@bctrl/cli 0.1.6 → 0.1.8

package/LICENSE

@@ -0,0 +1,15 @@
+ISC License
+
+Copyright (c) 2026 BCTRL
+
+Permission to use, copy, modify, and/or distribute this software for any purpose
+with or without fee is hereby granted, provided that the above copyright notice
+and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
+FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
+OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF
+THIS SOFTWARE.

package/README.md

@@ -1,95 +1,113 @@
-# BCTRL CLI
-
-CLI for controlling BCTRL runtimes, files, runs, vault secrets, tools, and account resources from scripts or AI agents.
-
-## Install
-
-```bash
-npm install -g @bctrl/cli
-```
-
-## Auth
-
-The CLI authenticates with a BCTRL API key.
-
-Use an API key for the current shell:
-
-```bash
-export BCTRL_API_KEY="bctrl_..."
-```
-
-Or save it locally:
-
-```bash
-bctrl auth login
-```
-
-If `BCTRL_API_KEY` is already set, `auth login` saves that key. Otherwise, it prompts you to paste an API key.
-
-Check the active auth:
-
-```bash
-bctrl auth status
-```
-
-## Browser Runtime Flow
-
-```bash
-bctrl space list
-bctrl runtime create --space sp_123 --name checkout-test
-bctrl runtime start rt_123
-bctrl runtime stop rt_123
-```
-
-## JSON Input
-
-Use `--input` for full request bodies:
-
-```bash
-bctrl runtime create --input runtime.json
-```
-
-Use `-` to read from stdin:
-
-```bash
-echo '{"type":"browser","spaceId":"sp_123","name":"agent-runtime"}' \
-  | bctrl runtime create --input -
-```
-
-## Output
-
-Print full JSON:
-
-```bash
-bctrl runtime list --space sp_123 --json
-```
-
-Print selected JSON fields:
-
-```bash
-bctrl runtime list --space sp_123 --json id,status,name
-```
-
-Filter with `jq`:
-
-```bash
-bctrl runtime list --space sp_123 --json --jq '.data[] | select(.status == "active")'
-```
-
-Render with a template:
-
-```bash
-bctrl runtime list \
-  --space sp_123 \
-  --json \
-  --template '{{#each data}}{{id}} {{status}}{{newline}}{{/each}}'
-```
-
-## Help
-
-Use command help for exact input and output fields:
-
-```bash
-bctrl runtime create --help
-bctrl runtime start --help
-```
+# BCTRL CLI
+
+Command-line tools for BCTRL cloud browser automation. Use it to create browser runtimes, start live sessions, submit hosted invocations, inspect runs and files, and manage account resources from a terminal or script.
+
+## Install
+
+```bash
+npm install -g @bctrl/cli
+```
+
+Requires Node.js 22.14 or newer.
+
+## Authenticate
+
+For an interactive terminal, start the browser approval flow and wait for completion:
+
+```bash
+bctrl auth login --url --wait
+```
+
+For CI, agents, or one-off shells, use an API key:
+
+```bash
+export BCTRL_API_KEY="bctrl_..."
+bctrl auth status
+```
+
+`BCTRL_API_KEY` takes precedence over credentials stored by `bctrl auth login`.
+
+## Quick Start
+
+Create a browser runtime, start it, run an extraction task, then stop it:
+
+```bash
+bctrl runtime create --name research-browser --json
+bctrl runtime start <runtime-id> --json
+
+bctrl runtime invocation create <runtime-id> \
+  --action extract \
+  --instruction "Extract the page title." \
+  --json
+
+bctrl runtime invocation wait <runtime-id> <invocation-id> --json
+bctrl runtime stop <runtime-id>
+```
+
+For full request bodies, pass JSON with `--body`. Inline JSON, `@file`, and `-` for stdin are supported:
+
+```bash
+bctrl runtime invocation create <runtime-id> \
+  --body '{"action":"observe","instruction":"Summarize the current page."}' \
+  --json
+
+cat invocation.json | bctrl runtime invocation create <runtime-id> --body - --json
+```
+
+Use `--params` for path and query overrides when you need the exact API surface:
+
+```bash
+bctrl run list --params '{"limit":25}' --json
+```
+
+## Output
+
+Print full JSON:
+
+```bash
+bctrl runtime list --json
+```
+
+Print selected fields:
+
+```bash
+bctrl runtime list --json id,status,name
+```
+
+Filter with jq syntax:
+
+```bash
+bctrl runtime list --json --jq '.data[] | select(.status == "active")'
+```
+
+Render with a template:
+
+```bash
+bctrl runtime list \
+  --json \
+  --template '{{#each data}}{{id}} {{status}}{{newline}}{{/each}}'
+```
+
+## Common Commands
+
+```bash
+bctrl space list
+bctrl runtime create --name browser-task
+bctrl runtime start <runtime-id>
+bctrl runtime target create <runtime-id> --uri https://example.com --activate
+bctrl runtime invocation create <runtime-id> --action act --instruction "Click the sign in button"
+bctrl run list --json
+bctrl runtime stop <runtime-id>
+```
+
+Run any command with `--help` for the exact arguments and flags:
+
+```bash
+bctrl runtime invocation create --help
+```
+
+## Documentation
+
+- CLI guide: https://platform.bctrl.ai/cli
+- Command reference: https://platform.bctrl.ai/cli/reference
+- API reference: https://platform.bctrl.ai/api-reference

