void 0.20.1 → 0.20.3

package/dist/client-BQBrZoCX.mjs

@@ -0,0 +1,989 @@
+import { n as __exportAll } from "./rolldown-runtime-rQ84J-ij.mjs";
+import { o as join } from "./dist-BrsS7cai.mjs";
+import { B as ensureCloudflaredToken, U as isCloudflareAccessChallenge, V as ensurePlatformAccessToken, X as normalizePlatformApiUrl, p as getPackageDir } from "./output-B0cfNSx5.mjs";
+import { t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
+import { o as getApiUrl } from "./auth-DPl6kck4.mjs";
+import { readFileSync } from "node:fs";
+import { stripVTControlCharacters } from "node:util";
+//#region src/cli/platform-errors.ts
+function parsePlatformErrorBody(body) {
+	try {
+		const parsed = JSON.parse(body);
+		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+		const result = {};
+		for (const key of [
+			"error",
+			"message",
+			"deployment",
+			"minVersion",
+			"clientVersion"
+		]) {
+			const value = parsed[key];
+			if (typeof value === "string") result[key] = value;
+		}
+		return result;
+	} catch {
+		return null;
+	}
+}
+function plainExplanation(value) {
+	const text = value ? stripVTControlCharacters(value).replace(/[\u0000-\u0008\u000b-\u001f\u007f]/g, " ").trim() : void 0;
+	return text && !text.startsWith("{") && !text.startsWith("[") && !/<[^>]+>/.test(text) ? text : void 0;
+}
+function platformErrorMessage(payload) {
+	const message = plainExplanation(payload?.message);
+	return message && !/^(forbidden|unauthorized|access denied|permission denied)[.!]?$/i.test(message) ? message : void 0;
+}
+function unexplainedRejection(status) {
+	if (status === 401) return "Authentication was rejected. Check the credentials for the selected platform and any access gateway in front of it.";
+	if (status === 403) return "Access was denied by the platform or its access gateway. Check the selected platform and ask its administrator to confirm your access.";
+	return "The platform did not provide an explanation. Retry the operation; if it still fails, contact the platform administrator.";
+}
+function permissionMessage(permission) {
+	if (permission === "owner") return "Only the project owner can perform this action. Ask the owner to run it using their platform login.";
+	if (permission === "read") return "This action requires project membership (reader or higher). Ask a project admin or owner for access.";
+	if (permission === "settings" || permission === "members") return "This action requires admin or owner access. Ask a project admin or owner to confirm your access.";
+	if (permission === "configure" || permission === "deploy") return "This action requires collaborator, admin, or owner access. Ask a project admin or owner to confirm your access.";
+	return "Ask the platform administrator to check your access to this action.";
+}
+const rejectionMessages = {
+	"invalid or expired token": "The platform reported an invalid or expired token. Sign in again with `void connect <platform-url>`, or replace `VOID_TOKEN` if you supplied it.",
+	"missing authorization header": "A platform login or token is required. Sign in with `void connect <platform-url>`, or supply a valid `VOID_TOKEN` for that platform.",
+	"session revoked; sign in again": "Your platform session was revoked. Sign in again with `void connect <platform-url>`, or replace `VOID_TOKEN` if you supplied it.",
+	"user not found": "This account is no longer available. Contact the platform administrator or sign in with an active account on this platform.",
+	"deploy credential revoked or expired": "This project deploy credential was revoked or expired. Ask the project owner to issue a replacement and update the credential used by your automation.",
+	"deploy token build is no longer active": "This build is no longer active. Start a new build to obtain a valid deployment credential.",
+	github_identity_required: "Link your GitHub account with `void github link`, then retry this operation.",
+	connect_authorization_required: "This GitHub repository requires authorization. Run `void github connect` in an interactive terminal to authorize access, then retry.",
+	"invalid connect grant": "GitHub authorization failed or expired. Run `void github connect` again.",
+	"installation access revoked": "Access to this GitHub installation was revoked. Ask its administrator to restore access, then run `void github join`.",
+	"account suspended": "This account is suspended. Contact the platform administrator to restore access.",
+	"project owner suspended": "The project owner is suspended. Ask the owner to contact the platform administrator.",
+	"project is being deleted": "This project is being deleted. Wait for deletion to finish before creating a replacement.",
+	"registered user not found": "No registered account matches that email address. Ask the recipient to sign in to this platform first, then invite their registered email.",
+	"the project owner cannot be invited or changed as a member": "The project owner cannot be invited or changed through team membership commands. Choose another member.",
+	"the project owner cannot leave the project": "The project owner cannot leave. Ask a platform administrator to transfer ownership first.",
+	"user is already a project member": "This user is already a project member. Use `void project team list` to find their user ID, then `void project team role` to change their role.",
+	"project member not found": "This user is no longer a project member. Run `void project team list` to check current members.",
+	"project has too many pending invitations": "This project has reached its pending invitation limit. Run `void project team invitations` and revoke invitations that are no longer needed."
