@agenzo/token-cli 0.3.4 → 0.5.0

package/dist/index.js

@@ -18,6 +18,9 @@ var CODE_NUM = {
   AUTH_INVITE_CODE_INVALID: 1004,
   KEY_INVALID: 1101,
   KEY_SCOPE_DENIED: 1102,
+  PAYMENT_METHOD_NOT_FOUND: 1401,
+  PAYMENT_METHOD_DISABLED: 1402,
+  INVALID_PAYMENT_METHOD: 1403,
   RESOURCE_NOT_FOUND: 2001,
   RESOURCE_CONFLICT: 2002,
   RESOURCE_STATE_INVALID: 2003,
@@ -38,6 +41,23 @@ var CODE_NUM = {
   QUOTE_EXPIRED: 4202,
   BOOKING_FAILED: 4203,
   CANCELLATION_NOT_ALLOWED: 4204,
+  PRICE_MISMATCH: 4205,
+  VEHICLE_CLASS_MISMATCH: 4206,
+  PAYMENT_METHOD_REQUIRED: 4207,
+  QUOTE_CACHE_UNAVAILABLE: 4208,
+  ARREARS_OUTSTANDING: 4209,
+  CONTACT_REQUIRED: 4210,
+  INVALID_PHONE: 4211,
+  SEAT_LIMIT_EXCEEDED: 4213,
+  RIDE_NOT_FOUND: 4212,
+  NO_AVAILABILITY: 4301,
+  PRICE_CHANGED: 4302,
+  NAME_FORMAT_INVALID: 4303,
+  HOTEL_ORDER_NOT_FOUND: 4304,
+  ALREADY_CANCELLED: 4305,
+  CHECKOUT_NOT_ALLOWED: 4306,
+  CHECKOUT_TASK_NOT_FOUND: 4307,
+  PAY_PER_CALL_NOT_AVAILABLE: 4308,
   RATE_LIMITED: 5001,
   UPSTREAM_ERROR: 5101,
   INTERNAL_ERROR: 5201,
@@ -55,23 +75,29 @@ function codeNum(code) {
   return CODE_NUM[code];
 }
 var CliError = class _CliError extends Error {
-  constructor(code, message, statusCode, requestId, upstream) {
+  constructor(code, message, statusCode, requestId, upstream, backendMessage) {
     super(message);
     this.code = code;
     this.statusCode = statusCode;
     this.requestId = requestId;
     this.upstream = upstream;
+    this.backendMessage = backendMessage;
     this.name = "CliError";
   }
   code;
   statusCode;
   requestId;
   upstream;
+  backendMessage;
   /**
    * Map a backend ApiError to a CLI-facing code (§8.5 transitional mapping).
-   * Backend numeric codes / HTTP status are translated to §8.4 string codes;
-   * the raw backend message is NOT passed through (§8.1 principle 4) — a
-   * stable, fixed message per code is used instead.
+   * Backend numeric codes / HTTP status are translated to §8.4 string codes.
+   * The top-level `message` is always the stable, catalog-owned text for the
+   * resolved code (§8.1 principle 4 — never let raw backend text become the
+   * primary/stable message). The backend's own message is NOT discarded,
+   * though: it is preserved on `backendMessage` and surfaced in the envelope
+   * as `backend_message` so the caller can see the real reason (e.g. which
+   * field failed validation) alongside the stable code/message.
    *
    * The optional `opts.auth` selects the auth semantics for the 401 mapping:
    * - `'bearer'` (default, admin-cli Bearer Token): 401 → `AUTH_SESSION_EXPIRED`.
