@catalyst-cloud/cli 0.14.5 → 0.14.7

package/dist/onboard-repositories.js

@@ -1,44 +1,105 @@
-import { loadConfig, normalizeBaseUrl, readManifest } from "./config.js";
+import { loadConfig, normalizeBaseUrl, readManifest, } from "./config.js";
 import { contractVersionInRange } from "./contract.js";
-import { readExistingOnboardJson, selectedOnboardTeam } from "./onboard-existing.js";
+import { readExistingOnboardJson, selectedOnboardTeam, } from "./onboard-existing.js";
 const part = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,99}$/;
 const id = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
-const object = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+const object = (value) => value !== null && typeof value === "object" && !Array.isArray(value)
+    ? value
+    : null;
 const key = (row) => `${row.owner}/${row.name}`.toLowerCase();
-const waiting = (reason) => ({ state: "waiting", reason });
+const waiting = (reason) => ({
+    state: "waiting",
+    reason,
+});
 const valid = (value) => {
     const row = object(value);
-    return !!row && typeof row.teamId === "string" && id.test(row.teamId) && typeof row.repoId === "string" && id.test(row.repoId) &&
-        typeof row.owner === "string" && part.test(row.owner) && typeof row.name === "string" && part.test(row.name);
+    return (!!row &&
+        typeof row.teamId === "string" &&
+        id.test(row.teamId) &&
+        typeof row.repoId === "string" &&
+        id.test(row.repoId) &&
+        typeof row.owner === "string" &&
+        part.test(row.owner) &&
+        typeof row.name === "string" &&
+        part.test(row.name));
 };
 /** Names/IDs only. A saved selection never proves current access or repository readiness. */
 export function selectedOnboardRepositories(journal) {
-    const step = journal?.steps.find(row => row.id === "github.repos" && row.state === "done");
-    const receipt = step?.evidence?.repository;
+    const selection = journal?.steps.find((row) => row.id === "github.repos" && row.state === "done");
+    const registered = journal?.steps.find((row) => row.id === "projects" && row.state === "done");
+    const receipt = selection?.evidence?.repository;
     if (typeof receipt !== "string" || receipt.length > 64_000)
         return [];
     try {
         const rows = JSON.parse(receipt);
-        if (!Array.isArray(rows) || !rows.length || rows.length > 100 || !rows.every(valid))
+        if (!Array.isArray(rows) || !rows.length || rows.length > 100)
             return [];
-        if (new Set(rows.map(key)).size !== rows.length)
+        if (rows.every(valid)) {
+            if (new Set(rows.map(key)).size !== rows.length)
+                return [];
+            return rows.map((row) => ({
+                teamId: row.teamId,
+                owner: row.owner,
+                name: row.name,
+                repoId: row.repoId,
+            }));
+        }
+        // A fresh Q3 choice has names only. It may use later verified registration evidence only
+        // when the exact selected team/repository matches, never an earlier project's selection.