+};
+function formatPlatformApiError(action, status, body, permission) {
+	const parsed = parsePlatformErrorBody(body);
+	const message = platformErrorMessage(parsed);
+	if (status === 426 && parsed?.error === "cli_outdated" && message) return message;
+	if (!parsed) {
+		if (status === 401 || status === 403) {
+			const plain = plainExplanation(body);
+			return `${action} (HTTP ${status}): ${plain && !/^(forbidden|unauthorized|access denied|permission denied)[.!]?$/i.test(plain) ? plain.replace(/\s+/g, " ").slice(0, 240) : unexplainedRejection(status)}`;
+		}
+		return `${action}: ${status} ${body}`;
+	}
+	return `${action} (HTTP ${status}): ${(message ?? (status === 403 && parsed.error === "forbidden" ? `Access denied. ${permissionMessage(permission)}` : (parsed.error && Object.hasOwn(rejectionMessages, parsed.error) ? rejectionMessages[parsed.error] : void 0) ?? (status === 401 && ["unauthorized", "missing token"].includes(parsed.error ?? "") ? rejectionMessages["invalid or expired token"] : plainExplanation(parsed.error)))) || unexplainedRejection(status)}`;
+}
+//#endregion
+//#region src/cli/client.ts
+var client_exports = /* @__PURE__ */ __exportAll({
+	PlatformApiError: () => PlatformApiError,
+	PlatformClient: () => PlatformClient,
+	isCliOutdatedError: () => isCliOutdatedError,
+	isExpiredTokenError: () => isExpiredTokenError,
+	readCliVersion: () => readCliVersion
+});
+/**
+* Current CLI version. Sent as `X-Void-CLI-Version` on every platform
+* request so the platform's CLI-version gate can refuse stale CLIs
+* cleanly (HTTP 426 + `cli_outdated`) instead of letting a wire
+* mismatch surface as an opaque parse error.
+*
+* Resolved once per process. Returns `null` when package.json can't be
+* read or has no `version` string — the ctor then OMITS the header
+* entirely. We deliberately do NOT send a placeholder string like
+* "unknown": the platform treats present-but-unparseable headers as a
+* stale-CLI signal and would 426 the request, bricking the CLI on any
+* packaging error. Missing-header is the documented pass-through path.
+*/
+function readCliVersion() {
+	try {
+		const pkgPath = join(getPackageDir(), "package.json");
+		const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
+		return typeof pkg.version === "string" ? pkg.version : null;
+	} catch {
+		return null;
+	}
+}
+const VOID_CLI_VERSION = readCliVersion();
+/**
+* Detects the `cli_outdated` 426 response shape emitted by the platform's
+* `cliVersionGate` middleware. When present, callers should surface the
+* server's `message` field verbatim — it already includes upgrade
+* instructions — rather than the default `<action>: <status> <body>`
+* which would dump raw JSON at the user.
+*/
+function isCliOutdatedError(err) {
+	if (!(err instanceof PlatformApiError)) return false;
+	if (err.status !== 426) return false;
+	return parsePlatformErrorBody(err.body)?.error === "cli_outdated";
+}
+var PlatformApiError = class extends Error {
+	status;
+	body;
+	code;
+	constructor(action, status, body, permission) {
+		const parsed = parsePlatformErrorBody(body);
+		super(formatPlatformApiError(action, status, body, permission));
+		this.name = "PlatformApiError";
+		this.status = status;
+		this.body = body;
+		this.code = parsed?.error ?? parsed?.message;
+	}
+};
+async function throwPlatformApiError(action, res, permission) {
+	throw new PlatformApiError(action, res.status, await res.text(), isCloudflareAccessChallenge(res) ? void 0 : permission);
+}
+function isExpiredTokenError(error) {
+	if (error instanceof PlatformApiError) return error.status === 401 && error.code === "invalid or expired token";
+	return false;
+}
+function isPreflightRejection(error) {
+	return error instanceof PlatformApiError && ([401, 403].includes(error.status) && !!parsePlatformErrorBody(error.body)?.error || isCliOutdatedError(error));
+}
+/**
+* Retry contract for the deploy POST's transport phase.
