saasfunnels 0.3.0 → 0.3.2

package/dist/saasfunnels.js

@@ -8649,7 +8649,7 @@ ${lanes.join("\n")}
             writeOutputIsTTY() {
               return process.stdout.isTTY;
             },
-            readFile: readFile6,
+            readFile: readFile7,
             writeFile: writeFile22,
             watchFile: watchFile2,
             watchDirectory,
@@ -8690,9 +8690,9 @@ ${lanes.join("\n")}
               return process.memoryUsage().heapUsed;
             },
             getFileSize(path) {
-              const stat4 = statSync(path);
-              if (stat4 == null ? void 0 : stat4.isFile()) {
-                return stat4.size;
+              const stat = statSync(path);
+              if (stat == null ? void 0 : stat.isFile()) {
+                return stat.size;
               }
               return 0;
             },
@@ -8855,7 +8855,7 @@ ${lanes.join("\n")}
               callback
             );
           }
-          function readFile6(fileName, _encoding) {
+          function readFile7(fileName, _encoding) {
             let buffer;
             try {
               buffer = _fs.readFileSync(fileName);
@@ -8910,19 +8910,19 @@ ${lanes.join("\n")}
                 if (entry === "." || entry === "..") {
                   continue;
                 }
-                let stat4;
+                let stat;
                 if (typeof dirent === "string" || dirent.isSymbolicLink()) {
                   const name = combinePaths(path, entry);
-                  stat4 = statSync(name);
-                  if (!stat4) {
+                  stat = statSync(name);
+                  if (!stat) {
                     continue;
                   }
                 } else {
-                  stat4 = dirent;
+                  stat = dirent;
                 }
-                if (stat4.isFile()) {
+                if (stat.isFile()) {
                   files.push(entry);
-                } else if (stat4.isDirectory()) {
+                } else if (stat.isDirectory()) {
                   directories.push(entry);
                 }
               }
@@ -8937,15 +8937,15 @@ ${lanes.join("\n")}
             return matchFiles(path, extensions, excludes, includes, useCaseSensitiveFileNames2, process.cwd(), depth, getAccessibleFileSystemEntries, realpath);
           }
           function fileSystemEntryExists(path, entryKind) {
-            const stat4 = statSync(path);
-            if (!stat4) {
+            const stat = statSync(path);
+            if (!stat) {
               return false;
             }
             switch (entryKind) {
               case 0:
-                return stat4.isFile();
+                return stat.isFile();
               case 1:
-                return stat4.isDirectory();
+                return stat.isDirectory();
               default:
                 return false;
             }
@@ -45538,7 +45538,7 @@ ${lanes.join("\n")}
         const possibleOption = getSpellingSuggestion(unknownOption, diagnostics.optionDeclarations, getOptionName);
         return possibleOption ? createDiagnosticForNodeInSourceFileOrCompilerDiagnostic(sourceFile, node, diagnostics.unknownDidYouMeanDiagnostic, unknownOptionErrorText || unknownOption, possibleOption.name) : createDiagnosticForNodeInSourceFileOrCompilerDiagnostic(sourceFile, node, diagnostics.unknownOptionDiagnostic, unknownOptionErrorText || unknownOption);
       }
-      function parseCommandLineWorker(diagnostics, commandLine, readFile6) {
+      function parseCommandLineWorker(diagnostics, commandLine, readFile7) {
         const options = {};
         let watchOptions;
         const fileNames = [];
@@ -45586,7 +45586,7 @@ ${lanes.join("\n")}
           }
         }
         function parseResponseFile(fileName) {
-          const text = tryReadFile(fileName, readFile6 || ((fileName2) => sys.readFile(fileName2)));
+          const text = tryReadFile(fileName, readFile7 || ((fileName2) => sys.readFile(fileName2)));
           if (!isString(text)) {
             errors.push(text);
             return;
@@ -45689,8 +45689,8 @@ ${lanes.join("\n")}
         unknownDidYouMeanDiagnostic: Diagnostics.Unknown_compiler_option_0_Did_you_mean_1,
         optionTypeMismatchDiagnostic: Diagnostics.Compiler_option_0_expects_an_argument
       };
-      function parseCommandLine(commandLine, readFile6) {
-        return parseCommandLineWorker(compilerOptionsDidYouMeanDiagnostics, commandLine, readFile6);
+      function parseCommandLine(commandLine, readFile7) {
+        return parseCommandLineWorker(compilerOptionsDidYouMeanDiagnostics, commandLine, readFile7);
       }
       function getOptionFromName(optionName, allowShort) {
         return getOptionDeclarationFromName(getOptionsNameMap, optionName, allowShort);
@@ -45772,8 +45772,8 @@ ${lanes.join("\n")}
           watchOptionsToExtend
         );
       }
-      function readConfigFile(fileName, readFile6) {
-        const textOrDiagnostic = tryReadFile(fileName, readFile6);
+      function readConfigFile(fileName, readFile7) {
+        const textOrDiagnostic = tryReadFile(fileName, readFile7);
         return isString(textOrDiagnostic) ? parseConfigFileTextToJson(fileName, textOrDiagnostic) : { config: {}, error: textOrDiagnostic };
       }
       function parseConfigFileTextToJson(fileName, jsonText) {
@@ -45788,14 +45788,14 @@ ${lanes.join("\n")}
           error: jsonSourceFile.parseDiagnostics.length ? jsonSourceFile.parseDiagnostics[0] : void 0
         };
       }
-      function readJsonConfigFile(fileName, readFile6) {
-        const textOrDiagnostic = tryReadFile(fileName, readFile6);
+      function readJsonConfigFile(fileName, readFile7) {
+        const textOrDiagnostic = tryReadFile(fileName, readFile7);
         return isString(textOrDiagnostic) ? parseJsonText(fileName, textOrDiagnostic) : { fileName, parseDiagnostics: [textOrDiagnostic] };
       }
-      function tryReadFile(fileName, readFile6) {
+      function tryReadFile(fileName, readFile7) {
         let text;
         try {
-          text = readFile6(fileName);
+          text = readFile7(fileName);
         } catch (e) {
           return createCompilerDiagnostic(Diagnostics.Cannot_read_file_0_Colon_1, fileName, e.message);
         }
@@ -124332,7 +124332,7 @@ ${lanes.join("\n")}
           }
         }
         function createImportCallExpressionAMD(arg, containsLexicalThis) {
-          const resolve5 = factory2.createUniqueName("resolve");
+          const resolve6 = factory2.createUniqueName("resolve");
           const reject = factory2.createUniqueName("reject");
           const parameters = [
             factory2.createParameterDeclaration(
@@ -124341,7 +124341,7 @@ ${lanes.join("\n")}
               /*dotDotDotToken*/
               void 0,
               /*name*/
-              resolve5
+              resolve6
             ),
             factory2.createParameterDeclaration(
               /*modifiers*/
@@ -124358,7 +124358,7 @@ ${lanes.join("\n")}
                 factory2.createIdentifier("require"),
                 /*typeArguments*/
                 void 0,
-                [factory2.createArrayLiteralExpression([arg || factory2.createOmittedExpression()]), resolve5, reject]
+                [factory2.createArrayLiteralExpression([arg || factory2.createOmittedExpression()]), resolve6, reject]
               )
             )
           ]);
@@ -135899,12 +135899,12 @@ ${lanes.join("\n")}
       function createCompilerHost(options, setParentNodes) {
         return createCompilerHostWorker(options, setParentNodes);
       }
-      function createGetSourceFile(readFile6, setParentNodes) {
+      function createGetSourceFile(readFile7, setParentNodes) {
         return (fileName, languageVersionOrOptions, onError) => {
           let text;
           try {
             mark("beforeIORead");
-            text = readFile6(fileName);
+            text = readFile7(fileName);
             mark("afterIORead");
             measure("I/O Read", "beforeIORead", "afterIORead");
           } catch (e) {
@@ -136808,7 +136808,7 @@ ${lanes.join("\n")}
           getRedirectFromOutput,
           forEachResolvedProjectReference: forEachResolvedProjectReference2
         });
-        const readFile6 = host.readFile.bind(host);
+        const readFile7 = host.readFile.bind(host);
         (_e = tracing) == null ? void 0 : _e.push(tracing.Phase.Program, "shouldProgramCreateNewSourceFiles", { hasOldProgram: !!oldProgram });
         const shouldCreateNewSourceFile = shouldProgramCreateNewSourceFiles(oldProgram, options);
         (_f = tracing) == null ? void 0 : _f.pop();
@@ -137029,7 +137029,7 @@ ${lanes.join("\n")}
           shouldTransformImportCall,
           emitBuildInfo,
           fileExists,
-          readFile: readFile6,
+          readFile: readFile7,
           directoryExists,
           getSymlinkCache,
           realpath: (_o = host.realpath) == null ? void 0 : _o.bind(host),
@@ -211289,8 +211289,8 @@ Additional information: BADCLIENT: Bad error code, ${badCode} not found in range
         installPackage(options) {
           this.packageInstallId++;
           const request = { kind: "installPackage", ...options, id: this.packageInstallId };
-          const promise2 = new Promise((resolve5, reject) => {
-            (this.packageInstalledPromise ?? (this.packageInstalledPromise = /* @__PURE__ */ new Map())).set(this.packageInstallId, { resolve: resolve5, reject });
+          const promise2 = new Promise((resolve6, reject) => {
+            (this.packageInstalledPromise ?? (this.packageInstalledPromise = /* @__PURE__ */ new Map())).set(this.packageInstallId, { resolve: resolve6, reject });
           });