+        if (rows.length !== 1)
+            return [];
+        const selected = object(rows[0]);
+        if (!selected ||
+            selected.repoId !== undefined ||
+            typeof selected.teamId !== "string" ||
+            !id.test(selected.teamId) ||
+            typeof selected.owner !== "string" ||
+            !part.test(selected.owner) ||
+            typeof selected.name !== "string" ||
+            !part.test(selected.name))
+            return [];
+        const evidence = registered?.evidence?.repository;
+        if (typeof evidence !== "string" || evidence.length > 64_000)
             return [];
-        return rows.map(row => ({ teamId: row.teamId, owner: row.owner, name: row.name, repoId: row.repoId }));
+        const registeredRows = JSON.parse(evidence);
+        if (!Array.isArray(registeredRows) ||
+            registeredRows.length !== 1 ||
+            !registeredRows.every(valid))
+            return [];
+        const live = registeredRows[0];
+        return live.teamId === selected.teamId &&
+            key(live) === key({ owner: selected.owner, name: selected.name })
+            ? [{ ...live }]
+            : [];
     }
     catch {
         return [];
     }
 }
 /** The personal ACL inventory chooses bindings; a fresh contract supplies IDs only. No cache read. */
-async function inventory(ctx, journal, signal) {
+export async function readOnboardRepositoryInventory(ctx, journal, signal) {
     const cfg = loadConfig(ctx.home);
-    if (!cfg?.user || !journal.account || cfg.account !== journal.account || journal.membershipId !== cfg.user.id ||
-        !journal.baseUrl || normalizeBaseUrl(journal.baseUrl) !== normalizeBaseUrl(cfg.baseUrl))
+    if (!cfg?.user ||
+        !journal.account ||
+        cfg.account !== journal.account ||
+        journal.membershipId !== cfg.user.id ||
+        !journal.baseUrl ||
+        normalizeBaseUrl(journal.baseUrl) !== normalizeBaseUrl(cfg.baseUrl))
         return { reason: "repository_identity_unverified" };
+    const personId = cfg.user.id;
+    const sameIdentity = () => {
+        const current = loadConfig(ctx.home);
+        return (current?.user &&
+            current.account === cfg.account &&
+            current.user.id === personId &&
+            normalizeBaseUrl(current.baseUrl) === normalizeBaseUrl(cfg.baseUrl));
+    };
     const teamId = selectedOnboardTeam(journal);
     if (!teamId)
         return { reason: "team_selection_unverified" };
     const read = await readExistingOnboardJson(ctx, "/api/v1/repos", signal);
+    if (!sameIdentity())
+        return { reason: "repository_identity_unverified" };
     if ("reason" in read)
         return { reason: "repository_read_unavailable" };
     const body = object(read.body);
@@ -48,8 +109,13 @@ async function inventory(ctx, journal, signal) {
     const seen = new Set();
     for (const value of body.repos) {
         const row = object(value);
-        if (!row || typeof row.teamId !== "string" || !id.test(row.teamId) || typeof row.owner !== "string" || !part.test(row.owner) ||
-            typeof row.name !== "string" || !part.test(row.name))
+        if (!row ||
+            typeof row.teamId !== "string" ||
+            !id.test(row.teamId) ||
+            typeof row.owner !== "string" ||
+            !part.test(row.owner) ||
+            typeof row.name !== "string" ||
+            !part.test(row.name))
             return { reason: "repository_inventory_shape" };
         if (row.teamId !== teamId)
             continue;
@@ -59,24 +125,37 @@ async function inventory(ctx, journal, signal) {
         seen.add(name);
         bindings.push({ owner: row.owner, name: row.name });
     }
+    if (!sameIdentity())
+        return { reason: "repository_identity_unverified" };
     if (!bindings.length)
         return { repositories: [] };
     const contractRead = await readExistingOnboardJson(ctx, "/api/v1/agent/contract", signal);
+    if (!sameIdentity())
+        return { reason: "repository_identity_unverified" };
     if ("reason" in contractRead)
         return { reason: "repository_contract_unavailable" };
     const doc = object(contractRead.body);
     const account = object(doc?.account);
     const merge = object(doc?.merge);
-    if (!doc || account?.id !== journal.account || typeof doc.contractVersion !== "string" ||
+    if (!doc ||
