@dench.com/cli 2.0.4 → 2.1.1

package/crm.ts

@@ -48,12 +48,16 @@ import {
   getRequiredFieldsForApolloPath,
 } from "./lib/crm-enrichment";
 import {
+  type AviatoEnrichCompanyBody,
+  type AviatoEnrichPersonBody,
   aviatoEnrichCompany,
   aviatoEnrichPerson,
+  type EnrichCompanyBody,
   EnrichmentGatewayError,
   type EnrichmentGatewayOptions,
+  type EnrichPersonBody,
   enrichCompany,
-  enrichPersonByIdentifier,
+  enrichPerson,
 } from "./lib/enrichment-gateway";
 
 // Contact-info fields that Aviato does not return.
@@ -90,6 +94,32 @@ type CrmCliContext = {
 // don't need to change their try/catch shape.
 class CrmCliError extends Error {}
 
+function userFacingConvexErrorMessage(error: unknown): string | null {
+  if (!error || typeof error !== "object") return null;
+  const data = (error as { data?: unknown }).data;
+  if (typeof data === "string" && data.trim().length > 0) {
+    return data.trim();
+  }
+  if (data && typeof data === "object" && !Array.isArray(data)) {
+    const record = data as Record<string, unknown>;
+    for (const key of ["message", "error", "reason"]) {
+      const value = record[key];
+      if (typeof value === "string" && value.trim().length > 0) {
+        return value.trim();
+      }
+    }
+  }
+  return null;
+}
+
+function normalizeRpcError(error: unknown): Error {
+  if (error instanceof CrmCliError) return error;
+  return new CrmCliError(
+    userFacingConvexErrorMessage(error) ??
+      (error instanceof Error ? error.message : String(error)),
+  );
+}
+
 function shift(args: string[], expected: string): string {
   try {
     return shiftRaw(args, expected);
@@ -275,10 +305,14 @@ async function callQuery(
   fn: Parameters<ConvexHttpClient["query"]>[0],
   args: Record<string, unknown> = {},
 ): Promise<unknown> {
-  return ctx.convex.query(fn, {
-    ...args,
-    ...(ctx.sessionToken ? { sessionToken: ctx.sessionToken } : {}),
-  } as never);
+  try {
+    return await ctx.convex.query(fn, {
+      ...args,
+      ...(ctx.sessionToken ? { sessionToken: ctx.sessionToken } : {}),
+    } as never);
+  } catch (error) {
+    throw normalizeRpcError(error);
+  }
 }
 
 async function callMutation(
@@ -286,10 +320,14 @@ async function callMutation(
   fn: Parameters<ConvexHttpClient["mutation"]>[0],
   args: Record<string, unknown> = {},
 ): Promise<unknown> {
-  return ctx.convex.mutation(fn, {
-    ...args,
-    ...(ctx.sessionToken ? { sessionToken: ctx.sessionToken } : {}),
-  } as never);
+  try {
+    return await ctx.convex.mutation(fn, {
+      ...args,
+      ...(ctx.sessionToken ? { sessionToken: ctx.sessionToken } : {}),
+    } as never);
+  } catch (error) {
+    throw normalizeRpcError(error);
+  }
 }
 
