@curviate/cli 0.9.0 → 0.11.0

package/dist/account-P5K5UDWF.js

@@ -0,0 +1,1401 @@
+#!/usr/bin/env node
+import {
+  defaultReadStdin
+} from "./chunk-U7Y4EXHT.js";
+import {
+  readlineSync
+} from "./chunk-MKXA2LAR.js";
+import {
+  AUTH_NEEDED
+} from "./chunk-OSQ643UW.js";
+import {
+  streamAll
+} from "./chunk-GXTZION6.js";
+import {
+  buildPreviewOutput
+} from "./chunk-R3VLWLVV.js";
+import {
+  slimAccountGet,
+  slimAccountList,
+  slimAccountListItem
+} from "./chunk-SSPILTKF.js";
+import {
+  createClient,
+  renderError,
+  renderSuccess,
+  renderUnexpectedError,
+  resolveEffectiveConfig
+} from "./chunk-JXF47TRY.js";
+import {
+  GLOBAL_FLAGS,
+  READ_SINGLE_FLAGS,
+  WRITE_SINGLE_FLAGS
+} from "./chunk-4JHGVY7R.js";
+
+// src/commands/account.ts
+import { defineCommand } from "citty";
+
+// src/lib/credential-resolve.ts
+async function resolveSecret(params) {
+  if (params.flagValue !== void 0 && params.flagValue !== "") {
+    return params.flagValue;
+  }
+  if (params.stdinRequested) {
+    const reader = params.readStdin ?? defaultReadStdin;
+    const raw = await reader();
+    const trimmed = raw.trim();
+    if (trimmed !== "") {
+      return trimmed;
+    }
+  }
+  const envValue = process.env[params.envVar];
+  if (envValue !== void 0 && envValue !== "") {
+    return envValue;
+  }
+  if (!params.required) {
+    return void 0;
+  }
+  if (params.allowInteractive === false) {
+    return void 0;
+  }
+  if (params.prompt && params.prompt.isTTY) {
+    const value = await params.prompt.readline(params.prompt.promptText, { mask: true });
+    if (value) {
+      return value;
+    }
+  }
+  params.out.stderr.write(`error: ${params.failMessage ?? "missing required credential"}
+`);
+  process.exit(2);
+}
+function checkCredentialConflicts(flags, out) {
+  const passwordStdin = flags["password-stdin"] ?? false;
+  const liAtStdin = flags["li-at-stdin"] ?? false;
+  if (flags.password !== void 0 && passwordStdin) {
+    failConflict(out, "--password and --password-stdin cannot both be set \u2014 choose one source.");
+  }
+  if (flags["li-at"] !== void 0 && liAtStdin) {
+    failConflict(out, "--li-at and --li-at-stdin cannot both be set \u2014 choose one source.");
+  }
+  if (passwordStdin && liAtStdin) {
+    failConflict(
+      out,
+      "--password-stdin and --li-at-stdin cannot both be set \u2014 stdin can feed only one secret per invocation."
+    );
+  }
+  if (liAtStdin && flags["auth-method"] === "credentials") {
+    failConflict(out, "--li-at-stdin requires --auth-method cookie (it does not apply to the credentials method).");
+  }
+  if (passwordStdin && flags["auth-method"] === "cookie") {
+    failConflict(out, "--password-stdin requires --auth-method credentials (it does not apply to the cookie method).");
+  }
+}
+function failConflict(out, message) {
+  out.stderr.write(`error: ${message}
+`);
+  process.exit(2);
+}
+var SECRET_MASK = "\u2022\u2022\u2022\u2022";
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function maskCredentialSecretsForPreview(body) {
+  const masked = { ...body };
+  const credentials = masked["credentials"];
+  if (isRecord(credentials) && "password" in credentials) {
+    masked["credentials"] = { ...credentials, password: SECRET_MASK };
+  }
+  const cookie = masked["cookie"];
+  if (isRecord(cookie)) {
+    const maskedCookie = { ...cookie };
+    if ("li_at" in maskedCookie) maskedCookie["li_at"] = SECRET_MASK;
+    if ("li_a" in maskedCookie) maskedCookie["li_a"] = SECRET_MASK;
+    masked["cookie"] = maskedCookie;
+  }
+  const proxy = masked["proxy"];
+  if (isRecord(proxy) && "password" in proxy) {
+    masked["proxy"] = { ...proxy, password: SECRET_MASK };
+  }
+  return masked;
+}
+
+// src/lib/checkpoint-copy.ts
+var RESENDABLE_CHALLENGE_TYPES = /* @__PURE__ */ new Set([
+  "otp",
+  "two_factor_sms",
+  "mobile_app_approval"
+]);
+function challengeTitle(type) {
+  switch (type) {
+    case "otp":
+      return "Check your email";
+    case "two_factor_sms":
+      return "Enter SMS code";
+    case "two_factor_app":
+      return "Enter authenticator code";
+    case "mobile_app_approval":
+      return "Approve in LinkedIn app";
+  }
+}
+function challengeDescription(type) {
+  switch (type) {
+    case "otp":
+      return "LinkedIn sent a one-time code to your registered email address.";
+    case "two_factor_sms":
+      return "LinkedIn sent a verification code to your registered phone number.";
+    case "two_factor_app":
+      return "Enter the current code from your authenticator app.";
+    case "mobile_app_approval":
+      return "Open your LinkedIn mobile app and approve this sign-in \u2014 this will continue automatically once you tap approve.";
+  }
+}
+function printChallengeCopy(type, out) {
+  out.stderr.write(`${challengeTitle(type)}
+${challengeDescription(type)}
+`);
+}
+function printResendHintIfApplicable(type, accountId, out) {
+  if (!RESENDABLE_CHALLENGE_TYPES.has(type)) return;
+  out.stderr.write(
+    `No code/notification? Re-send it: curviate account checkpoint resend --checkpoint ${accountId}
+`
+  );
+}
+
+// src/lib/checkpoint-cadence.ts
+var CHECKPOINT_POLL_FIRST_DELAY_MS = 1e3;
+var CHECKPOINT_POLL_FAST_INTERVAL_MS = 1500;
+var CHECKPOINT_POLL_FAST_WINDOW_MS = 3e4;
+var CHECKPOINT_POLL_SLOW_INTERVAL_MS = 3e3;
+function nextCheckpointPollDelayMs(elapsedMs) {
+  return elapsedMs < CHECKPOINT_POLL_FAST_WINDOW_MS ? CHECKPOINT_POLL_FAST_INTERVAL_MS : CHECKPOINT_POLL_SLOW_INTERVAL_MS;
+}
+
+// src/commands/account.ts
+var PW_WARNING = (stdinFlag, envVar) => `Note: a value on the command line is visible to other processes via \`ps\` and saved in shell history; prefer \`${stdinFlag}\` or the ${envVar} env var.`;
+var OPTIONAL_SECRET_WARNING = (envVar) => `Note: a value on the command line is visible to other processes via \`ps\` and saved in shell history; prefer the ${envVar} env var.`;
+function rejectPreviewOnRead(preview, out) {
+  if (preview) {
+    out.stderr.write("error: --preview is only valid on write commands (mutations). Reads just run.\n");
+    process.exit(2);
+  }
+}
+function rejectAllOnNonPaginated(all, out) {
+  if (all) {
+    out.stderr.write("error: --all is not supported on non-paginated commands.\n");
+    process.exit(2);
+  }
+}
+function buildOutputStreams() {
+  return {
+    stdout: { write: (s) => process.stdout.write(s) },
+    stderr: { write: (s) => process.stderr.write(s) }
+  };
+}
+function resolveOutputOpts(flags) {
+  return {
+    json: (flags.json ?? false) || !process.stdout.isTTY,
+    isTTY: process.stdout.isTTY ?? false,
+    fields: flags.fields,
+    verbose: flags.verbose ?? false
+  };
+}
+async function handleError(err, outOpts, out) {
+  const { CurviateError } = await import("@curviate/sdk");
+  if (err instanceof CurviateError) {
+    const { getExitCode } = await import("./exit-codes-2ASIFXGR.js");
+    renderError(err, outOpts, out);
+    process.exit(getExitCode(err.code));
+  }
+  renderUnexpectedError(err, out);
+  process.exit(1);
+}
+async function runAccountList(client, flags, out) {
+  rejectPreviewOnRead(flags.preview, out);
+  const outOpts = resolveOutputOpts(flags);
+  const all = flags.all ?? false;
+  const maxPages = flags["max-pages"] ? parseInt(flags["max-pages"], 10) : 100;
+  const limit = flags.limit ? parseInt(flags.limit, 10) : void 0;
+  const cursor = flags.cursor;
+  const params = {};
+  if (limit !== void 0) params["limit"] = limit;
+  if (cursor) params["cursor"] = cursor;
+  try {
+    if (all) {
+      const fn = (p) => client.accounts.list(p);
+      for await (const item of streamAll(fn, params, {
+        maxPages,
+        onTruncated: (n) => out.stderr.write(`Streaming truncated at ${n} page(s). Use --all --max-pages or --cursor for manual paging.
