@the-open-engine/zeroshot 6.28.0 → 6.29.1

package/lib/target/bounded-response.d.ts

@@ -0,0 +1 @@
+export declare function readBoundedResponseJson(response: Response, maxBytes: number, error: (kind: 'size' | 'json') => Error): Promise<unknown>;

package/lib/target/bounded-response.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readBoundedResponseJson = readBoundedResponseJson;
+async function declaredResponseBytes(response, maxBytes, error) {
+    const declared = response.headers.get('content-length');
+    if (declared === null)
+        return 0;
+    if (!/^\d+$/.test(declared) || Number(declared) > maxBytes) {
+        await response.body?.cancel().catch(() => undefined);
+        throw error('size');
+    }
+    return Number(declared);
+}
+function growBuffer(bytes, required, used, maxBytes) {
+    const capacity = Math.min(maxBytes, Math.max(required, Math.max(bytes.byteLength * 2, 8 * 1024)));
+    const grown = new Uint8Array(capacity);
+    grown.set(bytes.subarray(0, used));
+    return grown;
+}
+function decodeJson(bytes, error) {
+    try {
+        return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+    }
+    catch {
+        throw error('json');
+    }
+}
+async function readBoundedResponseJson(response, maxBytes, error) {
+    const declaredBytes = await declaredResponseBytes(response, maxBytes, error);
+    const reader = response.body?.getReader();
+    if (reader === undefined)
+        return decodeJson(new Uint8Array(), error);
+    let bytes = new Uint8Array(Math.min(maxBytes, Math.max(declaredBytes, 8 * 1024)));
+    let total = 0;
+    while (true) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        const nextTotal = total + value.byteLength;
+        if (nextTotal > maxBytes) {
+            await reader.cancel().catch(() => undefined);
+            throw error('size');
+        }
+        if (nextTotal > bytes.byteLength) {
+            bytes = growBuffer(bytes, nextTotal, total, maxBytes);
+        }
+        bytes.set(value, total);
+        total = nextTotal;
+    }
+    return decodeJson(bytes.subarray(0, total), error);
+}

package/lib/target/bounded-response.mjs

@@ -0,0 +1,48 @@
+async function declaredResponseBytes(response, maxBytes, error) {
+    const declared = response.headers.get('content-length');
+    if (declared === null)
+        return 0;
+    if (!/^\d+$/.test(declared) || Number(declared) > maxBytes) {
+        await response.body?.cancel().catch(() => undefined);
+        throw error('size');
+    }
+    return Number(declared);
+}
+function growBuffer(bytes, required, used, maxBytes) {
+    const capacity = Math.min(maxBytes, Math.max(required, Math.max(bytes.byteLength * 2, 8 * 1024)));
+    const grown = new Uint8Array(capacity);
+    grown.set(bytes.subarray(0, used));
+    return grown;
+}
+function decodeJson(bytes, error) {
+    try {
+        return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+    }
+    catch {
+        throw error('json');
+    }
+}
+export async function readBoundedResponseJson(response, maxBytes, error) {
+    const declaredBytes = await declaredResponseBytes(response, maxBytes, error);
+    const reader = response.body?.getReader();
+    if (reader === undefined)
+        return decodeJson(new Uint8Array(), error);
+    let bytes = new Uint8Array(Math.min(maxBytes, Math.max(declaredBytes, 8 * 1024)));
+    let total = 0;
+    while (true) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        const nextTotal = total + value.byteLength;
+        if (nextTotal > maxBytes) {
+            await reader.cancel().catch(() => undefined);
+            throw error('size');
+        }
+        if (nextTotal > bytes.byteLength) {
+            bytes = growBuffer(bytes, nextTotal, total, maxBytes);
+        }
+        bytes.set(value, total);
+        total = nextTotal;
+    }
+    return decodeJson(bytes.subarray(0, total), error);
+}

