@freecodecamp/universe-cli 0.3.3 → 0.5.0

package/dist/index.js

@@ -3,21 +3,20 @@
 // src/cli.ts
 import { cac } from "cac";
 
+// src/commands/deploy.ts
+import { readFile as readFile2 } from "fs/promises";
+import { resolve as resolve2 } from "path";
+import { log } from "@clack/prompts";
+
 // src/output/exit-codes.ts
 var EXIT_USAGE = 10;
 var EXIT_CONFIG = 11;
-var EXIT_CREDENTIAL = 12;
+var EXIT_CREDENTIALS = 12;
 var EXIT_STORAGE = 13;
-var EXIT_OUTPUT_DIR = 14;
 var EXIT_GIT = 15;
-var EXIT_ALIAS = 16;
-var EXIT_DEPLOY_NOT_FOUND = 17;
 var EXIT_CONFIRM = 18;
 var EXIT_PARTIAL = 19;
-function exitWithCode(code, message) {
-  if (message !== void 0) {
-    process.stderr.write(message + "\n");
-  }
+function exitWithCode(code) {
   process.exit(code);
 }
 
@@ -32,7 +31,7 @@ var ConfigError = class extends CliError {
   exitCode = EXIT_CONFIG;
 };
 var CredentialError = class extends CliError {
-  exitCode = EXIT_CREDENTIAL;
+  exitCode = EXIT_CREDENTIALS;
 };
 var StorageError = class extends CliError {
   exitCode = EXIT_STORAGE;
@@ -40,440 +39,35 @@ var StorageError = class extends CliError {
 var GitError = class extends CliError {
   exitCode = EXIT_GIT;
 };
-
-// src/config/loader.ts
-import { readFileSync } from "fs";
-import { isAbsolute, relative, resolve, sep } from "path";
-import { parse as parseYaml } from "yaml";
-
-// src/config/schema.ts
-import { z } from "zod";
-var staticSchema = z.object({
-  output_dir: z.string().min(1).default("dist"),
-  bucket: z.string().min(1).default("gxy-static-1"),
-  rclone_remote: z.string().min(1).default("gxy-static"),
-  region: z.string().min(1).default("auto")
-}).prefault({});
-var domainSchema = z.object({
-  production: z.string().min(1),
-  preview: z.string().min(1)
-});
-var platformSchema = z.object({
-  name: z.string().min(1).regex(/^[a-z0-9]([a-z0-9._-]*[a-z0-9])?$/i),
-  stack: z.literal("static"),
-  domain: domainSchema,
-  static: staticSchema
-});
-
-// src/config/loader.ts
-function assertSafeOutputDir(outputDir, cwd) {
-  if (isAbsolute(outputDir)) {
-    throw new ConfigError(
-      `output_dir must be relative to the project root; absolute paths are rejected: ${outputDir}`
-    );
-  }
-  const resolved = resolve(cwd, outputDir);
-  const rel = relative(cwd, resolved);
-  if (rel === "..") {
-    throw new ConfigError(
-      `output_dir resolves outside the project root: ${outputDir}`
-    );
-  }
-  if (rel.startsWith(`..${sep}`)) {
-    throw new ConfigError(
-      `output_dir resolves outside the project root: ${outputDir}`
-    );
-  }
-}
-function readEnvOverrides() {
-  const overrides = {};
-  if (process.env.UNIVERSE_STATIC_OUTPUT_DIR) {
-    overrides.output_dir = process.env.UNIVERSE_STATIC_OUTPUT_DIR;
-  }
-  if (process.env.UNIVERSE_STATIC_BUCKET) {
-    overrides.bucket = process.env.UNIVERSE_STATIC_BUCKET;
-  }
-  if (process.env.UNIVERSE_STATIC_RCLONE_REMOTE) {
-    overrides.rclone_remote = process.env.UNIVERSE_STATIC_RCLONE_REMOTE;
-  }
-  if (process.env.UNIVERSE_STATIC_REGION) {
-    overrides.region = process.env.UNIVERSE_STATIC_REGION;
-  }
-  return overrides;
-}
-function readFlagOverrides(flags) {
-  if (!flags) return {};
-  const overrides = {};
-  if (flags.outputDir) overrides.output_dir = flags.outputDir;
-  if (flags.bucket) overrides.bucket = flags.bucket;
-  if (flags.rcloneRemote) overrides.rclone_remote = flags.rcloneRemote;
-  if (flags.region) overrides.region = flags.region;
-  return overrides;
-}
-function loadConfig(options = {}) {
-  const cwd = options.cwd ?? process.cwd();
-  const configPath = resolve(cwd, "platform.yaml");
-  let raw;
-  try {
-    raw = readFileSync(configPath, "utf-8");
-  } catch (err) {
-    if (err instanceof Error && err.code === "ENOENT") {
-      throw new ConfigError(
-        `platform.yaml not found at ${configPath}. See docs/STAFF-GUIDE.md for the required format.`
-      );
-    }
-    throw err;
-  }
-  const parsed = parseYaml(raw);
-  const parseResult = platformSchema.safeParse(parsed);
-  if (!parseResult.success) {
-    const issues = parseResult.error.issues.map((issue) => {
-      const path = issue.path.length > 0 ? issue.path.join(".") : "(root)";
-      return `  - ${path}: ${issue.message}`;
-    }).join("\n");
-    throw new ConfigError(
-      `platform.yaml is invalid:
-${issues}
-See docs/STAFF-GUIDE.md for the required format.`
-    );
-  }
-  const yamlValidated = parseResult.data;
-  const envOverrides = readEnvOverrides();
-  const flagOverrides = readFlagOverrides(options.flags);
-  const merged = {
-    ...yamlValidated,
-    static: {
-      ...yamlValidated.static,
-      ...envOverrides,
-      ...flagOverrides
-    }
-  };
-  assertSafeOutputDir(merged.static.output_dir, cwd);
-  return merged;
-}
-
-// src/credentials/resolver.ts
-import { execSync } from "child_process";
-
-// src/output/redact.ts
-var AWS_KEY_PREFIX_PATTERN = /(?:AKIA|ASIA|AROA|AIDA|ACCA|ANPA|ABIA|AGPA)[A-Z0-9]{12,}/g;
-var URL_CREDS_PATTERN = /https?:\/\/[^@\s]+@/g;
-var CREDENTIAL_CONTEXT_PATTERN = /(?:access_key_id|secret_access_key|accessKeyId|secretAccessKey|secret|password|token|key|credential|auth)\s*[=:]\s*([A-Za-z0-9/+=]{21,})/gi;
-var HEX_CREDENTIAL_CONTEXT_PATTERN = /(?:secret|password|token|key|credential|auth|access_key_id|secret_access_key)\s*[=:]\s*([a-f0-9]{32,})/gi;
-var JSON_CREDENTIAL_PATTERN = /"(?:secret|password|token|key|credential|auth|access_key_id|secret_access_key|accessKeyId|secretAccessKey)"\s*:\s*"[^"]+"/gi;
-var BEARER_PATTERN = /\bBearer\s+[A-Za-z0-9._~+/=-]+/gi;
-function maskAwsKey(match) {
-  return match.slice(0, 4) + "****" + match.slice(-4);
-}
-function maskUrlCreds(match) {
-  const atIndex = match.lastIndexOf("@");
-  const protocolEnd = match.indexOf("://") + 3;
-  return match.slice(0, protocolEnd) + "****:****@" + match.slice(atIndex + 1);
-}
-function redact(value) {
-  let result = value;
-  result = result.replace(URL_CREDS_PATTERN, maskUrlCreds);
-  result = result.replace(AWS_KEY_PREFIX_PATTERN, maskAwsKey);
-  result = result.replace(BEARER_PATTERN, "Bearer ****");
-  result = result.replace(JSON_CREDENTIAL_PATTERN, (match) => {
-    const colonIndex = match.indexOf(":");
-    return match.slice(0, colonIndex + 1) + '"****"';
-  });
-  result = result.replace(
-    CREDENTIAL_CONTEXT_PATTERN,
-    (_match, _secret, _offset, _full) => {
-      const eqIndex = _match.indexOf("=");
-      const colonIndex = _match.indexOf(":");
-      const sepIndex = eqIndex >= 0 && colonIndex >= 0 ? Math.min(eqIndex, colonIndex) : eqIndex >= 0 ? eqIndex : colonIndex;
-      const prefix = _match.slice(0, sepIndex + 1);
-      return prefix + "****";
-    }
-  );
-  result = result.replace(HEX_CREDENTIAL_CONTEXT_PATTERN, (_match, _secret) => {
-    const eqIndex = _match.indexOf("=");
-    const colonIndex = _match.indexOf(":");
-    const sepIndex = eqIndex >= 0 && colonIndex >= 0 ? Math.min(eqIndex, colonIndex) : eqIndex >= 0 ? eqIndex : colonIndex;
-    const prefix = _match.slice(0, sepIndex + 1);
-    return prefix + "****";
-  });
-  return result;
-}
-
-// src/credentials/resolver.ts
-var LOCAL_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
-function validateEndpoint(endpoint) {
-  let url;
-  try {
-    url = new URL(endpoint);
-  } catch {
-    throw new CredentialError(`S3_ENDPOINT is not a valid URL: ${endpoint}`);
-  }
-  if (url.username !== "" || url.password !== "") {
-    throw new CredentialError(
-      "S3_ENDPOINT must not contain credentials in the URL (user:pass@host). Use S3_ACCESS_KEY_ID / S3_SECRET_ACCESS_KEY instead."
-    );
-  }
-  if (url.protocol !== "https:" && url.protocol !== "http:") {
-    throw new CredentialError(
-      `S3_ENDPOINT must use http or https, got: ${url.protocol}`
-    );
-  }
-  if (url.protocol === "http:" && !LOCAL_HOSTS.has(url.hostname)) {
-    throw new CredentialError(
-      `S3_ENDPOINT must use https for non-localhost hosts. Plaintext http is only allowed for localhost/127.0.0.1. Got: ${endpoint}`
-    );
-  }
-}
-function tryEnvCredentials() {
-  const key = process.env.S3_ACCESS_KEY_ID;
-  const secret = process.env.S3_SECRET_ACCESS_KEY;
-  const endpoint = process.env.S3_ENDPOINT;
-  const region = process.env.S3_REGION;
-  const present = [key, secret, endpoint].filter(Boolean);
-  if (present.length === 0) return "none";
-  if (present.length < 3) return "partial";
-  validateEndpoint(endpoint);
-  const creds = {
-    accessKeyId: key,
-    secretAccessKey: secret,
-    endpoint
-  };
-  if (region) creds.region = region;
-  return creds;
-}
-function fromRclone(remoteName) {
-  let output;
-  try {
-    output = execSync("rclone config dump", { stdio: "pipe" });
-  } catch (err) {
-    if (err instanceof Error && err.code === "ENOENT") {
-      throw new CredentialError(
-        "rclone not found \u2014 install rclone or provide S3 credentials via environment variables"
-      );
-    }
-    throw new CredentialError(
-      `Failed to run rclone config dump: ${redact(err instanceof Error ? err.message : "unknown error")}`
-    );
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(output.toString("utf-8"));
-  } catch {
-    throw new CredentialError(
-      `Failed to parse rclone config for remote ${remoteName}`
-    );
-  }
-  output = null;
-  const remote = parsed[remoteName];
-  if (!remote) {
-    throw new CredentialError(
-      `Remote "${remoteName}" not found in rclone config. Available remotes: ${Object.keys(parsed).join(", ") || "(none)"}`
-    );
-  }
-  const missing = [];
-  if (!remote.access_key_id) missing.push("access_key_id");
-  if (!remote.secret_access_key) missing.push("secret_access_key");
-  if (!remote.endpoint) missing.push("endpoint");
-  if (missing.length > 0) {
-    throw new CredentialError(
-      `Rclone remote "${remoteName}" is missing required fields: ${missing.join(", ")}`
-    );
-  }
-  const creds = {
-    accessKeyId: remote.access_key_id,
-    secretAccessKey: remote.secret_access_key,
-    endpoint: remote.endpoint
-  };
-  if (remote.region) creds.region = remote.region;
-  return creds;
-}
-function resolveCredentials(options) {
-  const envResult = tryEnvCredentials();
-  if (envResult === "partial") {
-    throw new CredentialError(
-      "Partial S3 credentials in environment. Set all three: S3_ACCESS_KEY_ID, S3_SECRET_ACCESS_KEY, S3_ENDPOINT \u2014 or remove all to use rclone fallback."
