saasfunnels 0.3.1 → 0.3.2

package/README.md

@@ -102,6 +102,10 @@ Use `saasfunnels setup run` from the application repository after creating app c
 
 The command asks before uploading structured discovery proposals. `--send` provides explicit non-interactive approval. It coordinates features, pricing extraction, and plan branches, reports progress, and waits for the Stripe catalog. Run `saasfunnels setup run --resume` after an interruption. Existing accepted stages and customer review decisions are preserved.
 
-If extraction is unsupported, review a `.saasfunnels/setup-pricing.json` file with `{ "plans": [{ "key": "pro", "name": "Pro", "features": { "export": true }, "prices": [{ "key": "price_ACTUAL_ID" }] }] }`, then resume. Use real identifiers from the connected merchant. Raw source files are never uploaded by guided setup or the pricing handoff.
+The scanner reads supported application files one at a time without the old 500-file, 2 MB repository, or 200-candidate cutoffs. Generated code, tests, and symlinks are excluded. Files over 2 MB and uploads over the server limit stop with a specific recovery message.
+
+Static pricing supports literal spreads, capability/quota maps, unlimited limits, and exact Stripe lookup-key matching. It never executes customer code. Pricing definitions are inspected beyond the first ten filename matches; unrelated helpers do not count as plans.
+
+If extraction is unsupported, `.saasfunnels/setup-review.json` lists the files and reasons. Correct those declarations or review a `.saasfunnels/setup-pricing.json` file with `{ "plans": [{ "key": "pro", "name": "Pro", "features": { "export": true }, "prices": [{ "key": "price_ACTUAL_ID" }] }] }`, then resume. Use real identifiers from the connected merchant. Raw source files are never uploaded by guided setup or the pricing handoff.
 
 The command does not implement arbitrary payment code, approve feature access, or verify transactions. Complete **Review and verify** in Setup after deploying the runtime and payment integration. Requires the server's guided setup API release.

package/dist/library.js

@@ -24264,7 +24264,7 @@ function validateFeatureCatalogManifest(value) {
 
 // src/identity.ts
 var SAASFUNNELS_CLI_NAME = "saasfunnels";
-var SAASFUNNELS_CLI_VERSION = "0.3.1";
+var SAASFUNNELS_CLI_VERSION = "0.3.2";
 var SAASFUNNELS_PRODUCT_NAME = "SaaSFunnels";
 var SAASFUNNELS_DEFAULT_API_BASE_URL = "https://app.saasfunnels.ai";
 var SAASFUNNELS_ENV = Object.freeze({