 function out(ctx: CrmCliContext, value: unknown): void {
@@ -383,6 +421,21 @@ const api = {
     update: makeFunctionReference<"mutation">("functions/crm/fields:update"),
     remove: makeFunctionReference<"mutation">("functions/crm/fields:remove"),
     reorder: makeFunctionReference<"mutation">("functions/crm/fields:reorder"),
+    reorderEnumValues: makeFunctionReference<"mutation">(
+      "functions/crm/fields:reorderEnumValues",
+    ),
+    addEnumValue: makeFunctionReference<"mutation">(
+      "functions/crm/fields:addEnumValue",
+    ),
+    removeEnumValue: makeFunctionReference<"mutation">(
+      "functions/crm/fields:removeEnumValue",
+    ),
+    setEnumColor: makeFunctionReference<"mutation">(
+      "functions/crm/fields:setEnumColor",
+    ),
+    renameEnumValue: makeFunctionReference<"mutation">(
+      "functions/crm/fields:renameEnumValue",
+    ),
   },
   entries: {
     list: makeFunctionReference<"query">("functions/crm/entries:list"),
@@ -693,6 +746,107 @@ async function runFieldsCommand(ctx: CrmCliContext): Promise<void> {
       );
       return;
     }
+    case "enum-reorder": {
+      const objectName = shift(ctx.args, "object name");
+      const fieldName = shift(ctx.args, "field name");
+      // Same pattern as `reorder`: peel positional args after asserting
+      // there are no stray flags so a typo'd `--limit` fails loud
+      // instead of being silently consumed as an enum value.
+      assertNoUnknownFlags(ctx.args, "crm fields enum-reorder");
+      const orderedValues = [...ctx.args];
+      if (orderedValues.length === 0) {
+        throw new CrmCliError(
+          "dench crm fields enum-reorder requires at least one value. " +
+            'Pass each enum value as a positional arg: `enum-reorder task Status "Done" "In Progress" "To Do"`',
+        );
+      }
+      out(
+        ctx,
+        await callMutation(ctx, api.fields.reorderEnumValues, {
+          objectName,
+          fieldName,
+          orderedValues,
+        }),
+      );
+      return;
+    }
+    case "enum-add": {
+      const objectName = shift(ctx.args, "object name");
+      const fieldName = shift(ctx.args, "field name");
+      const value = shift(ctx.args, "enum value");
+      const color = getFlag(ctx.args, "--color");
+      const positionStr = getFlag(ctx.args, "--position");
+      const position =
+        positionStr !== undefined
+          ? Number.parseInt(positionStr, 10)
+          : undefined;
+      if (position !== undefined && !Number.isFinite(position)) {
+        throw new CrmCliError(
+          `--position must be an integer, got "${positionStr}"`,
+        );
+      }
+      assertNoUnknownFlags(ctx.args, "crm fields enum-add");
+      out(
+        ctx,
+        await callMutation(ctx, api.fields.addEnumValue, {
+          objectName,
+          fieldName,
+          value,
+          color,
+          position,
+        }),
+      );
+      return;
+    }
+    case "enum-remove": {
+      const objectName = shift(ctx.args, "object name");
+      const fieldName = shift(ctx.args, "field name");
+      const value = shift(ctx.args, "enum value");
+      assertNoUnknownFlags(ctx.args, "crm fields enum-remove");
+      out(
+        ctx,
+        await callMutation(ctx, api.fields.removeEnumValue, {
+          objectName,
+          fieldName,
+          value,
+        }),
+      );
+      return;
+    }
+    case "enum-rename": {
+      const objectName = shift(ctx.args, "object name");
+      const fieldName = shift(ctx.args, "field name");
+      const oldValue = shift(ctx.args, "old enum value");
+      const newValue = shift(ctx.args, "new enum value");
+      assertNoUnknownFlags(ctx.args, "crm fields enum-rename");
+      out(
+        ctx,
+        await callMutation(ctx, api.fields.renameEnumValue, {
+          objectName,
+          fieldName,
+          oldValue,
+          newValue,
+        }),
+      );
+      return;
+    }
+    case "enum-set-color": {
+      const objectName = shift(ctx.args, "object name");
+      const fieldName = shift(ctx.args, "field name");
+      const value = shift(ctx.args, "enum value");
+      const color = shift(ctx.args, "hex color");
+      assertNoUnknownFlags(ctx.args, "crm fields enum-set-color");
+      out(
+        ctx,
+        await callMutation(ctx, api.fields.setEnumColor, {
+          objectName,
+          fieldName,
+          value,
+          color,
+        }),
+      );
+      return;
+    }
     default:
       throw new CrmCliError(`Unknown crm fields verb: ${verb ?? "<none>"}`);
   }
@@ -1704,6 +1858,21 @@ async function resolveEnrichmentTarget(
   };
 }
 
