@curviate/cli 0.22.0 → 0.23.1

package/CHANGELOG.md

@@ -6,7 +6,91 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 Versioning follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html):
 a new command or flag is a minor; a breaking command/flag/exit-code change is a major; a fix is a patch.
 
-## [Unreleased]
+## [0.23.1] - 2026-08-10
+
+### Fixed
+
+- **A global flag placed before the subcommand was rejected, and any flag
+  value beginning with `-` was rejected.** `curviate --api-key <key> account
+  list` exited 2 with "unknown command", and a value like `--api-key
+  -something` exited 2 with "unknown flag". Both shared one root cause: the
+  dispatcher's flag scan never tracked which tokens it had already consumed
+  as another flag's value, so it re-inspected a value token as if it were
+  fresh input, misreading a flag's value as the subcommand name in the first
+  case and re-scanning a dash-prefixed value as its own (unknown) flag in the
+  second. Fixing the scan surfaced a second, more serious defect on the same
+  path: once a leading global flag was correctly found, the token AFTER it
+  was dropped entirely on the way to the resolved command, so the flag's
+  value silently never reached the request at all (a stored profile or
+  environment variable answered instead, with no error). All three are
+  fixed. Global flags now work in any position, and a flag value starting
+  with `-` (an API key, a negative `--limit`, a message beginning with a
+  dash) is bound exactly as typed.
+
+## [0.23.0] - 2026-08-10
+
+A security and correctness release. Upgrade promptly if `--account` is ever
+set from anything other than a literal you typed yourself (an environment
+variable, a config profile, or agent- or model-generated text): every
+published version through 0.22.0 interpolated it into the request path with
+no validation at all, so a value carrying a slash, `..`, a question mark, a
+hash, or a percent sign could redirect a request, including a write, to a
+different endpoint on the API host. This release also lets `--account` take a
+connected account's name, not just its id.
+
+### Fixed
+
+- **`--account` could redirect a request to a different endpoint.**
+  `inbox mark-read` on `--account 'x/../../../v1/accounts'` built
+  `PATCH /v1/accounts/chats/chat_1` instead of touching the account the caller
+  named. `--account 'a?x=1'` injected a query string into the middle of the
+  path. Neither needed a literal `..`: the URL Standard percent-decodes when it
+  decides whether a segment is a double-dot path segment, so `%2e%2e` walked up
+  the path with no slash in the value at all. Every account-scoped command was
+  reachable this way, since all of them build the request URL from `--account`.
+  The value is now checked before any request is built, and a value that could
+  redirect one is refused with `[INVALID_PATH_SEGMENT]` (exit `2`) naming the
+  character it contains, rather than being sent.
+
+- **`group get` / `group members` never actually accepted a group URL,
+  despite documenting it.** The help and this file both claimed the server
+  extracted the numeric id from a full `https://www.linkedin.com/groups/...`
+  URL passed through verbatim; it does not, and cannot: the URL's own slashes
+  split it into several path segments and the request landed on a route that
+  does not exist. The numeric id is now extracted client-side, the same way
+  member, company, chat, and job URLs already are. A bare numeric id is
+  unaffected.
+
+### Added
+
+- **`--account` accepts a connected account's name, not just its id.** A value
+  that is not shaped like an account id is looked up against
+  `accounts.list`: an exact name match wins outright, otherwise a unique
+  prefix match resolves. A name matching more than one connected account
+  exits with `[ACCOUNT_AMBIGUOUS]` (exit `2`) rather than guessing, since
+  acting on the wrong live persona cannot be undone. A name matching none
+  exits with `[ACCOUNT_NAME_NOT_FOUND]` (exit `4`) and lists what is
+  connected. On an API key with more connected accounts than the resolver
+  reads (250 per page, 10 pages), a name lookup exits with
+  `[ACCOUNT_LIST_TRUNCATED]` (exit `2`) instead of matching against a list
+  that might be missing the very account the name would have matched; pass
+  the id instead, which needs no lookup. An id-shaped value still costs no
+  extra request. `--preview` never issues the lookup, consistent with it
+  never calling the API.
+
+### Changed
+
+- **`@curviate/sdk` dependency bumped to `^0.20.1`.** ^0.20.0 still resolves
+  the vulnerable 0.20.0 build on a fresh install or an old lockfile; 0.20.1 is
+  a hard floor at the fix. Percent-encoding of every other command's path
+  parameters (chat, job, group, company and member ids, and so on) is the
+  SDK's job as of 0.20.0, not this CLI's: a previous CLI-side guard that
+  inspected each call's leading string argument has been removed, because it
+  could not know which argument actually became a path segment and was wrong
+  in both directions, missing a path parameter passed inside an object and
+  rejecting a body field that never reached a path (`post save <share URL>`
+  was one such false rejection). `--account` is guarded separately, above,
+  because it is the one value this CLI genuinely understands the meaning of.
 
