@revfleet/hscli 0.5.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (329) hide show
  1. package/CHANGELOG.md +466 -0
  2. package/LICENSE +21 -0
  3. package/README.md +287 -0
  4. package/SECURITY.md +68 -0
  5. package/dist/cli.d.ts +8 -0
  6. package/dist/cli.js +192 -0
  7. package/dist/cli.js.map +1 -0
  8. package/dist/commands/account/index.d.ts +3 -0
  9. package/dist/commands/account/index.js +65 -0
  10. package/dist/commands/account/index.js.map +1 -0
  11. package/dist/commands/api/index.d.ts +3 -0
  12. package/dist/commands/api/index.js +35 -0
  13. package/dist/commands/api/index.js.map +1 -0
  14. package/dist/commands/auth/index.d.ts +3 -0
  15. package/dist/commands/auth/index.js +229 -0
  16. package/dist/commands/auth/index.js.map +1 -0
  17. package/dist/commands/automation/index.d.ts +3 -0
  18. package/dist/commands/automation/index.js +119 -0
  19. package/dist/commands/automation/index.js.map +1 -0
  20. package/dist/commands/cms/blog-settings.d.ts +3 -0
  21. package/dist/commands/cms/blog-settings.js +70 -0
  22. package/dist/commands/cms/blog-settings.js.map +1 -0
  23. package/dist/commands/cms/content-ops.d.ts +13 -0
  24. package/dist/commands/cms/content-ops.js +262 -0
  25. package/dist/commands/cms/content-ops.js.map +1 -0
  26. package/dist/commands/cms/hubdb.d.ts +3 -0
  27. package/dist/commands/cms/hubdb.js +55 -0
  28. package/dist/commands/cms/hubdb.js.map +1 -0
  29. package/dist/commands/cms/index.d.ts +3 -0
  30. package/dist/commands/cms/index.js +119 -0
  31. package/dist/commands/cms/index.js.map +1 -0
  32. package/dist/commands/cms/source-code.d.ts +3 -0
  33. package/dist/commands/cms/source-code.js +101 -0
  34. package/dist/commands/cms/source-code.js.map +1 -0
  35. package/dist/commands/communication-preferences/index.d.ts +3 -0
  36. package/dist/commands/communication-preferences/index.js +107 -0
  37. package/dist/commands/communication-preferences/index.js.map +1 -0
  38. package/dist/commands/conversations/index.d.ts +3 -0
  39. package/dist/commands/conversations/index.js +233 -0
  40. package/dist/commands/conversations/index.js.map +1 -0
  41. package/dist/commands/crm/associations.d.ts +3 -0
  42. package/dist/commands/crm/associations.js +180 -0
  43. package/dist/commands/crm/associations.js.map +1 -0
  44. package/dist/commands/crm/cards.d.ts +3 -0
  45. package/dist/commands/crm/cards.js +72 -0
  46. package/dist/commands/crm/cards.js.map +1 -0
  47. package/dist/commands/crm/carts.d.ts +3 -0
  48. package/dist/commands/crm/carts.js +5 -0
  49. package/dist/commands/crm/carts.js.map +1 -0
  50. package/dist/commands/crm/communications.d.ts +3 -0
  51. package/dist/commands/crm/communications.js +5 -0
  52. package/dist/commands/crm/communications.js.map +1 -0
  53. package/dist/commands/crm/companies.d.ts +3 -0
  54. package/dist/commands/crm/companies.js +5 -0
  55. package/dist/commands/crm/companies.js.map +1 -0
  56. package/dist/commands/crm/contacts.d.ts +3 -0
  57. package/dist/commands/crm/contacts.js +5 -0
  58. package/dist/commands/crm/contacts.js.map +1 -0
  59. package/dist/commands/crm/custom-objects.d.ts +3 -0
  60. package/dist/commands/crm/custom-objects.js +83 -0
  61. package/dist/commands/crm/custom-objects.js.map +1 -0
  62. package/dist/commands/crm/dated.d.ts +9 -0
  63. package/dist/commands/crm/dated.js +247 -0
  64. package/dist/commands/crm/dated.js.map +1 -0
  65. package/dist/commands/crm/deals.d.ts +3 -0
  66. package/dist/commands/crm/deals.js +5 -0
  67. package/dist/commands/crm/deals.js.map +1 -0
  68. package/dist/commands/crm/describe.d.ts +3 -0
  69. package/dist/commands/crm/describe.js +89 -0
  70. package/dist/commands/crm/describe.js.map +1 -0
  71. package/dist/commands/crm/discounts.d.ts +3 -0
  72. package/dist/commands/crm/discounts.js +5 -0
  73. package/dist/commands/crm/discounts.js.map +1 -0
  74. package/dist/commands/crm/engagements.d.ts +3 -0
  75. package/dist/commands/crm/engagements.js +8 -0
  76. package/dist/commands/crm/engagements.js.map +1 -0
  77. package/dist/commands/crm/fees.d.ts +3 -0
  78. package/dist/commands/crm/fees.js +5 -0
  79. package/dist/commands/crm/fees.js.map +1 -0
  80. package/dist/commands/crm/goals.d.ts +3 -0
  81. package/dist/commands/crm/goals.js +30 -0
  82. package/dist/commands/crm/goals.js.map +1 -0
  83. package/dist/commands/crm/imports.d.ts +3 -0
  84. package/dist/commands/crm/imports.js +45 -0
  85. package/dist/commands/crm/imports.js.map +1 -0
  86. package/dist/commands/crm/index.d.ts +3 -0
  87. package/dist/commands/crm/index.js +64 -0
  88. package/dist/commands/crm/index.js.map +1 -0
  89. package/dist/commands/crm/invoices.d.ts +3 -0
  90. package/dist/commands/crm/invoices.js +5 -0
  91. package/dist/commands/crm/invoices.js.map +1 -0
  92. package/dist/commands/crm/leads.d.ts +3 -0
  93. package/dist/commands/crm/leads.js +5 -0
  94. package/dist/commands/crm/leads.js.map +1 -0
  95. package/dist/commands/crm/line-items.d.ts +3 -0
  96. package/dist/commands/crm/line-items.js +5 -0
