@curviate/cli 0.12.0 → 0.14.0

package/CHANGELOG.md

@@ -6,6 +6,55 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 Versioning follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html):
 a new command or flag is a minor; a breaking command/flag/exit-code change is a major; a fix is a patch.
 
+## [0.14.0] - 2026-07-07
+
+Webhooks surface cascade — the coupled release with `@curviate/sdk` 0.14.0. Additive minor.
+
+### Added
+
+- **`webhook get <id>`** — get a single webhook owned by the calling tenant (`webhooks.get`). Read command; `--preview` is a usage error (nothing to mutate), matching `webhook state-diff`.
+
+### Changed
+
+- **`@curviate/sdk` bumped to `^0.14.0`.** The SDK's webhook event catalogue expanded 21 → 27 (`chat.updated`, `chat.deleted`, `connection.new`, `account.initial_sync.*`, and account-lifecycle renames) and its `CurviateEvent` union re-keyed to match — this CLI never imports `CurviateEvent` directly, so `webhook verify`'s offline HMAC verification is unaffected; only the dependency range changed.
+
+## [0.13.0] - 2026-07-05
+
+Accounts/Auth surface migration — the coupled release with `@curviate/sdk` 0.13.0. This is a
+**breaking** minor (pre-1.0): the account connection and checkpoint commands were reshaped to
+match the new account-in-path grammar.
+
+### Added
+
+- **`account reconnect-link <account_id>`** — mint a one-time hosted **re-authorization** link for an existing disconnected account (the hosted counterpart of `account reconnect`). Same open+wait UX as `account connect-link`: on an interactive TTY the URL auto-opens and the command waits for the account to reconnect (exit `0` resolved, `9` expired/failed, `12` on a wait-window timeout); non-interactively it prints the url + session_id and returns immediately. Optional `--expires-in-seconds` / `--redirect-url`.
+- **`account update --metadata '<json>'`** — set the account's custom metadata (a flat JSON object that replaces the store wholesale). **`account update --clear-proxy`** — clear the custom proxy (revert to automatic proxy protection).
+- **New connect/checkpoint response fields ride through `--json` output** (coupled with the SDK 0.13.0 connect-fix regen — the CLI duck-types the response, so the fields pass through verbatim with no code change):
+  - `recovered` (boolean) on `account link` and `account checkpoint solve` completions — `true` when the connect reclaimed a LinkedIn identity already present on the workspace rather than connecting a brand-new one.
+  - the completed-account `status` is widened to `active | reconnect_needed | restricted | disconnected` (a recovered identity often reports needing a reconnect); the CLI reads `status` as a free-form string, so the wider set is unaffected.
+  - `challenge_type` (`mobile_app_approval`) + `recovery_hint` on an `account checkpoint poll` that returns `status: "expired"` (a mobile-approval timeout).
+  Surfacing `recovered` in the human-readable (non-`--json`) success line is a deferred UX follow-up — it would need consistent treatment across the direct-link, interactive-solve, and standalone-solve completion paths.
+
+### Changed (BREAKING)
+
+- **Checkpoint commands are now account-in-path (positional), not `--checkpoint`.**
+  - `account checkpoint submit --checkpoint <id> --code <c>` → **`account checkpoint solve <account_id> --code <c>`**.
+  - `account checkpoint resend --checkpoint <id>` → **`account checkpoint request <account_id>`**.
+  - `account checkpoint poll --checkpoint <id>` → **`account checkpoint poll <account_id>`** (the `--checkpoint` flag becomes the account_id positional; `--wait`/`--timeout` unchanged).
+  - Update scripts: replace `checkpoint submit --checkpoint X --code Y` with `checkpoint solve X --code Y`, `checkpoint resend --checkpoint X` with `checkpoint request X`, and `checkpoint poll --checkpoint X` with `checkpoint poll X`.
+- **`account refresh <account_id>` removed** — accounts restart and re-sync automatically now; there is no replacement command. Status freshness comes from the account-status webhook, the nightly reconcile, and `account get`.
+- **`account connect-link` is create-only** — the `--purpose` and `--account-id` flags are removed; it only mints a link to connect a **new** account. Use `account reconnect-link <account_id>` for hosted re-auth of an existing account.
+- **`account update` reshaped** — the managed `--country` / `--ip` flags are removed (a managed location is now chosen at connect time). The command now takes `--metadata` and/or a custom proxy (`--proxy-*` / `--clear-proxy`).
+- **`account link` / `account reconnect` require `--user-agent` for cookie auth** — connecting by session cookie (`--auth-method cookie`) without a `--user-agent` fails fast at exit `2` (it stays optional for `--auth-method credentials`). Under `--preview` the check is skipped (a render never exits).
+- SDK-parity manifest (`test/parity.test.ts`) repoints the checkpoint entries (`solve`/`request`/`poll`) and swaps `account refresh` → `account reconnect-link`; the manifest and SDK method count stay at 93 (`accounts` stays 12 methods).
+
+### Fixed
+
+- **`account connect-session poll` now interpolates the session id correctly.** It previously passed the session id as an object to the SDK, producing a request path of `/v1/accounts/connect-sessions/[object Object]` (broken `--wait` loops). It now passes the id as a string. A regression test asserts the interpolated path is `/v1/accounts/connect-sessions/<session_id>`, never `[object Object]`.
