@curviate/cli 0.19.0 → 0.20.0

package/CHANGELOG.md

@@ -8,6 +8,101 @@ a new command or flag is a minor; a breaking command/flag/exit-code change is a
 
 ## [Unreleased]
 
+## [0.20.0] - 2026-08-03
+
+A safety and correctness release. Upgrade promptly: it closes a path by which a
+mistyped command sent a message, and it is the first release in which
+`curviate webhook verify` works at all.
+
+### Fixed
+
+- **An unknown subcommand under `message` no longer becomes a send.**
+  `curviate message search "sophie"` did not error. `message` accepts both
+  subcommands and a bare `message <chat_id> "<text>"` form, and an unregistered
+  first token fell through to the bare form, so it bound `chatId="search"`,
+  `text="sophie"` and **sent a message**. That applied to any unknown or
+  mistyped subcommand: with `search` it 404s, but with a real chat id in that
+  position, or a paste that lands one there, it messaged a real person.
+
+  An unknown subcommand now exits 2 with usage and issues **no request at all**.
+  The legitimate `curviate message <chat_id> "<text>"` form is unchanged, and
+  `curviate message send <chat_id> "<text>"` is always available for a chat id
+  the check does not recognise.
+
+  To search your messages, the command is `curviate inbox search`.
+
+- **A mistyped `connect` subcommand no longer sends a connection invitation.**
+  Same shape: `curviate connect <id>` sends an invitation, so `connect snet`
+  (for `sent`) invited whoever owns the slug `snet`. A first argument that is a
+  near-miss of a `connect` subcommand is now refused with a suggestion. If the
+  slug really was intended, pass the full profile URL or the provider id.
+
+- **`curviate webhook verify` now verifies real deliveries.** It inherited a
+  defect from `@curviate/sdk`: the platform sends the event name in `event` and
+  the SDK required a `type` field no delivery has ever carried, so verification
+  failed on 100% of genuine webhooks and reported `malformed_header`, pointing
+  at the header and the secret when both were correct. Fixed by the `@curviate/sdk`
+  0.19.0 dependency bump. A body that verifies but cannot be parsed now reports
+  `malformed_payload`.
+
+- **`webhook verify --body` accepts the raw body inline, as a file path, or on
+  stdin.** Every documented invocation failed before this: the flag value was
+  handed straight to the filesystem, so inline JSON was opened as a filename
+  (`ENOENT`/`ENAMETOOLONG`), and `--body -` opened the internal placeholder the
+  argument parser substitutes for a bare dash. Only a file path ever worked, and
+  the failure surfaced as exit `1` with a raw filesystem error rather than a
+  usage error. A body is now recognised by its leading `{`, `-` reads stdin on
+  every platform, and anything unreadable exits `2` naming all three accepted
+  forms. A trailing newline added by a shell redirect, `curl -o`, or an editor
+  save is ignored; newlines inside the body are preserved.
+
+- **`webhook verify --help` named the wrong signature header.** It said
+  `X-Curviate-Signature`; the platform sends `Curviate-Signature`, so a reader
+  who copied the name read for a header that is never present. The same help
+  also claimed `--header` falls back to stdin, which it never did. Both flags
+  are now marked required, so omitting one is a usage error instead of a
+  signature failure that points at a secret which was never wrong.
+
+- **`group list` help said `--profile`; the flag is `--target`.** `--profile` is
+  the global config-profile selector, so following the help text selected a
+  config profile and silently returned your own groups instead of the target
+  member's.
+
+- **`job publish` and `recruiter job publish` help said `--budget-*`.** The glob
+  is not a flag anyone can type; the help now names `--budget-amount`,
+  `--budget-currency`, and `--budget-scope`.
+
+- **Em dashes removed from all CLI output** (error messages, help text, usage
+  blocks), including the `no API key` error.
+
+### Changed
+
+- `@curviate/sdk` dependency bumped to `^0.19.0`. If you also call the SDK
+  directly, note that its webhook event discriminant moved from `event.type` to
+  `event.event`; see the SDK's 0.19.0 changelog.
+
+### Added
+
+- Two mechanical guards in the test suite, both derived from the live command
+  tree rather than a hand-maintained list, so this class of defect cannot
+  quietly return:
+  - a fall-through audit that forces an explicit safe/read-only/write-bearing
+    verdict on every command group that mixes subcommands with a positional
+    fallback, and
+  - a help-vs-args check that fails when any command's help text names a flag
+    that command does not declare (resolving cross-references, so a reference
+    to another command's flag is checked against that command).
+
+- Two further mechanical guards, in the same spirit:
+  - an em-dash check that walks the TypeScript syntax tree, so it inspects
+    string and template literals only and leaves comments exempt structurally
+    rather than by a fragile line-based heuristic, and
+  - a pre-publish binary gate that runs every documented `webhook verify --body`
+    form against a recorded delivery: the exact body bytes and the exact
+    signature header the platform put on the wire, replayed verbatim and never
+    re-signed. Tampering with a single field is still rejected, so the gate
+    proves the verdict as well as the plumbing.
+
 ## [0.19.0] - 2026-07-29
 
