@siteoshq/cli 1.4.0 → 1.6.0

package/dist/cli.js

@@ -1499,7 +1499,7 @@ var OverviewSchema = z4.object({
 });
 function createProjectApi(input) {
   const origin = resolveSiteOSAuthBaseUrl(input.env);
-  async function request(path30, schema, body, method) {
+  async function request(path31, schema, body, method) {
     const scope = body === void 0 ? "projects:workspace:read" : "projects:workspace:write";
     const grant = await input.grants.acquire({
       audience: "siteos-projects",
@@ -1513,7 +1513,7 @@ function createProjectApi(input) {
         message: "SiteOS API access is unavailable."
       });
     const response = await input.fetchImpl(
-      `${origin}/api/projects/v1/projects${path30}`,
+      `${origin}/api/projects/v1/projects${path31}`,
       {
         method: method ?? (body === void 0 ? "GET" : "POST"),
         headers: {
@@ -3133,11 +3133,33 @@ function resolveSiteOSFormsBaseUrl(env = process.env) {
     env[SITEOS_FORMS_BASE_URL_ENV]?.trim() || DEFAULT_SITEOS_FORMS_BASE_URL
   );
 }
+var deploymentResponseSchema = z9.object({
+  environmentId: opaqueIdentifierSchema,
+  forms: z9.array(
+    z9.object({
+      formKey: opaqueIdentifierSchema,
+      formId: opaqueIdentifierSchema,
+      contractVersion: z9.string().regex(/^sha256:[a-f0-9]{64}$/),
+      versionId: opaqueIdentifierSchema,
+      version: z9.number().int().positive()
+    })
+  )
+});
 function createSiteOSFormsApiClient(options) {
   const apiBaseUrl = normalizeFormsOrigin(options.apiBaseUrl);
   const inboxPath = (input) => `/api/v1/forms/environments/${encodeURIComponent(input.environmentId)}/forms/${encodeURIComponent(input.formId)}/submissions`;
   const definitionPath = (input) => `/api/v1/forms/environments/${encodeURIComponent(input.environmentId)}/forms/${encodeURIComponent(input.formId)}`;
+  const keyCollection = (input) => options.deploymentKeys ? `${environmentItemPath(input)}/deployment-keys` : credentialCollectionPath(input);
   return {
+    publishDefinitions: (input) => requestJson2({
+      apiBaseUrl,
+      fetchImpl: options.fetchImpl,
+      method: "POST",
+      path: "/api/forms/deployments",
+      body: { definitions: input.definitions },
+      headers: { "x-siteos-forms-deployment-key": input.credential },
+      responseSchema: deploymentResponseSchema
+    }),
     listDefinitions: (input) => requestJson2({
       apiBaseUrl,
       fetchImpl: options.fetchImpl,
@@ -3212,8 +3234,10 @@ function createSiteOSFormsApiClient(options) {
       fetchImpl: options.fetchImpl,
       headers: managementHeaders(input),
       method: "POST",
-      path: credentialCollectionPath(input),
-      responseSchema: formsCredentialExchangeSchema
+      path: keyCollection(input),
+      responseSchema: options.deploymentKeys ? formsCredentialExchangeSchema.extend({
+        token: z9.string().regex(/^pfd_[A-Za-z0-9_-]{43}$/)
+      }) : formsCredentialExchangeSchema
     }),
     listEnvironments: (input) => requestJson2({
       apiBaseUrl,
@@ -3236,7 +3260,7 @@ function createSiteOSFormsApiClient(options) {
       fetchImpl: options.fetchImpl,
       headers: managementHeaders(input),
       method: "GET",
-      path: credentialCollectionPath(input),
+      path: keyCollection(input),
       responseSchema: formsCredentialListSchema
     }),
     revokeCredential: (input) => requestJson2({
@@ -3244,7 +3268,7 @@ function createSiteOSFormsApiClient(options) {
       fetchImpl: options.fetchImpl,
       headers: managementHeaders(input),
       method: "DELETE",
-      path: credentialItemPath(input),
+      path: options.deploymentKeys ? `${keyCollection(input)}/${encodeURIComponent(input.credentialId)}` : credentialItemPath(input),
       responseSchema: formsCredentialMetadataSchema
     }),
     rotateCredential: (input) => requestJson2({
@@ -3254,7 +3278,9 @@ function createSiteOSFormsApiClient(options) {
       headers: managementHeaders(input),
       method: "POST",
       path: credentialRotatePath(input),
-      responseSchema: formsCredentialExchangeSchema
+      responseSchema: options.deploymentKeys ? formsCredentialExchangeSchema.extend({
+        token: z9.string().regex(/^pfd_[A-Za-z0-9_-]{43}$/)
+      }) : formsCredentialExchangeSchema
     }),
