@curviate/cli 0.20.0 → 0.21.0

package/CHANGELOG.md

@@ -8,6 +8,44 @@ a new command or flag is a minor; a breaking command/flag/exit-code change is a
 
 ## [Unreleased]
 
+## [0.21.0] - 2026-08-04
+
+A correctness release for every argument that reads from stdin. Upgrade
+immediately if you are on 0.20.0: on that version the documented quick-start
+login silently stored a placeholder instead of your API key, so the very first
+command after it failed and blamed your key.
+
+### Fixed
+
+- **`curviate login --api-key -` now stores the piped key.** It previously
+  reported success and exited 0 while writing the literal string
+  `__curviate_stdin__` into your config, so every later command answered 401 and
+  attributed the failure to your API key. That is the first command in the
+  quick-start, so a new install failed on first contact with a misleading cause.
+
+- **Eleven further arguments documented as accepting `-` now read stdin.** Each
+  compared its raw value against `-`, but the dispatcher had already substituted
+  an internal placeholder by that point, so the branch was unreachable and the
+  placeholder was consumed as your data. Affected: `--filters` on the eight
+  search and list commands, and `--body` on the three recruiter and webhook
+  commands, which answered `--filters is not valid JSON` or
+  `--body only accepts '-'` to a caller who had passed exactly that.
+
+### Changed
+
+- **A bare `-` is only special on an argument that declares a stdin contract.**
+  Every other argument now receives a literal `-`, restored between the parser
+  and the handler. Previously the substitution was indiscriminate, so a bare `-`
+  became the internal placeholder at any argument, including places where it
+  then travelled to the wire as a value. If you were relying on `-` being read
+  from stdin on an argument whose help text does not describe that behaviour, it
+  no longer is; the arguments that document the contract are unchanged.
+
+- **The internal placeholder can no longer leave the process.** The request
+  transport and the config writer both refuse it as a defence in depth backstop,
+  and report what to do instead, so no future argument can leak it into a
+  request or a config file.
+
 ## [0.20.0] - 2026-08-03
 
 A safety and correctness release. Upgrade promptly: it closes a path by which a

package/dist/{account-2SOSCEB6.js → account-A3FOYUKC.js}

@@ -5,9 +5,6 @@ import {
 import {
   AUTH_NEEDED
 } from "./chunk-M6UDWFHX.js";
-import {
-  defaultReadStdin
-} from "./chunk-U7Y4EXHT.js";
 import {
   slimAccountGet,
   slimAccountList,
@@ -26,12 +23,15 @@ import {
   renderSuccess,
   renderUnexpectedError,
   resolveEffectiveConfig
-} from "./chunk-HDQUEFD2.js";
+} from "./chunk-LMVDURUZ.js";
 import {
   GLOBAL_FLAGS,
   READ_SINGLE_FLAGS,
   WRITE_SINGLE_FLAGS
-} from "./chunk-DW2HCRXJ.js";
+} from "./chunk-CUTMZWL6.js";
+import {
+  defaultReadStdin
+} from "./chunk-ZYURL5VK.js";
 
 // src/commands/account.ts
 import { defineCommand } from "citty";

package/dist/{chunk-42VUUKQ3.js → chunk-56ORAZJO.js}

@@ -1,4 +1,7 @@
 #!/usr/bin/env node
+import {
+  isStdinToken
+} from "./chunk-ZYURL5VK.js";
 
 // src/lib/search-filters.ts
 import { readFile } from "fs/promises";
@@ -23,7 +26,7 @@ async function assembleFilters(flags, readers = DEFAULT_FILTER_READERS) {
     } catch {
       return { error: `cannot read ${source}` };
     }
-  } else if (flags.filters === "-") {
+  } else if (isStdinToken(flags.filters)) {
     source = "--filters - (stdin)";
     raw = await readers.readStdin();
   } else if (flags.filters !== void 0) {

package/dist/{chunk-DW2HCRXJ.js → chunk-CUTMZWL6.js}

@@ -1,4 +1,7 @@
 #!/usr/bin/env node
+import {
+  assertNoStdinPlaceholder
+} from "./chunk-ZYURL5VK.js";
 
 // src/lib/config.ts
 import {
@@ -37,6 +40,7 @@ async function writeConfig(cfg) {
   } catch {
   }
   const content = JSON.stringify(cfg, null, 2) + "\n";
+  assertNoStdinPlaceholder("the configuration about to be written", [content]);
   const tmpPath = join(
     tmpdir(),
     `curviate-cfg-${randomBytes(6).toString("hex")}.tmp`

package/dist/{chunk-HDQUEFD2.js → chunk-LMVDURUZ.js}

@@ -1,7 +1,10 @@
 #!/usr/bin/env node
 import {
   readConfig
-} from "./chunk-DW2HCRXJ.js";
+} from "./chunk-CUTMZWL6.js";
+import {
+  assertNoStdinPlaceholder
+} from "./chunk-ZYURL5VK.js";
 
 // src/lib/resolve.ts
 var DEFAULT_BASE_URL = "https://api.curviate.com";
@@ -20,9 +23,28 @@ async function resolveEffectiveConfig(flags) {
 
