@ekanos/cli 0.12.0 → 0.13.0

package/dist/source-products-api.d.ts

@@ -0,0 +1,59 @@
+import { z } from 'zod';
+export declare const SourceProductSchema: z.ZodObject<{
+    slug: z.ZodString;
+    name: z.ZodString;
+    kind: z.ZodEnum<{
+        experience: "experience";
+        integration: "integration";
+    }>;
+    enabled: z.ZodBoolean;
+    lever: z.ZodEnum<{
+        entitlement: "entitlement";
+        flag: "flag";
+        plan: "plan";
+    }>;
+    registered: z.ZodBoolean;
+}, z.core.$strip>;
+export type SourceProduct = z.infer<typeof SourceProductSchema>;
+export type SourceProductsApiResult<T> = {
+    status: 'ok';
+    data: T;
+} | {
+    status: 'unauthorized';
+};
+export declare function listSourceProducts(host: string, token: string, source: string): Promise<SourceProductsApiResult<{
+    source: {
+        id: string;
+        slug: string;
+        name: string | null;
+    };
+    products: {
+        slug: string;
+        name: string;
+        kind: "experience" | "integration";
+        enabled: boolean;
+        lever: "entitlement" | "flag" | "plan";
+        registered: boolean;
+    }[];
+    canEnable: boolean;
+}>>;
+export declare function setSourceProduct(host: string, token: string, input: {
+    source: string;
+    product: string;
+    enabled: boolean;
+}): Promise<SourceProductsApiResult<{
+    source: {
+        id: string;
+        slug: string;
+        name: string | null;
+    };
+    product: {
+        slug: string;
+        name: string;
+        kind: "experience" | "integration";
+        enabled: boolean;
+        lever: "entitlement" | "flag" | "plan";
+        registered: boolean;
+    };
+    changed: boolean;
+}>>;

package/dist/source-products-api.js

@@ -0,0 +1,113 @@
+import { z } from 'zod';
+import { request } from './auth/ekanos-api.js';
+import { authRequiredError, forbiddenError, invalidStateError, networkError, notFoundError, usageError, } from './errors.js';
+/**
+ * The CLI's client for a Source's products (`ekanos sources products`).
+ *
+ *   GET    /api/partner/sources/products?source=<slug|id>
+ *     → { source, products: [{ slug, name, kind, enabled, lever, registered }], canEnable }
+ *   PUT    /api/partner/sources/products/<product>?source=<slug|id>   enable
+ *   DELETE /api/partner/sources/products/<product>?source=<slug|id>   disable
+ *     → { source, product, changed }
+ *
+ *   → 401 / 3xx  refresh once and retry
+ *   → 403 SUPER_ADMIN_REQUIRED   enabling is a super-admin grant, which an
+ *                                `ekanos login` session never carries
+ *   → 409 REFUSED                a dependency or demo-only guard refused
+ *
+ * The shapes are read here rather than from `@ekanos/integration-schema`, so
+ * this CLI works against a host without a schema release.
+ */
+const SourceRefSchema = z.object({
+    id: z.string(),
+    slug: z.string(),
+    name: z.string().nullable(),
+});
+export const SourceProductSchema = z.object({
+    slug: z.string(),
+    name: z.string(),
+    kind: z.enum(['experience', 'integration']),
+    enabled: z.boolean(),
+    lever: z.enum(['flag', 'plan', 'entitlement']),
+    registered: z.boolean(),
+});
+const ListSchema = z.object({
+    source: SourceRefSchema,
+    products: z.array(SourceProductSchema),
+    canEnable: z.boolean(),
+});
+const ChangeSchema = z.object({
+    source: SourceRefSchema,
+    product: SourceProductSchema,
+    changed: z.boolean(),
+});
+export function listSourceProducts(host, token, source) {
+    return call(host, token, ListSchema, {
+        method: 'GET',
+        path: `/api/partner/sources/products?${new URLSearchParams({ source })}`,
+    });
+}
+export function setSourceProduct(host, token, input) {
+    return call(host, token, ChangeSchema, {
+        method: input.enabled ? 'PUT' : 'DELETE',
+        path: `/api/partner/sources/products/${encodeURIComponent(input.product)}?${new URLSearchParams({ source: input.source })}`,
+    });
+}
+async function call(host, accessToken, schema, init) {
+    const response = await request(`${host}${init.path}`, {
+        method: init.method,
+        headers: {
+            accept: 'application/json',
+            authorization: `Bearer ${accessToken}`,
+        },
