@the-open-engine/zeroshot 6.35.2 → 6.36.0

package/lib/target/discovery-validation.cjs

@@ -7,9 +7,7 @@ exports.exact = exact;
 exports.integer = integer;
 exports.exactStringSet = exactStringSet;
 exports.sameOriginUrl = sameOriginUrl;
-exports.parseCredentialInstall = parseCredentialInstall;
 const discovery_errors_js_1 = require("./discovery-errors.cjs");
-const route_template_js_1 = require("./route-template.cjs");
 function record(value, field) {
     if (value === null || typeof value !== 'object' || Array.isArray(value)) {
         throw new discovery_errors_js_1.TargetDiscoveryError(`${field} must be an object`);
@@ -44,19 +42,20 @@ function exactStringSet(value, field, expected) {
     if (!Array.isArray(value) || value.some((item) => typeof item !== 'string')) {
         throw new discovery_errors_js_1.TargetDiscoveryError(`${field} must be an array of strings`);
     }
-    if (value.length !== expected.length || new Set(value).size !== value.length ||
+    if (value.length !== expected.length ||
+        new Set(value).size !== value.length ||
         expected.some((item) => !value.includes(item))) {
         throw new discovery_errors_js_1.TargetDiscoveryError(`${field} does not match the supported contract`);
     }
     return Object.freeze([...value]);
 }
 function hasForbiddenUrlComponent(url, value, protocols) {
-    return !protocols.includes(url.protocol) ||
+    return (!protocols.includes(url.protocol) ||
         url.username !== '' ||
         url.password !== '' ||
         url.search !== '' ||
         url.hash !== '' ||
-        url.href !== value;
+        url.href !== value);
 }
 function sameOriginUrl(value, field, origin, protocols = ['https:', 'http:']) {
     if (typeof value !== 'string' || /[\u0000-\u0020\u007f]|\s/u.test(value)) {
@@ -77,26 +76,3 @@ function sameOriginUrl(value, field, origin, protocols = ['https:', 'http:']) {
     }
     return url.href;
 }
-function parseCredentialInstall(value) {
-    if (value === undefined || value === null)
-        return null;
-    const extension = closedRecord(value, 'extensions.credential_install', [
-        'kind',
-        'install',
-        'max_body_bytes',
-    ]);
-    exact(extension.kind, 'openengine.capsule-credential-install/v1', 'extensions.credential_install.kind');
-    const install = closedRecord(extension.install, 'extensions.credential_install.install', [
-        'route_template',
-        'method',
-    ]);
-    exact(install.method, 'PUT', 'extensions.credential_install.install.method');
-    return Object.freeze({
-        kind: 'openengine.capsule-credential-install/v1',
-        install: Object.freeze({
-            routeTemplate: (0, route_template_js_1.routeTemplate)(install.route_template, 'extensions.credential_install.install.route_template', ['capsule_id']),
-            method: 'PUT',
-        }),
-        maxBodyBytes: integer(extension.max_body_bytes, 'extensions.credential_install.max_body_bytes', 1, 4 * 1024 * 1024),
-    });
-}

package/lib/target/discovery-validation.d.cts

@@ -1,12 +1,3 @@
-import { type RouteTemplate } from './route-template.js';
-export interface CredentialInstallDescriptor {
-    readonly kind: 'openengine.capsule-credential-install/v1';
-    readonly install: {
-        readonly routeTemplate: RouteTemplate;
-        readonly method: 'PUT';
-    };
-    readonly maxBodyBytes: number;
-}
 export declare function record(value: unknown, field: string): Record<string, unknown>;
 export declare function closedRecord(value: unknown, field: string, fields: readonly string[]): Record<string, unknown>;
 export declare function stringField(source: Record<string, unknown>, field: string, parent?: string): string;
@@ -14,4 +5,3 @@ export declare function exact(value: unknown, expected: unknown, field: string):
 export declare function integer(value: unknown, field: string, min: number, max?: number): number;
 export declare function exactStringSet(value: unknown, field: string, expected: readonly string[]): readonly string[];
 export declare function sameOriginUrl(value: unknown, field: string, origin: string, protocols?: readonly string[]): string;
-export declare function parseCredentialInstall(value: unknown): CredentialInstallDescriptor | null;

