@wix/agent-skills 1.35.1 → 1.36.1

package/skills/wix-replatform/resources/rp-source-wordpress/lib/wix-wp-plugin-v2-client.test-fixture.js

@@ -1,149 +0,0 @@
-'use strict';
-
-// Exercises BOTH of the handler's capabilities, not just discoverStructure -- a self-test
-// that only ever called discoverStructure would report readiness even if queryStructure
-// (the route that actually returns real data) were completely broken.
-async function selfTest({ discoverStructure, queryStructure, guardedValueColumns }) {
-  const calls = [];
-  const httpClient = {
-    async get(url, options) {
-      calls.push({ method: 'GET', url, options });
-      return {
-        table: options.params.table,
-        columns: [
-          { name: 'id', type: 'bigint(20) unsigned', nullable: false, key: 'primary' },
-          { name: 'number', type: 'varchar(64)', nullable: false, key: 'unique' },
-          { name: 'active', type: 'tinyint(1)', nullable: false, key: null },
-        ],
-      };
-    },
-    async post(url, options) {
-      calls.push({ method: 'POST', url, options });
-      return {
-        rows: [{ id: '1', number: 'CARD0001', active: '1' }],
-        pagingMetadata: { cursors: { next: null }, hasNext: false, total: 1 },
-        redactionMetadata: { redactedValueCount: 0, redactedColumns: [] },
-      };
-    },
-  };
-
-  const discovered = await discoverStructure({ httpClient, siteBaseUrl: 'https://example.test', table: 'pimwick_gift_card' });
-  if (discovered.table !== 'pimwick_gift_card' || discovered.columns.length !== 3) {
-    throw new Error('fixture discovery did not return the expected table/columns shape');
-  }
-  const getCall = calls.find((call) => call.method === 'GET');
-  if (!getCall || getCall.options.params.table !== 'pimwick_gift_card') {
-    throw new Error('fixture discovery did not request the expected table param');
-  }
-  if (!getCall.url.endsWith('/wp-json/wix-wp-plugin/v2/structure')) {
-    throw new Error('fixture discovery did not hit the expected wix-wp-plugin-v2 route');
-  }
-
-  const queried = await queryStructure({
-    httpClient,
-    siteBaseUrl: 'https://example.test',
-    structureRequest: {
-      table: 'pimwick_gift_card',
-      select: [{ column: 'id' }, { column: 'number' }, { column: 'active' }],
-      orderBy: [{ column: 'id', direction: 'asc' }],
-    },
-    limit: 10,
-  });
-  if (!Array.isArray(queried.rows) || queried.rows.length !== 1 || queried.rows[0].number !== 'CARD0001') {
-    throw new Error('fixture query did not return the expected row shape');
-  }
-  if (queried.pagingMetadata.hasNext !== false || queried.pagingMetadata.total !== 1) {
-    throw new Error('fixture query did not return the expected pagingMetadata shape');
-  }
-  const postCall = calls.find((call) => call.method === 'POST');
-  if (!postCall || !postCall.url.endsWith('/wp-json/wix-wp-plugin/v2/query/admin-key')) {
-    throw new Error('fixture query did not hit the expected wix-wp-plugin-v2 route');
-  }
-  const postedBody = JSON.parse(postCall.options.body);
-  if (postedBody.structureRequest.table !== 'pimwick_gift_card' || postedBody.limit !== 10) {
-    throw new Error('fixture query did not send the expected request body');
-  }
-
-  // --- the safety metadata must survive the client, and its absence must fail ---
-
-  if (!queried.redactionMetadata || queried.redactionMetadata.redactedValueCount !== 0) {
-    throw new Error('fixture query dropped redactionMetadata, which every response carries');
-  }
-  if (queried.eavAccess !== null) {
-    throw new Error('a plain table must report eavAccess as null, not as a fabricated object');
-  }
-
-  // A plugin too old to send redactionMetadata has no value guard at all. Accepting that
-  // response would report a guarded read that never happened, so the client must refuse it.