+    });
+    if (response.status === 401 ||
+        (response.status >= 300 && response.status < 400)) {
+        return { status: 'unauthorized' };
+    }
+    const body = await readOptionalJson(response);
+    const code = typeof body.code === 'string' ? body.code : null;
+    const message = typeof body.error === 'string' && body.error ? body.error : null;
+    if (response.status === 403 && code === 'MFA_REQUIRED') {
+        throw authRequiredError(message !== null && message !== void 0 ? message : `${host} requires multi-factor authentication.`, 'Complete MFA in the browser, then run "ekanos login" again.');
+    }
+    if (response.status === 403 && code === 'SUPER_ADMIN_REQUIRED') {
+        throw forbiddenError(message !== null && message !== void 0 ? message : 'Only a super-admin enables a product for a Source.', 'A super-admin does it in the browser: /admin/sources → the Source → Products (Experiences are switched on the same page).');
+    }
+    if (response.status === 403) {
+        throw forbiddenError(message !== null && message !== void 0 ? message : 'Not permitted on this Source.', 'Run "ekanos sources" to list the sources you hold a seat on.');
+    }
+    if (response.status === 404) {
+        throw notFoundError(message !== null && message !== void 0 ? message : 'Not found.', code === 'PRODUCT_NOT_FOUND'
+            ? '"ekanos sources products" lists the catalog.'
+            : 'Run "ekanos sources" to list the sources you hold a seat on.');
+    }
+    if (response.status === 409) {
+        throw invalidStateError(message !== null && message !== void 0 ? message : 'The host refused the change.', '"ekanos sources products" shows what this Source has.');
+    }
+    if (response.status === 400) {
+        throw usageError(message !== null && message !== void 0 ? message : 'The host refused the request.', 'See "ekanos sources --help".');
+    }
+    if (!response.ok) {
+        throw networkError(`${host}${init.path.split('?')[0]} responded ${response.status}.`, response.status >= 500
+            ? 'The Ekanos deployment returned a server error. Retry shortly.'
+            : 'Confirm the host runs a build that includes the source products routes.');
+    }
+    const parsed = schema.safeParse(body.data);
+    if (!parsed.success) {
+        throw networkError(`${host}/api/partner/sources/products answered in a shape this CLI does not read.`, 'Run "ekanos upgrade" — the CLI and the host disagree on the source products contract.');
+    }
+    return { status: 'ok', data: parsed.data };
+}
+async function readOptionalJson(response) {
+    try {
+        const parsed = await response.json();
+        return typeof parsed === 'object' && parsed !== null
+            ? parsed
+            : {};
+    }
+    catch (_a) {
+        return {};
+    }
+}
+//# sourceMappingURL=source-products-api.js.map

package/dist/source-products-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-products-api.js","sourceRoot":"","sources":["../src/source-products-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACb,UAAU,GACX,MAAM,UAAU,CAAC;AAElB;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;IAC3C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;IAC9C,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;CACxB,CAAC,CAAC;AAGH,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,MAAM,EAAE,eAAe;IACvB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;CACvB,CAAC,CAAC;AACH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,MAAM,EAAE,eAAe;IACvB,OAAO,EAAE,mBAAmB;IAC5B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC;AAMH,MAAM,UAAU,kBAAkB,CAChC,IAAY,EACZ,KAAa,EACb,MAAc;IAEd,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE;QACnC,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,iCAAiC,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE;KACzE,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,KAAa,EACb,KAA4D;IAE5D,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE;QACrC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;QACxC,IAAI,EAAE,iCAAiC,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;KAC5H,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,IAAI,CACjB,IAAY,EACZ,WAAmB,EACnB,MAAoB,EACpB,IAAwD;IAExD