@rathnasgala/cli 0.0.22 → 1.1.4

package/src/gala-device-flow.js

@@ -1,121 +0,0 @@
-const DEVICE_GRANT = 'urn:ietf:params:oauth:grant-type:device_code';
-
-function requiredString(value, field) {
-  if (typeof value !== 'string' || value.trim() === '') throw new TypeError(`${field} is required`);
-  return value.trim();
-}
-
-function positiveInteger(value, field) {
-  if (!Number.isSafeInteger(value) || value <= 0) throw new TypeError(`${field} must be positive`);
-  return value;
-}
-
-function apiUrl(apiBaseUrl, path) {
-  const base = new URL(requiredString(apiBaseUrl, 'apiBaseUrl'));
-  const loopback = ['localhost', '127.0.0.1', '::1'].includes(base.hostname);
-  if ((base.protocol !== 'https:' && !(loopback && base.protocol === 'http:'))
-      || base.username || base.password || base.search || base.hash) {
-    throw new TypeError('apiBaseUrl must be a credential-free HTTPS URL (or HTTP loopback for testing)');
-  }
-  return new URL(path, base).href;
-}
-
-async function postForm(fetchImpl, url, fields) {
-  const response = await fetchImpl(url, {
-    method: 'POST',
-    headers: {
-      accept: 'application/json',
-      'content-type': 'application/x-www-form-urlencoded'
-    },
-    body: new URLSearchParams(fields)
-  });
-  let payload;
-  try {
-    payload = await response.json();
-  } catch {
-    const status = Number.isInteger(response?.status) ? ` (HTTP ${response.status})` : '';
-    throw new TypeError(`Gala device authorization returned invalid JSON${status}`);
-  }
-  if (payload == null || Array.isArray(payload) || typeof payload !== 'object') {
-    throw new TypeError('Gala device authorization response must be a JSON object');
-  }
-  return { response, payload };
-}
-
-export async function requestGalaDeviceCode({
-  apiBaseUrl = 'https://api.gala67.com',
-  clientId = 'gala-cli',
-  fetchImpl = fetch
-} = {}) {
-  const { response, payload } = await postForm(
-    fetchImpl,
-    apiUrl(apiBaseUrl, '/v1/auth/device/code'),
-    { client_id: requiredString(clientId, 'clientId') }
-  );
-  if (!response.ok) throw new Error(`Gala device authorization failed with HTTP ${response.status}`);
-  return Object.freeze({
-    deviceCode: requiredString(payload.device_code, 'device_code'),
-    userCode: requiredString(payload.user_code, 'user_code'),
-    verificationUri: requiredString(payload.verification_uri, 'verification_uri'),
-    verificationUriComplete: requiredString(
-      payload.verification_uri_complete,
-      'verification_uri_complete'
-    ),
-    expiresInSeconds: positiveInteger(payload.expires_in, 'expires_in'),
-    intervalSeconds: positiveInteger(payload.interval ?? 5, 'interval')
-  });
-}
-
-export async function pollForGalaToken({
-  deviceCode,
-  expiresInSeconds,
-  intervalSeconds,
-  apiBaseUrl = 'https://api.gala67.com',
-  clientId = 'gala-cli',
-  fetchImpl = fetch,
-  sleep = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)),
-  now = Date.now
-}) {
-  const code = requiredString(deviceCode, 'deviceCode');
-  const lifetime = positiveInteger(expiresInSeconds, 'expiresInSeconds') * 1000;
-  let interval = positiveInteger(intervalSeconds, 'intervalSeconds');
-  const startedAt = now();
-  if (!Number.isFinite(startedAt)) throw new TypeError('Clock must return epoch milliseconds');
-
-  while (true) {
-    await sleep(interval * 1000);
-    const currentTime = now();
-    if (!Number.isFinite(currentTime)) throw new TypeError('Clock must return epoch milliseconds');
-    if (currentTime - startedAt >= lifetime) {
-      throw new Error('Gala device authorization expired; run `gala auth` again');
-    }
-    const { response, payload } = await postForm(
-      fetchImpl,
-      apiUrl(apiBaseUrl, '/v1/auth/device/token'),
-      {
-        grant_type: DEVICE_GRANT,
-        device_code: code,
-        client_id: requiredString(clientId, 'clientId')
-      }
-    );
-    if (response.ok) {
-      if (requiredString(payload.token_type, 'token_type').toLowerCase() !== 'bearer') {
-        throw new TypeError('Gala token_type must be bearer');
-      }
-      return Object.freeze({
-        accessToken: requiredString(payload.access_token, 'access_token'),
-        expiresInSeconds: positiveInteger(payload.expires_in, 'expires_in')
-      });
-    }
-    if (payload.error === 'authorization_pending') continue;
-    if (payload.error === 'slow_down') {
-      interval += 5;
-      continue;
-    }
-    if (payload.error === 'expired_token') {
-      throw new Error('Gala device authorization expired; run `gala auth` again');
-    }
-    if (payload.error === 'access_denied') throw new Error('Gala device authorization was denied');
-    throw new Error(`Gala device authorization failed: ${requiredString(payload.error, 'error')}`);
-  }
-}

