@graphty/graph-io 0.3.49 → 0.3.50

package/dist/chunks/credentials-DXHx7nwR.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"credentials-DXHx7nwR.js","sources":["../../src/sources/ids.ts","../../src/sources/fail.ts","../../src/sources/define.ts","../../src/sources/credentials.ts"],"sourcesContent":["/**\n * The public names of network sources: one constant per built-in source id, and the reserved\n * `_source.` attribute names. Nothing else in graph-io spells them, so a rename is one edit here.\n *\n * Experimental: the ids and the `_source.` namespace await the owner's final word (design\n * section 22, items 4 and 5).\n */\n\n/**\n * The NDEx source (www.ndexbio.org). Experimental.\n * @category Network sources\n */\nexport const NDEX_SOURCE_ID = \"ndex\";\n\n/**\n * The generic Cypher source, for any openCypher server. Experimental.\n * @category Network sources\n */\nexport const CYPHER_SOURCE_ID = \"cypher\";\n\n/**\n * The Neo4j preset of the Cypher source. Experimental.\n * @category Network sources\n */\nexport const NEO4J_SOURCE_ID = \"neo4j\";\n\n/**\n * The Amazon Neptune preset of the Cypher source. Experimental.\n * @category Network sources\n */\nexport const NEPTUNE_SOURCE_ID = \"neptune\";\n\n/**\n * The generic REST mapping source. Experimental.\n * @category Network sources\n */\nexport const REST_SOURCE_ID = \"rest\";\n\n/**\n * The OpenAlex preset of the REST mapping source. Experimental.\n * @category Network sources\n */\nexport const OPENALEX_SOURCE_ID = \"openalex\";\n\n/**\n * The SPARQL source, for any SPARQL 1.1 endpoint. Experimental.\n * @category Network sources\n */\nexport const SPARQL_SOURCE_ID = \"sparql\";\n\n/**\n * The prefix of the reserved attribute namespace sources and graphty-element write facts under.\n * @category Network sources\n */\nexport const SOURCE_ATTR_PREFIX = \"_source.\";\n\n/**\n * Node attribute: true on a stub, a node known only by its id until it is hydrated or expanded.\n * @category Network sources\n */\nexport const SOURCE_STUB_ATTR = \"_source.stub\";\n\n/**\n * Node attribute: the entity a stub node is (a REST mapping's entity name).\n * @category Network sources\n */\nexport const SOURCE_ENTITY_ATTR = \"_source.entity\";\n\n/**\n * Node attribute: the node's degree at the source, when the source returns it at no extra cost\n * (the Cypher source's degree hint).\n * @category Network sources\n */\nexport const SOURCE_DEGREE_ATTR = \"_source.degree\";\n\n/**\n * The prefix of `ImportGraphResult.format` for a load from a source: `\"source:<id>\"`.\n * @category Network sources\n */\nexport const SOURCE_FORMAT_PREFIX = \"source:\";\n","/**\n * Raising a network source issue: one place that turns a code and its params into an ImportError\n * whose `issue.params` and `details` both carry the params, so callers branch on\n * `err.issue.code` and read `err.issue.params` as with every other graph-io failure.\n */\n\nimport { ImportReportBuilder } from \"../common/report.js\";\nimport { type IssueCategory } from \"../types.js\";\nimport { type SourceIssueCode } from \"./codes.js\";\n\n/** The category each code is filed under. */\nconst CATEGORY: Readonly<Partial<Record<SourceIssueCode, IssueCategory>>> = {\n    E_SOURCE_PARAM: \"validation-error\",\n    E_SOURCE_INVALID: \"validation-error\",\n    E_SOURCE_RESPONSE: \"parse-error\",\n    E_SOURCE_NOT_A_GRAPH: \"parse-error\",\n    E_SOURCE_NOT_FOUND: \"missing-value\",\n    E_SOURCE_UNKNOWN: \"missing-value\",\n};\n\n/**\n * Abort a load with a source error, carrying the load's report so far plus the error.\n * @param report - the load's report\n * @param code - the code\n * @param message - a plain-ASCII message, for logs\n * @param params - the issue's values\n * @returns never; it throws the ImportError\n */\nexport function failOn(\n    report: ImportReportBuilder,\n    code: SourceIssueCode,\n    message: string,\n    params: Readonly<Record<string, unknown>>,\n): never {\n    // a fork, so a failure the runner turns into a warning (a later page's 401, a cap) leaves no\n    // error in the load's own report; the ImportError carries everything recorded so far\n    return report.fork().failWith(CATEGORY[code] ?? \"unsupported\", code, message, undefined, params, params);\n}\n\n/**\n * Raise a source error outside a load (registration, a credential factory).