@ekanos/cli 0.14.0 → 0.16.0

package/dist/commands/workflows.js

@@ -0,0 +1,589 @@
+import { TeamWorkflowRunStatusSchema, } from '@ekanos/integration-schema';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { loginHint } from '../auth/host-trust.js';
+import { refreshStoredSession, requireSession, resolveAuthEnvironment, } from '../auth/session.js';
+import { authRequiredError, usageError, validationError } from '../errors.js';
+import { writePulledFiles } from '../pull-write.js';
+import { resolveSourceTarget } from '../source-target.js';
+import { applyWorkflow, cancelWorkflowRun, decideWorkflowApproval, listWorkflowApprovals, listWorkflowRuns, listWorkflows, setWorkflowStatus, showWorkflow, showWorkflowRun, startWorkflowRun, } from '../workflows-api.js';
+import { promptYesNo } from './publish.js';
+export const WORKFLOWS_SUBCOMMANDS = [
+    'list',
+    'show',
+    'pull',
+    'apply',
+    'enable',
+    'disable',
+    'run',
+    'runs',
+    'approvals',
+];
+const RUNS_VERBS = ['list', 'show', 'cancel'];
+const APPROVALS_VERBS = ['list', 'approve', 'reject'];
+/** The file `pull` writes and a directory given to `apply` is read from. */
+export const WORKFLOW_FILE = 'workflow.json';
+const FOLLOW_INTERVAL_MS = 2000;
+const FOLLOW_TIMEOUT_MS = 15 * 60 * 1000;
+/**
+ * `workflows` — a team's workflows, for its Source admin: the same
+ * definitions the visual editor saves, saved through the same checks
+ * (shape, effect pinning, Custom Code review, write-behind-gate), activated
+ * through the same gate, run and approved through the same paths. A
+ * member's personal workflow is theirs alone and never reachable here.
+ */
+export async function runWorkflows(ctx, args) {
+    const [rawSubcommand, operand, third, ...extra] = args.positionals;
+    const subcommand = WORKFLOWS_SUBCOMMANDS.find((name) => name === rawSubcommand);
+    if (!subcommand) {
+        throw usageError(rawSubcommand
+            ? `Unknown workflows subcommand "${rawSubcommand}".`
+            : 'workflows needs a subcommand.', `Run one of: ${WORKFLOWS_SUBCOMMANDS.map((name) => `ekanos workflows ${name}`).join(', ')} — each with --team <slug>.`);
+    }
+    rejectExtra(extra);
+    const team = requireTeam(args.team);
+    switch (subcommand) {
+        case 'list':
+            rejectExtra([operand, third]);
+            return list(ctx, args, team);
+        case 'show':
+        case 'pull':
+        case 'enable':
+        case 'disable':
+        case 'run': {
+            rejectExtra([third]);
+            const workflow = requireOperand(operand, 'workflow (its id or name)', subcommand);
+            if (subcommand === 'show')
+                return show(ctx, args, team, workflow);
+            if (subcommand === 'pull')
+                return pull(ctx, args, team, workflow);
+            if (subcommand === 'run')
+                return run(ctx, args, team, workflow);
+            return setStatus(ctx, args, team, workflow, subcommand === 'enable' ? 'active' : 'paused');
+        }
+        case 'apply': {
+            rejectExtra([third]);
+            const file = requireOperand(operand, 'file or folder', 'apply');
+            return apply(ctx, args, team, file);
+        }
+        case 'runs':
+            return runs(ctx, args, team, operand, third);
+        case 'approvals':
+            return approvals(ctx, args, team, operand, third);
+    }
+}
+async function list(ctx, args, team) {
+    const { env, client, source } = await connect(ctx, args);
+    const listed = await client.call((token) => listWorkflows(env.host, token, { source, team, all: args.all }));
+    return ctx.succeed(Object.assign({ host: env.host }, listed), listed.workflows.length === 0
+        ? ctx.ui.result({
+            title: `No workflows on ${listed.team.slug}`,
+            tone: 'warn',
+            notes: [
+                'Write one as JSON (the editor\'s format) and "ekanos workflows apply <file> --team <slug>".',
+            ],
+        })
+        : ctx.ui.table(['ID', 'NAME', 'STATUS', 'TRIGGER', 'LAST RUN'], listed.workflows.map((workflow) => { var _a; return [
+            workflow.id,
+            workflow.name,
+            workflow.status,
+            (_a = workflow.trigger) !== null && _a !== void 0 ? _a : '?',
+            lastRunLabel(workflow),
+        ]; })));
+}
+async function show(ctx, args, team, workflow) {
