@agiledigital/pingone-aic-script-tester 0.1.0

package/dist/src/aic/file-lease.js

@@ -0,0 +1,543 @@
+/**
+ * Owns the reusable AM graph and tenant-backed check/cleanup replay behind the
+ * harness's framework-free lane port. The Vitest composition root constructs
+ * this tenant-aware side of the seam.
+ */
+import { randomUUID } from "node:crypto";
+import { judge } from "../case/verdict.js";
+import { tenantIdmHandle } from "./idm.js";
+import { conformChain } from "./conform.js";
+import { emitLeasedJourney } from "./emit-journey.js";
+import { emitLeasedSessionJourney } from "./emit-session.js";
+import { instrumentSubject } from "./emit-subject.js";
+import { createLeaseIdentity } from "./lease-identity.js";
+import { acquireLeaseLock, addJournalFixture, addJournalResources, leaseStatePaths, newLeaseJournal, readLeaseJournal, removeLeaseJournal, removeJournalFixture, writeLeaseJournal, } from "./lease-lock.js";
+import { acquireManagedFixtureLock, deleteManagedFixture, fixtureIdentity, managedResource, seedManagedFixtures, } from "./managed.js";
+import { confirmResourceSnapshot } from "./resource-snapshot.js";
+import { deleteCreatedResources, driveJourney, fetchCookieName, invokeJourney, provisionJourney, validateAicRun, } from "./run.js";
+import { AicLaneError, amConfigHeaders, amRequest, connectTenant, defaultAicIo, realmJsonPath, } from "./tenant.js";
+import { beginSingleTrace, beginTrace, clearAicTrace } from "./trace.js";
+import { projectRoot } from "../project.js";
+export class AicFileLease {
+    #options;
+    #io;
+    #realm;
+    #project;
+    #identity;
+    #wrapper;
+    #session;
+    #created = [];
+    #state = "new";
+    #queue = Promise.resolve();
+    #lock;
+    #paths;
+    #sessionWrapper;
+    #sessionCreated = [];
+    #cookieName;
+    #seededManaged = [];
+    #releaseManagedLock;
+    constructor(options) {
+        this.#options = options;
+        this.#realm = options.realm ?? "alpha";
+        this.#project = options.project ?? projectRoot();
+        this.#io = options.io ?? defaultAicIo(this.#project);
+    }
+    get identity() {
+        if (this.#identity === undefined) {
+            throw new AicLaneError("AIC file lease has not been opened");
+        }
+        return this.#identity;
+    }
+    async open() {
+        if (this.#state !== "new") {
+            throw new AicLaneError(`AIC file lease cannot open from state ${this.#state}`);
+        }
+        this.#state = "opening";
+        this.#identity = createLeaseIdentity({
+            id: this.#options.id,
+            source: this.#options.source,
+            outcomes: this.#options.outcomes,
+        });
+        this.#wrapper = emitLeasedJourney({
+            identity: this.#identity,
+            realm: this.#realm,
+            suiteName: this.#options.suiteName,
+        });
+        try {
+            this.#session = await connectTenant(this.#io, {
+                ...(this.#options.tenant === undefined ? {} : { tenant: this.#options.tenant }),
+                ...(this.#options.provider === undefined ? {} : { provider: this.#options.provider }),
+                useConfigured: this.#options.io === undefined,
+                project: this.#project,
+            });
+            this.#paths = leaseStatePaths(this.#session.baseUrl, this.#identity, this.#options.stateDir);
+            this.#lock = await acquireLeaseLock(this.#paths, this.#identity, {
+                ...(this.#options.lockTimeoutMs === undefined
+                    ? {}
+                    : { timeoutMs: this.#options.lockTimeoutMs }),
+            });
+            await this.#handleOlderJournal();
+            await writeLeaseJournal(this.#paths.journalPath, newLeaseJournal(this.#paths, this.#identity, this.#realm, staticResources(this.#wrapper)));
+            await provisionJourney(this.#io, this.#session, this.#wrapper, this.#created);
+            this.#state = "open";
+        }
+        catch (error) {
+            await this.#cleanupAfterFailedOpen();
+            this.#state = "closed";
+            throw error;
+        }
+    }
+    run(request) {
+        const task = async () => {
+            this.#requireOpen();
+            this.#validate(request);
+            const report = await conformChain({
+                ...request,
+                aic: (args) => this.#runEffects(args.cases, args.source, args.replies, args.managedFixtures ?? [], request.hooks),
