@ekanos/cli 0.12.0 → 0.14.0

package/dist/commands/teams.js

@@ -1,39 +1,67 @@
+var __rest = (this && this.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
+import { loginHint } from '../auth/host-trust.js';
 import { refreshStoredSession, requireSession, resolveAuthEnvironment, } from '../auth/session.js';
 import { authRequiredError, invalidStateError, usageError, validationError, } from '../errors.js';
+import { ensureSecretsDir, writeSecretFile } from '../secret-file.js';
 import { resolveSourceTarget } from '../source-target.js';
 import { listTeams, mintTeamWebhook, setTeamApp, showTeamIntegration, } from '../teams-api.js';
 import { promptHidden, promptLine } from './apps.js';
+import { scopeHiddenLines } from './scope-notice.js';
 import { isTeamAgentArea, runTeamAgentCommands } from './team-agents.js';
+import { runTeamEvents } from './teams-events.js';
 import { ONBOARDING_SUBCOMMANDS, isOnboardingSubcommand, parseOnboarding, runOnboarding, } from './teams-onboard.js';
+import { runTeamOverview } from './teams-overview.js';
+import { runTeamScope } from './teams-scope.js';
 export const TEAMS_SUBCOMMANDS = [
     'list',
     'show',
     'app',
     'webhook',
+    'events',
+    'scope',
     ...ONBOARDING_SUBCOMMANDS,
 ];
 /**
  * `teams` — a Source admin's view of its teams' integration setup, the
  * team-level counterpart of `apps`. `list` names the teams; `show` reads one
- * team's setup of one product as a checklist; `app set` enters a team's own
- * app (Zendesk's subdomain, client and signing secret) at the admin's
- * terminal — never from a flag, a file or a non-interactive run, so an
- * agent driving the CLI never handles a secret; `webhook` mints the URL the
+ * team's setup of one product as a checklist; `app set` enters or updates
+ * any of a team's own app fields (Zendesk's subdomain, client and signing
+ * secret), one at a time if need be — a field left alone keeps its saved
+ * value. Secrets are only ever typed at the admin's terminal, never from a
+ * flag, a file or a non-interactive run, so an agent driving the CLI never
+ * handles one; a non-secret field may be passed as `--set name=value`; `webhook` mints the URL the
  * team's provider sends to, shown once.
  */
 export async function runTeams(ctx, args) {
+    var _a;
     const [rawSubcommand, ...rest] = args.positionals;
     if (isTeamAgentArea(rawSubcommand)) {
         return runTeamAgentCommands(ctx, args);
     }
     const subcommand = parseSubcommand(rawSubcommand);
+    if (subcommand === 'events') {
+        return runTeamEvents(ctx, args, rest);
+    }
+    if (subcommand === 'scope') {
+        return runTeamScope(ctx, args, rest);
+    }
     if (isOnboardingSubcommand(subcommand)) {
-        const plan = parseOnboarding(subcommand, rest, args);
+        const plan = parseOnboarding(subcommand, rest, Object.assign(Object.assign({}, args), { as: typeof ((_a = args.flags) === null || _a === void 0 ? void 0 : _a.as) === 'string' ? args.flags.as : undefined }));
         const env = resolveAuthEnvironment(ctx, args.host, args.env, {
             projectDir: args.dir,
         });
-        const resolved = await resolveSourceTarget(env, requireSession(env.store, env.host), args);
-        return runOnboarding(ctx, new TeamsClient(env, resolved.session), env.host, resolved.source, plan);
+        const resolved = await resolveSourceTarget(env, requireSession(env), args);
+        return runOnboarding(ctx, args, new TeamsClient(env, resolved.session), env.host, resolved.source, plan);
     }
     if (subcommand === 'app' && rest[0] !== 'set') {
         throw usageError(rest[0]
@@ -45,18 +73,23 @@ export async function runTeams(ctx, args) {
         throw usageError('teams list takes no arguments.', 'Run "ekanos teams list --source <slug>".');
     }
     const team = subcommand === 'list' ? '' : requireSlug(operands[0], 'team');
-    const product = subcommand === 'list' ? '' : requireSlug(operands[1], 'product');
+    // `teams show <team>` alone is the team's overview.
