void 0.27.0 → 0.28.0

package/dist/{client-DlDJuY0s.mjs → client-DM9Kcf4e.mjs}

@@ -1,10 +1,10 @@
-import { a as join } from "./dist-BVqXeR_h.mjs";
-import { c as normalizePlatformApiUrl } from "./platform-registry-Cjv2Qf0r.mjs";
-import { t as cfAccessHeaders } from "./cf-access-TWNzXltp.mjs";
-import { i as isCloudflareAccessChallenge, n as ensurePlatformAccessToken, t as ensureCloudflaredToken } from "./cf-access-BcIBSKqG.mjs";
-import { a as getApiUrl } from "./auth-Dn2vw-SG.mjs";
-import { n as getPackageDir } from "./agents-B_pX_HmQ.mjs";
-import { n as readPlatformDiscoveryResponse } from "./platform-discovery-DIYz8V63.mjs";
+import { a as join } from "./dist-ipQi0Q8y.mjs";
+import { c as normalizePlatformApiUrl } from "./platform-registry-B9mWX9LO.mjs";
+import { t as cfAccessHeaders } from "./cf-access-BM9G0lhO.mjs";
+import { r as isCloudflareAccessChallenge, t as ensurePlatformAccessToken } from "./cf-access-CWP4avfP.mjs";
+import { a as getApiUrl } from "./auth-B6iOCjKI.mjs";
+import { r as getPackageDir } from "./agents-CuNtT0D_.mjs";
+import { n as readPlatformDiscoveryResponse } from "./platform-discovery-CHhNs8Nn.mjs";
 import { readFileSync } from "node:fs";
 import { stripVTControlCharacters } from "node:util";
 //#region src/cli/platform-errors.ts
@@ -84,19 +84,6 @@ function formatPlatformApiError(action, status, body, permission) {
 }
 //#endregion
 //#region src/cli/client.ts
-/**
-* Current CLI version. Sent as `X-Void-CLI-Version` on every platform
-* request so the platform's CLI-version gate can refuse stale CLIs
-* cleanly (HTTP 426 + `cli_outdated`) instead of letting a wire
-* mismatch surface as an opaque parse error.
-*
-* Resolved once per process. Returns `null` when package.json can't be
-* read or has no `version` string — the ctor then OMITS the header
-* entirely. We deliberately do NOT send a placeholder string like
-* "unknown": the platform treats present-but-unparseable headers as a
-* stale-CLI signal and would 426 the request, bricking the CLI on any
-* packaging error. Missing-header is the documented pass-through path.
-*/
 function readCliVersion() {
 	try {
 		const pkgPath = join(getPackageDir(), "package.json");
@@ -108,7 +95,7 @@ function readCliVersion() {
 }
 const VOID_CLI_VERSION = readCliVersion();
 /** The oldest Void platform release this CLI supports. */
-const MIN_PLATFORM_VERSION = "0.27.0";
+const MIN_PLATFORM_VERSION = "0.28.0";
 const RELEASE_VERSION = /^(\d+)\.(\d+)\.(\d+)(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$/;
 /**
 * Version checks keyed by platform base URL. Every outcome (pass, inconclusive,
@@ -191,27 +178,6 @@ function isHeadersTimeoutError(error) {
 function isPreflightRejection(error) {
 	return error instanceof PlatformApiError && ([401, 403].includes(error.status) && !!parsePlatformErrorBody(error.body)?.error || isCliOutdatedError(error));
 }
-/**
-* Retry contract for the deploy POST's transport phase.
-*
-* - Only `fetch` rejections (`TypeError` — no HTTP response) are retried.
-*   A Response of any status means the server answered; surface it
-*   verbatim rather than replay a request it may have accepted.
-* - A headers timeout is retried too. Every attempt sends the same
-*   idempotency key, so once an earlier request has created its deployment,
-*   a receipt-aware platform answers the retry with that deployment's
-*   receipt and the CLI follows it to the real result.
-* - A rejected fetch does NOT prove the request never arrived — the
-*   connection may have dropped after delivery. Arbitration is left to
-*   the server's precheck, the only atomic (project-locked) verdict: if
-*   an earlier attempt or a concurrent deploy is still in flight, the
-*   replay is rejected with 409 and surfaced as a deploy conflict
-*   naming the deployment id. Receipt-aware platforms additionally bind
-*   the stable invocation key to the accepted artifact, so an accepted
-*   request can be recovered without creating another execution. Older
-*   platforms retain their concurrency guard. No client-side deployment
-*   lookup may authorize replay or identify an unrelated conflicting row.
-*/
 const DEPLOY_POST_MAX_RETRIES = 3;
 const DEPLOY_POST_BACKOFF_MS = [
 	1e3,
@@ -260,16 +226,11 @@ var PlatformClient = class {
 	* Only login uses it, so users can still sign in to an older platform.
