@bctrl/cli 0.1.5 → 0.1.7

package/dist/commands/auth/device-login.js

@@ -0,0 +1,19 @@
+import { hostname } from 'node:os';
+import { startDeviceAuth as defaultStartDeviceAuth, } from '../../api/device-auth.js';
+export async function startDeviceLoginSession(deps) {
+    const start = deps.startDeviceAuth ?? defaultStartDeviceAuth;
+    return start(deps.apiBaseUrl, {
+        clientName: 'BCTRL CLI',
+        clientKind: 'cli',
+        deviceName: safeHostname(),
+    });
+}
+function safeHostname() {
+    try {
+        const name = hostname().trim();
+        return name.length > 0 ? name.slice(0, 80) : 'cli';
+    }
+    catch {
+        return 'cli';
+    }
+}

package/dist/commands/auth/login.d.ts

@@ -3,12 +3,23 @@ import type { BctrlConfig } from '../../config/config.js';
 import type { Factory } from '../../factory.js';
 import type { IOStreams } from '../../io/streams.js';
 import { validateAuthToken } from '../../api/auth.js';
+import { pollDeviceAuth as defaultPollDeviceAuth, startDeviceAuth as defaultStartDeviceAuth } from '../../api/device-auth.js';
+export type AuthLoginDeviceDeps = {
+    startDeviceAuth?: typeof defaultStartDeviceAuth;
+    pollDeviceAuth?: typeof defaultPollDeviceAuth;
+    now?: () => number;
+    sleep?: (ms: number) => Promise<void>;
+};
 export type AuthLoginOptions = {
     io: IOStreams;
     config: () => Promise<BctrlConfig>;
     withToken?: boolean;
+    tokenFile?: string;
+    url?: boolean;
+    wait?: boolean;
     validateToken?: typeof validateAuthToken;
     env?: NodeJS.ProcessEnv;
+    deviceLoginDeps?: AuthLoginDeviceDeps;
 };
 export declare function createAuthLoginCommand(factory: Factory, run?: (options: AuthLoginOptions) => Promise<void>): Command;
 export declare function authLoginRun(options: AuthLoginOptions): Promise<void>;

