@the-open-engine/zeroshot 6.28.0 → 6.29.1

package/lib/target/target-registry.js

@@ -11,6 +11,8 @@ exports.removeTarget = removeTarget;
 exports.getTarget = getTarget;
 exports.listTargets = listTargets;
 exports.updateTargetOrganization = updateTargetOrganization;
+exports.targetRefreshIsInvalidated = targetRefreshIsInvalidated;
+exports.setTargetRefreshInvalidated = setTargetRefreshInvalidated;
 const node_crypto_1 = __importDefault(require("node:crypto"));
 class TargetNameInvalidError extends Error {
     constructor(name) {
@@ -41,13 +43,20 @@ class TargetUrlInvalidError extends Error {
 }
 exports.TargetUrlInvalidError = TargetUrlInvalidError;
 const TARGET_NAME_PATTERN = /^[a-zA-Z0-9]([a-zA-Z0-9-]{0,62}[a-zA-Z0-9])?$/;
-const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '::1', '[::1]']);
+const LOOPBACK_HOSTS = Object.freeze({
+    '127.0.0.1': true,
+    '::1': true,
+    '[::1]': true,
+});
 function validateTargetName(name) {
     if (!TARGET_NAME_PATTERN.test(name) || name.length > 64) {
         throw new TargetNameInvalidError(name);
     }
 }
 function normalizeAndValidateUrl(rawUrl) {
+    if (/[\u0000-\u0020\u007f]|\s/u.test(rawUrl)) {
+        throw new TargetUrlInvalidError(rawUrl, 'URL contains forbidden whitespace or controls');
+    }
     let parsed;
     try {
         parsed = new URL(rawUrl);
@@ -61,27 +70,30 @@ function normalizeAndValidateUrl(rawUrl) {
     if (parsed.search || parsed.hash) {
         throw new TargetUrlInvalidError(rawUrl, 'URL must not contain query or fragment');
     }
-    const isLoopback = LOOPBACK_HOSTS.has(parsed.hostname);
-    if (parsed.protocol !== 'https:' && !isLoopback) {
-        throw new TargetUrlInvalidError(rawUrl, 'HTTPS required for non-loopback targets');
+    const isLoopback = LOOPBACK_HOSTS[parsed.hostname] === true;
+    const protocolAllowed = parsed.protocol === 'https:' || (parsed.protocol === 'http:' && isLoopback);
+    if (!protocolAllowed) {
+        throw new TargetUrlInvalidError(rawUrl, 'HTTPS required except for literal loopback HTTP targets');
     }
-    let normalized = `${parsed.protocol}//${parsed.host}${parsed.pathname}`;
-    if (normalized.endsWith('/') && normalized.length > 1) {
-        normalized = normalized.slice(0, -1);
+    if (parsed.pathname !== '/') {
+        throw new TargetUrlInvalidError(rawUrl, 'URL must contain only an origin');
     }
-    return normalized;
+    return parsed.origin;
 }
-function addTarget(name, rawUrl, settings) {
+function addTarget(name, rawUrl, settings, descriptor) {
     validateTargetName(name);
     const url = normalizeAndValidateUrl(rawUrl);
     const existing = settings.load();
     if (existing._targets?.[name]) {
         throw new TargetNameExistsError(name);
     }
+    if (!descriptor || descriptor.origin !== url || descriptor.adapter.majorVersion !== 1) {
+        throw new TargetUrlInvalidError(rawUrl, 'validated discovery does not match the target origin');
+    }
     const record = {
         id: node_crypto_1.default.randomUUID(),
         url,
-        adapterVersion: 'v1',
+        adapterVersion: `v${descriptor.adapter.majorVersion}`,
         deviceToken: node_crypto_1.default.randomUUID(),
         createdAt: new Date().toISOString(),
     };
@@ -130,3 +142,22 @@ function updateTargetOrganization(name, organization, settings) {
         }
     });
 }
+function targetRefreshIsInvalidated(name, settings) {
+    return settings.load()._targets?.[name]?.refreshInvalidated === true;
+}
+function setTargetRefreshInvalidated(name, invalidated, settings) {
+    settings.mutate((state) => {
+        const targets = state._targets;
+        const target = targets?.[name];
+        if (targets === undefined || target === undefined)
