@ekanos/cli 0.10.0 → 0.12.0

package/dist/connections-api.d.ts

@@ -0,0 +1,125 @@
+import { z } from 'zod';
+export declare const SourceConnectionSchema: z.ZodObject<{
+    slug: z.ZodString;
+    name: z.ZodString;
+    connected: z.ZodBoolean;
+    connectedBy: z.ZodNullable<z.ZodString>;
+    connectedAt: z.ZodNullable<z.ZodString>;
+    scope: z.ZodNullable<z.ZodString>;
+    app: z.ZodEnum<{
+        fields: "fields";
+        "source-app": "source-app";
+    }>;
+    fields: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        label: z.ZodString;
+        description: z.ZodNullable<z.ZodString>;
+        sensitive: z.ZodBoolean;
+        set: z.ZodBoolean;
+        value: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+    missing: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export type SourceConnection = z.infer<typeof SourceConnectionSchema>;
+export type ConnectionsApiResult<T> = {
+    status: 'ok';
+    data: T;
+} | {
+    status: 'unauthorized';
+}
+/** The integration supports no Source connection (409 NO_SOURCE_CONNECTION). */
+ | {
+    status: 'unsupported';
+    message: string;
+}
+/** App fields are still missing (409 NOT_CONFIGURED). */
+ | {
+    status: 'not-configured';
+    missing: string[];
+    connection: SourceConnection | null;
+};
+export declare function listConnections(host: string, token: string, source: string): Promise<ConnectionsApiResult<{
+    source: {
+        id: string;
+        slug: string;
+        name: string | null;
+    };
+    connections: {
+        slug: string;
+        name: string;
+        connected: boolean;
+        connectedBy: string | null;
+        connectedAt: string | null;
+        scope: string | null;
+        app: "fields" | "source-app";
+        fields: {
+            name: string;
+            label: string;
+            description: string | null;
+            sensitive: boolean;
+            set: boolean;
+            value: string | null;
+        }[];
+        missing: string[];
+    }[];
+}>>;
+export declare function showConnection(host: string, token: string, source: string, product: string): Promise<ConnectionsApiResult<{
+    source: {
+        id: string;
+        slug: string;
+        name: string | null;
+    };
+    connection: {
+        slug: string;
+        name: string;
+        connected: boolean;
+        connectedBy: string | null;
+        connectedAt: string | null;
+        scope: string | null;
+        app: "fields" | "source-app";
+        fields: {
+            name: string;
+            label: string;
+            description: string | null;
+            sensitive: boolean;
+            set: boolean;
+            value: string | null;
+        }[];
+        missing: string[];
+    };
+    callbackUrls: string[];
+}>>;
+export declare function startConnection(host: string, token: string, body: {
+    source: string;
+    product: string;
+    fields?: Record<string, string>;
+}): Promise<ConnectionsApiResult<{
+    source: {
+        id: string;
+        slug: string;
+        name: string | null;
+    };
+    connection: {
+        slug: string;
+        name: string;
+        connected: boolean;
+        connectedBy: string | null;
+        connectedAt: string | null;
+        scope: string | null;
+        app: "fields" | "source-app";
+        fields: {
+            name: string;
+            label: string;
+            description: string | null;
+            sensitive: boolean;
+            set: boolean;
+            value: string | null;
+        }[];
+        missing: string[];
+    };
+    authorizeUrl: string;
+    callbackUrl: string;
+}>>;
+export declare function deleteConnection(host: string, token: string, source: string, product: string): Promise<ConnectionsApiResult<{
+    removed: boolean;
+}>>;

package/dist/connections-api.js

@@ -0,0 +1,156 @@
+import { z } from 'zod';
+import { request } from './auth/ekanos-api.js';
+import { authRequiredError, forbiddenError, invalidStateError, networkError, notFoundError, usageError, } from './errors.js';
+/**
+ * The CLI's client for a Source's connections (plan 241): an integration a
+ * Source admin connects ONCE for the whole Source, used by the Source's
+ * provided agents in every team whose template marks it `owner: "source"`.
+ *
+ *   GET    /api/partner/connections?source=<slug|id>
+ *   GET    /api/partner/connections/<product>?source=<slug|id>
+ *   POST   /api/partner/connections/<product>  { source, fields? }  → authorizeUrl
+ *   DELETE /api/partner/connections/<product>?source=<slug|id>
+ *
+ * The shapes are read here rather than from `@ekanos/integration-schema`, so
+ * this CLI works against a host without a schema release.