package/src/git-credentials.js

@@ -1,37 +0,0 @@
-/**
- * Git operations authenticated as the writer's Gala credential, not as the machine.
- *
- * Every git call used to fall through to whatever credential helper the machine had configured,
- * which is a different identity from the one the CLI just authenticated with. On this machine the
- * token belonged to `rfai8me` and git's stored credential to `anandrathnas`, so a scaffold created
- * the repository through the API and was then refused its own push:
- *
- *     remote: Permission to rfai8me/pub-231254.git denied to anandrathnas
- *
- * The OAuth App hid this because both identities were usually the same person. A writer with none
- * configured at all — a fresh machine, or someone who only uses SSH — had no chance.
- *
- * The token is passed through the environment rather than the argument list, because arguments are
- * visible to every process on the machine via `ps`, and written nowhere: an ephemeral `-c` helper
- * leaves no trace in `.git/config`.
- */
-export const GIT_TOKEN_VARIABLE = 'GALA_GIT_TOKEN';
-
-/** Clears inherited helpers first, or the machine's keychain answers before ours does. */
-export function gitCredentialArguments(accessToken) {
-  if (typeof accessToken !== 'string' || accessToken === '') return [];
-  return [
-    '-c', 'credential.helper=',
-    '-c', `credential.helper=!f() { test "$1" = get && echo username=x-access-token && echo "password=$${GIT_TOKEN_VARIABLE}"; }; f`
-  ];
-}
-
-export function gitEnvironment(accessToken, environment = process.env) {
-  if (typeof accessToken !== 'string' || accessToken === '') return environment;
-  return {
-    ...environment,
-    [GIT_TOKEN_VARIABLE]: accessToken,
-    // Nothing on this path may block waiting for a username at a terminal.
-    GIT_TERMINAL_PROMPT: '0'
-  };
-}