+    var _a;
+    const { env, client, source } = await connect(ctx, args);
+    const detail = await client.call((token) => showWorkflow(env.host, token, { source, team, workflow }));
+    const { workflow: shown } = detail;
+    const rows = [
+        ['Id', shown.id],
+        ['Status', shown.status],
+        ['Trigger', (_a = shown.trigger) !== null && _a !== void 0 ? _a : 'unreadable definition'],
+        ['Updated', shown.updatedAt],
+        ...(detail.codeSteps.length > 0
+            ? [
+                [
+                    'Custom Code',
+                    detail.codeSteps.map((step) => [
+                        `${step.stepId}: ${CODE_STATUS_WORDS[step.reviewStatus]}`,
+                        step.reviewSummary ? ` — ${step.reviewSummary}` : '',
+                    ].join('')),
+                ],
+            ]
+            : []),
+        [
+            'Recent runs',
+            detail.recentRuns.length === 0
+                ? 'none'
+                : detail.recentRuns.map((run) => runLine(run)),
+        ],
+    ];
+    return ctx.succeed(Object.assign({ host: env.host }, detail), ctx.ui.result({
+        title: shown.name,
+        tone: detail.codeSteps.length > 0 ? 'warn' : 'ok',
+        rows,
+        notes: [
+            `The definition: --json, or "ekanos workflows pull ${shown.id} --team ${team}".`,
+        ],
+    }));
+}
+const CODE_STATUS_WORDS = {
+    pending: 'security review not finished',
+    rejected: 'rejected by security review',
+    missing: 'not reviewed yet (save it again)',
+    needs_approval: 'reviewed; needs your approval of what it reaches',
+};
+async function pull(ctx, args, team, workflow) {
+    var _a;
+    const { env, client, source } = await connect(ctx, args);
+    const detail = await client.call((token) => showWorkflow(env.host, token, { source, team, workflow }));
+    const outDir = path.resolve(args.dir, (_a = args.out) !== null && _a !== void 0 ? _a : path.join('workflows', folderName(detail.workflow.name)));
+    const written = writePulledFiles({
+        projectDir: args.dir,
+        outDir,
+        files: [
+            {
+                path: WORKFLOW_FILE,
+                contents: `${JSON.stringify(detail.workflow.dsl, null, 2)}\n`,
+            },
+        ],
+        force: args.force,
+        rerun: `ekanos workflows pull ${workflow} --team ${team}`,
+    });
+    const relative = path.relative(args.dir, outDir) || '.';
+    return ctx.succeed({
+        host: env.host,
+        team: detail.team,
+        workflow: { id: detail.workflow.id, name: detail.workflow.name },
+        files: written,
+    }, ctx.ui.result({
+        title: `Pulled ${detail.workflow.name}`,
+        rows: written.map((file) => ['Wrote', file]),
+        notes: [
+            `Edit, then "ekanos workflows apply ${relative} --team ${team} --update ${detail.workflow.id}".`,
+        ],
+    }));
+}
+async function apply(ctx, args, team, target) {
+    const dsl = readDefinition(args.dir, target);
+    const { env, client, source } = await connect(ctx, args);
+    const applied = await client.call((token) => applyWorkflow(env.host, token, { source, team }, Object.assign({ dsl }, (args.update ? { update: args.update } : {}))));
+    const { workflow } = applied;
+    const blocking = applied.codeReviews.filter((review) => review.reviewStatus !== 'approved');
+    return ctx.succeed(Object.assign({ host: env.host }, applied), ctx.ui.result({
+        title: `${applied.created ? 'Created' : 'Updated'} ${workflow.name} on ${applied.team.slug}`,
+        tone: applied.warnings.length > 0 || blocking.length > 0 ? 'warn' : 'ok',
+        rows: [
+            ['Id', workflow.id],
+            ['Status', workflow.status],
+            ...(applied.codeReviews.length > 0
+                ? [
+                    [
+                        'Custom Code',
+                        applied.codeReviews.map((review) => `${review.stepId}: review ${review.reviewStatus}${review.reviewSummary ? ` — ${review.reviewSummary}` : ''}`),
+                    ],
+                ]
+                : []),
+            ...(applied.warnings.length > 0
+                ? [['Warnings', applied.warnings]]
+                : []),
+        ],
+        notes: [
+            applied.warnings.length > 0
+                ? 'Saved, but activation refuses until the warnings are fixed.'
