@rathnasgala/cli 0.0.1

package/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "@rathnasgala/cli",
+  "version": "0.0.1",
+  "type": "module",
+  "files": [
+    "src"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "bin": {
+    "gala": "src/index.js"
+  },
+  "scripts": {
+    "test": "node --test",
+    "lint": "node scripts/lint.js"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/rathnasgala/cli.git"
+  },
+  "dependencies": {
+    "@rathnasgala/content-validation": "0.0.1",
+    "libsodium-wrappers": "0.8.4",
+    "tar": "7.5.22",
+    "yaml": "2.9.0"
+  }
+}

package/src/assign-content-ids.js

@@ -0,0 +1 @@
+export { assignMissingContentIds } from '@rathnasgala/content-validation';

package/src/auth-command.js

@@ -0,0 +1,36 @@
+import { pollForGalaToken, requestGalaDeviceCode } from './gala-device-flow.js';
+import { writeGalaCredential } from './gala-credential-store.js';
+
+export async function authenticateGala({
+  apiBaseUrl = 'https://api.gala67.com',
+  clientId = 'gala-cli',
+  fetchImpl = fetch,
+  sleep,
+  now = Date.now,
+  showInstructions,
+  credentialTarget
+} = {}) {
+  if (typeof showInstructions !== 'function') throw new TypeError('showInstructions is required');
+  const authorization = await requestGalaDeviceCode({ apiBaseUrl, clientId, fetchImpl });
+  showInstructions({
+    verificationUri: authorization.verificationUri,
+    verificationUriComplete: authorization.verificationUriComplete,
+    userCode: authorization.userCode
+  });
+  const token = await pollForGalaToken({
+    ...authorization,
+    apiBaseUrl,
+    clientId,
+    fetchImpl,
+    ...(sleep == null ? {} : { sleep }),
+    now
+  });
+  const expiresAt = new Date(now() + token.expiresInSeconds * 1000);
+  const target = await writeGalaCredential({
+    accessToken: token.accessToken,
+    expiresAt,
+    apiBaseUrl,
+    ...(credentialTarget == null ? {} : { target: credentialTarget })
+  });
+  return Object.freeze({ target, expiresAt });
+}

package/src/configure-site.js

@@ -0,0 +1,77 @@
+import { lstat, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { normalizeSiteConfigurationOptions } from '@rathnasgala/content-validation';
+import { parse, stringify } from 'yaml';
+
+import { scaffoldOptionNames } from './scaffold-options.js';
+
+function nonEmptyString(value, field) {
+  if (typeof value !== 'string' || value.trim() === '') {
+    throw new TypeError(`${field} must be a non-empty string`);
+  }
+  return value.trim();
+}
+
+export async function configureSite(root, designOptions) {
+  const configPath = path.resolve(root, 'site.config.yml');
+  const relation = path.relative(path.resolve(root), configPath);
+  if (relation.startsWith('..') || path.isAbsolute(relation)) {
+    throw new TypeError('site.config.yml escapes the site root');
+  }
+
+  const metadata = await lstat(configPath);
+  if (metadata.isSymbolicLink() || !metadata.isFile()) {
+    throw new TypeError('site.config.yml must be a regular file');
+  }
+
+  let config;
+  try {
+    config = parse(await readFile(configPath, 'utf8'));
+  } catch (error) {
+    throw new TypeError(`Invalid site.config.yml: ${error.message}`);
+  }
+  if (config.schemaVersion !== 1 || config.design == null || Array.isArray(config.design)) {
+    throw new TypeError('Unsupported site configuration schema');
+  }
+
+  const siteOptions = Object.fromEntries(
+    Object.entries(designOptions).filter(([name]) => !scaffoldOptionNames.includes(name))
+  );
+  const normalizedSiteOptions = normalizeSiteConfigurationOptions(siteOptions);
+
+  for (const [name, value] of Object.entries(designOptions)) {
+    if (scaffoldOptionNames.includes(name)) {
+      config.design[name] = nonEmptyString(value, `Design option ${name}`);
+    }
+  }
+  if (normalizedSiteOptions.siteName != null) config.site.name = normalizedSiteOptions.siteName;
+  if (normalizedSiteOptions.siteAuthor != null) config.site.author = normalizedSiteOptions.siteAuthor;
+  if (normalizedSiteOptions.defaultLanguage != null) {
+    config.site.defaultLanguage = normalizedSiteOptions.defaultLanguage;
+  }
+  if (normalizedSiteOptions.timezone != null) config.site.timezone = normalizedSiteOptions.timezone;
+  if (normalizedSiteOptions.shareTargets != null) {
+    config.sharing.targets = normalizedSiteOptions.shareTargets;
+  }
+  if (normalizedSiteOptions.socialProfiles != null) {
+    config.sharing.socialProfiles = normalizedSiteOptions.socialProfiles;
+  }
+
+  const temporary = `${configPath}.gala-config-${process.pid}`;
+  const backup = `${configPath}.gala-backup-${process.pid}`;
+  try {
+    await writeFile(temporary, stringify(config), { flag: 'wx' });
+    await rename(configPath, backup);
+    try {
+      await rename(temporary, configPath);
+    } catch (error) {
+      await rename(backup, configPath);
+      throw error;
+    }
+    await rm(backup);
+  } catch (error) {
+    await rm(temporary, { force: true });
+    throw error;
+  }
+  return config;
+}

