@freecodecamp/universe-cli 0.6.0 → 0.7.1

package/dist/index.js

@@ -6,7 +6,7 @@ import { cac } from "cac";
 // src/commands/deploy.ts
 import { readFile as readFile2 } from "fs/promises";
 import { resolve as resolve2 } from "path";
-import { log } from "@clack/prompts";
+import { log as log2, spinner } from "@clack/prompts";
 
 // src/output/exit-codes.ts
 var EXIT_USAGE = 10;
@@ -221,14 +221,14 @@ async function resolveIdentity(opts = {}) {
   if (isNonEmpty(ghTokenEnv)) {
     return { token: ghTokenEnv.trim(), source: "env_GH_TOKEN" };
   }
-  const ghCli = await execGh();
-  if (isNonEmpty(ghCli)) {
-    return { token: ghCli.trim(), source: "gh_cli" };
-  }
   const stored = await loadStored();
   if (isNonEmpty(stored)) {
     return { token: stored.trim(), source: "device_flow" };
   }
+  const ghCli = await execGh();
+  if (isNonEmpty(ghCli)) {
+    return { token: ghCli.trim(), source: "gh_cli" };
+  }
   return null;
 }
 
@@ -429,6 +429,14 @@ function suggest(target, candidates, threshold = 2) {
 }
 
 // src/lib/proxy-client.ts
+var DEFAULT_FETCH_TIMEOUT_MS = 3e4;
+function parseFetchTimeoutMs(env) {
+  const raw = env["UNIVERSE_FETCH_TIMEOUT_MS"];
+  if (raw === void 0 || raw === "") return void 0;
+  const n = Number(raw);
+  if (!Number.isFinite(n) || n < 0) return void 0;
+  return Math.floor(n);
+}
 var ProxyError = class extends CliError {
   exitCode;
   status;
@@ -506,6 +514,24 @@ function stripTrailingSlash(url) {
 function createProxyClient(cfg) {
   const base = stripTrailingSlash(cfg.baseUrl);
   const fetchImpl = cfg.fetch ?? globalThis.fetch.bind(globalThis);
+  const timeoutMs = cfg.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
+  function withTimeoutSignal(init) {
+    if (timeoutMs <= 0) return init;
+    const timeoutSignal = AbortSignal.timeout(timeoutMs);
+    const merged = init.signal ? AbortSignal.any([init.signal, timeoutSignal]) : timeoutSignal;
+    return { ...init, signal: merged };
+  }
+  function translateFetchError(err) {
+    if (err instanceof DOMException && (err.name === "TimeoutError" || err.name === "AbortError")) {
+      throw new ProxyError(
+        0,
+        "timeout",
+        `proxy timed out after ${timeoutMs}ms`
+      );
+    }
+    const message = err instanceof Error ? err.message : String(err);
+    throw new ProxyError(0, "network_error", `proxy unreachable: ${message}`);
+  }
   async function userBearer() {
     const tok = await cfg.getAuthToken();
     return `Bearer ${tok}`;
@@ -513,10 +539,9 @@ function createProxyClient(cfg) {
   async function call(url, init) {
     let response;
     try {
-      response = await fetchImpl(url, init);
+      response = await fetchImpl(url, withTimeoutSignal(init));
     } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      throw new ProxyError(0, "network_error", `proxy unreachable: ${message}`);
+      translateFetchError(err);
     }
     if (!response.ok) {
       const env = await readErrorEnvelope(response);
@@ -588,20 +613,18 @@ function createProxyClient(cfg) {
       const url = `${base}/api/site/${encodeURIComponent(req.site)}/alias/${encodeURIComponent(req.mode)}`;
       let response;
       try {
-        response = await fetchImpl(url, {
-          method: "GET",
-          headers: {
-            Authorization: await userBearer(),
-            Accept: "application/json"
-          }
-        });
-      } catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        throw new ProxyError(
-          0,
-          "network_error",
-          `proxy unreachable: ${message}`
+        response = await fetchImpl(
+          url,
+          withTimeoutSignal({
+            method: "GET",
+            headers: {
+              Authorization: await userBearer(),
+              Accept: "application/json"
+            }
+          })
         );
+      } catch (err) {
+        translateFetchError(err);
       }
       if (response.status === 404) return null;
       if (!response.ok) {
@@ -845,6 +868,106 @@ function buildErrorEnvelope(command, code, message, issues) {
   };
 }
 
