@wirebench/engine 2.1.1

package/dist/secrets/resolve.js

@@ -0,0 +1,136 @@
+/**
+ * Resolves an `EndpointAuth` (which only ever carries a `passwordRef`) into the plaintext shape
+ * the engine's `importDefinition`/send path expects. Kept pure — the secret getter is injected —
+ * so it needs no Electron and is trivially testable without a real `SecretStore`.
+ */
+import { WirebenchError } from '../errors.js';
+/**
+ * The message for a `secret-missing` error: in a shared workspace, secret refs travel with the
+ * project but values stay in each member's local keychain-backed store, so a teammate who joins
+ * sees a ref with nothing behind it on their machine. Named by username when one is known,
+ * otherwise a generic fallback — either way it tells the user where to act instead of merely
+ * naming the dangling ref.
+ */
+export function secretMissingMessage(username) {
+    return username !== undefined
+        ? `The password for "${username}" is not on this machine — enter it in the authentication settings.`
+        : 'A saved password is not on this machine — enter it in the authentication settings.';
+}
+/**
+ * Looks up `auth.passwordRef` via `getSecret` and returns the resolved auth. Returns `undefined`
+ * when `auth` itself is `undefined` (nothing to resolve). Throws a `secret-missing`
+ * `WirebenchError` when a `passwordRef` is set but the store has no value for it — a dangling
+ * reference must fail loudly rather than silently sending no credentials.
+ */
+export async function resolveEndpointAuth(auth, getSecret) {
+    if (!auth) {
+        return undefined;
+    }
+    const resolved = {
+        type: auth.type,
+        ...(auth.username !== undefined ? { username: auth.username } : {}),
+        ...(auth.domain !== undefined ? { domain: auth.domain } : {}),
+        ...(auth.workstation !== undefined ? { workstation: auth.workstation } : {}),
+        ...(auth.preemptive !== undefined ? { preemptive: auth.preemptive } : {}),
+    };
+    if (auth.passwordRef === undefined) {
+        return resolved;
+    }
+    const password = await getSecret(auth.passwordRef);
+    if (password === undefined) {
+        throw new WirebenchError('secret-missing', secretMissingMessage(auth.username), {
+            details: { ref: auth.passwordRef },
+        });
+    }
+    return { ...resolved, password };
+}
+/**
+ * Converts resolved endpoint credentials into the engine's `SendAuth`, or `undefined` when there
+ * is nothing to send (no auth configured, `type: 'none'`, or an incomplete pair). Basic defaults
+ * to preemptive; a non-preemptive send waits for the 401 challenge. Shared by every host so a
+ * SOAP request authenticates the same way from the app and from a pipeline.
+ */
+export function toSendAuth(auth) {
+    if (auth === undefined || auth.type === 'none') {
+        return undefined;
+    }
+    if (auth.username === undefined || auth.password === undefined) {
+        return undefined;
+    }
+    if (auth.type === 'ntlm') {
+        return {
+            type: 'ntlm',
+            username: auth.username,
+            password: auth.password,
+            ...(auth.domain !== undefined ? { domain: auth.domain } : {}),
+            ...(auth.workstation !== undefined ? { workstation: auth.workstation } : {}),
+        };
+    }
+    return { type: 'basic', username: auth.username, password: auth.password, preemptive: auth.preemptive !== false };
+}
+/**
+ * Resolves any {@link AuthConfig} into the engine's `SendAuth` — the shape that carries values
+ * rather than references.
+ *
+ * The token-bearing schemes are resolved here; OAuth2 is not, because obtaining a token is a
+ * network exchange with its own cache and its own browser flow. The caller passes `accessToken`
+ * for an OAuth2 configuration, having got it from `oauth2.ts`.
+ *
+ * `inherit` and `none` resolve to no credentials at all: `inherit` should already have been
+ * resolved by `resolveAuthChain` before this is called, and reaching here means nothing in the
+ * chain configured anything.
+ *
+ * @throws WirebenchError `secret-missing` when a reference is set but the store has no value for
+ * it — a dangling reference must fail loudly rather than quietly sending no credentials.
