@freecodecamp/universe-cli 0.7.2 → 0.8.0

package/dist/index.js

@@ -39,6 +39,9 @@ var StorageError = class extends CliError {
 var GitError = class extends CliError {
   exitCode = EXIT_GIT;
 };
+var ConfirmError = class extends CliError {
+  exitCode = EXIT_CONFIRM;
+};
 var PartialUploadError = class extends CliError {
   exitCode = EXIT_PARTIAL;
 };
@@ -51,8 +54,8 @@ import { execSync } from "child_process";
 function getGitState() {
   try {
     const hash = execSync("git rev-parse HEAD", { encoding: "utf-8" }).trim();
-    const status = execSync("git status --porcelain", { encoding: "utf-8" });
-    return { hash, dirty: status.length > 0 };
+    const status2 = execSync("git status --porcelain", { encoding: "utf-8" });
+    return { hash, dirty: status2.length > 0 };
   } catch {
     return { hash: null, dirty: false, error: "not a git repository" };
   }
@@ -101,13 +104,13 @@ import { spawn } from "child_process";
 import { stat } from "fs/promises";
 import { isAbsolute, resolve } from "path";
 var defaultExec = async (req) => {
-  return new Promise((resolveExit, reject) => {
+  return new Promise((resolveExit, reject2) => {
     const child = spawn(req.command, {
       cwd: req.cwd,
       shell: true,
       stdio: "inherit"
     });
-    child.on("error", (err) => reject(err));
+    child.on("error", (err) => reject2(err));
     child.on("exit", (code) => resolveExit(code ?? 1));
   });
 };
@@ -428,6 +431,52 @@ function suggest(target, candidates, threshold = 2) {
   return bestD <= threshold ? best : null;
 }
 
+// src/commands/repo/schema.ts
+import { z as z2 } from "zod";
+var REPO_NAME_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]{0,99}$/;
+var repoName = z2.string().regex(
+  REPO_NAME_RE,
+  "must start with a letter or digit, then letters, digits, '.', '_' or '-' (max 100 chars)"
+);
+var visibilitySchema = z2.enum(["public", "private"]);
+var repoStatusSchema = z2.enum([
+  "pending",
+  "approved",
+  "active",
+  "rejected",
+  "failed"
+]);
+var createRepoRequestSchema = z2.object({
+  name: repoName,
+  visibility: visibilitySchema.default("private"),
+  description: z2.string().max(350).optional(),
+  template: repoName.optional()
+}).strict();
+var repoRowSchema = z2.object({
+  id: z2.string(),
+  name: z2.string(),
+  owner: z2.string(),
+  visibility: visibilitySchema,
+  description: z2.string().optional(),
+  template: z2.string().optional(),
+  status: repoStatusSchema,
+  url: z2.string().optional(),
+  error: z2.string().optional(),
+  requestedBy: z2.string(),
+  approver: z2.string().optional(),
+  rejectReason: z2.string().optional(),
+  createdAt: z2.string(),
+  updatedAt: z2.string()
+});
+var repoRowArraySchema = z2.array(repoRowSchema);
+var repoApproveResultSchema = z2.object({
+  outcome: z2.enum(["ok", "approved_failed"]),
+  request: repoRowSchema
+});
+var repoTemplatesResponseSchema = z2.object({
+  templates: z2.array(z2.string())
+});
+
 // src/lib/proxy-client.ts
 var DEFAULT_FETCH_TIMEOUT_MS = 3e4;
 function parseFetchTimeoutMs(env) {
@@ -441,11 +490,13 @@ var ProxyError = class extends CliError {
   exitCode;
   status;
   code;
-  constructor(status, code, message) {
+  requestId;
+  constructor(status2, code, message, requestId) {
     super(message);
-    this.status = status;
+    this.status = status2;
     this.code = code;
-    this.exitCode = mapExitCode(status);
+    this.exitCode = mapExitCode(status2);
+    this.requestId = requestId;
   }
 };
 var AliasDriftError = class extends ProxyError {
@@ -455,16 +506,22 @@ var AliasDriftError = class extends ProxyError {
     this.current = current;
   }
 };
-function mapExitCode(status) {
-  if (status === 401 || status === 403) return EXIT_CREDENTIALS;
-  if (status === 422 || status === 0 || status >= 500) return EXIT_STORAGE;
+function mapExitCode(status2) {
+  if (status2 === 401 || status2 === 403) return EXIT_CREDENTIALS;
+  if (status2 === 422 || status2 === 0 || status2 >= 500) return EXIT_STORAGE;
   return EXIT_USAGE;
 }
 function wrapProxyError(command, err) {
   if (err instanceof ProxyError) {
+    let message = `${command} failed (${err.code}): ${err.message}`;
+    if (err.code === "user_unauthorized") {
+      message += "\n  hint: the active GitHub token may lack the read:org scope or SSO authorization for the org. $GITHUB_TOKEN / $GH_TOKEN override `gh auth token` \u2014 run `universe whoami` to check the active identity source, then unset them or re-authorize the token (Configure SSO).";
+    }
     return {
       code: err.exitCode,
-      message: `${command} failed (${err.code}): ${err.message}`
+      message,
+      kind: err.code,
+      requestId: err.requestId
     };
   }
   if (err instanceof CliError) {
