@catalyst-cloud/cli 0.14.6 → 0.14.7

package/dist/onboard-file-snapshot.js

@@ -0,0 +1,45 @@
+import { constants, closeSync, fstatSync, openSync, readSync } from "node:fs";
+import { CliError } from "./errors.js";
+/** Bounded, regular-file snapshot for the review precheck. This is not a CAS primitive. */
+export function onboardFileSnapshot(path) {
+    let fd;
+    try {
+        fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    }
+    catch (error) {
+        if (error !== null &&
+            typeof error === "object" &&
+            "code" in error &&
+            error.code === "ENOENT")
+            return null;
+        throw new CliError("The saved setup files could not be verified. Keep them and try again.", "onboard-file-unverified", 12);
+    }
+    try {
+        const before = fstatSync(fd);
+        const limit = 1024 * 1024;
+        if (!before.isFile() || before.size > limit)
+            throw new Error("invalid file");
+        const bytes = Buffer.alloc(limit + 1);
+        let used = 0;
+        for (;;) {
+            const read = readSync(fd, bytes, used, bytes.length - used, null);
+            used += read;
+            if (used > limit)
+                throw new Error("oversized file");
+            if (read === 0)
+                break;
+        }
+        const after = fstatSync(fd);
+        if (before.size !== after.size ||
+            before.mtimeMs !== after.mtimeMs ||
+            used !== after.size)
+            throw new Error("changed file");
+        return new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, used));
+    }
+    catch {
+        throw new CliError("The saved setup files could not be verified. Keep them and try again.", "onboard-file-unverified", 12);
+    }
+    finally {
+        closeSync(fd);
+    }
+}

package/dist/onboard-login-candidate.js

@@ -0,0 +1,261 @@
+import { constants, closeSync, fsyncSync, openSync, unlinkSync } from "node:fs";
+import { dirname } from "node:path";
+import { DEFAULT_BASE_URL, cliPath, configPathFor, contractPathFor, defaultReplicaDbFor, loadConfig, normalizeBaseUrl, readManifest, writeConfig, } from "./config.js";
+import { contractVersionInRange } from "./contract.js";
+import { CliError, UsageError } from "./errors.js";
+import { deviceFlowLogin } from "./oauth.js";
+import { fetchMe } from "./transport.js";
+import { onboardFileSnapshot } from "./onboard-file-snapshot.js";
+const stopped = () => new CliError("Sign-in paused. Your saved connection was not changed.", "onboard-signin-paused", 11);
+const object = (value) => value !== null && typeof value === "object" && !Array.isArray(value)
+    ? value
+    : null;
+async function bounded(external, ms, run) {
+    const owned = new AbortController();
+    const signal = external
+        ? AbortSignal.any([owned.signal, external])
+        : owned.signal;
+    const timer = setTimeout(() => owned.abort(), ms);
+    let remove = () => { };
+    try {
+        return await new Promise((resolve, reject) => {
+            const abort = () => reject(stopped());
+            if (signal.aborted) {
+                abort();
+                return;
+            }
+            signal.addEventListener("abort", abort, { once: true });
+            remove = () => signal.removeEventListener("abort", abort);
+            Promise.resolve()
+                .then(() => {
+                if (signal.aborted)
+                    throw stopped();
+                return run(signal);
+            })
+                .then((value) => (signal.aborted ? abort() : resolve(value)), reject);
+        });
+    }
+    finally {
+        clearTimeout(timer);
+        remove();
+        owned.abort();
+    }
+}
+function boundedResponse(response, signal) {
+    if (!response.body)
+        return response;
+    let bytes = 0;
+    const limit = new TransformStream({
+        transform(chunk, controller) {
+            if (signal.aborted)
+                throw stopped();
+            bytes += chunk.byteLength;
+            if (bytes > 1024 * 1024)
+                throw new CliError("The sign-in response could not be verified.", "onboard-response-unverified", 11);
+            controller.enqueue(chunk);
+        },
+    });
+    return new Response(response.body.pipeThrough(limit), {
+        status: response.status,
+        statusText: response.statusText,
+        headers: response.headers,
+    });
+}
+/** Staging keeps tokens in this closure. Neither config nor receipt nor auth caches is changed. */
+export async function stageOnboardLogin(ctx, input) {
+    const timeoutMs = input.timeoutMs ?? 600_000;
+    if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0 || timeoutMs > 600_000)
+        throw new UsageError("onboarding sign-in timeout must be 1 to 600000 milliseconds");
+    const reviewDeadline = Date.now() + timeoutMs;
+    const original = onboardFileSnapshot(configPathFor(ctx.home));
+    const saved = loadConfig(ctx.home);
+    const originalContract = onboardFileSnapshot(contractPathFor(ctx.home));
+    const baseUrl = normalizeBaseUrl(saved?.baseUrl ??
