@topolo/cli 0.12.11 → 0.12.13

package/dist/index.js

@@ -9,7 +9,7 @@ import { platform as platform2 } from "os";
 import { createInterface } from "readline/promises";
 import { stdin as input } from "process";
 
-// node_modules/.pnpm/@topolo+sdk@0.21.4/node_modules/@topolo/sdk/dist/index.js
+// node_modules/.pnpm/@topolo+sdk@0.23.1/node_modules/@topolo/sdk/dist/index.js
 function applyAuthHeaders(headers, credential) {
   if (credential.kind === "api_key") {
     headers.set("X-Api-Key", credential.apiKey);
@@ -83,6 +83,9 @@ var PUBLIC_ERROR_CODES = /* @__PURE__ */ new Set([
   "unknown_service"
 ]);
 var ERROR_CODE_PATTERN = /^[a-z][a-z0-9_]{0,63}$/;
+var SERVICE_ERROR_CODE_PATTERN = /^[a-z][a-z0-9]*(?:_[a-z][a-z0-9]*){1,9}$/;
+var SERVICE_MESSAGE_MAX_LENGTH = 300;
+var SERVICE_ISSUE_LIMIT = 32;
 var TOPOLO_REQUEST_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 var CLOUDFLARE_RAY_ID_PATTERN = /^[0-9a-f]{16}-[A-Z]{3}$/;
 var PERMISSION_PATTERN = /^[a-z][a-z0-9_-]{0,63}(?:\.[a-z][a-z0-9_-]{0,63})*:(?:[a-z][a-z0-9_-]{0,63}|\*)$/;
@@ -107,6 +110,24 @@ function canonicalTopoloErrorCode(value) {
   if (!ERROR_CODE_PATTERN.test(candidate) || !PUBLIC_ERROR_CODES.has(candidate)) return null;
   return candidate;
 }
+function canonicalTopoloServiceErrorCode(value) {
+  const platform4 = canonicalTopoloErrorCode(value);
+  if (platform4) return platform4;
+  if (typeof value !== "string") return null;
+  const candidate = value.trim();
+  if (candidate.length > 64 || !SERVICE_ERROR_CODE_PATTERN.test(candidate)) return null;
+  const wordLike = candidate.split("_").every((segment) => {
+    const digits = segment.replace(/[a-z]/g, "").length;
+    return digits === 0 || digits < segment.length - digits && segment.length <= 8;
+  });
+  return wordLike ? candidate : null;
+}
+function sanitizeTopoloServiceMessage(value) {
+  if (typeof value !== "string") return void 0;
+  const text3 = value.replace(/[\u0000-\u001f\u007f-\u009f\u200b-\u200f\u2028-\u202e\u2066-\u2069\ufeff]/g, " ").replace(/\b[a-z][a-z0-9+.-]*:\/\/\S+/gi, "[url]").replace(/[^\s@<>()[\],;:"']+@[^\s@<>()[\],;:"']+\.[a-z]{2,}/gi, "[email]").replace(/[A-Za-z0-9_\-+/=.]{20,}/g, (run) => /[0-9]/.test(run) && /[A-Za-z]/.test(run) ? "[redacted]" : run).replace(/\s+/g, " ").trim();
+  if (!text3) return void 0;
+  return text3.length > SERVICE_MESSAGE_MAX_LENGTH ? `${text3.slice(0, SERVICE_MESSAGE_MAX_LENGTH - 1).trimEnd()}\u2026` : text3;
+}
 function canonicalTopoloRequestId(value) {
   if (typeof value !== "string") return void 0;
   const candidate = value.trim();
@@ -131,7 +152,7 @@ var TopoloAuthError = class extends TopoloSdkError {
   retryAfter;
   details;
   constructor(message2, code = "auth_error", options = {}) {
-    super(canonicalTopoloErrorCode(code) ?? "auth_error", message2);
+    super(canonicalTopoloServiceErrorCode(code) ?? "auth_error", message2);
     this.name = "TopoloAuthError";
     this.status = options.status ?? 401;
     this.body = options.body;
@@ -155,7 +176,7 @@ var TopoloPermissionError = class extends TopoloSdkError {
   details;
   constructor(message2, required, options = {}) {
     super(
-      canonicalTopoloErrorCode(options.code) ?? serviceErrorCode(options.body, "permission_denied"),
+      canonicalTopoloServiceErrorCode(options.code) ?? serviceErrorCode(options.body, "permission_denied"),
       message2
     );
     this.name = "TopoloPermissionError";
@@ -173,36 +194,49 @@ var TopoloPermissionError = class extends TopoloSdkError {
 };
 function extractTopoloServiceErrorCode(body) {
   if (!body || typeof body !== "object" || Array.isArray(body)) return null;
