@automattic/vip 4.0.3 → 4.0.6

package/AGENTS.md

@@ -96,3 +96,5 @@ Guide for future agents working on this codebase. Focus on traps, cross-cutting
 - Respect exit semantics: uncaught exceptions routed to `exit.withError`; GraphQL errors call `process.exit(1)` unless explicitly disabled; 401 auth errors exit with guidance.
 - Watch shared state: current implementation mutates a global; ensure new parser avoids cross-command bleeding when multiple command instances run in-process (tests/CLI wrappers).
 - Login guardrails in `vip.js` let certain commands bypass auth; preserve equivalent shortcuts or add explicit non-interactive flags for CI.
+- Normalize short-option equals syntax: rewrite `-x=value` to `-x value` before parsing for short options that expect values; track which short options take values to avoid breaking boolean flags that should remain flag-only.
+- Apply tracked defaults after parsing: when an option has both a default and a custom parser function, apply the default only when `opts[optionName] === undefined` after the parser runs, so that explicit values and defaults maintain parity with the parser contract (see test `parses short options using equals syntax without prefixing values` in `__tests__/lib/cli/command.js`).

package/dist/bin/vip-app-deploy-token-generate.js

@@ -0,0 +1,102 @@
+#!/usr/bin/env node
+"use strict";
+
+exports.__esModule = true;
+exports.appDeployTokenGenerateCmd = appDeployTokenGenerateCmd;
+var _graphqlTag = _interopRequireDefault(require("graphql-tag"));
+var _api = _interopRequireDefault(require("../lib/api"));
+var _command = _interopRequireDefault(require("../lib/cli/command"));
+var exit = _interopRequireWildcard(require("../lib/cli/exit"));
+var _tracker = require("../lib/tracker");
+var _utils = require("../lib/utils");
+function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
+const usage = 'vip app deploy-token generate';
+const examples = [{
+  usage: 'vip @example-app.develop app deploy-token generate',
+  description: 'Generate a custom deploy access token for the selected environment.'
+}, {
+  usage: 'vip @example-app.develop app deploy-token generate --format=json',
+  description: 'Generate a custom deploy access token and print the result as JSON.'
+}];
+const appQuery = `
+	id,
+	name,
+	environments{
+		id
+		appId
+		type
+		name
+		uniqueLabel
+	}
+`;
+const GENERATE_CUSTOM_DEPLOY_ACCESS_MUTATION = (0, _graphqlTag.default)`
+	mutation GenerateCustomDeployAccess($input: GenerateCustomDeployAccessInput) {
+		generateCustomDeployAccess(input: $input) {
+			token
+			expiresAt
+		}
+	}
+`;
+async function appDeployTokenGenerateCmd(_arg, {
+  app,
+  env
+}) {
+  const trackerFn = (0, _tracker.makeCommandTracker)('deploy_token_generate', {
+    app: app.id,
+    env: env.uniqueLabel
+  });
+  await trackerFn('execute');
+  const envId = env.id;
+  if (typeof envId !== 'number') {
+    await trackerFn('error', {
+      error: 'Missing environment id'
+    });
+    exit.withError('Failed to generate deploy token: environment id is missing.');
+    return;
+  }
+  const api = (0, _api.default)();
+  let response;
+  try {
+    response = await api.mutate({
+      mutation: GENERATE_CUSTOM_DEPLOY_ACCESS_MUTATION,
+      variables: {
+        input: {
+          environmentIds: [envId]
+        }
+      }
+    });
+  } catch (err) {
+    const message = (0, _utils.parseApiError)(err) ?? 'Unknown error';
+    await trackerFn('error', {
+      error: message
+    });
+    exit.withError(`Failed to generate deploy token: ${message}`);
+    return;
+  }
+  const tokenPayload = response.data?.generateCustomDeployAccess;
+  if (!tokenPayload?.token || !tokenPayload.expiresAt) {
+    await trackerFn('error', {
+      error: 'Missing generateCustomDeployAccess payload'
+    });
+    exit.withError('Failed to generate deploy token: API returned an empty response.');
+    return;
+  }
+  await trackerFn('success');
+  return [{
+    appId: app.id,
+    appName: app.name,
+    envId,
+    env: env.uniqueLabel,
+    token: tokenPayload.token,
+    expiresAt: tokenPayload.expiresAt
+  }];
+}
+void (0, _command.default)({
+  appContext: true,
+  appQuery,
+  envContext: true,
+  format: true,
+  requiredArgs: 0,
+  usage
+}).examples(examples).argv(process.argv, appDeployTokenGenerateCmd);

