@freecodecamp/universe-cli 0.5.1 → 0.7.0

package/dist/index.js

@@ -6,7 +6,7 @@ import { cac } from "cac";
 // src/commands/deploy.ts
 import { readFile as readFile2 } from "fs/promises";
 import { resolve as resolve2 } from "path";
-import { log } from "@clack/prompts";
+import { log as log2, spinner } from "@clack/prompts";
 
 // src/output/exit-codes.ts
 var EXIT_USAGE = 10;
@@ -429,6 +429,14 @@ function suggest(target, candidates, threshold = 2) {
 }
 
 // src/lib/proxy-client.ts
+var DEFAULT_FETCH_TIMEOUT_MS = 3e4;
+function parseFetchTimeoutMs(env) {
+  const raw = env["UNIVERSE_FETCH_TIMEOUT_MS"];
+  if (raw === void 0 || raw === "") return void 0;
+  const n = Number(raw);
+  if (!Number.isFinite(n) || n < 0) return void 0;
+  return Math.floor(n);
+}
 var ProxyError = class extends CliError {
   exitCode;
   status;
@@ -440,6 +448,13 @@ var ProxyError = class extends CliError {
     this.exitCode = mapExitCode(status);
   }
 };
+var AliasDriftError = class extends ProxyError {
+  current;
+  constructor(message, current) {
+    super(409, "alias_drift", message);
+    this.current = current;
+  }
+};
 function mapExitCode(status) {
   if (status === 401 || status === 403) return EXIT_CREDENTIALS;
   if (status === 422 || status === 0 || status >= 500) return EXIT_STORAGE;
@@ -475,9 +490,11 @@ async function readErrorEnvelope(response) {
     };
   }
   if (isProxyErrorEnvelope(raw) && raw.error) {
+    const current = typeof raw.current === "string" ? raw.current : void 0;
     return {
       code: raw.error.code ?? `http_${status}`,
-      message: raw.error.message ?? response.statusText ?? "request failed"
+      message: raw.error.message ?? response.statusText ?? "request failed",
+      ...current === void 0 ? {} : { current }
     };
   }
   return {
@@ -485,12 +502,36 @@ async function readErrorEnvelope(response) {
     message: response.statusText || "request failed"
   };
 }
+function throwProxyError(status, env) {
+  if (status === 409 && env.code === "alias_drift") {
+    throw new AliasDriftError(env.message, env.current ?? "");
+  }
+  throw new ProxyError(status, env.code, env.message);
+}
 function stripTrailingSlash(url) {
   return url.endsWith("/") ? url.slice(0, -1) : url;
 }
 function createProxyClient(cfg) {
   const base = stripTrailingSlash(cfg.baseUrl);
   const fetchImpl = cfg.fetch ?? globalThis.fetch.bind(globalThis);
+  const timeoutMs = cfg.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
+  function withTimeoutSignal(init) {
+    if (timeoutMs <= 0) return init;
+    const timeoutSignal = AbortSignal.timeout(timeoutMs);
+    const merged = init.signal ? AbortSignal.any([init.signal, timeoutSignal]) : timeoutSignal;
+    return { ...init, signal: merged };
+  }
+  function translateFetchError(err) {
+    if (err instanceof DOMException && (err.name === "TimeoutError" || err.name === "AbortError")) {
+      throw new ProxyError(
+        0,
+        "timeout",
+        `proxy timed out after ${timeoutMs}ms`
+      );
+    }
+    const message = err instanceof Error ? err.message : String(err);
+    throw new ProxyError(0, "network_error", `proxy unreachable: ${message}`);
+  }
   async function userBearer() {
     const tok = await cfg.getAuthToken();
     return `Bearer ${tok}`;
@@ -498,14 +539,13 @@ function createProxyClient(cfg) {
   async function call(url, init) {
     let response;
     try {
-      response = await fetchImpl(url, init);
+      response = await fetchImpl(url, withTimeoutSignal(init));
     } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      throw new ProxyError(0, "network_error", `proxy unreachable: ${message}`);
+      translateFetchError(err);
     }
     if (!response.ok) {
       const env = await readErrorEnvelope(response);
-      throw new ProxyError(response.status, env.code, env.message);
+      throwProxyError(response.status, env);
     }
     if (response.status === 204) {
       return void 0;
@@ -569,18 +609,53 @@ function createProxyClient(cfg) {
         }
       });
     },
+    async getAlias(req) {
+      const url = `${base}/api/site/${encodeURIComponent(req.site)}/alias/${encodeURIComponent(req.mode)}`;
+      let response;
+      try {
+        response = await fetchImpl(
+          url,
+          withTimeoutSignal({
+            method: "GET",
+            headers: {
+              Authorization: await userBearer(),
+              Accept: "application/json"
+            }
+          })
+        );
+      } catch (err) {
+        translateFetchError(err);
+      }
+      if (response.status === 404) return null;
+      if (!response.ok) {
+        const env = await readErrorEnvelope(response);
+        throwProxyError(response.status, env);
+      }
+      return await response.json();
+    },
     async sitePromote(req) {
       const url = `${base}/api/site/${encodeURIComponent(req.site)}/promote`;
+      const headers = {
+        Authorization: await userBearer(),
+        Accept: "application/json"
+      };
+      const body = {};
+      if (req.deployId !== void 0) body.deployId = req.deployId;
+      if (req.expectedCurrent !== void 0)
+        body.expectedCurrent = req.expectedCurrent;
+      const hasBody = Object.keys(body).length > 0;
+      if (hasBody) headers["Content-Type"] = "application/json";
       return call(url, {
         method: "POST",
-        headers: {
-          Authorization: await userBearer(),
-          Accept: "application/json"
-        }
+        headers,
+        ...hasBody ? { body: JSON.stringify(body) } : {}
       });
     },
     async siteRollback(req) {
       const url = `${base}/api/site/${encodeURIComponent(req.site)}/rollback`;
+      const body = { to: req.to };
+      if (req.expectedCurrent !== void 0)
+        body.expectedCurrent = req.expectedCurrent;
       return call(url, {
         method: "POST",
         headers: {
@@ -588,7 +663,7 @@ function createProxyClient(cfg) {
           Accept: "application/json",
           "Content-Type": "application/json"
         },
-        body: JSON.stringify({ to: req.to })
+        body: JSON.stringify(body)
       });
     },
     async registerSite(req) {
@@ -793,6 +868,106 @@ function buildErrorEnvelope(command, code, message, issues) {
   };
 }
 