+*
+* - Only `fetch` rejections (`TypeError` — no HTTP response) are retried.
+*   A Response of any status means the server answered; surface it
+*   verbatim rather than replay a request it may have accepted.
+* - A rejected fetch does NOT prove the request never arrived — the
+*   connection may have dropped after delivery. Arbitration is left to
+*   the server's precheck, the only atomic (project-locked) verdict: if
+*   an earlier attempt or a concurrent deploy is still in flight, the
+*   replay is rejected with 409 and surfaced as a deploy conflict
+*   naming the deployment id. A client-side GET-then-decide lookup can
+*   never be authoritative (the row can transition between lookup and
+*   replay), so no dedupe query is made — the residual case is the lost
+*   attempt completing within seconds and being redeployed identically.
+*/
+const DEPLOY_POST_MAX_RETRIES = 3;
+const DEPLOY_POST_BACKOFF_MS = [
+	1e3,
+	5e3,
+	1e4
+];
+/**
+* HTTP client for the Void platform API.
+*/
+var PlatformClient = class {
+	baseUrl;
+	authHeaders;
+	accessHeaders;
+	cliLog;
+	apiUrl;
+	constructor(token, options) {
+		if (typeof options === "string") this.baseUrl = normalizePlatformApiUrl(options);
+		else {
+			this.baseUrl = normalizePlatformApiUrl(options?.apiUrl ?? getApiUrl(options?.root));
+			this.cliLog = options?.cliLog;
+		}
+		this.apiUrl = this.baseUrl;
+		ensureCloudflaredToken(this.baseUrl);
+		this.accessHeaders = cfAccessHeaders(process.env, this.baseUrl);
+		this.authHeaders = {
+			Authorization: `Bearer ${token}`,
+			...VOID_CLI_VERSION !== null && { "X-Void-CLI-Version": VOID_CLI_VERSION }
+		};
+	}
+	async request(url, options = {}) {
+		if (new URL(url).origin !== this.baseUrl) throw new Error("Platform credentials cannot be sent to another origin.");
+		if (!this.accessHeaders["CF-Access-Client-Id"]) ensureCloudflaredToken(this.baseUrl);
+		const send = () => {
+			const currentAccessHeaders = cfAccessHeaders(process.env, this.baseUrl);
+			const accessHeaders = this.accessHeaders["CF-Access-Client-Id"] ? this.accessHeaders : Object.keys(currentAccessHeaders).length > 0 ? currentAccessHeaders : this.accessHeaders;
+			return {
+				accessHeaders,
+				response: fetch(url, {
+					...options,
+					headers: {
+						...options.headers,
+						...accessHeaders
+					},
+					redirect: "manual"
+				})
+			};
+		};
+		const first = send();
+		const response = await first.response;
+		if (!isCloudflareAccessChallenge(response)) return response;
+		if (first.accessHeaders["CF-Access-Client-Id"]) return response;
+		await response.body?.cancel();
+		ensurePlatformAccessToken(this.baseUrl, true, false, first.accessHeaders["cf-access-token"]);
+		return send().response;
+	}
+	async startIdentityLink(connectionId) {
+		const response = await this.request(this.baseUrl + "/auth/link", {
+			method: "POST",
+			headers: {
+				...this.authHeaders,
+				"Content-Type": "application/json"
+			},
+			body: JSON.stringify({ connectionId })
+		});
+		if (!response.ok) await throwPlatformApiError("Failed to link login method", response);
+		const result = await response.json();
+		const url = new URL(result.url);
+		if (url.origin !== this.baseUrl || url.pathname !== "/auth/link" || url.username || url.password) throw new Error("auth: Invalid account-link URL from platform.");
+		return result;
+	}
+	async whoami() {
+		const res = await this.request(`${this.baseUrl}/me`, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to fetch user info", res);
+		return res.json();
+	}
+	async listProjects() {
+		const res = await this.request(`${this.baseUrl}/projects`, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to list projects", res);
+		return res.json();
+	}
+	async listProjectTokens(projectId) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/tokens`, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to list project tokens", res, "owner");
+		return res.json();
+	}
+	async createProjectToken(projectId, input) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/tokens`, {
+			method: "POST",
+			headers: {
+				...this.authHeaders,
+				"Content-Type": "application/json"
+			},
+			body: JSON.stringify(input)
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to create project token", res, "owner");
+		return res.json();
+	}
+	async listProjectMembers(projectId) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/members`, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to list project members", res, "read");
+		return (await res.json()).members;
+	}
+	async listProjectInvitations(projectId) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/invitations`, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to list project invitations", res, "members");
+		return (await res.json()).invitations;
+	}
+	async inviteProjectMember(projectId, email, role) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/invitations`, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				...this.authHeaders
+			},
+			body: JSON.stringify({
+				email,
+				role
+			})
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to invite project member", res, "members");
+		return res.json();
+	}
