linear-sdk-cli 0.8.3 → 0.9.1

package/src/commands/meta.ts

@@ -1,6 +1,6 @@
 /**
  * Top-level meta commands: whoami, auth (login/list/default/token/status/
- * logout/migrate), config.
+ * logout/rename/migrate), config.
  */
 
 import { Command } from "commander";
@@ -18,8 +18,9 @@ import {
   setDefaultWorkspace,
   listCredentials,
   readOAuthCredential,
-  writeOAuthCredential,
   migrateCredentials,
+  renameApiKeyProfile,
+  profileRenameProjectUpdates,
   redactKey,
   resolveConfig,
   defaultProjectConfigPath,
@@ -33,12 +34,11 @@ import {
 import { keyring } from "../lib/keyring.js";
 import { readStdinSync } from "../lib/body.js";
 import { CliError, authError, normalizeError, usageError } from "../lib/errors.js";
-import { confirmDestructive, promptSelect } from "../lib/prompt.js";
+import { confirmDestructive, promptSecret, promptSelect } from "../lib/prompt.js";
 import { listTeams } from "../services/team.js";
 import { resolveTeam } from "../lib/resolve.js";
 import { ISSUE_SORTS } from "../services/issue.js";
 import { firstTeam, type Context } from "../context.js";
-import { openUrl } from "../lib/open.js";
 import {
   authorizationCapabilities,
   credentialType as resolvedCredentialType,
@@ -46,19 +46,9 @@ import {
 import {
   ClientCredentialsTokenProvider,
   clientCredentialsScopes,
-  DEFAULT_OAUTH_SCOPES,
-  buildAuthorizationUrl,
-  createPkceRequest,
-  exchangeAuthorizationCode,
   revokeOAuthToken,
-  startLoopbackCallback,
-  type OAuthUserCredential,
 } from "../oauth.js";
 
-export const DEFAULT_OAUTH_REDIRECT_URI = "http://127.0.0.1:43821/oauth/callback";
-/** Public PKCE client identity. This is not a credential; no client secret is shipped or used. */
-export const DEFAULT_OAUTH_CLIENT_ID = "eda60862e4bb8b8af82cfb3193b65c2f";
-
 /**
  * The `whoami` handler, shared by the top-level `linear whoami` and the
  * reference CLI's spelling `linear auth whoami` so the two cannot drift.
@@ -111,6 +101,12 @@ const defaultAuthValidationClientFactory: AuthValidationClientFactory = (credent
     kind === "oauth-access-token" ? { accessToken: credential } : { apiKey: credential },
   ) as unknown as AuthValidationClient;
 let authValidationClientFactory = defaultAuthValidationClientFactory;
+let authSecretPrompt = promptSecret;
+
+/** Test seam that does not depend on Bun's module-namespace spying behavior. */
+export function setAuthSecretPromptForTests(prompt: typeof promptSecret | undefined): void {
+  authSecretPrompt = prompt ?? promptSecret;
+}
 
 /** Test seam for command-level auth tests; production always uses LinearClient. */
 export function setAuthValidationClientFactoryForTests(
@@ -229,17 +225,14 @@ export function registerMeta(program: Command): void {
   // login -------------------------------------------------------------------
   auth
     .command("login")
-    .description("Authenticate and select the workspace for this project")
+    .description("Sign in with a personal API key (default) or app credentials")
     .option("--no-project", "save credentials without changing the project workspace")
     .option("--key <key>", "use a personal API key ('-' reads it from stdin)")
     .option(
       "--plaintext",
       "Store API-key or app credentials in the private user config file (0600)",
     )
-    .option("--no-browser", "print the authorization URL instead of opening it")
-    .option("--read-only", "request read-only OAuth access")
-    .option("--admin", "explicitly add the OAuth admin scope")
-    .option("--timeout <seconds>", "seconds to wait for the loopback callback", "120")
+    .option("--read-only", "request read-only access with --app")
     .option("--app", "sign in as an app using client credentials")
     .option("--client-credentials", "alias for --app")
     .option("--scope <scopes>", "comma-separated app scopes (default: read,write)")
@@ -247,30 +240,18 @@ export function registerMeta(program: Command): void {
       "--client-secret <secret>",
       "app client secret ('-' reads stdin; defaults to LINEAR_CLIENT_SECRET)",
