@synap-core/cli 1.12.2 → 1.13.1-next.20261102.246dc73

package/dist/lib/hub-client.js

@@ -3,10 +3,11 @@ import { join } from "node:path";
 import { getActivePodConfig, getActiveWorkspaceId, getActiveWorkspaceIdForPod, findPodNameByUrl, getActiveProjectBinding, getActiveProjectId, listPodProfiles, getPodOverride, getSurfaceAgentKey, } from "./pod.js";
 import { resolveAgentOverride } from "./agents-config.js";
 import { resolveActiveLensForPod, getClaudeSessionId, writeLens, clearLensField, } from "./session-lens.js";
-import { conversationHeaders } from "./conversation-headers.js";
+import { clientHeader, conversationHeaders } from "./conversation-headers.js";
 import { effectiveDirectoryLens, resolveDirectoryLensForPod, writeDirectoryLens, clearDirectoryLensField, } from "./directory-lens.js";
 import { preferClaudeCodeSurfaceKey } from "./key-source.js";
 import { samePodOrigin } from "./project-ref.js";
+import { PodMovedError, podFetch } from "./pod-moved.js";
 import { HubRestClient } from "@synap-core/hub-rest-client";
 import { log } from "../utils/logger.js";
 import chalk from "chalk";
@@ -46,6 +47,47 @@ function resolveProjectIdForPod(podUrl, opts) {
     }
     return undefined;
 }
+/**
+ * The pod's `code` on a 403 that refused a LIMITED key at the door (a key
+ * whose grant is not unbounded full access), whatever the door: a read no
+ * grant bounds yet, or a door that acts on everything the person owns.
+ * synap-backend `routers/hub-protocol/_middleware/auth.ts`.
+ */
+export const GRANT_DOOR_UNSUPPORTED_CODE = "GRANT_DOOR_UNSUPPORTED";
+/**
+ * The code a pod puts on a 403 that refused a write the calling key's GRANT
+ * does not cover (synap-backend `utils/grant-write-check.ts` `GRANT_DENIED`,
+ * added to every Hub REST denial by `_middleware/grant-denial-code.ts`), as
+ * `code` (or `reasonCode`, when the door set its own `code`), with the refused
+ * `action`.
+ */
+export const GRANT_DENIED_CODE = "GRANT_DENIED";
+/**
+ * How an OLDER pod words the same refusal, with no code (`{ error }` only):
+ * read only when the body carries no `GRANT_DENIED` code.
+ */
+export const GRANT_DENIAL_PREFIX = "This key's grant does not allow";
+/**
+ * A 403 the pod sent because the calling key's grant leaves the action out:
+ * a limited key (a computer's or an agent's) refused by design, never a
+ * missing workspace. `action` is the refused action key when the pod named it
+ * (`workspace.update`). The code first; the words only for an older pod.
+ */
+export function grantDenialOf(err) {
+    if (!(err instanceof HubError) || err.status !== 403)
+        return null;
+    const body = err.body && typeof err.body === "object" && !Array.isArray(err.body)
+        ? err.body
+        : undefined;
+    if (err.code === GRANT_DENIED_CODE || body?.reasonCode === GRANT_DENIED_CODE) {
+        return typeof body?.action === "string" && body.action ? { action: body.action } : {};
+    }
+    const said = err.detail ?? "";
+    if (!said.startsWith(GRANT_DENIAL_PREFIX))
+        return null;
+    const named = /^This key's grant does not allow "([^"]+)"/.exec(said);
+    return named ? { action: named[1] } : {};
+}
 /**
  * A failed Hub call, carrying the structured facts callers need to branch on.
  *
@@ -59,6 +101,13 @@ export class HubError extends Error {
     status;
     code;
     reason;
+    /**
+     * What the pod itself said, without the `Hub <METHOD> <path> failed` prefix
+     * `message` carries. Read a hint's words from here, never from `message`:
+     * the path is in `message`, so `/workspace/i` over it matched every refusal
+     * on a `/workspaces` route (finding de33a075).
