@fargowealth/fargo-ai-cli 1.4.1 → 1.5.0

package/node_modules/@fargowealth/website-connector-runtime/src/index.mjs

@@ -1,825 +0,0 @@
-const CONNECTOR_ID = /^[a-z][a-z0-9-]{1,62}[a-z0-9]$/;
-const OPERATION_ID = /^[a-z][a-z0-9_]{1,62}[a-z0-9]$/;
-const TEMPLATE_ARGUMENT = /\{\{([a-zA-Z][a-zA-Z0-9_]*)\}\}/g;
-const RUNTIME_CAPABILITY = /^[a-z][a-z0-9.-]{1,80}$/;
-const SECRET_SOURCE_ID = /^[a-z][a-z0-9_]{1,62}[a-z0-9]$/;
-const AWS_REGION = /^[a-z]{2}(?:-gov)?-[a-z]+-\d$/;
-const COGNITO_CLIENT_ID = /^[A-Za-z0-9+]{1,128}$/;
-const COGNITO_USER_POOL_ID = /^[a-z]{2}(?:-gov)?-[a-z]+-\d_[A-Za-z0-9]+$/;
-const SEMVER = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
-const MAX_RESPONSE_BYTES = 1_048_576;
-const DEFAULT_REFRESH_LEEWAY_SECONDS = 300;
-const FORBIDDEN_HEADERS = new Set([
-  "connection",
-  "content-length",
-  "cookie",
-  "host",
-  "proxy-authorization",
-  "transfer-encoding",
-  "upgrade"
-]);
-
-export const WEBSITE_CONNECTOR_SCHEMA_VERSION = "fargo.website-connector/v1";
-export const WEBSITE_CONNECTOR_RUNTIME_VERSION = "1.1.0";
-export const WEBSITE_CONNECTOR_RUNTIME_CAPABILITIES = Object.freeze([
-  "auth.browser-storage",
-  "auth.refresh.aws-cognito",
-  "request.http",
-  "request.json-body",
-  "request.write",
-  "response.auto",
-  "response.json",
-  "response.text"
-]);
-
-export class WebsiteConnectorDefinitionError extends Error {
-  constructor(code, path = "") {
-    super(path ? `${code}:${path}` : code);
-    this.name = "WebsiteConnectorDefinitionError";
-    this.code = code;
-    this.path = path;
-  }
-}
-
-export class WebsiteConnectorRuntimeError extends Error {
-  constructor(status, code, details) {
-    super(code);
-    this.name = "WebsiteConnectorRuntimeError";
-    this.status = status;
-    this.code = code;
-    this.details = details;
-  }
-}
-
-export function parseWebsiteConnectorDefinition(value) {
-  const source = record(value, "website_connector_definition_invalid", "/");
-  equal(source.schemaVersion, WEBSITE_CONNECTOR_SCHEMA_VERSION, "website_connector_schema_version_invalid", "/schemaVersion");
-  const connectorId = requiredText(source.connectorId, 64, "website_connector_id_invalid", "/connectorId");
-  if (!CONNECTOR_ID.test(connectorId)) fail("website_connector_id_invalid", "/connectorId");
-  const displayName = requiredText(source.displayName, 120, "website_connector_display_name_invalid", "/displayName");
-  const allowedOrigins = uniqueArray(source.allowedOrigins, 1, 12, "/allowedOrigins").map((origin, index) => (
-    exactHttpsOrigin(origin, "website_connector_origin_invalid", `/allowedOrigins/${index}`)
-  ));
-  const loginUrl = optionalHttpsUrl(source.loginUrl, allowedOrigins, "/loginUrl");
-  const auth = parseAuthRecipe(source.auth, allowedOrigins);
-  const runtime = parseRuntimeRequirements(source.runtime);
-  if (auth.kind === "browser_storage" && !loginUrl) fail("website_connector_login_url_required", "/loginUrl");
-  const operations = uniqueArray(source.operations, 1, 80, "/operations").map((operation, index) => (
-    parseOperation(operation, allowedOrigins, index)
-  ));
-  const operationIds = new Set();
-  for (const operation of operations) {
-    if (operationIds.has(operation.operationId)) fail("website_operation_id_duplicate", `/operations/${operation.operationId}`);
-    if (operation.requiresConnection && auth.kind !== "browser_storage") {
-      fail("website_operation_connection_auth_required", `/operations/${operation.operationId}/requiresConnection`);
-    }
-    operationIds.add(operation.operationId);
-  }
-  return {
-    schemaVersion: WEBSITE_CONNECTOR_SCHEMA_VERSION,
-    connectorId,
-    displayName,
-    allowedOrigins,
-    ...(loginUrl ? { loginUrl } : {}),
-    ...(runtime ? { runtime } : {}),
-    auth,
-    operations
-  };
-}
-
-export function connectorToolName(connectorId, operationId) {
-  const left = String(connectorId || "").replaceAll("-", "_");
-  return `${left}_${operationId}`;
-}
-
-export function renderWebsiteOperation(definition, operationId, rawArguments) {
-  const parsed = parseWebsiteConnectorDefinition(definition);
-  const operation = parsed.operations.find((candidate) => candidate.operationId === operationId);
-  if (!operation) fail("website_operation_not_found", "/operationId");
-  const args = record(rawArguments ?? {}, "website_operation_arguments_invalid", "/arguments");
-  validateArguments(args, operation.inputSchema);
-  const path = renderString(operation.request.path, args, "/request/path");
-  const url = new URL(path, `${operation.request.origin}/`);
-  if (url.origin !== operation.request.origin) fail("website_operation_origin_escape", "/request/path");
-  for (const [name, argumentName] of Object.entries(operation.request.query)) {
-    const value = args[argumentName];
-    if (value !== undefined && value !== null) url.searchParams.set(name, scalarText(value, `/arguments/${argumentName}`));
-  }
-  const body = operation.request.body === undefined
-    ? undefined
-    : renderBody(operation.request.body, args, "/request/body");
-  return {
-    definition: parsed,
-    operation,
-    request: {
-      body,