-  const record2 = body;
-  const topLevel = canonicalTopoloErrorCode(record2.code);
+  const record3 = body;
+  const topLevel = canonicalTopoloServiceErrorCode(record3.code);
   if (topLevel) return topLevel;
-  const nested = record2.error;
-  const nestedString = canonicalTopoloErrorCode(nested);
+  const nested = record3.error;
+  const nestedString = canonicalTopoloServiceErrorCode(nested);
   if (nestedString) return nestedString;
   if (nested && typeof nested === "object" && !Array.isArray(nested)) {
     const code = nested.code;
-    const nestedCode = canonicalTopoloErrorCode(code);
+    const nestedCode = canonicalTopoloServiceErrorCode(code);
     if (nestedCode) return nestedCode;
   }
   return null;
 }
+function extractTopoloServiceErrorMessage(body) {
+  if (!body || typeof body !== "object" || Array.isArray(body)) return void 0;
+  const record3 = body;
+  const nested = record3.error;
+  const candidates = [];
+  if (nested && typeof nested === "object" && !Array.isArray(nested)) {
+    candidates.push(nested.message);
+  }
+  candidates.push(record3.message, record3.error_description);
+  if (typeof nested === "string" && !canonicalTopoloServiceErrorCode(nested)) candidates.push(nested);
+  for (const candidate of candidates) {
+    const message2 = sanitizeTopoloServiceMessage(candidate);
+    if (message2) return message2;
+  }
+  return void 0;
+}
 function serviceErrorCode(body, fallback) {
   return extractTopoloServiceErrorCode(body) ?? fallback;
 }
 function extractTopoloServiceErrorDetails(body) {
   if (!body || typeof body !== "object" || Array.isArray(body)) return void 0;
-  const record2 = body;
-  let candidate = record2.details;
-  const nested = record2.error;
+  const record3 = body;
+  let candidate = record3.details;
+  const nested = record3.error;
   if (nested && typeof nested === "object" && !Array.isArray(nested)) {
     const nestedRecord = nested;
     if (candidate === void 0) candidate = nestedRecord.details ?? nestedRecord;
   }
-  if (candidate === void 0) candidate = record2;
-  if (Array.isArray(candidate)) {
-    const paths = canonicalTopoloValidationPaths(candidate);
-    return paths.length ? { paths } : void 0;
-  }
+  if (candidate === void 0) candidate = record3;
+  if (Array.isArray(candidate)) return validationIssueDetails(canonicalTopoloValidationIssues(candidate)) ?? void 0;
   if (!candidate || typeof candidate !== "object") return void 0;
   const source = candidate;
   const safe = {};
@@ -244,18 +278,59 @@ function extractTopoloServiceErrorDetails(body) {
       if (paths.length) safe[key] = paths;
     }
   }
+  const issues = [
+    ...Array.isArray(source.issues) ? canonicalTopoloValidationIssues(source.issues) : [],
+    ...flattenedValidationIssues(source.formErrors, source.fieldErrors)
+  ].slice(0, SERVICE_ISSUE_LIMIT);
+  Object.assign(safe, validationIssueDetails(issues));
   return Object.keys(safe).length ? safe : void 0;
 }
-function canonicalTopoloValidationPaths(issues) {
+function validationIssueDetails(issues) {
+  if (!issues.length) return null;
   const paths = [];
-  for (const issue of issues) {
-    if (!issue || typeof issue !== "object" || Array.isArray(issue)) continue;
-    const record2 = issue;
-    const path = canonicalTopoloValidationPath(record2.field) ?? canonicalTopoloValidationPath(record2.path);
-    if (path && !paths.includes(path)) paths.push(path);
-    if (paths.length === 32) break;
+  for (const issue22 of issues) {
+    if (issue22.path && !paths.includes(issue22.path)) paths.push(issue22.path);
