@ekanos/cli 0.15.0 → 0.17.0

package/dist/commands/teams-audience.js

@@ -0,0 +1,144 @@
+import { requireSession, resolveAuthEnvironment } from '../auth/session.js';
+import { invalidStateError, usageError } from '../errors.js';
+import { resolveSourceTarget } from '../source-target.js';
+import { listAudiences, setMemberAudience, setTeamAudience, showMemberAudience, showTeamAudience, } from '../teams-api.js';
+import { TeamsClient } from './teams.js';
+const USAGE = 'Run "ekanos teams audience <team>" to read a team’s audience, "ekanos teams audience <team> <audience> [--yes]" to set it, or add --member <email> (with <audience>, or --inherit to clear it) for one person’s own.';
+/**
+ * `teams audience <team> [<audience>] [--member <email> [--inherit]]` — the
+ * audience a team starts its members on, and a member's own override of it
+ * (a Source admin's only; audited). Without an audience it reads. Moving
+ * people to an audience that shows fewer products hides the difference from
+ * them in the app, so that needs `--yes`. `teams scope` is the deprecated
+ * form of this.
+ */
+export async function runTeamAudience(ctx, args, rest) {
+    var _a, _b;
+    const [rawTeam, audience, ...extra] = rest;
+    const team = rawTeam === null || rawTeam === void 0 ? void 0 : rawTeam.trim().toLowerCase();
+    if (!team || !/^[a-z0-9][a-z0-9-]*$/.test(team)) {
+        throw usageError(rawTeam
+            ? `"${rawTeam}" is not a team slug.`
+            : 'teams audience needs a team.', USAGE);
+    }
+    if (extra.length > 0) {
+        throw usageError(`Unexpected argument "${extra[0]}".`, USAGE);
+    }
+    const member = typeof ((_a = args.flags) === null || _a === void 0 ? void 0 : _a.member) === 'string'
+        ? args.flags.member.trim().toLowerCase()
+        : undefined;
+    const inherit = ((_b = args.flags) === null || _b === void 0 ? void 0 : _b.inherit) === true;
+    if (inherit && !member) {
+        throw usageError('--inherit clears one member’s audience.', USAGE);
+    }
+    if (inherit && audience) {
+        throw usageError('Name an audience or pass --inherit, not both.', 'ekanos teams audience <team> --member <email> --inherit puts them back on the team’s.');
+    }
+    if (member && !/^[^@\s]+@[^@\s]+$/.test(member)) {
+        throw usageError(`"${member}" is not an email address.`, USAGE);
+    }
+    const env = resolveAuthEnvironment(ctx, args.host, args.env, {
+        projectDir: args.dir,
+    });
+    const resolved = await resolveSourceTarget(env, requireSession(env), args);
+    const client = new TeamsClient(env, resolved.session);
+    const source = resolved.source;
+    const target = { source, team };
+    if (member) {
+        const person = Object.assign(Object.assign({}, target), { email: member });
+        const current = await client.call((token) => showMemberAudience(env.host, token, person));
+        if (!audience && !inherit) {
+            return ctx.succeed(Object.assign({ host: env.host }, current), describeMember(ctx, current));
+        }
+        const next = inherit
+            ? (await client.call((token) => showTeamAudience(env.host, token, target))).audience.id
+            : audience;
+        await requireYesIfNarrowing(client, env.host, {
+            source,
+            from: current.audience,
+            to: next,
+            who: `${member}`,
+            yes: args.yes,
+            retry: `ekanos teams audience ${team} ${inherit ? '' : `${quote(audience)} `}--member ${member}${inherit ? ' --inherit' : ''} --source ${source} --yes`,
+        });
+        const result = await client.call((token) => setMemberAudience(env.host, token, person, inherit ? null : audience));
+        return ctx.succeed(Object.assign({ host: env.host }, result), describeMember(ctx, result, result.before));
+    }
+    const current = await client.call((token) => showTeamAudience(env.host, token, target));
+    if (!audience) {
+        return ctx.succeed(Object.assign({ host: env.host }, current), describeTeam(ctx, current));
+    }
+    await requireYesIfNarrowing(client, env.host, {
+        source,
+        from: current.audience,
+        to: audience,
+        who: `members of ${team} on the team default`,
+        yes: args.yes,
+        retry: `ekanos teams audience ${team} ${quote(audience)} --source ${source} --yes`,
+    });
+    const result = await client.call((token) => setTeamAudience(env.host, token, target, audience));
+    return ctx.succeed(Object.assign({ host: env.host }, result), describeTeam(ctx, result, result.before));
+}
+/**
+ * Refuses, before any write, a move to an audience that shows less than the
+ * one people are on, unless `--yes`. An audience that shows every entitled
+ * product can only be left for a narrower one, which is also refused.
