@the-open-engine/zeroshot 6.27.0 → 6.29.0

package/lib/target/hosted-run/contracts.d.ts

@@ -0,0 +1,49 @@
+import type { SettingsPort } from '../target-registry.ts';
+export interface HostedOptions {
+    readonly target?: string;
+    readonly repository?: string;
+    readonly model?: string;
+    readonly size?: string;
+    readonly submissionKey?: string;
+    readonly detach?: boolean;
+    readonly pr?: boolean;
+    readonly provider?: string;
+    readonly config?: string;
+    readonly docker?: boolean;
+    readonly worktree?: boolean;
+    readonly dockerImage?: string;
+    readonly strictSchema?: boolean;
+    readonly ship?: boolean;
+    readonly prBase?: string;
+    readonly mergeQueue?: boolean;
+    readonly closeIssue?: string;
+    readonly workers?: number;
+    readonly gitlab?: boolean;
+    readonly jira?: boolean;
+    readonly devops?: boolean;
+    readonly linear?: boolean;
+    readonly mount?: readonly string[];
+    readonly noMounts?: boolean;
+    readonly containerHome?: string;
+}
+export interface HostedRunIntent {
+    readonly intent_id: string;
+    readonly state: string;
+    readonly waiting_reason: string | null;
+    readonly result: Record<string, unknown> | null;
+    readonly error_code: string | null;
+    readonly [key: string]: unknown;
+}
+export interface HostedRunDependencies {
+    readonly settings: SettingsPort;
+    readonly environment?: NodeJS.ProcessEnv;
+    readonly fetch?: typeof globalThis.fetch;
+    readonly delay?: (milliseconds: number) => Promise<void>;
+    readonly stdout?: {
+        write(value: string): void;
+    };
+}
+export interface ResolvedInput {
+    readonly repository: string;
+    readonly request: Record<string, unknown>;
+}

package/lib/target/hosted-run/contracts.js

@@ -0,0 +1,3 @@
+"use strict";
+// Shared hosted-run command contracts.
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/target/hosted-run/input.d.ts

@@ -0,0 +1,5 @@
+import type { HostedOptions, ResolvedInput } from './contracts.ts';
+export declare function resolveHostedInput(input: string, options: HostedOptions, environment?: NodeJS.ProcessEnv): Promise<ResolvedInput>;
+export declare function githubToken(environment: NodeJS.ProcessEnv): string;
+export declare function providerKey(environment: NodeJS.ProcessEnv): string;
+export declare function validateHostedOptions(options: HostedOptions): void;