+// src/output/format.ts
+import { log } from "@clack/prompts";
+
+// src/output/redact.ts
+var AWS_KEY_PREFIX_PATTERN = /(?:AKIA|ASIA|AROA|AIDA|ACCA|ANPA|ABIA|AGPA)[A-Z0-9]{12,}/g;
+var URL_CREDS_PATTERN = /https?:\/\/[^@\s]+@/g;
+var CREDENTIAL_CONTEXT_PATTERN = /(?:access_key_id|secret_access_key|accessKeyId|secretAccessKey|secret|password|token|key|credential|auth)\s*[=:]\s*([A-Za-z0-9/+=]{21,})/gi;
+var HEX_CREDENTIAL_CONTEXT_PATTERN = /(?:secret|password|token|key|credential|auth|access_key_id|secret_access_key)\s*[=:]\s*([a-f0-9]{32,})/gi;
+var JSON_CREDENTIAL_PATTERN = /"(?:secret|password|token|key|credential|auth|access_key_id|secret_access_key|accessKeyId|secretAccessKey)"\s*:\s*"[^"]+"/gi;
+var BEARER_PATTERN = /\bBearer\s+[A-Za-z0-9._~+/=-]+/gi;
+var CREDENTIAL_KEY_PATTERN = /(?:secret|password|token|key|credential|auth)/i;
+var EXACT_CREDENTIAL_KEYS = /* @__PURE__ */ new Set([
+  "accesskeyid",
+  "secretaccesskey",
+  "access_key_id",
+  "secret_access_key"
+]);
+var STANDALONE_LONG_SECRET = /^[A-Za-z0-9/+=]{21,}$/;
+function maskAwsKey(match) {
+  return match.slice(0, 4) + "****" + match.slice(-4);
+}
+function maskUrlCreds(match) {
+  const atIndex = match.lastIndexOf("@");
+  const protocolEnd = match.indexOf("://") + 3;
+  return match.slice(0, protocolEnd) + "****:****@" + match.slice(atIndex + 1);
+}
+function redact(value) {
+  let result = value;
+  result = result.replace(URL_CREDS_PATTERN, maskUrlCreds);
+  result = result.replace(AWS_KEY_PREFIX_PATTERN, maskAwsKey);
+  result = result.replace(BEARER_PATTERN, "Bearer ****");
+  result = result.replace(JSON_CREDENTIAL_PATTERN, (match) => {
+    const colonIndex = match.indexOf(":");
+    return match.slice(0, colonIndex + 1) + '"****"';
+  });
+  result = result.replace(
+    CREDENTIAL_CONTEXT_PATTERN,
+    (_match, _secret, _offset, _full) => {
+      const eqIndex = _match.indexOf("=");
+      const colonIndex = _match.indexOf(":");
+      const sepIndex = eqIndex >= 0 && colonIndex >= 0 ? Math.min(eqIndex, colonIndex) : eqIndex >= 0 ? eqIndex : colonIndex;
+      const prefix = _match.slice(0, sepIndex + 1);
+      return prefix + "****";
+    }
+  );
+  result = result.replace(HEX_CREDENTIAL_CONTEXT_PATTERN, (_match, _secret) => {
+    const eqIndex = _match.indexOf("=");
+    const colonIndex = _match.indexOf(":");
+    const sepIndex = eqIndex >= 0 && colonIndex >= 0 ? Math.min(eqIndex, colonIndex) : eqIndex >= 0 ? eqIndex : colonIndex;
+    const prefix = _match.slice(0, sepIndex + 1);
+    return prefix + "****";
+  });
+  return result;
+}
+function redactValue(value, keyName) {
+  if (typeof value === "string") {
+    if (keyName && EXACT_CREDENTIAL_KEYS.has(keyName.toLowerCase())) {
+      return "****";
+    }
+    const redacted = redact(value);
+    if (redacted === value && keyName && CREDENTIAL_KEY_PATTERN.test(keyName) && STANDALONE_LONG_SECRET.test(value)) {
+      return "****";
+    }
+    return redacted;
+  }
+  if (Array.isArray(value)) {
+    return value.map((v) => redactValue(v, keyName));
+  }
+  if (value !== null && typeof value === "object") {
+    return redactObject(value);
+  }
+  return value;
+}
+function redactObject(obj) {
+  const result = {};
+  for (const [key, value] of Object.entries(obj)) {
+    result[key] = redactValue(value, key);
+  }
+  return result;
+}
+
+// src/output/format.ts
+function outputError(ctx, code, message, optsOrIssues) {
+  const opts = Array.isArray(optsOrIssues) ? { issues: optsOrIssues } : optsOrIssues ?? {};
+  const redactedMessage = redact(message);
+  const redactedIssues = opts.issues?.map(redact);
+  if (ctx.json) {
+    const envelope = buildErrorEnvelope(
+      ctx.command,
+      code,
+      redactedMessage,
+      redactedIssues
+    );
+    const payload = opts.extras ? { ...envelope, ...redactObject(opts.extras) } : envelope;
+    process.stdout.write(JSON.stringify(payload) + "\n");
+  } else {
+    (opts.logError ?? ((m) => log.error(m)))(redactedMessage);
+  }
+}
+
 // src/commands/deploy.ts
 var defaultReadPlatformYaml = async (cwd) => {
   return readFile2(resolve2(cwd, "platform.yaml"), "utf-8");
@@ -886,10 +1061,11 @@ async function deploy(options, deps = {}) {
   const build = deps.runBuild ?? runBuild;
   const walk = deps.walkFiles ?? walkFiles;
   const upload = deps.uploadFiles ?? uploadFiles;
-  const success = deps.logSuccess ?? ((s) => log.success(s));
-  const info = deps.logInfo ?? ((s) => log.info(s));
-  const warn = deps.logWarn ?? ((s) => log.warn(s));
-  const error = deps.logError ?? ((s) => log.error(s));
+  const mkSpinner = deps.createSpinner ?? (() => spinner());
+  const success = deps.logSuccess ?? ((s) => log2.success(s));
+  const info = deps.logInfo ?? ((s) => log2.info(s));
+  const warn = deps.logWarn ?? ((s) => log2.warn(s));
+  const error = deps.logError ?? ((s) => log2.error(s));
   const exit = deps.exit ?? exitWithCode;
   try {
     const identity = await resolveId({ env });
@@ -902,7 +1078,8 @@ async function deploy(options, deps = {}) {
     const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL;
     const client = mkClient({
       baseUrl,
-      getAuthToken: () => identity.token
+      getAuthToken: () => identity.token,
+      timeoutMs: parseFetchTimeoutMs(env)
     });
     let me;
     try {
@@ -953,17 +1130,22 @@ async function deploy(options, deps = {}) {
     } catch (err) {
       rethrowProxy("deploy init failed", err);
     }
+    const spin = options.json ? null : mkSpinner();
+    spin?.start(`Uploading 0/${filtered.length} files`);
     const uploadResult = await upload({
       client,
       deployId: initResult.deployId,
       jwt: initResult.jwt,
-      files: filtered
+      files: filtered,
+      onProgress: spin ? (p) => spin.message(`Uploading ${p.uploaded}/${p.total} \u2014 ${p.current}`) : void 0
     });
     if (uploadResult.errors.length > 0) {
+      spin?.error(`Upload failed: ${uploadResult.errors.length} file(s)`);
       const message = `Upload partially failed: ${uploadResult.errors.length} file(s) failed:
   - ${uploadResult.errors.join("\n  - ")}`;
       throw new PartialUploadError(message);
     }
+    spin?.stop(`Uploaded ${uploadResult.fileCount} files`);
     const mode = options.promote ? "production" : "preview";
     let finalizeResult;
     try {
@@ -976,6 +1158,25 @@ async function deploy(options, deps = {}) {
     } catch (err) {
       rethrowProxy("deploy finalize failed", err);
     }
+    if (options.promote && !options.json) {
+      try {
+        const preview = await client.getAlias({
+          site: config.site,
+          mode: "preview"
+        });
+        if (preview && preview.deployId !== finalizeResult.deployId) {
+          warn(
+            `Preview alias still points to ${preview.deployId}; it will not auto-update. Run \`universe static deploy\` (without --promote) to refresh preview.`
+          );
+        }
+      } catch (err) {
+        if (err instanceof ProxyError && (err.status === 401 || err.status === 403)) {
+          warn(
+            `Preview alias probe got ${err.status} (${err.code}) \u2014 token may need rotation: ${err.message}`
+          );
+        }
+      }
+    }
     if (options.json) {
       emitJson(
         buildEnvelope("deploy", true, {
@@ -1022,17 +1223,15 @@ async function deploy(options, deps = {}) {
       code = EXIT_USAGE;
       message = String(err);
     }
-    if (options.json) {
-      emitJson(buildErrorEnvelope("deploy", code, message));
-    } else {
-      error(message);
-    }
+    outputError({ json: options.json, command: "deploy" }, code, message, {
+      logError: error
+    });
     exit(code);
   }
 }
 