+            });
+            assertConformance(report);
+            return report;
+        };
+        const result = this.#queue.then(task, task);
+        this.#queue = result.then(() => undefined, () => undefined);
+        return result;
+    }
+    async endTest() {
+        await this.#queue;
+        const errors = await this.#cleanupManaged();
+        if (errors.length > 0) {
+            throw new AicLaneError(`AIC managed fixture cleanup failed: ${errors.join("; ")}`);
+        }
+    }
+    async close() {
+        if (this.#state === "closed") {
+            return;
+        }
+        await this.#queue;
+        const errors = [];
+        try {
+            const session = this.#session;
+            errors.push(...(await this.#cleanupManaged()));
+            if (session !== undefined) {
+                errors.push(...(await deleteCreatedResources(this.#io, session, this.#realm, this.#sessionCreated)));
+                errors.push(...(await deleteCreatedResources(this.#io, session, this.#realm, this.#created)));
+            }
+            if (errors.length === 0) {
+                this.#created = [];
+                this.#sessionCreated = [];
+                if (this.#paths !== undefined) {
+                    await removeLeaseJournal(this.#paths.journalPath);
+                }
+            }
+        }
+        finally {
+            this.#state = "closed";
+            await this.#releaseManagedLock?.();
+            this.#releaseManagedLock = undefined;
+            await this.#lock?.release();
+        }
+        if (errors.length > 0) {
+            throw new AicLaneError(`AIC file lease cleanup failed: ${errors.join("; ")}`);
+        }
+    }
+    async #runEffects(cases, source, replies, managedFixtures, hooks) {
+        const session = this.#session;
+        // The bearer captured at open() is NOT refreshed here, deliberately.
+        // Measured 2026-09-14: the agent rotates on its own ~898s schedule and
+        // `whoami --token` can hand back a token already near the end of that
+        // cycle, so neither the file's age nor the token's tells you whether it is
+        // still good — a prophylactic refresh would cost a CLI call per case and
+        // still not guarantee one. `amRequest` instead refreshes and retries once
+        // on a non-anonymous 401, which closes the gap completely for the price of
+        // one wasted request on the rare occasion the bearer dies mid-file.
+        // `/authenticate` is anonymous and carries no bearer, so a journey
+        // invocation is unaffected either way.
+        if (managedFixtures.length > 0) {
+            this.#releaseManagedLock = await acquireManagedFixtureLock(session, cases[cases.length - 1]?.name ?? this.identity.id);
+            const identities = managedFixtures.map((fixture) => fixtureIdentity(fixture));
+            for (const [index, identity] of identities.entries()) {
+                const fixture = managedFixtures[index];
+                await addJournalFixture(this.#journalPath(), {
+                    type: fixture.type,
+                    id: identity.id,
+                });
+            }
+        }
+        let effects;
+        let failure;
+        let fixturesReady = false;
+        try {
+            await seedManagedFixtures(this.#io, session, managedFixtures, this.#seededManaged);
+            fixturesReady = true;
+            let sessionCookie;
+            const existingSession = cases[0]?.given.existingSession;
+            if (existingSession !== undefined) {
+                sessionCookie = await this.#mintSession(existingSession);
+                clearAicTrace();
+            }
+            effects = await this.#armAndDrive(cases, source, replies, hooks, sessionCookie);
+        }
+        catch (error) {
+            failure = error;
+        }
+        if (fixturesReady && hooks.cleanup !== undefined) {
+            try {
+                await hooks.cleanup(tenantIdmHandle(this.#io, session));
+            }
+            catch (error) {
+                const cleanupFailure = laneHookError(cases[cases.length - 1]?.name ?? this.identity.id, "cleanup()", error);
+                failure = combineHookFailure(failure, cleanupFailure);
+            }
+        }
+        const cleanupErrors = await this.#cleanupManaged();
+        for (const fixture of managedFixtures) {
