@curviate/cli 0.10.0 → 0.12.0

package/CHANGELOG.md

@@ -6,7 +6,50 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 Versioning follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html):
 a new command or flag is a minor; a breaking command/flag/exit-code change is a major; a fix is a patch.
 
-## [Unreleased]
+## [0.12.0] - 2026-07-05
+
+### Added
+
+- **`company employees <id>`** — list people who currently work at the company (facade over people search with the company filter). `--keywords` and `--location` narrow the result; pagination flags apply. `<id>` must be the company's numeric provider_id (the `id` field of `company <id>`).
+- **`company posts <id>`** — list the company's posts (facade over post search). Pagination flags apply; post `text` prints verbatim.
+- **`company jobs <id>`** — list the company's open job postings (facade over job search). `--keywords` narrows the result. An empty list is a valid result (the company currently has no open postings), not an error.
+- **`company followers <id>`** — list the company's followers (native — the same seam that backs `profile <id> --followers`). Requires the acting account to administer the target company page; a non-admin company returns the exit code for `RESOURCE_ACCESS_RESTRICTED` (new, see below).
+- All four new subcommands support `--all` (NDJSON page streaming) alongside the existing pagination flags, and reject `--preview` (exit `2`) like every other read command.
+- `--account` is now required on `company <id>` (retrieve) — the underlying endpoint always requires `account_id`; previously the command silently fell back to an unscoped call.
+- **Sales Navigator v2 list surface — 5 new subcommands.** `sales-nav account-lists --account <id>` and `sales-nav lead-lists --account <id>` list the operator's saved-account/saved-lead lists (`--limit`/`--cursor`/`--all` paginate). `sales-nav browse-account-list <list_id> --account <id> [--filter --sort-by --sort-order]` and `sales-nav browse-lead-list <list_id> --account <id> [--spotlight --sort-by --sort-order]` browse the saved items in one list — genuine paginated reads, so they keep all pagination flags. `sales-nav save-account <company_id> --list <id> --account <id>` saves a company into an account list (write, `--preview` supported, no pagination flags in `--help`). All five call the SDK's new `salesNavigator` methods (`accountLists`/`leadLists`/`browseAccountList`/`browseLeadList`/`saveAccount`) — no re-implementation of the HTTP call.
+
+### Changed (BREAKING)
+
+- **`company <id>` now routes to the SDK's `companies.get()`** instead of the retired `profiles.getCompany()` — an internal repoint (the hard-moved server endpoint), not a CLI UX change: flags, output shape, and slim projection are unchanged. `--account` becoming required (above) is the one user-visible behavior change.
+- SDK-parity manifest (`test/parity.test.ts`) repoints `company get` → `companies.get` and gains `company employees` / `company posts` / `company jobs` / `company followers`; the manifest and SDK method count both move from 84 to 88.
+- `@curviate/sdk` dependency bumped to `^0.12.0` — the released build carrying the `companies` resource and the v2 `salesNavigator` list-surface cascade (see the SDK's own CHANGELOG).
+- **`sales-nav save-lead` re-signed for the v2 save-lead surface.** The old `save-lead <user_id> [--list-id <id>]` (list optional) is **retired, no alias** — the v2 op always saves into a specific list. The replacement is `save-lead <user_id> --list <id>`: `--list` is now **required** and the flag is renamed from `--list-id`. Update scripts: `save-lead <id> --list-id <l>` → `save-lead <id> --list <l>`.
+- SDK-parity manifest gains the 5 new `sales-nav` v2 subcommands; the manifest and SDK method count both move from 88 to 93 (`salesNavigator` 7→12 methods).
+
+### Fixed
+
+- **`RESOURCE_ACCESS_RESTRICTED`** — a new SDK error code (the non-admin mapping for `company followers`) is now present in `EXIT_CODE_MAP` (exit `8`, grouped with `ACCOUNT_RESTRICTED`); the exhaustiveness test would otherwise have silently mapped it to the default `1`.
+
+## [0.11.0] - 2026-07-04
+
+### Added
+