package/lib/target/discovery-validation.d.mts

@@ -1,12 +1,3 @@
-import { type RouteTemplate } from './route-template.js';
-export interface CredentialInstallDescriptor {
-    readonly kind: 'openengine.capsule-credential-install/v1';
-    readonly install: {
-        readonly routeTemplate: RouteTemplate;
-        readonly method: 'PUT';
-    };
-    readonly maxBodyBytes: number;
-}
 export declare function record(value: unknown, field: string): Record<string, unknown>;
 export declare function closedRecord(value: unknown, field: string, fields: readonly string[]): Record<string, unknown>;
 export declare function stringField(source: Record<string, unknown>, field: string, parent?: string): string;
@@ -14,4 +5,3 @@ export declare function exact(value: unknown, expected: unknown, field: string):
 export declare function integer(value: unknown, field: string, min: number, max?: number): number;
 export declare function exactStringSet(value: unknown, field: string, expected: readonly string[]): readonly string[];
 export declare function sameOriginUrl(value: unknown, field: string, origin: string, protocols?: readonly string[]): string;
-export declare function parseCredentialInstall(value: unknown): CredentialInstallDescriptor | null;

package/lib/target/discovery-validation.d.ts

@@ -1,12 +1,3 @@
-import { type RouteTemplate } from './route-template.js';
-export interface CredentialInstallDescriptor {
-    readonly kind: 'openengine.capsule-credential-install/v1';
-    readonly install: {
-        readonly routeTemplate: RouteTemplate;
-        readonly method: 'PUT';
-    };
-    readonly maxBodyBytes: number;
-}
 export declare function record(value: unknown, field: string): Record<string, unknown>;
 export declare function closedRecord(value: unknown, field: string, fields: readonly string[]): Record<string, unknown>;
 export declare function stringField(source: Record<string, unknown>, field: string, parent?: string): string;
@@ -14,4 +5,3 @@ export declare function exact(value: unknown, expected: unknown, field: string):
 export declare function integer(value: unknown, field: string, min: number, max?: number): number;
 export declare function exactStringSet(value: unknown, field: string, expected: readonly string[]): readonly string[];
 export declare function sameOriginUrl(value: unknown, field: string, origin: string, protocols?: readonly string[]): string;
-export declare function parseCredentialInstall(value: unknown): CredentialInstallDescriptor | null;

