@wirebench/engine 2.1.1

package/dist/http/client.js

@@ -0,0 +1,403 @@
+import { Agent, ProxyAgent, request as undiciRequest } from 'undici';
+import { decompressBody } from './decompress.js';
+import { failedRequestFor, withFailedRequest } from './failed-request.js';
+import { invalidUrlError, toHttpError, tooManyRedirectsError } from './errors.js';
+import { buildRawRequest, buildRawResponse } from './raw-capture.js';
+import { TimingTracker } from './timings.js';
+const DEFAULT_MAX_REDIRECTS = 5;
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+/** Standard reason phrases, used when undici doesn't surface one for us. */
+const REASON_PHRASES = {
+    200: 'OK',
+    201: 'Created',
+    202: 'Accepted',
+    204: 'No Content',
+    301: 'Moved Permanently',
+    302: 'Found',
+    303: 'See Other',
+    304: 'Not Modified',
+    307: 'Temporary Redirect',
+    308: 'Permanent Redirect',
+    400: 'Bad Request',
+    401: 'Unauthorized',
+    403: 'Forbidden',
+    404: 'Not Found',
+    405: 'Method Not Allowed',
+    408: 'Request Timeout',
+    409: 'Conflict',
+    413: 'Payload Too Large',
+    429: 'Too Many Requests',
+    500: 'Internal Server Error',
+    501: 'Not Implemented',
+    502: 'Bad Gateway',
+    503: 'Service Unavailable',
+    504: 'Gateway Timeout',
+};
+function statusText(status) {
+    return REASON_PHRASES[status] ?? '';
+}
+/** A lazily-created, shared keep-alive Agent for requests with no custom TLS/proxy options. */
+let defaultAgent;
+function getDefaultAgent() {
+    defaultAgent ??= new Agent({ keepAliveTimeout: 4000, keepAliveMaxTimeout: 10000 });
+    return defaultAgent;
+}
+/**
+ * Builds a dispatcher for the given TLS/proxy options. Callers that pass
+ * custom `tls`/`proxy` own the returned dispatcher (it is not cached) and
+ * should close it when done; callers with no options get the shared default
+ * keep-alive agent.
+ */
+export function createDispatcher(opts) {
+    const connect = connectOptions(opts);
+    const h2 = opts.allowH2 === true ? { allowH2: true } : {};
+    if (opts.proxy !== undefined) {
+        return new ProxyAgent(proxyAgentOptionsFor(opts.proxy, opts, opts.allowH2 === true));
+    }
+    if (connect !== undefined || opts.allowH2 === true) {
+        return new Agent({ ...(connect !== undefined ? { connect } : {}), ...h2 });
+    }
+    return getDefaultAgent();
+}
+/**
+ * The `ProxyAgent` options for one proxied request.
+ *
+ * The split between `requestTls` and `proxyTls` is the whole point: undici applies the
+ * agent-level `connect` to the socket it opens *to the proxy*, never to the TLS session inside
+ * the CONNECT tunnel — so passing our TLS settings there would silently drop the user's trust
+ * anchors, client certificate and `minVersion` for every proxied HTTPS request. `requestTls`
+ * is the tunnelled origin handshake (where those belong) and `proxyTls` carries only what
+ * describes the hop to the proxy itself, i.e. the bind address.
+ *
+ * `allowH2` is stated on `requestTls` rather than left to the agent, because undici builds the
+ * tunnelled connector from `requestTls` alone and its `allowH2` *defaults to true* — so an
+ * unstated flag offered `h2` in the ALPN of every proxied HTTPS handshake, including the ones
+ * whose client only speaks HTTP/1.1. Exported for the unit test that pins exactly that; not
+ * part of the package's public API (`index.ts` does not re-export it).
+ *
+ * @param proxy the resolved proxy to dial
+ * @param opts the send's TLS options and bind address
+ * @param allowH2 whether HTTP/2 may be negotiated, on the tunnelled handshake and the agent
+ * @param extra agent-level options merged on top (connection pooling, keep-alive)
+ */
+export function proxyAgentOptionsFor(proxy, opts, allowH2, extra = {}) {
+    return {
+        uri: proxy.url,
+        ...(proxy.auth !== undefined
+            ? { token: `Basic ${Buffer.from(`${proxy.auth.username}:${proxy.auth.password}`).toString('base64')}` }
+            : {}),
+        requestTls: { ...(opts.tls !== undefined ? tlsConnectOptions(opts.tls) : {}), allowH2 },
+        // undici types `proxyTls` as `TcpNetConnectOpts & …`, which insists on a `port` a connector
+        // option set never carries; the narrow cast here replaces the one that used to swallow the
+        // whole options object (and with it every typo in it).
