@wirebench/engine 2.1.1

package/dist/rest/url.js

@@ -0,0 +1,213 @@
+/**
+ * Building the URL a REST request actually sends, and taking one apart again.
+ *
+ * Two jobs, both pure. {@link composeUrl} joins the API's base URL with the request's own URL,
+ * fills its `{name}` path parameters and appends its enabled query rows, percent-encoding to
+ * RFC 3986. {@link splitQuery} and {@link joinQuery} are the other direction: the editor keeps one
+ * URL field and one query table, and they have to be the same thing seen twice, so a value typed
+ * into either lands in the other without drifting.
+ *
+ * Nothing here throws for bad input. A missing path parameter or a property reference nothing
+ * expanded is a {@link UrlProblem} the caller surfaces before the send — a URL that is merely
+ * unfinished is the normal state of a request being written.
+ */
+/** Characters RFC 3986 §2.3 calls unreserved, plus the sub-delims a value may keep. */
+const UNRESERVED = /[A-Za-z0-9\-._~]/;
+/** A `%XX` sequence that is already a valid escape, so encoding it again would double it. */
+const VALID_ESCAPE = /^%[0-9A-Fa-f]{2}/;
+/**
+ * Percent-encodes one value, leaving an existing valid `%XX` escape alone.
+ *
+ * The double-encoding guard is the whole point: a user who pastes `a%20b` means one space, and
+ * turning it into `a%2520b` would silently change the request. A lone `%` that is not a valid
+ * escape *is* encoded, because on the wire it has to be.
+ */
+export function encodeValue(value, extraSafe = '') {
+    let out = '';
+    for (let i = 0; i < value.length;) {
+        const char = value[i];
+        if (char === '%' && VALID_ESCAPE.test(value.slice(i, i + 3))) {
+            out += value.slice(i, i + 3);
+            i += 3;
+            continue;
+        }
+        out += UNRESERVED.test(char) || extraSafe.includes(char) ? char : percentEncode(char, value, i);
+        i += char === '%' ? 1 : charLength(value, i);
+    }
+    return out;
+}
+/** How many UTF-16 code units the character at `index` occupies (a surrogate pair counts as two). */
+function charLength(value, index) {
+    const code = value.codePointAt(index);
+    return code !== undefined && code > 0xffff ? 2 : 1;
+}
+/** The `%XX` (or multi-byte `%XX%XX…`) escape for the character at `index`. */
+function percentEncode(char, value, index) {
+    const length = charLength(value, index);
+    return encodeURIComponent(value.slice(index, index + length)).replace(/[!'()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+/** Every `{name}` in `url`, in the order they appear, without duplicates. */
+export function parseUrlParams(url) {
+    const names = [];
+    for (const match of url.matchAll(/\{([^{}/?#]+)\}/g)) {
+        const name = match[1];
+        if (!names.includes(name)) {
+            names.push(name);
+        }
+    }
+    return names;
+}
+/**
+ * Every `${…}` reference left in `text`, which means the caller did not expand it.
+ *
+ * An `indexOf` walk rather than `/\$\{([^}]*)\}/g`: with an unclosed `${` the regex rescans to
+ * the end of the string from every later start, which is O(n²) on pathological input. This finds
+ * each `${`, then the next `}`; if there is none, nothing after it can match either, so it stops.
+ */
+function unexpandedProperties(text) {
+    const names = [];
+    let from = 0;
+    for (;;) {
+        const open = text.indexOf('${', from);
+        if (open === -1) {
+            return names;
+        }
+        const close = text.indexOf('}', open + 2);
+        if (close === -1) {
+            return names;
+        }
+        names.push(text.slice(open + 2, close));
+        from = close + 1;
+    }
+}
+/**
+ * Drops every trailing `/` from `text`.
+ *
+ * A character walk rather than `replace(/\/+$/, '')`: that pattern is anchored at the end but not
+ * at the start, so the engine retries it at each of the string's positions and the whole trim costs
+ * O(n²) — 80k slashes took five seconds. Nothing here is attacker-supplied (it is the user's own
+ * base URL), so this is a sharp edge rather than a vulnerability, but linear is free.
+ */
+export function trimTrailingSlashes(text) {
+    let end = text.length;
+    while (end > 0 && text.charCodeAt(end - 1) === 0x2f) {
+        end -= 1;
+    }
+    return text.slice(0, end);
+}
+/** True when `url` already carries its own scheme, so the base URL plays no part. */
+function isAbsolute(url) {
+    return /^[A-Za-z][A-Za-z0-9+.-]*:\/\//.test(url);
+}
+/**
+ * Joins a base URL with a request's relative URL.
+ *
+ * The base's own path is kept (`https://h/api/v3` + `/pet` is `https://h/api/v3/pet`), because an
+ * API's base URL usually *is* a path prefix; exactly one `/` ends up between the two however many
+ * either side brought. An empty relative URL sends the base itself.
+ */
+export function joinBase(base, url) {
+    if (isAbsolute(url)) {
+        return url;
+    }
+    const trimmedBase = trimTrailingSlashes(base);
+    if (url === '') {
+        return trimmedBase;
+    }
+    const relative = url.replace(/^\/+/, '');
+    return trimmedBase === '' ? `/${relative}` : `${trimmedBase}/${relative}`;
+}
+/** Splits `url` into its part before `?`/`#` and the query rows after it. */
+export function splitQuery(url) {
+    const hash = url.indexOf('#');
+    const fragment = hash === -1 ? '' : url.slice(hash);
+    const withoutFragment = hash === -1 ? url : url.slice(0, hash);
+    const mark = withoutFragment.indexOf('?');
+    if (mark === -1) {
+        return { path: url, query: [] };
+    }
+    const path = withoutFragment.slice(0, mark) + fragment;
+    const search = withoutFragment.slice(mark + 1);
+    const query = search
+        .split('&')
+        .filter((pair) => pair.length > 0)
+        .map((pair) => {
+        const equals = pair.indexOf('=');
+        const name = equals === -1 ? pair : pair.slice(0, equals);
+        const value = equals === -1 ? '' : pair.slice(equals + 1);
+        return { name, value, enabled: true };
+    });
+    return { path, query };
+}
+/**
+ * The inverse of {@link splitQuery}: puts enabled rows back onto `path` as its query string.
+ *
+ * Values are written exactly as given — this is the editor's URL field, not the wire — so
+ * `joinQuery(splitQuery(url))` returns `url` for any URL the editor could have produced.
+ */
+export function joinQuery(path, query) {
+    const hash = path.indexOf('#');
+    const base = hash === -1 ? path : path.slice(0, hash);
+    const fragment = hash === -1 ? '' : path.slice(hash);
+    const search = query
+        .filter((row) => row.enabled)
+        .map((row) => (row.value === '' ? row.name : `${row.name}=${row.value}`))
+        .join('&');
+    return search === '' ? base + fragment : `${base}?${search}${fragment}`;
+}
+/**
+ * Builds the URL one send actually uses.
+ *
+ * Order of work: the request's URL wins over the base when it is absolute; `{name}` parameters are
+ * filled from the enabled rows of `pathParams`; the URL's own query string and the `query` table
+ * are concatenated, in that order, so a parameter typed into the field and one added in the table
+ * both survive; every value is encoded unless `encode` is off.
+ *
+ * @param base the API's effective base URL, already expanded
+ * @param url the request's URL, already expanded
+ * @param pathParams values for the URL's `{name}` placeholders
+ * @param query query rows to append
+ */
+export function composeUrl(base, url, pathParams = [], query = [], options = {}) {
+    const encode = options.encode ?? true;
+    const problems = [];
+    const joined = joinBase(base, url);
+    const { path, query: inlineQuery } = splitQuery(joined);
+    const values = new Map();
+    for (const row of pathParams) {
+        if (row.enabled) {
+            values.set(row.name, row.value);
+        }
+    }
+    const filled = path.replace(/\{([^{}/?#]+)\}/g, (whole, name) => {
+        const value = values.get(name);
+        if (value === undefined || value === '') {
+            problems.push({ code: 'missing-path-param', name });
+            return whole;
+        }
+        // A path segment keeps sub-delims but never a `/`: a value containing one would invent a
+        // segment the request did not ask for.
+        return encode ? encodeValue(value, "!$&'()*+,;=:@") : value;
+    });
+    const rows = [...inlineQuery, ...query].filter((row) => row.enabled);
+    const search = rows
+        .map((row) => {
+        const name = encode ? encodeValue(row.name, '') : row.name;
+        const value = encode ? encodeValue(row.value, '') : row.value;
+        return value === '' ? name : `${name}=${value}`;
+    })
+        .join('&');
+    const composed = search === '' ? filled : appendSearch(filled, search);
+    for (const name of unexpandedProperties(composed)) {
+        problems.push({ code: 'unexpanded-property', name });
+    }
+    if (!isAbsolute(composed)) {
+        problems.push({ code: 'no-host', name: composed });
+    }
+    return { url: composed, problems };
+}
+/** Appends a query string to a URL that may already carry a fragment. */
+function appendSearch(url, search) {
+    const hash = url.indexOf('#');
+    return hash === -1 ? `${url}?${search}` : `${url.slice(0, hash)}?${search}${url.slice(hash)}`;
+}