\n * @param code - the code\n * @param message - a plain-ASCII message, for logs\n * @param params - the issue's values\n * @param format - the report's format name\n */\nexport function failAlone(\n    code: SourceIssueCode,\n    message: string,\n    params: Readonly<Record<string, unknown>>,\n    format = \"source\",\n): never {\n    failOn(new ImportReportBuilder(format, 0), code, message, params);\n}\n\n/**\n * Record a source warning on a report.\n * @param report - the report\n * @param code - the code\n * @param message - a plain-ASCII message, for logs\n * @param params - the issue's values\n */\nexport function warnOn(\n    report: ImportReportBuilder,\n    code: SourceIssueCode,\n    message: string,\n    params: Readonly<Record<string, unknown>>,\n): void {\n    report.warning(\"unsupported\", code, message, undefined, params);\n}\n","/**\n * `defineSource` and the registration checks (design section 2): the id form, exactly one read\n * method, and the declared features against the methods present. Also the parameter checks every\n * load runs against the descriptor before any request.\n */\n\nimport { type ImportReportBuilder } from \"../common/report.js\";\nimport { failAlone, failOn } from \"./fail.js\";\nimport {\n    type GraphSource,\n    type LazySource,\n    type SourceDescriptor,\n    type SourceFeature,\n    type SourceParamDescriptor,\n} from \"./types.js\";\n\n/** Lowercase letters, digits and single dashes between them. */\nconst ID_FORM = /^[a-z0-9]+(-[a-z0-9]+)*$/;\n\n/** The optional methods and the feature each one is. */\nconst FEATURE_METHODS: readonly (readonly [SourceFeature, \"expand\" | \"probe\" | \"list\" | \"validate\"])[] = [\n    [\"expand\", \"expand\"],\n    [\"probe\", \"probe\"],\n    [\"list\", \"list\"],\n    [\"validate\", \"validate\"],\n];\n\n/**\n * Refuse a malformed source.\n * @param id - the source id\n * @param reason - why\n * @param message - for logs\n */\nfunction invalid(id: string, reason: string, message: string): never {\n    failAlone(\"E_SOURCE_INVALID\", message, { id, reason });\n}\n\n/**\n * Check a source id.\n * @param id - the id\n */\nfunction checkSourceId(id: unknown): asserts id is string {\n    if (typeof id !== \"string\" || !ID_FORM.test(id)) {\n        invalid(String(id), \"id\", `source id ${JSON.stringify(id)} must be lowercase letters, digits and dashes`);\n    }\n}\n\n/**\n * The features a loaded source has, from its methods.\n * @param source - the source\n * @returns the features\n */\nfunction featuresOf(source: GraphSource<never>): readonly SourceFeature[] {\n    return FEATURE_METHODS.filter(([, method]) => typeof source[method] === \"function\").map(([f]) => f);\n}\n\n/**\n * Check a loaded source: its id, exactly one read method, and its declared features.\n * @param source - the source\n * @param declared - features a lazy registration declared, if any\n */\nexport function checkSource(source: GraphSource<never>, declared?: SourceDescriptor): void {\n    checkSourceId((source as { id?: unknown }).id);\n    const reads = ([\"records\", \"file\", \"import\"] as const).filter((m) => typeof source[m] === \"function\");\n    if (reads.length !== 1) {\n        invalid(source.id, \"read-methods\", `source ${source.id} must have exactly one of records, file and import`);\n    }\n    const features = (declared ?? source.descriptor)?.features;\n    if (features !== undefined) {\n        const has = new Set(featuresOf(source));\n        for (const f of features) {\n            if (f !== \"page\" && !has.has(f)) {\n                invalid(source.id, \"features\", `source ${source.id} declares ${f} but has no ${f} method`);\n            }\n        }\n    }\n}\n\n/**\n * Check a lazy registration before its code is loaded.\n * @param source - the lazy source\n */\nexport function checkLazySource(source: LazySource): void {\n    checkSourceId(source.id);\n    if (typeof source.load !== \"function\" || typeof source.descriptor !== \"object\") {\n        invalid(source.id, \"lazy\", `lazy source ${source.id} needs a descriptor and a load function`);\n    }\n}\n\n/**\n * Define a network source: returns it unchanged, with its parameter type inferred, after the\n * registration checks (an id of lowercase letters, digits and dashes; exactly one of `records`,\n * `file` and `import`; declared features backed by methods). A malformed source throws an\n * ImportError whose `issue.code` is E_SOURCE_INVALID. Experimental.