@the-open-engine/zeroshot 6.27.0 → 6.28.0

package/cli/index.js

@@ -3958,7 +3958,7 @@ for (const providerName of VALID_PROVIDERS) {
 
 // Settings management
 const settingsCmd = program.command('settings').description('Manage zeroshot settings');
-const INTERNAL_SETTINGS_KEYS = new Set(['lastUpdateCheckClaim']);
+const INTERNAL_SETTINGS_KEYS = new Set(['lastUpdateCheckClaim', '_targets']);
 
 function visibleSettingKeys() {
   return Object.keys(DEFAULT_SETTINGS).filter((key) => !INTERNAL_SETTINGS_KEYS.has(key));
@@ -4339,8 +4339,12 @@ function parseSettingValue(value) {
 
 function resetGlobalSettings() {
   mutateSettings((settings) => {
+    const preserved = {};
+    for (const key of INTERNAL_SETTINGS_KEYS) {
+      if (key in settings) preserved[key] = settings[key];
+    }
     for (const key of Object.keys(settings)) delete settings[key];
-    Object.assign(settings, JSON.parse(JSON.stringify({ ...DEFAULT_SETTINGS })));
+    Object.assign(settings, JSON.parse(JSON.stringify({ ...DEFAULT_SETTINGS })), preserved);
   });
 }
 
@@ -4486,6 +4490,211 @@ settingsCmd.action(() => {
   formatSettingsList(settings, true);
 });
 