@@ -479,34 +536,34 @@ function isProxyErrorEnvelope(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value) && "error" in value;
 }
 async function readErrorEnvelope(response) {
-  const status = response.status;
+  const status2 = response.status;
   let raw;
   try {
     raw = await response.json();
   } catch {
     return {
-      code: `http_${status}`,
+      code: `http_${status2}`,
       message: response.statusText || "request failed"
     };
   }
   if (isProxyErrorEnvelope(raw) && raw.error) {
     const current = typeof raw.current === "string" ? raw.current : void 0;
     return {
-      code: raw.error.code ?? `http_${status}`,
+      code: raw.error.code ?? `http_${status2}`,
       message: raw.error.message ?? response.statusText ?? "request failed",
       ...current === void 0 ? {} : { current }
     };
   }
   return {
-    code: `http_${status}`,
+    code: `http_${status2}`,
     message: response.statusText || "request failed"
   };
 }
-function throwProxyError(status, env) {
-  if (status === 409 && env.code === "alias_drift") {
+function throwProxyError(status2, env, requestId) {
+  if (status2 === 409 && env.code === "alias_drift") {
     throw new AliasDriftError(env.message, env.current ?? "");
   }
-  throw new ProxyError(status, env.code, env.message);
+  throw new ProxyError(status2, env.code, env.message, requestId);
 }
 function stripTrailingSlash(url) {
   return url.endsWith("/") ? url.slice(0, -1) : url;
@@ -515,6 +572,7 @@ function createProxyClient(cfg) {
   const base = stripTrailingSlash(cfg.baseUrl);
   const fetchImpl = cfg.fetch ?? globalThis.fetch.bind(globalThis);
   const timeoutMs = cfg.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
+  const debug = cfg.debug ?? false;
   function withTimeoutSignal(init) {
     if (timeoutMs <= 0) return init;
     const timeoutSignal = AbortSignal.timeout(timeoutMs);
@@ -526,31 +584,65 @@ function createProxyClient(cfg) {
       throw new ProxyError(
         0,
         "timeout",
-        `proxy timed out after ${timeoutMs}ms`
+        `proxy timed out after ${timeoutMs}ms (${base})`
       );
     }
     const message = err instanceof Error ? err.message : String(err);
-    throw new ProxyError(0, "network_error", `proxy unreachable: ${message}`);
+    throw new ProxyError(
+      0,
+      "network_error",
+      `proxy unreachable at ${base}: ${message}`
+    );
   }
   async function userBearer() {
     const tok = await cfg.getAuthToken();
     return `Bearer ${tok}`;
   }
-  async function call(url, init) {
+  async function call(url, init, validate) {
+    const startedAt = debug ? Date.now() : 0;
     let response;
     try {
       response = await fetchImpl(url, withTimeoutSignal(init));
     } catch (err) {
       translateFetchError(err);
     }
+    if (debug) {
+      process.stderr.write(
+        `[universe] ${init.method ?? "GET"} ${url} -> ${response.status} (${Date.now() - startedAt}ms)
+`
+      );
+    }
     if (!response.ok) {
+      const requestId = response.headers.get("x-request-id") ?? void 0;
       const env = await readErrorEnvelope(response);
-      throwProxyError(response.status, env);
+      throwProxyError(response.status, env, requestId);
     }
     if (response.status === 204) {
       return void 0;
     }
-    return await response.json();
+    let raw;
+    try {
+      raw = await response.json();
+    } catch {
+      throw new ProxyError(
+        0,
+        "malformed_response",
+        "proxy returned a non-JSON response body"
+      );
+    }
+    if (validate) {
+      try {
+        validate(raw);
+      } catch (err) {
+        const detail = err instanceof Error ? err.message : "invalid shape";
+        throw new ProxyError(
+          0,
+          "malformed_response",
+          `proxy returned an unexpected response shape: ${detail}`
+        );
+      }
+    }
+    return raw;
   }
   return {
     async whoami() {
@@ -711,6 +803,105 @@ function createProxyClient(cfg) {
           Accept: "application/json"
         }
       });
+    },
+    async createRepoRequest(req) {
+      const body = { name: req.name };
+      if (req.visibility !== void 0) body.visibility = req.visibility;
+      if (req.description !== void 0) body.description = req.description;
+      if (req.template !== void 0 && req.template !== "") {
+        body.template = req.template;
+      }
+      return call(
+        `${base}/api/repo`,
+        {
+          method: "POST",
+          headers: {
+            Authorization: await userBearer(),
+            Accept: "application/json",
+            "Content-Type": "application/json"
+          },
+          body: JSON.stringify(body)
+        },
+        (raw) => repoRowSchema.parse(raw)
+      );
+    },
