runline 0.32.0 → 0.34.0

package/dist/index.js

@@ -1,5 +1,5 @@
 export { AuthError } from "./auth/errors.js";
-export { acquireOAuth2ClientToken, acquireOAuth2JwtToken, buildOAuth2AuthorizationUrl, exchangeOAuth2Code, refreshOAuth2Token, } from "./auth/oauth2.js";
+export { acquireOAuth2ClientToken, acquireOAuth2JwtToken, acquireOAuth2PasswordToken, buildOAuth2AuthorizationUrl, exchangeOAuth2Code, refreshOAuth2Token, } from "./auth/oauth2.js";
 export { decodeOAuthTokens, requestOAuth2Token } from "./auth/token.js";
 export { addConnection, findConfigDir, getConnection, loadConfig, removeConnection, saveConfig, updateConnectionConfig, } from "./config/loader.js";
 export { DEFAULT_CONFIG } from "./config/types.js";
@@ -8,7 +8,7 @@ export { MemoryConnectionProvider } from "./connections/memory.js";
 export { ExecutionEngine } from "./core/engine.js";
 export { buildAuthUrl, exchangeAuthCode, generatePKCE, OAUTH_CALLBACK_PORT, OAUTH_CALLBACK_URI, oauthCallback, runOAuth, } from "./core/oauth.js";
 export { downloadResource } from "./credentials/http.js";
-export { CredentialRegistry, OAuthGrantSchema, OAuthTokensSchema, validateCredential, } from "./credentials/registry.js";
+export { CredentialRegistry, OAuthGrantSchema, OAuthTokensSchema, staticSecretSchema, validateCredential, } from "./credentials/registry.js";
 export { CredentialTransport } from "./credentials/transport.js";
 export { createPluginAPI, isPluginFunction, resolvePluginExport, } from "./plugin/api.js";
 export { installPlugin, listInstalled, parsePluginSource, removePlugin, } from "./plugin/installer.js";

package/dist/plugin/api.d.ts

@@ -1,3 +1,4 @@
+import type { CredentialDeclaration } from "../credentials/types.js";
 import type { ActionAccess, ActionDef, ConnectionSchema, InputSchema, OAuthConfig, PluginDef } from "./types.js";
 export interface ActionDefinition {
     access?: ActionAccess;
@@ -16,6 +17,12 @@ export interface RunlinePluginAPI {
      * with refreshable tokens.
      */
     setOAuth(oauth: OAuthConfig): void;
+    /**
+     * Declare how a connection's config becomes what this plugin's requests
+     * are signed with, so a host brokering for it can sign from the plugin
+     * it loaded rather than from anything the plugin's process sends.
+     */
+    setCredential(declaration: CredentialDeclaration): void;
     onInit(fn: (config: Record<string, unknown>) => void): void;
     log: {
         info(msg: string): void;

package/dist/plugin/api.js

@@ -4,6 +4,7 @@ export function createPluginAPI(pluginId) {
     const actions = [];
     let connectionConfigSchema;
     let oauth;
+    let credential;
     const initHooks = [];
     const api = {
         setName(n) {
@@ -24,6 +25,9 @@ export function createPluginAPI(pluginId) {
         setOAuth(cfg) {
             oauth = { ...cfg };
         },
+        setCredential(declaration) {
+            credential = declaration;
+        },
         onInit(fn) {
             initHooks.push(fn);
         },
@@ -49,6 +53,9 @@ export function createPluginAPI(pluginId) {
         if (oauth) {
             plugin.oauth = oauth;
         }
+        if (credential) {
+            plugin.credential = credential;
+        }
         if (initHooks.length > 0) {
             plugin.initHooks = initHooks;
         }