+`)
+      })) {
+        const projected = outOpts.verbose ? item : slimAccountListItem(item);
+        out.stdout.write(JSON.stringify(projected) + "\n");
+      }
+    } else {
+      const result = await client.accounts.list(params);
+      renderSuccess(result, { ...outOpts, slim: slimAccountList }, out);
+    }
+  } catch (err) {
+    await handleError(err, outOpts, out);
+  }
+}
+async function runAccountGet(client, flags, out) {
+  rejectPreviewOnRead(flags.preview, out);
+  rejectAllOnNonPaginated(flags.all, out);
+  const accountId = flags["account-id"] ?? "";
+  const outOpts = resolveOutputOpts(flags);
+  try {
+    const result = await client.accounts.get(accountId);
+    renderSuccess(result, { ...outOpts, slim: slimAccountGet }, out);
+  } catch (err) {
+    await handleError(err, outOpts, out);
+  }
+}
+async function buildAuthBody(flags, ctx) {
+  const body = {};
+  if (flags["auth-method"]) body["auth_method"] = flags["auth-method"];
+  if (flags["user-agent"]) body["user_agent"] = flags["user-agent"];
+  if (flags["recruiter-contract-id"]) body["recruiter_contract_id"] = flags["recruiter-contract-id"];
+  if (flags["auth-method"] === "credentials") {
+    const password = await resolveSecret({
+      flagValue: flags.password,
+      stdinRequested: flags["password-stdin"],
+      envVar: "CURVIATE_LINKEDIN_PASSWORD",
+      readStdin: ctx.readStdin,
+      required: true,
+      // The interactive prompt/fail-fast only engages once --email is present
+      // (nothing meaningful to prompt toward yet otherwise) — and never
+      // under --preview (a client-side render must not prompt or exit).
+      allowInteractive: !ctx.previewMode && Boolean(flags.email),
+      failMessage: "no password \u2014 pass --password, --password-stdin, or set CURVIATE_LINKEDIN_PASSWORD",
+      prompt: { isTTY: ctx.isTTY, readline: ctx.readline, promptText: "LinkedIn password: " },
+      out: ctx.out
+    });
+    if (flags.email || password !== void 0) {
+      body["credentials"] = {
+        ...flags.email ? { email: flags.email } : {},
+        ...password !== void 0 ? { password } : {}
+      };
+    }
+  }
+  if (flags["auth-method"] === "cookie") {
+    const liAt = await resolveSecret({
+      flagValue: flags["li-at"],
+      stdinRequested: flags["li-at-stdin"],
+      envVar: "CURVIATE_LINKEDIN_LI_AT",
+      readStdin: ctx.readStdin,
+      required: true,
+      allowInteractive: !ctx.previewMode,
+      failMessage: "no li_at \u2014 pass --li-at, --li-at-stdin, or set CURVIATE_LINKEDIN_LI_AT",
+      out: ctx.out
+    });
+    const liA = await resolveSecret({
+      flagValue: flags["li-a"],
+      envVar: "CURVIATE_LINKEDIN_LI_A",
+      out: ctx.out
+    });
+    if (liAt !== void 0 || liA !== void 0) {
+      body["cookie"] = {
+        ...liAt !== void 0 ? { li_at: liAt } : {},
+        ...liA !== void 0 ? { li_a: liA } : {}
+      };
+    }
+  }
+  if (flags.country) body["country"] = flags.country;
+  if (flags.ip) body["ip"] = flags.ip;
+  if (flags["proxy-host"]) {
+    const proxyPassword = await resolveSecret({
+      flagValue: flags["proxy-password"],
+      envVar: "CURVIATE_PROXY_PASSWORD",
+      out: ctx.out
+    });
+    body["proxy"] = {
+      protocol: flags["proxy-protocol"] ?? "http",
+      host: flags["proxy-host"],
+      port: flags["proxy-port"] ? parseInt(flags["proxy-port"], 10) : 80,
+      ...flags["proxy-username"] ? { username: flags["proxy-username"] } : {},
+      ...proxyPassword !== void 0 ? { password: proxyPassword } : {}
+    };
+  }
+  return body;
+}
+async function defaultOpen(url) {
+  const open = (await import("open")).default;
+  return open(url);
+}
+function resolveCredentialIO(io) {
+  return {
+    isTTY: io.isTTY ?? (process.stdin.isTTY ?? false),
+    isOutputTTY: io.isOutputTTY ?? (process.stdout.isTTY ?? false),
+    readline: io.readline ?? readlineSync,
+    readStdin: io.readStdin ?? defaultReadStdin,
+    sleep: io.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms))),
+    now: io.now ?? (() => Date.now()),
+    open: io.open ?? defaultOpen
+  };
+}
+function printConnected(result, ctx) {
+  const r = result;
+  ctx.out.stderr.write(`Account ${ctx.successVerb}: ${r.account_id ?? ""}
+`);
+  renderSuccess(result, ctx.outOpts, ctx.out);
+}
+function printInvalidCodeRetryHint(err, out) {
+  const attemptsRemaining = err.attempts_remaining;
+  const message = typeof attemptsRemaining === "number" ? `That code was not accepted \u2014 ${attemptsRemaining} attempt(s) remaining.` : "That code was not accepted \u2014 please try again.";
+  out.stderr.write(`${message}
+`);
+}
+async function waitForMobileApproval(client, accountId, expiresAt, ctx) {
+  const startedAt = ctx.now();
+  const timeoutAt = expiresAt ? new Date(expiresAt).getTime() : startedAt + 10 * 6e4;
+  await ctx.sleep(CHECKPOINT_POLL_FIRST_DELAY_MS);
+  for (; ; ) {
+    let result;
+    try {
+      result = await client.accounts.pollCheckpoint({ account_id: accountId });
+    } catch (err) {
+      return await handleError(err, ctx.outOpts, ctx.out);
+    }
+    const status = result.status;
+    if (status === "active") return { kind: "active", result };
+    if (status === "expired" || status === "failed") {
+      return { kind: "terminal_failure", status };
+    }
+    const n = ctx.now();
+    if (n >= timeoutAt) return { kind: "timeout" };
+    await ctx.sleep(nextCheckpointPollDelayMs(n - startedAt));
+  }
+}
+async function runInteractiveCheckpointLoop(client, initial, ctx) {
+  const { CurviateError } = await import("@curviate/sdk");
+  let current = initial;
+  for (; ; ) {
+    const challengeType = current.challenge_type;
+    const accountId = current.account_id ?? "";
+    printChallengeCopy(challengeType, ctx.out);
+    printResendHintIfApplicable(challengeType, accountId, ctx.out);
+    if (challengeType === "mobile_app_approval") {
+      const outcome = await waitForMobileApproval(client, accountId, current.expires_at, {
+        out: ctx.out,
+        outOpts: ctx.outOpts,
+        sleep: ctx.sleep,
+        now: ctx.now
+      });
+      if (outcome.kind === "active") {
+        printConnected(outcome.result, { out: ctx.out, outOpts: ctx.outOpts, successVerb: ctx.successVerb });
+        return;
+      }
+      if (outcome.kind === "terminal_failure") {
+        ctx.out.stderr.write(
+          `This checkpoint has ${outcome.status}. Run the connect command again to restart.