+- **Safe credential entry** for `account link` / `account reconnect` / `account update` — env-var fallbacks (an explicit flag always wins over its env var), `--password-stdin` / `--li-at-stdin` flags to read a secret from stdin, and a masked TTY prompt with a non-TTY fail-fast when a credential is required but not supplied any other way. A 5-way conflict matrix rejects supplying the same credential through more than one channel. The four secret-bearing flags carry a shell-history/`ps`-visibility warning, and `--preview` masks credential values instead of ever rendering them in cleartext.
+- **Guided checkpoint follow-through** on `account link` / `account reconnect`. A `202 checkpoint_required` response now resolves in-process on an interactive TTY — code prompt, retry loop on a `422`, chained-challenge follow-through, a codeless mobile-app-approval poll sub-loop, and a resend hint — instead of just printing the envelope. A non-interactive session (either stream not a TTY, or `--no-interactive`) still prints the envelope and exits with the new `12` (`AUTH_NEEDED`) code — a pending checkpoint, not an error.
+- **`account checkpoint poll --wait`** — an adaptive-cadence loop (1000ms, then 1500ms for 30s, then 3000ms) that blocks until the checkpoint resolves (exit `0`), expires/fails (exit `9`), or the wait window elapses while still pending (exit `12`, still resolvable later). `--wait` is off by default (the single-poll behavior is unchanged). `--timeout <ms>` overrides the wall-clock bound (default: the checkpoint's own expiry) and fails fast at exit `2` on a non-numeric value, before any call. `checkpoint submit`'s one-shot path also now detects a chained `checkpoint_required` response and exits `12` instead of rendering it as a plain success.
+- **`account checkpoint resend --checkpoint <id>`** — re-sends the pending challenge notification, mirroring `checkpoint submit` / `poll` (body-addressed, `WRITE_SINGLE_FLAGS`, `--preview` supported, no `--code` since there's nothing to submit). Exits `0` on any `200` regardless of the response's `resent` boolean — `false` is an honest answer, not a command failure.
+- **`account connect-link` browser handoff.** The command now completes the hosted-link round trip instead of only minting a URL: on an interactive TTY it auto-opens the URL and waits on the same adaptive cadence as `checkpoint poll --wait` for the account to connect (resolved → prints the connected account and exits `0`; expired/failed → exit `9`; wait window elapses while still pending → exit `12`). A non-interactive session (non-TTY, or `--no-interactive`) never opens a browser and never blocks — it prints the URL, a relay instruction, and the `session_id`, then returns immediately.
+- **`account connect-session poll --session <id>`** — the standalone counterpart to the above: a single poll by default (prints the body, exits `0` regardless of status), or the same adaptive wait loop with `--wait`. `--open`/`--no-open` and `--wait`/`--no-wait` are TTY-adaptive; `--timeout <ms>` overrides the wait bound (default: time remaining to the session's own expiry).
+- Pagination flags (`--limit`/`--cursor`/`--all`/`--max-pages`) are now suppressed on the 8 `account` subcommands that mutate or resolve exactly one resource (`link`, `connect-link`, `reconnect`, `refresh`, `update`, `disconnect`, `checkpoint submit`, `checkpoint poll`) — they had no meaning on a one-row response. `account list` is unaffected. `link` / `reconnect` help text gains a one-line note about the checkpoint-required path.
+- SDK-parity manifest (`test/parity.test.ts`) gains `account checkpoint resend` → `accounts.resendCheckpoint` and `account connect-session poll` → `accounts.getConnectSession` — both were held back pending the SDK's own `0.11.0` regen; the manifest and the SDK method count both move from 82 to 84.
+
+### Fixed
+
+- **Flag-dispatch bug:** the unknown-flag check always stripped a leading `no-` prefix before matching against the declared-flag set, so a flag literally declared with that prefix (e.g. `--no-interactive`) was misread as negating an undeclared name and rejected as unknown on every invocation. The full declared name is now checked first; the `no-` strip is only a fallback for citty's own implicit negation of an undeclared `no-*` flag.
+
+### Changed
+
+- `@curviate/sdk` dependency bumped to `^0.11.0`.
 
