[yashiels]

• ApiError carries status, method, path (pathname only). The --json error envelope adds details, an allowlist of message/code/error + errors[] {field,message,code}, redacted then truncated, with emails and 9+ digit runs masked. --verbose logs METHOD path -> status.
• Typed cart/card/order calls (authedJson) now throw ApiError through the same path, so a failed cart add shows the server message ("Product in cart is not available anymore.") instead of HTTP 400 [object Object].
• info / skuForPlid: missing buybox retries once (authed when logged in); still missing -> null price/sku + unavailableReason, never R— / sku ?. Missing buybox exits 1, variants still exit 4.

363 tests. Live: invalid cart add and wishlist write show status/method/path/details; info returns price+sku. Oracle signed off (3 rounds).

Closes #38
Closes #39

[sentinel-skyner]

🛡️ Sentinel review

No material correctness or security issues found.

_{Automated review via cursorbridge:gpt-5.3-codex. Findings only — not an approval. Push new commits to re-review.}