     submitForm: (input) => requestJson2({
       apiBaseUrl,
@@ -3288,7 +3314,9 @@ async function requestJson2(options) {
         ...options.body === void 0 ? {} : { "Content-Type": "application/json" },
         ...options.headers
       },
-      method: options.method
+      method: options.method,
+      redirect: "error",
+      signal: AbortSignal.timeout(3e4)
     });
   } catch {
     throw new SiteOSFormsApiError({
@@ -3381,7 +3409,7 @@ import {
 } from "fs/promises";
 import path11 from "path";
 var SITEOS_FORMS_SUBMISSION_CREDENTIAL_ENV = "SITEOS_FORMS_SUBMISSION_CREDENTIAL";
-var credentialPattern = /^pfs_[A-Za-z0-9_-]{22}$/;
+var SITEOS_FORMS_DEPLOYMENT_KEY_ENV = "SITEOS_FORMS_DEPLOYMENT_KEY";
 var SiteOSFormsCredentialStorageError = class extends Error {
   code;
   constructor(code) {
@@ -3393,6 +3421,8 @@ var SiteOSFormsCredentialStorageError = class extends Error {
   }
 };
 async function prepareSiteOSFormsCredentialInstallation(options) {
+  const variable = options.deployment ? SITEOS_FORMS_DEPLOYMENT_KEY_ENV : SITEOS_FORMS_SUBMISSION_CREDENTIAL_ENV;
+  const credentialPattern = options.deployment ? /^pfd_[A-Za-z0-9_-]{43}$/ : /^pfs_[A-Za-z0-9_-]{22}$/;
   const projectRoot = path11.resolve(options.projectRoot);
   const dotenvPath = path11.join(projectRoot, ".env");
   try {
@@ -3419,7 +3449,7 @@ async function prepareSiteOSFormsCredentialInstallation(options) {
           }
           const currentContent = await readSafeDotenv(dotenvPath);
           await writeCredentialAtomically({
-            content: setCredential(currentContent, credential),
+            content: setCredential(currentContent, credential, variable),
             dotenvPath,
             projectRoot
           });
@@ -3457,7 +3487,10 @@ async function readSafeDotenv(dotenvPath) {
     );
   }
   const content = dotenvStats ? await readFile4(dotenvPath, "utf8") : "";
-  if (countCredentialEntries(content) > 1) {
+  if ([
+    SITEOS_FORMS_SUBMISSION_CREDENTIAL_ENV,
+    SITEOS_FORMS_DEPLOYMENT_KEY_ENV
+  ].some((variable) => countCredentialEntries(content, variable) > 1)) {
     throw new SiteOSFormsCredentialStorageError(
       "FORMS_CREDENTIAL_STORAGE_INVALID"
     );
@@ -3485,21 +3518,16 @@ async function writeCredentialAtomically(options) {
     await rm3(temporaryPath, { force: true }).catch(() => void 0);
   }
 }
-function setCredential(content, credential) {
-  const assignment = `${SITEOS_FORMS_SUBMISSION_CREDENTIAL_ENV}=${credential}`;
-  const existing = new RegExp(
-    `^${SITEOS_FORMS_SUBMISSION_CREDENTIAL_ENV}=[^\\r\\n]*(?=\\r?$)`,
-    "m"
-  );
+function setCredential(content, credential, variable) {
+  const assignment = `${variable}=${credential}`;
+  const existing = new RegExp(`^${variable}=[^\\r\\n]*(?=\\r?$)`, "m");
   if (existing.test(content)) return content.replace(existing, assignment);
   const newline = content.includes("\r\n") ? "\r\n" : "\n";
   if (content.length === 0) return `${assignment}${newline}`;
   return `${content}${content.endsWith("\n") ? "" : newline}${assignment}${newline}`;
 }
-function countCredentialEntries(content) {
-  return content.split(/\r?\n/u).filter(
-    (line) => line.startsWith(`${SITEOS_FORMS_SUBMISSION_CREDENTIAL_ENV}=`)
-  ).length;
+function countCredentialEntries(content, variable) {
+  return content.split(/\r?\n/u).filter((line) => line.startsWith(`${variable}=`)).length;
 }
 function isDotenvIgnored(projectRoot) {
   return new Promise((resolve, reject) => {
@@ -3670,6 +3698,10 @@ var FORMS_HELP = `Usage:
   siteos forms submissions list --environment <slug> --form <form-id> [--query <text>] [--status <status>] [--from <ISO>] [--to <ISO>] [--limit <1-100>] [--cursor <cursor>] [--json]
   siteos forms submissions read --environment <slug> --form <form-id> --submission <id> [--json]
   siteos forms submissions status --environment <slug> --form <form-id> --submission <id> --status <new|read|archived|spam> --expected-status <status> [--json]
+  siteos forms deploy --manifest <path> [--json]
+  siteos forms deployment-key issue --environment <slug> --install [--name <name>] [--json]
+  siteos forms deployment-key list --environment <slug> [--json]
+  siteos forms deployment-key revoke --environment <slug> --credential <id> [--json]