package/dist/saasfunnels.js

@@ -8690,9 +8690,9 @@ ${lanes.join("\n")}
               return process.memoryUsage().heapUsed;
             },
             getFileSize(path) {
-              const stat4 = statSync(path);
-              if (stat4 == null ? void 0 : stat4.isFile()) {
-                return stat4.size;
+              const stat = statSync(path);
+              if (stat == null ? void 0 : stat.isFile()) {
+                return stat.size;
               }
               return 0;
             },
@@ -8910,19 +8910,19 @@ ${lanes.join("\n")}
                 if (entry === "." || entry === "..") {
                   continue;
                 }
-                let stat4;
+                let stat;
                 if (typeof dirent === "string" || dirent.isSymbolicLink()) {
                   const name = combinePaths(path, entry);
-                  stat4 = statSync(name);
-                  if (!stat4) {
+                  stat = statSync(name);
+                  if (!stat) {
                     continue;
                   }
                 } else {
-                  stat4 = dirent;
+                  stat = dirent;
                 }
-                if (stat4.isFile()) {
+                if (stat.isFile()) {
                   files.push(entry);
-                } else if (stat4.isDirectory()) {
+                } else if (stat.isDirectory()) {
                   directories.push(entry);
                 }
               }
@@ -8937,15 +8937,15 @@ ${lanes.join("\n")}
             return matchFiles(path, extensions, excludes, includes, useCaseSensitiveFileNames2, process.cwd(), depth, getAccessibleFileSystemEntries, realpath);
           }
           function fileSystemEntryExists(path, entryKind) {
-            const stat4 = statSync(path);
-            if (!stat4) {
+            const stat = statSync(path);
+            if (!stat) {
               return false;
             }
             switch (entryKind) {
               case 0:
-                return stat4.isFile();
+                return stat.isFile();
               case 1:
-                return stat4.isDirectory();
+                return stat.isDirectory();
               default:
                 return false;
             }
@@ -218948,8 +218948,20 @@ import { dirname as dirname3, join as join5, resolve as resolve5 } from "node:pa
 // src/setup-pricing.ts
 var import_typescript = __toESM(require_typescript(), 1);
 var import_yaml = __toESM(require_dist(), 1);
+var PricingExtractionError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+  code;
+};
+var unsupported = () => new PricingExtractionError(
+  "needs_review",
+  "Pricing contains a value that needs developer review."
+);
 var object = (v) => v !== null && typeof v === "object" && !Array.isArray(v) ? v : null;
 var safeKey = (v) => typeof v === "string" && /^[a-z][a-z0-9_.-]{0,79}$/.test(v);
+var safeProperty = (key2) => !["__proto__", "constructor", "prototype"].includes(key2);
 function declarations(source) {
   const file2 = import_typescript.default.createSourceFile(
     "pricing.ts",
@@ -218960,47 +218972,107 @@ function declarations(source) {
   );
   const values = /* @__PURE__ */ new Map();
   const roots = [];
+  const planName = /^(plans?|pricing|tiers?|billingCatalog|planCatalog|subscriptionPlans)$/i;
+  const containsAccess = (node, fields = /^(features|capabilities|quotas)$/) => {
+    if (import_typescript.default.isPropertyAssignment(node) && fields.test(node.name.getText(file2).replace(/["']/g, "")))
+      return true;
+    return import_typescript.default.forEachChild(
+      node,
+      (child) => containsAccess(child, fields) ? true : void 0
+    ) ?? false;
+  };
   for (const statement of file2.statements) {
     if (import_typescript.default.isVariableStatement(statement))
       for (const declaration of statement.declarationList.declarations) {
         if (import_typescript.default.isIdentifier(declaration.name) && declaration.initializer) {
           values.set(declaration.name.text, declaration.initializer);
-          roots.push(declaration.initializer);
+          if (planName.test(declaration.name.text) || containsAccess(declaration.initializer) && containsAccess(
+            declaration.initializer,
+            /^(prices|stripePriceId)$/
+          ))
+            roots.push(declaration.initializer);
         }
       }
-    if (import_typescript.default.isExportAssignment(statement)) roots.push(statement.expression);
+    if (import_typescript.default.isExportAssignment(statement) && containsAccess(statement.expression))
+      roots.push(statement.expression);
   }
-  function read(node, depth = 0) {
-    if (depth > 20) throw new Error("Unsupported pricing expression");
+  function read(node, depth = 0, locals = /* @__PURE__ */ new Map()) {
+    if (depth > 30) throw unsupported();
+    const next = (value) => read(value, depth + 1, locals);
     if (import_typescript.default.isAsExpression(node) || import_typescript.default.isSatisfiesExpression(node) || import_typescript.default.isParenthesizedExpression(node))
-      return read(node.expression, depth + 1);
+      return next(node.expression);
     if (import_typescript.default.isStringLiteral(node) || import_typescript.default.isNoSubstitutionTemplateLiteral(node))
       return node.text;
-    if (import_typescript.default.isNumericLiteral(node)) return Number(node.text);
+    if (import_typescript.default.isNumericLiteral(node)) return Number(node.text.replaceAll("_", ""));
     if (node.kind === import_typescript.default.SyntaxKind.TrueKeyword) return true;
     if (node.kind === import_typescript.default.SyntaxKind.FalseKeyword) return false;
-    if (import_typescript.default.isIdentifier(node) && values.has(node.text))
-      return read(values.get(node.text), depth + 1);
+    if (import_typescript.default.isIdentifier(node)) {
+      if (locals.has(node.text)) return locals.get(node.text);
+      if (values.has(node.text)) return next(values.get(node.text));
+    }
     if (import_typescript.default.isArrayLiteralExpression(node))
-      return node.elements.map((n) => read(n, depth + 1));
+      return node.elements.flatMap((n) => {
+        if (!import_typescript.default.isSpreadElement(n)) return [next(n)];
+        const spread = next(n.expression);
+        if (!Array.isArray(spread)) throw unsupported();
+        return spread;
+      });
     if (import_typescript.default.isObjectLiteralExpression(node)) {
       const result3 = /* @__PURE__ */ Object.create(null);
       for (const property of node.properties) {
+        if (import_typescript.default.isSpreadAssignment(property)) {
+          const spread = object(next(property.expression));
+          if (!spread) throw unsupported();
+          Object.assign(result3, spread);
+          continue;
+        }
         if (!import_typescript.default.isPropertyAssignment(property) || import_typescript.default.isComputedPropertyName(property.name))
-          throw new Error("Unsupported pricing expression");
-        result3[property.name.getText(file2).replace(/^["']|["']$/g, "")] = read(
-          property.initializer,
-          depth + 1
-        );
+          throw unsupported();
+        const key2 = property.name.getText(file2).replace(/^["']|["']$/g, "");
+        if (!safeProperty(key2)) throw unsupported();
