@wirebench/engine 2.2.1 → 3.1.0-rc.1

package/dist/index.js

@@ -1,22 +1,57 @@
 export { evaluateAssertions } from './assert/index.js';
-export { assertionsSchema } from './assert/schema.js';
+export { checkRequestAssertions } from './assert/check.js';
+export { CALLBACK_LIMITS, callbackLabel } from './assert/model.js';
+export { assertionsSchema, callbackAssertionSchema, stepAssertionsSchema, toCallbackAssertion, } from './assert/schema.js';
+export { FIRST_CAPTURE_CURSOR, captureDetailView, captureSourceOver, captureSummaryView, unavailableCaptureSource, } from './assert/capture-source.js';
+export { NO_CAPTURE_SOURCE_MESSAGE, awaitCallbacks, expandCallback, isCallbackAssertion, prepareCallbacks, realCallbackClock, seconds, sendAwaitingCallbacks, waitingOf, } from './assert/callback.js';
 export * from './run/index.js';
-export { WirebenchError, WsdlParseError, SchemaError, HttpError, WsaError, WssError, ProjectError, ValidationError, WorkspaceError, OpenApiError, PostmanError, LegacyProjectError, ProtoError, GrpcError, WsError, isWirebenchError, } from './errors.js';
+// Protocol modules, the registry and features (ADR-0017). Exported for the engine's own hosts and
+// tagged `@internal` where they are declared: they are not yet a plugin API.
+export { createFeatureSet } from './protocol/features.js';
+export { defineProtocol } from './protocol/module.js';
+export { createProtocolRegistry } from './protocol/registry.js';
+export { BUILTIN_PROTOCOLS, createBuiltinRegistry } from './protocols.js';
+export { extraContainersOf, unsupportedOf } from './project/model.js';
+// What three core files re-exported until 3.0, from the module that declares it.
+export { soapResponseSubject } from './soap/run.js';
+// The SOAP run facet's item and its effective credentials, for a host that sends one SOAP item itself.
+export { soapEffectiveAuth, soapItemFor } from './soap/run.js';
+export { restSubject } from './rest/run.js';
+// The REST run facet and its effective credentials, for a host that sends one REST item itself.
+export { restEffectiveAuth, restItemFor, restRun } from './rest/run.js';
+export { grpcSubject } from './grpc/run.js';
+// The gRPC run facet's item and its effective credentials, for a host that sends one gRPC item itself.
+export { grpcEffectiveAuth, grpcItemFor } from './grpc/run.js';
+// The WebSocket run facet's item and its effective credentials, for a host that opens one itself.
+export { wsEffectiveAuth, wsItemFor, wsSubject } from './ws/run.js';
+// One WebSocket session as History records it, for every host that writes History.
+export { buildWsHistoryEntry, redactWsExchange } from './ws/history-entry.js';
+export { applySoapSnapshot, soapRequestSnapshot, soapResponseSnapshot } from './soap/scripting.js';
+export { projectSoapBody, qnameFromClark, replaceSoapBody, soapOperationElements, soapScriptTypes, } from './soap/script-types.js';
+export { applyRestSnapshot, restRequestSnapshot, restResponseSnapshot } from './rest/scripting.js';
+export { restOperationFor, restScriptTypes } from './rest/script-types.js';
+export { applyGrpcSnapshot, grpcRequestSnapshot, grpcResponseSnapshot } from './grpc/scripting.js';
+export { grpcMessageTypes, grpcScriptTypes } from './grpc/script-types.js';
+export { interfaceFileSchema, requestFileSchema } from './soap/files.js';
+export { apiFileSchema, restBodySchema, restRequestFileSchema } from './rest/files.js';
+export { grpcApiFileSchema, grpcMethodKindSchema, grpcRequestFileSchema } from './grpc/files.js';
+export { WirebenchError, WsdlParseError, SchemaError, HttpError, WsaError, WssError, ProjectError, ValidationError, SequenceError, WorkspaceError, OpenApiError, AsyncApiError, PostmanError, LegacyProjectError, ProtoError, GrpcError, WsError, isWirebenchError, } from './errors.js';
 export { parseXml, parseXmlDetailed, getPosition, classifyParseEvent } from './xml/parse.js';
 export { serializeXml } from './xml/serialize.js';
 export { NS, PREFIX } from './xml/namespaces.js';
 export { LineIndex } from './xml/positions.js';
 export { evaluate, evaluateJson } from './xpath/evaluate.js';
 export { evaluateJsonPath } from './xpath/jsonpath.js';
-export { evaluateWithTimeout } from './xpath/evaluate-async.js';
+export { evaluateWithTimeout, matchRegexWithTimeout } from './xpath/evaluate-async.js';
 export { collectNamespaces, suggestPrefixes } from './xpath/namespaces.js';
 export { parseQName, qnameEquals, qnameToString } from './wsdl/qname.js';
 export { findBinding, findMessage, findPortType, findService } from './wsdl/model.js';
 export { parseWsdl, parseWsdlDocument } from './wsdl/parse-wsdl.js';
 export { parseWsdlBundle } from './wsdl/merge.js';
 export { resolveDefinition } from './wsdl/resolver.js';
-export { createDefaultFetchDocument } from './wsdl/fetch.js';
-export { assignFileNames } from './wsdl/cache-naming.js';
+export { createDefaultFetchDocument } from './http/fetch-document.js';
+export { createHttpFetchDocument } from './http/document-fetch.js';
+export { assignFileNames } from './project/cache-naming.js';
 export { createCachedFetchDocument, readDefinitionCache, writeDefinitionCache } from './wsdl/cache.js';
 export { exportDefinition } from './wsdl/export-definition.js';
 export { generateDocs } from './wsdl/docs-generator.js';
@@ -29,15 +64,18 @@ export { PLACEHOLDER, facetsOf, sampleValueFor, typeCommentFor } from './xsd/sam
 export { scanXml } from './xsd/xml-scan.js';
 export { applyForm, buildForm, buildFormForType } from './xsd/form-model.js';
 export { applyFormEdit } from './xsd/form-edits.js';
+export { createJsonSchemaWriter, jsonFromXml, jsonSchemaOf, lexical, MAX_FILL_ROUNDS, MAX_PROPERTY_DESCRIPTION, xmlFromJson, } from './xsd/json-bridge.js';
 export { createEnvelope, detectEnvelopeVersion, envelopeNamespace, SOAP_ENVELOPE_PREFIX } from './soap/envelope.js';
-export { prefixForNamespace, RESERVED_PREFIXES } from './soap/prefixes.js';
+export { prefixForNamespace, RESERVED_PREFIXES } from './xml/prefixes.js';
 export { NamespaceScope } from './soap/namespace-scope.js';
 export { soapActionHeaders } from './soap/soap-action.js';
 export { buildEmptyRequest, buildSampleRequest } from './soap/request-builder.js';
 export { buildRequestForm } from './soap/form-request.js';
+export { envelopeFromJson, faultDetailJson, jsonFromEnvelope, operationJsonSchema } from './soap/json-operation.js';