+// src/output/format.ts
+import { log } from "@clack/prompts";
+
+// src/output/redact.ts
+var AWS_KEY_PREFIX_PATTERN = /(?:AKIA|ASIA|AROA|AIDA|ACCA|ANPA|ABIA|AGPA)[A-Z0-9]{12,}/g;
+var URL_CREDS_PATTERN = /https?:\/\/[^@\s]+@/g;
+var CREDENTIAL_CONTEXT_PATTERN = /(?:access_key_id|secret_access_key|accessKeyId|secretAccessKey|secret|password|token|key|credential|auth)\s*[=:]\s*([A-Za-z0-9/+=]{21,})/gi;
+var HEX_CREDENTIAL_CONTEXT_PATTERN = /(?:secret|password|token|key|credential|auth|access_key_id|secret_access_key)\s*[=:]\s*([a-f0-9]{32,})/gi;
+var JSON_CREDENTIAL_PATTERN = /"(?:secret|password|token|key|credential|auth|access_key_id|secret_access_key|accessKeyId|secretAccessKey)"\s*:\s*"[^"]+"/gi;
+var BEARER_PATTERN = /\bBearer\s+[A-Za-z0-9._~+/=-]+/gi;
+var CREDENTIAL_KEY_PATTERN = /(?:secret|password|token|key|credential|auth)/i;
+var EXACT_CREDENTIAL_KEYS = /* @__PURE__ */ new Set([
+  "accesskeyid",
+  "secretaccesskey",
+  "access_key_id",
+  "secret_access_key"
+]);
+var STANDALONE_LONG_SECRET = /^[A-Za-z0-9/+=]{21,}$/;
+function maskAwsKey(match) {
+  return match.slice(0, 4) + "****" + match.slice(-4);
+}
+function maskUrlCreds(match) {
+  const atIndex = match.lastIndexOf("@");
+  const protocolEnd = match.indexOf("://") + 3;
+  return match.slice(0, protocolEnd) + "****:****@" + match.slice(atIndex + 1);
+}
+function redact(value) {
+  let result = value;
+  result = result.replace(URL_CREDS_PATTERN, maskUrlCreds);
+  result = result.replace(AWS_KEY_PREFIX_PATTERN, maskAwsKey);
+  result = result.replace(BEARER_PATTERN, "Bearer ****");
+  result = result.replace(JSON_CREDENTIAL_PATTERN, (match) => {
+    const colonIndex = match.indexOf(":");
+    return match.slice(0, colonIndex + 1) + '"****"';
+  });
+  result = result.replace(
+    CREDENTIAL_CONTEXT_PATTERN,
+    (_match, _secret, _offset, _full) => {
+      const eqIndex = _match.indexOf("=");
+      const colonIndex = _match.indexOf(":");
+      const sepIndex = eqIndex >= 0 && colonIndex >= 0 ? Math.min(eqIndex, colonIndex) : eqIndex >= 0 ? eqIndex : colonIndex;
+      const prefix = _match.slice(0, sepIndex + 1);
+      return prefix + "****";
+    }
+  );
+  result = result.replace(HEX_CREDENTIAL_CONTEXT_PATTERN, (_match, _secret) => {
+    const eqIndex = _match.indexOf("=");
+    const colonIndex = _match.indexOf(":");
+    const sepIndex = eqIndex >= 0 && colonIndex >= 0 ? Math.min(eqIndex, colonIndex) : eqIndex >= 0 ? eqIndex : colonIndex;
+    const prefix = _match.slice(0, sepIndex + 1);
+    return prefix + "****";
+  });
+  return result;
+}
+function redactValue(value, keyName) {
+  if (typeof value === "string") {
+    if (keyName && EXACT_CREDENTIAL_KEYS.has(keyName.toLowerCase())) {
+      return "****";
+    }
+    const redacted = redact(value);
+    if (redacted === value && keyName && CREDENTIAL_KEY_PATTERN.test(keyName) && STANDALONE_LONG_SECRET.test(value)) {
+      return "****";
+    }
+    return redacted;
+  }
+  if (Array.isArray(value)) {
+    return value.map((v) => redactValue(v, keyName));
+  }
+  if (value !== null && typeof value === "object") {
+    return redactObject(value);
+  }
+  return value;
+}
+function redactObject(obj) {
+  const result = {};
+  for (const [key, value] of Object.entries(obj)) {
+    result[key] = redactValue(value, key);
+  }
+  return result;
+}
+
+// src/output/format.ts
+function outputError(ctx, code, message, optsOrIssues) {
+  const opts = Array.isArray(optsOrIssues) ? { issues: optsOrIssues } : optsOrIssues ?? {};
+  const redactedMessage = redact(message);
+  const redactedIssues = opts.issues?.map(redact);
+  if (ctx.json) {
+    const envelope = buildErrorEnvelope(
+      ctx.command,
+      code,
+      redactedMessage,
+      redactedIssues
+    );
+    const payload = opts.extras ? { ...envelope, ...redactObject(opts.extras) } : envelope;
