@indigoai-us/hq-cli 5.101.7 → 5.103.0

package/dist/commands/integrations-connect.js

@@ -0,0 +1,583 @@
+/**
+ * `hq integrations catalog | inspect | discover | connect | reconnect`.
+ *
+ * The add half of the lifecycle: find an app, look at what it exposes, and
+ * connect it. Connecting is the interesting one — an app authenticates in one
+ * of three ways and hq-cli should not make the caller work out which:
+ *
+ *   none    the MCP endpoint is anonymously callable → install directly
+ *   key     the endpoint wants a bearer token → take it from --token /
+ *           --token-stdin / a hidden prompt, never from argv history
+ *   oauth   the endpoint speaks OAuth 2.1 → run the RFC 8252 loopback flow
+ *
+ * Detection is server-authoritative and lazy. Rather than guessing from
+ * catalog metadata (which can be stale), the command attempts the direct
+ * install and treats hq-pro's `INTEGRATION_FACTORY_OAUTH_REQUIRED` as the
+ * signal to switch into the browser flow. That way a catalog row that says
+ * "key" but is really OAuth-protected still connects on the first try.
+ */
+import chalk from "chalk";
+import open from "open";
+import { ensureCognitoIdToken } from "../utils/cognito-session.js";
+import { getCompanyUid } from "../utils/vault-api.js";
+import { IntegrationsCliError, bareProvider, printJson, resolveConnection, } from "./integrations-core.js";
+import { completeOAuth, discoverDocs, installIntegration, listCatalog, pullBlueprint, startOAuth, } from "./integrations-api.js";
+import { startLoopbackListener } from "./integrations-oauth.js";
+/** hq-pro's machine code for "this endpoint needs a browser sign-in". */
+const OAUTH_REQUIRED_CODE = "INTEGRATION_FACTORY_OAUTH_REQUIRED";
+/**
+ * hq-pro will not take our loopback callback, for either of the two reasons it
+ * can refuse one:
+ *
+ *   OAUTH_REDIRECT_URI_NOT_ALLOWED  the backend's loopback flag is off, or it
+ *                                   predates loopback support entirely
+ *   OAUTH_LOOPBACK_NOT_SUPPORTED    this app signs in through a client HQ
+ *                                   pre-registered with the vendor against the
+ *                                   fixed console callback, so an ephemeral
+ *                                   port can never be added to it
+ *
+ * Both mean the same thing to the caller — finish in the browser, the console
+ * completes the install — so both take the handoff path.
+ */
+const CONSOLE_HANDOFF_CODES = new Set([
+    "OAUTH_REDIRECT_URI_NOT_ALLOWED",
+    "OAUTH_LOOPBACK_NOT_SUPPORTED",
+]);
+/**
+ * Looks-like-a-domain test for the positional `<app>` argument. Deliberately
+ * loose — hq-pro does the real resolution — but tight enough that `linear.app`
+ * routes to the domain path while a bare word routes to catalog search.
+ */
+function looksLikeDomain(value) {
+    return /^[a-z0-9][a-z0-9.-]*\.[a-z]{2,}$/i.test(value) && !value.includes(" ");
+}
+/**
+ * True when this shell is almost certainly on a different machine from the
+ * person's browser. Not a security boundary — just the signal that a loopback
+ * callback cannot reach us.
+ */
+function isRemoteShell() {
+    return Boolean(process.env.SSH_CONNECTION || process.env.SSH_TTY || process.env.SSH_CLIENT);
+}
+/**
+ * Validate `--auth` against the supported enum, rejecting an unknown value
+ * before anything is installed. A finite provider/runtime option must never be
+ * narrowed by a truthy cast — an unrecognised mode has to fail loudly rather
+ * than fall through to a default.
+ */
+export function assertAuthMode(value) {
+    if (value !== undefined && !["none", "key", "oauth"].includes(value)) {
+        throw new IntegrationsCliError("--auth must be none, key, or oauth.", { expected: true });
+    }
+}
+/** Single-quote a value for a copy-pasteable shell command. */
+export function shellQuote(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+/** Read a secret from piped stdin, without echoing or trailing-newline noise. */
+function readStdin() {
+    return new Promise((resolve, reject) => {
+        let data = "";
+        process.stdin.setEncoding("utf8");
+        process.stdin.on("data", (chunk) => {
+            data += chunk;
+        });
+        process.stdin.on("end", () => resolve(data.replace(/\r?\n$/, "")));
+        process.stdin.on("error", reject);
+    });
+}
+/**
+ * Hidden TTY prompt for an API key. Mirrors `hq secrets`' input handling:
+ * raw mode with no echo, Ctrl-C aborts, Ctrl-D/Enter submits. Keys must never
+ * reach argv (shell history, `ps` output) unless the caller insists via
+ * `--token`.
