@ekanos/cli 0.17.1 → 0.18.0

package/dist/names-api.d.ts

@@ -0,0 +1,90 @@
+import { z } from 'zod';
+/**
+ * The CLI's client for package names: the pre-flight that says what a slug
+ * will be called, and the global-name claims.
+ *
+ *   GET  /api/partner/slugs/<slug>?source=<slug|id>[&availability=global|restricted]
+ *     → 200 { ok: true, data: { slug, status, available, namespace,
+ *             displayName, token, availability, claim } }
+ *       `status` is the host's word for the slug (`global_unapproved` when a
+ *       global package has no approved name). Every field past `available` is
+ *       optional here: an older host omits them.
+ *
+ *   POST /api/partner/names/claims   { source, slug, reason? }
+ *     → 201 { ok: true, data: { id, slug, status: "requested", createdAt } }
+ *     → 409 { code: "CLAIM_EXISTS" | "SLUG_RESERVED" | "SLUG_TAKEN" }
+ *
+ *   GET  /api/partner/names/claims/<slug>?source=<slug|id>
+ *     → 200 { ok: true, data: { slug, status: "none" | "requested" |
+ *             "approved" | "rejected", reason, requestedAt, decidedAt } }
+ *
+ *   → 400 INVALID_REQUEST · 401 / 3xx refresh once and retry · 403 FORBIDDEN
+ *     (no developer seat) or MFA_REQUIRED · 404 SOURCE_NOT_FOUND
+ */
+export type NamesApiResult<T> = {
+    status: 'ok';
+    data: T;
+} | {
+    status: 'unauthorized';
+};
+export declare const SlugLookupSchema: z.ZodObject<{
+    slug: z.ZodString;
+    status: z.ZodString;
+    available: z.ZodBoolean;
+    namespace: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    displayName: z.ZodOptional<z.ZodString>;
+    token: z.ZodOptional<z.ZodString>;
+    availability: z.ZodOptional<z.ZodEnum<{
+        global: "global";
+        restricted: "restricted";
+    }>>;
+    claim: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        status: z.ZodEnum<{
+            approved: "approved";
+            rejected: "rejected";
+            requested: "requested";
+        }>;
+        reason: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type SlugLookup = z.infer<typeof SlugLookupSchema>;
+export declare const NameClaimRequestedSchema: z.ZodObject<{
+    id: z.ZodString;
+    slug: z.ZodString;
+    status: z.ZodLiteral<"requested">;
+    createdAt: z.ZodString;
+}, z.core.$strip>;
+export type NameClaimRequested = z.infer<typeof NameClaimRequestedSchema>;
+export declare const NameClaimStatusSchema: z.ZodObject<{
+    slug: z.ZodString;
+    status: z.ZodEnum<{
+        approved: "approved";
+        none: "none";
+        rejected: "rejected";
+        requested: "requested";
+    }>;
+    reason: z.ZodNullable<z.ZodString>;
+    requestedAt: z.ZodNullable<z.ZodString>;
+    decidedAt: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type NameClaimStatus = z.infer<typeof NameClaimStatusSchema>;
+/**
+ * What the host will call a slug for this Source. `unavailable` is any answer
+ * that is not the lookup (an older host without the route, a server error, a
+ * shape this CLI does not read): the caller carries on with the bare slug.
+ */
+export type SlugLookupResult = {
+    status: 'ok';
+    lookup: SlugLookup;
+} | {
+    status: 'unavailable';
+} | {
+    status: 'unauthorized';
+};
+export declare function lookupSlug(host: string, accessToken: string, source: string, slug: string, availability?: 'global' | 'restricted'): Promise<SlugLookupResult>;
+export declare function requestNameClaim(host: string, accessToken: string, body: {
+    source: string;
+    slug: string;
+    reason?: string;
+}): Promise<NamesApiResult<NameClaimRequested>>;
+export declare function getNameClaim(host: string, accessToken: string, source: string, slug: string): Promise<NamesApiResult<NameClaimStatus>>;

package/dist/names-api.js

@@ -0,0 +1,123 @@
+import { z } from 'zod';
+import { request } from './auth/ekanos-api.js';
+import { authRequiredError, forbiddenError, invalidStateError, networkError, notFoundError, validationError, } from './errors.js';
+export const SlugLookupSchema = z.object({
+    slug: z.string(),
+    status: z.string(),
+    available: z.boolean(),
+    namespace: z.string().nullable().optional(),
+    displayName: z.string().optional(),
+    token: z.string().optional(),
+    availability: z.enum(['global', 'restricted']).optional(),
+    claim: z
+        .object({
+        status: z.enum(['requested', 'approved', 'rejected']),
+        reason: z.string().nullable().optional(),
+    })
+        .nullable()
+        .optional(),
+});
+export const NameClaimRequestedSchema = z.object({
+    id: z.string(),
+    slug: z.string(),
+    status: z.literal('requested'),
+    createdAt: z.string(),
+});
+export const NameClaimStatusSchema = z.object({
+    slug: z.string(),
+    status: z.enum(['none', 'requested', 'approved', 'rejected']),
+    reason: z.string().nullable(),
+    requestedAt: z.string().nullable(),
+    decidedAt: z.string().nullable(),
+});
+export async function lookupSlug(host, accessToken, source, slug, availability) {
+    const query = new URLSearchParams({ source });
+    if (availability)
+        query.set('availability', availability);