 export { isSoapFault, parseFault } from './soap/fault.js';
 export { recreateRequest } from './soap/recreate.js';
-export { fromCurl, soapToCurl, toCurl } from './http/curl.js';
+export { toCurl } from './http/curl.js';
+export { fromCurl, soapToCurl } from './soap/curl.js';
 export { parseSoapResponse } from './soap/response-parser.js';
 export { DEFAULT_ROOT_CONTENT_ID, buildMultipartRelated, mediaTypeOf, mimeParameter, parseMultipartRelated, stripContentId, } from './soap/mime/multipart.js';
 export { XOP_NS, expandMtomResponse, prepareMtomRequest, xopContentType } from './soap/mime/mtom.js';
@@ -53,51 +91,80 @@ export { FAILED_REQUEST_BODY_CAP_BYTES, failedRequestOf } from './http/failed-re
 export { buildRawRequest, buildRawResponse } from './http/raw-capture.js';
 export { isExcluded, parseSystemProxy, resolveProxyFor } from './http/proxy.js';
 export { captureSslInfo, splitPemBundle } from './http/tls.js';
-export { importDefinition } from './import.js';
-export { sendSoapRequest } from './send.js';
-export { generateEmptyRequest, generateRequest } from './generate.js';
-export { summarizeOperations } from './operations.js';
-export { DEFAULT_OAUTH2_AUTH, DEFAULT_PROJECT_SETTINGS, DEFAULT_REQUEST_PROPERTIES, FORMAT_VERSION, createInterface, createProject, createRequest, defaultContentId, generateId, } from './project/model.js';
+export { importWsdl } from './soap/import.js';
+export { sendSoapRequest } from './soap/send.js';
+export { generateEmptySoapRequest, generateSoapRequest } from './soap/generate.js';
+export { summarizeSoapOperations } from './soap/operations.js';
+export { DEFAULT_OAUTH2_AUTH, DEFAULT_PROJECT_SETTINGS, DEFAULT_REQUEST_PROPERTIES, FORMAT_VERSION, createInterface, createProject, createRequest, defaultContentId, generateId, takenContainerSlugs, } from './project/model.js';
 export { COMMON_METHODS, NO_BODY, RAW_LANGUAGE_CONTENT_TYPES, RAW_LANGUAGE_EXTENSIONS, apiFolders, apiRequests, createApi, createFolder, createRestRequest, entry, folderRequests, } from './rest/model.js';
+export { DEFAULT_WEBHOOK_TARGET, WEBHOOKS_COLLECTION_PREFIX, WEBHOOK_TARGET_PROPERTY, assertWebhookTarget, createWebhookCollection, createWebhookFolder, effectiveSigning, effectiveTarget, findWebhookRequest, hookKey, signingAlong, signingSecretMissing, signingSecretRef, signingSourceLabel, webhookFolders, webhookPath, webhookRequests, } from './webhooks/model.js';
+export { DEFAULT_SIGNATURE_TOLERANCE_SEC, SIGNATURE_FAILURES, isCanonicalBase64, signWebhook, signatureHeaderNames, signatureSchemeSchema, toSignatureScheme, verifyWebhook, } from './http/webhook-signature.js';
 export { bodyLanguage, encodeFormFields, encodeRestBody, escapeForLanguage, rawContentType } from './rest/body.js';
-export { applyAuth, missingSecretRef, resolveAuthChain, resolveAuthChainIndex } from './rest/auth.js';
-export { cookieHeader, cookiesToSend, defaultPath, domainMatches, isExpired, pathMatches } from './rest/cookies.js';
+export { applyAuth, missingSecretRef, resolveAuthChain, resolveAuthChainIndex } from './http/auth/apply-auth.js';
+export { applySoapAuth } from './soap/auth.js';
+export { cookieHeader, defaultPath, domainMatches, isExpired, pathMatches } from './rest/cookies.js';
+export { CookieJar, cookiesToSend, jarCookieHost, MAX_COOKIE_BYTES, MAX_COOKIES, MAX_COOKIES_PER_DOMAIN, mergeCookieHeader, } from './rest/cookie-jar.js';
 export { decodeResponseText, detectLanguage, parseSetCookie, prettyBody } from './rest/response.js';
-export { TOKEN_REFRESH_MARGIN_MS, authorizationUrl, buildTokenRequest, needsRefresh, newState, parseTokenResponse, pkce, } from './rest/oauth2.js';
+export { TOKEN_REFRESH_MARGIN_MS, authorizationUrl, buildTokenRequest, needsRefresh, newState, parseTokenResponse, pkce, } from './http/auth/oauth2.js';
 export { fromRestCurl, restToCurl, CURL_REDACTED } from './rest/curl.js';
 export { expandRestSendInput } from './rest/expand.js';
 export { decodeRestResponse, sendRest } from './rest/send.js';
+export { createSseParser, eventStreamDocument, isEventStream, serializeEventStream } from './rest/sse.js';
+export { capSseRows, createSseRowStore, SSE_HISTORY_LIMITS, SSE_SUMMARY_LIMITS } from './rest/sse-transcript.js';
 export { composeUrl, encodeValue, joinBase, joinQuery, parseUrlParams, splitQuery } from './rest/url.js';
 // OpenAPI: reading a description into the model an import maps onto an API.
+export { parseAsyncApi } from './asyncapi/parse.js';
+export { mapAsyncApi } from './asyncapi/map.js';
+export { authFromScheme as asyncApiAuthFromScheme } from './asyncapi/security.js';
+export { importAsyncApi } from './asyncapi/import.js';
+export { applyAsyncApiUpdate, planAsyncApiUpdate } from './asyncapi/update.js';
+export { channelMessages as asyncApiChannelMessages, checkFrame as checkAsyncApiFrame, createFrameChecker, DEFAULT_FRAME_CHECK_BUDGET_MS, MAX_CHECKED_FRAME_BYTES, } from './asyncapi/frame-check.js';
+export { createWorkerFrameChecker, DEFAULT_FRAME_CHECK_DEADLINE_MS, DEFAULT_FRAME_CHECK_QUEUE, DEFAULT_FRAME_CHECK_QUEUE_BYTES, } from './asyncapi/frame-check-worker-host.js';
 export { importOpenApi, parseOpenApi } from './rest/openapi/import.js';
-export { apiFromDocument, authFromScheme, mapScheme } from './rest/openapi/map.js';
+export { loadOpenApiDocument } from './rest/script-types.js';
+export { apiFromDocument, authFromScheme, mapScheme, webhookItemsOf, webhookSourcesOf, webhooksFromDocument, } from './rest/openapi/map.js';
 export { createCachedApiFetch, readApiDefinitionCache, writeApiDefinitionCache } from './rest/openapi/cache.js';
 export { parseDocumentText, parseOpenApiDocument, parseSchema, versionOf } from './rest/openapi/parse.js';
-export { resolvePointer, resolveRefs, unescapePointerToken, MAX_REF_DEPTH } from './rest/openapi/refs.js';
-export { sampleFromSchema, sampleXml, MAX_SAMPLE_DEPTH } from './rest/openapi/sample.js';
+export { selectResponse } from './rest/openapi/responses.js';
+export { applyRestUpdate, applyWebhookUpdate, planRestUpdate, planWebhookUpdate, sameStructure, } from './rest/openapi/update.js';
+export { matchOperation } from './rest/openapi/match.js';
+export { evaluateRuntimeTemplate, parseRuntimeExpression, parseRuntimeTemplate, resolveJsonPointer, } from './rest/openapi/runtime-expression.js';
+export { checkRestResponse, DEFAULT_REST_CHECK_BUDGET_MS, MAX_CHECKED_BODY_BYTES, MAX_CONTRACT_MESSAGE_LENGTH, MAX_CONTRACT_PROBLEMS, } from './rest/contract-check.js';