+        ...(opts.localAddress !== undefined
+            ? { proxyTls: { localAddress: opts.localAddress } }
+            : {}),
+        ...(allowH2 ? { allowH2: true } : {}),
+        ...extra,
+    };
+}
+/**
+ * Builds a dispatcher pinned to a single, non-pipelined connection per origin, using the
+ * same TLS/proxy/bind-address mapping as {@link createDispatcher}. NTLM authenticates the
+ * *connection*, not the request, so all three legs of its handshake have to travel over one
+ * socket; `connections: 1` plus keep-alive gives sequential requests exactly that. The caller
+ * owns the returned dispatcher and must close it.
+ */
+export function createSingleConnectionDispatcher(opts) {
+    const connect = connectOptions(opts);
+    const base = { connections: 1, pipelining: 1, keepAliveTimeout: 30_000, keepAliveMaxTimeout: 60_000 };
+    const shared = { ...base, ...(connect !== undefined ? { connect } : {}) };
+    if (opts.proxy !== undefined) {
+        // `base` (connections: 1, keep-alive) still applies: it reaches the per-origin client
+        // inside the tunnel, which is exactly the connection NTLM authenticates. NTLM is an
+        // HTTP/1.1 authentication scheme, so the tunnelled handshake stays pinned to HTTP/1.1.
+        return new ProxyAgent(proxyAgentOptionsFor(opts.proxy, opts, false, base));
+    }
+    return new Agent(shared);
+}
+/** The connector options for the given TLS/bind-address settings, or `undefined` when neither is set. */
+function connectOptions(opts) {
+    if (opts.tls === undefined && opts.localAddress === undefined) {
+        return undefined;
+    }
+    return {
+        ...(opts.tls !== undefined ? tlsConnectOptions(opts.tls) : {}),
+        ...(opts.localAddress !== undefined ? { localAddress: opts.localAddress } : {}),
+    };
+}
+function tlsConnectOptions(tls) {
+    return {
+        rejectUnauthorized: tls.rejectUnauthorized,
+        ca: tls.ca !== undefined ? [...tls.ca] : undefined,
+        cert: tls.cert,
+        key: tls.key,
+        passphrase: tls.passphrase,
+        minVersion: tls.minVersion,
+        servername: tls.servername,
+    };
+}
+/** Headers dropped when a redirect crosses an origin, per fetch/undici's credential-scoping semantics. */
+const CREDENTIAL_HEADERS = new Set(['authorization', 'proxy-authorization', 'cookie']);
+/** Origin as scheme + host + port (host already includes a non-default port). */
+function originOf(url) {
+    return `${url.protocol}//${url.host}`;
+}
+/** Drops credential headers (case-insensitive) when moving to a different origin. */
+function scopeHeadersToOrigin(headers, fromUrl, toUrl) {
+    if (originOf(fromUrl) === originOf(toUrl))
+        return headers;
+    const scoped = {};
+    for (const [name, value] of Object.entries(headers)) {
+        if (CREDENTIAL_HEADERS.has(name.toLowerCase()))
+            continue;
+        scoped[name] = value;
+    }
+    return scoped;
+}
+/** Joins undici's raw header shape (string | string[] per name) into our lower-cased map. */
+function joinHeaders(raw) {
+    const headers = {};
+    const rawHeaders = [];
+    for (const [name, value] of Object.entries(raw)) {
+        if (value === undefined)
+            continue;
+        const lower = name.toLowerCase();
+        if (Array.isArray(value)) {
+            for (const v of value)
+                rawHeaders.push([lower, v]);
+            headers[lower] = lower === 'set-cookie' ? (value[0] ?? '') : value.join(', ');
+        }
+        else {
+            rawHeaders.push([lower, value]);
+            headers[lower] = value;
+        }
+    }
+    return { headers, rawHeaders };
+}
+/** Builds the header set as it will be sent, including the `Host` and `Content-Length` undici adds implicitly. */
+function buildFinalHeaders(req, url, body) {
+    const final = { host: url.host };
+    for (const [name, value] of Object.entries(req.headers)) {
+        final[name] = value;
+    }
+    if (body !== undefined)
+        final['content-length'] = String(body.length);
+    return final;
+}
+async function readBody(body, maxSizeBytes) {
+    const chunks = [];
+    let total = 0;
+    let truncated = false;
+    for await (const chunk of body) {
+        if (maxSizeBytes !== undefined && total + chunk.length > maxSizeBytes) {
+            const remaining = maxSizeBytes - total;
+            if (remaining > 0)
+                chunks.push(chunk.subarray(0, remaining));
+            total = maxSizeBytes;
+            truncated = true;
+            // Tear the connection down explicitly rather than relying on the async
+            // iterator's implicit cleanup on `break` — that cleanup is not
+            // guaranteed to release the socket back to the pool promptly.