package/dist/plugin/types.d.ts

@@ -1,6 +1,8 @@
 import type { TSchema } from "typebox";
 import type { OAuth2Definition } from "../auth/types.js";
 import type { ConnectionUpdate } from "../connections/types.js";
+import type { CredentialBroker } from "../credentials/transport.js";
+import type { CredentialDeclaration } from "../credentials/types.js";
 export interface InputField {
     type: "string" | "number" | "boolean" | "object" | "array";
     description?: string;
@@ -60,6 +62,13 @@ export interface ActionContext {
      * engine). Absent when the embedder passed none.
      */
     context?: unknown;
+    /**
+     * Authenticated requests signed by the host, present when the embedder
+     * holds this connection's credentials elsewhere and the plugin declares
+     * its credential. A plugin given one sends through it and signs nothing
+     * itself: its connection config then carries public settings only.
+     */
+    credentials?: CredentialBroker;
     log: {
         info(msg: string): void;
         warn(msg: string): void;
@@ -128,6 +137,9 @@ export interface PluginDef {
     connectionConfigSchema?: ConnectionSchema;
     /** OAuth2 config for `runline auth <plugin>`. */
     oauth?: OAuthConfig;
+    /** How a connection's config becomes what its requests are signed with;
+     *  present on plugins whose requests go through the credential registry. */
+    credential?: CredentialDeclaration;
     /** @internal */
     initHooks?: Array<(config: Record<string, unknown>) => void>;
 }

package/dist/plugins/_shared/credentialAdapter.js

@@ -1,15 +1,73 @@
 import { createHash } from "node:crypto";
 import { AuthError, CredentialRegistry, CredentialTransport, } from "runline";
-/** Flat CLI/env storage is a projection, not a second token cache or refresh engine. */
-export function credentialRuntime(ctx, definition, method, authority) {
+/**
+ * Where one action call's authenticated requests go: the host's broker
+ * when it supplies one — the credentials then live with the host, and no
+ * local signer is built — else this process signs with its own
+ * connection, from the plugin's declaration.
+ */
+export function credentialBroker(ctx, declaration) {
+    if (ctx.credentials)
+        return ctx.credentials;
+    const { binding, transport } = localSigner(ctx, declaration);
+    return {
+        request: (input) => transport.request(binding, input),
+        probe: () => transport.probe(binding),
+        socketUrl: (input) => transport.socketUrl(binding, input),
+    };
+}
+/** Everything a stored token was issued under. A config whose selection
+ *  hashes differently can no longer use tokens issued for this one. */
+function authorityOf(selection) {
+    return createHash("sha256").update(JSON.stringify(selection)).digest("hex");
+}
+/**
+ * A static secret's structured shape, from the flat fields and fixed values
+ * the declaration names, joined in order where a part concatenates them.
+ * Absent when a required part's field is missing, so the transport refuses
+ * it as invalid_credentials before any IO; a missing optional part is left
+ * out, refusing only the targets that place it.
+ */
+function staticSecret(current, sources, optional) {
+    if (!sources)
+        return undefined;
+    const secret = {};
+    sources: for (const [key, source] of Object.entries(sources)) {
+        let joined = "";
+        for (const part of "concat" in source ? source.concat : [source]) {
+            const value = "value" in part ? part.value : current[part.field];
+            if (typeof value !== "string") {
+                if (optional.includes(key))
+                    continue sources;
+                return undefined;
+            }
+            joined += value;
+        }
+        secret[key] = joined;
+    }
+    return secret;
+}
+/**
+ * This process signing with its own connection. Flat CLI/env storage is a
+ * projection, not a second token cache or refresh engine.
+ */