+/**
+ * Build the gateway request body from a CRM entry the same way the
+ * chat-turn `enrich_person` / `enrich_company` / `enrich_person_basic` /
+ * `enrich_company_basic` tools do — pass every structured identifier the
+ * row has (email, firstName, lastName, linkedinUrl, domain, …) and let the
+ * shared gateway client (`enrichPerson`, `enrichCompany`,
+ * `aviatoEnrichPerson`, `aviatoEnrichCompany`) validate + dispatch.
+ *
+ * The previous implementation collapsed the entry to a single
+ * `--input-field` value and called `enrichPersonByIdentifier`, which
+ * threw away the rest of the row and made FullEnrich fail with
+ * `missing_people_identifier` whenever the input field was just an
+ * Email (no first/last name reached the gateway, so the validator
+ * rejected the request before any provider was called).
+ */
 async function callEnrichmentGatewayForEntry(args: {
   target: EnrichmentTarget;
   entry: CrmEntryForEnrichment;
@@ -1711,64 +1880,175 @@ async function callEnrichmentGatewayForEntry(args: {
   provider?: string;
   gateway?: Pick<EnrichmentGatewayOptions, "apiKey" | "baseUrl">;
 }): Promise<Record<string, unknown>> {
-  const input = args.entry.fields[args.target.inputField.name];
-  if (!hasCellValue(input)) {
+  const { entry, target } = args;
+  // Sanity gate: the column the user picked as `--input-field` must be
+  // populated. The body builder will pass every other available identifier
+  // too, so the gateway has the best possible chance of resolving the row.
+  if (!hasCellValue(entry.fields[target.inputField.name])) {
     throw new CrmCliError(
-      `Entry ${args.entry.id} has no value for input field "${args.target.inputField.name}"`,
+      `Entry ${entry.id} has no value for input field "${target.inputField.name}"`,
     );
   }
-  const inputValue = String(input);
-  const isCompany = args.target.category === "company";
+  const isCompany = target.category === "company";
   const resolvedProvider =
     args.provider ?? (isCompany ? "aviato" : "fullenrich");
 
   if (resolvedProvider === "aviato") {
-    // Guard: Aviato does not return phone or email.
-    const contactFields = args.target.requiredFields.filter(isContactField);
+    // Aviato does not return phone or email — surface a clear error
+    // before we waste a gateway round-trip.
+    const contactFields = target.requiredFields.filter(isContactField);
     if (contactFields.length > 0) {
       throw new CrmCliError(
         `Aviato does not return phone or email; use --provider fullenrich for contact fields (${contactFields.join(", ")}).`,
       );
     }
-
     if (isCompany) {
-      // inputValue is typically a domain; try to detect linkedin URLs
-      const isLinkedin = /linkedin\.com/i.test(inputValue);
       return aviatoEnrichCompany(
-        isLinkedin ? { linkedinUrl: inputValue } : { website: inputValue },
+        buildAviatoCompanyBodyFromEntry(entry),
         args.gateway,
       );
-    } else {
-      // For people, inputValue may be a LinkedIn URL, email, or LinkedIn ID
-      const isLinkedin = /linkedin\.com/i.test(inputValue);
-      const isEmail = /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(inputValue);
-      if (isLinkedin) {
-        return aviatoEnrichPerson({ linkedinUrl: inputValue }, args.gateway);
-      }
-      if (isEmail) {
-        return aviatoEnrichPerson({ email: inputValue }, args.gateway);
-      }
-      return aviatoEnrichPerson({ linkedinID: inputValue }, args.gateway);
     }
+    return aviatoEnrichPerson(
+      buildAviatoPersonBodyFromEntry(entry),
+      args.gateway,
+    );
   }
 