package/dist/bin/vip-app-deploy-token.js

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+"use strict";
+
+var _command = _interopRequireDefault(require("../lib/cli/command"));
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
+const usage = 'vip app deploy-token';
+const exampleUsage = 'vip @example-app.develop app deploy-token';
+const examples = [{
+  usage: `${exampleUsage} generate`,
+  description: 'Generate a custom deploy access token for an environment that already has Custom Deployment enabled.'
+}, {
+  usage: `${exampleUsage} generate --format=json | jq -r '.[0].token'`,
+  description: 'Generate a token and extract the token value for scripting workflows.'
+}];
+void (0, _command.default)({
+  requiredArgs: 0,
+  usage
+}).command('generate', 'Generate a custom deploy access token for an environment.').examples(examples).argv(process.argv, () => {
+  process.exit(0);
+});

package/dist/bin/vip-app-deploy.js

@@ -79,6 +79,9 @@ async function appDeployCmd(arg = [], opts = {}) {
   const track = _tracker.trackEventWithEnv.bind(null, appId, envId);
   debug('Validating file...');
   await (0, _customDeploy.validateFile)(appId, envId, fileMeta);
+  if (!opts.skipLargeFileValidation) {
+    await (0, _customDeploy.validateLargeArchiveFiles)(appId, envId, fileMeta);
+  }
   await track('deploy_app_command_execute');
 
   // Upload file as different name to avoid overwriting existing same named files
@@ -229,8 +232,11 @@ const examples = [
 }, {
   usage: 'WPVIP_DEPLOY_TOKEN=1234 vip @example-app.develop app deploy file.tar.gz --skip-confirmation',
   description: 'Skip the confirmation prompt for the Custom Deployment of the archived file named "file.tar.gz" to the environment.'
+}, {
+  usage: 'WPVIP_DEPLOY_TOKEN=1234 vip @example-app.develop app deploy file.zip --skip-large-file-validation',
+  description: 'Skip checking the deploy archive for repository archive files larger than 20 MB.'
 }];
 void (0, _command.default)({
   requiredArgs: 1,
   usage: baseUsage
-}).command('validate', 'Validate the directory structure of an archived file.').examples(examples).option('message', 'Add a description of a deployment.').option('skip-confirmation', 'Skip the confirmation prompt.').option('force', 'Skip confirmation prompt (deprecated)').option('app', 'Target an application. Accepts a string value for the application name or an integer for the application ID.').option('env', 'Target an environment. Accepts a string value for the environment type.').argv(process.argv, appDeployCmd);
+}).command('validate', 'Validate the directory structure of an archived file.').examples(examples).option('message', 'Add a description of a deployment.').option('skip-confirmation', 'Skip the confirmation prompt.').option('skip-large-file-validation', 'Skip checking for repository archive files over 20 MB.', false).option('force', 'Skip confirmation prompt (deprecated)').option('app', 'Target an application. Accepts a string value for the application name or an integer for the application ID.').option('env', 'Target an environment. Accepts a string value for the environment type.').argv(process.argv, appDeployCmd);

