@wirebench/engine 2.1.1

package/dist/run/run.js

@@ -0,0 +1,223 @@
+/**
+ * Sends each selected request, evaluates its assertions and summarises the run.
+ *
+ * One request's error never stops the run unless `bail` asks it to: a pipeline wants the whole
+ * picture, not the first thing that went wrong. An errored assertion outranks a failed one for the
+ * request's outcome, because "we could not tell" is a different problem from "it is wrong".
+ */
+import { evaluateAssertions } from '../assert/index.js';
+import { isWirebenchError } from '../errors.js';
+import { definitionCacheDir } from '../project/paths.js';
+import { sendRest } from '../rest/send.js';
+import { sendSoapRequest } from '../send.js';
+import { bindingContextFor, validateMessage } from '../validate/index.js';
+import { summarizeWsa } from '../wsa/policy-detect.js';
+import { parseWsdlBundle } from '../wsdl/merge.js';
+import { readDefinitionCache } from '../wsdl/cache.js';
+import { buildSchemaSet } from '../xsd/schema-set.js';
+import { prepareSend } from './prepare.js';
+/** Enough of each exchange to keep for a report: a failing response can be megabytes. */
+const EXCHANGE_CAP_BYTES = 64 * 1024;
+function capped(bytes) {
+    if (bytes.length <= EXCHANGE_CAP_BYTES) {
+        return new TextDecoder().decode(bytes);
+    }
+    return `${new TextDecoder().decode(bytes.subarray(0, EXCHANGE_CAP_BYTES))}\n… truncated`;
+}
+function identity(item) {
+    return { path: item.path, group: item.group, name: item.request.name, protocol: item.kind };
+}
+function erroredResult(item, error) {
+    return {
+        ...identity(item),
+        outcome: 'errored',
+        assertions: [],
+        error,
+        unasserted: item.request.assertions.length === 0,
+    };
+}
+function parseClark(clark) {
+    const match = /^\{([^}]*)\}(.*)$/.exec(clark);
+    return match === null
+        ? { namespaceUri: '', localName: clark }
+        : { namespaceUri: match[1] ?? '', localName: match[2] ?? '' };
+}
+/**
+ * Reads the interface's definition from `interfaces/<slug>/definition/`, as the app hydrates it
+ * with `prefer-cache` — minus the network fallback: a run never fetches a WSDL. An interface that
+ * does not cache its definition, or whose cache is absent or unreadable, has no contract here.
+ */
+async function loadDefinition(projectDir, iface) {
+    if (!iface.cacheDefinition) {
+        return undefined;
+    }
+    try {
+        const bundle = await readDefinitionCache(definitionCacheDir(projectDir, iface.slug));
+        const definition = parseWsdlBundle(bundle);
+        return {
+            definition,
+            bundle,
+            schemaSet: buildSchemaSet(bundle),
+            defaultActionByOperation: summarizeWsa(definition).defaultActionByOperation,
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+function soapSubject(exchange, loaded, item) {
+    const fault = exchange.response?.fault;
+    const bodyText = exchange.response?.envelopeXml ?? new TextDecoder().decode(exchange.http.body);
+    const binding = loaded === undefined
+        ? undefined
+        : bindingContextFor(loaded.definition, { bindingName: parseClark(item.operation.bindingName), operationName: item.operation.name }, 'response');
+    const contentType = exchange.http.headers['content-type'];
+    return {
+        protocol: 'soap',
+        status: exchange.http.status,
+        durationMs: exchange.durationMs,
+        bodyText,
+        bodyKind: exchange.response?.isSoap === true ? 'xml' : 'other',
+        fault: {
+            present: fault !== undefined,
+            ...(fault !== undefined ? { summary: [fault.code, fault.reason].filter((s) => s.length > 0).join(' — ') } : {}),
+        },
+        ...(loaded !== undefined && binding !== undefined
+            ? {
+                validateContract: () => validateMessage({
+                    xml: bodyText,
+                    direction: 'response',
+                    schemaSet: loaded.schemaSet,
+                    bundle: loaded.bundle,
+                    binding,
+                    http: { ...(contentType !== undefined ? { contentType } : {}) },
+                }).then((r) => r.problems),
+            }
+            : {}),
+    };
+}
+function restSubject(exchange) {
+    return {
+        protocol: 'rest',
+        status: exchange.status,
+        durationMs: exchange.durationMs,
+        bodyText: exchange.text,
+        bodyKind: exchange.language === 'json' ? 'json' : exchange.language === 'xml' ? 'xml' : 'other',
+    };
+}
+function outcomeOf(assertions) {
+    if (assertions.some((a) => a.outcome === 'errored'))
