@ekanos/cli 0.10.0 → 0.12.0

package/dist/commands/apps.js

@@ -1,9 +1,16 @@
 import { setProviderApp, showProviderApp, } from '../apps-api.js';
 import { refreshStoredSession, requireSession, resolveAuthEnvironment, } from '../auth/session.js';
-import { authRequiredError, usageError, validationError } from '../errors.js';
+import { deleteConnection, listConnections, showConnection, startConnection, } from '../connections-api.js';
+import { authRequiredError, invalidStateError, usageError, validationError, } from '../errors.js';
 import { resolveSourceTarget } from '../source-target.js';
 import { promptYesNo } from './publish.js';
-export const APPS_SUBCOMMANDS = ['show', 'set'];
+export const APPS_SUBCOMMANDS = [
+    'show',
+    'set',
+    'list',
+    'connect',
+    'disconnect',
+];
 /**
  * `apps` — a Source's provider apps: the OAuth client an integration signs
  * every team in through (Linear's, say). `show` says whether the Source has
@@ -15,7 +22,12 @@ export const APPS_SUBCOMMANDS = ['show', 'set'];
 export async function runApps(ctx, args) {
     var _a, _b, _c;
     const subcommand = parseSubcommand(args.subcommand);
+    if (subcommand === 'list')
+        return runList(ctx, args);
     const product = requireProduct(args.product, subcommand);
+    if (subcommand === 'connect' || subcommand === 'disconnect') {
+        return runConnection(ctx, args, subcommand, product);
+    }
     if (subcommand === 'set' && !canPrompt(ctx, args)) {
         throw usageError('apps set takes the client secret at a terminal, never in a script or an agent run.', `Run it yourself in your terminal: npx @ekanos/cli apps set ${product}${args.source ? ` --source ${args.source}` : ''}`);
     }
@@ -25,10 +37,10 @@ export async function runApps(ctx, args) {
     const resolved = await resolveSourceTarget(env, requireSession(env.store, env.host), args);
     const client = new AppsClient(env, resolved.session);
     const source = resolved.source;
-    const status = await client.call((token) => showProviderApp(env.host, token, source, product));
     if (subcommand === 'show') {
-        return ctx.succeed(Object.assign({ host: env.host }, status), summary(ctx, status));
+        return showApp(ctx, env.host, client, source, product);
     }
+    const status = await client.call((token) => showProviderApp(env.host, token, source, product));
     ctx.log(walkthrough(status).join('\n'));
     if (status.configured) {
         const replace = await ((_a = args.confirm) !== null && _a !== void 0 ? _a : promptYesNo)(`${status.source.slug} already has ${status.product.name} credentials. Replace them? [y/N]`);
@@ -117,6 +129,228 @@ function summary(ctx, status) {
             ]),
     ].join('\n');
 }
+/**
+ * `apps show <product>`: the Source provider app, and — for an integration
+ * that supports one — the Source connection (plan 241). A `teamApp`
+ * integration (Zendesk) has no provider app but can have a Source
+ * connection, so either half may be absent.
+ */
+async function showApp(ctx, host, client, source, product) {
+    const [app, connection] = await Promise.all([
+        client
+            .call((token) => showProviderApp(host, token, source, product))
+            .then((status) => ({ ok: true, status }), (error) => ({ ok: false, error })),
+        // A host without the connections routes (before plan 241), or one that
+        // refuses, leaves `show` exactly as it was: the provider app alone.
+        client
+            .connection((token) => showConnection(host, token, source, product))
+            .catch(() => ({ status: 'unavailable' })),
+    ]);
+    if (!app.ok && connection.status !== 'ok')
+        throw app.error;
+    const parts = [];
+    if (app.ok)
+        parts.push(summary(ctx, app.status));
+    if (connection.status === 'ok') {
+        parts.push(connectionSummary(ctx, connection.data.connection, {
+            sourceSlug: connection.data.source.slug,
+            callbackUrls: connection.data.callbackUrls,
+        }));
+    }
+    return ctx.succeed(Object.assign(Object.assign({ host }, (app.ok ? app.status : {})), (connection.status === 'ok'
+        ? {
+            sourceConnection: connection.data.connection,
+            sourceConnectionCallbackUrls: connection.data.callbackUrls,
+        }
+        : {})), parts.join('\n'));
+}
+/** `apps list`: every integration the Source can connect once, with status. */
+async function runList(ctx, args) {
+    const { env, client, source } = await openClient(ctx, args);
+    const result = await client.connection((token) => listConnections(env.host, token, source));
+    if (result.status !== 'ok') {
+        throw invalidStateError('The host could not list the connections.', 'Retry shortly.');
+    }
+    const { connections } = result.data;
+    const rows = connections.map((connection) => [
+        `${connection.name} (${connection.slug})`,
+        connectionState(connection),
+    ]);
+    return ctx.succeed(Object.assign({ host: env.host }, result.data), connections.length === 0
+        ? ctx.ui.hint(`No integration on ${result.data.source.slug} supports one connection for the whole Source yet.`)
+        : ctx.ui.result({
+            title: `Source connections on ${result.data.source.slug}`,
+            rows,
+        }));
+}
+function connectionState(connection) {
+    if (connection.connected) {
+        return [
+            'connected',
+            connection.connectedAt ? ` ${connection.connectedAt}` : '',
+            connection.connectedBy ? ` by ${connection.connectedBy}` : '',
+        ].join('');
+    }
+    return connection.missing.length > 0
+        ? `not connected — app fields missing: ${connection.missing.join(', ')}`
+        : 'not connected';
+}
+/**
+ * `apps connect <product>`: connect the integration ONCE for the whole Source,
+ * for the Source's provided agents whose template says `owner: "source"`.
+ * Asks for any missing app fields at the terminal (secrets hidden, never from
+ * a flag), prints the provider's consent URL, then waits until the browser
+ * finishes. `apps disconnect <product>` removes it.
+ */
+async function runConnection(ctx, args, subcommand, product) {
+    const { env, client, source } = await openClient(ctx, args);
+    if (subcommand === 'disconnect') {
+        return disconnect(ctx, args, client, env.host, source, product);
+    }
+    const shown = await client.connection((token) => showConnection(env.host, token, source, product));
+    if (shown.status === 'unsupported') {
+        throw invalidStateError(shown.message, `Each team connects ${product} itself, from the team's Integrations page.`);
+    }
+    if (shown.status !== 'ok') {
+        throw invalidStateError('The host could not read the connection.', 'Retry shortly.');
+    }
+    const current = shown.data.connection;
+    if (current.app === 'fields') {
+        ctx.log([
+            `${current.name} app for ${shown.data.source.slug} (one for the whole Source)`,
+            `  Register this redirect URL in the app: ${shown.data.callbackUrls.join(', ')}`,
+        ].join('\n'));
+    }
+    const fields = await askFields(ctx, args, current, product);
+    const started = await client.connection((token) => startConnection(env.host, token, Object.assign({ source,
+        product }, (Object.keys(fields).length > 0 ? { fields } : {}))));
+    if (started.status === 'not-configured') {
+        throw validationError(`${current.name} is not set up for the Source yet — missing: ${started.missing.join(', ')}.`, current.app === 'source-app'
+            ? `Run "ekanos apps set ${product}" to enter the Source's app first.`
+            : `Run "ekanos apps connect ${product}" again and fill every field.`);
+    }
+    if (started.status !== 'ok') {
+        throw invalidStateError('The host could not start the connection.', 'Retry shortly.');
+    }
+    ctx.log([
+        `Open this link and approve ${current.name} as the account the Source's agents should act as:`,
+        `  ${started.data.authorizeUrl}`,
+    ].join('\n'));
+    if (args.noWait || ctx.jsonMode) {
+        return ctx.succeed({
+            host: env.host,
+            product,
+            authorizeUrl: started.data.authorizeUrl,
+            callbackUrl: started.data.callbackUrl,
+            connected: false,
+        }, ctx.ui.hint(`Then check with "ekanos apps show ${product}".`));
+    }
+    const deadline = Date.now() + 10 * 60 * 1000;
+    const before = current.connectedAt;
+    while (Date.now() < deadline) {
+        await new Promise((resolve) => { var _a; return setTimeout(resolve, (_a = args.pollDelayMs) !== null && _a !== void 0 ? _a : 3000); });
+        const polled = await client.connection((token) => showConnection(env.host, token, source, product));
+        if (polled.status === 'ok' &&
+            polled.data.connection.connected &&
+            polled.data.connection.connectedAt !== before) {
+            return ctx.succeed({ host: env.host, product, connection: polled.data.connection }, connectionSummary(ctx, polled.data.connection, {
+                sourceSlug: polled.data.source.slug,
+                callbackUrls: polled.data.callbackUrls,
+            }));
+        }
+    }
+    throw validationError('The connection did not finish within ten minutes.', `Run "ekanos apps connect ${product}" again for a fresh link.`);
+}
+async function askFields(ctx, args, current, product) {
+    var _a, _b;
+    const toAsk = current.fields.filter((field) => !field.set || current.missing.includes(field.name));
+    if (toAsk.length === 0)
+        return {};
+    if (!canPrompt(ctx, args)) {
+        throw usageError(`${current.name} needs its app fields entered for the Source: ${toAsk.map((field) => field.label).join(', ')}.`, `Run it yourself in your terminal: npx @ekanos/cli apps connect ${product}${args.source ? ` --source ${args.source}` : ''}`);