+    const response = await request(`${host}/api/partner/slugs/${encodeURIComponent(slug)}?${query}`, { method: 'GET', headers: headers(accessToken) });
+    if (isUnauthorized(response.status))
+        return { status: 'unauthorized' };
+    if (!response.ok)
+        return { status: 'unavailable' };
+    const body = await readOptionalJson(response);
+    const parsed = SlugLookupSchema.safeParse(body.data);
+    return parsed.success
+        ? { status: 'ok', lookup: parsed.data }
+        : { status: 'unavailable' };
+}
+export function requestNameClaim(host, accessToken, body) {
+    return call(host, accessToken, '/api/partner/names/claims', NameClaimRequestedSchema, { method: 'POST', body });
+}
+export function getNameClaim(host, accessToken, source, slug) {
+    return call(host, accessToken, `/api/partner/names/claims/${encodeURIComponent(slug)}?${new URLSearchParams({ source })}`, NameClaimStatusSchema, { method: 'GET' });
+}
+async function call(host, accessToken, path, schema, init) {
+    const response = await request(`${host}${path}`, {
+        method: init.method,
+        headers: Object.assign(Object.assign({}, headers(accessToken)), (init.body === undefined
+            ? {}
+            : { 'content-type': 'application/json' })),
+        body: init.body === undefined ? undefined : JSON.stringify(init.body),
+    });
+    if (isUnauthorized(response.status))
+        return { status: 'unauthorized' };
+    const body = await readOptionalJson(response);
+    const code = typeof body.code === 'string' ? body.code : null;
+    const message = typeof body.error === 'string' && body.error ? body.error : null;
+    const route = path.split('?')[0];
+    if (response.status === 403 && code === 'MFA_REQUIRED') {
+        throw authRequiredError(message !== null && message !== void 0 ? message : `${host} requires multi-factor authentication.`, 'Complete MFA in the browser, then run "ekanos login" again.');
+    }
+    if (response.status === 403) {
+        throw forbiddenError(message !== null && message !== void 0 ? message : 'This account does not hold the developer seat on the Source.', 'Ask the Source operator for the developer seat, or run "ekanos sources" to list the sources you hold a seat on.');
+    }
+    if (response.status === 404) {
+        throw notFoundError(message !== null && message !== void 0 ? message : 'Source not found.', 'Check --source against "ekanos sources".');
+    }
+    if (response.status === 409) {
+        throw invalidStateError(message !== null && message !== void 0 ? message : 'The host refused the claim.', conflictHint(code));
+    }
+    if (response.status === 400) {
+        throw validationError(message !== null && message !== void 0 ? message : 'The host refused the request.', 'Names are kebab-case, e.g. "google-drive". See "ekanos names --help".');
+    }
+    if (!response.ok) {
+        throw networkError(`${host}${route} responded ${response.status}.`, response.status >= 500
+            ? 'The Ekanos deployment returned a server error. Retry shortly.'
+            : 'Confirm the host runs a build that includes the names routes.');
+    }
+    const parsed = schema.safeParse(body.data);
+    if (!parsed.success) {
+        throw networkError(`${host}${route} answered in a shape this CLI does not read.`, 'Run "ekanos upgrade" - the CLI and the host disagree on the names contract.');
+    }
+    return { status: 'ok', data: parsed.data };
+}
+function conflictHint(code) {
+    switch (code) {
+        case 'CLAIM_EXISTS':
+            return 'A claim for this name is already open; check it with "ekanos names status <slug>".';
+        case 'SLUG_RESERVED':
+            return 'This name is reserved. Pick another, or publish restricted under your Source namespace.';
+        case 'SLUG_TAKEN':
+            return 'Another package already holds this name. Pick another, or publish restricted under your Source namespace.';
+        default:
+            return 'Check the claim with "ekanos names status <slug>".';
+    }
+}
+function headers(accessToken) {
+    return { accept: 'application/json', authorization: `Bearer ${accessToken}` };
+}
+function isUnauthorized(status) {
+    return status === 401 || (status >= 300 && status < 400);
+}
+async function readOptionalJson(response) {
+    try {
+        const parsed = await response.json();
+        return typeof parsed === 'object' && parsed !== null
+            ? parsed
+            : {};
+    }
+    catch (_a) {
+        return {};
+    }
+}
+//# sourceMappingURL=names-api.js.map