package/lib/target/discovery-validation.js

@@ -7,9 +7,7 @@ exports.exact = exact;
 exports.integer = integer;
 exports.exactStringSet = exactStringSet;
 exports.sameOriginUrl = sameOriginUrl;
-exports.parseCredentialInstall = parseCredentialInstall;
 const discovery_errors_js_1 = require("./discovery-errors.js");
-const route_template_js_1 = require("./route-template.js");
 function record(value, field) {
     if (value === null || typeof value !== 'object' || Array.isArray(value)) {
         throw new discovery_errors_js_1.TargetDiscoveryError(`${field} must be an object`);
@@ -44,19 +42,20 @@ function exactStringSet(value, field, expected) {
     if (!Array.isArray(value) || value.some((item) => typeof item !== 'string')) {
         throw new discovery_errors_js_1.TargetDiscoveryError(`${field} must be an array of strings`);
     }
-    if (value.length !== expected.length || new Set(value).size !== value.length ||
+    if (value.length !== expected.length ||
+        new Set(value).size !== value.length ||
         expected.some((item) => !value.includes(item))) {
         throw new discovery_errors_js_1.TargetDiscoveryError(`${field} does not match the supported contract`);
     }
     return Object.freeze([...value]);
 }
 function hasForbiddenUrlComponent(url, value, protocols) {
-    return !protocols.includes(url.protocol) ||
+    return (!protocols.includes(url.protocol) ||
         url.username !== '' ||
         url.password !== '' ||
         url.search !== '' ||
         url.hash !== '' ||
-        url.href !== value;
+        url.href !== value);
 }
 function sameOriginUrl(value, field, origin, protocols = ['https:', 'http:']) {
     if (typeof value !== 'string' || /[\u0000-\u0020\u007f]|\s/u.test(value)) {
@@ -77,26 +76,3 @@ function sameOriginUrl(value, field, origin, protocols = ['https:', 'http:']) {
     }
     return url.href;
 }
-function parseCredentialInstall(value) {
-    if (value === undefined || value === null)
-        return null;
-    const extension = closedRecord(value, 'extensions.credential_install', [
-        'kind',
-        'install',
-        'max_body_bytes',
-    ]);
-    exact(extension.kind, 'openengine.capsule-credential-install/v1', 'extensions.credential_install.kind');
-    const install = closedRecord(extension.install, 'extensions.credential_install.install', [
-        'route_template',
-        'method',
-    ]);
-    exact(install.method, 'PUT', 'extensions.credential_install.install.method');
-    return Object.freeze({
-        kind: 'openengine.capsule-credential-install/v1',
-        install: Object.freeze({
-            routeTemplate: (0, route_template_js_1.routeTemplate)(install.route_template, 'extensions.credential_install.install.route_template', ['capsule_id']),
-            method: 'PUT',
-        }),
-        maxBodyBytes: integer(extension.max_body_bytes, 'extensions.credential_install.max_body_bytes', 1, 4 * 1024 * 1024),
-    });
-}

package/lib/target/discovery-validation.mjs

@@ -1,5 +1,4 @@
 import { TargetDiscoveryError } from './discovery-errors.mjs';
-import { routeTemplate } from './route-template.mjs';
 export function record(value, field) {
     if (value === null || typeof value !== 'object' || Array.isArray(value)) {
         throw new TargetDiscoveryError(`${field} must be an object`);
@@ -34,19 +33,20 @@ export function exactStringSet(value, field, expected) {
     if (!Array.isArray(value) || value.some((item) => typeof item !== 'string')) {
         throw new TargetDiscoveryError(`${field} must be an array of strings`);
     }
-    if (value.length !== expected.length || new Set(value).size !== value.length ||
+    if (value.length !== expected.length ||
+        new Set(value).size !== value.length ||
         expected.some((item) => !value.includes(item))) {
         throw new TargetDiscoveryError(`${field} does not match the supported contract`);
     }
     return Object.freeze([...value]);
 }
 function hasForbiddenUrlComponent(url, value, protocols) {
-    return !protocols.includes(url.protocol) ||
+    return (!protocols.includes(url.protocol) ||
         url.username !== '' ||
         url.password !== '' ||
         url.search !== '' ||
         url.hash !== '' ||
-        url.href !== value;
+        url.href !== value);
 }
 export function sameOriginUrl(value, field, origin, protocols = ['https:', 'http:']) {
     if (typeof value !== 'string' || /[\u0000-\u0020\u007f]|\s/u.test(value)) {
@@ -67,26 +67,3 @@ export function sameOriginUrl(value, field, origin, protocols = ['https:', 'http
     }
     return url.href;
 }
-export function parseCredentialInstall(value) {
-    if (value === undefined || value === null)
-        return null;
-    const extension = closedRecord(value, 'extensions.credential_install', [
-        'kind',
-        'install',
-        'max_body_bytes',
-    ]);
-    exact(extension.kind, 'openengine.capsule-credential-install/v1', 'extensions.credential_install.kind');
-    const install = closedRecord(extension.install, 'extensions.credential_install.install', [
-        'route_template',
-        'method',
-    ]);
-    exact(install.method, 'PUT', 'extensions.credential_install.install.method');
-    return Object.freeze({
-        kind: 'openengine.capsule-credential-install/v1',
-        install: Object.freeze({
-            routeTemplate: routeTemplate(install.route_template, 'extensions.credential_install.install.route_template', ['capsule_id']),
-            method: 'PUT',
-        }),
-        maxBodyBytes: integer(extension.max_body_bytes, 'extensions.credential_install.max_body_bytes', 1, 4 * 1024 * 1024),
-    });
-}

