@the-open-engine/zeroshot 6.29.0 → 6.29.1

package/lib/target/discovery-sections.cjs

@@ -0,0 +1,191 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseAdapter = parseAdapter;
+exports.validateCachePolicy = validateCachePolicy;
+exports.parseSizes = parseSizes;
+exports.parseExtensions = parseExtensions;
+exports.validateOAuthMetadata = validateOAuthMetadata;
+exports.parseEndpoint = parseEndpoint;
+exports.parseCapsule = parseCapsule;
+exports.parseOAuth = parseOAuth;
+exports.parseSession = parseSession;
+exports.parseTransport = parseTransport;
+const discovery_errors_js_1 = require("./discovery-errors.cjs");
+const discovery_validation_js_1 = require("./discovery-validation.cjs");
+const route_template_js_1 = require("./route-template.cjs");
+function parseAdapter(discovery) {
+    const adapter = (0, discovery_validation_js_1.closedRecord)(discovery.adapter, 'adapter', ['name', 'major_version']);
+    if (!['fargate', 'docker', 'local'].includes(String(adapter.name))) {
+        throw new discovery_errors_js_1.TargetDiscoveryError('adapter.name is not supported');
+    }
+    (0, discovery_validation_js_1.exact)(adapter.major_version, 1, 'adapter.major_version');
+    return Object.freeze({
+        name: adapter.name,
+        majorVersion: 1,
+    });
+}
+function validateCachePolicy(discovery) {
+    const cache = (0, discovery_validation_js_1.closedRecord)(discovery.cache_policy, 'cache_policy', ['control', 'discovery']);
+    (0, discovery_validation_js_1.exact)(cache.control, 'no-store', 'cache_policy.control');
+    if (cache.discovery !== undefined && cache.discovery !== null &&
+        typeof cache.discovery !== 'string') {
+        throw new discovery_errors_js_1.TargetDiscoveryError('cache_policy.discovery must be a string or null');
+    }
+}
+function parseSizes(discovery) {
+    const sizes = (0, discovery_validation_js_1.closedRecord)(discovery.sizes, 'sizes', ['catalog', 'default']);
+    if (!Array.isArray(sizes.catalog) || sizes.catalog.length === 0 ||
+        new Set(sizes.catalog).size !== sizes.catalog.length ||
+        sizes.catalog.some((size) => !['tiny', 'small', 'standard', 'large'].includes(String(size)))) {
+        throw new discovery_errors_js_1.TargetDiscoveryError('sizes.catalog contains an unsupported size');
+    }
+    if (!sizes.catalog.includes(sizes.default)) {
+        throw new discovery_errors_js_1.TargetDiscoveryError('sizes.default is not in sizes.catalog');
+    }
+    return Object.freeze({
+        catalog: Object.freeze([...sizes.catalog]),
+        default: sizes.default,
+    });
+}
+function parseExtensions(discovery, origin) {
+    if (discovery.extensions === undefined || discovery.extensions === null)
+        return null;
+    const extensions = (0, discovery_validation_js_1.closedRecord)(discovery.extensions, 'extensions', [
+        'connections', 'credential_install',
+    ]);
+    if (extensions.connections === undefined) {
+        throw new discovery_errors_js_1.TargetDiscoveryError('extensions.connections is required');
+    }
+    const connections = (0, discovery_validation_js_1.closedRecord)(extensions.connections, 'extensions.connections', [
+        'kind', 'base_url', 'route_templates',
+    ]);
+    (0, discovery_validation_js_1.exact)(connections.kind, 'zerocloud.connections/v1', 'extensions.connections.kind');
+    (0, discovery_validation_js_1.sameOriginUrl)(connections.base_url, 'extensions.connections.base_url', origin);
+    const routes = (0, discovery_validation_js_1.closedRecord)(connections.route_templates, 'extensions.connections.route_templates', [
+        'list', 'create', 'update',
+    ]);
+    (0, route_template_js_1.routeTemplate)(routes.list, 'extensions.connections.route_templates.list', []);
+    (0, route_template_js_1.routeTemplate)(routes.create, 'extensions.connections.route_templates.create', []);