package/lib/target/credential-lock.js

@@ -32,7 +32,5 @@ async function acquireTargetLock(targetId) {
             maxTimeout: LOCK_RETRY_MAX_TIMEOUT_MS,
         },
     });
-    return async () => {
-        await release();
-    };
+    return release;
 }

package/lib/target/credential-store.js

@@ -71,12 +71,17 @@ class KeyringCredentialStore {
             return entry.getPassword();
         }
         catch {
-            return null;
+            throw new CredentialStoreUnavailableError('The secure credential store could not be read.');
         }
     }
     async set(service, account, token) {
-        const entry = new this.Entry(service, account);
-        entry.setPassword(token);
+        try {
+            const entry = new this.Entry(service, account);
+            entry.setPassword(token);
+        }
+        catch {
+            throw new CredentialStoreUnavailableError('The secure credential store could not be updated.');
+        }
     }
     async delete(service, account) {
         try {
@@ -84,7 +89,7 @@ class KeyringCredentialStore {
             entry.deletePassword();
         }
         catch {
-            // Already deleted or not present
+            throw new CredentialStoreUnavailableError('The secure credential store could not be cleared.');
         }
     }
 }

package/lib/target/device-flow.cjs

@@ -0,0 +1,213 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UnboundSessionError = exports.DeviceFlowExpiredError = exports.DeviceFlowDeniedError = exports.parseTokenResponse = void 0;
+exports.oauthFormRequest = oauthFormRequest;
+exports.requestDeviceCode = requestDeviceCode;
+exports.pollForToken = pollForToken;
+const bounded_response_js_1 = require("./bounded-response.cjs");
+const token_response_js_1 = require("./token-response.cjs");
+var token_response_js_2 = require("./token-response.cjs");
+Object.defineProperty(exports, "parseTokenResponse", { enumerable: true, get: function () { return token_response_js_2.parseTokenResponse; } });
+function exchangeFields(exchange) {
+    if (exchange === undefined)
+        return {};
+    if ('grantType' in exchange) {
+        return {
+            grant_type: exchange.grantType,
+            device_token: exchange.deviceToken,
+            device_label: exchange.deviceLabel,
+            audience: exchange.audience,
+        };
+    }
+    return {
+        device_token: exchange.token,
+        device_label: exchange.label,
+        audience: 'admin',
+    };
+}
+class DeviceFlowDeniedError extends Error {
+    constructor() {
+        super('Device authorization denied by user');
+        this.name = 'DeviceFlowDeniedError';
+    }
+}
+exports.DeviceFlowDeniedError = DeviceFlowDeniedError;
+class DeviceFlowExpiredError extends Error {
+    constructor() {
+        super('Device authorization code expired');
+        this.name = 'DeviceFlowExpiredError';
+    }
+}
+exports.DeviceFlowExpiredError = DeviceFlowExpiredError;
+class UnboundSessionError extends Error {
+    verificationUri;
+    constructor(verificationUri) {
+        super(`Session not bound to an organization. Re-approve at ${verificationUri} and select an organization.`);
+        this.name = 'UnboundSessionError';
+        this.verificationUri = verificationUri;
+    }
+}
+exports.UnboundSessionError = UnboundSessionError;
+const DEFAULT_CLOCK = { now: () => Date.now() };
+const MAX_OAUTH_RESPONSE_BYTES = 64 * 1024;
+const MAX_DEVICE_CODE_BYTES = 16 * 1024;
+const LOOPBACK_HOSTS = Object.freeze({
+    '127.0.0.1': true,
+    '::1': true,
+    '[::1]': true,
+});
+const MAX_URI_BYTES = 4 * 1024;
+function oauthFormRequest(body, signal) {
+    const init = {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: body.toString(),
+        redirect: 'error',
+    };
+    if (signal !== undefined)
+        init.signal = signal;
+    return init;
+}
+async function requireResponseRoute(response, expectedUrl) {
+    if (!response.url || new URL(response.url).href === expectedUrl)
+        return;
+    await response.body?.cancel().catch(() => undefined);
+    throw new Error('OAuth response changed target route or authority');
+}
+async function readBoundedJson(response) {
+    return (0, bounded_response_js_1.readBoundedResponseJson)(response, MAX_OAUTH_RESPONSE_BYTES, (kind) => new Error(kind === 'size' ? 'OAuth response exceeds the size limit' : 'OAuth response is malformed'));
+}
+function boundedString(value, maxBytes) {
+    return (typeof value === 'string' &&
+        value.length > 0 &&
+        new TextEncoder().encode(value).byteLength <= maxBytes);
+}
+function safeVerificationAuthority(url, allowQuery) {
+    const literalLoopback = LOOPBACK_HOSTS[url.hostname] === true;
+    return !url.username && !url.password && !url.hash &&
+        (allowQuery || !url.search) &&
+        (url.protocol === 'https:' || (url.protocol === 'http:' && literalLoopback));
+}
+function verificationUrl(value, allowQuery) {
+    if (!boundedString(value, MAX_URI_BYTES) ||
