@ekanos/cli 0.12.0 → 0.13.0

package/dist/teams-api.js.map

@@ -1 +1 @@
-{"version":3,"file":"teams-api.js","sourceRoot":"","sources":["../src/teams-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,sBAAsB,EAGtB,sBAAsB,EAEtB,4BAA4B,EAE5B,4BAA4B,EAE5B,oBAAoB,EAEpB,eAAe,EAEf,2BAA2B,EAE3B,cAAc,EAEd,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACb,UAAU,EACV,eAAe,GAChB,MAAM,UAAU,CAAC;AAgClB,MAAM,UAAU,SAAS,CACvB,IAAY,EACZ,WAAmB,EACnB,MAAc;IAEd,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE;QAC7C,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,oBAAoB;QAC1B,MAAM;KACP,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,IAAY,EACZ,WAAmB,EACnB,MAAyD;IAEzD,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,2BAA2B,EAAE;QAC1D,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,IAAY,EACZ,WAAmB,EACnB,MAAyD,EACzD,IAA+D;IAE/D,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,sBAAsB,EAAE;QACrD,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM;QACtC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,IAAI;KACL,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,WAAmB,EACnB,MAAyD,EACzD,SAAiB;IAEjB,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,2BAA2B,EAAE;QAC1D,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,aAAa,kBAAkB,CAAC,SAAS,CAAC,EAAE;QAC5E,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,IAAY,EACZ,WAAmB,EACnB,MAAc,EACd,IAAuB;IAEvB,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,sBAAsB,EAAE;QACrD,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,oBAAoB;QAC1B,MAAM;QACN,IAAI;KACL,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,WAAmB,EACnB,MAAwC;IAExC,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,oBAAoB,EAAE;QACnD,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC;QAC9B,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,WAAmB,EACnB,MAAwC,EACxC,IAAqC;IAErC,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,4BAA4B,EAAE;QAC3D,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC;QAC9B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,IAAI;KACL,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,WAAmB,EACnB,MAAuD,EACvD,IAAY;IAEZ,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,4BAA4B,EAAE;QAC3D,MAAM,EAAE,OAAO;QACf,IAAI,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;QACvE,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,IAAI,EAAE,EAAE,IAAI,EAAE;KACf,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,WAAmB,EACnB,MAAuD;IAEvD,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,4BAA4B,EAAE;QAC3D,MAAM,EAAE,QAAQ;QAChB,IAAI,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;QACvE,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,WAAmB,EACnB,MAAwC;IAExC,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,eAAe,EAAE;QAC9C,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,sBAAsB,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ;QACnE,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,sBAAsB,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC;AAClE,CAAC;AAED,SAAS,eAAe,CAAC,MAAyC;IAChE,OAAO,sBAAsB,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;AACpH,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,IAAI,CACxB,IAAY,EACZ,WAAmB,EACnB,MAAoB,EACpB,IAKC;IAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,GAAG,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EACrE;QACE,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,kBACL,MAAM,EAAE,kBAAkB,EAC1B,aAAa,EAAE,UAAU,WAAW,EAAE,IACnC,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;YACzB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAC5C;QACD,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;KACtE,CACF,CAAC;IAEF,IACE,QAAQ,CAAC,MAAM,KAAK,GAAG;QACvB,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,EACjD,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACpC,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,MAAM,OAAO,GACX,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAEnE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QACvD,MAAM,iBAAiB,CACrB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,GAAG,IAAI,wCAAwC,EAC1D,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,cAAc,CAClB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,+BAA+B,EAC1C,IAAI,KAAK,uBAAuB;YAC9B,CAAC,CAAC,yEAAyE;YAC3E,CAAC,CAAC,8DAA8D,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,aAAa,CACjB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,YAAY,EACvB,IAAI,KAAK,gBAAgB;YACvB,CAAC,CAAC,0DAA0D;YAC5D,CAAC,CAAC,IAAI,KAAK,sBAAsB;gBAC/B,CAAC,CAAC,qFAAqF;gBACvF,CAAC,CAAC,IAAI,KAAK,mBAAmB,IAAI,IAAI,KAAK,sBAAsB;oBAC/D,CAAC,CAAC,6EAA6E;oBAC/E,CAAC,CAAC,IAAI,KAAK,kBAAkB;wBAC3B,CAAC,CAAC,4EAA4E;wBAC9E,CAAC,CAAC,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,UAAU,CAAC,QAAQ,CAAC,KAAI,IAAI,KAAK,oBAAoB;4BAC3D,CAAC,CAAC,kEAAkE;4BACpE,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,EAAE,CAAC;gCACvC,CAAC,CAAC,oEAAoE;gCACtE,CAAC,CAAC,8DAA8D,CAC7E,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QACtD,MAAM,iBAAiB,CACrB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,qCAAqC,EAChD,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvD,MAAM,iBAAiB,CACrB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,8BAA8B,EACzC,IAAI,KAAK,YAAY;YACnB,CAAC,CAAC,wEAAwE;YAC1E,CAAC,CAAC,IAAI,KAAK,gBAAgB,IAAI,IAAI,KAAK,iBAAiB;gBACvD,CAAC,CAAC,+GAA+G;gBACjH,CAAC,CAAC,IAAI,KAAK,eAAe;oBACxB,CAAC,CAAC,oFAAoF;oBACtF,CAAC,CAAC,IAAI,KAAK,wBAAwB;wBACjC,CAAC,CAAC,mEAAmE;wBACrE,CAAC,CAAC,4BAA4B,CACvC,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QACvD,MAAM,eAAe,CACnB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,eAAe,EAC1B,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;QACzD,MAAM,eAAe,CACnB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,8BAA8B,EACzC,oDAAoD,CACrD,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,UAAU,CACd,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,+BAA+B,EAC1C,4BAA4B,CAC7B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,YAAY,CAChB,GAAG,IAAI,GAAG,IAAI,CAAC,IAAI,cAAc,QAAQ,CAAC,MAAM,GAAG,EACnD,QAAQ,CAAC,MAAM,IAAI,GAAG;YACpB,CAAC,CAAC,+DAA+D;YACjE,CAAC,CAAC,+DAA+D,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,YAAY,CAChB,GAAG,IAAI,gEAAgE,EACvE,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC7C,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,QAAkB;IAElB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC9C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAClD,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;eAAO,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["import {\n  type TeamAppSetResult,\n  TeamAppSetResultSchema,\n  type TeamCreateRequest,\n  type TeamCreateResult,\n  TeamCreateResultSchema,\n  type TeamMemberChangeResult,\n  TeamMemberChangeResultSchema,\n  type TeamMemberInviteResult,\n  TeamMemberInviteResultSchema,\n  type TeamMemberList,\n  TeamMemberListSchema,\n  type TeamRoles,\n  TeamRolesSchema,\n  type TeamIntegrationStatus,\n  TeamIntegrationStatusSchema,\n  type TeamList,\n  TeamListSchema,\n  type TeamWebhookMintResult,\n  TeamWebhookMintResultSchema,\n} from '@ekanos/integration-schema';\nimport type { z } from 'zod';\n\nimport { request } from './auth/ekanos-api';\nimport {\n  authRequiredError,\n  forbiddenError,\n  invalidStateError,\n  networkError,\n  notFoundError,\n  usageError,\n  validationError,\n} from './errors';\n\n/**\n * The CLI's client for a Source's teams and their integration setup — the\n * team-level counterpart of `apps-api.ts`.