+export { createRestContractChecker, DEFAULT_REST_CHECK_DEADLINE_MS, DEFAULT_REST_CHECK_QUEUE, } from './rest/contract-check-worker-host.js';
+export { pointerRange } from './json/pointer-range.js';
+export { resolvePointer, resolveRefs, unescapePointerToken, MAX_REF_DEPTH } from './json/schema/refs.js';
+export { sampleFromSchema, sampleXml, MAX_SAMPLE_DEPTH } from './json/schema/sample.js';
+export { validateJsonSchema } from './json/schema-validate.js';
+export { applyJsonFormEdit, buildJsonForm, toWireSchema } from './rest/json-form.js';
 export { serverUrl, HTTP_METHODS } from './rest/openapi/model.js';
 // Postman: importing Postman Collection v2.0 and v2.1 exports into REST APIs.
 export { apiFromPostmanCollection, importPostmanCollection, isPostmanCollection, normalizePostmanPath, parsePostmanCollection, parsePostmanCollectionText, translatePostmanVariables, } from './rest/postman/index.js';
 // Legacy SOAP projects: reading the single-XML project files of older SOAP workbenches.
 export { definitionRootOf, fetchDocumentFromCache, formatLegacyImportReport, IMPORTED_SCRIPTS_DIR, looksLikeLegacyProject, mapLegacyProject, MAX_LEGACY_PROJECT_BYTES, parseLegacyProject, readLegacySoapProject, resolvedOperationsOf, } from './soap/legacy-project/index.js';
-export { API_FILE, APIS_DIR, ATTACHMENTS_DIR, ENVIRONMENTS_DIR, FOLDER_FILE, INTERFACES_DIR, MAX_FOLDER_DEPTH, OPERATIONS_DIR, REQUEST_SUFFIX, REQUESTS_DIR, WSS_DIR, apiDefinitionDir, apiDir, apiFile, definitionCacheDir, definitionDir, environmentFile, interfaceDir, interfaceFile, keystoresFile, manifestFile, operationDir, requestFiles, restBodyFileName, restFolderDir, restFolderFile, restRequestFile, slugify, uniqueSlug, wssFile, } from './project/paths.js';
-export { apiFileSchema, assertSupportedKind, attachmentSourceSchema, authConfigSchema, definitionCacheManifestSchema, environmentFileSchema, keyValueEntrySchema, interfaceFileSchema, keystoreEntrySchema, keystoresFileSchema, manifestSchema, parseFile, requestFileSchema, restBodySchema, apiDefinitionCacheManifestSchema, restFolderFileSchema, restRequestFileSchema, grpcApiFileSchema, grpcRequestFileSchema, grpcMethodKindSchema, protoDefinitionCacheManifestSchema, apiKindOf, wssIncomingFileSchema, wssEntrySchema, wssOutgoingFileSchema, } from './project/schema.js';
+export { API_FILE, APIS_DIR, ATTACHMENTS_DIR, ENVIRONMENTS_DIR, FOLDER_FILE, INTERFACES_DIR, MAX_FOLDER_DEPTH, OPERATIONS_DIR, REQUEST_SUFFIX, REQUESTS_DIR, WSS_DIR, apiDefinitionDir, apiDir, apiFile, definitionCacheDir, definitionDir, environmentFile, interfaceDir, interfaceFile, keystoresFile, manifestFile, operationDir, requestFiles, restBodyFileName, restFolderDir, restFolderFile, restRequestFile, slugify, uniqueSlug, WEBHOOKS_DIR, WEBHOOKS_FILE, wssFile, } from './project/paths.js';
+export { attachmentSourceSchema, authConfigSchema, definitionAuthSchema, definitionCacheManifestSchema, environmentFileSchema, keyValueEntrySchema, soapOwnerAuthSchema, keystoreEntrySchema, keystoresFileSchema, manifestSchema, parseFile, apiDefinitionCacheManifestSchema, restFolderFileSchema, protoDefinitionCacheManifestSchema, hookLinkSchema, webhookFolderFileSchema, webhooksFileSchema, wssIncomingFileSchema, wssEntrySchema, wssOutgoingFileSchema, } from './project/schema.js';
 export { DEFAULT_PREFERENCES, LOG_SIZE_MAX, LOG_SIZE_MIN, mergePreferences, preferencesSchema, resetPreferences, } from './project/preferences.js';
-export { toGrpcSendInput, toRestSendInput, toSendInput } from './send-options.js';
+export { toSoapSendInput } from './soap/send-input.js';
+export { toRestSendInput } from './rest/send-input.js';
+export { toGrpcSendInput } from './grpc/send-input.js';
 export { entitizeValue, prettyPrint, removeEmptyContent, stripWhitespaces } from './soap/transforms.js';
 export { jsonCompletionContextAt } from './json/cursor.js';
 export { formatXml } from './xml/pretty.js';
 export { migrate } from './project/migrate.js';
 export { KEYSTORES_PATH, MANIFEST_PATH, authDocument, projectFiles } from './project/serialize.js';
+export { requestFileLocation } from './project/request-location.js';
+export { BASELINE_MAX_BYTES, checkBaseline } from './run/baseline.js';
+export { readGoldenFile, writeGoldenFile } from './snapshot/golden-file.js';
 export { loadProject } from './project/load.js';
 export { saveProject } from './project/save.js';
 export { attachmentFile, attachmentsDir, attachmentsIndexFile, createFileAttachmentResolver, listAttachments, pruneAttachments, putAttachment, readAttachment, } from './project/attachments-cache.js';
 export { nodeFs, writeFileAtomic } from './project/fs.js';
-export { appendHistory, generateHistoryId, historyWsOf, normalizeHistoryEntry, openHistory, } from './project/history.js';
-export { enabledProperties, expand, expandSendInput, hasExpansions } from './project/properties.js';
-export { effectiveAuth } from './project/endpoints.js';
+export { appendHistory, generateHistoryId, historyContractOf, historySseOf, historyWsOf, normalizeHistoryEntry, openHistory, } from './project/history.js';
+export { enabledProperties, expand, hasExpansions, secretNamesIn } from './project/properties.js';
+export { expandSendInput } from './soap/expand.js';
+export { effectiveAuth, isEndpointAuth } from './project/endpoints.js';
 export { toKeystoreDef, toKeystoreRef } from './project/keystores.js';
-export { toWssIncomingConfig, toWssIncomingRef, toWssOutgoingConfig, toWssOutgoingRef } from './project/wss-configs.js';
+export { toWssIncomingConfig, toWssIncomingRef, toWssOutgoingConfig, toWssOutgoingRef } from './wss/configs.js';
 // ---------------------------------------------------------------------------
 // WS-Addressing (Task 41)
 // ---------------------------------------------------------------------------
@@ -114,17 +181,17 @@ export { decryptIncoming } from './wss/incoming/decrypt.js';
 export { verifyIncoming } from './wss/incoming/verify.js';
 export { decryptEnvelope, encryptEnvelope } from './wss/outgoing/encryption.js';
 export { buildKeyIdentifier, certificateBase64, certificateDer, issuerDnRfc2253, pkiPathBase64, serialNumberDecimal, subjectKeyIdentifierBase64, thumbprintSha1Base64, WSS_TOKEN_TYPES, } from './wss/key-identifiers.js';
-export { keystoreTypeForPath, loadKeystore, loadPem, loadPkcs12, selectAlias, toTlsClientIdentity, } from './wss/keystore/index.js';
