@catalyst-cloud/cli 0.14.4 → 0.14.6

package/dist/onboard-workspace.js

@@ -3,49 +3,90 @@ import { pollConsent } from "./onboard-consent.js";
 const STATUS = "/api/v1/me/connections/linear/workspace";
 const HANDOFF = "/connect/linear/workspace/handoff";
 const idPattern = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
-const states = new Set(["connected", "missing-scope", "expired-or-revoked", "unreachable", "not-connected"]);
-const warmth = new Set(["warm", "absent", "expired", "renewal-due", "no-expiry", "unavailable"]);
-const object = (v) => v !== null && typeof v === "object" && !Array.isArray(v) ? v : null;
-const waiting = (reason) => ({ state: "waiting", reason });
+const states = new Set([
+    "connected",
+    "missing-scope",
+    "expired-or-revoked",
+    "unreachable",
+    "not-connected",
+]);
+const warmth = new Set([
+    "warm",
+    "absent",
+    "expired",
+    "renewal-due",
+    "no-expiry",
+    "unavailable",
+]);
+const object = (v) => v !== null && typeof v === "object" && !Array.isArray(v)
+    ? v
+    : null;
+const waiting = (reason) => ({
+    state: "waiting",
+    reason,
+});
 const nullableText = (v) => v === null || typeof v === "string";
-const nullableTime = (v) => v === null || typeof v === "number" && Number.isFinite(v) && v >= 0;
+const nullableTime = (v) => v === null || (typeof v === "number" && Number.isFinite(v) && v >= 0);
 /** A bounded read never rotates credentials or writes a token after the receipt lock is released. */
 async function read(ctx, journal, path, timeoutMs, external) {
     const cfg = loadConfig(ctx.home);
     if (!cfg?.user)
         return { reason: "personal_login_required" };
-    if ((journal.account ?? journal.tenant) && (journal.account ?? journal.tenant) !== cfg.account ||
-        journal.membershipId && journal.membershipId !== cfg.user.id ||
-        journal.baseUrl && normalizeBaseUrl(journal.baseUrl) !== normalizeBaseUrl(cfg.baseUrl))
+    if (((journal.account ?? journal.tenant) &&
+        (journal.account ?? journal.tenant) !== cfg.account) ||
+        (journal.membershipId && journal.membershipId !== cfg.user.id) ||
+        (journal.baseUrl &&
+            normalizeBaseUrl(journal.baseUrl) !== normalizeBaseUrl(cfg.baseUrl)))
         return { reason: "workspace_identity_refused" };
-    const expiry = cfg.auth ? Date.parse(cfg.auth.expiresAt) - ctx.now().getTime() : 0;
-    const bearer = cfg.key || (cfg.auth && Number.isFinite(expiry) && expiry > 30_000 ? cfg.auth.accessToken : undefined);
+    const expiry = cfg.auth
+        ? Date.parse(cfg.auth.expiresAt) - ctx.now().getTime()
+        : 0;
+    const bearer = cfg.key ||
+        (cfg.auth && Number.isFinite(expiry) && expiry > 30_000
+            ? cfg.auth.accessToken
+            : undefined);
     if (!bearer)
         return { reason: "workspace_login_refresh_required" };
     const deadline = new AbortController();
     const timer = setTimeout(() => deadline.abort(), timeoutMs);
-    const signal = external ? AbortSignal.any([external, deadline.signal]) : deadline.signal;
+    const signal = external
+        ? AbortSignal.any([external, deadline.signal])
+        : deadline.signal;
     let remove = () => { };
     try {
-        return await new Promise(resolve => {
-            const stopped = () => resolve({ reason: external?.aborted ? "interrupted" : "workspace_status_unavailable" });
+        return await new Promise((resolve) => {
+            const stopped = () => resolve({
+                reason: external?.aborted
+                    ? "interrupted"
+                    : "workspace_status_unavailable",
+            });
             if (signal.aborted) {
                 stopped();
                 return;
             }
             signal.addEventListener("abort", stopped, { once: true });
             remove = () => signal.removeEventListener("abort", stopped);
-            Promise.resolve().then(async () => {
+            Promise.resolve()
+                .then(async () => {
                 if (signal.aborted)
                     return { reason: "interrupted" };
                 const response = await ctx.fetch(`${normalizeBaseUrl(cfg.baseUrl)}${path}`, {
-                    method: "GET", redirect: "error", headers: { authorization: `Bearer ${bearer}`, accept: "application/json" }, signal,
+                    method: "GET",
+                    redirect: "error",
+                    headers: {
+                        authorization: `Bearer ${bearer}`,
+                        accept: "application/json",
+                    },
+                    signal,
                 });
                 // Refusal bodies and provider diagnostics are never parsed, returned or printed.
