@the-open-engine/zeroshot 6.26.0 → 6.28.0

package/lib/hosted-session/coordinator.cjs

@@ -0,0 +1,101 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HostedSessionCoordinator = void 0;
+const index_js_1 = require("../cluster/index.cjs");
+function combineSignals(signals) {
+    const defined = signals.filter((s) => s !== undefined);
+    if (defined.length === 0)
+        return undefined;
+    if (defined.length === 1)
+        return defined[0];
+    return AbortSignal.any(defined);
+}
+class HostedSessionCoordinator {
+    #getAccess;
+    #connectOptions;
+    #clock;
+    #closeController = new AbortController();
+    #referenceCapabilities;
+    #closed = false;
+    constructor(init) {
+        this.#getAccess = init.getAccess;
+        this.#connectOptions = init.connectOptions;
+        this.#clock = init.clock ?? Date;
+    }
+    async open(signal) {
+        this.#requireNotClosed();
+        const session = await this.#createSession(signal);
+        this.#referenceCapabilities = session.initializeResult.capabilities;
+        return session;
+    }
+    async replace(signal) {
+        this.#requireNotClosed();
+        const session = await this.#createSession(signal);
+        this.#verifyCapabilities(session.initializeResult.capabilities, session);
+        return session;
+    }
+    renewalDeadline(access, receivedAt) {
+        const expiresAt = Date.parse(access.expiresAt);
+        if (Number.isNaN(expiresAt)) {
+            throw new index_js_1.ClusterConfigError(`invalid expiresAt: ${access.expiresAt}`, 'INVALID_EXPIRY');
+        }
+        const lifetime = expiresAt - receivedAt;
+        return Math.min(expiresAt - 30_000, receivedAt + 0.8 * lifetime);
+    }
+    async close() {
+        this.#closed = true;
+        this.#closeController.abort();
+    }
+    async #createSession(signal) {
+        const combined = combineSignals([signal, this.#closeController.signal]);
+        const access = await this.#getAccess(combined);
+        const expiresAt = Date.parse(access.expiresAt);
+        if (Number.isNaN(expiresAt)) {
+            throw new index_js_1.ClusterConfigError(`invalid expiresAt: ${access.expiresAt}`, 'INVALID_EXPIRY');
+        }
+        if (expiresAt <= this.#clock.now()) {
+            throw new index_js_1.ClusterConfigError('access token is already expired', 'ACCESS_EXPIRED');
+        }
+        let endpoint;
+        try {
+            endpoint = new URL(access.endpoint);
+        }
+        catch {
+            throw new index_js_1.ClusterConfigError('hosted access endpoint is invalid', 'INVALID_ENDPOINT');
+        }
+        if (endpoint.protocol !== 'wss:') {
+            throw new index_js_1.ClusterConfigError('hosted access endpoint must use wss', 'INSECURE_ENDPOINT');
+        }
+        return (0, index_js_1.connectInitialized)(endpoint.href, {
+            ...this.#connectOptions,
+            headers: { Authorization: `Bearer ${access.token}` },
+            ...(combined !== undefined ? { signal: combined } : {}),
+        });
+    }
+    #verifyCapabilities(incoming, session) {
+        if (!this.#referenceCapabilities)
+            return;
+        const ref = this.#referenceCapabilities;
+        const mismatches = [];
+        if (ref.graphProfiles) {
+            const incomingProfiles = new Set(incoming.graphProfiles ?? []);
+            for (const profile of ref.graphProfiles) {
+                if (!incomingProfiles.has(profile))
+                    mismatches.push(`missing graphProfile: ${profile}`);
+            }
+        }
+        if (ref.logs && !incoming.logs)
+            mismatches.push('missing capability: logs');
+        if (ref.agentAttach && !incoming.agentAttach)
+            mismatches.push('missing capability: agentAttach');
+        if (mismatches.length > 0) {
+            void session.connection.close();
+            throw new index_js_1.ClusterConfigError(`replacement capabilities incompatible: ${mismatches.join(', ')}`, 'INCOMPATIBLE_CAPABILITIES');
+        }
+    }
+    #requireNotClosed() {
+        if (this.#closed)
+            throw new index_js_1.ClusterConfigError('coordinator is closed', 'COORDINATOR_CLOSED');
+    }
+}
+exports.HostedSessionCoordinator = HostedSessionCoordinator;