+     */
+    detail;
     body;
     rawBody;
     path;
@@ -73,6 +122,7 @@ export class HubError extends Error {
         this.status = init.status;
         this.code = init.code;
         this.reason = init.reason;
+        this.detail = init.detail;
         this.body = init.body;
         this.rawBody = init.rawBody;
         this.path = init.path;
@@ -269,6 +319,7 @@ function hubError(method, path, status, rawBody, suffix, ctx) {
         status,
         code,
         reason,
+        detail,
         body: parsed,
         rawBody,
         path,
@@ -277,46 +328,50 @@ function hubError(method, path, status, rawBody, suffix, ctx) {
         workspaceId: ctx?.workspaceId,
     });
 }
-/** Where to send users who hit a wall. */
+/**
+ * Where to send users who hit a wall. The support door is the ONE customer
+ * support entry point shared by every Synap surface (`from=cli` tells support
+ * which surface the person came from); Discord stays as the community option.
+ */
+export const SUPPORT_URL = "https://synap.live/support?from=cli";
 const DISCORD_INVITE_URL = "https://discord.gg/xhRdQ7hG5h";
 /** Wrap a URL in an OSC-8 terminal hyperlink so `label` is clickable. */
 function osc8Link(url, label) {
     return `\x1b]8;;${url}\x1b\\${label}\x1b]8;;\x1b\\`;
 }
 /**
- * Once-per-process guard for the Discord help footer. A single CLI invocation
+ * Once-per-process guard for the help footer. A single CLI invocation
  * runs one command; printing the footer at most once keeps it a footer, not a
  * per-error/per-line spam.
  */
-let _discordHelpShown = false;
+let _helpShown = false;
 /**
- * Append a one-line "need help?" footer with a clickable Discord invite. Prints
- * to stderr (same stream as the error it follows, so `2>/dev/null` hides both)
- * and only once per process. The invite is an OSC-8 hyperlink on an interactive
- * terminal, a plain URL when the stream is redirected/piped.
+ * Append a one-line "need help?" footer naming the support door (open a ticket)
+ * and the Discord invite. Prints to stderr (same stream as the error it
+ * follows, so `2>/dev/null` hides both) and only once per process. Each URL is
+ * an OSC-8 hyperlink on an interactive terminal, a plain URL when the stream is
+ * redirected/piped.
  */
-export function discordHelpLine() {
-    if (_discordHelpShown)
+export function helpFooterLine() {
+    if (_helpShown)
         return;
-    _discordHelpShown = true;
-    const link = process.stderr.isTTY
-        ? osc8Link(DISCORD_INVITE_URL, DISCORD_INVITE_URL)
-        : DISCORD_INVITE_URL;
-    console.error(chalk.dim(`    Need help? Join our Discord: ${link}`));
+    _helpShown = true;
+    const link = (url) => (process.stderr.isTTY ? osc8Link(url, url) : url);
+    console.error(chalk.dim(`    Need help? Open a ticket: ${link(SUPPORT_URL)} (or join our Discord: ${link(DISCORD_INVITE_URL)})`));
 }
 /**
  * Print a failed Hub call: its humanized message plus a hint for the classes
  * where the cause is not obvious from the message alone. Lives here rather than
  * in utils/logger so the logger stays domain-agnostic and the taxonomy and its
- * presentation sit in one file. Always closes with the one-time Discord footer.
+ * presentation sit in one file. Always closes with the one-time help footer.
  */
-export function renderHubError(err) {
-    renderHubErrorBody(err);
+export function renderHubError(err, opts = {}) {
+    renderHubErrorBody(err, opts);
     // ONE central place every failed Hub command flows through — append the help
     // footer here so it prints once per failed command (guarded), not per line.
-    discordHelpLine();
+    helpFooterLine();
 }
-function renderHubErrorBody(err) {
+function renderHubErrorBody(err, opts) {
     // Hints use log.hint (stderr), not log.dim (stdout): a hint belongs to the
     // error it explains, and splitting one message across two streams means
     // `2>/dev/null` shows a bare hint with no error above it.
@@ -325,6 +380,11 @@ function renderHubErrorBody(err) {
         log.hint(err.hint);
         return;
     }
+    if (err instanceof PodMovedError) {
+        // One line: what happened and what to run.
+        log.error(err.message);
+        return;
+    }
     if (!(err instanceof HubError)) {
         log.error(err instanceof Error ? err.message : String(err));
         return;
@@ -390,16 +450,37 @@ function renderHubErrorBody(err) {
     // template or data problem. Only add the generic pod-fault hint when the body
     // gave nothing better than the status phrase.
     const hasSpecificCause = !!err.rawBody && !err.message.endsWith("the pod hit an internal error");
-    // A 403/message naming a workspace: the real cause is almost always "that
-    // workspace doesn't exist or isn't accessible ON THIS POD" (a stale saved
-    // workspace id after a pod switch), not a scopes problem — name it + the
-    // exact next command instead of the generic "credentials" hint.