 // src/commands/login.ts
-import { log as log2 } from "@clack/prompts";
+import { log as log3 } from "@clack/prompts";
 
 // src/lib/device-flow.ts
 var DEVICE_CODE_URL = "https://github.com/login/device/code";
@@ -1117,9 +1316,9 @@ async function login(options, deps = {}) {
   const runFlow = deps.runDeviceFlow ?? runDeviceFlow;
   const save = deps.saveToken ?? saveToken;
   const load = deps.loadToken ?? loadToken;
-  const success = deps.logSuccess ?? ((s) => log2.success(s));
-  const info = deps.logInfo ?? ((s) => log2.info(s));
-  const error = deps.logError ?? ((s) => log2.error(s));
+  const success = deps.logSuccess ?? ((s) => log3.success(s));
+  const info = deps.logInfo ?? ((s) => log3.info(s));
+  const error = deps.logError ?? ((s) => log3.error(s));
   const exit = deps.exit ?? exitWithCode;
   const envClientId = env["UNIVERSE_GH_CLIENT_ID"];
   const clientId = envClientId && envClientId.trim().length > 0 ? envClientId : DEFAULT_GH_CLIENT_ID;
@@ -1170,17 +1369,12 @@ async function login(options, deps = {}) {
     });
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    if (options.json) {
-      emitJson2({
-        schemaVersion: "1",
-        command: "login",
-        success: false,
-        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-        error: { code: EXIT_CREDENTIALS, message }
-      });
-    } else {
-      error(message);
-    }
+    outputError(
+      { json: options.json, command: "login" },
+      EXIT_CREDENTIALS,
+      message,
+      { logError: error }
+    );
     exit(EXIT_CREDENTIALS);
     return;
   }
@@ -1193,15 +1387,15 @@ async function login(options, deps = {}) {
 }
 