 ## [0.22.0] - 2026-08-07
 

package/README.md

@@ -47,12 +47,14 @@ curviate --api-key <your-api-key> account list
 > history. Prefer `curviate login` or the `CURVIATE_API_KEY` environment
 > variable; reserve `--api-key` for one-off, low-trust contexts.
 
-Get your API key from the [Curviate dashboard](https://docs.curviate.com).
+Get your API key from the [Curviate dashboard](https://app.curviate.com).
 
 ## Usage
 
 ```
-curviate [command] [subcommand] [flags]
+curviate [flags] [command] [subcommand] [flags]
+
+Global flags may appear anywhere in the invocation, before the command or after it.
 
 Global flags available on every command:
   --account      Target a specific account ID
@@ -62,9 +64,11 @@ Global flags available on every command:
   --fields       Comma-separated list of fields to include in JSON output
   --limit        Maximum number of results to return per page
   --cursor       Pagination cursor from a previous response
-  --all          Fetch all pages (streams results)
+  --all          Stream all pages as NDJSON
   --max-pages    Cap on the number of pages fetched with --all
+  --page-delay   Milliseconds to pause between pages when --all is used (default 400)
   --preview      Show what would happen without sending any write request
+  --verbose      Output the full SDK response instead of the slim default
   --base-url     Override the API base URL (for testing)
   --timeout      Request timeout in milliseconds (default: 30000)
 ```
@@ -77,44 +81,59 @@ These examples show how coding agents compose the CLI in real workflows.
 
 ### 1. Find people and send connection requests
 
-Search for matching profiles, preview the invitations, then send them once satisfied:
+Search for matching profiles, preview the invitations, then send them once satisfied.
+`--location` on `search people` takes location **ids**, not free text; resolve a
+human-readable place name to an id first with `curviate search parameters --type LOCATION`:
 
 ```bash
-# Look first: a search is a read, so it just runs (no --preview on reads)
+curviate search parameters --type LOCATION --keywords "Berlin" --account acc_1 --json
+# {"items":[{"id":"103035651","name":"Berlin, Germany"}, {"id":"106967730","name":"Berlin, Berlin, Germany"}, ...]}
+
+# Look first, a search is a read, so it just runs (no --preview on reads)
 curviate search people \
   --keywords "AI engineer" \
-  --location "Berlin" \
+  --location 103035651 \
+  --account acc_1 \
   --limit 10 \
   --json
 
 # Preview a single write before sending, then pipe IDs into connect, one request per person
-curviate connect "$SOME_ID" --note "Hi, I'd love to connect." --preview
+curviate connect "$SOME_ID" --account acc_1 --note "Hi, I'd love to connect." --preview
 
-curviate search people --keywords "AI engineer" --location "Berlin" --all \
+curviate search people --keywords "AI engineer" --location 103035651 --account acc_1 --all \
   | jq -r '.id' \
   | head -5 \
-  | xargs -I{} curviate connect {} --note "Hi, I'd love to connect."
+  | xargs -I{} curviate connect {} --account acc_1 --note "Hi, I'd love to connect."
 ```
 