+        return 'errored';
+    if (assertions.some((a) => a.outcome === 'failed'))
+        return 'failed';
+    return 'passed';
+}
+/** Runs one request; a throw anywhere on the way becomes an errored result, never a stopped run. */
+async function runOne(item, context, options, definitionFor) {
+    try {
+        const loaded = item.kind === 'soap' ? await definitionFor(item.iface) : undefined;
+        const prepared = await prepareSend(item, {
+            ...context,
+            ...(loaded !== undefined
+                ? {
+                    defaultWsaActionFor: (s) => loaded.defaultActionByOperation[`${s.operation.bindingName}|${s.operation.name}`] ?? '',
+                }
+                : {}),
+        });
+        let subject;
+        let raw;
+        if (prepared.kind === 'soap' && item.kind === 'soap') {
+            const exchange = await sendSoapRequest(prepared.input, { scopes: prepared.scopes });
+            subject = soapSubject(exchange, loaded, item);
+            raw = exchange.http;
+        }
+        else if (prepared.kind === 'rest') {
+            const exchange = await sendRest(prepared.input);
+            subject = restSubject(exchange);
+            raw = exchange;
+        }
+        else {
+            throw new Error('prepareSend returned a send of the wrong protocol');
+        }
+        const own = item.request.assertions;
+        const withDefault = options.defaultSlaMs !== undefined && !own.some((a) => a.type === 'sla')
+            ? [...own, { type: 'sla', maxMs: options.defaultSlaMs }]
+            : own;
+        const assertions = await evaluateAssertions(subject, withDefault);
+        const outcome = outcomeOf(assertions);
+        return {
+            ...identity(item),
+            outcome,
+            status: subject.status,
+            durationMs: subject.durationMs,
+            assertions,
+            unasserted: own.length === 0,
+            ...(outcome !== 'passed'
+                ? { exchange: { request: capped(raw.rawRequest), response: capped(raw.rawResponse) } }
+                : {}),
+        };
+    }
+    catch (e) {
+        return erroredResult(item, {
+            code: isWirebenchError(e) ? e.code : 'internal-error',
+            message: e instanceof Error ? e.message : String(e),
+            ...(isWirebenchError(e) && e.details !== undefined ? { details: e.details } : {}),
+        });
+    }
+}
+/**
+ * Sends `selected` in order and reports each. A request after an abort, or after the first
+ * failure under `bail`, is `skipped` and never sent.
+ */
+export async function runRequests(selected, context, options = {}) {
+    const started = performance.now();
+    const startedAt = new Date().toISOString();
+    const definitions = new Map();
+    const definitionFor = (iface) => {
+        let loaded = definitions.get(iface.id);
+        if (loaded === undefined) {
+            loaded = loadDefinition(context.projectDir, iface);
+            definitions.set(iface.id, loaded);
+        }
+        return loaded;
+    };
+    const results = [];
+    let stopped = false;
+    for (const item of selected) {
+        let result;
+        if (stopped || context.signal?.aborted === true) {
+            result = {
+                ...identity(item),
+                outcome: 'skipped',
+                assertions: [],
+                unasserted: item.request.assertions.length === 0,
+            };
+        }
+        else if (item.request.assertions.length === 0 && options.requireAssertions === true) {
+            result = erroredResult(item, { code: 'assertions-required', message: 'This request has no assertions.' });
+        }
+        else {
+            result = await runOne(item, context, options, definitionFor);
+        }
+        results.push(result);
+        options.onRequestDone?.(result);
+        if (options.bail === true && (result.outcome === 'failed' || result.outcome === 'errored')) {
+            stopped = true;
+        }
+    }
+    const count = (outcome) => results.filter((r) => r.outcome === outcome).length;
+    const environment = context.project.environments.find((e) => e.id === context.environmentId)?.name;
+    return {
+        startedAt,
+        ...(environment !== undefined ? { environment } : {}),
+        summary: {
+            total: results.length,
+            passed: count('passed'),
+            failed: count('failed'),
+            errored: count('errored'),
+            skipped: count('skipped'),
+            durationMs: Math.round(performance.now() - started),
+        },
+        requests: results,
+    };
+}