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE;QACpD,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,UAAU,WAAW,EAAE;SACvC;KACF,CAAC,CAAC;IAEH,IACE,QAAQ,CAAC,MAAM,KAAK,GAAG;QACvB,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,EACjD,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACpC,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,MAAM,OAAO,GACX,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAEnE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QACvD,MAAM,iBAAiB,CACrB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,GAAG,IAAI,wCAAwC,EAC1D,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,sBAAsB,EAAE,CAAC;QAC/D,MAAM,cAAc,CAClB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,oDAAoD,EAC/D,2HAA2H,CAC5H,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,cAAc,CAClB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,+BAA+B,EAC1C,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,aAAa,CACjB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,YAAY,EACvB,IAAI,KAAK,mBAAmB;YAC1B,CAAC,CAAC,8CAA8C;YAChD,CAAC,CAAC,8DAA8D,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,iBAAiB,CACrB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,8BAA8B,EACzC,uDAAuD,CACxD,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,UAAU,CACd,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,+BAA+B,EAC1C,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,YAAY,CAChB,GAAG,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,QAAQ,CAAC,MAAM,GAAG,EACjE,QAAQ,CAAC,MAAM,IAAI,GAAG;YACpB,CAAC,CAAC,+DAA+D;YACjE,CAAC,CAAC,yEAAyE,CAC9E,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,YAAY,CAChB,GAAG,IAAI,2EAA2E,EAClF,uFAAuF,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC7C,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,QAAkB;IAElB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC9C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAClD,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;eAAO,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["import { z } from 'zod';\n\nimport { request } from './auth/ekanos-api';\nimport {\n  authRequiredError,\n  forbiddenError,\n  invalidStateError,\n  networkError,\n  notFoundError,\n  usageError,\n} from './errors';\n\n/**\n * The CLI's client for a Source's products (`ekanos sources products`).\n *\n *   GET    /api/partner/sources/products?source=<slug|id>\n *     → { source, products: [{ slug, name, kind, enabled, lever, registered }], canEnable }\n *   PUT    /api/partner/sources/products/<product>?source=<slug|id>   enable\n *   DELETE /api/partner/sources/products/<product>?source=<slug|id>   disable\n *     → { source, product, changed }\n *\n *   → 401 / 3xx  refresh once and retry\n *   → 403 SUPER_ADMIN_REQUIRED   enabling is a super-admin grant, which an\n *                                `ekanos login` session never carries\n *   → 409 REFUSED                a dependency or demo-only guard refused\n *\n * The shapes are read here rather than from `@ekanos/integration-schema`, so\n * this CLI works against a host without a schema release.\n */\n\nconst SourceRefSchema = z.object({\n  id: z.string(),\n  slug: z.string(),\n  name: z.string().nullable(),\n});\n\nexport const SourceProductSchema = z.object({\n  slug: z.string(),\n  name: z.string(),\n  kind: z.enum(['experience', 'integration']),\n  enabled: z.boolean(),\n  lever: z.enum(['flag', 'plan', 'entitlement']),\n  registered: z.boolean(),\n});\nexport type SourceProduct = z.infer<typeof SourceProductSchema>;\n\nconst ListSchema = z.object({\n  source: SourceRefSchema,\n  products: z.array(SourceProductSchema),\n  canEnable: z.boolean(),\n});\nconst ChangeSchema = z.object({\n  source: SourceRefSchema,\n  product: SourceProductSchema,\n  changed: z.boolean(),\n});\n\nexport type SourceProductsApiResult<T> =\n  | { status: 'ok'; data: T }\n  | { status: 'unauthorized' };\n\nexport function listSourceProducts(\n  host: string,\n  token: string,\n  source: string,\n) {\n  return call(host, token, ListSchema, {\n    method: 'GET',\n    path: `/api/partner/sources/products?${new URLSearchParams({ source })}`,\n  });\n}\n\nexport function setSourceProduct(\n  host: string,\n  token: string,\n  input: { source: string; product: string; enabled: boolean },\n) {\n  return call(host, token, ChangeSchema, {\n    method: input.enabled ? 