-    );
-  }
-  if (envResult !== "none") {
-    return envResult;
-  }
-  return fromRclone(options.remoteName);
-}
-
-// src/storage/client.ts
-import { S3Client } from "@aws-sdk/client-s3";
-function createS3Client(credentials) {
-  return new S3Client({
-    endpoint: credentials.endpoint,
-    region: credentials.region ?? "auto",
-    credentials: {
-      accessKeyId: credentials.accessKeyId,
-      secretAccessKey: credentials.secretAccessKey
-    },
-    forcePathStyle: true
-  });
-}
-
-// src/storage/operations.ts
-import {
-  PutObjectCommand,
-  GetObjectCommand,
-  ListObjectsV2Command,
-  HeadObjectCommand,
-  DeleteObjectCommand,
-  DeleteObjectsCommand
-} from "@aws-sdk/client-s3";
-var MAX_RETRIES = 3;
-var BASE_DELAY_MS = 500;
-function isTransientError(error) {
-  if (!(error instanceof Error)) return false;
-  const meta = error.$metadata;
-  const statusCode = meta?.httpStatusCode;
-  if (statusCode !== void 0 && statusCode >= 500) return true;
-  if (statusCode === 429) return true;
-  const name = error.name;
-  if (name === "ThrottlingException" || name === "TooManyRequestsException" || name === "RequestTimeout" || name === "RequestTimeoutException")
-    return true;
-  if (name === "NetworkingError" || name === "TimeoutError" || error.code === "ECONNRESET")
-    return true;
-  return false;
-}
-async function withRetry(fn) {
-  for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
-    try {
-      return await fn();
-    } catch (error) {
-      if (!isTransientError(error) || attempt === MAX_RETRIES) {
-        throw error;
-      }
-      const jitter = Math.random() * BASE_DELAY_MS;
-      const delay = BASE_DELAY_MS * Math.pow(2, attempt) + jitter;
-      await new Promise((resolve2) => setTimeout(resolve2, delay));
-    }
-  }
-  throw new Error("withRetry: unreachable");
-}
-async function putObject(client, params) {
-  await withRetry(
-    () => client.send(
-      new PutObjectCommand({
-        Bucket: params.bucket,
-        Key: params.key,
-        Body: params.body,
-        ContentType: params.contentType,
-        CacheControl: params.cacheControl
-      })
-    )
-  );
-}
-async function getObject(client, params) {
-  try {
-    const response = await withRetry(
-      () => client.send(
-        new GetObjectCommand({
-          Bucket: params.bucket,
-          Key: params.key
-        })
-      )
-    );
-    return await response.Body?.transformToString() ?? null;
-  } catch (error) {
-    if (error instanceof Error && error.name === "NoSuchKey") {
-      return null;
-    }
-    throw error;
-  }
-}
-async function listObjects(client, params) {
-  const allItems = [];
-  let continuationToken;
-  do {
-    const response = await withRetry(
-      () => client.send(
-        new ListObjectsV2Command({
-          Bucket: params.bucket,
-          Prefix: params.prefix,
-          ContinuationToken: continuationToken
-        })
-      )
-    );
-    if (response.Contents) {
-      for (const item of response.Contents) {
-        allItems.push({
-          key: item.Key ?? "",
-          size: item.Size ?? 0,
-          lastModified: item.LastModified ?? /* @__PURE__ */ new Date(0)
-        });
-      }
-    }
-    continuationToken = response.IsTruncated ? response.NextContinuationToken : void 0;
-  } while (continuationToken);
-  return allItems;
-}
-
-// src/storage/aliases.ts
-async function readAlias(client, bucket, site, aliasName) {
-  const result = await getObject(client, {
-    bucket,
-    key: `${site}/${aliasName}`
-  });
-  return result !== null ? result.trim() : null;
-}
-async function writeAlias(client, bucket, site, aliasName, deployId) {
-  await putObject(client, {
-    bucket,
-    key: `${site}/${aliasName}`,
-    body: deployId,
-    contentType: "text/plain"
-  });
-}
-
-// src/deploy/id.ts
-function generateDeployId(gitHash, force = false) {
-  if (gitHash === void 0) {
-    if (!force) {
-      throw new GitError("git hash is required unless --force is set");
-    }
-    return formatId("nogit");
-  }
-  return formatId(gitHash.slice(0, 7));
-}
-function formatId(suffix) {
-  const now = /* @__PURE__ */ new Date();
-  const y = now.getUTCFullYear();
-  const mo = String(now.getUTCMonth() + 1).padStart(2, "0");
-  const d = String(now.getUTCDate()).padStart(2, "0");
-  const h = String(now.getUTCHours()).padStart(2, "0");
-  const mi = String(now.getUTCMinutes()).padStart(2, "0");
-  const s = String(now.getUTCSeconds()).padStart(2, "0");
-  return `${y}${mo}${d}-${h}${mi}${s}-${suffix}`;
-}
+var PartialUploadError = class extends CliError {
+  exitCode = EXIT_PARTIAL;
+};
+var UsageError = class extends CliError {
+  exitCode = EXIT_USAGE;
+};
 
 // src/deploy/git.ts
-import { execSync as execSync2 } from "child_process";
+import { execSync } from "child_process";
 function getGitState() {
   try {
-    const hash = execSync2("git rev-parse HEAD", { encoding: "utf-8" }).trim();
-    const status = execSync2("git status --porcelain", { encoding: "utf-8" });
+    const hash = execSync("git rev-parse HEAD", { encoding: "utf-8" }).trim();
+    const status = execSync("git status --porcelain", { encoding: "utf-8" });
     return { hash, dirty: status.length > 0 };
   } catch {
     return { hash: null, dirty: false, error: "not a git repository" };
   }
 }
 
-// src/deploy/preflight.ts
-import { existsSync, statSync as statSync2 } from "fs";
-
 // src/deploy/walk.ts
 import { readdirSync, realpathSync, statSync } from "fs";
-import { join, relative as relative2, sep as sep2 } from "path";
+import { join, relative, sep } from "path";
 function walkFiles(base) {
   const baseReal = realpathSync(base);
   const entries = readdirSync(base, { recursive: true, withFileTypes: true });
   const files = [];
   for (const entry of entries) {
     const full = join(entry.parentPath, entry.name);
-    const relPath = relative2(base, full);
+    const relPath = relative(base, full);
     let targetIsFile;
     try {
       targetIsFile = statSync(full).isFile();
@@ -491,8 +85,8 @@ function walkFiles(base) {
         `"${relPath}" could not be resolved (dangling symlink?)`
       );
     }
-    const rel = relative2(baseReal, resolved);
-    if (rel === ".." || rel.startsWith(`..${sep2}`)) {
+    const rel = relative(baseReal, resolved);
+    if (rel === ".." || rel.startsWith(`..${sep}`)) {
       throw new StorageError(
         `"${relPath}" resolves outside the output directory (symlink escape). Resolved to: ${resolved}`
       );
@@ -502,472 +96,1929 @@ function walkFiles(base) {
   return files;
 }
 
-// src/deploy/preflight.ts
-function validateOutputDir(dir) {
-  if (!existsSync(dir)) {
-    return { valid: false, fileCount: 0, error: "directory not found" };
+// src/lib/build.ts
+import { spawn } from "child_process";
+import { stat } from "fs/promises";
+import { isAbsolute, resolve } from "path";
+var defaultExec = async (req) => {
+  return new Promise((resolveExit, reject) => {
+    const child = spawn(req.command, {
+      cwd: req.cwd,
+      shell: true,
+      stdio: "inherit"
+    });
+    child.on("error", (err) => reject(err));
+    child.on("exit", (code) => resolveExit(code ?? 1));
+  });
+};
+async function ensureDirectory(absPath) {
+  let st;
+  try {
+    st = await stat(absPath);
+  } catch {
+    throw new ConfigError(`output directory missing after build: ${absPath}`);
+  }
+  if (!st.isDirectory()) {
+    throw new ConfigError(
+      `output path is not a directory after build: ${absPath}`
+    );
+  }
+}
+async function runBuild(options, deps = {}) {
+  const exec = deps.exec ?? defaultExec;
+  const absCwd = isAbsolute(options.cwd) ? options.cwd : resolve(options.cwd);
+  const absOutput = isAbsolute(options.outputDir) ? options.outputDir : resolve(absCwd, options.outputDir);
+  if (!options.command) {
+    await ensureDirectory(absOutput);
+    return { skipped: true, outputDir: absOutput };
+  }
+  const code = await exec({ command: options.command, cwd: absCwd });
+  if (code !== 0) {
+    throw new ConfigError(
+      `build command failed with exit code ${code}: ${options.command}`
+    );
   }
-  if (!statSync2(dir).isDirectory()) {
-    return { valid: false, fileCount: 0, error: "not a directory" };
+  await ensureDirectory(absOutput);
+  return { skipped: false, outputDir: absOutput };
+}
+
+// src/lib/constants.ts
+var DEFAULT_GH_CLIENT_ID = "Iv23liIuGmZRyPd5wUeN";
+var DEFAULT_PROXY_URL = "https://uploads.freecode.camp";
+
+// src/lib/identity.ts
+import { execFile } from "child_process";
+import { promisify } from "util";
+
+// src/lib/token-store.ts
+import { chmod, mkdir, readFile, rm, writeFile } from "fs/promises";
+import { homedir } from "os";
+import { dirname, join as join2 } from "path";
+var APP_DIR = "universe-cli";
+var TOKEN_FILE = "token";
+function configBase() {
+  const xdg = process.env["XDG_CONFIG_HOME"];
+  if (xdg && xdg.length > 0) return xdg;
+  return join2(homedir(), ".config");
+}
+function tokenPath() {
+  return join2(configBase(), APP_DIR, TOKEN_FILE);
+}
+async function saveToken(token) {
+  const trimmed = token.trim();
+  if (trimmed.length === 0) {
+    throw new Error("refusing to save empty token");
   }
-  let fileCount;
+  const path = tokenPath();
+  const dir = dirname(path);
+  await mkdir(dir, { recursive: true, mode: 448 });
+  await chmod(dir, 448);
+  await writeFile(path, trimmed, { mode: 384 });
+  await chmod(path, 384);
+}
+async function loadToken() {
+  let raw;
   try {
-    fileCount = walkFiles(dir).length;
+    raw = await readFile(tokenPath(), "utf-8");
   } catch (err) {
-    if (err instanceof StorageError) {
-      return { valid: false, fileCount: 0, error: err.message };
-    }
+    if (isFileNotFound(err)) return null;
     throw err;
   }
-  if (fileCount === 0) {
-    return { valid: false, fileCount: 0, error: "directory is empty" };
-  }
-  return { valid: true, fileCount };
+  const trimmed = raw.trim();
+  return trimmed.length === 0 ? null : trimmed;
+}
+async function deleteToken() {
+  await rm(tokenPath(), { force: true });
+}
+function isFileNotFound(err) {
+  return typeof err === "object" && err !== null && "code" in err && err.code === "ENOENT";
 }
 
-// src/deploy/upload.ts
-import { readFileSync as readFileSync2 } from "fs";
-import { extname, basename } from "path";
-import { lookup } from "mrmime";
-import pLimit from "p-limit";
-var FINGERPRINT_RE = /[.-][a-zA-Z0-9_-]{8,}\./;
-function getContentType(filename) {
-  const mime = lookup(filename);
-  if (mime === void 0) {
-    console.warn(`Unknown content-type for extension: ${extname(filename)}`);
-    return "application/octet-stream";
+// src/lib/identity.ts
+var execFileP = promisify(execFile);
+function isNonEmpty(s) {
+  return typeof s === "string" && s.trim().length > 0;
+}
+async function defaultExecGhAuthToken() {
+  try {
+    const { stdout } = await execFileP("gh", ["auth", "token"], {
+      timeout: 5e3
+    });
+    return stdout;
+  } catch {
+    return null;
   }
-  return mime;
 }
-function getCacheControl(filename) {
-  if (extname(filename) === ".html") {
-    return "public, max-age=60, must-revalidate";
+async function resolveIdentity(opts = {}) {
+  const env = opts.env ?? process.env;
+  const execGh = opts.execGhAuthToken ?? defaultExecGhAuthToken;
+  const loadStored = opts.loadStoredToken ?? loadToken;
+  const ghEnv = env["GITHUB_TOKEN"];
+  if (isNonEmpty(ghEnv)) {
+    return { token: ghEnv.trim(), source: "env_GITHUB_TOKEN" };
   }
-  if (FINGERPRINT_RE.test(basename(filename))) {
-    return "public, max-age=31536000, immutable";
+  const ghTokenEnv = env["GH_TOKEN"];
+  if (isNonEmpty(ghTokenEnv)) {
+    return { token: ghTokenEnv.trim(), source: "env_GH_TOKEN" };
   }
-  return "public, max-age=3600";
+  const ghCli = await execGh();
+  if (isNonEmpty(ghCli)) {
+    return { token: ghCli.trim(), source: "gh_cli" };
+  }
+  const stored = await loadStored();
+  if (isNonEmpty(stored)) {
+    return { token: stored.trim(), source: "device_flow" };
+  }
+  return null;
 }
-async function uploadDirectory(client, bucket, site, deployId, outputDir, options) {
-  const concurrency = options?.concurrency ?? 10;
-  const limit = pLimit(concurrency);
