feat: accept Honeycomb Management API key in integration connect

[claude]

Requested by boris · Slack thread

The Honeycomb connect flow now also takes a Management API key (ID + secret) — required, per boris's follow-up — matching what POST /v1/integrations/connect accepts since nominal #1298.

Deliberate breaking change: polylane integration connect --type honeycomb previously worked with just --region and --api-key; it now refuses to run without the Management API key pair. Requested by boris.

Before

polylane integration connect --type honeycomb asked for the region and the configuration API key, and there was no way to pass a Management API key at all.

After

One smooth sequence, same path for everyone:

◆ Honeycomb region: the one in your Honeycomb URL
◆ Honeycomb configuration API key (paste it here)
▪ Management API key  Create one in your Honeycomb team settings under API Keys.
◆ Management API key ID          (required — empty input re-prompts)
◆ Management API key secret

New flags for non-interactive use: --management-api-key-id and --management-api-key-secret. Both are required: a non-interactive connect missing either one fails with Missing required flag: --management-api-key-... (exit code 2) and the hint Pass both --management-api-key-id and --management-api-key-secret., same style as the other required credential flags. Both halves are trimmed on the flag path as well as the interactive path; whitespace-only values count as missing.

Deploy-skew guard: an API build that predates the management-key fields strips them from the connect body and would silently discard the key. The CLI now verifies the connect response's metadata still carries managementApiKeyId (it survives redaction on the new API, and is absent when the old API stripped the field). When it is missing, the CLI exits 1 instead of reporting success:

Error: The Polylane API does not support the Honeycomb Management API key yet — the key was not stored
Hint: Honeycomb was connected without query access. Disconnect it, then retry once the API is updated:
      polylane integration disconnect <id> --yes
      or reconnect from the console: <console URL>

How

• Two extra wizard steps in the honeycomb branch of connectWithCredentials (src/commands/integration/connect.ts), built from a shared managementKeyStep factory (flag short-circuit, non-interactive usage error, prompt) using the existing runSteps/SKIPPED/BACK machinery so back-navigation works across all four steps.
• honeycombManagementKeyFields() trims both halves, puts the pair into the request body, and throws a usage error naming the missing flag if either half is empty, as a backstop behind the prompts.
• assertHoneycombManagementKeyStored() runs after every honeycomb connect and throws the deploy-skew error above when the response metadata lacks the key ID.
• The fields are spread into the body rather than written as literal keys: the client is generated from the live prod spec, which gains managementApiKeyId/managementApiKeySecret only when the matching nominal deploy lands. The spread keeps typecheck green on both sides of that deploy; the current API's non-strict body schema strips the unknown keys (now caught post-connect), the new one validates them (a bad key 400s with the server's actionable message). Reading the key ID back uses the same trust-boundary pattern (structural cast), since the generated metadata type lags the same way.

Verify

• npm run typecheck (includes codegen against the live spec) — clean
• npm run lint — clean
• npm run test — 299 pass, 0 fail (test/integration-connect-honeycomb.test.ts: field pairing + trimming + whitespace-only rejection; drop-detection passes with a stored key ID, throws with the exact message/hint when the field is missing, empty, or metadata is null, and includes the console link when the response carries one)
• npm run build — dist/polylane.mjs builds
• Built CLI, non-interactive: missing either or both management-key flags errors with exit code 2 and the pairing hint; region + configuration key behavior unchanged.

---

Generated by Claude Code