+ */
+const SourceRefSchema = z.object({
+    id: z.string(),
+    slug: z.string(),
+    name: z.string().nullable(),
+});
+export const SourceConnectionSchema = z.object({
+    slug: z.string(),
+    name: z.string(),
+    connected: z.boolean(),
+    connectedBy: z.string().nullable(),
+    connectedAt: z.string().nullable(),
+    scope: z.string().nullable(),
+    app: z.enum(['source-app', 'fields']),
+    fields: z.array(z.object({
+        name: z.string(),
+        label: z.string(),
+        description: z.string().nullable(),
+        sensitive: z.boolean(),
+        set: z.boolean(),
+        value: z.string().nullable(),
+    })),
+    missing: z.array(z.string()),
+});
+const ListSchema = z.object({
+    source: SourceRefSchema,
+    connections: z.array(SourceConnectionSchema),
+});
+const ShowSchema = z.object({
+    source: SourceRefSchema,
+    connection: SourceConnectionSchema,
+    callbackUrls: z.array(z.string()),
+});
+const ConnectSchema = z.object({
+    source: SourceRefSchema,
+    connection: SourceConnectionSchema,
+    authorizeUrl: z.string(),
+    callbackUrl: z.string(),
+});
+const DisconnectSchema = z.object({ removed: z.boolean() });
+export function listConnections(host, token, source) {
+    return call(host, token, ListSchema, null, {
+        method: 'GET',
+        path: `/api/partner/connections?${new URLSearchParams({ source })}`,
+    });
+}
+export function showConnection(host, token, source, product) {
+    return call(host, token, ShowSchema, product, {
+        method: 'GET',
+        path: `${route(product)}?${new URLSearchParams({ source })}`,
+    });
+}
+export function startConnection(host, token, body) {
+    return call(host, token, ConnectSchema, body.product, {
+        method: 'POST',
+        path: route(body.product),
+        body: Object.assign({ source: body.source }, (body.fields ? { fields: body.fields } : {})),
+    });
+}
+export function deleteConnection(host, token, source, product) {
+    return call(host, token, DisconnectSchema, product, {
+        method: 'DELETE',
+        path: `${route(product)}?${new URLSearchParams({ source })}`,
+    });
+}
+function route(product) {
+    return `/api/partner/connections/${encodeURIComponent(product)}`;
+}
+async function call(host, accessToken, schema, product, init) {
+    const response = await request(`${host}${init.path}`, {
+        method: init.method,
+        headers: Object.assign({ accept: 'application/json', authorization: `Bearer ${accessToken}` }, (init.body === undefined
+            ? {}
+            : { 'content-type': 'application/json' })),
+        body: init.body === undefined ? undefined : JSON.stringify(init.body),
+    });
+    if (response.status === 401 ||
+        (response.status >= 300 && response.status < 400)) {
+        return { status: 'unauthorized' };
+    }
+    const body = await readOptionalJson(response);
+    const code = typeof body.code === 'string' ? body.code : null;
+    const message = typeof body.error === 'string' && body.error ? body.error : null;
+    if (response.status === 403 && code === 'MFA_REQUIRED') {
+        throw authRequiredError(message !== null && message !== void 0 ? message : `${host} requires multi-factor authentication.`, 'Complete MFA in the browser, then run "ekanos login" again.');
+    }
+    if (response.status === 403) {
+        throw forbiddenError(message !== null && message !== void 0 ? message : 'Not permitted on this Source.', code === 'SOURCE_ADMIN_REQUIRED'
+            ? "Only a Source admin manages the Source's connections. Ask one to run it."
+            : 'Run "ekanos sources" to list the sources you hold a seat on.');
+    }
+    if (response.status === 404) {
+        throw notFoundError(message !== null && message !== void 0 ? message : `"${product !== null && product !== void 0 ? product : 'the Source'}" was not found.`, code === 'PRODUCT_NOT_ENTITLED'
+            ? '"ekanos catalog" lists what this Source has; Ekanos enables a product for a Source.'
+            : 'Run "ekanos sources" to list the sources you hold a seat on.');
+    }
+    if (response.status === 409 && code === 'NO_SOURCE_CONNECTION') {
+        return {
+            status: 'unsupported',
+            message: message !== null && message !== void 0 ? message : `"${product}" does not support one connection for the Source.`,
+        };
+    }
+    if (response.status === 409 && code === 'NOT_CONFIGURED') {
+        const parsed = SourceConnectionSchema.safeParse(body.connection);
+        return {
+            status: 'not-configured',
+            missing: Array.isArray(body.missing)
+                ? body.missing.filter((n) => typeof n === 'string')
+                : [],
+            connection: parsed.success ? parsed.data : null,
+        };
+    }
+    if (response.status === 400) {
+        throw usageError(message !== null && message !== void 0 ? message : 'The host refused the request.', 'See "ekanos apps --help".');
+    }
+    if (response.status === 409) {
+        throw invalidStateError(message !== null && message !== void 0 ? message : 'The host refused the request.', '');
+    }
+    if (!response.ok) {
+        throw networkError(`${host}${init.path.split('?')[0]} responded ${response.status}.`, response.status >= 500
+            ? 'The Ekanos deployment returned a server error. Retry shortly.'