  97. package/dist/commands/crm/line-items.js.map +1 -0
  98. package/dist/commands/crm/orders.d.ts +3 -0
  99. package/dist/commands/crm/orders.js +5 -0
  100. package/dist/commands/crm/orders.js.map +1 -0
  101. package/dist/commands/crm/owners.d.ts +3 -0
  102. package/dist/commands/crm/owners.js +22 -0
  103. package/dist/commands/crm/owners.js.map +1 -0
  104. package/dist/commands/crm/payments.d.ts +3 -0
  105. package/dist/commands/crm/payments.js +5 -0
  106. package/dist/commands/crm/payments.js.map +1 -0
  107. package/dist/commands/crm/pipelines.d.ts +3 -0
  108. package/dist/commands/crm/pipelines.js +70 -0
  109. package/dist/commands/crm/pipelines.js.map +1 -0
  110. package/dist/commands/crm/products.d.ts +3 -0
  111. package/dist/commands/crm/products.js +5 -0
  112. package/dist/commands/crm/products.js.map +1 -0
  113. package/dist/commands/crm/properties.d.ts +3 -0
  114. package/dist/commands/crm/properties.js +103 -0
  115. package/dist/commands/crm/properties.js.map +1 -0
  116. package/dist/commands/crm/quotes.d.ts +3 -0
  117. package/dist/commands/crm/quotes.js +5 -0
  118. package/dist/commands/crm/quotes.js.map +1 -0
  119. package/dist/commands/crm/shared.d.ts +17 -0
  120. package/dist/commands/crm/shared.js +256 -0
  121. package/dist/commands/crm/shared.js.map +1 -0
  122. package/dist/commands/crm/subscriptions.d.ts +3 -0
  123. package/dist/commands/crm/subscriptions.js +5 -0
  124. package/dist/commands/crm/subscriptions.js.map +1 -0
  125. package/dist/commands/crm/sync.d.ts +3 -0
  126. package/dist/commands/crm/sync.js +116 -0
  127. package/dist/commands/crm/sync.js.map +1 -0
  128. package/dist/commands/crm/taxes.d.ts +3 -0
  129. package/dist/commands/crm/taxes.js +5 -0
  130. package/dist/commands/crm/taxes.js.map +1 -0
  131. package/dist/commands/crm/tickets.d.ts +3 -0
  132. package/dist/commands/crm/tickets.js +5 -0
  133. package/dist/commands/crm/tickets.js.map +1 -0
  134. package/dist/commands/crm/users.d.ts +3 -0
  135. package/dist/commands/crm/users.js +5 -0
  136. package/dist/commands/crm/users.js.map +1 -0
  137. package/dist/commands/doctor/index.d.ts +3 -0
  138. package/dist/commands/doctor/index.js +232 -0
  139. package/dist/commands/doctor/index.js.map +1 -0
  140. package/dist/commands/domains/shared.d.ts +13 -0
  141. package/dist/commands/domains/shared.js +56 -0
  142. package/dist/commands/domains/shared.js.map +1 -0
  143. package/dist/commands/email-events/index.d.ts +3 -0
  144. package/dist/commands/email-events/index.js +77 -0
  145. package/dist/commands/email-events/index.js.map +1 -0
  146. package/dist/commands/events/index.d.ts +3 -0
  147. package/dist/commands/events/index.js +80 -0
  148. package/dist/commands/events/index.js.map +1 -0
  149. package/dist/commands/exports/index.d.ts +3 -0
  150. package/dist/commands/exports/index.js +45 -0
  151. package/dist/commands/exports/index.js.map +1 -0
  152. package/dist/commands/extensions/index.d.ts +3 -0
  153. package/dist/commands/extensions/index.js +118 -0
  154. package/dist/commands/extensions/index.js.map +1 -0
  155. package/dist/commands/feature-flags/index.d.ts +3 -0
  156. package/dist/commands/feature-flags/index.js +65 -0
  157. package/dist/commands/feature-flags/index.js.map +1 -0
  158. package/dist/commands/files/folders.d.ts +3 -0
  159. package/dist/commands/files/folders.js +74 -0
  160. package/dist/commands/files/folders.js.map +1 -0
  161. package/dist/commands/files/index.d.ts +3 -0
  162. package/dist/commands/files/index.js +30 -0
  163. package/dist/commands/files/index.js.map +1 -0
  164. package/dist/commands/forms/index.d.ts +3 -0
  165. package/dist/commands/forms/index.js +37 -0
  166. package/dist/commands/forms/index.js.map +1 -0
  167. package/dist/commands/integrations/index.d.ts +3 -0
  168. package/dist/commands/integrations/index.js +64 -0
  169. package/dist/commands/integrations/index.js.map +1 -0
  170. package/dist/commands/integrators/index.d.ts +3 -0
  171. package/dist/commands/integrators/index.js +79 -0
  172. package/dist/commands/integrators/index.js.map +1 -0
  173. package/dist/commands/legacy/index.d.ts +13 -0
  174. package/dist/commands/legacy/index.js +254 -0
  175. package/dist/commands/legacy/index.js.map +1 -0
  176. package/dist/commands/legacy-v1/index.d.ts +29 -0
  177. package/dist/commands/legacy-v1/index.js +568 -0
  178. package/dist/commands/legacy-v1/index.js.map +1 -0
  179. package/dist/commands/lists/index.d.ts +3 -0
  180. package/dist/commands/lists/index.js +148 -0
  181. package/dist/commands/lists/index.js.map +1 -0
  182. package/dist/commands/marketing/ads.d.ts +3 -0
  183. package/dist/commands/marketing/ads.js +45 -0
  184. package/dist/commands/marketing/ads.js.map +1 -0
  185. package/dist/commands/marketing/behavioral-events.d.ts +3 -0
  186. package/dist/commands/marketing/behavioral-events.js +38 -0
  187. package/dist/commands/marketing/behavioral-events.js.map +1 -0
  188. package/dist/commands/marketing/events.d.ts +3 -0
