@getpeppr/cli 0.6.0 → 0.7.0

package/CHANGELOG.md

@@ -0,0 +1,206 @@
+# Changelog
+
+All notable changes to `@getpeppr/cli` are documented here.
+
+The CLI bundles `@getpeppr/sdk` into its published artifact (tsup `noExternal`), so `validate`, `convert` and `init` run the SDK's validators, country rules and UBL builder locally — an SDK release only reaches CLI users once the CLI is rebundled. Rebundle-only releases are listed with the SDK version they ship.
+
+## [0.7.0] — 2026-08-16
+
+Rebundle SDK 4.0.0 (GPR-1061). `getpeppr send --watch` could not confirm a
+delivery: it polled every 2 seconds, was handed an invented `submitted` every
+time, and after 60 seconds printed *"Timeout — invoice was sent but delivery not
+confirmed"* on invoices that had in fact been delivered. The status was never
+measured; the SDK was supplying it.
+
+The SDK now refuses a status the gateway did not send, so `--watch` stops
+reporting a timeout it cannot justify. When the gateway answers without a
+status, the watch ends immediately with `⚠ Watch error:` and the reason, instead
+of waiting a minute to say nothing.
+
+### Changed
+
+- `send --watch` surfaces a gateway protocol fault instead of polling to
+  timeout. Minor rather than patch: a script that read the 60-second timeout as
+  "not delivered yet" will now see an error much sooner — which is the point,
+  since that timeout was never evidence of anything.
+- **`send --watch` exits 1 when the watch itself fails.** It used to print the
+  error and exit 0, leaving the send-time `submitted` on stdout: an automation
+  gating on the exit code read a broken API as a confirmed delivery. A watch you
+  asked for and could not run is not a success.
+
+  A watch that merely **times out** still exits 0, unchanged. The send worked;
+  delivery is simply unconfirmed within the window. That is a different fact
+  from "the API answered something the SDK refused to interpret".
+
+## [0.6.0] — 2026-08-12
+
+Rebundle SDK 3.2.0 (GPR-1012, GPR-1020). Minor rather than patch: `validate` now
+**fails** documents it used to pass, so a pipeline gating on its exit code will
+start rejecting invoices — which is the point, since those invoices were being
+refused at send time anyway.
+
+Measured against the published `0.5.4` on the same file, before and after:
+
+| `vatCategory` | 0.5.4 said | 0.6.0 says |
+| --- | --- | --- |
+| `L` (IGIC) | *nothing* — passed silently | `unsupported_vat_category`, explained |
+| `M` (IPSI) | *nothing* — passed silently | `unsupported_vat_category`, explained |
+| `B` (split payment) | `invalid VAT category` | `unsupported_vat_category` |
+| `ae` | `invalid VAT category` | `BR-CL-17` + a note that codes are case-sensitive |
+
+### Changed
+
+- `validate` reports unroutable VAT categories instead of passing them. `L` and
+  `M` are valid EN 16931 codes our provider has no vocabulary for, so a document
+  carrying one is refused with a 422 at send time. `0.5.4` said nothing about
+  them, which meant the offline validator's verdict and the gateway's disagreed
+  on exactly the case where the developer needed the warning.
+- `validate` no longer emits the rule id `PEPPOL-EN16931-R006`. That id does not
+  exist in Peppol rulebook v3.0.20 — the family stops at R005, R007 and R008 —
+  so the CLI was citing a rule a reader could not look up. Violations now carry
+  `BR-CL-17` (a genuine EN 16931 rule) or `unsupported_vat_category`.
+- `validate` accepts `B` (Italian split payment) as a real VAT category. It was
+  reported invalid, which is the more expensive direction of error: telling a
+  developer the network refuses a code it accepts closes a corridor that is open.
+- A `vatCategory` of `null` is treated as absent rather than reported as the
+  literal string `"null"` — the shape any JSON serialiser emits for an unset
+  field, and the shape the gateway has always accepted.