+            : 'Confirm the host runs a build that includes the connections routes (plan 241).');
+    }
+    const parsed = schema.safeParse(body.data);
+    if (!parsed.success) {
+        throw networkError(`${host}/api/partner/connections answered in a shape this CLI does not read.`, 'Run "ekanos upgrade" — the CLI and the host disagree on the connections contract.');
+    }
+    return { status: 'ok', data: parsed.data };
+}
+async function readOptionalJson(response) {
+    try {
+        const parsed = await response.json();
+        return typeof parsed === 'object' && parsed !== null
+            ? parsed
+            : {};
+    }
+    catch (_a) {
+        return {};
+    }
+}
+//# sourceMappingURL=connections-api.js.map

package/dist/connections-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connections-api.js","sourceRoot":"","sources":["../src/connections-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACb,UAAU,GACX,MAAM,UAAU,CAAC;AAElB;;;;;;;;;;;;GAYG;AAEH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACrC,MAAM,EAAE,CAAC,CAAC,KAAK,CACb,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;QACtB,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE;QAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC7B,CAAC,CACH;IACD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC7B,CAAC,CAAC;AAGH,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,MAAM,EAAE,eAAe;IACvB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC;CAC7C,CAAC,CAAC;AACH,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,MAAM,EAAE,eAAe;IACvB,UAAU,EAAE,sBAAsB;IAClC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAClC,CAAC,CAAC;AACH,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,MAAM,EAAE,eAAe;IACvB,UAAU,EAAE,sBAAsB;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;CACxB,CAAC,CAAC;AACH,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAc5D,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,KAAa,EAAE,MAAc;IACzE,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE;QACzC,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,4BAA4B,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE;KACpE,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,KAAa,EACb,MAAc,EACd,OAAe;IAEf,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE;QAC5C,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE;KAC7D,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,KAAa,EACb,IAA0E;IAE1E,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC,OAAO,EAAE;QACpD,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;QACzB,IAAI,kBACF,MAAM,EAAE,IAAI,CAAC,MAAM,IAChB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAChD;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,KAAa,EACb,MAAc,EACd,OAAe;IAEf,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE;QAClD,MAAM,EAAE,QAAQ;QAChB,IAAI,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE;KAC7D,CAAC,CAAC;AACL,CAAC;AAED,SAAS,KAAK,CAAC,OAAe;IAC5B,OAAO,4BAA4B,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;AACnE,CAAC;AAED,KAAK,UAAU,IAAI,CACjB,IAAY,EACZ,WAAmB,EACnB,MAAoB,EACpB,OAAsB,EACtB,IAAyE;IAEzE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE;QACpD,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,kBACL,MAAM,EAAE,kBAAkB,EAC1B,aAAa,EAAE,UAAU,WAAW,EAAE,IACnC,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;YACzB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAC5C;QACD,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;KACtE,CAAC,CAAC;IAEH,IACE,QAAQ,CAAC,MAAM,KAAK,GAAG;QACvB,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,EACjD,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACpC,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,MAAM,OAAO,GACX,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAEnE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QACvD,MAAM,iBAAiB,CACrB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,GAAG,IAAI,wCAAwC,EAC1D,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,cAAc,CAClB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,+BAA+B,EAC1C,IAAI,KAAK,uBAAuB;YAC9B,CAAC,CAAC,0EAA0E;YAC5E,CAAC,CAAC,8DAA8D,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,aAAa,CACjB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,IAAI,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,YAAY,kBAAkB,EACxD,IAAI,KAAK,sBAAsB;YAC7B,CAAC,CAAC,qFAAqF;YACvF,CAAC,CAAC,8DAA8D,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,sBAAsB,EAAE,CAAC;QAC/D,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,OAAO,EACL,OAAO,aAAP,OAAO,cAAP,OAAO,GACP,IAAI,OAAO,mDAAmD;SACjE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;QACzD,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjE,OAAO;YACL,MAAM,EAAE,gBAAgB;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;gBAClC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;gBAChE,CAAC,CAAC,EAAE;YACN,