@fargowealth/fargo-ai-cli 1.3.0 → 1.4.0

package/src/website-browser-profile.mjs

@@ -1,5 +1,5 @@
 import { spawn } from "node:child_process";
-import { access, chmod, mkdir, readFile, unlink } from "node:fs/promises";
+import { access, chmod, mkdir, readFile, readdir, unlink } from "node:fs/promises";
 import { homedir, platform } from "node:os";
 import { delimiter, join, resolve } from "node:path";
 import { createInterface } from "node:readline/promises";
@@ -91,6 +91,34 @@ export function defaultLocalWebsiteProfileDirectory(connectorId, options = {}) {
   return join(options.xdgConfigHome ?? process.env.XDG_CONFIG_HOME ?? join(homeDirectory, ".config"), "fargo", "website-profiles", safeId, profileKey);
 }
 
+export async function resolveLocalWebsiteProfileDirectory(connectorId, options = {}) {
+  if (options.profileDirectory) return resolve(options.profileDirectory);
+  const fallback = defaultLocalWebsiteProfileDirectory(connectorId, options);
+  const connectorDirectory = resolve(fallback, "..");
+  let entries;
+  try {
+    entries = await readdir(connectorDirectory, { withFileTypes: true });
+  } catch (error) {
+    if (error?.code === "ENOENT") return fallback;
+    throw error;
+  }
+  const connectionProfiles = entries
+    .filter((entry) => entry.isDirectory() && /^bgc_[A-Za-z0-9_-]{43}$/.test(entry.name))
+    .map((entry) => join(connectorDirectory, entry.name));
+  if (connectionProfiles.length === 0) return fallback;
+  if (connectionProfiles.length === 1) return connectionProfiles[0];
+  throw new Error(`Multiple local Profiles exist for ${connectorId}; pass --profile-dir <path>`);
+}
+
+export function documentIsReadyAtOrigin(value, expectedOrigin) {
+  if (!["interactive", "complete"].includes(value?.readyState)) return false;
+  try {
+    return new URL(value.url).origin === expectedOrigin;
+  } catch {
+    return false;
+  }
+}
+
 export function parseCaptureSpec(value) {
   const source = record(value, "Website Profile capture spec is invalid");
   if (source.profileSchemaVersion !== WEBSITE_BROWSER_PROFILE_SCHEMA_VERSION) throw new Error("Website Profile schema is not supported");
@@ -174,7 +202,7 @@ async function waitForDocument(client, sessionId, expectedOrigin) {
       returnByValue: true
     }, sessionId).catch(() => ({}));
     const value = result?.result?.value;
-    if (value?.readyState === "complete" && new URL(value.url).origin === expectedOrigin) return;
+    if (documentIsReadyAtOrigin(value, expectedOrigin)) return;
     await delay(100);
   }
   throw new Error(`Timed out while reading local storage for ${expectedOrigin}`);
@@ -185,7 +213,10 @@ async function waitForLoginConfirmation(spec, options) {
   const input = options.stdin ?? process.stdin;
   const output = options.stderr ?? process.stderr;
   if (!input.isTTY) throw new Error("Interactive login requires a TTY; use --no-prompt only for an already authenticated local Profile");
-  output.write(`Fargo opened an isolated local Chrome Profile for ${spec.connectorId}.\nComplete login, then press Enter here to upload only the allowlisted session state.\n`);
+  const nextStep = options.purpose === "local-execution"
+    ? "Complete login, then press Enter here to run locally; nothing will be uploaded."
+    : "Complete login, then press Enter here to upload only the allowlisted session state.";
+  output.write(`Fargo opened an isolated local Chrome Profile for ${spec.connectorId}.\n${nextStep}\n`);
   const prompt = createInterface({ input, output });
   try {
     await prompt.question("");

