void 0.20.1 → 0.20.2

package/dist/{client-Clirrol3.mjs → client-dHfSJvAN.mjs}

@@ -1,9 +1,8 @@
 import { n as __exportAll } from "./rolldown-runtime-rQ84J-ij.mjs";
 import { o as join } from "./dist-BrsS7cai.mjs";
-import { G as normalizePlatformApiUrl, p as getPackageDir } from "./output-tFQLLj26.mjs";
-import { t as cfAccessHeaders } from "./cf-access-AJ1ehiFR.mjs";
-import { a as getApiUrl } from "./auth-W9WII-mN.mjs";
-import { t as ensureCloudflaredToken } from "./cf-access-DsSsZUPr.mjs";
+import { B as ensureCloudflaredToken, U as isCloudflareAccessChallenge, V as ensurePlatformAccessToken, X as normalizePlatformApiUrl, p as getPackageDir } from "./output-B0cfNSx5.mjs";
+import { t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
+import { o as getApiUrl } from "./auth-DPl6kck4.mjs";
 import { readFileSync } from "node:fs";
 //#region src/cli/client.ts
 var client_exports = /* @__PURE__ */ __exportAll({
@@ -80,11 +79,34 @@ function isExpiredTokenError(error) {
 	return false;
 }
 /**
+* Retry contract for the deploy POST's transport phase.
+*
+* - Only `fetch` rejections (`TypeError` — no HTTP response) are retried.
+*   A Response of any status means the server answered; surface it
+*   verbatim rather than replay a request it may have accepted.
+* - A rejected fetch does NOT prove the request never arrived — the
+*   connection may have dropped after delivery. Arbitration is left to
+*   the server's precheck, the only atomic (project-locked) verdict: if
+*   an earlier attempt or a concurrent deploy is still in flight, the
+*   replay is rejected with 409 and surfaced as a deploy conflict
+*   naming the deployment id. A client-side GET-then-decide lookup can
+*   never be authoritative (the row can transition between lookup and
+*   replay), so no dedupe query is made — the residual case is the lost
+*   attempt completing within seconds and being redeployed identically.
+*/
+const DEPLOY_POST_MAX_RETRIES = 3;
+const DEPLOY_POST_BACKOFF_MS = [
+	1e3,
+	5e3,
+	1e4
+];
+/**
 * HTTP client for the Void platform API.
 */
 var PlatformClient = class {
 	baseUrl;
 	authHeaders;
+	accessHeaders;
 	cliLog;
 	apiUrl;
 	constructor(token, options) {
@@ -95,31 +117,179 @@ var PlatformClient = class {
 		}
 		this.apiUrl = this.baseUrl;
 		ensureCloudflaredToken(this.baseUrl);
+		this.accessHeaders = cfAccessHeaders(process.env, this.baseUrl);
 		this.authHeaders = {
 			Authorization: `Bearer ${token}`,
-			...VOID_CLI_VERSION !== null && { "X-Void-CLI-Version": VOID_CLI_VERSION },
-			...cfAccessHeaders(process.env, this.baseUrl)
+			...VOID_CLI_VERSION !== null && { "X-Void-CLI-Version": VOID_CLI_VERSION }
+		};
+	}
+	async request(url, options = {}) {
+		if (new URL(url).origin !== this.baseUrl) throw new Error("Platform credentials cannot be sent to another origin.");
+		if (!this.accessHeaders["CF-Access-Client-Id"]) ensureCloudflaredToken(this.baseUrl);
+		const send = () => {
+			const currentAccessHeaders = cfAccessHeaders(process.env, this.baseUrl);
+			const accessHeaders = this.accessHeaders["CF-Access-Client-Id"] ? this.accessHeaders : Object.keys(currentAccessHeaders).length > 0 ? currentAccessHeaders : this.accessHeaders;
+			return {
+				accessHeaders,
+				response: fetch(url, {
+					...options,
+					headers: {
+						...options.headers,
+						...accessHeaders
+					},
+					redirect: "manual"
+				})
+			};
 		};
+		const first = send();
+		const response = await first.response;
+		if (!isCloudflareAccessChallenge(response)) return response;
+		if (first.accessHeaders["CF-Access-Client-Id"]) return response;
+		await response.body?.cancel();
+		ensurePlatformAccessToken(this.baseUrl, true, false, first.accessHeaders["cf-access-token"]);
+		return send().response;
+	}
+	async startIdentityLink(connectionId) {
+		const response = await this.request(this.baseUrl + "/auth/link", {
+			method: "POST",
+			headers: {