+        /[\u0000-\u0020\u007f]|\s/u.test(value)) {
+        return false;
+    }
+    try {
+        const url = new URL(value);
+        return url.href === value && safeVerificationAuthority(url, allowQuery);
+    }
+    catch {
+        return false;
+    }
+}
+function deviceFieldsValid(device) {
+    const fields = Object.keys(device);
+    const required = ['device_code', 'user_code', 'verification_uri', 'expires_in', 'interval'];
+    return fields.every((field) => required.includes(field) || field === 'verification_uri_complete') && required.every((field) => field in device);
+}
+function deviceStringsValid(device) {
+    return boundedString(device.device_code, MAX_DEVICE_CODE_BYTES) &&
+        boundedString(device.user_code, 256) &&
+        verificationUrl(device.verification_uri, false) &&
+        (device.verification_uri_complete === undefined ||
+            verificationUrl(device.verification_uri_complete, true));
+}
+function deviceTimingValid(device) {
+    return Number.isSafeInteger(device.expires_in) &&
+        device.expires_in >= 1 &&
+        device.expires_in <= 86_400 &&
+        Number.isSafeInteger(device.interval) &&
+        device.interval >= 0 &&
+        device.interval <= 300;
+}
+function browserAuthorityMatches(device) {
+    return device.verification_uri_complete === undefined ||
+        new URL(device.verification_uri_complete).origin ===
+            new URL(device.verification_uri).origin;
+}
+function parseDeviceCodeResponse(value) {
+    const device = object(value, 'Device code');
+    if (!deviceFieldsValid(device) || !deviceStringsValid(device) ||
+        !deviceTimingValid(device) || !browserAuthorityMatches(device)) {
+        throw new Error('Device code response is malformed');
+    }
+    return Object.freeze(device);
+}
+function parseOAuthError(value) {
+    const error = object(value, 'OAuth error');
+    if (Object.keys(error).length !== 1 || typeof error.error !== 'string') {
+        throw new Error('OAuth error response is malformed');
+    }
+    return error.error;
+}
+function object(value, field) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error(`${field} response is malformed`);
+    }
+    return value;
+}
+function sleep(ms, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal?.aborted) {
+            reject(signal.reason ?? new DOMException('Aborted', 'AbortError'));
+            return;
+        }
+        const timer = setTimeout(resolve, ms);
+        signal?.addEventListener('abort', () => {
+            clearTimeout(timer);
+            reject(signal.reason ?? new DOMException('Aborted', 'AbortError'));
+        }, { once: true });
+    });
+}
+async function requestDeviceCode(deviceAuthorizationEndpoint, clientId, http, signal) {
+    const body = new URLSearchParams({ client_id: clientId });
+    const response = await http.fetch(deviceAuthorizationEndpoint, oauthFormRequest(body, signal));
+    await requireResponseRoute(response, deviceAuthorizationEndpoint);
+    if (!response.ok) {
+        parseOAuthError(await readBoundedJson(response));
+        throw new Error(`Device code request failed (${response.status})`);
+    }
+    return parseDeviceCodeResponse(await readBoundedJson(response));
+}
+async function parsePollResponse(response) {
+    if (response.ok)
+        return (0, token_response_js_1.parseTokenResponse)(await readBoundedJson(response));
+    const error = parseOAuthError(await readBoundedJson(response));
+    if (error === 'authorization_pending' || error === 'slow_down')
+        return error;
+    if (error === 'access_denied')
+        throw new DeviceFlowDeniedError();
+    if (error === 'expired_token')
+        throw new DeviceFlowExpiredError();
+    throw new Error('Token endpoint returned an unsupported OAuth error');
+}
+function pollBody(request) {
+    return new URLSearchParams({
+        grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+        device_code: request.deviceCode,
+        client_id: request.clientId,
+        ...exchangeFields(request.exchange),
+    });
+}
+async function pollForToken(request) {
+    const clock = request.clock ?? DEFAULT_CLOCK;
+    const deadline = clock.now() + request.expiresIn * 1000;
+    let currentInterval = request.interval;
+    while (clock.now() < deadline) {
+        if (request.signal?.aborted) {
+            throw request.signal.reason ?? new DOMException('Aborted', 'AbortError');
+        }
+        await sleep(currentInterval * 1000, request.signal);
+        const response = await request.http.fetch(request.tokenEndpoint, oauthFormRequest(pollBody(request), request.signal));
+        const result = await parsePollResponse(response);
+        if (result === 'authorization_pending')
+            continue;
+        if (result === 'slow_down') {
+            currentInterval += 5;
+            continue;
+        }
+        return result;
+    }
+    throw new DeviceFlowExpiredError();
+}