package/lib/target/discovery.cjs

@@ -67,7 +67,6 @@ function parseDiscoveryDocument(discovery, origin) {
         capsule,
         transport,
         capabilityFlags,
-        credentialInstall: extensions.credentialInstall,
         runIntent: extensions.runIntent,
         additional,
     });

package/lib/target/discovery.d.cts

@@ -1,8 +1,6 @@
 import type { HttpTransport } from './device-flow.js';
 import type { RouteTemplate } from './route-template.js';
-import { type CredentialInstallDescriptor } from './discovery-validation.js';
 import type { RunIntentDescriptor } from './run-intent-discovery.js';
-export type { CredentialInstallDescriptor } from './discovery-validation.js';
 export type { RunIntentDescriptor } from './run-intent-discovery.js';
 export { TargetDiscoveryError } from './discovery-errors.js';
 export { expandRoute, type RouteTemplate } from './route-template.js';
@@ -57,7 +55,6 @@ export interface TargetDiscoveryDescriptor {
         };
     };
     readonly capabilityFlags: readonly string[];
-    readonly credentialInstall: CredentialInstallDescriptor | null;
     readonly runIntent: RunIntentDescriptor | null;
     readonly additional: Readonly<Record<string, unknown>>;
 }

package/lib/target/discovery.d.mts

@@ -1,8 +1,6 @@
 import type { HttpTransport } from './device-flow.js';
 import type { RouteTemplate } from './route-template.js';
-import { type CredentialInstallDescriptor } from './discovery-validation.js';
 import type { RunIntentDescriptor } from './run-intent-discovery.js';
-export type { CredentialInstallDescriptor } from './discovery-validation.js';
 export type { RunIntentDescriptor } from './run-intent-discovery.js';
 export { TargetDiscoveryError } from './discovery-errors.js';
 export { expandRoute, type RouteTemplate } from './route-template.js';
@@ -57,7 +55,6 @@ export interface TargetDiscoveryDescriptor {
         };
     };
     readonly capabilityFlags: readonly string[];
-    readonly credentialInstall: CredentialInstallDescriptor | null;
     readonly runIntent: RunIntentDescriptor | null;
     readonly additional: Readonly<Record<string, unknown>>;
 }

package/lib/target/discovery.d.ts

@@ -1,8 +1,6 @@
 import type { HttpTransport } from './device-flow.js';
 import type { RouteTemplate } from './route-template.js';
-import { type CredentialInstallDescriptor } from './discovery-validation.js';
 import type { RunIntentDescriptor } from './run-intent-discovery.js';
-export type { CredentialInstallDescriptor } from './discovery-validation.js';
 export type { RunIntentDescriptor } from './run-intent-discovery.js';
 export { TargetDiscoveryError } from './discovery-errors.js';
 export { expandRoute, type RouteTemplate } from './route-template.js';
@@ -57,7 +55,6 @@ export interface TargetDiscoveryDescriptor {
         };
     };
     readonly capabilityFlags: readonly string[];
-    readonly credentialInstall: CredentialInstallDescriptor | null;
     readonly runIntent: RunIntentDescriptor | null;
     readonly additional: Readonly<Record<string, unknown>>;
 }

package/lib/target/discovery.js

@@ -67,7 +67,6 @@ function parseDiscoveryDocument(discovery, origin) {
         capsule,
         transport,
         capabilityFlags,
-        credentialInstall: extensions.credentialInstall,
         runIntent: extensions.runIntent,
         additional,
     });