+        result3[key2] = next(property.initializer);
       }
       return result3;
     }
-    throw new Error("Unsupported pricing expression");
+    if (import_typescript.default.isCallExpression(node) && import_typescript.default.isPropertyAccessExpression(node.expression)) {
+      const callee = node.expression;
+      if (import_typescript.default.isIdentifier(callee.expression) && callee.expression.text === "Object" && !values.has("Object") && callee.name.text === "fromEntries" && node.arguments.length === 1) {
+        const entries = next(node.arguments[0]);
+        if (!Array.isArray(entries) || entries.length > 1e4)
+          throw unsupported();
+        const result3 = /* @__PURE__ */ Object.create(null);
+        for (const entry of entries) {
+          if (!Array.isArray(entry) || entry.length !== 2 || typeof entry[0] !== "string" || !safeProperty(entry[0]))
+            throw unsupported();
+          result3[entry[0]] = entry[1];
+        }
+        return result3;
+      }
+      if (callee.name.text === "map" && node.arguments.length === 1) {
+        const array2 = next(callee.expression);
+        const callback = node.arguments[0];
+        if (!Array.isArray(array2) || array2.length > 1e4 || !import_typescript.default.isArrowFunction(callback) || callback.parameters.length !== 1 || !import_typescript.default.isIdentifier(callback.parameters[0].name) || import_typescript.default.isBlock(callback.body))
+          throw unsupported();
+        const parameter = callback.parameters[0].name.text;
+        return array2.map(
+          (value) => read(
+            callback.body,
+            depth + 1,
+            new Map([...locals, [parameter, value]])
+          )
+        );
+      }
+    }
+    throw unsupported();
   }
   return roots.map((node) => read(node));
 }
-function extractSetupPricing(source, kind) {
-  if (source.length > 512e3) throw new Error("Pricing file exceeds limit");
+function extractSetupPricing(source, kind, catalogPrices = []) {
+  if (source.length > 2e6)
+    throw new PricingExtractionError(
+      "needs_review",
+      "Pricing file exceeds the 2 MB per-file limit."
+    );
   const documents = kind === "typescript" ? declarations(source) : kind === "json" ? [JSON.parse(source)] : [
     (0, import_yaml.parseDocument)(source, { uniqueKeys: true }).toJS({
       maxAliasCount: 10
@@ -219008,8 +219080,7 @@ function extractSetupPricing(source, kind) {
   ];
   const plans = /* @__PURE__ */ new Map();
   for (const doc of documents) {
-    const root = object(doc);
-    const candidate = root?.plans ?? doc;
+    const candidate = object(doc)?.plans ?? doc;
     const rows = Array.isArray(candidate) ? candidate : object(candidate) ? Object.entries(candidate).map(
       ([key2, value]) => ({ key: key2, ...object(value) })
     ) : [];
@@ -219020,30 +219091,45 @@ function extractSetupPricing(source, kind) {
       const name = row.name ?? row.displayName ?? key2;
       if (!safeKey(key2) || typeof name !== "string" || !name.length || name.length > 120)
         continue;
-      if (!("features" in row) && !("prices" in row) && !("stripePriceId" in row) && !("productKey" in row))
+      if (![
+        "features",
+        "capabilities",
+        "quotas",
+        "prices",
+        "stripePriceId",
+        "productKey"
+      ].some((k) => k in row))
         continue;
-      const features = {};
-      const rawFeatures = object(row.features);
-      if (rawFeatures)
-        for (const [feature, access2] of Object.entries(rawFeatures)) {
-          if (!safeKey(feature) || !(typeof access2 === "boolean" || typeof access2 === "number" && Number.isFinite(access2) && access2 >= 0))
-            throw new Error("Feature access needs manual review");
+      const features = /* @__PURE__ */ Object.create(null);
+      for (const field of ["features", "capabilities", "quotas"]) {
+        const raw = row[field];
+        const entries = object(raw) ? Object.entries(raw) : Array.isArray(raw) && raw.every(safeKey) ? raw.map((key3) => [key3, true]) : raw === void 0 ? [] : null;
+        if (!entries) throw unsupported();
+        for (const [feature, access2] of entries) {
+          if (!safeKey(feature) || !safeProperty(feature) || !(typeof access2 === "boolean" || access2 === "unlimited" || typeof access2 === "number" && Number.isFinite(access2) && access2 >= 0))
+            throw unsupported();
+          if (features[feature] === false && access2 !== false)
+            throw unsupported();
           features[feature] = access2;
         }
-      else if (Array.isArray(row.features) && row.features.every(safeKey)) {
-        for (const feature of row.features) features[feature] = true;
-      } else if (row.features !== void 0)
-        throw new Error("Feature access needs manual review");
-      const rawPrices = Array.isArray(row.prices) ? row.prices : row.stripePriceId ?? row.priceId ? [{ key: row.stripePriceId ?? row.priceId }] : [];
+      }
+      const rawPrices = Array.isArray(row.prices) ? row.prices : object(row.prices) ? Object.values(row.prices) : row.stripePriceId ?? row.priceId ? [{ key: row.stripePriceId ?? row.priceId }] : [];
       const prices = rawPrices.map((value2) => {
         const price = typeof value2 === "string" ? value2 : object(value2)?.key ?? object(value2)?.stripePriceId;
-        if (typeof price !== "string" || !/^price_[A-Za-z0-9]+$/.test(price))
-          throw new Error("Price needs manual review");
-        return { key: price };
+        if (typeof price === "string" && /^price_[A-Za-z0-9]+$/.test(price))
+          return { key: price };
+        const lookup = object(value2)?.lookupKey ?? object(value2)?.lookup_key;
+        const matches = typeof lookup === "string" ? catalogPrices.filter((p) => p.lookupKey === lookup) : [];
+        if (matches.length !== 1)
+          throw new PricingExtractionError(
+            "needs_review",
+            "A Stripe lookup key has no unique match in the connected catalog."
+          );
+        return { key: matches[0].id };
       });
       const productKey = row.productKey ?? row.stripeProductId;
       if (productKey !== void 0 && (typeof productKey !== "string" || !/^prod_[A-Za-z0-9]+$/.test(productKey)))
-        throw new Error("Product needs manual review");
+        throw unsupported();
       const plan = {
         key: key2,
         name,
@@ -219052,12 +219138,23 @@ function extractSetupPricing(source, kind) {
         ...typeof productKey === "string" ? { productKey } : {}
       };
       if (plans.has(key2) && JSON.stringify(plans.get(key2)) !== JSON.stringify(plan))
-        throw new Error("Conflicting plan declarations");
+        throw new PricingExtractionError(
+          "needs_review",
+          "Conflicting plan declarations."
+        );
       plans.set(key2, plan);
     }
   }
-  if (!plans.size) throw new Error("No supported pricing declaration found");
-  if (plans.size > 200) throw new Error("Too many pricing declarations");
+  if (!plans.size)
+    throw new PricingExtractionError(
+      "no_declarations",
+      "No supported pricing declaration found."
+    );
+  if (plans.size > 200)
+    throw new PricingExtractionError(
+      "needs_review",
+      "More than 200 plan declarations need review."
+    );
   return [...plans.values()];
 }
 