+                : workflow.status === 'draft'
+                    ? `A draft until you turn it on: "ekanos workflows enable ${workflow.id} --team ${team}" ("workflows run ${workflow.id} --dry-run" rehearses it first).`
+                    : `It stays ${workflow.status}.`,
+        ],
+    }));
+}
+async function setStatus(ctx, args, team, workflow, status) {
+    var _a, _b, _c;
+    const { env, client, source } = await connect(ctx, args);
+    const send = (confirmAccess) => client.call((token) => setWorkflowStatus(env.host, token, { source, team, workflow }, { status, confirmAccess }), { allowNeedsAccess: true });
+    let changed = await send(args.confirmAccess);
+    if ('needsAccess' in changed) {
+        const lines = changed.needsAccess.map(accessLine);
+        if (ctx.jsonMode || !((_a = args.stdinIsTTY) !== null && _a !== void 0 ? _a : process.stdin.isTTY === true)) {
+            throw validationError([
+                `Turning on ${workflow} needs your approval of what its Custom Code reaches:`,
+                ...lines.map((line) => `  ${line}`),
+            ].join('\n'), `Nothing changed. If you approve it, as yourself: ekanos workflows enable ${workflow} --team ${team} --confirm-access`);
+        }
+        for (const line of lines)
+            ctx.log(`  ${line}`);
+        const confirmed = await ((_b = args.confirm) !== null && _b !== void 0 ? _b : promptYesNo)('Approve this access, as yourself, and turn the workflow on? [y/N]');
+        if (!confirmed) {
+            throw validationError('The Custom Code access was not approved.', 'Nothing changed.');
+        }
+        changed = await send(true);
+        if ('needsAccess' in changed) {
+            throw validationError('The host still asks for approval of the Custom Code access.', 'Nothing changed. Run "ekanos workflows show" for what it reaches.');
+        }
+    }
+    return ctx.succeed(Object.assign({ host: env.host }, changed), ctx.ui.result({
+        title: `${status === 'active' ? 'Turned on' : 'Paused'} ${changed.workflow.name} on ${changed.team.slug}`,
+        tone: status === 'active' ? 'ok' : 'warn',
+        rows: [
+            ['Status', `${changed.from} → ${changed.workflow.status}`],
+            ['Trigger', (_c = changed.workflow.trigger) !== null && _c !== void 0 ? _c : '?'],
+        ],
+        notes: status === 'active'
+            ? [
+                'Its trigger now starts it; every write still waits on its approval gate.',
+            ]
+            : ['Its trigger no longer starts it. Runs already going continue.'],
+    }));
+}
+function accessLine(access) {
+    const parts = [
+        access.effect === 'write' ? 'writes' : 'reads',
+        ...(access.egressHosts.length > 0
+            ? [`reaches ${access.egressHosts.join(', ')}`]
+            : []),
+        ...(access.tools.length > 0 ? [`calls ${access.tools.join(', ')}`] : []),
+    ];
+    return `${access.stepId}: ${parts.join('; ')}${access.reviewSummary ? ` — review: ${access.reviewSummary}` : ''}`;
+}
+async function run(ctx, args, team, workflow) {
+    if (args.input && !args.dryRun) {
+        throw usageError('--input is a sample trigger payload for a dry run.', `A live run takes what its trigger gives it. Rehearse with it: ekanos workflows run ${workflow} --team ${team} --dry-run --input ${args.input}`);
+    }
+    const input = args.input ? readSample(args.dir, args.input) : undefined;
+    const { env, client, source } = await connect(ctx, args);
+    const started = await client.call((token) => startWorkflowRun(env.host, token, { source, team, workflow }, Object.assign({ dryRun: args.dryRun }, (input ? { input } : {}))));
