@ekanos/cli 0.13.0 → 0.15.0

package/dist/source-products-api.js.map

@@ -1 +1 @@
-{"version":3,"file":"source-products-api.js","sourceRoot":"","sources":["../src/source-products-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACb,UAAU,GACX,MAAM,UAAU,CAAC;AAElB;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;IAC3C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;IAC9C,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;CACxB,CAAC,CAAC;AAGH,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,MAAM,EAAE,eAAe;IACvB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;CACvB,CAAC,CAAC;AACH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,MAAM,EAAE,eAAe;IACvB,OAAO,EAAE,mBAAmB;IAC5B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC;AAMH,MAAM,UAAU,kBAAkB,CAChC,IAAY,EACZ,KAAa,EACb,MAAc;IAEd,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE;QACnC,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,iCAAiC,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE;KACzE,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,KAAa,EACb,KAA4D;IAE5D,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE;QACrC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;QACxC,IAAI,EAAE,iCAAiC,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;KAC5H,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,IAAI,CACjB,IAAY,EACZ,WAAmB,EACnB,MAAoB,EACpB,IAAwD;IAExD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE;QACpD,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,UAAU,WAAW,EAAE;SACvC;KACF,CAAC,CAAC;IAEH,IACE,QAAQ,CAAC,MAAM,KAAK,GAAG;QACvB,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,EACjD,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACpC,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,MAAM,OAAO,GACX,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAEnE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QACvD,MAAM,iBAAiB,CACrB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,GAAG,IAAI,wCAAwC,EAC1D,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,sBAAsB,EAAE,CAAC;QAC/D,MAAM,cAAc,CAClB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,oDAAoD,EAC/D,2HAA2H,CAC5H,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,cAAc,CAClB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,+BAA+B,EAC1C,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,aAAa,CACjB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,YAAY,EACvB,IAAI,KAAK,mBAAmB;YAC1B,CAAC,CAAC,8CAA8C;YAChD,CAAC,CAAC,8DAA8D,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,iBAAiB,CACrB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,8BAA8B,EACzC,uDAAuD,CACxD,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,UAAU,CACd,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,+BAA+B,EAC1C,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,YAAY,CAChB,GAAG,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,QAAQ,CAAC,MAAM,GAAG,EACjE,QAAQ,CAAC,MAAM,IAAI,GAAG;YACpB,CAAC,CAAC,+DAA+D;YACjE,CAAC,CAAC,yEAAyE,CAC9E,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,YAAY,CAChB,GAAG,IAAI,2EAA2E,EAClF,uFAAuF,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC7C,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,QAAkB;IAElB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC9C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAClD,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;eAAO,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["import { z } from 'zod';\n\nimport { request } from './auth/ekanos-api';\nimport {\n  authRequiredError,\n  forbiddenError,\n  invalidStateError,\n  networkError,\n  notFoundError,\n  usageError,\n} from './errors';\n\n/**\n * The CLI's client for a Source's products (`ekanos sources products`).\n *\n *   GET    /api/partner/sources/products?source=<slug|id>\n *     → { source, products: [{ slug, name, kind, enabled, lever, registered }], canEnable }\n *   PUT    /api/partner/sources/products/<product>?source=<slug|id>   enable\n *   DELETE /api/partner/sources/products/<product>?source=<slug|id>   disable\n *     → { source, product, changed }\n *\n *   → 401 / 3xx  refresh once and retry\n *   → 403 SUPER_ADMIN_REQUIRED   enabling is a super-admin grant, which an\n *                                `ekanos login` session never carries\n *   → 409 REFUSED                a dependency or demo-only guard refused\n *\n * The shapes are read here rather than from `@ekanos/integration-schema`, so\n * this CLI works against a host without a schema release.\n */\n\nconst SourceRefSchema = z.object({\n  id: z.string(),\n  slug: z.string(),\n  name: z.string().nullable(),\n});\n\nexport const SourceProductSchema = z.object({\n  slug: z.string(),\n  name: z.string(),\n  kind: z.enum(['experience', 'integration']),\n  enabled: z.boolean(),\n  lever: z.enum(['flag', 'plan', 'entitlement']),\n  registered: z.boolean(),\n});\nexport type SourceProduct = z.infer<typeof SourceProductSchema>;\n\nconst ListSchema = z.object({\n  source: SourceRefSchema,\n  products: z.array(SourceProductSchema),\n  canEnable: z.boolean(),\n});\nconst ChangeSchema = z.object({\n  source: SourceRefSchema,\n  product: SourceProductSchema,\n  changed: z.boolean(),\n});\n\nexport type SourceProductsApiResult<T> =\n  | { status: 'ok'; data: T }\n  | { status: 'unauthorized' };\n\nexport function listSourceProducts(\n  host: string,\n  token: string,\n  source: string,\n) {\n  return call(host, token, ListSchema, {\n    method: 'GET',\n    path: `/api/partner/sources/products?${new URLSearchParams({ source })}`,\n  });\n}\n\nexport function setSourceProduct(\n  host: string,\n  token: string,\n  input: { source: string; product: string; enabled: boolean },\n) {\n  return call(host, token, ChangeSchema, {\n    method: input.enabled ? 'PUT' : 'DELETE',\n    path: `/api/partner/sources/products/${encodeURIComponent(input.product)}?${new URLSearchParams({ source: input.source })}`,\n  });\n}\n\nasync function call<T>(\n  host: string,\n  accessToken: string,\n  schema: z.ZodType<T>,\n  init: { method: 'GET' | 'PUT' | 'DELETE'; path: string },\n): Promise<SourceProductsApiResult<T>> {\n  const response = await request(`${host}${init.path}`, {\n    method: init.method,\n    headers: {\n      accept: 'application/json',\n      authorization: `Bearer ${accessToken}`,\n    },\n  });\n\n  if (\n    response.status === 401 ||\n    (response.status >= 300 && response.status < 400)\n  ) {\n    return { status: 'unauthorized' };\n  }\n\n  const body = await readOptionalJson(response);\n  const code = typeof body.code === 'string' ? body.code : null;\n  const message =\n    typeof body.error === 'string' && body.error ? body.error : null;\n\n  if (response.status === 403 && code === 'MFA_REQUIRED') {\n    throw authRequiredError(\n      message ?? `${host} requires multi-factor authentication.`,\n      'Complete MFA in the browser, then run \"ekanos login\" again.',\n    );\n  }\n  if (response.status === 403 && code === 'SUPER_ADMIN_REQUIRED') {\n    throw forbiddenError(\n      message ?? 'Only a super-admin enables a product for a Source.',\n      'A super-admin does it in the browser: /admin/sources → the Source → Products (Experiences are switched on the same page).',\n    );\n  }\n  if (response.status === 403) {\n    throw forbiddenError(\n      message ?? 'Not permitted on this Source.',\n      'Run \"ekanos sources\" to list the sources you hold a seat on.',\n    );\n  }\n  if (response.status === 404) {\n    throw notFoundError(\n      message ?? 'Not found.',\n      code === 'PRODUCT_NOT_FOUND'\n        ? '\"ekanos sources products\" lists the catalog.'\n        : 'Run \"ekanos sources\" to list the sources you hold a seat on.',\n    );\n  }\n  if (response.status === 409) {\n    throw invalidStateError(\n      message ?? 'The host refused the change.',\n      '\"ekanos sources products\" shows what this Source has.',\n    );\n  }\n  if (response.status === 400) {\n    throw usageError(\n      message ?? 'The host refused the request.',\n      'See \"ekanos sources --help\".',\n    );\n  }\n  if (!response.ok) {\n    throw networkError(\n      `${host}${init.path.split('?')[0]} responded ${response.status}.`,\n      response.status >= 500\n        ? 'The Ekanos deployment returned a server error. Retry shortly.'\n        : 'Confirm the host runs a build that includes the source products routes.',\n    );\n  }\n\n  const parsed = schema.safeParse(body.data);\n  if (!parsed.success) {\n    throw networkError(\n      `${host}/api/partner/sources/products answered in a shape this CLI does not read.`,\n      'Run \"ekanos upgrade\" — the CLI and the host disagree on the source products contract.',\n    );\n  }\n  return { status: 'ok', data: parsed.data };\n}\n\nasync function readOptionalJson(\n  response: Response,\n): Promise<Record<string, unknown>> {\n  try {\n    const parsed: unknown = await response.json();\n    return typeof parsed === 'object' && parsed !== null\n      ? (parsed as Record<string, unknown>)\n      : {};\n  } catch {\n    return {};\n  }\n}\n"]}