package/dist/run/effective-auth.d.ts

@@ -0,0 +1,10 @@
+import type { AuthConfig, EndpointAuth } from '../project/model.js';
+import type { SelectedRequest } from './select.js';
+/** A SOAP request's own auth, combined with its endpoint's, falling back to the interface's. */
+export declare function soapEffectiveAuth(selected: Extract<SelectedRequest, {
+    kind: 'soap';
+}>): EndpointAuth | undefined;
+/** Innermost first, as the app's `authChainFor` builds it: request, its folders inside-out, the API. */
+export declare function restEffectiveAuth(selected: Extract<SelectedRequest, {
+    kind: 'rest';
+}>): AuthConfig;

package/dist/run/effective-auth.js

@@ -0,0 +1,19 @@
+/**
+ * The authentication a selected request would send with, before any secret is resolved. Both
+ * `prepareSend` and `secretNeedsOf` read it from here, so the secrets a run is told it needs are
+ * exactly the secrets its sends will ask for.
+ */
+import { effectiveAuth } from '../project/endpoints.js';
+import { resolveAuthEndpoint } from '../project/environments.js';
+import { resolveAuthChain } from '../rest/auth.js';
+/** A SOAP request's own auth, combined with its endpoint's, falling back to the interface's. */
+export function soapEffectiveAuth(selected) {
+    const { iface, request } = selected;
+    const endpoint = resolveAuthEndpoint(iface, request);
+    return effectiveAuth(request.auth, endpoint?.auth, endpoint?.authMode ?? 'override', iface.auth);
+}
+/** Innermost first, as the app's `authChainFor` builds it: request, its folders inside-out, the API. */
+export function restEffectiveAuth(selected) {
+    const { api, chain, request } = selected;
+    return resolveAuthChain([request.auth, ...[...chain].reverse().map((folder) => folder.auth), api.auth]);
+}

package/dist/run/index.d.ts

@@ -0,0 +1,8 @@
+export { selectRequests } from './select.js';
+export type { SelectedRequest } from './select.js';
+export { prepareSend } from './prepare.js';
+export type { PreparedSend, RunContext } from './prepare.js';
+export { runRequests } from './run.js';
+export type { RequestOutcome, RequestResult, RunOptions, RunResult, RunSummary } from './run.js';
+export { secretNeedsOf } from './secret-needs.js';
+export type { LocatedSecretNeed } from './secret-needs.js';

package/dist/run/index.js

@@ -0,0 +1,4 @@
+export { selectRequests } from './select.js';
+export { prepareSend } from './prepare.js';
+export { runRequests } from './run.js';
+export { secretNeedsOf } from './secret-needs.js';