-  // fullenrich path (default for people, explicit override for companies)
+  // FullEnrich path. Mirrors `enrichPersonStep` / `enrichCompanyStep` in
+  // src/workflows/enrichment-steps.ts: build a structured body, hand it
+  // to the same shared gateway client.
   if (isCompany) {
     return enrichCompany(
-      {
-        domain: inputValue,
-        requiredFields: args.target.requiredFields,
-      },
+      buildCompanyBodyFromEntry(entry, target.requiredFields),
       args.gateway,
     );
   }
-  return enrichPersonByIdentifier(
-    inputValue,
-    args.target.requiredFields,
+  return enrichPerson(
+    buildPersonBodyFromEntry(entry, target.requiredFields),
     args.gateway,
   );
 }
 
+// ── Body builders ────────────────────────────────────────────────────────
+//
+// Pick whichever canonical column name the entry happens to use. Field
+// naming on CRM objects has historically drifted (`Name` vs `Full Name`,
+// `Email` vs `Email Address`, `Website` vs `Domain`), so each builder
+// accepts a small list of synonyms before giving up.
+
+const PEOPLE_FULL_NAME_FIELDS = ["Name", "Full Name", "Person Name"] as const;
+const PEOPLE_FIRST_NAME_FIELDS = ["First Name", "Given Name"] as const;
+const PEOPLE_LAST_NAME_FIELDS = [
+  "Last Name",
+  "Family Name",
+  "Surname",
+] as const;
+const PEOPLE_EMAIL_FIELDS = [
+  "Email",
+  "Email Address",
+  "Work Email",
+  "Personal Email",
+] as const;
+const PEOPLE_LINKEDIN_FIELDS = [
+  "LinkedIn URL",
+  "LinkedIn",
+  "Linkedin URL",
+] as const;
+const PEOPLE_DOMAIN_FIELDS = ["Domain", "Company Domain"] as const;
+
+const COMPANY_WEBSITE_FIELDS = ["Website", "Domain", "URL", "Site"] as const;
+const COMPANY_LINKEDIN_FIELDS = [
+  "LinkedIn URL",
+  "LinkedIn",
+  "Linkedin URL",
+] as const;
+const COMPANY_NAME_FIELDS = [
+  "Company Name",
+  "Name",
+  "Organization",
+  "Organization Name",
+] as const;
+
+function readEntryField(
+  entry: CrmEntryForEnrichment,
+  candidates: readonly string[],
+): string | undefined {
+  for (const name of candidates) {
+    const value = entry.fields[name];
+    if (typeof value === "string") {
+      const trimmed = value.trim();
+      if (trimmed.length > 0) return trimmed;
+    }
+  }
+  return undefined;
+}
+
+/** Split "Mendy Edri" → { firstName: "Mendy", lastName: "Edri" }. */
+export function splitFullName(fullName: string): {
+  firstName?: string;
+  lastName?: string;
+} {
+  const trimmed = fullName.trim();
+  if (!trimmed) return {};
+  const parts = trimmed.split(/\s+/);
+  if (parts.length === 1) return { firstName: parts[0] };
+  return { firstName: parts[0], lastName: parts.slice(1).join(" ") };
+}
+
+export function buildPersonBodyFromEntry(
+  entry: CrmEntryForEnrichment,
+  requiredFields: string[] | undefined,
+): EnrichPersonBody {
+  let firstName = readEntryField(entry, PEOPLE_FIRST_NAME_FIELDS);
+  let lastName = readEntryField(entry, PEOPLE_LAST_NAME_FIELDS);
+  if (!firstName || !lastName) {
+    const fullName = readEntryField(entry, PEOPLE_FULL_NAME_FIELDS);
+    if (fullName) {
+      const split = splitFullName(fullName);
+      firstName ??= split.firstName;
+      lastName ??= split.lastName;
+    }
+  }
+  return {
+    email: readEntryField(entry, PEOPLE_EMAIL_FIELDS),