-  const files = walkFiles(outputDir);
-  const errors = [];
-  let totalSize = 0;
-  let fileCount = 0;
-  const tasks = files.map(
-    (file) => limit(async () => {
-      const key = `${site}/deploys/${deployId}/${file.relPath}`;
-      const contentType = getContentType(file.relPath);
-      const cacheControl = getCacheControl(file.relPath);
-      try {
-        const body = readFileSync2(file.absPath);
-        totalSize += body.byteLength;
-        fileCount++;
-        await putObject(client, {
-          bucket,
-          key,
-          body,
-          contentType,
-          cacheControl
-        });
-      } catch (err) {
-        const message = err instanceof Error ? err.message : "unknown upload error";
-        errors.push(`${file.relPath}: ${message}`);
+
+// src/lib/ignore.ts
+var SPECIAL = /[.+^${}()|[\]\\]/g;
+function globToRegexBody(pattern) {
+  let out = "";
+  let i = 0;
+  while (i < pattern.length) {
+    const ch = pattern[i] ?? "";
+    if (ch === "*") {
+      const next = pattern[i + 1];
+      if (next === "*") {
+        out += ".*";
+        i += 2;
+        continue;
       }
-    })
-  );
-  await Promise.all(tasks);
-  return { fileCount, totalSize, errors };
-}
-
-// src/deploy/metadata.ts
-async function writeDeployMetadata(client, bucket, site, deployId, meta) {
-  const key = `${site}/_universe/deploys/${deployId}.json`;
-  const body = JSON.stringify(meta);
-  await putObject(client, {
-    bucket,
-    key,
-    body,
-    contentType: "application/json"
-  });
+      out += "[^/]*";
+      i += 1;
+      continue;
+    }
+    if (ch === "?") {
+      out += "[^/]";
+      i += 1;
+      continue;
+    }
+    out += ch.replace(SPECIAL, "\\$&");
+    i += 1;
+  }
+  return out;
 }
-
-// src/output/format.ts
-import { log } from "@clack/prompts";
-
-// src/output/envelope.ts
-function buildEnvelope(command, success, data) {
+function compilePattern(pattern) {
+  const anchored = pattern.includes("/");
+  const body = globToRegexBody(pattern);
+  if (anchored) {
+    const re2 = new RegExp(`^${body}$`);
+    return { test: (rel) => re2.test(rel) };
+  }
+  const re = new RegExp(`^${body}$`);
   return {
-    schemaVersion: "1",
-    command,
-    success,
-    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-    ...data
+    test: (rel) => {
+      const idx = rel.lastIndexOf("/");
+      const base = idx === -1 ? rel : rel.slice(idx + 1);
+      return re.test(base);
+    }
   };
 }
-function buildErrorEnvelope(command, code, message, issues) {
-  const error = {
-    code,
-    message
-  };
-  if (issues !== void 0) {
-    error.issues = issues;
-  }
-  return {
-    schemaVersion: "1",
-    command,
-    success: false,
-    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-    error
+function normalize(rel) {
+  let out = rel.replace(/\\/g, "/");
+  if (out.startsWith("./")) out = out.slice(2);
+  return out;
+}
+function createIgnoreFilter(patterns) {
+  const compiled = patterns.filter((p) => p.length > 0).map(compilePattern);
+  return (relPath) => {
+    const norm = normalize(relPath);
+    for (const c of compiled) {
+      if (c.test(norm)) return true;
+    }
+    return false;
   };
 }
 
-// src/output/format.ts
-function outputSuccess(ctx, humanMessage, data) {
-  if (ctx.json) {
-    const envelope = buildEnvelope(ctx.command, true, data);
-    process.stdout.write(JSON.stringify(envelope) + "\n");
-  } else {
-    log.success(humanMessage);
-  }
-}
-function outputError(ctx, code, message, issues) {
-  const redactedMessage = redact(message);
-  const redactedIssues = issues?.map(redact);
-  if (ctx.json) {
-    const envelope = buildErrorEnvelope(
-      ctx.command,
-      code,
-      redactedMessage,
-      redactedIssues
-    );
-    process.stdout.write(JSON.stringify(envelope) + "\n");
-  } else {
-    log.error(redactedMessage);
+// src/lib/platform-yaml.ts
+import { parse as parseYaml } from "yaml";
+
+// src/lib/platform-yaml.schema.ts
+import { z } from "zod";
+var SITE_NAME_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+var siteName = z.string().min(1, "site is required").max(63, "site must be at most 63 characters").regex(
+  SITE_NAME_PATTERN,
+  "site must be lowercase letters, digits, and single hyphens; no leading/trailing/consecutive hyphens"
+);
+var buildSchema = z.object({
+  command: z.string().min(1).optional(),
+  output: z.string().min(1).default("dist")
+}).strict();
+var DEFAULT_DEPLOY_IGNORE = Object.freeze([
+  "*.map",
+  "node_modules/**",
+  ".git/**",
+  ".env*"
+]);
+var deploySchema = z.object({
+  preview: z.boolean().default(true),
+  ignore: z.array(z.string()).default([...DEFAULT_DEPLOY_IGNORE])
+}).strict().prefault({});
+var platformYamlSchemaV2 = z.object({
+  site: siteName,
+  build: buildSchema.prefault({}),
+  deploy: deploySchema
+}).strict();
+
+// src/lib/platform-yaml.ts
+var V1_MARKERS = ["r2", "stack", "domain", "static", "name"];
+var MIGRATION_HINT = "platform.yaml v1 detected. v0.4 removes credential paths (r2, bucket, region) and per-site team declarations. See docs/platform-yaml.md for the v0.3 \u2192 v0.4 migration.";
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) && Object.getPrototypeOf(value) === Object.prototype;
+}
+function detectV1(parsed) {
+  for (const marker of V1_MARKERS) {
+    if (Object.prototype.hasOwnProperty.call(parsed, marker)) {
+      return marker;
+    }
   }
+  return void 0;
+}
+function formatZodIssues(issues) {
+  return issues.map((issue) => {
+    const path = issue.path.length > 0 ? issue.path.join(".") : "(root)";
+    return `  - ${path}: ${issue.message}`;
+  }).join("\n");
+}
+function parsePlatformYaml(text) {
+  let parsed;
+  try {
+    parsed = parseYaml(text);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return { ok: false, error: `platform.yaml is not valid YAML: ${message}` };
+  }
+  if (parsed === null || parsed === void 0) {
+    return {
+      ok: false,
+      error: "platform.yaml is empty. Required field: `site`. See docs/platform-yaml.md."
+    };
+  }
+  if (!isPlainObject(parsed)) {
+    return {
+      ok: false,
+      error: "platform.yaml must be a YAML mapping at the root. See docs/platform-yaml.md."
+    };
+  }
+  const v1Marker = detectV1(parsed);
+  if (v1Marker) {
+    return {
+      ok: false,
+      error: `${MIGRATION_HINT} (v1 marker detected: \`${v1Marker}\`)`
+    };
+  }
+  const result = platformYamlSchemaV2.safeParse(parsed);
+  if (!result.success) {
+    return {
+      ok: false,
+      error: `platform.yaml is invalid:
+${formatZodIssues(result.error.issues)}
+See docs/platform-yaml.md.`
+    };
+  }
+  return { ok: true, value: result.data };
 }
 
-// src/commands/deploy.ts
-var MAX_COLLISION_RETRIES = 3;
-var COLLISION_DELAY_MS = 1e3;
-async function resolveDeployId(client, bucket, site, gitHash, force) {
-  let lastDeployId = "";
-  for (let attempt = 0; attempt < MAX_COLLISION_RETRIES; attempt++) {
-    const deployId = generateDeployId(gitHash, force);
-    lastDeployId = deployId;
-    const prefix = `${site}/deploys/${deployId}/`;
-    const existing = await listObjects(client, { bucket, prefix });
-    if (existing.length === 0) {
-      return deployId;
-    }
-    if (attempt < MAX_COLLISION_RETRIES - 1) {
-      await new Promise((resolve2) => setTimeout(resolve2, COLLISION_DELAY_MS));
-    }
-  }
-  throw new StorageError(
-    `Deploy ID collision could not be resolved after ${MAX_COLLISION_RETRIES} attempts (last attempted: ${lastDeployId}). Commit a new change and retry, or wait for the timestamp to advance.`
+// src/lib/similarity.ts
+function editDistance(a, b) {
+  const m = a.length;
+  const n = b.length;
+  if (m === 0) return n;
+  if (n === 0) return m;
+  const d = Array.from(
+    { length: m + 1 },
+    () => new Array(n + 1).fill(0)
   );
+  for (let i = 0; i <= m; i++) d[i][0] = i;
+  for (let j = 0; j <= n; j++) d[0][j] = j;
+  for (let i = 1; i <= m; i++) {
+    for (let j = 1; j <= n; j++) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+      d[i][j] = Math.min(
+        d[i - 1][j] + 1,
+        d[i][j - 1] + 1,
+        d[i - 1][j - 1] + cost
+      );
+      if (i > 1 && j > 1 && a[i - 1] === b[j - 2] && a[i - 2] === b[j - 1]) {
+        d[i][j] = Math.min(d[i][j], d[i - 2][j - 2] + 1);
+      }
+    }
+  }
+  return d[m][n];
 }
-async function deploy(options) {
-  const config = loadConfig({
-    flags: options.outputDir ? { outputDir: options.outputDir } : void 0
-  });
-  const credentials = resolveCredentials({
-    remoteName: config.static.rclone_remote
+function suggest(target, candidates, threshold = 2) {
+  if (candidates.length === 0) return null;
+  const lc = target.toLowerCase();
+  const sub = candidates.find((c) => {
+    const clc = c.toLowerCase();
+    return clc.includes(lc) || lc.includes(clc);
   });
-  const client = createS3Client(credentials);
-  const bucket = config.static.bucket;
-  const site = config.name;
-  const ctx = { json: options.json, command: "deploy" };
-  const git = getGitState();
-  if (git.hash === null && !options.force) {
-    outputError(
-      ctx,
-      EXIT_GIT,
-      "Git hash not available \u2014 use --force to deploy without git info"
-    );
-    exitWithCode(
-      EXIT_GIT,
-      "Git hash not available \u2014 use --force to deploy without git info"
-    );
-    return;
+  if (sub) return sub;
+  let best = null;
+  let bestD = threshold + 1;
+  for (const c of candidates) {
+    const d = editDistance(lc, c.toLowerCase());
+    if (d < bestD) {
+      bestD = d;
+      best = c;
+    }
   }
-  if (git.dirty) {
-    console.warn(
-      "Warning: git working tree is dirty \u2014 uncommitted changes will not be reflected in the deploy"
-    );
+  return bestD <= threshold ? best : null;
+}
+
+// src/lib/proxy-client.ts
+var ProxyError = class extends CliError {
+  exitCode;
+  status;
+  code;
+  constructor(status, code, message) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.exitCode = mapExitCode(status);
+  }
+};
+function mapExitCode(status) {
+  if (status === 401 || status === 403) return EXIT_CREDENTIALS;
+  if (status === 422 || status === 0 || status >= 500) return EXIT_STORAGE;
+  return EXIT_USAGE;
+}
+function wrapProxyError(command, err) {
+  if (err instanceof ProxyError) {
+    return {
+      code: err.exitCode,
+      message: `${command} failed (${err.code}): ${err.message}`
+    };
+  }
+  if (err instanceof CliError) {
+    return { code: err.exitCode, message: err.message };
+  }
+  if (err instanceof Error) {
+    return { code: EXIT_USAGE, message: err.message };
+  }
+  return { code: EXIT_USAGE, message: String(err) };
+}
+function isProxyErrorEnvelope(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) && "error" in value;
+}
+async function readErrorEnvelope(response) {
+  const status = response.status;
+  let raw;
+  try {
+    raw = await response.json();
+  } catch {
+    return {
+      code: `http_${status}`,
+      message: response.statusText || "request failed"
+    };
+  }
+  if (isProxyErrorEnvelope(raw) && raw.error) {
+    return {
+      code: raw.error.code ?? `http_${status}`,
+      message: raw.error.message ?? response.statusText ?? "request failed"
+    };
+  }
+  return {
+    code: `http_${status}`,
+    message: response.statusText || "request failed"
+  };
+}
+function stripTrailingSlash(url) {
+  return url.endsWith("/") ? url.slice(0, -1) : url;
+}
+function createProxyClient(cfg) {
+  const base = stripTrailingSlash(cfg.baseUrl);
+  const fetchImpl = cfg.fetch ?? globalThis.fetch.bind(globalThis);
+  async function userBearer() {
+    const tok = await cfg.getAuthToken();
+    return `Bearer ${tok}`;
+  }
+  async function call(url, init) {
+    let response;
+    try {
+      response = await fetchImpl(url, init);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      throw new ProxyError(0, "network_error", `proxy unreachable: ${message}`);
+    }
+    if (!response.ok) {
+      const env = await readErrorEnvelope(response);
+      throw new ProxyError(response.status, env.code, env.message);
+    }
+    if (response.status === 204) {
+      return void 0;
+    }
+    return await response.json();
   }