+function localSigner(ctx, declaration) {
+    const selection = declaration(ctx.connection.config);
+    const { type: definition, method } = selection;
+    if (!Object.hasOwn(definition.methods, method))
+        throw new AuthError("invalid_definition");
+    const auth = definition.methods[method].authentication;
     const identity = { name: ctx.connection.name, plugin: ctx.connection.plugin };
-    const fingerprint = (config) => createHash("sha256")
-        .update(JSON.stringify([definition.id, method, authority(config)]))
-        .digest("hex");
-    const expected = fingerprint(ctx.connection.config);
+    const expected = authorityOf(selection);
     const project = (current) => {
-        if (fingerprint(current) !== expected)
+        if (authorityOf(declaration(current)) !== expected)
             throw new AuthError("binding_changed");
+        if (auth.kind === "none")
+            return {};
+        if (auth.kind === "static") {
+            const secret = staticSecret(current, selection.localSecret, auth.optionalParts ?? []);
+            return secret ? { [auth.field]: secret } : {};
+        }
         const compatible = current.authTokenBinding === undefined ||
             current.authTokenBinding === expected;
         const tokens = {
@@ -34,7 +92,7 @@ export function credentialRuntime(ctx, definition, method, authority) {
         const revision = typeof current.authTokenRevision === "string" && compatible
             ? current.authTokenRevision
             : createHash("sha256").update(JSON.stringify(tokens)).digest("hex");
-        return { grant: { tokens, revision } };
+        return { [auth.field]: { tokens, revision } };
     };
     const snapshot = () => ({
         ...identity,
@@ -44,21 +102,25 @@ export function credentialRuntime(ctx, definition, method, authority) {
         type: definition.id,
         method,
         identity,
-        application: {
-            clientId: ctx.connection.config.clientId,
-            clientSecret: ctx.connection.config.clientSecret,
-        },
+        application: selection.application,
+        ...(selection.jwtIdentity ? { jwtIdentity: selection.jwtIdentity } : {}),
+        ...(selection.resourceOwner
+            ? { resourceOwner: selection.resourceOwner }
+            : {}),
         connection: {
             async read() {
                 return snapshot();
             },
             async update(change) {
+                // Only an OAuth grant is ever renewed and written back.
+                if (auth.kind !== "oauth2")
+                    throw new AuthError("invalid_definition");
                 await ctx.updateConnection(async (current) => {
                     const projected = project(current);
                     const patch = typeof change === "function" ? await change(projected) : change;
                     if (!patch)
                         return;
-                    const grant = patch.grant;
+                    const grant = patch[auth.field];
                     if (!grant?.tokens.accessToken)
                         throw new AuthError("invalid_credentials");
                     return {
@@ -77,10 +139,12 @@ export function credentialRuntime(ctx, definition, method, authority) {
     };
     const registry = new CredentialRegistry();
     registry.register(definition);
-    // Builtins run in the caller's trusted runtime. Vex must supply its privileged
-    // egress transport via the broker rather than execute these plugins server-side.
+    // The widest defaults the transport allows, so an undeclared slow call
+    // (image generation, exports) is bounded rather than cut short; targets
+    // that declare their own deadline or ceiling get it up to the host caps.
     const transport = new CredentialTransport(registry, {
         fetch: globalThis.fetch,
+        timeoutMs: 120_000,
         maxRequestBytes: 64 * 1024 * 1024,
         maxResponseBytes: 64 * 1024 * 1024,
     });