package/dist/bin/vip-app.js

@@ -11,7 +11,7 @@ function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e
 (0, _command.default)({
   requiredArgs: 1,
   format: true
-}).example('vip app list', 'Retrieve a list of applications that can be accessed by the current authenticated VIP-CLI user.').example('vip app example-app', 'Retrieve information about the application named "example-app" and its environments.').example('WPVIP_DEPLOY_TOKEN=1234 vip @example-app.develop app deploy file.zip', 'Deploy a local archived file named "file.zip" that contains application code to a VIP Platform environment that has Custom Deployment enabled.').command('list', 'Retrieve a list of applications that can be accessed by the current authenticated VIP-CLI user.').command('deploy', 'Deploy an archived file of application code to an environment that has Custom Deployment enabled.').argv(process.argv, async arg => {
+}).example('vip app list', 'Retrieve a list of applications that can be accessed by the current authenticated VIP-CLI user.').example('vip app example-app', 'Retrieve information about the application named "example-app" and its environments.').example('WPVIP_DEPLOY_TOKEN=1234 vip @example-app.develop app deploy file.zip', 'Deploy a local archived file named "file.zip" that contains application code to a VIP Platform environment that has Custom Deployment enabled.').example('vip @example-app.develop app deploy-token generate --format=json', 'Generate a custom deploy token for the environment and print it in JSON format for use with tools like jq.').command('list', 'Retrieve a list of applications that can be accessed by the current authenticated VIP-CLI user.').command('deploy', 'Deploy an archived file of application code to an environment that has Custom Deployment enabled.').command('deploy-token', 'Generate and manage custom deploy access tokens for environments that have Custom Deployment enabled.').argv(process.argv, async arg => {
   await (0, _tracker.trackEvent)('app_command_execute');
   let res;
   try {

package/dist/bin/vip-dev-env-update.js

@@ -53,7 +53,6 @@ cmd.argv(process.argv, async (arg, opt) => {
       ...opt
     };
     const configurationFileOptions = await (0, _devEnvironmentConfigurationFile.getConfigurationFileOptions)();
-    const thereAreOptionsFromConfigFile = Object.keys(configurationFileOptions).length > 0;
     const finalPreselectedOptions = (0, _devEnvironmentConfigurationFile.mergeConfigurationFileOptions)(preselectedOptions, configurationFileOptions);
 
     /** @type {InstanceOptions} */
@@ -74,10 +73,7 @@ cmd.argv(process.argv, async (arg, opt) => {
       cron: currentInstanceData.cron,
       adminPassword: currentInstanceData.adminPassword
     };
-    const providedOptions = Object.keys(opt).filter(option => option.length > 1) // Filter out single letter aliases
-    .filter(option => !['debug', 'help', 'slug'].includes(option)); // Filter out options that are not related to instance configuration
-
-    const suppressPrompts = providedOptions.length > 0 || thereAreOptionsFromConfigFile;
+    const suppressPrompts = !process.stdin.isTTY;
     const instanceData = await (0, _devEnvironmentCli.promptForArguments)(finalPreselectedOptions, defaultOptions, suppressPrompts, false);
     instanceData.siteSlug = slug;
     await (0, _devEnvironmentCore.updateEnvironment)(lando, instanceData);

package/dist/commands/dev-env-import-sql.js

@@ -115,7 +115,10 @@ class DevEnvImportSQLCommand {
       if (!dumpDetails.sourceDb) {
         console.log(`${_chalk.default.yellow('!')} Unable to identify source DB. Skipping myloader source-db option`);
       }
-      importArg = ['db-myloader', '--overwrite-tables', ...(dumpDetails.sourceDb ? [`--source-db=${dumpDetails.sourceDb}`] : []), `--threads=${threadCount}`, '--max-threads-for-schema-creation=10', '--max-threads-for-index-creation=10', '--skip-triggers', '--skip-post', '--optimize-keys', '--checksum=SKIP', '--metadata-refresh-interval=2000000', '--stream'].concat(this.options.quiet ? ['--verbose=0'] : ['--verbose=3']);
+      importArg = ['db-myloader',
+      // Drop existing tables before restoring. Do not use the long form:
+      // `--overwrite-tables` is a silent no-op on myloader >= 0.20.
+      '-o', ...(dumpDetails.sourceDb ? [`--source-db=${dumpDetails.sourceDb}`] : []), `--threads=${threadCount}`, '--max-threads-for-schema-creation=10', '--max-threads-for-index-creation=10', '--skip-triggers', '--skip-post', '--optimize-keys', '--checksum=SKIP', '--metadata-refresh-interval=2000000', '--stream'].concat(this.options.quiet ? ['--verbose=0'] : ['--verbose=3']);
     }
     return importArg;
   }

