@freecodecamp/universe-cli 0.9.0 → 0.10.0

package/dist/index.js

@@ -1,3457 +0,0 @@
-#!/usr/bin/env node
-
-// src/cli.ts
-import { cac } from "cac";
-
-// src/commands/deploy.ts
-import { readFile as readFile2 } from "fs/promises";
-import { resolve as resolve2 } from "path";
-import { log as log2, spinner } from "@clack/prompts";
-
-// src/output/exit-codes.ts
-var EXIT_USAGE = 10;
-var EXIT_CONFIG = 11;
-var EXIT_CREDENTIALS = 12;
-var EXIT_STORAGE = 13;
-var EXIT_GIT = 15;
-var EXIT_CONFIRM = 18;
-var EXIT_PARTIAL = 19;
-function exitWithCode(code) {
-  process.exit(code);
-}
-
-// src/errors.ts
-var CliError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = new.target.name;
-  }
-};
-var ConfigError = class extends CliError {
-  exitCode = EXIT_CONFIG;
-};
-var CredentialError = class extends CliError {
-  exitCode = EXIT_CREDENTIALS;
-};
-var StorageError = class extends CliError {
-  exitCode = EXIT_STORAGE;
-};
-var GitError = class extends CliError {
-  exitCode = EXIT_GIT;
-};
-var ConfirmError = class extends CliError {
-  exitCode = EXIT_CONFIRM;
-};
-var PartialUploadError = class extends CliError {
-  exitCode = EXIT_PARTIAL;
-};
-var UsageError = class extends CliError {
-  exitCode = EXIT_USAGE;
-};
-
-// src/deploy/git.ts
-import { execSync } from "child_process";
-function getGitState() {
-  try {
-    const hash = execSync("git rev-parse HEAD", { encoding: "utf-8" }).trim();
-    const status2 = execSync("git status --porcelain", { encoding: "utf-8" });
-    return { hash, dirty: status2.length > 0 };
-  } catch {
-    return { hash: null, dirty: false, error: "not a git repository" };
-  }
-}
-
-// src/deploy/walk.ts
-import { readdirSync, realpathSync, statSync } from "fs";
-import { join, relative, sep } from "path";
-function walkFiles(base) {
-  const baseReal = realpathSync(base);
-  const entries = readdirSync(base, { recursive: true, withFileTypes: true });
-  const files = [];
-  for (const entry of entries) {
-    const full = join(entry.parentPath, entry.name);
-    const relPath = relative(base, full);
-    let targetIsFile;
-    try {
-      targetIsFile = statSync(full).isFile();
-    } catch {
-      throw new StorageError(
-        `"${relPath}" could not be stat'd (dangling symlink?)`
-      );
-    }
-    if (!targetIsFile) continue;
-    let resolved;
-    try {
-      resolved = realpathSync(full);
-    } catch {
-      throw new StorageError(
-        `"${relPath}" could not be resolved (dangling symlink?)`
-      );
-    }
-    const rel = relative(baseReal, resolved);
-    if (rel === ".." || rel.startsWith(`..${sep}`)) {
-      throw new StorageError(
-        `"${relPath}" resolves outside the output directory (symlink escape). Resolved to: ${resolved}`
-      );
-    }
-    files.push({ relPath, absPath: full });
-  }
-  return files;
-}
-
-// src/lib/build.ts
-import { spawn } from "child_process";
-import { stat } from "fs/promises";
-import { isAbsolute, resolve } from "path";
-var defaultExec = async (req) => {
-  return new Promise((resolveExit, reject2) => {
-    const child = spawn(req.command, {
-      cwd: req.cwd,
-      shell: true,
-      stdio: "inherit"
-    });
-    child.on("error", (err) => reject2(err));
-    child.on("exit", (code) => resolveExit(code ?? 1));
-  });
-};
-async function ensureDirectory(absPath) {
-  let st;
-  try {
-    st = await stat(absPath);
-  } catch {
-    throw new ConfigError(`output directory missing after build: ${absPath}`);
-  }
-  if (!st.isDirectory()) {
-    throw new ConfigError(
-      `output path is not a directory after build: ${absPath}`
-    );
-  }
-}
-async function runBuild(options, deps = {}) {
-  const exec = deps.exec ?? defaultExec;
-  const absCwd = isAbsolute(options.cwd) ? options.cwd : resolve(options.cwd);
-  const absOutput = isAbsolute(options.outputDir) ? options.outputDir : resolve(absCwd, options.outputDir);
-  if (!options.command) {
-    await ensureDirectory(absOutput);
-    return { skipped: true, outputDir: absOutput };
-  }
-  const code = await exec({ command: options.command, cwd: absCwd });
-  if (code !== 0) {
-    throw new ConfigError(
-      `build command failed with exit code ${code}: ${options.command}`
-    );
-  }
-  await ensureDirectory(absOutput);
-  return { skipped: false, outputDir: absOutput };
-}
-
-// src/lib/constants.ts
-var DEFAULT_GH_CLIENT_ID = "Iv23liIuGmZRyPd5wUeN";
-var DEFAULT_PROXY_URL = "https://uploads.freecode.camp";
-
-// src/lib/identity.ts
-import { execFile } from "child_process";
-import { promisify } from "util";
-
-// src/lib/token-store.ts
-import { chmod, mkdir, readFile, rm, writeFile } from "fs/promises";
-import { homedir } from "os";
-import { dirname, join as join2 } from "path";
-var APP_DIR = "universe-cli";
-var TOKEN_FILE = "token";
-function configBase() {
-  const xdg = process.env["XDG_CONFIG_HOME"];
-  if (xdg && xdg.length > 0) return xdg;
-  return join2(homedir(), ".config");
-}
-function tokenPath() {
-  return join2(configBase(), APP_DIR, TOKEN_FILE);
-}
-async function saveToken(token) {
-  const trimmed = token.trim();
-  if (trimmed.length === 0) {
-    throw new Error("refusing to save empty token");
-  }
-  const path = tokenPath();
-  const dir = dirname(path);
-  await mkdir(dir, { recursive: true, mode: 448 });
-  await chmod(dir, 448);
-  await writeFile(path, trimmed, { mode: 384 });
-  await chmod(path, 384);
-}
-async function loadToken() {
-  let raw;
-  try {
-    raw = await readFile(tokenPath(), "utf-8");
-  } catch (err) {
-    if (isFileNotFound(err)) return null;
-    throw err;
-  }
-  const trimmed = raw.trim();
-  return trimmed.length === 0 ? null : trimmed;
-}
-async function deleteToken() {
-  await rm(tokenPath(), { force: true });
-}
-function isFileNotFound(err) {
-  return typeof err === "object" && err !== null && "code" in err && err.code === "ENOENT";
-}
-
-// src/lib/identity.ts
-var execFileP = promisify(execFile);
-function isNonEmpty(s) {
-  return typeof s === "string" && s.trim().length > 0;
-}
-async function defaultExecGhAuthToken() {
-  try {
-    const { stdout } = await execFileP("gh", ["auth", "token"], {
-      timeout: 5e3
-    });
-    return stdout;
-  } catch {
-    return null;
-  }
-}
-async function resolveIdentity(opts = {}) {
-  const env = opts.env ?? process.env;
-  const execGh = opts.execGhAuthToken ?? defaultExecGhAuthToken;
-  const loadStored = opts.loadStoredToken ?? loadToken;
-  const ghEnv = env["GITHUB_TOKEN"];
-  if (isNonEmpty(ghEnv)) {
-    return { token: ghEnv.trim(), source: "env_GITHUB_TOKEN" };
-  }
-  const ghTokenEnv = env["GH_TOKEN"];
-  if (isNonEmpty(ghTokenEnv)) {
-    return { token: ghTokenEnv.trim(), source: "env_GH_TOKEN" };
-  }
-  const stored = await loadStored();
-  if (isNonEmpty(stored)) {
-    return { token: stored.trim(), source: "device_flow" };
-  }
-  const ghCli = await execGh();
-  if (isNonEmpty(ghCli)) {
-    return { token: ghCli.trim(), source: "gh_cli" };
-  }
-  return null;
-}
-
-// src/lib/ignore.ts
-var SPECIAL = /[.+^${}()|[\]\\]/g;
-function globToRegexBody(pattern) {
-  let out = "";
-  let i = 0;
-  while (i < pattern.length) {
-    const ch = pattern[i] ?? "";
-    if (ch === "*") {
-      const next = pattern[i + 1];
-      if (next === "*") {
-        out += ".*";
-        i += 2;
-        continue;
-      }
-      out += "[^/]*";
-      i += 1;
-      continue;
-    }
-    if (ch === "?") {
-      out += "[^/]";
-      i += 1;
-      continue;
-    }
-    out += ch.replace(SPECIAL, "\\$&");
-    i += 1;
-  }
-  return out;
-}
-function compilePattern(pattern) {
-  const anchored = pattern.includes("/");
-  const body = globToRegexBody(pattern);
-  if (anchored) {
-    const re2 = new RegExp(`^${body}$`);
-    return { test: (rel) => re2.test(rel) };
-  }
-  const re = new RegExp(`^${body}$`);
-  return {
-    test: (rel) => {
-      const idx = rel.lastIndexOf("/");
-      const base = idx === -1 ? rel : rel.slice(idx + 1);
-      return re.test(base);
-    }
-  };
-}
-function normalize(rel) {
-  let out = rel.replace(/\\/g, "/");
-  if (out.startsWith("./")) out = out.slice(2);
-  return out;
-}
-function createIgnoreFilter(patterns) {
-  const compiled = patterns.filter((p) => p.length > 0).map(compilePattern);
-  return (relPath) => {
-    const norm = normalize(relPath);
-    for (const c of compiled) {
-      if (c.test(norm)) return true;
-    }
-    return false;
-  };
-}
-
-// src/lib/platform-yaml.ts
-import { parse as parseYaml } from "yaml";
-
-// src/lib/platform-yaml.schema.ts
-import { z } from "zod";
-var SITE_NAME_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-var siteName = z.string().min(1, "site is required").max(63, "site must be at most 63 characters").regex(
-  SITE_NAME_PATTERN,
-  "site must be lowercase letters, digits, and single hyphens; no leading/trailing/consecutive hyphens"
-);
-var buildSchema = z.object({
-  command: z.string().min(1).optional(),
-  output: z.string().min(1).default("dist")
-}).strict();
-var DEFAULT_DEPLOY_IGNORE = Object.freeze([
-  "*.map",
-  "node_modules/**",
-  ".git/**",
-  ".env*"
-]);
-var deploySchema = z.object({
-  preview: z.boolean().default(true),
-  ignore: z.array(z.string()).default([...DEFAULT_DEPLOY_IGNORE])
-}).strict().prefault({});
-var platformYamlSchemaV2 = z.object({
-  site: siteName,
-  build: buildSchema.prefault({}),
-  deploy: deploySchema
-}).strict();
-
-// src/lib/platform-yaml.ts
-var V1_MARKERS = ["r2", "stack", "domain", "static", "name"];
-var MIGRATION_HINT = "platform.yaml v1 detected. v0.4 removes credential paths (r2, bucket, region) and per-site team declarations. See docs/platform-yaml.md for the v0.3 \u2192 v0.4 migration.";
-function isPlainObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value) && Object.getPrototypeOf(value) === Object.prototype;
-}
-function detectV1(parsed) {
-  for (const marker of V1_MARKERS) {
-    if (Object.prototype.hasOwnProperty.call(parsed, marker)) {
-      return marker;
-    }
-  }
-  return void 0;
-}
-function formatZodIssues(issues) {
-  return issues.map((issue) => {
-    const path = issue.path.length > 0 ? issue.path.join(".") : "(root)";
-    return `  - ${path}: ${issue.message}`;
-  }).join("\n");
-}
-function parsePlatformYaml(text) {
-  let parsed;
-  try {
-    parsed = parseYaml(text);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    return { ok: false, error: `platform.yaml is not valid YAML: ${message}` };
-  }
-  if (parsed === null || parsed === void 0) {
-    return {
-      ok: false,
-      error: "platform.yaml is empty. Required field: `site`. See docs/platform-yaml.md."
-    };
-  }
-  if (!isPlainObject(parsed)) {
-    return {
-      ok: false,
-      error: "platform.yaml must be a YAML mapping at the root. See docs/platform-yaml.md."