-  const legacyClient = {
-    async post() {
-      return { rows: [{ id: '1' }], pagingMetadata: { cursors: { next: null }, hasNext: false, total: 1 } };
-    },
-  };
-  let refusedLegacy = false;
-  try {
-    await queryStructure({
-      httpClient: legacyClient,
-      siteBaseUrl: 'https://example.test',
-      structureRequest: { table: 'pimwick_gift_card', select: [{ column: 'id' }], orderBy: [{ column: 'id', direction: 'asc' }] },
-    });
-  } catch (error) {
-    refusedLegacy = /redactionMetadata/.test(error.message);
-  }
-  if (!refusedLegacy) {
-    throw new Error('a response with no redactionMetadata must be refused, not defaulted to zero');
-  }
-
-  // A key/value table: both routes must hand the caller enough to build a legal request,
-  // INCLUDING the second guarded value column on a multi-pair schema.
-  const eavClient = {
-    async get(url, options) {
-      return {
-        table: options.params.table,
-        columns: [
-          { name: 'meta_id', type: 'bigint(20) unsigned', nullable: false, key: 'primary' },
-          { name: 'meta_key', type: 'varchar(255)', nullable: true, key: 'index' },
-          { name: 'meta_value', type: 'longtext', nullable: true, key: null },
-          { name: 'name', type: 'varchar(64)', nullable: true, key: null },
-          { name: 'value', type: 'longtext', nullable: true, key: null },
-        ],
-        eavPair: {
-          keyColumn: 'meta_key',
-          valueColumn: 'meta_value',
-          additionalPairs: [{ keyColumn: 'name', valueColumn: 'value' }],
-        },
-      };
-    },
-    async post() {
-      return {
-        rows: [{ meta_key: 'last4', n: '12' }],
-        pagingMetadata: { cursors: { next: null }, hasNext: false, total: 1 },
-        redactionMetadata: { redactedValueCount: 1, redactedColumns: ['meta_value'] },
-        eavAccess: { keyColumn: 'meta_key', valueColumn: 'meta_value', tier: 'key-discovery', pinnedKeys: [] },
-      };
-    },
-  };
-  const eavDiscovered = await discoverStructure({ httpClient: eavClient, siteBaseUrl: 'https://example.test', table: 'dual_meta' });
-  if (!eavDiscovered.eavPair || eavDiscovered.eavPair.keyColumn !== 'meta_key') {
-    throw new Error('discoverStructure dropped eavPair -- the caller loses its only advance notice that a table is key-scoped');
-  }
-  if (guardedValueColumns(eavDiscovered.eavPair).join(',') !== 'meta_value,value') {
-    throw new Error('guardedValueColumns must report EVERY guarded value column, not only the first pair\'s');
-  }
-  const eavQueried = await queryStructure({
-    httpClient: eavClient,
-    siteBaseUrl: 'https://example.test',
-    structureRequest: { table: 'dual_meta', select: [{ column: 'meta_key' }], orderBy: [{ column: 'meta_key', direction: 'asc' }] },
-  });
-  if (!eavQueried.eavAccess || eavQueried.eavAccess.tier !== 'key-discovery') {
-    throw new Error('queryStructure dropped eavAccess -- the caller cannot tell the read was key-scoped');
-  }
-  if (eavQueried.redactionMetadata.redactedValueCount !== 1
-    || eavQueried.redactionMetadata.redactedColumns[0] !== 'meta_value') {
-    throw new Error('queryStructure dropped the redaction count -- a redacted value would look like real data');
-  }
-
-  return true;
-}
-
-module.exports = selfTest;

package/skills/wix-replatform/resources/rp-source-wordpress/lib/woo-inventory.js

@@ -1,25 +0,0 @@
-'use strict';
-
-// Source policy only. The target adapter owns how these canonical values are written.