+  }
+  return paths.length ? { paths, issues } : { issues };
+}
+function issue(path, message2) {
+  const text3 = sanitizeTopoloServiceMessage(message2);
+  if (!path && !text3) return null;
+  return { ...path ? { path } : {}, ...text3 ? { message: text3 } : {} };
+}
+function canonicalTopoloValidationIssues(values) {
+  const issues = [];
+  for (const value of values) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) continue;
+    const record3 = value;
+    const path = canonicalTopoloValidationPath(record3.field) ?? canonicalTopoloValidationPath(record3.path);
+    if (!path) continue;
+    const projected = issue(path, record3.message);
+    if (projected) issues.push(projected);
+    if (issues.length === SERVICE_ISSUE_LIMIT) break;
+  }
+  return issues;
+}
+function flattenedValidationIssues(formErrors, fieldErrors) {
+  const issues = [];
+  if (Array.isArray(formErrors)) {
+    for (const message2 of formErrors) {
+      const projected = issue(void 0, message2);
+      if (projected) issues.push(projected);
+    }
+  }
+  if (fieldErrors && typeof fieldErrors === "object" && !Array.isArray(fieldErrors)) {
+    for (const [key, messages] of Object.entries(fieldErrors)) {
+      const path = canonicalTopoloValidationPath(key);
+      if (!path) continue;
+      const list = Array.isArray(messages) && messages.length ? messages : [void 0];
+      for (const message2 of list) {
+        const projected = issue(path, message2);
+        if (projected) issues.push(projected);
+      }
+    }
   }
-  return paths;
+  return issues;
 }
 function canonicalTopoloValidationPath(value) {
   if (typeof value === "string") {
@@ -277,7 +352,9 @@ function canonicalTopoloValidationPath(value) {
   return PUBLIC_FIELD_PATH_PATTERN.test(path) ? path : void 0;
 }
 function publicTopoloErrorMessage(error) {
-  const code = canonicalTopoloErrorCode(
+  const serviceMessage = typeof error === "string" ? void 0 : extractTopoloServiceErrorMessage(error.body);
+  if (serviceMessage) return serviceMessage;
+  const code = canonicalTopoloServiceErrorCode(
     typeof error === "string" ? error : error.code ?? extractTopoloServiceErrorCode(error.body)
   ) ?? "request_failed";
   if (/(?:organization|org).*(?:enroll|membership|member|admission)/.test(code)) {
@@ -294,7 +371,7 @@ function publicTopoloErrorMessage(error) {
   return `Topolo request failed (${code}).`;
 }
 function topoloErrorHint(error) {
-  const code = canonicalTopoloErrorCode(
+  const code = canonicalTopoloServiceErrorCode(
     typeof error === "string" ? error : error.code ?? extractTopoloServiceErrorCode(error.body)
   );
   if (!code) return void 0;
@@ -360,8 +437,8 @@ function sensitive(key, value) {
   const normalized = key.toLowerCase().replace(/[^a-z0-9]/g, "");
   if (normalized === "capability") {
     if (typeof value !== "string") return value !== null && value !== void 0 && typeof value !== "boolean" && typeof value !== "number";
-    const text2 = value.trim();
-    return Boolean(text2) && !/^[a-z][a-z0-9_-]{0,31}$/.test(text2);
+    const text3 = value.trim();
+    return Boolean(text3) && !/^[a-z][a-z0-9_-]{0,31}$/.test(text3);
   }
   return ["authorization", "cookie", "setcookie", "proxyauthorization"].includes(normalized) || /(token|secret|password|privatekey|apikey)$/.test(normalized);
 }
@@ -645,7 +722,7 @@ function inspectSchema(schema, path, root, depth) {
   if (unsupportedKeyword) {
     return { path, code: "unsupported_schema_keyword", message: `Action schema uses unsupported keyword ${unsupportedKeyword}.` };
   }
