feat(plapi): stamp from_source=cli on authenticated app creation

.changeset/cli-attribution-stamp.md

@@ -0,0 +1,5 @@
+---
+"clerk": minor
+---
+
+Stamp authenticated CLI app creation with `from_source=cli` so apps created through Clerk CLI flows are attributable in Clerk's analytics. The value is set on the PLAPI request body and persists to `applications.from_source`. Requires matching PLAPI support to be deployed server-side.

packages/cli-core/src/lib/plapi.test.ts

@@ -305,7 +305,7 @@ describe("plapi", () => {
       await createApplication("My App");
       expect(capturedMethod).toBe("POST");
       expect(capturedUrl).toBe("https://api.clerk.com/v1/platform/applications");
-      expect(JSON.parse(capturedBody)).toEqual({ name: "My App" });
+      expect(JSON.parse(capturedBody)).toEqual({ name: "My App", from_source: "cli" });
     });
 
     test("sends Content-Type and Authorization headers", async () => {

packages/cli-core/src/lib/plapi.ts

@@ -9,6 +9,19 @@ import { CliError, PlapiError, ERROR_CODE } from "./errors.ts";
 import { loggedFetch } from "./fetch.ts";
 import { log } from "./log.ts";
 
+/**
+ * Canonical attribution marker written to `applications.from_source` when the
+ * CLI creates an application through PLAPI. Surfaces in BigQuery via
+ * `dim_applications.from_source` for growth analytics. Do not change without
+ * coordinating with the growth-data team - the value is consumed by dbt
+ * models and dashboards downstream.
+ */
+const CLI_FROM_SOURCE = "cli";
+
+/**
+ * Validate that a key has the expected prefix and suggest the correct key type
+ * if the user mixed them up.
+ */
 export function validateKeyPrefix(key: string, expected: "ak_" | "sk_"): void {
   if (key.startsWith(expected)) return;
 
@@ -167,7 +180,9 @@ export const patchInstanceConfig = (
 
 export async function createApplication(name: string): Promise<Application> {
   const url = new URL("/v1/platform/applications", getPlapiBaseUrl());
-  const response = await plapiFetch("POST", url, { body: JSON.stringify({ name }) });
+  const response = await plapiFetch("POST", url, {
+    body: JSON.stringify({ name, from_source: CLI_FROM_SOURCE }),
+  });
   return response.json() as Promise<Application>;
 }