+ */
+export async function resolveAuthConfig(auth, getSecret, options = {}) {
+    if (auth === undefined) {
+        return undefined;
+    }
+    switch (auth.type) {
+        case 'basic':
+        case 'ntlm': {
+            const resolved = await resolveEndpointAuth(auth, getSecret);
+            if (resolved === undefined || resolved.type === 'none') {
+                return undefined;
+            }
+            const password = resolved.password ?? '';
+            return resolved.type === 'basic'
+                ? { type: 'basic', username: resolved.username ?? '', password, preemptive: resolved.preemptive ?? true }
+                : {
+                    type: 'ntlm',
+                    username: resolved.username ?? '',
+                    password,
+                    ...(resolved.domain !== undefined ? { domain: resolved.domain } : {}),
+                    ...(resolved.workstation !== undefined ? { workstation: resolved.workstation } : {}),
+                };
+        }
+        case 'bearer': {
+            const token = await requireSecret(auth.tokenRef, getSecret);
+            return token === undefined
+                ? undefined
+                : { type: 'bearer', token, ...(auth.scheme !== undefined ? { scheme: auth.scheme } : {}) };
+        }
+        case 'api-key': {
+            const value = await requireSecret(auth.valueRef, getSecret);
+            return value === undefined ? undefined : { type: 'api-key', name: auth.name, value, in: auth.in };
+        }
+        case 'oauth2':
+            return options.accessToken === undefined ? undefined : { type: 'oauth2', accessToken: options.accessToken };
+        default:
+            return undefined;
+    }
+}
+/** One reference resolved, or `undefined` when the scheme has none configured yet. */
+async function requireSecret(ref, getSecret) {
+    if (ref === undefined || ref === '') {
+        return undefined;
+    }
+    const value = await getSecret(ref);
+    if (value === undefined) {
+        throw new WirebenchError('secret-missing', `Secret ${ref} was not found in the secret store.`, {
+            details: { ref },
+        });
+    }
+    return value;
+}

package/dist/send-options.d.ts

@@ -0,0 +1,141 @@
+/**
+ * Turns a saved request plus the settings around it into the {@link SoapSendInput} the
+ * transport actually receives.
+ *
+ * This is the single place the three layers of configuration meet, and the precedence between
+ * them is fixed here rather than in the desktop app: the request's own property wins, then the
+ * project's setting, then the user's preference (which is also the engine default). A property
+ * left unset in the request is therefore never "off" — it is "inherit".
+ */
+import type { Preferences } from './project/preferences.js';
+import type { Attachment, HeaderEntry, ProjectSettings, RequestProperties } from './project/model.js';
+import type { AttachmentResolver } from './soap/mime/types.js';
+import type { SendAuth, SoapSendInput } from './types.js';
+import type { ProxyOptions, TlsOptions } from './http/types.js';
+import type { FileResolver } from './rest/body.js';
+import type { KeyValueEntry, RestBody, RestMethod, RestRequestSettings } from './rest/model.js';
+import type { Cookie } from './rest/response.js';
+import type { RestSendInput } from './rest/send.js';
+import type { GrpcMethodKind, GrpcRequestSettings } from './grpc/model.js';
+import type { GrpcSendInput } from './grpc/send.js';
+/** The parts of a request {@link toSendInput} reads. */
+export interface SendRequestInput {
+    readonly properties: RequestProperties;
+    readonly soapVersion: '1.1' | '1.2';
+    readonly soapAction?: string;
+    readonly headers: readonly HeaderEntry[];
+    readonly envelopeXml: string;
+}
+/**
+ * How the send is to read attachment and inline-file bytes. The engine never opens a file
+ * on its own, so without this the request's attachments (and its inline-file property) are
+ * left inert; the desktop main process supplies `createFileAttachmentResolver`.