-      headers: { ...operation.request.headers },
-      method: operation.request.method,
-      responseMode: operation.request.responseMode,
-      url: url.toString()
-    }
-  };
-}
-
-export function websiteConnectorRuntimeDescriptor() {
-  return {
-    capabilities: [...WEBSITE_CONNECTOR_RUNTIME_CAPABILITIES],
-    runtimeVersion: WEBSITE_CONNECTOR_RUNTIME_VERSION
-  };
-}
-
-export function requiredWebsiteConnectorCapabilities(definition) {
-  const parsed = parseWebsiteConnectorDefinition(definition);
-  const required = new Set(["request.http"]);
-  if (parsed.auth.kind === "browser_storage") required.add("auth.browser-storage");
-  if (parsed.auth.kind === "browser_storage" && parsed.auth.refresh?.kind === "aws_cognito") {
-    required.add("auth.refresh.aws-cognito");
-  }
-  for (const operation of parsed.operations) {
-    required.add(`response.${operation.request.responseMode}`);
-    if (operation.request.body !== undefined) required.add("request.json-body");
-    if (operation.request.method !== "GET") required.add("request.write");
-  }
-  for (const capability of parsed.runtime?.requiredCapabilities ?? []) required.add(capability);
-  return [...required].sort();
-}
-
-export function assertWebsiteConnectorRuntimeCompatibility(definition, descriptor = websiteConnectorRuntimeDescriptor()) {
-  const parsed = parseWebsiteConnectorDefinition(definition);
-  const version = String(descriptor?.runtimeVersion || "");
-  const capabilities = new Set(Array.isArray(descriptor?.capabilities) ? descriptor.capabilities : []);
-  if (!SEMVER.test(version)) throw new WebsiteConnectorRuntimeError(500, "website_runtime_descriptor_invalid");
-  if (parsed.runtime?.minimumVersion && compareSemver(version, parsed.runtime.minimumVersion) < 0) {
-    throw new WebsiteConnectorRuntimeError(409, "website_runtime_version_incompatible", {
-      installedVersion: version,
-      minimumVersion: parsed.runtime.minimumVersion
-    });
-  }
-  const missingCapabilities = requiredWebsiteConnectorCapabilities(parsed).filter((capability) => !capabilities.has(capability));
-  if (missingCapabilities.length > 0) {
-    throw new WebsiteConnectorRuntimeError(409, "website_runtime_capability_missing", { missingCapabilities });
-  }
-  return { definition: parsed, descriptor: { capabilities: [...capabilities].sort(), runtimeVersion: version } };
-}
-
-export async function executeWebsiteConnectorOperation(definition, operationId, args, options = {}) {
-  assertWebsiteConnectorRuntimeCompatibility(definition, options.runtimeDescriptor);
-  let rendered;
-  try {
-    rendered = renderWebsiteOperation(definition, operationId, args);
-  } catch (error) {
-    const code = error instanceof WebsiteConnectorDefinitionError ? error.code : "website_operation_invalid";
-    throw new WebsiteConnectorRuntimeError(code === "website_operation_not_found" ? 404 : 400, code);
-  }
-  if (options.readOnlyOnly && !rendered.operation.readOnly) {
-    throw new WebsiteConnectorRuntimeError(409, "website_operation_not_read_only");
-  }
-  if (rendered.operation.requiresConnection && !options.storageState) {
-    throw new WebsiteConnectorRuntimeError(409, "browser_connection_required");
-  }
-  const headers = new Headers(rendered.request.headers);
-  if (rendered.operation.requiresConnection) {
-    applyBrowserAuthentication(headers, rendered.definition.auth, options.storageState, rendered.request.url);
-  }
-  let body;
-  if (rendered.request.body !== undefined) {
-    body = JSON.stringify(rendered.request.body);
-    if (!headers.has("content-type")) headers.set("Content-Type", "application/json");
-  }
-  let response;
-  try {
-    response = await (options.fetchImpl ?? fetch)(rendered.request.url, {
-      body,
-      headers,
-      method: rendered.request.method,
-      redirect: "manual",
-      signal: AbortSignal.timeout(options.timeoutMs ?? 30_000)
-    });
-  } catch {
-    throw new WebsiteConnectorRuntimeError(502, "website_operation_upstream_unavailable");
-  }
-  if (response.status >= 300 && response.status < 400) {
-    throw new WebsiteConnectorRuntimeError(409, "website_operation_redirect_forbidden");
-  }
-  if (response.status === 401 || response.status === 403) {
-    throw new WebsiteConnectorRuntimeError(409, "browser_connection_needs_reauth");
-  }
-  const raw = await readLimitedBody(response);
-  const contentType = response.headers.get("content-type")?.toLowerCase() || "";
-  let data = raw;
-  const parseJson = rendered.request.responseMode === "json"
-    || (rendered.request.responseMode === "auto" && contentType.includes("json"));
-  if (parseJson && raw) {
-    try { data = JSON.parse(raw); }
-    catch { throw new WebsiteConnectorRuntimeError(502, "website_operation_upstream_json_invalid"); }
-  }
-  const result = {
-    connectorId: rendered.definition.connectorId,
-    data,
-    fetchedAt: new Date().toISOString(),
-    ok: response.ok,
-    operationId: rendered.operation.operationId,
-    runtime: websiteConnectorRuntimeDescriptor(),
-    status: response.status
-  };
-  return options.storageState ? sanitizeWebsiteConnectorOutput(result, options.storageState) : result;