   siteos forms submit --input <path> [--json]
 
 Manage SiteOS Forms Environments, definitions, credentials, and submission smoke tests.`;
@@ -3681,6 +3713,8 @@ async function runFormsCommand(options) {
       stdout: FORMS_HELP
     };
   }
+  if (args2[0] === "deploy")
+    return runDeployment({ ...options, args: args2.slice(1) });
   if (args2[0] !== "submit" && args2[0] !== "project") {
     try {
       args2 = await commonEnvironmentArguments(options, "forms", args2);
@@ -3717,6 +3751,13 @@ async function runFormsCommand(options) {
       args: args2.slice(1)
     });
   }
+  if (args2[0] === "deployment-key") {
+    return runCredentialCommand({
+      ...options,
+      args: args2.slice(1),
+      deployment: true
+    });
+  }
   if (args2[0] === "credential") {
     return runCredentialCommand({
       ...options,
@@ -4052,6 +4093,11 @@ async function runCredentialCommand(options) {
   if (!action || !["issue", "list", "revoke", "rotate"].includes(action)) {
     return usageError2("Unknown SiteOS forms credential command.");
   }
+  if (options.deployment && action === "rotate")
+    return usageError2(
+      "Issue a new deployment key, update the release secret, then revoke the old key."
+    );
+  const variable = options.deployment ? SITEOS_FORMS_DEPLOYMENT_KEY_ENV : SITEOS_FORMS_SUBMISSION_CREDENTIAL_ENV;
   const parsed = parseCredentialFlags(action, options.args.slice(1));
   if (!parsed.ok) return parsed.error;
   const context = await loadCredentialManagementContext({
@@ -4123,7 +4169,7 @@ Environment: ${parsed.environmentSlug}`
       credential,
       environment: parsed.environmentSlug,
       installed: {
-        variable: SITEOS_FORMS_SUBMISSION_CREDENTIAL_ENV
+        variable
       },
       operation: action === "issue" ? "issued" : "rotated"
     };
@@ -4133,7 +4179,7 @@ Environment: ${parsed.environmentSlug}`
         `SiteOS Forms credential ${output.operation} and installed.`,
         `Credential: ${credential.id}`,
         `Environment: ${parsed.environmentSlug}`,
-        `Variable: ${SITEOS_FORMS_SUBMISSION_CREDENTIAL_ENV}`
+        `Variable: ${variable}`
       ].join("\n")
     };
   } catch (error) {
@@ -4144,14 +4190,21 @@ async function loadCredentialManagementContext(options) {
   try {
     const local = await readLocalCommonProject(options);
     const rootDir = local?.rootDir ?? (await requireFormsProjectReference(options.cwd ?? process.cwd())).rootDir;
-    const installation = options.install ? await (options.prepareCredentialInstallation ?? prepareSiteOSFormsCredentialInstallation)({ projectRoot: rootDir }) : void 0;
+    const installation = options.install ? await (options.prepareCredentialInstallation ?? prepareSiteOSFormsCredentialInstallation)({
+      projectRoot: rootDir,
+      ...options.deployment ? { deployment: true } : {}
+    }) : void 0;
     const context = await loadFormsManagementContext(
       options,
       "forms:credential:manage"
     );
     if (!context.ok) return context;
     return {
-      client: context.client,
+      client: options.deployment ? createSiteOSFormsApiClient({
+        apiBaseUrl: context.apiBaseUrl,
+        fetchImpl: options.fetchImpl ?? fetch,
+        deploymentKeys: true
+      }) : context.client,
       grant: context.grant,
       ...installation ? { installation } : {},
       ok: true,
@@ -5255,6 +5308,55 @@ function createFormsUiOutput(input) {
     url
   };
 }
+async function runDeployment(options) {
+  const parsed = parseDefinitionSourceFlags(options.args, {
+    environmentRequired: false,
+    usage: "Usage: siteos forms deploy --manifest <path> [--json]"
+  });
+  if (!parsed.ok) return parsed.error;
+  const loaded = await loadFormDefinitions({
+    cwd: options.cwd,
+    source: parsed.source
+  });
+  if (!loaded.ok) return loaded.error;
+  const env = options.env ?? process.env;
+  const credential = env[SITEOS_FORMS_DEPLOYMENT_KEY_ENV]?.trim();
+  const apiBaseUrl = env.SITEOS_FORMS_PUBLIC_URL?.trim();
+  if (!credential || !/^pfd_[A-Za-z0-9_-]{43}$/.test(credential) || !apiBaseUrl)
+    return {
+      exitCode: 1,
+      stderr: "Configure SITEOS_FORMS_PUBLIC_URL and SITEOS_FORMS_DEPLOYMENT_KEY in the release environment."