+ */
+export interface AttachmentResolvers {
+    readonly resolver: AttachmentResolver;
+    /** Reads one file for "Enable Inline Files". */
+    readonly resolveFile?: (path: string) => Promise<Uint8Array>;
+    /** The project's resource root, for relative inline-file references. */
+    readonly resourceRoot?: string;
+}
+/** Everything {@link toSendInput} needs beyond the request itself. */
+export interface ToSendInputArgs {
+    readonly request: SendRequestInput;
+    /** The already-resolved endpoint URL (environment overrides applied). */
+    readonly endpoint: string;
+    readonly preferences?: Preferences;
+    readonly projectSettings?: Pick<ProjectSettings, 'defaultTimeoutMs'>;
+    /** The request's attachments; only acted on together with {@link attachmentResolvers}. */
+    readonly attachments?: readonly Attachment[];
+    readonly attachmentResolvers?: AttachmentResolvers;
+}
+/**
+ * Builds the send input for one request.
+ *
+ * Timeout precedence is request > project > preference. The TLS floor (`ssl.minVersion`) and
+ * the HTTP/2 offer come from preferences alone. Headers are the request's own, plus a
+ * `User-Agent` from preferences when the request does not set one, plus `Accept-Encoding` when
+ * response compression is enabled and `Connection: close` when connection reuse is disabled.
+ * Request-body gzip is requested via `compressBody`; the transport does the compressing so the
+ * `Content-Length` it computes describes the bytes that are actually sent.
+ *
+ * The MTOM/attachment properties are mapped only when `attachmentResolvers` says how bytes
+ * can be read; without a resolver there is nothing the transport could do with them, and a
+ * half-configured send would silently drop parts.
+ *
+ * @param args the request, its resolved endpoint, and the preferences/project settings around it
+ */
+export declare function toSendInput(args: ToSendInputArgs): SoapSendInput;
+/** The parts of a REST request {@link toRestSendInput} reads. */
+export interface RestSendRequestInput {
+    readonly method: RestMethod;
+    readonly url: string;
+    readonly pathParams: readonly KeyValueEntry[];
+    readonly query: readonly KeyValueEntry[];
+    readonly headers: readonly KeyValueEntry[];
+    readonly body: RestBody;
+    readonly settings: RestRequestSettings;
+}
+/** Everything {@link toRestSendInput} needs beyond the request itself. */
+export interface ToRestSendInputArgs {
+    readonly request: RestSendRequestInput;
+    /** The API's effective base URL, environment override applied and properties expanded. */
+    readonly baseUrl: string;
+    /** The API's own settings, which a request inherits where it sets nothing. */
+    readonly apiSettings?: RestRequestSettings;
+    readonly preferences?: Preferences;
+    readonly projectSettings?: Pick<ProjectSettings, 'defaultTimeoutMs'>;
+    /** Resolved credentials; the host turns `secretRef`s into values and tokens into `oauth2`. */
+    readonly auth?: SendAuth;
+    /** Cookies already matched against the URL, when the request asks for them. */
+    readonly cookies?: readonly Cookie[];
+    /** How a multipart file part or a binary body is read. */
+    readonly resolveFile?: FileResolver;
+    readonly tls?: TlsOptions;
+    readonly proxy?: ProxyOptions;
+    readonly signal?: AbortSignal;
+}
+/**
+ * Builds the send input for one REST request.
+ *
+ * Precedence is request → API → project → preference, the same ladder a SOAP request's properties
+ * climb, and for the same reason: a setting the request leaves unset means *inherit*, never *off*.
+ * The headers the host adds on the request's behalf — `User-Agent`, `Accept-Encoding`, `Connection`,
+ * a default `Accept` — are passed separately from the request's own, so `rest/send.ts` can let the
+ * user's typed header win without having to guess which came from where.
+ */
+export declare function toRestSendInput(args: ToRestSendInputArgs): RestSendInput;
+/** The parts of a gRPC request {@link toGrpcSendInput} reads. */
+export interface GrpcSendRequestInput {
+    readonly service: string;
+    readonly method: string;
+    readonly methodKind: GrpcMethodKind;
+    readonly metadata: readonly KeyValueEntry[];
+    readonly settings: GrpcRequestSettings;
+}
+/** Everything {@link toGrpcSendInput} needs beyond the request itself. */
+export interface ToGrpcSendInputArgs {
+    readonly request: GrpcSendRequestInput;
+    /** The API's effective target, environment override applied and properties expanded. */
+    readonly target: string;
+    readonly tls: boolean;
+    /** The API's own metadata rows, which a request row of the same key overrides. */
+    readonly apiMetadata?: readonly KeyValueEntry[];
+    /** The API's own settings, which a request inherits where it sets nothing. */
+    readonly apiSettings?: GrpcRequestSettings;
+    readonly preferences?: Preferences;
+    readonly projectSettings?: Pick<ProjectSettings, 'defaultTimeoutMs'>;
+    /** Resolved credentials; the host turns `secretRef`s into values and tokens into `oauth2`. */
+    readonly auth?: SendAuth;
+    readonly tlsOptions?: TlsOptions;
+    readonly signal?: AbortSignal;
+}
+/**
+ * Builds the transport input for one gRPC call, everything but the encoded messages.