package/dist/run/prepare.d.ts

@@ -0,0 +1,43 @@
+import type { ProxyOptions } from '../http/types.js';
+import type { Project, PropertyMap } from '../project/model.js';
+import type { PropertyScopes } from '../project/properties.js';
+import type { RestSendInput } from '../rest/send.js';
+import type { GetSecret } from '../secrets/resolve.js';
+import type { SoapSendInput } from '../types.js';
+import type { SelectedRequest } from './select.js';
+/** Everything a run supplies around the saved requests it sends. */
+export interface RunContext {
+    readonly project: Project;
+    /** The project folder: keystores, attachments and file bodies are read from inside it only. */
+    readonly projectDir: string;
+    readonly environmentId?: string;
+    /** `--var` overrides, laid over the environment's properties. */
+    readonly overrides: PropertyMap;
+    readonly getSecret: GetSecret;
+    readonly timeoutMs?: number;
+    readonly insecure?: boolean;
+    readonly proxyFor?: (url: string) => ProxyOptions | undefined;
+    readonly signal?: AbortSignal;
+    /**
+     * The WSDL-derived default `wsa:Action` for a SOAP request, as the app takes it from the
+     * interface's imported definition. Absent (or returning `''`) when no definition is at hand:
+     * an explicit `wsa:Action` or the request's SOAPAction then still applies.
+     */
+    readonly defaultWsaActionFor?: (selected: Extract<SelectedRequest, {
+        kind: 'soap';
+    }>) => string;
+}
+/** One request, ready for `sendSoapRequest` (with `scopes`) or `sendRest`. */
+export type PreparedSend = {
+    readonly kind: 'soap';
+    readonly input: SoapSendInput;
+    readonly scopes: PropertyScopes;
+} | {
+    readonly kind: 'rest';
+    readonly input: RestSendInput;
+};
+/**
+ * @throws WirebenchError `unresolved-properties` | `endpoint-unresolved` | `secret-missing` |
+ * `auth-grant-unsupported` | `wss-config-missing` | `keystore-missing`
+ */
+export declare function prepareSend(selected: SelectedRequest, context: RunContext): Promise<PreparedSend>;