-  const preflight = validateOutputDir(config.static.output_dir);
-  if (!preflight.valid) {
-    outputError(
-      ctx,
-      EXIT_OUTPUT_DIR,
-      `Output directory invalid: ${preflight.error}`
+  return {
+    async whoami() {
+      return call(`${base}/api/whoami`, {
+        method: "GET",
+        headers: {
+          Authorization: await userBearer(),
+          Accept: "application/json"
+        }
+      });
+    },
+    async deployInit(req) {
+      return call(`${base}/api/deploy/init`, {
+        method: "POST",
+        headers: {
+          Authorization: await userBearer(),
+          Accept: "application/json",
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify(req)
+      });
+    },
+    async deployUpload(req) {
+      const url = `${base}/api/deploy/${encodeURIComponent(
+        req.deployId
+      )}/upload?path=${encodeURIComponent(req.path)}`;
+      return call(url, {
+        method: "PUT",
+        headers: {
+          Authorization: `Bearer ${req.jwt}`,
+          Accept: "application/json",
+          "Content-Type": req.contentType ?? "application/octet-stream"
+        },
+        body: req.body
+      });
+    },
+    async deployFinalize(req) {
+      const url = `${base}/api/deploy/${encodeURIComponent(req.deployId)}/finalize`;
+      return call(url, {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${req.jwt}`,
+          Accept: "application/json",
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({ mode: req.mode, files: req.files })
+      });
+    },
+    async siteDeploys(req) {
+      const url = `${base}/api/site/${encodeURIComponent(req.site)}/deploys`;
+      return call(url, {
+        method: "GET",
+        headers: {
+          Authorization: await userBearer(),
+          Accept: "application/json"
+        }
+      });
+    },
+    async sitePromote(req) {
+      const url = `${base}/api/site/${encodeURIComponent(req.site)}/promote`;
+      return call(url, {
+        method: "POST",
+        headers: {
+          Authorization: await userBearer(),
+          Accept: "application/json"
+        }
+      });
+    },
+    async siteRollback(req) {
+      const url = `${base}/api/site/${encodeURIComponent(req.site)}/rollback`;
+      return call(url, {
+        method: "POST",
+        headers: {
+          Authorization: await userBearer(),
+          Accept: "application/json",
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({ to: req.to })
+      });
+    },
+    async registerSite(req) {
+      const body = { slug: req.slug };
+      if (req.teams && req.teams.length > 0) {
+        body.teams = req.teams;
+      }
+      return call(`${base}/api/site/register`, {
+        method: "POST",
+        headers: {
+          Authorization: await userBearer(),
+          Accept: "application/json",
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify(body)
+      });
+    },
+    async listSites() {
+      return call(`${base}/api/sites`, {
+        method: "GET",
+        headers: {
+          Authorization: await userBearer(),
+          Accept: "application/json"
+        }
+      });
+    },
+    async updateSite(req) {
+      const url = `${base}/api/site/${encodeURIComponent(req.slug)}`;
+      return call(url, {
+        method: "PATCH",
+        headers: {
+          Authorization: await userBearer(),
+          Accept: "application/json",
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({ teams: req.teams })
+      });
+    },
+    async deleteSite(req) {
+      const url = `${base}/api/site/${encodeURIComponent(req.slug)}`;
+      return call(url, {
+        method: "DELETE",
+        headers: {
+          Authorization: await userBearer(),
+          Accept: "application/json"
+        }
+      });
+    }
+  };
+}
+
+// src/lib/upload.ts
+import { readFile as defaultReadFile } from "fs/promises";
+var DEFAULT_CONCURRENCY = 6;
+var MIME_BY_EXT = Object.freeze({
+  // text
+  html: "text/html",
+  htm: "text/html",
+  css: "text/css",
+  js: "text/javascript",
+  mjs: "text/javascript",
+  cjs: "text/javascript",
+  json: "application/json",
+  txt: "text/plain",
+  md: "text/markdown",
+  xml: "application/xml",
+  csv: "text/csv",
+  // images
+  svg: "image/svg+xml",
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  gif: "image/gif",
+  webp: "image/webp",
+  avif: "image/avif",
+  ico: "image/x-icon",
+  bmp: "image/bmp",
+  // fonts
+  woff: "font/woff",
+  woff2: "font/woff2",
+  ttf: "font/ttf",
+  otf: "font/otf",
+  eot: "application/vnd.ms-fontobject",
+  // a/v
+  mp4: "video/mp4",
+  webm: "video/webm",
+  ogg: "audio/ogg",
+  mp3: "audio/mpeg",
+  wav: "audio/wav",
+  // other
+  pdf: "application/pdf",
+  wasm: "application/wasm"
+});
+function getContentType(filename) {
+  const dot = filename.lastIndexOf(".");
+  if (dot < 0 || dot === filename.length - 1) {
+    return "application/octet-stream";
+  }
+  const ext = filename.slice(dot + 1).toLowerCase();
+  return MIME_BY_EXT[ext] ?? "application/octet-stream";
+}
+function createLimit(max) {
+  let active = 0;
+  const queue = [];
+  const acquire = () => {
+    if (active < max) {
+      active += 1;
+      return Promise.resolve();
+    }
+    return new Promise((resolve6) => {
+      queue.push(() => {
+        active += 1;
+        resolve6();
+      });
+    });
+  };
+  const release = () => {
+    active -= 1;
+    const next = queue.shift();
+    if (next) next();
+  };
+  return async (fn) => {
+    await acquire();
+    try {
+      return await fn();
+    } finally {
+      release();
+    }
+  };
+}
+async function uploadFiles(options, deps = {}) {
+  const read = deps.readFile ?? defaultReadFile;
+  const concurrency = options.concurrency ?? DEFAULT_CONCURRENCY;
+  const limit = createLimit(concurrency);
+  const total = options.files.length;
+  const uploaded = [];
+  const errors = [];
+  let totalSize = 0;
+  let done = 0;
+  const tasks = options.files.map(
+    (file) => limit(async () => {
+      try {
+        const body = await read(file.absPath);
+        const bodyAsBodyInit = body;
+        await options.client.deployUpload({
+          deployId: options.deployId,
+          jwt: options.jwt,
+          path: file.relPath,
+          body: bodyAsBodyInit,
+          contentType: getContentType(file.relPath)
+        });
+        uploaded.push(file.relPath);
+        totalSize += body.byteLength;
+      } catch (err) {
+        const message = err instanceof Error ? err.message : "unknown upload error";
+        errors.push(`${file.relPath}: ${message}`);
+      } finally {
+        done += 1;
+        if (options.onProgress) {
+          options.onProgress({
+            uploaded: done,
+            total,
+            current: file.relPath
+          });
+        }
+      }
+    })
+  );
+  await Promise.all(tasks);
+  return {
+    fileCount: uploaded.length,
+    totalSize,
+    uploaded,
+    errors
+  };
+}
+
+// src/output/envelope.ts
+function buildEnvelope(command, success, data) {
+  return {
+    schemaVersion: "1",
+    command,
+    success,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    ...data
+  };
+}
+function buildErrorEnvelope(command, code, message, issues) {
+  const error = {
+    code,
+    message
+  };
+  if (issues !== void 0) {
+    error.issues = issues;
+  }
+  return {
+    schemaVersion: "1",
+    command,
+    success: false,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    error
+  };
+}
+
+// src/commands/deploy.ts
+var defaultReadPlatformYaml = async (cwd) => {
+  return readFile2(resolve2(cwd, "platform.yaml"), "utf-8");
+};
+function emitJson(envelope) {
+  process.stdout.write(JSON.stringify(envelope) + "\n");
+}
+async function readAndParseConfig(cwd, read) {
+  let raw;
+  try {
+    raw = await read(cwd);
+  } catch (err) {
+    if (err instanceof Error && err.code === "ENOENT") {
+      throw new ConfigError(
+        `platform.yaml not found in ${cwd}. See docs/platform-yaml.md.`
+      );
+    }
+    throw err;
+  }
+  const r = parsePlatformYaml(raw);
+  if (!r.ok) throw new ConfigError(r.error);
+  return r.value;
+}
+function syntheticSha() {
+  return `nogit-${Date.now().toString(36)}`;
+}
+function rethrowProxy(prefix, err) {
+  if (err instanceof ProxyError) {
+    throw new ProxyError(
+      err.status,
+      err.code,
+      `${prefix} (${err.code}): ${err.message}`
     );
-    exitWithCode(
-      EXIT_OUTPUT_DIR,
-      `Output directory invalid: ${preflight.error}`
+  }
+  if (err instanceof Error) throw new StorageError(`${prefix}: ${err.message}`);
+  throw new StorageError(`${prefix}: ${String(err)}`);
+}
+var PREFLIGHT_INLINE_LIST_CAP = 10;
+function formatUnauthorizedSiteError(a) {
+  const lines = [
+    `Site '${a.attempted}' is not registered for your GitHub identity.`,
+    ``,
+    `  You are:  ${a.login}`,
+    ``
+  ];
+  if (a.authorized.length === 0) {
+    lines.push(
+      `  Your identity is authorized for no sites yet.`,
+      ``,
+      `  Likely causes:`,
+      `    1. The '${a.attempted}' slug is not registered.`,
+      `       Admin (staff): universe sites register ${a.attempted} --team <team>`,
+      `    2. You are not in any team listed on any registered site.`,
+      `       Admin (staff): universe sites update <slug> --team +<your-team>`
     );
-    return;
+    return lines.join("\n");
   }
-  const gitHash = git.hash ?? void 0;
-  const deployId = await resolveDeployId(
-    client,
-    bucket,
-    site,
-    gitHash,
-    options.force ?? false
-  );
-  const uploadResult = await uploadDirectory(
-    client,
-    bucket,
-    site,
-    deployId,
-    config.static.output_dir
+  const hint = suggest(a.attempted, a.authorized);
+  if (hint) {
+    lines.push(`  Did you mean: ${hint}?`, ``);
+  }
+  lines.push(
+    `  Likely causes (most common first):`,
+    `    1. Typo in platform.yaml \`site:\` \u2014 check the spelling above.`,
+    `    2. The '${a.attempted}' slug is not registered yet.`,
+    `       Admin (staff): universe sites register ${a.attempted} --team <team>`,
+    `    3. You are not in any team authorized for '${a.attempted}'.`,
+    `       Admin (staff): universe sites update ${a.attempted} --team +<your-team>`,
+    ``
   );
-  if (uploadResult.errors.length > 0) {
-    outputError(
-      ctx,
-      EXIT_PARTIAL,
-      `Upload partially failed: ${uploadResult.errors.length} file(s) failed`,
-      uploadResult.errors
+  if (a.authorized.length <= PREFLIGHT_INLINE_LIST_CAP) {
+    lines.push(
+      `  Your authorized sites (${a.authorized.length}):`,
+      ...[...a.authorized].sort().map((s) => `    - ${s}`)
     );
-    exitWithCode(
-      EXIT_PARTIAL,
-      `Upload partially failed: ${uploadResult.errors.length} file(s) failed`
+  } else {
+    lines.push(
+      `  You have ${a.authorized.length} authorized sites \u2014 too many to inline.`,
+      `  Run \`universe sites ls --mine\` to inspect the full list.`
     );
-    return;
   }
-  await writeDeployMetadata(client, bucket, site, deployId, {
-    deployId,
-    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-    gitHash: git.hash,
-    gitDirty: git.dirty,
-    fileCount: uploadResult.fileCount,
-    totalSize: uploadResult.totalSize
+  return lines.join("\n");
+}
+async function deploy(options, deps = {}) {
+  const cwd = deps.cwd ?? process.cwd();
+  const env = deps.env ?? process.env;
+  const readYaml = deps.readPlatformYaml ?? defaultReadPlatformYaml;
+  const resolveId = deps.resolveIdentity ?? resolveIdentity;
+  const mkClient = deps.createProxyClient ?? createProxyClient;
+  const gitState = deps.getGitState ?? getGitState;
+  const build = deps.runBuild ?? runBuild;
+  const walk = deps.walkFiles ?? walkFiles;
+  const upload = deps.uploadFiles ?? uploadFiles;
+  const success = deps.logSuccess ?? ((s) => log.success(s));
+  const info = deps.logInfo ?? ((s) => log.info(s));
+  const warn = deps.logWarn ?? ((s) => log.warn(s));
+  const error = deps.logError ?? ((s) => log.error(s));
+  const exit = deps.exit ?? exitWithCode;
+  try {
+    const identity = await resolveId({ env });
+    if (!identity) {
+      throw new CredentialError(
+        "No GitHub identity available. Run `universe login`, set $GITHUB_TOKEN, or install the gh CLI."