+            throw new TargetNotFoundError(name);
+        if (invalidated) {
+            targets[name] = { ...target, refreshInvalidated: true };
+        }
+        else {
+            const active = { ...target };
+            Reflect.deleteProperty(active, 'refreshInvalidated');
+            targets[name] = active;
+        }
+    });
+}

package/lib/target/target-session-manager.d.ts

@@ -0,0 +1,48 @@
+import type { TargetCredentialStore } from './credential-store.js';
+import type { TargetRecord, SettingsPort } from './target-registry.js';
+import { type Clock, type HttpTransport } from './device-flow.js';
+import type { TargetSessionEndpoints } from './discovery.js';
+export { LoginRequiredError } from './session-errors.js';
+export interface BrowserOpener {
+    open(url: string): Promise<void>;
+}
+export interface TargetSessionDeps {
+    readonly http: HttpTransport;
+    readonly clock: Clock;
+    readonly browserOpener: BrowserOpener;
+    readonly stderr: {
+        write(s: string): void;
+    };
+    readonly discoveryEndpoints: TargetSessionEndpoints;
+}
+export interface TargetSessionManagerInit {
+    readonly targetName: string;
+    readonly target: TargetRecord;
+    readonly credentialStore: TargetCredentialStore;
+    readonly acquireLock: () => Promise<() => Promise<void>>;
+    readonly settings: SettingsPort;
+    readonly deps: TargetSessionDeps;
+}
+/**
+ * Sole owner of one target's rotating refresh family and audience-scoped access cache.
+ * The cross-process lock covers durable reread, exchange, replacement, and invalidation.
+ */
+export declare class TargetSessionManager {
+    #private;
+    constructor(init: TargetSessionManagerInit);
+    login(signal?: AbortSignal): Promise<{
+        organization: {
+            id: string;
+        };
+    }>;
+    getAccessTokenWithLifetime(audience: string, signal?: AbortSignal): Promise<{
+        accessToken: string;
+        expiresIn: number;
+    }>;
+    getAccessToken(audience: string, signal?: AbortSignal): Promise<string>;
+    tokenProvider(audience: string): {
+        getAccessToken(signal?: AbortSignal): Promise<string>;
+    };
+    revoke(force: boolean): Promise<void>;
+    clearMemory(): void;
+}

package/lib/target/target-session-manager.js

@@ -0,0 +1,226 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TargetSessionManager = exports.LoginRequiredError = void 0;
+const refresh_exchange_js_1 = require("./refresh-exchange.js");
+const device_flow_js_1 = require("./device-flow.js");
+const credential_store_js_1 = require("./credential-store.js");
+const target_registry_js_1 = require("./target-registry.js");
+const session_errors_js_1 = require("./session-errors.js");
+var session_errors_js_2 = require("./session-errors.js");
+Object.defineProperty(exports, "LoginRequiredError", { enumerable: true, get: function () { return session_errors_js_2.LoginRequiredError; } });
+const session_verification_js_1 = require("./session-verification.js");
+const refresh_revocation_js_1 = require("./refresh-revocation.js");
+const DEVICE_LABEL = 'zeroshot-cli';
+const TOKEN_EXPIRY_SKEW_MS = 30_000;
+const AUDIENCE_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/;
+const INVALID_REFRESH_FAMILY = 'zeroshot.invalidated-refresh-family/v1';
+function abortReason(signal) {
+    return signal?.reason ?? new DOMException('Aborted', 'AbortError');
+}
+function requireAudience(audience) {
+    if (!AUDIENCE_PATTERN.test(audience))
+        throw new Error('Requested target audience is invalid');
+}
+/**
+ * Sole owner of one target's rotating refresh family and audience-scoped access cache.
+ * The cross-process lock covers durable reread, exchange, replacement, and invalidation.