package/dist/run/secret-needs.d.ts

@@ -0,0 +1,13 @@
+import type { Project } from '../project/model.js';
+import type { SecretNeed } from '../secrets/env-names.js';
+import type { SelectedRequest } from './select.js';
+/** One secret a run needs, and which requests need it. */
+export interface LocatedSecretNeed extends SecretNeed {
+    /** Display paths of the requests that need it. */
+    readonly usedBy: readonly string[];
+}
+/**
+ * The secrets `selected` needs, one entry per ref in first-use order, each with every request
+ * that uses it. The first declaration of a ref supplies its name and purpose.
+ */
+export declare function secretNeedsOf(selected: readonly SelectedRequest[], project: Project): LocatedSecretNeed[];

package/dist/run/secret-needs.js

@@ -0,0 +1,125 @@
+/**
+ * Every secret a selection of requests will ask for, found before anything is sent, so a pipeline
+ * can be told which variables to set (`wirebench secrets list`) and a run knows which names to
+ * read. It walks the same sources `prepareSend` resolves: effective auth, the request's keystore,
+ * and the WS-Security configurations it selects, with the keystores those lead to.
+ */
+import { toKeystoreDef } from '../project/keystores.js';
+import { toWssIncomingConfig, toWssOutgoingConfig } from '../project/wss-configs.js';
+import { secretNeedsOfAuth } from '../secrets/env-names.js';
+import { restEffectiveAuth, soapEffectiveAuth } from './effective-auth.js';
+const present = (id) => id !== undefined && id.length > 0;
+/** A keystore's password, when the registry entry has one; an unreadable entry needs nothing here. */
+function keystoreNeeds(project, keystoreId) {
+    if (!present(keystoreId)) {
+        return [];
+    }
+    const ref = project.wss.keystores.find((candidate) => candidate.id === keystoreId);
+    if (ref === undefined) {
+        return [];
+    }
+    try {
+        const def = toKeystoreDef(ref);
+        return present(def.passwordSecretRef)
+            ? [
+                {
+                    ref: def.passwordSecretRef,
+                    ...(def.passwordEnv !== undefined ? { envName: def.passwordEnv } : {}),
+                    purpose: `keystore password for "${def.name}"`,
+                },
+            ]
+            : [];
+    }
+    catch {
+        // `prepareSend` refuses such a request with its own error; it needs no secret before then.
+        return [];
+    }
+}
+/** Parses a WS-Security configuration by id; missing or unreadable is prepare's error, not a need. */
+function findConfig(refs, id, convert) {
+    if (!present(id)) {
+        return undefined;
+    }
+    const ref = refs.find((candidate) => candidate.id === id);
+    if (ref === undefined) {
+        return undefined;
+    }
+    try {
+        return convert(ref);
+    }
+    catch {
+        return undefined;
+    }
+}
+/** WS-Security passwords carry no `…Env` name: they resolve through their ref-derived variable. */
+function outgoingNeeds(project, config) {
+    const needs = [];
+    for (const entry of config.entries) {
+        if (entry.kind === 'username-token') {
+            const ref = entry.passwordRef ?? config.defaultPasswordRef;
+            if (entry.passwordType !== 'none' && present(ref)) {
+                needs.push({ ref, purpose: `WS-Security password for "${entry.username}"` });
+            }
+        }
+        else if (entry.kind === 'signature') {
+            needs.push(...keystoreNeeds(project, entry.keystoreRef));
+            if (present(entry.keyPasswordRef)) {
+                needs.push({ ref: entry.keyPasswordRef, purpose: `WS-Security signing key password ("${config.name}")` });
+            }
+        }
+        else if (entry.kind === 'encryption') {
+            needs.push(...keystoreNeeds(project, entry.keystoreRef));
+        }
+    }
+    return needs;
+}
+function incomingNeeds(project, config) {
+    return [
+        ...keystoreNeeds(project, config.decryptKeystoreRef),
+        ...(present(config.decryptKeyPasswordRef)
+            ? [{ ref: config.decryptKeyPasswordRef, purpose: `WS-Security decryption key password ("${config.name}")` }]
+            : []),
+        ...keystoreNeeds(project, config.signatureKeystoreRef),
+    ];
+}
+function needsOf(selected, project) {
+    if (selected.kind === 'rest') {
+        return [
+            ...secretNeedsOfAuth(restEffectiveAuth(selected)),
+            ...keystoreNeeds(project, selected.request.settings.sslKeystoreRef),
+        ];
+    }
+    const { request } = selected;
+    const outgoing = findConfig(project.wss.outgoing, request.wssOutgoingRef, toWssOutgoingConfig);
+    const incoming = findConfig(project.wss.incoming, request.wssIncomingRef, toWssIncomingConfig);
+    return [
+        ...secretNeedsOfAuth(soapEffectiveAuth(selected)),
+        ...keystoreNeeds(project, request.properties.sslKeystoreRef),
+        ...(outgoing !== undefined ? outgoingNeeds(project, outgoing) : []),
+        ...(incoming !== undefined ? incomingNeeds(project, incoming) : []),
+    ];
+}
+/**
+ * The secrets `selected` needs, one entry per ref in first-use order, each with every request
+ * that uses it. The first declaration of a ref supplies its name and purpose.
+ */
+export function secretNeedsOf(selected, project) {
+    const byRef = new Map();
+    for (const item of selected) {
+        for (const need of needsOf(item, project)) {
+            const known = byRef.get(need.ref);
+            if (known === undefined) {
+                byRef.set(need.ref, { need, usedBy: [item.path] });
+            }
+            else {
+                if (!known.usedBy.includes(item.path)) {
+                    known.usedBy.push(item.path);
+                }
+                if (known.need.envName === undefined && need.envName !== undefined) {
+                    known.need = { ...known.need, envName: need.envName };
+                }
+            }
+        }
+    }
+    return [...byRef.values()].map(({ need, usedBy }) => ({ ...need, usedBy }));
+}

