@rathnasgala/cli 0.0.22 → 1.1.4

package/src/scaffold-git.js

@@ -1,76 +0,0 @@
-import { spawn } from 'node:child_process';
-
-import { gitCredentialArguments, gitEnvironment } from './git-credentials.js';
-
-function run(root, args, spawnProcess, acceptedExitCodes = [0], accessToken) {
-  return new Promise((resolve, reject) => {
-    const child = spawnProcess('git', ['-C', root, ...gitCredentialArguments(accessToken), ...args], {
-      cwd: root, shell: false, stdio: 'inherit', env: gitEnvironment(accessToken)
-    });
-    child.once('error', reject);
-    child.once('exit', (code, signal) => {
-      if (signal) reject(new Error(`Git ${args[0]} terminated by signal ${signal}`));
-      else if (!acceptedExitCodes.includes(code)) reject(new Error(`Git ${args[0]} exited with code ${code}`));
-      else resolve(code);
-    });
-  });
-}
-
-function capture(root, args, spawnProcess) {
-  return new Promise((resolve, reject) => {
-    const child = spawnProcess('git', ['-C', root, ...args], {
-      cwd: root, shell: false, stdio: ['ignore', 'pipe', 'inherit']
-    });
-    let stdout = '';
-    child.stdout.on('data', (chunk) => { stdout += chunk; });
-    child.once('error', reject);
-    child.once('exit', (code, signal) => {
-      if (signal) reject(new Error(`Git ${args[0]} terminated by signal ${signal}`));
-      else if (code !== 0) reject(new Error(`Git ${args[0]} exited with code ${code}`));
-      else resolve(stdout.trim());
-    });
-  });
-}
-
-/**
- * Takes the commit registration just pushed, before anything local is written.
- *
- * Registering a site makes the server write `site.config.yml` and `.github/workflows/publish.yml`
- * into the repository. The checkout was taken before that, so the scaffold's own commit lands on a
- * parent the remote has moved past and the push is rejected:
- *
- *     ! [rejected] HEAD -> main (fetch first)
- *
- * Integrating here rather than after committing is what keeps it simple: at this point the working
- * tree is untouched, so the rebase is trivial and cannot conflict with files this process is about
- * to write. A dirty tree — only reachable via --resume — fails loudly, which is the right answer
- * for work nobody asked this command to reconcile.
- */
-export async function syncScaffold(root, { spawnProcess = spawn, accessToken } = {}) {
-  const branch = await capture(root, ['rev-parse', '--abbrev-ref', 'HEAD'], spawnProcess);
-  if (!/^[A-Za-z0-9._/-]+$/.test(branch) || branch === 'HEAD') {
-    throw new Error('Git checkout is not on a named branch');
-  }
-  await run(root, ['fetch', 'origin', branch], spawnProcess, [0], accessToken);
-  await run(root, ['rebase', `origin/${branch}`], spawnProcess);
-  const commitSha = await capture(root, ['rev-parse', 'HEAD'], spawnProcess);
-  if (!/^[0-9a-f]{40}$/.test(commitSha)) throw new Error('Git returned an invalid head SHA');
-  return commitSha;
-}
-
-export async function commitScaffold(root, { spawnProcess = spawn, accessToken } = {}) {
-  /*
-   * Only the site configuration. The publish workflow is written by the server during registration
-   * — the same path the browser editor uses — and staging a file that is not in the checkout yet
-   * fails outright with a pathspec error.