+ */
+class TargetSessionManager {
+    #targetName;
+    #target;
+    #store;
+    #acquireLock;
+    #settings;
+    #deps;
+    #access = new Map();
+    constructor(init) {
+        this.#targetName = init.targetName;
+        this.#target = init.target;
+        this.#store = init.credentialStore;
+        this.#acquireLock = init.acquireLock;
+        this.#settings = init.settings;
+        this.#deps = init.deps;
+    }
+    #cachedAccess(audience) {
+        const cached = this.#access.get(audience);
+        if (cached === undefined ||
+            this.#deps.clock.now() >= cached.expiresAt - TOKEN_EXPIRY_SKEW_MS) {
+            return null;
+        }
+        return {
+            accessToken: cached.token,
+            expiresIn: Math.max(0, Math.floor((cached.expiresAt - this.#deps.clock.now()) / 1_000)),
+        };
+    }
+    async login(signal) {
+        const endpoints = this.#deps.discoveryEndpoints;
+        const code = await (0, device_flow_js_1.requestDeviceCode)(endpoints.deviceAuthorizationEndpoint, endpoints.clientId, this.#deps.http, signal);
+        this.#deps.stderr.write(`\nOpen this URL to authorize:\n  ${code.verification_uri}\n\nEnter code: ${code.user_code}\n\n`);
+        if (code.verification_uri_complete) {
+            try {
+                await this.#deps.browserOpener.open(code.verification_uri_complete);
+            }
+            catch {
+                // Opening a browser is explicitly optional; polling remains authoritative.
+            }
+        }
+        const release = await this.#acquireLock();
+        try {
+            const storedPrevious = await this.#store.get(this.#serviceKey(), credential_store_js_1.TARGET_ACCOUNT);
+            const previous = storedPrevious === INVALID_REFRESH_FAMILY ? null : storedPrevious;
+            const token = await (0, device_flow_js_1.pollForToken)({
+                tokenEndpoint: endpoints.tokenEndpoint,
+                clientId: endpoints.clientId,
+                deviceCode: code.device_code,
+                interval: code.interval,
+                expiresIn: code.expires_in,
+                http: this.#deps.http,
+                clock: this.#deps.clock,
+                ...(signal === undefined ? {} : { signal }),
+                exchange: {
+                    grantType: endpoints.deviceGrantType,
+                    deviceToken: this.#target.deviceToken,
+                    deviceLabel: DEVICE_LABEL,
+                    audience: endpoints.audience,
+                },
+            });
+            const organization = await (0, session_verification_js_1.readVerifiedOrganization)(token.access_token, signal, this.#deps).catch(async () => {
+                await this.#bestEffortRevoke(token.refresh_token);
+                throw new session_errors_js_1.LoginRequiredError(this.#targetName);
+            });
+            try {
+                await this.#store.set(this.#serviceKey(), credential_store_js_1.TARGET_ACCOUNT, token.refresh_token);
+                (0, target_registry_js_1.setTargetRefreshInvalidated)(this.#targetName, false, this.#settings);
+                this.#access.set(endpoints.audience, {
+                    token: token.access_token,
+                    expiresAt: this.#deps.clock.now() + token.expires_in * 1_000,
+                });
+                (0, target_registry_js_1.updateTargetOrganization)(this.#targetName, organization, this.#settings);
+                if (previous && previous !== token.refresh_token) {
+                    const revoked = await (0, refresh_revocation_js_1.revokeRefreshToken)(previous, this.#deps);
+                    if (!revoked.ok)
+                        throw new Error('Prior refresh family revocation failed');
+                }
+            }
+            catch {
+                await this.#invalidateFamily(token.refresh_token);
+                throw new session_errors_js_1.LoginRequiredError(this.#targetName);
+            }
+            return { organization };
+        }
+        finally {
+            await release();
+        }
+    }
+    async getAccessTokenWithLifetime(audience, signal) {
+        requireAudience(audience);
+        const cached = this.#cachedAccess(audience);
+        if (cached !== null)
+            return cached;
+        if (signal?.aborted)
+            throw abortReason(signal);
+        const release = await this.#acquireLock();
+        try {
+            const afterLock = this.#cachedAccess(audience);
+            if (afterLock !== null)