 // src/lib/client.ts
 import { Curviate } from "@curviate/sdk";
+function headerStrings(headers) {
+  if (!headers) return [];
+  if (headers instanceof Headers) {
+    const out = [];
+    headers.forEach((value, key) => out.push(key, value));
+    return out;
+  }
+  if (Array.isArray(headers)) return headers.flat().map(String);
+  return Object.entries(headers).flat().map(String);
+}
+var guardedFetch = (input, init) => {
+  assertNoStdinPlaceholder("the request about to be sent", [
+    String(input instanceof Request ? input.url : input),
+    ...headerStrings(init?.headers),
+    typeof init?.body === "string" ? init.body : void 0
+  ]);
+  return fetch(input, init);
+};
 function createClient(config) {
   return new Curviate({
     apiKey: config.apiKey.trim(),
+    fetch: guardedFetch,
     ...config.baseUrl !== void 0 ? { baseUrl: config.baseUrl } : {},
     ...config.timeout !== void 0 ? { timeout: config.timeout } : {}
   });

package/dist/{chunk-IGCQNDIG.js → chunk-Q7XG2VIF.js}

@@ -3,9 +3,6 @@ import {
   looksLikeCommandWord,
   nearestSubcommand
 } from "./chunk-HOQ7EUHJ.js";
-import {
-  resolveTextOrStdin
-} from "./chunk-U7Y4EXHT.js";
 import {
   AttachError,
   readAttachment,
@@ -28,11 +25,14 @@ import {
   renderSuccess,
   renderUnexpectedError,
   resolveEffectiveConfig
-} from "./chunk-HDQUEFD2.js";
+} from "./chunk-LMVDURUZ.js";
 import {
   READ_SINGLE_FLAGS,
   WRITE_FLAGS
-} from "./chunk-DW2HCRXJ.js";
+} from "./chunk-CUTMZWL6.js";
+import {
+  resolveTextOrStdin
+} from "./chunk-ZYURL5VK.js";
 
 // src/commands/message.ts
 import { defineCommand } from "citty";
@@ -393,7 +393,7 @@ var messageNewCommand = defineCommand({
       description: "Recipient: LinkedIn profile URL (e.g. https://www.linkedin.com/in/some-slug), bare slug (e.g. some-slug), or provider ID (e.g. ACoAAA\u2026). URL and slug inputs resolve the provider ID automatically.",
       required: true
     },
-    text: { type: "positional", description: "Opening message text. Pass - to read from stdin (e.g. via heredoc or pipe)." },
+    text: { type: "positional", stdinArg: true, description: "Opening message text. Pass - to read from stdin (e.g. via heredoc or pipe)." },
     attach: { type: "string", description: "File to attach (repeatable)." }
   },
   async run({ args }) {
@@ -447,7 +447,7 @@ var messageEditCommand = defineCommand({
     ...WRITE_FLAGS,
     chatId: { type: "positional", description: "Chat ID or LinkedIn messaging thread URL." },
     messageId: { type: "positional", description: "Message ID." },
-    text: { type: "positional", description: "Replacement text. Pass - to read from stdin." }
+    text: { type: "positional", stdinArg: true, description: "Replacement text. Pass - to read from stdin." }
   },
   async run({ args }) {
     const flags = args;
@@ -569,7 +569,7 @@ var messageInMailCommand = defineCommand({
       required: true
     },
     subject: { type: "string", description: "InMail subject line.", required: true },
-    text: { type: "positional", description: "InMail body text. Pass - to read from stdin." }
+    text: { type: "positional", stdinArg: true, description: "InMail body text. Pass - to read from stdin." }
   },
   async run({ args }) {
     const flags = args;
@@ -601,7 +601,7 @@ var messageSendCommand = defineCommand({
       type: "positional",
       description: "Chat ID or LinkedIn messaging thread URL. A COMPANY_ chat id sends as the company page; any other chat id sends as the connected member."
     },
-    text: { type: "positional", description: "Message text. Pass - to read from stdin (e.g. via heredoc or pipe)." },
+    text: { type: "positional", stdinArg: true, description: "Message text. Pass - to read from stdin (e.g. via heredoc or pipe)." },
     attach: { type: "string", description: "File to attach (repeatable)." }
   },
   async run({ args }) {
@@ -691,7 +691,7 @@ var messageCommand = defineCommand({
       description: "Chat ID to send a message to. A COMPANY_ chat id sends as the company page.",
       required: false
     },
-    text: { type: "positional", description: "Message text. Pass - to read from stdin.", required: false },
+    text: { type: "positional", stdinArg: true, description: "Message text. Pass - to read from stdin.", required: false },
     attach: { type: "string", description: "File to attach (repeatable)." }
   },
   subCommands: {

