@revfleet/hscli 0.8.11 → 0.9.0

package/dist/commands/settings/index.js

@@ -1,41 +1,14 @@
-import { readFileSync } from "node:fs";
-import { getProfile } from "../../core/auth.js";
-import { createBrowserSessionClient, createClient } from "../../core/http.js";
+import { createClient } from "../../core/http.js";
 import { CliError, printResult } from "../../core/output.js";
 import { encodePathSegment, maybeWrite, parseJsonPayload, parseNumberFlag } from "../crm/shared.js";
-function addBrowserSessionOptions(command) {
-    return command
-        .option("--portal-id <id>", "HubSpot portal ID (or HSCLI_PORTAL_ID / profile.portalId)")
-        .option("--ui-domain <domain>", "HubSpot app domain, e.g. app.hubspot.com or app-eu1.hubspot.com")
-        .option("--cookie <header>", "Browser Cookie header for app.hubspot.com")
-        .option("--cookie-file <path>", "Cookie header, Netscape cookie jar, or JSON cookie export")
-        .option("--csrf <token>", "x-hubspot-csrf-hubspotapi header value");
-}
+import { addBrowserSessionOptions, resolveBrowserSession } from "../internal-session.js";
+import { registerSiteSettings } from "./site-settings.js";
 function resolvePermissionSetSession(ctx, opts) {
-    const profile = safeProfile(ctx.profile);
-    const portalId = firstString(opts.portalId, process.env.HSCLI_PORTAL_ID, profile?.portalId);
-    if (!portalId) {
-        throw new CliError("SESSION_PORTAL_ID_REQUIRED", "Permission-set commands require --portal-id, HSCLI_PORTAL_ID, or profile.portalId.");
-    }
-    const uiDomain = normalizeUiDomain(firstString(opts.uiDomain, process.env.HSCLI_HUBSPOT_UI_DOMAIN, profile?.uiDomain, "app.hubspot.com") ?? "app.hubspot.com");
-    const cookie = firstString(opts.cookie, process.env.HSCLI_HUBSPOT_COOKIE) ?? readCookieFile(firstString(opts.cookieFile, process.env.HSCLI_HUBSPOT_COOKIE_FILE));
-    if (!cookie) {
-        throw new CliError("SESSION_COOKIE_REQUIRED", "Permission-set commands require --cookie, --cookie-file, HSCLI_HUBSPOT_COOKIE, or HSCLI_HUBSPOT_COOKIE_FILE.");
-    }
-    const csrfToken = firstString(opts.csrf, process.env.HSCLI_HUBSPOT_CSRF, extractCsrfToken(cookie));
-    if (!csrfToken) {
-        throw new CliError("SESSION_CSRF_REQUIRED", "Permission-set commands require --csrf or HSCLI_HUBSPOT_CSRF. A csrf.app cookie is also accepted when present.");
-    }
-    return {
-        portalId,
-        client: createBrowserSessionClient(ctx.profile, {
-            apiBaseUrl: `https://${uiDomain}`,
-            cookie,
-            csrfToken,
-            telemetryFile: ctx.telemetryFile,
-            strictCapabilities: ctx.strictCapabilities,
-        }),
-    };
+    const session = resolveBrowserSession(ctx, opts, "Permission-set commands", true);
+    return { client: session.client, portalId: session.portalId };
+}
+function resolveBusinessUnitSession(ctx, opts, requirePortalId = false) {
+    return resolveBrowserSession(ctx, opts, "Business-unit internal commands", requirePortalId);
 }
 function permissionSetsPath(portalId) {
     return `/api/app-users/v1/permission-sets?portalId=${encodeURIComponent(portalId)}`;
@@ -43,6 +16,87 @@ function permissionSetsPath(portalId) {
 function permissionSetPath(portalId, id) {
     return `/api/app-users/v1/permission-sets/${encodePathSegment(id, "permissionSetId")}?portalId=${encodeURIComponent(portalId)}`;
 }
+function permissionSetClonePath(portalId, id) {
+    return `/api/app-users/v1/permission-sets/${encodePathSegment(id, "permissionSetId")}/clone?portalId=${encodeURIComponent(portalId)}`;
+}
+function appUserPath(portalId, userId) {
+    return `/api/app-users/v1/users/${encodePathSegment(userId, "userId")}?portalId=${encodeURIComponent(portalId)}`;
+}
+function appUsersPath(portalId, limit, offset) {
+    const params = new URLSearchParams();
+    params.set("portalId", portalId);
+    if (limit)
+        params.set("limit", String(parseNumberFlag(limit, "--limit")));
