@the-open-engine/zeroshot 6.27.0 → 6.29.0

package/lib/target/credential-store.js

@@ -0,0 +1,113 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FakeCredentialStore = exports.KeyringCredentialStore = exports.TARGET_ACCOUNT = exports.CredentialStoreUnavailableError = void 0;
+exports.targetServiceKey = targetServiceKey;
+class CredentialStoreUnavailableError extends Error {
+    constructor(message) {
+        super(message ??
+            'OS secure store unavailable. Install libsecret (Linux), or run on macOS/Windows. No plaintext fallback.');
+        this.name = 'CredentialStoreUnavailableError';
+    }
+}
+exports.CredentialStoreUnavailableError = CredentialStoreUnavailableError;
+function targetServiceKey(targetId) {
+    return `zeroshot-target-${targetId}`;
+}
+exports.TARGET_ACCOUNT = 'refresh-token';
+class KeyringCredentialStore {
+    Entry;
+    constructor(Entry) {
+        this.Entry = Entry;
+    }
+    static async create() {
+        let keyringModule;
+        try {
+            keyringModule = await Promise.resolve().then(() => __importStar(require('@napi-rs/keyring')));
+        }
+        catch {
+            throw new CredentialStoreUnavailableError();
+        }
+        if (!keyringModule.Entry) {
+            throw new CredentialStoreUnavailableError();
+        }
+        return new KeyringCredentialStore(keyringModule.Entry);
+    }
+    async get(service, account) {
+        try {
+            const entry = new this.Entry(service, account);
+            return entry.getPassword();
+        }
+        catch {
+            return null;
+        }
+    }
+    async set(service, account, token) {
+        const entry = new this.Entry(service, account);
+        entry.setPassword(token);
+    }
+    async delete(service, account) {
+        try {
+            const entry = new this.Entry(service, account);
+            entry.deletePassword();
+        }
+        catch {
+            // Already deleted or not present
+        }
+    }
+}
+exports.KeyringCredentialStore = KeyringCredentialStore;
+class FakeCredentialStore {
+    store = new Map();
+    key(service, account) {
+        return `${service}::${account}`;
+    }
+    async get(service, account) {
+        return this.store.get(this.key(service, account)) ?? null;
+    }
+    async set(service, account, token) {
+        this.store.set(this.key(service, account), token);
+    }
+    async delete(service, account) {
+        this.store.delete(this.key(service, account));
+    }
+    has(service, account) {
+        return this.store.has(this.key(service, account));
+    }
+    clear() {
+        this.store.clear();
+    }
+}
+exports.FakeCredentialStore = FakeCredentialStore;

package/lib/target/device-flow.d.ts

@@ -0,0 +1,42 @@
+export interface DeviceCodeResponse {
+    readonly device_code: string;
+    readonly user_code: string;
+    readonly verification_uri: string;
+    readonly verification_uri_complete?: string;
+    readonly expires_in: number;
+    readonly interval: number;
+}
+export interface TokenResponse {
+    readonly access_token: string;
+    readonly refresh_token: string;
+    readonly token_type: string;
+    readonly expires_in: number;
+    readonly organization?: {
+        readonly id: string;
+        readonly name: string;
+    };
+}
+export interface HttpTransport {
+    fetch(url: string, init: RequestInit & {
+        redirect: 'error';
+    }): Promise<Response>;
+}
+export interface Clock {
+    now(): number;
+}
+export interface DeviceIdentity {
+    readonly token: string;
+    readonly label: string;
+}
+export declare class DeviceFlowDeniedError extends Error {
+    constructor();
+}
+export declare class DeviceFlowExpiredError extends Error {
+    constructor();
+}
+export declare class UnboundSessionError extends Error {
+    readonly verificationUri: string;
+    constructor(verificationUri: string);
+}
+export declare function requestDeviceCode(deviceAuthorizationEndpoint: string, clientId: string, http: HttpTransport, signal?: AbortSignal): Promise<DeviceCodeResponse>;
+export declare function pollForToken(tokenEndpoint: string, clientId: string, deviceCode: string, interval: number, expiresIn: number, http: HttpTransport, clock?: Clock, signal?: AbortSignal, deviceIdentity?: DeviceIdentity): Promise<TokenResponse>;

