@wirebench/engine 2.1.1

package/dist/json/cursor.js

@@ -0,0 +1,168 @@
+/**
+ * Where a cursor sits in a JSON document, worked out from the text alone.
+ *
+ * The counterpart of `xsd/locate.ts`'s `completionContextAt` for XML, and it exists for the same
+ * reason: a completion provider runs against a document that is, by definition, half-typed, so a
+ * parse is the one thing that cannot be relied on. This scans characters left to right, keeping a
+ * stack of the containers it has entered, and answers what object the cursor is in, what key has
+ * been typed so far, and which keys that object already holds.
+ *
+ * Array indices are not path segments. A repeated field's items all have the element type, so
+ * `{"items": [{ | }]}` is at `["items"]` — the same place a singular message field would be. The
+ * one container that does add a segment of its own is a map, whose keys the user names; a caller
+ * resolving the path against a schema consumes that segment itself.
+ *
+ * Nothing here knows about protobuf: it is a JSON text helper, and the schema half lives in
+ * `grpc/proto/describe.ts`.
+ */
+/** Where a string starting at `start` ends, and whether a quote or a line break ended it. */
+function endOfString(text, start) {
+    let i = start;
+    while (i < text.length) {
+        const char = text[i];
+        if (char === '\\') {
+            i += 2;
+            continue;
+        }
+        if (char === '"') {
+            return { end: i, closed: true };
+        }
+        // An unterminated string is taken to end at the line break. A user who has not closed one has
+        // moved on, and stopping here keeps a single missing quote from swallowing the rest of the file.
+        if (char === '\n') {
+            return { end: i, closed: false };
+        }
+        i += 1;
+    }
+    return { end: text.length, closed: false };
+}
+/** Whether a container is entered at the value position of an object, and so takes its key as a segment. */
+function segmentFor(parent) {
+    if (parent === undefined || parent.kind !== 'object' || !parent.afterColon) {
+        return undefined;
+    }
+    return parent.pendingKey;
+}
+function enter(stack, kind) {
+    const segment = segmentFor(stack[stack.length - 1]);
+    stack.push({ kind, keys: [], afterColon: false, ...(segment !== undefined ? { segment } : {}) });
+}
+/** The path a stack of frames spells: every segment it carries, arrays included, root excluded. */
+function pathOf(stack) {
+    const path = [];
+    for (const frame of stack) {
+        if (frame.segment !== undefined) {
+            path.push(frame.segment);
+        }
+    }
+    return path;
+}
+/** The characters a bare (unquoted) key token is made of. */
+const WORD = /[A-Za-z0-9_]/;
+/**
+ * Pure text analysis for a JSON completion provider: the object the cursor is in, the key being
+ * typed and the range to replace with the accepted one.
+ *
+ * Returns `undefined` wherever a key cannot go — in a value, directly inside an array, at the top
+ * level outside any object, or anywhere a key would not be the next thing written.
+ */
+export function jsonCompletionContextAt(text, offset) {
+    const stack = [];
+    let cursorString;
+    let i = 0;
+    while (i < offset) {
+        const char = text[i];
+        const top = stack[stack.length - 1];
+        if (char === '"') {
+            const contentStart = i + 1;
+            const { end: contentEnd, closed } = endOfString(text, contentStart);
+            const isKey = top !== undefined && top.kind === 'object' && !top.afterColon;
+            // The position just past a key's closing quote still belongs to that key: the user has typed
+            // it and not yet reached for the colon, so completing it is what they are asking for.
+            const last = isKey && closed ? contentEnd + 1 : contentEnd;
+            if (offset >= contentStart && offset <= last) {
+                cursorString = { contentStart, contentEnd, isKey };
+                break;
+            }
+            if (isKey && top !== undefined) {
+                const key = text.slice(contentStart, contentEnd);
+                top.pendingKey = key;
+                top.keys.push(key);
+            }
+            if (!closed && top !== undefined && top.kind === 'object') {
+                // The value was abandoned at the line break, so the next line starts a member of its own.
+                top.afterColon = false;
+                delete top.pendingKey;
+            }
+            i = contentEnd + 1;
+            continue;
+        }
+        if (char === '{' || char === '[') {
+            enter(stack, char === '{' ? 'object' : 'array');
+        }
+        else if (char === '}' || char === ']') {
+            stack.pop();
+            const parent = stack[stack.length - 1];
+            if (parent !== undefined && parent.kind === 'object') {
+                parent.afterColon = false;
+                delete parent.pendingKey;
+            }
+        }
+        else if (char === ':') {
+            if (top !== undefined && top.kind === 'object') {
+                top.afterColon = true;
+            }
+        }
+        else if (char === ',') {
+            if (top !== undefined && top.kind === 'object') {
+                top.afterColon = false;
+                delete top.pendingKey;
+            }
+        }
+        i += 1;
+    }
+    const frame = stack[stack.length - 1];
+    if (frame === undefined || frame.kind !== 'object') {
+        return undefined;
+    }
+    if (cursorString !== undefined) {
+        if (!cursorString.isKey) {
+            return undefined;
+        }
+        return {
+            path: pathOf(stack),
+            partial: text.slice(cursorString.contentStart, Math.min(offset, cursorString.contentEnd)),
+            replaceRange: { start: cursorString.contentStart, end: cursorString.contentEnd },
+            quoted: true,
+            siblings: [...frame.keys],
+        };
+    }
+    if (frame.afterColon) {
+        return undefined;
+    }
+    // An unquoted word is still worth completing: Monaco asks as soon as a letter is typed, and a
+    // user who has not reached for the quote key yet means the same thing by it.
+    let start = offset;
+    while (start > 0 && WORD.test(text[start - 1])) {
+        start -= 1;
+    }
+    let before = start - 1;
+    while (before >= 0 && /\s/.test(text[before])) {
+        before -= 1;
+    }
+    const preceding = before >= 0 ? text[before] : '';
+    if (preceding !== '{' && preceding !== ',') {
+        return undefined;
+    }
+    let end = offset;
+    while (end < text.length && WORD.test(text[end])) {
+        end += 1;
+    }
+    return {
+        path: pathOf(stack),
+        partial: text.slice(start, offset),
+        replaceRange: { start, end },
+        quoted: false,
+        siblings: [...frame.keys],
+    };
+}