+
+### Changed
+
+- `@curviate/sdk` dependency bumped to `^0.13.0` — the coupled release carrying the reshaped `accounts` surface (see the SDK's own CHANGELOG). The CLI duck-types the SDK, so its commands are covered by the parity manifest against that release.
+
 ## [0.12.0] - 2026-07-05
 
 ### Added

package/dist/{account-NZBO6Y5I.js → account-7AUDAMIK.js}

@@ -157,7 +157,7 @@ ${challengeDescription(type)}
 function printResendHintIfApplicable(type, accountId, out) {
   if (!RESENDABLE_CHALLENGE_TYPES.has(type)) return;
   out.stderr.write(
-    `No code/notification? Re-send it: curviate account checkpoint resend --checkpoint ${accountId}
+    `No code/notification? Re-send it: curviate account checkpoint request ${accountId}
 `
   );
 }
@@ -353,7 +353,7 @@ async function waitForMobileApproval(client, accountId, expiresAt, ctx) {
   for (; ; ) {
     let result;
     try {
-      result = await client.accounts.pollCheckpoint({ account_id: accountId });
+      result = await client.accounts.pollCheckpoint(accountId);
     } catch (err) {
       return await handleError(err, ctx.outOpts, ctx.out);
     }
@@ -395,7 +395,7 @@ async function runInteractiveCheckpointLoop(client, initial, ctx) {
         return;
       }
       ctx.out.stderr.write(
-        `Still waiting for approval. Finish out-of-band: curviate account checkpoint poll --checkpoint ${accountId}
+        `Still waiting for approval. Finish out-of-band: curviate account checkpoint poll ${accountId}
 `
       );
       process.exit(AUTH_NEEDED);
@@ -404,7 +404,7 @@ async function runInteractiveCheckpointLoop(client, initial, ctx) {
     for (; ; ) {
       const code = await ctx.readline("Enter the code: ");
       try {
-        const result = await client.accounts.submitCheckpoint({ account_id: accountId, code });
+        const result = await client.accounts.solveCheckpoint(accountId, { code });
         const r = result;
         if (r.status === "checkpoint_required") {
           current = { ...r, account_id: r.account_id ?? accountId };
@@ -453,6 +453,10 @@ async function runAccountLink(client, flags, out, io = {}) {
     process.exit(2);
   }
   checkCredentialConflicts(flags, out);
+  if (!flags.preview && flags["auth-method"] === "cookie" && !flags["user-agent"]) {
+    out.stderr.write("error: --user-agent is required when --auth-method=cookie.\n");
+    process.exit(2);
+  }
   const resolvedIo = resolveCredentialIO(io);
   const authBody = await buildAuthBody(flags, {
     out,
@@ -486,12 +490,12 @@ async function runAccountLink(client, flags, out, io = {}) {
     successVerb: "linked"
   });
 }
-async function runConnectSessionWaitLoop(client, params, ctx) {
+async function runConnectSessionWaitLoop(client, sessionId, ctx) {
   const startedAt = ctx.now();
   let timeoutAt = ctx.timeoutOverrideMs !== void 0 ? startedAt + ctx.timeoutOverrideMs : void 0;
   await ctx.sleep(CHECKPOINT_POLL_FIRST_DELAY_MS);
   for (; ; ) {
-    const result = await client.accounts.getConnectSession(params);
+    const result = await client.accounts.getConnectSession(sessionId);
     const r = result;
     if (r.status === "resolved") return { kind: "resolved", result };
     if (r.status === "expired" || r.status === "failed") {
@@ -527,8 +531,6 @@ function resolveWaitTimeoutOverrideMs(flags, out) {
 async function runAccountConnectLink(client, flags, out, io = {}) {
   const body = {};
   if (flags["seat-id"]) body["seat_id"] = flags["seat-id"];
-  if (flags["account-id"]) body["account_id"] = flags["account-id"];
-  if (flags.purpose) body["purpose"] = flags.purpose;
   if (flags["expires-in-seconds"]) body["expires_in_seconds"] = parseInt(flags["expires-in-seconds"], 10);
   if (flags["redirect-url"]) body["redirect_url"] = flags["redirect-url"];
   const outOpts = resolveOutputOpts(flags);
@@ -570,10 +572,10 @@ async function runAccountConnectLink(client, flags, out, io = {}) {
   }
   const timeoutOverrideMs = resolveWaitTimeoutOverrideMs(flags, out);
   const showTicker = resolvedIo.isOutputTTY && !(flags.json ?? false);
-  const params = { session_id: mint.session_id };
+  const sessionId = mint.session_id ?? "";
   let outcome;
   try {
-    outcome = await runConnectSessionWaitLoop(client, params, {
+    outcome = await runConnectSessionWaitLoop(client, sessionId, {
       out,
       sleep: resolvedIo.sleep,
       now: resolvedIo.now,