+    const overview = subcommand === 'show' && operands[1] === undefined;
+    const product = subcommand === 'list' || overview
+        ? ''
+        : requireSlug(operands[1], 'product');
     const extra = operands.slice(subcommand === 'webhook' ? 3 : 2);
+    const appEdits = subcommand === 'app' ? parseAppEdits(args.flags) : null;
     if (subcommand !== 'list' && extra.length > 0) {
         throw usageError(`Unexpected argument "${extra[0]}".`, 'See "ekanos teams --help".');
     }
-    if (subcommand === 'app' && !canPrompt(ctx, args)) {
-        throw usageError("teams app set takes the team's secrets at a terminal, never in a script or an agent run.", `Run it yourself in your terminal: npx @ekanos/cli teams app set ${team} ${product}${args.connection ? ` --connection ${args.connection}` : ''}${args.source ? ` --source ${args.source}` : ''}`);
+    if ((appEdits === null || appEdits === void 0 ? void 0 : appEdits.prompts) && !canPrompt(ctx, args)) {
+        throw usageError("teams app set takes the team's secrets at a terminal, never in a script or an agent run. Non-secret fields can be passed with --set <name>=<value>.", `Run it yourself in your terminal: npx @ekanos/cli teams app set ${team} ${product}${args.connection ? ` --connection ${args.connection}` : ''}${args.source ? ` --source ${args.source}` : ''}`);
     }
     const env = resolveAuthEnvironment(ctx, args.host, args.env, {
         projectDir: args.dir,
     });
-    const resolved = await resolveSourceTarget(env, requireSession(env.store, env.host), args);
+    const resolved = await resolveSourceTarget(env, requireSession(env), args);
     const client = new TeamsClient(env, resolved.session);
     const source = resolved.source;
     if (subcommand === 'list') {
@@ -73,63 +106,156 @@ export async function runTeams(ctx, args) {
                     `${entry.name} · ${entry.memberCount} member${entry.memberCount === 1 ? '' : 's'}`,
                 ]),
                 notes: [
-                    '"ekanos teams show <team> <product>" shows a team\'s setup.',
+                    '"ekanos teams show <team>" shows a team\'s setup; add a product for its checklist.',
                 ],
             }));
     }
+    if (overview) {
+        return runTeamOverview(ctx, client, env.host, source, team);
+    }
     const target = { source, team, product };
     const status = await client.call((token) => showTeamIntegration(env.host, token, target));
     if (subcommand === 'show') {
         return ctx.succeed(Object.assign({ host: env.host }, status), checklist(status).join('\n'));
     }
     if (!status.enabled) {
-        throw invalidStateError(`"${product}" is not enabled on ${status.source.slug}.`, '"ekanos catalog" lists what this Source has; Ekanos enables a product for a Source.');
+        throw invalidStateError(`"${product}" is not enabled on ${status.source.slug}.`, `"ekanos sources products --source ${status.source.slug}" shows what it has; only a super-admin enables a product for a Source (in /admin).`);
     }
-    if (subcommand === 'app') {
-        return setApp(ctx, args, client, env.host, target, status);
+    if (subcommand === 'app' && appEdits) {
+        return setApp(ctx, args, client, env.host, target, status, appEdits);
     }
     return mintWebhook(ctx, args, client, env.host, target, status, operands[2]);
 }
-async function setApp(ctx, args, client, host, target, status) {
-    var _a, _b;
-    const app = chooseApp(status, args.connection);
-    ctx.log(appWalkthrough(status, app).join('\n'));
-    const fields = {};
-    for (const field of app.fields) {
-        const keep = field.set ? ' (set — Enter keeps it)' : '';
-        const question = field.sensitive
-            ? `${field.label}${keep} (hidden): `
-            : `${field.label}${keep}: `;
-        const value = (await (field.sensitive
-            ? ((_a = args.askSecret) !== null && _a !== void 0 ? _a : promptHidden)
-            : ((_b = args.ask) !== null && _b !== void 0 ? _b : promptLine))(question)).trim();
-        if (value)
-            fields[field.secretName] = value;
-    }
-    const missing = app.fields.filter((field) => !field.set && !fields[field.secretName]);
-    if (missing.length > 0) {
-        throw validationError(`Every field is needed: ${missing.map((field) => field.label).join(', ')}.`, `Run "ekanos teams app set ${target.team} ${target.product}" again.`);