+	async renewProjectToken(projectId, credentialId, expiresInDays) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/tokens/${encodeURIComponent(credentialId)}/renew`, {
+			method: "POST",
+			headers: {
+				...this.authHeaders,
+				"Content-Type": "application/json"
+			},
+			body: JSON.stringify(expiresInDays ? { expiresInDays } : {})
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to renew project token", res, "owner");
+		return res.json();
+	}
+	async updateProjectMemberRole(projectId, userId, role) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/members/${encodeURIComponent(userId)}`, {
+			method: "PATCH",
+			headers: {
+				"Content-Type": "application/json",
+				...this.authHeaders
+			},
+			body: JSON.stringify({ role })
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to change project member role", res, "members");
+		return res.json();
+	}
+	async revokeProjectToken(projectId, credentialId) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/tokens/${encodeURIComponent(credentialId)}`, {
+			method: "DELETE",
+			headers: { ...this.authHeaders }
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to revoke project token", res, "owner");
+		return res.json();
+	}
+	async removeProjectMember(projectId, userId) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/members/${encodeURIComponent(userId)}`, {
+			method: "DELETE",
+			headers: { ...this.authHeaders }
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to remove project member", res, "members");
+	}
+	async revokeProjectInvitation(projectId, invitationId) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/invitations/${encodeURIComponent(invitationId)}`, {
+			method: "DELETE",
+			headers: { ...this.authHeaders }
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to revoke project invitation", res, "members");
+	}
+	async leaveProject(projectId) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/leave`, {
+			method: "POST",
+			headers: { ...this.authHeaders }
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to leave project", res);
+	}
+	async listPendingProjectInvitations() {
+		const res = await this.request(`${this.baseUrl}/me/project-invitations`, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to list pending project invitations", res);
+		return (await res.json()).invitations;
+	}
+	async respondToProjectInvitation(invitationId, action) {
+		const res = await this.request(`${this.baseUrl}/project-invitations/${encodeURIComponent(invitationId)}/${action}`, {
+			method: "POST",
+			headers: { ...this.authHeaders }
+		});
+		if (!res.ok) await throwPlatformApiError(`Failed to ${action} project invitation`, res);
+	}
+	async listDeployments(projectId) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/deployments`, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to list deployments", res, "read");
+		return res.json();
+	}
+	async rollback(projectId, deploymentId, options) {
+		const body = { deploymentId };
+		if (options?.allowDestructive && options.allowDestructive.length > 0) body.allowDestructive = options.allowDestructive;
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/rollback`, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				...this.authHeaders
+			},
+			body: JSON.stringify(body)
+		});
+		if (!res.ok) await throwPlatformApiError("Rollback failed", res, "deploy");
+		return res.json();
+	}
+	async cancelDeployment(projectId, deploymentId) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/deployments/${deploymentId}/cancel`, {
+			method: "POST",
+			headers: { ...this.authHeaders }
+		});
+		if (!res.ok) await throwPlatformApiError("Cancel deployment failed", res, "deploy");
+		return res.json();
+	}
+	async createProject(slug) {
+		const res = await this.request(`${this.baseUrl}/projects`, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				...this.authHeaders
+			},
+			body: JSON.stringify({ slug })
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to create project", res);
+		return res.json();
+	}
+	async preflight(projectId, assetManifest, hasWorker) {
+		const total = Object.keys(assetManifest).length;
+		try {
+			const res = await this.request(`${this.baseUrl}/projects/${projectId}/deploy/preflight`, {
+				method: "POST",
+				headers: {
+					"Content-Type": "application/json",
+					...this.authHeaders
+				},
+				body: JSON.stringify({
+					assetManifest,
+					...hasWorker && { hasWorker }
+				})
+			});
+			if (!res.ok) {
+				const error = new PlatformApiError("Preflight failed", res.status, await res.text(), isCloudflareAccessChallenge(res) ? void 0 : "deploy");
+				if (isPreflightRejection(error)) throw error;
+				return {
+					needed: Object.keys(assetManifest),
+					total,
+					skipped: 0
+				};
+			}
+			return res.json();
+		} catch (error) {
+			if (isPreflightRejection(error)) throw error;
+			return {
+				needed: Object.keys(assetManifest),
+				total,
+				skipped: 0
+			};
+		}
+	}
+	/**
+	* Request presigned R2 PUT URLs for a batch of assets. Each entry carries
+	* both `blake3` (storage key) and `md5` (wire-level integrity primitive)
+	* so the platform can sign a PUT URL that R2 enforces against the bytes
+	* the CLI is about to upload. See design doc 0068 for the full protocol.