 ### 2. Triage the inbox and extract unread threads
 
-Pull the inbox as JSON, filter unread chats, and surface the most recent message from each:
+Pull the inbox, filter unread chats, and surface the most recent message from each.
+`--all` streams **NDJSON** (one JSON object per line), not a `{items:[...]}` envelope or a
+bare array, so pipe each line straight into `jq` with no `.[]`. The chat's own id is `id`
+(`chat_id` only appears nested inside `last_message`, pointing back at its own chat); the
+unread signal is the integer `unread_count`, not a boolean `unread`; and `last_message` has
+no `sender` object, only `sender_id` (a provider id, not a display name), so a
+human-readable sender comes from the chat's own `user.display_name` instead (present on
+1:1 chats):
 
 ```bash
-curviate inbox list --json --all \
-  | jq '[.[] | select(.unread == true) | {chat_id, sender: .last_message.sender, preview: .last_message.text[0:80]}]'
+curviate inbox list --json --all --account acc_1 \
+  | jq -c 'select(.unread_count > 0) | {chat_id: .id, sender: (.user.display_name // .last_message.sender_id), preview: .last_message.text[0:80]}'
 ```
 
 ### 3. Warm up a prospect by reacting to their recent posts
 
-Read recent posts from a profile, then react to each, which is useful for ambient warm-up before outreach:
+Read recent posts from a profile, then react to each, useful for ambient warm-up before outreach.
+A post's id is `id` (there is no `post_id` field), and `--posts` returns a `{items:[...]}`
+envelope, not a bare array:
 
 ```bash
 PROFILE_URL="https://www.linkedin.com/in/example"
 
-curviate profile "$PROFILE_URL" --posts --fields post_id --json \
-  | jq -r '.[].post_id' \
-  | xargs -I{} curviate post react {} --reaction like
+curviate profile "$PROFILE_URL" --posts --fields id --account acc_1 --json \
+  | jq -r '.items[].id' \
+  | xargs -I{} curviate post react {} --account acc_1 --reaction like
 ```
 
 ### 4. Check tier entitlement before a Sales Navigator sweep
@@ -122,7 +141,7 @@ curviate profile "$PROFILE_URL" --posts --fields post_id --json \
 Exit code `5` means the account lacks the required add-on. Branch on it in a script:
 
 ```bash
-curviate sales-nav search people --keywords "VP Engineering" --json \
+curviate sales-nav search people --keywords "VP Engineering" --account acc_1 --json \
   || {
     code=$?
     if [ "$code" -eq 5 ]; then
@@ -152,11 +171,13 @@ Exit `2` means the signature is invalid or the replay window has expired.
 
 ### 6. Export all accounts to a CSV (agent-friendly pipeline)
 
-List every connected account, select key fields, and format as CSV with `jq`:
+List every connected account, select key fields, and format as CSV with `jq`. `--all` streams
+NDJSON, so slurp it into an array first with `jq -s`; the fields are `account_id` and
+`full_name`, not `id` / `name`:
 
 ```bash
 curviate account list --all --json \
-  | jq -r '["id","name","status"], (.[] | [.id, .name, .status]) | @csv' \
+  | jq -s -r '["account_id","full_name","status"], (.[] | [.account_id, .full_name, .status]) | @csv' \
   > accounts.csv
 ```
 
@@ -229,10 +250,13 @@ curviate sales-nav save-lead ACwAAA1234567 --account acc_1 --list 987654
 
 ### 3. Start a new Sales Navigator chat
 
+`--subject` is required for Sales Navigator messaging.
+
 ```bash
 curviate sales-nav message new \
   --to ACwAAA1234567 \
   --account acc_1 \
+  --subject "An opportunity at our company" \
   "Hi, I'd love to connect about an opportunity at our company."
 ```
 
@@ -314,8 +338,12 @@ curviate recruiter project-job get "$PROJECT_ID" --account acc_1 --json
 
 ### 3. Create a job posting draft, then publish it
 
-`recruiter job create` requires `--project-name` (the hiring project the posting opens) and takes
-the v2 job body. `recruiter job publish` is project-scoped and requires `--mode`
+`recruiter job create` requires `--project-name` (the hiring project the posting opens) plus the
+full v2 job body: `--job-title`, `--company-id`/`--company-name`, `--workplace-type`, `--location`,
+`--employment-status`, `--seniority-level`, `--description` (200 characters minimum), `--industry`,
+`--job-function`, and `--apply-method`. `--location`/`--industry`/`--job-function` take resolved
+parameter ids, the same `search parameters --type LOCATION`/`--type INDUSTRY`/`--type JOB_FUNCTION`
+resolution from example 1 above. `recruiter job publish` is project-scoped and requires `--mode`
 (`FREE | PROMOTED | PROMOTED_PLUS`); the paid modes also require the full `--budget-*` triple.
 