-}
-
-export function browserStorageAuthenticated(state, auth, now = Date.now()) {
-  if (auth.kind !== "browser_storage") return true;
-  const seconds = now / 1000;
-  const hasCookie = !auth.sendCookies || state.cookies.some((cookie) => cookie.expires === undefined || cookie.expires < 0 || cookie.expires > seconds);
-  const hasHeaderValues = auth.headerSources.every((source) => storageValue(state, source.origin, source.keySuffix) !== undefined);
-  const headersUnexpired = auth.headerSources.every((source) => {
-    const value = storageValue(state, source.origin, source.keySuffix);
-    return value !== undefined && credentialUnexpired(value, seconds);
-  });
-  const hasRefreshSecrets = !auth.refresh || auth.secretSources.every((source) => (
-    storageValue(state, source.origin, source.keySuffix) !== undefined
-  ));
-  return hasCookie && hasHeaderValues && hasRefreshSecrets && (headersUnexpired || Boolean(auth.refresh));
-}
-
-export async function refreshWebsiteConnectorAuthentication(definition, storageState, options = {}) {
-  const parsed = parseWebsiteConnectorDefinition(definition);
-  if (parsed.auth.kind !== "browser_storage") {
-    return { refreshed: false, storageState };
-  }
-  const auth = parsed.auth;
-  const now = options.now?.() ?? Date.now();
-  const leewaySeconds = auth.refresh?.leewaySeconds ?? DEFAULT_REFRESH_LEEWAY_SECONDS;
-  const shouldRefresh = auth.refresh
-    ? !cognitoStoredTokenValid(storageState, auth.refresh.idTokenSource, auth.refresh, "id", now, leewaySeconds)
-      || !cognitoStoredTokenValid(storageState, auth.refresh.accessTokenSource, auth.refresh, "access", now, leewaySeconds)
-    : auth.headerSources.some((source) => {
-        const value = storageValue(storageState, source.origin, source.keySuffix);
-        return value === undefined || !credentialUnexpired(value, now / 1000, leewaySeconds);
-      });
-  if (!shouldRefresh) return { refreshed: false, storageState };
-  if (!auth.refresh) throw new WebsiteConnectorRuntimeError(409, "browser_connection_needs_reauth");
-  return refreshAwsCognitoAuthentication(auth, storageState, { ...options, now });
-}
-
-export function sanitizeWebsiteConnectorOutput(value, storageState) {
-  const secrets = [
-    ...array(storageState?.cookies).map((cookie) => String(cookie?.value || "")),
-    ...array(storageState?.origins).flatMap((origin) => array(origin?.localStorage).map((item) => String(item?.value || "")))
-  ].filter((item) => item.length >= 4);
-  return sanitizeOutputValue(value, secrets, 0);
-}
-
-function parseRuntimeRequirements(value) {
-  if (value === undefined || value === null) return undefined;
-  const source = record(value, "website_runtime_requirements_invalid", "/runtime");
-  const minimumVersion = requiredText(source.minimumVersion, 40, "website_runtime_version_invalid", "/runtime/minimumVersion");
-  if (!SEMVER.test(minimumVersion)) fail("website_runtime_version_invalid", "/runtime/minimumVersion");
-  const requiredCapabilities = uniqueArray(source.requiredCapabilities ?? [], 0, 32, "/runtime/requiredCapabilities")
-    .map((item, index) => {
-      const capability = requiredText(item, 80, "website_runtime_capability_invalid", `/runtime/requiredCapabilities/${index}`);
-      if (!RUNTIME_CAPABILITY.test(capability)) fail("website_runtime_capability_invalid", `/runtime/requiredCapabilities/${index}`);
-      return capability;
-    }).sort();
-  return { minimumVersion, requiredCapabilities };
-}
-
-function parseAuthRecipe(value, allowedOrigins) {
-  const source = value === undefined ? { kind: "none" } : record(value, "website_auth_recipe_invalid", "/auth");
-  if (source.kind === "none") return { kind: "none" };
-  equal(source.kind, "browser_storage", "website_auth_recipe_invalid", "/auth/kind");
-  const sendCookies = source.sendCookies === true;
-  const headerSources = source.headerSources === undefined
-    ? []
-    : uniqueArray(source.headerSources, 0, 12, "/auth/headerSources").map((item, index) => {
-        const binding = record(item, "website_auth_header_source_invalid", `/auth/headerSources/${index}`);
-        const name = headerName(binding.name, `/auth/headerSources/${index}/name`, true);
-        const origin = exactHttpsOrigin(binding.origin, "website_auth_header_source_invalid", `/auth/headerSources/${index}/origin`);
-        if (!allowedOrigins.includes(origin)) fail("website_auth_origin_not_allowed", `/auth/headerSources/${index}/origin`);
-        const keySuffix = requiredText(binding.keySuffix, 240, "website_auth_header_source_invalid", `/auth/headerSources/${index}/keySuffix`);
-        const prefix = optionalHeaderPrefix(binding.prefix, `/auth/headerSources/${index}/prefix`);
-        return { keySuffix, name, origin, ...(prefix ? { prefix } : {}) };
-      });
-  const secretSources = source.secretSources === undefined
-    ? []
-    : uniqueArray(source.secretSources, 0, 12, "/auth/secretSources").map((item, index) => {
-        const binding = record(item, "website_auth_secret_source_invalid", `/auth/secretSources/${index}`);
