saasfunnels 0.4.0 → 0.4.2

package/README.md

@@ -51,7 +51,7 @@ approved set is reviewable.
 - uses: LeadEngine-ai/saasfunnels-cli/action@v0.2.1
   with:
     api-key: ${{ secrets.SAASFUNNELS_API_KEY }}
-    cli-version: 0.2.1          # pin it; a floating version rebaselines drift
+    cli-version: 0.2.1 # pin it; a floating version rebaselines drift
     discovery-roots: app,lib
 ```
 
@@ -63,8 +63,8 @@ measured against a comparable scan rather than a wider or narrower one.
 Plan and pricing upload is opt-in:
 
 ```yaml
-    plan-sources: "true"
-    integration-id: <stripe integration id>
+plan-sources: "true"
+integration-id: <stripe integration id>
 ```
 
 It runs only on the default branch, requires a committed
@@ -100,7 +100,7 @@ Support: support@saasfunnels.ai
 
 Use `saasfunnels setup run` from the application repository after creating app credentials in Setup. Load `SAASFUNNELS_API_KEY` from **Developer setup access** into the local process environment. Its scopes are `developer:read` and `features:write`; it is not a browser or payment-administration key.
 
-The command asks before uploading structured discovery proposals. `--send` provides explicit non-interactive approval. It coordinates features, pricing extraction, and plan branches, reports progress, and waits for the Stripe catalog. Run `saasfunnels setup run --resume` after an interruption. Existing accepted stages and customer review decisions are preserved.
+The command asks before uploading structured discovery proposals. `--send` provides explicit non-interactive approval. It coordinates features, pricing extraction, and plan branches, reports progress, and waits for the Stripe catalog. Run `saasfunnels setup run --resume` after an interruption. Existing accepted stages and customer review decisions are preserved. Coverage questions include a SHA-256 fingerprint of their affected files so changed application behavior can reopen an answer while unrelated file changes keep it. Only the fingerprint and bounded paths are uploaded, never source contents.
 
 The scanner reads supported application files one at a time without the old 500-file, 2 MB repository, or 200-candidate cutoffs. Generated code, tests, and symlinks are excluded. Files over 2 MB and uploads over the server limit stop with a specific recovery message.
 

package/dist/library.js

@@ -235858,7 +235858,7 @@ function validateFeatureCatalogManifest(value) {
 
 // src/identity.ts
 var SAASFUNNELS_CLI_NAME = "saasfunnels";
-var SAASFUNNELS_CLI_VERSION = "0.4.0";
+var SAASFUNNELS_CLI_VERSION = "0.4.2";
 var SAASFUNNELS_PRODUCT_NAME = "SaaSFunnels";
 var SAASFUNNELS_DEFAULT_API_BASE_URL = "https://app.saasfunnels.ai";
 var SAASFUNNELS_ENV = Object.freeze({

package/dist/saasfunnels.js

@@ -233702,6 +233702,38 @@ function declarations(source, featuresOnly = false) {
     true,
     import_typescript2.default.ScriptKind.TSX
   );
+  const validatorBindings = /* @__PURE__ */ new Map();
+  for (const statement of file2.statements) {
+    if (!import_typescript2.default.isImportDeclaration(statement) || !import_typescript2.default.isStringLiteral(statement.moduleSpecifier) || !/^(?:zod(?:\/.*)?|yup|joi|valibot|superstruct)$/.test(
+      statement.moduleSpecifier.text
+    ))
+      continue;
+    const clause = statement.importClause;
+    if (clause?.name) validatorBindings.set(clause.name.text, "namespace");
+    const bindings = clause?.namedBindings;
+    if (bindings && import_typescript2.default.isNamespaceImport(bindings))
+      validatorBindings.set(bindings.name.text, "namespace");
+    if (bindings && import_typescript2.default.isNamedImports(bindings))
+      for (const item of bindings.elements)
+        validatorBindings.set(
+          item.name.text,
+          item.propertyName?.text ?? item.name.text
+        );
+  }
+  const schemaConstructors = /^(?:object|strictObject|looseObject|record|array|tuple|union|intersection|discriminatedUnion|lazy|recursive|struct)$/;
+  const schemaModifiers = /^(?:strict|passthrough|strip|optional|nullable|nullish|default|describe|meta|refine|superRefine|transform|pipe|readonly|brand|extend|merge|pick|omit|partial|required|min|max)$/;
+  function validationSchema(node) {
+    if (import_typescript2.default.isAsExpression(node) || import_typescript2.default.isSatisfiesExpression(node) || import_typescript2.default.isParenthesizedExpression(node))
+      return validationSchema(node.expression);
+    if (!import_typescript2.default.isCallExpression(node)) return false;