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;SAChD,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,UAAU,CACd,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,+BAA+B,EAC1C,2BAA2B,CAC5B,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,iBAAiB,CAAC,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,+BAA+B,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,YAAY,CAChB,GAAG,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,QAAQ,CAAC,MAAM,GAAG,EACjE,QAAQ,CAAC,MAAM,IAAI,GAAG;YACpB,CAAC,CAAC,+DAA+D;YACjE,CAAC,CAAC,gFAAgF,CACrF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,YAAY,CAChB,GAAG,IAAI,sEAAsE,EAC7E,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC7C,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,QAAkB;IAElB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC9C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAClD,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;eAAO,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["import { z } from 'zod';\n\nimport { request } from './auth/ekanos-api';\nimport {\n  authRequiredError,\n  forbiddenError,\n  invalidStateError,\n  networkError,\n  notFoundError,\n  usageError,\n} from './errors';\n\n/**\n * The CLI's client for a Source's connections (plan 241): an integration a\n * Source admin connects ONCE for the whole Source, used by the Source's\n * provided agents in every team whose template marks it `owner: \"source\"`.\n *\n *   GET    /api/partner/connections?source=<slug|id>\n *   GET    /api/partner/connections/<product>?source=<slug|id>\n *   POST   /api/partner/connections/<product>  { source, fields? }  → authorizeUrl\n *   DELETE /api/partner/connections/<product>?source=<slug|id>\n *\n * The shapes are read here rather than from `@ekanos/integration-schema`, so\n * this CLI works against a host without a schema release.\n */\n\nconst SourceRefSchema = z.object({\n  id: z.string(),\n  slug: z.string(),\n  name: z.string().nullable(),\n});\n\nexport const SourceConnectionSchema = z.object({\n  slug: z.string(),\n  name: z.string(),\n  connected: z.boolean(),\n  connectedBy: z.string().nullable(),\n  connectedAt: z.string().nullable(),\n  scope: z.string().nullable(),\n  app: z.enum(['source-app', 'fields']),\n  fields: z.array(\n    z.object({\n      name: z.string(),\n      label: z.string(),\n      description: z.string().nullable(),\n      sensitive: z.boolean(),\n      set: z.boolean(),\n      value: z.string().nullable(),\n    }),\n  ),\n  missing: z.array(z.string()),\n});\nexport type SourceConnection = z.infer<typeof SourceConnectionSchema>;\n\nconst ListSchema = z.object({\n  source: SourceRefSchema,\n  connections: z.array(SourceConnectionSchema),\n});\nconst ShowSchema = z.object({\n  source: SourceRefSchema,\n  connection: SourceConnectionSchema,\n  callbackUrls: z.array(z.string()),\n});\nconst ConnectSchema = z.object({\n  source: SourceRefSchema,\n  connection: SourceConnectionSchema,\n  authorizeUrl: z.string(),\n  callbackUrl: z.string(),\n});\nconst DisconnectSchema = z.object({ removed: z.boolean() });\n\nexport type ConnectionsApiResult<T> =\n  | { status: 'ok'; data: T }\n  | { status: 'unauthorized' }\n  /** The integration supports no Source connection (409 NO_SOURCE_CONNECTION). */\n  | { status: 'unsupported'; message: string }\n  /** App fields are still missing (409 NOT_CONFIGURED). */\n  | {\n      status: 'not-configured';\n      missing: string[];\n      connection: SourceConnection | null;\n    };\n\nexport function listConnections(host: string, token: string, source: string) {\n  return call(host, token, ListSchema, null, {\n    method: 'GET',\n    path: `/api/partner/connections?${new URLSearchParams({ source })}`,\n  });\n}\n\nexport function showConnection(\n  host: string,\n  token: string,\n  source: string,\n  product: string,\n) {\n  return call(host, token, ShowSchema, product, {\n    method: 'GET',\n    path: `${route(product)}?${new URLSearchParams({ source })}`,\n  });\n}\n\nexport function startConnection(\n  host: string,\n  token: string,\n  body: { source: string; product: string; fields?: Record<string, string> },\n) {\n  return call(host, token, ConnectSchema, body.product, {\n    method: 'POST',\n    path: route(body.product),\n    body: {\n      source: body.source,\n      ...(body.fields ? { fields: body.fields } : {}),\n    },\n  });\n}\n\nexport function deleteConnection(\n  host: string,\n  token: string,\n  source: string,\n  product: string,\n) {\n  return call(host, token, DisconnectSchema, product, {\n    method: 'DELETE',\n    path: `${route(product)}?