+    };
+  try {
+    const client = createSiteOSFormsApiClient({
+      apiBaseUrl,
+      fetchImpl: options.fetchImpl ?? fetch
+    });
+    const result = await client.publishDefinitions({
+      credential,
+      definitions: loaded.definitions.map((item) => item.value)
+    });
+    const expected = new Map(
+      loaded.definitions.map((item) => [
+        item.value.formKey,
+        item.value.sourceExportId
+      ])
+    );
+    if (result.forms.length !== expected.size || new Set(result.forms.map((item) => item.formKey)).size !== expected.size || result.forms.some(
+      (item) => !expected.has(item.formKey) || expected.get(item.formKey) !== item.contractVersion
+    ))
+      return {
+        exitCode: 1,
+        stderr: "The published Forms versions do not match this build."
+      };
+    return {
+      exitCode: 0,
+      stdout: parsed.json ? stringifySafeJson(result) : `Published ${result.forms.length} Forms contracts for Environment ${result.environmentId}.`
+    };
+  } catch (error) {
+    return formatApiError(error);
+  }
+}
 
 // src/package-metadata.ts
 import { readFileSync } from "fs";
@@ -5299,7 +5401,7 @@ var projectSchema = z11.object({
 }).strict();
 var projectListSchema = z11.object({ projects: z11.array(projectSchema) }).strict();
 var projectResponseSchema = z11.object({ project: projectSchema }).strict();
-var deploymentResponseSchema = z11.object({
+var deploymentResponseSchema2 = z11.object({
   checks: z11.array(
     z11.object({
       checkId: z11.string().min(1),
@@ -5404,7 +5506,7 @@ function createPulseApiClient(input) {
         grant: options.grant,
         method: "POST",
         path: "/api/cli/v1/deployments",
-        schema: deploymentResponseSchema
+        schema: deploymentResponseSchema2
       });
     }
   };
@@ -9735,10 +9837,261 @@ async function runServiceCommand(service, options) {
 }
 
 // src/services/seo-command.ts
+import { writeFile as writeFile9 } from "fs/promises";
+import path30 from "path";
+import { parseArgs as parseArgs5 } from "util";
+import { z as z17 } from "zod";
+
+// src/services/seo-performance-command.ts
+import { randomUUID as randomUUID6 } from "crypto";
 import { writeFile as writeFile8 } from "fs/promises";
 import path29 from "path";
+import { setTimeout as setTimeout2 } from "timers/promises";
 import { parseArgs as parseArgs4 } from "util";
 import { z as z16 } from "zod";
+var PERFORMANCE_HELP = `
+  siteos seo performance run --audit <id> --url <url> [--url <url>...] [--device <mobile|desktop>] [--idempotency-key <key>] [--environment <slug>] [--json]
+  siteos seo performance list [--device <mobile|desktop>] [--environment <slug>] [--json]
+  siteos seo performance show <id> [--url <url>] [--environment <slug>] [--json]
+  siteos seo performance wait <id> [--timeout <seconds>] [--environment <slug>] [--json]
+  siteos seo performance cancel <id> [--environment <slug>] [--json]
+  siteos seo performance history --url <url> [--device <mobile|desktop>] [--environment <slug>] [--json]
+  siteos seo performance export <id> --format <csv|json> --output <new-file> [--environment <slug>] [--json]
+
+Performance checks use up to 10 explicitly selected URLs from a saved full HTML audit.
+Mobile is the default for a new run. Scores are Lighthouse lab data, not real-user Core Web Vitals.
+Reuse the returned idempotency key after an uncertain run response. Wait defaults to 120 seconds (maximum 900).