\n * @param source - the source\n * @returns the same source\n * @example\n * ```ts\n * const people = defineSource({\n *     id: \"people\",\n *     async records(params: { team: string }, ctx) {\n *         const rows = await ctx.fetchJson<{ id: string; name: string }[]>(`/api/people?team=${params.team}`);\n *         return { nodes: rows };\n *     },\n * });\n * ```\n * @category Network sources\n */\nexport function defineSource<P>(source: GraphSource<P>): GraphSource<P> {\n    checkSource(source);\n    return source;\n}\n\n/**\n * Why a number or integer param is wrong, if it is.\n * @param p - the param's descriptor\n * @param value - the value given\n * @returns the reason, or null when it is fine\n */\nfunction numberProblem(p: SourceParamDescriptor, value: unknown): string | null {\n    if (typeof value !== \"number\" || Number.isNaN(value) || (p.type === \"integer\" && !Number.isInteger(value))) {\n        return \"type\";\n    }\n    if ((p.min !== undefined && value < p.min) || (p.max !== undefined && value > p.max)) {\n        return \"range\";\n    }\n    return null;\n}\n\n/**\n * Why a URL param is wrong, if it is.\n * @param value - the value given\n * @returns the reason, or null when it is fine\n */\nfunction urlProblem(value: unknown): string | null {\n    let url: URL;\n    try {\n        url = new URL(typeof value === \"string\" ? value : \"\");\n    } catch {\n        return \"type\";\n    }\n    return url.username !== \"\" || url.password !== \"\" ? \"credentials-in-url\" : null;\n}\n\n/**\n * Why a present param value is wrong for its descriptor, if it is.\n * @param p - the param's descriptor\n * @param value - the value given (not undefined or null)\n * @returns the reason, or null when it is fine\n */\nfunction paramProblem(p: SourceParamDescriptor, value: unknown): string | null {\n    switch (p.type) {\n        case \"integer\":\n        case \"number\":\n            return numberProblem(p, value);\n        case \"boolean\":\n            return typeof value === \"boolean\" ? null : \"type\";\n        case \"enum\":\n            return p.values !== undefined && !p.values.some((v) => v.value === value) ? \"enum\" : null;\n        case \"url\":\n            return urlProblem(value);\n        default:\n            return null;\n    }\n}\n\n/**\n * Check params against a descriptor before any request: required ones present, numbers and\n * integers in range, booleans, enums, URLs (never with a user name or password in them).\n * @param params - the caller's params\n * @param descriptor - the source's descriptor\n * @param report - the load's report\n */\nexport function checkParams(\n    params: Readonly<Record<string, unknown>>,\n    descriptor: SourceDescriptor | undefined,\n    report: ImportReportBuilder,\n): void {\n    if (typeof params !== \"object\" || (params as unknown) === null) {\n        failOn(report, \"E_SOURCE_PARAM\", \"params must be an object\", { name: \"params\", reason: \"type\" });\n    }\n    for (const p of descriptor?.params ?? []) {\n        const value = params[p.name];\n        const missing = value === undefined || value === null;\n        let reason: string | null = null;\n        if (!missing) {\n            reason = paramProblem(p, value);\n        } else if (p.required === true && p.default === undefined) {\n            reason = \"required\";\n        }\n        if (reason !== null) {\n            failOn(report, \"E_SOURCE_PARAM\", `parameter ${p.name}: ${reason}`, { name: p.name, reason });\n        }\n    }\n}\n","/**\n * Credentials (design section 6): objects made by factories, holding their secret where no code\n * can read it back. graph-io applies a credential inside `ctx.fetch`, only to the origins it is\n * bound to, and keeps nothing after a load settles.\n *\n * Experimental, with the source contract.\n */\n\nimport { failAlone } from \"./fail.js\";\nimport { type AwsCredentials, type Credential, type CredentialKind } from \"./types.js\";\n\n/**\n * Where a credential may go: the load's endpoint origin by default. Experimental.\n * @category Network sources\n */\nexport interface CredentialBind {\n    /** The origins (scheme, host and port) it may be sent to. */\n    readonly origins?: readonly string[] | undefined;\n}\n\n/**\n * The options of `credentials.awsSigV4`. Experimental.