 ```bash
@@ -323,8 +351,15 @@ curviate recruiter job create \
   --account acc_1 \
   --project-name "Backend Hiring 2026" \
   --job-title "Senior Backend Engineer" \
-  --description "Remote-first team building the core platform." \
+  --company-name "Curviate GmbH" \
+  --workplace-type REMOTE \
+  --location 103035651 \
   --employment-status FULL_TIME \
+  --seniority-level MID_SENIOR_LEVEL \
+  --description "We are looking for a senior backend engineer to join our remote-first team building the core platform that powers agent-native LinkedIn automation for thousands of developers and their AI agents worldwide." \
+  --industry 96 \
+  --job-function 15 \
+  --apply-method linkedin \
   --json
 
 curviate recruiter job publish "$PROJECT_ID" "$JOB_ID" --account acc_1 --mode FREE --json
@@ -380,7 +415,7 @@ curviate recruiter message new \
   --to AEM789 \
   --account acc_1 \
   --subject "A role you'd be a great fit for" \
-  --signature "- Alex, Talent Team" \
+  --signature "Alex, Talent Team" \
   "Hi, I came across your profile and think you'd be a great fit for a role we're hiring for."
 ```
 
@@ -407,6 +442,13 @@ curviate recruiter job get "https://www.linkedin.com/jobs/view/4428113858" --acc
 | 3 | Authentication or authorization failure |
 | 4 | Resource not found |
 | 5 | Feature requires an add-on or higher plan |
+| 6 | Rate limited |
+| 7 | Transient platform error (retry likely to succeed) |
+| 8 | Account or connection state blocks the request |
+| 9 | Checkpoint flow error (expired, invalid code, or too many attempts) |
+| 10 | Messaging window expired or recipient unreachable |
+| 11 | Billing issue (payment required, failed, or seat cancelled) |
+| 12 | Auth action needed (a pending checkpoint; not an error) |
 
 ## License
 

package/dist/{account-QRGWUQXF.js → account-NZZLUI4E.js}

@@ -2,9 +2,6 @@
 import {
   readlineSync
 } from "./chunk-H4KV7MIN.js";
-import {
-  AUTH_NEEDED
-} from "./chunk-PMRQXBCP.js";
 import {
   slimAccountGet,
   slimAccountList,
@@ -13,7 +10,7 @@ import {
 import {
   pageDelayFromFlags,
   streamAll
-} from "./chunk-H6XD3F66.js";
+} from "./chunk-766W25QS.js";
 import {
   buildPreviewOutput
 } from "./chunk-R3VLWLVV.js";
@@ -23,15 +20,17 @@ import {
   renderSuccess,
   renderUnexpectedError,
   resolveEffectiveConfig
-} from "./chunk-JA3NNST6.js";
+} from "./chunk-TKWW6BV6.js";
+import "./chunk-SYRFLZ4D.js";
 import {
   GLOBAL_FLAGS,
   READ_SINGLE_FLAGS,
-  WRITE_SINGLE_FLAGS
-} from "./chunk-CUTMZWL6.js";
-import {
+  WRITE_SINGLE_FLAGS,
   defaultReadStdin
-} from "./chunk-ZYURL5VK.js";
+} from "./chunk-AHYUM2XQ.js";
+import {
+  AUTH_NEEDED
+} from "./chunk-PMRQXBCP.js";
 
 // src/commands/account.ts
 import { defineCommand } from "citty";
@@ -1101,11 +1100,11 @@ var accountCheckpointPollCommand = defineCommand({
     },
     // Override WRITE_SINGLE_FLAGS.timeout: on this command --timeout is the
     // --wait loop's own wall-clock bound in MILLISECONDS (requires --wait),
-    // NOT the SDK request timeout, and NOT seconds like `inbox sync-chat
-    // --timeout`. Default: the time remaining to the checkpoint's own expiry.
+    // NOT the SDK request timeout. Default: the time remaining to the
+    // checkpoint's own expiry.
     timeout: {
       type: "string",
-      description: "Wait-loop timeout in milliseconds (requires --wait; default: time remaining to the checkpoint's expiry). Note the unit: this is milliseconds; `inbox sync-chat --timeout` is seconds."
+      description: "Wait-loop timeout in milliseconds (requires --wait; default: time remaining to the checkpoint's expiry)."