package/dist/commands/auth/login.js

@@ -1,62 +1,179 @@
 import { Command } from 'commander';
-import { writeStoredAuth } from '../../config/auth-store.js';
+import { readFile } from 'node:fs/promises';
+import { saveCredential } from '../../config/auth-store.js';
+import { clearPendingDeviceAuth, pendingExpired, pendingMatchesApiBaseUrl, readPendingDeviceAuth, savePendingDeviceAuth, } from '../../config/pending-auth.js';
 import { CliError } from '../../runtime/errors.js';
 import { validateAuthToken } from '../../api/auth.js';
-import { readHiddenInput } from '../shared/hidden-input.js';
+import { pollDeviceAuth as defaultPollDeviceAuth, } from '../../api/device-auth.js';
+import { startDeviceLoginSession } from './device-login.js';
 export function createAuthLoginCommand(factory, run = authLoginRun) {
     return new Command('login')
-        .description('Authenticate with a BCTRL API key')
-        .option('--with-token', 'Read API key from standard input')
+        .description('Authenticate with BCTRL')
+        .option('--with-token', 'Read an API key from standard input instead of using the browser device flow')
+        .option('--token-file <path>', 'Read an API key from a file instead of using the browser device flow')
+        .option('--url', 'Start a browser authorization, print the URL, and exit')
+        .option('--wait', 'Poll until the browser authorization is approved')
         .action(async (options) => {
         await run({
             io: factory.io,
             config: factory.config,
             withToken: options.withToken,
+            tokenFile: options.tokenFile,
+            url: options.url,
+            wait: options.wait,
         });
     });
 }
 export async function authLoginRun(options) {
     const config = await options.config();
-    const { token, source } = await resolveLoginToken(options, config);
-    if (!token) {
-        throw new CliError('No API key provided');
+    if (options.url) {
+        const token = await startPendingBrowserLogin(options, config);
+        if (token) {
+            await persistResolvedLogin(options, config, {
+                token,
+                method: 'device',
+                source: 'device',
+            });
+        }
+        return;
     }
+    const { token, method, source } = await resolveLogin(options, config);
+    await persistResolvedLogin(options, config, { token, method, source });
+}
+async function startPendingBrowserLogin(options, config) {
+    if (options.withToken || options.tokenFile) {
+        throw new CliError('Use --url without --with-token or --token-file.');
+    }
+    const session = await startDeviceLoginSession({
+        apiBaseUrl: config.apiBaseUrl,
+        startDeviceAuth: options.deviceLoginDeps?.startDeviceAuth,
+    });
+    await savePendingDeviceAuth(config.apiBaseUrl, session, options.env, options.deviceLoginDeps?.now);
+    options.io.writeOut(`${session.verificationUriComplete}\n`);
+    if (!options.wait)
+        return null;
+    options.io.writeErr('Waiting for browser approval...\n');
+    return completePendingDeviceLogin(options, config, { wait: true });
+}
+async function persistResolvedLogin(options, config, resolution) {
     const validateToken = options.validateToken ?? validateAuthToken;
-    const whoami = await validateToken(config.apiBaseUrl, token);
+    const whoami = await validateToken(config.apiBaseUrl, resolution.token);
     const now = new Date().toISOString();
-    const path = await writeStoredAuth({
+    const saved = await saveCredential({
         apiBaseUrl: config.apiBaseUrl,
-        token,
+        token: resolution.token,
         whoami,
+        method: resolution.method,
         createdAt: now,
         validatedAt: now,
     }, options.env);
-    if (source === 'env') {
+    if (resolution.source === 'env') {
         options.io.writeErr('Using BCTRL_API_KEY from environment.\n');
     }
+    if (resolution.source === 'file') {
+        options.io.writeErr('Using API key from token file.\n');
+    }
+    if (saved.keychainFallback) {
+        options.io.writeErr('Warning: OS keychain unavailable; storing credentials in a 0600 file.\n');
+    }
     options.io.writeErr(`Logged in to ${config.apiBaseUrl}\n`);
-    options.io.writeErr(`Credentials saved to ${path}\n`);
+    options.io.writeErr(`Credentials saved to ${saved.path} (store: ${saved.backend})\n`);
     options.io.writeErr(`Scope: ${whoami.scope}\n`);
     options.io.writeErr(`Organization: ${whoami.organizationId}\n`);
     if (whoami.subaccountId) {
         options.io.writeErr(`Subaccount: ${whoami.subaccountId}\n`);
     }
-    options.io.writeErr(`Default space: ${whoami.defaultSpaceId}\n`);