package/lib/target/device-flow.js

@@ -0,0 +1,109 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UnboundSessionError = exports.DeviceFlowExpiredError = exports.DeviceFlowDeniedError = void 0;
+exports.requestDeviceCode = requestDeviceCode;
+exports.pollForToken = pollForToken;
+class DeviceFlowDeniedError extends Error {
+    constructor() {
+        super('Device authorization denied by user');
+        this.name = 'DeviceFlowDeniedError';
+    }
+}
+exports.DeviceFlowDeniedError = DeviceFlowDeniedError;
+class DeviceFlowExpiredError extends Error {
+    constructor() {
+        super('Device authorization code expired');
+        this.name = 'DeviceFlowExpiredError';
+    }
+}
+exports.DeviceFlowExpiredError = DeviceFlowExpiredError;
+class UnboundSessionError extends Error {
+    verificationUri;
+    constructor(verificationUri) {
+        super(`Session not bound to an organization. Re-approve at ${verificationUri} and select an organization.`);
+        this.name = 'UnboundSessionError';
+        this.verificationUri = verificationUri;
+    }
+}
+exports.UnboundSessionError = UnboundSessionError;
+const DEFAULT_CLOCK = { now: () => Date.now() };
+function sleep(ms, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal?.aborted) {
+            reject(signal.reason ?? new DOMException('Aborted', 'AbortError'));
+            return;
+        }
+        const timer = setTimeout(resolve, ms);
+        signal?.addEventListener('abort', () => {
+            clearTimeout(timer);
+            reject(signal.reason ?? new DOMException('Aborted', 'AbortError'));
+        }, { once: true });
+    });
+}
+async function requestDeviceCode(deviceAuthorizationEndpoint, clientId, http, signal) {
+    const body = new URLSearchParams({
+        client_id: clientId,
+        scope: 'openid',
+    });
+    const init = {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: body.toString(),
+        redirect: 'error',
+    };
+    if (signal)
+        init.signal = signal;
+    const response = await http.fetch(deviceAuthorizationEndpoint, init);
+    if (!response.ok) {
+        const text = await response.text();
+        throw new Error(`Device code request failed (${response.status}): ${text}`);
+    }
+    return (await response.json());
+}
+async function pollForToken(tokenEndpoint, clientId, deviceCode, interval, expiresIn, http, clock = DEFAULT_CLOCK, signal, deviceIdentity) {
+    const deadline = clock.now() + expiresIn * 1000;
+    let currentInterval = interval;
+    while (clock.now() < deadline) {
+        if (signal?.aborted) {
+            throw signal.reason ?? new DOMException('Aborted', 'AbortError');
+        }
+        await sleep(currentInterval * 1000, signal);
+        const body = new URLSearchParams({
+            grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+            device_code: deviceCode,
+            client_id: clientId,
+        });
+        if (deviceIdentity) {
+            body.set('audience', 'admin');
+            body.set('device_token', deviceIdentity.token);
+            body.set('device_label', deviceIdentity.label);
+        }
+        const init = {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: body.toString(),
+            redirect: 'error',
+        };
+        if (signal)
+            init.signal = signal;
+        const response = await http.fetch(tokenEndpoint, init);
+        if (response.ok) {
+            return (await response.json());
+        }
+        const errorBody = (await response.json());
+        switch (errorBody.error) {
+            case 'authorization_pending':
+                continue;
+            case 'slow_down':
+                currentInterval += 5;
+                continue;
+            case 'access_denied':
+                throw new DeviceFlowDeniedError();
+            case 'expired_token':
+                throw new DeviceFlowExpiredError();
+            default:
+                throw new Error(`Token endpoint error: ${errorBody.error}`);
+        }
+    }
+    throw new DeviceFlowExpiredError();
+}

package/lib/target/discovery.d.ts

@@ -0,0 +1,12 @@
+import type { HttpTransport } from './device-flow.ts';
+export interface TargetSessionEndpoints {
+    readonly deviceAuthorizationEndpoint: string;
+    readonly tokenEndpoint: string;
+    readonly revocationEndpoint?: string;
+    readonly clientId: string;
+    readonly capsuleApiBaseUrl: string;
+}
+export declare class TargetDiscoveryError extends Error {
+    constructor(message: string);
+}
+export declare function discoverTargetSessionEndpoints(targetUrl: string, http: HttpTransport): Promise<TargetSessionEndpoints>;

