@graphty/graph-io 0.3.46 → 0.3.48

package/dist/chunks/context-cgmmOxZ2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context-cgmmOxZ2.js","sources":["../../src/sources/context.ts"],"sourcesContent":["/**\n * The source context (design sections 2.1, 6.2, 7.2 and 9): the guarded `ctx.fetch` every source\n * reads through. It applies the credential only to the origins it is bound to, refuses credentials\n * in clear text and across redirects, retries what HTTP says is safe to retry, paces requests,\n * enforces the caps, counts decoded bytes, times the load out and turns every failure into a coded\n * issue. A source never sees the credential.\n */\n\nimport { throwIfAborted } from \"../common/input.js\";\nimport { type ImportReportBuilder } from \"../common/report.js\";\nimport { type ImportReport } from \"../types.js\";\nimport { type SourceBlockedCause } from \"./codes.js\";\nimport { applyCredential, originOf } from \"./credentials.js\";\nimport { failOn, warnOn } from \"./fail.js\";\nimport {\n    type Credential,\n    type LoadFromSourceOptions,\n    type SourceContext,\n    type SourceCursor,\n    type SourceDescriptor,\n    type SourceFinish,\n    type SourceLimitOptions,\n    type SourceLimits,\n    type SourceReportInfo,\n    type SourceRequestInit,\n    type SourceRuntime,\n} from \"./types.js\";\n\n/** Statuses HTTP says a client may retry. */\nconst RETRY_STATUSES: ReadonlySet<number> = new Set([429, 502, 503, 504]);\n\n/** Statuses whose response has no body by definition. */\nconst NULL_BODY_STATUSES: ReadonlySet<number> = new Set([101, 204, 205, 304]);\n\n/** Redirect statuses. */\nconst REDIRECT_STATUSES: ReadonlySet<number> = new Set([301, 302, 303, 307, 308]);\n\n/** Same-origin redirects followed with a credential before giving up. */\nconst MAX_REDIRECTS = 5;\n\n/**\n * Thrown inside a load when a cap stops it under `onLimit: \"stop\"`; the runner catches it, keeps\n * what came first and records where to resume. Never leaves graph-io.\n */\nexport class LimitStop extends Error {\n    /**\n     * Create one.\n     * @param limit - the cap's option name\n     * @param value - the value that reached it\n     */\n    constructor(\n        readonly limit: string,\n        readonly value: number,\n    ) {\n        super(`${limit} reached at ${String(value)}`);\n        this.name = \"LimitStop\";\n    }\n}\n\n/**\n * Where code is running. Node is checked first, since a test may stub a `document`.\n * @returns the runtime\n */\nexport function detectRuntime(): SourceRuntime {\n    const g = globalThis as {\n        process?: { versions?: { node?: unknown } };\n        importScripts?: unknown;\n        window?: unknown;\n        document?: unknown;\n    };\n    if (typeof g.process?.versions?.node === \"string\") {\n        return \"node\";\n    }\n    if (typeof g.importScripts === \"function\") {\n        return \"worker\";\n    }\n    return g.window !== undefined && g.document !== undefined ? \"browser\" : \"other\";\n}\n\n/**\n * A URL as reports show it: origin and path, never the query string.\n * @param url - the URL\n * @returns origin plus path\n */\nfunction originPath(url: URL): string {\n    return `${originOf(url)}${url.pathname}`;\n}\n\n/**\n * Whether a host is this machine.\n * @param hostname - the URL's hostname\n * @returns true for localhost, 127.0.0.0/8 and ::1\n */\nexport function isLoopback(hostname: string): boolean {\n    const host = hostname.replaceAll(/(?:^\\[)|(?:\\]$)/g, \"\").toLowerCase();\n    return host === \"localhost\" || host.endsWith(\".localhost\") || /^127(\\.\\d{1,3}){3}$/.test(host) || host === \"::1\";\n}\n\n/**\n * Whether a host is on a local network: loopback, private IPv4 ranges, link-local, unique local\n * IPv6 or an mDNS `.local` name.\n * @param hostname - the URL's hostname\n * @returns true for a local-network host\n */\nexport function isLocalNetwork(hostname: string): boolean {\n    const host = hostname.replaceAll(/(?:^\\[)|(?:\\]$)/g, \"\").toLowerCase();\n    return (\n        isLoopback(host) ||\n        host.endsWith(\".local\") ||\n        /^10(\\.\\d{1,3}){3}$/.test(host) ||\n        /^192\\.168(\\.\\d{1,3}){2}$/.test(host) ||\n        /^169\\.254(\\.\\d{1,3}){2}$/.test(host) ||\n        /^172\\.(1[6-9]|2\\d|3[01])(\\.\\d{1,3}){2}$/.test(host) ||\n        /^f[cd][0-9a-f]{2}:/.test(host) ||\n        host.startsWith(\"fe80:\")\n    );\n}\n\n/** Requests in flight and recently sent, per source and origin, for `descriptor.rateLimit`. */\ninterface Pacer {\n    active: number;\n    times: number[];\n    readonly waiters: (() => void)[];\n}\n\n/** One pacer per source id and origin, shared by every load in this process. */\nconst PACERS = new Map<string, Pacer>();\n\n/** What the runner reads back from a context after a load. */\nexport interface ContextState {\n    /** Requests sent. */\n    requests: number;\n    /** Decoded response bytes read. */\n    bytes: number;\n    /** What the source passed to finish(). */\n    finish: SourceFinish | null;\n}\n\n/** What createSourceContext() needs. */\ninterface ContextInput {\n    /** The source id. */\n    readonly id: string;\n    /** The source's descriptor, if it has one. */\n    readonly descriptor: SourceDescriptor | undefined;\n    /** The caller's options. */\n    readonly options: LoadFromSourceOptions;\n    /** The load's report. */\n    readonly report: ImportReportBuilder;\n    /** The resolved endpoint. */\n    readonly endpoint: URL | null;\n    /** The cursor the source sees (version stripped). */\n    readonly cursor: SourceCursor | null;\n    /** What progress counts: \"bytes\" for a file source, \"items\" otherwise. */\n    readonly unit: \"items\" | \"bytes\";\n    /** What the sink has received so far. */\n    readonly counts: () => { readonly nodes: number; readonly edges: number };\n    /** The runtime to act as; detected when absent (tests set it). */\n    readonly runtime?: SourceRuntime | undefined;\n}\n\n/** A context and what the runner needs to close it. */\nexport interface CreatedContext {\n    /** The context handed to the source. */\n    readonly ctx: SourceContext;\n    /** Counters the runner reads. */\n    readonly state: ContextState;\n    /**\n     * The report's `source` member as it stands.\n     * @param next - where to resume\n     * @returns the info\n     */\n    info(next: SourceCursor | null): SourceReportInfo;\n    /** Clear the timeout and detach from the caller's signal. */\n    dispose(): void;\n}\n\n/**\n * Wait, unless the signal aborts first.\n * @param ms - milliseconds\n * @param signal - the signal\n * @returns a promise that settles after the wait\n */\nexport function sleep(ms: number, signal: AbortSignal): Promise<void> {\n    return new Promise<void>((resolve, reject) => {\n        if (signal.aborted) {\n            reject(signal.reason as Error);\n            return;\n        }\n        const onAbort = (): void => {\n            clearTimeout(timer);\n            reject(signal.reason as Error);\n        };\n        const timer = setTimeout(() => {\n            signal.removeEventListener(\"abort\", onAbort);\n            resolve();\n        }, ms);\n        signal.addEventListener(\"abort\", onAbort, { once: true });\n    });\n}\n\n/**\n * The milliseconds a readable Retry-After header asks for.\n * @param response - the response\n * @returns milliseconds, or null when absent or unreadable\n */\nfunction retryAfterMs(response: Response): number | null {\n    const value = response.headers.get(\"retry-after\");\n    if (value === null) {\n        return null;\n    }\n    const seconds = Number(value);\n    if (Number.isFinite(seconds)) {\n        return Math.max(0, seconds * 1000);\n    }\n    const date = Date.parse(value);\n    return Number.isNaN(date) ? null : Math.max(0, date - Date.now());\n}\n\n/**\n * The origins a credential goes to: its own, else the endpoint's.\n * @param credential - the credential, if any\n * @param endpoint - the endpoint, if any\n * @returns the origins\n */\nfunction boundOrigins(credential: Credential | undefined, endpoint: URL | null): readonly string[] {\n    if (credential === undefined) {\n        return [];\n    }\n    if (credential.origins.length > 0) {\n        return credential.origins;\n    }\n    return endpoint === null ? [] : [originOf(endpoint)];\n}\n\n/** The retry settings, resolved. */\ninterface RetrySettings {\n    readonly retries: number;\n    readonly baseDelayMs: number;\n    readonly maxDelayMs: number;\n}\n\n/**\n * The machinery behind one context: the guarded fetch, the caps, pacing, the timeout and the\n * counters.\n */\nclass SourceFetcher {\n    readonly state: ContextState = { requests: 0, bytes: 0, finish: null };\n    readonly signal: AbortSignal;\n    readonly runtime: SourceRuntime;\n    private readonly controller = new AbortController();\n    private readonly fetchImpl: typeof fetch;\n    private readonly limitOptions: SourceLimitOptions;\n    private readonly retry: RetrySettings;\n    private readonly credentialOrigins: readonly string[];\n    private readonly warnedLimits = new Set<string>();\n    private readonly timer: ReturnType<typeof setTimeout> | undefined;\n    private byteTotal: number | undefined;\n\n    /**\n     * Set up one call.\n     * @param input - the source, options, report and counters\n     */\n    constructor(private readonly input: ContextInput) {\n        const { options, endpoint } = input;\n        this.runtime = input.runtime ?? detectRuntime();\n        this.fetchImpl = options.fetch ?? ((...args) => globalThis.fetch(...args));\n        this.limitOptions = options.limits ?? {};\n        const retry = options.retry === false ? { retries: 0 } : (options.retry ?? {});\n        this.retry = {\n            retries: retry.retries ?? 3,\n            baseDelayMs: retry.baseDelayMs ?? 500,\n            maxDelayMs: retry.maxDelayMs ?? 30_000,\n        };\n        this.credentialOrigins = boundOrigins(options.credential, endpoint);\n        // one controller for the caller's signal and the load timeout; its reason is what rejects\n        const callerSignal = options.signal;\n        if (callerSignal?.aborted === true) {\n            this.controller.abort(callerSignal.reason);\n        } else {\n            callerSignal?.addEventListener(\"abort\", this.onCallerAbort, { once: true });\n        }\n        const { timeoutMs } = this.limitOptions;\n        this.timer =\n            timeoutMs === undefined\n                ? undefined\n                : setTimeout(() => {\n                      this.timeOut(timeoutMs);\n                  }, timeoutMs);\n        this.signal = this.controller.signal;\n    }\n\n    /** Clear the timeout and detach from the caller's signal. */\n    dispose(): void {\n        clearTimeout(this.timer);\n        this.input.options.signal?.removeEventListener(\"abort\", this.onCallerAbort);\n    }\n\n    /** Forward the caller's abort, with its reason. */\n    private readonly onCallerAbort = (): void => {\n        this.controller.abort(this.input.options.signal?.reason);\n    };\n\n    /**\n     * Abort the load with E_SOURCE_TIMEOUT as the reason.\n     * @param timeoutMs - the limit that passed\n     */\n    private timeOut(timeoutMs: number): void {\n        try {\n            failOn(this.input.report, \"E_SOURCE_TIMEOUT\", `the load ran longer than ${String(timeoutMs)} ms`, {\n                timeoutMs,\n                serverSide: false,\n            });\n        } catch (err) {\n            this.controller.abort(err);\n        }\n    }\n\n    /**\n     * A cap was reached: fail under \"error\", else warn once and stop.