+      );
+    }
+    const config = await readAndParseConfig(cwd, readYaml);
+    const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL;
+    const client = mkClient({
+      baseUrl,
+      getAuthToken: () => identity.token
+    });
+    let me;
+    try {
+      me = await client.whoami();
+    } catch (err) {
+      rethrowProxy("whoami preflight failed", err);
+    }
+    if (!me.authorizedSites.includes(config.site)) {
+      throw new CredentialError(
+        formatUnauthorizedSiteError({
+          attempted: config.site,
+          login: me.login,
+          authorized: me.authorizedSites
+        })
+      );
+    }
+    const git = gitState();
+    if (git.dirty) {
+      warn(
+        "git working tree is dirty \u2014 uncommitted changes will not be reflected."
+      );
+    }
+    const sha = git.hash ?? syntheticSha();
+    const outputDir = options.dir ?? config.build.output;
+    const buildResult = await build({
+      command: config.build.command,
+      cwd,
+      outputDir
+    });
+    if (buildResult.skipped) {
+      info("build.command not set \u2014 using pre-built output.");
+    }
+    const resolvedOutputDir = buildResult.outputDir;
+    const walked = walk(resolvedOutputDir);
+    const ignore = createIgnoreFilter(config.deploy.ignore);
+    const filtered = walked.filter((f) => !ignore(f.relPath));
+    if (filtered.length === 0) {
+      throw new GitError(`No files to deploy under ${resolvedOutputDir}.`);
+    }
+    const fileList = filtered.map((f) => f.relPath);
+    let initResult;
+    try {
+      initResult = await client.deployInit({
+        site: config.site,
+        sha,
+        files: fileList
+      });
+    } catch (err) {
+      rethrowProxy("deploy init failed", err);
+    }
+    const uploadResult = await upload({
+      client,
+      deployId: initResult.deployId,
+      jwt: initResult.jwt,
+      files: filtered
+    });
+    if (uploadResult.errors.length > 0) {
+      const message = `Upload partially failed: ${uploadResult.errors.length} file(s) failed:
+  - ${uploadResult.errors.join("\n  - ")}`;
+      throw new PartialUploadError(message);
+    }
+    const mode = options.promote ? "production" : "preview";
+    let finalizeResult;
+    try {
+      finalizeResult = await client.deployFinalize({
+        deployId: initResult.deployId,
+        jwt: initResult.jwt,
+        mode,
+        files: fileList
+      });
+    } catch (err) {
+      rethrowProxy("deploy finalize failed", err);
+    }
+    if (options.json) {
+      emitJson(
+        buildEnvelope("deploy", true, {
+          deployId: finalizeResult.deployId,
+          url: finalizeResult.url,
+          mode: finalizeResult.mode,
+          site: config.site,
+          sha,
+          fileCount: uploadResult.fileCount,
+          totalSize: uploadResult.totalSize,
+          identitySource: identity.source
+        })
+      );
+    } else {
+      const sizeKB = (uploadResult.totalSize / 1024).toFixed(1);
+      const nextLine = mode === "preview" ? "Next: universe static promote" : "Promoted to production.";
+      success(
+        [
+          `Deployed ${finalizeResult.deployId}`,
+          ``,
+          `  Site:     ${config.site}`,
+          `  Files:    ${uploadResult.fileCount}`,
+          `  Size:     ${sizeKB} KB`,
+          `  Mode:     ${mode}`,
+          `  URL:      ${finalizeResult.url}`,
+          ``,
+          nextLine
+        ].join("\n")
+      );
+    }
+  } catch (err) {
+    let code;
+    let message;
+    if (err instanceof ProxyError) {
+      code = err.exitCode;
+      message = err.message;
+    } else if (err instanceof CliError) {
+      code = err.exitCode;
+      message = err.message;
+    } else if (err instanceof Error) {
+      code = EXIT_USAGE;
+      message = err.message;
+    } else {
+      code = EXIT_USAGE;
+      message = String(err);
+    }
+    if (options.json) {
+      emitJson(buildErrorEnvelope("deploy", code, message));
+    } else {
+      error(message);
+    }
+    exit(code);
+  }
+}
+
+// src/commands/login.ts
+import { log as log2 } from "@clack/prompts";
+
+// src/lib/device-flow.ts
+var DEVICE_CODE_URL = "https://github.com/login/device/code";
+var ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
+var DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+function isAccessTokenSuccess(body) {
+  return "access_token" in body && typeof body.access_token === "string";
+}
+var defaultSleep = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms));
+async function runDeviceFlow(opts) {
+  const fetchImpl = opts.fetch ?? globalThis.fetch.bind(globalThis);
+  const sleep = opts.sleep ?? defaultSleep;
+  const startResp = await fetchImpl(DEVICE_CODE_URL, {
+    method: "POST",
+    headers: {
+      Accept: "application/json",
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify({
+      client_id: opts.clientId,
+      ...opts.scope ? { scope: opts.scope } : {}
+    })
   });
-  await writeAlias(client, bucket, site, "preview", deployId);
-  const sizeKB = (uploadResult.totalSize / 1024).toFixed(1);
-  const previewDomain = config.domain?.preview ?? `preview.${site}`;
-  const humanMsg = [
-    `Deployed ${deployId}`,
-    ``,
-    `  Site:     ${site}`,
-    `  Files:    ${uploadResult.fileCount}`,
-    `  Size:     ${sizeKB} KB`,
-    `  Alias:    preview`,
-    `  Preview:  https://${previewDomain}`,
-    ``,
-    `Next: universe static promote`
-  ].join("\n");
-  outputSuccess(ctx, humanMsg, {
-    deployId,
-    site,
-    fileCount: uploadResult.fileCount,
-    totalSize: uploadResult.totalSize,
-    alias: "preview",
-    previewDomain
+  if (!startResp.ok) {
+    throw new Error(`device code request failed: HTTP ${startResp.status}`);
+  }
+  const start = await startResp.json();
+  await opts.onPrompt({
+    userCode: start.user_code,
+    verificationUri: start.verification_uri,
+    expiresIn: start.expires_in
   });
+  let intervalSec = start.interval > 0 ? start.interval : 5;
+  while (true) {
+    await sleep(intervalSec * 1e3);
+    const pollResp = await fetchImpl(ACCESS_TOKEN_URL, {
+      method: "POST",
+      headers: {
+        Accept: "application/json",
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        client_id: opts.clientId,
+        device_code: start.device_code,
+        grant_type: DEVICE_CODE_GRANT
+      })
+    });
+    if (!pollResp.ok) {
+      throw new Error(`device flow poll failed: HTTP ${pollResp.status}`);
+    }
+    const body = await pollResp.json();
+    if (isAccessTokenSuccess(body)) {
+      return body.access_token;
+    }
+    switch (body.error) {
+      case "authorization_pending":
+        continue;
+      case "slow_down":
+        intervalSec += 5;
+        continue;
+      case "expired_token":
+        throw new Error(
+          "device flow expired before authorization. Run `universe login` again."