+    const callee = node.expression;
+    if (import_typescript2.default.isIdentifier(callee))
+      return schemaConstructors.test(validatorBindings.get(callee.text) ?? "");
+    if (!import_typescript2.default.isPropertyAccessExpression(callee)) return false;
+    if (import_typescript2.default.isIdentifier(callee.expression) && validatorBindings.has(callee.expression.text) && schemaConstructors.test(callee.name.text))
+      return true;
+    return schemaModifiers.test(callee.name.text) && validationSchema(callee.expression);
+  }
   const values = /* @__PURE__ */ new Map();
   const roots = [];
   const planName = /^(plans?|pricing|tiers?|billingCatalog|planCatalog|subscriptionPlans)$/i;
@@ -233718,6 +233750,7 @@ function declarations(source, featuresOnly = false) {
       for (const declaration of statement.declarationList.declarations) {
         if (import_typescript2.default.isIdentifier(declaration.name) && declaration.initializer && isProductNode(declaration)) {
           values.set(declaration.name.text, declaration.initializer);
+          if (validationSchema(declaration.initializer)) continue;
           if (planName.test(declaration.name.text) || containsAccess(declaration.initializer) && containsAccess(
             declaration.initializer,
             /^(prices|stripePriceId)$/
@@ -233725,7 +233758,7 @@ function declarations(source, featuresOnly = false) {
             roots.push(declaration.initializer);
         }
       }
-    if (import_typescript2.default.isExportAssignment(statement) && containsAccess(statement.expression))
+    if (import_typescript2.default.isExportAssignment(statement) && containsAccess(statement.expression) && !validationSchema(statement.expression))
       roots.push(statement.expression);
   }
   function read(node, depth = 0, locals = /* @__PURE__ */ new Map()) {
@@ -233928,7 +233961,7 @@ function extractSetupPricing(source, kind, catalogPrices = [], options = {}) {
 
 // src/identity.ts
 var SAASFUNNELS_CLI_NAME = "saasfunnels";
-var SAASFUNNELS_CLI_VERSION = "0.4.0";
+var SAASFUNNELS_CLI_VERSION = "0.4.2";
 var SAASFUNNELS_PRODUCT_NAME = "SaaSFunnels";
 var SAASFUNNELS_DEFAULT_API_BASE_URL = "https://app.saasfunnels.ai";
 var SAASFUNNELS_ENV = Object.freeze({
@@ -233959,6 +233992,9 @@ function saasFunnelsPublicText(value) {
   ).replaceAll("prevenueFeatureKeys", "saasFunnelsFeatureKeys").replaceAll("PrevenueFeatureKey", "SaaSFunnelsFeatureKey").replaceAll("SaaSFunnels", SAASFUNNELS_PRODUCT_NAME);
 }
 
+// src/discovery-coverage.ts
+import { createHash as createHash3 } from "node:crypto";
+
 // src/plan-analysis.ts
 var import_typescript3 = __toESM(require_typescript(), 1);
 function effect(node) {
@@ -237287,9 +237323,10 @@ async function discoverCoverageLimitations(cwd2) {
     );
   const sources = /* @__PURE__ */ new Map();
   const results = /* @__PURE__ */ new Map();
+  const evidence = /* @__PURE__ */ new Map();
   const record3 = (code, file2) => {
     const paths = results.get(code) ?? /* @__PURE__ */ new Set();
-    if (paths.size < 12) paths.add(file2);
+    paths.add(file2);
     results.set(code, paths);
   };
   for (const path of files) {
@@ -237302,6 +237339,14 @@ async function discoverCoverageLimitations(cwd2) {
     if (/\.(?:py|rb|go|rs|java|kt|cs|php|ex|exs|scala|swift|vue|svelte)$/.test(
       path
     )) {
+      if (stat.size > 2e6)
+        throw new Error(
+          "Unsupported source exceeds the 2 MB scan limit. Narrow the discovery scope before retrying."
+        );
+      evidence.set(
+        path,
+        createHash3("sha256").update(await readFile3(join2(cwd2, path))).digest("hex")
+      );
       record3("unsupported_language", path);
       continue;
     }
@@ -237309,6 +237354,7 @@ async function discoverCoverageLimitations(cwd2) {
       continue;
     const source = await readFile3(join2(cwd2, path), "utf8");
     sources.set(path, source);
+    evidence.set(path, createHash3("sha256").update(source).digest("hex"));
     const file2 = parseApplicationSource(path, source);
     const visit = (node) => {
       if (!isProductNode(node)) return;
@@ -237351,11 +237397,20 @@ async function discoverCoverageLimitations(cwd2) {
     ))
       record3("dynamic_access", path);
   }
-  return [...results].map(([code, paths]) => ({ code, files: [...paths] }));
+  return [...results].map(([code, paths]) => ({
+    code,
+    files: [...paths].sort().slice(0, 12),
+    // Include all affected files in the receipt, even when the UI path list is capped.