-function mapWooInventory(source = {}, { parent } = {}) {
-  const gap = (reason) => ({ status: 'decision-needed', fields: {}, reason });
-  if (source.backorders_allowed === true || source.backordered === true ||
-      (source.backorders != null && source.backorders !== 'no') || source.stock_status === 'onbackorder') {
-    return gap('backorder-policy');
-  }
-  if (source.manage_stock === 'parent' ||
-      (parent && parent.manage_stock === true && source.manage_stock !== true)) {
-    return gap('shared-parent-stock');
-  }
-  if (!['instock', 'outofstock'].includes(source.stock_status)) return gap('missing-or-unknown-stock-status');
-  if (source.manage_stock === false) {
-    return { status: 'mapped', fields: { inventoryTracked: false, inStock: source.stock_status === 'instock' } };
-  }
-  if (source.manage_stock !== true) return gap('missing-or-unknown-tracking-method');
-  const quantity = source.stock_quantity;
-  if (!Number.isInteger(quantity) || quantity < 0 || quantity > 99999) return gap('invalid-stock-quantity');
-  if ((quantity > 0) !== (source.stock_status === 'instock')) return gap('stock-status-quantity-conflict');
-  return { status: 'mapped', fields: { inventoryTracked: true, inventoryQuantity: quantity } };
-}
-
-module.exports = { mapWooInventory };

package/skills/wix-replatform/resources/rp-source-wordpress/lib/wp-http.js

@@ -1,444 +0,0 @@
-'use strict';
-
-// Shared WordPress REST transport core.
-//
-// This module is the single source of truth for the operational discipline a
-// WordPress reader must get right: auth header construction, URL building,
-// rate-limit throttling, and Retry-After-aware backoff on 429/503. It is
-// imported by:
-//   - scripts/wp-discovery.js (discovery-time sampling), and
-//   - the bulk-extract reader generated by rp-import-codegen, which vendors a
-//     copy of this file into the migration project so the project stays
-//     self-contained.
-//
-// Keep this file dependency-free (Node built-ins / global fetch only) so the
-// vendored copy needs no install step. The one sibling module it reaches for --
-// ./gateway-summary.mjs -- is loaded lazily, inside fetchGatewaySummary(), so a
-// vendored copy that never reads gateway configuration still runs standalone.
-
-const DEFAULT_TIMEOUT_MS = 60000;
-const DEFAULT_RATE_LIMIT_RPM = 120;
-const DEFAULT_MAX_RETRIES = 3;
-const MAX_BACKOFF_MS = 30000;
-
-// Shared throttle state. Every request routes through fetchJson, so a single
-// module-level throttle enforces the rate limit across the whole run.
-const rateState = { minIntervalMs: 0, lastRequestAt: 0, maxRetries: DEFAULT_MAX_RETRIES };
-
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-
-class DeadlineExceededError extends Error {
-  constructor() {
-    super('WordPress request deadline exceeded');
-    this.name = 'DeadlineExceededError';
-    this.code = 'deadline-exceeded';
-  }
-}
-
-function remainingDeadlineMs(deadlineAt) {
-  return deadlineAt === null ? Infinity : Math.max(0, deadlineAt - Date.now());
-}
-
-// Configure the shared throttle. Call once before issuing requests.
-function configureRateLimit({ rateLimitRpm = DEFAULT_RATE_LIMIT_RPM, maxRetries = DEFAULT_MAX_RETRIES } = {}) {
-  const rpm = Number.isFinite(rateLimitRpm) && rateLimitRpm >= 1 ? rateLimitRpm : DEFAULT_RATE_LIMIT_RPM;
-  rateState.minIntervalMs = Math.ceil(60000 / rpm);
-  rateState.maxRetries = Number.isFinite(maxRetries) && maxRetries >= 0 ? maxRetries : DEFAULT_MAX_RETRIES;
-}
-
-async function applyThrottle(progress, deadlineAt = null) {
-  if (rateState.minIntervalMs <= 0) {
-    return;
-  }
-  const elapsed = Date.now() - rateState.lastRequestAt;
-  const wait = rateState.minIntervalMs - elapsed;
-  if (wait > 0) {
-    // A per-media-chunk deadline includes pacing. Do not start a wait that cannot
-    // finish inside it; returning immediately is what keeps the stated worst-case bound real.