+            body.destroy?.();
+            break;
+        }
+        chunks.push(chunk);
+        total += chunk.length;
+    }
+    const data = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        data.set(chunk, offset);
+        offset += chunk.length;
+    }
+    return { data, truncated };
+}
+/**
+ * Fully consumes a redirect response's body so the underlying connection is
+ * returned to the keep-alive pool, without buffering the bytes anywhere.
+ * Prefers undici's `dump()` (a body we're discarding, not size-capped);
+ * falls back to iterating to completion for any body lacking `dump`.
+ */
+async function drainBody(body) {
+    if (typeof body.dump === 'function') {
+        await body.dump();
+        return;
+    }
+    for await (const chunk of body) {
+        void chunk; // discard; just drives the stream to completion
+    }
+}
+/**
+ * Sends one HTTP request and returns the full {@link HttpExchange}, including
+ * reconstructed raw wire bytes and best-effort timings. Redirects (301/302/
+ * 303/307/308) are followed manually when `req.followRedirects` is set, so we
+ * can record the `redirects[]` trail and apply fetch's POST→GET downgrade on
+ * 301/302/303.
+ *
+ * Non-2xx responses are returned as a normal exchange, never thrown — only
+ * transport-level failures (timeout, abort, DNS, TLS, refused connection,
+ * too many redirects, invalid URL) throw {@link HttpError}.
+ *
+ * A response exceeding `req.maxSizeBytes` is *not* an error: the exchange is
+ * returned with `truncated: true` and `body` cut at the cap, per the product
+ * decision that "Max Size" (Task 30) should notify, not fail, the exchange.
+ */
+export async function sendHttp(req, options) {
+    let parsedUrl;
+    try {
+        parsedUrl = new URL(req.url);
+    }
+    catch (err) {
+        throw invalidUrlError(req.url, err);
+    }
+    const ownDispatcher = options?.dispatcher === undefined &&
+        (req.tls !== undefined || req.proxy !== undefined || req.localAddress !== undefined || req.allowH2 === true)
+        ? createDispatcher({
+            ...(req.tls !== undefined ? { tls: req.tls } : {}),
+            ...(req.proxy !== undefined ? { proxy: req.proxy } : {}),
+            ...(req.localAddress !== undefined ? { localAddress: req.localAddress } : {}),
+            ...(req.allowH2 === true ? { allowH2: true } : {}),
+        })
+        : undefined;
+    const dispatcher = options?.dispatcher ?? ownDispatcher ?? getDefaultAgent();
+    const maxRedirects = req.maxRedirects ?? DEFAULT_MAX_REDIRECTS;
+    const redirects = [];
+    const tracker = new TimingTracker(options?.now);
+    const deadlineController = new AbortController();
+    const timer = setTimeout(() => deadlineController.abort(), req.timeoutMs);
+    const signals = [deadlineController.signal, req.signal].filter((s) => s !== undefined);
+    const combinedSignal = signals.length > 1 ? AbortSignal.any(signals) : signals[0];
+    // The last attempt made, so a transport error can say what was about to go on the wire.
+    let lastAttempt;
+    try {
+        let currentUrl = parsedUrl;
+        let currentMethod = req.method;
+        let currentBody = req.body;
+        let currentHeaders = { ...req.headers };
+        let result;
+        for (let attempt = 0; attempt <= maxRedirects; attempt++) {
+            // Tells the tracker which origin the TLS events it is about to see belong to.