 // src/commands/logout.ts
-import { log as log3 } from "@clack/prompts";
+import { log as log4 } from "@clack/prompts";
 function emitJson3(envelope) {
   process.stdout.write(JSON.stringify(envelope) + "\n");
 }
 async function logout(options, deps = {}) {
   const load = deps.loadToken ?? loadToken;
   const del = deps.deleteToken ?? deleteToken;
-  const success = deps.logSuccess ?? ((s) => log3.success(s));
-  const info = deps.logInfo ?? ((s) => log3.info(s));
+  const success = deps.logSuccess ?? ((s) => log4.success(s));
+  const info = deps.logInfo ?? ((s) => log4.info(s));
   const existing = await load();
   await del();
   if (options.json) {
@@ -1218,14 +1412,14 @@ async function logout(options, deps = {}) {
 // src/commands/ls.ts
 import { readFile as readFile3 } from "fs/promises";
 import { resolve as resolve3 } from "path";
-import { log as log4 } from "@clack/prompts";
+import { log as log5 } from "@clack/prompts";
 var defaultReadPlatformYaml2 = async (cwd) => {
   return readFile3(resolve3(cwd, "platform.yaml"), "utf-8");
 };
 function emitJson4(envelope) {
   process.stdout.write(JSON.stringify(envelope) + "\n");
 }
-var DEPLOY_ID_RE = /^(\d{8})-(\d{6})-([a-f0-9]+)$/i;
+var DEPLOY_ID_RE = /^(\d{8})-(\d{6})-(\S+)$/;
 function parseDeployId(deployId) {
   const m = DEPLOY_ID_RE.exec(deployId);
   if (!m) return { deployId, timestamp: null, sha: null };
@@ -1268,9 +1462,9 @@ async function ls(options, deps = {}) {
   const readYaml = deps.readPlatformYaml ?? defaultReadPlatformYaml2;
   const resolveId = deps.resolveIdentity ?? resolveIdentity;
   const mkClient = deps.createProxyClient ?? createProxyClient;
-  const success = deps.logSuccess ?? ((s) => log4.success(s));
-  const info = deps.logInfo ?? ((s) => log4.info(s));
-  const error = deps.logError ?? ((s) => log4.error(s));
+  const success = deps.logSuccess ?? ((s) => log5.success(s));
+  const info = deps.logInfo ?? ((s) => log5.info(s));
+  const error = deps.logError ?? ((s) => log5.error(s));
   const exit = deps.exit ?? exitWithCode;
   try {
     const identity = await resolveId({ env });
@@ -1291,7 +1485,8 @@ async function ls(options, deps = {}) {
     const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL;
     const client = mkClient({
       baseUrl,
-      getAuthToken: () => identity.token
+      getAuthToken: () => identity.token,
+      timeoutMs: parseFetchTimeoutMs(env)
     });
     const raw = await client.siteDeploys({ site });
     const sorted = [...raw].sort(
@@ -1315,11 +1510,9 @@ async function ls(options, deps = {}) {
     success(formatTable(deploys));
   } catch (err) {
     const { code, message } = wrapProxyError("ls", err);
-    if (options.json) {
-      emitJson4(buildErrorEnvelope("ls", code, message));
-    } else {
-      error(message);
-    }
+    outputError({ json: options.json, command: "ls" }, code, message, {
+      logError: error
+    });
     exit(code);
   }
 }
@@ -1327,7 +1520,12 @@ async function ls(options, deps = {}) {
 // src/commands/promote.ts
 import { readFile as readFile4 } from "fs/promises";
 import { resolve as resolve4 } from "path";
-import { log as log5 } from "@clack/prompts";
+import { confirm, isCancel, log as log6 } from "@clack/prompts";
+var defaultPromptConfirm = async (msg) => {
+  const r = await confirm({ message: msg, initialValue: false });
+  if (isCancel(r)) return false;
+  return r === true;
+};
 var defaultReadPlatformYaml3 = async (cwd) => {
   return readFile4(resolve4(cwd, "platform.yaml"), "utf-8");
 };
@@ -1356,9 +1554,10 @@ async function promote(options, deps = {}) {
   const readYaml = deps.readPlatformYaml ?? defaultReadPlatformYaml3;
   const resolveId = deps.resolveIdentity ?? resolveIdentity;
   const mkClient = deps.createProxyClient ?? createProxyClient;
-  const success = deps.logSuccess ?? ((s) => log5.success(s));
-  const error = deps.logError ?? ((s) => log5.error(s));
+  const success = deps.logSuccess ?? ((s) => log6.success(s));
+  const error = deps.logError ?? ((s) => log6.error(s));
   const exit = deps.exit ?? exitWithCode;
+  const promptConfirm = deps.promptConfirm ?? defaultPromptConfirm;
   try {
     const identity = await resolveId({ env });
     if (!identity) {
@@ -1370,16 +1569,80 @@ async function promote(options, deps = {}) {
     const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL;
     const client = mkClient({
       baseUrl,
-      getAuthToken: () => identity.token
+      getAuthToken: () => identity.token,
+      timeoutMs: parseFetchTimeoutMs(env)
     });
     let result;
     if (options.from) {
-      result = await client.siteRollback({
+      const prod = await client.getAlias({
         site: config.site,
-        to: options.from
+        mode: "production"
       });
+      const initialExpected = prod?.deployId ?? "";
+      try {
+        result = await client.siteRollback({
+          site: config.site,
+          to: options.from,
+          expectedCurrent: initialExpected
+        });
+      } catch (err) {
+        if (!(err instanceof AliasDriftError)) throw err;
+        if (options.json) throw err;
+        error(
+          `drift: production moved to ${err.current}, expected ${initialExpected}`
+        );
+        const ok = await promptConfirm(
+          `Retry promote --from with expectedCurrent='${err.current}'?`
+        );
+        if (!ok) throw err;