+    async listRepoRequests(req) {
+      const params = new URLSearchParams();
+      if (req?.status) params.set("status", req.status);
+      if (req?.mine) params.set("mine", "1");
+      const qs = params.toString();
+      const url = `${base}/api/repos${qs ? `?${qs}` : ""}`;
+      return call(
+        url,
+        {
+          method: "GET",
+          headers: {
+            Authorization: await userBearer(),
+            Accept: "application/json"
+          }
+        },
+        (raw) => repoRowArraySchema.parse(raw)
+      );
+    },
+    async getRepoRequest(id) {
+      const url = `${base}/api/repo/${encodeURIComponent(id)}`;
+      return call(
+        url,
+        {
+          method: "GET",
+          headers: {
+            Authorization: await userBearer(),
+            Accept: "application/json"
+          }
+        },
+        (raw) => repoRowSchema.parse(raw)
+      );
+    },
+    async approveRepoRequest(req) {
+      const url = `${base}/api/repo/${encodeURIComponent(req.id)}/approve`;
+      return call(
+        url,
+        {
+          method: "POST",
+          headers: {
+            Authorization: await userBearer(),
+            Accept: "application/json"
+          }
+        },
+        (raw) => repoApproveResultSchema.parse(raw)
+      );
+    },
+    async rejectRepoRequest(req) {
+      const url = `${base}/api/repo/${encodeURIComponent(req.id)}/reject`;
+      const body = {};
+      if (req.reason !== void 0) body.reason = req.reason;
+      return call(
+        url,
+        {
+          method: "POST",
+          headers: {
+            Authorization: await userBearer(),
+            Accept: "application/json",
+            "Content-Type": "application/json"
+          },
+          body: JSON.stringify(body)
+        },
+        (raw) => repoRowSchema.parse(raw)
+      );
+    },
+    async listRepoTemplates() {
+      const res = await call(
+        `${base}/api/repo/templates`,
+        {
+          method: "GET",
+          headers: {
+            Authorization: await userBearer(),
+            Accept: "application/json"
+          }
+        },
+        (raw) => repoTemplatesResponseSchema.parse(raw)
+      );
+      return res.templates ?? [];
     }
   };
 }
@@ -851,11 +1042,17 @@ function buildEnvelope(command, success, data) {
     ...data
   };
 }
-function buildErrorEnvelope(command, code, message, issues) {
+function buildErrorEnvelope(command, code, message, issues, kind, requestId) {
   const error = {
     code,
     message
   };
+  if (kind !== void 0) {
+    error.kind = kind;
+  }
+  if (requestId !== void 0) {
+    error.requestId = requestId;
+  }
   if (issues !== void 0) {
     error.issues = issues;
   }
@@ -959,12 +1156,14 @@ function outputError(ctx, code, message, optsOrIssues) {
       ctx.command,
       code,
       redactedMessage,
-      redactedIssues
+      redactedIssues,
+      opts.kind,
+      opts.requestId
     );
     const payload = opts.extras ? { ...envelope, ...redactObject(opts.extras) } : envelope;
     process.stdout.write(JSON.stringify(payload) + "\n");
   } else {
-    (opts.logError ?? ((m) => log.error(m)))(redactedMessage);
+    (opts.logError ?? ((m) => log.error(m, { output: process.stderr })))(redactedMessage);
   }
 }
 
@@ -1885,6 +2084,7 @@ async function whoami(options, deps = {}) {
         buildEnvelope("whoami", true, {
           login: result.login,
           identitySource: identity.source,
+          proxyUrl: baseUrl,
           authorizedSitesCount: count
         })
       );
@@ -1894,6 +2094,7 @@ async function whoami(options, deps = {}) {
         [
           `Logged in as: ${result.login}`,
           `Identity source: ${identity.source}`,
+          `Proxy: ${baseUrl}`,
           sitesLine
         ].join("\n")
       );
@@ -2130,6 +2331,508 @@ async function update(options, deps = {}) {
   }
 }
 
+// src/commands/repo/approve.ts
+import { log as log13 } from "@clack/prompts";
+
+// src/commands/repo/_shared.ts
+import {
+  confirm as clackConfirm,
+  isCancel as clackIsCancel,
+  select as clackSelect,
+  text as clackText
+} from "@clack/prompts";
+var defaultRepoPrompts = {
+  text: clackText,
+  select: clackSelect,
+  confirm: clackConfirm,
+  isCancel: clackIsCancel
+};
+function emitJson9(envelope) {
+  process.stdout.write(JSON.stringify(envelope) + "\n");
+}
+async function setupClient2(deps) {
+  const env = deps.env ?? process.env;
+  const resolveId = deps.resolveIdentity ?? resolveIdentity;
+  const mkClient = deps.createProxyClient ?? createProxyClient;
+  const identity = await resolveId({ env });
+  if (!identity) {
+    throw new CredentialError(
+      "No GitHub identity available. Run `universe login`, set $GITHUB_TOKEN, or install the gh CLI."