package/dist/chunk-ZYURL5VK.js

@@ -0,0 +1,83 @@
+#!/usr/bin/env node
+
+// src/lib/stdin.ts
+var STDIN_SENTINEL = "__curviate_stdin__";
+async function defaultReadStdin() {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    process.stdin.on("data", (chunk) => {
+      chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+    });
+    process.stdin.on("end", () => {
+      const full = Buffer.concat(chunks).toString("utf8");
+      resolve(full.replace(/\n+$/, ""));
+    });
+    process.stdin.on("error", reject);
+  });
+}
+function isStdinToken(value) {
+  return value === "-" || value === STDIN_SENTINEL;
+}
+function declaresStdinArg(def) {
+  return def?.stdinArg === true;
+}
+function restoreLiteralDashes(args, argsDef) {
+  const declaring = /* @__PURE__ */ new Set();
+  const positionalNames = [];
+  for (const [name, def] of Object.entries(argsDef)) {
+    if (def?.type === "positional") positionalNames.push(name);
+    if (!declaresStdinArg(def)) continue;
+    declaring.add(name);
+    const alias = def.alias;
+    if (typeof alias === "string") declaring.add(alias);
+    else if (Array.isArray(alias)) for (const a of alias) declaring.add(a);
+  }
+  const put = (value) => {
+    if (value === STDIN_SENTINEL) return "-";
+    if (Array.isArray(value)) return value.map((e) => e === STDIN_SENTINEL ? "-" : e);
+    return value;
+  };
+  for (const key of Object.keys(args)) {
+    if (key === "_" || declaring.has(key)) continue;
+    args[key] = put(args[key]);
+  }
+  const rest = args["_"];
+  if (Array.isArray(rest)) {
+    for (let i = 0; i < rest.length; i++) {
+      const name = positionalNames[i];
+      if (name !== void 0 && declaring.has(name)) continue;
+      if (rest[i] === STDIN_SENTINEL) rest[i] = "-";
+    }
+  }
+}
+function assertNoStdinPlaceholder(where, values) {
+  if (!values.some((v) => typeof v === "string" && v.includes(STDIN_SENTINEL))) return;
+  process.stderr.write(
+    `error: refusing to continue. ${where} contains "${STDIN_SENTINEL}", the internal placeholder the CLI substitutes for a bare "-" while it parses arguments.
+`
+  );
+  process.stderr.write(
+    `hint: that placeholder means "read this value from stdin" and must never leave the process. Check the value you supplied, including environment variables such as CURVIATE_ACCOUNT and CURVIATE_API_KEY. If you did not supply it yourself, this is a bug in the CLI. Nothing was sent or written.
+`
+  );
+  process.exit(1);
+}
+async function resolveTextOrStdin(rawText, out, readStdin) {
+  if (!isStdinToken(rawText)) return rawText;
+  const reader = readStdin ?? defaultReadStdin;
+  const text = await reader();
+  if (!text) {
+    out.stderr.write("error: stdin: empty input\n");
+    process.exit(2);
+  }
+  return text;
+}
+
+export {
+  STDIN_SENTINEL,
+  defaultReadStdin,
+  isStdinToken,
+  restoreLiteralDashes,
+  assertNoStdinPlaceholder,
+  resolveTextOrStdin
+};

package/dist/cli.js

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 import {
-  STDIN_SENTINEL
-} from "./chunk-U7Y4EXHT.js";
+  STDIN_SENTINEL,
+  restoreLiteralDashes
+} from "./chunk-ZYURL5VK.js";
 
 // src/cli.ts
 import { defineCommand } from "citty";
@@ -221,7 +222,21 @@ async function dispatch(root, rawArgs) {
       usageError(`unknown flag \`${unknown}\`.`);
     }
     const processedLeafArgs = leafArgs.map((a) => a === "-" ? STDIN_SENTINEL : a);
-    const leafToRun = { ...leaf, subCommands: void 0 };
+    const leafArgsDef = await resolveValue(leaf.args ?? {});
+    const originalRun = leaf.run;
+    const leafToRun = {
+      ...leaf,
+      subCommands: void 0,
+      ...originalRun ? {
+        run: (ctx) => {
+          restoreLiteralDashes(
+            ctx.args,
+            leafArgsDef
+          );
+          return originalRun(ctx);
+        }
+      } : {}
+    };
     await runCommand(leafToRun, { rawArgs: processedLeafArgs });
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
@@ -247,28 +262,28 @@ var main = defineCommand({
   // Subcommand registry — names and descriptions are static for help rendering;
   // the handler implementation is loaded lazily on first invocation.
   subCommands: {
-    login: () => import("./login-W7NCDZOQ.js").then((m) => m.loginCommand),
-    config: () => import("./config-3O4N2XSH.js").then((m) => m.configCommand),
+    login: () => import("./login-ZLDDIAFW.js").then((m) => m.loginCommand),
+    config: () => import("./config-FPWWYG7G.js").then((m) => m.configCommand),
     // ---------------------------------------------------------------------------
     // Noun groups — lazy-loaded on first invocation.
     // ---------------------------------------------------------------------------
-    profile: () => import("./profile-A2TWF4HB.js").then((m) => m.profileCommand),
-    company: () => import("./company-BX4VDXZX.js").then((m) => m.companyCommand),
-    job: () => import("./job-TYBA2DUQ.js").then((m) => m.jobCommand),
-    connect: () => import("./connect-KWOJKCIB.js").then((m) => m.connectCommand),
-    search: () => import("./search-DH6BJFQC.js").then((m) => m.searchCommand),
-    inbox: () => import("./inbox-GMGZVDTQ.js").then((m) => m.inboxCommand),
-    inboxes: () => import("./inboxes-YVYLSM5W.js").then((m) => m.inboxesCommand),
-    message: () => import("./message-C6FV6JH6.js").then((m) => m.messageCommand),
-    post: () => import("./post-RETV3WUG.js").then((m) => m.postCommand),
-    comment: () => import("./comment-AXDINBPS.js").then((m) => m.commentCommand),
-    account: () => import("./account-2SOSCEB6.js").then((m) => m.accountCommand),
-    webhook: () => import("./webhook-LED6AKF3.js").then((m) => m.webhookCommand),
-    "sales-nav": () => import("./sales-nav-SSJIZUNB.js").then((m) => m.salesNavCommand),
-    recruiter: () => import("./recruiter-FQAKY6Z2.js").then((m) => m.recruiterCommand),
-    group: () => import("./group-L7TQEEFN.js").then((m) => m.groupCommand),
-    feed: () => import("./feed-4ROKUBG5.js").then((m) => m.feedCommand),
-    notification: () => import("./notification-45XFT3S4.js").then((m) => m.notificationCommand)
+    profile: () => import("./profile-XOMDIYSY.js").then((m) => m.profileCommand),
+    company: () => import("./company-DFJK2RHM.js").then((m) => m.companyCommand),
+    job: () => import("./job-WOPIAHOR.js").then((m) => m.jobCommand),
+    connect: () => import("./connect-ELSSMOIC.js").then((m) => m.connectCommand),
+    search: () => import("./search-NDESJC3Y.js").then((m) => m.searchCommand),
+    inbox: () => import("./inbox-G6KNWWLI.js").then((m) => m.inboxCommand),
+    inboxes: () => import("./inboxes-NTTYCQPM.js").then((m) => m.inboxesCommand),
+    message: () => import("./message-KJXY5RCD.js").then((m) => m.messageCommand),
+    post: () => import("./post-A7YZWBFG.js").then((m) => m.postCommand),
+    comment: () => import("./comment-RPLZHFJQ.js").then((m) => m.commentCommand),
+    account: () => import("./account-A3FOYUKC.js").then((m) => m.accountCommand),
+    webhook: () => import("./webhook-TNZF3FMN.js").then((m) => m.webhookCommand),
+    "sales-nav": () => import("./sales-nav-5ZRE2UAQ.js").then((m) => m.salesNavCommand),
+    recruiter: () => import("./recruiter-CCLG4PM4.js").then((m) => m.recruiterCommand),
+    group: () => import("./group-52MP24W3.js").then((m) => m.groupCommand),
+    feed: () => import("./feed-23Z7OQNL.js").then((m) => m.feedCommand),
+    notification: () => import("./notification-MNEABNVW.js").then((m) => m.notificationCommand)
   },
   async run() {
     const { runMain } = await import("citty");