+    }
+    const fields = {};
+    for (const field of toAsk) {
+        const question = field.sensitive
+            ? `${field.label} (hidden): `
+            : `${field.label}: `;
+        const value = (await (field.sensitive
+            ? ((_a = args.askSecret) !== null && _a !== void 0 ? _a : promptHidden)
+            : ((_b = args.ask) !== null && _b !== void 0 ? _b : promptLine))(question)).trim();
+        if (value)
+            fields[field.name] = value;
+    }
+    return fields;
+}
+async function disconnect(ctx, args, client, host, source, product) {
+    var _a;
+    if (canPrompt(ctx, args)) {
+        const sure = await ((_a = args.confirm) !== null && _a !== void 0 ? _a : promptYesNo)(`Disconnect ${product} for every team's provided agents on ${source}? [y/N]`);
+        if (!sure) {
+            throw validationError('Nothing was changed.', `Run "ekanos apps show ${product}" to see the current state.`);
+        }
+    }
+    const result = await client.connection((token) => deleteConnection(host, token, source, product));
+    if (result.status === 'unsupported') {
+        throw invalidStateError(result.message, `Each team connects ${product} itself, from the team's Integrations page.`);
+    }
+    if (result.status !== 'ok') {
+        throw invalidStateError('The host could not disconnect.', 'Retry shortly.');
+    }
+    return ctx.succeed(Object.assign({ host, product }, result.data), ctx.ui.result({
+        title: result.data.removed
+            ? `Disconnected ${product} for ${source}`
+            : `${product} was not connected for ${source}`,
+        rows: [
+            [
+                'Provided agents',
+                'their tools for this product stop until you connect again',
+            ],
+        ],
+    }));
+}
+function connectionSummary(ctx, connection, meta) {
+    const rows = [
+        ['Source', meta.sourceSlug],
+        ['Connected', connectionState(connection)],
+        ...(connection.scope ? [['Scope', connection.scope]] : []),
+        ...(connection.fields.length > 0
+            ? [
+                [
+                    'App fields',
+                    connection.fields.map((field) => { var _a; return `${field.label}: ${field.set ? ((_a = field.value) !== null && _a !== void 0 ? _a : 'set') : 'missing'}`; }),
+                ],
+            ]
+            : []),
+        ['Redirect URL', meta.callbackUrls],
+        [
+            'Used by',
+            'provided agents whose template says connections.<product>.owner: "source", in every team',
+        ],
+    ];
+    return [
+        ctx.ui.result({
+            title: `${connection.name} — one connection for the whole Source`,
+            rows,
+        }),
+        ...(connection.connected
+            ? []
+            : [
+                ctx.ui.hint(`Run "ekanos apps connect ${connection.slug}" in your terminal to connect it.`),
+            ]),
+    ].join('\n');
+}
+async function openClient(ctx, args) {
+    const env = resolveAuthEnvironment(ctx, args.host, args.env, {
+        projectDir: args.dir,
+    });
+    const resolved = await resolveSourceTarget(env, requireSession(env.store, env.host), args);
+    return {
+        env,
+        client: new AppsClient(env, resolved.session),
+        source: resolved.source,
+    };
+}
 class AppsClient {
     constructor(env, session) {
         this.env = env;
@@ -132,6 +366,17 @@ class AppsClient {
             return result.data;
         throw authRequiredError(`The session for ${this.env.host} could not authorize the apps call.`, `Run "ekanos login --host ${this.env.host}" and retry.`);
     }
+    /** As `call`, for the connections client, whose 409s are answers. */
+    async connection(send) {
+        let result = await send(this.session.accessToken);
+        if (result.status === 'unauthorized') {
+            this.session = await refreshStoredSession(this.env, this.session);
+            result = await send(this.session.accessToken);
+        }
+        if (result.status !== 'unauthorized')
+            return result;
+        throw authRequiredError(`The session for ${this.env.host} could not authorize the connections call.`, `Run "ekanos login --host ${this.env.host}" and retry.`);
+    }
 }
 function canPrompt(ctx, args) {
     var _a;

package/dist/commands/apps.js.map

@@ -1 +1 @@
-{"version":3,"file":"apps.js","sourceRoot":"","sources":["../../src/commands/apps.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,cAAc,EACd,eAAe,GAChB,MAAM,aAAa,CAAC;AAErB,OAAO,EAEL,oBAAoB,EACpB,cAAc,EACd,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,KAAK,CAAU,CAAC;AAiBzD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAe,EACf,IAAc;;IAEd,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAEzD,IAAI,UAAU,KAAK,KAAK,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;QAClD,MAAM,UAAU,CACd,oFAAoF,EACpF,8DAA8D,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACxH,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE;QAC3D,UAAU,EAAE,IAAI,CAAC,GAAG;KACrB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CACxC,GAAG,EACH,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,EACnC,IAAI,CACL,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAE/B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CACzC,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAClD,CAAC;IAEF,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;QAC1B,OAAO,GAAG,CAAC,OAAO,iBAAG,IAAI,EAAE,GAAG,CAAC,IAAI,IAAK,MAAM,GAAI,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACxC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,MAAM,OAAC,IAAI,CAAC,OAAO,mCAAI,WAAW,CAAC,CACjD,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,gBAAgB,MAAM,CAAC,OAAO,CAAC,IAAI,mCAAmC,CAC5F,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,eAAe,CACnB,sBAAsB,EACtB,yBAAyB,OAAO,6BAA6B,CAC9D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,MAAM,OAAC,IAAI,CAAC,GAAG,mCAAI,UAAU,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACxE,MAAM,YAAY,GAAG,CACnB,MAAM,OAAC,IAAI,CAAC,SAAS,mCAAI,YAAY,CAAC,CAAC,0BAA0B,CAAC,CACnE,CAAC,IAAI,EAAE,CAAC;IACT,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;QAC/B,MAAM,eAAe,CACnB,sDAAsD,EACtD,wBAAwB,OAAO,UAAU,CAC1C,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CACzC,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAC9B,MAAM;QACN,OAAO;QACP,QAAQ;QACR,YAAY;KACb,CAAC,CACH,CAAC;IACF,OAAO,GAAG,CAAC,OAAO,iBACd,IAAI,EAAE,GAAG,CAAC,IAAI,IAAK,MAAM,GAC3B,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC;QACZ,KAAK,EAAE,MAAM,CAAC,QAAQ;YACpB,CAAC,CAAC,gBAAgB,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM;YAC3C,CAAC,CAAC,cAAc,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM;QAC3C,IAAI,EAAE;YACJ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;YAC9B,CAAC,mBAAmB,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5D,CAAC,eAAe,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;SACxC;KACF,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,MAAyB;;IACnD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;IACjC,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,YAAY,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACxD,IAAI,MAAA,MAAM,CAAC,KAAK,0CAAE,UAAU,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,KAAK,GAAG,CAAA,MAAA,MAAM,CAAC,KAAK,0CAAE,KAAK,CAAC,MAAM;QACtC,CAAC,CAAC;YACE,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK;YACrB,gCAAgC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAClE;QACH,CAAC,CAAC;YACE,MAAM,IAAI,kDAAkD;YAC5D,yCAAyC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAC3E,CAAC;IACN,KAAK,CAAC,IAAI,CACR,qGAAqG,CACtG,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IACrE,IAAI,MAAA,MAAM,CAAC,KAAK,0CAAE,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,OAAO,CAAC,GAAe,EAAE,MAAyB;IACzD,MAAM,IAAI,GAAgB;QACxB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;QAC9B,GAAG,CAAC,MAAM,CAAC,KAAK;YACd,CAAC,CAAE;gBACC;oBACE,kBAAkB;oBAClB;wBACE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU;4BACzB,CAAC,CAAC,CAAC,QAAQ,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;4BACrC,CAAC,CAAC,EAAE,CAAC;wBACP,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CACvB,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE,CACzC;qBACF;iBACF;aACQ;YACb,CAAC,CAAC,EAAE,CAAC;QACP;YACE,QAAQ;YACR,MAAM,CAAC,UAAU;gBACf,CAAC,CAAC,yBAAyB;gBAC3B,CAAC,CAAC,8BAA8B;SACnC;QACD,CAAC,eAAe,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;KACxC,CAAC;IACF,OAAO;QACL,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,EAAE,IAAI,EAAE,CAAC;QAC5D,GAAG,CAAC,MAAM,CAAC,UAAU;YACnB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,GAAG,CAAC,EAAE,CAAC,IAAI,CACT,wBAAwB,MAAM,CAAC,OAAO,CAAC,IAAI,8CAA8C,CAC1F;aACF,CAAC;KACP,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU;IACd,YACmB,GAAoB,EAC7B,OAAsB;mBADb,GAAG;uBACZ,OAAO;IACd,CAAC;IAEJ,KAAK,CAAC,IAAI,CACR,IAAwD;QAExD,IAAI,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;YACrC,IAAI,CAAC,OAAO,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAClE,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC;QAC/C,MAAM,iBAAiB,CACrB,mBAAmB,IAAI,CAAC,GAAG,CAAC,IAAI,qCAAqC,EACrE,4BAA4B,IAAI,CAAC,GAAG,CAAC,IAAI,cAAc,CACxD,CAAC;IACJ,CAAC;CACF;AAED,SAAS,SAAS,CAAC,GAAe,EAAE,IAAc;;IAChD,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,OAAC,IAAI,CAAC,UAAU,mCAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,eAAe,CAAC,KAAyB;IAChD,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;IAC9D,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,UAAU,CACd,KAAK,CAAC,CAAC,CAAC,4BAA4B,KAAK,IAAI,CAAC,CAAC,CAAC,0BAA0B,EAC1E,eAAe,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,IAAI,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC7F,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAyB,EAAE,IAAY;IAC7D,MAAM,IAAI,GAAG,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,IAAI,GAAG,WAAW,EAAE,CAAC;IACzC,IAAI,IAAI,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,UAAU,CACd,KAAK;QACH,CAAC,CAAC,IAAI,KAAK,0BAA0B;QACrC,CAAC,CAAC,QAAQ,IAAI,mBAAmB,EACnC,8CAA8C,IAAI,wCAAwC,CAC3F,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAAgB;IAC/C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;IACxD,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC;QAClC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;IACH,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB;IACjD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IAC/C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC;QAClC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,IAAI;KACf,CAAC,CAAC;IACH,8EAA8E;IAC7E,EAA4D,CAAC,cAAc;QAC1E,GAAG,EAAE,GAAE,CAAC,CAAC;IACX,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;YAC3C,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,SAAS,YAAY,CAAC,MAAyB;;IAC7C,OAAO,CAAA,MAAA,MAAM,CAAC,YAAY,0CAAE,MAAM;QAChC,CAAC,CAAC,MAAM,CAAC,YAAY;QACrB,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAC3B,CAAC","sourcesContent":["import