+    if (offset)
+        params.set("offset", offset);
+    return `/api/app-users/v1/users?${params.toString()}`;
+}
+function appUsersBatchPath(portalId) {
+    return `/api/app-users/v1/users/partial/batch?portalId=${encodeURIComponent(portalId)}`;
+}
+function roleCatalogPath(portalId) {
+    return `/api/app-users/v1/roles?portalId=${encodeURIComponent(portalId)}`;
+}
+function roleCatalogItemPath(portalId, roleName) {
+    return `/api/app-users/v1/roles/${encodePathSegment(roleName, "roleName")}?portalId=${encodeURIComponent(portalId)}`;
+}
+function roleCategoriesPath(portalId) {
+    return `/api/app-users/v1/role-categories?portalId=${encodeURIComponent(portalId)}`;
+}
+function roleScopesPath(portalId) {
+    return `/api/app-users/v1/scopes?portalId=${encodeURIComponent(portalId)}`;
+}
+function seatsPath(portalId) {
+    return `/api/app-users/v1/seats?portalId=${encodeURIComponent(portalId)}`;
+}
+function seatAssignmentsPath(portalId) {
+    return `/api/app-users/v1/seat-assignments?portalId=${encodeURIComponent(portalId)}`;
+}
+function seatAssignmentPath(portalId, userId) {
+    return `/api/app-users/v1/seat-assignments/${encodePathSegment(userId, "userId")}?portalId=${encodeURIComponent(portalId)}`;
+}
+function permissionTemplatesPath(portalId) {
+    return `/api/permission-templates/v1/templates?portalId=${encodeURIComponent(portalId)}`;
+}
+function permissionTemplatePath(portalId, templateId) {
+    return `/api/permission-templates/v1/templates/${encodePathSegment(templateId, "templateId")}?portalId=${encodeURIComponent(portalId)}`;
+}
+function permissionSetAssignmentsPath(portalId) {
+    return `/api/app-users/v1/permission-sets/permission-set-user-assignments?portalId=${encodeURIComponent(portalId)}`;
+}
+function permissionSetAssignUserRpcPath(portalId) {
+    return `/api/chirp-frontend-app/v1/gateway/com.hubspot.appusers.rpc.PermissionSetAssignmentsRpc/assignUserToPermissionSets?portalId=${encodeURIComponent(portalId)}`;
+}
+const PERMISSION_AUDIT_RPC = {
+    "assignment-history": "getPermissionSetAssignmentHistory",
+    "role-change-history": "getRoleChangeHistory",
+    "user-access": "getUserAccessAudit",
+};
+function permissionAuditRpcPath(name) {
+    return `/api/chirp-frontend-app/v1/gateway/com.hubspot.app.user.audits.service.rpc.AppUserAuditsRpc/${PERMISSION_AUDIT_RPC[name]}`;
+}
+function flpAllowlistingsPath() {
+    return "/api/crm-permissions/v1/field-level-permissions/allowlistings";
+}
+function flpObjectAllowlistingsPath(typeId) {
+    return `/api/crm-permissions/v1/field-level-permissions/allowlistings/${encodePathSegment(typeId, "typeId")}`;
+}
+function flpPropertyAllowlistingsPath(typeId, propertyName) {
+    return `${flpObjectAllowlistingsPath(typeId)}/${encodePathSegment(propertyName, "propertyName")}`;
+}
+function flpAccessStatePath() {
+    return "/api/crm-permissions/v1/field-level-permissions/allowlistings/access-state/multi-get";
+}
+function flpBlocklistPath() {
+    return "/api/crm-permissions/v1/field-level-permissions/blocklist/including-global";
+}
+function flpBypassUsersPath() {
+    return "/api/permissions-skynet/v1/scopes/app/field-level-permissions-bypass/user-ids";
+}
+function businessUnitsInternalPath(portalId) {
+    const query = portalId ? `?portalId=${encodeURIComponent(portalId)}` : "";
+    return `/api/business-units/v1/business-units${query}`;
+}
 async function maybeWritePermissionSetWithRoleRetry(ctx, client, method, path, body, stripUnknownRoles) {
     try {
         return await maybeWrite(ctx, client, method, path, body);
@@ -75,6 +129,65 @@ function extractPermissionSets(response) {
     }
     return [];
 }
+function buildBusinessUnitIdMapSeed(response) {
+    const seed = {};
+    for (const unit of extractBusinessUnits(response)) {
+        const id = firstString(stringFromUnknown(unit.id), stringFromUnknown(unit.businessUnitId), stringFromUnknown(unit.unitId));