package/dist/run/select.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Which requests a run covers, and in what order: the order the explorer shows, so a report reads
+ * like the project. Interfaces and APIs share one ordering space (see `Project.apis`).
+ */
+import type { Interface, OperationDef, Project, SoapRequestDef } from '../project/model.js';
+import type { RestApi, RestFolder, RestRequestDef } from '../rest/model.js';
+/** One saved request selected for a run, with enough context to send and report it. */
+export type SelectedRequest = {
+    readonly kind: 'soap';
+    readonly path: string;
+    readonly group: string;
+    readonly iface: Interface;
+    readonly operation: OperationDef;
+    readonly request: SoapRequestDef;
+} | {
+    readonly kind: 'rest';
+    readonly path: string;
+    readonly group: string;
+    readonly api: RestApi;
+    readonly chain: readonly RestFolder[];
+    readonly request: RestRequestDef;
+};
+/**
+ * Resolves `selectors` (display paths or on-disk paths, matched at a `/` boundary) against the
+ * project's requests, in explorer order. An empty `selectors` list selects everything. A gRPC or
+ * WebSocket API is skipped: neither is runnable from the command line in this slice, and there is
+ * no per-selector reason to report — a selector naming one simply matches nothing and surfaces
+ * through `unmatched`, same as a typo would. `unmatched` lists every selector that covered no
+ * request, so the runner can refuse the run rather than quietly test nothing.
+ */
+export declare function selectRequests(project: Project, selectors: readonly string[]): {
+    selected: SelectedRequest[];
+    unmatched: string[];
+};