package/dist/plugins/_shared/credentials.js

@@ -0,0 +1,389 @@
+import { AuthError, OAuthGrantSchema, staticSecretSchema, } from "runline";
+import * as t from "typebox";
+import { credentialBroker } from "./credentialAdapter.js";
+/**
+ * The plugin side of the credential broker, shared by every plugin: one
+ * declaration factory for static keys, one stored grant shape for OAuth
+ * methods, one way to turn public config into an HTTPS target, one
+ * request path.
+ */
+/**
+ * The stored shape of an OAuth method: one optional revisioned grant in the
+ * `grant` field, absent until the first issuance.
+ */
+export const grantSchema = t.Object({ grant: t.Optional(OAuthGrantSchema) }, { additionalProperties: false });
+/** The parts and placements a shorthand, or the general form, declares. */
+function placementsOf(auth) {
+    if (auth.kind === "static") {
+        const { kind: _, ...declared } = auth;
+        return declared;
+    }
+    if (auth.kind === "basic")
+        return {
+            parts: ["username", "password"],
+            placements: [{ in: "basic", username: "username", password: "password" }],
+        };
+    const placement = auth.kind === "bearer"
+        ? {
+            in: "header",
+            part: "secret",
+            name: "Authorization",
+            prefix: "Bearer ",
+        }
+        : auth.kind === "queryKey"
+            ? { in: "query", part: "secret", name: auth.param }
+            : {
+                in: "header",
+                part: "secret",
+                name: auth.header,
+                ...(auth.prefix === undefined ? {} : { prefix: auth.prefix }),
+            };
+    return { parts: ["secret"], placements: [placement] };
+}
+/**
+ * A static-key plugin's declaration. The secret lives in one structured
+ * `credential` field — `{ secret }`, `{ username, password }` for basic, or
+ * the general form's named parts — and the method is named for the auth
+ * kind, so every static declaration has the same shape. A host stores the
+ * structured field; the CLI's flat fields are named by `local`.
+ */
+export function staticCredential(spec) {
+    const field = "credential";
+    const { parts, optionalParts, placements } = placementsOf(spec.auth);
+    if (Object.keys(spec.local).sort().join() !== [...parts].sort().join())
+        throw new AuthError("invalid_definition");
+    const localSecret = Object.fromEntries(Object.entries(spec.local).map(([key, source]) => [
+        key,
+        typeof source === "string" ? { field: source } : source,
+    ]));
+    const fields = Object.values(localSecret).flatMap((source) => ("concat" in source ? source.concat : [source]).flatMap((part) => "field" in part ? [part.field] : []));
+    return (config) => {
+        const targets = typeof spec.targets === "function" ? spec.targets(config) : spec.targets;
+        const signed = !spec.optional ||
+            config.authenticated === true ||
+            fields.every((name) => typeof config[name] === "string" && config[name]);
+        return {
+            type: {
+                id: spec.id,
+                methods: {
+                    [spec.auth.kind]: {
+                        schema: t.Object({ [field]: staticSecretSchema(parts, optionalParts) }, { additionalProperties: false }),
+                        authentication: {
+                            kind: "static",
+                            field,
+                            parts,
+                            ...(optionalParts ? { optionalParts } : {}),
+                            placements,
+                        },
+                        targets,
+                        ...(spec.probe ? { probe: spec.probe } : {}),
+                    },
+                    ...(spec.optional
+                        ? {
+                            none: {
+                                schema: t.Object({}, { additionalProperties: false }),
+                                authentication: { kind: "none" },
+                                targets: spec.optional === true ? targets : spec.optional.targets,
+                            },
+                        }
+                        : {}),
+                },
+            },
+            ...(signed
+                ? { method: spec.auth.kind, localSecret }
+                : { method: "none" }),
+        };
+    };
+}
+/**
+ * An HTTPS base URL from public config, with `path` appended beneath it.
+ * Anything else — plain HTTP, embedded credentials, a query or fragment —
+ * is invalid_credentials: the connection cannot be signed as configured.
+ */
+export function httpsBase(value, path) {
+    try {
+        if (typeof value !== "string")
+            throw new Error();
+        const url = new URL(value);
+        if (url.protocol !== "https:" ||
+            url.username ||
+            url.password ||
+            url.search ||
+            url.hash ||
+            value.includes("?") ||
+            value.includes("#"))
+            throw new Error();
+        const base = url.pathname.endsWith("/") ? url.pathname : `${url.pathname}/`;
+        return `${url.origin}${base}${path}`;
+    }
+    catch {
+        throw new AuthError("invalid_credentials");
+    }
+}
+/** One DNS label from public config, for `https://{label}.provider.com/` hosts. */
+export function hostLabel(value) {
+    if (typeof value !== "string" ||