@@ -95,7 +121,8 @@ var CliError = class _CliError extends Error {
         STABLE_MESSAGE[error.code] ?? "Request failed. Please check your input and retry.",
         error.statusCode,
         error.requestId,
-        error.upstream
+        error.upstream,
+        error.errorMessage
       );
     }
     const status = error.statusCode;
@@ -112,7 +139,8 @@ var CliError = class _CliError extends Error {
       STABLE_MESSAGE[code] ?? "Request failed. Please check your input and retry.",
       status,
       error.requestId,
-      error.upstream
+      error.upstream,
+      error.errorMessage
     );
   }
 };
@@ -167,6 +195,9 @@ var STABLE_MESSAGE = {
   AUTH_INVITE_CODE_INVALID: "The invitation code is invalid.",
   KEY_INVALID: "The API key is invalid or has been revoked. Please check your --api-key and retry.",
   KEY_SCOPE_DENIED: "This API key does not have the required scope for this command.",
+  PAYMENT_METHOD_NOT_FOUND: "Payment method not found.",
+  PAYMENT_METHOD_DISABLED: "This payment method has been disabled.",
+  INVALID_PAYMENT_METHOD: "The payment method is not available for this operation.",
   RESOURCE_NOT_FOUND: "The resource was not found or does not belong to the current organization.",
   RESOURCE_CONFLICT: "A resource with the same unique value already exists.",
   RESOURCE_STATE_INVALID: "The resource is in a state that does not permit this operation.",
@@ -188,18 +219,38 @@ var STABLE_MESSAGE = {
   VEHICLE_UNAVAILABLE: "No vehicle is available for the requested trip. Please try a different time or class.",
   QUOTE_EXPIRED: "The quote has expired. Please request a new quote and retry.",
   BOOKING_FAILED: "The booking could not be completed. Please retry.",
+  PRICE_MISMATCH: "The price does not match the quote. Re-quote and use the exact amount from the quote response.",
+  VEHICLE_CLASS_MISMATCH: "The vehicle class does not match the quote. Use the vehicle class from the quote response.",
+  PAYMENT_METHOD_REQUIRED: "Pay-per-call billing requires an active payment method. Please add a card first.",
+  QUOTE_CACHE_UNAVAILABLE: "Quote cache is temporarily unavailable. Please request a new quote and retry.",
+  ARREARS_OUTSTANDING: "You have outstanding arrears. Please settle your balance before booking a new ride.",
+  CONTACT_REQUIRED: "Passenger contact information is required. Please provide a passenger name and phone number.",
+  INVALID_PHONE: "The passenger phone number is not valid. Please provide a valid international number.",
+  SEAT_LIMIT_EXCEEDED: "The number of child/infant/toddler seats exceeds the vehicle capacity. Reduce seats or choose a larger vehicle.",
+  RIDE_NOT_FOUND: "The ride order was not found or does not belong to you.",
   CANCELLATION_NOT_ALLOWED: "This order cannot be cancelled in its current state.",
+  NO_AVAILABILITY: "No rooms available for the selected hotel and dates.",
+  PRICE_CHANGED: "The price changed since the quote. Re-quote and confirm.",
+  NAME_FORMAT_INVALID: "The guest name format is not accepted; use Latin letters.",
+  HOTEL_ORDER_NOT_FOUND: "Hotel order not found.",
+  ALREADY_CANCELLED: "This hotel order is already cancelled.",
+  CHECKOUT_NOT_ALLOWED: "A partial check-out is not allowed in the current state.",
+  CHECKOUT_TASK_NOT_FOUND: "Check-out application not found.",
+  PAY_PER_CALL_NOT_AVAILABLE: "Pay-per-call billing is not available; use monthly_settlement.",
   NOT_IMPLEMENTED: "This operation is not implemented yet."
 };
 function toErrorEnvelope(error) {
   if (error instanceof CliError) {
+    const stableMessage = error.message || "Unknown error";
+    const backendMessage = error.backendMessage && error.backendMessage !== stableMessage ? error.backendMessage : void 0;
     return {
       error: {
         code: error.code,
         code_num: codeNum(error.code),
-        message: error.message || "Unknown error",
+        message: stableMessage,
         ...error.requestId ? { request_id: error.requestId } : {},
-        ...error.upstream ? { upstream: error.upstream } : {}
+        ...error.upstream ? { upstream: error.upstream } : {},
+        ...backendMessage ? { backend_message: backendMessage } : {}
       }
     };
   }
@@ -262,13 +313,27 @@ function isBelow(current, minimum) {
 var ApiClient = class {
   baseUrl;
   timeout;
+  /**
+   * Correlation id for this CLI invocation. Generated once per `ApiClient`
+   * instance (i.e. once per command execution — each `apps/*` entrypoint
+   * constructs exactly one `ApiClient` per process run) and sent as
+   * `X-Request-Id` on every request this client makes. The backend's
+   * `RequestIdMiddleware` adopts a client-supplied `X-Request-Id` verbatim as
+   * both `trace_id` and `request_id` (only generating its own when the header
+   * is absent), so every HTTP call belonging to one CLI operation — including
+   * multi-step flows like `payment-methods add`'s create + poll + get — shares
+   * a single trace_id server-side and can be followed as one chain in logs.