package/src/website-cli.mjs

@@ -3,8 +3,13 @@ import { readFile } from "node:fs/promises";
 import { resolve } from "node:path";
 import { callMcpTool } from "./mcp-client.mjs";
 import { mcpToolPayload } from "./mcp-result.mjs";
-import { captureLocalWebsiteProfile } from "./website-browser-profile.mjs";
-import { parseWebsiteConnectorDefinition } from "./website-connector-definition.mjs";
+import { captureLocalWebsiteProfile, resolveLocalWebsiteProfileDirectory } from "./website-browser-profile.mjs";
+import {
+  assertWebsiteConnectorRuntimeCompatibility,
+  executeWebsiteConnectorOperation,
+  parseWebsiteConnectorDefinition,
+  websiteConnectorRuntimeDescriptor
+} from "./website-connector-definition.mjs";
 
 const WEBSITE_BRIDGE_APP_ID = "website-bridge";
 const WEBSITE_BRIDGE_URL = "https://website-bridge.fargowealth.app";
@@ -17,9 +22,14 @@ export async function runWebsiteCommand(args, stdout, store, options = {}) {
   }
   if (action === "validate") {
     const definition = await readDefinition(args);
+    assertWebsiteConnectorRuntimeCompatibility(definition);
     stdout.write(`${JSON.stringify(validationSummary(definition))}\n`);
     return;
   }
+  if (action === "runtime") {
+    stdout.write(`${JSON.stringify(websiteConnectorRuntimeDescriptor())}\n`);
+    return;
+  }
   if (action === "release") {
     const definition = await readDefinition(args);
     const expectedRevision = optionalInteger(args, "--expected-revision");
@@ -41,13 +51,50 @@ export async function runWebsiteCommand(args, stdout, store, options = {}) {
     return;
   }
   if (action === "call") {
+    const mode = websiteCallMode(args);
     const write = args.includes("--write");
+    if (mode === "local") {
+      const definition = await readDefinition(args);
+      const connectorId = optionValue(args, "--connector")?.trim();
+      if (connectorId && connectorId !== definition.connectorId) {
+        throw new Error("--connector must match the Connector definition in --file");
+      }
+      const operationId = requiredOption(args, "--operation");
+      const operation = definition.operations.find((candidate) => candidate.operationId === operationId);
+      if (!operation) throw new Error("website_operation_not_found");
+      if (!operation.readOnly && (!write || !args.includes("--confirm"))) {
+        throw new Error("Local write operations require --write --confirm");
+      }
+      let storageState;
+      if (operation.requiresConnection) {
+        const capture = options.captureWebsiteProfile ?? captureLocalWebsiteProfile;
+        storageState = await capture(localProfileSpec(definition), {
+          chromePath: optionValue(args, "--chrome-path"),
+          noPrompt: args.includes("--no-prompt"),
+          profileDirectory: await resolveLocalWebsiteProfileDirectory(definition.connectorId, {
+            profileDirectory: optionValue(args, "--profile-dir")
+          }),
+          purpose: "local-execution",
+          settleMs: optionalInteger(args, "--settle-ms"),
+          stderr: options.stderr,
+          stdin: options.stdin
+        });
+      }
+      const execute = options.executeWebsiteOperation ?? executeWebsiteConnectorOperation;
+      const result = await execute(definition, operationId, await readArguments(args), {
+        fetchImpl: options.fetchImpl,
+        readOnlyOnly: !write,
+        ...(storageState ? { storageState } : {})
+      });
+      stdout.write(`${JSON.stringify({ ...result, executionMode: "local" })}\n`);
+      return;
+    }
     const result = await callWebsiteBridge(store, write ? "website_connector_execute" : "website_connector_read", {
       connectorId: requiredOption(args, "--connector"),
       operationId: requiredOption(args, "--operation"),
       arguments: await readArguments(args)
     }, { ...options, confirmation: args.includes("--confirm") });
-    stdout.write(`${JSON.stringify(result)}\n`);
+    stdout.write(`${JSON.stringify({ ...result, executionMode: "remote" })}\n`);
     return;
   }
   if (action === "connection-status") {
@@ -151,10 +198,35 @@ function validationSummary(definition) {
     displayName: definition.displayName,
     operationCount: definition.operations.length,
     requiresConnection: definition.operations.some((operation) => operation.requiresConnection),
+    runtime: websiteConnectorRuntimeDescriptor(),
     sha256: createHash("sha256").update(canonical).digest("hex")
   };
 }
 