-   */
-  await run(root, ['add', '--', 'site.config.yml'], spawnProcess);
-  const unchanged = await run(root, ['diff', '--cached', '--quiet', '--exit-code'], spawnProcess, [0, 1]);
-  if (unchanged === 1) {
-    await run(root, ['commit', '-m', 'chore(gala): configure site'], spawnProcess);
-  }
-  await run(root, ['push', 'origin', 'HEAD'], spawnProcess, [0], accessToken);
-  const commitSha = await capture(root, ['rev-parse', 'HEAD'], spawnProcess);
-  if (!/^[0-9a-f]{40}$/.test(commitSha)) throw new Error('Git returned an invalid scaffold commit SHA');
-  return commitSha;
-}

package/src/scaffold-options.js

@@ -1,58 +0,0 @@
-export const scaffoldOptionNames = Object.freeze([
-  'theme',
-  'layout',
-  'palette',
-  'typography',
-  'spacing',
-  'radius',
-  'density',
-  'motion',
-  'componentStyle'
-]);
-
-const singleValueOptions = Object.freeze({
-  'site-name': 'siteName',
-  author: 'siteAuthor',
-  language: 'defaultLanguage',
-  timezone: 'timezone'
-});
-
-function requireValue(args, index, name) {
-  const value = args[index + 1];
-  if (!value || value.startsWith('--')) {
-    throw new Error(`Missing value for --${name}`);
-  }
-  return value;
-}
-
-export function parseScaffoldOptions(args) {
-  const values = {};
-
-  for (let index = 0; index < args.length; index += 1) {
-    const argument = args[index];
-    if (!argument.startsWith('--')) continue;
-
-    const name = argument.slice(2);
-    if (name === 'share-target') {
-      const value = requireValue(args, index, name);
-      values.shareTargets = [...(values.shareTargets ?? []), value];
-      index += 1;
-      continue;
-    }
-    if (name === 'social-profile') {
-      const value = requireValue(args, index, name);
-      values.socialProfiles = [...(values.socialProfiles ?? []), value];
-      index += 1;
-      continue;
-    }
-
-    const targetName = singleValueOptions[name] ?? name;
-    if (!scaffoldOptionNames.includes(name) && singleValueOptions[name] == null) continue;
-
-    const value = requireValue(args, index, name);
-    values[targetName] = value;
-    index += 1;
-  }
-
-  return values;
-}

package/src/scaffold-preflight.js

@@ -1,146 +0,0 @@
-import path from 'node:path';
-
-import { authenticateGala } from './auth-command.js';
-import { authenticateGithub } from './github-auth-command.js';
-import { readGalaCredential } from './gala-credential-store.js';
-import { readGithubCredential } from './github-credential-store.js';
-import { resolveGithubLogin } from './github-identity.js';
-import { galaCredentialAccepted } from './gala-credential-health.js';
-import { openInBrowser } from './open-browser.js';
-import { forgetGalaCredential } from './gala-credential-store.js';
-
-export const GITHUB_APP_INSTALL_URL = 'https://github.com/apps/gala67-app/installations/new';
-
-const DEFAULT_API_BASE_URL = 'https://api.gala67.com';
-
-/**
- * Everything `scaffold` needs, worked out rather than demanded.
- *
- * `scaffold` used to require four values up front — `--owner`, `--repository`, `--target` and
- * `--installation-id` — and it failed outright if `auth` or `auth github` had not been run first,
- * telling the writer to go and run them. Three of those four are derivable and the two sign-ins
- * can simply happen. Every one of them is still accepted as an explicit override; nothing that
- * worked before stops working.
- *
- * The steps are ordered so nothing is created until everything is known: the App installation is
- * confirmed before a repository exists, rather than after, so an interrupted run leaves no
- * half-connected repository behind.
- */
-export async function prepareScaffold({
-  owner,
-  repository,
-  target,
-  githubInstallationId,
-  siteName,
-  cwd = process.cwd(),
-  notify = () => {},
-  ask,
-  openUrl = openInBrowser,
-  readGala = readGalaCredential,
-  readGithub = readGithubCredential,
-  credentialAccepted = galaCredentialAccepted,
-  forgetGala = forgetGalaCredential,
-  signInGala = authenticateGala,
-  signInGithub = authenticateGithub,
-  resolveLogin = resolveGithubLogin,
-  apiBaseUrl = DEFAULT_API_BASE_URL
-} = {}) {
-  const gala = await ensureGala({
-    apiBaseUrl, notify, readGala, signInGala, credentialAccepted, forgetGala, openUrl
-  });
-  const github = await ensureGithub({ notify, readGithub, signInGithub, openUrl });
-
-  const resolvedOwner = owner ?? await resolveLogin({ accessToken: github.accessToken });
-
-  const resolvedRepository = repository
-    ?? (target == null ? null : path.basename(path.resolve(cwd, target)))
-    ?? repositoryNameFrom(siteName)
-    ?? await askForRepository(ask);
-
-  // `--target ./` is the common case and means "here", so the repository takes its name from the
-  // directory the writer is standing in. Everywhere else the repository names its own folder.