 	*/
 	constructor(token, options) {
-		if (typeof options === "string") {
-			this.baseUrl = normalizePlatformApiUrl(options);
-			this.checkPlatformVersion = true;
-		} else {
-			this.baseUrl = normalizePlatformApiUrl(options?.apiUrl ?? getApiUrl(options?.root));
-			this.cliLog = options?.cliLog;
-			this.checkPlatformVersion = options?.checkPlatformVersion !== false;
-		}
+		this.baseUrl = normalizePlatformApiUrl(options?.apiUrl ?? getApiUrl(options?.root));
+		this.cliLog = options?.cliLog;
+		this.checkPlatformVersion = options?.checkPlatformVersion !== false;
 		this.apiUrl = this.baseUrl;
-		ensureCloudflaredToken(this.baseUrl);
+		ensurePlatformAccessToken(this.baseUrl);
 		this.accessHeaders = cfAccessHeaders(process.env, this.baseUrl);
 		this.authHeaders = {
 			Authorization: `Bearer ${token}`,
@@ -318,7 +279,7 @@ var PlatformClient = class {
 		}
 	}
 	async send(url, options) {
-		if (!this.accessHeaders["CF-Access-Client-Id"]) ensureCloudflaredToken(this.baseUrl);
+		if (!this.accessHeaders["CF-Access-Client-Id"]) ensurePlatformAccessToken(this.baseUrl);
 		const send = () => {
 			const currentAccessHeaders = cfAccessHeaders(process.env, this.baseUrl);
 			const accessHeaders = this.accessHeaders["CF-Access-Client-Id"] ? this.accessHeaders : Object.keys(currentAccessHeaders).length > 0 ? currentAccessHeaders : this.accessHeaders;
@@ -342,36 +303,41 @@ var PlatformClient = class {
 		ensurePlatformAccessToken(this.baseUrl, true, false, first.accessHeaders["cf-access-token"]);
 		return send().response;
 	}
+	/** Sends an authenticated request and throws `PlatformApiError` unless it succeeds. */
+	async call(url, action, options = {}) {
+		const { method, body, permission } = options;
+		const res = await this.request(url, {
+			...method !== void 0 && { method },
+			headers: body === void 0 ? { ...this.authHeaders } : {
+				"Content-Type": "application/json",
+				...this.authHeaders
+			},
+			...body !== void 0 && { body: JSON.stringify(body) }
+		});
+		if (!res.ok) await throwPlatformApiError(action, res, permission);
+		return res;
+	}
+	async json(url, action, options) {
+		return (await this.call(url, action, options)).json();
+	}
 	async startIdentityLink(connectionId) {
-		const response = await this.request(this.baseUrl + "/auth/link", {
+		const result = await this.json(`${this.baseUrl}/auth/link`, "Failed to link login method", {
 			method: "POST",
-			headers: {
-				...this.authHeaders,
-				"Content-Type": "application/json"
-			},
-			body: JSON.stringify({ connectionId })
+			body: { connectionId }
 		});
-		if (!response.ok) await throwPlatformApiError("Failed to link login method", response);
-		const result = await response.json();
 		const url = new URL(result.url);
 		if (url.origin !== this.baseUrl || url.pathname !== "/auth/link" || url.username || url.password) throw new Error("auth: Invalid account-link URL from platform.");
 		return result;
 	}
 	async whoami() {
-		const res = await this.request(`${this.baseUrl}/me`, { headers: { ...this.authHeaders } });
-		if (!res.ok) await throwPlatformApiError("Failed to fetch user info", res);
-		return res.json();
+		return this.json(`${this.baseUrl}/me`, "Failed to fetch user info");
 	}
 	async listProjects() {
-		const res = await this.request(`${this.baseUrl}/projects`, { headers: { ...this.authHeaders } });
-		if (!res.ok) await throwPlatformApiError("Failed to list projects", res);
-		return res.json();
+		return this.json(`${this.baseUrl}/projects`, "Failed to list projects");
 	}
 	/** A lightweight project list for interactive linking. */
 	async listProjectChoices() {
-		const res = await this.request(`${this.baseUrl}/projects/choices`, { headers: { ...this.authHeaders } });
-		if (!res.ok) await throwPlatformApiError("Failed to list project choices", res);
-		return res.json();
+		return this.json(`${this.baseUrl}/projects/choices`, "Failed to list project choices");
 	}
 	/** Resolve one known project without loading account-wide deployment and traffic summaries. */
 	async getProject(projectId) {
@@ -382,186 +348,118 @@ var PlatformClient = class {
 	}
 	/** Resolve a slug through the current platform contract. */
 	async findProjectBySlug(slug) {
-		const url = new URL(`${this.baseUrl}/projects/resolve`);
-		url.searchParams.set("slug", slug);
-		const res = await this.request(url.toString(), { headers: { ...this.authHeaders } });
-		if (!res.ok) await throwPlatformApiError("Failed to resolve project", res);
-		return (await res.json()).project;
+		return (await this.json(`${this.baseUrl}/projects/resolve?${new URLSearchParams({ slug })}`, "Failed to resolve project")).project;
 	}
 	async listProjectTokens(projectId) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/tokens`, { headers: { ...this.authHeaders } });
-		if (!res.ok) await throwPlatformApiError("Failed to list project tokens", res, "owner");
-		return res.json();
+		return this.json(`${this.baseUrl}/projects/${projectId}/tokens`, "Failed to list project tokens", { permission: "owner" });
 	}
 	async getProjectZeroTrust(projectId) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/zero-trust`, { headers: { ...this.authHeaders } });
-		if (!res.ok) await throwPlatformApiError("Failed to inspect project Zero Trust", res, "read");
-		return res.json();