+function websiteCallMode(args) {
+  if (args.includes("--local")) return "local";
+  const mode = optionValue(args, "--mode") ?? "remote";
+  if (!["auto", "local", "remote"].includes(mode)) throw new Error("--mode must be auto, local, or remote");
+  return mode === "auto" ? (optionValue(args, "--file") ? "local" : "remote") : mode;
+}
+
+function localProfileSpec(definition) {
+  if (definition.auth.kind !== "browser_storage" || !definition.loginUrl) {
+    throw new Error("Website Connector does not define a local browser Profile");
+  }
+  return {
+    allowedOrigins: definition.allowedOrigins,
+    auth: {
+      headerSources: definition.auth.headerSources.map(({ keySuffix, origin }) => ({ keySuffix, origin })),
+      sendCookies: definition.auth.sendCookies
+    },
+    connection: {},
+    connectorId: definition.connectorId,
+    loginUrl: definition.loginUrl,
+    profileSchemaVersion: "fargo.browser-profile/v1"
+  };
+}
+
 function optionalInteger(args, name) {
   const raw = optionValue(args, name);
   if (raw === undefined) return undefined;
@@ -264,12 +336,13 @@ function validatedUploadUrl(value, options) {
   return url.toString();
 }
 
-export const WEBSITE_USAGE = "Usage: fargo website validate|release|list|operations|call|connect|sync|connection-status|authorize|authorize-complete|binding";
+export const WEBSITE_USAGE = "Usage: fargo website validate|runtime|release|list|operations|call|connect|sync|connection-status|authorize|authorize-complete|binding";
 
 export const WEBSITE_HELP = `Usage: fargo website <command> [options]
 
 Connector authoring:
   validate --file <path>
+  runtime
   release --file <path> [--expected-revision <n>] --confirm
   list
   operations --connector <id>
@@ -278,7 +351,8 @@ Connection and execution:
   connect --connector <id> [--chrome-path <path>] [--profile-dir <path>]
   sync --connector <id> [--no-prompt] [--settle-ms <n>]
   connection-status --connector <id>
-  call --connector <id> --operation <id> [--args <json> | --args-file <path>]
+  call --connector <id> --operation <id> [--args <json> | --args-file <path>] [--mode auto|remote]
+  call --file <path> --operation <id> --mode local [--profile-dir <path>] [--no-prompt]
   call --connector <id> --operation <id> --write [--confirm]
 
 Cloud login fallback:

package/src/website-connector-definition.d.mts

@@ -1,58 +1 @@
-export type WebsiteConnectorInputSchema = {
-  additionalProperties: false;
-  properties: Record<string, {
-    enum?: Array<string | number | boolean>;
-    maxLength?: number;
-    type: "string" | "number" | "integer" | "boolean";
-  }>;
-  required: string[];
-  type: "object";
-};
-
-export type WebsiteConnectorAuth =
-  | { kind: "none" }
-  | {
-      kind: "browser_storage";
-      sendCookies: boolean;
-      headerSources: Array<{ keySuffix: string; name: string; origin: string; prefix?: string }>;
-    };
-
-export type WebsiteConnectorOperation = {
-  operationId: string;
-  description: string;
-  readOnly: boolean;
-  requiresConnection: boolean;
-  riskLevel: "low" | "medium" | "high" | "critical";
-  inputSchema: WebsiteConnectorInputSchema;
-  request: {
-    origin: string;
-    method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
-    path: string;
-    query: Record<string, string>;
-    headers: Record<string, string>;
-    body?: unknown;
-  };
-};
-
-export type WebsiteConnectorDefinition = {
-  schemaVersion: "fargo.website-connector/v1";
-  connectorId: string;
-  displayName: string;
-  allowedOrigins: string[];
-  loginUrl?: string;
-  auth: WebsiteConnectorAuth;
-  operations: WebsiteConnectorOperation[];
-};
-
-export const WEBSITE_CONNECTOR_SCHEMA_VERSION: "fargo.website-connector/v1";
-export class WebsiteConnectorDefinitionError extends Error {
-  code: string;
-  path: string;
-}
-export function parseWebsiteConnectorDefinition(value: unknown): WebsiteConnectorDefinition;
-export function connectorToolName(connectorId: string, operationId: string): string;
-export function renderWebsiteOperation(definition: unknown, operationId: string, rawArguments: unknown): {
-  definition: WebsiteConnectorDefinition;
-  operation: WebsiteConnectorOperation;
-  request: { body?: unknown; headers: Record<string, string>; method: string; url: string };
-};
+export * from "@fargowealth/website-connector-runtime";