+// Target management commands
+// Target modules are compiled during install/package preparation for the Node 18+ CLI.
+const importTarget = (mod) => import(`../lib/target/${mod}.js`);
+const targetCmd = program.command('target').description('Manage named remote targets');
+
+targetCmd
+  .command('add <name>')
+  .description('Register a named remote target')
+  .requiredOption('--url <url>', 'Service URL for the target')
+  .action(async (name, options) => {
+    try {
+      const { addTarget } = await importTarget('target-registry');
+      const settingsPort = {
+        load: () => loadSettings(),
+        mutate: (fn) => mutateSettings(fn),
+      };
+      const record = addTarget(name, options.url, settingsPort);
+      console.log(chalk.green(`✓ Target "${name}" added (${record.url})`));
+    } catch (error) {
+      console.error(chalk.red(error.message));
+      process.exit(1);
+    }
+  });
+
+targetCmd
+  .command('login <name>')
+  .description('Authenticate with a remote target via device login')
+  .action(async (name) => {
+    try {
+      const { getTarget } = await importTarget('target-registry');
+      const { targetLogin } = await importTarget('target-session');
+      const { KeyringCredentialStore } = await importTarget('credential-store');
+      const { acquireTargetLock } = await importTarget('credential-lock');
+      const { discoverTargetSessionEndpoints } = await importTarget('discovery');
+
+      const settingsPort = {
+        load: () => loadSettings(),
+        mutate: (fn) => mutateSettings(fn),
+      };
+
+      const target = getTarget(name, settingsPort);
+      if (!target) {
+        console.error(chalk.red(`Target "${name}" not found.`));
+        process.exit(1);
+      }
+
+      const http = { fetch: (url, init) => fetch(url, init) };
+      const discoveryEndpoints = await discoverTargetSessionEndpoints(target.url, http);
+
+      const credentialStore = await KeyringCredentialStore.create();
+      const openPkg = await import('open');
+      const browserOpen = openPkg.default || openPkg;
+
+      const result = await targetLogin(
+        name,
+        target,
+        credentialStore,
+        () => acquireTargetLock(target.id),
+        settingsPort,
+        {
+          http,
+          clock: { now: () => Date.now() },
+          browserOpener: {
+            open: async (url) => {
+              await browserOpen(url);
+            },
+          },
+          stderr: process.stderr,
+          discoveryEndpoints,
+        }
+      );
+
+      console.log(
+        chalk.green(`✓ Logged in to "${name}" (organization: ${result.organization.name})`)
+      );
+    } catch (error) {
+      console.error(chalk.red(error.message));
+      process.exit(1);
+    }
+  });
+
+targetCmd
+  .command('list')
+  .description('List registered remote targets')
+  .option('--json', 'Output as JSON')
+  .action(async (options) => {
+    try {
+      const { listTargets } = await importTarget('target-registry');
+      const settingsPort = {
+        load: () => loadSettings(),
+        mutate: (fn) => mutateSettings(fn),
+      };
+
+      const targets = listTargets(settingsPort);
+
+      if (options.json) {
+        const output = targets.map(({ name, record }) => ({
+          name,
+          id: record.id,
+          url: record.url,
+          organization: record.organization ?? null,
+          loggedIn: false,
+          createdAt: record.createdAt,
+        }));
+
+        // Try to check keyring presence for each target
+        try {
+          const { KeyringCredentialStore } = await importTarget('credential-store');
+          const { targetServiceKey, TARGET_ACCOUNT } = await importTarget('credential-store');
+          const store = await KeyringCredentialStore.create();
+          for (const item of output) {
+            const matchingTarget = targets.find((t) => t.name === item.name);
+            if (matchingTarget) {
+              const cred = await store.get(
+                targetServiceKey(matchingTarget.record.id),
+                TARGET_ACCOUNT
+              );
+              item.loggedIn = cred !== null;
+            }
+          }
+        } catch {
+          // Keyring unavailable, all show as not logged in
+        }
+
+        console.log(JSON.stringify(output, null, 2));
+        return;
+      }
+
+      if (targets.length === 0) {
+        console.log(
+          chalk.dim(
+            'No targets registered. Use `zeroshot target add <name> --url <url>` to add one.'
+          )
+        );
+        return;
+      }
+
+      for (const { name, record } of targets) {
+        const org = record.organization ? ` (org: ${record.organization.name})` : '';
+        console.log(`  ${chalk.bold(name)}  ${record.url}${org}`);
+      }
+    } catch (error) {
+      console.error(chalk.red(error.message));
+      process.exit(1);
+    }
+  });
+
+targetCmd
+  .command('remove <name>')
+  .description('Remove a named remote target')
+  .option('--force', 'Remove even if remote revocation fails')
+  .action(async (name, options) => {
+    try {
+      const { getTarget, removeTarget } = await importTarget('target-registry');
+      const { revokeAndCleanup } = await importTarget('target-session');
+      const { acquireTargetLock } = await importTarget('credential-lock');
+      const { discoverTargetSessionEndpoints } = await importTarget('discovery');
+
+      const settingsPort = {
+        load: () => loadSettings(),
+        mutate: (fn) => mutateSettings(fn),
+      };
+
+      const target = getTarget(name, settingsPort);
+      if (!target) {
+        console.error(chalk.red(`Target "${name}" not found.`));
+        process.exit(1);
+      }
+
+      // Try to revoke and cleanup keyring
+      try {
+        const { KeyringCredentialStore } = await importTarget('credential-store');
+        const credentialStore = await KeyringCredentialStore.create();
+        const http = { fetch: (url, init) => fetch(url, init) };
+        const discoveryEndpoints = await discoverTargetSessionEndpoints(target.url, http);
+        await revokeAndCleanup(
+          target,
+          credentialStore,
+          () => acquireTargetLock(target.id),
+          {
+            http,
+            discoveryEndpoints,
+          },
+          !!options.force
+        );
+      } catch (error) {
+        if (!options.force) {
+          console.error(chalk.red(error.message));
+          process.exit(1);
+        }
+        // Force mode: continue with removal
+      }
+
+      removeTarget(name, settingsPort);
+      console.log(chalk.green(`✓ Target "${name}" removed`));
+    } catch (error) {
+      console.error(chalk.red(error.message));
+      process.exit(1);
+    }
+  });
+
+targetCmd.action(() => {
+  targetCmd.help();
+});
+
 // Providers management
 const providersCmd = program.command('providers').description('Manage AI providers');
 providersCmd.action(async () => {