+    );
+  }
+  const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL;
+  const client = mkClient({
+    baseUrl,
+    getAuthToken: () => identity.token,
+    timeoutMs: parseFetchTimeoutMs(env),
+    debug: Boolean(env["UNIVERSE_DEBUG"])
+  });
+  return { client, identitySource: identity.source };
+}
+function formatRepoTable(rows, emptyMsg = "No repo requests.") {
+  if (rows.length === 0) return emptyMsg;
+  const headers = [
+    "ID",
+    "REPO",
+    "VIS",
+    "STATUS",
+    "REQUESTED BY",
+    "REQUESTED AT"
+  ];
+  const cells = rows.map((r) => [
+    r.id,
+    r.name,
+    r.visibility,
+    r.status,
+    r.requestedBy,
+    r.createdAt
+  ]);
+  const widths = headers.map(
+    (h, i) => Math.max(h.length, ...cells.map((row) => row[i]?.length ?? 0))
+  );
+  const fmt = (row) => row.map((c, i) => c.padEnd(widths[i] ?? 0)).join("  ");
+  return [fmt(headers), ...cells.map(fmt)].join("\n");
+}
+
+// src/commands/repo/approve.ts
+async function approve(options, deps = {}) {
+  const command = "repo approve";
+  const success = deps.logSuccess ?? ((s) => log13.success(s));
+  const error = deps.logError ?? ((s) => log13.error(s));
+  const exit = deps.exit ?? exitWithCode;
+  const prompts = deps.prompts ?? defaultRepoPrompts;
+  const isTTY = deps.isTTY ?? Boolean(process.stdout.isTTY);
+  let creationFailure;
+  let identitySource;
+  try {
+    if (!options.id || options.id.trim().length === 0) {
+      throw new UsageError("request id is required (positional argument)");
+    }
+    const setup = await setupClient2(deps);
+    const client = setup.client;
+    identitySource = setup.identitySource;
+    if (!options.json && !options.yes) {
+      if (!isTTY) {
+        throw new UsageError(
+          "non-interactive session: pass --yes to approve without confirmation"
+        );
+      }
+      const cur = await client.getRepoRequest(options.id);
+      const ok = await prompts.confirm({
+        message: `Approve ${cur.visibility} repo "${cur.name}" requested by ${cur.requestedBy}? This creates the repository.`
+      });
+      if (prompts.isCancel(ok) || ok === false) {
+        throw new ConfirmError("repo approve cancelled");
+      }
+    }
+    const res = await client.approveRepoRequest({ id: options.id });
+    const row = res.request;
+    if (res.outcome === "approved_failed") {
+      if (!options.json) {
+        throw new StorageError(
+          `approved, but repository creation failed: ${row.error ?? "unknown"} (${row.owner}/${row.name}, requested by ${row.requestedBy})`
+        );
+      }
+      creationFailure = {
+        outcome: res.outcome,
+        id: row.id,
+        repo: `${row.owner}/${row.name}`,
+        status: row.status,
+        creationError: row.error ?? "unknown",
+        requestedBy: row.requestedBy,
+        identitySource
+      };
+    } else if (options.json) {
+      emitJson9(
+        buildEnvelope(command, true, {
+          id: row.id,
+          outcome: res.outcome,
+          repo: `${row.owner}/${row.name}`,
+          url: row.url,
+          visibility: row.visibility,
+          approver: row.approver,
+          identitySource
+        })
+      );
+    } else {
+      success(
+        [
+          `Approved ${row.name}`,
+          ``,
+          `  Repository:  ${row.url ?? `${row.owner}/${row.name}`}`,
+          `  Visibility:  ${row.visibility}`,
+          `  Approved by: ${row.approver ?? "you"}`
+        ].join("\n")
+      );
+    }
+  } catch (err) {
+    const { code, message, kind, requestId } = wrapProxyError(command, err);
+    outputError({ json: options.json, command }, code, message, {
+      logError: error,
+      kind,
+      requestId,
+      extras: identitySource ? { identitySource } : void 0
+    });
+    exit(code);
+    return;
+  }
+  if (creationFailure) {
+    outputError(
+      { json: true, command },
+      EXIT_STORAGE,
+      "approved, but repository creation failed",
+      { logError: error, extras: creationFailure }
+    );
+    exit(EXIT_STORAGE);
+  }
+}
+
+// src/commands/repo/create.ts
+import { log as log14 } from "@clack/prompts";
+function blankToUndefined(s) {
+  if (s === void 0 || s === null) return void 0;
+  const t = String(s).trim();
+  return t === "" ? void 0 : t;
+}
+async function promptTemplate(client, prompts) {
+  let templates = [];
+  try {
+    templates = await client.listRepoTemplates();
+  } catch {
+    templates = [];
+  }
+  if (templates.length === 0) {
+    const v2 = await prompts.text({