+    process.stdout.write(JSON.stringify(payload) + "\n");
+  } else {
+    (opts.logError ?? ((m) => log.error(m)))(redactedMessage);
+  }
+}
+
 // src/commands/deploy.ts
 var defaultReadPlatformYaml = async (cwd) => {
   return readFile2(resolve2(cwd, "platform.yaml"), "utf-8");
@@ -938,10 +1061,11 @@ async function deploy(options, deps = {}) {
   const build = deps.runBuild ?? runBuild;
   const walk = deps.walkFiles ?? walkFiles;
   const upload = deps.uploadFiles ?? uploadFiles;
-  const success = deps.logSuccess ?? ((s) => log.success(s));
-  const info = deps.logInfo ?? ((s) => log.info(s));
-  const warn = deps.logWarn ?? ((s) => log.warn(s));
-  const error = deps.logError ?? ((s) => log.error(s));
+  const mkSpinner = deps.createSpinner ?? (() => spinner());
+  const success = deps.logSuccess ?? ((s) => log2.success(s));
+  const info = deps.logInfo ?? ((s) => log2.info(s));
+  const warn = deps.logWarn ?? ((s) => log2.warn(s));
+  const error = deps.logError ?? ((s) => log2.error(s));
   const exit = deps.exit ?? exitWithCode;
   try {
     const identity = await resolveId({ env });
@@ -954,7 +1078,8 @@ async function deploy(options, deps = {}) {
     const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL;
     const client = mkClient({
       baseUrl,
-      getAuthToken: () => identity.token
+      getAuthToken: () => identity.token,
+      timeoutMs: parseFetchTimeoutMs(env)
     });
     let me;
     try {
@@ -1005,17 +1130,22 @@ async function deploy(options, deps = {}) {
     } catch (err) {
       rethrowProxy("deploy init failed", err);
     }
+    const spin = options.json ? null : mkSpinner();
+    spin?.start(`Uploading 0/${filtered.length} files`);
     const uploadResult = await upload({
       client,
       deployId: initResult.deployId,
       jwt: initResult.jwt,
-      files: filtered
+      files: filtered,
+      onProgress: spin ? (p) => spin.message(`Uploading ${p.uploaded}/${p.total} \u2014 ${p.current}`) : void 0
     });
     if (uploadResult.errors.length > 0) {
+      spin?.error(`Upload failed: ${uploadResult.errors.length} file(s)`);
       const message = `Upload partially failed: ${uploadResult.errors.length} file(s) failed:
   - ${uploadResult.errors.join("\n  - ")}`;
       throw new PartialUploadError(message);
     }
+    spin?.stop(`Uploaded ${uploadResult.fileCount} files`);
     const mode = options.promote ? "production" : "preview";
     let finalizeResult;
     try {
@@ -1028,6 +1158,25 @@ async function deploy(options, deps = {}) {
     } catch (err) {
       rethrowProxy("deploy finalize failed", err);
     }
+    if (options.promote && !options.json) {
+      try {
+        const preview = await client.getAlias({
+          site: config.site,
+          mode: "preview"
+        });
+        if (preview && preview.deployId !== finalizeResult.deployId) {
+          warn(
+            `Preview alias still points to ${preview.deployId}; it will not auto-update. Run \`universe static deploy\` (without --promote) to refresh preview.`
+          );
+        }
+      } catch (err) {
+        if (err instanceof ProxyError && (err.status === 401 || err.status === 403)) {
+          warn(
+            `Preview alias probe got ${err.status} (${err.code}) \u2014 token may need rotation: ${err.message}`
+          );
+        }
+      }
+    }
     if (options.json) {
       emitJson(
         buildEnvelope("deploy", true, {
@@ -1074,17 +1223,15 @@ async function deploy(options, deps = {}) {
       code = EXIT_USAGE;
       message = String(err);
     }
-    if (options.json) {
-      emitJson(buildErrorEnvelope("deploy", code, message));
-    } else {
-      error(message);
-    }
+    outputError({ json: options.json, command: "deploy" }, code, message, {
+      logError: error
+    });
     exit(code);
   }
 }
 
