@calltelemetry/cli 0.15.1 → 1.1.0

package/dist/commands/sftp.js

@@ -0,0 +1,1586 @@
+import chalk from 'chalk';
+import prompts from 'prompts';
+import { readFileSync, statSync } from 'node:fs';
+import { basename } from 'node:path';
+import { ApplianceApi, ApplianceApiError, DEFAULT_API_URL, DEFAULT_TIMEOUT_MS, isLocalBaseUrl, parsePositiveInt, readJsonOption, } from '../lib/appliance-api.js';
+import { describeSchema, getOperation, listOperations, operationBodySchema, operationQueryParams, pathPlaceholders, validateAgainstSchema, } from '../lib/openapi.js';
+import { addAccountContacts, buildCreateAccountPayload, buildDiscoverPayload, buildMonitoringPayload, buildUpdateAccountPayload, collectSftpStatus, getAccountActivity, getAccountContacts, getAccountFiles, getAccountMonitoring, getAccountQuota, getAccountRuns, listAccounts, listMonitoredAccounts, parseContactIds, readImportFile, removeAccountContact, requireOperation, resolveAccount, supportsOperation, } from '../lib/sftp.js';
+import { checkTcpPort } from '../lib/network.js';
+import { rpc } from '../lib/rpc.js';
+import { redactSecrets } from '../lib/redact.js';
+import { getLogLevel } from '../lib/log.js';
+import * as out from '../utils/output.js';
+import { formatBytes, formatDateTime, formatGb, formatPercent, formatQuota, renderTable, } from '../utils/table.js';
+function collect(value, previous = []) {
+    return [...previous, value];
+}
+function parseIntegerOption(value, label, opts = {}) {
+    if (value === undefined || value === '')
+        return opts.fallback;
+    const parsed = Number(value);
+    const min = opts.min ?? 0;
+    const max = opts.max ?? Number.MAX_SAFE_INTEGER;
+    if (!Number.isInteger(parsed) || parsed < min || parsed > max) {
+        throw new ApplianceApiError(`${label} must be an integer between ${min} and ${max}.`);
+    }
+    return parsed;
+}
+function parsePair(value, label) {
+    const index = value.indexOf('=');
+    if (index <= 0) {
+        throw new ApplianceApiError(`${label} must use key=value syntax: ${value}`);
+    }
+    return [value.slice(0, index), value.slice(index + 1)];
+}
+function parsePairs(values, label) {
+    const result = {};
+    for (const value of values ?? []) {
+        const [key, raw] = parsePair(value, label);
+        result[key] = raw;
+    }
+    return result;
+}
+function printJson(value) {
+    console.log(JSON.stringify(value, null, 2));
+}
+function printError(err) {
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(chalk.red('  ✗'), redactSecrets(message));
+    if (getLogLevel() === 'debug' && err instanceof Error && err.stack) {
+        console.error(chalk.gray(err.stack));
+    }
+}
+/** Wrap a Commander action with friendly error output and a non-zero exit code. */
+function action(fn) {
+    return async (...args) => {
+        try {
+            await fn(...args);
+        }
+        catch (err) {
+            printError(err);
+            process.exitCode = 1;
+        }
+    };
+}
+function addApiOptions(command, withJson = false) {
+    command
+        .option('--url <url>', `Appliance API base URL (default: ${DEFAULT_API_URL})`)
+        .option('--token <token>', 'Machine API token for automation (prefer CT_API_TOKEN)')
+        .option('--email <email>', 'Admin email for interactive session login (or CT_API_EMAIL)')
+        .option('--org <id>', 'Organization ID (or CT_ORG_ID)')
+        .option('--timeout <ms>', 'Request timeout in milliseconds', String(DEFAULT_TIMEOUT_MS))
+        .option('--verify-tls', 'Verify the appliance TLS certificate');
+    if (withJson)
+        command.option('--json', 'Output JSON');
+    return command;
+}
+async function connect(options, opts = {}) {
+    return ApplianceApi.connect({
+        baseUrl: options.url,
+        token: options.token,
+        email: options.email,
+        orgId: parsePositiveInt(options.org, '--org'),
+        timeoutMs: parseIntegerOption(options.timeout, '--timeout', { min: 1000 }),
+        verifyTls: options.verifyTls ? true : undefined,
+        requireAuth: opts.requireAuth ?? true,
+    });
+}
+async function connectWithSpec(options) {
+    const api = await connect(options);
+    const spec = await api.fetchSpec();
+    return { api, spec };
+}
+function printKeyValues(rows) {
+    if (rows.length === 0)
+        return;
+    const width = Math.max(...rows.map(([key]) => key.length));
+    for (const [key, value] of rows) {
+        console.log(`  ${chalk.gray(key.padEnd(width))}  ${value}`);
+    }
+}
+function accountLabel(account) {
+    return `${account.username} (id ${account.id})`;
+}
+function actionSummary(actions) {
+    if (!Array.isArray(actions) || actions.length === 0)
+        return 'none';
+    return actions
+        .map(item => {
+        if (typeof item === 'object' && item !== null && 'type' in item) {
+            return String(item.type);
+        }
+        return String(item);
+    })
+        .join(', ');
+}
+function monitoringSchedule(monitoring) {
+    const schedule = monitoring?.schedule;
+    if (!schedule?.type)
+        return '—';
+    const time = schedule.hour !== null && schedule.hour !== undefined
+        ? ` ${String(schedule.hour).padStart(2, '0')}:${String(schedule.minute ?? 0).padStart(2, '0')}`
+        : '';
+    return `${schedule.type}${time}`;
+}
+function isTty() {
+    return Boolean(process.stdin.isTTY && process.stdout.isTTY);
+}
+async function promptHidden(message) {
+    if (!isTty())
+        return undefined;
+    const { value } = await prompts({ type: 'password', name: 'value', message });
+    return typeof value === 'string' && value.length > 0 ? value : undefined;
+}
+function readPasswordFromStdin() {
+    const value = readFileSync(0, 'utf-8').replace(/\r?\n$/, '');
+    if (!value)
+        throw new ApplianceApiError('No password received on stdin.');
+    return value;
+}
+async function resolveNewPassword(opts) {
+    if (opts.password)
+        return opts.password;
+    if (opts.passwordStdin)
+        return readPasswordFromStdin();
+    if (opts.generate)
+        return undefined;
+    const prompted = await promptHidden('SFTP password (leave blank to generate a secure password)');
+    return prompted;
+}
+function redactAccount(account) {
+    if (typeof account.password !== 'string')
+        return account;
+    return { ...account, password: '[REDACTED]' };
+}
+async function confirmDestructive(message, yes) {
+    if (yes)
+        return;
+    if (!isTty()) {
+        throw new ApplianceApiError('Refusing to continue without --yes in a non-interactive shell.');
+    }
+    const { value } = await prompts({
+        type: 'confirm',
+        name: 'value',
+        message,
+        initial: false,
+    });
+    if (!value)
+        throw new ApplianceApiError('Aborted.');
+}
+function printGeneratedPassword(password) {
+    if (!password)
+        return;
+    console.log();
+    console.log(`  ${chalk.bold('Generated password:')} ${chalk.cyan(password)}`);
+    console.log(chalk.gray('  Save this now. It cannot be retrieved later.'));
+}
+// ── Status and doctor ────────────────────────────────────────────────────
+async function sftpDaemonStatus(baseUrl) {
+    if (!isLocalBaseUrl(baseUrl)) {
+        return { ok: true, detail: 'remote (skipped)' };
+    }
+    try {
+        const output = await rpc('case Cdrcisco.CTSFTPD.status() do {:error, :down} -> IO.puts("down"); _ -> IO.puts("ok") end', 10_000);
+        const value = output.trim();
+        if (value === 'ok')
+            return { ok: true, detail: 'running' };
+        if (value === 'down')
+            return { ok: false, detail: 'not running' };
+        return { ok: false, detail: value || 'unknown' };
+    }
+    catch (err) {
+        return { ok: false, detail: `unavailable (${err.message})` };
+    }
+}
+function registerStatus(sftp) {
+    const status = addApiOptions(sftp
+        .command('status')
+        .description('Show SFTP accounts, storage, monitoring, and daemon status')
+        .option('--skip-daemon', 'Skip the local SFTP daemon RPC check'), true);
+    status.action(action(async (opts) => {
+        const { api, spec } = await connectWithSpec(opts);
+        const snapshot = await collectSftpStatus(api, spec);
+        const daemon = opts.skipDaemon
+            ? { ok: true, detail: 'skipped' }
+            : await sftpDaemonStatus(api.baseUrl);
+        if (opts.json) {
+            printJson({
+                api: api.describe(),
+                spec: { openapi: snapshot.operations.specOpenApi, sftp_operations: snapshot.operations.total },
+                daemon,
+                ...snapshot,
+            });
+            return;
+        }
+        out.header('SFTP Status');
+        out.ok(`API ${api.baseUrl} · org ${api.orgId}`);
+        out.ok(`OpenAPI ${snapshot.operations.specOpenApi ?? 'unknown'} · ${snapshot.operations.total} SFTP operations`);
+        if (daemon.detail.includes('skipped'))
+            out.info(`SFTP daemon check ${daemon.detail}`);
+        else if (daemon.ok)
+            out.ok(`SFTP daemon ${daemon.detail}`);
+        else
+            out.fail(`SFTP daemon ${daemon.detail}`);
+        out.info(`Accounts ${snapshot.accounts.total} total · ${snapshot.accounts.enabled} enabled · ` +
+            `${snapshot.accounts.disabled} disabled`);
+        if (snapshot.monitoring.available) {
+            const missing = snapshot.monitoring.missingUploads === null