package/dist/operations.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Builds the operation-picker summary (`OperationSummary[]`) for an imported
+ * WSDL definition: every binding operation, cross-referenced with the ports
+ * (and their services) that expose it.
+ */
+import type { WsdlDefinition } from './wsdl/model.js';
+import type { OperationSummary } from './types.js';
+/**
+ * Walks every `binding` x `operation` pair in `definition`, mapping each to
+ * the ports (and their services) that reference the binding.
+ */
+export declare function summarizeOperations(definition: WsdlDefinition): readonly OperationSummary[];

package/dist/operations.js

@@ -0,0 +1,52 @@
+/**
+ * Builds the operation-picker summary (`OperationSummary[]`) for an imported
+ * WSDL definition: every binding operation, cross-referenced with the ports
+ * (and their services) that expose it.
+ */
+import { findPortType } from './wsdl/model.js';
+import { qnameEquals } from './wsdl/qname.js';
+/** The services/ports that bind to `binding`, across every service in the definition. */
+function portsFor(definition, binding) {
+    const ports = [];
+    for (const service of definition.services) {
+        for (const port of service.ports) {
+            if (qnameEquals(port.binding, binding.name)) {
+                ports.push({
+                    serviceName: service.name,
+                    portName: port.name,
+                    ...(port.address !== undefined ? { address: port.address } : {}),
+                });
+            }
+        }
+    }
+    return ports;
+}
+/** The abstract `wsdl:operation` behind a binding operation, for its documentation. */
+function abstractOperationFor(definition, binding, operationName) {
+    const portType = findPortType(definition, binding.type);
+    return portType?.operations.find((op) => op.name === operationName);
+}
+/**
+ * Walks every `binding` x `operation` pair in `definition`, mapping each to
+ * the ports (and their services) that reference the binding.
+ */
+export function summarizeOperations(definition) {
+    const summaries = [];
+    for (const binding of definition.bindings) {
+        const ports = portsFor(definition, binding);
+        for (const operation of binding.operations) {
+            const documentation = abstractOperationFor(definition, binding, operation.name)?.documentation;
+            summaries.push({
+                bindingName: binding.name,
+                operationName: operation.name,
+                soapVersion: binding.soapVersion,
+                ...(operation.soapAction !== undefined ? { soapAction: operation.soapAction } : {}),
+                style: operation.style ?? binding.style,
+                ...(documentation !== undefined ? { documentation } : {}),
+                ports,
+                inputMimeParts: operation.input?.mimeParts ?? [],
+            });
+        }
+    }
+    return summaries;
+}