${new URLSearchParams({ source })}`,\n  });\n}\n\nfunction route(product: string): string {\n  return `/api/partner/connections/${encodeURIComponent(product)}`;\n}\n\nasync function call<T>(\n  host: string,\n  accessToken: string,\n  schema: z.ZodType<T>,\n  product: string | null,\n  init: { method: 'GET' | 'POST' | 'DELETE'; path: string; body?: unknown },\n): Promise<ConnectionsApiResult<T>> {\n  const response = await request(`${host}${init.path}`, {\n    method: init.method,\n    headers: {\n      accept: 'application/json',\n      authorization: `Bearer ${accessToken}`,\n      ...(init.body === undefined\n        ? {}\n        : { 'content-type': 'application/json' }),\n    },\n    body: init.body === undefined ? undefined : JSON.stringify(init.body),\n  });\n\n  if (\n    response.status === 401 ||\n    (response.status >= 300 && response.status < 400)\n  ) {\n    return { status: 'unauthorized' };\n  }\n\n  const body = await readOptionalJson(response);\n  const code = typeof body.code === 'string' ? body.code : null;\n  const message =\n    typeof body.error === 'string' && body.error ? body.error : null;\n\n  if (response.status === 403 && code === 'MFA_REQUIRED') {\n    throw authRequiredError(\n      message ?? `${host} requires multi-factor authentication.`,\n      'Complete MFA in the browser, then run \"ekanos login\" again.',\n    );\n  }\n  if (response.status === 403) {\n    throw forbiddenError(\n      message ?? 'Not permitted on this Source.',\n      code === 'SOURCE_ADMIN_REQUIRED'\n        ? \"Only a Source admin manages the Source's connections. Ask one to run it.\"\n        : 'Run \"ekanos sources\" to list the sources you hold a seat on.',\n    );\n  }\n  if (response.status === 404) {\n    throw notFoundError(\n      message ?? `\"${product ?? 'the Source'}\" was not found.`,\n      code === 'PRODUCT_NOT_ENTITLED'\n        ? '\"ekanos catalog\" lists what this Source has; Ekanos enables a product for a Source.'\n        : 'Run \"ekanos sources\" to list the sources you hold a seat on.',\n    );\n  }\n  if (response.status === 409 && code === 'NO_SOURCE_CONNECTION') {\n    return {\n      status: 'unsupported',\n      message:\n        message ??\n        `\"${product}\" does not support one connection for the Source.`,\n    };\n  }\n  if (response.status === 409 && code === 'NOT_CONFIGURED') {\n    const parsed = SourceConnectionSchema.safeParse(body.connection);\n    return {\n      status: 'not-configured',\n      missing: Array.isArray(body.missing)\n        ? body.missing.filter((n): n is string => typeof n === 'string')\n        : [],\n      connection: parsed.success ? parsed.data : null,\n    };\n  }\n  if (response.status === 400) {\n    throw usageError(\n      message ?? 'The host refused the request.',\n      'See \"ekanos apps --help\".',\n    );\n  }\n  if (response.status === 409) {\n    throw invalidStateError(message ?? 'The host refused the request.', '');\n  }\n  if (!response.ok) {\n    throw networkError(\n      `${host}${init.path.split('?')[0]} responded ${response.status}.`,\n      response.status >= 500\n        ? 'The Ekanos deployment returned a server error. Retry shortly.'\n        : 'Confirm the host runs a build that includes the connections routes (plan 241).',\n    );\n  }\n\n  const parsed = schema.safeParse(body.data);\n  if (!parsed.success) {\n    throw networkError(\n      `${host}/api/partner/connections answered in a shape this CLI does not read.`,\n      'Run \"ekanos upgrade\" — the CLI and the host disagree on the connections contract.',\n    );\n  }\n  return { status: 'ok', data: parsed.data };\n}\n\nasync function readOptionalJson(\n  response: Response,\n): Promise<Record<string, unknown>> {\n  try {\n    const parsed: unknown = await response.json();\n    return typeof parsed === 'object' && parsed !== null\n      ? (parsed as Record<string, unknown>)\n      : {};\n  } catch {\n    return {};\n  }\n}\n"]}

package/dist/index.js

@@ -7,6 +7,10 @@ import { runInit } from './commands/init.js';
 import { runLogin } from './commands/login.js';
 import { runLogout } from './commands/logout.js';
 import { runPublish } from './commands/publish.js';
+import { runReviewers } from './commands/reviewers.js';
+import { runRoutes } from './commands/routes.js';
+import { runApprovals, runRuns } from './commands/runs.js';
+import { runSkills } from './commands/skills.js';
 import { runSources } from './commands/sources.js';
 import { runStatus } from './commands/status.js';
 import { runTeams } from './commands/teams.js';
@@ -87,13 +91,45 @@ const COMMAND_SPECS = {
         host: { type: 'string' },
         source: { type: 'string' },
         dir: { type: 'string' },
+        'no-wait': { type: 'boolean' },
     },
     teams: {
         host: { type: 'string' },
         source: { type: 'string' },
         dir: { type: 'string' },
         connection: { type: 'string' },
+        slug: { type: 'string' },
+        owner: { type: 'string' },
+        role: { type: 'string' },
         yes: { type: 'boolean' },
+        // `teams agents|triggers|links|mcp` (team-agents.ts).