package/src/website-connector-definition.mjs

@@ -1,339 +1 @@
-const CONNECTOR_ID = /^[a-z][a-z0-9-]{1,62}[a-z0-9]$/;
-const OPERATION_ID = /^[a-z][a-z0-9_]{1,62}[a-z0-9]$/;
-const TEMPLATE_ARGUMENT = /\{\{([a-zA-Z][a-zA-Z0-9_]*)\}\}/g;
-const FORBIDDEN_HEADERS = new Set([
-  "connection",
-  "content-length",
-  "cookie",
-  "host",
-  "proxy-authorization",
-  "transfer-encoding",
-  "upgrade"
-]);
-
-export const WEBSITE_CONNECTOR_SCHEMA_VERSION = "fargo.website-connector/v1";
-
-export class WebsiteConnectorDefinitionError extends Error {
-  constructor(code, path = "") {
-    super(path ? `${code}:${path}` : code);
-    this.name = "WebsiteConnectorDefinitionError";
-    this.code = code;
-    this.path = path;
-  }
-}
-
-export function parseWebsiteConnectorDefinition(value) {
-  const source = record(value, "website_connector_definition_invalid", "/");
-  equal(source.schemaVersion, WEBSITE_CONNECTOR_SCHEMA_VERSION, "website_connector_schema_version_invalid", "/schemaVersion");
-  const connectorId = requiredText(source.connectorId, 64, "website_connector_id_invalid", "/connectorId");
-  if (!CONNECTOR_ID.test(connectorId)) fail("website_connector_id_invalid", "/connectorId");
-  const displayName = requiredText(source.displayName, 120, "website_connector_display_name_invalid", "/displayName");
-  const allowedOrigins = uniqueArray(source.allowedOrigins, 1, 12, "/allowedOrigins").map((origin, index) => (
-    exactHttpsOrigin(origin, "website_connector_origin_invalid", `/allowedOrigins/${index}`)
-  ));
-  const loginUrl = optionalHttpsUrl(source.loginUrl, allowedOrigins, "/loginUrl");
-  const auth = parseAuthRecipe(source.auth, allowedOrigins);
-  if (auth.kind === "browser_storage" && !loginUrl) fail("website_connector_login_url_required", "/loginUrl");
-  const operations = uniqueArray(source.operations, 1, 80, "/operations").map((operation, index) => (
-    parseOperation(operation, allowedOrigins, index)
-  ));
-  const operationIds = new Set();
-  for (const operation of operations) {
-    if (operationIds.has(operation.operationId)) fail("website_operation_id_duplicate", `/operations/${operation.operationId}`);
-    if (operation.requiresConnection && auth.kind !== "browser_storage") {
-      fail("website_operation_connection_auth_required", `/operations/${operation.operationId}/requiresConnection`);
-    }
-    operationIds.add(operation.operationId);
-  }
-  return {
-    schemaVersion: WEBSITE_CONNECTOR_SCHEMA_VERSION,
-    connectorId,
-    displayName,
-    allowedOrigins,
-    ...(loginUrl ? { loginUrl } : {}),
-    auth,
-    operations
-  };
-}
-
-export function connectorToolName(connectorId, operationId) {
-  const left = String(connectorId || "").replaceAll("-", "_");
-  return `${left}_${operationId}`;
-}
-
-export function renderWebsiteOperation(definition, operationId, rawArguments) {
-  const parsed = parseWebsiteConnectorDefinition(definition);
-  const operation = parsed.operations.find((candidate) => candidate.operationId === operationId);
-  if (!operation) fail("website_operation_not_found", "/operationId");
-  const args = record(rawArguments ?? {}, "website_operation_arguments_invalid", "/arguments");
-  validateArguments(args, operation.inputSchema);
-  const path = renderString(operation.request.path, args, "/request/path");
-  const url = new URL(path, `${operation.request.origin}/`);
-  if (url.origin !== operation.request.origin) fail("website_operation_origin_escape", "/request/path");
-  for (const [name, argumentName] of Object.entries(operation.request.query)) {
-    const value = args[argumentName];
-    if (value !== undefined && value !== null) url.searchParams.set(name, scalarText(value, `/arguments/${argumentName}`));
-  }
-  const body = operation.request.body === undefined
-    ? undefined
-    : renderBody(operation.request.body, args, "/request/body");
-  return {
-    definition: parsed,
-    operation,
-    request: {
-      body,
-      headers: { ...operation.request.headers },
-      method: operation.request.method,
-      url: url.toString()
-    }
-  };
-}
-
-function parseAuthRecipe(value, allowedOrigins) {
-  const source = value === undefined ? { kind: "none" } : record(value, "website_auth_recipe_invalid", "/auth");
-  if (source.kind === "none") return { kind: "none" };
-  equal(source.kind, "browser_storage", "website_auth_recipe_invalid", "/auth/kind");
-  const sendCookies = source.sendCookies === true;