+ *
+ * The same request → API → project → preference ladder as a REST request, and the same TLS rule:
+ * the floor comes from preferences, and the host merges trust anchors, the client identity and the
+ * per-request trust decision on top. Metadata rows are the API's first and then the request's, so
+ * a repeated key resolves to the request's value on the wire.
+ */
+export declare function toGrpcSendInput(args: ToGrpcSendInputArgs): Omit<GrpcSendInput, 'messages'>;

package/dist/send-options.js

@@ -0,0 +1,228 @@
+/**
+ * Turns a saved request plus the settings around it into the {@link SoapSendInput} the
+ * transport actually receives.
+ *
+ * This is the single place the three layers of configuration meet, and the precedence between
+ * them is fixed here rather than in the desktop app: the request's own property wins, then the
+ * project's setting, then the user's preference (which is also the engine default). A property
+ * left unset in the request is therefore never "off" — it is "inherit".
+ */
+import { DEFAULT_PREFERENCES } from './project/preferences.js';
+import { soapActionHeaders } from './soap/soap-action.js';
+import { prettyPrint, removeEmptyContent, stripWhitespaces } from './soap/transforms.js';
+/** Case-insensitive lookup over a header map. */
+function hasHeader(headers, name) {
+    const lower = name.toLowerCase();
+    return Object.keys(headers).some((key) => key.toLowerCase() === lower);
+}
+/** Whether `encoding` is (a spelling of) the transport's own default, so nothing needs reflecting. */
+function isDefaultEncoding(encoding) {
+    const normalized = encoding.trim().toLowerCase();
+    return normalized.length === 0 || normalized === 'utf-8' || normalized === 'utf8';
+}
+/**
+ * Applies the envelope transforms a request asks for, in a fixed order: content removal
+ * first (so whitespace and formatting decisions see the final element set), then whitespace
+ * stripping, then pretty printing. Entitizing is not here — it happens during property
+ * expansion; see `soap/transforms.ts`.
+ */
+function transformEnvelope(xml, properties, indentWidth) {
+    let out = xml;
+    if (properties.removeEmptyContent) {
+        out = removeEmptyContent(out);
+    }
+    if (properties.stripWhitespaces) {
+        out = stripWhitespaces(out);
+    }
+    if (properties.prettyPrint) {
+        out = prettyPrint(out, indentWidth);
+    }
+    return out;
+}
+/**
+ * Builds the send input for one request.
+ *
+ * Timeout precedence is request > project > preference. The TLS floor (`ssl.minVersion`) and
+ * the HTTP/2 offer come from preferences alone. Headers are the request's own, plus a
+ * `User-Agent` from preferences when the request does not set one, plus `Accept-Encoding` when
+ * response compression is enabled and `Connection: close` when connection reuse is disabled.
+ * Request-body gzip is requested via `compressBody`; the transport does the compressing so the
+ * `Content-Length` it computes describes the bytes that are actually sent.
+ *
+ * The MTOM/attachment properties are mapped only when `attachmentResolvers` says how bytes
+ * can be read; without a resolver there is nothing the transport could do with them, and a
+ * half-configured send would silently drop parts.