+        account?.id !== journal.account ||
+        typeof doc.contractVersion !== "string" ||
         contractVersionInRange(doc.contractVersion, readManifest().tenantContractRange) !== true ||
-        !merge || !Array.isArray(merge.repositories) || merge.repositories.length > 10_000)
+        !merge ||
+        !Array.isArray(merge.repositories) ||
+        merge.repositories.length > 10_000)
         return { reason: "repository_contract_unverified" };
     const lookup = new Map();
     const idNames = new Map();
     for (const value of merge.repositories) {
         const row = object(value);
-        if (!row || typeof row.owner !== "string" || !part.test(row.owner) || typeof row.name !== "string" || !part.test(row.name) ||
-            typeof row.repoId !== "string" || !id.test(row.repoId))
+        if (!row ||
+            typeof row.owner !== "string" ||
+            !part.test(row.owner) ||
+            typeof row.name !== "string" ||
+            !part.test(row.name) ||
+            typeof row.repoId !== "string" ||
+            !id.test(row.repoId))
             return { reason: "repository_contract_unverified" };
         const name = key({ owner: row.owner, name: row.name });
         if (idNames.has(row.repoId) && idNames.get(row.repoId) !== name)
@@ -99,34 +178,57 @@ export function existingRepositoryAdapter(args, choose) {
         const explicit = args.flags.repo;
         if (explicit !== undefined) {
             const names = Array.isArray(explicit) ? explicit : [explicit];
-            if (!names.length || names.length > 100 || !names.every(name => typeof name === "string" && /^[A-Za-z0-9][A-Za-z0-9_.-]{0,99}\/[A-Za-z0-9][A-Za-z0-9_.-]{0,99}$/.test(name)))
+            if (!names.length ||
+                names.length > 100 ||
+                !names.every((name) => typeof name === "string" &&
+                    /^[A-Za-z0-9][A-Za-z0-9_.-]{0,99}\/[A-Za-z0-9][A-Za-z0-9_.-]{0,99}$/.test(name)))
                 return null;
-            const wanted = names.map(name => String(name).toLowerCase());
+            const wanted = names.map((name) => String(name).toLowerCase());
             if (new Set(wanted).size !== wanted.length)
                 return null;
-            const selected = wanted.map(name => repositories.find(row => key(row) === name));
-            return selected.every((row) => !!row) ? selected : null;
+            const selected = wanted.map((name) => repositories.find((row) => key(row) === name));
+            return selected.every((row) => !!row)
+                ? selected
+                : null;
         }
         const saved = chosen ?? selectedOnboardRepositories(journal);
         if (!saved.length)
             return null;
-        const selected = saved.map(row => repositories.find(live => key(live) === key(row) && live.teamId === row.teamId && live.repoId === row.repoId));
-        return selected.every((row) => !!row) ? selected : null;
+        const selected = saved.map((row) => repositories.find((live) => key(live) === key(row) &&
+            live.teamId === row.teamId &&
+            live.repoId === row.repoId));
+        return selected.every((row) => !!row)
+            ? selected
+            : null;
     };
     const check = async (ctx, journal, signal) => {
-        const list = await inventory(ctx, journal, signal);
+        const list = await readOnboardRepositoryInventory(ctx, journal, signal);
         if ("reason" in list)
             return waiting(list.reason);
         if (!list.repositories.length)
             return waiting("repository_inventory_empty");
         const rows = requested(list.repositories, journal);
         if (!rows)
-            return args.flags.repo !== undefined || chosen || selectedOnboardRepositories(journal).length
-                ? waiting("repository_selection_unverified") : choose ? { state: "pending" } : waiting("repository_choice_required");
-        return { state: "done", evidence: { repository: JSON.stringify(rows), count: rows.length, checkedAt: ctx.now().getTime() } };
+            return args.flags.repo !== undefined ||
+                chosen ||
+                selectedOnboardRepositories(journal).length
+                ? waiting("repository_selection_unverified")
+                : choose
+                    ? { state: "pending" }
+                    : waiting("repository_choice_required");