@@ -599,7 +601,7 @@ async function runAccountConnectLink(client, flags, out, io = {}) {
   }
   renderSuccess(outcome.result, outOpts, out);
   out.stderr.write(
-    `Still waiting for the account to connect \u2014 the wait window elapsed. Check again: curviate account connect-session poll --session ${mint.session_id} --wait
+    `Still waiting for the account to connect \u2014 the wait window elapsed. Check again: curviate account connect-session poll --session ${sessionId} --wait
 `
   );
   process.exit(AUTH_NEEDED);
@@ -609,16 +611,16 @@ async function runAccountConnectSessionPoll(client, flags, out, io = {}) {
     out.stderr.write("error: --session is required (the session_id from `account connect-link`).\n");
     process.exit(2);
   }
-  const params = { session_id: flags.session };
+  const sessionId = flags.session;
   const outOpts = resolveOutputOpts(flags);
   if (flags.preview) {
-    const preview = buildPreviewOutput({ method: "accounts.getConnectSession", args: {}, body: params });
+    const preview = buildPreviewOutput({ method: "accounts.getConnectSession", args: { session_id: sessionId }, body: {} });
     out.stdout.write(JSON.stringify(preview) + "\n");
     return;
   }
   if (!flags.wait) {
     try {
-      const result = await client.accounts.getConnectSession(params);
+      const result = await client.accounts.getConnectSession(sessionId);
       renderSuccess(result, outOpts, out);
     } catch (err) {
       await handleError(err, outOpts, out);
@@ -630,7 +632,7 @@ async function runAccountConnectSessionPoll(client, flags, out, io = {}) {
   const showTicker = resolvedIo.isOutputTTY && !(flags.json ?? false);
   let outcome;
   try {
-    outcome = await runConnectSessionWaitLoop(client, params, {
+    outcome = await runConnectSessionWaitLoop(client, sessionId, {
       out,
       sleep: resolvedIo.sleep,
       now: resolvedIo.now,
@@ -661,12 +663,94 @@ async function runAccountConnectSessionPoll(client, flags, out, io = {}) {
   );
   process.exit(AUTH_NEEDED);
 }
+async function runAccountReconnectLink(client, flags, out, io = {}) {
+  const accountId = flags["account-id"] ?? "";
+  const body = {};
+  if (flags["expires-in-seconds"]) body["expires_in_seconds"] = parseInt(flags["expires-in-seconds"], 10);
+  if (flags["redirect-url"]) body["redirect_url"] = flags["redirect-url"];
+  const outOpts = resolveOutputOpts(flags);
+  if (flags.preview) {
+    const preview = buildPreviewOutput({ method: "accounts.createReconnectLink", args: { accountId }, body });
+    out.stdout.write(JSON.stringify(preview) + "\n");
+    return;
+  }
+  let result;
+  try {
+    result = await client.accounts.createReconnectLink(accountId, body);
+  } catch (err) {
+    await handleError(err, outOpts, out);
+    return;
+  }
+  const mint = result;
+  const resolvedIo = resolveCredentialIO(io);
+  const isInteractive = resolvedIo.isTTY && resolvedIo.isOutputTTY && !(flags["no-interactive"] ?? false);
+  if (!isInteractive) {
+    if (mint.url) {
+      out.stderr.write(`Open this URL in a browser to reconnect the account: ${mint.url}
+`);
+    }
+    if (mint.session_id) {
+      out.stderr.write(
+        `Session: ${mint.session_id} \u2014 check it later with: curviate account connect-session poll --session ${mint.session_id} --wait
+`
+      );
+    }
+    renderSuccess(result, outOpts, out);
+    return;
+  }
+  if ((flags.open ?? true) && mint.url) {
+    await resolvedIo.open(mint.url);
+  }
+  if (!(flags.wait ?? true)) {
+    renderSuccess(result, outOpts, out);
+    return;
+  }
+  const timeoutOverrideMs = resolveWaitTimeoutOverrideMs(flags, out);
+  const showTicker = resolvedIo.isOutputTTY && !(flags.json ?? false);
+  const sessionId = mint.session_id ?? "";
+  let outcome;
+  try {
+    outcome = await runConnectSessionWaitLoop(client, sessionId, {
+      out,
+      sleep: resolvedIo.sleep,
+      now: resolvedIo.now,
+      showTicker,
+      timeoutOverrideMs
+    });
+  } catch (err) {
+    await handleError(err, outOpts, out);
+    return;
+  }
+  if (outcome.kind === "resolved") {
+    printConnectSessionResolved(outcome.result, { out, outOpts });
+    return;
+  }
+  if (outcome.kind === "terminal_failure") {
+    renderSuccess(outcome.result, outOpts, out);
+    out.stderr.write(
+      `This reconnect session has ${outcome.status}. Generate a new link: curviate account reconnect-link ${accountId}.