package/src/content-files.js

@@ -0,0 +1 @@
+export { markdownPostFiles } from '@rathnasgala/content-validation';

package/src/doctor-command.js

@@ -0,0 +1,214 @@
+import { createHash } from 'node:crypto';
+import { lstat, mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { readPublicationState, PUBLICATION_STATE_PATH } from './publication-state.js';
+
+async function sha256(file) {
+  return createHash('sha256').update(await readFile(file)).digest('hex');
+}
+
+export async function diagnoseFramework(root) {
+  const manifestPath = managedPath(root, '.gala/managed-files.json');
+  let manifest;
+  try {
+    await assertSafeAncestors(root, manifestPath);
+    await assertNotSymbolicLink(manifestPath, false);
+    manifest = parseManifest(await readFile(manifestPath, 'utf8'));
+  } catch (error) {
+    if (error.code === 'ENOENT') {
+      return [{ path: '.gala/managed-files.json', status: 'missing-manifest' }];
+    }
+    throw new TypeError(`Invalid managed-file manifest: ${error.message}`);
+  }
+
+  return diagnoseAgainstManifest(root, manifest);
+}
+
+export async function diagnosePublicationState(root) {
+  try {
+    await readPublicationState(root);
+    return { path: PUBLICATION_STATE_PATH.split(path.sep).join('/'), status: 'valid' };
+  } catch (error) {
+    if (error.code === 'ENOENT') {
+      return { path: PUBLICATION_STATE_PATH.split(path.sep).join('/'), status: 'missing' };
+    }
+    return {
+      path: PUBLICATION_STATE_PATH.split(path.sep).join('/'),
+      status: 'invalid',
+      detail: error.message
+    };
+  }
+}
+
+async function diagnoseAgainstManifest(root, manifest) {
+  const findings = [];
+  for (const [relativePath, expectedHash] of Object.entries(manifest.files)) {
+    if (relativePath === '.gala/managed-files.json') {
+      throw new TypeError('Managed-file manifest cannot manage itself');
+    }
+    const file = managedPath(root, relativePath);
+    try {
+      await assertSafeAncestors(root, file);
+      await assertNotSymbolicLink(file, false);
+      const actualHash = await sha256(file);
+      findings.push({
+        path: relativePath,
+        status: actualHash === expectedHash ? 'intact' : 'modified'
+      });
+    } catch (error) {
+      if (error.code !== 'ENOENT') throw error;
+      findings.push({ path: relativePath, status: 'missing' });
+    }
+  }
+  return findings;
+}
+
+function parseManifest(source) {
+  const manifest = JSON.parse(source);
+  if (manifest.schemaVersion !== 1 || manifest.files == null || Array.isArray(manifest.files)) {
+    throw new TypeError('Unsupported managed-file manifest schema');
+  }
+  return manifest;
+}
+
+function managedPath(root, relativePath) {
+  if (path.isAbsolute(relativePath)) throw new TypeError(`Managed path must be relative: ${relativePath}`);
+  const resolvedRoot = path.resolve(root);
+  const resolved = path.resolve(resolvedRoot, ...relativePath.split('/'));
+  const relation = path.relative(resolvedRoot, resolved);
+  if (relation.startsWith('..') || path.isAbsolute(relation)) {
+    throw new TypeError(`Managed path escapes the site root: ${relativePath}`);
+  }
+  const [firstSegment] = relation.split(path.sep);
+  const protectedFile = new Set([
+    '.engagement-snapshot.json',
+    '.gala/publication-state.yml',
+    '.github/workflows/publish.yml',
+    'CNAME',
+    'custom.css',
+    'site.config.yml'
+  ]).has(relation);
+  if (
+    protectedFile
+    || firstSegment === '.git'
+    || firstSegment === 'content'
+    || relation === '.env'
+    || (relation.startsWith('.env.') && relation !== '.env.example')
+  ) {
+    throw new TypeError(`Author-owned path cannot be managed: ${relativePath}`);
+  }
+  return resolved;
+}
+
+async function assertNotSymbolicLink(file, allowMissing) {
+  try {
+    const metadata = await lstat(file);
+    if (metadata.isSymbolicLink()) throw new TypeError(`Refusing symbolic link: ${file}`);
+    return metadata;
+  } catch (error) {
+    if (allowMissing && error.code === 'ENOENT') return null;
+    throw error;
+  }
+}
+
+async function assertSafeAncestors(root, file) {
+  const resolvedRoot = path.resolve(root);
+  const segments = path.relative(resolvedRoot, path.dirname(file)).split(path.sep).filter(Boolean);
+  let cursor = resolvedRoot;
+  for (const segment of segments) {
+    cursor = path.join(cursor, segment);
