@ekanos/cli 0.12.0 → 0.14.0

package/README.md

@@ -28,7 +28,7 @@ npx @ekanos/cli dev
 | `status`   | The read verb: login state for the resolved host, this project's `ekanos.json`, and its submissions on the host (`GET /api/partner/submissions`). Never fails just because you are logged out — it reports `authenticated: false` instead.                                                                                                                    |
 | `sources`  | List every Ekanos source you hold a developer or source-admin seat on (`GET /api/partner/sources`), with a marker on this project's current publish target.                                                                                                                                                                                                   |
 | `catalog`  | `ekanos catalog [<product-slug>]` — what a source can already use (`GET /api/partner/catalog`): every product enabled, switched off or available to enable, with its tools, agent triggers and generated setup steps. Check it before building something the source may already have.                                                               |
-| `agents`   | `ekanos agents init | list | show | pull | apply | publish | rollback` — the source's agents, held by Ekanos (`/api/partner/agents`). `init` sets up a folder for designing agents with Claude (the `build-agent` and `ekanos-platform` skills, the docs MCP server, a CLAUDE.md) without scaffolding an integration. `apply` stores a new version as a draft, `publish` makes a version the one every team runs, `rollback` publishes an earlier one. Either seat applies; only the source admin publishes.
+| `agents`   | `ekanos agents init | list | show | pull | apply | publish | rollback | archive | unarchive` — the source's agents, held by Ekanos (`/api/partner/agents`). `init` sets up a folder for designing agents with Claude (the `build-agent` and `ekanos-platform` skills, the docs MCP server, a CLAUDE.md) without scaffolding an integration. `apply` stores a new version as a draft, `publish` makes a version the one every team runs, `rollback` publishes an earlier one, `archive` retires one no team has on. Either seat applies; only the source admin publishes or archives.
 | `reviewers` | `ekanos reviewers list \| add <email> --reach source\|team [--team <slug>] \| remove <email> [--team <slug>]` — a Source admin names who decides agent reply drafts held under an `approve` policy (`/api/partner/reviewers`). A `source`-reach reviewer decides every team's drafts; a `team`-reach reviewer one team's. The reviewer must be a member of one of the Source's teams. |
 | `use`      | `ekanos use <source-slug>` — set this project's publish target to a source you hold a seat on. Refuses (`forbidden`, with your actual seats in the hint) for a slug you don't hold a seat on, so a typo can't silently repoint a project.                                                                                                                     |
 | `publish`  | Validate, pack and submit the integration to an Ekanos host — refusing (`forbidden`) a target you hold no seat on, and confirming an ambiguous multi-seat target before submitting. See [Publish target verification](#publish-target-verification).                                                                                                           |
@@ -40,14 +40,15 @@ npx @ekanos/cli dev
 npm i -g @ekanos/cli   # convenient — the `ekanos` binary is always on PATH
 ```
 
-Inside a project, `validate`/`dev`/`publish`/`test` automatically delegate to
+Inside a project, `validate`/`dev`/`test` automatically delegate to
 **that project's own** pinned `@ekanos/cli` devDependency whenever it differs
 from the globally invoked binary — the same wrapper pattern as Gradle's
 `./gradlew` or `npx`. A partner with several integrations on different
 `@ekanos/sdk` versions gets the right toolchain per project without juggling
 installs by hand. Machine-level verbs (`init`, `login`, `logout`, `whoami`,
-`sources`, `use`, `status`, `upgrade`) never delegate — they always run on the
-binary you invoked. Set `EKANOS_NO_DELEGATE=1` to opt out for one invocation.
+`sources`, `use`, `status`, `upgrade`) and `publish`, which sends your session
+token to the host, never delegate — they always run on the binary you invoked.
+Set `EKANOS_NO_DELEGATE=1` to opt out for one invocation.
 
 ## Global flags
 
@@ -56,7 +57,7 @@ binary you invoked. Set `EKANOS_NO_DELEGATE=1` to opt out for one invocation.
 | `--json`    | Force the JSON envelope on, even at a terminal.                  |
 | `--no-json` | Force the human-readable form on, even when piped.               |
 | `--version` | Print the CLI version and exit 0. Works with or without a verb.  |
-| `--help`    | Print usage. Also available per-verb (`ekanos validate --help`). |
+| `--help`    | Print usage. Per command (`ekanos teams --help`) it prints that command's subcommands and every flag with what it does; with `--json`, as `usage`, `details` and `options`. |
 
 Short flags are not supported — the parser rejects them rather than guessing.
 
@@ -437,7 +438,22 @@ that _creates_ credentials, and `ekanos.json` is a committed file; if login
 honored it, anyone could point your device flow at their own tenant just by
 editing a file in a repo you clone. Every other verb is safe reading it,
 because their bearer tokens are looked up per-host from the credential store —
-an unfamiliar host in `ekanos.json` simply has no session to present.
+an unfamiliar host in `ekanos.json` simply has no session to present. Nor will
+the CLI suggest one: a "not logged in" hint names `ekanos login --host <url>`
+only for a host you have logged in to or an Ekanos domain. For any other host
+it says where the host came from and asks you to check it before logging in
+yourself, because a coding agent follows hints.
+
+A host you have never logged in to is **new** unless it is loopback or under
+Ekanos's own domains (`vastlyfusion.site` and its subdomains); a Source's
+custom domain is new the first time. `login` to a new host shows the host and
+the Auth0 domain it signs in through and asks before the browser step. With
+nobody to ask (JSON mode, an agent, no TTY) it exits 7 unless you pass
+`--trust-host`. The sign-in domain must be `*.auth0.com`.
+
+A remote `http://` host is refused (exit 9) by `login` and every verb that
+sends credentials; `localhost`, `127.0.0.1`, `[::1]` and `*.localhost` stay
+allowed. `logout` still removes a session stored for one, with a warning.
 
 So the common single-deployment flow is: `ekanos login --host <url>` once, then
 every later verb with no flag at all. The first successful `ekanos publish`
@@ -476,8 +492,9 @@ envelope, not at any log level.
 - `login` with a session that still works reports `already-authenticated` and
   never opens a browser. `--force` starts a fresh login regardless.
 - `logout` twice succeeds; the second run reports `cleared: false`.
-- `logout` revokes at Auth0 first, but a failed revocation never stops the local
-  delete — it is reported as `revoked: false` with a warning on stderr.
+- `logout` ends the server-side session (`sessionRevoked`) and revokes at Auth0
+  (`revoked`) first, but a failed revocation never stops the local delete — it
+  is reported as `false` with a warning on stderr.
 
 ### Rotation safety
 

package/dist/agents-api.d.ts

@@ -1,4 +1,4 @@
-import { type AgentTemplateApplyRequest, type AgentTemplateList, type AgentTemplateResult, type AgentTemplateShow } from '@ekanos/integration-schema';
+import { type AgentTemplateApplyRequest, type AgentTemplateArchiveResult, type AgentTemplateList, type AgentTemplateResult, type AgentTemplateShow } from '@ekanos/integration-schema';
 /**
  * The CLI's client for Source agent templates (plan 239.0 / 239.2).