-  if (typeof schema.format === "string" && !["uri", "email", "date-time"].includes(schema.format)) {
+  if (typeof schema.format === "string" && !["uri", "email", "date-time", "uuid"].includes(schema.format)) {
     return { path, code: "unsupported_schema_format", message: `Action schema uses unsupported format ${schema.format}.` };
   }
   if (typeof schema.$ref === "string" && !resolveLocalReference(root, schema.$ref)) {
@@ -665,8 +742,8 @@ function inspectSchema(schema, path, root, depth) {
   );
   for (const [key, child] of children) {
     if (!isRecord2(child)) continue;
-    const issue = inspectSchema(child, `${path}.${key}`, root, depth + 1);
-    if (issue) return issue;
+    const issue22 = inspectSchema(child, `${path}.${key}`, root, depth + 1);
+    if (issue22) return issue22;
   }
   return null;
 }
@@ -782,6 +859,7 @@ function validateString(schema, value, path, errors) {
   if (schema.format === "uri" && !isUrl(value)) errors.push({ path, code: "format_uri", message: "Expected an absolute URL." });
   if (schema.format === "email" && !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(value)) errors.push({ path, code: "format_email", message: "Expected an email address." });
   if (schema.format === "date-time" && !isDateTime(value)) errors.push({ path, code: "format_date_time", message: "Expected an ISO-8601 date-time." });
+  if (schema.format === "uuid" && (value.length !== 36 || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value))) errors.push({ path, code: "format_uuid", message: "Expected a hyphenated UUID." });
 }
 function validateNumber(schema, value, path, errors) {
   if (typeof schema.minimum === "number" && value < schema.minimum) errors.push({ path, code: "minimum", message: `Expected a value of at least ${schema.minimum}.` });
@@ -1839,14 +1917,14 @@ var TopoloClient = class _TopoloClient {
     if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
       throw new TopoloSdkError("action_catalog_summary_unavailable", "Action catalog summary is unavailable.");
     }
-    const record2 = raw;
-    if (record2.algorithm !== "sha256-v1" || typeof record2.digest !== "string" || !/^[a-f0-9]{64}$/.test(record2.digest) || !Number.isSafeInteger(record2.actionCount) || Number(record2.actionCount) < 0) {
+    const record3 = raw;
+    if (record3.algorithm !== "sha256-v1" || typeof record3.digest !== "string" || !/^[a-f0-9]{64}$/.test(record3.digest) || !Number.isSafeInteger(record3.actionCount) || Number(record3.actionCount) < 0) {
       throw new TopoloSdkError("action_catalog_summary_unavailable", "Action catalog summary is invalid.");
     }
     return {
       algorithm: "sha256-v1",
-      digest: record2.digest,
-      actionCount: Number(record2.actionCount)
+      digest: record3.digest,
+      actionCount: Number(record3.actionCount)
     };
   }
   /** @deprecated Prefer searchActions() so callers retain the continuation cursor. */
@@ -1982,7 +2060,7 @@ var TopoloClient = class _TopoloClient {
       input: selectedInput,
       inputSource: input2 ? "provided" : example ? "example" : "empty",
       missingFields: [...new Set(
-        plan.validation.errors.filter((issue) => issue.code === "required").map((issue) => issue.path)
+        plan.validation.errors.filter((issue22) => issue22.code === "required").map((issue22) => issue22.path)
       )],
       plan
     };
@@ -2047,7 +2125,7 @@ var TopoloClient = class _TopoloClient {
     if (!validation.valid) {
       throw new TopoloSdkError(
         "invalid_action_input",