-  const resolvedTarget = target ?? `./${resolvedRepository}`;
-
-  /*
-   * No installation lookup. The id is an internal GitHub identifier for an App the server owns, and
-   * nothing here can discover it reliably: a GitHub App token could list installations and the CLI
-   * cannot hold one, while the repository inventory only carries the id once a repository exists —
-   * which, in the flow that creates the first repository, is never. The server resolves it during
-   * registration. `--installation-id` still overrides, for an account with several.
-   */
-  return Object.freeze({
-    owner: resolvedOwner,
-    repository: resolvedRepository,
-    target: resolvedTarget,
-    githubInstallationId: githubInstallationId ?? null
-  });
-}
-
-/**
- * A missing, expired or refused credential is a step to take, not an error to report.
- *
- * The stored file is checked against the server before anything depends on it, because a
- * credential that parses and has not expired can still be one the API refuses — and finding that
- * out four calls later, as an opaque 401 from whichever endpoint got there first, is how a
- * "sign in again" turned into a stack trace.
- */
-async function ensureGala({
-  apiBaseUrl, notify, readGala, signInGala, credentialAccepted, forgetGala, openUrl
-}) {
-  let stored = null;
-  try {
-    stored = await readGala();
-  } catch {
-    stored = null;
-  }
-
-  if (stored != null) {
-    const base = stored.apiBaseUrl ?? apiBaseUrl;
-    if (await credentialAccepted({ apiBaseUrl: base, accessToken: stored.accessToken })) {
-      return stored;
-    }
-    // Leaving it on disk would make every later command repeat this discovery.
-    await forgetGala();
-    notify('Your Gala sign-in is no longer valid.');
-  }
-
-  notify('Signing in to Gala.');
-  await signInGala({
-    apiBaseUrl,
-    showInstructions: ({ verificationUri, userCode }) =>
-      notify(`${openUrl(verificationUri) ? 'Opened' : 'Open'} ${verificationUri}\nEnter code: ${userCode}`)
-  });
-  return readGala();
-}
-
-async function ensureGithub({ notify, readGithub, signInGithub, openUrl }) {
-  try {
-    return await readGithub();
-  } catch {
-    notify('Signing in to GitHub.');
-    await signInGithub({
-      showInstructions: ({ verificationUri, userCode }) =>
-        notify(`${openUrl(verificationUri) ? 'Opened' : 'Open'} ${verificationUri}\nEnter code: ${userCode}`)
-    });
-    return readGithub();
-  }
-}
-
-/** GitHub repository names allow letters, digits, dot, underscore and hyphen, and nothing else. */
-export function repositoryNameFrom(siteName) {
-  if (typeof siteName !== 'string') return null;
-  const slug = siteName
-    .trim().toLowerCase()
-    .replace(/[^a-z0-9._-]+/g, '-')
-    .replace(/^-+|-+$/g, '');
-  return slug === '' ? null : slug;
-}
-
-async function askForRepository(ask) {
-  if (typeof ask !== 'function') {
-    throw new TypeError('repository is required; pass --repository or --site-name');
-  }
-  const answer = repositoryNameFrom(await ask('What should the publication repository be called? '));
-  if (answer == null) throw new TypeError('A repository name is required');
-  return answer;
-}

package/src/scaffold-site.js

@@ -1,185 +0,0 @@
-import { createHash } from 'node:crypto';
-import path from 'node:path';
-
-import { configureSite } from './configure-site.js';
-import { readGalaCredential } from './gala-credential-store.js';
-import { readGithubCredential } from './github-credential-store.js';
-import { awaitRepositoryContent, cloneRepository } from './github-template-repository.js';
-import { createPublication } from './publication-creation-client.js';
-import { installRepositoryVariable } from './github-repository-variable.js';
-import { provisionGithubPages } from './github-pages-provisioning.js';
-import { registerSite } from './site-registration-client.js';
-import { commitScaffold, syncScaffold } from './scaffold-git.js';
-import {
-  setRepositoryOrigin, verifyEmptyRepository, verifyRepositoryOrigin
-} from './github-empty-repository.js';
-
-function segment(value, field) {
-  if (typeof value !== 'string' || !/^[A-Za-z0-9_.-]+$/.test(value)) throw new TypeError(`${field} is invalid`);
-  return value;
-}
-
-function providerDefaultBase(owner) {
-  return `https://${owner.toLowerCase()}.github.io`;
-}
-
-function registrationLocation(owner, topology, canonicalBaseUrl) {
-  if (topology === 'provider-default') {
-    if (canonicalBaseUrl != null) {