+		return this.json(`${this.baseUrl}/projects/${projectId}/zero-trust`, "Failed to inspect project Zero Trust", { permission: "read" });
 	}
 	async setProjectZeroTrust(projectId, protectedProject) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/zero-trust`, {
+		return this.json(`${this.baseUrl}/projects/${projectId}/zero-trust`, "Failed to update project Zero Trust", {
 			method: "PUT",
-			headers: {
-				"Content-Type": "application/json",
-				...this.authHeaders
-			},
-			body: JSON.stringify({ protected: protectedProject })
+			body: { protected: protectedProject },
+			permission: "settings"
 		});
-		if (!res.ok) await throwPlatformApiError("Failed to update project Zero Trust", res, "settings");
-		return res.json();
 	}
 	async reconcileProjectZeroTrust(projectId) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/zero-trust/reconcile`, {
+		return this.json(`${this.baseUrl}/projects/${projectId}/zero-trust/reconcile`, "Failed to reconcile project Zero Trust", {
 			method: "POST",
-			headers: { ...this.authHeaders }
+			permission: "settings"
 		});
-		if (!res.ok) await throwPlatformApiError("Failed to reconcile project Zero Trust", res, "settings");
-		return res.json();
 	}
 	async createProjectToken(projectId, input) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/tokens`, {
+		return this.json(`${this.baseUrl}/projects/${projectId}/tokens`, "Failed to create project token", {
 			method: "POST",
-			headers: {
-				...this.authHeaders,
-				"Content-Type": "application/json"
-			},
-			body: JSON.stringify(input)
+			body: input,
+			permission: "owner"
 		});
-		if (!res.ok) await throwPlatformApiError("Failed to create project token", res, "owner");
-		return res.json();
 	}
 	async listProjectMembers(projectId) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/members`, { headers: { ...this.authHeaders } });
-		if (!res.ok) await throwPlatformApiError("Failed to list project members", res, "read");
-		const body = await res.json();
+		const body = await this.json(`${this.baseUrl}/projects/${projectId}/members`, "Failed to list project members", { permission: "read" });
 		return {
 			members: body.members,
 			...body.warnings ? { warnings: body.warnings } : {}
 		};
 	}
 	async listProjectInvitations(projectId) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/invitations`, { headers: { ...this.authHeaders } });
-		if (!res.ok) await throwPlatformApiError("Failed to list project invitations", res, "members");
-		return (await res.json()).invitations;
+		return (await this.json(`${this.baseUrl}/projects/${projectId}/invitations`, "Failed to list project invitations", { permission: "members" })).invitations;
 	}
 	async inviteProjectMember(projectId, email, role) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/invitations`, {
+		return this.json(`${this.baseUrl}/projects/${projectId}/invitations`, "Failed to invite project member", {
 			method: "POST",
-			headers: {
-				"Content-Type": "application/json",
-				...this.authHeaders
-			},
-			body: JSON.stringify({
+			body: {
 				email,
 				role
-			})
+			},
+			permission: "members"
 		});
-		if (!res.ok) await throwPlatformApiError("Failed to invite project member", res, "members");
-		return res.json();
 	}
 	async renewProjectToken(projectId, credentialId, expiresInDays) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/tokens/${encodeURIComponent(credentialId)}/renew`, {
+		return this.json(`${this.baseUrl}/projects/${projectId}/tokens/${encodeURIComponent(credentialId)}/renew`, "Failed to renew project token", {
 			method: "POST",
-			headers: {
-				...this.authHeaders,
-				"Content-Type": "application/json"
-			},
-			body: JSON.stringify(expiresInDays ? { expiresInDays } : {})
+			body: expiresInDays ? { expiresInDays } : {},
+			permission: "owner"
 		});
-		if (!res.ok) await throwPlatformApiError("Failed to renew project token", res, "owner");
-		return res.json();
 	}
 	async updateProjectMemberRole(projectId, userId, role) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/members/${encodeURIComponent(userId)}`, {
+		return this.json(`${this.baseUrl}/projects/${projectId}/members/${encodeURIComponent(userId)}`, "Failed to change project member role", {
 			method: "PATCH",
-			headers: {
-				"Content-Type": "application/json",
-				...this.authHeaders
-			},
-			body: JSON.stringify({ role })
+			body: { role },
+			permission: "members"
 		});
-		if (!res.ok) await throwPlatformApiError("Failed to change project member role", res, "members");
-		return res.json();
 	}
 	async revokeProjectToken(projectId, credentialId) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/tokens/${encodeURIComponent(credentialId)}`, {
+		return this.json(`${this.baseUrl}/projects/${projectId}/tokens/${encodeURIComponent(credentialId)}`, "Failed to revoke project token", {
 			method: "DELETE",
-			headers: { ...this.authHeaders }
+			permission: "owner"
 		});
-		if (!res.ok) await throwPlatformApiError("Failed to revoke project token", res, "owner");
-		return res.json();
 	}
 	async removeProjectMember(projectId, userId) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/members/${encodeURIComponent(userId)}`, {
+		await this.call(`${this.baseUrl}/projects/${projectId}/members/${encodeURIComponent(userId)}`, "Failed to remove project member", {
 			method: "DELETE",
-			headers: { ...this.authHeaders }
+			permission: "members"