package/dist/{comment-AXDINBPS.js → comment-RPLZHFJQ.js}

@@ -2,9 +2,6 @@
 import {
   resolveMemberOrMeProviderId
 } from "./chunk-QJZ3LWOX.js";
-import {
-  resolveTextOrStdin
-} from "./chunk-U7Y4EXHT.js";
 import {
   AttachError,
   describeAttachment,
@@ -25,11 +22,14 @@ import {
   renderSuccess,
   renderUnexpectedError,
   resolveEffectiveConfig
-} from "./chunk-HDQUEFD2.js";
+} from "./chunk-LMVDURUZ.js";
 import {
   GLOBAL_FLAGS,
   WRITE_SINGLE_FLAGS
-} from "./chunk-DW2HCRXJ.js";
+} from "./chunk-CUTMZWL6.js";
+import {
+  resolveTextOrStdin
+} from "./chunk-ZYURL5VK.js";
 
 // src/commands/comment.ts
 import { defineCommand } from "citty";
@@ -452,7 +452,7 @@ var commentAddCommand = defineCommand({
   args: {
     ...WRITE_SINGLE_FLAGS,
     postId: { type: "positional", description: "Post id to comment on." },
-    text: { type: "positional", description: "Comment text. Pass - to read from stdin." },
+    text: { type: "positional", stdinArg: true, description: "Comment text. Pass - to read from stdin." },
     attach: { type: "string", description: "Image file to attach (at most one)." }
   },
   async run({ args }) {
@@ -465,7 +465,7 @@ var commentReplyCommand = defineCommand({
     ...WRITE_SINGLE_FLAGS,
     postId: { type: "positional", description: "Post id the comment belongs to." },
     commentId: { type: "positional", description: "Comment id to reply to." },
-    text: { type: "positional", description: "Reply text. Pass - to read from stdin." },
+    text: { type: "positional", stdinArg: true, description: "Reply text. Pass - to read from stdin." },
     attach: { type: "string", description: "Image file to attach (at most one)." }
   },
   async run({ args }) {
@@ -478,7 +478,7 @@ var commentEditCommand = defineCommand({
     ...WRITE_SINGLE_FLAGS,
     postId: { type: "positional", description: "Post id the comment belongs to." },
     commentId: { type: "positional", description: "Comment id to edit." },
-    text: { type: "positional", description: "Updated comment text. Pass - to read from stdin." }
+    text: { type: "positional", stdinArg: true, description: "Updated comment text. Pass - to read from stdin." }
   },
   async run({ args }) {
     await withClient(args, (c, f, o) => runCommentEdit(c, f, o, void 0));

package/dist/{company-BX4VDXZX.js → company-DFJK2RHM.js}

@@ -1,11 +1,8 @@
 #!/usr/bin/env node
 import {
   sentAsNotice
-} from "./chunk-IGCQNDIG.js";
+} from "./chunk-Q7XG2VIF.js";
 import "./chunk-HOQ7EUHJ.js";
-import {
-  resolveTextOrStdin
-} from "./chunk-U7Y4EXHT.js";
 import {
   AttachError,
   readAttachment,
@@ -37,11 +34,14 @@ import {
   renderSuccess,
   renderUnexpectedError,
   resolveEffectiveConfig
-} from "./chunk-HDQUEFD2.js";
+} from "./chunk-LMVDURUZ.js";
 import {
   GLOBAL_FLAGS,
   WRITE_FLAGS
-} from "./chunk-DW2HCRXJ.js";
+} from "./chunk-CUTMZWL6.js";
+import {
+  resolveTextOrStdin
+} from "./chunk-ZYURL5VK.js";
 