-        `Topolo action "${entry.actionId}" input is invalid: ${validation.errors.map((issue) => `${issue.path} ${issue.message}`).join("; ")}`
+        `Topolo action "${entry.actionId}" input is invalid: ${validation.errors.map((issue22) => `${issue22.path} ${issue22.message}`).join("; ")}`
       );
     }
     const resourceIssue = validateActionResource(entry, options.resource);
@@ -2564,10 +2642,10 @@ function extractRequired(body) {
     if (Array.isArray(maybe.required)) return canonicalTopoloRequired(maybe.required);
     for (const nested of [maybe.details, maybe.error]) {
       if (!nested || typeof nested !== "object" || Array.isArray(nested)) continue;
-      const record2 = nested;
-      if (Array.isArray(record2.required)) return canonicalTopoloRequired(record2.required);
-      if (record2.details && typeof record2.details === "object" && !Array.isArray(record2.details)) {
-        const required = record2.details.required;
+      const record3 = nested;
+      if (Array.isArray(record3.required)) return canonicalTopoloRequired(record3.required);
+      if (record3.details && typeof record3.details === "object" && !Array.isArray(record3.details)) {
+        const required = record3.details.required;
         if (Array.isArray(required)) return canonicalTopoloRequired(required);
       }
     }
@@ -2642,8 +2720,8 @@ function compactResultValue(value, depth, budget) {
     return value.length > ACTION_RESULT_MAX_ITEMS ? { count: value.length, items, omittedItems: value.length - ACTION_RESULT_MAX_ITEMS } : items;
   }
   if (typeof value === "object") {
-    const record2 = value;
-    const allKeys = Object.keys(record2);
+    const record3 = value;
+    const allKeys = Object.keys(record3);
     const ranked = allKeys.sort((left, right) => resultKeyPriority(left) - resultKeyPriority(right));
     const prioritized = ranked.filter((key) => resultKeyPriority(key) < 2);
     const ordinary = ranked.filter((key) => resultKeyPriority(key) === 2);
@@ -2652,7 +2730,7 @@ function compactResultValue(value, depth, budget) {
       ...prioritized,
       ...ordinary.slice(0, ordinaryLimit)
     ].slice(0, ACTION_RESULT_MAX_KEYS);
-    const compact = Object.fromEntries(keys.map((key) => [key, compactResultValue(record2[key], depth + 1, budget)]));
+    const compact = Object.fromEntries(keys.map((key) => [key, compactResultValue(record3[key], depth + 1, budget)]));
     if (allKeys.length > keys.length) compact["_omittedKeys"] = allKeys.length - keys.length;
     return compact;
   }
@@ -3416,7 +3494,7 @@ function createTopolo(options) {
   };
 }
 
-// node_modules/.pnpm/@topolo+sdk@0.21.4/node_modules/@topolo/sdk/dist/node/credential-store.js
+// node_modules/.pnpm/@topolo+sdk@0.23.1/node_modules/@topolo/sdk/dist/node/credential-store.js
 import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2, chmod as chmod2, rm as rm2, stat } from "fs/promises";
 import { existsSync as existsSync2 } from "fs";
 import { homedir as homedir2, platform } from "os";
@@ -3483,6 +3561,9 @@ var PUBLIC_ERROR_CODES2 = /* @__PURE__ */ new Set([
   "unknown_service"
 ]);
 var ERROR_CODE_PATTERN2 = /^[a-z][a-z0-9_]{0,63}$/;
+var SERVICE_ERROR_CODE_PATTERN2 = /^[a-z][a-z0-9]*(?:_[a-z][a-z0-9]*){1,9}$/;
+var SERVICE_MESSAGE_MAX_LENGTH2 = 300;
+var SERVICE_ISSUE_LIMIT2 = 32;
 var TOPOLO_REQUEST_ID_PATTERN2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 var CLOUDFLARE_RAY_ID_PATTERN2 = /^[0-9a-f]{16}-[A-Z]{3}$/;
 var PERMISSION_PATTERN2 = /^[a-z][a-z0-9_-]{0,63}(?:\.[a-z][a-z0-9_-]{0,63})*:(?:[a-z][a-z0-9_-]{0,63}|\*)$/;
@@ -3507,6 +3588,24 @@ function canonicalTopoloErrorCode2(value) {