+ *
+ * @param args the request, its resolved endpoint, and the preferences/project settings around it
+ */
+export function toSendInput(args) {
+    const preferences = args.preferences ?? DEFAULT_PREFERENCES;
+    const { properties } = args.request;
+    const headers = {};
+    for (const header of args.request.headers) {
+        headers[header.name] = header.value;
+    }
+    if (!hasHeader(headers, 'user-agent') && preferences.http.userAgent.length > 0) {
+        headers['User-Agent'] = preferences.http.userAgent;
+    }
+    if (preferences.http.responseCompression && !hasHeader(headers, 'accept-encoding')) {
+        headers['Accept-Encoding'] = 'gzip, deflate';
+    }
+    if (preferences.http.closeConnections && !hasHeader(headers, 'connection')) {
+        headers['Connection'] = 'close';
+    }
+    // A non-default `encoding` property changes what bytes actually go on the wire (see
+    // `encodeBody` in `send.ts`), so the `Content-Type` charset must say the same thing — a
+    // request sent as ISO-8859-1 but declared UTF-8 would decode wrong at the far end. This is
+    // skipped for the default encoding so a request with no opinion keeps getting the transport's
+    // own `UTF-8` charset, computed downstream exactly as it always has been.
+    if (!isDefaultEncoding(properties.encoding) && !hasHeader(headers, 'content-type')) {
+        headers['Content-Type'] = soapActionHeaders(args.request.soapVersion, args.request.soapAction, {
+            ...(properties.skipSoapAction !== undefined ? { skipSoapAction: properties.skipSoapAction } : {}),
+            charset: properties.encoding,
+        }).contentType;
+    }
+    const timeoutMs = properties.timeoutMs ?? args.projectSettings?.defaultTimeoutMs ?? preferences.http.socketTimeoutMs;
+    const resolvers = args.attachmentResolvers;
+    const attachmentOptions = resolvers === undefined
+        ? undefined
+        : {
+            enableMtom: properties.enableMtom,
+            forceMtom: properties.forceMtom,
+            disableMultiparts: properties.disableMultiparts,
+            encodeAttachments: properties.encodeAttachments,
+            enableInlineFiles: properties.enableInlineFiles,
+            inlineResponseAttachments: properties.inlineResponseAttachments,
+            expandMtomAttachments: properties.expandMtomAttachments,
+            resolver: resolvers.resolver,
+            ...(resolvers.resolveFile !== undefined ? { resolveFile: resolvers.resolveFile } : {}),
+            ...(resolvers.resourceRoot !== undefined ? { resourceRoot: resolvers.resourceRoot } : {}),
+        };
+    return {
+        endpoint: args.endpoint,
+        envelopeXml: transformEnvelope(args.request.envelopeXml, properties, preferences.editor.tabSize),
+        soapVersion: args.request.soapVersion,
+        ...(args.request.soapAction !== undefined ? { soapAction: args.request.soapAction } : {}),
+        headers,
+        timeoutMs,
+        encoding: properties.encoding,
+        followRedirects: properties.followRedirects,
+        skipSoapAction: properties.skipSoapAction,
+        ...(properties.maxSizeBytes !== undefined ? { maxSizeBytes: properties.maxSizeBytes } : {}),
+        ...(properties.bindAddress !== undefined && properties.bindAddress.length > 0
+            ? { localAddress: properties.bindAddress }
+            : {}),
+        ...(preferences.http.requestCompression === 'gzip' ? { compressBody: 'gzip' } : {}),
+        ...(preferences.http.allowH2 ? { allowH2: true } : {}),
+        // The minimum protocol version is a floor the user sets once; everything else in `tls`
+        // (trust anchors, the client identity, a per-endpoint trust decision) is resolved in the
+        // desktop's main process, which reads files and secrets, and merged onto this.
+        tls: { minVersion: preferences.ssl.minVersion },
+        ...(properties.entitizeProperties ? { entitize: true } : {}),
+        ...(attachmentOptions !== undefined ? { attachments: args.attachments ?? [], attachmentOptions } : {}),
+    };
+}
+/** The first of `values` that is not `undefined`, which is what "inherit" means. */
+function inherited(...values) {
+    return values.find((value) => value !== undefined);
+}
+/**
+ * Builds the send input for one REST request.
+ *
+ * Precedence is request → API → project → preference, the same ladder a SOAP request's properties
+ * climb, and for the same reason: a setting the request leaves unset means *inherit*, never *off*.