package/dist/commands/dev-env-sync-sql.js

@@ -180,12 +180,11 @@ class DevEnvSyncSQLCommand {
     const readStream = _fs.default.createReadStream(this.sqlFile);
     const replacedStream = await (0, _vipSearchReplace.replace)(readStream, replacements);
     const outputFile = `${this.tmpDir}/sql-export-sr.sql`;
-    const streams = [replacedStream];
+    const transforms = [];
     if (this.getSqlDumpType() === _database.SqlDumpType.MYDUMPER) {
-      streams.push((0, _database.fixMyDumperTransform)());
+      transforms.push((0, _database.fixMyDumperTransform)());
     }
-    streams.push(_fs.default.createWriteStream(outputFile));
-    await (0, _promises.pipeline)(streams);
+    await (0, _promises.pipeline)(replacedStream, ...transforms, _fs.default.createWriteStream(outputFile));
     _fs.default.renameSync(outputFile, this.sqlFile);
   }
   getSiteUrlsFromSDS() {

package/dist/lib/analytics/clients/tracks.js

@@ -3,8 +3,8 @@
 exports.__esModule = true;
 exports.default = void 0;
 var _debug = _interopRequireDefault(require("debug"));
-var _nodeFetch = _interopRequireDefault(require("node-fetch"));
 var _querystring = _interopRequireDefault(require("querystring"));
+var _undici = require("undici");
 var _apiConfig = require("../../cli/apiConfig");
 function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
 const debug = (0, _debug.default)('@automattic/vip:analytics:clients:tracks');
@@ -94,7 +94,7 @@ class Tracks {
       'User-Agent': this.userAgent
     };
     debug('send()', body);
-    return (0, _nodeFetch.default)(Tracks.ENDPOINT, {
+    return (0, _undici.fetch)(Tracks.ENDPOINT, {
       method,
       body,
       headers

package/dist/lib/api/http.js

@@ -3,19 +3,25 @@
 exports.__esModule = true;
 exports.default = void 0;
 var _debug = _interopRequireDefault(require("debug"));
-var _nodeFetch = _interopRequireDefault(require("node-fetch"));
+var _undici = require("undici");
 var _api = require("../../lib/api");
 var _env = _interopRequireDefault(require("../../lib/env"));
-var _proxyAgent = require("../../lib/http/proxy-agent");
+var _proxyDispatcher = require("../../lib/http/proxy-dispatcher");
 var _token = _interopRequireDefault(require("../../lib/token"));
 function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
 const debug = (0, _debug.default)('@automattic/vip:http');
+const isPlainObjectBody = value => {
+  if (!value || typeof value !== 'object') {
+    return false;
+  }
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+};
+
 /**
  * Call the Public API with an arbitrary path (e.g. to connect to REST endpoints).
  * This will include the token in an Authorization header so requests are "logged-in."
  *
- * This is simply a wrapper around node-fetch
- *
  * @param {string} path    API path to pass to `fetch` -- will be prefixed by the API_HOST
  * @param {Object} options options to pass to `fetch`
  * @return {Promise} Return value of the `fetch` call
@@ -29,26 +35,25 @@ var _default = async (path, options = {}) => {
     url = `${_api.API_HOST}${path}`;
   }
   const authToken = await _token.default.get();
-  const proxyAgent = (0, _proxyAgent.createProxyAgent)(url);
+  const proxyDispatcher = (0, _proxyDispatcher.createProxyDispatcher)(url);
+  const shouldSerializeJsonBody = isPlainObjectBody(options.body);
   debug('running fetch', url);
-  const headers = new Headers({
-    ...options.headers
-  });
+  const headers = new _undici.Headers(options.headers);
   if (!headers.has('Authorization')) {
     headers.set('Authorization', `Bearer ${authToken.raw}`);
   }
   if (!headers.has('User-Agent')) {
     headers.set('User-Agent', _env.default.userAgent);
   }
-  if (!headers.has('Content-Type') && options.method !== 'GET') {
+  if (!headers.has('Content-Type') && options.method !== 'GET' && shouldSerializeJsonBody) {
     headers.set('Content-Type', 'application/json');
   }
-  const opts = {
+  const requestBody = shouldSerializeJsonBody ? JSON.stringify(options.body) : options.body;
+  return (0, _undici.fetch)(url, {
     ...options,
-    agent: proxyAgent ?? undefined,
+    dispatcher: proxyDispatcher ?? undefined,
     headers,
-    body: typeof options.body === 'object' ? JSON.stringify(options.body) : options.body
-  };
-  return (0, _nodeFetch.default)(url, opts);
+    body: requestBody
+  });
 };
 exports.default = _default;