+{"version":3,"file":"source-products-api.js","sourceRoot":"","sources":["../src/source-products-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACb,UAAU,GACX,MAAM,UAAU,CAAC;AAElB;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;IAC3C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;IAC9C,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IACvB;uDACmD;IACnD,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC7C,CAAC,CAAC;AAGH,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,MAAM,EAAE,eAAe;IACvB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACtD,CAAC,CAAC;AACH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,MAAM,EAAE,eAAe;IACvB,OAAO,EAAE,mBAAmB;IAC5B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC;AAMH,MAAM,UAAU,kBAAkB,CAChC,IAAY,EACZ,KAAa,EACb,MAAc;IAEd,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE;QACnC,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,iCAAiC,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE;KACzE,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,KAAa,EACb,KAA4D;IAE5D,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE;QACrC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;QACxC,IAAI,EAAE,iCAAiC,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;KAC5H,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,IAAI,CACjB,IAAY,EACZ,WAAmB,EACnB,MAAoB,EACpB,IAAwD;IAExD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE;QACpD,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,UAAU,WAAW,EAAE;SACvC;KACF,CAAC,CAAC;IAEH,IACE,QAAQ,CAAC,MAAM,KAAK,GAAG;QACvB,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,EACjD,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACpC,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,MAAM,OAAO,GACX,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAEnE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QACvD,MAAM,iBAAiB,CACrB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,GAAG,IAAI,wCAAwC,EAC1D,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,sBAAsB,EAAE,CAAC;QAC/D,MAAM,cAAc,CAClB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,uDAAuD,EAClE,wMAAwM,CACzM,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,uBAAuB,EAAE,CAAC;QAChE,MAAM,cAAc,CAClB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,8DAA8D,EACzE,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,cAAc,CAClB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,+BAA+B,EAC1C,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,aAAa,CACjB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,YAAY,EACvB,IAAI,KAAK,mBAAmB;YAC1B,CAAC,CAAC,8CAA8C;YAChD,CAAC,CAAC,8DAA8D,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,iBAAiB,CACrB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,8BAA8B,EACzC,uDAAuD,CACxD,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,UAAU,CACd,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,+BAA+B,EAC1C,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,YAAY,CAChB,GAAG,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,QAAQ,CAAC,MAAM,GAAG,EACjE,QAAQ,CAAC,MAAM,IAAI,GAAG;YACpB,CAAC,CAAC,+DAA+D;YACjE,CAAC,CAAC,yEAAyE,CAC9E,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,YAAY,CAChB,GAAG,IAAI,2EAA2E,EAClF,uFAAuF,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC7C,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,QAAkB;IAElB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC9C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAClD,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;eAAO,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["import { z } from 'zod';\n\nimport { request } from './auth/ekanos-api';\nimport {\n  authRequiredError,\n  forbiddenError,\n  invalidStateError,\n  networkError,\n  notFoundError,\n  usageError,\n} from './errors';\n\n/**\n * The CLI's client for a Source's products (`ekanos sources products`).\n *\n *   GET    /api/partner/sources/products?source=<slug|id>\n *     → { source, products: [{ slug, name, kind, enabled, lever, registered, owned }],\n *         canEnable, canEnableOwned }\n *   PUT    /api/partner/sources/products/<product>?source=<slug|id>   enable\n *   DELETE /api/partner/sources/products/<product>?source=<slug|id>   disable\n *     → { source, product, changed }\n *\n *   → 401 / 3xx  refresh once and retry\n *   → 403 SOURCE_ADMIN_REQUIRED  no Source admin seat on the Source\n *   → 403 SUPER_ADMIN_REQUIRED   not an integration the Source built: a\n *                                super-admin grant, which an `ekanos login`\n *                                session never carries\n *   → 409 REFUSED                a dependency or demo-only guard refused\n *\n * The shapes are read here rather than from `@ekanos/integration-schema`, so\n * this CLI works against a host without a schema release.\n */\n\nconst SourceRefSchema = z.object({\n  id: z.string(),\n  slug: z.string(),\n  name: z.string().nullable(),\n});\n\nexport const SourceProductSchema = z.object({\n  slug: z.string(),\n  name: z.string(),\n  kind: z.enum(['experience', 'integration']),\n  enabled: z.boolean(),\n  lever: z.enum(['flag', 'plan', 'entitlement']),\n  registered: z.boolean(),\n  /** The Source built it, so its Source admin may switch it. Absent on an\n   * older host, which allowed no Source admin to. */\n  owned: z.boolean().optional().default(false),\n});\nexport type SourceProduct = z.infer<typeof SourceProductSchema>;\n\nconst ListSchema = z.object({\n  source: SourceRefSchema,\n  products: z.array(SourceProductSchema),\n  canEnable: z.boolean(),\n  canEnableOwned: z.boolean().optional().default(false),\n});\nconst ChangeSchema = z.object({\n  source: SourceRefSchema,\n  product: SourceProductSchema,\n  changed: z.boolean(),\n});\n\nexport type SourceProductsApiResult<T> =\n  | { status: 'ok'; data: T }\n  | { status: 'unauthorized' };\n\nexport function listSourceProducts(\n  host: string,\n  token: string,\n  source: string,\n) {\n  return call(host, token, ListSchema, {\n    method: 'GET',\n    path: `/api/partner/sources/products?${new URLSearchParams({ source })}`,\n  });\n}\n\nexport function setSourceProduct(\n  host: string,\n  token: string,\n  input: { source: string; product: string; enabled: boolean },\n) {\n  return call(host, token, ChangeSchema, {\n    method: input.enabled ? 'PUT' : 'DELETE',\n    path: `/api/partner/sources/products/${encodeURIComponent(input.product)}?${new URLSearchParams({ source: input.source })}`,\n  });\n}\n\nasync function call<T>(\n  host: string,\n  accessToken: string,\n  schema: z.ZodType<T>,\n  init: { method: 'GET' | 'PUT' | 'DELETE'; path: string },\n): Promise<SourceProductsApiResult<T>> {\n  const response = await request(`${host}${init.path}`, {\n    method: init.method,\n    headers: {\n      accept: 'application/json',\n      authorization: `Bearer ${accessToken}`,\n    },\n  });\n\n  if (\n    response.status === 401 ||\n    (response.status >= 300 && response.status < 400)\n  ) {\n    return { status: 'unauthorized' };\n  }\n\n  const body = await readOptionalJson(response);\n  const code = typeof body.code === 'string' ? body.code : null;\n  const message =\n    typeof body.error === 'string' && body.error ? body.error : null;\n\n  if (response.status === 403 && code === 'MFA_REQUIRED') {\n    throw authRequiredError(\n      message ?? `${host} requires multi-factor authentication.`,\n      'Complete MFA in the browser, then run \"ekanos login\" again.',\n    );\n  }\n  if (response.status === 403 && code === 'SUPER_ADMIN_REQUIRED') {\n    throw forbiddenError(\n      message ?? 'Only a super-admin enables this product for a Source.',\n      'A Source admin switches only the integrations their Source built. Anything else a super-admin does in the browser: /admin/sources → the Source → Products (Experiences are switched on the same page).',\n    );\n  }\n  if (response.status === 403 && code === 'SOURCE_ADMIN_REQUIRED') {\n    throw forbiddenError(\n      message ?? 'Switching a product needs a Source admin seat on the Source.',\n      'Run \"ekanos sources\" to see your seats; a Source admin grants the seat.',\n    );\n  }\n  if (response.status === 403) {\n    throw forbiddenError(\n      message ?? 'Not permitted on this Source.',\n      'Run \"ekanos sources\" to list the sources you hold a seat on.',\n    );\n  }\n  if (response.status === 404) {\n    throw notFoundError(\n      message ?? 'Not found.',\n      code === 'PRODUCT_NOT_FOUND'\n        ? '\"ekanos sources products\" lists the catalog.'\n        : 'Run \"ekanos sources\" to list the sources you hold a seat on.',\n    );\n  }\n  if (response.status === 409) {\n    throw invalidStateError(\n      message ?? 'The host refused the change.',\n      '\"ekanos sources products\" shows what this Source has.',\n    );\n  }\n  if (response.status === 400) {\n    throw usageError(\n      message ?? 'The host refused the request.',\n      'See \"ekanos sources --help\".',\n    );\n  }\n  if (!response.ok) {\n    throw networkError(\n      `${host}${init.path.split('?')[0]} responded ${response.status}.`,\n      response.status >= 500\n        ? 'The Ekanos deployment returned a server error. Retry shortly.'\n        : 'Confirm the host runs a build that includes the source products routes.',\n    );\n  }\n\n  const parsed = schema.safeParse(body.data);\n  if (!parsed.success) {\n    throw networkError(\n      `${host}/api/partner/sources/products answered in a shape this CLI does not read.`,\n      'Run \"ekanos upgrade\" — the CLI and the host disagree on the source products contract.',\n    );\n  }\n  return { status: 'ok', data: parsed.data };\n}\n\nasync function readOptionalJson(\n  response: Response,\n): Promise<Record<string, unknown>> {\n  try {\n    const parsed: unknown = await response.json();\n    return typeof parsed === 'object' && parsed !== null\n      ? (parsed as Record<string, unknown>)\n      : {};\n  } catch {\n    return {};\n  }\n}\n"]}