+`
+        );
+        process.exit(9);
+        return;
+      }
+      ctx.out.stderr.write(
+        `Still waiting for approval. Finish out-of-band: curviate account checkpoint poll --checkpoint ${accountId}
+`
+      );
+      process.exit(AUTH_NEEDED);
+      return;
+    }
+    for (; ; ) {
+      const code = await ctx.readline("Enter the code: ");
+      try {
+        const result = await client.accounts.submitCheckpoint({ account_id: accountId, code });
+        const r = result;
+        if (r.status === "checkpoint_required") {
+          current = { ...r, account_id: r.account_id ?? accountId };
+          break;
+        }
+        printConnected(result, { out: ctx.out, outOpts: ctx.outOpts, successVerb: ctx.successVerb });
+        return;
+      } catch (err) {
+        if (err instanceof CurviateError && err.code === "CHECKPOINT_INVALID_CODE") {
+          printInvalidCodeRetryHint(err, ctx.out);
+          continue;
+        }
+        await handleError(err, ctx.outOpts, ctx.out);
+      }
+    }
+  }
+}
+async function handleAccountConnectResult(client, result, ctx) {
+  const envelope = result;
+  if (envelope.status !== "checkpoint_required") {
+    renderSuccess(result, ctx.outOpts, ctx.out);
+    return;
+  }
+  const isInteractive = ctx.io.isTTY && ctx.io.isOutputTTY && !(ctx.flags["no-interactive"] ?? false);
+  if (!isInteractive) {
+    renderSuccess(result, ctx.outOpts, ctx.out);
+    process.exit(AUTH_NEEDED);
+    return;
+  }
+  await runInteractiveCheckpointLoop(client, envelope, {
+    out: ctx.out,
+    outOpts: ctx.outOpts,
+    readline: ctx.io.readline,
+    sleep: ctx.io.sleep,
+    now: ctx.io.now,
+    successVerb: ctx.successVerb
+  });
+}
+async function runAccountLink(client, flags, out, io = {}) {
+  if (!flags["seat-id"]) {
+    out.stderr.write("error: --seat-id is required for account link.\n");
+    process.exit(2);
+  }
+  if (!flags["auth-method"]) {
+    out.stderr.write("error: --auth-method is required for account link (credentials | cookie).\n");
+    process.exit(2);
+  }
+  checkCredentialConflicts(flags, out);
+  const resolvedIo = resolveCredentialIO(io);
+  const authBody = await buildAuthBody(flags, {
+    out,
+    isTTY: resolvedIo.isTTY,
+    readline: resolvedIo.readline,
+    readStdin: resolvedIo.readStdin,
+    previewMode: flags.preview ?? false
+  });
+  const body = {
+    seat_id: flags["seat-id"],
+    ...authBody
+  };
+  const outOpts = resolveOutputOpts(flags);
+  if (flags.preview) {
+    const preview = buildPreviewOutput({ method: "accounts.link", args: {}, body: maskCredentialSecretsForPreview(body) });
+    out.stdout.write(JSON.stringify(preview) + "\n");
+    return;
+  }
+  let result;
+  try {
+    result = await client.accounts.link(body);
+  } catch (err) {
+    await handleError(err, outOpts, out);
+    return;
+  }
+  await handleAccountConnectResult(client, result, {
+    out,
+    flags,
+    outOpts,
+    io: resolvedIo,
+    successVerb: "linked"
+  });
+}
+async function runConnectSessionWaitLoop(client, params, ctx) {
+  const startedAt = ctx.now();
+  let timeoutAt = ctx.timeoutOverrideMs !== void 0 ? startedAt + ctx.timeoutOverrideMs : void 0;
+  await ctx.sleep(CHECKPOINT_POLL_FIRST_DELAY_MS);
+  for (; ; ) {
+    const result = await client.accounts.getConnectSession(params);
+    const r = result;
+    if (r.status === "resolved") return { kind: "resolved", result };
+    if (r.status === "expired" || r.status === "failed") {
+      return { kind: "terminal_failure", status: r.status, result };
+    }
+    if (timeoutAt === void 0) {
+      const expiresAtMs = r.expires_at ? new Date(r.expires_at).getTime() : NaN;
+      timeoutAt = Number.isNaN(expiresAtMs) ? startedAt + 10 * 6e4 : expiresAtMs;
+    }
+    const n = ctx.now();
+    if (n >= timeoutAt) return { kind: "timeout", result };
+    if (ctx.showTicker) {
+      ctx.out.stderr.write(`\rWaiting for the account to connect\u2026 ${formatRemaining(timeoutAt - n)} remaining`);
+    }
+    await ctx.sleep(nextCheckpointPollDelayMs(n - startedAt));
+  }
+}
+function printConnectSessionResolved(result, ctx) {
+  const r = result;
+  ctx.out.stderr.write(`Account connected: ${r.account_id ?? ""}
+`);
+  renderSuccess(result, ctx.outOpts, ctx.out);
+}
+function resolveWaitTimeoutOverrideMs(flags, out) {
+  if (flags.timeout === void 0) return void 0;
+  const parsed = Number(flags.timeout);
+  if (Number.isNaN(parsed)) {
+    out.stderr.write("error: --timeout must be a number of milliseconds.\n");