           this.installer.send(request);
           return promise2;
@@ -218902,14 +218902,66 @@ var require_dist = __commonJS({
 // src/saasfunnels.ts
 import { createInterface as createInterface2 } from "node:readline/promises";
 
+// src/setup-access.ts
+import { execFile } from "node:child_process";
+import { readFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import { parseEnv, promisify } from "node:util";
+var exec = promisify(execFile);
+async function resolveSetupAccess(options) {
+  if (options.key?.trim()) return { key: options.key.trim() };
+  let file2 = options.envFile;
+  if (!file2 && options.prompt) {
+    const choice = (await options.prompt(
+      "Developer access is not loaded. Where did you save SAASFUNNELS_API_KEY?\n  1. Doppler (this folder\u2019s configured project)\n  2. .env.local in this app\n  3. I haven\u2019t saved it yet\nChoose [1/2/3]: "
+    )).trim();
+    if (choice === "1") {
+      try {
+        const key2 = options.loadDoppler ? await options.loadDoppler() : (await exec("doppler", ["secrets", "get", "SAASFUNNELS_API_KEY", "--plain"], {
+          cwd: options.cwd,
+          timeout: 3e4,
+          maxBuffer: 64e3
+        })).stdout;
+        if (key2.trim()) return { key: key2.trim() };
+      } catch {
+      }
+      return { error: "Couldn\u2019t load developer access from Doppler. Check this folder\u2019s Doppler project/config and save SAASFUNNELS_API_KEY there, then rerun this command." };
+    }
+    if (choice === "2") file2 = ".env.local";
+  }
+  if (file2) {
+    try {
+      const source = await readFile(resolve(options.cwd, file2), "utf8");
+      if (source.length > 64e3) throw new Error("Oversized env file");
+      const key2 = parseEnv(source).SAASFUNNELS_API_KEY?.trim();
+      if (key2) return { key: key2 };
+    } catch {
+    }
+    return { error: "Couldn\u2019t find SAASFUNNELS_API_KEY in the selected env file. Save the developer access key there, then rerun this command. No file was changed." };
+  }
+  return { error: "Open SaaSFunnels \u2192 Setup \u2192 Environment values \u2192 Developer setup access. Save SAASFUNNELS_API_KEY in your secret manager or .env.local, then run npx --yes saasfunnels@latest setup again. Never paste the key into a command. For automation, load it into the process or use --env-file .env.local." };
+}
+
 // src/cli.ts
-import { dirname as dirname3, join as join5, resolve as resolve4 } from "node:path";
+import { dirname as dirname3, join as join5, resolve as resolve5 } from "node:path";
 
 // src/setup-pricing.ts
 var import_typescript = __toESM(require_typescript(), 1);
 var import_yaml = __toESM(require_dist(), 1);
+var PricingExtractionError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+  code;
+};
+var unsupported = () => new PricingExtractionError(
+  "needs_review",
+  "Pricing contains a value that needs developer review."
+);
 var object = (v) => v !== null && typeof v === "object" && !Array.isArray(v) ? v : null;
 var safeKey = (v) => typeof v === "string" && /^[a-z][a-z0-9_.-]{0,79}$/.test(v);
+var safeProperty = (key2) => !["__proto__", "constructor", "prototype"].includes(key2);
 function declarations(source) {
   const file2 = import_typescript.default.createSourceFile(
     "pricing.ts",
@@ -218920,47 +218972,107 @@ function declarations(source) {
   );
   const values = /* @__PURE__ */ new Map();
   const roots = [];
+  const planName = /^(plans?|pricing|tiers?|billingCatalog|planCatalog|subscriptionPlans)$/i;
+  const containsAccess = (node, fields = /^(features|capabilities|quotas)$/) => {
+    if (import_typescript.default.isPropertyAssignment(node) && fields.test(node.name.getText(file2).replace(/["']/g, "")))
+      return true;
+    return import_typescript.default.forEachChild(
+      node,
+      (child) => containsAccess(child, fields) ? true : void 0
+    ) ?? false;
+  };
   for (const statement of file2.statements) {
     if (import_typescript.default.isVariableStatement(statement))
       for (const declaration of statement.declarationList.declarations) {
         if (import_typescript.default.isIdentifier(declaration.name) && declaration.initializer) {
           values.set(declaration.name.text, declaration.initializer);
-          roots.push(declaration.initializer);
+          if (planName.test(declaration.name.text) || containsAccess(declaration.initializer) && containsAccess(
+            declaration.initializer,
+            /^(prices|stripePriceId)$/
+          ))
+            roots.push(declaration.initializer);
         }
       }
-    if (import_typescript.default.isExportAssignment(statement)) roots.push(statement.expression);
+    if (import_typescript.default.isExportAssignment(statement) && containsAccess(statement.expression))
+      roots.push(statement.expression);
   }
-  function read(node, depth = 0) {
-    if (depth > 20) throw new Error("Unsupported pricing expression");
+  function read(node, depth = 0, locals = /* @__PURE__ */ new Map()) {
+    if (depth > 30) throw unsupported();
+    const next = (value) => read(value, depth + 1, locals);
     if (import_typescript.default.isAsExpression(node) || import_typescript.default.isSatisfiesExpression(node) || import_typescript.default.isParenthesizedExpression(node))
-      return read(node.expression, depth + 1);
+      return next(node.expression);
     if (import_typescript.default.isStringLiteral(node) || import_typescript.default.isNoSubstitutionTemplateLiteral(node))
       return node.text;
-    if (import_typescript.default.isNumericLiteral(node)) return Number(node.text);
+    if (import_typescript.default.isNumericLiteral(node)) return Number(node.text.replaceAll("_", ""));
     if (node.kind === import_typescript.default.SyntaxKind.TrueKeyword) return true;
     if (node.kind === import_typescript.default.SyntaxKind.FalseKeyword) return false;
-    if (import_typescript.default.isIdentifier(node) && values.has(node.text))
-      return read(values.get(node.text), depth + 1);
+    if (import_typescript.default.isIdentifier(node)) {
+      if (locals.has(node.text)) return locals.get(node.text);
+      if (values.has(node.text)) return next(values.get(node.text));
+    }
     if (import_typescript.default.isArrayLiteralExpression(node))
-      return node.elements.map((n) => read(n, depth + 1));
+      return node.elements.flatMap((n) => {
+        if (!import_typescript.default.isSpreadElement(n)) return [next(n)];
+        const spread = next(n.expression);
+        if (!Array.isArray(spread)) throw unsupported();
+        return spread;
+      });
     if (import_typescript.default.isObjectLiteralExpression(node)) {
       const result3 = /* @__PURE__ */ Object.create(null);
       for (const property of node.properties) {
+        if (import_typescript.default.isSpreadAssignment(property)) {
+          const spread = object(next(property.expression));
+          if (!spread) throw unsupported();
+          Object.assign(result3, spread);
+          continue;
+        }
         if (!import_typescript.default.isPropertyAssignment(property) || import_typescript.default.isComputedPropertyName(property.name))
-          throw new Error("Unsupported pricing expression");
-        result3[property.name.getText(file2).replace(/^["']|["']$/g, "")] = read(
-          property.initializer,
-          depth + 1
-        );
+          throw unsupported();
+        const key2 = property.name.getText(file2).replace(/^["']|["']$/g, "");
+        if (!safeProperty(key2)) throw unsupported();
+        result3[key2] = next(property.initializer);
       }
       return result3;
     }
-    throw new Error("Unsupported pricing expression");
+    if (import_typescript.default.isCallExpression(node) && import_typescript.default.isPropertyAccessExpression(node.expression)) {
+      const callee = node.expression;
+      if (import_typescript.default.isIdentifier(callee.expression) && callee.expression.text === "Object" && !values.has("Object") && callee.name.text === "fromEntries" && node.arguments.length === 1) {
+        const entries = next(node.arguments[0]);
+        if (!Array.isArray(entries) || entries.length > 1e4)
+          throw unsupported();
+        const result3 = /* @__PURE__ */ Object.create(null);
+        for (const entry of entries) {
+          if (!Array.isArray(entry) || entry.length !== 2 || typeof entry[0] !== "string" || !safeProperty(entry[0]))
+            throw unsupported();
+          result3[entry[0]] = entry[1];
+        }
+        return result3;
+      }
+      if (callee.name.text === "map" && node.arguments.length === 1) {
+        const array2 = next(callee.expression);
+        const callback = node.arguments[0];
+        if (!Array.isArray(array2) || array2.length > 1e4 || !import_typescript.default.isArrowFunction(callback) || callback.parameters.length !== 1 || !import_typescript.default.isIdentifier(callback.parameters[0].name) || import_typescript.default.isBlock(callback.body))
+          throw unsupported();
+        const parameter = callback.parameters[0].name.text;
+        return array2.map(
+          (value) => read(
+            callback.body,
+            depth + 1,
+            new Map([...locals, [parameter, value]])
+          )
+        );
+      }
+    }
+    throw unsupported();
   }
   return roots.map((node) => read(node));
 }
-function extractSetupPricing(source, kind) {
-  if (source.length > 512e3) throw new Error("Pricing file exceeds limit");
+function extractSetupPricing(source, kind, catalogPrices = []) {
+  if (source.length > 2e6)
+    throw new PricingExtractionError(
+      "needs_review",
+      "Pricing file exceeds the 2 MB per-file limit."