package/dist/api/auth.d.ts

@@ -7,7 +7,16 @@ export declare const AuthWhoamiSchema: z.ZodObject<{
     }>;
     organizationId: z.ZodString;
     subaccountId: z.ZodNullable<z.ZodString>;
-    defaultSpaceId: z.ZodString;
+    defaultSpaceId: z.ZodNullable<z.ZodString>;
+    effectiveScope: z.ZodObject<{
+        scope: z.ZodEnum<{
+            organization: "organization";
+            subaccount: "subaccount";
+        }>;
+        organizationId: z.ZodString;
+        subaccountId: z.ZodNullable<z.ZodString>;
+        defaultSpaceId: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>;
     keyId: z.ZodString;
     plan: z.ZodString;
 }, z.core.$strict>;

package/dist/api/auth.js

@@ -1,13 +1,22 @@
 import { z } from 'zod';
 import { CliError } from '../runtime/errors.js';
 import { apiErrorFromResponse } from './errors.js';
+const AuthEffectiveScopeSchema = z
+    .object({
+    scope: z.enum(['organization', 'subaccount']),
+    organizationId: z.string().min(1),
+    subaccountId: z.string().min(1).nullable(),
+    defaultSpaceId: z.string().min(1).nullable(),
+})
+    .strict();
 export const AuthWhoamiSchema = z
     .object({
     email: z.string().email().nullable().optional(),
     scope: z.enum(['organization', 'subaccount']),
     organizationId: z.string().min(1),
     subaccountId: z.string().min(1).nullable(),
-    defaultSpaceId: z.string().min(1),
+    defaultSpaceId: z.string().min(1).nullable(),
+    effectiveScope: AuthEffectiveScopeSchema,
     keyId: z.string().min(1),
     plan: z.string().min(1),
 })

package/dist/api/client.d.ts

@@ -16,8 +16,9 @@ export type BctrlApiClient = {
 export type RequestOptions = {
     query?: Record<string, string | number | boolean | undefined>;
     idempotencyKey?: string;
+    actingSubaccountId?: string;
 };
 export type JsonRequestOptions = RequestOptions & {
     body?: unknown;
 };
-export declare function createBctrlApiClient(config: BctrlConfig): BctrlApiClient;
+export declare function createBctrlApiClient(config: BctrlConfig, env?: NodeJS.ProcessEnv): BctrlApiClient;