-    };
-  }
-  const v1Marker = detectV1(parsed);
-  if (v1Marker) {
-    return {
-      ok: false,
-      error: `${MIGRATION_HINT} (v1 marker detected: \`${v1Marker}\`)`
-    };
-  }
-  const result = platformYamlSchemaV2.safeParse(parsed);
-  if (!result.success) {
-    return {
-      ok: false,
-      error: `platform.yaml is invalid:
-${formatZodIssues(result.error.issues)}
-See docs/platform-yaml.md.`
-    };
-  }
-  return { ok: true, value: result.data };
-}
-
-// src/lib/similarity.ts
-function editDistance(a, b) {
-  const m = a.length;
-  const n = b.length;
-  if (m === 0) return n;
-  if (n === 0) return m;
-  const d = Array.from(
-    { length: m + 1 },
-    () => new Array(n + 1).fill(0)
-  );
-  for (let i = 0; i <= m; i++) d[i][0] = i;
-  for (let j = 0; j <= n; j++) d[0][j] = j;
-  for (let i = 1; i <= m; i++) {
-    for (let j = 1; j <= n; j++) {
-      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
-      d[i][j] = Math.min(
-        d[i - 1][j] + 1,
-        d[i][j - 1] + 1,
-        d[i - 1][j - 1] + cost
-      );
-      if (i > 1 && j > 1 && a[i - 1] === b[j - 2] && a[i - 2] === b[j - 1]) {
-        d[i][j] = Math.min(d[i][j], d[i - 2][j - 2] + 1);
-      }
-    }
-  }
-  return d[m][n];
-}
-function suggest(target, candidates, threshold = 2) {
-  if (candidates.length === 0) return null;
-  const lc = target.toLowerCase();
-  const sub = candidates.find((c) => {
-    const clc = c.toLowerCase();
-    return clc.includes(lc) || lc.includes(clc);
-  });
-  if (sub) return sub;
-  let best = null;
-  let bestD = threshold + 1;
-  for (const c of candidates) {
-    const d = editDistance(lc, c.toLowerCase());
-    if (d < bestD) {
-      bestD = d;
-      best = c;
-    }
-  }
-  return bestD <= threshold ? best : null;
-}
-
-// src/commands/repo/schema.ts
-import { z as z2 } from "zod";
-var REPO_NAME_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]{0,99}$/;
-var repoName = z2.string().regex(
-  REPO_NAME_RE,
-  "must start with a letter or digit, then letters, digits, '.', '_' or '-' (max 100 chars)"
-);
-var visibilitySchema = z2.enum(["public", "private"]);
-var repoStatusSchema = z2.enum([
-  "pending",
-  "approved",
-  "active",
-  "rejected",
-  "failed"
-]);
-var createRepoRequestSchema = z2.object({
-  name: repoName,
-  visibility: visibilitySchema.default("private"),
-  description: z2.string().max(350).optional(),
-  template: repoName.optional()
-}).strict();
-var repoRowSchema = z2.object({
-  id: z2.string(),
-  name: z2.string(),
-  owner: z2.string(),
-  visibility: visibilitySchema,
-  description: z2.string().optional(),
-  template: z2.string().optional(),
-  status: repoStatusSchema,
-  url: z2.string().optional(),
-  error: z2.string().optional(),
-  requestedBy: z2.string(),
-  approver: z2.string().optional(),
-  rejectReason: z2.string().optional(),
-  createdAt: z2.string(),
-  updatedAt: z2.string()
-});
-var repoRowArraySchema = z2.array(repoRowSchema);
-var repoApproveResultSchema = z2.object({
-  outcome: z2.enum(["ok", "approved_failed"]),
-  request: repoRowSchema
-});
-var repoTemplatesResponseSchema = z2.object({
-  templates: z2.array(z2.string())
-});
-
-// src/lib/proxy-client.ts
-var DEFAULT_FETCH_TIMEOUT_MS = 3e4;
-function parseFetchTimeoutMs(env) {
-  const raw = env["UNIVERSE_FETCH_TIMEOUT_MS"];
-  if (raw === void 0 || raw === "") return void 0;
-  const n = Number(raw);
-  if (!Number.isFinite(n) || n < 0) return void 0;
-  return Math.floor(n);
-}
-var ProxyError = class extends CliError {
-  exitCode;
-  status;
-  code;
-  requestId;
-  constructor(status2, code, message, requestId) {
-    super(message);
-    this.status = status2;
-    this.code = code;
-    this.exitCode = mapExitCode(status2);
-    this.requestId = requestId;
-  }
-};
-var AliasDriftError = class extends ProxyError {
-  current;
-  constructor(message, current) {
-    super(409, "alias_drift", message);
-    this.current = current;
-  }
-};
-function mapExitCode(status2) {
-  if (status2 === 401 || status2 === 403) return EXIT_CREDENTIALS;
-  if (status2 === 422 || status2 === 0 || status2 >= 500) return EXIT_STORAGE;
-  return EXIT_USAGE;
-}
-function wrapProxyError(command, err) {
-  if (err instanceof ProxyError) {
-    let message = `${command} failed (${err.code}): ${err.message}`;
-    if (err.code === "user_unauthorized") {
-      message += "\n  hint: the active GitHub token may lack the read:org scope or SSO authorization for the org. $GITHUB_TOKEN / $GH_TOKEN override `gh auth token` \u2014 run `universe whoami` to check the active identity source, then unset them or re-authorize the token (Configure SSO).";
-    }
-    return {
-      code: err.exitCode,
-      message,
-      kind: err.code,
-      requestId: err.requestId
-    };
-  }
-  if (err instanceof CliError) {
-    return { code: err.exitCode, message: err.message };
-  }
-  if (err instanceof Error) {
-    return { code: EXIT_USAGE, message: err.message };
-  }
-  return { code: EXIT_USAGE, message: String(err) };
-}
-function isProxyErrorEnvelope(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value) && "error" in value;
-}
-async function readErrorEnvelope(response) {
-  const status2 = response.status;
-  let raw;
-  try {
-    raw = await response.json();
-  } catch {
-    return {
-      code: `http_${status2}`,
-      message: response.statusText || "request failed"
-    };
-  }
-  if (isProxyErrorEnvelope(raw) && raw.error) {
-    const current = typeof raw.current === "string" ? raw.current : void 0;
-    return {
-      code: raw.error.code ?? `http_${status2}`,
-      message: raw.error.message ?? response.statusText ?? "request failed",
-      ...current === void 0 ? {} : { current }
-    };
-  }
-  return {
-    code: `http_${status2}`,
-    message: response.statusText || "request failed"
-  };
-}
-function throwProxyError(status2, env, requestId) {
-  if (status2 === 409 && env.code === "alias_drift") {
-    throw new AliasDriftError(env.message, env.current ?? "");
-  }
-  throw new ProxyError(status2, env.code, env.message, requestId);
-}
-function stripTrailingSlash(url) {
-  return url.endsWith("/") ? url.slice(0, -1) : url;
-}
-function createProxyClient(cfg) {
-  const base = stripTrailingSlash(cfg.baseUrl);
-  const fetchImpl = cfg.fetch ?? globalThis.fetch.bind(globalThis);
-  const timeoutMs = cfg.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
-  const debug = cfg.debug ?? false;
-  function withTimeoutSignal(init) {
-    if (timeoutMs <= 0) return init;
-    const timeoutSignal = AbortSignal.timeout(timeoutMs);
-    const merged = init.signal ? AbortSignal.any([init.signal, timeoutSignal]) : timeoutSignal;
-    return { ...init, signal: merged };
-  }
-  function translateFetchError(err) {
-    if (err instanceof DOMException && (err.name === "TimeoutError" || err.name === "AbortError")) {
-      throw new ProxyError(
-        0,
-        "timeout",
-        `proxy timed out after ${timeoutMs}ms (${base})`
-      );
-    }
-    const message = err instanceof Error ? err.message : String(err);
-    throw new ProxyError(
-      0,
-      "network_error",
-      `proxy unreachable at ${base}: ${message}`
-    );
-  }
-  async function userBearer() {
-    const tok = await cfg.getAuthToken();
-    return `Bearer ${tok}`;
-  }
-  async function call(url, init, validate) {
-    const startedAt = debug ? Date.now() : 0;
-    let response;
-    try {
-      response = await fetchImpl(url, withTimeoutSignal(init));
-    } catch (err) {
-      translateFetchError(err);
-    }
-    if (debug) {
-      process.stderr.write(
-        `[universe] ${init.method ?? "GET"} ${url} -> ${response.status} (${Date.now() - startedAt}ms)
-`
-      );
-    }
-    if (!response.ok) {
-      const requestId = response.headers.get("x-request-id") ?? void 0;
-      const env = await readErrorEnvelope(response);
-      throwProxyError(response.status, env, requestId);
-    }
-    if (response.status === 204) {
-      return void 0;
-    }
-    let raw;
-    try {
-      raw = await response.json();
-    } catch {
-      throw new ProxyError(
-        0,
-        "malformed_response",
-        "proxy returned a non-JSON response body"
-      );
-    }
-    if (validate) {
-      try {
-        validate(raw);
-      } catch (err) {
-        const detail = err instanceof Error ? err.message : "invalid shape";
-        throw new ProxyError(
-          0,
-          "malformed_response",
-          `proxy returned an unexpected response shape: ${detail}`
-        );
-      }
-    }
-    return raw;
-  }
-  return {
-    async whoami() {
-      return call(`${base}/api/whoami`, {
-        method: "GET",
-        headers: {
-          Authorization: await userBearer(),
-          Accept: "application/json"
-        }
-      });
-    },
-    async deployInit(req) {
-      return call(`${base}/api/deploy/init`, {
-        method: "POST",
-        headers: {
-          Authorization: await userBearer(),
-          Accept: "application/json",
-          "Content-Type": "application/json"
-        },
-        body: JSON.stringify(req)
-      });
-    },
-    async deployUpload(req) {
-      const url = `${base}/api/deploy/${encodeURIComponent(
-        req.deployId
-      )}/upload?path=${encodeURIComponent(req.path)}`;
-      return call(url, {
-        method: "PUT",
-        headers: {
-          Authorization: `Bearer ${req.jwt}`,
-          Accept: "application/json",
-          "Content-Type": req.contentType ?? "application/octet-stream"
-        },
-        body: req.body
-      });
-    },
-    async deployFinalize(req) {
-      const url = `${base}/api/deploy/${encodeURIComponent(req.deployId)}/finalize`;
-      return call(url, {
-        method: "POST",
-        headers: {
-          Authorization: `Bearer ${req.jwt}`,
-          Accept: "application/json",
-          "Content-Type": "application/json"
-        },
-        body: JSON.stringify({ mode: req.mode, files: req.files })
-      });
-    },
-    async siteDeploys(req) {
-      const url = `${base}/api/site/${encodeURIComponent(req.site)}/deploys`;
-      return call(url, {
-        method: "GET",
-        headers: {
-          Authorization: await userBearer(),
-          Accept: "application/json"
-        }
-      });
-    },
-    async getAlias(req) {
-      const url = `${base}/api/site/${encodeURIComponent(req.site)}/alias/${encodeURIComponent(req.mode)}`;
-      let response;
-      try {
-        response = await fetchImpl(
-          url,
-          withTimeoutSignal({
-            method: "GET",
-            headers: {
-              Authorization: await userBearer(),
-              Accept: "application/json"
-            }
-          })
-        );
-      } catch (err) {
-        translateFetchError(err);
-      }
-      if (response.status === 404) return null;
-      if (!response.ok) {
-        const env = await readErrorEnvelope(response);
-        throwProxyError(response.status, env);
-      }
-      return await response.json();
-    },
-    async sitePromote(req) {
-      const url = `${base}/api/site/${encodeURIComponent(req.site)}/promote`;
-      const headers = {
-        Authorization: await userBearer(),
-        Accept: "application/json"
-      };
-      const body = {};
-      if (req.deployId !== void 0) body.deployId = req.deployId;
-      if (req.expectedCurrent !== void 0)
-        body.expectedCurrent = req.expectedCurrent;
-      const hasBody = Object.keys(body).length > 0;
-      if (hasBody) headers["Content-Type"] = "application/json";
-      return call(url, {
-        method: "POST",
-        headers,
-        ...hasBody ? { body: JSON.stringify(body) } : {}
-      });
-    },
-    async siteRollback(req) {
-      const url = `${base}/api/site/${encodeURIComponent(req.site)}/rollback`;
-      const body = { to: req.to };
-      if (req.expectedCurrent !== void 0)
-        body.expectedCurrent = req.expectedCurrent;
-      return call(url, {
-        method: "POST",
-        headers: {
-          Authorization: await userBearer(),
-          Accept: "application/json",
-          "Content-Type": "application/json"
-        },
-        body: JSON.stringify(body)
-      });
-    },
-    async registerSite(req) {
-      const body = { slug: req.slug };
-      if (req.teams && req.teams.length > 0) {
-        body.teams = req.teams;
-      }
-      return call(`${base}/api/site/register`, {
-        method: "POST",
-        headers: {
-          Authorization: await userBearer(),
-          Accept: "application/json",
-          "Content-Type": "application/json"
-        },
-        body: JSON.stringify(body)
-      });
-    },
-    async listSites() {
-      return call(`${base}/api/sites`, {
-        method: "GET",
-        headers: {
-          Authorization: await userBearer(),
-          Accept: "application/json"
-        }
-      });
-    },
-    async updateSite(req) {
-      const url = `${base}/api/site/${encodeURIComponent(req.slug)}`;
-      return call(url, {
-        method: "PATCH",
-        headers: {
-          Authorization: await userBearer(),
-          Accept: "application/json",
-          "Content-Type": "application/json"
-        },
-        body: JSON.stringify({ teams: req.teams })
-      });
-    },
-    async deleteSite(req) {
-      const url = `${base}/api/site/${encodeURIComponent(req.slug)}`;
-      return call(url, {
-        method: "DELETE",
-        headers: {
-          Authorization: await userBearer(),
-          Accept: "application/json"
-        }
-      });
-    },
-    async createRepoRequest(req) {
-      const body = { name: req.name };
-      if (req.visibility !== void 0) body.visibility = req.visibility;
-      if (req.description !== void 0) body.description = req.description;
-      if (req.template !== void 0 && req.template !== "") {
-        body.template = req.template;
-      }
-      return call(
-        `${base}/api/repo`,
-        {
-          method: "POST",
-          headers: {
-            Authorization: await userBearer(),
-            Accept: "application/json",
-            "Content-Type": "application/json"
-          },
-          body: JSON.stringify(body)
-        },
-        (raw) => repoRowSchema.parse(raw)
-      );
-    },
-    async listRepoRequests(req) {
-      const params = new URLSearchParams();
-      if (req?.status) params.set("status", req.status);
-      if (req?.mine) params.set("mine", "1");
-      const qs = params.toString();
-      const url = `${base}/api/repos${qs ? `?${qs}` : ""}`;
-      return call(
-        url,
-        {
-          method: "GET",
-          headers: {
-            Authorization: await userBearer(),
-            Accept: "application/json"