+`;
+async function runSeoPerformanceCommand(options) {
+  let idempotencyKey;
+  try {
+    const { values, positionals } = parseArgs4({
+      args: options.args.slice(1),
+      strict: true,
+      allowPositionals: true,
+      options: {
+        json: { type: "boolean" },
+        environment: { type: "string" },
+        audit: { type: "string" },
+        url: { type: "string", multiple: true },
+        device: { type: "string" },
+        "idempotency-key": { type: "string" },
+        timeout: { type: "string" },
+        format: { type: "string" },
+        output: { type: "string" }
+      }
+    });
+    const action = positionals[0] ?? "";
+    const id = positionals[1];
+    const operations = {
+      run: { args: 1, flags: ["audit", "url", "device", "idempotency-key"] },
+      list: { args: 1, flags: ["device"] },
+      show: { args: 2, flags: ["url"] },
+      wait: { args: 2, flags: ["timeout"] },
+      cancel: { args: 2, flags: [] },
+      history: { args: 1, flags: ["url", "device"] },
+      export: { args: 2, flags: ["format", "output"] }
+    };
+    const operation = operations[action];
+    if (!operation || positionals.length !== operation.args || Object.keys(values).some(
+      (key) => !["environment", "json", ...operation.flags].includes(key)
+    ))
+      throw new Error(
+        "Invalid performance operation or flags. Run siteos seo --help."
+      );
+    if (values.device && !["mobile", "desktop"].includes(values.device))
+      throw new Error("Use --device mobile or desktop.");
+    if (action === "run" && (!values.audit || !values.url?.length || values.url.length > 10))
+      throw new Error(
+        "Choose a source --audit and between 1 and 10 --url values."
+      );
+    if (action === "history" && values.url?.length !== 1 || action === "show" && values.url && values.url.length !== 1)
+      throw new Error("Use one --url for page evidence or history.");
+    for (const value of values.url ?? []) {
+      const url = new URL(value);
+      if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.port || value.length > 2048)
+        throw new Error("Use eligible public HTTP(S) URLs.");
+    }
+    const timeout = Number(values.timeout ?? 120);
+    if (!Number.isInteger(timeout) || timeout < 1 || timeout > 900)
+      throw new Error("Use a wait timeout between 1 and 900 seconds.");
+    if (action === "export" && (!values.output || !["csv", "json"].includes(values.format ?? "")))
+      throw new Error(
+        "Export requires --format csv|json and --output for a new file."
+      );
+    if (action === "run") {
+      idempotencyKey = values["idempotency-key"] ?? randomUUID6();
+      if (!/^[a-zA-Z0-9_-]{16,100}$/u.test(idempotencyKey))
+        throw new Error(
+          "Use an idempotency key of 16 to 100 letters, digits, underscores or hyphens."
+        );
+    }
+    const context = await commonServiceContext(
+      options,
+      "seo",
+      values.environment
+    );
+    if (!context)
+      throw new Error("Select a SiteOS Project with siteos project use first.");
+    const runtime = commonProjectRuntime(options);
+    const writing = ["run", "cancel"].includes(action);
+    const scope = writing ? "seo:audits:write" : "seo:workspace:read";
+    const batchSchema = z16.object({
+      id: z16.string(),
+      resourceId: z16.literal(context.resourceId),
+      organizationId: z16.literal(context.overview.project.organizationId),
+      sourceAuditId: z16.string(),
+      state: z16.enum([
+        "queued",
+        "running",
+        "completed",
+        "partial",
+        "failed",
+        "cancelled"
+      ]),
+      device: z16.enum(["mobile", "desktop"]),
+      urls: z16.array(z16.string()).min(1).max(10)
+    }).passthrough();
+    const query = new URLSearchParams();
+    if (values.device) query.set("device", values.device);
+    if (!writing && values.url?.[0]) query.set("pageUrl", values.url[0]);
+    const suffix = id ? `/${encodeURIComponent(id)}${action === "cancel" ? "/cancel" : action === "export" ? "/export" : ""}` : "";
+    if (action === "export") query.set("format", values.format);
+    const deadline = Date.now() + timeout * 1e3;
+    while (true) {
+      const grant = await runtime.grants.acquire({
+        audience: "siteos-seo",
+        scopes: [scope]
+      });
+      if (grant.grant.audience !== "siteos-seo" || grant.grant.organizationId !== context.overview.project.organizationId || grant.grant.scopes.length !== 1 || grant.grant.scopes[0] !== scope)
+        throw new Error(
+          "The SEO grant does not match this Project and operation."