  189. package/dist/commands/marketing/events.js +69 -0
  190. package/dist/commands/marketing/events.js.map +1 -0
  191. package/dist/commands/marketing/index.d.ts +3 -0
  192. package/dist/commands/marketing/index.js +55 -0
  193. package/dist/commands/marketing/index.js.map +1 -0
  194. package/dist/commands/marketing/landing-pages.d.ts +3 -0
  195. package/dist/commands/marketing/landing-pages.js +48 -0
  196. package/dist/commands/marketing/landing-pages.js.map +1 -0
  197. package/dist/commands/marketing/seo.d.ts +3 -0
  198. package/dist/commands/marketing/seo.js +35 -0
  199. package/dist/commands/marketing/seo.js.map +1 -0
  200. package/dist/commands/marketing/social.d.ts +3 -0
  201. package/dist/commands/marketing/social.js +45 -0
  202. package/dist/commands/marketing/social.js.map +1 -0
  203. package/dist/commands/marketing/subscriptions.d.ts +3 -0
  204. package/dist/commands/marketing/subscriptions.js +27 -0
  205. package/dist/commands/marketing/subscriptions.js.map +1 -0
  206. package/dist/commands/marketing/transactional.d.ts +3 -0
  207. package/dist/commands/marketing/transactional.js +30 -0
  208. package/dist/commands/marketing/transactional.js.map +1 -0
  209. package/dist/commands/marketing-emails-v1/index.d.ts +3 -0
  210. package/dist/commands/marketing-emails-v1/index.js +72 -0
  211. package/dist/commands/marketing-emails-v1/index.js.map +1 -0
  212. package/dist/commands/mcp.d.ts +2 -0
  213. package/dist/commands/mcp.js +10 -0
  214. package/dist/commands/mcp.js.map +1 -0
  215. package/dist/commands/media-bridge/index.d.ts +3 -0
  216. package/dist/commands/media-bridge/index.js +209 -0
  217. package/dist/commands/media-bridge/index.js.map +1 -0
  218. package/dist/commands/reporting/index.d.ts +3 -0
  219. package/dist/commands/reporting/index.js +73 -0
  220. package/dist/commands/reporting/index.js.map +1 -0
  221. package/dist/commands/sales/calling.d.ts +3 -0
  222. package/dist/commands/sales/calling.js +32 -0
  223. package/dist/commands/sales/calling.js.map +1 -0
  224. package/dist/commands/sales/index.d.ts +3 -0
  225. package/dist/commands/sales/index.js +10 -0
  226. package/dist/commands/sales/index.js.map +1 -0
  227. package/dist/commands/sales/meetings.d.ts +3 -0
  228. package/dist/commands/sales/meetings.js +37 -0
  229. package/dist/commands/sales/meetings.js.map +1 -0
  230. package/dist/commands/sales/sequences.d.ts +3 -0
  231. package/dist/commands/sales/sequences.js +78 -0
  232. package/dist/commands/sales/sequences.js.map +1 -0
  233. package/dist/commands/seed/cms.d.ts +6 -0
  234. package/dist/commands/seed/cms.js +204 -0
  235. package/dist/commands/seed/cms.js.map +1 -0
  236. package/dist/commands/seed/commerce.d.ts +3 -0
  237. package/dist/commands/seed/commerce.js +117 -0
  238. package/dist/commands/seed/commerce.js.map +1 -0
  239. package/dist/commands/seed/context.d.ts +8 -0
  240. package/dist/commands/seed/context.js +76 -0
  241. package/dist/commands/seed/context.js.map +1 -0
  242. package/dist/commands/seed/crm-core.d.ts +3 -0
  243. package/dist/commands/seed/crm-core.js +137 -0
  244. package/dist/commands/seed/crm-core.js.map +1 -0
  245. package/dist/commands/seed/data.d.ts +73 -0
  246. package/dist/commands/seed/data.js +49 -0
  247. package/dist/commands/seed/data.js.map +1 -0
  248. package/dist/commands/seed/engagements.d.ts +3 -0
  249. package/dist/commands/seed/engagements.js +89 -0
  250. package/dist/commands/seed/engagements.js.map +1 -0
  251. package/dist/commands/seed/index.d.ts +3 -0
  252. package/dist/commands/seed/index.js +95 -0
  253. package/dist/commands/seed/index.js.map +1 -0
  254. package/dist/commands/seed/infra.d.ts +6 -0
  255. package/dist/commands/seed/infra.js +163 -0
  256. package/dist/commands/seed/infra.js.map +1 -0
  257. package/dist/commands/seed/marketing.d.ts +3 -0
  258. package/dist/commands/seed/marketing.js +172 -0
  259. package/dist/commands/seed/marketing.js.map +1 -0
  260. package/dist/commands/seed/shared.d.ts +8 -0
  261. package/dist/commands/seed/shared.js +37 -0
  262. package/dist/commands/seed/shared.js.map +1 -0
  263. package/dist/commands/seed/types.d.ts +44 -0
  264. package/dist/commands/seed/types.js +2 -0
  265. package/dist/commands/seed/types.js.map +1 -0
  266. package/dist/commands/service/chatflows.d.ts +3 -0
  267. package/dist/commands/service/chatflows.js +30 -0
  268. package/dist/commands/service/chatflows.js.map +1 -0
  269. package/dist/commands/service/index.d.ts +3 -0
  270. package/dist/commands/service/index.js +25 -0
  271. package/dist/commands/service/index.js.map +1 -0
  272. package/dist/commands/service/knowledge-base.d.ts +3 -0
  273. package/dist/commands/service/knowledge-base.js +19 -0
  274. package/dist/commands/service/knowledge-base.js.map +1 -0
  275. package/dist/commands/service/pipelines.d.ts +3 -0
  276. package/dist/commands/service/pipelines.js +36 -0
  277. package/dist/commands/service/pipelines.js.map +1 -0
  278. package/dist/commands/settings/index.d.ts +3 -0