+        input.baseUrl ??
+        ctx.env.CATALYST_CLOUD_BASE_URL ??
+        DEFAULT_BASE_URL);
+    if (input.baseUrl && normalizeBaseUrl(input.baseUrl) !== baseUrl)
+        throw new CliError("Resume against the original cloud to change this login.", "onboard-base-url-mismatch", 12);
+    const url = new URL(baseUrl);
+    if (url.protocol !== "https:" || url.origin !== baseUrl)
+        throw new CliError("The saved cloud origin could not be verified.", "onboard-base-url-mismatch", 12);
+    const manifest = readManifest();
+    const validate = async (auth, signal) => {
+        if (signal.aborted)
+            throw stopped();
+        if (!Number.isFinite(Date.parse(auth.expiresAt)) ||
+            Date.parse(auth.expiresAt) - ctx.now().getTime() <= 30_000)
+            throw new CliError("Sign in again before accepting this plan.", "onboard-login-refresh-required", 11);
+        const fetchImpl = async (request, init) => boundedResponse(await ctx.fetch(request, {
+            ...init,
+            redirect: "error",
+            signal: init?.signal
+                ? AbortSignal.any([signal, init.signal])
+                : signal,
+        }), signal);
+        const me = await fetchMe(baseUrl, auth.accessToken, fetchImpl);
+        if (signal.aborted)
+            throw stopped();
+        if (!me.user)
+            throw new CliError("Onboarding needs your personal login.", "onboard-person-required", 12);
+        // Cached contracts and loadContract's stale fallback cannot approve a staged identity.
+        const response = await fetchImpl(`${baseUrl}/api/v1/agent/contract`, {
+            headers: {
+                authorization: `Bearer ${auth.accessToken}`,
+                accept: "application/json",
+            },
+        });
+        if (!response.ok)
+            throw new CliError("The workspace could not be verified. Your saved connection was not changed.", "onboard-candidate-unverified", 11);
+        const text = await response.text();
+        if (signal.aborted)
+            throw stopped();
+        if (Buffer.byteLength(text) > 1024 * 1024)
+            throw new CliError("The workspace response could not be verified.", "onboard-candidate-unverified", 11);
+        let contract;
+        try {
+            contract = object(JSON.parse(text));
+        }
+        catch {
+            contract = null;
+        }
+        if (object(contract?.account)?.id !== me.account ||
+            typeof contract?.contractVersion !== "string" ||
+            contractVersionInRange(contract.contractVersion, manifest.tenantContractRange) !== true)
+            throw new CliError("The workspace response did not match this login.", "onboard-candidate-unverified", 11);
+        return me;
+    };
+    const staged = await bounded(input.signal, timeoutMs, async (signal) => {
+        const stageCtx = {
+            ...ctx,
+            env: { ...ctx.env, CATALYST_CLOUD_TOKEN: undefined },
+            fetch: async (request, init) => boundedResponse(await ctx.fetch(request, {
+                ...init,
+                redirect: "error",
+                signal: init?.signal
+                    ? AbortSignal.any([signal, init.signal])
+                    : signal,
+            }), signal),
+        };
+        let auth;
+        try {
+            auth = await deviceFlowLogin(stageCtx, baseUrl, {
+                ...input.device,
+                discoveryCache: false,
+                signal,