\n * @category Network sources\n */\nexport interface AwsSigV4Options {\n    /** The AWS region (\"us-east-1\"). */\n    readonly region: string;\n    /** The signing service: \"neptune-db\" (default) or \"neptune-graph\" for Neptune Analytics. */\n    readonly service?: string | undefined;\n    /** The credentials, or a function returning fresh ones per request. */\n    readonly credentials: AwsCredentials | (() => Promise<AwsCredentials>);\n}\n\n/** What only graph-io's own code can read about a credential. */\ntype Secret =\n    | { readonly kind: \"bearer\"; readonly token: string | (() => Promise<string>) }\n    | { readonly kind: \"basic\"; readonly username: string; readonly password: string }\n    | {\n          readonly kind: \"api-key\";\n          readonly header: string | null;\n          readonly query: string | null;\n          readonly value: string;\n      }\n    | { readonly kind: \"aws-sigv4\"; readonly options: AwsSigV4Options }\n    | {\n          readonly kind: \"custom\";\n          readonly name: string;\n          readonly apply: (request: Request) => Promise<Request> | Request;\n      };\n\n/** The secrets, by credential; a WeakMap so nothing reachable from the object holds them. */\nconst SECRETS = new WeakMap<Credential, Secret>();\n\n/** The key Node's util.inspect looks up. */\nconst INSPECT = Symbol.for(\"nodejs.util.inspect.custom\");\n\n/**\n * The scheme, host and port of a URL. `URL.origin` is \"null\" for schemes such as bolt+s:, so this\n * is used everywhere instead.\n * @param url - the URL\n * @returns the origin string\n */\nexport function originOf(url: URL): string {\n    return `${url.protocol}//${url.host}`;\n}\n\n/**\n * Normalize the origins a credential is bound to.\n * @param bind - the bind option\n * @returns the normalized origins\n */\nfunction bindOrigins(bind: CredentialBind | undefined): readonly string[] {\n    return Object.freeze(\n        (bind?.origins ?? []).map((o) => {\n            let url: URL;\n            try {\n                url = new URL(o);\n            } catch {\n                return failAlone(\"E_SOURCE_PARAM\", `credential origin ${JSON.stringify(o)} is not a URL`, {\n                    name: \"origins\",\n                    reason: \"origin\",\n                });\n            }\n            return originOf(url);\n        }),\n    );\n}\n\n/** The object every factory returns: kind and origins visible, the secret in SECRETS. */\nclass SourceCredential implements Credential {\n    readonly kind: CredentialKind;\n    readonly origins: readonly string[];\n    readonly username: string | undefined;\n\n    /**\n     * Create one; only the factories do.\n     * @param secret - the secret\n     * @param bind - the origins it is bound to\n     */\n    constructor(secret: Secret, bind: CredentialBind | undefined) {\n        this.kind = secret.kind === \"custom\" ? secret.name : secret.kind;\n        this.origins = bindOrigins(bind);\n        this.username = secret.kind === \"basic\" ? secret.username : undefined;\n        SECRETS.set(this, secret);\n        Object.freeze(this);\n    }\n\n    /**\n     * What JSON.stringify writes: never the secret.\n     * @returns kind, origins and a basic credential's user name\n     */\n    toJSON(): Record<string, unknown> {\n        return this.username === undefined\n            ? { kind: this.kind, origins: this.origins }\n            : { kind: this.kind, origins: this.origins, username: this.username };\n    }\n\n    /**\n     * What util.inspect and console.log show in Node: never the secret.\n     * @returns the same as toJSON\n     */\n    [INSPECT](): Record<string, unknown> {\n        return this.toJSON();\n    }\n\n    /**\n     * What string conversion shows: never the secret.\n     * @returns a description\n     */\n    toString(): string {\n        return `[Credential ${this.kind}]`;\n    }\n}\n\n/**\n * Base64 of a string's UTF-8 bytes.\n * @param text - the text\n * @returns base64\n */\nfunction base64(text: string): string {\n    let binary = \"\";\n    for (const b of new TextEncoder().encode(text)) {\n        binary += String.fromCodePoint(b);\n    }\n    return btoa(binary);\n}\n\n/**\n * The factories that make credentials. Pass the result as the `credential` option of a load; it is\n * sent only to the load's endpoint origin, or to `bind.origins` when you give them. Experimental.