+	*/
+	async requestUploadUrls(projectId, assets) {
+		const url = `${this.baseUrl}/projects/${projectId}/deploy/upload-urls`;
+		this.cliLog?.info("upload_urls_post", {
+			url,
+			assetCount: assets.length
+		});
+		const res = await this.request(url, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				...this.authHeaders
+			},
+			body: JSON.stringify({ assets })
+		});
+		const cfRay = res.headers.get("cf-ray");
+		const cfCacheStatus = res.headers.get("cf-cache-status");
+		this.cliLog?.info("upload_urls_response", {
+			status: res.status,
+			cfRay,
+			cfCacheStatus
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to request upload URLs", res, "deploy");
+		return (await res.json()).urls;
+	}
+	/**
+	* Manifest-only (direct-to-R2) deploy. POSTs a JSON body containing the
+	* deploy manifest, asset manifest (no asset bytes), and any worker module
+	* bytes (base64-encoded). Streams an NDJSON response that the caller can
+	* apply with the existing `applyDeployEvent` machinery.
+	*/
+	async *finalizeDeploy(projectId, payload) {
+		const url = `${this.baseUrl}/projects/${projectId}/deploy`;
+		yield* this.streamDeployRequest(url, projectId, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				...this.authHeaders
+			},
+			body: JSON.stringify(payload)
+		});
+	}
+	/**
+	* POST + NDJSON-stream-reader used by `finalizeDeploy()`. Captures
+	* `cf-ray` + `cf-cache-status` for postmortem correlation.
+	*/
+	async *streamDeployRequest(url, projectId, init) {
+		const cliLog = this.cliLog;
+		cliLog?.info("deploy_post", { url });
+		let res;
+		let attempt = 0;
+		while (true) try {
+			res = await this.request(url, init);
+			break;
+		} catch (err) {
+			if (!(err instanceof TypeError) || attempt >= DEPLOY_POST_MAX_RETRIES) {
+				cliLog?.error("deploy_fetch_rejected", err, {
+					url,
+					attempts: attempt + 1
+				});
+				throw err;
+			}
+			cliLog?.warn("deploy_fetch_retry", {
+				url,
+				attempt: attempt + 1,
+				delayMs: DEPLOY_POST_BACKOFF_MS[attempt],
+				error: err instanceof Error ? err.message : String(err)
+			});
+			await sleep(DEPLOY_POST_BACKOFF_MS[attempt]);
+			attempt++;
+		}
+		const cfRay = res.headers.get("cf-ray");
+		const cfCacheStatus = res.headers.get("cf-cache-status");
+		cliLog?.info("deploy_response", {
+			status: res.status,
+			cfRay,
+			cfCacheStatus,
+			contentType: res.headers.get("content-type")
+		});
+		if (!res.ok) {
+			const body = await res.text();
+			if (res.status === 409) {
+				const parsed = parsePlatformErrorBody(body);
+				if (parsed?.deployment) {
+					cliLog?.warn("deploy_conflict", {
+						url,
+						deploymentId: parsed.deployment,
+						error: parsed.error
+					});
+					yield {
+						event: "error",
+						step: "finalize",
+						message: `${platformErrorMessage(parsed) ?? platformErrorMessage({ message: parsed.error }) ?? "deploy in progress"}: deployment ${parsed.deployment} — it may be an earlier attempt of this deploy or a concurrent one; inspect with \`void project status\` before redeploying`
+					};
+					return;
+				}
+			}
+			throw new PlatformApiError("Deploy failed", res.status, body, isCloudflareAccessChallenge(res) ? void 0 : "deploy");
+		}
+		const reader = res.body.getReader();
+		const decoder = new TextDecoder();
+		let buffer = "";
+		let bytesRead = 0;
+		let firstByteAt = null;
+		const startedAt = Date.now();
+		let eventCount = 0;
+		let lastEventName = "<none>";
+		try {
+			while (true) {
+				const { done, value } = await reader.read();
+				if (done) {
+					cliLog?.info("deploy_stream_eof", {
+						bytesRead,
+						eventCount,
+						lastEvent: lastEventName
+					});
+					break;
+				}
+				if (firstByteAt === null) {
+					firstByteAt = Date.now() - startedAt;
+					cliLog?.info("deploy_stream_ttfb", { ttfbMs: firstByteAt });
+				}
+				bytesRead += value.byteLength;
+				buffer += decoder.decode(value, { stream: true });
+				let newlineIdx;
+				while ((newlineIdx = buffer.indexOf("\n")) !== -1) {
+					const line = buffer.slice(0, newlineIdx);
+					buffer = buffer.slice(newlineIdx + 1);
+					if (line.trim()) {
+						const event = JSON.parse(line);
+						eventCount++;
+						lastEventName = event.event ?? "<no-event-field>";
+						cliLog?.info("deploy_event", {
+							eventCount,
+							event: lastEventName,
+							raw: line.slice(0, 200)
+						});
+						yield event;
+					}
+				}
+			}
+		} catch (err) {
+			cliLog?.error("deploy_stream_error", err, {
+				bytesRead,
+				eventCount,
+				lastEvent: lastEventName
+			});
+			throw err;
+		}
+	}
+	async listSecrets(projectId) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/secrets`, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to list secrets", res, "configure");
+		return res.json();
+	}
+	async setSecret(projectId, name, value) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/secrets/${encodeURIComponent(name)}`, {
+			method: "PUT",
+			headers: {
+				"Content-Type": "application/json",
+				...this.authHeaders
+			},