+      message: "Template (optional)",
+      placeholder: "name of an org template repo; blank for an empty repo"
+    });
+    if (prompts.isCancel(v2)) throw new ConfirmError("repo create cancelled");
+    return blankToUndefined(String(v2));
+  }
+  const v = await prompts.select({
+    message: "Template",
+    options: [
+      { value: "", label: "None (blank repo)" },
+      ...templates.map((t) => ({ value: t, label: t }))
+    ],
+    initialValue: ""
+  });
+  if (prompts.isCancel(v)) throw new ConfirmError("repo create cancelled");
+  return blankToUndefined(String(v));
+}
+async function create(options, deps = {}) {
+  const command = "repo create";
+  const success = deps.logSuccess ?? ((s) => log14.success(s));
+  const error = deps.logError ?? ((s) => log14.error(s));
+  const exit = deps.exit ?? exitWithCode;
+  const prompts = deps.prompts ?? defaultRepoPrompts;
+  const isTTY = deps.isTTY ?? Boolean(process.stdout.isTTY);
+  const canPrompt = !options.json && !options.yes && isTTY;
+  let identitySource = "";
+  try {
+    let client;
+    const ensureClient = async () => {
+      if (!client) {
+        const setup = await setupClient2(deps);
+        client = setup.client;
+        identitySource = setup.identitySource;
+      }
+      return client;
+    };
+    let name = blankToUndefined(options.name) ?? "";
+    let visibility = options.visibility;
+    let description = options.description;
+    let template = options.template;
+    if (canPrompt) {
+      if (!name) {
+        const v = await prompts.text({
+          message: "Repository name",
+          placeholder: "learn-python-rpg"
+        });
+        if (prompts.isCancel(v))
+          throw new ConfirmError("repo create cancelled");
+        name = String(v).trim();
+      }
+      if (visibility === void 0) {
+        const v = await prompts.select({
+          message: "Visibility",
+          options: [
+            { value: "private", label: "Private" },
+            { value: "public", label: "Public" }
+          ],
+          initialValue: "private"
+        });
+        if (prompts.isCancel(v))
+          throw new ConfirmError("repo create cancelled");
+        visibility = String(v);
+      }
+      if (description === void 0) {
+        const v = await prompts.text({
+          message: "Description (optional)",
+          placeholder: "What is this project about?"
+        });
+        if (prompts.isCancel(v))
+          throw new ConfirmError("repo create cancelled");
+        description = String(v);
+      }
+      if (template === void 0) {
+        template = await promptTemplate(await ensureClient(), prompts);
+      }
+    }
+    if (!name) {
+      throw new UsageError("repo name is required");
+    }
+    const candidate = { name };
+    if (visibility !== void 0 && visibility !== "") {
+      candidate.visibility = visibility;
+    }
+    const desc = blankToUndefined(description);
+    if (desc !== void 0) candidate.description = desc;
+    const tmpl = blankToUndefined(template);
+    if (tmpl !== void 0) candidate.template = tmpl;
+    const parsed = createRepoRequestSchema.safeParse(candidate);
+    if (!parsed.success) {
+      const issues = parsed.error.issues.map(
+        (i) => `${i.path.join(".") || "input"}: ${i.message}`
+      );
+      throw new UsageError(issues.join("; "));
+    }
+    const body = parsed.data;
+    if (!options.json && !options.yes) {
+      if (!isTTY) {
+        throw new UsageError(
+          "non-interactive session: pass --yes to submit without confirmation (or --json)"
+        );
+      }
+      const ok = await prompts.confirm({
+        message: `Submit request to create ${body.visibility} repo "${body.name}"${body.template ? ` from template ${body.template}` : ""}?`
+      });
+      if (prompts.isCancel(ok) || ok === false) {
+        throw new ConfirmError("repo create cancelled");
+      }
+    }
+    const activeClient = await ensureClient();
+    const row = await activeClient.createRepoRequest({
+      name: body.name,
+      visibility: body.visibility,
+      description: body.description,
+      template: body.template
+    });
+    if (options.json) {
+      emitJson9(
+        buildEnvelope(command, true, {
+          id: row.id,
+          name: row.name,
+          owner: row.owner,
+          visibility: row.visibility,
+          template: row.template,
+          status: row.status,
+          identitySource
+        })
+      );
+    } else {