+            });
+        }
+        catch {
+            if (signal.aborted)
+                throw stopped();
+            throw new CliError("Sign-in could not be verified. Your saved connection was not changed.", "onboard-signin-unverified", 11);
+        }
+        const me = await bounded(signal, 30_000, (readSignal) => validate(auth, readSignal));
+        if (onboardFileSnapshot(configPathFor(ctx.home)) !== original)
+            throw new CliError("Your saved login changed. Run setup again.", "onboard-login-changed", 11);
+        return { auth, me };
+    });
+    const user = staged.me.user;
+    if (!user)
+        throw new CliError("Onboarding needs your personal login.", "onboard-person-required", 12);
+    const identity = {
+        account: staged.me.account,
+        membershipId: user.id,
+        baseUrl,
+        role: user.role,
+        display: Object.freeze({
+            personLabel: user.label,
+            email: user.email,
+            workspaceName: staged.me.name,
+            workspaceSlug: staged.me.slug,
+        }),
+    };
+    let accepted = false;
+    return {
+        identity: Object.freeze(identity),
+        get accepted() {
+            return accepted;
+        },
+        async accept(signal, beforePublish) {
+            if (accepted)
+                throw new CliError("This sign-in preview was already accepted.", "onboard-candidate-used", 11);
+            const remaining = reviewDeadline - Date.now();
+            if (remaining <= 0)
+                throw stopped();
+            const me = await bounded(signal, Math.min(30_000, remaining), (readSignal) => validate(staged.auth, readSignal));
+            if (me.account !== identity.account ||
+                me.user?.id !== identity.membershipId ||
+                me.user.role !== identity.role)
+                throw new CliError("This login changed during review. Run setup again.", "onboard-login-changed", 11);
+            if (signal?.aborted)
+                throw stopped();
+            if (onboardFileSnapshot(configPathFor(ctx.home)) !== original)
+                throw new CliError("Your saved login changed. Run setup again.", "onboard-login-changed", 11);
+            if (onboardFileSnapshot(contractPathFor(ctx.home)) !== originalContract)
+                throw new CliError("Your setup files changed during review. Run setup again.", "onboard-login-changed", 11);
+            beforePublish?.();
+            const config = {
+                baseUrl,
+                account: me.account,
+                slug: me.slug,
+                name: me.name,
+                principal: me.principal,
+                permissions: me.permissions,
+                user: me.user,
+                auth: staged.auth,
+                joinedAt: ctx.now().toISOString(),
+                lastSkillBundleVersion: manifest.version,
+                cliPath: cliPath(),
+                ...(saved?.skillsDir ? { skillsDir: saved.skillsDir } : {}),
+                // A new workspace never inherits the old workspace's database path.
+                replicaDb: saved?.account === me.account
+                    ? (saved.replicaDb ?? defaultReplicaDbFor(ctx.home))
+                    : undefined,
+            };
+            // This is an accepted connection, not a two-file transaction. Existing config writers do
+            // not share the receipt lock; the precheck refuses visible changes but is not a CAS claim.