-          }
-        },
-        (raw) => repoRowArraySchema.parse(raw)
-      );
-    },
-    async getRepoRequest(id) {
-      const url = `${base}/api/repo/${encodeURIComponent(id)}`;
-      return call(
-        url,
-        {
-          method: "GET",
-          headers: {
-            Authorization: await userBearer(),
-            Accept: "application/json"
-          }
-        },
-        (raw) => repoRowSchema.parse(raw)
-      );
-    },
-    async approveRepoRequest(req) {
-      const url = `${base}/api/repo/${encodeURIComponent(req.id)}/approve`;
-      return call(
-        url,
-        {
-          method: "POST",
-          headers: {
-            Authorization: await userBearer(),
-            Accept: "application/json"
-          }
-        },
-        (raw) => repoApproveResultSchema.parse(raw)
-      );
-    },
-    async rejectRepoRequest(req) {
-      const url = `${base}/api/repo/${encodeURIComponent(req.id)}/reject`;
-      const body = {};
-      if (req.reason !== void 0) body.reason = req.reason;
-      return call(
-        url,
-        {
-          method: "POST",
-          headers: {
-            Authorization: await userBearer(),
-            Accept: "application/json",
-            "Content-Type": "application/json"
-          },
-          body: JSON.stringify(body)
-        },
-        (raw) => repoRowSchema.parse(raw)
-      );
-    },
-    async deleteRepoRequest(req) {
-      const url = `${base}/api/repo/${encodeURIComponent(req.id)}`;
-      return call(url, {
-        method: "DELETE",
-        headers: {
-          Authorization: await userBearer(),
-          Accept: "application/json"
-        }
-      });
-    },
-    async listRepoTemplates() {
-      const res = await call(
-        `${base}/api/repo/templates`,
-        {
-          method: "GET",
-          headers: {
-            Authorization: await userBearer(),
-            Accept: "application/json"
-          }
-        },
-        (raw) => repoTemplatesResponseSchema.parse(raw)
-      );
-      return res.templates ?? [];
-    }
-  };
-}
-
-// src/lib/upload.ts
-import { readFile as defaultReadFile } from "fs/promises";
-var DEFAULT_CONCURRENCY = 6;
-var MIME_BY_EXT = Object.freeze({
-  // text
-  html: "text/html",
-  htm: "text/html",
-  css: "text/css",
-  js: "text/javascript",
-  mjs: "text/javascript",
-  cjs: "text/javascript",
-  json: "application/json",
-  txt: "text/plain",
-  md: "text/markdown",
-  xml: "application/xml",
-  csv: "text/csv",
-  // images
-  svg: "image/svg+xml",
-  png: "image/png",
-  jpg: "image/jpeg",
-  jpeg: "image/jpeg",
-  gif: "image/gif",
-  webp: "image/webp",
-  avif: "image/avif",
-  ico: "image/x-icon",
-  bmp: "image/bmp",
-  // fonts
-  woff: "font/woff",
-  woff2: "font/woff2",
-  ttf: "font/ttf",
-  otf: "font/otf",
-  eot: "application/vnd.ms-fontobject",
-  // a/v
-  mp4: "video/mp4",
-  webm: "video/webm",
-  ogg: "audio/ogg",
-  mp3: "audio/mpeg",
-  wav: "audio/wav",
-  // other
-  pdf: "application/pdf",
-  wasm: "application/wasm"
-});
-function getContentType(filename) {
-  const dot = filename.lastIndexOf(".");
-  if (dot < 0 || dot === filename.length - 1) {
-    return "application/octet-stream";
-  }
-  const ext = filename.slice(dot + 1).toLowerCase();
-  return MIME_BY_EXT[ext] ?? "application/octet-stream";
-}
-function createLimit(max) {
-  let active = 0;
-  const queue = [];
-  const acquire = () => {
-    if (active < max) {
-      active += 1;
-      return Promise.resolve();
-    }
-    return new Promise((resolve6) => {
-      queue.push(() => {
-        active += 1;
-        resolve6();
-      });
-    });
-  };
-  const release = () => {
-    active -= 1;
-    const next = queue.shift();
-    if (next) next();
-  };
-  return async (fn) => {
-    await acquire();
-    try {
-      return await fn();
-    } finally {
-      release();
-    }
-  };
-}
-async function uploadFiles(options, deps = {}) {
-  const read = deps.readFile ?? defaultReadFile;
-  const concurrency = options.concurrency ?? DEFAULT_CONCURRENCY;
-  const limit = createLimit(concurrency);
-  const total = options.files.length;
-  const uploaded = [];
-  const errors = [];
-  let totalSize = 0;
-  let done = 0;
-  const tasks = options.files.map(
-    (file) => limit(async () => {
-      try {
-        const body = await read(file.absPath);
-        const bodyAsBodyInit = body;
-        await options.client.deployUpload({
-          deployId: options.deployId,
-          jwt: options.jwt,
-          path: file.relPath,
-          body: bodyAsBodyInit,
-          contentType: getContentType(file.relPath)
-        });
-        uploaded.push(file.relPath);
-        totalSize += body.byteLength;
-      } catch (err) {
-        const message = err instanceof Error ? err.message : "unknown upload error";
-        errors.push(`${file.relPath}: ${message}`);
-      } finally {
-        done += 1;
-        if (options.onProgress) {
-          options.onProgress({
-            uploaded: done,
-            total,
-            current: file.relPath
-          });
-        }
-      }
-    })
-  );
-  await Promise.all(tasks);
-  return {
-    fileCount: uploaded.length,
-    totalSize,
-    uploaded,
-    errors
-  };
-}
-
-// src/output/envelope.ts
-function buildEnvelope(command, success, data) {
-  return {
-    schemaVersion: "1",
-    command,
-    success,
-    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-    ...data
-  };
-}
-function buildErrorEnvelope(command, code, message, issues, kind, requestId) {
-  const error = {
-    code,
-    message
-  };
-  if (kind !== void 0) {
-    error.kind = kind;
-  }
-  if (requestId !== void 0) {
-    error.requestId = requestId;
-  }
-  if (issues !== void 0) {
-    error.issues = issues;
-  }
-  return {
-    schemaVersion: "1",
-    command,
-    success: false,
-    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-    error
-  };
-}
-
-// src/output/format.ts
-import { log } from "@clack/prompts";
-
-// src/output/redact.ts
-var AWS_KEY_PREFIX_PATTERN = /(?:AKIA|ASIA|AROA|AIDA|ACCA|ANPA|ABIA|AGPA)[A-Z0-9]{12,}/g;
-var URL_CREDS_PATTERN = /https?:\/\/[^@\s]+@/g;
-var CREDENTIAL_CONTEXT_PATTERN = /(?:access_key_id|secret_access_key|accessKeyId|secretAccessKey|secret|password|token|key|credential|auth)\s*[=:]\s*([A-Za-z0-9/+=]{21,})/gi;
-var HEX_CREDENTIAL_CONTEXT_PATTERN = /(?:secret|password|token|key|credential|auth|access_key_id|secret_access_key)\s*[=:]\s*([a-f0-9]{32,})/gi;
-var JSON_CREDENTIAL_PATTERN = /"(?:secret|password|token|key|credential|auth|access_key_id|secret_access_key|accessKeyId|secretAccessKey)"\s*:\s*"[^"]+"/gi;
-var BEARER_PATTERN = /\bBearer\s+[A-Za-z0-9._~+/=-]+/gi;
-var CREDENTIAL_KEY_PATTERN = /(?:secret|password|token|key|credential|auth)/i;
-var EXACT_CREDENTIAL_KEYS = /* @__PURE__ */ new Set([
-  "accesskeyid",
-  "secretaccesskey",
-  "access_key_id",
-  "secret_access_key"
-]);
-var STANDALONE_LONG_SECRET = /^[A-Za-z0-9/+=]{21,}$/;
-function maskAwsKey(match) {
-  return match.slice(0, 4) + "****" + match.slice(-4);
-}
-function maskUrlCreds(match) {
-  const atIndex = match.lastIndexOf("@");
-  const protocolEnd = match.indexOf("://") + 3;
-  return match.slice(0, protocolEnd) + "****:****@" + match.slice(atIndex + 1);
-}
-function redact(value) {
-  let result = value;
-  result = result.replace(URL_CREDS_PATTERN, maskUrlCreds);
-  result = result.replace(AWS_KEY_PREFIX_PATTERN, maskAwsKey);
-  result = result.replace(BEARER_PATTERN, "Bearer ****");
-  result = result.replace(JSON_CREDENTIAL_PATTERN, (match) => {
-    const colonIndex = match.indexOf(":");
-    return match.slice(0, colonIndex + 1) + '"****"';
-  });
-  result = result.replace(
-    CREDENTIAL_CONTEXT_PATTERN,
-    (_match, _secret, _offset, _full) => {
-      const eqIndex = _match.indexOf("=");
-      const colonIndex = _match.indexOf(":");
-      const sepIndex = eqIndex >= 0 && colonIndex >= 0 ? Math.min(eqIndex, colonIndex) : eqIndex >= 0 ? eqIndex : colonIndex;
-      const prefix = _match.slice(0, sepIndex + 1);
-      return prefix + "****";
-    }
-  );
-  result = result.replace(HEX_CREDENTIAL_CONTEXT_PATTERN, (_match, _secret) => {
-    const eqIndex = _match.indexOf("=");
-    const colonIndex = _match.indexOf(":");
-    const sepIndex = eqIndex >= 0 && colonIndex >= 0 ? Math.min(eqIndex, colonIndex) : eqIndex >= 0 ? eqIndex : colonIndex;
-    const prefix = _match.slice(0, sepIndex + 1);
-    return prefix + "****";
-  });
-  return result;
-}
-function redactValue(value, keyName) {
-  if (typeof value === "string") {
-    if (keyName && EXACT_CREDENTIAL_KEYS.has(keyName.toLowerCase())) {
-      return "****";
-    }
-    const redacted = redact(value);
-    if (redacted === value && keyName && CREDENTIAL_KEY_PATTERN.test(keyName) && STANDALONE_LONG_SECRET.test(value)) {
-      return "****";
-    }
-    return redacted;
-  }
-  if (Array.isArray(value)) {
-    return value.map((v) => redactValue(v, keyName));
-  }
-  if (value !== null && typeof value === "object") {
-    return redactObject(value);
-  }
-  return value;
-}
-function redactObject(obj) {
-  const result = {};
-  for (const [key, value] of Object.entries(obj)) {
-    result[key] = redactValue(value, key);
-  }
-  return result;
-}
-
-// src/output/format.ts
-function outputError(ctx, code, message, optsOrIssues) {
-  const opts = Array.isArray(optsOrIssues) ? { issues: optsOrIssues } : optsOrIssues ?? {};
-  const redactedMessage = redact(message);
-  const redactedIssues = opts.issues?.map(redact);
-  if (ctx.json) {
-    const envelope = buildErrorEnvelope(
-      ctx.command,
-      code,
-      redactedMessage,
-      redactedIssues,
-      opts.kind,
-      opts.requestId
-    );
-    const payload = opts.extras ? { ...envelope, ...redactObject(opts.extras) } : envelope;
-    process.stdout.write(JSON.stringify(payload) + "\n");
-  } else {
-    (opts.logError ?? ((m) => log.error(m, { output: process.stderr })))(redactedMessage);
-  }
-}
-
-// src/commands/deploy.ts
-var defaultReadPlatformYaml = async (cwd) => {
-  return readFile2(resolve2(cwd, "platform.yaml"), "utf-8");
-};
-function emitJson(envelope) {
-  process.stdout.write(JSON.stringify(envelope) + "\n");
-}
-async function readAndParseConfig(cwd, read) {
-  let raw;
-  try {
-    raw = await read(cwd);
-  } catch (err) {
-    if (err instanceof Error && err.code === "ENOENT") {
-      throw new ConfigError(
-        `platform.yaml not found in ${cwd}. See docs/platform-yaml.md.`
-      );
-    }
-    throw err;
-  }
-  const r = parsePlatformYaml(raw);
-  if (!r.ok) throw new ConfigError(r.error);
-  return r.value;
-}
-function syntheticSha() {
-  return `nogit-${Date.now().toString(36)}`;
-}
-function rethrowProxy(prefix, err) {
-  if (err instanceof ProxyError) {
-    throw new ProxyError(
-      err.status,
-      err.code,
-      `${prefix} (${err.code}): ${err.message}`
-    );
-  }
-  if (err instanceof Error) throw new StorageError(`${prefix}: ${err.message}`);
-  throw new StorageError(`${prefix}: ${String(err)}`);
-}
-var PREFLIGHT_INLINE_LIST_CAP = 10;
-function formatUnauthorizedSiteError(a) {
-  const lines = [
-    `Site '${a.attempted}' is not registered for your GitHub identity.`,
-    ``,
-    `  You are:  ${a.login}`,
-    ``
-  ];
-  if (a.authorized.length === 0) {
-    lines.push(
-      `  Your identity is authorized for no sites yet.`,
-      ``,
-      `  Likely causes:`,
-      `    1. The '${a.attempted}' slug is not registered.`,
-      `       Admin (staff): universe sites register ${a.attempted} --team <team>`,
-      `    2. You are not in any team listed on any registered site.`,
-      `       Admin (staff): universe sites update <slug> --team +<your-team>`
-    );
-    return lines.join("\n");
-  }
-  const hint = suggest(a.attempted, a.authorized);
-  if (hint) {
-    lines.push(`  Did you mean: ${hint}?`, ``);
-  }
-  lines.push(
-    `  Likely causes (most common first):`,
-    `    1. Typo in platform.yaml \`site:\` \u2014 check the spelling above.`,
-    `    2. The '${a.attempted}' slug is not registered yet.`,
-    `       Admin (staff): universe sites register ${a.attempted} --team <team>`,
-    `    3. You are not in any team authorized for '${a.attempted}'.`,
-    `       Admin (staff): universe sites update ${a.attempted} --team +<your-team>`,
-    ``
-  );
-  if (a.authorized.length <= PREFLIGHT_INLINE_LIST_CAP) {
-    lines.push(
-      `  Your authorized sites (${a.authorized.length}):`,
-      ...[...a.authorized].sort().map((s) => `    - ${s}`)
-    );
-  } else {
-    lines.push(
-      `  You have ${a.authorized.length} authorized sites \u2014 too many to inline.`,
-      `  Run \`universe sites ls --mine\` to inspect the full list.`
-    );
-  }
-  return lines.join("\n");
-}
-async function deploy(options, deps = {}) {
-  const cwd = deps.cwd ?? process.cwd();
-  const env = deps.env ?? process.env;
-  const readYaml = deps.readPlatformYaml ?? defaultReadPlatformYaml;
-  const resolveId = deps.resolveIdentity ?? resolveIdentity;
-  const mkClient = deps.createProxyClient ?? createProxyClient;
-  const gitState = deps.getGitState ?? getGitState;
-  const build = deps.runBuild ?? runBuild;
-  const walk = deps.walkFiles ?? walkFiles;
-  const upload = deps.uploadFiles ?? uploadFiles;
-  const mkSpinner = deps.createSpinner ?? (() => spinner());
-  const success = deps.logSuccess ?? ((s) => log2.success(s));
-  const info = deps.logInfo ?? ((s) => log2.info(s));
-  const warn = deps.logWarn ?? ((s) => log2.warn(s));
-  const error = deps.logError ?? ((s) => log2.error(s));
-  const exit = deps.exit ?? exitWithCode;
-  try {
-    const identity = await resolveId({ env });
-    if (!identity) {
-      throw new CredentialError(
-        "No GitHub identity available. Run `universe login`, set $GITHUB_TOKEN, or install the gh CLI."
-      );
-    }
-    const config = await readAndParseConfig(cwd, readYaml);
-    const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL;
-    const client = mkClient({
-      baseUrl,
-      getAuthToken: () => identity.token,
-      timeoutMs: parseFetchTimeoutMs(env)
-    });
-    let me;
-    try {
-      me = await client.whoami();
-    } catch (err) {
-      rethrowProxy("whoami preflight failed", err);
-    }
-    if (!me.authorizedSites.includes(config.site)) {
-      throw new CredentialError(
-        formatUnauthorizedSiteError({
-          attempted: config.site,
-          login: me.login,
-          authorized: me.authorizedSites
-        })
-      );
-    }
-    const git = gitState();
-    if (git.dirty && !options.json) {
-      warn(
-        "git working tree is dirty \u2014 uncommitted changes will not be reflected."