package/dist/names-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"names-api.js","sourceRoot":"","sources":["../src/names-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACb,eAAe,GAChB,MAAM,UAAU,CAAC;AA6BlB,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzD,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;QACrD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;KACzC,CAAC;SACD,QAAQ,EAAE;SACV,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IAC7D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAcH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAY,EACZ,WAAmB,EACnB,MAAc,EACd,IAAY,EACZ,YAAsC;IAEtC,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9C,IAAI,YAAY;QAAE,KAAK,CAAC,GAAG,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;IAE1D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,GAAG,IAAI,sBAAsB,kBAAkB,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,EAChE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,CACjD,CAAC;IAEF,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACvE,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAEnD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAErD,OAAO,MAAM,CAAC,OAAO;QACnB,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE;QACvC,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,WAAmB,EACnB,IAAuD;IAEvD,OAAO,IAAI,CACT,IAAI,EACJ,WAAW,EACX,2BAA2B,EAC3B,wBAAwB,EACxB,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CACzB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,IAAY,EACZ,WAAmB,EACnB,MAAc,EACd,IAAY;IAEZ,OAAO,IAAI,CACT,IAAI,EACJ,WAAW,EACX,6BAA6B,kBAAkB,CAAC,IAAI,CAAC,IAAI,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAC1F,qBAAqB,EACrB,EAAE,MAAM,EAAE,KAAK,EAAE,CAClB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,IAAI,CACjB,IAAY,EACZ,WAAmB,EACnB,IAAY,EACZ,MAAoB,EACpB,IAAgD;IAEhD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE;QAC/C,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,kCACF,OAAO,CAAC,WAAW,CAAC,GACpB,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;YACzB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAC5C;QACD,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;KACtE,CAAC,CAAC;IAEH,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAEvE,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,MAAM,OAAO,GACX,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACnE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAEjC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QACvD,MAAM,iBAAiB,CACrB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,GAAG,IAAI,wCAAwC,EAC1D,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,cAAc,CAClB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,8DAA8D,EACzE,iHAAiH,CAClH,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,aAAa,CACjB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,mBAAmB,EAC9B,0CAA0C,CAC3C,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,iBAAiB,CACrB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,6BAA6B,EACxC,YAAY,CAAC,IAAI,CAAC,CACnB,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,eAAe,CACnB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,+BAA+B,EAC1C,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,YAAY,CAChB,GAAG,IAAI,GAAG,KAAK,cAAc,QAAQ,CAAC,MAAM,GAAG,EAC/C,QAAQ,CAAC,MAAM,IAAI,GAAG;YACpB,CAAC,CAAC,+DAA+D;YACjE,CAAC,CAAC,+DAA+D,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,YAAY,CAChB,GAAG,IAAI,GAAG,KAAK,8CAA8C,EAC7D,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,YAAY,CAAC,IAAmB;IACvC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,cAAc;YACjB,OAAO,oFAAoF,CAAC;QAC9F,KAAK,eAAe;YAClB,OAAO,yFAAyF,CAAC;QACnG,KAAK,YAAY;YACf,OAAO,2GAA2G,CAAC;QACrH;YACE,OAAO,oDAAoD,CAAC;IAChE,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,WAAmB;IAClC,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,CAAC;AAChF,CAAC;AAED,SAAS,cAAc,CAAC,MAAc;IACpC,OAAO,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,QAAkB;IAElB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE9C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAClD,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;eAAO,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["import { z } from 'zod';\n\nimport { request } from './auth/ekanos-api';\nimport {\n  authRequiredError,\n  forbiddenError,\n  invalidStateError,\n  networkError,\n  notFoundError,\n  validationError,\n} from './errors';\n\n/**\n * The CLI's client for package names: the pre-flight that says what a slug\n * will be called, and the global-name claims.\n *\n *   GET  /api/partner/slugs/<slug>?source=<slug|id>[&availability=global|restricted]\n *     → 200 { ok: true, data: { slug, status, available, namespace,\n *             displayName, token, availability, claim } }\n *       `status` is the host's word for the slug (`global_unapproved` when a\n *       global package has no approved name). Every field past `available` is\n *       optional here: an older host omits them.\n *\n *   POST /api/partner/names/claims   { source, slug, reason? }\n *     → 201 { ok: true, data: { id, slug, status: \"requested\", createdAt } }\n *     → 409 { code: \"CLAIM_EXISTS\" | \"SLUG_RESERVED\" | \"SLUG_TAKEN\" }\n *\n *   GET  /api/partner/names/claims/<slug>?source=<slug|id>\n *     → 200 { ok: true, data: { slug, status: \"none\" | \"requested\" |\n *             \"approved\" | \"rejected\", reason, requestedAt, decidedAt } }\n *\n *   → 400 INVALID_REQUEST · 401 / 3xx refresh once and retry · 403 FORBIDDEN\n *     (no developer seat) or MFA_REQUIRED · 404 SOURCE_NOT_FOUND\n */\n\nexport type NamesApiResult<T> =\n  | { status: 'ok'; data: T }\n  | { status: 'unauthorized' };\n\nexport const SlugLookupSchema = z.object({\n  slug: z.string(),\n  status: z.string(),\n  available: z.boolean(),\n  namespace: z.string().nullable().optional(),\n  