package/dist/source-target.js

@@ -1,3 +1,4 @@
+import { loginHint } from './auth/host-trust.js';
 import { readActiveSource } from './commands/sources.js';
 import { authRequiredError, validationError } from './errors.js';
 import { fetchSeatsWithOneRefresh } from './seats.js';
@@ -14,7 +15,7 @@ export async function resolveSourceTarget(env, session, args) {
         return { source: named, session };
     const seats = await fetchSeatsWithOneRefresh(env, session);
     if (seats.status !== 'ok') {
-        throw authRequiredError(`The session for ${env.host} could not list your sources.`, `Run "ekanos login --host ${env.host}" and retry.`);
+        throw authRequiredError(`The session for ${env.host} could not list your sources.`, loginHint(env));
     }
     if (seats.sources.length === 1) {
         return { source: seats.sources[0].slug, session: seats.session };

package/dist/source-target.js.map

@@ -1 +1 @@
-{"version":3,"file":"source-target.js","sourceRoot":"","sources":["../src/source-target.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,SAAS,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAoB,EACpB,OAAsB,EACtB,IAAsC;;IAEtC,MAAM,KAAK,GAAG,CAAA,MAAA,IAAI,CAAC,MAAM,0CAAE,IAAI,EAAE,KAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChE,IAAI,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAE7C,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC1B,MAAM,iBAAiB,CACrB,mBAAmB,GAAG,CAAC,IAAI,+BAA+B,EAC1D,4BAA4B,GAAG,CAAC,IAAI,cAAc,CACnD,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IACpE,CAAC;IAED,MAAM,eAAe,CACnB,6CAA6C;QAC3C,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YACzB,CAAC,CAAC,yBAAyB;YAC3B,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAC9D,yDAAyD,CAC1D,CAAC;AACJ,CAAC","sourcesContent":["import type { StoredSession } from './auth/credential-store';\nimport type { AuthEnvironment } from './auth/session';\nimport { readActiveSource } from './commands/sources';\nimport { authRequiredError, validationError } from './errors';\nimport { fetchSeatsWithOneRefresh } from './seats';\n\n/**\n * Which Source a Source-scoped read or write (`catalog`, `agents`) is about:\n * `--source`, else `source` in ekanos.json, else the caller's only seat.\n * Works outside a project. With several seats and nothing named, it refuses\n * rather than guessing.\n */\nexport async function resolveSourceTarget(\n  env: AuthEnvironment,\n  session: StoredSession,\n  args: { source?: string; dir: string },\n): Promise<{ source: string; session: StoredSession }> {\n  const named = args.source?.trim() || readActiveSource(args.dir);\n  if (named) return { source: named, session };\n\n  const seats = await fetchSeatsWithOneRefresh(env, session);\n  if (seats.status !== 'ok') {\n    throw authRequiredError(\n      `The session for ${env.host} could not list your sources.`,\n      `Run \"ekanos login --host ${env.host}\" and retry.`,\n    );\n  }\n  if (seats.sources.length === 1) {\n    return { source: seats.sources[0]!.slug, session: seats.session };\n  }\n\n  throw validationError(\n    'Which Source? This account holds a seat on ' +\n      (seats.sources.length === 0\n        ? 'no source on this host.'\n        : `${seats.sources.map((seat) => seat.slug).join(', ')}.`),\n    'Pass \"--source <slug>\", or set \"source\" in ekanos.json.',\n  );\n}\n"]}
+{"version":3,"file":"source-target.js","sourceRoot":"","sources":["../src/source-target.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,SAAS,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAoB,EACpB,OAAsB,EACtB,IAAsC;;IAEtC,MAAM,KAAK,GAAG,CAAA,MAAA,IAAI,CAAC,MAAM,0CAAE,IAAI,EAAE,KAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChE,IAAI,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAE7C,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC1B,MAAM,iBAAiB,CACrB,mBAAmB,GAAG,CAAC,IAAI,+BAA+B,EAC1D,SAAS,CAAC,GAAG,CAAC,CACf,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IACpE,CAAC;IAED,MAAM,eAAe,CACnB,6CAA6C;QAC3C,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YACzB,CAAC,CAAC,yBAAyB;YAC3B,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAC9D,yDAAyD,CAC1D,CAAC;AACJ,CAAC","sourcesContent":["import type { StoredSession } from './auth/credential-store';\nimport { loginHint } from './auth/host-trust';\nimport type { AuthEnvironment } from './auth/session';\nimport { readActiveSource } from './commands/sources';\nimport { authRequiredError, validationError } from './errors';\nimport { fetchSeatsWithOneRefresh } from './seats';\n\n/**\n * Which Source a Source-scoped read or write (`catalog`, `agents`) is about:\n * `--source`, else `source` in ekanos.json, else the caller's only seat.\n * Works outside a project. With several seats and nothing named, it refuses\n * rather than guessing.\n */\nexport async function resolveSourceTarget(\n  env: AuthEnvironment,\n  session: StoredSession,\n  args: { source?: string; dir: string },\n): Promise<{ source: string; session: StoredSession }> {\n  const named = args.source?.trim() || readActiveSource(args.dir);\n  if (named) return { source: named, session };\n\n  const seats = await fetchSeatsWithOneRefresh(env, session);\n  if (seats.status !== 'ok') {\n    throw authRequiredError(\n      `The session for ${env.host} could not list your sources.`,\n      loginHint(env),\n    );\n  }\n  if (seats.sources.length === 1) {\n    return { source: seats.sources[0]!.slug, session: seats.session };\n  }\n\n  throw validationError(\n    'Which Source? This account holds a seat on ' +\n      (seats.sources.length === 0\n        ? 'no source on this host.'\n        : `${seats.sources.map((seat) => seat.slug).join(', ')}.`),\n    'Pass \"--source <slug>\", or set \"source\" in ekanos.json.',\n  );\n}\n"]}

package/dist/sources-api.d.ts

@@ -1,3 +1,4 @@
+import type { AuthEnvironment } from './auth/session.js';
 /**
  * The CLI's client for the Ekanos source-seat visibility route.
  *
@@ -41,4 +42,4 @@ export type FetchSourceSeatsResult = {
  */
 export declare function fetchSourceSeats(host: string, accessToken: string): Promise<FetchSourceSeatsResult>;
 /** Guard for the "still unauthorized after one refresh" terminal case. */
-export declare function stillUnauthorizedSourceSeats(host: string): never;
+export declare function stillUnauthorizedSourceSeats(env: AuthEnvironment): never;

package/dist/sources-api.js

@@ -1,4 +1,5 @@
 import { request } from './auth/ekanos-api.js';
+import { loginHint } from './auth/host-trust.js';
 import { authRequiredError, networkError } from './errors.js';
 /**
  * List the sources the caller holds a seat on (any role). Authorization is
@@ -43,8 +44,8 @@ export async function fetchSourceSeats(host, accessToken) {
     return { status: 'ok', sources };
 }
 /** Guard for the "still unauthorized after one refresh" terminal case. */
-export function stillUnauthorizedSourceSeats(host) {
-    throw authRequiredError(`The session for ${host} could not authorize the source seat lookup.`, `Run "ekanos login --host ${host}" and retry.`);
+export function stillUnauthorizedSourceSeats(env) {
+    throw authRequiredError(`The session for ${env.host} could not authorize the source seat lookup.`, loginHint(env));
 }
 async function readOptionalJson(response) {
     try {