+
+### Unchanged
+
+- `lookup`, `login`, `logout` and `send` behave identically.
+- The scheme and identifier fixes from SDK 3.0.0 (`GB:CRN` removal, `GB:VAT` and
+  Leitweg-ID patterns) are **not** in this bundle and never were: those symbols
+  live in a module the CLI does not import, and tsup tree-shakes them out.
+  Verified on the built artifact — `SCHEMES_BY_COUNTRY`, `validatePeppolIdentifier`
+  and `LEITWEG` are absent while `buildInvoiceXml` and `validateSchematron` are
+  present, so the absence is real and not a broken grep. SDK 3.1.0 was type-only
+  and had nothing to bundle.
+
+## [0.5.4] — 2026-07-24
+
+### Changed
+
+- Rebundle SDK 2.5.0 (GPR-868): `directory.search()` pagination meta remap, `WebhookEventType` phantom values removed. No CLI command change (`lookup` uses its own directory client).
+
+## [0.5.3] — 2026-07-20
+
+### Changed
+
+- `init` templates now target the getpeppr sandbox test receiver, so a scaffolded invoice can be sent successfully on the first try in sandbox (GPR-828).
+
+## [0.5.2] — 2026-07-16
+
+### Changed
+
+- Rebundle SDK 2.4.0 (GPR-134): `validate`/`convert` now apply the France country rules (FR-01 SIREN/SIRET checksums with the corrected La Poste model, FR-02 VAT key alphabet, FR-03 DGFiP VAT key formula) locally.
+
+## [0.5.1] — 2026-07-16
+
+### Fixed
+
+- Rebundle SDK 2.3.0 (GPR-838): `convert`/`validate` now emit EN 16931 BR-CO-17-compliant UBL — group-level VAT rounding replaced per-line accumulation, which could drift the payable amount by one cent on sub-cent line amounts.
+
+## [0.5.0] — 2026-07-13
+
+### Changed
+
+- `send --watch` stops on the terminal `no_action` status (recipient not deliverable) and `send` exits 1 on it (GPR-830). Rebundles SDK 2.1.0 (`invoice.undeliverable` webhook event, `waitFor` terminal semantics).
+
+## [0.4.7] — 2026-06-21
+
+### Changed
+
+- Rebundle SDK 2.0.0 (bundle hygiene, no command change).
+
+## [0.4.6] — 2026-06-19
+
+### Changed
+
+- Rebundle SDK 1.9.0 (GPR-738: `invoices.list()` blank `number`/`createdAt` fix).
+
+## [0.4.5] — 2026-06-04
+
+### Changed
+
+- Rebundle SDK 1.5.2 (directory response alignment).
+
+## [0.4.4] — 2026-06-04
+
+### Changed
+
+- Rebundle SDK 1.5.1 (patch train).
+
+## [0.4.3] — 2026-05-24
+
+### Changed
+
+- Rebundle SDK 1.5.0 (server validation contract updates).
+
+## [0.4.2] — 2026-05-07
+
+### Fixed
+
+- Repaired published package imports (#289) — same packaging fix as SDK 1.4.2.
+
+## [0.4.1] — 2026-05-07
+
+### Changed
+
+- Version alignment with SDK 1.4.1, package metadata normalization (#287, #290).
+
+## [0.4.0] — 2026-05-01
+
+### Added
+
+- `DirectoryError` class for directory lookup failures (GPR-414 PR-B, #270).
+
+### Fixed
+
+- `lookup`/search requests now carry `AbortSignal.timeout(15s)` and an HTTP ok-check — previously a slow Peppol Directory response could hang the command forever.
+
+## [0.3.1] — 2026-04-27
+
+### Changed
+
+- README documents the `send`, `login` and `logout` commands.
+
+## [0.3.0] — 2026-04-27
+
+### Added
+
+- `send [file]` — send an invoice to the Peppol network via the getpeppr API (`--watch`, `--prod`) (GPR-278).