displayName: z.string().optional(),\n  token: z.string().optional(),\n  availability: z.enum(['global', 'restricted']).optional(),\n  claim: z\n    .object({\n      status: z.enum(['requested', 'approved', 'rejected']),\n      reason: z.string().nullable().optional(),\n    })\n    .nullable()\n    .optional(),\n});\n\nexport type SlugLookup = z.infer<typeof SlugLookupSchema>;\n\nexport const NameClaimRequestedSchema = z.object({\n  id: z.string(),\n  slug: z.string(),\n  status: z.literal('requested'),\n  createdAt: z.string(),\n});\n\nexport type NameClaimRequested = z.infer<typeof NameClaimRequestedSchema>;\n\nexport const NameClaimStatusSchema = z.object({\n  slug: z.string(),\n  status: z.enum(['none', 'requested', 'approved', 'rejected']),\n  reason: z.string().nullable(),\n  requestedAt: z.string().nullable(),\n  decidedAt: z.string().nullable(),\n});\n\nexport type NameClaimStatus = z.infer<typeof NameClaimStatusSchema>;\n\n/**\n * What the host will call a slug for this Source. `unavailable` is any answer\n * that is not the lookup (an older host without the route, a server error, a\n * shape this CLI does not read): the caller carries on with the bare slug.\n */\nexport type SlugLookupResult =\n  | { status: 'ok'; lookup: SlugLookup }\n  | { status: 'unavailable' }\n  | { status: 'unauthorized' };\n\nexport async function lookupSlug(\n  host: string,\n  accessToken: string,\n  source: string,\n  slug: string,\n  availability?: 'global' | 'restricted',\n): Promise<SlugLookupResult> {\n  const query = new URLSearchParams({ source });\n  if (availability) query.set('availability', availability);\n\n  const response = await request(\n    `${host}/api/partner/slugs/${encodeURIComponent(slug)}?${query}`,\n    { method: 'GET', headers: headers(accessToken) },\n  );\n\n  if (isUnauthorized(response.status)) return { status: 'unauthorized' };\n  if (!response.ok) return { status: 'unavailable' };\n\n  const body = await readOptionalJson(response);\n  const parsed = SlugLookupSchema.safeParse(body.data);\n\n  return parsed.success\n    ? { status: 'ok', lookup: parsed.data }\n    : { status: 'unavailable' };\n}\n\nexport function requestNameClaim(\n  host: string,\n  accessToken: string,\n  body: { source: string; slug: string; reason?: string },\n): Promise<NamesApiResult<NameClaimRequested>> {\n  return call(\n    host,\n    accessToken,\n    '/api/partner/names/claims',\n    NameClaimRequestedSchema,\n    { method: 'POST', body },\n  );\n}\n\nexport function getNameClaim(\n  host: string,\n  accessToken: string,\n  source: string,\n  slug: string,\n): Promise<NamesApiResult<NameClaimStatus>> {\n  return call(\n    host,\n    accessToken,\n    `/api/partner/names/claims/${encodeURIComponent(slug)}?${new URLSearchParams({ source })}`,\n    NameClaimStatusSchema,\n    { method: 'GET' },\n  );\n}\n\nasync function call<T>(\n  host: string,\n  accessToken: string,\n  path: string,\n  schema: z.ZodType<T>,\n  init: { method: 'GET' | 'POST'; body?: unknown },\n): Promise<NamesApiResult<T>> {\n  const response = await request(`${host}${path}`, {\n    method: init.method,\n    headers: {\n      ...headers(accessToken),\n      ...(init.body === undefined\n        ? {}\n        : { 'content-type': 'application/json' }),\n    },\n    body: init.body === undefined ? undefined : JSON.stringify(init.body),\n  });\n\n  if (isUnauthorized(response.status)) return { status: 'unauthorized' };\n\n  const body = await readOptionalJson(response);\n  const code = typeof body.code === 'string' ? body.code : null;\n  const message =\n    typeof body.error === 'string' && body.error ? body.error : null;\n  const route = path.split('?')[0];\n\n  if (response.status === 403 && code === 'MFA_REQUIRED') {\n    throw authRequiredError(\n      message ?? `${host} requires multi-factor authentication.`,\n      'Complete MFA in the browser, then run \"ekanos login\" again.',\n    );\n  }\n  if (response.status === 403) {\n    throw forbiddenError(\n      message ?? 'This account does not hold the developer seat on the Source.',\n      'Ask the Source operator for the developer seat, or run \"ekanos sources\" to list the sources you hold a seat on.',\n    );\n  }\n  if (response.status === 404) {\n    throw notFoundError(\n      message ?? 'Source not found.',\n      'Check --source against \"ekanos sources\".',\n    );\n  }\n  if (response.status === 409) {\n    throw invalidStateError(\n      message ?? 'The host refused the claim.',\n      conflictHint(code),\n    );\n  }\n  if (response.status === 400) {\n    throw validationError(\n      message ?? 'The host refused the request.',\n      'Names are kebab-case, e.g. \"google-drive\". See \"ekanos names --help\".',\n    );\n  }\n  if (!response.ok) {\n    throw networkError(\n      `${host}${route} responded ${response.status}.`,\n      response.status >= 500\n        ? 'The Ekanos deployment returned a server error. Retry shortly.'\n        : 'Confirm the host runs a build that includes the names routes.',\n    );\n  }\n\n  const parsed = schema.safeParse(body.data);\n  if (!parsed.success) {\n    throw networkError(\n      `${host}${route} answered in a shape this CLI does not read.