@curviate/cli 0.11.0 → 0.13.0

package/CHANGELOG.md

@@ -6,7 +6,66 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 Versioning follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html):
 a new command or flag is a minor; a breaking command/flag/exit-code change is a major; a fix is a patch.
 
-## [Unreleased]
+## [0.13.0] - 2026-07-05
+
+Accounts/Auth surface migration — the coupled release with `@curviate/sdk` 0.13.0. This is a
+**breaking** minor (pre-1.0): the account connection and checkpoint commands were reshaped to
+match the new account-in-path grammar.
+
+### Added
+
+- **`account reconnect-link <account_id>`** — mint a one-time hosted **re-authorization** link for an existing disconnected account (the hosted counterpart of `account reconnect`). Same open+wait UX as `account connect-link`: on an interactive TTY the URL auto-opens and the command waits for the account to reconnect (exit `0` resolved, `9` expired/failed, `12` on a wait-window timeout); non-interactively it prints the url + session_id and returns immediately. Optional `--expires-in-seconds` / `--redirect-url`.
+- **`account update --metadata '<json>'`** — set the account's custom metadata (a flat JSON object that replaces the store wholesale). **`account update --clear-proxy`** — clear the custom proxy (revert to automatic proxy protection).
+- **New connect/checkpoint response fields ride through `--json` output** (coupled with the SDK 0.13.0 connect-fix regen — the CLI duck-types the response, so the fields pass through verbatim with no code change):
+  - `recovered` (boolean) on `account link` and `account checkpoint solve` completions — `true` when the connect reclaimed a LinkedIn identity already present on the workspace rather than connecting a brand-new one.
+  - the completed-account `status` is widened to `active | reconnect_needed | restricted | disconnected` (a recovered identity often reports needing a reconnect); the CLI reads `status` as a free-form string, so the wider set is unaffected.
+  - `challenge_type` (`mobile_app_approval`) + `recovery_hint` on an `account checkpoint poll` that returns `status: "expired"` (a mobile-approval timeout).
+  Surfacing `recovered` in the human-readable (non-`--json`) success line is a deferred UX follow-up — it would need consistent treatment across the direct-link, interactive-solve, and standalone-solve completion paths.
+
+### Changed (BREAKING)
+
+- **Checkpoint commands are now account-in-path (positional), not `--checkpoint`.**
+  - `account checkpoint submit --checkpoint <id> --code <c>` → **`account checkpoint solve <account_id> --code <c>`**.
+  - `account checkpoint resend --checkpoint <id>` → **`account checkpoint request <account_id>`**.
+  - `account checkpoint poll --checkpoint <id>` → **`account checkpoint poll <account_id>`** (the `--checkpoint` flag becomes the account_id positional; `--wait`/`--timeout` unchanged).
+  - Update scripts: replace `checkpoint submit --checkpoint X --code Y` with `checkpoint solve X --code Y`, `checkpoint resend --checkpoint X` with `checkpoint request X`, and `checkpoint poll --checkpoint X` with `checkpoint poll X`.
+- **`account refresh <account_id>` removed** — accounts restart and re-sync automatically now; there is no replacement command. Status freshness comes from the account-status webhook, the nightly reconcile, and `account get`.
+- **`account connect-link` is create-only** — the `--purpose` and `--account-id` flags are removed; it only mints a link to connect a **new** account. Use `account reconnect-link <account_id>` for hosted re-auth of an existing account.
+- **`account update` reshaped** — the managed `--country` / `--ip` flags are removed (a managed location is now chosen at connect time). The command now takes `--metadata` and/or a custom proxy (`--proxy-*` / `--clear-proxy`).
+- **`account link` / `account reconnect` require `--user-agent` for cookie auth** — connecting by session cookie (`--auth-method cookie`) without a `--user-agent` fails fast at exit `2` (it stays optional for `--auth-method credentials`). Under `--preview` the check is skipped (a render never exits).
+- SDK-parity manifest (`test/parity.test.ts`) repoints the checkpoint entries (`solve`/`request`/`poll`) and swaps `account refresh` → `account reconnect-link`; the manifest and SDK method count stay at 93 (`accounts` stays 12 methods).
+
+### Fixed
+