type { ProviderAppStatus } from '@ekanos/integration-schema';\n\nimport {\n  type AppsApiResult,\n  setProviderApp,\n  showProviderApp,\n} from '../apps-api';\nimport type { StoredSession } from '../auth/credential-store';\nimport {\n  type AuthEnvironment,\n  refreshStoredSession,\n  requireSession,\n  resolveAuthEnvironment,\n} from '../auth/session';\nimport type { CliContext } from '../context';\nimport { authRequiredError, usageError, validationError } from '../errors';\nimport type { ExitCode } from '../exit-codes';\nimport { resolveSourceTarget } from '../source-target';\nimport type { ResultRow } from '../ui';\nimport { promptYesNo } from './publish';\n\nexport const APPS_SUBCOMMANDS = ['show', 'set'] as const;\ntype AppsSubcommand = (typeof APPS_SUBCOMMANDS)[number];\n\nexport interface AppsArgs {\n  host?: string;\n  source?: string;\n  subcommand?: string;\n  product?: string;\n  dir: string;\n  env: Record<string, string | undefined>;\n  stdinIsTTY?: boolean;\n  /** Test seams for the questions `set` asks. */\n  ask?: (question: string) => Promise<string>;\n  askSecret?: (question: string) => Promise<string>;\n  confirm?: (question: string) => Promise<boolean>;\n}\n\n/**\n * `apps` — a Source's provider apps: the OAuth client an integration signs\n * every team in through (Linear's, say). `show` says whether the Source has\n * one and which callback URL to register; `set` takes the client id and\n * secret from the Source admin at the terminal — never from a flag, a file\n * or a non-interactive run, so an agent driving the CLI never handles the\n * secret.\n */\nexport async function runApps(\n  ctx: CliContext,\n  args: AppsArgs,\n): Promise<ExitCode> {\n  const subcommand = parseSubcommand(args.subcommand);\n  const product = requireProduct(args.product, subcommand);\n\n  if (subcommand === 'set' && !canPrompt(ctx, args)) {\n    throw usageError(\n      'apps set takes the client secret at a terminal, never in a script or an agent run.',\n      `Run it yourself in your terminal: npx @ekanos/cli apps set ${product}${args.source ? ` --source ${args.source}` : ''}`,\n    );\n  }\n\n  const env = resolveAuthEnvironment(ctx, args.host, args.env, {\n    projectDir: args.dir,\n  });\n  const resolved = await resolveSourceTarget(\n    env,\n    requireSession(env.store, env.host),\n    args,\n  );\n  const client = new AppsClient(env, resolved.session);\n  const source = resolved.source;\n\n  const status = await client.call((token) =>\n    showProviderApp(env.host, token, source, product),\n  );\n\n  if (subcommand === 'show') {\n    return ctx.succeed({ host: env.host, ...status }, summary(ctx, status));\n  }\n\n  ctx.log(walkthrough(status).join('\\n'));\n  if (status.configured) {\n    const replace = await (args.confirm ?? promptYesNo)(\n      `${status.source.slug} already has ${status.product.name} credentials. Replace them? [y/N]`,\n    );\n    if (!replace) {\n      throw validationError(\n        'Nothing was changed.',\n        `Run \"ekanos apps show ${product}\" to see the current state.`,\n      );\n    }\n  }\n\n  const clientId = (await (args.ask ?? promptLine)('Client ID: ')).trim();\n  const clientSecret = (\n    await (args.askSecret ?? promptHidden)('Client secret (hidden): ')\n  ).trim();\n  if (!clientId || !clientSecret) {\n    throw validationError(\n      'Both the client ID and the client secret are needed.',\n      `Run \"ekanos apps set ${product}\" again.`,\n    );\n  }\n\n  const result = await client.call((token) =>\n    setProviderApp(env.host, token, {\n      source,\n      product,\n      clientId,\n      clientSecret,\n    }),\n  );\n  return ctx.succeed(\n    { host: env.host, ...result },\n    ctx.ui.result({\n      title: result.replaced\n        ? `Replaced the ${result.product.name} app`\n        : `Set up the ${result.product.name} app`,\n      rows: [\n        ['Source', result.source.slug],\n        ['Teams can connect', result.configured ? 'yes' : 'not yet'],\n        ['Callback URLs', callbackUrls(result)],\n      ],\n    }),\n  );\n}\n\n/**\n * How to create the app: the integration's own steps (`oauth.setup`, with the\n * callback URL filled in) when it declares them, else the generic three.\n */\nexport function walkthrough(status: ProviderAppStatus): string[] {\n  const name = status.product.name;\n  const lines = [`${name} app for ${status.source.slug}`];\n  if (status.setup?.consoleUrl) {\n    lines.push(`  Open: ${status.setup.consoleUrl}`);\n  }\n  const steps = status.setup?.steps.length\n    ? [\n        ...status.setup.steps,\n        `Check the app lists exactly: ${callbackUrls(status).join(', ')}`,\n      ]\n    : [\n        `In ${name}, create an OAuth app (or open the one you use).`,\n        `Register exactly these callback URLs: ${callbackUrls(status).join(', ')}`,\n      ];\n  steps.push(\n    \"Enter its client ID and secret below. The secret is stored in Ekanos's vault and never shown again.\",\n  );\n  lines.push(...steps.map((step, index) => `  ${index + 1}. ${step}`));\n  if (status.setup?.guideUrl) lines.push(`  Guide: ${status.setup.guideUrl}`);\n  return lines;\n}\n\nfunction summary(ctx: CliContext, status: ProviderAppStatus): string {\n  const rows: ResultRow[] = [\n    ['Source', status.source.slug],\n    ...(status.setup\n      ? ([\n          [\n            'How to create it',\n            [\n              ...(status.setup.consoleUrl\n                ? [`Open ${status.setup.consoleUrl}`]\n                : []),\n              ...status.setup.steps.map(\n                (step, index) => `${index + 1}. ${step}`,\n              ),\n            ],\n          ],\n        ] as const)\n      : []),\n    [\n      'Set up',\n      status.configured\n        ? 'yes — teams can connect'\n        : 'no — no team can connect yet',\n    ],\n    ['Callback URLs', callbackUrls(status)],\n  ];\n  return [\n    ctx.ui.result({ title: `${status.product.name} app`, rows }),\n    ...(status.configured\n      ? []\n      : [\n          ctx.ui.hint(\n            `Run \"ekanos apps set ${status.product.slug}\" in your terminal to enter its credentials.`,\n          ),\n        ]),\n  ].join('\\n');\n}\n\nclass AppsClient {\n  constructor(\n    private readonly env: AuthEnvironment,\n    private session: StoredSession,\n  ) {}\n\n  async call<T>(\n    send: (accessToken: string) => Promise<AppsApiResult<T>>,\n  ): Promise<T> {\n    let result = await send(this.session.accessToken);\n    if (result.status === 'unauthorized') {\n      this.session = await refreshStoredSession(this.env, this.session);\n      result = await send(this.session.accessToken);\n    }\n    if (result.status === 'ok') return result.data;\n    throw authRequiredError(\n      `The session for ${this.env.host} could not authorize the apps call.`,\n      `Run \"ekanos login --host ${this.env.host}\" and retry.`,\n    );\n  }\n}\n\nfunction canPrompt(ctx: CliContext, args: AppsArgs): boolean {\n  return !ctx.jsonMode && (args.stdinIsTTY ?? process.stdin.isTTY === true);\n}\n\nfunction parseSubcommand(value: string | undefined): AppsSubcommand {\n  const match = APPS_SUBCOMMANDS.find((name) => name === value);\n  if (match) return match;\n  throw usageError(\n    value ? `Unknown apps subcommand \"${value}\".` : 'apps needs a subcommand.',\n    `Run one of: ${APPS_SUBCOMMANDS.map((name) => `ekanos apps ${name} <product>`).join(', ')}.`,\n  );\n}\n\nfunction requireProduct(value: string | undefined, verb: string): string {\n  const slug = value?.trim().toLowerCase();\n  if (slug && /^[a-z0-9][a-z0-9-]*$/.test(slug)) return slug;\n  throw usageError(\n    value\n      ? `\"${value}\" is not a product slug.`\n      : `apps ${verb} needs a product.`,\n    `Pass the product's slug, e.g. \"ekanos apps ${verb} linear\". \"ekanos catalog\" lists them.`,\n  );\n}\n\nexport async function promptLine(question: string): Promise<string> {\n  const readline = await import('node:readline/promises');\n  const rl = readline.createInterface({\n    input: process.stdin,\n    output: process.stderr,\n  });\n  try {\n    return await rl.question(question);\n  } finally {\n    rl.close();\n  }\n}\n\n/** Read a line without echoing it: the secret never appears on screen or in scrollback. */\nexport async function promptHidden(question: string): Promise<string> {\n  const readline = await import('node:readline');\n  process.stderr.write(question);\n  const rl = readline.createInterface({\n    input: process.stdin,\n    output: process.stderr,\n    terminal: true,\n  });\n  // Swallow readline's echo of each keystroke; the question is already written.\n  (rl as unknown as { _writeToOutput: (text: string) => void })._writeToOutput =\n    () => {};\n  try {\n    return await new Promise<string>((resolve) => {\n      rl.question('', resolve);\n    });\n  } finally {\n    rl.close();\n    process.stderr.write('\\n');\n  }\n}\n\n/** Every redirect URI to register; an older host sends only the one. */\nfunction callbackUrls(status: ProviderAppStatus): string[] {\n  return status.callbackUrls?.length\n    ? status.callbackUrls\n    : [status.callbackUrl];\n}\n"]}