+    process.exit(2);
+  }
+  return parsed;
+}
+async function runAccountConnectLink(client, flags, out, io = {}) {
+  const body = {};
+  if (flags["seat-id"]) body["seat_id"] = flags["seat-id"];
+  if (flags["account-id"]) body["account_id"] = flags["account-id"];
+  if (flags.purpose) body["purpose"] = flags.purpose;
+  if (flags["expires-in-seconds"]) body["expires_in_seconds"] = parseInt(flags["expires-in-seconds"], 10);
+  if (flags["redirect-url"]) body["redirect_url"] = flags["redirect-url"];
+  const outOpts = resolveOutputOpts(flags);
+  if (flags.preview) {
+    const preview = buildPreviewOutput({ method: "accounts.createConnectLink", args: {}, body });
+    out.stdout.write(JSON.stringify(preview) + "\n");
+    return;
+  }
+  let result;
+  try {
+    result = await client.accounts.createConnectLink(body);
+  } catch (err) {
+    await handleError(err, outOpts, out);
+    return;
+  }
+  const mint = result;
+  const resolvedIo = resolveCredentialIO(io);
+  const isInteractive = resolvedIo.isTTY && resolvedIo.isOutputTTY && !(flags["no-interactive"] ?? false);
+  if (!isInteractive) {
+    if (mint.url) {
+      out.stderr.write(`Open this URL in a browser to connect the account: ${mint.url}
+`);
+    }
+    if (mint.session_id) {
+      out.stderr.write(
+        `Session: ${mint.session_id} \u2014 check it later with: curviate account connect-session poll --session ${mint.session_id} --wait
+`
+      );
+    }
+    renderSuccess(result, outOpts, out);
+    return;
+  }
+  if ((flags.open ?? true) && mint.url) {
+    await resolvedIo.open(mint.url);
+  }
+  if (!(flags.wait ?? true)) {
+    renderSuccess(result, outOpts, out);
+    return;
+  }
+  const timeoutOverrideMs = resolveWaitTimeoutOverrideMs(flags, out);
+  const showTicker = resolvedIo.isOutputTTY && !(flags.json ?? false);
+  const params = { session_id: mint.session_id };
+  let outcome;
+  try {
+    outcome = await runConnectSessionWaitLoop(client, params, {
+      out,
+      sleep: resolvedIo.sleep,
+      now: resolvedIo.now,
+      showTicker,
+      timeoutOverrideMs
+    });
+  } catch (err) {
+    await handleError(err, outOpts, out);
+    return;
+  }
+  if (outcome.kind === "resolved") {
+    printConnectSessionResolved(outcome.result, { out, outOpts });
+    return;
+  }
+  if (outcome.kind === "terminal_failure") {
+    renderSuccess(outcome.result, outOpts, out);
+    out.stderr.write(
+      `This connect session has ${outcome.status}. Generate a new link: curviate account connect-link.
+`
+    );
+    process.exit(9);
+    return;
+  }
+  renderSuccess(outcome.result, outOpts, out);
+  out.stderr.write(
+    `Still waiting for the account to connect \u2014 the wait window elapsed. Check again: curviate account connect-session poll --session ${mint.session_id} --wait
+`
+  );
+  process.exit(AUTH_NEEDED);
+}
+async function runAccountConnectSessionPoll(client, flags, out, io = {}) {
+  if (!flags.session) {
+    out.stderr.write("error: --session is required (the session_id from `account connect-link`).\n");
+    process.exit(2);
+  }
+  const params = { session_id: flags.session };
+  const outOpts = resolveOutputOpts(flags);
+  if (flags.preview) {
+    const preview = buildPreviewOutput({ method: "accounts.getConnectSession", args: {}, body: params });
+    out.stdout.write(JSON.stringify(preview) + "\n");
+    return;
+  }
+  if (!flags.wait) {
+    try {
+      const result = await client.accounts.getConnectSession(params);
+      renderSuccess(result, outOpts, out);
+    } catch (err) {
+      await handleError(err, outOpts, out);
+    }
+    return;
+  }
+  const timeoutOverrideMs = resolveWaitTimeoutOverrideMs(flags, out);
+  const resolvedIo = resolveCredentialIO(io);
+  const showTicker = resolvedIo.isOutputTTY && !(flags.json ?? false);
+  let outcome;
+  try {
+    outcome = await runConnectSessionWaitLoop(client, params, {
+      out,
+      sleep: resolvedIo.sleep,
+      now: resolvedIo.now,
+      showTicker,
+      timeoutOverrideMs
+    });
+  } catch (err) {
+    await handleError(err, outOpts, out);
+    return;
+  }
+  if (outcome.kind === "resolved") {
+    printConnectSessionResolved(outcome.result, { out, outOpts });
+    return;
+  }
+  if (outcome.kind === "terminal_failure") {
+    renderSuccess(outcome.result, outOpts, out);
+    out.stderr.write(
+      `This connect session has ${outcome.status}. Generate a new link: curviate account connect-link.