package/lib/target/discovery.js

@@ -0,0 +1,97 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TargetDiscoveryError = void 0;
+exports.discoverTargetSessionEndpoints = discoverTargetSessionEndpoints;
+const bounded_json_ts_1 = require("./bounded-json.js");
+const DISCOVERY_PATH = '/.well-known/openengine-hosted-target';
+const MAX_DISCOVERY_BYTES = 64 * 1024;
+class TargetDiscoveryError extends Error {
+    constructor(message) {
+        super(`Target discovery failed: ${message}`);
+        this.name = 'TargetDiscoveryError';
+    }
+}
+exports.TargetDiscoveryError = TargetDiscoveryError;
+function record(value, field) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        throw new TargetDiscoveryError(`${field} must be an object`);
+    }
+    return value;
+}
+function stringField(source, field) {
+    const value = source[field];
+    if (typeof value !== 'string' || value.length === 0) {
+        throw new TargetDiscoveryError(`${field} must be a non-empty string`);
+    }
+    return value;
+}
+function safeEndpoint(value, field, serviceOrigin) {
+    if (typeof value !== 'string') {
+        throw new TargetDiscoveryError(`${field} must be an absolute URL`);
+    }
+    let endpoint;
+    try {
+        endpoint = new URL(value);
+    }
+    catch {
+        throw new TargetDiscoveryError(`${field} must be an absolute URL`);
+    }
+    if (endpoint.username || endpoint.password || endpoint.search || endpoint.hash) {
+        throw new TargetDiscoveryError(`${field} contains forbidden URL components`);
+    }
+    if (endpoint.origin !== serviceOrigin) {
+        throw new TargetDiscoveryError(`${field} must remain on the target origin`);
+    }
+    return endpoint.href;
+}
+async function fetchDocument(http, url) {
+    const response = await http.fetch(url, {
+        method: 'GET',
+        headers: { Accept: 'application/json' },
+        redirect: 'error',
+    });
+    if (!response.ok) {
+        throw new TargetDiscoveryError(`request failed with status ${response.status}`);
+    }
+    const body = await (0, bounded_json_ts_1.readBoundedJson)(response, MAX_DISCOVERY_BYTES, {
+        tooLarge: () => new TargetDiscoveryError('response exceeds the size limit'),
+        invalid: () => new TargetDiscoveryError('response is not valid JSON'),
+    });
+    return record(body, 'response');
+}
+async function discoverTargetSessionEndpoints(targetUrl, http) {
+    const target = new URL(targetUrl);
+    const discovery = await fetchDocument(http, new URL(DISCOVERY_PATH, target).href);
+    if (discovery.kind !== 'openengine.hosted-target/v1') {
+        throw new TargetDiscoveryError('unsupported hosted-target version');
+    }
+    if (discovery.organization_binding !== 'device_approval') {
+        throw new TargetDiscoveryError('unsupported organization binding');
+    }
+    const oauth = record(discovery.oauth, 'oauth');
+    const capsuleProtocol = record(discovery.capsule_protocol, 'capsule_protocol');
+    if (capsuleProtocol.name !== 'openengine.capsules/v1' || capsuleProtocol.major_version !== 1) {
+        throw new TargetDiscoveryError('unsupported capsule protocol');
+    }
+    const capsuleApiBaseUrl = safeEndpoint(capsuleProtocol.base_url, 'capsule_protocol.base_url', target.origin).replace(/\/$/, '');
+    const metadataUrl = safeEndpoint(oauth.metadata_url, 'oauth.metadata_url', target.origin);
+    const deviceEndpoint = safeEndpoint(oauth.device_authorization_endpoint, 'oauth.device_authorization_endpoint', target.origin);
+    const tokenEndpoint = safeEndpoint(oauth.token_endpoint, 'oauth.token_endpoint', target.origin);
+    const clientId = stringField(oauth, 'client_id');
+    const metadata = await fetchDocument(http, metadataUrl);
+    const metadataDeviceEndpoint = safeEndpoint(metadata.device_authorization_endpoint, 'device_authorization_endpoint', target.origin);
+    const metadataTokenEndpoint = safeEndpoint(metadata.token_endpoint, 'token_endpoint', target.origin);
+    if (metadataDeviceEndpoint !== deviceEndpoint || metadataTokenEndpoint !== tokenEndpoint) {
+        throw new TargetDiscoveryError('OAuth metadata does not match hosted-target discovery');
+    }
+    const revocationEndpoint = metadata.revocation_endpoint === undefined
+        ? undefined
+        : safeEndpoint(metadata.revocation_endpoint, 'revocation_endpoint', target.origin);
+    return {
+        deviceAuthorizationEndpoint: deviceEndpoint,
+        tokenEndpoint,
+        ...(revocationEndpoint === undefined ? {} : { revocationEndpoint }),
+        clientId,
+        capsuleApiBaseUrl,
+    };
+}

