@freecodecamp/universe-cli 0.6.0 → 0.7.1

package/dist/index.cjs

@@ -8421,6 +8421,27 @@ function w(r, t2) {
   const e = r;
   e.isTTY && e.setRawMode(t2);
 }
+function z({ input: r = import_node_process.stdin, output: t2 = import_node_process.stdout, overwrite: e = true, hideCursor: s = true } = {}) {
+  const i = _.createInterface({ input: r, output: t2, prompt: "", tabSize: 1 });
+  _.emitKeypressEvents(r, i), r instanceof import_node_tty.ReadStream && r.isTTY && r.setRawMode(true);
+  const n = (o, { name: a, sequence: h }) => {
+    const l = String(o);
+    if (V([l, a, h], "cancel")) {
+      s && t2.write(import_sisteransi.cursor.show), process.exit(0);
+      return;
+    }
+    if (!e) return;
+    const f = a === "return" ? 0 : -1, v = a === "return" ? -1 : 0;
+    _.moveCursor(t2, f, v, () => {
+      _.clearLine(t2, 1, () => {
+        r.once("keypress", n);
+      });
+    });
+  };
+  return s && t2.write(import_sisteransi.cursor.hide), r.once("keypress", n), () => {
+    r.off("keypress", n), s && t2.write(import_sisteransi.cursor.show), r instanceof import_node_tty.ReadStream && r.isTTY && !Y && r.setRawMode(false), i.terminal = false, i.close();
+  };
+}
 var O = (r) => "columns" in r && typeof r.columns == "number" ? r.columns : 80;
 var A = (r) => "rows" in r && typeof r.rows == "number" ? r.rows : 20;
 function R(r, t2, e, s = e) {
@@ -8579,6 +8600,7 @@ function Ze() {
   return import_node_process2.default.platform !== "win32" ? import_node_process2.default.env.TERM !== "linux" : !!import_node_process2.default.env.CI || !!import_node_process2.default.env.WT_SESSION || !!import_node_process2.default.env.TERMINUS_SUBLIME || import_node_process2.default.env.ConEmuTask === "{cmd::Cmder}" || import_node_process2.default.env.TERM_PROGRAM === "Terminus-Sublime" || import_node_process2.default.env.TERM_PROGRAM === "vscode" || import_node_process2.default.env.TERM === "xterm-256color" || import_node_process2.default.env.TERM === "alacritty" || import_node_process2.default.env.TERMINAL_EMULATOR === "JetBrains-JediTerm";
 }
 var ee = Ze();
+var ae = () => process.env.CI === "true";
 var w2 = (e, i) => ee ? e : i;
 var _e = w2("\u25C6", "*");
 var oe = w2("\u25A0", "x");
@@ -8671,6 +8693,59 @@ var O2 = { message: (e = [], { symbol: i = (0, import_node_util2.styleText)("gra
 }, error: (e, i) => {
   O2.message(e, { ...i, symbol: (0, import_node_util2.styleText)("red", ge) });
 } };
+var Ct = (e) => (0, import_node_util2.styleText)("magenta", e);
+var fe = ({ indicator: e = "dots", onCancel: i, output: s = process.stdout, cancelMessage: r, errorMessage: u2, frames: n = ee ? ["\u25D2", "\u25D0", "\u25D3", "\u25D1"] : ["\u2022", "o", "O", "0"], delay: o = ee ? 80 : 120, signal: c2, ...a } = {}) => {
+  const l = ae();
+  let $2, y2, p2 = false, m = false, g = "", S2, h = performance.now();
+  const f = O(s), v = a?.styleFrame ?? Ct, T = (_2) => {
+    const A2 = _2 > 1 ? u2 ?? u.messages.error : r ?? u.messages.cancel;
+    m = _2 === 1, p2 && (W(A2, _2), m && typeof i == "function" && i());
+  }, C2 = () => T(2), b = () => T(1), x = () => {
+    process.on("uncaughtExceptionMonitor", C2), process.on("unhandledRejection", C2), process.on("SIGINT", b), process.on("SIGTERM", b), process.on("exit", T), c2 && c2.addEventListener("abort", b);
+  }, G2 = () => {
+    process.removeListener("uncaughtExceptionMonitor", C2), process.removeListener("unhandledRejection", C2), process.removeListener("SIGINT", b), process.removeListener("SIGTERM", b), process.removeListener("exit", T), c2 && c2.removeEventListener("abort", b);
+  }, M2 = () => {
+    if (S2 === void 0) return;
+    l && s.write(`
+`);
+    const _2 = wrapAnsi(S2, f, { hard: true, trim: false }).split(`
+`);
+    _2.length > 1 && s.write(import_sisteransi2.cursor.up(_2.length - 1)), s.write(import_sisteransi2.cursor.to(0)), s.write(import_sisteransi2.erase.down());
+  }, R2 = (_2) => _2.replace(/\.+$/, ""), j2 = (_2) => {