-    const namesWorkspace = /workspace/i.test(err.message);
+    // A limited key refused at the door: the pod says so in a structured `code`
+    // (synap-backend access/grant-door-fence.ts, the Hub auth middleware), for a
+    // read door no grant bounds yet and for a door that acts on everything the
+    // person owns. It says nothing about any workspace.
+    const limitedKeyRefusal = err.status === 403 && err.code === GRANT_DOOR_UNSUPPORTED_CODE;
+    // A limited key whose grant leaves this action out (no code: the pod's
+    // words, `grantDenialOf`). Refused by design; its words often name a
+    // workspace ("workspace.update", "in workspace <id>"), which is no reason to
+    // say the workspace is missing.
+    const grantDenial = grantDenialOf(err);
+    // A 403 whose OWN words name a workspace: the real cause is almost always
+    // "that workspace doesn't exist or isn't accessible ON THIS POD" (a stale
+    // saved workspace id after a pod switch), not a scopes problem — name it +
+    // the exact next command instead of the generic "credentials" hint. The
+    // pod's words (`detail`), never `message`: that one carries the path.
+    const namesWorkspace = !limitedKeyRefusal && !grantDenial && /workspace/i.test(err.detail ?? "");
     if (err.status >= 500) {
         if (!hasSpecificCause) {
             log.hint("The pod hit an internal error — check the pod logs for the stack trace.");
         }
     }
+    else if (limitedKeyRefusal) {
+        log.hint(`This key is limited (a computer's or an agent's key), and the pod does not let a limited key use ${err.method} ${err.path}. Nothing is wrong with your workspace.`);
+        log.hint("Until your pod opens this door to limited keys, do it with full access: in the Synap app, or with a full-access key in SYNAP_HUB_API_KEY.");
+    }
+    else if (grantDenial) {
+        const what = grantDenial.action ? `"${grantDenial.action}"` : "this action";
+        log.hint(`This key may not do ${what}: it is a limited key (a computer's or an agent's), and its grant leaves that out on purpose. Nothing is wrong with your workspace.`);
+        log.hint(opts.personDoor ??
+            "Do it yourself with full access: in the Synap app or pod admin.");
+    }
     else if (err.status === 403 && namesWorkspace) {
         // Name the exact workspace + pod this call used: the usual cause is a global
         // active workspace left over from ANOTHER pod (a stale `synap use` after a
@@ -475,8 +556,9 @@ export async function resolveHubConfig(opts) {
         return {
             podUrl: podOverride.podUrl,
             apiKey: podOverride.hubApiKey,
-            // A profile's agentUserId may be empty; "cli" makes resolveUserId fetch /users/me.
-            userId: podOverride.agentUserId || "cli",
+            // "cli": resolveUserId asks the pod who this key acts as (see HubConfig.userId).
+            userId: "cli",
+            agentUserId: podOverride.agentUserId || undefined,
             workspaceId: safeWs,
             projectId: resolveProjectIdForPod(podOverride.podUrl, {}),
         };
@@ -499,10 +581,13 @@ export async function resolveHubConfig(opts) {
         return {
             podUrl,
             apiKey: agentOverride.apiKey,
-            // The AGENT's own id, recorded with its key. Never the pod profile name
-            // (it was, so `synap worker` never recognised its own room posts and
-            // resumed itself on them). Unrecorded → "cli": resolveUserId asks the pod.
-            userId: agentOverride.agentUserId || "cli",
+            // The acting user is asked of the pod ("cli" → /users/me): an agent key
+            // acts as its linked human, and the pod 403s the agent's own id.
+            userId: "cli",
+            // The AGENT's own id, recorded with its key — for `synap worker` to
+            // recognise its own room posts (resolveAgentUserId). Never the pod
+            // profile name (it once was, and the worker resumed itself on them).
