@catalyst-cloud/cli 0.14.6 → 0.14.7

package/dist/oauth.js

@@ -1,4 +1,4 @@
-import { discoveryCachePathFor, loadConfig, normalizeBaseUrl, writeConfig } from "./config.js";
+import { discoveryCachePathFor, loadConfig, normalizeBaseUrl, writeConfig, } from "./config.js";
 import { CliError } from "./errors.js";
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 const DISCOVERY_TTL_MS = 60 * 60_000;
@@ -20,7 +20,9 @@ function readDiscoveryDisk(home) {
         return null;
     try {
         const parsed = JSON.parse(readFileSync(path, "utf8"));
-        if (isDiscovery(parsed.doc) && typeof parsed.fetchedAt === "number" && typeof parsed.baseUrl === "string")
+        if (isDiscovery(parsed.doc) &&
+            typeof parsed.fetchedAt === "number" &&
+            typeof parsed.baseUrl === "string")
             return parsed;
     }
     catch {
@@ -32,16 +34,24 @@ function isDiscovery(v) {
     if (typeof v !== "object" || v === null)
         return false;
     const d = v;
-    return ["clientId", "issuer", "deviceAuthorizationUrl", "tokenUrl", "jwksUrl"].every((k) => typeof d[k] === "string");
+    return [
+        "clientId",
+        "issuer",
+        "deviceAuthorizationUrl",
+        "tokenUrl",
+        "jwksUrl",
+    ].every((k) => typeof d[k] === "string");
 }
 export async function fetchDiscovery(ctx, baseUrl, opts = {}) {
-    const cancelled = () => { if (opts.signal?.aborted)
-        throw new CliError("Sign-in paused. Run the same command to resume.", "login-cancelled", 11); };
+    const cancelled = () => {
+        if (opts.signal?.aborted)
+            throw new CliError("Sign-in paused. Run the same command to resume.", "login-cancelled", 11);
+    };
     cancelled();
     const base = normalizeBaseUrl(baseUrl);
     const nowMs = ctx.now().getTime();
     const fresh = (e) => e !== null && e.baseUrl === base && nowMs - e.fetchedAt < DISCOVERY_TTL_MS;
-    if (!opts.refresh) {
+    if (!opts.refresh && opts.cache !== false) {
         if (fresh(memo))
             return memo.doc;
         const disk = readDiscoveryDisk(ctx.home);
@@ -51,7 +61,9 @@ export async function fetchDiscovery(ctx, baseUrl, opts = {}) {
         }
     }
     const url = `${base}/api/v1/auth/cli`;
-    const res = await safeFetch(ctx, url, { headers: { accept: "application/json" } });
+    const res = await safeFetch(ctx, url, {
+        headers: { accept: "application/json" },
+    });
     if (!res.ok) {
         throw new CliError(`could not read the login discovery document (${res.status}) at ${url} — is this a Catalyst Cloud origin?`, "discovery-failed");
     }
@@ -60,6 +72,8 @@ export async function fetchDiscovery(ctx, baseUrl, opts = {}) {
     if (!isDiscovery(doc))
         throw new CliError(`the login discovery document at ${url} is not the expected shape`, "discovery-shape");
     const entry = { baseUrl: base, fetchedAt: nowMs, doc };
+    if (opts.cache === false)
+        return doc;
     memo = entry;
     try {
         writeFileSync(discoveryCachePathFor(ctx.home), JSON.stringify(entry, null, 2) + "\n");
@@ -83,17 +97,28 @@ export const MAX_DEVICE_CODES = 3;
  * expires, a fresh one is minted and printed, up to MAX_DEVICE_CODES in all.
