@wirebench/engine 2.1.1

package/dist/validate/wsi/report-html.js

@@ -0,0 +1,135 @@
+/**
+ * Renders a {@link WsiReport} as a self-contained HTML document.
+ *
+ * "Self-contained" is the whole point: the file a user exports has to open from a mail
+ * attachment, a ticket, or a shared drive years from now, so it carries its own inline CSS and
+ * nothing else — no script, no font, no stylesheet, no image, nothing that resolves over the
+ * network. Every value that reaches the markup goes through {@link escapeHtml} first: a finding
+ * quotes the offending element's name straight out of somebody else's message.
+ */
+/** Escapes the five characters that could otherwise close a tag or an attribute. */
+export function escapeHtml(value) {
+    return value
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+/** How each result is labelled in the report. */
+const RESULT_LABEL = {
+    passed: 'Passed',
+    failed: 'Failed',
+    warning: 'Warning',
+    notApplicable: 'Not applicable',
+};
+/** The stylesheet, inlined. Kept deliberately plain so the file prints and reads anywhere. */
+const STYLE = `
+  :root { color-scheme: light dark; }
+  body { margin: 0; padding: 2rem; font: 14px/1.5 system-ui, -apple-system, "Segoe UI", sans-serif; }
+  h1 { font-size: 1.25rem; margin: 0 0 0.25rem; }
+  .target { color: #555; margin: 0 0 1.5rem; word-break: break-all; }
+  .summary { display: flex; flex-wrap: wrap; gap: 0.5rem; list-style: none; margin: 0 0 1.5rem; padding: 0; }
+  .summary li { border: 1px solid #ccc; border-radius: 999px; padding: 0.15rem 0.75rem; }
+  .summary .count { font-weight: 600; }
+  table { border-collapse: collapse; width: 100%; }
+  th, td { border-bottom: 1px solid #ddd; padding: 0.4rem 0.6rem; text-align: left; vertical-align: top; }
+  th { border-bottom-width: 2px; white-space: nowrap; }
+  td.id, td.level, td.result { white-space: nowrap; }
+  .findings { margin: 0.25rem 0 0; padding-left: 1.1rem; }
+  .findings li { color: #444; }
+  .where { color: #777; }
+  .r-failed { color: #a11; font-weight: 600; }
+  .r-warning { color: #a60; font-weight: 600; }
+  .r-passed { color: #161; }
+  .r-notApplicable { color: #777; }
+  .empty { color: #555; font-style: italic; }
+  .footnote { color: #777; font-size: 0.85em; margin: 0.75rem 0 0; }
+  @media (prefers-color-scheme: dark) {
+    body { background: #16181c; color: #e6e6e6; }
+    .target, .findings li, .empty { color: #b9b9b9; }
+    th, td { border-color: #333; }
+    .summary li { border-color: #444; }
+    .footnote { color: #999; }
+    .r-failed { color: #ff8b8b; } .r-warning { color: #f0b429; } .r-passed { color: #7fd08a; }
+  }
+`;
+/** One finding rendered as a list item, with its location when it has one. */
+function findingHtml(assertion) {
+    if (assertion.findings.length === 0) {
+        return '';
+    }
+    const items = assertion.findings.map((finding) => {
+        const location = finding.location;
+        const where = location === undefined
+            ? ''
+            : ` <span class="where">(${escapeHtml(location.document)}${location.line === undefined ? '' : `:${String(location.line)}`}${location.xpath === undefined ? '' : ` ${escapeHtml(location.xpath)}`})</span>`;
+        return `<li>${escapeHtml(finding.message)}${where}</li>`;
+    });
+    return `<ul class="findings">${items.join('')}</ul>`;
+}
+/** One assertion rendered as a table row. */
+function rowHtml(assertion) {
+    const marker = assertion.unverifiedId === true ? '<sup>*</sup>' : '';
+    return [
+        '<tr>',
+        `<td class="id">${escapeHtml(assertion.id)}${marker}</td>`,
+        `<td class="level">${escapeHtml(assertion.level)}</td>`,
+        `<td class="result r-${assertion.result}">${RESULT_LABEL[assertion.result]}</td>`,
+        `<td>${escapeHtml(assertion.title)}${findingHtml(assertion)}</td>`,
+        `<td>${escapeHtml(assertion.section)}</td>`,
+        '</tr>',
+    ].join('');
+}
+/**
+ * Renders one WS-I report as a standalone HTML document.