 // src/commands/company.ts
 import { defineCommand } from "citty";
@@ -824,7 +824,7 @@ var companyReplyCommand = defineCommand({
       type: "positional",
       description: "The 2-\u2026 chat id from `company chats`, passed through verbatim (no client-side check)."
     },
-    text: { type: "positional", description: "Reply text. Pass - to read from stdin (e.g. via heredoc or pipe)." },
+    text: { type: "positional", stdinArg: true, description: "Reply text. Pass - to read from stdin (e.g. via heredoc or pipe)." },
     attach: { type: "string", description: "File to attach (repeatable)." }
   },
   async run({ args }) {

package/dist/{config-3O4N2XSH.js → config-FPWWYG7G.js}

@@ -7,7 +7,8 @@ import {
   renameProfile,
   setActiveProfile,
   updateProfileField
-} from "./chunk-DW2HCRXJ.js";
+} from "./chunk-CUTMZWL6.js";
+import "./chunk-ZYURL5VK.js";
 
 // src/commands/config.ts
 import { defineCommand } from "citty";

package/dist/{connect-KWOJKCIB.js → connect-ELSSMOIC.js}

@@ -24,11 +24,12 @@ import {
   renderSuccess,
   renderUnexpectedError,
   resolveEffectiveConfig
-} from "./chunk-HDQUEFD2.js";
+} from "./chunk-LMVDURUZ.js";
 import {
   GLOBAL_FLAGS,
   WRITE_FLAGS
-} from "./chunk-DW2HCRXJ.js";
+} from "./chunk-CUTMZWL6.js";
+import "./chunk-ZYURL5VK.js";
 
 // src/commands/connect.ts
 import { defineCommand } from "citty";

package/dist/{feed-4ROKUBG5.js → feed-23Z7OQNL.js}

@@ -9,10 +9,11 @@ import {
   renderSuccess,
   renderUnexpectedError,
   resolveEffectiveConfig
-} from "./chunk-HDQUEFD2.js";
+} from "./chunk-LMVDURUZ.js";
 import {
   GLOBAL_FLAGS
-} from "./chunk-DW2HCRXJ.js";
+} from "./chunk-CUTMZWL6.js";
+import "./chunk-ZYURL5VK.js";
 
 // src/commands/feed.ts
 import { defineCommand } from "citty";

package/dist/{group-L7TQEEFN.js → group-52MP24W3.js}

@@ -9,11 +9,12 @@ import {
   renderSuccess,
   renderUnexpectedError,
   resolveEffectiveConfig
-} from "./chunk-HDQUEFD2.js";
+} from "./chunk-LMVDURUZ.js";
 import {
   GLOBAL_FLAGS,
   READ_SINGLE_FLAGS
-} from "./chunk-DW2HCRXJ.js";
+} from "./chunk-CUTMZWL6.js";
+import "./chunk-ZYURL5VK.js";
 
 // src/commands/group.ts
 import { defineCommand } from "citty";

package/dist/{inbox-GMGZVDTQ.js → inbox-G6KNWWLI.js}

@@ -15,12 +15,13 @@ import {
   renderSuccess,
   renderUnexpectedError,
   resolveEffectiveConfig
-} from "./chunk-HDQUEFD2.js";
+} from "./chunk-LMVDURUZ.js";
 import {
   GLOBAL_FLAGS,
   READ_SINGLE_FLAGS,
   WRITE_SINGLE_FLAGS
-} from "./chunk-DW2HCRXJ.js";
+} from "./chunk-CUTMZWL6.js";
+import "./chunk-ZYURL5VK.js";
 
 // src/commands/inbox.ts
 import { defineCommand } from "citty";

package/dist/{inboxes-YVYLSM5W.js → inboxes-NTTYCQPM.js}

@@ -9,11 +9,12 @@ import {
   renderSuccess,
   renderUnexpectedError,
   resolveEffectiveConfig
-} from "./chunk-HDQUEFD2.js";
+} from "./chunk-LMVDURUZ.js";
 import {
   GLOBAL_FLAGS,
   READ_SINGLE_FLAGS
-} from "./chunk-DW2HCRXJ.js";
+} from "./chunk-CUTMZWL6.js";
+import "./chunk-ZYURL5VK.js";
 
 // src/commands/inboxes.ts
 import { defineCommand } from "citty";

package/dist/{job-TYBA2DUQ.js → job-WOPIAHOR.js}

@@ -24,12 +24,13 @@ import {
   renderSuccess,
   renderUnexpectedError,
   resolveEffectiveConfig
-} from "./chunk-HDQUEFD2.js";
+} from "./chunk-LMVDURUZ.js";
 import {
   GLOBAL_FLAGS,
   READ_SINGLE_FLAGS,
   WRITE_SINGLE_FLAGS
-} from "./chunk-DW2HCRXJ.js";
+} from "./chunk-CUTMZWL6.js";
+import "./chunk-ZYURL5VK.js";
 
