[HDLS-696] Fail loudly on silent no-ops in sequences add-contacts and bulk-enrich

[alexander-rykhlitskiap]

Fixes the two items from the external CLI + MCP defect report that are unambiguously ours to fix in the CLI. Triage of the full 11-item report is in HDLS-696; the rest need API/MCP/docs decisions and are tracked there.

Source: Slack thread in #apollo-headless-feedback (report reproduced live against CLI v2.1.0).

1. sequences add-contacts could report success while enrolling nobody

The reporter's launch step returned HTTP 200, exit code 0 with an empty campaign. The response gives it away — one skipped_contact_ids key containing all five ids space-joined:

{"contacts": [],
 "skipped_contact_ids": {"6a9570afd7400f001011956b 6a9570b3087bc9001871f233 …": "contact_not_found"}}

Two independent problems, both fixed:

• Packed ids never reach the API as separate ids. A new normalizeIds helper splits a variadic id option on whitespace and commas, so --contact-id "id1 id2" becomes ["id1", "id2"] instead of one id Apollo cannot match. Applied to --contact-id and --from-email-account on add-contacts, and --contact-id / --sequence-id on remove-contacts. Label options are left alone — label names legitimately contain spaces.
• A 200 with every contact skipped exited 0. summarizeAddContacts now reads the response: every skipped_contact_ids entry is reported on stderr, and the command exits non-zero when nothing was enrolled. An operator running a launch no longer sees exit 0 on an empty campaign.

The stdout payload still prints first and unchanged, so jq pipelines are unaffected.

2. people bulk-enrich --file accepted a file it could not send

--file took a JSON array of any length and passed it straight through; the server rejected anything over 10 with 400 RECORD_LIMIT_EXCEEDED, and the cap was not in --help. The cap is now checked client-side before the request and stated in the command and option help.

I did not auto-chunk, which was the reporter's other suggestion: /people/bulk_match returns counters (total_requested_enrichments, credits_consumed, …) alongside matches, and merging those across batches invents response semantics the API does not define. Failing early with a clear message is the safe half; auto-chunking is worth a follow-up once merge semantics are agreed. Their own 10-per-call script loop worked fine over 1,000 records.

Also folded the duplicated file-reading block in bulk-enrich into the existing readJsonArrayFile helper.

Tests

Unit tests added for normalizeIds (src/utils.test.ts, new) and summarizeAddContacts (src/commands/sequences.test.ts), following the existing pure-builder-plus-vitest pattern.

⚠️ I could not run npm test or npm run typecheck — this was written in a fresh worktree with no node_modules, and the install wasn't available to me. Please run both before approving.

[orca-security-us]

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	Infrastructure as Code	0   0   0   0	View in Orca
Passed	Secrets	0   0   0   0	View in Orca
Passed	Vulnerabilities	0   0   0   0	View in Orca

[kodem-security]

Kodem Security Scan Summary

Status	Check	Issues by Severity	Link
✅ Passed	Code Weakness Security Report	🟧 M: 2   🟨 L: 1	Link to Check

Note: Kai marked all findings as likely false positives.