+ */
+function promptForKey(label) {
+    return new Promise((resolve, reject) => {
+        process.stdout.write(`${label}: `);
+        if (process.stdin.isTTY)
+            process.stdin.setRawMode(true);
+        process.stdin.setEncoding("utf8");
+        let value = "";
+        const cleanup = () => {
+            if (process.stdin.isTTY)
+                process.stdin.setRawMode(false);
+            process.stdin.removeListener("data", onData);
+            process.stdin.pause();
+        };
+        const onData = (chunk) => {
+            for (const ch of chunk) {
+                const codePoint = ch.codePointAt(0);
+                if (ch === "\n" || ch === "\r" || codePoint === 4) {
+                    cleanup();
+                    process.stdout.write("\n");
+                    resolve(value);
+                    return;
+                }
+                if (codePoint === 3) {
+                    cleanup();
+                    process.stdout.write("\n");
+                    reject(new IntegrationsCliError("Cancelled.", { expected: true }));
+                    return;
+                }
+                if (codePoint === 127 || codePoint === 8) {
+                    value = value.slice(0, -1);
+                    continue;
+                }
+                value += ch;
+            }
+        };
+        process.stdin.on("data", onData);
+        process.stdin.resume();
+    });
+}
+/**
+ * Resolve the API key for a key-authenticated app, in descending order of how
+ * safe the source is: piped stdin, a hidden prompt, then the explicit
+ * `--token` flag. Refuses rather than connecting credential-less when there is
+ * nobody to ask.
+ */
+async function resolveKey(opts, appLabel) {
+    if (opts.tokenStdin) {
+        const piped = (await readStdin()).trim();
+        if (!piped) {
+            throw new IntegrationsCliError("--token-stdin was set but stdin was empty.", {
+                expected: true,
+            });
+        }
+        return piped;
+    }
+    if (opts.token)
+        return opts.token;
+    if (process.stdin.isTTY) {
+        const value = (await promptForKey(`API key for ${appLabel}`)).trim();
+        if (!value) {
+            throw new IntegrationsCliError("No API key entered — nothing was connected.", {
+                expected: true,
+            });
+        }
+        return value;
+    }
+    throw new IntegrationsCliError(`${appLabel} needs an API key. Pass it with --token-stdin (recommended, keeps it out of shell history) or --token <key>.`, { expected: true });
+}
+/**
+ * Turn the caller's arguments into one unambiguous target. Precedence is
+ * most-specific-first so an explicit flag always wins over the positional
+ * argument's heuristics.
+ */
+async function resolveTarget(token, companyUid, app, opts) {
+    if (opts.docsUrl) {
+        const found = await discoverDocs(token, companyUid, opts.docsUrl);
+        if (!found.discovery || !found.discoveryReceiptId) {
+            throw new IntegrationsCliError("No connectable server was found on that documentation page.", { expected: true });
+        }
+        return {
+            // The receipt is the trusted continuation: hq-pro re-reads the verified
+            // endpoint from its own row instead of trusting a URL echoed back here.
+            ref: { discoveryReceiptId: found.discoveryReceiptId },
+            authClass: found.discovery.authMode === "bearer"
+                ? "key"
+                : found.discovery.authMode === "oauth"
+                    ? "oauth"
+                    : "none",
+            label: found.discovery.displayName,
+        };
+    }
+    if (opts.mcpUrl) {
+        return {
+            ref: {
+                mcpUrl: opts.mcpUrl,
+                ...(opts.provider ? { provider: opts.provider } : {}),
+                ...(opts.displayName ? { displayName: opts.displayName } : {}),
+            },
+            label: opts.displayName ?? opts.provider ?? opts.mcpUrl,
+        };
+    }
+    if (opts.entryId) {
+        return { ref: { catalogEntryId: opts.entryId }, label: opts.entryId };
+    }
+    if (!app) {
+        throw new IntegrationsCliError("Name an app to connect — a domain (`hq integrations connect linear.app`), or use --mcp-url / --docs-url / --entry-id.", { expected: true });
+    }
+    if (looksLikeDomain(app)) {
+        // A catalog row for the same domain carries the opaque entryId and the
+        // authClass, both of which make the connect cleaner than a raw domain
+        // lookup. Missing it is fine — the domain path still works.