+      success(
+        [
+          `Request submitted`,
+          ``,
+          `  Request id:  ${row.id}`,
+          `  Repository:  ${row.owner}/${row.name}`,
+          `  Visibility:  ${row.visibility}`,
+          ...row.template ? [`  Template:    ${row.template}`] : [],
+          `  Status:      ${row.status} \u2014 run \`universe repo ls\` to review`
+        ].join("\n")
+      );
+    }
+  } catch (err) {
+    const { code, message, kind, requestId } = wrapProxyError(command, err);
+    outputError({ json: options.json, command }, code, message, {
+      logError: error,
+      kind,
+      requestId,
+      extras: identitySource ? { identitySource } : void 0
+    });
+    exit(code);
+  }
+}
+
+// src/commands/repo/ls.ts
+import { log as log15 } from "@clack/prompts";
+var LS_STATUSES = [...repoStatusSchema.options, "all"];
+async function ls3(options, deps = {}) {
+  const command = "repo ls";
+  const message = deps.logMessage ?? ((s) => log15.message(s));
+  const error = deps.logError ?? ((s) => log15.error(s));
+  const exit = deps.exit ?? exitWithCode;
+  let identitySource;
+  try {
+    if (options.status !== void 0 && !LS_STATUSES.includes(options.status)) {
+      throw new UsageError(
+        `invalid --status "${options.status}": must be one of ${LS_STATUSES.join(", ")}`
+      );
+    }
+    const setup = await setupClient2(deps);
+    const client = setup.client;
+    identitySource = setup.identitySource;
+    const rows = await client.listRepoRequests({
+      status: options.status,
+      mine: options.mine ?? false
+    });
+    const status2 = options.status ?? "pending";
+    if (options.json) {
+      emitJson9(
+        buildEnvelope(command, true, {
+          count: rows.length,
+          status: status2,
+          mine: options.mine ?? false,
+          requests: rows,
+          identitySource
+        })
+      );
+    } else {
+      const empty = status2 === "all" ? "No repo requests." : `No ${status2} repo requests.`;
+      message(formatRepoTable(rows, empty));
+    }
+  } catch (err) {
+    const {
+      code,
+      message: msg,
+      kind,
+      requestId
+    } = wrapProxyError(command, err);
+    outputError({ json: options.json, command }, code, msg, {
+      logError: error,
+      kind,
+      requestId,
+      extras: identitySource ? { identitySource } : void 0
+    });
+    exit(code);
+  }
+}
+
+// src/commands/repo/reject.ts
+import { log as log16 } from "@clack/prompts";
+async function reject(options, deps = {}) {
+  const command = "repo reject";
+  const success = deps.logSuccess ?? ((s) => log16.success(s));
+  const error = deps.logError ?? ((s) => log16.error(s));
+  const exit = deps.exit ?? exitWithCode;
+  const prompts = deps.prompts ?? defaultRepoPrompts;
+  const isTTY = deps.isTTY ?? Boolean(process.stdout.isTTY);
+  let identitySource;
+  try {
+    if (!options.id || options.id.trim().length === 0) {
+      throw new UsageError("request id is required (positional argument)");
+    }
+    const setup = await setupClient2(deps);
+    const client = setup.client;
+    identitySource = setup.identitySource;
+    if (!options.json && !options.yes) {
+      if (!isTTY) {
+        throw new UsageError(
+          "non-interactive session: pass --yes to reject without confirmation"
+        );
+      }
+      const cur = await client.getRepoRequest(options.id);
+      const ok = await prompts.confirm({
+        message: `Reject the request for "${cur.name}" by ${cur.requestedBy}?`
+      });
+      if (prompts.isCancel(ok) || ok === false) {
+        throw new ConfirmError("repo reject cancelled");
+      }
+    }
+    const reason = options.reason === void 0 ? void 0 : String(options.reason).trim() || void 0;
+    const row = await client.rejectRepoRequest({
+      id: options.id,
+      reason
+    });
+    if (options.json) {
+      emitJson9(
+        buildEnvelope(command, true, {
+          id: row.id,
+          status: row.status,
+          repo: `${row.owner}/${row.name}`,
+          rejectReason: row.rejectReason,
+          identitySource
+        })
+      );
+    } else {
+      success(
+        [
+          `Rejected ${row.name}`,
+          ``,
+          `  Repository: ${row.owner}/${row.name}`,
+          ...row.rejectReason ? [`  Reason:     ${row.rejectReason}`] : []
+        ].join("\n")
+      );
+    }
+  } catch (err) {
+    const { code, message, kind, requestId } = wrapProxyError(command, err);
+    outputError({ json: options.json, command }, code, message, {