-      throw new TypeError('--canonical-base-url is valid only with --topology custom-domain');
-    }
-    return { topology: 'PROVIDER_DEFAULT', canonicalBaseUrl: providerDefaultBase(owner) };
-  }
-  if (topology !== 'custom-domain') {
-    throw new TypeError('topology must be provider-default or custom-domain');
-  }
-  if (typeof canonicalBaseUrl !== 'string') {
-    throw new TypeError('--canonical-base-url is required with --topology custom-domain');
-  }
-  const canonical = new URL(canonicalBaseUrl);
-  if (canonical.protocol !== 'https:' || canonical.username || canonical.password
-      || canonical.port || canonical.search || canonical.hash || canonical.pathname !== '/') {
-    throw new TypeError('canonicalBaseUrl must be a credential-free HTTPS origin');
-  }
-  return { topology: 'CUSTOM_DOMAIN', canonicalBaseUrl: canonical.origin };
-}
-
-export async function scaffoldSite({
-  owner, repository, target, githubInstallationId, siteOptions, emptyExistingRepository = false,
-  notify = (message) => process.stdout.write(`${message}\n`), ask, openUrl,
-  resumeExistingCheckout = false, topology = 'provider-default', canonicalBaseUrl,
-  templateOwner = 'rathnasgala',
-  templateRepository = 'site-template',
-  readGithub = readGithubCredential, readGala = readGalaCredential,
-  createRepository = createPublication, awaitContent = awaitRepositoryContent, clone = cloneRepository,
-  configure = configureSite, register = registerSite,
-  installVariable = installRepositoryVariable,
-  provisionPages = provisionGithubPages,
-  commit = commitScaffold, sync = syncScaffold, verifyEmpty = verifyEmptyRepository, setOrigin = setRepositoryOrigin,
-  verifyCheckout = verifyRepositoryOrigin
-}) {
-  const requestedOwner = segment(owner, 'owner');
-  const requestedName = segment(repository, 'repository');
-  // Validated now so a bad --topology/--canonical-base-url combination fails before a repository
-  // exists. The value used later is recomputed once the server says who actually owns it.
-  registrationLocation(requestedOwner, topology, canonicalBaseUrl);
-  // Optional: the server resolves the installation from the owner when none is supplied. An
-  // explicit value is still validated, because a wrong one fails much later and less clearly.
-  if (githubInstallationId != null
-      && (!Number.isSafeInteger(githubInstallationId) || githubInstallationId <= 0)) {
-    throw new TypeError('githubInstallationId must be a positive integer');
-  }
-  if (target == null || path.resolve(target) === path.parse(path.resolve(target)).root) {
-    throw new TypeError('target must be a non-root local path');
-  }
-  const [github, gala] = await Promise.all([readGithub(), readGala()]);
-  // Creation reports which installation owns the new repository, so registration cannot disagree.
-  let resolvedInstallationId = githubInstallationId ?? null;
-  if (emptyExistingRepository && resumeExistingCheckout) {
-    throw new TypeError('emptyExistingRepository and resumeExistingCheckout are mutually exclusive');
-  }
-  /*
-   * The server decides the owner, not this process. It creates under the account the Gala App
-   * installation belongs to, which is not always the account behind the writer's OAuth token — an
-   * installation on an organisation they belong to gives a different owner entirely. Deriving the
-   * canonical URL, the idempotency key, the registration and the Pages target from the local guess
-   * would register a publication against a repository that does not exist.
-   */
-  let repositoryOwner = requestedOwner;
-  let repositoryName = requestedName;
-  let generated;
-  let root;
-  if (resumeExistingCheckout) {
-    root = await verifyCheckout({
-      root: path.resolve(target), owner: repositoryOwner, repository: repositoryName
-    });
-    generated = { fullName: `${repositoryOwner}/${repositoryName}` };
-  } else if (emptyExistingRepository) {
-    await verifyEmpty({ owner: repositoryOwner, repository: repositoryName, accessToken: github.accessToken });
-    generated = {
-      fullName: `${repositoryOwner}/${repositoryName}`,
-      cloneUrl: `https://github.com/${templateOwner}/${templateRepository}.git`
-    };
-  } else {
-    /*
-     * Created through the API, the same call the browser editor makes. Doing it here meant a second
-     * implementation with no fallback and no wait for the App installation to reach the result,
-     * which is why CLI-created repositories never appeared in the web UI.