+ */
+async function requireYesIfNarrowing(client, host, input) {
+    if (input.yes)
+        return;
+    const { audiences } = await client.call((token) => listAudiences(host, token, input.source));
+    const from = audiences.find((entry) => entry.id === input.from.id);
+    const to = findAudience(audiences, input.to);
+    if (!from || !to || to.includesAllEntitled)
+        return;
+    const kept = new Set(to.products.map((product) => product.slug));
+    const lost = from.includesAllEntitled
+        ? null
+        : from.products.filter((product) => !kept.has(product.slug));
+    if (lost !== null && lost.length === 0)
+        return;
+    throw invalidStateError(lost === null
+        ? `${to.name} does not show every product the Source has, as ${from.name} does: ${input.who} may stop seeing some in the app.`
+        : `${input.who} would stop seeing ${lost.map((product) => product.slug).join(', ')} in the app: ${from.name} shows ${lost.length === 1 ? 'it' : 'them'}, ${to.name} does not.`, `Re-run with --yes: ${input.retry}`);
+}
+function findAudience(audiences, ref) {
+    const wanted = ref.trim().toLowerCase();
+    return audiences.find((entry) => entry.id === wanted || entry.name.toLowerCase() === wanted);
+}
+function describeTeam(ctx, result, before) {
+    var _a;
+    return ctx.ui.result({
+        title: `${result.team.slug} starts its members on ${result.audience.name}`,
+        rows: [
+            ['Audience', result.audience.name],
+            ...(before !== undefined
+                ? [['Before', (_a = before === null || before === void 0 ? void 0 : before.name) !== null && _a !== void 0 ? _a : 'none']]
+                : []),
+        ],
+        notes: [
+            'A member’s own audience overrides it: "ekanos teams audience <team> <audience> --member <email>".',
+            '"ekanos audiences show <audience>" lists what it shows.',
+        ],
+    });
+}
+function describeMember(ctx, result, before) {
+    var _a;
+    return ctx.ui.result({
+        title: `${result.member.email} is on ${result.audience.name}`,
+        rows: [
+            ['Audience', result.audience.name],
+            [
+                'From',
+                result.isOverride ? 'their own' : `the ${result.team.slug} default`,
+            ],
+            ...(before !== undefined
+                ? [['Before', (_a = before === null || before === void 0 ? void 0 : before.name) !== null && _a !== void 0 ? _a : 'none']]
+                : []),
+        ],
+    });
+}
+function quote(name) {
+    return /^[A-Za-z0-9._-]+$/.test(name) ? name : `"${name}"`;
+}
+//# sourceMappingURL=teams-audience.js.map

package/dist/commands/teams-audience.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"teams-audience.js","sourceRoot":"","sources":["../../src/commands/teams-audience.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAEzE,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAkB,MAAM,SAAS,CAAC;AAEtD,MAAM,KAAK,GACT,sNAAsN,CAAC;AAEzN;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAe,EACf,IAAe,EACf,IAAuB;;IAEvB,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC;IAC3C,MAAM,IAAI,GAAG,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3C,IAAI,CAAC,IAAI,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,UAAU,CACd,OAAO;YACL,CAAC,CAAC,IAAI,OAAO,uBAAuB;YACpC,CAAC,CAAC,8BAA8B,EAClC,KAAK,CACN,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,UAAU,CAAC,wBAAwB,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,MAAM,GACV,QAAO,MAAA,IAAI,CAAC,KAAK,0CAAE,MAAM,CAAA,KAAK,QAAQ;QACpC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;QACxC,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,OAAO,GAAG,CAAA,MAAA,IAAI,CAAC,KAAK,0CAAE,OAAO,MAAK,IAAI,CAAC;IAC7C,IAAI,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,UAAU,CAAC,yCAAyC,EAAE,KAAK,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;QACxB,MAAM,UAAU,CACd,+CAA+C,EAC/C,uFAAuF,CACxF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,MAAM,UAAU,CAAC,IAAI,MAAM,4BAA4B,EAAE,KAAK,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE;QAC3D,UAAU,EAAE,IAAI,CAAC,GAAG;KACrB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC/B,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAEhC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,MAAM,mCAAQ,MAAM,KAAE,KAAK,EAAE,MAAM,GAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAC1C,kBAAkB,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAC5C,CAAC;QACF,