+export { keystoreTypeForPath, loadKeystore, loadPem, loadPkcs12, selectAlias, toTlsClientIdentity, } from './keystore/index.js';
 export { findEnvironment, removeEnvironment, resolveApiBaseUrl, resolveAuthEndpoint, resolveEndpoint, resolveScopes, upsertEnvironment, } from './project/environments.js';
 // Workspace
-export { WORKSPACE_FORMAT_VERSION, assertPathSegment, WORKSPACES_DIR, WORKSPACE_ENVIRONMENTS_DIR, WORKSPACE_MANIFEST, WORKSPACE_PROJECTS_DIR, WORKSPACE_STATE_FILE, WORKSPACE_TREE_DIR, WORKSPACE_JOINING_DIR, GIT_ATTRIBUTES_FILE, GIT_ATTRIBUTES, WORKSPACE_LOCAL_FILE, EMPTY_LOCAL_STATE, WORKSPACE_SHARE_FILE, DEFAULT_GIT_SHARE_SETTINGS, commitMessage, createWorkspace, createWorkspaceEnvironment, deleteShare, describeTreePath, linkedEnvironment, loadLocalState, loadShare, loadWorkspace, migrateWorkspace, parseWorkspaceFile, reidentifyProject, resolveWorkspaceApiBaseUrl, resolveWorkspaceEndpoint, resolveWorkspaceScopes, saveLocalState, saveShare, saveWorkspace, workspaceDir, workspaceEnvironmentFile, workspaceEnvironmentFileSchema, workspaceFiles, workspaceLocalStateSchema, workspaceManifestFile, workspaceManifestSchema, workspaceProjectDir, workspaceProjectRefSchema, workspaceShareSchema, workspaceTreeDir, } from './workspace/index.js';
+export { WORKSPACE_FORMAT_VERSION, assertPathSegment, WORKSPACES_DIR, WORKSPACE_ENVIRONMENTS_DIR, WORKSPACE_MANIFEST, WORKSPACE_PROJECTS_DIR, WORKSPACE_STATE_FILE, WORKSPACE_TREE_DIR, WORKSPACE_JOINING_DIR, GIT_ATTRIBUTES_FILE, GIT_ATTRIBUTES, TEAM_SECRETS_DIR, WORKSPACE_LOCAL_FILE, EMPTY_LOCAL_STATE, WORKSPACE_SHARE_FILE, DEFAULT_GIT_SHARE_SETTINGS, DEFAULT_SYNC_SETTINGS, commitMessage, createWorkspace, createWorkspaceEnvironment, deleteShare, describeTreePath, linkedEnvironment, loadLocalState, loadShare, loadWorkspace, migrateWorkspace, parseWorkspaceFile, reidentifyProject, resolveWorkspaceApiBaseUrl, resolveWorkspaceEndpoint, resolveWorkspaceScopes, saveLocalState, saveShare, saveWorkspace, shareSyncSettings, workspaceDir, workspaceEnvironmentFile, workspaceEnvironmentFileSchema, workspaceFiles, workspaceLocalStateSchema, workspaceManifestFile, workspaceManifestSchema, workspaceProjectDir, workspaceProjectRefSchema, workspaceShareSchema, workspaceTreeDir, } from './workspace/index.js';
 export { bindingContextFor, checkSoapStructure, validateAgainstSchemaSet, validateMessage, DEFAULT_VALIDATION_TIMEOUT_MS, } from './validate/index.js';
 export { WSI_WSDL_ASSERTIONS, WSI_MESSAGE_ASSERTIONS, messageBindingFor, runMessageAssertions, wsiMessageContext, renderWsiReportHtml, escapeHtml, runWsdlAssertions, wsiWsdlContext, wsiProblems, NOT_APPLICABLE, isNotApplicable, } from './validate/wsi/index.js';
 export { renderWsiAssertionsMarkdown, WSI_PLANNED_ASSERTIONS } from './validate/wsi/index.js';
 export { detectImportFormat } from './import-detect.js';
 // gRPC: the third protocol, a sibling container to a SOAP interface and a REST API (ADR-0007).
 export { clientStreams, GRPC_REFLECTION_VERSIONS, createGrpcApi, createGrpcFolder, createGrpcRequest, defaultTlsFor, grpcApiFolders, grpcApiRequests, grpcFolderRequests, grpcMethodPath, serverStreams, } from './grpc/model.js';
-export { GRPC_STATUS_NAMES, decodeGrpcMessage, encodeGrpcMessage, formatGrpcTimeout, grpcStatusName, } from './grpc/status.js';
+export { GRPC_STATUS_NAMES, decodeGrpcMessage, encodeGrpcMessage, formatGrpcTimeout, grpcStatusName, grpcStatusNames, } from './grpc/status.js';
 export { encodeGrpcFrame, GrpcFrameParser } from './grpc/framing.js';
 export { loadProtoSet } from './grpc/proto/load.js';
 export { describeMessage, describeMessageAt, describeMethod, describeServices, lookupMessageType, lookupMethod, qualifiedName, } from './grpc/proto/describe.js';
@@ -141,17 +208,47 @@ export { DESCRIPTOR_HEADER_TYPE, DESCRIPTOR_SET_HEADER_TYPE, REFLECTION_METHOD,
 export { descriptorHeader, descriptorSetBytes, descriptorSetHeaders, encodeFileDescriptorSet, orderDescriptors, protoSetFromDescriptorSet, protoSetFromDescriptors, } from './grpc/reflection/descriptors.js';
 export { isReflectionService, reflectProtoSet, reflectServices } from './grpc/reflection/client.js';
 export { GRPC_COMMAND_REDACTED, grpcToCommand } from './grpc/command.js';
-export { resolveAuthConfig, resolveEndpointAuth, secretMissingMessage, toSendAuth } from './secrets/resolve.js';
-export { envVariablesFor, secretNeedsOfAuth, SECRET_ENV_PREFIX } from './secrets/env-names.js';
-export { REDACTED_MARKER, SECRET_BODY_KEYS, containsRedaction, redactHeaderPairs, redactHeaders, redactRawHttp, redactResponseAttachments, redactStructuredBody, redactUrl, redactXml, } from './redact/index.js';
-export { createSecretMasker } from './redact/literal.js';
+export { resolveAuthConfig, resolveEndpointAuth, resolveSecretTokens, resolveSoapAuth, secretMissingMessage, secretTokenMissingMessage, toSendAuth, } from './secrets/resolve.js';
+export { envVariablesFor, secretNeedsOfAuth, SECRET_ENV_PREFIX, SIGNING_PSEUDO_REF_PREFIX, } from './secrets/env-names.js';
+export { SECRET_NAME_PATTERN, secretEnvName, secretPseudoRef, secretToken, parseSecretPseudoRef, } from './secrets/secret-token.js';
+export { detectInText, SECRET_TEXT_SCAN_LIMIT } from './secrets/scan/rules.js';
+export { maskedPreview, scanProjectForSecrets } from './secrets/scan/scan.js';
+export { applySecretMoves, proposeSecretName } from './secrets/scan/apply.js';
+export { SECRET_REF_PATTERN, secretRefsInValue } from './secrets/secret-refs.js';
+// ---------------------------------------------------------------------------
+// Team secrets: machine keys, the access log and the vault (team-secrets spec §4, §5.2)
+// ---------------------------------------------------------------------------
+export { ACCESS_ACTIONS, accessEntryFileSchema, accessEntryPath, approvedRecipients, base32, base64url, buildVaultEntry, canonicalJson, decryptValue, encryptValue, encryptionPrivateKey, encryptionPublicKey, fingerprintOf, fromBase64url, generateMachineKeys, healVaultEntry, isTeamSecretsPath, isVaultEntryPath, KEY_ID_PATTERN, keyIdOf, keyIdSchema, keyRequestFileSchema, keyRequestPath, newDataKey, nextAccessEntryId, openVaultEntry, parseMachineKeys, parseTeamSecretsFile, readTeamSecretsFiles, replayAccessLog, rotateMarks, rotateMarksFor, sameSecret, sealVaultEntry, secretKeySchema, serializeMachineKeys, signDocument, signingPrivateKey, signingPublicKey, TEAM_SECRETS_ACCESS_DIR, TEAM_SECRETS_FORMAT_VERSION, TEAM_SECRETS_KEYS_DIR, TEAM_SECRETS_MESSAGES, TEAM_SECRETS_VALUES_DIR, teamSecretsError, teamSecretsFileText, ULID_PATTERN, unwrapDataKey, vaultConflictWinner, vaultEntryFileSchema, vaultEntryId, vaultEntryIdOfPath, vaultEntryPath, verifiedKeys, verifyDocument, verifyVaultEntry, withoutSignature, WRAP_INFO, wrapDataKey, wrapsUnapprovedKey, } from './team-secrets/index.js';