package/lib/target/credential-lock.d.ts

@@ -0,0 +1 @@
+export declare function acquireTargetLock(targetId: string): Promise<() => Promise<void>>;

package/lib/target/credential-lock.js

@@ -0,0 +1,38 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.acquireTargetLock = acquireTargetLock;
+const node_fs_1 = require("node:fs");
+const node_path_1 = __importDefault(require("node:path"));
+const node_os_1 = __importDefault(require("node:os"));
+// @ts-expect-error no declaration file for proper-lockfile
+const proper_lockfile_1 = __importDefault(require("proper-lockfile"));
+const LOCK_STALE_MS = 10_000;
+const LOCK_RETRIES = 100;
+const LOCK_RETRY_MIN_TIMEOUT_MS = 50;
+const LOCK_RETRY_MAX_TIMEOUT_MS = 5_000;
+async function acquireTargetLock(targetId) {
+    const lockDir = node_path_1.default.join(node_os_1.default.homedir(), '.zeroshot');
+    await node_fs_1.promises.mkdir(lockDir, { recursive: true });
+    const lockTarget = node_path_1.default.join(lockDir, `target-${targetId}.lock`);
+    try {
+        await node_fs_1.promises.writeFile(lockTarget, '', { flag: 'wx' });
+    }
+    catch (err) {
+        if (err.code !== 'EEXIST')
+            throw err;
+    }
+    const release = await proper_lockfile_1.default.lock(lockTarget, {
+        stale: LOCK_STALE_MS,
+        retries: {
+            retries: LOCK_RETRIES,
+            minTimeout: LOCK_RETRY_MIN_TIMEOUT_MS,
+            maxTimeout: LOCK_RETRY_MAX_TIMEOUT_MS,
+        },
+    });
+    return async () => {
+        await release();
+    };
+}

package/lib/target/credential-store.d.ts

@@ -0,0 +1,27 @@
+export declare class CredentialStoreUnavailableError extends Error {
+    constructor(message?: string);
+}
+export interface TargetCredentialStore {
+    get(service: string, account: string): Promise<string | null>;
+    set(service: string, account: string, token: string): Promise<void>;
+    delete(service: string, account: string): Promise<void>;
+}
+export declare function targetServiceKey(targetId: string): string;
+export declare const TARGET_ACCOUNT = "refresh-token";
+export declare class KeyringCredentialStore implements TargetCredentialStore {
+    private readonly Entry;
+    private constructor();
+    static create(): Promise<KeyringCredentialStore>;
+    get(service: string, account: string): Promise<string | null>;
+    set(service: string, account: string, token: string): Promise<void>;
+    delete(service: string, account: string): Promise<void>;
+}
+export declare class FakeCredentialStore implements TargetCredentialStore {
+    private readonly store;
+    private key;
+    get(service: string, account: string): Promise<string | null>;
+    set(service: string, account: string, token: string): Promise<void>;
+    delete(service: string, account: string): Promise<void>;
+    has(service: string, account: string): boolean;
+    clear(): void;
+}