+    options.io.writeErr(`Default space: ${whoami.defaultSpaceId ?? '-'}\n`);
     if (config.activeToken?.source === 'BCTRL_API_KEY') {
         options.io.writeErr('BCTRL_API_KEY is set and will take precedence over stored credentials.\n');
     }
 }
-async function resolveLoginToken(options, config) {
+/**
+ * Resolution order for `auth login`: explicit stdin token (`--with-token`) →
+ * explicit token file (`--token-file`) → ambient `BCTRL_API_KEY` →
+ * pending device authorization completion. A bare `auth login` never creates a
+ * fresh browser URL; run `auth login --url` first, authorize it, then run
+ * `auth login` to store the minted CLI session.
+ */
+async function resolveLogin(options, config) {
+    if (options.withToken && options.tokenFile) {
+        throw new CliError('Use either --with-token or --token-file, not both.');
+    }
     if (options.withToken) {
-        return { token: (await readStreamText(options.io.in)).trim(), source: 'stdin' };
+        const token = (await readStreamText(options.io.in)).trim();
+        if (!token) {
+            throw new CliError('No API key provided on standard input.');
+        }
+        return { token, method: 'api-key', source: 'stdin' };
+    }
+    if (options.tokenFile) {
+        const token = (await readFile(options.tokenFile, 'utf8')).trim();
+        if (!token) {
+            throw new CliError(`No API key found in ${options.tokenFile}.`);
+        }
+        return { token, method: 'api-key', source: 'file' };
     }
     if (config.activeToken?.source === 'BCTRL_API_KEY') {
-        return { token: config.activeToken.token, source: 'env' };
+        return {
+            token: config.activeToken.token,
+            method: 'api-key',
+            source: 'env',
+        };
+    }
+    const token = await completePendingDeviceLogin(options, config, {
+        wait: options.wait ?? false,
+    });
+    return { token, method: 'device', source: 'device' };
+}
+async function completePendingDeviceLogin(options, config, polling) {
+    const now = options.deviceLoginDeps?.now ?? Date.now;
+    const pending = await readPendingDeviceAuth(options.env);
+    if (!pending || !pendingMatchesApiBaseUrl(pending, config.apiBaseUrl)) {
+        throw new CliError('No pending browser login found.\n\n' +
+            'Start one with:\n' +
+            '  bctrl auth login --url\n\n' +
+            'Then approve the URL and run:\n' +
+            '  bctrl auth login\n\n' +
+            'Or store an API key directly with:\n' +
+            '  bctrl auth login --with-token\n' +
+            '  bctrl auth login --token-file <path>');
+    }
+    const poll = options.deviceLoginDeps?.pollDeviceAuth ?? defaultPollDeviceAuth;
+    const sleep = options.deviceLoginDeps?.sleep ?? defaultSleep;
+    for (;;) {
+        if (pendingExpired(pending, now)) {
+            await clearPendingDeviceAuth(options.env);
+            throw new CliError('The pending browser login expired.\n\n' +
+                'Start a new one with:\n' +
+                '  bctrl auth login --url');
+        }
+        const result = await poll(config.apiBaseUrl, pending.deviceCode);
+        switch (result.status) {
+            case 'complete':
+                await clearPendingDeviceAuth(options.env);
+                options.io.writeErr('Approved.\n');
+                return result.token;
+            case 'access_denied':
+                await clearPendingDeviceAuth(options.env);
+                throw new CliError('The pending browser login was denied.');
+            case 'expired_token':
+                await clearPendingDeviceAuth(options.env);
+                throw new CliError('The pending browser login expired.\n\n' +
+                    'Start a new one with:\n' +
+                    '  bctrl auth login --url');
+            case 'rate_limited':
+            case 'authorization_pending':
+                if (!polling.wait) {
+                    throw new CliError('Pending browser login is not approved yet.\n\n' +
+                        'Open and approve this URL:\n' +
+                        `  ${pending.verificationUriComplete}\n\n` +
+                        'Then run:\n' +
+                        '  bctrl auth login');
+                }
+                await sleep(pending.interval * 1000);
+                break;
+        }
     }
-    return {
-        token: await readHiddenInput(options.io, 'Paste BCTRL API key: '),
-        source: 'prompt',
-    };
 }
 async function readStreamText(stream) {
     const chunks = [];
@@ -65,3 +182,6 @@ async function readStreamText(stream) {
     }
     return Buffer.concat(chunks).toString('utf8');
 }
+function defaultSleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}