+- **`account connect-session poll` now interpolates the session id correctly.** It previously passed the session id as an object to the SDK, producing a request path of `/v1/accounts/connect-sessions/[object Object]` (broken `--wait` loops). It now passes the id as a string. A regression test asserts the interpolated path is `/v1/accounts/connect-sessions/<session_id>`, never `[object Object]`.
+
+### Changed
+
+- `@curviate/sdk` dependency bumped to `^0.13.0` — the coupled release carrying the reshaped `accounts` surface (see the SDK's own CHANGELOG). The CLI duck-types the SDK, so its commands are covered by the parity manifest against that release.
+
+## [0.12.0] - 2026-07-05
+
+### Added
+
+- **`company employees <id>`** — list people who currently work at the company (facade over people search with the company filter). `--keywords` and `--location` narrow the result; pagination flags apply. `<id>` must be the company's numeric provider_id (the `id` field of `company <id>`).
+- **`company posts <id>`** — list the company's posts (facade over post search). Pagination flags apply; post `text` prints verbatim.
+- **`company jobs <id>`** — list the company's open job postings (facade over job search). `--keywords` narrows the result. An empty list is a valid result (the company currently has no open postings), not an error.
+- **`company followers <id>`** — list the company's followers (native — the same seam that backs `profile <id> --followers`). Requires the acting account to administer the target company page; a non-admin company returns the exit code for `RESOURCE_ACCESS_RESTRICTED` (new, see below).
+- All four new subcommands support `--all` (NDJSON page streaming) alongside the existing pagination flags, and reject `--preview` (exit `2`) like every other read command.
+- `--account` is now required on `company <id>` (retrieve) — the underlying endpoint always requires `account_id`; previously the command silently fell back to an unscoped call.
+- **Sales Navigator v2 list surface — 5 new subcommands.** `sales-nav account-lists --account <id>` and `sales-nav lead-lists --account <id>` list the operator's saved-account/saved-lead lists (`--limit`/`--cursor`/`--all` paginate). `sales-nav browse-account-list <list_id> --account <id> [--filter --sort-by --sort-order]` and `sales-nav browse-lead-list <list_id> --account <id> [--spotlight --sort-by --sort-order]` browse the saved items in one list — genuine paginated reads, so they keep all pagination flags. `sales-nav save-account <company_id> --list <id> --account <id>` saves a company into an account list (write, `--preview` supported, no pagination flags in `--help`). All five call the SDK's new `salesNavigator` methods (`accountLists`/`leadLists`/`browseAccountList`/`browseLeadList`/`saveAccount`) — no re-implementation of the HTTP call.
+
+### Changed (BREAKING)
+
+- **`company <id>` now routes to the SDK's `companies.get()`** instead of the retired `profiles.getCompany()` — an internal repoint (the hard-moved server endpoint), not a CLI UX change: flags, output shape, and slim projection are unchanged. `--account` becoming required (above) is the one user-visible behavior change.
+- SDK-parity manifest (`test/parity.test.ts`) repoints `company get` → `companies.get` and gains `company employees` / `company posts` / `company jobs` / `company followers`; the manifest and SDK method count both move from 84 to 88.
+- `@curviate/sdk` dependency bumped to `^0.12.0` — the released build carrying the `companies` resource and the v2 `salesNavigator` list-surface cascade (see the SDK's own CHANGELOG).
+- **`sales-nav save-lead` re-signed for the v2 save-lead surface.** The old `save-lead <user_id> [--list-id <id>]` (list optional) is **retired, no alias** — the v2 op always saves into a specific list. The replacement is `save-lead <user_id> --list <id>`: `--list` is now **required** and the flag is renamed from `--list-id`. Update scripts: `save-lead <id> --list-id <l>` → `save-lead <id> --list <l>`.
+- SDK-parity manifest gains the 5 new `sales-nav` v2 subcommands; the manifest and SDK method count both move from 88 to 93 (`salesNavigator` 7→12 methods).
+
+### Fixed
+
+- **`RESOURCE_ACCESS_RESTRICTED`** — a new SDK error code (the non-admin mapping for `company followers`) is now present in `EXIT_CODE_MAP` (exit `8`, grouped with `ACCOUNT_RESTRICTED`); the exhaustiveness test would otherwise have silently mapped it to the default `1`.
 