+    const metadata = await assertNotSymbolicLink(cursor, true);
+    if (metadata == null) return;
+    if (!metadata.isDirectory()) throw new TypeError(`Managed path ancestor is not a directory: ${cursor}`);
+  }
+}
+
+export async function repairFramework(root, sourceRoot, { renameImpl = rename, siteConfiguration } = {}) {
+  const manifestPath = path.resolve(root, '.gala', 'managed-files.json');
+  const sourceManifestPath = path.resolve(sourceRoot, '.gala', 'managed-files.json');
+  await assertSafeAncestors(sourceRoot, sourceManifestPath);
+  const sourceManifestMetadata = await assertNotSymbolicLink(sourceManifestPath, false);
+  if (!sourceManifestMetadata.isFile()) throw new TypeError('Trusted manifest must be a regular file');
+  const sourceManifest = await readFile(sourceManifestPath);
+  const manifest = parseManifest(sourceManifest.toString('utf8'));
+  await assertSafeAncestors(root, manifestPath);
+  await assertNotSymbolicLink(manifestPath, true);
+
+  const findings = await diagnoseAgainstManifest(root, manifest);
+  const repairTargets = findings.filter(({ status }) => status === 'missing' || status === 'modified');
+  const validated = [];
+
+  // Validate the entire repair set before replacing the first target.
+  for (const finding of repairTargets) {
+    const expectedHash = manifest.files[finding.path];
+    const source = managedPath(sourceRoot, finding.path);
+    const target = managedPath(root, finding.path);
+    await assertSafeAncestors(sourceRoot, source);
+    await assertSafeAncestors(root, target);
+    const sourceMetadata = await assertNotSymbolicLink(source, false);
+    if (!sourceMetadata.isFile()) throw new TypeError(`Repair source is not a file: ${finding.path}`);
+    const targetMetadata = await assertNotSymbolicLink(target, true);
+    if (await sha256(source) !== expectedHash) {
+      throw new TypeError(`Repair source hash mismatch: ${finding.path}`);
+    }
+    validated.push({ ...finding, source, target, targetExists: targetMetadata != null });
+  }
+
+  let existingManifest = null;
+  try { existingManifest = await readFile(manifestPath); } catch (error) {
+    if (error.code !== 'ENOENT') throw error;
+  }
+  if (!existingManifest?.equals(sourceManifest)) {
+    validated.push({
+      path: '.gala/managed-files.json',
+      target: manifestPath,
+      bytes: sourceManifest,
+      targetExists: existingManifest != null
+    });
+  }
+  if (siteConfiguration != null) {
+    const configTarget = path.resolve(root, 'site.config.yml');
+    await assertSafeAncestors(root, configTarget);
+    const configMetadata = await assertNotSymbolicLink(configTarget, false);
+    if (!configMetadata.isFile()) throw new TypeError('site.config.yml must be a regular file');
+    validated.push({
+      path: 'site.config.yml', target: configTarget,
+      bytes: Buffer.from(siteConfiguration), targetExists: true
+    });
+  }
+
+  const transaction = `${process.pid}-${Date.now()}`;
+  const prepared = [];
+  try {
+    for (const item of validated) {
+      await mkdir(path.dirname(item.target), { recursive: true });
+      const temporary = `${item.target}.gala-repair-${transaction}`;
+      const backup = `${item.target}.gala-backup-${transaction}`;
+      await writeFile(temporary, item.bytes ?? await readFile(item.source), { flag: 'wx' });
+      prepared.push({ ...item, temporary, backup, backedUp: false, installed: false });
+    }
+    for (const item of prepared) {
+      if (item.targetExists) {
+        await renameImpl(item.target, item.backup);
+        item.backedUp = true;
+      }
+      await renameImpl(item.temporary, item.target);
+      item.installed = true;
+    }
+  } catch (error) {
+    const rollbackErrors = [];
+    for (const item of [...prepared].reverse()) {
+      try {
+        if (item.installed) await rm(item.target, { force: true });
+        if (item.backedUp) await renameImpl(item.backup, item.target);
+        await rm(item.temporary, { force: true });
+      } catch (rollbackError) { rollbackErrors.push(rollbackError); }
+    }
+    if (rollbackErrors.length > 0) {
+      throw new AggregateError([error, ...rollbackErrors], 'Framework repair and rollback failed');
+    }
+    throw error;
+  }
+  for (const item of prepared) if (item.backedUp) await rm(item.backup);
+  return prepared.map(({ path: repairedPath }) => repairedPath);
+}