  279. package/dist/commands/settings/index.js +149 -0
  280. package/dist/commands/settings/index.js.map +1 -0
  281. package/dist/commands/site-search/index.d.ts +3 -0
  282. package/dist/commands/site-search/index.js +36 -0
  283. package/dist/commands/site-search/index.js.map +1 -0
  284. package/dist/commands/timeline/index.d.ts +3 -0
  285. package/dist/commands/timeline/index.js +32 -0
  286. package/dist/commands/timeline/index.js.map +1 -0
  287. package/dist/commands/webhooks/index.d.ts +3 -0
  288. package/dist/commands/webhooks/index.js +41 -0
  289. package/dist/commands/webhooks/index.js.map +1 -0
  290. package/dist/commands/workflows/index.d.ts +3 -0
  291. package/dist/commands/workflows/index.js +13 -0
  292. package/dist/commands/workflows/index.js.map +1 -0
  293. package/dist/core/auth.d.ts +33 -0
  294. package/dist/core/auth.js +137 -0
  295. package/dist/core/auth.js.map +1 -0
  296. package/dist/core/capabilities.d.ts +60 -0
  297. package/dist/core/capabilities.js +559 -0
  298. package/dist/core/capabilities.js.map +1 -0
  299. package/dist/core/http.d.ts +47 -0
  300. package/dist/core/http.js +433 -0
  301. package/dist/core/http.js.map +1 -0
  302. package/dist/core/output.d.ts +23 -0
  303. package/dist/core/output.js +197 -0
  304. package/dist/core/output.js.map +1 -0
  305. package/dist/core/permissions.d.ts +9 -0
  306. package/dist/core/permissions.js +27 -0
  307. package/dist/core/permissions.js.map +1 -0
  308. package/dist/core/plugins.d.ts +42 -0
  309. package/dist/core/plugins.js +94 -0
  310. package/dist/core/plugins.js.map +1 -0
  311. package/dist/core/policy.d.ts +2 -0
  312. package/dist/core/policy.js +38 -0
  313. package/dist/core/policy.js.map +1 -0
  314. package/dist/core/schema-cache.d.ts +56 -0
  315. package/dist/core/schema-cache.js +338 -0
  316. package/dist/core/schema-cache.js.map +1 -0
  317. package/dist/core/schemas.d.ts +96 -0
  318. package/dist/core/schemas.js +104 -0
  319. package/dist/core/schemas.js.map +1 -0
  320. package/dist/core/urls.d.ts +50 -0
  321. package/dist/core/urls.js +122 -0
  322. package/dist/core/urls.js.map +1 -0
  323. package/dist/core/vault.d.ts +37 -0
  324. package/dist/core/vault.js +143 -0
  325. package/dist/core/vault.js.map +1 -0
  326. package/dist/mcp/server.d.ts +5 -0
  327. package/dist/mcp/server.js +680 -0
  328. package/dist/mcp/server.js.map +1 -0
  329. package/package.json +84 -0
package/CHANGELOG.md ADDED
@@ -0,0 +1,466 @@
1
+ # Changelog
2
+
3
+ ## 0.5.3 - 2026-04-21
4
+
5
+ **npm package scoped to `@revfleet/hscli`.** After npm's anti-typosquat
6
+ rule rejected both `hubcli` (too similar to `hub-cli`, an unrelated
7
+ ArcGIS CLI) and `hscli` (too similar to `hs-cli`, another generic
8
+ package), we moved the package to the authors organization on npm. This
9
+ is the same pattern HubSpot itself uses for their own packages
10
+ (`@hubspot/cli`, `@hubspot/api-client`).
11
+
12
+ ### Install
13
+
14
+ ```bash
15
+ npm install -g @revfleet/hscli
16
+ ```
17
+
18
+ Binary + everything else is unchanged: `hscli crm contacts list`.
19
+
20
+ ### Why @revfleet/
21
+
22
+ `revfleet` is the authors product organization for CRM + HubSpot
23
+ operational tooling. Future siblings (`@revfleet/orchestrator`,
24
+ `@revfleet/audit`, etc.) will live under the same scope, so the
25
+ authorship and maintenance signal stays coherent across the toolchain.
26
+
27
+ ### Zero behavior change
28
+
29
+ - 162 tests still pass
30
+ - 0 npm audit vulnerabilities
31
+ - 100% HubSpot API coverage
32
+ - Same binary name (`hscli`)
33
+ - Same config dir (`~/.hscli/`)
34
+ - Same env vars (`HSCLI_*`)
35
+
36
+ ---
37
+
38
+ ## 0.5.2 - 2026-04-21
39
+
40
+ **Rename: `hubcli` → `hscli`.** npm's anti-typosquat rule rejected
41
+ the `hubcli` name because it's "too similar to hub-cli" (an unrelated
42
+ ArcGIS Portal CLI). Rather than fight the heuristic with an appeal,
43
+ we renamed cleanly.
44
+
45
+ ### What changes
46
+
47
+ - **npm package**: `hubcli` → `hscli`. Install: `npm install -g hscli`.
48
+ - **Binary**: `hubcli` → `hscli`. Daily use: `hscli crm contacts list`.
49
+ - **Config directory**: `~/.hubcli/` → `~/.hscli/`. Existing users migrate
50
+ by running `mv ~/.hubcli ~/.hscli`.
51
+ - **Env vars**: `HUBCLI_*` → `HSCLI_*` (HSCLI_PROFILE, HSCLI_HOME,
52
+ HSCLI_MCP_PROFILE, HSCLI_TELEMETRY_FILE, HSCLI_VAULT_PASSPHRASE,
53
+ HSCLI_STRICT_CAPABILITIES, HSCLI_MCP_STRICT_CAPABILITIES,
54
+ HSCLI_MCP_TOOL_NAME, HSCLI_REQUEST_ID, HSCLI_TRACE_BODIES,
55
+ HSCLI_DEV_APP_ID, HSCLI_ENDPOINTS_JSON, HSCLI_PLUGINS,
56
+ HSCLI_ENABLE_SANDBOX_CONTRACT, HSCLI_SANDBOX_TOKEN).
57
+
58
+ ### Build hygiene
59
+
60
+ - Added `rm -rf dist` to the build script so tarballs ship clean
61
+ (previous 0.5.1 tarball would have included stale `dist/commands/
62
+ seed.js` alongside the new `dist/commands/seed/` modules).
63
+
64
+ ### No behavior change
65
+
66
+ All 162 tests still pass. 100% API coverage preserved. Same commands,
67
+ same flags, same MCP tools — just renamed.