 // src/commands/job.ts
 import { defineCommand } from "citty";

package/dist/{login-W7NCDZOQ.js → login-ZLDDIAFW.js}

@@ -5,7 +5,11 @@ import {
 import {
   GLOBAL_FLAGS,
   writeProfile
-} from "./chunk-DW2HCRXJ.js";
+} from "./chunk-CUTMZWL6.js";
+import {
+  defaultReadStdin,
+  resolveTextOrStdin
+} from "./chunk-ZYURL5VK.js";
 
 // src/commands/login.ts
 import { defineCommand } from "citty";
@@ -43,6 +47,7 @@ var loginCommand = defineCommand({
     ...GLOBAL_FLAGS,
     "api-key": {
       type: "string",
+      stdinArg: true,
       description: 'API key to save. Pass "-" to read from stdin (keeps the key off argv).'
     },
     account: {
@@ -58,8 +63,13 @@ var loginCommand = defineCommand({
   async run({ args }) {
     const profileName = args.profile ?? "default";
     let apiKey = args["api-key"];
-    if (apiKey === "-") {
-      apiKey = await readStdin();
+    const out = { stderr: { write: (s) => process.stderr.write(s) } };
+    if (apiKey !== void 0) {
+      apiKey = await resolveTextOrStdin(
+        apiKey,
+        out,
+        async () => (await defaultReadStdin()).trim()
+      );
     }
     if (apiKey === void 0) {
       if (process.stdin.isTTY) {
@@ -72,7 +82,6 @@ var loginCommand = defineCommand({
         return;
       }
     }
-    const out = { stderr: { write: (s) => process.stderr.write(s) } };
     await runLogin(
       {
         "api-key": apiKey,
@@ -84,16 +93,6 @@ var loginCommand = defineCommand({
     );
   }
 });
-async function readStdin() {
-  return new Promise((resolve, reject) => {
-    const chunks = [];
-    process.stdin.on("data", (chunk) => chunks.push(chunk));
-    process.stdin.on("end", () => {
-      resolve(Buffer.concat(chunks).toString("utf8").trim());
-    });
-    process.stdin.on("error", reject);
-  });
-}
 async function promptMasked(prompt) {
   return readlineSync(prompt, { mask: true });
 }

package/dist/{message-C6FV6JH6.js → message-KJXY5RCD.js}

@@ -13,15 +13,15 @@ import {
   runMessageSend,
   sentAsNotice,
   willSendAsNotice
-} from "./chunk-IGCQNDIG.js";
+} from "./chunk-Q7XG2VIF.js";
 import "./chunk-HOQ7EUHJ.js";
-import "./chunk-U7Y4EXHT.js";
 import "./chunk-BGZW6B7G.js";
 import "./chunk-UWO2D4HW.js";
 import "./chunk-DMQZEPQE.js";
 import "./chunk-R3VLWLVV.js";
-import "./chunk-HDQUEFD2.js";
-import "./chunk-DW2HCRXJ.js";
+import "./chunk-LMVDURUZ.js";
+import "./chunk-CUTMZWL6.js";
+import "./chunk-ZYURL5VK.js";
 export {
   guardBareMessageForm,
   messageCommand,

package/dist/{notification-45XFT3S4.js → notification-MNEABNVW.js}

@@ -12,11 +12,12 @@ import {
   renderSuccess,
   renderUnexpectedError,
   resolveEffectiveConfig
-} from "./chunk-HDQUEFD2.js";
+} from "./chunk-LMVDURUZ.js";
 import {
   GLOBAL_FLAGS,
   WRITE_SINGLE_FLAGS
-} from "./chunk-DW2HCRXJ.js";
+} from "./chunk-CUTMZWL6.js";
+import "./chunk-ZYURL5VK.js";
 
 // src/commands/notification.ts
 import { defineCommand } from "citty";

package/dist/{post-RETV3WUG.js → post-A7YZWBFG.js}

@@ -2,9 +2,6 @@
 import {
   resolveMemberOrMeProviderId
 } from "./chunk-QJZ3LWOX.js";
-import {
-  resolveTextOrStdin
-} from "./chunk-U7Y4EXHT.js";
 import {
   AttachError,
   readAttachment,
@@ -24,12 +21,15 @@ import {
   renderSuccess,
   renderUnexpectedError,
   resolveEffectiveConfig
-} from "./chunk-HDQUEFD2.js";
+} from "./chunk-LMVDURUZ.js";
 import {
   GLOBAL_FLAGS,
   WRITE_FLAGS,
   WRITE_SINGLE_FLAGS
-} from "./chunk-DW2HCRXJ.js";
+} from "./chunk-CUTMZWL6.js";
+import {
+  resolveTextOrStdin
+} from "./chunk-ZYURL5VK.js";
 
 // src/commands/post.ts
 import { defineCommand } from "citty";
@@ -412,7 +412,7 @@ var postCreateCommand = defineCommand({
   args: {
     // Write command: WRITE_FLAGS omits pagination/projection flags
     ...WRITE_FLAGS,
-    text: { type: "positional", description: "Post body text. Pass - to read from stdin (enables multiline via heredoc or pipe)." },
+    text: { type: "positional", stdinArg: true, description: "Post body text. Pass - to read from stdin (enables multiline via heredoc or pipe)." },
     attach: {
       type: "string",
       description: "Image/video/document to attach (repeatable for images; a single PDF produces a document post). Supported: jpg, png, gif, mp4, pdf."