-    }
-    if (Object.keys(fields).length === 0) {
-        throw validationError('Nothing was changed.', `Run "ekanos teams show ${target.team} ${target.product}" to see the current state.`);
+function parseAppEdits(flags) {
+    const list = (name) => {
+        const raw = flags === null || flags === void 0 ? void 0 : flags[name];
+        if (raw === undefined || raw === false)
+            return [];
+        if (Array.isArray(raw))
+            return raw;
+        return typeof raw === 'string' ? [raw] : [];
+    };
+    const values = {};
+    for (const pair of list('set')) {
+        const at = pair.indexOf('=');
+        if (at <= 0) {
+            throw usageError(`--set "${pair}" is not <field>=<value>.`, 'For example: --set subdomain=acme. Secrets are never passed as arguments: use --field <name> and enter it at the prompt.');
+        }
+        values[pair.slice(0, at).trim()] = pair.slice(at + 1).trim();
     }
-    const result = await client.call((token) => setTeamApp(host, token, target, {
-        connectionId: app.connectionId,
-        fields,
-    }));
-    const next = nextSteps(status, app, target);
+    const only = list('field');
+    const clear = list('clear');
+    return {
+        only,
+        values,
+        clear,
+        // Bare `app set` walks every field; `--field` asks the named ones.
+        prompts: only.length > 0 ||
+            (Object.keys(values).length === 0 && clear.length === 0),
+    };
+}
+async function setApp(ctx, args, client, host, target, status, edits) {
+    const app = chooseApp(status, args.connection);
+    const result = await promptAndSaveTeamApp(ctx, args, client, host, target, status, app, edits);
+    const missing = result.fields.filter((field) => !field.set);
+    const next = [
+        ...(missing.length > 0
+            ? [
+                `Still not set: ${missing.map((field) => field.label).join(', ')} — a team member can't connect until it is. Run "ekanos teams app set ${target.team} ${target.product} ${missing.map((field) => `--field ${field.secretName}`).join(' ')}".`,
+            ]
+            : []),
+        ...nextSteps(status, app, target),
+    ];
     return ctx.succeed(Object.assign({ host }, result), ctx.ui.result({
         title: `Saved ${target.team}'s ${result.product.name} app`,
         rows: [
             ['Source', status.source.slug],
-            [
-                'Fields',
-                result.fields.map((field) => `${mark(field.set)} ${field.label}`),
-            ],
+            ['Fields', result.fields.map(fieldLine)],
         ],
         notes: next,
     }));
 }
+/** Every field, asked in turn: bare `teams app set`, and `teams connect`. */
+const WALK_EVERY_FIELD = {
+    only: [],
+    values: {},
+    clear: [],
+    prompts: true,
+};
+/**
+ * The `teams app set` walkthrough and prompts for one team app, then the
+ * save — of only what was entered: a field left empty keeps its saved value.
+ * Shared with `teams connect`, which runs it inline when the integration
+ * needs the team's own app (Zendesk) before anyone can sign in.
+ */
+export async function promptAndSaveTeamApp(ctx, args, client, host, target, status, app, edits = WALK_EVERY_FIELD) {
+    var _a;
+    var _b, _c;
+    const known = new Map(app.fields.map((field) => [field.secretName, field]));
+    const names = app.fields.map((field) => field.secretName).join(', ');
+    for (const name of [
+        ...edits.only,
+        ...Object.keys(edits.values),
+        ...edits.clear,
+    ]) {
+        if (!known.has(name)) {
+            throw usageError(`${status.product.name}'s team app has no field "${name}".`, `Its fields are: ${names}.`);
+        }
+    }
+    for (const name of Object.keys(edits.values)) {
+        if ((_a = known.get(name)) === null || _a === void 0 ? void 0 : _a.sensitive) {
+            throw usageError(`"${name}" is a secret: it is never passed as an argument.`, `Enter it at the prompt: ekanos teams app set ${target.team} ${target.product} --field ${name}`);
+        }
+    }
+    const fields = Object.assign({}, edits.values);
+    if (edits.prompts) {
+        const toAsk = edits.only.length > 0
+            ? app.fields.filter((field) => edits.only.includes(field.secretName))
+            : app.fields;
+        if (edits.only.length === 0)