\n *\n *   GET  /api/partner/teams?source=<slug>                              → TeamList\n *   GET  /api/partner/teams/<team>/integrations/<product>?source=<slug> → TeamIntegrationStatus\n *   PUT  …/integrations/<product>/app?source=<slug>  { connectionId?, fields }\n *                                                                      → TeamAppSetResult\n *   POST …/integrations/<product>/webhooks/<id>?source=<slug>         → TeamWebhookMintResult\n *   POST /api/partner/teams?source=<slug>  { name, slug?, ownerEmail? } → TeamCreateResult\n *   GET  /api/partner/teams/<team>/members?source=<slug>               → TeamMemberList\n *   POST …/<team>/members?source=<slug>  { email, role }               → TeamMemberInviteResult\n *   PATCH  …/<team>/members/<email>?source=<slug>  { role }            → TeamMemberChangeResult\n *   DELETE …/<team>/members/<email>?source=<slug>                      → TeamMemberChangeResult\n *   GET  /api/partner/teams/<team>/roles?source=<slug>                 → TeamRoles\n *\n *   → 401 / 3xx  refresh once and retry\n *   → 403 { code: \"SOURCE_ADMIN_REQUIRED\" | \"MFA_REQUIRED\" | \"FORBIDDEN\" }\n *   → 404 { code: \"TEAM_NOT_FOUND\" | \"PRODUCT_NOT_ENTITLED\" | \"WEBHOOK_NOT_FOUND\"\n *               | \"CONNECTION_NOT_FOUND\" | \"SOURCE_NOT_FOUND\" }\n *               | \"MEMBER_NOT_FOUND\" }\n *   → 409 { code: \"NO_TEAM_APP\" | \"SLUG_TAKEN\" | \"TEAM_ACCOUNTS_DISABLED\"\n *               | \"ALREADY_MEMBER\" | \"ALREADY_INVITED\" | \"PRIMARY_OWNER\" }\n *   → 400 { code: \"INVALID_FIELDS\" | \"INVALID_REQUEST\" | \"UNKNOWN_ROLE\" }\n */\n\nexport type TeamsApiResult<T> =\n  | { status: 'ok'; data: T }\n  | { status: 'unauthorized' };\n\nexport function listTeams(\n  host: string,\n  accessToken: string,\n  source: string,\n): Promise<TeamsApiResult<TeamList>> {\n  return call(host, accessToken, TeamListSchema, {\n    method: 'GET',\n    path: '/api/partner/teams',\n    source,\n  });\n}\n\nexport function showTeamIntegration(\n  host: string,\n  accessToken: string,\n  target: { source: string; team: string; product: string },\n): Promise<TeamsApiResult<TeamIntegrationStatus>> {\n  return call(host, accessToken, TeamIntegrationStatusSchema, {\n    method: 'GET',\n    path: integrationPath(target),\n    source: target.source,\n  });\n}\n\nexport function setTeamApp(\n  host: string,\n  accessToken: string,\n  target: { source: string; team: string; product: string },\n  body: { connectionId?: string; fields: Record<string, string> },\n): Promise<TeamsApiResult<TeamAppSetResult>> {\n  return call(host, accessToken, TeamAppSetResultSchema, {\n    method: 'PUT',\n    path: `${integrationPath(target)}/app`,\n    source: target.source,\n    body,\n  });\n}\n\nexport function mintTeamWebhook(\n  host: string,\n  accessToken: string,\n  target: { source: string; team: string; product: string },\n  webhookId: string,\n): Promise<TeamsApiResult<TeamWebhookMintResult>> {\n  return call(host, accessToken, TeamWebhookMintResultSchema, {\n    method: 'POST',\n    path: `${integrationPath(target)}/webhooks/${encodeURIComponent(webhookId)}`,\n    source: target.source,\n  });\n}\n\nexport function createTeam(\n  host: string,\n  accessToken: string,\n  source: string,\n  body: TeamCreateRequest,\n): Promise<TeamsApiResult<TeamCreateResult>> {\n  return call(host, accessToken, TeamCreateResultSchema, {\n    method: 'POST',\n    path: '/api/partner/teams',\n    source,\n    body,\n  });\n}\n\nexport function listTeamMembers(\n  host: string,\n  accessToken: string,\n  target: { source: string; team: string },\n): Promise<TeamsApiResult<TeamMemberList>> {\n  return call(host, accessToken, TeamMemberListSchema, {\n    method: 'GET',\n    path: membersPath(target.team),\n    source: target.source,\n  });\n}\n\nexport function inviteTeamMember(\n  host: string,\n  accessToken: string,\n  target: { source: string; team: string },\n  body: { email: string; role: string },\n): Promise<TeamsApiResult<TeamMemberInviteResult>> {\n  return call(host, accessToken, TeamMemberInviteResultSchema, {\n    method: 'POST',\n    path: membersPath(target.team),\n    source: target.source,\n    body,\n  });\n}\n\nexport function setTeamMemberRole(\n  host: string,\n  accessToken: string,\n  target: { source: string; team: string; email: string },\n  role: string,\n): Promise<TeamsApiResult<TeamMemberChangeResult>> {\n  return call(host, accessToken, TeamMemberChangeResultSchema, {\n    method: 'PATCH',\n    path: `${membersPath(target.team)}/${encodeURIComponent(target.email)}`,\n    source: target.source,\n    body: { role },\n  });\n}\n\nexport function removeTeamMember(\n  host: string,\n  accessToken: string,\n  target: { source: string; team: string; email: string },\n): Promise<TeamsApiResult<TeamMemberChangeResult>> {\n  return call(host, accessToken, TeamMemberChangeResultSchema, {\n    method: 'DELETE',\n    path: `${membersPath(target.team)}/${encodeURIComponent(target.email)}`,\n    source: target.source,\n  });\n}\n\nexport function listTeamRoles(\n  host: string,\n  accessToken: string,\n  target: { source: string; team: string },\n): Promise<TeamsApiResult<TeamRoles>> {\n  return call(host, accessToken, TeamRolesSchema, {\n    method: 'GET',\n    path: `/api/partner/teams/${encodeURIComponent(target.team)}/roles`,\n    source: target.source,\n  });\n}\n\nfunction membersPath(team: string): string {\n  return `/api/partner/teams/${encodeURIComponent(team)}/members`;\n}\n\nfunction integrationPath(target: { team: string; product: string }): string {\n  return `/api/partner/teams/${encodeURIComponent(target.team)}/integrations/${encodeURIComponent(target.product)}`;\n}\n\n/** One partner teams call; shared by the team-agent clients (`team-agents-api.ts`). */\nexport async function call<T>(\n  host: string,\n  accessToken: string,\n  schema: z.ZodType<T>,\n  init: {\n    method: 'GET' | 'PUT' | 'POST' | 'PATCH' | 'DELETE';\n    path: string;\n    source: string;\n    body?: unknown;\n  },\n): Promise<TeamsApiResult<T>> {\n  const response = await request(\n    `${host}${init.path}?${new URLSearchParams({ source: init.source })}`,\n    {\n      method: init.method,\n      headers: {\n        accept: 'application/json',\n        authorization: `Bearer ${accessToken}`,\n        ...(init.body === undefined\n          ? {}\n          : { 'content-type': 'application/json' }),\n      },\n      body: init.body === undefined ? undefined : JSON.stringify(init.body),\n    },\n  );\n\n  if (\n    response.status === 401 ||\n    (response.status >= 300 && response.status < 400)\n  ) {\n    return { status: 'unauthorized' };\n  }\n\n  const body = await readOptionalJson(response);\n  const code = typeof body.code === 'string' ? body.code : null;\n  const message =\n    typeof body.error === 'string' && body.error ? body.error : null;\n\n  if (response.status === 403 && code === 'MFA_REQUIRED') {\n    throw authRequiredError(\n      message ?? `${host} requires multi-factor authentication.`,\n      'Complete MFA in the browser, then run \"ekanos login\" again.',\n    );\n  }\n  if (response.status === 403) {\n    throw forbiddenError(\n      message ?? 'Not permitted on this Source.',\n      code === 'SOURCE_ADMIN_REQUIRED'\n        ? \"Only a Source admin manages its teams' integrations. Ask one to run it.\"\n        : 'Run \"ekanos sources\" to list the sources you hold a seat on.',\n    );\n  }\n  if (response.status === 404) {\n    throw notFoundError(\n      message ?? 'Not found.',\n      code === 'TEAM_NOT_FOUND'\n        ? 'Run \"ekanos teams list\" to see the teams on this Source.'