+    const A2 = (performance.now() - _2) / 1e3, k = Math.floor(A2 / 60), L = Math.floor(A2 % 60);
+    return k > 0 ? `[${k}m ${L}s]` : `[${L}s]`;
+  }, D2 = a.withGuide ?? u.withGuide, ie = (_2 = "") => {
+    p2 = true, $2 = z({ output: s }), g = R2(_2), h = performance.now(), D2 && s.write(`${(0, import_node_util2.styleText)("gray", d)}
+`);
+    let A2 = 0, k = 0;
+    x(), y2 = setInterval(() => {
+      if (l && g === S2) return;
+      M2(), S2 = g;
+      const L = v(n[A2]);
+      let Z;
+      if (l) Z = `${L}  ${g}...`;
+      else if (e === "timer") Z = `${L}  ${g} ${j2(h)}`;
+      else {
+        const Be = ".".repeat(Math.floor(k)).slice(0, 3);
+        Z = `${L}  ${g}${Be}`;
+      }
+      const Ne = wrapAnsi(Z, f, { hard: true, trim: false });
+      s.write(Ne), A2 = A2 + 1 < n.length ? A2 + 1 : 0, k = k < 4 ? k + 0.125 : 0;
+    }, o);
+  }, W = (_2 = "", A2 = 0, k = false) => {
+    if (!p2) return;
+    p2 = false, clearInterval(y2), M2();
+    const L = A2 === 0 ? (0, import_node_util2.styleText)("green", F) : A2 === 1 ? (0, import_node_util2.styleText)("red", oe) : (0, import_node_util2.styleText)("red", ue);
+    g = _2 ?? g, k || (e === "timer" ? s.write(`${L}  ${g} ${j2(h)}
+`) : s.write(`${L}  ${g}
+`)), G2(), $2();
+  };
+  return { start: ie, stop: (_2 = "") => W(_2, 0), message: (_2 = "") => {
+    g = R2(_2 ?? g);
+  }, cancel: (_2 = "") => W(_2, 1), error: (_2 = "") => W(_2, 2), clear: () => W("", 0, true), get isCancelled() {
+    return m;
+  } };
+};
 var Ve = { light: w2("\u2500", "-"), heavy: w2("\u2501", "="), block: w2("\u2588", "#") };
 var je = `${(0, import_node_util2.styleText)("gray", d)}  `;
 
@@ -8887,14 +8962,14 @@ async function resolveIdentity(opts = {}) {
   if (isNonEmpty(ghTokenEnv)) {
     return { token: ghTokenEnv.trim(), source: "env_GH_TOKEN" };
   }
-  const ghCli = await execGh();
-  if (isNonEmpty(ghCli)) {
-    return { token: ghCli.trim(), source: "gh_cli" };
-  }
   const stored = await loadStored();
   if (isNonEmpty(stored)) {
     return { token: stored.trim(), source: "device_flow" };
   }
+  const ghCli = await execGh();
+  if (isNonEmpty(ghCli)) {
+    return { token: ghCli.trim(), source: "gh_cli" };
+  }
   return null;
 }
 
@@ -22862,6 +22937,14 @@ function suggest(target, candidates, threshold = 2) {
 }
 
 // src/lib/proxy-client.ts
+var DEFAULT_FETCH_TIMEOUT_MS = 3e4;
+function parseFetchTimeoutMs(env) {
+  const raw = env["UNIVERSE_FETCH_TIMEOUT_MS"];
+  if (raw === void 0 || raw === "") return void 0;
+  const n = Number(raw);
+  if (!Number.isFinite(n) || n < 0) return void 0;
+  return Math.floor(n);
+}
 var ProxyError = class extends CliError {
   exitCode;
   status;
@@ -22939,6 +23022,24 @@ function stripTrailingSlash(url2) {
 function createProxyClient(cfg) {
   const base = stripTrailingSlash(cfg.baseUrl);
   const fetchImpl = cfg.fetch ?? globalThis.fetch.bind(globalThis);
+  const timeoutMs = cfg.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
+  function withTimeoutSignal(init) {
+    if (timeoutMs <= 0) return init;
+    const timeoutSignal = AbortSignal.timeout(timeoutMs);
+    const merged = init.signal ? AbortSignal.any([init.signal, timeoutSignal]) : timeoutSignal;
+    return { ...init, signal: merged };
+  }
+  function translateFetchError(err) {
+    if (err instanceof DOMException && (err.name === "TimeoutError" || err.name === "AbortError")) {
+      throw new ProxyError(
+        0,
+        "timeout",
+        `proxy timed out after ${timeoutMs}ms`
+      );
+    }
+    const message = err instanceof Error ? err.message : String(err);
+    throw new ProxyError(0, "network_error", `proxy unreachable: ${message}`);
+  }
   async function userBearer() {
     const tok = await cfg.getAuthToken();
     return `Bearer ${tok}`;
@@ -22946,10 +23047,9 @@ function createProxyClient(cfg) {
   async function call(url2, init) {
     let response;
     try {
-      response = await fetchImpl(url2, init);
+      response = await fetchImpl(url2, withTimeoutSignal(init));
     } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      throw new ProxyError(0, "network_error", `proxy unreachable: ${message}`);
+      translateFetchError(err);
     }
     if (!response.ok) {
       const env = await readErrorEnvelope(response);
@@ -23021,20 +23121,18 @@ function createProxyClient(cfg) {
       const url2 = `${base}/api/site/${encodeURIComponent(req.site)}/alias/${encodeURIComponent(req.mode)}`;
       let response;
       try {
-        response = await fetchImpl(url2, {
-          method: "GET",
-          headers: {
-            Authorization: await userBearer(),
-            Accept: "application/json"
-          }
-        });
-      } catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        throw new ProxyError(
-          0,
-          "network_error",
-          `proxy unreachable: ${message}`
+        response = await fetchImpl(
+          url2,
+          withTimeoutSignal({
+            method: "GET",
+            headers: {
+              Authorization: await userBearer(),
+              Accept: "application/json"
+            }
+          })
         );
+      } catch (err) {
+        translateFetchError(err);
       }
       if (response.status === 404) return null;
       if (!response.ok) {
@@ -23278,6 +23376,103 @@ function buildErrorEnvelope(command, code, message, issues) {
   };
 }
 
+// src/output/redact.ts
+var AWS_KEY_PREFIX_PATTERN = /(?:AKIA|ASIA|AROA|AIDA|ACCA|ANPA|ABIA|AGPA)[A-Z0-9]{12,}/g;
+var URL_CREDS_PATTERN = /https?:\/\/[^@\s]+@/g;
+var CREDENTIAL_CONTEXT_PATTERN = /(?:access_key_id|secret_access_key|accessKeyId|secretAccessKey|secret|password|token|key|credential|auth)\s*[=:]\s*([A-Za-z0-9/+=]{21,})/gi;
+var HEX_CREDENTIAL_CONTEXT_PATTERN = /(?:secret|password|token|key|credential|auth|access_key_id|secret_access_key)\s*[=:]\s*([a-f0-9]{32,})/gi;
+var JSON_CREDENTIAL_PATTERN = /"(?:secret|password|token|key|credential|auth|access_key_id|secret_access_key|accessKeyId|secretAccessKey)"\s*:\s*"[^"]+"/gi;
+var BEARER_PATTERN = /\bBearer\s+[A-Za-z0-9._~+/=-]+/gi;
+var CREDENTIAL_KEY_PATTERN = /(?:secret|password|token|key|credential|auth)/i;
+var EXACT_CREDENTIAL_KEYS = /* @__PURE__ */ new Set([
+  "accesskeyid",
+  "secretaccesskey",
+  "access_key_id",
+  "secret_access_key"
+]);
+var STANDALONE_LONG_SECRET = /^[A-Za-z0-9/+=]{21,}$/;
+function maskAwsKey(match) {
+  return match.slice(0, 4) + "****" + match.slice(-4);
+}
+function maskUrlCreds(match) {
+  const atIndex = match.lastIndexOf("@");
+  const protocolEnd = match.indexOf("://") + 3;
+  return match.slice(0, protocolEnd) + "****:****@" + match.slice(atIndex + 1);
+}
+function redact(value) {
+  let result = value;
+  result = result.replace(URL_CREDS_PATTERN, maskUrlCreds);
+  result = result.replace(AWS_KEY_PREFIX_PATTERN, maskAwsKey);
+  result = result.replace(BEARER_PATTERN, "Bearer ****");
+  result = result.replace(JSON_CREDENTIAL_PATTERN, (match) => {
+    const colonIndex = match.indexOf(":");
+    return match.slice(0, colonIndex + 1) + '"****"';
+  });
+  result = result.replace(
+    CREDENTIAL_CONTEXT_PATTERN,
+    (_match, _secret, _offset, _full) => {
+      const eqIndex = _match.indexOf("=");
+      const colonIndex = _match.indexOf(":");
+      const sepIndex = eqIndex >= 0 && colonIndex >= 0 ? Math.min(eqIndex, colonIndex) : eqIndex >= 0 ? eqIndex : colonIndex;
+      const prefix = _match.slice(0, sepIndex + 1);
+      return prefix + "****";
+    }
+  );
+  result = result.replace(HEX_CREDENTIAL_CONTEXT_PATTERN, (_match, _secret) => {
+    const eqIndex = _match.indexOf("=");
+    const colonIndex = _match.indexOf(":");
+    const sepIndex = eqIndex >= 0 && colonIndex >= 0 ? Math.min(eqIndex, colonIndex) : eqIndex >= 0 ? eqIndex : colonIndex;
+    const prefix = _match.slice(0, sepIndex + 1);
+    return prefix + "****";
+  });
+  return result;
+}
+function redactValue(value, keyName) {
+  if (typeof value === "string") {
+    if (keyName && EXACT_CREDENTIAL_KEYS.has(keyName.toLowerCase())) {