+			body: JSON.stringify({ value })
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to set secret", res, "configure");
+		return res.json();
+	}
+	async deleteProject(projectId) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}`, {
+			method: "DELETE",
+			headers: { ...this.authHeaders }
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to delete project", res, "owner");
+		return res.json();
+	}
+	async getMigrationStatus(projectId, dialect) {
+		const url = new URL(`${this.baseUrl}/projects/${projectId}/migrations`);
+		if (dialect) url.searchParams.set("dialect", dialect);
+		const res = await this.request(url, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to get migration status", res, "read");
+		return res.json();
+	}
+	async applyRemoteMigrations(projectId, migrations) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/migrations/apply`, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				...this.authHeaders
+			},
+			body: JSON.stringify({ migrations })
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to apply remote migrations", res, "configure");
+		return res.json();
+	}
+	async renameMigrations(projectId, renames) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/migrations/rename`, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				...this.authHeaders
+			},
+			body: JSON.stringify({ renames })
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to rename remote migrations", res, "configure");
+		return res.json();
+	}
+	async addDomain(projectId, hostname) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/domains`, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				...this.authHeaders
+			},
+			body: JSON.stringify({ hostname })
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to add domain", res, "settings");
+		return res.json();
+	}
+	async listDomains(projectId) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/domains`, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to list domains", res, "read");
+		return res.json();
+	}
+	async getDomainStatus(projectId, domainId) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/domains/${domainId}`, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to get domain status", res, "read");
+		return res.json();
+	}
+	async removeDomain(projectId, domainId) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/domains/${domainId}`, {
+			method: "DELETE",
+			headers: { ...this.authHeaders }
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to remove domain", res, "settings");
+		return res.json();
+	}
+	async deleteSecret(projectId, name) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/secrets/${encodeURIComponent(name)}`, {
+			method: "DELETE",
+			headers: { ...this.authHeaders }
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to delete secret", res, "configure");
+		return res.json();
+	}
+	async getResources(projectId) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/resources`, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to get resources", res, "read");
+		return res.json();
+	}
+	async createPrerenderToken(projectId) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/prerender-token`, {
+			method: "POST",
+			headers: { ...this.authHeaders }
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to create prerender token", res, "deploy");
+		return (await res.json()).token;
+	}
+	async provisionDatabase(projectId, connectionString) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/database`, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				...this.authHeaders
+			},
+			body: JSON.stringify({ connectionString })
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to provision database", res, "configure");
+		return res.json();
+	}
+	async setDatabaseUrl(projectId, connectionString) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/database-url`, {
+			method: "PUT",
+			headers: {
+				"Content-Type": "application/json",
+				...this.authHeaders
+			},
+			body: JSON.stringify({ connectionString })
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to update database URL", res, "configure");
+		return res.json();
+	}
+	async getDatabaseUrl(projectId) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/database-url`, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to fetch database URL", res, "owner");
+		return res.json();
+	}
+	async purgeCache(projectId) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/revalidate`, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				...this.authHeaders
+			},
+			body: JSON.stringify({ all: true })
+		});
+		if (!res.ok) await throwPlatformApiError("Cache purge failed", res, "deploy");
+		return res.json();
+	}
+	async getLogs(projectId, since, limit = 200, deploymentId, level) {
+		const params = new URLSearchParams({
+			since,
+			limit: String(limit)
+		});
+		if (deploymentId) params.set("deploymentId", deploymentId);
+		if (level && level !== "all") params.set("level", level);