+    );
   const documents = kind === "typescript" ? declarations(source) : kind === "json" ? [JSON.parse(source)] : [
     (0, import_yaml.parseDocument)(source, { uniqueKeys: true }).toJS({
       maxAliasCount: 10
@@ -218968,8 +219080,7 @@ function extractSetupPricing(source, kind) {
   ];
   const plans = /* @__PURE__ */ new Map();
   for (const doc of documents) {
-    const root = object(doc);
-    const candidate = root?.plans ?? doc;
+    const candidate = object(doc)?.plans ?? doc;
     const rows = Array.isArray(candidate) ? candidate : object(candidate) ? Object.entries(candidate).map(
       ([key2, value]) => ({ key: key2, ...object(value) })
     ) : [];
@@ -218980,30 +219091,45 @@ function extractSetupPricing(source, kind) {
       const name = row.name ?? row.displayName ?? key2;
       if (!safeKey(key2) || typeof name !== "string" || !name.length || name.length > 120)
         continue;
-      if (!("features" in row) && !("prices" in row) && !("stripePriceId" in row) && !("productKey" in row))
+      if (![
+        "features",
+        "capabilities",
+        "quotas",
+        "prices",
+        "stripePriceId",
+        "productKey"
+      ].some((k) => k in row))
         continue;
-      const features = {};
-      const rawFeatures = object(row.features);
-      if (rawFeatures)
-        for (const [feature, access2] of Object.entries(rawFeatures)) {
-          if (!safeKey(feature) || !(typeof access2 === "boolean" || typeof access2 === "number" && Number.isFinite(access2) && access2 >= 0))
-            throw new Error("Feature access needs manual review");
+      const features = /* @__PURE__ */ Object.create(null);
+      for (const field of ["features", "capabilities", "quotas"]) {
+        const raw = row[field];
+        const entries = object(raw) ? Object.entries(raw) : Array.isArray(raw) && raw.every(safeKey) ? raw.map((key3) => [key3, true]) : raw === void 0 ? [] : null;
+        if (!entries) throw unsupported();
+        for (const [feature, access2] of entries) {
+          if (!safeKey(feature) || !safeProperty(feature) || !(typeof access2 === "boolean" || access2 === "unlimited" || typeof access2 === "number" && Number.isFinite(access2) && access2 >= 0))
+            throw unsupported();
+          if (features[feature] === false && access2 !== false)
+            throw unsupported();
           features[feature] = access2;
         }
-      else if (Array.isArray(row.features) && row.features.every(safeKey)) {
-        for (const feature of row.features) features[feature] = true;
-      } else if (row.features !== void 0)
-        throw new Error("Feature access needs manual review");
-      const rawPrices = Array.isArray(row.prices) ? row.prices : row.stripePriceId ?? row.priceId ? [{ key: row.stripePriceId ?? row.priceId }] : [];
+      }
+      const rawPrices = Array.isArray(row.prices) ? row.prices : object(row.prices) ? Object.values(row.prices) : row.stripePriceId ?? row.priceId ? [{ key: row.stripePriceId ?? row.priceId }] : [];
       const prices = rawPrices.map((value2) => {
         const price = typeof value2 === "string" ? value2 : object(value2)?.key ?? object(value2)?.stripePriceId;
-        if (typeof price !== "string" || !/^price_[A-Za-z0-9]+$/.test(price))
-          throw new Error("Price needs manual review");
-        return { key: price };
+        if (typeof price === "string" && /^price_[A-Za-z0-9]+$/.test(price))
+          return { key: price };
+        const lookup = object(value2)?.lookupKey ?? object(value2)?.lookup_key;
+        const matches = typeof lookup === "string" ? catalogPrices.filter((p) => p.lookupKey === lookup) : [];
+        if (matches.length !== 1)
+          throw new PricingExtractionError(
+            "needs_review",
+            "A Stripe lookup key has no unique match in the connected catalog."
+          );
+        return { key: matches[0].id };
       });
       const productKey = row.productKey ?? row.stripeProductId;
       if (productKey !== void 0 && (typeof productKey !== "string" || !/^prod_[A-Za-z0-9]+$/.test(productKey)))
-        throw new Error("Product needs manual review");
+        throw unsupported();
       const plan = {
         key: key2,
         name,
@@ -219012,20 +219138,31 @@ function extractSetupPricing(source, kind) {
         ...typeof productKey === "string" ? { productKey } : {}
       };
       if (plans.has(key2) && JSON.stringify(plans.get(key2)) !== JSON.stringify(plan))
-        throw new Error("Conflicting plan declarations");
+        throw new PricingExtractionError(
+          "needs_review",
+          "Conflicting plan declarations."
+        );
       plans.set(key2, plan);
     }
   }
-  if (!plans.size) throw new Error("No supported pricing declaration found");
-  if (plans.size > 200) throw new Error("Too many pricing declarations");
+  if (!plans.size)
+    throw new PricingExtractionError(
+      "no_declarations",
+      "No supported pricing declaration found."
+    );
+  if (plans.size > 200)
+    throw new PricingExtractionError(
+      "needs_review",
+      "More than 200 plan declarations need review."