+        return {
+            state: "done",
+            evidence: {
+                repository: JSON.stringify(rows),
+                count: rows.length,
+                checkedAt: ctx.now().getTime(),
+            },
+        };
     };
-    return { check, act: async (ctx, journal, signal) => {
-            const list = await inventory(ctx, journal, signal);
+    return {
+        check,
+        act: async (ctx, journal, signal) => {
+            const list = await readOnboardRepositoryInventory(ctx, journal, signal);
             if ("reason" in list)
                 return waiting(list.reason);
             if (!list.repositories.length)
@@ -142,19 +244,27 @@ export function existingRepositoryAdapter(args, choose) {
                 }
                 signal?.addEventListener("abort", stopped, { once: true });
                 remove = () => signal?.removeEventListener("abort", stopped);
-                Promise.resolve().then(() => signal?.aborted ? null : choose(list.repositories.map(row => ({ ...row })))).then(resolve, reject);
+                Promise.resolve()
+                    .then(() => signal?.aborted
+                    ? null
+                    : choose(list.repositories.map((row) => ({ ...row }))))
+                    .then(resolve, reject);
             }).finally(() => remove());
             if (!answer || signal?.aborted)
                 return waiting("interrupted");
-            if (!Array.isArray(answer) || !answer.length || answer.length > 100 || !answer.every(name => typeof name === "string"))
+            if (!Array.isArray(answer) ||
+                !answer.length ||
+                answer.length > 100 ||
+                !answer.every((name) => typeof name === "string"))
                 return waiting("repository_selection_unverified");
-            const names = answer.map(name => name.toLowerCase());
+            const names = answer.map((name) => name.toLowerCase());
             if (new Set(names).size !== names.length)
                 return waiting("repository_selection_unverified");
-            const rows = names.map(name => list.repositories.find(row => key(row) === name));
+            const rows = names.map((name) => list.repositories.find((row) => key(row) === name));
             if (!rows.every((row) => !!row))
                 return waiting("repository_selection_unverified");
             chosen = rows;
             return check(ctx, journal, signal);
-        } };
+        },
+    };
 }

package/dist/onboard-runtime.js

@@ -5,14 +5,18 @@ import { openBrowser } from "./browser.js";
 import { defaultSkillsDirFor, loadConfig, normalizeBaseUrl, readManifest, } from "./config.js";
 import { CliError } from "./errors.js";
 import { cmdLegacy, findLegacy } from "./legacy.js";
-import { bearerFor } from "./oauth.js";
 import { personalConsentAdapter } from "./onboard-personal.js";
 import { boundedOnboardSignin } from "./onboard-signin.js";
 import { existingLinearAdapters } from "./onboard-existing.js";
 import { linearWorkspaceAdapter } from "./onboard-workspace.js";
-import { existingRepositoryAdapter } from "./onboard-repositories.js";
+import { firstProjectAdapters } from "./onboard-projects.js";
+import { onboardCapacityAdapter } from "./onboard-capacity.js";
+import { onboardAutomationManagementAdapter } from "./onboard-automation-management.js";
+import { onboardWorkflowVerificationAdapter } from "./onboard-workflow.js";
+import { onboardAccountsAdapter } from "./onboard-accounts.js";
 import { githubInstallationAdapter } from "./onboard-github.js";
 import { guardOnboardCapabilities, } from "./onboard-capabilities.js";
+import { onboardSettingsAdapter, } from "./onboard-settings.js";
 import { fetchMe } from "./transport.js";
 const waiting = (reason) => ({
     state: "waiting",
@@ -45,7 +49,56 @@ export function createOnboardRuntime(args, ctx, hooks) {
                 (journal.baseUrl &&
                     normalizeBaseUrl(journal.baseUrl) !== normalizeBaseUrl(cfg.baseUrl))))
             throw new CliError("the saved setup belongs to another workspace or member", "onboard-identity-mismatch", 12);
-        const me = await fetchMe(cfg.baseUrl, await bearerFor(stepCtx, cfg), stepCtx.fetch);
+        // The Q1 preview reads the current token directly; stopping setup must not rotate saved credentials.