+   */
+  requestId;
   constructor(config) {
     this.baseUrl = config.baseUrl.replace(/\/+$/, "");
     this.timeout = config.timeout ?? 6e4;
+    this.requestId = crypto.randomUUID();
   }
   buildHeaders(auth) {
     const headers = {
-      "User-Agent": `agenzo-admin-cli/${getCurrentVersion()}`
+      "User-Agent": `agenzo-admin-cli/${getCurrentVersion()}`,
+      "X-Request-Id": this.requestId
     };
     if (auth.type === "bearer") {
       headers["Authorization"] = `Bearer ${auth.token}`;
@@ -743,6 +808,265 @@ async function collectPaymentMethodParams(type, flags) {
   return params;
 }
 
+// src/verb-schema.ts
+var CLI_NAME = "agenzo-token-cli";
+var PAYMENT_METHODS_NOUN = "payment-methods";
+var PAYMENT_TOKENS_NOUN = "payment-tokens";
+function wantsJsonSchema(argv = process.argv) {
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--format=json") return true;
+    if (a === "--format" && argv[i + 1] === "json") return true;
+  }
+  return false;
+}
+function emitSchema(schema) {
+  console.log(JSON.stringify(schema, null, 2));
+}
+function attachSchemaHelp(cmd, schema) {
+  const baseHelp = cmd.helpInformation.bind(cmd);
+  cmd.helpInformation = (context) => {
+    if (!wantsJsonSchema()) return baseHelp(context);
+    emitSchema(schema);
+    return "";
+  };
+  return cmd;
+}
+var pmAddSchema = {
+  cli: CLI_NAME,
+  noun: PAYMENT_METHODS_NOUN,
+  verb: "add",
+  description: "Add a payment method (manual 3DS or Drop-in session)",
+  flags: {
+    type: { type: "string", required: false, default: "card", description: "Payment method type" },
+    mode: {
+      type: "string",
+      required: false,
+      default: "manual",
+      description: 'Add mode: "manual" (CLI collects card details and polls 3DS) or "dropin" (mint a Drop-in session; the app opens the Drop-in SDK for the user to enter card details securely \u2014 use this mode when the user wants to bind/add a card from chat)',
+      constraints: "manual | dropin"
+    },
+    email: {
+      type: "string",
+      required: "conditional",
+      description: "Manual mode: email for 3DS verification. Dropin mode: email used as the Drop-in session reference. Use the user's login profile email \u2014 never ask in chat."
+    },
+    "idempotency-key": {
+      type: "string",
+      required: false,
+      description: "Idempotency key forwarded verbatim as the Idempotency-Key header (manual mode only)"
+    },
+    "no-poll": {
+      type: "bool",
+      required: false,
+      default: false,
+      description: "Dropin mode: mint the session, print it, and exit immediately without polling verification status (for server/SDK-driven flows where the front-end completes the binding). Agents integrating with a UI card flow should set this."
+    }
+  },
+  response: {
+    id: { type: "string", description: "Payment method id" },
+    session_id: { type: "string|absent", description: "Drop-in session id (dropin mode only) \u2014 pass to the front-end Drop-in SDK, never read aloud to the user" },
+    status: { type: "string", description: "PENDING | ACTIVE | FAILED | EXPIRED" },
+    brand: { type: "string|absent", description: "Card brand, once known" },
+    last4: { type: "string|absent", description: "Card last 4 digits, once known" }
+  },
+  example: {
+    command: "agenzo-token-cli payment-methods add --mode dropin --email user@example.com --no-poll",
+    output_summary: "Dropin mode returns { id, session_id }. Never read card numbers/CVV/expiry to or from the user (PCI) \u2014 the Drop-in SDK collects them securely."
+  },
+  error_recovery: {
+    PARAM_INVALID: 'Fix the offending flag (mode must be "manual" or "dropin"), then retry.'