@@ -233592,7 +233689,7 @@ import {
   readdir,
   rename,
   rm,
-  stat,
+  lstat,
   writeFile
 } from "node:fs/promises";
 import { dirname, extname, join, relative, resolve as resolve2 } from "node:path";
@@ -235742,7 +235839,17 @@ var featureBindingKinds = [
   "funnel_trigger",
   "discovery"
 ];
-var defaultRoots = ["app", "src", "lib", "components", "pages"];
+var defaultRoots = [
+  "app",
+  "src",
+  "lib",
+  "components",
+  "pages",
+  "apps",
+  "packages",
+  "server",
+  "client"
+];
 var ignoredSegments = /* @__PURE__ */ new Set([
   ".claude",
   ".git",
@@ -235751,6 +235858,13 @@ var ignoredSegments = /* @__PURE__ */ new Set([
   ".turbo",
   "build",
   "coverage",
+  ".saasfunnels",
+  "docs",
+  "e2e",
+  "fixtures",
+  "__tests__",
+  "tests",
+  "__mocks__",
   "dist",
   "generated",
   "node_modules",
@@ -235849,7 +235963,11 @@ function allowedPath(path, excludes) {
   const normalized = path.replaceAll("\\", "/");
   if (sensitivePathPattern.test(normalized)) return false;
   const segments = normalized.split("/");
-  if (segments.some((segment) => ignoredSegments.has(segment))) return false;
+  if (segments.some(
+    (segment) => ignoredSegments.has(segment) || /^\.next(?:[-.]|$)/.test(segment)
+  ))
+    return false;
+  if (/\.(test|spec|stories|d)\.[cm]?[jt]sx?$/.test(normalized)) return false;
   return !excludes.some(
     (exclude) => normalized === exclude || normalized.startsWith(`${exclude}/`)
   );
@@ -235857,13 +235975,17 @@ function allowedPath(path, excludes) {
 async function walkFiles(input) {
   const files = [];
   const queue = input.roots.map((root) => resolve2(input.cwd, root));
-  while (queue.length && files.length < 500) {
+  const seen = /* @__PURE__ */ new Set();
+  let oversizedFileCount = 0;
+  while (queue.length) {
     const current = queue.shift();
+    if (seen.has(current)) continue;
+    seen.add(current);
     const relativePath = safeRelative(input.cwd, current);
     if (!relativePath || !allowedPath(relativePath, input.excludes)) continue;
     let currentStat;
     try {
-      currentStat = await stat(current);
+      currentStat = await lstat(current);
     } catch {
       continue;
     }
@@ -235872,11 +235994,15 @@ async function walkFiles(input) {
       entries.sort((left, right) => left.name.localeCompare(right.name)).forEach((entry) => queue.push(join(current, entry.name)));
       continue;
     }
-    if (currentStat.isFile() && currentStat.size <= 256e3 && supportedExtensions.has(extname(current))) {
+    if (currentStat.isFile() && supportedExtensions.has(extname(current))) {
+      if (currentStat.size > 2e6) {
+        oversizedFileCount++;
+        continue;
+      }
       files.push(current);
     }
   }
-  return files.sort();
+  return { files: files.sort(), oversizedFileCount };
 }
 function nearestSymbol(lines, lineIndex) {
   for (let index = lineIndex; index >= Math.max(0, lineIndex - 20); index -= 1) {
@@ -235987,7 +236113,9 @@ async function detectFramework(cwd2, requestedRoots) {
   };
   const framework = typeof dependencies.next === "string" ? "nextjs" : "unsupported";
   const packageManager = await exists(join(cwd2, "pnpm-lock.yaml")) ? "pnpm" : await exists(join(cwd2, "yarn.lock")) ? "yarn" : await exists(join(cwd2, "bun.lockb")) || await exists(join(cwd2, "bun.lock")) ? "bun" : await exists(join(cwd2, "package-lock.json")) ? "npm" : "unknown";
-  const roots = (requestedRoots?.length ? requestedRoots : defaultRoots).filter((root) => !root.startsWith("../") && !root.startsWith("/"));
+  const roots = (requestedRoots?.length ? requestedRoots : defaultRoots).filter(
+    (root) => !root.startsWith("../") && !root.startsWith("/")
+  );
   const existingRoots = [];
   for (const root of roots) {
     if (await exists(resolve2(cwd2, root))) existingRoots.push(root);
@@ -235995,7 +236123,9 @@ async function detectFramework(cwd2, requestedRoots) {
   return {
     framework,
     packageManager,
-    saasFunnelsPackages: Object.keys(dependencies).filter((name) => name === "saasfunnels" || name.startsWith("@saasfunnels/")).sort(),
+    saasFunnelsPackages: Object.keys(dependencies).filter(
+      (name) => name === "saasfunnels" || name.startsWith("@saasfunnels/")
+    ).sort(),
     roots: existingRoots
   };
 }
@@ -236102,11 +236232,16 @@ async function applyFeatureSetupChangesAtomically(cwd2, changes, io = {
       const absolute = resolve2(cwd2, change.path);
       const relativePath = safeRelative(cwd2, absolute);
       if (!relativePath)
-        throw new Error(`Refusing to write outside the repository: ${change.path}`);
+        throw new Error(
+          `Refusing to write outside the repository: ${change.path}`
+        );
       await io.mkdir(dirname(absolute), { recursive: true });
       originals.set(absolute, await io.read(absolute));
       const stagedPath = `${absolute}.saasfunnels-${transactionId}.tmp`;
-      await io.write(stagedPath, change.contents, { encoding: "utf8", mode: 384 });
+      await io.write(stagedPath, change.contents, {
+        encoding: "utf8",
+        mode: 384
+      });
       staged.push({ absolute, staged: stagedPath });
     }
     for (const entry of staged) await io.rename(entry.staged, entry.absolute);
@@ -236220,10 +236355,12 @@ async function runFeatureSetup(input) {
       `Inspect these local roots only: ${framework.roots.join(", ") || "none"}? [y/N] `
     );
     if (!/^y(?:es)?$/i.test(confirmation.trim())) {
-      throw new Error("Feature discovery was cancelled before reading source files.");
+      throw new Error(
+        "Feature discovery was cancelled before reading source files."
+      );
     }
   }
-  const files = await walkFiles({
+  const { files, oversizedFileCount } = await walkFiles({
     cwd: input.cwd,
     excludes: input.exclude ?? [],
     roots: framework.roots
@@ -236231,14 +236368,10 @@ async function runFeatureSetup(input) {
   const discovered = [];
   let scannedBytes = 0;
   let scannedFileCount = 0;
-  let byteLimitReached = false;
+  const byteLimitReached = oversizedFileCount > 0;
   for (const file2 of files) {
     const source = await readFile2(file2, "utf8");
     scannedBytes += Buffer.byteLength(source);
-    if (scannedBytes > 2e6) {
-      byteLimitReached = true;
-      break;
-    }
     const path = safeRelative(input.cwd, file2);
     if (!path) continue;
     scannedFileCount++;
@@ -236249,9 +236382,14 @@ async function runFeatureSetup(input) {
     (left, right) => right.confidenceBasisPoints - left.confidenceBasisPoints || left.file.localeCompare(right.file) || left.line - right.line
   )) {
     const identity = `${candidate.suggestedKey}:${candidate.accessModel}:${candidate.file}:${candidate.line}`;
-    if (!uniqueCandidates.has(identity)) uniqueCandidates.set(identity, candidate);
+    if (!uniqueCandidates.has(identity))
+      uniqueCandidates.set(identity, candidate);
   }
-  const candidates = [...uniqueCandidates.values()].slice(0, 200);
+  const candidates = [...uniqueCandidates.values()];
+  if (new Set(candidates.map((candidate) => candidate.suggestedKey)).size > 5e3)
+    throw new Error(
+      "Feature discovery found more than 5,000 distinct features. Narrow the source roots before retrying."
+    );
   const manifestPath = ".saasfunnels/catalog.yaml";
   const existingManifestSource = await readable(
     resolve2(input.cwd, manifestPath)
@@ -236271,7 +236409,8 @@ async function runFeatureSetup(input) {
   const accept = new Set(input.accept ?? []);
   const reject = new Set(input.reject ?? []);
   for (const candidate of candidates) {
-    if (reject.has(candidate.id) || reject.has(candidate.suggestedKey)) continue;
+    if (reject.has(candidate.id) || reject.has(candidate.suggestedKey))
+      continue;
     if (accept.has("all") || accept.has(candidate.id) || accept.has(candidate.suggestedKey)) {
       accepted.add(candidate.id);
       continue;
@@ -236285,7 +236424,10 @@ async function runFeatureSetup(input) {
       if (/^a(?:ccept)?$/i.test(answer.trim())) accepted.add(candidate.id);
       else if (keyPattern.test(answer.trim())) {
         accepted.add(candidate.id);
-        input.mappings = { ...input.mappings ?? {}, [candidate.id]: answer.trim() };
+        input.mappings = {
+          ...input.mappings ?? {},
+          [candidate.id]: answer.trim()
+        };
       }
     }
   }
@@ -236420,7 +236562,15 @@ async function runFeatureSetup(input) {
     reviewUrl,
     runtimeCheck: check2,
     scannedFileCount,
-    coverage: { complete: scannedFileCount > 0 && !byteLimitReached && uniqueCandidates.size <= 200, matchedFiles: files.length, scannedFiles: scannedFileCount, byteLimitReached, candidateLimitReached: uniqueCandidates.size > 200 },
+    coverage: {
+      complete: scannedFileCount > 0 && !byteLimitReached && uniqueCandidates.size <= 1e4,
+      matchedFiles: files.length + oversizedFileCount,
+      scannedFiles: scannedFileCount,
+      scannedBytes,
+      oversizedFileCount,
+      byteLimitReached,
+      candidateLimitReached: uniqueCandidates.size > 1e4
+    },
     validation: { errors: validation.errors, ok: validation.ok }
   };
 }
@@ -236502,7 +236652,7 @@ Applied reviewed edits. Change record: ${result3.changeRecordPath}` : result3.id
 }
 