+        const expiry = cfg.auth
+            ? Date.parse(cfg.auth.expiresAt) - stepCtx.now().getTime()
+            : 0;
+        const bearer = cfg.key ||
+            (cfg.auth && Number.isFinite(expiry) && expiry > 30_000
+                ? cfg.auth.accessToken
+                : undefined);
+        if (!bearer)
+            throw new CliError("Renew your login with catalyst login, then run catalyst onboard.", "onboard-login-refresh-required", 11);
+        const owned = new AbortController();
+        const signal = hooks.ui
+            ? AbortSignal.any([owned.signal, hooks.ui.signal])
+            : owned.signal;
+        const timer = setTimeout(() => owned.abort(), 30_000);
+        let remove = () => { };
+        let me;
+        try {
+            me = await new Promise((resolve, reject) => {
+                const stopped = () => reject(new CliError("Your membership could not be checked. Run catalyst onboard to retry.", "onboard-membership-unavailable", 11));
+                if (signal.aborted) {
+                    stopped();
+                    return;
+                }
+                signal.addEventListener("abort", stopped, { once: true });
+                remove = () => signal.removeEventListener("abort", stopped);
+                const boundedFetch = ((url, init) => {
+                    if (signal.aborted)
+                        return Promise.reject(new Error("membership_read_stopped"));
+                    return stepCtx.fetch(url, {
+                        ...init,
+                        redirect: "error",
+                        signal: init?.signal
+                            ? AbortSignal.any([signal, init.signal])
+                            : signal,
+                    });
+                });
+                fetchMe(cfg.baseUrl, bearer, boundedFetch).then((value) => (signal.aborted ? stopped() : resolve(value)), reject);
+            });
+        }
+        finally {
+            clearTimeout(timer);
+            remove();
+        }
+        const current = loadConfig(stepCtx.home);
+        if (!current?.user ||
+            current.account !== cfg.account ||
+            current.user.id !== cfg.user.id ||
+            normalizeBaseUrl(current.baseUrl) !== normalizeBaseUrl(cfg.baseUrl))
+            throw new CliError("Your saved login changed while membership was checked. Run catalyst onboard again.", "onboard-identity-mismatch", 12);
         if (!me.user || me.account !== cfg.account || me.user.id !== cfg.user.id)
             throw new CliError("the saved login and live member do not match", "onboard-identity-mismatch", 12);
         // /me names a person within the account, not an independently exposed membership-row ID.
@@ -54,6 +107,12 @@ export function createOnboardRuntime(args, ctx, hooks) {
             membershipId: me.user.id,
             baseUrl: normalizeBaseUrl(cfg.baseUrl),
             role: me.user.role,
+            display: {
+                personLabel: me.user.label,
+                email: me.user.email,
+                workspaceName: me.name,
+                workspaceSlug: me.slug,
+            },
         };
     };
     const legacyCheck = async (stepCtx) => {
@@ -160,9 +219,36 @@ export function createOnboardRuntime(args, ctx, hooks) {
                 : undefined,
             sleep: hooks.sleep,
         }),
-        "github.repos": existingRepositoryAdapter(args, hooks.ui?.chooseRepositories
-            ? (repositories) => hooks.ui.chooseRepositories(repositories.map((row) => ({ ...row })))
-            : undefined),
+        settings: onboardSettingsAdapter({
+            ...hooks.settings,
+            review: hooks.ui?.reviewSettings
+                ? (summaries) => hooks.ui.reviewSettings(summaries)
+                : hooks.settings?.review,
+            message: hooks.ui
+                ? (text) => hooks.ui.message(text)
+                : (text) => ctx.stderr(text),
+        }),
+        ...firstProjectAdapters(args, {
+            chooseExisting: hooks.ui?.chooseRepositories
+                ? (rows) => hooks.ui.chooseRepositories(rows.map((row) => ({ ...row })))
+                : undefined,
+            chooseFirst: hooks.ui?.chooseFirstRepository
+                ? (rows) => hooks.ui.chooseFirstRepository(rows.map((row) => ({ ...row })))
+                : undefined,