+{"version":3,"file":"apps.js","sourceRoot":"","sources":["../../src/commands/apps.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,cAAc,EACd,eAAe,GAChB,MAAM,aAAa,CAAC;AAErB,OAAO,EAEL,oBAAoB,EACpB,cAAc,EACd,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAGL,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,UAAU,EACV,eAAe,GAChB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,MAAM;IACN,KAAK;IACL,MAAM;IACN,SAAS;IACT,YAAY;CACJ,CAAC;AAqBX;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAe,EACf,IAAc;;IAEd,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACpD,IAAI,UAAU,KAAK,MAAM;QAAE,OAAO,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACzD,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;QAC5D,OAAO,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,UAAU,KAAK,KAAK,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;QAClD,MAAM,UAAU,CACd,oFAAoF,EACpF,8DAA8D,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACxH,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE;QAC3D,UAAU,EAAE,IAAI,CAAC,GAAG;KACrB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CACxC,GAAG,EACH,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,EACnC,IAAI,CACL,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAE/B,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CACzC,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAClD,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACxC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,MAAM,OAAC,IAAI,CAAC,OAAO,mCAAI,WAAW,CAAC,CACjD,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,gBAAgB,MAAM,CAAC,OAAO,CAAC,IAAI,mCAAmC,CAC5F,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,eAAe,CACnB,sBAAsB,EACtB,yBAAyB,OAAO,6BAA6B,CAC9D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,MAAM,OAAC,IAAI,CAAC,GAAG,mCAAI,UAAU,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACxE,MAAM,YAAY,GAAG,CACnB,MAAM,OAAC,IAAI,CAAC,SAAS,mCAAI,YAAY,CAAC,CAAC,0BAA0B,CAAC,CACnE,CAAC,IAAI,EAAE,CAAC;IACT,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;QAC/B,MAAM,eAAe,CACnB,sDAAsD,EACtD,wBAAwB,OAAO,UAAU,CAC1C,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CACzC,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAC9B,MAAM;QACN,OAAO;QACP,QAAQ;QACR,YAAY;KACb,CAAC,CACH,CAAC;IACF,OAAO,GAAG,CAAC,OAAO,iBACd,IAAI,EAAE,GAAG,CAAC,IAAI,IAAK,MAAM,GAC3B,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC;QACZ,KAAK,EAAE,MAAM,CAAC,QAAQ;YACpB,CAAC,CAAC,gBAAgB,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM;YAC3C,CAAC,CAAC,cAAc,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM;QAC3C,IAAI,EAAE;YACJ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;YAC9B,CAAC,mBAAmB,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5D,CAAC,eAAe,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;SACxC;KACF,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,MAAyB;;IACnD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;IACjC,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,YAAY,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACxD,IAAI,MAAA,MAAM,CAAC,KAAK,0CAAE,UAAU,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,KAAK,GAAG,CAAA,MAAA,MAAM,CAAC,KAAK,0CAAE,KAAK,CAAC,MAAM;QACtC,CAAC,CAAC;YACE,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK;YACrB,gCAAgC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAClE;QACH,CAAC,CAAC;YACE,MAAM,IAAI,kDAAkD;YAC5D,yCAAyC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAC3E,CAAC;IACN,KAAK,CAAC,IAAI,CACR,qGAAqG,CACtG,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IACrE,IAAI,MAAA,MAAM,CAAC,KAAK,0CAAE,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,OAAO,CAAC,GAAe,EAAE,MAAyB;IACzD,MAAM,IAAI,GAAgB;QACxB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;QAC9B,GAAG,CAAC,MAAM,CAAC,KAAK;YACd,CAAC,CAAE;gBACC;oBACE,kBAAkB;oBAClB;wBACE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU;4BACzB,CAAC,CAAC,CAAC,QAAQ,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;4BACrC,CAAC,CAAC,EAAE,CAAC;wBACP,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CACvB,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE,CACzC;qBACF;iBACF;aACQ;YACb,CAAC,CAAC,EAAE,CAAC;QACP;YACE,QAAQ;YACR,MAAM,CAAC,UAAU;gBACf,CAAC,CAAC,yBAAyB;gBAC3B,CAAC,CAAC,8BAA8B;SACnC;QACD,CAAC,eAAe,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;KACxC,CAAC;IACF,OAAO;QACL,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,EAAE,IAAI,EAAE,CAAC;QAC5D,GAAG,CAAC,MAAM,CAAC,UAAU;YACnB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,GAAG,CAAC,EAAE,CAAC,IAAI,CACT,wBAAwB,MAAM,CAAC,OAAO,CAAC,IAAI,8CAA8C,CAC1F;aACF,CAAC;KACP,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,OAAO,CACpB,GAAe,EACf,IAAY,EACZ,MAAkB,EAClB,MAAc,EACd,OAAe;IAEf,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC1C,MAAM;aACH,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;aAC9D,IAAI,CACH,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAa,EAAE,MAAM,EAAE,CAAC,EAC3C,CAAC,KAAc,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAc,EAAE,KAAK,EAAE,CAAC,CACpD;QACH,uEAAuE;QACvE,oEAAoE;QACpE,MAAM;aACH,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;aACnE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,aAAsB,EAAE,CAAC,CAAC;KACrD,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,UAAU,CAAC,MAAM,KAAK,IAAI;QAAE,MAAM,GAAG,CAAC,KAAK,CAAC;IAE3D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,GAAG,CAAC,EAAE;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACjD,IAAI,UAAU,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CACR,iBAAiB,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE;YACjD,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI;YACvC,YAAY,EAAE,UAAU,CAAC,IAAI,CAAC,YAAY;SAC3C,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,GAAG,CAAC,OAAO,+BAEd,IAAI,IACD,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAC1B,CAAC,UAAU,CAAC,MAAM,KAAK,IAAI;QAC5B,CAAC,CAAC;YACE,gBAAgB,EAAE,UAAU,CAAC,IAAI,CAAC,UAAU;YAC5C,4BAA4B,EAAE,UAAU,CAAC,IAAI,CAAC,YAAY;SAC3D;QACH,CAAC,CAAC,EAAE,CAAC,GAET,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CACjB,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,KAAK,UAAU,OAAO,CAAC,GAAe,EAAE,IAAc;IACpD,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE,CAC/C,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CACzC,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC3B,MAAM,iBAAiB,CACrB,0CAA0C,EAC1C,gBAAgB,CACjB,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;IACpC,MAAM,IAAI,GAAgB,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC;QACxD,GAAG,UAAU,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,GAAG;QACzC,eAAe,CAAC,UAAU,CAAC;KAC5B,CAAC,CAAC;IACH,OAAO,GAAG,CAAC,OAAO,iBACd,IAAI,EAAE,GAAG,CAAC,IAAI,IAAK,MAAM,CAAC,IAAI,GAChC,WAAW,CAAC,MAAM,KAAK,CAAC;QACtB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CACT,qBAAqB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,oDAAoD,CACjG;QACH,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC;YACZ,KAAK,EAAE,yBAAyB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;YACzD,IAAI;SACL,CAAC,CACP,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,UAA4B;IACnD,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;QACzB,OAAO;YACL,WAAW;YACX,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE;YAC1D,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE;SAC9D,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,CAAC;IACD,OAAO,UAAU,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QAClC,CAAC,CAAC,uCAAuC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACxE,CAAC,CAAC,eAAe,CAAC;AACtB,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,aAAa,CAC1B,GAAe,EACf,IAAc,EACd,UAAoC,EACpC,OAAe;IAEf,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAE5D,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;QAChC,OAAO,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE,CAC9C,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CACjD,CAAC;IACF,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;QACnC,MAAM,iBAAiB,CACrB,KAAK,CAAC,OAAO,EACb,sBAAsB,OAAO,6CAA6C,CAC3E,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC1B,MAAM,iBAAiB,CACrB,yCAAyC,EACzC,gBAAgB,CACjB,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;IAEtC,IAAI,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC7B,GAAG,CAAC,GAAG,CACL;YACE,GAAG,OAAO,CAAC,IAAI,YAAY,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,6BAA6B;YAC9E,4CAA4C,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACjF,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAE5D,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE,CAChD,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,kBAC7B,MAAM;QACN,OAAO,IACJ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EACrD,CACH,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;QACxC,MAAM,eAAe,CACnB,GAAG,OAAO,CAAC,IAAI,gDAAgD,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAC5F,OAAO,CAAC,GAAG,KAAK,YAAY;YAC1B,CAAC,CAAC,wBAAwB,OAAO,oCAAoC;YACrE,CAAC,CAAC,4BAA4B,OAAO,+BAA+B,CACvE,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,iBAAiB,CACrB,0CAA0C,EAC1C,gBAAgB,CACjB,CAAC;IACJ,CAAC;IAED,GAAG,CAAC,GAAG,CACL;QACE,8BAA8B,OAAO,CAAC,IAAI,oDAAoD;QAC9F,KAAK,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE;KACjC,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IAEF,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QAChC,OAAO,GAAG,CAAC,OAAO,CAChB;YACE,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