  */
 export async function deviceFlowLogin(ctx, baseUrl, deps = {}) {
-    const cancelled = () => { if (deps.signal?.aborted)
-        throw new CliError("Sign-in paused. Run the same command to resume.", "login-cancelled", 11); };
+    const cancelled = () => {
+        if (deps.signal?.aborted)
+            throw new CliError("Sign-in paused. Run the same command to resume.", "login-cancelled", 11);
+    };
     cancelled();
     if (deps.signal) {
         const fetchImpl = ctx.fetch;
         const signal = deps.signal;
-        ctx = { ...ctx, fetch: ((input, init) => fetchImpl(input, {
-                ...init, signal: init?.signal ? AbortSignal.any([signal, init.signal]) : signal,
-            })) };
+        ctx = {
+            ...ctx,
+            fetch: ((input, init) => fetchImpl(input, {
+                ...init,
+                signal: init?.signal
+                    ? AbortSignal.any([signal, init.signal])
+                    : signal,
+            })),
+        };
     }
-    const discovery = await fetchDiscovery(ctx, baseUrl, { signal: deps.signal });
+    const discovery = await fetchDiscovery(ctx, baseUrl, {
+        signal: deps.signal,
+        cache: deps.discoveryCache,
+    });
     cancelled();
     // The browser rule is decided on the first code; a later code re-opens it only when the first did.
     let browserOpened = false;
@@ -120,7 +145,9 @@ export async function deviceFlowLogin(ctx, baseUrl, deps = {}) {
         }
         ctx.stdout("Waiting for you to approve… (Ctrl-C to cancel)");
         const poll = () => pollDeviceCode(ctx, discovery, auth, deps.sleep, deps.signal);
-        const tokens = deps.waitForApproval ? await deps.waitForApproval(poll) : await poll();
+        const tokens = deps.waitForApproval
+            ? await deps.waitForApproval(poll)
+            : await poll();
         cancelled();
         if (tokens !== "expired")
             return tokensToAuth(ctx, tokens.access_token, tokens.refresh_token);
@@ -137,8 +164,10 @@ export async function deviceFlowLogin(ctx, baseUrl, deps = {}) {
 async function pollDeviceCode(ctx, discovery, auth, sleep, external) {
     const deadline = AbortSignal.timeout(auth.expires_in * 1_000);
     const signal = external ? AbortSignal.any([external, deadline]) : deadline;
-    const cancelled = () => { if (external?.aborted)
-        throw new CliError("Sign-in paused. Run the same command to resume.", "login-cancelled", 11); };
+    const cancelled = () => {
+        if (external?.aborted)
+            throw new CliError("Sign-in paused. Run the same command to resume.", "login-cancelled", 11);
+    };
     let intervalMs = Math.max(1, auth.interval) * 1_000;
     for (;;) {
         cancelled();
@@ -158,7 +187,15 @@ async function pollDeviceCode(ctx, discovery, auth, sleep, external) {
             return "expired";
         let res;
         try {
-            res = await safeFetch(ctx, discovery.tokenUrl, { method: "POST", headers: formHeaders(), body: form({ grant_type: "urn:ietf:params:oauth:grant-type:device_code", device_code: auth.device_code, client_id: discovery.clientId }) }, signal);
+            res = await safeFetch(ctx, discovery.tokenUrl, {
+                method: "POST",
+                headers: formHeaders(),
+                body: form({
+                    grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+                    device_code: auth.device_code,
+                    client_id: discovery.clientId,
+                }),
+            }, signal);
             cancelled();
         }
         catch (err) {
@@ -172,10 +209,14 @@ async function pollDeviceCode(ctx, discovery, auth, sleep, external) {
         }
         if (res.ok) {
             const pair = (await parseJson(res, discovery.tokenUrl));
-            if (typeof pair.access_token !== "string" || typeof pair.refresh_token !== "string") {
+            if (typeof pair.access_token !== "string" ||
+                typeof pair.refresh_token !== "string") {
                 throw new CliError("the login token response was missing a token", "login-shape");
             }
-            return { access_token: pair.access_token, refresh_token: pair.refresh_token };
+            return {
+                access_token: pair.access_token,
+                refresh_token: pair.refresh_token,
+            };
         }
         const err = await oauthError(res, discovery.tokenUrl);
         if (err === "authorization_pending")
@@ -192,7 +233,10 @@ async function pollDeviceCode(ctx, discovery, auth, sleep, external) {
         // Retry-After for a 429; only a genuine, non-transient refusal ends the loop.