package/dist/api/client.js

@@ -1,26 +1,23 @@
 import { AuthError, CliError } from '../runtime/errors.js';
-import { apiErrorFromResponse } from './errors.js';
-export function createBctrlApiClient(config) {
+import { clearCredential } from '../config/auth-store.js';
+import { apiErrorFromResponse, isUnauthorizedApiError } from './errors.js';
+export function createBctrlApiClient(config, env = process.env) {
     return {
-        get: (path, options) => requestJson(config, 'GET', path, options),
-        post: (path, options) => requestJson(config, 'POST', path, options),
-        patch: (path, options) => requestJson(config, 'PATCH', path, options),
-        put: (path, options) => requestJson(config, 'PUT', path, options),
-        delete: (path, options) => requestJson(config, 'DELETE', path, options),
-        download: (path, options) => requestBinary(config, 'GET', path, options),
-        streamText: (path, options) => requestTextStream(config, path, options),
-        uploadFile: (path, options) => uploadFile(config, path, options),
+        get: (path, options) => requestJson(config, env, 'GET', path, options),
+        post: (path, options) => requestJson(config, env, 'POST', path, options),
+        patch: (path, options) => requestJson(config, env, 'PATCH', path, options),
+        put: (path, options) => requestJson(config, env, 'PUT', path, options),
+        delete: (path, options) => requestJson(config, env, 'DELETE', path, options),
+        download: (path, options) => requestBinary(config, env, 'GET', path, options),
+        streamText: (path, options) => requestTextStream(config, env, path, options),
+        uploadFile: (path, options) => uploadFile(config, env, path, options),
     };
 }
-async function requestJson(config, method, path, options) {
+async function requestJson(config, env, method, path, options) {
     if (!config.activeToken) {
         throw new AuthError();
     }
-    const headers = {
-        accept: 'application/json',
-        authorization: `Bearer ${config.activeToken.token}`,
-        'user-agent': 'BCTRL CLI',
-    };
+    const headers = requestHeaders(config.activeToken.token, options, 'application/json');
     if (options?.idempotencyKey) {
         headers['idempotency-key'] = options.idempotencyKey;
     }
@@ -35,7 +32,7 @@ async function requestJson(config, method, path, options) {
         body,
     });
     if (!response.ok) {
-        throw await apiErrorFromResponse(response);
+        throw await reconcileStoredCredentialAuthError(config, env, await apiErrorFromResponse(response));
     }
     if (response.status === 204) {
         return { ok: true };
@@ -43,36 +40,29 @@ async function requestJson(config, method, path, options) {
     const text = await response.text();
     return (text ? JSON.parse(text) : { ok: true });
 }
-async function requestBinary(config, method, path, options) {
+async function requestBinary(config, env, method, path, options) {
     if (!config.activeToken) {
         throw new AuthError();
     }
     const response = await fetch(buildUrl(config.apiBaseUrl, path, options?.query), {
         method,
-        headers: {
-            authorization: `Bearer ${config.activeToken.token}`,
-            'user-agent': 'BCTRL CLI',
-        },
+        headers: requestHeaders(config.activeToken.token, options),
     });
     if (!response.ok) {
-        throw await apiErrorFromResponse(response);
+        throw await reconcileStoredCredentialAuthError(config, env, await apiErrorFromResponse(response));
     }
     return new Uint8Array(await response.arrayBuffer());
 }
-async function requestTextStream(config, path, options) {
+async function requestTextStream(config, env, path, options) {
     if (!config.activeToken) {
         throw new AuthError();
     }
     const response = await fetch(buildUrl(config.apiBaseUrl, path, options?.query), {
         method: 'GET',
-        headers: {
-            accept: 'text/event-stream',
-            authorization: `Bearer ${config.activeToken.token}`,
-            'user-agent': 'BCTRL CLI',
-        },
+        headers: requestHeaders(config.activeToken.token, options, 'text/event-stream'),
     });
     if (!response.ok) {
-        throw await apiErrorFromResponse(response);
+        throw await reconcileStoredCredentialAuthError(config, env, await apiErrorFromResponse(response));
     }
     if (!response.body) {
         throw new CliError('BCTRL API response did not include a stream body');
@@ -99,7 +89,7 @@ async function requestTextStream(config, path, options) {
         },
     };
 }
-async function uploadFile(config, path, options) {
+async function uploadFile(config, env, path, options) {
     if (!config.activeToken) {
         throw new AuthError();
     }
@@ -110,18 +100,28 @@ async function uploadFile(config, path, options) {
     }
     const response = await fetch(buildUrl(config.apiBaseUrl, path, options.query), {
         method: 'POST',
-        headers: {
-            accept: 'application/json',
-            authorization: `Bearer ${config.activeToken.token}`,
-            'user-agent': 'BCTRL CLI',
-        },
+        headers: requestHeaders(config.activeToken.token, options, 'application/json'),
         body: form,
     });
     if (!response.ok) {
-        throw await apiErrorFromResponse(response);
+        throw await reconcileStoredCredentialAuthError(config, env, await apiErrorFromResponse(response));
     }
     return (await response.json());
 }
+async function reconcileStoredCredentialAuthError(config, env, error) {
+    if (config.activeToken?.source === 'stored' && isUnauthorizedApiError(error)) {
+        await clearCredential(env, config.apiBaseUrl);
+    }
+    return error;
+}
+function requestHeaders(token, options, accept) {
+    return {
+        ...(accept ? { accept } : {}),
+        authorization: `Bearer ${token}`,
+        'user-agent': 'BCTRL CLI',
+        ...(options?.actingSubaccountId ? { 'BCTRL-Subaccount-Id': options.actingSubaccountId } : {}),
+    };
+}
 function buildUrl(baseUrl, path, query) {
     const url = new URL(`${baseUrl}${path.startsWith('/') ? path : `/${path}`}`);
     for (const [key, value] of Object.entries(query ?? {})) {