 // src/commands/login.ts
-import { log as log2 } from "@clack/prompts";
+import { log as log3 } from "@clack/prompts";
 
 // src/lib/device-flow.ts
 var DEVICE_CODE_URL = "https://github.com/login/device/code";
@@ -1161,6 +1308,19 @@ async function runDeviceFlow(opts) {
 
 // src/commands/login.ts
 var DEFAULT_SCOPE = "read:org user:email";
+var DEFAULT_PROXY_URL2 = "https://uploads.freecode.camp";
+var NO_SITES_WARNING = [
+  "Logged in, but the proxy reports 0 authorized sites for your account.",
+  "This usually means the Universe CLI GitHub App is not installed on the org",
+  "that owns the registry-authz team (production: `freeCodeCamp-Universe`), or",
+  "your account is not on a team granted access to any site.",
+  "",
+  "Next steps:",
+  "  1. Run `universe whoami` to confirm the identity that resolved.",
+  "  2. Ask an org owner to install the Universe CLI GitHub App on the org.",
+  "  3. Confirm your team membership at",
+  "     https://github.com/orgs/freeCodeCamp-Universe/teams."
+].join("\n");
 function emitJson2(envelope) {
   process.stdout.write(JSON.stringify(envelope) + "\n");
 }
@@ -1169,9 +1329,9 @@ async function login(options, deps = {}) {
   const runFlow = deps.runDeviceFlow ?? runDeviceFlow;
   const save = deps.saveToken ?? saveToken;
   const load = deps.loadToken ?? loadToken;
-  const success = deps.logSuccess ?? ((s) => log2.success(s));
-  const info = deps.logInfo ?? ((s) => log2.info(s));
-  const error = deps.logError ?? ((s) => log2.error(s));
+  const success = deps.logSuccess ?? ((s) => log3.success(s));
+  const info = deps.logInfo ?? ((s) => log3.info(s));
+  const error = deps.logError ?? ((s) => log3.error(s));
   const exit = deps.exit ?? exitWithCode;
   const envClientId = env["UNIVERSE_GH_CLIENT_ID"];
   const clientId = envClientId && envClientId.trim().length > 0 ? envClientId : DEFAULT_GH_CLIENT_ID;
@@ -1222,38 +1382,69 @@ async function login(options, deps = {}) {
     });
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    if (options.json) {
-      emitJson2({
-        schemaVersion: "1",
-        command: "login",
-        success: false,
-        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-        error: { code: EXIT_CREDENTIALS, message }
-      });
-    } else {
-      error(message);
-    }
+    outputError(
+      { json: options.json, command: "login" },
+      EXIT_CREDENTIALS,
+      message,
+      { logError: error }
+    );
     exit(EXIT_CREDENTIALS);
     return;
   }
   await save(token);
+  const selfCheck = await postLoginSelfCheck(token, env, deps);
   if (options.json) {
-    emitJson2(buildEnvelope("login", true, { stored: true }));
+    emitJson2(
+      buildEnvelope("login", true, {
+        stored: true,
+        ...selfCheck.checked ? {
+          authorizedSitesCount: selfCheck.authorizedSitesCount,
+          ...selfCheck.warning ? { warning: selfCheck.warning } : {}
+        } : {}
+      })
+    );
   } else {
     success("Logged in. Token stored at ~/.config/universe-cli/token.");
+    if (selfCheck.checked && selfCheck.warning) {
+      const warn = deps.logWarn ?? ((s) => log3.warn(s));
+      warn(selfCheck.warning);
+    }
+  }
+}
+async function postLoginSelfCheck(token, env, deps) {
+  const mkClient = deps.createProxyClient ?? createProxyClient;
+  try {
+    const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL2;
+    const client = mkClient({
+      baseUrl,
+      getAuthToken: () => token,
+      timeoutMs: parseFetchTimeoutMs(env)
+    });
+    const result = await client.whoami();
+    const count = result.authorizedSites.length;
+    if (count === 0) {
+      return {
+        checked: true,
+        authorizedSitesCount: 0,
+        warning: NO_SITES_WARNING
+      };
+    }
+    return { checked: true, authorizedSitesCount: count };
+  } catch {
+    return { checked: false, authorizedSitesCount: 0 };
   }
 }
 