+        );
+      case "access_denied":
+        throw new Error("device flow access denied by user.");
+      default:
+        throw new Error(
+          body.error_description ? `device flow error: ${body.error}: ${body.error_description}` : `device flow error: ${body.error}`
+        );
+    }
+  }
 }
 
-// src/storage/deploys.ts
-async function listDeploys(client, bucket, site) {
-  const prefix = `${site}/deploys/`;
-  const items = await listObjects(client, { bucket, prefix });
-  const deployIds = /* @__PURE__ */ new Set();
-  for (const item of items) {
-    const afterPrefix = item.key.slice(prefix.length);
-    const segment = afterPrefix.split("/")[0];
-    if (segment) {
-      deployIds.add(segment);
+// src/commands/login.ts
+var DEFAULT_SCOPE = "read:org user:email";
+function emitJson2(envelope) {
+  process.stdout.write(JSON.stringify(envelope) + "\n");
+}
+async function login(options, deps = {}) {
+  const env = deps.env ?? process.env;
+  const runFlow = deps.runDeviceFlow ?? runDeviceFlow;
+  const save = deps.saveToken ?? saveToken;
+  const load = deps.loadToken ?? loadToken;
+  const success = deps.logSuccess ?? ((s) => log2.success(s));
+  const info = deps.logInfo ?? ((s) => log2.info(s));
+  const error = deps.logError ?? ((s) => log2.error(s));
+  const exit = deps.exit ?? exitWithCode;
+  const envClientId = env["UNIVERSE_GH_CLIENT_ID"];
+  const clientId = envClientId && envClientId.trim().length > 0 ? envClientId : DEFAULT_GH_CLIENT_ID;
+  if (!options.force) {
+    const existing = await load();
+    if (existing) {
+      const msg = "Already logged in. Run `universe logout` first or pass --force to replace the stored token.";
+      if (options.json) {
+        emitJson2({
+          schemaVersion: "1",
+          command: "login",
+          success: false,
+          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+          error: { code: EXIT_CONFIRM, message: msg }
+        });
+      } else {
+        error(msg);
+      }
+      exit(EXIT_CONFIRM);
+      return;
     }
   }
-  return [...deployIds].sort().reverse();
+  let token;
+  try {
+    token = await runFlow({
+      clientId,
+      scope: DEFAULT_SCOPE,
+      onPrompt: ({ userCode, verificationUri, expiresIn }) => {
+        if (options.json) {
+          emitJson2(
+            buildEnvelope("login", true, {
+              userCode,
+              verificationUri,
+              expiresIn,
+              stored: false
+            })
+          );
+        } else {
+          info(
+            [
+              `Open ${verificationUri} in your browser`,
+              `and enter code: ${userCode}`,
+              `(code expires in ${Math.round(expiresIn / 60)} min)`
+            ].join("\n")
+          );
+        }
+      }
+    });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (options.json) {
+      emitJson2({
+        schemaVersion: "1",
+        command: "login",
+        success: false,
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        error: { code: EXIT_CREDENTIALS, message }
+      });
+    } else {
+      error(message);
+    }
+    exit(EXIT_CREDENTIALS);
+    return;
+  }
+  await save(token);
+  if (options.json) {
+    emitJson2(buildEnvelope("login", true, { stored: true }));
+  } else {
+    success("Logged in. Token stored at ~/.config/universe-cli/token.");
+  }
 }
-async function deployExists(client, bucket, site, deployId) {
-  const prefix = `${site}/deploys/${deployId}/`;
-  const items = await listObjects(client, { bucket, prefix });
-  return items.length > 0;
+
+// src/commands/logout.ts
+import { log as log3 } from "@clack/prompts";
+function emitJson3(envelope) {
+  process.stdout.write(JSON.stringify(envelope) + "\n");
+}
+async function logout(options, deps = {}) {
+  const load = deps.loadToken ?? loadToken;
+  const del = deps.deleteToken ?? deleteToken;
+  const success = deps.logSuccess ?? ((s) => log3.success(s));
+  const info = deps.logInfo ?? ((s) => log3.info(s));
+  const existing = await load();
+  await del();
+  if (options.json) {
+    emitJson3(buildEnvelope("logout", true, { removed: existing !== null }));
+    return;
+  }
+  if (existing) {
+    success("Logged out. Stored token removed.");
+  } else {
+    info("No token was stored. Nothing to remove.");
+  }
 }
 
-// src/commands/promote.ts
-async function promote(options) {
-  const config = loadConfig();
-  const credentials = resolveCredentials({
-    remoteName: config.static.rclone_remote
-  });
-  const client = createS3Client(credentials);
-  const bucket = config.static.bucket;
-  const site = config.name;
-  const ctx = { json: options.json, command: "promote" };
-  let deployId;
-  if (options.deployId) {
-    const exists = await deployExists(client, bucket, site, options.deployId);
-    if (!exists) {
-      outputError(
-        ctx,
-        EXIT_DEPLOY_NOT_FOUND,
-        `Deploy ${options.deployId} not found`
-      );
-      exitWithCode(
-        EXIT_DEPLOY_NOT_FOUND,
-        `Deploy ${options.deployId} not found`
+// src/commands/ls.ts
+import { readFile as readFile3 } from "fs/promises";
+import { resolve as resolve3 } from "path";
+import { log as log4 } from "@clack/prompts";
+var defaultReadPlatformYaml2 = async (cwd) => {
+  return readFile3(resolve3(cwd, "platform.yaml"), "utf-8");
+};
+function emitJson4(envelope) {
+  process.stdout.write(JSON.stringify(envelope) + "\n");
+}
+var DEPLOY_ID_RE = /^(\d{8})-(\d{6})-([a-f0-9]+)$/i;
+function parseDeployId(deployId) {
+  const m = DEPLOY_ID_RE.exec(deployId);
+  if (!m) return { deployId, timestamp: null, sha: null };
+  const [, ymd, hms, sha] = m;
+  if (!ymd || !hms || !sha) return { deployId, timestamp: null, sha: null };
+  const iso = `${ymd.slice(0, 4)}-${ymd.slice(4, 6)}-${ymd.slice(6, 8)}T${hms.slice(0, 2)}:${hms.slice(2, 4)}:${hms.slice(4, 6)}Z`;
+  return { deployId, timestamp: iso, sha };
+}
+async function readSiteFromYaml(cwd, read) {
+  let raw;
+  try {
+    raw = await read(cwd);
+  } catch (err) {
+    if (err instanceof Error && err.code === "ENOENT") {
+      return null;
+    }
+    throw err;
+  }
+  const r = parsePlatformYaml(raw);
+  if (!r.ok) throw new ConfigError(r.error);
+  const config = r.value;
+  return config.site;
+}
+function formatTable(deploys) {
+  const header = ["DEPLOY ID", "TIMESTAMP", "SHA"];
+  const rows = deploys.map((d) => [
+    d.deployId,
+    d.timestamp ? d.timestamp.replace("T", " ").replace("Z", "") : "\u2014",
+    d.sha ?? "\u2014"
+  ]);
+  const widths = header.map(
+    (h, i) => Math.max(h.length, ...rows.map((r) => (r[i] ?? "").length))
+  );
+  const fmt = (cells) => cells.map((c, i) => c.padEnd(widths[i] ?? 0)).join("  ");
+  return [fmt(header), ...rows.map(fmt)].join("\n");
+}
+async function ls(options, deps = {}) {
+  const cwd = deps.cwd ?? process.cwd();
+  const env = deps.env ?? process.env;
+  const readYaml = deps.readPlatformYaml ?? defaultReadPlatformYaml2;
+  const resolveId = deps.resolveIdentity ?? resolveIdentity;
+  const mkClient = deps.createProxyClient ?? createProxyClient;
+  const success = deps.logSuccess ?? ((s) => log4.success(s));
+  const info = deps.logInfo ?? ((s) => log4.info(s));
+  const error = deps.logError ?? ((s) => log4.error(s));
+  const exit = deps.exit ?? exitWithCode;
+  try {
+    const identity = await resolveId({ env });
+    if (!identity) {
+      throw new CredentialError(
+        "No GitHub identity available. Run `universe login`, set $GITHUB_TOKEN, or install the gh CLI."
       );
-      return;
     }
-    deployId = options.deployId;
-  } else {
-    const preview = await readAlias(client, bucket, site, "preview");
-    if (!preview) {
-      outputError(
-        ctx,
-        EXIT_ALIAS,
-        "No preview alias set \u2014 deploy first or specify a deploy ID"
+    let site = options.site?.trim() || null;
+    if (!site) {
+      site = await readSiteFromYaml(cwd, readYaml);
+    }
+    if (!site) {
+      throw new ConfigError(
+        "No site to list. Run from a directory with `platform.yaml`, or pass `--site <name>`."
       );
-      exitWithCode(
-        EXIT_ALIAS,
-        "No preview alias set \u2014 deploy first or specify a deploy ID"
+    }
+    const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL;
+    const client = mkClient({
+      baseUrl,
+      getAuthToken: () => identity.token
+    });
+    const raw = await client.siteDeploys({ site });
+    const deploys = raw.map((d) => parseDeployId(d.deployId));
+    if (options.json) {
+      emitJson4(
+        buildEnvelope("ls", true, {
+          site,
+          deploys,
+          identitySource: identity.source
+        })
       );
       return;
     }
-    deployId = preview;
+    if (deploys.length === 0) {
+      info(`(no deploys for ${site})`);
+      return;
+    }
+    success(formatTable(deploys));
+  } catch (err) {
+    const { code, message } = wrapProxyError("ls", err);
+    if (options.json) {
+      emitJson4(buildErrorEnvelope("ls", code, message));
+    } else {
+      error(message);
+    }
+    exit(code);
+  }
+}
+
+// src/commands/promote.ts
+import { readFile as readFile4 } from "fs/promises";
+import { resolve as resolve4 } from "path";
+import { log as log5 } from "@clack/prompts";
+var defaultReadPlatformYaml3 = async (cwd) => {
+  return readFile4(resolve4(cwd, "platform.yaml"), "utf-8");
+};
+function emitJson5(envelope) {
+  process.stdout.write(JSON.stringify(envelope) + "\n");
+}
+async function readAndParseConfig2(cwd, read) {
+  let raw;
+  try {
+    raw = await read(cwd);
+  } catch (err) {
+    if (err instanceof Error && err.code === "ENOENT") {
+      throw new ConfigError(
+        `platform.yaml not found in ${cwd}. See docs/platform-yaml.md.`
+      );
+    }
+    throw err;
+  }
+  const r = parsePlatformYaml(raw);
+  if (!r.ok) throw new ConfigError(r.error);
+  return r.value;
+}
+async function promote(options, deps = {}) {
+  const cwd = deps.cwd ?? process.cwd();
+  const env = deps.env ?? process.env;
+  const readYaml = deps.readPlatformYaml ?? defaultReadPlatformYaml3;
+  const resolveId = deps.resolveIdentity ?? resolveIdentity;
+  const mkClient = deps.createProxyClient ?? createProxyClient;
+  const success = deps.logSuccess ?? ((s) => log5.success(s));
+  const error = deps.logError ?? ((s) => log5.error(s));
+  const exit = deps.exit ?? exitWithCode;
+  try {
+    const identity = await resolveId({ env });
+    if (!identity) {
+      throw new CredentialError(
+        "No GitHub identity available. Run `universe login`, set $GITHUB_TOKEN, or install the gh CLI."
+      );
+    }
+    const config = await readAndParseConfig2(cwd, readYaml);
+    const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL;
+    const client = mkClient({
+      baseUrl,
+      getAuthToken: () => identity.token
+    });
+    let result;
+    if (options.from) {
+      result = await client.siteRollback({
+        site: config.site,
+        to: options.from
+      });
+    } else {
+      result = await client.sitePromote({ site: config.site });
+    }
+    if (options.json) {
+      emitJson5(
+        buildEnvelope("promote", true, {
+          deployId: result.deployId,
+          url: result.url,
+          site: config.site,
+          identitySource: identity.source
+        })
+      );
+    } else {
+      success(
+        [
+          `Promoted ${result.deployId} to production`,
+          ``,
+          `  Site:        ${config.site}`,
+          `  Deploy:      ${result.deployId}`,
+          `  Production:  ${result.url}`
+        ].join("\n")
+      );
+    }
+  } catch (err) {
+    const { code, message } = wrapProxyError("promote", err);
+    if (options.json) {
+      emitJson5(buildErrorEnvelope("promote", code, message));
+    } else {
+      error(message);
+    }
+    exit(code);
   }
-  await writeAlias(client, bucket, site, "production", deployId);
-  const productionDomain = config.domain?.production ?? site;
-  const humanMsg = [
-    `Promoted ${deployId} to production`,
-    ``,
-    `  Site:        ${site}`,
-    `  Deploy:      ${deployId}`,
-    `  Production:  https://${productionDomain}`
-  ].join("\n");
-  outputSuccess(ctx, humanMsg, {
-    deployId,
-    site,
-    alias: "production",
-    productionDomain
-  });
 }
 
 // src/commands/rollback.ts
-import { confirm } from "@clack/prompts";
-async function rollback(options) {
-  const config = loadConfig();
-  const credentials = resolveCredentials({
-    remoteName: config.static.rclone_remote
-  });
-  const client = createS3Client(credentials);
-  const bucket = config.static.bucket;
-  const site = config.name;
-  const ctx = { json: options.json, command: "rollback" };
-  const currentDeployId = await readAlias(client, bucket, site, "production");
-  if (!currentDeployId) {
-    outputError(
-      ctx,
-      EXIT_ALIAS,
-      "No production alias set \u2014 nothing to rollback"
-    );
-    exitWithCode(EXIT_ALIAS, "No production alias set \u2014 nothing to rollback");
-    return;
+import { readFile as readFile5 } from "fs/promises";
+import { resolve as resolve5 } from "path";
+import { log as log6 } from "@clack/prompts";
+var defaultReadPlatformYaml4 = async (cwd) => {
+  return readFile5(resolve5(cwd, "platform.yaml"), "utf-8");
+};
+function emitJson6(envelope) {
+  process.stdout.write(JSON.stringify(envelope) + "\n");
+}
+async function readAndParseConfig3(cwd, read) {
+  let raw;
+  try {
+    raw = await read(cwd);
+  } catch (err) {
+    if (err instanceof Error && err.code === "ENOENT") {
+      throw new ConfigError(
+        `platform.yaml not found in ${cwd}. See docs/platform-yaml.md.`
+      );
+    }
+    throw err;
   }
-  const deploys = await listDeploys(client, bucket, site);
-  const currentIndex = deploys.indexOf(currentDeployId);
-  const previousDeploy = deploys[currentIndex + 1];
-  if (!previousDeploy) {
-    outputError(ctx, EXIT_ALIAS, "no previous deploy to rollback to");
-    exitWithCode(EXIT_ALIAS, "no previous deploy to rollback to");
+  const r = parsePlatformYaml(raw);
+  if (!r.ok) throw new ConfigError(r.error);
+  return r.value;
+}
+async function rollback(options, deps = {}) {
+  const cwd = deps.cwd ?? process.cwd();
+  const env = deps.env ?? process.env;
+  const readYaml = deps.readPlatformYaml ?? defaultReadPlatformYaml4;
+  const resolveId = deps.resolveIdentity ?? resolveIdentity;
+  const mkClient = deps.createProxyClient ?? createProxyClient;
+  const success = deps.logSuccess ?? ((s) => log6.success(s));
+  const error = deps.logError ?? ((s) => log6.error(s));
+  const exit = deps.exit ?? exitWithCode;
+  try {
+    if (!options.to || options.to.trim().length === 0) {
+      throw new UsageError(
+        "rollback requires --to <deployId>. Run `universe static ls` to list past deploys."