+    (0, route_template_js_1.routeTemplate)(routes.update, 'extensions.connections.route_templates.update', ['connection_id']);
+    return (0, discovery_validation_js_1.parseCredentialInstall)(extensions.credential_install);
+}
+function validateOAuthMetadata(metadata, origin, expected) {
+    const device = (0, discovery_validation_js_1.sameOriginUrl)(metadata.device_authorization_endpoint, 'OAuth metadata device_authorization_endpoint', origin);
+    const token = (0, discovery_validation_js_1.sameOriginUrl)(metadata.token_endpoint, 'OAuth metadata token_endpoint', origin);
+    const revoke = (0, discovery_validation_js_1.sameOriginUrl)(metadata.revocation_endpoint, 'OAuth metadata revocation_endpoint', origin);
+    if (device !== expected[0] || token !== expected[1] || revoke !== expected[2]) {
+        throw new discovery_errors_js_1.TargetDiscoveryError('OAuth metadata does not match hosted-target discovery');
+    }
+}
+function parseEndpoint(discovery, origin) {
+    const protocol = (0, discovery_validation_js_1.closedRecord)(discovery.protocol, 'protocol', ['name', 'major_version']);
+    (0, discovery_validation_js_1.exact)(protocol.name, 'openengine.cluster/v1', 'protocol.name');
+    (0, discovery_validation_js_1.exact)(protocol.major_version, 1, 'protocol.major_version');
+    const binding = (0, discovery_validation_js_1.closedRecord)(discovery.binding, 'binding', ['scope', 'auth_location']);
+    (0, discovery_validation_js_1.exact)(binding.scope, 'organization', 'binding.scope');
+    (0, discovery_validation_js_1.exact)(binding.auth_location, 'authorization_header', 'binding.auth_location');
+    const endpoint = (0, discovery_validation_js_1.closedRecord)(discovery.endpoint, 'endpoint', ['url', 'capabilities']);
+    const capabilities = (0, discovery_validation_js_1.exactStringSet)(endpoint.capabilities, 'endpoint.capabilities', ['exec', 'log_stream']);
+    const pagination = (0, discovery_validation_js_1.closedRecord)(discovery.pagination, 'pagination', [
+        'default_page_size',
+        'max_page_size',
+    ]);
+    const defaultPageSize = (0, discovery_validation_js_1.integer)(pagination.default_page_size, 'pagination.default_page_size', 1);
+    const maxPageSize = (0, discovery_validation_js_1.integer)(pagination.max_page_size, 'pagination.max_page_size', 1);
+    if (defaultPageSize > maxPageSize) {
+        throw new discovery_errors_js_1.TargetDiscoveryError('pagination.default_page_size exceeds maximum');
+    }
+    validateCachePolicy(discovery);
+    const schemaLinks = (0, discovery_validation_js_1.closedRecord)(discovery.schema_links, 'schema_links', [
+        'self',
+        'problem',
+        'errors',
+    ]);
+    (0, discovery_validation_js_1.sameOriginUrl)(schemaLinks.self, 'schema_links.self', origin);
+    (0, discovery_validation_js_1.sameOriginUrl)(schemaLinks.problem, 'schema_links.problem', origin);
+    (0, discovery_validation_js_1.sameOriginUrl)(schemaLinks.errors, 'schema_links.errors', origin);
+    return Object.freeze({
+        url: (0, discovery_validation_js_1.sameOriginUrl)(endpoint.url, 'endpoint.url', origin),
+        capabilities,
+        pagination: Object.freeze({ defaultPageSize, maxPageSize }),
+    });
+}
+function parseCapsule(discovery, origin) {
+    const capsule = (0, discovery_validation_js_1.closedRecord)(discovery.capsule_protocol, 'capsule_protocol', [
+        'name',
+        'major_version',
+        'base_url',
+        'route_templates',
+    ]);
+    (0, discovery_validation_js_1.exact)(capsule.name, 'openengine.capsules/v1', 'capsule_protocol.name');
+    (0, discovery_validation_js_1.exact)(capsule.major_version, 1, 'capsule_protocol.major_version');
+    const routes = (0, discovery_validation_js_1.closedRecord)(capsule.route_templates, 'capsule_protocol.route_templates', ['allocate', 'list', 'inspect', 'terminate', 'limits', 'access']);