 A minor release closing the remaining SDK-parity gap: 25 new commands across seven

package/dist/{account-EGJJNBXW.js → account-2SOSCEB6.js}

@@ -26,12 +26,12 @@ import {
   renderSuccess,
   renderUnexpectedError,
   resolveEffectiveConfig
-} from "./chunk-M33MI53G.js";
+} from "./chunk-HDQUEFD2.js";
 import {
   GLOBAL_FLAGS,
   READ_SINGLE_FLAGS,
   WRITE_SINGLE_FLAGS
-} from "./chunk-TMU3CSPR.js";
+} from "./chunk-DW2HCRXJ.js";
 
 // src/commands/account.ts
 import { defineCommand } from "citty";
@@ -90,15 +90,15 @@ function checkCredentialConflicts(flags, out) {
   const passwordStdin = flags["password-stdin"] ?? false;
   const liAtStdin = flags["li-at-stdin"] ?? false;
   if (flags.password !== void 0 && passwordStdin) {
-    failConflict(out, "--password and --password-stdin cannot both be set \u2014 choose one source.");
+    failConflict(out, "--password and --password-stdin cannot both be set. Choose one source.");
   }
   if (flags["li-at"] !== void 0 && liAtStdin) {
-    failConflict(out, "--li-at and --li-at-stdin cannot both be set \u2014 choose one source.");
+    failConflict(out, "--li-at and --li-at-stdin cannot both be set. Choose one source.");
   }
   if (passwordStdin && liAtStdin) {
     failConflict(
       out,
-      "--password-stdin and --li-at-stdin cannot both be set \u2014 stdin can feed only one secret per invocation."
+      "--password-stdin and --li-at-stdin cannot both be set. stdin can feed only one secret per invocation."
     );
   }
   if (liAtStdin && flags["auth-method"] === "credentials") {
@@ -164,7 +164,7 @@ function challengeDescription(type) {
     case "two_factor_app":
       return "Enter the current code from your authenticator app.";
     case "mobile_app_approval":
-      return "Open your LinkedIn mobile app and approve this sign-in \u2014 this will continue automatically once you tap approve.";
+      return "Open your LinkedIn mobile app and approve this sign-in. This will continue automatically once you tap approve.";
   }
 }
 function printChallengeCopy(type, out) {
@@ -293,7 +293,7 @@ async function buildAuthBody(flags, ctx) {
       // of --email — an email-less body still fails downstream validation,
       // as expected, rather than the flag being silently ignored.
       allowInteractiveStdinRead: !ctx.previewMode,
-      failMessage: "no password \u2014 pass --password, --password-stdin, or set CURVIATE_LINKEDIN_PASSWORD",
+      failMessage: "no password. Pass --password, --password-stdin, or set CURVIATE_LINKEDIN_PASSWORD",
       prompt: { isTTY: ctx.isTTY, readline: ctx.readline, promptText: "LinkedIn password: " },
       out: ctx.out
     });
@@ -314,7 +314,7 @@ async function buildAuthBody(flags, ctx) {
       readSingleLine: ctx.readSingleLine,
       required: true,
       allowInteractive: !ctx.previewMode,
-      failMessage: "no li_at \u2014 pass --li-at, --li-at-stdin, or set CURVIATE_LINKEDIN_LI_AT",
+      failMessage: "no li_at. Pass --li-at, --li-at-stdin, or set CURVIATE_LINKEDIN_LI_AT",
       out: ctx.out
     });
     const liA = await resolveSecret({
@@ -377,7 +377,7 @@ function printConnected(result, ctx) {
 }
 function printInvalidCodeRetryHint(err, out) {
   const attemptsRemaining = err.attempts_remaining;
-  const message = typeof attemptsRemaining === "number" ? `That code was not accepted \u2014 ${attemptsRemaining} attempt(s) remaining.` : "That code was not accepted \u2014 please try again.";
+  const message = typeof attemptsRemaining === "number" ? `That code was not accepted. ${attemptsRemaining} attempt(s) remaining.` : "That code was not accepted. Please try again.";
   out.stderr.write(`${message}
 `);
 }
@@ -620,7 +620,7 @@ async function runAccountConnectSessionPoll(client, flags, out, io = {}) {
   }
   renderSuccess(outcome.result, outOpts, out);
   out.stderr.write(
-    `Still waiting for the account to connect \u2014 the wait window elapsed. Check again: curviate account connect-session poll --session ${flags.session} --wait
+    `Still waiting for the account to connect. The wait window elapsed. Check again: curviate account connect-session poll --session ${flags.session} --wait
 `
   );
   process.exit(AUTH_NEEDED);