package/lib/hosted-session/coordinator.d.ts

@@ -0,0 +1,9 @@
+import type { AccessResponse, HostedSessionInit, InitializedSession } from './types.js';
+export declare class HostedSessionCoordinator {
+    #private;
+    constructor(init: HostedSessionInit);
+    open(signal?: AbortSignal): Promise<InitializedSession>;
+    replace(signal?: AbortSignal): Promise<InitializedSession>;
+    renewalDeadline(access: AccessResponse, receivedAt: number): number;
+    close(): Promise<void>;
+}

package/lib/hosted-session/coordinator.mjs

@@ -0,0 +1,97 @@
+import { ClusterConfigError, connectInitialized } from '../cluster/index.mjs';
+function combineSignals(signals) {
+    const defined = signals.filter((s) => s !== undefined);
+    if (defined.length === 0)
+        return undefined;
+    if (defined.length === 1)
+        return defined[0];
+    return AbortSignal.any(defined);
+}
+export class HostedSessionCoordinator {
+    #getAccess;
+    #connectOptions;
+    #clock;
+    #closeController = new AbortController();
+    #referenceCapabilities;
+    #closed = false;
+    constructor(init) {
+        this.#getAccess = init.getAccess;
+        this.#connectOptions = init.connectOptions;
+        this.#clock = init.clock ?? Date;
+    }
+    async open(signal) {
+        this.#requireNotClosed();
+        const session = await this.#createSession(signal);
+        this.#referenceCapabilities = session.initializeResult.capabilities;
+        return session;
+    }
+    async replace(signal) {
+        this.#requireNotClosed();
+        const session = await this.#createSession(signal);
+        this.#verifyCapabilities(session.initializeResult.capabilities, session);
+        return session;
+    }
+    renewalDeadline(access, receivedAt) {
+        const expiresAt = Date.parse(access.expiresAt);
+        if (Number.isNaN(expiresAt)) {
+            throw new ClusterConfigError(`invalid expiresAt: ${access.expiresAt}`, 'INVALID_EXPIRY');
+        }
+        const lifetime = expiresAt - receivedAt;
+        return Math.min(expiresAt - 30_000, receivedAt + 0.8 * lifetime);
+    }
+    async close() {
+        this.#closed = true;
+        this.#closeController.abort();
+    }
+    async #createSession(signal) {
+        const combined = combineSignals([signal, this.#closeController.signal]);
+        const access = await this.#getAccess(combined);
+        const expiresAt = Date.parse(access.expiresAt);
+        if (Number.isNaN(expiresAt)) {
+            throw new ClusterConfigError(`invalid expiresAt: ${access.expiresAt}`, 'INVALID_EXPIRY');
+        }
+        if (expiresAt <= this.#clock.now()) {
+            throw new ClusterConfigError('access token is already expired', 'ACCESS_EXPIRED');
+        }
+        let endpoint;
+        try {
+            endpoint = new URL(access.endpoint);
+        }
+        catch {
+            throw new ClusterConfigError('hosted access endpoint is invalid', 'INVALID_ENDPOINT');
+        }
+        if (endpoint.protocol !== 'wss:') {
+            throw new ClusterConfigError('hosted access endpoint must use wss', 'INSECURE_ENDPOINT');
+        }
+        return connectInitialized(endpoint.href, {
+            ...this.#connectOptions,
+            headers: { Authorization: `Bearer ${access.token}` },
+            ...(combined !== undefined ? { signal: combined } : {}),
+        });
+    }
+    #verifyCapabilities(incoming, session) {
+        if (!this.#referenceCapabilities)
+            return;
+        const ref = this.#referenceCapabilities;
+        const mismatches = [];
+        if (ref.graphProfiles) {
+            const incomingProfiles = new Set(incoming.graphProfiles ?? []);
+            for (const profile of ref.graphProfiles) {
+                if (!incomingProfiles.has(profile))
+                    mismatches.push(`missing graphProfile: ${profile}`);
+            }
+        }
+        if (ref.logs && !incoming.logs)
+            mismatches.push('missing capability: logs');
+        if (ref.agentAttach && !incoming.agentAttach)
+            mismatches.push('missing capability: agentAttach');
+        if (mismatches.length > 0) {
+            void session.connection.close();
+            throw new ClusterConfigError(`replacement capabilities incompatible: ${mismatches.join(', ')}`, 'INCOMPATIBLE_CAPABILITIES');
+        }
+    }
+    #requireNotClosed() {
+        if (this.#closed)
+            throw new ClusterConfigError('coordinator is closed', 'COORDINATOR_CLOSED');
+    }
+}