 		});
-		if (!res.ok) await throwPlatformApiError("Failed to remove project member", res, "members");
 	}
 	async revokeProjectInvitation(projectId, invitationId) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/invitations/${encodeURIComponent(invitationId)}`, {
+		await this.call(`${this.baseUrl}/projects/${projectId}/invitations/${encodeURIComponent(invitationId)}`, "Failed to revoke project invitation", {
 			method: "DELETE",
-			headers: { ...this.authHeaders }
+			permission: "members"
 		});
-		if (!res.ok) await throwPlatformApiError("Failed to revoke project invitation", res, "members");
 	}
 	async leaveProject(projectId) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/leave`, {
-			method: "POST",
-			headers: { ...this.authHeaders }
-		});
-		if (!res.ok) await throwPlatformApiError("Failed to leave project", res);
+		await this.call(`${this.baseUrl}/projects/${projectId}/leave`, "Failed to leave project", { method: "POST" });
 	}
 	async listPendingProjectInvitations() {
-		const res = await this.request(`${this.baseUrl}/me/project-invitations`, { headers: { ...this.authHeaders } });
-		if (!res.ok) await throwPlatformApiError("Failed to list pending project invitations", res);
-		return (await res.json()).invitations;
+		return (await this.json(`${this.baseUrl}/me/project-invitations`, "Failed to list pending project invitations")).invitations;
 	}
 	async respondToProjectInvitation(invitationId, action) {
-		const res = await this.request(`${this.baseUrl}/project-invitations/${encodeURIComponent(invitationId)}/${action}`, {
-			method: "POST",
-			headers: { ...this.authHeaders }
-		});
-		if (!res.ok) await throwPlatformApiError(`Failed to ${action} project invitation`, res);
+		await this.call(`${this.baseUrl}/project-invitations/${encodeURIComponent(invitationId)}/${action}`, `Failed to ${action} project invitation`, { method: "POST" });
 	}
 	async listDeployments(projectId) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/deployments`, { headers: { ...this.authHeaders } });
-		if (!res.ok) await throwPlatformApiError("Failed to list deployments", res, "read");
-		return res.json();
+		return this.json(`${this.baseUrl}/projects/${projectId}/deployments`, "Failed to list deployments", { permission: "read" });
 	}
 	async rollback(projectId, deploymentId, options) {
 		const body = { deploymentId };
 		if (options?.allowDestructive && options.allowDestructive.length > 0) body.allowDestructive = options.allowDestructive;
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/rollback`, {
+		return this.json(`${this.baseUrl}/projects/${projectId}/rollback`, "Rollback failed", {
 			method: "POST",
-			headers: {
-				"Content-Type": "application/json",
-				...this.authHeaders
-			},
-			body: JSON.stringify(body)
+			body,
+			permission: "deploy"
 		});
-		if (!res.ok) await throwPlatformApiError("Rollback failed", res, "deploy");
-		return res.json();
 	}
 	async cancelDeployment(projectId, deploymentId) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/deployments/${deploymentId}/cancel`, {
+		return this.json(`${this.baseUrl}/projects/${projectId}/deployments/${deploymentId}/cancel`, "Cancel deployment failed", {
 			method: "POST",
-			headers: { ...this.authHeaders }
+			permission: "deploy"
 		});
-		if (!res.ok) await throwPlatformApiError("Cancel deployment failed", res, "deploy");
-		return res.json();
 	}
 	async createProject(slug) {
-		const res = await this.request(`${this.baseUrl}/projects`, {
+		return this.json(`${this.baseUrl}/projects`, "Failed to create project", {
 			method: "POST",
-			headers: {
-				"Content-Type": "application/json",
-				...this.authHeaders
-			},
-			body: JSON.stringify({ slug })
+			body: { slug }
 		});
-		if (!res.ok) await throwPlatformApiError("Failed to create project", res);
-		return res.json();
 	}
 	async preflight(projectId, assetManifest, hasWorker) {
 		const total = Object.keys(assetManifest).length;
@@ -596,12 +494,6 @@ var PlatformClient = class {
 			};
 		}
 	}
-	/**
-	* Request presigned R2 PUT URLs for a batch of assets. Each entry carries
-	* both `blake3` (storage key) and `md5` (wire-level integrity primitive)
-	* so the platform can sign a PUT URL that R2 enforces against the bytes
-	* the CLI is about to upload. See design doc 0068 for the full protocol.
-	*/
 	async requestUploadUrls(projectId, assets) {
 		const url = `${this.baseUrl}/projects/${projectId}/deploy/upload-urls`;
 		this.cliLog?.info("upload_urls_post", {
@@ -626,12 +518,6 @@ var PlatformClient = class {
 		if (!res.ok) await throwPlatformApiError("Failed to request upload URLs", res, "deploy");
 		return (await res.json()).urls;
 	}
-	/**
-	* Manifest-only (direct-to-R2) deploy. POSTs a JSON body containing the
-	* deploy manifest, asset manifest (no asset bytes), and any worker module
-	* bytes (base64-encoded). Streams an NDJSON response that the caller can
-	* apply with the existing `applyDeployEvent` machinery.
-	*/
 	async *finalizeDeploy(projectId, payload) {
 		const url = `${this.baseUrl}/projects/${projectId}/deploy`;
 		yield* this.streamDeployRequest(url, projectId, {
@@ -644,10 +530,6 @@ var PlatformClient = class {
 			body: JSON.stringify(payload)
 		});
 	}
-	/**
-	* POST + NDJSON-stream-reader used by `finalizeDeploy()`. Captures
-	* `cf-ray` + `cf-cache-status` for postmortem correlation.