package/dist/run/select.js

@@ -0,0 +1,76 @@
+const byOrder = (a, b) => a.order - b.order || a.name.localeCompare(b.name);
+function walkRest(api, chain, node, group, diskDir, out) {
+    const children = [
+        ...node.requests.map((request) => ({
+            tag: 'request',
+            order: request.order,
+            name: request.name,
+            request,
+        })),
+        ...node.folders.map((folder) => ({ tag: 'folder', order: folder.order, name: folder.name, folder })),
+    ].sort(byOrder);
+    for (const child of children) {
+        if (child.tag === 'request') {
+            if (child.request.orphaned !== true) {
+                out.push({
+                    item: { kind: 'rest', path: `${group}/${child.request.name}`, group, api, chain, request: child.request },
+                    diskPath: `${diskDir}/${child.request.slug}`,
+                });
+            }
+        }
+        else {
+            walkRest(api, [...chain, child.folder], child.folder, `${group}/${child.folder.name}`, `${diskDir}/${child.folder.slug}`, out);
+        }
+    }
+}
+function candidates(project) {
+    const out = [];
+    for (const container of [...project.interfaces, ...project.apis].sort(byOrder)) {
+        if (container.kind === 'rest') {
+            walkRest(container, [], container, container.name, `apis/${container.slug}/requests`, out);
+            continue;
+        }
+        for (const operation of [...container.operations].sort(byOrder)) {
+            const group = `${container.name}/${operation.name}`;
+            for (const request of [...operation.requests].sort(byOrder)) {
+                if (request.orphaned !== true) {
+                    out.push({
+                        item: { kind: 'soap', path: `${group}/${request.name}`, group, iface: container, operation, request },
+                        diskPath: `interfaces/${container.slug}/operations/${operation.slug}/${request.slug}`,
+                    });
+                }
+            }
+        }
+    }
+    return out;
+}
+function normalise(selector) {
+    return selector
+        .replace(/\\/g, '/')
+        .replace(/^\.\//, '')
+        .replace(/\.request\.yaml$/, '')
+        .replace(/\/$/, '');
+}
+const covers = (selector, candidate) => candidate === selector || candidate.startsWith(`${selector}/`);
+/**
+ * Resolves `selectors` (display paths or on-disk paths, matched at a `/` boundary) against the
+ * project's requests, in explorer order. An empty `selectors` list selects everything. A gRPC or
+ * WebSocket API is skipped: neither is runnable from the command line in this slice, and there is
+ * no per-selector reason to report — a selector naming one simply matches nothing and surfaces
+ * through `unmatched`, same as a typo would. `unmatched` lists every selector that covered no
+ * request, so the runner can refuse the run rather than quietly test nothing.
+ */
+export function selectRequests(project, selectors) {
+    const all = candidates(project);
+    if (selectors.length === 0) {
+        return { selected: all.map((c) => c.item), unmatched: [] };
+    }
+    const matches = (selector, c) => {
+        const s = normalise(selector);
+        return covers(s, c.item.path) || covers(s, c.diskPath);
+    };
+    return {
+        selected: all.filter((c) => selectors.some((s) => matches(s, c))).map((c) => c.item),
+        unmatched: selectors.filter((s) => !all.some((c) => matches(s, c))),
+    };
+}

package/dist/secrets/env-names.d.ts

@@ -0,0 +1,27 @@
+/**
+ * What secrets a config needs, and what environment variable a run reads each one from.
+ *
+ * A `secretRef` is opaque by design (see `resolve.ts`): it identifies an entry in the OS-keychain-
+ * backed secret store, not a name a human would choose for a CI variable. A file may now declare a
+ * friendlier `…Env` name beside the ref — not a secret, safe to commit — and this module is where
+ * that name and the ref both turn into the environment variables a headless run is allowed to read.
+ */
+import type { AuthConfig, EndpointAuth } from '../project/model.js';
+/** The prefix every secret-carrying environment variable name starts with. */
+export declare const SECRET_ENV_PREFIX = "WIREBENCH_SECRET_";
+/** One secret a run must be given, and the friendlier name the file declares for it, if any. */
+export interface SecretNeed {
+    /** The opaque reference in the file. */
+    readonly ref: string;
+    /** The declared name, when the file carries one. */
+    readonly envName?: string;
+    /** What the secret is for, for `secrets list`: e.g. `basic password for "svc-billing"`. */
+    readonly purpose: string;
+}
+/** Every secret `auth` would resolve at send time. */
+export declare function secretNeedsOfAuth(auth: AuthConfig | EndpointAuth | undefined): SecretNeed[];
+/**
+ * The variables a host reads for one secret, in order: the declared name, then the reference
+ * itself. The reference form exists so a project nobody has annotated can still run in CI.
+ */
+export declare function envVariablesFor(secret: Pick<SecretNeed, 'ref' | 'envName'>): string[];