         if (res.status === 408 || res.status === 429 || res.status >= 500) {
             const retryAfter = Number(res.headers.get("retry-after"));
-            intervalMs = Number.isFinite(retryAfter) && retryAfter > 0 ? retryAfter * 1_000 : backoff(intervalMs);
+            intervalMs =
+                Number.isFinite(retryAfter) && retryAfter > 0
+                    ? retryAfter * 1_000
+                    : backoff(intervalMs);
             continue;
         }
         throw new CliError(`login failed (${res.status}): ${err}`, "login-failed");
@@ -202,18 +246,35 @@ async function pollDeviceCode(ctx, discovery, auth, sleep, external) {
 function devicePollDelay(ms, signal, sleep) {
     return new Promise((resolve, reject) => {
         let timer;
-        const clean = () => { clearTimeout(timer); signal.removeEventListener("abort", abort); };
-        const abort = () => { clean(); reject(new Error("device_poll_stopped")); };
+        const clean = () => {
+            clearTimeout(timer);
+            signal.removeEventListener("abort", abort);
+        };
+        const abort = () => {
+            clean();
+            reject(new Error("device_poll_stopped"));
+        };
         if (signal.aborted) {
             abort();
             return;
         }
         signal.addEventListener("abort", abort, { once: true });
         if (sleep) {
-            Promise.resolve().then(() => sleep(ms)).then(() => { clean(); resolve(); }, error => { clean(); reject(error); });
+            Promise.resolve()
+                .then(() => sleep(ms))
+                .then(() => {
+                clean();
+                resolve();
+            }, (error) => {
+                clean();
+                reject(error);
+            });
         }
         else
-            timer = setTimeout(() => { clean(); resolve(); }, ms);
+            timer = setTimeout(() => {
+                clean();
+                resolve();
+            }, ms);
     });
 }
 /** Grow the poll interval on a transient failure, capped, so retries never hammer the endpoint. */
@@ -243,18 +304,27 @@ function persistRotation(ctx, cfg, sessionId, rotated) {
     writeConfig(ctx.home, target); // atomic; the rotated pair survives a crash
 }
 async function deviceAuthorize(ctx, discovery) {
-    const res = await safeFetch(ctx, discovery.deviceAuthorizationUrl, { method: "POST", headers: formHeaders(), body: form({ client_id: discovery.clientId }) });
+    const res = await safeFetch(ctx, discovery.deviceAuthorizationUrl, {
+        method: "POST",
+        headers: formHeaders(),
+        body: form({ client_id: discovery.clientId }),
+    });
     if (!res.ok)
         throw new CliError(`could not start login (${res.status}) at ${discovery.deviceAuthorizationUrl}`, "login-failed");
     const d = (await parseJson(res, discovery.deviceAuthorizationUrl));
-    if (typeof d.device_code !== "string" || typeof d.user_code !== "string" || typeof d.verification_uri !== "string") {
+    if (typeof d.device_code !== "string" ||
+        typeof d.user_code !== "string" ||
+        typeof d.verification_uri !== "string") {
         throw new CliError("the login authorization response was not the expected shape", "login-shape");
     }
     return {
         device_code: d.device_code,
         user_code: d.user_code,
         verification_uri: d.verification_uri,
-        ...(typeof d.verification_uri_complete === "string" && d.verification_uri_complete !== "" ? { verification_uri_complete: d.verification_uri_complete } : {}),
+        ...(typeof d.verification_uri_complete === "string" &&