+            tracker.setOrigin(currentUrl.origin);
+            const finalHeaders = buildFinalHeaders({ ...req, headers: currentHeaders, method: currentMethod }, currentUrl, currentBody);
+            lastAttempt = failedRequestFor(currentUrl.toString(), currentMethod, finalHeaders, currentBody);
+            const rawRequest = buildRawRequest({ ...req, url: currentUrl.toString(), method: currentMethod, headers: currentHeaders }, finalHeaders, currentBody);
+            let response;
+            try {
+                // Wraps the call itself (not its result) so the tracker can capture the exact
+                // undici `Request` object this attempt uses from `undici:request:create`, which
+                // fires synchronously inside `undiciRequest()` before it returns a pending
+                // promise — see `TimingTracker.captureRequestFor`.
+                response = await tracker.captureRequestFor(() => undiciRequest(currentUrl, {
+                    method: currentMethod,
+                    headers: currentHeaders,
+                    ...(currentBody !== undefined ? { body: currentBody } : {}),
+                    dispatcher,
+                    signal: combinedSignal ?? null,
+                    headersTimeout: req.timeoutMs,
+                    bodyTimeout: req.timeoutMs,
+                }));
+            }
+            catch (err) {
+                throw toHttpError(err, {
+                    userAborted: req.signal?.aborted === true,
+                    deadlineHit: deadlineController.signal.aborted,
+                    hadProxy: req.proxy !== undefined,
+                    host: currentUrl.host,
+                });
+            }
+            tracker.markHeaders();
+            const { headers, rawHeaders } = joinHeaders(response.headers);
+            const isRedirect = req.followRedirects && REDIRECT_STATUSES.has(response.statusCode) && headers['location'] !== undefined;
+            if (isRedirect) {
+                if (attempt === maxRedirects) {
+                    // Fully drain the body so the socket returns to the keep-alive pool, then fail.
+                    await drainBody(response.body).catch(() => undefined);
+                    throw tooManyRedirectsError(maxRedirects);
+                }
+                redirects.push({ url: currentUrl.toString(), status: response.statusCode });
+                await drainBody(response.body).catch(() => undefined);
+                const nextUrl = new URL(headers['location'] ?? '', currentUrl);
+                // 303 always becomes a GET - that is what the status means. 301 and 302 do so only for a
+                // POST, which is the historical browser (and curl) behaviour RFC 9110 §15.4.3 records; a
+                // PUT or DELETE keeps its method, and `preserveMethodOnRedirect` keeps even a POST's.
+                const downgrade = response.statusCode === 303 ||
+                    ((response.statusCode === 301 || response.statusCode === 302) &&
+                        currentMethod === 'POST' &&
+                        req.preserveMethodOnRedirect !== true);
+                if (downgrade) {
+                    currentMethod = 'GET';
+                    currentBody = undefined;
+                    const rest = { ...currentHeaders };
+                    delete rest['content-type'];
+                    currentHeaders = rest;
+                }
+                // Drop credential headers (Authorization/Proxy-Authorization/Cookie)
+                // when the redirect crosses to a different origin.
+                currentHeaders = scopeHeadersToOrigin(currentHeaders, currentUrl, nextUrl);
+                currentUrl = nextUrl;
+                continue;
+            }
+            const { data: rawBodyRaw, truncated } = await readBody(response.body, req.maxSizeBytes);
+            const decompress = req.decompress ?? true;
+            let body = rawBodyRaw;
+            let decodeError;
+            if (decompress) {
+                try {
+                    body = await decompressBody(rawBodyRaw, headers['content-encoding']);
+                }
+                catch (err) {
+                    body = rawBodyRaw;
+                    decodeError = err instanceof Error ? err.message : String(err);
+                }
+            }
+            result = {
+                status: response.statusCode,
+                headers,
+                rawHeaders,
+                rawBody: rawBodyRaw,
+                body,
+                truncated,
+                ...(decodeError !== undefined ? { decodeError } : {}),
+                rawRequest,
+                finalUrl: currentUrl.toString(),
+                finalMethod: currentMethod,
+            };
+            break;
+        }
+        if (result === undefined)
+            throw tooManyRedirectsError(maxRedirects);
+        const tlsInfo = tracker.tlsInfo();
+        // ALPN is the only honest answer to "what did this actually speak": `allowH2` is an offer,
+        // and a server is free to stay on HTTP/1.1. Plain HTTP has no ALPN and is always 1.1.