package/lib/hosted-session/index.cjs

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HostedSessionCoordinator = void 0;
+var coordinator_js_1 = require("./coordinator.cjs");
+Object.defineProperty(exports, "HostedSessionCoordinator", { enumerable: true, get: function () { return coordinator_js_1.HostedSessionCoordinator; } });

package/lib/hosted-session/index.d.ts

@@ -0,0 +1,2 @@
+export { HostedSessionCoordinator } from './coordinator.js';
+export type { AccessResponse, HostedSessionInit, InitializedSession } from './types.js';

package/lib/hosted-session/index.mjs

@@ -0,0 +1 @@
+export { HostedSessionCoordinator } from './coordinator.mjs';

package/lib/hosted-session/types.cjs

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/hosted-session/types.d.ts

@@ -0,0 +1,20 @@
+import type { Connection } from '../cluster/index.js';
+import type { ClusterClient, ConnectOptions } from '../cluster/index.js';
+import type { InitializeResult } from '../cluster/index.js';
+export interface AccessResponse {
+    readonly endpoint: string;
+    readonly token: string;
+    readonly expiresAt: string;
+}
+export interface HostedSessionInit {
+    readonly getAccess: (signal?: AbortSignal) => Promise<AccessResponse>;
+    readonly connectOptions?: Omit<ConnectOptions, 'headers' | 'signal'>;
+    readonly clock?: {
+        now(): number;
+    };
+}
+export interface InitializedSession {
+    readonly connection: Connection;
+    readonly client: ClusterClient;
+    readonly initializeResult: InitializeResult;
+}

package/lib/hosted-session/types.mjs

@@ -0,0 +1 @@
+export {};

package/lib/target/credential-lock.d.ts

@@ -0,0 +1 @@
+export declare function acquireTargetLock(targetId: string): Promise<() => Promise<void>>;

package/lib/target/credential-lock.js

@@ -0,0 +1,38 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.acquireTargetLock = acquireTargetLock;
+const node_fs_1 = require("node:fs");
+const node_path_1 = __importDefault(require("node:path"));
+const node_os_1 = __importDefault(require("node:os"));
+// @ts-expect-error no declaration file for proper-lockfile
+const proper_lockfile_1 = __importDefault(require("proper-lockfile"));
+const LOCK_STALE_MS = 10_000;
+const LOCK_RETRIES = 100;
+const LOCK_RETRY_MIN_TIMEOUT_MS = 50;
+const LOCK_RETRY_MAX_TIMEOUT_MS = 5_000;
+async function acquireTargetLock(targetId) {
+    const lockDir = node_path_1.default.join(node_os_1.default.homedir(), '.zeroshot');
+    await node_fs_1.promises.mkdir(lockDir, { recursive: true });
+    const lockTarget = node_path_1.default.join(lockDir, `target-${targetId}.lock`);
+    try {
+        await node_fs_1.promises.writeFile(lockTarget, '', { flag: 'wx' });
+    }
+    catch (err) {
+        if (err.code !== 'EEXIST')
+            throw err;
+    }
+    const release = await proper_lockfile_1.default.lock(lockTarget, {
+        stale: LOCK_STALE_MS,
+        retries: {
+            retries: LOCK_RETRIES,
+            minTimeout: LOCK_RETRY_MIN_TIMEOUT_MS,
+            maxTimeout: LOCK_RETRY_MAX_TIMEOUT_MS,
+        },
+    });
+    return async () => {
+        await release();
+    };
+}

package/lib/target/credential-store.d.ts

@@ -0,0 +1,27 @@
+export declare class CredentialStoreUnavailableError extends Error {
+    constructor(message?: string);
+}
+export interface TargetCredentialStore {
+    get(service: string, account: string): Promise<string | null>;
+    set(service: string, account: string, token: string): Promise<void>;
+    delete(service: string, account: string): Promise<void>;
+}
+export declare function targetServiceKey(targetId: string): string;
+export declare const TARGET_ACCOUNT = "refresh-token";
+export declare class KeyringCredentialStore implements TargetCredentialStore {
+    private readonly Entry;
+    private constructor();
+    static create(): Promise<KeyringCredentialStore>;
+    get(service: string, account: string): Promise<string | null>;
+    set(service: string, account: string, token: string): Promise<void>;
+    delete(service: string, account: string): Promise<void>;
+}
+export declare class FakeCredentialStore implements TargetCredentialStore {
+    private readonly store;
+    private key;
+    get(service: string, account: string): Promise<string | null>;
+    set(service: string, account: string, token: string): Promise<void>;
+    delete(service: string, account: string): Promise<void>;
+    has(service: string, account: string): boolean;
+    clear(): void;
+}