@@ -851,7 +851,7 @@ async function runAccountCheckpointPoll(client, flags, out, io = {}) {
   }
   renderSuccess(outcome.result, outOpts, out);
   out.stderr.write(
-    `Still waiting for approval \u2014 the wait window elapsed. Check again: curviate account checkpoint poll ${accountId} --wait
+    `Still waiting for approval. The wait window elapsed. Check again: curviate account checkpoint poll ${accountId} --wait
 `
   );
   process.exit(AUTH_NEEDED);
@@ -868,7 +868,7 @@ var accountListCommand = defineCommand({
       profile: flags.profile
     });
     if (!cfg.apiKey) {
-      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
+      process.stderr.write("error: no API key, run `curviate login` or pass --api-key.\n");
       process.exit(3);
     }
     const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
@@ -892,7 +892,7 @@ var accountGetCommand = defineCommand({
       profile: flags.profile
     });
     if (!cfg.apiKey) {
-      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
+      process.stderr.write("error: no API key, run `curviate login` or pass --api-key.\n");
       process.exit(3);
     }
     const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
@@ -924,10 +924,10 @@ var accountLinkCommand = defineCommand({
     "proxy-password": { type: "string", description: `Proxy auth password. ${OPTIONAL_SECRET_WARNING("CURVIATE_PROXY_PASSWORD")}` },
     "user-agent": { type: "string", description: "Browser User-Agent to pin for this account." },
     "recruiter-contract-id": { type: "string", description: "Recruiter contract to bind to (Recruiter tier only)." },
-    "account-id": { type: "string", description: "Existing account id (acc_\u2026) to re-authenticate IN PLACE \u2014 passing it makes this an in-place reconnect of that account. Omit to connect a NEW account into --seat-id." },
+    "account-id": { type: "string", description: "Existing account id (acc_\u2026) to re-authenticate IN PLACE. Passing it makes this an in-place reconnect of that account. Omit to connect a NEW account into --seat-id." },
     "no-interactive": {
       type: "boolean",
-      description: "Never prompt for a checkpoint code \u2014 on a checkpoint, always render the envelope and exit 12, even on a TTY.",
+      description: "Never prompt for a checkpoint code. On a checkpoint, always render the envelope and exit 12, even on a TTY.",
       default: false
     }
   },
@@ -940,7 +940,7 @@ var accountLinkCommand = defineCommand({
       profile: flags.profile
     });
     if (!cfg.apiKey) {
-      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
+      process.stderr.write("error: no API key, run `curviate login` or pass --api-key.\n");
       process.exit(3);
     }
     const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
@@ -951,7 +951,7 @@ var accountLinkCommand = defineCommand({
 var accountConnectSessionPollCommand = defineCommand({
   meta: {
     name: "poll",
-    description: "Poll the status of an in-progress connect (auth intent) for completion. Without --wait: a single poll \u2014 the JSON `status` field (pending | resolved | expired | failed) tells you what to do next. With --wait: block on the same adaptive cadence as `account link` until a terminal state."
+    description: "Poll the status of an in-progress connect (auth intent) for completion. Without --wait: a single poll. The JSON `status` field (pending | resolved | expired | failed) tells you what to do next. With --wait: block on the same adaptive cadence as `account link` until a terminal state."
   },
   args: {
     ...WRITE_SINGLE_FLAGS,
@@ -982,7 +982,7 @@ var accountConnectSessionPollCommand = defineCommand({
       profile: flags.profile
     });
     if (!cfg.apiKey) {
-      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
+      process.stderr.write("error: no API key, run `curviate login` or pass --api-key.\n");
       process.exit(3);
     }
     const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
@@ -1004,7 +1004,7 @@ var accountUpdateCommand = defineCommand({
   args: {
     ...WRITE_SINGLE_FLAGS,
     "account-id": { type: "positional", description: "Account id (acc_\u2026)." },