  *
@@ -9,14 +9,17 @@ import { type AgentTemplateApplyRequest, type AgentTemplateList, type AgentTempl
  *   GET  /api/partner/agents?source=<slug|id>          → { ok, data: AgentTemplateList }
  *   GET  /api/partner/agents/<key>?source=<slug|id>    → { ok, data: AgentTemplateShow }
  *   POST /api/partner/agents            AgentTemplateApplyRequest   → { ok, data: AgentTemplateResult }
- *   POST /api/partner/agents/<key>/publish   { source, version? }   → { ok, data: AgentTemplateResult }
+ *   POST /api/partner/agents/<key>/publish   { source, version?, confirmAccess? }   → { ok, data: AgentTemplateResult }
  *   POST /api/partner/agents/<key>/rollback  { source, version }    → { ok, data: AgentTemplateResult }
+ *   POST /api/partner/agents/<key>/archive | unarchive  { source }  → { ok, data: AgentTemplateArchiveResult }
  *
  *   → 401 / 3xx                        refresh once and retry
  *   → 400 { code: "INVALID_AGENT", issues: AgentTemplateIssue[] }
  *   → 403 { code: "MFA_REQUIRED" | "FORBIDDEN" | "SOURCE_ADMIN_REQUIRED" }
  *   → 404 { code: "SOURCE_NOT_FOUND" | "TEMPLATE_NOT_FOUND" | "VERSION_NOT_FOUND" }
  *   → 409 { code: "VERSION_CONFLICT", latestVersion }
+ *   → 409 { code: "TEMPLATE_ARCHIVED" }            apply, publish, rollback
+ *   → 409 { code: "TEMPLATE_IN_USE", teams }       archive: a team has it on
  * ---------------------------------------------------------------------------
  */
 export type AgentsApiResult<T> = {
@@ -32,4 +35,10 @@ export declare function publishAgentTemplate(host: string, accessToken: string,
     source: string;
     key: string;
     version?: number;
+    /** Sent only when set: an older host refuses it rather than ignoring it. */
+    confirmAccess?: boolean;
 }): Promise<AgentsApiResult<AgentTemplateResult>>;
+export declare function archiveAgentTemplate(host: string, accessToken: string, action: 'archive' | 'unarchive', params: {
+    source: string;
+    key: string;
+}): Promise<AgentsApiResult<AgentTemplateArchiveResult>>;

package/dist/agents-api.js

@@ -1,4 +1,4 @@
-import { AgentTemplateIssueSchema, AgentTemplateListSchema, AgentTemplateResultSchema, AgentTemplateShowSchema, } from '@ekanos/integration-schema';
+import { AgentTemplateArchiveResultSchema, AgentTemplateIssueSchema, AgentTemplateListSchema, AgentTemplateResultSchema, AgentTemplateShowSchema, AgentTemplateTeamInUseSchema, } from '@ekanos/integration-schema';
 import { request } from './auth/ekanos-api.js';
 import { authRequiredError, forbiddenError, invalidStateError, networkError, notFoundError, usageError, validationError, } from './errors.js';
 const ROUTE = '/api/partner/agents';
@@ -28,10 +28,19 @@ export function publishAgentTemplate(host, accessToken, action, params) {
     return call(host, accessToken, AgentTemplateResultSchema, {
         method: 'POST',
         path: `${ROUTE}/${encodeURIComponent(params.key)}/${action}`,
-        body: { source: params.source, version: params.version },
+        body: Object.assign({ source: params.source, version: params.version }, (params.confirmAccess ? { confirmAccess: true } : {})),
         subject: params.key,
     });
 }
+export function archiveAgentTemplate(host, accessToken, action, params) {
+    return call(host, accessToken, AgentTemplateArchiveResultSchema, {
+        method: 'POST',
+        path: `${ROUTE}/${encodeURIComponent(params.key)}/${action}`,
+        body: { source: params.source },
+        subject: params.key,
+        source: params.source,
+    });
+}
 async function call(host, accessToken, schema, init) {
     const response = await request(`${host}${init.path}`, {
         method: init.method,
@@ -62,7 +71,7 @@ async function call(host, accessToken, schema, init) {
     }
     if (response.status === 403) {
         throw forbiddenError(message !== null && message !== void 0 ? message : 'Not permitted on this Source.', code === 'SOURCE_ADMIN_REQUIRED'
-            ? `Only a Source admin publishes. Ask one to run it, or apply as a draft.`
+            ? `Ask a Source admin to run it. A developer seat applies drafts; a Source admin publishes, rolls back and archives.`
             : `Run "ekanos sources" to list the sources you hold a seat on.`);
     }
     if (response.status === 404) {
@@ -76,6 +85,25 @@ async function call(host, accessToken, schema, init) {
             (latest ? ` (now version ${latest}).` : '.'), `Run "ekanos agents show ${init.subject}" to see the latest, then apply ` +
             `again — or pass --overwrite to replace it.`);
     }
+    if (response.status === 409 && code === 'TEMPLATE_ARCHIVED') {
+        throw invalidStateError(message !== null && message !== void 0 ? message : `"${init.subject}" is archived.`, `Run "ekanos agents unarchive ${init.subject}" first.`);
+    }
+    if (response.status === 409 && code === 'TEMPLATE_IN_USE') {
+        const teams = readTeamsInUse(body.teams);
+        const source = init.source ? ` --source ${init.source}` : '';
+        throw invalidStateError([
+            message !== null && message !== void 0 ? message : `"${init.subject}" is turned on for a team.`,
+            ...teams.map((team) => `  ${team.team}: ${team.agent} on v${team.version}` +
+                (team.draft
+                    ? ' (testing the draft)'
+                    : team.pinned
+                        ? ' (pinned)'
+                        : '')),
+        ].join('\n'), [
+            'Turn it off on each team, then archive again:',
+            ...teams.map((team) => `  ekanos teams agents disable ${team.team} ${team.agent}${source} --yes`),
+        ].join('\n'));
+    }
     if (!response.ok) {
         throw networkError(`${host}${init.path.split('?')[0]} responded ${response.status}.`, response.status >= 500
             ? `The Ekanos deployment returned a server error. Retry shortly.`
@@ -87,6 +115,14 @@ async function call(host, accessToken, schema, init) {
     }
     return { status: 'ok', data: parsed.data };
 }
+function readTeamsInUse(value) {
+    if (!Array.isArray(value))
+        return [];
+    return value.flatMap((team) => {
+        const parsed = AgentTemplateTeamInUseSchema.safeParse(team);
+        return parsed.success ? [parsed.data] : [];
+    });
+}
 function readIssues(value) {
     if (!Array.isArray(value))
         return [];

package/dist/agents-api.js.map

@@ -1 +1 @@
-{"version":3,"file":"agents-api.js","sourceRoot":"","sources":["../src/agents-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,wBAAwB,EAExB,uBAAuB,EAEvB,yBAAyB,EAEzB,uBAAuB,GACxB,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACb,UAAU,EACV,eAAe,GAChB,MAAM,UAAU,CAAC;AA2BlB,MAAM,KAAK,GAAG,qBAAqB,CAAC;AAEpC,MAAM,UAAU,kBAAkB,CAChC,IAAY,EACZ,WAAmB,EACnB,MAAc;IAEd,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,uBAAuB,EAAE;QACtD,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,GAAG,KAAK,IAAI,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE;QACnD,OAAO,EAAE,MAAM;KAChB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,WAAmB,EACnB,MAAc,EACd,GAAW;IAEX,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,uBAAuB,EAAE;QACtD,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,GAAG,KAAK,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE;QAC9E,OAAO,EAAE,GAAG;KACb,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,IAAY,EACZ,WAAmB,EACnB,IAA+B;IAE/B,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,yBAAyB,EAAE;QACxD,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,KAAK;QACX,IAAI;QACJ,OAAO,EAAE,IAAI,CAAC,GAAG;KAClB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,IAAY,EACZ,WAAmB,EACnB,MAA8B,EAC9B,MAAyD;IAEzD,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,yBAAyB,EAAE;QACxD,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,GAAG,KAAK,IAAI,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,EAAE;QAC5D,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;QACxD,OAAO,EAAE,MAAM,CAAC,GAAG;KACpB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,IAAI,CACjB,IAAY,EACZ,WAAmB,EACnB,MAAoB,EACpB,IAMC;IAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE;QACpD,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,kBACL,MAAM,EAAE,kBAAkB,EAC1B,aAAa,EAAE,UAAU,WAAW,EAAE,IACnC,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;YACzB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAC5C;QACD,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;KACtE,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACpC,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAEhC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;QACxD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,eAAe,CACnB;YACE,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,6BAA6B;YACxC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;SAC9D,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,qEAAqE;YACnE,4BAA4B,CAC/B,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,UAAU,CACd,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,+BAA+B,EAC1C,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QACvD,MAAM,iBAAiB,CACrB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,GAAG,IAAI,wCAAwC,EAC1D,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,cAAc,CAClB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,+BAA+B,EAC1C,IAAI,KAAK,uBAAuB;YAC9B,CAAC,CAAC,wEAAwE;YAC1E,CAAC,CAAC,8DAA8D,CACnE,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,aAAa,CACjB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,IAAI,IAAI,CAAC,OAAO,kBAAkB,EAC7C,IAAI,KAAK,kBAAkB;YACzB,CAAC,CAAC,8DAA8D;YAChE,CAAC,CAAC,oEAAoE,CACzE,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAC3D,MAAM,MAAM,GACV,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;QACrE,MAAM,iBAAiB,CACrB,OAAO,aAAP,OAAO,cAAP,OAAO,GACL,IAAI,IAAI,CAAC,OAAO,6BAA6B;YAC3C,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB,MAAM,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAChD,2BAA2B,IAAI,CAAC,OAAO,kCAAkC;YACvE,4CAA4C,CAC/C,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,YAAY,CAChB,GAAG,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,QAAQ,CAAC,MAAM,GAAG,EACjE,QAAQ,CAAC,MAAM,IAAI,GAAG;YACpB,CAAC,CAAC,+DAA+D;YACjE,CAAC,CAAC,gEAAgE,CACrE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,YAAY,CAChB,GAAG,IAAI,GAAG,KAAK,8CAA8C,EAC7D,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACzD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,QAAkB;IAElB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC9C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAClD,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;eAAO,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC;AACvC,CAAC;AAED,SAAS,GAAG,CAAC,KAAc;IACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC","sourcesContent":["import {\n  type AgentTemplateApplyRequest,\n  type AgentTemplateIssue,\n  AgentTemplateIssueSchema,\n  type AgentTemplateList,\n  AgentTemplateListSchema,\n  type AgentTemplateResult,\n  AgentTemplateResultSchema,\n  type AgentTemplateShow,\n  AgentTemplateShowSchema,\n} from '@ekanos/integration-schema';\nimport type { z } from 'zod';\n\nimport { request } from './auth/ekanos-api';\nimport {\n  authRequiredError,\n  forbiddenError,\n  invalidStateError,\n  networkError,\n  notFoundError,\n  usageError,\n  validationError,\n} from './errors';\n\n/**\n * The CLI's client for Source agent templates (plan 239.0 / 239.2).\n *\n * ---------------------------------------------------------------------------\n * WIRE CONTRACT — the `AgentTemplate*` schemas in `@ekanos/integration-schema`,\n * which the host's `/api/partner/agents` routes build and this parses.\n *\n *   GET  /api/partner/agents?source=<slug|id>          → { ok, data: AgentTemplateList }\n *   GET  /api/partner/agents/<key>?source=<slug|id>    → { ok, data: AgentTemplateShow }\n *   POST /api/partner/agents            AgentTemplateApplyRequest   → { ok, data: AgentTemplateResult }\n *   POST /api/partner/agents/<key>/publish   { source, version? }   → { ok, data: AgentTemplateResult }\n *   POST /api/partner/agents/<key>/rollback  { source, version }    → { ok, data: AgentTemplateResult }\n *\n *   → 401 / 3xx                        refresh once and retry\n *   → 400 { code: \"INVALID_AGENT\", issues: AgentTemplateIssue[] }\n *   → 403 { code: \"MFA_REQUIRED\" | \"FORBIDDEN\" | \"SOURCE_ADMIN_REQUIRED\" }\n *   → 404 { code: \"SOURCE_NOT_FOUND\" | \"TEMPLATE_NOT_FOUND\" | \"VERSION_NOT_FOUND\" }\n *   → 409 { code: \"VERSION_CONFLICT\", latestVersion }\n * ---------------------------------------------------------------------------\n */\n\nexport type AgentsApiResult<T> =\n  | { status: 'ok'; data: T }\n  | { status: 'unauthorized' };\n\nconst ROUTE = '/api/partner/agents';\n\nexport function listAgentTemplates(\n  host: string,\n  accessToken: string,\n  source: string,\n): Promise<AgentsApiResult<AgentTemplateList>> {\n  return call(host, accessToken, AgentTemplateListSchema, {\n    method: 'GET',\n    path: `${ROUTE}?${new URLSearchParams({ source })}`,\n    subject: source,\n  });\n}\n\nexport function showAgentTemplate(\n  host: string,\n  accessToken: string,\n  source: string,\n  key: string,\n): Promise<AgentsApiResult<AgentTemplateShow>> {\n  return call(host, accessToken, AgentTemplateShowSchema, {\n    method: 'GET',\n    path: `${ROUTE}/${encodeURIComponent(key)}?${new URLSearchParams({ source })}`,\n    subject: key,\n  });\n}\n\nexport function applyAgentTemplate(\n  host: string,\n  accessToken: string,\n  body: AgentTemplateApplyRequest,\n): Promise<AgentsApiResult<AgentTemplateResult>> {\n  return call(host, accessToken, AgentTemplateResultSchema, {\n    method: 'POST',\n    path: ROUTE,\n    body,\n    subject: body.key,\n  });\n}\n\nexport function publishAgentTemplate(\n  host: string,\n  accessToken: string,\n  action: 'publish' | 'rollback',\n  params: { source: string; key: string; version?: number },\n): Promise<AgentsApiResult<AgentTemplateResult>> {\n  return call(host, accessToken, AgentTemplateResultSchema, {\n    method: 'POST',\n    path: `${ROUTE}/${encodeURIComponent(params.key)}/${action}`,\n    body: { source: params.source, version: params.version },\n    subject: params.key,\n  });\n}\n\nasync function call<T>(\n  host: string,\n  accessToken: string,\n  schema: z.ZodType<T>,\n  init: {\n    method: 'GET' | 'POST';\n    path: string;\n    body?: unknown;\n    /** What a 404 is about, for the message. */\n    subject: string;\n  },\n): Promise<AgentsApiResult<T>> {\n  const response = await request(`${host}${init.path}`, {\n    method: init.method,\n    headers: {\n      accept: 'application/json',\n      authorization: `Bearer ${accessToken}`,\n      ...(init.body === undefined\n        ? {}\n        : { 'content-type': 'application/json' }),\n    },\n    body: init.body === undefined ? undefined : JSON.stringify(init.body),\n  });\n\n  if (response.status === 401 || isRedirect(response.status)) {\n    return { status: 'unauthorized' };\n  }\n\n  const body = await readOptionalJson(response);\n  const code = str(body.code);\n  const message = str(body.error);\n\n  if (response.status === 400 && code === 'INVALID_AGENT') {\n    const issues = readIssues(body.issues);\n    throw validationError(\n      [\n        message ?? 'The host refused the agent.',\n        ...issues.map((issue) => `  ${issue.path}: ${issue.message}`),\n      ].join('\\n'),\n      `Fix the agent and apply again. \"ekanos catalog\" lists the products ` +\n        `and tools this Source has.`,\n    );\n  }\n\n  if (response.status === 400) {\n    throw usageError(\n      message ?? 'The host refused the request.',\n      'See \"ekanos agents --help\" for each subcommand\\'s arguments.',\n    );\n  }\n\n  if (response.status === 403 && code === 'MFA_REQUIRED') {\n    throw authRequiredError(\n      message ?? `${host} requires multi-factor authentication.`,\n      `Complete MFA in the browser, then run \"ekanos login\" again.`,\n    );\n  }\n\n  if (response.status === 403) {\n    throw forbiddenError(\n      message ?? 'Not permitted on this Source.',\n      code === 'SOURCE_ADMIN_REQUIRED'\n        ? `Only a Source admin publishes. Ask one to run it, or apply as a draft.`\n        : `Run \"ekanos sources\" to list the sources you hold a seat on.`,\n    );\n  }\n\n  if (response.status === 404) {\n    throw notFoundError(\n      message ?? `\"${init.subject}\" was not found.`,\n      code === 'SOURCE_NOT_FOUND'\n        ? `Run \"ekanos sources\" to list the sources you hold a seat on.`\n        : `Run \"ekanos agents list\" to see this Source's agents and versions.`,\n    );\n  }\n\n  if (response.status === 409 && code === 'VERSION_CONFLICT') {\n    const latest =\n      typeof body.latestVersion === 'number' ? body.latestVersion : null;\n    throw invalidStateError(\n      message ??\n        `\"${init.subject}\" changed since you read it` +\n          (latest ? ` (now version ${latest}).` : '.'),\n      `Run \"ekanos agents show ${init.subject}\" to see the latest, then apply ` +\n        `again — or pass --overwrite to replace it.`,\n    );\n  }\n\n  if (!response.ok) {\n    throw networkError(\n      `${host}${init.path.split('?')[0]} responded ${response.status}.`,\n      response.status >= 500\n        ? `The Ekanos deployment returned a server error. Retry shortly.`\n        : `Confirm the host runs a build that includes the agents routes.`,\n    );\n  }\n\n  const parsed = schema.safeParse(body.data);\n  if (!parsed.success) {\n    throw networkError(\n      `${host}${ROUTE} answered in a shape this CLI does not read.`,\n      `Run \"ekanos upgrade\" — the CLI and the host disagree on the agents contract.`,\n    );\n  }\n\n  return { status: 'ok', data: parsed.data };\n}\n\nfunction readIssues(value: unknown): AgentTemplateIssue[] {\n  if (!Array.isArray(value)) return [];\n  return value.flatMap((issue) => {\n    const parsed = AgentTemplateIssueSchema.safeParse(issue);\n    return parsed.success ? [parsed.data] : [];\n  });\n}\n\nasync function readOptionalJson(\n  response: Response,\n): Promise<Record<string, unknown>> {\n  try {\n    const parsed: unknown = await response.json();\n    return typeof parsed === 'object' && parsed !== null\n      ? (parsed as Record<string, unknown>)\n      : {};\n  } catch {\n    return {};\n  }\n}\n\nfunction isRedirect(status: number): boolean {\n  return status >= 300 && status < 400;\n}\n\nfunction str(value: unknown): string | null {\n  return typeof value === 'string' && value.length > 0 ? value : null;\n}\n"]}