-     */
-    const created = await createRepository({
-      apiBaseUrl: gala.apiBaseUrl, galaAccessToken: gala.accessToken,
-      githubAccessToken: github.accessToken, name: repositoryName,
-      notify, ask, openUrl, selfLogin: requestedOwner
-    });
-    repositoryOwner = segment(created.owner, 'owner');
-    repositoryName = segment(created.repository, 'repository');
-    resolvedInstallationId = created.installationId;
-    generated = { fullName: created.fullName, cloneUrl: created.cloneUrl };
-    // Creation is asynchronous: GitHub answers before the template content lands, and cloning into
-    // that window produces an empty checkout and a missing site.config.yml.
-    await awaitContent({
-      accessToken: github.accessToken, owner: created.owner, repository: created.repository
-    });
-  }
-  if (!resumeExistingCheckout) {
-    root = await clone({ cloneUrl: generated.cloneUrl, target, accessToken: github.accessToken });
-    if (emptyExistingRepository) await setOrigin({ root, owner: repositoryOwner, repository: repositoryName });
-  }
-  const location = registrationLocation(repositoryOwner, topology, canonicalBaseUrl);
-  await configure(root, siteOptions ?? {});
-
-  /*
-   * The writer's design choices go up before registration, and nothing goes up after it.
-   *
-   * Registration makes the server write `site.config.yml` and `.github/workflows/publish.yml` into
-   * the repository — the same code path the browser editor uses. The CLI used to write its own
-   * versions of both files afterwards and commit them, which produced a second commit whose whole
-   * content was rewriting `api-base-url` into a `vars` reference and stripping the template's
-   * comments. That second commit triggered a second Publish run, which collided with the first
-   * one's deployment record and failed:
-   *
-   *     Assigned-ID source moved on the remote branch: content/posts/example/index.en.md
-   *
-   * So those two files have one owner now, and it is the server. What is left here is the design
-   * configuration, which only the CLI receives — pushed first so the server provisions on top of
-   * it rather than around it.
-   */
-  await commit(root, { accessToken: github.accessToken });
-
-  const idempotencyKey = `scaffold-${createHash('sha256').update(`${repositoryOwner.toLowerCase()}/${repositoryName.toLowerCase()}`).digest('hex')}`;
-  const registration = await register({
-    apiBaseUrl: gala.apiBaseUrl, galaAccessToken: gala.accessToken,
-    githubAccessToken: github.accessToken, idempotencyKey,
-    githubInstallationId: resolvedInstallationId, repositoryOwner, repositoryName,
-    topology: location.topology, canonicalBaseUrl: location.canonicalBaseUrl
-  });
-
-  await installVariable({
-    owner: repositoryOwner, repository: repositoryName, accessToken: github.accessToken,
-    variableName: 'GALA_API_BASE_URL', variableValue: gala.apiBaseUrl
-  });
-
-  // Brings the server's provisioning commits into the checkout, so the writer's working copy holds
-  // the publication as it actually exists, and reports the commit publishing will run against.
-  const commitSha = await sync(root, { accessToken: github.accessToken });
-
-  /*
-   * Pages is only touched for a custom domain.
-   *
-   * On the provider default it was never doing anything: publishing creates a `gh-pages` branch and
-   * GitHub turns on classic Pages by itself — every scaffold produced a live site with
-   * `build_type: legacy, source: gh-pages` before this step ran, including runs that failed before
-   * reaching it. What the step did cost was up to ten minutes waiting on a workflow run, and a
-   * reported failure for a publication that was already serving.
-   *
-   * A custom domain is different: classic Pages will not point itself at someone's own hostname, so
-   * the API call is the thing that does it.