+      logError: error,
+      kind,
+      requestId,
+      extras: identitySource ? { identitySource } : void 0
+    });
+    exit(code);
+  }
+}
+
+// src/commands/repo/status.ts
+import { log as log17 } from "@clack/prompts";
+function humanRow(row) {
+  const lines = [
+    `Request ${row.id}`,
+    ``,
+    `  Repository:   ${row.owner}/${row.name}`,
+    `  Visibility:   ${row.visibility}`,
+    `  Status:       ${row.status}`,
+    `  Requested by: ${row.requestedBy}`
+  ];
+  if (row.template) lines.push(`  Template:     ${row.template}`);
+  if (row.url) lines.push(`  URL:          ${row.url}`);
+  if (row.approver) lines.push(`  Approver:     ${row.approver}`);
+  if (row.rejectReason) lines.push(`  Reason:       ${row.rejectReason}`);
+  if (row.error) lines.push(`  Error:        ${row.error}`);
+  lines.push(`  Created:      ${row.createdAt}`);
+  lines.push(`  Updated:      ${row.updatedAt}`);
+  return lines.join("\n");
+}
+async function status(options, deps = {}) {
+  const command = "repo status";
+  const message = deps.logMessage ?? ((s) => log17.message(s));
+  const error = deps.logError ?? ((s) => log17.error(s));
+  const exit = deps.exit ?? exitWithCode;
+  let identitySource;
+  try {
+    if (!options.id || options.id.trim().length === 0) {
+      throw new UsageError("request id is required (positional argument)");
+    }
+    const setup = await setupClient2(deps);
+    const client = setup.client;
+    identitySource = setup.identitySource;
+    const row = await client.getRepoRequest(options.id);
+    if (options.json) {
+      emitJson9(buildEnvelope(command, true, { request: row, identitySource }));
+    } else {
+      message(humanRow(row));
+    }
+  } catch (err) {
+    const {
+      code,
+      message: msg,
+      kind,
+      requestId
+    } = wrapProxyError(command, err);
+    outputError({ json: options.json, command }, code, msg, {
+      logError: error,
+      kind,
+      requestId,
+      extras: identitySource ? { identitySource } : void 0
+    });
+    exit(code);
+  }
+}
+
 // src/lib/update-notifier.ts
 import { readFileSync } from "fs";
 import { mkdir as mkdir2, readFile as readFile6, writeFile as writeFile2 } from "fs/promises";
@@ -2285,7 +2988,7 @@ function installExitNotice(current) {
 }
 
 // src/cli.ts
-var version = true ? "0.7.2" : "0.0.0";
+var version = true ? "0.8.0" : "0.0.0";
 function handleActionError(command, json, err) {
   const ctx = { json, command };
   const message = err instanceof Error ? err.message : "unknown error";
@@ -2302,12 +3005,14 @@ function findFirstPositional(args) {
 }
 function run(argv = process.argv) {
   installExitNotice(version);
-  void refreshIfStale();
+  void refreshIfStale().catch(() => {
+  });
   const args = argv.slice(2);
   const firstPosIdx = findFirstPositional(args);
   const namespace = firstPosIdx >= 0 ? args[firstPosIdx] : void 0;
   const isStatic = namespace === "static";
   const isSites = namespace === "sites";
+  const isRepo = namespace === "repo";
   if (isSites) {
     const sitesArgs = [
       ...args.slice(0, firstPosIdx),
@@ -2374,6 +3079,136 @@ function run(argv = process.argv) {
     sitesCli.parse(["node", "universe-sites", ...sitesArgs]);
     return;
   }
+  if (isRepo) {
+    const repoArgs = [
+      ...args.slice(0, firstPosIdx),
+      ...args.slice(firstPosIdx + 1)
+    ];
+    const repoCli = cac("universe repo");
+    repoCli.command(
+      "create [name]",
+      "Request a new repository under freeCodeCamp-Universe (staff only)"
+    ).option("--json", "Output as JSON").option("--visibility <vis>", "public or private (default: private)").option("--description <text>", "Repository description").option(
+      "--template <name>",
+      "Org template repo to generate from; omit for a blank repo"
+    ).option("--yes", "Skip confirmation prompts (required for non-TTY/CI)").example("universe repo create my-app --visibility private --yes").action(
+      async (name, flags) => {
+        try {
+          await create({
+            json: flags.json ?? false,
+            name,
+            visibility: flags.visibility,
+            description: flags.description,
+            template: flags.template,
+            yes: flags.yes ?? false
+          });
+        } catch (err) {
+          handleActionError("repo create", flags.json ?? false, err);
+        }
+      }
+    );
+    repoCli.command("ls", "List repo requests (default: pending)").option("--json", "Output as JSON").option(