 // src/commands/logout.ts
-import { log as log3 } from "@clack/prompts";
+import { log as log4 } from "@clack/prompts";
 function emitJson3(envelope) {
   process.stdout.write(JSON.stringify(envelope) + "\n");
 }
 async function logout(options, deps = {}) {
   const load = deps.loadToken ?? loadToken;
   const del = deps.deleteToken ?? deleteToken;
-  const success = deps.logSuccess ?? ((s) => log3.success(s));
-  const info = deps.logInfo ?? ((s) => log3.info(s));
+  const success = deps.logSuccess ?? ((s) => log4.success(s));
+  const info = deps.logInfo ?? ((s) => log4.info(s));
   const existing = await load();
   await del();
   if (options.json) {
@@ -1270,7 +1461,7 @@ async function logout(options, deps = {}) {
 // src/commands/ls.ts
 import { readFile as readFile3 } from "fs/promises";
 import { resolve as resolve3 } from "path";
-import { log as log4 } from "@clack/prompts";
+import { log as log5 } from "@clack/prompts";
 var defaultReadPlatformYaml2 = async (cwd) => {
   return readFile3(resolve3(cwd, "platform.yaml"), "utf-8");
 };
@@ -1320,9 +1511,9 @@ async function ls(options, deps = {}) {
   const readYaml = deps.readPlatformYaml ?? defaultReadPlatformYaml2;
   const resolveId = deps.resolveIdentity ?? resolveIdentity;
   const mkClient = deps.createProxyClient ?? createProxyClient;
-  const success = deps.logSuccess ?? ((s) => log4.success(s));
-  const info = deps.logInfo ?? ((s) => log4.info(s));
-  const error = deps.logError ?? ((s) => log4.error(s));
+  const success = deps.logSuccess ?? ((s) => log5.success(s));
+  const info = deps.logInfo ?? ((s) => log5.info(s));
+  const error = deps.logError ?? ((s) => log5.error(s));
   const exit = deps.exit ?? exitWithCode;
   try {
     const identity = await resolveId({ env });
@@ -1343,7 +1534,8 @@ async function ls(options, deps = {}) {
     const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL;
     const client = mkClient({
       baseUrl,
-      getAuthToken: () => identity.token
+      getAuthToken: () => identity.token,
+      timeoutMs: parseFetchTimeoutMs(env)
     });
     const raw = await client.siteDeploys({ site });
     const sorted = [...raw].sort(
@@ -1367,11 +1559,9 @@ async function ls(options, deps = {}) {
     success(formatTable(deploys));
   } catch (err) {
     const { code, message } = wrapProxyError("ls", err);
-    if (options.json) {
-      emitJson4(buildErrorEnvelope("ls", code, message));
-    } else {
-      error(message);
-    }
+    outputError({ json: options.json, command: "ls" }, code, message, {
+      logError: error
+    });
     exit(code);
   }
 }
@@ -1379,7 +1569,7 @@ async function ls(options, deps = {}) {
 // src/commands/promote.ts
 import { readFile as readFile4 } from "fs/promises";
 import { resolve as resolve4 } from "path";
-import { confirm, isCancel, log as log5 } from "@clack/prompts";
+import { confirm, isCancel, log as log6 } from "@clack/prompts";
 var defaultPromptConfirm = async (msg) => {
   const r = await confirm({ message: msg, initialValue: false });
   if (isCancel(r)) return false;
@@ -1413,8 +1603,8 @@ async function promote(options, deps = {}) {
   const readYaml = deps.readPlatformYaml ?? defaultReadPlatformYaml3;
   const resolveId = deps.resolveIdentity ?? resolveIdentity;
   const mkClient = deps.createProxyClient ?? createProxyClient;
-  const success = deps.logSuccess ?? ((s) => log5.success(s));
-  const error = deps.logError ?? ((s) => log5.error(s));
+  const success = deps.logSuccess ?? ((s) => log6.success(s));
+  const error = deps.logError ?? ((s) => log6.error(s));
   const exit = deps.exit ?? exitWithCode;
   const promptConfirm = deps.promptConfirm ?? defaultPromptConfirm;
   try {
@@ -1428,7 +1618,8 @@ async function promote(options, deps = {}) {
     const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL;
     const client = mkClient({
       baseUrl,
-      getAuthToken: () => identity.token
+      getAuthToken: () => identity.token,
+      timeoutMs: parseFetchTimeoutMs(env)
     });
     let result;
     if (options.from) {
@@ -1526,16 +1717,11 @@ async function promote(options, deps = {}) {
     }
   } catch (err) {
     const { code, message } = wrapProxyError("promote", err);
-    if (options.json) {
-      const envelope = buildErrorEnvelope("promote", code, message);
-      if (err instanceof AliasDriftError) {
-        emitJson5({ ...envelope, current: err.current });
-      } else {
-        emitJson5(envelope);
-      }
-    } else {
-      error(message);
-    }
+    const extras = err instanceof AliasDriftError ? { current: err.current } : void 0;
+    outputError({ json: options.json, command: "promote" }, code, message, {
+      logError: error,
+      extras
+    });
     exit(code);
   }
 }
@@ -1543,7 +1729,7 @@ async function promote(options, deps = {}) {
 // src/commands/rollback.ts
 import { readFile as readFile5 } from "fs/promises";
 import { resolve as resolve5 } from "path";
-import { confirm as confirm2, isCancel as isCancel2, log as log6 } from "@clack/prompts";
+import { confirm as confirm2, isCancel as isCancel2, log as log7 } from "@clack/prompts";
 var defaultPromptConfirm2 = async (msg) => {
   const r = await confirm2({ message: msg, initialValue: false });
   if (isCancel2(r)) return false;
@@ -1577,8 +1763,8 @@ async function rollback(options, deps = {}) {
   const readYaml = deps.readPlatformYaml ?? defaultReadPlatformYaml4;
   const resolveId = deps.resolveIdentity ?? resolveIdentity;
   const mkClient = deps.createProxyClient ?? createProxyClient;
-  const success = deps.logSuccess ?? ((s) => log6.success(s));
-  const error = deps.logError ?? ((s) => log6.error(s));
+  const success = deps.logSuccess ?? ((s) => log7.success(s));
+  const error = deps.logError ?? ((s) => log7.error(s));
   const exit = deps.exit ?? exitWithCode;
   const promptConfirm = deps.promptConfirm ?? defaultPromptConfirm2;
   try {
@@ -1597,7 +1783,8 @@ async function rollback(options, deps = {}) {
     const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL;
     const client = mkClient({
       baseUrl,
-      getAuthToken: () => identity.token
+      getAuthToken: () => identity.token,
+      timeoutMs: parseFetchTimeoutMs(env)
     });
     const to = options.to.trim();
     const prod = await client.getAlias({
@@ -1650,23 +1837,18 @@ async function rollback(options, deps = {}) {
     }
   } catch (err) {
     const { code, message } = wrapProxyError("rollback", err);
-    if (options.json) {
-      const envelope = buildErrorEnvelope("rollback", code, message);
-      if (err instanceof AliasDriftError) {
-        emitJson6({ ...envelope, current: err.current });
-      } else {
-        emitJson6(envelope);
-      }
-    } else {
-      error(message);
-    }
+    const extras = err instanceof AliasDriftError ? { current: err.current } : void 0;
+    outputError({ json: options.json, command: "rollback" }, code, message, {
+      logError: error,
+      extras
+    });
     exit(code);
   }
 }
 
