@curviate/cli 0.19.0 → 0.21.0

package/CHANGELOG.md

@@ -8,6 +8,139 @@ a new command or flag is a minor; a breaking command/flag/exit-code change is a
 
 ## [Unreleased]
 
+## [0.21.0] - 2026-08-04
+
+A correctness release for every argument that reads from stdin. Upgrade
+immediately if you are on 0.20.0: on that version the documented quick-start
+login silently stored a placeholder instead of your API key, so the very first
+command after it failed and blamed your key.
+
+### Fixed
+
+- **`curviate login --api-key -` now stores the piped key.** It previously
+  reported success and exited 0 while writing the literal string
+  `__curviate_stdin__` into your config, so every later command answered 401 and
+  attributed the failure to your API key. That is the first command in the
+  quick-start, so a new install failed on first contact with a misleading cause.
+
+- **Eleven further arguments documented as accepting `-` now read stdin.** Each
+  compared its raw value against `-`, but the dispatcher had already substituted
+  an internal placeholder by that point, so the branch was unreachable and the
+  placeholder was consumed as your data. Affected: `--filters` on the eight
+  search and list commands, and `--body` on the three recruiter and webhook
+  commands, which answered `--filters is not valid JSON` or
+  `--body only accepts '-'` to a caller who had passed exactly that.
+
+### Changed
+
+- **A bare `-` is only special on an argument that declares a stdin contract.**
+  Every other argument now receives a literal `-`, restored between the parser
+  and the handler. Previously the substitution was indiscriminate, so a bare `-`
+  became the internal placeholder at any argument, including places where it
+  then travelled to the wire as a value. If you were relying on `-` being read
+  from stdin on an argument whose help text does not describe that behaviour, it
+  no longer is; the arguments that document the contract are unchanged.
+
+- **The internal placeholder can no longer leave the process.** The request
+  transport and the config writer both refuse it as a defence in depth backstop,
+  and report what to do instead, so no future argument can leak it into a
+  request or a config file.
+
+## [0.20.0] - 2026-08-03
+
+A safety and correctness release. Upgrade promptly: it closes a path by which a
+mistyped command sent a message, and it is the first release in which
+`curviate webhook verify` works at all.
+
+### Fixed
+
+- **An unknown subcommand under `message` no longer becomes a send.**
+  `curviate message search "sophie"` did not error. `message` accepts both
+  subcommands and a bare `message <chat_id> "<text>"` form, and an unregistered
+  first token fell through to the bare form, so it bound `chatId="search"`,
+  `text="sophie"` and **sent a message**. That applied to any unknown or
+  mistyped subcommand: with `search` it 404s, but with a real chat id in that
+  position, or a paste that lands one there, it messaged a real person.
+
+  An unknown subcommand now exits 2 with usage and issues **no request at all**.
+  The legitimate `curviate message <chat_id> "<text>"` form is unchanged, and
+  `curviate message send <chat_id> "<text>"` is always available for a chat id
+  the check does not recognise.
+
+  To search your messages, the command is `curviate inbox search`.
+
+- **A mistyped `connect` subcommand no longer sends a connection invitation.**
+  Same shape: `curviate connect <id>` sends an invitation, so `connect snet`
+  (for `sent`) invited whoever owns the slug `snet`. A first argument that is a
+  near-miss of a `connect` subcommand is now refused with a suggestion. If the
+  slug really was intended, pass the full profile URL or the provider id.
+