+        if (!id)
+            continue;
+        seed[id] = {
+            sourceName: firstString(stringFromUnknown(unit.name), stringFromUnknown(unit.label)),
+            target_id: "",
+        };
+    }
+    return seed;
+}
+function extractBusinessUnits(response) {
+    if (Array.isArray(response))
+        return response.filter(isRecord);
+    if (!isRecord(response))
+        return [];
+    for (const key of ["results", "businessUnits", "items"]) {
+        const value = response[key];
+        if (Array.isArray(value))
+            return value.filter(isRecord);
+    }
+    const data = isRecord(response.data) ? response.data : undefined;
+    if (data) {
+        for (const key of ["results", "businessUnits", "items"]) {
+            const value = data[key];
+            if (Array.isArray(value))
+                return value.filter(isRecord);
+        }
+    }
+    return [];
+}
+async function findExistingBusinessUnitByName(client, name, portalId) {
+    const response = await client.request(businessUnitsInternalPath(portalId));
+    return extractBusinessUnits(response).find((unit) => unit.name === name);
+}
+function normalizeBusinessUnitCreatePayload(raw) {
+    if (!isRecord(raw)) {
+        throw new CliError("INVALID_BUSINESS_UNIT_PAYLOAD", "Business-unit create payload must be a JSON object.");
+    }
+    const name = typeof raw.name === "string" ? raw.name.trim() : "";
+    if (!name) {
+        throw new CliError("BUSINESS_UNIT_NAME_REQUIRED", "Business-unit create payload requires a non-empty name.");
+    }
+    const payload = { name };
+    for (const key of ["label", "description", "logoMetadata"]) {
+        if (raw[key] !== undefined && raw[key] !== null && raw[key] !== "")
+            payload[key] = raw[key];
+    }
+    return payload;
+}
+function stringFromUnknown(value) {
+    if (typeof value === "string")
+        return value;
+    if (typeof value === "number" && Number.isFinite(value))
+        return String(value);
+    return undefined;
+}
 function extractMissingRoles(error) {
     if (!(error instanceof CliError) || error.status !== 400)
         return [];
@@ -97,14 +210,6 @@ function stripRoles(body, rolesToStrip) {
         return undefined;
     return { ...body, roleNames: kept };
 }
-function safeProfile(profile) {
-    try {
-        return getProfile(profile);
-    }
-    catch {
-        return undefined;
-    }
-}
 function firstString(...values) {
     for (const value of values) {
         const trimmed = value?.trim();
@@ -113,73 +218,87 @@ function firstString(...values) {
     }
     return undefined;
 }
-function normalizeUiDomain(raw) {
-    return raw.replace(/^https?:\/\//, "").replace(/\/.*$/, "");
+function isRecord(value) {
+    return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
-function readCookieFile(path) {
-    if (!path)
-        return undefined;
-    const raw = readFileSync(path, "utf8").trim();
-    if (!raw)
-        return undefined;
-    return normalizeCookieFile(raw);
-}
-function normalizeCookieFile(raw) {
-    const parsed = parseCookieJson(raw);
-    if (parsed)
-        return parsed;
-    const lines = raw.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
-    const netscapeCookies = lines
-        .filter((line) => !line.startsWith("#"))
-        .map((line) => line.split(/\t+/))
-        .filter((parts) => parts.length >= 7)
-        .map((parts) => `${parts[5]}=${parts.slice(6).join("\t")}`);
-    if (netscapeCookies.length > 0)
-        return netscapeCookies.join("; ");
-    return lines.filter((line) => !line.startsWith("#")).join("; ");
-}
-function parseCookieJson(raw) {
-    try {
-        const parsed = JSON.parse(raw);
-        if (typeof parsed === "string")
-            return parsed;
-        if (isRecord(parsed) && typeof parsed.cookie === "string")
-            return parsed.cookie;