+      return "****";
+    }
+    const redacted = redact(value);
+    if (redacted === value && keyName && CREDENTIAL_KEY_PATTERN.test(keyName) && STANDALONE_LONG_SECRET.test(value)) {
+      return "****";
+    }
+    return redacted;
+  }
+  if (Array.isArray(value)) {
+    return value.map((v) => redactValue(v, keyName));
+  }
+  if (value !== null && typeof value === "object") {
+    return redactObject(value);
+  }
+  return value;
+}
+function redactObject(obj) {
+  const result = {};
+  for (const [key, value] of Object.entries(obj)) {
+    result[key] = redactValue(value, key);
+  }
+  return result;
+}
+
+// src/output/format.ts
+function outputError(ctx, code, message, optsOrIssues) {
+  const opts = Array.isArray(optsOrIssues) ? { issues: optsOrIssues } : optsOrIssues ?? {};
+  const redactedMessage = redact(message);
+  const redactedIssues = opts.issues?.map(redact);
+  if (ctx.json) {
+    const envelope = buildErrorEnvelope(
+      ctx.command,
+      code,
+      redactedMessage,
+      redactedIssues
+    );
+    const payload = opts.extras ? { ...envelope, ...redactObject(opts.extras) } : envelope;
+    process.stdout.write(JSON.stringify(payload) + "\n");
+  } else {
+    (opts.logError ?? ((m) => O2.error(m)))(redactedMessage);
+  }
+}
+
 // src/commands/deploy.ts
 var defaultReadPlatformYaml = async (cwd) => {
   return (0, import_promises4.readFile)((0, import_node_path5.resolve)(cwd, "platform.yaml"), "utf-8");
@@ -23371,6 +23566,7 @@ async function deploy(options, deps = {}) {
   const build = deps.runBuild ?? runBuild;
   const walk = deps.walkFiles ?? walkFiles;
   const upload = deps.uploadFiles ?? uploadFiles;
+  const mkSpinner = deps.createSpinner ?? (() => fe());
   const success2 = deps.logSuccess ?? ((s) => O2.success(s));
   const info = deps.logInfo ?? ((s) => O2.info(s));
   const warn = deps.logWarn ?? ((s) => O2.warn(s));
@@ -23387,7 +23583,8 @@ async function deploy(options, deps = {}) {
     const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL;
     const client = mkClient({
       baseUrl,
-      getAuthToken: () => identity.token
+      getAuthToken: () => identity.token,
+      timeoutMs: parseFetchTimeoutMs(env)
     });
     let me2;
     try {
@@ -23438,17 +23635,22 @@ async function deploy(options, deps = {}) {
     } catch (err) {
       rethrowProxy("deploy init failed", err);
     }
+    const spin = options.json ? null : mkSpinner();
+    spin?.start(`Uploading 0/${filtered.length} files`);
     const uploadResult = await upload({
       client,
       deployId: initResult.deployId,
       jwt: initResult.jwt,
-      files: filtered
+      files: filtered,
+      onProgress: spin ? (p2) => spin.message(`Uploading ${p2.uploaded}/${p2.total} \u2014 ${p2.current}`) : void 0
     });
     if (uploadResult.errors.length > 0) {
+      spin?.error(`Upload failed: ${uploadResult.errors.length} file(s)`);
       const message = `Upload partially failed: ${uploadResult.errors.length} file(s) failed:
   - ${uploadResult.errors.join("\n  - ")}`;
       throw new PartialUploadError(message);
     }
+    spin?.stop(`Uploaded ${uploadResult.fileCount} files`);
     const mode = options.promote ? "production" : "preview";
     let finalizeResult;
     try {
@@ -23461,6 +23663,25 @@ async function deploy(options, deps = {}) {
     } catch (err) {
       rethrowProxy("deploy finalize failed", err);
     }
+    if (options.promote && !options.json) {
+      try {
+        const preview = await client.getAlias({
+          site: config2.site,
+          mode: "preview"
+        });
+        if (preview && preview.deployId !== finalizeResult.deployId) {
+          warn(
+            `Preview alias still points to ${preview.deployId}; it will not auto-update. Run \`universe static deploy\` (without --promote) to refresh preview.`
+          );
+        }
+      } catch (err) {
+        if (err instanceof ProxyError && (err.status === 401 || err.status === 403)) {