+    linkedinUrl: readEntryField(entry, PEOPLE_LINKEDIN_FIELDS),
+    firstName,
+    lastName,
+    domain: readEntryField(entry, PEOPLE_DOMAIN_FIELDS),
+    requiredFields,
+  };
+}
+
+export function buildCompanyBodyFromEntry(
+  entry: CrmEntryForEnrichment,
+  requiredFields: string[] | undefined,
+): EnrichCompanyBody {
+  return {
+    domain: readEntryField(entry, COMPANY_WEBSITE_FIELDS),
+    companyName: readEntryField(entry, COMPANY_NAME_FIELDS),
+    linkedinUrl: readEntryField(entry, COMPANY_LINKEDIN_FIELDS),
+    requiredFields,
+  };
+}
+
+export function buildAviatoPersonBodyFromEntry(
+  entry: CrmEntryForEnrichment,
+): AviatoEnrichPersonBody {
+  return {
+    linkedinUrl: readEntryField(entry, PEOPLE_LINKEDIN_FIELDS),
+    email: readEntryField(entry, PEOPLE_EMAIL_FIELDS),
+  };
+}
+
+export function buildAviatoCompanyBodyFromEntry(
+  entry: CrmEntryForEnrichment,
+): AviatoEnrichCompanyBody {
+  return {
+    website: readEntryField(entry, COMPANY_WEBSITE_FIELDS),
+    linkedinUrl: readEntryField(entry, COMPANY_LINKEDIN_FIELDS),
+  };
+}
+
 async function enrichOneEntry(
   ctx: CrmCliContext,
   args: Omit<CellEnrichmentArgs, "entryId"> & {
@@ -1776,6 +2056,7 @@ async function enrichOneEntry(
     entry: CrmEntryForEnrichment;
   },
 ): Promise<Record<string, unknown>> {
+  let value: unknown;
   try {
     const payload = await callEnrichmentGatewayForEntry({
       target: args.target,
@@ -1783,32 +2064,7 @@ async function enrichOneEntry(
       provider: args.provider,
       gateway: ctx.enrichmentGateway,
     });
-    const value = extractEnrichmentValue(payload, args.target.column);
-    if (value === null) {
-      return {
-        entryId: args.entry.id,
-        ok: false,
-        reason: "value_not_found",
-      };
-    }
-    const writeResult = (await callMutation(
-      ctx,
-      api.enrich.applyCellEnrichmentResult,
-      {
-        objectName: args.objectName,
-        entryId: args.entry.id,
-        fieldName: args.fieldName,
-        value,
-        provider: args.provider ?? "gateway",
-        overwrite: args.overwrite,
-      },
-    )) as Record<string, unknown>;
-    return {
-      entryId: args.entry.id,
-      ok: writeResult.ok === true,
-      value,
-      ...writeResult,
-    };
+    value = extractEnrichmentValue(payload, args.target.column);
   } catch (error) {
     if (
       error instanceof EnrichmentGatewayError ||
@@ -1826,6 +2082,31 @@ async function enrichOneEntry(
     }
     throw error;
   }
+  if (value === null) {
+    return {
+      entryId: args.entry.id,
+      ok: false,
+      reason: "value_not_found",
+    };
+  }
+  const writeResult = (await callMutation(
+    ctx,
+    api.enrich.applyCellEnrichmentResult,
+    {
+      objectName: args.objectName,
+      entryId: args.entry.id,
+      fieldName: args.fieldName,
+      value,
+      provider: args.provider ?? "gateway",
+      overwrite: args.overwrite,
+    },
+  )) as Record<string, unknown>;
+  return {
+    entryId: args.entry.id,
+    ok: writeResult.ok === true,
+    value,
+    ...writeResult,
+  };
 }
 
 async function enrichCellThroughGateway(
@@ -2148,6 +2429,28 @@ Fields (columns):
   dench crm fields delete <object> <field>
   dench crm fields reorder <object> <field1> <field2> <field3> ...
 