package/dist/commands/auth/logout.d.ts

@@ -1,4 +1,5 @@
 import { Command } from 'commander';
+import { revokeDeviceSession } from '../../api/device-auth.js';
 import type { BctrlConfig } from '../../config/config.js';
 import type { Factory } from '../../factory.js';
 import type { IOStreams } from '../../io/streams.js';
@@ -6,6 +7,7 @@ export type AuthLogoutOptions = {
     io: IOStreams;
     config: () => Promise<BctrlConfig>;
     env?: NodeJS.ProcessEnv;
+    revokeDeviceSession?: typeof revokeDeviceSession;
 };
 export declare function createAuthLogoutCommand(factory: Factory, run?: (options: AuthLogoutOptions) => Promise<void>): Command;
 export declare function authLogoutRun(options: AuthLogoutOptions): Promise<void>;

package/dist/commands/auth/logout.js

@@ -1,5 +1,6 @@
 import { Command } from 'commander';
-import { deleteStoredAuth } from '../../config/auth-store.js';
+import { revokeDeviceSession } from '../../api/device-auth.js';
+import { clearCredential } from '../../config/auth-store.js';
 export function createAuthLogoutCommand(factory, run = authLogoutRun) {
     return new Command('logout').description('Remove stored BCTRL credentials').action(async () => {
         await run({
@@ -10,7 +11,23 @@ export function createAuthLogoutCommand(factory, run = authLogoutRun) {
 }
 export async function authLogoutRun(options) {
     const config = await options.config();
-    const removed = await deleteStoredAuth(options.env);
+    const revokeStoredDeviceSession = options.revokeDeviceSession ?? revokeDeviceSession;
+    if (config.storedAuth?.method === 'device') {
+        try {
+            const result = await revokeStoredDeviceSession(config.apiBaseUrl, config.storedAuth.token);
+            if (result.revoked) {
+                options.io.writeErr('Revoked connected device session.\n');
+            }
+            else {
+                options.io.writeErr('Connected device session was already revoked or not found.\n');
+            }
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            options.io.writeErr(`Warning: could not revoke connected device session: ${message}\n`);
+        }
+    }
+    const removed = await clearCredential(options.env, config.apiBaseUrl);
     if (removed) {
         options.io.writeErr('Removed stored BCTRL credentials.\n');
     }

package/dist/commands/auth/status.d.ts

@@ -9,6 +9,7 @@ export type AuthStatusOptions = {
     config: () => Promise<BctrlConfig>;
     output?: OutputFlags;
     validateToken?: typeof validateAuthToken;
+    env?: NodeJS.ProcessEnv;
 };
 export declare function createAuthStatusCommand(factory: Factory, run?: (options: AuthStatusOptions) => Promise<void>): Command;
 export declare function authStatusRun(options: AuthStatusOptions): Promise<void>;

package/dist/commands/auth/status.js

@@ -1,5 +1,7 @@
 import { Command } from 'commander';
 import { validateAuthToken } from '../../api/auth.js';
+import { isUnauthorizedApiError } from '../../api/errors.js';
+import { clearCredential } from '../../config/auth-store.js';
 import { addOutputFlags, outputData } from '../shared/output.js';
 export function createAuthStatusCommand(factory, run = authStatusRun) {
     return addOutputFlags(new Command('status')
@@ -29,11 +31,23 @@ export async function authStatusRun(options) {
         return;
     }
     const validateToken = options.validateToken ?? validateAuthToken;
-    const whoami = await validateToken(config.apiBaseUrl, config.activeToken.token);
+    let whoami;
+    try {
+        whoami = await validateToken(config.apiBaseUrl, config.activeToken.token);
+    }
+    catch (error) {
+        if (config.activeToken.source === 'stored' && isUnauthorizedApiError(error)) {
+            await clearCredential(options.env, config.apiBaseUrl);
+        }
+        throw error;
+    }
     const status = {
         authenticated: true,
         apiBaseUrl: config.apiBaseUrl,
         tokenSource: config.activeToken.source,
+        ...(config.storedAuth
+            ? { backend: config.storedAuth.backend, method: config.storedAuth.method }
+            : {}),
         ...whoami,
     };
     if (usesStructuredOutput(options.output)) {
@@ -64,17 +78,20 @@ function writeHumanAuthStatus(io, status) {
         `Scope: ${status.scope}`,
         `Organization: ${status.organizationId}`,
         ...(status.subaccountId ? [`Subaccount: ${status.subaccountId}`] : []),
-        `Default space: ${status.defaultSpaceId}`,
+        `Default space: ${status.defaultSpaceId ?? '-'}`,
         `Plan: ${status.plan}`,
-        `Auth: ${formatTokenSource(status.tokenSource)}`,
+        `Auth: ${formatTokenSource(status.tokenSource, status.method)}`,
+        ...(status.backend
+            ? [`Store: ${status.backend === 'keychain' ? 'OS keychain' : 'plaintext file (0600)'}`]
+            : []),
         `API: ${status.apiBaseUrl}`,
         '',
     ].join('\n'));
 }
-function formatTokenSource(source) {
+function formatTokenSource(source, method) {
     if (source === 'BCTRL_API_KEY')
         return 'environment API key';
     if (source === 'stored')
-        return 'saved API key';
+        return method === 'device' ? 'saved CLI session' : 'saved API key';
     return source;
 }