'PUT' : 'DELETE',\n    path: `/api/partner/sources/products/${encodeURIComponent(input.product)}?${new URLSearchParams({ source: input.source })}`,\n  });\n}\n\nasync function call<T>(\n  host: string,\n  accessToken: string,\n  schema: z.ZodType<T>,\n  init: { method: 'GET' | 'PUT' | 'DELETE'; path: string },\n): Promise<SourceProductsApiResult<T>> {\n  const response = await request(`${host}${init.path}`, {\n    method: init.method,\n    headers: {\n      accept: 'application/json',\n      authorization: `Bearer ${accessToken}`,\n    },\n  });\n\n  if (\n    response.status === 401 ||\n    (response.status >= 300 && response.status < 400)\n  ) {\n    return { status: 'unauthorized' };\n  }\n\n  const body = await readOptionalJson(response);\n  const code = typeof body.code === 'string' ? body.code : null;\n  const message =\n    typeof body.error === 'string' && body.error ? body.error : null;\n\n  if (response.status === 403 && code === 'MFA_REQUIRED') {\n    throw authRequiredError(\n      message ?? `${host} requires multi-factor authentication.`,\n      'Complete MFA in the browser, then run \"ekanos login\" again.',\n    );\n  }\n  if (response.status === 403 && code === 'SUPER_ADMIN_REQUIRED') {\n    throw forbiddenError(\n      message ?? 'Only a super-admin enables a product for a Source.',\n      'A super-admin does it in the browser: /admin/sources → the Source → Products (Experiences are switched on the same page).',\n    );\n  }\n  if (response.status === 403) {\n    throw forbiddenError(\n      message ?? 'Not permitted on this Source.',\n      'Run \"ekanos sources\" to list the sources you hold a seat on.',\n    );\n  }\n  if (response.status === 404) {\n    throw notFoundError(\n      message ?? 'Not found.',\n      code === 'PRODUCT_NOT_FOUND'\n        ? '\"ekanos sources products\" lists the catalog.'\n        : 'Run \"ekanos sources\" to list the sources you hold a seat on.',\n    );\n  }\n  if (response.status === 409) {\n    throw invalidStateError(\n      message ?? 'The host refused the change.',\n      '\"ekanos sources products\" shows what this Source has.',\n    );\n  }\n  if (response.status === 400) {\n    throw usageError(\n      message ?? 'The host refused the request.',\n      'See \"ekanos sources --help\".',\n    );\n  }\n  if (!response.ok) {\n    throw networkError(\n      `${host}${init.path.split('?')[0]} responded ${response.status}.`,\n      response.status >= 500\n        ? 'The Ekanos deployment returned a server error. Retry shortly.'\n        : 'Confirm the host runs a build that includes the source products routes.',\n    );\n  }\n\n  const parsed = schema.safeParse(body.data);\n  if (!parsed.success) {\n    throw networkError(\n      `${host}/api/partner/sources/products answered in a shape this CLI does not read.`,\n      'Run \"ekanos upgrade\" — the CLI and the host disagree on the source products contract.',\n    );\n  }\n  return { status: 'ok', data: parsed.data };\n}\n\nasync function readOptionalJson(\n  response: Response,\n): Promise<Record<string, unknown>> {\n  try {\n    const parsed: unknown = await response.json();\n    return typeof parsed === 'object' && parsed !== null\n      ? (parsed as Record<string, unknown>)\n      : {};\n  } catch {\n    return {};\n  }\n}\n"]}

package/dist/team-connect-api.d.ts

@@ -0,0 +1,244 @@
+import { z } from 'zod';
+import { type TeamsApiResult } from './teams-api.js';
+/**
+ * The CLI's client for connecting a product for a team (`ekanos teams
+ * connect`), for the team's Source admin.
+ *
+ *   GET  /api/partner/teams/<team>/integrations/<product>/connect?source=<slug>[&as=<email>]
+ *     → { plan }
+ *   POST /api/partner/teams/<team>/integrations/<product>/connect?source=<slug>
+ *        { as?, fields? }
+ *     → { plan, result: "activated" }                         fields / no-fields
+ *     → { plan, result: "consent", authorizeUrl, expiresAt }  oauth
+ *
+ * The plan's `mode`, decided by the host, says how the product is
+ * connected. The shapes are read here rather than from
+ * `@ekanos/integration-schema`, so this CLI works against a host without a
+ * schema release.