     )
-    .option(
-      "--client-id <id>",
-      "OAuth client ID (app: LINEAR_CLIENT_ID; browser: packaged CLI app)",
-    )
-    .option("--redirect-uri <uri>", "registered HTTP loopback callback URI")
+    .option("--client-id <id>", "app client ID (defaults to LINEAR_CLIENT_ID)")
     .action(
       action(async (ctx: Context, opts) => {
         if (ctx.options.accessToken !== undefined) {
           throw usageError(
-            "`auth login` cannot persist an injected access token. Remove --access-token and use browser OAuth, or use --key - for a personal API key.",
+            "`auth login` cannot persist an injected access token. Use LINEAR_ACCESS_TOKEN or --access-token with a data command, or use `auth login --key -` for a personal API key.",
           );
         }
         if (opts.app || opts.clientCredentials) {
-          if (
-            opts.key !== undefined ||
-            ctx.options.apiKey !== undefined ||
-            opts.redirectUri ||
-            opts.browser === false
-          ) {
-            throw usageError(
-              "--app cannot be combined with personal API-key or browser callback options.",
-            );
+          if (opts.key !== undefined || ctx.options.apiKey !== undefined) {
+            throw usageError("--app cannot be combined with --key or --api-key.");
           }
-          if (opts.admin) throw usageError("App actors cannot request the admin scope.");
           if (!opts.plaintext && !keyring())
             throw new CliError(
               "App authentication requires a system keyring; use --plaintext for explicit private-file storage.",
@@ -335,144 +316,64 @@ export function registerMeta(program: Command): void {
           );
           return;
         }
-        if (opts.clientSecret !== undefined || opts.scope !== undefined)
-          throw usageError("--client-secret and --scope require --app or --client-credentials.");
+        if (
+          opts.clientId !== undefined ||
+          opts.clientSecret !== undefined ||
+          opts.scope !== undefined ||
+          opts.readOnly
+        )
+          throw usageError(
+            "--client-id, --client-secret, --scope, and --read-only require --app or --client-credentials. Set personal API-key permissions in Linear's Security & Access settings.",
+          );
         let key: string | undefined = selectLoginKey(opts.key, ctx.options.apiKey);
-        if (key !== undefined) {
-          if (
-            opts.readOnly ||
-            opts.admin ||
-            opts.browser === false ||
-            opts.redirectUri ||
-            opts.clientId
-          ) {
-            throw usageError("OAuth-only options cannot be combined with --key or --api-key.");
-          }
+        if (key === undefined && !ctx.isTTY)
+          throw usageError(
+            "Personal API-key login requires interactive input. Pipe a key to `linear auth login --key -`, or use --app for app credentials. To authenticate commands without saving credentials, set LINEAR_API_KEY or LINEAR_ACCESS_TOKEN.",
+          );
+        if (!opts.plaintext && !keyring())
+          throw new CliError(
+            "API-key login requires a system keyring; use --plaintext for explicit private-file storage.",
+            "runtime",
+          );
+        if (key === undefined) {
+          ctx.output.info(
+            "Create a personal API key at https://linear.app/settings/account/security. Choose its permissions and team access in Linear; workspace policy may restrict key creation.",
+          );
+          key = await authSecretPrompt(ctx, "Linear API key:", { required: true });
+        } else {
           if (key === "-") key = readStdinSync();
           else
             ctx.output.warn(
               "An API key on the command line is visible to other processes and shell history; prefer --key - (stdin).",
             );
-          key = key.trim();
-          if (!key) throw usageError("No API key provided.");