\n     * @param limit - the option name\n     * @param value - the value reached\n     */\n    limitHit(limit: string, value: number): never {\n        const { report } = this.input;\n        if ((this.limitOptions.onLimit ?? \"stop\") === \"error\") {\n            failOn(report, \"E_SOURCE_LIMIT\", `${limit} of ${String(value)} reached`, { limit, value });\n        }\n        if (!this.warnedLimits.has(limit)) {\n            this.warnedLimits.add(limit);\n            warnOn(report, \"W_SOURCE_LIMIT\", `${limit} reached at ${String(value)}; what came first is kept`, {\n                limit,\n                value,\n            });\n        }\n        throw new LimitStop(limit, value);\n    }\n\n    /**\n     * Whether a cap is reached; warns once under \"stop\", throws under \"error\".\n     * @returns true when the source should stop\n     */\n    reached(): boolean {\n        const { nodes, edges } = this.input.counts();\n        const caps: [string, number, number | undefined][] = [\n            [\"maxNodes\", nodes, this.limitOptions.maxNodes],\n            [\"maxEdges\", edges, this.limitOptions.maxEdges],\n            [\"maxBytes\", this.state.bytes, this.limitOptions.maxBytes],\n            [\"maxRequests\", this.state.requests, this.limitOptions.maxRequests],\n        ];\n        const hit = caps.find(([, value, cap]) => cap !== undefined && value >= cap);\n        if (hit === undefined) {\n            return false;\n        }\n        try {\n            this.limitHit(hit[0], hit[1]);\n        } catch (err) {\n            if (!(err instanceof LimitStop)) {\n                throw err;\n            }\n        }\n        return true;\n    }\n\n    /**\n     * Report progress.\n     * @param done - how much is done\n     * @param total - the total, when known\n     * @param unit - what is counted\n     */\n    progress(done: number, total?: number, unit: \"items\" | \"bytes\" = \"items\"): void {\n        if (unit === \"bytes\") {\n            this.byteTotal = total;\n        }\n        this.input.options.onProgress?.(done, total, unit);\n    }\n\n    /**\n     * Resolve a request URL against the endpoint and refuse what must never be sent.\n     * @param target - the source's URL\n     * @returns the absolute URL\n     */\n    private resolve(target: string | URL): URL {\n        const { report, endpoint } = this.input;\n        let url: URL;\n        try {\n            url = endpoint === null ? new URL(target) : new URL(target, endpoint);\n        } catch {\n            return failOn(report, \"E_SOURCE_PARAM\", \"a relative URL needs an endpoint\", {\n                name: \"endpoint\",\n                reason: \"missing\",\n            });\n        }\n        if (url.username !== \"\" || url.password !== \"\") {\n            failOn(report, \"E_SOURCE_PARAM\", \"a URL may not carry a user name or password\", {\n                name: \"endpoint\",\n                reason: \"credentials-in-url\",\n            });\n        }\n        const page = (globalThis as { location?: { protocol?: string } }).location;\n        const plain = url.protocol === \"http:\" || url.protocol === \"ws:\";\n        if (this.runtime === \"browser\" && page?.protocol === \"https:\" && plain && !isLoopback(url.hostname)) {\n            failOn(report, \"E_SOURCE_RUNTIME\", \"an https page cannot reach a plain http endpoint\", {\n                runtime: this.runtime,\n                reason: \"insecure-endpoint\",\n            });\n        }\n        return url;\n    }\n\n    /**\n     * Wait for a slot under the descriptor's rate limit.\n     * @param url - the request URL\n     * @returns a release function\n     */\n    private async pace(url: URL): Promise<() => void> {\n        const rate = this.input.descriptor?.rateLimit;\n        if (rate === undefined) {\n            return () => undefined;\n        }\n        const key = `${this.input.id} ${originOf(url)}`;\n        const p = PACERS.get(key) ?? { active: 0, times: [], waiters: [] };\n        PACERS.set(key, p);\n        for (;;) {\n            const now = Date.now();\n            p.times = p.times.filter((t) => now - t < rate.perMs);\n            if (rate.concurrent !== undefined && p.active >= rate.concurrent) {\n                await new Promise<void>((r) => p.waiters.push(r));\n            } else if (p.times.length >= rate.requests) {\n                await sleep(Math.max(1, rate.perMs - (now - p.times[0])), this.signal);\n            } else {\n                p.times.push(now);\n                p.active++;\n                return () => {\n                    p.active--;\n                    p.waiters.shift()?.();\n                };\n            }\n        }\n    }\n\n    /**\n     * Count the decoded bytes of a body as it is read, against `maxBytes`.\n     * @param response - the response\n     * @returns the response, with a counted body\n     */\n    private counted(response: Response): Response {\n        if (response.body === null || NULL_BODY_STATUSES.has(response.status)) {\n            return response;\n        }\n        const counter = new TransformStream<Uint8Array, Uint8Array>({\n            transform: (chunk, ctrl): void => {\n                this.state.bytes += chunk.byteLength;\n                const cap = this.limitOptions.maxBytes;\n                if (cap !== undefined && this.state.bytes > cap) {\n                    this.limitHit(\"maxBytes\", this.state.bytes);\n                }\n                if (this.input.unit === \"bytes\") {\n                    this.input.options.onProgress?.(this.state.bytes, this.byteTotal, \"bytes\");\n                }\n                ctrl.enqueue(chunk);\n            },\n        });\n        return new Response(response.body.pipeThrough(counter), {\n            status: response.status,\n            statusText: response.statusText,\n            headers: response.headers,\n        });\n    }\n\n    /**\n     * Raise the coded issue of a status outside 200 to 299.\n     * @param response - the response\n     * @param url - the request URL\n     * @returns never; it throws\n     */\n    private async statusFailure(response: Response, url: URL): Promise<never> {\n        await response.body?.cancel().catch(() => undefined);\n        const { report } = this.input;\n        const { status } = response;\n        const where = originPath(url);\n        switch (status) {\n            case 401:\n                return failOn(report, \"E_SOURCE_AUTH\", `${where} answered 401`, {\n                    origin: originOf(url),\n                    status,\n                    scheme: response.headers.get(\"www-authenticate\")?.split(/\\s/)[0] ?? null,\n                    serverCode: null,\n                });\n            case 403:\n                return failOn(report, \"E_SOURCE_FORBIDDEN\", `${where} answered 403`, { status, serverCode: null });\n            case 404:\n                return failOn(report, \"E_SOURCE_NOT_FOUND\", `${where} answered 404`, { what: \"url\", value: where });\n            case 429:\n                return failOn(report, \"E_SOURCE_QUOTA\", `${where} answered 429`, {\n                    retryAfterMs: retryAfterMs(response),\n                });\n            default:\n                return failOn(report, \"E_FETCH\", `${where} answered ${String(status)}`, { url: where, status });\n        }\n    }\n\n    /**\n     * Build one request, with the credential when the URL's origin is bound.\n     * @param url - the request URL\n     * @param init - the source's init\n     * @param attach - whether the credential goes with it\n     * @returns the request\n     */\n    private async request(url: URL, init: SourceRequestInit, attach: boolean): Promise<Request> {\n        const { options, report } = this.input;\n        const headers = new Headers(init.headers);\n        if (options.userAgent !== undefined && this.runtime === \"node\") {\n            headers.set(\"User-Agent\", options.userAgent);\n        }\n        const { retry: _retry, idempotent: _idempotent, allowStatus: _allowStatus, ...requestInit } = init;\n        const guarded: RequestInit = {\n            cache: \"no-store\",\n            credentials: \"omit\",\n            redirect: this.runtime === \"browser\" ? \"error\" : \"manual\",\n        };\n        const request = new Request(url, { ...requestInit, headers, signal: this.signal, ...(attach ? guarded : {}) });\n        if (!attach || options.credential === undefined) {\n            return request;\n        }\n        const signed = await applyCredential(options.credential, request);\n        const after = new URL(signed.url);\n        if (originOf(after) !== originOf(url)) {\n            failOn(report, \"E_SOURCE_REDIRECT\", \"the credential changed the request's origin\", {\n                from: originPath(url),\n                to: originPath(after),\n            });\n        }\n        return signed;\n    }\n\n    /**\n     * Send one request, following same-origin redirects by hand while a credential is attached.\n     * @param url - the request URL\n     * @param init - the source's init\n     * @param hops - redirects followed so far\n     * @returns the response\n     */\n    private async send(url: URL, init: SourceRequestInit, hops: number): Promise<Response> {\n        const { options, report } = this.input;\n        const attach = options.credential !== undefined && this.credentialOrigins.includes(originOf(url));\n        const plain = url.protocol === \"http:\" || url.protocol === \"ws:\";\n        if (attach && plain && !isLoopback(url.hostname) && options.allowInsecure !== true) {\n            failOn(report, \"E_SOURCE_PARAM\", \"a credential is never sent without TLS\", {\n                name: \"endpoint\",\n                reason: \"insecure-endpoint\",\n            });\n        }\n        const request = await this.request(url, init, attach);\n        this.state.requests++;\n        const response = await this.fetchImpl(request);\n        if (!attach || !REDIRECT_STATUSES.has(response.status)) {\n            return response;\n        }\n        const location = response.headers.get(\"location\");\n        await response.body?.cancel().catch(() => undefined);\n        const to = location === null ? null : new URL(location, url);\n        if (to === null || originOf(to) !== originOf(url) || hops >= MAX_REDIRECTS) {\n            return failOn(report, \"E_SOURCE_REDIRECT\", \"a redirect while a credential was attached\", {\n                from: originPath(url),\n                to: to === null ? null : originPath(to),\n            });\n        }\n        return this.send(to, response.status === 303 ? { ...init, method: \"GET\", body: null } : init, hops + 1);\n    }\n\n    /**\n     * Whether a browser refused a credentialed request because it was redirected (sent with\n     * `redirect: \"error\"`, which fails like a CORS refusal): the same URL once more, WITHOUT the\n     * credential, under `redirect: \"manual\"`, whose answer to a redirect is an opaque redirect.