package/src/evaluation-date.js

@@ -0,0 +1 @@
+export { repositoryEvaluationDate } from '@rathnasgala/content-validation';

package/src/gala-credential-store.js

@@ -0,0 +1,104 @@
+import { chmod, lstat, mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+export function galaCredentialPath({
+  platform = process.platform,
+  environment = process.env,
+  home = os.homedir()
+} = {}) {
+  if (platform === 'win32') {
+    const root = environment.APPDATA;
+    if (!root) throw new Error('APPDATA is required to store Gala credentials on Windows');
+    return path.join(root, 'Gala', 'credentials.json');
+  }
+  if (platform === 'darwin') {
+    return path.join(home, 'Library', 'Application Support', 'Gala', 'credentials.json');
+  }
+  const root = environment.XDG_CONFIG_HOME || path.join(home, '.config');
+  return path.join(root, 'gala', 'credentials.json');
+}
+
+async function regularOrMissing(target, label) {
+  try {
+    const metadata = await lstat(target);
+    if (metadata.isSymbolicLink() || !metadata.isFile()) {
+      throw new TypeError(`${label} must be a regular file`);
+    }
+    return true;
+  } catch (error) {
+    if (error.code === 'ENOENT') return false;
+    throw error;
+  }
+}
+
+export async function writeGalaCredential({
+  accessToken,
+  expiresAt,
+  apiBaseUrl,
+  target = galaCredentialPath()
+}) {
+  if (typeof accessToken !== 'string' || accessToken === '') throw new TypeError('accessToken is required');
+  if (!(expiresAt instanceof Date) || Number.isNaN(expiresAt.getTime())) {
+    throw new TypeError('expiresAt must be a valid Date');
+  }
+  const base = new URL(apiBaseUrl);
+  const loopback = base.protocol === 'http:' && ['127.0.0.1', 'localhost', '::1'].includes(base.hostname);
+  if ((base.protocol !== 'https:' && !loopback) || base.username || base.password
+      || base.search || base.hash) {
+    throw new TypeError('apiBaseUrl must be credential-free HTTPS (or HTTP loopback) without query or fragment');
+  }
+  const directory = path.dirname(path.resolve(target));
+  await mkdir(directory, { recursive: true, mode: 0o700 });
+  const directoryMetadata = await lstat(directory);
+  if (directoryMetadata.isSymbolicLink() || !directoryMetadata.isDirectory()) {
+    throw new TypeError('Gala credential directory must be a real directory');
+  }
+  await chmod(directory, 0o700);
+  const exists = await regularOrMissing(target, 'Gala credential file');
+  const temporary = `${target}.gala-${process.pid}`;
+  const backup = `${target}.gala-backup-${process.pid}`;
+  const content = `${JSON.stringify({
+    schemaVersion: 1,
+    apiBaseUrl: base.href,
+    accessToken,
+    expiresAt: expiresAt.toISOString()
+  })}\n`;
+  try {
+    await writeFile(temporary, content, { flag: 'wx', mode: 0o600 });
+    await chmod(temporary, 0o600);
+    if (exists) await rename(target, backup);
+    try {
+      await rename(temporary, target);
+    } catch (error) {
+      if (exists) await rename(backup, target);
+      throw error;
+    }
+    await chmod(target, 0o600);
+    if (exists) await rm(backup);
+    return path.resolve(target);
+  } catch (error) {
+    await rm(temporary, { force: true });
+    throw error;
+  }
+}
+
+export async function readGalaCredential({ target = galaCredentialPath(), now = new Date() } = {}) {
+  if (!await regularOrMissing(target, 'Gala credential file')) {
+    throw new Error('Gala authentication is missing; run `gala auth`');
+  }
+  const payload = JSON.parse(await readFile(target, 'utf8'));
+  if (payload?.schemaVersion !== 1 || typeof payload.accessToken !== 'string'
+      || typeof payload.apiBaseUrl !== 'string' || typeof payload.expiresAt !== 'string') {
+    throw new TypeError('Gala credential file has an unsupported schema');
+  }
+  const expiresAt = new Date(payload.expiresAt);
+  if (Number.isNaN(expiresAt.getTime()) || expiresAt <= now) {
+    throw new Error('Gala authentication expired; run `gala auth` again');
+  }
+  return Object.freeze({
+    accessToken: payload.accessToken,
+    apiBaseUrl: payload.apiBaseUrl,
+    expiresAt
+  });
+}