+  }
+};
+var pmListSchema = {
+  cli: CLI_NAME,
+  noun: PAYMENT_METHODS_NOUN,
+  verb: "list",
+  description: "List payment methods",
+  flags: {
+    member: { type: "string", required: false, description: "Filter by member ID" }
+  },
+  response: {
+    payment_methods: {
+      type: "array",
+      description: "Payment methods for the developer (optionally scoped to --member)",
+      items: {
+        id: { type: "string", description: "Payment method id" },
+        type: { type: "string", description: "Payment method type (e.g. card)" },
+        status: { type: "string", description: "PENDING | ACTIVE | FAILED | DISABLED | EXPIRED" },
+        brand: { type: "string|null", description: "Card brand" },
+        first6: { type: "string|null", description: "Card first 6 digits" },
+        last4: { type: "string|null", description: "Card last 4 digits" }
+      }
+    }
+  },
+  example: {
+    command: "agenzo-token-cli payment-methods list",
+    output_summary: "Returns payment_methods[]. Check for status=ACTIVE before assuming the user has a usable card."
+  }
+};
+var pmGetSchema = {
+  cli: CLI_NAME,
+  noun: PAYMENT_METHODS_NOUN,
+  verb: "get",
+  description: "Get a payment method by ID",
+  flags: {
+    pm_id: { type: "string", required: true, description: "Payment method id (positional argument)" }
+  },
+  response: {
+    id: { type: "string", description: "Payment method id" },
+    type: { type: "string", description: "Payment method type" },
+    status: { type: "string", description: "PENDING | ACTIVE | FAILED | DISABLED | EXPIRED" },
+    brand: { type: "string|null", description: "Card brand" },
+    first6: { type: "string|null", description: "Card first 6 digits" },
+    last4: { type: "string|null", description: "Card last 4 digits" },
+    created_at: { type: "string", description: "Creation time" }
+  },
+  example: {
+    command: "agenzo-token-cli payment-methods get pm_01H...",
+    output_summary: "Returns the payment method detail including status."
+  }
+};
+var pmDisableSchema = {
+  cli: CLI_NAME,
+  noun: PAYMENT_METHODS_NOUN,
+  verb: "disable",
+  description: "Disable a payment method",
+  flags: {
+    pm_id: { type: "string", required: true, description: "Payment method id (positional argument)" },
+    "idempotency-key": {
+      type: "string",
+      required: true,
+      description: "Idempotency key forwarded verbatim as the Idempotency-Key header"
+    }
+  },
+  response: {
+    status: { type: "string", description: "Status after disabling (typically DISABLED)" },
+    revoked_tokens_count: { type: "int", description: "Number of payment tokens revoked as a side effect" }
+  },
+  example: {
+    command: "agenzo-token-cli payment-methods disable pm_01H... --idempotency-key disable-123",
+    output_summary: "Disables the card and revokes any payment tokens issued against it. Only use when the user explicitly requests it."
+  },
+  error_recovery: {
+    PARAM_IDEMPOTENCY_KEY_REQUIRED: "Supply --idempotency-key (1-128 chars [A-Za-z0-9_-]); the CLI never generates one under --yes."
+  }
+};
+var ptCreateSchema = {
+  cli: CLI_NAME,
+  noun: PAYMENT_TOKENS_NOUN,
+  verb: "create",
+  description: "Create a payment token (VCN / Network Token / X402)",
+  flags: {
+    type: { type: "string", required: true, description: "Token type", constraints: "vcn | network-token | x402" },
+    "payment-method-id": { type: "string", required: "conditional", description: "Payment method ID to use (or resolved via --card / auto-select from ACTIVE cards)" },
+    card: { type: "string", required: false, description: "Match payment method by last 4 digits" },
+    member: { type: "string", required: false, description: "Member ID" },
+    amount: { type: "string", required: "conditional", description: "Amount in USD (vcn) or USDC (x402)" },
+    currency: { type: "string", required: false, description: "Currency (vcn only; server default applies if omitted)" },
+    "pay-to": { type: "string", required: "conditional", description: "Pay-to address (x402 only)" },
+    nonce: { type: "string", required: "conditional", description: "Nonce (x402 only)" },
+    network: { type: "string", required: "conditional", description: "Network (x402 only)" },
+    deadline: { type: "string", required: "conditional", description: "Deadline as a Unix timestamp in seconds (x402 only)" },
+    "external-tx-id": { type: "string", required: false, description: "External transaction ID" },
+    "idempotency-key": {
+      type: "string",
+      required: true,
+      description: "Idempotency key forwarded verbatim as the Idempotency-Key header"
+    }
+  },
+  response: {
+    id: { type: "string", description: "Payment token id" },
+    type: { type: "string", description: "vcn | network_token | x402" },
+    status: { type: "string", description: "Token status" }
+  },
+  example: {
+    command: "agenzo-token-cli payment-tokens create --type vcn --card 1234 --amount 25.00 --idempotency-key tok-123",
+    output_summary: "Creates a token; response shape varies by type (nested under vcn / network_token / x402)."