package/dist/sources-api.js.map

@@ -1 +1 @@
-{"version":3,"file":"sources-api.js","sourceRoot":"","sources":["../src/sources-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAqC3D;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAY,EACZ,WAAmB;;IAEnB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,sBAAsB,EAAE;QAC5D,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,UAAU,WAAW,EAAE;SACvC;KACF,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACpC,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAE9C,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,iBAAiB,OACrB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,mCACb,GAAG,IAAI,yDAAyD,EAClE,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,YAAY,CAChB,GAAG,IAAI,kCAAkC,QAAQ,CAAC,MAAM,GAAG,EAC3D,QAAQ,CAAC,MAAM,IAAI,GAAG;YACpB,CAAC,CAAC,mEAAmE;gBACjE,8CAA8C;YAClD,CAAC,CAAC,gEAAgE;gBAC9D,qCAAqC,CAC5C,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,OAAC,IAAI,CAAC,IAAI,mCAAI,EAAE,CAA4B,CAAC;IAC1D,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAE7D,MAAM,OAAO,GAAG,IAAI;SACjB,MAAM,CACL,CAAC,GAAG,EAAkC,EAAE,CACtC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAC1C;SACA,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,sBAAC,CAAC;QACb,EAAE,QAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,mCAAI,EAAE;QACrB,IAAI,QAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,mCAAI,EAAE;QACzB,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;QACnB,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;YAC7B,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;YACtE,CAAC,CAAC,EAAE;KACP,CAAC,GAAA,CAAC,CAAC;IAEN,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACnC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,4BAA4B,CAAC,IAAY;IACvD,MAAM,iBAAiB,CACrB,mBAAmB,IAAI,8CAA8C,EACrE,4BAA4B,IAAI,cAAc,CAC/C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,QAAkB;IAElB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE9C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAClD,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;eAAO,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC;AACvC,CAAC;AAED,SAAS,GAAG,CAAC,KAAc;IACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC","sourcesContent":["import { request } from './auth/ekanos-api';\nimport { authRequiredError, networkError } from './errors';\n\n/**\n * The CLI's client for the Ekanos source-seat visibility route.\n *\n * ---------------------------------------------------------------------------\n * WIRE CONTRACT — the seam between this package and the Ekanos web app.\n *\n * The server side is the host's `/api/partner/sources` route. As with the\n * auth routes and `publish-api.ts`, the two halves are coupled only by\n * HTTP; tests stub `fetch`, never the route.\n *\n *   GET /api/partner/sources        [Authorization: Bearer <access_token>]\n *     → 200 { ok: true, data: { sources: [{ id, slug, name, roles }] } }\n *           roles is a non-empty array of \"developer\" | \"source_admin\", sorted; sources\n *           is sorted by slug. Empty array means no seats anywhere.\n *     → 401 { error, code: \"AUTH_REQUIRED\" }      token absent or expired —\n *                                                 refresh once and retry\n *     → 403 { error, code: \"MFA_REQUIRED\" }\n *     → 3xx                                       treated as 401 (an\n *                                                 auth-gated Ekanos page\n *                                                 answers 307)\n * ---------------------------------------------------------------------------\n */\n\nexport interface SourceSeat {\n  id: string;\n  slug: string;\n  name: string | null;\n  roles: string[];\n}\n\nexport type FetchSourceSeatsResult =\n  | { status: 'ok'; sources: SourceSeat[] }\n  /** The bearer token did not authenticate — refresh and retry, once. */\n  | { status: 'unauthorized' };\n\n/**\n * List the sources the caller holds a seat on (any role). Authorization is\n * entirely server-side (RLS on `source_memberships`): there is no client-side\n * filter to get wrong here.\n */\nexport async function fetchSourceSeats(\n  host: string,\n  accessToken: string,\n): Promise<FetchSourceSeatsResult> {\n  const response = await request(`${host}/api/partner/sources`, {\n    method: 'GET',\n    headers: {\n      accept: 'application/json',\n      authorization: `Bearer ${accessToken}`,\n    },\n  });\n\n  if (response.status === 401 || isRedirect(response.status)) {\n    return { status: 'unauthorized' };\n  }\n\n  const body = await readOptionalJson(response);\n\n  if (response.status === 403) {\n    throw authRequiredError(\n      str(body.error) ??\n        `${host} requires multi-factor authentication for this account.`,\n      `Complete MFA in the browser, then run \"ekanos login\" again.`,\n    );\n  }\n\n  if (!response.ok) {\n    throw networkError(\n      `${host}/api/partner/sources responded ${response.status}.`,\n      response.status >= 500\n        ? `The Ekanos deployment returned a server error. Retry shortly; if ` +\n            `it persists, report it with the status code.`\n        : `Confirm the host is an Ekanos deployment running a build that ` +\n            `includes the partner sources route.`,\n    );\n  }\n\n  const data = (body.data ?? {}) as Record<string, unknown>;\n  const rows = Array.isArray(data.sources) ? data.sources : [];\n\n  const sources = rows\n    .filter(\n      (row): row is Record<string, unknown> =>\n        typeof row === 'object' && row !== null,\n    )\n    .map((row) => ({\n      id: str(row.id) ?? '',\n      slug: str(row.slug) ?? '',\n      name: str(row.name),\n      roles: Array.isArray(row.roles)\n        ? row.roles.filter((role): role is string => typeof role === 'string')\n        : [],\n    }));\n\n  return { status: 'ok', sources };\n}\n\n/** Guard for the \"still unauthorized after one refresh\" terminal case. */\nexport function stillUnauthorizedSourceSeats(host: string): never {\n  throw authRequiredError(\n    `The session for ${host} could not authorize the source seat lookup.`,\n    `Run \"ekanos login --host ${host}\" and retry.`,\n  );\n}\n\nasync function readOptionalJson(\n  response: Response,\n): Promise<Record<string, unknown>> {\n  try {\n    const parsed: unknown = await response.json();\n\n    return typeof parsed === 'object' && parsed !== null\n      ? (parsed as Record<string, unknown>)\n      : {};\n  } catch {\n    return {};\n  }\n}\n\nfunction isRedirect(status: number): boolean {\n  return status >= 300 && status < 400;\n}\n\nfunction str(value: unknown): string | null {\n  return typeof value === 'string' && value.length > 0 ? value : null;\n}\n"]}
+{"version":3,"file":"sources-api.js","sourceRoot":"","sources":["../src/sources-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAqC3D;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAY,EACZ,WAAmB;;IAEnB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,sBAAsB,EAAE;QAC5D,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,UAAU,WAAW,EAAE;SACvC;KACF,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACpC,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAE9C,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,iBAAiB,OACrB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,mCACb,GAAG,IAAI,yDAAyD,EAClE,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,YAAY,CAChB,GAAG,IAAI,kCAAkC,QAAQ,CAAC,MAAM,GAAG,EAC3D,QAAQ,CAAC,MAAM,IAAI,GAAG;YACpB,CAAC,CAAC,mEAAmE;gBACjE,8CAA8C;YAClD,CAAC,CAAC,gEAAgE;gBAC9D,qCAAqC,CAC5C,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,OAAC,IAAI,CAAC,IAAI,mCAAI,EAAE,CAA4B,CAAC;IAC1D,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAE7D,MAAM,OAAO,GAAG,IAAI;SACjB,MAAM,CACL,CAAC,GAAG,EAAkC,EAAE,CACtC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAC1C;SACA,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,sBAAC,CAAC;QACb,EAAE,QAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,mCAAI,EAAE;QACrB,IAAI,QAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,mCAAI,EAAE;QACzB,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;QACnB,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;YAC7B,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;YACtE,CAAC,CAAC,EAAE;KACP,CAAC,GAAA,CAAC,CAAC;IAEN,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACnC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,4BAA4B,CAAC,GAAoB;IAC/D,MAAM,iBAAiB,CACrB,mBAAmB,GAAG,CAAC,IAAI,8CAA8C,EACzE,SAAS,CAAC,GAAG,CAAC,CACf,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,QAAkB;IAElB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE9C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAClD,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;eAAO,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC;AACvC,CAAC;AAED,SAAS,GAAG,CAAC,KAAc;IACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC","sourcesContent":["import { request } from './auth/ekanos-api';\nimport { loginHint } from './auth/host-trust';\nimport type { AuthEnvironment } from './auth/session';\nimport { authRequiredError, networkError } from './errors';\n\n/**\n * The CLI's client for the Ekanos source-seat visibility route.\n *\n * ---------------------------------------------------------------------------\n * WIRE CONTRACT — the seam between this package and the Ekanos web app.\n *\n * The server side is the host's `/api/partner/sources` route. As with the\n * auth routes and `publish-api.ts`, the two halves are coupled only by\n * HTTP; tests stub `fetch`, never the route.\n *\n *   GET /api/partner/sources        [Authorization: Bearer <access_token>]\n *     → 200 { ok: true, data: { sources: [{ id, slug, name, roles }] } }\n *           roles is a non-empty array of \"developer\" | \"source_admin\", sorted; sources\n *           is sorted by slug. Empty array means no seats anywhere.\n *     → 401 { error, code: \"AUTH_REQUIRED\" }      token absent or expired —\n *                                                 refresh once and retry\n *     → 403 { error, code: \"MFA_REQUIRED\" }\n *     → 3xx                                       treated as 401 (an\n *                                                 auth-gated Ekanos page\n *                                                 answers 307)\n * ---------------------------------------------------------------------------\n */\n\nexport interface SourceSeat {\n  id: string;\n  slug: string;\n  name: string | null;\n  roles: string[];\n}\n\nexport type FetchSourceSeatsResult =\n  | { status: 'ok'; sources: SourceSeat[] }\n  /** The bearer token did not authenticate — refresh and retry, once. */\n  | { status: 'unauthorized' };\n\n/**\n * List the sources the caller holds a seat on (any role). Authorization is\n * entirely server-side (RLS on `source_memberships`): there is no client-side\n * filter to get wrong here.\n */\nexport async function fetchSourceSeats(\n  host: string,\n  accessToken: string,\n): Promise<FetchSourceSeatsResult> {\n  const response = await request(`${host}/api/partner/sources`, {\n    method: 'GET',\n    headers: {\n      accept: 'application/json',\n      authorization: `Bearer ${accessToken}`,\n    },\n  });\n\n  if (response.status === 401 || isRedirect(response.status)) {\n    return { status: 'unauthorized' };\n  }\n\n  const body = await readOptionalJson(response);\n\n  if (response.status === 403) {\n    throw authRequiredError(\n      str(body.error) ??\n        `${host} requires multi-factor authentication for this account.`,\n      `Complete MFA in the browser, then run \"ekanos login\" again.`,\n    );\n  }\n\n  if (!response.ok) {\n    throw networkError(\n      `${host}/api/partner/sources responded ${response.status}.`,\n      response.status >= 500\n        ? `The Ekanos deployment returned a server error. Retry shortly; if ` +\n            `it persists, report it with the status code.`\n        : `Confirm the host is an Ekanos deployment running a build that ` +\n            `includes the partner sources route.`,\n    );\n  }\n\n  const data = (body.data ?? {}) as Record<string, unknown>;\n  const rows = Array.isArray(data.sources) ? data.sources : [];\n\n  const sources = rows\n    .filter(\n      (row): row is Record<string, unknown> =>\n        typeof row === 'object' && row !== null,\n    )\n    .map((row) => ({\n      id: str(row.id) ?? '',\n      slug: str(row.slug) ?? '',\n      name: str(row.name),\n      roles: Array.isArray(row.roles)\n        ? row.roles.filter((role): role is string => typeof role === 'string')\n        : [],\n    }));\n\n  return { status: 'ok', sources };\n}\n\n/** Guard for the \"still unauthorized after one refresh\" terminal case. */\nexport function stillUnauthorizedSourceSeats(env: AuthEnvironment): never {\n  throw authRequiredError(\n    `The session for ${env.host} could not authorize the source seat lookup.`,\n    loginHint(env),\n  );\n}\n\nasync function readOptionalJson(\n  response: Response,\n): Promise<Record<string, unknown>> {\n  try {\n    const parsed: unknown = await response.json();\n\n    return typeof parsed === 'object' && parsed !== null\n      ? (parsed as Record<string, unknown>)\n      : {};\n  } catch {\n    return {};\n  }\n}\n\nfunction isRedirect(status: number): boolean {\n  return status >= 300 && status < 400;\n}\n\nfunction str(value: unknown): string | null {\n  return typeof value === 'string' && value.length > 0 ? value : null;\n}\n"]}