+ */
+export declare const TeamConnectPlanSchema: z.ZodObject<{
+    source: z.ZodObject<{
+        id: z.ZodString;
+        slug: z.ZodString;
+        name: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>;
+    team: z.ZodObject<{
+        slug: z.ZodString;
+        name: z.ZodString;
+    }, z.core.$strip>;
+    product: z.ZodObject<{
+        slug: z.ZodString;
+        name: z.ZodString;
+        kind: z.ZodNullable<z.ZodEnum<{
+            experience: "experience";
+            integration: "integration";
+        }>>;
+    }, z.core.$strip>;
+    scope: z.ZodEnum<{
+        team: "team";
+        user: "user";
+    }>;
+    mode: z.ZodEnum<{
+        browser: "browser";
+        fields: "fields";
+        "no-fields": "no-fields";
+        "not-entitled": "not-entitled";
+        "not-self-serve": "not-self-serve";
+        oauth: "oauth";
+        unsupported: "unsupported";
+        "works-as-shipped": "works-as-shipped";
+    }>;
+    reason: z.ZodNullable<z.ZodString>;
+    fields: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        label: z.ZodString;
+        description: z.ZodNullable<z.ZodString>;
+        sensitive: z.ZodBoolean;
+        required: z.ZodBoolean;
+    }, z.core.$strip>>;
+    teamApp: z.ZodBoolean;
+    member: z.ZodNullable<z.ZodObject<{
+        userId: z.ZodString;
+        email: z.ZodNullable<z.ZodString>;
+        isCaller: z.ZodBoolean;
+    }, z.core.$strip>>;
+    memberProblem: z.ZodNullable<z.ZodString>;
+    connected: z.ZodBoolean;
+    connectedAt: z.ZodNullable<z.ZodString>;
+    connectUrl: z.ZodString;
+}, z.core.$strip>;
+export type TeamConnectPlan = z.infer<typeof TeamConnectPlanSchema>;
+declare const ShowSchema: z.ZodObject<{
+    plan: z.ZodObject<{
+        source: z.ZodObject<{
+            id: z.ZodString;
+            slug: z.ZodString;
+            name: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>;
+        team: z.ZodObject<{
+            slug: z.ZodString;
+            name: z.ZodString;
+        }, z.core.$strip>;
+        product: z.ZodObject<{
+            slug: z.ZodString;
+            name: z.ZodString;
+            kind: z.ZodNullable<z.ZodEnum<{
+                experience: "experience";
+                integration: "integration";
+            }>>;
+        }, z.core.$strip>;
+        scope: z.ZodEnum<{
+            team: "team";
+            user: "user";
+        }>;
+        mode: z.ZodEnum<{
+            browser: "browser";
+            fields: "fields";
+            "no-fields": "no-fields";
+            "not-entitled": "not-entitled";
+            "not-self-serve": "not-self-serve";
+            oauth: "oauth";
+            unsupported: "unsupported";
+            "works-as-shipped": "works-as-shipped";
+        }>;
+        reason: z.ZodNullable<z.ZodString>;
+        fields: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            label: z.ZodString;
+            description: z.ZodNullable<z.ZodString>;
+            sensitive: z.ZodBoolean;
+            required: z.ZodBoolean;
+        }, z.core.$strip>>;
+        teamApp: z.ZodBoolean;
+        member: z.ZodNullable<z.ZodObject<{
+            userId: z.ZodString;
+            email: z.ZodNullable<z.ZodString>;
+            isCaller: z.ZodBoolean;
+        }, z.core.$strip>>;
+        memberProblem: z.ZodNullable<z.ZodString>;
+        connected: z.ZodBoolean;
+        connectedAt: z.ZodNullable<z.ZodString>;
+        connectUrl: z.ZodString;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+declare const StartSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    plan: z.ZodObject<{
+        source: z.ZodObject<{
+            id: z.ZodString;
+            slug: z.ZodString;
+            name: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>;
+        team: z.ZodObject<{
+            slug: z.ZodString;
+            name: z.ZodString;
+        }, z.core.$strip>;
+        product: z.ZodObject<{
+            slug: z.ZodString;
+            name: z.ZodString;
+            kind: z.ZodNullable<z.ZodEnum<{
+                experience: "experience";
+                integration: "integration";
+            }>>;
+        }, z.core.$strip>;
+        scope: z.ZodEnum<{
+            team: "team";
+            user: "user";
+        }>;
+        mode: z.ZodEnum<{
+            browser: "browser";
+            fields: "fields";