-        const id = requiredText(binding.id, 64, "website_auth_secret_source_invalid", `/auth/secretSources/${index}/id`);
-        if (!SECRET_SOURCE_ID.test(id)) fail("website_auth_secret_source_invalid", `/auth/secretSources/${index}/id`);
-        const origin = exactHttpsOrigin(binding.origin, "website_auth_secret_source_invalid", `/auth/secretSources/${index}/origin`);
-        if (!allowedOrigins.includes(origin)) fail("website_auth_origin_not_allowed", `/auth/secretSources/${index}/origin`);
-        const keySuffix = requiredText(binding.keySuffix, 240, "website_auth_secret_source_invalid", `/auth/secretSources/${index}/keySuffix`);
-        return { id, keySuffix, origin };
-      });
-  if (new Set(secretSources.map((item) => item.id)).size !== secretSources.length) {
-    fail("website_auth_secret_source_duplicate", "/auth/secretSources");
-  }
-  const refresh = parseRefreshRecipe(source.refresh, { headerSources, secretSources });
-  if (!refresh && secretSources.length > 0) fail("website_auth_secret_source_unused", "/auth/secretSources");
-  if (refresh && secretSources.some((item) => item.id !== refresh.refreshTokenSource)) {
-    fail("website_auth_secret_source_unused", "/auth/secretSources");
-  }
-  if (!sendCookies && headerSources.length === 0) fail("website_auth_recipe_empty", "/auth");
-  return {
-    kind: "browser_storage",
-    sendCookies,
-    headerSources,
-    secretSources,
-    ...(refresh ? { refresh } : {})
-  };
-}
-
-function parseRefreshRecipe(value, sources) {
-  if (value === undefined || value === null) return undefined;
-  const source = record(value, "website_auth_refresh_invalid", "/auth/refresh");
-  equal(source.kind, "aws_cognito", "website_auth_refresh_invalid", "/auth/refresh/kind");
-  const clientId = requiredText(source.clientId, 128, "website_auth_refresh_invalid", "/auth/refresh/clientId");
-  if (!COGNITO_CLIENT_ID.test(clientId)) fail("website_auth_refresh_invalid", "/auth/refresh/clientId");
-  const region = requiredText(source.region, 40, "website_auth_refresh_invalid", "/auth/refresh/region");
-  if (!AWS_REGION.test(region)) fail("website_auth_refresh_invalid", "/auth/refresh/region");
-  const userPoolId = requiredText(source.userPoolId, 128, "website_auth_refresh_invalid", "/auth/refresh/userPoolId");
-  if (!COGNITO_USER_POOL_ID.test(userPoolId) || !userPoolId.startsWith(`${region}_`)) {
-    fail("website_auth_refresh_invalid", "/auth/refresh/userPoolId");
-  }
-  const refreshTokenSource = requiredText(source.refreshTokenSource, 64, "website_auth_refresh_invalid", "/auth/refresh/refreshTokenSource");
-  const secret = sources.secretSources.find((candidate) => candidate.id === refreshTokenSource);
-  if (!secret) fail("website_auth_refresh_source_unknown", "/auth/refresh/refreshTokenSource");
-  const idTokenSource = parseRefreshTokenTarget(source.idTokenSource, sources.headerSources, "/auth/refresh/idTokenSource");
-  const accessTokenSource = parseRefreshTokenTarget(source.accessTokenSource, sources.headerSources, "/auth/refresh/accessTokenSource");
-  const leewaySeconds = source.leewaySeconds === undefined
-    ? DEFAULT_REFRESH_LEEWAY_SECONDS
-    : boundedInteger(source.leewaySeconds, 30, 3_600, "/auth/refresh/leewaySeconds");
-  return {
-    kind: "aws_cognito",
-    clientId,
-    region,
-    userPoolId,
-    refreshTokenSource,
-    idTokenSource,
-    accessTokenSource,
-    leewaySeconds
-  };
-}
-
-function parseRefreshTokenTarget(value, headerSources, path) {
-  const source = record(value, "website_auth_refresh_invalid", path);
-  const origin = exactHttpsOrigin(source.origin, "website_auth_refresh_invalid", `${path}/origin`);
-  const keySuffix = requiredText(source.keySuffix, 240, "website_auth_refresh_invalid", `${path}/keySuffix`);
-  if (!headerSources.some((candidate) => candidate.origin === origin && candidate.keySuffix === keySuffix)) {
-    fail("website_auth_refresh_target_unknown", path);
-  }
-  return { keySuffix, origin };
-}
-
-function parseOperation(value, allowedOrigins, index) {
-  const path = `/operations/${index}`;
-  const source = record(value, "website_operation_invalid", path);
-  const operationId = requiredText(source.operationId, 64, "website_operation_id_invalid", `${path}/operationId`);
-  if (!OPERATION_ID.test(operationId)) fail("website_operation_id_invalid", `${path}/operationId`);
-  const description = requiredText(source.description, 500, "website_operation_description_invalid", `${path}/description`);
-  const readOnly = source.readOnly === true;
-  const requiresConnection = source.requiresConnection === true;
-  const riskLevel = optionalEnum(source.riskLevel, ["low", "medium", "high", "critical"], readOnly ? "low" : "medium", `${path}/riskLevel`);
-  const inputSchema = parseInputSchema(source.inputSchema, `${path}/inputSchema`);
-  const requestSource = record(source.request, "website_operation_request_invalid", `${path}/request`);
-  const origin = exactHttpsOrigin(requestSource.origin, "website_operation_origin_invalid", `${path}/request/origin`);
-  if (!allowedOrigins.includes(origin)) fail("website_operation_origin_not_allowed", `${path}/request/origin`);