+          warn(
+            `Preview alias probe got ${err.status} (${err.code}) \u2014 token may need rotation: ${err.message}`
+          );
+        }
+      }
+    }
     if (options.json) {
       emitJson(
         buildEnvelope("deploy", true, {
@@ -23507,11 +23728,9 @@ async function deploy(options, deps = {}) {
       code = EXIT_USAGE;
       message = String(err);
     }
-    if (options.json) {
-      emitJson(buildErrorEnvelope("deploy", code, message));
-    } else {
-      error48(message);
-    }
+    outputError({ json: options.json, command: "deploy" }, code, message, {
+      logError: error48
+    });
     exit(code);
   }
 }
@@ -23591,6 +23810,19 @@ async function runDeviceFlow(opts) {
 
 // src/commands/login.ts
 var DEFAULT_SCOPE = "read:org user:email";
+var DEFAULT_PROXY_URL2 = "https://uploads.freecode.camp";
+var NO_SITES_WARNING = [
+  "Logged in, but the proxy reports 0 authorized sites for your account.",
+  "This usually means the Universe CLI GitHub App is not installed on the org",
+  "that owns the registry-authz team (production: `freeCodeCamp-Universe`), or",
+  "your account is not on a team granted access to any site.",
+  "",
+  "Next steps:",
+  "  1. Run `universe whoami` to confirm the identity that resolved.",
+  "  2. Ask an org owner to install the Universe CLI GitHub App on the org.",
+  "  3. Confirm your team membership at",
+  "     https://github.com/orgs/freeCodeCamp-Universe/teams."
+].join("\n");
 function emitJson2(envelope) {
   process.stdout.write(JSON.stringify(envelope) + "\n");
 }
@@ -23652,25 +23884,56 @@ async function login(options, deps = {}) {
     });
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    if (options.json) {
-      emitJson2({
-        schemaVersion: "1",
-        command: "login",
-        success: false,
-        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-        error: { code: EXIT_CREDENTIALS, message }
-      });
-    } else {
-      error48(message);
-    }
+    outputError(
+      { json: options.json, command: "login" },
+      EXIT_CREDENTIALS,
+      message,
+      { logError: error48 }
+    );
     exit(EXIT_CREDENTIALS);
     return;
   }
   await save(token);
+  const selfCheck = await postLoginSelfCheck(token, env, deps);
   if (options.json) {
-    emitJson2(buildEnvelope("login", true, { stored: true }));
+    emitJson2(
+      buildEnvelope("login", true, {
+        stored: true,
+        ...selfCheck.checked ? {
+          authorizedSitesCount: selfCheck.authorizedSitesCount,
+          ...selfCheck.warning ? { warning: selfCheck.warning } : {}
+        } : {}
+      })
+    );
   } else {
     success2("Logged in. Token stored at ~/.config/universe-cli/token.");
+    if (selfCheck.checked && selfCheck.warning) {
+      const warn = deps.logWarn ?? ((s) => O2.warn(s));
+      warn(selfCheck.warning);
+    }
+  }
+}
+async function postLoginSelfCheck(token, env, deps) {
+  const mkClient = deps.createProxyClient ?? createProxyClient;
+  try {
+    const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL2;
+    const client = mkClient({
+      baseUrl,
+      getAuthToken: () => token,
+      timeoutMs: parseFetchTimeoutMs(env)
+    });
+    const result = await client.whoami();
+    const count = result.authorizedSites.length;
+    if (count === 0) {
+      return {
+        checked: true,
+        authorizedSitesCount: 0,
+        warning: NO_SITES_WARNING
+      };
+    }
+    return { checked: true, authorizedSitesCount: count };
+  } catch {
+    return { checked: false, authorizedSitesCount: 0 };
   }
 }
 
@@ -23771,7 +24034,8 @@ async function ls(options, deps = {}) {
     const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL;
     const client = mkClient({
       baseUrl,
-      getAuthToken: () => identity.token
+      getAuthToken: () => identity.token,
+      timeoutMs: parseFetchTimeoutMs(env)
     });
     const raw = await client.siteDeploys({ site });