+    const route = (name, variables) => (0, route_template_js_1.routeTemplate)(routes[name], `capsule_protocol.route_templates.${name}`, variables);
+    return Object.freeze({
+        baseUrl: (0, discovery_validation_js_1.sameOriginUrl)(capsule.base_url, 'capsule_protocol.base_url', origin),
+        routes: Object.freeze({
+            allocate: route('allocate', ['org_id']),
+            list: route('list', ['org_id', 'cursor', 'limit']),
+            inspect: route('inspect', ['org_id', 'capsule_id']),
+            terminate: route('terminate', ['org_id', 'capsule_id']),
+            limits: route('limits', ['org_id']),
+            access: route('access', ['capsule_id']),
+        }),
+    });
+}
+function parseOAuth(discovery, origin) {
+    const oauth = (0, discovery_validation_js_1.closedRecord)(discovery.oauth, 'oauth', [
+        'metadata_url',
+        'device_authorization_endpoint',
+        'token_endpoint',
+        'revocation_endpoint',
+        'client_id',
+        'device_grant_type',
+        'device_exchange_fields',
+        'audience',
+    ]);
+    (0, discovery_validation_js_1.exact)(oauth.device_grant_type, 'urn:ietf:params:oauth:grant-type:device_code', 'oauth.device_grant_type');
+    (0, discovery_validation_js_1.exactStringSet)(oauth.device_exchange_fields, 'oauth.device_exchange_fields', ['device_token', 'device_label']);
+    (0, discovery_validation_js_1.exact)(oauth.audience, 'capsule', 'oauth.audience');
+    return Object.freeze({
+        metadataUrl: (0, discovery_validation_js_1.sameOriginUrl)(oauth.metadata_url, 'oauth.metadata_url', origin),
+        deviceAuthorizationEndpoint: (0, discovery_validation_js_1.sameOriginUrl)(oauth.device_authorization_endpoint, 'oauth.device_authorization_endpoint', origin),
+        tokenEndpoint: (0, discovery_validation_js_1.sameOriginUrl)(oauth.token_endpoint, 'oauth.token_endpoint', origin),
+        revocationEndpoint: (0, discovery_validation_js_1.sameOriginUrl)(oauth.revocation_endpoint, 'oauth.revocation_endpoint', origin),
+        clientId: (0, discovery_validation_js_1.stringField)(oauth, 'client_id', 'oauth.'),
+        deviceGrantType: 'urn:ietf:params:oauth:grant-type:device_code',
+        audience: 'capsule',
+    });
+}
+function parseSession(discovery) {
+    const session = (0, discovery_validation_js_1.closedRecord)(discovery.session, 'session', [
+        'route_template',
+        'method',
+        'cache_policy',
+    ]);
+    (0, discovery_validation_js_1.exact)(session.method, 'GET', 'session.method');
+    (0, discovery_validation_js_1.exact)(session.cache_policy, 'no-store', 'session.cache_policy');
+    return Object.freeze({
+        routeTemplate: (0, route_template_js_1.routeTemplate)(session.route_template, 'session.route_template', []),
+        method: 'GET',
+    });
+}
+function parseTransport(discovery) {
+    const transport = (0, discovery_validation_js_1.closedRecord)(discovery.transport, 'transport', [
+        'websocket_route_template',
+        'unauthorized_status',
+        'close_codes',
+    ]);
+    (0, discovery_validation_js_1.exact)(transport.unauthorized_status, 401, 'transport.unauthorized_status');
+    const closeCodes = (0, discovery_validation_js_1.closedRecord)(transport.close_codes, 'transport.close_codes', [
+        'expired',
+        'revoked',
+    ]);
+    (0, discovery_validation_js_1.exact)(closeCodes.expired, 4401, 'transport.close_codes.expired');
+    (0, discovery_validation_js_1.exact)(closeCodes.revoked, 4403, 'transport.close_codes.revoked');
+    return Object.freeze({
+        websocketRouteTemplate: (0, route_template_js_1.routeTemplate)(transport.websocket_route_template, 'transport.websocket_route_template', ['capsule_id']),
+        unauthorizedStatus: 401,