+				...this.authHeaders,
+				"Content-Type": "application/json"
+			},
+			body: JSON.stringify({ connectionId })
+		});
+		if (!response.ok) await throwPlatformApiError("Failed to link login method", response);
+		const result = await response.json();
+		const url = new URL(result.url);
+		if (url.origin !== this.baseUrl || url.pathname !== "/auth/link" || url.username || url.password) throw new Error("auth: Invalid account-link URL from platform.");
+		return result;
 	}
 	async whoami() {
-		const res = await fetch(`${this.baseUrl}/me`, { headers: { ...this.authHeaders } });
+		const res = await this.request(`${this.baseUrl}/me`, { headers: { ...this.authHeaders } });
 		if (!res.ok) await throwPlatformApiError("Failed to fetch user info", res);
 		return res.json();
 	}
 	async listProjects() {
-		const res = await fetch(`${this.baseUrl}/projects`, { headers: { ...this.authHeaders } });
+		const res = await this.request(`${this.baseUrl}/projects`, { headers: { ...this.authHeaders } });
 		if (!res.ok) await throwPlatformApiError("Failed to list projects", res);
 		return res.json();
 	}
+	async listProjectTokens(projectId) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/tokens`, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to list project tokens", res);
+		return res.json();
+	}
+	async createProjectToken(projectId, input) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/tokens`, {
+			method: "POST",
+			headers: {
+				...this.authHeaders,
+				"Content-Type": "application/json"
+			},
+			body: JSON.stringify(input)
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to create project token", res);
+		return res.json();
+	}
+	async listProjectMembers(projectId) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/members`, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to list project members", res);
+		return (await res.json()).members;
+	}
+	async listProjectInvitations(projectId) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/invitations`, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to list project invitations", res);
+		return (await res.json()).invitations;
+	}
+	async inviteProjectMember(projectId, email, role) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/invitations`, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				...this.authHeaders
+			},
+			body: JSON.stringify({
+				email,
+				role
+			})
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to invite project member", res);
+		return res.json();
+	}
+	async renewProjectToken(projectId, credentialId, expiresInDays) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/tokens/${encodeURIComponent(credentialId)}/renew`, {
+			method: "POST",
+			headers: {
+				...this.authHeaders,
+				"Content-Type": "application/json"
+			},
+			body: JSON.stringify(expiresInDays ? { expiresInDays } : {})
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to renew project token", res);
+		return res.json();
+	}
+	async updateProjectMemberRole(projectId, userId, role) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/members/${encodeURIComponent(userId)}`, {
+			method: "PATCH",
+			headers: {
+				"Content-Type": "application/json",
+				...this.authHeaders
+			},
+			body: JSON.stringify({ role })
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to change project member role", res);
+		return res.json();
+	}
+	async revokeProjectToken(projectId, credentialId) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/tokens/${encodeURIComponent(credentialId)}`, {
+			method: "DELETE",
+			headers: { ...this.authHeaders }
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to revoke project token", res);
+		return res.json();
+	}
+	async removeProjectMember(projectId, userId) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/members/${encodeURIComponent(userId)}`, {
+			method: "DELETE",
+			headers: { ...this.authHeaders }