package/dist/team-connect-api.d.ts

@@ -4,10 +4,10 @@ import { type TeamsApiResult } from './teams-api.js';
  * The CLI's client for connecting a product for a team (`ekanos teams
  * connect`), for the team's Source admin.
  *
- *   GET  /api/partner/teams/<team>/integrations/<product>/connect?source=<slug>[&as=<email>]
+ *   GET  /api/partner/teams/<team>/integrations/<product>/connect?source=<slug>[&as=<email>][&connection=<id>]
  *     → { plan }
  *   POST /api/partner/teams/<team>/integrations/<product>/connect?source=<slug>
- *        { as?, fields? }
+ *        { as?, fields?, connection? }
  *     → { plan, result: "activated" }                         fields / no-fields
  *     → { plan, result: "consent", authorizeUrl, expiresAt }  oauth
  *
@@ -38,6 +38,7 @@ export declare const TeamConnectPlanSchema: z.ZodObject<{
         team: "team";
         user: "user";
     }>;
+    connectionId: z.ZodOptional<z.ZodString>;
     mode: z.ZodEnum<{
         browser: "browser";
         fields: "fields";
@@ -66,6 +67,15 @@ export declare const TeamConnectPlanSchema: z.ZodObject<{
     connected: z.ZodBoolean;
     connectedAt: z.ZodNullable<z.ZodString>;
     connectUrl: z.ZodString;
+    productScope: z.ZodOptional<z.ZodObject<{
+        state: z.ZodEnum<{
+            locked_out: "locked_out";
+            scoped: "scoped";
+            unscoped: "unscoped";
+        }>;
+        scopes: z.ZodArray<z.ZodString>;
+        hidden: z.ZodBoolean;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
 export type TeamConnectPlan = z.infer<typeof TeamConnectPlanSchema>;
 declare const ShowSchema: z.ZodObject<{
@@ -91,6 +101,7 @@ declare const ShowSchema: z.ZodObject<{
             team: "team";
             user: "user";
         }>;
+        connectionId: z.ZodOptional<z.ZodString>;
         mode: z.ZodEnum<{
             browser: "browser";
             fields: "fields";
@@ -119,6 +130,15 @@ declare const ShowSchema: z.ZodObject<{
         connected: z.ZodBoolean;
         connectedAt: z.ZodNullable<z.ZodString>;
         connectUrl: z.ZodString;
+        productScope: z.ZodOptional<z.ZodObject<{
+            state: z.ZodEnum<{
+                locked_out: "locked_out";
+                scoped: "scoped";
+                unscoped: "unscoped";
+            }>;
+            scopes: z.ZodArray<z.ZodString>;
+            hidden: z.ZodBoolean;
+        }, z.core.$strip>>;
     }, z.core.$strip>;
 }, z.core.$strip>;
 declare const StartSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -144,6 +164,7 @@ declare const StartSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
             team: "team";
             user: "user";
         }>;
+        connectionId: z.ZodOptional<z.ZodString>;
         mode: z.ZodEnum<{
             browser: "browser";
             fields: "fields";
@@ -172,6 +193,15 @@ declare const StartSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         connected: z.ZodBoolean;
         connectedAt: z.ZodNullable<z.ZodString>;
         connectUrl: z.ZodString;
+        productScope: z.ZodOptional<z.ZodObject<{
+            state: z.ZodEnum<{
+                locked_out: "locked_out";
+                scoped: "scoped";
+                unscoped: "unscoped";
+            }>;
+            scopes: z.ZodArray<z.ZodString>;
+            hidden: z.ZodBoolean;
+        }, z.core.$strip>>;
     }, z.core.$strip>;
     result: z.ZodLiteral<"activated">;
 }, z.core.$strip>, z.ZodObject<{
@@ -197,6 +227,7 @@ declare const StartSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
             team: "team";
             user: "user";
         }>;
+        connectionId: z.ZodOptional<z.ZodString>;
         mode: z.ZodEnum<{
             browser: "browser";
             fields: "fields";
@@ -225,6 +256,15 @@ declare const StartSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         connected: z.ZodBoolean;
         connectedAt: z.ZodNullable<z.ZodString>;
         connectUrl: z.ZodString;
+        productScope: z.ZodOptional<z.ZodObject<{
+            state: z.ZodEnum<{
+                locked_out: "locked_out";
+                scoped: "scoped";
+                unscoped: "unscoped";
+            }>;
+            scopes: z.ZodArray<z.ZodString>;
+            hidden: z.ZodBoolean;
+        }, z.core.$strip>>;
     }, z.core.$strip>;
     result: z.ZodLiteral<"consent">;
     authorizeUrl: z.ZodString;
@@ -235,6 +275,8 @@ interface Target {
     source: string;
     team: string;
     product: string;
+    /** A named OAuth connection (`agent`); the main one when absent. */
+    connection?: string;
 }
 export declare function showTeamConnect(host: string, accessToken: string, target: Target, asEmail?: string): Promise<TeamsApiResult<z.infer<typeof ShowSchema>>>;
 export declare function startTeamConnect(host: string, accessToken: string, target: Target, body: {

package/dist/team-connect-api.js

@@ -4,10 +4,10 @@ import { call } from './teams-api.js';
  * The CLI's client for connecting a product for a team (`ekanos teams
  * connect`), for the team's Source admin.
  *
- *   GET  /api/partner/teams/<team>/integrations/<product>/connect?source=<slug>[&as=<email>]
+ *   GET  /api/partner/teams/<team>/integrations/<product>/connect?source=<slug>[&as=<email>][&connection=<id>]
  *     → { plan }
  *   POST /api/partner/teams/<team>/integrations/<product>/connect?source=<slug>
- *        { as?, fields? }
+ *        { as?, fields?, connection? }
  *     → { plan, result: "activated" }                         fields / no-fields
  *     → { plan, result: "consent", authorizeUrl, expiresAt }  oauth
  *
@@ -29,6 +29,8 @@ export const TeamConnectPlanSchema = z.object({
         kind: z.enum(['experience', 'integration']).nullable(),
     }),
     scope: z.enum(['team', 'user']),
+    /** The OAuth connection the plan is for; absent from an older host (`default`). */
+    connectionId: z.string().optional(),
     mode: z.enum([
         'unsupported',
         'not-entitled',
@@ -59,6 +61,17 @@ export const TeamConnectPlanSchema = z.object({
     connected: z.boolean(),
     connectedAt: z.string().nullable(),
     connectUrl: z.string(),
+    /**
+     * Whether the team's product scopes hide the product from it in the app.
+     * Absent from an older host.
+     */
+    productScope: z
+        .object({
+        state: z.enum(['unscoped', 'scoped', 'locked_out']),
+        scopes: z.array(z.string()),
+        hidden: z.boolean(),
+    })
+        .optional(),
 });
 const ShowSchema = z.object({ plan: TeamConnectPlanSchema });
 const StartSchema = z.discriminatedUnion('result', [
@@ -74,10 +87,9 @@ function connectPath(target) {
     return `/api/partner/teams/${encodeURIComponent(target.team)}/integrations/${encodeURIComponent(target.product)}/connect`;
 }
 export function showTeamConnect(host, accessToken, target, asEmail) {
-    // `call` puts `source` in the query; `as` rides in the path's own query.
-    const path = asEmail
-        ? `${connectPath(target)}?${new URLSearchParams({ as: asEmail })}`
-        : connectPath(target);
+    // `call` puts `source` in the query; the rest ride in the path's own query.
+    const query = new URLSearchParams(Object.assign(Object.assign({}, (asEmail ? { as: asEmail } : {})), (target.connection ? { connection: target.connection } : {}))).toString();
+    const path = query ? `${connectPath(target)}?${query}` : connectPath(target);
     return call(host, accessToken, ShowSchema, {
         method: 'GET',
         path,
@@ -89,7 +101,7 @@ export function startTeamConnect(host, accessToken, target, body) {
         method: 'POST',
         path: connectPath(target),
         source: target.source,
-        body,
+        body: target.connection ? Object.assign(Object.assign({}, body), { connection: target.connection }) : body,
     });
 }
 //# sourceMappingURL=team-connect-api.js.map