-        const cookies = Array.isArray(parsed) ? parsed : isRecord(parsed) && Array.isArray(parsed.cookies) ? parsed.cookies : undefined;
-        if (!cookies)
-            return undefined;
-        const pairs = cookies
-            .filter(isRecord)
-            .map((cookie) => {
-            const name = typeof cookie.name === "string" ? cookie.name.trim() : "";
-            const value = typeof cookie.value === "string" ? cookie.value : "";
-            return name ? `${name}=${value}` : "";
-        })
-            .filter(Boolean);
-        return pairs.length > 0 ? pairs.join("; ") : undefined;
+function normalizeUserCreatePayload(raw, allowInviteEmail) {
+    if (!isRecord(raw)) {
+        throw new CliError("INVALID_USER_PAYLOAD", "User create payload must be a JSON object.");
     }
-    catch {
-        return undefined;
+    const payload = { ...raw };
+    const inviteFields = [
+        payload.sendWelcomeEmail === true ? "sendWelcomeEmail=true" : undefined,
+        payload.sendInviteEmail === true ? "sendInviteEmail=true" : undefined,
+        payload.skipInviteEmail === false ? "skipInviteEmail=false" : undefined,
+    ].filter(Boolean);
+    if (!allowInviteEmail && inviteFields.length > 0) {
+        throw new CliError("USER_INVITE_EMAIL_BLOCKED", `User invite email blocked by default (${inviteFields.join(", ")}). Set sendWelcomeEmail:false or pass --allow-invite-email.`);
+    }
+    if (!allowInviteEmail) {
+        payload.sendWelcomeEmail = false;
     }
+    return payload;
 }
-function extractCsrfToken(cookieHeader) {
-    const candidates = new Set(["csrf.app", "csrf", "hubspotapi-csrf", "hs-csrf"]);
-    for (const part of cookieHeader.split(";")) {
-        const [rawName, ...rawValue] = part.trim().split("=");
-        if (!rawName || rawValue.length === 0)
-            continue;
-        if (candidates.has(rawName.trim().toLowerCase())) {
-            const value = rawValue.join("=").trim();
-            return value ? decodeURIComponent(value) : undefined;
-        }
+function permissionSetIdsFromOptions(opts) {
+    const single = firstString(opts.permissionSetId);
+    const many = firstString(opts.permissionSetIds);
+    if (single && many) {
+        throw new CliError("INVALID_PERMISSION_SET_ASSIGNMENT", "Use either --permission-set-id or --permission-set-ids, not both.");
     }
-    return undefined;
+    if (single)
+        return [single];
+    if (many) {
+        const ids = many.split(",").map((id) => id.trim()).filter(Boolean);
+        if (ids.length === 0)
+            throw new CliError("INVALID_PERMISSION_SET_ASSIGNMENT", "--permission-set-ids must contain at least one id.");
+        return ids;
+    }
+    throw new CliError("INVALID_PERMISSION_SET_ASSIGNMENT", "Assign requires --permission-set-id or --permission-set-ids.");
 }
-function isRecord(value) {
-    return Boolean(value && typeof value === "object" && !Array.isArray(value));
+function idStringFromAssignmentValue(value, fieldName) {
+    const id = stringFromUnknown(value)?.trim();
+    if (!id) {
+        throw new CliError("INVALID_PERMISSION_SET_ASSIGNMENT", `${fieldName} must be a non-empty string or number.`);
+    }
+    return id;
+}
+function buildPermissionSetAssignmentPayload(userId, opts) {
+    return {
+        assignments: [
+            {
+                userId,
+                permissionSetIds: permissionSetIdsFromOptions(opts),
+            },
+        ],
+    };
+}
+function normalizePermissionSetAssignmentsPayload(raw) {
+    if (!isRecord(raw)) {
+        throw new CliError("INVALID_PERMISSION_SET_ASSIGNMENT", "Assignment payload must be a JSON object.");
+    }
+    const assignments = raw.assignments;
+    if (!Array.isArray(assignments) || assignments.length === 0) {
+        throw new CliError("INVALID_PERMISSION_SET_ASSIGNMENT", "Assignment payload requires a non-empty assignments array.");
+    }
+    return {
+        assignments: assignments.map((assignment, index) => {