+        );
+      if (!options.fetchImpl)
+        throw new Error("SiteOS API access is unavailable.");
+      const response = await options.fetchImpl(
+        `${runtime.api.origin}/api/seo/v1/resources/${encodeURIComponent(context.resourceId)}/browser-checks${suffix}?${query}`,
+        {
+          method: writing ? "POST" : "GET",
+          headers: {
+            Accept: "application/json",
+            Authorization: `Bearer ${grant.accessToken}`,
+            ...action === "run" ? { "Content-Type": "application/json" } : {}
+          },
+          ...action === "run" ? {
+            body: JSON.stringify({
+              auditId: values.audit,
+              urls: values.url,
+              device: values.device ?? "mobile",
+              idempotencyKey
+            })
+          } : {},
+          signal: AbortSignal.timeout(3e4)
+        }
+      );
+      if (action === "export" && response.ok) {
+        if (!(response instanceof Response) || response.headers.get("X-SEO-Browser-Id") !== id || !response.headers.get("Content-Type")?.startsWith(
+          values.format === "csv" ? "text/csv" : "application/json"
+        ))
+          throw new Error(
+            "The export response does not match the selected check."
+          );
+        const text = await response.text();
+        if (values.format === "json") {
+          const parsed = z16.object({
+            contractVersion: z16.literal(1),
+            batch: batchSchema,
+            pages: z16.array(z16.unknown())
+          }).parse(JSON.parse(text));
+          if (parsed.batch.id !== id)
+            throw new Error(
+              "The export response does not match the selected check."
+            );
+        }
+        const output = path29.resolve(
+          options.cwd ?? process.cwd(),
+          values.output
+        );
+        await writeFile8(output, text, { flag: "wx", mode: 384 });
+        return {
+          exitCode: 0,
+          stdout: JSON.stringify(
+            { batchId: id, output, format: values.format },
+            null,
+            2
+          )
+        };
+      }
+      const data = await response.json();
+      if (!response.ok) {
+        const error = z16.object({
+          error: z16.object({ code: z16.string(), message: z16.string().max(500) })
+        }).safeParse(data);
+        throw new SiteOSAuthApiError({
+          code: error.success ? error.data.error.code : "SEO_REQUEST_FAILED",
+          message: error.success ? error.data.error.message : "The performance request failed.",
+          status: response.status
+        });
+      }
+      const record = z16.object({ contractVersion: z16.literal(1) }).passthrough().parse(data);
+      if (action === "cancel") z16.literal(true).parse(record.cancelled);
+      else if (action === "run") {
+        const accepted = batchSchema.parse(record.batch);
+        const normalize = (url) => {
+          const value = new URL(url);
+          value.hash = "";
+          return value.href;
+        };
+        if (accepted.sourceAuditId !== values.audit || accepted.device !== (values.device ?? "mobile") || JSON.stringify([...new Set(accepted.urls.map(normalize))].sort()) !== JSON.stringify([...new Set(values.url.map(normalize))].sort()))
+          throw new Error(
+            "The queued check does not match the requested source, device and URLs."
+          );
+      } else {
+        z16.literal(context.resourceId).parse(record.resourceId);
+        z16.array(batchSchema).parse(record.batches);
+        const selected = batchSchema.nullable().parse(record.batch);
+        if (id && selected?.id !== id)
+          throw new Error(
+            "The response does not match the selected performance check."
+          );
+      }
+      const batch = record.batch ? batchSchema.parse(record.batch) : null;
+      if (action !== "wait" || !batch || !["queued", "running"].includes(batch.state))
+        return {
+          exitCode: 0,
+          stdout: JSON.stringify(
+            { ...record, ...idempotencyKey ? { idempotencyKey } : {} },
+            null,
+            2
+          )
+        };
+      if (Date.now() >= deadline)
+        return {
+          exitCode: 3,
+          stdout: JSON.stringify({ ...record, timedOut: true }, null, 2)
+        };
+      await setTimeout2(Math.min(3e3, Math.max(0, deadline - Date.now())));
+    }
+  } catch (cause) {
+    const error = {
+      code: cause instanceof SiteOSAuthApiError ? cause.code : "SEO_COMMAND_FAILED",
+      message: cause instanceof z16.ZodError ? "The SEO service returned an invalid response." : cause instanceof Error ? cause.message : "The performance command failed."
+    };
+    return {
+      exitCode: cause instanceof SiteOSAuthApiError ? 1 : 2,
+      ...options.args.includes("--json") ? {
+        stdout: JSON.stringify({
+          error,
+          ...idempotencyKey ? { idempotencyKey } : {}
+        })
+      } : {
+        stderr: `${error.message}${idempotencyKey ? ` Retry key: ${idempotencyKey}` : ""}`
+      }
+    };
+  }
+}
+
+// src/services/seo-command.ts
 var SEO_HELP = `Audit public HTML in the selected Project environment.