 // src/plan-sources.ts
-import { readFile as readFile3, readdir as readdir2, stat as stat2, writeFile as writeFile2, mkdir as mkdir2 } from "node:fs/promises";
+import { readFile as readFile3, readdir as readdir2, lstat as lstat2, writeFile as writeFile2, mkdir as mkdir2 } from "node:fs/promises";
 import { dirname as dirname2, extname as extname2, join as join2, relative as relative2, resolve as resolve3, sep } from "node:path";
 var planSourceApprovalPath = ".saasfunnels/plan-sources.json";
 var maxPlanSourceFiles = 12;
@@ -236533,10 +236683,9 @@ var planSourceKindByExtension = /* @__PURE__ */ new Map([
   [".yml", "yaml"]
 ]);
 var billingIntervalPattern = /\b(month|monthly|year|yearly|annual|annually|week|weekly|day|daily|recurring|interval|billing_period)\b/i;
-var chargeAmountPattern = /\b(unit_amount|unit_amount_decimal|amount|amount_decimal|price|prices|currency|usd|eur|gbp|cents)\b/i;
+var chargeAmountPattern = /\b(unit_amount|unit_amount_decimal|unitAmount|amount|amount_decimal|price|prices|currency|usd|eur|gbp|cents)\b/i;
 var stripePriceIdPattern = /["'`]price_(?=[A-Za-z0-9]*\d)[A-Za-z0-9]{14,}["'`]/;
 var nonDefinitionPattern = /(^|\/)(__tests__|__mocks__|tests?|specs?)(\/)|\.(test|spec|d)\.[cm]?[jt]sx?$/i;
-var maxNamedOnlyCandidates = 10;
 function normalize(path) {
   return path.split(sep).join("/");
 }
@@ -236561,7 +236710,7 @@ async function discoverPlanSourceCandidates(input) {
   const seen = /* @__PURE__ */ new Set();
   const candidates = [];
   const queue = roots.map((root) => resolve3(input.cwd, root));
-  while (queue.length && candidates.length < 200) {
+  while (queue.length) {
     const current = queue.shift();
     if (seen.has(current)) continue;
     seen.add(current);
@@ -236569,13 +236718,16 @@ async function discoverPlanSourceCandidates(input) {
     if (relativePath && !allowed(relativePath, excludes)) continue;
     let entryStat;
     try {
-      entryStat = await stat2(current);
+      entryStat = await lstat2(current);
     } catch {
       continue;
     }
+    if (entryStat.isSymbolicLink()) continue;
     if (entryStat.isDirectory()) {
       const entries = await readdir2(current, { withFileTypes: true });
-      for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+      for (const entry of entries.sort(
+        (a, b) => a.name.localeCompare(b.name)
+      )) {
         queue.push(join2(current, entry.name));
       }
       continue;
@@ -236583,7 +236735,13 @@ async function discoverPlanSourceCandidates(input) {
     if (!entryStat.isFile()) continue;
     const kind = planSourceKindByExtension.get(extname2(current).toLowerCase());
     if (!kind || !relativePath) continue;
-    if (entryStat.size > maxPlanSourceCharacters) continue;
+    if (entryStat.size > 2e6) {
+      if (looksLikePlanSource(relativePath))
+        throw new Error(
+          "Plan discovery found a pricing file above the 2 MB per-file limit. Split large pricing files before retrying."
+        );
+      continue;
+    }
     const contents = await readFile3(current, "utf8");
     const hasStripePriceId = stripePriceIdPattern.test(contents);
     const named = looksLikePlanSource(relativePath);
@@ -236603,13 +236761,15 @@ async function discoverPlanSourceCandidates(input) {
   );
   const confirmed = sorted.filter((candidate) => candidate.hasStripePriceId);
   const namedOnly = sorted.filter((candidate) => !candidate.hasStripePriceId);
-  return [...confirmed, ...namedOnly.slice(0, maxNamedOnlyCandidates)];
+  return [...confirmed, ...namedOnly];
 }
 async function readApprovedPlanSources(cwd2) {
   try {
     const raw = await readFile3(resolve3(cwd2, planSourceApprovalPath), "utf8");
     const parsed = JSON.parse(raw);
-    return Array.isArray(parsed.files) ? parsed.files.filter((value) => typeof value === "string") : [];
+    return Array.isArray(parsed.files) ? parsed.files.filter(
+      (value) => typeof value === "string"
+    ) : [];
   } catch {
     return [];
   }
@@ -236646,7 +236806,9 @@ async function buildPlanMappingHandoff(input) {
     if (!allowed(relativePath, [])) {
       throw new Error(`${relativePath} is not a readable plan source path.`);
     }
-    const kind = planSourceKindByExtension.get(extname2(relativePath).toLowerCase());
+    const kind = planSourceKindByExtension.get(
+      extname2(relativePath).toLowerCase()
+    );
     if (!kind) {
       throw new Error(`${relativePath} is not a supported plan source type.`);
     }
@@ -236666,7 +236828,7 @@ function planMappingRequestKey(input) {
 }
 