                 if (response.status !== 200)
                     return { status: response.status };
-                return { status: 200, body: await response.json() };
-            }).then(value => signal.aborted ? stopped() : resolve(value), () => signal.aborted ? stopped() : resolve({ reason: "workspace_status_unavailable" }));
+                return { status: 200, body: (await response.json()) };
+            })
+                .then((value) => (signal.aborted ? stopped() : resolve(value)), () => signal.aborted
+                ? stopped()
+                : resolve({ reason: "workspace_status_unavailable" }));
         });
     }
     finally {
@@ -55,8 +96,10 @@ async function read(ctx, journal, path, timeoutMs, external) {
 }
 function readFailure(value) {
     if ("reason" in value)
-        return value.reason === "workspace_identity_refused" || value.reason === "personal_login_required"
-            ? { state: "refused", reason: value.reason } : waiting(value.reason);
+        return value.reason === "workspace_identity_refused" ||
+            value.reason === "personal_login_required"
+            ? { state: "refused", reason: value.reason }
+            : waiting(value.reason);
     if (value.status === 401 || value.status === 403)
         return { state: "refused", reason: "workspace_consent_refused" };
     return value.status === 200 ? null : waiting("workspace_status_unavailable");
@@ -67,16 +110,33 @@ function observation(body, now) {
     const workspace = object(row?.workspace);
     const credential = object(row?.credential);
     const verification = object(row?.verification);
-    if (!row || typeof row.connected !== "boolean" || !workspace || typeof workspace.bound !== "boolean" ||
-        !nullableText(workspace.workspaceId) || !nullableText(workspace.workspaceSlug) || !nullableText(workspace.workspaceName) ||
-        !credential || ![true, false, null].includes(credential.stored) ||
-        !nullableTime(credential.updatedAt) || !nullableTime(credential.expiresAt) || (typeof credential.warmth !== "string" || !warmth.has(credential.warmth)) || !verification)
+    if (!row ||
+        typeof row.connected !== "boolean" ||
+        !workspace ||
+        typeof workspace.bound !== "boolean" ||
+        !nullableText(workspace.workspaceId) ||
+        !nullableText(workspace.workspaceSlug) ||
+        !nullableText(workspace.workspaceName) ||
+        !credential ||
+        ![true, false, null].includes(credential.stored) ||
+        !nullableTime(credential.updatedAt) ||
+        !nullableTime(credential.expiresAt) ||
+        typeof credential.warmth !== "string" ||
+        !warmth.has(credential.warmth) ||
+        !verification)
         return waiting("workspace_status_shape");
-    if (verification.source === "none" && verification.state === "not-run" && verification.checkedAt === null && row.connected === false)
+    if (verification.source === "none" &&
+        verification.state === "not-run" &&
+        verification.checkedAt === null &&
+        row.connected === false)
         return waiting("workspace_status_unavailable");
-    if (verification.source !== "live-probe" || (typeof verification.state !== "string" || !states.has(verification.state)) ||
-        typeof verification.checkedAt !== "number" || !Number.isFinite(verification.checkedAt) ||
-        verification.checkedAt < now - 120_000 || verification.checkedAt > now + 30_000 ||
+    if (verification.source !== "live-probe" ||
+        typeof verification.state !== "string" ||
+        !states.has(verification.state) ||
+        typeof verification.checkedAt !== "number" ||
+        !Number.isFinite(verification.checkedAt) ||
+        verification.checkedAt < now - 120_000 ||
+        verification.checkedAt > now + 30_000 ||
         row.connected !== (verification.state === "connected"))
         return waiting("workspace_status_shape");
     if (verification.state === "unreachable")
@@ -84,15 +144,29 @@ function observation(body, now) {
     if (!row.connected)
         return { state: "pending" };
     // A working credential alone cannot prove this account has a bound Linear workspace.