+ *
+ * @param report the report to render, from `runWsdlAssertions` or `runMessageAssertions`
+ * @param options the heading, the (injected) timestamp, and whether to keep non-failing rows
+ * @returns a complete HTML document with no external references of any kind
+ */
+export function renderWsiReportHtml(report, options) {
+    const rows = options.verbose === true
+        ? report.assertions
+        : report.assertions.filter((assertion) => assertion.result === 'failed' || assertion.result === 'warning');
+    const summary = [
+        ['Passed', report.summary.passed],
+        ['Failed', report.summary.failed],
+        ['Warning', report.summary.warning],
+        ['Not applicable', report.summary.notApplicable],
+    ];
+    const hasUnverifiedId = rows.some((assertion) => assertion.unverifiedId === true);
+    const body = rows.length === 0
+        ? '<p class="empty">No assertions to show.</p>'
+        : [
+            '<table>',
+            '<thead><tr><th>Id</th><th>Level</th><th>Result</th><th>Assertion</th><th>Section</th></tr></thead>',
+            '<tbody>',
+            ...rows.map(rowHtml),
+            '</tbody>',
+            '</table>',
+            hasUnverifiedId
+                ? '<p class="footnote">* requirement number not verified against the published Basic Profile 1.1; quote the title.</p>'
+                : '',
+        ].join('\n');
+    return [
+        '<!doctype html>',
+        '<html lang="en">',
+        '<head>',
+        '<meta charset="utf-8">',
+        '<meta name="viewport" content="width=device-width, initial-scale=1">',
+        `<title>WS-I ${escapeHtml(report.profile)} report — ${escapeHtml(options.title)}</title>`,
+        `<style>${STYLE}</style>`,
+        '</head>',
+        '<body>',
+        `<h1>WS-I ${escapeHtml(report.profile)} report — ${escapeHtml(options.title)}</h1>`,
+        `<p class="target">${escapeHtml(report.target)} · generated ${escapeHtml(options.generatedAt)}</p>`,
+        '<ul class="summary">',
+        ...summary.map(([label, count]) => `<li>${label}: <span class="count">${String(count)}</span></li>`),
+        '</ul>',
+        body,
+        '</body>',
+        '</html>',
+        '',
+    ].join('\n');
+}

package/dist/validate/wsi/run-message.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Runs the WS-I Basic Profile 1.1 message assertion catalogue over one {@link SoapExchange}.
+ *
+ * Where `run-wsdl.ts` judges a *description*, this judges the bytes one send actually put on the
+ * wire — both halves of it. The report shape is the same {@link WsiReport}, so a single renderer
+ * (and a single HTML export) serves both.
+ */
+import type { SoapExchange } from '../../types.js';
+import type { WsdlDefinition } from '../../wsdl/model.js';
+import type { OperationRef } from '../../soap/request-builder.js';
+import type { WsiMessageBinding, WsiMessageContext, WsiMessageDirection, WsiReport } from './types.js';
+/** What {@link runMessageAssertions} needs besides the exchange itself. */
+export interface RunMessageAssertionsOptions {
+    /** What the binding says about this operation's messages. */
+    readonly binding: WsiMessageBinding;
+    /** Which half the caller asked about; both are still analysed. */
+    readonly direction: WsiMessageDirection;
+    /**
+     * The request envelope text. `SoapExchange` keeps the request only as raw wire bytes, so a
+     * caller that still holds the envelope it sent should pass it rather than making this module
+     * re-split the HTTP frame.