+`
+    );
+    process.exit(9);
+    return;
+  }
+  renderSuccess(outcome.result, outOpts, out);
+  out.stderr.write(
+    `Still waiting for the account to connect \u2014 the wait window elapsed. Check again: curviate account connect-session poll --session ${flags.session} --wait
+`
+  );
+  process.exit(AUTH_NEEDED);
+}
+async function runAccountReconnect(client, flags, out, io = {}) {
+  if (!flags["auth-method"]) {
+    out.stderr.write("error: --auth-method is required for account reconnect (credentials | cookie).\n");
+    process.exit(2);
+  }
+  checkCredentialConflicts(flags, out);
+  const accountId = flags["account-id"] ?? "";
+  const resolvedIo = resolveCredentialIO(io);
+  const body = await buildAuthBody(flags, {
+    out,
+    isTTY: resolvedIo.isTTY,
+    readline: resolvedIo.readline,
+    readStdin: resolvedIo.readStdin,
+    previewMode: flags.preview ?? false
+  });
+  const outOpts = resolveOutputOpts(flags);
+  if (flags.preview) {
+    const preview = buildPreviewOutput({
+      method: "accounts.reconnect",
+      args: { accountId },
+      body: maskCredentialSecretsForPreview(body)
+    });
+    out.stdout.write(JSON.stringify(preview) + "\n");
+    return;
+  }
+  let result;
+  try {
+    result = await client.accounts.reconnect(accountId, body);
+  } catch (err) {
+    await handleError(err, outOpts, out);
+    return;
+  }
+  await handleAccountConnectResult(client, result, {
+    out,
+    flags,
+    outOpts,
+    io: resolvedIo,
+    successVerb: "reconnected"
+  });
+}
+async function runAccountRefresh(client, flags, out) {
+  const accountId = flags["account-id"] ?? "";
+  const outOpts = resolveOutputOpts(flags);
+  if (flags.preview) {
+    const preview = buildPreviewOutput({
+      method: "accounts.refresh",
+      args: { accountId },
+      body: {}
+    });
+    out.stdout.write(JSON.stringify(preview) + "\n");
+    return;
+  }
+  try {
+    const result = await client.accounts.refresh(accountId);
+    renderSuccess(result, outOpts, out);
+  } catch (err) {
+    await handleError(err, outOpts, out);
+  }
+}
+async function runAccountUpdate(client, flags, out) {
+  const accountId = flags["account-id"] ?? "";
+  const body = {};
+  if (flags.country) body["country"] = flags.country;
+  if (flags.ip) body["ip"] = flags.ip;
+  if (flags["proxy-host"]) {
+    const proxyPassword = await resolveSecret({
+      flagValue: flags["proxy-password"],
+      envVar: "CURVIATE_PROXY_PASSWORD",
+      out
+    });
+    body["proxy"] = {
+      protocol: flags["proxy-protocol"] ?? "http",
+      host: flags["proxy-host"],
+      port: flags["proxy-port"] ? parseInt(flags["proxy-port"], 10) : 80,
+      ...flags["proxy-username"] ? { username: flags["proxy-username"] } : {},
+      ...proxyPassword !== void 0 ? { password: proxyPassword } : {}
+    };
+  }
+  const outOpts = resolveOutputOpts(flags);
+  if (flags.preview) {
+    const preview = buildPreviewOutput({
+      method: "accounts.update",
+      args: { accountId },
+      body: maskCredentialSecretsForPreview(body)
+    });
+    out.stdout.write(JSON.stringify(preview) + "\n");
+    return;
+  }
+  try {
+    const result = await client.accounts.update(accountId, body);
+    renderSuccess(result, outOpts, out);
+  } catch (err) {
+    await handleError(err, outOpts, out);
+  }
+}
+async function runAccountDisconnect(client, flags, out) {
+  const accountId = flags["account-id"] ?? "";
+  const outOpts = resolveOutputOpts(flags);
+  if (flags.preview) {
+    const preview = buildPreviewOutput({
+      method: "accounts.disconnect",
+      args: { accountId },
+      body: {}
+    });
+    out.stdout.write(JSON.stringify(preview) + "\n");
+    return;
+  }
+  try {
+    const result = await client.accounts.disconnect(accountId);
+    renderSuccess(result, outOpts, out);
+  } catch (err) {
+    await handleError(err, outOpts, out);
+  }
+}
+async function runAccountCheckpointSubmit(client, flags, out) {
+  if (!flags.checkpoint) {
+    out.stderr.write("error: --checkpoint is required (the provisional account_id from the 202 response).\n");
+    process.exit(2);
+  }
+  if (!flags.code) {
+    out.stderr.write("error: --code is required (the OTP / 2FA code).\n");
+    process.exit(2);
+  }
+  const body = {
+    account_id: flags.checkpoint,
+    code: flags.code
+  };
+  const outOpts = resolveOutputOpts(flags);
+  if (flags.preview) {
+    const preview = buildPreviewOutput({
+      method: "accounts.submitCheckpoint",
+      args: {},
+      body
+    });
+    out.stdout.write(JSON.stringify(preview) + "\n");
+    return;
+  }
+  let chained = false;
+  try {
+    const result = await client.accounts.submitCheckpoint(body);
+    const r = result;
+    renderSuccess(result, outOpts, out);
+    chained = r.status === "checkpoint_required";
+  } catch (err) {
+    await handleError(err, outOpts, out);
+    return;
+  }
+  if (chained) {
+    process.exit(AUTH_NEEDED);
+  }
+}
+async function runAccountCheckpointResend(client, flags, out) {
+  if (!flags.checkpoint) {
+    out.stderr.write("error: --checkpoint is required (the provisional account_id from the 202 response).\n");
+    process.exit(2);
+  }
+  const body = {
+    account_id: flags.checkpoint
+  };
+  const outOpts = resolveOutputOpts(flags);
+  if (flags.preview) {
+    const preview = buildPreviewOutput({
+      method: "accounts.resendCheckpoint",
+      args: {},
+      body
+    });
+    out.stdout.write(JSON.stringify(preview) + "\n");
+    return;
+  }
+  try {
+    const result = await client.accounts.resendCheckpoint(body);
+    renderSuccess(result, outOpts, out);
+  } catch (err) {
+    await handleError(err, outOpts, out);
+  }
+}
+function formatRemaining(ms) {
+  const totalSec = Math.max(0, Math.ceil(ms / 1e3));
+  const minutes = Math.floor(totalSec / 60);
+  const seconds = totalSec % 60;
+  return `${minutes}:${String(seconds).padStart(2, "0")}`;
+}
+async function runCheckpointPollWaitLoop(client, body, ctx) {
+  const startedAt = ctx.now();
+  let timeoutAt = ctx.timeoutOverrideMs !== void 0 ? startedAt + ctx.timeoutOverrideMs : void 0;
+  await ctx.sleep(CHECKPOINT_POLL_FIRST_DELAY_MS);
+  for (; ; ) {
+    const result = await client.accounts.pollCheckpoint(body);
+    const r = result;
+    if (r.status === "active") return { kind: "active", result };
+    if (r.status === "expired" || r.status === "failed") {
+      return { kind: "terminal_failure", status: r.status, result };
+    }
+    if (timeoutAt === void 0) {
+      const expiresAtMs = r.expires_at ? new Date(r.expires_at).getTime() : NaN;
+      timeoutAt = Number.isNaN(expiresAtMs) ? startedAt + 10 * 6e4 : expiresAtMs;
+    }
+    const n = ctx.now();
+    if (n >= timeoutAt) return { kind: "timeout", result };
+    if (ctx.showTicker) {
+      ctx.out.stderr.write(`\rWaiting for approval\u2026 ${formatRemaining(timeoutAt - n)} remaining`);
+    }
+    await ctx.sleep(nextCheckpointPollDelayMs(n - startedAt));
+  }
+}
+async function runAccountCheckpointPoll(client, flags, out, io = {}) {
+  if (!flags.checkpoint) {
+    out.stderr.write("error: --checkpoint is required (the provisional account_id from the 202 response).\n");
+    process.exit(2);
+  }
+  const body = {
+    account_id: flags.checkpoint
+  };
+  const outOpts = resolveOutputOpts(flags);
+  if (flags.preview) {
+    const preview = buildPreviewOutput({
+      method: "accounts.pollCheckpoint",
+      args: {},
+      body
+    });
+    out.stdout.write(JSON.stringify(preview) + "\n");
+    return;
+  }
+  if (!flags.wait) {
+    try {
+      const result = await client.accounts.pollCheckpoint(body);
+      renderSuccess(result, outOpts, out);
+    } catch (err) {
+      await handleError(err, outOpts, out);
+    }
+    return;
+  }
+  let timeoutOverrideMs;
+  if (flags.timeout !== void 0) {
+    const parsed = Number(flags.timeout);
+    if (Number.isNaN(parsed)) {
+      out.stderr.write("error: --timeout must be a number of milliseconds.\n");
+      process.exit(2);
+    }
+    timeoutOverrideMs = parsed;
+  }
+  const resolvedIo = resolveCredentialIO(io);
+  const showTicker = resolvedIo.isOutputTTY && !(flags.json ?? false);
+  printResendHintIfApplicable("mobile_app_approval", flags.checkpoint, out);
+  let outcome;
+  try {
+    outcome = await runCheckpointPollWaitLoop(client, body, {
+      out,
+      sleep: resolvedIo.sleep,
+      now: resolvedIo.now,
+      showTicker,
+      timeoutOverrideMs
+    });
+  } catch (err) {
+    await handleError(err, outOpts, out);
+    return;
+  }
+  if (outcome.kind === "active") {
+    printConnected(outcome.result, { out, outOpts, successVerb: "linked" });
+    return;
+  }
+  if (outcome.kind === "terminal_failure") {
+    renderSuccess(outcome.result, outOpts, out);
+    out.stderr.write(`This checkpoint has ${outcome.status}. Start over: curviate account link or curviate account reconnect.