+  Enum option management (on existing enum fields):
+  dench crm fields enum-reorder <object> <field> <value1> <value2> ...
+      Canonical way to set the order of kanban columns / table picker options.
+      The trailing positional values must be a permutation of the field's
+      current enumValues; additions/removals are rejected (use enum-add /
+      enum-remove first). Also keeps any matching crmStatuses rows in sync
+      so the kanban (which prefers statuses over enumValues) reflects the
+      new order.
+  dench crm fields enum-add <object> <field> <value> [--color HEX] [--position N]
+      Appends <value> to the field's enumValues. --color is a hex like
+      "#22c55e"; --position is a 0-based insertion index (defaults to append).
+      Idempotent: re-adding an existing value only updates its color when given.
+  dench crm fields enum-remove <object> <field> <value>
+      Removes the value from the option list. Historical entry rows that held
+      <value> keep the literal string (the badge falls back to the default
+      tint), matching Notion's "remove option, keep history" semantics.
+  dench crm fields enum-rename <object> <field> <oldValue> <newValue>
+      Renames the option AND rewrites every entry that referenced the old
+      value (bounded to 1000 rows per call) AND renames matching crmStatuses.
+  dench crm fields enum-set-color <object> <field> <value> <hex>
+      Update the color (e.g. "#3b82f6") for an existing enum option.
+
 Entries (rows):
   dench crm entries list <object> [--limit N] [--with-meta] [--json]
   dench crm entries get <object> <entryId>

package/dench.ts

@@ -376,6 +376,30 @@ function parseCommaOption(name: string) {
   );
 }
 
+function parseMemoryVisibilityOption() {
+  const scope = option("--scope");
+  const visibility = option("--visibility");
+  if (scope && visibility && scope !== visibility) {
+    throw new CliError(
+      "--scope and --visibility must match when both are set",
+      {
+        code: "memory_scope_conflict",
+        nextActions: ["Use only --scope user or --scope org."],
+      },
+    );
+  }
+  const value = scope ?? visibility ?? "user";
+  if (value !== "user" && value !== "org") {
+    throw new CliError("--scope must be user or org", {
+      code: "invalid_memory_scope",
+      nextActions: [
+        "Use --scope user for private user memory or --scope org for shared organization memory.",
+      ],
+    });
+  }
+  return value;
+}
+
 function logHuman(message: string) {
   if (!json) {
     console.error(message);
@@ -398,7 +422,7 @@ Usage:
   dench context [--json]
   dench status [--mine|--self] [--json]
   dench memory search "query" [--limit 8] [--json]
-  dench memory save <key> "text" [--kind fact|decision|preference|goal|tool_note|other] [--tags a,b] [--sensitivity normal|broad|sensitive] [--json]
+  dench memory save <key> "text" [--kind fact|decision|preference|goal|tool_note|other] [--tags a,b] [--sensitivity normal|broad|sensitive] [--scope user|org] [--json]
   dench artifacts [--limit 25] [--json]
   dench suggested-work [--json]
   dench approval request "message" [--json]
@@ -610,10 +634,11 @@ function memoryHelp() {
 
 Usage:
   dench memory search "query" [--limit 8] [--json]
-  dench memory save <key> "text" [--kind fact|decision|preference|goal|tool_note|other] [--tags a,b] [--sensitivity normal|broad|sensitive] [--json]
+  dench memory save <key> "text" [--kind fact|decision|preference|goal|tool_note|other] [--tags a,b] [--sensitivity normal|broad|sensitive] [--scope user|org] [--json]
 
 Use memory only for stable facts, decisions, preferences, recurring goals, and
-tool notes. Do not store secrets or scratch notes.
+tool notes. Do not store secrets or scratch notes. Saved memories are scoped to
+the signed-in user by default; pass --scope org to share with the organization.
 `);
 }
 
@@ -2419,6 +2444,7 @@ function requireAuthenticatedRuntime(
 type GatewayCommandAuth = {
   bearerToken: string;
   gatewayBaseUrl?: string;
+  gatewayHeaders?: Record<string, string>;
 };
 
 function gatewayBaseUrlForCli(value: unknown): string | undefined {
@@ -2515,6 +2541,12 @@ async function resolveGatewayCommandAuth(
     return {
       bearerToken: gatewayKey,
       gatewayBaseUrl: gatewayBaseUrlForCli(body.gatewayBaseUrl),
+      gatewayHeaders:
+        body.gatewayHeaders &&
+        typeof body.gatewayHeaders === "object" &&
+        !Array.isArray(body.gatewayHeaders)
+          ? (body.gatewayHeaders as Record<string, string>)
+          : undefined,
     };
   }
 