`,\n      'Run \"ekanos upgrade\" - the CLI and the host disagree on the names contract.',\n    );\n  }\n\n  return { status: 'ok', data: parsed.data };\n}\n\nfunction conflictHint(code: string | null): string {\n  switch (code) {\n    case 'CLAIM_EXISTS':\n      return 'A claim for this name is already open; check it with \"ekanos names status <slug>\".';\n    case 'SLUG_RESERVED':\n      return 'This name is reserved. Pick another, or publish restricted under your Source namespace.';\n    case 'SLUG_TAKEN':\n      return 'Another package already holds this name. Pick another, or publish restricted under your Source namespace.';\n    default:\n      return 'Check the claim with \"ekanos names status <slug>\".';\n  }\n}\n\nfunction headers(accessToken: string): Record<string, string> {\n  return { accept: 'application/json', authorization: `Bearer ${accessToken}` };\n}\n\nfunction isUnauthorized(status: number): boolean {\n  return status === 401 || (status >= 300 && status < 400);\n}\n\nasync function readOptionalJson(\n  response: Response,\n): Promise<Record<string, unknown>> {\n  try {\n    const parsed: unknown = await response.json();\n\n    return typeof parsed === 'object' && parsed !== null\n      ? (parsed as Record<string, unknown>)\n      : {};\n  } catch {\n    return {};\n  }\n}\n"]}

package/dist/product-kinds.d.ts

@@ -0,0 +1,13 @@
+type Kinded = {
+    kind: 'feature' | 'experience' | 'integration';
+};
+/**
+ * Whether a list came from a host that predates the Features rename
+ * (2026-10-28), where a built-in capability was called an `experience`. Such a
+ * host never says `feature`, while every current host has built-in Features, so
+ * a list with none is from an older one.
+ */
+export declare function hostPredatesFeatures(products: readonly Kinded[]): boolean;
+/** The display group of a product: Features, Experiences or Integrations. */
+export declare function productGroup(product: Kinded, legacyHost: boolean): 'feature' | 'experience' | 'integration';
+export {};

package/dist/product-kinds.js

@@ -0,0 +1,17 @@
+/**
+ * Whether a list came from a host that predates the Features rename
+ * (2026-10-28), where a built-in capability was called an `experience`. Such a
+ * host never says `feature`, while every current host has built-in Features, so
+ * a list with none is from an older one.
+ */
+export function hostPredatesFeatures(products) {
+    return (products.some((product) => product.kind === 'experience') &&
+        !products.some((product) => product.kind === 'feature'));
+}
+/** The display group of a product: Features, Experiences or Integrations. */
+export function productGroup(product, legacyHost) {
+    if (product.kind === 'experience' && legacyHost)
+        return 'feature';
+    return product.kind;
+}
+//# sourceMappingURL=product-kinds.js.map

package/dist/product-kinds.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"product-kinds.js","sourceRoot":"","sources":["../src/product-kinds.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAA2B;IAC9D,OAAO,CACL,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,YAAY,CAAC;QACzD,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CACxD,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,YAAY,CAC1B,OAAe,EACf,UAAmB;IAEnB,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,IAAI,UAAU;QAAE,OAAO,SAAS,CAAC;IAClE,OAAO,OAAO,CAAC,IAAI,CAAC;AACtB,CAAC","sourcesContent":["type Kinded = { kind: 'feature' | 'experience' | 'integration' };\n\n/**\n * Whether a list came from a host that predates the Features rename\n * (2026-10-28), where a built-in capability was called an `experience`. Such a\n * host never says `feature`, while every current host has built-in Features, so\n * a list with none is from an older one.\n */\nexport function hostPredatesFeatures(products: readonly Kinded[]): boolean {\n  return (\n    products.some((product) => product.kind === 'experience') &&\n    !products.some((product) => product.kind === 'feature')\n  );\n}\n\n/** The display group of a product: Features, Experiences or Integrations. */\nexport function productGroup(\n  product: Kinded,\n  legacyHost: boolean,\n): 'feature' | 'experience' | 'integration' {\n  if (product.kind === 'experience' && legacyHost) return 'feature';\n  return product.kind;\n}\n"]}

package/dist/publish-api.d.ts

@@ -12,12 +12,22 @@ import type { AuthEnvironment } from './auth/session.js';
  *   POST /api/partner/submissions    [Authorization: Bearer <access_token>]
  *     ← multipart/form-data:
  *         source   — Ekanos source slug
- *         slug     — integration slug (kebab-case)
+ *         slug     — integration (or experience) slug (kebab-case; bare, never namespaced)
  *         version  — semver
- *         manifest — JSON string (the parsed ekanos.json + declaration summary)
+ *         kind     — "experience" for a composed experience; omitted for an
+ *                    integration (an older host never sees the field). Sent
+ *                    only to a host that advertises
+ *                    `capabilities.experienceSubmissions` on the toolchain
+ *                    route.