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to remove project member", res);
+	}
+	async revokeProjectInvitation(projectId, invitationId) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/invitations/${encodeURIComponent(invitationId)}`, {
+			method: "DELETE",
+			headers: { ...this.authHeaders }
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to revoke project invitation", res);
+	}
+	async leaveProject(projectId) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/leave`, {
+			method: "POST",
+			headers: { ...this.authHeaders }
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to leave project", res);
+	}
+	async listPendingProjectInvitations() {
+		const res = await this.request(`${this.baseUrl}/me/project-invitations`, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to list pending project invitations", res);
+		return (await res.json()).invitations;
+	}
+	async respondToProjectInvitation(invitationId, action) {
+		const res = await this.request(`${this.baseUrl}/project-invitations/${encodeURIComponent(invitationId)}/${action}`, {
+			method: "POST",
+			headers: { ...this.authHeaders }
+		});
+		if (!res.ok) await throwPlatformApiError(`Failed to ${action} project invitation`, res);
+	}
 	async listDeployments(projectId) {
-		const res = await fetch(`${this.baseUrl}/projects/${projectId}/deployments`, { headers: { ...this.authHeaders } });
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/deployments`, { headers: { ...this.authHeaders } });
 		if (!res.ok) await throwPlatformApiError("Failed to list deployments", res);
 		return res.json();
 	}
 	async rollback(projectId, deploymentId, options) {
 		const body = { deploymentId };
 		if (options?.allowDestructive && options.allowDestructive.length > 0) body.allowDestructive = options.allowDestructive;
-		const res = await fetch(`${this.baseUrl}/projects/${projectId}/rollback`, {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/rollback`, {
 			method: "POST",
 			headers: {
 				"Content-Type": "application/json",
@@ -131,7 +301,7 @@ var PlatformClient = class {
 		return res.json();
 	}
 	async cancelDeployment(projectId, deploymentId) {
-		const res = await fetch(`${this.baseUrl}/projects/${projectId}/deployments/${deploymentId}/cancel`, {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/deployments/${deploymentId}/cancel`, {
 			method: "POST",
 			headers: { ...this.authHeaders }
 		});
@@ -139,7 +309,7 @@ var PlatformClient = class {
 		return res.json();
 	}
 	async createProject(slug) {
-		const res = await fetch(`${this.baseUrl}/projects`, {
+		const res = await this.request(`${this.baseUrl}/projects`, {
 			method: "POST",
 			headers: {
 				"Content-Type": "application/json",
@@ -153,7 +323,7 @@ var PlatformClient = class {
 	async preflight(projectId, assetManifest, hasWorker) {
 		const total = Object.keys(assetManifest).length;
 		try {
-			const res = await fetch(`${this.baseUrl}/projects/${projectId}/deploy/preflight`, {
+			const res = await this.request(`${this.baseUrl}/projects/${projectId}/deploy/preflight`, {
 				method: "POST",
 				headers: {
 					"Content-Type": "application/json",
@@ -195,7 +365,7 @@ var PlatformClient = class {
 			url,
 			assetCount: assets.length
 		});
-		const res = await fetch(url, {
+		const res = await this.request(url, {
 			method: "POST",
 			headers: {
 				"Content-Type": "application/json",
@@ -221,7 +391,7 @@ var PlatformClient = class {
 	*/
 	async *finalizeDeploy(projectId, payload) {
 		const url = `${this.baseUrl}/projects/${projectId}/deploy`;
-		yield* this.streamDeployRequest(url, {
+		yield* this.streamDeployRequest(url, projectId, {
 			method: "POST",
 			headers: {
 				"Content-Type": "application/json",
@@ -234,15 +404,30 @@ var PlatformClient = class {
 	* POST + NDJSON-stream-reader used by `finalizeDeploy()`. Captures
 	* `cf-ray` + `cf-cache-status` for postmortem correlation.