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1B,OAAO,GAAG,CAAC,OAAO,iBACd,IAAI,EAAE,GAAG,CAAC,IAAI,IAAK,OAAO,GAC5B,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAC7B,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,OAAO;YAClB,CAAC,CAAC,CACE,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAC1B,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAC1C,CACF,CAAC,QAAQ,CAAC,EAAE;YACf,CAAC,CAAC,QAAS,CAAC;QACd,MAAM,qBAAqB,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE;YAC5C,MAAM;YACN,IAAI,EAAE,OAAO,CAAC,QAAQ;YACtB,EAAE,EAAE,IAAI;YACR,GAAG,EAAE,GAAG,MAAM,EAAE;YAChB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,KAAK,EAAE,yBAAyB,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,QAAS,CAAC,GAAG,YAAY,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,MAAM,QAAQ;SACzJ,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CACzC,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAS,CAAC,CACvE,CAAC;QACF,OAAO,GAAG,CAAC,OAAO,iBACd,IAAI,EAAE,GAAG,CAAC,IAAI,IAAK,MAAM,GAC3B,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAC3C,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAC1C,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAC1C,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,GAAG,CAAC,OAAO,iBACd,IAAI,EAAE,GAAG,CAAC,IAAI,IAAK,OAAO,GAC5B,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAC3B,CAAC;IACJ,CAAC;IACD,MAAM,qBAAqB,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE;QAC5C,MAAM;QACN,IAAI,EAAE,OAAO,CAAC,QAAQ;QACtB,EAAE,EAAE,QAAQ;QACZ,GAAG,EAAE,cAAc,IAAI,sBAAsB;QAC7C,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,KAAK,EAAE,yBAAyB,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,MAAM,QAAQ;KACnF,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CACzC,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CACnD,CAAC;IACF,OAAO,GAAG,CAAC,OAAO,iBACd,IAAI,EAAE,GAAG,CAAC,IAAI,IAAK,MAAM,GAC3B,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CACzC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,qBAAqB,CAClC,MAAmB,EACnB,IAAY,EACZ,KAOC;IAED,IAAI,KAAK,CAAC,GAAG;QAAE,OAAO;IACtB,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAChD,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CACzC,CAAC;IACF,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnE,MAAM,EAAE,GAAG,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,mBAAmB;QAAE,OAAO;IAEnD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,IAAI,CAAC,mBAAmB;QACnC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAE/C,MAAM,iBAAiB,CACrB,IAAI,KAAK,IAAI;QACX,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,mDAAmD,IAAI,CAAC,IAAI,UAAU,KAAK,CAAC,GAAG,mCAAmC;QAC9H,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,sBAAsB,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,IAAI,UAAU,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,IAAI,YAAY,EAChL,sBAAsB,KAAK,CAAC,KAAK,EAAE,CACpC,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,SAAqB,EACrB,GAAW;IAEX,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxC,OAAO,SAAS,CAAC,IAAI,CACnB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CACtE,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,GAAe,EACf,MAAoB,EACpB,MAA2B;;IAE3B,OAAO,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,0BAA0B,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE;QAC1E,IAAI,EAAE;YACJ,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAClC,GAAG,CAAC,MAAM,KAAK,SAAS;gBACtB,CAAC,CAAE,CAAC,CAAC,QAAQ,QAAE,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,IAAI,mCAAI,MAAM,CAAC,CAA6B;gBACnE,CAAC,CAAC,EAAE,CAAC;SACR;QACD,KAAK,EAAE;YACL,mGAAmG;YACnG,yDAAyD;SAC1D;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CACrB,GAAe,EACf,MAAsB,EACtB,MAA2B;;IAE3B,OAAO,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE;QAC7D,IAAI,EAAE;YACJ,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAClC;gBACE,MAAM;gBACN,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU;aACpE;YACD,GAAG,CAAC,MAAM,KAAK,SAAS;gBACtB,CAAC,CAAE,CAAC,CAAC,QAAQ,QAAE,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,IAAI,mCAAI,MAAM,CAAC,CAA6B;gBACnE,CAAC,CAAC,EAAE,CAAC;SACR;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,KAAK,CAAC,IAAY;IACzB,OAAO,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC;AAC7D,CAAC","sourcesContent":["import type {\n  Audience,\n  AudienceRef,\n  MemberAudience,\n  TeamAudience,\n} from '@ekanos/integration-schema';\n\nimport { requireSession, resolveAuthEnvironment } from '../auth/session';\nimport type { CliContext } from '../context';\nimport { invalidStateError, usageError } from '../errors';\nimport type { ExitCode } from '../exit-codes';\nimport { resolveSourceTarget } from '../source-target';\nimport {\n  listAudiences,\n  setMemberAudience,\n  setTeamAudience,\n  showMemberAudience,\n  showTeamAudience,\n} from '../teams-api';\nimport { TeamsClient, type TeamsArgs } from './teams';\n\nconst USAGE =\n  'Run \"ekanos teams audience <team>\" to read a team’s audience, \"ekanos teams audience <team> <audience> [--yes]\" to set it, or add --member <email> (with <audience>, or --inherit to clear it) for one person’s own.';\n\n/**\n * `teams audience <team> [<audience>] [--member <email> [--inherit]]` — the\n * audience a team starts its members on, and a member's own override of it\n * (a Source admin's only; audited). Without an audience it reads. Moving\n * people to an audience that shows fewer products hides the difference from\n * them in the app, so that needs `--yes`. `teams scope` is the deprecated\n * form of this.\n */\nexport async function runTeamAudience(\n  ctx: CliContext,\n  args: TeamsArgs,\n  rest: readonly string[],\n): Promise<ExitCode> {\n  const [rawTeam, audience, ...extra] = rest;\n  const team = rawTeam?.trim().toLowerCase();\n  if (!team || !/^[a-z0-9][a-z0-9-]*$/.test(team)) {\n    throw usageError(\n      rawTeam\n        ? `\"${rawTeam}\" is not a team slug.`\n        : 'teams audience needs a team.',\n      USAGE,\n    );\n  }\n  if (extra.length > 0) {\n    throw usageError(`Unexpected argument \"${extra[0]}\".`, USAGE);\n  }\n  const member =\n    typeof args.flags?.member === 'string'\n      ? args.flags.member.trim().toLowerCase()\n      : undefined;\n  const inherit = args.flags?.inherit === true;\n  if (inherit && !member) {\n    throw usageError('--inherit clears one member’s audience.', USAGE);\n  }\n  if (inherit && audience) {\n    throw usageError(\n      'Name an audience or pass --inherit, not both.',\n      'ekanos teams audience <team> --member <email> --inherit puts them back on the team’s.',\n    );\n  }\n  if (member && !/^[^@\\s]+@[^@\\s]+$/.test(member)) {\n    throw usageError(`\"${member}\" is not an email address.`, USAGE);\n  }\n\n  const env = resolveAuthEnvironment(ctx, args.host, args.env, {\n    projectDir: args.dir,\n  });\n  const resolved = await resolveSourceTarget(env, requireSession(env), args);\n  const client = new TeamsClient(env, resolved.session);\n  const source = resolved.source;\n  const target = { source, team };\n\n  if (member) {\n    const person = { ...target, email: member };\n    const current = await client.call((token) =>\n      showMemberAudience(env.host, token, person),\n    );\n    if (!audience && !inherit) {\n      return ctx.succeed(\n        { host: env.host, ...current },\n        describeMember(ctx, current),\n      );\n    }\n\n    const next = inherit\n      ? (\n          await client.call((token) =>\n            showTeamAudience(env.host, token, target),\n          )\n        ).audience.id\n      : audience!;\n    await requireYesIfNarrowing(client, env.host, {\n      source,\n      from: current.audience,\n      to: next,\n      who: `${member}`,\n      yes: args.yes,\n      retry: `ekanos teams audience ${team} ${inherit ? '' : `${quote(audience!)} `}--member ${member}${inherit ? ' --inherit' : ''} --source ${source} --yes`,\n    });\n    const result = await client.call((token) =>\n      setMemberAudience(env.host, token, person, inherit ? null : audience!),\n    );\n    return ctx.succeed(\n      { host: env.host, ...result },\n      describeMember(ctx, result, result.before),\n    );\n  }\n\n  const current = await client.call((token) =>\n    showTeamAudience(env.host, token, target),\n  );\n  if (!audience) {\n    return ctx.succeed(\n      { host: env.host, ...current },\n      describeTeam(ctx, current),\n    );\n  }\n  await requireYesIfNarrowing(client, env.host, {\n    source,\n    from: current.audience,\n    to: audience,\n    who: `members of ${team} on the team default`,\n    yes: args.yes,\n    retry: `ekanos teams audience ${team} ${quote(audience)} --source ${source} --yes`,\n  });\n  const result = await client.call((token) =>\n    setTeamAudience(env.host, token, target, audience),\n  );\n  return ctx.succeed(\n    { host: env.host, ...result },\n    describeTeam(ctx, result, result.before),\n  );\n}\n\n/**\n * Refuses, before any write, a move to an audience that shows less than the\n * one people are on, unless `--yes`. An audience that shows every entitled\n * product can only be left for a narrower one, which is also refused.