package/lib/target/hosted-run/client.d.ts

@@ -0,0 +1,26 @@
+import { type TargetAccessTokenProvider } from '../target-session.ts';
+import type { HostedRunDependencies, HostedRunIntent } from './contracts.ts';
+export declare const UUID: RegExp;
+export declare const TERMINAL_STATES: Set<string>;
+export interface HostedContext {
+    readonly targetName: string;
+    readonly organization: string;
+    readonly client: RunIntentClient;
+}
+export declare class HostedRunHttpError extends Error {
+    readonly status: number;
+    readonly code: string | null;
+    constructor(status: number, message: string, code?: string | null);
+}
+export declare class RunIntentClient {
+    private readonly baseUrl;
+    private readonly organization;
+    private readonly tokenProvider;
+    private readonly fetch;
+    constructor(baseUrl: string, organization: string, tokenProvider: TargetAccessTokenProvider, fetchImplementation: typeof globalThis.fetch);
+    submit(body: Record<string, unknown>, submissionKey: string): Promise<HostedRunIntent>;
+    get(intentId: string): Promise<HostedRunIntent>;
+    cancel(intentId: string): Promise<HostedRunIntent>;
+    private request;
+}
+export declare function context(targetName: string, deps: HostedRunDependencies): Promise<HostedContext>;