\n        : code === 'PRODUCT_NOT_ENTITLED'\n          ? '\"ekanos catalog\" lists what this Source has; Ekanos enables a product for a Source.'\n          : code === 'WEBHOOK_NOT_FOUND' || code === 'CONNECTION_NOT_FOUND'\n            ? 'Run \"ekanos teams show <team> <product>\" to see its team apps and webhooks.'\n            : code === 'MEMBER_NOT_FOUND'\n              ? 'Run \"ekanos teams members list <team>\" to see its members and invitations.'\n              : code?.startsWith('AGENT_') || code === 'TEMPLATE_NOT_FOUND'\n                ? 'Run \"ekanos teams agents list <team>\" to see the team\\'s agents.'\n                : /^(TRIGGER|LINK|MCP)_/.test(code ?? '')\n                  ? 'List them first: \"ekanos teams triggers|links|mcp list <team> ...\"'\n                  : 'Run \"ekanos sources\" to list the sources you hold a seat on.',\n    );\n  }\n  if (response.status === 409 && code === 'NO_TEAM_APP') {\n    throw invalidStateError(\n      message ?? 'This integration takes no team app.',\n      'Teams connect through the Source\\'s app: \"ekanos apps show <product>\".',\n    );\n  }\n  if (response.status === 409 || response.status === 422) {\n    throw invalidStateError(\n      message ?? 'The host refused the change.',\n      code === 'SLUG_TAKEN'\n        ? 'Pick another with --slug, or run \"ekanos teams list\" to see the teams.'\n        : code === 'ALREADY_MEMBER' || code === 'ALREADY_INVITED'\n          ? 'Run \"ekanos teams members list <team>\"; change a role with \"ekanos teams members role <team> <email> <role>\".'\n          : code === 'PRIMARY_OWNER'\n            ? \"The primary owner's ownership is transferred in the app (team Settings → Members).\"\n            : code === 'TEAM_ACCOUNTS_DISABLED'\n              ? 'Ekanos switches team accounts on for a Source; ask a super-admin.'\n              : 'See \"ekanos teams --help\".',\n    );\n  }\n  if (response.status === 400 && code === 'UNKNOWN_ROLE') {\n    throw validationError(\n      message ?? 'No such role.',\n      'Run \"ekanos teams roles list <team>\" for the roles this Source uses.',\n    );\n  }\n  if (response.status === 400 && code === 'INVALID_FIELDS') {\n    throw validationError(\n      message ?? 'The host refused the fields.',\n      'Run \"ekanos teams app set <team> <product>\" again.',\n    );\n  }\n  if (response.status === 400) {\n    throw usageError(\n      message ?? 'The host refused the request.',\n      'See \"ekanos teams --help\".',\n    );\n  }\n  if (!response.ok) {\n    throw networkError(\n      `${host}${init.path} responded ${response.status}.`,\n      response.status >= 500\n        ? 'The Ekanos deployment returned a server error. Retry shortly.'\n        : 'Confirm the host runs a build that includes the teams routes.',\n    );\n  }\n\n  const parsed = schema.safeParse(body.data);\n  if (!parsed.success) {\n    throw networkError(\n      `${host}/api/partner/teams answered in a shape this CLI does not read.`,\n      'Run \"ekanos upgrade\" — the CLI and the host disagree on the teams contract.',\n    );\n  }\n  return { status: 'ok', data: parsed.data };\n}\n\nasync function readOptionalJson(\n  response: Response,\n): Promise<Record<string, unknown>> {\n  try {\n    const parsed: unknown = await response.json();\n    return typeof parsed === 'object' && parsed !== null\n      ? (parsed as Record<string, unknown>)\n      : {};\n  } catch {\n    return {};\n  }\n}\n"]}
+{"version":3,"file":"teams-api.js","sourceRoot":"","sources":["../src/teams-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,sBAAsB,EAGtB,sBAAsB,EAEtB,4BAA4B,EAE5B,4BAA4B,EAE5B,oBAAoB,EAEpB,eAAe,EAEf,2BAA2B,EAE3B,cAAc,EAEd,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACb,UAAU,EACV,eAAe,GAChB,MAAM,UAAU,CAAC;AAgClB,MAAM,UAAU,SAAS,CACvB,IAAY,EACZ,WAAmB,EACnB,MAAc;IAEd,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE;QAC7C,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,oBAAoB;QAC1B,MAAM;KACP,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,IAAY,EACZ,WAAmB,EACnB,MAAyD;IAEzD,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,2BAA2B,EAAE;QAC1D,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,IAAY,EACZ,WAAmB,EACnB,MAAyD,EACzD,IAIC;IAED,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,sBAAsB,EAAE;QACrD,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM;QACtC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,IAAI;KACL,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,WAAmB,EACnB,MAAyD,EACzD,SAAiB;IAEjB,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,2BAA2B,EAAE;QAC1D,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,aAAa,kBAAkB,CAAC,SAAS,CAAC,EAAE;QAC5E,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,IAAY,EACZ,WAAmB,EACnB,MAAc,EACd,IAAuB;IAEvB,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,sBAAsB,EAAE;QACrD,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,oBAAoB;QAC1B,MAAM;QACN,IAAI;KACL,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,WAAmB,EACnB,MAAwC;IAExC,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,oBAAoB,EAAE;QACnD,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC;QAC9B,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,WAAmB,EACnB,MAAwC,EACxC,IAAqC;IAErC,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,4BAA4B,EAAE;QAC3D,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC;QAC9B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,IAAI;KACL,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,WAAmB,EACnB,MAAuD,EACvD,IAAY;IAEZ,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,4BAA4B,EAAE;QAC3D,MAAM,EAAE,OAAO;QACf,IAAI,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;QACvE,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,IAAI,EAAE,EAAE,IAAI,EAAE;KACf,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,WAAmB,EACnB,MAAuD;IAEvD,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,4BAA4B,EAAE;QAC3D,MAAM,EAAE,QAAQ;QAChB,IAAI,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;QACvE,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,WAAmB,EACnB,MAAwC;IAExC,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,eAAe,EAAE;QAC9C,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,sBAAsB,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ;QACnE,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,sBAAsB,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC;AAClE,CAAC;AAED,SAAS,eAAe,CAAC,MAAyC;IAChE,OAAO,sBAAsB,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;AACpH,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,IAAI,CACxB,IAAY,EACZ,WAAmB,EACnB,MAAoB,EACpB,IAKC;IAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,GAAG,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAC1G;QACE,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,kBACL,MAAM,EAAE,kBAAkB,EAC1B,aAAa,EAAE,UAAU,WAAW,EAAE,IACnC,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;YACzB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAC5C;QACD,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;KACtE,CACF,CAAC;IAEF,IACE,QAAQ,CAAC,MAAM,KAAK,GAAG;QACvB,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,EACjD,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACpC,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,MAAM,OAAO,GACX,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAEnE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QACvD,MAAM,iBAAiB,CACrB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,GAAG,IAAI,wCAAwC,EAC1D,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