-    if (wait >= remainingDeadlineMs(deadlineAt)) throw new DeadlineExceededError();
-    if (progress) {
-      await progress.withHeartbeat({ phase: 'discovery', step: 'rate-limit', message: 'Still waiting for WordPress rate limit' }, () => sleep(wait));
-    } else {
-      await sleep(wait);
-    }
-  }
-  rateState.lastRequestAt = Date.now();
-}
-
-function retryAfterMs(responseHeaders) {
-  const raw = responseHeaders?.['retry-after'];
-  if (!raw) {
-    return null;
-  }
-  const seconds = Number.parseInt(raw, 10);
-  return Number.isFinite(seconds) ? seconds * 1000 : null;
-}
-
-function buildHeaders(args) {
-  const headers = new Headers();
-  headers.set('accept', 'application/json');
-
-  for (const rawHeader of args.authHeaders || []) {
-    const splitIndex = rawHeader.indexOf(':');
-    if (splitIndex === -1) {
-      throw new Error(`Invalid --auth-header value: ${rawHeader}`);
-    }
-    const name = rawHeader.slice(0, splitIndex).trim();
-    const value = rawHeader.slice(splitIndex + 1).trim();
-    headers.set(name, value);
-  }
-
-  if (args.username && args.applicationPassword) {
-    const credentials = Buffer.from(`${args.username}:${args.applicationPassword}`).toString('base64');
-    headers.set('authorization', `Basic ${credentials}`);
-  } else if (args.apiKey) {
-    const headerName = args.apiKeyHeader || 'Authorization';
-    const headerValue = headerName.toLowerCase() === 'authorization' && !/^bearer\s+/i.test(args.apiKey)
-      ? `Bearer ${args.apiKey}`
-      : args.apiKey;
-    headers.set(headerName, headerValue);
-  }
-
-  return headers;
-}
-
-function normalizeBaseUrl(input) {
-  return input.replace(/\/+$/, '');
-}
-
-function buildApiUrl(baseUrl, routePath, query = {}) {
-  const url = new URL(`${normalizeBaseUrl(baseUrl)}/wp-json${routePath}`);
-  for (const [key, value] of Object.entries(query)) {
-    if (value === undefined || value === null || value === '') {
-      continue;
-    }
-    url.searchParams.set(key, String(value));
-  }
-  return url;
-}
-
-// ---------------------------------------------------------------------------
-// Payment-gateway route denial
-//
-// `GET /wc/v3/payment_gateways` (and `/{id}`) returns each gateway's ENTIRE settings object.
-// On a site with a real gateway connected that includes the live API key and secret. Anything
-// a tool returns is in the model's context, the transcript, and potentially a durable run
-// artifact -- discovery's generic sampler writes sampled records to disk -- so there is no
-// careful-handling mitigation available above this line.
-//
-// The denial sits HERE, in the transport, rather than in a caller, for one reason: discovery
-// accepts `--include-route <path>` to force-sample any route. A control above that flag is a
-// control an operator can switch off by accident. This one is below it, so no CLI argument and
-// no future caller can route around it.
-//
-// It consults NOTHING but the route path. There is deliberately no `{ allowGatewayRoute }`, no
-// `{ skipDenyList }`, no capability token, no environment variable and no "internal caller"
-// parameter -- each of those is the exposure with extra steps. Their absence is asserted by
-// tests/source-wordpress/gateway-route-deny-contract-test.js.
-//
-// Honest limit: this guards the shared transport, not the network. Code that builds a URL and
-// calls global fetch itself is outside its reach; that is covered by the instructions in
-// rp-source-wordpress/SKILL.md and the codegen prohibition in rp-import-codegen/SKILL.md, not
-// by this function.