package/dist/run/prepare.js

@@ -0,0 +1,280 @@
+/**
+ * Turns one saved request into a send input, for a host with no editor: no draft to apply, no
+ * user preferences to fold in, no renderer to keep credentials from. It composes the same engine
+ * functions the app's main process does, in the same order, so a request runs in a pipeline the
+ * way it runs when its author presses Send.
+ *
+ * What the app reads from the user's preferences — a global client keystore, a CA bundle, a
+ * proxy, global properties — has no counterpart here: a run is described by the project and its
+ * command line alone. Trust anchors beyond Node's own come from `NODE_EXTRA_CA_CERTS`.
+ */
+import { readFile, stat } from 'node:fs/promises';
+import { isAbsolute, resolve as resolvePath } from 'node:path';
+import { WirebenchError } from '../errors.js';
+import { isInsideRealDir } from '../fs.js';
+import { createFileAttachmentResolver, readAttachment } from '../project/attachments-cache.js';
+import { resolveApiBaseUrl, resolveEndpoint, resolveScopes } from '../project/environments.js';
+import { toKeystoreDef } from '../project/keystores.js';
+import { expandSendInput } from '../project/properties.js';
+import { toWssIncomingConfig, toWssOutgoingConfig } from '../project/wss-configs.js';
+import { expandRestSendInput } from '../rest/expand.js';
+import { resolveAuthConfig, resolveEndpointAuth, toSendAuth } from '../secrets/resolve.js';
+import { toRestSendInput, toSendInput } from '../send-options.js';
+import { effectiveWsa } from '../wsa/model.js';
+import { loadKeystore, toTlsClientIdentity } from '../wss/keystore/index.js';
+import { createWssContext } from '../wss/model.js';
+import { restEffectiveAuth, soapEffectiveAuth } from './effective-auth.js';
+function scopesFor(context) {
+    const scopes = resolveScopes(context.project, context.environmentId, {}, process.env);
+    return { ...scopes, env: { ...(scopes.env ?? {}), ...context.overrides } };
+}
+function unresolvedError(path, unresolved) {
+    const exprs = unresolved.map((ref) => ref.expr);
+    return new WirebenchError('unresolved-properties', `"${path}" has property references nothing resolves: ${exprs.join(', ')}`, { details: { path, unresolved: exprs } });
+}
+/** A secret the project names but the run was not given: refused, never sent without. */
+async function requiredSecret(ref, getSecret) {
+    const value = await getSecret(ref);
+    if (value === undefined) {
+        throw new WirebenchError('secret-missing', `Secret ${ref} was not supplied to this run.`, { details: { ref } });
+    }
+    return value;
+}
+/**
+ * `path` resolved against the project folder, refused when it lands outside it. The app also
+ * accepts a file its user picked through a dialog; a pipeline has no such user, so the project
+ * folder is the whole boundary.
+ */
+async function insideProject(context, path, code, name) {
+    const resolved = resolvePath(context.projectDir, path);
+    if (!(await isInsideRealDir(context.projectDir, resolved))) {
+        throw new WirebenchError(code, `"${name}" resolves outside the project folder.`, { details: { path } });
+    }
+    return resolved;
+}
+/** Mirrors the app's keystore loading, minus its cache: a run loads each keystore it needs. */
+async function loadKeystoreById(context, keystoreId) {
+    const ref = context.project.wss.keystores.find((candidate) => candidate.id === keystoreId);
+    if (ref === undefined) {
+        return undefined;
+    }
+    const def = toKeystoreDef(ref);
+    const path = await insideProject(context, def.path, 'keystore-outside-project', def.name);
+    try {
+        await stat(path);
+    }
+    catch (error) {
+        throw new WirebenchError('keystore-unreadable', `The keystore file "${def.path}" could not be read.`, {
+            details: { id: def.id },
+            cause: error,
+        });
+    }
+    const password = def.passwordSecretRef === undefined ? undefined : await requiredSecret(def.passwordSecretRef, context.getSecret);
+    return loadKeystore(await readFile(path), { type: def.type, ...(password !== undefined ? { password } : {}) });
+}
+/** The `cert`/`key` a request's own keystore presents; there is no global keystore in a run. */
+async function clientIdentityFor(context, keystoreId) {
+    if (keystoreId === undefined || keystoreId.length === 0) {
+        return undefined;
+    }
+    const keystore = await loadKeystoreById(context, keystoreId);
+    const def = context.project.wss.keystores.find((candidate) => candidate.id === keystoreId);
+    if (keystore === undefined || def === undefined) {
+        throw new WirebenchError('keystore-missing', 'This request selects a keystore the project no longer has.', {
+            details: { keystoreId },
+        });
+    }
+    const identity = toTlsClientIdentity(keystore, toKeystoreDef(def).defaultAlias);