+        as: { type: 'string' },
+        reads: { type: 'string' },
+        writes: { type: 'string' },
+        effect: { type: 'string' },
+        kind: { type: 'string' },
+        mode: { type: 'string' },
+        url: { type: 'string' },
+        auth: { type: 'string' },
+        name: { type: 'string' },
+        cron: { type: 'string' },
+        timezone: { type: 'string' },
+        prompt: { type: 'string' },
+        filter: { type: 'string' },
+    },
+    reviewers: {
+        host: { type: 'string' },
+        source: { type: 'string' },
+        dir: { type: 'string' },
+        reach: { type: 'string' },
+        team: { type: 'string' },
+    },
+    routes: {
+        host: { type: 'string' },
+        source: { type: 'string' },
+        dir: { type: 'string' },
+        label: { type: 'string' },
+        webhook: { type: 'string' },
     },
     agents: {
         host: { type: 'string' },
@@ -107,6 +143,49 @@ const COMMAND_SPECS = {
         yes: { type: 'boolean' },
         force: { type: 'boolean' },
         claude: { type: 'boolean' },
+        // `agents test <key> --team <slug> --prompt|--input [--follow]`.
+        team: { type: 'string' },
+        prompt: { type: 'string' },
+        input: { type: 'string' },
+        follow: { type: 'boolean' },
+        // `apply`: `--no-skills` skips pushing the skill folders beside the agent.
+        skills: { type: 'boolean' },
+        // policy | triggers | links | overrides
+        event: { type: 'string' },
+        filter: { type: 'string', repeatable: true },
+        disabled: { type: 'boolean' },
+        cron: { type: 'string' },
+        timezone: { type: 'string' },
+        kind: { type: 'string' },
+        mode: { type: 'string' },
+        reads: { type: 'string' },
+        writes: { type: 'string' },
+        publish: { type: 'boolean' },
+    },
+    skills: {
+        host: { type: 'string' },
+        source: { type: 'string' },
+        dir: { type: 'string' },
+        team: { type: 'string' },
+        out: { type: 'string' },
+    },
+    runs: {
+        host: { type: 'string' },
+        source: { type: 'string' },
+        dir: { type: 'string' },
+        team: { type: 'string' },
+        agent: { type: 'string' },
+        prompt: { type: 'string' },
+        input: { type: 'string' },
+        follow: { type: 'boolean' },
+    },
+    approvals: {
+        host: { type: 'string' },
+        source: { type: 'string' },
+        dir: { type: 'string' },
+        team: { type: 'string' },
+        reason: { type: 'string' },
+        body: { type: 'string' },
     },
     use: {
         host: { type: 'string' },
@@ -133,9 +212,23 @@ const POSITIONAL_COMMANDS = {
     use: ['source-slug'],
     catalog: ['product-slug'],
     apps: ['subcommand', 'product-slug'],
-    // `app set <team> <product>` is the longest form: four tokens.
-    teams: ['subcommand', 'team-slug', 'product-slug', 'webhook-id'],
-    agents: ['subcommand', 'key-or-path'],
+    // `teams agents policy <team> <key> set <tool> auto` is the longest form.
+    teams: [
+        'subcommand',
+        'team-slug',
+        'product-slug',
+        'webhook-id',
+        'role',
+        'arg-6',
+        'arg-7',
+    ],
+    reviewers: ['subcommand', 'email'],
+    routes: ['subcommand', 'product-or-event-id', 'value', 'team-slug'],
+    skills: ['subcommand', 'slug-or-path'],
+    runs: ['subcommand', 'agent-key-or-run-id'],
+    approvals: ['subcommand', 'approval-id'],
+    // `triggers <key> add event <trigger-key>` is the longest form: five tokens.