-      );
-    }
-    const sha = git.hash ?? syntheticSha();
-    const outputDir = options.dir ?? config.build.output;
-    const buildResult = await build({
-      command: config.build.command,
-      cwd,
-      outputDir
-    });
-    if (buildResult.skipped && !options.json) {
-      info("build.command not set \u2014 using pre-built output.");
-    }
-    const resolvedOutputDir = buildResult.outputDir;
-    const walked = walk(resolvedOutputDir);
-    const ignore = createIgnoreFilter(config.deploy.ignore);
-    const filtered = walked.filter((f) => !ignore(f.relPath));
-    if (filtered.length === 0) {
-      throw new GitError(`No files to deploy under ${resolvedOutputDir}.`);
-    }
-    const fileList = filtered.map((f) => f.relPath);
-    let initResult;
-    try {
-      initResult = await client.deployInit({
-        site: config.site,
-        sha,
-        files: fileList
-      });
-    } catch (err) {
-      rethrowProxy("deploy init failed", err);
-    }
-    const spin = options.json ? null : mkSpinner();
-    spin?.start(`Uploading 0/${filtered.length} files`);
-    const uploadResult = await upload({
-      client,
-      deployId: initResult.deployId,
-      jwt: initResult.jwt,
-      files: filtered,
-      onProgress: spin ? (p) => spin.message(`Uploading ${p.uploaded}/${p.total} \u2014 ${p.current}`) : void 0
-    });
-    if (uploadResult.errors.length > 0) {
-      spin?.error(`Upload failed: ${uploadResult.errors.length} file(s)`);
-      const message = `Upload partially failed: ${uploadResult.errors.length} file(s) failed:
-  - ${uploadResult.errors.join("\n  - ")}`;
-      throw new PartialUploadError(message);
-    }
-    spin?.stop(`Uploaded ${uploadResult.fileCount} files`);
-    const mode = options.promote ? "production" : "preview";
-    let finalizeResult;
-    try {
-      finalizeResult = await client.deployFinalize({
-        deployId: initResult.deployId,
-        jwt: initResult.jwt,
-        mode,
-        files: fileList
-      });
-    } catch (err) {
-      rethrowProxy("deploy finalize failed", err);
-    }
-    if (options.promote && !options.json) {
-      try {
-        const preview = await client.getAlias({
-          site: config.site,
-          mode: "preview"
-        });
-        if (preview && preview.deployId !== finalizeResult.deployId) {
-          warn(
-            `Preview alias still points to ${preview.deployId}; it will not auto-update. Run \`universe static deploy\` (without --promote) to refresh preview.`
-          );
-        }
-      } catch (err) {
-        if (err instanceof ProxyError && (err.status === 401 || err.status === 403)) {
-          warn(
-            `Preview alias probe got ${err.status} (${err.code}) \u2014 token may need rotation: ${err.message}`
-          );
-        }
-      }
-    }
-    if (options.json) {
-      emitJson(
-        buildEnvelope("deploy", true, {
-          deployId: finalizeResult.deployId,
-          url: finalizeResult.url,
-          mode: finalizeResult.mode,
-          site: config.site,
-          sha,
-          fileCount: uploadResult.fileCount,
-          totalSize: uploadResult.totalSize,
-          identitySource: identity.source
-        })
-      );
-    } else {
-      const sizeKB = (uploadResult.totalSize / 1024).toFixed(1);
-      const nextLine = mode === "preview" ? `Next: universe static promote --from ${finalizeResult.deployId}` : "Promoted to production.\nPreview alias unchanged.";
-      success(
-        [
-          `Deployed ${finalizeResult.deployId}`,
-          ``,
-          `  Site:     ${config.site}`,
-          `  Files:    ${uploadResult.fileCount}`,
-          `  Size:     ${sizeKB} KB`,
-          `  Mode:     ${mode}`,
-          `  URL:      ${finalizeResult.url}`,
-          ``,
-          nextLine
-        ].join("\n")
-      );
-    }
-  } catch (err) {
-    let code;
-    let message;
-    if (err instanceof ProxyError) {
-      code = err.exitCode;
-      message = err.message;
-    } else if (err instanceof CliError) {
-      code = err.exitCode;
-      message = err.message;
-    } else if (err instanceof Error) {
-      code = EXIT_USAGE;
-      message = err.message;
-    } else {
-      code = EXIT_USAGE;
-      message = String(err);
-    }
-    outputError({ json: options.json, command: "deploy" }, code, message, {
-      logError: error
-    });
-    exit(code);
-  }
-}
-
-// src/commands/login.ts
-import { log as log3 } from "@clack/prompts";
-
-// src/lib/device-flow.ts
-var DEVICE_CODE_URL = "https://github.com/login/device/code";
-var ACCESS_TOKEN_URL = "https://github.com/login/oauth/access_token";
-var DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
-function isAccessTokenSuccess(body) {
-  return "access_token" in body && typeof body.access_token === "string";
-}
-var defaultSleep = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms));
-async function runDeviceFlow(opts) {
-  const fetchImpl = opts.fetch ?? globalThis.fetch.bind(globalThis);
-  const sleep = opts.sleep ?? defaultSleep;
-  const startResp = await fetchImpl(DEVICE_CODE_URL, {
-    method: "POST",
-    headers: {
-      Accept: "application/json",
-      "Content-Type": "application/json"
-    },
-    body: JSON.stringify({
-      client_id: opts.clientId,
-      ...opts.scope ? { scope: opts.scope } : {}
-    })
-  });
-  if (!startResp.ok) {
-    throw new Error(`device code request failed: HTTP ${startResp.status}`);
-  }
-  const start = await startResp.json();
-  await opts.onPrompt({
-    userCode: start.user_code,
-    verificationUri: start.verification_uri,
-    expiresIn: start.expires_in
-  });
-  let intervalSec = start.interval > 0 ? start.interval : 5;
-  while (true) {
-    await sleep(intervalSec * 1e3);
-    const pollResp = await fetchImpl(ACCESS_TOKEN_URL, {
-      method: "POST",
-      headers: {
-        Accept: "application/json",
-        "Content-Type": "application/json"
-      },
-      body: JSON.stringify({
-        client_id: opts.clientId,
-        device_code: start.device_code,
-        grant_type: DEVICE_CODE_GRANT
-      })
-    });
-    if (!pollResp.ok) {
-      throw new Error(`device flow poll failed: HTTP ${pollResp.status}`);
-    }
-    const body = await pollResp.json();
-    if (isAccessTokenSuccess(body)) {
-      return body.access_token;
-    }
-    switch (body.error) {
-      case "authorization_pending":
-        continue;
-      case "slow_down":
-        intervalSec += 5;
-        continue;
-      case "expired_token":
-        throw new Error(
-          "device flow expired before authorization. Run `universe login` again."
-        );
-      case "access_denied":
-        throw new Error("device flow access denied by user.");
-      default:
-        throw new Error(
-          body.error_description ? `device flow error: ${body.error}: ${body.error_description}` : `device flow error: ${body.error}`
-        );
-    }
-  }
-}
-
-// src/commands/login.ts
-var DEFAULT_SCOPE = "read:org user:email";
-var DEFAULT_PROXY_URL2 = "https://uploads.freecode.camp";
-var NO_SITES_WARNING = [
-  "Logged in, but the proxy reports 0 authorized sites for your account.",
-  "This usually means the Universe CLI GitHub App is not installed on the org",
-  "that owns the registry-authz team (production: `freeCodeCamp-Universe`), or",
-  "your account is not on a team granted access to any site.",
-  "",
-  "Next steps:",
-  "  1. Run `universe whoami` to confirm the identity that resolved.",
-  "  2. Ask an org owner to install the Universe CLI GitHub App on the org.",
-  "  3. Confirm your team membership at",
-  "     https://github.com/orgs/freeCodeCamp-Universe/teams."
-].join("\n");
-function emitJson2(envelope) {
-  process.stdout.write(JSON.stringify(envelope) + "\n");
-}
-async function login(options, deps = {}) {
-  const env = deps.env ?? process.env;
-  const runFlow = deps.runDeviceFlow ?? runDeviceFlow;
-  const save = deps.saveToken ?? saveToken;
-  const load = deps.loadToken ?? loadToken;
-  const success = deps.logSuccess ?? ((s) => log3.success(s));
-  const info = deps.logInfo ?? ((s) => log3.info(s));
-  const error = deps.logError ?? ((s) => log3.error(s));
-  const exit = deps.exit ?? exitWithCode;
-  const envClientId = env["UNIVERSE_GH_CLIENT_ID"];
-  const clientId = envClientId && envClientId.trim().length > 0 ? envClientId : DEFAULT_GH_CLIENT_ID;
-  if (!options.force) {
-    const existing = await load();
-    if (existing) {
-      const msg = "Already logged in. Run `universe logout` first or pass --force to replace the stored token.";
-      if (options.json) {
-        emitJson2({
-          schemaVersion: "1",
-          command: "login",
-          success: false,
-          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-          error: { code: EXIT_CONFIRM, message: msg }
-        });
-      } else {
-        error(msg);
-      }
-      exit(EXIT_CONFIRM);
-      return;
-    }
-  }
-  let token;
-  try {
-    token = await runFlow({
-      clientId,
-      scope: DEFAULT_SCOPE,
-      onPrompt: ({ userCode, verificationUri, expiresIn }) => {
-        if (options.json) {
-          emitJson2(
-            buildEnvelope("login", true, {
-              userCode,
-              verificationUri,
-              expiresIn,
-              stored: false
-            })
-          );
-        } else {
-          info(
-            [
-              `Open ${verificationUri} in your browser`,
-              `and enter code: ${userCode}`,
-              `(code expires in ${Math.round(expiresIn / 60)} min)`
-            ].join("\n")
-          );
-        }
-      }
-    });
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    outputError(
-      { json: options.json, command: "login" },
-      EXIT_CREDENTIALS,
-      message,
-      { logError: error }
-    );
-    exit(EXIT_CREDENTIALS);
-    return;
-  }
-  await save(token);
-  const selfCheck = await postLoginSelfCheck(token, env, deps);
-  if (options.json) {
-    emitJson2(
-      buildEnvelope("login", true, {
-        stored: true,
-        ...selfCheck.checked ? {
-          authorizedSitesCount: selfCheck.authorizedSitesCount,
-          ...selfCheck.warning ? { warning: selfCheck.warning } : {}
-        } : {}
-      })
-    );
-  } else {
-    success("Logged in. Token stored at ~/.config/universe-cli/token.");
-    if (selfCheck.checked && selfCheck.warning) {
-      const warn = deps.logWarn ?? ((s) => log3.warn(s));
-      warn(selfCheck.warning);
-    }
-  }
-}
-async function postLoginSelfCheck(token, env, deps) {
-  const mkClient = deps.createProxyClient ?? createProxyClient;
-  try {
-    const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL2;
-    const client = mkClient({
-      baseUrl,
-      getAuthToken: () => token,
-      timeoutMs: parseFetchTimeoutMs(env)
-    });
-    const result = await client.whoami();
-    const count = result.authorizedSites.length;
-    if (count === 0) {
-      return {
-        checked: true,
-        authorizedSitesCount: 0,
-        warning: NO_SITES_WARNING
-      };
-    }
-    return { checked: true, authorizedSitesCount: count };
-  } catch {
-    return { checked: false, authorizedSitesCount: 0 };
-  }
-}
-
-// src/commands/logout.ts
-import { log as log4 } from "@clack/prompts";
-function emitJson3(envelope) {
-  process.stdout.write(JSON.stringify(envelope) + "\n");
-}
-async function logout(options, deps = {}) {
-  const load = deps.loadToken ?? loadToken;
-  const del = deps.deleteToken ?? deleteToken;
-  const success = deps.logSuccess ?? ((s) => log4.success(s));
-  const info = deps.logInfo ?? ((s) => log4.info(s));
-  const existing = await load();
-  await del();
-  if (options.json) {
-    emitJson3(buildEnvelope("logout", true, { removed: existing !== null }));
-    return;
-  }
-  if (existing) {
-    success("Logged out. Stored token removed.");
-  } else {
-    info("No token was stored. Nothing to remove.");
-  }
-}
-
-// src/commands/ls.ts
-import { readFile as readFile3 } from "fs/promises";
-import { resolve as resolve3 } from "path";
-import { log as log5 } from "@clack/prompts";
-var defaultReadPlatformYaml2 = async (cwd) => {
-  return readFile3(resolve3(cwd, "platform.yaml"), "utf-8");
-};
-function emitJson4(envelope) {
-  process.stdout.write(JSON.stringify(envelope) + "\n");
-}
-var DEPLOY_ID_RE = /^(\d{8})-(\d{6})-(\S+)$/;
-function parseDeployId(deployId) {
-  const m = DEPLOY_ID_RE.exec(deployId);
-  if (!m) return { deployId, timestamp: null, sha: null };
-  const [, ymd, hms, sha] = m;
-  if (!ymd || !hms || !sha) return { deployId, timestamp: null, sha: null };
-  const iso = `${ymd.slice(0, 4)}-${ymd.slice(4, 6)}-${ymd.slice(6, 8)}T${hms.slice(0, 2)}:${hms.slice(2, 4)}:${hms.slice(4, 6)}Z`;
-  return { deployId, timestamp: iso, sha };
-}
-async function readSiteFromYaml(cwd, read) {
-  let raw;
-  try {
-    raw = await read(cwd);
-  } catch (err) {
-    if (err instanceof Error && err.code === "ENOENT") {
-      return null;
-    }
-    throw err;
-  }
-  const r = parsePlatformYaml(raw);
-  if (!r.ok) throw new ConfigError(r.error);
-  const config = r.value;
-  return config.site;
-}
-function formatTable(deploys) {
-  const header = ["DEPLOY ID", "TIMESTAMP", "SHA"];
-  const rows = deploys.map((d) => [
-    d.deployId,
-    d.timestamp ? d.timestamp.replace("T", " ").replace("Z", "") : "\u2014",
-    d.sha ?? "\u2014"
-  ]);
-  const widths = header.map(
-    (h, i) => Math.max(h.length, ...rows.map((r) => (r[i] ?? "").length))
-  );
-  const fmt = (cells) => cells.map((c, i) => c.padEnd(widths[i] ?? 0)).join("  ");
-  return [fmt(header), ...rows.map(fmt)].join("\n");
-}
-async function ls(options, deps = {}) {
-  const cwd = deps.cwd ?? process.cwd();
-  const env = deps.env ?? process.env;
-  const readYaml = deps.readPlatformYaml ?? defaultReadPlatformYaml2;
-  const resolveId = deps.resolveIdentity ?? resolveIdentity;
-  const mkClient = deps.createProxyClient ?? createProxyClient;
-  const success = deps.logSuccess ?? ((s) => log5.success(s));
-  const info = deps.logInfo ?? ((s) => log5.info(s));
-  const error = deps.logError ?? ((s) => log5.error(s));
-  const exit = deps.exit ?? exitWithCode;
-  try {
-    const identity = await resolveId({ env });
-    if (!identity) {
-      throw new CredentialError(
-        "No GitHub identity available. Run `universe login`, set $GITHUB_TOKEN, or install the gh CLI."