+            agentUserId: agentOverride.agentUserId || undefined,
             scopes: envScopes ? envScopes.split(",") : undefined,
         };
     }
@@ -513,7 +598,13 @@ export async function resolveHubConfig(opts) {
     const envScopes = process.env.SYNAP_KEY_SCOPES;
     const envWorkspace = process.env.SYNAP_WORKSPACE_ID;
     const envProject = process.env.SYNAP_PROJECT_ID;
-    if (envPod && envKey && envUser) {
+    // Pod + key are enough. SYNAP_USER_ID used to be required too, so a shell
+    // with just the pair (`SYNAP_POD_URL=… SYNAP_HUB_API_KEY=… synap app
+    // connect`, the documented way to try another key) fell through to "No pod
+    // configured" (2026-10-20). Unset, userId is "cli" and resolveUserId asks
+    // the pod (/users/me) — the same fallback --pod and SYNAP_AGENT use. The
+    // claude-code surface-key preference below still applies.
+    if (envPod && envKey) {
         // Surface-bound resolution guard: if this pod has a `claude-code` surface
         // key pinned to it (via `synap connect --target=claude-code`) and the
         // ambient SYNAP_HUB_API_KEY doesn't match it, the session inherited a
@@ -534,6 +625,7 @@ export async function resolveHubConfig(opts) {
         }
         const apiKey = preferred.apiKey;
         const userId = preferred.userId;
+        const agentUserId = preferred.agentUserId;
         // Per-Claude-session lens wins over the global env var, so concurrent
         // sessions can each be scoped to a different workspace — but ONLY when the
         // lens belongs to THIS pod. A lens stamped with another pod is ignored so
@@ -550,6 +642,7 @@ export async function resolveHubConfig(opts) {
             podUrl: envPod,
             apiKey,
             userId,
+            agentUserId,
             // The global-config fallback is resolved AGAINST THIS POD (envPod) —
             // never send a workspace that belongs to a different pod.
             workspaceId: lens?.workspaceId ||
@@ -580,7 +673,10 @@ export async function resolveHubConfig(opts) {
     return {
         podUrl: config.podUrl,
         apiKey: config.hubApiKey,
-        userId: config.agentUserId,
+        // "cli": resolveUserId asks the pod. A profile's agentUserId is the key's
+        // principal (a computer or agent key), not who the pod acts as.
+        userId: "cli",
+        agentUserId: config.agentUserId || undefined,
         // session lens › directory lens › global config. (No env rung here: this
         // branch is only reached when SYNAP_POD_URL is unset.)
         workspaceId: activeLens?.workspaceId || activeDirLens?.workspaceId || getActiveWorkspaceId(),
@@ -696,13 +792,18 @@ export function detachActiveSessionId(podUrl) {
     return previous;
 }
 /**
- * Per-request headers: the focus session this terminal is attached to, and the
+ * Per-request headers: which client calls (`synap-cli/<version>`), the focus
+ * session this terminal is attached to, and the
  * Claude Code conversation the call comes from (`conversation-headers.ts`) — so
  * the work it lands can be traced back to, and reopened in, that conversation.
  */
 function sessionHeaders(cfg) {
     const id = resolveActiveSessionId(cfg?.podUrl);
-    return { ...conversationHeaders(getClaudeSessionId()), ...(id ? { "X-Session-Id": id } : {}) };
+    return {
+        ...clientHeader("synap-cli"),
+        ...conversationHeaders(getClaudeSessionId()),
+        ...(id ? { "X-Session-Id": id } : {}),
+    };
 }
 /** Max 429 retries for bulk import (each waits up to the rate-limit window). */
 const HUB_429_MAX_RETRIES = 12;
@@ -710,6 +811,12 @@ const HUB_429_MAX_RETRIES = 12;
 const HUB_429_DEFAULT_WAIT_MS = 62_000;
 /** Never sleep more than this on a single 429 (proxies sometimes send 180+). */
 const HUB_429_MAX_WAIT_MS = 75_000;
+/**
+ * Never wait more than this in total on one request. 12 waits of up to 75s
+ * was ~15 minutes of a terminal that looked hung; past this budget the call
+ * fails and says so.
+ */
+export const HUB_429_MAX_TOTAL_WAIT_MS = 150_000;
 /**
  * Client-side request budget — stay UNDER the server limit so we rarely 429.
  * Default 80/min is safe for pods still on the old 100/min auth limit.
@@ -752,26 +859,59 @@ async function acquireHubSlot() {
     }
 }
 /**
- * Parse Retry-After from headers or a Hub 429 body. Caps at 75s so a bad
- * proxy header never parks the importer for 3 minutes.