package/src/github-auth-command.js

@@ -1,50 +0,0 @@
-import { pollForAccessToken, requestDeviceCode } from './github-device-flow.js';
-import { writeGithubCredential } from './github-credential-store.js';
-
-/**
- * The Gala GitHub App, not an OAuth App.
- *
- * The CLI used to authenticate as a separate OAuth App (`Ov23ligTfectgl2FHJ6c`) while the browser
- * editor used the GitHub App. They are two different identity systems, and every difference fell on
- * the CLI: an OAuth token cannot list App installations, is blocked by organisation OAuth App
- * restrictions, and inherits none of the App's repository grants. The editor hit none of that.
- *
- * The one thing that forced an OAuth App — the CLI creating repositories before any installation
- * covered them — no longer applies: creation moved to the API. So both clients are now the same
- * GitHub App, and the differences disappear rather than being worked around.
- *
- * Client IDs are public; this is the value `GET /apps/gala67-app` publishes.
- */
-export const GITHUB_APP_CLIENT_ID = 'Iv23liIg7Hi1lMesiaon';
-
-export async function authenticateGithub({
-  clientId = GITHUB_APP_CLIENT_ID, fetchImpl = fetch, sleep, now = Date.now,
-  showInstructions, credentialTarget
-} = {}) {
-  if (typeof showInstructions !== 'function') {
-    throw new TypeError('device instructions are required');
-  }
-  // No scopes: a GitHub App's permissions are fixed on the app and granted at installation, so
-  // there is nothing to negotiate and nothing to warn about. The broad `repo` scope the OAuth App
-  // had to request — read/write on every repository the writer could reach — is gone with it.
-  const authorization = await requestDeviceCode({ clientId, fetchImpl });
-  showInstructions(authorization);
-  const token = await pollForAccessToken({
-    ...authorization, clientId, fetchImpl,
-    ...(sleep == null ? {} : { sleep }), now
-  });
-  /*
-   * The app expires user tokens after eight hours and issues a refresh token with each one.
-   * Exchanging that refresh token requires the app's client secret, which a published CLI cannot
-   * hold — so it is stored for the API-side refresh that will do the exchange, and until that
-   * exists an expired credential asks for one sign-in rather than failing somewhere further down
-   * as an unexplained 401.
-   */
-  const target = await writeGithubCredential({
-    accessToken: token.accessToken,
-    ...(token.expiresAt == null ? {} : { expiresAt: token.expiresAt }),
-    ...(token.refreshToken == null ? {} : { refreshToken: token.refreshToken }),
-    ...(credentialTarget == null ? {} : { target: credentialTarget })
-  });
-  return Object.freeze({ target, expiresAt: token.expiresAt ?? null });
-}