+        !/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i.test(value))
+        throw new AuthError("invalid_credentials");
+    return value;
+}
+/**
+ * One of a config field's documented values — a region, an environment,
+ * a hosting mode — or `fallback` when the field is absent. Anything else
+ * is invalid_credentials, never mapped to a default: a mistyped value
+ * would otherwise send the credential to another host.
+ */
+export function configChoice(value, choices, fallback) {
+    if (value === undefined || value === null)
+        return fallback;
+    if (typeof value !== "string" ||
+        !choices.includes(value))
+        throw new AuthError("invalid_credentials");
+    return value;
+}
+/**
+ * A boolean config field, as a boolean or the string a CLI or environment
+ * variable gives (`"true"`, `"false"`); false when absent. Anything else
+ * is invalid_credentials, as for `configChoice`: a mistyped sandbox or
+ * SSL flag must not read as false and reach the live host.
+ */
+export function configFlag(value) {
+    if (typeof value === "boolean")
+        return value;
+    return configChoice(value, ["true", "false"], "false") === "true";
+}
+/**
+ * An ID or name as exactly one path segment, the one encoder every plugin
+ * uses. A value that is not one segment is refused rather than encoded: an
+ * empty value would address the parent collection (`items/`), a dot segment
+ * a sibling, and a separator more than one segment.
+ */
+export function pathSegment(value) {
+    const raw = value === undefined || value === null ? "" : String(value);
+    if (!raw || raw === "." || raw === ".." || /[/\\]/.test(raw))
+        throw new AuthError("request_not_allowed");
+    return encodeURIComponent(raw);
+}
+/**
+ * A slash-separated name the API addresses as a sub-path — a model's
+ * `owner/name`, a file path, a nested job — each segment by `pathSegment`,
+ * its slashes kept.
+ */
+export function pathSegments(value) {
+    return String(value ?? "")
+        .split("/")
+        .map(pathSegment)
+        .join("/");
+}
+/**
+ * A slashed name as exactly one segment, its slashes encoded
+ * (`@scope/pkg` → `%40scope%2Fpkg`), for a target that declares
+ * `encodedSlashes`. An empty or dot piece, or a backslash, is refused.
+ */
+export function slashEncodedSegment(value) {
+    return pathSegments(value).replaceAll("/", "%2F");
+}
+/** Parameters as `a=1&b=2`: arrays repeat the key; null and undefined are skipped. */
+function encodeParams(params) {
+    const encoded = new URLSearchParams();
+    for (const [key, value] of Object.entries(params)) {
+        if (value === undefined || value === null)
+            continue;
+        for (const entry of Array.isArray(value) ? value : [value])
+            encoded.append(key, String(entry));
+    }
+    return encoded.toString();
+}
+function withQuery(path, query) {
+    if (!query)
+        return path;
+    const encoded = encodeParams(query);
+    if (!encoded)
+        return path;
+    return `${path}${path.includes("?") ? "&" : "?"}${encoded}`;
+}
+/** The one authenticated request path: the host's broker, else the local signer. */
+export function credentialRequest(ctx, declaration, call) {
+    const body = call.json !== undefined
+        ? { type: "application/json", body: JSON.stringify(call.json) }
+        : call.form !== undefined
+            ? {
+                type: "application/x-www-form-urlencoded",
+                body: encodeParams(call.form),
+            }
+            : undefined;
+    const payload = body?.body ?? call.body;
+    return credentialBroker(ctx, declaration).request({
+        target: call.target,
+        path: withQuery(call.path, call.query),
+        method: call.method ?? "GET",
+        headers: {
+            Accept: "application/json",
+            ...(body ? { "Content-Type": body.type } : {}),
+            ...call.headers,
+        },
+        ...(payload !== undefined ? { body: payload } : {}),
+        ...(call.destination !== undefined
+            ? { destination: call.destination }
+            : {}),
+    });
+}
+/**
+ * A step that writes a grant into the connection — an owner login run
+ * against the provider — happens only where the grant lives: this process,
+ * signing with its own connection. Under a host that keeps the grant, setup
+ * is the host's, and the step refuses before any request.
+ */
+export function refuseUnderHost(ctx) {
+    if (ctx.credentials)
+        throw new AuthError("unsupported_operation");
+}
+/**
+ * A socket target's URL for this connection, from the broker: signed by
+ * the local signer, or a relay the host controls. A broker that serves no
+ * sockets refuses as unsupported_operation.
+ */
+export async function credentialSocketUrl(ctx, declaration, call) {
+    const broker = credentialBroker(ctx, declaration);
+    if (!broker.socketUrl)
+        throw new AuthError("unsupported_operation");
+    return broker.socketUrl({
+        target: call.target,
+        path: withQuery(call.path, call.query),
+    });
+}
+/**
+ * A provider error identifier worth handing back — an error code, a field
+ * path — as a plain name. Anything else is not a name and is dropped, so
+ * the code and field slots of a failure never carry free text.
+ */
+export function errorIdentifier(value) {
+    return typeof value === "string" && /^[\w.$:-]{1,100}$/.test(value)