 	*/
-	async *streamDeployRequest(url, init) {
+	async *streamDeployRequest(url, projectId, init) {
 		const cliLog = this.cliLog;
 		cliLog?.info("deploy_post", { url });
 		let res;
-		try {
-			res = await fetch(url, init);
+		let attempt = 0;
+		while (true) try {
+			res = await this.request(url, init);
+			break;
 		} catch (err) {
-			cliLog?.error("deploy_fetch_rejected", err, { url });
-			throw err;
+			if (!(err instanceof TypeError) || attempt >= DEPLOY_POST_MAX_RETRIES) {
+				cliLog?.error("deploy_fetch_rejected", err, {
+					url,
+					attempts: attempt + 1
+				});
+				throw err;
+			}
+			cliLog?.warn("deploy_fetch_retry", {
+				url,
+				attempt: attempt + 1,
+				delayMs: DEPLOY_POST_BACKOFF_MS[attempt],
+				error: err instanceof Error ? err.message : String(err)
+			});
+			await sleep(DEPLOY_POST_BACKOFF_MS[attempt]);
+			attempt++;
 		}
 		const cfRay = res.headers.get("cf-ray");
 		const cfCacheStatus = res.headers.get("cf-cache-status");
@@ -252,7 +437,30 @@ var PlatformClient = class {
 			cfCacheStatus,
 			contentType: res.headers.get("content-type")
 		});
-		if (!res.ok) await throwPlatformApiError("Deploy failed", res);
+		if (!res.ok) {
+			const body = await res.text();
+			if (res.status === 409) {
+				let parsed = null;
+				try {
+					const raw = JSON.parse(body);
+					if (raw !== null && typeof raw === "object") parsed = raw;
+				} catch {}
+				if (parsed?.deployment) {
+					cliLog?.warn("deploy_conflict", {
+						url,
+						deploymentId: parsed.deployment,
+						error: parsed.error
+					});
+					yield {
+						event: "error",
+						step: "finalize",
+						message: `${parsed.error ?? "deploy in progress"}: deployment ${parsed.deployment} — it may be an earlier attempt of this deploy or a concurrent one; inspect with \`void project status\` before redeploying`
+					};
+					return;
+				}
+			}
+			throw new PlatformApiError("Deploy failed", res.status, body);
+		}
 		const reader = res.body.getReader();
 		const decoder = new TextDecoder();
 		let buffer = "";
@@ -305,12 +513,12 @@ var PlatformClient = class {
 		}
 	}
 	async listSecrets(projectId) {
-		const res = await fetch(`${this.baseUrl}/projects/${projectId}/secrets`, { headers: { ...this.authHeaders } });
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/secrets`, { headers: { ...this.authHeaders } });
 		if (!res.ok) await throwPlatformApiError("Failed to list secrets", res);
 		return res.json();
 	}
 	async setSecret(projectId, name, value) {
-		const res = await fetch(`${this.baseUrl}/projects/${projectId}/secrets/${encodeURIComponent(name)}`, {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/secrets/${encodeURIComponent(name)}`, {
 			method: "PUT",
 			headers: {
 				"Content-Type": "application/json",
@@ -322,7 +530,7 @@ var PlatformClient = class {
 		return res.json();
 	}
 	async deleteProject(projectId) {
-		const res = await fetch(`${this.baseUrl}/projects/${projectId}`, {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}`, {
 			method: "DELETE",
 			headers: { ...this.authHeaders }
 		});
@@ -332,12 +540,12 @@ var PlatformClient = class {
 	async getMigrationStatus(projectId, dialect) {
 		const url = new URL(`${this.baseUrl}/projects/${projectId}/migrations`);
 		if (dialect) url.searchParams.set("dialect", dialect);
-		const res = await fetch(url, { headers: { ...this.authHeaders } });
+		const res = await this.request(url, { headers: { ...this.authHeaders } });
 		if (!res.ok) await throwPlatformApiError("Failed to get migration status", res);
 		return res.json();
 	}
 	async applyRemoteMigrations(projectId, migrations) {
-		const res = await fetch(`${this.baseUrl}/projects/${projectId}/migrations/apply`, {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/migrations/apply`, {
 			method: "POST",
 			headers: {
 				"Content-Type": "application/json",
@@ -349,7 +557,7 @@ var PlatformClient = class {
 		return res.json();
 	}
 	async renameMigrations(projectId, renames) {
-		const res = await fetch(`${this.baseUrl}/projects/${projectId}/migrations/rename`, {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/migrations/rename`, {
 			method: "POST",
 			headers: {
 				"Content-Type": "application/json",
@@ -361,7 +569,7 @@ var PlatformClient = class {
 		return res.json();
 	}
 	async addDomain(projectId, hostname) {