package/dist/team-connect-api.js.map

@@ -1 +1 @@
-{"version":3,"file":"team-connect-api.js","sourceRoot":"","sources":["../src/team-connect-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAuB,IAAI,EAAE,MAAM,aAAa,CAAC;AAExD;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC5B,CAAC;IACF,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACtD,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE;KACvD,CAAC;IACF,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;QACX,aAAa;QACb,cAAc;QACd,gBAAgB;QAChB,kBAAkB;QAClB,OAAO;QACP,QAAQ;QACR,WAAW;QACX,SAAS;KACV,CAAC;IACF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,MAAM,EAAE,CAAC,CAAC,KAAK,CACb,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;QACtB,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;KACtB,CAAC,CACH;IACD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,MAAM,EAAE,CAAC;SACN,MAAM,CAAC;QACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC5B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;KACtB,CAAC;SACD,QAAQ,EAAE;IACb,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAC;AAGH,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;AAC7D,MAAM,WAAW,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IACjD,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;IACzE,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,qBAAqB;QAC3B,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC5B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;QACxB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;KACtB,CAAC;CACH,CAAC,CAAC;AASH,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,sBAAsB,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;AAC5H,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,WAAmB,EACnB,MAAc,EACd,OAAgB;IAEhB,yEAAyE;IACzE,MAAM,IAAI,GAAG,OAAO;QAClB,CAAC,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,IAAI,eAAe,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE;QAClE,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACxB,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE;QACzC,MAAM,EAAE,KAAK;QACb,IAAI;QACJ,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,WAAmB,EACnB,MAAc,EACd,IAAsD;IAEtD,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE;QAC1C,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,IAAI;KACL,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { z } from 'zod';\n\nimport { type TeamsApiResult, call } from './teams-api';\n\n/**\n * The CLI's client for connecting a product for a team (`ekanos teams\n * connect`), for the team's Source admin.\n *\n *   GET  /api/partner/teams/<team>/integrations/<product>/connect?source=<slug>[&as=<email>]\n *     → { plan }\n *   POST /api/partner/teams/<team>/integrations/<product>/connect?source=<slug>\n *        { as?, fields? }\n *     → { plan, result: \"activated\" }                         fields / no-fields\n *     → { plan, result: \"consent\", authorizeUrl, expiresAt }  oauth\n *\n * The plan's `mode`, decided by the host, says how the product is\n * connected. The shapes are read here rather than from\n * `@ekanos/integration-schema`, so this CLI works against a host without a\n * schema release.\n */\n\nexport const TeamConnectPlanSchema = z.object({\n  source: z.object({\n    id: z.string(),\n    slug: z.string(),\n    name: z.string().nullable(),\n  }),\n  team: z.object({ slug: z.string(), name: z.string() }),\n  product: z.object({\n    slug: z.string(),\n    name: z.string(),\n    kind: z.enum(['experience', 'integration']).nullable(),\n  }),\n  scope: z.enum(['team', 'user']),\n  mode: z.enum([\n    'unsupported',\n    'not-entitled',\n    'not-self-serve',\n    'works-as-shipped',\n    'oauth',\n    'fields',\n    'no-fields',\n    'browser',\n  ]),\n  reason: z.string().nullable(),\n  fields: z.array(\n    z.object({\n      name: z.string(),\n      label: z.string(),\n      description: z.string().nullable(),\n      sensitive: z.boolean(),\n      required: z.boolean(),\n    }),\n  ),\n  teamApp: z.boolean(),\n  member: z\n    .object({\n      userId: z.string(),\n      email: z.string().nullable(),\n      isCaller: z.boolean(),\n    })\n    .nullable(),\n  memberProblem: z.string().nullable(),\n  connected: z.boolean(),\n  connectedAt: z.string().nullable(),\n  connectUrl: z.string(),\n});\nexport type TeamConnectPlan = z.infer<typeof TeamConnectPlanSchema>;\n\nconst ShowSchema = z.object({ plan: TeamConnectPlanSchema });\nconst StartSchema = z.discriminatedUnion('result', [\n  z.object({ plan: TeamConnectPlanSchema, result: z.literal('activated') }),\n  z.object({\n    plan: TeamConnectPlanSchema,\n    result: z.literal('consent'),\n    authorizeUrl: z.string(),\n    expiresAt: z.string(),\n  }),\n]);\nexport type TeamConnectStart = z.infer<typeof StartSchema>;\n\ninterface Target {\n  source: string;\n  team: string;\n  product: string;\n}\n\nfunction connectPath(target: Target): string {\n  return `/api/partner/teams/${encodeURIComponent(target.team)}/integrations/${encodeURIComponent(target.product)}/connect`;\n}\n\nexport function showTeamConnect(\n  host: string,\n  accessToken: string,\n  target: Target,\n  asEmail?: string,\n): Promise<TeamsApiResult<z.infer<typeof ShowSchema>>> {\n  // `call` puts `source` in the query; `as` rides in the path's own query.\n  const path = asEmail\n    ? `${connectPath(target)}?${new URLSearchParams({ as: asEmail })}`\n    : connectPath(target);\n  return call(host, accessToken, ShowSchema, {\n    method: 'GET',\n    path,\n    source: target.source,\n  });\n}\n\nexport function startTeamConnect(\n  host: string,\n  accessToken: string,\n  target: Target,\n  body: { as?: string; fields?: Record<string, string> },\n): Promise<TeamsApiResult<TeamConnectStart>> {\n  return call(host, accessToken, StartSchema, {\n    method: 'POST',\n    path: connectPath(target),\n    source: target.source,\n    body,\n  });\n}\n"]}
+{"version":3,"file":"team-connect-api.js","sourceRoot":"","sources":["../src/team-connect-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAuB,IAAI,EAAE,MAAM,aAAa,CAAC;AAExD;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC5B,CAAC;IACF,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACtD,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE;KACvD,CAAC;IACF,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,mFAAmF;IACnF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;QACX,aAAa;QACb,cAAc;QACd,gBAAgB;QAChB,kBAAkB;QAClB,OAAO;QACP,QAAQ;QACR,WAAW;QACX,SAAS;KACV,CAAC;IACF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,MAAM,EAAE,CAAC,CAAC,KAAK,CACb,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;QACtB,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;KACtB,CAAC,CACH;IACD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,MAAM,EAAE,CAAC;SACN,MAAM,CAAC;QACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC5B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;KACtB,CAAC;SACD,QAAQ,EAAE;IACb,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB;;;OAGG;IACH,YAAY,EAAE,CAAC;SACZ,MAAM,CAAC;QACN,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;QACnD,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAC3B,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;KACpB,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAGH,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;AAC7D,MAAM,WAAW,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IACjD,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;IACzE,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,qBAAqB;QAC3B,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC5B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;QACxB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;KACtB,CAAC;CACH,CAAC,CAAC;AAWH,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,sBAAsB,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;AAC5H,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,WAAmB,EACnB,MAAc,EACd,OAAgB;IAEhB,4EAA4E;IAC5E,MAAM,KAAK,GAAG,IAAI,eAAe,iCAC5B,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAChC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAC/D,CAAC,QAAQ,EAAE,CAAC;IACd,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7E,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE;QACzC,MAAM,EAAE,KAAK;QACb,IAAI;QACJ,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,WAAmB,EACnB,MAAc,EACd,IAAsD;IAEtD,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE;QAC1C,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,iCAAM,IAAI,KAAE,UAAU,EAAE,MAAM,CAAC,UAAU,IAAG,CAAC,CAAC,IAAI;KAC5E,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { z } from 'zod';\n\nimport { type TeamsApiResult, call } from './teams-api';\n\n/**\n * The CLI's client for connecting a product for a team (`ekanos teams\n * connect`), for the team's Source admin.\n *\n *   GET  /api/partner/teams/<team>/integrations/<product>/connect?source=<slug>[&as=<email>][&connection=<id>]\n *     → { plan }\n *   POST /api/partner/teams/<team>/integrations/<product>/connect?source=<slug>\n *        { as?, fields?, connection? }\n *     → { plan, result: \"activated\" }                         fields / no-fields\n *     → { plan, result: \"consent\", authorizeUrl, expiresAt }  oauth\n *\n * The plan's `mode`, decided by the host, says how the product is\n * connected. The shapes are read here rather than from\n * `@ekanos/integration-schema`, so this CLI works against a host without a\n * schema release.\n */\n\nexport const TeamConnectPlanSchema = z.object({\n  source: z.object({\n    id: z.string(),\n    slug: z.string(),\n    name: z.string().nullable(),\n  }),\n  team: z.object({ slug: z.string(), name: z.string() }),\n  product: z.object({\n    slug: z.string(),\n    name: z.string(),\n    kind: z.enum(['experience', 'integration']).nullable(),\n  }),\n  scope: z.enum(['team', 'user']),\n  /** The OAuth connection the plan is for; absent from an older host (`default`). */\n  connectionId: z.string().optional(),\n  mode: z.enum([\n    'unsupported',\n    'not-entitled',\n    'not-self-serve',\n    'works-as-shipped',\n    'oauth',\n    'fields',\n    'no-fields',\n    'browser',\n  ]),\n  reason: z.string().nullable(),\n  fields: z.array(\n    z.object({\n      name: z.string(),\n      label: z.string(),\n      description: z.string().nullable(),\n      sensitive: z.boolean(),\n      required: z.boolean(),\n    }),\n  ),\n  teamApp: z.boolean(),\n  member: z\n    .object({\n      userId: z.string(),\n      email: z.string().nullable(),\n      isCaller: z.boolean(),\n    })\n    .nullable(),\n  memberProblem: z.string().nullable(),\n  connected: z.boolean(),\n  connectedAt: z.string().nullable(),\n  connectUrl: z.string(),\n  /**\n   * Whether the team's product scopes hide the product from it in the app.\n   * Absent from an older host.\n   */\n  productScope: z\n    .object({\n      state: z.enum(['unscoped', 'scoped', 'locked_out']),\n      scopes: z.array(z.string()),\n      hidden: z.boolean(),\n    })\n    .optional(),\n});\nexport type TeamConnectPlan = z.infer<typeof TeamConnectPlanSchema>;\n\nconst ShowSchema = z.object({ plan: TeamConnectPlanSchema });\nconst StartSchema = z.discriminatedUnion('result', [\n  z.object({ plan: TeamConnectPlanSchema, result: z.literal('activated') }),\n  z.object({\n    plan: TeamConnectPlanSchema,\n    result: z.literal('consent'),\n    authorizeUrl: z.string(),\n    expiresAt: z.string(),\n  }),\n]);\nexport type TeamConnectStart = z.infer<typeof StartSchema>;\n\ninterface Target {\n  source: string;\n  team: string;\n  product: string;\n  /** A named OAuth connection (`agent`); the main one when absent. */\n  connection?: string;\n}\n\nfunction connectPath(target: Target): string {\n  return `/api/partner/teams/${encodeURIComponent(target.team)}/integrations/${encodeURIComponent(target.product)}/connect`;\n}\n\nexport function showTeamConnect(\n  host: string,\n  accessToken: string,\n  target: Target,\n  asEmail?: string,\n): Promise<TeamsApiResult<z.infer<typeof ShowSchema>>> {\n  // `call` puts `source` in the query; the rest ride in the path's own query.\n  const query = new URLSearchParams({\n    ...(asEmail ? { as: asEmail } : {}),\n    ...(target.connection ? { connection: target.connection } : {}),\n  }).toString();\n  const path = query ? `${connectPath(target)}?${query}` : connectPath(target);\n  return call(host, accessToken, ShowSchema, {\n    method: 'GET',\n    path,\n    source: target.source,\n  });\n}\n\nexport function startTeamConnect(\n  host: string,\n  accessToken: string,\n  target: Target,\n  body: { as?: string; fields?: Record<string, string> },\n): Promise<TeamsApiResult<TeamConnectStart>> {\n  return call(host, accessToken, StartSchema, {\n    method: 'POST',\n    path: connectPath(target),\n    source: target.source,\n    body: target.connection ? { ...body, connection: target.connection } : body,\n  });\n}\n"]}