+`);
+    process.exit(9);
+    return;
+  }
+  renderSuccess(outcome.result, outOpts, out);
+  out.stderr.write(
+    `Still waiting for approval \u2014 the wait window elapsed. Check again: curviate account checkpoint poll --checkpoint ${flags.checkpoint} --wait
+`
+  );
+  process.exit(AUTH_NEEDED);
+}
+var accountListCommand = defineCommand({
+  meta: { name: "list", description: "List connected LinkedIn accounts." },
+  args: { ...GLOBAL_FLAGS },
+  async run({ args }) {
+    const flags = args;
+    const cfg = await resolveEffectiveConfig({
+      apiKey: flags["api-key"],
+      baseUrl: flags["base-url"],
+      timeout: flags.timeout,
+      profile: flags.profile
+    });
+    if (!cfg.apiKey) {
+      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
+      process.exit(3);
+    }
+    const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
+    const out = buildOutputStreams();
+    await runAccountList(client, flags, out);
+  }
+});
+var accountGetCommand = defineCommand({
+  meta: { name: "get", description: "Get a connected LinkedIn account." },
+  args: {
+    // Single-object read: READ_SINGLE_FLAGS omits pagination flags, keeps --fields
+    ...READ_SINGLE_FLAGS,
+    "account-id": { type: "positional", description: "Account id (acc_\u2026)." }
+  },
+  async run({ args }) {
+    const flags = args;
+    const cfg = await resolveEffectiveConfig({
+      apiKey: flags["api-key"],
+      baseUrl: flags["base-url"],
+      timeout: flags.timeout,
+      profile: flags.profile
+    });
+    if (!cfg.apiKey) {
+      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
+      process.exit(3);
+    }
+    const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
+    const out = buildOutputStreams();
+    await runAccountGet(client, flags, out);
+  }
+});
+var accountLinkCommand = defineCommand({
+  meta: {
+    name: "link",
+    description: "Connect a LinkedIn account to an empty seat. If LinkedIn requires verification you'll be prompted for the code interactively; in a non-interactive shell the command exits 12 and you finish with `curviate account checkpoint submit`."
+  },
+  args: {
+    ...WRITE_SINGLE_FLAGS,
+    "seat-id": { type: "string", description: "Empty seat to bind the account to.", required: true },
+    "auth-method": { type: "string", description: "Authentication method: credentials | cookie.", required: true },
+    email: { type: "string", description: "LinkedIn email (credentials method)." },
+    password: { type: "string", description: `LinkedIn password (credentials method). ${PW_WARNING("--password-stdin", "CURVIATE_LINKEDIN_PASSWORD")}` },
+    "password-stdin": { type: "boolean", description: "Read the LinkedIn password from stdin (one line, trimmed).", default: false },
+    "li-at": { type: "string", description: `LinkedIn session cookie li_at (cookie method). ${PW_WARNING("--li-at-stdin", "CURVIATE_LINKEDIN_LI_AT")}` },
+    "li-at-stdin": { type: "boolean", description: "Read the li_at session cookie from stdin (one line, trimmed).", default: false },
+    "li-a": { type: "string", description: `Optional premium session cookie li_a (cookie method). ${OPTIONAL_SECRET_WARNING("CURVIATE_LINKEDIN_LI_A")}` },
+    country: { type: "string", description: "Proxy location hint (ISO 3166-1 alpha-2)." },
+    ip: { type: "string", description: "IP to infer the managed proxy location." },
+    "proxy-protocol": { type: "string", description: "Proxy protocol: http | https | socks5." },
+    "proxy-host": { type: "string", description: "Proxy host or IP." },
+    "proxy-port": { type: "string", description: "Proxy port." },
+    "proxy-username": { type: "string", description: "Proxy auth username." },
+    "proxy-password": { type: "string", description: `Proxy auth password. ${OPTIONAL_SECRET_WARNING("CURVIATE_PROXY_PASSWORD")}` },
+    "user-agent": { type: "string", description: "Browser User-Agent to pin for this account." },
+    "recruiter-contract-id": { type: "string", description: "Recruiter contract to bind to (Recruiter tier only)." },
+    "no-interactive": {
+      type: "boolean",
+      description: "Never prompt for a checkpoint code \u2014 on a checkpoint, always render the envelope and exit 12, even on a TTY.",
+      default: false
+    }
+  },
+  async run({ args }) {
+    const flags = args;
+    const cfg = await resolveEffectiveConfig({
+      apiKey: flags["api-key"],
+      baseUrl: flags["base-url"],
+      timeout: flags.timeout,
+      profile: flags.profile
+    });
+    if (!cfg.apiKey) {
+      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
+      process.exit(3);
+    }
+    const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
+    const out = buildOutputStreams();
+    await runAccountLink(client, flags, out);
+  }
+});
+var accountConnectLinkCommand = defineCommand({
+  meta: {
+    name: "connect-link",
+    description: "Generate a one-time hosted account connection URL. On an interactive TTY the URL auto-opens in your browser and the command waits for the account to connect (exit 0 on success, 9 if the link expires or fails, 12 if the wait window elapses first). Non-interactively it never opens a browser and returns immediately with the url and session_id \u2014 poll completion later with `account connect-session poll`."
+  },
+  args: {
+    ...WRITE_SINGLE_FLAGS,
+    "seat-id": { type: "string", description: "Target seat (required when purpose=create)." },
+    "account-id": { type: "string", description: "Account to reconnect (required when purpose=reconnect)." },
+    purpose: { type: "string", description: "create | reconnect (default: create)." },
+    "expires-in-seconds": { type: "string", description: "Link expiry in seconds (60\u20133600, default 900)." },
+    "redirect-url": { type: "string", description: "Browser return URL after the hosted flow." },
+    open: {
+      type: "boolean",
+      description: "Auto-open the URL in your default browser. Default: on for an interactive TTY, always off otherwise (ignored non-interactively)."
+    },
+    wait: {
+      type: "boolean",
+      description: "Poll for the account to connect on an adaptive cadence (1000ms, then 1500ms for 30s, then 3000ms) after opening the URL. Default: on for an interactive TTY, always off otherwise (the agent polls later via `account connect-session poll`)."