+            const identity = fixtureIdentity(fixture);
+            if (!this.#seededManaged.some((seeded) => seeded.type === fixture.type && seeded.id === identity.id)) {
+                try {
+                    await removeJournalFixture(this.#journalPath(), {
+                        type: fixture.type,
+                        id: identity.id,
+                    });
+                }
+                catch (error) {
+                    cleanupErrors.push(error instanceof Error ? error.message : String(error));
+                }
+            }
+        }
+        if (failure !== undefined) {
+            if (cleanupErrors.length > 0) {
+                throw new AggregateError([failure, ...cleanupErrors.map((message) => new AicLaneError(message))], "AIC run and managed fixture cleanup both failed");
+            }
+            throw failure;
+        }
+        if (cleanupErrors.length > 0) {
+            throw new AicLaneError(`AIC managed fixture cleanup failed: ${cleanupErrors.join("; ")}`);
+        }
+        return effects;
+    }
+    async #armAndDrive(cases, source, replies, hooks, sessionCookie) {
+        const session = this.#session;
+        const wrapper = this.#wrapper;
+        const nonce = randomUUID();
+        const instrumented = instrumentSubject(source, this.identity.idHash, cases[0]?.given, {
+            snapshotKey: this.identity.snapshotKey,
+            invocationNonce: nonce,
+            header: this.identity.marker,
+        });
+        const subjectDigest = instrumented.subjectDigest;
+        if (subjectDigest === undefined) {
+            throw new AicLaneError("leased subject instrumentation produced no digest");
+        }
+        // No size guard: there is no script-specific limit, and the 5 MiB
+        // request-body ceiling is orders of magnitude above any generated subject
+        // (measured 2026-09-14, `docs/api/04-scripts.md`). Over it AM answers a
+        // clean 400 and stores nothing, so the confirming read below is the only
+        // check this needs — it never truncates.
+        const body = {
+            _id: this.identity.ids.subjectScript,
+            name: `${this.identity.treeName}-subject`,
+            description: this.identity.marker,
+            script: Buffer.from(instrumented.source, "utf8").toString("base64"),
+            default: false,
+            language: "JAVASCRIPT",
+            context: "AUTHENTICATION_TREE_DECISION_NODE",
+            evaluatorVersion: "2.0",
+        };
+        const path = `${realmJsonPath(this.#realm)}/scripts/${this.identity.ids.subjectScript}`;
+        const update = await amRequest(this.#io, session, {
+            method: "PUT",
+            path,
+            headers: amConfigHeaders(),
+            body: JSON.stringify(body),
+        });
+        if (update.status !== 200) {
+            throw new AicLaneError(`subject update returned HTTP ${update.status}, expected 200; the owned slot may have disappeared`);
+        }
+        const confirmation = await amRequest(this.#io, session, {
+            method: "GET",
+            path,
+            headers: amConfigHeaders(),
+        });
+        if (confirmation.status !== 200) {
+            throw new AicLaneError(`subject confirming read returned HTTP ${confirmation.status}, expected 200`);
+        }
+        confirmResourceSnapshot("script", body, confirmation.body);
+        const first = cases[0];
+        wrapper.invoke = {
+            headers: copyArrayMap(first.given.requestHeaders),
+            parameters: copyArrayMap(first.given.requestParameters),
+            cookies: { ...(first.given.requestCookies ?? {}) },
+        };
+        if (sessionCookie !== undefined) {
+            wrapper.invoke.cookies[sessionCookie.name] = sessionCookie.value;
+        }
+        const observePass = async (index, effects) => {
+            const final = index === cases.length - 1;
+            if (!final && !judge(cases[index], effects).pass) {
+                return;
+            }
+            const stepCheck = hooks.stepChecks[index];
+            const checks = final
+                ? hooks.finalChecks
+                : stepCheck === undefined
+                    ? []
+                    : [stepCheck];
+            for (const [checkIndex, check] of checks.entries()) {
+                try {
+                    await check(tenantIdmHandle(this.#io, session), effects);