68
+
69
+ ---
70
+
71
+ # Changelog
72
+
73
+ ## 0.5.0 - 2026-04-21
74
+
75
+ **100% HubSpot public API coverage.** Every one of the 1,180 endpoints in
76
+ HubSpot's dev-docs surface now has a dedicated hubcli subcommand or an
77
+ alternate-path variant. Cross-reference against the scrape at
78
+ `~/Desktop/vault/HubSpot Audit/api-mapping/endpoints.json` (1,180
79
+ endpoints across 70 path roots) shows 1180 / 1180 covered.
80
+
81
+ Positioning: hubcli is now the **headless HubSpot** with full portal
82
+ coverage — every portal operation that can be done through HubSpot's UI
83
+ can be done through hubcli, with no UI dependency (enterprise safety
84
+ rails: policy-guarded writes, idempotency keys, rate-limit aware,
85
+ read-only profiles, JSON/CSV/YAML output).
86
+
87
+ ### Added — 8 first-class CRM objects
88
+
89
+ `crm leads`, `crm carts`, `crm orders`, `crm discounts`, `crm fees`,
90
+ `crm taxes`, `crm communications`, `crm users` — each with the full
91
+ `registerObjectCommands` surface: list, get, search, filter, count,
92
+ create, update, delete, batch-read, batch-upsert, batch-archive.
93
+
94
+ ### Added — CMS deep coverage
95
+
96
+ - Full content-op lifecycle on every CMS content type (`site-pages`,
97
+ `pages`, `landing-pages`, `landing-page-folders`, `blog-posts`,
98
+ `blogs`, `blog-authors`, `blog-tags`, `redirects`) via a generic
99
+ `registerCmsContentCommands` helper: CRUD + batch (read/create/update/
100
+ archive) + `clone` + `schedule` + `draft {get,update,push-live,reset}`
101
+ + `revisions {list,get,restore,restore-to-draft}` + `ab-test
102
+ {create-variation,end,rerun}` + `multi-language {attach,create-
103
+ variation,detach,set-primary,update-languages}`.
104
+ - `cms blog-settings {get,update,revisions}` + `multi-language` subcmds.
105
+ - `cms source-code {get,create,update,delete,metadata,validate,extract,
106
+ extract-status}` — theme/module source code CRUD via public API.
107
+ - `cms domains`, `cms audit-logs`, `cms seo-audit`, `cms search`,
108
+ `cms topics`.
109
+
110
+ ### Added — New top-level domains
111
+
112
+ - `media-bridge` — full video/media partner API: properties CRUD +
113
+ batch, property groups, schemas + associations, settings (register,
114
+ event-visibility, object-definitions, oembed-domains), playback
115
+ events (attention-span, media-played, media-played-percent).
116
+ - `feature-flags` — app-dev feature flag framework CRUD.
117
+ - `extensions calling|videoconferencing|accounting` + raw escape hatch
118
+ for future `/crm/v3/extensions/*` APIs.
119
+ - `integrators timeline-event-templates` + `tokens` — app-dev timeline
120
+ event templates with token subresources.
121
+ - `integrations {me,timeline {create,batch-create,update,delete}}` —
122
+ partner app introspection + application timeline event CRUD.
123
+ - `broadcast` + `broadcasts-root` — legacy social broadcast scheduling.
124
+ - `visitor-identification` — chat widget identification token.
125
+ - `submissions` — forms submissions across v1 + v3 paths.
126
+ - `scheduler` — Meetings Scheduler (list links, book, reschedule,
127
+ cancel).
128
+ - `tax` — tax rates CRUD (commerce).
129
+ - `appinstalls` — partner app external install lifecycle.
130
+ - `marketing-extras` — ads events submission + legacy email A/B test.
131
+ - `marketing-emails-v1` — legacy v1 email campaigns (for portals still
132
+ on old content): CRUD + clone + publish/unpublish + stats.
133
+ - `owners-extras` — archived owners listing.
134
+ - `business-units` — root `/business-units/v3` path.
135
+ - `form-integrations` — file upload signed URL redirect.
136
+ - `comments` — CMS blog post comments (list, get, moderate).
137
+ - `channels` — root channel inventory.
138
+
139
+ ### Added — Legacy v1/v2 API surface
140
+
141
+ - `contacts-v1` — legacy `/contacts/v1` (list, get-by-id, by-email,
142
+ by-utk, create-or-update, update-by-id, delete, recent, search,
143
+ lists, list-contacts).
144
+ - `companies-v2` — legacy `/companies/v2` (list, get, CRUD, recent,
145
+ get-contacts).
146
+ - `deals-v1` — legacy `/deals/v1` (list, get, CRUD, recent, associate).
147
+ - `owners-v2` — legacy `/owners/v2`.
148
+ - `engagements-v1` — legacy `/engagements/v1` (CRUD + associated).
149
+ - `properties-legacy` — `/properties/v1` + `/properties/v2` (property
150
+ CRUD + groups CRUD).
151
+ - `reports-v2` — legacy reports (list, get, data).
152
+ - `payments-subscriptions` — top-level commerce subscriptions (get,
153
+ cancel, pause).
154
+ - `content-v2` — legacy `/content/api/v2` CMS (25 endpoint aliases:
155
+ pages, page-versions, page-buffer, blogs-v3, blog-by-id,
156
+ blog-versions, blog-topics, blog-topic-by-id, templates,
157
+ template-by-id, template-buffer, template-versions, layouts,
158
+ layout-by-id, layout-buffer, layout-buffered-changes, layout-versions,
159
+ modules, module-by-id, module-by-path, url-mappings, domains,
160
+ domain-by-id, indexed-properties). Each is a flexible subcommand with
161
+ optional `--method` and `--data`.
162
+ - `sales-extensions` — `/extensions/sales/videoconferencing` and
163
+ `/extensions/sales/accounting` settings.
164
+ - `calling-v1` — legacy call dispositions.
165
+
166
+ ### Added — CRM dated API (2025-09) + alternate schema path
167
+
168
+ `crm dated objects-2025-09 {list,get,create,update,delete,search,
169
+ batch-read,batch-create,batch-update,batch-upsert,batch-archive}`,
170
+ `crm dated properties-2025-09 {list,get,create,update,delete}`,
171
+ `crm dated associations-2025-09 {batch-read,batch-create,batch-archive,
172
+ batch-associate-default,batch-labels-archive,labels-create,labels-
173
+ update,usage-report}`, `crm dated associations-v4-configs {list,all,
174
+ batch-create,batch-update,batch-purge}`, `crm dated object-schemas
175
+ {list,get,create,update,delete,associations-create,associations-
176
+ delete}`.