-  const headerSources = source.headerSources === undefined
-    ? []
-    : uniqueArray(source.headerSources, 0, 12, "/auth/headerSources").map((item, index) => {
-        const binding = record(item, "website_auth_header_source_invalid", `/auth/headerSources/${index}`);
-        const name = headerName(binding.name, `/auth/headerSources/${index}/name`, true);
-        const origin = exactHttpsOrigin(binding.origin, "website_auth_header_source_invalid", `/auth/headerSources/${index}/origin`);
-        if (!allowedOrigins.includes(origin)) fail("website_auth_origin_not_allowed", `/auth/headerSources/${index}/origin`);
-        const keySuffix = requiredText(binding.keySuffix, 240, "website_auth_header_source_invalid", `/auth/headerSources/${index}/keySuffix`);
-        const prefix = optionalHeaderPrefix(binding.prefix, `/auth/headerSources/${index}/prefix`);
-        return { keySuffix, name, origin, ...(prefix ? { prefix } : {}) };
-      });
-  if (!sendCookies && headerSources.length === 0) fail("website_auth_recipe_empty", "/auth");
-  return { kind: "browser_storage", sendCookies, headerSources };
-}
-
-function parseOperation(value, allowedOrigins, index) {
-  const path = `/operations/${index}`;
-  const source = record(value, "website_operation_invalid", path);
-  const operationId = requiredText(source.operationId, 64, "website_operation_id_invalid", `${path}/operationId`);
-  if (!OPERATION_ID.test(operationId)) fail("website_operation_id_invalid", `${path}/operationId`);
-  const description = requiredText(source.description, 500, "website_operation_description_invalid", `${path}/description`);
-  const readOnly = source.readOnly === true;
-  const requiresConnection = source.requiresConnection === true;
-  const riskLevel = optionalEnum(source.riskLevel, ["low", "medium", "high", "critical"], readOnly ? "low" : "medium", `${path}/riskLevel`);
-  const inputSchema = parseInputSchema(source.inputSchema, `${path}/inputSchema`);
-  const requestSource = record(source.request, "website_operation_request_invalid", `${path}/request`);
-  const origin = exactHttpsOrigin(requestSource.origin, "website_operation_origin_invalid", `${path}/request/origin`);
-  if (!allowedOrigins.includes(origin)) fail("website_operation_origin_not_allowed", `${path}/request/origin`);
-  const method = optionalEnum(requestSource.method, ["GET", "POST", "PUT", "PATCH", "DELETE"], "GET", `${path}/request/method`);
-  if (readOnly && method !== "GET") fail("website_operation_read_only_method_invalid", `${path}/request/method`);
-  const requestPath = requiredText(requestSource.path, 2_000, "website_operation_path_invalid", `${path}/request/path`);
-  if (!requestPath.startsWith("/") || requestPath.startsWith("//") || requestPath.includes("\\")) {
-    fail("website_operation_path_invalid", `${path}/request/path`);
-  }
-  const pathArguments = [...requestPath.matchAll(TEMPLATE_ARGUMENT)].map((match) => match[1]);
-  const properties = record(inputSchema.properties ?? {}, "website_operation_input_schema_invalid", `${path}/inputSchema/properties`);
-  for (const argument of pathArguments) {
-    if (!Object.hasOwn(properties, argument)) fail("website_operation_template_argument_unknown", `${path}/request/path`);
-  }
-  const query = requestSource.query === undefined
-    ? {}
-    : Object.fromEntries(Object.entries(record(requestSource.query, "website_operation_query_invalid", `${path}/request/query`)).map(([name, argument]) => {
-        if (!/^[A-Za-z0-9_.~-]{1,120}$/.test(name)) fail("website_operation_query_name_invalid", `${path}/request/query/${name}`);
-        const argumentName = requiredText(argument, 120, "website_operation_query_argument_invalid", `${path}/request/query/${name}`);
-        if (!Object.hasOwn(properties, argumentName)) fail("website_operation_query_argument_unknown", `${path}/request/query/${name}`);
-        return [name, argumentName];
-      }));
-  const headers = requestSource.headers === undefined
-    ? {}
-    : Object.fromEntries(Object.entries(record(requestSource.headers, "website_operation_headers_invalid", `${path}/request/headers`)).map(([name, headerValue]) => {
-        const normalized = requiredText(headerValue, 500, "website_operation_header_value_invalid", `${path}/request/headers/${name}`);
-        if (/[\r\n\0]/.test(normalized)) fail("website_operation_header_value_invalid", `${path}/request/headers/${name}`);
-        return [headerName(name, `${path}/request/headers/${name}`, false), normalized];