\n */\nasync function requireYesIfNarrowing(\n  client: TeamsClient,\n  host: string,\n  input: {\n    source: string;\n    from: AudienceRef;\n    to: string;\n    who: string;\n    yes: boolean;\n    retry: string;\n  },\n): Promise<void> {\n  if (input.yes) return;\n  const { audiences } = await client.call((token) =>\n    listAudiences(host, token, input.source),\n  );\n  const from = audiences.find((entry) => entry.id === input.from.id);\n  const to = findAudience(audiences, input.to);\n  if (!from || !to || to.includesAllEntitled) return;\n\n  const kept = new Set(to.products.map((product) => product.slug));\n  const lost = from.includesAllEntitled\n    ? null\n    : from.products.filter((product) => !kept.has(product.slug));\n  if (lost !== null && lost.length === 0) return;\n\n  throw invalidStateError(\n    lost === null\n      ? `${to.name} does not show every product the Source has, as ${from.name} does: ${input.who} may stop seeing some in the app.`\n      : `${input.who} would stop seeing ${lost.map((product) => product.slug).join(', ')} in the app: ${from.name} shows ${lost.length === 1 ? 'it' : 'them'}, ${to.name} does not.`,\n    `Re-run with --yes: ${input.retry}`,\n  );\n}\n\nfunction findAudience(\n  audiences: Audience[],\n  ref: string,\n): Audience | undefined {\n  const wanted = ref.trim().toLowerCase();\n  return audiences.find(\n    (entry) => entry.id === wanted || entry.name.toLowerCase() === wanted,\n  );\n}\n\nfunction describeTeam(\n  ctx: CliContext,\n  result: TeamAudience,\n  before?: AudienceRef | null,\n): string {\n  return ctx.ui.result({\n    title: `${result.team.slug} starts its members on ${result.audience.name}`,\n    rows: [\n      ['Audience', result.audience.name],\n      ...(before !== undefined\n        ? ([['Before', before?.name ?? 'none']] as Array<[string, string]>)\n        : []),\n    ],\n    notes: [\n      'A member’s own audience overrides it: \"ekanos teams audience <team> <audience> --member <email>\".',\n      '\"ekanos audiences show <audience>\" lists what it shows.',\n    ],\n  });\n}\n\nfunction describeMember(\n  ctx: CliContext,\n  result: MemberAudience,\n  before?: AudienceRef | null,\n): string {\n  return ctx.ui.result({\n    title: `${result.member.email} is on ${result.audience.name}`,\n    rows: [\n      ['Audience', result.audience.name],\n      [\n        'From',\n        result.isOverride ? 'their own' : `the ${result.team.slug} default`,\n      ],\n      ...(before !== undefined\n        ? ([['Before', before?.name ?? 'none']] as Array<[string, string]>)\n        : []),\n    ],\n  });\n}\n\nfunction quote(name: string): string {\n  return /^[A-Za-z0-9._-]+$/.test(name) ? name : `\"${name}\"`;\n}\n"]}

package/dist/commands/teams-connect.js

@@ -1,11 +1,14 @@
 import { TeamAgentListSchema, } from '@ekanos/integration-schema';
+import { fieldPrompt, parseFieldValue } from '../connect-fields.js';
 import { invalidStateError, usageError, validationError } from '../errors.js';
+import { cli } from '../invocation.js';
 import { assertBrowserSafeUrl, openInBrowser } from '../open-url.js';
+import { FIELD_SECRET_FORMS, collectSecrets, parsePlainValues, readSecretFlags, secretInputGiven, } from '../secret-input.js';
 import { showTeamConnect, startTeamConnect, } from '../team-connect-api.js';
 import { call, showTeamIntegration } from '../teams-api.js';
 import { promptHidden, promptLine } from './apps.js';
 import { scopeHiddenLines } from './scope-notice.js';
-import { canPrompt, checklist, promptAndSaveTeamApp, } from './teams.js';
+import { canPrompt, checklist, promptAndSaveTeamApp, teamsSecretIO, } from './teams.js';
 import { isTeamChannel, runTeamChannelInstall } from './teams-channel-install.js';
 /**
  * `teams connect <team> <product>` — connect a product for one team, doing
@@ -161,7 +164,7 @@ async function warnOtherRunsAs(ctx, client, host, source, plan) {
             item.viaDetail.toLowerCase() !== email)) === null || _d === void 0 ? void 0 : _d.viaDetail;
         if (!runsAs)
             continue;
-        ctx.warn(`Note: ${entry.key} runs as ${runsAs} and uses ${runsAs}'s ${plan.product.name} connection, not ${email}'s. For the agent, run: npx @ekanos/cli teams connect ${plan.team.slug} ${plan.product.slug} --as ${runsAs} --source ${source}`);