 
 Usage:
@@ -9759,19 +10112,23 @@ Usage:
   siteos seo notifications destinations [--environment <slug>] [--json]
   siteos seo notifications set --enabled <true|false> [--destination <candidate-id>] --severity <error|warning> --failures <true|false> --revision <number> [--environment <slug>] [--json]
   siteos seo export --audit <id> --kind <pages|issues|changes> --format <csv|json> --output <new-file> [--query <text>] [--rule <id>] [--severity <error|warning|notice>] [--state <page-or-change-state>] [--environment <slug>] [--json]
+${PERFORMANCE_HELP.trim().split("\n\n")[0]}
 
 Schedule and notification writes require an owner/admin and the saved revision (initially 0).
 Export writes all matching rows to a new file; existing files are never overwritten.
 Runs are queued. Read audit show until terminal; an accepted run is not a completed check.
 Recheck accepts a URL observed in the source audit. Cross-page rules require a full audit.
 Read the current disposition revision before ignore/restore; use 0 if no decision exists.
-Setup: siteos project connect seo. No crawl runs during setup.`;
+Setup: siteos project connect seo. No crawl runs during setup.
+${PERFORMANCE_HELP.trim().split("\n\n").slice(1).join("\n\n")}`;
 async function runSeoCommand(options) {
   if (!options.args.length || options.args.some((arg) => ["--help", "-h"].includes(arg)))
     return { exitCode: 0, stdout: SEO_HELP };
+  if (options.args[0] === "performance")
+    return runSeoPerformanceCommand(options);
   const json = options.args.includes("--json");
   try {
-    const { positionals, values } = parseArgs4({
+    const { positionals, values } = parseArgs5({
       args: options.args,
       strict: true,
       allowPositionals: true,
@@ -9984,18 +10341,18 @@ async function runSeoCommand(options) {
         );
       const text = await response.text();
       if (values.format === "json")
-        z16.object({
-          contractVersion: z16.literal(1),
-          audit: z16.object({
-            id: z16.literal(values.audit),
-            resourceId: z16.literal(context.resourceId)
+        z17.object({
+          contractVersion: z17.literal(1),
+          audit: z17.object({
+            id: z17.literal(values.audit),
+            resourceId: z17.literal(context.resourceId)
           }),
-          kind: z16.literal(values.kind),
-          totalRows: z16.literal(rows),
-          rows: z16.array(z16.unknown()).length(rows)
+          kind: z17.literal(values.kind),
+          totalRows: z17.literal(rows),
+          rows: z17.array(z17.unknown()).length(rows)
         }).parse(JSON.parse(text));
-      const output = path29.resolve(options.cwd ?? process.cwd(), values.output);
-      await writeFile8(output, text, { flag: "wx", mode: 384 });
+      const output = path30.resolve(options.cwd ?? process.cwd(), values.output);
+      await writeFile9(output, text, { flag: "wx", mode: 384 });
       return {
         exitCode: 0,
         stdout: JSON.stringify(
@@ -10013,8 +10370,8 @@ async function runSeoCommand(options) {
     }
     const data = await response.json();
     if (!response.ok) {
-      const result = z16.object({
-        error: z16.object({ code: z16.string(), message: z16.string().max(500) })
+      const result = z17.object({
+        error: z17.object({ code: z17.string(), message: z17.string().max(500) })
       }).safeParse(data);
       throw new SiteOSAuthApiError({
         code: result.success ? result.data.error.code : "SEO_REQUEST_FAILED",
@@ -10022,34 +10379,34 @@ async function runSeoCommand(options) {
         status: response.status
       });
     }
-    const record = z16.object({ contractVersion: z16.literal(1) }).passthrough().parse(data);
+    const record = z17.object({ contractVersion: z17.literal(1) }).passthrough().parse(data);
     if (automation) {
-      z16.literal(context.resourceId).parse(record.resourceId);
-      const schedule = z16.object({
-        enabled: z16.boolean(),
-        weekday: z16.number().int().min(1).max(7),
-        time: z16.string(),
-        timeZone: z16.string(),
-        revision: z16.number().int().min(0),
-        nextRunAt: z16.string().nullable()
+      z17.literal(context.resourceId).parse(record.resourceId);
+      const schedule = z17.object({
+        enabled: z17.boolean(),
+        weekday: z17.number().int().min(1).max(7),
+        time: z17.string(),
+        timeZone: z17.string(),
+        revision: z17.number().int().min(0),
+        nextRunAt: z17.string().nullable()
       });
-      const notificationRoute = z16.object({
-        enabled: z16.boolean(),
-        minimumSeverity: z16.enum(["error", "warning"]),
-        includeFailures: z16.boolean(),