package/lib/target/discovery.mjs

@@ -1,6 +1,6 @@
 import { readBoundedResponseJson } from './bounded-response.mjs';
 import { TargetDiscoveryError } from './discovery-errors.mjs';
-import { exact, exactStringSet, record, } from './discovery-validation.mjs';
+import { exact, exactStringSet, record } from './discovery-validation.mjs';
 import { parseAdapter, parseCapsule, parseEndpoint, parseExtensions, parseOAuth, parseSession, parseSizes, parseTransport, validateOAuthMetadata, } from './discovery-sections.mjs';
 export { TargetDiscoveryError } from './discovery-errors.mjs';
 export { expandRoute } from './route-template.mjs';
@@ -60,7 +60,6 @@ function parseDiscoveryDocument(discovery, origin) {
         capsule,
         transport,
         capabilityFlags,
-        credentialInstall: extensions.credentialInstall,
         runIntent: extensions.runIntent,
         additional,
     });

package/lib/target/index.d.ts

@@ -3,4 +3,4 @@ export { acquireTargetLock } from './credential-lock.js';
 export { requestDeviceCode, pollForToken, parseTokenResponse, DeviceFlowDeniedError, DeviceFlowExpiredError, UnboundSessionError, type DeviceCodeResponse, type DeviceExchangeContext, type TokenResponse, type HttpTransport, type Clock, } from './device-flow.js';
 export { addTarget, removeTarget, getTarget, listTargets, updateTargetOrganization, validateTargetName, normalizeAndValidateUrl, TargetNameInvalidError, TargetNameExistsError, TargetNotFoundError, TargetUrlInvalidError, type TargetRecord, type SettingsPort, } from './target-registry.js';
 export { TargetSessionManager, LoginRequiredError, type BrowserOpener, type TargetSessionDeps, type TargetSessionManagerInit, } from './target-session.js';
-export { discoverTarget, discoverTargetSessionEndpoints, expandRoute, TargetDiscoveryError, type CredentialInstallDescriptor, type RunIntentDescriptor, type RouteTemplate, type TargetDiscoveryDescriptor, type TargetSessionEndpoints, } from './discovery.js';
+export { discoverTarget, discoverTargetSessionEndpoints, expandRoute, TargetDiscoveryError, type RunIntentDescriptor, type RouteTemplate, type TargetDiscoveryDescriptor, type TargetSessionEndpoints, } from './discovery.js';

package/lib/target/run-intent-discovery.cjs

@@ -6,12 +6,14 @@ const discovery_validation_js_1 = require("./discovery-validation.cjs");
 function parseRunIntent(value, origin) {
     if (value === undefined || value === null)
         return null;
+    const advertised = (0, discovery_validation_js_1.record)(value, 'extensions.run_intent');
+    if (advertised.kind !== 'zeroshot.run-intent/v2')
+        return null;
     const extension = (0, discovery_validation_js_1.closedRecord)(value, 'extensions.run_intent', [
         'kind',
         'base_url',
         'route_templates',
     ]);
-    (0, discovery_validation_js_1.exact)(extension.kind, 'zeroshot.run-intent/v2', 'extensions.run_intent.kind');
     const routes = (0, discovery_validation_js_1.closedRecord)(extension.route_templates, 'extensions.run_intent.route_templates', [
         'submit',
         'status',

package/lib/target/run-intent-discovery.js

@@ -6,12 +6,14 @@ const discovery_validation_js_1 = require("./discovery-validation.js");
 function parseRunIntent(value, origin) {
     if (value === undefined || value === null)
         return null;
+    const advertised = (0, discovery_validation_js_1.record)(value, 'extensions.run_intent');
+    if (advertised.kind !== 'zeroshot.run-intent/v2')
+        return null;
     const extension = (0, discovery_validation_js_1.closedRecord)(value, 'extensions.run_intent', [
         'kind',
         'base_url',
         'route_templates',
     ]);
-    (0, discovery_validation_js_1.exact)(extension.kind, 'zeroshot.run-intent/v2', 'extensions.run_intent.kind');
     const routes = (0, discovery_validation_js_1.closedRecord)(extension.route_templates, 'extensions.run_intent.route_templates', [
         'submit',
         'status',