\n * @example\n * ```ts\n * await loadFromSource(\"people\", { team: \"core\" }, {\n *     endpoint: \"https://example.com\",\n *     credential: credentials.bearer(token),\n * });\n * ```\n * @category Network sources\n */\nexport const credentials = Object.freeze({\n    /**\n     * An `Authorization: Bearer` token, or a function returning a fresh one per request.\n     * @param token - the token or a function returning it\n     * @param bind - the origins it may be sent to\n     * @returns the credential\n     */\n    bearer(token: string | (() => Promise<string>), bind?: CredentialBind): Credential {\n        return new SourceCredential({ kind: \"bearer\", token }, bind);\n    },\n    /**\n     * HTTP basic authentication (a database user and password).\n     * @param username - the user name\n     * @param password - the password\n     * @param bind - the origins it may be sent to\n     * @returns the credential\n     */\n    basic(username: string, password: string, bind?: CredentialBind): Credential {\n        return new SourceCredential({ kind: \"basic\", username, password }, bind);\n    },\n    /**\n     * An API key sent in a request header or a query parameter.\n     * @param where - `{ header: \"X-Api-Key\" }` or `{ query: \"api_key\" }`\n     * @param value - the key\n     * @param bind - the origins it may be sent to\n     * @returns the credential\n     */\n    apiKey(\n        where: { readonly header: string } | { readonly query: string },\n        value: string,\n        bind?: CredentialBind,\n    ): Credential {\n        const header = \"header\" in where ? where.header : null;\n        const query = \"query\" in where ? where.query : null;\n        return new SourceCredential({ kind: \"api-key\", header, query, value }, bind);\n    },\n    /**\n     * AWS Signature Version 4 (Amazon Neptune). The signer loads on first use.\n     * @param options - region, service and the credentials or a provider of them\n     * @param bind - the origins it may be sent to\n     * @returns the credential\n     */\n    awsSigV4(options: AwsSigV4Options, bind?: CredentialBind): Credential {\n        return new SourceCredential({ kind: \"aws-sigv4\", options }, bind);\n    },\n    /**\n     * Anything else: a function that returns the request with its authentication added. The\n     * request's origin must not change.\n     * @param apply - adds the authentication\n     * @param kind - what to call it in `credential.kind`\n     * @param bind - the origins it may be sent to\n     * @returns the credential\n     */\n    custom(apply: (request: Request) => Promise<Request> | Request, kind: string, bind?: CredentialBind): Credential {\n        return new SourceCredential({ kind: \"custom\", name: kind, apply }, bind);\n    },\n});\n\n/**\n * The secret of a credential made by the factories, or undefined for any other object.\n * @param credential - the credential\n * @returns the secret\n */\nfunction secretOf(credential: Credential): Secret | undefined {\n    return SECRETS.get(credential);\n}\n\n/**\n * Whether an object is a credential made by the `credentials` factories.\n * @param value - the value\n * @returns true for a factory-made credential\n */\nexport function isCredential(value: unknown): value is Credential {\n    return typeof value === \"object\" && value !== null && secretOf(value as Credential) !== undefined;\n}\n\n/**\n * The request header a credential sets, for the browser checks; null for a query key or a custom one.\n * @param credential - the credential\n * @returns the header name, lowercase\n */\nexport function credentialHeader(credential: Credential): string | null {\n    const secret = secretOf(credential);\n    if (secret?.kind === \"api-key\") {\n        return secret.header?.toLowerCase() ?? null;\n    }\n    return secret?.kind === \"bearer\" || secret?.kind === \"basic\" || secret?.kind === \"aws-sigv4\"\n        ? \"authorization\"\n        : null;\n}\n\n/**\n * Add a credential to a request. Internal to graph-io: only `ctx.fetch` calls it.