+      "--status <status>",
+      "pending | approved | active | rejected | failed | all"
+    ).option("--mine", "Only requests you submitted").action(
+      async (flags) => {
+        try {
+          await ls3({
+            json: flags.json ?? false,
+            status: flags.status,
+            mine: flags.mine ?? false
+          });
+        } catch (err) {
+          handleActionError("repo ls", flags.json ?? false, err);
+        }
+      }
+    );
+    repoCli.command(
+      "approve <id>",
+      "Approve a pending request \u2014 creates the repo (admin only)"
+    ).option("--json", "Output as JSON").option("--yes", "Skip confirmation prompts (required for non-TTY/CI)").example("universe repo approve req_abc123 --yes --json").action(async (id, flags) => {
+      try {
+        await approve({
+          json: flags.json ?? false,
+          id,
+          yes: flags.yes ?? false
+        });
+      } catch (err) {
+        handleActionError("repo approve", flags.json ?? false, err);
+      }
+    });
+    repoCli.command("reject <id>", "Reject a pending request (admin only)").option("--json", "Output as JSON").option("--reason <text>", "Reason shown to the requester").option("--yes", "Skip confirmation prompts (required for non-TTY/CI)").example('universe repo reject req_abc123 --reason "out of scope" --yes').action(
+      async (id, flags) => {
+        try {
+          await reject({
+            json: flags.json ?? false,
+            id,
+            reason: flags.reason,
+            yes: flags.yes ?? false
+          });
+        } catch (err) {
+          handleActionError("repo reject", flags.json ?? false, err);
+        }
+      }
+    );
+    repoCli.command("status <id>", "Show a request's current state").option("--json", "Output as JSON").action(async (id, flags) => {
+      try {
+        await status({ json: flags.json ?? false, id });
+      } catch (err) {
+        handleActionError("repo status", flags.json ?? false, err);
+      }
+    });
+    repoCli.help();
+    repoCli.version(version);
+    const knownRepoSubs = /* @__PURE__ */ new Set([
+      "create",
+      "ls",
+      "approve",
+      "reject",
+      "status"
+    ]);
+    const repoValueFlags = /* @__PURE__ */ new Set([
+      "--visibility",
+      "--description",
+      "--template",
+      "--status",
+      "--reason"
+    ]);
+    let repoSub;
+    for (let i = 0; i < repoArgs.length; i += 1) {
+      const a = repoArgs[i];
+      if (a === void 0) continue;
+      if (repoValueFlags.has(a)) {
+        i += 1;
+        continue;
+      }
+      if (!a.startsWith("-")) {
+        repoSub = a;
+        break;
+      }
+    }
+    const repoJson = repoArgs.includes("--json");
+    const repoWantsHelp = repoArgs.includes("--help") || repoArgs.includes("-h") || repoArgs.includes("--version");
+    if (repoSub === void 0 ? !repoWantsHelp : !knownRepoSubs.has(repoSub)) {
+      if (repoSub === void 0 && !repoJson) {
+        repoCli.outputHelp();
+      } else {
+        outputError(
+          { json: repoJson, command: "repo" },
+          EXIT_USAGE,
+          repoSub === void 0 ? "missing repo subcommand \u2014 run `universe repo --help`" : `unknown repo subcommand "${repoSub}" \u2014 run \`universe repo --help\``
+        );
+      }
+      exitWithCode(EXIT_USAGE);
+      return;
+    }
+    try {
+      repoCli.parse(["node", "universe-repo", ...repoArgs]);
+    } catch (err) {
+      handleActionError("repo", repoJson, err);
+    }
+    return;
+  }
   if (isStatic) {
     const staticArgs = [
       ...args.slice(0, firstPosIdx),
@@ -2457,11 +3292,30 @@ function run(argv = process.argv) {
     });
     cli.command("static <subcommand>", "Static site deployment commands");
     cli.command("sites <subcommand>", "Static site registry commands");
+    cli.command(
+      "repo <subcommand>",
+      "Repository creation + approval queue commands"
+    );
     cli.help();
     cli.version(version);
     cli.parse(argv);
   }
 }
 
+// src/lib/fatal.ts
+function formatFatal(err) {
+  const message = err instanceof Error ? err.message : String(err);
+  return `universe: ${redact(message)}`;
+}
+function defaultOnFatal(err) {
+  process.stderr.write(formatFatal(err) + "\n");
+  process.exit(EXIT_USAGE);
+}
+function installFatalHandlers(onFatal = defaultOnFatal) {
+  process.on("unhandledRejection", onFatal);
+  process.on("uncaughtException", onFatal);
+}
+
 // src/index.ts
+installFatalHandlers();
 run();