+`
+    );
+    process.exit(9);
+    return;
+  }
+  renderSuccess(outcome.result, outOpts, out);
+  out.stderr.write(
+    `Still waiting for the account to reconnect \u2014 the wait window elapsed. Check again: curviate account connect-session poll --session ${sessionId} --wait
+`
+  );
+  process.exit(AUTH_NEEDED);
+}
 async function runAccountReconnect(client, flags, out, io = {}) {
   if (!flags["auth-method"]) {
     out.stderr.write("error: --auth-method is required for account reconnect (credentials | cookie).\n");
     process.exit(2);
   }
   checkCredentialConflicts(flags, out);
+  if (!flags.preview && flags["auth-method"] === "cookie" && !flags["user-agent"]) {
+    out.stderr.write("error: --user-agent is required when --auth-method=cookie.\n");
+    process.exit(2);
+  }
   const accountId = flags["account-id"] ?? "";
   const resolvedIo = resolveCredentialIO(io);
   const body = await buildAuthBody(flags, {
@@ -701,30 +785,32 @@ async function runAccountReconnect(client, flags, out, io = {}) {
     successVerb: "reconnected"
   });
 }
-async function runAccountRefresh(client, flags, out) {
-  const accountId = flags["account-id"] ?? "";
-  const outOpts = resolveOutputOpts(flags);
-  if (flags.preview) {
-    const preview = buildPreviewOutput({
-      method: "accounts.refresh",
-      args: { accountId },
-      body: {}
-    });
-    out.stdout.write(JSON.stringify(preview) + "\n");
-    return;
-  }
-  try {
-    const result = await client.accounts.refresh(accountId);
-    renderSuccess(result, outOpts, out);
-  } catch (err) {
-    await handleError(err, outOpts, out);
-  }
-}
 async function runAccountUpdate(client, flags, out) {
   const accountId = flags["account-id"] ?? "";
   const body = {};
-  if (flags.country) body["country"] = flags.country;
-  if (flags.ip) body["ip"] = flags.ip;
+  if (flags.metadata !== void 0) {
+    let parsed;
+    try {
+      parsed = JSON.parse(flags.metadata);
+    } catch {
+      out.stderr.write(`error: --metadata must be a JSON object, e.g. --metadata '{"team":"growth"}'.
+`);
+      process.exit(2);
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+      out.stderr.write(`error: --metadata must be a JSON object, e.g. --metadata '{"team":"growth"}'.
+`);
+      process.exit(2);
+    }
+    body["metadata"] = parsed;
+  }
+  if (flags["clear-proxy"]) {
+    if (flags["proxy-host"]) {
+      out.stderr.write("error: --clear-proxy cannot be combined with --proxy-host (choose one).\n");
+      process.exit(2);
+    }
+    body["proxy"] = null;
+  }
   if (flags["proxy-host"]) {
     const proxyPassword = await resolveSecret({
       flagValue: flags["proxy-password"],
@@ -775,24 +861,24 @@ async function runAccountDisconnect(client, flags, out) {
     await handleError(err, outOpts, out);
   }
 }
-async function runAccountCheckpointSubmit(client, flags, out) {
-  if (!flags.checkpoint) {
-    out.stderr.write("error: --checkpoint is required (the provisional account_id from the 202 response).\n");
+async function runAccountCheckpointSolve(client, flags, out) {
+  if (!flags["account-id"]) {
+    out.stderr.write("error: account_id is required (the provisional account_id from the 202 response).\n");
     process.exit(2);
   }
   if (!flags.code) {
     out.stderr.write("error: --code is required (the OTP / 2FA code).\n");
     process.exit(2);
   }
+  const accountId = flags["account-id"] ?? "";
   const body = {
-    account_id: flags.checkpoint,
     code: flags.code
   };
   const outOpts = resolveOutputOpts(flags);
   if (flags.preview) {
     const preview = buildPreviewOutput({
-      method: "accounts.submitCheckpoint",
-      args: {},
+      method: "accounts.solveCheckpoint",
+      args: { accountId },
       body
     });
     out.stdout.write(JSON.stringify(preview) + "\n");
@@ -800,7 +886,7 @@ async function runAccountCheckpointSubmit(client, flags, out) {
   }
   let chained = false;
   try {
-    const result = await client.accounts.submitCheckpoint(body);
+    const result = await client.accounts.solveCheckpoint(accountId, body);
     const r = result;
     renderSuccess(result, outOpts, out);
     chained = r.status === "checkpoint_required";
@@ -812,26 +898,24 @@ async function runAccountCheckpointSubmit(client, flags, out) {
     process.exit(AUTH_NEEDED);
   }
 }
-async function runAccountCheckpointResend(client, flags, out) {
-  if (!flags.checkpoint) {
-    out.stderr.write("error: --checkpoint is required (the provisional account_id from the 202 response).\n");
+async function runAccountCheckpointRequest(client, flags, out) {
+  if (!flags["account-id"]) {
+    out.stderr.write("error: account_id is required (the provisional account_id from the 202 response).\n");
     process.exit(2);
   }
-  const body = {
-    account_id: flags.checkpoint
-  };
+  const accountId = flags["account-id"] ?? "";
   const outOpts = resolveOutputOpts(flags);
   if (flags.preview) {
     const preview = buildPreviewOutput({
-      method: "accounts.resendCheckpoint",
-      args: {},
-      body
+      method: "accounts.requestCheckpoint",
+      args: { accountId },
+      body: {}