+            try {
+                writeConfig(ctx.home, config);
+            }
+            catch (error) {
+                const current = loadConfig(ctx.home);
+                accepted =
+                    current?.account === config.account &&
+                        current.user?.id === config.user?.id &&
+                        current.auth?.accessToken === config.auth?.accessToken;
+                if (accepted)
+                    throw new CliError("Your connection was accepted, but setup could not be recorded. Run catalyst onboard to resume.", "onboard-connection-accepted", 11);
+                throw error;
+            }
+            accepted = true;
+            const fd = openSync(configPathFor(ctx.home), constants.O_RDONLY | constants.O_NOFOLLOW);
+            try {
+                fsyncSync(fd);
+            }
+            finally {
+                closeSync(fd);
+            }
+            const directory = openSync(dirname(configPathFor(ctx.home)), constants.O_RDONLY | constants.O_NOFOLLOW);
+            try {
+                fsyncSync(directory);
+            }
+            finally {
+                closeSync(directory);
+            }
+            // The old cache has no identity scope. Invalidate it only after this reviewed connection
+            // is accepted, and only while its observed bytes still match. A failure remains partial.
+            if (onboardFileSnapshot(contractPathFor(ctx.home)) !== originalContract)
+                throw new CliError("Your connection was accepted, but setup could not be recorded. Run catalyst onboard to resume.", "onboard-connection-accepted", 11);
+            if (originalContract !== null) {
+                unlinkSync(contractPathFor(ctx.home));
+                const cacheDirectory = openSync(dirname(contractPathFor(ctx.home)), constants.O_RDONLY | constants.O_NOFOLLOW);
+                try {
+                    fsyncSync(cacheDirectory);
+                }
+                finally {
+                    closeSync(cacheDirectory);
+                }
+            }
+        },
+    };
+}

package/dist/onboard-projects.js

@@ -0,0 +1,350 @@
+import { verifyOnboardRoutes } from "./onboard-capabilities.js";
+import { loadConfig, normalizeBaseUrl } from "./config.js";
+import { readExistingOnboardJson, selectedOnboardTeam, } from "./onboard-existing.js";
+import { existingRepositoryAdapter, } from "./onboard-repositories.js";
+const object = (value) => value !== null && typeof value === "object" && !Array.isArray(value)
+    ? value
+    : null;
+const part = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,99}$/;
+const key = (row) => `${row.owner}/${row.name}`.toLowerCase();
+const waiting = (reason) => ({
+    state: "waiting",
+    reason,
+});
+function repository(value) {
+    const row = object(value);
+    return row &&
+        typeof row.owner === "string" &&
+        part.test(row.owner) &&
+        typeof row.name === "string" &&
+        part.test(row.name)
+        ? { owner: row.owner, name: row.name }
+        : null;
+}
+function pendingSelection(journal) {
+    const step = journal.steps.find((row) => row.id === "github.repos" && row.state === "done");
+    const raw = step?.evidence?.repository;
+    if (typeof raw !== "string" || raw.length > 64_000)
+        return null;
+    try {
+        const values = JSON.parse(raw);
+        if (!Array.isArray(values) ||
+            values.length !== 1 ||
+            object(values[0])?.teamId !== selectedOnboardTeam(journal))
+            return null;
+        return repository(values[0]);
+    }
+    catch {
+        return null;
+    }
+}
+async function options(ctx, journal, signal) {
+    const cfg = loadConfig(ctx.home);
+    if (!cfg?.user ||
+        !["owner", "admin"].includes(cfg.user.role) ||
+        cfg.account !== journal.account ||
+        cfg.user.id !== journal.membershipId ||
+        !journal.baseUrl ||
+        normalizeBaseUrl(cfg.baseUrl) !== normalizeBaseUrl(journal.baseUrl))
+        return { reason: "project_identity_unverified" };
+    const personId = cfg.user.id;
+    const teamId = selectedOnboardTeam(journal);
+    if (!teamId)
+        return { reason: "team_selection_unverified" };
+    const support = await verifyOnboardRoutes(ctx, journal, [{ method: "GET", path: "/api/v1/me/repositories/options" }], signal);
+    if ("reason" in support)
+        return support;
+    const sameIdentity = () => {
+        const current = loadConfig(ctx.home);
+        return (current?.user &&
+            ["owner", "admin"].includes(current.user.role) &&
+            current.account === cfg.account &&
+            current.user.id === personId &&
+            normalizeBaseUrl(current.baseUrl) === normalizeBaseUrl(cfg.baseUrl));
+    };
+    // The read helper loads its own credential. Reject a switch before that read and again
+    // after its body settles, before any provider names become receipt evidence.