+            message: (text) => (hooks.ui ? hooks.ui.message(text) : ctx.stderr(text)),
+        }),
+        accounts: onboardAccountsAdapter({
+            message: (text) => (hooks.ui ? hooks.ui.message(text) : ctx.stderr(text)),
+        }),
+        capacity: onboardCapacityAdapter({
+            message: (text) => (hooks.ui ? hooks.ui.message(text) : ctx.stderr(text)),
+        }),
+        "linear.adopt": onboardWorkflowVerificationAdapter({
+            message: (text) => (hooks.ui ? hooks.ui.message(text) : ctx.stderr(text)),
+        }),
+        "linear.automations": onboardAutomationManagementAdapter({
+            message: (text) => (hooks.ui ? hooks.ui.message(text) : ctx.stderr(text)),
+        }),
         "linear.personal": personalAdapter("linear"),
         "github.personal": personalAdapter("github"),
         daemon: {
@@ -220,11 +306,19 @@ export function createOnboardRuntime(args, ctx, hooks) {
             ],
             fallback: "connections",
         },
-        "linear.automations": {
-            check: [get("/api/v1/agent/tenant/readiness")],
+        "github.repos": {
+            check: [get("/api/v1/repos"), get("/api/v1/agent/contract")],
             fallback: "connections",
         },
-        "github.repos": {
+        settings: {
+            check: [
+                get("/api/v1/agent/teams"),
+                get("/api/v1/repos"),
+                get("/api/v1/agent/contract"),
+            ],
+            fallback: "connections",
+        },
+        projects: {
             check: [get("/api/v1/repos"), get("/api/v1/agent/contract")],
             fallback: "connections",
         },
@@ -246,6 +340,7 @@ export function createOnboardRuntime(args, ctx, hooks) {
     // tenant-bound step guards can run. Unsupported/local-only steps make no endpoint requests.
     return {
         identity: (journal) => identity(ctx, journal),
+        ...(hooks.stageSignin ? { stageSignin: hooks.stageSignin } : {}),
         bindSignals: true,
         ui: hooks.ui,
         adapters,

package/dist/onboard-settings-context.js

@@ -0,0 +1,141 @@
+import { verifyOnboardRoutes } from "./onboard-capabilities.js";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { loadConfig, normalizeBaseUrl } from "./config.js";
+import { readExistingOnboardJson, readOnboardTeamInventory, selectedOnboardTeam, } from "./onboard-existing.js";
+import { readOnboardRepositoryInventory, selectedOnboardRepositories, } from "./onboard-repositories.js";
+import { readLocalSettings, } from "./env/settings-authority.js";
+const run = promisify(execFile);
+const object = (value) => value !== null && typeof value === "object" && !Array.isArray(value)
+    ? value
+    : null;
+const repoKey = (repo) => `${repo.owner}/${repo.name}`.toLowerCase();
+/** Read only Git's local origin; no credential helper, provider call, hook or repo command runs. */
+export async function readLocalRepositoryName(repoRoot, signal) {
+    try {
+        if (signal?.aborted)
+            return null;
+        const result = await run("git", ["config", "--local", "--get-all", "remote.origin.url"], {
+            cwd: repoRoot,
+            timeout: 3_000,
+            maxBuffer: 16_384,
+            signal,
+            env: {
+                PATH: process.env.PATH,
+                GIT_CONFIG_GLOBAL: "/dev/null",
+                GIT_CONFIG_SYSTEM: "/dev/null",
+                GIT_CONFIG_NOSYSTEM: "1",
+                GIT_TERMINAL_PROMPT: "0",
+            },
+        });
+        const urls = result.stdout.trim().split(/\r?\n/);
+        if (urls.length !== 1 || signal?.aborted)
+            return null;
+        const raw = urls[0];
+        if (/[\u0000-\u0020\u007f]/.test(raw))
+            return null;
+        const ssh = /^git@github\.com:([A-Za-z0-9][A-Za-z0-9-]{0,38})\/([A-Za-z0-9._-]{1,100}?)(?:\.git)?$/.exec(raw);
+        if (ssh)
+            return `${ssh[1]}/${ssh[2]}`.toLowerCase();
+        const url = new URL(raw);
+        if (url.protocol !== "https:" ||
+            url.hostname !== "github.com" ||
+            url.port ||
+            url.username ||
+            url.password ||
+            url.search ||
+            url.hash)
+            return null;
+        const path = url.pathname.replace(/^\//, "").replace(/\.git$/, "");