package/lib/target/hosted-run/input.js

@@ -0,0 +1,200 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveHostedInput = resolveHostedInput;
+exports.githubToken = githubToken;
+exports.providerKey = providerKey;
+exports.validateHostedOptions = validateHostedOptions;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_child_process_1 = require("node:child_process");
+const SUBMISSION_KEY = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{12}$/i;
+const CAPSULE_SIZES = new Set(['tiny', 'small', 'standard', 'large']);
+function validRepository(value) {
+    if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(value))
+        return false;
+    return value.split('/').every((segment) => segment !== '.' && segment !== '..');
+}
+function validModel(value) {
+    return (value.length <= 256 && /^[A-Za-z0-9][A-Za-z0-9._-]*\/[A-Za-z0-9][A-Za-z0-9._:-]*$/.test(value));
+}
+function repositoryFromRemote(cwd = process.cwd()) {
+    let remote;
+    try {
+        remote = (0, node_child_process_1.execFileSync)('git', ['remote', 'get-url', 'origin'], {
+            cwd,
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+        }).trim();
+    }
+    catch {
+        return null;
+    }
+    const match = remote.match(/^(?:git@github\.com:|ssh:\/\/git@github\.com\/|https?:\/\/github\.com\/)([^/]+\/[^/]+?)(?:\.git)?$/);
+    const repository = match?.[1];
+    return repository && validRepository(repository) ? repository : null;
+}
+function isolationProfile(options) {
+    return options.pr ? 'isolation.pr@1' : 'isolation.worktree@1';
+}
+function providerProfile(options) {
+    return options.pr ? 'provider.codex-openrouter-pr@1' : 'provider.codex-openrouter@1';
+}
+function promptRequest(prompt, options) {
+    return {
+        source: 'prompt',
+        prompt,
+        artifacts: [],
+        isolationProfile: isolationProfile(options),
+        providerProfile: providerProfile(options),
+    };
+}
+function issueRequest(issue, options) {
+    return {
+        source: 'issue',
+        issue,
+        artifacts: [],
+        isolationProfile: isolationProfile(options),
+        providerProfile: providerProfile(options),
+    };
+}
+function issueInput(value, options) {
+    const shorthand = value.match(/^([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+)#([1-9][0-9]*)$/);
+    if (shorthand?.[1] && shorthand[2] && validRepository(shorthand[1])) {
+        const issue = `https://github.com/${shorthand[1]}/issues/${shorthand[2]}`;
+        return { repository: shorthand[1], request: issueRequest(issue, options) };
+    }
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return null;
+    }
+    const match = url.pathname.match(/^\/([^/]+)\/([^/]+)\/issues\/([1-9][0-9]*)\/?$/);
+    const repository = match?.[1] && match[2] ? `${match[1]}/${match[2]}` : '';
+    if (url.hostname !== 'github.com' || !match || !validRepository(repository))
+        return null;
+    return { repository, request: issueRequest(url.href, options) };
+}
+async function readStdin() {
+    if (process.stdin.isTTY)
+        throw new Error('zeroshot run - requires piped input');
+    const chunks = [];
+    let bytes = 0;
+    for await (const chunk of process.stdin) {
+        const value = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        bytes += value.length;
+        if (bytes > 1024 * 1024)
+            throw new Error('hosted task input exceeds 1 MiB');
+        chunks.push(value);
+    }
+    const value = Buffer.concat(chunks).toString('utf8').trim();
+    if (!value)
+        throw new Error('hosted task input is empty');
+    return value;
+}
+function readTaskFile(filename) {
+    const flags = node_fs_1.default.constants.O_RDONLY | (node_fs_1.default.constants.O_NOFOLLOW ?? 0) | (node_fs_1.default.constants.O_NONBLOCK ?? 0);
+    let descriptor;
+    try {
+        descriptor = node_fs_1.default.openSync(filename, flags);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === 'ENOENT' || code === 'ENOTDIR' || code === 'EISDIR')
+            return null;
+        if (code === 'ELOOP')
+            throw new Error(`hosted task file must not be a symlink: ${filename}`);
+        throw error;
+    }
+    try {
+        if (!node_fs_1.default.fstatSync(descriptor).isFile())
+            return null;
+        return node_fs_1.default.readFileSync(descriptor, 'utf8');
+    }
+    finally {
+        node_fs_1.default.closeSync(descriptor);
+    }
+}
+async function resolveHostedInput(input, options, environment = process.env) {
+    const explicitIssue = issueInput(input, options);
+    if (explicitIssue)
+        return explicitIssue;
+    const repository = options.repository ?? environment['ZEROSHOT_REPOSITORY'] ?? repositoryFromRemote();
+    if (!validRepository(repository ?? '')) {
+        throw new Error('hosted runs need a GitHub repository; use org/repo#123, --repository owner/name, ' +
+            'ZEROSHOT_REPOSITORY, or run inside a GitHub checkout');
+    }
+    if (/^[1-9][0-9]*$/.test(input)) {
+        return { repository: repository, request: issueRequest(input, options) };
+    }
+    const prompt = input === '-' ? await readStdin() : (readTaskFile(node_path_1.default.resolve(input)) ?? input);
+    if (!prompt.trim())
+        throw new Error('hosted task input is empty');
+    return { repository: repository, request: promptRequest(prompt.trim(), options) };
+}
+function githubToken(environment) {
+    const configured = environment['GH_TOKEN'] ?? environment['GITHUB_TOKEN'];
+    if (configured?.trim())
+        return configured.trim();
+    try {
+        const token = (0, node_child_process_1.execFileSync)('gh', ['auth', 'token'], {
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+        }).trim();
+        if (token)
+            return token;
+    }
+    catch {
+        // The actionable error below covers missing and unauthenticated gh alike.
+    }
+    throw new Error('hosted runs require GH_TOKEN/GITHUB_TOKEN or an authenticated gh CLI');
+}
+function providerKey(environment) {
+    const key = environment['OPENROUTER_API_KEY'];
+    if (!key?.trim())
+        throw new Error('hosted Codex runs require OPENROUTER_API_KEY');
+    return key.trim();
+}
+function validateHostedOptions(options) {
+    const unsupported = [
+        ['config', '--config'],
+        ['docker', '--docker'],
+        ['worktree', '--worktree'],
+        ['dockerImage', '--docker-image'],
+        ['strictSchema', '--strict-schema'],
+        ['ship', '--ship'],
+        ['prBase', '--pr-base'],
+        ['mergeQueue', '--merge-queue'],
+        ['closeIssue', '--close-issue'],
+        ['workers', '--workers'],
+        ['gitlab', '--gitlab'],
+        ['jira', '--jira'],
+        ['devops', '--devops'],
+        ['linear', '--linear'],
+        ['mount', '--mount'],
+        ['noMounts', '--no-mounts'],
+        ['containerHome', '--container-home'],
+    ];
+    const selected = unsupported
+        .filter(([name]) => options[name] !== undefined && options[name] !== false)
+        .map(([, flag]) => flag);
+    if (options.provider && options.provider !== 'codex')
+        selected.push('--provider');
+    if (selected.length)
+        throw new Error(`hosted runs do not support ${selected.join(', ')}`);
+    if (!options.target)
+        throw new Error('hosted runs require --target');
+    if (options.model !== undefined && !validModel(options.model)) {
+        throw new Error('hosted runs require an exact provider/model slug');
+    }
+    if (!CAPSULE_SIZES.has(options.size ?? 'standard')) {
+        throw new Error('hosted runs require --size tiny, small, standard, or large');
+    }
+    if (options.submissionKey !== undefined && !SUBMISSION_KEY.test(options.submissionKey)) {
+        throw new Error('hosted runs require --submission-key to be a random UUID');
+    }
+}