+            if (!isRecord(assignment)) {
+                throw new CliError("INVALID_PERMISSION_SET_ASSIGNMENT", `assignments[${index}] must be a JSON object.`);
+            }
+            const permissionSetIds = assignment.permissionSetIds;
+            if (!Array.isArray(permissionSetIds) || permissionSetIds.length === 0) {
+                throw new CliError("INVALID_PERMISSION_SET_ASSIGNMENT", `assignments[${index}].permissionSetIds must be a non-empty array.`);
+            }
+            return {
+                userId: idStringFromAssignmentValue(assignment.userId, `assignments[${index}].userId`),
+                permissionSetIds: permissionSetIds.map((id, idIndex) => idStringFromAssignmentValue(id, `assignments[${index}].permissionSetIds[${idIndex}]`)),
+            };
+        }),
+    };
 }
 export function registerSettings(program, getCtx) {
     const settings = program.command("settings").description("HubSpot Settings APIs");
+    registerSiteSettings(settings, getCtx);
     // Users
     const users = settings.command("users").description("User provisioning");
     users
@@ -205,10 +324,11 @@ export function registerSettings(program, getCtx) {
     users
         .command("create")
         .requiredOption("--data <payload>", "User creation payload JSON")
+        .option("--allow-invite-email", "Allow the create payload to send welcome/invite email")
         .action(async (opts) => {
         const ctx = getCtx();
         const client = createClient(ctx.profile);
-        const payload = parseJsonPayload(opts.data);
+        const payload = normalizeUserCreatePayload(parseJsonPayload(opts.data), Boolean(opts.allowInviteEmail));
         const res = await maybeWrite(ctx, client, "POST", "/settings/v3/users/", payload);
         printResult(ctx, res);
     });
@@ -257,6 +377,33 @@ export function registerSettings(program, getCtx) {
         const res = await client.request(`/settings/v3/business-units/?${params.toString()}`);
         printResult(ctx, res);
     });
+    addBrowserSessionOptions(businessUnits
+        .command("capture")
+        .description("Capture full business-unit metadata via internal HubSpot session-auth endpoint")
+        .option("--include-id-map-seed", "Include a source-ID keyed business-unit map seed")).action(async (opts) => {
+        const ctx = getCtx();
+        const { client, portalId } = resolveBusinessUnitSession(ctx, opts);
+        const res = await client.request(businessUnitsInternalPath(portalId));
+        printResult(ctx, opts.includeIdMapSeed ? { result: res, idMapSeed: buildBusinessUnitIdMapSeed(res) } : res);
+    });
+    addBrowserSessionOptions(businessUnits
+        .command("create-internal")
+        .description("Create a business unit via the internal browser-session endpoint")
+        .requiredOption("--data <payload>", "Business-unit payload JSON: { name, label?, description?, logoMetadata? }")
+        .option("--skip-existing", "Skip create when a target business unit with the same name already exists")).action(async (opts) => {
+        const ctx = getCtx();
+        const { client, portalId } = resolveBusinessUnitSession(ctx, opts, true);
+        const payload = normalizeBusinessUnitCreatePayload(parseJsonPayload(opts.data));
+        if (!ctx.dryRun && opts.skipExisting) {
+            const existing = await findExistingBusinessUnitByName(client, String(payload.name), portalId);
+            if (existing) {
+                printResult(ctx, { skipped: true, reason: "business-unit-exists", matchKey: "name", existing });
+                return;
+            }
+        }
+        const res = await maybeWrite(ctx, client, "POST", businessUnitsInternalPath(portalId), payload);
+        printResult(ctx, res);
+    });
     // Teams
     const teams = settings.command("teams").description("Team management");
     teams
@@ -326,6 +473,207 @@ export function registerSettings(program, getCtx) {