package/dist/commands/auth/token.js

@@ -20,5 +20,11 @@ export async function authTokenRun(options) {
     if (options.io.isStdoutTTY() && options.reveal !== true) {
         throw new CliError('Refusing to print API key to a terminal without --reveal');
     }
+    // `auth token` is a human/debug command — never wire it into agent/MCP flows
+    // (it re-introduces the secret into a captured context). Warn loudly when it
+    // exfiltrates a secret out of the OS keychain.
+    if (options.reveal === true && config.storedAuth?.backend === 'keychain') {
+        options.io.writeErr('Warning: revealing a credential stored in the OS keychain.\n');
+    }
     options.io.writeOut(`${config.activeToken.token}\n`);
 }

package/dist/commands/browser-extension/index.js

@@ -1,7 +1,7 @@
 import { Command } from 'commander';
-import { readBlob, readJsonFile } from '../shared/io.js';
+import { readBlob } from '../shared/io.js';
 import { addOutputFlags, outputData } from '../shared/output.js';
-import { createOperationDeleteCommand, createOperationJsonBodyCommand, createOperationListCommand, createOperationViewCommand, uploadOperationFile, } from '../shared/operation.js';
+import { actingSubaccountOption, createOperationDeleteCommand, createOperationJsonBodyCommand, createOperationListCommand, createOperationViewCommand, uploadOperationFile, } from '../shared/operation.js';
 export function createBrowserExtensionCommand(factory) {
     const command = new Command('browser-extension').description('Manage browser extensions');
     command.addCommand(createOperationListCommand(factory, {
@@ -13,11 +13,11 @@ export function createBrowserExtensionCommand(factory) {
             .option('--format <format>', 'Filter by format')
             .option('--source <source>', 'Filter by source'),
         query: (options) => ({
-            subaccountId: typeof options.subaccountId === 'string' ? options.subaccountId : undefined,
             q: typeof options.q === 'string' ? options.q : undefined,
             format: typeof options.format === 'string' ? options.format : undefined,
             source: typeof options.source === 'string' ? options.source : undefined,
         }),
+        actingSubaccountId: actingSubaccountOption(),
     }));
     command.addCommand(createOperationViewCommand(factory, {
         operationId: 'browser-extensions.get',
@@ -36,8 +36,8 @@ export function createBrowserExtensionCommand(factory) {
             fileName: file.fileName,
             fields: {
                 ...(options.name ? { name: options.name } : {}),
-                ...(options.subaccountId ? { subaccountId: options.subaccountId } : {}),
             },
+            actingSubaccountId: options.subaccountId,
         });
         await outputData(factory.io, result, options);
     }));
@@ -48,18 +48,14 @@ export function createBrowserExtensionCommand(factory) {
         configure: (cmd) => cmd
             .option('--url <url>', 'Extension URL')
             .option('--name <name>', 'Display name')
-            .option('--subaccount-id <id>', 'Create under a subaccount when using a parent/org key')
-            .option('--input <path>', 'Read full JSON request body from file, or - for stdin'),
+            .option('--subaccount-id <id>', 'Create under a subaccount when using a parent/org key'),
         body: async (_args, options) => {
-            if (typeof options.input === 'string') {
-                return (await readJsonFile(options.input));
-            }
             return {
                 url: options.url,
                 name: options.name,
-                subaccountId: options.subaccountId,
             };
         },
+        actingSubaccountId: (_args, options) => actingSubaccountOption()(options),
     }));
     command.addCommand(createOperationJsonBodyCommand(factory, {
         operationId: 'browser-extensions.update',
@@ -67,12 +63,8 @@ export function createBrowserExtensionCommand(factory) {
         description: 'Update a browser extension',
         argNames: ['extensionId'],
         configure: (cmd) => cmd
-            .option('--name <name>', 'Display name')
-            .option('--input <path>', 'Read full JSON request body from file, or - for stdin'),
+            .option('--name <name>', 'Display name'),
         body: async (_args, options) => {
-            if (typeof options.input === 'string') {
-                return (await readJsonFile(options.input));
-            }
             return { name: options.name };
         },
     }));