+    );
   return [...plans.values()];
 }
 
 // src/setup-run.ts
 import { createHash as createHash3 } from "node:crypto";
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
-import { readFile as readFile4, writeFile as writeFile3, mkdir as mkdir3 } from "node:fs/promises";
+import { execFile as execFile2 } from "node:child_process";
+import { promisify as promisify2 } from "node:util";
+import { readFile as readFile5, writeFile as writeFile3, mkdir as mkdir3 } from "node:fs/promises";
 import { join as join4 } from "node:path";
 
 // node_modules/zod/v4/classic/external.js
@@ -233548,14 +233685,14 @@ import { createHash as createHash2, randomUUID } from "node:crypto";
 import {
   access,
   mkdir,
-  readFile,
+  readFile as readFile2,
   readdir,
   rename,
   rm,
-  stat,
+  lstat,
   writeFile
 } from "node:fs/promises";
-import { dirname, extname, join, relative, resolve } from "node:path";
+import { dirname, extname, join, relative, resolve as resolve2 } from "node:path";
 
 // src/runtime-contracts.js
 import { createHash } from "node:crypto";
@@ -235702,7 +235839,17 @@ var featureBindingKinds = [
   "funnel_trigger",
   "discovery"
 ];
-var defaultRoots = ["app", "src", "lib", "components", "pages"];
+var defaultRoots = [
+  "app",
+  "src",
+  "lib",
+  "components",
+  "pages",
+  "apps",
+  "packages",
+  "server",
+  "client"
+];
 var ignoredSegments = /* @__PURE__ */ new Set([
   ".claude",
   ".git",
@@ -235711,6 +235858,13 @@ var ignoredSegments = /* @__PURE__ */ new Set([
   ".turbo",
   "build",
   "coverage",
+  ".saasfunnels",
+  "docs",
+  "e2e",
+  "fixtures",
+  "__tests__",
+  "tests",
+  "__mocks__",
   "dist",
   "generated",
   "node_modules",
@@ -235809,21 +235963,29 @@ function allowedPath(path, excludes) {
   const normalized = path.replaceAll("\\", "/");
   if (sensitivePathPattern.test(normalized)) return false;
   const segments = normalized.split("/");
-  if (segments.some((segment) => ignoredSegments.has(segment))) return false;
+  if (segments.some(
+    (segment) => ignoredSegments.has(segment) || /^\.next(?:[-.]|$)/.test(segment)
+  ))
+    return false;
+  if (/\.(test|spec|stories|d)\.[cm]?[jt]sx?$/.test(normalized)) return false;
   return !excludes.some(
     (exclude) => normalized === exclude || normalized.startsWith(`${exclude}/`)
   );
 }
 async function walkFiles(input) {
   const files = [];
-  const queue = input.roots.map((root) => resolve(input.cwd, root));
-  while (queue.length && files.length < 500) {
+  const queue = input.roots.map((root) => resolve2(input.cwd, root));
+  const seen = /* @__PURE__ */ new Set();
+  let oversizedFileCount = 0;
+  while (queue.length) {
     const current = queue.shift();
+    if (seen.has(current)) continue;
+    seen.add(current);
     const relativePath = safeRelative(input.cwd, current);
     if (!relativePath || !allowedPath(relativePath, input.excludes)) continue;
     let currentStat;
     try {
-      currentStat = await stat(current);
+      currentStat = await lstat(current);
     } catch {
       continue;
     }
@@ -235832,11 +235994,15 @@ async function walkFiles(input) {
       entries.sort((left, right) => left.name.localeCompare(right.name)).forEach((entry) => queue.push(join(current, entry.name)));
       continue;
     }
-    if (currentStat.isFile() && currentStat.size <= 256e3 && supportedExtensions.has(extname(current))) {
+    if (currentStat.isFile() && supportedExtensions.has(extname(current))) {
+      if (currentStat.size > 2e6) {
+        oversizedFileCount++;
+        continue;
+      }
       files.push(current);
     }
   }
-  return files.sort();
+  return { files: files.sort(), oversizedFileCount };
 }
 function nearestSymbol(lines, lineIndex) {
   for (let index = lineIndex; index >= Math.max(0, lineIndex - 20); index -= 1) {
@@ -235938,7 +236104,7 @@ function candidatesFromFile(path, source) {
 async function detectFramework(cwd2, requestedRoots) {
   let packageJson = {};
   try {
-    packageJson = JSON.parse(await readFile(join(cwd2, "package.json"), "utf8"));
+    packageJson = JSON.parse(await readFile2(join(cwd2, "package.json"), "utf8"));
   } catch {
   }
   const dependencies = {
@@ -235947,15 +236113,19 @@ async function detectFramework(cwd2, requestedRoots) {
   };
   const framework = typeof dependencies.next === "string" ? "nextjs" : "unsupported";
   const packageManager = await exists(join(cwd2, "pnpm-lock.yaml")) ? "pnpm" : await exists(join(cwd2, "yarn.lock")) ? "yarn" : await exists(join(cwd2, "bun.lockb")) || await exists(join(cwd2, "bun.lock")) ? "bun" : await exists(join(cwd2, "package-lock.json")) ? "npm" : "unknown";
-  const roots = (requestedRoots?.length ? requestedRoots : defaultRoots).filter((root) => !root.startsWith("../") && !root.startsWith("/"));
+  const roots = (requestedRoots?.length ? requestedRoots : defaultRoots).filter(
+    (root) => !root.startsWith("../") && !root.startsWith("/")
+  );
   const existingRoots = [];
   for (const root of roots) {
-    if (await exists(resolve(cwd2, root))) existingRoots.push(root);
+    if (await exists(resolve2(cwd2, root))) existingRoots.push(root);
   }
   return {
     framework,
     packageManager,
-    saasFunnelsPackages: Object.keys(dependencies).filter((name) => name === "saasfunnels" || name.startsWith("@saasfunnels/")).sort(),
+    saasFunnelsPackages: Object.keys(dependencies).filter(
+      (name) => name === "saasfunnels" || name.startsWith("@saasfunnels/")
+    ).sort(),
     roots: existingRoots
   };
 }
@@ -236042,7 +236212,7 @@ export type SaaSFunnelsFeatureKey =
 }
 async function readable(path) {
   try {
-    return await readFile(path, "utf8");
+    return await readFile2(path, "utf8");
   } catch {
     return null;
   }
@@ -236059,14 +236229,19 @@ async function applyFeatureSetupChangesAtomically(cwd2, changes, io = {
   const staged = [];
   try {
     for (const change of changes) {
-      const absolute = resolve(cwd2, change.path);
+      const absolute = resolve2(cwd2, change.path);
       const relativePath = safeRelative(cwd2, absolute);
       if (!relativePath)
-        throw new Error(`Refusing to write outside the repository: ${change.path}`);
+        throw new Error(
+          `Refusing to write outside the repository: ${change.path}`
+        );
       await io.mkdir(dirname(absolute), { recursive: true });
       originals.set(absolute, await io.read(absolute));
       const stagedPath = `${absolute}.saasfunnels-${transactionId}.tmp`;
-      await io.write(stagedPath, change.contents, { encoding: "utf8", mode: 384 });
+      await io.write(stagedPath, change.contents, {
+        encoding: "utf8",
+        mode: 384
+      });
       staged.push({ absolute, staged: stagedPath });
     }
     for (const entry of staged) await io.rename(entry.staged, entry.absolute);
@@ -236169,7 +236344,7 @@ async function runFeatureRuntimeCheck(input) {
   }
 }
 async function runFeatureSetup(input) {
-  if (input.environment !== "test") {
+  if (input.environment !== "test" && !(input.manifestOnly && !input.apply && !input.prompt)) {
     throw new Error(
       "Feature setup is Test-only. Review and promote Feature catalogs from Stripe Products."
     );
@@ -236180,22 +236355,26 @@ async function runFeatureSetup(input) {
       `Inspect these local roots only: ${framework.roots.join(", ") || "none"}? [y/N] `
     );
     if (!/^y(?:es)?$/i.test(confirmation.trim())) {
-      throw new Error("Feature discovery was cancelled before reading source files.");
+      throw new Error(
+        "Feature discovery was cancelled before reading source files."
+      );
     }
   }
-  const files = await walkFiles({
+  const { files, oversizedFileCount } = await walkFiles({
     cwd: input.cwd,
     excludes: input.exclude ?? [],
     roots: framework.roots
   });
   const discovered = [];
   let scannedBytes = 0;
+  let scannedFileCount = 0;
+  const byteLimitReached = oversizedFileCount > 0;
   for (const file2 of files) {
-    const source = await readFile(file2, "utf8");
+    const source = await readFile2(file2, "utf8");
     scannedBytes += Buffer.byteLength(source);
-    if (scannedBytes > 2e6) break;
     const path = safeRelative(input.cwd, file2);
     if (!path) continue;
+    scannedFileCount++;
     discovered.push(...candidatesFromFile(path, source));
   }
   const uniqueCandidates = /* @__PURE__ */ new Map();
@@ -236203,12 +236382,17 @@ async function runFeatureSetup(input) {
     (left, right) => right.confidenceBasisPoints - left.confidenceBasisPoints || left.file.localeCompare(right.file) || left.line - right.line
   )) {
     const identity = `${candidate.suggestedKey}:${candidate.accessModel}:${candidate.file}:${candidate.line}`;
-    if (!uniqueCandidates.has(identity)) uniqueCandidates.set(identity, candidate);
+    if (!uniqueCandidates.has(identity))
+      uniqueCandidates.set(identity, candidate);
   }
-  const candidates = [...uniqueCandidates.values()].slice(0, 200);
+  const candidates = [...uniqueCandidates.values()];
+  if (new Set(candidates.map((candidate) => candidate.suggestedKey)).size > 5e3)
+    throw new Error(
+      "Feature discovery found more than 5,000 distinct features. Narrow the source roots before retrying."