+        const match = await findCatalogEntry(token, companyUid, app);
+        if (match?.entryId) {
+            return {
+                ref: { catalogEntryId: match.entryId },
+                ...(match.authClass ? { authClass: match.authClass } : {}),
+                label: match.name || app,
+            };
+        }
+        return {
+            ref: { domain: app },
+            ...(match?.authClass ? { authClass: match.authClass } : {}),
+            label: match?.name || app,
+        };
+    }
+    return { ref: { query: app }, label: app };
+}
+/** Best-effort catalog lookup by domain; never fails the connect. */
+async function findCatalogEntry(token, companyUid, domain) {
+    try {
+        const entries = await listCatalog(token, companyUid, { query: domain, limit: 20 });
+        const want = domain.trim().toLowerCase();
+        return entries.find((entry) => entry.domain.trim().toLowerCase() === want) ?? null;
+    }
+    catch {
+        // The catalog is an optimization here, not the source of truth: an
+        // unreachable or flag-disabled catalog must not block a direct connect.
+        return null;
+    }
+}
+/**
+ * Run the browser sign-in and finish the install.
+ *
+ * The loopback listener is bound BEFORE `/oauth/start` because its port is
+ * part of the redirect URI hq-pro registers with the remote authorization
+ * server. If hq-pro refuses that URI (its loopback flag is off, or it predates
+ * the feature), the flow degrades to the console handoff rather than failing:
+ * `/oauth/start` is retried with no `redirectUri`, and the caller is told to
+ * finish in the browser where the console callback completes it.
+ */
+async function connectViaOAuth(token, companyUid, target, opts) {
+    const timeoutMs = opts.timeout ? Number(opts.timeout) * 1000 : undefined;
+    if (timeoutMs !== undefined && (!Number.isFinite(timeoutMs) || timeoutMs <= 0)) {
+        throw new IntegrationsCliError("--timeout must be a positive number of seconds.", {
+            expected: true,
+        });
+    }
+    const startInput = { ...target.ref };
+    // A loopback listener only works if the browser runs on THIS machine. Over
+    // SSH the person opens the printed URL on their workstation, so the provider
+    // redirects to the workstation's 127.0.0.1 while the listener sits on the
+    // remote host — the callback can never arrive and the command just times
+    // out. Go straight to the console handoff instead of failing slowly.
+    if (opts.browser === false && isRemoteShell()) {
+        return await consoleHandoff(token, companyUid, startInput, target, opts);
+    }
+    const listener = await startLoopbackListener(timeoutMs === undefined ? {} : { timeoutMs });
+    try {
+        let started;
+        try {
+            started = await startOAuth(token, companyUid, {
+                ...startInput,
+                redirectUri: listener.redirectUri,
+            });
+        }
+        catch (err) {
+            if (!(err instanceof IntegrationsCliError) ||
+                !err.code ||
+                !CONSOLE_HANDOFF_CODES.has(err.code)) {
+                throw err;
+            }
+            listener.close();
+            return await consoleHandoff(token, companyUid, startInput, target, opts);
+        }
+        // Arm the waiter BEFORE the browser opens. The listener buffers a redirect
+        // that beats it, but ordering it this way means the happy path never
+        // depends on that buffer.
+        const pendingCode = listener.waitForCode(started.state);
+        console.error(chalk.dim(`Waiting for you to sign in to ${started.displayName || target.label}…`));
+        if (opts.browser === false) {
+            console.error(`Open this URL to sign in:\n  ${started.authorizationUrl}`);
+        }
+        else {
+            // A failed browser launch (headless box, no handler) is recoverable —
+            // print the URL and keep waiting rather than aborting the sign-in.
+            await open(started.authorizationUrl).catch(() => {
+                console.error(`Open this URL to sign in:\n  ${started.authorizationUrl}`);
+            });
+        }
+        const code = await pendingCode;
+        return await completeOAuth(token, companyUid, { state: started.state, code });
+    }
+    finally {
+        listener.close();
+    }
+}
+/**
+ * Fallback for a backend that will not accept a loopback callback: start the
+ * sign-in against hq-pro's own console callback and hand the URL over. The
+ * console route finishes the install, so this command cannot report the
+ * result — it reports the handoff truthfully instead of pretending.