+{"version":3,"file":"agents-api.js","sourceRoot":"","sources":["../src/agents-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,gCAAgC,EAEhC,wBAAwB,EAExB,uBAAuB,EAEvB,yBAAyB,EAEzB,uBAAuB,EAEvB,4BAA4B,GAC7B,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACb,UAAU,EACV,eAAe,GAChB,MAAM,UAAU,CAAC;AA8BlB,MAAM,KAAK,GAAG,qBAAqB,CAAC;AAEpC,MAAM,UAAU,kBAAkB,CAChC,IAAY,EACZ,WAAmB,EACnB,MAAc;IAEd,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,uBAAuB,EAAE;QACtD,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,GAAG,KAAK,IAAI,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE;QACnD,OAAO,EAAE,MAAM;KAChB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,WAAmB,EACnB,MAAc,EACd,GAAW;IAEX,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,uBAAuB,EAAE;QACtD,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,GAAG,KAAK,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE;QAC9E,OAAO,EAAE,GAAG;KACb,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,IAAY,EACZ,WAAmB,EACnB,IAA+B;IAE/B,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,yBAAyB,EAAE;QACxD,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,KAAK;QACX,IAAI;QACJ,OAAO,EAAE,IAAI,CAAC,GAAG;KAClB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,IAAY,EACZ,WAAmB,EACnB,MAA8B,EAC9B,MAMC;IAED,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,yBAAyB,EAAE;QACxD,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,GAAG,KAAK,IAAI,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,EAAE;QAC5D,IAAI,kBACF,MAAM,EAAE,MAAM,CAAC,MAAM,EACrB,OAAO,EAAE,MAAM,CAAC,OAAO,IACpB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACzD;QACD,OAAO,EAAE,MAAM,CAAC,GAAG;KACpB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,IAAY,EACZ,WAAmB,EACnB,MAA+B,EAC/B,MAAuC;IAEvC,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,gCAAgC,EAAE;QAC/D,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,GAAG,KAAK,IAAI,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,EAAE;QAC5D,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;QAC/B,OAAO,EAAE,MAAM,CAAC,GAAG;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,IAAI,CACjB,IAAY,EACZ,WAAmB,EACnB,MAAoB,EACpB,IAQC;IAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE;QACpD,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,kBACL,MAAM,EAAE,kBAAkB,EAC1B,aAAa,EAAE,UAAU,WAAW,EAAE,IACnC,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;YACzB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAC5C;QACD,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;KACtE,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACpC,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAEhC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;QACxD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,eAAe,CACnB;YACE,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,6BAA6B;YACxC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;SAC9D,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,qEAAqE;YACnE,4BAA4B,CAC/B,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,UAAU,CACd,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,+BAA+B,EAC1C,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QACvD,MAAM,iBAAiB,CACrB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,GAAG,IAAI,wCAAwC,EAC1D,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,cAAc,CAClB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,+BAA+B,EAC1C,IAAI,KAAK,uBAAuB;YAC9B,CAAC,CAAC,mHAAmH;YACrH,CAAC,CAAC,8DAA8D,CACnE,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,aAAa,CACjB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,IAAI,IAAI,CAAC,OAAO,kBAAkB,EAC7C,IAAI,KAAK,kBAAkB;YACzB,CAAC,CAAC,8DAA8D;YAChE,CAAC,CAAC,oEAAoE,CACzE,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAC3D,MAAM,MAAM,GACV,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;QACrE,MAAM,iBAAiB,CACrB,OAAO,aAAP,OAAO,cAAP,OAAO,GACL,IAAI,IAAI,CAAC,OAAO,6BAA6B;YAC3C,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB,MAAM,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAChD,2BAA2B,IAAI,CAAC,OAAO,kCAAkC;YACvE,4CAA4C,CAC/C,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;QAC5D,MAAM,iBAAiB,CACrB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,IAAI,IAAI,CAAC,OAAO,gBAAgB,EAC3C,gCAAgC,IAAI,CAAC,OAAO,UAAU,CACvD,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC1D,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,iBAAiB,CACrB;YACE,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,IAAI,IAAI,CAAC,OAAO,4BAA4B;YACvD,GAAG,KAAK,CAAC,GAAG,CACV,CAAC,IAAI,EAAE,EAAE,CACP,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,OAAO,EAAE;gBACnD,CAAC,IAAI,CAAC,KAAK;oBACT,CAAC,CAAC,sBAAsB;oBACxB,CAAC,CAAC,IAAI,CAAC,MAAM;wBACX,CAAC,CAAC,WAAW;wBACb,CAAC,CAAC,EAAE,CAAC,CACZ;SACF,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ;YACE,+CAA+C;YAC/C,GAAG,KAAK,CAAC,GAAG,CACV,CAAC,IAAI,EAAE,EAAE,CACP,iCAAiC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,GAAG,MAAM,QAAQ,CAC5E;SACF,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,YAAY,CAChB,GAAG,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,QAAQ,CAAC,MAAM,GAAG,EACjE,QAAQ,CAAC,MAAM,IAAI,GAAG;YACpB,CAAC,CAAC,+DAA+D;YACjE,CAAC,CAAC,gEAAgE,CACrE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,YAAY,CAChB,GAAG,IAAI,GAAG,KAAK,8CAA8C,EAC7D,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAC5B,MAAM,MAAM,GAAG,4BAA4B,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC5D,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACzD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,QAAkB;IAElB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC9C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAClD,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;eAAO,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC;AACvC,CAAC;AAED,SAAS,GAAG,CAAC,KAAc;IACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC","sourcesContent":["import {\n  type AgentTemplateApplyRequest,\n  type AgentTemplateArchiveResult,\n  AgentTemplateArchiveResultSchema,\n  type AgentTemplateIssue,\n  AgentTemplateIssueSchema,\n  type AgentTemplateList,\n  AgentTemplateListSchema,\n  type AgentTemplateResult,\n  AgentTemplateResultSchema,\n  type AgentTemplateShow,\n  AgentTemplateShowSchema,\n  type AgentTemplateTeamInUse,\n  AgentTemplateTeamInUseSchema,\n} from '@ekanos/integration-schema';\nimport type { z } from 'zod';\n\nimport { request } from './auth/ekanos-api';\nimport {\n  authRequiredError,\n  forbiddenError,\n  invalidStateError,\n  networkError,\n  notFoundError,\n  usageError,\n  validationError,\n} from './errors';\n\n/**\n * The CLI's client for Source agent templates (plan 239.0 / 239.2).\n *\n * ---------------------------------------------------------------------------\n * WIRE CONTRACT — the `AgentTemplate*` schemas in `@ekanos/integration-schema`,\n * which the host's `/api/partner/agents` routes build and this parses.\n *\n *   GET  /api/partner/agents?source=<slug|id>          → { ok, data: AgentTemplateList }\n *   GET  /api/partner/agents/<key>?source=<slug|id>    → { ok, data: AgentTemplateShow }\n *   POST /api/partner/agents            AgentTemplateApplyRequest   → { ok, data: AgentTemplateResult }\n *   POST /api/partner/agents/<key>/publish   { source, version?, confirmAccess? }   → { ok, data: AgentTemplateResult }\n *   POST /api/partner/agents/<key>/rollback  { source, version }    → { ok, data: AgentTemplateResult }\n *   POST /api/partner/agents/<key>/archive | unarchive  { source }  → { ok, data: AgentTemplateArchiveResult }\n *\n *   → 401 / 3xx                        refresh once and retry\n *   → 400 { code: \"INVALID_AGENT\", issues: AgentTemplateIssue[] }\n *   → 403 { code: \"MFA_REQUIRED\" | \"FORBIDDEN\" | \"SOURCE_ADMIN_REQUIRED\" }\n *   → 404 { code: \"SOURCE_NOT_FOUND\" | \"TEMPLATE_NOT_FOUND\" | \"VERSION_NOT_FOUND\" }\n *   → 409 { code: \"VERSION_CONFLICT\", latestVersion }\n *   → 409 { code: \"TEMPLATE_ARCHIVED\" }            apply, publish, rollback\n *   → 409 { code: \"TEMPLATE_IN_USE\", teams }       archive: a team has it on\n * ---------------------------------------------------------------------------\n */\n\nexport type AgentsApiResult<T> =\n  | { status: 'ok'; data: T }\n  | { status: 'unauthorized' };\n\nconst ROUTE = '/api/partner/agents';\n\nexport function listAgentTemplates(\n  host: string,\n  accessToken: string,\n  source: string,\n): Promise<AgentsApiResult<AgentTemplateList>> {\n  return call(host, accessToken, AgentTemplateListSchema, {\n    method: 'GET',\n    path: `${ROUTE}?${new URLSearchParams({ source })}`,\n    subject: source,\n  });\n}\n\nexport function showAgentTemplate(\n  host: string,\n  accessToken: string,\n  source: string,\n  key: string,\n): Promise<AgentsApiResult<AgentTemplateShow>> {\n  return call(host, accessToken, AgentTemplateShowSchema, {\n    method: 'GET',\n    path: `${ROUTE}/${encodeURIComponent(key)}?${new URLSearchParams({ source })}`,\n    subject: key,\n  });\n}\n\nexport function applyAgentTemplate(\n  host: string,\n  accessToken: string,\n  body: AgentTemplateApplyRequest,\n): Promise<AgentsApiResult<AgentTemplateResult>> {\n  return call(host, accessToken, AgentTemplateResultSchema, {\n    method: 'POST',\n    path: ROUTE,\n    body,\n    subject: body.key,\n  });\n}\n\nexport function publishAgentTemplate(\n  host: string,\n  accessToken: string,\n  action: 'publish' | 'rollback',\n  params: {\n    source: string;\n    key: string;\n    version?: number;\n    /** Sent only when set: an older host refuses it rather than ignoring it. */\n    confirmAccess?: boolean;\n  },\n): Promise<AgentsApiResult<AgentTemplateResult>> {\n  return call(host, accessToken, AgentTemplateResultSchema, {\n    method: 'POST',\n    path: `${ROUTE}/${encodeURIComponent(params.key)}/${action}`,\n    body: {\n      source: params.source,\n      version: params.version,\n      ...(params.confirmAccess ? { confirmAccess: true } : {}),\n    },\n    subject: params.key,\n  });\n}\n\nexport function archiveAgentTemplate(\n  host: string,\n  accessToken: string,\n  action: 'archive' | 'unarchive',\n  params: { source: string; key: string },\n): Promise<AgentsApiResult<AgentTemplateArchiveResult>> {\n  return call(host, accessToken, AgentTemplateArchiveResultSchema, {\n    method: 'POST',\n    path: `${ROUTE}/${encodeURIComponent(params.key)}/${action}`,\n    body: { source: params.source },\n    subject: params.key,\n    source: params.source,\n  });\n}\n\nasync function call<T>(\n  host: string,\n  accessToken: string,\n  schema: z.ZodType<T>,\n  init: {\n    method: 'GET' | 'POST';\n    path: string;\n    body?: unknown;\n    /** What a 404 is about, for the message. */\n    subject: string;\n    /** For the commands a refusal suggests. */\n    source?: string;\n  },\n): Promise<AgentsApiResult<T>> {\n  const response = await request(`${host}${init.path}`, {\n    method: init.method,\n    headers: {\n      accept: 'application/json',\n      authorization: `Bearer ${accessToken}`,\n      ...