package/lib/target/hosted-run.d.ts

@@ -0,0 +1,4 @@
+export { HostedRunHttpError } from './hosted-run/client.ts';
+export { cancelHostedRun, runHosted, statusHostedRun } from './hosted-run/commands.ts';
+export { resolveHostedInput, validateHostedOptions } from './hosted-run/input.ts';
+export type { HostedOptions, HostedRunDependencies, HostedRunIntent, } from './hosted-run/contracts.ts';

package/lib/target/hosted-run.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateHostedOptions = exports.resolveHostedInput = exports.statusHostedRun = exports.runHosted = exports.cancelHostedRun = exports.HostedRunHttpError = void 0;
+var client_ts_1 = require("./hosted-run/client.js");
+Object.defineProperty(exports, "HostedRunHttpError", { enumerable: true, get: function () { return client_ts_1.HostedRunHttpError; } });
+var commands_ts_1 = require("./hosted-run/commands.js");
+Object.defineProperty(exports, "cancelHostedRun", { enumerable: true, get: function () { return commands_ts_1.cancelHostedRun; } });
+Object.defineProperty(exports, "runHosted", { enumerable: true, get: function () { return commands_ts_1.runHosted; } });
+Object.defineProperty(exports, "statusHostedRun", { enumerable: true, get: function () { return commands_ts_1.statusHostedRun; } });
+var input_ts_1 = require("./hosted-run/input.js");
+Object.defineProperty(exports, "resolveHostedInput", { enumerable: true, get: function () { return input_ts_1.resolveHostedInput; } });
+Object.defineProperty(exports, "validateHostedOptions", { enumerable: true, get: function () { return input_ts_1.validateHostedOptions; } });