+                }
+                catch (error) {
+                    const label = final
+                        ? `final check() ${checkIndex + 1}`
+                        : `step ${index + 1} check()`;
+                    throw laneHookError(cases[index]?.name ?? this.identity.id, label, error);
+                }
+            }
+        };
+        return driveJourney(this.#io, session, wrapper, cases, replies, beginTrace(session.tenantName), {
+            leaseDigest: this.identity.structuralDigest,
+            invocationNonce: nonce,
+            subjectDigest,
+        }, observePass);
+    }
+    async #mintSession(existingSession) {
+        const session = this.#session;
+        const emitted = emitLeasedSessionJourney(existingSession, {
+            identity: this.identity,
+            realm: this.#realm,
+        });
+        if (this.#sessionWrapper === undefined) {
+            await addJournalResources(this.#journalPath(), staticResources(emitted));
+            await provisionJourney(this.#io, session, emitted, this.#sessionCreated);
+            this.#sessionWrapper = emitted;
+        }
+        else {
+            // A replaced minter script IS what the next invocation executes
+            // (measured 2026-09-14): one file minted a session carrying "A", this
+            // branch replaced the same script id to carry "B", and the subject
+            // journey 1.1s later saw "B". AM does not serve a cached compile here,
+            // so the slot is safe to reuse.
+            const script = emitted.scripts[0];
+            const body = scriptBody(script, this.identity.marker);
+            const path = `${realmJsonPath(this.#realm)}/scripts/${script.id}`;
+            const update = await amRequest(this.#io, session, {
+                method: "PUT",
+                path,
+                headers: amConfigHeaders(),
+                body: JSON.stringify(body),
+            });
+            if (update.status !== 200) {
+                throw new AicLaneError(`session-minter update returned HTTP ${update.status}, expected 200`);
+            }
+            const confirmation = await amRequest(this.#io, session, {
+                method: "GET",
+                path,
+                headers: amConfigHeaders(),
+            });
+            if (confirmation.status !== 200) {
+                throw new AicLaneError(`session-minter confirming read returned HTTP ${confirmation.status}, expected 200`);
+            }
+            confirmResourceSnapshot("script", body, confirmation.body);
+            this.#sessionWrapper.scripts[0] = script;
+        }
+        const response = await invokeJourney(this.#io, session, this.#sessionWrapper, beginSingleTrace(session.tenantName));
+        const tokenId = response.body.tokenId;
+        if (typeof tokenId !== "string" || tokenId.length === 0) {
+            throw new AicLaneError("session-minter returned no tokenId");
+        }
+        this.#cookieName ??= await fetchCookieName(this.#io, session);
+        return { name: this.#cookieName, value: tokenId };
+    }
+    async #cleanupManaged() {
+        const errors = [];
+        for (const fixture of this.#seededManaged.slice().reverse()) {
+            try {
+                await deleteManagedFixture(this.#io, this.#session, fixture);
+                await removeJournalFixture(this.#journalPath(), fixture);
+                this.#seededManaged = this.#seededManaged.filter((item) => item.type !== fixture.type || item.id !== fixture.id);
+            }
+            catch (error) {
+                errors.push(error instanceof Error ? error.message : String(error));
+            }
+        }
+        if (this.#releaseManagedLock !== undefined && this.#seededManaged.length === 0) {
+            try {
+                await this.#releaseManagedLock();
+                this.#releaseManagedLock = undefined;
+            }
+            catch (error) {
+                errors.push(error instanceof Error ? error.message : String(error));
+            }
+        }
+        return errors;
+    }
+    #validate(request) {
+        const validation = validateAicRun(request.cases, request.replies, request.managedFixtures);
+        if (request.hooks.stepChecks.length !== request.replies.length) {
+            throw new AicLaneError(`AIC file lease received ${request.hooks.stepChecks.length} step hook slots for ${request.replies.length} steps`);