-  const method = optionalEnum(requestSource.method, ["GET", "POST", "PUT", "PATCH", "DELETE"], "GET", `${path}/request/method`);
-  const responseMode = optionalEnum(requestSource.responseMode, ["auto", "json", "text"], "auto", `${path}/request/responseMode`);
-  if (readOnly && method !== "GET") fail("website_operation_read_only_method_invalid", `${path}/request/method`);
-  const requestPath = requiredText(requestSource.path, 2_000, "website_operation_path_invalid", `${path}/request/path`);
-  if (!requestPath.startsWith("/") || requestPath.startsWith("//") || requestPath.includes("\\")) {
-    fail("website_operation_path_invalid", `${path}/request/path`);
-  }
-  const pathArguments = [...requestPath.matchAll(TEMPLATE_ARGUMENT)].map((match) => match[1]);
-  const properties = record(inputSchema.properties ?? {}, "website_operation_input_schema_invalid", `${path}/inputSchema/properties`);
-  for (const argument of pathArguments) {
-    if (!Object.hasOwn(properties, argument)) fail("website_operation_template_argument_unknown", `${path}/request/path`);
-  }
-  const query = requestSource.query === undefined
-    ? {}
-    : Object.fromEntries(Object.entries(record(requestSource.query, "website_operation_query_invalid", `${path}/request/query`)).map(([name, argument]) => {
-        if (!/^[A-Za-z0-9_.~-]{1,120}$/.test(name)) fail("website_operation_query_name_invalid", `${path}/request/query/${name}`);
-        const argumentName = requiredText(argument, 120, "website_operation_query_argument_invalid", `${path}/request/query/${name}`);
-        if (!Object.hasOwn(properties, argumentName)) fail("website_operation_query_argument_unknown", `${path}/request/query/${name}`);
-        return [name, argumentName];
-      }));
-  const headers = requestSource.headers === undefined
-    ? {}
-    : Object.fromEntries(Object.entries(record(requestSource.headers, "website_operation_headers_invalid", `${path}/request/headers`)).map(([name, headerValue]) => {
-        const normalized = requiredText(headerValue, 500, "website_operation_header_value_invalid", `${path}/request/headers/${name}`);
-        if (/[\r\n\0]/.test(normalized)) fail("website_operation_header_value_invalid", `${path}/request/headers/${name}`);
-        return [headerName(name, `${path}/request/headers/${name}`, false), normalized];
-      }));
-  const body = requestSource.body;
-  if (body !== undefined && method === "GET") fail("website_operation_get_body_invalid", `${path}/request/body`);
-  if (body !== undefined) validateBodyTemplate(body, properties, `${path}/request/body`);
-  return {
-    operationId,
-    description,
-    readOnly,
-    requiresConnection,
-    riskLevel,
-    inputSchema,
-    request: {
-      origin,
-      method,
-      path: requestPath,
-      query,
-      headers,
-      responseMode,
-      ...(body === undefined ? {} : { body })
-    }
-  };
-}
-
-function optionalHeaderPrefix(value, path) {
-  if (value === undefined || value === null || value === "") return "";
-  if (typeof value !== "string" || value.length > 80 || /[\r\n\0]/.test(value)) {
-    fail("website_auth_header_source_invalid", path);
-  }
-  return value;
-}
-
-function parseInputSchema(value, path) {
-  const source = value === undefined
-    ? { additionalProperties: false, properties: {}, type: "object" }
-    : record(value, "website_operation_input_schema_invalid", path);
-  equal(source.type, "object", "website_operation_input_schema_invalid", `${path}/type`);
-  if (source.additionalProperties !== false) fail("website_operation_input_schema_open", `${path}/additionalProperties`);
-  const properties = record(source.properties ?? {}, "website_operation_input_schema_invalid", `${path}/properties`);
-  const normalizedProperties = {};
-  for (const [name, candidate] of Object.entries(properties)) {
-    if (!/^[A-Za-z][A-Za-z0-9_]{0,119}$/.test(name)) fail("website_operation_input_name_invalid", `${path}/properties/${name}`);
-    const property = record(candidate, "website_operation_input_property_invalid", `${path}/properties/${name}`);
-    const type = optionalEnum(property.type, ["string", "number", "integer", "boolean"], "string", `${path}/properties/${name}/type`);
-    normalizedProperties[name] = {
-      type,
-      ...(typeof property.maxLength === "number" ? { maxLength: boundedInteger(property.maxLength, 1, 20_000, `${path}/properties/${name}/maxLength`) } : {}),
-      ...(Array.isArray(property.enum) ? { enum: property.enum.map((item) => scalar(item, `${path}/properties/${name}/enum`)) } : {})
-    };
-  }
-  const required = source.required === undefined ? [] : uniqueArray(source.required, 0, Object.keys(normalizedProperties).length, `${path}/required`).map(String);
-  for (const name of required) if (!Object.hasOwn(normalizedProperties, name)) fail("website_operation_required_unknown", `${path}/required`);
-  return { additionalProperties: false, properties: normalizedProperties, required, type: "object" };
-}
-
-function validateArguments(args, schema) {
-  for (const required of schema.required) if (!Object.hasOwn(args, required)) fail("website_operation_argument_required", `/arguments/${required}`);