+    const note = `${started.dryRun ? 'Rehearsing' : 'Started'} ${started.workflow.name} on ${started.team.slug}: run ${started.runId}`;
+    if (!args.follow) {
+        return ctx.succeed(Object.assign({ host: env.host }, started), ctx.ui.result({
+            title: note,
+            notes: [
+                ...(started.dryRun
+                    ? ['A dry run: writes are recorded, not sent, and gates pass.']
+                    : []),
+                `Watch it: "ekanos workflows runs show ${started.runId} --team ${team}".`,
+            ],
+        }));
+    }
+    ctx.log(note);
+    const detail = await follow(ctx, args, () => client.call((token) => showWorkflowRun(env.host, token, {
+        source,
+        team,
+        runId: started.runId,
+    })));
+    return ctx.succeed(Object.assign({ host: env.host, started }, detail), runDetail(ctx.ui, detail));
+}
+/** Poll until the run ends or parks on a gate, logging each step it finishes. */
+async function follow(ctx, args, read) {
+    var _a;
+    const sleep = (_a = args.sleep) !== null && _a !== void 0 ? _a : ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    const seen = new Set();
+    let lastStatus = '';
+    const deadline = Date.now() + FOLLOW_TIMEOUT_MS;
+    for (;;) {
+        const detail = await read();
+        for (const step of detail.run.stepsExecuted) {
+            if (seen.has(step))
+                continue;
+            seen.add(step);
+            ctx.log(`  ✓ ${step}`);
+        }
+        if (detail.run.status !== lastStatus) {
+            lastStatus = detail.run.status;
+            ctx.log(`  status: ${lastStatus}`);
+        }
+        if (detail.run.status !== 'running' || Date.now() > deadline) {
+            return detail;
+        }
+        await sleep(FOLLOW_INTERVAL_MS);
+    }
+}
+async function runs(ctx, args, team, rawVerb, operand) {
+    const verb = RUNS_VERBS.find((name) => name === rawVerb);
+    if (!verb) {
+        throw usageError(rawVerb
+            ? `Unknown workflows runs verb "${rawVerb}".`
+            : 'workflows runs needs a verb.', 'Run one of: ekanos workflows runs list --team <slug> [--workflow <id>] [--status <status>], ekanos workflows runs show <run-id> --team <slug>, ekanos workflows runs cancel <run-id> --team <slug> [--yes].');
+    }
+    if (verb === 'list') {
+        rejectExtra([operand]);
+        const status = parseStatus(args.status);
+        const { env, client, source } = await connect(ctx, args);
+        const listed = await client.call((token) => listWorkflowRuns(env.host, token, {
+            source,
+            team,
+            workflow: args.workflow,
+            status,
+        }));
+        return ctx.succeed(Object.assign({ host: env.host }, listed), listed.runs.length === 0
+            ? ctx.ui.result({
+                title: `No workflow runs on ${listed.team.slug}`,
+                tone: 'warn',
+            })
+            : ctx.ui.table(['RUN', 'WORKFLOW', 'STATUS', 'STARTED'], listed.runs.map((run) => [
+                run.id,
+                run.workflow.name,
+                `${run.status}${run.dryRun ? ' (dry run)' : ''}`,
+                run.startedAt.slice(0, 19).replace('T', ' '),
+            ])));
+    }
+    const runId = requireOperand(operand, 'run id', `runs ${verb}`);
+    if (verb === 'cancel')
+        await confirmCancel(ctx, args, runId, team);
+    const { env, client, source } = await connect(ctx, args);
+    if (verb === 'show') {
+        const detail = await client.call((token) => showWorkflowRun(env.host, token, { source, team, runId }));