 ## [0.10.0] - 2026-07-03
 

package/README.md

@@ -172,13 +172,44 @@ curviate search jobs --keywords "founding engineer" --location "Berlin" --accoun
 curviate job get "https://www.linkedin.com/jobs/view/4428113858" --account acc_1
 ```
 
+## Company
+
+Company commands (`curviate company ...`) are Core-tier reads. `company <id>` accepts a public
+handle (the slug in `linkedin.com/company/<handle>`) or a numeric id; the four sub-resource
+commands require the company's **numeric provider id** — the `id` field `company <id>` returns.
+`--account` (or a configured default account) is required on all of them.
+
+### 1. Retrieve a company, then list its employees
+
+```bash
+curviate company t-systems --account acc_1 --json | jq -r '.id' \
+  | xargs -I{} curviate company employees {} --keywords "engineer" --limit 10 --account acc_1 --json
+```
+
+### 2. Page through a company's posts and jobs
+
+```bash
+curviate company posts 112013061 --limit 5 --account acc_1 --json
+curviate company jobs 112013061 --all --account acc_1 --json   # streams every page
+```
+
+### 3. List a company's followers (page admins only)
+
+Followers are only retrievable for a company page the acting account **administers** — a
+non-administered company returns a `RESOURCE_NOT_FOUND` error (exit code `4`), the same shape as
+an unknown company.
+
+```bash
+curviate company followers 112013061 --limit 25 --account acc_1 --json
+```
+
 ## Sales Navigator
 
 Sales Navigator commands (`curviate sales-nav ...`) require an account with the Sales Navigator
 add-on tier attached. A call against an account without it fails with **exit code `5`** and a
 `TIER_NOT_ACTIVE` error body naming the required tier (`sales_nav`) — branch on the exit code the
-same way as example 4 above. Write commands (`save-lead`, `message new`) accept `--preview` to
-render the request without sending it.
+same way as example 4 above. Write commands (`save-lead`, `save-account`, `message new`) accept
+`--preview` to render the request without sending it.
 
 ### 1. Search Sales Navigator profiles, then get one full profile
 
@@ -193,15 +224,15 @@ curviate sales-nav search people \
 
 ### 2. Save a lead to a specific lead list
 
-Preview first, then send:
+Preview first, then send. `--list` is required — the save always targets a specific list.
 
 ```bash
 curviate sales-nav save-lead ACwAAA1234567 \
   --account acc_1 \
-  --list-id 987654 \
+  --list 987654 \
   --preview
 
-curviate sales-nav save-lead ACwAAA1234567 --account acc_1 --list-id 987654
+curviate sales-nav save-lead ACwAAA1234567 --account acc_1 --list 987654
 ```
 
 ### 3. Start a new Sales Navigator chat
@@ -223,6 +254,45 @@ curviate sales-nav search companies \
   | jq -r '.items[] | "\(.id)\t\(.name)"'
 ```
 
+### 5. List saved-account and saved-lead lists
+
+```bash
+curviate sales-nav account-lists --account acc_1
+curviate sales-nav lead-lists --account acc_1
+```
+
+### 6. Browse a saved-account list, filtered to starred accounts
+
+```bash
+curviate sales-nav browse-account-list 987654 \
+  --account acc_1 \
+  --filter STARRED \
+  --sort-by NAME \
+  --json \
+  | jq -r '.items[] | "\(.id)\t\(.display_name)"'
+```
+
+### 7. Browse a saved-lead list, spotlighting recent job changes
+
+```bash
+curviate sales-nav browse-lead-list 456789 \
+  --account acc_1 \
+  --spotlight RECENT_POSITION_CHANGE \
+  --json \
+  | jq -r '.items[] | "\(.id)\t\(.display_name)"'
+```
+
+### 8. Save a company into an account list
+
+```bash
+curviate sales-nav save-account 112013061 \
+  --account acc_1 \
+  --list 987654 \
+  --preview
+
+curviate sales-nav save-account 112013061 --account acc_1 --list 987654
+```
+
 ## Recruiter
 
 Recruiter commands (`curviate recruiter ...`) require an account with the Recruiter add-on tier