+export { REDACTED_MARKER, SECRET_BODY_KEYS, containsRedaction, isSensitiveHeaderName, isSensitiveQueryParam, redactHeaderPairs, redactHeaders, redactRawHttp, redactResponseAttachments, redactStructuredBody, redactUrl, redactXml, } from './redact/index.js';
+export { createSecretBytesMasker, createSecretMasker } from './redact/literal.js';
 // WebSocket: the fourth protocol, a sibling container to a SOAP interface, a REST API and a gRPC
 // API (ADR-0007).
 export { createWsApi, createWsFolder, createWsRequest, createWsSavedMessage, wsApiFolders, wsApiRequests, wsFolderRequests, wsMessageFileName, } from './ws/model.js';
 export { resolveWsUrl } from './ws/url.js';
 export { prettyFrameText } from './ws/pretty.js';
 export { openWsSession } from './ws/session.js';
+export { connectWebSocket } from './ws/connect.js';
 export { capFrames, WS_HISTORY_HEAD, WS_HISTORY_MAX_BYTES, WS_HISTORY_TAIL } from './ws/transcript.js';
 export { expandWsInput, expandWsMessage } from './ws/expand.js';
 export { toWsSessionOptions } from './ws/call.js';
 export { wsToCommand } from './ws/command.js';
+export { GIT_CALL_ENV, GIT_PLUMBING_SUBCOMMANDS, GIT_SUBCOMMANDS, GitCli, assertBranchName, assertRemoteUrl, assertSafeLocalConfig, findGit, parseGitVersion, refusedLocalConfigKeys, } from './sync/git-cli.js';
+export { mergeFiles } from './sync/three-way-merge.js';
+export { MACHINE_LOCAL_PATHS, MAX_TREE_PATH_LENGTH, TREE_ITEMS, assertTreePath, isSafeTreeSegment, isTreePath, } from './sync/tree-paths.js';
+// ---------------------------------------------------------------------------
+// Wirebench Server API: wire schemas shared by packages/server and the desktop client
+// ---------------------------------------------------------------------------
+export { SERVER_API_VERSION, SERVER_NAME, metaResponseSchema } from './server-api/meta.js';
+export { DEVICE_TOKEN_PATTERN, MAX_DEVICE_NAME_LENGTH, MAX_DISPLAY_NAME_LENGTH, MAX_PASSWORD_LENGTH, MIN_PASSWORD_LENGTH, PKCE_VERIFIER_PATTERN, SECRET_PATTERN, deviceSchema, devicesResponseSchema, deviceSummarySchema, emailSchema, identityIdParamsSchema, identityIdSchema, invitationAcceptRequestSchema, invitationCreatedSchema, invitationCreateRequestSchema, invitationLookupQuerySchema, invitationLookupResponseSchema, invitationsResponseSchema, invitationSummarySchema, localSignInRequestSchema, meResponseSchema, oidcCallbackQuerySchema, oidcCompleteRequestSchema, oidcStartRequestSchema, oidcStartResponseSchema, passwordChangeRequestSchema, passwordResetCreatedSchema, passwordSchema, serverUserSchema, signInMethodsSchema, signInResponseSchema, userPatchRequestSchema, usersResponseSchema, userSummarySchema, } from './server-api/identity.js';
+export { MAX_TEAMS_NAME_LENGTH, TEAMS_ID_PATTERN, accessEntrySchema, accessParamsSchema, accessResponseSchema, defaultRoleSchema, effectiveRoleSchema, memberAddRequestSchema, memberParamsSchema, memberRoleRequestSchema, roleSourceSchema, setAccessRequestSchema, teamInvitationCreatedSchema, teamInvitationCreateRequestSchema, teamInvitationParamsSchema, teamInvitationSchema, teamInvitationsResponseSchema, teamMemberSchema, teamMembersResponseSchema, teamNameRequestSchema, teamParamsSchema, teamRoleSchema, teamSchema, teamsIdSchema, teamsNameSchema, teamsResponseSchema, teamWorkspaceCreateRequestSchema, teamWorkspaceParamsSchema, teamWorkspaceSchema, teamWorkspacesResponseSchema, teamWorkspaceUpdateRequestSchema, workspaceRoleSchema, } from './server-api/teams.js';
+export { MAX_SYNC_FILE_BYTES, MAX_SYNC_LOG_LIMIT, MAX_SYNC_SUBJECT_LENGTH, SYNC_COMMIT_ID_PATTERN, syncChangeSchema, syncChangesQuerySchema, syncChangesResponseSchema, syncCommitIdSchema, syncEncodingSchema, syncFileSchema, syncHeadQuerySchema, syncHeadResponseSchema, syncLogEntrySchema, syncLogQuerySchema, syncLogResponseSchema, syncPushCommitSchema, syncPushRequestSchema, syncPushResponseSchema, syncSnapshotQuerySchema, syncSnapshotResponseSchema, TEAM_SECRETS_KEY_REQUEST_MAX_BYTES, teamSecretsKeyRequestSchema, teamSecretsKeyRequestResponseSchema, } from './server-api/sync.js';
+export { LIVE_CAPABILITY, LIVE_CLOSE, LIVE_LIMITS, LIVE_PATH, LIVE_REFUSED_CODES, liveClientMessageSchema, livePresenceUserSchema, liveServerMessageSchema, } from './server-api/live.js';
+export { CATCH_CONTENT_TYPE_PATTERN, CATCH_SECRET_PATTERN, CATCH_URL_DEFAULT_RESPONSE, CATCH_URL_PATH_PREFIX, captureParamsSchema, captureSchema, capturesQuerySchema, capturesResponseSchema, captureSignatureSchema, captureSummarySchema, catchUrlCreateRequestSchema, catchUrlParamsSchema, catchUrlResponseSchema, catchUrlSchema, catchUrlSignatureSchema, catchUrlsResponseSchema, catchUrlUpdateRequestSchema, HOOKS_LIMITS, hooksMetaSchema, SIGNATURE_SECRET_MAX_LENGTH, } from './server-api/hooks.js';
+export { CI_TOKEN_NAME_MAX_LENGTH, ciTokenCreatedSchema, ciTokenParamsSchema, ciTokenSummarySchema, ciTokensResponseSchema, ciWhoamiResponseSchema, } from './server-api/ci-tokens.js';
+export { COMMUNITY_SEATS, EDITIONS, FEATURES, GRACE_DAYS, LICENSE_FORMAT, LICENSE_STATUSES, LICENSE_TEXT_MAX_LENGTH, LICENSE_TEXT_PATTERN, editionSchema, featureSchema, licenseInstallRequestSchema, licensePayloadSchema, licenseStateSchema, } from './server-api/licensing.js';
+export { AUDIT_ACTION_GROUPS, AUDIT_ACTIONS, AUDIT_ACTOR_KINDS, AUDIT_LIMITS, AUDIT_TARGET_KINDS, DESKTOP_AUDIT_LIMITS, auditActionSchema, auditActorSchema, auditDetailsSchema, auditEventSchema, auditExportQuerySchema, auditPageSchema, auditQuerySchema, desktopAuditBatchSchema, desktopAuditEventSchema, desktopRequestSentDetailsSchema, desktopRunFinishedDetailsSchema, } from './server-api/audit.js';
+export { ACCOUNTS_FILE_VERSION, accountsFileSchema, parseAccountsFile, serverAccountSchema } from './account/schema.js';
+export * from './sequence/index.js';
+export * from './script/index.js';
+export { readSequences } from './sequence/load.js';
+export { assertNoControlCharacters, assertOriginIndependent, expandWithSequenceEscaped, hasSequenceValues, urlOrigin, } from './project/sequence-guards.js';