+    return { cert: identity.cert, key: identity.key };
+}
+/** Identity, then the only two trust opt-outs a run honours: `--insecure` and the file's own flag. */
+async function tlsFor(context, keystoreId, trustInvalid) {
+    const identity = await clientIdentityFor(context, keystoreId);
+    const skipVerify = context.insecure === true || trustInvalid;
+    if (identity === undefined && !skipVerify) {
+        return undefined;
+    }
+    return { ...identity, ...(skipVerify ? { rejectUnauthorized: false } : {}) };
+}
+/**
+ * WS-Addressing as the app's `wsaFor` builds it. The WSDL-derived default action comes from the
+ * host's `defaultWsaActionFor`; without one it is empty, as it is in the app for an interface not
+ * yet hydrated, and an explicit `wsa:Action` or the request's SOAPAction still applies.
+ */
+function wsaFor(selected, context) {
+    const config = effectiveWsa(selected.iface.wsa, selected.request.wsa);
+    return config.enabled ? { config, defaultAction: context.defaultWsaActionFor?.(selected) ?? '' } : undefined;
+}
+/** The app's `wssFor`: a selected configuration the project no longer has refuses the send. */
+function wssFor(selected, context) {
+    const { request } = selected;
+    const pick = (id) => (id === undefined || id.length === 0 ? undefined : id);
+    const outgoingId = pick(request.wssOutgoingRef);
+    const incomingId = pick(request.wssIncomingRef);
+    if (outgoingId === undefined && incomingId === undefined) {
+        return undefined;
+    }
+    const find = (refs, id, convert) => {
+        const ref = refs.find((candidate) => candidate.id === id);
+        if (ref !== undefined) {
+            try {
+                return convert(ref);
+            }
+            catch {
+                // An unreadable configuration is treated as the app treats it: as missing.
+            }
+        }
+        throw new WirebenchError('wss-config-missing', 'This request selects a WS-Security configuration the project no longer has.', { details: { configId: id } });
+    };
+    const outgoing = outgoingId === undefined ? undefined : find(context.project.wss.outgoing, outgoingId, toWssOutgoingConfig);
+    const incoming = incomingId === undefined ? undefined : find(context.project.wss.incoming, incomingId, toWssIncomingConfig);
+    const { properties } = request;
+    return {
+        ...(outgoing !== undefined ? { outgoing } : {}),
+        ...(incoming !== undefined ? { incoming } : {}),
+        ctx: createWssContext({
+            keystores: (ref) => loadKeystoreById(context, ref),
+            secrets: (ref) => requiredSecret(ref, context.getSecret),
+        }),
+        requestProperties: {
+            ...(properties.wssPasswordType !== undefined ? { wssPasswordType: properties.wssPasswordType } : {}),
+            ...(properties.wssTimeToLive !== undefined ? { wssTimeToLive: properties.wssTimeToLive } : {}),
+        },
+    };
+}
+/**
+ * The app's `attachmentResolvers`, with the project folder as the only read boundary: a `cache`
+ * attachment comes out of `attachments/`, a `path` one from its first existing candidate (resource
+ * root, then the project), and an inline `file:` reference from the project folder.
+ */
+function attachmentResolvers(context) {
+    const { projectDir } = context;
+    const resourceRoot = context.project.settings.resourceRoot;
+    const read = createFileAttachmentResolver(projectDir, resourceRoot);
+    return {
+        resolver: async (attachment) => {
+            if (attachment.source.kind === 'path') {
+                const { path } = attachment.source;
+                const candidates = isAbsolute(path)
+                    ? [path]
+                    : [...(resourceRoot !== undefined ? [resolvePath(resourceRoot, path)] : []), resolvePath(projectDir, path)];
+                for (const candidate of candidates) {
+                    const exists = await stat(candidate).then(() => true, () => false);
+                    if (exists) {
+                        await insideProject(context, candidate, 'attachment-outside-project', attachment.name);
+                        return new Uint8Array(await readFile(candidate));
+                    }
+                }
+            }
+            return read(attachment);
+        },
+        resolveFile: async (path) => new Uint8Array(await readFile(await insideProject(context, path, 'inline-file-outside-project', path))),
+        resourceRoot: projectDir,
+    };
+}
+/** A REST multipart file part or binary body, read from inside the project folder. */
+function restFileResolver(context) {
+    return async (source) => source.kind === 'cache'
+        ? readAttachment(context.projectDir, source.sha256)
+        : new Uint8Array(await readFile(await insideProject(context, source.path, 'rest-file-outside-project', source.path)));
+}