-   */
-  const pages = location.topology === 'CUSTOM_DOMAIN' ? await provisionPages({
-    owner: repositoryOwner, repository: repositoryName, accessToken: github.accessToken, commitSha,
-    customDomain: new URL(location.canonicalBaseUrl).hostname
-  }) : null;
-  return Object.freeze({
-    root, fullName: generated.fullName, siteId: registration.siteId, commitSha, pages
-  });
-}

package/src/site-config-registration.js

@@ -1,47 +0,0 @@
-import { lstat, readFile, rename, rm, writeFile } from 'node:fs/promises';
-import path from 'node:path';
-import { parse, stringify } from 'yaml';
-
-export async function writeRegisteredSiteConfiguration(root, {
-  siteId, canonicalBaseUrl, pathPrefix, topology
-}) {
-  if (!/^[0-7][0-9A-HJKMNP-TV-Z]{25}$/.test(siteId)) throw new TypeError('siteId is invalid');
-  if (!['provider-default', 'custom-domain', 'domain-root', 'domain-subpath'].includes(topology)) {
-    throw new TypeError('topology is invalid');
-  }
-  const canonical = new URL(canonicalBaseUrl);
-  if (canonical.protocol !== 'https:' || canonical.username || canonical.password || canonical.search
-      || canonical.hash || canonical.pathname !== '/') {
-    throw new TypeError('canonicalBaseUrl must be a credential-free HTTPS origin; put the URL path in pathPrefix');
-  }
-  const normalizedPrefix = pathPrefix === '' ? '/' : pathPrefix;
-  if (typeof normalizedPrefix !== 'string'
-      || !/^\/(?:[^/?#]+(?:\/[^/?#]+)*)?$/.test(normalizedPrefix)) {
-    throw new TypeError('pathPrefix must be a normalized URL path');
-  }
-  const target = path.resolve(root, 'site.config.yml');
-  const metadata = await lstat(target);
-  if (!metadata.isFile() || metadata.isSymbolicLink()) throw new TypeError('site.config.yml must be a regular file');
-  const config = parse(await readFile(target, 'utf8'));
-  if (config?.schemaVersion !== 1 || config.site == null || config.hosting == null) {
-    throw new TypeError('Unsupported site configuration schema');
-  }
-  config.site.id = siteId;
-  config.hosting.provider = 'github-pages';
-  config.hosting.topology = topology;
-  config.hosting.canonicalBaseUrl = canonical.origin;
-  config.hosting.pathPrefix = normalizedPrefix;
-  const temporary = `${target}.gala-register-${process.pid}`;
-  const backup = `${target}.gala-backup-${process.pid}`;
-  try {
-    await writeFile(temporary, stringify(config), { flag: 'wx' });
-    await rename(target, backup);
-    try { await rename(temporary, target); }
-    catch (error) { await rename(backup, target); throw error; }
-    await rm(backup);
-  } catch (error) {
-    await rm(temporary, { force: true });
-    throw error;
-  }
-  return config;
-}

package/src/site-registration-client.js

@@ -1,138 +0,0 @@
-import { describeHttpFailure } from './http-failure.js';
-const ULID = /^[0-7][0-9A-HJKMNP-TV-Z]{25}$/;
-const REPOSITORY_PART = /^[A-Za-z0-9_.-]+$/;
-const IDEMPOTENCY_KEY = /^[A-Za-z0-9._:-]{16,128}$/;
-
-function required(value, field, pattern) {
-  if (typeof value !== 'string' || !pattern.test(value)) throw new TypeError(`${field} is invalid`);
-  return value;
-}
-
-function apiUrl(apiBaseUrl) {
-  const base = new URL(apiBaseUrl);
-  const loopback = ['localhost', '127.0.0.1', '::1'].includes(base.hostname);
-  if ((base.protocol !== 'https:' && !(loopback && base.protocol === 'http:'))
-      || base.username || base.password || base.search || base.hash) {
-    throw new TypeError('apiBaseUrl must be a credential-free HTTPS URL (or HTTP loopback for testing)');
-  }
-  return new URL('/v1/sites', base).href;
-}
-
-/**
- * Exchanges the stored GitHub token for the short-lived capability the API's GitHub-scoped
- * endpoints require. Exported because publication creation needs the same capability, and two
- * copies of an auth exchange is how they drift.
