PostHog contract maintenance

plugin.json generates the api group from the reviewed openapi.json snapshot plus openapi.overlay.yaml, and the capture group from the handwritten capture.openapi.yaml: PostHog publishes no OpenAPI document for its public ingestion endpoints. sourceUrl records the upstream schema location. Released package artifacts are immutable.

Regenerate from the repository root with installed workspace dependencies:

dual openapi-plugin plugins/posthog-api
bun run --cwd plugins/posthog-api ci:check

The live schema changes on most PostHog deploys. Refresh the snapshot only deliberately, by downloading sourceUrl and minifying it into openapi.json, then review the reported action changes before bumping the package version.

src/auth.ts routes the app API to the connection's region or self-hosted host with the personal API key, and ingestion to the matching ingestion host without it; capture and flag calls carry the project API key in their body. src/triggers.ts owns the triggers: the webhook triggers manage an HTTP Webhook destination signed with a Standard Webhooks secret, and the polling triggers read HogQL events and the activity log with an overlapping window.