+- **`curviate webhook verify` now verifies real deliveries.** It inherited a
+  defect from `@curviate/sdk`: the platform sends the event name in `event` and
+  the SDK required a `type` field no delivery has ever carried, so verification
+  failed on 100% of genuine webhooks and reported `malformed_header`, pointing
+  at the header and the secret when both were correct. Fixed by the `@curviate/sdk`
+  0.19.0 dependency bump. A body that verifies but cannot be parsed now reports
+  `malformed_payload`.
+
+- **`webhook verify --body` accepts the raw body inline, as a file path, or on
+  stdin.** Every documented invocation failed before this: the flag value was
+  handed straight to the filesystem, so inline JSON was opened as a filename
+  (`ENOENT`/`ENAMETOOLONG`), and `--body -` opened the internal placeholder the
+  argument parser substitutes for a bare dash. Only a file path ever worked, and
+  the failure surfaced as exit `1` with a raw filesystem error rather than a
+  usage error. A body is now recognised by its leading `{`, `-` reads stdin on
+  every platform, and anything unreadable exits `2` naming all three accepted
+  forms. A trailing newline added by a shell redirect, `curl -o`, or an editor
+  save is ignored; newlines inside the body are preserved.
+
+- **`webhook verify --help` named the wrong signature header.** It said
+  `X-Curviate-Signature`; the platform sends `Curviate-Signature`, so a reader
+  who copied the name read for a header that is never present. The same help
+  also claimed `--header` falls back to stdin, which it never did. Both flags
+  are now marked required, so omitting one is a usage error instead of a
+  signature failure that points at a secret which was never wrong.
+
+- **`group list` help said `--profile`; the flag is `--target`.** `--profile` is
+  the global config-profile selector, so following the help text selected a
+  config profile and silently returned your own groups instead of the target
+  member's.
+
+- **`job publish` and `recruiter job publish` help said `--budget-*`.** The glob
+  is not a flag anyone can type; the help now names `--budget-amount`,
+  `--budget-currency`, and `--budget-scope`.
+
+- **Em dashes removed from all CLI output** (error messages, help text, usage
+  blocks), including the `no API key` error.
+
+### Changed
+
+- `@curviate/sdk` dependency bumped to `^0.19.0`. If you also call the SDK
+  directly, note that its webhook event discriminant moved from `event.type` to
+  `event.event`; see the SDK's 0.19.0 changelog.
+
+### Added
+
+- Two mechanical guards in the test suite, both derived from the live command
+  tree rather than a hand-maintained list, so this class of defect cannot
+  quietly return:
+  - a fall-through audit that forces an explicit safe/read-only/write-bearing
+    verdict on every command group that mixes subcommands with a positional
+    fallback, and
+  - a help-vs-args check that fails when any command's help text names a flag
+    that command does not declare (resolving cross-references, so a reference
+    to another command's flag is checked against that command).
+
+- Two further mechanical guards, in the same spirit:
+  - an em-dash check that walks the TypeScript syntax tree, so it inspects
+    string and template literals only and leaves comments exempt structurally
+    rather than by a fragile line-based heuristic, and
+  - a pre-publish binary gate that runs every documented `webhook verify --body`
+    form against a recorded delivery: the exact body bytes and the exact
+    signature header the platform put on the wire, replayed verbatim and never
+    re-signed. Tampering with a single field is still rejected, so the gate
+    proves the verdict as well as the plumbing.
+
 ## [0.19.0] - 2026-07-29
 
 A minor release closing the remaining SDK-parity gap: 25 new commands across seven

package/dist/{account-EGJJNBXW.js → account-A3FOYUKC.js}

@@ -5,9 +5,6 @@ import {
 import {
   AUTH_NEEDED
 } from "./chunk-M6UDWFHX.js";
-import {
-  defaultReadStdin
-} from "./chunk-U7Y4EXHT.js";
 import {
   slimAccountGet,
   slimAccountList,
@@ -26,12 +23,15 @@ import {
   renderSuccess,
   renderUnexpectedError,
   resolveEffectiveConfig
-} from "./chunk-M33MI53G.js";
+} from "./chunk-LMVDURUZ.js";
 import {
   GLOBAL_FLAGS,
   READ_SINGLE_FLAGS,
   WRITE_SINGLE_FLAGS
-} from "./chunk-TMU3CSPR.js";
+} from "./chunk-CUTMZWL6.js";
+import {
+  defaultReadStdin
+} from "./chunk-ZYURL5VK.js";
 
 // src/commands/account.ts
 import { defineCommand } from "citty";
@@ -90,15 +90,15 @@ function checkCredentialConflicts(flags, out) {
   const passwordStdin = flags["password-stdin"] ?? false;
   const liAtStdin = flags["li-at-stdin"] ?? false;
   if (flags.password !== void 0 && passwordStdin) {
-    failConflict(out, "--password and --password-stdin cannot both be set \u2014 choose one source.");
+    failConflict(out, "--password and --password-stdin cannot both be set. Choose one source.");
   }
   if (flags["li-at"] !== void 0 && liAtStdin) {
-    failConflict(out, "--li-at and --li-at-stdin cannot both be set \u2014 choose one source.");
+    failConflict(out, "--li-at and --li-at-stdin cannot both be set. Choose one source.");
   }
   if (passwordStdin && liAtStdin) {
     failConflict(
       out,
-      "--password-stdin and --li-at-stdin cannot both be set \u2014 stdin can feed only one secret per invocation."
+      "--password-stdin and --li-at-stdin cannot both be set. stdin can feed only one secret per invocation."
     );
   }
   if (liAtStdin && flags["auth-method"] === "credentials") {
@@ -164,7 +164,7 @@ function challengeDescription(type) {
     case "two_factor_app":
       return "Enter the current code from your authenticator app.";
     case "mobile_app_approval":
-      return "Open your LinkedIn mobile app and approve this sign-in \u2014 this will continue automatically once you tap approve.";
+      return "Open your LinkedIn mobile app and approve this sign-in. This will continue automatically once you tap approve.";
   }
 }
 function printChallengeCopy(type, out) {
@@ -293,7 +293,7 @@ async function buildAuthBody(flags, ctx) {
       // of --email — an email-less body still fails downstream validation,
       // as expected, rather than the flag being silently ignored.
       allowInteractiveStdinRead: !ctx.previewMode,
-      failMessage: "no password \u2014 pass --password, --password-stdin, or set CURVIATE_LINKEDIN_PASSWORD",
+      failMessage: "no password. Pass --password, --password-stdin, or set CURVIATE_LINKEDIN_PASSWORD",
       prompt: { isTTY: ctx.isTTY, readline: ctx.readline, promptText: "LinkedIn password: " },
       out: ctx.out
     });
@@ -314,7 +314,7 @@ async function buildAuthBody(flags, ctx) {
       readSingleLine: ctx.readSingleLine,
       required: true,
       allowInteractive: !ctx.previewMode,
-      failMessage: "no li_at \u2014 pass --li-at, --li-at-stdin, or set CURVIATE_LINKEDIN_LI_AT",
+      failMessage: "no li_at. Pass --li-at, --li-at-stdin, or set CURVIATE_LINKEDIN_LI_AT",
       out: ctx.out
     });
     const liA = await resolveSecret({
@@ -377,7 +377,7 @@ function printConnected(result, ctx) {
 }
 function printInvalidCodeRetryHint(err, out) {
   const attemptsRemaining = err.attempts_remaining;
-  const message = typeof attemptsRemaining === "number" ? `That code was not accepted \u2014 ${attemptsRemaining} attempt(s) remaining.` : "That code was not accepted \u2014 please try again.";
+  const message = typeof attemptsRemaining === "number" ? `That code was not accepted. ${attemptsRemaining} attempt(s) remaining.` : "That code was not accepted. Please try again.";
   out.stderr.write(`${message}
 `);
 }
@@ -620,7 +620,7 @@ async function runAccountConnectSessionPoll(client, flags, out, io = {}) {
   }
   renderSuccess(outcome.result, outOpts, out);
   out.stderr.write(
-    `Still waiting for the account to connect \u2014 the wait window elapsed. Check again: curviate account connect-session poll --session ${flags.session} --wait