+  },
+  error_recovery: {
+    TOKEN_FEATURE_DISABLED: "This token type is not enabled yet. Tell the user and suggest an alternative type if applicable.",
+    CLIENT_NO_PAYMENT_METHOD: "The user has no ACTIVE payment method. Guide them to add one first (payment-methods add --mode dropin).",
+    CLIENT_CARD_NOT_MATCHED: "The --card last-4 did not match any ACTIVE card. Call payment-methods list to see available cards."
+  }
+};
+var ptListSchema = {
+  cli: CLI_NAME,
+  noun: PAYMENT_TOKENS_NOUN,
+  verb: "list",
+  description: "List payment tokens",
+  flags: {
+    type: { type: "string", required: false, description: "Filter by token type" },
+    member: { type: "string", required: false, description: "Filter by member ID" }
+  },
+  response: {
+    payment_tokens: {
+      type: "array",
+      description: "Payment tokens for the developer (optionally filtered)",
+      items: {
+        id: { type: "string", description: "Token id" },
+        type: { type: "string", description: "vcn | network_token | x402" },
+        status: { type: "string", description: "Token status" }
+      }
+    }
+  },
+  example: {
+    command: "agenzo-token-cli payment-tokens list --type vcn",
+    output_summary: "Returns payment_tokens[]."
+  }
+};
+var ptGetSchema = {
+  cli: CLI_NAME,
+  noun: PAYMENT_TOKENS_NOUN,
+  verb: "get",
+  description: "Get a payment token by ID",
+  flags: {
+    payment_token_id: { type: "string", required: true, description: "Payment token id (positional argument)" },
+    reveal: {
+      type: "bool",
+      required: false,
+      default: false,
+      description: "Reveal full VCN card number and CVC in the output. NEVER pass this or read revealed card data aloud to the user (PCI) unless explicitly required by a payment flow."
+    }
+  },
+  response: {
+    id: { type: "string", description: "Token id" },
+    type: { type: "string", description: "vcn | network_token | x402" },
+    status: { type: "string", description: "Token status" }
+  },
+  example: {
+    command: "agenzo-token-cli payment-tokens get pt_01H...",
+    output_summary: "Returns the token detail. VCN PAN/CVC are masked unless --reveal is set."
+  }
+};
+var ptRevokeSchema = {
+  cli: CLI_NAME,
+  noun: PAYMENT_TOKENS_NOUN,
+  verb: "revoke",
+  description: "Revoke a payment token",
+  flags: {
+    payment_token_id: { type: "string", required: true, description: "Payment token id (positional argument)" },
+    "idempotency-key": {
+      type: "string",
+      required: true,
+      description: "Idempotency key forwarded verbatim as the Idempotency-Key header"
+    }
+  },
+  response: {
+    id: { type: "string", description: "Token id" },
+    status: { type: "string", description: "Status after revocation" },
+    revoked_at: { type: "string|absent", description: "Revocation time (immediate revoke)" },
+    expires_at: { type: "string|absent", description: "Expiry time (delayed revoke \u2014 x402 cryptogram auto-expires)" }
+  },
+  example: {
+    command: "agenzo-token-cli payment-tokens revoke pt_01H... --idempotency-key revoke-123",
+    output_summary: "Revokes the token immediately, or schedules a delayed revoke for x402 (status stays ACTIVE until expires_at)."
+  },
+  error_recovery: {
+    PARAM_IDEMPOTENCY_KEY_REQUIRED: "Supply --idempotency-key (1-128 chars [A-Za-z0-9_-]); the CLI never generates one under --yes."