-        revision: z16.number().int().min(0),
-        destinationId: z16.string().nullable()
+      const notificationRoute = z17.object({
+        enabled: z17.boolean(),
+        minimumSeverity: z17.enum(["error", "warning"]),
+        includeFailures: z17.boolean(),
+        revision: z17.number().int().min(0),
+        destinationId: z17.string().nullable()
       });
       if (retryNotification) {
-        z16.literal(true).parse(record.retryQueued);
-        z16.literal(positionals[2]).parse(record.notificationId);
+        z17.literal(true).parse(record.retryQueued);
+        z17.literal(positionals[2]).parse(record.notificationId);
       } else if (route === "notifications destinations")
-        z16.object({
-          candidates: z16.array(
-            z16.object({
-              candidateId: z16.string(),
-              label: z16.string(),
-              availability: z16.literal("available")
+        z17.object({
+          candidates: z17.array(
+            z17.object({
+              candidateId: z17.string(),
+              label: z17.string(),
+              availability: z17.literal("available")
             })
           )
         }).parse(record);
@@ -10062,46 +10419,46 @@ async function runSeoCommand(options) {
         notificationRoute.parse(record.route);
       }
     } else if (!writing) {
-      const validated = z16.object({
-        resource: z16.object({
-          id: z16.literal(context.resourceId),
-          organizationId: z16.literal(context.overview.project.organizationId)
+      const validated = z17.object({
+        resource: z17.object({
+          id: z17.literal(context.resourceId),
+          organizationId: z17.literal(context.overview.project.organizationId)
         }),
-        audits: z16.array(z16.object({ id: z16.string() }).passthrough()),
-        audit: z16.object({
-          id: z16.string(),
-          resourceId: z16.literal(context.resourceId)
+        audits: z17.array(z17.object({ id: z17.string() }).passthrough()),
+        audit: z17.object({
+          id: z17.string(),
+          resourceId: z17.literal(context.resourceId)
         }).passthrough().nullable(),
-        pages: z16.array(z16.unknown()),
-        issues: z16.array(z16.unknown()),
-        changes: z16.array(z16.unknown()),
-        totalChanges: z16.number(),
-        dispositions: z16.array(z16.unknown())
+        pages: z17.array(z17.unknown()),
+        issues: z17.array(z17.unknown()),
+        changes: z17.array(z17.unknown()),
+        totalChanges: z17.number(),
+        dispositions: z17.array(z17.unknown())
       }).passthrough().parse(record);
       const selected = query.get("audit");
       if (selected && validated.audit?.id !== selected)
         throw new Error("The SEO response does not match the requested audit.");
     } else if (record.audit)
-      z16.object({
-        id: z16.string(),
-        resourceId: z16.literal(context.resourceId),
-        organizationId: z16.literal(context.overview.project.organizationId),
-        state: z16.literal("queued")
+      z17.object({
+        id: z17.string(),
+        resourceId: z17.literal(context.resourceId),
+        organizationId: z17.literal(context.overview.project.organizationId),
+        state: z17.literal("queued")
       }).parse(record.audit);
-    else if (route === "audit cancel") z16.literal(true).parse(record.cancelled);
+    else if (route === "audit cancel") z17.literal(true).parse(record.cancelled);
     else if (action === "issue")
-      z16.object({
-        url: z16.literal(values.url),
-        ruleId: z16.literal(values.rule),
-        ignored: z16.literal(positionals[1] === "ignore"),
-        revision: z16.literal(Number(values.revision) + 1)
+      z17.object({
+        url: z17.literal(values.url),
+        ruleId: z17.literal(values.rule),
+        ignored: z17.literal(positionals[1] === "ignore"),
+        revision: z17.literal(Number(values.revision) + 1)
       }).parse(record.disposition);
     else throw new Error("The SEO service returned an invalid response.");
     return { exitCode: 0, stdout: JSON.stringify(record, null, 2) };
   } catch (cause) {
     const error = {
       code: cause instanceof SiteOSAuthApiError ? cause.code : "SEO_COMMAND_FAILED",
-      message: cause instanceof z16.ZodError ? "The SEO service returned an invalid response." : cause instanceof Error ? cause.message : "The SEO command failed."
+      message: cause instanceof z17.ZodError ? "The SEO service returned an invalid response." : cause instanceof Error ? cause.message : "The SEO command failed."
     };
     return {
       exitCode: cause instanceof SiteOSAuthApiError ? 1 : 2,