+ *         manifest — JSON string (the parsed ekanos.json + declaration
+ *                    summary; for an experience, its built manifest.json)
  *         archive  — gzipped tarball, ≤ 4 MiB
+ *         availability — "global" | "restricted"; sent only when ekanos.json
+ *                        declares it
  *     → 201 { ok: true, data: { submissionId, slug, version, state,
- *                               archiveSha256 } }
+ *                               archiveSha256,
+ *                               // newer hosts only:
+ *                               namespace?: string|null, displayName? } }
  *     → 400 { error, code: "INVALID_REQUEST" | "INVALID_ARCHIVE" }
  *     → 401 { error, code: "AUTH_REQUIRED" }      token absent or expired —
  *                                                 refresh once and retry
@@ -25,6 +35,12 @@ import type { AuthEnvironment } from './auth/session.js';
  *     → 404 { error, code: "SOURCE_NOT_FOUND" }
  *     → 409 { error, code: "VERSION_EXISTS" }     this (slug, version) is
  *                                                 already submitted
+ *     → 409 { error, code: "KIND_MISMATCH" }      the slug is registered as
+ *                                                 the other kind
+ *     → 409 { error, code: "GLOBAL_NAME_UNAPPROVED", hint? }
+ *                                                 availability "global" without
+ *                                                 an approved global name
+ *     → 409 { error, code: "NAMESPACE_REQUIRED" } the source has no namespace
  *     → 413 { error, code: "ARCHIVE_TOO_LARGE" }
  *     → 3xx                                       treated as 401 (an
  *                                                 auth-gated Ekanos page
@@ -33,7 +49,7 @@ import type { AuthEnvironment } from './auth/session.js';
  *   GET /api/partner/submissions?source=<slug|id>[&detail=findings]
  *       [Authorization: Bearer]
  *     → 200 { ok: true, data: { source, integrations: [{ id, slug, name,
- *             createdAt, versions: [{ id, version, state, archiveSha256,
+ *             createdAt, namespace?: string|null, displayName?, versions: [{ id, version, state, archiveSha256,
  *             submittedAt, gatedAt,
  *             // present once a gate has run (gate_report is non-null):
  *             errorCount?, warnCount?,
@@ -46,7 +62,8 @@ import type { AuthEnvironment } from './auth/session.js';
  *     → 404 { error, code: "SOURCE_NOT_FOUND" }
  *     → 3xx                                       treated as 401
  *
- *   `state` walks submitted -> gated|rejected -> dev -> prod -> revoked,
+ *   `state` walks submitted -> gated|rejected -> dev -> prod -> revoked (a
+ *   `dev` version is marked `superseded` once a newer version reaches dev),
  *   enforced by a database trigger on the host's side (the full transition
  *   matrix lives there). `gated`/`dev`/`rejected` are the
  *   terminal-for-waiting states `ekanos status --watch` polls for.
@@ -61,10 +78,14 @@ export declare const MAX_MANIFEST_BYTES: number;
 export interface SubmissionPayload {
     source: string;
     slug: string;
+    /** Omitted for an integration. */
+    kind?: 'experience';
     version: string;
     /** JSON string — already serialized by the caller. */
     manifest: string;
     archive: Uint8Array;
+    /** Sent only when ekanos.json declares an availability mode. */
+    availability?: 'global' | 'restricted';
 }
 export interface SubmissionReceipt {
     submissionId: string;
@@ -72,6 +93,10 @@ export interface SubmissionReceipt {
     version: string;
     state: string;
     archiveSha256: string;
+    /** The Source namespace the package is named under; absent on an older host. */
+    namespace?: string | null;
+    /** The full name the host uses (`acme/google-drive`); absent on an older host. */
+    displayName?: string;
 }
 export type SubmitResult = {
     status: 'ok';
@@ -82,6 +107,11 @@ export type SubmitResult = {
     status: 'unauthorized';
 };
 export declare function submitArchive(host: string, accessToken: string, payload: SubmissionPayload): Promise<SubmitResult>;
+/**
+ * The refusal for a `global` package whose name no super-admin has approved.
+ * Shared by the pre-flight (`publish.ts`) and the 409 the host answers with.