+                return afterLock;
+            if ((0, target_registry_js_1.targetRefreshIsInvalidated)(this.#targetName, this.#settings)) {
+                throw new session_errors_js_1.LoginRequiredError(this.#targetName);
+            }
+            const refreshToken = await this.#store.get(this.#serviceKey(), credential_store_js_1.TARGET_ACCOUNT);
+            if (!refreshToken || refreshToken === INVALID_REFRESH_FAMILY) {
+                throw new session_errors_js_1.LoginRequiredError(this.#targetName);
+            }
+            if (signal?.aborted)
+                throw abortReason(signal);
+            (0, target_registry_js_1.setTargetRefreshInvalidated)(this.#targetName, true, this.#settings);
+            await this.#store.set(this.#serviceKey(), credential_store_js_1.TARGET_ACCOUNT, INVALID_REFRESH_FAMILY);
+            let replacement;
+            try {
+                replacement = await (0, refresh_exchange_js_1.exchangeRefreshToken)({
+                    tokenEndpoint: this.#deps.discoveryEndpoints.tokenEndpoint,
+                    clientId: this.#deps.discoveryEndpoints.clientId,
+                    refreshToken,
+                    audience,
+                    http: this.#deps.http,
+                    ...(signal === undefined ? {} : { signal }),
+                });
+                await this.#store.set(this.#serviceKey(), credential_store_js_1.TARGET_ACCOUNT, replacement.refresh_token);
+                (0, target_registry_js_1.setTargetRefreshInvalidated)(this.#targetName, false, this.#settings);
+                this.#access.clear();
+                this.#access.set(audience, {
+                    token: replacement.access_token,
+                    expiresAt: this.#deps.clock.now() + replacement.expires_in * 1_000,
+                });
+                return { accessToken: replacement.access_token, expiresIn: replacement.expires_in };
+            }
+            catch {
+                await this.#invalidateFamily(replacement?.refresh_token);
+                throw new session_errors_js_1.LoginRequiredError(this.#targetName);
+            }
+        }
+        finally {
+            await release();
+        }
+    }
+    async getAccessToken(audience, signal) {
+        return (await this.getAccessTokenWithLifetime(audience, signal)).accessToken;
+    }
+    tokenProvider(audience) {
+        requireAudience(audience);
+        return Object.freeze({
+            getAccessToken: (signal) => this.getAccessToken(audience, signal),
+        });
+    }
+    async revoke(force) {
+        const release = await this.#acquireLock();
+        try {
+            const token = await this.#store.get(this.#serviceKey(), credential_store_js_1.TARGET_ACCOUNT);
+            if (token && token !== INVALID_REFRESH_FAMILY) {
+                try {
+                    const response = await (0, refresh_revocation_js_1.revokeRefreshToken)(token, this.#deps);
+                    if (!response.ok && !force)
+                        throw new Error('Remote revocation failed. Use --force to remove anyway.');
+                }
+                catch (error) {
+                    if (!force)
+                        throw error;
+                }
+            }
+            this.#access.clear();
+            await this.#store.delete(this.#serviceKey(), credential_store_js_1.TARGET_ACCOUNT);
+            (0, target_registry_js_1.setTargetRefreshInvalidated)(this.#targetName, false, this.#settings);
+        }
+        finally {
+            await release();
+        }
+    }
+    clearMemory() {
+        this.#access.clear();
+    }
+    async #invalidateFamily(replacement) {
+        this.#access.clear();
+        (0, target_registry_js_1.setTargetRefreshInvalidated)(this.#targetName, true, this.#settings);
+        try {
+            await this.#store.set(this.#serviceKey(), credential_store_js_1.TARGET_ACCOUNT, INVALID_REFRESH_FAMILY);
+        }
+        catch {
+            // A direct delete remains safe if overwriting the stale family was unavailable.
+        }
+        if (replacement)
+            await this.#bestEffortRevoke(replacement);
+        await this.#store.delete(this.#serviceKey(), credential_store_js_1.TARGET_ACCOUNT);
+    }
+    async #bestEffortRevoke(token) {
+        try {
+            await (0, refresh_revocation_js_1.revokeRefreshToken)(token, this.#deps);
+        }
+        catch {
+            // Revocation is compensating cleanup; callers still receive login-required.