package/lib/target/device-flow.d.cts

@@ -0,0 +1,54 @@
+import { type TokenResponse } from './token-response.js';
+export { parseTokenResponse, type TokenResponse } from './token-response.js';
+export interface DeviceCodeResponse {
+    readonly device_code: string;
+    readonly user_code: string;
+    readonly verification_uri: string;
+    readonly verification_uri_complete?: string;
+    readonly expires_in: number;
+    readonly interval: number;
+}
+export interface DeviceExchangeContext {
+    readonly grantType: string;
+    readonly deviceToken: string;
+    readonly deviceLabel: string;
+    readonly audience: string;
+}
+export interface DeviceIdentity {
+    readonly token: string;
+    readonly label: string;
+}
+export interface HttpTransport {
+    fetch(url: string, init: RequestInit & {
+        redirect: 'error';
+    }): Promise<Response>;
+}
+export interface Clock {
+    now(): number;
+}
+export declare class DeviceFlowDeniedError extends Error {
+    constructor();
+}
+export declare class DeviceFlowExpiredError extends Error {
+    constructor();
+}
+export declare class UnboundSessionError extends Error {
+    readonly verificationUri: string;
+    constructor(verificationUri: string);
+}
+export declare function oauthFormRequest(body: URLSearchParams, signal?: AbortSignal): RequestInit & {
+    redirect: 'error';
+};
+export declare function requestDeviceCode(deviceAuthorizationEndpoint: string, clientId: string, http: HttpTransport, signal?: AbortSignal): Promise<DeviceCodeResponse>;
+export interface PollForTokenRequest {
+    readonly tokenEndpoint: string;
+    readonly clientId: string;
+    readonly deviceCode: string;
+    readonly interval: number;
+    readonly expiresIn: number;
+    readonly http: HttpTransport;
+    readonly clock?: Clock;
+    readonly signal?: AbortSignal;
+    readonly exchange?: DeviceExchangeContext | DeviceIdentity;
+}
+export declare function pollForToken(request: PollForTokenRequest): Promise<TokenResponse>;