 // src/plan-branches.ts
-import { readdir as readdir3, readFile as readFile4, stat as stat3 } from "node:fs/promises";
+import { readdir as readdir3, readFile as readFile4, lstat as lstat3 } from "node:fs/promises";
 import { extname as extname3, join as join3, relative as relative3, resolve as resolve4, sep as sep2 } from "node:path";
 var maxPlanBranchFileCharacters = 2e6;
 var codeExtensions = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"]);
@@ -236796,7 +236958,9 @@ function clusterPlanBranches(branches) {
     return {
       branches: grouped,
       location: key2.slice(key2.indexOf("|") + 1),
-      planValues: [...new Set(grouped.map((branch) => branch.planValue))].sort(),
+      planValues: [
+        ...new Set(grouped.map((branch) => branch.planValue))
+      ].sort(),
       polarity: decided,
       shape: grouped[0].shape
     };
@@ -236824,20 +236988,26 @@ async function discoverPlanBranches(input) {
     if (relativePath && !allowed2(relativePath, excludes)) continue;
     let entryStat;
     try {
-      entryStat = await stat3(current);
+      entryStat = await lstat3(current);
     } catch {
       continue;
     }
+    if (entryStat.isSymbolicLink()) continue;
     if (entryStat.isDirectory()) {
       const entries = await readdir3(current, { withFileTypes: true });
-      for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+      for (const entry of entries.sort(
+        (a, b) => a.name.localeCompare(b.name)
+      )) {
         queue.push(join3(current, entry.name));
       }
       continue;
     }
     if (!entryStat.isFile() || !relativePath) continue;
     if (!codeExtensions.has(extname3(current).toLowerCase())) continue;
-    if (entryStat.size > maxPlanBranchFileCharacters) continue;
+    if (entryStat.size > maxPlanBranchFileCharacters)
+      throw new Error(
+        "Plan discovery found a source file above the 2 MB per-file limit. Split large source files before retrying."
+      );
     const lines = (await readFile4(current, "utf8")).split(/\r?\n/);
     collectConstants(lines, constants);
     lines.forEach((line, lineIndex) => {
@@ -236887,7 +237057,13 @@ var contextSchema = external_exports.object({
   integrationId: external_exports.string().nullable(),
   environment: external_exports.enum(["test", "production"]),
   catalogReady: external_exports.boolean(),
-  planNames: external_exports.array(external_exports.string())
+  planNames: external_exports.array(external_exports.string()),
+  catalogPrices: external_exports.array(
+    external_exports.object({
+      id: external_exports.string().regex(/^price_[A-Za-z0-9]+$/),
+      lookupKey: external_exports.string().nullable()
+    })
+  ).default([])
 });
 function safeRepositoryKey(remote) {
   const ssh = remote.match(/^[^@\s]+@([^:]+):(.+)$/);
@@ -236948,7 +237124,9 @@ async function runGuidedSetup(options) {
       await exec2("git", ["rev-parse", "HEAD"], { cwd: options.cwd });
       await exec2("git", ["remote", "get-url", "origin"], { cwd: options.cwd });
     } catch {
-      throw new Error("Repository setup needed: run this command inside your app\u2019s Git repository with an initial commit and an origin remote. No push or production deploy is required for discovery.");
+      throw new Error(
+        "Repository setup needed: run this command inside your app\u2019s Git repository with an initial commit and an origin remote. No push or production deploy is required for discovery."
+      );
     }
     const head = (await exec2("git", ["rev-parse", "HEAD"], { cwd: options.cwd })).stdout.trim();
     const diff = (await exec2(
@@ -236996,7 +237174,11 @@ async function runGuidedSetup(options) {
       )).trim()
     );
     if (!approved)
-      return { exitCode: options.prompt ? 0 : 2, stdout: "Discovery cancelled. Nothing was uploaded. Run npx --yes saasfunnels@latest setup when ready.\n", stderr: "" };
+      return {
+        exitCode: options.prompt ? 0 : 2,
+        stdout: "Discovery cancelled. Nothing was uploaded. Run npx --yes saasfunnels@latest setup when ready.\n",
+        stderr: ""
+      };
     run = (await request("/api/developer-tools/setup/runs", {
       generation: context.generation,
       repositoryKey,
@@ -237040,6 +237222,10 @@ async function runGuidedSetup(options) {
     };
     const send = (evidence) => {
       const currentStage = stage;
+      if (JSON.stringify({ runId: run.id, stage: currentStage, evidence }).length > 1e6)
+        throw new Error(
+          "Feature discovery evidence exceeds the upload size limit. Review the source scope before retrying."
+        );
       heartbeat = heartbeat.then(async () => {
         const result3 = await request("/api/developer-tools/setup/evidence", {
           runId: run.id,
@@ -237049,7 +237235,8 @@ async function runGuidedSetup(options) {
         if (typeof result3.sequence === "number")
           run.sequence = result3.sequence;
         run.receipts[currentStage] = result3.receipt ?? { complete: true };
-        if (currentStage === "plans") run.planNames = result3.planNames ?? evidence.plans.flatMap((plan) => [plan.key, plan.name]);
+        if (currentStage === "plans")
+          run.planNames = result3.planNames ?? evidence.plans.flatMap((plan) => [plan.key, plan.name]);
       });
       return heartbeat;
     };
@@ -237063,7 +237250,9 @@ async function runGuidedSetup(options) {
       void update(progressState, progressFailure).catch(() => {
       });
     }, 3e4);
-    options.progress?.(run.receipts.features ? "2/4 Features already submitted." : "2/4 Discovering features\u2026");
+    options.progress?.(
+      run.receipts.features ? "2/4 Features already submitted." : "2/4 Discovering features\u2026"
+    );
     if (!run.receipts.features) {
       await update("running");
       const scan = await runFeatureSetup({
@@ -237074,8 +237263,15 @@ async function runGuidedSetup(options) {
         manifestOnly: true,
         accept: ["all"]
       });
-      if (!scan.coverage.complete)
-        throw new Error("Feature discovery needs attention: no supported source was scanned or the scan limit was reached. No feature evidence was submitted. Ask your developer to review scanner coverage before retrying.");
+      if (!scan.coverage.complete) {
+        const reason = scan.coverage.byteLimitReached ? `${scan.coverage.oversizedFileCount} source file(s) exceed the 2 MB per-file limit. Split large source files before retrying.` : !scan.coverage.scannedFiles ? "No JavaScript or TypeScript app files were found in the source roots. Run from the application folder." : "More than 10,000 feature bindings were found. Review the source scope before retrying.";
+        throw new Error(
+          `Feature discovery needs attention: ${reason} Scanned ${scan.coverage.scannedFiles} of ${scan.coverage.matchedFiles} files. Nothing was submitted for this stage.`
+        );
+      }
+      options.progress?.(
+        `Scanned ${scan.scannedFileCount} files; found ${scan.manifest.features.length} feature proposals.`
+      );
       if (!scan.ok)
         throw new Error(