+        }
+    }
+    #serviceKey() {
+        return (0, credential_store_js_1.targetServiceKey)(this.#target.id);
+    }
+}
+exports.TargetSessionManager = TargetSessionManager;

package/lib/target/target-session.d.ts

@@ -1,39 +1,47 @@
-import type { TargetCredentialStore } from './credential-store.ts';
-import type { TargetRecord, SettingsPort } from './target-registry.ts';
-import { type HttpTransport, type Clock } from './device-flow.ts';
-export declare class LoginRequiredError extends Error {
-    readonly targetName: string;
-    constructor(targetName: string);
-}
-export interface BrowserOpener {
-    open(url: string): Promise<void>;
-}
-export interface TargetSessionDeps {
-    readonly http: HttpTransport;
-    readonly clock: Clock;
-    readonly browserOpener: BrowserOpener;
-    readonly stderr: {
-        write(s: string): void;
-    };
-    readonly discoveryEndpoints: {
-        readonly deviceAuthorizationEndpoint: string;
-        readonly tokenEndpoint: string;
-        readonly revocationEndpoint?: string;
-        readonly clientId: string;
-    };
+import type { TargetCredentialStore } from './credential-store.js';
+import type { Clock } from './device-flow.js';
+import { type TargetSessionDeps } from './target-session-manager.js';
+import type { SettingsPort, TargetRecord } from './target-registry.js';
+export { LoginRequiredError, TargetSessionManager, type BrowserOpener, type TargetSessionDeps, type TargetSessionManagerInit, } from './target-session-manager.js';
+export interface TargetAccessTokenProvider {
+    getAccessToken(signal?: AbortSignal): Promise<string>;
 }
-export declare function targetLogin(targetName: string, target: TargetRecord, credentialStore: TargetCredentialStore, acquireLock: () => Promise<() => Promise<void>>, settings: SettingsPort, deps: TargetSessionDeps): Promise<{
+type LegacySessionDeps = Pick<TargetSessionDeps, 'http' | 'discoveryEndpoints'> & {
+    readonly settings?: SettingsPort;
+    readonly targetName?: string;
+    readonly clock?: Clock;
+};
+type TargetLoginArgs = readonly [
+    targetName: string,
+    target: TargetRecord,
+    credentialStore: TargetCredentialStore,
+    acquireLock: () => Promise<() => Promise<void>>,
+    settings: SettingsPort,
+    deps: TargetSessionDeps
+];
+type RefreshAccessArgs = readonly [
+    targetName: string,
+    target: TargetRecord,
+    credentialStore: TargetCredentialStore,
+    acquireLock: () => Promise<() => Promise<void>>,
+    deps: LegacySessionDeps,
+    clock?: Clock
+];
+type RevokeArgs = readonly [
+    target: TargetRecord,
+    credentialStore: TargetCredentialStore,
+    acquireLock: () => Promise<() => Promise<void>>,
+    deps: LegacySessionDeps,
+    force: boolean
+];
+export declare function targetLogin(...args: TargetLoginArgs): Promise<{
     organization: {
         id: string;
-        name: string;
     };
 }>;
-export declare function refreshAccessToken(targetName: string, target: TargetRecord, credentialStore: TargetCredentialStore, acquireLock: () => Promise<() => Promise<void>>, deps: Pick<TargetSessionDeps, 'http' | 'discoveryEndpoints'>): Promise<{
+export declare function refreshAccessToken(...args: RefreshAccessArgs): Promise<{
     accessToken: string;
     expiresIn: number;
 }>;
-export interface TargetAccessTokenProvider {
-    getAccessToken(signal?: AbortSignal): Promise<string>;
-}
-export declare function getAccessTokenProvider(targetName: string, target: TargetRecord, credentialStore: TargetCredentialStore, acquireLock: () => Promise<() => Promise<void>>, deps: Pick<TargetSessionDeps, 'http' | 'discoveryEndpoints'>, clock?: Clock): TargetAccessTokenProvider;
-export declare function revokeAndCleanup(target: TargetRecord, credentialStore: TargetCredentialStore, acquireLock: () => Promise<() => Promise<void>>, deps: Pick<TargetSessionDeps, 'http' | 'discoveryEndpoints'>, force: boolean): Promise<void>;
+export declare function getAccessTokenProvider(...args: RefreshAccessArgs): TargetAccessTokenProvider;
+export declare function revokeAndCleanup(...args: RevokeArgs): Promise<void>;