@@ -2622,6 +2654,7 @@ async function connectedAppsContext(runtime: Runtime) {
     return fetchConnectedAppsSummary({
       bearerToken: gatewayAuth.bearerToken,
       gatewayBaseUrl: gatewayAuth.gatewayBaseUrl,
+      gatewayHeaders: gatewayAuth.gatewayHeaders,
     });
   } catch (error) {
     return {
@@ -3822,6 +3855,7 @@ async function main() {
       jsonOutput: json,
       bearerToken: gatewayAuth.bearerToken,
       gatewayBaseUrl: gatewayAuth.gatewayBaseUrl,
+      gatewayHeaders: gatewayAuth.gatewayHeaders,
     });
     return;
   }
@@ -3841,6 +3875,7 @@ async function main() {
       jsonOutput: json,
       bearerToken: gatewayAuth.bearerToken,
       gatewayBaseUrl: gatewayAuth.gatewayBaseUrl,
+      gatewayHeaders: gatewayAuth.gatewayHeaders,
     });
     return;
   }
@@ -4135,6 +4170,7 @@ async function main() {
             text,
             tags: parseCommaOption("--tags"),
             sensitivity: (option("--sensitivity") ?? "normal") as never,
+            visibility: parseMemoryVisibilityOption() as never,
           },
         ),
       );

package/lib/enrichment-gateway.ts

@@ -1280,6 +1280,28 @@ async function buildGatewayError(
       code: code ?? "not_found",
     });
   }
+  if (
+    response.status === 401 ||
+    code === "invalid_api_key" ||
+    code === "unauthorized"
+  ) {
+    return new EnrichmentGatewayError(
+      upstreamMessage ?? "Unauthorized gateway request",
+      { status: response.status, code: "unauthorized" },
+    );
+  }
+  if (response.status === 403 || code === "forbidden") {
+    return new EnrichmentGatewayError(
+      upstreamMessage ?? "Forbidden gateway request",
+      { status: response.status, code: "forbidden" },
+    );
+  }
+  if (code === "aviato_unauthorized") {
+    return new EnrichmentGatewayError(
+      upstreamMessage ?? "Aviato provider unauthorized",
+      { status: response.status || 401, code: "aviato_unauthorized" },
+    );
+  }
   if (response.status === 503 || code === "provider_unavailable") {
     return new EnrichmentGatewayError("Gateway providers unavailable", {
       status: response.status,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dench.com/cli",
-  "version": "2.0.4",
+  "version": "2.1.1",
   "description": "Dench agent workspace CLI. v2 unifies auth behind `dench signin`; the legacy `dench login` / `dench onboard` / `dench setup` / `dench what-can-i-do` / `dench register` commands now error with a redirect.",
   "type": "module",
   "bin": {

package/tools.ts

@@ -50,11 +50,12 @@ export type ToolCliContext = {
   jsonOutput: boolean;
   bearerToken?: string;
   gatewayBaseUrl?: string;
+  gatewayHeaders?: Record<string, string>;
 };
 
 type GatewayAuthContext = Pick<
   ToolCliContext,
-  "bearerToken" | "gatewayBaseUrl"
+  "bearerToken" | "gatewayBaseUrl" | "gatewayHeaders"
 >;
 
 export async function runToolCommand(ctx: ToolCliContext): Promise<void> {
@@ -453,6 +454,7 @@ async function callGateway(
     headers: {
       "content-type": "application/json",
       authorization: `Bearer ${bearerToken}`,
+      ...(ctx.gatewayHeaders ?? {}),
     },
   };
   if (body !== undefined) init.body = JSON.stringify(body);