package/dist/lib/api.js

@@ -12,7 +12,6 @@ var _retry = require("@apollo/client/link/retry");
 var _chalk = _interopRequireDefault(require("chalk"));
 var _debug = _interopRequireDefault(require("debug"));
 var _graphql = require("graphql");
-var _nodeFetch = require("node-fetch");
 var _http = _interopRequireDefault(require("./api/http"));
 function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
 // Config
@@ -41,7 +40,7 @@ function shouldRetryRequest(attempt, operation, error) {
     debug(`Request failed and max retry attempts reached. ${debugSuffix}`, error);
     return false;
   }
-  if (error instanceof _nodeFetch.FetchError && error.code === 'ECONNREFUSED') {
+  if (error?.code === 'ECONNREFUSED') {
     debug(`Request failed. Retrying request due to connection refused error. ${debugSuffix}`);
     return true;
   }

package/dist/lib/cli/command.js

@@ -323,6 +323,41 @@ class CommanderArgsCompat {
     }
     return null;
   }
+  hasWpCommandPayload(subcommandArgs) {
+    const wpFlagsWithoutValue = new Set(['--help', '-h', '--version', '-v', '--yes', '-y']);
+    let expectOptionValue = false;
+    for (const arg of subcommandArgs) {
+      if (expectOptionValue) {
+        if (!isOptionToken(arg)) {
+          expectOptionValue = false;
+          continue;
+        }
+        expectOptionValue = false;
+      }
+      if (!isOptionToken(arg)) {
+        return true;
+      }
+      if (arg.startsWith('--')) {
+        if (arg.includes('=') || wpFlagsWithoutValue.has(arg)) {
+          continue;
+        }
+        expectOptionValue = true;
+        continue;
+      }
+      if (/^-[A-Za-z0-9]$/.test(arg)) {
+        if (wpFlagsWithoutValue.has(arg)) {
+          continue;
+        }
+        expectOptionValue = true;
+        continue;
+      }
+      if (/^-[A-Za-z0-9]+=/.test(arg)) {
+        continue;
+      }
+      return true;
+    }
+    return false;
+  }
   async executeSubcommand(argv, parsedAlias, subcommand) {
     const currentScript = argv[1];
     const subcommandName = subcommand.name;
@@ -334,8 +369,9 @@ class CommanderArgsCompat {
     const hasSeparatorBeforeSubcommand = rawArgsBeforeSubcommand.includes('--');
     const argsBeforeSubcommand = rawArgsBeforeSubcommand.filter(arg => arg !== '--');
     const subcommandArgs = parsedAlias.argv.slice(subcommand.index + 1);
+    const hasWpCommandPayload = this.hasWpCommandPayload(subcommandArgs);
     const hasSeparator = argv.includes('--');
-    if (subcommandName === 'wp' && subcommandArgs.length && !hasSeparator) {
+    if (subcommandName === 'wp' && hasWpCommandPayload && !hasSeparator) {
       exit.withError('A double dash ("--") must separate the arguments of "vip" from those of "wp". Run "vip wp --help" for examples.');
     }
     let childArgs = [...argsBeforeSubcommand, ...(hasSeparatorBeforeSubcommand ? ['--'] : []), ...subcommandArgs];