+async function prepareSoap(selected, context) {
+    const { iface, request } = selected;
+    const resolved = resolveEndpoint(context.project, context.environmentId, iface, request);
+    if (resolved.url === undefined) {
+        throw new WirebenchError('endpoint-unresolved', `No endpoint resolves for "${selected.path}"`, {
+            details: { path: selected.path },
+        });
+    }
+    const auth = await resolveEndpointAuth(soapEffectiveAuth(selected), context.getSecret);
+    const base = toSendInput({
+        request: {
+            properties: request.properties,
+            soapVersion: request.soapVersion,
+            ...(request.soapAction !== undefined ? { soapAction: request.soapAction } : {}),
+            headers: request.headers,
+            envelopeXml: request.envelopeXml,
+        },
+        endpoint: resolved.url,
+        projectSettings: context.project.settings,
+        attachments: request.attachments,
+        attachmentResolvers: attachmentResolvers(context),
+    });
+    const scopes = scopesFor(context);
+    const tls = await tlsFor(context, request.properties.sslKeystoreRef, resolved.endpoint?.trustInvalid === true);
+    const proxy = context.proxyFor?.(resolved.url);
+    const wsa = wsaFor(selected, context);
+    const wss = wssFor(selected, context);
+    const sendAuth = toSendAuth(auth);
+    // The attachments and MTOM options ride on `base`, as the app's `sendAttachmentsFor` builds them.
+    const input = {
+        ...base,
+        ...(sendAuth !== undefined ? { auth: sendAuth } : {}),
+        ...(context.timeoutMs !== undefined ? { timeoutMs: context.timeoutMs } : {}),
+        ...(tls !== undefined ? { tls: { ...base.tls, ...tls } } : {}),
+        ...(proxy !== undefined ? { proxy } : {}),
+        ...(wsa !== undefined ? { wsa } : {}),
+        ...(wss !== undefined ? { wss } : {}),
+        ...(context.signal !== undefined ? { signal: context.signal } : {}),
+    };
+    // Refused here, before the wire: the engine would report the same refs on the exchange, but by
+    // then a half-expanded envelope has already been sent to somebody's service.
+    const { unresolved } = expandSendInput(input, scopes);
+    if (unresolved.length > 0) {
+        throw unresolvedError(selected.path, unresolved);
+    }
+    return { kind: 'soap', input, scopes };
+}
+async function prepareRest(selected, context) {
+    const { api, request } = selected;
+    const configured = restEffectiveAuth(selected);
+    if (configured.type === 'oauth2') {
+        throw new WirebenchError('auth-grant-unsupported', configured.grant === 'authorization-code'
+            ? 'This request signs in through a browser (OAuth2 authorization code), which a pipeline cannot do.'
+            : 'OAuth2 is not supported by the runner yet.', { details: { path: selected.path, grant: configured.grant } });
+    }
+    const auth = await resolveAuthConfig(configured, context.getSecret);
+    const scopes = scopesFor(context);
+    const baseUrl = resolveApiBaseUrl(context.project, context.environmentId, api).url;
+    const tls = await tlsFor(context, request.settings.sslKeystoreRef, request.settings.trustInvalid === true);
+    const unexpanded = toRestSendInput({
+        request: {
+            method: request.method,
+            url: request.url,
+            pathParams: request.pathParams,
+            query: request.query,
+            headers: request.headers,
+            body: request.body,
+            settings: request.settings,
+        },
+        baseUrl,
+        projectSettings: context.project.settings,
+        ...(auth !== undefined ? { auth } : {}),
+        ...(tls !== undefined ? { tls } : {}),
+        resolveFile: restFileResolver(context),
+        ...(context.signal !== undefined ? { signal: context.signal } : {}),
+    });
+    const { input, unresolved } = expandRestSendInput(unexpanded, scopes, {
+        escape: request.settings.escapeProperties === true,
+    });
+    if (unresolved.length > 0) {
+        throw unresolvedError(selected.path, unresolved);
+    }
+    // As the app does: the proxy is chosen for the base URL, or the request's own when it has none.
+    const proxy = context.proxyFor?.(input.baseUrl === '' ? input.request.url : input.baseUrl);
+    return {
+        kind: 'rest',
+        input: {
+            ...input,
+            ...(proxy !== undefined ? { proxy } : {}),
+            ...(context.timeoutMs !== undefined ? { settings: { ...input.settings, timeoutMs: context.timeoutMs } } : {}),
+        },
+    };
+}
+/**
+ * @throws WirebenchError `unresolved-properties` | `endpoint-unresolved` | `secret-missing` |
+ * `auth-grant-unsupported` | `wss-config-missing` | `keystore-missing`
+ */
+export function prepareSend(selected, context) {
+    return selected.kind === 'soap' ? prepareSoap(selected, context) : prepareRest(selected, context);
+}