\n     * @param url - the refused URL\n     * @returns true when the URL answers with a redirect\n     */\n    private async redirects(url: URL): Promise<boolean> {\n        if (this.input.options.retry === false) {\n            return false;\n        }\n        try {\n            const response = await this.fetchImpl(url, {\n                method: \"GET\",\n                redirect: \"manual\",\n                credentials: \"omit\",\n                cache: \"no-store\",\n                signal: this.signal,\n            });\n            await response.body?.cancel().catch(() => undefined);\n            return response.type === \"opaqueredirect\";\n        } catch {\n            throwIfAborted(this.signal);\n            return false;\n        }\n    }\n\n    /**\n     * Why the browser refused a request: one bodyless no-cors GET of the origin's root.\n     * @param url - the refused URL\n     * @returns the cause\n     */\n    private async diagnose(url: URL): Promise<SourceBlockedCause> {\n        const page = (globalThis as { location?: { hostname?: string } }).location;\n        if (page?.hostname !== undefined && !isLocalNetwork(page.hostname) && isLocalNetwork(url.hostname)) {\n            return \"local-network\";\n        }\n        if (this.input.options.retry === false) {\n            return \"unknown\";\n        }\n        try {\n            await this.fetchImpl(`${originOf(url)}/`, {\n                mode: \"no-cors\",\n                method: \"GET\",\n                credentials: \"omit\",\n                cache: \"no-store\",\n                signal: this.signal,\n            });\n            return \"cors\";\n        } catch {\n            throwIfAborted(this.signal);\n            return \"unreachable\";\n        }\n    }\n\n    /**\n     * A full-jitter backoff delay.\n     * @param attempt - the attempt that failed, from 0\n     * @returns milliseconds\n     */\n    private backoff(attempt: number): number {\n        const jitter = Math.random(); // NOSONAR(S2245): retry jitter, not a security value\n        return jitter * Math.min(this.retry.maxDelayMs, this.retry.baseDelayMs * 2 ** attempt);\n    }\n\n    /**\n     * What a network failure becomes: a retry (true), or the coded issue.\n     * @param err - what fetch threw\n     * @param url - the request URL\n     * @param attempt - the attempt, from 0\n     * @param tries - the retries allowed\n     * @param statuses - the statuses seen so far\n     * @param probeRedirect - whether a refused redirect may explain it (a credentialed GET or HEAD)\n     * @returns true to retry\n     */\n    private async networkFailure(\n        err: unknown,\n        url: URL,\n        attempt: number,\n        tries: number,\n        statuses: (number | null)[],\n        probeRedirect: boolean,\n    ): Promise<boolean> {\n        throwIfAborted(this.signal);\n        if (!(err instanceof TypeError)) {\n            throw err;\n        }\n        const { report } = this.input;\n        statuses.push(null);\n        if (this.runtime === \"browser\") {\n            if (probeRedirect && (await this.redirects(url))) {\n                return failOn(report, \"E_SOURCE_REDIRECT\", \"a redirect while a credential was attached\", {\n                    from: originPath(url),\n                    to: null,\n                });\n            }\n            const cause = await this.diagnose(url);\n            // a hidden 429 looks like a CORS refusal, so that one cause is retried once\n            if (cause === \"cors\" && attempt === 0 && tries > 0) {\n                await sleep(this.backoff(0), this.signal);\n                return true;\n            }\n            return failOn(report, \"E_SOURCE_BLOCKED\", `the browser refused ${originPath(url)}`, {\n                url: originPath(url),\n                cause,\n            });\n        }\n        if (attempt < tries) {\n            await sleep(this.backoff(attempt), this.signal);\n            return true;\n        }\n        return failOn(report, \"E_FETCH\", `${originPath(url)} could not be reached`, {\n            url: originPath(url),\n            status: null,\n        });\n    }\n\n    /**\n     * Send one attempt under the request cap and the rate limit.\n     * @param url - the request URL\n     * @param init - the source's init\n     * @param attempt - the attempt, from 0\n     * @param tries - the retries allowed\n     * @param statuses - the statuses seen so far\n     * @returns the response, or null to try again\n     */\n    private async attempt(\n        url: URL,\n        init: SourceRequestInit,\n        attempt: number,\n        tries: number,\n        statuses: (number | null)[],\n    ): Promise<Response | null> {\n        const cap = this.limitOptions.maxRequests;\n        if (cap !== undefined && this.state.requests >= cap) {\n            this.limitHit(\"maxRequests\", this.state.requests);\n        }\n        const release = await this.pace(url);\n        try {\n            return await this.send(url, init, 0);\n        } catch (err) {\n            const method = (init.method ?? \"GET\").toUpperCase();\n            const credentialed =\n                this.input.options.credential !== undefined && this.credentialOrigins.includes(originOf(url));\n            await this.networkFailure(\n                err,\n                url,\n                attempt,\n                tries,\n                statuses,\n                credentialed && (method === \"GET\" || method === \"HEAD\"),\n            );\n            return null;\n        } finally {\n            release();\n        }\n    }\n\n    /**\n     * The guarded fetch handed to sources.\n     * @param target - the URL, relative to the endpoint or absolute\n     * @param init - fetch's init and the source options\n     * @returns the response\n     */\n    async fetch(target: string | URL, init: SourceRequestInit = {}): Promise<Response> {\n        throwIfAborted(this.signal);\n        const url = this.resolve(target);\n        const method = (init.method ?? \"GET\").toUpperCase();\n        const idempotent = method === \"GET\" || method === \"HEAD\" || init.idempotent === true;\n        const tries = init.retry === false || !idempotent ? 0 : this.retry.retries;\n        const statuses: (number | null)[] = [];\n        for (let attempt = 0; ; attempt++) {\n            const response = await this.attempt(url, init, attempt, tries, statuses);\n            if (response === null) {\n                continue;\n            }\n            if (!RETRY_STATUSES.has(response.status) || attempt >= tries) {\n                return this.settle(response, url, init, attempt, statuses);\n            }\n            statuses.push(response.status);\n            const asked = retryAfterMs(response);\n            await response.body?.cancel().catch(() => undefined);\n            await sleep(asked === null ? this.backoff(attempt) : Math.min(asked, this.retry.maxDelayMs), this.signal);\n        }\n    }\n\n    /**\n     * What a fetch returns: a retried success warned, a failing status raised, the body counted.\n     * @param response - the response\n     * @param url - the request URL\n     * @param init - the source's init\n     * @param attempt - the attempt, from 0\n     * @param statuses - the statuses retried before it\n     * @returns the counted response\n     */\n    private settle(\n        response: Response,\n        url: URL,\n        init: SourceRequestInit,\n        attempt: number,\n        statuses: readonly (number | null)[],\n    ): Response | Promise<never> {\n        if (statuses.length > 0 && response.ok) {\n            const attempts = attempt + 1;\n            warnOn(\n                this.input.report,\n                \"W_SOURCE_RETRIED\",\n                `${originPath(url)} answered after ${String(attempts)} attempts`,\n                {\n                    attempts,\n                    statuses,\n                },\n            );\n        }\n        if (!response.ok && response.status !== 304 && !(init.allowStatus ?? []).includes(response.status)) {\n            return this.statusFailure(response, url);\n        }\n        return this.counted(response);\n    }\n\n    /**\n     * Fetch and parse JSON.\n     * @param target - the URL\n     * @param init - the request init\n     * @returns the parsed body\n     */\n    async fetchJson<T>(target: string | URL, init: SourceRequestInit = {}): Promise<T> {\n        const headers = new Headers(init.headers);\n        if (!headers.has(\"accept\")) {\n            headers.set(\"Accept\", \"application/json\");\n        }\n        const response = await this.fetch(target, { ...init, headers });\n        let text: string;\n        try {\n            text = await response.text();\n        } catch (err) {\n            throwIfAborted(this.signal);\n            throw err;\n        }\n        try {\n            return JSON.parse(text) as T;\n        } catch {\n            return failOn(this.input.report, \"E_SOURCE_RESPONSE\", \"the response is not JSON\", {\n                expected: \"json\",\n                contentType: response.headers.get(\"content-type\"),\n            });\n        }\n    }\n\n    /**\n     * The report's `source` member as it stands.\n     * @param next - where to resume\n     * @returns the info\n     */\n    info(next: SourceCursor | null): SourceReportInfo {\n        const { finish } = this.state;\n        const { id, descriptor, endpoint } = this.input;\n        return Object.freeze({\n            id,\n            version: descriptor?.version ?? 1,\n            endpoint: endpoint === null ? null : originPath(endpoint),\n            requests: this.state.requests,\n            bytes: this.state.bytes,\n            next,\n            ...(finish?.server === undefined ? {} : { server: finish.server }),\n            ...(finish?.budget === undefined ? {} : { budget: finish.budget }),\n            ...(finish?.validators === undefined ? {} : { validators: finish.validators }),\n        });\n    }\n}\n\n/** The caller's options behind each context, for transports that cannot go through ctx.fetch. */\nconst CONTEXT_OPTIONS = new WeakMap<SourceContext, LoadFromSourceOptions>();\n\n/**\n * The credential and transport options of a context's load. Internal to graph-io: a transport that\n * hands a credential to a driver (Bolt) reads it here and applies the origin and TLS rules itself.\n * Sources outside graph-io never see a credential.\n * @param ctx - the context\n * @returns the options that matter to a transport\n */\nexport function transportOptions(\n    ctx: SourceContext,\n): Pick<LoadFromSourceOptions, \"credential\" | \"allowInsecure\" | \"userAgent\"> {\n    const options = CONTEXT_OPTIONS.get(ctx) ?? {};\n    return { credential: options.credential, allowInsecure: options.allowInsecure, userAgent: options.userAgent };\n}\n\n/**\n * Create the context of one source call.