package/lib/target/index.d.ts

@@ -0,0 +1,6 @@
+export { CredentialStoreUnavailableError, KeyringCredentialStore, FakeCredentialStore, targetServiceKey, TARGET_ACCOUNT, type TargetCredentialStore, } from './credential-store.ts';
+export { acquireTargetLock } from './credential-lock.ts';
+export { requestDeviceCode, pollForToken, DeviceFlowDeniedError, DeviceFlowExpiredError, UnboundSessionError, type DeviceCodeResponse, type TokenResponse, type HttpTransport, type Clock, } from './device-flow.ts';
+export { addTarget, removeTarget, getTarget, listTargets, updateTargetOrganization, validateTargetName, normalizeAndValidateUrl, TargetNameInvalidError, TargetNameExistsError, TargetNotFoundError, TargetUrlInvalidError, type TargetRecord, type SettingsPort, } from './target-registry.ts';
+export { targetLogin, refreshAccessToken, getAccessTokenProvider, revokeAndCleanup, LoginRequiredError, type BrowserOpener, type TargetSessionDeps, type TargetAccessTokenProvider, } from './target-session.ts';
+export { discoverTargetSessionEndpoints, TargetDiscoveryError, type TargetSessionEndpoints, } from './discovery.ts';

package/lib/target/index.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TargetDiscoveryError = exports.discoverTargetSessionEndpoints = exports.LoginRequiredError = exports.revokeAndCleanup = exports.getAccessTokenProvider = exports.refreshAccessToken = exports.targetLogin = exports.TargetUrlInvalidError = exports.TargetNotFoundError = exports.TargetNameExistsError = exports.TargetNameInvalidError = exports.normalizeAndValidateUrl = exports.validateTargetName = exports.updateTargetOrganization = exports.listTargets = exports.getTarget = exports.removeTarget = exports.addTarget = exports.UnboundSessionError = exports.DeviceFlowExpiredError = exports.DeviceFlowDeniedError = exports.pollForToken = exports.requestDeviceCode = exports.acquireTargetLock = exports.TARGET_ACCOUNT = exports.targetServiceKey = exports.FakeCredentialStore = exports.KeyringCredentialStore = exports.CredentialStoreUnavailableError = void 0;
+var credential_store_ts_1 = require("./credential-store.js");
+Object.defineProperty(exports, "CredentialStoreUnavailableError", { enumerable: true, get: function () { return credential_store_ts_1.CredentialStoreUnavailableError; } });
+Object.defineProperty(exports, "KeyringCredentialStore", { enumerable: true, get: function () { return credential_store_ts_1.KeyringCredentialStore; } });
+Object.defineProperty(exports, "FakeCredentialStore", { enumerable: true, get: function () { return credential_store_ts_1.FakeCredentialStore; } });
+Object.defineProperty(exports, "targetServiceKey", { enumerable: true, get: function () { return credential_store_ts_1.targetServiceKey; } });
+Object.defineProperty(exports, "TARGET_ACCOUNT", { enumerable: true, get: function () { return credential_store_ts_1.TARGET_ACCOUNT; } });
+var credential_lock_ts_1 = require("./credential-lock.js");
+Object.defineProperty(exports, "acquireTargetLock", { enumerable: true, get: function () { return credential_lock_ts_1.acquireTargetLock; } });
+var device_flow_ts_1 = require("./device-flow.js");
+Object.defineProperty(exports, "requestDeviceCode", { enumerable: true, get: function () { return device_flow_ts_1.requestDeviceCode; } });
+Object.defineProperty(exports, "pollForToken", { enumerable: true, get: function () { return device_flow_ts_1.pollForToken; } });
+Object.defineProperty(exports, "DeviceFlowDeniedError", { enumerable: true, get: function () { return device_flow_ts_1.DeviceFlowDeniedError; } });
+Object.defineProperty(exports, "DeviceFlowExpiredError", { enumerable: true, get: function () { return device_flow_ts_1.DeviceFlowExpiredError; } });
+Object.defineProperty(exports, "UnboundSessionError", { enumerable: true, get: function () { return device_flow_ts_1.UnboundSessionError; } });
+var target_registry_ts_1 = require("./target-registry.js");
+Object.defineProperty(exports, "addTarget", { enumerable: true, get: function () { return target_registry_ts_1.addTarget; } });
+Object.defineProperty(exports, "removeTarget", { enumerable: true, get: function () { return target_registry_ts_1.removeTarget; } });