-		const res = await fetch(`${this.baseUrl}/projects/${projectId}/domains`, {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/domains`, {
 			method: "POST",
 			headers: {
 				"Content-Type": "application/json",
@@ -373,17 +581,17 @@ var PlatformClient = class {
 		return res.json();
 	}
 	async listDomains(projectId) {
-		const res = await fetch(`${this.baseUrl}/projects/${projectId}/domains`, { headers: { ...this.authHeaders } });
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/domains`, { headers: { ...this.authHeaders } });
 		if (!res.ok) await throwPlatformApiError("Failed to list domains", res);
 		return res.json();
 	}
 	async getDomainStatus(projectId, domainId) {
-		const res = await fetch(`${this.baseUrl}/projects/${projectId}/domains/${domainId}`, { headers: { ...this.authHeaders } });
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/domains/${domainId}`, { headers: { ...this.authHeaders } });
 		if (!res.ok) await throwPlatformApiError("Failed to get domain status", res);
 		return res.json();
 	}
 	async removeDomain(projectId, domainId) {
-		const res = await fetch(`${this.baseUrl}/projects/${projectId}/domains/${domainId}`, {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/domains/${domainId}`, {
 			method: "DELETE",
 			headers: { ...this.authHeaders }
 		});
@@ -391,7 +599,7 @@ var PlatformClient = class {
 		return res.json();
 	}
 	async deleteSecret(projectId, name) {
-		const res = await fetch(`${this.baseUrl}/projects/${projectId}/secrets/${encodeURIComponent(name)}`, {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/secrets/${encodeURIComponent(name)}`, {
 			method: "DELETE",
 			headers: { ...this.authHeaders }
 		});
@@ -399,12 +607,12 @@ var PlatformClient = class {
 		return res.json();
 	}
 	async getResources(projectId) {
-		const res = await fetch(`${this.baseUrl}/projects/${projectId}/resources`, { headers: { ...this.authHeaders } });
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/resources`, { headers: { ...this.authHeaders } });
 		if (!res.ok) await throwPlatformApiError("Failed to get resources", res);
 		return res.json();
 	}
 	async createPrerenderToken(projectId) {
-		const res = await fetch(`${this.baseUrl}/projects/${projectId}/prerender-token`, {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/prerender-token`, {
 			method: "POST",
 			headers: { ...this.authHeaders }
 		});
@@ -412,7 +620,7 @@ var PlatformClient = class {
 		return (await res.json()).token;
 	}
 	async provisionDatabase(projectId, connectionString) {
-		const res = await fetch(`${this.baseUrl}/projects/${projectId}/database`, {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/database`, {
 			method: "POST",
 			headers: {
 				"Content-Type": "application/json",
@@ -424,7 +632,7 @@ var PlatformClient = class {
 		return res.json();
 	}
 	async setDatabaseUrl(projectId, connectionString) {
-		const res = await fetch(`${this.baseUrl}/projects/${projectId}/database-url`, {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/database-url`, {
 			method: "PUT",
 			headers: {
 				"Content-Type": "application/json",
@@ -436,12 +644,12 @@ var PlatformClient = class {
 		return res.json();
 	}
 	async getDatabaseUrl(projectId) {
-		const res = await fetch(`${this.baseUrl}/projects/${projectId}/database-url`, { headers: { ...this.authHeaders } });
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/database-url`, { headers: { ...this.authHeaders } });
 		if (!res.ok) await throwPlatformApiError("Failed to fetch database URL", res);
 		return res.json();
 	}
 	async purgeCache(projectId) {
-		const res = await fetch(`${this.baseUrl}/projects/${projectId}/revalidate`, {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/revalidate`, {
 			method: "POST",
 			headers: {
 				"Content-Type": "application/json",
@@ -459,7 +667,7 @@ var PlatformClient = class {
 		});
 		if (deploymentId) params.set("deploymentId", deploymentId);
 		if (level && level !== "all") params.set("level", level);
-		const res = await fetch(`${this.baseUrl}/projects/${projectId}/logs?${params}`, { headers: { ...this.authHeaders } });
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/logs?${params}`, { headers: { ...this.authHeaders } });
 		if (!res.ok) await throwPlatformApiError("Failed to fetch logs", res);
 		return (await res.json()).data;
 	}
@@ -469,34 +677,34 @@ var PlatformClient = class {