(init.body === undefined\n        ? {}\n        : { 'content-type': 'application/json' }),\n    },\n    body: init.body === undefined ? undefined : JSON.stringify(init.body),\n  });\n\n  if (response.status === 401 || isRedirect(response.status)) {\n    return { status: 'unauthorized' };\n  }\n\n  const body = await readOptionalJson(response);\n  const code = str(body.code);\n  const message = str(body.error);\n\n  if (response.status === 400 && code === 'INVALID_AGENT') {\n    const issues = readIssues(body.issues);\n    throw validationError(\n      [\n        message ?? 'The host refused the agent.',\n        ...issues.map((issue) => `  ${issue.path}: ${issue.message}`),\n      ].join('\\n'),\n      `Fix the agent and apply again. \"ekanos catalog\" lists the products ` +\n        `and tools this Source has.`,\n    );\n  }\n\n  if (response.status === 400) {\n    throw usageError(\n      message ?? 'The host refused the request.',\n      'See \"ekanos agents --help\" for each subcommand\\'s arguments.',\n    );\n  }\n\n  if (response.status === 403 && code === 'MFA_REQUIRED') {\n    throw authRequiredError(\n      message ?? `${host} requires multi-factor authentication.`,\n      `Complete MFA in the browser, then run \"ekanos login\" again.`,\n    );\n  }\n\n  if (response.status === 403) {\n    throw forbiddenError(\n      message ?? 'Not permitted on this Source.',\n      code === 'SOURCE_ADMIN_REQUIRED'\n        ? `Ask a Source admin to run it. A developer seat applies drafts; a Source admin publishes, rolls back and archives.`\n        : `Run \"ekanos sources\" to list the sources you hold a seat on.`,\n    );\n  }\n\n  if (response.status === 404) {\n    throw notFoundError(\n      message ?? `\"${init.subject}\" was not found.`,\n      code === 'SOURCE_NOT_FOUND'\n        ? `Run \"ekanos sources\" to list the sources you hold a seat on.`\n        : `Run \"ekanos agents list\" to see this Source's agents and versions.`,\n    );\n  }\n\n  if (response.status === 409 && code === 'VERSION_CONFLICT') {\n    const latest =\n      typeof body.latestVersion === 'number' ? body.latestVersion : null;\n    throw invalidStateError(\n      message ??\n        `\"${init.subject}\" changed since you read it` +\n          (latest ? ` (now version ${latest}).` : '.'),\n      `Run \"ekanos agents show ${init.subject}\" to see the latest, then apply ` +\n        `again — or pass --overwrite to replace it.`,\n    );\n  }\n\n  if (response.status === 409 && code === 'TEMPLATE_ARCHIVED') {\n    throw invalidStateError(\n      message ?? `\"${init.subject}\" is archived.`,\n      `Run \"ekanos agents unarchive ${init.subject}\" first.`,\n    );\n  }\n\n  if (response.status === 409 && code === 'TEMPLATE_IN_USE') {\n    const teams = readTeamsInUse(body.teams);\n    const source = init.source ? ` --source ${init.source}` : '';\n    throw invalidStateError(\n      [\n        message ?? `\"${init.subject}\" is turned on for a team.`,\n        ...teams.map(\n          (team) =>\n            `  ${team.team}: ${team.agent} on v${team.version}` +\n            (team.draft\n              ? ' (testing the draft)'\n              : team.pinned\n                ? ' (pinned)'\n                : ''),\n        ),\n      ].join('\\n'),\n      [\n        'Turn it off on each team, then archive again:',\n        ...teams.map(\n          (team) =>\n            `  ekanos teams agents disable ${team.team} ${team.agent}${source} --yes`,\n        ),\n      ].join('\\n'),\n    );\n  }\n\n  if (!response.ok) {\n    throw networkError(\n      `${host}${init.path.split('?')[0]} responded ${response.status}.`,\n      response.status >= 500\n        ? `The Ekanos deployment returned a server error. Retry shortly.`\n        : `Confirm the host runs a build that includes the agents routes.`,\n    );\n  }\n\n  const parsed = schema.safeParse(body.data);\n  if (!parsed.success) {\n    throw networkError(\n      `${host}${ROUTE} answered in a shape this CLI does not read.`,\n      `Run \"ekanos upgrade\" — the CLI and the host disagree on the agents contract.`,\n    );\n  }\n\n  return { status: 'ok', data: parsed.data };\n}\n\nfunction readTeamsInUse(value: unknown): AgentTemplateTeamInUse[] {\n  if (!Array.isArray(value)) return [];\n  return value.flatMap((team) => {\n    const parsed = AgentTemplateTeamInUseSchema.safeParse(team);\n    return parsed.success ? [parsed.data] : [];\n  });\n}\n\nfunction readIssues(value: unknown): AgentTemplateIssue[] {\n  if (!Array.isArray(value)) return [];\n  return value.flatMap((issue) => {\n    const parsed = AgentTemplateIssueSchema.safeParse(issue);\n    return parsed.success ? [parsed.data] : [];\n  });\n}\n\nasync function readOptionalJson(\n  response: Response,\n): Promise<Record<string, unknown>> {\n  try {\n    const parsed: unknown = await response.json();\n    return typeof parsed === 'object' && parsed !== null\n      ? (parsed as Record<string, unknown>)\n      : {};\n  } catch {\n    return {};\n  }\n}\n\nfunction isRedirect(status: number): boolean {\n  return status >= 300 && status < 400;\n}\n\nfunction str(value: unknown): string | null {\n  return typeof value === 'string' && value.length > 0 ? value : null;\n}\n"]}

package/dist/apps-api.d.ts

@@ -22,6 +22,7 @@ export declare function showProviderApp(host: string, accessToken: string, sourc
 export declare function setProviderApp(host: string, accessToken: string, body: {
     source: string;
     product: string;
-    clientId: string;
-    clientSecret: string;
+    /** Either or both: one left out keeps what is stored. */
+    clientId?: string;
+    clientSecret?: string;
 }): Promise<AppsApiResult<ProviderAppSetResult>>;

package/dist/apps-api.js

@@ -11,11 +11,7 @@ export function setProviderApp(host, accessToken, body) {
     return call(host, accessToken, ProviderAppSetResultSchema, body.product, {
         method: 'PUT',
         path: route(body.product),
-        body: {
-            source: body.source,
-            clientId: body.clientId,
-            clientSecret: body.clientSecret,
-        },
+        body: Object.assign(Object.assign({ source: body.source }, (body.clientId ? { clientId: body.clientId } : {})), (body.clientSecret ? { clientSecret: body.clientSecret } : {})),
     });
 }
 function route(product) {
@@ -46,11 +42,11 @@ async function call(host, accessToken, schema, product, init) {
     }
     if (response.status === 404) {
         throw notFoundError(message !== null && message !== void 0 ? message : `"${product}" was not found.`, code === 'PRODUCT_NOT_ENTITLED'
-            ? `"ekanos catalog" lists what this Source has; Ekanos enables a product for a Source.`
+            ? `"ekanos sources products" shows what this Source has; only a super-admin enables a product for a Source (in /admin).`
             : 'Run "ekanos sources" to list the sources you hold a seat on.');
     }
     if (response.status === 409 && code === 'NO_PROVIDER_APP') {
-        throw invalidStateError(message !== null && message !== void 0 ? message : `"${product}" has no app for the Source to set up.`, `Each team connects ${product} with its own app, from the team's Integrations page. "ekanos catalog ${product}" shows its setup steps.`);
+        throw invalidStateError(message !== null && message !== void 0 ? message : `"${product}" has no app for the Source to set up.`, `Each team connects ${product} with its own app: "ekanos teams app set <team> ${product}", then "ekanos teams connect <team> ${product}". "ekanos catalog ${product}" shows its setup steps.`);
     }
     if (response.status === 400) {
         throw usageError(message !== null && message !== void 0 ? message : 'The host refused the request.', 'See "ekanos apps --help".');

package/dist/apps-api.js.map

@@ -1 +1 @@