         const res = await maybeWrite(ctx, client, "DELETE", permissionSetPath(portalId, id));
         printResult(ctx, res);
     });
+    addBrowserSessionOptions(permissionSets.command("clone")
+        .argument("<id>")
+        .description("Clone a permission set through the internal browser-session endpoint")
+        .option("--data <payload>", "Optional clone payload JSON, e.g. { name }")).action(async (id, opts) => {
+        const ctx = getCtx();
+        const { client, portalId } = resolvePermissionSetSession(ctx, opts);
+        const payload = opts.data ? parseJsonPayload(opts.data) : {};
+        const res = await maybeWrite(ctx, client, "POST", permissionSetClonePath(portalId, id), payload);
+        printResult(ctx, res);
+    });
+    const permissionSetRoles = permissionSets.command("roles").description("Internal atomic role catalog used by permission sets");
+    addBrowserSessionOptions(permissionSetRoles.command("list"))
+        .action(async (opts) => {
+        const ctx = getCtx();
+        const { client, portalId } = resolvePermissionSetSession(ctx, opts);
+        const res = await client.request(roleCatalogPath(portalId));
+        printResult(ctx, res);
+    });
+    addBrowserSessionOptions(permissionSetRoles.command("get").argument("<roleName>"))
+        .action(async (roleName, opts) => {
+        const ctx = getCtx();
+        const { client, portalId } = resolvePermissionSetSession(ctx, opts);
+        const res = await client.request(roleCatalogItemPath(portalId, roleName));
+        printResult(ctx, res);
+    });
+    const permissionSetAssignments = permissionSets.command("assignments").description("Internal permission-set assignment map");
+    addBrowserSessionOptions(permissionSetAssignments.command("list"))
+        .action(async (opts) => {
+        const ctx = getCtx();
+        const { client, portalId } = resolvePermissionSetSession(ctx, opts);
+        const res = await client.request(permissionSetAssignmentsPath(portalId));
+        printResult(ctx, res);
+    });
+    const permissionSetAudit = permissionSets.command("audit").description("Read-only internal permission audit RPCs");
+    for (const name of Object.keys(PERMISSION_AUDIT_RPC)) {
+        addBrowserSessionOptions(permissionSetAudit.command(name)
+            .requiredOption("--data <payload>", "Audit RPC payload JSON")).action(async (opts) => {
+            const ctx = getCtx();
+            const { client } = resolvePermissionSetSession(ctx, opts);
+            const payload = parseJsonPayload(opts.data);
+            const res = await client.request(permissionAuditRpcPath(name), {
+                method: "POST",
+                body: payload,
+                permissionMode: "read",
+            });
+            printResult(ctx, res);
+        });
+    }
+    addBrowserSessionOptions(permissionSets.command("role-categories").description("List internal permission role categories"))
+        .action(async (opts) => {
+        const ctx = getCtx();
+        const { client, portalId } = resolvePermissionSetSession(ctx, opts);
+        const res = await client.request(roleCategoriesPath(portalId));
+        printResult(ctx, res);
+    });
+    addBrowserSessionOptions(permissionSets.command("scopes").description("List internal permission role scope buckets"))
+        .action(async (opts) => {
+        const ctx = getCtx();
+        const { client, portalId } = resolvePermissionSetSession(ctx, opts);
+        const res = await client.request(roleScopesPath(portalId));
+        printResult(ctx, res);
+    });
+    const permissionSetUsers = permissionSets.command("users").description("Internal app-users reads and permission-set assignments");
+    addBrowserSessionOptions(permissionSetUsers.command("list")
+        .option("--limit <n>", "Max records", "200")
+        .option("--offset <n>", "Offset cursor")).action(async (opts) => {
+        const ctx = getCtx();