,cAAc,CAClB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,+BAA+B,EAC1C,IAAI,KAAK,uBAAuB;YAC9B,CAAC,CAAC,yEAAyE;YAC3E,CAAC,CAAC,8DAA8D,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,aAAa,CACjB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,YAAY,EACvB,IAAI,KAAK,gBAAgB;YACvB,CAAC,CAAC,0DAA0D;YAC5D,CAAC,CAAC,IAAI,KAAK,sBAAsB;gBAC/B,CAAC,CAAC,qFAAqF;gBACvF,CAAC,CAAC,IAAI,KAAK,mBAAmB,IAAI,IAAI,KAAK,sBAAsB;oBAC/D,CAAC,CAAC,6EAA6E;oBAC/E,CAAC,CAAC,IAAI,KAAK,kBAAkB;wBAC3B,CAAC,CAAC,4EAA4E;wBAC9E,CAAC,CAAC,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,UAAU,CAAC,QAAQ,CAAC,KAAI,IAAI,KAAK,oBAAoB;4BAC3D,CAAC,CAAC,kEAAkE;4BACpE,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,EAAE,CAAC;gCACvC,CAAC,CAAC,oEAAoE;gCACtE,CAAC,CAAC,8DAA8D,CAC7E,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QACtD,MAAM,iBAAiB,CACrB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,qCAAqC,EAChD,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvD,MAAM,iBAAiB,CACrB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,8BAA8B,EACzC,IAAI,KAAK,YAAY;YACnB,CAAC,CAAC,wEAAwE;YAC1E,CAAC,CAAC,IAAI,KAAK,gBAAgB,IAAI,IAAI,KAAK,iBAAiB;gBACvD,CAAC,CAAC,+GAA+G;gBACjH,CAAC,CAAC,IAAI,KAAK,eAAe;oBACxB,CAAC,CAAC,oFAAoF;oBACtF,CAAC,CAAC,IAAI,KAAK,wBAAwB;wBACjC,CAAC,CAAC,mEAAmE;wBACrE,CAAC,CAAC,4BAA4B,CACvC,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QACvD,MAAM,eAAe,CACnB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,eAAe,EAC1B,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;QACzD,MAAM,eAAe,CACnB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,8BAA8B,EACzC,oDAAoD,CACrD,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,UAAU,CACd,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,+BAA+B,EAC1C,4BAA4B,CAC7B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,YAAY,CAChB,GAAG,IAAI,GAAG,IAAI,CAAC,IAAI,cAAc,QAAQ,CAAC,MAAM,GAAG,EACnD,QAAQ,CAAC,MAAM,IAAI,GAAG;YACpB,CAAC,CAAC,+DAA+D;YACjE,CAAC,CAAC,+DAA+D,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,YAAY,CAChB,GAAG,IAAI,gEAAgE,EACvE,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC7C,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,QAAkB;IAElB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC9C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAClD,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;eAAO,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["import {\n  type TeamAppSetResult,\n  TeamAppSetResultSchema,\n  type TeamCreateRequest,\n  type TeamCreateResult,\n  TeamCreateResultSchema,\n  type TeamMemberChangeResult,\n  TeamMemberChangeResultSchema,\n  type TeamMemberInviteResult,\n  TeamMemberInviteResultSchema,\n  type TeamMemberList,\n  TeamMemberListSchema,\n  type TeamRoles,\n  TeamRolesSchema,\n  type TeamIntegrationStatus,\n  TeamIntegrationStatusSchema,\n  type TeamList,\n  TeamListSchema,\n  type TeamWebhookMintResult,\n  TeamWebhookMintResultSchema,\n} from '@ekanos/integration-schema';\nimport type { z } from 'zod';\n\nimport { request } from './auth/ekanos-api';\nimport {\n  authRequiredError,\n  forbiddenError,\n  invalidStateError,\n  networkError,\n  notFoundError,\n  usageError,\n  validationError,\n} from './errors';\n\n/**\n * The CLI's client for a Source's teams and their integration setup — the\n * team-level counterpart of `apps-api.ts`.\n *\n *   GET  /api/partner/teams?source=<slug>                              → TeamList\n *   GET  /api/partner/teams/<team>/integrations/<product>?source=<slug> → TeamIntegrationStatus\n *   PUT  …/integrations/<product>/app?source=<slug>  { connectionId?, fields }\n *                                                                      → TeamAppSetResult\n *   POST …/integrations/<product>/webhooks/<id>?source=<slug>         → TeamWebhookMintResult\n *   POST /api/partner/teams?source=<slug>  { name, slug?, ownerEmail? } → TeamCreateResult\n *   GET  /api/partner/teams/<team>/members?source=<slug>               → TeamMemberList\n *   POST …/<team>/members?source=<slug>  { email, role }               → TeamMemberInviteResult\n *   PATCH  …/<team>/members/<email>?source=<slug>  { role }            → TeamMemberChangeResult\n *   DELETE …/<team>/members/<email>?source=<slug>                      → TeamMemberChangeResult\n *   GET  /api/partner/teams/<team>/roles?source=<slug>                 → TeamRoles\n *\n *   → 401 / 3xx  refresh once and retry\n *   → 403 { code: \"SOURCE_ADMIN_REQUIRED\" | \"MFA_REQUIRED\" | \"FORBIDDEN\" }\n *   → 404 { code: \"TEAM_NOT_FOUND\" | \"PRODUCT_NOT_ENTITLED\" | \"WEBHOOK_NOT_FOUND\"\n *               | \"CONNECTION_NOT_FOUND\" | \"SOURCE_NOT_FOUND\" }\n *               | \"MEMBER_NOT_FOUND\" }\n *   → 409 { code: \"NO_TEAM_APP\" | \"SLUG_TAKEN\" | \"TEAM_ACCOUNTS_DISABLED\"\n *               | \"ALREADY_MEMBER\" | \"ALREADY_INVITED\" | \"PRIMARY_OWNER\" }\n *   → 400 { code: \"INVALID_FIELDS\" | \"INVALID_REQUEST\" | \"UNKNOWN_ROLE\" }\n */\n\nexport type TeamsApiResult<T> =\n  | { status: 'ok'; data: T }\n  | { status: 'unauthorized' };\n\nexport function listTeams(\n  host: string,\n  accessToken: string,\n  source: string,\n): Promise<TeamsApiResult<TeamList>> {\n  return call(host, accessToken, TeamListSchema, {\n    method: 'GET',\n    path: '/api/partner/teams',\n    source,\n  });\n}\n\nexport function showTeamIntegration(\n  host: string,\n  accessToken: string,\n  target: { source: string; team: string; product: string },\n): Promise<TeamsApiResult<TeamIntegrationStatus>> {\n  return call(host, accessToken, TeamIntegrationStatusSchema, {\n    method: 'GET',\n    path: integrationPath(target),\n    source: target.source,\n  });\n}\n\nexport function setTeamApp(\n  host: string,\n  accessToken: string,\n  target: { source: string; team: string; product: string },\n  body: {\n    connectionId?: string;\n    fields: Record<string, string>;\n    clear?: string[];\n  },\n): Promise<TeamsApiResult<TeamAppSetResult>> {\n  return call(host, accessToken, TeamAppSetResultSchema, {\n    method: 'PUT',\n    path: `${integrationPath(target)}/app`,\n    source: target.source,\n    body,\n  });\n}\n\nexport function mintTeamWebhook(\n  host: string,\n  accessToken: string,\n  target: { source: string; team: string; product: string },\n  webhookId: string,\n): Promise<TeamsApiResult<TeamWebhookMintResult>> {\n  return call(host, accessToken, TeamWebhookMintResultSchema, {\n    method: 'POST',\n    path: `${integrationPath(target)}/webhooks/${encodeURIComponent(webhookId)}`,\n    source: target.source,\n  });\n}\n\nexport function createTeam(\n  host: string,\n  accessToken: string,\n  source: string,\n  body: TeamCreateRequest,\n): Promise<TeamsApiResult<TeamCreateResult>> {\n  return call(host, accessToken, TeamCreateResultSchema, {\n    method: 'POST',\n    path: '/api/partner/teams',\n    source,\n    body,\n  });\n}\n\nexport function listTeamMembers(\n  host: string,\n  accessToken: string,\n  target: { source: string; team: string },\n): Promise<TeamsApiResult<TeamMemberList>> {\n  return call(host, accessToken, TeamMemberListSchema, {\n    method: 'GET',\n    path: membersPath(target.team),\n    source: target.source,\n  });\n}\n\nexport function inviteTeamMember(\n  host: string,\n  accessToken: string,\n  target: { source: string; team: string },\n  body: { email: string; role: string },\n): Promise<TeamsApiResult<TeamMemberInviteResult>> {\n  return call(host, accessToken, TeamMemberInviteResultSchema, {\n    method: 'POST',\n    path: membersPath(target.team),\n    source: target.source,\n    