     }
   },
   async run({ args }) {

package/dist/{chunk-H6XD3F66.js → chunk-766W25QS.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   renderNotices
-} from "./chunk-JA3NNST6.js";
+} from "./chunk-TKWW6BV6.js";
 
 // src/lib/paginate.ts
 var PaginateError = class extends Error {

package/dist/{chunk-ZYURL5VK.js → chunk-AHYUM2XQ.js}

@@ -73,11 +73,103 @@ async function resolveTextOrStdin(rawText, out, readStdin) {
   return text;
 }
 
+// src/lib/global-flags.ts
+var GLOBAL_FLAGS = {
+  // Auth / config
+  "api-key": {
+    type: "string",
+    description: "API key (overrides env and profile). Note: a key passed on the command line is visible to other processes via `ps` and is saved in shell history; prefer the CURVIATE_API_KEY env var or `curviate login`."
+  },
+  profile: {
+    type: "string",
+    description: "Named profile to use from the config file."
+  },
+  account: {
+    type: "string",
+    description: "Account id for account-scoped commands."
+  },
+  "base-url": {
+    type: "string",
+    description: "Override the API base URL."
+  },
+  timeout: {
+    type: "string",
+    description: "Request timeout in milliseconds."
+  },
+  // Output
+  json: {
+    type: "boolean",
+    description: "Emit JSON output (default when stdout is not a TTY).",
+    default: false
+  },
+  fields: {
+    type: "string",
+    description: "Comma-separated dot-path field projection (e.g. id,name)."
+  },
+  limit: {
+    type: "string",
+    description: "Maximum items per page."
+  },
+  cursor: {
+    type: "string",
+    description: "Pagination cursor (opaque token from a previous response)."
+  },
+  all: {
+    type: "boolean",
+    description: "Stream all pages as NDJSON.",
+    default: false
+  },
+  "max-pages": {
+    type: "string",
+    description: "Maximum number of pages to fetch when --all is used."
+  },
+  "page-delay": {
+    type: "string",
+    description: "Milliseconds to pause between pages when --all is used (default 400; pass 0 to disable). A modest delay keeps a long stream under the platform rate gate."
+  },
+  preview: {
+    type: "boolean",
+    description: "Render the request that would be sent without calling the API.",
+    default: false
+  },
+  verbose: {
+    type: "boolean",
+    description: "Output the full SDK response instead of the slim default.",
+    default: false
+  }
+};
+var WRITE_FLAGS = {
+  "api-key": GLOBAL_FLAGS["api-key"],
+  profile: GLOBAL_FLAGS.profile,
+  account: GLOBAL_FLAGS.account,
+  "base-url": GLOBAL_FLAGS["base-url"],
+  timeout: GLOBAL_FLAGS.timeout,
+  json: GLOBAL_FLAGS.json,
+  preview: GLOBAL_FLAGS.preview,
+  verbose: GLOBAL_FLAGS.verbose
+};
+var READ_SINGLE_FLAGS = {
+  "api-key": GLOBAL_FLAGS["api-key"],
+  profile: GLOBAL_FLAGS.profile,
+  account: GLOBAL_FLAGS.account,
+  "base-url": GLOBAL_FLAGS["base-url"],
+  timeout: GLOBAL_FLAGS.timeout,
+  json: GLOBAL_FLAGS.json,
+  fields: GLOBAL_FLAGS.fields,
+  preview: GLOBAL_FLAGS.preview,
+  verbose: GLOBAL_FLAGS.verbose
+};
+var WRITE_SINGLE_FLAGS = READ_SINGLE_FLAGS;
+
 export {
   STDIN_SENTINEL,
   defaultReadStdin,
   isStdinToken,
   restoreLiteralDashes,
   assertNoStdinPlaceholder,
-  resolveTextOrStdin
+  resolveTextOrStdin,
+  GLOBAL_FLAGS,
+  WRITE_FLAGS,
+  READ_SINGLE_FLAGS,
+  WRITE_SINGLE_FLAGS
 };

package/dist/{chunk-56ORAZJO.js → chunk-LCIUD7S2.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   isStdinToken
-} from "./chunk-ZYURL5VK.js";
+} from "./chunk-AHYUM2XQ.js";
 
 // src/lib/search-filters.ts