package/lib/target/device-flow.d.mts

@@ -0,0 +1,54 @@
+import { type TokenResponse } from './token-response.js';
+export { parseTokenResponse, type TokenResponse } from './token-response.js';
+export interface DeviceCodeResponse {
+    readonly device_code: string;
+    readonly user_code: string;
+    readonly verification_uri: string;
+    readonly verification_uri_complete?: string;
+    readonly expires_in: number;
+    readonly interval: number;
+}
+export interface DeviceExchangeContext {
+    readonly grantType: string;
+    readonly deviceToken: string;
+    readonly deviceLabel: string;
+    readonly audience: string;
+}
+export interface DeviceIdentity {
+    readonly token: string;
+    readonly label: string;
+}
+export interface HttpTransport {
+    fetch(url: string, init: RequestInit & {
+        redirect: 'error';
+    }): Promise<Response>;
+}
+export interface Clock {
+    now(): number;
+}
+export declare class DeviceFlowDeniedError extends Error {
+    constructor();
+}
+export declare class DeviceFlowExpiredError extends Error {
+    constructor();
+}
+export declare class UnboundSessionError extends Error {
+    readonly verificationUri: string;
+    constructor(verificationUri: string);
+}
+export declare function oauthFormRequest(body: URLSearchParams, signal?: AbortSignal): RequestInit & {
+    redirect: 'error';
+};
+export declare function requestDeviceCode(deviceAuthorizationEndpoint: string, clientId: string, http: HttpTransport, signal?: AbortSignal): Promise<DeviceCodeResponse>;
+export interface PollForTokenRequest {
+    readonly tokenEndpoint: string;
+    readonly clientId: string;
+    readonly deviceCode: string;
+    readonly interval: number;
+    readonly expiresIn: number;
+    readonly http: HttpTransport;
+    readonly clock?: Clock;
+    readonly signal?: AbortSignal;
+    readonly exchange?: DeviceExchangeContext | DeviceIdentity;
+}
+export declare function pollForToken(request: PollForTokenRequest): Promise<TokenResponse>;

package/lib/target/device-flow.d.ts

@@ -1,3 +1,5 @@
+import { type TokenResponse } from './token-response.js';
+export { parseTokenResponse, type TokenResponse } from './token-response.js';
 export interface DeviceCodeResponse {
     readonly device_code: string;
     readonly user_code: string;
@@ -6,15 +8,15 @@ export interface DeviceCodeResponse {
     readonly expires_in: number;
     readonly interval: number;
 }
-export interface TokenResponse {
-    readonly access_token: string;
-    readonly refresh_token: string;
-    readonly token_type: string;
-    readonly expires_in: number;
-    readonly organization?: {
-        readonly id: string;
-        readonly name: string;
-    };
+export interface DeviceExchangeContext {
+    readonly grantType: string;
+    readonly deviceToken: string;
+    readonly deviceLabel: string;
+    readonly audience: string;
+}
+export interface DeviceIdentity {
+    readonly token: string;
+    readonly label: string;
 }
 export interface HttpTransport {
     fetch(url: string, init: RequestInit & {
@@ -34,5 +36,19 @@ export declare class UnboundSessionError extends Error {
     readonly verificationUri: string;
     constructor(verificationUri: string);
 }
+export declare function oauthFormRequest(body: URLSearchParams, signal?: AbortSignal): RequestInit & {
+    redirect: 'error';
+};
 export declare function requestDeviceCode(deviceAuthorizationEndpoint: string, clientId: string, http: HttpTransport, signal?: AbortSignal): Promise<DeviceCodeResponse>;
-export declare function pollForToken(tokenEndpoint: string, clientId: string, deviceCode: string, interval: number, expiresIn: number, http: HttpTransport, clock?: Clock, signal?: AbortSignal): Promise<TokenResponse>;
+export interface PollForTokenRequest {
+    readonly tokenEndpoint: string;
+    readonly clientId: string;
+    readonly deviceCode: string;
+    readonly interval: number;
+    readonly expiresIn: number;
+    readonly http: HttpTransport;
+    readonly clock?: Clock;
+    readonly signal?: AbortSignal;
+    readonly exchange?: DeviceExchangeContext | DeviceIdentity;
+}
+export declare function pollForToken(request: PollForTokenRequest): Promise<TokenResponse>;