+      );
+    }
+    const identity = await resolveId({ env });
+    if (!identity) {
+      throw new CredentialError(
+        "No GitHub identity available. Run `universe login`, set $GITHUB_TOKEN, or install the gh CLI."
+      );
+    }
+    const config = await readAndParseConfig3(cwd, readYaml);
+    const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL;
+    const client = mkClient({
+      baseUrl,
+      getAuthToken: () => identity.token
+    });
+    const result = await client.siteRollback({
+      site: config.site,
+      to: options.to.trim()
+    });
+    if (options.json) {
+      emitJson6(
+        buildEnvelope("rollback", true, {
+          deployId: result.deployId,
+          url: result.url,
+          site: config.site,
+          identitySource: identity.source
+        })
+      );
+    } else {
+      success(
+        [
+          `Rolled production back to ${result.deployId}`,
+          ``,
+          `  Site:        ${config.site}`,
+          `  Deploy:      ${result.deployId}`,
+          `  Production:  ${result.url}`
+        ].join("\n")
+      );
+    }
+  } catch (err) {
+    const { code, message } = wrapProxyError("rollback", err);
+    if (options.json) {
+      emitJson6(buildErrorEnvelope("rollback", code, message));
+    } else {
+      error(message);
+    }
+    exit(code);
+  }
+}
+
+// src/commands/whoami.ts
+import { log as log7 } from "@clack/prompts";
+var DEFAULT_PROXY_URL2 = "https://uploads.freecode.camp";
+function emitJson7(envelope) {
+  process.stdout.write(JSON.stringify(envelope) + "\n");
+}
+async function whoami(options, deps = {}) {
+  const env = deps.env ?? process.env;
+  const resolve6 = deps.resolveIdentity ?? resolveIdentity;
+  const mkClient = deps.createProxyClient ?? createProxyClient;
+  const success = deps.logSuccess ?? ((s) => log7.success(s));
+  const error = deps.logError ?? ((s) => log7.error(s));
+  const exit = deps.exit ?? exitWithCode;
+  const identity = await resolve6({ env });
+  if (!identity) {
+    const msg = "No GitHub identity available. Run `universe login`, set $GITHUB_TOKEN, or install the gh CLI.";
+    if (options.json) {
+      emitJson7(buildErrorEnvelope("whoami", EXIT_CREDENTIALS, msg));
+    } else {
+      error(msg);
+    }
+    exit(EXIT_CREDENTIALS);
     return;
   }
-  if (options.json && !options.confirm) {
-    outputError(
-      ctx,
-      EXIT_CONFIRM,
-      "Rollback requires --confirm flag in JSON mode"
+  const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL2;
+  const client = mkClient({
+    baseUrl,
+    getAuthToken: () => identity.token
+  });
+  try {
+    const result = await client.whoami();
+    const count = result.authorizedSites.length;
+    if (options.json) {
+      emitJson7(
+        buildEnvelope("whoami", true, {
+          login: result.login,
+          identitySource: identity.source,
+          authorizedSitesCount: count
+        })
+      );
+    } else {
+      const sitesLine = count === 0 ? "Authorized for 0 sites." : `Authorized for ${count} site${count === 1 ? "" : "s"} \u2014 run \`universe sites ls --mine\``;
+      success(
+        [
+          `Logged in as: ${result.login}`,
+          `Identity source: ${identity.source}`,
+          sitesLine
+        ].join("\n")
+      );
+    }
+  } catch (err) {
+    const exitCode = err instanceof CliError ? err.exitCode : EXIT_CREDENTIALS;
+    const message = err instanceof ProxyError ? `whoami failed (${err.code}): ${err.message}` : err instanceof Error ? err.message : String(err);
+    if (options.json) {
+      emitJson7(buildErrorEnvelope("whoami", exitCode, message));
+    } else {
+      error(message);
+    }
+    exit(exitCode);
+  }
+}
+
+// src/commands/sites/ls.ts
+import { log as log8 } from "@clack/prompts";
+
+// src/commands/sites/_shared.ts
+function emitJson8(envelope) {
+  process.stdout.write(JSON.stringify(envelope) + "\n");
+}
+function parseTeamsFlag(raw) {
+  if (raw === void 0 || raw === null) return [];
+  const tokens = Array.isArray(raw) ? raw : [raw];
+  return tokens.flatMap((s) => s.split(",")).map((s) => s.trim()).filter((s) => s.length > 0);
+}
+async function setupClient(deps) {
+  const env = deps.env ?? process.env;
+  const resolveId = deps.resolveIdentity ?? resolveIdentity;
+  const mkClient = deps.createProxyClient ?? createProxyClient;
+  const identity = await resolveId({ env });
+  if (!identity) {
+    throw new CredentialError(
+      "No GitHub identity available. Run `universe login`, set $GITHUB_TOKEN, or install the gh CLI."
     );
-    exitWithCode(EXIT_CONFIRM, "Rollback requires --confirm flag in JSON mode");
-    return;
   }
-  if (!options.json && !options.confirm) {
-    const confirmed = await confirm({
-      message: `Rollback production from ${currentDeployId} to ${previousDeploy}?`
+  const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL;
+  const client = mkClient({
+    baseUrl,
+    getAuthToken: () => identity.token
+  });
+  return { client, identitySource: identity.source };
+}
+
+// src/commands/sites/ls.ts
+function formatTable2(rows) {
+  if (rows.length === 0) return "No registered sites.";
+  const headers = ["SLUG", "TEAMS", "CREATED BY", "CREATED AT"];
+  const cells = rows.map((r) => [
+    r.slug,
+    r.teams.join(","),
+    r.createdBy,
+    r.createdAt
+  ]);
+  const widths = headers.map(
+    (h, i) => Math.max(h.length, ...cells.map((row) => row[i]?.length ?? 0))
+  );
+  const fmt = (row) => row.map((c, i) => c.padEnd(widths[i] ?? 0)).join("  ");
+  return [fmt(headers), ...cells.map(fmt)].join("\n");
+}
+async function ls2(options, deps = {}) {
+  const command = "sites ls";
+  const success = deps.logSuccess ?? ((s) => log8.message(s));
+  const error = deps.logError ?? ((s) => log8.error(s));
+  const exit = deps.exit ?? exitWithCode;
+  try {
+    const { client } = await setupClient(deps);
+    let rows = await client.listSites();
+    let scope = "all";
+    if (options.mine) {
+      const me = await client.whoami();
+      const allowed = new Set(me.authorizedSites);
+      rows = rows.filter((r) => allowed.has(r.slug));
+      scope = "mine";
+    }
+    if (options.json) {
+      emitJson8(
+        buildEnvelope(command, true, {
+          count: rows.length,
+          scope,
+          sites: rows
+        })
+      );
+    } else {
+      success(formatTable2(rows));
+    }
+  } catch (err) {
+    const { code, message } = wrapProxyError(command, err);
+    if (options.json) {
+      emitJson8(buildErrorEnvelope(command, code, message));
+    } else {
+      error(message);
+    }
+    exit(code);
+  }
+}
+
+// src/commands/sites/register.ts
+import { log as log9 } from "@clack/prompts";
+async function register(options, deps = {}) {
+  const command = "sites register";
+  const success = deps.logSuccess ?? ((s) => log9.success(s));
+  const error = deps.logError ?? ((s) => log9.error(s));
+  const exit = deps.exit ?? exitWithCode;
+  try {
+    if (!options.slug || options.slug.trim().length === 0) {
+      throw new UsageError("slug is required (positional argument)");
+    }
+    const teams = parseTeamsFlag(options.team);
+    const { client } = await setupClient(deps);
+    const row = await client.registerSite({
+      slug: options.slug,
+      teams: teams.length > 0 ? teams : void 0
     });
-    if (!confirmed || typeof confirmed === "symbol") {
-      return;
+    if (options.json) {
+      emitJson8(
+        buildEnvelope(command, true, {
+          slug: row.slug,
+          teams: row.teams,
+          createdAt: row.createdAt,
+          createdBy: row.createdBy
+        })
+      );
+    } else {
+      success(
+        [
+          `Registered ${row.slug}`,
+          ``,
+          `  Slug:        ${row.slug}`,
+          `  Teams:       ${row.teams.join(", ")}`,
+          `  Created by:  ${row.createdBy}`,
+          `  Created at:  ${row.createdAt}`
+        ].join("\n")
+      );
     }
+  } catch (err) {
+    const { code, message } = wrapProxyError(command, err);
+    if (options.json) {
+      emitJson8(buildErrorEnvelope(command, code, message));
+    } else {
+      error(message);
+    }
+    exit(code);
   }
-  await writeAlias(client, bucket, site, "production", previousDeploy);
-  const productionDomain = config.domain?.production ?? site;
-  const humanMsg = [
-    `Rolled back production`,
-    ``,
-    `  Site:        ${site}`,
-    `  Was:         ${currentDeployId}`,
-    `  Now:         ${previousDeploy}`,
-    `  Production:  https://${productionDomain}`
-  ].join("\n");
-  outputSuccess(ctx, humanMsg, {
-    previousDeployId: currentDeployId,
-    rolledBackTo: previousDeploy,
-    site,
-    alias: "production",
-    productionDomain
+}
+
+// src/commands/sites/rm.ts
+import { log as log10 } from "@clack/prompts";
+async function rm2(options, deps = {}) {
+  const command = "sites rm";
+  const success = deps.logSuccess ?? ((s) => log10.success(s));
+  const error = deps.logError ?? ((s) => log10.error(s));
+  const exit = deps.exit ?? exitWithCode;
+  try {
+    if (!options.slug || options.slug.trim().length === 0) {
+      throw new UsageError("slug is required (positional argument)");
+    }
+    const { client } = await setupClient(deps);
+    await client.deleteSite({ slug: options.slug });
+    if (options.json) {
+      emitJson8(
+        buildEnvelope(command, true, {
+          slug: options.slug,
+          deleted: true
+        })
+      );
+    } else {
+      success(
+        [
+          `Deleted ${options.slug}`,
+          ``,
+          `  Note: R2 deploy bytes are NOT removed; they age out via the`,
+          `        post-GA cleanup cron.`
+        ].join("\n")
+      );
+    }
+  } catch (err) {
+    const { code, message } = wrapProxyError(command, err);
+    if (options.json) {
+      emitJson8(buildErrorEnvelope(command, code, message));
+    } else {
+      error(message);
+    }
+    exit(code);
+  }
+}
+
+// src/commands/sites/update.ts
+import { log as log11 } from "@clack/prompts";
+async function update(options, deps = {}) {
+  const command = "sites update";
+  const success = deps.logSuccess ?? ((s) => log11.success(s));
+  const error = deps.logError ?? ((s) => log11.error(s));
+  const exit = deps.exit ?? exitWithCode;
+  try {
+    if (!options.slug || options.slug.trim().length === 0) {
+      throw new UsageError("slug is required (positional argument)");
+    }
+    const teams = parseTeamsFlag(options.team);
+    if (teams.length === 0) {
+      throw new UsageError(
+        "--team is required with at least one slug; use `sites rm` to remove a site"
+      );
+    }
+    const { client } = await setupClient(deps);
+    const row = await client.updateSite({
+      slug: options.slug,
+      teams
+    });
+    if (options.json) {
+      emitJson8(
+        buildEnvelope(command, true, {
+          slug: row.slug,
+          teams: row.teams,
+          updatedAt: row.updatedAt
+        })