 			limit: String(limit)
 		});
 		if (status && status !== "all") params.set("status", status);
-		const res = await fetch(`${this.baseUrl}/projects/${projectId}/requests?${params}`, { headers: { ...this.authHeaders } });
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/requests?${params}`, { headers: { ...this.authHeaders } });
 		if (!res.ok) await throwPlatformApiError("Failed to fetch requests", res);
 		return (await res.json()).data;
 	}
 	async listBuilds(projectId, limit = 20) {
 		const params = new URLSearchParams({ limit: String(limit) });
-		const res = await fetch(`${this.baseUrl}/projects/${projectId}/builds?${params}`, { headers: { ...this.authHeaders } });
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/builds?${params}`, { headers: { ...this.authHeaders } });
 		if (!res.ok) await throwPlatformApiError("Failed to list builds", res);
 		return (await res.json()).builds;
 	}
 	async getBuildLogs(projectId, buildId, since = 0) {
 		const params = new URLSearchParams({ since: String(since) });
-		const res = await fetch(`${this.baseUrl}/projects/${projectId}/builds/${buildId}/logs?${params}`, { headers: { ...this.authHeaders } });
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/builds/${buildId}/logs?${params}`, { headers: { ...this.authHeaders } });
 		if (!res.ok) await throwPlatformApiError("Failed to fetch build logs", res);
 		return res.json();
 	}
 	async getGithubInstallUrl() {
-		const res = await fetch(`${this.baseUrl}/github/install-url`, { headers: { ...this.authHeaders } });
+		const res = await this.request(`${this.baseUrl}/github/install-url`, { headers: { ...this.authHeaders } });
 		if (!res.ok) await throwPlatformApiError("Failed to get GitHub install URL", res);
 		return res.json();
 	}
 	async listGithubInstallations() {
-		const res = await fetch(`${this.baseUrl}/github/installations`, { headers: { ...this.authHeaders } });
+		const res = await this.request(`${this.baseUrl}/github/installations`, { headers: { ...this.authHeaders } });
 		if (!res.ok) await throwPlatformApiError("Failed to list GitHub installations", res);
 		return res.json();
 	}
 	async connectGithub(projectId, body) {
-		const res = await fetch(`${this.baseUrl}/projects/${projectId}/github`, {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/github`, {
 			method: "POST",
 			headers: {
 				"Content-Type": "application/json",
@@ -522,17 +730,17 @@ var PlatformClient = class {
 			installationId,
 			repoFullName
 		});
-		const res = await fetch(`${this.baseUrl}/github/connect-authorize-url?${params}`, { headers: { ...this.authHeaders } });
+		const res = await this.request(`${this.baseUrl}/github/connect-authorize-url?${params}`, { headers: { ...this.authHeaders } });
 		if (!res.ok) await throwPlatformApiError("Failed to start GitHub connect authorization", res);
 		return res.json();
 	}
 	async getGithubConnection(projectId) {
-		const res = await fetch(`${this.baseUrl}/projects/${projectId}/github`, { headers: { ...this.authHeaders } });
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/github`, { headers: { ...this.authHeaders } });
 		if (!res.ok) await throwPlatformApiError("Failed to get GitHub connection", res);
 		return res.json();
 	}
 	async updateGithubConnection(projectId, body) {
-		const res = await fetch(`${this.baseUrl}/projects/${projectId}/github`, {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/github`, {
 			method: "PATCH",
 			headers: {
 				"Content-Type": "application/json",
@@ -544,7 +752,7 @@ var PlatformClient = class {
 		return res.json();
 	}
 	async deleteGithubConnection(projectId) {
-		const res = await fetch(`${this.baseUrl}/projects/${projectId}/github`, {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/github`, {
 			method: "DELETE",
 			headers: { ...this.authHeaders }
 		});
@@ -557,12 +765,12 @@ var PlatformClient = class {
 			code_challenge: codeChallenge,
 			code_challenge_method: "S256"
 		});
-		const res = await fetch(`${this.baseUrl}/github/link-url?${params}`, { headers: { ...this.authHeaders } });
+		const res = await this.request(`${this.baseUrl}/github/link-url?${params}`, { headers: { ...this.authHeaders } });
 		if (!res.ok) await throwPlatformApiError("Failed to start GitHub link", res);
 		return res.json();
 	}
 	async completeGithubLink(linkCode, codeVerifier) {