     const sorted = [...raw].sort(
@@ -23795,11 +24059,9 @@ async function ls(options, deps = {}) {
     success2(formatTable(deploys));
   } catch (err) {
     const { code, message } = wrapProxyError("ls", err);
-    if (options.json) {
-      emitJson4(buildErrorEnvelope("ls", code, message));
-    } else {
-      error48(message);
-    }
+    outputError({ json: options.json, command: "ls" }, code, message, {
+      logError: error48
+    });
     exit(code);
   }
 }
@@ -23855,7 +24117,8 @@ async function promote(options, deps = {}) {
     const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL;
     const client = mkClient({
       baseUrl,
-      getAuthToken: () => identity.token
+      getAuthToken: () => identity.token,
+      timeoutMs: parseFetchTimeoutMs(env)
     });
     let result;
     if (options.from) {
@@ -23953,16 +24216,11 @@ async function promote(options, deps = {}) {
     }
   } catch (err) {
     const { code, message } = wrapProxyError("promote", err);
-    if (options.json) {
-      const envelope = buildErrorEnvelope("promote", code, message);
-      if (err instanceof AliasDriftError) {
-        emitJson5({ ...envelope, current: err.current });
-      } else {
-        emitJson5(envelope);
-      }
-    } else {
-      error48(message);
-    }
+    const extras = err instanceof AliasDriftError ? { current: err.current } : void 0;
+    outputError({ json: options.json, command: "promote" }, code, message, {
+      logError: error48,
+      extras
+    });
     exit(code);
   }
 }
@@ -24023,7 +24281,8 @@ async function rollback(options, deps = {}) {
     const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL;
     const client = mkClient({
       baseUrl,
-      getAuthToken: () => identity.token
+      getAuthToken: () => identity.token,
+      timeoutMs: parseFetchTimeoutMs(env)
     });
     const to = options.to.trim();
     const prod = await client.getAlias({
@@ -24076,22 +24335,17 @@ async function rollback(options, deps = {}) {
     }
   } catch (err) {
     const { code, message } = wrapProxyError("rollback", err);
-    if (options.json) {
-      const envelope = buildErrorEnvelope("rollback", code, message);
-      if (err instanceof AliasDriftError) {
-        emitJson6({ ...envelope, current: err.current });
-      } else {
-        emitJson6(envelope);
-      }
-    } else {
-      error48(message);
-    }
+    const extras = err instanceof AliasDriftError ? { current: err.current } : void 0;
+    outputError({ json: options.json, command: "rollback" }, code, message, {
+      logError: error48,
+      extras
+    });
     exit(code);
   }
 }
 
 // src/commands/whoami.ts
-var DEFAULT_PROXY_URL2 = "https://uploads.freecode.camp";
+var DEFAULT_PROXY_URL3 = "https://uploads.freecode.camp";
 function emitJson7(envelope) {
   process.stdout.write(JSON.stringify(envelope) + "\n");
 }
@@ -24105,18 +24359,20 @@ async function whoami(options, deps = {}) {
   const identity = await resolve6({ env });
   if (!identity) {
     const msg = "No GitHub identity available. Run `universe login`, set $GITHUB_TOKEN, or install the gh CLI.";
-    if (options.json) {
-      emitJson7(buildErrorEnvelope("whoami", EXIT_CREDENTIALS, msg));
-    } else {
-      error48(msg);
-    }
+    outputError(
+      { json: options.json, command: "whoami" },
+      EXIT_CREDENTIALS,
+      msg,
+      { logError: error48 }
+    );
     exit(EXIT_CREDENTIALS);
     return;
   }
-  const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL2;
+  const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL3;
   const client = mkClient({
     baseUrl,
-    getAuthToken: () => identity.token
+    getAuthToken: () => identity.token,
+    timeoutMs: parseFetchTimeoutMs(env)
   });
   try {
     const result = await client.whoami();
@@ -24142,11 +24398,9 @@ async function whoami(options, deps = {}) {
   } catch (err) {
     const exitCode = err instanceof CliError ? err.exitCode : EXIT_CREDENTIALS;