-          const identity = await validateAuthCredential(key, ctx.options.workspace);
-          const { user: me, organization: org } = identity;
-          const { path, storage, keyringLabel } = writeCredential(org.urlKey, key, {
-            plaintext: opts.plaintext === true,
-          });
-          const projectConfigPath = saveLoginProject(ctx, org.urlKey, opts.project !== false);
-          const where =
-            storage === "keychain"
-              ? `Credential saved to the ${keyringLabel}; ${path} records the workspace.`
-              : `Credential saved to ${path} (plaintext, 0600).`;
-          ctx.output.emit(
-            {
-              success: true,
-              credentialType: "api-key",
-              workspace: org.urlKey,
-              user: me,
-              storage,
-              path,
-              projectConfigPath,
-            },
-            () =>
-              ctx.output.success(
-                `Authenticated as ${me.name} <${me.email}> for workspace '${org.urlKey}'. ${where}${projectConfigPath ? ` Project workspace saved to ${projectConfigPath}.` : ""}`,
-              ),
-          );
-          return;
         }
-
-        if (opts.plaintext) {
-          throw usageError(
-            "Browser OAuth is keyring-only; --plaintext requires --key, --api-key, or --client-credentials.",
-          );
-        }
-        if (opts.readOnly && opts.admin) {
-          throw usageError("--read-only cannot be combined with --admin.");
-        }
-        const timeoutSeconds = Number(opts.timeout);
-        if (!Number.isFinite(timeoutSeconds) || timeoutSeconds <= 0) {
-          throw usageError("--timeout must be a positive number of seconds.");
-        }
-        const clientId = String(
-          opts.clientId ?? process.env.LINEAR_OAUTH_CLIENT_ID ?? DEFAULT_OAUTH_CLIENT_ID,
-        ).trim();
-        const redirectUri = String(
-          opts.redirectUri ?? process.env.LINEAR_OAUTH_REDIRECT_URI ?? DEFAULT_OAUTH_REDIRECT_URI,
-        );
-        const scopes = opts.readOnly
-          ? ["read"]
-          : opts.admin
-            ? [...DEFAULT_OAUTH_SCOPES, "admin"]
-            : [...DEFAULT_OAUTH_SCOPES];
-        const pkce = createPkceRequest();
-        const callback = await startLoopbackCallback({
-          redirectUri,
-          state: pkce.state,
-          timeoutMs: timeoutSeconds * 1000,
+        key = key.trim();
+        if (!key) throw usageError("No API key provided.");
+        const identity = await validateAuthCredential(key, ctx.options.workspace);
+        const { user: me, organization: org } = identity;
+        const { path, storage, keyringLabel } = writeCredential(org.urlKey, key, {
+          plaintext: opts.plaintext === true,
         });
-        try {
-          const authorizationUrl = buildAuthorizationUrl({
-            clientId,
-            redirectUri: callback.redirectUri,
-            scopes,
-            challenge: pkce.challenge,
-            state: pkce.state,
-          });
-          if (opts.browser === false) {
-            ctx.output.info(`Open this URL to authenticate with Linear:\n${authorizationUrl}`);
-          } else {
-            ctx.output.info("Opening Linear in your browser…");
-            await openUrl(authorizationUrl);
-          }
-          const code = await callback.wait;
-          const token = await exchangeAuthorizationCode({
-            code,
-            verifier: pkce.verifier,
-            clientId,
-            redirectUri: callback.redirectUri,
-          });
-          const identity = await validateAuthCredential(
-            token.accessToken,
-            ctx.options.workspace,
-            "oauth-access-token",
-          );
-          const credential: OAuthUserCredential = {
-            version: 1,
-            kind: "oauth-user",
-            actor: "user",
-            ...token,
-            clientId,
-            workspace: identity.organization,
-            user: identity.user,
-          };
-          const saved = writeOAuthCredential(credential);