177
+
178
+ ### Added — Communication preferences v4 + conversations extras
179
+
180
+ - `communication-preferences v4 {status-batch-read,status-update-batch,
181
+ subscribe-batch,unsubscribe-batch,subscriptions-list,channels-list}`.
182
+ - `conversations custom-channels {list,get,create,update,delete}` +
183
+ `channel-accounts {list,create,update,delete}`.
184
+ - `conversations messages send <threadId>`.
185
+ - `conversations inboxes {list,get}`, `channels {list,get}`,
186
+ `channel-accounts {list,get}`, `actors {get,batch-read}` (already in
187
+ 0.4.0; reconfirmed here).
188
+
189
+ ### Added — Automation custom actions
190
+
191
+ `automation actions {list,get,create,update,delete,revisions-list,
192
+ revisions-get,functions-list,functions-create,functions-delete}` on
193
+ `/automation/v4/actions/{appId}` for workflow custom code actions.
194
+
195
+ ### Added — CRM lists folders + sales sequences enroll/unenroll
196
+
197
+ - `lists folders {list,get,create,update,delete,move}`.
198
+ - `sales sequences {enroll,unenroll}` (already in 0.4.0; reconfirmed).
199
+
200
+ ### Fixed
201
+
202
+ - Wire 3 orphan modules from 0.3.0 (`account`,
203
+ `communication-preferences`, `events`) into `src/cli.ts`.
204
+ - `visitor-identification` path corrected to `/visitor-identification/v3/
205
+ tokens/create` (was under `/conversations/v3/…` mistakenly).
206
+
207
+ ### Security
208
+
209
+ - `npm audit` reports 0 vulnerabilities at all severity levels.
210
+ - `@hubspot/cli` removed from `devDependencies` (unused, 14 transitive
211
+ advisories).
212
+ - `@modelcontextprotocol/sdk` bumped to ^1.29.0.
213
+ - `overrides.path-to-regexp: ^8.4.2` to patch transitive via
214
+ express@5.2.1 → router@2.2.0.
215
+
216
+ ### Coverage verification
217
+
218
+ Script at repo root (`scripts/verify-coverage.mjs`, not shipped):
219
+ ```
220
+ === FINAL COVERAGE ===
221
+ Roots: 70/70
222
+ Endpoints: 1180/1180 = 100.0%
223
+ ```
224
+
225
+ Verified against the HubSpot dev-doc scrape of 1,180 endpoints across
226
+ 1,978 source files at developers.hubspot.com.
227
+
228
+ ---
229
+
230
+ ## 0.4.0 - 2026-04-21
231
+
232
+ Completeness and coverage release. Brings hubcli to ~100% of the stable
233
+ HubSpot public API surface: fixes three orphan top-level modules that were
234
+ shipped but never wired into the CLI in 0.3.0, adds high-leverage search
235
+ primitives to every CRM object, closes seven documented P1 coverage gaps
236
+ (files folders, marketing events attendance, associations v4 labels, legacy
237
+ email events per-recipient stream, conversations inboxes/channels/channel-
238
+ accounts/actors, CRM UI Extension cards, sales sequences enroll/unenroll),
239
+ and reaches a fully clean `npm audit` (0 vulnerabilities) with no
240
+ runtime-facing advisories.
241
+
242
+ ### Added
243
+
244
+ - `crm <object> filter` — search across any CRM object with property filters
245
+ and HubSpot standard operators (EQ, NEQ, GT, GTE, LT, LTE, HAS_PROPERTY,
246
+ NOT_HAS_PROPERTY, CONTAINS_TOKEN, NOT_CONTAINS_TOKEN, BETWEEN). Supports
247
+ `--sorts`, `--properties`, `--query`, `--limit`, `--after`, `--count-only`.
248
+ Applies to contacts, companies, deals, tickets, products, quotes, line-items,
249
+ invoices, subscriptions, payments, goals, and every custom object registered
250
+ via `registerObjectCommands`.
251
+ - `crm <object> count` — count-only mode for fast totals, optionally filtered.
252
+ - `files folders {list,get,create,update,archive}` — File Manager folder CRUD
253
+ (`/files/v3/folders`), including `--parent-folder-id` filtering for tree walks.
254
+ - `marketing events participations <externalEventId>` — breakdown of
255
+ participation state by attendee
256
+ (`/marketing/v3/marketing-events/{id}/participations/breakdown`).
257
+ - `marketing events attendance <externalEventId> <state>` — record attendance
258
+ state transitions (register | cancel | attend | no-show) for contacts on an
259
+ event (`/marketing/v3/marketing-events/attendance/{id}/{state}/create`).
260
+ - `crm associations labels {list,create,update,delete}` — CRUD user-defined
261
+ association label definitions between two object types
262
+ (`/crm/v4/associations/{fromType}/{toType}/labels`).
263
+ - `email-events {list,get,campaigns-by-id,campaign}` — legacy per-recipient
264
+ event stream with filters for recipient, campaign id, event type, timestamps
265
+ (`/email/public/v1/events`, `/email/public/v1/campaigns/*`). Richer than
266
+ `marketing emails stats` for downstream analytics pipelines.
267
+ - `conversations inboxes {list,get}`, `conversations channels {list,get}`,
268
+ `conversations channel-accounts {list,get}`, `conversations actors {get,batch-read}` —
269
+ routing topology and actor hydration endpoints
270
+ (`/conversations/v3/conversations/{inboxes,channels,channel-accounts,actors}`).
271
+ - `crm cards {list,get,create,update,delete}` — UI Extension card definitions
272
+ for app developers building CRM record sidebar cards
273
+ (`/crm/v3/extensions/cards/{appId}`).
274
+ - `sales sequences enroll` — enroll a contact in a sales sequence
275
+ (`POST /automation/v4/sequences/enrollments`).
276
+ - `sales sequences unenroll <enrollmentId>` — cancel an active enrollment
277
+ (`POST /automation/v4/sequences/enrollments/{id}/cancel`).