   if (!ERROR_CODE_PATTERN2.test(candidate) || !PUBLIC_ERROR_CODES2.has(candidate)) return null;
   return candidate;
 }
+function canonicalTopoloServiceErrorCode2(value) {
+  const platform22 = canonicalTopoloErrorCode2(value);
+  if (platform22) return platform22;
+  if (typeof value !== "string") return null;
+  const candidate = value.trim();
+  if (candidate.length > 64 || !SERVICE_ERROR_CODE_PATTERN2.test(candidate)) return null;
+  const wordLike = candidate.split("_").every((segment) => {
+    const digits = segment.replace(/[a-z]/g, "").length;
+    return digits === 0 || digits < segment.length - digits && segment.length <= 8;
+  });
+  return wordLike ? candidate : null;
+}
+function sanitizeTopoloServiceMessage2(value) {
+  if (typeof value !== "string") return void 0;
+  const text2 = value.replace(/[\u0000-\u001f\u007f-\u009f\u200b-\u200f\u2028-\u202e\u2066-\u2069\ufeff]/g, " ").replace(/\b[a-z][a-z0-9+.-]*:\/\/\S+/gi, "[url]").replace(/[^\s@<>()[\],;:"']+@[^\s@<>()[\],;:"']+\.[a-z]{2,}/gi, "[email]").replace(/[A-Za-z0-9_\-+/=.]{20,}/g, (run) => /[0-9]/.test(run) && /[A-Za-z]/.test(run) ? "[redacted]" : run).replace(/\s+/g, " ").trim();
+  if (!text2) return void 0;
+  return text2.length > SERVICE_MESSAGE_MAX_LENGTH2 ? `${text2.slice(0, SERVICE_MESSAGE_MAX_LENGTH2 - 1).trimEnd()}\u2026` : text2;
+}
 function canonicalTopoloRequestId2(value) {
   if (typeof value !== "string") return void 0;
   const candidate = value.trim();
@@ -3531,7 +3630,7 @@ var TopoloAuthError2 = class extends TopoloSdkError2 {
   retryAfter;
   details;
   constructor(message2, code = "auth_error", options = {}) {
-    super(canonicalTopoloErrorCode2(code) ?? "auth_error", message2);
+    super(canonicalTopoloServiceErrorCode2(code) ?? "auth_error", message2);
     this.name = "TopoloAuthError";
     this.status = options.status ?? 401;
     this.body = options.body;
@@ -3547,14 +3646,14 @@ var TopoloAuthError2 = class extends TopoloSdkError2 {
 function extractTopoloServiceErrorCode2(body) {
   if (!body || typeof body !== "object" || Array.isArray(body)) return null;
   const record2 = body;
-  const topLevel = canonicalTopoloErrorCode2(record2.code);
+  const topLevel = canonicalTopoloServiceErrorCode2(record2.code);
   if (topLevel) return topLevel;
   const nested = record2.error;
-  const nestedString = canonicalTopoloErrorCode2(nested);
+  const nestedString = canonicalTopoloServiceErrorCode2(nested);
   if (nestedString) return nestedString;
   if (nested && typeof nested === "object" && !Array.isArray(nested)) {
     const code = nested.code;
-    const nestedCode = canonicalTopoloErrorCode2(code);
+    const nestedCode = canonicalTopoloServiceErrorCode2(code);
     if (nestedCode) return nestedCode;
   }
   return null;
@@ -3572,10 +3671,7 @@ function extractTopoloServiceErrorDetails2(body) {
     if (candidate === void 0) candidate = nestedRecord.details ?? nestedRecord;
   }
   if (candidate === void 0) candidate = record2;
-  if (Array.isArray(candidate)) {
-    const paths = canonicalTopoloValidationPaths2(candidate);
-    return paths.length ? { paths } : void 0;
-  }
+  if (Array.isArray(candidate)) return validationIssueDetails2(canonicalTopoloValidationIssues2(candidate)) ?? void 0;
   if (!candidate || typeof candidate !== "object") return void 0;
   const source = candidate;
   const safe = {};
@@ -3617,18 +3713,59 @@ function extractTopoloServiceErrorDetails2(body) {
       if (paths.length) safe[key] = paths;
     }
   }
+  const issues = [
+    ...Array.isArray(source.issues) ? canonicalTopoloValidationIssues2(source.issues) : [],