package/lib/target/run-intent-discovery.mjs

@@ -1,14 +1,16 @@
 import { routeTemplate } from './route-template.mjs';
-import { closedRecord, exact, sameOriginUrl } from './discovery-validation.mjs';
+import { closedRecord, record, sameOriginUrl } from './discovery-validation.mjs';
 export function parseRunIntent(value, origin) {
     if (value === undefined || value === null)
         return null;
+    const advertised = record(value, 'extensions.run_intent');
+    if (advertised.kind !== 'zeroshot.run-intent/v2')
+        return null;
     const extension = closedRecord(value, 'extensions.run_intent', [
         'kind',
         'base_url',
         'route_templates',
     ]);
-    exact(extension.kind, 'zeroshot.run-intent/v2', 'extensions.run_intent.kind');
     const routes = closedRecord(extension.route_templates, 'extensions.run_intent.route_templates', [
         'submit',
         'status',

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@the-open-engine/zeroshot",
-  "version": "6.35.2",
+  "version": "6.36.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@the-open-engine/zeroshot",
-      "version": "6.35.2",
+      "version": "6.36.0",
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@the-open-engine/zeroshot",
-  "version": "6.35.2",
+  "version": "6.36.0",
   "description": "Independent executor–verifier orchestration for software changes.",
   "main": "src/orchestrator.js",
   "bin": {

package/src/agent-cli-provider/adapters/omp.ts

@@ -81,7 +81,7 @@ function detectCliFeatures(helpText?: string | null, versionText?: string | null
   return {
     provider: 'omp',
     versionMatches: VERSION_TOKEN_PATTERN.test(version),
-    supportsRpcMode: /(^|\s)rpc(\s|$)/m.test(help),
+    supportsRpcMode: /(?<![A-Za-z0-9_-])rpc(?![A-Za-z0-9_-])/.test(help),
     supportsConfig: /--config\b/.test(help),
     supportsModel: /--model\b/.test(help),
     supportsThinking: /--thinking\b/.test(help),

package/src/agent-cli-provider/single-agent-runtime.ts

@@ -921,11 +921,7 @@ function probeGatewayProvider(
   try {
     const settings = runtimeSettings ?? loadRuntimeSettings();
     const providerSettings = runtimeProviderSettings(settings, 'gateway', process.cwd());
-    resolveGatewayConfiguration(
-      providerSettings.gateway,
-      'settings.providerSettings.gateway',
-      process.cwd()
-    );
+    resolveRuntimeGatewayOptions('gateway', {}, providerSettings, providerSettings.gateway ?? {});
     return {
       available: true,
       helpText: 'Bundled gateway runner',

package/src/hosted-target/adapter-types.ts

@@ -12,13 +12,6 @@ import type {
   TargetAccessTokenProvider,
 } from './types.js';
 
-export type CredentialInstallCapability =
-  | { readonly supported: false }
-  | {
-      readonly supported: true;
-      readonly descriptor: NonNullable<TargetDiscoveryDescriptor['credentialInstall']>;
-    };
-
 export interface TargetAdapter {
   allocate(req: AllocateRequest, signal?: AbortSignal): Promise<Capsule>;
   list(req?: ListRequest, signal?: AbortSignal): Promise<CapsuleListPage>;
@@ -26,13 +19,6 @@ export interface TargetAdapter {
   terminate(capsuleId: string, signal?: AbortSignal): Promise<Capsule>;
   limits(signal?: AbortSignal): Promise<CapsuleLimits>;
   access(capsuleId: string, signal?: AbortSignal): Promise<CapsuleAccess>;
-  installRuntime(
-    capsuleId: string,
-    runtime: unknown,
-    accessToken: string,
-    signal?: AbortSignal
-  ): Promise<void>;
-  readonly credentialInstall: CredentialInstallCapability;
 }
 