+- `login` / `logout` — store/remove the API key in `~/.config/getpeppr/credentials.json` (mode 0600).
+- SDK now bundled into the published artifact via tsup `noExternal` (fixes `ERR_UNSUPPORTED_DIR_IMPORT` on user installs). 7 commands total.
+
+## [0.2.2] — 2026-04-09
+
+### Changed
+
+- README documents the `init`, `convert` and `lookup` commands.
+
+## [0.2.1] — 2026-04-09
+
+### Changed
+
+- Belgian seller templates for `init`.
+
+## [0.2.0] — 2026-04-09
+
+### Added
+
+- `init [file]` — scaffold an invoice/credit-note JSON template (GPR-275).
+- `convert <file>` — JSON → Peppol BIS 3.0 UBL XML on stdout (GPR-276).
+- `lookup <peppolId>` — Peppol Directory participant search (GPR-277).
+
+## [0.1.1] — 2026-04-07
+
+### Changed
+
+- npm README and website docs page (GPR-159).
+
+## [0.1.0] — 2026-04-07
+
+### Added
+
+- Initial release: `getpeppr validate <file>` — offline Peppol invoice validation running the SDK's three validators locally, no account required (GPR-265/266/267). Exit codes: 0 = valid, 1 = validation errors, 2 = fatal.

package/README.md

@@ -271,6 +271,16 @@ const result = await peppol.invoices.send(invoice);
 
 Sign up at [getpeppr.dev](https://getpeppr.dev) to get your API key.
 
+## Release notes
+
+`validate` runs the Peppol rules bundled into the version you installed, so its
+verdict can change between releases — which matters most if you gate a pipeline
+on its exit code. Two places tell you what moved:
+
+- `CHANGELOG.md`, shipped inside the package (`node_modules/@getpeppr/cli/CHANGELOG.md`).
+- [getpeppr.dev/news](https://getpeppr.dev/news) for the same notes on the web,
+  alongside gateway and SDK changes.
+
 ## License
 
 MIT

package/dist/index.js

@@ -1161,7 +1161,7 @@ function statusFamily(status) {
 var TERMINAL_FAILURE_STATUSES = STATUS_PRECEDENCE.filter((e) => e.family === "terminal-failure").map((e) => e.status);
 
 // ../sdk/dist/version.js
-var SDK_VERSION = "3.2.0";
+var SDK_VERSION = "4.0.0";
 
 // ../sdk/dist/core/client.js
 function findHeaderCaseInsensitive(headers, name) {
@@ -1199,6 +1199,50 @@ function parseRetryAfter(headerValue) {
   }
   return void 0;
 }
+var CONTROL_CHARACTERS = /[\u0000-\u001F\u007F-\u009F]/g;
+function stripControls(value) {
+  return value.replace(CONTROL_CHARACTERS, " ");
+}
+function readOwn(source, key) {
+  return Object.hasOwn(source, key) ? source[key] : void 0;
+}
+function readSentence(source, key) {
+  const value = readOwn(source, key);
+  if (typeof value !== "string")
+    return null;
+  const cleaned = stripControls(value).trim();
+  return cleaned === "" ? null : cleaned;
+}
+function safeDocsUrl(value) {
+  if (typeof value !== "string")
+    return null;
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:")
+    return null;
+  return parsed.href;
+}
+function formatApiErrorMessage(status, rawBody) {
+  const verbatim = `getpeppr API error (${status}): ${stripControls(rawBody)}`;
+  let parsed;
+  try {
+    parsed = JSON.parse(rawBody);
+  } catch {
+    return verbatim;
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    return verbatim;
+  }
+  const sentence = readSentence(parsed, "message") ?? readSentence(parsed, "error");
+  if (sentence === null)
+    return verbatim;
+  const link = safeDocsUrl(readOwn(parsed, "docs"));
+  return `getpeppr API error (${status}): ${sentence}${link ? ` See ${link}` : ""}`;
+}
 function isRetryableError(error2) {
   if (error2 instanceof PeppolApiError) {
     return RETRYABLE_STATUS_CODES.has(error2.statusCode);
@@ -1300,7 +1344,7 @@ var GetpepprAdapter = class {
           } catch {
           }
         }
-        throw new PeppolApiError(`getpeppr API error (${response.status}): ${errorBody}`, response.status, errorBody, retryAfterMs);
+        throw new PeppolApiError(formatApiErrorMessage(response.status, errorBody), response.status, errorBody, retryAfterMs);
       }
       if (response.status === 204) {
         if (this.onResponse) {
@@ -1328,7 +1372,17 @@ var GetpepprAdapter = class {
           this.onResponse({
             status: response.status,
             headers: Object.fromEntries(response.headers.entries()),
-            body: responseBody,
+            // GPR-1061 — a COPY, not the live object. The hook used to receive
+            // the very body the parsers then read: a hook that redacts fields
+            // before logging them (an entirely reasonable hook) could delete
+            // `status` and make the SDK blame the gateway for the omission.