+    },
+    // Override WRITE_SINGLE_FLAGS.timeout: on this command --timeout is the
+    // TTY+interactive wait loop's own wall-clock bound in MILLISECONDS
+    // (meaningless outside that branch) — NOT the SDK request timeout.
+    // Default: the time remaining to the link's own expiry.
+    timeout: {
+      type: "string",
+      description: "Wait-loop timeout in milliseconds (only meaningful under the interactive TTY wait; default: time remaining to the link's expiry). Note the unit: this is milliseconds."
+    }
+  },
+  async run({ args }) {
+    const flags = args;
+    const cfg = await resolveEffectiveConfig({
+      apiKey: flags["api-key"],
+      baseUrl: flags["base-url"],
+      profile: flags.profile
+    });
+    if (!cfg.apiKey) {
+      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
+      process.exit(3);
+    }
+    const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
+    const out = buildOutputStreams();
+    await runAccountConnectLink(client, flags, out);
+  }
+});
+var accountConnectSessionPollCommand = defineCommand({
+  meta: {
+    name: "poll",
+    description: "Poll a hosted connect-link session for completion. Without --wait: a single poll \u2014 the JSON `status` field (pending | resolved | expired | failed) tells you what to do next. With --wait: block on the same adaptive cadence as `account connect-link` until a terminal state."
+  },
+  args: {
+    ...WRITE_SINGLE_FLAGS,
+    session: {
+      type: "string",
+      description: "The session_id returned by `account connect-link`.",
+      required: true
+    },
+    wait: {
+      type: "boolean",
+      description: "Poll on an adaptive cadence (1000ms, then 1500ms for 30s, then 3000ms) until a terminal state, instead of a single poll.",
+      default: false
+    },
+    // Override WRITE_SINGLE_FLAGS.timeout: on this command --timeout is the
+    // --wait loop's own wall-clock bound in MILLISECONDS (requires --wait) —
+    // NOT the SDK request timeout. Default: the time remaining to the
+    // session's own expiry.
+    timeout: {
+      type: "string",
+      description: "Wait-loop timeout in milliseconds (requires --wait; default: time remaining to the session's expiry). Note the unit: this is milliseconds."
+    }
+  },
+  async run({ args }) {
+    const flags = args;
+    const cfg = await resolveEffectiveConfig({
+      apiKey: flags["api-key"],
+      baseUrl: flags["base-url"],
+      profile: flags.profile
+    });
+    if (!cfg.apiKey) {
+      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
+      process.exit(3);
+    }
+    const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
+    const out = buildOutputStreams();
+    await runAccountConnectSessionPoll(client, flags, out);
+  }
+});
+var accountConnectSessionCommand = defineCommand({
+  meta: { name: "connect-session", description: "Hosted connect-link session operations (poll for completion)." },
+  subCommands: {
+    poll: accountConnectSessionPollCommand
+  },
+  async run() {
+    process.stderr.write("Usage: curviate account connect-session poll --session <session_id>\n");
+  }
+});
+var accountReconnectCommand = defineCommand({
+  meta: {
+    name: "reconnect",
+    description: "Re-authorize a disconnected account in place. If LinkedIn requires verification you'll be prompted for the code interactively; in a non-interactive shell the command exits 12 and you finish with `curviate account checkpoint submit`."
+  },
+  args: {
+    ...WRITE_SINGLE_FLAGS,
+    "account-id": { type: "positional", description: "Account id (acc_\u2026)." },
+    "auth-method": { type: "string", description: "Authentication method: credentials | cookie.", required: true },
+    email: { type: "string", description: "LinkedIn email (credentials method)." },
+    password: { type: "string", description: `LinkedIn password (credentials method). ${PW_WARNING("--password-stdin", "CURVIATE_LINKEDIN_PASSWORD")}` },
+    "password-stdin": { type: "boolean", description: "Read the LinkedIn password from stdin (one line, trimmed).", default: false },
+    "li-at": { type: "string", description: `LinkedIn session cookie li_at (cookie method). ${PW_WARNING("--li-at-stdin", "CURVIATE_LINKEDIN_LI_AT")}` },
+    "li-at-stdin": { type: "boolean", description: "Read the li_at session cookie from stdin (one line, trimmed).", default: false },
+    "li-a": { type: "string", description: `Optional premium session cookie li_a (cookie method). ${OPTIONAL_SECRET_WARNING("CURVIATE_LINKEDIN_LI_A")}` },
+    country: { type: "string", description: "Proxy location hint (ISO 3166-1 alpha-2)." },
+    ip: { type: "string", description: "IP to infer the managed proxy location." },
+    "proxy-protocol": { type: "string", description: "Proxy protocol: http | https | socks5." },
+    "proxy-host": { type: "string", description: "Proxy host or IP." },
+    "proxy-port": { type: "string", description: "Proxy port." },
+    "proxy-username": { type: "string", description: "Proxy auth username." },
+    "proxy-password": { type: "string", description: `Proxy auth password. ${OPTIONAL_SECRET_WARNING("CURVIATE_PROXY_PASSWORD")}` },
+    "user-agent": { type: "string", description: "Browser User-Agent to pin." },
+    "recruiter-contract-id": { type: "string", description: "Recruiter contract id (Recruiter tier only)." },
+    "no-interactive": {
+      type: "boolean",
+      description: "Never prompt for a checkpoint code \u2014 on a checkpoint, always render the envelope and exit 12, even on a TTY.",
+      default: false
+    }
+  },
+  async run({ args }) {
+    const flags = args;
+    const cfg = await resolveEffectiveConfig({
+      apiKey: flags["api-key"],
+      baseUrl: flags["base-url"],
+      timeout: flags.timeout,
+      profile: flags.profile
+    });
+    if (!cfg.apiKey) {
+      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
+      process.exit(3);
+    }
+    const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
+    const out = buildOutputStreams();
+    await runAccountReconnect(client, flags, out);
+  }
+});
+var accountRefreshCommand = defineCommand({
+  meta: { name: "refresh", description: "Refresh an account's synced data sources." },
+  args: {
+    ...WRITE_SINGLE_FLAGS,
+    "account-id": { type: "positional", description: "Account id (acc_\u2026)." }
+  },
+  async run({ args }) {
+    const flags = args;
+    const cfg = await resolveEffectiveConfig({
+      apiKey: flags["api-key"],
+      baseUrl: flags["base-url"],
+      timeout: flags.timeout,
+      profile: flags.profile
+    });
+    if (!cfg.apiKey) {
+      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
+      process.exit(3);
+    }
+    const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
+    const out = buildOutputStreams();
+    await runAccountRefresh(client, flags, out);
+  }
+});
+var accountUpdateCommand = defineCommand({
+  meta: { name: "update", description: "Update managed-proxy configuration for an account." },
+  args: {
+    ...WRITE_SINGLE_FLAGS,
+    "account-id": { type: "positional", description: "Account id (acc_\u2026)." },
+    country: { type: "string", description: "Proxy location hint (ISO 3166-1 alpha-2)." },
+    ip: { type: "string", description: "IP to infer the managed proxy location." },