-          const projectConfigPath = saveLoginProject(
-            ctx,
-            credential.workspace.urlKey,
-            opts.project !== false,
-          );
-          ctx.output.emit(
-            {
-              success: true,
-              credentialType: "oauth-user",
-              workspace: credential.workspace.urlKey,
-              user: credential.user,
-              storage: saved.storage,
-              scopes: credential.scopes,
-              expiresAt: new Date(credential.expiresAt).toISOString(),
-              path: saved.path,
-              projectConfigPath,
-            },
-            () =>
-              ctx.output.success(
-                `Authenticated as ${credential.user.name} <${credential.user.email}> for workspace '${credential.workspace.urlKey}'. OAuth credentials saved to the ${saved.keyringLabel}.${projectConfigPath ? ` Project workspace saved to ${projectConfigPath}.` : ""}`,
-              ),
-          );
-        } finally {
-          await callback.close();
-        }
+        const projectConfigPath = saveLoginProject(ctx, org.urlKey, opts.project !== false);
+        const where =
+          storage === "keychain"
+            ? `Credential saved to the ${keyringLabel}; ${path} records the workspace.`
+            : `Credential saved to ${path} (plaintext, 0600).`;
+        ctx.output.emit(
+          {
+            success: true,
+            credentialType: "api-key",
+            workspace: org.urlKey,
+            user: me,
+            storage,
+            path,
+            projectConfigPath,
+          },
+          () =>
+            ctx.output.success(
+              `Authenticated as ${me.name} <${me.email}> for workspace '${org.urlKey}'. ${where}${projectConfigPath ? ` Project workspace saved to ${projectConfigPath}.` : ""}`,
+            ),
+        );
       }),
     );
 
@@ -631,6 +532,80 @@ export function registerMeta(program: Command): void {
       }),
     );
 
+  // rename ------------------------------------------------------------------
+  auth
+    .command("rename <old-slug> <new-slug>")
+    .description("Rename a stored API-key profile after its Linear workspace URL slug changes")
+    .option(
+      "--project-config <paths...>",
+      "also inspect these project configs for old workspace selectors (read-only)",
+    )
+    .addHelpText(
+      "after",
+      `
+Validates the exact stored API key against the current Linear workspace slug.
+Preserves the key, profile team, user workspace/default, and shared keyring list.
+Refuses configured or unlisted keyring destinations; never overwrites or revokes.
+Keyring moves require atomic create-only support (macOS Keychain). Linux Secret
+Service entries are refused; file-only API-key profiles are supported.
+An interrupted rename can be resumed by repeating the same command.
+OAuth user/app profiles are not supported; their credentials and grants stay unchanged.
+Project files are never edited. Reports the discovered project config and any
+--project-config paths needing updates; other repositories must be checked separately.
+Example: linear auth rename old-workspace new-workspace --json`,
+    )
+    .action(
+      action(async (ctx: Context, opts, oldSlug: string, newSlug: string) => {
+        const from = explicitWorkspaceSlug(oldSlug);
+        const to = explicitWorkspaceSlug(newSlug);
+        if (ctx.options.workspace && ctx.options.workspace !== from)
+          throw usageError("--workspace must match <old-slug> when renaming a profile.");
+        if (ctx.options.apiKey || ctx.options.accessToken)
+          throw usageError(
+            "`auth rename` uses only the named stored profile; remove credential flags.",
+          );
+        const checkedProjectConfigs = [
+          ...new Set([
+            ...(ctx.config.projectConfigPath ? [ctx.config.projectConfigPath] : []),
+            ...(opts.projectConfig ?? []).map((path: string) => resolve(path)),
+          ]),
+        ] as string[];