+        closeCodes: Object.freeze({ expired: 4401, revoked: 4403 }),
+    });
+}

package/lib/target/discovery-sections.d.cts

@@ -0,0 +1,52 @@
+import { type CredentialInstallDescriptor } from './discovery-validation.js';
+export declare function parseAdapter(discovery: Record<string, unknown>): {
+    readonly name: 'fargate' | 'docker' | 'local';
+    readonly majorVersion: 1;
+};
+export declare function validateCachePolicy(discovery: Record<string, unknown>): void;
+export declare function parseSizes(discovery: Record<string, unknown>): {
+    readonly catalog: readonly ('tiny' | 'small' | 'standard' | 'large')[];
+    readonly default: 'tiny' | 'small' | 'standard' | 'large';
+};
+export declare function parseExtensions(discovery: Record<string, unknown>, origin: string): CredentialInstallDescriptor | null;
+export declare function validateOAuthMetadata(metadata: Record<string, unknown>, origin: string, expected: readonly [string, string, string]): void;
+export declare function parseEndpoint(discovery: Record<string, unknown>, origin: string): Readonly<{
+    url: string;
+    capabilities: readonly ["exec", "log_stream"];
+    pagination: Readonly<{
+        defaultPageSize: number;
+        maxPageSize: number;
+    }>;
+}>;
+export declare function parseCapsule(discovery: Record<string, unknown>, origin: string): Readonly<{
+    baseUrl: string;
+    routes: Readonly<{
+        allocate: import("./route-template.js").RouteTemplate;
+        list: import("./route-template.js").RouteTemplate;
+        inspect: import("./route-template.js").RouteTemplate;
+        terminate: import("./route-template.js").RouteTemplate;
+        limits: import("./route-template.js").RouteTemplate;
+        access: import("./route-template.js").RouteTemplate;
+    }>;
+}>;
+export declare function parseOAuth(discovery: Record<string, unknown>, origin: string): Readonly<{
+    metadataUrl: string;
+    deviceAuthorizationEndpoint: string;
+    tokenEndpoint: string;
+    revocationEndpoint: string;
+    clientId: string;
+    deviceGrantType: "urn:ietf:params:oauth:grant-type:device_code";
+    audience: "capsule";
+}>;
+export declare function parseSession(discovery: Record<string, unknown>): Readonly<{
+    routeTemplate: import("./route-template.js").RouteTemplate;
+    method: "GET";
+}>;
+export declare function parseTransport(discovery: Record<string, unknown>): Readonly<{
+    websocketRouteTemplate: import("./route-template.js").RouteTemplate;
+    unauthorizedStatus: 401;
+    closeCodes: Readonly<{
+        expired: 4401;
+        revoked: 4403;
+    }>;
+}>;

package/lib/target/discovery-sections.d.mts

@@ -0,0 +1,52 @@
+import { type CredentialInstallDescriptor } from './discovery-validation.js';
+export declare function parseAdapter(discovery: Record<string, unknown>): {
+    readonly name: 'fargate' | 'docker' | 'local';
+    readonly majorVersion: 1;
+};
+export declare function validateCachePolicy(discovery: Record<string, unknown>): void;
+export declare function parseSizes(discovery: Record<string, unknown>): {
+    readonly catalog: readonly ('tiny' | 'small' | 'standard' | 'large')[];
+    readonly default: 'tiny' | 'small' | 'standard' | 'large';
+};
+export declare function parseExtensions(discovery: Record<string, unknown>, origin: string): CredentialInstallDescriptor | null;
+export declare function validateOAuthMetadata(metadata: Record<string, unknown>, origin: string, expected: readonly [string, string, string]): void;
+export declare function parseEndpoint(discovery: Record<string, unknown>, origin: string): Readonly<{
+    url: string;
+    capabilities: readonly ["exec", "log_stream"];
+    pagination: Readonly<{
+        defaultPageSize: number;
+        maxPageSize: number;
+    }>;
+}>;
+export declare function parseCapsule(discovery: Record<string, unknown>, origin: string): Readonly<{