 // src/commands/whoami.ts
-import { log as log7 } from "@clack/prompts";
-var DEFAULT_PROXY_URL2 = "https://uploads.freecode.camp";
+import { log as log8 } from "@clack/prompts";
+var DEFAULT_PROXY_URL3 = "https://uploads.freecode.camp";
 function emitJson7(envelope) {
   process.stdout.write(JSON.stringify(envelope) + "\n");
 }
@@ -1674,24 +1856,26 @@ async function whoami(options, deps = {}) {
   const env = deps.env ?? process.env;
   const resolve6 = deps.resolveIdentity ?? resolveIdentity;
   const mkClient = deps.createProxyClient ?? createProxyClient;
-  const success = deps.logSuccess ?? ((s) => log7.success(s));
-  const error = deps.logError ?? ((s) => log7.error(s));
+  const success = deps.logSuccess ?? ((s) => log8.success(s));
+  const error = deps.logError ?? ((s) => log8.error(s));
   const exit = deps.exit ?? exitWithCode;
   const identity = await resolve6({ env });
   if (!identity) {
     const msg = "No GitHub identity available. Run `universe login`, set $GITHUB_TOKEN, or install the gh CLI.";
-    if (options.json) {
-      emitJson7(buildErrorEnvelope("whoami", EXIT_CREDENTIALS, msg));
-    } else {
-      error(msg);
-    }
+    outputError(
+      { json: options.json, command: "whoami" },
+      EXIT_CREDENTIALS,
+      msg,
+      { logError: error }
+    );
     exit(EXIT_CREDENTIALS);
     return;
   }
-  const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL2;
+  const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL3;
   const client = mkClient({
     baseUrl,
-    getAuthToken: () => identity.token
+    getAuthToken: () => identity.token,
+    timeoutMs: parseFetchTimeoutMs(env)
   });
   try {
     const result = await client.whoami();
@@ -1717,17 +1901,15 @@ async function whoami(options, deps = {}) {
   } catch (err) {
     const exitCode = err instanceof CliError ? err.exitCode : EXIT_CREDENTIALS;
     const message = err instanceof ProxyError ? `whoami failed (${err.code}): ${err.message}` : err instanceof Error ? err.message : String(err);
-    if (options.json) {
-      emitJson7(buildErrorEnvelope("whoami", exitCode, message));
-    } else {
-      error(message);
-    }
+    outputError({ json: options.json, command: "whoami" }, exitCode, message, {
+      logError: error
+    });
     exit(exitCode);
   }
 }
 
 // src/commands/sites/ls.ts
-import { log as log8 } from "@clack/prompts";
+import { log as log9 } from "@clack/prompts";
 