 export interface CreateTargetAdapterOptions {

package/src/hosted-target/index.ts

@@ -2,7 +2,6 @@ export {
   createTargetAdapter,
   type TargetAdapter,
   type CreateTargetAdapterOptions,
-  type CredentialInstallCapability,
 } from './target-adapter.js';
 export {
   TargetAdapterError,

package/src/hosted-target/retry-executor.ts

@@ -2,14 +2,7 @@ import { MAX_RETRY_ELAPSED_MS } from './bounds.js';
 import { TargetAdapterError } from './errors.js';
 import type { Clock, RetryPolicy } from './types.js';
 
-export type TargetOperation =
-  | 'allocate'
-  | 'list'
-  | 'inspect'
-  | 'terminate'
-  | 'limits'
-  | 'access'
-  | 'installRuntime';
+export type TargetOperation = 'allocate' | 'list' | 'inspect' | 'terminate' | 'limits' | 'access';
 
 function throwIfAborted(signal?: AbortSignal): void {
   if (signal?.aborted) {
@@ -22,10 +15,16 @@ async function wait(delayMs: number, signal?: AbortSignal): Promise<void> {
   if (delayMs <= 0) return;
   await new Promise<void>((resolve, reject) => {
     const timer = setTimeout(resolve, delayMs);
-    signal?.addEventListener('abort', () => {
-      clearTimeout(timer);
-      reject(signal.reason ?? new globalThis.DOMException('The operation was aborted', 'AbortError'));
-    }, { once: true });
+    signal?.addEventListener(
+      'abort',
+      () => {
+        clearTimeout(timer);
+        reject(
+          signal.reason ?? new globalThis.DOMException('The operation was aborted', 'AbortError')
+        );
+      },
+      { once: true }
+    );
   });
 }
 
@@ -41,12 +40,11 @@ function validRetryDelay(retry: boolean, delayMs: number, remaining: number): bo
   return retry && Number.isFinite(delayMs) && delayMs >= 0 && delayMs < remaining;
 }
 
-
 export async function withTargetRetry<T>(
   operation: TargetOperation,
   effect: () => Promise<T>,
   signal: AbortSignal | undefined,
-  context: RetryContext,
+  context: RetryContext
 ): Promise<T> {
   const retrySafe = operation !== 'access';
   const started = context.clock.now();

package/src/hosted-target/target-adapter.ts

@@ -1,10 +1,6 @@
 import { ZeroCloudV1TargetAdapter } from './zero-cloud-v1-adapter.js';
 import type { CreateTargetAdapterOptions, TargetAdapter } from './adapter-types.js';
-export type {
-  CreateTargetAdapterOptions,
-  CredentialInstallCapability,
-  TargetAdapter,
-} from './adapter-types.js';
+export type { CreateTargetAdapterOptions, TargetAdapter } from './adapter-types.js';
 
 export function createTargetAdapter(options: CreateTargetAdapterOptions): TargetAdapter {
   if (options.descriptor.adapter.majorVersion !== 1) {

package/src/hosted-target/zero-cloud-v1-adapter.ts

@@ -22,7 +22,6 @@ import type { TargetDiscoveryDescriptor } from '../target/discovery.js';
 import { readBoundedResponseJson } from '../target/bounded-response.js';
 import { validateAccessUrl } from './access-url.js';
 import { withTargetRetry } from './retry-executor.js';
-import { installRuntime as installOpaqueRuntime } from './runtime-install.js';
 import { assertCapsuleResponseStatus } from './response-status.js';
 import {
   createAdapterRequester,
@@ -61,13 +60,6 @@ export class ZeroCloudV1TargetAdapter implements TargetAdapter {
     this.#retryPolicy = options.retryPolicy ?? new DefaultRetryPolicy();
   }
 