+ * The wait (ms) a pod 429 asks for, capped at 75s so a bad proxy header never
+ * parks the importer. The pod sends the wait in three shapes, and this reads
+ * all of them: the `Retry-After` header (seconds), a JSON body's numeric
+ * `retryAfter` (hub commands door) or `cause.retryAfterSec`, and the text
+ * "Retry after 60s." the key limiter writes into its message.
  */
-function retryAfterMs(res, bodyText) {
+export function retryAfterMs(res, bodyText) {
+    const cap = (sec) => Math.min(Math.max(sec * 1000, 1_000), HUB_429_MAX_WAIT_MS);
+    const positive = (n) => typeof n === "number" && Number.isFinite(n) && n > 0;
     const h = res.headers.get("retry-after");
     if (h) {
         const sec = parseInt(h, 10);
-        if (Number.isFinite(sec) && sec > 0) {
-            return Math.min(Math.max(sec * 1000, 1_000), HUB_429_MAX_WAIT_MS);
+        if (positive(sec))
+            return cap(sec);
+    }
+    try {
+        const body = JSON.parse(bodyText);
+        const cause = body?.cause;
+        for (const v of [body?.retryAfter, body?.retryAfterSec, cause?.retryAfterSec]) {
+            if (positive(v))
+                return cap(v);
         }
     }
+    catch {
+        // not JSON: fall through to the text shape
+    }
     const m = bodyText.match(/retry after\s+(\d+)\s*s/i);
     if (m) {
         const sec = parseInt(m[1], 10);
-        if (Number.isFinite(sec) && sec > 0) {
-            return Math.min(Math.max(sec * 1000, 1_000), HUB_429_MAX_WAIT_MS);
-        }
+        if (positive(sec))
+            return cap(sec);
     }
     return HUB_429_DEFAULT_WAIT_MS;
 }
+/**
+ * After a 429: say what is happening, sleep the pod's wait, or give up with a
+ * plain error once the retry count or the total wait budget is spent. Both
+ * the JSON and the multipart doors use it, so they cannot drift.
+ */
+async function waitOutRateLimit(res, state, method, path, label) {
+    state.attempt++;
+    const bodyText = await res.text().catch(() => "");
+    if (state.attempt > HUB_429_MAX_RETRIES) {
+        throw hubError(method, path, 429, bodyText, `after ${HUB_429_MAX_RETRIES} retries`);
+    }
+    const wait = retryAfterMs(res, bodyText);
+    if (state.waitedMs + wait > HUB_429_MAX_TOTAL_WAIT_MS) {
+        throw hubError(method, path, 429, bodyText, `after waiting ${Math.round(state.waitedMs / 1000)}s (rate-limited; the pod is up, try again in a minute)`);
+    }
+    console.error(`[hub] rate-limited; the pod is up; retrying in ${Math.ceil(wait / 1000)}s (${label}, retry ${state.attempt}/${HUB_429_MAX_RETRIES})`);
+    state.waitedMs += wait;
+    await sleep(wait);
+}
 /**
  * fetch with client pacing + automatic 429 backoff.
  *
@@ -781,30 +921,27 @@ function retryAfterMs(res, bodyText) {
 async function hubFetchWithRetry(url, init, label, timeoutMs) {
     const [labelMethod, ...labelRest] = label.split(" ");
     const labelPath = labelRest.join(" ");
-    let attempt = 0;
+    const rl = { attempt: 0, waitedMs: 0 };
     for (;;) {
         await acquireHubSlot();
         let res;
         try {
-            res = await fetch(url, init);
+            res = await podFetch(url, init);
         }
         catch (err) {
+            if (err instanceof PodMovedError)
+                throw err;
             throw networkError(err, url, labelMethod, labelPath, timeoutMs);
         }
         if (res.status !== 429)
             return res;
-        attempt++;
-        if (attempt > HUB_429_MAX_RETRIES) {
-            const bodyText = await res.text().catch(() => "");
-            throw hubError(labelMethod, labelPath, 429, bodyText, `after ${HUB_429_MAX_RETRIES} retries`);
-        }
-        const bodyText = await res.text().catch(() => "");
-        const wait = retryAfterMs(res, bodyText);
-        console.error(`[hub] 429 rate limit on ${label} — waiting ${Math.ceil(wait / 1000)}s (retry ${attempt}/${HUB_429_MAX_RETRIES})`);
-        await sleep(wait);
+        await waitOutRateLimit(res, rl, labelMethod, labelPath, label);
     }
 }
-export async function hubGet(path, params, cfg) {
+export async function hubGet(path, params, cfg, 
+// Default 15s suits reads. A long-poll door (`/answers/wait`) holds the
+// request open for its own `timeoutSeconds`; its caller passes more.