+ */
+async function consoleHandoff(token, companyUid, startInput, target, opts) {
+    const started = await startOAuth(token, companyUid, startInput);
+    const name = started.displayName || target.label;
+    console.error(chalk.yellow(`${name} signs in through the browser, and this HQ backend finishes those sign-ins in the console.`));
+    console.error(`Open this URL to sign in:\n  ${started.authorizationUrl}`);
+    if (opts.browser !== false)
+        await open(started.authorizationUrl).catch(() => { });
+    console.error(chalk.dim("When the browser says it connected, run `hq integrations list` to confirm."));
+    return null;
+}
+/**
+ * Second chance at a credential when the target's auth mode wasn't known up
+ * front.
+ *
+ * A key-authenticated app selected by bare query, `--entry-id`, or an unknown
+ * `--mcp-url` carries no `authClass`, so nothing prompts for a key and the
+ * install lands as `needs_credentials`. Unlike OAuth there is no error code to
+ * branch on — the signal is in the SUCCESS payload. Treat it as the detection
+ * point: prompt and re-install once, so the common case finishes in one
+ * command instead of leaving a half-connected app behind.
+ */
+async function completeCredentialIfNeeded(token, companyUid, target, opts, result) {
+    const needsKey = result.installation.status === "needs_credentials" ||
+        (result.credential?.required === true && result.credential.configured === false);
+    // Only worth retrying when a key could actually be collected: a token was
+    // never supplied (or it was and still failed — don't loop on it) and there
+    // is somebody to ask.
+    if (!needsKey || opts.token || opts.tokenStdin || !process.stdin.isTTY)
+        return result;
+    console.error(chalk.dim(`${target.label} needs an API key to finish connecting.`));
+    const bearerToken = await resolveKey(opts, target.label);
+    return await installIntegration(token, companyUid, {
+        ...target.ref,
+        authMode: "bearer",
+        bearerToken,
+    });
+}
+/** Print the outcome of a successful connect. */
+function reportInstall(result, opts) {
+    if (opts.json) {
+        printJson(result);
+        return;
+    }
+    const { installation, connection } = result;
+    const toolCount = result.mcp?.tools?.length;
+    console.log(chalk.green(`Connected ${chalk.bold(installation.displayName)}`) +
+        (typeof toolCount === "number" ? chalk.dim(` — ${toolCount} tools available`) : ""));
+    console.log(chalk.dim(`  connection: ${connection.id}`));
+    if (installation.status === "needs_credentials") {
+        console.log(chalk.yellow("  This app still needs credentials — re-run with --token, or reconnect it."));
+    }
+    console.log(chalk.dim(`  Try it: hq integrations tools --provider ${bareProvider(connection.provider)}`));
+}
+export function registerConnectCommands(integrations) {
+    integrations
+        .command("catalog [query]")
+        .alias("search")
+        .description("Browse or search apps you can connect")
+        .option("--company <slug>", "Company slug")
+        .option("--limit <n>", "How many entries to show (max 100)", "60")
+        .option("--json", "Machine-readable output")
+        .action(async (query, opts) => {
+        const token = await ensureCognitoIdToken();
+        const companyUid = await getCompanyUid(token, opts.company);
+        const limit = Number(opts.limit);
+        if (!Number.isFinite(limit) || limit < 1) {
+            throw new IntegrationsCliError("--limit must be a positive number.", { expected: true });
+        }
+        const entries = await listCatalog(token, companyUid, {
+            limit,
+            ...(query ? { query } : {}),
+        });
+        if (opts.json) {
+            printJson(entries);
+            return;
+        }
+        if (entries.length === 0) {
+            console.log(query
+                ? `Nothing matched '${query}'. Try a domain, e.g. hq integrations catalog linear.app`
+                : "The catalog is empty right now.");
+            return;
+        }
+        for (const entry of entries) {
+            const auth = entry.authClass === "oauth"
+                ? "sign-in"
+                : entry.authClass === "key"
+                    ? "api key"
+                    : entry.authClass === "none"
+                        ? "no auth"
+                        : null;
+            const tags = [
+                auth,
+                entry.source === "hq-recommended" ? "recommended" : null,
+                entry.source === "hq-discovered" ? "community" : null,
+                entry.mcpReady ? null : "not one-click",
+            ]
+                .filter(Boolean)
+                .join(" · ");
+            console.log(`${chalk.bold(entry.name)}  ${chalk.dim(entry.domain)}  ${chalk.dim(tags)}`);