+ */
+export declare function globalNameUnapprovedError(slug: string): import("./errors.js").CliError;
 /**
  * One gate finding, mirroring `@ekanos/integration-schema`'s `Finding` shape
  * (the same one `validate`/`publish` carry in `data.findings`). Declared
@@ -135,6 +165,9 @@ export interface SubmissionListing {
     slug: string;
     name: string | null;
     createdAt: string | null;
+    /** Absent on an older host. */
+    namespace?: string | null;
+    displayName?: string;
     versions: SubmissionVersion[];
 }
 export type ListResult = {

package/dist/publish-api.js

@@ -14,12 +14,22 @@ import { authRequiredError, forbiddenError, invalidStateError, networkError, not
  *   POST /api/partner/submissions    [Authorization: Bearer <access_token>]
  *     ← multipart/form-data:
  *         source   — Ekanos source slug
- *         slug     — integration slug (kebab-case)
+ *         slug     — integration (or experience) slug (kebab-case; bare, never namespaced)
  *         version  — semver
- *         manifest — JSON string (the parsed ekanos.json + declaration summary)
+ *         kind     — "experience" for a composed experience; omitted for an
+ *                    integration (an older host never sees the field). Sent
+ *                    only to a host that advertises
+ *                    `capabilities.experienceSubmissions` on the toolchain
+ *                    route.
+ *         manifest — JSON string (the parsed ekanos.json + declaration
+ *                    summary; for an experience, its built manifest.json)
  *         archive  — gzipped tarball, ≤ 4 MiB
+ *         availability — "global" | "restricted"; sent only when ekanos.json
+ *                        declares it
  *     → 201 { ok: true, data: { submissionId, slug, version, state,
- *                               archiveSha256 } }
+ *                               archiveSha256,
+ *                               // newer hosts only:
+ *                               namespace?: string|null, displayName? } }
  *     → 400 { error, code: "INVALID_REQUEST" | "INVALID_ARCHIVE" }
  *     → 401 { error, code: "AUTH_REQUIRED" }      token absent or expired —
  *                                                 refresh once and retry
@@ -27,6 +37,12 @@ import { authRequiredError, forbiddenError, invalidStateError, networkError, not
  *     → 404 { error, code: "SOURCE_NOT_FOUND" }
  *     → 409 { error, code: "VERSION_EXISTS" }     this (slug, version) is
  *                                                 already submitted
+ *     → 409 { error, code: "KIND_MISMATCH" }      the slug is registered as
+ *                                                 the other kind
+ *     → 409 { error, code: "GLOBAL_NAME_UNAPPROVED", hint? }
+ *                                                 availability "global" without
+ *                                                 an approved global name
+ *     → 409 { error, code: "NAMESPACE_REQUIRED" } the source has no namespace
  *     → 413 { error, code: "ARCHIVE_TOO_LARGE" }
  *     → 3xx                                       treated as 401 (an
  *                                                 auth-gated Ekanos page
@@ -35,7 +51,7 @@ import { authRequiredError, forbiddenError, invalidStateError, networkError, not
  *   GET /api/partner/submissions?source=<slug|id>[&detail=findings]
  *       [Authorization: Bearer]
  *     → 200 { ok: true, data: { source, integrations: [{ id, slug, name,
- *             createdAt, versions: [{ id, version, state, archiveSha256,
+ *             createdAt, namespace?: string|null, displayName?, versions: [{ id, version, state, archiveSha256,
  *             submittedAt, gatedAt,
  *             // present once a gate has run (gate_report is non-null):
  *             errorCount?, warnCount?,
@@ -48,7 +64,8 @@ import { authRequiredError, forbiddenError, invalidStateError, networkError, not
  *     → 404 { error, code: "SOURCE_NOT_FOUND" }
  *     → 3xx                                       treated as 401
  *
- *   `state` walks submitted -> gated|rejected -> dev -> prod -> revoked,
+ *   `state` walks submitted -> gated|rejected -> dev -> prod -> revoked (a
+ *   `dev` version is marked `superseded` once a newer version reaches dev),
  *   enforced by a database trigger on the host's side (the full transition
  *   matrix lives there). `gated`/`dev`/`rejected` are the
  *   terminal-for-waiting states `ekanos status --watch` polls for.
@@ -61,12 +78,16 @@ import { authRequiredError, forbiddenError, invalidStateError, networkError, not
  */
 export const MAX_MANIFEST_BYTES = 64 * 1024;
 export async function submitArchive(host, accessToken, payload) {
-    var _a;
+    var _a, _b;
     const form = new FormData();
     form.append('source', payload.source);
     form.append('slug', payload.slug);
     form.append('version', payload.version);
+    if (payload.kind)
+        form.append('kind', payload.kind);
     form.append('manifest', payload.manifest);
+    if (payload.availability)
+        form.append('availability', payload.availability);
     form.append('archive', 
     // Copy into a fresh Uint8Array: Buffer is Uint8Array<ArrayBufferLike>,
     // which BlobPart refuses (a SharedArrayBuffer view is not a BlobPart).