+    sourceFingerprint: createHash3("sha256").update(
+      JSON.stringify(
+        [...paths].sort().map((path) => [path, evidence.get(path)])
+      )
+    ).digest("hex")
+  }));
 }
 
 // src/setup-run.ts
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 import { execFile as execFile4 } from "node:child_process";
 import { promisify as promisify4 } from "node:util";
 import { readFile as readFile6, writeFile as writeFile3, mkdir as mkdir3 } from "node:fs/promises";
@@ -237540,7 +237595,7 @@ function planMappingRequestKey(input) {
 }
 
 // src/plan-branches.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 import { readdir as readdir3, readFile as readFile5, lstat as lstat4 } from "node:fs/promises";
 import { extname as extname3, join as join4, relative as relative3, resolve as resolve4, sep as sep2 } from "node:path";
 var maxPlanBranchFileCharacters = 2e6;
@@ -237562,7 +237617,7 @@ function clusterPlanBranches(branches) {
   const clusters = /* @__PURE__ */ new Map();
   for (const branch of branches) {
     const fullLocation = `${branch.repositoryPath}::${branch.symbol}`;
-    const location = fullLocation.length <= 400 ? fullLocation : `${fullLocation.slice(0, 367)}~${createHash3("sha256").update(fullLocation).digest("hex").slice(0, 32)}`;
+    const location = fullLocation.length <= 400 ? fullLocation : `${fullLocation.slice(0, 367)}~${createHash4("sha256").update(fullLocation).digest("hex").slice(0, 32)}`;
     const key3 = `${branch.shape}|${location}`;
     const existing = clusters.get(key3);
     if (existing) existing.push(branch);
@@ -237652,7 +237707,7 @@ async function discoverPlanBranches(input) {
 
 // src/setup-run.ts
 var exec4 = promisify4(execFile4);
-var hash2 = (text) => createHash4("sha256").update(text).digest("hex");
+var hash2 = (text) => createHash5("sha256").update(text).digest("hex");
 var contextSchema = external_exports.object({
   contractVersion: external_exports.literal(3),
   minimumCliVersion: external_exports.string(),
@@ -237704,6 +237759,10 @@ async function runGuidedSetup(options) {
       ...body === void 0 ? {} : { body: JSON.stringify(body) },
       signal: AbortSignal.timeout(3e4)
     });
+    if (response.status === 426)
+      throw new Error(
+        "Setup request failed: update the installer with npx --yes saasfunnels@latest setup run"
+      );
     if (!response.ok)
       throw new Error(
         `Setup request failed (${response.status}). Check installation access and retry.`
@@ -237782,15 +237841,15 @@ async function runGuidedSetup(options) {
         }
       })
     );
-    const revision = `${head}:${hash2(JSON.stringify(["configuration-v3", diff, sourceHashes, reviewedInputs]))}`;
+    const revision = `${head}:${hash2(JSON.stringify(["configuration-v3", SAASFUNNELS_CLI_VERSION, diff, sourceHashes, reviewedInputs]))}`;
     const remote = (await exec4("git", ["remote", "get-url", "origin"], { cwd: options.cwd })).stdout.trim();
     const repositoryKey = safeRepositoryKey(remote);
     const statePath = join5(options.cwd, ".saasfunnels", "setup-run.json");
     if (options.resume) {
       const saved = JSON.parse(await readFile6(statePath, "utf8"));
-      if (saved.generation !== context.generation || saved.repositoryKey !== repositoryKey || saved.revision !== revision)
+      if (saved.cliVersion !== SAASFUNNELS_CLI_VERSION || saved.generation !== context.generation || saved.repositoryKey !== repositoryKey || saved.revision !== revision)
         throw new Error(
-          "The app connection or revision changed. Run setup again without --resume."
+          "The app connection, installer, or source changed. Start a fresh scan: npx --yes saasfunnels@latest setup run"
         );
     }
     const approved = options.send || options.prompt && /^y(es)?$/i.test(
@@ -237815,6 +237874,7 @@ async function runGuidedSetup(options) {
       statePath,
       JSON.stringify(
         {
+          cliVersion: SAASFUNNELS_CLI_VERSION,
           generation: context.generation,
           repositoryKey,
           revision,

package/dist/types/identity.d.ts

@@ -1,5 +1,5 @@
 export declare const SAASFUNNELS_CLI_NAME = "saasfunnels";
-export declare const SAASFUNNELS_CLI_VERSION = "0.4.0";
+export declare const SAASFUNNELS_CLI_VERSION = "0.4.2";
 export declare const SAASFUNNELS_PRODUCT_NAME = "SaaSFunnels";
 export declare const SAASFUNNELS_DEFAULT_API_BASE_URL = "https://app.saasfunnels.ai";
 export declare const SAASFUNNELS_ENV: Readonly<{

package/dist/types/mcp.d.ts

@@ -77,7 +77,7 @@ export type SaaSFunnelsMcpOptions = {
     output?: Pick<NodeJS.WritableStream, "write">;
 };
 declare const mcpProtocolVersion = "2025-06-18";
-declare const mcpServerVersion = "0.4.0";
+declare const mcpServerVersion = "0.4.2";
 export declare function saasFunnelsMcpResources(): McpResourceDefinition[];
 export declare function readSaaSFunnelsMcpResource(uri: string, options?: SaaSFunnelsMcpOptions): string;
 export declare function saasFunnelsMcpToolDefinitions({ allowFunnelTests, allowFunnelWrites, allowTestWrites, includeHostedAccountTools, }?: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "saasfunnels",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "private": false,
   "description": "SaaSFunnels CLI and local stdio MCP server",
   "author": "SaaSFunnels",