+            "no-fields": "no-fields";
+            "not-entitled": "not-entitled";
+            "not-self-serve": "not-self-serve";
+            oauth: "oauth";
+            unsupported: "unsupported";
+            "works-as-shipped": "works-as-shipped";
+        }>;
+        reason: z.ZodNullable<z.ZodString>;
+        fields: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            label: z.ZodString;
+            description: z.ZodNullable<z.ZodString>;
+            sensitive: z.ZodBoolean;
+            required: z.ZodBoolean;
+        }, z.core.$strip>>;
+        teamApp: z.ZodBoolean;
+        member: z.ZodNullable<z.ZodObject<{
+            userId: z.ZodString;
+            email: z.ZodNullable<z.ZodString>;
+            isCaller: z.ZodBoolean;
+        }, z.core.$strip>>;
+        memberProblem: z.ZodNullable<z.ZodString>;
+        connected: z.ZodBoolean;
+        connectedAt: z.ZodNullable<z.ZodString>;
+        connectUrl: z.ZodString;
+    }, z.core.$strip>;
+    result: z.ZodLiteral<"activated">;
+}, z.core.$strip>, z.ZodObject<{
+    plan: z.ZodObject<{
+        source: z.ZodObject<{
+            id: z.ZodString;
+            slug: z.ZodString;
+            name: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>;
+        team: z.ZodObject<{
+            slug: z.ZodString;
+            name: z.ZodString;
+        }, z.core.$strip>;
+        product: z.ZodObject<{
+            slug: z.ZodString;
+            name: z.ZodString;
+            kind: z.ZodNullable<z.ZodEnum<{
+                experience: "experience";
+                integration: "integration";
+            }>>;
+        }, z.core.$strip>;
+        scope: z.ZodEnum<{
+            team: "team";
+            user: "user";
+        }>;
+        mode: z.ZodEnum<{
+            browser: "browser";
+            fields: "fields";
+            "no-fields": "no-fields";
+            "not-entitled": "not-entitled";
+            "not-self-serve": "not-self-serve";
+            oauth: "oauth";
+            unsupported: "unsupported";
+            "works-as-shipped": "works-as-shipped";
+        }>;
+        reason: z.ZodNullable<z.ZodString>;
+        fields: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            label: z.ZodString;
+            description: z.ZodNullable<z.ZodString>;
+            sensitive: z.ZodBoolean;
+            required: z.ZodBoolean;
+        }, z.core.$strip>>;
+        teamApp: z.ZodBoolean;
+        member: z.ZodNullable<z.ZodObject<{
+            userId: z.ZodString;
+            email: z.ZodNullable<z.ZodString>;
+            isCaller: z.ZodBoolean;
+        }, z.core.$strip>>;
+        memberProblem: z.ZodNullable<z.ZodString>;
+        connected: z.ZodBoolean;
+        connectedAt: z.ZodNullable<z.ZodString>;
+        connectUrl: z.ZodString;
+    }, z.core.$strip>;
+    result: z.ZodLiteral<"consent">;
+    authorizeUrl: z.ZodString;
+    expiresAt: z.ZodString;
+}, z.core.$strip>], "result">;
+export type TeamConnectStart = z.infer<typeof StartSchema>;
+interface Target {
+    source: string;
+    team: string;
+    product: string;
+}
+export declare function showTeamConnect(host: string, accessToken: string, target: Target, asEmail?: string): Promise<TeamsApiResult<z.infer<typeof ShowSchema>>>;
+export declare function startTeamConnect(host: string, accessToken: string, target: Target, body: {
+    as?: string;
+    fields?: Record<string, string>;
+}): Promise<TeamsApiResult<TeamConnectStart>>;
+export {};

package/dist/team-connect-api.js

@@ -0,0 +1,95 @@
+import { z } from 'zod';
+import { call } from './teams-api.js';
+/**
+ * The CLI's client for connecting a product for a team (`ekanos teams
+ * connect`), for the team's Source admin.
+ *
+ *   GET  /api/partner/teams/<team>/integrations/<product>/connect?source=<slug>[&as=<email>]
+ *     → { plan }
+ *   POST /api/partner/teams/<team>/integrations/<product>/connect?source=<slug>
+ *        { as?, fields? }
+ *     → { plan, result: "activated" }                         fields / no-fields
+ *     → { plan, result: "consent", authorizeUrl, expiresAt }  oauth
+ *
+ * The plan's `mode`, decided by the host, says how the product is
+ * connected. The shapes are read here rather than from
+ * `@ekanos/integration-schema`, so this CLI works against a host without a
+ * schema release.