+    ...flattenedValidationIssues2(source.formErrors, source.fieldErrors)
+  ].slice(0, SERVICE_ISSUE_LIMIT2);
+  Object.assign(safe, validationIssueDetails2(issues));
   return Object.keys(safe).length ? safe : void 0;
 }
-function canonicalTopoloValidationPaths2(issues) {
+function validationIssueDetails2(issues) {
+  if (!issues.length) return null;
   const paths = [];
-  for (const issue of issues) {
-    if (!issue || typeof issue !== "object" || Array.isArray(issue)) continue;
-    const record2 = issue;
+  for (const issue22 of issues) {
+    if (issue22.path && !paths.includes(issue22.path)) paths.push(issue22.path);
+  }
+  return paths.length ? { paths, issues } : { issues };
+}
+function issue2(path, message2) {
+  const text2 = sanitizeTopoloServiceMessage2(message2);
+  if (!path && !text2) return null;
+  return { ...path ? { path } : {}, ...text2 ? { message: text2 } : {} };
+}
+function canonicalTopoloValidationIssues2(values) {
+  const issues = [];
+  for (const value of values) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) continue;
+    const record2 = value;
     const path = canonicalTopoloValidationPath2(record2.field) ?? canonicalTopoloValidationPath2(record2.path);
-    if (path && !paths.includes(path)) paths.push(path);
-    if (paths.length === 32) break;
+    if (!path) continue;
+    const projected = issue2(path, record2.message);
+    if (projected) issues.push(projected);
+    if (issues.length === SERVICE_ISSUE_LIMIT2) break;
   }
-  return paths;
+  return issues;
+}
+function flattenedValidationIssues2(formErrors, fieldErrors) {
+  const issues = [];
+  if (Array.isArray(formErrors)) {
+    for (const message2 of formErrors) {
+      const projected = issue2(void 0, message2);
+      if (projected) issues.push(projected);
+    }
+  }
+  if (fieldErrors && typeof fieldErrors === "object" && !Array.isArray(fieldErrors)) {
+    for (const [key, messages] of Object.entries(fieldErrors)) {
+      const path = canonicalTopoloValidationPath2(key);
+      if (!path) continue;
+      const list = Array.isArray(messages) && messages.length ? messages : [void 0];
+      for (const message2 of list) {
+        const projected = issue2(path, message2);
+        if (projected) issues.push(projected);
+      }
+    }
+  }
+  return issues;
 }
 function canonicalTopoloValidationPath2(value) {
   if (typeof value === "string") {
@@ -4462,6 +4599,10 @@ function fail2(err, mode) {
 `);
     if (payload.status) process.stderr.write(`HTTP:  ${payload.status}
 `);
+    for (const issue3 of validationIssues(payload.details)) {
+      process.stderr.write(`Issue: ${[issue3.path, issue3.message].filter(Boolean).join(": ")}
+`);
+    }
     if (payload.requestId) process.stderr.write(`Request: ${payload.requestId}
 `);
     if (payload.hint) process.stderr.write(`Hint:  ${payload.hint}
@@ -4469,6 +4610,10 @@ function fail2(err, mode) {
   }
   process.exit(payload.exitCode);
 }
+function validationIssues(details) {
+  const issues = details?.issues;
+  return Array.isArray(issues) ? issues : [];
+}
 function normalizeError(err) {
   if (err instanceof Error) {
     const code = err.code;
@@ -4486,9 +4631,9 @@ function normalizeError(err) {
       path: err.path,
       requestId: err.requestId,
       retryAfter: err.retryAfter,
-      details: extractTopoloServiceErrorDetails(
-        suppliedDetails === void 0 ? body : { details: suppliedDetails }
-      ),
+      // SDK HTTP errors already carry sanitized details; projecting them again
+      // would drop form-level issues that have no field path.