+    );
   const manifestPath = ".saasfunnels/catalog.yaml";
   const existingManifestSource = await readable(
-    resolve(input.cwd, manifestPath)
+    resolve2(input.cwd, manifestPath)
   );
   const existingManifestValidation = existingManifestSource ? parseFeatureManifestSource(existingManifestSource) : null;
   if (existingManifestValidation && !existingManifestValidation.ok) {
@@ -236225,7 +236409,8 @@ async function runFeatureSetup(input) {
   const accept = new Set(input.accept ?? []);
   const reject = new Set(input.reject ?? []);
   for (const candidate of candidates) {
-    if (reject.has(candidate.id) || reject.has(candidate.suggestedKey)) continue;
+    if (reject.has(candidate.id) || reject.has(candidate.suggestedKey))
+      continue;
     if (accept.has("all") || accept.has(candidate.id) || accept.has(candidate.suggestedKey)) {
       accepted.add(candidate.id);
       continue;
@@ -236239,7 +236424,10 @@ async function runFeatureSetup(input) {
       if (/^a(?:ccept)?$/i.test(answer.trim())) accepted.add(candidate.id);
       else if (keyPattern.test(answer.trim())) {
         accepted.add(candidate.id);
-        input.mappings = { ...input.mappings ?? {}, [candidate.id]: answer.trim() };
+        input.mappings = {
+          ...input.mappings ?? {},
+          [candidate.id]: answer.trim()
+        };
       }
     }
   }
@@ -236263,7 +236451,7 @@ async function runFeatureSetup(input) {
   const existingManifest = existingManifestSource;
   const constantsPath = ".saasfunnels/features.ts";
   const constantsContents = generatedConstants(manifest);
-  const existingConstants = await readable(resolve(input.cwd, constantsPath));
+  const existingConstants = await readable(resolve2(input.cwd, constantsPath));
   const constantsSafe = existingConstants === null || existingConstants.startsWith(generatedMarker);
   const editInputs = [
     {
@@ -236373,7 +236561,16 @@ async function runFeatureSetup(input) {
     ok: validation.ok,
     reviewUrl,
     runtimeCheck: check2,
-    scannedFileCount: files.length,
+    scannedFileCount,
+    coverage: {
+      complete: scannedFileCount > 0 && !byteLimitReached && uniqueCandidates.size <= 1e4,
+      matchedFiles: files.length + oversizedFileCount,
+      scannedFiles: scannedFileCount,
+      scannedBytes,
+      oversizedFileCount,
+      byteLimitReached,
+      candidateLimitReached: uniqueCandidates.size > 1e4
+    },
     validation: { errors: validation.errors, ok: validation.ok }
   };
 }
@@ -236455,8 +236652,8 @@ Applied reviewed edits. Change record: ${result3.changeRecordPath}` : result3.id
 }
 
 // src/plan-sources.ts
-import { readFile as readFile2, readdir as readdir2, stat as stat2, writeFile as writeFile2, mkdir as mkdir2 } from "node:fs/promises";
-import { dirname as dirname2, extname as extname2, join as join2, relative as relative2, resolve as resolve2, sep } from "node:path";
+import { readFile as readFile3, readdir as readdir2, lstat as lstat2, writeFile as writeFile2, mkdir as mkdir2 } from "node:fs/promises";
+import { dirname as dirname2, extname as extname2, join as join2, relative as relative2, resolve as resolve3, sep } from "node:path";
 var planSourceApprovalPath = ".saasfunnels/plan-sources.json";
 var maxPlanSourceFiles = 12;
 var maxPlanSourceCharacters = 512e3;
@@ -236486,10 +236683,9 @@ var planSourceKindByExtension = /* @__PURE__ */ new Map([
   [".yml", "yaml"]
 ]);
 var billingIntervalPattern = /\b(month|monthly|year|yearly|annual|annually|week|weekly|day|daily|recurring|interval|billing_period)\b/i;
-var chargeAmountPattern = /\b(unit_amount|unit_amount_decimal|amount|amount_decimal|price|prices|currency|usd|eur|gbp|cents)\b/i;
+var chargeAmountPattern = /\b(unit_amount|unit_amount_decimal|unitAmount|amount|amount_decimal|price|prices|currency|usd|eur|gbp|cents)\b/i;
 var stripePriceIdPattern = /["'`]price_(?=[A-Za-z0-9]*\d)[A-Za-z0-9]{14,}["'`]/;
 var nonDefinitionPattern = /(^|\/)(__tests__|__mocks__|tests?|specs?)(\/)|\.(test|spec|d)\.[cm]?[jt]sx?$/i;
-var maxNamedOnlyCandidates = 10;
 function normalize(path) {
   return path.split(sep).join("/");
 }
@@ -236513,8 +236709,8 @@ async function discoverPlanSourceCandidates(input) {
   const roots = input.roots ?? [".", "config", ...defaultRoots];
   const seen = /* @__PURE__ */ new Set();
   const candidates = [];
-  const queue = roots.map((root) => resolve2(input.cwd, root));
-  while (queue.length && candidates.length < 200) {
+  const queue = roots.map((root) => resolve3(input.cwd, root));
+  while (queue.length) {
     const current = queue.shift();
     if (seen.has(current)) continue;
     seen.add(current);
@@ -236522,13 +236718,16 @@ async function discoverPlanSourceCandidates(input) {
     if (relativePath && !allowed(relativePath, excludes)) continue;
     let entryStat;
     try {
-      entryStat = await stat2(current);
+      entryStat = await lstat2(current);
     } catch {
       continue;
     }
+    if (entryStat.isSymbolicLink()) continue;
     if (entryStat.isDirectory()) {
       const entries = await readdir2(current, { withFileTypes: true });
-      for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+      for (const entry of entries.sort(
+        (a, b) => a.name.localeCompare(b.name)
+      )) {
         queue.push(join2(current, entry.name));
       }
       continue;
@@ -236536,8 +236735,14 @@ async function discoverPlanSourceCandidates(input) {
     if (!entryStat.isFile()) continue;
     const kind = planSourceKindByExtension.get(extname2(current).toLowerCase());
     if (!kind || !relativePath) continue;
-    if (entryStat.size > maxPlanSourceCharacters) continue;
-    const contents = await readFile2(current, "utf8");
+    if (entryStat.size > 2e6) {
+      if (looksLikePlanSource(relativePath))
+        throw new Error(
+          "Plan discovery found a pricing file above the 2 MB per-file limit. Split large pricing files before retrying."