+     */
+    readonly requestEnvelopeXml?: string;
+    /** Run only these assertion ids (default: the whole catalogue). */
+    readonly ids?: readonly string[];
+    /** Include `passed`/`notApplicable` rows in `assertions` (the `wsi.verbose` preference). */
+    readonly verbose?: boolean;
+}
+/** Builds the context the message assertions run against. */
+export declare function wsiMessageContext(exchange: SoapExchange, options: RunMessageAssertionsOptions): WsiMessageContext;
+/**
+ * Evaluates the message assertion catalogue against one exchange.
+ *
+ * `summary` always counts every assertion that ran; `assertions` carries only the failing rows
+ * unless `verbose` is set. `target` names the endpoint the exchange went to, so a report can say
+ * what it is about without the caller re-deriving it.
+ *
+ * @param exchange the send to analyse, request and response alike
+ * @param options the binding facts, the half the caller asked about, and the usual id/verbose knobs
+ */
+export declare function runMessageAssertions(exchange: SoapExchange, options: RunMessageAssertionsOptions): WsiReport;
+/**
+ * Derives the {@link WsiMessageBinding} one operation implies, so a caller holding an
+ * `ImportResult` does not have to walk the model itself. Returns `undefined` when the binding is
+ * not a SOAP binding, or has no such operation.
+ *
+ * @param definition the merged description
+ * @param op the binding and operation the message belongs to
+ */
+export declare function messageBindingFor(definition: WsdlDefinition, op: OperationRef): WsiMessageBinding | undefined;

package/dist/validate/wsi/run-message.js

@@ -0,0 +1,190 @@
+/**
+ * Runs the WS-I Basic Profile 1.1 message assertion catalogue over one {@link SoapExchange}.
+ *
+ * Where `run-wsdl.ts` judges a *description*, this judges the bytes one send actually put on the
+ * wire — both halves of it. The report shape is the same {@link WsiReport}, so a single renderer
+ * (and a single HTML export) serves both.
+ */
+import { NS } from '../../xml/namespaces.js';
+import { parseXml } from '../../xml/parse.js';
+import { findBinding } from '../../wsdl/model.js';
+import { WSI_MESSAGE_ASSERTIONS } from './assertions/message/index.js';
+import { isNotApplicable } from './types.js';
+/** The two envelope namespaces a message may legally use, mapped to their SOAP version. */
+const ENVELOPE_VERSIONS = [
+    [NS.SOAP11_ENV, '1.1'],
+    [NS.SOAP12_ENV, '1.2'],
+];
+/** Parses one half's envelope, tolerating text that is not XML at all. */
+function parsed(text) {
+    if (text === undefined || text.trim().length === 0) {
+        return undefined;
+    }
+    try {
+        return parseXml(text);
+    }
+    catch {
+        // Not well-formed: R1001 reports it, and every DOM-based assertion reports notApplicable.
+        return undefined;
+    }
+}
+/** The document element when it is a `soap:Envelope` in either SOAP envelope namespace. */
+function envelopeOf(document) {
+    const root = document?.documentElement ?? null;
+    if (root === null || root.localName !== 'Envelope') {
+        return undefined;
+    }
+    const match = ENVELOPE_VERSIONS.find(([uri]) => uri === root.namespaceURI);
+    return match === undefined ? undefined : { element: root, soapNs: match[0] };
+}
+/**
+ * The only headers a message assertion may quote. Anything else — most importantly
+ * `Authorization`, but equally any custom or WSS credential header a description never declares
+ * — never reaches a {@link WsiMessageView}, so it cannot end up in a finding message or an
+ * exported HTML report.