+        const httpVersion = tlsInfo?.alpn === 'h2' ? '2' : '1.1';
+        const rawResponse = buildRawResponse(result.status, statusText(result.status), result.rawHeaders, result.rawBody, httpVersion);
+        const timings = tracker.finish();
+        return {
+            request: { url: result.finalUrl, method: result.finalMethod, headers: req.headers },
+            status: result.status,
+            statusText: statusText(result.status),
+            headers: result.headers,
+            rawHeaders: result.rawHeaders,
+            body: result.body,
+            rawBody: result.rawBody,
+            truncated: result.truncated,
+            httpVersion,
+            ...(result.decodeError !== undefined ? { decodeError: result.decodeError } : {}),
+            timings,
+            rawRequest: result.rawRequest,
+            rawResponse,
+            redirects,
+            ...(tlsInfo !== undefined ? { tls: tlsInfo } : {}),
+        };
+    }
+    catch (err) {
+        throw lastAttempt === undefined ? err : withFailedRequest(err, lastAttempt);
+    }
+    finally {
+        clearTimeout(timer);
+        tracker.dispose();
+        if (ownDispatcher !== undefined)
+            await ownDispatcher.close().catch(() => undefined);
+    }
+}

package/dist/http/curl-flags.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The curl flags both command readers (SOAP in `curl.ts`, REST in `../rest/curl.ts`) need to agree
+ * on: which ones take no value. A reader that skips a flag it has no field for must also skip that
+ * flag's value, or the value is read as the URL; and it must not skip the token after a flag that
+ * has none, or the URL is swallowed instead.
+ */
+/** Flags that take no value, so a parser must not eat the token after them. */
+export declare const VALUELESS_FLAGS: Set<string>;
+/**
+ * Splits a bundle of short flags the way curl reads it: `-sSL` is three flags, and the first letter
+ * that takes a value ends the bundle, the rest being its value (`-XPUT`, `-sXPOST`, `-uada:pw`).
+ */
+export declare function expandBundles(tokens: readonly string[]): string[];
+/** Whether a flag this reader does not handle stands alone: listed as value-less, or `--name=value`. */
+export declare function takesNoValue(flag: string): boolean;

package/dist/http/curl-flags.js

@@ -0,0 +1,95 @@
+/**
+ * The curl flags both command readers (SOAP in `curl.ts`, REST in `../rest/curl.ts`) need to agree
+ * on: which ones take no value. A reader that skips a flag it has no field for must also skip that
+ * flag's value, or the value is read as the URL; and it must not skip the token after a flag that
+ * has none, or the URL is swallowed instead.
+ */
+/** Flags that take no value, so a parser must not eat the token after them. */
+export const VALUELESS_FLAGS = new Set([
+    '-k',
+    '--insecure',
+    '-L',
+    '--location',
+    '-s',
+    '--silent',
+    '-v',
+    '--verbose',
+    '-i',
+    '--include',
+    '-f',
+    '--fail',
+    '-g',
+    '--globoff',
+    '--compressed',
+    '-4',
+    '-6',
+    '--http1.0',
+    '--http1.1',
+    '--http2',
+    '--http2-prior-knowledge',
+    '--http3',
+    '-G',
+    '--get',
+    '-I',
+    '--head',
+    '-O',
+    '--remote-name',
+    '-J',
+    '--remote-header-name',
+    '-S',
+    '--show-error',
+    '-N',
+    '--no-buffer',
+    '-#',
+    '--progress-bar',
+    '-n',
+    '--netrc',
+    '-j',
+    '--junk-session-cookies',
+    '--basic',
+    '--digest',
+    '--ntlm',
+    '--negotiate',
+    '--anyauth',
+    '--fail-with-body',
+    '--location-trusted',
+    '--path-as-is',
+    '--raw',
+    '--no-keepalive',
+    '--tcp-nodelay',
+    '--ssl',
+    '--ssl-reqd',
+    '--tlsv1',
+    '--tlsv1.0',
+    '--tlsv1.1',
+    '--tlsv1.2',
+    '--tlsv1.3',
+]);
+/**
+ * Splits a bundle of short flags the way curl reads it: `-sSL` is three flags, and the first letter
+ * that takes a value ends the bundle, the rest being its value (`-XPUT`, `-sXPOST`, `-uada:pw`).