,OAAO;YACP,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY;YACvC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW;YACrC,SAAS,EAAE,KAAK;SACjB,EACD,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,qCAAqC,OAAO,IAAI,CAAC,CAC9D,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IACnC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,kBAC5B,UAAU,CAAC,OAAO,QAAE,IAAI,CAAC,WAAW,mCAAI,IAAI,CAAC,GAAA,CAC9C,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE,CAC/C,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CACjD,CAAC;QACF,IACE,MAAM,CAAC,MAAM,KAAK,IAAI;YACtB,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS;YAChC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,KAAK,MAAM,EAC7C,CAAC;YACD,OAAO,GAAG,CAAC,OAAO,CAChB,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,EAC/D,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE;gBAC7C,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI;gBACnC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY;aACvC,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,eAAe,CACnB,mDAAmD,EACnD,4BAA4B,OAAO,2BAA2B,CAC/D,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,GAAe,EACf,IAAc,EACd,OAAyB,EACzB,OAAe;;IAEf,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CACjC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAC9D,CAAC;IACF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,UAAU,CACd,GAAG,OAAO,CAAC,IAAI,iDAAiD,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAC/G,kEAAkE,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAC5H,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS;YAC9B,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,aAAa;YAC7B,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC;QACvB,MAAM,KAAK,GAAG,CACZ,MAAM,CACJ,KAAK,CAAC,SAAS;YACb,CAAC,CAAC,OAAC,IAAI,CAAC,SAAS,mCAAI,YAAY,CAAC;YAClC,CAAC,CAAC,OAAC,IAAI,CAAC,GAAG,mCAAI,UAAU,CAAC,CAC7B,CAAC,QAAQ,CAAC,CACZ,CAAC,IAAI,EAAE,CAAC;QACT,IAAI,KAAK;YAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACxC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,GAAe,EACf,IAAc,EACd,MAAkB,EAClB,IAAY,EACZ,MAAc,EACd,OAAe;;IAEf,IAAI,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,OAAC,IAAI,CAAC,OAAO,mCAAI,WAAW,CAAC,CAC9C,cAAc,OAAO,wCAAwC,MAAM,SAAS,CAC7E,CAAC;QACF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,eAAe,CACnB,sBAAsB,EACtB,yBAAyB,OAAO,6BAA6B,CAC9D,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE,CAC/C,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAC/C,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;QACpC,MAAM,iBAAiB,CACrB,MAAM,CAAC,OAAO,EACd,sBAAsB,OAAO,6CAA6C,CAC3E,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC3B,MAAM,iBAAiB,CAAC,gCAAgC,EAAE,gBAAgB,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,GAAG,CAAC,OAAO,iBACd,IAAI,EAAE,OAAO,IAAK,MAAM,CAAC,IAAI,GAC/B,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC;QACZ,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO;YACxB,CAAC,CAAC,gBAAgB,OAAO,QAAQ,MAAM,EAAE;YACzC,CAAC,CAAC,GAAG,OAAO,0BAA0B,MAAM,EAAE;QAChD,IAAI,EAAE;YACJ;gBACE,iBAAiB;gBACjB,2DAA2D;aAC5D;SACF;KACF,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,GAAe,EACf,UAA4B,EAC5B,IAAoD;IAEpD,MAAM,IAAI,GAAgB;QACxB,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC;QAC3B,CAAC,WAAW,EAAE,eAAe,CAAC,UAAU,CAAC,CAAC;QAC1C,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,CAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YAC9B,CAAC,CAAE;gBACC;oBACE,YAAY;oBACZ,UAAU,CAAC,MAAM,CAAC,GAAG,CACnB,CAAC,KAAK,EAAE,EAAE,kBACR,GAAG,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,OAAC,KAAK,CAAC,KAAK,mCAAI,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,GAAA,CACtE;iBACF;aACc;YACnB,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC;QACnC;YACE,SAAS;YACT,0FAA0F;SAC3F;KACF,CAAC;IACF,OAAO;QACL,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC;YACZ,KAAK,EAAE,GAAG,UAAU,CAAC,IAAI,wCAAwC;YACjE,IAAI;SACL,CAAC;QACF,GAAG,CAAC,UAAU,CAAC,SAAS;YACtB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,GAAG,CAAC,EAAE,CAAC,IAAI,CACT,4BAA4B,UAAU,CAAC,IAAI,mCAAmC,CAC/E;aACF,CAAC;KACP,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,GAAe,EAAE,IAAc;IACvD,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE;QAC3D,UAAU,EAAE,IAAI,CAAC,GAAG;KACrB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CACxC,GAAG,EACH,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,EACnC,IAAI,CACL,CAAC;IACF,OAAO;QACL,GAAG;QACH,MAAM,EAAE,IAAI,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC;QAC7C,MAAM,EAAE,QAAQ,CAAC,MAAM;KACxB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU;IACd,YACmB,GAAoB,EAC7B,OAAsB;mBADb,GAAG;uBACZ,OAAO;IACd,CAAC;IAEJ,KAAK,CAAC,IAAI,CACR,IAAwD;QAExD,IAAI,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;YACrC,IAAI,CAAC,OAAO,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAClE,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC;QAC/C,MAAM,iBAAiB,CACrB,mBAAmB,IAAI,CAAC,GAAG,CAAC,IAAI,qCAAqC,EACrE,4BAA4B,IAAI,CAAC,GAAG,CAAC,IAAI,cAAc,CACxD,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,KAAK,CAAC,UAAU,CACd,IAA+D;QAE/D,IAAI,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;YACrC,IAAI,CAAC,OAAO,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAClE,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc;YAAE,OAAO,MAAM,CAAC;QACpD,MAAM,iBAAiB,CACrB,mBAAmB,IAAI,CAAC,GAAG,CAAC,IAAI,4CAA4C,EAC5E,4BAA4B,IAAI,CAAC,GAAG,CAAC,IAAI,cAAc,CACxD,CAAC;IACJ,CAAC;CACF;AAED,SAAS,SAAS,CAAC,GAAe,EAAE,IAAc;;IAChD,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,OAAC,IAAI,CAAC,UAAU,mCAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,eAAe,CAAC,KAAyB;IAChD,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;IAC9D,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,UAAU,CACd,KAAK,CAAC,CAAC,CAAC,4BAA4B,KAAK,IAAI,CAAC,CAAC,CAAC,0BAA0B,EAC1E,eAAe,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,IAAI,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC7F,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAyB,EAAE,IAAY;IAC7D,MAAM,IAAI,GAAG,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,IAAI,GAAG,WAAW,EAAE,CAAC;IACzC,IAAI,IAAI,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,UAAU,CACd,KAAK;QACH,CAAC,CAAC,IAAI,KAAK,0BAA0B;QACrC,CAAC,CAAC,QAAQ,IAAI,mBAAmB,EACnC,8CAA8C,IAAI,wCAAwC,CAC3F,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAAgB;IAC/C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;IACxD,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC;QAClC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;IACH,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB;IACjD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IAC/C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC;QAClC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,IAAI;KACf,CAAC,CAAC;IACH,8EAA8E;IAC7E,EAA4D,CAAC,cAAc;QAC1E,GAAG,EAAE,GAAE,CAAC,CAAC;IACX,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;YAC3C,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,SAAS,YAAY,CAAC,MAAyB;;IAC7C,OAAO,CAAA,MAAA,MAAM,CAAC,YAAY,0CAAE,MAAM;QAChC,CAAC,CAAC,MAAM,CAAC,YAAY;QACrB,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAC3B,CAAC","sourcesContent":["import type { ProviderAppStatus } from '@ekanos/integration-schema';\n\nimport {\n  type AppsApiResult,\n  setProviderApp,\n  showProviderApp,\n} from '../apps-api';\nimport type { StoredSession } from '../auth/credential-store';\nimport {\n  type AuthEnvironment,\n  refreshStoredSession,\n  requireSession,\n  resolveAuthEnvironment,\n} from '../auth/session';\nimport {\n  type ConnectionsApiResult,\n  type SourceConnection,\n  deleteConnection,\n  listConnections,\n  showConnection,\n  startConnection,\n} from '../connections-api';\nimport type { CliContext } from '../context';\nimport {\n  authRequiredError,\n  invalidStateError,\n  usageError,\n  validationError,\n} from '../errors';\nimport type { ExitCode } from '../exit-codes';\nimport { resolveSourceTarget } from '../source-target';\nimport type { ResultRow } from '../ui';\nimport { promptYesNo } from './publish';\n\nexport const APPS_SUBCOMMANDS = [\n  'show',\n  'set',\n  'list',\n  'connect',\n  'disconnect',\n] as const;\ntype AppsSubcommand = (typeof APPS_SUBCOMMANDS)[number];\n\nexport interface AppsArgs {\n  host?: string;\n  source?: string;\n  subcommand?: string;\n  product?: string;\n  dir: string;\n  env: Record<string, string | undefined>;\n  stdinIsTTY?: boolean;\n  /** Test seams for the questions `set` and `connect` ask. */\n  ask?: (question: string) => Promise<string>;\n  askSecret?: (question: string) => Promise<string>;\n  confirm?: (question: string) => Promise<boolean>;\n  /** Test seam: `connect`'s wait between status polls. */\n  pollDelayMs?: number;\n  /** `connect --no-wait`: print the URL and return without polling. */\n  noWait?: boolean;\n}\n\n/**\n * `apps` — a Source's provider apps: the OAuth client an integration signs\n * every team in through (Linear's, say). `show` says whether the Source has\n * one and which callback URL to register; `set` takes the client id and\n * secret from the Source admin at the terminal — never from a flag, a file\n * or a non-interactive run, so an agent driving the CLI never handles the\n * secret.