@@ -95,6 +116,17 @@ export async function submitArchive(host, accessToken, payload) {
         throw notFoundError(serverMessage !== null && serverMessage !== void 0 ? serverMessage : `${host} has no source with slug "${payload.source}".`, `Check the --source value (or the "source" field in ekanos.json) ` +
             `against the slug your Ekanos operator gave you.`);
     }
+    if (response.status === 409 && str(body.code) === 'KIND_MISMATCH') {
+        throw invalidStateError(serverMessage !== null && serverMessage !== void 0 ? serverMessage : `"${payload.slug}" is registered as the other kind of package.`, `A slug names one kind for its whole life. Pick a different slug, or ` +
+            `submit it as the kind it was first registered as.`);
+    }
+    if (response.status === 409 && body.code === 'GLOBAL_NAME_UNAPPROVED') {
+        throw globalNameUnapprovedError(payload.slug);
+    }
+    if (response.status === 409 && body.code === 'NAMESPACE_REQUIRED') {
+        throw invalidStateError(serverMessage !== null && serverMessage !== void 0 ? serverMessage : `Source "${payload.source}" has no namespace to name "${payload.slug}" under.`, (_a = str(body.hint)) !== null && _a !== void 0 ? _a : `Ask an Ekanos super-admin to give "${payload.source}" a namespace, ` +
+            `then retry.`);
+    }
     if (response.status === 409) {
         throw invalidStateError(serverMessage !== null && serverMessage !== void 0 ? serverMessage : `Version ${payload.version} of "${payload.slug}" is already submitted.`, `Submitted versions are immutable. Bump the "version" field in ` +
             `package.json and publish again.`);
@@ -110,7 +142,7 @@ export async function submitArchive(host, accessToken, payload) {
             : `Confirm the host is an Ekanos deployment running a build that ` +
                 `includes the partner submissions route.`);
     }
-    const data = ((_a = body.data) !== null && _a !== void 0 ? _a : {});
+    const data = ((_b = body.data) !== null && _b !== void 0 ? _b : {});
     const receipt = {
         submissionId: str(data.submissionId),
         slug: str(data.slug),
@@ -118,12 +150,27 @@ export async function submitArchive(host, accessToken, payload) {
         state: str(data.state),
         archiveSha256: str(data.archiveSha256),
     };
+    const displayName = str(data.displayName);
     if (Object.values(receipt).some((value) => value === null)) {
         throw networkError(`${host} accepted the submission but returned an incomplete receipt.`, `Confirm the deployment is running an Ekanos build that includes the ` +
             `partner submissions route, then check the submission's state with ` +
             `your operator before re-publishing.`);
     }
-    return { status: 'ok', receipt: receipt };
+    return {
+        status: 'ok',
+        receipt: Object.assign(Object.assign(Object.assign({}, receipt), (data.namespace === null || typeof data.namespace === 'string'
+            ? { namespace: data.namespace }
+            : {})), (displayName ? { displayName } : {})),
+    };
+}
+/**
+ * The refusal for a `global` package whose name no super-admin has approved.
+ * Shared by the pre-flight (`publish.ts`) and the 409 the host answers with.
+ */
+export function globalNameUnapprovedError(slug) {
+    return invalidStateError(`The global name "${slug}" is not approved.`, `Run "ekanos names claim ${slug}" to request it, or publish restricted ` +
+        `(remove availability.mode "global" from ekanos.json, or set it to ` +
+        `"restricted").`);
 }
 /**
  * List the caller's visible submissions for a source. Same authorization model
@@ -173,19 +220,15 @@ export async function listSubmissions(host, accessToken, source, options = {}) {
     const rows = Array.isArray(data.integrations) ? data.integrations : [];
     const integrations = rows
         .filter((row) => typeof row === 'object' && row !== null)
-        .map((row) => { var _a, _b; return ({
-        id: (_a = str(row.id)) !== null && _a !== void 0 ? _a : '',
-        slug: (_b = str(row.slug)) !== null && _b !== void 0 ? _b : '',
-        name: str(row.name),
-        createdAt: str(row.createdAt),
-        versions: (Array.isArray(row.versions) ? row.versions : [])
+        .map((row) => { var _a, _b; return (Object.assign(Object.assign(Object.assign({ id: (_a = str(row.id)) !== null && _a !== void 0 ? _a : '', slug: (_b = str(row.slug)) !== null && _b !== void 0 ? _b : '', name: str(row.name), createdAt: str(row.createdAt) }, (row.namespace === null || typeof row.namespace === 'string'
+        ? { namespace: row.namespace }
+        : {})), (str(row.displayName) ? { displayName: str(row.displayName) } : {})), { versions: (Array.isArray(row.versions) ? row.versions : [])
             .filter((version) => typeof version === 'object' && version !== null)
             .map((version) => { var _a, _b, _c; return (Object.assign(Object.assign({ id: (_a = str(version.id)) !== null && _a !== void 0 ? _a : '', version: (_b = str(version.version)) !== null && _b !== void 0 ? _b : '', state: (_c = str(version.state)) !== null && _c !== void 0 ? _c : '', archiveSha256: str(version.archiveSha256), submittedAt: str(version.submittedAt), gatedAt: str(version.gatedAt), errorCount: num(version.errorCount), warnCount: num(version.warnCount) }, (Array.isArray(version.findings)
             ? { findings: version.findings }
             : {})), (Array.isArray(version.stages)
             ? { stages: version.stages }
-            : {}))); }),
-    }); });
+            : {}))); }) })); });
     return { status: 'ok', integrations };
 }
 /** Guard for the "still unauthorized after one refresh" terminal case. */