-{"version":3,"file":"apps-api.js","sourceRoot":"","sources":["../src/apps-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,0BAA0B,EAE1B,uBAAuB,GACxB,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACb,UAAU,GACX,MAAM,UAAU,CAAC;AAoBlB,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,WAAmB,EACnB,MAAc,EACd,OAAe;IAEf,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,uBAAuB,EAAE,OAAO,EAAE;QAC/D,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE;KAC7D,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,WAAmB,EACnB,IAKC;IAED,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,0BAA0B,EAAE,IAAI,CAAC,OAAO,EAAE;QACvE,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;QACzB,IAAI,EAAE;YACJ,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,KAAK,CAAC,OAAe;IAC5B,OAAO,qBAAqB,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED,KAAK,UAAU,IAAI,CACjB,IAAY,EACZ,WAAmB,EACnB,MAAoB,EACpB,OAAe,EACf,IAA6D;IAE7D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE;QACpD,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,kBACL,MAAM,EAAE,kBAAkB,EAC1B,aAAa,EAAE,UAAU,WAAW,EAAE,IACnC,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;YACzB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAC5C;QACD,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;KACtE,CAAC,CAAC;IAEH,IACE,QAAQ,CAAC,MAAM,KAAK,GAAG;QACvB,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,EACjD,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACpC,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,MAAM,OAAO,GACX,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAEnE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QACvD,MAAM,iBAAiB,CACrB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,GAAG,IAAI,wCAAwC,EAC1D,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,cAAc,CAClB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,+BAA+B,EAC1C,IAAI,KAAK,uBAAuB;YAC9B,CAAC,CAAC,mEAAmE;YACrE,CAAC,CAAC,8DAA8D,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,aAAa,CACjB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,IAAI,OAAO,kBAAkB,EACxC,IAAI,KAAK,sBAAsB;YAC7B,CAAC,CAAC,qFAAqF;YACvF,CAAC,CAAC,8DAA8D,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC1D,MAAM,iBAAiB,CACrB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,IAAI,OAAO,wCAAwC,EAC9D,sBAAsB,OAAO,yEAAyE,OAAO,0BAA0B,CACxI,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,UAAU,CACd,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,+BAA+B,EAC1C,2BAA2B,CAC5B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,YAAY,CAChB,GAAG,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,QAAQ,CAAC,MAAM,GAAG,EACjE,QAAQ,CAAC,MAAM,IAAI,GAAG;YACpB,CAAC,CAAC,+DAA+D;YACjE,CAAC,CAAC,8DAA8D,CACnE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,YAAY,CAChB,GAAG,IAAI,+DAA+D,EACtE,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC7C,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,QAAkB;IAElB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC9C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAClD,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;eAAO,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["import {\n  type ProviderAppSetResult,\n  ProviderAppSetResultSchema,\n  type ProviderAppStatus,\n  ProviderAppStatusSchema,\n} from '@ekanos/integration-schema';\nimport type { z } from 'zod';\n\nimport { request } from './auth/ekanos-api';\nimport {\n  authRequiredError,\n  forbiddenError,\n  invalidStateError,\n  networkError,\n  notFoundError,\n  usageError,\n} from './errors';\n\n/**\n * The CLI's client for a Source's provider apps — the OAuth client an\n * integration signs every team in through.\n *\n *   GET /api/partner/apps/<product>?source=<slug|id>  → { ok, data: ProviderAppStatus }\n *   PUT /api/partner/apps/<product>  { source, clientId, clientSecret }\n *                                     → { ok, data: ProviderAppStatus & { replaced } }\n *\n *   → 401 / 3xx  refresh once and retry\n *   → 403 { code: \"SOURCE_ADMIN_REQUIRED\" | \"MFA_REQUIRED\" | \"FORBIDDEN\" }\n *   → 404 { code: \"PRODUCT_NOT_ENTITLED\" | \"SOURCE_NOT_FOUND\" }\n *   → 409 { code: \"NO_PROVIDER_APP\" }\n */\n\nexport type AppsApiResult<T> =\n  | { status: 'ok'; data: T }\n  | { status: 'unauthorized' };\n\nexport function showProviderApp(\n  host: string,\n  accessToken: string,\n  source: string,\n  product: string,\n): Promise<AppsApiResult<ProviderAppStatus>> {\n  return call(host, accessToken, ProviderAppStatusSchema, product, {\n    method: 'GET',\n    path: `${route(product)}?${new URLSearchParams({ source })}`,\n  });\n}\n\nexport function setProviderApp(\n  host: string,\n  accessToken: string,\n  body: {\n    source: string;\n    product: string;\n    clientId: string;\n    clientSecret: string;\n  },\n): Promise<AppsApiResult<ProviderAppSetResult>> {\n  return call(host, accessToken, ProviderAppSetResultSchema, body.product, {\n    method: 'PUT',\n    path: route(body.product),\n    body: {\n      source: body.source,\n      clientId: body.clientId,\n      clientSecret: body.clientSecret,\n    },\n  });\n}\n\nfunction route(product: string): string {\n  return `/api/partner/apps/${encodeURIComponent(product)}`;\n}\n\nasync function call<T>(\n  host: string,\n  accessToken: string,\n  schema: z.ZodType<T>,\n  product: string,\n  init: { method: 'GET' | 'PUT'; path: string; body?: unknown },\n): Promise<AppsApiResult<T>> {\n  const response = await request(`${host}${init.path}`, {\n    method: init.method,\n    headers: {\n      accept: 'application/json',\n      authorization: `Bearer ${accessToken}`,\n      ...(init.body === undefined\n        ? {}\n        : { 'content-type': 'application/json' }),\n    },\n    body: init.body === undefined ? undefined : JSON.stringify(init.body),\n  });\n\n  if (\n    response.status === 401 ||\n    (response.status >= 300 && response.status < 400)\n  ) {\n    return { status: 'unauthorized' };\n  }\n\n  const body = await readOptionalJson(response);\n  const code = typeof body.code === 'string' ? body.code : null;\n  const message =\n    typeof body.error === 'string' && body.error ? body.error : null;\n\n  if (response.status === 403 && code === 'MFA_REQUIRED') {\n    throw authRequiredError(\n      message ?? `${host} requires multi-factor authentication.`,\n      'Complete MFA in the browser, then run \"ekanos login\" again.',\n    );\n  }\n  if (response.status === 403) {\n    throw forbiddenError(\n      message ?? 'Not permitted on this Source.',\n      code === 'SOURCE_ADMIN_REQUIRED'\n        ? \"Only a Source admin manages the Source's apps. Ask one to run it.\"\n        : 'Run \"ekanos sources\" to list the sources you hold a seat on.',\n    );\n  }\n  if (response.status === 404) {\n    throw notFoundError(\n      message ?? `\"${product}\" was not found.`,\n      code === 'PRODUCT_NOT_ENTITLED'\n        ? `\"ekanos catalog\" lists what this Source has; Ekanos enables a product for a Source.`\n        : 'Run \"ekanos sources\" to list the sources you hold a seat on.',\n    );\n  }\n  if (response.status === 409 && code === 'NO_PROVIDER_APP') {\n    throw invalidStateError(\n      message ?? `\"${product}\" has no app for the Source to set up.`,\n      `Each team connects ${product} with its own app, from the team's Integrations page. \"ekanos catalog ${product}\" shows its setup steps.`,\n    );\n  }\n  if (response.status === 400) {\n    throw usageError(\n      message ?? 'The host refused the request.',\n      'See \"ekanos apps --help\".',\n    );\n  }\n  if (!response.ok) {\n    throw networkError(\n      `${host}${init.path.split('?')[0]} responded ${response.status}.`,\n      response.status >= 500\n        ? 'The Ekanos deployment returned a server error. Retry shortly.'\n        : 'Confirm the host runs a build that includes the apps routes.',\n    );\n  }\n\n  const parsed = schema.safeParse(body.data);\n  if (!parsed.success) {\n    throw networkError(\n      `${host}/api/partner/apps answered in a shape this CLI does not read.`,\n      'Run \"ekanos upgrade\" — the CLI and the host disagree on the apps contract.',\n    );\n  }\n  return { status: 'ok', data: parsed.data };\n}\n\nasync function readOptionalJson(\n  response: Response,\n): Promise<Record<string, unknown>> {\n  try {\n    const parsed: unknown = await response.json();\n    return typeof parsed === 'object' && parsed !== null\n      ? (parsed as Record<string, unknown>)\n      : {};\n  } catch {\n    return {};\n  }\n}\n"]}
+{"version":3,"file":"apps-api.js","sourceRoot":"","sources":["../src/apps-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,0BAA0B,EAE1B,uBAAuB,GACxB,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACb,UAAU,GACX,MAAM,UAAU,CAAC;AAoBlB,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,WAAmB,EACnB,MAAc,EACd,OAAe;IAEf,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,uBAAuB,EAAE,OAAO,EAAE;QAC/D,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE;KAC7D,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,WAAmB,EACnB,IAMC;IAED,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,0BAA0B,EAAE,IAAI,CAAC,OAAO,EAAE;QACvE,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;QACzB,IAAI,gCACF,MAAM,EAAE,IAAI,CAAC,MAAM,IAChB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAClD,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAClE;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,KAAK,CAAC,OAAe;IAC5B,OAAO,qBAAqB,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED,KAAK,UAAU,IAAI,CACjB,IAAY,EACZ,WAAmB,EACnB,MAAoB,EACpB,OAAe,EACf,IAA6D;IAE7D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE;QACpD,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,kBACL,MAAM,EAAE,kBAAkB,EAC1B,aAAa,EAAE,UAAU,WAAW,EAAE,IACnC,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;YACzB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAC5C;QACD,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;KACtE,CAAC,CAAC;IAEH,IACE,QAAQ,CAAC,MAAM,KAAK,GAAG;QACvB,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,EACjD,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACpC,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,MAAM,OAAO,GACX,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAEnE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QACvD,MAAM,iBAAiB,CACrB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,GAAG,IAAI,wCAAwC,EAC1D,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,cAAc,CAClB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,+BAA+B,EAC1C,IAAI,KAAK,uBAAuB;YAC9B,CAAC,CAAC,mEAAmE;YACrE,CAAC,CAAC,8DAA8D,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,aAAa,CACjB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,IAAI,OAAO,kBAAkB,EACxC,IAAI,KAAK,sBAAsB;YAC7B,CAAC,CAAC,sHAAsH;YACxH,CAAC,CAAC,8DAA8D,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC1D,MAAM,iBAAiB,CACrB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,IAAI,OAAO,wCAAwC,EAC9D,sBAAsB,OAAO,mDAAmD,OAAO,wCAAwC,OAAO,sBAAsB,OAAO,0BAA0B,CAC9L,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,UAAU,CACd,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,+BAA+B,EAC1C,2BAA2B,CAC5B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,YAAY,CAChB,GAAG,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,QAAQ,CAAC,MAAM,GAAG,EACjE,QAAQ,CAAC,MAAM,IAAI,GAAG;YACpB,CAAC,CAAC,+DAA+D;YACjE,CAAC,CAAC,8DAA8D,CACnE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,YAAY,CAChB,GAAG,IAAI,+DAA+D,EACtE,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC7C,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,QAAkB;IAElB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC9C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAClD,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;eAAO,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["import {\n  type ProviderAppSetResult,\n  ProviderAppSetResultSchema,\n  type ProviderAppStatus,\n  ProviderAppStatusSchema,\n} from '@ekanos/integration-schema';\nimport type { z } from 'zod';\n\nimport { request } from './auth/ekanos-api';\nimport {\n  authRequiredError,\n  forbiddenError,\n  invalidStateError,\n  networkError,\n  notFoundError,\n  usageError,\n} from './errors';\n\n/**\n * The CLI's client for a Source's provider apps — the OAuth client an\n * integration signs every team in through.