+        );
+      continue;
+    }
+    const contents = await readFile3(current, "utf8");
     const hasStripePriceId = stripePriceIdPattern.test(contents);
     const named = looksLikePlanSource(relativePath);
     const looksPriced = billingIntervalPattern.test(contents) && chargeAmountPattern.test(contents);
@@ -236556,19 +236761,21 @@ async function discoverPlanSourceCandidates(input) {
   );
   const confirmed = sorted.filter((candidate) => candidate.hasStripePriceId);
   const namedOnly = sorted.filter((candidate) => !candidate.hasStripePriceId);
-  return [...confirmed, ...namedOnly.slice(0, maxNamedOnlyCandidates)];
+  return [...confirmed, ...namedOnly];
 }
 async function readApprovedPlanSources(cwd2) {
   try {
-    const raw = await readFile2(resolve2(cwd2, planSourceApprovalPath), "utf8");
+    const raw = await readFile3(resolve3(cwd2, planSourceApprovalPath), "utf8");
     const parsed = JSON.parse(raw);
-    return Array.isArray(parsed.files) ? parsed.files.filter((value) => typeof value === "string") : [];
+    return Array.isArray(parsed.files) ? parsed.files.filter(
+      (value) => typeof value === "string"
+    ) : [];
   } catch {
     return [];
   }
 }
 async function writeApprovedPlanSources(cwd2, files) {
-  const target = resolve2(cwd2, planSourceApprovalPath);
+  const target = resolve3(cwd2, planSourceApprovalPath);
   await mkdir2(dirname2(target), { recursive: true });
   await writeFile2(
     target,
@@ -236599,11 +236806,13 @@ async function buildPlanMappingHandoff(input) {
     if (!allowed(relativePath, [])) {
       throw new Error(`${relativePath} is not a readable plan source path.`);
     }
-    const kind = planSourceKindByExtension.get(extname2(relativePath).toLowerCase());
+    const kind = planSourceKindByExtension.get(
+      extname2(relativePath).toLowerCase()
+    );
     if (!kind) {
       throw new Error(`${relativePath} is not a supported plan source type.`);
     }
-    const content = await readFile2(resolve2(input.cwd, relativePath), "utf8");
+    const content = await readFile3(resolve3(input.cwd, relativePath), "utf8");
     if (content.length > maxPlanSourceCharacters) {
       throw new Error(
         `${relativePath} is ${content.length} characters; the limit is ${maxPlanSourceCharacters}.`
@@ -236619,8 +236828,8 @@ function planMappingRequestKey(input) {
 }
 
 // src/plan-branches.ts
-import { readdir as readdir3, readFile as readFile3, stat as stat3 } from "node:fs/promises";
-import { extname as extname3, join as join3, relative as relative3, resolve as resolve3, sep as sep2 } from "node:path";
+import { readdir as readdir3, readFile as readFile4, lstat as lstat3 } from "node:fs/promises";
+import { extname as extname3, join as join3, relative as relative3, resolve as resolve4, sep as sep2 } from "node:path";
 var maxPlanBranchFileCharacters = 2e6;
 var codeExtensions = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"]);
 var nonDefinitionPattern2 = /(^|\/)(__tests__|__mocks__|tests?|specs?|fixtures?|testing|mocks?|mock-data|stories|__stories__)(\/)|\.(test|spec|d|stories)\.[cm]?[jt]sx?$/i;
@@ -236749,7 +236958,9 @@ function clusterPlanBranches(branches) {
     return {
       branches: grouped,
       location: key2.slice(key2.indexOf("|") + 1),
-      planValues: [...new Set(grouped.map((branch) => branch.planValue))].sort(),
+      planValues: [
+        ...new Set(grouped.map((branch) => branch.planValue))
+      ].sort(),
       polarity: decided,
       shape: grouped[0].shape
     };
@@ -236768,7 +236979,7 @@ async function discoverPlanBranches(input) {
   const branches = [];
   const constants = /* @__PURE__ */ new Map();
   const pending = [];
-  const queue = roots.map((root) => resolve3(input.cwd, root));
+  const queue = roots.map((root) => resolve4(input.cwd, root));
   while (queue.length) {
     const current = queue.shift();
     if (seen.has(current)) continue;
@@ -236777,21 +236988,27 @@ async function discoverPlanBranches(input) {
     if (relativePath && !allowed2(relativePath, excludes)) continue;
     let entryStat;
     try {
-      entryStat = await stat3(current);
+      entryStat = await lstat3(current);
     } catch {
       continue;
     }
+    if (entryStat.isSymbolicLink()) continue;
     if (entryStat.isDirectory()) {
       const entries = await readdir3(current, { withFileTypes: true });
-      for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+      for (const entry of entries.sort(
+        (a, b) => a.name.localeCompare(b.name)
+      )) {
         queue.push(join3(current, entry.name));
       }
       continue;
     }
     if (!entryStat.isFile() || !relativePath) continue;
     if (!codeExtensions.has(extname3(current).toLowerCase())) continue;
-    if (entryStat.size > maxPlanBranchFileCharacters) continue;
-    const lines = (await readFile3(current, "utf8")).split(/\r?\n/);
+    if (entryStat.size > maxPlanBranchFileCharacters)
+      throw new Error(
+        "Plan discovery found a source file above the 2 MB per-file limit. Split large source files before retrying."
+      );
+    const lines = (await readFile4(current, "utf8")).split(/\r?\n/);
     collectConstants(lines, constants);
     lines.forEach((line, lineIndex) => {
       comparisonPattern.lastIndex = 0;
@@ -236831,7 +237048,7 @@ async function discoverPlanBranches(input) {
 }
 
 // src/setup-run.ts
-var exec = promisify(execFile);
+var exec2 = promisify2(execFile2);
 var hash2 = (text) => createHash3("sha256").update(text).digest("hex");
 var contextSchema = external_exports.object({
   workspaceId: external_exports.string(),
@@ -236840,7 +237057,13 @@ var contextSchema = external_exports.object({
   integrationId: external_exports.string().nullable(),
   environment: external_exports.enum(["test", "production"]),
   catalogReady: external_exports.boolean(),
-  planNames: external_exports.array(external_exports.string())
+  planNames: external_exports.array(external_exports.string()),
+  catalogPrices: external_exports.array(
+    external_exports.object({
+      id: external_exports.string().regex(/^price_[A-Za-z0-9]+$/),
+      lookupKey: external_exports.string().nullable()
+    })
+  ).default([])
 });
 function safeRepositoryKey(remote) {
   const ssh = remote.match(/^[^@\s]+@([^:]+):(.+)$/);
@@ -236889,6 +237112,7 @@ async function runGuidedSetup(options) {
   let progressState = "running";
   let progressFailure = null;
   try {
+    options.progress?.("1/4 Checking app connection\u2026");
     let context = contextSchema.parse(
       await request("/api/developer-tools/setup/context")
     );
@@ -236896,8 +237120,16 @@ async function runGuidedSetup(options) {
       throw new Error(
         "Connect Stripe and create app credentials in Setup first."
       );
-    const head = (await exec("git", ["rev-parse", "HEAD"], { cwd: options.cwd })).stdout.trim();
-    const diff = (await exec(
+    try {
+      await exec2("git", ["rev-parse", "HEAD"], { cwd: options.cwd });
+      await exec2("git", ["remote", "get-url", "origin"], { cwd: options.cwd });
+    } catch {
+      throw new Error(
+        "Repository setup needed: run this command inside your app\u2019s Git repository with an initial commit and an origin remote. No push or production deploy is required for discovery."
+      );
+    }
+    const head = (await exec2("git", ["rev-parse", "HEAD"], { cwd: options.cwd })).stdout.trim();
+    const diff = (await exec2(
       "git",
       [
         "diff",
@@ -236910,7 +237142,7 @@ async function runGuidedSetup(options) {
       ],
       { cwd: options.cwd, maxBuffer: 8e6 }
     )).stdout;
-    const untracked = (await exec("git", ["ls-files", "--others", "--exclude-standard", "-z"], {
+    const untracked = (await exec2("git", ["ls-files", "--others", "--exclude-standard", "-z"], {
       cwd: options.cwd
     })).stdout.split("\0").filter(
       (path) => path && !path.startsWith(".saasfunnels/") && !/(^|\/)(\.env|node_modules|dist|\.next)(\/|$|\.)/i.test(path)
@@ -236922,15 +237154,15 @@ async function runGuidedSetup(options) {
     const sourceHashes = await Promise.all(
       untracked.map(async (path) => [
         path,
-        hash2(await readFile4(join4(options.cwd, path), "utf8"))
+        hash2(await readFile5(join4(options.cwd, path), "utf8"))
       ])
     );
     const revision = `${head}:${hash2(JSON.stringify([diff, sourceHashes]))}`;
-    const remote = (await exec("git", ["remote", "get-url", "origin"], { cwd: options.cwd })).stdout.trim();
+    const remote = (await exec2("git", ["remote", "get-url", "origin"], { cwd: options.cwd })).stdout.trim();
     const repositoryKey = safeRepositoryKey(remote);
     const statePath = join4(options.cwd, ".saasfunnels", "setup-run.json");
     if (options.resume) {
-      const saved = JSON.parse(await readFile4(statePath, "utf8"));
+      const saved = JSON.parse(await readFile5(statePath, "utf8"));
       if (saved.generation !== context.generation || saved.repositoryKey !== repositoryKey || saved.revision !== revision)
         throw new Error(
           "The app connection or revision changed. Run setup again without --resume."
@@ -236943,9 +237175,9 @@ async function runGuidedSetup(options) {
     );
     if (!approved)
       return {
-        exitCode: 2,
-        stdout: "",
-        stderr: "No evidence uploaded. Review the installation instructions, then run setup run --send to approve discovery uploads.\n"
+        exitCode: options.prompt ? 0 : 2,
+        stdout: "Discovery cancelled. Nothing was uploaded. Run npx --yes saasfunnels@latest setup when ready.\n",
+        stderr: ""
       };
     run = (await request("/api/developer-tools/setup/runs", {
       generation: context.generation,
@@ -236990,6 +237222,10 @@ async function runGuidedSetup(options) {
     };
     const send = (evidence) => {
       const currentStage = stage;
+      if (JSON.stringify({ runId: run.id, stage: currentStage, evidence }).length > 1e6)
+        throw new Error(
+          "Feature discovery evidence exceeds the upload size limit. Review the source scope before retrying."