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/logs?${params}`, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to fetch logs", res, "read");
+		return (await res.json()).data;
+	}
+	async getRequests(projectId, since, limit = 200, status) {
+		const params = new URLSearchParams({
+			since,
+			limit: String(limit)
+		});
+		if (status && status !== "all") params.set("status", status);
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/requests?${params}`, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to fetch requests", res, "read");
+		return (await res.json()).data;
+	}
+	async listBuilds(projectId, limit = 20) {
+		const params = new URLSearchParams({ limit: String(limit) });
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/builds?${params}`, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to list builds", res, "read");
+		return (await res.json()).builds;
+	}
+	async getBuildLogs(projectId, buildId, since = 0) {
+		const params = new URLSearchParams({ since: String(since) });
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/builds/${buildId}/logs?${params}`, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to fetch build logs", res, "read");
+		return res.json();
+	}
+	async getGithubInstallUrl() {
+		const res = await this.request(`${this.baseUrl}/github/install-url`, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to get GitHub install URL", res);
+		return res.json();
+	}
+	async listGithubInstallations() {
+		const res = await this.request(`${this.baseUrl}/github/installations`, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to list GitHub installations", res);
+		return res.json();
+	}
+	async connectGithub(projectId, body) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/github`, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				...this.authHeaders
+			},
+			body: JSON.stringify(body)
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to connect GitHub repository", res, "settings");
+		return res.json();
+	}
+	/**
+	* Start the per-repo connect-authorization round-trip used by a non-owner org
+	* member (Task 7 platform contract). The callback redirects back to `redirect`
+	* with either `?connect_grant=<signed>` (proof of per-repo access) or
+	* `?error=repo_not_accessible`. Mirrors {@link getGithubLinkUrl} but carries
+	* the installation + repo the grant is scoped to.
+	*/
+	async getGithubConnectAuthorizeUrl(redirect, codeChallenge, installationId, repoFullName) {
+		const params = new URLSearchParams({
+			redirect,
+			code_challenge: codeChallenge,
+			code_challenge_method: "S256",
+			installationId,
+			repoFullName
+		});
+		const res = await this.request(`${this.baseUrl}/github/connect-authorize-url?${params}`, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to start GitHub connect authorization", res);
+		return res.json();
+	}
+	async getGithubConnection(projectId) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/github`, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to get GitHub connection", res, "read");
+		return res.json();
+	}
+	async updateGithubConnection(projectId, body) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/github`, {
+			method: "PATCH",
+			headers: {
+				"Content-Type": "application/json",
+				...this.authHeaders
+			},
+			body: JSON.stringify(body)
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to update GitHub connection", res, "settings");
+		return res.json();
+	}
+	async deleteGithubConnection(projectId) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/github`, {
+			method: "DELETE",
+			headers: { ...this.authHeaders }
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to disconnect GitHub repository", res, "settings");
+		return res.json();
+	}
+	async getGithubLinkUrl(redirect, codeChallenge) {
+		const params = new URLSearchParams({
+			redirect,
+			code_challenge: codeChallenge,
+			code_challenge_method: "S256"
+		});
+		const res = await this.request(`${this.baseUrl}/github/link-url?${params}`, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to start GitHub link", res);
+		return res.json();
+	}
+	async completeGithubLink(linkCode, codeVerifier) {
+		const res = await this.request(`${this.baseUrl}/github/link/complete`, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				...this.authHeaders
+			},
+			body: JSON.stringify({
+				link_code: linkCode,
+				code_verifier: codeVerifier
+			})
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to complete GitHub link", res);
+		return res.json();
+	}
+	async getGithubJoinUrl(redirect, codeChallenge) {
+		const params = new URLSearchParams({
+			redirect,
+			code_challenge: codeChallenge,
+			code_challenge_method: "S256"
+		});
+		const res = await this.request(`${this.baseUrl}/github/join-url?${params}`, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to start GitHub join", res);
+		return res.json();
+	}
+	async completeGithubJoin(joinCode, codeVerifier) {
+		const res = await this.request(`${this.baseUrl}/github/join/complete`, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				...this.authHeaders