+        return ctx.succeed(Object.assign({ host: env.host }, detail), runDetail(ctx.ui, detail));
+    }
+    const cancelled = await client.call((token) => cancelWorkflowRun(env.host, token, { source, team, runId }));
+    return ctx.succeed(Object.assign({ host: env.host }, cancelled), ctx.ui.result({
+        title: `Cancelled run ${cancelled.run.id} on ${cancelled.team.slug}`,
+        tone: 'warn',
+        rows: [
+            ['Workflow', cancelled.run.workflow.name],
+            ['Status', cancelled.run.status],
+        ],
+        notes: ['Its pending approvals expired.'],
+    }));
+}
+async function confirmCancel(ctx, args, runId, team) {
+    var _a, _b;
+    if (args.yes)
+        return;
+    if (ctx.jsonMode || !((_a = args.stdinIsTTY) !== null && _a !== void 0 ? _a : process.stdin.isTTY === true)) {
+        throw validationError(`Cancelling run ${runId} on ${team} needs confirmation.`, `It stops the run for good and expires its pending approvals. Pass --yes to confirm: ekanos workflows runs cancel ${runId} --team ${team} --yes`);
+    }
+    const confirmed = await ((_b = args.confirm) !== null && _b !== void 0 ? _b : promptYesNo)(`Stop run ${runId} on ${team} for good? [y/N]`);
+    if (!confirmed) {
+        throw validationError(`Cancelling run ${runId} was not confirmed.`, 'Nothing was changed.');
+    }
+}
+async function approvals(ctx, args, team, rawVerb, operand) {
+    const verb = APPROVALS_VERBS.find((name) => name === rawVerb);
+    if (!verb) {
+        throw usageError(rawVerb
+            ? `Unknown workflows approvals verb "${rawVerb}".`
+            : 'workflows approvals needs a verb.', 'Run one of: ekanos workflows approvals list --team <slug>, ekanos workflows approvals approve|reject <id> --team <slug> [--reason "…"].');
+    }
+    if (verb === 'list') {
+        rejectExtra([operand]);
+        const { env, client, source } = await connect(ctx, args);
+        const listed = await client.call((token) => listWorkflowApprovals(env.host, token, { source, team }));
+        return ctx.succeed(Object.assign({ host: env.host }, listed), listed.approvals.length === 0
+            ? ctx.ui.result({ title: `Nothing waiting on ${listed.team.slug}` })
+            : ctx.ui.result({
+                title: `${listed.approvals.length} waiting on ${listed.team.slug}`,
+                tone: 'warn',
+                rows: listed.approvals.map((approval) => [
+                    approval.id,
+                    approvalLines(approval),
+                ]),
+                notes: [
+                    '"ekanos workflows approvals approve|reject <id> --team <slug>" decides one.',
+                ],
+            }));
+    }
+    const approvalId = requireOperand(operand, 'approval id', `approvals ${verb}`);
+    const { env, client, source } = await connect(ctx, args);
+    const decided = await client.call((token) => decideWorkflowApproval(env.host, token, { source, team, approvalId }, Object.assign({ decision: verb === 'reject' ? 'rejected' : 'approved' }, (args.reason ? { reason: args.reason } : {}))));
+    const { approval } = decided;
+    return ctx.succeed(Object.assign({ host: env.host }, decided), ctx.ui.result({
+        title: `${approval.status === 'rejected' ? 'Rejected' : 'Approved'} ${approval.stepId} in ${approval.workflow.name}`,
+        tone: approval.status === 'rejected' ? 'warn' : 'ok',
+        rows: [['Run', approval.runId]],
+        notes: [
+            `The run picks it up now: "ekanos workflows runs show ${approval.runId} --team ${team}".`,
+        ],
+    }));
+}
+function runDetail(ui, detail) {