package/dist/project/attachments-cache.d.ts

@@ -0,0 +1,80 @@
+/**
+ * The project's attachment cache: `attachments/<sha256>` plus an `attachments/index.yaml`
+ * describing each blob.
+ *
+ * Content addressing means adding the same file twice costs one copy, a request that
+ * references it keeps working when the original is moved or deleted, and the project stays
+ * diffable — the index is the only file that changes when metadata does. Nothing is ever
+ * deleted implicitly: {@link pruneAttachments} exists so the UI can offer it explicitly,
+ * because a blob whose last reference was removed in an unsaved edit must survive an undo.
+ */
+import { type FsLike } from './fs.js';
+import type { AttachmentResolver } from '../soap/mime/types.js';
+/** One blob in the attachment cache, as recorded in `attachments/index.yaml`. */
+export interface AttachmentCacheEntry {
+    readonly sha256: string;
+    /** Name of the file the bytes were added from. */
+    readonly originalName: string;
+    readonly contentType: string;
+    readonly size: number;
+}
+/** Options every cache function accepts. */
+export interface AttachmentCacheOptions {
+    readonly fs?: FsLike;
+}
+/** Absolute path of the attachment cache directory. */
+export declare function attachmentsDir(projectDir: string): string;
+/** Absolute path of the cache index. */
+export declare function attachmentsIndexFile(projectDir: string): string;
+/** Absolute path of one cached blob. */
+export declare function attachmentFile(projectDir: string, sha256: string): string;
+/**
+ * Copies `bytes` into the project's attachment cache, returning the digest a
+ * {@link Attachment} with a `cache` source references.
+ *
+ * Re-adding identical bytes is a no-op beyond the index lookup, and the metadata of the
+ * first add wins: the digest is the identity, so a second name for the same content would
+ * only make the index ambiguous.
+ *
+ * @param projectDir the project root
+ * @param bytes the file content to cache
+ * @param meta the name and content type to record for it
+ */
+export declare function putAttachment(projectDir: string, bytes: Uint8Array, meta: {
+    readonly originalName: string;
+    readonly contentType: string;
+}, options?: AttachmentCacheOptions): Promise<{
+    readonly sha256: string;
+    readonly size: number;
+}>;
+/**
+ * Reads one cached blob.
+ *
+ * @param projectDir the project root
+ * @param sha256 the digest recorded on the attachment
+ */
+export declare function readAttachment(projectDir: string, sha256: string, options?: AttachmentCacheOptions): Promise<Uint8Array>;
+/** Every blob in the cache, ordered by digest. */
+export declare function listAttachments(projectDir: string, options?: AttachmentCacheOptions): Promise<readonly AttachmentCacheEntry[]>;
+/**
+ * Deletes every cached blob whose digest is not in `referencedShas`, index entry included.
+ *
+ * Called only when the UI explicitly asks: an automatic prune would race with editing (an
+ * attachment removed from a request but not yet saved is still referenced by the document
+ * on disk, and vice versa).
+ *
+ * @param projectDir the project root
+ * @param referencedShas digests still referenced by the project's requests
+ */
+export declare function pruneAttachments(projectDir: string, referencedShas: Iterable<string>, options?: AttachmentCacheOptions): Promise<{
+    readonly removed: readonly string[];
+}>;
+/**
+ * The {@link AttachmentResolver} the desktop main process hands to the send path: cached
+ * attachments come out of `attachments/`, path attachments off disk (absolute, or relative
+ * to the resource root and then to the project itself, in that order).
+ *
+ * @param projectDir the project root
+ * @param resourceRoot the project's resource root, when it has one
+ */
+export declare function createFileAttachmentResolver(projectDir: string, resourceRoot?: string, options?: AttachmentCacheOptions): AttachmentResolver;