-	*/
 	async *streamDeployRequest(url, projectId, init) {
 		const cliLog = this.cliLog;
 		cliLog?.info("deploy_post", { url });
@@ -857,152 +739,97 @@ var PlatformClient = class {
 		throw new DeploymentObservationTimeoutError(deploymentId);
 	}
 	async listSecrets(projectId) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/secrets`, { headers: { ...this.authHeaders } });
-		if (!res.ok) await throwPlatformApiError("Failed to list secrets", res, "configure");
-		return res.json();
+		return this.json(`${this.baseUrl}/projects/${projectId}/secrets`, "Failed to list secrets", { permission: "configure" });
 	}
 	async setSecret(projectId, name, value) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/secrets/${encodeURIComponent(name)}`, {
+		return this.json(`${this.baseUrl}/projects/${projectId}/secrets/${encodeURIComponent(name)}`, "Failed to set secret", {
 			method: "PUT",
-			headers: {
-				"Content-Type": "application/json",
-				...this.authHeaders
-			},
-			body: JSON.stringify({ value })
+			body: { value },
+			permission: "configure"
 		});
-		if (!res.ok) await throwPlatformApiError("Failed to set secret", res, "configure");
-		return res.json();
 	}
 	async deleteProject(projectId) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}`, {
+		return this.json(`${this.baseUrl}/projects/${projectId}`, "Failed to delete project", {
 			method: "DELETE",
-			headers: { ...this.authHeaders }
+			permission: "owner"
 		});
-		if (!res.ok) await throwPlatformApiError("Failed to delete project", res, "owner");
-		return res.json();
 	}
 	async getMigrationStatus(projectId, dialect) {
 		const url = new URL(`${this.baseUrl}/projects/${projectId}/migrations`);
 		if (dialect) url.searchParams.set("dialect", dialect);
-		const res = await this.request(url, { headers: { ...this.authHeaders } });
-		if (!res.ok) await throwPlatformApiError("Failed to get migration status", res, "read");
-		return res.json();
+		return this.json(url, "Failed to get migration status", { permission: "read" });
 	}
 	async applyRemoteMigrations(projectId, migrations) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/migrations/apply`, {
+		return this.json(`${this.baseUrl}/projects/${projectId}/migrations/apply`, "Failed to apply remote migrations", {
 			method: "POST",
-			headers: {
-				"Content-Type": "application/json",
-				...this.authHeaders
-			},
-			body: JSON.stringify({ migrations })
+			body: { migrations },
+			permission: "configure"
 		});
-		if (!res.ok) await throwPlatformApiError("Failed to apply remote migrations", res, "configure");
-		return res.json();
 	}
 	async renameMigrations(projectId, renames) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/migrations/rename`, {
+		return this.json(`${this.baseUrl}/projects/${projectId}/migrations/rename`, "Failed to rename remote migrations", {
 			method: "POST",
-			headers: {
-				"Content-Type": "application/json",
-				...this.authHeaders
-			},
-			body: JSON.stringify({ renames })
+			body: { renames },
+			permission: "configure"
 		});
-		if (!res.ok) await throwPlatformApiError("Failed to rename remote migrations", res, "configure");
-		return res.json();
 	}
 	async addDomain(projectId, hostname) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/domains`, {
+		return this.json(`${this.baseUrl}/projects/${projectId}/domains`, "Failed to add domain", {
 			method: "POST",
-			headers: {
-				"Content-Type": "application/json",
-				...this.authHeaders
-			},
-			body: JSON.stringify({ hostname })
+			body: { hostname },
+			permission: "settings"
 		});
-		if (!res.ok) await throwPlatformApiError("Failed to add domain", res, "settings");
-		return res.json();
 	}
 	async listDomains(projectId) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/domains`, { headers: { ...this.authHeaders } });
-		if (!res.ok) await throwPlatformApiError("Failed to list domains", res, "read");
-		return res.json();
+		return this.json(`${this.baseUrl}/projects/${projectId}/domains`, "Failed to list domains", { permission: "read" });
 	}
 	async getDomainStatus(projectId, domainId) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/domains/${domainId}`, { headers: { ...this.authHeaders } });
-		if (!res.ok) await throwPlatformApiError("Failed to get domain status", res, "read");
-		return res.json();
+		return this.json(`${this.baseUrl}/projects/${projectId}/domains/${domainId}`, "Failed to get domain status", { permission: "read" });
 	}
 	async removeDomain(projectId, domainId) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/domains/${domainId}`, {
+		return this.json(`${this.baseUrl}/projects/${projectId}/domains/${domainId}`, "Failed to remove domain", {
 			method: "DELETE",
-			headers: { ...this.authHeaders }
+			permission: "settings"
 		});
-		if (!res.ok) await throwPlatformApiError("Failed to remove domain", res, "settings");
-		return res.json();
 	}
 	async deleteSecret(projectId, name) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/secrets/${encodeURIComponent(name)}`, {
+		return this.json(`${this.baseUrl}/projects/${projectId}/secrets/${encodeURIComponent(name)}`, "Failed to delete secret", {
 			method: "DELETE",
-			headers: { ...this.authHeaders }
+			permission: "configure"
 		});
-		if (!res.ok) await throwPlatformApiError("Failed to delete secret", res, "configure");
-		return res.json();
 	}
 	async getResources(projectId) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/resources`, { headers: { ...this.authHeaders } });
-		if (!res.ok) await throwPlatformApiError("Failed to get resources", res, "read");
-		return res.json();
+		return this.json(`${this.baseUrl}/projects/${projectId}/resources`, "Failed to get resources", { permission: "read" });
 	}
 	async createPrerenderToken(projectId) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/prerender-token`, {
+		return (await this.json(`${this.baseUrl}/projects/${projectId}/prerender-token`, "Failed to create prerender token", {
 			method: "POST",
-			headers: { ...this.authHeaders }
-		});
-		if (!res.ok) await throwPlatformApiError("Failed to create prerender token", res, "deploy");