\n * @param input - the source, options, report and counters\n * @returns the context and its controls\n */\nexport function createSourceContext(input: ContextInput): CreatedContext {\n    const f = new SourceFetcher(input);\n    const limits: SourceLimits = Object.freeze({ ...input.options.limits, reached: () => f.reached() });\n    const ctx: SourceContext = Object.freeze({\n        fetch: (target: string | URL, init?: SourceRequestInit) => f.fetch(target, init),\n        fetchJson: <T>(target: string | URL, init?: SourceRequestInit) => f.fetchJson<T>(target, init),\n        endpoint: input.endpoint,\n        signal: f.signal,\n        report: input.report,\n        limits,\n        cursor: input.cursor,\n        runtime: f.runtime,\n        progress: (done: number, total?: number, unit?: \"items\" | \"bytes\") => {\n            f.progress(done, total, unit);\n        },\n        finish: (result?: SourceFinish): ImportReport => {\n            f.state.finish = result ?? {};\n            return Object.freeze({ ...input.report.finish(), source: f.info(result?.next ?? null) });\n        },\n    });\n    CONTEXT_OPTIONS.set(ctx, input.options);\n    return {\n        ctx,\n        state: f.state,\n        info: (next) => f.info(next),\n        dispose: () => {\n            f.dispose();\n        },\n    };\n}\n"],"names":[],"mappings":";;AA6BA,MAAM,qCAA0C,IAAI,CAAC,KAAK,KAAK,KAAK,GAAG,CAAC;AAGxE,MAAM,yCAA8C,IAAI,CAAC,KAAK,KAAK,KAAK,GAAG,CAAC;AAG5E,MAAM,wCAA6C,IAAI,CAAC,KAAK,KAAK,KAAK,KAAK,GAAG,CAAC;AAGhF,MAAM,gBAAgB;AAMf,MAAM,kBAAkB,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMjC,YACa,OACA,OACX;AACE,UAAM,GAAG,KAAK,eAAe,OAAO,KAAK,CAAC,EAAE;AAHnC,SAAA,QAAA;AACA,SAAA,QAAA;AAGT,SAAK,OAAO;AAAA,EAChB;AACJ;AAMO,SAAS,gBAA+B;AAC3C,QAAM,IAAI;AAMV,MAAI,OAAO,EAAE,SAAS,UAAU,SAAS,UAAU;AAC/C,WAAO;AAAA,EACX;AACA,MAAI,OAAO,EAAE,kBAAkB,YAAY;AACvC,WAAO;AAAA,EACX;AACA,SAAO,EAAE,WAAW,UAAa,EAAE,aAAa,SAAY,YAAY;AAC5E;AAOA,SAAS,WAAW,KAAkB;AAClC,SAAO,GAAG,SAAS,GAAG,CAAC,GAAG,IAAI,QAAQ;AAC1C;AAOO,SAAS,WAAW,UAA2B;AAClD,QAAM,OAAO,SAAS,WAAW,oBAAoB,EAAE,EAAE,YAAA;AACzD,SAAO,SAAS,eAAe,KAAK,SAAS,YAAY,KAAK,sBAAsB,KAAK,IAAI,KAAK,SAAS;AAC/G;AAQO,SAAS,eAAe,UAA2B;AACtD,QAAM,OAAO,SAAS,WAAW,oBAAoB,EAAE,EAAE,YAAA;AACzD,SACI,WAAW,IAAI,KACf,KAAK,SAAS,QAAQ,KACtB,qBAAqB,KAAK,IAAI,KAC9B,2BAA2B,KAAK,IAAI,KACpC,2BAA2B,KAAK,IAAI,KACpC,0CAA0C,KAAK,IAAI,KACnD,qBAAqB,KAAK,IAAI,KAC9B,KAAK,WAAW,OAAO;AAE/B;AAUA,MAAM,6BAAa,IAAA;AAwDZ,SAAS,MAAM,IAAY,QAAoC;AAClE,SAAO,IAAI,QAAc,CAAC,SAAS,WAAW;AAC1C,QAAI,OAAO,SAAS;AAChB,aAAO,OAAO,MAAe;AAC7B;AAAA,IACJ;AACA,UAAM,UAAU,MAAY;AACxB,mBAAa,KAAK;AAClB,aAAO,OAAO,MAAe;AAAA,IACjC;AACA,UAAM,QAAQ,WAAW,MAAM;AAC3B,aAAO,oBAAoB,SAAS,OAAO;AAC3C,cAAA;AAAA,IACJ,GAAG,EAAE;AACL,WAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,MAAM;AAAA,EAC5D,CAAC;AACL;AAOA,SAAS,aAAa,UAAmC;AACrD,QAAM,QAAQ,SAAS,QAAQ,IAAI,aAAa;AAChD,MAAI,UAAU,MAAM;AAChB,WAAO;AAAA,EACX;AACA,QAAM,UAAU,OAAO,KAAK;AAC5B,MAAI,OAAO,SAAS,OAAO,GAAG;AAC1B,WAAO,KAAK,IAAI,GAAG,UAAU,GAAI;AAAA,EACrC;AACA,QAAM,OAAO,KAAK,MAAM,KAAK;AAC7B,SAAO,OAAO,MAAM,IAAI,IAAI,OAAO,KAAK,IAAI,GAAG,OAAO,KAAK,IAAA,CAAK;AACpE;AAQA,SAAS,aAAa,YAAoC,UAAyC;AAC/F,MAAI,eAAe,QAAW;AAC1B,WAAO,CAAA;AAAA,EACX;AACA,MAAI,WAAW,QAAQ,SAAS,GAAG;AAC/B,WAAO,WAAW;AAAA,EACtB;AACA,SAAO,aAAa,OAAO,CAAA,IAAK,CAAC,SAAS,QAAQ,CAAC;AACvD;AAaA,MAAM,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBhB,YAA6B,OAAqB;AAArB,SAAA,QAAA;AAhB7B,SAAS,QAAsB,EAAE,UAAU,GAAG,OAAO,GAAG,QAAQ,KAAA;AAGhE,SAAiB,aAAa,IAAI,gBAAA;AAKlC,SAAiB,mCAAmB,IAAA;AA4CpC,SAAiB,gBAAgB,MAAY;AACzC,WAAK,WAAW,MAAM,KAAK,MAAM,QAAQ,QAAQ,MAAM;AAAA,IAC3D;AArCI,UAAM,EAAE,SAAS,SAAA,IAAa;AAC9B,SAAK,UAAU,MAAM,WAAW,cAAA;AAChC,SAAK,YAAY,QAAQ,UAAU,IAAI,SAAS,WAAW,MAAM,GAAG,IAAI;AACxE,SAAK,eAAe,QAAQ,UAAU,CAAA;AACtC,UAAM,QAAQ,QAAQ,UAAU,QAAQ,EAAE,SAAS,EAAA,IAAO,QAAQ,SAAS,CAAA;AAC3E,SAAK,QAAQ;AAAA,MACT,SAAS,MAAM,WAAW;AAAA,MAC1B,aAAa,MAAM,eAAe;AAAA,MAClC,YAAY,MAAM,cAAc;AAAA,IAAA;AAEpC,SAAK,oBAAoB,aAAa,QAAQ,YAAY,QAAQ;AAElE,UAAM,eAAe,QAAQ;AAC7B,QAAI,cAAc,YAAY,MAAM;AAChC,WAAK,WAAW,MAAM,aAAa,MAAM;AAAA,IAC7C,OAAO;AACH,oBAAc,iBAAiB,SAAS,KAAK,eAAe,EAAE,MAAM,MAAM;AAAA,IAC9E;AACA,UAAM,EAAE,cAAc,KAAK;AAC3B,SAAK,QACD,cAAc,SACR,SACA,WAAW,MAAM;AACb,WAAK,QAAQ,SAAS;AAAA,IAC1B,GAAG,SAAS;AACtB,SAAK,SAAS,KAAK,WAAW;AAAA,EAClC;AAAA;AAAA,EAGA,UAAgB;AACZ,iBAAa,KAAK,KAAK;AACvB,SAAK,MAAM,QAAQ,QAAQ,oBAAoB,SAAS,KAAK,aAAa;AAAA,EAC9E;AAAA;AAAA;AAAA;AAAA;AAAA,EAWQ,QAAQ,WAAyB;AACrC,QAAI;AACA,aAAO,KAAK,MAAM,QAAQ,oBAAoB,4BAA4B,OAAO,SAAS,CAAC,OAAO;AAAA,QAC9F;AAAA,QACA,YAAY;AAAA,MAAA,CACf;AAAA,IACL,SAAS,KAAK;AACV,WAAK,WAAW,MAAM,GAAG;AAAA,IAC7B;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,SAAS,OAAe,OAAsB;AAC1C,UAAM,EAAE,WAAW,KAAK;AACxB,SAAK,KAAK,aAAa,WAAW,YAAY,SAAS;AACnD,aAAO,QAAQ,kBAAkB,GAAG,KAAK,OAAO,OAAO,KAAK,CAAC,YAAY,EAAE,OAAO,MAAA,CAAO;AAAA,IAC7F;AACA,QAAI,CAAC,KAAK,aAAa,IAAI,KAAK,GAAG;AAC/B,WAAK,aAAa,IAAI,KAAK;AAC3B,aAAO,QAAQ,kBAAkB,GAAG,KAAK,eAAe,OAAO,KAAK,CAAC,6BAA6B;AAAA,QAC9F;AAAA,QACA;AAAA,MAAA,CACH;AAAA,IACL;AACA,UAAM,IAAI,UAAU,OAAO,KAAK;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,UAAmB;AACf,UAAM,EAAE,OAAO,MAAA,IAAU,KAAK,MAAM,OAAA;AACpC,UAAM,OAA+C;AAAA,MACjD,CAAC,YAAY,OAAO,KAAK,aAAa,QAAQ;AAAA,MAC9C,CAAC,YAAY,OAAO,KAAK,aAAa,QAAQ;AAAA,MAC9C,CAAC,YAAY,KAAK,MAAM,OAAO,KAAK,aAAa,QAAQ;AAAA,MACzD,CAAC,eAAe,KAAK,MAAM,UAAU,KAAK,aAAa,WAAW;AAAA,IAAA;AAEtE,UAAM,MAAM,KAAK,KAAK,CAAC,CAAA,EAAG,OAAO,GAAG,MAAM,QAAQ,UAAa,SAAS,GAAG;AAC3E,QAAI,QAAQ,QAAW;AACnB,aAAO;AAAA,IACX;AACA,QAAI;AACA,WAAK,SAAS,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;AAAA,IAChC,SAAS,KAAK;AACV,UAAI,EAAE,eAAe,YAAY;AAC7B,cAAM;AAAA,MACV;AAAA,IACJ;AACA,WAAO;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,SAAS,MAAc,OAAgB,OAA0B,SAAe;AAC5E,QAAI,SAAS,SAAS;AAClB,WAAK,YAAY;AAAA,IACrB;AACA,SAAK,MAAM,QAAQ,aAAa,MAAM,OAAO,IAAI;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,QAAQ,QAA2B;AACvC,UAAM,EAAE,QAAQ,SAAA,IAAa,KAAK;AAClC,QAAI;AACJ,QAAI;AACA,YAAM,aAAa,OAAO,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,QAAQ,QAAQ;AAAA,IACxE,QAAQ;AACJ,aAAO,OAAO,QAAQ,kBAAkB,oCAAoC;AAAA,QACxE,MAAM;AAAA,QACN,QAAQ;AAAA,MAAA,CACX;AAAA,IACL;AACA,QAAI,IAAI,aAAa,MAAM,IAAI,aAAa,IAAI;AAC5C,aAAO,QAAQ,kBAAkB,+CAA+C;AAAA,QAC5E,MAAM;AAAA,QACN,QAAQ;AAAA,MAAA,CACX;AAAA,IACL;AACA,UAAM,OAAQ,WAAoD;AAClE,UAAM,QAAQ,IAAI,aAAa,WAAW,IAAI,aAAa;AAC3D,QAAI,KAAK,YAAY,aAAa,MAAM,aAAa,YAAY,SAAS,CAAC,WAAW,IAAI,QAAQ,GAAG;AACjG,aAAO,QAAQ,oBAAoB,oDAAoD;AAAA,QACnF,SAAS,KAAK;AAAA,QACd,QAAQ;AAAA,MAAA,CACX;AAAA,IACL;AACA,WAAO;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,KAAK,KAA+B;AAC9C,UAAM,OAAO,KAAK,MAAM,YAAY;AACpC,QAAI,SAAS,QAAW;AACpB,aAAO,MAAM;AAAA,IACjB;AACA,UAAM,MAAM,GAAG,KAAK,MAAM,EAAE,IAAI,SAAS,GAAG,CAAC;AAC7C,UAAM,IAAI,OAAO,IAAI,GAAG,KAAK,EAAE,QAAQ,GAAG,OAAO,IAAI,SAAS,CAAA,EAAC;AAC/D,WAAO,IAAI,KAAK,CAAC;AACjB,eAAS;AACL,YAAM,MAAM,KAAK,IAAA;AACjB,QAAE,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,MAAM,IAAI,KAAK,KAAK;AACpD,UAAI,KAAK,eAAe,UAAa,EAAE,UAAU,KAAK,YAAY;AAC9D,cAAM,IAAI,QAAc,CAAC,MAAM,EAAE,QAAQ,KAAK,CAAC,CAAC;AAAA,MACpD,WAAW,EAAE,MAAM,UAAU,KAAK,UAAU;AACxC,cAAM,MAAM,KAAK,IAAI,GAAG,KAAK,SAAS,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,KAAK,MAAM;AAAA,MACzE,OAAO;AACH,UAAE,MAAM,KAAK,GAAG;AAChB,UAAE;AACF,eAAO,MAAM;AACT,YAAE;AACF,YAAE,QAAQ,UAAM;AAAA,QACpB;AAAA,MACJ;AAAA,IACJ;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,QAAQ,UAA8B;AAC1C,QAAI,SAAS,SAAS,QAAQ,mBAAmB,IAAI,SAAS,MAAM,GAAG;AACnE,aAAO;AAAA,IACX;AACA,UAAM,UAAU,IAAI,gBAAwC;AAAA,MACxD,WAAW,CAAC,OAAO,SAAe;AAC9B,aAAK,MAAM,SAAS,MAAM;AAC1B,cAAM,MAAM,KAAK,aAAa;AAC9B,YAAI,QAAQ,UAAa,KAAK,MAAM,QAAQ,KAAK;AAC7C,eAAK,SAAS,YAAY,KAAK,MAAM,KAAK;AAAA,QAC9C;AACA,YAAI,KAAK,MAAM,SAAS,SAAS;AAC7B,eAAK,MAAM,QAAQ,aAAa,KAAK,MAAM,OAAO,KAAK,WAAW,OAAO;AAAA,QAC7E;AACA,aAAK,QAAQ,KAAK;AAAA,MACtB;AAAA,IAAA,CACH;AACD,WAAO,IAAI,SAAS,SAAS,KAAK,YAAY,OAAO,GAAG;AAAA,MACpD,QAAQ,SAAS;AAAA,MACjB,YAAY,SAAS;AAAA,MACrB,SAAS,SAAS;AAAA,IAAA,CACrB;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAc,cAAc,UAAoB,KAA0B;AACtE,UAAM,SAAS,MAAM,OAAA,EAAS,MAAM,MAAM,MAAS;AACnD,UAAM,EAAE,WAAW,KAAK;AACxB,UAAM,EAAE,WAAW;AACnB,UAAM,QAAQ,WAAW,GAAG;AAC5B,YAAQ,QAAA;AAAA,MACJ,KAAK;AACD,eAAO,OAAO,QAAQ,iBAAiB,GAAG,KAAK,iBAAiB;AAAA,UAC5D,QAAQ,SAAS,GAAG;AAAA,UACpB;AAAA,UACA,QAAQ,SAAS,QAAQ,IAAI,kBAAkB,GAAG,MAAM,IAAI,EAAE,CAAC,KAAK;AAAA,UACpE,YAAY;AAAA,QAAA,CACf;AAAA,MACL,KAAK;AACD,eAAO,OAAO,QAAQ,sBAAsB,GAAG,KAAK,iBAAiB,EAAE,QAAQ,YAAY,KAAA,CAAM;AAAA,MACrG,KAAK;AACD,eAAO,OAAO,QAAQ,sBAAsB,GAAG,KAAK,iBAAiB,EAAE,MAAM,OAAO,OAAO,MAAA,CAAO;AAAA,MACtG,KAAK;AACD,eAAO,OAAO,QAAQ,kBAAkB,GAAG,KAAK,iBAAiB;AAAA,UAC7D,cAAc,aAAa,QAAQ;AAAA,QAAA,CACtC;AAAA,MACL;AACI,eAAO,OAAO,QAAQ,WAAW,GAAG,KAAK,aAAa,OAAO,MAAM,CAAC,IAAI,EAAE,KAAK,OAAO,QAAQ;AAAA,IAAA;AAAA,EAE1G;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,QAAQ,KAAU,MAAyB,QAAmC;AACxF,UAAM,EAAE,SAAS,OAAA,IAAW,KAAK;AACjC,UAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;AACxC,QAAI,QAAQ,cAAc,UAAa,KAAK,YAAY,QAAQ;AAC5D,cAAQ,IAAI,cAAc,QAAQ,SAAS;AAAA,IAC/C;AACA,UAAM,EAAE,OAAO,QAAQ,YAAY,aAAa,aAAa,cAAc,GAAG,YAAA,IAAgB;AAC9F,UAAM,UAAuB;AAAA,MACzB,OAAO;AAAA,MACP,aAAa;AAAA,MACb,UAAU,KAAK,YAAY,YAAY,UAAU;AAAA,IAAA;AAErD,UAAM,UAAU,IAAI,QAAQ,KAAK,EAAE,GAAG,aAAa,SAAS,QAAQ,KAAK,QAAQ,GAAI,SAAS,UAAU,CAAA,GAAK;AAC7G,QAAI,CAAC,UAAU,QAAQ,eAAe,QAAW;AAC7C,aAAO;AAAA,IACX;AACA,UAAM,SAAS,MAAM,gBAAgB,QAAQ,YAAY,OAAO;AAChE,UAAM,QAAQ,IAAI,IAAI,OAAO,GAAG;AAChC,QAAI,SAAS,KAAK,MAAM,SAAS,GAAG,GAAG;AACnC,aAAO,QAAQ,qBAAqB,+CAA+C;AAAA,QAC/E,MAAM,WAAW,GAAG;AAAA,QACpB,IAAI,WAAW,KAAK;AAAA,MAAA,CACvB;AAAA,IACL;AACA,WAAO;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,KAAK,KAAU,MAAyB,MAAiC;AACnF,UAAM,EAAE,SAAS,OAAA,IAAW,KAAK;AACjC,UAAM,SAAS,QAAQ,eAAe,UAAa,KAAK,kBAAkB,SAAS,SAAS,GAAG,CAAC;AAChG,UAAM,QAAQ,IAAI,aAAa,WAAW,IAAI,aAAa;AAC3D,QAAI,UAAU,SAAS,CAAC,WAAW,IAAI,QAAQ,KAAK,QAAQ,kBAAkB,MAAM;AAChF,aAAO,QAAQ,kBAAkB,0CAA0C;AAAA,QACvE,MAAM;AAAA,QACN,QAAQ;AAAA,MAAA,CACX;AAAA,IACL;AACA,UAAM,UAAU,MAAM,KAAK,QAAQ,KAAK,MAAM,MAAM;AACpD,SAAK,MAAM;AACX,UAAM,WAAW,MAAM,KAAK,UAAU,OAAO;AAC7C,QAAI,CAAC,UAAU,CAAC,kBAAkB,IAAI,SAAS,MAAM,GAAG;AACpD,aAAO;AAAA,IACX;AACA,UAAM,WAAW,SAAS,QAAQ,IAAI,UAAU;AAChD,UAAM,SAAS,MAAM,OAAA,EAAS,MAAM,MAAM,MAAS;AACnD,UAAM,KAAK,aAAa,OAAO,OAAO,IAAI,IAAI,UAAU,GAAG;AAC3D,QAAI,OAAO,QAAQ,SAAS,EAAE,MAAM,SAAS,GAAG,KAAK,QAAQ,eAAe;AACxE,aAAO,OAAO,QAAQ,qBAAqB,8CAA8C;AAAA,QACrF,MAAM,WAAW,GAAG;AAAA,QACpB,IAAI,OAAO,OAAO,OAAO,WAAW,EAAE;AAAA,MAAA,CACzC;AAAA,IACL;AACA,WAAO,KAAK,KAAK,IAAI,SAAS,WAAW,MAAM,EAAE,GAAG,MAAM,QAAQ,OAAO,MAAM,KAAA,IAAS,MAAM,OAAO,CAAC;AAAA,EAC1G;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,UAAU,KAA4B;AAChD,QAAI,KAAK,MAAM,QAAQ,UAAU,OAAO;AACpC,aAAO;AAAA,IACX;AACA,QAAI;AACA,YAAM,WAAW,MAAM,KAAK,UAAU,KAAK;AAAA,QACvC,QAAQ;AAAA,QACR,UAAU;AAAA,QACV,aAAa;AAAA,QACb,OAAO;AAAA,QACP,QAAQ,KAAK;AAAA,MAAA,CAChB;AACD,YAAM,SAAS,MAAM,OAAA,EAAS,MAAM,MAAM,MAAS;AACnD,aAAO,SAAS,SAAS;AAAA,IAC7B,QAAQ;AACJ,qBAAe,KAAK,MAAM;AAC1B,aAAO;AAAA,IACX;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,SAAS,KAAuC;AAC1D,UAAM,OAAQ,WAAoD;AAClE,QAAI,MAAM,aAAa,UAAa,CAAC,eAAe,KAAK,QAAQ,KAAK,eAAe,IAAI,QAAQ,GAAG;AAChG,aAAO;AAAA,IACX;AACA,QAAI,KAAK,MAAM,QAAQ,UAAU,OAAO;AACpC,aAAO;AAAA,IACX;AACA,QAAI;AACA,YAAM,KAAK,UAAU,GAAG,SAAS,GAAG,CAAC,KAAK;AAAA,QACtC,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,OAAO;AAAA,QACP,QAAQ,KAAK;AAAA,MAAA,CAChB;AACD,aAAO;AAAA,IACX,QAAQ;AACJ,qBAAe,KAAK,MAAM;AAC1B,aAAO;AAAA,IACX;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,QAAQ,SAAyB;AACrC,UAAM,SAAS,KAAK,OAAA;AACpB,WAAO,SAAS,KAAK,IAAI,KAAK,MAAM,YAAY,KAAK,MAAM,cAAc,KAAK,OAAO;AAAA,EACzF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAc,eACV,KACA,KACA,SACA,OACA,UACA,eACgB;AAChB,mBAAe,KAAK,MAAM;AAC1B,QAAI,EAAE,eAAe,YAAY;AAC7B,YAAM;AAAA,IACV;AACA,UAAM,EAAE,WAAW,KAAK;AACxB,aAAS,KAAK,IAAI;AAClB,QAAI,KAAK,YAAY,WAAW;AAC5B,UAAI,iBAAkB,MAAM,KAAK,UAAU,GAAG,GAAI;AAC9C,eAAO,OAAO,QAAQ,qBAAqB,8CAA8C;AAAA,UACrF,MAAM,WAAW,GAAG;AAAA,UACpB,IAAI;AAAA,QAAA,CACP;AAAA,MACL;AACA,YAAM,QAAQ,MAAM,KAAK,SAAS,GAAG;AAErC,UAAI,UAAU,UAAU,YAAY,KAAK,QAAQ,GAAG;AAChD,cAAM,MAAM,KAAK,QAAQ,CAAC,GAAG,KAAK,MAAM;AACxC,eAAO;AAAA,MACX;AACA,aAAO,OAAO,QAAQ,oBAAoB,uBAAuB,WAAW,GAAG,CAAC,IAAI;AAAA,QAChF,KAAK,WAAW,GAAG;AAAA,QACnB;AAAA,MAAA,CACH;AAAA,IACL;AACA,QAAI,UAAU,OAAO;AACjB,YAAM,MAAM,KAAK,QAAQ,OAAO,GAAG,KAAK,MAAM;AAC9C,aAAO;AAAA,IACX;AACA,WAAO,OAAO,QAAQ,WAAW,GAAG,WAAW,GAAG,CAAC,yBAAyB;AAAA,MACxE,KAAK,WAAW,GAAG;AAAA,MACnB,QAAQ;AAAA,IAAA,CACX;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAc,QACV,KACA,MACA,SACA,OACA,UACwB;AACxB,UAAM,MAAM,KAAK,aAAa;AAC9B,QAAI,QAAQ,UAAa,KAAK,MAAM,YAAY,KAAK;AACjD,WAAK,SAAS,eAAe,KAAK,MAAM,QAAQ;AAAA,IACpD;AACA,UAAM,UAAU,MAAM,KAAK,KAAK,GAAG;AACnC,QAAI;AACA,aAAO,MAAM,KAAK,KAAK,KAAK,MAAM,CAAC;AAAA,IACvC,SAAS,KAAK;AACV,YAAM,UAAU,KAAK,UAAU,OAAO,YAAA;AACtC,YAAM,eACF,KAAK,MAAM,QAAQ,eAAe,UAAa,KAAK,kBAAkB,SAAS,SAAS,GAAG,CAAC;AAChG,YAAM,KAAK;AAAA,QACP;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,iBAAiB,WAAW,SAAS,WAAW;AAAA,MAAA;AAEpD,aAAO;AAAA,IACX,UAAA;AACI,cAAA;AAAA,IACJ;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,MAAM,QAAsB,OAA0B,IAAuB;AAC/E,mBAAe,KAAK,MAAM;AAC1B,UAAM,MAAM,KAAK,QAAQ,MAAM;AAC/B,UAAM,UAAU,KAAK,UAAU,OAAO,YAAA;AACtC,UAAM,aAAa,WAAW,SAAS,WAAW,UAAU,KAAK,eAAe;AAChF,UAAM,QAAQ,KAAK,UAAU,SAAS,CAAC,aAAa,IAAI,KAAK,MAAM;AACnE,UAAM,WAA8B,CAAA;AACpC,aAAS,UAAU,KAAK,WAAW;AAC/B,YAAM,WAAW,MAAM,KAAK,QAAQ,KAAK,MAAM,SAAS,OAAO,QAAQ;AACvE,UAAI,aAAa,MAAM;AACnB;AAAA,MACJ;AACA,UAAI,CAAC,eAAe,IAAI,SAAS,MAAM,KAAK,WAAW,OAAO;AAC1D,eAAO,KAAK,OAAO,UAAU,KAAK,MAAM,SAAS,QAAQ;AAAA,MAC7D;AACA,eAAS,KAAK,SAAS,MAAM;AAC7B,YAAM,QAAQ,aAAa,QAAQ;AACnC,YAAM,SAAS,MAAM,OAAA,EAAS,MAAM,MAAM,MAAS;AACnD,YAAM,MAAM,UAAU,OAAO,KAAK,QAAQ,OAAO,IAAI,KAAK,IAAI,OAAO,KAAK,MAAM,UAAU,GAAG,KAAK,MAAM;AAAA,IAC5G;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWQ,OACJ,UACA,KACA,MACA,SACA,UACyB;AACzB,QAAI,SAAS,SAAS,KAAK,SAAS,IAAI;AACpC,YAAM,WAAW,UAAU;AAC3B;AAAA,QACI,KAAK,MAAM;AAAA,QACX;AAAA,QACA,GAAG,WAAW,GAAG,CAAC,mBAAmB,OAAO,QAAQ,CAAC;AAAA,QACrD;AAAA,UACI;AAAA,UACA;AAAA,QAAA;AAAA,MACJ;AAAA,IAER;AACA,QAAI,CAAC,SAAS,MAAM,SAAS,WAAW,OAAO,EAAE,KAAK,eAAe,CAAA,GAAI,SAAS,SAAS,MAAM,GAAG;AAChG,aAAO,KAAK,cAAc,UAAU,GAAG;AAAA,IAC3C;AACA,WAAO,KAAK,QAAQ,QAAQ;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,UAAa,QAAsB,OAA0B,IAAgB;AAC/E,UAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;AACxC,QAAI,CAAC,QAAQ,IAAI,QAAQ,GAAG;AACxB,cAAQ,IAAI,UAAU,kBAAkB;AAAA,IAC5C;AACA,UAAM,WAAW,MAAM,KAAK,MAAM,QAAQ,EAAE,GAAG,MAAM,SAAS;AAC9D,QAAI;AACJ,QAAI;AACA,aAAO,MAAM,SAAS,KAAA;AAAA,IAC1B,SAAS,KAAK;AACV,qBAAe,KAAK,MAAM;AAC1B,YAAM;AAAA,IACV;AACA,QAAI;AACA,aAAO,KAAK,MAAM,IAAI;AAAA,IAC1B,QAAQ;AACJ,aAAO,OAAO,KAAK,MAAM,QAAQ,qBAAqB,4BAA4B;AAAA,QAC9E,UAAU;AAAA,QACV,aAAa,SAAS,QAAQ,IAAI,cAAc;AAAA,MAAA,CACnD;AAAA,IACL;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,KAAK,MAA6C;AAC9C,UAAM,EAAE,WAAW,KAAK;AACxB,UAAM,EAAE,IAAI,YAAY,SAAA,IAAa,KAAK;AAC1C,WAAO,OAAO,OAAO;AAAA,MACjB;AAAA,MACA,SAAS,YAAY,WAAW;AAAA,MAChC,UAAU,aAAa,OAAO,OAAO,WAAW,QAAQ;AAAA,MACxD,UAAU,KAAK,MAAM;AAAA,MACrB,OAAO,KAAK,MAAM;AAAA,MAClB;AAAA,MACA,GAAI,QAAQ,WAAW,SAAY,CAAA,IAAK,EAAE,QAAQ,OAAO,OAAA;AAAA,MACzD,GAAI,QAAQ,WAAW,SAAY,CAAA,IAAK,EAAE,QAAQ,OAAO,OAAA;AAAA,MACzD,GAAI,QAAQ,eAAe,SAAY,CAAA,IAAK,EAAE,YAAY,OAAO,WAAA;AAAA,IAAW,CAC/E;AAAA,EACL;AACJ;AAGA,MAAM,sCAAsB,QAAA;AASrB,SAAS,iBACZ,KACyE;AACzE,QAAM,UAAU,gBAAgB,IAAI,GAAG,KAAK,CAAA;AAC5C,SAAO,EAAE,YAAY,QAAQ,YAAY,eAAe,QAAQ,eAAe,WAAW,QAAQ,UAAA;AACtG;AAOO,SAAS,oBAAoB,OAAqC;AACrE,QAAM,IAAI,IAAI,cAAc,KAAK;AACjC,QAAM,SAAuB,OAAO,OAAO,EAAE,GAAG,MAAM,QAAQ,QAAQ,SAAS,MAAM,EAAE,QAAA,GAAW;AAClG,QAAM,MAAqB,OAAO,OAAO;AAAA,IACrC,OAAO,CAAC,QAAsB,SAA6B,EAAE,MAAM,QAAQ,IAAI;AAAA,IAC/E,WAAW,CAAI,QAAsB,SAA6B,EAAE,UAAa,QAAQ,IAAI;AAAA,IAC7F,UAAU,MAAM;AAAA,IAChB,QAAQ,EAAE;AAAA,IACV,QAAQ,MAAM;AAAA,IACd;AAAA,IACA,QAAQ,MAAM;AAAA,IACd,SAAS,EAAE;AAAA,IACX,UAAU,CAAC,MAAc,OAAgB,SAA6B;AAClE,QAAE,SAAS,MAAM,OAAO,IAAI;AAAA,IAChC;AAAA,IACA,QAAQ,CAAC,WAAwC;AAC7C,QAAE,MAAM,SAAS,UAAU,CAAA;AAC3B,aAAO,OAAO,OAAO,EAAE,GAAG,MAAM,OAAO,OAAA,GAAU,QAAQ,EAAE,KAAK,QAAQ,QAAQ,IAAI,GAAG;AAAA,IAC3F;AAAA,EAAA,CACH;AACD,kBAAgB,IAAI,KAAK,MAAM,OAAO;AACtC,SAAO;AAAA,IACH;AAAA,IACA,OAAO,EAAE;AAAA,IACT,MAAM,CAAC,SAAS,EAAE,KAAK,IAAI;AAAA,IAC3B,SAAS,MAAM;AACX,QAAE,QAAA;AAAA,IACN;AAAA,EAAA;AAER;"}

package/dist/chunks/credentials-BiQsnMTb.js

@@ -0,0 +1,347 @@
+import { K as ImportReportBuilder } from "./report-CgdsL9Hb.js";
+const NDEX_SOURCE_ID = "ndex";
+const CYPHER_SOURCE_ID = "cypher";
+const NEO4J_SOURCE_ID = "neo4j";
+const NEPTUNE_SOURCE_ID = "neptune";
+const REST_SOURCE_ID = "rest";
+const OPENALEX_SOURCE_ID = "openalex";
+const SOURCE_ATTR_PREFIX = "_source.";
+const SOURCE_STUB_ATTR = "_source.stub";
+const SOURCE_ENTITY_ATTR = "_source.entity";
+const SOURCE_DEGREE_ATTR = "_source.degree";
+const SOURCE_FORMAT_PREFIX = "source:";
+const CATEGORY = {
+  E_SOURCE_PARAM: "validation-error",
+  E_SOURCE_INVALID: "validation-error",
+  E_SOURCE_RESPONSE: "parse-error",
+  E_SOURCE_NOT_A_GRAPH: "parse-error",
+  E_SOURCE_NOT_FOUND: "missing-value",
+  E_SOURCE_UNKNOWN: "missing-value"
+};
+function failOn(report, code, message, params) {
+  return report.fork().failWith(CATEGORY[code] ?? "unsupported", code, message, void 0, params, params);
+}
+function failAlone(code, message, params, format = "source") {
+  failOn(new ImportReportBuilder(format, 0), code, message, params);
+}
+function warnOn(report, code, message, params) {
+  report.warning("unsupported", code, message, void 0, params);
+}
+const ID_FORM = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+const FEATURE_METHODS = [
+  ["expand", "expand"],
+  ["probe", "probe"],
+  ["list", "list"],
+  ["validate", "validate"]
+];
+function invalid(id, reason, message) {
+  failAlone("E_SOURCE_INVALID", message, { id, reason });
+}
+function checkSourceId(id) {
+  if (typeof id !== "string" || !ID_FORM.test(id)) {
+    invalid(String(id), "id", `source id ${JSON.stringify(id)} must be lowercase letters, digits and dashes`);
+  }
+}
+function featuresOf(source) {
+  return FEATURE_METHODS.filter(([, method]) => typeof source[method] === "function").map(([f]) => f);
+}
+function checkSource(source, declared) {
+  checkSourceId(source.id);
+  const reads = ["records", "file", "import"].filter((m) => typeof source[m] === "function");
+  if (reads.length !== 1) {
+    invalid(source.id, "read-methods", `source ${source.id} must have exactly one of records, file and import`);
+  }
+  const features = (declared ?? source.descriptor)?.features;
+  if (features !== void 0) {
+    const has = new Set(featuresOf(source));
+    for (const f of features) {
+      if (f !== "page" && !has.has(f)) {
+        invalid(source.id, "features", `source ${source.id} declares ${f} but has no ${f} method`);
+      }
+    }
+  }
+}
+function checkLazySource(source) {
+  checkSourceId(source.id);
+  if (typeof source.load !== "function" || typeof source.descriptor !== "object") {
+    invalid(source.id, "lazy", `lazy source ${source.id} needs a descriptor and a load function`);
+  }
+}
+function defineSource(source) {
+  checkSource(source);
+  return source;
+}
+function numberProblem(p, value) {
+  if (typeof value !== "number" || Number.isNaN(value) || p.type === "integer" && !Number.isInteger(value)) {
+    return "type";
+  }
+  if (p.min !== void 0 && value < p.min || p.max !== void 0 && value > p.max) {
+    return "range";
+  }
+  return null;
+}
+function urlProblem(value) {
+  let url;
+  try {
+    url = new URL(typeof value === "string" ? value : "");
+  } catch {
+    return "type";
+  }
+  return url.username !== "" || url.password !== "" ? "credentials-in-url" : null;
+}
+function paramProblem(p, value) {
+  switch (p.type) {
+    case "integer":
+    case "number":
+      return numberProblem(p, value);
+    case "boolean":
+      return typeof value === "boolean" ? null : "type";
+    case "enum":
+      return p.values !== void 0 && !p.values.some((v) => v.value === value) ? "enum" : null;
+    case "url":
+      return urlProblem(value);
+    default:
+      return null;
+  }
+}
+function checkParams(params, descriptor, report) {
+  if (typeof params !== "object" || params === null) {
+    failOn(report, "E_SOURCE_PARAM", "params must be an object", { name: "params", reason: "type" });
+  }
+  for (const p of descriptor?.params ?? []) {
+    const value = params[p.name];
+    const missing = value === void 0 || value === null;
+    let reason = null;
+    if (!missing) {
+      reason = paramProblem(p, value);
+    } else if (p.required === true && p.default === void 0) {
+      reason = "required";
+    }
+    if (reason !== null) {
+      failOn(report, "E_SOURCE_PARAM", `parameter ${p.name}: ${reason}`, { name: p.name, reason });
+    }
+  }
+}
+const SECRETS = /* @__PURE__ */ new WeakMap();
+const INSPECT = /* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom");
+function originOf(url) {
+  return `${url.protocol}//${url.host}`;
+}
+function bindOrigins(bind) {
+  return Object.freeze(
+    (bind?.origins ?? []).map((o) => {
+      let url;
+      try {
+        url = new URL(o);
+      } catch {
+        return failAlone("E_SOURCE_PARAM", `credential origin ${JSON.stringify(o)} is not a URL`, {
+          name: "origins",
+          reason: "origin"
+        });
+      }
+      return originOf(url);
+    })
+  );
+}
+class SourceCredential {
+  /**
+   * Create one; only the factories do.
+   * @param secret - the secret
+   * @param bind - the origins it is bound to
+   */
+  constructor(secret, bind) {
+    this.kind = secret.kind === "custom" ? secret.name : secret.kind;
+    this.origins = bindOrigins(bind);
+    this.username = secret.kind === "basic" ? secret.username : void 0;
+    SECRETS.set(this, secret);
+    Object.freeze(this);
+  }
+  /**
+   * What JSON.stringify writes: never the secret.
+   * @returns kind, origins and a basic credential's user name
+   */
+  toJSON() {
+    return this.username === void 0 ? { kind: this.kind, origins: this.origins } : { kind: this.kind, origins: this.origins, username: this.username };
+  }
+  /**
+   * What util.inspect and console.log show in Node: never the secret.
+   * @returns the same as toJSON
+   */
+  [INSPECT]() {
+    return this.toJSON();
+  }
+  /**
+   * What string conversion shows: never the secret.
+   * @returns a description
+   */
+  toString() {
+    return `[Credential ${this.kind}]`;
+  }
+}
+function base64(text) {
+  let binary = "";
+  for (const b of new TextEncoder().encode(text)) {
+    binary += String.fromCodePoint(b);
+  }
+  return btoa(binary);
+}
+const credentials = Object.freeze({
+  /**
+   * An `Authorization: Bearer` token, or a function returning a fresh one per request.
+   * @param token - the token or a function returning it
+   * @param bind - the origins it may be sent to
+   * @returns the credential
+   */
+  bearer(token, bind) {
+    return new SourceCredential({ kind: "bearer", token }, bind);
+  },
+  /**
+   * HTTP basic authentication (a database user and password).
+   * @param username - the user name
+   * @param password - the password
+   * @param bind - the origins it may be sent to
+   * @returns the credential
+   */
+  basic(username, password, bind) {
+    return new SourceCredential({ kind: "basic", username, password }, bind);
+  },
+  /**
+   * An API key sent in a request header or a query parameter.
+   * @param where - `{ header: "X-Api-Key" }` or `{ query: "api_key" }`
+   * @param value - the key
+   * @param bind - the origins it may be sent to
+   * @returns the credential
+   */
+  apiKey(where, value, bind) {
+    const header = "header" in where ? where.header : null;
+    const query = "query" in where ? where.query : null;
+    return new SourceCredential({ kind: "api-key", header, query, value }, bind);
+  },
+  /**
+   * AWS Signature Version 4 (Amazon Neptune). The signer loads on first use.
+   * @param options - region, service and the credentials or a provider of them
+   * @param bind - the origins it may be sent to
+   * @returns the credential
+   */
+  awsSigV4(options, bind) {
+    return new SourceCredential({ kind: "aws-sigv4", options }, bind);
+  },
+  /**
+   * Anything else: a function that returns the request with its authentication added. The
+   * request's origin must not change.