body,\n  });\n}\n\nexport function setTeamMemberRole(\n  host: string,\n  accessToken: string,\n  target: { source: string; team: string; email: string },\n  role: string,\n): Promise<TeamsApiResult<TeamMemberChangeResult>> {\n  return call(host, accessToken, TeamMemberChangeResultSchema, {\n    method: 'PATCH',\n    path: `${membersPath(target.team)}/${encodeURIComponent(target.email)}`,\n    source: target.source,\n    body: { role },\n  });\n}\n\nexport function removeTeamMember(\n  host: string,\n  accessToken: string,\n  target: { source: string; team: string; email: string },\n): Promise<TeamsApiResult<TeamMemberChangeResult>> {\n  return call(host, accessToken, TeamMemberChangeResultSchema, {\n    method: 'DELETE',\n    path: `${membersPath(target.team)}/${encodeURIComponent(target.email)}`,\n    source: target.source,\n  });\n}\n\nexport function listTeamRoles(\n  host: string,\n  accessToken: string,\n  target: { source: string; team: string },\n): Promise<TeamsApiResult<TeamRoles>> {\n  return call(host, accessToken, TeamRolesSchema, {\n    method: 'GET',\n    path: `/api/partner/teams/${encodeURIComponent(target.team)}/roles`,\n    source: target.source,\n  });\n}\n\nfunction membersPath(team: string): string {\n  return `/api/partner/teams/${encodeURIComponent(team)}/members`;\n}\n\nfunction integrationPath(target: { team: string; product: string }): string {\n  return `/api/partner/teams/${encodeURIComponent(target.team)}/integrations/${encodeURIComponent(target.product)}`;\n}\n\n/** One partner teams call; shared by the team-agent clients (`team-agents-api.ts`). */\nexport async function call<T>(\n  host: string,\n  accessToken: string,\n  schema: z.ZodType<T>,\n  init: {\n    method: 'GET' | 'PUT' | 'POST' | 'PATCH' | 'DELETE';\n    path: string;\n    source: string;\n    body?: unknown;\n  },\n): Promise<TeamsApiResult<T>> {\n  const response = await request(\n    `${host}${init.path}${init.path.includes('?') ? '&' : '?'}${new URLSearchParams({ source: init.source })}`,\n    {\n      method: init.method,\n      headers: {\n        accept: 'application/json',\n        authorization: `Bearer ${accessToken}`,\n        ...(init.body === undefined\n          ? {}\n          : { 'content-type': 'application/json' }),\n      },\n      body: init.body === undefined ? undefined : JSON.stringify(init.body),\n    },\n  );\n\n  if (\n    response.status === 401 ||\n    (response.status >= 300 && response.status < 400)\n  ) {\n    return { status: 'unauthorized' };\n  }\n\n  const body = await readOptionalJson(response);\n  const code = typeof body.code === 'string' ? body.code : null;\n  const message =\n    typeof body.error === 'string' && body.error ? body.error : null;\n\n  if (response.status === 403 && code === 'MFA_REQUIRED') {\n    throw authRequiredError(\n      message ?? `${host} requires multi-factor authentication.`,\n      'Complete MFA in the browser, then run \"ekanos login\" again.',\n    );\n  }\n  if (response.status === 403) {\n    throw forbiddenError(\n      message ?? 'Not permitted on this Source.',\n      code === 'SOURCE_ADMIN_REQUIRED'\n        ? \"Only a Source admin manages its teams' integrations. Ask one to run it.\"\n        : 'Run \"ekanos sources\" to list the sources you hold a seat on.',\n    );\n  }\n  if (response.status === 404) {\n    throw notFoundError(\n      message ?? 'Not found.',\n      code === 'TEAM_NOT_FOUND'\n        ? 'Run \"ekanos teams list\" to see the teams on this Source.'\n        : code === 'PRODUCT_NOT_ENTITLED'\n          ? '\"ekanos catalog\" lists what this Source has; Ekanos enables a product for a Source.'\n          : code === 'WEBHOOK_NOT_FOUND' || code === 'CONNECTION_NOT_FOUND'\n            ? 'Run \"ekanos teams show <team> <product>\" to see its team apps and webhooks.'\n            : code === 'MEMBER_NOT_FOUND'\n              ? 'Run \"ekanos teams members list <team>\" to see its members and invitations.'\n              : code?.startsWith('AGENT_') || code === 'TEMPLATE_NOT_FOUND'\n                ? 'Run \"ekanos teams agents list <team>\" to see the team\\'s agents.'\n                : /^(TRIGGER|LINK|MCP)_/.test(code ?? '')\n                  ? 'List them first: \"ekanos teams triggers|links|mcp list <team> ...\"'\n                  : 'Run \"ekanos sources\" to list the sources you hold a seat on.',\n    );\n  }\n  if (response.status === 409 && code === 'NO_TEAM_APP') {\n    throw invalidStateError(\n      message ?? 'This integration takes no team app.',\n      'Teams connect through the Source\\'s app: \"ekanos apps show <product>\".',\n    );\n  }\n  if (response.status === 409 || response.status === 422) {\n    throw invalidStateError(\n      message ?? 'The host refused the change.',\n      code === 'SLUG_TAKEN'\n        ? 'Pick another with --slug, or run \"ekanos teams list\" to see the teams.'\n        : code === 'ALREADY_MEMBER' || code === 'ALREADY_INVITED'\n          ? 'Run \"ekanos teams members list <team>\"; change a role with \"ekanos teams members role <team> <email> <role>\".'\n          : code === 'PRIMARY_OWNER'\n            ? \"The primary owner's ownership is transferred in the app (team Settings → Members).\"\n            : code === 'TEAM_ACCOUNTS_DISABLED'\n              ? 'Ekanos switches team accounts on for a Source; ask a super-admin.'\n              : 'See \"ekanos teams --help\".',\n    );\n  }\n  if (response.status === 400 && code === 'UNKNOWN_ROLE') {\n    throw validationError(\n      message ?? 'No such role.',\n      'Run \"ekanos teams roles list <team>\" for the roles this Source uses.',\n    );\n  }\n  if (response.status === 400 && code === 'INVALID_FIELDS') {\n    throw validationError(\n      message ?? 'The host refused the fields.',\n      'Run \"ekanos teams app set <team> <product>\" again.',\n    );\n  }\n  if (response.status === 400) {\n    throw usageError(\n      message ?? 'The host refused the request.',\n      'See \"ekanos teams --help\".',\n    );\n  }\n  if (!response.ok) {\n    throw networkError(\n      `${host}${init.path} responded ${response.status}.`,\n      response.status >= 500\n        ? 'The Ekanos deployment returned a server error. Retry shortly.'\n        : 'Confirm the host runs a build that includes the teams routes.',\n    );\n  }\n\n  const parsed = schema.safeParse(body.data);\n  if (!parsed.success) {\n    throw networkError(\n      `${host}/api/partner/teams answered in a shape this CLI does not read.`,\n      'Run \"ekanos upgrade\" — the CLI and the host disagree on the teams contract.',\n    );\n  }\n  return { status: 'ok', data: parsed.data };\n}\n\nasync function readOptionalJson(\n  response: Response,\n): Promise<Record<string, unknown>> {\n  try {\n    const parsed: unknown = await response.json();\n    return typeof parsed === 'object' && parsed !== null\n      ? (parsed as Record<string, unknown>)\n      : {};\n  } catch {\n    return {};\n  }\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ekanos/cli",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "private": false,
   "description": "The Ekanos partner toolchain CLI: scaffold, validate, and test an Ekanos integration against the published @ekanos packages. Agent-native — every verb speaks JSON with a stable exit-code taxonomy.",
   "keywords": [
@@ -35,7 +35,7 @@
   },
   "dependencies": {
     "@clack/prompts": "1.7.0",
-    "@ekanos/integration-schema": "0.15.0",
+    "@ekanos/integration-schema": "0.15.1",
     "esbuild": "0.28.1",
     "picocolors": "1.1.1"
   },