+    if (!sameIdentity())
+        return { reason: "project_identity_unverified" };
+    const read = await readExistingOnboardJson(ctx, "/api/v1/me/repositories/options", signal);
+    if (!sameIdentity())
+        return { reason: "project_identity_unverified" };
+    if ("reason" in read)
+        return { reason: "project_options_unavailable" };
+    const body = object(read.body), linear = object(body?.linear), github = object(body?.github);
+    if (!linear ||
+        !github ||
+        linear.connected !== true ||
+        github.connected !== true ||
+        linear.error !== null ||
+        github.error !== null)
+        return { reason: "project_provider_inventory_unavailable" };
+    if (!Array.isArray(linear.teams) ||
+        linear.teams.length > 1_000 ||
+        !Array.isArray(github.repositories) ||
+        github.repositories.length > 10_000 ||
+        typeof github.truncated !== "boolean" ||
+        !Array.isArray(body?.taken) ||
+        body.taken.length > 10_000)
+        return { reason: "project_options_unverified" };
+    const teams = linear.teams.filter((value) => object(value)?.id === teamId);
+    const team = object(teams[0]);
+    if (teams.length !== 1 ||
+        typeof team?.key !== "string" ||
+        !/^[A-Za-z0-9_-]{1,64}$/.test(team.key))
+        return { reason: "team_selection_unverified" };
+    const rows = [], seen = new Set();
+    for (const value of github.repositories) {
+        const row = repository(value);
+        if (!row || seen.has(key(row)))
+            return { reason: "project_options_unverified" };
+        seen.add(key(row));
+        rows.push(row);
+    }
+    const taken = [];
+    for (const value of body.taken) {
+        const row = object(value);
+        const repo = repository({
+            owner: row?.githubRepoOwner,
+            name: row?.githubRepoName,
+        });
+        if (!row ||
+            !repo ||
+            typeof row.linearTeamId !== "string" ||
+            typeof row.status !== "string" ||
+            !["active", "archived"].includes(row.status))
+            return { reason: "project_options_unverified" };
+        taken.push({
+            teamId: row.linearTeamId,
+            repo,
+            active: row.status === "active",
+        });
+    }
+    return { rows, taken, teamKey: team.key, truncated: github.truncated };
+}
+/** Q3 records a choice. It does not report an unregistered repository as a cloud binding. */
+export function firstProjectAdapters(args, input = {}) {
+    const existing = existingRepositoryAdapter(args, input.chooseExisting);
+    let chosen = null;
+    const selected = (journal) => {
+        const explicit = args.flags.repo;
+        if (explicit !== undefined) {
+            const values = Array.isArray(explicit) ? explicit : [explicit];
+            if (values.length !== 1 || typeof values[0] !== "string")
+                return null;
+            const parts = values[0].split("/");
+            return parts.length === 2
+                ? repository({ owner: parts[0], name: parts[1] })
+                : null;
+        }
+        return chosen ?? pendingSelection(journal);
+    };
+    const selectionResult = (row, journal) => ({
+        state: "done",
+        evidence: {
+            repository: JSON.stringify([
+                { ...row, teamId: selectedOnboardTeam(journal) },
+            ]),
+            count: 1,
+        },
+    });
+    const binding = async (ctx, journal, signal) => {
+        const row = selected(journal);
+        if (!row)
+            return waiting("repository_selection_unverified");
+        return existingRepositoryAdapter({
+            ...args,
+            flags: { ...args.flags, repo: `${row.owner}/${row.name}` },
+        }).check(ctx, journal, signal);
+    };
+    const projectCheck = async (ctx, journal, signal) => {
+        const known = await existing.check(ctx, journal, signal);
+        if (known.state === "done")
+            return known;
+        const live = await binding(ctx, journal, signal);
+        if (live.state === "done")
+            return live;
+        if (live.reason !== "repository_inventory_empty")
+            return live;
+        const row = selected(journal);
+        if (!row)
+            return waiting("repository_selection_unverified");
+        const list = await options(ctx, journal, signal);
+        if ("reason" in list)
+            return waiting(list.reason);
+        const held = list.taken.filter((value) => value.teamId === selectedOnboardTeam(journal) ||
+            key(value.repo) === key(row));
+        if (held.length)
+            return waiting(held.length === 1 &&
+                held[0].active &&
+                held[0].teamId === selectedOnboardTeam(journal) &&