-  for (const [name, value] of Object.entries(args)) {
-    const property = schema.properties[name];
-    if (!property) fail("website_operation_argument_unknown", `/arguments/${name}`);
-    if (property.type === "string" && typeof value !== "string") fail("website_operation_argument_type_invalid", `/arguments/${name}`);
-    if (property.type === "number" && (typeof value !== "number" || !Number.isFinite(value))) fail("website_operation_argument_type_invalid", `/arguments/${name}`);
-    if (property.type === "integer" && !Number.isInteger(value)) fail("website_operation_argument_type_invalid", `/arguments/${name}`);
-    if (property.type === "boolean" && typeof value !== "boolean") fail("website_operation_argument_type_invalid", `/arguments/${name}`);
-    if (property.maxLength && typeof value === "string" && value.length > property.maxLength) fail("website_operation_argument_too_long", `/arguments/${name}`);
-    if (property.enum && !property.enum.some((candidate) => Object.is(candidate, value))) fail("website_operation_argument_enum_invalid", `/arguments/${name}`);
-  }
-}
-
-function validateBodyTemplate(value, properties, path) {
-  if (typeof value === "string") {
-    if (value.startsWith("$") && !Object.hasOwn(properties, value.slice(1))) fail("website_operation_body_argument_unknown", path);
-    return;
-  }
-  if (value === null || typeof value === "number" || typeof value === "boolean") return;
-  if (Array.isArray(value)) {
-    value.forEach((item, index) => validateBodyTemplate(item, properties, `${path}/${index}`));
-    return;
-  }
-  const source = record(value, "website_operation_body_invalid", path);
-  for (const [name, item] of Object.entries(source)) validateBodyTemplate(item, properties, `${path}/${name}`);
-}
-
-function renderBody(value, args, path) {
-  if (typeof value === "string") {
-    if (value.startsWith("$")) return args[value.slice(1)];
-    return renderString(value, args, path);
-  }
-  if (Array.isArray(value)) return value.map((item, index) => renderBody(item, args, `${path}/${index}`));
-  if (value && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([name, item]) => [name, renderBody(item, args, `${path}/${name}`)]));
-  return value;
-}
-
-function renderString(value, args, path) {
-  return String(value).replace(TEMPLATE_ARGUMENT, (_match, name) => encodeURIComponent(scalarText(args[name], `/arguments/${name || path}`)));
-}
-
-function scalarText(value, path) {
-  scalar(value, path);
-  return String(value);
-}
-
-function scalar(value, path) {
-  if (!["string", "number", "boolean"].includes(typeof value) || (typeof value === "number" && !Number.isFinite(value))) {
-    fail("website_operation_argument_scalar_required", path);
-  }
-  return value;
-}
-
-function headerName(value, path, allowAuthorization) {
-  const name = requiredText(value, 100, "website_operation_header_name_invalid", path);
-  const normalized = name.toLowerCase();
-  if (!/^[A-Za-z][A-Za-z0-9-]*$/.test(name) || FORBIDDEN_HEADERS.has(normalized) || (!allowAuthorization && normalized === "authorization")) {
-    fail("website_operation_header_name_invalid", path);
-  }
-  return name;
-}
-
-function exactHttpsOrigin(value, code, path) {
-  const text = requiredText(value, 500, code, path);
-  try {
-    const url = new URL(text);
-    if (url.protocol !== "https:" || url.origin !== text || url.username || url.password || !publicHostname(url.hostname)) fail(code, path);
-    return url.origin;
-  } catch (error) {
-    if (error instanceof WebsiteConnectorDefinitionError) throw error;
-    fail(code, path);
-  }
-}
-
-function publicHostname(value) {
-  const hostname = String(value).toLowerCase().replace(/^\[|\]$/g, "");
-  if (!hostname.includes(".") || /^[0-9.]+$/.test(hostname) || hostname.includes(":")) return false;
-  return !hostname.endsWith(".localhost")
-    && !hostname.endsWith(".local")
-    && !hostname.endsWith(".internal")
-    && hostname !== "metadata.google.internal";
-}
-
-function optionalHttpsUrl(value, allowedOrigins, path) {
-  if (value === undefined || value === null || value === "") return undefined;
-  try {
-    const url = new URL(requiredText(value, 2_000, "website_connector_login_url_invalid", path));
-    if (url.protocol !== "https:" || !allowedOrigins.includes(url.origin) || url.username || url.password || url.hash) fail("website_connector_login_url_invalid", path);
-    return url.toString();
-  } catch (error) {
-    if (error instanceof WebsiteConnectorDefinitionError) throw error;
-    fail("website_connector_login_url_invalid", path);
-  }
-}
-
-function record(value, code, path) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) fail(code, path);
-  return value;
-}
-
-function uniqueArray(value, min, max, path) {
-  if (!Array.isArray(value) || value.length < min || value.length > max) fail("website_connector_array_invalid", path);
-  const serialized = value.map((item) => typeof item === "string" ? item : JSON.stringify(item));
-  if (new Set(serialized).size !== serialized.length) fail("website_connector_array_duplicate", path);
-  return value;
-}
-
-function requiredText(value, max, code, path) {