+    `Still waiting for the account to connect. The wait window elapsed. Check again: curviate account connect-session poll --session ${flags.session} --wait
 `
   );
   process.exit(AUTH_NEEDED);
@@ -851,7 +851,7 @@ async function runAccountCheckpointPoll(client, flags, out, io = {}) {
   }
   renderSuccess(outcome.result, outOpts, out);
   out.stderr.write(
-    `Still waiting for approval \u2014 the wait window elapsed. Check again: curviate account checkpoint poll ${accountId} --wait
+    `Still waiting for approval. The wait window elapsed. Check again: curviate account checkpoint poll ${accountId} --wait
 `
   );
   process.exit(AUTH_NEEDED);
@@ -868,7 +868,7 @@ var accountListCommand = defineCommand({
       profile: flags.profile
     });
     if (!cfg.apiKey) {
-      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
+      process.stderr.write("error: no API key, run `curviate login` or pass --api-key.\n");
       process.exit(3);
     }
     const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
@@ -892,7 +892,7 @@ var accountGetCommand = defineCommand({
       profile: flags.profile
     });
     if (!cfg.apiKey) {
-      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
+      process.stderr.write("error: no API key, run `curviate login` or pass --api-key.\n");
       process.exit(3);
     }
     const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
@@ -924,10 +924,10 @@ var accountLinkCommand = defineCommand({
     "proxy-password": { type: "string", description: `Proxy auth password. ${OPTIONAL_SECRET_WARNING("CURVIATE_PROXY_PASSWORD")}` },
     "user-agent": { type: "string", description: "Browser User-Agent to pin for this account." },
     "recruiter-contract-id": { type: "string", description: "Recruiter contract to bind to (Recruiter tier only)." },
-    "account-id": { type: "string", description: "Existing account id (acc_\u2026) to re-authenticate IN PLACE \u2014 passing it makes this an in-place reconnect of that account. Omit to connect a NEW account into --seat-id." },
+    "account-id": { type: "string", description: "Existing account id (acc_\u2026) to re-authenticate IN PLACE. Passing it makes this an in-place reconnect of that account. Omit to connect a NEW account into --seat-id." },
     "no-interactive": {
       type: "boolean",
-      description: "Never prompt for a checkpoint code \u2014 on a checkpoint, always render the envelope and exit 12, even on a TTY.",
+      description: "Never prompt for a checkpoint code. On a checkpoint, always render the envelope and exit 12, even on a TTY.",
       default: false
     }
   },
@@ -940,7 +940,7 @@ var accountLinkCommand = defineCommand({
       profile: flags.profile
     });
     if (!cfg.apiKey) {
-      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
+      process.stderr.write("error: no API key, run `curviate login` or pass --api-key.\n");
       process.exit(3);
     }
     const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
@@ -951,7 +951,7 @@ var accountLinkCommand = defineCommand({
 var accountConnectSessionPollCommand = defineCommand({
   meta: {
     name: "poll",
-    description: "Poll the status of an in-progress connect (auth intent) for completion. Without --wait: a single poll \u2014 the JSON `status` field (pending | resolved | expired | failed) tells you what to do next. With --wait: block on the same adaptive cadence as `account link` until a terminal state."
+    description: "Poll the status of an in-progress connect (auth intent) for completion. Without --wait: a single poll. The JSON `status` field (pending | resolved | expired | failed) tells you what to do next. With --wait: block on the same adaptive cadence as `account link` until a terminal state."
   },
   args: {
     ...WRITE_SINGLE_FLAGS,
@@ -982,7 +982,7 @@ var accountConnectSessionPollCommand = defineCommand({
       profile: flags.profile
     });
     if (!cfg.apiKey) {
-      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
+      process.stderr.write("error: no API key, run `curviate login` or pass --api-key.\n");
       process.exit(3);
     }
     const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
@@ -1004,7 +1004,7 @@ var accountUpdateCommand = defineCommand({
   args: {
     ...WRITE_SINGLE_FLAGS,
     "account-id": { type: "positional", description: "Account id (acc_\u2026)." },