+    const { run } = detail;
+    const pending = detail.approvals.filter((approval) => approval.status === 'pending');
+    const decisions = Object.entries(run.gateDecisions);
+    return ui.result({
+        title: `Run ${run.id}`,
+        tone: run.status === 'failed' || run.status === 'rejected'
+            ? 'err'
+            : run.status === 'completed'
+                ? 'ok'
+                : 'warn',
+        rows: [
+            ['Workflow', run.workflow.name],
+            ['Status', `${run.status}${run.dryRun ? ' (dry run)' : ''}`],
+            ['Started', run.startedAt],
+            ...(run.finishedAt ? [['Finished', run.finishedAt]] : []),
+            ...(run.error ? [['Error', run.error]] : []),
+            [
+                'Steps',
+                run.stepsExecuted.length === 0 ? 'none yet' : run.stepsExecuted,
+            ],
+            ...(decisions.length > 0
+                ? [
+                    [
+                        'Gates',
+                        decisions.map(([step, decision]) => `${step}: ${decision}`),
+                    ],
+                ]
+                : []),
+            ...(pending.length > 0
+                ? [
+                    [
+                        'Waiting on',
+                        pending.map((approval) => `${approval.id}  ${approval.stepId}`),
+                    ],
+                ]
+                : []),
+        ],
+        notes: pending.length > 0
+            ? [
+                `Decide: "ekanos workflows approvals approve|reject <id> --team ${detail.team.slug}".`,
+            ]
+            : ['The full record: --json.'],
+    });
+}
+function approvalLines(approval) {
+    return [
+        `${approval.stepId} · ${approval.workflow.name}`,
+        `run ${approval.runId}${approval.expiresAt ? ` · expires ${approval.expiresAt}` : ''}`,
+        clip(approval.summary),
+    ];
+}
+function runLine(run) {
+    return `${run.id}  ${run.status}${run.dryRun ? ' (dry run)' : ''}  ${run.startedAt.slice(0, 19).replace('T', ' ')}`;
+}
+function lastRunLabel(workflow) {
+    const run = workflow.lastRun;
+    if (!run)
+        return 'never';
+    return `${run.status}${run.dryRun ? ' (dry)' : ''} ${run.startedAt.slice(0, 16).replace('T', ' ')}`;
+}
+function clip(text, max = 200) {
+    const flat = text.replace(/\s+/g, ' ').trim();
+    return flat.length > max ? `${flat.slice(0, max - 1)}…` : flat;
+}
+/** A folder name for `pull`'s default `workflows/<name>`. */
+function folderName(name) {
+    const slug = name
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .slice(0, 60);
+    return slug || 'workflow';
+}
+/** `apply <file|dir>`: the JSON the editor saves, from a file or `<dir>/workflow.json`. */
+function readDefinition(dir, target) {
+    const resolved = path.resolve(dir, target);
+    let file = resolved;
+    try {
+        if (fs.statSync(resolved).isDirectory()) {
+            file = path.join(resolved, WORKFLOW_FILE);
+        }
+    }
+    catch (_a) {
+        throw usageError(`Cannot read ${resolved}.`, `Pass a workflow JSON file, or a folder holding ${WORKFLOW_FILE}.`);
+    }
+    let raw;
+    try {
+        raw = fs.readFileSync(file, 'utf8');
+    }
+    catch (_b) {
+        throw usageError(`Cannot read ${file}.`, `Pass a workflow JSON file, or a folder holding ${WORKFLOW_FILE}.`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (_c) {
+        throw validationError(`${file} is not valid JSON.`, 'A workflow is the JSON the editor saves: { version, name, scope, trigger, steps, edges }.');
+    }
+    if (typeof parsed !== 'object' ||
+        parsed === null ||