-		const res = await fetch(`${this.baseUrl}/github/link/complete`, {
+		const res = await this.request(`${this.baseUrl}/github/link/complete`, {
 			method: "POST",
 			headers: {
 				"Content-Type": "application/json",
@@ -582,12 +790,12 @@ var PlatformClient = class {
 			code_challenge: codeChallenge,
 			code_challenge_method: "S256"
 		});
-		const res = await fetch(`${this.baseUrl}/github/join-url?${params}`, { headers: { ...this.authHeaders } });
+		const res = await this.request(`${this.baseUrl}/github/join-url?${params}`, { headers: { ...this.authHeaders } });
 		if (!res.ok) await throwPlatformApiError("Failed to start GitHub join", res);
 		return res.json();
 	}
 	async completeGithubJoin(joinCode, codeVerifier) {
-		const res = await fetch(`${this.baseUrl}/github/join/complete`, {
+		const res = await this.request(`${this.baseUrl}/github/join/complete`, {
 			method: "POST",
 			headers: {
 				"Content-Type": "application/json",
@@ -602,24 +810,29 @@ var PlatformClient = class {
 		return res.json();
 	}
 	async getEmailUsage(projectId) {
-		const res = await fetch(`${this.baseUrl}/projects/${projectId}/email/usage`, { headers: { ...this.authHeaders } });
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/email/usage`, { headers: { ...this.authHeaders } });
 		if (!res.ok) await throwPlatformApiError("Failed to fetch email usage", res);
 		return res.json();
 	}
 	async getEmailLogs(projectId, limit) {
 		const url = new URL(`${this.baseUrl}/projects/${projectId}/email/logs`);
 		if (limit !== void 0) url.searchParams.set("limit", String(limit));
-		const res = await fetch(url, { headers: { ...this.authHeaders } });
+		const res = await this.request(url, { headers: { ...this.authHeaders } });
 		if (!res.ok) await throwPlatformApiError("Failed to fetch email logs", res);
 		return res.json();
 	}
+	async getEmailOperation(projectId, operationId) {
+		const res = await this.request(`${this.baseUrl}/projects/${encodeURIComponent(projectId)}/email/operations/${encodeURIComponent(operationId)}`, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to fetch email operation", res);
+		return res.json();
+	}
 	async listEmailDestinations(projectId) {
-		const res = await fetch(`${this.baseUrl}/projects/${projectId}/email/destinations`, { headers: { ...this.authHeaders } });
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/email/destinations`, { headers: { ...this.authHeaders } });
 		if (!res.ok) await throwPlatformApiError("Failed to list email destinations", res);
 		return res.json();
 	}
 	async addEmailDestination(projectId, address) {
-		const res = await fetch(`${this.baseUrl}/projects/${projectId}/email/destinations`, {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/email/destinations`, {
 			method: "POST",
 			headers: {
 				"Content-Type": "application/json",
@@ -634,27 +847,27 @@ var PlatformClient = class {
 		};
 	}
 	async removeEmailDestination(projectId, destinationId) {
-		const res = await fetch(`${this.baseUrl}/projects/${projectId}/email/destinations/${destinationId}`, {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/email/destinations/${destinationId}`, {
 			method: "DELETE",
 			headers: { ...this.authHeaders }
 		});
 		if (!res.ok) await throwPlatformApiError("Failed to remove email destination", res);
 		return res.json();
 	}
+	/** Installation email settings the CLI reads before starting a credential flow. */
+	async getEmailSettings(projectId) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/email/settings`, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to read email settings", res);
+		return res.json();
+	}
 	async listEmailDomains(projectId) {
-		const res = await fetch(`${this.baseUrl}/projects/${projectId}/email/domains`, { headers: { ...this.authHeaders } });
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/email/domains`, { headers: { ...this.authHeaders } });
 		if (!res.ok) await throwPlatformApiError("Failed to list email domains", res);
 		return res.json();
 	}
-	/**
-	* `domain add` sends the credential exactly once — the OAuth grant's
-	* refresh token xor a pasted API token (the api enforces exactly one). It
-	* is the only call that ever carries it: the platform stores it encrypted
-	* per project, and every later step (`status`, `sync`, `remove`) addresses
-	* the row by domain. The caller must not log the input.