     });
     out.stdout.write(JSON.stringify(preview) + "\n");
     return;
   }
   try {
-    const result = await client.accounts.resendCheckpoint(body);
+    const result = await client.accounts.requestCheckpoint(accountId);
     renderSuccess(result, outOpts, out);
   } catch (err) {
     await handleError(err, outOpts, out);
@@ -843,12 +927,12 @@ function formatRemaining(ms) {
   const seconds = totalSec % 60;
   return `${minutes}:${String(seconds).padStart(2, "0")}`;
 }
-async function runCheckpointPollWaitLoop(client, body, ctx) {
+async function runCheckpointPollWaitLoop(client, accountId, ctx) {
   const startedAt = ctx.now();
   let timeoutAt = ctx.timeoutOverrideMs !== void 0 ? startedAt + ctx.timeoutOverrideMs : void 0;
   await ctx.sleep(CHECKPOINT_POLL_FIRST_DELAY_MS);
   for (; ; ) {
-    const result = await client.accounts.pollCheckpoint(body);
+    const result = await client.accounts.pollCheckpoint(accountId);
     const r = result;
     if (r.status === "active") return { kind: "active", result };
     if (r.status === "expired" || r.status === "failed") {
@@ -867,26 +951,24 @@ async function runCheckpointPollWaitLoop(client, body, ctx) {
   }
 }
 async function runAccountCheckpointPoll(client, flags, out, io = {}) {
-  if (!flags.checkpoint) {
-    out.stderr.write("error: --checkpoint is required (the provisional account_id from the 202 response).\n");
+  if (!flags["account-id"]) {
+    out.stderr.write("error: account_id is required (the provisional account_id from the 202 response).\n");
     process.exit(2);
   }
-  const body = {
-    account_id: flags.checkpoint
-  };
+  const accountId = flags["account-id"] ?? "";
   const outOpts = resolveOutputOpts(flags);
   if (flags.preview) {
     const preview = buildPreviewOutput({
       method: "accounts.pollCheckpoint",
-      args: {},
-      body
+      args: { accountId },
+      body: {}
     });
     out.stdout.write(JSON.stringify(preview) + "\n");
     return;
   }
   if (!flags.wait) {
     try {
-      const result = await client.accounts.pollCheckpoint(body);
+      const result = await client.accounts.pollCheckpoint(accountId);
       renderSuccess(result, outOpts, out);
     } catch (err) {
       await handleError(err, outOpts, out);
@@ -904,10 +986,10 @@ async function runAccountCheckpointPoll(client, flags, out, io = {}) {
   }
   const resolvedIo = resolveCredentialIO(io);
   const showTicker = resolvedIo.isOutputTTY && !(flags.json ?? false);
-  printResendHintIfApplicable("mobile_app_approval", flags.checkpoint, out);
+  printResendHintIfApplicable("mobile_app_approval", accountId, out);
   let outcome;
   try {
-    outcome = await runCheckpointPollWaitLoop(client, body, {
+    outcome = await runCheckpointPollWaitLoop(client, accountId, {
       out,
       sleep: resolvedIo.sleep,
       now: resolvedIo.now,
@@ -931,7 +1013,7 @@ async function runAccountCheckpointPoll(client, flags, out, io = {}) {
   }
   renderSuccess(outcome.result, outOpts, out);
   out.stderr.write(
-    `Still waiting for approval \u2014 the wait window elapsed. Check again: curviate account checkpoint poll --checkpoint ${flags.checkpoint} --wait
+    `Still waiting for approval \u2014 the wait window elapsed. Check again: curviate account checkpoint poll ${accountId} --wait
 `
   );
   process.exit(AUTH_NEEDED);
@@ -983,7 +1065,7 @@ var accountGetCommand = defineCommand({
 var accountLinkCommand = defineCommand({
   meta: {
     name: "link",
-    description: "Connect a LinkedIn account to an empty seat. If LinkedIn requires verification you'll be prompted for the code interactively; in a non-interactive shell the command exits 12 and you finish with `curviate account checkpoint submit`."
+    description: "Connect a LinkedIn account to an empty seat. If LinkedIn requires verification you'll be prompted for the code interactively; in a non-interactive shell the command exits 12 and you finish with `curviate account checkpoint solve <account_id> --code`."
   },
   args: {
     ...WRITE_SINGLE_FLAGS,
@@ -1030,13 +1112,11 @@ var accountLinkCommand = defineCommand({
 var accountConnectLinkCommand = defineCommand({
   meta: {
     name: "connect-link",
-    description: "Generate a one-time hosted account connection URL. On an interactive TTY the URL auto-opens in your browser and the command waits for the account to connect (exit 0 on success, 9 if the link expires or fails, 12 if the wait window elapses first). Non-interactively it never opens a browser and returns immediately with the url and session_id \u2014 poll completion later with `account connect-session poll`."
+    description: "Generate a one-time hosted URL to connect a NEW LinkedIn account. On an interactive TTY the URL auto-opens in your browser and the command waits for the account to connect (exit 0 on success, 9 if the link expires or fails, 12 if the wait window elapses first). Non-interactively it never opens a browser and returns immediately with the url and session_id \u2014 poll completion later with `account connect-session poll`. To re-authorize an EXISTING account, use `account reconnect-link`."