package/lib/target/credential-store.js

@@ -0,0 +1,113 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FakeCredentialStore = exports.KeyringCredentialStore = exports.TARGET_ACCOUNT = exports.CredentialStoreUnavailableError = void 0;
+exports.targetServiceKey = targetServiceKey;
+class CredentialStoreUnavailableError extends Error {
+    constructor(message) {
+        super(message ??
+            'OS secure store unavailable. Install libsecret (Linux), or run on macOS/Windows. No plaintext fallback.');
+        this.name = 'CredentialStoreUnavailableError';
+    }
+}
+exports.CredentialStoreUnavailableError = CredentialStoreUnavailableError;
+function targetServiceKey(targetId) {
+    return `zeroshot-target-${targetId}`;
+}
+exports.TARGET_ACCOUNT = 'refresh-token';
+class KeyringCredentialStore {
+    Entry;
+    constructor(Entry) {
+        this.Entry = Entry;
+    }
+    static async create() {
+        let keyringModule;
+        try {
+            keyringModule = await Promise.resolve().then(() => __importStar(require('@napi-rs/keyring')));
+        }
+        catch {
+            throw new CredentialStoreUnavailableError();
+        }
+        if (!keyringModule.Entry) {
+            throw new CredentialStoreUnavailableError();
+        }
+        return new KeyringCredentialStore(keyringModule.Entry);
+    }
+    async get(service, account) {
+        try {
+            const entry = new this.Entry(service, account);
+            return entry.getPassword();
+        }
+        catch {
+            return null;
+        }
+    }
+    async set(service, account, token) {
+        const entry = new this.Entry(service, account);
+        entry.setPassword(token);
+    }
+    async delete(service, account) {
+        try {
+            const entry = new this.Entry(service, account);
+            entry.deletePassword();
+        }
+        catch {
+            // Already deleted or not present
+        }
+    }
+}
+exports.KeyringCredentialStore = KeyringCredentialStore;
+class FakeCredentialStore {
+    store = new Map();
+    key(service, account) {
+        return `${service}::${account}`;
+    }
+    async get(service, account) {
+        return this.store.get(this.key(service, account)) ?? null;
+    }
+    async set(service, account, token) {
+        this.store.set(this.key(service, account), token);
+    }
+    async delete(service, account) {
+        this.store.delete(this.key(service, account));
+    }
+    has(service, account) {
+        return this.store.has(this.key(service, account));
+    }
+    clear() {
+        this.store.clear();
+    }
+}
+exports.FakeCredentialStore = FakeCredentialStore;

package/lib/target/device-flow.d.ts

@@ -0,0 +1,38 @@
+export interface DeviceCodeResponse {
+    readonly device_code: string;
+    readonly user_code: string;
+    readonly verification_uri: string;
+    readonly verification_uri_complete?: string;
+    readonly expires_in: number;
+    readonly interval: number;
+}
+export interface TokenResponse {
+    readonly access_token: string;
+    readonly refresh_token: string;
+    readonly token_type: string;
+    readonly expires_in: number;
+    readonly organization?: {
+        readonly id: string;
+        readonly name: string;
+    };
+}
+export interface HttpTransport {
+    fetch(url: string, init: RequestInit & {
+        redirect: 'error';
+    }): Promise<Response>;
+}
+export interface Clock {
+    now(): number;
+}
+export declare class DeviceFlowDeniedError extends Error {
+    constructor();
+}
+export declare class DeviceFlowExpiredError extends Error {
+    constructor();
+}
+export declare class UnboundSessionError extends Error {
+    readonly verificationUri: string;
+    constructor(verificationUri: string);
+}
+export declare function requestDeviceCode(deviceAuthorizationEndpoint: string, clientId: string, http: HttpTransport, signal?: AbortSignal): Promise<DeviceCodeResponse>;
+export declare function pollForToken(tokenEndpoint: string, clientId: string, deviceCode: string, interval: number, expiresIn: number, http: HttpTransport, clock?: Clock, signal?: AbortSignal): Promise<TokenResponse>;