-      }));
-  const body = requestSource.body;
-  if (body !== undefined && method === "GET") fail("website_operation_get_body_invalid", `${path}/request/body`);
-  if (body !== undefined) validateBodyTemplate(body, properties, `${path}/request/body`);
-  return {
-    operationId,
-    description,
-    readOnly,
-    requiresConnection,
-    riskLevel,
-    inputSchema,
-    request: {
-      origin,
-      method,
-      path: requestPath,
-      query,
-      headers,
-      ...(body === undefined ? {} : { body })
-    }
-  };
-}
-
-function optionalHeaderPrefix(value, path) {
-  if (value === undefined || value === null || value === "") return "";
-  if (typeof value !== "string" || value.length > 80 || /[\r\n\0]/.test(value)) {
-    fail("website_auth_header_source_invalid", path);
-  }
-  return value;
-}
-
-function parseInputSchema(value, path) {
-  const source = value === undefined
-    ? { additionalProperties: false, properties: {}, type: "object" }
-    : record(value, "website_operation_input_schema_invalid", path);
-  equal(source.type, "object", "website_operation_input_schema_invalid", `${path}/type`);
-  if (source.additionalProperties !== false) fail("website_operation_input_schema_open", `${path}/additionalProperties`);
-  const properties = record(source.properties ?? {}, "website_operation_input_schema_invalid", `${path}/properties`);
-  const normalizedProperties = {};
-  for (const [name, candidate] of Object.entries(properties)) {
-    if (!/^[A-Za-z][A-Za-z0-9_]{0,119}$/.test(name)) fail("website_operation_input_name_invalid", `${path}/properties/${name}`);
-    const property = record(candidate, "website_operation_input_property_invalid", `${path}/properties/${name}`);
-    const type = optionalEnum(property.type, ["string", "number", "integer", "boolean"], "string", `${path}/properties/${name}/type`);
-    normalizedProperties[name] = {
-      type,
-      ...(typeof property.maxLength === "number" ? { maxLength: boundedInteger(property.maxLength, 1, 20_000, `${path}/properties/${name}/maxLength`) } : {}),
-      ...(Array.isArray(property.enum) ? { enum: property.enum.map((item) => scalar(item, `${path}/properties/${name}/enum`)) } : {})
-    };
-  }
-  const required = source.required === undefined ? [] : uniqueArray(source.required, 0, Object.keys(normalizedProperties).length, `${path}/required`).map(String);
-  for (const name of required) if (!Object.hasOwn(normalizedProperties, name)) fail("website_operation_required_unknown", `${path}/required`);
-  return { additionalProperties: false, properties: normalizedProperties, required, type: "object" };
-}
-
-function validateArguments(args, schema) {
-  for (const required of schema.required) if (!Object.hasOwn(args, required)) fail("website_operation_argument_required", `/arguments/${required}`);
-  for (const [name, value] of Object.entries(args)) {
-    const property = schema.properties[name];
-    if (!property) fail("website_operation_argument_unknown", `/arguments/${name}`);
-    if (property.type === "string" && typeof value !== "string") fail("website_operation_argument_type_invalid", `/arguments/${name}`);
-    if (property.type === "number" && (typeof value !== "number" || !Number.isFinite(value))) fail("website_operation_argument_type_invalid", `/arguments/${name}`);
-    if (property.type === "integer" && !Number.isInteger(value)) fail("website_operation_argument_type_invalid", `/arguments/${name}`);
-    if (property.type === "boolean" && typeof value !== "boolean") fail("website_operation_argument_type_invalid", `/arguments/${name}`);
-    if (property.maxLength && typeof value === "string" && value.length > property.maxLength) fail("website_operation_argument_too_long", `/arguments/${name}`);
-    if (property.enum && !property.enum.some((candidate) => Object.is(candidate, value))) fail("website_operation_argument_enum_invalid", `/arguments/${name}`);
-  }
-}
-
-function validateBodyTemplate(value, properties, path) {
-  if (typeof value === "string") {
-    if (value.startsWith("$") && !Object.hasOwn(properties, value.slice(1))) fail("website_operation_body_argument_unknown", path);
-    return;
-  }
-  if (value === null || typeof value === "number" || typeof value === "boolean") return;
-  if (Array.isArray(value)) {
-    value.forEach((item, index) => validateBodyTemplate(item, properties, `${path}/${index}`));
-    return;
-  }
-  const source = record(value, "website_operation_body_invalid", path);