+        Array.isArray(parsed) ||
+        typeof parsed.name !== 'string') {
+        throw validationError(`${file} is not a workflow definition.`, 'A workflow is the JSON the editor saves: { version, name, scope, trigger, steps, edges }. "ekanos workflows pull <id>" writes one.');
+    }
+    return parsed;
+}
+/** `--input`: a JSON object, the dry run's sample `trigger.*`. */
+function readSample(dir, file) {
+    const resolved = path.resolve(dir, file);
+    let raw;
+    try {
+        raw = fs.readFileSync(resolved, 'utf8');
+    }
+    catch (_a) {
+        throw usageError(`Cannot read ${resolved}.`, 'Pass --input <file.json>.');
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (_b) {
+        throw validationError(`${resolved} is not valid JSON.`, 'Fix the file.');
+    }
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        throw validationError(`${resolved} is not a JSON object.`, 'The sample payload is read as trigger.*, so it is an object of fields.');
+    }
+    return parsed;
+}
+function parseStatus(raw) {
+    if (raw === undefined)
+        return undefined;
+    const parsed = TeamWorkflowRunStatusSchema.safeParse(raw.trim());
+    if (parsed.success)
+        return parsed.data;
+    throw usageError(`--status "${raw}" is not a workflow run status.`, `Use one of: ${TeamWorkflowRunStatusSchema.options.join(', ')}.`);
+}
+function requireTeam(value) {
+    const slug = value === null || value === void 0 ? void 0 : value.trim().toLowerCase();
+    if (slug && /^[a-z0-9][a-z0-9-]*$/.test(slug))
+        return slug;
+    throw usageError(value
+        ? `"${value}" is not a team slug.`
+        : 'Name the team with --team <slug>.', '"ekanos teams list" lists the teams on this Source.');
+}
+function requireOperand(value, what, command) {
+    const trimmed = value === null || value === void 0 ? void 0 : value.trim();
+    if (trimmed)
+        return trimmed;
+    throw usageError(`Name the ${what}.`, `e.g. "ekanos workflows ${command} <…> --team <slug>". See "ekanos workflows --help".`);
+}
+function rejectExtra(extra) {
+    const first = extra.find((value) => value !== undefined);
+    if (first !== undefined) {
+        throw usageError(`Unexpected argument "${first}".`, 'See "ekanos workflows --help".');
+    }
+}
+async function connect(ctx, args) {
+    const env = resolveAuthEnvironment(ctx, args.host, args.env, {
+        projectDir: args.dir,
+    });
+    const resolved = await resolveSourceTarget(env, requireSession(env), args);
+    return {
+        env,
+        client: new WorkflowsClient(env, resolved.session),
+        source: resolved.source,
+    };
+}
+class WorkflowsClient {
+    constructor(env, session) {
+        this.env = env;
+        this.session = session;
+    }
+    async call(send, options) {
+        let result = await send(this.session.accessToken);
+        if (result.status === 'unauthorized') {
+            this.session = await refreshStoredSession(this.env, this.session);
+            result = await send(this.session.accessToken);
+        }
+        if (result.status === 'ok')
+            return result.data;
+        if (result.status === 'needs-access') {
+            if (options === null || options === void 0 ? void 0 : options.allowNeedsAccess)
+                return { needsAccess: result.codeAccess };
+            throw validationError(result.error, 'Run "ekanos workflows enable <id> --team <slug>" to review and approve it.');
+        }
+        throw authRequiredError(`The session for ${this.env.host} could not authorize the call.`, loginHint(this.env));
+    }
+}
+//# sourceMappingURL=workflows.js.map