package/lib/target/device-flow.js

@@ -0,0 +1,104 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UnboundSessionError = exports.DeviceFlowExpiredError = exports.DeviceFlowDeniedError = void 0;
+exports.requestDeviceCode = requestDeviceCode;
+exports.pollForToken = pollForToken;
+class DeviceFlowDeniedError extends Error {
+    constructor() {
+        super('Device authorization denied by user');
+        this.name = 'DeviceFlowDeniedError';
+    }
+}
+exports.DeviceFlowDeniedError = DeviceFlowDeniedError;
+class DeviceFlowExpiredError extends Error {
+    constructor() {
+        super('Device authorization code expired');
+        this.name = 'DeviceFlowExpiredError';
+    }
+}
+exports.DeviceFlowExpiredError = DeviceFlowExpiredError;
+class UnboundSessionError extends Error {
+    verificationUri;
+    constructor(verificationUri) {
+        super(`Session not bound to an organization. Re-approve at ${verificationUri} and select an organization.`);
+        this.name = 'UnboundSessionError';
+        this.verificationUri = verificationUri;
+    }
+}
+exports.UnboundSessionError = UnboundSessionError;
+const DEFAULT_CLOCK = { now: () => Date.now() };
+function sleep(ms, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal?.aborted) {
+            reject(signal.reason ?? new DOMException('Aborted', 'AbortError'));
+            return;
+        }
+        const timer = setTimeout(resolve, ms);
+        signal?.addEventListener('abort', () => {
+            clearTimeout(timer);
+            reject(signal.reason ?? new DOMException('Aborted', 'AbortError'));
+        }, { once: true });
+    });
+}
+async function requestDeviceCode(deviceAuthorizationEndpoint, clientId, http, signal) {
+    const body = new URLSearchParams({
+        client_id: clientId,
+        scope: 'openid',
+    });
+    const init = {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: body.toString(),
+        redirect: 'error',
+    };
+    if (signal)
+        init.signal = signal;
+    const response = await http.fetch(deviceAuthorizationEndpoint, init);
+    if (!response.ok) {
+        const text = await response.text();
+        throw new Error(`Device code request failed (${response.status}): ${text}`);
+    }
+    return (await response.json());
+}
+async function pollForToken(tokenEndpoint, clientId, deviceCode, interval, expiresIn, http, clock = DEFAULT_CLOCK, signal) {
+    const deadline = clock.now() + expiresIn * 1000;
+    let currentInterval = interval;
+    while (clock.now() < deadline) {
+        if (signal?.aborted) {
+            throw signal.reason ?? new DOMException('Aborted', 'AbortError');
+        }
+        await sleep(currentInterval * 1000, signal);
+        const body = new URLSearchParams({
+            grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+            device_code: deviceCode,
+            client_id: clientId,
+        });
+        const init = {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: body.toString(),
+            redirect: 'error',
+        };
+        if (signal)
+            init.signal = signal;
+        const response = await http.fetch(tokenEndpoint, init);
+        if (response.ok) {
+            return (await response.json());
+        }
+        const errorBody = (await response.json());
+        switch (errorBody.error) {
+            case 'authorization_pending':
+                continue;
+            case 'slow_down':
+                currentInterval += 5;
+                continue;
+            case 'access_denied':
+                throw new DeviceFlowDeniedError();
+            case 'expired_token':
+                throw new DeviceFlowExpiredError();
+            default:
+                throw new Error(`Token endpoint error: ${errorBody.error}`);
+        }
+    }
+    throw new DeviceFlowExpiredError();
+}

package/lib/target/discovery.d.ts

@@ -0,0 +1,11 @@
+import type { HttpTransport } from './device-flow.ts';
+export interface TargetSessionEndpoints {
+    readonly deviceAuthorizationEndpoint: string;
+    readonly tokenEndpoint: string;
+    readonly revocationEndpoint?: string;
+    readonly clientId: string;
+}
+export declare class TargetDiscoveryError extends Error {
+    constructor(message: string);
+}
+export declare function discoverTargetSessionEndpoints(targetUrl: string, http: HttpTransport): Promise<TargetSessionEndpoints>;