+        const projectConfigUpdates = profileRenameProjectUpdates(from, to, checkedProjectConfigs);
+        const globalConfigUpdates = profileRenameProjectUpdates(
+          from,
+          to,
+          ctx.config.globalConfigPath ? [ctx.config.globalConfigPath] : [],
+        );
+        let organization: AuthIdentity["organization"] | undefined;
+        const saved = await renameApiKeyProfile(from, to, async (key) => {
+          organization = (await validateAuthCredential(key, to)).organization;
+        });
+        const otherProjects = `Update workspace = "${from}" to "${to}" in other project configs and LINEAR_WORKSPACE overrides. Only the listed project paths were checked.`;
+        ctx.output.emit(
+          {
+            success: true,
+            from,
+            workspace: to,
+            credentialType: "api-key",
+            organization: organization!,
+            ...saved,
+            checkedProjectConfigs,
+            projectConfigUpdates,
+            globalConfigUpdates,
+            otherProjects,
+          },
+          () => {
+            ctx.output.success(
+              `Renamed API-key profile '${from}' to '${to}'. Credential preserved; no grant revoked.`,
+            );
+            for (const update of [...projectConfigUpdates, ...globalConfigUpdates])
+              ctx.output.info(`Update ${update.path}: workspace = "${to}" (currently "${from}").`);
+            ctx.output.info(otherProjects);
+          },
+        );
+      }),
+    );
+
   // migrate -----------------------------------------------------------------
   auth
     .command("migrate")
@@ -753,6 +728,7 @@ export function registerMeta(program: Command): void {
             workspaceProfile: c.workspaceProfile ?? null,
             team: c.team ?? null,
             workspace: c.workspace ?? null,
+            project: c.project ?? null,
             sort: c.sort,
             origins: c.origins,
             userConfigPath: c.userConfigPath,
@@ -766,6 +742,7 @@ export function registerMeta(program: Command): void {
             ["Workspace profile", c.workspaceProfile ?? "(none)"],
             ["Team", show("team", c.team)],
             ["Workspace", show("workspace", c.workspace)],
+            ["Default issue project", show("project", c.project)],
             ["Sort", show("sort", c.sort)],
             ["User config", c.userConfigPath],
             ["Project config", c.projectConfigPath],
@@ -780,6 +757,7 @@ export function registerMeta(program: Command): void {
     .command("init")
     .description("Write a project .linear.toml (at the git root, or here outside a repository)")
     .option("--team <key>", "default team key (otherwise chosen from a list)")
+    .option("--project <name|id>", "default Linear project for new issues")
     .option("--sort <order>", `default issue-list sort (${ISSUE_SORTS.join(" | ")})`)
     .option("--path <file>", "write this file instead of <git root>/.linear.toml")
     .option("--force", "overwrite an existing file")
@@ -808,10 +786,11 @@ export function registerMeta(program: Command): void {
           team: validateSetting("team", team),
         };
         if (opts.sort !== undefined) settings.sort = validateSetting("sort", opts.sort);
+        if (opts.project !== undefined) settings.project = validateSetting("project", opts.project);
         initProjectConfig(path, settings, { force: opts.force === true });
         ctx.output.emit({ success: true, path, ...settings }, () =>
           ctx.output.success(
-            `Wrote ${path} (team ${settings.team}${settings.sort ? `, sort ${settings.sort}` : ""}).`,
+            `Wrote ${path} (team ${settings.team}${settings.project ? `, project ${settings.project}` : ""}${settings.sort ? `, sort ${settings.sort}` : ""}).`,
           ),
         );
       }),

package/src/commands/release-note.ts

@@ -0,0 +1,90 @@
+import { Command } from "commander";
+import { action } from "../lib/action.js";
+import { noteOptions, noteInput } from "../lib/release-input.js";