+Object.defineProperty(exports, "getTarget", { enumerable: true, get: function () { return target_registry_ts_1.getTarget; } });
+Object.defineProperty(exports, "listTargets", { enumerable: true, get: function () { return target_registry_ts_1.listTargets; } });
+Object.defineProperty(exports, "updateTargetOrganization", { enumerable: true, get: function () { return target_registry_ts_1.updateTargetOrganization; } });
+Object.defineProperty(exports, "validateTargetName", { enumerable: true, get: function () { return target_registry_ts_1.validateTargetName; } });
+Object.defineProperty(exports, "normalizeAndValidateUrl", { enumerable: true, get: function () { return target_registry_ts_1.normalizeAndValidateUrl; } });
+Object.defineProperty(exports, "TargetNameInvalidError", { enumerable: true, get: function () { return target_registry_ts_1.TargetNameInvalidError; } });
+Object.defineProperty(exports, "TargetNameExistsError", { enumerable: true, get: function () { return target_registry_ts_1.TargetNameExistsError; } });
+Object.defineProperty(exports, "TargetNotFoundError", { enumerable: true, get: function () { return target_registry_ts_1.TargetNotFoundError; } });
+Object.defineProperty(exports, "TargetUrlInvalidError", { enumerable: true, get: function () { return target_registry_ts_1.TargetUrlInvalidError; } });
+var target_session_ts_1 = require("./target-session.js");
+Object.defineProperty(exports, "targetLogin", { enumerable: true, get: function () { return target_session_ts_1.targetLogin; } });
+Object.defineProperty(exports, "refreshAccessToken", { enumerable: true, get: function () { return target_session_ts_1.refreshAccessToken; } });
+Object.defineProperty(exports, "getAccessTokenProvider", { enumerable: true, get: function () { return target_session_ts_1.getAccessTokenProvider; } });
+Object.defineProperty(exports, "revokeAndCleanup", { enumerable: true, get: function () { return target_session_ts_1.revokeAndCleanup; } });
+Object.defineProperty(exports, "LoginRequiredError", { enumerable: true, get: function () { return target_session_ts_1.LoginRequiredError; } });
+var discovery_ts_1 = require("./discovery.js");
+Object.defineProperty(exports, "discoverTargetSessionEndpoints", { enumerable: true, get: function () { return discovery_ts_1.discoverTargetSessionEndpoints; } });
+Object.defineProperty(exports, "TargetDiscoveryError", { enumerable: true, get: function () { return discovery_ts_1.TargetDiscoveryError; } });

package/lib/target/target-registry.d.ts

@@ -0,0 +1,45 @@
+export interface TargetRecord {
+    readonly id: string;
+    readonly url: string;
+    readonly adapterVersion: string;
+    readonly deviceToken: string;
+    readonly organization?: {
+        readonly id: string;
+        readonly name: string;
+    };
+    readonly createdAt: string;
+}
+export declare class TargetNameInvalidError extends Error {
+    constructor(name: string);
+}
+export declare class TargetNameExistsError extends Error {
+    constructor(name: string);
+}
+export declare class TargetNotFoundError extends Error {
+    constructor(name: string);
+}
+export declare class TargetUrlInvalidError extends Error {
+    constructor(url: string, reason: string);
+}
+export declare function validateTargetName(name: string): void;
+export declare function normalizeAndValidateUrl(rawUrl: string): string;
+interface SettingsWithTargets {
+    _targets?: Record<string, TargetRecord>;
+    [key: string]: unknown;
+}
+export interface SettingsPort {
+    load(): SettingsWithTargets;
+    mutate(mutator: (settings: SettingsWithTargets) => void): void;
+}
+export declare function addTarget(name: string, rawUrl: string, settings: SettingsPort): TargetRecord;
+export declare function removeTarget(name: string, settings: SettingsPort): TargetRecord;
+export declare function getTarget(name: string, settings: SettingsPort): TargetRecord | null;
+export declare function listTargets(settings: SettingsPort): Array<{
+    name: string;
+    record: TargetRecord;
+}>;
+export declare function updateTargetOrganization(name: string, organization: {
+    id: string;
+    name: string;
+}, settings: SettingsPort): void;
+export {};