package/src/github-credential-store.js

@@ -1,104 +0,0 @@
-import { chmod, lstat, mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-
-export function githubCredentialPath({ platform = process.platform, environment = process.env, home = os.homedir() } = {}) {
-  if (platform === 'win32') {
-    if (!environment.APPDATA) throw new Error('APPDATA is required to store GitHub credentials on Windows');
-    return path.join(environment.APPDATA, 'Gala', 'github-credentials.json');
-  }
-  if (platform === 'darwin') return path.join(home, 'Library', 'Application Support', 'Gala', 'github-credentials.json');
-  return path.join(environment.XDG_CONFIG_HOME || path.join(home, '.config'), 'gala', 'github-credentials.json');
-}
-
-async function regularOrMissing(target) {
-  try {
-    const metadata = await lstat(target);
-    if (metadata.isSymbolicLink() || !metadata.isFile()) throw new TypeError('GitHub credential must be a regular file');
-    return true;
-  } catch (error) {
-    if (error.code === 'ENOENT') return false;
-    throw error;
-  }
-}
-
-/**
- * Schema 2 stores a GitHub App user token, which has no scopes.
- *
- * Schema 1 held an OAuth App token and recorded the `repo` and `workflow` scopes it had negotiated.
- * A GitHub App has neither: its permissions are fixed on the app and granted at installation. The
- * version bump is what makes the difference visible — a schema-1 file is rejected on read, so a
- * writer carrying an OAuth token is sent through `auth github` once rather than presenting a
- * credential the API will refuse in a less obvious way later.
- */
-export async function writeGithubCredential({
-  accessToken, expiresAt, refreshToken, target = githubCredentialPath()
-}) {
-  if (typeof accessToken !== 'string' || accessToken === '') throw new TypeError('accessToken is required');
-  if (expiresAt != null && Number.isNaN(new Date(expiresAt).getTime())) {
-    throw new TypeError('expiresAt must be a date');
-  }
-  const directory = path.dirname(path.resolve(target));
-  await mkdir(directory, { recursive: true, mode: 0o700 });
-  const directoryMetadata = await lstat(directory);
-  if (directoryMetadata.isSymbolicLink() || !directoryMetadata.isDirectory()) {
-    throw new TypeError('GitHub credential directory must be a real directory');
-  }
-  await chmod(directory, 0o700);
-  const exists = await regularOrMissing(target);
-  const temporary = `${target}.gala-${process.pid}`;
-  const backup = `${target}.gala-backup-${process.pid}`;
-  try {
-    const record = {
-      schemaVersion: 2,
-      accessToken,
-      ...(expiresAt == null ? {} : { expiresAt: new Date(expiresAt).toISOString() }),
-      ...(refreshToken == null ? {} : { refreshToken })
-    };
-    await writeFile(temporary, `${JSON.stringify(record)}\n`, {
-      flag: 'wx', mode: 0o600
-    });
-    await chmod(temporary, 0o600);
-    if (exists) await rename(target, backup);
-    try { await rename(temporary, target); }
-    catch (error) { if (exists) await rename(backup, target); throw error; }
-    await chmod(target, 0o600);
-    if (exists) await rm(backup);
-    return path.resolve(target);
-  } catch (error) {
-    await rm(temporary, { force: true });
-    throw error;
-  }
-}
-
-export async function readGithubCredential({ target = githubCredentialPath(), now = new Date() } = {}) {
-  if (!await regularOrMissing(target)) throw new Error('GitHub authentication is missing; run `gala auth github`');
-  const payload = JSON.parse(await readFile(target, 'utf8'));
-  if (payload?.schemaVersion === 1) {
-    // An OAuth App token. It cannot list installations and organisations may refuse it outright, so
-    // it is not usable — and saying that here beats a confusing 403 four calls later.
-    throw new Error('GitHub authentication is out of date; run `gala auth github` again');
-  }
-  if (payload?.schemaVersion !== 2 || typeof payload.accessToken !== 'string'
-      || payload.accessToken === '') {
-    throw new TypeError('GitHub credential file has an unsupported schema');
-  }
-  /*
-   * The app expires user tokens after eight hours. Refreshing one needs the app's client secret,
-   * which lives on the server, so until that exchange exists the honest answer is to ask for a
-   * sign-in here — rather than hand out a token that fails as a 401 several calls deeper, which is
-   * exactly how the legacy Gala credential wasted a week.
-   */
-  if (typeof payload.expiresAt === 'string') {
-    const expiresAt = new Date(payload.expiresAt);
-    if (Number.isNaN(expiresAt.getTime()) || expiresAt <= now) {
-      throw new Error('GitHub authentication expired; run `gala auth github` again');
-    }
-    return Object.freeze({
-      accessToken: payload.accessToken,
-      expiresAt,
-      ...(typeof payload.refreshToken === 'string' ? { refreshToken: payload.refreshToken } : {})
-    });
-  }
-  return Object.freeze({ accessToken: payload.accessToken });
-}