+        }
+        if (request.source !== this.#options.source) {
+            throw new AicLaneError("AIC file lease source differs from the suite source used at open");
+        }
+        for (const kase of request.cases) {
+            if (kase.script !== this.#options.source) {
+                throw new AicLaneError(`${kase.name}: case source differs from the leased suite source`);
+            }
+            const realm = kase.given.realm ?? "alpha";
+            if (realm !== this.#realm) {
+                throw new AicLaneError(`${kase.name}: realm ${JSON.stringify(realm)} differs from leased realm ${JSON.stringify(this.#realm)}`);
+            }
+            if (kase.expect.outcome !== null &&
+                !this.identity.outcomes.includes(kase.expect.outcome)) {
+                throw new AicLaneError(`${kase.name}: outcome ${JSON.stringify(kase.expect.outcome)} is outside the leased vocabulary`);
+            }
+        }
+        if (validation.unsupported.length > 0 &&
+            this.#options.unsupported !== "skip") {
+            throw new AicLaneError(`AIC lane unsupported: ${validation.unsupported.join("; ")}`);
+        }
+    }
+    #requireOpen() {
+        if (this.#state !== "open") {
+            throw new AicLaneError(`AIC file lease is not open (state ${this.#state})`);
+        }
+    }
+    async #cleanupAfterFailedOpen() {
+        if (this.#session !== undefined && this.#created.length > 0) {
+            const errors = await deleteCreatedResources(this.#io, this.#session, this.#realm, this.#created);
+            if (errors.length === 0) {
+                this.#created = [];
+                if (this.#paths !== undefined) {
+                    await removeLeaseJournal(this.#paths.journalPath);
+                }
+            }
+        }
+        if (this.#created.length === 0 && this.#paths !== undefined) {
+            await removeLeaseJournal(this.#paths.journalPath);
+        }
+        await this.#lock?.release();
+    }
+    async #handleOlderJournal() {
+        const paths = this.#paths;
+        const journal = await readLeaseJournal(paths.journalPath);
+        if (journal === undefined) {
+            return;
+        }
+        const residue = [];
+        for (const resource of journal.resources) {
+            const path = resourcePath(journal.realm, resource);
+            const response = await amRequest(this.#io, this.#session, {
+                method: "GET",
+                path,
+                headers: amConfigHeaders(),
+            });
+            if (response.status === 404) {
+                continue;
+            }
+            if (response.status >= 200 && response.status < 300) {
+                residue.push(resourceLabel(resource));
+                continue;
+            }
+            throw new AicLaneError(`could not probe older AIC lease journal resource ${resourceLabel(resource)} (HTTP ${response.status})`);
+        }
+        for (const fixture of journal.managedFixtures) {
+            const response = await amRequest(this.#io, this.#session, {
+                method: "GET",
+                path: managedResource(fixture.type, fixture.id),
+            });
+            if (response.status === 404) {
+                continue;
+            }
+            if (response.status >= 200 && response.status < 300) {
+                residue.push(`${fixture.type}/${fixture.id}`);
+                continue;
+            }
+            throw new AicLaneError(`could not probe older managed fixture ${fixture.type}/${fixture.id} (HTTP ${response.status})`);
+        }
+        if (residue.length > 0) {
+            throw new AicLaneError(`AIC file lease ${JSON.stringify(journal.aicId)} has owned residue: ${residue.join(", ")}`);
+        }
+        await removeLeaseJournal(paths.journalPath);
+    }
+    #journalPath() {
+        if (this.#paths === undefined) {
+            throw new AicLaneError("AIC file lease journal path is unavailable");
+        }
+        return this.#paths.journalPath;
+    }
+}
+class AicLaneHookError extends AicLaneError {
+}
+function laneHookError(name, hook, error) {
+    // The kind goes in the message and the original goes on `cause`: the message
+    // must not carry arbitrary assertion text, but a remote check reporting only
+    // "threw Error" tells you nothing about what it actually found.