package/dist/secrets/env-names.js

@@ -0,0 +1,40 @@
+/**
+ * What secrets a config needs, and what environment variable a run reads each one from.
+ *
+ * A `secretRef` is opaque by design (see `resolve.ts`): it identifies an entry in the OS-keychain-
+ * backed secret store, not a name a human would choose for a CI variable. A file may now declare a
+ * friendlier `…Env` name beside the ref — not a secret, safe to commit — and this module is where
+ * that name and the ref both turn into the environment variables a headless run is allowed to read.
+ */
+/** The prefix every secret-carrying environment variable name starts with. */
+export const SECRET_ENV_PREFIX = 'WIREBENCH_SECRET_';
+function need(ref, envName, purpose) {
+    return ref === undefined || ref.length === 0 ? [] : [{ ref, ...(envName !== undefined ? { envName } : {}), purpose }];
+}
+/** Every secret `auth` would resolve at send time. */
+export function secretNeedsOfAuth(auth) {
+    if (auth === undefined) {
+        return [];
+    }
+    switch (auth.type) {
+        case 'basic':
+        case 'ntlm':
+            return need(auth.passwordRef, auth.passwordEnv, `${auth.type} password for "${auth.username ?? ''}"`);
+        case 'bearer':
+            return need(auth.tokenRef, auth.tokenEnv, 'bearer token');
+        case 'api-key':
+            return need(auth.valueRef, auth.valueEnv, `API key "${auth.name}"`);
+        case 'oauth2':
+            return need(auth.clientSecretRef, auth.clientSecretEnv, `OAuth2 client secret for "${auth.clientId}"`);
+        default:
+            return [];
+    }
+}
+/**
+ * The variables a host reads for one secret, in order: the declared name, then the reference
+ * itself. The reference form exists so a project nobody has annotated can still run in CI.
+ */
+export function envVariablesFor(secret) {
+    const byRef = `${SECRET_ENV_PREFIX}${secret.ref.toUpperCase().replace(/[^A-Z0-9]/g, '_')}`;
+    return secret.envName !== undefined ? [`${SECRET_ENV_PREFIX}${secret.envName}`, byRef] : [byRef];
+}

package/dist/secrets/resolve.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Resolves an `EndpointAuth` (which only ever carries a `passwordRef`) into the plaintext shape
+ * the engine's `importDefinition`/send path expects. Kept pure — the secret getter is injected —
+ * so it needs no Electron and is trivially testable without a real `SecretStore`.
+ */
+import type { AuthConfig, EndpointAuth } from '../project/model.js';
+import type { SendAuth } from '../types.js';
+/** Turns a `secretRef` into its value. The one seam every host fills in: a keychain, or `process.env`. */
+export type GetSecret = (ref: string) => Promise<string | undefined>;
+/**
+ * The message for a `secret-missing` error: in a shared workspace, secret refs travel with the
+ * project but values stay in each member's local keychain-backed store, so a teammate who joins
+ * sees a ref with nothing behind it on their machine. Named by username when one is known,
+ * otherwise a generic fallback — either way it tells the user where to act instead of merely
+ * naming the dangling ref.
+ */
+export declare function secretMissingMessage(username: string | undefined): string;
+/** The engine-facing shape: a resolved password in place of a `passwordRef`. */
+export interface ResolvedAuth {
+    readonly type: EndpointAuth['type'];
+    readonly username?: string;
+    readonly password?: string;
+    readonly domain?: string;
+    readonly workstation?: string;
+    readonly preemptive?: boolean;
+}
+/**
+ * Looks up `auth.passwordRef` via `getSecret` and returns the resolved auth. Returns `undefined`
+ * when `auth` itself is `undefined` (nothing to resolve). Throws a `secret-missing`
+ * `WirebenchError` when a `passwordRef` is set but the store has no value for it — a dangling
+ * reference must fail loudly rather than silently sending no credentials.
+ */
+export declare function resolveEndpointAuth(auth: EndpointAuth | undefined, getSecret: GetSecret): Promise<ResolvedAuth | undefined>;
+/**
+ * Converts resolved endpoint credentials into the engine's `SendAuth`, or `undefined` when there
+ * is nothing to send (no auth configured, `type: 'none'`, or an incomplete pair). Basic defaults
+ * to preemptive; a non-preemptive send waits for the 401 challenge. Shared by every host so a
+ * SOAP request authenticates the same way from the app and from a pipeline.
+ */
+export declare function toSendAuth(auth?: ResolvedAuth): SendAuth | undefined;
+/**
+ * Resolves any {@link AuthConfig} into the engine's `SendAuth` — the shape that carries values
+ * rather than references.
+ *
+ * The token-bearing schemes are resolved here; OAuth2 is not, because obtaining a token is a
+ * network exchange with its own cache and its own browser flow. The caller passes `accessToken`
+ * for an OAuth2 configuration, having got it from `oauth2.ts`.
+ *
+ * `inherit` and `none` resolve to no credentials at all: `inherit` should already have been
+ * resolved by `resolveAuthChain` before this is called, and reaching here means nothing in the
+ * chain configured anything.
+ *
+ * @throws WirebenchError `secret-missing` when a reference is set but the store has no value for
+ * it — a dangling reference must fail loudly rather than quietly sending no credentials.
+ */
+export declare function resolveAuthConfig(auth: AuthConfig | undefined, getSecret: GetSecret, options?: {
+    readonly accessToken?: string;
+}): Promise<SendAuth | undefined>;