 ## [0.11.0] - 2026-07-04
 

package/README.md

@@ -172,13 +172,44 @@ curviate search jobs --keywords "founding engineer" --location "Berlin" --accoun
 curviate job get "https://www.linkedin.com/jobs/view/4428113858" --account acc_1
 ```
 
+## Company
+
+Company commands (`curviate company ...`) are Core-tier reads. `company <id>` accepts a public
+handle (the slug in `linkedin.com/company/<handle>`) or a numeric id; the four sub-resource
+commands require the company's **numeric provider id** — the `id` field `company <id>` returns.
+`--account` (or a configured default account) is required on all of them.
+
+### 1. Retrieve a company, then list its employees
+
+```bash
+curviate company t-systems --account acc_1 --json | jq -r '.id' \
+  | xargs -I{} curviate company employees {} --keywords "engineer" --limit 10 --account acc_1 --json
+```
+
+### 2. Page through a company's posts and jobs
+
+```bash
+curviate company posts 112013061 --limit 5 --account acc_1 --json
+curviate company jobs 112013061 --all --account acc_1 --json   # streams every page
+```
+
+### 3. List a company's followers (page admins only)
+
+Followers are only retrievable for a company page the acting account **administers** — a
+non-administered company returns a `RESOURCE_NOT_FOUND` error (exit code `4`), the same shape as
+an unknown company.
+
+```bash
+curviate company followers 112013061 --limit 25 --account acc_1 --json
+```
+
 ## Sales Navigator
 
 Sales Navigator commands (`curviate sales-nav ...`) require an account with the Sales Navigator
 add-on tier attached. A call against an account without it fails with **exit code `5`** and a
 `TIER_NOT_ACTIVE` error body naming the required tier (`sales_nav`) — branch on the exit code the
-same way as example 4 above. Write commands (`save-lead`, `message new`) accept `--preview` to
-render the request without sending it.
+same way as example 4 above. Write commands (`save-lead`, `save-account`, `message new`) accept
+`--preview` to render the request without sending it.
 
 ### 1. Search Sales Navigator profiles, then get one full profile
 
@@ -193,15 +224,15 @@ curviate sales-nav search people \
 
 ### 2. Save a lead to a specific lead list
 
-Preview first, then send:
+Preview first, then send. `--list` is required — the save always targets a specific list.
 
 ```bash
 curviate sales-nav save-lead ACwAAA1234567 \
   --account acc_1 \
-  --list-id 987654 \
+  --list 987654 \
   --preview
 
-curviate sales-nav save-lead ACwAAA1234567 --account acc_1 --list-id 987654
+curviate sales-nav save-lead ACwAAA1234567 --account acc_1 --list 987654
 ```
 
 ### 3. Start a new Sales Navigator chat
@@ -223,6 +254,45 @@ curviate sales-nav search companies \
   | jq -r '.items[] | "\(.id)\t\(.name)"'
 ```
 
+### 5. List saved-account and saved-lead lists
+
+```bash
+curviate sales-nav account-lists --account acc_1
+curviate sales-nav lead-lists --account acc_1
+```
+
+### 6. Browse a saved-account list, filtered to starred accounts
+
+```bash
+curviate sales-nav browse-account-list 987654 \
+  --account acc_1 \
+  --filter STARRED \
+  --sort-by NAME \
+  --json \
+  | jq -r '.items[] | "\(.id)\t\(.display_name)"'
+```
+
+### 7. Browse a saved-lead list, spotlighting recent job changes
+
+```bash
+curviate sales-nav browse-lead-list 456789 \
+  --account acc_1 \
+  --spotlight RECENT_POSITION_CHANGE \
+  --json \
+  | jq -r '.items[] | "\(.id)\t\(.display_name)"'
+```
+
+### 8. Save a company into an account list
+
+```bash
+curviate sales-nav save-account 112013061 \
+  --account acc_1 \
+  --list 987654 \
+  --preview
+
+curviate sales-nav save-account 112013061 --account acc_1 --list 987654
+```
+
 ## Recruiter
 
 Recruiter commands (`curviate recruiter ...`) require an account with the Recruiter add-on tier