 import { readFile } from "fs/promises";

package/dist/chunk-LCLYFE54.js

@@ -0,0 +1,182 @@
+#!/usr/bin/env node
+import {
+  assertNoStdinPlaceholder
+} from "./chunk-AHYUM2XQ.js";
+import {
+  getExitCode
+} from "./chunk-PMRQXBCP.js";
+
+// src/lib/path-safety.ts
+var UNSAFE_CHARS = /[\u0000-\u0020\u007F/\\?#%]/;
+var UNICODE_WHITESPACE = /[\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000\uFEFF]/;
+function describeChar(value, index) {
+  const ch = value[index] ?? "";
+  const named = {
+    "/": "a slash",
+    "\\": "a backslash",
+    "?": "a question mark",
+    "#": "a hash",
+    "%": "a percent sign",
+    " ": "a space",
+    "	": "a tab",
+    "\n": "a newline",
+    "\r": "a carriage return"
+  };
+  return named[ch] ?? `the character U+${ch.charCodeAt(0).toString(16).toUpperCase().padStart(4, "0")}`;
+}
+function firstRedirectingIndex(value) {
+  for (let i = 0; i < value.length; i++) {
+    const ch = value[i];
+    if (ch === " ") continue;
+    if (UNSAFE_CHARS.test(ch) || UNICODE_WHITESPACE.test(ch)) return i;
+  }
+  return -1;
+}
+function redirectingViolation(value) {
+  if (value.length === 0) return "it is empty";
+  const i = firstRedirectingIndex(value);
+  if (i >= 0) return `it contains ${describeChar(value, i)}`;
+  if (value.includes("..")) return 'it contains ".."';
+  if (value === ".") return 'it is "."';
+  return null;
+}
+function pathSegmentViolation(value) {
+  const redirecting = redirectingViolation(value);
+  if (redirecting !== null) return redirecting;
+  if (value.includes(" ")) return "it contains a space";
+  return null;
+}
+function pathSegmentErrorMessage(label, value, reason) {
+  return `error: [INVALID_PATH_SEGMENT] ${label}: ${reason}, so it cannot be part of a request path. A value carrying a slash, backslash, question mark, hash, percent sign, whitespace, or ".." would redirect the request to a different endpoint. Received: ${JSON.stringify(value)}.
+`;
+}
+
+// src/lib/account-arg.ts
+var ACCOUNT_ID_RE = /^acc_[A-Za-z0-9_-]+$/;
+var listCache = /* @__PURE__ */ new WeakMap();
+var MAX_LOOKUP_PAGES = 10;
+function toConnectedAccount(item) {
+  if (item === null || typeof item !== "object") return null;
+  const row = item;
+  const accountId = row["account_id"];
+  if (typeof accountId !== "string" || accountId.length === 0) return null;
+  const fullName = row["full_name"];
+  return {
+    accountId,
+    fullName: typeof fullName === "string" && fullName.length > 0 ? fullName : null
+  };
+}
+function listConnectedAccounts(client) {
+  const cached = listCache.get(client);
+  if (cached) return cached;
+  const pending = (async () => {
+    const accounts = [];
+    let cursor;
+    for (let page = 0; page < MAX_LOOKUP_PAGES; page++) {
+      const params = { limit: 250 };
+      if (cursor) params["cursor"] = cursor;
+      const result = await client.accounts.list(
+        params
+      );
+      for (const item of result.items ?? []) {
+        const account = toConnectedAccount(item);
+        if (account) accounts.push(account);
+      }
+      if (!result.cursor) return { accounts, complete: true };
+      cursor = result.cursor;
+    }
+    return { accounts, complete: false };
+  })();
+  listCache.set(client, pending);
+  return pending;
+}
+function describeAccount(account) {
+  return account.fullName === null ? account.accountId : `"${account.fullName}" (${account.accountId})`;
+}
+function describeAll(accounts) {
+  return accounts.map(describeAccount).join(", ");
+}
+function matchAccounts(accounts, selector) {
+  const needle = selector.toLowerCase();