+            //
+            // The clone is not guaranteed: structuredClone throws RangeError
+            // past roughly 3000 levels of nesting. Falling back to the live
+            // object would reopen the mutation above, and letting the throw
+            // escape would silently drop the log — the surrounding catch
+            // swallows everything — so the hook fires with a marker instead.
+            body: cloneForHook(responseBody),
             durationMs: Date.now() - startTime,
             timestamp: Date.now()
           });
@@ -1385,8 +1439,13 @@ var GetpepprAdapter = class {
       params.set("include", "lines");
     const query = params.toString() ? `?${params.toString()}` : "";
     const result = await this.request("GET", `/invoices${query}`);
-    const invoices = result.invoices ?? result.data ?? [];
-    const meta = result.meta;
+    const envelope = requireRecordBody(result, "the invoice list");
+    const rows = envelope.invoices ?? envelope.data ?? [];
+    if (!Array.isArray(rows)) {
+      throw new PeppolProtocolError("The getpeppr API answered the invoice list without an array of invoices. Please report this response to support@getpeppr.dev.", "invoices", boundedBody(envelope));
+    }
+    const invoices = rows;
+    const meta = envelope.meta;
     return {
       data: invoices.map(parseInvoiceSummary),
       meta: {
@@ -1398,8 +1457,9 @@ var GetpepprAdapter = class {
       }
     };
   }
-  async getStatus(documentId) {
-    const result = await this.request("GET", `/invoices/${documentId}`);
+  async getStatus(documentId, options) {
+    const query = options?.includeEvidence ? "?include=evidence" : "";
+    const result = await this.request("GET", `/invoices/${documentId}${query}`);
     return parseSendResult(result);
   }
   async lookupDirectory(scheme, id) {
@@ -1479,7 +1539,7 @@ var GetpepprAdapter = class {
           } catch {
           }
         }
-        throw new PeppolApiError(`getpeppr API error (${response.status}): ${errorBody}`, response.status, errorBody, retryAfterMs);
+        throw new PeppolApiError(formatApiErrorMessage(response.status, errorBody), response.status, errorBody, retryAfterMs);
       }
       const responseBody = await response.arrayBuffer();
       if (this.onResponse) {
@@ -1748,21 +1808,67 @@ function detectMimeType(filename) {
       return "application/octet-stream";
   }
 }
-function parseSendResult(result) {
-  const rawStatus = result.status == null ? void 0 : String(result.status);
+var PROTOCOL_ERROR_BODY_LIMIT = 2e3;
+function cloneForHook(body) {
+  try {
+    return structuredClone(body);
+  } catch {
+    return "[response body could not be copied for logging]";
+  }
+}
+function boundedBody(raw) {
+  let serialised;
+  try {
+    serialised = JSON.stringify(raw) ?? String(raw);
+  } catch {
+    serialised = "[unserialisable response body]";
+  }
+  if (serialised.length <= PROTOCOL_ERROR_BODY_LIMIT)
+    return serialised;
+  let head = serialised.slice(0, PROTOCOL_ERROR_BODY_LIMIT);
+  if (/[\uD800-\uDBFF]$/.test(head))
+    head = head.slice(0, -1);
+  return `${head}\u2026 [truncated, ${serialised.length} chars]`;
+}
+function requireRecordBody(raw, surface) {
+  if (isRecord(raw))
+    return raw;
+  throw new PeppolProtocolError(`The getpeppr API answered ${surface} with a body that is not an object. Please report this response to support@getpeppr.dev.`, "body", boundedBody(raw));
+}
+function requireWireStatus(candidate, raw, surface) {
+  if (typeof candidate === "string" && candidate.trim() !== "")
+    return candidate;
