test(cli): cover parser and help contract gaps

crates/cli/src/commands/cors.rs

@@ -534,6 +534,7 @@ mod tests {
         assert!(parse_bucket_path("local").is_err());
         assert!(parse_bucket_path("local/").is_err());
         assert!(parse_bucket_path("/bucket").is_err());
+        assert!(parse_bucket_path("local//").is_err());
         assert!(parse_bucket_path("local//bucket").is_err());
         assert!(parse_bucket_path("local/my-bucket/nested").is_err());
         assert!(parse_bucket_path("local///").is_err());
@@ -595,6 +596,40 @@ mod tests {
         assert!(error.contains("unsupported method"));
     }
 
+    #[test]
+    fn test_parse_cors_configuration_rejects_missing_allowed_origin() {
+        let error = parse_cors_configuration(
+            r#"{
+                "rules": [
+                    {
+                        "allowedOrigins": [],
+                        "allowedMethods": ["GET"]
+                    }
+                ]
+            }"#,
+        )
+        .expect_err("missing allowed origin");
+
+        assert!(error.contains("at least one allowed origin"));
+    }
+
+    #[test]
+    fn test_parse_cors_configuration_rejects_missing_allowed_method() {
+        let error = parse_cors_configuration(
+            r#"{
+                "rules": [
+                    {
+                        "allowedOrigins": ["*"],
+                        "allowedMethods": []
+                    }
+                ]
+            }"#,
+        )
+        .expect_err("missing allowed method");
+
+        assert!(error.contains("at least one allowed method"));
+    }
+
     #[test]
     fn test_parse_cors_configuration_xml_rejects_missing_allowed_origin() {
         let error = parse_cors_configuration(
@@ -715,6 +750,28 @@ mod tests {
         assert_eq!(config.rules[0].allowed_methods, vec!["GET".to_string()]);
     }
 
+    #[test]
+    fn test_parse_cors_configuration_xml_drops_blank_optional_headers() {
+        let config = parse_cors_configuration(
+            r#"
+<CORSConfiguration>
+  <CORSRule>
+    <AllowedOrigin>https://console.example.com</AllowedOrigin>
+    <AllowedMethod>get</AllowedMethod>
+    <AllowedHeader>   </AllowedHeader>
+    <ExposeHeader></ExposeHeader>
+  </CORSRule>
+</CORSConfiguration>
+"#,
+        )
+        .expect("parse xml config with blank optional headers");
+
+        assert_eq!(config.rules.len(), 1);
+        assert_eq!(config.rules[0].allowed_headers, None);
+        assert_eq!(config.rules[0].expose_headers, None);
+        assert_eq!(config.rules[0].allowed_methods, vec!["GET".to_string()]);
+    }
+
     #[test]
     fn test_cors_input_source_prefers_positional_argument() {
         let args = SetCorsArgs {
@@ -763,6 +820,56 @@ mod tests {
         assert!(cors_input_source(&args).is_err());
     }
 
+    #[tokio::test]
+    async fn test_execute_list_rejects_empty_normalized_bucket_path() {
+        let code = execute(
+            CorsArgs {
+                command: CorsCommands::List(BucketArg {
+                    path: "local///".to_string(),
+                    force: false,
+                }),
+            },
+            OutputConfig::default(),
+        )
+        .await;
+
+        assert_eq!(code, ExitCode::UsageError);
+    }
+
+    #[tokio::test]
+    async fn test_execute_set_rejects_empty_normalized_bucket_path_before_reading_source() {
+        let code = execute(
+            CorsArgs {
+                command: CorsCommands::Set(SetCorsArgs {
+                    path: "local///".to_string(),
+                    source: Some("missing-cors.json".to_string()),
+                    file: None,
+                    force: false,
+                }),
+            },
+            OutputConfig::default(),
+        )
+        .await;
+
+        assert_eq!(code, ExitCode::UsageError);
+    }
+
+    #[tokio::test]
+    async fn test_execute_remove_rejects_empty_normalized_bucket_path() {
+        let code = execute(
+            CorsArgs {
+                command: CorsCommands::Remove(BucketArg {
+                    path: "local///".to_string(),
+                    force: false,
+                }),
+            },
+            OutputConfig::default(),
+        )
+        .await;
+
+        assert_eq!(code, ExitCode::UsageError);
+    }
+
     #[tokio::test]
     async fn test_read_cors_source_reads_file_contents() {
         let temp_dir = tempfile::tempdir().expect("create temp dir");

crates/cli/src/commands/event.rs

@@ -22,6 +22,11 @@ Examples:
   rc event add local/my-bucket arn:aws:sns:us-east-1:123456789012:alerts --event delete
   rc bucket event add local/my-bucket arn:aws:lambda:us-east-1:123456789012:function:thumbnail --event put,delete";
 
+const EVENT_REMOVE_AFTER_HELP: &str = "\
+Examples:
+  rc bucket event remove local/my-bucket arn:aws:sqs:us-east-1:123456789012:jobs
+  rc event remove local/my-bucket arn:aws:sns:us-east-1:123456789012:alerts";
+
 /// Manage bucket event notifications
 #[derive(Args, Debug)]
 #[command(after_help = EVENT_AFTER_HELP)]
@@ -71,6 +76,7 @@ pub struct AddArgs {
 }
 
 #[derive(Args, Debug)]
+#[command(after_help = EVENT_REMOVE_AFTER_HELP)]
 pub struct RemoveArgs {
     /// Path to the bucket (alias/bucket)
     pub path: String,
@@ -480,6 +486,7 @@ mod tests {
         assert!(parse_bucket_path("local").is_err());
         assert!(parse_bucket_path("/bucket").is_err());
         assert!(parse_bucket_path("local/my-bucket/prefix").is_err());
+        assert!(parse_bucket_path("local///").is_err());
     }
 
     #[test]