+                key(held[0].repo) === key(row)
+                ? "project_registration_visibility_pending"
+                : "project_binding_conflict");
+        return list.rows.some((value) => key(value) === key(row))
+            ? { state: "pending" }
+            : waiting("repository_selection_unverified");
+    };
+    return {
+        "github.repos": {
+            check: async (ctx, journal, signal) => {
+                const live = await existing.check(ctx, journal, signal);
+                if (live.state === "done")
+                    return live;
+                // A names-only Q3 receipt remains the selected choice when registration later becomes
+                // visible. Resolve its actual ID without asking the registered-repository picker again.
+                if (selected(journal)) {
+                    const registered = await binding(ctx, journal, signal);
+                    if (registered.state === "done" ||
+                        registered.reason !== "repository_inventory_empty")
+                        return registered;
+                }
+                if (live.reason !== "repository_inventory_empty")
+                    return live;
+                const list = await options(ctx, journal, signal);
+                if ("reason" in list)
+                    return waiting(list.reason);
+                const row = selected(journal);
+                if (row)
+                    return list.rows.some((value) => key(value) === key(row))
+                        ? selectionResult(row, journal)
+                        : waiting("repository_selection_unverified");
+                return input.chooseFirst && list.rows.length
+                    ? { state: "pending" }
+                    : waiting("repository_choice_required");
+            },
+            act: async (ctx, journal, signal) => {
+                const live = await existing.check(ctx, journal, signal);
+                if (live.reason !== "repository_inventory_empty")
+                    return existing.act ? existing.act(ctx, journal, signal) : live;
+                const list = await options(ctx, journal, signal);
+                if ("reason" in list)
+                    return waiting(list.reason);
+                if (!input.chooseFirst || !list.rows.length)
+                    return waiting("repository_choice_required");
+                if (list.truncated)
+                    input.message?.("GitHub returned part of its repository list. Choose a displayed repository, or stop and adjust the App access before resuming.");
+                let remove = () => { };
+                const answer = await new Promise((resolve, reject) => {
+                    const stopped = () => resolve(null);
+                    if (signal?.aborted) {
+                        stopped();
+                        return;
+                    }
+                    signal?.addEventListener("abort", stopped, { once: true });
+                    remove = () => signal?.removeEventListener("abort", stopped);
+                    Promise.resolve()
+                        .then(() => signal?.aborted
+                        ? null
+                        : input.chooseFirst(list.rows.map((row) => ({ ...row }))))
+                        .then(resolve, reject);
+                }).finally(() => remove());
+                if (signal?.aborted || answer === null)
+                    return waiting("interrupted");
+                chosen =
+                    list.rows.find((row) => key(row) === answer.toLowerCase()) ?? null;
+                if (!chosen)
+                    return waiting("repository_selection_unverified");
+                const fresh = await options(ctx, journal, signal);
+                return "reason" in fresh
+                    ? waiting(fresh.reason)
+                    : fresh.rows.some((row) => key(row) === key(chosen))
+                        ? selectionResult(chosen, journal)
+                        : waiting("repository_selection_unverified");
+            },
+        },
+        projects: {
+            check: projectCheck,
+            act: async (ctx, journal, signal) => {
+                const before = await projectCheck(ctx, journal, signal);
+                if (before.state !== "pending")
+                    return before;
+                const row = selected(journal);
+                if (!row)
+                    return waiting("repository_selection_unverified");
+                const list = await options(ctx, journal, signal);
+                if ("reason" in list)
+                    return waiting(list.reason);
+                // Recheck after the second provider read before any mutation; an archived holder is a conflict.