package/dist/lib/cli/internal-bin-loader.js

@@ -8,6 +8,8 @@ const internalBinLoaders = {
   vip: () => import('../../bin/vip'),
   'vip-app': () => import('../../bin/vip-app'),
   'vip-app-deploy': () => import('../../bin/vip-app-deploy'),
+  'vip-app-deploy-token': () => import('../../bin/vip-app-deploy-token'),
+  'vip-app-deploy-token-generate': () => import('../../bin/vip-app-deploy-token-generate'),
   'vip-app-deploy-validate': () => import('../../bin/vip-app-deploy-validate'),
   'vip-app-list': () => import('../../bin/vip-app-list'),
   'vip-backup': () => import('../../bin/vip-backup'),

package/dist/lib/client-file-uploader.js

@@ -4,12 +4,14 @@ exports.__esModule = true;
 exports.MULTIPART_THRESHOLD = exports.COMPRESS_THRESHOLD = void 0;
 exports.checkFileAccess = checkFileAccess;
 exports.detectCompressedMimeType = detectCompressedMimeType;
+exports.fetchWithRetry = fetchWithRetry;
 exports.getFileHash = void 0;
 exports.getFileMeta = getFileMeta;
 exports.getFileSize = getFileSize;
 exports.getPartBoundaries = getPartBoundaries;
 exports.getSignedUploadRequestData = getSignedUploadRequestData;
 exports.isFile = isFile;
+exports.parseEtagHeader = parseEtagHeader;
 exports.unzipFile = void 0;
 exports.uploadImportFileToS3 = uploadImportFileToS3;
 exports.uploadParts = uploadParts;
@@ -17,28 +19,66 @@ var _chalk = _interopRequireDefault(require("chalk"));
 var _crypto = require("crypto");
 var _debug = _interopRequireDefault(require("debug"));
 var _fs = require("fs");
-var _nodeFetch = _interopRequireDefault(require("node-fetch"));
 var _promises = require("node:fs/promises");
 var _promises2 = require("node:stream/promises");
+var _nodeTimers = require("node:timers");
+var _promises3 = require("node:timers/promises");
 var _os = _interopRequireDefault(require("os"));
 var _path = _interopRequireDefault(require("path"));
 var _stream = require("stream");
+var _undici = require("undici");
 var _xml2js = require("xml2js");
 var _zlib = require("zlib");
 var _http = _interopRequireDefault(require("../lib/api/http"));
 var _fileSize = require("../lib/constants/file-size");
 function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
-// Need to use CommonJS imports here as the `fetch-retry` typedefs are messed up and throwing TypeJS errors when using `import`
-// eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
-const fetchWithRetry =
-// eslint-disable-next-line @typescript-eslint/no-unsafe-call, @typescript-eslint/no-require-imports
-require('fetch-retry')(_nodeFetch.default, {
-  // Set default retry options
-  retries: 3,
-  retryDelay: attempt => {
-    return Math.pow(2, attempt) * 1000; // 1000, 2000, 4000
+function parseEtagHeader(etag) {
+  const normalizedEtag = etag.replace(/^W\//u, '').trim();
+  if (normalizedEtag.startsWith('"') && normalizedEtag.endsWith('"')) {
+    try {
+      return JSON.parse(normalizedEtag);
+    } catch (err) {
+      debug(`Unable to JSON.parse ETag header, falling back to raw value: ${err.message}`);
+    }
+  }
+  return normalizedEtag.replace(/^"(.*)"$/u, '$1');
+}
+/**
+ * Wraps `fetch` with exponential-backoff retries.
+ *
+ * A request body that is a Node stream can only be consumed once. If the body
+ * is a stream and we retried with the same `init`, the second attempt would
+ * pass an already-consumed (disturbed/locked) stream to `fetch`, which throws
+ * the misleading `Response body object should not be disturbed or locked` error
+ * and masks the original network failure.
+ *
+ * To retry safely, callers that send a stream body should pass `createBody`,
+ * which is invoked to produce a fresh body for every attempt. If a stream body
+ * is supplied without a `createBody` factory, the request is attempted only
+ * once so the underlying error surfaces instead of the misleading undici one.
+ */
+async function fetchWithRetry(input, init = {}, retries = 3, createBody) {
+  const bodyIsStream = typeof init.body?.pipe === 'function';
+  // Only retry when we can hand `fetch` a fresh, replayable body each attempt.
+  const maxAttempts = createBody || !bodyIsStream ? retries : 0;
+  for (let attempt = 0; attempt <= maxAttempts; attempt++) {
+    const requestInit = createBody ? {
+      ...init,
+      body: createBody()
+    } : init;
+    try {
+      // eslint-disable-next-line no-await-in-loop
+      return await (0, _undici.fetch)(input, requestInit);
+    } catch (err) {
+      if (attempt === maxAttempts) {
+        throw err;
+      }
+      // eslint-disable-next-line no-await-in-loop
+      await (0, _promises3.setTimeout)(Math.pow(2, attempt) * 1000); // 1000, 2000, 4000
+    }
   }
-});
+  throw new Error('unreachable');
+}
 const debug = (0, _debug.default)('vip:lib/client-file-uploader');
 
