@indigoai-us/hq-cli 5.101.7 → 5.103.0

package/dist/commands/integrations-api.js

@@ -0,0 +1,135 @@
+/**
+ * Typed client for hq-pro's integration-factory routes.
+ *
+ * One function per endpoint, each a thin `vaultApiFetch` + `raiseForResponse`
+ * pair. The wire shapes below MIRROR hq-pro (`src/vault-service/handlers/
+ * integrations-admin.ts`) rather than importing from it — hq-cli takes no
+ * cross-repo source dependency — so every field a newer backend might not emit
+ * is optional and read defensively.
+ */
+import { vaultApiFetch } from "../utils/vault-api.js";
+import { raiseForResponse, } from "./integrations-core.js";
+export async function listCatalog(token, companyUid, opts = {}) {
+    const query = {
+        companyUid,
+        limit: String(opts.limit ?? 60),
+    };
+    // hq-pro bounds the query itself; normalize whitespace here so an
+    // accidentally padded shell argument doesn't read as a different search.
+    const q = (opts.query ?? "").replace(/\s+/g, " ").trim();
+    if (q)
+        query.query = q;
+    const res = await vaultApiFetch({
+        token,
+        path: "/v1/integrations/factory/catalog",
+        query,
+    });
+    if (!res.ok)
+        await raiseForResponse(res, "Failed to browse the app catalog");
+    const body = (await res.json());
+    return body.entries ?? [];
+}
+export async function pullBlueprint(token, companyUid, input) {
+    const res = await vaultApiFetch({
+        token,
+        path: "/v1/integrations/factory/blueprint",
+        method: "POST",
+        body: { companyUid, ...input },
+    });
+    if (!res.ok)
+        await raiseForResponse(res, "Failed to inspect the app");
+    const body = (await res.json());
+    return body.blueprint;
+}
+export async function discoverDocs(token, companyUid, docsUrl) {
+    const res = await vaultApiFetch({
+        token,
+        path: "/v1/integrations/factory/discover-docs",
+        method: "POST",
+        body: { companyUid, docsUrl },
+    });
+    if (!res.ok)
+        await raiseForResponse(res, "Failed to read that documentation page");
+    return (await res.json());
+}
+export async function installIntegration(token, companyUid, input) {
+    const res = await vaultApiFetch({
+        token,
+        path: "/v1/integrations/factory/install",
+        method: "POST",
+        body: { companyUid, ...input },
+    });
+    if (!res.ok)
+        await raiseForResponse(res, "Failed to connect the app");
+    return (await res.json());
+}
+export async function uninstallIntegration(token, companyUid, installationId) {
+    const res = await vaultApiFetch({
+        token,
+        path: "/v1/integrations/factory/uninstall",
+        method: "POST",
+        body: { companyUid, installationId },
+    });
+    if (!res.ok)
+        await raiseForResponse(res, "Failed to disconnect the app");
+    return (await res.json());
+}
+export async function startOAuth(token, companyUid, input) {
+    const res = await vaultApiFetch({
+        token,
+        path: "/v1/integrations/factory/oauth/start",
+        method: "POST",
+        body: { companyUid, ...input },
+    });
+    if (!res.ok)
+        await raiseForResponse(res, "Failed to start sign-in");
+    return (await res.json());
+}
+export async function completeOAuth(token, companyUid, input) {
+    const res = await vaultApiFetch({
+        token,
+        path: "/v1/integrations/factory/oauth/complete",
+        method: "POST",
+        body: { companyUid, ...input },
+    });
+    if (!res.ok)
+        await raiseForResponse(res, "Failed to finish sign-in");
+    return (await res.json());
+}
+/* ------------------------------------------------------------------ */
+/* Governance: write policy + per-tool grants                          */
+/* ------------------------------------------------------------------ */
+export async function updateGovernance(token, companyUid, input) {
+    const res = await vaultApiFetch({
+        token,
+        path: "/v1/integrations/admin",
+        method: "PATCH",
+        body: { companyUid, ...input },
+    });
+    if (!res.ok)
+        await raiseForResponse(res, "Failed to update the app's settings");
+    return (await res.json());
+}
+export async function getConnectionAccess(token, companyUid, connectionId) {
+    const res = await vaultApiFetch({
+        token,
+        path: "/v1/integrations/factory/access",
+        query: { companyUid, connectionId },
+    });
+    if (!res.ok)
+        await raiseForResponse(res, "Failed to read who can use this app");
+    return (await res.json());
+}
+export async function mutateConnectionAccess(token, companyUid, action, input) {
+    const res = await vaultApiFetch({
+        token,
+        path: `/v1/integrations/factory/access/${action}`,
+        method: "POST",
+        body: { companyUid, ...input },
+    });
+    if (!res.ok) {
+        await raiseForResponse(res, action === "grant" ? "Failed to share the app" : "Failed to remove access");
+    }
+    return (await res.json());
+}
+//# sourceMappingURL=integrations-api.js.map

package/dist/commands/integrations-connect.d.ts

@@ -0,0 +1,30 @@
+/**
+ * `hq integrations catalog | inspect | discover | connect | reconnect`.
+ *
+ * The add half of the lifecycle: find an app, look at what it exposes, and
+ * connect it. Connecting is the interesting one — an app authenticates in one
+ * of three ways and hq-cli should not make the caller work out which:
+ *
+ *   none    the MCP endpoint is anonymously callable → install directly
+ *   key     the endpoint wants a bearer token → take it from --token /
+ *           --token-stdin / a hidden prompt, never from argv history
+ *   oauth   the endpoint speaks OAuth 2.1 → run the RFC 8252 loopback flow
+ *
+ * Detection is server-authoritative and lazy. Rather than guessing from
+ * catalog metadata (which can be stale), the command attempts the direct
+ * install and treats hq-pro's `INTEGRATION_FACTORY_OAUTH_REQUIRED` as the
+ * signal to switch into the browser flow. That way a catalog row that says
+ * "key" but is really OAuth-protected still connects on the first try.
+ */
+import { Command } from "commander";
+/**
+ * Validate `--auth` against the supported enum, rejecting an unknown value
+ * before anything is installed. A finite provider/runtime option must never be
+ * narrowed by a truthy cast — an unrecognised mode has to fail loudly rather
+ * than fall through to a default.
+ */
+export declare function assertAuthMode(value: string | undefined): void;
+/** Single-quote a value for a copy-pasteable shell command. */
+export declare function shellQuote(value: string): string;
+export declare function registerConnectCommands(integrations: Command): void;
+//# sourceMappingURL=integrations-connect.d.ts.map