-		return (await res.json()).token;
+			permission: "deploy"
+		})).token;
 	}
 	async provisionDatabase(projectId, connectionString) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/database`, {
+		return this.json(`${this.baseUrl}/projects/${projectId}/database`, "Failed to provision database", {
 			method: "POST",
-			headers: {
-				"Content-Type": "application/json",
-				...this.authHeaders
-			},
-			body: JSON.stringify({ connectionString })
+			body: { connectionString },
+			permission: "configure"
 		});
-		if (!res.ok) await throwPlatformApiError("Failed to provision database", res, "configure");
-		return res.json();
 	}
 	async setDatabaseUrl(projectId, connectionString) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/database-url`, {
+		return this.json(`${this.baseUrl}/projects/${projectId}/database-url`, "Failed to update database URL", {
 			method: "PUT",
-			headers: {
-				"Content-Type": "application/json",
-				...this.authHeaders
-			},
-			body: JSON.stringify({ connectionString })
+			body: { connectionString },
+			permission: "configure"
 		});
-		if (!res.ok) await throwPlatformApiError("Failed to update database URL", res, "configure");
-		return res.json();
 	}
 	async getDatabaseUrl(projectId) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/database-url`, { headers: { ...this.authHeaders } });
-		if (!res.ok) await throwPlatformApiError("Failed to fetch database URL", res, "owner");
-		return res.json();
+		return this.json(`${this.baseUrl}/projects/${projectId}/database-url`, "Failed to fetch database URL", { permission: "owner" });
 	}
 	async purgeCache(projectId) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/revalidate`, {
+		return this.json(`${this.baseUrl}/projects/${projectId}/revalidate`, "Cache purge failed", {
 			method: "POST",
-			headers: {
-				"Content-Type": "application/json",
-				...this.authHeaders
-			},
-			body: JSON.stringify({ all: true })
+			body: { all: true },
+			permission: "deploy"
 		});
-		if (!res.ok) await throwPlatformApiError("Cache purge failed", res, "deploy");
-		return res.json();
 	}
 	async getLogs(projectId, since, limit = 200, deploymentId, level) {
 		const params = new URLSearchParams({
@@ -1011,9 +838,7 @@ var PlatformClient = class {
 		});
 		if (deploymentId) params.set("deploymentId", deploymentId);
 		if (level && level !== "all") params.set("level", level);
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/logs?${params}`, { headers: { ...this.authHeaders } });
-		if (!res.ok) await throwPlatformApiError("Failed to fetch logs", res, "read");
-		return (await res.json()).data;
+		return (await this.json(`${this.baseUrl}/projects/${projectId}/logs?${params}`, "Failed to fetch logs", { permission: "read" })).data;
 	}
 	async getRequests(projectId, since, limit = 200, status) {
 		const params = new URLSearchParams({
@@ -1021,50 +846,32 @@ var PlatformClient = class {
 			limit: String(limit)
 		});
 		if (status && status !== "all") params.set("status", status);
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/requests?${params}`, { headers: { ...this.authHeaders } });
-		if (!res.ok) await throwPlatformApiError("Failed to fetch requests", res, "read");
-		return (await res.json()).data;
+		return (await this.json(`${this.baseUrl}/projects/${projectId}/requests?${params}`, "Failed to fetch requests", { permission: "read" })).data;
 	}
 	async listBuilds(projectId, limit = 20) {
 		const params = new URLSearchParams({ limit: String(limit) });
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/builds?${params}`, { headers: { ...this.authHeaders } });
-		if (!res.ok) await throwPlatformApiError("Failed to list builds", res, "read");
-		return (await res.json()).builds;
+		return (await this.json(`${this.baseUrl}/projects/${projectId}/builds?${params}`, "Failed to list builds", { permission: "read" })).builds;
 	}
 	async getBuildLogs(projectId, buildId, since = 0) {
 		const params = new URLSearchParams({ since: String(since) });
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/builds/${buildId}/logs?${params}`, { headers: { ...this.authHeaders } });
-		if (!res.ok) await throwPlatformApiError("Failed to fetch build logs", res, "read");
-		return res.json();
+		return this.json(`${this.baseUrl}/projects/${projectId}/builds/${buildId}/logs?${params}`, "Failed to fetch build logs", { permission: "read" });
 	}
 	async getGithubInstallUrl() {
-		const res = await this.request(`${this.baseUrl}/github/install-url`, { headers: { ...this.authHeaders } });
-		if (!res.ok) await throwPlatformApiError("Failed to get GitHub install URL", res);
-		return res.json();
+		return this.json(`${this.baseUrl}/github/install-url`, "Failed to get GitHub install URL");
 	}
 	async listGithubInstallations() {
-		const res = await this.request(`${this.baseUrl}/github/installations`, { headers: { ...this.authHeaders } });
-		if (!res.ok) await throwPlatformApiError("Failed to list GitHub installations", res);
-		return res.json();
+		return this.json(`${this.baseUrl}/github/installations`, "Failed to list GitHub installations");
 	}
 	async connectGithub(projectId, body) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/github`, {
+		return this.json(`${this.baseUrl}/projects/${projectId}/github`, "Failed to connect GitHub repository", {
 			method: "POST",
-			headers: {
-				"Content-Type": "application/json",
-				...this.authHeaders
-			},
-			body: JSON.stringify(body)
+			body,
+			permission: "settings"
 		});
-		if (!res.ok) await throwPlatformApiError("Failed to connect GitHub repository", res, "settings");
-		return res.json();
 	}
 	/**
-	* Start the per-repo connect-authorization round-trip used by a non-owner org
-	* member. The callback redirects back to `redirect`
-	* with either `?connect_grant=<signed>` (proof of per-repo access) or
-	* `?error=repo_not_accessible`. Mirrors {@link getGithubLinkUrl} but carries
-	* the installation + repo the grant is scoped to.
+	* Start the per-repo connect authorization for a non-owner org member. The
+	* callback carries `?connect_grant=<signed>` or `?error=repo_not_accessible`.