-  const text = typeof value === "string" ? value.trim() : "";
-  if (!text || text.length > max) fail(code, path);
-  return text;
-}
-
-function optionalText(value, max, code, path) {
-  if (value === undefined || value === null || value === "") return undefined;
-  return requiredText(value, max, code, path);
-}
-
-function optionalEnum(value, allowed, fallback, path) {
-  const candidate = value === undefined ? fallback : value;
-  if (!allowed.includes(candidate)) fail("website_connector_enum_invalid", path);
-  return candidate;
-}
-
-function boundedInteger(value, min, max, path) {
-  if (!Number.isInteger(value) || value < min || value > max) fail("website_connector_integer_invalid", path);
-  return value;
-}
-
-function equal(actual, expected, code, path) {
-  if (actual !== expected) fail(code, path);
-}
-
-function compareSemver(left, right) {
-  const a = left.split(".").map(Number);
-  const b = right.split(".").map(Number);
-  for (let index = 0; index < 3; index += 1) {
-    if (a[index] !== b[index]) return a[index] < b[index] ? -1 : 1;
-  }
-  return 0;
-}
-
-async function refreshAwsCognitoAuthentication(auth, storageState, options) {
-  const refresh = auth.refresh;
-  const secretSource = auth.secretSources.find((source) => source.id === refresh.refreshTokenSource);
-  const refreshToken = secretSource
-    ? storageValue(storageState, secretSource.origin, secretSource.keySuffix)
-    : undefined;
-  if (!refreshToken) throw new WebsiteConnectorRuntimeError(409, "browser_connection_needs_reauth");
-  const endpoint = `https://cognito-idp.${refresh.region}.amazonaws.com/`;
-  let response;
-  try {
-    response = await (options.fetchImpl ?? fetch)(endpoint, {
-      body: JSON.stringify({ ClientId: refresh.clientId, RefreshToken: refreshToken }),
-      headers: {
-        "Content-Type": "application/x-amz-json-1.0",
-        "X-Amz-Target": "AWSCognitoIdentityProviderService.GetTokensFromRefreshToken"
-      },
-      method: "POST",
-      redirect: "manual",
-      signal: AbortSignal.timeout(options.timeoutMs ?? 15_000)
-    });
-  } catch {
-    throw new WebsiteConnectorRuntimeError(502, "website_auth_refresh_unavailable");
-  }
-  if (response.status >= 300 && response.status < 400) {
-    throw new WebsiteConnectorRuntimeError(502, "website_auth_refresh_redirect_forbidden");
-  }
-  let payload;
-  try {
-    const raw = await readLimitedBody(response);
-    payload = raw ? JSON.parse(raw) : {};
-  } catch (error) {
-    if (error instanceof WebsiteConnectorRuntimeError && error.code === "website_operation_response_too_large") {
-      throw new WebsiteConnectorRuntimeError(502, "website_auth_refresh_response_invalid");
-    }
-    throw new WebsiteConnectorRuntimeError(502, "website_auth_refresh_response_invalid");
-  }
-  if (!response.ok) {
-    const errorType = String(payload?.__type || payload?.code || "").split("#").at(-1);
-    if (["NotAuthorizedException", "UserNotFoundException", "PasswordResetRequiredException"].includes(errorType)) {
-      throw new WebsiteConnectorRuntimeError(409, "browser_connection_needs_reauth");
-    }
-    throw new WebsiteConnectorRuntimeError(502, "website_auth_refresh_unavailable");
-  }
-  const result = payload?.AuthenticationResult;
-  const idToken = typeof result?.IdToken === "string" ? result.IdToken : "";
-  const accessToken = typeof result?.AccessToken === "string" ? result.AccessToken : "";
-  assertCognitoToken(idToken, refresh, "id", options.now);
-  assertCognitoToken(accessToken, refresh, "access", options.now);
-  let nextState = replaceStorageValue(storageState, refresh.idTokenSource, idToken);
-  nextState = replaceStorageValue(nextState, refresh.accessTokenSource, accessToken);
-  if (typeof result?.RefreshToken === "string" && result.RefreshToken) {
-    nextState = replaceStorageValue(nextState, secretSource, result.RefreshToken);
-  }
-  return { refreshed: true, storageState: nextState };
-}
-
-function assertCognitoToken(value, refresh, tokenUse, now) {
-  if (!cognitoTokenValid(value, refresh, tokenUse, now, 30)) {
-    throw new WebsiteConnectorRuntimeError(502, "website_auth_refresh_response_invalid");
-  }
-}
-
-function cognitoStoredTokenValid(state, source, refresh, tokenUse, now, leewaySeconds) {
-  const value = storageValue(state, source.origin, source.keySuffix);
-  return cognitoTokenValid(value, refresh, tokenUse, now, leewaySeconds);
-}
-
-function cognitoTokenValid(value, refresh, tokenUse, now, leewaySeconds) {
-  const claims = jwtClaims(value);
-  const issuer = `https://cognito-idp.${refresh.region}.amazonaws.com/${refresh.userPoolId}`;
-  const clientMatches = tokenUse === "id"
-    ? claims?.aud === refresh.clientId
-    : claims?.client_id === refresh.clientId;
-  return Boolean(
-    claims
-    && claims.iss === issuer
-    && claims.token_use === tokenUse
-    && clientMatches
-    && typeof claims.exp === "number"
-    && claims.exp > now / 1000 + leewaySeconds
-  );
-}
-
-function replaceStorageValue(state, source, value) {
-  let matches = 0;
-  const origins = array(state?.origins).map((origin) => {
-    if (origin?.origin !== source.origin) return {