package/dist/project/attachments-cache.js

@@ -0,0 +1,186 @@
+/**
+ * The project's attachment cache: `attachments/<sha256>` plus an `attachments/index.yaml`
+ * describing each blob.
+ *
+ * Content addressing means adding the same file twice costs one copy, a request that
+ * references it keeps working when the original is moved or deleted, and the project stays
+ * diffable — the index is the only file that changes when metadata does. Nothing is ever
+ * deleted implicitly: {@link pruneAttachments} exists so the UI can offer it explicitly,
+ * because a blob whose last reference was removed in an unsaved edit must survive an undo.
+ */
+import { createHash } from 'node:crypto';
+import { isAbsolute, join } from 'node:path';
+import { ProjectError } from '../errors.js';
+import { nodeFs, readFileIfExists, readdirIfExists, writeFileAtomic } from './fs.js';
+import { ATTACHMENTS_DIR } from './paths.js';
+import { parseYaml, stringifyYaml } from './yaml.js';
+const SHA256 = /^[0-9a-f]{64}$/;
+/** Absolute path of the attachment cache directory. */
+export function attachmentsDir(projectDir) {
+    return join(projectDir, ATTACHMENTS_DIR);
+}
+/** Absolute path of the cache index. */
+export function attachmentsIndexFile(projectDir) {
+    return join(attachmentsDir(projectDir), 'index.yaml');
+}
+/** Absolute path of one cached blob. */
+export function attachmentFile(projectDir, sha256) {
+    assertDigest(sha256);
+    return join(attachmentsDir(projectDir), sha256);
+}
+function assertDigest(sha256) {
+    if (!SHA256.test(sha256)) {
+        throw new ProjectError('attachment-invalid-digest', `"${sha256}" is not a sha256 digest`, {
+            details: { sha256 },
+        });
+    }
+}
+/** The cache index, or an empty one when the project has no attachments yet. */
+async function readIndex(projectDir, fs) {
+    const buffer = await readFileIfExists(fs, attachmentsIndexFile(projectDir));
+    const index = new Map();
+    if (buffer === undefined) {
+        return index;
+    }
+    const parsed = parseYaml(buffer.toString('utf8'), `${ATTACHMENTS_DIR}/index.yaml`);
+    if (typeof parsed !== 'object' || parsed === null) {
+        return index;
+    }
+    for (const [sha256, value] of Object.entries(parsed)) {
+        if (typeof value !== 'object' || value === null) {
+            continue;
+        }
+        const record = value;
+        index.set(sha256, {
+            sha256,
+            originalName: typeof record.originalName === 'string' ? record.originalName : sha256,
+            contentType: typeof record.contentType === 'string' ? record.contentType : 'application/octet-stream',
+            size: typeof record.size === 'number' ? record.size : 0,
+        });
+    }
+    return index;
+}
+async function writeIndex(projectDir, fs, index) {
+    const document = {};
+    for (const entry of [...index.values()].sort((a, b) => a.sha256.localeCompare(b.sha256))) {
+        document[entry.sha256] = {
+            originalName: entry.originalName,
+            contentType: entry.contentType,
+            size: entry.size,
+        };
+    }
+    await writeFileAtomic(fs, attachmentsIndexFile(projectDir), stringifyYaml(document));
+}
+/**
+ * Copies `bytes` into the project's attachment cache, returning the digest a
+ * {@link Attachment} with a `cache` source references.
+ *
+ * Re-adding identical bytes is a no-op beyond the index lookup, and the metadata of the
+ * first add wins: the digest is the identity, so a second name for the same content would
+ * only make the index ambiguous.
+ *
+ * @param projectDir the project root
+ * @param bytes the file content to cache
+ * @param meta the name and content type to record for it
+ */
+export async function putAttachment(projectDir, bytes, meta, options = {}) {
+    const fs = options.fs ?? nodeFs;
+    const sha256 = createHash('sha256').update(bytes).digest('hex');
+    const index = await readIndex(projectDir, fs);
+    const file = attachmentFile(projectDir, sha256);
+    // The blob is rewritten when it is missing even though the index knows it: a project