+                ? ''
+                : ` · ${snapshot.monitoring.missingUploads} missing upload`;
+            out.info(`Monitoring ${snapshot.monitoring.monitoredCount} enabled${missing}`);
+        }
+        else {
+            out.warn('Monitoring is not available on this appliance release');
+        }
+        if (snapshot.storage) {
+            out.info(`Storage ${formatBytes(snapshot.storage.total_used_bytes)} used · ` +
+                `${formatGb(snapshot.storage.total_limit_gb)} limit · ` +
+                `${snapshot.storage.accounts_over_quota ?? 0} account(s) over quota`);
+        }
+        else {
+            out.warn('Storage status is not available on this appliance release');
+        }
+        console.log();
+    }));
+}
+function registerDoctor(sftp) {
+    const doctor = addApiOptions(sftp
+        .command('doctor')
+        .description('Run SFTP connectivity and API compatibility checks'), true);
+    doctor.action(action(async (opts) => {
+        const checks = [];
+        let api;
+        let spec;
+        try {
+            api = await connect(opts);
+            spec = await api.fetchSpec();
+            checks.push({
+                name: 'OpenAPI spec',
+                ok: true,
+                detail: `${spec.openapi ?? 'unknown'} · ${listOperations(spec, { contains: 'sftp' }).length} SFTP operations`,
+            });
+        }
+        catch (err) {
+            checks.push({
+                name: 'OpenAPI spec',
+                ok: false,
+                detail: err.message,
+            });
+        }
+        if (api) {
+            try {
+                const accounts = await listAccounts(api);
+                checks.push({
+                    name: 'API authentication',
+                    ok: true,
+                    detail: `${accounts.length} account(s) readable`,
+                });
+            }
+            catch (err) {
+                checks.push({
+                    name: 'API authentication',
+                    ok: false,
+                    detail: err.message,
+                });
+            }
+            if (spec && !supportsOperation(spec, 'GET sftp_storage/status')) {
+                checks.push({
+                    name: 'Storage endpoint',
+                    ok: true,
+                    detail: 'not available on this release (skipped)',
+                });
+            }
+            else {
+                try {
+                    await api.get('sftp_storage/status');
+                    checks.push({ name: 'Storage endpoint', ok: true, detail: 'reachable' });
+                }
+                catch (err) {
+                    checks.push({ name: 'Storage endpoint', ok: false, detail: err.message });
+                }
+            }
+        }
+        const daemon = await sftpDaemonStatus(api?.baseUrl ?? opts.url ?? DEFAULT_API_URL);
+        checks.push({ name: 'SFTP daemon', ok: daemon.ok, detail: daemon.detail });
+        const host = (() => {
+            try {
+                return new URL(api?.baseUrl ?? DEFAULT_API_URL).hostname;
+            }
+            catch {
+                return '127.0.0.1';
+            }
+        })();
+        const port = await checkTcpPort(host, 22, 3000);
+        checks.push({
+            name: `SFTP port 22 (${host})`,
+            ok: port.open,
+            detail: port.open ? `open in ${port.durationMs}ms` : port.error ?? 'closed',
+        });
+        if (opts.json) {
+            printJson({ api: api?.describe(), checks });
+        }
+        else {
+            out.header('SFTP Doctor');
+            for (const check of checks) {
+                const [summary, ...rest] = check.detail.split('\n');
+                if (check.ok) {
+                    out.ok(`${check.name}: ${summary}`);
+                }
+                else {
+                    out.fail(`${check.name}: ${summary}`);
+                    for (const line of rest) {
+                        if (line.trim())
+                            console.log(chalk.gray(`      ${line.trim()}`));
+                    }
+                }
+            }
+            console.log();
+        }
+        if (checks.some(check => !check.ok))
+            process.exitCode = 1;
+    }));
+}
+// ── Accounts ─────────────────────────────────────────────────────────────
+function registerAccounts(sftp) {
+    const accounts = sftp
+        .command('accounts')
+        .alias('account')
+        .description('Manage SFTP Action Accounts');
+    accounts.action(() => accounts.outputHelp());
+    addApiOptions(accounts
+        .command('list')
+        .description('List SFTP accounts')
+        .option('--enabled', 'Only enabled accounts')
+        .option('--disabled', 'Only disabled accounts')
+        .option('--search <text>', 'Filter by username or description'), true).action(action(async (opts) => {
+        const { api, spec } = await connectWithSpec(opts);
+        requireOperation(spec, 'GET sftp_action_accounts');
+        let list = await listAccounts(api);
+        if (opts.enabled)
+            list = list.filter(account => account.enabled);
+        if (opts.disabled)
+            list = list.filter(account => !account.enabled);
+        if (opts.search) {
+            const needle = opts.search.toLowerCase();
+            list = list.filter(account => account.username.toLowerCase().includes(needle) ||
+                (account.description ?? '').toLowerCase().includes(needle));
+        }
+        if (opts.json) {
+            printJson(list);
+            return;
+        }
+        if (list.length === 0) {
+            out.info('No SFTP accounts found.');
+            return;
+        }
+        console.log(renderTable(['USERNAME', 'STATUS', 'QUOTA', 'MONITOR', 'HOME', 'DESCRIPTION'], list.map(account => [
+            account.username,
+            account.enabled ? 'enabled' : 'disabled',
+            formatQuota(account.quota_used_bytes, account.quota_limit_gb),
+            account.upload_monitoring_enabled ? 'on' : 'off',
+            account.home ?? '—',
+            account.description ?? '—',
+        ]), { maxWidth: [28, 8, 22, 7, 30, 40] }));
+        console.log();
+        out.info(`${list.length} account(s)`);
+    }));
+    addApiOptions(accounts
+        .command('show')
+        .description('Show a single SFTP account')
+        .argument('<id|username>', 'Account ID or username')
+        .option('--actions', 'Include full action configuration'), true).action(action(async (ref, opts) => {
+        const { api, spec } = await connectWithSpec(opts);
+        requireOperation(spec, 'GET sftp_action_accounts/{id}');
+        const account = await resolveAccount(api, ref);
+        if (opts.json) {
+            printJson(account);
+            return;
+        }
+        out.header(`SFTP Account ${account.username}`);
+        printKeyValues([
+            ['ID', String(account.id)],
+            ['Status', account.enabled ? 'enabled' : 'disabled'],
+            ['Home', account.home ?? '—'],
+            ['Description', account.description ?? '—'],
+            ['Quota', formatQuota(account.quota_used_bytes, account.quota_limit_gb)],
+            [
+                'Monitoring',
+                account.upload_monitoring_enabled
+                    ? `${account.expected_schedule ?? 'enabled'}${account.expected_next_upload_at ? ` · next ${formatDateTime(account.expected_next_upload_at)}` : ''}`
+                    : 'disabled',
+            ],
+            ['Last upload', formatDateTime(account.last_upload_at)],
+            ['On success', actionSummary(account.on_success_actions)],
+            ['On failure', actionSummary(account.on_failure_actions)],
+            ['Created', formatDateTime(account.inserted_at)],
+            ['Updated', formatDateTime(account.updated_at)],
+        ]);
+        if (opts.actions) {
+            console.log();
+            console.log(chalk.bold('On success actions:'));
+            console.log(JSON.stringify(account.on_success_actions ?? [], null, 2));
+            console.log(chalk.bold('On failure actions:'));
+            console.log(JSON.stringify(account.on_failure_actions ?? [], null, 2));
+        }
+        console.log();
+    }));
+    addApiOptions(accounts
+        .command('create')
+        .description('Create an SFTP account')
+        .requiredOption('--username <username>', 'SFTP username')
+        .option('--password <password>', 'Password (prefer --password-stdin)')
+        .option('--password-stdin', 'Read the password from stdin')
+        .option('--generate', 'Generate a random password')
+        .option('--description <text>', 'Description')
+        .option('--quota-gb <gb>', 'Per-account quota in GB, or "none" for the org default')
+        .option('--callmanager-id <id>', 'Link the account to a CallManager for DRF discovery')
+        .option('--disabled', 'Create the account disabled')
+        .option('--on-success <action>', 'Success action: type, JSON, or @file (repeatable)', collect, [])
+        .option('--on-failure <action>', 'Failure action: type, JSON, or @file (repeatable)', collect, [])
+        .option('--dry-run', 'Print the request without sending it'), true).action(action(async (opts) => {
+        const { api, spec } = await connectWithSpec(opts);
+        requireOperation(spec, 'POST sftp_action_accounts');