-    metadata: { type: "string", description: `Custom metadata as a JSON object (flat string\u2192string map) \u2014 replaces the store wholesale. Example: '{"team":"growth"}'.` },
+    metadata: { type: "string", description: `Custom metadata as a JSON object (flat string\u2192string map). Replaces the store wholesale. Example: '{"team":"growth"}'.` },
     "clear-proxy": { type: "boolean", description: "Clear the custom proxy (revert to automatic proxy protection). Mutually exclusive with --proxy-host.", default: false },
     "proxy-protocol": { type: "string", description: "Proxy protocol: http | https | socks5." },
     "proxy-host": { type: "string", description: "Proxy host or IP." },
@@ -1021,7 +1021,7 @@ var accountUpdateCommand = defineCommand({
       profile: flags.profile
     });
     if (!cfg.apiKey) {
-      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
+      process.stderr.write("error: no API key, run `curviate login` or pass --api-key.\n");
       process.exit(3);
     }
     const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
@@ -1044,7 +1044,7 @@ var accountDisconnectCommand = defineCommand({
       profile: flags.profile
     });
     if (!cfg.apiKey) {
-      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
+      process.stderr.write("error: no API key, run `curviate login` or pass --api-key.\n");
       process.exit(3);
     }
     const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
@@ -1075,7 +1075,7 @@ var accountCheckpointSolveCommand = defineCommand({
       profile: flags.profile
     });
     if (!cfg.apiKey) {
-      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
+      process.stderr.write("error: no API key, run `curviate login` or pass --api-key.\n");
       process.exit(3);
     }
     const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
@@ -1105,7 +1105,7 @@ var accountCheckpointPollCommand = defineCommand({
     // --timeout`. Default: the time remaining to the checkpoint's own expiry.
     timeout: {
       type: "string",
-      description: "Wait-loop timeout in milliseconds (requires --wait; default: time remaining to the checkpoint's expiry). Note the unit: this is milliseconds \u2014 `inbox sync-chat --timeout` is seconds."
+      description: "Wait-loop timeout in milliseconds (requires --wait; default: time remaining to the checkpoint's expiry). Note the unit: this is milliseconds; `inbox sync-chat --timeout` is seconds."
     }
   },
   async run({ args }) {
@@ -1116,7 +1116,7 @@ var accountCheckpointPollCommand = defineCommand({
       profile: flags.profile
     });
     if (!cfg.apiKey) {
-      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
+      process.stderr.write("error: no API key, run `curviate login` or pass --api-key.\n");
       process.exit(3);
     }
     const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
@@ -1127,7 +1127,7 @@ var accountCheckpointPollCommand = defineCommand({
 var accountCheckpointRequestCommand = defineCommand({
   meta: {
     name: "request",
-    description: "Re-request the challenge notification for a pending checkpoint (e.g. re-send an OTP email, SMS code, or mobile-app approval push). Not every challenge type supports it \u2014 an authenticator- app code has nothing to re-send. The response's `resent` boolean tells you honestly whether a new notification actually went out; the command still exits 0 either way."
+    description: "Re-request the challenge notification for a pending checkpoint (e.g. re-send an OTP email, SMS code, or mobile-app approval push). Not every challenge type supports it; an authenticator- app code has nothing to re-send. The response's `resent` boolean tells you honestly whether a new notification actually went out; the command still exits 0 either way."
   },
   args: {
     ...WRITE_SINGLE_FLAGS,
@@ -1145,7 +1145,7 @@ var accountCheckpointRequestCommand = defineCommand({
       profile: flags.profile
     });
     if (!cfg.apiKey) {
-      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
+      process.stderr.write("error: no API key, run `curviate login` or pass --api-key.\n");
       process.exit(3);
     }
     const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });

package/dist/{chunk-TMU3CSPR.js → chunk-DW2HCRXJ.js}

@@ -87,7 +87,7 @@ async function renameProfile(oldName, newName) {
   }
   if (cfg.profiles[newName]) {
     throw new Error(
-      `Profile "${newName}" already exists \u2014 remove it first or choose another name.`
+      `Profile "${newName}" already exists. Remove it first or choose another name.`
     );
   }
   cfg.profiles[newName] = cfg.profiles[oldName];

package/dist/{chunk-M33MI53G.js → chunk-HDQUEFD2.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   readConfig
-} from "./chunk-TMU3CSPR.js";
+} from "./chunk-DW2HCRXJ.js";
 
 // src/lib/resolve.ts
 var DEFAULT_BASE_URL = "https://api.curviate.com";

package/dist/chunk-HOQ7EUHJ.js

@@ -0,0 +1,50 @@
+#!/usr/bin/env node
+
+// src/lib/bare-form-guard.ts
+var COMMAND_WORD_RE = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
+function looksLikeCommandWord(token) {
+  return COMMAND_WORD_RE.test(token);
+}
+function editDistance(a, b) {
+  const m = a.length;
+  const n = b.length;
+  if (m === 0) return n;
+  if (n === 0) return m;
+  const d = Array.from({ length: m + 1 }, () => new Array(n + 1).fill(0));
+  for (let i = 0; i <= m; i++) d[i][0] = i;
+  for (let j = 0; j <= n; j++) d[0][j] = j;
+  for (let i = 1; i <= m; i++) {
+    for (let j = 1; j <= n; j++) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+      let best = Math.min(
+        d[i - 1][j] + 1,
+        // deletion
+        d[i][j - 1] + 1,
+        // insertion
+        d[i - 1][j - 1] + cost
+        // substitution
+      );
+      if (i > 1 && j > 1 && a[i - 1] === b[j - 2] && a[i - 2] === b[j - 1]) {
+        best = Math.min(best, d[i - 2][j - 2] + 1);
+      }
+      d[i][j] = best;
+    }
+  }
+  return d[m][n];
+}
+function nearestSubcommand(token, subcommandNames) {
+  let best = null;
+  for (const name of subcommandNames) {
+    const threshold = name.length < 6 ? 1 : 2;
+    const isPrefix = token.length >= 2 && token.length < name.length && name.startsWith(token);
+    const distance = isPrefix ? 1 : editDistance(token, name);
+    if (distance > threshold) continue;
+    if (best === null || distance < best.distance) best = { name, distance };
+  }
+  return best?.name ?? null;
+}
+
+export {
+  looksLikeCommandWord,
+  nearestSubcommand
+};