 	*/
 	async getGithubConnectAuthorizeUrl(redirect, codeChallenge, installationId, repoFullName) {
 		const params = new URLSearchParams({
@@ -1074,34 +881,23 @@ var PlatformClient = class {
 			installationId,
 			repoFullName
 		});
-		const res = await this.request(`${this.baseUrl}/github/connect-authorize-url?${params}`, { headers: { ...this.authHeaders } });
-		if (!res.ok) await throwPlatformApiError("Failed to start GitHub connect authorization", res);
-		return res.json();
+		return this.json(`${this.baseUrl}/github/connect-authorize-url?${params}`, "Failed to start GitHub connect authorization");
 	}
 	async getGithubConnection(projectId) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/github`, { headers: { ...this.authHeaders } });
-		if (!res.ok) await throwPlatformApiError("Failed to get GitHub connection", res, "read");
-		return res.json();
+		return this.json(`${this.baseUrl}/projects/${projectId}/github`, "Failed to get GitHub connection", { permission: "read" });
 	}
 	async updateGithubConnection(projectId, body) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/github`, {
+		return this.json(`${this.baseUrl}/projects/${projectId}/github`, "Failed to update GitHub connection", {
 			method: "PATCH",
-			headers: {
-				"Content-Type": "application/json",
-				...this.authHeaders
-			},
-			body: JSON.stringify(body)
+			body,
+			permission: "settings"
 		});
-		if (!res.ok) await throwPlatformApiError("Failed to update GitHub connection", res, "settings");
-		return res.json();
 	}
 	async deleteGithubConnection(projectId) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/github`, {
+		return this.json(`${this.baseUrl}/projects/${projectId}/github`, "Failed to disconnect GitHub repository", {
 			method: "DELETE",
-			headers: { ...this.authHeaders }
+			permission: "settings"
 		});
-		if (!res.ok) await throwPlatformApiError("Failed to disconnect GitHub repository", res, "settings");
-		return res.json();
 	}
 	async getGithubLinkUrl(redirect, codeChallenge) {
 		const params = new URLSearchParams({
@@ -1109,24 +905,16 @@ var PlatformClient = class {
 			code_challenge: codeChallenge,
 			code_challenge_method: "S256"
 		});
-		const res = await this.request(`${this.baseUrl}/github/link-url?${params}`, { headers: { ...this.authHeaders } });
-		if (!res.ok) await throwPlatformApiError("Failed to start GitHub link", res);
-		return res.json();
+		return this.json(`${this.baseUrl}/github/link-url?${params}`, "Failed to start GitHub link");
 	}
 	async completeGithubLink(linkCode, codeVerifier) {
-		const res = await this.request(`${this.baseUrl}/github/link/complete`, {
+		return this.json(`${this.baseUrl}/github/link/complete`, "Failed to complete GitHub link", {
 			method: "POST",
-			headers: {
-				"Content-Type": "application/json",
-				...this.authHeaders
-			},
-			body: JSON.stringify({
+			body: {
 				link_code: linkCode,
 				code_verifier: codeVerifier
-			})
+			}
 		});
-		if (!res.ok) await throwPlatformApiError("Failed to complete GitHub link", res);
-		return res.json();
 	}
 	async getGithubJoinUrl(redirect, codeChallenge) {
 		const params = new URLSearchParams({
@@ -1134,135 +922,93 @@ var PlatformClient = class {
 			code_challenge: codeChallenge,
 			code_challenge_method: "S256"
 		});
-		const res = await this.request(`${this.baseUrl}/github/join-url?${params}`, { headers: { ...this.authHeaders } });
-		if (!res.ok) await throwPlatformApiError("Failed to start GitHub join", res);
-		return res.json();
+		return this.json(`${this.baseUrl}/github/join-url?${params}`, "Failed to start GitHub join");
 	}
 	async completeGithubJoin(joinCode, codeVerifier) {
-		const res = await this.request(`${this.baseUrl}/github/join/complete`, {
+		return this.json(`${this.baseUrl}/github/join/complete`, "Failed to complete GitHub join", {
 			method: "POST",
-			headers: {
-				"Content-Type": "application/json",
-				...this.authHeaders
-			},
-			body: JSON.stringify({
+			body: {
 				join_code: joinCode,
 				code_verifier: codeVerifier
-			})
+			}
 		});
-		if (!res.ok) await throwPlatformApiError("Failed to complete GitHub join", res);
-		return res.json();
 	}
 	async getEmailUsage(projectId) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/email/usage`, { headers: { ...this.authHeaders } });
-		if (!res.ok) await throwPlatformApiError("Failed to fetch email usage", res, "read");
-		return res.json();
+		return this.json(`${this.baseUrl}/projects/${projectId}/email/usage`, "Failed to fetch email usage", { permission: "read" });
 	}
 	async getEmailLogs(projectId, limit) {
 		const url = new URL(`${this.baseUrl}/projects/${projectId}/email/logs`);
 		if (limit !== void 0) url.searchParams.set("limit", String(limit));
-		const res = await this.request(url, { headers: { ...this.authHeaders } });
-		if (!res.ok) await throwPlatformApiError("Failed to fetch email logs", res, "read");
-		return res.json();
+		return this.json(url, "Failed to fetch email logs", { permission: "read" });
 	}
 	async getEmailOperation(projectId, operationId) {
-		const res = await this.request(`${this.baseUrl}/projects/${encodeURIComponent(projectId)}/email/operations/${encodeURIComponent(operationId)}`, { headers: { ...this.authHeaders } });
-		if (!res.ok) await throwPlatformApiError("Failed to fetch email operation", res, "read");
-		return res.json();
+		return this.json(`${this.baseUrl}/projects/${encodeURIComponent(projectId)}/email/operations/${encodeURIComponent(operationId)}`, "Failed to fetch email operation", { permission: "read" });
 	}
 	async listEmailDestinations(projectId) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/email/destinations`, { headers: { ...this.authHeaders } });
-		if (!res.ok) await throwPlatformApiError("Failed to list email destinations", res, "read");