+   * @param apply - adds the authentication
+   * @param kind - what to call it in `credential.kind`
+   * @param bind - the origins it may be sent to
+   * @returns the credential
+   */
+  custom(apply, kind, bind) {
+    return new SourceCredential({ kind: "custom", name: kind, apply }, bind);
+  }
+});
+function secretOf(credential) {
+  return SECRETS.get(credential);
+}
+async function applyCredential(credential, request) {
+  const secret = secretOf(credential);
+  if (secret === void 0) {
+    return failAlone("E_SOURCE_PARAM", "the credential was not made by the credentials factories", {
+      name: "credential",
+      reason: "type"
+    });
+  }
+  switch (secret.kind) {
+    case "bearer": {
+      const token = typeof secret.token === "string" ? secret.token : await secret.token();
+      const headers = new Headers(request.headers);
+      headers.set("Authorization", `Bearer ${token}`);
+      return new Request(request, { headers });
+    }
+    case "basic": {
+      const headers = new Headers(request.headers);
+      const pair = `${secret.username}:${secret.password}`;
+      headers.set("Authorization", `Basic ${base64(pair)}`);
+      return new Request(request, { headers });
+    }
+    case "api-key": {
+      if (secret.header !== null) {
+        const headers = new Headers(request.headers);
+        headers.set(secret.header, secret.value);
+        return new Request(request, { headers });
+      }
+      const url = new URL(request.url);
+      url.searchParams.set(secret.query ?? "api_key", secret.value);
+      return new Request(url, request);
+    }
+    case "aws-sigv4": {
+      const { signRequest } = await import("./sigv4-LkAzsLAu.js");
+      return signRequest(request, secret.options);
+    }
+    case "custom":
+      return secret.apply(request);
+    default:
+      return request;
+  }
+}
+function unwrapCredential(credential) {
+  const secret = secretOf(credential);
+  if (secret?.kind === "basic") {
+    return { kind: "basic", username: secret.username, password: secret.password };
+  }
+  if (secret?.kind === "bearer") {
+    return { kind: "bearer", token: secret.token };
+  }
+  return secret === void 0 ? void 0 : { kind: credential.kind };
+}
+function storableCredential(credential) {
+  const secret = secretOf(credential);
+  switch (secret?.kind) {
+    case "basic":
+      return { kind: "basic", username: secret.username, password: secret.password };
+    case "api-key":
+      return { kind: "api-key", header: secret.header, query: secret.query, value: secret.value };
+    case "bearer":
+      return typeof secret.token === "string" ? { kind: "bearer", token: secret.token } : null;
+    default:
+      return null;
+  }
+}
+function fromStorableCredential(parts, bind) {
+  switch (parts.kind) {
+    case "basic":
+      return credentials.basic(parts.username, parts.password, bind);
+    case "bearer":
+      return credentials.bearer(parts.token, bind);
+    default:
+      return new SourceCredential(
+        { kind: "api-key", header: parts.header, query: parts.query, value: parts.value },
+        bind
+      );
+  }
+}
+export {
+  CYPHER_SOURCE_ID as C,
+  NDEX_SOURCE_ID as N,
+  OPENALEX_SOURCE_ID as O,
+  REST_SOURCE_ID as R,
+  SOURCE_ENTITY_ATTR as S,
+  applyCredential as a,
+  failAlone as b,
+  credentials as c,
+  defineSource as d,
+  SOURCE_STUB_ATTR as e,
+  failOn as f,
+  NEO4J_SOURCE_ID as g,
+  NEPTUNE_SOURCE_ID as h,
+  SOURCE_FORMAT_PREFIX as i,
+  checkParams as j,
+  checkLazySource as k,
+  checkSource as l,
+  SOURCE_ATTR_PREFIX as m,
+  SOURCE_DEGREE_ATTR as n,
+  originOf as o,
+  fromStorableCredential as p,
+  storableCredential as s,
+  unwrapCredential as u,
+  warnOn as w
+};
+//# sourceMappingURL=credentials-BiQsnMTb.js.map

package/dist/chunks/credentials-BiQsnMTb.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials-BiQsnMTb.js","sources":["../../src/sources/ids.ts","../../src/sources/fail.ts","../../src/sources/define.ts","../../src/sources/credentials.ts"],"sourcesContent":["/**\n * The public names of network sources: one constant per built-in source id, and the reserved\n * `_source.` attribute names. Nothing else in graph-io spells them, so a rename is one edit here.\n *\n * Experimental: the ids and the `_source.` namespace await the owner's final word (design\n * section 22, items 4 and 5).\n */\n\n/**\n * The NDEx source (www.ndexbio.org). Experimental.\n * @category Network sources\n */\nexport const NDEX_SOURCE_ID = \"ndex\";\n\n/**\n * The generic Cypher source, for any openCypher server. Experimental.\n * @category Network sources\n */\nexport const CYPHER_SOURCE_ID = \"cypher\";\n\n/**\n * The Neo4j preset of the Cypher source. Experimental.\n * @category Network sources\n */\nexport const NEO4J_SOURCE_ID = \"neo4j\";\n\n/**\n * The Amazon Neptune preset of the Cypher source. Experimental.\n * @category Network sources\n */\nexport const NEPTUNE_SOURCE_ID = \"neptune\";\n\n/**\n * The generic REST mapping source. Experimental.\n * @category Network sources\n */\nexport const REST_SOURCE_ID = \"rest\";\n\n/**\n * The OpenAlex preset of the REST mapping source. Experimental.\n * @category Network sources\n */\nexport const OPENALEX_SOURCE_ID = \"openalex\";\n\n/**\n * The prefix of the reserved attribute namespace sources and graphty-element write facts under.\n * @category Network sources\n */\nexport const SOURCE_ATTR_PREFIX = \"_source.\";\n\n/**\n * Node attribute: true on a stub, a node known only by its id until it is hydrated or expanded.\n * @category Network sources\n */\nexport const SOURCE_STUB_ATTR = \"_source.stub\";\n\n/**\n * Node attribute: the entity a stub node is (a REST mapping's entity name).\n * @category Network sources\n */\nexport const SOURCE_ENTITY_ATTR = \"_source.entity\";\n\n/**\n * Node attribute: the node's degree at the source, when the source returns it at no extra cost\n * (the Cypher source's degree hint).\n * @category Network sources\n */\nexport const SOURCE_DEGREE_ATTR = \"_source.degree\";\n\n/**\n * The prefix of `ImportGraphResult.format` for a load from a source: `\"source:<id>\"`.\n * @category Network sources\n */\nexport const SOURCE_FORMAT_PREFIX = \"source:\";\n","/**\n * Raising a network source issue: one place that turns a code and its params into an ImportError\n * whose `issue.params` and `details` both carry the params, so callers branch on\n * `err.issue.code` and read `err.issue.params` as with every other graph-io failure.\n */\n\nimport { ImportReportBuilder } from \"../common/report.js\";\nimport { type IssueCategory } from \"../types.js\";\nimport { type SourceIssueCode } from \"./codes.js\";\n\n/** The category each code is filed under. */\nconst CATEGORY: Readonly<Partial<Record<SourceIssueCode, IssueCategory>>> = {\n    E_SOURCE_PARAM: \"validation-error\",\n    E_SOURCE_INVALID: \"validation-error\",\n    E_SOURCE_RESPONSE: \"parse-error\",\n    E_SOURCE_NOT_A_GRAPH: \"parse-error\",\n    E_SOURCE_NOT_FOUND: \"missing-value\",\n    E_SOURCE_UNKNOWN: \"missing-value\",\n};\n\n/**\n * Abort a load with a source error, carrying the load's report so far plus the error.\n * @param report - the load's report\n * @param code - the code\n * @param message - a plain-ASCII message, for logs\n * @param params - the issue's values\n * @returns never; it throws the ImportError\n */\nexport function failOn(\n    report: ImportReportBuilder,\n    code: SourceIssueCode,\n    message: string,\n    params: Readonly<Record<string, unknown>>,\n): never {\n    // a fork, so a failure the runner turns into a warning (a later page's 401, a cap) leaves no\n    // error in the load's own report; the ImportError carries everything recorded so far\n    return report.fork().failWith(CATEGORY[code] ?? \"unsupported\", code, message, undefined, params, params);\n}\n\n/**\n * Raise a source error outside a load (registration, a credential factory).\n * @param code - the code\n * @param message - a plain-ASCII message, for logs\n * @param params - the issue's values\n * @param format - the report's format name\n */\nexport function failAlone(\n    code: SourceIssueCode,\n    message: string,\n    params: Readonly<Record<string, unknown>>,\n    format = \"source\",\n): never {\n    failOn(new ImportReportBuilder(format, 0), code, message, params);\n}\n\n/**\n * Record a source warning on a report.\n * @param report - the report\n * @param code - the code\n * @param message - a plain-ASCII message, for logs\n * @param params - the issue's values\n */\nexport function warnOn(\n    report: ImportReportBuilder,\n    code: SourceIssueCode,\n    message: string,\n    params: Readonly<Record<string, unknown>>,\n): void {\n    report.warning(\"unsupported\", code, message, undefined, params);\n}\n","/**\n * `defineSource` and the registration checks (design section 2): the id form, exactly one read\n * method, and the declared features against the methods present. Also the parameter checks every\n * load runs against the descriptor before any request.\n */\n\nimport { type ImportReportBuilder } from \"../common/report.js\";\nimport { failAlone, failOn } from \"./fail.js\";\nimport {\n    type GraphSource,\n    type LazySource,\n    type SourceDescriptor,\n    type SourceFeature,\n    type SourceParamDescriptor,\n} from \"./types.js\";\n\n/** Lowercase letters, digits and single dashes between them. */\nconst ID_FORM = /^[a-z0-9]+(-[a-z0-9]+)*$/;\n\n/** The optional methods and the feature each one is. */\nconst FEATURE_METHODS: readonly (readonly [SourceFeature, \"expand\" | \"probe\" | \"list\" | \"validate\"])[] = [\n    [\"expand\", \"expand\"],\n    [\"probe\", \"probe\"],\n    [\"list\", \"list\"],\n    [\"validate\", \"validate\"],\n];\n\n/**\n * Refuse a malformed source.\n * @param id - the source id\n * @param reason - why\n * @param message - for logs\n */\nfunction invalid(id: string, reason: string, message: string): never {\n    failAlone(\"E_SOURCE_INVALID\", message, { id, reason });\n}\n\n/**\n * Check a source id.\n * @param id - the id\n */\nfunction checkSourceId(id: unknown): asserts id is string {\n    if (typeof id !== \"string\" || !ID_FORM.test(id)) {\n        invalid(String(id), \"id\", `source id ${JSON.stringify(id)} must be lowercase letters, digits and dashes`);\n    }\n}\n\n/**\n * The features a loaded source has, from its methods.\n * @param source - the source\n * @returns the features\n */\nfunction featuresOf(source: GraphSource<never>): readonly SourceFeature[] {\n    return FEATURE_METHODS.filter(([, method]) => typeof source[method] === \"function\").map(([f]) => f);\n}\n\n/**\n * Check a loaded source: its id, exactly one read method, and its declared features.\n * @param source - the source\n * @param declared - features a lazy registration declared, if any\n */\nexport function checkSource(source: GraphSource<never>, declared?: SourceDescriptor): void {\n    checkSourceId((source as { id?: unknown }).id);\n    const reads = ([\"records\", \"file\", \"import\"] as const).filter((m) => typeof source[m] === \"function\");\n    if (reads.length !== 1) {\n        invalid(source.id, \"read-methods\", `source ${source.id} must have exactly one of records, file and import`);\n    }\n    const features = (declared ?? source.descriptor)?.features;\n    if (features !== undefined) {\n        const has = new Set(featuresOf(source));\n        for (const f of features) {\n            if (f !== \"page\" && !has.has(f)) {\n                invalid(source.id, \"features\", `source ${source.id} declares ${f} but has no ${f} method`);\n            }\n        }\n    }\n}\n\n/**\n * Check a lazy registration before its code is loaded.\n * @param source - the lazy source\n */\nexport function checkLazySource(source: LazySource): void {\n    checkSourceId(source.id);\n    if (typeof source.load !== \"function\" || typeof source.descriptor !== \"object\") {\n        invalid(source.id, \"lazy\", `lazy source ${source.id} needs a descriptor and a load function`);\n    }\n}\n\n/**\n * Define a network source: returns it unchanged, with its parameter type inferred, after the\n * registration checks (an id of lowercase letters, digits and dashes; exactly one of `records`,\n * `file` and `import`; declared features backed by methods). A malformed source throws an\n * ImportError whose `issue.code` is E_SOURCE_INVALID. Experimental.\n * @param source - the source\n * @returns the same source\n * @example\n * ```ts\n * const people = defineSource({\n *     id: \"people\",\n *     async records(params: { team: string }, ctx) {\n *         const rows = await ctx.fetchJson<{ id: string; name: string }[]>(`/api/people?team=${params.team}`);\n *         return { nodes: rows };\n *     },\n * });\n * ```\n * @category Network sources\n */\nexport function defineSource<P>(source: GraphSource<P>): GraphSource<P> {\n    checkSource(source);\n    return source;\n}\n\n/**\n * Why a number or integer param is wrong, if it is.