+        result = await client.siteRollback({
+          site: config.site,
+          to: options.from,
+          expectedCurrent: err.current
+        });
+      }
     } else {
-      result = await client.sitePromote({ site: config.site });
+      const preview = await client.getAlias({
+        site: config.site,
+        mode: "preview"
+      });
+      if (preview === null) {
+        throw new ConfigError(
+          "no preview alias to promote \u2014 run `universe static deploy` first"
+        );
+      }
+      const prod = await client.getAlias({
+        site: config.site,
+        mode: "production"
+      });
+      if (!options.json) {
+        success(
+          `Promoting ${preview.deployId} \u2192 ${prod?.deployId ?? "<none>"}`
+        );
+      }
+      const initialExpected = prod?.deployId ?? "";
+      try {
+        result = await client.sitePromote({
+          site: config.site,
+          deployId: preview.deployId,
+          expectedCurrent: initialExpected
+        });
+      } catch (err) {
+        if (!(err instanceof AliasDriftError)) throw err;
+        if (options.json) throw err;
+        error(
+          `drift: production moved to ${err.current}, expected ${initialExpected}`
+        );
+        const ok = await promptConfirm(
+          `Retry promote with expectedCurrent='${err.current}'?`
+        );
+        if (!ok) throw err;
+        result = await client.sitePromote({
+          site: config.site,
+          deployId: preview.deployId,
+          expectedCurrent: err.current
+        });
+      }
     }
     if (options.json) {
       emitJson5(
@@ -1405,11 +1668,11 @@ async function promote(options, deps = {}) {
     }
   } catch (err) {
     const { code, message } = wrapProxyError("promote", err);
-    if (options.json) {
-      emitJson5(buildErrorEnvelope("promote", code, message));
-    } else {
-      error(message);
-    }
+    const extras = err instanceof AliasDriftError ? { current: err.current } : void 0;
+    outputError({ json: options.json, command: "promote" }, code, message, {
+      logError: error,
+      extras
+    });
     exit(code);
   }
 }
@@ -1417,7 +1680,12 @@ async function promote(options, deps = {}) {
 // src/commands/rollback.ts
 import { readFile as readFile5 } from "fs/promises";
 import { resolve as resolve5 } from "path";
-import { log as log6 } from "@clack/prompts";
+import { confirm as confirm2, isCancel as isCancel2, log as log7 } from "@clack/prompts";
+var defaultPromptConfirm2 = async (msg) => {
+  const r = await confirm2({ message: msg, initialValue: false });
+  if (isCancel2(r)) return false;
+  return r === true;
+};
 var defaultReadPlatformYaml4 = async (cwd) => {
   return readFile5(resolve5(cwd, "platform.yaml"), "utf-8");
 };
@@ -1446,9 +1714,10 @@ async function rollback(options, deps = {}) {
   const readYaml = deps.readPlatformYaml ?? defaultReadPlatformYaml4;
   const resolveId = deps.resolveIdentity ?? resolveIdentity;
   const mkClient = deps.createProxyClient ?? createProxyClient;
-  const success = deps.logSuccess ?? ((s) => log6.success(s));
-  const error = deps.logError ?? ((s) => log6.error(s));
+  const success = deps.logSuccess ?? ((s) => log7.success(s));
+  const error = deps.logError ?? ((s) => log7.error(s));
   const exit = deps.exit ?? exitWithCode;
+  const promptConfirm = deps.promptConfirm ?? defaultPromptConfirm2;
   try {
     if (!options.to || options.to.trim().length === 0) {
       throw new UsageError(
@@ -1465,12 +1734,38 @@ async function rollback(options, deps = {}) {
     const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL;
     const client = mkClient({
       baseUrl,
-      getAuthToken: () => identity.token
+      getAuthToken: () => identity.token,
+      timeoutMs: parseFetchTimeoutMs(env)
     });
-    const result = await client.siteRollback({
+    const to = options.to.trim();
+    const prod = await client.getAlias({
       site: config.site,
-      to: options.to.trim()
+      mode: "production"
     });
+    const initialExpected = prod?.deployId ?? "";
+    let result;
+    try {
+      result = await client.siteRollback({
+        site: config.site,
+        to,
+        expectedCurrent: initialExpected
+      });
+    } catch (err) {
+      if (!(err instanceof AliasDriftError)) throw err;
+      if (options.json) throw err;
+      error(
+        `drift: production moved to ${err.current}, expected ${initialExpected}`
+      );
+      const ok = await promptConfirm(
+        `Retry rollback with expectedCurrent='${err.current}'?`
+      );
+      if (!ok) throw err;
+      result = await client.siteRollback({
+        site: config.site,
+        to,
+        expectedCurrent: err.current
+      });
+    }
     if (options.json) {
       emitJson6(
         buildEnvelope("rollback", true, {
@@ -1493,17 +1788,17 @@ async function rollback(options, deps = {}) {
     }
   } catch (err) {
     const { code, message } = wrapProxyError("rollback", err);
-    if (options.json) {
-      emitJson6(buildErrorEnvelope("rollback", code, message));
-    } else {
-      error(message);
-    }
+    const extras = err instanceof AliasDriftError ? { current: err.current } : void 0;
+    outputError({ json: options.json, command: "rollback" }, code, message, {
+      logError: error,
+      extras
+    });
     exit(code);
   }
 }
 