package/dist/json/cursor.d.ts

@@ -41,3 +41,5 @@ export interface JsonCompletionContext {
  * level outside any object, or anywhere a key would not be the next thing written.
  */
 export declare function jsonCompletionContextAt(text: string, offset: number): JsonCompletionContext | undefined;
+export { pointerRange } from './pointer-range.js';
+export type { PointerTextRange } from './pointer-range.js';

package/dist/json/cursor.js

@@ -166,3 +166,4 @@ export function jsonCompletionContextAt(text, offset) {
         siblings: [...frame.keys],
     };
 }
+export { pointerRange } from './pointer-range.js';

package/dist/json/pointer-range.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Where a JSON Pointer's value sits in a JSON text, so a problem found on the parsed value can be
+ * marked in the text the user sees — pretty-printed or exactly as received.
+ *
+ * One forward scan: at each container it walks every member, descending into the ones on the
+ * pointer's path and skipping the rest, so no character is read twice. A scalar is located as its whole token; an object or array
+ * as its opening bracket only, which is also where a missing required property belongs (the
+ * validator reports that at the parent). Pure and dependency-free, so the renderer can use it.
+ */
+/** A 1-based range, Monaco style: `endColumn` is one past the last character. */
+export interface PointerTextRange {
+    readonly line: number;
+    readonly column: number;
+    readonly endLine: number;
+    readonly endColumn: number;
+}
+/** The range of the value `pointer` names in `text`, or `undefined` when it cannot be located. */
+export declare function pointerRange(text: string, pointer: string): PointerTextRange | undefined;