+            if (entry.description)
+                console.log(chalk.dim(`  ${entry.description}`));
+        }
+        console.log(chalk.dim(`\n${entries.length} apps. Connect one with: hq integrations connect <domain>`));
+    });
+    integrations
+        .command("inspect <app>")
+        .description("Show what an app exposes before you connect it")
+        .option("--company <slug>", "Company slug")
+        .option("--json", "Machine-readable output")
+        .action(async (app, opts) => {
+        const token = await ensureCognitoIdToken();
+        const companyUid = await getCompanyUid(token, opts.company);
+        const blueprint = await pullBlueprint(token, companyUid, looksLikeDomain(app) ? { domain: app } : { query: app });
+        if (opts.json) {
+            printJson(blueprint);
+            return;
+        }
+        console.log(`${chalk.bold(blueprint.displayName)}  ${chalk.dim(blueprint.domain)}`);
+        if (blueprint.summary)
+            console.log(chalk.dim(blueprint.summary));
+        for (const surface of blueprint.surfaces) {
+            const auth = surface.authStatus === "none" ? "no auth" : `auth: ${surface.authStatus}`;
+            console.log(`  ${chalk.bold(surface.kind)}  ${surface.name}  ${chalk.dim(`${auth} · ${surface.readiness.strategy}`)}`);
+        }
+        for (const credential of blueprint.credentials) {
+            console.log(chalk.dim(`  needs: ${credential.label}${credential.generateUrl ? ` (${credential.generateUrl})` : ""}`));
+        }
+        for (const warning of blueprint.warnings) {
+            console.log(chalk.yellow(`  ! ${warning.message}`));
+        }
+    });
+    integrations
+        .command("discover <docsUrl>")
+        .description("Find a connectable server from an app's documentation page")
+        .option("--company <slug>", "Company slug")
+        .option("--json", "Machine-readable output")
+        .action(async (docsUrl, opts) => {
+        const token = await ensureCognitoIdToken();
+        const companyUid = await getCompanyUid(token, opts.company);
+        const found = await discoverDocs(token, companyUid, docsUrl);
+        if (opts.json) {
+            printJson(found);
+            return;
+        }
+        if (!found.discovery) {
+            console.log("No connectable server was found on that page.");
+            return;
+        }
+        const { discovery } = found;
+        console.log(`${chalk.bold(discovery.displayName)}  ${chalk.dim(discovery.mcpUrl)}`);
+        console.log(chalk.dim(`  sign-in: ${discovery.authMode} · ${discovery.verification} · confidence ${discovery.confidence}`));
+        // Quoted: a docs URL routinely carries `&`, which would background the
+        // command when pasted, and `;` would run whatever follows it.
+        console.log(chalk.dim(`\nConnect it with: hq integrations connect --docs-url ${shellQuote(docsUrl)}`));
+    });
+    integrations
+        .command("connect [app]")
+        .alias("add")
+        .description("Connect an app — by domain, catalog entry, docs page, or MCP URL")
+        .option("--company <slug>", "Company slug")
+        .option("--entry-id <id>", "Catalog entry id (from `hq integrations catalog --json`)")
+        .option("--mcp-url <url>", "Connect a specific MCP endpoint directly")
+        .option("--docs-url <url>", "Find the endpoint from a documentation page first")
+        .option("--provider <slug>", "Provider slug for a custom --mcp-url")
+        .option("--display-name <name>", "Display name for a custom --mcp-url")
+        .option("--token <key>", "API key (prefer --token-stdin: --token lands in shell history)")
+        .option("--token-stdin", "Read the API key from stdin")
+        .option("--auth <mode>", "Force the auth mode: none, key, or oauth (default: detect)")
+        .option("--no-browser", "Print the sign-in URL instead of opening a browser")
+        .option("--timeout <seconds>", "How long to wait for a browser sign-in (default 300)")
+        .option("--json", "Machine-readable output")
+        .action(async (app, opts) => {
+        assertAuthMode(opts.auth);
+        const token = await ensureCognitoIdToken();
+        const companyUid = await getCompanyUid(token, opts.company);
+        const target = await resolveTarget(token, companyUid, app, opts);
+        const authMode = opts.auth ?? target.authClass;
+        if (authMode === "oauth") {
+            const result = await connectViaOAuth(token, companyUid, target, opts);
+            if (result)
+                reportInstall(result, opts);
+            return;
+        }
+        // A key is only collected when something already says one is needed, or
+        // the caller supplied one — otherwise a no-auth app would pointlessly
+        // prompt.