\n * @param credential - the credential\n * @param request - the request\n * @returns the request with its authentication\n */\nexport async function applyCredential(credential: Credential, request: Request): Promise<Request> {\n    const secret = secretOf(credential);\n    if (secret === undefined) {\n        return failAlone(\"E_SOURCE_PARAM\", \"the credential was not made by the credentials factories\", {\n            name: \"credential\",\n            reason: \"type\",\n        });\n    }\n    switch (secret.kind) {\n        case \"bearer\": {\n            const token = typeof secret.token === \"string\" ? secret.token : await secret.token();\n            const headers = new Headers(request.headers);\n            headers.set(\"Authorization\", `Bearer ${token}`);\n            return new Request(request, { headers });\n        }\n        case \"basic\": {\n            const headers = new Headers(request.headers);\n            const pair = `${secret.username}:${secret.password}`;\n            headers.set(\"Authorization\", `Basic ${base64(pair)}`);\n            return new Request(request, { headers });\n        }\n        case \"api-key\": {\n            if (secret.header !== null) {\n                const headers = new Headers(request.headers);\n                headers.set(secret.header, secret.value);\n                return new Request(request, { headers });\n            }\n            const url = new URL(request.url);\n            url.searchParams.set(secret.query ?? \"api_key\", secret.value);\n            return new Request(url, request);\n        }\n        case \"aws-sigv4\": {\n            const { signRequest } = await import(\"./sigv4.js\");\n            return signRequest(request, secret.options);\n        }\n        case \"custom\":\n            return secret.apply(request);\n        default:\n            return request;\n    }\n}\n\n/**\n * The raw secret, for a transport that must hand it to a driver (Bolt). Internal to graph-io; the\n * caller applies the origin and TLS rules itself.\n * @param credential - the credential\n * @returns the kind and the values the driver needs\n */\nexport function unwrapCredential(\n    credential: Credential,\n):\n    | { readonly kind: \"basic\"; readonly username: string; readonly password: string }\n    | { readonly kind: \"bearer\"; readonly token: string | (() => Promise<string>) }\n    | { readonly kind: CredentialKind }\n    | undefined {\n    const secret = secretOf(credential);\n    if (secret?.kind === \"basic\") {\n        return { kind: \"basic\", username: secret.username, password: secret.password };\n    }\n    if (secret?.kind === \"bearer\") {\n        return { kind: \"bearer\", token: secret.token };\n    }\n    return secret === undefined ? undefined : { kind: credential.kind };\n}\n\n/**\n * Whether a credential can be remembered: its secret is a plain value, not a function. A token\n * refresher, a custom credential and an AWS provider cannot.\n * @param credential - the credential\n * @returns true for basic, a bearer string token and an API key\n */\nexport function isStorableCredential(credential: Credential): boolean {\n    const secret = secretOf(credential);\n    return (\n        secret?.kind === \"basic\" ||\n        secret?.kind === \"api-key\" ||\n        (secret?.kind === \"bearer\" && typeof secret.token === \"string\")\n    );\n}\n\n/**\n * The plain parts of a credential that can be remembered. Experimental.\n * @category Network sources\n */\nexport type StorableCredential =\n    | {\n          /** A user name and password, sent as HTTP Basic authentication. */\n          readonly kind: \"basic\";\n          /** The user name. */\n          readonly username: string;\n          /** The password. */\n          readonly password: string;\n      }\n    | {\n          /** A bearer token, sent in the Authorization header. */\n          readonly kind: \"bearer\";\n          /** The token. */\n          readonly token: string;\n      }\n    | {\n          /** An API key, sent in a header or a query parameter. */\n          readonly kind: \"api-key\";\n          /** The header that carries the key, or null when a query parameter does. */\n          readonly header: string | null;\n          /** The query parameter that carries the key, or null when a header does. */\n          readonly query: string | null;\n          /** The key. */\n          readonly value: string;\n      };\n\n/**\n * The parts of a credential a credential store saves (graphty-element's `CredentialStore` is the\n * one caller), or null when it cannot be saved: a token function, an AWS provider or a custom\n * credential. The result HOLDS THE SECRET: never log it, and keep it only where you would keep the\n * password itself. `fromStorableCredential` makes the credential again. Experimental.