+        ctx.warn(`Note: ${entry.key} runs as ${runsAs} and uses ${runsAs}'s ${plan.product.name} connection, not ${email}'s. For the agent, run: ${cli()} teams connect ${plan.team.slug} ${plan.product.slug} --as ${runsAs} --source ${source}`);
     }
 }
 /**
@@ -192,7 +195,7 @@ async function offerChannels(ctx, args, client, host, source, input, done) {
             done.summary,
             ...waiting.flatMap((entry) => [
                 `Next: ${why(entry)}`,
-                `  Install it in your terminal: npx @ekanos/cli ${command(entry.connectionId)}`,
+                `  Install it in your terminal: ${cli()} ${command(entry.connectionId)}`,
             ]),
         ].join('\n'));
     }
@@ -229,31 +232,14 @@ async function connectionLabel(client, host, target, plan) {
 }
 async function activate(ctx, args, client, host, target, plan) {
     var _a;
-    var _b, _c, _d, _e;
+    var _b, _c;
     if (plan.scope === 'user' && !plan.member) {
-        throw invalidStateError((_b = plan.memberProblem) !== null && _b !== void 0 ? _b : `${plan.product.name} is a personal connection: each member connects their own.`, `A member connects it for themselves on the team's page: ${plan.connectUrl}`);
+        throw invalidStateError((_b = plan.memberProblem) !== null && _b !== void 0 ? _b : `${plan.product.name} is a personal connection: each member connects their own.`, joinHint(plan, target));
     }
-    const fields = {};
-    if (plan.mode === 'fields') {
-        if (!canPrompt(ctx, args)) {
-            throw usageError(`${plan.product.name} needs its fields typed at a terminal (${plan.fields.map((field) => field.label).join(', ')}), never in a script or an agent run.`, `Run it yourself in your terminal: npx @ekanos/cli teams connect ${target.team} ${target.product} --source ${plan.source.slug}`);
-        }
-        ctx.log(`${plan.product.name} for ${plan.scope === 'user' ? 'you, in' : 'team'} ${plan.team.slug}: enter what the app's form asks. Secrets are hidden and never shown again.`);
-        for (const field of plan.fields) {
-            if (field.description)
-                ctx.log(`  ${field.description}`);
-            const suffix = `${field.required ? '' : ' (optional — Enter skips)'}${field.sensitive ? ' (hidden)' : ''}: `;
-            const value = (await (field.sensitive
-                ? ((_c = args.askSecret) !== null && _c !== void 0 ? _c : promptHidden)
-                : ((_d = args.ask) !== null && _d !== void 0 ? _d : promptLine))(`${field.label}${suffix}`)).trim();
-            if (value)
-                fields[field.name] = value;
-            else if (field.required) {
-                throw validationError(`${field.label} is needed.`, `Run "ekanos teams connect ${target.team} ${target.product}" again.`);
-            }
-        }
-    }
-    const started = await client.call((token) => startTeamConnect(host, token, target, { fields }));
+    const entered = plan.mode === 'fields'
+        ? await enterFields(ctx, args, plan, connectAgain(target, plan))
+        : { fields: {}, set: [] };
+    const started = await client.call((token) => startTeamConnect(host, token, target, Object.assign({ fields: entered.fields }, (entered.set.length > 0 ? { set: entered.set } : {}))));
     return ctx.succeed(Object.assign(Object.assign({ host }, started), { connected: started.plan.connected }), ctx.ui.result({
         title: `Connected ${started.plan.product.name} for ${started.plan.team.slug}`,
         rows: [
@@ -261,7 +247,7 @@ async function activate(ctx, args, client, host, target, plan) {
             [
                 'For',
                 started.plan.scope === 'user'
-                    ? `you (${(_e = (_a = started.plan.member) === null || _a === void 0 ? void 0 : _a.email) !== null && _e !== void 0 ? _e : 'your account'}) — a personal connection`
+                    ? `you (${(_c = (_a = started.plan.member) === null || _a === void 0 ? void 0 : _a.email) !== null && _c !== void 0 ? _c : 'your account'}) — a personal connection`
                     : 'the whole team',
             ],
             ['Team page', started.plan.connectUrl],
@@ -274,21 +260,32 @@ async function connectOAuth(ctx, args, client, host, target, plan, asEmail, opti
     const name = options.name;
     const again = `ekanos teams connect ${target.team} ${target.product}${named ? ` --connection ${plan.connectionId}` : ''}`;
     if (!plan.member) {