-  for (const [name, item] of Object.entries(source)) validateBodyTemplate(item, properties, `${path}/${name}`);
-}
-
-function renderBody(value, args, path) {
-  if (typeof value === "string") {
-    if (value.startsWith("$")) return args[value.slice(1)];
-    return renderString(value, args, path);
-  }
-  if (Array.isArray(value)) return value.map((item, index) => renderBody(item, args, `${path}/${index}`));
-  if (value && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([name, item]) => [name, renderBody(item, args, `${path}/${name}`)]));
-  return value;
-}
-
-function renderString(value, args, path) {
-  return String(value).replace(TEMPLATE_ARGUMENT, (_match, name) => encodeURIComponent(scalarText(args[name], `/arguments/${name || path}`)));
-}
-
-function scalarText(value, path) {
-  scalar(value, path);
-  return String(value);
-}
-
-function scalar(value, path) {
-  if (!["string", "number", "boolean"].includes(typeof value) || (typeof value === "number" && !Number.isFinite(value))) {
-    fail("website_operation_argument_scalar_required", path);
-  }
-  return value;
-}
-
-function headerName(value, path, allowAuthorization) {
-  const name = requiredText(value, 100, "website_operation_header_name_invalid", path);
-  const normalized = name.toLowerCase();
-  if (!/^[A-Za-z][A-Za-z0-9-]*$/.test(name) || FORBIDDEN_HEADERS.has(normalized) || (!allowAuthorization && normalized === "authorization")) {
-    fail("website_operation_header_name_invalid", path);
-  }
-  return name;
-}
-
-function exactHttpsOrigin(value, code, path) {
-  const text = requiredText(value, 500, code, path);
-  try {
-    const url = new URL(text);
-    if (url.protocol !== "https:" || url.origin !== text || url.username || url.password || !publicHostname(url.hostname)) fail(code, path);
-    return url.origin;
-  } catch (error) {
-    if (error instanceof WebsiteConnectorDefinitionError) throw error;
-    fail(code, path);
-  }
-}
-
-function publicHostname(value) {
-  const hostname = String(value).toLowerCase().replace(/^\[|\]$/g, "");
-  if (!hostname.includes(".") || /^[0-9.]+$/.test(hostname) || hostname.includes(":")) return false;
-  return !hostname.endsWith(".localhost")
-    && !hostname.endsWith(".local")
-    && !hostname.endsWith(".internal")
-    && hostname !== "metadata.google.internal";
-}
-
-function optionalHttpsUrl(value, allowedOrigins, path) {
-  if (value === undefined || value === null || value === "") return undefined;
-  try {
-    const url = new URL(requiredText(value, 2_000, "website_connector_login_url_invalid", path));
-    if (url.protocol !== "https:" || !allowedOrigins.includes(url.origin) || url.username || url.password || url.hash) fail("website_connector_login_url_invalid", path);
-    return url.toString();
-  } catch (error) {
-    if (error instanceof WebsiteConnectorDefinitionError) throw error;
-    fail("website_connector_login_url_invalid", path);
-  }
-}
-
-function record(value, code, path) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) fail(code, path);
-  return value;
-}
-
-function uniqueArray(value, min, max, path) {
-  if (!Array.isArray(value) || value.length < min || value.length > max) fail("website_connector_array_invalid", path);
-  const serialized = value.map((item) => typeof item === "string" ? item : JSON.stringify(item));
-  if (new Set(serialized).size !== serialized.length) fail("website_connector_array_duplicate", path);
-  return value;
-}
-
-function requiredText(value, max, code, path) {
-  const text = typeof value === "string" ? value.trim() : "";
-  if (!text || text.length > max) fail(code, path);
-  return text;
-}
-
-function optionalText(value, max, code, path) {
-  if (value === undefined || value === null || value === "") return undefined;
-  return requiredText(value, max, code, path);
-}
-
-function optionalEnum(value, allowed, fallback, path) {
-  const candidate = value === undefined ? fallback : value;
-  if (!allowed.includes(candidate)) fail("website_connector_enum_invalid", path);
-  return candidate;
-}
-
-function boundedInteger(value, min, max, path) {
-  if (!Number.isInteger(value) || value < min || value > max) fail("website_connector_integer_invalid", path);
-  return value;
-}
-
-function equal(actual, expected, code, path) {
-  if (actual !== expected) fail(code, path);
-}
-
-function fail(code, path) {
-  throw new WebsiteConnectorDefinitionError(code, path);
-}
+export * from "@fargowealth/website-connector-runtime";