+ */
+export const TeamConnectPlanSchema = z.object({
+    source: z.object({
+        id: z.string(),
+        slug: z.string(),
+        name: z.string().nullable(),
+    }),
+    team: z.object({ slug: z.string(), name: z.string() }),
+    product: z.object({
+        slug: z.string(),
+        name: z.string(),
+        kind: z.enum(['experience', 'integration']).nullable(),
+    }),
+    scope: z.enum(['team', 'user']),
+    mode: z.enum([
+        'unsupported',
+        'not-entitled',
+        'not-self-serve',
+        'works-as-shipped',
+        'oauth',
+        'fields',
+        'no-fields',
+        'browser',
+    ]),
+    reason: z.string().nullable(),
+    fields: z.array(z.object({
+        name: z.string(),
+        label: z.string(),
+        description: z.string().nullable(),
+        sensitive: z.boolean(),
+        required: z.boolean(),
+    })),
+    teamApp: z.boolean(),
+    member: z
+        .object({
+        userId: z.string(),
+        email: z.string().nullable(),
+        isCaller: z.boolean(),
+    })
+        .nullable(),
+    memberProblem: z.string().nullable(),
+    connected: z.boolean(),
+    connectedAt: z.string().nullable(),
+    connectUrl: z.string(),
+});
+const ShowSchema = z.object({ plan: TeamConnectPlanSchema });
+const StartSchema = z.discriminatedUnion('result', [
+    z.object({ plan: TeamConnectPlanSchema, result: z.literal('activated') }),
+    z.object({
+        plan: TeamConnectPlanSchema,
+        result: z.literal('consent'),
+        authorizeUrl: z.string(),
+        expiresAt: z.string(),
+    }),
+]);
+function connectPath(target) {
+    return `/api/partner/teams/${encodeURIComponent(target.team)}/integrations/${encodeURIComponent(target.product)}/connect`;
+}
+export function showTeamConnect(host, accessToken, target, asEmail) {
+    // `call` puts `source` in the query; `as` rides in the path's own query.
+    const path = asEmail
+        ? `${connectPath(target)}?${new URLSearchParams({ as: asEmail })}`
+        : connectPath(target);
+    return call(host, accessToken, ShowSchema, {
+        method: 'GET',
+        path,
+        source: target.source,
+    });
+}
+export function startTeamConnect(host, accessToken, target, body) {
+    return call(host, accessToken, StartSchema, {
+        method: 'POST',
+        path: connectPath(target),
+        source: target.source,
+        body,
+    });
+}
+//# sourceMappingURL=team-connect-api.js.map

package/dist/team-connect-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"team-connect-api.js","sourceRoot":"","sources":["../src/team-connect-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAuB,IAAI,EAAE,MAAM,aAAa,CAAC;AAExD;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC5B,CAAC;IACF,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACtD,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE;KACvD,CAAC;IACF,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;QACX,aAAa;QACb,cAAc;QACd,gBAAgB;QAChB,kBAAkB;QAClB,OAAO;QACP,QAAQ;QACR,WAAW;QACX,SAAS;KACV,CAAC;IACF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,MAAM,EAAE,CAAC,CAAC,KAAK,CACb,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;QACtB,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;KACtB,CAAC,CACH;IACD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,MAAM,EAAE,CAAC;SACN,MAAM,CAAC;QACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC5B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;KACtB,CAAC;SACD,QAAQ,EAAE;IACb,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAC;AAGH,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;AAC7D,MAAM,WAAW,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IACjD,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;IACzE,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,qBAAqB;QAC3B,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC5B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;QACxB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;KACtB,CAAC;CACH,CAAC,CAAC;AASH,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,sBAAsB,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;AAC5H,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,WAAmB,EACnB,MAAc,EACd,OAAgB;IAEhB,yEAAyE;IACzE,MAAM,IAAI,GAAG,OAAO;QAClB,CAAC,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,IAAI,eAAe,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE;QAClE,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACxB,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE;QACzC,MAAM,EAAE,KAAK;QACb,IAAI;QACJ,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,WAAmB,EACnB,MAAc,EACd,IAAsD;IAEtD,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE;QAC1C,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,IAAI;KACL,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { z } from 'zod';\n\nimport { type TeamsApiResult, call } from './teams-api';\n\n/**\n * The CLI's client for connecting a product for a team (`ekanos teams\n * connect`), for the team's Source admin.