 // src/commands/sites/_shared.ts
 function emitJson8(envelope) {
@@ -1751,7 +1933,8 @@ async function setupClient(deps) {
   const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL;
   const client = mkClient({
     baseUrl,
-    getAuthToken: () => identity.token
+    getAuthToken: () => identity.token,
+    timeoutMs: parseFetchTimeoutMs(env)
   });
   return { client, identitySource: identity.source };
 }
@@ -1774,11 +1957,11 @@ function formatTable2(rows) {
 }
 async function ls2(options, deps = {}) {
   const command = "sites ls";
-  const success = deps.logSuccess ?? ((s) => log8.message(s));
-  const error = deps.logError ?? ((s) => log8.error(s));
+  const success = deps.logSuccess ?? ((s) => log9.message(s));
+  const error = deps.logError ?? ((s) => log9.error(s));
   const exit = deps.exit ?? exitWithCode;
   try {
-    const { client } = await setupClient(deps);
+    const { client, identitySource } = await setupClient(deps);
     let rows = await client.listSites();
     let scope = "all";
     if (options.mine) {
@@ -1792,7 +1975,8 @@ async function ls2(options, deps = {}) {
         buildEnvelope(command, true, {
           count: rows.length,
           scope,
-          sites: rows
+          sites: rows,
+          identitySource
         })
       );
     } else {
@@ -1800,28 +1984,26 @@ async function ls2(options, deps = {}) {
     }
   } catch (err) {
     const { code, message } = wrapProxyError(command, err);
-    if (options.json) {
-      emitJson8(buildErrorEnvelope(command, code, message));
-    } else {
-      error(message);
-    }
+    outputError({ json: options.json, command }, code, message, {
+      logError: error
+    });
     exit(code);
   }
 }
 
 // src/commands/sites/register.ts
-import { log as log9 } from "@clack/prompts";
+import { log as log10 } from "@clack/prompts";
 async function register(options, deps = {}) {
   const command = "sites register";
-  const success = deps.logSuccess ?? ((s) => log9.success(s));
-  const error = deps.logError ?? ((s) => log9.error(s));
+  const success = deps.logSuccess ?? ((s) => log10.success(s));
+  const error = deps.logError ?? ((s) => log10.error(s));
   const exit = deps.exit ?? exitWithCode;
   try {
     if (!options.slug || options.slug.trim().length === 0) {
       throw new UsageError("slug is required (positional argument)");
     }
     const teams = parseTeamsFlag(options.team);
-    const { client } = await setupClient(deps);
+    const { client, identitySource } = await setupClient(deps);
     const row = await client.registerSite({
       slug: options.slug,
       teams: teams.length > 0 ? teams : void 0
@@ -1832,7 +2014,8 @@ async function register(options, deps = {}) {
           slug: row.slug,
           teams: row.teams,
           createdAt: row.createdAt,
-          createdBy: row.createdBy
+          createdBy: row.createdBy,
+          identitySource
         })
       );
     } else {
@@ -1849,33 +2032,32 @@ async function register(options, deps = {}) {
     }
   } catch (err) {
     const { code, message } = wrapProxyError(command, err);
-    if (options.json) {
-      emitJson8(buildErrorEnvelope(command, code, message));
-    } else {
-      error(message);
-    }
+    outputError({ json: options.json, command }, code, message, {
+      logError: error
+    });
     exit(code);
   }
 }
 
 // src/commands/sites/rm.ts
-import { log as log10 } from "@clack/prompts";
+import { log as log11 } from "@clack/prompts";
 async function rm2(options, deps = {}) {
   const command = "sites rm";
-  const success = deps.logSuccess ?? ((s) => log10.success(s));
-  const error = deps.logError ?? ((s) => log10.error(s));
+  const success = deps.logSuccess ?? ((s) => log11.success(s));
+  const error = deps.logError ?? ((s) => log11.error(s));
   const exit = deps.exit ?? exitWithCode;
   try {
     if (!options.slug || options.slug.trim().length === 0) {
       throw new UsageError("slug is required (positional argument)");
     }
-    const { client } = await setupClient(deps);
+    const { client, identitySource } = await setupClient(deps);
     await client.deleteSite({ slug: options.slug });
     if (options.json) {
       emitJson8(
         buildEnvelope(command, true, {
           slug: options.slug,
-          deleted: true
+          deleted: true,
+          identitySource
         })
       );
     } else {
@@ -1890,21 +2072,19 @@ async function rm2(options, deps = {}) {
     }
   } catch (err) {
     const { code, message } = wrapProxyError(command, err);
-    if (options.json) {
-      emitJson8(buildErrorEnvelope(command, code, message));
-    } else {
-      error(message);
-    }
+    outputError({ json: options.json, command }, code, message, {
+      logError: error
+    });
     exit(code);
   }
 }
 