+    return new AicLaneHookError(`local and AIC lanes disagreed for ${JSON.stringify(name)}: local ${hook} passed; AIC ${hook} threw ${safeErrorKind(error)}`, { cause: error });
+}
+function combineHookFailure(failure, cleanupFailure) {
+    if (failure === undefined) {
+        return cleanupFailure;
+    }
+    const message = failure instanceof AicLaneHookError
+        ? `${failure.message}; ${cleanupFailure.message}`
+        : "AIC run and suite cleanup both failed";
+    return new AggregateError([failure, cleanupFailure], message);
+}
+function safeErrorKind(error) {
+    if (!(error instanceof Error)) {
+        return "a non-Error value";
+    }
+    return /^(?:Error|[A-Za-z][A-Za-z0-9]*Error)$/.test(error.name)
+        ? error.name
+        : "an Error";
+}
+function staticResources(wrapper) {
+    return [
+        ...wrapper.scripts.map((script) => ({ kind: "script", id: script.id })),
+        ...wrapper.nodes.map((node) => ({ kind: "node", id: node.id })),
+        { kind: "tree", name: wrapper.treeName },
+    ];
+}
+function resourcePath(realm, resource) {
+    const base = realmJsonPath(realm);
+    if (resource.kind === "script") {
+        return `${base}/scripts/${resource.id}`;
+    }
+    if (resource.kind === "node") {
+        return `${base}/realm-config/authentication/authenticationtrees/nodes/ScriptedDecisionNode/${resource.id}`;
+    }
+    return `${base}/realm-config/authentication/authenticationtrees/trees/${encodeURIComponent(resource.name)}`;
+}
+function resourceLabel(resource) {
+    return resource.kind === "tree"
+        ? `tree ${resource.name}`
+        : `${resource.kind} ${resource.id}`;
+}
+function scriptBody(script, description) {
+    return {
+        _id: script.id,
+        name: script.name,
+        description,
+        script: Buffer.from(script.source, "utf8").toString("base64"),
+        default: false,
+        language: "JAVASCRIPT",
+        context: "AUTHENTICATION_TREE_DECISION_NODE",
+        evaluatorVersion: "2.0",
+    };
+}
+function assertConformance(report) {
+    const error = report.passes.find((pass) => pass.aic.error !== undefined)?.aic.error;
+    if (error !== undefined) {
+        throw new AicLaneError(error);
+    }
+    const failed = report.passes.find((pass) => pass.aic.verdict?.pass === false);
+    if (failed !== undefined) {
+        throw new AicLaneError(`AIC verdict failed for ${failed.name}: ${failed.aic.verdict?.summary}`);
+    }
+    if (report.disagreements.length > 0) {
+        throw new AicLaneError(`local and AIC lanes disagreed: ${report.disagreements.map((item) => item.message).join("; ")}`);
+    }
+}
+function copyArrayMap(value) {
+    return Object.fromEntries(Object.entries(value ?? {}).map(([key, items]) => [key, items.slice()]));
+}

package/dist/src/aic/http.d.ts

@@ -0,0 +1,21 @@
+export interface HttpResponse {
+    status: number;
+    headers: Array<[string, string]>;
+    body: string;
+}
+export interface HttpRequest {
+    url: string;
+    method: string;
+    /** Repeated names are sent as repeated header lines, not comma-joined. */
+    headerLines: Array<[string, string]>;
+    body?: string;
+    timeoutMs?: number;
+}
+/**
+ * HTTP/1.1 request that preserves duplicate header names. Node's
+ * `setHeader(name, [a,b])` comma-joins; AM `requestHeaders` stores one
+ * element per occurrence (`docs/api/12-script-bindings-matrix.md`), so the
+ * authenticate call has to write each line itself.