278
+
279
+ ### Fixed
280
+
281
+ - **Wire three orphan top-level modules** that existed in `src/commands/` but
282
+ were never called from `src/cli.ts` in 0.3.0, making 18 subcommands invisible
283
+ at runtime:
284
+ - `hubcli account` — info, audit-logs, private-apps, api-usage
285
+ - `hubcli communication-preferences` — definitions, status, subscribe,
286
+ unsubscribe, email-resubscribe
287
+ - `hubcli events` — event-definitions CRUD + send behavioral events
288
+ - **Clean npm audit** (0 vulnerabilities, including devDependencies):
289
+ - Removed `@hubspot/cli` from `devDependencies` — it was never imported by
290
+ source or tests, contributed 14 transitive advisories (axios, express,
291
+ vite, js-yaml, minimatch, qs, etc.), and its presence did not support
292
+ `hubcli doctor hublet-check` (that feature reads `~/.hscli/config.yml`
293
+ which is only written by a *global* install of `@hubspot/cli`).
294
+ Contributors who want to test `doctor hublet-check` should install
295
+ `@hubspot/cli` globally: `npm i -g @hubspot/cli`.
296
+ - Bumped `@modelcontextprotocol/sdk` from ^1.27.1 to ^1.29.0 (patches
297
+ ReDoS CVE GHSA-8r9q-7v3j-jr4g and cross-client leak GHSA-345p-7cg4-v4c7).
298
+ - Added `overrides.path-to-regexp: ^8.4.2` to force the patched transitive
299
+ through express@5.2.1 → router@2.2.0 (fixes GHSA-j3q9-mxjg-w52f and
300
+ GHSA-27v5-c462-wpq7 ReDoS).
301
+
302
+ ### Known niche gaps (deferred, not P1)
303
+
304
+ The following HubSpot API surfaces remain intentionally unshipped — each is
305
+ either out of scope for a general-purpose CRM CLI or depends on internal/
306
+ unstable endpoints:
307
+
308
+ - CMS source code / project upload / theme push (belongs to `@hubspot/cli`)
309
+ - Developer Projects API (`/project-components-external/v3`)
310
+ - Design Manager file push
311
+ - Playbooks / Documents tracking (no stable public API)
312
+ - Marketing SMS (limited GA availability)
313
+ - CTA legacy API (`/cta/v3`)
314
+ - Accounting Extension (`/crm/v3/extensions/accounting`) — QBO/Xero niche
315
+ - Video Conferencing Extension (`/crm/v3/extensions/videoconferencing`)
316
+ - Partner API (`/partners/v3`) — Solutions Partners only
317
+
318
+ ---
319
+
320
+ ## 0.3.0 - 2026-04-17
321
+
322
+ First public release. hubcli now covers ~95% of HubSpot's public API surface across 25 command domains, with a ~125-tool MCP server and enterprise safety rails throughout.
323
+
324
+ ### Command domains added since 0.2.0
325
+
326
+ **CRM (now 22 files in `src/commands/crm/`):**
327
+ - `crm quotes`, `crm products`, `crm line-items` — commerce-adjacent objects
328
+ - `crm payments`, `crm invoices`, `crm subscriptions` — full commerce hub
329
+ - `crm goals` — goal tracking
330
+ - `crm pipelines` — now full CRUD (stages create/update/delete), previously read-only
331
+ - `crm properties` — full CRUD including delete, plus property groups list/create/update
332
+
333
+ **Marketing (9 files in `src/commands/marketing/`):**
334
+ - `marketing ads` — ad accounts + campaigns
335
+ - `marketing social` — social accounts + publishing
336
+ - `marketing seo` — SEO recommendations + topics
337
+ - `marketing landing-pages` — landing page management
338
+ - `marketing subscriptions` — email subscription types
339
+ - `marketing events` — marketing events
340
+ - `marketing behavioral-events` — custom behavioral event tracking
341
+ - `marketing transactional` — transactional email + SMTP tokens
342
+ - `marketing emails stats <emailId>` — per-email engagement metrics (opens, clicks, bounces, unsubscribes)
343
+
344
+ **Sales (4 files):**
345
+ - `sales sequences` — sales sequences (list/get/enrollments, auto-detected userId)
346
+ - `sales meetings` — meetings API
347
+ - `sales calling` — call engagements
348
+ - `sales goals` — sales goal tracking
349
+
350
+ **Service (4 files):**
351
+ - `service chatflows` — chatflow configuration
352
+ - `service knowledge-base` — knowledge base articles
353
+ - `service pipelines` — ticket pipelines and stages
354
+ - (existing: conversations, feedback, tickets in `crm`)
355
+
356
+ **New top-level domains:**
357
+ - `account` — info, audit-logs, private-apps, api-usage
358
+ - `automation` — workflow automation
359
+ - `communication-preferences` — subscription / GDPR preference management
360
+ - `conversations` — inbox conversations
361
+ - `events` — event-based API surface
362
+ - `exports` — CRM export jobs (create, list, get, status)
363
+ - `lists` — modern CRM v3 Lists API (list, get, create, update, delete, add-members, remove-members, search)
364
+ - `reporting` — analytics dashboards and reports
365
+ - `settings` — users, teams, business-units, currencies, GDPR, audit-logs
366
+ - `site-search` — indexed site search with type param
367
+ - `timeline` — timeline events
368
+
369
+ ### MCP server
370
+
371
+ - `src/mcp/server.ts` — expanded to ~125 tools covering the full surface
372
+ - 19 net-new tools since 0.2.0: lists, sequences, reporting, exports, pipeline stages, property groups, plus CRM lifecycle and custom object tools
373
+ - Profile isolation via `HUBCLI_MCP_PROFILE` env var
374
+ - All tool responses redacted for secrets
375
+
376
+ ### Security
377
+
378
+ - **LICENSE file added** (MIT — previously declared only in package.json)
379
+ - **Encrypted vault support** (`src/core/vault.ts`) — optional encrypted `auth.enc` storage with passphrase, plus full encrypt / decrypt / rotation lifecycle
380
+ - **Permissions module** (`src/core/permissions.ts`) — scope-aware permission checks
381
+ - Expanded secret redaction across all output paths
382
+ - Path scope enforcement tightened in transport
383
+ - `npm audit fix` pass: baseline vulnerability sweep
384
+ - **Known dependency issues** (not blocking ship, documented for transparency):
385
+ - 1 high-severity runtime transitive (`path-to-regexp 8.3.0` via `@modelcontextprotocol/sdk`) — pending upstream fix in MCP SDK. Does not affect hubcli's own code paths (no user input routed through affected API surface).