-        throw invalidStateError((_a = plan.memberProblem) !== null && _a !== void 0 ? _a : 'No member of the team can sign in yet.', `Name a member of ${plan.team.slug} who signs in: ${again} --as <email>`);
+        throw invalidStateError((_a = plan.memberProblem) !== null && _a !== void 0 ? _a : 'No member of the team can sign in yet.', plan.scope === 'user'
+            ? joinHint(plan, target)
+            : `Name a member of ${plan.team.slug} who signs in: ${again} --as <email>. Or join it and sign in yourself: ekanos teams members add ${plan.team.slug} --self --role admin`);
     }
     if (plan.teamApp) {
         const status = await client.call((token) => showTeamIntegration(host, token, target));
         const connectionId = (_b = plan.connectionId) !== null && _b !== void 0 ? _b : 'default';
         const app = (_c = status.teamApps.find((entry) => entry.connectionId === connectionId)) !== null && _c !== void 0 ? _c : (named ? undefined : status.teamApps[0]);
         if (app && app.fields.some((field) => !field.set)) {
-            if (!canPrompt(ctx, args)) {
-                throw usageError(`${name} needs ${plan.team.slug}'s own app first, entered at a terminal.`, `Run it yourself in your terminal: npx @ekanos/cli ${again} --source ${plan.source.slug}`);
+            if (!canPrompt(ctx, args) &&
+                !secretInputGiven(readSecretFlags(args.flags))) {
+                throw usageError(`${name} needs ${plan.team.slug}'s own app first (${app.fields
+                    .filter((field) => !field.set)
+                    .map((field) => field.secretName)
+                    .join(', ')}), and there is no terminal to ask at.`, `Without a terminal, pass --set <field>=<value> for the plain fields and ${FIELD_SECRET_FORMS}. Or run it yourself in your terminal: ${cli()} ${again} --source ${plan.source.slug}`);
             }
             ctx.log(`${name} signs ${plan.team.slug} in through the team's own app. Set it up first:`);
             await promptAndSaveTeamApp(ctx, args, client, host, target, status, app);
         }
     }
-    const started = await client.call((token) => startTeamConnect(host, token, target, asEmail ? { as: asEmail } : {}));
+    // An app sign-in (GitHub, ROAM) activates on return with what the app's
+    // form would add after the sign-in: asked now, applied then.
+    const entered = plan.signIn === 'app' && plan.fields.length > 0
+        ? await enterFields(ctx, args, plan, `${again} --source ${plan.source.slug}`)
+        : undefined;
+    const started = await client.call((token) => startTeamConnect(host, token, target, Object.assign(Object.assign(Object.assign({}, (asEmail ? { as: asEmail } : {})), (entered ? { fields: entered.fields } : {})), (entered && entered.set.length > 0 ? { set: entered.set } : {}))));
     if (started.result !== 'consent') {
         throw invalidStateError(`The host answered "${started.result}" where a sign-in link was expected.`, 'Run "ekanos upgrade" — the CLI and the host disagree on the connect contract.');
     }
@@ -303,11 +300,21 @@ async function connectOAuth(ctx, args, client, host, target, plan, asEmail, opti
                 : `Sign in to ${plan.product.name} as the account ${plan.team.slug} should use${plan.scope === 'user' ? ' (a personal connection: yours)' : ''}:`,
             `  ${started.authorizeUrl}`,
             `  (one-time link, valid until ${expires} UTC)`,
+            ...(plan.signIn === 'app'
+                ? [
+                    `  It opens ${plan.product.name}'s sign-in through ${plan.source.slug}'s app: if the browser asks you to sign in to the app first, do, then open the link again.`,
+                ]
+                : []),
         ].join('\n')
         : [
             `Send this link to ${(_e = member.email) !== null && _e !== void 0 ? _e : 'the member'} — they ${named ? `install ${name}` : `sign in to ${plan.product.name}`} for ${plan.team.slug}${plan.scope === 'user' ? ' (a personal connection: theirs)' : ''}:`,
             `  ${started.authorizeUrl}`,
             `  (one-time, for them only, valid until ${expires} UTC)`,
+            ...(plan.signIn === 'app'
+                ? [
+                    `  They open it signed in to ${plan.source.slug}'s app as themselves.`,
+                ]
+                : []),
         ].join('\n'));
     // Only ever the caller's own browser: opening a link meant for another
     // member would sign the caller's provider account in for them.