+    baseUrl: string;
+    routes: Readonly<{
+        allocate: import("./route-template.js").RouteTemplate;
+        list: import("./route-template.js").RouteTemplate;
+        inspect: import("./route-template.js").RouteTemplate;
+        terminate: import("./route-template.js").RouteTemplate;
+        limits: import("./route-template.js").RouteTemplate;
+        access: import("./route-template.js").RouteTemplate;
+    }>;
+}>;
+export declare function parseOAuth(discovery: Record<string, unknown>, origin: string): Readonly<{
+    metadataUrl: string;
+    deviceAuthorizationEndpoint: string;
+    tokenEndpoint: string;
+    revocationEndpoint: string;
+    clientId: string;
+    deviceGrantType: "urn:ietf:params:oauth:grant-type:device_code";
+    audience: "capsule";
+}>;
+export declare function parseSession(discovery: Record<string, unknown>): Readonly<{
+    routeTemplate: import("./route-template.js").RouteTemplate;
+    method: "GET";
+}>;
+export declare function parseTransport(discovery: Record<string, unknown>): Readonly<{
+    websocketRouteTemplate: import("./route-template.js").RouteTemplate;
+    unauthorizedStatus: 401;
+    closeCodes: Readonly<{
+        expired: 4401;
+        revoked: 4403;
+    }>;
+}>;

package/lib/target/discovery-sections.d.ts

@@ -0,0 +1,52 @@
+import { type CredentialInstallDescriptor } from './discovery-validation.js';
+export declare function parseAdapter(discovery: Record<string, unknown>): {
+    readonly name: 'fargate' | 'docker' | 'local';
+    readonly majorVersion: 1;
+};
+export declare function validateCachePolicy(discovery: Record<string, unknown>): void;
+export declare function parseSizes(discovery: Record<string, unknown>): {
+    readonly catalog: readonly ('tiny' | 'small' | 'standard' | 'large')[];
+    readonly default: 'tiny' | 'small' | 'standard' | 'large';
+};
+export declare function parseExtensions(discovery: Record<string, unknown>, origin: string): CredentialInstallDescriptor | null;
+export declare function validateOAuthMetadata(metadata: Record<string, unknown>, origin: string, expected: readonly [string, string, string]): void;
+export declare function parseEndpoint(discovery: Record<string, unknown>, origin: string): Readonly<{
+    url: string;
+    capabilities: readonly ["exec", "log_stream"];
+    pagination: Readonly<{
+        defaultPageSize: number;
+        maxPageSize: number;
+    }>;
+}>;
+export declare function parseCapsule(discovery: Record<string, unknown>, origin: string): Readonly<{
+    baseUrl: string;
+    routes: Readonly<{
+        allocate: import("./route-template.js").RouteTemplate;
+        list: import("./route-template.js").RouteTemplate;
+        inspect: import("./route-template.js").RouteTemplate;
+        terminate: import("./route-template.js").RouteTemplate;
+        limits: import("./route-template.js").RouteTemplate;
+        access: import("./route-template.js").RouteTemplate;
+    }>;
+}>;
+export declare function parseOAuth(discovery: Record<string, unknown>, origin: string): Readonly<{
+    metadataUrl: string;
+    deviceAuthorizationEndpoint: string;
+    tokenEndpoint: string;
+    revocationEndpoint: string;
+    clientId: string;
+    deviceGrantType: "urn:ietf:params:oauth:grant-type:device_code";
+    audience: "capsule";
+}>;
+export declare function parseSession(discovery: Record<string, unknown>): Readonly<{
+    routeTemplate: import("./route-template.js").RouteTemplate;
+    method: "GET";
+}>;
+export declare function parseTransport(discovery: Record<string, unknown>): Readonly<{
+    websocketRouteTemplate: import("./route-template.js").RouteTemplate;
+    unauthorizedStatus: 401;
+    closeCodes: Readonly<{
+        expired: 4401;
+        revoked: 4403;
+    }>;
+}>;

package/lib/target/discovery-sections.js