\n * @param p - the param's descriptor\n * @param value - the value given\n * @returns the reason, or null when it is fine\n */\nfunction numberProblem(p: SourceParamDescriptor, value: unknown): string | null {\n    if (typeof value !== \"number\" || Number.isNaN(value) || (p.type === \"integer\" && !Number.isInteger(value))) {\n        return \"type\";\n    }\n    if ((p.min !== undefined && value < p.min) || (p.max !== undefined && value > p.max)) {\n        return \"range\";\n    }\n    return null;\n}\n\n/**\n * Why a URL param is wrong, if it is.\n * @param value - the value given\n * @returns the reason, or null when it is fine\n */\nfunction urlProblem(value: unknown): string | null {\n    let url: URL;\n    try {\n        url = new URL(typeof value === \"string\" ? value : \"\");\n    } catch {\n        return \"type\";\n    }\n    return url.username !== \"\" || url.password !== \"\" ? \"credentials-in-url\" : null;\n}\n\n/**\n * Why a present param value is wrong for its descriptor, if it is.\n * @param p - the param's descriptor\n * @param value - the value given (not undefined or null)\n * @returns the reason, or null when it is fine\n */\nfunction paramProblem(p: SourceParamDescriptor, value: unknown): string | null {\n    switch (p.type) {\n        case \"integer\":\n        case \"number\":\n            return numberProblem(p, value);\n        case \"boolean\":\n            return typeof value === \"boolean\" ? null : \"type\";\n        case \"enum\":\n            return p.values !== undefined && !p.values.some((v) => v.value === value) ? \"enum\" : null;\n        case \"url\":\n            return urlProblem(value);\n        default:\n            return null;\n    }\n}\n\n/**\n * Check params against a descriptor before any request: required ones present, numbers and\n * integers in range, booleans, enums, URLs (never with a user name or password in them).\n * @param params - the caller's params\n * @param descriptor - the source's descriptor\n * @param report - the load's report\n */\nexport function checkParams(\n    params: Readonly<Record<string, unknown>>,\n    descriptor: SourceDescriptor | undefined,\n    report: ImportReportBuilder,\n): void {\n    if (typeof params !== \"object\" || (params as unknown) === null) {\n        failOn(report, \"E_SOURCE_PARAM\", \"params must be an object\", { name: \"params\", reason: \"type\" });\n    }\n    for (const p of descriptor?.params ?? []) {\n        const value = params[p.name];\n        const missing = value === undefined || value === null;\n        let reason: string | null = null;\n        if (!missing) {\n            reason = paramProblem(p, value);\n        } else if (p.required === true && p.default === undefined) {\n            reason = \"required\";\n        }\n        if (reason !== null) {\n            failOn(report, \"E_SOURCE_PARAM\", `parameter ${p.name}: ${reason}`, { name: p.name, reason });\n        }\n    }\n}\n","/**\n * Credentials (design section 6): objects made by factories, holding their secret where no code\n * can read it back. graph-io applies a credential inside `ctx.fetch`, only to the origins it is\n * bound to, and keeps nothing after a load settles.\n *\n * Experimental, with the source contract.\n */\n\nimport { failAlone } from \"./fail.js\";\nimport { type AwsCredentials, type Credential, type CredentialKind } from \"./types.js\";\n\n/**\n * Where a credential may go: the load's endpoint origin by default. Experimental.\n * @category Network sources\n */\nexport interface CredentialBind {\n    /** The origins (scheme, host and port) it may be sent to. */\n    readonly origins?: readonly string[] | undefined;\n}\n\n/**\n * The options of `credentials.awsSigV4`. Experimental.\n * @category Network sources\n */\nexport interface AwsSigV4Options {\n    /** The AWS region (\"us-east-1\"). */\n    readonly region: string;\n    /** The signing service: \"neptune-db\" (default) or \"neptune-graph\" for Neptune Analytics. */\n    readonly service?: string | undefined;\n    /** The credentials, or a function returning fresh ones per request. */\n    readonly credentials: AwsCredentials | (() => Promise<AwsCredentials>);\n}\n\n/** What only graph-io's own code can read about a credential. */\ntype Secret =\n    | { readonly kind: \"bearer\"; readonly token: string | (() => Promise<string>) }\n    | { readonly kind: \"basic\"; readonly username: string; readonly password: string }\n    | {\n          readonly kind: \"api-key\";\n          readonly header: string | null;\n          readonly query: string | null;\n          readonly value: string;\n      }\n    | { readonly kind: \"aws-sigv4\"; readonly options: AwsSigV4Options }\n    | {\n          readonly kind: \"custom\";\n          readonly name: string;\n          readonly apply: (request: Request) => Promise<Request> | Request;\n      };\n\n/** The secrets, by credential; a WeakMap so nothing reachable from the object holds them. */\nconst SECRETS = new WeakMap<Credential, Secret>();\n\n/** The key Node's util.inspect looks up. */\nconst INSPECT = Symbol.for(\"nodejs.util.inspect.custom\");\n\n/**\n * The scheme, host and port of a URL. `URL.origin` is \"null\" for schemes such as bolt+s:, so this\n * is used everywhere instead.\n * @param url - the URL\n * @returns the origin string\n */\nexport function originOf(url: URL): string {\n    return `${url.protocol}//${url.host}`;\n}\n\n/**\n * Normalize the origins a credential is bound to.\n * @param bind - the bind option\n * @returns the normalized origins\n */\nfunction bindOrigins(bind: CredentialBind | undefined): readonly string[] {\n    return Object.freeze(\n        (bind?.origins ?? []).map((o) => {\n            let url: URL;\n            try {\n                url = new URL(o);\n            } catch {\n                return failAlone(\"E_SOURCE_PARAM\", `credential origin ${JSON.stringify(o)} is not a URL`, {\n                    name: \"origins\",\n                    reason: \"origin\",\n                });\n            }\n            return originOf(url);\n        }),\n    );\n}\n\n/** The object every factory returns: kind and origins visible, the secret in SECRETS. */\nclass SourceCredential implements Credential {\n    readonly kind: CredentialKind;\n    readonly origins: readonly string[];\n    readonly username: string | undefined;\n\n    /**\n     * Create one; only the factories do.\n     * @param secret - the secret\n     * @param bind - the origins it is bound to\n     */\n    constructor(secret: Secret, bind: CredentialBind | undefined) {\n        this.kind = secret.kind === \"custom\" ? secret.name : secret.kind;\n        this.origins = bindOrigins(bind);\n        this.username = secret.kind === \"basic\" ? secret.username : undefined;\n        SECRETS.set(this, secret);\n        Object.freeze(this);\n    }\n\n    /**\n     * What JSON.stringify writes: never the secret.\n     * @returns kind, origins and a basic credential's user name\n     */\n    toJSON(): Record<string, unknown> {\n        return this.username === undefined\n            ? { kind: this.kind, origins: this.origins }\n            : { kind: this.kind, origins: this.origins, username: this.username };\n    }\n\n    /**\n     * What util.inspect and console.log show in Node: never the secret.\n     * @returns the same as toJSON\n     */\n    [INSPECT](): Record<string, unknown> {\n        return this.toJSON();\n    }\n\n    /**\n     * What string conversion shows: never the secret.\n     * @returns a description\n     */\n    toString(): string {\n        return `[Credential ${this.kind}]`;\n    }\n}\n\n/**\n * Base64 of a string's UTF-8 bytes.\n * @param text - the text\n * @returns base64\n */\nfunction base64(text: string): string {\n    let binary = \"\";\n    for (const b of new TextEncoder().encode(text)) {\n        binary += String.fromCodePoint(b);\n    }\n    return btoa(binary);\n}\n\n/**\n * The factories that make credentials. Pass the result as the `credential` option of a load; it is\n * sent only to the load's endpoint origin, or to `bind.origins` when you give them. Experimental.\n * @example\n * ```ts\n * await loadFromSource(\"people\", { team: \"core\" }, {\n *     endpoint: \"https://example.com\",\n *     credential: credentials.bearer(token),\n * });\n * ```\n * @category Network sources\n */\nexport const credentials = Object.freeze({\n    /**\n     * An `Authorization: Bearer` token, or a function returning a fresh one per request.\n     * @param token - the token or a function returning it\n     * @param bind - the origins it may be sent to\n     * @returns the credential\n     */\n    bearer(token: string | (() => Promise<string>), bind?: CredentialBind): Credential {\n        return new SourceCredential({ kind: \"bearer\", token }, bind);\n    },\n    /**\n     * HTTP basic authentication (a database user and password).\n     * @param username - the user name\n     * @param password - the password\n     * @param bind - the origins it may be sent to\n     * @returns the credential\n     */\n    basic(username: string, password: string, bind?: CredentialBind): Credential {\n        return new SourceCredential({ kind: \"basic\", username, password }, bind);\n    },\n    /**\n     * An API key sent in a request header or a query parameter.\n     * @param where - `{ header: \"X-Api-Key\" }` or `{ query: \"api_key\" }`\n     * @param value - the key\n     * @param bind - the origins it may be sent to\n     * @returns the credential\n     */\n    apiKey(\n        where: { readonly header: string } | { readonly query: string },\n        value: string,\n        bind?: CredentialBind,\n    ): Credential {\n        const header = \"header\" in where ? where.header : null;\n        const query = \"query\" in where ? where.query : null;\n        return new SourceCredential({ kind: \"api-key\", header, query, value }, bind);\n    },\n    /**\n     * AWS Signature Version 4 (Amazon Neptune). The signer loads on first use.\n     * @param options - region, service and the credentials or a provider of them\n     * @param bind - the origins it may be sent to\n     * @returns the credential\n     */\n    awsSigV4(options: AwsSigV4Options, bind?: CredentialBind): Credential {\n        return new SourceCredential({ kind: \"aws-sigv4\", options }, bind);\n    },\n    /**\n     * Anything else: a function that returns the request with its authentication added. The\n     * request's origin must not change.\n     * @param apply - adds the authentication\n     * @param kind - what to call it in `credential.kind`\n     * @param bind - the origins it may be sent to\n     * @returns the credential\n     */\n    custom(apply: (request: Request) => Promise<Request> | Request, kind: string, bind?: CredentialBind): Credential {\n        return new SourceCredential({ kind: \"custom\", name: kind, apply }, bind);\n    },\n});\n\n/**\n * The secret of a credential made by the factories, or undefined for any other object.\n * @param credential - the credential\n * @returns the secret\n */\nfunction secretOf(credential: Credential): Secret | undefined {\n    return SECRETS.get(credential);\n}\n\n/**\n * Whether an object is a credential made by the `credentials` factories.\n * @param value - the value\n * @returns true for a factory-made credential\n */\nexport function isCredential(value: unknown): value is Credential {\n    return typeof value === \"object\" && value !== null && secretOf(value as Credential) !== undefined;\n}\n\n/**\n * The request header a credential sets, for the browser checks; null for a query key or a custom one.\n * @param credential - the credential\n * @returns the header name, lowercase\n */\nexport function credentialHeader(credential: Credential): string | null {\n    const secret = secretOf(credential);\n    if (secret?.kind === \"api-key\") {\n        return secret.header?.toLowerCase() ?? null;\n    }\n    return secret?.kind === \"bearer\" || secret?.kind === \"basic\" || secret?.kind === \"aws-sigv4\"\n        ? \"authorization\"\n        : null;\n}\n\n/**\n * Add a credential to a request. Internal to graph-io: only `ctx.fetch` calls it.\n * @param credential - the credential\n * @param request - the request\n * @returns the request with its authentication\n */\nexport async function applyCredential(credential: Credential, request: Request): Promise<Request> {\n    const secret = secretOf(credential);\n    if (secret === undefined) {\n        return failAlone(\"E_SOURCE_PARAM\", \"the credential was not made by the credentials factories\", {\n            name: \"credential\",\n            reason: \"type\",\n        });\n    }\n    switch (secret.kind) {\n        case \"bearer\": {\n            const token = typeof secret.token === \"string\" ? secret.token : await secret.token();\n            const headers = new Headers(request.headers);\n            headers.set(\"Authorization\", `Bearer ${token}`);\n            return new Request(request, { headers });\n        }\n        case \"basic\": {\n            const headers = new Headers(request.headers);\n            const pair = `${secret.username}:${secret.password}`;\n            headers.set(\"Authorization\", `Basic ${base64(pair)}`);\n            return new Request(request, { headers });\n        }\n        case \"api-key\": {\n            if (secret.header !