package/dist/run/run.d.ts

@@ -0,0 +1,53 @@
+import type { AssertionResult } from '../assert/model.js';
+import type { RunContext } from './prepare.js';
+import type { SelectedRequest } from './select.js';
+export type RequestOutcome = 'passed' | 'failed' | 'errored' | 'skipped';
+/** What happened to one selected request. */
+export interface RequestResult {
+    readonly path: string;
+    readonly group: string;
+    readonly name: string;
+    readonly protocol: 'soap' | 'rest';
+    readonly outcome: RequestOutcome;
+    readonly status?: number;
+    readonly durationMs?: number;
+    readonly assertions: readonly AssertionResult[];
+    /** Set when errored before or during the send. */
+    readonly error?: {
+        readonly code: string;
+        readonly message: string;
+        readonly details?: Readonly<Record<string, unknown>>;
+    };
+    /** A request with no assertions of its own; reported, and an error under `requireAssertions`. */
+    readonly unasserted: boolean;
+    /** Raw request and response text, kept for failed and errored requests only. NOT yet redacted. */
+    readonly exchange?: {
+        readonly request: string;
+        readonly response: string;
+    };
+}
+export interface RunSummary {
+    readonly total: number;
+    readonly passed: number;
+    readonly failed: number;
+    readonly errored: number;
+    readonly skipped: number;
+    readonly durationMs: number;
+}
+export interface RunResult {
+    readonly startedAt: string;
+    readonly environment?: string;
+    readonly summary: RunSummary;
+    readonly requests: readonly RequestResult[];
+}
+export interface RunOptions {
+    readonly bail?: boolean;
+    readonly defaultSlaMs?: number;
+    readonly requireAssertions?: boolean;
+    readonly onRequestDone?: (result: RequestResult) => void;
+}
+/**
+ * Sends `selected` in order and reports each. A request after an abort, or after the first
+ * failure under `bail`, is `skipped` and never sent.
+ */
+export declare function runRequests(selected: readonly SelectedRequest[], context: RunContext, options?: RunOptions): Promise<RunResult>;