@@ -0,0 +1,191 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseAdapter = parseAdapter;
+exports.validateCachePolicy = validateCachePolicy;
+exports.parseSizes = parseSizes;
+exports.parseExtensions = parseExtensions;
+exports.validateOAuthMetadata = validateOAuthMetadata;
+exports.parseEndpoint = parseEndpoint;
+exports.parseCapsule = parseCapsule;
+exports.parseOAuth = parseOAuth;
+exports.parseSession = parseSession;
+exports.parseTransport = parseTransport;
+const discovery_errors_js_1 = require("./discovery-errors.js");
+const discovery_validation_js_1 = require("./discovery-validation.js");
+const route_template_js_1 = require("./route-template.js");
+function parseAdapter(discovery) {
+    const adapter = (0, discovery_validation_js_1.closedRecord)(discovery.adapter, 'adapter', ['name', 'major_version']);
+    if (!['fargate', 'docker', 'local'].includes(String(adapter.name))) {
+        throw new discovery_errors_js_1.TargetDiscoveryError('adapter.name is not supported');
+    }
+    (0, discovery_validation_js_1.exact)(adapter.major_version, 1, 'adapter.major_version');
+    return Object.freeze({
+        name: adapter.name,
+        majorVersion: 1,
+    });
+}
+function validateCachePolicy(discovery) {
+    const cache = (0, discovery_validation_js_1.closedRecord)(discovery.cache_policy, 'cache_policy', ['control', 'discovery']);
+    (0, discovery_validation_js_1.exact)(cache.control, 'no-store', 'cache_policy.control');
+    if (cache.discovery !== undefined && cache.discovery !== null &&
+        typeof cache.discovery !== 'string') {
+        throw new discovery_errors_js_1.TargetDiscoveryError('cache_policy.discovery must be a string or null');
+    }
+}
+function parseSizes(discovery) {
+    const sizes = (0, discovery_validation_js_1.closedRecord)(discovery.sizes, 'sizes', ['catalog', 'default']);
+    if (!Array.isArray(sizes.catalog) || sizes.catalog.length === 0 ||
+        new Set(sizes.catalog).size !== sizes.catalog.length ||
+        sizes.catalog.some((size) => !['tiny', 'small', 'standard', 'large'].includes(String(size)))) {
+        throw new discovery_errors_js_1.TargetDiscoveryError('sizes.catalog contains an unsupported size');
+    }
+    if (!sizes.catalog.includes(sizes.default)) {
+        throw new discovery_errors_js_1.TargetDiscoveryError('sizes.default is not in sizes.catalog');
+    }
+    return Object.freeze({
+        catalog: Object.freeze([...sizes.catalog]),
+        default: sizes.default,
+    });
+}
+function parseExtensions(discovery, origin) {
+    if (discovery.extensions === undefined || discovery.extensions === null)
+        return null;
+    const extensions = (0, discovery_validation_js_1.closedRecord)(discovery.extensions, 'extensions', [
+        'connections', 'credential_install',
+    ]);
+    if (extensions.connections === undefined) {
+        throw new discovery_errors_js_1.TargetDiscoveryError('extensions.connections is required');
+    }
+    const connections = (0, discovery_validation_js_1.closedRecord)(extensions.connections, 'extensions.connections', [
+        'kind', 'base_url', 'route_templates',
+    ]);
+    (0, discovery_validation_js_1.exact)(connections.kind, 'zerocloud.connections/v1', 'extensions.connections.kind');
+    (0, discovery_validation_js_1.sameOriginUrl)(connections.base_url, 'extensions.connections.base_url', origin);
+    const routes = (0, discovery_validation_js_1.closedRecord)(connections.route_templates, 'extensions.connections.route_templates', [
+        'list', 'create', 'update',
+    ]);
+    (0, route_template_js_1.routeTemplate)(routes.list, 'extensions.connections.route_templates.list', []);
+    (0, route_template_js_1.routeTemplate)(routes.create, 'extensions.connections.route_templates.create', []);
+    (0, route_template_js_1.routeTemplate)(routes.update, 'extensions.connections.route_templates.update', ['connection_id']);