package/dist/api/device-auth.d.ts

@@ -0,0 +1,39 @@
+import { z } from 'zod';
+declare const DeviceStartResponseSchema: z.ZodObject<{
+    deviceCode: z.ZodString;
+    userCode: z.ZodString;
+    verificationUri: z.ZodString;
+    verificationUriComplete: z.ZodString;
+    expiresIn: z.ZodNumber;
+    interval: z.ZodNumber;
+}, z.core.$strict>;
+declare const DeviceSessionRevokeResponseSchema: z.ZodObject<{
+    revoked: z.ZodBoolean;
+}, z.core.$strict>;
+export type DeviceStartResponse = z.infer<typeof DeviceStartResponseSchema>;
+type DeviceSessionRevokeResponse = z.infer<typeof DeviceSessionRevokeResponseSchema>;
+/**
+ * Poll outcome. The control-plane returns the RFC 8628 polling states as a 200
+ * status union; a 429 (rate limiter) is surfaced as `rate_limited` so the poll
+ * loop can back off rather than treating it as a hard failure.
+ */
+export type DevicePollResult = {
+    status: 'authorization_pending';
+} | {
+    status: 'access_denied';
+} | {
+    status: 'expired_token';
+} | {
+    status: 'rate_limited';
+} | {
+    status: 'complete';
+    token: string;
+};
+export declare function startDeviceAuth(apiBaseUrl: string, body?: {
+    clientName?: string;
+    clientKind?: 'cli' | 'mcp';
+    deviceName?: string;
+}): Promise<DeviceStartResponse>;
+export declare function pollDeviceAuth(apiBaseUrl: string, deviceCode: string): Promise<DevicePollResult>;
+export declare function revokeDeviceSession(apiBaseUrl: string, token: string): Promise<DeviceSessionRevokeResponse>;
+export {};