+            ctx.log(appWalkthrough(status, app).join('\n'));
+        else {
+            ctx.log(`${status.product.name} app for team ${target.team} on ${status.source.slug}`);
+        }
+        for (const field of toAsk) {
+            const value = (await (field.sensitive
+                ? ((_b = args.askSecret) !== null && _b !== void 0 ? _b : promptHidden)
+                : ((_c = args.ask) !== null && _c !== void 0 ? _c : promptLine))(fieldQuestion(field))).trim();
+            if (value)
+                fields[field.secretName] = value;
+        }
+    }
+    if (Object.keys(fields).length === 0 && edits.clear.length === 0) {
+        throw validationError('Nothing was changed.', `Run "ekanos teams show ${target.team} ${target.product}" to see the current state.`);
+    }
+    return client.call((token) => setTeamApp(host, token, target, Object.assign({ connectionId: app.connectionId, fields }, (edits.clear.length > 0 ? { clear: edits.clear } : {}))));
+}
+/** The prompt for one field: what is saved, and that Enter keeps it. */
+function fieldQuestion(field) {
+    const name = `${field.label} [${field.secretName}]`;
+    if (field.sensitive) {
+        return field.set
+            ? `${name} (saved — Enter to keep, hidden): `
+            : `${name} (hidden): `;
+    }
+    if (field.set) {
+        return field.value
+            ? `${name} (current: ${field.value} — Enter to keep): `
+            : `${name} (saved — Enter to keep): `;
+    }
+    return `${name}: `;
+}
+/** One field's state: a secret only as saved / not set, never its value. */
+function fieldLine(field) {
+    const state = !field.set
+        ? 'not set'
+        : field.sensitive
+            ? 'saved'
+            : field.value
+                ? field.value
+                : 'saved';
+    return `${mark(field.set)} ${field.label} (${field.secretName}): ${state}`;
+}
 async function mintWebhook(ctx, args, client, host, target, status, requested) {
     const webhooks = status.teamApps.flatMap((app) => app.webhooks);
     if (webhooks.length === 0) {
@@ -148,19 +274,29 @@ async function mintWebhook(ctx, args, client, host, target, status, requested) {
     if (webhook.endpoint && !args.yes) {
         throw invalidStateError(`${target.team} already has a live URL for ${webhook.webhookId} (${webhook.endpoint.tokenPrefix}…). A new one revokes it, and the provider's webhook stops working until you paste the new URL there.`, `Re-run with --yes when you are ready to update the provider: ekanos teams webhook ${target.team} ${target.product} ${webhook.webhookId} --yes`);
     }
+    // The URL carries its token, so it goes to a 0600 file, never the output.
+    const secrets = ensureSecretsDir(args.env);
     const minted = await client.call((token) => mintTeamWebhook(host, token, target, webhook.webhookId));
-    return ctx.succeed(Object.assign({ host }, minted), ctx.ui.result({
+    const { url } = minted, rest = __rest(minted, ["url"]);
+    const secretFile = writeSecretFile(secrets, {
+        owner: target.team,
+        what: `${target.product}-${webhook.webhookId}-webhook-url`,
+        purpose: `Webhook URL for team ${target.team}'s ${status.product.name} (${webhook.webhookId}). Paste it into ${status.product.name}'s webhook settings for this team; the token is part of the URL.`,
+        values: [['WEBHOOK_URL', url]],
+        again: `ekanos teams webhook ${target.team} ${target.product} ${webhook.webhookId} --yes`,
+    });
+    return ctx.succeed(Object.assign(Object.assign({ host }, rest), { secretFile }), ctx.ui.result({
         title: `Webhook URL for ${target.team} · ${webhook.webhookId}`,
         tone: 'warn',
         rows: [
-            ['URL', minted.url],
+            ['URL', `saved to ${secretFile} (readable only by you)`],
             [
                 'Paste it into',
                 `${status.product.name}'s webhook settings for this team`,
             ],
         ],
         notes: [
-            'This URL is shown once and cannot be read again. Paste it now.',
+            'The URL carries its token, so it is shown nowhere else and cannot be read again. Copy it from that file into the provider yourself — not into a chat or an agent session — then delete the file.',
             ...(minted.replaced
                 ? ['The previous URL is revoked: the provider must use this one.']