+      details: err instanceof TopoloHttpError || err instanceof TopoloAuthError || err instanceof TopoloPermissionError ? err.details : extractTopoloServiceErrorDetails(suppliedDetails === void 0 ? body : { details: suppliedDetails }),
       hint: topoloErrorHint({ code, body }) ?? (code ? fallbackHintMap[code] : void 0),
       exitCode: status === 401 || code === "auth_error" || code === "confirmation_required" ? 2 : status === 403 || code === "permission_denied" ? 3 : code === "immutable_drift" ? 4 : 1
     };
@@ -4833,7 +4978,7 @@ function stderrDebugLogger(event) {
     return;
   }
   const statusPart = event.status ? ` ${event.status}` : "";
-  const errorCode = canonicalTopoloErrorCode(event.error) ?? "request_failed";
+  const errorCode = canonicalTopoloServiceErrorCode(event.error) ?? "request_failed";
   process.stderr.write(
     `[topolo] \u2717${statusPart} ${event.method} ${event.service} ${event.path} (${event.durationMs}ms, req=${requestId}, code=${errorCode})
 `
@@ -5087,7 +5232,7 @@ Approval required. ${opened ? "Opening" : "Open"} ${approval.verificationUrl}` :
       const topolo = await requiredClient();
       const result = await topolo.client.validateActionInput(action, parseJsonObject(opts.data || "{}"));
       const output = detailRequested(opts.detail, command) ? result : compactActionValidation(result.action.actionId, result.validation);
-      emit(output, mode, () => result.validation.valid ? `Valid input for ${result.action.actionId}.` : result.validation.errors.map((issue) => `${issue.path}: ${issue.message}`).join("\n"));
+      emit(output, mode, () => result.validation.valid ? `Valid input for ${result.action.actionId}.` : result.validation.errors.map((issue3) => `${issue3.path}: ${issue3.message}`).join("\n"));
     } catch (err) {
       fail2(err, mode);
     }
@@ -5367,7 +5512,7 @@ function formatActionPlan(plan) {
   ];
   if (plan.request) lines.push(`Request:      ${plan.request.method} ${plan.request.apiBaseUrl || plan.request.service}${plan.request.path}`);
   if (plan.request?.resource) lines.push(`Resource:     ${plan.request.resource.resourceType}:${plan.request.resource.resourceId}`);
-  if (plan.validation.errors.length) lines.push("", ...plan.validation.errors.map((issue) => `${issue.path}: ${issue.message}`));
+  if (plan.validation.errors.length) lines.push("", ...plan.validation.errors.map((issue3) => `${issue3.path}: ${issue3.message}`));
   if (plan.verification.length) lines.push("", "Verify:", ...plan.verification.map((step) => `- ${step}`));
   if (plan.rollbackActionId) lines.push("", `Rollback: ${plan.rollbackActionId}`);
   return lines.join("\n");

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@topolo/cli",
   "packageManager": "pnpm@10.17.1",
-  "version": "0.12.11",
-  "topoloPublishedVersion": "0.12.11",
+  "version": "0.12.13",
+  "topoloPublishedVersion": "0.12.13",
   "description": "Public command-line interface for Topolo customer organizations, developers, and agents.",
   "license": "UNLICENSED",
   "author": "Topolo",
@@ -28,8 +28,8 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
-    "@topolo/mcp": "0.14.4",
-    "@topolo/sdk": "0.21.4",
+    "@topolo/mcp": "0.14.6",
+    "@topolo/sdk": "0.23.1",
     "commander": "^12.1.0"
   },
   "devDependencies": {

package/skills/topolo/SKILL.md

@@ -289,6 +289,8 @@ In JSON mode, branch on `error.code`, not message text:
 - exit 3 / permission denied: surface the missing permission or target denial; do not retry or widen access.
 - `invalid_action_input`: correct only the reported schema paths.
 - `confirmation_required`: plan, obtain approval, then retry once with confirmation.
+- a service-published refusal code (for example `outreach_requires_mailbox_sender`): apply that action's published recovery for the code; `error.message` is the service's sanitized explanation and `error.details.issues` lists field-level problems.
+- `http_error`: the service returned no structured code; use `status` and `requestId`.
 - unknown action/service: repeat bounded discovery; never substitute a guessed identifier.
 - missing docs/schema/examples/verification/recovery: stop the affected operation and report the missing publication contract.