package/dist/{profile-A2TWF4HB.js → profile-XOMDIYSY.js}

@@ -28,12 +28,13 @@ import {
   renderSuccess,
   renderUnexpectedError,
   resolveEffectiveConfig
-} from "./chunk-HDQUEFD2.js";
+} from "./chunk-LMVDURUZ.js";
 import {
   GLOBAL_FLAGS,
   READ_SINGLE_FLAGS,
   WRITE_SINGLE_FLAGS
-} from "./chunk-DW2HCRXJ.js";
+} from "./chunk-CUTMZWL6.js";
+import "./chunk-ZYURL5VK.js";
 
 // src/commands/profile.ts
 import { defineCommand } from "citty";

package/dist/{recruiter-FQAKY6Z2.js → recruiter-CCLG4PM4.js}

@@ -3,7 +3,7 @@ import {
   DEFAULT_FILTER_READERS,
   assembleFilters,
   splitCsv
-} from "./chunk-42VUUKQ3.js";
+} from "./chunk-56ORAZJO.js";
 import {
   AttachError,
   readAttachment,
@@ -33,13 +33,16 @@ import {
   renderSuccess,
   renderUnexpectedError,
   resolveEffectiveConfig
-} from "./chunk-HDQUEFD2.js";
+} from "./chunk-LMVDURUZ.js";
 import {
   GLOBAL_FLAGS,
   READ_SINGLE_FLAGS,
   WRITE_FLAGS,
   WRITE_SINGLE_FLAGS
-} from "./chunk-DW2HCRXJ.js";
+} from "./chunk-CUTMZWL6.js";
+import {
+  isStdinToken
+} from "./chunk-ZYURL5VK.js";
 
 // src/commands/recruiter.ts
 import { defineCommand } from "citty";
@@ -112,7 +115,7 @@ async function assembleRecruiterJobBody(flags, readers) {
     } catch {
       return { error: `cannot read ${source}` };
     }
-  } else if (flags.body === "-") {
+  } else if (isStdinToken(flags.body)) {
     source = "--body - (stdin)";
     raw = await readers.readStdin();
   } else if (flags.body !== void 0) {
@@ -962,7 +965,7 @@ var recruiterSearchPeopleCommand = defineCommand({
   args: {
     ...GLOBAL_FLAGS,
     keywords: { type: "string", description: "Keyword search string." },
-    filters: { type: "string", description: "Filter body as a JSON object (escape hatch for the full filter surface); '-' reads JSON from stdin." },
+    filters: { type: "string", stdinArg: true, description: "Filter body as a JSON object (escape hatch for the full filter surface); '-' reads JSON from stdin." },
     "filters-file": { type: "string", description: "Path to a JSON file with the filter body." },
     locale: { type: "string", description: "Result locale, e.g. en." },
     "employment-type": { type: "string", description: "Employment type ids (comma-separated)." },
@@ -1228,7 +1231,7 @@ var recruiterJobsCommand = defineCommand({
 });
 var RECRUITER_JOB_BODY_FLAGS = {
   "body-file": { type: "string", description: "Path to a JSON file with the full job body." },
-  body: { type: "string", description: "Read the JSON job body from stdin (pass '-')." },
+  body: { type: "string", stdinArg: true, description: "Read the JSON job body from stdin (pass '-')." },
   "job-title-id": { type: "string", description: "Resolved job-title parameter id (merged with --job-title into job_title:{id,name})." },
   "job-title": { type: "string", description: "Job title display name (merged with --job-title-id into job_title:{id,name})." },
   "company-id": { type: "string", description: "Resolved company id (or use --company-name for free text)." },
@@ -1537,7 +1540,7 @@ var recruiterTalentSearchCommand = defineCommand({
     projectId: { type: "positional", description: "Recruiter project ID." },
     "channel-id": { type: "string", description: "The project's RECRUITER_SEARCH talent-pool channel ID (required).", required: true },
     keywords: { type: "string", description: "Free-text keyword search." },
-    filters: { type: "string", description: "Filter body as a JSON object (escape hatch for the full filter surface); '-' reads JSON from stdin." },
+    filters: { type: "string", stdinArg: true, description: "Filter body as a JSON object (escape hatch for the full filter surface); '-' reads JSON from stdin." },
     "filters-file": { type: "string", description: "Path to a JSON file with the filter body." }
   },
   async run({ args }) {

package/dist/{sales-nav-SSJIZUNB.js → sales-nav-5ZRE2UAQ.js}

@@ -4,7 +4,7 @@ import {
   assembleFilters,
   splitCsv,
   splitCsvNumbers
-} from "./chunk-42VUUKQ3.js";
+} from "./chunk-56ORAZJO.js";
 import {
   AttachError,
   readAttachment,
@@ -26,12 +26,13 @@ import {
   renderSuccess,
   renderUnexpectedError,
   resolveEffectiveConfig
-} from "./chunk-HDQUEFD2.js";
+} from "./chunk-LMVDURUZ.js";
 import {
   GLOBAL_FLAGS,
   READ_SINGLE_FLAGS,
   WRITE_FLAGS
-} from "./chunk-DW2HCRXJ.js";
+} from "./chunk-CUTMZWL6.js";
+import "./chunk-ZYURL5VK.js";
 