     const message = err instanceof ProxyError ? `whoami failed (${err.code}): ${err.message}` : err instanceof Error ? err.message : String(err);
-    if (options.json) {
-      emitJson7(buildErrorEnvelope("whoami", exitCode, message));
-    } else {
-      error48(message);
-    }
+    outputError({ json: options.json, command: "whoami" }, exitCode, message, {
+      logError: error48
+    });
     exit(exitCode);
   }
 }
@@ -24173,7 +24427,8 @@ async function setupClient(deps) {
   const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL;
   const client = mkClient({
     baseUrl,
-    getAuthToken: () => identity.token
+    getAuthToken: () => identity.token,
+    timeoutMs: parseFetchTimeoutMs(env)
   });
   return { client, identitySource: identity.source };
 }
@@ -24200,7 +24455,7 @@ async function ls2(options, deps = {}) {
   const error48 = deps.logError ?? ((s) => O2.error(s));
   const exit = deps.exit ?? exitWithCode;
   try {
-    const { client } = await setupClient(deps);
+    const { client, identitySource } = await setupClient(deps);
     let rows = await client.listSites();
     let scope = "all";
     if (options.mine) {
@@ -24214,7 +24469,8 @@ async function ls2(options, deps = {}) {
         buildEnvelope(command, true, {
           count: rows.length,
           scope,
-          sites: rows
+          sites: rows,
+          identitySource
         })
       );
     } else {
@@ -24222,11 +24478,9 @@ async function ls2(options, deps = {}) {
     }
   } catch (err) {
     const { code, message } = wrapProxyError(command, err);
-    if (options.json) {
-      emitJson8(buildErrorEnvelope(command, code, message));
-    } else {
-      error48(message);
-    }
+    outputError({ json: options.json, command }, code, message, {
+      logError: error48
+    });
     exit(code);
   }
 }
@@ -24242,7 +24496,7 @@ async function register(options, deps = {}) {
       throw new UsageError("slug is required (positional argument)");
     }
     const teams = parseTeamsFlag(options.team);
-    const { client } = await setupClient(deps);
+    const { client, identitySource } = await setupClient(deps);
     const row = await client.registerSite({
       slug: options.slug,
       teams: teams.length > 0 ? teams : void 0
@@ -24253,7 +24507,8 @@ async function register(options, deps = {}) {
           slug: row.slug,
           teams: row.teams,
           createdAt: row.createdAt,
-          createdBy: row.createdBy
+          createdBy: row.createdBy,
+          identitySource
         })
       );
     } else {
@@ -24270,11 +24525,9 @@ async function register(options, deps = {}) {
     }
   } catch (err) {
     const { code, message } = wrapProxyError(command, err);
-    if (options.json) {
-      emitJson8(buildErrorEnvelope(command, code, message));
-    } else {
-      error48(message);
-    }
+    outputError({ json: options.json, command }, code, message, {
+      logError: error48
+    });
     exit(code);
   }
 }
@@ -24289,13 +24542,14 @@ async function rm2(options, deps = {}) {
     if (!options.slug || options.slug.trim().length === 0) {
       throw new UsageError("slug is required (positional argument)");
     }
-    const { client } = await setupClient(deps);
+    const { client, identitySource } = await setupClient(deps);
     await client.deleteSite({ slug: options.slug });
     if (options.json) {
       emitJson8(
         buildEnvelope(command, true, {
           slug: options.slug,
-          deleted: true
+          deleted: true,
+          identitySource
         })
       );
     } else {
@@ -24310,11 +24564,9 @@ async function rm2(options, deps = {}) {
     }
   } catch (err) {
     const { code, message } = wrapProxyError(command, err);
-    if (options.json) {
-      emitJson8(buildErrorEnvelope(command, code, message));
-    } else {
-      error48(message);
-    }
+    outputError({ json: options.json, command }, code, message, {
+      logError: error48
+    });
     exit(code);
   }
 }