+    "proxy-protocol": { type: "string", description: "Proxy protocol: http | https | socks5." },
+    "proxy-host": { type: "string", description: "Proxy host or IP." },
+    "proxy-port": { type: "string", description: "Proxy port." },
+    "proxy-username": { type: "string", description: "Proxy auth username." },
+    "proxy-password": { type: "string", description: `Proxy auth password. ${OPTIONAL_SECRET_WARNING("CURVIATE_PROXY_PASSWORD")}` }
+  },
+  async run({ args }) {
+    const flags = args;
+    const cfg = await resolveEffectiveConfig({
+      apiKey: flags["api-key"],
+      baseUrl: flags["base-url"],
+      timeout: flags.timeout,
+      profile: flags.profile
+    });
+    if (!cfg.apiKey) {
+      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
+      process.exit(3);
+    }
+    const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
+    const out = buildOutputStreams();
+    await runAccountUpdate(client, flags, out);
+  }
+});
+var accountDisconnectCommand = defineCommand({
+  meta: { name: "disconnect", description: "Hard-disconnect a LinkedIn account and release its seat." },
+  args: {
+    ...WRITE_SINGLE_FLAGS,
+    "account-id": { type: "positional", description: "Account id (acc_\u2026)." }
+  },
+  async run({ args }) {
+    const flags = args;
+    const cfg = await resolveEffectiveConfig({
+      apiKey: flags["api-key"],
+      baseUrl: flags["base-url"],
+      timeout: flags.timeout,
+      profile: flags.profile
+    });
+    if (!cfg.apiKey) {
+      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
+      process.exit(3);
+    }
+    const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
+    const out = buildOutputStreams();
+    await runAccountDisconnect(client, flags, out);
+  }
+});
+var accountCheckpointSubmitCommand = defineCommand({
+  meta: { name: "submit", description: "Submit an OTP / 2FA code to resolve a checkpoint challenge." },
+  args: {
+    ...WRITE_SINGLE_FLAGS,
+    checkpoint: {
+      type: "string",
+      description: "The provisional account_id from the 202 checkpoint_required response.",
+      required: true
+    },
+    code: {
+      type: "string",
+      description: "The OTP / 2FA verification code.",
+      required: true
+    }
+  },
+  async run({ args }) {
+    const flags = args;
+    const cfg = await resolveEffectiveConfig({
+      apiKey: flags["api-key"],
+      baseUrl: flags["base-url"],
+      timeout: flags.timeout,
+      profile: flags.profile
+    });
+    if (!cfg.apiKey) {
+      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
+      process.exit(3);
+    }
+    const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
+    const out = buildOutputStreams();
+    await runAccountCheckpointSubmit(client, flags, out);
+  }
+});
+var accountCheckpointPollCommand = defineCommand({
+  meta: {
+    name: "poll",
+    description: "Poll for mobile-app approval of a pending checkpoint challenge. With --wait, blocks on an adaptive cadence until a terminal state (or --timeout elapses) instead of a single poll."
+  },
+  args: {
+    ...WRITE_SINGLE_FLAGS,
+    checkpoint: {
+      type: "string",
+      description: "The provisional account_id from the 202 checkpoint_required response.",
+      required: true
+    },
+    wait: {
+      type: "boolean",
+      description: "Poll on an adaptive cadence (1000ms, then 1500ms for 30s, then 3000ms) until a terminal state, instead of a single poll.",
+      default: false
+    },
+    // Override WRITE_SINGLE_FLAGS.timeout: on this command --timeout is the
+    // --wait loop's own wall-clock bound in MILLISECONDS (requires --wait) —
+    // NOT the SDK request timeout, and NOT seconds like `inbox sync-chat
+    // --timeout`. Default: the time remaining to the checkpoint's own expiry.
+    timeout: {
+      type: "string",
+      description: "Wait-loop timeout in milliseconds (requires --wait; default: time remaining to the checkpoint's expiry). Note the unit: this is milliseconds \u2014 `inbox sync-chat --timeout` is seconds."
+    }
+  },
+  async run({ args }) {
+    const flags = args;
+    const cfg = await resolveEffectiveConfig({
+      apiKey: flags["api-key"],
+      baseUrl: flags["base-url"],
+      profile: flags.profile
+    });
+    if (!cfg.apiKey) {
+      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
+      process.exit(3);
+    }
+    const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
+    const out = buildOutputStreams();
+    await runAccountCheckpointPoll(client, flags, out);
+  }
+});
+var accountCheckpointResendCommand = defineCommand({
+  meta: {
+    name: "resend",
+    description: "Re-send the challenge notification for a pending checkpoint (e.g. re-send an OTP email, SMS code, or mobile-app approval push). Not every challenge type supports resend \u2014 an authenticator- app code has nothing to re-send. The response's `resent` boolean tells you honestly whether a new notification actually went out; the command still exits 0 either way."
+  },
+  args: {
+    ...WRITE_SINGLE_FLAGS,
+    checkpoint: {
+      type: "string",
+      description: "The provisional account_id from the 202 checkpoint_required response.",
+      required: true
+    }
+  },
+  async run({ args }) {
+    const flags = args;
+    const cfg = await resolveEffectiveConfig({
+      apiKey: flags["api-key"],
+      baseUrl: flags["base-url"],
+      timeout: flags.timeout,
+      profile: flags.profile
+    });
+    if (!cfg.apiKey) {
+      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
+      process.exit(3);
+    }
+    const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
+    const out = buildOutputStreams();
+    await runAccountCheckpointResend(client, flags, out);
+  }
+});
+var accountCheckpointCommand = defineCommand({
+  meta: {
+    name: "checkpoint",
+    description: "Checkpoint challenge operations (submit OTP, poll mobile-app approval, or resend the challenge notification)."
+  },
+  subCommands: {
+    submit: accountCheckpointSubmitCommand,
+    poll: accountCheckpointPollCommand,
+    resend: accountCheckpointResendCommand
+  },
+  async run() {
+    process.stderr.write("Usage: curviate account checkpoint submit | poll | resend\n");
+  }
+});
+var accountCommand = defineCommand({
+  meta: { name: "account", description: "LinkedIn account connection management." },
+  subCommands: {
+    list: accountListCommand,
+    get: accountGetCommand,
+    link: accountLinkCommand,
+    "connect-link": accountConnectLinkCommand,
+    "connect-session": accountConnectSessionCommand,
+    reconnect: accountReconnectCommand,
+    refresh: accountRefreshCommand,
+    update: accountUpdateCommand,
+    disconnect: accountDisconnectCommand,
+    checkpoint: accountCheckpointCommand
+  },
+  async run() {
+    process.stderr.write(
+      "Usage: curviate account <subcommand>\n  list | get | link | connect-link | connect-session poll | reconnect | refresh | update | disconnect | checkpoint\n"
+    );
+  }
+});
+export {
+  accountCommand,
+  runAccountCheckpointPoll,
+  runAccountCheckpointResend,
+  runAccountCheckpointSubmit,
+  runAccountConnectLink,
+  runAccountConnectSessionPoll,
+  runAccountDisconnect,
+  runAccountGet,
+  runAccountLink,
+  runAccountList,
+  runAccountReconnect,
+  runAccountRefresh,
+  runAccountUpdate
+};