+ */
+export declare function sendHttp(req: HttpRequest): Promise<HttpResponse>;
+export declare function headerValues(headers: Array<[string, string]>, name: string): string[];

package/dist/src/aic/http.js

@@ -0,0 +1,127 @@
+import { request as httpRequest } from "node:http";
+import { request as httpsRequest } from "node:https";
+/**
+ * HTTP/1.1 request that preserves duplicate header names. Node's
+ * `setHeader(name, [a,b])` comma-joins; AM `requestHeaders` stores one
+ * element per occurrence (`docs/api/12-script-bindings-matrix.md`), so the
+ * authenticate call has to write each line itself.
+ */
+export function sendHttp(req) {
+    const url = new URL(req.url);
+    const isHttps = url.protocol === "https:";
+    const requestFn = isHttps ? httpsRequest : httpRequest;
+    const body = req.body ?? "";
+    const headerLines = withHostAndLength(url, req.headerLines, Buffer.byteLength(body));
+    const options = {
+        protocol: url.protocol,
+        hostname: url.hostname,
+        port: url.port === "" ? undefined : url.port,
+        path: `${url.pathname}${url.search}`,
+        method: req.method,
+        timeout: req.timeoutMs ?? 30_000,
+        // Leave headers empty; we write them on the wire below.
+        headers: {},
+    };
+    return new Promise((resolve, reject) => {
+        const request = requestFn(options, (response) => {
+            collect(response).then(resolve, reject);
+        });
+        request.on("timeout", () => {
+            request.destroy(new Error(`rhino-local: HTTP timeout after ${options.timeout}ms`));
+        });
+        request.on("error", reject);
+        writeHeaderLines(request, headerLines);
+        if (body.length > 0) {
+            request.write(body);
+        }
+        request.end();
+    });
+}
+function withHostAndLength(url, headerLines, length) {
+    const out = [];
+    let hasHost = false;
+    let hasLength = false;
+    let hasConnection = false;
+    for (const [name, value] of headerLines) {
+        const lower = name.toLowerCase();
+        if (lower === "host") {
+            hasHost = true;
+        }
+        if (lower === "content-length") {
+            hasLength = true;
+        }
+        if (lower === "connection") {
+            hasConnection = true;
+        }
+        out.push([name, value]);
+    }
+    if (!hasHost) {
+        const host = url.port === "" ? url.hostname : `${url.hostname}:${url.port}`;
+        out.unshift(["Host", host]);
+    }
+    if (!hasLength) {
+        out.push(["Content-Length", String(length)]);
+    }
+    if (!hasConnection) {
+        out.push(["Connection", "close"]);
+    }
+    return out;
+}
+function writeHeaderLines(request, headerLines) {
+    const grouped = new Map();
+    const order = [];
+    for (const [name, value] of headerLines) {
+        const existing = grouped.get(name);
+        if (existing === undefined) {
+            grouped.set(name, [value]);
+            order.push(name);
+        }
+        else {
+            existing.push(value);
+        }
+    }
+    for (const name of order) {
+        const values = grouped.get(name);
+        if (values === undefined) {
+            continue;
+        }
+        const single = values[0];
+        request.setHeader(name, values.length === 1 && single !== undefined ? single : values);
+    }
+}
+function collect(response) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        response.on("data", (chunk) => {
+            chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+        });
+        response.on("error", reject);
+        response.on("end", () => {
+            const headers = [];
+            const raw = response.rawHeaders;
+            for (let index = 0; index < raw.length; index += 2) {
+                const name = raw[index];
+                const value = raw[index + 1];
+                if (name === undefined || value === undefined) {
+                    continue;
+                }
+                headers.push([name, value]);
+            }
+            resolve({
+                status: response.statusCode ?? 0,
+                headers,
+                body: Buffer.concat(chunks).toString("utf8"),
+            });
+        });
+    });
+}
+export function headerValues(headers, name) {
+    const lower = name.toLowerCase();
+    const values = [];
+    for (const [key, value] of headers) {
+        if (key.toLowerCase() === lower) {
+            values.push(value);
+        }
+    }
+    return values;
+}