 // Files smaller than COMPRESS_THRESHOLD will not be compressed before upload
@@ -203,20 +243,28 @@ async function uploadUsingPutObject({
     ...fetchOptions.headers,
     'Content-Length': `${fileSize}` // This has to be a string
   };
-  let readBytes = 0;
-  const progressPassThrough = new _stream.PassThrough();
-  progressPassThrough.on('data', data => {
-    readBytes += data.length;
-    const percentage = `${Math.floor(100 * readBytes / fileSize)}%`;
-    debug(percentage);
-    if (typeof progressCallback === 'function') {
-      progressCallback(percentage);
+
+  // Build a fresh request body for every attempt. The upload streams the file
+  // from disk, and a stream can only be consumed once; recreating it per
+  // attempt lets `fetchWithRetry` retry without reusing a consumed stream
+  // (which would otherwise throw `... should not be disturbed or locked`).
+  const createBody = () => {
+    if (fileContent) {
+      return fileContent;
     }
-  });
-  const response = await fetchWithRetry(presignedRequest.url, {
-    ...fetchOptions,
-    body: fileContent ?? (0, _fs.createReadStream)(fileName).pipe(progressPassThrough)
-  });
+    let readBytes = 0;
+    const progressPassThrough = new _stream.PassThrough();
+    progressPassThrough.on('data', data => {
+      readBytes += data.length;
+      const percentage = `${Math.floor(100 * readBytes / fileSize)}%`;
+      debug(percentage);
+      if (typeof progressCallback === 'function') {
+        progressCallback(percentage);
+      }
+    });
+    return (0, _fs.createReadStream)(fileName).pipe(progressPassThrough);
+  };
+  const response = await fetchWithRetry(presignedRequest.url, fetchOptions, 3, createBody);
   if (response.status === 200) {
     return 'ok';
   }
@@ -411,18 +459,19 @@ async function uploadParts({
   progressCallback
 }) {
   let uploadsInProgress = 0;
-  let totalBytesRead = 0;
   const partPercentages = new Array(parts.length).fill(0);
+  const partBytesRead = new Array(parts.length).fill(0);
   const readyForPartUpload = () => new Promise(resolve => {
-    const canDoInterval = setInterval(() => {
+    const canDoInterval = (0, _nodeTimers.setInterval)(() => {
       if (uploadsInProgress < MAX_CONCURRENT_PART_UPLOADS) {
         uploadsInProgress++;
-        clearInterval(canDoInterval);
+        (0, _nodeTimers.clearInterval)(canDoInterval);
         resolve();
       }
     }, 300);
   });
   const updateProgress = () => {
+    const totalBytesRead = partBytesRead.reduce((sum, bytes) => sum + bytes, 0);
     const percentage = `${Math.floor(100 * totalBytesRead / fileMeta.fileSize)}%`;
     if (typeof progressCallback === 'function') {
       progressCallback(percentage);
@@ -434,32 +483,46 @@ async function uploadParts({
       return `Part # ${index}: ${partPercentage}% of ${(partSize / _fileSize.MB_IN_BYTES).toFixed(2)}MB`;
     }).join('\n') + `\n\nOverall Progress: ${percentage}% of ${(fileMeta.fileSize / _fileSize.MB_IN_BYTES).toFixed(2)}MB`);
   };
-  const updateProgressInterval = setInterval(updateProgress, 500);