+			},
+			body: JSON.stringify({
+				join_code: joinCode,
+				code_verifier: codeVerifier
+			})
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to complete GitHub join", res);
+		return res.json();
+	}
+	async getEmailUsage(projectId) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/email/usage`, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to fetch email usage", res, "read");
+		return res.json();
+	}
+	async getEmailLogs(projectId, limit) {
+		const url = new URL(`${this.baseUrl}/projects/${projectId}/email/logs`);
+		if (limit !== void 0) url.searchParams.set("limit", String(limit));
+		const res = await this.request(url, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to fetch email logs", res, "read");
+		return res.json();
+	}
+	async getEmailOperation(projectId, operationId) {
+		const res = await this.request(`${this.baseUrl}/projects/${encodeURIComponent(projectId)}/email/operations/${encodeURIComponent(operationId)}`, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to fetch email operation", res, "read");
+		return res.json();
+	}
+	async listEmailDestinations(projectId) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/email/destinations`, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to list email destinations", res, "read");
+		return res.json();
+	}
+	async addEmailDestination(projectId, address) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/email/destinations`, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				...this.authHeaders
+			},
+			body: JSON.stringify({ address })
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to add email destination", res, "settings");
+		return {
+			...await res.json(),
+			created: res.status === 201
+		};
+	}
+	async removeEmailDestination(projectId, destinationId) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/email/destinations/${destinationId}`, {
+			method: "DELETE",
+			headers: { ...this.authHeaders }
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to remove email destination", res, "settings");
+		return res.json();
+	}
+	/** Installation email settings the CLI reads before starting a credential flow. */
+	async getEmailSettings(projectId) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/email/settings`, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to read email settings", res, "read");
+		return res.json();
+	}
+	async listEmailDomains(projectId) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/email/domains`, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to list email domains", res, "read");
+		return res.json();
+	}
+	/** Submit a scoped token once; later operations address the domain without it. */
+	async addEmailDomain(projectId, input) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/email/domains`, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				...this.authHeaders
+			},
+			body: JSON.stringify({
+				domain: input.domain,
+				...input.apiToken !== void 0 ? { apiToken: input.apiToken } : {},
+				...input.attemptId !== void 0 ? { attemptId: input.attemptId } : {}
+			})
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to add email domain", res, "settings");
+		return res.json();
+	}
+	async getEmailDomain(projectId, domain) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/email/domains/${encodeURIComponent(domain)}`, { headers: { ...this.authHeaders } });
+		if (!res.ok) await throwPlatformApiError("Failed to fetch email domain status", res, "read");
+		return res.json();
+	}
+	/** Rotates the shared zone connection secret. */
+	async rotateEmailDomainSecret(projectId, domain, attemptId) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/email/domains/${encodeURIComponent(domain)}/rotate-secret`, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				...this.authHeaders
+			},
+			body: JSON.stringify({ attemptId })
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to rotate email connection secret", res, "settings");
+		return res.json();
+	}
+	async syncEmailDomain(projectId, domain) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/email/domains/${encodeURIComponent(domain)}/sync`, {
+			method: "POST",
+			headers: { ...this.authHeaders }
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to sync email domain", res, "settings");
+		return res.json();
+	}
+	async removeEmailDomain(projectId, domain) {
+		const res = await this.request(`${this.baseUrl}/projects/${projectId}/email/domains/${encodeURIComponent(domain)}`, {
+			method: "DELETE",
+			headers: { ...this.authHeaders }
+		});
+		if (!res.ok) await throwPlatformApiError("Failed to remove email domain", res, "settings");
+		return res.json();
+	}
+};
+function sleep(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+//#endregion
+export { isExpiredTokenError as a, isCliOutdatedError as i, PlatformClient as n, parsePlatformErrorBody as o, client_exports as r, platformErrorMessage as s, PlatformApiError as t };