package/templates/package.json.tmpl

@@ -12,12 +12,12 @@
     "prepare": "node scripts/setup-hooks.mjs"
   },
   "dependencies": {
-    "@ekanos/sdk": "^0.15.0",
-    "@ekanos/ui": "^0.15.0"
+    "@ekanos/sdk": "^0.15.1",
+    "@ekanos/ui": "^0.15.1"
   },
   "devDependencies": {
-    "@ekanos/cli": "^0.12.0",
-    "@ekanos/harness": "^0.15.0",
+    "@ekanos/cli": "^0.13.0",
+    "@ekanos/harness": "^0.15.1",
     "@hookform/resolvers": "^5.2.2",
     "@tailwindcss/postcss": "^4.3.3",
     "@tanstack/react-query": "^5.101.4",

package/templates/skills/build-agent/SKILL.md

@@ -49,6 +49,15 @@ every `hint`. Look things up in the `ekanos-sdk-docs` MCP server
      `provider-app`) is not set up, so no team can connect. Offer to walk them
      through it now — `references/app-setup.md` — or after the interview. The
      agent can be drafted while it is pending.
+   - **Docs and know-how with no home yet** — when the user asks where the
+     agent's docs, policies or FAQs should live, offer **Knowledge** first:
+     Ekanos's own knowledge base, nothing to sign up for. One collection per
+     team plus the Source's General one; load a folder of markdown with
+     `ekanos knowledge push <dir> [--team <team>]`, check with
+     `ekanos knowledge search "<words>" --team <team>`, and grant the agent
+     `search_knowledge` + `read_knowledge_article` (`references/agent-json.md`
+     → `tools`). Keep skills for how-to-work instructions; Knowledge for the
+     facts the agent looks up.
    - **Missing** — no product does it. Say so plainly. Options: build the
      integration (the `build-integration` skill), use a remote MCP server
      instead if the service offers one (common for docs and knowledge bases:
@@ -109,7 +118,11 @@ in parentheses are the recommendation when the user has no preference.
 7. **What starts it** — see `references/triggers.md`. Declare the triggers in
    the template (an event such as `zendesk.ticket_created` with its filters,
    a schedule, a webhook) so every team gets them, or leave them to each
-   team. Say what each team needs connected first.
+   team. Take event ids from the catalog's `agentEvents`, which lists every
+   event a product declares (Linear also has `linear.issue_labeled`,
+   `linear.issue_created` and `linear.assigned`; Zendesk also has
+   `zendesk.comment_added`) — map an old trigger onto the matching event
+   rather than onto an @mention. Say what each team needs connected first.
 8. **Who it works with** — other agents of this Source it may ask or hand
    work to (`links`). A link only exists in a team that runs both agents.
 9. **What teams may change** — `teamOverrides` per area (approvals,

package/templates/skills/build-agent/references/agent-json.md

@@ -39,7 +39,7 @@ conflicting change unless `--overwrite`. Unknown fields are refused.
       "key": "new-tickets",
       "type": "event",
       "event": "zendesk.ticket_created",
-      "filter": { "tags": ["vip", "urgent"], "brand": "123", "reply_as": "internal_note" }
+      "filter": { "tags": ["vip", "urgent"], "brands": ["Acme Support"] }
     },
     {
       "key": "weekday-digest",
@@ -70,6 +70,13 @@ The tool names above are illustrations. Take real ones from
   - `all`: every tool, reads and changes.
   - `custom`: whole `products` (slugs) plus single `tools` (names).
   A tool it must never call is simply not granted — there is no deny list.
+  **Knowledge** (Ekanos's own knowledge base, `ekanos knowledge`): add
+  `search_knowledge` and `read_knowledge_article` to `tools.tools` for an
+  agent that should look things up — they read the team's collection plus
+  the Source's General collection, and the agent never picks which. A
+  feedback agent that turns reviewer corrections into articles also gets
+  `propose_knowledge_article` (a write: it waits for approval by default).
+  These are named one by one; no mode or product grants them.
   Extra team integrations (`teamCustomization.integrations`) need `custom`.
 - **`policy`** — for each granted tool, `auto` (runs on its own) or
   `approve` (waits for a person in the app). `reads`/`writes` set the
@@ -108,9 +115,14 @@ The tool names above are illustrations. Take real ones from
   an optional `prompt` (what to do each time), and `enabled` (default
   `true`; `false` sets it up turned off). Types:
   - `event` — `event` is an integration event (`<slug>.<event>`, as
-    `ekanos catalog <product>` lists under `agentEvents`); `filter` holds the
-    event's declared filter fields (Zendesk: `organization`, `brand`,
-    `group`, `tags`, `reply_as` …).
+    `ekanos catalog <product> --json` lists under `agentEvents` — every
+    event the product declares, e.g. Zendesk `zendesk.ticket_created` and
+    `zendesk.comment_added`, Linear `linear.mentioned`, `linear.assigned`,
+    `linear.issue_labeled` and `linear.issue_created`); `filter` holds only
+    the keys in that event's `filterFields` (Zendesk: `brands`, `groups`,
+    `tags`, `organizations`, each a list; Linear: `teamKeys`, plus `labels`,
+    which `linear.issue_labeled` requires). Zendesk's `reply_as` is not a
+    filter: it is set in the Zendesk trigger's body (`triggers.md`).
   - `schedule` — `cron` (5 fields, on a 5-minute boundary) and `timezone`
     (IANA, default `UTC`); give it a `prompt`.
   - `webhook` — each team gets its **own** URL and secret, created or
@@ -143,7 +155,9 @@ ekanos agents policy <key> unset zendesk_add_comment
 ekanos agents policy <key> --reads auto --writes approve
 ekanos agents triggers <key>                                  # list
 ekanos agents triggers <key> add event new-tickets --event zendesk.ticket_created \
-  --filter tags=vip,urgent --filter brand=123 --filter reply_as=internal_note
+  --filter tags=vip,urgent --filter brands=Acme,
+ekanos agents triggers <key> add event feedback-label --event linear.issue_labeled \
+  --filter labels=feedback,
 ekanos agents triggers <key> add schedule weekday-digest --cron "0 9 * * 1-5" \
   --timezone America/Los_Angeles --prompt "Summarize yesterday's escalations."
 ekanos agents triggers <key> add webhook inbound --prompt "Triage the posted ticket."
@@ -156,7 +170,9 @@ ekanos agents overrides <key> disable policy
 ```
 
 `--filter field=value` repeats; a value with commas is a list, `true` or
-`false` a switch, anything else text. `--disabled` adds a trigger turned off.
+`false` a switch, anything else text. A list field (`tags`, `brands`,
+`labels`, `teamKeys` …) needs a list even for one item, so end a single
+item with a comma: `--filter labels=feedback,`. `--disabled` adds a trigger turned off.
 
 ## What the host checks on `apply`
 

package/templates/skills/build-agent/references/app-setup.md

@@ -47,7 +47,8 @@ working from those rather than from Ekanos.
   npx @ekanos/cli apps set <product> --source <slug>
   ```
 