-  get credentialInstall(): TargetAdapter['credentialInstall'] {
-    const descriptor = this.#descriptor.credentialInstall;
-    return descriptor === null
-      ? Object.freeze({ supported: false as const })
-      : Object.freeze({ supported: true as const, descriptor });
-  }
-
   allocate(request: AllocateRequest, signal?: AbortSignal): Promise<Capsule> {
     try {
       if (!IDEMPOTENCY_KEY_PATTERN.test(request.idempotencyKey))
@@ -184,35 +176,6 @@ export class ZeroCloudV1TargetAdapter implements TargetAdapter {
     return result;
   }
 
-  async installRuntime(
-    capsuleId: string,
-    runtime: unknown,
-    accessToken: string,
-    signal?: AbortSignal
-  ): Promise<void> {
-    const descriptor = this.#descriptor.credentialInstall;
-    if (descriptor === null) {
-      throw new TargetProtocolError('Target does not advertise runtime installation');
-    }
-    await installOpaqueRuntime({
-      capsuleId,
-      runtime,
-      accessToken,
-      descriptor,
-      ...(signal === undefined ? {} : { signal }),
-      clock: this.#clock,
-      retryPolicy: this.#retryPolicy,
-      request: (method, path, requestSignal, body, token) =>
-        this.#request({
-          method,
-          path,
-          signal: requestSignal,
-          request: { body },
-          accessToken: token,
-        }),
-    });
-  }
-
   #execute<T>(...args: ExecuteArguments<T>): Promise<T> {
     return Promise.resolve().then(() => this.#executeExpanded(args));
   }

package/src/target/discovery-sections.ts

@@ -4,10 +4,9 @@ import {
   exact,
   exactStringSet,
   integer,
-  parseCredentialInstall,
+  record,
   sameOriginUrl,
   stringField,
-  type CredentialInstallDescriptor,
 } from './discovery-validation.js';
 import { parseRunIntent, type RunIntentDescriptor } from './run-intent-discovery.js';
 import { routeTemplate } from './route-template.js';
@@ -65,37 +64,13 @@ export function parseExtensions(
   discovery: Record<string, unknown>,
   origin: string
 ): {
-  readonly credentialInstall: CredentialInstallDescriptor | null;
   readonly runIntent: RunIntentDescriptor | null;
 } {
   if (discovery.extensions === undefined || discovery.extensions === null) {
-    return Object.freeze({ credentialInstall: null, runIntent: null });
+    return Object.freeze({ runIntent: null });
   }
-  const extensions = closedRecord(discovery.extensions, 'extensions', [
-    'connections',
-    'credential_install',
-    'run_intent',
-  ]);
-  if (extensions.connections === undefined) {
-    throw new TargetDiscoveryError('extensions.connections is required');
-  }
-  const connections = closedRecord(extensions.connections, 'extensions.connections', [
-    'kind',
-    'base_url',
-    'route_templates',
-  ]);
-  exact(connections.kind, 'zerocloud.connections/v1', 'extensions.connections.kind');
-  sameOriginUrl(connections.base_url, 'extensions.connections.base_url', origin);
-  const routes = closedRecord(
-    connections.route_templates,
-    'extensions.connections.route_templates',
-    ['list', 'create', 'update']
-  );
-  routeTemplate(routes.list, 'extensions.connections.route_templates.list', []);
-  routeTemplate(routes.create, 'extensions.connections.route_templates.create', []);
-  routeTemplate(routes.update, 'extensions.connections.route_templates.update', ['connection_id']);
+  const extensions = record(discovery.extensions, 'extensions');
   return Object.freeze({
-    credentialInstall: parseCredentialInstall(extensions.credential_install),
     runIntent: parseRunIntent(extensions.run_intent, origin),
   });
 }