package/dist/commands/file/index.js

@@ -1,5 +1,5 @@
 import { Command } from 'commander';
-import { readBlob, readJsonFile, writeBinary } from '../shared/io.js';
+import { parseJsonString, readBlob, readJsonFile, writeBinary } from '../shared/io.js';
 import { parsePositiveInteger } from '../shared/options.js';
 import { addOutputFlags, outputData } from '../shared/output.js';
 import { createOperationDeleteCommand, createOperationJsonBodyCommand, createOperationListCommand, createOperationViewCommand, downloadOperation, uploadOperationFile, } from '../shared/operation.js';
@@ -40,8 +40,12 @@ export function createFileCommand(factory) {
         .argument('<path>')
         .option('--space <id>', 'Space id; omitted uses caller default space')
         .option('--path <storagePath>', 'Storage path')
-        .option('--name <name>', 'Display name')).action(async (path, options) => {
+        .option('--name <name>', 'Display name')
+        .option('--metadata <json>', 'Metadata as inline JSON')).action(async (path, options) => {
         const file = await readBlob(path);
+        const metadata = options.metadata !== undefined
+            ? JSON.stringify(parseJsonString(options.metadata, '--metadata'))
+            : undefined;
         const result = await uploadOperationFile(factory, 'files.upload', {
             file: file.blob,
             fileName: options.name ?? file.fileName,
@@ -49,6 +53,7 @@ export function createFileCommand(factory) {
             fields: {
                 ...(options.path ? { path: options.path } : {}),
                 ...(options.name ? { name: options.name } : {}),
+                ...(metadata ? { metadata } : {}),
             },
         });
         await outputData(factory.io, result, options);
@@ -70,12 +75,8 @@ export function createFileCommand(factory) {
         argNames: ['fileId'],
         configure: (cmd) => cmd
             .option('--name <name>', 'Display name')
-            .option('--metadata-file <path>', 'Metadata JSON file')
-            .option('--input <path>', 'Read full JSON request body from file, or - for stdin'),
+            .option('--metadata-file <path>', 'Metadata JSON file'),
         body: async (_args, options) => {
-            if (typeof options.input === 'string') {
-                return (await readJsonFile(options.input));
-            }
             return {
                 name: options.name,
                 metadata: typeof options.metadataFile === 'string'

package/dist/commands/help/index.js

@@ -1,17 +1,18 @@
 import { Command } from 'commander';
 import { addOutputFlags } from '../shared/output.js';
-import { outputFlags, requestOperationAndPrint } from '../shared/operation.js';
+import { buildOperationInput, outputFlags, requestOperationAndPrint } from '../shared/operation.js';
 export function createHelpCommand(factory) {
     return addOutputFlags(new Command('help')
         .description('Get BCTRL API help')
         .option('--topic <topic>', 'Help topic')
-        .option('--audience <audience>', 'Help audience')).action(async (options) => {
-        await requestOperationAndPrint(factory, 'help', {
+        .option('--audience <audience>', 'Help audience')
+        .option('--params <json>', 'Path/query parameters as a JSON object (inline, @file, or - for stdin)')).action(async (options) => {
+        await requestOperationAndPrint(factory, 'help', await buildOperationInput('help', options, {
             query: {
                 topic: options.topic,
                 audience: options.audience,
             },
             output: outputFlags(options),
-        });
+        }));
     });
 }

package/dist/commands/notification-recipient/index.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+import type { Factory } from '../../factory.js';
+export declare function createNotificationRecipientCommand(factory: Factory): Command;