package/lib/target/credential-store.js

@@ -0,0 +1,113 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FakeCredentialStore = exports.KeyringCredentialStore = exports.TARGET_ACCOUNT = exports.CredentialStoreUnavailableError = void 0;
+exports.targetServiceKey = targetServiceKey;
+class CredentialStoreUnavailableError extends Error {
+    constructor(message) {
+        super(message ??
+            'OS secure store unavailable. Install libsecret (Linux), or run on macOS/Windows. No plaintext fallback.');
+        this.name = 'CredentialStoreUnavailableError';
+    }
+}
+exports.CredentialStoreUnavailableError = CredentialStoreUnavailableError;
+function targetServiceKey(targetId) {
+    return `zeroshot-target-${targetId}`;
+}
+exports.TARGET_ACCOUNT = 'refresh-token';
+class KeyringCredentialStore {
+    Entry;
+    constructor(Entry) {
+        this.Entry = Entry;
+    }
+    static async create() {
+        let keyringModule;
+        try {
+            keyringModule = await Promise.resolve().then(() => __importStar(require('@napi-rs/keyring')));
+        }
+        catch {
+            throw new CredentialStoreUnavailableError();
+        }
+        if (!keyringModule.Entry) {
+            throw new CredentialStoreUnavailableError();
+        }
+        return new KeyringCredentialStore(keyringModule.Entry);
+    }
+    async get(service, account) {
+        try {
+            const entry = new this.Entry(service, account);
+            return entry.getPassword();
+        }
+        catch {
+            return null;
+        }
+    }
+    async set(service, account, token) {
+        const entry = new this.Entry(service, account);
+        entry.setPassword(token);
+    }
+    async delete(service, account) {
+        try {
+            const entry = new this.Entry(service, account);
+            entry.deletePassword();
+        }
+        catch {
+            // Already deleted or not present
+        }
+    }
+}
+exports.KeyringCredentialStore = KeyringCredentialStore;
+class FakeCredentialStore {
+    store = new Map();
+    key(service, account) {
+        return `${service}::${account}`;
+    }
+    async get(service, account) {
+        return this.store.get(this.key(service, account)) ?? null;
+    }
+    async set(service, account, token) {
+        this.store.set(this.key(service, account), token);
+    }
+    async delete(service, account) {
+        this.store.delete(this.key(service, account));
+    }
+    has(service, account) {
+        return this.store.has(this.key(service, account));
+    }
+    clear() {
+        this.store.clear();
+    }
+}
+exports.FakeCredentialStore = FakeCredentialStore;

package/lib/target/device-flow.d.ts

@@ -0,0 +1,38 @@
+export interface DeviceCodeResponse {
+    readonly device_code: string;
+    readonly user_code: string;
+    readonly verification_uri: string;
+    readonly verification_uri_complete?: string;
+    readonly expires_in: number;
+    readonly interval: number;
+}
+export interface TokenResponse {
+    readonly access_token: string;
+    readonly refresh_token: string;
+    readonly token_type: string;
+    readonly expires_in: number;
+    readonly organization?: {
+        readonly id: string;
+        readonly name: string;
+    };
+}
+export interface HttpTransport {
+    fetch(url: string, init: RequestInit & {
+        redirect: 'error';
+    }): Promise<Response>;
+}
+export interface Clock {
+    now(): number;
+}
+export declare class DeviceFlowDeniedError extends Error {
+    constructor();
+}
+export declare class DeviceFlowExpiredError extends Error {
+    constructor();
+}
+export declare class UnboundSessionError extends Error {
+    readonly verificationUri: string;
+    constructor(verificationUri: string);
+}
+export declare function requestDeviceCode(deviceAuthorizationEndpoint: string, clientId: string, http: HttpTransport, signal?: AbortSignal): Promise<DeviceCodeResponse>;
+export declare function pollForToken(tokenEndpoint: string, clientId: string, deviceCode: string, interval: number, expiresIn: number, http: HttpTransport, clock?: Clock, signal?: AbortSignal): Promise<TokenResponse>;