386
+ - ~14 dev-only transitive vulns via `@hubspot/cli` devDependency (used for CMS workflows in development). These do not ship in the published package.
387
+
388
+ ### Dev experience
389
+
390
+ - **ESLint + typescript-eslint** — migrated from biome, now `npm run lint` + `npm run lint:fix`
391
+ - **`@hubspot/cli`** added as a dev dependency for CMS workflows
392
+ - `CLAUDE.md` — AI agent guidance for working in the repo
393
+ - `CHANGELOG-OPENCLAW.md` — internal release tracker for the multi-repo project
394
+ - CI workflow runs typecheck + lint + test + audit + build + checksums on Node 20 + 22
395
+ - `npm run audit` script (audit-level=moderate)
396
+ - `npm run release:verify` — full pre-release gate
397
+
398
+ ### Tests
399
+
400
+ - Test suites expanded from 4 to 9:
401
+ - `tests/bugfixes.test.ts` — regression coverage
402
+ - `tests/hublet.test.ts` — EU1 / US hublet routing
403
+ - `tests/permissions.test.ts` — scope and permission checks
404
+ - `tests/plugins.test.ts` — plugin architecture
405
+ - `tests/schemas.test.ts` — schema cache behavior
406
+ - `tests/vault.test.ts` — encrypted vault lifecycle (encrypt, decrypt, rotate)
407
+ - (plus existing cli, mcp, contract.sandbox, http)
408
+ - **155 tests passing** (10 sandbox tests skipped by default; enable with `HUBCLI_ENABLE_SANDBOX_CONTRACT=1`)
409
+
410
+ ### Documentation
411
+
412
+ - README rewritten for the real surface and the competitive landscape
413
+ - `docs/COMMAND_TREE.md` — comprehensive command reference
414
+ - New domain setup guides: CMS_SETUP, COMMERCE_SETUP, MARKETING_SETUP, SALES_SETUP, SERVICE_SETUP, OPERATIONS_SETUP, REPORTING_SETUP, INTEGRATIONS_NOTIFICATIONS_SETUP, PORTAL_SETUP
415
+ - `docs/PLUGIN_GUIDE.md` — plugin authoring
416
+ - `docs/OPERATIONAL_PLAYBOOKS.md` — common ops playbooks
417
+ - `docs/COOKBOOK.md` — recipes
418
+ - `docs/LAUNCH/` — launch material:
419
+ - `BLOG_POST.md` — release blog post draft
420
+ - `HN_SHOW_HN.md` — Show HN post draft
421
+ - `MARKETPLACE_LISTING.md` — HubSpot Marketplace listing copy
422
+ - `COMPETITIVE-LANDSCAPE.md` — honest map of HubSpot CLI + MCP ecosystem (official HubSpot projects, Composio hosted SaaS, 17+ community OSS MCPs)
423
+ - CONTRIBUTING.md + `.github/ISSUE_TEMPLATE/` (bug, feature, MCP tool request)
424
+
425
+ ### Infrastructure
426
+
427
+ - `src/core/plugins.ts` — plugin loader system
428
+ - `src/core/vault.ts` — encrypted token vault
429
+ - `src/core/schemas.ts` — schema management beyond the cache
430
+ - `src/core/urls.ts` — URL construction helpers
431
+ - Package metadata: `exports` map for `./plugins`, `./http`, `./output` sub-paths so downstream projects can import core modules
432
+
433
+ ### Breaking changes
434
+
435
+ - None from 0.2.0 public surface. Command signatures remain compatible.
436
+
437
+ ## 0.2.0 - 2026-03-05
438
+ - Added CRM tickets command family.
439
+ - Added strict allowlists for objectType inputs with domain-specific scope.
440
+ - Added enterprise safety controls:
441
+ - policy file support (`--policy-file`)
442
+ - change-ticket enforcement (`--change-ticket`) when policy requires it
443
+ - Added request observability:
444
+ - run correlation id (`X-Hubcli-Request-Id`)
445
+ - optional telemetry JSONL (`--telemetry-file`)
446
+ - Added CRM lifecycle operations:
447
+ - delete/archive, merge, batch-read, batch-upsert, batch-archive
448
+ - Added CRM custom object support:
449
+ - schema list/get/create/update
450
+ - record list/get/search/create/update/delete
451
+ - Added CRM engagement support:
452
+ - notes, calls, tasks, emails, meetings
453
+ - Added incremental sync utility:
454
+ - `crm sync pull`
455
+ - Added top-level domain command groups:
456
+ - `marketing`, `forms`, `files`, `cms`, `workflows`, `service`
457
+ - Added raw API command:
458
+ - `api request`
459
+ - Expanded MCP catalog:
460
+ - lifecycle object tools (delete/merge/batch)
461
+ - custom object schema/record tools
462
+ - raw `hub_api_request`
463
+ - Added OAuth-oriented auth commands:
464
+ - `auth profiles`, `auth profile-show`, `auth token-info`
465
+ - `auth oauth-url`, `auth oauth-exchange`
466
+ - Added release governance + compatibility docs and sandbox contract test scaffolding.
package/LICENSE ADDED
@@ -0,0 +1,21 @@
1
+ MIT License
2
+
3
+ Copyright (c) 2026 Luigi Vermeulen
4
+
5
+ Permission is hereby granted, free of charge, to any person obtaining a copy
6
+ of this software and associated documentation files (the "Software"), to deal
7
+ in the Software without restriction, including without limitation the rights
8
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
+ copies of the Software, and to permit persons to whom the Software is
10
+ furnished to do so, subject to the following conditions:
11
+
12
+ The above copyright notice and this permission notice shall be included in all
13
+ copies or substantial portions of the Software.
14
+
15
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
+ SOFTWARE.