+  throw new PeppolProtocolError(`The getpeppr API answered ${surface} without a status. The SDK will not invent one \u2014 please report this response to support@getpeppr.dev.`, "status", boundedBody(raw));
+}
+function optionalWireId(value) {
+  return typeof value === "string" && value.trim() !== "" ? value : void 0;
+}
+function parseSendResult(body) {
+  const result = requireRecordBody(body, "this request");
+  const rawStatus = requireWireStatus(result.status, result, "this request");
   const sendResult = {
     id: String(result.id ?? ""),
-    status: mapStatus(rawStatus ?? "submitted"),
-    peppolMessageId: result.peppolMessageId ?? result.peppol_message_id,
-    createdAt: String(result.createdAt ?? result.updatedAt ?? result.created_at ?? (/* @__PURE__ */ new Date()).toISOString()),
+    status: mapStatus(rawStatus),
+    rawStatus,
+    // A TYPE guard like the identifiers below, not a cast. This line used to
+    // read `as string | undefined`, which types a number as a string and hands
+    // a consumer an AS4 id that never existed.
+    peppolMessageId: optionalWireId(result.peppolMessageId ?? result.peppol_message_id),
     ublXml: result.ublXml,
     warnings: Array.isArray(result.warnings) ? result.warnings : void 0
   };
-  if (rawStatus !== void 0)
-    sendResult.rawStatus = rawStatus;
+  const createdAt = result.createdAt ?? result.created_at;
+  if (createdAt != null)
+    sendResult.createdAt = String(createdAt);
   const detail = parseStatusDetail(result.detail);
   if (detail)
     sendResult.detail = detail;
+  const submissionId = optionalWireId(result.submissionId);
+  if (submissionId)
+    sendResult.submissionId = submissionId;
+  const providerDocumentId = optionalWireId(result.providerDocumentId);
+  if (providerDocumentId)
+    sendResult.providerDocumentId = providerDocumentId;
   return sendResult;
 }
 function parseDirectoryEntry(result) {
@@ -1898,18 +2004,24 @@ function parseLegalEntity(raw) {
   }
   return le;
 }
-function parseInvoiceSummary(raw) {
-  const rawStatus = (raw.state ?? raw.status) == null ? void 0 : String(raw.state ?? raw.status);
+function parseInvoiceSummary(row) {
+  const raw = requireRecordBody(row, "this invoice row");
+  const rawStatus = requireWireStatus(raw.state ?? raw.status, raw, "this invoice row");
   const summary = {
     id: String(raw.id ?? ""),
     number: String(raw.invoiceNumber ?? raw.number ?? ""),
-    status: mapStatus(rawStatus ?? "submitted")
+    status: mapStatus(rawStatus),
+    rawStatus
   };
-  if (rawStatus !== void 0)
-    summary.rawStatus = rawStatus;
   const detail = parseStatusDetail(raw.detail);
   if (detail)
     summary.detail = detail;
+  const submissionId = optionalWireId(raw.submissionId);
+  if (submissionId)
+    summary.submissionId = submissionId;
+  const providerDocumentId = optionalWireId(raw.providerDocumentId);
+  if (providerDocumentId)
+    summary.providerDocumentId = providerDocumentId;
   if (raw.createdAt != null)
     summary.createdAt = String(raw.createdAt);
   if (typeof raw.isCreditNote === "boolean")
@@ -1991,6 +2103,16 @@ var PeppolValidationError = class extends PeppolError {
     this.name = "PeppolValidationError";
   }
 };
+var PeppolProtocolError = class extends PeppolError {
+  field;
+  responseBody;
+  constructor(message, field, responseBody) {
+    super(message);
+    this.field = field;
+    this.responseBody = responseBody;
+    this.name = "PeppolProtocolError";
+  }
+};
 var PeppolApiError = class extends PeppolError {
   statusCode;
   responseBody;
@@ -2026,6 +2148,22 @@ var Peppol = class {
   contacts;
   bankAccounts;
   transports;
+  /**
+   * Sub-tenant Legal Entities — **platform accounts only**.