-    if (!workspace.bound || typeof workspace.workspaceId !== "string" || !idPattern.test(workspace.workspaceId))
+    if (!workspace.bound ||
+        typeof workspace.workspaceId !== "string" ||
+        !idPattern.test(workspace.workspaceId))
         return waiting("linear_workspace_unverified");
-    return { state: "done", evidence: { provider: "linear", workspace: workspace.workspaceId, checkedAt: verification.checkedAt } };
+    return {
+        state: "done",
+        evidence: {
+            provider: "linear",
+            workspace: workspace.workspaceId,
+            checkedAt: verification.checkedAt,
+        },
+    };
 }
 function safeHandoff(body, ctx) {
     const row = object(body);
     const cfg = loadConfig(ctx.home);
-    if (!cfg || !row || typeof row.authorizationUrl !== "string" || row.authorizationUrl.length > 8192 || /[\u0000-\u0020\u007f]/.test(row.authorizationUrl) ||
-        typeof row.expiresAt !== "number" || !Number.isFinite(row.expiresAt))
+    if (!cfg ||
+        !row ||
+        typeof row.authorizationUrl !== "string" ||
+        row.authorizationUrl.length > 8192 ||
+        /[\u0000-\u0020\u007f]/.test(row.authorizationUrl) ||
+        typeof row.expiresAt !== "number" ||
+        !Number.isFinite(row.expiresAt))
         return null;
     const remaining = row.expiresAt - ctx.now().getTime();
     // Thirty seconds accommodates clock skew; an expired link is never launched.
@@ -102,9 +176,17 @@ function safeHandoff(body, ctx) {
         const url = new URL(row.authorizationUrl);
         const keys = [...url.searchParams.keys()];
         const handoff = url.searchParams.get("handoff");
-        if (url.protocol !== "https:" || url.origin !== new URL(normalizeBaseUrl(cfg.baseUrl)).origin || url.username || url.password ||
-            url.pathname !== HANDOFF || url.hash || keys.length !== 1 || keys[0] !== "handoff" ||
-            !handoff || handoff.length > 4096 || /[\s\u0000-\u001f\u007f]/.test(handoff))
+        if (url.protocol !== "https:" ||
+            url.origin !== new URL(normalizeBaseUrl(cfg.baseUrl)).origin ||
+            url.username ||
+            url.password ||
+            url.pathname !== HANDOFF ||
+            url.hash ||
+            keys.length !== 1 ||
+            keys[0] !== "handoff" ||
+            !handoff ||
+            handoff.length > 4096 ||
+            /[\s\u0000-\u001f\u007f]/.test(handoff))
             return null;
         return url.toString();
     }
@@ -112,19 +194,29 @@ function safeHandoff(body, ctx) {
         return null;
     }
 }
-/** Uses the new personal bearer twins; old clouds retain their supported read-only readiness path. */
+/** Uses personal bearer twins; missing routes wait without an ungated readiness fallback. */
 export function linearWorkspaceAdapter(options) {
     const timeoutMs = options.requestTimeoutMs ?? 30_000;
     const consentTimeoutMs = options.consentTimeoutMs ?? 600_000;
-    if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 30_000 ||
-        !Number.isSafeInteger(consentTimeoutMs) || consentTimeoutMs < 1 || consentTimeoutMs > 600_000)
+    if (!Number.isSafeInteger(timeoutMs) ||
+        timeoutMs < 1 ||
+        timeoutMs > 30_000 ||
+        !Number.isSafeInteger(consentTimeoutMs) ||
+        consentTimeoutMs < 1 ||
+        consentTimeoutMs > 600_000)
         throw new Error("workspace_timeout_invalid");
     const inspect = async (ctx, journal, signal) => {
         const result = await read(ctx, journal, STATUS, timeoutMs, signal);
-        if ("status" in result && result.status === 404)
-            return { result: await options.fallback.check(ctx, journal, signal), unsupported: true };
+        if ("status" in result && [404, 405].includes(result.status))
+            return {
+                result: waiting("cloud_capability_unavailable"),
+                unsupported: true,
+            };
         const failure = readFailure(result);
-        return { result: failure ?? observation("body" in result ? result.body : undefined, ctx.now().getTime()) };
+        return {
+            result: failure ??