package/src/github-device-flow.js

@@ -1,153 +0,0 @@
-const DEVICE_CODE_URL = 'https://github.com/login/device/code';
-const ACCESS_TOKEN_URL = 'https://github.com/login/oauth/access_token';
-const DEVICE_GRANT = 'urn:ietf:params:oauth:grant-type:device_code';
-
-function requiredString(value, field) {
-  if (typeof value !== 'string' || value.trim() === '') {
-    throw new TypeError(`${field} is required`);
-  }
-  return value.trim();
-}
-
-function positiveInteger(value, field) {
-  if (!Number.isSafeInteger(value) || value <= 0) {
-    throw new TypeError(`${field} must be a positive integer`);
-  }
-  return value;
-}
-
-async function postForm(fetchImpl, url, fields) {
-  const response = await fetchImpl(url, {
-    method: 'POST',
-    headers: {
-      accept: 'application/json',
-      'content-type': 'application/x-www-form-urlencoded'
-    },
-    body: new URLSearchParams(fields)
-  });
-  if (!response.ok) {
-    throw new Error(`GitHub OAuth request failed with HTTP ${response.status}`);
-  }
-  const payload = await response.json();
-  if (payload == null || Array.isArray(payload) || typeof payload !== 'object') {
-    throw new TypeError('GitHub OAuth response must be a JSON object');
-  }
-  return payload;
-}
-
-/**
- * `scopes` is optional and must be omitted for a GitHub App.
- *
- * OAuth Apps negotiate scopes per authorization; GitHub Apps do not — their permissions are fixed
- * on the app and granted at installation. Sending a `scope` parameter to an App's device flow asks
- * for something the grant cannot express.
- */
-export async function requestDeviceCode({ clientId, scopes, fetchImpl = fetch }) {
-  const normalizedClientId = requiredString(clientId, 'clientId');
-  if (scopes != null && (!Array.isArray(scopes) || scopes.length === 0)) {
-    throw new TypeError('scopes must be a non-empty list when supplied');
-  }
-  const normalizedScopes = scopes == null
-    ? null
-    : scopes.map((scope) => requiredString(scope, 'scope'));
-  const payload = await postForm(fetchImpl, DEVICE_CODE_URL, {
-    client_id: normalizedClientId,
-    ...(normalizedScopes == null ? {} : { scope: normalizedScopes.join(' ') })
-  });
-
-  return Object.freeze({
-    deviceCode: requiredString(payload.device_code, 'device_code'),
-    userCode: requiredString(payload.user_code, 'user_code'),
-    verificationUri: requiredString(payload.verification_uri, 'verification_uri'),
-    expiresInSeconds: positiveInteger(payload.expires_in, 'expires_in'),
-    intervalSeconds: positiveInteger(payload.interval, 'interval')
-  });
-}
-
-export async function pollForAccessToken({
-  clientId,
-  deviceCode,
-  expiresInSeconds,
-  intervalSeconds,
-  requiredScopes = [],
-  fetchImpl = fetch,
-  sleep = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)),
-  now = Date.now
-}) {
-  const normalizedClientId = requiredString(clientId, 'clientId');
-  const normalizedDeviceCode = requiredString(deviceCode, 'deviceCode');
-  if (!Array.isArray(requiredScopes)) throw new TypeError('requiredScopes must be a list');
-  // A GitHub App answers with no `scope` field at all; there is nothing to require of it.
-  const normalizedRequiredScopes = (requiredScopes ?? []).map((scope) =>
-    requiredString(scope, 'scope').toLowerCase()