+ */
+export function expandBundles(tokens) {
+    return tokens.flatMap((token) => {
+        if (!/^-[A-Za-z0-9#]./.test(token)) {
+            return [token];
+        }
+        const out = [];
+        for (let at = 1; at < token.length; at += 1) {
+            const flag = `-${token.charAt(at)}`;
+            out.push(flag);
+            if (!VALUELESS_FLAGS.has(flag)) {
+                const value = token.slice(at + 1);
+                if (value !== '') {
+                    out.push(value);
+                }
+                break;
+            }
+        }
+        return out;
+    });
+}
+/** Whether a flag this reader does not handle stands alone: listed as value-less, or `--name=value`. */
+export function takesNoValue(flag) {
+    return VALUELESS_FLAGS.has(flag) || flag.includes('=');
+}

package/dist/http/curl.d.ts

@@ -0,0 +1,94 @@
+/**
+ * Interoperability convenience: export a send as a `curl` command, and parse a pasted `curl` command
+ * back into a partial send input.
+ *
+ * {@link toCurl} describes a request in `curl`'s own terms — a method, a URL, headers and one of the
+ * body shapes `curl` has a flag for — and knows nothing about SOAP or REST. Each protocol builds that
+ * description from its own send input ({@link soapToCurl} here, `restToCurl` in `rest/curl.ts`), so the
+ * quoting, the line continuations and the two shells have one implementation rather than two.
+ */
+import type { SoapSendInput } from '../types.js';
+/** One header of an exported command, in the order the user wrote it. */
+export interface CurlHeader {
+    readonly name: string;
+    readonly value: string;
+}
+/** One part of an exported `multipart/form-data` body. */
+export type CurlPart = {
+    readonly kind: 'text';
+    readonly name: string;
+    readonly value: string;
+    readonly contentType?: string;
+}
+/** A file `curl` reads itself, as `-F name=@path`. An empty path is written as a placeholder. */
+ | {
+    readonly kind: 'file';
+    readonly name: string;
+    readonly path: string;
+    readonly contentType?: string;
+};
+/**
+ * What the command sends.
+ *
+ * Each arm maps to the flag `curl` users expect for it, which is what makes an exported command worth
+ * pasting: `--data-urlencode` per form field rather than one pre-encoded blob, `-F` per part rather
+ * than a hand-built multipart body, and `@file` where the bytes live on disk rather than inline.
+ */
+export type CurlBody = {
+    readonly kind: 'none';
+} | {
+    readonly kind: 'raw';
+    readonly text: string;
+} | {
+    readonly kind: 'form';
+    readonly fields: readonly CurlHeader[];
+} | {
+    readonly kind: 'multipart';
+    readonly parts: readonly CurlPart[];
+} | {
+    readonly kind: 'binary';
+    readonly path: string;
+};
+/** A request as `curl` would describe it. */
+export interface CurlCommand {
+    readonly method: string;
+    readonly url: string;
+    readonly headers: readonly CurlHeader[];
+    readonly body?: CurlBody;
+    /** `-u user:password`. The password is the caller's to redact before it gets here. */
+    readonly basic?: {
+        readonly username: string;
+        readonly password: string;
+    };
+    /** `-k`: send even when the certificate does not verify. */
+    readonly insecure?: boolean;
+    /** `-L`, with `--max-redirs` when a limit is set. */
+    readonly followRedirects?: boolean;
+    readonly maxRedirects?: number;
+}
+/** Options for {@link toCurl} and {@link soapToCurl}. */
+export interface ToCurlOptions {
+    /** Target shell for line continuations and quoting. Default 'posix'. */
+    readonly shell?: 'posix' | 'powershell';
+}
+/** Quotes one argument for `shell`; shared with the gRPC command renderer so both quote alike. */
+export declare function quoteForShell(value: string, shell: 'posix' | 'powershell'): string;
+/**
+ * Builds a `curl` command from {@link CurlCommand}.
+ *
+ * A raw body travels as a heredoc (POSIX) or a here-string (PowerShell) rather than as a quoted
+ * argument: it may contain newlines, quotes and anything else, and a heredoc is the one form that
+ * carries all of it unchanged — which is also what {@link fromCurl} reads back.
+ */
+export declare function toCurl(command: CurlCommand, options?: ToCurlOptions): string;
+/** Builds a `curl` command reproducing a SOAP send — headers, envelope and all. */
+export declare function soapToCurl(input: SoapSendInput & {
+    readonly contentType?: string;
+}, options?: ToCurlOptions): string;
+/** Result of {@link fromCurl}. */
+export interface FromCurlResult {
+    readonly input: Partial<SoapSendInput>;
+    readonly problems: readonly string[];
+}
+/** Parses a pasted `curl` command back into a partial {@link SoapSendInput}. */
+export declare function fromCurl(text: string): FromCurlResult;