+                observation("body" in result ? result.body : undefined, ctx.now().getTime()),
+        };
     };
     return {
         check: async (ctx, journal, signal) => (await inspect(ctx, journal, signal)).result,
@@ -140,7 +232,7 @@ export function linearWorkspaceAdapter(options) {
             if (before.unsupported)
                 return waiting("cloud_capability_unavailable");
             const start = await read(ctx, journal, `${STATUS}/start`, timeoutMs, signal);
-            if ("status" in start && start.status === 404)
+            if ("status" in start && [404, 405].includes(start.status))
                 return waiting("cloud_capability_unavailable");
             const failure = readFailure(start);
             if (failure)
@@ -151,7 +243,9 @@ export function linearWorkspaceAdapter(options) {
             if (signal?.aborted)
                 return waiting("interrupted");
             const current = loadConfig(ctx.home);
-            if (!current?.user || current.account !== cfg.account || current.user.id !== cfg.user.id ||
+            if (!current?.user ||
+                current.account !== cfg.account ||
+                current.user.id !== cfg.user.id ||
                 normalizeBaseUrl(current.baseUrl) !== normalizeBaseUrl(cfg.baseUrl))
                 return { state: "refused", reason: "workspace_identity_refused" };
             if (!["owner", "admin"].includes(current.user.role))
@@ -165,20 +259,30 @@ export function linearWorkspaceAdapter(options) {
                 return waiting("workspace_browser_unavailable");
             }
             let latest = waiting("workspace_status_unavailable");
-            const run = () => pollConsent({ timeoutMs: consentTimeoutMs, signal, sleep: options.sleep,
+            const run = () => pollConsent({
+                timeoutMs: consentTimeoutMs,
+                signal,
+                sleep: options.sleep,
                 readStatus: async (pollSignal) => {
                     const value = await inspect(ctx, journal, pollSignal);
                     latest = value.result;
                     if (value.unsupported)
-                        return { outcome: "failed", reason: "cloud_capability_unavailable" };
+                        return {
+                            outcome: "waiting",
+                            reason: "cloud_capability_unavailable",
+                        };
                     if (latest.state === "done")
                         return { outcome: "connected" };
                     if (latest.state === "refused" || latest.state === "failed")
                         return { outcome: latest.state, reason: latest.reason };
-                    return { outcome: latest.state === "pending" ? "absent" : "unavailable" };
+                    return {
+                        outcome: latest.state === "pending" ? "absent" : "unavailable",
+                    };
                 },
             });
-            const result = options.wait ? await options.wait("Waiting for workspace approval", run) : await run();
+            const result = options.wait
+                ? await options.wait("Waiting for workspace approval", run)
+                : await run();
             return result.state === "done" ? latest : result;
         },
     };