           "Feature discovery needs attention. Run features setup to review the local findings."
@@ -237090,7 +237286,10 @@ async function runGuidedSetup(options) {
       );
     }
     stage = "plans";
-    if (!context.catalogReady) options.progress?.("Waiting for your Stripe catalog. Setup can stay open while it imports\u2026");
+    if (!context.catalogReady)
+      options.progress?.(
+        "Waiting for your Stripe catalog. Setup can stay open while it imports\u2026"
+      );
     const catalogDeadline = Date.now() + 5 * 6e4;
     const generation = context.generation;
     while (!context.catalogReady && Date.now() < catalogDeadline) {
@@ -237108,53 +237307,83 @@ async function runGuidedSetup(options) {
         stdout: "Stripe is still importing. Run npx --yes saasfunnels@latest setup --resume when the catalog is ready.\n",
         stderr: ""
       };
-    options.progress?.(run.receipts.plans ? "3/4 Plans already submitted." : "3/4 Discovering plans and prices\u2026");
+    options.progress?.(
+      run.receipts.plans ? "3/4 Plans already submitted." : "3/4 Discovering plans and prices\u2026"
+    );
     if (!run.receipts.plans) {
       await update("running");
       const candidates = await discoverPlanSourceCandidates({
         cwd: options.cwd
       });
+      let manual = null;
       try {
-        if (candidates.length > 12) throw new Error("Too many sources");
-        let manual = null;
+        manual = await readFile5(
+          join4(options.cwd, ".saasfunnels/setup-pricing.json"),
+          "utf8"
+        );
+      } catch (error51) {
+        if (error51.code !== "ENOENT") throw error51;
+      }
+      const byKey = /* @__PURE__ */ new Map();
+      const reviewedFiles = [];
+      const issues = [];
+      const sources = manual !== null ? [{ path: ".saasfunnels/setup-pricing.json", kind: "json" }] : candidates;
+      for (const candidate of sources) {
         try {
-          manual = await readFile5(
-            join4(options.cwd, ".saasfunnels/setup-pricing.json"),
-            "utf8"
+          const plans = extractSetupPricing(
+            manual ?? await readFile5(join4(options.cwd, candidate.path), "utf8"),
+            candidate.kind,
+            context.catalogPrices
           );
+          for (const plan of plans) {
+            if (byKey.has(plan.key) && JSON.stringify(byKey.get(plan.key)) !== JSON.stringify(plan))
+              throw new PricingExtractionError(
+                "needs_review",
+                "Conflicting declarations for the same plan."
+              );
+            byKey.set(plan.key, plan);
+          }
+          reviewedFiles.push(candidate.path);
         } catch (error51) {
-          if (error51.code !== "ENOENT") throw error51;
+          if (manual === null && error51 instanceof PricingExtractionError && error51.code === "no_declarations")
+            continue;
+          issues.push({
+            file: candidate.path,
+            reason: error51 instanceof PricingExtractionError ? error51.message : "Unsupported pricing syntax."
+          });
         }
-        const discovered = manual !== null ? extractSetupPricing(manual, "json") : (await Promise.all(
-          candidates.map(
-            async (candidate) => extractSetupPricing(
-              await readFile5(join4(options.cwd, candidate.path), "utf8"),
-              candidate.kind
-            )
-          )
-        )).flat();
-        const byKey = /* @__PURE__ */ new Map();
-        for (const plan of discovered) {
-          if (byKey.has(plan.key) && JSON.stringify(byKey.get(plan.key)) !== JSON.stringify(plan))
-            throw new Error("Conflicting pricing sources");
-          byKey.set(plan.key, plan);
-        }
-        await send({
-          plans: [...byKey.values()],
-          reviewedFiles: manual !== null ? [".saasfunnels/setup-pricing.json"] : candidates.map((c) => c.path)
+      }
+      if (reviewedFiles.length > 12 || byKey.size > 200)
+        issues.push({
+          file: "pricing",
+          reason: "Combine the pricing declarations into at most 12 files and 200 plans."
         });
-      } catch {
+      if (issues.length) {
+        await writeFile3(
+          join4(options.cwd, ".saasfunnels/setup-review.json"),
+          JSON.stringify({ stage: "plans", issues }, null, 2) + "\n",
+          { mode: 384 }
+        );
         await update("waiting", "extraction_unsupported");
         return {
           exitCode: 2,
-          stdout: "Pricing discovery needs manual review. Create .saasfunnels/setup-pricing.json with a plans array containing key, name, features (boolean or numeric access), and prices (Stripe price IDs). Review it, then run npx --yes saasfunnels@latest setup --resume. No source files were uploaded.\n",
+          stdout: `Pricing needs review in ${issues.length} file(s). See .saasfunnels/setup-review.json for the exact files and reasons. Ask your coding agent to review those declarations, or prepare .saasfunnels/setup-pricing.json, then run npx --yes saasfunnels@latest setup --resume. No pricing evidence was submitted.
+`,
           stderr: ""
         };
       }
+      options.progress?.(
+        `Found ${byKey.size} plan proposals in ${reviewedFiles.length} pricing files.`
+      );
+      await send({ plans: [...byKey.values()], reviewedFiles });
     }
     stage = "branches";
-    const planValues = [.../* @__PURE__ */ new Set([...context.planNames, ...run.planNames ?? []])];
-    options.progress?.(run.receipts.branches ? "4/4 Plan checks already submitted." : "4/4 Checking plan conditions\u2026");
+    const planValues = [
+      .../* @__PURE__ */ new Set([...context.planNames, ...run.planNames ?? []])
+    ];
+    options.progress?.(
+      run.receipts.branches ? "4/4 Plan checks already submitted." : "4/4 Checking plan conditions\u2026"
+    );
     if (!run.receipts.branches) {
       await update("running");
       const branches = planValues.length ? await discoverPlanBranches({
@@ -237173,6 +237402,7 @@ async function runGuidedSetup(options) {
           symbol: branch.symbol
         }))
       }));
+      options.progress?.(`Found ${clusters.length} groups of plan conditions.`);
       await send({
         clusters,
         environment: context.environment,
@@ -237192,7 +237422,7 @@ async function runGuidedSetup(options) {
     clearInterval(timer);
     await reportFailure?.().catch(() => {
     });
-    const safe = error51 instanceof Error && /^(Setup request failed|Connect Stripe|The app connection|Use a repository|Feature discovery|Repository setup)/.test(
+    const safe = error51 instanceof Error && /^(Setup request failed|Connect Stripe|The app connection|Use a repository|Feature discovery|Plan discovery|Repository setup)/.test(
       error51.message
     ) ? error51.message : "Setup could not finish. Check local repository access and developer credentials, then resume.";
     return { exitCode: 2, stdout: "", stderr: safe + "\n" };
@@ -237247,7 +237477,7 @@ import { mkdir as mkdir4, readFile as readFile6, writeFile as writeFile4 } from
 