+  }
+};
+
 // src/payment-methods/add.ts
 var MANUAL_POLL_INTERVAL_MS = 3e3;
 var MANUAL_POLL_TIMEOUT_MS = 15 * 60 * 1e3;
@@ -764,6 +1088,7 @@ function registerAddCommand(parent, deps) {
     "--no-poll",
     "Dropin mode: mint the session, print it, and exit immediately without polling verification status (for server/SDK-driven flows where the front-end completes the binding)"
   );
+  attachSchemaHelp(cmd, pmAddSchema);
   cmd.action(async () => {
     const opts = cmd.optsWithGlobals();
     const format = resolveFormat(opts.format);
@@ -1014,6 +1339,7 @@ function sleep(ms) {
 // src/payment-methods/list.ts
 function registerListCommand(parent, deps) {
   const cmd = parent.command("list").description("List payment methods").option("--api-key <key>", "API Key for authentication").option("--member <member_id>", "Filter by member ID");
+  attachSchemaHelp(cmd, pmListSchema);
   cmd.action(async () => {
     const opts = cmd.optsWithGlobals();
     const format = resolveFormat(opts.format);
@@ -1060,6 +1386,7 @@ function registerListCommand(parent, deps) {
 // src/payment-methods/get.ts
 function registerGetCommand(parent, deps) {
   const cmd = parent.command("get <pm_id>").description("Get a payment method by ID").option("--api-key <key>", "API key for authentication");
+  attachSchemaHelp(cmd, pmGetSchema);
   cmd.action(async (pmId) => {
     const opts = cmd.optsWithGlobals();
     const format = resolveFormat(opts.format);
@@ -1105,6 +1432,7 @@ function registerDisableCommand(parent, deps) {
     "--idempotency-key <key>",
     "Idempotency key forwarded verbatim as the Idempotency-Key header"
   );
+  attachSchemaHelp(cmd, pmDisableSchema);
   cmd.action(async (pmId) => {
     const opts = cmd.optsWithGlobals();
     const format = resolveFormat(opts.format);
@@ -1232,7 +1560,7 @@ function registerDropinStatusCommand(parent, deps) {
 
 // src/payment-tokens/create.ts
 import { confirm, select as select2 } from "@inquirer/prompts";
-var DEFAULT_NT_FEE_CENTS = 500;
+var DEFAULT_NT_FEE_CENTS = 50;
 var USDC_UNIT = 1e6;
 function mapTokenType(cliType) {
   if (cliType === "network-token") return "network_token";
@@ -1343,6 +1671,7 @@ function registerCreateCommand(parent, deps) {
     "--idempotency-key <key>",
     "Idempotency key forwarded verbatim as the Idempotency-Key header"
   );
+  attachSchemaHelp(cmd, ptCreateSchema);
   cmd.action(async () => {
     const opts = cmd.optsWithGlobals();
     const format = resolveFormat(opts.format);
@@ -1574,6 +1903,7 @@ function getSummary(token) {
 }
 function registerListCommand2(parent, deps) {
   const cmd = parent.command("list").description("List payment tokens").option("--api-key <key>", "API Key for authentication").option("--type <type>", "Filter by token type").option("--member <member_id>", "Filter by member ID");
+  attachSchemaHelp(cmd, ptListSchema);
   cmd.action(async () => {
     const opts = cmd.optsWithGlobals();
     const format = resolveFormat(opts.format);
@@ -1710,6 +2040,7 @@ function formatCentsPlain(cents) {
 }
 function registerGetCommand2(parent, deps) {
   const cmd = parent.command("get <payment_token_id>").description("Get a payment token by ID").option("--api-key <key>", "API key for authentication").option("--reveal", "Reveal full VCN card number and CVC in the output");
+  attachSchemaHelp(cmd, ptGetSchema);
   cmd.action(async (paymentTokenId) => {
     const opts = cmd.optsWithGlobals();
     const format = resolveFormat(opts.format);
@@ -1741,6 +2072,7 @@ function registerRevokeCommand(parent, deps) {
     "--idempotency-key <key>",
     "Idempotency key forwarded verbatim as the Idempotency-Key header"
   );
+  attachSchemaHelp(cmd, ptRevokeSchema);
   cmd.action(async (paymentTokenId) => {
     const opts = cmd.optsWithGlobals();
     const format = resolveFormat(opts.format);
@@ -1851,6 +2183,9 @@ function reportError(error) {
     console.error(
       Formatter.status("error", `[${envelope.error.code_num}] ${envelope.error.message}`)
     );
+    if (envelope.error.upstream) {
+      console.error(`  \u21B3 [${envelope.error.upstream.code}] ${envelope.error.upstream.message}`);
+    }
     if (!(error instanceof CliError) && process.argv.includes("--verbose")) {
       console.error(error);
     }