+            d.verification_uri_complete !== ""
+            ? { verification_uri_complete: d.verification_uri_complete }
+            : {}),
         expires_in: typeof d.expires_in === "number" ? d.expires_in : 300,
         interval: typeof d.interval === "number" ? d.interval : 5,
     };
@@ -293,10 +363,19 @@ async function refreshAndPersist(ctx, cfg, deps) {
     for (let attempt = 0; attempt < REFRESH_MAX_ATTEMPTS; attempt++) {
         if (attempt > 0)
             await sleep(REFRESH_BASE_BACKOFF_MS * 2 ** (attempt - 1));
-        const res = await safeFetch(ctx, discovery.tokenUrl, { method: "POST", headers: formHeaders(), body: form({ grant_type: "refresh_token", refresh_token: current.refreshToken, client_id: discovery.clientId }) });
+        const res = await safeFetch(ctx, discovery.tokenUrl, {
+            method: "POST",
+            headers: formHeaders(),
+            body: form({
+                grant_type: "refresh_token",
+                refresh_token: current.refreshToken,
+                client_id: discovery.clientId,
+            }),
+        });
         if (res.ok) {
             const pair = (await parseJson(res, discovery.tokenUrl));
-            if (typeof pair.access_token !== "string" || typeof pair.refresh_token !== "string")
+            if (typeof pair.access_token !== "string" ||
+                typeof pair.refresh_token !== "string")
                 throw new CliError("the refresh response was missing a token", "session-refresh-shape");
             const rotated = tokensToAuth(ctx, pair.access_token, pair.refresh_token, current.sessionId);
             cfg.auth = rotated; // this process keeps using its own refreshed token
@@ -326,9 +405,17 @@ export function authStrategyFor(ctx, cfg) {
 // ── helpers ──────────────────────────────────────────────────────────────────────────────────────
 function tokensToAuth(ctx, accessToken, refreshToken, fallbackSid) {
     const claims = decodeJwtClaims(accessToken);
-    const exp = typeof claims.exp === "number" ? claims.exp * 1_000 : ctx.now().getTime() + 15 * 60_000;
+    const exp = typeof claims.exp === "number"
+        ? claims.exp * 1_000
+        : ctx.now().getTime() + 15 * 60_000;
     const sid = typeof claims.sid === "string" ? claims.sid : (fallbackSid ?? "");
-    return { kind: "oauth", accessToken, refreshToken, expiresAt: new Date(exp).toISOString(), sessionId: sid };
+    return {
+        kind: "oauth",
+        accessToken,
+        refreshToken,
+        expiresAt: new Date(exp).toISOString(),
+        sessionId: sid,
+    };
 }
 function decodeJwtClaims(token) {
     const parts = token.split(".");
@@ -342,13 +429,18 @@ function decodeJwtClaims(token) {
     }
 }
 function formHeaders() {
-    return { "content-type": "application/x-www-form-urlencoded", accept: "application/json" };
+    return {
+        "content-type": "application/x-www-form-urlencoded",
+        accept: "application/json",
+    };
 }
 function form(fields) {
     return new URLSearchParams(fields).toString();
 }
 async function safeFetch(ctx, url, init, signal) {
-    const sig = signal ? AbortSignal.any([signal, AbortSignal.timeout(REQUEST_TIMEOUT_MS)]) : AbortSignal.timeout(REQUEST_TIMEOUT_MS);
+    const sig = signal
+        ? AbortSignal.any([signal, AbortSignal.timeout(REQUEST_TIMEOUT_MS)])
+        : AbortSignal.timeout(REQUEST_TIMEOUT_MS);
     try {
         return await ctx.fetch(url, { ...init, signal: sig });
     }

package/dist/onboard-accounts.js

@@ -0,0 +1,259 @@
+import { loadConfig, normalizeBaseUrl } from "./config.js";