== null) {\n                const headers = new Headers(request.headers);\n                headers.set(secret.header, secret.value);\n                return new Request(request, { headers });\n            }\n            const url = new URL(request.url);\n            url.searchParams.set(secret.query ?? \"api_key\", secret.value);\n            return new Request(url, request);\n        }\n        case \"aws-sigv4\": {\n            const { signRequest } = await import(\"./sigv4.js\");\n            return signRequest(request, secret.options);\n        }\n        case \"custom\":\n            return secret.apply(request);\n        default:\n            return request;\n    }\n}\n\n/**\n * The raw secret, for a transport that must hand it to a driver (Bolt). Internal to graph-io; the\n * caller applies the origin and TLS rules itself.\n * @param credential - the credential\n * @returns the kind and the values the driver needs\n */\nexport function unwrapCredential(\n    credential: Credential,\n):\n    | { readonly kind: \"basic\"; readonly username: string; readonly password: string }\n    | { readonly kind: \"bearer\"; readonly token: string | (() => Promise<string>) }\n    | { readonly kind: CredentialKind }\n    | undefined {\n    const secret = secretOf(credential);\n    if (secret?.kind === \"basic\") {\n        return { kind: \"basic\", username: secret.username, password: secret.password };\n    }\n    if (secret?.kind === \"bearer\") {\n        return { kind: \"bearer\", token: secret.token };\n    }\n    return secret === undefined ? undefined : { kind: credential.kind };\n}\n\n/**\n * Whether a credential can be remembered: its secret is a plain value, not a function. A token\n * refresher, a custom credential and an AWS provider cannot.\n * @param credential - the credential\n * @returns true for basic, a bearer string token and an API key\n */\nexport function isStorableCredential(credential: Credential): boolean {\n    const secret = secretOf(credential);\n    return (\n        secret?.kind === \"basic\" ||\n        secret?.kind === \"api-key\" ||\n        (secret?.kind === \"bearer\" && typeof secret.token === \"string\")\n    );\n}\n\n/**\n * The plain parts of a credential that can be remembered. Experimental.\n * @category Network sources\n */\nexport type StorableCredential =\n    | {\n          /** A user name and password, sent as HTTP Basic authentication. */\n          readonly kind: \"basic\";\n          /** The user name. */\n          readonly username: string;\n          /** The password. */\n          readonly password: string;\n      }\n    | {\n          /** A bearer token, sent in the Authorization header. */\n          readonly kind: \"bearer\";\n          /** The token. */\n          readonly token: string;\n      }\n    | {\n          /** An API key, sent in a header or a query parameter. */\n          readonly kind: \"api-key\";\n          /** The header that carries the key, or null when a query parameter does. */\n          readonly header: string | null;\n          /** The query parameter that carries the key, or null when a header does. */\n          readonly query: string | null;\n          /** The key. */\n          readonly value: string;\n      };\n\n/**\n * The parts of a credential a credential store saves (graphty-element's `CredentialStore` is the\n * one caller), or null when it cannot be saved: a token function, an AWS provider or a custom\n * credential. The result HOLDS THE SECRET: never log it, and keep it only where you would keep the\n * password itself. `fromStorableCredential` makes the credential again. Experimental.\n * @param credential - a credential made by the `credentials` factories\n * @returns the parts, or null\n * @category Network sources\n */\nexport function storableCredential(credential: Credential): StorableCredential | null {\n    const secret = secretOf(credential);\n    switch (secret?.kind) {\n        case \"basic\":\n            return { kind: \"basic\", username: secret.username, password: secret.password };\n        case \"api-key\":\n            return { kind: \"api-key\", header: secret.header, query: secret.query, value: secret.value };\n        case \"bearer\":\n            return typeof secret.token === \"string\" ? { kind: \"bearer\", token: secret.token } : null;\n        default:\n            return null;\n    }\n}\n\n/**\n * The credential `storableCredential` took apart, bound to the origins given. Experimental.\n * @param parts - what `storableCredential` returned\n * @param bind - the origins it may be sent to\n * @returns the credential\n * @category Network sources\n */\nexport function fromStorableCredential(parts: StorableCredential, bind?: CredentialBind): Credential {\n    switch (parts.kind) {\n        case \"basic\":\n            return credentials.basic(parts.username, parts.password, bind);\n        case \"bearer\":\n            return credentials.bearer(parts.token, bind);\n        default:\n            return new SourceCredential(\n                { kind: \"api-key\", header: parts.header, query: parts.query, value: parts.value },\n                bind,\n            );\n    }\n}\n"],"names":[],"mappings":";AAYO,MAAM,iBAAiB;AAMvB,MAAM,mBAAmB;AAMzB,MAAM,kBAAkB;AAMxB,MAAM,oBAAoB;AAM1B,MAAM,iBAAiB;AAMvB,MAAM,qBAAqB;AAM3B,MAAM,qBAAqB;AAM3B,MAAM,mBAAmB;AAMzB,MAAM,qBAAqB;AAO3B,MAAM,qBAAqB;AAM3B,MAAM,uBAAuB;AC9DpC,MAAM,WAAsE;AAAA,EACxE,gBAAgB;AAAA,EAChB,kBAAkB;AAAA,EAClB,mBAAmB;AAAA,EACnB,sBAAsB;AAAA,EACtB,oBAAoB;AAAA,EACpB,kBAAkB;AACtB;AAUO,SAAS,OACZ,QACA,MACA,SACA,QACK;AAGL,SAAO,OAAO,KAAA,EAAO,SAAS,SAAS,IAAI,KAAK,eAAe,MAAM,SAAS,QAAW,QAAQ,MAAM;AAC3G;AASO,SAAS,UACZ,MACA,SACA,QACA,SAAS,UACJ;AACL,SAAO,IAAI,oBAAoB,QAAQ,CAAC,GAAG,MAAM,SAAS,MAAM;AACpE;AASO,SAAS,OACZ,QACA,MACA,SACA,QACI;AACJ,SAAO,QAAQ,eAAe,MAAM,SAAS,QAAW,MAAM;AAClE;ACpDA,MAAM,UAAU;AAGhB,MAAM,kBAAmG;AAAA,EACrG,CAAC,UAAU,QAAQ;AAAA,EACnB,CAAC,SAAS,OAAO;AAAA,EACjB,CAAC,QAAQ,MAAM;AAAA,EACf,CAAC,YAAY,UAAU;AAC3B;AAQA,SAAS,QAAQ,IAAY,QAAgB,SAAwB;AACjE,YAAU,oBAAoB,SAAS,EAAE,IAAI,QAAQ;AACzD;AAMA,SAAS,cAAc,IAAmC;AACtD,MAAI,OAAO,OAAO,YAAY,CAAC,QAAQ,KAAK,EAAE,GAAG;AAC7C,YAAQ,OAAO,EAAE,GAAG,MAAM,aAAa,KAAK,UAAU,EAAE,CAAC,+CAA+C;AAAA,EAC5G;AACJ;AAOA,SAAS,WAAW,QAAsD;AACtE,SAAO,gBAAgB,OAAO,CAAC,CAAA,EAAG,MAAM,MAAM,OAAO,OAAO,MAAM,MAAM,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;AACtG;AAOO,SAAS,YAAY,QAA4B,UAAmC;AACvF,gBAAe,OAA4B,EAAE;AAC7C,QAAM,QAAS,CAAC,WAAW,QAAQ,QAAQ,EAAY,OAAO,CAAC,MAAM,OAAO,OAAO,CAAC,MAAM,UAAU;AACpG,MAAI,MAAM,WAAW,GAAG;AACpB,YAAQ,OAAO,IAAI,gBAAgB,UAAU,OAAO,EAAE,oDAAoD;AAAA,EAC9G;AACA,QAAM,YAAY,YAAY,OAAO,aAAa;AAClD,MAAI,aAAa,QAAW;AACxB,UAAM,MAAM,IAAI,IAAI,WAAW,MAAM,CAAC;AACtC,eAAW,KAAK,UAAU;AACtB,UAAI,MAAM,UAAU,CAAC,IAAI,IAAI,CAAC,GAAG;AAC7B,gBAAQ,OAAO,IAAI,YAAY,UAAU,OAAO,EAAE,aAAa,CAAC,eAAe,CAAC,SAAS;AAAA,MAC7F;AAAA,IACJ;AAAA,EACJ;AACJ;AAMO,SAAS,gBAAgB,QAA0B;AACtD,gBAAc,OAAO,EAAE;AACvB,MAAI,OAAO,OAAO,SAAS,cAAc,OAAO,OAAO,eAAe,UAAU;AAC5E,YAAQ,OAAO,IAAI,QAAQ,eAAe,OAAO,EAAE,yCAAyC;AAAA,EAChG;AACJ;AAqBO,SAAS,aAAgB,QAAwC;AACpE,cAAY,MAAM;AAClB,SAAO;AACX;AAQA,SAAS,cAAc,GAA0B,OAA+B;AAC5E,MAAI,OAAO,UAAU,YAAY,OAAO,MAAM,KAAK,KAAM,EAAE,SAAS,aAAa,CAAC,OAAO,UAAU,KAAK,GAAI;AACxG,WAAO;AAAA,EACX;AACA,MAAK,EAAE,QAAQ,UAAa,QAAQ,EAAE,OAAS,EAAE,QAAQ,UAAa,QAAQ,EAAE,KAAM;AAClF,WAAO;AAAA,EACX;AACA,SAAO;AACX;AAOA,SAAS,WAAW,OAA+B;AAC/C,MAAI;AACJ,MAAI;AACA,UAAM,IAAI,IAAI,OAAO,UAAU,WAAW,QAAQ,EAAE;AAAA,EACxD,QAAQ;AACJ,WAAO;AAAA,EACX;AACA,SAAO,IAAI,aAAa,MAAM,IAAI,aAAa,KAAK,uBAAuB;AAC/E;AAQA,SAAS,aAAa,GAA0B,OAA+B;AAC3E,UAAQ,EAAE,MAAA;AAAA,IACN,KAAK;AAAA,IACL,KAAK;AACD,aAAO,cAAc,GAAG,KAAK;AAAA,IACjC,KAAK;AACD,aAAO,OAAO,UAAU,YAAY,OAAO;AAAA,IAC/C,KAAK;AACD,aAAO,EAAE,WAAW,UAAa,CAAC,EAAE,OAAO,KAAK,CAAC,MAAM,EAAE,UAAU,KAAK,IAAI,SAAS;AAAA,IACzF,KAAK;AACD,aAAO,WAAW,KAAK;AAAA,IAC3B;AACI,aAAO;AAAA,EAAA;AAEnB;AASO,SAAS,YACZ,QACA,YACA,QACI;AACJ,MAAI,OAAO,WAAW,YAAa,WAAuB,MAAM;AAC5D,WAAO,QAAQ,kBAAkB,4BAA4B,EAAE,MAAM,UAAU,QAAQ,QAAQ;AAAA,EACnG;AACA,aAAW,KAAK,YAAY,UAAU,CAAA,GAAI;AACtC,UAAM,QAAQ,OAAO,EAAE,IAAI;AAC3B,UAAM,UAAU,UAAU,UAAa,UAAU;AACjD,QAAI,SAAwB;AAC5B,QAAI,CAAC,SAAS;AACV,eAAS,aAAa,GAAG,KAAK;AAAA,IAClC,WAAW,EAAE,aAAa,QAAQ,EAAE,YAAY,QAAW;AACvD,eAAS;AAAA,IACb;AACA,QAAI,WAAW,MAAM;AACjB,aAAO,QAAQ,kBAAkB,aAAa,EAAE,IAAI,KAAK,MAAM,IAAI,EAAE,MAAM,EAAE,MAAM,QAAQ;AAAA,IAC/F;AAAA,EACJ;AACJ;AC/IA,MAAM,8BAAc,QAAA;AAGpB,MAAM,UAAU,uBAAO,IAAI,4BAA4B;AAQhD,SAAS,SAAS,KAAkB;AACvC,SAAO,GAAG,IAAI,QAAQ,KAAK,IAAI,IAAI;AACvC;AAOA,SAAS,YAAY,MAAqD;AACtE,SAAO,OAAO;AAAA,KACT,MAAM,WAAW,CAAA,GAAI,IAAI,CAAC,MAAM;AAC7B,UAAI;AACJ,UAAI;AACA,cAAM,IAAI,IAAI,CAAC;AAAA,MACnB,QAAQ;AACJ,eAAO,UAAU,kBAAkB,qBAAqB,KAAK,UAAU,CAAC,CAAC,iBAAiB;AAAA,UACtF,MAAM;AAAA,UACN,QAAQ;AAAA,QAAA,CACX;AAAA,MACL;AACA,aAAO,SAAS,GAAG;AAAA,IACvB,CAAC;AAAA,EAAA;AAET;AAGA,MAAM,iBAAuC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUzC,YAAY,QAAgB,MAAkC;AAC1D,SAAK,OAAO,OAAO,SAAS,WAAW,OAAO,OAAO,OAAO;AAC5D,SAAK,UAAU,YAAY,IAAI;AAC/B,SAAK,WAAW,OAAO,SAAS,UAAU,OAAO,WAAW;AAC5D,YAAQ,IAAI,MAAM,MAAM;AACxB,WAAO,OAAO,IAAI;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,SAAkC;AAC9B,WAAO,KAAK,aAAa,SACnB,EAAE,MAAM,KAAK,MAAM,SAAS,KAAK,QAAA,IACjC,EAAE,MAAM,KAAK,MAAM,SAAS,KAAK,SAAS,UAAU,KAAK,SAAA;AAAA,EACnE;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,CAAC,OAAO,IAA6B;AACjC,WAAO,KAAK,OAAA;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,WAAmB;AACf,WAAO,eAAe,KAAK,IAAI;AAAA,EACnC;AACJ;AAOA,SAAS,OAAO,MAAsB;AAClC,MAAI,SAAS;AACb,aAAW,KAAK,IAAI,YAAA,EAAc,OAAO,IAAI,GAAG;AAC5C,cAAU,OAAO,cAAc,CAAC;AAAA,EACpC;AACA,SAAO,KAAK,MAAM;AACtB;AAcO,MAAM,cAAc,OAAO,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOrC,OAAO,OAAyC,MAAmC;AAC/E,WAAO,IAAI,iBAAiB,EAAE,MAAM,UAAU,MAAA,GAAS,IAAI;AAAA,EAC/D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,UAAkB,UAAkB,MAAmC;AACzE,WAAO,IAAI,iBAAiB,EAAE,MAAM,SAAS,UAAU,SAAA,GAAY,IAAI;AAAA,EAC3E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,OACI,OACA,OACA,MACU;AACV,UAAM,SAAS,YAAY,QAAQ,MAAM,SAAS;AAClD,UAAM,QAAQ,WAAW,QAAQ,MAAM,QAAQ;AAC/C,WAAO,IAAI,iBAAiB,EAAE,MAAM,WAAW,QAAQ,OAAO,MAAA,GAAS,IAAI;AAAA,EAC/E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,SAAS,SAA0B,MAAmC;AAClE,WAAO,IAAI,iBAAiB,EAAE,MAAM,aAAa,QAAA,GAAW,IAAI;AAAA,EACpE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,OAAO,OAAyD,MAAc,MAAmC;AAC7G,WAAO,IAAI,iBAAiB,EAAE,MAAM,UAAU,MAAM,MAAM,MAAA,GAAS,IAAI;AAAA,EAC3E;AACJ,CAAC;AAOD,SAAS,SAAS,YAA4C;AAC1D,SAAO,QAAQ,IAAI,UAAU;AACjC;AAgCA,eAAsB,gBAAgB,YAAwB,SAAoC;AAC9F,QAAM,SAAS,SAAS,UAAU;AAClC,MAAI,WAAW,QAAW;AACtB,WAAO,UAAU,kBAAkB,4DAA4D;AAAA,MAC3F,MAAM;AAAA,MACN,QAAQ;AAAA,IAAA,CACX;AAAA,EACL;AACA,UAAQ,OAAO,MAAA;AAAA,IACX,KAAK,UAAU;AACX,YAAM,QAAQ,OAAO,OAAO,UAAU,WAAW,OAAO,QAAQ,MAAM,OAAO,MAAA;AAC7E,YAAM,UAAU,IAAI,QAAQ,QAAQ,OAAO;AAC3C,cAAQ,IAAI,iBAAiB,UAAU,KAAK,EAAE;AAC9C,aAAO,IAAI,QAAQ,SAAS,EAAE,SAAS;AAAA,IAC3C;AAAA,IACA,KAAK,SAAS;AACV,YAAM,UAAU,IAAI,QAAQ,QAAQ,OAAO;AAC3C,YAAM,OAAO,GAAG,OAAO,QAAQ,IAAI,OAAO,QAAQ;AAClD,cAAQ,IAAI,iBAAiB,SAAS,OAAO,IAAI,CAAC,EAAE;AACpD,aAAO,IAAI,QAAQ,SAAS,EAAE,SAAS;AAAA,IAC3C;AAAA,IACA,KAAK,WAAW;AACZ,UAAI,OAAO,WAAW,MAAM;AACxB,cAAM,UAAU,IAAI,QAAQ,QAAQ,OAAO;AAC3C,gBAAQ,IAAI,OAAO,QAAQ,OAAO,KAAK;AACvC,eAAO,IAAI,QAAQ,SAAS,EAAE,SAAS;AAAA,MAC3C;AACA,YAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAI,aAAa,IAAI,OAAO,SAAS,WAAW,OAAO,KAAK;AAC5D,aAAO,IAAI,QAAQ,KAAK,OAAO;AAAA,IACnC;AAAA,IACA,KAAK,aAAa;AACd,YAAM,EAAE,YAAA,IAAgB,MAAM,OAAO,qBAAY;AACjD,aAAO,YAAY,SAAS,OAAO,OAAO;AAAA,IAC9C;AAAA,IACA,KAAK;AACD,aAAO,OAAO,MAAM,OAAO;AAAA,IAC/B;AACI,aAAO;AAAA,EAAA;AAEnB;AAQO,SAAS,iBACZ,YAKY;AACZ,QAAM,SAAS,SAAS,UAAU;AAClC,MAAI,QAAQ,SAAS,SAAS;AAC1B,WAAO,EAAE,MAAM,SAAS,UAAU,OAAO,UAAU,UAAU,OAAO,SAAA;AAAA,EACxE;AACA,MAAI,QAAQ,SAAS,UAAU;AAC3B,WAAO,EAAE,MAAM,UAAU,OAAO,OAAO,MAAA;AAAA,EAC3C;AACA,SAAO,WAAW,SAAY,SAAY,EAAE,MAAM,WAAW,KAAA;AACjE;AAwDO,SAAS,mBAAmB,YAAmD;AAClF,QAAM,SAAS,SAAS,UAAU;AAClC,UAAQ,QAAQ,MAAA;AAAA,IACZ,KAAK;AACD,aAAO,EAAE,MAAM,SAAS,UAAU,OAAO,UAAU,UAAU,OAAO,SAAA;AAAA,IACxE,KAAK;AACD,aAAO,EAAE,MAAM,WAAW,QAAQ,OAAO,QAAQ,OAAO,OAAO,OAAO,OAAO,OAAO,MAAA;AAAA,IACxF,KAAK;AACD,aAAO,OAAO,OAAO,UAAU,WAAW,EAAE,MAAM,UAAU,OAAO,OAAO,MAAA,IAAU;AAAA,IACxF;AACI,aAAO;AAAA,EAAA;AAEnB;AASO,SAAS,uBAAuB,OAA2B,MAAmC;AACjG,UAAQ,MAAM,MAAA;AAAA,IACV,KAAK;AACD,aAAO,YAAY,MAAM,MAAM,UAAU,MAAM,UAAU,IAAI;AAAA,IACjE,KAAK;AACD,aAAO,YAAY,OAAO,MAAM,OAAO,IAAI;AAAA,IAC/C;AACI,aAAO,IAAI;AAAA,QACP,EAAE,MAAM,WAAW,QAAQ,MAAM,QAAQ,OAAO,MAAM,OAAO,OAAO,MAAM,MAAA;AAAA,QAC1E;AAAA,MAAA;AAAA,EACJ;AAEZ;"}