+        );
       heartbeat = heartbeat.then(async () => {
         const result3 = await request("/api/developer-tools/setup/evidence", {
           runId: run.id,
@@ -236999,7 +237235,8 @@ async function runGuidedSetup(options) {
         if (typeof result3.sequence === "number")
           run.sequence = result3.sequence;
         run.receipts[currentStage] = result3.receipt ?? { complete: true };
-        if (currentStage === "plans") run.planNames = result3.planNames ?? evidence.plans.flatMap((plan) => [plan.key, plan.name]);
+        if (currentStage === "plans")
+          run.planNames = result3.planNames ?? evidence.plans.flatMap((plan) => [plan.key, plan.name]);
       });
       return heartbeat;
     };
@@ -237013,6 +237250,9 @@ async function runGuidedSetup(options) {
       void update(progressState, progressFailure).catch(() => {
       });
     }, 3e4);
+    options.progress?.(
+      run.receipts.features ? "2/4 Features already submitted." : "2/4 Discovering features\u2026"
+    );
     if (!run.receipts.features) {
       await update("running");
       const scan = await runFeatureSetup({
@@ -237023,6 +237263,15 @@ async function runGuidedSetup(options) {
         manifestOnly: true,
         accept: ["all"]
       });
+      if (!scan.coverage.complete) {
+        const reason = scan.coverage.byteLimitReached ? `${scan.coverage.oversizedFileCount} source file(s) exceed the 2 MB per-file limit. Split large source files before retrying.` : !scan.coverage.scannedFiles ? "No JavaScript or TypeScript app files were found in the source roots. Run from the application folder." : "More than 10,000 feature bindings were found. Review the source scope before retrying.";
+        throw new Error(
+          `Feature discovery needs attention: ${reason} Scanned ${scan.coverage.scannedFiles} of ${scan.coverage.matchedFiles} files. Nothing was submitted for this stage.`
+        );
+      }
+      options.progress?.(
+        `Scanned ${scan.scannedFileCount} files; found ${scan.manifest.features.length} feature proposals.`
+      );
       if (!scan.ok)
         throw new Error(
           "Feature discovery needs attention. Run features setup to review the local findings."
@@ -237037,11 +237286,15 @@ async function runGuidedSetup(options) {
       );
     }
     stage = "plans";
+    if (!context.catalogReady)
+      options.progress?.(
+        "Waiting for your Stripe catalog. Setup can stay open while it imports\u2026"
+      );
     const catalogDeadline = Date.now() + 5 * 6e4;
     const generation = context.generation;
     while (!context.catalogReady && Date.now() < catalogDeadline) {
       await update("waiting", "catalog_pending");
-      await new Promise((resolve5) => setTimeout(resolve5, 1e4));
+      await new Promise((resolve6) => setTimeout(resolve6, 1e4));
       context = contextSchema.parse(
         await request("/api/developer-tools/setup/context")
       );
@@ -237051,54 +237304,86 @@ async function runGuidedSetup(options) {
     if (!context.catalogReady)
       return {
         exitCode: 2,
-        stdout: "Stripe is still importing. Run setup run --resume --send when the catalog is ready.\n",
+        stdout: "Stripe is still importing. Run npx --yes saasfunnels@latest setup --resume when the catalog is ready.\n",
         stderr: ""
       };
+    options.progress?.(
+      run.receipts.plans ? "3/4 Plans already submitted." : "3/4 Discovering plans and prices\u2026"
+    );
     if (!run.receipts.plans) {
       await update("running");
       const candidates = await discoverPlanSourceCandidates({
         cwd: options.cwd
       });
+      let manual = null;
       try {
-        if (candidates.length > 12) throw new Error("Too many sources");
-        let manual = null;
+        manual = await readFile5(
+          join4(options.cwd, ".saasfunnels/setup-pricing.json"),
+          "utf8"
+        );
+      } catch (error51) {
+        if (error51.code !== "ENOENT") throw error51;
+      }
+      const byKey = /* @__PURE__ */ new Map();
+      const reviewedFiles = [];
+      const issues = [];
+      const sources = manual !== null ? [{ path: ".saasfunnels/setup-pricing.json", kind: "json" }] : candidates;
+      for (const candidate of sources) {
         try {
-          manual = await readFile4(
-            join4(options.cwd, ".saasfunnels/setup-pricing.json"),
-            "utf8"
+          const plans = extractSetupPricing(
+            manual ?? await readFile5(join4(options.cwd, candidate.path), "utf8"),
+            candidate.kind,
+            context.catalogPrices
           );
+          for (const plan of plans) {
+            if (byKey.has(plan.key) && JSON.stringify(byKey.get(plan.key)) !== JSON.stringify(plan))
+              throw new PricingExtractionError(
+                "needs_review",
+                "Conflicting declarations for the same plan."
+              );
+            byKey.set(plan.key, plan);
+          }
+          reviewedFiles.push(candidate.path);
         } catch (error51) {
-          if (error51.code !== "ENOENT") throw error51;
+          if (manual === null && error51 instanceof PricingExtractionError && error51.code === "no_declarations")
+            continue;
+          issues.push({
+            file: candidate.path,
+            reason: error51 instanceof PricingExtractionError ? error51.message : "Unsupported pricing syntax."
+          });
         }
-        const discovered = manual !== null ? extractSetupPricing(manual, "json") : (await Promise.all(
-          candidates.map(
-            async (candidate) => extractSetupPricing(
-              await readFile4(join4(options.cwd, candidate.path), "utf8"),
-              candidate.kind
-            )
-          )
-        )).flat();
-        const byKey = /* @__PURE__ */ new Map();
-        for (const plan of discovered) {
-          if (byKey.has(plan.key) && JSON.stringify(byKey.get(plan.key)) !== JSON.stringify(plan))
-            throw new Error("Conflicting pricing sources");
-          byKey.set(plan.key, plan);
-        }
-        await send({
-          plans: [...byKey.values()],
-          reviewedFiles: manual !== null ? [".saasfunnels/setup-pricing.json"] : candidates.map((c) => c.path)
+      }
+      if (reviewedFiles.length > 12 || byKey.size > 200)
+        issues.push({
+          file: "pricing",
+          reason: "Combine the pricing declarations into at most 12 files and 200 plans."
         });
-      } catch {
+      if (issues.length) {
+        await writeFile3(
+          join4(options.cwd, ".saasfunnels/setup-review.json"),
+          JSON.stringify({ stage: "plans", issues }, null, 2) + "\n",
+          { mode: 384 }
+        );
         await update("waiting", "extraction_unsupported");
         return {
           exitCode: 2,
-          stdout: "Pricing discovery needs manual review. Create .saasfunnels/setup-pricing.json with a plans array containing key, name, features (boolean or numeric access), and prices (Stripe price IDs). Review it, then run setup run --resume --send. No source files were uploaded.\n",
+          stdout: `Pricing needs review in ${issues.length} file(s). See .saasfunnels/setup-review.json for the exact files and reasons. Ask your coding agent to review those declarations, or prepare .saasfunnels/setup-pricing.json, then run npx --yes saasfunnels@latest setup --resume. No pricing evidence was submitted.