+        const password = await resolveNewPassword({
+            password: opts.password,
+            passwordStdin: opts.passwordStdin,
+            generate: opts.generate,
+        });
+        const { account, generatedPassword } = buildCreateAccountPayload({
+            username: opts.username,
+            password,
+            generatePassword: !password,
+            description: opts.description,
+            enabled: opts.disabled ? false : undefined,
+            quotaGb: opts.quotaGb,
+            callmanagerId: opts.callmanagerId,
+            onSuccess: opts.onSuccess,
+            onFailure: opts.onFailure,
+        });
+        if (opts.dryRun) {
+            console.log(`${chalk.bold('POST')} ${api.apiPath('sftp_action_accounts')}`);
+            printJson({ account: redactAccount(account) });
+            return;
+        }
+        const response = await api.post('sftp_action_accounts', { account });
+        const created = (response.data.account ?? response.data);
+        if (opts.json) {
+            printJson({ account: created, generated_password: generatedPassword });
+            return;
+        }
+        out.successBox(`Created SFTP account ${created.username ?? opts.username}`);
+        printKeyValues([
+            ['ID', String(created.id ?? '—')],
+            ['Home', String(created.home ?? '—')],
+            ['Status', created.enabled === false ? 'disabled' : 'enabled'],
+        ]);
+        printGeneratedPassword(generatedPassword);
+        console.log();
+    }));
+    addApiOptions(accounts
+        .command('update')
+        .description('Update an SFTP account (including password and actions)')
+        .argument('<id|username>', 'Account ID or username')
+        .option('--description <text>', 'Description')
+        .option('--quota-gb <gb>', 'Per-account quota in GB, or "none" for the org default')
+        .option('--callmanager-id <id>', 'Link the account to a CallManager for DRF discovery')
+        .option('--enable', 'Enable the account')
+        .option('--disable', 'Disable the account')
+        .option('--password <password>', 'New password (prefer --password-stdin)')
+        .option('--password-stdin', 'Read the new password from stdin')
+        .option('--generate', 'Generate a new random password')
+        .option('--on-success <action>', 'Success action: type, JSON, or @file (repeatable)', collect, [])
+        .option('--on-failure <action>', 'Failure action: type, JSON, or @file (repeatable)', collect, [])
+        .option('--clear-success-actions', 'Remove all success actions')
+        .option('--clear-failure-actions', 'Remove all failure actions')
+        .option('--dry-run', 'Print the request without sending it'), true).action(action(async (ref, opts) => {
+        const { api, spec } = await connectWithSpec(opts);
+        requireOperation(spec, 'PUT sftp_action_accounts/{id}');
+        const account = await resolveAccount(api, ref);
+        let password = opts.password;
+        if (!password && opts.passwordStdin)
+            password = readPasswordFromStdin();
+        const { account: payload, generatedPassword } = buildUpdateAccountPayload({
+            description: opts.description,
+            quotaGb: opts.quotaGb,
+            callmanagerId: opts.callmanagerId,
+            enable: opts.enable,
+            disable: opts.disable,
+            password,
+            generatePassword: opts.generate,
+            onSuccess: opts.onSuccess,
+            onFailure: opts.onFailure,
+            clearSuccess: opts.clearSuccessActions,
+            clearFailure: opts.clearFailureActions,
+        });
+        if (opts.dryRun) {
+            console.log(`${chalk.bold('PUT')} ${api.apiPath(`sftp_action_accounts/${account.id}`)}`);
+            printJson({ account: redactAccount(payload) });
+            return;
+        }
+        const response = await api.put(`sftp_action_accounts/${account.id}`, { account: payload });
+        const updated = (response.data.account ?? response.data);
+        if (opts.json) {
+            printJson({ account: updated, generated_password: generatedPassword });
+            return;
+        }
+        out.successBox(`Updated SFTP account ${updated.username ?? account.username}`);
+        printKeyValues([
+            ['Fields', Object.keys(payload).join(', ')],
+            ['Status', updated.enabled === false ? 'disabled' : 'enabled'],
+        ]);
+        printGeneratedPassword(generatedPassword);
+        console.log();
+    }));
+    addApiOptions(accounts
+        .command('delete')
+        .alias('rm')
+        .description('Delete an SFTP account')
+        .argument('<id|username>', 'Account ID or username')
+        .option('--yes', 'Skip the confirmation prompt'), true).action(action(async (ref, opts) => {
+        const { api, spec } = await connectWithSpec(opts);
+        requireOperation(spec, 'DELETE sftp_action_accounts/{id}');
+        const account = await resolveAccount(api, ref);
+        await confirmDestructive(`Delete SFTP account ${accountLabel(account)}?`, opts.yes);
+        await api.delete(`sftp_action_accounts/${account.id}`);
+        if (opts.json)
+            printJson({ deleted: true, id: account.id, username: account.username });
+        else
+            out.successBox(`Deleted SFTP account ${account.username}`);
+    }));
+    for (const [name, enabled] of [
+        ['enable', true],
+        ['disable', false],
+    ]) {
+        addApiOptions(accounts
+            .command(name)
+            .description(`${enabled ? 'Enable' : 'Disable'} an SFTP account`)
+            .argument('<id|username>', 'Account ID or username'), true).action(action(async (ref, opts) => {
+            const { api, spec } = await connectWithSpec(opts);
+            requireOperation(spec, 'PUT sftp_action_accounts/{id}');
+            const account = await resolveAccount(api, ref);
+            const response = await api.put(`sftp_action_accounts/${account.id}`, {
+                account: { enabled },
+            });
+            const updated = (response.data.account ?? response.data);
+            if (opts.json)
+                printJson(updated);
+            else
+                out.ok(`${account.username} ${enabled ? 'enabled' : 'disabled'}`);
+        }));
+    }
+    addApiOptions(accounts
+        .command('password')
+        .description('Set or generate an SFTP account password')
+        .argument('<id|username>', 'Account ID or username')
+        .option('--password <password>', 'New password (prefer --password-stdin)')
+        .option('--password-stdin', 'Read the new password from stdin')
+        .option('--generate', 'Generate a random password'), true).action(action(async (ref, opts) => {
+        const { api, spec } = await connectWithSpec(opts);
+        requireOperation(spec, 'PUT sftp_action_accounts/{id}');
+        const account = await resolveAccount(api, ref);
+        let password = opts.password;
+        if (!password && opts.passwordStdin)
+            password = readPasswordFromStdin();
+        if (!password && !opts.generate)
+            password = await promptHidden('New SFTP password');
+        let generatedPassword;
+        if (!password) {
+            generatedPassword = buildCreateAccountPayload({
+                username: account.username,
+                onSuccess: [],
+                onFailure: [],
+            }).account.password;
+            password = generatedPassword;
+        }
+        await api.put(`sftp_action_accounts/${account.id}`, { account: { password } });
+        if (opts.json) {
+            printJson({ id: account.id, username: account.username, generated_password: generatedPassword });
+            return;
+        }
+        out.ok(`Password updated for ${account.username}`);
+        printGeneratedPassword(generatedPassword);
+    }));
+    addApiOptions(accounts
+        .command('quota')
+        .description('Show (and optionally refresh) an account storage quota')
+        .argument('<id|username>', 'Account ID or username')
+        .option('--refresh', 'Recalculate the quota before showing it'), true).action(action(async (ref, opts) => {
+        const { api, spec } = await connectWithSpec(opts);
+        requireOperation(spec, 'GET sftp_action_accounts/{id}/quota');
+        const account = await resolveAccount(api, ref);
+        if (opts.refresh) {
+            requireOperation(spec, 'POST sftp_action_accounts/{id}/refresh_quota');
+            await api.post(`sftp_action_accounts/${account.id}/refresh_quota`, {});
+        }
+        const quota = await getAccountQuota(api, account);
+        if (opts.json) {
+            printJson({ account: account.username, ...quota });
+            return;
+        }
+        out.header(`Quota · ${account.username}`);
+        printKeyValues([
+            ['Used', formatBytes(quota.quota_used_bytes)],
+            ['Limit', formatGb(quota.quota_limit_gb)],
+            ['Usage', formatPercent(quota.quota_percentage)],
+            ['Over quota', quota.over_quota ? 'yes' : 'no'],
+            ['Calculated', formatDateTime(quota.last_calculated_at)],
+        ]);
+        console.log();
+    }));
+    addApiOptions(accounts
+        .command('files')
+        .description('List files in an account home directory')
+        .argument('<id|username>', 'Account ID or username')
+        .option('--path <path>', 'Directory path')