+ */
+const HEADER_ALLOWLIST = new Set([
+    'content-type',
+    'soapaction',
+    'content-length',
+    'transfer-encoding',
+    'content-encoding',
+    'accept',
+    'host',
+    'connection',
+]);
+/** Lower-cases every header name and drops everything outside {@link HEADER_ALLOWLIST}. */
+function lowerCased(headers) {
+    const out = {};
+    for (const [name, value] of Object.entries(headers)) {
+        const lower = name.toLowerCase();
+        if (HEADER_ALLOWLIST.has(lower)) {
+            out[lower] = value;
+        }
+    }
+    return out;
+}
+/** Builds one half's view: HTTP metadata plus the parsed envelope, when there is one. */
+function viewFor(direction, headers, envelopeXml, status) {
+    const document = parsed(envelopeXml);
+    const envelope = envelopeOf(document);
+    return {
+        direction,
+        headers: lowerCased(headers),
+        ...(envelopeXml !== undefined ? { envelopeXml } : {}),
+        ...(document !== undefined ? { document } : {}),
+        ...(envelope !== undefined ? { envelope: envelope.element, soapNs: envelope.soapNs } : {}),
+        ...(status !== undefined ? { status } : {}),
+    };
+}
+/** The text after the first blank line of a reconstructed HTTP frame — its entity body. */
+function bodyOfFrame(raw) {
+    if (raw === undefined || raw.length === 0) {
+        return undefined;
+    }
+    const text = new TextDecoder('utf-8', { fatal: false }).decode(raw);
+    const separator = /\r?\n\r?\n/.exec(text);
+    if (separator === null || separator.index === undefined) {
+        return undefined;
+    }
+    const body = text.slice(separator.index + separator[0].length);
+    return body.length === 0 ? undefined : body;
+}
+/** Builds the context the message assertions run against. */
+export function wsiMessageContext(exchange, options) {
+    const request = viewFor('request', exchange.http.request.headers, options.requestEnvelopeXml ?? bodyOfFrame(exchange.http.rawRequest));
+    const response = exchange.response === undefined && exchange.http.rawResponse.length === 0
+        ? undefined
+        : viewFor('response', exchange.http.headers, exchange.response?.envelopeXml, exchange.http.status);
+    return {
+        exchange,
+        binding: options.binding,
+        direction: options.direction,
+        request,
+        ...(response !== undefined ? { response } : {}),
+        messages: response === undefined ? [request] : [request, response],
+    };
+}
+/** Classifies one assertion's outcome; the mapping matches `run-wsdl.ts` exactly. */
+function resultFor(assertion, context) {
+    const outcome = assertion.check(context);
+    const findings = isNotApplicable(outcome) ? [] : outcome;
+    let result;
+    if (isNotApplicable(outcome)) {
+        result = 'notApplicable';
+    }
+    else if (findings.length === 0) {
+        result = 'passed';
+    }
+    else {
+        result = assertion.level === 'REQUIRED' ? 'failed' : 'warning';
+    }
+    return {
+        id: assertion.id,
+        title: assertion.title,
+        level: assertion.level,
+        section: assertion.section,
+        result,
+        findings,
+        ...(assertion.unverifiedId === true ? { unverifiedId: true } : {}),
+    };
+}
+/**
+ * Evaluates the message assertion catalogue against one exchange.
+ *
+ * `summary` always counts every assertion that ran; `assertions` carries only the failing rows
+ * unless `verbose` is set. `target` names the endpoint the exchange went to, so a report can say
+ * what it is about without the caller re-deriving it.
+ *
+ * @param exchange the send to analyse, request and response alike
+ * @param options the binding facts, the half the caller asked about, and the usual id/verbose knobs
+ */
+export function runMessageAssertions(exchange, options) {
+    const context = wsiMessageContext(exchange, options);
+    const selected = options.ids === undefined
+        ? WSI_MESSAGE_ASSERTIONS
+        : WSI_MESSAGE_ASSERTIONS.filter((assertion) => options.ids?.includes(assertion.id) === true);
+    const reports = selected.map((assertion) => resultFor(assertion, context));
+    const summary = {
+        passed: reports.filter((report) => report.result === 'passed').length,
+        failed: reports.filter((report) => report.result === 'failed').length,
+        warning: reports.filter((report) => report.result === 'warning').length,
+        notApplicable: reports.filter((report) => report.result === 'notApplicable').length,
+    };
+    return {
+        target: exchange.http.request.url,
+        profile: 'BP1.1',
+        summary,
+        assertions: options.verbose === true
+            ? reports
+            : reports.filter((report) => report.result === 'failed' || report.result === 'warning'),
+    };
+}
+/**
+ * Derives the {@link WsiMessageBinding} one operation implies, so a caller holding an
+ * `ImportResult` does not have to walk the model itself. Returns `undefined` when the binding is
+ * not a SOAP binding, or has no such operation.
