@integrity-labs/agt-cli 0.28.392 → 0.28.394

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-SET6SREA.js";
+} from "../chunk-PTQWY46F.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -70,7 +70,7 @@ import {
   renderTemplate,
   resolveChannels,
   serializeManifestForSlackCli
-} from "../chunk-IJF4W6LC.js";
+} from "../chunk-7HONFACG.js";
 import "../chunk-XWVM4KPK.js";
 
 // src/bin/agt.ts
@@ -4829,7 +4829,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync10, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.392" : "dev";
+var cliVersion = true ? "0.28.394" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6001,7 +6001,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.392" : "dev";
+var cliVersion2 = true ? "0.28.394" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-IJF4W6LC.js → chunk-7HONFACG.js}

@@ -4049,6 +4049,59 @@ var OAUTH_PROVIDERS = {
     extraAuthorizeParams: {},
     clientAuthMethod: "basic",
     userInfoUrl: "https://api.xero.com/connections"
+  },
+  // LinkedIn Ads (Marketing API). Confidential client with a static secret and
+  // refresh tokens (~60-day access token, ~1-year rotating refresh token), so it
+  // mirrors the Xero shape: clientAuthMethod 'body', supportsRefresh true, no
+  // PKCE. The shared authorize/callback/refresh machinery handles the rest.
+  //
+  // The single shared app is Augmented Team's own LinkedIn developer app
+  // (client id/secret in OAUTH_LINKEDIN_ADS_CLIENT_ID / _SECRET) - every org
+  // connects its own ad accounts against it; only the per-connection tokens
+  // differ. Register `${API_PUBLIC_URL}/integrations/oauth/callback` as an
+  // Authorized redirect URL on the LinkedIn app.
+  //
+  // NOTE (linkedin-verify): the grantable scope set depends on which LinkedIn
+  // API products the app is approved for (Advertising API, Lead Sync API,
+  // Community Management API). Keep this list to scopes the app actually holds -
+  // requesting an ungranted scope makes LinkedIn reject the authorize request.
+  "linkedin-ads": {
+    definitionId: "linkedin-ads",
+    authorizeUrl: "https://www.linkedin.com/oauth/v2/authorization",
+    tokenUrl: "https://www.linkedin.com/oauth/v2/accessToken",
+    defaultScopes: [
+      "openid",
+      "profile",
+      "email",
+      // Advertising API: read + manage campaigns/creatives, and reporting.
+      "r_ads",
+      "rw_ads",
+      "r_ads_reporting",
+      // Community Management API: organization page/follower/share statistics.
+      "r_organization_social",
+      // Lead Sync API: read lead-generation forms + responses.
+      // linkedin-verify: `linkedin_ads_create_lead_form` WRITES a lead form, and
+      // it is not obvious that `rw_ads` covers that - Lead Sync may need its own
+      // write scope. Resolve this during the verification pass against the app's
+      // approved products. Do NOT guess a scope string here: an ungranted or
+      // misspelled scope makes LinkedIn reject the whole authorize request, so a
+      // wrong guess breaks every connect, not just lead forms.
+      "r_marketing_leadgen_automation"
+    ],
+    // Read-only variant: reporting + organization stats, no campaign/creative
+    // mutation. Used when an install is (re)connected with read_only: true.
+    readOnlyScopes: [
+      "openid",
+      "profile",
+      "email",
+      "r_ads",
+      "r_ads_reporting",
+      "r_organization_social"
+    ],
+    supportsRefresh: true,
+    extraAuthorizeParams: {},
+    clientAuthMethod: "body",
+    userInfoUrl: "https://api.linkedin.com/v2/userinfo"
   }
 };
 function getOAuthProvider(definitionId) {
@@ -4083,7 +4136,12 @@ var HTTP_PROBE_PROVIDERS = /* @__PURE__ */ new Set([
   // reflects real API reachability, not a `buffer` binary on PATH. This wins
   // over its toolkit source_type, so the probe is honest regardless of how the
   // toolkit row is classified.
-  "buffer"
+  "buffer",
+  // LinkedIn Ads is a native OAuth + brokered-REST integration (Xero's shape),
+  // so its honest health signal is the same: a central read-only check that the
+  // stored token still authenticates. Routes to the OIDC userinfo probe in
+  // connectivity-http-probes.ts.
+  "linkedin-ads"
   // ENG-6100: GitHub is deliberately NOT here. This set drives the ASYNC
   // connectivity monitor's routing, where github (source_type='native')
   // stays host-side (cli_command — `gh`, the credential the agent actually
@@ -4875,6 +4933,11 @@ async function probeHttpProvider(definitionId, credentials, fetchImpl = fetch) {
           return { status: "down", message: "No Xero organisations connected" };
         return { status: "ok", message: `Connected to ${conns[0]?.tenantName ?? "Xero"}` };
       });
+    case "linkedin-ads":
+      return probeBearerJson("https://api.linkedin.com/v2/userinfo", credentials, fetchImpl, (body) => {
+        const user = body;
+        return { status: "ok", message: `Connected as ${user.name ?? user.email ?? "unknown"}` };
+      });
     case "v0":
       return probeBearerJson("https://api.v0.dev/v1/user", credentials, fetchImpl, (body) => {
         const user = body;
@@ -12377,4 +12440,4 @@ export {
   stopAllSessionsAndWait,
   getProjectDir
 };
-//# sourceMappingURL=chunk-IJF4W6LC.js.map
+//# sourceMappingURL=chunk-7HONFACG.js.map