                 : []),
@@ -176,10 +312,12 @@ export function checklist(status) {
         `  ${mark(status.enabled)} Enabled on the Source`,
     ];
     if (!status.enabled) {
-        lines.push('    "ekanos catalog" lists what this Source has; Ekanos enables a product for a Source.');
+        lines.push(`    "ekanos sources products --source ${status.source.slug}" shows what it has; only a super-admin enables a product for a Source (in /admin).`);
         return lines;
     }
     const target = { team: status.team.slug, product: status.product.slug };
+    lines.push(...scopeHiddenLines(status.scope, Object.assign(Object.assign({}, target), { source: status.source.slug })).map((line) => `  ${line}`));
+    lines.push(...connectionLines(status));
     for (const app of status.teamApps) {
         lines.push(`  Team app: ${app.label} (${app.connectionId})`);
         if ((_a = app.setup) === null || _a === void 0 ? void 0 : _a.consoleUrl)
@@ -190,10 +328,11 @@ export function checklist(status) {
         if (app.guideUrl)
             lines.push(`    Guide: ${app.guideUrl}`);
         for (const field of app.fields) {
-            lines.push(`    ${mark(field.set)} ${field.label}`);
+            lines.push(`    ${fieldLine(field)}`);
         }
-        if (app.fields.some((field) => !field.set)) {
-            lines.push(`      → in your terminal: npx @ekanos/cli teams app set ${target.team} ${target.product} --connection ${app.connectionId} --source ${status.source.slug}`);
+        const unset = app.fields.filter((field) => !field.set);
+        if (unset.length > 0) {
+            lines.push(`      → in your terminal: npx @ekanos/cli teams app set ${target.team} ${target.product} --connection ${app.connectionId} ${unset.map((field) => `--field ${field.secretName}`).join(' ')} --source ${status.source.slug}`);
         }
         for (const webhook of app.webhooks) {
             lines.push(webhook.endpoint
@@ -205,11 +344,11 @@ export function checklist(status) {
         }
         lines.push(app.connection
             ? `    ${mark(true)} Connected ${day(app.connection.connectedAt)}${app.connection.connectedBy ? ` by ${who(app.connection.connectedBy)}` : ''}`
-            : `    ${mark(false)} Connected: a team member clicks Connect at ${status.connectUrl}`);
+            : `    ${mark(false)} Connected: not yet\n      → in your terminal: ${connectCommand(status, app.connectionId)}`);
     }
     lines.push(status.activation
         ? `  ${mark(true)} Activated for the team${status.activation.activatedAt ? ` ${day(status.activation.activatedAt)}` : ''}${status.activation.activatedBy ? ` by ${who(status.activation.activatedBy)}` : ''}`
-        : `  ${mark(false)} Activated: a team member connects at ${status.connectUrl}`);
+        : `  ${mark(false)} Activated: not yet\n    → in your terminal: ${connectCommand(status)}`);
     lines.push(`  Team page: ${status.connectUrl}`);
     if (status.agentEvents.length > 0) {
         lines.push('  Agent events it offers:');
@@ -217,6 +356,61 @@ export function checklist(status) {
     }
     return lines;
 }
+/**
+ * Each OAuth connection in one line — connected, or installed for a named
+ * one, with its app's credentials and webhook URL — and which of the team's
+ * agents wait on it. A named connection an agent's trigger needs and the team
+ * has not installed is the gap no other line names: the trigger is stored
+ * and on, and nothing ever reaches it.
