chore(codegen): daily schema refresh (2026-07-14)

[timgl]

Summary

Daily automated OpenAPI schema refresh. Regenerated src/generated/api.d.ts
from the live PostHog spec (https://us.posthog.com/api/schema/?format=json,
filtered by openapi-filter.yaml) and patched two managed-resource client
bindings for renamed generated component schemas.

Why: keep the typed client in sync with the live API so downstream
consumers compile against accurate request/response shapes.

Spec diff size

• src/generated/api.d.ts: +2802 / −290 lines (17,571 → 20,083).
• Change is entirely schema/field drift on already-managed operations — no new
  API paths entered the managed set.

New operationIds added to the filter

None. The drift trigger lists every operationId not in the allowlist (~1500),
but that is the standing set of intentionally-unmanaged endpoints — this tool is
an infrastructure-as-code layer over a curated set of resource families
(insights, dashboards, feature flags, experiments + holdouts/saved-metrics,
cohorts, actions, endpoints, event definitions, event schemas, schema property
groups, project settings). None of the unmanaged operationIds are a missing core
CRUD operation for an existing managed family, and none constitute a new resource
family worth managing here. So openapi-filter.yaml is unchanged.

Resources touched

Codegen surfaced three renamed component schemas on managed operations, fixed
minimally in the Zod client bindings (no refactor):

Resource	Old schema	New schema
dashboard (partial_update body)	PatchedDashboard	PatchedPatchedDashboardOpenApi
experiment (partial_update body)	PatchedExperiment	PatchedExperimentWrite
experiment (list response)	PaginatedExperimentList	PaginatedExperimentBasicList

Verified PatchedPatchedDashboardOpenApi still carries the restriction_level
and tiles fields the dashboard pipeline projects.

pnpm typecheck and pnpm test (291 tests) both pass after the patch.

Unresolved drift

• No managed operationId was removed from the live spec — all 71 allowlisted
  operations still resolve.
• Note: the experiments create body renamed Experiment → ExperimentWrite
  upstream. The client casts the payload via as unknown as, so it still
  typechecks against the (still-present) Experiment read schema and runtime is
  unaffected; left as-is to keep the diff minimal. Flagging for a human if a
  tighter binding is desired.

TaskRun

d558a6f9-6481-4885-be56-1beaaadc2e62

---

Created with PostHog Code

[timgl]

🤖 Automated CI triage — schema-refresh agent

The only failing check is semgrep (2 blocking run-shell-injection findings). Both are in .github/workflows/release.yml (lines ~37–50, ${{ inputs.dist-tag }} / ${{ steps.tag.outputs.tag }} interpolated directly into run: steps):

• yaml.github-actions.security.run-shell-injection.run-shell-injection
• dotgithub-repo..semgrep.rules.github-actions-shell-injection

These are not introduced by this PR. This PR only touches src/generated/api.d.ts, src/resources/dashboard/client.ts, and src/resources/experiment/client.ts (git diff main...HEAD -- .github/ is empty). The flagged lines were last changed in #11 on main; semgrep runs on pull_request, so this is just the first PR to surface a pre-existing issue.

I'm not fixing it in this turn: it's outside this schema-refresh PR's scope and lives in .github/workflows/**, which the agent is not permitted to modify. The remediation (move the ${{ … }} values into env: and reference "$ENVVAR" in the run: scripts) should land as its own PR against release.yml.

The PR's own changes are green locally: pnpm typecheck passes and all 291 tests pass.