\n */\nexport async function runApps(\n  ctx: CliContext,\n  args: AppsArgs,\n): Promise<ExitCode> {\n  const subcommand = parseSubcommand(args.subcommand);\n  if (subcommand === 'list') return runList(ctx, args);\n  const product = requireProduct(args.product, subcommand);\n  if (subcommand === 'connect' || subcommand === 'disconnect') {\n    return runConnection(ctx, args, subcommand, product);\n  }\n\n  if (subcommand === 'set' && !canPrompt(ctx, args)) {\n    throw usageError(\n      'apps set takes the client secret at a terminal, never in a script or an agent run.',\n      `Run it yourself in your terminal: npx @ekanos/cli apps set ${product}${args.source ? ` --source ${args.source}` : ''}`,\n    );\n  }\n\n  const env = resolveAuthEnvironment(ctx, args.host, args.env, {\n    projectDir: args.dir,\n  });\n  const resolved = await resolveSourceTarget(\n    env,\n    requireSession(env.store, env.host),\n    args,\n  );\n  const client = new AppsClient(env, resolved.session);\n  const source = resolved.source;\n\n  if (subcommand === 'show') {\n    return showApp(ctx, env.host, client, source, product);\n  }\n\n  const status = await client.call((token) =>\n    showProviderApp(env.host, token, source, product),\n  );\n\n  ctx.log(walkthrough(status).join('\\n'));\n  if (status.configured) {\n    const replace = await (args.confirm ?? promptYesNo)(\n      `${status.source.slug} already has ${status.product.name} credentials. Replace them? [y/N]`,\n    );\n    if (!replace) {\n      throw validationError(\n        'Nothing was changed.',\n        `Run \"ekanos apps show ${product}\" to see the current state.`,\n      );\n    }\n  }\n\n  const clientId = (await (args.ask ?? promptLine)('Client ID: ')).trim();\n  const clientSecret = (\n    await (args.askSecret ?? promptHidden)('Client secret (hidden): ')\n  ).trim();\n  if (!clientId || !clientSecret) {\n    throw validationError(\n      'Both the client ID and the client secret are needed.',\n      `Run \"ekanos apps set ${product}\" again.`,\n    );\n  }\n\n  const result = await client.call((token) =>\n    setProviderApp(env.host, token, {\n      source,\n      product,\n      clientId,\n      clientSecret,\n    }),\n  );\n  return ctx.succeed(\n    { host: env.host, ...result },\n    ctx.ui.result({\n      title: result.replaced\n        ? `Replaced the ${result.product.name} app`\n        : `Set up the ${result.product.name} app`,\n      rows: [\n        ['Source', result.source.slug],\n        ['Teams can connect', result.configured ? 'yes' : 'not yet'],\n        ['Callback URLs', callbackUrls(result)],\n      ],\n    }),\n  );\n}\n\n/**\n * How to create the app: the integration's own steps (`oauth.setup`, with the\n * callback URL filled in) when it declares them, else the generic three.\n */\nexport function walkthrough(status: ProviderAppStatus): string[] {\n  const name = status.product.name;\n  const lines = [`${name} app for ${status.source.slug}`];\n  if (status.setup?.consoleUrl) {\n    lines.push(`  Open: ${status.setup.consoleUrl}`);\n  }\n  const steps = status.setup?.steps.length\n    ? [\n        ...status.setup.steps,\n        `Check the app lists exactly: ${callbackUrls(status).join(', ')}`,\n      ]\n    : [\n        `In ${name}, create an OAuth app (or open the one you use).`,\n        `Register exactly these callback URLs: ${callbackUrls(status).join(', ')}`,\n      ];\n  steps.push(\n    \"Enter its client ID and secret below. The secret is stored in Ekanos's vault and never shown again.\",\n  );\n  lines.push(...steps.map((step, index) => `  ${index + 1}. ${step}`));\n  if (status.setup?.guideUrl) lines.push(`  Guide: ${status.setup.guideUrl}`);\n  return lines;\n}\n\nfunction summary(ctx: CliContext, status: ProviderAppStatus): string {\n  const rows: ResultRow[] = [\n    ['Source', status.source.slug],\n    ...(status.setup\n      ? ([\n          [\n            'How to create it',\n            [\n              ...(status.setup.consoleUrl\n                ? [`Open ${status.setup.consoleUrl}`]\n                : []),\n              ...status.setup.steps.map(\n                (step, index) => `${index + 1}. ${step}`,\n              ),\n            ],\n          ],\n        ] as const)\n      : []),\n    [\n      'Set up',\n      status.configured\n        ? 'yes — teams can connect'\n        : 'no — no team can connect yet',\n    ],\n    ['Callback URLs', callbackUrls(status)],\n  ];\n  return [\n    ctx.ui.result({ title: `${status.product.name} app`, rows }),\n    ...(status.configured\n      ? []\n      : [\n          ctx.ui.hint(\n            `Run \"ekanos apps set ${status.product.slug}\" in your terminal to enter its credentials.`,\n          ),\n        ]),\n  ].join('\\n');\n}\n\n/**\n * `apps show <product>`: the Source provider app, and — for an integration\n * that supports one — the Source connection (plan 241). A `teamApp`\n * integration (Zendesk) has no provider app but can have a Source\n * connection, so either half may be absent.\n */\nasync function showApp(\n  ctx: CliContext,\n  host: string,\n  client: AppsClient,\n  source: string,\n  product: string,\n): Promise<ExitCode> {\n  const [app, connection] = await Promise.all([\n    client\n      .call((token) => showProviderApp(host, token, source, product))\n      .then(\n        (status) => ({ ok: true as const, status }),\n        (error: unknown) => ({ ok: false as const, error }),\n      ),\n    // A host without the connections routes (before plan 241), or one that\n    // refuses, leaves `show` exactly as it was: the provider app alone.\n    client\n      .connection((token) => showConnection(host, token, source, product))\n      .catch(() => ({ status: 'unavailable' as const })),\n  ]);\n\n  if (!app.ok && connection.status !== 'ok') throw app.error;\n\n  const parts: string[] = [];\n  if (app.ok) parts.push(summary(ctx, app.status));\n  if (connection.status === 'ok') {\n    parts.push(\n      connectionSummary(ctx, connection.data.connection, {\n        sourceSlug: connection.data.source.slug,\n        callbackUrls: connection.data.callbackUrls,\n      }),\n    );\n  }\n\n  return ctx.succeed(\n    {\n      host,\n      ...(app.ok ? app.status : {}),\n      ...(connection.status === 'ok'\n        ? {\n            sourceConnection: connection.data.connection,\n            sourceConnectionCallbackUrls: connection.data.callbackUrls,\n          }\n        : {}),\n    },\n    parts.join('\\n'),\n  );\n}\n\n/** `apps list`: every integration the Source can connect once, with status. */\nasync function runList(ctx: CliContext, args: AppsArgs): Promise<ExitCode> {\n  const { env, client, source } = await openClient(ctx, args);\n  const result = await client.connection((token) =>\n    listConnections(env.host, token, source),\n  );\n  if (result.status !== 'ok') {\n    throw invalidStateError(\n      'The host could not list the connections.',\n      'Retry shortly.',\n    );\n  }\n  const { connections } = result.data;\n  const rows: ResultRow[] = connections.map((connection) => [\n    `${connection.name} (${connection.slug})`,\n    connectionState(connection),\n  ]);\n  return ctx.succeed(\n    { host: env.host, ...result.data },\n    connections.length === 0\n      ? ctx.ui.hint(\n          `No integration on ${result.data.source.slug} supports one connection for the whole Source yet.`,\n        )\n      : ctx.ui.result({\n          title: `Source connections on ${result.data.source.slug}`,\n          rows,\n        }),\n  );\n}\n\nfunction connectionState(connection: SourceConnection): string {\n  if (connection.connected) {\n    return [\n      'connected',\n      connection.connectedAt ? ` ${connection.connectedAt}` : '',\n      connection.connectedBy ? ` by ${connection.connectedBy}` : '',\n    ].join('');\n  }\n  return connection.missing.length > 0\n    ? `not connected — app fields missing: ${connection.missing.join(', ')}`\n    : 'not connected';\n}\n\n/**\n * `apps connect <product>`: connect the integration ONCE for the whole Source,\n * for the Source's provided agents whose template says `owner: \"source\"`.\n * Asks for any missing app fields at the terminal (secrets hidden, never from\n * a flag), prints the provider's consent URL, then waits until the browser\n * finishes. `apps disconnect <product>` removes it.\n */\nasync function runConnection(\n  ctx: CliContext,\n  args: AppsArgs,\n  subcommand: 'connect' | 'disconnect',\n  product: string,\n): Promise<ExitCode> {\n  const { env, client, source } = await openClient(ctx, args);\n\n  if (subcommand === 'disconnect') {\n    return disconnect(ctx, args, client, env.host, source, product);\n  }\n\n  const shown = await client.connection((token) =>\n    showConnection(env.host, token, source, product),\n  );\n  if (shown.status === 'unsupported') {\n    throw invalidStateError(\n      shown.message,\n      `Each team connects ${product} itself, from the team's Integrations page.`,\n    );\n  }\n  if (shown.status !== 'ok') {\n    throw invalidStateError(\n      'The host could not read the connection.',\n      'Retry shortly.',\n    );\n  }\n  const current = shown.data.connection;\n\n  if (current.app === 'fields') {\n    ctx.log(\n      [\n        `${current.name} app for ${shown.data.source.slug} (one for the whole Source)`,\n        `  Register this redirect URL in the app: ${shown.data.callbackUrls.join(', ')}`,\n      ].join('\\n'),\n    );\n  }\n\n  const fields = await askFields(ctx, args, current, product);\n\n  const started = await client.connection((token) =>\n    startConnection(env.host, token, {\n      source,\n      product,\n      ...(Object.keys(fields).length > 0 ? { fields } : {}),\n    }),\n  );\n  if (started.status === 'not-configured') {\n    throw validationError(\n      `${current.name} is not set up for the Source yet — missing: ${started.missing.join(', ')}.`,\n      current.app === 'source-app'\n        ? `Run \"ekanos apps set ${product}\" to enter the Source's app first.`\n        : `Run \"ekanos apps connect ${product}\" again and fill every field.`,\n    );\n  }\n  if (started.status !== 'ok') {\n    throw invalidStateError(\n      'The host could not start the connection.',\n      'Retry shortly.',\n    );\n  }\n\n  ctx.log(\n    [\n      `Open this link and approve ${current.name} as the account the Source's agents should act as:`,\n      `  ${started.data.authorizeUrl}`,\n    ].join('\\n'),\n  );\n\n  if (args.noWait || ctx.jsonMode) {\n    return ctx.succeed(\n      {\n        host: env.host,\n        product,\n        authorizeUrl: started.data.authorizeUrl,\n        callbackUrl: started.data.callbackUrl,\n        connected: false,\n      },\n      ctx.ui.hint(`Then check with \"ekanos apps show ${product}\".