@@ -360,6 +367,91 @@ async function connectOAuth(ctx, args, client, host, target, plan, asEmail, opti
     }
     throw validationError('The sign-in did not finish before the link expired.', `Run "${again}${asEmail ? ` --as ${asEmail}` : ''}" again for a fresh link.`);
 }
+/** The command that connects it again, for a hint. */
+function connectAgain(target, plan) {
+    return `ekanos teams connect ${target.team} ${target.product} --source ${plan.source.slug}`;
+}
+/**
+ * A personal connection is the member's own: whoever runs connect makes
+ * theirs, so a caller who is not on the team joins it first.
+ */
+function joinHint(plan, target) {
+    return `It is yours to connect once you are a member: ekanos teams members add ${plan.team.slug} --self, then ${connectAgain(target, plan)}. For someone else's, send them a link: ${connectAgain(target, plan)} --as <their-email>.`;
+}
+/**
+ * The activation fields, through the shared secret input (`secret-input.ts`)
+ * that every command taking a secret uses: `--set <field>=<value>` for a
+ * plain field; for a secret (which includes a JSON value, which can carry
+ * one) `--set-secret <field>=env:…|file:…|stdin`, `--secret-env|file|stdin`
+ * for a single one, or `--browser`; otherwise a prompt at a terminal, hidden
+ * for a secret. Each value is then typed by its field (`connect-fields.ts`).
+ *
+ * In a script or an agent run with no secret flags, an optional field
+ * nobody gave is skipped rather than refused, so a product whose fields are
+ * all optional (GitHub) goes straight to its sign-in.
+ *
+ * `set` names the fields given by `--set`: the host refuses a secret among
+ * them (`SECRET_AS_ARGUMENT`), as `--set` here already does.
+ */
+async function enterFields(ctx, args, plan, again) {
+    var _a;
+    const plain = parsePlainValues((_a = args.flags) === null || _a === void 0 ? void 0 : _a.set, 'default_labels=bug,triage');
+    const secret = readSecretFlags(args.flags);
+    const interactive = canPrompt(ctx, args);
+    const asking = interactive || secretInputGiven(secret);
+    // Without a terminal, a secret flag or any --set, only the required fields
+    // are asked for (and refused); an optional one is skipped.
+    const fields = asking || Object.keys(plain).length > 0
+        ? plan.fields
+        : plan.fields.filter((field) => field.required);
+    if (interactive &&
+        !secretInputGiven(secret) &&
+        fields.some((field) => !(field.name in plain))) {
+        ctx.log(`${plan.product.name} for ${plan.scope === 'user' ? 'you, in' : 'team'} ${plan.team.slug}: enter what the app's form asks${plan.signIn === 'app' ? ' after the sign-in' : ''}. Secrets are hidden and never shown again.`);
+    }
+    const byName = new Map(plan.fields.map((field) => [field.name, field]));
+    const raw = fields.length === 0 && Object.keys(plain).length === 0
+        ? {}
+        : await collectSecrets(ctx, {
+            fields: fields.map((field) => (Object.assign({ name: field.name, label: field.label, sensitive: field.sensitive, required: field.required }, (field.description ? { description: field.description } : {})))),
+            plain,
+            flags: secret,
+            io: teamsSecretIO(args),
+            interactive,
+            title: `${plan.product.name} for ${plan.team.slug}`,
+            refusal: `${plan.product.name} needs its form's fields (${fields
+                .filter((field) => field.required)
+                .map((field) => `${field.label} [${field.name}]`)
+                .join(', ')}), and there is no terminal to ask at.`,
+            again: again.replace(/^ekanos /, ''),
+            prompt: (spec) => {
+                var _a, _b;
+                const field = byName.get(spec.name);
+                if (field.description)
+                    ctx.log(`  ${field.description}`);
+                return (field.sensitive
+                    ? ((_a = args.askSecret) !== null && _a !== void 0 ? _a : promptHidden)
+                    : ((_b = args.ask) !== null && _b !== void 0 ? _b : promptLine))(fieldPrompt(field));
+            },
+        });
+    const values = {};
+    for (const [name, text] of Object.entries(raw)) {
+        const field = byName.get(name);
+        if (!field)
+            continue;
+        const value = parseFieldValue(field, text);
+        if (value !== undefined)
+            values[name] = value;
+    }
+    const missing = plan.fields.filter((field) => field.required && values[field.name] === undefined);
+    if (missing.length > 0) {
+        throw validationError(`${missing.map((field) => `${field.label} (${field.name})`).join(', ')} ${missing.length === 1 ? 'is' : 'are'} needed.`, `Run "${again}" again.`);
+    }
+    return {
+        fields: values,
+        set: Object.keys(plain).filter((name) => plain[name] !== ''),
+    };
+}
 /** `--link-only`: the team's page and whether it is connected. */
 async function printLink(ctx, client, host, target) {
     var _a;