+        const { client, portalId } = resolvePermissionSetSession(ctx, opts);
+        const res = await client.request(appUsersPath(portalId, opts.limit, opts.offset));
+        printResult(ctx, res);
+    });
+    addBrowserSessionOptions(permissionSetUsers.command("get").argument("<userId>"))
+        .action(async (userId, opts) => {
+        const ctx = getCtx();
+        const { client, portalId } = resolvePermissionSetSession(ctx, opts);
+        const res = await client.request(appUserPath(portalId, userId));
+        printResult(ctx, res);
+    });
+    addBrowserSessionOptions(permissionSetUsers.command("batch-read")
+        .requiredOption("--data <payload>", "Batch-read payload JSON")).action(async (opts) => {
+        const ctx = getCtx();
+        const { client, portalId } = resolvePermissionSetSession(ctx, opts);
+        const payload = parseJsonPayload(opts.data);
+        const res = await maybeWrite(ctx, client, "POST", appUsersBatchPath(portalId), payload);
+        printResult(ctx, res);
+    });
+    addBrowserSessionOptions(permissionSetUsers.command("assign")
+        .argument("<userId>")
+        .option("--permission-set-id <id>", "Assign one permission set id")
+        .option("--permission-set-ids <ids>", "Assign multiple permission set ids, comma-separated")).action(async (userId, opts) => {
+        const ctx = getCtx();
+        const { client, portalId } = resolvePermissionSetSession(ctx, opts);
+        const payload = buildPermissionSetAssignmentPayload(userId, opts);
+        const res = await maybeWrite(ctx, client, "POST", permissionSetAssignUserRpcPath(portalId), payload);
+        printResult(ctx, res);
+    });
+    addBrowserSessionOptions(permissionSetUsers.command("assign-batch")
+        .description("Assign permission sets to one or more users through the allowlisted Chirp RPC")
+        .requiredOption("--data <payload>", "Assignment payload JSON: { assignments: [{ userId, permissionSetIds }] }")).action(async (opts) => {
+        const ctx = getCtx();
+        const { client, portalId } = resolvePermissionSetSession(ctx, opts);
+        const payload = normalizePermissionSetAssignmentsPayload(parseJsonPayload(opts.data));
+        const res = await maybeWrite(ctx, client, "POST", permissionSetAssignUserRpcPath(portalId), payload);
+        printResult(ctx, res);
+    });
+    const permissionSetSeatAssignments = permissionSets.command("seat-assignments").description("Internal seat assignment inventory and updates");
+    addBrowserSessionOptions(permissionSetSeatAssignments.command("list"))
+        .action(async (opts) => {
+        const ctx = getCtx();
+        const { client, portalId } = resolvePermissionSetSession(ctx, opts);
+        const res = await client.request(seatAssignmentsPath(portalId));
+        printResult(ctx, res);
+    });
+    addBrowserSessionOptions(permissionSetSeatAssignments.command("update")
+        .argument("<userId>")
+        .requiredOption("--data <payload>", "Seat assignment update payload JSON")).action(async (userId, opts) => {
+        const ctx = getCtx();
+        const { client, portalId } = resolvePermissionSetSession(ctx, opts);
+        const payload = parseJsonPayload(opts.data);
+        const res = await maybeWrite(ctx, client, "PATCH", seatAssignmentPath(portalId, userId), payload);
+        printResult(ctx, res);
+    });
+    addBrowserSessionOptions(permissionSets.command("seats").description("List internal seat catalog"))
+        .action(async (opts) => {
+        const ctx = getCtx();
+        const { client, portalId } = resolvePermissionSetSession(ctx, opts);
+        const res = await client.request(seatsPath(portalId));
+        printResult(ctx, res);
+    });
+    const permissionSetTemplates = permissionSets.command("templates").description("Internal permission template catalog");
+    addBrowserSessionOptions(permissionSetTemplates.command("list"))