+import { readExistingOnboardJson } from "./onboard-existing.js";
+import { verifyOnboardRoutes } from "./onboard-capabilities.js";
+const listPath = "/api/v1/coding-accounts";
+const validatePath = "/api/v1/coding-accounts/:slot/validate";
+const object = (value) => value !== null && typeof value === "object" && !Array.isArray(value)
+    ? value
+    : null;
+const waiting = (reason) => ({
+    state: "waiting",
+    reason,
+});
+const slotPattern = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
+function binding(ctx, journal) {
+    const cfg = loadConfig(ctx.home);
+    if (!cfg?.user ||
+        cfg.account !== (journal.account ?? journal.tenant) ||
+        cfg.user.id !== journal.membershipId ||
+        !journal.baseUrl ||
+        normalizeBaseUrl(cfg.baseUrl) !== normalizeBaseUrl(journal.baseUrl))
+        return null;
+    return {
+        account: cfg.account,
+        person: cfg.user.id,
+        origin: normalizeBaseUrl(cfg.baseUrl),
+        role: cfg.user.role,
+    };
+}
+const equal = (a, b) => a?.account === b.account &&
+    a.person === b.person &&
+    a.origin === b.origin &&
+    a.role === b.role;
+async function inventory(ctx, journal, signal) {
+    const identity = binding(ctx, journal);
+    if (!identity)
+        return { reason: "account_identity_unverified" };
+    const support = await verifyOnboardRoutes(ctx, journal, [{ method: "GET", path: listPath }], signal);
+    if ("reason" in support)
+        return support;
+    if (!equal(binding(ctx, journal), identity))
+        return { reason: "account_identity_unverified" };
+    const read = await readExistingOnboardJson(ctx, listPath, signal);
+    if (!equal(binding(ctx, journal), identity))
+        return { reason: "account_identity_unverified" };
+    if ("reason" in read)
+        return { reason: "account_inventory_unavailable" };
+    const body = object(read.body);
+    const now = ctx.now().getTime();
+    if (!Array.isArray(body?.accounts) ||
+        body.accounts.length > 1000 ||
+        typeof body.observedAtMs !== "number" ||
+        !Number.isSafeInteger(body.observedAtMs) ||
+        body.observedAtMs > now + 5000 ||
+        body.observedAtMs < now - 30000)
+        return { reason: "account_inventory_unverified" };
+    const slots = [], seen = new Set();
+    for (const value of body.accounts) {
+        const row = object(value);
+        if (!row ||
+            typeof row.accountSlot !== "string" ||
+            !slotPattern.test(row.accountSlot) ||
+            seen.has(row.accountSlot) ||
+            typeof row.provider !== "string" ||
+            !/^[a-z][a-z0-9_-]{0,63}$/.test(row.provider) ||
+            typeof row.declaredState !== "string" ||
+            !["active", "inactive"].includes(row.declaredState) ||
+            typeof row.ownedByMe !== "boolean" ||
+            typeof row.needsCredential !== "boolean" ||
+            typeof row.walled !== "boolean" ||
+            typeof row.quarantined !== "boolean" ||
+            ![null, "renews", "canceled"].includes(row.renewalStatus) ||
+            !(row.revokedAtMs === null ||
+                (typeof row.revokedAtMs === "number" &&
+                    Number.isSafeInteger(row.revokedAtMs))) ||
+            !(row.accessEndsAtMs === null ||
+                (typeof row.accessEndsAtMs === "number" &&
+                    Number.isSafeInteger(row.accessEndsAtMs))))
+            return { reason: "account_inventory_unverified" };
+        seen.add(row.accountSlot);
+        // Project only metadata we need. Unknown server fields never enter output or receipts.