 // src/commands/sales-nav.ts
 import { defineCommand } from "citty";
@@ -530,7 +531,7 @@ var salesNavSearchPeopleCommand = defineCommand({
   args: {
     ...GLOBAL_FLAGS,
     keywords: { type: "string", description: "Keyword search string." },
-    filters: { type: "string", description: "Filter body as a JSON object (escape hatch for the full filter surface); '-' reads JSON from stdin." },
+    filters: { type: "string", stdinArg: true, description: "Filter body as a JSON object (escape hatch for the full filter surface); '-' reads JSON from stdin." },
     "filters-file": { type: "string", description: "Path to a JSON file with the filter body." },
     "first-name": { type: "string", description: "First name to match." },
     "last-name": { type: "string", description: "Last name to match." },
@@ -560,7 +561,7 @@ var salesNavSearchCompaniesCommand = defineCommand({
   args: {
     ...GLOBAL_FLAGS,
     keywords: { type: "string", description: "Keyword search string." },
-    filters: { type: "string", description: "Filter body as a JSON object (escape hatch for the full filter surface); '-' reads JSON from stdin." },
+    filters: { type: "string", stdinArg: true, description: "Filter body as a JSON object (escape hatch for the full filter surface); '-' reads JSON from stdin." },
     "filters-file": { type: "string", description: "Path to a JSON file with the filter body." },
     technologies: { type: "string", description: "Technology tags (comma-separated)." },
     "recent-activities": { type: "string", description: "Recent activity ids (comma-separated)." },

package/dist/{search-DH6BJFQC.js → search-NDESJC3Y.js}

@@ -4,7 +4,7 @@ import {
   assembleFilters,
   splitCsv,
   splitCsvNumbers
-} from "./chunk-42VUUKQ3.js";
+} from "./chunk-56ORAZJO.js";
 import {
   slimSearchCompanies,
   slimSearchCompaniesItem,
@@ -25,10 +25,11 @@ import {
   renderSuccess,
   renderUnexpectedError,
   resolveEffectiveConfig
-} from "./chunk-HDQUEFD2.js";
+} from "./chunk-LMVDURUZ.js";
 import {
   GLOBAL_FLAGS
-} from "./chunk-DW2HCRXJ.js";
+} from "./chunk-CUTMZWL6.js";
+import "./chunk-ZYURL5VK.js";
 
 // src/commands/search.ts
 import { defineCommand } from "citty";
@@ -45,6 +46,7 @@ var PEOPLE_INVALID_FLAGS = ["seniority", "function", "employment-type", "sort-by
 var FILTER_FLAGS = {
   filters: {
     type: "string",
+    stdinArg: true,
     description: "Filter body as a JSON object (named flags win on conflict; server validates and strips unknown fields); '-' reads JSON from stdin."
   },
   "filters-file": {

package/dist/{webhook-LED6AKF3.js → webhook-TNZF3FMN.js}

@@ -1,8 +1,4 @@
 #!/usr/bin/env node
-import {
-  STDIN_SENTINEL,
-  defaultReadStdin
-} from "./chunk-U7Y4EXHT.js";
 import {
   pageDelayFromFlags,
   streamAll
@@ -16,10 +12,14 @@ import {
   renderSuccess,
   renderUnexpectedError,
   resolveEffectiveConfig
-} from "./chunk-HDQUEFD2.js";
+} from "./chunk-LMVDURUZ.js";
 import {
   GLOBAL_FLAGS
-} from "./chunk-DW2HCRXJ.js";
+} from "./chunk-CUTMZWL6.js";
+import {
+  defaultReadStdin,
+  isStdinToken
+} from "./chunk-ZYURL5VK.js";
 
 // src/commands/webhook.ts
 import { defineCommand } from "citty";
@@ -216,7 +216,7 @@ async function resolveWebhookBody(raw, out, readStdin = defaultReadStdin) {
     );
     process.exit(2);
   }
-  if (raw === "-" || raw === STDIN_SENTINEL) {
+  if (isStdinToken(raw)) {
     const piped = stripTrailingNewlines(await readStdin());
     if (!piped) {
       out.stderr.write("error: --body -: stdin: empty input\n");
@@ -428,6 +428,7 @@ var webhookVerifyCommand = defineCommand({
     },
     body: {
       type: "string",
+      stdinArg: true,
       description: "The raw webhook body: inline JSON, a path to a file containing it, or - to read it from stdin.",
       required: true
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@curviate/cli",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "private": false,
   "description": "Official command-line interface for the Curviate API.",
   "license": "MIT",

package/dist/chunk-U7Y4EXHT.js

@@ -1,33 +0,0 @@
-#!/usr/bin/env node
-
-// src/lib/stdin.ts
-var STDIN_SENTINEL = "__curviate_stdin__";
-async function defaultReadStdin() {
-  return new Promise((resolve, reject) => {
-    const chunks = [];
-    process.stdin.on("data", (chunk) => {
-      chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
-    });
-    process.stdin.on("end", () => {
-      const full = Buffer.concat(chunks).toString("utf8");
-      resolve(full.replace(/\n+$/, ""));
-    });
-    process.stdin.on("error", reject);
-  });
-}
-async function resolveTextOrStdin(rawText, out, readStdin) {
-  if (rawText !== "-" && rawText !== STDIN_SENTINEL) return rawText;
-  const reader = readStdin ?? defaultReadStdin;
-  const text = await reader();
-  if (!text) {
-    out.stderr.write("error: stdin: empty input\n");
-    process.exit(2);
-  }
-  return text;
-}
-
-export {
-  STDIN_SENTINEL,
-  defaultReadStdin,
-  resolveTextOrStdin
-};