package/src/gala-device-flow.js

@@ -0,0 +1,121 @@
+const DEVICE_GRANT = 'urn:ietf:params:oauth:grant-type:device_code';
+
+function requiredString(value, field) {
+  if (typeof value !== 'string' || value.trim() === '') throw new TypeError(`${field} is required`);
+  return value.trim();
+}
+
+function positiveInteger(value, field) {
+  if (!Number.isSafeInteger(value) || value <= 0) throw new TypeError(`${field} must be positive`);
+  return value;
+}
+
+function apiUrl(apiBaseUrl, path) {
+  const base = new URL(requiredString(apiBaseUrl, 'apiBaseUrl'));
+  const loopback = ['localhost', '127.0.0.1', '::1'].includes(base.hostname);
+  if ((base.protocol !== 'https:' && !(loopback && base.protocol === 'http:'))
+      || base.username || base.password || base.search || base.hash) {
+    throw new TypeError('apiBaseUrl must be a credential-free HTTPS URL (or HTTP loopback for testing)');
+  }
+  return new URL(path, base).href;
+}
+
+async function postForm(fetchImpl, url, fields) {
+  const response = await fetchImpl(url, {
+    method: 'POST',
+    headers: {
+      accept: 'application/json',
+      'content-type': 'application/x-www-form-urlencoded'
+    },
+    body: new URLSearchParams(fields)
+  });
+  let payload;
+  try {
+    payload = await response.json();
+  } catch {
+    const status = Number.isInteger(response?.status) ? ` (HTTP ${response.status})` : '';
+    throw new TypeError(`Gala device authorization returned invalid JSON${status}`);
+  }
+  if (payload == null || Array.isArray(payload) || typeof payload !== 'object') {
+    throw new TypeError('Gala device authorization response must be a JSON object');
+  }
+  return { response, payload };
+}
+
+export async function requestGalaDeviceCode({
+  apiBaseUrl = 'https://api.gala67.com',
+  clientId = 'gala-cli',
+  fetchImpl = fetch
+} = {}) {
+  const { response, payload } = await postForm(
+    fetchImpl,
+    apiUrl(apiBaseUrl, '/v1/auth/device/code'),
+    { client_id: requiredString(clientId, 'clientId') }
+  );
+  if (!response.ok) throw new Error(`Gala device authorization failed with HTTP ${response.status}`);
+  return Object.freeze({
+    deviceCode: requiredString(payload.device_code, 'device_code'),
+    userCode: requiredString(payload.user_code, 'user_code'),
+    verificationUri: requiredString(payload.verification_uri, 'verification_uri'),
+    verificationUriComplete: requiredString(
+      payload.verification_uri_complete,
+      'verification_uri_complete'
+    ),
+    expiresInSeconds: positiveInteger(payload.expires_in, 'expires_in'),
+    intervalSeconds: positiveInteger(payload.interval ?? 5, 'interval')
+  });
+}
+
+export async function pollForGalaToken({
+  deviceCode,
+  expiresInSeconds,
+  intervalSeconds,
+  apiBaseUrl = 'https://api.gala67.com',
+  clientId = 'gala-cli',
+  fetchImpl = fetch,
+  sleep = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)),
+  now = Date.now
+}) {
+  const code = requiredString(deviceCode, 'deviceCode');
+  const lifetime = positiveInteger(expiresInSeconds, 'expiresInSeconds') * 1000;
+  let interval = positiveInteger(intervalSeconds, 'intervalSeconds');