+                if (!list.rows.some((value) => key(value) === key(row)) ||
+                    list.taken.some((value) => value.teamId === selectedOnboardTeam(journal) ||
+                        key(value.repo) === key(row)))
+                    return projectCheck(ctx, journal, signal);
+                const result = await createFirstProject(ctx, journal, row, list.teamKey, signal);
+                if (result)
+                    return waiting(result);
+                return projectCheck(ctx, journal, signal);
+            },
+        },
+    };
+}
+async function createFirstProject(ctx, journal, row, teamKey, external) {
+    const support = await verifyOnboardRoutes(ctx, journal, [{ method: "POST", path: "/api/v1/me/repositories" }], external);
+    if ("reason" in support)
+        return support.reason;
+    const cfg = loadConfig(ctx.home);
+    if (!cfg?.user ||
+        !["admin", "owner"].includes(cfg.user.role) ||
+        cfg.account !== journal.account ||
+        cfg.user.id !== journal.membershipId ||
+        !journal.baseUrl ||
+        normalizeBaseUrl(cfg.baseUrl) !== normalizeBaseUrl(journal.baseUrl))
+        return "project_identity_unverified";
+    const expiry = cfg.auth
+        ? Date.parse(cfg.auth.expiresAt) - ctx.now().getTime()
+        : 0;
+    const bearer = cfg.key ||
+        (cfg.auth && Number.isFinite(expiry) && expiry > 30_000
+            ? cfg.auth.accessToken
+            : undefined);
+    if (!bearer)
+        return "project_login_refresh_required";
+    const owned = new AbortController(), signal = external
+        ? AbortSignal.any([external, owned.signal])
+        : owned.signal;
+    const timer = setTimeout(() => owned.abort(), 30_000);
+    let remove = () => { };
+    try {
+        return await new Promise((resolve) => {
+            const stopped = () => resolve(external?.aborted ? "interrupted" : "project_create_unverified");
+            if (signal.aborted) {
+                stopped();
+                return;
+            }
+            signal.addEventListener("abort", stopped, { once: true });
+            remove = () => signal.removeEventListener("abort", stopped);
+            Promise.resolve()
+                .then(async () => {
+                if (signal.aborted)
+                    return "interrupted";
+                const response = await ctx.fetch(`${normalizeBaseUrl(cfg.baseUrl)}/api/v1/me/repositories`, {
+                    method: "POST",
+                    redirect: "error",
+                    signal,
+                    headers: {
+                        authorization: `Bearer ${bearer}`,
+                        "content-type": "application/json",
+                        accept: "application/json",
+                    },
+                    body: JSON.stringify({
+                        name: `${row.owner}/${row.name}`.slice(0, 80),
+                        linearTeamId: selectedOnboardTeam(journal),
+                        linearTeamKey: teamKey,
+                        githubRepoOwner: row.owner,
+                        githubRepoName: row.name,
+                    }),
+                });
+                // A response is not readiness evidence. The next check reads the binding and contract again.
+                return response.status === 201 || response.status === 409
+                    ? null
+                    : "project_create_unverified";
+            })
+                .then((result) => (signal.aborted ? stopped() : resolve(result)), () => signal.aborted ? stopped() : resolve("project_create_unverified"));
+        });
+    }
+    finally {
+        clearTimeout(timer);
+        remove();
+        owned.abort();
+    }
+}