   },
   args: {
     ...WRITE_SINGLE_FLAGS,
-    "seat-id": { type: "string", description: "Target seat (required when purpose=create)." },
-    "account-id": { type: "string", description: "Account to reconnect (required when purpose=reconnect)." },
-    purpose: { type: "string", description: "create | reconnect (default: create)." },
+    "seat-id": { type: "string", description: "Empty seat to bind the new account to.", required: true },
     "expires-in-seconds": { type: "string", description: "Link expiry in seconds (60\u20133600, default 900)." },
     "redirect-url": { type: "string", description: "Browser return URL after the hosted flow." },
     open: {
@@ -1072,6 +1152,47 @@ var accountConnectLinkCommand = defineCommand({
     await runAccountConnectLink(client, flags, out);
   }
 });
+var accountReconnectLinkCommand = defineCommand({
+  meta: {
+    name: "reconnect-link",
+    description: "Generate a one-time hosted URL to re-authorize an EXISTING disconnected account (the hosted counterpart of `account reconnect`). On an interactive TTY the URL auto-opens and the command waits for the account to reconnect (exit 0 on success, 9 if the link expires or fails, 12 if the wait window elapses first). Non-interactively it prints the url + session_id and returns immediately \u2014 poll completion later with `account connect-session poll`."
+  },
+  args: {
+    ...WRITE_SINGLE_FLAGS,
+    "account-id": { type: "positional", description: "Account id (acc_\u2026) to re-authorize." },
+    "expires-in-seconds": { type: "string", description: "Link expiry in seconds (60\u20133600, default 900)." },
+    "redirect-url": { type: "string", description: "Browser return URL after the hosted flow." },
+    open: {
+      type: "boolean",
+      description: "Auto-open the URL in your default browser. Default: on for an interactive TTY, always off otherwise (ignored non-interactively)."
+    },
+    wait: {
+      type: "boolean",
+      description: "Poll for the account to reconnect on an adaptive cadence (1000ms, then 1500ms for 30s, then 3000ms) after opening the URL. Default: on for an interactive TTY, always off otherwise."
+    },
+    // Override WRITE_SINGLE_FLAGS.timeout: --timeout is the interactive wait
+    // loop's own wall-clock bound in MILLISECONDS, not the SDK request timeout.
+    timeout: {
+      type: "string",
+      description: "Wait-loop timeout in milliseconds (only meaningful under the interactive TTY wait; default: time remaining to the link's expiry). Note the unit: this is milliseconds."
+    }
+  },
+  async run({ args }) {
+    const flags = args;
+    const cfg = await resolveEffectiveConfig({
+      apiKey: flags["api-key"],
+      baseUrl: flags["base-url"],
+      profile: flags.profile
+    });
+    if (!cfg.apiKey) {
+      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
+      process.exit(3);
+    }
+    const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
+    const out = buildOutputStreams();
+    await runAccountReconnectLink(client, flags, out);
+  }
+});
 var accountConnectSessionPollCommand = defineCommand({
   meta: {
     name: "poll",
@@ -1126,7 +1247,7 @@ var accountConnectSessionCommand = defineCommand({
 var accountReconnectCommand = defineCommand({
   meta: {
     name: "reconnect",
-    description: "Re-authorize a disconnected account in place. If LinkedIn requires verification you'll be prompted for the code interactively; in a non-interactive shell the command exits 12 and you finish with `curviate account checkpoint submit`."
+    description: "Re-authorize a disconnected account in place. If LinkedIn requires verification you'll be prompted for the code interactively; in a non-interactive shell the command exits 12 and you finish with `curviate account checkpoint solve <account_id> --code`."
   },
   args: {
     ...WRITE_SINGLE_FLAGS,
@@ -1170,36 +1291,13 @@ var accountReconnectCommand = defineCommand({
     await runAccountReconnect(client, flags, out);
   }
 });
-var accountRefreshCommand = defineCommand({
-  meta: { name: "refresh", description: "Refresh an account's synced data sources." },
-  args: {
-    ...WRITE_SINGLE_FLAGS,
-    "account-id": { type: "positional", description: "Account id (acc_\u2026)." }
-  },
-  async run({ args }) {
-    const flags = args;
-    const cfg = await resolveEffectiveConfig({
-      apiKey: flags["api-key"],
-      baseUrl: flags["base-url"],
-      timeout: flags.timeout,
-      profile: flags.profile
-    });
-    if (!cfg.apiKey) {
-      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
-      process.exit(3);
-    }
-    const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
-    const out = buildOutputStreams();
-    await runAccountRefresh(client, flags, out);
-  }
-});
 var accountUpdateCommand = defineCommand({
-  meta: { name: "update", description: "Update managed-proxy configuration for an account." },
+  meta: { name: "update", description: "Update an account's metadata and/or custom-proxy configuration." },
   args: {
     ...WRITE_SINGLE_FLAGS,
     "account-id": { type: "positional", description: "Account id (acc_\u2026)." },
-    country: { type: "string", description: "Proxy location hint (ISO 3166-1 alpha-2)." },
-    ip: { type: "string", description: "IP to infer the managed proxy location." },
+    metadata: { type: "string", description: `Custom metadata as a JSON object (flat string\u2192string map) \u2014 replaces the store wholesale. Example: '{"team":"growth"}'.` },
+    "clear-proxy": { type: "boolean", description: "Clear the custom proxy (revert to automatic proxy protection). Mutually exclusive with --proxy-host.", default: false },
     "proxy-protocol": { type: "string", description: "Proxy protocol: http | https | socks5." },
     "proxy-host": { type: "string", description: "Proxy host or IP." },
     "proxy-port": { type: "string", description: "Proxy port." },
@@ -1246,14 +1344,13 @@ var accountDisconnectCommand = defineCommand({
     await runAccountDisconnect(client, flags, out);
   }
 });
-var accountCheckpointSubmitCommand = defineCommand({
-  meta: { name: "submit", description: "Submit an OTP / 2FA code to resolve a checkpoint challenge." },
+var accountCheckpointSolveCommand = defineCommand({
+  meta: { name: "solve", description: "Solve a checkpoint challenge with an OTP / 2FA code." },
   args: {
     ...WRITE_SINGLE_FLAGS,
-    checkpoint: {
-      type: "string",
-      description: "The provisional account_id from the 202 checkpoint_required response.",
-      required: true
+    "account-id": {
+      type: "positional",
+      description: "The provisional account_id (acc_\u2026) from the 202 checkpoint_required response."