package/lib/target/device-flow.js

@@ -0,0 +1,104 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UnboundSessionError = exports.DeviceFlowExpiredError = exports.DeviceFlowDeniedError = void 0;
+exports.requestDeviceCode = requestDeviceCode;
+exports.pollForToken = pollForToken;
+class DeviceFlowDeniedError extends Error {
+    constructor() {
+        super('Device authorization denied by user');
+        this.name = 'DeviceFlowDeniedError';
+    }
+}
+exports.DeviceFlowDeniedError = DeviceFlowDeniedError;
+class DeviceFlowExpiredError extends Error {
+    constructor() {
+        super('Device authorization code expired');
+        this.name = 'DeviceFlowExpiredError';
+    }
+}
+exports.DeviceFlowExpiredError = DeviceFlowExpiredError;
+class UnboundSessionError extends Error {
+    verificationUri;
+    constructor(verificationUri) {
+        super(`Session not bound to an organization. Re-approve at ${verificationUri} and select an organization.`);
+        this.name = 'UnboundSessionError';
+        this.verificationUri = verificationUri;
+    }
+}
+exports.UnboundSessionError = UnboundSessionError;
+const DEFAULT_CLOCK = { now: () => Date.now() };
+function sleep(ms, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal?.aborted) {
+            reject(signal.reason ?? new DOMException('Aborted', 'AbortError'));
+            return;
+        }
+        const timer = setTimeout(resolve, ms);
+        signal?.addEventListener('abort', () => {
+            clearTimeout(timer);
+            reject(signal.reason ?? new DOMException('Aborted', 'AbortError'));
+        }, { once: true });
+    });
+}
+async function requestDeviceCode(deviceAuthorizationEndpoint, clientId, http, signal) {
+    const body = new URLSearchParams({
+        client_id: clientId,
+        scope: 'openid',
+    });
+    const init = {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: body.toString(),
+        redirect: 'error',
+    };
+    if (signal)
+        init.signal = signal;
+    const response = await http.fetch(deviceAuthorizationEndpoint, init);
+    if (!response.ok) {
+        const text = await response.text();
+        throw new Error(`Device code request failed (${response.status}): ${text}`);
+    }
+    return (await response.json());
+}
+async function pollForToken(tokenEndpoint, clientId, deviceCode, interval, expiresIn, http, clock = DEFAULT_CLOCK, signal) {
+    const deadline = clock.now() + expiresIn * 1000;
+    let currentInterval = interval;
+    while (clock.now() < deadline) {
+        if (signal?.aborted) {
+            throw signal.reason ?? new DOMException('Aborted', 'AbortError');
+        }
+        await sleep(currentInterval * 1000, signal);
+        const body = new URLSearchParams({
+            grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+            device_code: deviceCode,
+            client_id: clientId,
+        });
+        const init = {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: body.toString(),
+            redirect: 'error',
+        };
+        if (signal)
+            init.signal = signal;
+        const response = await http.fetch(tokenEndpoint, init);
+        if (response.ok) {
+            return (await response.json());
+        }
+        const errorBody = (await response.json());
+        switch (errorBody.error) {
+            case 'authorization_pending':
+                continue;
+            case 'slow_down':
+                currentInterval += 5;
+                continue;
+            case 'access_denied':
+                throw new DeviceFlowDeniedError();
+            case 'expired_token':
+                throw new DeviceFlowExpiredError();
+            default:
+                throw new Error(`Token endpoint error: ${errorBody.error}`);
+        }
+    }
+    throw new DeviceFlowExpiredError();
+}

package/lib/target/discovery.d.ts

@@ -0,0 +1,11 @@
+import type { HttpTransport } from './device-flow.ts';
+export interface TargetSessionEndpoints {
+    readonly deviceAuthorizationEndpoint: string;
+    readonly tokenEndpoint: string;
+    readonly revocationEndpoint?: string;
+    readonly clientId: string;
+}
+export declare class TargetDiscoveryError extends Error {
+    constructor(message: string);
+}
+export declare function discoverTargetSessionEndpoints(targetUrl: string, http: HttpTransport): Promise<TargetSessionEndpoints>;