+        .option('--limit <n>', 'Maximum entries', '200'), true).action(action(async (ref, opts) => {
+        const { api, spec } = await connectWithSpec(opts);
+        requireOperation(spec, 'GET sftp_action_accounts/{account_id}/files');
+        const account = await resolveAccount(api, ref);
+        const result = await getAccountFiles(api, account, opts.path, parseIntegerOption(opts.limit, '--limit', { min: 1, max: 2000, fallback: 200 }));
+        if (opts.json) {
+            printJson({ account: account.username, ...result });
+            return;
+        }
+        if (result.entries.length === 0) {
+            out.info(`No files in ${result.path ?? account.home ?? `account ${account.username}`}`);
+            return;
+        }
+        console.log(renderTable(['TYPE', 'SIZE', 'MODIFIED', 'NAME'], result.entries.map(entry => [
+            entry.type === 'directory' ? 'dir' : 'file',
+            entry.type === 'directory' ? '—' : formatBytes(entry.size),
+            formatDateTime(entry.modified_at),
+            entry.name,
+        ]), { maxWidth: [5, 12, 20, 80] }));
+        console.log();
+        out.info(`${result.total ?? result.entries.length} entr${(result.total ?? result.entries.length) === 1 ? 'y' : 'ies'}`);
+    }));
+    addApiOptions(accounts
+        .command('download')
+        .description('Download a file from an account home directory')
+        .argument('<id|username>', 'Account ID or username')
+        .argument('<remote-path>', 'Path relative to the account home')
+        .option('--output <path>', 'Local destination path'), true).action(action(async (ref, remotePath, opts) => {
+        const { api, spec } = await connectWithSpec(opts);
+        requireOperation(spec, 'GET sftp_action_accounts/{account_id}/files/download');
+        const account = await resolveAccount(api, ref);
+        const outputPath = opts.output ?? basename(remotePath);
+        await api.get(`sftp_action_accounts/${account.id}/files/download`, {
+            query: { path: remotePath },
+            accept: 'application/octet-stream',
+            outputPath,
+            parse: 'none',
+        });
+        const size = statSync(outputPath).size;
+        if (opts.json)
+            printJson({ account: account.username, remote_path: remotePath, output: outputPath, size });
+        else
+            out.ok(`Downloaded ${remotePath} → ${outputPath} (${formatBytes(size)})`);
+    }));
+    addApiOptions(accounts
+        .command('runs')
+        .description('List action runs for an account')
+        .argument('<id|username>', 'Account ID or username')
+        .option('--limit <n>', 'Maximum runs', '50')
+        .option('--offset <n>', 'Offset', '0'), true).action(action(async (ref, opts) => {
+        const { api, spec } = await connectWithSpec(opts);
+        requireOperation(spec, 'GET sftp_action_accounts/{id}/runs');
+        const account = await resolveAccount(api, ref);
+        const runs = await getAccountRuns(api, account, parseIntegerOption(opts.limit, '--limit', { min: 1, max: 1000, fallback: 50 }), parseIntegerOption(opts.offset, '--offset', { min: 0, fallback: 0 }));
+        if (opts.json) {
+            printJson(runs);
+            return;
+        }
+        if (runs.length === 0) {
+            out.info(`No runs for ${account.username}.`);
+            return;
+        }
+        console.log(renderTable(['ID', 'STATUS', 'TYPE', 'EVENT', 'FILE', 'WHEN'], runs.map(run => [
+            String(run.id),
+            run.status ?? '—',
+            run.type ?? '—',
+            run.event ?? '—',
+            run.file ?? '—',
+            formatDateTime(run.inserted_at),
+        ]), { maxWidth: [8, 10, 22, 24, 50, 20] }));
+        console.log();
+    }));
+    addApiOptions(accounts
+        .command('activity')
+        .description('List audit activity for an account')
+        .argument('<id|username>', 'Account ID or username')
+        .option('--limit <n>', 'Maximum entries', '100')
+        .option('--offset <n>', 'Offset', '0'), true).action(action(async (ref, opts) => {
+        const { api, spec } = await connectWithSpec(opts);
+        requireOperation(spec, 'GET sftp_action_accounts/{id}/activity');
+        const account = await resolveAccount(api, ref);
+        const activity = await getAccountActivity(api, account, parseIntegerOption(opts.limit, '--limit', { min: 1, max: 1000, fallback: 100 }), parseIntegerOption(opts.offset, '--offset', { min: 0, fallback: 0 }));
+        if (opts.json) {
+            printJson(activity);
+            return;
+        }
+        printActivityTable(activity);
+    }));
+    addApiOptions(accounts
+        .command('catalog')
+        .description('Show action types supported by the appliance'), true).action(action(async (opts) => {
+        const { api, spec } = await connectWithSpec(opts);
+        requireOperation(spec, 'GET sftp_action_accounts/catalog');
+        const response = await api.get('sftp_action_accounts/catalog');
+        const catalog = (response.data.catalog ?? response.data);
+        if (opts.json) {
+            printJson(catalog);
+            return;
+        }
+        const types = catalog.types ?? [];
+        if (types.length === 0) {
+            out.warn('The appliance returned an empty action catalog.');
+            return;
+        }
+        console.log(renderTable(['TYPE', 'REQUIRED PARAMS', 'OPTIONAL PARAMS'], types.map(type => [
+            type.type ?? '—',
+            (type.required_params ?? []).join(', ') || '—',
+            (type.optional_params ?? []).join(', ') || '—',
+        ]), { maxWidth: [24, 40, 60] }));
+        console.log();
+    }));
+    const contacts = accounts
+        .command('contacts')
+        .description('Manage notification contacts on an SFTP account');
+    contacts.action(() => contacts.outputHelp());
+    addApiOptions(contacts
+        .command('list')
+        .description('List notification contacts')
+        .argument('<id|username>', 'Account ID or username'), true).action(action(async (ref, opts) => {
+        const { api, spec } = await connectWithSpec(opts);
+        requireOperation(spec, 'GET sftp_action_accounts/{id}/contacts');
+        const account = await resolveAccount(api, ref);
+        const list = await getAccountContacts(api, account);
+        if (opts.json) {
+            printJson(list);
+            return;
+        }
+        if (list.length === 0) {
+            out.info('No notification contacts.');
+            return;
+        }
+        console.log(renderTable(['ID', 'TYPE', 'CONTACT', 'DESCRIPTION'], list.map(contact => [
+            String(contact.id),
+            String(contact.type ?? contact.contact_type ?? '—'),
+            String(contact.contact_uri ?? contact.email ?? '—'),
+            String(contact.description ?? '—'),
+        ]), { maxWidth: [8, 16, 50, 40] }));
+        console.log();
+    }));
+    addApiOptions(contacts
+        .command('add')
+        .description('Add notification contacts')
+        .argument('<id|username>', 'Account ID or username')
+        .option('--contact <id>', 'Contact ID (repeatable, comma-separated)', collect, []), true).action(action(async (ref, opts) => {
+        const { api, spec } = await connectWithSpec(opts);
+        requireOperation(spec, 'POST sftp_action_accounts/{id}/contacts');
+        const account = await resolveAccount(api, ref);
+        const ids = parseContactIds(opts.contact);
+        await addAccountContacts(api, account, ids);
+        if (opts.json)
+            printJson({ account: account.username, added: ids });
+        else
+            out.ok(`Added ${ids.length} contact(s) to ${account.username}`);
+    }));
+    addApiOptions(contacts
+        .command('remove')
+        .description('Remove a notification contact')
+        .argument('<id|username>', 'Account ID or username')
+        .argument('<contact-id>', 'Contact ID'), true).action(action(async (ref, contactId, opts) => {
+        const { api, spec } = await connectWithSpec(opts);
+        requireOperation(spec, 'DELETE sftp_action_accounts/{id}/contacts/{contact_id}');
+        const account = await resolveAccount(api, ref);
+        const id = parseContactIds([contactId])[0];
+        await removeAccountContact(api, account, id);
+        if (opts.json)
+            printJson({ account: account.username, removed: id });
+        else
+            out.ok(`Removed contact ${id} from ${account.username}`);
+    }));
+    addApiOptions(accounts
+        .command('export')
+        .description('Export accounts to CSV')
+        .option('--output <path>', 'Destination file, or - for stdout')
+        .option('--include-actions', 'Include action configuration in the CSV')).action(action(async (opts) => {
+        const { api, spec } = await connectWithSpec(opts);
+        requireOperation(spec, 'GET sftp_action_accounts/export');
+        const output = opts.output ?? `sftp-accounts-${new Date().toISOString().slice(0, 10)}.csv`;
+        if (output === '-') {
+            const response = await api.get('sftp_action_accounts/export', {
+                query: { include_actions: opts.includeActions ? 'true' : undefined },
+                accept: 'text/csv',
+                parse: 'text',
+            });
+            process.stdout.write(response.data);
+            if (!response.data.endsWith('\n'))
+                process.stdout.write('\n');