-	*/
+	/** Submit a scoped token once; later operations address the domain without it. */
 	async addEmailDomain(projectId, input) {
-		const res = await fetch(`${this.baseUrl}/projects/${projectId}/email/domains`, {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/email/domains`, {
 			method: "POST",
 			headers: {
 				"Content-Type": "application/json",
@@ -662,7 +875,6 @@ var PlatformClient = class {
 			},
 			body: JSON.stringify({
 				domain: input.domain,
-				...input.refreshToken !== void 0 ? { refreshToken: input.refreshToken } : {},
 				...input.apiToken !== void 0 ? { apiToken: input.apiToken } : {},
 				...input.attemptId !== void 0 ? { attemptId: input.attemptId } : {}
 			})
@@ -671,29 +883,33 @@ var PlatformClient = class {
 		return res.json();
 	}
 	async getEmailDomain(projectId, domain) {
-		const res = await fetch(`${this.baseUrl}/projects/${projectId}/email/domains/${encodeURIComponent(domain)}`, { headers: { ...this.authHeaders } });
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/email/domains/${encodeURIComponent(domain)}`, { headers: { ...this.authHeaders } });
 		if (!res.ok) await throwPlatformApiError("Failed to fetch email domain status", res);
 		return res.json();
 	}
-	/** Redeploys the relay at the current version and rotates its secret (0078, `sync`). */
+	/** Rotates the shared zone connection secret. */
+	async rotateEmailDomainSecret(projectId, domain, attemptId) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/email/domains/${encodeURIComponent(domain)}/rotate-secret`, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				...this.authHeaders
+			},
+			body: JSON.stringify({ attemptId })
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to rotate email connection secret", res);
+		return res.json();
+	}
 	async syncEmailDomain(projectId, domain) {
-		const res = await fetch(`${this.baseUrl}/projects/${projectId}/email/domains/${encodeURIComponent(domain)}/sync`, {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/email/domains/${encodeURIComponent(domain)}/sync`, {
 			method: "POST",
 			headers: { ...this.authHeaders }
 		});
 		if (!res.ok) await throwPlatformApiError("Failed to sync email domain", res);
 		return res.json();
 	}
-	/**
-	* `force` appends `?force=1`: the api drops the row even when a
-	* Cloudflare-side cleanup step fails (and answers `forced: true` +
-	* `failed_steps`). Without it a CF-side failure keeps the row for retry
-	* (`removed: false`).
-	*/
-	async removeEmailDomain(projectId, domain, force) {
-		const url = new URL(`${this.baseUrl}/projects/${projectId}/email/domains/${encodeURIComponent(domain)}`);
-		if (force) url.searchParams.set("force", "1");
-		const res = await fetch(url, {
+	async removeEmailDomain(projectId, domain) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/email/domains/${encodeURIComponent(domain)}`, {
 			method: "DELETE",
 			headers: { ...this.authHeaders }
 		});
@@ -701,5 +917,8 @@ var PlatformClient = class {
 		return res.json();
 	}
 };
+function sleep(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
 //#endregion
 export { isExpiredTokenError as a, isCliOutdatedError as i, PlatformClient as n, parsePlatformErrorBody as o, client_exports as r, PlatformApiError as t };