+`,
           stderr: ""
         };
       }
+      options.progress?.(
+        `Found ${byKey.size} plan proposals in ${reviewedFiles.length} pricing files.`
+      );
+      await send({ plans: [...byKey.values()], reviewedFiles });
     }
     stage = "branches";
-    const planValues = [.../* @__PURE__ */ new Set([...context.planNames, ...run.planNames ?? []])];
+    const planValues = [
+      .../* @__PURE__ */ new Set([...context.planNames, ...run.planNames ?? []])
+    ];
+    options.progress?.(
+      run.receipts.branches ? "4/4 Plan checks already submitted." : "4/4 Checking plan conditions\u2026"
+    );
     if (!run.receipts.branches) {
       await update("running");
       const branches = planValues.length ? await discoverPlanBranches({
@@ -237117,6 +237402,7 @@ async function runGuidedSetup(options) {
           symbol: branch.symbol
         }))
       }));
+      options.progress?.(`Found ${clusters.length} groups of plan conditions.`);
       await send({
         clusters,
         environment: context.environment,
@@ -237129,14 +237415,14 @@ async function runGuidedSetup(options) {
     }
     return {
       exitCode: 0,
-      stdout: "Discovery submitted. Return to Setup to review findings and verify installation. Payment transactions have not been tested by this command.\n",
+      stdout: "Discovery submitted. Open https://app.saasfunnels.ai/app/setup to review findings and verify installation. Payment transactions have not been tested by this command.\n",
       stderr: ""
     };
   } catch (error51) {
     clearInterval(timer);
     await reportFailure?.().catch(() => {
     });
-    const safe = error51 instanceof Error && /^(Setup request failed|Connect Stripe|The app connection|Use a repository|Feature discovery)/.test(
+    const safe = error51 instanceof Error && /^(Setup request failed|Connect Stripe|The app connection|Use a repository|Feature discovery|Plan discovery|Repository setup)/.test(
       error51.message
     ) ? error51.message : "Setup could not finish. Check local repository access and developer credentials, then resume.";
     return { exitCode: 2, stdout: "", stderr: safe + "\n" };
@@ -237187,11 +237473,11 @@ async function submitApprovedSetupPlans(input) {
 }
 
 // src/cli.ts
-import { mkdir as mkdir4, readFile as readFile5, writeFile as writeFile4 } from "node:fs/promises";
+import { mkdir as mkdir4, readFile as readFile6, writeFile as writeFile4 } from "node:fs/promises";
 
 // src/identity.ts
 var SAASFUNNELS_CLI_NAME = "saasfunnels";
-var SAASFUNNELS_CLI_VERSION = "0.3.0";
+var SAASFUNNELS_CLI_VERSION = "0.3.2";
 var SAASFUNNELS_PRODUCT_NAME = "SaaSFunnels";
 var SAASFUNNELS_DEFAULT_API_BASE_URL = "https://app.saasfunnels.ai";
 var SAASFUNNELS_ENV = Object.freeze({
@@ -238979,7 +239265,8 @@ function usage() {
   return `${SAASFUNNELS_PRODUCT_NAME} CLI
 
 Usage:
-  ${SAASFUNNELS_CLI_NAME} setup run [--resume] [--send]
+  ${SAASFUNNELS_CLI_NAME} setup [--resume] [--env-file <path>]
+  ${SAASFUNNELS_CLI_NAME} setup run [--resume] [--send] [--non-interactive]
   ${SAASFUNNELS_CLI_NAME} init [--api-base-url <url>] [--force]
   ${SAASFUNNELS_CLI_NAME} agent install --target codex|claude-code|cursor|markdown [--endpoint <url>]
   ${SAASFUNNELS_CLI_NAME} events validate <file> [--source direct|posthog|segment] [--json]
@@ -239016,7 +239303,7 @@ function filesystem(options) {
     mkdir: async (path, mkdirOptions) => {
       await mkdir4(path, mkdirOptions);
     },
-    readFile: readFile5,
+    readFile: readFile6,
     writeFile: writeFile4
   };
 }
@@ -239047,7 +239334,7 @@ function sourceFlag(flags) {
 }
 async function readJsonFile(filePath, options) {
   const raw = await filesystem(options).readFile(
-    resolve4(cwd(options), filePath),
+    resolve5(cwd(options), filePath),
     "utf8"
   );
   return JSON.parse(raw);
@@ -239236,7 +239523,7 @@ async function commandFeatures(args, flags, options) {
     }
     const discoveryRoots = (flagString(flags, "discovery-roots") ?? "").split(",").map((root) => root.trim()).filter(Boolean);
     const source = await filesystem(options).readFile(
-      resolve4(cwd(options), path),
+      resolve5(cwd(options), path),
       "utf8"
     );
     const validation = parseFeatureManifestSource(source);
@@ -239252,7 +239539,7 @@ ${validation.errors.map((error51) => `- ${error51}`).join("\n")}
     let sdkVersions = [];
     try {
       const packageSource = await filesystem(options).readFile(
-        resolve4(cwd(options), "package.json"),
+        resolve5(cwd(options), "package.json"),
         "utf8"
       );
       sdkVersions = featureSdkVersionsFromPackageJson(
@@ -239323,7 +239610,7 @@ async function commandCatalog(args, flags, options) {
   if (action === "validate") {
     const path = args[1] ?? ".saasfunnels/catalog.yaml";
     const source = await filesystem(options).readFile(
-      resolve4(cwd(options), path),
+      resolve5(cwd(options), path),
       "utf8"
     );
     const validation = parseFeatureManifestSource(source);
@@ -239573,7 +239860,7 @@ async function commandVerify(flags, options) {
   if (catalogPath) {
     try {
       const source = await filesystem(options).readFile(
-        resolve4(cwd(options), catalogPath),
+        resolve5(cwd(options), catalogPath),
         "utf8"
       );
       const validation = parseFeatureManifestSource(source);
@@ -239916,7 +240203,15 @@ async function runSaaSFunnelsCli(argv2, options = {}) {
     if (!command || command === "help" || command === "--help")
       return result(0, usage());
     if (command === "init") return await commandInit(parsed.flags, options);
-    if (command === "setup" && args[0] === "run") return runGuidedSetup({ cwd: cwd(options), apiBaseUrl: apiBaseUrl2(options, parsed.flags), key: envValue2(options, SAASFUNNELS_ENV.apiKey), send: hasFlag(parsed.flags, "send"), resume: hasFlag(parsed.flags, "resume"), fetch: options.fetch, prompt: jsonMode(parsed.flags) ? void 0 : options.prompt });
+    if (command === "setup") {
+      const help = "SaaSFunnels setup\n\nRun npx --yes saasfunnels@latest setup in your app repository.\nIt checks access, asks before sending findings, and discovers features and plans for review.\nUse --resume after an interruption, or --env-file .env.local to load developer access.\nFor automation, supply SAASFUNNELS_API_KEY and explicit upload approval with --send --non-interactive.\nApp implementation, deployment and payment verification remain in https://app.saasfunnels.ai/app/setup.\n";
+      if (hasFlag(parsed.flags, "help") || args[0] === "help") return result(0, help);
+      if (args.length > 1 || args[0] && args[0] !== "run") return result(2, "", help);
+      const interactive = !jsonMode(parsed.flags) && !hasFlag(parsed.flags, "non-interactive");
+      const access2 = await resolveSetupAccess({ cwd: cwd(options), key: envValue2(options, SAASFUNNELS_ENV.apiKey), envFile: flagString(parsed.flags, "env-file"), prompt: interactive ? options.prompt : void 0 });
+      if (!access2.key) return result(2, "", access2.error + "\n");
+      return runGuidedSetup({ cwd: cwd(options), apiBaseUrl: apiBaseUrl2(options, parsed.flags), key: access2.key, send: hasFlag(parsed.flags, "send"), resume: hasFlag(parsed.flags, "resume"), fetch: options.fetch, prompt: interactive ? options.prompt : void 0, progress: jsonMode(parsed.flags) ? void 0 : options.progress });
+    }
     if (command === "agent")
       return await commandAgentInstall(args, parsed.flags, options);
     if (command === "events")
@@ -239944,13 +240239,14 @@ ${usage()}`);
 
 // src/saasfunnels.ts
 var argv = process.argv.slice(2);
-var interactiveFeatureSetup = !argv.includes("--json") && !argv.includes("--non-interactive") && (argv[0] === "setup" && argv[1] === "run" || argv[0] === "features" && argv[1] === "setup" || argv[0] === "catalog" && ["discover", "diff"].includes(argv[1] ?? ""));
+var interactiveFeatureSetup = Boolean(process.stdin.isTTY && process.stdout.isTTY) && !argv.includes("--json") && !argv.includes("--non-interactive") && (argv[0] === "setup" || argv[0] === "features" && argv[1] === "setup" || argv[0] === "catalog" && ["discover", "diff"].includes(argv[1] ?? ""));
 var prompts = interactiveFeatureSetup ? createInterface2({ input: process.stdin, output: process.stdout }) : null;
 var result2;
 try {
   result2 = await runSaaSFunnelsCli(argv, {
     cwd: process.cwd(),
     env: process.env,
+    progress: (message) => process.stdout.write(message + "\n"),
     prompt: prompts ? (message) => prompts.question(message) : void 0
   });
 } finally {