+    return (0, discovery_validation_js_1.parseCredentialInstall)(extensions.credential_install);
+}
+function validateOAuthMetadata(metadata, origin, expected) {
+    const device = (0, discovery_validation_js_1.sameOriginUrl)(metadata.device_authorization_endpoint, 'OAuth metadata device_authorization_endpoint', origin);
+    const token = (0, discovery_validation_js_1.sameOriginUrl)(metadata.token_endpoint, 'OAuth metadata token_endpoint', origin);
+    const revoke = (0, discovery_validation_js_1.sameOriginUrl)(metadata.revocation_endpoint, 'OAuth metadata revocation_endpoint', origin);
+    if (device !== expected[0] || token !== expected[1] || revoke !== expected[2]) {
+        throw new discovery_errors_js_1.TargetDiscoveryError('OAuth metadata does not match hosted-target discovery');
+    }
+}
+function parseEndpoint(discovery, origin) {
+    const protocol = (0, discovery_validation_js_1.closedRecord)(discovery.protocol, 'protocol', ['name', 'major_version']);
+    (0, discovery_validation_js_1.exact)(protocol.name, 'openengine.cluster/v1', 'protocol.name');
+    (0, discovery_validation_js_1.exact)(protocol.major_version, 1, 'protocol.major_version');
+    const binding = (0, discovery_validation_js_1.closedRecord)(discovery.binding, 'binding', ['scope', 'auth_location']);
+    (0, discovery_validation_js_1.exact)(binding.scope, 'organization', 'binding.scope');
+    (0, discovery_validation_js_1.exact)(binding.auth_location, 'authorization_header', 'binding.auth_location');
+    const endpoint = (0, discovery_validation_js_1.closedRecord)(discovery.endpoint, 'endpoint', ['url', 'capabilities']);
+    const capabilities = (0, discovery_validation_js_1.exactStringSet)(endpoint.capabilities, 'endpoint.capabilities', ['exec', 'log_stream']);
+    const pagination = (0, discovery_validation_js_1.closedRecord)(discovery.pagination, 'pagination', [
+        'default_page_size',
+        'max_page_size',
+    ]);
+    const defaultPageSize = (0, discovery_validation_js_1.integer)(pagination.default_page_size, 'pagination.default_page_size', 1);
+    const maxPageSize = (0, discovery_validation_js_1.integer)(pagination.max_page_size, 'pagination.max_page_size', 1);
+    if (defaultPageSize > maxPageSize) {
+        throw new discovery_errors_js_1.TargetDiscoveryError('pagination.default_page_size exceeds maximum');
+    }
+    validateCachePolicy(discovery);
+    const schemaLinks = (0, discovery_validation_js_1.closedRecord)(discovery.schema_links, 'schema_links', [
+        'self',
+        'problem',
+        'errors',
+    ]);
+    (0, discovery_validation_js_1.sameOriginUrl)(schemaLinks.self, 'schema_links.self', origin);
+    (0, discovery_validation_js_1.sameOriginUrl)(schemaLinks.problem, 'schema_links.problem', origin);
+    (0, discovery_validation_js_1.sameOriginUrl)(schemaLinks.errors, 'schema_links.errors', origin);
+    return Object.freeze({
+        url: (0, discovery_validation_js_1.sameOriginUrl)(endpoint.url, 'endpoint.url', origin),
+        capabilities,
+        pagination: Object.freeze({ defaultPageSize, maxPageSize }),
+    });
+}
+function parseCapsule(discovery, origin) {
+    const capsule = (0, discovery_validation_js_1.closedRecord)(discovery.capsule_protocol, 'capsule_protocol', [
+        'name',
+        'major_version',
+        'base_url',
+        'route_templates',
+    ]);
+    (0, discovery_validation_js_1.exact)(capsule.name, 'openengine.capsules/v1', 'capsule_protocol.name');
+    (0, discovery_validation_js_1.exact)(capsule.major_version, 1, 'capsule_protocol.major_version');
+    const routes = (0, discovery_validation_js_1.closedRecord)(capsule.route_templates, 'capsule_protocol.route_templates', ['allocate', 'list', 'inspect', 'terminate', 'limits', 'access']);