-// ---------------------------------------------------------------------------
-
-const GATEWAY_COLLECTION_ROUTE = '/wc/v3/payment_gateways';
-
-// Both shapes: the collection and the parameterized item route. Matching only the collection
-// would leave the exposure fully open -- the item route is the one that returns settings.
-// `v\d+` rather than `v3` because wc/v1 and wc/v2 expose the same route.
-const GATEWAY_ROUTE_PATTERN = /^\/wc\/v\d+\/payment_gateways(\/.*)?$/;
-
-class GatewayRouteDeniedError extends Error {
-  constructor(routePath) {
-    super(
-      `Refusing to request "${routePath}": WooCommerce payment-gateway routes return each gateway's `
-      + 'full settings object, including live API keys and secrets. Read gateway configuration through '
-      + 'fetchGatewaySummary(), which reduces the response with lib/gateway-summary.mjs and returns names '
-      + 'and states without credential values. No option, flag or override lifts this.',
-    );
-    this.name = 'GatewayRouteDeniedError';
-    this.code = 'GATEWAY_ROUTE_DENIED';
-    this.routePath = routePath;
-  }
-}
-
-// Normalize before matching, so a query string, a trailing slash, a doubled slash, a percent
-// escape, an accidental /wp-json prefix or a mixed-case spelling cannot walk past the pattern.
-function normalizeRouteForDeny(routePath) {
-  let route = typeof routePath === 'string' ? routePath : '';
-  try {
-    route = decodeURIComponent(route);
-  } catch {
-    // A malformed escape sequence is not a reason to skip the check — carry on with the raw text.
-  }
-  route = route.split('#')[0].split('?')[0].trim().toLowerCase();
-  route = route.replace(/\\/g, '/').replace(/\/{2,}/g, '/');
-  if (!route.startsWith('/')) {
-    route = `/${route}`;
-  }
-  route = route.replace(/^\/wp-json(?=\/|$)/, '').replace(/\/+$/, '');
-  return route === '' ? '/' : route;
-}
-
-/** Whether this route path returns payment-gateway configuration and must never be requested. */
-function isDeniedGatewayRoute(routePath) {
-  return GATEWAY_ROUTE_PATTERN.test(normalizeRouteForDeny(routePath));
-}
-
-// The undenied transport. MODULE-PRIVATE, and it stays that way: exporting it, or adding a
-// parameter to fetchJson that reaches it, recreates the hole the deny rule closes. The only
-// caller outside fetchJson is fetchGatewaySummary below, which hands the raw response straight
-// to a pure reducer and lets it go out of scope.
-async function fetchJsonUnchecked(baseUrl, routePath, {
-  headers,
-  method = 'GET',
-  query,
-  body,
-  timeoutMs = DEFAULT_TIMEOUT_MS,
-  deadlineMs,
-  progress = null,
-  progressContext = {},
-}) {
-  const url = buildApiUrl(baseUrl, routePath, query);
-  // One absolute deadline spans throttle waits, every attempt, response-body reads and every
-  // retry wait. Calls that omit deadlineMs retain the transport's existing per-attempt timeout.
-  const deadlineAt = Number.isFinite(deadlineMs) && deadlineMs >= 0 ? Date.now() + deadlineMs : null;
-  // `body` is a small, generic escape hatch for profile-declared entities whose read path
-  // is not a plain GET collection (see plugin-knowledge.js buildRequestOverrides) — it is
-  // never set on the default GET-with-query sampling path.