-  It asks for the client ID, then the secret with hidden input. For a team's
+  It asks for the client ID, then the secret with hidden input; Enter keeps
+  a saved value, so either can be changed on its own. For a team's
   app, they enter the fields in the team's setup panel in the Ekanos app.
 - Then check: `apps show <product> --source <slug> --json` should say
   `configured: true`, and the catalog's step should be `done`. Tell them

package/templates/skills/build-agent/references/set-up-an-integration.md

@@ -62,11 +62,16 @@ connect nothing for it.
   `ekanos teams app set`, with hidden input) or in the team's page in the app.
   If they paste one into the chat anyway, tell them to rotate it in the
   provider's console and enter the new one at the terminal.
-- **Signing in is a person's click.** Connecting (the provider's consent
-  screen) happens in the browser, by someone on the team, from the link in
-  `teams show` (or just the link and whether it is connected yet:
-  `teams connect <team> <product>`). Tell them who should click it: the account the integration
-  acts as. A dedicated seat such as "Support agent" makes its replies easy
+- **Connect with `teams connect <team> <product>`, run by the user in their
+  own terminal.** It does whatever the integration needs: asks a form's fields
+  (secrets hidden), runs the team-app prompts first when the team's own app is
+  missing, or opens a one-time sign-in link and waits until the team is
+  connected. The provider's consent is still a person's click, by a member of
+  the team (owner/admin for a team-wide connection): the user when they are
+  one, else `--as <email>` prints a link to send that member. `--link-only`
+  prints just the team's page. Tell them who should sign in: the account the
+  integration acts as. If the product is not enabled for the Source, a
+  super-admin enables it (`sources products` shows what the Source has). A dedicated seat such as "Support agent" makes its replies easy
   to recognise.
 - **Close each product out**: one line on what now works ("New tickets in
   Acme's Zendesk will start the support agent"), then move on to the next
@@ -82,8 +87,13 @@ pilot), the team-side steps can be done from the CLI:
 2. They create the app in the provider's console, step by step as above.
 3. **In their own terminal:**
    `npx @ekanos/cli teams app set <team> <product> --source <slug>`. It asks
-   for each field and hides the secret ones. It refuses to run inside Claude;
-   that is deliberate.
+   for each field and hides the secret ones; Enter keeps a saved value. It
+   refuses to run inside Claude; that is deliberate. To change one value
+   later, they need not re-enter the rest:
+   `teams app set <team> <product> --field <name>` asks for just that field
+   (names are in brackets in `teams show`), `--set <name>=<value>` sets a
+   non-secret field (a subdomain, a client ID) without a prompt — you may run
+   that one yourself — and `--clear <name>` removes a value.
 4. If the integration takes webhooks:
    `npx @ekanos/cli teams webhook <team> <product> --source <slug>` prints the
    team's webhook URL **once**. Have them paste it into the provider at that
@@ -159,7 +169,8 @@ from `teams show zendesk`.
    secret.
 3. **Credentials into Ekanos.** `ekanos teams app set <team> zendesk` in
    their terminal: subdomain, client ID, client secret, webhook signing
-   secret.
+   secret. Any of them can be entered or changed later on its own
+   (`--field <name>`); `teams show` says which are saved.
 4. **Connect.** Someone on the team opens the link and connects, as the
    Zendesk agent the integration should reply as.
 5. **Zendesk triggers.** Objects and rules › Triggers: one for *Ticket is

package/templates/skills/build-agent/references/triggers.md

@@ -20,7 +20,14 @@ A Source admin can add them for the team from the terminal instead:
 `ekanos teams triggers add acme-support support-agent event zendesk.ticket_created --filter '{"tags":["billing"]}'`,
 `… schedule --cron "0 9 * * 1-5" --timezone America/Los_Angeles --prompt "…"`,
 `… webhook --prompt "…"` (prints the URL and token once) or `… manual`.
-Slack and Linear triggers are added in the app. When a provided agent's
+Any event in a connected integration's `agentEvents` is added this way,
+including every Linear integration event (`event linear.issue_labeled
+--filter '{"labels":["feedback"]}'`). Only two trigger *types* are app-only:
+a **Slack** trigger, and a **Linear (Agents app)** trigger — Ekanos's own
+Linear app, which answers @mentions and assignments only. That app is not
+the Linear integration, and its limits are not the integration's: an agent
+that should start when a label is applied uses `linear.issue_labeled`, not an
+@mention. When a provided agent's
 template declares triggers and has not turned on team overrides for them, the
 team's triggers follow the template and these commands refuse to change them.
 
@@ -39,23 +46,45 @@ team's triggers follow the template and these commands refuse to change them.
 
 ## Integrations with agent events
 
-Check `ekanos catalog <product> --source <slug> --json` for what is actually
-there; these are the known shapes.
+`ekanos catalog <product> --source <slug> --json` is the authority: its
+`agentEvents` lists **every** event the product declares, with each one's
+filter keys (`filterFields`). The lists below are the known shapes; never
+conclude a product lacks an event because an example here or elsewhere
+names only one. A refused event id is answered with the ids the product
+does declare, and a refused filter with the keys the event takes.
 
-**Linear** (`linear.mentioned`, `linear.assigned`, `linear.issue_labeled`) —
-the agent becomes a teammate in Linear: @mention it, assign it an issue, or
-apply a label. Each team needs two things in the app: each person's own
-Linear connection (for the tools), and the team's own Linear app for the
-agent (client id, secret and webhook signing secret, entered in Ekanos).
+An event can be declared and still never fire for a team until the team
+finishes that event's own setup on the provider's side. That is a setup
+step, not a missing event — say which step, as below.
+
+**Linear** — the agent becomes a teammate in Linear. Each team needs two
+things in the app: each person's own Linear connection (for the tools), and
+the team's own Linear app for the agent (client id, secret and webhook
+signing secret, entered in Ekanos).
 Guide: https://sdk.ekanos.dev/guides/linear-agent
 