 // src/commands/whoami.ts
-import { log as log7 } from "@clack/prompts";
+import { log as log8 } from "@clack/prompts";
 var DEFAULT_PROXY_URL2 = "https://uploads.freecode.camp";
 function emitJson7(envelope) {
   process.stdout.write(JSON.stringify(envelope) + "\n");
@@ -1512,24 +1807,26 @@ async function whoami(options, deps = {}) {
   const env = deps.env ?? process.env;
   const resolve6 = deps.resolveIdentity ?? resolveIdentity;
   const mkClient = deps.createProxyClient ?? createProxyClient;
-  const success = deps.logSuccess ?? ((s) => log7.success(s));
-  const error = deps.logError ?? ((s) => log7.error(s));
+  const success = deps.logSuccess ?? ((s) => log8.success(s));
+  const error = deps.logError ?? ((s) => log8.error(s));
   const exit = deps.exit ?? exitWithCode;
   const identity = await resolve6({ env });
   if (!identity) {
     const msg = "No GitHub identity available. Run `universe login`, set $GITHUB_TOKEN, or install the gh CLI.";
-    if (options.json) {
-      emitJson7(buildErrorEnvelope("whoami", EXIT_CREDENTIALS, msg));
-    } else {
-      error(msg);
-    }
+    outputError(
+      { json: options.json, command: "whoami" },
+      EXIT_CREDENTIALS,
+      msg,
+      { logError: error }
+    );
     exit(EXIT_CREDENTIALS);
     return;
   }
   const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL2;
   const client = mkClient({
     baseUrl,
-    getAuthToken: () => identity.token
+    getAuthToken: () => identity.token,
+    timeoutMs: parseFetchTimeoutMs(env)
   });
   try {
     const result = await client.whoami();
@@ -1555,17 +1852,15 @@ async function whoami(options, deps = {}) {
   } catch (err) {
     const exitCode = err instanceof CliError ? err.exitCode : EXIT_CREDENTIALS;
     const message = err instanceof ProxyError ? `whoami failed (${err.code}): ${err.message}` : err instanceof Error ? err.message : String(err);
-    if (options.json) {
-      emitJson7(buildErrorEnvelope("whoami", exitCode, message));
-    } else {
-      error(message);
-    }
+    outputError({ json: options.json, command: "whoami" }, exitCode, message, {
+      logError: error
+    });
     exit(exitCode);
   }
 }
 
 // src/commands/sites/ls.ts
-import { log as log8 } from "@clack/prompts";
+import { log as log9 } from "@clack/prompts";
 