     },
     code: {
       type: "string",
@@ -1275,7 +1372,7 @@ var accountCheckpointSubmitCommand = defineCommand({
     }
     const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
     const out = buildOutputStreams();
-    await runAccountCheckpointSubmit(client, flags, out);
+    await runAccountCheckpointSolve(client, flags, out);
   }
 });
 var accountCheckpointPollCommand = defineCommand({
@@ -1285,10 +1382,9 @@ var accountCheckpointPollCommand = defineCommand({
   },
   args: {
     ...WRITE_SINGLE_FLAGS,
-    checkpoint: {
-      type: "string",
-      description: "The provisional account_id from the 202 checkpoint_required response.",
-      required: true
+    "account-id": {
+      type: "positional",
+      description: "The provisional account_id (acc_\u2026) from the 202 checkpoint_required response."
     },
     wait: {
       type: "boolean",
@@ -1320,17 +1416,16 @@ var accountCheckpointPollCommand = defineCommand({
     await runAccountCheckpointPoll(client, flags, out);
   }
 });
-var accountCheckpointResendCommand = defineCommand({
+var accountCheckpointRequestCommand = defineCommand({
   meta: {
-    name: "resend",
-    description: "Re-send the challenge notification for a pending checkpoint (e.g. re-send an OTP email, SMS code, or mobile-app approval push). Not every challenge type supports resend \u2014 an authenticator- app code has nothing to re-send. The response's `resent` boolean tells you honestly whether a new notification actually went out; the command still exits 0 either way."
+    name: "request",
+    description: "Re-request the challenge notification for a pending checkpoint (e.g. re-send an OTP email, SMS code, or mobile-app approval push). Not every challenge type supports it \u2014 an authenticator- app code has nothing to re-send. The response's `resent` boolean tells you honestly whether a new notification actually went out; the command still exits 0 either way."
   },
   args: {
     ...WRITE_SINGLE_FLAGS,
-    checkpoint: {
-      type: "string",
-      description: "The provisional account_id from the 202 checkpoint_required response.",
-      required: true
+    "account-id": {
+      type: "positional",
+      description: "The provisional account_id (acc_\u2026) from the 202 checkpoint_required response."
     }
   },
   async run({ args }) {
@@ -1347,21 +1442,21 @@ var accountCheckpointResendCommand = defineCommand({
     }
     const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
     const out = buildOutputStreams();
-    await runAccountCheckpointResend(client, flags, out);
+    await runAccountCheckpointRequest(client, flags, out);
   }
 });
 var accountCheckpointCommand = defineCommand({
   meta: {
     name: "checkpoint",
-    description: "Checkpoint challenge operations (submit OTP, poll mobile-app approval, or resend the challenge notification)."
+    description: "Checkpoint challenge operations (solve with an OTP, poll mobile-app approval, or re-request the challenge notification)."