-  const requestInit = {
-    method,
-    headers,
-    ...(body !== undefined ? { body } : {}),
-  };
-
-  const deadlineResult = (attempt, error = new DeadlineExceededError()) => ({
-    ok: false,
-    status: 0,
-    statusText: 'Deadline Exceeded',
-    url: url.toString(),
-    headers: {},
-    json: undefined,
-    text: '',
-    error,
-    retries: attempt,
-  });
-
-  for (let attempt = 0; ; attempt += 1) {
-    try {
-      await applyThrottle(progress, deadlineAt);
-    } catch (error) {
-      if (error && error.code === 'deadline-exceeded') return deadlineResult(attempt, error);
-      throw error;
-    }
-    const remaining = remainingDeadlineMs(deadlineAt);
-    if (remaining <= 0) return deadlineResult(attempt);
-    const attemptTimeoutMs = Math.min(timeoutMs, remaining);
-    const deadlineControlsAttempt = deadlineAt !== null && remaining <= timeoutMs;
-    const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), attemptTimeoutMs);
-
-    try {
-      const response = progress
-        ? await progress.withHeartbeat({
-          phase: 'discovery',
-          step: 'wordpress-request',
-          ...progressContext,
-          message: `Still waiting on WordPress ${method} ${routePath || '/'}`,
-        }, () => fetch(url, {
-          ...requestInit,
-          signal: controller.signal,
-        }))
-        : await fetch(url, {
-          ...requestInit,
-          signal: controller.signal,
-        });
-      const text = await response.text();
-      const responseHeaders = Object.fromEntries(response.headers.entries());
-
-      // Back off and retry on throttling / transient unavailability,
-      // honoring Retry-After when the server provides it.
-      if ((response.status === 429 || response.status === 503) && attempt < rateState.maxRetries) {
-        const backoff = retryAfterMs(responseHeaders) ?? Math.min(MAX_BACKOFF_MS, 1000 * 2 ** attempt);
-        if (backoff >= remainingDeadlineMs(deadlineAt)) return deadlineResult(attempt);
-        if (progress) {
-          progress.warn(`WordPress ${response.status} response; backing off before retry`, {
-            phase: 'discovery',
-            step: 'wordpress-retry',
-            ...progressContext,
-            count: attempt + 1,
-            total: rateState.maxRetries,
-            unit: 'retries',
-          });
-          await progress.withHeartbeat({
-            phase: 'discovery',
-            step: 'wordpress-retry',
-            ...progressContext,
-            message: `Still backing off after WordPress ${response.status}`,
-          }, () => sleep(backoff));
-        } else {
-          await sleep(backoff);
-        }
-        continue;
-      }
-
-      let json;
-      if (text) {
-        try {
-          json = JSON.parse(text);
-        } catch {
-          json = undefined;
-        }
-      }
-
-      return {
-        ok: response.ok,
-        status: response.status,
-        statusText: response.statusText,
-        url: url.toString(),
-        headers: responseHeaders,
-        json,
-        text,
-        retries: attempt,
-      };
-    } catch (error) {
-      if (error.name === 'AbortError' && deadlineControlsAttempt) {
-        return deadlineResult(attempt);
-      }
-      return {
-        ok: false,
-        status: 0,
-        statusText: error.name === 'AbortError' ? 'Request Timeout' : error.message,
-        url: url.toString(),
-        headers: {},
-        json: undefined,
-        text: '',
-        error,
-        retries: attempt,
-      };
-    } finally {
-      clearTimeout(timeout);
-    }
-  }
-}
-
-/**
- * The WordPress transport every reader uses.
- *
- * Identical to the core above except that it refuses payment-gateway routes BEFORE issuing the
- * request. The refusal throws rather than returning a result object: a caller that treats a
- * denial as "the route returned nothing" would carry on and record an empty entity, and a
- * security control that reads as an empty result is not a control.
- */
-async function fetchJson(baseUrl, routePath, options) {
-  if (isDeniedGatewayRoute(routePath)) {
-    throw new GatewayRouteDeniedError(routePath);
-  }
-  return fetchJsonUnchecked(baseUrl, routePath, options);
-}
-
-/**
- * The ONE sanctioned way to read payment-gateway configuration.
- *
- * Note the direction of the dependency: this module imports the reducer, not the reverse. The
- * raw response never leaves this function's scope -- it goes straight into a pure function that
- * cannot make a request, and only that function's §1-shaped output is resolved. So there is no
- * exemption to keep narrow, because there is no hole: `gateway-summary.mjs` has no transport to
- * reach, and `fetchJson` has no way to be talked into the route.