+ *
+ * @param definition the merged description
+ * @param op the binding and operation the message belongs to
+ */
+export function messageBindingFor(definition, op) {
+    const binding = findBinding(definition, op.bindingName);
+    if (binding === undefined || binding.soapVersion === 'none') {
+        return undefined;
+    }
+    const operation = binding.operations.find((candidate) => candidate.name === op.operationName);
+    if (operation === undefined) {
+        return undefined;
+    }
+    // The input side states the `use` for the request; a binding that differed between the two
+    // halves would be out of profile anyway (R2706), so the output is only the fallback.
+    const use = operation.input?.body.use ?? operation.output?.body.use ?? 'literal';
+    return {
+        soapVersion: binding.soapVersion,
+        style: operation.style ?? binding.style,
+        use,
+        operation: op.operationName,
+        ...(operation.soapAction !== undefined ? { soapAction: operation.soapAction } : {}),
+    };
+}

package/dist/validate/wsi/run-wsdl.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Runs the WS-I Basic Profile 1.1 WSDL assertion catalogue over one description.
+ */
+import type { WsdlDefinition } from '../../wsdl/model.js';
+import type { DefinitionBundle } from '../../wsdl/resolver.js';
+import type { SchemaSet } from '../../xsd/schema-set.js';
+import type { ValidationProblem } from '../types.js';
+import type { WsiReport, WsiWsdlContext } from './types.js';
+/** What {@link wsiWsdlContext} needs: exactly the interesting half of an `ImportResult`. */
+export interface WsiWsdlContextInput {
+    readonly definition: WsdlDefinition;
+    readonly bundle: DefinitionBundle;
+    readonly schemaSet: SchemaSet;
+}
+/**
+ * Builds the context the assertions run against, indexing the bundle's documents by location.
+ *
+ * @param input the parsed definition, its bundle and its schema set (an `ImportResult` fits)
+ */
+export declare function wsiWsdlContext(input: WsiWsdlContextInput): WsiWsdlContext;
+/** Options accepted by {@link runWsdlAssertions}. */
+export interface RunWsdlAssertionsOptions {
+    /** Run only these assertion ids (default: the whole catalogue). */
+    readonly ids?: readonly string[];
+    /** Include `passed`/`notApplicable` rows in `assertions` (the `wsi.verbose` preference). */
+    readonly verbose?: boolean;
+}
+/**
+ * Evaluates the WSDL assertion catalogue against one description.
+ *
+ * Every assertion reports one of four results; `summary` always counts all of them, while
+ * `assertions` carries only the failing rows unless `verbose` is set.
+ *
+ * @param context the description to analyse, from {@link wsiWsdlContext}
+ * @param options an id subset to run, and whether to keep non-failing rows
+ */
+export declare function runWsdlAssertions(context: WsiWsdlContext, options?: RunWsdlAssertionsOptions): WsiReport;
+/**
+ * Flattens a report's findings into the shared {@link ValidationProblem} shape, so a WS-I report
+ * can be shown in the same Problems panel as the message validators' output.
+ *
+ * Positions are document positions, not envelope positions: `path` carries the document location
+ * alongside the element path, as `<document>#<xpath>`, so a consumer can tell the two apart. A
+ * finding that has an xpath but no document (or neither) contributes no `path`.
+ *
+ * @param report the report to flatten
+ */
+export declare function wsiProblems(report: WsiReport): readonly ValidationProblem[];

package/dist/validate/wsi/run-wsdl.js

@@ -0,0 +1,99 @@
+/**
+ * Runs the WS-I Basic Profile 1.1 WSDL assertion catalogue over one description.