\n *\n *   GET  /api/partner/teams/<team>/integrations/<product>/connect?source=<slug>[&as=<email>]\n *     → { plan }\n *   POST /api/partner/teams/<team>/integrations/<product>/connect?source=<slug>\n *        { as?, fields? }\n *     → { plan, result: \"activated\" }                         fields / no-fields\n *     → { plan, result: \"consent\", authorizeUrl, expiresAt }  oauth\n *\n * The plan's `mode`, decided by the host, says how the product is\n * connected. The shapes are read here rather than from\n * `@ekanos/integration-schema`, so this CLI works against a host without a\n * schema release.\n */\n\nexport const TeamConnectPlanSchema = z.object({\n  source: z.object({\n    id: z.string(),\n    slug: z.string(),\n    name: z.string().nullable(),\n  }),\n  team: z.object({ slug: z.string(), name: z.string() }),\n  product: z.object({\n    slug: z.string(),\n    name: z.string(),\n    kind: z.enum(['experience', 'integration']).nullable(),\n  }),\n  scope: z.enum(['team', 'user']),\n  mode: z.enum([\n    'unsupported',\n    'not-entitled',\n    'not-self-serve',\n    'works-as-shipped',\n    'oauth',\n    'fields',\n    'no-fields',\n    'browser',\n  ]),\n  reason: z.string().nullable(),\n  fields: z.array(\n    z.object({\n      name: z.string(),\n      label: z.string(),\n      description: z.string().nullable(),\n      sensitive: z.boolean(),\n      required: z.boolean(),\n    }),\n  ),\n  teamApp: z.boolean(),\n  member: z\n    .object({\n      userId: z.string(),\n      email: z.string().nullable(),\n      isCaller: z.boolean(),\n    })\n    .nullable(),\n  memberProblem: z.string().nullable(),\n  connected: z.boolean(),\n  connectedAt: z.string().nullable(),\n  connectUrl: z.string(),\n});\nexport type TeamConnectPlan = z.infer<typeof TeamConnectPlanSchema>;\n\nconst ShowSchema = z.object({ plan: TeamConnectPlanSchema });\nconst StartSchema = z.discriminatedUnion('result', [\n  z.object({ plan: TeamConnectPlanSchema, result: z.literal('activated') }),\n  z.object({\n    plan: TeamConnectPlanSchema,\n    result: z.literal('consent'),\n    authorizeUrl: z.string(),\n    expiresAt: z.string(),\n  }),\n]);\nexport type TeamConnectStart = z.infer<typeof StartSchema>;\n\ninterface Target {\n  source: string;\n  team: string;\n  product: string;\n}\n\nfunction connectPath(target: Target): string {\n  return `/api/partner/teams/${encodeURIComponent(target.team)}/integrations/${encodeURIComponent(target.product)}/connect`;\n}\n\nexport function showTeamConnect(\n  host: string,\n  accessToken: string,\n  target: Target,\n  asEmail?: string,\n): Promise<TeamsApiResult<z.infer<typeof ShowSchema>>> {\n  // `call` puts `source` in the query; `as` rides in the path's own query.\n  const path = asEmail\n    ? `${connectPath(target)}?${new URLSearchParams({ as: asEmail })}`\n    : connectPath(target);\n  return call(host, accessToken, ShowSchema, {\n    method: 'GET',\n    path,\n    source: target.source,\n  });\n}\n\nexport function startTeamConnect(\n  host: string,\n  accessToken: string,\n  target: Target,\n  body: { as?: string; fields?: Record<string, string> },\n): Promise<TeamsApiResult<TeamConnectStart>> {\n  return call(host, accessToken, StartSchema, {\n    method: 'POST',\n    path: connectPath(target),\n    source: target.source,\n    body,\n  });\n}\n"]}

package/dist/teams-api.d.ts

@@ -44,6 +44,7 @@ export declare function setTeamApp(host: string, accessToken: string, target: {
 }, body: {
     connectionId?: string;
     fields: Record<string, string>;
+    clear?: string[];
 }): Promise<TeamsApiResult<TeamAppSetResult>>;
 export declare function mintTeamWebhook(host: string, accessToken: string, target: {
     source: string;

package/dist/teams-api.js

@@ -83,7 +83,7 @@ function integrationPath(target) {
 }
 /** One partner teams call; shared by the team-agent clients (`team-agents-api.ts`). */
 export async function call(host, accessToken, schema, init) {
-    const response = await request(`${host}${init.path}?${new URLSearchParams({ source: init.source })}`, {
+    const response = await request(`${host}${init.path}${init.path.includes('?') ? '&' : '?'}${new URLSearchParams({ source: init.source })}`, {
         method: init.method,
         headers: Object.assign({ accept: 'application/json', authorization: `Bearer ${accessToken}` }, (init.body === undefined
             ? {}