+ * The headers the host adds on the request's behalf — `User-Agent`, `Accept-Encoding`, `Connection`,
+ * a default `Accept` — are passed separately from the request's own, so `rest/send.ts` can let the
+ * user's typed header win without having to guess which came from where.
+ */
+export function toRestSendInput(args) {
+    const preferences = args.preferences ?? DEFAULT_PREFERENCES;
+    const request = args.request;
+    const api = args.apiSettings ?? {};
+    const defaultHeaders = {};
+    if (preferences.http.userAgent.length > 0) {
+        defaultHeaders['User-Agent'] = preferences.http.userAgent;
+    }
+    if (preferences.http.responseCompression) {
+        defaultHeaders['Accept-Encoding'] = 'gzip, deflate, br';
+    }
+    if (preferences.http.closeConnections) {
+        defaultHeaders.Connection = 'close';
+    }
+    if (preferences.rest.defaultAccept.length > 0) {
+        defaultHeaders.Accept = preferences.rest.defaultAccept;
+    }
+    const timeoutMs = inherited(request.settings.timeoutMs, api.timeoutMs, args.projectSettings?.defaultTimeoutMs) ??
+        preferences.http.socketTimeoutMs;
+    const followRedirects = inherited(request.settings.followRedirects, api.followRedirects) ?? preferences.rest.followRedirects;
+    const maxRedirects = inherited(request.settings.maxRedirects, api.maxRedirects) ?? preferences.rest.maxRedirects;
+    const keepBodyOnRedirect = inherited(request.settings.keepBodyOnRedirect, api.keepBodyOnRedirect);
+    const encodeUrl = inherited(request.settings.encodeUrl, api.encodeUrl);
+    const maxSizeBytes = inherited(request.settings.maxSizeBytes, api.maxSizeBytes);
+    const bindAddress = inherited(request.settings.bindAddress, api.bindAddress);
+    return {
+        baseUrl: args.baseUrl,
+        request: {
+            method: request.method,
+            url: request.url,
+            pathParams: request.pathParams,
+            query: request.query,
+            headers: request.headers,
+            body: request.body,
+        },
+        settings: {
+            timeoutMs,
+            followRedirects,
+            maxRedirects,
+            ...(keepBodyOnRedirect !== undefined ? { keepBodyOnRedirect } : {}),
+            ...(encodeUrl !== undefined ? { encodeUrl } : {}),
+            ...(maxSizeBytes !== undefined ? { maxSizeBytes } : {}),
+            ...(bindAddress !== undefined && bindAddress.length > 0 ? { localAddress: bindAddress } : {}),
+            ...(preferences.http.allowH2 ? { allowH2: true } : {}),
+        },
+        defaultHeaders,
+        ...(args.auth !== undefined ? { auth: args.auth } : {}),
+        ...(args.cookies !== undefined ? { cookies: args.cookies } : {}),
+        // As for SOAP: the TLS floor is the user's one-off choice, and everything else in `tls` is
+        // resolved by the host, which reads files and secrets, and merged onto this.
+        tls: { minVersion: preferences.ssl.minVersion, ...args.tls },
+        ...(args.proxy !== undefined ? { proxy: args.proxy } : {}),
+        ...(args.resolveFile !== undefined ? { resolveFile: args.resolveFile } : {}),
+        ...(args.signal !== undefined ? { signal: args.signal } : {}),
+    };
+}
+/**
+ * Builds the transport input for one gRPC call, everything but the encoded messages.
+ *
+ * The same request → API → project → preference ladder as a REST request, and the same TLS rule:
+ * the floor comes from preferences, and the host merges trust anchors, the client identity and the
+ * per-request trust decision on top. Metadata rows are the API's first and then the request's, so
+ * a repeated key resolves to the request's value on the wire.
+ */
+export function toGrpcSendInput(args) {
+    const preferences = args.preferences ?? DEFAULT_PREFERENCES;
+    const request = args.request;
+    const api = args.apiSettings ?? {};
+    const defaultMetadata = {};
+    if (preferences.http.userAgent.length > 0) {
+        defaultMetadata['user-agent'] = preferences.http.userAgent;
+    }
+    const timeoutMs = inherited(request.settings.timeoutMs, api.timeoutMs, args.projectSettings?.defaultTimeoutMs) ??