+ */
+function connectionLines(status) {
+    var _a, _b, _c, _d;
+    const connections = (_a = status.connections) !== null && _a !== void 0 ? _a : [];
+    if (connections.length === 0)
+        return [];
+    const lines = ['  Connections:'];
+    for (const entry of connections) {
+        const named = entry.connectionId !== 'default';
+        const app = status.teamApps.find((candidate) => candidate.connectionId === entry.connectionId);
+        const webhooks = (_b = app === null || app === void 0 ? void 0 : app.webhooks) !== null && _b !== void 0 ? _b : [];
+        const steps = [
+            ...(entry.credentialsSaved === null
+                ? []
+                : [
+                    `app credentials ${entry.credentialsSaved ? 'saved' : 'not saved'}`,
+                ]),
+            named
+                ? entry.connected
+                    ? `installed ${day((_c = entry.connectedAt) !== null && _c !== void 0 ? _c : '')}`
+                    : 'not installed'
+                : entry.connected
+                    ? `connected ${day((_d = entry.connectedAt) !== null && _d !== void 0 ? _d : '')}`
+                    : 'not connected',
+            ...(webhooks.length > 0
+                ? [
+                    webhooks.every((webhook) => webhook.endpoint)
+                        ? 'webhook URL made'
+                        : 'no webhook URL',
+                ]
+                : []),
+        ];
+        const ready = entry.connected &&
+            entry.credentialsSaved !== false &&
+            webhooks.every((webhook) => webhook.endpoint);
+        lines.push(`    ${mark(ready)} ${entry.label} (${entry.connectionId}): ${steps.join(' · ')}${entry.connectedBy ? ` by ${who(entry.connectedBy)}` : ''}`);
+        if (entry.neededBy.length > 0) {
+            lines.push(`      Needed by: ${entry.neededBy.map((need) => `${need.agent} (${need.triggers.join(', ')})`).join(', ')}`);
+        }
+        if (!entry.connected) {
+            lines.push(`      → in your terminal: ${connectCommand(status, entry.connectionId)}`);
+        }
+    }
+    return lines;
+}
+/** The command that connects the team, for a hint: `--connection` only for a named one. */
+function connectCommand(status, connectionId = 'default') {
+    return `npx @ekanos/cli teams connect ${status.team.slug} ${status.product.slug}${connectionId === 'default' ? '' : ` --connection ${connectionId}`} --source ${status.source.slug}`;
+}
 function appWalkthrough(status, app) {
     var _a, _b;
     const lines = [
@@ -242,10 +436,10 @@ function nextSteps(status, app, target) {
             .map((webhook) => `Next: "ekanos teams webhook ${target.team} ${target.product} ${webhook.webhookId}" for the provider's webhook URL.`),
         ...(app.connection
             ? []
-            : [`Then a team member clicks Connect at ${status.connectUrl}`]),
+            : [`Then connect it: ${connectCommand(status, app.connectionId)}`]),
     ];
 }
-function chooseApp(status, connection) {
+export function chooseApp(status, connection) {
     const apps = status.teamApps;
     if (apps.length === 0) {
         throw invalidStateError(`${status.product.name} takes no team app: teams connect through the Source's app, or need none.`, `Run "ekanos apps show ${status.product.slug}" for the Source's app.`);
@@ -274,10 +468,10 @@ export class TeamsClient {
         }
         if (result.status === 'ok')
             return result.data;
-        throw authRequiredError(`The session for ${this.env.host} could not authorize the teams call.`, `Run "ekanos login --host ${this.env.host}" and retry.`);
+        throw authRequiredError(`The session for ${this.env.host} could not authorize the teams call.`, loginHint(this.env));
     }
 }
-function canPrompt(ctx, args) {
+export function canPrompt(ctx, args) {
     var _a;
     return !ctx.jsonMode && ((_a = args.stdinIsTTY) !== null && _a !== void 0 ? _a : process.stdin.isTTY === true);
 }
@@ -287,7 +481,7 @@ function parseSubcommand(value) {
         return match;
     throw usageError(value
         ? `Unknown teams subcommand "${value}".`
-        : 'teams needs a subcommand.', 'Run one of: ekanos teams list, ekanos teams create <name>, ekanos teams members list <team>, ekanos teams roles list <team>, ekanos teams connect <team> <product>, ekanos teams show <team> <product>, ekanos teams app set <team> <product>, ekanos teams webhook <team> <product> [<webhook-id>], ekanos teams agents|triggers|links|mcp ….');
+        : 'teams needs a subcommand.', 'Run one of: ekanos teams list, ekanos teams create <name>, ekanos teams rename <team> <name>, ekanos teams members list <team>, ekanos teams roles list <team>, ekanos teams connect <team> <product>, ekanos teams disconnect <team> <product> --yes, ekanos teams show <team> [<product>], ekanos teams app set <team> <product>, ekanos teams webhook <team> <product> [<webhook-id>], ekanos teams events <team> [<product>], ekanos teams scope show|set <team> …, ekanos teams agents|triggers|links|mcp ….');
 }
 function requireSlug(value, what) {
     const slug = value === null || value === void 0 ? void 0 : value.trim().toLowerCase();