package/dist/json/pointer-range.js

@@ -0,0 +1,157 @@
+/**
+ * Where a JSON Pointer's value sits in a JSON text, so a problem found on the parsed value can be
+ * marked in the text the user sees — pretty-printed or exactly as received.
+ *
+ * One forward scan: at each container it walks every member, descending into the ones on the
+ * pointer's path and skipping the rest, so no character is read twice. A scalar is located as its whole token; an object or array
+ * as its opening bracket only, which is also where a missing required property belongs (the
+ * validator reports that at the parent). Pure and dependency-free, so the renderer can use it.
+ */
+function skipWs(text, i) {
+    while (i < text.length) {
+        const c = text.charCodeAt(i);
+        if (c !== 0x20 && c !== 0x0a && c !== 0x0d && c !== 0x09)
+            break;
+        i++;
+    }
+    return i;
+}
+/** Index just past the string that opens at `i`, or -1 when it never closes. */
+function endOfString(text, i) {
+    for (let j = i + 1; j < text.length; j++) {
+        const c = text[j];
+        if (c === '\\')
+            j++;
+        else if (c === '"')
+            return j + 1;
+    }
+    return -1;
+}
+/** Index just past the value starting at `i` (whitespace already skipped), or -1. */
+function endOfValue(text, i) {
+    const c = text[i];
+    if (c === '"')
+        return endOfString(text, i);
+    if (c === '{' || c === '[') {
+        let depth = 0;
+        for (let j = i; j < text.length; j++) {
+            const d = text[j];
+            if (d === '"') {
+                const end = endOfString(text, j);
+                if (end < 0)
+                    return -1;
+                j = end - 1;
+            }
+            else if (d === '{' || d === '[')
+                depth++;
+            else if (d === '}' || d === ']') {
+                depth--;
+                if (depth === 0)
+                    return j + 1;
+            }
+        }
+        return -1;
+    }
+    let j = i;
+    while (j < text.length && !/[\s,:\]}]/.test(text[j]))
+        j++;
+    return j > i ? j : -1;
+}
+function decodeKey(raw) {
+    try {
+        const decoded = JSON.parse(raw);
+        return typeof decoded === 'string' ? decoded : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Locates `segments[k..]` inside the value starting at `i`, and also returns where that value
+ * ends, so the caller carries on scanning from there: every character is read once. An object may
+ * repeat a key; `JSON.parse` keeps the last, so a later match replaces an earlier one.
+ */
+function locate(text, i, segments, k) {
+    if (k === segments.length) {
+        const container = text[i] === '{' || text[i] === '[';
+        const end = endOfValue(text, i);
+        return { target: container || end >= 0 ? i : -1, end };
+    }
+    if (text[i] !== '{' && text[i] !== '[')
+        return { target: -1, end: endOfValue(text, i) };
+    const isArray = text[i] === '[';
+    const close = isArray ? ']' : '}';
+    const segment = segments[k];
+    const wanted = isArray && /^(0|[1-9]\d*)$/.test(segment) ? Number(segment) : -1;
+    let target = -1;
+    let j = skipWs(text, i + 1);
+    if (text[j] === close)
+        return { target, end: j + 1 };
+    for (let index = 0;; index++) {
+        let matched;
+        if (isArray) {
+            matched = index === wanted;
+        }
+        else {
+            if (text[j] !== '"')
+                return { target, end: -1 };
+            const keyEnd = endOfString(text, j);
+            if (keyEnd < 0)
+                return { target, end: -1 };
+            matched = decodeKey(text.slice(j, keyEnd)) === segment;
+            j = skipWs(text, keyEnd);
+            if (text[j] !== ':')
+                return { target, end: -1 };
+            j = skipWs(text, j + 1);
+        }
+        let end;
+        if (matched) {
+            const inner = locate(text, j, segments, k + 1);
+            target = inner.target;
+            end = inner.end;
+        }
+        else {
+            end = endOfValue(text, j);
+        }
+        if (end < 0)
+            return { target, end: -1 };
+        j = skipWs(text, end);
+        if (text[j] === close)
+            return { target, end: j + 1 };
+        if (text[j] !== ',')
+            return { target, end: -1 };
+        j = skipWs(text, j + 1);
+    }
+}
+function position(text, offset) {
+    let line = 1;
+    let lineStart = 0;
+    for (let k = text.indexOf('\n'); k >= 0 && k < offset; k = text.indexOf('\n', k + 1)) {
+        line++;
+        lineStart = k + 1;
+    }
+    return { line, column: offset - lineStart + 1 };
+}
+/** The range of the value `pointer` names in `text`, or `undefined` when it cannot be located. */
+export function pointerRange(text, pointer) {
+    if (pointer !== '' && !pointer.startsWith('/'))
+        return undefined;
+    const segments = pointer === ''
+        ? []
+        : pointer
+            .slice(1)
+            .split('/')
+            .map((s) => s.replace(/~1/g, '/').replace(/~0/g, '~'));
+    const at = skipWs(text, 0);
+    if (at >= text.length)
+        return undefined;
+    const found = locate(text, at, segments, 0).target;
+    if (found < 0)
+        return undefined;
+    const container = text[found] === '{' || text[found] === '[';
+    const end = container ? found + 1 : endOfValue(text, found);
+    if (end < 0)
+        return undefined;
+    const start = position(text, found);
+    return { line: start.line, column: start.column, endLine: start.line, endColumn: start.column + (end - found) };
+}