\n * @param credential - a credential made by the `credentials` factories\n * @returns the parts, or null\n * @category Network sources\n */\nexport function storableCredential(credential: Credential): StorableCredential | null {\n    const secret = secretOf(credential);\n    switch (secret?.kind) {\n        case \"basic\":\n            return { kind: \"basic\", username: secret.username, password: secret.password };\n        case \"api-key\":\n            return { kind: \"api-key\", header: secret.header, query: secret.query, value: secret.value };\n        case \"bearer\":\n            return typeof secret.token === \"string\" ? { kind: \"bearer\", token: secret.token } : null;\n        default:\n            return null;\n    }\n}\n\n/**\n * The credential `storableCredential` took apart, bound to the origins given. Experimental.\n * @param parts - what `storableCredential` returned\n * @param bind - the origins it may be sent to\n * @returns the credential\n * @category Network sources\n */\nexport function fromStorableCredential(parts: StorableCredential, bind?: CredentialBind): Credential {\n    switch (parts.kind) {\n        case \"basic\":\n            return credentials.basic(parts.username, parts.password, bind);\n        case \"bearer\":\n            return credentials.bearer(parts.token, bind);\n        default:\n            return new SourceCredential(\n                { kind: \"api-key\", header: parts.header, query: parts.query, value: parts.value },\n                bind,\n            );\n    }\n}\n"],"names":[],"mappings":";AAYO,MAAM,iBAAiB;AAMvB,MAAM,mBAAmB;AAMzB,MAAM,kBAAkB;AAMxB,MAAM,oBAAoB;AAM1B,MAAM,iBAAiB;AAMvB,MAAM,qBAAqB;AAM3B,MAAM,mBAAmB;AAMzB,MAAM,qBAAqB;AAM3B,MAAM,mBAAmB;AAMzB,MAAM,qBAAqB;AAO3B,MAAM,qBAAqB;AAM3B,MAAM,uBAAuB;ACpEpC,MAAM,WAAsE;AAAA,EACxE,gBAAgB;AAAA,EAChB,kBAAkB;AAAA,EAClB,mBAAmB;AAAA,EACnB,sBAAsB;AAAA,EACtB,oBAAoB;AAAA,EACpB,kBAAkB;AACtB;AAUO,SAAS,OACZ,QACA,MACA,SACA,QACK;AAGL,SAAO,OAAO,KAAA,EAAO,SAAS,SAAS,IAAI,KAAK,eAAe,MAAM,SAAS,QAAW,QAAQ,MAAM;AAC3G;AASO,SAAS,UACZ,MACA,SACA,QACA,SAAS,UACJ;AACL,SAAO,IAAI,oBAAoB,QAAQ,CAAC,GAAG,MAAM,SAAS,MAAM;AACpE;AASO,SAAS,OACZ,QACA,MACA,SACA,QACI;AACJ,SAAO,QAAQ,eAAe,MAAM,SAAS,QAAW,MAAM;AAClE;ACpDA,MAAM,UAAU;AAGhB,MAAM,kBAAmG;AAAA,EACrG,CAAC,UAAU,QAAQ;AAAA,EACnB,CAAC,SAAS,OAAO;AAAA,EACjB,CAAC,QAAQ,MAAM;AAAA,EACf,CAAC,YAAY,UAAU;AAC3B;AAQA,SAAS,QAAQ,IAAY,QAAgB,SAAwB;AACjE,YAAU,oBAAoB,SAAS,EAAE,IAAI,QAAQ;AACzD;AAMA,SAAS,cAAc,IAAmC;AACtD,MAAI,OAAO,OAAO,YAAY,CAAC,QAAQ,KAAK,EAAE,GAAG;AAC7C,YAAQ,OAAO,EAAE,GAAG,MAAM,aAAa,KAAK,UAAU,EAAE,CAAC,+CAA+C;AAAA,EAC5G;AACJ;AAOA,SAAS,WAAW,QAAsD;AACtE,SAAO,gBAAgB,OAAO,CAAC,CAAA,EAAG,MAAM,MAAM,OAAO,OAAO,MAAM,MAAM,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;AACtG;AAOO,SAAS,YAAY,QAA4B,UAAmC;AACvF,gBAAe,OAA4B,EAAE;AAC7C,QAAM,QAAS,CAAC,WAAW,QAAQ,QAAQ,EAAY,OAAO,CAAC,MAAM,OAAO,OAAO,CAAC,MAAM,UAAU;AACpG,MAAI,MAAM,WAAW,GAAG;AACpB,YAAQ,OAAO,IAAI,gBAAgB,UAAU,OAAO,EAAE,oDAAoD;AAAA,EAC9G;AACA,QAAM,YAAY,YAAY,OAAO,aAAa;AAClD,MAAI,aAAa,QAAW;AACxB,UAAM,MAAM,IAAI,IAAI,WAAW,MAAM,CAAC;AACtC,eAAW,KAAK,UAAU;AACtB,UAAI,MAAM,UAAU,CAAC,IAAI,IAAI,CAAC,GAAG;AAC7B,gBAAQ,OAAO,IAAI,YAAY,UAAU,OAAO,EAAE,aAAa,CAAC,eAAe,CAAC,SAAS;AAAA,MAC7F;AAAA,IACJ;AAAA,EACJ;AACJ;AAMO,SAAS,gBAAgB,QAA0B;AACtD,gBAAc,OAAO,EAAE;AACvB,MAAI,OAAO,OAAO,SAAS,cAAc,OAAO,OAAO,eAAe,UAAU;AAC5E,YAAQ,OAAO,IAAI,QAAQ,eAAe,OAAO,EAAE,yCAAyC;AAAA,EAChG;AACJ;AAqBO,SAAS,aAAgB,QAAwC;AACpE,cAAY,MAAM;AAClB,SAAO;AACX;AAQA,SAAS,cAAc,GAA0B,OAA+B;AAC5E,MAAI,OAAO,UAAU,YAAY,OAAO,MAAM,KAAK,KAAM,EAAE,SAAS,aAAa,CAAC,OAAO,UAAU,KAAK,GAAI;AACxG,WAAO;AAAA,EACX;AACA,MAAK,EAAE,QAAQ,UAAa,QAAQ,EAAE,OAAS,EAAE,QAAQ,UAAa,QAAQ,EAAE,KAAM;AAClF,WAAO;AAAA,EACX;AACA,SAAO;AACX;AAOA,SAAS,WAAW,OAA+B;AAC/C,MAAI;AACJ,MAAI;AACA,UAAM,IAAI,IAAI,OAAO,UAAU,WAAW,QAAQ,EAAE;AAAA,EACxD,QAAQ;AACJ,WAAO;AAAA,EACX;AACA,SAAO,IAAI,aAAa,MAAM,IAAI,aAAa,KAAK,uBAAuB;AAC/E;AAQA,SAAS,aAAa,GAA0B,OAA+B;AAC3E,UAAQ,EAAE,MAAA;AAAA,IACN,KAAK;AAAA,IACL,KAAK;AACD,aAAO,cAAc,GAAG,KAAK;AAAA,IACjC,KAAK;AACD,aAAO,OAAO,UAAU,YAAY,OAAO;AAAA,IAC/C,KAAK;AACD,aAAO,EAAE,WAAW,UAAa,CAAC,EAAE,OAAO,KAAK,CAAC,MAAM,EAAE,UAAU,KAAK,IAAI,SAAS;AAAA,IACzF,KAAK;AACD,aAAO,WAAW,KAAK;AAAA,IAC3B;AACI,aAAO;AAAA,EAAA;AAEnB;AASO,SAAS,YACZ,QACA,YACA,QACI;AACJ,MAAI,OAAO,WAAW,YAAa,WAAuB,MAAM;AAC5D,WAAO,QAAQ,kBAAkB,4BAA4B,EAAE,MAAM,UAAU,QAAQ,QAAQ;AAAA,EACnG;AACA,aAAW,KAAK,YAAY,UAAU,CAAA,GAAI;AACtC,UAAM,QAAQ,OAAO,EAAE,IAAI;AAC3B,UAAM,UAAU,UAAU,UAAa,UAAU;AACjD,QAAI,SAAwB;AAC5B,QAAI,CAAC,SAAS;AACV,eAAS,aAAa,GAAG,KAAK;AAAA,IAClC,WAAW,EAAE,aAAa,QAAQ,EAAE,YAAY,QAAW;AACvD,eAAS;AAAA,IACb;AACA,QAAI,WAAW,MAAM;AACjB,aAAO,QAAQ,kBAAkB,aAAa,EAAE,IAAI,KAAK,MAAM,IAAI,EAAE,MAAM,EAAE,MAAM,QAAQ;AAAA,IAC/F;AAAA,EACJ;AACJ;AC/IA,MAAM,8BAAc,QAAA;AAGpB,MAAM,UAAU,uBAAO,IAAI,4BAA4B;AAQhD,SAAS,SAAS,KAAkB;AACvC,SAAO,GAAG,IAAI,QAAQ,KAAK,IAAI,IAAI;AACvC;AAOA,SAAS,YAAY,MAAqD;AACtE,SAAO,OAAO;AAAA,KACT,MAAM,WAAW,CAAA,GAAI,IAAI,CAAC,MAAM;AAC7B,UAAI;AACJ,UAAI;AACA,cAAM,IAAI,IAAI,CAAC;AAAA,MACnB,QAAQ;AACJ,eAAO,UAAU,kBAAkB,qBAAqB,KAAK,UAAU,CAAC,CAAC,iBAAiB;AAAA,UACtF,MAAM;AAAA,UACN,QAAQ;AAAA,QAAA,CACX;AAAA,MACL;AACA,aAAO,SAAS,GAAG;AAAA,IACvB,CAAC;AAAA,EAAA;AAET;AAGA,MAAM,iBAAuC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUzC,YAAY,QAAgB,MAAkC;AAC1D,SAAK,OAAO,OAAO,SAAS,WAAW,OAAO,OAAO,OAAO;AAC5D,SAAK,UAAU,YAAY,IAAI;AAC/B,SAAK,WAAW,OAAO,SAAS,UAAU,OAAO,WAAW;AAC5D,YAAQ,IAAI,MAAM,MAAM;AACxB,WAAO,OAAO,IAAI;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,SAAkC;AAC9B,WAAO,KAAK,aAAa,SACnB,EAAE,MAAM,KAAK,MAAM,SAAS,KAAK,QAAA,IACjC,EAAE,MAAM,KAAK,MAAM,SAAS,KAAK,SAAS,UAAU,KAAK,SAAA;AAAA,EACnE;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,CAAC,OAAO,IAA6B;AACjC,WAAO,KAAK,OAAA;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,WAAmB;AACf,WAAO,eAAe,KAAK,IAAI;AAAA,EACnC;AACJ;AAOA,SAAS,OAAO,MAAsB;AAClC,MAAI,SAAS;AACb,aAAW,KAAK,IAAI,YAAA,EAAc,OAAO,IAAI,GAAG;AAC5C,cAAU,OAAO,cAAc,CAAC;AAAA,EACpC;AACA,SAAO,KAAK,MAAM;AACtB;AAcO,MAAM,cAAc,OAAO,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOrC,OAAO,OAAyC,MAAmC;AAC/E,WAAO,IAAI,iBAAiB,EAAE,MAAM,UAAU,MAAA,GAAS,IAAI;AAAA,EAC/D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,UAAkB,UAAkB,MAAmC;AACzE,WAAO,IAAI,iBAAiB,EAAE,MAAM,SAAS,UAAU,SAAA,GAAY,IAAI;AAAA,EAC3E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,OACI,OACA,OACA,MACU;AACV,UAAM,SAAS,YAAY,QAAQ,MAAM,SAAS;AAClD,UAAM,QAAQ,WAAW,QAAQ,MAAM,QAAQ;AAC/C,WAAO,IAAI,iBAAiB,EAAE,MAAM,WAAW,QAAQ,OAAO,MAAA,GAAS,IAAI;AAAA,EAC/E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,SAAS,SAA0B,MAAmC;AAClE,WAAO,IAAI,iBAAiB,EAAE,MAAM,aAAa,QAAA,GAAW,IAAI;AAAA,EACpE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,OAAO,OAAyD,MAAc,MAAmC;AAC7G,WAAO,IAAI,iBAAiB,EAAE,MAAM,UAAU,MAAM,MAAM,MAAA,GAAS,IAAI;AAAA,EAC3E;AACJ,CAAC;AAOD,SAAS,SAAS,YAA4C;AAC1D,SAAO,QAAQ,IAAI,UAAU;AACjC;AAgCA,eAAsB,gBAAgB,YAAwB,SAAoC;AAC9F,QAAM,SAAS,SAAS,UAAU;AAClC,MAAI,WAAW,QAAW;AACtB,WAAO,UAAU,kBAAkB,4DAA4D;AAAA,MAC3F,MAAM;AAAA,MACN,QAAQ;AAAA,IAAA,CACX;AAAA,EACL;AACA,UAAQ,OAAO,MAAA;AAAA,IACX,KAAK,UAAU;AACX,YAAM,QAAQ,OAAO,OAAO,UAAU,WAAW,OAAO,QAAQ,MAAM,OAAO,MAAA;AAC7E,YAAM,UAAU,IAAI,QAAQ,QAAQ,OAAO;AAC3C,cAAQ,IAAI,iBAAiB,UAAU,KAAK,EAAE;AAC9C,aAAO,IAAI,QAAQ,SAAS,EAAE,SAAS;AAAA,IAC3C;AAAA,IACA,KAAK,SAAS;AACV,YAAM,UAAU,IAAI,QAAQ,QAAQ,OAAO;AAC3C,YAAM,OAAO,GAAG,OAAO,QAAQ,IAAI,OAAO,QAAQ;AAClD,cAAQ,IAAI,iBAAiB,SAAS,OAAO,IAAI,CAAC,EAAE;AACpD,aAAO,IAAI,QAAQ,SAAS,EAAE,SAAS;AAAA,IAC3C;AAAA,IACA,KAAK,WAAW;AACZ,UAAI,OAAO,WAAW,MAAM;AACxB,cAAM,UAAU,IAAI,QAAQ,QAAQ,OAAO;AAC3C,gBAAQ,IAAI,OAAO,QAAQ,OAAO,KAAK;AACvC,eAAO,IAAI,QAAQ,SAAS,EAAE,SAAS;AAAA,MAC3C;AACA,YAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAI,aAAa,IAAI,OAAO,SAAS,WAAW,OAAO,KAAK;AAC5D,aAAO,IAAI,QAAQ,KAAK,OAAO;AAAA,IACnC;AAAA,IACA,KAAK,aAAa;AACd,YAAM,EAAE,YAAA,IAAgB,MAAM,OAAO,qBAAY;AACjD,aAAO,YAAY,SAAS,OAAO,OAAO;AAAA,IAC9C;AAAA,IACA,KAAK;AACD,aAAO,OAAO,MAAM,OAAO;AAAA,IAC/B;AACI,aAAO;AAAA,EAAA;AAEnB;AAQO,SAAS,iBACZ,YAKY;AACZ,QAAM,SAAS,SAAS,UAAU;AAClC,MAAI,QAAQ,SAAS,SAAS;AAC1B,WAAO,EAAE,MAAM,SAAS,UAAU,OAAO,UAAU,UAAU,OAAO,SAAA;AAAA,EACxE;AACA,MAAI,QAAQ,SAAS,UAAU;AAC3B,WAAO,EAAE,MAAM,UAAU,OAAO,OAAO,MAAA;AAAA,EAC3C;AACA,SAAO,WAAW,SAAY,SAAY,EAAE,MAAM,WAAW,KAAA;AACjE;AAwDO,SAAS,mBAAmB,YAAmD;AAClF,QAAM,SAAS,SAAS,UAAU;AAClC,UAAQ,QAAQ,MAAA;AAAA,IACZ,KAAK;AACD,aAAO,EAAE,MAAM,SAAS,UAAU,OAAO,UAAU,UAAU,OAAO,SAAA;AAAA,IACxE,KAAK;AACD,aAAO,EAAE,MAAM,WAAW,QAAQ,OAAO,QAAQ,OAAO,OAAO,OAAO,OAAO,OAAO,MAAA;AAAA,IACxF,KAAK;AACD,aAAO,OAAO,OAAO,UAAU,WAAW,EAAE,MAAM,UAAU,OAAO,OAAO,MAAA,IAAU;AAAA,IACxF;AACI,aAAO;AAAA,EAAA;AAEnB;AASO,SAAS,uBAAuB,OAA2B,MAAmC;AACjG,UAAQ,MAAM,MAAA;AAAA,IACV,KAAK;AACD,aAAO,YAAY,MAAM,MAAM,UAAU,MAAM,UAAU,IAAI;AAAA,IACjE,KAAK;AACD,aAAO,YAAY,OAAO,MAAM,OAAO,IAAI;AAAA,IAC/C;AACI,aAAO,IAAI;AAAA,QACP,EAAE,MAAM,WAAW,QAAQ,MAAM,QAAQ,OAAO,MAAM,OAAO,OAAO,MAAM,MAAA;AAAA,QAC1E;AAAA,MAAA;AAAA,EACJ;AAEZ;"}