package/dist/{chunk-KVV6LZ7E.js → chunk-IGCQNDIG.js}

@@ -1,4 +1,8 @@
 #!/usr/bin/env node
+import {
+  looksLikeCommandWord,
+  nearestSubcommand
+} from "./chunk-HOQ7EUHJ.js";
 import {
   resolveTextOrStdin
 } from "./chunk-U7Y4EXHT.js";
@@ -24,11 +28,11 @@ import {
   renderSuccess,
   renderUnexpectedError,
   resolveEffectiveConfig
-} from "./chunk-M33MI53G.js";
+} from "./chunk-HDQUEFD2.js";
 import {
   READ_SINGLE_FLAGS,
   WRITE_FLAGS
-} from "./chunk-TMU3CSPR.js";
+} from "./chunk-DW2HCRXJ.js";
 
 // src/commands/message.ts
 import { defineCommand } from "citty";
@@ -267,7 +271,7 @@ async function runMessageReact(client, flags, out) {
   const messageId = flags.messageId ?? "";
   const reaction = flags.emoji ?? flags.emojiAlias ?? "";
   if (!reaction) {
-    out.stderr.write("error: a reaction is required \u2014 pass it as `message react <chat_id> <message_id> <emoji>` (or --emoji <e>).\n");
+    out.stderr.write("error: a reaction is required. Pass it as `message react <chat_id> <message_id> <emoji>` (or --emoji <e>).\n");
     process.exit(2);
     return;
   }
@@ -402,7 +406,7 @@ var messageNewCommand = defineCommand({
       profile: flags.profile
     });
     if (!cfg.apiKey) {
-      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
+      process.stderr.write("error: no API key, run `curviate login` or pass --api-key.\n");
       process.exit(3);
     }
     const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
@@ -428,7 +432,7 @@ var messageGetCommand = defineCommand({
       profile: flags.profile
     });
     if (!cfg.apiKey) {
-      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
+      process.stderr.write("error: no API key, run `curviate login` or pass --api-key.\n");
       process.exit(3);
     }
     const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
@@ -455,7 +459,7 @@ var messageEditCommand = defineCommand({
       profile: flags.profile
     });
     if (!cfg.apiKey) {
-      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
+      process.stderr.write("error: no API key, run `curviate login` or pass --api-key.\n");
       process.exit(3);
     }
     const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
@@ -481,7 +485,7 @@ var messageDeleteCommand = defineCommand({
       profile: flags.profile
     });
     if (!cfg.apiKey) {
-      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
+      process.stderr.write("error: no API key, run `curviate login` or pass --api-key.\n");
       process.exit(3);
     }
     const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
@@ -513,7 +517,7 @@ var messageReactCommand = defineCommand({
       profile: flags.profile
     });
     if (!cfg.apiKey) {
-      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
+      process.stderr.write("error: no API key, run `curviate login` or pass --api-key.\n");
       process.exit(3);
     }
     const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
@@ -541,7 +545,7 @@ var messageAttachmentCommand = defineCommand({
       profile: flags.profile
     });
     if (!cfg.apiKey) {
-      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
+      process.stderr.write("error: no API key, run `curviate login` or pass --api-key.\n");
       process.exit(3);
     }
     const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
@@ -577,7 +581,7 @@ var messageInMailCommand = defineCommand({
       profile: flags.profile
     });
     if (!cfg.apiKey) {
-      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
+      process.stderr.write("error: no API key, run `curviate login` or pass --api-key.\n");
       process.exit(3);
     }
     const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
@@ -610,7 +614,7 @@ var messageSendCommand = defineCommand({
       profile: flags.profile
     });
     if (!cfg.apiKey) {
-      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
+      process.stderr.write("error: no API key, run `curviate login` or pass --api-key.\n");
       process.exit(3);
     }