@@ -24335,7 +24587,7 @@ async function update(options, deps = {}) {
         "--team is required with at least one slug; use `sites rm` to remove a site"
       );
     }
-    const { client } = await setupClient(deps);
+    const { client, identitySource } = await setupClient(deps);
     const row = await client.updateSite({
       slug: options.slug,
       teams
@@ -24345,7 +24597,8 @@ async function update(options, deps = {}) {
         buildEnvelope(command, true, {
           slug: row.slug,
           teams: row.teams,
-          updatedAt: row.updatedAt
+          updatedAt: row.updatedAt,
+          identitySource
         })
       );
     } else {
@@ -24361,78 +24614,15 @@ async function update(options, deps = {}) {
     }
   } catch (err) {
     const { code, message } = wrapProxyError(command, err);
-    if (options.json) {
-      emitJson8(buildErrorEnvelope(command, code, message));
-    } else {
-      error48(message);
-    }
+    outputError({ json: options.json, command }, code, message, {
+      logError: error48
+    });
     exit(code);
   }
 }
 
-// src/output/redact.ts
-var AWS_KEY_PREFIX_PATTERN = /(?:AKIA|ASIA|AROA|AIDA|ACCA|ANPA|ABIA|AGPA)[A-Z0-9]{12,}/g;
-var URL_CREDS_PATTERN = /https?:\/\/[^@\s]+@/g;
-var CREDENTIAL_CONTEXT_PATTERN = /(?:access_key_id|secret_access_key|accessKeyId|secretAccessKey|secret|password|token|key|credential|auth)\s*[=:]\s*([A-Za-z0-9/+=]{21,})/gi;
-var HEX_CREDENTIAL_CONTEXT_PATTERN = /(?:secret|password|token|key|credential|auth|access_key_id|secret_access_key)\s*[=:]\s*([a-f0-9]{32,})/gi;
-var JSON_CREDENTIAL_PATTERN = /"(?:secret|password|token|key|credential|auth|access_key_id|secret_access_key|accessKeyId|secretAccessKey)"\s*:\s*"[^"]+"/gi;
-var BEARER_PATTERN = /\bBearer\s+[A-Za-z0-9._~+/=-]+/gi;
-function maskAwsKey(match) {
-  return match.slice(0, 4) + "****" + match.slice(-4);
-}
-function maskUrlCreds(match) {
-  const atIndex = match.lastIndexOf("@");
-  const protocolEnd = match.indexOf("://") + 3;
-  return match.slice(0, protocolEnd) + "****:****@" + match.slice(atIndex + 1);
-}
-function redact(value) {
-  let result = value;
-  result = result.replace(URL_CREDS_PATTERN, maskUrlCreds);
-  result = result.replace(AWS_KEY_PREFIX_PATTERN, maskAwsKey);
-  result = result.replace(BEARER_PATTERN, "Bearer ****");
-  result = result.replace(JSON_CREDENTIAL_PATTERN, (match) => {
-    const colonIndex = match.indexOf(":");
-    return match.slice(0, colonIndex + 1) + '"****"';
-  });
-  result = result.replace(
-    CREDENTIAL_CONTEXT_PATTERN,
-    (_match, _secret, _offset, _full) => {
-      const eqIndex = _match.indexOf("=");
-      const colonIndex = _match.indexOf(":");
-      const sepIndex = eqIndex >= 0 && colonIndex >= 0 ? Math.min(eqIndex, colonIndex) : eqIndex >= 0 ? eqIndex : colonIndex;
-      const prefix = _match.slice(0, sepIndex + 1);
-      return prefix + "****";
-    }
-  );
-  result = result.replace(HEX_CREDENTIAL_CONTEXT_PATTERN, (_match, _secret) => {
-    const eqIndex = _match.indexOf("=");
-    const colonIndex = _match.indexOf(":");
-    const sepIndex = eqIndex >= 0 && colonIndex >= 0 ? Math.min(eqIndex, colonIndex) : eqIndex >= 0 ? eqIndex : colonIndex;
-    const prefix = _match.slice(0, sepIndex + 1);
-    return prefix + "****";
-  });
-  return result;
-}
-
-// src/output/format.ts
-function outputError(ctx, code, message, issues) {
-  const redactedMessage = redact(message);
-  const redactedIssues = issues?.map(redact);
-  if (ctx.json) {
-    const envelope = buildErrorEnvelope(
-      ctx.command,
-      code,
-      redactedMessage,
-      redactedIssues
-    );
-    process.stdout.write(JSON.stringify(envelope) + "\n");
-  } else {
-    O2.error(redactedMessage);
-  }
-}
-
 // src/cli.ts
-var version2 = true ? "0.6.0" : "0.0.0";
+var version2 = true ? "0.7.1" : "0.0.0";
 function handleActionError(command, json2, err) {
   const ctx = { json: json2, command };
   const message = err instanceof Error ? err.message : "unknown error";