+import { confirmDestructive } from "../lib/prompt.js";
+import * as svc from "../services/release.js";
+
+export function registerReleaseNote(program: Command): void {
+  const group = program
+    .command("release-note")
+    .description("Manage Markdown notes covering one or more releases");
+  group
+    .command("list")
+    .alias("ls")
+    .description("List release notes with optional pipeline/release filters")
+    .option("--pipeline <id|slug>", "filter by pipeline UUID or slug")
+    .option("--release <id>", "filter by covered release UUID or slug")
+    .option("--include-archived", "include archived notes")
+    .action(
+      action(async (ctx, opts) => {
+        const rows = await svc.listNotes(ctx.client, ctx.limit, opts);
+        ctx.output.list(
+          rows,
+          [
+            { key: "id", header: "ID", value: (r) => r.id },
+            { key: "title", header: "Title", value: (r) => r.title ?? "—" },
+            { key: "pipeline", header: "Pipeline", value: (r) => r.pipeline.name },
+            { key: "releaseCount", header: "Releases", value: (r) => r.releaseCount },
+          ],
+          rows,
+        );
+      }),
+    );
+  group
+    .command("view <id>")
+    .description("Show a release note and its Markdown body by UUID or slug")
+    .action(
+      action(async (ctx, _opts, id: string) => {
+        const n = await svc.getNote(ctx.client, id);
+        ctx.output.detail(n, [
+          ["ID", n.id],
+          ["Title", n.title],
+          ["Pipeline", n.pipeline.name],
+          ["Releases", n.releaseCount],
+          ["First release", n.firstRelease?.name],
+          ["Last release", n.lastRelease?.name],
+          ["Generation status", n.generationStatus],
+          ["Archived", n.archivedAt],
+          ["URL", n.url],
+          ["Content", n.content],
+        ]);
+      }),
+    );
+  noteOptions(
+    group
+      .command("create")
+      .description("Create a note for explicit releases or an inclusive createdAt range"),
+  )
+    .requiredOption("--pipeline <id|slug>", "pipeline UUID or slug")
+    .action(
+      action(async (ctx, opts) => {
+        const input = noteInput(opts);
+        svc.validateNoteScope(input, true);
+        const n = await svc.createNote(ctx.client, opts.pipeline, input);
+        ctx.output.emit(n, () => ctx.output.success(`Created release note ${n.id}`));
+      }),
+    );
+  noteOptions(
+    group
+      .command("update <id>")
+      .description("Update a note's title, Markdown, or covered releases"),
+  ).action(
+    action(async (ctx, opts, id: string) => {
+      const input = noteInput(opts);
+      svc.validateNoteScope(input, false);
+      const n = await svc.updateNote(ctx.client, id, input);
+      ctx.output.emit(n, () => ctx.output.success(`Updated release note ${n.id}`));
+    }),
+  );
+  group
+    .command("delete <id>")
+    .description("Delete a release note by UUID or slug")
+    .action(
+      action(async (ctx, _opts, id: string) => {
+        const n = await svc.getNote(ctx.client, id);
+        if (!(await confirmDestructive(ctx, `Delete release note ${n.title ?? n.id}?`))) return;
+        const receipt = await svc.deleteNote(ctx.client, n.id);
+        ctx.output.emit(receipt, () => ctx.output.success(`Deleted release note ${receipt.id}`));
+      }),
+    );
+}

package/src/commands/release-pipeline.ts

@@ -0,0 +1,122 @@
+import { Command, Option } from "commander";
+import { action } from "../lib/action.js";
+import { booleanValue, repeat, PIPELINE_TYPES } from "../lib/release-input.js";
+import * as svc from "../services/release.js";
+
+function options(command: Command, creating = false): Command {
+  const result = command
+    .option("--name <name>", "pipeline name")
+    .addOption(new Option("--type <type>", "pipeline type").choices(PIPELINE_TYPES))
+    .option(
+      "--production <boolean>",
+      "whether pipeline targets production (true|false)",
+      booleanValue,
+    )
+    .option(
+      "--auto-release-notes <boolean>",