- */
-export async function exchangeGithubAuthorization({
-  apiBaseUrl, galaAccessToken, githubAccessToken, fetchImpl
-}) {
-  if (typeof githubAccessToken !== 'string' || githubAccessToken === '') {
-    throw new Error('GitHub authentication is missing; run `gala auth`');
-  }
-  const response = await fetchImpl(new URL('/v1/auth/github/device-authorizations', apiBaseUrl), {
-    method: 'POST',
-    headers: {
-      accept: 'application/json',
-      authorization: `Bearer ${galaAccessToken}`,
-      'content-type': 'application/json'
-    },
-    body: JSON.stringify({ accessToken: githubAccessToken })
-  });
-  if (response.status === 401) {
-    throw new Error('GitHub or Gala authentication expired; run `gala auth` again');
-  }
-  if (response.status !== 200) {
-    throw new Error(await describeHttpFailure(response, 'GitHub repository authorization'));
-  }
-  const payload = await response.json();
-  return required(payload?.authorization, 'GitHub authorization', /^[A-Za-z0-9_-]{43}$/);
-}
-
-export async function registerSite({
-  apiBaseUrl = 'https://api.gala67.com',
-  galaAccessToken,
-  githubAccessToken,
-  idempotencyKey,
-  githubInstallationId,
-  repositoryOwner,
-  repositoryName,
-  topology,
-  canonicalBaseUrl,
-  fetchImpl = fetch
-}) {
-  if (typeof galaAccessToken !== 'string' || galaAccessToken === '') {
-    throw new Error('Gala authentication is missing; run `gala auth`');
-  }
-  const githubAuthorization = await exchangeGithubAuthorization({
-    apiBaseUrl, galaAccessToken, githubAccessToken, fetchImpl
-  });
-  required(idempotencyKey, 'idempotencyKey', IDEMPOTENCY_KEY);
-  required(repositoryOwner, 'repositoryOwner', REPOSITORY_PART);
-  required(repositoryName, 'repositoryName', REPOSITORY_PART);
-  if (githubInstallationId != null
-      && (!Number.isSafeInteger(githubInstallationId) || githubInstallationId <= 0)) {
-    throw new TypeError('githubInstallationId must be a positive integer');
-  }
-  if (!['PROVIDER_DEFAULT', 'CUSTOM_DOMAIN'].includes(topology)) {
-    throw new TypeError('topology is invalid');
-  }
-  const response = await fetchImpl(apiUrl(apiBaseUrl), {
-    method: 'POST',
-    headers: {
-      accept: 'application/json',
-      authorization: `Bearer ${galaAccessToken}`,
-      'content-type': 'application/json',
-      'github-authorization': githubAuthorization,
-      'idempotency-key': idempotencyKey
-    },
-    body: JSON.stringify({
-      // Omitted rather than sent as null: the server resolves it from the owner.
-      ...(githubInstallationId == null ? {} : { githubInstallationId }),
-      repositoryOwner,
-      repositoryName,
-      topology,
-      canonicalBaseUrl
-    })
-  });
-  if (response.status === 401) {
-    throw new Error('Gala authentication expired; run `gala auth` again');
-  }
-  if (response.status === 404) {
-    throw new Error(`GitHub App installation does not cover ${repositoryOwner}/${repositoryName}`);
-  }
-  if (response.status === 409) {
-    const failure = await response.clone().json().catch(() => null);
-    if (failure?.code === 'GITHUB_APP_NOT_INSTALLED') {
-      throw new Error(
-        `The Gala GitHub App is not installed on ${repositoryOwner}. Install it at `
-        + 'https://github.com/apps/gala67-app/installations/new for that account, then run scaffold '
-        + 'again.'
-      );
-    }
-    throw new Error('Site registration conflicts with existing protected state; use the recovery command');
-  }
-  if (response.status !== 201) throw new Error(await describeHttpFailure(response, 'Gala site registration'));
-  const payload = await response.json();
-  if (!ULID.test(payload?.siteId) || typeof payload.siteSecret !== 'string' || payload.siteSecret === '') {
-    throw new TypeError('Gala site registration response is invalid');
-  }
-  const canonical = new URL(payload.canonicalBaseUrl);
-  if (canonical.protocol !== 'https:' || canonical.username || canonical.password
-      || canonical.search || canonical.hash || canonical.pathname !== '/') {
-    throw new TypeError('Gala site registration returned an invalid canonicalBaseUrl');
-  }
-  if (typeof payload.pathPrefix !== 'string'
-      || !/^\/(?:[^/?#]+(?:\/[^/?#]+)*)?$/.test(payload.pathPrefix)) {
-    throw new TypeError('Gala site registration returned an invalid pathPrefix');
-  }
-  const location = response.headers?.get?.('location');
-  if (location !== `/v1/sites/${payload.siteId}`) {
-    throw new TypeError('Gala site registration returned an invalid Location header');
-  }
-  return Object.freeze({
-    siteId: payload.siteId,
-    siteSecret: payload.siteSecret,
-    canonicalBaseUrl: canonical.origin,
-    pathPrefix: payload.pathPrefix === '' ? '/' : payload.pathPrefix
-  });
-}