+        return /^[A-Za-z0-9][A-Za-z0-9-]{0,38}\/[A-Za-z0-9._-]{1,100}$/.test(path)
+            ? path.toLowerCase()
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Fresh account/member, team inventory and personal repository ACL establish authority. The
+ * journal chooses identifiers only; neither its done state nor the disk contract is proof. */
+export function onboardSettingsAuthorityPorts(input) {
+    const selected = { ...input.repository };
+    const root = input.repoRoot;
+    return {
+        readSettings: readLocalSettings,
+        readContext: async (signal) => {
+            try {
+                const { ctx, journal } = input;
+                const cfg = loadConfig(ctx.home);
+                const account = journal.account ?? journal.tenant;
+                if (signal?.aborted ||
+                    !cfg?.user ||
+                    !account ||
+                    account !== cfg.account ||
+                    journal.membershipId !== cfg.user.id ||
+                    !journal.baseUrl ||
+                    normalizeBaseUrl(journal.baseUrl) !== normalizeBaseUrl(cfg.baseUrl))
+                    return null;
+                const teamId = selectedOnboardTeam(journal);
+                if (!teamId ||
+                    teamId !== selected.teamId ||
+                    !selectedOnboardRepositories(journal).some((repo) => repoKey(repo) === repoKey(selected) &&
+                        repo.repoId === selected.repoId &&
+                        repo.teamId === teamId))
+                    return null;
+                const supported = await verifyOnboardRoutes(ctx, journal, [
+                    { method: "GET", path: "/api/v1/agent/teams" },
+                    { method: "GET", path: "/api/v1/repos" },
+                    { method: "GET", path: "/api/v1/agent/contract" },
+                ], signal);
+                if ("reason" in supported || signal?.aborted)
+                    return null;
+                const meRead = await readExistingOnboardJson(ctx, "/api/v1/me", signal);
+                if ("reason" in meRead)
+                    return null;
+                const me = object(meRead.body);
+                const user = object(me?.user);
+                if (me?.account !== account ||
+                    user?.id !== cfg.user.id ||
+                    typeof user.role !== "string" ||
+                    !["owner", "admin"].includes(user.role))
+                    return null;
+                const teams = await readOnboardTeamInventory(ctx, signal);
+                if ("reason" in teams)
+                    return null;
+                const team = teams.teams.find((row) => row.id === teamId);
+                if (!team || !/^[A-Z][A-Z0-9]{0,15}$/.test(team.key))
+                    return null;
+                const inventory = await readOnboardRepositoryInventory(ctx, journal, signal);
+                if ("reason" in inventory ||
+                    !inventory.repositories.some((repo) => repoKey(repo) === repoKey(selected) &&
+                        repo.repoId === selected.repoId &&
+                        repo.teamId === selected.teamId))
+                    return null;
+                const local = await (input.readRepositoryName ?? readLocalRepositoryName)(root, signal);
+                if (local !== repoKey(selected) || signal?.aborted)
+                    return null;
+                const current = loadConfig(ctx.home);
+                if (!current?.user ||
+                    current.account !== cfg.account ||
+                    current.user.id !== cfg.user.id ||
+                    normalizeBaseUrl(current.baseUrl) !== normalizeBaseUrl(cfg.baseUrl) ||
+                    !["owner", "admin"].includes(current.user.role))
+                    return null;
+                return {
+                    accountId: account,
+                    personId: cfg.user.id,
+                    baseUrl: normalizeBaseUrl(cfg.baseUrl),
+                    role: user.role,
+                    teamId,
+                    teamKey: team.key,
+                    repoId: selected.repoId,
+                    repoName: repoKey(selected),
+                    repoRoot: root,
+                };
+            }
+            catch {
+                return null;
+            }
+        },
+    };
+}