+            return;
+        }
+        await api.get('sftp_action_accounts/export', {
+            query: { include_actions: opts.includeActions ? 'true' : undefined },
+            accept: 'text/csv',
+            outputPath: output,
+            parse: 'none',
+        });
+        out.ok(`Exported accounts to ${output}`);
+    }));
+    addApiOptions(accounts
+        .command('template')
+        .description('Download the CSV import template')
+        .option('--output <path>', 'Destination file, or - for stdout')).action(action(async (opts) => {
+        const { api, spec } = await connectWithSpec(opts);
+        requireOperation(spec, 'GET sftp_action_accounts/template');
+        const output = opts.output ?? 'sftp-accounts-template.csv';
+        if (output === '-') {
+            const response = await api.get('sftp_action_accounts/template', {
+                accept: 'text/csv',
+                parse: 'text',
+            });
+            process.stdout.write(response.data);
+            if (!response.data.endsWith('\n'))
+                process.stdout.write('\n');
+            return;
+        }
+        await api.get('sftp_action_accounts/template', {
+            accept: 'text/csv',
+            outputPath: output,
+            parse: 'none',
+        });
+        out.ok(`Wrote CSV template to ${output}`);
+    }));
+    addApiOptions(accounts
+        .command('import')
+        .description('Import accounts from a CSV file')
+        .argument('<file>', 'CSV file')
+        .option('--validate-only', 'Validate the CSV without importing')
+        .option('--skip-existing', 'Skip usernames that already exist')
+        .option('--on-success <action>', 'Default success action for imported accounts (repeatable)', collect, [])
+        .option('--on-failure <action>', 'Default failure action for imported accounts (repeatable)', collect, [])
+        .option('--dry-run', 'Print the request without sending it'), true).action(action(async (file, opts) => {
+        const { api, spec } = await connectWithSpec(opts);
+        const operation = opts.validateOnly
+            ? requireOperation(spec, 'POST sftp_action_accounts/import/validate')
+            : requireOperation(spec, 'POST sftp_action_accounts/import');
+        const upload = readImportFile(file);
+        const files = [{ ...upload, field: 'file' }];
+        if (opts.dryRun) {
+            console.log(`${chalk.bold('POST')} ${api.apiPath(operation.shortPath)}`);
+            printJson({
+                file: upload.filename,
+                bytes: upload.data.length,
+                skip_existing: opts.skipExisting ? 'true' : undefined,
+                on_success_actions: opts.onSuccess.length > 0 ? 'json' : undefined,
+                on_failure_actions: opts.onFailure.length > 0 ? 'json' : undefined,
+            });
+            return;
+        }
+        const fields = {};
+        if (!opts.validateOnly) {
+            fields.skip_existing = opts.skipExisting ? 'true' : undefined;
+            if (opts.onSuccess.length > 0) {
+                fields.on_success_actions = JSON.stringify(buildCreateAccountPayload({
+                    username: 'import',
+                    password: 'placeholder',
+                    onSuccess: opts.onSuccess,
+                    onFailure: [],
+                }).account.on_success_actions ?? []);
+            }
+            if (opts.onFailure.length > 0) {
+                fields.on_failure_actions = JSON.stringify(buildCreateAccountPayload({
+                    username: 'import',
+                    password: 'placeholder',
+                    onSuccess: [],
+                    onFailure: opts.onFailure,
+                }).account.on_failure_actions ?? []);
+            }
+        }
+        const response = await api.request('POST', operation.shortPath, {
+            form: { fields, files },
+        });
+        if (opts.json) {
+            printJson(response.data);
+            return;
+        }
+        if (opts.validateOnly) {
+            const analysis = (response.data.analysis ?? response.data);
+            if (analysis.valid === false) {
+                out.fail('CSV validation failed');
+                for (const error of analysis.errors ?? [])
+                    console.log(`    ${error}`);
+                process.exitCode = 1;
+                return;
+            }
+            out.ok(`CSV valid · ${analysis.row_count ?? '?'} row(s)`);
+            for (const warning of analysis.warnings ?? [])
+                out.warn(warning);
+            return;
+        }
+        const imported = (response.data.accounts ?? []);
+        out.ok(`Imported ${imported.length} account(s)`);
+        if (imported.length > 0) {
+            console.log(renderTable(['ID', 'USERNAME', 'STATUS', 'HOME'], imported.map(account => [
+                String(account.id),
+                account.username,
+                account.enabled ? 'enabled' : 'disabled',
+                account.home ?? '—',
+            ])));
+        }
+    }));
+}
+// ── Monitoring ───────────────────────────────────────────────────────────
+function registerMonitoring(sftp) {
+    const monitoring = sftp
+        .command('monitoring')
+        .alias('monitor')
+        .description('Upload monitoring and missed-upload alerts');
+    monitoring.action(() => monitoring.outputHelp());
+    addApiOptions(monitoring.command('list').description('List monitored SFTP accounts'), true).action(action(async (opts) => {
+        const { api, spec } = await connectWithSpec(opts);
+        requireOperation(spec, 'GET sftp_monitoring');
+        const list = await listMonitoredAccounts(api);
+        if (opts.json) {
+            printJson(list);
+            return;
+        }
+        printMonitoringTable(list);
+    }));
+    addApiOptions(monitoring.command('missing').description('List accounts with missing uploads'), true).action(action(async (opts) => {
+        const { api, spec } = await connectWithSpec(opts);
+        requireOperation(spec, 'GET sftp_monitoring/missing');
+        const response = await api.get('sftp_monitoring/missing');
+        const list = (response.data.data ?? response.data.accounts ?? []);
+        if (opts.json) {
+            printJson(response.data);
+            return;
+        }
+        if (!Array.isArray(list) || list.length === 0) {
+            out.ok('No missing uploads.');
+            return;
+        }
+        printMonitoringTable(list);
+    }));
+    addApiOptions(monitoring
+        .command('check')
+        .description('Trigger an immediate missed-upload check'), true).action(action(async (opts) => {
+        const { api, spec } = await connectWithSpec(opts);
+        requireOperation(spec, 'POST sftp_monitoring/check');
+        const response = await api.post('sftp_monitoring/check', {});
+        if (opts.json)
+            printJson(response.data);
+        else
+            out.ok(String(response.data.message ?? 'Monitoring check completed'));
+    }));
+    addApiOptions(monitoring
+        .command('show')
+        .description('Show monitoring configuration for an account')
+        .argument('<id|username>', 'Account ID or username'), true).action(action(async (ref, opts) => {
+        const { api, spec } = await connectWithSpec(opts);
+        requireOperation(spec, 'GET sftp_action_accounts/{account_id}/monitoring');
+        const account = await resolveAccount(api, ref);
+        const config = await getAccountMonitoring(api, account);
+        if (opts.json) {
+            printJson(config);
+            return;
+        }
+        out.header(`Monitoring · ${account.username}`);
+        printKeyValues([
+            ['Enabled', config.enabled ? 'yes' : 'no'],
+            ['Schedule', monitoringSchedule(config)],
+            ['Next upload', formatDateTime(config.expected_next_upload_at)],
+            ['Last upload', formatDateTime(config.last_upload_at)],
+            ['Missed uploads', String(config.missed_upload_count ?? 0)],
+            ['Alerts', config.config?.alert_on_missed_uploads ? 'on' : 'off'],
+            ['Tolerance', `${config.config?.tolerance_minutes ?? '—'} min`],
+            ['Threshold', String(config.config?.alert_threshold ?? '—')],
+        ]);
+        console.log();
+    }));
+    const addMonitoringOptions = (command) => command
+        .option('--schedule <type>', 'Schedule: hourly, daily, weekly, monthly')
+        .option('--hour <n>', 'Expected hour (0-23)')
+        .option('--minute <n>', 'Expected minute (0-59)')
+        .option('--day-of-week <n>', 'Expected day of week (1=Mon … 7=Sun)')
+        .option('--day-of-month <n>', 'Expected day of month (1-28)')
+        .option('--weekdays-only', 'Only expect uploads on weekdays')
+        .option('--tolerance <minutes>', 'Minutes of tolerance')
+        .option('--threshold <n>', 'Missed-upload alert threshold')
+        .option('--alert-config <json>', 'Alert config JSON object or @file')
+        .option('--no-alert-on-missed', 'Disable missed-upload alerts');
+    addApiOptions(addMonitoringOptions(monitoring
+        .command('enable')
+        .description('Enable upload monitoring for an account')
+        .argument('<id|username>', 'Account ID or username')), true).action(action(async (ref, opts) => {
+        const { api, spec } = await connectWithSpec(opts);