-  );
-  const lifetime = positiveInteger(expiresInSeconds, 'expiresInSeconds') * 1000;
-  let interval = positiveInteger(intervalSeconds, 'intervalSeconds');
-  const startedAt = now();
-  if (typeof startedAt !== 'number' || !Number.isFinite(startedAt)) {
-    throw new TypeError('Clock must return epoch milliseconds');
-  }
-
-  while (true) {
-    await sleep(interval * 1000);
-    const currentTime = now();
-    if (typeof currentTime !== 'number' || !Number.isFinite(currentTime)) {
-      throw new TypeError('Clock must return epoch milliseconds');
-    }
-    if (currentTime - startedAt >= lifetime) {
-      throw new Error('GitHub device code expired before authorization completed');
-    }
-
-    const payload = await postForm(fetchImpl, ACCESS_TOKEN_URL, {
-      client_id: normalizedClientId,
-      device_code: normalizedDeviceCode,
-      grant_type: DEVICE_GRANT
-    });
-    if (typeof payload.access_token === 'string' && payload.access_token !== '') {
-      const tokenType = requiredString(payload.token_type, 'token_type');
-      if (tokenType.toLowerCase() !== 'bearer') {
-        throw new TypeError('GitHub OAuth token_type must be bearer');
-      }
-      const grantedScopes = typeof payload.scope === 'string'
-        ? payload.scope.split(/[,\s]+/).map((scope) => scope.trim().toLowerCase()).filter(Boolean)
-        : [];
-      const missingScopes = normalizedRequiredScopes.filter((scope) => !grantedScopes.includes(scope));
-      if (missingScopes.length > 0) {
-        throw new Error(`GitHub authorization omitted required scope(s): ${missingScopes.join(', ')}`);
-      }
-      /*
-       * A GitHub App may be set to expire user tokens after eight hours, in which case GitHub
-       * returns `expires_in` and a refresh token. Refreshing one requires the app's client secret,
-       * which a published CLI cannot hold — so the expiry is reported rather than dropped, and the
-       * caller decides what to do about a credential it has no way to renew.
-       */
-      const expiresInSeconds = Number(payload.expires_in);
-      return Object.freeze({
-        accessToken: requiredString(payload.access_token, 'access_token'),
-        ...(Number.isFinite(expiresInSeconds) && expiresInSeconds > 0
-          ? { expiresAt: new Date(now() + expiresInSeconds * 1000) }
-          : {}),
-        ...(typeof payload.refresh_token === 'string' && payload.refresh_token !== ''
-          ? { refreshToken: payload.refresh_token }
-          : {}),
-        tokenType: 'bearer',
-        scopes: grantedScopes
-      });
-    }
-
-    if (payload.error === 'authorization_pending') continue;
-    if (payload.error === 'slow_down') {
-      interval = Number.isSafeInteger(payload.interval) && payload.interval > interval
-        ? payload.interval
-        : interval + 5;
-      continue;
-    }
-    if (payload.error === 'expired_token' || payload.error === 'token_expired') {
-      throw new Error('GitHub device code expired before authorization completed');
-    }
-    if (typeof payload.error === 'string' && payload.error !== '') {
-      throw new Error(`GitHub device authorization failed: ${payload.error}`);
-    }
-    throw new TypeError('GitHub OAuth response contained neither a token nor an error');
-  }
-}