package/dist/json/schema/model.d.ts

@@ -0,0 +1,59 @@
+/**
+ * A JSON value and the JSON Schema subset the engine reads.
+ *
+ * In `json/schema/` because an OpenAPI description, an AsyncAPI description and a script's generated
+ * types all read the same schemas, and no protocol folder imports another (protocol modules spec
+ * §7.2). `rest/openapi/model.ts` re-exports the four names.
+ */
+/** A JSON value, as a document literally contains it (an `example`, a `default`, an `enum` member). */
+export type JsonValue = string | number | boolean | null | readonly JsonValue[] | {
+    readonly [key: string]: JsonValue;
+};
+/**
+ * The JSON Schema subset the sample generator reads — Draft 2020-12 as 3.1 uses it, and 3.0's own
+ * dialect, which differs in the two ways noted on the fields.
+ */
+export interface JsonSchema {
+    /** 3.0 allows one type; 3.1 allows a list, which is how it spells "nullable". */
+    readonly type?: string | readonly string[];
+    readonly format?: string;
+    readonly title?: string;
+    readonly description?: string;
+    readonly default?: JsonValue;
+    readonly example?: JsonValue;
+    /** 3.1 spelling; 3.0 uses `example`. Both are read. */
+    readonly examples?: readonly JsonValue[];
+    readonly enum?: readonly JsonValue[];
+    readonly const?: JsonValue;
+    readonly properties?: Readonly<Record<string, JsonSchema>>;
+    readonly required?: readonly string[];
+    readonly items?: JsonSchema;
+    readonly additionalProperties?: boolean | JsonSchema;
+    readonly allOf?: readonly JsonSchema[];
+    readonly oneOf?: readonly JsonSchema[];
+    readonly anyOf?: readonly JsonSchema[];
+    /** Names the property whose value says which `oneOf`/`anyOf` branch an object is. */
+    readonly discriminator?: OpenApiDiscriminator;
+    /** 3.0 only: 3.1 spells this as a `type` list including `'null'`. */
+    readonly nullable?: boolean;
+    readonly deprecated?: boolean;
+    readonly readOnly?: boolean;
+    readonly writeOnly?: boolean;
+    /** The `xml` object an XML body's shape honours. */
+    readonly xml?: OpenApiXml;
+    /** Left in place when a reference could not be resolved, so a sample can say so rather than guess. */
+    readonly $ref?: string;
+}
+/** The `discriminator` object. `mapping` values are references, kept as the document spells them. */
+export interface OpenApiDiscriminator {
+    readonly propertyName: string;
+    readonly mapping?: Readonly<Record<string, string>>;
+}
+/** The `xml` object: how a schema's value is spelled as XML. */
+export interface OpenApiXml {
+    readonly name?: string;
+    readonly namespace?: string;
+    readonly prefix?: string;
+    readonly attribute?: boolean;
+    readonly wrapped?: boolean;
+}

package/dist/json/schema/model.js

@@ -0,0 +1,8 @@
+/**
+ * A JSON value and the JSON Schema subset the engine reads.
+ *
+ * In `json/schema/` because an OpenAPI description, an AsyncAPI description and a script's generated
+ * types all read the same schemas, and no protocol folder imports another (protocol modules spec
+ * §7.2). `rest/openapi/model.ts` re-exports the four names.
+ */
+export {};

package/dist/json/schema/parse-text.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Reading the text of a description, JSON or YAML, into a value.
+ *
+ * In `json/schema/` because the OpenAPI and the AsyncAPI imports both start here, and no protocol
+ * folder imports another (protocol modules spec §7.2). `rest/openapi/parse.ts` re-exports
+ * {@link parseDocumentText}.
+ */
+/**
+ * Parses text as JSON when it looks like JSON, and as YAML otherwise.
+ *
+ * JSON is a subset of YAML, so one parser would do — but a JSON document with a syntax error gets a
+ * far better message from `JSON.parse`, and that message is what the user has to act on.
+ *
+ * @throws OpenApiError `openapi-malformed` when the text parses as neither.
+ */
+export declare function parseDocumentText(text: string, where?: string): unknown;

package/dist/json/schema/parse-text.js

@@ -0,0 +1,37 @@
+/**
+ * Reading the text of a description, JSON or YAML, into a value.
+ *
+ * In `json/schema/` because the OpenAPI and the AsyncAPI imports both start here, and no protocol
+ * folder imports another (protocol modules spec §7.2). `rest/openapi/parse.ts` re-exports
+ * {@link parseDocumentText}.
+ */
+import { parse as parseYamlDocument } from 'yaml';
+import { OpenApiError } from '../../errors.js';
+/**
+ * Parses text as JSON when it looks like JSON, and as YAML otherwise.
+ *
+ * JSON is a subset of YAML, so one parser would do — but a JSON document with a syntax error gets a
+ * far better message from `JSON.parse`, and that message is what the user has to act on.
+ *
+ * @throws OpenApiError `openapi-malformed` when the text parses as neither.
+ */
+export function parseDocumentText(text, where = 'the document') {
+    const trimmed = text.replace(/^/, '').trimStart();
+    if (trimmed.startsWith('{') || trimmed.startsWith('[')) {
+        try {
+            return JSON.parse(trimmed);
+        }
+        catch (error) {
+            throw new OpenApiError('openapi-malformed', `${where} is not valid JSON: ${messageOf(error)}`, { cause: error });
+        }
+    }
+    try {
+        return parseYamlDocument(trimmed);
+    }
+    catch (error) {
+        throw new OpenApiError('openapi-malformed', `${where} is not valid YAML: ${messageOf(error)}`, { cause: error });
+    }
+}
+function messageOf(error) {
+    return error instanceof Error ? error.message : String(error);
+}

package/dist/{rest/openapi → json/schema}/refs.d.ts

@@ -6,12 +6,12 @@
  * lets the definition be exported byte-exact later.
  *
  * Two rules keep this from being a file-read primitive handed to whoever wrote the document. The
- * *reference policy* is the one WSDL import already uses (`wsdl/ref-policy.ts`): a `file:` root may
+ * *reference policy* is the one WSDL import already uses (`http/ref-policy.ts`): a `file:` root may
  * only reference files inside its own folder tree, an `http(s):` root may never reach a local file.
  * And the walk is bounded — a visited set per pointer, a depth cap, and a document cap — because a
  * cyclic or fan-out document must end in a diagnostic, not a hang.
  */
-import type { FetchDocument } from '../../wsdl/resolver.js';
+import type { FetchDocument } from '../../http/fetch-document.js';
 /** How deep a chain of `$ref`s may nest before the graph is treated as runaway. */
 export declare const MAX_REF_DEPTH = 32;
 /** One document the resolution pulled in, kept for the definition cache. */

package/dist/{rest/openapi → json/schema}/refs.js

@@ -6,14 +6,14 @@
  * lets the definition be exported byte-exact later.
  *
  * Two rules keep this from being a file-read primitive handed to whoever wrote the document. The
- * *reference policy* is the one WSDL import already uses (`wsdl/ref-policy.ts`): a `file:` root may
+ * *reference policy* is the one WSDL import already uses (`http/ref-policy.ts`): a `file:` root may
  * only reference files inside its own folder tree, an `http(s):` root may never reach a local file.
  * And the walk is bounded — a visited set per pointer, a depth cap, and a document cap — because a
  * cyclic or fan-out document must end in a diagnostic, not a hang.
  */
 import { OpenApiError } from '../../errors.js';
-import { referencePolicyFor, MAX_IMPORT_DEPTH, MAX_IMPORT_DOCUMENTS } from '../../wsdl/ref-policy.js';
-import { parseDocumentText } from './parse.js';
+import { referencePolicyFor, MAX_IMPORT_DEPTH, MAX_IMPORT_DOCUMENTS } from '../../http/ref-policy.js';
+import { parseDocumentText } from './parse-text.js';
 /** How deep a chain of `$ref`s may nest before the graph is treated as runaway. */
 export const MAX_REF_DEPTH = MAX_IMPORT_DEPTH;
 /** Unescapes one JSON pointer token per RFC 6901: `~1` is `/`, `~0` is `~`, in that order. */