+        ? value
+        : undefined;
+}
+/**
+ * How a failed request reads: its HTTP status when the status is the
+ * failure, and the identifiers a provider returns for correcting the call
+ * — its error `code` and the offending `param`. A failed response's body
+ * is never read into it: that is where a provider may echo the credential.
+ */
+export function failureMessage(plugin, status, detail = {}) {
+    const identifiers = [detail.code, detail.param && `param: ${detail.param}`]
+        .filter(Boolean)
+        .join(", ");
+    const inner = [status === undefined ? "" : `HTTP ${status}`, identifiers]
+        .filter(Boolean)
+        .join(" ");
+    return `${plugin}: request failed${inner ? ` (${inner})` : ""}`;
+}
+/** A code or field path as a plain identifier, numbers included. */
+function identifierOf(value) {
+    return errorIdentifier(typeof value === "number" ? String(value) : value);
+}
+/**
+ * A successful response whose answer reports failure — Slack's `ok: false`,
+ * an OCS status, a GraphQL `errors` entry — by the provider's code, the
+ * field at fault and its message. The answer is 2xx data the plugin
+ * already holds, so the message stays for the caller to act on, reduced
+ * to one line of at most 300 characters.
+ */
+export function answerFailed(plugin, detail) {
+    const head = failureMessage(plugin, undefined, {
+        code: identifierOf(detail.code),
+        param: identifierOf(detail.param),
+    });
+    const text = typeof detail.message === "string"
+        ? detail.message.replace(/[\u0000-\u001f\u007f\s]+/g, " ").trim()
+        : "";
+    const line = text.length > 300 ? `${text.slice(0, 300)}…` : text;
+    return new Error(line ? `${head}: ${line}` : head);
+}
+/** A GraphQL answer's `errors`, read by `answerFailed` from the first entry. */
+export function graphqlFailed(plugin, errors) {
+    const first = (Array.isArray(errors) ? errors[0] : undefined);
+    return answerFailed(plugin, {
+        code: first?.extensions?.code,
+        param: Array.isArray(first?.path) ? first.path.join(".") : undefined,
+        message: first?.message,
+    });
+}
+/** A failed request, reported by status alone. */
+export function requestFailed(plugin, status) {
+    return new Error(failureMessage(plugin, status));
+}
+/** A request that must succeed, for callers that read the Response itself (headers, text, bytes). */
+export async function credentialOk(ctx, declaration, plugin, call) {
+    const response = await credentialRequest(ctx, declaration, call);
+    if (!response.ok)
+        throw requestFailed(plugin, response.status);
+    return response;
+}
+/**
+ * A successful response's JSON. `T` is the caller's statement of the
+ * answer's shape, unchecked, as for any parsed JSON; without one it is
+ * `unknown`. An empty answer is `EmptyAnswer`, so a caller whose endpoint
+ * can answer empty includes it in `T`. Every JSON request path reads its
+ * answer here, so they cannot disagree about empty or malformed bodies.
+ */
+export async function jsonAnswer(response) {
+    const empty = { success: true };
+    if (response.status === 204)
+        return empty;
+    const text = await response.text();
+    if (!text)
+        return empty;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw new AuthError("invalid_response");
+    }
+}
+/**
+ * A successful response's JSON when its Content-Type says JSON; any other
+ * body — a text "OK", nothing at all — is an acknowledgement,
+ * `EmptyAnswer`. For APIs whose writes answer without JSON.
+ */
+export async function jsonOrAcknowledged(response) {
+    return (response.headers.get("content-type") ?? "").includes("application/json")
+        ? jsonAnswer(response)
+        : { success: true };
+}
+/** A JSON request that must succeed; its answer is read by `jsonAnswer`. */
+export async function credentialJson(ctx, declaration, plugin, call) {
+    return jsonAnswer(await credentialOk(ctx, declaration, plugin, call));
+}
+/**
+ * A next-page URL the API returned, as a path beneath the declared target
+ * it will be signed for. Anything outside that target's exact origin and
+ * path prefix is refused rather than followed with the credential attached.
+ */
+export function pathWithin(ctx, declaration, target, value) {
+    const { type, method } = declaration(ctx.connection.config);
+    const targets = type.methods[method]?.targets ?? {};
+    if (!Object.hasOwn(targets, target))
+        throw new AuthError("request_not_allowed");
+    try {
+        const base = new URL(targets[target].baseUrl);
+        const url = new URL(value);
+        if (url.origin !== base.origin ||
+            url.username ||
+            url.password ||
+            url.hash ||
+            !url.pathname.startsWith(base.pathname))
+            throw new Error();
+        return `${url.pathname.slice(base.pathname.length)}${url.search}`;
+    }
+    catch {
+        throw new AuthError("request_not_allowed");
+    }
+}
+/** FormData as the buffered bytes the transport accepts, with its boundary. */
+export async function multipartBody(form) {
+    const response = new Response(form);
+    const contentType = response.headers.get("content-type");
+    if (!contentType)
+        throw new AuthError("request_not_allowed");
+    return { body: new Uint8Array(await response.arrayBuffer()), contentType };
+}