+        requireOperation(spec, 'POST sftp_action_accounts/{account_id}/monitoring/enable');
+        const account = await resolveAccount(api, ref);
+        const payload = buildMonitoringPayload(opts, true);
+        const response = await api.post(`sftp_action_accounts/${account.id}/monitoring/enable`, payload);
+        if (opts.json)
+            printJson(response.data);
+        else
+            out.ok(`Enabled upload monitoring for ${account.username}`);
+    }));
+    addApiOptions(monitoring
+        .command('disable')
+        .description('Disable upload monitoring for an account')
+        .argument('<id|username>', 'Account ID or username'), true).action(action(async (ref, opts) => {
+        const { api, spec } = await connectWithSpec(opts);
+        requireOperation(spec, 'POST sftp_action_accounts/{account_id}/monitoring/disable');
+        const account = await resolveAccount(api, ref);
+        const response = await api.post(`sftp_action_accounts/${account.id}/monitoring/disable`, {});
+        if (opts.json)
+            printJson(response.data);
+        else
+            out.ok(`Disabled upload monitoring for ${account.username}`);
+    }));
+    addApiOptions(addMonitoringOptions(monitoring
+        .command('config')
+        .description('Update monitoring configuration for an account')
+        .argument('<id|username>', 'Account ID or username')), true).action(action(async (ref, opts) => {
+        const { api, spec } = await connectWithSpec(opts);
+        requireOperation(spec, 'PUT sftp_action_accounts/{account_id}/monitoring/config');
+        const account = await resolveAccount(api, ref);
+        const payload = buildMonitoringPayload(opts, false);
+        if (Object.keys(payload).length === 0) {
+            throw new ApplianceApiError('Nothing to update. Pass a schedule or alert option.');
+        }
+        const response = await api.put(`sftp_action_accounts/${account.id}/monitoring/config`, payload);
+        if (opts.json)
+            printJson(response.data);
+        else
+            out.ok(`Updated monitoring configuration for ${account.username}`);
+    }));
+    addApiOptions(monitoring
+        .command('discover')
+        .description('Discover CUCM DRF backup schedules and apply them to an account')
+        .argument('<id|username>', 'Account ID or username')
+        .option('--host <host>', 'CUCM host')
+        .option('--username <username>', 'CUCM username')
+        .option('--password <password>', 'CUCM password (prefer --password-stdin)')
+        .option('--password-stdin', 'Read the CUCM password from stdin')
+        .option('--schedule-name <name>', 'Schedule name filter')
+        .option('--callmanager-id <id>', 'Existing CallManager ID')
+        .option('--tolerance <minutes>', 'Minutes of tolerance'), true).action(action(async (ref, opts) => {
+        const { api, spec } = await connectWithSpec(opts);
+        requireOperation(spec, 'POST sftp_action_accounts/{account_id}/monitoring/discover');
+        const account = await resolveAccount(api, ref);
+        let password = opts.password;
+        if (!password && opts.passwordStdin)
+            password = readPasswordFromStdin();
+        if (!password && opts.host && opts.username) {
+            password = await promptHidden('CUCM password');
+        }
+        const payload = buildDiscoverPayload({ ...opts, password });
+        const response = await api.post(`sftp_action_accounts/${account.id}/monitoring/discover`, payload);
+        if (opts.json)
+            printJson(response.data);
+        else
+            out.ok(`Discovered backup schedules for ${account.username}`);
+    }));
+    addApiOptions(monitoring
+        .command('schedules')
+        .description('Discover CUCM backup schedules without applying them')
+        .argument('<id|username>', 'Account ID or username'), true).action(action(async (ref, opts) => {
+        const { api, spec } = await connectWithSpec(opts);
+        requireOperation(spec, 'GET sftp_action_accounts/{account_id}/monitoring/schedules');
+        const account = await resolveAccount(api, ref);
+        const response = await api.get(`sftp_action_accounts/${account.id}/monitoring/schedules`);
+        if (opts.json) {
+            printJson(response.data);
+            return;
+        }
+        const schedules = (response.data.data ?? []);
+        if (schedules.length === 0) {
+            out.info('No CUCM backup schedules discovered.');
+            return;
+        }
+        console.log(renderTable(['SCHEDULE', 'FREQUENCY', 'TIME', 'DAY', 'DEVICE', 'PATH'], schedules.map(schedule => [
+            String(schedule.schedule_name ?? '—'),
+            String(schedule.frequency ?? '—'),
+            `${String(schedule.hour ?? '—')}:${String(schedule.minute ?? 0).padStart(2, '0')}`,
+            String(schedule.day_of_month ??
+                (Array.isArray(schedule.days_of_week) ? schedule.days_of_week.join(',') : '—')),
+            String(schedule.device_name ?? '—'),
+            String(schedule.device_path ?? '—'),
+        ]), { maxWidth: [28, 14, 8, 10, 28, 50] }));
+        console.log();
+    }));
+}
+function printMonitoringTable(list) {
+    if (list.length === 0) {
+        out.info('No monitored accounts.');
+        return;
+    }
+    console.log(renderTable(['USERNAME', 'STATUS', 'SCHEDULE', 'NEXT', 'LAST', 'MISSED'], list.map(account => [
+        account.username,
+        account.monitoring?.enabled ? 'enabled' : 'disabled',
+        monitoringSchedule(account.monitoring),
+        formatDateTime(account.monitoring?.expected_next_upload_at),
+        formatDateTime(account.monitoring?.last_upload_at),
+        String(account.monitoring?.missed_upload_count ?? 0),
+    ]), { maxWidth: [28, 9, 20, 20, 20, 8] }));
+    console.log();
+}
+function printActivityTable(activity) {
+    if (activity.length === 0) {
+        out.info('No activity found.');
+        return;
+    }
+    console.log(renderTable(['ID', 'WHEN', 'ACTION', 'STATUS', 'ACTOR', 'TARGET', 'ERROR'], activity.map(row => [
+        String(row.id),
+        formatDateTime(row.inserted_at),
+        row.action ?? '—',
+        row.status ?? '—',
+        row.actor_ip ?? '—',
+        row.target_type ? `${row.target_type}:${row.target_id ?? '?'}` : '—',
+        row.error_message ?? '—',
+    ]), { maxWidth: [8, 20, 24, 9, 18, 24, 40] }));
+    console.log();
+}
+// ── Org-wide activity and runs ───────────────────────────────────────────
+function registerActivity(sftp) {
+    addApiOptions(sftp
+        .command('activity')
+        .description('List org-wide SFTP audit activity')
+        .option('--username <username>', 'Filter by username')
+        .option('--limit <n>', 'Maximum entries', '100')
+        .option('--offset <n>', 'Offset', '0'), true).action(action(async (opts) => {
+        const { api, spec } = await connectWithSpec(opts);
+        requireOperation(spec, 'GET sftp_activity');
+        const response = await api.get('sftp_activity', {
+            query: {
+                username: opts.username,
+                limit: parseIntegerOption(opts.limit, '--limit', { min: 1, max: 1000, fallback: 100 }),
+                offset: parseIntegerOption(opts.offset, '--offset', { min: 0, fallback: 0 }),
+            },
+        });
+        if (opts.json) {
+            printJson(response.data);
+            return;
+        }
+        printActivityTable((response.data.activity ?? response.data.data ?? []));
+    }));
+    addApiOptions(sftp
+        .command('runs')
+        .description('List org-wide SFTP action runs')
+        .option('--username <username>', 'Filter by username')
+        .option('--status <status>', 'Filter by status')
+        .option('--type <type>', 'Filter by run type')
+        .option('--event <event>', 'Filter by event')
+        .option('--account-id <id>', 'Filter by action account ID')
+        .option('--start-date <date>', 'Filter by start date')
+        .option('--end-date <date>', 'Filter by end date')
+        .option('--limit <n>', 'Maximum runs', '50')
+        .option('--offset <n>', 'Offset', '0'), true).action(action(async (opts) => {
+        const { api, spec } = await connectWithSpec(opts);
+        requireOperation(spec, 'GET sftp_action_runs');
+        const response = await api.get('sftp_action_runs', {
+            query: {
+                username: opts.username,
+                status: opts.status,
+                type: opts.type,
+                event: opts.event,
+                action_account_id: parseIntegerOption(opts.accountId, '--account-id', { min: 1 }),
+                start_date: opts.startDate,
+                end_date: opts.endDate,
+                limit: parseIntegerOption(opts.limit, '--limit', { min: 1, max: 1000, fallback: 50 }),
+                offset: parseIntegerOption(opts.offset, '--offset', { min: 0, fallback: 0 }),
+            },
+        });
+        if (opts.json) {
+            printJson(response.data);
+            return;
+        }
+        const runs = (response.data.runs ?? response.data.data ?? []);
+        if (runs.length === 0) {
+            out.info('No runs found.');
+            return;
+        }
+        console.log(renderTable(['ID', 'ACCOUNT', 'STATUS', 'TYPE', 'EVENT', 'FILE', 'WHEN'], runs.map(run => [
+            String(run.id),
+            run.username ?? String(run.action_account_id ?? '—'),
+            run.status ?? '—',