package/dist/teams-api.d.ts

@@ -1,4 +1,4 @@
-import { type TeamAppSetResult, type TeamCreateRequest, type TeamCreateResult, type TeamMemberChangeResult, type TeamMemberInviteResult, type TeamMemberList, type TeamRoles, type TeamIntegrationStatus, type TeamList, type TeamWebhookMintResult } from '@ekanos/integration-schema';
+import { type ProductScopeList, type ProductScopeProductChange, type TeamScopes, type TeamScopesSetResult, type TeamAppSetResult, type TeamCreateRequest, type TeamCreateResult, type TeamDisconnectResult, type TeamMemberChangeResult, type TeamMemberInviteResult, type TeamMemberList, type TeamRenameResult, type TeamRoles, type TeamIntegrationStatus, type TeamIntegrationEventList, type TeamList, type TeamWebhookMintResult } from '@ekanos/integration-schema';
 import type { z } from 'zod';
 /**
  * The CLI's client for a Source's teams and their integration setup — the
@@ -9,12 +9,21 @@ import type { z } from 'zod';
  *   PUT  …/integrations/<product>/app?source=<slug>  { connectionId?, fields }
  *                                                                      → TeamAppSetResult
  *   POST …/integrations/<product>/webhooks/<id>?source=<slug>         → TeamWebhookMintResult
+ *   DELETE /api/partner/teams/<team>/integrations/<product>?source=<slug> → TeamDisconnectResult
  *   POST /api/partner/teams?source=<slug>  { name, slug?, ownerEmail? } → TeamCreateResult
+ *   PATCH /api/partner/teams/<team>?source=<slug>  { name }           → TeamRenameResult
  *   GET  /api/partner/teams/<team>/members?source=<slug>               → TeamMemberList
  *   POST …/<team>/members?source=<slug>  { email, role }               → TeamMemberInviteResult
  *   PATCH  …/<team>/members/<email>?source=<slug>  { role }            → TeamMemberChangeResult
  *   DELETE …/<team>/members/<email>?source=<slug>                      → TeamMemberChangeResult
  *   GET  /api/partner/teams/<team>/roles?source=<slug>                 → TeamRoles
+ *   GET  /api/partner/teams/<team>/events?source=<slug>[&product=<slug>]
+ *        [&since=<iso>][&limit=<n>]                                    → TeamIntegrationEventList
+ *   GET  /api/partner/scopes?source=<slug>                             → ProductScopeList
+ *   PUT | DELETE /api/partner/scopes/<scope>/products/<product>?source=<slug>
+ *                                                                      → ProductScopeProductChange
+ *   GET  /api/partner/teams/<team>/scopes?source=<slug>                → TeamScopes
+ *   PUT  /api/partner/teams/<team>/scopes?source=<slug>  { scopes }   → TeamScopesSetResult
  *
  *   → 401 / 3xx  refresh once and retry
  *   → 403 { code: "SOURCE_ADMIN_REQUIRED" | "MFA_REQUIRED" | "FORBIDDEN" }
@@ -51,7 +60,16 @@ export declare function mintTeamWebhook(host: string, accessToken: string, targe
     team: string;
     product: string;
 }, webhookId: string): Promise<TeamsApiResult<TeamWebhookMintResult>>;
+export declare function disconnectTeamIntegration(host: string, accessToken: string, target: {
+    source: string;
+    team: string;
+    product: string;
+}): Promise<TeamsApiResult<TeamDisconnectResult>>;
 export declare function createTeam(host: string, accessToken: string, source: string, body: TeamCreateRequest): Promise<TeamsApiResult<TeamCreateResult>>;
+export declare function renameTeam(host: string, accessToken: string, target: {
+    source: string;
+    team: string;
+}, name: string): Promise<TeamsApiResult<TeamRenameResult>>;
 export declare function listTeamMembers(host: string, accessToken: string, target: {
     source: string;
     team: string;
@@ -73,10 +91,32 @@ export declare function removeTeamMember(host: string, accessToken: string, targ
     team: string;
     email: string;
 }): Promise<TeamsApiResult<TeamMemberChangeResult>>;
+export declare function listProductScopes(host: string, accessToken: string, source: string): Promise<TeamsApiResult<ProductScopeList>>;
+export declare function setScopeProduct(host: string, accessToken: string, target: {
+    source: string;
+    scope: string;
+    product: string;
+}, included: boolean): Promise<TeamsApiResult<ProductScopeProductChange>>;
+export declare function showTeamScopes(host: string, accessToken: string, target: {
+    source: string;
+    team: string;
+}): Promise<TeamsApiResult<TeamScopes>>;
+export declare function setTeamScopes(host: string, accessToken: string, target: {
+    source: string;
+    team: string;
+}, scopes: string[]): Promise<TeamsApiResult<TeamScopesSetResult>>;
 export declare function listTeamRoles(host: string, accessToken: string, target: {
     source: string;
     team: string;
 }): Promise<TeamsApiResult<TeamRoles>>;
+export declare function listTeamEvents(host: string, accessToken: string, target: {
+    source: string;
+    team: string;
+}, filters: {
+    product?: string;
+    since?: string;
+    limit?: number;
+}): Promise<TeamsApiResult<TeamIntegrationEventList>>;
 /** One partner teams call; shared by the team-agent clients (`team-agents-api.ts`). */
 export declare function call<T>(host: string, accessToken: string, schema: z.ZodType<T>, init: {
     method: 'GET' | 'PUT' | 'POST' | 'PATCH' | 'DELETE';