package/lib/target/discovery.js

@@ -0,0 +1,120 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TargetDiscoveryError = void 0;
+exports.discoverTargetSessionEndpoints = discoverTargetSessionEndpoints;
+const DISCOVERY_PATH = '/.well-known/openengine-hosted-target';
+const MAX_DISCOVERY_BYTES = 64 * 1024;
+class TargetDiscoveryError extends Error {
+    constructor(message) {
+        super(`Target discovery failed: ${message}`);
+        this.name = 'TargetDiscoveryError';
+    }
+}
+exports.TargetDiscoveryError = TargetDiscoveryError;
+function record(value, field) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        throw new TargetDiscoveryError(`${field} must be an object`);
+    }
+    return value;
+}
+function stringField(source, field) {
+    const value = source[field];
+    if (typeof value !== 'string' || value.length === 0) {
+        throw new TargetDiscoveryError(`${field} must be a non-empty string`);
+    }
+    return value;
+}
+function safeEndpoint(value, field, serviceOrigin) {
+    if (typeof value !== 'string') {
+        throw new TargetDiscoveryError(`${field} must be an absolute URL`);
+    }
+    let endpoint;
+    try {
+        endpoint = new URL(value);
+    }
+    catch {
+        throw new TargetDiscoveryError(`${field} must be an absolute URL`);
+    }
+    if (endpoint.username || endpoint.password || endpoint.search || endpoint.hash) {
+        throw new TargetDiscoveryError(`${field} contains forbidden URL components`);
+    }
+    if (endpoint.origin !== serviceOrigin) {
+        throw new TargetDiscoveryError(`${field} must remain on the target origin`);
+    }
+    return endpoint.href;
+}
+async function readBoundedJson(response) {
+    const declaredLength = response.headers.get('content-length');
+    if (declaredLength !== null && Number(declaredLength) > MAX_DISCOVERY_BYTES) {
+        throw new TargetDiscoveryError('response exceeds the size limit');
+    }
+    if (!response.body)
+        return response.json();
+    const reader = response.body.getReader();
+    const chunks = [];
+    let total = 0;
+    while (true) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        total += value.byteLength;
+        if (total > MAX_DISCOVERY_BYTES) {
+            await reader.cancel();
+            throw new TargetDiscoveryError('response exceeds the size limit');
+        }
+        chunks.push(value);
+    }
+    const bytes = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    try {
+        return JSON.parse(new TextDecoder().decode(bytes));
+    }
+    catch {
+        throw new TargetDiscoveryError('response is not valid JSON');
+    }
+}
+async function fetchDocument(http, url) {
+    const response = await http.fetch(url, {
+        method: 'GET',
+        headers: { Accept: 'application/json' },
+        redirect: 'error',
+    });
+    if (!response.ok) {
+        throw new TargetDiscoveryError(`request failed with status ${response.status}`);
+    }
+    return record(await readBoundedJson(response), 'response');
+}
+async function discoverTargetSessionEndpoints(targetUrl, http) {
+    const target = new URL(targetUrl);
+    const discovery = await fetchDocument(http, new URL(DISCOVERY_PATH, target).href);
+    if (discovery.kind !== 'openengine.hosted-target/v1') {
+        throw new TargetDiscoveryError('unsupported hosted-target version');
+    }
+    if (discovery.organization_binding !== 'device_approval') {
+        throw new TargetDiscoveryError('unsupported organization binding');
+    }
+    const oauth = record(discovery.oauth, 'oauth');
+    const metadataUrl = safeEndpoint(oauth.metadata_url, 'oauth.metadata_url', target.origin);
+    const deviceEndpoint = safeEndpoint(oauth.device_authorization_endpoint, 'oauth.device_authorization_endpoint', target.origin);
+    const tokenEndpoint = safeEndpoint(oauth.token_endpoint, 'oauth.token_endpoint', target.origin);
+    const clientId = stringField(oauth, 'client_id');
+    const metadata = await fetchDocument(http, metadataUrl);
+    const metadataDeviceEndpoint = safeEndpoint(metadata.device_authorization_endpoint, 'device_authorization_endpoint', target.origin);
+    const metadataTokenEndpoint = safeEndpoint(metadata.token_endpoint, 'token_endpoint', target.origin);
+    if (metadataDeviceEndpoint !== deviceEndpoint || metadataTokenEndpoint !== tokenEndpoint) {
+        throw new TargetDiscoveryError('OAuth metadata does not match hosted-target discovery');
+    }
+    const revocationEndpoint = metadata.revocation_endpoint === undefined
+        ? undefined
+        : safeEndpoint(metadata.revocation_endpoint, 'revocation_endpoint', target.origin);
+    return {
+        deviceAuthorizationEndpoint: deviceEndpoint,
+        tokenEndpoint,
+        ...(revocationEndpoint === undefined ? {} : { revocationEndpoint }),
+        clientId,
+    };
+}