-    metadata: { type: "string", description: `Custom metadata as a JSON object (flat string\u2192string map) \u2014 replaces the store wholesale. Example: '{"team":"growth"}'.` },
+    metadata: { type: "string", description: `Custom metadata as a JSON object (flat string\u2192string map). Replaces the store wholesale. Example: '{"team":"growth"}'.` },
     "clear-proxy": { type: "boolean", description: "Clear the custom proxy (revert to automatic proxy protection). Mutually exclusive with --proxy-host.", default: false },
     "proxy-protocol": { type: "string", description: "Proxy protocol: http | https | socks5." },
     "proxy-host": { type: "string", description: "Proxy host or IP." },
@@ -1021,7 +1021,7 @@ var accountUpdateCommand = defineCommand({
       profile: flags.profile
     });
     if (!cfg.apiKey) {
-      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
+      process.stderr.write("error: no API key, run `curviate login` or pass --api-key.\n");
       process.exit(3);
     }
     const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
@@ -1044,7 +1044,7 @@ var accountDisconnectCommand = defineCommand({
       profile: flags.profile
     });
     if (!cfg.apiKey) {
-      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
+      process.stderr.write("error: no API key, run `curviate login` or pass --api-key.\n");
       process.exit(3);
     }
     const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
@@ -1075,7 +1075,7 @@ var accountCheckpointSolveCommand = defineCommand({
       profile: flags.profile
     });
     if (!cfg.apiKey) {
-      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
+      process.stderr.write("error: no API key, run `curviate login` or pass --api-key.\n");
       process.exit(3);
     }
     const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
@@ -1105,7 +1105,7 @@ var accountCheckpointPollCommand = defineCommand({
     // --timeout`. Default: the time remaining to the checkpoint's own expiry.
     timeout: {
       type: "string",
-      description: "Wait-loop timeout in milliseconds (requires --wait; default: time remaining to the checkpoint's expiry). Note the unit: this is milliseconds \u2014 `inbox sync-chat --timeout` is seconds."
+      description: "Wait-loop timeout in milliseconds (requires --wait; default: time remaining to the checkpoint's expiry). Note the unit: this is milliseconds; `inbox sync-chat --timeout` is seconds."
     }
   },
   async run({ args }) {
@@ -1116,7 +1116,7 @@ var accountCheckpointPollCommand = defineCommand({
       profile: flags.profile
     });
     if (!cfg.apiKey) {
-      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
+      process.stderr.write("error: no API key, run `curviate login` or pass --api-key.\n");
       process.exit(3);
     }
     const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });
@@ -1127,7 +1127,7 @@ var accountCheckpointPollCommand = defineCommand({
 var accountCheckpointRequestCommand = defineCommand({
   meta: {
     name: "request",
-    description: "Re-request the challenge notification for a pending checkpoint (e.g. re-send an OTP email, SMS code, or mobile-app approval push). Not every challenge type supports it \u2014 an authenticator- app code has nothing to re-send. The response's `resent` boolean tells you honestly whether a new notification actually went out; the command still exits 0 either way."
+    description: "Re-request the challenge notification for a pending checkpoint (e.g. re-send an OTP email, SMS code, or mobile-app approval push). Not every challenge type supports it; an authenticator- app code has nothing to re-send. The response's `resent` boolean tells you honestly whether a new notification actually went out; the command still exits 0 either way."
   },
   args: {
     ...WRITE_SINGLE_FLAGS,
@@ -1145,7 +1145,7 @@ var accountCheckpointRequestCommand = defineCommand({
       profile: flags.profile
     });
     if (!cfg.apiKey) {
-      process.stderr.write("error: no API key \u2014 run `curviate login` or pass --api-key.\n");
+      process.stderr.write("error: no API key, run `curviate login` or pass --api-key.\n");
       process.exit(3);
     }
     const client = createClient({ apiKey: cfg.apiKey, baseUrl: cfg.baseUrl, timeout: cfg.timeout });