+      "automatically generate notes on completion (true|false)",
+      booleanValue,
+    )
+    .option(
+      "--rollover-issues <boolean>",
+      "move open issues to the next scheduled release on completion (true|false)",
+      booleanValue,
+    )
+    .addOption(
+      new Option("--include-path <glob>", "replace path patterns with these globs (repeatable)")
+        .argParser(repeat)
+        .conflicts("clearPaths"),
+    )
+    .addOption(new Option("--clear-paths", "clear all path filters").conflicts("includePath"))
+    .addOption(
+      new Option("--team-id <uuid>", "replace associated teams with these UUIDs (repeatable)")
+        .argParser(repeat)
+        .conflicts("clearTeams"),
+    )
+    .addOption(new Option("--clear-teams", "clear team associations").conflicts("teamId"));
+  if (creating)
+    for (const flag of ["--name", "--type"])
+      result.options.find((o) => o.long === flag)!.makeOptionMandatory();
+  return result;
+}
+function input(opts: Record<string, any>): svc.PipelineInput {
+  return {
+    name: opts.name,
+    type: opts.type,
+    isProduction: opts.production,
+    autoGenerateReleaseNotesOnCompletion: opts.autoReleaseNotes,
+    rolloverIssuesOnCompletion: opts.rolloverIssues,
+    includePathPatterns: opts.clearPaths ? [] : opts.includePath,
+    teamIds: opts.clearTeams ? [] : opts.teamId,
+  };
+}
+export function registerReleasePipeline(program: Command): void {
+  const group = program
+    .command("release-pipeline")
+    .description("Manage release pipelines (Business/Enterprise)")
+    .addHelpText(
+      "after",
+      "\nUse normal Linear OAuth/API credentials. Pipeline access keys belong to\nlinear-release and cannot replace these credentials. Creating a pipeline\ncreates default stages; entitlement and workspace permissions are enforced by Linear.",
+    );
+  group
+    .command("list")
+    .alias("ls")
+    .description("List workspace release pipelines")
+    .option("--include-archived", "include archived pipelines")
+    .action(
+      action(async (ctx, opts) => {
+        const rows = await svc.listPipelines(ctx.client, ctx.limit, opts.includeArchived);
+        ctx.output.list(
+          rows,
+          [
+            { key: "id", header: "ID", value: (r) => r.id },
+            { key: "name", header: "Name", value: (r) => r.name },
+            { key: "type", header: "Type", value: (r) => r.type },
+            { key: "slugId", header: "Slug", value: (r) => r.slugId },
+          ],
+          rows,
+        );
+      }),
+    );
+  group
+    .command("view <id>")
+    .description("Show pipeline settings by UUID or slug")
+    .action(
+      action(async (ctx, _opts, id: string) => {
+        const p = await svc.getPipeline(ctx.client, id);
+        ctx.output.detail(p, [
+          ["ID", p.id],
+          ["Name", p.name],
+          ["Slug", p.slugId],
+          ["Type", p.type],
+          ["Production", p.isProduction],
+          ["Auto release notes", p.autoGenerateReleaseNotesOnCompletion],
+          ["Rollover issues", p.rolloverIssuesOnCompletion],
+          ["Path patterns", p.includePathPatterns.join(", ")],
+          ["Archived", p.archivedAt],
+          ["URL", p.url],
+        ]);
+      }),
+    );
+  options(
+    group.command("create").description("Create a pipeline with default stages"),
+    true,
+  ).action(
+    action(async (ctx, opts) => {
+      const p = await svc.createPipeline(ctx.client, {
+        ...input(opts),
+        name: opts.name,
+        type: opts.type,
+      });
+      ctx.output.emit(p, () => ctx.output.success(`Created release pipeline ${p.name} (${p.id})`));
+    }),
+  );
+  options(
+    group.command("update <id>").description("Update pipeline settings by UUID or slug"),
+  ).action(
+    action(async (ctx, opts, id: string) => {
+      const p = await svc.updatePipeline(ctx.client, id, input(opts));
+      ctx.output.emit(p, () => ctx.output.success(`Updated release pipeline ${p.name} (${p.id})`));
+    }),
+  );
+}