 // src/commands/sites/_shared.ts
 function emitJson8(envelope) {
@@ -1589,7 +1884,8 @@ async function setupClient(deps) {
   const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL;
   const client = mkClient({
     baseUrl,
-    getAuthToken: () => identity.token
+    getAuthToken: () => identity.token,
+    timeoutMs: parseFetchTimeoutMs(env)
   });
   return { client, identitySource: identity.source };
 }
@@ -1612,11 +1908,11 @@ function formatTable2(rows) {
 }
 async function ls2(options, deps = {}) {
   const command = "sites ls";
-  const success = deps.logSuccess ?? ((s) => log8.message(s));
-  const error = deps.logError ?? ((s) => log8.error(s));
+  const success = deps.logSuccess ?? ((s) => log9.message(s));
+  const error = deps.logError ?? ((s) => log9.error(s));
   const exit = deps.exit ?? exitWithCode;
   try {
-    const { client } = await setupClient(deps);
+    const { client, identitySource } = await setupClient(deps);
     let rows = await client.listSites();
     let scope = "all";
     if (options.mine) {
@@ -1630,7 +1926,8 @@ async function ls2(options, deps = {}) {
         buildEnvelope(command, true, {
           count: rows.length,
           scope,
-          sites: rows
+          sites: rows,
+          identitySource
         })
       );
     } else {
@@ -1638,28 +1935,26 @@ async function ls2(options, deps = {}) {
     }
   } catch (err) {
     const { code, message } = wrapProxyError(command, err);
-    if (options.json) {
-      emitJson8(buildErrorEnvelope(command, code, message));
-    } else {
-      error(message);
-    }
+    outputError({ json: options.json, command }, code, message, {
+      logError: error
+    });
     exit(code);
   }
 }
 
 // src/commands/sites/register.ts
-import { log as log9 } from "@clack/prompts";
+import { log as log10 } from "@clack/prompts";
 async function register(options, deps = {}) {
   const command = "sites register";
-  const success = deps.logSuccess ?? ((s) => log9.success(s));
-  const error = deps.logError ?? ((s) => log9.error(s));
+  const success = deps.logSuccess ?? ((s) => log10.success(s));
+  const error = deps.logError ?? ((s) => log10.error(s));
   const exit = deps.exit ?? exitWithCode;
   try {
     if (!options.slug || options.slug.trim().length === 0) {
       throw new UsageError("slug is required (positional argument)");
     }
     const teams = parseTeamsFlag(options.team);
-    const { client } = await setupClient(deps);
+    const { client, identitySource } = await setupClient(deps);
     const row = await client.registerSite({
       slug: options.slug,
       teams: teams.length > 0 ? teams : void 0
@@ -1670,7 +1965,8 @@ async function register(options, deps = {}) {
           slug: row.slug,
           teams: row.teams,
           createdAt: row.createdAt,
-          createdBy: row.createdBy
+          createdBy: row.createdBy,
+          identitySource
         })
       );
     } else {
@@ -1687,33 +1983,32 @@ async function register(options, deps = {}) {
     }
   } catch (err) {
     const { code, message } = wrapProxyError(command, err);
-    if (options.json) {
-      emitJson8(buildErrorEnvelope(command, code, message));
-    } else {
-      error(message);
-    }
+    outputError({ json: options.json, command }, code, message, {
+      logError: error
+    });
     exit(code);
   }
 }
 
 // src/commands/sites/rm.ts
-import { log as log10 } from "@clack/prompts";
+import { log as log11 } from "@clack/prompts";
 async function rm2(options, deps = {}) {
   const command = "sites rm";
-  const success = deps.logSuccess ?? ((s) => log10.success(s));
-  const error = deps.logError ?? ((s) => log10.error(s));
+  const success = deps.logSuccess ?? ((s) => log11.success(s));
+  const error = deps.logError ?? ((s) => log11.error(s));
   const exit = deps.exit ?? exitWithCode;
   try {
     if (!options.slug || options.slug.trim().length === 0) {
       throw new UsageError("slug is required (positional argument)");
     }
-    const { client } = await setupClient(deps);
+    const { client, identitySource } = await setupClient(deps);
     await client.deleteSite({ slug: options.slug });
     if (options.json) {
       emitJson8(
         buildEnvelope(command, true, {
           slug: options.slug,
-          deleted: true
+          deleted: true,
+          identitySource
         })
       );
     } else {
@@ -1728,21 +2023,19 @@ async function rm2(options, deps = {}) {
     }
   } catch (err) {
     const { code, message } = wrapProxyError(command, err);
-    if (options.json) {
-      emitJson8(buildErrorEnvelope(command, code, message));
-    } else {
-      error(message);
-    }
+    outputError({ json: options.json, command }, code, message, {
+      logError: error
+    });
     exit(code);
   }
 }
 