+    agents: ['subcommand', 'key-or-path', 'action', 'arg', 'value'],
 };
 const COMMANDS = Object.keys(COMMAND_SPECS);
 const USAGE = [
@@ -163,18 +256,76 @@ const USAGE = [
     '             ("ekanos catalog [<product-slug>] --source <slug>", --json)',
     "  apps       The Source's app for an integration teams sign in through:",
     '             show <product> | set <product> (Source admin; takes the secret',
-    '             at your terminal)',
-    "  teams      A team's integration setup, for the Source admin:",
+    '             at your terminal) | connect <product> [--no-wait] (one',
+    "             connection for the whole Source, used by the Source's provided",
+    '             agents in every team) | disconnect <product> | list',
+    "  teams      A Source's teams, for the Source admin:",
+    '             create <name> [--slug <slug>] [--owner <email>] (you own it',
+    '             unless --owner, who is invited as owner) |',
+    '             members list <team> | members invite <team> <email> [--role',
+    '             <role>] (default member; sends the invitation email) |',
+    '             members role <team> <email> <role> | members remove <team>',
+    "             <email> --yes | roles list <team> (each role's permissions) |",
+    '             connect <team> <product> (the link a member opens to sign in',
+    '             an integration, and whether it is connected) |',
     '             list | show <team> <product> (a checklist: fields, callback',
     '             URLs, webhooks, connect link) | app set <team> <product>',
     '             [--connection <id>] (takes the secrets at your terminal) |',
     '             webhook <team> <product> [<webhook-id>] [--yes] (URL shown once)',
+    "             A team's agents, for the Source admin (teams <area> <verb> <team> …):",
+    '             agents list <team> | agents enable <team> <key> [--as <member-email>]',
+    '             | agents disable|unpin <team> <key> | agents pin <team> <key> <version>',
+    '             | agents policy <team> <key> [set <tool> auto|approve | unset <tool>]',
+    '             [--reads auto|approve] [--writes auto|approve]',
+    '             triggers list|add|remove <team> <key> … | links list|add|remove',
+    '             <team> <from-key> [<to-key> --kind talk|delegate --mode await|handoff]',
+    '             | mcp list|add|status|token|effect <team> [<server-key> …]',
+    '             (see "ekanos teams --help")',
+    '  reviewers  Who decides agent reply drafts, for the Source admin:',
+    '             list | add <email> --reach source|team [--team <slug>] |',
+    '             remove <email> [--team <slug>]',
+    "  routes     Route a Source connection's events to teams, for the Source admin:",
+    '             list [<product>] | options <product> | set <product> <value> <team>',
+    '             [--label <name>] | remove <product> <value> | webhook <product>',
+    '             [--webhook <id>] (URL shown once) | unrouted [<product>] |',
+    '             replay <event-id>',
     "  agents     The source's agent templates, held by Ekanos:",
     '             init [<dir>] [--claude|--no-claude] (skills + docs MCP for designing',
     '             agents with Claude; offers to add the docs to Claude Code)',
     '             list | show <key> | pull <key> [--out <dir>]',
     '             apply <dir|file> [--base-version <n>] [--overwrite]',
     '             publish <key> [--to <n>] --yes | rollback <key> --to <n> --yes',
+    '             test <key> --team <slug> (--prompt "…" | --input <file.json>)',
+    '             [--follow] (runs the latest, unpublished version on one team;',
+    '             same grant, policy, approvals and audit; marked as a test)',
+    '             apply also pushes <dir>/skills/<slug>/ folders first and names',
+    '             them in the agent (--no-skills skips that)',
+    '             Edit one template in place (stores a draft version; --publish',
+    '             also rolls it out, with --yes):',
+    '             policy <key> [set <tool> auto|approve | unset <tool>]',
+    '               [--reads auto|approve] [--writes auto|approve]',
+    '             triggers <key> [list | add event <k> --event <slug.event>',
+    '               [--filter field=a,b]... | add schedule <k> --cron "<expr>"',
+    '               [--timezone <tz>] --prompt <text> | add webhook <k> --prompt',
+    '               <text> | remove <k>] [--prompt <text>] [--disabled]',
+    '             links <key> [list | add <to-key> --kind talk|delegate',
+    '               [--mode await|handoff] | remove <to-key> [--kind <kind>]]',
+    '             overrides <key> [enable|disable policy|triggers|links]',
+    '               (off: teams follow the template exactly; on: teams keep',
+    '               their own differences)',
+    "  skills     The source's skills (SKILL.md folders), held by Ekanos:",
+    '             list [--team <t>] | show <slug> [--team <t>] |',
+    '             push <dir> [--team <t>] (a new version, live at once; created',
+    '             on first push, "unchanged" when identical; --team: that team\'s',
+    '             own skill, no other team sees it) | pull <slug> [--out <dir>]',
+    "  runs       Run and inspect a team's agents, as the Source admin:",
+    '             start <agent-key> --team <slug> (--prompt "…" | --input',
+    '             <file.json>) [--follow] | list --team <slug> [--agent <key>] |',
+    '             show <run-id> --team <slug> (--json: transcript, tool calls,',
+    '             how each was authorized, approvals)',