   },
   subCommands: {
-    submit: accountCheckpointSubmitCommand,
+    solve: accountCheckpointSolveCommand,
     poll: accountCheckpointPollCommand,
-    resend: accountCheckpointResendCommand
+    request: accountCheckpointRequestCommand
   },
   async run() {
-    process.stderr.write("Usage: curviate account checkpoint submit | poll | resend\n");
+    process.stderr.write("Usage: curviate account checkpoint solve <account_id> --code <code> | poll <account_id> | request <account_id>\n");
   }
 });
 var accountCommand = defineCommand({
@@ -1371,24 +1466,24 @@ var accountCommand = defineCommand({
     get: accountGetCommand,
     link: accountLinkCommand,
     "connect-link": accountConnectLinkCommand,
+    "reconnect-link": accountReconnectLinkCommand,
     "connect-session": accountConnectSessionCommand,
     reconnect: accountReconnectCommand,
-    refresh: accountRefreshCommand,
     update: accountUpdateCommand,
     disconnect: accountDisconnectCommand,
     checkpoint: accountCheckpointCommand
   },
   async run() {
     process.stderr.write(
-      "Usage: curviate account <subcommand>\n  list | get | link | connect-link | connect-session poll | reconnect | refresh | update | disconnect | checkpoint\n"
+      "Usage: curviate account <subcommand>\n  list | get | link | connect-link | reconnect-link | connect-session poll | reconnect | update | disconnect | checkpoint\n"
     );
   }
 });
 export {
   accountCommand,
   runAccountCheckpointPoll,
-  runAccountCheckpointResend,
-  runAccountCheckpointSubmit,
+  runAccountCheckpointRequest,
+  runAccountCheckpointSolve,
   runAccountConnectLink,
   runAccountConnectSessionPoll,
   runAccountDisconnect,
@@ -1396,6 +1491,6 @@ export {
   runAccountLink,
   runAccountList,
   runAccountReconnect,
-  runAccountRefresh,
+  runAccountReconnectLink,
   runAccountUpdate
 };

package/dist/cli.js

@@ -152,8 +152,8 @@ var main = defineCommand({
     inbox: () => import("./inbox-DN7X7CM2.js").then((m) => m.inboxCommand),
     message: () => import("./message-6K5E3CUF.js").then((m) => m.messageCommand),
     post: () => import("./post-2JQZ3OSF.js").then((m) => m.postCommand),
-    account: () => import("./account-NZBO6Y5I.js").then((m) => m.accountCommand),
-    webhook: () => import("./webhook-XPWBI675.js").then((m) => m.webhookCommand),
+    account: () => import("./account-7AUDAMIK.js").then((m) => m.accountCommand),
+    webhook: () => import("./webhook-EIY5WWTE.js").then((m) => m.webhookCommand),
     "sales-nav": () => import("./sales-nav-QTSTJMKA.js").then((m) => m.salesNavCommand),
     recruiter: () => import("./recruiter-XHVMQWK6.js").then((m) => m.recruiterCommand)
   },

package/dist/{webhook-XPWBI675.js → webhook-EIY5WWTE.js}

@@ -134,6 +134,17 @@ async function runWebhookEvents(client, flags, out) {
     await handleError(err, outOpts, out);
   }
 }
+async function runWebhookGet(client, flags, out) {
+  rejectPreviewOnRead(flags.preview, out);
+  const id = flags.id ?? "";
+  const outOpts = resolveOutputOpts(flags);
+  try {
+    const result = await client.webhooks.get(id);
+    renderSuccess(result, outOpts, out);
+  } catch (err) {
+    await handleError(err, outOpts, out);
+  }
+}
 async function runWebhookUpdate(client, flags, out) {
   if (flags.source !== void 0) {
     out.stderr.write("error: --source cannot be changed after creation (source is immutable).\n");
@@ -302,6 +313,29 @@ var webhookEventsCommand = defineCommand({
     await runWebhookEvents(client, flags, out);
   }
 });
+var webhookGetCommand = defineCommand({
+  meta: { name: "get", description: "Get a single webhook owned by the calling tenant." },
+  args: {
+    ...GLOBAL_FLAGS,
+    id: { type: "positional", description: "Webhook id (wh_\u2026)." }
+  },
+  async run({ args }) {
+    const flags = args;
+    const cfg = await resolveEffectiveConfig({
+      apiKey: flags["api-key"],
+      baseUrl: flags["base-url"],
+      timeout: flags.timeout,
+      profile: flags.profile
+    });
+    if (!cfg.apiKey) {
+      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
+      process.exit(3);
+    }
+    const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
+    const out = buildOutputStreams();
+    await runWebhookGet(client, flags, out);
+  }
+});
 var webhookUpdateCommand = defineCommand({
   meta: { name: "update", description: "Update a webhook in place (source is immutable)." },
   args: {
@@ -423,6 +457,7 @@ var webhookCommand = defineCommand({
     create: webhookCreateCommand,
     list: webhookListCommand,
     events: webhookEventsCommand,
+    get: webhookGetCommand,
     update: webhookUpdateCommand,
     delete: webhookDeleteCommand,
     "state-diff": webhookStateDiffCommand,
@@ -430,7 +465,7 @@ var webhookCommand = defineCommand({
   },
   async run() {
     process.stderr.write(
-      "Usage: curviate webhook <subcommand>\n  create | list | events | update | delete | state-diff | verify\n"
+      "Usage: curviate webhook <subcommand>\n  create | list | events | get | update | delete | state-diff | verify\n"
     );
   }
 });
@@ -438,6 +473,7 @@ export {
   runWebhookCreate,
   runWebhookDelete,
   runWebhookEvents,
+  runWebhookGet,
   runWebhookList,
   runWebhookStateDiff,
   runWebhookUpdate,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@curviate/cli",
-  "version": "0.12.0",
+  "version": "0.14.0",
   "private": false,
   "description": "Official command-line interface for the Curviate API.",
   "license": "MIT",
@@ -40,7 +40,7 @@
     "clean": "rm -rf dist *.tsbuildinfo"
   },
   "dependencies": {
-    "@curviate/sdk": "^0.12.0",
+    "@curviate/sdk": "^0.14.0",
     "citty": "^0.1.6",
     "open": "^10.1.0"
   },