package/src/github-empty-repository.js

@@ -1,89 +0,0 @@
-import { spawn } from 'node:child_process';
-import { describeHttpFailure } from './http-failure.js';
-
-const API_VERSION = '2026-03-10';
-
-export async function verifyEmptyRepository({ owner, repository, accessToken, fetchImpl = fetch }) {
-  const repositoryUrl = `https://api.github.com/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repository)}`;
-  const headers = {
-    accept: 'application/vnd.github+json', authorization: `Bearer ${accessToken}`,
-    'x-github-api-version': API_VERSION
-  };
-  const response = await fetchImpl(repositoryUrl, {
-    headers
-  });
-  if (response.status === 404) {
-    /*
-     * A GitHub App user token only sees repositories the App is installed on, so "not found" here
-     * usually means "not shared with Gala" rather than "does not exist". The OAuth token this
-     * replaced held `repo` and could see everything, which is exactly the access we stopped asking
-     * for — so the cost is that this needs saying out loud.
-     */
-    throw new Error(
-      `${owner}/${repository} is not visible to Gala. Either it does not exist, or the Gala GitHub `
-      + 'App has not been given access to it — install or share it at '
-      + 'https://github.com/settings/installations, then run scaffold again.'
-    );
-  }
-  if (!response.ok) throw new Error(await describeHttpFailure(response, 'GitHub repository lookup'));
-  const payload = await response.json();
-  if (payload.full_name?.toLowerCase() !== `${owner}/${repository}`.toLowerCase()) {
-    throw new TypeError('GitHub returned an unexpected repository');
-  }
-  const branchesResponse = await fetchImpl(`${repositoryUrl}/branches?per_page=1`, {
-    headers: {
-      ...headers
-    }
-  });
-  if (!branchesResponse.ok) throw new Error(await describeHttpFailure(branchesResponse, 'GitHub branch lookup'));
-  const branches = await branchesResponse.json();
-  if (payload.size !== 0 || !Array.isArray(branches) || branches.length !== 0) {
-    throw new Error('Existing repository is not empty; explicit non-empty adoption is not implemented');
-  }
-}
-
-export function setRepositoryOrigin({ root, owner, repository, spawnProcess = spawn }) {
-  const target = `https://github.com/${owner}/${repository}.git`;
-  return new Promise((resolve, reject) => {
-    const child = spawnProcess('git', ['-C', root, 'remote', 'set-url', 'origin', target], {
-      cwd: root, shell: false, stdio: 'inherit'
-    });
-    child.once('error', reject);
-    child.once('exit', (code, signal) => {
-      if (signal) reject(new Error(`Git remote update terminated by signal ${signal}`));
-      else if (code !== 0) reject(new Error(`Git remote update exited with code ${code}`));
-      else resolve();
-    });
-  });
-}
-
-export function verifyRepositoryOrigin({ root, owner, repository, spawnProcess = spawn }) {
-  const expected = `https://github.com/${owner}/${repository}.git`;
-  const expectedPath = `/${owner}/${repository}.git`;
-  return new Promise((resolve, reject) => {
-    const child = spawnProcess('git', ['-C', root, 'remote', 'get-url', 'origin'], {
-      cwd: root, shell: false, stdio: ['ignore', 'pipe', 'inherit']
-    });
-    let output = '';
-    child.stdout?.setEncoding('utf8');
-    child.stdout?.on('data', (chunk) => { output += chunk; });
-    child.once('error', reject);
-    child.once('exit', (code, signal) => {
-      if (signal) reject(new Error(`Git origin verification terminated by signal ${signal}`));
-      else if (code !== 0) reject(new Error(`Git origin verification exited with code ${code}`));
-      else {
-        let origin;
-        try {
-          origin = new URL(output.trim());
-        } catch {
-          reject(new Error(`Existing checkout origin must be ${expected}`));
-          return;
-        }
-        if (origin.protocol !== 'https:' || origin.hostname !== 'github.com' || origin.port !== ''
-            || origin.pathname !== expectedPath || origin.search !== '' || origin.hash !== '') {
-          reject(new Error(`Existing checkout origin must be ${expected}`));
-        } else resolve(root);
-      }
-    });
-  });
-}

package/src/github-identity.js

@@ -1,32 +0,0 @@
-import { describeHttpFailure } from './http-failure.js';
-const GITHUB_API_VERSION = '2026-03-10';
-
-/**
- * The GitHub account the stored credential belongs to.
- *
- * `scaffold` used to make the writer pass `--owner`, which is a value the token already knows and
- * they can only get wrong. The credential file holds the token and its scopes and nothing else, so
- * this is a live lookup rather than something cached at `auth github` time — a login can be
- * changed, and a stale one would create the repository under a name that no longer exists.
- */
-export async function resolveGithubLogin({ accessToken, fetchImpl = fetch }) {
-  if (typeof accessToken !== 'string' || accessToken === '') {
-    throw new TypeError('accessToken is required');
-  }
-  const response = await fetchImpl('https://api.github.com/user', {
-    headers: {
-      accept: 'application/vnd.github+json',
-      authorization: `Bearer ${accessToken}`,
-      'x-github-api-version': GITHUB_API_VERSION
-    }
-  });
-  if (!response.ok) throw new Error(await describeHttpFailure(response, 'GitHub account lookup'));
-  const payload = await response.json();
-  const login = payload?.login;
-  // The same shape `scaffold` demands of `--owner`. Refusing here beats a confusing failure four
-  // API calls later.
-  if (typeof login !== 'string' || !/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/.test(login)) {
-    throw new TypeError('GitHub returned an unusable account login');
-  }
-  return login;
-}