+    "  approvals  What a team's agent runs wait on: list --team <slug> |",
+    '             approve|reject <id> --team <slug> [--reason "…"] |',
+    '             edit <id> --team <slug> --body <file> (edit & send a reply draft)',
     '  use        Set this project\'s publish target ("ekanos use <source-slug>")',
     '  publish    Validate, pack and submit the integration to an Ekanos host',
     '  upgrade    Move this toolchain to a coherent target version, with',
@@ -189,7 +340,7 @@ const USAGE = [
     '  bare "ekanos upgrade" MUTATES the project (installs the target versions,',
     '  verifies with validate + the test script, rolls back on any failure).',
     '',
-    'Host resolution (logout, whoami, status, sources, catalog, apps, teams, agents, use, publish, upgrade):',
+    'Host resolution (logout, whoami, status, sources, catalog, apps, teams, reviewers, routes, agents, skills, runs, approvals, use, publish, upgrade):',
     '  --host, else EKANOS_HOST, else the "host" field in ekanos.json, else the',
     '  sole stored login. "ekanos publish" saves host and source to ekanos.json.',
     '  "ekanos login" never reads ekanos.json for a host (--host, else',
@@ -360,6 +511,7 @@ export async function run(argv, options = {}) {
                     ask: options.ask,
                     askSecret: options.askSecret,
                     confirm: options.confirm,
+                    noWait: parsed.flags['no-wait'] === true,
                 });
             case 'teams':
                 return await runTeams(ctx, {
@@ -367,13 +519,37 @@ export async function run(argv, options = {}) {
                     source: parsed.flags.source,
                     positionals: parsed.positionals,
                     connection: parsed.flags.connection,
+                    slug: parsed.flags.slug,
+                    owner: parsed.flags.owner,
+                    role: parsed.flags.role,
                     yes: parsed.flags.yes === true,
+                    flags: parsed.flags,
                     dir,
                     env,
                     stdinIsTTY: options.stdinIsTTY,
                     ask: options.ask,
                     askSecret: options.askSecret,
                 });
+            case 'reviewers':
+                return await runReviewers(ctx, {
+                    host: parsed.flags.host,
+                    source: parsed.flags.source,
+                    positionals: parsed.positionals,
+                    reach: parsed.flags.reach,
+                    team: parsed.flags.team,
+                    dir,
+                    env,
+                });
+            case 'routes':
+                return await runRoutes(ctx, {
+                    host: parsed.flags.host,
+                    source: parsed.flags.source,
+                    positionals: parsed.positionals,
+                    label: parsed.flags.label,
+                    webhook: parsed.flags.webhook,
+                    dir,
+                    env,
+                });
             case 'agents':
                 return await runAgents(ctx, {
                     host: parsed.flags.host,
@@ -387,10 +563,54 @@ export async function run(argv, options = {}) {
                     yes: parsed.flags.yes === true,
                     force: parsed.flags.force === true,
                     claude: parsed.flags.claude,
+                    skills: parsed.flags.skills,
+                    rest: parsed.positionals.slice(2),
+                    event: parsed.flags.event,
+                    filter: parsed.flags.filter,
+                    disabled: parsed.flags.disabled === true,
+                    cron: parsed.flags.cron,
+                    timezone: parsed.flags.timezone,
+                    kind: parsed.flags.kind,
+                    mode: parsed.flags.mode,
+                    reads: parsed.flags.reads,
+                    writes: parsed.flags.writes,
+                    publish: parsed.flags.publish === true,
                     dir,
                     env,
                     stdinIsTTY: options.stdinIsTTY,
                     confirm: options.confirm,
+                    team: parsed.flags.team,
+                    prompt: parsed.flags.prompt,
+                    input: parsed.flags.input,
+                    follow: parsed.flags.follow === true,
+                });
+            case 'runs':
+            case 'approvals':
+                return await (command === 'runs' ? runRuns : runApprovals)(ctx, {
+                    host: parsed.flags.host,
+                    source: parsed.flags.source,
+                    positionals: parsed.positionals,
+                    team: parsed.flags.team,
+                    agent: parsed.flags.agent,
+                    prompt: parsed.flags.prompt,
+                    input: parsed.flags.input,
+                    follow: parsed.flags.follow === true,
+                    reason: parsed.flags.reason,
+                    body: parsed.flags.body,
+                    dir,
+                    env,
+                    sleep: options.sleep,
+                });
+            case 'skills':
+                return await runSkills(ctx, {
+                    host: parsed.flags.host,
+                    source: parsed.flags.source,
+                    subcommand: parsed.positionals[0],
+                    target: parsed.positionals[1],
+                    team: parsed.flags.team,
+                    out: parsed.flags.out,
+                    dir,
+                    env,
                 });
             case 'use':
                 return await runUse(ctx, {