package/lib/target/target-registry.js

@@ -0,0 +1,132 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TargetUrlInvalidError = exports.TargetNotFoundError = exports.TargetNameExistsError = exports.TargetNameInvalidError = void 0;
+exports.validateTargetName = validateTargetName;
+exports.normalizeAndValidateUrl = normalizeAndValidateUrl;
+exports.addTarget = addTarget;
+exports.removeTarget = removeTarget;
+exports.getTarget = getTarget;
+exports.listTargets = listTargets;
+exports.updateTargetOrganization = updateTargetOrganization;
+const node_crypto_1 = __importDefault(require("node:crypto"));
+class TargetNameInvalidError extends Error {
+    constructor(name) {
+        super(`Invalid target name "${name}". Must be 1-64 characters, alphanumeric and hyphens only.`);
+        this.name = 'TargetNameInvalidError';
+    }
+}
+exports.TargetNameInvalidError = TargetNameInvalidError;
+class TargetNameExistsError extends Error {
+    constructor(name) {
+        super(`Target "${name}" already exists. Remove it first or choose a different name.`);
+        this.name = 'TargetNameExistsError';
+    }
+}
+exports.TargetNameExistsError = TargetNameExistsError;
+class TargetNotFoundError extends Error {
+    constructor(name) {
+        super(`Target "${name}" not found.`);
+        this.name = 'TargetNotFoundError';
+    }
+}
+exports.TargetNotFoundError = TargetNotFoundError;
+class TargetUrlInvalidError extends Error {
+    constructor(url, reason) {
+        super(`Invalid target URL "${url}": ${reason}`);
+        this.name = 'TargetUrlInvalidError';
+    }
+}
+exports.TargetUrlInvalidError = TargetUrlInvalidError;
+const TARGET_NAME_PATTERN = /^[a-zA-Z0-9]([a-zA-Z0-9-]{0,62}[a-zA-Z0-9])?$/;
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '::1', '[::1]']);
+function validateTargetName(name) {
+    if (!TARGET_NAME_PATTERN.test(name) || name.length > 64) {
+        throw new TargetNameInvalidError(name);
+    }
+}
+function normalizeAndValidateUrl(rawUrl) {
+    let parsed;
+    try {
+        parsed = new URL(rawUrl);
+    }
+    catch {
+        throw new TargetUrlInvalidError(rawUrl, 'not a valid URL');
+    }
+    if (parsed.username || parsed.password) {
+        throw new TargetUrlInvalidError(rawUrl, 'URL must not contain userinfo');
+    }
+    if (parsed.search || parsed.hash) {
+        throw new TargetUrlInvalidError(rawUrl, 'URL must not contain query or fragment');
+    }
+    const isLoopback = LOOPBACK_HOSTS.has(parsed.hostname);
+    if (parsed.protocol !== 'https:' && !isLoopback) {
+        throw new TargetUrlInvalidError(rawUrl, 'HTTPS required for non-loopback targets');
+    }
+    let normalized = `${parsed.protocol}//${parsed.host}${parsed.pathname}`;
+    if (normalized.endsWith('/') && normalized.length > 1) {
+        normalized = normalized.slice(0, -1);
+    }
+    return normalized;
+}
+function addTarget(name, rawUrl, settings) {
+    validateTargetName(name);
+    const url = normalizeAndValidateUrl(rawUrl);
+    const existing = settings.load();
+    if (existing._targets?.[name]) {
+        throw new TargetNameExistsError(name);
+    }
+    const record = {
+        id: node_crypto_1.default.randomUUID(),
+        url,
+        adapterVersion: 'v1',
+        deviceToken: node_crypto_1.default.randomUUID(),
+        createdAt: new Date().toISOString(),
+    };
+    settings.mutate((s) => {
+        if (!s._targets) {
+            s._targets = {};
+        }
+        s._targets[name] = record;
+    });
+    return record;
+}
+function removeTarget(name, settings) {
+    const existing = settings.load();
+    const record = existing._targets?.[name];
+    if (!record) {
+        throw new TargetNotFoundError(name);
+    }
+    settings.mutate((s) => {
+        if (s._targets) {
+            delete s._targets[name];
+        }
+    });
+    return record;
+}
+function getTarget(name, settings) {
+    const existing = settings.load();
+    return existing._targets?.[name] ?? null;
+}
+function listTargets(settings) {
+    const existing = settings.load();
+    const targets = existing._targets ?? {};
+    return Object.entries(targets).map(([name, record]) => ({ name, record }));
+}
+function updateTargetOrganization(name, organization, settings) {
+    const existing = settings.load();
+    if (!existing._targets?.[name]) {
+        throw new TargetNotFoundError(name);
+    }
+    settings.mutate((s) => {
+        const target = s._targets?.[name];
+        if (target) {
+            s._targets[name] = {
+                ...target,
+                organization,
+            };
+        }
+    });
+}