+        const wantsKey = authMode === "key" || Boolean(opts.token || opts.tokenStdin);
+        const bearerToken = wantsKey ? await resolveKey(opts, target.label) : undefined;
+        try {
+            const result = await installIntegration(token, companyUid, {
+                ...target.ref,
+                ...(bearerToken
+                    ? { authMode: "bearer", bearerToken }
+                    : authMode === "none"
+                        ? { authMode: "none" }
+                        : {}),
+            });
+            reportInstall(await completeCredentialIfNeeded(token, companyUid, target, opts, result), opts);
+        }
+        catch (err) {
+            // Server-authoritative detection: the endpoint turned out to be
+            // OAuth-protected, so run the browser flow instead of making the
+            // caller re-issue the command with --auth oauth.
+            if (err instanceof IntegrationsCliError && err.code === OAUTH_REQUIRED_CODE) {
+                const result = await connectViaOAuth(token, companyUid, target, opts);
+                if (result)
+                    reportInstall(result, opts);
+                return;
+            }
+            throw err;
+        }
+    });
+    integrations
+        .command("reconnect [app]")
+        .description("Re-authenticate a connected app whose credentials stopped working")
+        .option("--company <slug>", "Company slug")
+        .option("--provider <slug>", "Connected app (e.g. linear)")
+        .option("--connection <id>", "Connection id (acct_…)")
+        .option("--token <key>", "API key (prefer --token-stdin)")
+        .option("--token-stdin", "Read the API key from stdin")
+        .option("--auth <mode>", "Force the auth mode: none, key, or oauth (default: detect)")
+        .option("--no-browser", "Print the sign-in URL instead of opening a browser")
+        .option("--timeout <seconds>", "How long to wait for a browser sign-in (default 300)")
+        .option("--json", "Machine-readable output")
+        .action(async (app, opts) => {
+        // Same validation as `connect`. Without it a typo like `--auth oauth2`
+        // is cast straight into `authClass`, matches neither branch, and
+        // silently reinstalls with auto-detection — the caller believes they
+        // forced a mode that was never applied.
+        assertAuthMode(opts.auth);
+        const token = await ensureCognitoIdToken();
+        const companyUid = await getCompanyUid(token, opts.company);
+        const connection = await resolveConnection(token, companyUid, app, opts);
+        const url = connection.installation?.surface?.url;
+        if (!url) {
+            throw new IntegrationsCliError(`${bareProvider(connection.provider)} was not installed through the app catalog, so it cannot be reconnected from here.`, { expected: true });
+        }
+        // Re-installing the same endpoint is the reconnect: hq-pro serializes it
+        // on the connection's install lease and replaces the stored credential.
+        const target = {
+            ref: {
+                mcpUrl: url,
+                provider: bareProvider(connection.provider),
+                ...(connection.installation?.displayName
+                    ? { displayName: connection.installation.displayName }
+                    : {}),
+            },
+            ...(opts.auth ? { authClass: opts.auth } : {}),
+            label: connection.installation?.displayName ?? bareProvider(connection.provider),
+        };
+        if (target.authClass === "oauth") {
+            const result = await connectViaOAuth(token, companyUid, target, opts);
+            if (result)
+                reportInstall(result, opts);
+            return;
+        }
+        const wantsKey = target.authClass === "key" || Boolean(opts.token || opts.tokenStdin);
+        const bearerToken = wantsKey ? await resolveKey(opts, target.label) : undefined;
+        try {
+            const result = await installIntegration(token, companyUid, {
+                ...target.ref,
+                ...(bearerToken ? { authMode: "bearer", bearerToken } : {}),
+            });
+            reportInstall(await completeCredentialIfNeeded(token, companyUid, target, opts, result), opts);
+        }
+        catch (err) {
+            if (err instanceof IntegrationsCliError && err.code === OAUTH_REQUIRED_CODE) {
+                const result = await connectViaOAuth(token, companyUid, target, opts);
+                if (result)
+                    reportInstall(result, opts);
+                return;
+            }
+            throw err;
+        }
+    });
+}
+//# sourceMappingURL=integrations-connect.js.map