 // src/commands/sites/update.ts
-import { log as log11 } from "@clack/prompts";
+import { log as log12 } from "@clack/prompts";
 async function update(options, deps = {}) {
   const command = "sites update";
-  const success = deps.logSuccess ?? ((s) => log11.success(s));
-  const error = deps.logError ?? ((s) => log11.error(s));
+  const success = deps.logSuccess ?? ((s) => log12.success(s));
+  const error = deps.logError ?? ((s) => log12.error(s));
   const exit = deps.exit ?? exitWithCode;
   try {
     if (!options.slug || options.slug.trim().length === 0) {
@@ -1916,7 +2096,7 @@ async function update(options, deps = {}) {
         "--team is required with at least one slug; use `sites rm` to remove a site"
       );
     }
-    const { client } = await setupClient(deps);
+    const { client, identitySource } = await setupClient(deps);
     const row = await client.updateSite({
       slug: options.slug,
       teams
@@ -1926,7 +2106,8 @@ async function update(options, deps = {}) {
         buildEnvelope(command, true, {
           slug: row.slug,
           teams: row.teams,
-          updatedAt: row.updatedAt
+          updatedAt: row.updatedAt,
+          identitySource
         })
       );
     } else {
@@ -1942,81 +2123,15 @@ async function update(options, deps = {}) {
     }
   } catch (err) {
     const { code, message } = wrapProxyError(command, err);
-    if (options.json) {
-      emitJson8(buildErrorEnvelope(command, code, message));
-    } else {
-      error(message);
-    }
+    outputError({ json: options.json, command }, code, message, {
+      logError: error
+    });
     exit(code);
   }
 }
 
-// src/output/format.ts
-import { log as log12 } from "@clack/prompts";
-
-// src/output/redact.ts
-var AWS_KEY_PREFIX_PATTERN = /(?:AKIA|ASIA|AROA|AIDA|ACCA|ANPA|ABIA|AGPA)[A-Z0-9]{12,}/g;
-var URL_CREDS_PATTERN = /https?:\/\/[^@\s]+@/g;
-var CREDENTIAL_CONTEXT_PATTERN = /(?:access_key_id|secret_access_key|accessKeyId|secretAccessKey|secret|password|token|key|credential|auth)\s*[=:]\s*([A-Za-z0-9/+=]{21,})/gi;
-var HEX_CREDENTIAL_CONTEXT_PATTERN = /(?:secret|password|token|key|credential|auth|access_key_id|secret_access_key)\s*[=:]\s*([a-f0-9]{32,})/gi;
-var JSON_CREDENTIAL_PATTERN = /"(?:secret|password|token|key|credential|auth|access_key_id|secret_access_key|accessKeyId|secretAccessKey)"\s*:\s*"[^"]+"/gi;
-var BEARER_PATTERN = /\bBearer\s+[A-Za-z0-9._~+/=-]+/gi;
-function maskAwsKey(match) {
-  return match.slice(0, 4) + "****" + match.slice(-4);
-}
-function maskUrlCreds(match) {
-  const atIndex = match.lastIndexOf("@");
-  const protocolEnd = match.indexOf("://") + 3;
-  return match.slice(0, protocolEnd) + "****:****@" + match.slice(atIndex + 1);
-}
-function redact(value) {
-  let result = value;
-  result = result.replace(URL_CREDS_PATTERN, maskUrlCreds);
-  result = result.replace(AWS_KEY_PREFIX_PATTERN, maskAwsKey);
-  result = result.replace(BEARER_PATTERN, "Bearer ****");
-  result = result.replace(JSON_CREDENTIAL_PATTERN, (match) => {
-    const colonIndex = match.indexOf(":");
-    return match.slice(0, colonIndex + 1) + '"****"';
-  });
-  result = result.replace(
-    CREDENTIAL_CONTEXT_PATTERN,
-    (_match, _secret, _offset, _full) => {
-      const eqIndex = _match.indexOf("=");
-      const colonIndex = _match.indexOf(":");
-      const sepIndex = eqIndex >= 0 && colonIndex >= 0 ? Math.min(eqIndex, colonIndex) : eqIndex >= 0 ? eqIndex : colonIndex;
-      const prefix = _match.slice(0, sepIndex + 1);
-      return prefix + "****";
-    }
-  );
-  result = result.replace(HEX_CREDENTIAL_CONTEXT_PATTERN, (_match, _secret) => {
-    const eqIndex = _match.indexOf("=");
-    const colonIndex = _match.indexOf(":");
-    const sepIndex = eqIndex >= 0 && colonIndex >= 0 ? Math.min(eqIndex, colonIndex) : eqIndex >= 0 ? eqIndex : colonIndex;
-    const prefix = _match.slice(0, sepIndex + 1);
-    return prefix + "****";
-  });
-  return result;
-}
-
-// src/output/format.ts
-function outputError(ctx, code, message, issues) {
-  const redactedMessage = redact(message);
-  const redactedIssues = issues?.map(redact);
-  if (ctx.json) {
-    const envelope = buildErrorEnvelope(
-      ctx.command,
-      code,
-      redactedMessage,
-      redactedIssues
-    );
-    process.stdout.write(JSON.stringify(envelope) + "\n");
-  } else {
-    log12.error(redactedMessage);
-  }
-}
-
 // src/cli.ts
-var version = true ? "0.6.0" : "0.0.0";
+var version = true ? "0.7.1" : "0.0.0";
 function handleActionError(command, json, err) {
   const ctx = { json, command };
   const message = err instanceof Error ? err.message : "unknown error";