+  const byId = accounts.filter((a) => a.accountId === selector);
+  if (byId.length > 0) return byId;
+  const exactName = accounts.filter((a) => a.fullName?.toLowerCase() === needle);
+  if (exactName.length > 0) return exactName;
+  return accounts.filter((a) => a.fullName?.toLowerCase().startsWith(needle));
+}
+async function requireAccount(client, flags, out) {
+  const account = flags.account;
+  if (!account) {
+    out.stderr.write(
+      "error: --account is required for this command. Set it via --account, CURVIATE_ACCOUNT, or `curviate config set-account`.\n"
+    );
+    process.exit(2);
+  }
+  const selector = account.trim();
+  assertNoStdinPlaceholder("the --account value", [selector]);
+  const redirecting = redirectingViolation(selector);
+  if (redirecting !== null) {
+    out.stderr.write(pathSegmentErrorMessage("--account", selector, redirecting));
+    process.exit(2);
+  }
+  if (ACCOUNT_ID_RE.test(selector)) return selector;
+  if (flags.preview === true) {
+    out.stderr.write(
+      `note: --preview does not call the API, so --account "${selector}" is shown as you typed it. A real run resolves it to an account id first, and fails if it matches no connected account or more than one.
+`
+    );
+    return selector;
+  }
+  let listed;
+  try {
+    listed = await listConnectedAccounts(client);
+  } catch (err) {
+    const { CurviateError } = await import("@curviate/sdk");
+    if (err instanceof CurviateError) {
+      const e = err;
+      out.stderr.write(
+        `error: [${e.code}] could not look up connected accounts to resolve --account "${selector}": ${e.message}
+`
+      );
+      process.exit(getExitCode(e.code));
+    }
+    throw err;
+  }
+  if (!listed.complete) {
+    out.stderr.write(
+      `error: [ACCOUNT_LIST_TRUNCATED] --account "${selector}" cannot be resolved by name: this API key has more connected accounts than the resolver reads (it stops after ${MAX_LOOKUP_PAGES} pages of 250), so the name would be matched against an incomplete list and a single match would not prove there is only one. Pass the account id instead; an id is used as given and needs no lookup.
+`
+    );
+    process.exit(2);
+  }
+  const accounts = listed.accounts;
+  const matches = matchAccounts(accounts, selector);
+  if (matches.length === 1) {
+    const resolved = matches[0].accountId;
+    const bad = pathSegmentViolation(resolved);
+    if (bad !== null) {
+      out.stderr.write(
+        pathSegmentErrorMessage(`the account id resolved from "${selector}"`, resolved, bad)
+      );
+      process.exit(2);
+    }
+    return resolved;
+  }
+  if (matches.length > 1) {
+    out.stderr.write(
+      `error: [ACCOUNT_AMBIGUOUS] --account "${selector}" matches ${matches.length} connected accounts: ${describeAll(matches)}. Pass the account id of the one you mean; this is not resolved by guessing, because acting as the wrong account cannot be undone.
+`
+    );
+    process.exit(2);
+  }
+  const known = accounts.length === 0 ? "No accounts are connected on this API key." : `Connected accounts: ${describeAll(accounts)}.`;
+  out.stderr.write(
+    `error: [ACCOUNT_NAME_NOT_FOUND] --account "${selector}" matched no connected account. ${known}
+`
+  );
+  process.exit(4);
+}
+
+export {
+  requireAccount
+};

package/dist/{chunk-QJZ3LWOX.js → chunk-RJTG5YWE.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   resolveIdentifier
-} from "./chunk-DMQZEPQE.js";
+} from "./chunk-UEAX6KUB.js";
 
 // src/lib/member-id.ts
 var MEMBER_PROVIDER_ID_RE = /^A[CDE][A-Za-z0-9_-]{4,}$/;