\n *\n *   GET /api/partner/apps/<product>?source=<slug|id>  → { ok, data: ProviderAppStatus }\n *   PUT /api/partner/apps/<product>  { source, clientId, clientSecret }\n *                                     → { ok, data: ProviderAppStatus & { replaced } }\n *\n *   → 401 / 3xx  refresh once and retry\n *   → 403 { code: \"SOURCE_ADMIN_REQUIRED\" | \"MFA_REQUIRED\" | \"FORBIDDEN\" }\n *   → 404 { code: \"PRODUCT_NOT_ENTITLED\" | \"SOURCE_NOT_FOUND\" }\n *   → 409 { code: \"NO_PROVIDER_APP\" }\n */\n\nexport type AppsApiResult<T> =\n  | { status: 'ok'; data: T }\n  | { status: 'unauthorized' };\n\nexport function showProviderApp(\n  host: string,\n  accessToken: string,\n  source: string,\n  product: string,\n): Promise<AppsApiResult<ProviderAppStatus>> {\n  return call(host, accessToken, ProviderAppStatusSchema, product, {\n    method: 'GET',\n    path: `${route(product)}?${new URLSearchParams({ source })}`,\n  });\n}\n\nexport function setProviderApp(\n  host: string,\n  accessToken: string,\n  body: {\n    source: string;\n    product: string;\n    /** Either or both: one left out keeps what is stored. */\n    clientId?: string;\n    clientSecret?: string;\n  },\n): Promise<AppsApiResult<ProviderAppSetResult>> {\n  return call(host, accessToken, ProviderAppSetResultSchema, body.product, {\n    method: 'PUT',\n    path: route(body.product),\n    body: {\n      source: body.source,\n      ...(body.clientId ? { clientId: body.clientId } : {}),\n      ...(body.clientSecret ? { clientSecret: body.clientSecret } : {}),\n    },\n  });\n}\n\nfunction route(product: string): string {\n  return `/api/partner/apps/${encodeURIComponent(product)}`;\n}\n\nasync function call<T>(\n  host: string,\n  accessToken: string,\n  schema: z.ZodType<T>,\n  product: string,\n  init: { method: 'GET' | 'PUT'; path: string; body?: unknown },\n): Promise<AppsApiResult<T>> {\n  const response = await request(`${host}${init.path}`, {\n    method: init.method,\n    headers: {\n      accept: 'application/json',\n      authorization: `Bearer ${accessToken}`,\n      ...(init.body === undefined\n        ? {}\n        : { 'content-type': 'application/json' }),\n    },\n    body: init.body === undefined ? undefined : JSON.stringify(init.body),\n  });\n\n  if (\n    response.status === 401 ||\n    (response.status >= 300 && response.status < 400)\n  ) {\n    return { status: 'unauthorized' };\n  }\n\n  const body = await readOptionalJson(response);\n  const code = typeof body.code === 'string' ? body.code : null;\n  const message =\n    typeof body.error === 'string' && body.error ? body.error : null;\n\n  if (response.status === 403 && code === 'MFA_REQUIRED') {\n    throw authRequiredError(\n      message ?? `${host} requires multi-factor authentication.`,\n      'Complete MFA in the browser, then run \"ekanos login\" again.',\n    );\n  }\n  if (response.status === 403) {\n    throw forbiddenError(\n      message ?? 'Not permitted on this Source.',\n      code === 'SOURCE_ADMIN_REQUIRED'\n        ? \"Only a Source admin manages the Source's apps. Ask one to run it.\"\n        : 'Run \"ekanos sources\" to list the sources you hold a seat on.',\n    );\n  }\n  if (response.status === 404) {\n    throw notFoundError(\n      message ?? `\"${product}\" was not found.`,\n      code === 'PRODUCT_NOT_ENTITLED'\n        ? `\"ekanos sources products\" shows what this Source has; only a super-admin enables a product for a Source (in /admin).`\n        : 'Run \"ekanos sources\" to list the sources you hold a seat on.',\n    );\n  }\n  if (response.status === 409 && code === 'NO_PROVIDER_APP') {\n    throw invalidStateError(\n      message ?? `\"${product}\" has no app for the Source to set up.`,\n      `Each team connects ${product} with its own app: \"ekanos teams app set <team> ${product}\", then \"ekanos teams connect <team> ${product}\". \"ekanos catalog ${product}\" shows its setup steps.`,\n    );\n  }\n  if (response.status === 400) {\n    throw usageError(\n      message ?? 'The host refused the request.',\n      'See \"ekanos apps --help\".',\n    );\n  }\n  if (!response.ok) {\n    throw networkError(\n      `${host}${init.path.split('?')[0]} responded ${response.status}.`,\n      response.status >= 500\n        ? 'The Ekanos deployment returned a server error. Retry shortly.'\n        : 'Confirm the host runs a build that includes the apps routes.',\n    );\n  }\n\n  const parsed = schema.safeParse(body.data);\n  if (!parsed.success) {\n    throw networkError(\n      `${host}/api/partner/apps answered in a shape this CLI does not read.`,\n      'Run \"ekanos upgrade\" — the CLI and the host disagree on the apps contract.',\n    );\n  }\n  return { status: 'ok', data: parsed.data };\n}\n\nasync function readOptionalJson(\n  response: Response,\n): Promise<Record<string, unknown>> {\n  try {\n    const parsed: unknown = await response.json();\n    return typeof parsed === 'object' && parsed !== null\n      ? (parsed as Record<string, unknown>)\n      : {};\n  } catch {\n    return {};\n  }\n}\n"]}

package/dist/auth/ekanos-api.d.ts

@@ -37,12 +37,26 @@ export interface RefreshOptions {
      */
     onRotatedToken?: (rotated: string) => void;
 }
-/** Re-mint an Ekanos JWT from the stored Auth0 refresh token. */
-export declare function refreshEkanosSession(host: string, auth0RefreshToken: string, options?: RefreshOptions): Promise<RefreshedSession>;
+/**
+ * Re-mint an Ekanos JWT from the stored Auth0 refresh token. `accessToken` is
+ * the previous Ekanos JWT (usually expired): the server reads the session id
+ * from it to enforce that session's idle timeout, maximum age and revocation.
+ */
+export declare function refreshEkanosSession(host: string, credentials: {
+    auth0RefreshToken: string;
+    accessToken: string;
+}, options?: RefreshOptions): Promise<RefreshedSession>;
 /**
  * Prove the Ekanos JWT authenticates. Returns null on 401 so the caller can
  * decide whether to refresh and retry — an expired access token is an ordinary
  * event, not an error.
  */
 export declare function fetchIdentity(host: string, accessToken: string): Promise<EkanosIdentity | null>;
+/**
+ * End the server-side session behind an Ekanos JWT (`ekanos logout`). Returns
+ * whether the server answered — `true` also when the session was already
+ * revoked, since either way it can no longer be refreshed. Never throws for
+ * an HTTP status: logout must always reach the local delete.
+ */
+export declare function revokeEkanosSession(host: string, accessToken: string): Promise<boolean>;
 export declare function request(url: string, init: RequestInit): Promise<Response>;

package/dist/auth/ekanos-api.js

@@ -1,6 +1,6 @@
-import { authRequiredError, networkError, preconditionError } from '../errors.js';
+import { authRequiredError, forbiddenError, networkError, preconditionError, } from '../errors.js';
 /**
- * The CLI's client for the four Ekanos auth routes.
+ * The CLI's client for the five Ekanos auth routes.
  *
  * ---------------------------------------------------------------------------
  * WIRE CONTRACT — the seam between this package and the Ekanos web app.
@@ -22,17 +22,33 @@ import { authRequiredError, networkError, preconditionError } from '../errors.js
  *     → 400 { error, code: "INVALID_REQUEST" }      malformed / wrong shape
  *     → 401 { error, code: "SESSION_EXPIRED" }      Auth0 said no, OR no
  *                                                   Ekanos account for it
+ *     → 403 { error, code: "NO_DEVELOPER_SEAT" }    no developer/admin seat
+ *     → 403 { error, code: "EMAIL_UNVERIFIED" }     Auth0 email unverified
+ *     → 429 { error, code: "RATE_LIMITED" }         + Retry-After header
  *     → 503 { error, code: "CLI_NOT_CONFIGURED" }   deployment not provisioned
  *     → 500 { error, code: "INTERNAL_ERROR" }
+ *     `error` on a 403 is a sentence written for the person; show it.
  *
  *   POST /api/auth/cli-refresh                                 [no auth]
- *     ← { auth0_refresh_token: string }
+ *     ← { auth0_refresh_token: string, access_token: string }
+ *       access_token is the PREVIOUS Ekanos JWT (expired is fine): it names
+ *       the server-side session this refresh continues. Required: without
+ *       it the server answers 401 SESSION_EXPIRED, reason
+ *       "previous_token_missing" (an older CLI is told to log in again).