-      );
-    }
-    let site = options.site?.trim() || null;
-    if (!site) {
-      site = await readSiteFromYaml(cwd, readYaml);
-    }
-    if (!site) {
-      throw new ConfigError(
-        "No site to list. Run from a directory with `platform.yaml`, or pass `--site <name>`."
-      );
-    }
-    const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL;
-    const client = mkClient({
-      baseUrl,
-      getAuthToken: () => identity.token,
-      timeoutMs: parseFetchTimeoutMs(env)
-    });
-    const raw = await client.siteDeploys({ site });
-    const sorted = [...raw].sort(
-      (a, b) => b.deployId.localeCompare(a.deployId)
-    );
-    const deploys = sorted.map((d) => parseDeployId(d.deployId));
-    if (options.json) {
-      emitJson4(
-        buildEnvelope("ls", true, {
-          site,
-          deploys,
-          identitySource: identity.source
-        })
-      );
-      return;
-    }
-    if (deploys.length === 0) {
-      info(`(no deploys for ${site})`);
-      return;
-    }
-    success(formatTable(deploys));
-  } catch (err) {
-    const { code, message } = wrapProxyError("ls", err);
-    outputError({ json: options.json, command: "ls" }, code, message, {
-      logError: error
-    });
-    exit(code);
-  }
-}
-
-// src/commands/promote.ts
-import { readFile as readFile4 } from "fs/promises";
-import { resolve as resolve4 } from "path";
-import { confirm, isCancel, log as log6 } from "@clack/prompts";
-var defaultPromptConfirm = async (msg) => {
-  const r = await confirm({ message: msg, initialValue: false });
-  if (isCancel(r)) return false;
-  return r === true;
-};
-var defaultReadPlatformYaml3 = async (cwd) => {
-  return readFile4(resolve4(cwd, "platform.yaml"), "utf-8");
-};
-function emitJson5(envelope) {
-  process.stdout.write(JSON.stringify(envelope) + "\n");
-}
-async function readAndParseConfig2(cwd, read) {
-  let raw;
-  try {
-    raw = await read(cwd);
-  } catch (err) {
-    if (err instanceof Error && err.code === "ENOENT") {
-      throw new ConfigError(
-        `platform.yaml not found in ${cwd}. See docs/platform-yaml.md.`
-      );
-    }
-    throw err;
-  }
-  const r = parsePlatformYaml(raw);
-  if (!r.ok) throw new ConfigError(r.error);
-  return r.value;
-}
-async function promote(options, deps = {}) {
-  const cwd = deps.cwd ?? process.cwd();
-  const env = deps.env ?? process.env;
-  const readYaml = deps.readPlatformYaml ?? defaultReadPlatformYaml3;
-  const resolveId = deps.resolveIdentity ?? resolveIdentity;
-  const mkClient = deps.createProxyClient ?? createProxyClient;
-  const success = deps.logSuccess ?? ((s) => log6.success(s));
-  const error = deps.logError ?? ((s) => log6.error(s));
-  const exit = deps.exit ?? exitWithCode;
-  const promptConfirm = deps.promptConfirm ?? defaultPromptConfirm;
-  try {
-    const identity = await resolveId({ env });
-    if (!identity) {
-      throw new CredentialError(
-        "No GitHub identity available. Run `universe login`, set $GITHUB_TOKEN, or install the gh CLI."
-      );
-    }
-    const config = await readAndParseConfig2(cwd, readYaml);
-    const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL;
-    const client = mkClient({
-      baseUrl,
-      getAuthToken: () => identity.token,
-      timeoutMs: parseFetchTimeoutMs(env)
-    });
-    let result;
-    if (options.from) {
-      const prod = await client.getAlias({
-        site: config.site,
-        mode: "production"
-      });
-      const initialExpected = prod?.deployId ?? "";
-      try {
-        result = await client.siteRollback({
-          site: config.site,
-          to: options.from,
-          expectedCurrent: initialExpected
-        });
-      } catch (err) {
-        if (!(err instanceof AliasDriftError)) throw err;
-        if (options.json) throw err;
-        error(
-          `drift: production moved to ${err.current}, expected ${initialExpected}`
-        );
-        const ok = await promptConfirm(
-          `Retry promote --from with expectedCurrent='${err.current}'?`
-        );
-        if (!ok) throw err;
-        result = await client.siteRollback({
-          site: config.site,
-          to: options.from,
-          expectedCurrent: err.current
-        });
-      }
-    } else {
-      const preview = await client.getAlias({
-        site: config.site,
-        mode: "preview"
-      });
-      if (preview === null) {
-        throw new ConfigError(
-          "no preview alias to promote \u2014 run `universe static deploy` first"
-        );
-      }
-      const prod = await client.getAlias({
-        site: config.site,
-        mode: "production"
-      });
-      if (!options.json) {
-        success(
-          `Promoting ${preview.deployId} \u2192 ${prod?.deployId ?? "<none>"}`
-        );
-      }
-      const initialExpected = prod?.deployId ?? "";
-      try {
-        result = await client.sitePromote({
-          site: config.site,
-          deployId: preview.deployId,
-          expectedCurrent: initialExpected
-        });
-      } catch (err) {
-        if (!(err instanceof AliasDriftError)) throw err;
-        if (options.json) throw err;
-        error(
-          `drift: production moved to ${err.current}, expected ${initialExpected}`
-        );
-        const ok = await promptConfirm(
-          `Retry promote with expectedCurrent='${err.current}'?`
-        );
-        if (!ok) throw err;
-        result = await client.sitePromote({
-          site: config.site,
-          deployId: preview.deployId,
-          expectedCurrent: err.current
-        });
-      }
-    }
-    if (options.json) {
-      emitJson5(
-        buildEnvelope("promote", true, {
-          deployId: result.deployId,
-          url: result.url,
-          site: config.site,
-          identitySource: identity.source
-        })
-      );
-    } else {
-      const lines = [
-        `Promoted ${result.deployId} to production`,
-        ``,
-        `  Site:        ${config.site}`,
-        `  Deploy:      ${result.deployId}`,
-        `  Production:  ${result.url}`
-      ];
-      if (options.from) {
-        lines.push(``, "Preview alias unchanged.");
-      }
-      success(lines.join("\n"));
-    }
-  } catch (err) {
-    const { code, message } = wrapProxyError("promote", err);
-    const extras = err instanceof AliasDriftError ? { current: err.current } : void 0;
-    outputError({ json: options.json, command: "promote" }, code, message, {
-      logError: error,
-      extras
-    });
-    exit(code);
-  }
-}
-
-// src/commands/rollback.ts
-import { readFile as readFile5 } from "fs/promises";
-import { resolve as resolve5 } from "path";
-import { confirm as confirm2, isCancel as isCancel2, log as log7 } from "@clack/prompts";
-var defaultPromptConfirm2 = async (msg) => {
-  const r = await confirm2({ message: msg, initialValue: false });
-  if (isCancel2(r)) return false;
-  return r === true;
-};
-var defaultReadPlatformYaml4 = async (cwd) => {
-  return readFile5(resolve5(cwd, "platform.yaml"), "utf-8");
-};
-function emitJson6(envelope) {
-  process.stdout.write(JSON.stringify(envelope) + "\n");
-}
-async function readAndParseConfig3(cwd, read) {
-  let raw;
-  try {
-    raw = await read(cwd);
-  } catch (err) {
-    if (err instanceof Error && err.code === "ENOENT") {
-      throw new ConfigError(
-        `platform.yaml not found in ${cwd}. See docs/platform-yaml.md.`
-      );
-    }
-    throw err;
-  }
-  const r = parsePlatformYaml(raw);
-  if (!r.ok) throw new ConfigError(r.error);
-  return r.value;
-}
-async function rollback(options, deps = {}) {
-  const cwd = deps.cwd ?? process.cwd();
-  const env = deps.env ?? process.env;
-  const readYaml = deps.readPlatformYaml ?? defaultReadPlatformYaml4;
-  const resolveId = deps.resolveIdentity ?? resolveIdentity;
-  const mkClient = deps.createProxyClient ?? createProxyClient;
-  const success = deps.logSuccess ?? ((s) => log7.success(s));
-  const error = deps.logError ?? ((s) => log7.error(s));
-  const exit = deps.exit ?? exitWithCode;
-  const promptConfirm = deps.promptConfirm ?? defaultPromptConfirm2;
-  try {
-    if (!options.to || options.to.trim().length === 0) {
-      throw new UsageError(
-        "rollback requires --to <deployId>. Run `universe static ls` to list past deploys."
-      );
-    }
-    const identity = await resolveId({ env });
-    if (!identity) {
-      throw new CredentialError(
-        "No GitHub identity available. Run `universe login`, set $GITHUB_TOKEN, or install the gh CLI."
-      );
-    }
-    const config = await readAndParseConfig3(cwd, readYaml);
-    const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL;
-    const client = mkClient({
-      baseUrl,
-      getAuthToken: () => identity.token,
-      timeoutMs: parseFetchTimeoutMs(env)
-    });
-    const to = options.to.trim();
-    const prod = await client.getAlias({
-      site: config.site,
-      mode: "production"
-    });
-    const initialExpected = prod?.deployId ?? "";
-    let result;
-    try {
-      result = await client.siteRollback({
-        site: config.site,
-        to,
-        expectedCurrent: initialExpected
-      });
-    } catch (err) {
-      if (!(err instanceof AliasDriftError)) throw err;
-      if (options.json) throw err;
-      error(
-        `drift: production moved to ${err.current}, expected ${initialExpected}`
-      );
-      const ok = await promptConfirm(
-        `Retry rollback with expectedCurrent='${err.current}'?`
-      );
-      if (!ok) throw err;
-      result = await client.siteRollback({
-        site: config.site,
-        to,
-        expectedCurrent: err.current
-      });
-    }
-    if (options.json) {
-      emitJson6(
-        buildEnvelope("rollback", true, {
-          deployId: result.deployId,
-          url: result.url,
-          site: config.site,
-          identitySource: identity.source
-        })
-      );
-    } else {
-      success(
-        [
-          `Rolled production back to ${result.deployId}`,
-          ``,
-          `  Site:        ${config.site}`,
-          `  Deploy:      ${result.deployId}`,
-          `  Production:  ${result.url}`
-        ].join("\n")
-      );
-    }
-  } catch (err) {
-    const { code, message } = wrapProxyError("rollback", err);
-    const extras = err instanceof AliasDriftError ? { current: err.current } : void 0;
-    outputError({ json: options.json, command: "rollback" }, code, message, {
-      logError: error,
-      extras
-    });
-    exit(code);
-  }
-}
-
-// src/commands/whoami.ts
-import { log as log8 } from "@clack/prompts";
-var DEFAULT_PROXY_URL3 = "https://uploads.freecode.camp";
-function emitJson7(envelope) {
-  process.stdout.write(JSON.stringify(envelope) + "\n");
-}
-async function whoami(options, deps = {}) {
-  const env = deps.env ?? process.env;
-  const resolve6 = deps.resolveIdentity ?? resolveIdentity;
-  const mkClient = deps.createProxyClient ?? createProxyClient;
-  const success = deps.logSuccess ?? ((s) => log8.success(s));
-  const error = deps.logError ?? ((s) => log8.error(s));
-  const exit = deps.exit ?? exitWithCode;
-  const identity = await resolve6({ env });
-  if (!identity) {
-    const msg = "No GitHub identity available. Run `universe login`, set $GITHUB_TOKEN, or install the gh CLI.";
-    outputError(
-      { json: options.json, command: "whoami" },
-      EXIT_CREDENTIALS,
-      msg,
-      { logError: error }
-    );
-    exit(EXIT_CREDENTIALS);
-    return;
-  }
-  const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL3;
-  const client = mkClient({
-    baseUrl,
-    getAuthToken: () => identity.token,
-    timeoutMs: parseFetchTimeoutMs(env)
-  });
-  try {
-    const result = await client.whoami();
-    const count = result.authorizedSites.length;
-    if (options.json) {
-      emitJson7(
-        buildEnvelope("whoami", true, {
-          login: result.login,
-          identitySource: identity.source,
-          proxyUrl: baseUrl,
-          authorizedSitesCount: count
-        })
-      );
-    } else {
-      const sitesLine = count === 0 ? "Authorized for 0 sites." : `Authorized for ${count} site${count === 1 ? "" : "s"} \u2014 run \`universe sites ls --mine\``;
-      success(
-        [
-          `Logged in as: ${result.login}`,
-          `Identity source: ${identity.source}`,
-          `Proxy: ${baseUrl}`,
-          sitesLine
-        ].join("\n")
-      );
-    }
-  } catch (err) {
-    const exitCode = err instanceof CliError ? err.exitCode : EXIT_CREDENTIALS;
-    const message = err instanceof ProxyError ? `whoami failed (${err.code}): ${err.message}` : err instanceof Error ? err.message : String(err);
-    outputError({ json: options.json, command: "whoami" }, exitCode, message, {
-      logError: error
-    });
-    exit(exitCode);
-  }
-}
-
-// src/commands/sites/ls.ts
-import { log as log9 } from "@clack/prompts";
-
-// src/commands/sites/_shared.ts
-function emitJson8(envelope) {
-  process.stdout.write(JSON.stringify(envelope) + "\n");
-}
-function parseTeamsFlag(raw) {
-  if (raw === void 0 || raw === null) return [];
-  const tokens = Array.isArray(raw) ? raw : [raw];
-  return tokens.flatMap((s) => s.split(",")).map((s) => s.trim()).filter((s) => s.length > 0);
-}
-async function setupClient(deps) {
-  const env = deps.env ?? process.env;
-  const resolveId = deps.resolveIdentity ?? resolveIdentity;
-  const mkClient = deps.createProxyClient ?? createProxyClient;
-  const identity = await resolveId({ env });
-  if (!identity) {
-    throw new CredentialError(
-      "No GitHub identity available. Run `universe login`, set $GITHUB_TOKEN, or install the gh CLI."