+timeoutMs = 15_000) {
     const url = new URL(`${cfg.podUrl}/api/hub${path}`);
     for (const [k, v] of Object.entries(params)) {
         if (v !== undefined)
@@ -812,8 +949,8 @@ export async function hubGet(path, params, cfg) {
     }
     const res = await hubFetchWithRetry(url.toString(), {
         headers: { Authorization: `Bearer ${cfg.apiKey}`, ...sessionHeaders(cfg) },
-        signal: AbortSignal.timeout(15_000),
-    }, `GET ${path}`, 15_000);
+        signal: AbortSignal.timeout(timeoutMs),
+    }, `GET ${path}`, timeoutMs);
     if (!res.ok) {
         const body = await res.text().catch(() => "");
         throw hubError("GET", path, res.status, body, undefined, cfg);
@@ -880,14 +1017,14 @@ export async function hubPostMultipart(path, form, cfg, timeoutMs = 120_000) {
  * can only be read once).
  */
 export async function hubPostMultipartRetryable(path, buildForm, cfg, timeoutMs = 120_000) {
-    let attempt = 0;
+    const rl = { attempt: 0, waitedMs: 0 };
     for (;;) {
         await acquireHubSlot();
         const form = buildForm();
         const url = `${cfg.podUrl}/api/hub${path}`;
         let res;
         try {
-            res = await fetch(url, {
+            res = await podFetch(url, {
                 method: "POST",
                 headers: { Authorization: `Bearer ${cfg.apiKey}`, ...sessionHeaders(cfg) },
                 body: form,
@@ -895,6 +1032,8 @@ export async function hubPostMultipartRetryable(path, buildForm, cfg, timeoutMs
             });
         }
         catch (err) {
+            if (err instanceof PodMovedError)
+                throw err;
             throw networkError(err, url, "POST multipart", path, timeoutMs);
         }
         if (res.status !== 429) {
@@ -904,22 +1043,14 @@ export async function hubPostMultipartRetryable(path, buildForm, cfg, timeoutMs
             }
             return res.json();
         }
-        attempt++;
-        if (attempt > HUB_429_MAX_RETRIES) {
-            const bodyText = await res.text().catch(() => "");
-            throw hubError("POST multipart", path, 429, bodyText, `after ${HUB_429_MAX_RETRIES} retries`);
-        }
-        const bodyText = await res.text().catch(() => "");
-        const wait = retryAfterMs(res, bodyText);
-        console.error(`[hub] 429 rate limit on POST multipart ${path} — waiting ${Math.ceil(wait / 1000)}s (retry ${attempt}/${HUB_429_MAX_RETRIES})`);
-        await sleep(wait);
+        await waitOutRateLimit(res, rl, "POST multipart", path, `POST multipart ${path}`);
     }
 }
 export async function hubPatch(path, body, cfg) {
     const url = `${cfg.podUrl}/api/hub${path}`;
     let res;
     try {
-        res = await fetch(url, {
+        res = await podFetch(url, {
             method: "PATCH",
             headers: { Authorization: `Bearer ${cfg.apiKey}`, "Content-Type": "application/json", ...sessionHeaders(cfg) },
             body: JSON.stringify(body),
@@ -927,6 +1058,8 @@ export async function hubPatch(path, body, cfg) {
         });
     }
     catch (err) {
+        if (err instanceof PodMovedError)
+            throw err;
         throw networkError(err, url, "PATCH", path, 15_000);
     }
     if (!res.ok) {
@@ -942,13 +1075,15 @@ export async function hubDelete(path, cfg) {
     const url = `${cfg.podUrl}/api/hub${path}`;
     let res;
     try {
-        res = await fetch(url, {
+        res = await podFetch(url, {
             method: "DELETE",
             headers: { Authorization: `Bearer ${cfg.apiKey}`, ...sessionHeaders(cfg) },
             signal: AbortSignal.timeout(15_000),
         });
     }
     catch (err) {
+        if (err instanceof PodMovedError)
+            throw err;
         throw networkError(err, url, "DELETE", path, 15_000);
     }
     if (!res.ok) {