`),\n    );\n  }\n\n  const deadline = Date.now() + 10 * 60 * 1000;\n  const before = current.connectedAt;\n  while (Date.now() < deadline) {\n    await new Promise((resolve) =>\n      setTimeout(resolve, args.pollDelayMs ?? 3000),\n    );\n    const polled = await client.connection((token) =>\n      showConnection(env.host, token, source, product),\n    );\n    if (\n      polled.status === 'ok' &&\n      polled.data.connection.connected &&\n      polled.data.connection.connectedAt !== before\n    ) {\n      return ctx.succeed(\n        { host: env.host, product, connection: polled.data.connection },\n        connectionSummary(ctx, polled.data.connection, {\n          sourceSlug: polled.data.source.slug,\n          callbackUrls: polled.data.callbackUrls,\n        }),\n      );\n    }\n  }\n  throw validationError(\n    'The connection did not finish within ten minutes.',\n    `Run \"ekanos apps connect ${product}\" again for a fresh link.`,\n  );\n}\n\nasync function askFields(\n  ctx: CliContext,\n  args: AppsArgs,\n  current: SourceConnection,\n  product: string,\n): Promise<Record<string, string>> {\n  const toAsk = current.fields.filter(\n    (field) => !field.set || current.missing.includes(field.name),\n  );\n  if (toAsk.length === 0) return {};\n  if (!canPrompt(ctx, args)) {\n    throw usageError(\n      `${current.name} needs its app fields entered for the Source: ${toAsk.map((field) => field.label).join(', ')}.`,\n      `Run it yourself in your terminal: npx @ekanos/cli apps connect ${product}${args.source ? ` --source ${args.source}` : ''}`,\n    );\n  }\n  const fields: Record<string, string> = {};\n  for (const field of toAsk) {\n    const question = field.sensitive\n      ? `${field.label} (hidden): `\n      : `${field.label}: `;\n    const value = (\n      await (\n        field.sensitive\n          ? (args.askSecret ?? promptHidden)\n          : (args.ask ?? promptLine)\n      )(question)\n    ).trim();\n    if (value) fields[field.name] = value;\n  }\n  return fields;\n}\n\nasync function disconnect(\n  ctx: CliContext,\n  args: AppsArgs,\n  client: AppsClient,\n  host: string,\n  source: string,\n  product: string,\n): Promise<ExitCode> {\n  if (canPrompt(ctx, args)) {\n    const sure = await (args.confirm ?? promptYesNo)(\n      `Disconnect ${product} for every team's provided agents on ${source}? [y/N]`,\n    );\n    if (!sure) {\n      throw validationError(\n        'Nothing was changed.',\n        `Run \"ekanos apps show ${product}\" to see the current state.`,\n      );\n    }\n  }\n  const result = await client.connection((token) =>\n    deleteConnection(host, token, source, product),\n  );\n  if (result.status === 'unsupported') {\n    throw invalidStateError(\n      result.message,\n      `Each team connects ${product} itself, from the team's Integrations page.`,\n    );\n  }\n  if (result.status !== 'ok') {\n    throw invalidStateError('The host could not disconnect.', 'Retry shortly.');\n  }\n  return ctx.succeed(\n    { host, product, ...result.data },\n    ctx.ui.result({\n      title: result.data.removed\n        ? `Disconnected ${product} for ${source}`\n        : `${product} was not connected for ${source}`,\n      rows: [\n        [\n          'Provided agents',\n          'their tools for this product stop until you connect again',\n        ],\n      ],\n    }),\n  );\n}\n\nfunction connectionSummary(\n  ctx: CliContext,\n  connection: SourceConnection,\n  meta: { sourceSlug: string; callbackUrls: string[] },\n): string {\n  const rows: ResultRow[] = [\n    ['Source', meta.sourceSlug],\n    ['Connected', connectionState(connection)],\n    ...(connection.scope ? ([['Scope', connection.scope]] as ResultRow[]) : []),\n    ...(connection.fields.length > 0\n      ? ([\n          [\n            'App fields',\n            connection.fields.map(\n              (field) =>\n                `${field.label}: ${field.set ? (field.value ?? 'set') : 'missing'}`,\n            ),\n          ],\n        ] as ResultRow[])\n      : []),\n    ['Redirect URL', meta.callbackUrls],\n    [\n      'Used by',\n      'provided agents whose template says connections.<product>.owner: \"source\", in every team',\n    ],\n  ];\n  return [\n    ctx.ui.result({\n      title: `${connection.name} — one connection for the whole Source`,\n      rows,\n    }),\n    ...(connection.connected\n      ? []\n      : [\n          ctx.ui.hint(\n            `Run \"ekanos apps connect ${connection.slug}\" in your terminal to connect it.`,\n          ),\n        ]),\n  ].join('\\n');\n}\n\nasync function openClient(ctx: CliContext, args: AppsArgs) {\n  const env = resolveAuthEnvironment(ctx, args.host, args.env, {\n    projectDir: args.dir,\n  });\n  const resolved = await resolveSourceTarget(\n    env,\n    requireSession(env.store, env.host),\n    args,\n  );\n  return {\n    env,\n    client: new AppsClient(env, resolved.session),\n    source: resolved.source,\n  };\n}\n\nclass AppsClient {\n  constructor(\n    private readonly env: AuthEnvironment,\n    private session: StoredSession,\n  ) {}\n\n  async call<T>(\n    send: (accessToken: string) => Promise<AppsApiResult<T>>,\n  ): Promise<T> {\n    let result = await send(this.session.accessToken);\n    if (result.status === 'unauthorized') {\n      this.session = await refreshStoredSession(this.env, this.session);\n      result = await send(this.session.accessToken);\n    }\n    if (result.status === 'ok') return result.data;\n    throw authRequiredError(\n      `The session for ${this.env.host} could not authorize the apps call.`,\n      `Run \"ekanos login --host ${this.env.host}\" and retry.`,\n    );\n  }\n\n  /** As `call`, for the connections client, whose 409s are answers. */\n  async connection<T>(\n    send: (accessToken: string) => Promise<ConnectionsApiResult<T>>,\n  ): Promise<Exclude<ConnectionsApiResult<T>, { status: 'unauthorized' }>> {\n    let result = await send(this.session.accessToken);\n    if (result.status === 'unauthorized') {\n      this.session = await refreshStoredSession(this.env, this.session);\n      result = await send(this.session.accessToken);\n    }\n    if (result.status !== 'unauthorized') return result;\n    throw authRequiredError(\n      `The session for ${this.env.host} could not authorize the connections call.`,\n      `Run \"ekanos login --host ${this.env.host}\" and retry.`,\n    );\n  }\n}\n\nfunction canPrompt(ctx: CliContext, args: AppsArgs): boolean {\n  return !ctx.jsonMode && (args.stdinIsTTY ?? process.stdin.isTTY === true);\n}\n\nfunction parseSubcommand(value: string | undefined): AppsSubcommand {\n  const match = APPS_SUBCOMMANDS.find((name) => name === value);\n  if (match) return match;\n  throw usageError(\n    value ? `Unknown apps subcommand \"${value}\".` : 'apps needs a subcommand.',\n    `Run one of: ${APPS_SUBCOMMANDS.map((name) => `ekanos apps ${name} <product>`).join(', ')}.`,\n  );\n}\n\nfunction requireProduct(value: string | undefined, verb: string): string {\n  const slug = value?.trim().toLowerCase();\n  if (slug && /^[a-z0-9][a-z0-9-]*$/.test(slug)) return slug;\n  throw usageError(\n    value\n      ? `\"${value}\" is not a product slug.`\n      : `apps ${verb} needs a product.`,\n    `Pass the product's slug, e.g. \"ekanos apps ${verb} linear\". \"ekanos catalog\" lists them.`,\n  );\n}\n\nexport async function promptLine(question: string): Promise<string> {\n  const readline = await import('node:readline/promises');\n  const rl = readline.createInterface({\n    input: process.stdin,\n    output: process.stderr,\n  });\n  try {\n    return await rl.question(question);\n  } finally {\n    rl.close();\n  }\n}\n\n/** Read a line without echoing it: the secret never appears on screen or in scrollback. */\nexport async function promptHidden(question: string): Promise<string> {\n  const readline = await import('node:readline');\n  process.stderr.write(question);\n  const rl = readline.createInterface({\n    input: process.stdin,\n    output: process.stderr,\n    terminal: true,\n  });\n  // Swallow readline's echo of each keystroke; the question is already written.\n  (rl as unknown as { _writeToOutput: (text: string) => void })._writeToOutput =\n    () => {};\n  try {\n    return await new Promise<string>((resolve) => {\n      rl.question('', resolve);\n    });\n  } finally {\n    rl.close();\n    process.stderr.write('\\n');\n  }\n}\n\n/** Every redirect URI to register; an older host sends only the one. */\nfunction callbackUrls(status: ProviderAppStatus): string[] {\n  return status.callbackUrls?.length\n    ? status.callbackUrls\n    : [status.callbackUrl];\n}\n"]}

package/dist/commands/reviewers.d.ts

@@ -0,0 +1,21 @@
+import type { CliContext } from '../context.js';
+import type { ExitCode } from '../exit-codes.js';
+export declare const REVIEWERS_SUBCOMMANDS: readonly ['list', 'add', 'remove'];
+export interface ReviewersArgs {
+    host?: string;
+    source?: string;
+    /** `list`, `add <email>`, `remove <email>`. */
+    positionals: readonly string[];
+    reach?: string;
+    team?: string;
+    dir: string;
+    env: Record<string, string | undefined>;
+}
+/**
+ * `reviewers` — a Source admin names who decides its agents' reply drafts
+ * held under an `approve` policy. A reviewer is one of the Source's own
+ * users, at a reach: `source` (drafts from every team's provided agents) or
+ * `team` (one named team's). `list` shows them; `add` names one; `remove`
+ * takes one off — every reach, or only the named team's with `--team`.