+  const startedAt = now();
+  if (!Number.isFinite(startedAt)) throw new TypeError('Clock must return epoch milliseconds');
+
+  while (true) {
+    await sleep(interval * 1000);
+    const currentTime = now();
+    if (!Number.isFinite(currentTime)) throw new TypeError('Clock must return epoch milliseconds');
+    if (currentTime - startedAt >= lifetime) {
+      throw new Error('Gala device authorization expired; run `gala auth` again');
+    }
+    const { response, payload } = await postForm(
+      fetchImpl,
+      apiUrl(apiBaseUrl, '/v1/auth/device/token'),
+      {
+        grant_type: DEVICE_GRANT,
+        device_code: code,
+        client_id: requiredString(clientId, 'clientId')
+      }
+    );
+    if (response.ok) {
+      if (requiredString(payload.token_type, 'token_type').toLowerCase() !== 'bearer') {
+        throw new TypeError('Gala token_type must be bearer');
+      }
+      return Object.freeze({
+        accessToken: requiredString(payload.access_token, 'access_token'),
+        expiresInSeconds: positiveInteger(payload.expires_in, 'expires_in')
+      });
+    }
+    if (payload.error === 'authorization_pending') continue;
+    if (payload.error === 'slow_down') {
+      interval += 5;
+      continue;
+    }
+    if (payload.error === 'expired_token') {
+      throw new Error('Gala device authorization expired; run `gala auth` again');
+    }
+    if (payload.error === 'access_denied') throw new Error('Gala device authorization was denied');
+    throw new Error(`Gala device authorization failed: ${requiredString(payload.error, 'error')}`);
+  }
+}

package/src/github-auth-command.js

@@ -0,0 +1,29 @@
+import { pollForAccessToken, requestDeviceCode } from './github-device-flow.js';
+import { writeGithubCredential } from './github-credential-store.js';
+
+export const GITHUB_OAUTH_CLIENT_ID = 'Ov23ligTfectgl2FHJ6c';
+export const GITHUB_SCAFFOLD_SCOPES = Object.freeze(['repo', 'workflow']);
+
+export async function authenticateGithub({
+  clientId = GITHUB_OAUTH_CLIENT_ID, fetchImpl = fetch, sleep, now = Date.now,
+  showScopeWarning, showInstructions, credentialTarget
+} = {}) {
+  if (typeof showScopeWarning !== 'function' || typeof showInstructions !== 'function') {
+    throw new TypeError('scope warning and device instructions are required');
+  }
+  showScopeWarning({
+    scopes: GITHUB_SCAFFOLD_SCOPES,
+    explanation: 'repo grants read/write access to every public and private repository you can access; workflow is used only for scaffold and explicit action-major migration.'
+  });
+  const authorization = await requestDeviceCode({ clientId, scopes: GITHUB_SCAFFOLD_SCOPES, fetchImpl });
+  showInstructions(authorization);
+  const token = await pollForAccessToken({
+    ...authorization, clientId, requiredScopes: GITHUB_SCAFFOLD_SCOPES, fetchImpl,
+    ...(sleep == null ? {} : { sleep }), now
+  });
+  const target = await writeGithubCredential({
+    accessToken: token.accessToken, scopes: token.scopes,
+    ...(credentialTarget == null ? {} : { target: credentialTarget })
+  });
+  return Object.freeze({ target, scopes: token.scopes });
+}