package/dist/commands/notification-recipient/index.js

@@ -0,0 +1,72 @@
+import { Command, Option } from 'commander';
+import { createOperationDeleteCommand, createOperationJsonBodyCommand, createOperationListCommand, } from '../shared/operation.js';
+import { parsePositiveInteger } from '../shared/options.js';
+function parseEnabled(value) {
+    if (value === true || value === 'true')
+        return true;
+    if (value === false || value === 'false')
+        return false;
+    return undefined;
+}
+export function createNotificationRecipientCommand(factory) {
+    const command = new Command('notification-recipient').description('Manage notification recipients');
+    command.addCommand(createOperationListCommand(factory, {
+        operationId: 'notification-recipients.list',
+        description: 'List notification recipients',
+        configure: (cmd) => cmd
+            .addOption(new Option('--type <type>', 'Filter by recipient type').choices([
+            'email',
+            'sms',
+            'whatsapp',
+        ]))
+            .addOption(new Option('--enabled <enabled>', 'Filter by enabled state').choices(['true', 'false']))
+            .option('-L, --limit <number>', 'Maximum number of results to return', parsePositiveInteger)
+            .option('--cursor <cursor>', 'Pagination cursor'),
+        query: (options) => ({
+            type: typeof options.type === 'string' ? options.type : undefined,
+            enabled: parseEnabled(options.enabled),
+            limit: typeof options.limit === 'number' ? options.limit : undefined,
+            cursor: typeof options.cursor === 'string' ? options.cursor : undefined,
+        }),
+    }));
+    command.addCommand(createOperationJsonBodyCommand(factory, {
+        operationId: 'notification-recipients.create',
+        name: 'create',
+        description: 'Create a notification recipient',
+        configure: (cmd) => cmd
+            .addOption(new Option('--type <type>', 'Recipient type').choices(['email', 'sms', 'whatsapp']))
+            .option('--value <value>', 'Email address, SMS number, or WhatsApp number')
+            .option('--name <name>', 'Display name'),
+        body: async (_args, options) => {
+            return {
+                type: options.type,
+                value: options.value,
+                name: options.name,
+            };
+        },
+    }));
+    command.addCommand(createOperationJsonBodyCommand(factory, {
+        operationId: 'notification-recipients.update',
+        name: 'patch',
+        description: 'Update a notification recipient',
+        argNames: ['recipientId'],
+        configure: (cmd) => cmd
+            .option('--value <value>', 'Email address, SMS number, or WhatsApp number')
+            .option('--name <name>', 'Display name')
+            .option('--clear-name', 'Clear the display name')
+            .addOption(new Option('--enabled <enabled>', 'Set enabled state').choices(['true', 'false'])),
+        body: async (_args, options) => {
+            return {
+                value: options.value,
+                name: options.clearName === true ? null : options.name,
+                enabled: parseEnabled(options.enabled),
+            };
+        },
+    }));
+    command.addCommand(createOperationDeleteCommand(factory, {
+        operationId: 'notification-recipients.delete',
+        description: 'Delete a notification recipient',
+        argNames: ['recipientId'],
+    }));
+    return command;
+}

package/dist/commands/proxy/index.js

@@ -1,6 +1,6 @@
 import { Command } from 'commander';
 import { addOutputFlags } from '../shared/output.js';
-import { addPaginationFlags, createOperationDeleteCommand, createOperationJsonBodyCommand, createOperationListCommand, createOperationViewCommand, outputFlags, requestOperationAndPrint, } from '../shared/operation.js';
+import { addPaginationFlags, buildOperationInput, createOperationDeleteCommand, createOperationJsonBodyCommand, createOperationListCommand, createOperationViewCommand, outputFlags, requestOperationAndPrint, } from '../shared/operation.js';
 export function createProxyCommand(factory) {
     const command = new Command('proxy').description('Manage proxies');
     command.addCommand(createOperationListCommand(factory, {
@@ -24,11 +24,13 @@ export function createProxyCommand(factory) {
         description: 'Update a proxy',
         argNames: ['proxyId'],
     }));
-    command.addCommand(addOutputFlags(new Command('test').description('Test a proxy').argument('<proxyId>')).action(async (proxyId, options) => {
-        await requestOperationAndPrint(factory, 'proxies.test', {
+    command.addCommand(addOutputFlags(new Command('test').description('Test a proxy').argument('<proxyId>'))
+        .option('--params <json>', 'Path/query parameters as a JSON object (inline, @file, or - for stdin)')
+        .action(async (proxyId, options) => {
+        await requestOperationAndPrint(factory, 'proxies.test', await buildOperationInput('proxies.test', options, {
             pathParams: { proxyId },
             output: outputFlags(options),
-        });
+        }));
     }));
     command.addCommand(createOperationDeleteCommand(factory, {
         operationId: 'proxies.delete',