+        slots.push({
+            accountSlot: row.accountSlot,
+            provider: row.provider,
+            declaredState: row.declaredState,
+            ownedByMe: row.ownedByMe,
+            needsCredential: row.needsCredential,
+            walled: row.walled,
+            quarantined: row.quarantined,
+            renewalStatus: row.renewalStatus,
+            revokedAtMs: row.revokedAtMs,
+            accessEndsAtMs: row.accessEndsAtMs,
+        });
+    }
+    return { slots, identity };
+}
+/** Verify one existing Claude slot per run. A stored login, cached poll or Codex shape is not
+ * fresh provider access. Enrollment and a phase's actual lease eligibility remain separate. */
+export function onboardAccountsAdapter(input = {}) {
+    let proof = null;
+    let attempted = false;
+    const candidate = (slots, now) => slots
+        .filter((row) => row.provider === "claude" &&
+        row.declaredState === "active" &&
+        row.ownedByMe &&
+        !row.needsCredential &&
+        !row.walled &&
+        !row.quarantined &&
+        row.renewalStatus !== "canceled" &&
+        row.revokedAtMs === null &&
+        (row.accessEndsAtMs === null || row.accessEndsAtMs > now))
+        .sort((a, b) => a.accountSlot.localeCompare(b.accountSlot))[0];
+    const check = async (ctx, journal, signal) => {
+        const live = await inventory(ctx, journal, signal);
+        if ("reason" in live)
+            return waiting(live.reason);
+        const selected = candidate(live.slots, ctx.now().getTime());
+        if (proof &&
+            equal(live.identity, proof) &&
+            live.slots.some((row) => row.accountSlot === proof.slot &&
+                row.provider === proof.provider &&
+                row.declaredState === "active" &&
+                row.ownedByMe &&
+                !row.needsCredential &&
+                !row.walled &&
+                !row.quarantined &&
+                row.renewalStatus !== "canceled" &&
+                row.revokedAtMs === null &&
+                (row.accessEndsAtMs === null ||
+                    row.accessEndsAtMs > ctx.now().getTime())) &&
+            proof.checkedAtMs <= ctx.now().getTime() + 5000 &&
+            proof.checkedAtMs >= ctx.now().getTime() - 30000)
+            return {
+                state: "done",
+                evidence: {
+                    accountSlot: proof.slot,
+                    provider: proof.provider,
+                    checkedAt: new Date(proof.checkedAtMs).toISOString(),
+                },
+            };
+        proof = null;
+        if (!live.slots.length)
+            return waiting("account_enrollment_required");
+        if (!selected)
+            return waiting(live.slots.some((row) => row.provider === "codex")
+                ? "codex_provider_access_unverified"
+                : "account_provider_access_unverified");
+        if (attempted)
+            return waiting("account_provider_access_unverified");
+        const cfg = loadConfig(ctx.home);
+        if (!cfg?.user || !["owner", "admin"].includes(cfg.user.role))
+            return waiting("account_validation_admin_required");
+        return { state: "pending" };
+    };
+    return {
+        check,
+        act: async (ctx, journal, external) => {
+            if (attempted)
+                return waiting("account_provider_access_unverified");
+            const live = await inventory(ctx, journal, external);
+            if ("reason" in live)
+                return waiting(live.reason);
+            const selected = candidate(live.slots, ctx.now().getTime());
+            if (!selected)
+                return waiting("account_provider_access_unverified");
+            const support = await verifyOnboardRoutes(ctx, journal, [{ method: "POST", path: validatePath }], external);
+            if ("reason" in support)
+                return waiting(support.reason);
+            const cfg = loadConfig(ctx.home);
+            if (!equal(binding(ctx, journal), live.identity) ||
+                !cfg?.user ||
+                !["owner", "admin"].includes(cfg.user.role))
+                return waiting("account_identity_unverified");
+            const expiry = cfg.auth
+                ? Date.parse(cfg.auth.expiresAt) - ctx.now().getTime()
+                : 0;
+            const bearer = cfg.key ||
+                (cfg.auth && Number.isFinite(expiry) && expiry > 30000
+                    ? cfg.auth.accessToken
+                    : undefined);
+            if (!bearer)
+                return waiting("account_login_refresh_required");
+            input.message?.("Checking one stored Claude account with a one-token provider request. This may use Claude quota. Codex credentials are not refreshed. Phase eligibility is checked separately.");
+            // A display callback must not be able to switch the identity used for this request.