+ */
+import { WSI_WSDL_ASSERTIONS } from './assertions/index.js';
+import { isNotApplicable } from './types.js';
+/**
+ * Builds the context the assertions run against, indexing the bundle's documents by location.
+ *
+ * @param input the parsed definition, its bundle and its schema set (an `ImportResult` fits)
+ */
+export function wsiWsdlContext(input) {
+    const documents = new Map();
+    for (const doc of input.bundle.documents) {
+        documents.set(doc.location, doc.document);
+    }
+    return { definition: input.definition, bundle: input.bundle, schemaSet: input.schemaSet, documents };
+}
+/** Classifies one assertion's outcome. */
+function resultFor(assertion, context) {
+    const outcome = assertion.check(context);
+    const findings = isNotApplicable(outcome) ? [] : outcome;
+    let result;
+    if (isNotApplicable(outcome)) {
+        result = 'notApplicable';
+    }
+    else if (findings.length === 0) {
+        result = 'passed';
+    }
+    else {
+        result = assertion.level === 'REQUIRED' ? 'failed' : 'warning';
+    }
+    return {
+        id: assertion.id,
+        title: assertion.title,
+        level: assertion.level,
+        section: assertion.section,
+        result,
+        findings,
+        ...(assertion.unverifiedId === true ? { unverifiedId: true } : {}),
+    };
+}
+/**
+ * Evaluates the WSDL assertion catalogue against one description.
+ *
+ * Every assertion reports one of four results; `summary` always counts all of them, while
+ * `assertions` carries only the failing rows unless `verbose` is set.
+ *
+ * @param context the description to analyse, from {@link wsiWsdlContext}
+ * @param options an id subset to run, and whether to keep non-failing rows
+ */
+export function runWsdlAssertions(context, options = {}) {
+    const selected = options.ids === undefined
+        ? WSI_WSDL_ASSERTIONS
+        : WSI_WSDL_ASSERTIONS.filter((assertion) => options.ids?.includes(assertion.id) === true);
+    const reports = selected.map((assertion) => resultFor(assertion, context));
+    const summary = {
+        passed: reports.filter((report) => report.result === 'passed').length,
+        failed: reports.filter((report) => report.result === 'failed').length,
+        warning: reports.filter((report) => report.result === 'warning').length,
+        notApplicable: reports.filter((report) => report.result === 'notApplicable').length,
+    };
+    return {
+        target: context.bundle.root.location,
+        profile: 'BP1.1',
+        summary,
+        assertions: options.verbose === true
+            ? reports
+            : reports.filter((report) => report.result === 'failed' || report.result === 'warning'),
+    };
+}
+/**
+ * Flattens a report's findings into the shared {@link ValidationProblem} shape, so a WS-I report
+ * can be shown in the same Problems panel as the message validators' output.
+ *
+ * Positions are document positions, not envelope positions: `path` carries the document location
+ * alongside the element path, as `<document>#<xpath>`, so a consumer can tell the two apart. A
+ * finding that has an xpath but no document (or neither) contributes no `path`.
+ *
+ * @param report the report to flatten
+ */
+export function wsiProblems(report) {
+    const problems = [];
+    for (const assertion of report.assertions) {
+        for (const finding of assertion.findings) {
+            problems.push({
+                severity: assertion.result === 'warning' ? 'warning' : 'error',
+                code: assertion.id,
+                message: `${assertion.id}: ${finding.message}`,
+                source: 'ws-i',
+                ...(finding.location?.line !== undefined ? { line: finding.location.line } : {}),
+                ...(finding.location?.column !== undefined ? { column: finding.location.column } : {}),
+                ...(finding.location?.xpath !== undefined
+                    ? { path: `${finding.location.document}#${finding.location.xpath}` }
+                    : {}),
+            });
+        }
+    }
+    return problems;
+}