-      ...origin,
-      localStorage: array(origin?.localStorage).map((item) => ({ ...item }))
-    };
-    return {
-      ...origin,
-      localStorage: array(origin?.localStorage).map((item) => {
-        if (!String(item?.name || "").endsWith(source.keySuffix)) return { ...item };
-        matches += 1;
-        return { ...item, value };
-      })
-    };
-  });
-  if (matches !== 1) throw new WebsiteConnectorRuntimeError(409, "browser_connection_needs_reauth");
-  return {
-    cookies: array(state?.cookies).map((cookie) => ({ ...cookie })),
-    origins
-  };
-}
-
-function applyBrowserAuthentication(headers, auth, state, requestUrl) {
-  if (auth.kind !== "browser_storage") {
-    throw new WebsiteConnectorRuntimeError(503, "website_connector_auth_invalid");
-  }
-  if (auth.sendCookies) {
-    const cookie = cookieHeader(state, new URL(requestUrl));
-    if (!cookie) throw new WebsiteConnectorRuntimeError(409, "browser_connection_needs_reauth");
-    headers.set("Cookie", cookie);
-  }
-  for (const source of auth.headerSources) {
-    const value = storageValue(state, source.origin, source.keySuffix);
-    if (value === undefined || !credentialUnexpired(value, Date.now() / 1000)) {
-      throw new WebsiteConnectorRuntimeError(409, "browser_connection_needs_reauth");
-    }
-    headers.set(source.name, `${source.prefix ?? ""}${value}`);
-  }
-}
-
-function storageValue(state, origin, keySuffix) {
-  const matches = array(state?.origins)
-    .filter((candidate) => candidate?.origin === origin)
-    .flatMap((candidate) => array(candidate?.localStorage))
-    .filter((candidate) => String(candidate?.name || "").endsWith(keySuffix));
-  return matches.length === 1 && matches[0]?.value ? String(matches[0].value) : undefined;
-}
-
-function credentialUnexpired(value, nowSeconds, leewaySeconds = 30) {
-  const payload = jwtClaims(value);
-  return !payload || typeof payload.exp !== "number" || payload.exp > nowSeconds + leewaySeconds;
-}
-
-function jwtClaims(value) {
-  const parts = String(value).split(".");
-  if (parts.length !== 3) return undefined;
-  try {
-    const base64 = parts[1].replaceAll("-", "+").replaceAll("_", "/");
-    const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, "=");
-    const payload = JSON.parse(atob(padded));
-    return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : undefined;
-  } catch {
-    return undefined;
-  }
-}
-
-function cookieHeader(state, url) {
-  const now = Date.now() / 1000;
-  return array(state?.cookies)
-    .filter((cookie) => {
-      const domain = String(cookie?.domain || "").replace(/^\./, "").toLowerCase();
-      const hostname = url.hostname.toLowerCase();
-      const domainMatch = hostname === domain || hostname.endsWith(`.${domain}`);
-      const pathMatch = url.pathname.startsWith(cookie?.path || "/");
-      const unexpired = cookie?.expires === undefined || cookie.expires < 0 || cookie.expires > now;
-      return domainMatch && pathMatch && unexpired && (!cookie?.secure || url.protocol === "https:");
-    })
-    .sort((left, right) => (right.path?.length ?? 0) - (left.path?.length ?? 0))
-    .map((cookie) => `${cookie.name}=${cookie.value}`)
-    .join("; ");
-}
-
-async function readLimitedBody(response) {
-  const declared = Number(response.headers.get("content-length") || 0);
-  if (declared > MAX_RESPONSE_BYTES) throw new WebsiteConnectorRuntimeError(502, "website_operation_response_too_large");
-  if (!response.body) return "";
-  const reader = response.body.getReader();
-  const chunks = [];
-  let size = 0;
-  while (true) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    size += value.byteLength;
-    if (size > MAX_RESPONSE_BYTES) {
-      await reader.cancel();
-      throw new WebsiteConnectorRuntimeError(502, "website_operation_response_too_large");
-    }
-    chunks.push(value);
-  }
-  const body = new Uint8Array(size);
-  let offset = 0;
-  for (const chunk of chunks) {
-    body.set(chunk, offset);
-    offset += chunk.byteLength;
-  }
-  return new TextDecoder().decode(body);
-}
-
-function sanitizeOutputValue(value, secrets, depth) {
-  if (depth > 12) return "[truncated]";
-  if (typeof value === "string") {
-    let result = value.slice(0, 100_000);
-    for (const secret of secrets) result = result.replaceAll(secret, "[redacted]");
-    return result;
-  }
-  if (typeof value === "number" || typeof value === "boolean" || value === null) return value;
-  if (Array.isArray(value)) return value.slice(0, 1_000).map((item) => sanitizeOutputValue(item, secrets, depth + 1));
-  if (!value || typeof value !== "object") return undefined;
-  return Object.fromEntries(Object.entries(value).flatMap(([key, child]) => (
-    sensitiveKey(key) ? [] : [[key, sanitizeOutputValue(child, secrets, depth + 1)]]
-  )));
-}
-
-function sensitiveKey(key) {
-  return /cookie|password|authorization|access.?token|refresh.?token|session.?state|storage.?state|credential/i.test(key);
-}
-
-function array(value) {
-  return Array.isArray(value) ? value : [];
-}
-
-function fail(code, path) {
-  throw new WebsiteConnectorDefinitionError(code, path);
-}