package/dist/api/device-auth.js

@@ -0,0 +1,93 @@
+import { z } from 'zod';
+import { CliError } from '../runtime/errors.js';
+import { apiErrorFromResponse } from './errors.js';
+// Hand-written client for the OAuth 2.0 device-authorization endpoints (RFC 8628).
+// These are unauthenticated (the CLI has no credential yet) and intentionally kept
+// out of the generated public OpenAPI/SDK (docs-hidden).
+const DeviceStartResponseSchema = z
+    .object({
+    deviceCode: z.string().min(1),
+    userCode: z.string().min(1),
+    verificationUri: z.string().min(1),
+    verificationUriComplete: z.string().min(1),
+    expiresIn: z.number().int().positive(),
+    interval: z.number().int().positive(),
+})
+    .strict();
+const DeviceTokenResponseSchema = z
+    .object({
+    status: z.enum(['authorization_pending', 'access_denied', 'expired_token', 'complete']),
+    token: z.string().optional(),
+})
+    .strict();
+const DeviceSessionRevokeResponseSchema = z.object({ revoked: z.boolean() }).strict();
+function deviceEndpoint(apiBaseUrl, path) {
+    return new URL(`${apiBaseUrl.replace(/\/+$/, '')}${path}`);
+}
+export async function startDeviceAuth(apiBaseUrl, body = {}) {
+    const response = await fetch(deviceEndpoint(apiBaseUrl, '/auth/device'), {
+        method: 'POST',
+        headers: {
+            accept: 'application/json',
+            'content-type': 'application/json',
+            'user-agent': 'BCTRL CLI',
+        },
+        body: JSON.stringify(body),
+    });
+    if (!response.ok) {
+        throw await apiErrorFromResponse(response, 'BCTRL device login');
+    }
+    const parsed = DeviceStartResponseSchema.safeParse(await response.json());
+    if (!parsed.success) {
+        throw new CliError(`BCTRL device login returned an unexpected response: ${parsed.error.message}`);
+    }
+    return parsed.data;
+}
+export async function pollDeviceAuth(apiBaseUrl, deviceCode) {
+    const response = await fetch(deviceEndpoint(apiBaseUrl, '/auth/device/token'), {
+        method: 'POST',
+        headers: {
+            accept: 'application/json',
+            'content-type': 'application/json',
+            'user-agent': 'BCTRL CLI',
+        },
+        body: JSON.stringify({ deviceCode }),
+    });
+    // The poll route is rate-limited; a 429 is expected under fast polling and just
+    // means "back off and keep waiting", not a terminal error.
+    if (response.status === 429) {
+        return { status: 'rate_limited' };
+    }
+    if (!response.ok) {
+        throw await apiErrorFromResponse(response, 'BCTRL device login');
+    }
+    const parsed = DeviceTokenResponseSchema.safeParse(await response.json());
+    if (!parsed.success) {
+        throw new CliError(`BCTRL device login returned an unexpected response: ${parsed.error.message}`);
+    }
+    if (parsed.data.status === 'complete') {
+        if (!parsed.data.token) {
+            throw new CliError('BCTRL device login completed without returning a token.');
+        }
+        return { status: 'complete', token: parsed.data.token };
+    }
+    return { status: parsed.data.status };
+}
+export async function revokeDeviceSession(apiBaseUrl, token) {
+    const response = await fetch(deviceEndpoint(apiBaseUrl, '/auth/device/session'), {
+        method: 'DELETE',
+        headers: {
+            accept: 'application/json',
+            authorization: `Bearer ${token}`,
+            'user-agent': 'BCTRL CLI',
+        },
+    });
+    if (!response.ok) {
+        throw await apiErrorFromResponse(response, 'BCTRL device logout');
+    }
+    const parsed = DeviceSessionRevokeResponseSchema.safeParse(await response.json());
+    if (!parsed.success) {
+        throw new CliError(`BCTRL device logout returned an unexpected response: ${parsed.error.message}`);
+    }
+    return parsed.data;
+}

package/dist/api/errors.d.ts

@@ -1,2 +1,3 @@
 import { CliError } from '../runtime/errors.js';
 export declare function apiErrorFromResponse(response: Response, context?: string): Promise<CliError>;
+export declare function isUnauthorizedApiError(error: unknown): boolean;

package/dist/api/errors.js

@@ -16,6 +16,14 @@ export async function apiErrorFromResponse(response, context = 'BCTRL API reques
         apiError,
     });
 }
+export function isUnauthorizedApiError(error) {
+    if (!(error instanceof CliError))
+        return false;
+    return (error.apiError?.status === 401 &&
+        (error.apiError.code === 'auth.required' ||
+            error.apiError.code === 'auth.invalid' ||
+            error.apiError.code === undefined));
+}
 function parseErrorBody(bodyText) {
     if (!bodyText)
         return {};