package/lib/target/hosted-run/client.js

@@ -0,0 +1,158 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RunIntentClient = exports.HostedRunHttpError = exports.TERMINAL_STATES = exports.UUID = void 0;
+exports.context = context;
+const credential_lock_ts_1 = require("../credential-lock.js");
+const credential_store_ts_1 = require("../credential-store.js");
+const discovery_ts_1 = require("../discovery.js");
+const target_registry_ts_1 = require("../target-registry.js");
+const target_session_ts_1 = require("../target-session.js");
+const bounded_json_ts_1 = require("../bounded-json.js");
+const MAX_RESPONSE_BYTES = 1024 * 1024;
+exports.UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+exports.TERMINAL_STATES = new Set(['succeeded', 'failed', 'cancelled', 'expired']);
+const RUN_INTENT_STATES = new Set([
+    'queued',
+    'provisioning',
+    'running',
+    'cancelling',
+    ...exports.TERMINAL_STATES,
+]);
+function wait(milliseconds) {
+    return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
+class HostedRunHttpError extends Error {
+    status;
+    code;
+    constructor(status, message, code = null) {
+        super(message);
+        this.name = 'HostedRunHttpError';
+        this.status = status;
+        this.code = code;
+    }
+}
+exports.HostedRunHttpError = HostedRunHttpError;
+function validateIntent(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error('Zero Cloud returned an invalid run intent');
+    }
+    const record = value;
+    if (typeof record['intent_id'] !== 'string' ||
+        !exports.UUID.test(record['intent_id']) ||
+        typeof record['state'] !== 'string' ||
+        !RUN_INTENT_STATES.has(record['state'])) {
+        throw new Error('Zero Cloud returned an invalid run intent');
+    }
+    const result = record['result'];
+    if (result !== null && (typeof result !== 'object' || Array.isArray(result))) {
+        throw new Error('Zero Cloud returned an invalid run intent result');
+    }
+    return record;
+}
+class RunIntentClient {
+    baseUrl;
+    organization;
+    tokenProvider;
+    fetch;
+    constructor(baseUrl, organization, tokenProvider, fetchImplementation) {
+        this.baseUrl = baseUrl.replace(/\/$/, '');
+        this.organization = organization;
+        this.tokenProvider = tokenProvider;
+        this.fetch = fetchImplementation;
+    }
+    async submit(body, submissionKey) {
+        let failure;
+        for (let attempt = 0; attempt < 2; attempt += 1) {
+            try {
+                return await this.request('', {
+                    method: 'POST',
+                    body: JSON.stringify(body),
+                    headers: { 'Idempotency-Key': submissionKey },
+                });
+            }
+            catch (error) {
+                failure = error;
+                if (error instanceof HostedRunHttpError && error.status < 500)
+                    throw error;
+                if (attempt === 0)
+                    await wait(250);
+            }
+        }
+        throw failure;
+    }
+    get(intentId) {
+        return this.request(`/${encodeURIComponent(intentId)}`, { method: 'GET' });
+    }
+    cancel(intentId) {
+        return this.request(`/${encodeURIComponent(intentId)}`, { method: 'DELETE' });
+    }
+    async request(suffix, options) {
+        const token = await this.tokenProvider.getAccessToken();
+        const url = `${this.baseUrl}/orgs/${encodeURIComponent(this.organization)}/run-intents${suffix}`;
+        const init = {
+            method: options.method,
+            redirect: 'error',
+            headers: {
+                Accept: 'application/json',
+                Authorization: `Bearer ${token}`,
+                'Content-Type': 'application/json',
+                ...options.headers,
+            },
+        };
+        if (options.body !== undefined)
+            init.body = options.body;
+        let response;
+        try {
+            response = await this.fetch(url, init);
+        }
+        catch (error) {
+            throw new Error(`Zero Cloud request failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        const body = await (0, bounded_json_ts_1.readBoundedJson)(response, MAX_RESPONSE_BYTES, {
+            tooLarge: () => new Error('Zero Cloud response exceeded 1 MiB'),
+            invalid: () => new Error('Zero Cloud returned invalid JSON'),
+        });
+        if (!response.ok) {
+            const problem = body;
+            const code = typeof problem['code'] === 'string' ? problem['code'] : null;
+            const message = typeof problem['message'] === 'string' ? problem['message'] : 'request failed';
+            throw new HostedRunHttpError(response.status, `Zero Cloud ${response.status}: ${message}`, code);
+        }
+        return validateIntent(body);
+    }
+}
+exports.RunIntentClient = RunIntentClient;
+async function context(targetName, deps) {
+    const environment = deps.environment ?? process.env;
+    const target = (0, target_registry_ts_1.getTarget)(targetName, deps.settings);
+    if (!target)
+        throw new Error(`Target "${targetName}" not found.`);
+    const http = {
+        fetch: (url, init) => (deps.fetch ?? globalThis.fetch)(url, init),
+    };
+    const discovery = await (0, discovery_ts_1.discoverTargetSessionEndpoints)(target.url, http);
+    const ephemeralToken = environment['ZEROSHOT_TARGET_ACCESS_TOKEN']?.trim();
+    const ephemeralOrganization = environment['ZEROSHOT_TARGET_ORGANIZATION']?.trim();
+    if ((ephemeralToken && !ephemeralOrganization) || (!ephemeralToken && ephemeralOrganization)) {
+        throw new Error('ZEROSHOT_TARGET_ACCESS_TOKEN and ZEROSHOT_TARGET_ORGANIZATION must be provided together');
+    }
+    let organization;
+    let tokenProvider;
+    if (ephemeralToken && ephemeralOrganization) {
+        organization = ephemeralOrganization;
+        tokenProvider = { getAccessToken: async () => ephemeralToken };
+    }
+    else {
+        if (!target.organization) {
+            throw new Error(`Login required. Run: zeroshot target login ${targetName}`);
+        }
+        organization = target.organization.id;
+        const credentials = await credential_store_ts_1.KeyringCredentialStore.create();
+        tokenProvider = (0, target_session_ts_1.getAccessTokenProvider)(targetName, target, credentials, () => (0, credential_lock_ts_1.acquireTargetLock)(target.id), { http, discoveryEndpoints: discovery });
+    }
+    return {
+        targetName,
+        organization,
+        client: new RunIntentClient(discovery.capsuleApiBaseUrl, organization, tokenProvider, deps.fetch ?? globalThis.fetch),
+    };
+}

package/lib/target/hosted-run/commands.d.ts

@@ -0,0 +1,4 @@
+import type { HostedOptions, HostedRunDependencies, HostedRunIntent } from './contracts.ts';
+export declare function runHosted(input: string, options: HostedOptions, deps: HostedRunDependencies): Promise<HostedRunIntent | Record<string, unknown> | null>;
+export declare function statusHostedRun(targetName: string, intentId: string, shouldFollow: boolean, deps: HostedRunDependencies): Promise<HostedRunIntent | Record<string, unknown> | null>;
+export declare function cancelHostedRun(targetName: string, intentId: string, deps: HostedRunDependencies): Promise<HostedRunIntent>;