package/lib/target/target-session.d.ts

@@ -0,0 +1,40 @@
+import type { TargetCredentialStore } from './credential-store.ts';
+import type { TargetRecord, SettingsPort } from './target-registry.ts';
+import { type HttpTransport, type Clock } from './device-flow.ts';
+export declare class LoginRequiredError extends Error {
+    readonly targetName: string;
+    constructor(targetName: string);
+}
+export interface BrowserOpener {
+    open(url: string): Promise<void>;
+}
+export interface TargetSessionDeps {
+    readonly http: HttpTransport;
+    readonly clock: Clock;
+    readonly browserOpener: BrowserOpener;
+    readonly stderr: {
+        write(s: string): void;
+    };
+    readonly discoveryEndpoints: {
+        readonly deviceAuthorizationEndpoint: string;
+        readonly tokenEndpoint: string;
+        readonly revocationEndpoint?: string;
+        readonly clientId: string;
+        readonly capsuleApiBaseUrl: string;
+    };
+}
+export declare function targetLogin(targetName: string, target: TargetRecord, credentialStore: TargetCredentialStore, acquireLock: () => Promise<() => Promise<void>>, settings: SettingsPort, deps: TargetSessionDeps): Promise<{
+    organization: {
+        id: string;
+        name: string;
+    };
+}>;
+export declare function refreshAccessToken(targetName: string, target: TargetRecord, credentialStore: TargetCredentialStore, acquireLock: () => Promise<() => Promise<void>>, deps: Pick<TargetSessionDeps, 'http' | 'discoveryEndpoints'>): Promise<{
+    accessToken: string;
+    expiresIn: number;
+}>;
+export interface TargetAccessTokenProvider {
+    getAccessToken(signal?: AbortSignal): Promise<string>;
+}
+export declare function getAccessTokenProvider(targetName: string, target: TargetRecord, credentialStore: TargetCredentialStore, acquireLock: () => Promise<() => Promise<void>>, deps: Pick<TargetSessionDeps, 'http' | 'discoveryEndpoints'>, clock?: Clock): TargetAccessTokenProvider;
+export declare function revokeAndCleanup(target: TargetRecord, credentialStore: TargetCredentialStore, acquireLock: () => Promise<() => Promise<void>>, deps: Pick<TargetSessionDeps, 'http' | 'discoveryEndpoints'>, force: boolean): Promise<void>;