 // src/identity.ts
 var SAASFUNNELS_CLI_NAME = "saasfunnels";
-var SAASFUNNELS_CLI_VERSION = "0.3.1";
+var SAASFUNNELS_CLI_VERSION = "0.3.2";
 var SAASFUNNELS_PRODUCT_NAME = "SaaSFunnels";
 var SAASFUNNELS_DEFAULT_API_BASE_URL = "https://app.saasfunnels.ai";
 var SAASFUNNELS_ENV = Object.freeze({

package/dist/types/feature-setup.d.ts

@@ -125,6 +125,8 @@ export type FeatureSetupResult = {
         complete: boolean;
         matchedFiles: number;
         scannedFiles: number;
+        scannedBytes: number;
+        oversizedFileCount: number;
         byteLimitReached: boolean;
         candidateLimitReached: boolean;
     };

package/dist/types/identity.d.ts

@@ -1,5 +1,5 @@
 export declare const SAASFUNNELS_CLI_NAME = "saasfunnels";
-export declare const SAASFUNNELS_CLI_VERSION = "0.3.1";
+export declare const SAASFUNNELS_CLI_VERSION = "0.3.2";
 export declare const SAASFUNNELS_PRODUCT_NAME = "SaaSFunnels";
 export declare const SAASFUNNELS_DEFAULT_API_BASE_URL = "https://app.saasfunnels.ai";
 export declare const SAASFUNNELS_ENV: Readonly<{

package/dist/types/mcp.d.ts

@@ -77,7 +77,7 @@ export type SaaSFunnelsMcpOptions = {
     output?: Pick<NodeJS.WritableStream, "write">;
 };
 declare const mcpProtocolVersion = "2025-06-18";
-declare const mcpServerVersion = "0.3.1";
+declare const mcpServerVersion = "0.3.2";
 export declare function saasFunnelsMcpResources(): McpResourceDefinition[];
 export declare function readSaaSFunnelsMcpResource(uri: string, options?: SaaSFunnelsMcpOptions): string;
 export declare function saasFunnelsMcpToolDefinitions({ allowFunnelTests, allowFunnelWrites, allowTestWrites, includeHostedAccountTools, }?: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "saasfunnels",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "private": false,
   "description": "SaaSFunnels CLI and local stdio MCP server",
   "author": "SaaSFunnels",