+  const updateProgressInterval = (0, _nodeTimers.setInterval)(updateProgress, 500);
   const allDone = await Promise.all(parts.map(async part => {
     const {
       index,
-      partSize
+      partSize,
+      start,
+      end
     } = part;
-    const progressPassThrough = new _stream.PassThrough();
-    let partBytesRead = 0;
-    progressPassThrough.on('data', data => {
-      totalBytesRead += data.length;
-      partBytesRead += data.length;
-      partPercentages[index] = Math.floor(100 * partBytesRead / partSize);
-    });
+
+    // Build a fresh request body for every attempt. A stream can only be
+    // consumed once, so recreating the ranged read stream (and its progress
+    // PassThrough) per attempt lets `fetchWithRetry` retry without reusing a
+    // disturbed/locked stream. Reset this part's progress counters so a retry
+    // re-streams the part without double-counting bytes.
+    const createBody = () => {
+      partBytesRead[index] = 0;
+      partPercentages[index] = 0;
+      const progressPassThrough = new _stream.PassThrough();
+      progressPassThrough.on('data', data => {
+        partBytesRead[index] += data.length;
+        partPercentages[index] = Math.floor(100 * partBytesRead[index] / partSize);
+      });
+      return (0, _fs.createReadStream)(fileMeta.fileName, {
+        start,
+        end
+      }).pipe(progressPassThrough);
+    };
     await readyForPartUpload();
     const uploadResult = await uploadPart({
       app,
       env,
       fileMeta,
       part,
-      progressPassThrough,
+      createBody,
       uploadId
     });
     uploadsInProgress--;
     return uploadResult;
   }));
-  clearInterval(updateProgressInterval);
+  (0, _nodeTimers.clearInterval)(updateProgressInterval);
   updateProgress();
   return allDone;
 }
@@ -467,18 +530,15 @@ async function uploadPart({
   app,
   env,
   fileMeta: {
-    basename,
-    fileName
+    basename
   },
   part,
-  progressPassThrough,
+  createBody,
   uploadId
 }) {
   const {
-    end,
     index,
-    partSize,
-    start
+    partSize
   } = part;
   const s3PartNumber = index + 1; // S3 multipart is indexed from 1
 
@@ -504,15 +564,13 @@ async function uploadPart({
        *   ...so it may not be feasible to include with presigned requests.
        */
     };
-    fetchOptions.body = (0, _fs.createReadStream)(fileName, {
-      start,
-      end
-    }).pipe(progressPassThrough);
-    const fetchResponse = await fetchWithRetry(partUploadRequestData.url, fetchOptions);
+    const fetchResponse = await fetchWithRetry(partUploadRequestData.url, fetchOptions, 3, createBody);
     if (fetchResponse.status === 200) {
-      const responseHeaders = fetchResponse.headers.raw();
-      const [etag] = responseHeaders.etag;
-      return JSON.parse(etag);
+      const etag = fetchResponse.headers.get('etag');
+      if (!etag) {
+        throw new Error('Unable to upload file part. Missing ETag response header.');
+      }
+      return parseEtagHeader(etag);
     }
     const result = await fetchResponse.text();