 // src/commands/sites/update.ts
-import { log as log11 } from "@clack/prompts";
+import { log as log12 } from "@clack/prompts";
 async function update(options, deps = {}) {
   const command = "sites update";
-  const success = deps.logSuccess ?? ((s) => log11.success(s));
-  const error = deps.logError ?? ((s) => log11.error(s));
+  const success = deps.logSuccess ?? ((s) => log12.success(s));
+  const error = deps.logError ?? ((s) => log12.error(s));
   const exit = deps.exit ?? exitWithCode;
   try {
     if (!options.slug || options.slug.trim().length === 0) {
@@ -1754,7 +2047,7 @@ async function update(options, deps = {}) {
         "--team is required with at least one slug; use `sites rm` to remove a site"
       );
     }
-    const { client } = await setupClient(deps);
+    const { client, identitySource } = await setupClient(deps);
     const row = await client.updateSite({
       slug: options.slug,
       teams
@@ -1764,7 +2057,8 @@ async function update(options, deps = {}) {
         buildEnvelope(command, true, {
           slug: row.slug,
           teams: row.teams,
-          updatedAt: row.updatedAt
+          updatedAt: row.updatedAt,
+          identitySource
         })
       );
     } else {
@@ -1780,81 +2074,15 @@ async function update(options, deps = {}) {
     }
   } catch (err) {
     const { code, message } = wrapProxyError(command, err);
-    if (options.json) {
-      emitJson8(buildErrorEnvelope(command, code, message));
-    } else {
-      error(message);
-    }
+    outputError({ json: options.json, command }, code, message, {
+      logError: error
+    });
     exit(code);
   }
 }
 
-// src/output/format.ts
-import { log as log12 } from "@clack/prompts";
-
-// src/output/redact.ts
-var AWS_KEY_PREFIX_PATTERN = /(?:AKIA|ASIA|AROA|AIDA|ACCA|ANPA|ABIA|AGPA)[A-Z0-9]{12,}/g;
-var URL_CREDS_PATTERN = /https?:\/\/[^@\s]+@/g;
-var CREDENTIAL_CONTEXT_PATTERN = /(?:access_key_id|secret_access_key|accessKeyId|secretAccessKey|secret|password|token|key|credential|auth)\s*[=:]\s*([A-Za-z0-9/+=]{21,})/gi;
-var HEX_CREDENTIAL_CONTEXT_PATTERN = /(?:secret|password|token|key|credential|auth|access_key_id|secret_access_key)\s*[=:]\s*([a-f0-9]{32,})/gi;
-var JSON_CREDENTIAL_PATTERN = /"(?:secret|password|token|key|credential|auth|access_key_id|secret_access_key|accessKeyId|secretAccessKey)"\s*:\s*"[^"]+"/gi;
-var BEARER_PATTERN = /\bBearer\s+[A-Za-z0-9._~+/=-]+/gi;
-function maskAwsKey(match) {
-  return match.slice(0, 4) + "****" + match.slice(-4);
-}
-function maskUrlCreds(match) {
-  const atIndex = match.lastIndexOf("@");
-  const protocolEnd = match.indexOf("://") + 3;
-  return match.slice(0, protocolEnd) + "****:****@" + match.slice(atIndex + 1);
-}
-function redact(value) {
-  let result = value;
-  result = result.replace(URL_CREDS_PATTERN, maskUrlCreds);
-  result = result.replace(AWS_KEY_PREFIX_PATTERN, maskAwsKey);
-  result = result.replace(BEARER_PATTERN, "Bearer ****");
-  result = result.replace(JSON_CREDENTIAL_PATTERN, (match) => {
-    const colonIndex = match.indexOf(":");
-    return match.slice(0, colonIndex + 1) + '"****"';
-  });
-  result = result.replace(
-    CREDENTIAL_CONTEXT_PATTERN,
-    (_match, _secret, _offset, _full) => {
-      const eqIndex = _match.indexOf("=");
-      const colonIndex = _match.indexOf(":");
-      const sepIndex = eqIndex >= 0 && colonIndex >= 0 ? Math.min(eqIndex, colonIndex) : eqIndex >= 0 ? eqIndex : colonIndex;
-      const prefix = _match.slice(0, sepIndex + 1);
-      return prefix + "****";
-    }
-  );
-  result = result.replace(HEX_CREDENTIAL_CONTEXT_PATTERN, (_match, _secret) => {
-    const eqIndex = _match.indexOf("=");
-    const colonIndex = _match.indexOf(":");
-    const sepIndex = eqIndex >= 0 && colonIndex >= 0 ? Math.min(eqIndex, colonIndex) : eqIndex >= 0 ? eqIndex : colonIndex;
-    const prefix = _match.slice(0, sepIndex + 1);
-    return prefix + "****";
-  });
-  return result;
-}
-
-// src/output/format.ts
-function outputError(ctx, code, message, issues) {
-  const redactedMessage = redact(message);
-  const redactedIssues = issues?.map(redact);
-  if (ctx.json) {
-    const envelope = buildErrorEnvelope(
-      ctx.command,
-      code,
-      redactedMessage,
-      redactedIssues
-    );
-    process.stdout.write(JSON.stringify(envelope) + "\n");
-  } else {
-    log12.error(redactedMessage);
-  }
-}
-
 // src/cli.ts
-var version = true ? "0.5.1" : "0.0.0";
+var version = true ? "0.7.0" : "0.0.0";
 function handleActionError(command, json, err) {
   const ctx = { json, command };
   const message = err instanceof Error ? err.message : "unknown error";