+      );
+    } else {
+      success(
+        [
+          `Updated ${row.slug}`,
+          ``,
+          `  Slug:        ${row.slug}`,
+          `  Teams:       ${row.teams.join(", ")}`,
+          `  Updated at:  ${row.updatedAt}`
+        ].join("\n")
+      );
+    }
+  } catch (err) {
+    const { code, message } = wrapProxyError(command, err);
+    if (options.json) {
+      emitJson8(buildErrorEnvelope(command, code, message));
+    } else {
+      error(message);
+    }
+    exit(code);
+  }
+}
+
+// src/output/format.ts
+import { log as log12 } from "@clack/prompts";
+
+// src/output/redact.ts
+var AWS_KEY_PREFIX_PATTERN = /(?:AKIA|ASIA|AROA|AIDA|ACCA|ANPA|ABIA|AGPA)[A-Z0-9]{12,}/g;
+var URL_CREDS_PATTERN = /https?:\/\/[^@\s]+@/g;
+var CREDENTIAL_CONTEXT_PATTERN = /(?:access_key_id|secret_access_key|accessKeyId|secretAccessKey|secret|password|token|key|credential|auth)\s*[=:]\s*([A-Za-z0-9/+=]{21,})/gi;
+var HEX_CREDENTIAL_CONTEXT_PATTERN = /(?:secret|password|token|key|credential|auth|access_key_id|secret_access_key)\s*[=:]\s*([a-f0-9]{32,})/gi;
+var JSON_CREDENTIAL_PATTERN = /"(?:secret|password|token|key|credential|auth|access_key_id|secret_access_key|accessKeyId|secretAccessKey)"\s*:\s*"[^"]+"/gi;
+var BEARER_PATTERN = /\bBearer\s+[A-Za-z0-9._~+/=-]+/gi;
+function maskAwsKey(match) {
+  return match.slice(0, 4) + "****" + match.slice(-4);
+}
+function maskUrlCreds(match) {
+  const atIndex = match.lastIndexOf("@");
+  const protocolEnd = match.indexOf("://") + 3;
+  return match.slice(0, protocolEnd) + "****:****@" + match.slice(atIndex + 1);
+}
+function redact(value) {
+  let result = value;
+  result = result.replace(URL_CREDS_PATTERN, maskUrlCreds);
+  result = result.replace(AWS_KEY_PREFIX_PATTERN, maskAwsKey);
+  result = result.replace(BEARER_PATTERN, "Bearer ****");
+  result = result.replace(JSON_CREDENTIAL_PATTERN, (match) => {
+    const colonIndex = match.indexOf(":");
+    return match.slice(0, colonIndex + 1) + '"****"';
   });
+  result = result.replace(
+    CREDENTIAL_CONTEXT_PATTERN,
+    (_match, _secret, _offset, _full) => {
+      const eqIndex = _match.indexOf("=");
+      const colonIndex = _match.indexOf(":");
+      const sepIndex = eqIndex >= 0 && colonIndex >= 0 ? Math.min(eqIndex, colonIndex) : eqIndex >= 0 ? eqIndex : colonIndex;
+      const prefix = _match.slice(0, sepIndex + 1);
+      return prefix + "****";
+    }
+  );
+  result = result.replace(HEX_CREDENTIAL_CONTEXT_PATTERN, (_match, _secret) => {
+    const eqIndex = _match.indexOf("=");
+    const colonIndex = _match.indexOf(":");
+    const sepIndex = eqIndex >= 0 && colonIndex >= 0 ? Math.min(eqIndex, colonIndex) : eqIndex >= 0 ? eqIndex : colonIndex;
+    const prefix = _match.slice(0, sepIndex + 1);
+    return prefix + "****";
+  });
+  return result;
+}
+
+// src/output/format.ts
+function outputError(ctx, code, message, issues) {
+  const redactedMessage = redact(message);
+  const redactedIssues = issues?.map(redact);
+  if (ctx.json) {
+    const envelope = buildErrorEnvelope(
+      ctx.command,
+      code,
+      redactedMessage,
+      redactedIssues
+    );
+    process.stdout.write(JSON.stringify(envelope) + "\n");
+  } else {
+    log12.error(redactedMessage);
+  }
 }
 
 // src/cli.ts
-var version = true ? "0.3.3" : "0.0.0";
+var version = true ? "0.5.0" : "0.0.0";
 function handleActionError(command, json, err) {
   const ctx = { json, command };
   const message = err instanceof Error ? err.message : "unknown error";
   const code = err instanceof CliError ? err.exitCode : EXIT_USAGE;
   outputError(ctx, code, message);
-  exitWithCode(code, message);
+  exitWithCode(code);
+}
+function findFirstPositional(args) {
+  for (let i = 0; i < args.length; i += 1) {
+    const a = args[i];
+    if (typeof a === "string" && !a.startsWith("-")) return i;
+  }
+  return -1;
 }
 function run(argv = process.argv) {
   const args = argv.slice(2);
-  if (args[0] === "static") {
-    const staticCli = cac("universe static");
-    staticCli.command("deploy", "Deploy static site to S3").option("--json", "Output as JSON").option("--force", "Force deploy without git hash").option("--output-dir <dir>", "Build output directory").action(
-      async (flags) => {
+  const firstPosIdx = findFirstPositional(args);
+  const namespace = firstPosIdx >= 0 ? args[firstPosIdx] : void 0;
+  const isStatic = namespace === "static";
+  const isSites = namespace === "sites";
+  if (isSites) {
+    const sitesArgs = [
+      ...args.slice(0, firstPosIdx),
+      ...args.slice(firstPosIdx + 1)
+    ];
+    const sitesCli = cac("universe sites");
+    sitesCli.command("register <slug>", "Register a new static site (staff only)").option("--json", "Output as JSON").option(
+      "--team <name>",
+      "GitHub team slug (repeatable, or comma-separated). Defaults to staff."
+    ).action(
+      async (slug, flags) => {
         try {
-          await deploy({
+          await register({
             json: flags.json ?? false,
-            force: flags.force ?? false,
-            outputDir: flags.outputDir
+            slug,
+            team: flags.team
           });
         } catch (err) {
-          handleActionError("deploy", flags.json ?? false, err);
+          handleActionError("sites register", flags.json ?? false, err);
         }
       }
     );
-    staticCli.command("promote [deploy-id]", "Promote a deploy to production").option("--json", "Output as JSON").action(
-      async (deployId, flags) => {
+    sitesCli.command("ls", "List sites in the registry").option("--json", "Output as JSON").option(
+      "--mine",
+      "Filter to sites your GitHub identity is authorized for"
+    ).action(async (flags) => {
+      try {
+        await ls2({
+          json: flags.json ?? false,
+          mine: flags.mine ?? false
+        });
+      } catch (err) {
+        handleActionError("sites ls", flags.json ?? false, err);
+      }
+    });
+    sitesCli.command(
+      "update <slug>",
+      "Replace the teams list for an existing site (staff only)"
+    ).option("--json", "Output as JSON").option(
+      "--team <name>",
+      "GitHub team slug (repeatable, or comma-separated). Required."
+    ).action(
+      async (slug, flags) => {
         try {
-          await promote({ json: flags.json ?? false, deployId });
+          await update({
+            json: flags.json ?? false,
+            slug,
+            team: flags.team
+          });
         } catch (err) {
-          handleActionError("promote", flags.json ?? false, err);
+          handleActionError("sites update", flags.json ?? false, err);
         }
       }
     );
-    staticCli.command("rollback", "Rollback production to previous deploy").option("--json", "Output as JSON").option("--confirm", "Confirm rollback").action(async (flags) => {
+    sitesCli.command("rm <slug>", "Remove a site from the registry (staff only)").option("--json", "Output as JSON").action(async (slug, flags) => {
+      try {
+        await rm2({ json: flags.json ?? false, slug });
+      } catch (err) {
+        handleActionError("sites rm", flags.json ?? false, err);
+      }
+    });
+    sitesCli.help();
+    sitesCli.version(version);
+    sitesCli.parse(["node", "universe-sites", ...sitesArgs]);
+    return;
+  }
+  if (isStatic) {
+    const staticArgs = [
+      ...args.slice(0, firstPosIdx),
+      ...args.slice(firstPosIdx + 1)
+    ];
+    const staticCli = cac("universe static");
+    staticCli.command("deploy", "Deploy static site via the artemis proxy").option("--json", "Output as JSON").option("--promote", "Finalize as production (default: preview)").option("--dir <path>", "Override build.output dir from platform.yaml").action(
+      async (flags) => {
+        try {
+          await deploy({
+            json: flags.json ?? false,
+            promote: flags.promote ?? false,
+            dir: flags.dir
+          });
+        } catch (err) {
+          handleActionError("deploy", flags.json ?? false, err);
+        }
+      }
+    );
+    staticCli.command("promote", "Promote the current preview to production").option("--json", "Output as JSON").option(
+      "--from <deployId>",
+      "Promote a specific past deploy id (alias rewrite)"
+    ).action(async (flags) => {
+      try {
+        await promote({
+          json: flags.json ?? false,
+          from: flags.from
+        });
+      } catch (err) {
+        handleActionError("promote", flags.json ?? false, err);
+      }
+    });
+    staticCli.command("rollback", "Rewrite production alias to a past deploy").option("--json", "Output as JSON").option("--to <deployId>", "Target deploy id (required)").action(async (flags) => {
       try {
         await rollback({
           json: flags.json ?? false,
-          confirm: flags.confirm ?? false
+          to: flags.to
         });
       } catch (err) {
         handleActionError("rollback", flags.json ?? false, err);
       }
     });
+    staticCli.command("ls", "List recent deploys for a site").option("--json", "Output as JSON").option("--site <site>", "Override site from platform.yaml").action(async (flags) => {
+      try {
+        await ls({
+          json: flags.json ?? false,
+          site: flags.site
+        });
+      } catch (err) {
+        handleActionError("ls", flags.json ?? false, err);
+      }
+    });
     staticCli.help();
     staticCli.version(version);
-    staticCli.parse(["node", "universe-static", ...args.slice(1)]);
+    staticCli.parse(["node", "universe-static", ...staticArgs]);
   } else {
     const cli = cac("universe");
-    cli.command("static [...args]", "Static site deployment commands").action(() => {
-      console.log("Run: universe static --help");
+    cli.command("login", "Authenticate with GitHub via OAuth device flow").option("--json", "Output as JSON").option("--force", "Replace any existing stored token").action(async (flags) => {
+      try {
+        await login({
+          json: flags.json ?? false,
+          force: flags.force ?? false
+        });
+      } catch (err) {
+        handleActionError("login", flags.json ?? false, err);
+      }
+    });
+    cli.command("logout", "Remove the stored GitHub device-flow token").option("--json", "Output as JSON").action(async (flags) => {
+      try {
+        await logout({ json: flags.json ?? false });
+      } catch (err) {
+        handleActionError("logout", flags.json ?? false, err);
+      }
+    });
+    cli.command("whoami", "Show resolved GitHub identity and authorized sites").option("--json", "Output as JSON").action(async (flags) => {
+      try {
+        await whoami({ json: flags.json ?? false });
+      } catch (err) {
+        handleActionError("whoami", flags.json ?? false, err);
+      }
     });
+    cli.command("static <subcommand>", "Static site deployment commands");
+    cli.command("sites <subcommand>", "Static site registry commands");
     cli.help();
     cli.version(version);
     cli.parse(argv);