-**Zendesk** (`zendesk.ticket_created`, `zendesk.comment_added`; filters such
-as brand, group, tags, organization) — when present in the catalog, each team
-connects its own Zendesk (subdomain plus an OAuth client it creates in
-Zendesk) and adds a Zendesk webhook pointing at its Ekanos endpoint
-(walk-through: `set-up-an-integration.md`, worked example). The agent
-answers on the ticket as a public reply or an internal note — recommend
-internal notes, or approval on public replies, until the team trusts it.
+| Event | Starts when | Filter keys | Needs on the team's Linear app |
+|---|---|---|---|
+| `linear.mentioned` | someone @mentions the agent, or writes to it again in that conversation | `teamKeys` | webhook with **Agent session events** ticked |
+| `linear.assigned` | someone assigns (delegates) an issue to the agent | `teamKeys` | webhook with **Agent session events** ticked |
+| `linear.issue_labeled` | someone applies one of the given labels to an issue | `labels` (**required**), `teamKeys` | webhook with **Issues** ticked |
+| `linear.issue_created` | someone creates an issue (optionally only with given labels) | `labels`, `teamKeys` | webhook with **Issues** ticked |
+
+**Zendesk** — each team connects its own Zendesk (subdomain plus an OAuth
+client it creates in Zendesk) and adds a Zendesk webhook pointing at its
+Ekanos endpoint (walk-through: `set-up-an-integration.md`, worked example).
+The agent answers on the ticket as a public reply or an internal note —
+recommend internal notes, or approval on public replies, until the team
+trusts it.
+
+| Event | Starts when | Filter keys | Needs in Zendesk |
+|---|---|---|---|
+| `zendesk.ticket_created` | a new ticket arrives | `brands`, `groups`, `tags`, `organizations` | a Zendesk trigger on *Ticket is Created* notifying the webhook |
+| `zendesk.comment_added` | an end user (requester or CC) comments on a ticket; agent and admin comments never start it | `brands`, `groups`, `tags`, `organizations` | a **second** Zendesk trigger, on a customer's public reply, notifying the webhook |
+
+Filter values are lists (`{"tags":["billing"],"brands":["Acme Support"]}`);
+brands, groups and organizations match by name or id. Where the answer goes
+(`reply_as`) is set in the Zendesk trigger's body, not in the filter.
 
 ## Checklist to hand each team
 

package/templates/skills/ekanos-platform/SKILL.md

@@ -53,7 +53,9 @@ npx @ekanos/cli teams members invite bank-a raj@bank-a.com --role admin   # defa
 npx @ekanos/cli teams members list bank-a                     # members and pending invitations
 npx @ekanos/cli teams members role bank-a raj@bank-a.com member
 npx @ekanos/cli teams members remove bank-a raj@bank-a.com --yes
-npx @ekanos/cli teams connect bank-a zendesk                  # the link a member opens to connect
+npx @ekanos/cli teams connect bank-a zendesk                  # connect it for the team (asks, signs in, waits)
+npx @ekanos/cli teams connect bank-a linear --as raj@bank-a.com   # a sign-in link for raj
+npx @ekanos/cli sources products                             # what the Source has enabled (super-admin enables)
 ```
 
 - `create` without `--owner` seats the person running it as the team's
@@ -66,9 +68,18 @@ npx @ekanos/cli teams connect bank-a zendesk                  # the link a membe
   customized ones). Pick a reviewer for agents by the role holding
   `agents.review` in `teams roles list`. The primary owner's role cannot be
   changed here; ownership moves in the app.
-- Connecting an integration is always a team member signing in in their
-  browser. `teams connect` prints the link to send them and whether the team
-  is connected yet; `teams show <team> <product>` has the full checklist.
+- `teams connect <team> <product>` does the connect: it asks a form's fields
+  at the user's terminal (hidden for secrets — so the user runs it, never you
+  with values), runs the team-app prompts first when needed (Zendesk), or
+  opens a one-time sign-in link and waits. The person who signs in is a team
+  member (owner/admin for a team-wide connection): the user when they are
+  one, else `--as <email>` prints a link to send that member. `--no-wait`,
+  `--no-open`, `--link-only` (just the team's page). `teams show <team>
+  <product>` has the full checklist.
+- A product the Source does not have is refused; `sources products` lists
+  what it has. Enabling one is a super-admin grant (`sources products enable`)
+  that an `ekanos login` session cannot make — the super-admin does it in
+  /admin.
 
 ## Products: integrations and experiences
 
@@ -77,7 +88,11 @@ Everything in the catalog (`npx @ekanos/cli catalog --source <slug> --json`) is
 
 - **Integration** — a connection to a third party (Linear, Zendesk, Slack…).
   Brings tools an agent can call, and may declare **agent events** that start
-  agents (`linear.mentioned`, `zendesk.ticket_created`…).
+  agents — Linear declares `linear.mentioned`, `linear.assigned`,
+  `linear.issue_labeled` and `linear.issue_created`; Zendesk declares
+  `zendesk.ticket_created` and `zendesk.comment_added`. The catalog's
+  `agentEvents` is the authority: read it before concluding a product lacks
+  an event, never infer the set from an example.
 - **Experience** — an Ekanos-native capability (Agents, Workflows, Home…).
   Never "connected"; it is simply on or off for the Source.
 
@@ -144,6 +159,14 @@ Skills are folders (`SKILL.md` + references) an agent loads when needed.
 A Source admin pushes them with `ekanos skills push <dir>`: at Source level
 every team can use them, with `--team <slug>` only that team can.
 
+**Knowledge** is Ekanos's own knowledge base (no outside account): markdown
+articles, one collection per team plus the Source's **General** collection
+every team reads. A Source admin loads folders of `.md` with
+`ekanos knowledge push <dir> [--team <slug>]`; team members edit theirs in
+the app (Agents → Knowledge). Agents granted `search_knowledge` /
+`read_knowledge_article` search their own team's collection and General.
+Skills say *how* to work; Knowledge holds the facts an agent looks up.
+
 The `build-agent` skill walks through choosing between these and building one.
 
 A Source admin can also do a team's agent setup from the terminal, acting on
@@ -165,7 +188,9 @@ always `ekanos teams <area> <verb> <team> …`:
   follows its template unless the template turns on team overrides for it.
 - `ekanos teams triggers list|add|remove <team> <key> …` — manual, schedule
   (`--cron`, `--timezone`), webhook (URL and token shown once) and
-  integration events (`event zendesk.ticket_created --filter '{…}'`).
+  integration events (`event zendesk.ticket_created --filter '{…}'`, or any
+  other id in the product's `agentEvents`, e.g. `event linear.issue_labeled
+  --filter '{"labels":["feedback"]}'`).
 - `ekanos teams links list|add|remove <team> <from-key> [<to-key>] --kind
   talk|delegate [--mode await|handoff]`.
 - `ekanos teams mcp list|add|status|token|effect <team> [<server-key> …]` — a
@@ -215,6 +240,7 @@ is refused (`USER_NOT_IN_SOURCE`): `ekanos teams list` shows the teams.
 | Running a team's agent, reading its runs (transcript, tool calls) | A team's agent manager in the app, or a Source admin with `ekanos runs` |
 | Deciding what an agent run waits on (approve, reject, edit & send a reply) | A team's agent manager in the app, or a Source admin with `ekanos approvals` |
 | Skills (SKILL.md folders) for every team, or one team's own | A Source admin, with `ekanos skills push` (`--team <slug>` for one team) |
+| Knowledge articles for every team (General), or one team's own | A Source admin, with `ekanos knowledge push` (`--team <slug>` for one team); a team's members in the app |
 | Who decides agent drafts that wait for a person | A Source admin, with `ekanos reviewers` |
 | An integration's app for the whole Source (client ID and secret) | A Source admin, with `ekanos apps set` at their own terminal |
 | One connection for the whole Source, used by provided agents in every team | A Source admin, with `ekanos apps connect` (status: `ekanos apps show`), or **Shared integrations › Connections** in the Source admin area |