package/dist/{chunk-42VUUKQ3.js → chunk-56ORAZJO.js}

@@ -1,4 +1,7 @@
 #!/usr/bin/env node
+import {
+  isStdinToken
+} from "./chunk-ZYURL5VK.js";
 
 // src/lib/search-filters.ts
 import { readFile } from "fs/promises";
@@ -23,7 +26,7 @@ async function assembleFilters(flags, readers = DEFAULT_FILTER_READERS) {
     } catch {
       return { error: `cannot read ${source}` };
     }
-  } else if (flags.filters === "-") {
+  } else if (isStdinToken(flags.filters)) {
     source = "--filters - (stdin)";
     raw = await readers.readStdin();
   } else if (flags.filters !== void 0) {

package/dist/{chunk-TMU3CSPR.js → chunk-CUTMZWL6.js}

@@ -1,4 +1,7 @@
 #!/usr/bin/env node
+import {
+  assertNoStdinPlaceholder
+} from "./chunk-ZYURL5VK.js";
 
 // src/lib/config.ts
 import {
@@ -37,6 +40,7 @@ async function writeConfig(cfg) {
   } catch {
   }
   const content = JSON.stringify(cfg, null, 2) + "\n";
+  assertNoStdinPlaceholder("the configuration about to be written", [content]);
   const tmpPath = join(
     tmpdir(),
     `curviate-cfg-${randomBytes(6).toString("hex")}.tmp`
@@ -87,7 +91,7 @@ async function renameProfile(oldName, newName) {
   }
   if (cfg.profiles[newName]) {
     throw new Error(
-      `Profile "${newName}" already exists \u2014 remove it first or choose another name.`
+      `Profile "${newName}" already exists. Remove it first or choose another name.`
     );
   }
   cfg.profiles[newName] = cfg.profiles[oldName];

package/dist/chunk-HOQ7EUHJ.js

@@ -0,0 +1,50 @@
+#!/usr/bin/env node
+
+// src/lib/bare-form-guard.ts
+var COMMAND_WORD_RE = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
+function looksLikeCommandWord(token) {
+  return COMMAND_WORD_RE.test(token);
+}
+function editDistance(a, b) {
+  const m = a.length;
+  const n = b.length;
+  if (m === 0) return n;
+  if (n === 0) return m;
+  const d = Array.from({ length: m + 1 }, () => new Array(n + 1).fill(0));
+  for (let i = 0; i <= m; i++) d[i][0] = i;
+  for (let j = 0; j <= n; j++) d[0][j] = j;
+  for (let i = 1; i <= m; i++) {
+    for (let j = 1; j <= n; j++) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+      let best = Math.min(
+        d[i - 1][j] + 1,
+        // deletion
+        d[i][j - 1] + 1,
+        // insertion
+        d[i - 1][j - 1] + cost
+        // substitution
+      );
+      if (i > 1 && j > 1 && a[i - 1] === b[j - 2] && a[i - 2] === b[j - 1]) {
+        best = Math.min(best, d[i - 2][j - 2] + 1);
+      }
+      d[i][j] = best;
+    }
+  }
+  return d[m][n];
+}
+function nearestSubcommand(token, subcommandNames) {
+  let best = null;
+  for (const name of subcommandNames) {
+    const threshold = name.length < 6 ? 1 : 2;
+    const isPrefix = token.length >= 2 && token.length < name.length && name.startsWith(token);
+    const distance = isPrefix ? 1 : editDistance(token, name);
+    if (distance > threshold) continue;
+    if (best === null || distance < best.distance) best = { name, distance };
+  }
+  return best?.name ?? null;
+}
+
+export {
+  looksLikeCommandWord,
+  nearestSubcommand
+};

package/dist/{chunk-M33MI53G.js → chunk-LMVDURUZ.js}

@@ -1,7 +1,10 @@
 #!/usr/bin/env node
 import {
   readConfig
-} from "./chunk-TMU3CSPR.js";
+} from "./chunk-CUTMZWL6.js";
+import {
+  assertNoStdinPlaceholder
+} from "./chunk-ZYURL5VK.js";
 
 // src/lib/resolve.ts
 var DEFAULT_BASE_URL = "https://api.curviate.com";
@@ -20,9 +23,28 @@ async function resolveEffectiveConfig(flags) {
 
 // src/lib/client.ts
 import { Curviate } from "@curviate/sdk";
+function headerStrings(headers) {
+  if (!headers) return [];
+  if (headers instanceof Headers) {
+    const out = [];
+    headers.forEach((value, key) => out.push(key, value));
+    return out;
+  }
+  if (Array.isArray(headers)) return headers.flat().map(String);
+  return Object.entries(headers).flat().map(String);
+}
+var guardedFetch = (input, init) => {
+  assertNoStdinPlaceholder("the request about to be sent", [
+    String(input instanceof Request ? input.url : input),
+    ...headerStrings(init?.headers),
+    typeof init?.body === "string" ? init.body : void 0
+  ]);
+  return fetch(input, init);
+};
 function createClient(config) {
   return new Curviate({
     apiKey: config.apiKey.trim(),
+    fetch: guardedFetch,
     ...config.baseUrl !== void 0 ? { baseUrl: config.baseUrl } : {},
     ...config.timeout !== void 0 ? { timeout: config.timeout } : {}
   });