  *     → 200 { access_token, expires_at, user: { id, email },
  *             auth0_refresh_token }   ← ROTATED; the presented one is dead
  *     → 400 { error, code: "INVALID_REQUEST" }
- *     → 401 { error, code: "SESSION_EXPIRED" }      expired or revoked
+ *     → 401 { error, code: "SESSION_EXPIRED", reason? }
+ *                                                   expired, revoked, idle
+ *                                                   or past the session's
+ *                                                   maximum age; checked
+ *                                                   BEFORE rotation, so no
+ *                                                   rotated token comes back
+ *     → 403 { error, code: "EMAIL_UNVERIFIED",
+ *             auth0_refresh_token }
  *     → 404 { error, code: "ACCOUNT_NOT_FOUND",
  *             auth0_refresh_token }                 no Ekanos account
+ *     → 429 { error, code: "RATE_LIMITED" }         + Retry-After header
  *     → 502 { error, code: "TOKEN_EXCHANGE_FAILED" } Auth0 returned no
  *                                                   rotated token
  *     → 503 { error, code: "CLI_NOT_CONFIGURED" }   deployment not provisioned
@@ -51,8 +67,16 @@ import { authRequiredError, networkError, preconditionError } from '../errors.js
  *      branch on `code`, not on the status alone.
  *
  *   All three routes above read the Fusion CLI Auth0 application config, so all
- *   three can answer 503 CLI_NOT_CONFIGURED. cli-whoami cannot — it reads no
- *   Auth0 config, only the caller's bearer token.
+ *   three can answer 503 CLI_NOT_CONFIGURED. cli-whoami and cli-logout cannot
+ *   — they read no Auth0 config, only an Ekanos token.
+ *
+ *   POST /api/auth/cli-logout                                  [no auth]
+ *     ← { access_token: string }   the stored Ekanos JWT; expired is fine
+ *     → 200 { revoked: boolean }   false = already revoked / no session row
+ *     → 400 { error, code: "INVALID_REQUEST" }
+ *     → 401 { error, code: "AUTH_REQUIRED" }        not a valid Ekanos token
+ *     → 429 { error, code: "RATE_LIMITED" }
+ *     → 500 { error, code: "INTERNAL_ERROR" }
  *
  *   GET /api/auth/cli-whoami        [Authorization: Bearer <access_token>]
  *     → 200 { user: { id, email, name } }
@@ -102,15 +126,19 @@ export async function fetchCliAuthConfig(host) {
             `/api/auth/cli-config route.`);
     }
     // The endpoints come from the server, so they are attacker-controlled if the
-    // host is. Pin them to the Auth0 domain the same response declares, so a
-    // compromised or misconfigured Ekanos cannot redirect the device flow — and
-    // the resulting credentials — to an arbitrary origin.
+    // host is. Pin the declared domain to Auth0 itself, then pin the endpoints
+    // to that domain, so a compromised or misconfigured Ekanos cannot redirect
+    // the device flow — and the resulting credentials — to an arbitrary origin.
+    // This does not prove the host is genuine: any Auth0 tenant passes, and a
+    // hostile host can name Ekanos's own. That is `login`'s new-host question.
+    assertAuth0Domain(config.auth0Domain);
     assertOnDomain(config.deviceAuthorizationEndpoint, config.auth0Domain);
     assertOnDomain(config.tokenEndpoint, config.auth0Domain);
     return config;
 }
 /** Exchange a verified Auth0 access token for an Ekanos JWT. */
 export async function createEkanosSession(host, auth0AccessToken) {
+    var _a;
     const response = await request(`${host}/api/auth/cli-session`, {
         method: 'POST',
         headers: { 'content-type': 'application/json', accept: 'application/json' },
@@ -122,18 +150,34 @@ export async function createEkanosSession(host, auth0AccessToken) {
             `exists on ${host} — the browser login can succeed for an identity ` +
             `that has no Ekanos account.`);
     }
+    if (response.status === 403) {
+        const body = await readOptionalJson(response);
+        throw forbiddenError((_a = str(body.error)) !== null && _a !== void 0 ? _a : `${host} refused a CLI session for this account.`, body.code === 'EMAIL_UNVERIFIED'
+            ? `Verify your email address, then run "ekanos login" again.`
+            : `The Ekanos CLI needs a developer seat. Ask your administrator ` +
+                `for one, then run "ekanos login" again.`);
+    }
+    throwIfRateLimited(response, host);
     if (!response.ok) {
         throw unexpectedStatus(host, '/api/auth/cli-session', response.status);
     }
     return toSession(await readJson(response, `${host}/api/auth/cli-session`), host);
 }
-/** Re-mint an Ekanos JWT from the stored Auth0 refresh token. */
-export async function refreshEkanosSession(host, auth0RefreshToken, options = {}) {
+/**
+ * Re-mint an Ekanos JWT from the stored Auth0 refresh token. `accessToken` is
+ * the previous Ekanos JWT (usually expired): the server reads the session id
+ * from it to enforce that session's idle timeout, maximum age and revocation.
+ */
+export async function refreshEkanosSession(host, credentials, options = {}) {
     var _a;
+    var _b;
     const response = await request(`${host}/api/auth/cli-refresh`, {
         method: 'POST',
         headers: { 'content-type': 'application/json', accept: 'application/json' },
-        body: JSON.stringify({ auth0_refresh_token: auth0RefreshToken }),
+        body: JSON.stringify({
+            auth0_refresh_token: credentials.auth0RefreshToken,
+            access_token: credentials.accessToken,
+        }),
     });
     // Read the body FIRST, whatever the status: the rotated token can arrive on
     // a 503, a 404 or a 500 just as readily as on a 200, and it must be captured
@@ -145,10 +189,16 @@ export async function refreshEkanosSession(host, auth0RefreshToken, options = {}
     }
     throwIfNotConfigured(response, host, body);
     if (response.status === 401) {
-        throw authRequiredError(`The stored session for ${host} is no longer valid.`, `Run "ekanos login" to sign in again. This is expected after the ` +
-            `refresh token expires, after it is revoked in Auth0, or if two ` +
-            `machines used the same credentials file.`);
+        throw authRequiredError(`The stored session for ${host} is no longer valid` +
+            (str(body.error) ? ` (${str(body.error)}).` : '.'), `Run "ekanos login" to sign in again. This is expected after the ` +
+            `session's idle timeout or maximum age, after "ekanos logout", after ` +
+            `the refresh token is revoked in Auth0, or if two machines used the ` +
+            `same credentials file.`);
+    }
+    if (response.status === 403) {
+        throw forbiddenError((_b = str(body.error)) !== null && _b !== void 0 ? _b : `${host} refused to renew the session.`, `Verify your email address, then run "ekanos login" again.`);
     }
+    throwIfRateLimited(response, host);
     if (response.status === 503 && body.code === 'REFRESH_INCOMPLETE') {
         // NOT an auth failure. The credential was renewed — and, thanks to the
         // callback above, already saved. Auth0's /userinfo is simply not answering.
@@ -206,6 +256,20 @@ export async function fetchIdentity(host, accessToken) {
     }
     return { id, email: str(user.email), name: str(user.name) };
 }
+/**
+ * End the server-side session behind an Ekanos JWT (`ekanos logout`). Returns
+ * whether the server answered — `true` also when the session was already
+ * revoked, since either way it can no longer be refreshed. Never throws for
+ * an HTTP status: logout must always reach the local delete.
+ */
+export async function revokeEkanosSession(host, accessToken) {
+    const response = await request(`${host}/api/auth/cli-logout`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', accept: 'application/json' },
+        body: JSON.stringify({ access_token: accessToken }),
+    });
+    return response.ok;
+}
 function toSession(body, host) {
     var _a;
     const user = ((_a = body.user) !== null && _a !== void 0 ? _a : {});
@@ -279,6 +343,16 @@ function throwIfNotConfigured(response, host, body) {
     throw preconditionError(`${host} does not have CLI login configured.`, `Ask the Ekanos operator to provision the "Fusion CLI" Auth0 ` +
         `application and set AUTH0_CLI_CLIENT_ID on that deployment.`);
 }
+/** 429: the deployment is throttling this machine's address. Retryable. */
+function throwIfRateLimited(response, host) {
+    var _a;
+    if (response.status !== 429)
+        return;
+    const retryAfter = Number.parseInt((_a = response.headers.get('retry-after')) !== null && _a !== void 0 ? _a : '', 10);
+    throw networkError(`${host} is rate-limiting sign-in requests from this address.`, Number.isFinite(retryAfter) && retryAfter > 0
+        ? `Retry in ${retryAfter} seconds.`
+        : `Retry in a few minutes.`);
+}
 function unexpectedStatus(host, route, status) {
     return networkError(`${host}${route} responded ${status}.`, status >= 500
         ? `The Ekanos deployment returned a server error. Retry shortly; if it ` +
@@ -286,6 +360,18 @@ function unexpectedStatus(host, route, status) {
         : `Confirm the host is an Ekanos deployment running a build that ` +
             `includes ${route}.`);
 }
+/**
+ * Every Ekanos tenant signs in on an `*.auth0.com` domain today
+ * (`fusion-{dev,stage,prod}.us.auth0.com`). If one moves to an Auth0 custom
+ * domain, add that domain here.
+ */
+function assertAuth0Domain(domain) {
+    const hostname = domain.toLowerCase();
+    if (/^[a-z0-9-]+(\.[a-z0-9-]+)*\.auth0\.com$/.test(hostname))
+        return;
+    throw preconditionError(`The login configuration names a sign-in domain that is not Auth0 (${domain}).`, `Do not continue. Report this to the operator of the Ekanos ` +
+        `deployment — it may be misconfigured or compromised.`);
+}
 function assertOnDomain(endpoint, domain) {
     let url;
     try {