-    );
-  }
-  const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL;
-  const client = mkClient({
-    baseUrl,
-    getAuthToken: () => identity.token,
-    timeoutMs: parseFetchTimeoutMs(env)
-  });
-  return { client, identitySource: identity.source };
-}
-
-// src/commands/sites/ls.ts
-function formatTable2(rows) {
-  if (rows.length === 0) return "No registered sites.";
-  const headers = ["SLUG", "TEAMS", "CREATED BY", "CREATED AT"];
-  const cells = rows.map((r) => [
-    r.slug,
-    r.teams.join(","),
-    r.createdBy,
-    r.createdAt
-  ]);
-  const widths = headers.map(
-    (h, i) => Math.max(h.length, ...cells.map((row) => row[i]?.length ?? 0))
-  );
-  const fmt = (row) => row.map((c, i) => c.padEnd(widths[i] ?? 0)).join("  ");
-  return [fmt(headers), ...cells.map(fmt)].join("\n");
-}
-async function ls2(options, deps = {}) {
-  const command = "sites ls";
-  const success = deps.logSuccess ?? ((s) => log9.message(s));
-  const error = deps.logError ?? ((s) => log9.error(s));
-  const exit = deps.exit ?? exitWithCode;
-  try {
-    const { client, identitySource } = await setupClient(deps);
-    let rows = await client.listSites();
-    let scope = "all";
-    if (options.mine) {
-      const me = await client.whoami();
-      const allowed = new Set(me.authorizedSites);
-      rows = rows.filter((r) => allowed.has(r.slug));
-      scope = "mine";
-    }
-    if (options.json) {
-      emitJson8(
-        buildEnvelope(command, true, {
-          count: rows.length,
-          scope,
-          sites: rows,
-          identitySource
-        })
-      );
-    } else {
-      success(formatTable2(rows));
-    }
-  } catch (err) {
-    const { code, message } = wrapProxyError(command, err);
-    outputError({ json: options.json, command }, code, message, {
-      logError: error
-    });
-    exit(code);
-  }
-}
-
-// src/commands/sites/register.ts
-import { log as log10 } from "@clack/prompts";
-async function register(options, deps = {}) {
-  const command = "sites register";
-  const success = deps.logSuccess ?? ((s) => log10.success(s));
-  const error = deps.logError ?? ((s) => log10.error(s));
-  const exit = deps.exit ?? exitWithCode;
-  try {
-    if (!options.slug || options.slug.trim().length === 0) {
-      throw new UsageError("slug is required (positional argument)");
-    }
-    const teams = parseTeamsFlag(options.team);
-    const { client, identitySource } = await setupClient(deps);
-    const row = await client.registerSite({
-      slug: options.slug,
-      teams: teams.length > 0 ? teams : void 0
-    });
-    if (options.json) {
-      emitJson8(
-        buildEnvelope(command, true, {
-          slug: row.slug,
-          teams: row.teams,
-          createdAt: row.createdAt,
-          createdBy: row.createdBy,
-          identitySource
-        })
-      );
-    } else {
-      success(
-        [
-          `Registered ${row.slug}`,
-          ``,
-          `  Slug:        ${row.slug}`,
-          `  Teams:       ${row.teams.join(", ")}`,
-          `  Created by:  ${row.createdBy}`,
-          `  Created at:  ${row.createdAt}`
-        ].join("\n")
-      );
-    }
-  } catch (err) {
-    const { code, message } = wrapProxyError(command, err);
-    outputError({ json: options.json, command }, code, message, {
-      logError: error
-    });
-    exit(code);
-  }
-}
-
-// src/commands/sites/rm.ts
-import { log as log11 } from "@clack/prompts";
-async function rm2(options, deps = {}) {
-  const command = "sites rm";
-  const success = deps.logSuccess ?? ((s) => log11.success(s));
-  const error = deps.logError ?? ((s) => log11.error(s));
-  const exit = deps.exit ?? exitWithCode;
-  try {
-    if (!options.slug || options.slug.trim().length === 0) {
-      throw new UsageError("slug is required (positional argument)");
-    }
-    const { client, identitySource } = await setupClient(deps);
-    await client.deleteSite({ slug: options.slug });
-    if (options.json) {
-      emitJson8(
-        buildEnvelope(command, true, {
-          slug: options.slug,
-          deleted: true,
-          identitySource
-        })
-      );
-    } else {
-      success(
-        [
-          `Deleted ${options.slug}`,
-          ``,
-          `  Note: R2 deploy bytes are NOT removed; they age out via the`,
-          `        post-GA cleanup cron.`
-        ].join("\n")
-      );
-    }
-  } catch (err) {
-    const { code, message } = wrapProxyError(command, err);
-    outputError({ json: options.json, command }, code, message, {
-      logError: error
-    });
-    exit(code);
-  }
-}
-
-// src/commands/sites/update.ts
-import { log as log12 } from "@clack/prompts";
-async function update(options, deps = {}) {
-  const command = "sites update";
-  const success = deps.logSuccess ?? ((s) => log12.success(s));
-  const error = deps.logError ?? ((s) => log12.error(s));
-  const exit = deps.exit ?? exitWithCode;
-  try {
-    if (!options.slug || options.slug.trim().length === 0) {
-      throw new UsageError("slug is required (positional argument)");
-    }
-    const teams = parseTeamsFlag(options.team);
-    if (teams.length === 0) {
-      throw new UsageError(
-        "--team is required with at least one slug; use `sites rm` to remove a site"
-      );
-    }
-    const { client, identitySource } = await setupClient(deps);
-    const row = await client.updateSite({
-      slug: options.slug,
-      teams
-    });
-    if (options.json) {
-      emitJson8(
-        buildEnvelope(command, true, {
-          slug: row.slug,
-          teams: row.teams,
-          updatedAt: row.updatedAt,
-          identitySource
-        })
-      );
-    } else {
-      success(
-        [
-          `Updated ${row.slug}`,
-          ``,
-          `  Slug:        ${row.slug}`,
-          `  Teams:       ${row.teams.join(", ")}`,
-          `  Updated at:  ${row.updatedAt}`
-        ].join("\n")
-      );
-    }
-  } catch (err) {
-    const { code, message } = wrapProxyError(command, err);
-    outputError({ json: options.json, command }, code, message, {
-      logError: error
-    });
-    exit(code);
-  }
-}
-
-// src/commands/repo/approve.ts
-import { log as log13 } from "@clack/prompts";
-
-// src/commands/repo/_shared.ts
-import {
-  confirm as clackConfirm,
-  isCancel as clackIsCancel,
-  select as clackSelect,
-  text as clackText
-} from "@clack/prompts";
-var defaultRepoPrompts = {
-  text: clackText,
-  select: clackSelect,
-  confirm: clackConfirm,
-  isCancel: clackIsCancel
-};
-function emitJson9(envelope) {
-  process.stdout.write(JSON.stringify(envelope) + "\n");
-}
-async function setupClient2(deps) {
-  const env = deps.env ?? process.env;
-  const resolveId = deps.resolveIdentity ?? resolveIdentity;
-  const mkClient = deps.createProxyClient ?? createProxyClient;
-  const identity = await resolveId({ env });
-  if (!identity) {
-    throw new CredentialError(
-      "No GitHub identity available. Run `universe login`, set $GITHUB_TOKEN, or install the gh CLI."
-    );
-  }
-  const baseUrl = env["UNIVERSE_PROXY_URL"] ?? DEFAULT_PROXY_URL;
-  const client = mkClient({
-    baseUrl,
-    getAuthToken: () => identity.token,
-    timeoutMs: parseFetchTimeoutMs(env),
-    debug: Boolean(env["UNIVERSE_DEBUG"])
-  });
-  return { client, identitySource: identity.source };
-}
-function formatRepoTable(rows, emptyMsg = "No repo requests.") {
-  if (rows.length === 0) return emptyMsg;
-  const headers = [
-    "ID",
-    "REPO",
-    "VIS",
-    "STATUS",
-    "REQUESTED BY",
-    "REQUESTED AT"
-  ];
-  const cells = rows.map((r) => [
-    r.id,
-    r.name,
-    r.visibility,
-    r.status,
-    r.requestedBy,
-    r.createdAt
-  ]);
-  const widths = headers.map(
-    (h, i) => Math.max(h.length, ...cells.map((row) => row[i]?.length ?? 0))
-  );
-  const fmt = (row) => row.map((c, i) => c.padEnd(widths[i] ?? 0)).join("  ");
-  return [fmt(headers), ...cells.map(fmt)].join("\n");
-}
-
-// src/commands/repo/approve.ts
-async function approve(options, deps = {}) {
-  const command = "repo approve";
-  const success = deps.logSuccess ?? ((s) => log13.success(s));
-  const error = deps.logError ?? ((s) => log13.error(s));
-  const exit = deps.exit ?? exitWithCode;
-  const prompts = deps.prompts ?? defaultRepoPrompts;
-  const isTTY = deps.isTTY ?? Boolean(process.stdout.isTTY);
-  let creationFailure;
-  let identitySource;
-  try {
-    if (!options.id || options.id.trim().length === 0) {
-      throw new UsageError("request id is required (positional argument)");
-    }
-    const setup = await setupClient2(deps);
-    const client = setup.client;
-    identitySource = setup.identitySource;
-    if (!options.json && !options.yes) {
-      if (!isTTY) {
-        throw new UsageError(
-          "non-interactive session: pass --yes to approve without confirmation"
-        );
-      }
-      const cur = await client.getRepoRequest(options.id);
-      const ok = await prompts.confirm({
-        message: `Approve ${cur.visibility} repo "${cur.name}" requested by ${cur.requestedBy}? This creates the repository.`
-      });
-      if (prompts.isCancel(ok) || ok === false) {
-        throw new ConfirmError("repo approve cancelled");
-      }
-    }
-    const res = await client.approveRepoRequest({ id: options.id });
-    const row = res.request;
-    if (res.outcome === "approved_failed") {
-      if (!options.json) {
-        throw new StorageError(
-          `approved, but repository creation failed: ${row.error ?? "unknown"} (${row.owner}/${row.name}, requested by ${row.requestedBy})`
-        );
-      }
-      creationFailure = {
-        outcome: res.outcome,
-        id: row.id,
-        repo: `${row.owner}/${row.name}`,
-        status: row.status,
-        creationError: row.error ?? "unknown",
-        requestedBy: row.requestedBy,
-        identitySource
-      };
-    } else if (options.json) {
-      emitJson9(
-        buildEnvelope(command, true, {
-          id: row.id,
-          outcome: res.outcome,
-          repo: `${row.owner}/${row.name}`,
-          url: row.url,
-          visibility: row.visibility,
-          approver: row.approver,
-          identitySource
-        })
-      );
-    } else {
-      success(
-        [
-          `Approved ${row.name}`,
-          ``,
-          `  Repository:  ${row.url ?? `${row.owner}/${row.name}`}`,
-          `  Visibility:  ${row.visibility}`,
-          `  Approved by: ${row.approver ?? "you"}`
-        ].join("\n")
-      );
-    }
-  } catch (err) {
-    const { code, message, kind, requestId } = wrapProxyError(command, err);
-    outputError({ json: options.json, command }, code, message, {
-      logError: error,
-      kind,
-      requestId,
-      extras: identitySource ? { identitySource } : void 0
-    });
-    exit(code);
-    return;
-  }
-  if (creationFailure) {
-    outputError(
-      { json: true, command },
-      EXIT_STORAGE,
-      "approved, but repository creation failed",
-      { logError: error, extras: creationFailure }
-    );
-    exit(EXIT_STORAGE);
-  }
-}
-
-// src/commands/repo/create.ts
-import { log as log14 } from "@clack/prompts";
-function blankToUndefined(s) {
-  if (s === void 0 || s === null) return void 0;
-  const t = String(s).trim();
-  return t === "" ? void 0 : t;
-}
-async function promptTemplate(client, prompts) {
-  let templates = [];
-  try {
-    templates = await client.listRepoTemplates();
-  } catch {
-    templates = [];
-  }
-  if (templates.length === 0) {
-    const v2 = await prompts.text({
-      message: "Template (optional)",
-      placeholder: "name of an org template repo; blank for an empty repo"
-    });
-    if (prompts.isCancel(v2)) throw new ConfirmError("repo create cancelled");
-    return blankToUndefined(String(v2));
-  }
-  const v = await prompts.select({
-    message: "Template",
-    options: [
-      { value: "", label: "None (blank repo)" },
-      ...templates.map((t) => ({ value: t, label: t }))
-    ],
-    initialValue: ""
-  });
-  if (prompts.isCancel(v)) throw new ConfirmError("repo create cancelled");
-  return blankToUndefined(String(v));
-}
-async function create(options, deps = {}) {
-  const command = "repo create";
-  const success = deps.logSuccess ?? ((s) => log14.success(s));
-  const error = deps.logError ?? ((s) => log14.error(s));
-  const exit = deps.exit ?? exitWithCode;
-  const prompts = deps.prompts ?? defaultRepoPrompts;
-  const isTTY = deps.isTTY ?? Boolean(process.stdout.isTTY);
-  const canPrompt = !options.json && !options.yes && isTTY;
-  let identitySource = "";
-  try {
-    let client;
-    const ensureClient = async () => {
-      if (!client) {
-        const setup = await setupClient2(deps);
-        client = setup.client;
-        identitySource = setup.identitySource;
-      }
-      return client;
-    };
-    let name = blankToUndefined(options.name) ?? "";
-    let visibility = options.visibility;
-    let description = options.description;
-    let template = options.template;
-    if (canPrompt) {
-      if (!name) {
-        const v = await prompts.text({
-          message: "Repository name",
-          placeholder: "learn-python-rpg"
-        });
-        if (prompts.isCancel(v))
-          throw new ConfirmError("repo create cancelled");
-        name = String(v).trim();
-      }
-      if (visibility === void 0) {
-        const v = await prompts.select({
-          message: "Visibility",
-          options: [
-            { value: "private", label: "Private" },
-            { value: "public", label: "Public" }
-          ],
-          initialValue: "private"
-        });
-        if (prompts.isCancel(v))
-          throw new ConfirmError("repo create cancelled");
-        visibility = String(v);
-      }
-      if (description === void 0) {
-        const v = await prompts.text({
-          message: "Description (optional)",
-          placeholder: "What is this project about?"