+        preferences.http.socketTimeoutMs;
+    const maxSizeBytes = inherited(request.settings.maxSizeBytes, api.maxSizeBytes);
+    const bindAddress = inherited(request.settings.bindAddress, api.bindAddress);
+    return {
+        target: args.target,
+        tls: args.tls,
+        service: request.service,
+        method: request.method,
+        metadata: [...(args.apiMetadata ?? []), ...request.metadata],
+        defaultMetadata,
+        timeoutMs,
+        ...(maxSizeBytes !== undefined ? { maxSizeBytes } : {}),
+        ...(bindAddress !== undefined && bindAddress.length > 0 ? { localAddress: bindAddress } : {}),
+        ...(args.auth !== undefined ? { auth: args.auth } : {}),
+        tlsOptions: { minVersion: preferences.ssl.minVersion, ...args.tlsOptions },
+        ...(args.signal !== undefined ? { signal: args.signal } : {}),
+    };
+}

package/dist/send.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Sends an already-built SOAP envelope over HTTP and structurally parses the
+ * response: SOAP version, fault, or "not actually SOAP" detection.
+ */
+import type { Dispatcher } from 'undici';
+import type { PropertyScopes } from './project/properties.js';
+import type { SoapExchange, SoapSendInput } from './types.js';
+/**
+ * Sends `input.envelopeXml` to `input.endpoint` over HTTP, computing the
+ * `Content-Type`/`SOAPAction` headers for `input.soapVersion` and merging in
+ * any caller-supplied `input.headers`, which override the computed ones.
+ *
+ * HTTP-layer failures (timeout, abort, DNS, TLS, ...) propagate as
+ * {@link HttpError}; a non-2xx HTTP status is not an error and is returned
+ * as a normal exchange for the caller to inspect.
+ *
+ * When `input.attachmentOptions` is given, the envelope additionally goes through the
+ * attachment pipeline. Its stages are split across the send: inline `file:` references are
+ * substituted up front, with property expansion (they are envelope text, and WS-Security must
+ * sign what is actually sent), while MTOM and then SwA package the finished envelope after the
+ * WS-Addressing and WS-Security rewrites. A `multipart/related` response is unwrapped into its
+ * envelope plus `response.attachments`. See `soap/mime/send-pipeline.ts`.
+ *
+ * The full request order is: property expansion → inline files → WS-Addressing → WS-Security →
+ * MTOM → SwA → gzip.
+ *
+ * When `options.scopes` is given, `input.endpoint`, `input.envelopeXml`,
+ * `input.soapAction` and every header name/value are first passed through
+ * {@link expandSendInput}; any expressions that could not be resolved are
+ * left verbatim in the sent request and reported on the returned exchange's
+ * `unresolved` field, rather than failing the send.
+ *
+ * When `input.auth` is Basic, the `Authorization` header is either sent up front
+ * (`preemptive`) or added on a single retry after the server answers the first attempt
+ * with a 401 `Basic` challenge; both attempts share the one `timeoutMs` budget (if the first
+ * attempt already used it all, the challenge is reported as-is, `attempts: 1`, rather than
+ * firing a retry doomed to time out immediately) and the returned exchange is the final attempt
+ * actually made. A caller-supplied `Authorization` header always wins.
+ *
+ * When `input.auth` is NTLM, the send instead runs the three-leg NTLMv2 handshake over one
+ * dedicated connection (`http/auth/ntlm-transport.ts`): a bare bodyless leg, the Type 1
+ * message, then the Type 3 message carrying the real body. The returned exchange is the
+ * final leg, `durationMs` sums every leg, and a server that never challenges short-circuits
+ * after the first (`attempts: 1`).
+ *
+ * @param input the endpoint, envelope and transport options to send
+ * @param options an injected `dispatcher` (tests), `now` clock, and/or property `scopes`
+ */
+export declare function sendSoapRequest(input: SoapSendInput, options?: {
+    readonly dispatcher?: Dispatcher;
+    readonly now?: () => number;
+    readonly scopes?: PropertyScopes;
+}): Promise<SoapExchange>;