+   *
+   * Requires a platform account and a **master API key**. With a standard key
+   * every call here fails with 403 `master_key_required`.
+   *
+   * Onboarding your OWN company is not done through this API: your legal entity
+   * is managed in the console, on the Peppol identity page. This surface is for
+   * platforms that onboard their customers as sub-tenants.
+   *
+   * **Getting access:** platform mode is enabled by getpeppr on your account —
+   * email hello@getpeppr.dev to have it switched on. Once it is, you create the
+   * master key yourself at https://console.getpeppr.dev/api-keys.
+   *
+   * @see https://getpeppr.dev/docs/platform/legal-entities/
+   */
   legalEntities;
   constructor(config) {
     if (!config.apiKey) {
@@ -2164,9 +2302,23 @@ ${validation.errors.map((e) => `  - ${e.field}: ${e.message}${e.suggestion ? ` (
   listAll(options) {
     return paginate((offset, limit) => this.adapter.listInvoices({ ...options, offset, limit }), options);
   }
-  /** Get the status of a sent invoice */
-  async getStatus(documentId) {
-    return this.adapter.getStatus(documentId);
+  /**
+   * Get the status of a sent invoice.
+   *
+   * @param options.includeEvidence Ask the gateway to read the sending evidence
+   *   from the Peppol network so the result carries `peppolMessageId`. Costs one
+   *   provider round trip, so it is off by default; if the document has not gone
+   *   out yet, or the read fails, the field is simply absent and everything else
+   *   is unaffected.
+   *
+   * @example
+   * ```ts
+   * const status = await peppol.invoices.getStatus(id);
+   * const proof = await peppol.invoices.getStatus(id, { includeEvidence: true });
+   * ```
+   */
+  async getStatus(documentId, options) {
+    return this.adapter.getStatus(documentId, options);
   }
   /**
    * Export an invoice in a specific format (e.g., PDF, UBL XML).
@@ -2580,6 +2732,13 @@ var LegalEntityOperations = class {
   /**
    * Create a sub-tenant Legal Entity for one of your customers.
    *
+   * **Platform accounts only — requires a master API key.** Platform mode is
+   * enabled by getpeppr: email hello@getpeppr.dev, then create the key at
+   * https://console.getpeppr.dev/api-keys.
+   *
+   * Your own company's legal entity is managed in the console, on the Peppol
+   * identity page; this creates an entity for a customer of yours.
+   *
    * Idempotent on `externalId`: repeated calls with the same `externalId` return
    * the existing entity (HTTP 200) instead of creating a duplicate. Transient 5xx
    * failures are NOT auto-retried unless you pass `options.idempotencyKey`.
@@ -2599,19 +2758,37 @@ var LegalEntityOperations = class {
     return this.adapter.createLegalEntity(input, options);
   }
   /**
-   * Fetch a single sub-tenant Legal Entity by id. For production entities the
-   * `status` reflects the attestation lifecycle (awaiting_authz → attested → active).