+            run.type ?? '—',
+            run.event ?? '—',
+            run.file ?? '—',
+            formatDateTime(run.inserted_at),
+        ]), { maxWidth: [8, 20, 10, 22, 20, 40, 20] }));
+        console.log();
+    }));
+}
+// ── Storage ──────────────────────────────────────────────────────────────
+function registerStorage(sftp) {
+    const storage = sftp.command('storage').description('SFTP storage quota and purge operations');
+    storage.action(() => storage.outputHelp());
+    addApiOptions(storage.command('status').description('Show org-wide SFTP storage status'), true).action(action(async (opts) => {
+        const { api, spec } = await connectWithSpec(opts);
+        requireOperation(spec, 'GET sftp_storage/status');
+        const response = await api.get('sftp_storage/status');
+        const status = (response.data.storage ?? response.data);
+        if (opts.json) {
+            printJson(status);
+            return;
+        }
+        out.header('SFTP Storage');
+        printKeyValues([
+            ['Used', formatBytes(status.total_used_bytes)],
+            ['Limit', formatGb(status.total_limit_gb)],
+            ['Accounts', String(status.account_count ?? '—')],
+            ['Over quota', String(status.accounts_over_quota ?? 0)],
+        ]);
+        console.log();
+    }));
+    addApiOptions(storage.command('refresh').description('Recalculate quotas for all SFTP accounts'), true).action(action(async (opts) => {
+        const { api, spec } = await connectWithSpec(opts);
+        requireOperation(spec, 'POST sftp_storage/refresh_quotas');
+        const response = await api.post('sftp_storage/refresh_quotas', {});
+        if (opts.json)
+            printJson(response.data);
+        else
+            out.ok(String(response.data.message ?? 'Refreshed SFTP quotas'));
+    }));
+    addApiOptions(storage
+        .command('purge')
+        .description('Trigger storage purge for the organization')
+        .option('--retention-days <n>', 'Retention window in days')
+        .option('--yes', 'Skip the confirmation prompt'), true).action(action(async (opts) => {
+        const { api, spec } = await connectWithSpec(opts);
+        requireOperation(spec, 'POST sftp_storage/purge');
+        const days = parseIntegerOption(opts.retentionDays, '--retention-days', { min: 1, max: 3650 });
+        if (!opts.json) {
+            await confirmDestructive(`Purge SFTP storage${days ? ` with a ${days}-day retention window` : ''}?`, opts.yes);
+        }
+        const response = await api.post('sftp_storage/purge', {}, {
+            query: { retention_days: days },
+        });
+        if (opts.json)
+            printJson(response.data);
+        else
+            out.ok(String(response.data.message ?? 'SFTP storage purge started'));
+    }));
+}
+// ── Backup analytics ─────────────────────────────────────────────────────
+function registerAnalytics(sftp) {
+    const analytics = sftp
+        .command('analytics')
+        .alias('backups')
+        .description('CUCM backup analytics and trends');
+    analytics.action(() => analytics.outputHelp());
+    const analyticsOptions = (command) => command
+        .option('--days <n>', 'Lookback window in days')
+        .option('--start-time <iso>', 'Start time (ISO 8601)')
+        .option('--end-time <iso>', 'End time (ISO 8601)')
+        .option('--username <username>', 'Filter by account username')
+        .option('--cluster <name>', 'CUCM cluster')
+        .option('--granularity <unit>', 'Trend granularity')
+        .option('--limit <n>', 'Maximum entries')
+        .option('--offset <n>', 'Offset');
+    const bindQuery = (opts) => ({
+        days: parseIntegerOption(opts.days, '--days', { min: 1, max: 3650 }),
+        start_time: opts.startTime,
+        end_time: opts.endTime,
+        username: opts.username,
+        cluster: opts.cluster,
+        granularity: opts.granularity,
+        limit: parseIntegerOption(opts.limit, '--limit', { min: 1, max: 1000 }),
+        offset: parseIntegerOption(opts.offset, '--offset', { min: 0 }),
+    });
+    const addAnalyticsCommand = (name, path, description, requiresCluster = false) => {
+        addApiOptions(analyticsOptions(analytics.command(name).description(description)), true).action(action(async (opts) => {
+            const { api, spec } = await connectWithSpec(opts);
+            requireOperation(spec, `GET ${path}`);
+            if (requiresCluster && (!opts.username || !opts.cluster)) {
+                throw new ApplianceApiError('--username and --cluster are required.');
+            }
+            const response = await api.get(path, { query: bindQuery(opts) });
+            if (opts.json) {
+                printJson(response.data);
+                return;
+            }
+            // These endpoints return nested analytics objects. Pretty JSON keeps
+            // every field visible without guessing a release-specific table shape.
+            printJson(response.data);
+        }));
+    };
+    addAnalyticsCommand('dashboard', 'sftp_backup_analytics/cucm/dashboard', 'CUCM backup dashboard summary');
+    addAnalyticsCommand('trends', 'sftp_backup_analytics/trends', 'Backup trend analytics');
+    addAnalyticsCommand('cluster', 'sftp_backup_analytics/cucm/cluster', 'CUCM cluster backup summary', true);
+    addAnalyticsCommand('validations', 'sftp_backup_analytics/cucm/cluster/validations', 'CUCM cluster validation history', true);
+}
+// ── Report schedules ─────────────────────────────────────────────────────
+function registerReports(sftp) {
+    const reports = sftp.command('reports').description('SFTP report schedules and executions');
+    reports.action(() => reports.outputHelp());
+    const schedules = reports.command('schedules').description('Manage SFTP report schedules');
+    schedules.action(() => schedules.outputHelp());
+    addApiOptions(schedules.command('list').description('List report schedules'), true).action(action(async (opts) => {
+        const { api, spec } = await connectWithSpec(opts);
+        requireOperation(spec, 'GET sftp_reports/schedules');
+        const response = await api.get('sftp_reports/schedules');
+        const list = (response.data.schedules ?? response.data.data ?? []);
+        if (opts.json) {
+            printJson(list);
+            return;
+        }
+        if (list.length === 0) {
+            out.info('No report schedules.');
+            return;
+        }
+        console.log(renderTable(['ID', 'TYPE', 'ENABLED', 'NEXT RUN', 'LAST RUN', 'STATUS', 'FAILURES'], list.map(schedule => [
+            String(schedule.id),
+            String(schedule.schedule_type ?? '—'),
+            schedule.enabled ? 'yes' : 'no',
+            formatDateTime(schedule.next_run_at),
+            formatDateTime(schedule.last_run_at),
+            schedule.last_run_status ?? '—',
+            String(schedule.failure_count ?? 0),
+        ]), { maxWidth: [8, 20, 8, 20, 20, 12, 9] }));
+        console.log();
+    }));
+    addApiOptions(schedules
+        .command('show')
+        .description('Show a report schedule')
+        .argument('<id>', 'Schedule ID'), true).action(action(async (id, opts) => {
+        const { api, spec } = await connectWithSpec(opts);
+        requireOperation(spec, 'GET sftp_reports/schedules/{id}');
+        const scheduleId = parsePositiveInt(id, 'schedule ID');
+        const response = await api.get(`sftp_reports/schedules/${scheduleId}`);
+        printJson(response.data.schedule ?? response.data);
+    }));
+    for (const [name, method] of [
+        ['create', 'POST'],
+        ['update', 'PUT'],
+    ]) {
+        const command = addApiOptions(schedules
+            .command(name)
+            .description(`${name === 'create' ? 'Create' : 'Update'} a report schedule from JSON`)
+            .requiredOption('--file <path>', 'JSON file with schedule fields (or a {schedule:{...}} object)'), true);
+        if (name === 'update')
+            command.argument('<id>', 'Schedule ID');
+        command.action(action(async (...args) => {
+            const opts = args[args.length - 1];
+            const scheduleId = name === 'update' ? parsePositiveInt(String(args[0]), 'schedule ID') : undefined;
+            const { api, spec } = await connectWithSpec(opts);
+            const path = scheduleId
+                ? requireOperation(spec, 'PUT sftp_reports/schedules/{id}').shortPath.replace('{id}', String(scheduleId))
+                : requireOperation(spec, 'POST sftp_reports/schedules').shortPath;
+            const parsed = readJsonOption(opts.file.startsWith('@') ? opts.file : `@${opts.file}`, '--file');
+            const schedule = typeof parsed === 'object' && parsed !== null && 'schedule' in parsed
+                ? parsed.schedule
+                : parsed;
+            if (typeof schedule !== 'object' || schedule === null || Array.isArray(schedule)) {
+                throw new ApplianceApiError('--file must contain a JSON object.');
+            }
+            const response = await api.request(method, path, {
+                body: { schedule },
+            });
+            if (opts.json)
+                printJson(response.data);
+            else
+                out.ok(`Report schedule ${name === 'create' ? 'created' : 'updated'}`);
+        }));
+    }
+    addApiOptions(schedules
+        .command('delete')