+    // whose `attachments/` was partly lost (a bad merge, a stray delete) heals on the next add.
+    if ((await readFileIfExists(fs, file)) === undefined) {
+        await writeFileAtomic(fs, file, Buffer.from(bytes));
+    }
+    if (!index.has(sha256)) {
+        index.set(sha256, { sha256, originalName: meta.originalName, contentType: meta.contentType, size: bytes.length });
+        await writeIndex(projectDir, fs, index);
+    }
+    return { sha256, size: bytes.length };
+}
+/**
+ * Reads one cached blob.
+ *
+ * @param projectDir the project root
+ * @param sha256 the digest recorded on the attachment
+ */
+export async function readAttachment(projectDir, sha256, options = {}) {
+    const fs = options.fs ?? nodeFs;
+    const file = attachmentFile(projectDir, sha256);
+    const buffer = await readFileIfExists(fs, file);
+    if (buffer === undefined) {
+        throw new ProjectError('attachment-missing', `Cached attachment ${sha256} is not in this project`, {
+            details: { sha256 },
+        });
+    }
+    return new Uint8Array(buffer);
+}
+/** Every blob in the cache, ordered by digest. */
+export async function listAttachments(projectDir, options = {}) {
+    const fs = options.fs ?? nodeFs;
+    const index = await readIndex(projectDir, fs);
+    return [...index.values()].sort((a, b) => a.sha256.localeCompare(b.sha256));
+}
+/**
+ * Deletes every cached blob whose digest is not in `referencedShas`, index entry included.
+ *
+ * Called only when the UI explicitly asks: an automatic prune would race with editing (an
+ * attachment removed from a request but not yet saved is still referenced by the document
+ * on disk, and vice versa).
+ *
+ * @param projectDir the project root
+ * @param referencedShas digests still referenced by the project's requests
+ */
+export async function pruneAttachments(projectDir, referencedShas, options = {}) {
+    const fs = options.fs ?? nodeFs;
+    const keep = new Set(referencedShas);
+    const index = await readIndex(projectDir, fs);
+    const onDisk = (await readdirIfExists(fs, attachmentsDir(projectDir)))
+        .filter((entry) => entry.isFile && SHA256.test(entry.name))
+        .map((entry) => entry.name);
+    const removed = [];
+    for (const sha256 of new Set([...index.keys(), ...onDisk]).values()) {
+        if (keep.has(sha256)) {
+            continue;
+        }
+        await fs.rm(attachmentFile(projectDir, sha256), { force: true });
+        index.delete(sha256);
+        removed.push(sha256);
+    }
+    if (removed.length > 0) {
+        await writeIndex(projectDir, fs, index);
+    }
+    return { removed: removed.sort() };
+}
+/**
+ * The {@link AttachmentResolver} the desktop main process hands to the send path: cached
+ * attachments come out of `attachments/`, path attachments off disk (absolute, or relative
+ * to the resource root and then to the project itself, in that order).
+ *
+ * @param projectDir the project root
+ * @param resourceRoot the project's resource root, when it has one
+ */
+export function createFileAttachmentResolver(projectDir, resourceRoot, options = {}) {
+    const fs = options.fs ?? nodeFs;
+    return async (attachment) => {
+        if (attachment.source.kind === 'cache') {
+            return readAttachment(projectDir, attachment.source.sha256, { fs });
+        }
+        const path = attachment.source.path;
+        const candidates = isAbsolute(path)
+            ? [path]
+            : resourceRoot === undefined
+                ? [join(projectDir, path)]
+                : [join(resourceRoot, path), join(projectDir, path)];
+        for (const candidate of candidates) {
+            const buffer = await readFileIfExists(fs, candidate);
+            if (buffer !== undefined) {
+                return new Uint8Array(buffer);
+            }
+        }
+        throw new ProjectError('attachment-unreadable', `Attachment "${attachment.name}" could not be read from ${path}`, {
+            details: { attachmentId: attachment.id, path },
+        });
+    };
+}