package/dist/teams-api.js

@@ -1,4 +1,4 @@
-import { TeamAppSetResultSchema, TeamCreateResultSchema, TeamMemberChangeResultSchema, TeamMemberInviteResultSchema, TeamMemberListSchema, TeamRolesSchema, TeamIntegrationStatusSchema, TeamListSchema, TeamWebhookMintResultSchema, } from '@ekanos/integration-schema';
+import { ProductScopeListSchema, ProductScopeProductChangeSchema, TeamScopesSchema, TeamScopesSetResultSchema, TeamAppSetResultSchema, TeamCreateResultSchema, TeamDisconnectResultSchema, TeamMemberChangeResultSchema, TeamMemberInviteResultSchema, TeamMemberListSchema, TeamRenameResultSchema, TeamRolesSchema, TeamIntegrationStatusSchema, TeamIntegrationEventListSchema, TeamListSchema, TeamWebhookMintResultSchema, } from '@ekanos/integration-schema';
 import { request } from './auth/ekanos-api.js';
 import { authRequiredError, forbiddenError, invalidStateError, networkError, notFoundError, usageError, validationError, } from './errors.js';
 export function listTeams(host, accessToken, source) {
@@ -30,6 +30,13 @@ export function mintTeamWebhook(host, accessToken, target, webhookId) {
         source: target.source,
     });
 }
+export function disconnectTeamIntegration(host, accessToken, target) {
+    return call(host, accessToken, TeamDisconnectResultSchema, {
+        method: 'DELETE',
+        path: integrationPath(target),
+        source: target.source,
+    });
+}
 export function createTeam(host, accessToken, source, body) {
     return call(host, accessToken, TeamCreateResultSchema, {
         method: 'POST',
@@ -38,6 +45,14 @@ export function createTeam(host, accessToken, source, body) {
         body,
     });
 }
+export function renameTeam(host, accessToken, target, name) {
+    return call(host, accessToken, TeamRenameResultSchema, {
+        method: 'PATCH',
+        path: `/api/partner/teams/${encodeURIComponent(target.team)}`,
+        source: target.source,
+        body: { name },
+    });
+}
 export function listTeamMembers(host, accessToken, target) {
     return call(host, accessToken, TeamMemberListSchema, {
         method: 'GET',
@@ -68,6 +83,35 @@ export function removeTeamMember(host, accessToken, target) {
         source: target.source,
     });
 }
+export function listProductScopes(host, accessToken, source) {
+    return call(host, accessToken, ProductScopeListSchema, {
+        method: 'GET',
+        path: '/api/partner/scopes',
+        source,
+    });
+}
+export function setScopeProduct(host, accessToken, target, included) {
+    return call(host, accessToken, ProductScopeProductChangeSchema, {
+        method: included ? 'PUT' : 'DELETE',
+        path: `/api/partner/scopes/${encodeURIComponent(target.scope)}/products/${encodeURIComponent(target.product)}`,
+        source: target.source,
+    });
+}
+export function showTeamScopes(host, accessToken, target) {
+    return call(host, accessToken, TeamScopesSchema, {
+        method: 'GET',
+        path: `/api/partner/teams/${encodeURIComponent(target.team)}/scopes`,
+        source: target.source,
+    });
+}
+export function setTeamScopes(host, accessToken, target, scopes) {
+    return call(host, accessToken, TeamScopesSetResultSchema, {
+        method: 'PUT',
+        path: `/api/partner/teams/${encodeURIComponent(target.team)}/scopes`,
+        source: target.source,
+        body: { scopes },
+    });
+}
 export function listTeamRoles(host, accessToken, target) {
     return call(host, accessToken, TeamRolesSchema, {
         method: 'GET',
@@ -75,6 +119,22 @@ export function listTeamRoles(host, accessToken, target) {
         source: target.source,
     });
 }
+export function listTeamEvents(host, accessToken, target, filters) {
+    const query = new URLSearchParams();
+    if (filters.product)
+        query.set('product', filters.product);
+    if (filters.since)
+        query.set('since', filters.since);
+    if (filters.limit !== undefined)
+        query.set('limit', String(filters.limit));
+    const encoded = query.toString();
+    const suffix = encoded ? `?${encoded}` : '';
+    return call(host, accessToken, TeamIntegrationEventListSchema, {
+        method: 'GET',
+        path: `/api/partner/teams/${encodeURIComponent(target.team)}/events${suffix}`,
+        source: target.source,
+    });
+}
 function membersPath(team) {
     return `/api/partner/teams/${encodeURIComponent(team)}/members`;
 }
@@ -103,22 +163,28 @@ export async function call(host, accessToken, schema, init) {
     if (response.status === 403) {
         throw forbiddenError(message !== null && message !== void 0 ? message : 'Not permitted on this Source.', code === 'SOURCE_ADMIN_REQUIRED'
             ? "Only a Source admin manages its teams' integrations. Ask one to run it."
-            : 'Run "ekanos sources" to list the sources you hold a seat on.');
+            : code === 'CONFIRM_NOT_PERMITTED'
+                ? "Only a Source admin of the team's Source, or someone who manages the team's agents, confirms what an agent may use."
+                : 'Run "ekanos sources" to list the sources you hold a seat on.');
     }
     if (response.status === 404) {
         throw notFoundError(message !== null && message !== void 0 ? message : 'Not found.', code === 'TEAM_NOT_FOUND'
             ? 'Run "ekanos teams list" to see the teams on this Source.'
             : code === 'PRODUCT_NOT_ENTITLED'
-                ? '"ekanos catalog" lists what this Source has; Ekanos enables a product for a Source.'
-                : code === 'WEBHOOK_NOT_FOUND' || code === 'CONNECTION_NOT_FOUND'
-                    ? 'Run "ekanos teams show <team> <product>" to see its team apps and webhooks.'
-                    : code === 'MEMBER_NOT_FOUND'
-                        ? 'Run "ekanos teams members list <team>" to see its members and invitations.'
-                        : (code === null || code === void 0 ? void 0 : code.startsWith('AGENT_')) || code === 'TEMPLATE_NOT_FOUND'
-                            ? 'Run "ekanos teams agents list <team>" to see the team\'s agents.'
-                            : /^(TRIGGER|LINK|MCP)_/.test(code !== null && code !== void 0 ? code : '')
-                                ? 'List them first: "ekanos teams triggers|links|mcp list <team> ..."'
-                                : 'Run "ekanos sources" to list the sources you hold a seat on.');
+                ? '"ekanos sources products" shows what this Source has; only a super-admin enables a product for a Source (in /admin).'
+                : code === 'SCOPE_NOT_FOUND' || code === 'PRODUCT_NOT_IN_SCOPE'
+                    ? 'Run "ekanos sources scopes" to see the Source\'s product scopes and their products.'
+                    : code === 'WEBHOOK_NOT_FOUND' || code === 'CONNECTION_NOT_FOUND'
+                        ? 'Run "ekanos teams show <team> <product>" to see its team apps and webhooks.'
+                        : code === 'MEMBER_NOT_FOUND'
+                            ? 'Run "ekanos teams members list <team>" to see its members and invitations.'
+                            : code === 'SKILL_NOT_FOUND'
+                                ? 'Run "ekanos skills list --team <team>" (and "ekanos skills list") to see the skills this team can use.'
+                                : (code === null || code === void 0 ? void 0 : code.startsWith('AGENT_')) || code === 'TEMPLATE_NOT_FOUND'
+                                    ? 'Run "ekanos teams agents list <team>" to see the team\'s agents.'
+                                    : /^(TRIGGER|LINK|MCP)_/.test(code !== null && code !== void 0 ? code : '')
+                                        ? 'List them first: "ekanos teams triggers|links|mcp list <team> ..."'
+                                        : 'Run "ekanos sources" to list the sources you hold a seat on.');
     }
     if (response.status === 409 && code === 'NO_TEAM_APP') {
         throw invalidStateError(message !== null && message !== void 0 ? message : 'This integration takes no team app.', 'Teams connect through the Source\'s app: "ekanos apps show <product>".');
@@ -126,13 +192,23 @@ export async function call(host, accessToken, schema, init) {
     if (response.status === 409 || response.status === 422) {
         throw invalidStateError(message !== null && message !== void 0 ? message : 'The host refused the change.', code === 'SLUG_TAKEN'
             ? 'Pick another with --slug, or run "ekanos teams list" to see the teams.'
-            : code === 'ALREADY_MEMBER' || code === 'ALREADY_INVITED'
-                ? 'Run "ekanos teams members list <team>"; change a role with "ekanos teams members role <team> <email> <role>".'
-                : code === 'PRIMARY_OWNER'
-                    ? "The primary owner's ownership is transferred in the app (team Settings → Members)."
-                    : code === 'TEAM_ACCOUNTS_DISABLED'
-                        ? 'Ekanos switches team accounts on for a Source; ask a super-admin.'
-                        : 'See "ekanos teams --help".');
+            : code === 'AGENT_VERSION_CHANGED'
+                ? 'A newer version was published since it was shown to you. Review it with "ekanos teams agents show <team> <key>", then run "ekanos teams agents confirm" again.'
+                : code === 'ALREADY_MEMBER' || code === 'ALREADY_INVITED'
+                    ? 'Run "ekanos teams members list <team>"; change a role with "ekanos teams members role <team> <email> <role>".'
+                    : code === 'PRIMARY_OWNER'
+                        ? "The primary owner's ownership is transferred in the app (team Settings → Members)."
+                        : code === 'TEAM_ACCOUNTS_DISABLED'
+                            ? 'Ekanos switches team accounts on for a Source; ask a super-admin.'
+                            : code === 'PERSONAL_CONNECTION'
+                                ? "The member who made it disconnects it on the team's Integrations page in the app."
+                                : code === 'MCP_SERVER_FROM_TEMPLATE'
+                                    ? 'It stays while the agent template declares it: change the template, apply and publish.'
+                                    : code === 'PRODUCT_NOT_ENTITLED'
+                                        ? '"ekanos sources products" shows what this Source has; only those can be in its scopes.'
+                                        : code === 'TEMPLATE_ARCHIVED'
+                                            ? 'Unarchive it first: "ekanos agents unarchive <key>".'
+                                            : 'See "ekanos teams --help".');
     }
     if (response.status === 400 && code === 'UNKNOWN_ROLE') {
         throw validationError(message !== null && message !== void 0 ? message : 'No such role.', 'Run "ekanos teams roles list <team>" for the roles this Source uses.');