package/dist/commands/ai/index.js

@@ -1,7 +1,6 @@
 import { Command } from 'commander';
-import { readJsonFile } from '../shared/io.js';
 import { addOutputFlags } from '../shared/output.js';
-import { createOperationDeleteCommand, createOperationJsonBodyCommand, createOperationListCommand, createOperationViewCommand, outputFlags, requestOperationAndPrint, } from '../shared/operation.js';
+import { actingSubaccountOption, buildOperationInput, createOperationDeleteCommand, createOperationJsonBodyCommand, createOperationListCommand, createOperationViewCommand, outputFlags, requestOperationAndPrint, } from '../shared/operation.js';
 export function createAiCommand(factory) {
     const command = new Command('ai').description('Manage AI models and credentials');
     command.addCommand(createAiModelsCommand(factory));
@@ -50,11 +49,13 @@ function createAiCredentialsCommand(factory) {
     }));
     command.addCommand(createAiCredentialWriteCommand(factory, 'create', 'ai.credentials.create'));
     command.addCommand(createAiCredentialWriteCommand(factory, 'patch', 'ai.credentials.update', ['credentialId']));
-    command.addCommand(addOutputFlags(new Command('test').description('Test an AI credential').argument('<credentialId>')).action(async (credentialId, options) => {
-        await requestOperationAndPrint(factory, 'ai.credentials.test', {
+    command.addCommand(addOutputFlags(new Command('test').description('Test an AI credential').argument('<credentialId>'))
+        .option('--params <json>', 'Path/query parameters as a JSON object (inline, @file, or - for stdin)')
+        .action(async (credentialId, options) => {
+        await requestOperationAndPrint(factory, 'ai.credentials.test', await buildOperationInput('ai.credentials.test', options, {
             pathParams: { credentialId },
             output: outputFlags(options),
-        });
+        }));
     }));
     command.addCommand(createOperationDeleteCommand(factory, {
         operationId: 'ai.credentials.delete',
@@ -76,22 +77,20 @@ function createAiCredentialWriteCommand(factory, name, operationId, argNames = [
             .option('--status <status>', 'Credential status')
             .option('--default-model <model>', 'Default model')
             .option('--base-url <url>', 'Custom provider base URL')
-            .option('--subaccount-id <id>', 'Subaccount scope when using a parent/org key')
-            .option('--input <path>', 'Read full JSON request body from file, or - for stdin'),
+            .option('--subaccount-id <id>', 'Subaccount scope when using a parent/org key'),
         body: async (_args, options) => {
-            if (typeof options.input === 'string') {
-                return (await readJsonFile(options.input));
-            }
             return {
                 name: options.name,
                 provider: options.provider,
                 apiKey: options.apiKey,
                 status: options.status,
-                subaccountId: options.subaccountId,
                 defaultModel: options.defaultModel,
                 baseUrl: options.baseUrl,
             };
         },
+        actingSubaccountId: operationId === 'ai.credentials.create'
+            ? (_args, options) => actingSubaccountOption()(options)
+            : undefined,
     });
 }
 function parseBooleanFlag(value) {

package/dist/commands/api-key/index.js

@@ -1,5 +1,4 @@
 import { Command } from 'commander';
-import { readJsonFile } from '../shared/io.js';
 import { createOperationDeleteCommand, createOperationJsonBodyCommand, createOperationListCommand, } from '../shared/operation.js';
 export function createApiKeyCommand(factory) {
     const command = new Command('api-key').description('Manage API keys');
@@ -8,12 +7,12 @@ export function createApiKeyCommand(factory) {
         description: 'List API keys',
         configure: (cmd) => cmd
             .option('--subaccount-id <id>', 'Filter by subaccount id')
-            .option('--kind <kind>', 'Filter by key kind: organization or subaccount')
+            .option('--type <type>', 'Filter by API key type: organization or subaccount')
             .option('-L, --limit <number>', 'Maximum number of results to return')
             .option('--cursor <cursor>', 'Pagination cursor'),
         query: (options) => ({
             subaccountId: typeof options.subaccountId === 'string' ? options.subaccountId : undefined,
-            keyKind: typeof options.kind === 'string' ? options.kind : undefined,
+            type: typeof options.type === 'string' ? options.type : undefined,
             limit: typeof options.limit === 'string' ? Number(options.limit) : undefined,
             cursor: typeof options.cursor === 'string' ? options.cursor : undefined,
         }),
@@ -25,12 +24,8 @@ export function createApiKeyCommand(factory) {
         configure: (cmd) => cmd
             .option('--name <name>', 'API key name')
             .option('--subaccount-id <id>', 'Create a subaccount-scoped key')
-            .option('--expires-at <iso>', 'Expiration timestamp')
-            .option('--input <path>', 'Read full JSON request body from file, or - for stdin'),
+            .option('--expires-at <iso>', 'Expiration timestamp'),
         body: async (_args, options) => {
-            if (typeof options.input === 'string') {
-                return (await readJsonFile(options.input));
-            }
             return {
                 name: options.name,
                 subaccountId: options.subaccountId,

package/dist/commands/auth/device-login.d.ts

@@ -0,0 +1,6 @@
+import { startDeviceAuth as defaultStartDeviceAuth, type DeviceStartResponse } from '../../api/device-auth.js';
+export type DeviceLoginStartDeps = {
+    apiBaseUrl: string;
+    startDeviceAuth?: typeof defaultStartDeviceAuth;
+};
+export declare function startDeviceLoginSession(deps: DeviceLoginStartDeps): Promise<DeviceStartResponse>;