package/dist/project/endpoints.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Endpoint-level credential precedence: how a request's own `EndpointAuth` combines with the
+ * auth configured on the endpoint it is sent to (and, as a last resort, on its interface).
+ * Pure — the desktop app resolves the resulting `passwordRef` afterwards.
+ */
+import type { EndpointAuth } from './model.js';
+/**
+ * Combines request, endpoint and interface credentials for one send.
+ *
+ * `override` (the endpoint wins): a defined endpoint auth replaces the request's entirely —
+ * including an explicit `{ type: 'none' }`, which deliberately turns authentication off.
+ * `complement` (the endpoint only fills blanks): start from the request's auth and take
+ * `username`, `passwordRef`, `domain` and `preemptive` from the endpoint wherever the request
+ * left them undefined, plus `type` when the request has no type or asks for `none`.
+ *
+ * When nothing is configured at either level, the interface's auth applies unchanged.
+ *
+ * @param requestAuth the request's own credentials, if any
+ * @param endpointAuth the credentials configured on the target endpoint, if any
+ * @param authMode how the endpoint's credentials combine with the request's
+ * @param interfaceAuth the interface-wide fallback, if any
+ */
+export declare function effectiveAuth(requestAuth: EndpointAuth | undefined, endpointAuth: EndpointAuth | undefined, authMode: 'override' | 'complement', interfaceAuth?: EndpointAuth): EndpointAuth | undefined;

package/dist/project/endpoints.js

@@ -0,0 +1,47 @@
+/**
+ * Endpoint-level credential precedence: how a request's own `EndpointAuth` combines with the
+ * auth configured on the endpoint it is sent to (and, as a last resort, on its interface).
+ * Pure — the desktop app resolves the resulting `passwordRef` afterwards.
+ */
+/**
+ * Combines request, endpoint and interface credentials for one send.
+ *
+ * `override` (the endpoint wins): a defined endpoint auth replaces the request's entirely —
+ * including an explicit `{ type: 'none' }`, which deliberately turns authentication off.
+ * `complement` (the endpoint only fills blanks): start from the request's auth and take
+ * `username`, `passwordRef`, `domain` and `preemptive` from the endpoint wherever the request
+ * left them undefined, plus `type` when the request has no type or asks for `none`.
+ *
+ * When nothing is configured at either level, the interface's auth applies unchanged.
+ *
+ * @param requestAuth the request's own credentials, if any
+ * @param endpointAuth the credentials configured on the target endpoint, if any
+ * @param authMode how the endpoint's credentials combine with the request's
+ * @param interfaceAuth the interface-wide fallback, if any
+ */
+export function effectiveAuth(requestAuth, endpointAuth, authMode, interfaceAuth) {
+    return combine(requestAuth, endpointAuth, authMode) ?? interfaceAuth;
+}
+function combine(requestAuth, endpointAuth, authMode) {
+    if (authMode === 'override') {
+        return endpointAuth ?? requestAuth;
+    }
+    if (endpointAuth === undefined) {
+        return requestAuth;
+    }
+    if (requestAuth === undefined) {
+        return endpointAuth;
+    }
+    const type = requestAuth.type === 'none' ? endpointAuth.type : requestAuth.type;
+    const username = requestAuth.username ?? endpointAuth.username;
+    const passwordRef = requestAuth.passwordRef ?? endpointAuth.passwordRef;
+    const domain = requestAuth.domain ?? endpointAuth.domain;
+    const preemptive = requestAuth.preemptive ?? endpointAuth.preemptive;
+    return {
+        type,
+        ...(username !== undefined ? { username } : {}),
+        ...(passwordRef !== undefined ? { passwordRef } : {}),
+        ...(domain !== undefined ? { domain } : {}),
+        ...(preemptive !== undefined ? { preemptive } : {}),
+    };
+}