+   * Fetch a single sub-tenant Legal Entity by id.
+   *
+   * **Platform accounts only — requires a master API key.** Platform mode is
+   * enabled by getpeppr: email hello@getpeppr.dev, then create the key at
+   * https://console.getpeppr.dev/api-keys.
+   *
+   * For production entities the `status` reflects the attestation lifecycle
+   * (awaiting_authz → attested → active).
    */
   async get(id) {
     return this.adapter.getLegalEntity(id);
   }
-  /** List your sub-tenant Legal Entities, newest first. */
+  /**
+   * List your sub-tenant Legal Entities, newest first.
+   *
+   * **Platform accounts only — requires a master API key.** Platform mode is
+   * enabled by getpeppr: email hello@getpeppr.dev, then create the key at
+   * https://console.getpeppr.dev/api-keys.
+   *
+   * This lists the customers you have onboarded, never your own legal entity.
+   */
   async list(options) {
     return this.adapter.listLegalEntities(options);
   }
   /**
    * Async iterator over all sub-tenant Legal Entities, handling pagination.
    *
+   * **Platform accounts only — requires a master API key.** Platform mode is
+   * enabled by getpeppr: email hello@getpeppr.dev, then create the key at
+   * https://console.getpeppr.dev/api-keys.
+   *
    * @example
    * ```ts
    * for await (const le of peppol.legalEntities.listAll()) console.log(le.id, le.status);
@@ -2620,7 +2797,14 @@ var LegalEntityOperations = class {
   listAll(options) {
     return paginate((offset, limit) => this.adapter.listLegalEntities({ ...options, offset, limit }), options);
   }
-  /** Archive (soft-delete) a sub-tenant Legal Entity. The id stays resolvable for audit. */
+  /**
+   * Archive (soft-delete) a sub-tenant Legal Entity. The id stays resolvable
+   * for audit.
+   *
+   * **Platform accounts only — requires a master API key.** Platform mode is
+   * enabled by getpeppr: email hello@getpeppr.dev, then create the key at
+   * https://console.getpeppr.dev/api-keys.
+   */
   async archive(id) {
     return this.adapter.archiveLegalEntity(id);
   }
@@ -2628,6 +2812,10 @@ var LegalEntityOperations = class {
    * Request a sub-tenant attestation (production only). Emails the co-branded
    * confirmation link to the sub-tenant contact and returns the pending status.
    *
+   * **Platform accounts only — requires a master API key.** Platform mode is
+   * enabled by getpeppr: email hello@getpeppr.dev, then create the key at
+   * https://console.getpeppr.dev/api-keys.
+   *
    * Transient failures are NOT auto-retried unless you pass `options.idempotencyKey`;
    * re-issuing mints a fresh token, so a retried call is safe.
    *
@@ -4051,6 +4239,7 @@ function registerSendCommand(program2) {
     const dashboardUrl = `${DASHBOARD_BASE}/${result.id}`;
     let finalStatus = result.status;
     let timedOut = false;
+    let watchFailed = false;
     if (flags.watch) {
       const onTransition = (s) => {
         if (!flags.quiet && !flags.json) {
@@ -4070,6 +4259,7 @@ function registerSendCommand(program2) {
         const msg = e instanceof Error ? e.message : String(e);
         process.stderr.write(`${pc6.yellow("\u26A0")} Watch error: ${msg}
 `);
+        watchFailed = true;
       }
       if (timedOut) {
         process.stderr.write(
@@ -4090,7 +4280,7 @@ function registerSendCommand(program2) {
       mode
     );
     if (output) process.stdout.write(output + "\n");
-    if (finalStatus === "rejected" || finalStatus === "failed" || finalStatus === "no_action") {
+    if (watchFailed || finalStatus === "rejected" || finalStatus === "failed" || finalStatus === "no_action") {
       process.exit(1);
     }
     process.exit(0);