-        });
-        if (prompts.isCancel(v))
-          throw new ConfirmError("repo create cancelled");
-        description = String(v);
-      }
-      if (template === void 0) {
-        template = await promptTemplate(await ensureClient(), prompts);
-      }
-    }
-    if (!name) {
-      throw new UsageError("repo name is required");
-    }
-    const candidate = { name };
-    if (visibility !== void 0 && visibility !== "") {
-      candidate.visibility = visibility;
-    }
-    const desc = blankToUndefined(description);
-    if (desc !== void 0) candidate.description = desc;
-    const tmpl = blankToUndefined(template);
-    if (tmpl !== void 0) candidate.template = tmpl;
-    const parsed = createRepoRequestSchema.safeParse(candidate);
-    if (!parsed.success) {
-      const issues = parsed.error.issues.map(
-        (i) => `${i.path.join(".") || "input"}: ${i.message}`
-      );
-      throw new UsageError(issues.join("; "));
-    }
-    const body = parsed.data;
-    if (!options.json && !options.yes) {
-      if (!isTTY) {
-        throw new UsageError(
-          "non-interactive session: pass --yes to submit without confirmation (or --json)"
-        );
-      }
-      const ok = await prompts.confirm({
-        message: `Submit request to create ${body.visibility} repo "${body.name}"${body.template ? ` from template ${body.template}` : ""}?`
-      });
-      if (prompts.isCancel(ok) || ok === false) {
-        throw new ConfirmError("repo create cancelled");
-      }
-    }
-    const activeClient = await ensureClient();
-    const row = await activeClient.createRepoRequest({
-      name: body.name,
-      visibility: body.visibility,
-      description: body.description,
-      template: body.template
-    });
-    if (options.json) {
-      emitJson9(
-        buildEnvelope(command, true, {
-          id: row.id,
-          name: row.name,
-          owner: row.owner,
-          visibility: row.visibility,
-          template: row.template,
-          status: row.status,
-          identitySource
-        })
-      );
-    } else {
-      success(
-        [
-          `Request submitted`,
-          ``,
-          `  Request id:  ${row.id}`,
-          `  Repository:  ${row.owner}/${row.name}`,
-          `  Visibility:  ${row.visibility}`,
-          ...row.template ? [`  Template:    ${row.template}`] : [],
-          `  Status:      ${row.status} \u2014 run \`universe repo ls\` to review`
-        ].join("\n")
-      );
-    }
-  } catch (err) {
-    const { code, message, kind, requestId } = wrapProxyError(command, err);
-    const display = kind === "already_exists" && !options.json ? `${message}
-  \u2192 run \`universe repo ls --status all\` to find the existing request (it may be active or failed)` : message;
-    outputError({ json: options.json, command }, code, display, {
-      logError: error,
-      kind,
-      requestId,
-      extras: identitySource ? { identitySource } : void 0
-    });
-    exit(code);
-  }
-}
-
-// src/commands/repo/ls.ts
-import { log as log15 } from "@clack/prompts";
-var LS_STATUSES = [...repoStatusSchema.options, "all"];
-async function ls3(options, deps = {}) {
-  const command = "repo ls";
-  const message = deps.logMessage ?? ((s) => log15.message(s));
-  const error = deps.logError ?? ((s) => log15.error(s));
-  const exit = deps.exit ?? exitWithCode;
-  let identitySource;
-  try {
-    const requestedStatus = options.all ? "all" : options.status;
-    if (requestedStatus !== void 0 && !LS_STATUSES.includes(requestedStatus)) {
-      throw new UsageError(
-        `invalid --status "${requestedStatus}": must be one of ${LS_STATUSES.join(", ")}`
-      );
-    }
-    const setup = await setupClient2(deps);
-    const client = setup.client;
-    identitySource = setup.identitySource;
-    const rows = await client.listRepoRequests({
-      status: requestedStatus,
-      mine: options.mine ?? false
-    });
-    const status2 = requestedStatus ?? "pending";
-    if (options.json) {
-      emitJson9(
-        buildEnvelope(command, true, {
-          count: rows.length,
-          status: status2,
-          mine: options.mine ?? false,
-          requests: rows,
-          identitySource
-        })
-      );
-    } else {
-      const empty = status2 === "all" ? "No repo requests." : `No ${status2} repo requests.`;
-      message(formatRepoTable(rows, empty));
-    }
-  } catch (err) {
-    const {
-      code,
-      message: msg,
-      kind,
-      requestId
-    } = wrapProxyError(command, err);
-    outputError({ json: options.json, command }, code, msg, {
-      logError: error,
-      kind,
-      requestId,
-      extras: identitySource ? { identitySource } : void 0
-    });
-    exit(code);
-  }
-}
-
-// src/commands/repo/reject.ts
-import { log as log16 } from "@clack/prompts";
-async function reject(options, deps = {}) {
-  const command = "repo reject";
-  const success = deps.logSuccess ?? ((s) => log16.success(s));
-  const error = deps.logError ?? ((s) => log16.error(s));
-  const exit = deps.exit ?? exitWithCode;
-  const prompts = deps.prompts ?? defaultRepoPrompts;
-  const isTTY = deps.isTTY ?? Boolean(process.stdout.isTTY);
-  let identitySource;
-  try {
-    if (!options.id || options.id.trim().length === 0) {
-      throw new UsageError("request id is required (positional argument)");
-    }
-    const setup = await setupClient2(deps);
-    const client = setup.client;
-    identitySource = setup.identitySource;
-    if (!options.json && !options.yes) {
-      if (!isTTY) {
-        throw new UsageError(
-          "non-interactive session: pass --yes to reject without confirmation"
-        );
-      }
-      const cur = await client.getRepoRequest(options.id);
-      const ok = await prompts.confirm({
-        message: `Reject the request for "${cur.name}" by ${cur.requestedBy}?`
-      });
-      if (prompts.isCancel(ok) || ok === false) {
-        throw new ConfirmError("repo reject cancelled");
-      }
-    }
-    const reason = options.reason === void 0 ? void 0 : String(options.reason).trim() || void 0;
-    const row = await client.rejectRepoRequest({
-      id: options.id,
-      reason
-    });
-    if (options.json) {
-      emitJson9(
-        buildEnvelope(command, true, {
-          id: row.id,
-          status: row.status,
-          repo: `${row.owner}/${row.name}`,
-          rejectReason: row.rejectReason,
-          identitySource
-        })
-      );
-    } else {
-      success(
-        [
-          `Rejected ${row.name}`,
-          ``,
-          `  Repository: ${row.owner}/${row.name}`,
-          ...row.rejectReason ? [`  Reason:     ${row.rejectReason}`] : []
-        ].join("\n")
-      );
-    }
-  } catch (err) {
-    const { code, message, kind, requestId } = wrapProxyError(command, err);
-    outputError({ json: options.json, command }, code, message, {
-      logError: error,
-      kind,
-      requestId,
-      extras: identitySource ? { identitySource } : void 0
-    });
-    exit(code);
-  }
-}
-
-// src/commands/repo/rm.ts
-import { log as log17 } from "@clack/prompts";
-async function rm3(options, deps = {}) {
-  const command = "repo rm";
-  const success = deps.logSuccess ?? ((s) => log17.success(s));
-  const error = deps.logError ?? ((s) => log17.error(s));
-  const exit = deps.exit ?? exitWithCode;
-  const prompts = deps.prompts ?? defaultRepoPrompts;
-  const isTTY = deps.isTTY ?? Boolean(process.stdout.isTTY);
-  let identitySource;
-  try {
-    if (!options.id || options.id.trim().length === 0) {
-      throw new UsageError("request id is required (positional argument)");
-    }
-    const setup = await setupClient2(deps);
-    const client = setup.client;
-    identitySource = setup.identitySource;
-    if (!options.json && !options.yes) {
-      if (!isTTY) {
-        throw new UsageError(
-          "non-interactive session: pass --yes to delete without confirmation"
-        );
-      }
-      const cur = await client.getRepoRequest(options.id);
-      const ok = await prompts.confirm({
-        message: `Delete the ${cur.status} request for "${cur.name}" (${cur.id})? This frees the repo name.`
-      });
-      if (prompts.isCancel(ok) || ok === false) {
-        throw new ConfirmError("repo rm cancelled");
-      }
-    }
-    await client.deleteRepoRequest({ id: options.id });
-    if (options.json) {
-      emitJson9(
-        buildEnvelope(command, true, {
-          id: options.id,
-          deleted: true,
-          identitySource
-        })
-      );
-    } else {
-      success(
-        `Deleted request ${options.id} \u2014 the repo name is free to request again`
-      );
-    }
-  } catch (err) {
-    const { code, message, kind, requestId } = wrapProxyError(command, err);
-    outputError({ json: options.json, command }, code, message, {
-      logError: error,
-      kind,
-      requestId,
-      extras: identitySource ? { identitySource } : void 0
-    });
-    exit(code);
-  }
-}
-
-// src/commands/repo/status.ts
-import { log as log18 } from "@clack/prompts";
-function humanRow(row) {
-  const lines = [
-    `Request ${row.id}`,
-    ``,
-    `  Repository:   ${row.owner}/${row.name}`,
-    `  Visibility:   ${row.visibility}`,
-    `  Status:       ${row.status}`,
-    `  Requested by: ${row.requestedBy}`
-  ];
-  if (row.template) lines.push(`  Template:     ${row.template}`);
-  if (row.url) lines.push(`  URL:          ${row.url}`);
-  if (row.approver) lines.push(`  Approver:     ${row.approver}`);
-  if (row.rejectReason) lines.push(`  Reason:       ${row.rejectReason}`);
-  if (row.error) lines.push(`  Error:        ${row.error}`);
-  lines.push(`  Created:      ${row.createdAt}`);
-  lines.push(`  Updated:      ${row.updatedAt}`);
-  return lines.join("\n");
-}
-async function status(options, deps = {}) {
-  const command = "repo status";
-  const message = deps.logMessage ?? ((s) => log18.message(s));
-  const error = deps.logError ?? ((s) => log18.error(s));
-  const exit = deps.exit ?? exitWithCode;
-  let identitySource;
-  try {
-    if (!options.id || options.id.trim().length === 0) {
-      throw new UsageError("request id is required (positional argument)");
-    }
-    const setup = await setupClient2(deps);
-    const client = setup.client;
-    identitySource = setup.identitySource;
-    const row = await client.getRepoRequest(options.id);
-    if (options.json) {
-      emitJson9(buildEnvelope(command, true, { request: row, identitySource }));
-    } else {
-      message(humanRow(row));
-    }
-  } catch (err) {
-    const {
-      code,
-      message: msg,
-      kind,
-      requestId
-    } = wrapProxyError(command, err);
-    outputError({ json: options.json, command }, code, msg, {
-      logError: error,
-      kind,
-      requestId,
-      extras: identitySource ? { identitySource } : void 0
-    });
-    exit(code);
-  }
-}
-
-// src/lib/update-notifier.ts
-import { spawn as spawn2 } from "child_process";
-import { readFileSync, writeSync } from "fs";
-import { mkdir as mkdir2, readFile as readFile6, writeFile as writeFile2 } from "fs/promises";
-import { homedir as homedir2 } from "os";
-import { dirname as dirname2, join as join3 } from "path";
-var APP_DIR2 = "universe-cli";
-var CACHE_FILE = "update-check.json";
-var PKG_NAME = "@freecodecamp/universe-cli";
-var NPM_LATEST_URL = `https://registry.npmjs.org/${PKG_NAME}/latest`;
-var DEFAULT_TTL_MS = 60 * 60 * 1e3;
-var FETCH_TIMEOUT_MS = 3e3;
-var REFRESH_ENV = "UNIVERSE_REFRESH_WORKER";
-function ttlMs() {
-  const raw = process.env["UNIVERSE_UPDATE_TTL_MS"];
-  if (raw !== void 0) {
-    const n = Number.parseInt(raw, 10);
-    if (Number.isFinite(n) && n >= 0) return n;
-  }
-  return DEFAULT_TTL_MS;
-}
-function latestUrl() {
-  const override = process.env["UNIVERSE_UPDATE_URL"];
-  return override && override.length > 0 ? override : NPM_LATEST_URL;
-}
-function configBase2() {
-  const xdg = process.env["XDG_CONFIG_HOME"];
-  if (xdg && xdg.length > 0) return xdg;
-  return join3(homedir2(), ".config");
-}
-function cachePath() {
-  return join3(configBase2(), APP_DIR2, CACHE_FILE);
-}
-function isDisabled() {
-  const v = process.env["UNIVERSE_NO_UPDATE_CHECK"];
-  return v === "1" || v === "true";
-}
-function parseCache(raw) {
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    return null;
-  }
-  if (typeof parsed !== "object" || parsed === null || !("latest" in parsed) || !("lastCheck" in parsed)) {
-    return null;
-  }
-  const { latest, lastCheck } = parsed;
-  if (typeof latest !== "string" || typeof lastCheck !== "number") {
-    return null;
-  }
-  return { latest, lastCheck };
-}
-async function readCache() {
-  try {
-    const raw = await readFile6(cachePath(), "utf-8");
-    return parseCache(raw);
-  } catch {
-    return null;
-  }
-}
-function readCacheSync() {
-  try {
-    const raw = readFileSync(cachePath(), "utf-8");
-    return parseCache(raw);
-  } catch {
-    return null;
-  }
-}
-async function writeCache(c) {
-  const path = cachePath();
-  await mkdir2(dirname2(path), { recursive: true, mode: 448 });
-  await writeFile2(path, JSON.stringify(c), { mode: 420 });
-}
-async function fetchLatest() {
-  const ctl = new AbortController();
-  const timer = setTimeout(() => ctl.abort(), FETCH_TIMEOUT_MS);
-  try {
-    const res = await fetch(latestUrl(), {
-      signal: ctl.signal,
-      headers: { accept: "application/json" }
-    });
-    if (!res.ok) return null;
-    const body = await res.json();
-    return typeof body.version === "string" ? body.version : null;
-  } catch {
-    return null;
-  } finally {
-    clearTimeout(timer);
-  }
-}
-function compareVersions(a, b) {
-  const pa = parseVersion(a);
-  const pb = parseVersion(b);
-  if (pa === null || pb === null) return 0;
-  for (let i = 0; i < 3; i += 1) {
-    const ai = pa[i] ?? 0;
-    const bi = pb[i] ?? 0;
-    if (ai < bi) return -1;
-    if (ai > bi) return 1;
-  }
-  return 0;
-}
-function parseVersion(s) {
-  const core = s.split("-")[0] ?? "";
-  const parts = core.split(".");
-  if (parts.length !== 3) return null;
-  const nums = parts.map((p) => Number.parseInt(p, 10));
-  if (nums.some((n) => Number.isNaN(n))) return null;
-  return [nums[0], nums[1], nums[2]];
-}
-async function refreshIfStale(now = Date.now(), options = {}) {
-  if (isDisabled()) return;
-  if (!options.force) {
-    const cache = await readCache();
-    if (cache !== null && now - cache.lastCheck < ttlMs()) return;
-  }
-  const latest = await fetchLatest();
-  if (latest === null) return;
-  try {
-    await writeCache({ latest, lastCheck: now });
-  } catch {
-  }
-}
-function spawnRefresh(now = Date.now()) {
-  if (isDisabled()) return;
-  const cache = readCacheSync();
-  if (cache !== null && now - cache.lastCheck < ttlMs()) return;
-  try {
-    const entry = process.argv[1];
-    const args = entry ? [entry] : [];
-    const child = spawn2(process.execPath, args, {
-      detached: true,
-      stdio: "ignore",
-      env: { ...process.env, [REFRESH_ENV]: "1" }
-    });
-    child.unref();
-  } catch {
-  }
-}
-async function runRefreshWorker() {
-  await refreshIfStale(Date.now(), { force: true });
-}
-function getNoticeSync(current) {
-  if (isDisabled()) return null;
-  const cache = readCacheSync();
-  if (cache === null) return null;
-  if (compareVersions(current, cache.latest) >= 0) return null;
-  return { current, latest: cache.latest };
-}
-function useColor() {
-  if (process.env["NO_COLOR"] && process.env["NO_COLOR"].length > 0) {
-    return false;
-  }
-  return process.stderr.isTTY === true;
-}
-function paint(s, code, color) {
-  if (!color) return s;
-  return `\x1B[${code}m${s}\x1B[0m`;
-}
-function formatNotice(n, color = useColor()) {
-  const dim = (s) => paint(s, "2", color);
-  const yellow = (s) => paint(s, "33", color);
-  const cyan = (s) => paint(s, "36", color);
-  const bar = dim("\u2502");
-  const lines = [
-    "",
-    bar,
-    `${yellow("\u25B2")}  Update available: ${dim(n.current)} \u2192 ${cyan(n.latest)}`,
-    `${bar}  Run ${cyan(`npm i -g ${PKG_NAME}`)} to upgrade`,
-    dim("\u2514"),
-    ""
-  ];
-  return lines.join("\n");
-}
-function installExitNotice(current) {
-  if (isDisabled()) return;
-  let printed = false;
-  const emit = () => {
-    if (printed) return;
-    printed = true;
-    const n = getNoticeSync(current);
-    if (n === null) return;
-    try {
-      writeSync(2, formatNotice(n));
-    } catch {
-    }
-  };
-  process.on("beforeExit", emit);
-  process.on("exit", emit);
-}
-
-// src/cli.ts
-var version = true ? "0.9.0" : "0.0.0";
-function handleActionError(command, json, err) {
-  const ctx = { json, command };
-  const message = err instanceof Error ? err.message : "unknown error";
-  const code = err instanceof CliError ? err.exitCode : EXIT_USAGE;
-  outputError(ctx, code, message);
-  exitWithCode(code);
-}
-function findFirstPositional(args) {
-  for (let i = 0; i < args.length; i += 1) {
-    const a = args[i];
-    if (typeof a === "string" && !a.startsWith("-")) return i;
-  }
-  return -1;
-}
-function isVersionRequest(args) {
-  return args.includes("--version") || args.includes("-v");
-}
-async function run(argv = process.argv) {
-  installExitNotice(version);
-  const args = argv.slice(2);
-  const versionRequested = isVersionRequest(args);
-  if (!versionRequested) {
-    spawnRefresh();
-  }
-  const firstPosIdx = findFirstPositional(args);
-  const namespace = firstPosIdx >= 0 ? args[firstPosIdx] : void 0;
-  const isStatic = namespace === "static";
-  const isSites = namespace === "sites";
-  const isRepo = namespace === "repo";
-  if (isSites) {
-    const sitesArgs = [
-      ...args.slice(0, firstPosIdx),
-      ...args.slice(firstPosIdx + 1)
-    ];
-    const sitesCli = cac("universe sites");
-    sitesCli.command("register <slug>", "Register a new static site (staff only)").option("--json", "Output as JSON").option(
-      "--team <name>",
-      "GitHub team slug (repeatable, or comma-separated). Defaults to staff."