- *
- * Refuses outright when the shared secret-value guard is not operational. A guard that quietly
- * evaluates an empty pattern set returns display values verbatim, and an allowlisted
- * `description` is free text a vendor controls -- so an unusable guard means we do not read.
- *
- * Loaded with dynamic import(), not require(): the reducer is ESM, this module is CommonJS and
- * is vendored into generated migration projects, and import() is the one form that works from
- * both on every Node version. Lazy, so a vendored copy that never reads gateway configuration
- * -- which is every generated reader, by prohibition -- needs no sibling file at all.
- */
-async function fetchGatewaySummary(baseUrl, { headers, timeoutMs = DEFAULT_TIMEOUT_MS, progress = null, progressContext = {} } = {}) {
-  const { reduceGatewayResponse, guardUnusableReason } = await import('./gateway-summary.mjs');
-
-  const guardProblem = guardUnusableReason();
-  if (guardProblem) {
-    throw new Error(
-      `Refusing to read payment-gateway configuration: the shared secret-value guard is not operational (${guardProblem}). `
-      + 'Fix secret-value-patterns.v1.json before reading gateway settings.',
-    );
-  }
-
-  const response = await fetchJsonUnchecked(baseUrl, GATEWAY_COLLECTION_ROUTE, {
-    headers,
-    method: 'GET',
-    timeoutMs,
-    progress,
-    progressContext: { step: 'gateway-summary', ...progressContext },
-  });
-
-  return reduceGatewayResponse(response);
-}
-
-// Total record count for a collection. WordPress returns it in X-WP-Total;
-// X-WP-TotalPages carries the page count. Header names are lowercased by fetch's
-// Headers iterator, but accept the canonical casing too for resilience.
-function parseTotalHeader(responseHeaders, name = 'x-wp-total') {
-  if (!responseHeaders) {
-    return null;
-  }
-  // fetch's Headers iterator lowercases names, but match case-insensitively so a
-  // plain object built with WordPress's canonical casing (X-WP-Total) also works.
-  const target = name.toLowerCase();
-  let raw;
-  for (const [key, value] of Object.entries(responseHeaders)) {
-    if (key.toLowerCase() === target) {
-      raw = value;
-      break;
-    }
-  }
-  if (raw === undefined || raw === null || raw === '') {
-    return null;
-  }
-  const total = Number.parseInt(raw, 10);
-  return Number.isFinite(total) ? total : null;
-}
-
-function parseTotalPagesHeader(responseHeaders) {
-  return parseTotalHeader(responseHeaders, 'x-wp-totalpages');
-}
-
-function shouldContinueCollectionPaging({ responseHeaders, page, perPage, itemCount }) {
-  const totalPages = parseTotalPagesHeader(responseHeaders);
-  if (totalPages !== null) {
-    return Number(page) < totalPages;
-  }
-  if (Number.isFinite(perPage) && perPage > 0) {
-    return Number(itemCount) >= perPage;
-  }
-  return false;
-}
-
-module.exports = {
-  DEFAULT_TIMEOUT_MS,
-  DEFAULT_RATE_LIMIT_RPM,
-  DEFAULT_MAX_RETRIES,
-  MAX_BACKOFF_MS,
-  DeadlineExceededError,
-  sleep,
-  configureRateLimit,
-  retryAfterMs,
-  buildHeaders,
-  normalizeBaseUrl,
-  buildApiUrl,
-  fetchJson,
-  // NOTE what is deliberately NOT here: the undenied transport, under any name. The gateway
-  // deny rule is only worth as much as this export list.
-  GATEWAY_COLLECTION_ROUTE,
-  GatewayRouteDeniedError,
-  isDeniedGatewayRoute,
-  fetchGatewaySummary,
-  parseTotalHeader,
-  parseTotalPagesHeader,
-  shouldContinueCollectionPaging,
-};