package/lib/target/hosted-run/commands.js

@@ -0,0 +1,113 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runHosted = runHosted;
+exports.statusHostedRun = statusHostedRun;
+exports.cancelHostedRun = cancelHostedRun;
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const client_ts_1 = require("./client.js");
+const input_ts_1 = require("./input.js");
+const DEFAULT_MODEL = 'openai/gpt-5.4';
+const RUN_INTENT_VERSION = 'zeroshot.run-intent/v1';
+const MAX_RUN_INTENT_BYTES = 1024 * 1024 + 64 * 1024;
+const RUN_INTENT_POLL_MS = 500;
+function output(deps, value) {
+    (deps.stdout ?? process.stdout).write(`${value}\n`);
+}
+function wait(milliseconds) {
+    return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
+function displayState(intent) {
+    return intent.waiting_reason ? `${intent.state} (${intent.waiting_reason})` : intent.state;
+}
+function resumeCommand(value, intentId) {
+    return `zeroshot target status ${value.targetName} ${intentId} --follow`;
+}
+async function follow(value, initial, deps) {
+    let intent = initial;
+    let displayed = null;
+    for (;;) {
+        const state = displayState(intent);
+        if (state !== displayed) {
+            output(deps, `Run ${intent.intent_id}: ${state}`);
+            displayed = state;
+        }
+        if (client_ts_1.TERMINAL_STATES.has(intent.state))
+            break;
+        await (deps.delay ?? wait)(RUN_INTENT_POLL_MS);
+        intent = await value.client.get(intent.intent_id);
+    }
+    if (intent.state === 'succeeded') {
+        const summary = intent.result?.['summary'];
+        if (typeof summary === 'string' && summary)
+            output(deps, summary);
+        return intent.result;
+    }
+    const detail = intent.error_code ? ` (${intent.error_code})` : '';
+    throw new Error(`hosted run ${intent.state}${detail}`);
+}
+async function runHosted(input, options, deps) {
+    (0, input_ts_1.validateHostedOptions)(options);
+    const environment = deps.environment ?? process.env;
+    const resolved = await (0, input_ts_1.resolveHostedInput)(input, options, environment);
+    const value = await (0, client_ts_1.context)(options.target, deps);
+    const body = {
+        label: 'zeroshot-cli',
+        size: options.size ?? 'standard',
+        intent: {
+            version: RUN_INTENT_VERSION,
+            credentials: {
+                githubToken: (0, input_ts_1.githubToken)(environment),
+                openrouterApiKey: (0, input_ts_1.providerKey)(environment),
+                repository: resolved.repository,
+                model: options.model ?? DEFAULT_MODEL,
+            },
+            request: resolved.request,
+        },
+    };
+    if (Buffer.byteLength(JSON.stringify(body)) > MAX_RUN_INTENT_BYTES) {
+        throw new Error('hosted run intent exceeds the 1088 KiB upload limit');
+    }
+    const submissionKey = options.submissionKey ?? node_crypto_1.default.randomUUID();
+    let created;
+    try {
+        created = await value.client.submit(body, submissionKey);
+    }
+    catch (error) {
+        if (error instanceof client_ts_1.HostedRunHttpError)
+            throw error;
+        throw new Error(`${error instanceof Error ? error.message : String(error)}. Recover this submission by rerunning ` +
+            `the same command with --submission-key ${submissionKey}`, { cause: error });
+    }
+    output(deps, `Run ${created.intent_id} queued`);
+    output(deps, `Resume: ${resumeCommand(value, created.intent_id)}`);
+    if (options.detach)
+        return created;
+    output(deps, 'Ctrl+C disconnects without cancelling.');
+    return follow(value, created, deps);
+}
+async function statusHostedRun(targetName, intentId, shouldFollow, deps) {
+    if (!client_ts_1.UUID.test(intentId))
+        throw new Error('run intent id must be a UUID');
+    const value = await (0, client_ts_1.context)(targetName, deps);
+    const intent = await value.client.get(intentId);
+    if (!shouldFollow) {
+        output(deps, JSON.stringify(intent, null, 2));
+        return intent;
+    }
+    if (!client_ts_1.TERMINAL_STATES.has(intent.state)) {
+        output(deps, `Following ${intentId}; Ctrl+C disconnects without cancelling.`);
+        output(deps, `Resume: ${resumeCommand(value, intentId)}`);
+    }
+    return follow(value, intent, deps);
+}
+async function cancelHostedRun(targetName, intentId, deps) {
+    if (!client_ts_1.UUID.test(intentId))
+        throw new Error('run intent id must be a UUID');
+    const value = await (0, client_ts_1.context)(targetName, deps);
+    const intent = await value.client.cancel(intentId);
+    output(deps, `Run ${intent.intent_id}: ${displayState(intent)}`);
+    return intent;
+}