-    ).action(
-      async (slug, flags) => {
-        try {
-          await register({
-            json: flags.json ?? false,
-            slug,
-            team: flags.team
-          });
-        } catch (err) {
-          handleActionError("sites register", flags.json ?? false, err);
-        }
-      }
-    );
-    sitesCli.command("ls", "List sites in the registry").option("--json", "Output as JSON").option(
-      "--mine",
-      "Filter to sites your GitHub identity is authorized for"
-    ).action(async (flags) => {
-      try {
-        await ls2({
-          json: flags.json ?? false,
-          mine: flags.mine ?? false
-        });
-      } catch (err) {
-        handleActionError("sites ls", flags.json ?? false, err);
-      }
-    });
-    sitesCli.command(
-      "update <slug>",
-      "Replace the teams list for an existing site (staff only)"
-    ).option("--json", "Output as JSON").option(
-      "--team <name>",
-      "GitHub team slug (repeatable, or comma-separated). Required."
-    ).action(
-      async (slug, flags) => {
-        try {
-          await update({
-            json: flags.json ?? false,
-            slug,
-            team: flags.team
-          });
-        } catch (err) {
-          handleActionError("sites update", flags.json ?? false, err);
-        }
-      }
-    );
-    sitesCli.command("rm <slug>", "Remove a site from the registry (staff only)").option("--json", "Output as JSON").action(async (slug, flags) => {
-      try {
-        await rm2({ json: flags.json ?? false, slug });
-      } catch (err) {
-        handleActionError("sites rm", flags.json ?? false, err);
-      }
-    });
-    sitesCli.help();
-    sitesCli.version(version);
-    sitesCli.parse(["node", "universe-sites", ...sitesArgs]);
-    return;
-  }
-  if (isRepo) {
-    const repoArgs = [
-      ...args.slice(0, firstPosIdx),
-      ...args.slice(firstPosIdx + 1)
-    ];
-    const repoCli = cac("universe repo");
-    repoCli.command(
-      "create [name]",
-      "Request a new repository under freeCodeCamp-Universe (staff only)"
-    ).option("--json", "Output as JSON").option("--visibility <vis>", "public or private (default: private)").option("--description <text>", "Repository description").option(
-      "--template <name>",
-      "Org template repo to generate from; omit for a blank repo"
-    ).option("--yes", "Skip confirmation prompts (required for non-TTY/CI)").example("universe repo create my-app --visibility private --yes").action(
-      async (name, flags) => {
-        try {
-          await create({
-            json: flags.json ?? false,
-            name,
-            visibility: flags.visibility,
-            description: flags.description,
-            template: flags.template,
-            yes: flags.yes ?? false
-          });
-        } catch (err) {
-          handleActionError("repo create", flags.json ?? false, err);
-        }
-      }
-    );
-    repoCli.command("ls", "List repo requests (default: pending)").option("--json", "Output as JSON").option(
-      "--status <status>",
-      "pending | approved | active | rejected | failed | all"
-    ).option("--mine", "Only requests you submitted").option("--all", "Show every state (shorthand for --status all)").action(
-      async (flags) => {
-        try {
-          await ls3({
-            json: flags.json ?? false,
-            status: flags.status,
-            mine: flags.mine ?? false,
-            all: flags.all ?? false
-          });
-        } catch (err) {
-          handleActionError("repo ls", flags.json ?? false, err);
-        }
-      }
-    );
-    repoCli.command(
-      "approve <id>",
-      "Approve a pending request \u2014 creates the repo (admin only)"
-    ).option("--json", "Output as JSON").option("--yes", "Skip confirmation prompts (required for non-TTY/CI)").example("universe repo approve req_abc123 --yes --json").action(async (id, flags) => {
-      try {
-        await approve({
-          json: flags.json ?? false,
-          id,
-          yes: flags.yes ?? false
-        });
-      } catch (err) {
-        handleActionError("repo approve", flags.json ?? false, err);
-      }
-    });
-    repoCli.command("reject <id>", "Reject a pending request (admin only)").option("--json", "Output as JSON").option("--reason <text>", "Reason shown to the requester").option("--yes", "Skip confirmation prompts (required for non-TTY/CI)").example('universe repo reject req_abc123 --reason "out of scope" --yes').action(
-      async (id, flags) => {
-        try {
-          await reject({
-            json: flags.json ?? false,
-            id,
-            reason: flags.reason,
-            yes: flags.yes ?? false
-          });
-        } catch (err) {
-          handleActionError("repo reject", flags.json ?? false, err);
-        }
-      }
-    );
-    repoCli.command("status <id>", "Show a request's current state").option("--json", "Output as JSON").action(async (id, flags) => {
-      try {
-        await status({ json: flags.json ?? false, id });
-      } catch (err) {
-        handleActionError("repo status", flags.json ?? false, err);
-      }
-    });
-    repoCli.command(
-      "rm <id>",
-      "Delete a request, freeing its repo name (admin only)"
-    ).option("--json", "Output as JSON").option("--yes", "Skip confirmation prompts (required for non-TTY/CI)").action(async (id, flags) => {
-      try {
-        await rm3({
-          json: flags.json ?? false,
-          id,
-          yes: flags.yes ?? false
-        });
-      } catch (err) {
-        handleActionError("repo rm", flags.json ?? false, err);
-      }
-    });
-    repoCli.help();
-    repoCli.version(version);
-    const knownRepoSubs = /* @__PURE__ */ new Set([
-      "create",
-      "ls",
-      "approve",
-      "reject",
-      "status",
-      "rm"
-    ]);
-    const repoValueFlags = /* @__PURE__ */ new Set([
-      "--visibility",
-      "--description",
-      "--template",
-      "--status",
-      "--reason"
-    ]);
-    let repoSub;
-    for (let i = 0; i < repoArgs.length; i += 1) {
-      const a = repoArgs[i];
-      if (a === void 0) continue;
-      if (repoValueFlags.has(a)) {
-        i += 1;
-        continue;
-      }
-      if (!a.startsWith("-")) {
-        repoSub = a;
-        break;
-      }
-    }
-    const repoJson = repoArgs.includes("--json");
-    const repoWantsHelp = repoArgs.includes("--help") || repoArgs.includes("-h") || repoArgs.includes("--version");
-    if (repoSub === void 0 ? !repoWantsHelp : !knownRepoSubs.has(repoSub)) {
-      if (repoSub === void 0 && !repoJson) {
-        repoCli.outputHelp();
-      } else {
-        outputError(
-          { json: repoJson, command: "repo" },
-          EXIT_USAGE,
-          repoSub === void 0 ? "missing repo subcommand \u2014 run `universe repo --help`" : `unknown repo subcommand "${repoSub}" \u2014 run \`universe repo --help\``
-        );
-      }
-      exitWithCode(EXIT_USAGE);
-      return;
-    }
-    try {
-      repoCli.parse(["node", "universe-repo", ...repoArgs]);
-    } catch (err) {
-      handleActionError("repo", repoJson, err);
-    }
-    return;
-  }
-  if (isStatic) {
-    const staticArgs = [
-      ...args.slice(0, firstPosIdx),
-      ...args.slice(firstPosIdx + 1)
-    ];
-    const staticCli = cac("universe static");
-    staticCli.command("deploy", "Deploy static site via the artemis proxy").option("--json", "Output as JSON").option("--promote", "Finalize as production (default: preview)").option("--dir <path>", "Override build.output dir from platform.yaml").action(
-      async (flags) => {
-        try {
-          await deploy({
-            json: flags.json ?? false,
-            promote: flags.promote ?? false,
-            dir: flags.dir
-          });
-        } catch (err) {
-          handleActionError("deploy", flags.json ?? false, err);
-        }
-      }
-    );
-    staticCli.command("promote", "Promote the current preview to production").option("--json", "Output as JSON").option(
-      "--from <deployId>",
-      "Promote a specific past deploy id (alias rewrite)"
-    ).action(async (flags) => {
-      try {
-        await promote({
-          json: flags.json ?? false,
-          from: flags.from
-        });
-      } catch (err) {
-        handleActionError("promote", flags.json ?? false, err);
-      }
-    });
-    staticCli.command("rollback", "Rewrite production alias to a past deploy").option("--json", "Output as JSON").option("--to <deployId>", "Target deploy id (required)").action(async (flags) => {
-      try {
-        await rollback({
-          json: flags.json ?? false,
-          to: flags.to
-        });
-      } catch (err) {
-        handleActionError("rollback", flags.json ?? false, err);
-      }
-    });
-    staticCli.command("ls", "List recent deploys for a site").option("--json", "Output as JSON").option("--site <site>", "Override site from platform.yaml").action(async (flags) => {
-      try {
-        await ls({
-          json: flags.json ?? false,
-          site: flags.site
-        });
-      } catch (err) {
-        handleActionError("ls", flags.json ?? false, err);
-      }
-    });
-    staticCli.help();
-    staticCli.version(version);
-    staticCli.parse(["node", "universe-static", ...staticArgs]);
-  } else {
-    const cli = cac("universe");
-    cli.command("login", "Authenticate with GitHub via OAuth device flow").option("--json", "Output as JSON").option("--force", "Replace any existing stored token").action(async (flags) => {
-      try {
-        await login({
-          json: flags.json ?? false,
-          force: flags.force ?? false
-        });
-      } catch (err) {
-        handleActionError("login", flags.json ?? false, err);
-      }
-    });
-    cli.command("logout", "Remove the stored GitHub device-flow token").option("--json", "Output as JSON").action(async (flags) => {
-      try {
-        await logout({ json: flags.json ?? false });
-      } catch (err) {
-        handleActionError("logout", flags.json ?? false, err);
-      }
-    });
-    cli.command("whoami", "Show resolved GitHub identity and authorized sites").option("--json", "Output as JSON").action(async (flags) => {
-      try {
-        await whoami({ json: flags.json ?? false });
-      } catch (err) {
-        handleActionError("whoami", flags.json ?? false, err);
-      }
-    });
-    cli.command("static <subcommand>", "Static site deployment commands");
-    cli.command("sites <subcommand>", "Static site registry commands");
-    cli.command(
-      "repo <subcommand>",
-      "Repository creation + approval queue commands"
-    );
-    cli.help();
-    cli.version(version);
-    cli.parse(argv);
-  }
-  if (versionRequested) {
-    await refreshIfStale(Date.now(), { force: true });
-  }
-}
-
-// src/lib/fatal.ts
-function formatFatal(err) {
-  const message = err instanceof Error ? err.message : String(err);
-  return `universe: ${redact(message)}`;
-}
-function defaultOnFatal(err) {
-  process.stderr.write(formatFatal(err) + "\n");
-  process.exit(EXIT_USAGE);
-}
-function installFatalHandlers(onFatal = defaultOnFatal) {
-  process.on("unhandledRejection", onFatal);
-  process.on("uncaughtException", onFatal);
-}
-
-// src/index.ts
-if (process.env[REFRESH_ENV] === "1") {
-  void runRefreshWorker();
-} else {
-  installFatalHandlers();
-  void run();
-}