+        .description('Delete a report schedule')
+        .argument('<id>', 'Schedule ID')
+        .option('--yes', 'Skip the confirmation prompt'), true).action(action(async (id, opts) => {
+        const { api, spec } = await connectWithSpec(opts);
+        requireOperation(spec, 'DELETE sftp_reports/schedules/{id}');
+        const scheduleId = parsePositiveInt(id, 'schedule ID');
+        await confirmDestructive(`Delete report schedule ${scheduleId}?`, opts.yes);
+        await api.delete(`sftp_reports/schedules/${scheduleId}`);
+        if (opts.json)
+            printJson({ deleted: true, id: scheduleId });
+        else
+            out.ok(`Deleted report schedule ${scheduleId}`);
+    }));
+    addApiOptions(schedules
+        .command('run')
+        .description('Run a report schedule now')
+        .argument('<id>', 'Schedule ID'), true).action(action(async (id, opts) => {
+        const { api, spec } = await connectWithSpec(opts);
+        requireOperation(spec, 'POST sftp_reports/schedules/{id}/run');
+        const scheduleId = parsePositiveInt(id, 'schedule ID');
+        const response = await api.post(`sftp_reports/schedules/${scheduleId}/run`, {});
+        if (opts.json)
+            printJson(response.data);
+        else
+            out.ok(`Triggered report schedule ${scheduleId}`);
+    }));
+    addApiOptions(schedules
+        .command('executions')
+        .description('List execution history for a report schedule')
+        .argument('<id>', 'Schedule ID')
+        .option('--limit <n>', 'Maximum entries', '50')
+        .option('--offset <n>', 'Offset', '0'), true).action(action(async (id, opts) => {
+        const { api, spec } = await connectWithSpec(opts);
+        requireOperation(spec, 'GET sftp_reports/schedules/{id}/executions');
+        const scheduleId = parsePositiveInt(id, 'schedule ID');
+        const response = await api.get(`sftp_reports/schedules/${scheduleId}/executions`, {
+            query: {
+                limit: parseIntegerOption(opts.limit, '--limit', { min: 1, max: 1000, fallback: 50 }),
+                offset: parseIntegerOption(opts.offset, '--offset', { min: 0, fallback: 0 }),
+            },
+        });
+        printJson(response.data);
+    }));
+    addApiOptions(reports
+        .command('executions')
+        .description('Show a single report execution')
+        .argument('<id>', 'Execution ID'), true).action(action(async (id, opts) => {
+        const { api, spec } = await connectWithSpec(opts);
+        requireOperation(spec, 'GET sftp_reports/executions/{id}');
+        const executionId = parsePositiveInt(id, 'execution ID');
+        const response = await api.get(`sftp_reports/executions/${executionId}`);
+        printJson(response.data);
+    }));
+}
+// ── Generic OpenAPI operation ────────────────────────────────────────────
+function registerApi(sftp) {
+    addApiOptions(sftp
+        .command('api')
+        .description('Call any SFTP operation exposed by the appliance OpenAPI spec')
+        .argument('[operation]', 'Example: "GET sftp_action_accounts/{id}/quota"')
+        .option('--list', 'List SFTP operations from the installed release')
+        .option('--all', 'With --list, include non-SFTP operations')
+        .option('--method <method>', 'HTTP method when the path supports several')
+        .option('--param <key=value>', 'Path parameter (repeatable)', collect, [])
+        .option('--query <key=value>', 'Query parameter (repeatable)', collect, [])
+        .option('--body <json>', 'JSON body or @file')
+        .option('--output <path>', 'Write the response to a file')
+        .option('--raw', 'Print the response as raw text')
+        .option('--dry-run', 'Print the request without sending it')
+        .option('--yes', 'Allow destructive methods without confirmation'), true).action(action(async (operation, opts) => {
+        let api;
+        let spec;
+        if (opts.list) {
+            api = await connect(opts, { requireAuth: false });
+            try {
+                spec = await api.fetchSpec();
+            }
+            catch (err) {
+                // A release may protect /api/openapi. Retry with local credentials
+                // before surfacing an authentication error.
+                if (err instanceof ApplianceApiError && (err.status === 401 || err.status === 403)) {
+                    api = await connect(opts, { requireAuth: true });
+                    spec = await api.fetchSpec();
+                }
+                else {
+                    throw err;
+                }
+            }
+        }
+        else {
+            api = await connect(opts);
+            spec = await api.fetchSpec();
+        }
+        if (opts.list) {
+            const operations = listOperations(spec, opts.all ? {} : { contains: 'sftp' });
+            if (opts.json) {
+                printJson(operations);
+                return;
+            }
+            if (operations.length === 0) {
+                out.warn('No matching operations in the installed release spec.');
+                return;
+            }
+            console.log(renderTable(['METHOD', 'OPERATION', 'SUMMARY'], operations.map(entry => [entry.method.toUpperCase(), entry.shortPath, entry.summary]), { maxWidth: [7, 64, 60] }));
+            console.log();
+            out.info(`${operations.length} operation(s) · OpenAPI ${spec.openapi ?? 'unknown'} · ${spec.info?.version ?? ''}`);
+            return;
+        }
+        if (!operation) {
+            throw new ApplianceApiError('Provide an operation, or use --list to discover them.');
+        }
+        const withMethod = opts.method
+            ? `${opts.method.toUpperCase()} ${operation.replace(/^(GET|POST|PUT|PATCH|DELETE)\s+/i, '')}`
+            : operation;
+        const resolved = getOperation(spec, withMethod);
+        const pathParams = parsePairs(opts.param, '--param');
+        Object.assign(pathParams, resolved.extractedParams);
+        // The generated spec does not always declare path parameters, so use
+        // the template placeholders as the authoritative required set.
+        for (const name of pathPlaceholders(resolved.path)) {
+            if (name === 'org_id')
+                continue;
+            if (!pathParams[name]) {
+                throw new ApplianceApiError(`Missing path parameter --param ${name}=<value> for ${resolved.shortPath}`);
+            }
+        }
+        let path = resolved.path;
+        for (const [key, value] of Object.entries(pathParams)) {
+            path = path.split(`{${key}}`).join(encodeURIComponent(value));
+        }
+        path = path.replace('{org_id}', String(api.orgId));
+        const query = parsePairs(opts.query, '--query');
+        for (const parameter of operationQueryParams(resolved.operation)) {
+            if (parameter.required && !query[parameter.name]) {
+                throw new ApplianceApiError(`Missing required query parameter --query ${parameter.name}=<value> for ${resolved.shortPath}`);
+            }
+        }
+        let body;
+        const bodySchema = operationBodySchema(spec, resolved.operation);
+        if (opts.body !== undefined) {
+            body = readJsonOption(opts.body, '--body');
+        }
+        else if (resolved.operation.requestBody?.required) {
+            throw new ApplianceApiError(`This operation requires a body (${describeSchema(spec, bodySchema)}). Pass --body <json|@file>.`);
+        }
+        if (body !== undefined && bodySchema) {
+            const errors = validateAgainstSchema(spec, bodySchema, body);
+            if (errors.length > 0) {
+                throw new ApplianceApiError(`Invalid request body:\n  - ${errors.join('\n  - ')}`);
+            }
+        }
+        const method = resolved.method.toUpperCase();
+        if (opts.dryRun) {
+            console.log(`${chalk.bold(method)} ${api.urlFor(path, query)}`);
+            console.log(`  Authorization: ${api.token ? '[REDACTED]' : '(none)'}`);
+            if (body !== undefined) {
+                console.log('  Content-Type: application/json');
+                console.log(JSON.stringify(body, null, 2));
+            }
+            return;
+        }
+        if (method === 'DELETE') {
+            await confirmDestructive(`Send DELETE ${resolved.shortPath}?`, opts.yes);
+        }
+        const response = await api.request(method, path, {
+            query,
+            body,
+            outputPath: opts.output,
+            parse: opts.output ? 'none' : opts.raw ? 'text' : 'json',
+            accept: opts.raw ? 'text/plain' : 'application/json',
+        });
+        if (opts.output) {
+            out.ok(`Wrote response to ${opts.output}`);
+        }
+        else if (opts.raw) {
+            console.log(String(response.data));
+        }
+        else {
+            printJson(response.data ?? null);
+        }
+    }));
+}
+export function registerSftpCommand(program) {
+    const sftp = program
+        .command('sftp')
+        .description('SFTP Action Accounts, upload monitoring, storage, and support');
+    sftp.action(() => sftp.outputHelp());
+    registerStatus(sftp);
+    registerDoctor(sftp);
+    registerAccounts(sftp);
+    registerMonitoring(sftp);
+    registerActivity(sftp);
+    registerStorage(sftp);
+    registerAnalytics(sftp);
+    registerReports(sftp);
+    registerApi(sftp);
+}
+//# sourceMappingURL=sftp.js.map