+        .action(async (opts) => {
+        const ctx = getCtx();
+        const { client, portalId } = resolvePermissionSetSession(ctx, opts);
+        const res = await client.request(permissionTemplatesPath(portalId));
+        printResult(ctx, res);
+    });
+    addBrowserSessionOptions(permissionSetTemplates.command("get").argument("<templateId>"))
+        .action(async (templateId, opts) => {
+        const ctx = getCtx();
+        const { client, portalId } = resolvePermissionSetSession(ctx, opts);
+        const res = await client.request(permissionTemplatePath(portalId, templateId));
+        printResult(ctx, res);
+    });
+    addBrowserSessionOptions(permissionSetTemplates.command("create")
+        .requiredOption("--data <payload>", "Permission template payload JSON")).action(async (opts) => {
+        const ctx = getCtx();
+        const { client, portalId } = resolvePermissionSetSession(ctx, opts);
+        const payload = parseJsonPayload(opts.data);
+        const res = await maybeWrite(ctx, client, "POST", permissionTemplatesPath(portalId), payload);
+        printResult(ctx, res);
+    });
+    const flp = settings.command("flp").description("Field-level permission inventory via internal HubSpot session-auth endpoint");
+    addBrowserSessionOptions(flp.command("list").description("List all field-level permission allowlistings"))
+        .action(async (opts) => {
+        const ctx = getCtx();
+        const { client } = resolvePermissionSetSession(ctx, opts);
+        const res = await client.request(flpAllowlistingsPath());
+        printResult(ctx, res);
+    });
+    addBrowserSessionOptions(flp.command("object").argument("<typeId>").description("List field-level permission allowlistings for one object type"))
+        .action(async (typeId, opts) => {
+        const ctx = getCtx();
+        const { client } = resolvePermissionSetSession(ctx, opts);
+        const res = await client.request(flpObjectAllowlistingsPath(typeId));
+        printResult(ctx, res);
+    });
+    addBrowserSessionOptions(flp.command("property").argument("<typeId>").argument("<propertyName>").description("Get field-level permission allowlisting for one property"))
+        .action(async (typeId, propertyName, opts) => {
+        const ctx = getCtx();
+        const { client } = resolvePermissionSetSession(ctx, opts);
+        const res = await client.request(flpPropertyAllowlistingsPath(typeId, propertyName));
+        printResult(ctx, res);
+    });
+    addBrowserSessionOptions(flp.command("access-state")
+        .description("Bulk-read field-level permission access state")
+        .requiredOption("--data <payload>", "Access-state payload JSON")).action(async (opts) => {
+        const ctx = getCtx();
+        const { client } = resolvePermissionSetSession(ctx, opts);
+        const payload = parseJsonPayload(opts.data);
+        const res = await client.request(flpAccessStatePath(), {
+            method: "POST",
+            body: payload,
+            permissionMode: "read",
+        });
+        printResult(ctx, res);
+    });
+    addBrowserSessionOptions(flp.command("blocklist").description("List field-level permission blocklist including global entries"))
+        .action(async (opts) => {
+        const ctx = getCtx();
+        const { client } = resolvePermissionSetSession(ctx, opts);
+        const res = await client.request(flpBlocklistPath());
+        printResult(ctx, res);
+    });
+    addBrowserSessionOptions(flp.command("bypass-users").description("List users who bypass field-level permissions"))
+        .action(async (opts) => {
+        const ctx = getCtx();
+        const { client } = resolvePermissionSetSession(ctx, opts);
+        const res = await client.request(flpBypassUsersPath());
+        printResult(ctx, res);
+    });
     // Currencies
     const currencies = settings.command("currencies").description("Multi-currency management");
     currencies