+    const route = (name, variables) => (0, route_template_js_1.routeTemplate)(routes[name], `capsule_protocol.route_templates.${name}`, variables);
+    return Object.freeze({
+        baseUrl: (0, discovery_validation_js_1.sameOriginUrl)(capsule.base_url, 'capsule_protocol.base_url', origin),
+        routes: Object.freeze({
+            allocate: route('allocate', ['org_id']),
+            list: route('list', ['org_id', 'cursor', 'limit']),
+            inspect: route('inspect', ['org_id', 'capsule_id']),
+            terminate: route('terminate', ['org_id', 'capsule_id']),
+            limits: route('limits', ['org_id']),
+            access: route('access', ['capsule_id']),
+        }),
+    });
+}
+function parseOAuth(discovery, origin) {
+    const oauth = (0, discovery_validation_js_1.closedRecord)(discovery.oauth, 'oauth', [
+        'metadata_url',
+        'device_authorization_endpoint',
+        'token_endpoint',
+        'revocation_endpoint',
+        'client_id',
+        'device_grant_type',
+        'device_exchange_fields',
+        'audience',
+    ]);
+    (0, discovery_validation_js_1.exact)(oauth.device_grant_type, 'urn:ietf:params:oauth:grant-type:device_code', 'oauth.device_grant_type');
+    (0, discovery_validation_js_1.exactStringSet)(oauth.device_exchange_fields, 'oauth.device_exchange_fields', ['device_token', 'device_label']);
+    (0, discovery_validation_js_1.exact)(oauth.audience, 'capsule', 'oauth.audience');
+    return Object.freeze({
+        metadataUrl: (0, discovery_validation_js_1.sameOriginUrl)(oauth.metadata_url, 'oauth.metadata_url', origin),
+        deviceAuthorizationEndpoint: (0, discovery_validation_js_1.sameOriginUrl)(oauth.device_authorization_endpoint, 'oauth.device_authorization_endpoint', origin),
+        tokenEndpoint: (0, discovery_validation_js_1.sameOriginUrl)(oauth.token_endpoint, 'oauth.token_endpoint', origin),
+        revocationEndpoint: (0, discovery_validation_js_1.sameOriginUrl)(oauth.revocation_endpoint, 'oauth.revocation_endpoint', origin),
+        clientId: (0, discovery_validation_js_1.stringField)(oauth, 'client_id', 'oauth.'),
+        deviceGrantType: 'urn:ietf:params:oauth:grant-type:device_code',
+        audience: 'capsule',
+    });
+}
+function parseSession(discovery) {
+    const session = (0, discovery_validation_js_1.closedRecord)(discovery.session, 'session', [
+        'route_template',
+        'method',
+        'cache_policy',
+    ]);
+    (0, discovery_validation_js_1.exact)(session.method, 'GET', 'session.method');
+    (0, discovery_validation_js_1.exact)(session.cache_policy, 'no-store', 'session.cache_policy');
+    return Object.freeze({
+        routeTemplate: (0, route_template_js_1.routeTemplate)(session.route_template, 'session.route_template', []),
+        method: 'GET',
+    });
+}
+function parseTransport(discovery) {
+    const transport = (0, discovery_validation_js_1.closedRecord)(discovery.transport, 'transport', [
+        'websocket_route_template',
+        'unauthorized_status',
+        'close_codes',
+    ]);
+    (0, discovery_validation_js_1.exact)(transport.unauthorized_status, 401, 'transport.unauthorized_status');
+    const closeCodes = (0, discovery_validation_js_1.closedRecord)(transport.close_codes, 'transport.close_codes', [
+        'expired',
+        'revoked',
+    ]);
+    (0, discovery_validation_js_1.exact)(closeCodes.expired, 4401, 'transport.close_codes.expired');
+    (0, discovery_validation_js_1.exact)(closeCodes.revoked, 4403, 'transport.close_codes.revoked');
+    return Object.freeze({
+        websocketRouteTemplate: (0, route_template_js_1.routeTemplate)(transport.websocket_route_template, 'transport.websocket_route_template', ['capsule_id']),
+        unauthorizedStatus: 401,
+        closeCodes: Object.freeze({ expired: 4401, revoked: 4403 }),
+    });
+}