-		return res.json();
+		return this.json(`${this.baseUrl}/projects/${projectId}/email/destinations`, "Failed to list email destinations", { permission: "read" });
 	}
 	async addEmailDestination(projectId, address) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/email/destinations`, {
+		const res = await this.call(`${this.baseUrl}/projects/${projectId}/email/destinations`, "Failed to add email destination", {
 			method: "POST",
-			headers: {
-				"Content-Type": "application/json",
-				...this.authHeaders
-			},
-			body: JSON.stringify({ address })
+			body: { address },
+			permission: "settings"
 		});
-		if (!res.ok) await throwPlatformApiError("Failed to add email destination", res, "settings");
 		return {
 			...await res.json(),
 			created: res.status === 201
 		};
 	}
 	async removeEmailDestination(projectId, destinationId) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/email/destinations/${destinationId}`, {
+		return this.json(`${this.baseUrl}/projects/${projectId}/email/destinations/${destinationId}`, "Failed to remove email destination", {
 			method: "DELETE",
-			headers: { ...this.authHeaders }
+			permission: "settings"
 		});
-		if (!res.ok) await throwPlatformApiError("Failed to remove email destination", res, "settings");
-		return res.json();
 	}
 	/** Installation email settings the CLI reads before starting a credential flow. */
 	async getEmailSettings(projectId) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/email/settings`, { headers: { ...this.authHeaders } });
-		if (!res.ok) await throwPlatformApiError("Failed to read email settings", res, "read");
-		return res.json();
+		return this.json(`${this.baseUrl}/projects/${projectId}/email/settings`, "Failed to read email settings", { permission: "read" });
 	}
 	async listEmailDomains(projectId) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/email/domains`, { headers: { ...this.authHeaders } });
-		if (!res.ok) await throwPlatformApiError("Failed to list email domains", res, "read");
-		return res.json();
+		return this.json(`${this.baseUrl}/projects/${projectId}/email/domains`, "Failed to list email domains", { permission: "read" });
 	}
 	/** Submit a scoped token once; later operations address the domain without it. */
 	async addEmailDomain(projectId, input) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/email/domains`, {
+		return this.json(`${this.baseUrl}/projects/${projectId}/email/domains`, "Failed to add email domain", {
 			method: "POST",
-			headers: {
-				"Content-Type": "application/json",
-				...this.authHeaders
-			},
-			body: JSON.stringify({
+			body: {
 				domain: input.domain,
 				...input.apiToken !== void 0 ? { apiToken: input.apiToken } : {},
 				...input.attemptId !== void 0 ? { attemptId: input.attemptId } : {}
-			})
+			},
+			permission: "settings"
 		});
-		if (!res.ok) await throwPlatformApiError("Failed to add email domain", res, "settings");
-		return res.json();
 	}
 	async getEmailDomain(projectId, domain) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/email/domains/${encodeURIComponent(domain)}`, { headers: { ...this.authHeaders } });
-		if (!res.ok) await throwPlatformApiError("Failed to fetch email domain status", res, "read");
-		return res.json();
+		return this.json(`${this.baseUrl}/projects/${projectId}/email/domains/${encodeURIComponent(domain)}`, "Failed to fetch email domain status", { permission: "read" });
 	}
 	/** Rotates the shared zone connection secret. */
 	async rotateEmailDomainSecret(projectId, domain, attemptId) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/email/domains/${encodeURIComponent(domain)}/rotate-secret`, {
+		return this.json(`${this.baseUrl}/projects/${projectId}/email/domains/${encodeURIComponent(domain)}/rotate-secret`, "Failed to rotate email connection secret", {
 			method: "POST",
-			headers: {
-				"Content-Type": "application/json",
-				...this.authHeaders
-			},
-			body: JSON.stringify({ attemptId })
+			body: { attemptId },
+			permission: "settings"
 		});
-		if (!res.ok) await throwPlatformApiError("Failed to rotate email connection secret", res, "settings");
-		return res.json();
 	}
 	async syncEmailDomain(projectId, domain) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/email/domains/${encodeURIComponent(domain)}/sync`, {
+		return this.json(`${this.baseUrl}/projects/${projectId}/email/domains/${encodeURIComponent(domain)}/sync`, "Failed to sync email domain", {
 			method: "POST",
-			headers: { ...this.authHeaders }
+			permission: "settings"
 		});
-		if (!res.ok) await throwPlatformApiError("Failed to sync email domain", res, "settings");
-		return res.json();
 	}
 	async removeEmailDomain(projectId, domain) {
-		const res = await this.request(`${this.baseUrl}/projects/${projectId}/email/domains/${encodeURIComponent(domain)}`, {
+		return this.json(`${this.baseUrl}/projects/${projectId}/email/domains/${encodeURIComponent(domain)}`, "Failed to remove email domain", {
 			method: "DELETE",
-			headers: { ...this.authHeaders }
+			permission: "settings"
 		});
-		if (!res.ok) await throwPlatformApiError("Failed to remove email domain", res, "settings");
-		return res.json();
 	}
 };
 function sleep(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
 //#endregion
-export { isExpiredTokenError as a, parsePlatformErrorBody as c, isCliOutdatedError as i, platformErrorMessage as l, PlatformApiError as n, isHeadersTimeoutError as o, PlatformClient as r, readCliVersion as s, MIN_PLATFORM_VERSION as t };
+export { isExpiredTokenError as a, platformErrorMessage as c, isCliOutdatedError as i, PlatformApiError as n, isHeadersTimeoutError as o, PlatformClient as r, parsePlatformErrorBody as s, MIN_PLATFORM_VERSION as t };