     const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
@@ -634,7 +638,7 @@ var messageInMailBalanceCommand = defineCommand({
       profile: flags.profile
     });
     if (!cfg.apiKey) {
-      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
+      process.stderr.write("error: no API key, run `curviate login` or pass --api-key.\n");
       process.exit(3);
     }
     const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
@@ -642,6 +646,38 @@ var messageInMailBalanceCommand = defineCommand({
     await runMessageInMailBalance(client, { ...flags, account: flags.account ?? cfg.account }, out);
   }
 });
+var MESSAGE_SUBCOMMANDS = [
+  "new",
+  "send",
+  "get",
+  "edit",
+  "delete",
+  "react",
+  "attachment",
+  "inmail",
+  "inmail-balance"
+];
+var MESSAGE_USAGE = 'Usage: curviate message new --to <attendee> "<text>" [--attach <file>\u2026]\n       curviate message send <chat_id> "<text>" [--attach <file>\u2026]\n       curviate message <chat_id> "<text>" [--attach <file>\u2026]\n       curviate message get <chat_id> <message_id>\n       curviate message edit <chat_id> <message_id> "<text>"\n       curviate message delete <chat_id> <message_id>\n       curviate message react <chat_id> <message_id> <emoji>\n       curviate message attachment <chat_id> <message_id> <attachment_id> [-o <file>]\n       curviate message inmail --to <id> --subject <s> "<text>"\n       curviate message inmail-balance\n';
+function guardBareMessageForm(chatId, out) {
+  if (!looksLikeCommandWord(chatId)) return;
+  const suggestion = nearestSubcommand(chatId, [...MESSAGE_SUBCOMMANDS]);
+  out.stderr.write(
+    `error: \`${chatId}\` is not a curviate message subcommand, and it is not a chat id (a chat id looks like 2-\u2026 or COMPANY_\u2026, or a linkedin.com/messaging/thread/\u2026 URL).
+`
+  );
+  if (suggestion) {
+    out.stderr.write(`hint: did you mean \`curviate message ${suggestion}\`?
+`);
+  } else if (chatId === "search") {
+    out.stderr.write("hint: to search your messages, use `curviate inbox search`.\n");
+  }
+  out.stderr.write(
+    `hint: to send to a chat id this check does not recognise, name the action explicitly: curviate message send <chat_id> "<text>".
+`
+  );
+  out.stderr.write(MESSAGE_USAGE);
+  process.exit(2);
+}
 var messageCommand = defineCommand({
   meta: {
     name: "message",
@@ -671,12 +707,12 @@ var messageCommand = defineCommand({
   },
   async run({ args }) {
     const flags = args;
+    const out = buildOutputStreams();
     if (!flags.chatId) {
-      process.stderr.write(
-        'Usage: curviate message new --to <attendee> "<text>" [--attach <file>\u2026]\n       curviate message <chat_id> "<text>" [--attach <file>\u2026]\n       curviate message get <chat_id> <message_id>\n       curviate message edit <chat_id> <message_id> "<text>"\n       curviate message delete <chat_id> <message_id>\n       curviate message react <chat_id> <message_id> <emoji>\n       curviate message attachment <chat_id> <message_id> <attachment_id> [-o <file>]\n       curviate message inmail --to <id> --subject <s> "<text>"\n       curviate message inmail-balance\n'
-      );
+      out.stderr.write(MESSAGE_USAGE);
       process.exit(2);
     }
+    guardBareMessageForm(normalizeChatId(flags.chatId), out);
     const cfg = await resolveEffectiveConfig({
       apiKey: flags["api-key"],
       baseUrl: flags["base-url"],
@@ -685,11 +721,10 @@ var messageCommand = defineCommand({
       profile: flags.profile
     });
     if (!cfg.apiKey) {
-      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
+      out.stderr.write("error: no API key, run `curviate login` or pass --api-key.\n");
       process.exit(3);
     }
     const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
-    const out = buildOutputStreams();
     await runMessageSend(client, { ...flags, account: flags.account ?? cfg.account }, out);
   }
 });
@@ -706,5 +741,6 @@ export {
   runMessageAttachment,
   runMessageInMail,
   runMessageInMailBalance,
+  guardBareMessageForm,
   messageCommand
 };