+ */
+export declare function runReviewers(ctx: CliContext, args: ReviewersArgs): Promise<ExitCode>;

package/dist/commands/reviewers.js

@@ -0,0 +1,162 @@
+import { refreshStoredSession, requireSession, resolveAuthEnvironment, } from '../auth/session.js';
+import { authRequiredError, usageError } from '../errors.js';
+import { addReviewer, listReviewers, removeReviewer, } from '../reviewers-api.js';
+import { resolveSourceTarget } from '../source-target.js';
+export const REVIEWERS_SUBCOMMANDS = ['list', 'add', 'remove'];
+const REACHES = ['source', 'team'];
+/**
+ * `reviewers` — a Source admin names who decides its agents' reply drafts
+ * held under an `approve` policy. A reviewer is one of the Source's own
+ * users, at a reach: `source` (drafts from every team's provided agents) or
+ * `team` (one named team's). `list` shows them; `add` names one; `remove`
+ * takes one off — every reach, or only the named team's with `--team`.
+ */
+export async function runReviewers(ctx, args) {
+    var _a;
+    var _b;
+    const [rawSubcommand, rawEmail, ...extra] = args.positionals;
+    const subcommand = parseSubcommand(rawSubcommand);
+    if (subcommand === 'list') {
+        if (rawEmail !== undefined || args.reach || args.team) {
+            throw usageError('reviewers list takes no arguments.', 'Run "ekanos reviewers list --source <slug>".');
+        }
+    }
+    else if (extra.length > 0) {
+        throw usageError(`Unexpected argument "${extra[0]}".`, 'See "ekanos reviewers --help".');
+    }
+    const email = subcommand === 'list' ? '' : requireEmail(rawEmail, subcommand);
+    const team = args.team === undefined ? undefined : requireTeam(args.team);
+    const reach = subcommand === 'add' ? requireReach(args.reach, email, team) : undefined;
+    if (subcommand === 'remove' && args.reach) {
+        throw usageError('reviewers remove takes no --reach.', `Run "ekanos reviewers remove ${email}" (every reach) or add "--team <slug>" for one team's.`);
+    }
+    const env = resolveAuthEnvironment(ctx, args.host, args.env, {
+        projectDir: args.dir,
+    });
+    const resolved = await resolveSourceTarget(env, requireSession(env.store, env.host), args);
+    const client = new ReviewersClient(env, resolved.session);
+    const source = resolved.source;
+    if (subcommand === 'list') {
+        const list = await client.call((token) => listReviewers(env.host, token, source));
+        if (list.reviewers.length === 0) {
+            return ctx.succeed(Object.assign({ host: env.host }, list), ctx.ui.result({
+                title: `No reviewers on ${list.source.slug}`,
+                tone: 'warn',
+                notes: [
+                    'Reply drafts under an "approve" policy wait for a named reviewer.',
+                    'Name one: "ekanos reviewers add <email> --reach source".',
+                ],
+            }));
+        }
+        return ctx.succeed(Object.assign({ host: env.host }, list), [
+            ctx.ui.bold(`Reviewers on ${list.source.slug}`),
+            ctx.ui.table(['Email', 'Name', 'Reach', 'Team'], list.reviewers.map(reviewerRow)),
+        ].join('\n'));
+    }
+    if (subcommand === 'add' && reach) {
+        const result = await client.call((token) => addReviewer(env.host, token, source, Object.assign({ email,
+            reach }, (team ? { team } : {}))));
+        const reviewer = result.reviewer;
+        return ctx.succeed(Object.assign({ host: env.host }, result), ctx.ui.result({
+            title: result.created
+                ? `Added ${who(reviewer)} as a reviewer`
+                : `${who(reviewer)} already reviews at that reach`,
+            tone: result.created ? 'ok' : 'warn',
+            rows: [
+                ['Source', source],
+                ['Reach', reachLabel(reviewer)],
+            ],
+            notes: [
+                reviewer.reach === 'source'
+                    ? "Decides drafts from every team's provided agents, in the Source's review queue."
+                    : `Decides ${(_b = (_a = reviewer.team) === null || _a === void 0 ? void 0 : _a.slug) !== null && _b !== void 0 ? _b : 'the team'}'s drafts, from its Approvals inbox or the Source's review queue.`,
+            ],
+        }));
+    }
+    const result = await client.call((token) => removeReviewer(env.host, token, source, Object.assign({ email }, (team ? { team } : {}))));
+    return ctx.succeed(Object.assign({ host: env.host }, result), ctx.ui.result({
+        title: `Removed ${email}${team ? ` from ${team}` : ''}`,
+        rows: [
+            ['Source', source],
+            [
+                'Removed',
+                `${result.removed} reach${result.removed === 1 ? '' : 'es'}`,
+            ],
+        ],
+    }));
+}
+function reviewerRow(reviewer) {
+    var _a;
+    var _b, _c, _d;
+    return [
+        (_b = reviewer.email) !== null && _b !== void 0 ? _b : reviewer.userId,
+        (_c = reviewer.name) !== null && _c !== void 0 ? _c : '—',
+        reviewer.reach,
+        (_d = (_a = reviewer.team) === null || _a === void 0 ? void 0 : _a.slug) !== null && _d !== void 0 ? _d : '—',
+    ];
+}
+function reachLabel(reviewer) {
+    return reviewer.reach === 'team' && reviewer.team
+        ? `team ${reviewer.team.slug} (${reviewer.team.name})`
+        : 'source';
+}
+function who(reviewer) {
+    var _a, _b;
+    return (_b = (_a = reviewer.email) !== null && _a !== void 0 ? _a : reviewer.name) !== null && _b !== void 0 ? _b : reviewer.userId;
+}
+class ReviewersClient {
+    constructor(env, session) {
+        this.env = env;
+        this.session = session;
+    }
+    async call(send) {
+        let result = await send(this.session.accessToken);
+        if (result.status === 'unauthorized') {
+            this.session = await refreshStoredSession(this.env, this.session);
+            result = await send(this.session.accessToken);
+        }
+        if (result.status === 'ok')
+            return result.data;
+        throw authRequiredError(`The session for ${this.env.host} could not authorize the reviewers call.`, `Run "ekanos login --host ${this.env.host}" and retry.`);
+    }
+}
+function parseSubcommand(value) {
+    const match = REVIEWERS_SUBCOMMANDS.find((name) => name === value);
+    if (match)
+        return match;
+    throw usageError(value
+        ? `Unknown reviewers subcommand "${value}".`
+        : 'reviewers needs a subcommand.', 'Run one of: ekanos reviewers list, ekanos reviewers add <email> --reach source|team [--team <slug>], ekanos reviewers remove <email> [--team <slug>].');
+}
+function requireEmail(value, subcommand) {
+    const email = value === null || value === void 0 ? void 0 : value.trim().toLowerCase();
+    if (email && /^[^\s@]+@[^\s@]+$/.test(email))
+        return email;
+    throw usageError(value
+        ? `"${value}" is not an email address.`
+        : 'Name the reviewer by email.', subcommand === 'add'
+        ? 'e.g. "ekanos reviewers add ana@example.com --reach source".'
+        : '"ekanos reviewers list" shows who reviews.');
+}
+function requireTeam(value) {
+    const slug = value.trim().toLowerCase();
+    if (/^[a-z0-9][a-z0-9-]*$/.test(slug))
+        return slug;
+    throw usageError(`"${value}" is not a team slug.`, 'Run "ekanos teams list" to see the teams on this Source.');
+}
+function requireReach(value, email, team) {
+    const reach = REACHES.find((entry) => entry === (value === null || value === void 0 ? void 0 : value.trim().toLowerCase()));
+    if (!reach) {
+        throw usageError(value
+            ? `"${value}" is not a reach: use source or team.`
+            : 'Name the reach: --reach source or --reach team.', `e.g. "ekanos reviewers add ${email} --reach source", or "--reach team --team <slug>" for one team's drafts.`);
+    }
+    if (reach === 'team' && !team) {
+        throw usageError('A team-reach reviewer needs --team <slug>.', 'Run "ekanos teams list" to see the teams on this Source.');
+    }
+    if (reach === 'source' && team) {
+        throw usageError('A source-reach reviewer decides for every team; drop --team.', `Run "ekanos reviewers add ${email} --reach source", or use "--reach team --team ${team}".`);
+    }
+    return reach;
+}
+//# sourceMappingURL=reviewers.js.map