package/dist/project/environments.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Environment resolution: named sets of endpoints and property overrides, which let a
+ * saved project be pointed at different deployments (endpoints + property
+ * overrides) without editing the project itself.
+ *
+ * Precedence for the endpoint a request is actually sent to: an active
+ * environment's override for the interface (an explicit deployment choice)
+ * wins over everything else, including a request's own custom URL; then the
+ * request's custom URL; then its chosen endpoint; then the interface
+ * default; then the interface's first endpoint.
+ */
+import type { Endpoint, Environment, Interface, Project, PropertyMap, RequestDef } from './model.js';
+import type { RestApi } from '../rest/model.js';
+import type { PropertyScopes } from './properties.js';
+/** Finds the environment with `envId` in `project`, or `undefined` when there is none or it isn't found. */
+export declare function findEnvironment(project: Project, envId: string | undefined): Environment | undefined;
+/** Where {@link resolveEndpoint}'s URL came from. */
+export type EndpointSource = 'environment' | 'workspace-environment' | 'request-custom' | 'request-endpoint' | 'interface-default' | 'none';
+/**
+ * Resolves the URL a request should actually be sent to, given an optional
+ * active environment. See the module doc for the precedence order.
+ *
+ * `endpoint` is the `Endpoint` object the URL came from, when one exists — the environment
+ * override and a request's custom URL name no endpoint, so they carry none. Callers that need
+ * the endpoint's own settings (its `trustInvalid` flag, say) read it from here rather than
+ * re-deriving the precedence.
+ */
+export declare function resolveEndpoint(project: Project, envId: string | undefined, iface: Interface, request: Pick<RequestDef, 'endpointId' | 'endpointUrl'>): {
+    url: string | undefined;
+    source: EndpointSource;
+    endpoint?: Endpoint;
+};
+/** Where an API's effective base URL came from. */
+export type BaseUrlSource = 'environment' | 'workspace-environment' | 'api';
+/**
+ * Resolves the base URL a REST API's requests are sent against.
+ *
+ * The same shape as {@link resolveEndpoint} and the same precedence as far as it goes: an active
+ * environment's override for the API wins over the API's own base URL, because choosing an
+ * environment is how a user says "point everything at test". An API has no per-request URL
+ * override to consider — a request that needs another host writes an absolute URL instead.
+ */
+export declare function resolveApiBaseUrl(project: Project, envId: string | undefined, api: Pick<RestApi, 'slug' | 'baseUrl'>): {
+    url: string;
+    source: BaseUrlSource;
+};
+/**
+ * Resolves the `Endpoint` object a request's *credentials* should come from: the request's own
+ * chosen endpoint, else the interface's default, else its first endpoint — the same precedence
+ * {@link resolveEndpoint} uses for the URL (minus the environment-override and custom-URL cases,
+ * which name no `Endpoint` object of their own, so have no auth to contribute). Callers that need
+ * a request's effective auth (not just its URL) should resolve the endpoint through this function
+ * rather than re-deriving the precedence, so the two cannot drift apart.
+ */
+export declare function resolveAuthEndpoint(iface: Interface, request: Pick<RequestDef, 'endpointId'>): Endpoint | undefined;
+/**
+ * Builds the {@link PropertyScopes} for expanding properties against `project`
+ * under the (optional) active environment `envId`. `env` is omitted entirely
+ * when there is no active environment, so shorthand lookups correctly skip it.
+ * A property switched off via `disabledProperties` (on the project, or on the
+ * active environment) is excluded from its scope's map, so it resolves exactly
+ * as if it were absent — see {@link enabledProperties}.
+ */
+export declare function resolveScopes(project: Project, envId: string | undefined, globals: PropertyMap, system?: PropertyScopes['system']): PropertyScopes;
+/** Replaces the environment with `env.id` if present, else appends it; preserves relative order otherwise. */
+export declare function upsertEnvironment(project: Project, env: Environment): Project;
+/** Removes the environment with `envId`, keeping the remaining environments' relative order. */
+export declare function removeEnvironment(project: Project, envId: string): Project;