+            if (!equal(binding(ctx, journal), live.identity))
+                return waiting("account_identity_unverified");
+            const deadline = new AbortController();
+            const signal = external
+                ? AbortSignal.any([external, deadline.signal])
+                : deadline.signal;
+            const timer = setTimeout(() => deadline.abort(), 15000);
+            let remove = () => { };
+            try {
+                return await new Promise((resolve) => {
+                    const stopped = () => resolve(waiting(external?.aborted
+                        ? "interrupted"
+                        : "account_validation_unavailable"));
+                    if (signal.aborted) {
+                        stopped();
+                        return;
+                    }
+                    signal.addEventListener("abort", stopped, { once: true });
+                    remove = () => signal.removeEventListener("abort", stopped);
+                    Promise.resolve()
+                        .then(async () => {
+                        if (signal.aborted)
+                            return waiting("interrupted");
+                        // UI callbacks can queue a config change before this deferred send executes.
+                        if (!equal(binding(ctx, journal), live.identity))
+                            return waiting("account_identity_unverified");
+                        attempted = true;
+                        const response = await ctx.fetch(`${support.origin}/api/v1/coding-accounts/${encodeURIComponent(selected.accountSlot)}/validate`, {
+                            method: "POST",
+                            redirect: "error",
+                            signal,
+                            headers: {
+                                authorization: `Bearer ${bearer}`,
+                                accept: "application/json",
+                            },
+                        });
+                        if (response.status !== 200)
+                            return waiting("account_validation_unavailable");
+                        const body = object(await response.json());
+                        if (signal.aborted ||
+                            !equal(binding(ctx, journal), live.identity))
+                            return waiting("account_identity_unverified");
+                        const now = ctx.now().getTime();
+                        if (!body ||
+                            body.provider !== selected.provider ||
+                            typeof body.checkedAtMs !== "number" ||
+                            !Number.isSafeInteger(body.checkedAtMs) ||
+                            body.checkedAtMs > now + 5000 ||
+                            body.checkedAtMs < now - 30000 ||
+                            !["working", "walled", "rejected", "inconclusive"].includes(String(body.result)))
+                            return waiting("account_validation_unverified");
+                        if (body.result !== "working")
+                            return waiting(body.result === "walled"
+                                ? "account_provider_walled"
+                                : body.result === "rejected"
+                                    ? "account_provider_rejected"
+                                    : "account_provider_access_unverified");
+                        proof = {
+                            ...live.identity,
+                            slot: selected.accountSlot,
+                            provider: selected.provider,
+                            checkedAtMs: body.checkedAtMs,
+                        };
+                        input.message?.("Claude provider access was verified. This does not reserve a runner or prove that a phase can start.");
+                        return check(ctx, journal, signal);
+                    })
+                        .then((result) => (signal.aborted ? stopped() : resolve(result)), () => stopped());
+                });
+            }
+            finally {
+                clearTimeout(timer);
+                remove();
+            }
+        },
+    };
+}

package/dist/onboard-automation-management.js

@@ -0,0 +1,15 @@
+/** Rule management is unbuilt. This disposition does not assess the customer's actual rules.
+ * Cloud readiness and first-ticket eligibility must still reject conflicting or unreadable rules.
+ */
+export function onboardAutomationManagementAdapter(input = {}) {
+    return {
+        check: async (_ctx, _journal, signal) => {
+            if (signal?.aborted)
+                return { state: "waiting", reason: "interrupted" };
+            input.message?.("Linear automation management is unavailable. Setup made no automation change. Cloud readiness still checks your existing rules.");
+            if (signal?.aborted)
+                return { state: "waiting", reason: "interrupted" };
+            return { state: "skipped", reason: "automation_management_unavailable" };
+        },
+    };
+}