@wirebench/engine 2.2.1 → 3.1.0-rc.1

package/dist/rest/contract-check.js

@@ -0,0 +1,217 @@
+/**
+ * Checks a received REST response against the schema its OpenAPI operation declares for it.
+ *
+ * Pure and synchronous, plain data in and out, so it can run in a worker: a contract's `pattern` is
+ * untrusted, and the time budget here only stops the check between steps (reporting `not-checked`,
+ * neither a pass nor a failure) — the worker is what bounds a single call that runs away.
+ */
+import { unsupportedKeywordsIn, validateJsonSchema } from '../json/schema-validate.js';
+import { selectResponse } from './openapi/responses.js';
+/** A body bigger than this (UTF-8 bytes) is not parsed or validated: it is reported `skipped`. */
+export const MAX_CHECKED_BODY_BYTES = 1_048_576;
+/** The default time one response's check may take before it gives up as `not-checked`. */
+export const DEFAULT_REST_CHECK_BUDGET_MS = 200;
+export const MAX_CONTRACT_PROBLEMS = 50;
+export const MAX_CONTRACT_MESSAGE_LENGTH = 300;
+/**
+ * Schema nodes one check may visit. Generous, since a real response (hundreds of rows of dozens of
+ * properties) must be checkable: the worker's deadline is what bounds the time, and this only stops a
+ * body the deadline would let through yet is still too big to finish.
+ */
+export const MAX_REST_CHECK_NODES = 200_000;
+export const MAX_CONTRACT_PATH_LENGTH = 300;
+/** Value nodes the `writeOnly` pass may visit; it walks the value, so the schema's shape cannot loop it. */
+const MAX_WRITE_ONLY_NODES = MAX_REST_CHECK_NODES;
+function utf8Length(text, limit) {
+    if (text.length > limit)
+        return text.length;
+    if (text.length * 3 <= limit)
+        return text.length;
+    return new TextEncoder().encode(text).length;
+}
+function capped(problems) {
+    return problems.slice(0, MAX_CONTRACT_PROBLEMS).map((p) => ({
+        path: p.path.length > MAX_CONTRACT_PATH_LENGTH ? p.path.slice(0, MAX_CONTRACT_PATH_LENGTH) : p.path,
+        keyword: p.keyword,
+        message: p.message.length > MAX_CONTRACT_MESSAGE_LENGTH ? p.message.slice(0, MAX_CONTRACT_MESSAGE_LENGTH) : p.message,
+    }));
+}
+function isObject(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+function escapeSegment(key) {
+    return key.replace(/~/g, '~0').replace(/\//g, '~1');
+}
+/** The schema that applies to item `i`: a tuple's own (`prefixItems`, or draft-07 array `items`), then the rest. */
+function itemSchema(sch, i) {
+    const items = sch['items'];
+    const prefix = Array.isArray(sch['prefixItems']) ? sch['prefixItems'] : Array.isArray(items) ? items : undefined;
+    if (prefix !== undefined && i < prefix.length)
+        return prefix[i];
+    if (Array.isArray(sch['prefixItems']))
+        return items;
+    return Array.isArray(items) ? sch['additionalItems'] : items;
+}
+/**
+ * Every present property whose schema says `writeOnly: true`. `allOf` is always followed; an
+ * `anyOf`/`oneOf` branch only when the value matches it, so a write-only property of an alternative
+ * the value is not does not count. Composition keywords are followed without moving in the value,
+ * so a per-value set of schemas already applied stops a cycle there; everything else descends into
+ * the value, which is finite and bounded by the node cap.
+ */
+function writeOnlyProblems(value, schema, max, expired) {
+    const problems = [];
+    let nodes = 0;
+    let capped = false;
+    let outOfTime = false;
+    let undecided = false;
+    const halted = () => {
+        if (problems.length >= max || capped || outOfTime)
+            return true;
+        if (nodes >= MAX_WRITE_ONLY_NODES)
+            capped = true;
+        else if (expired())
+            outOfTime = true;
+        return capped || outOfTime;
+    };
+    const visit = (val, sch, path, applied) => {
+        if (!isObject(sch) || applied.has(sch) || halted())
+            return;
+        applied.add(sch);
+        nodes++;
+        const allOf = sch['allOf'];
+        if (Array.isArray(allOf))
+            for (const b of allOf)
+                visit(val, b, path, applied);
+        for (const keyword of ['anyOf', 'oneOf']) {
+            const branches = sch[keyword];
+            if (!Array.isArray(branches))
+                continue;
+            for (const b of branches) {
+                if (halted())
+                    return;
+                const trial = validateJsonSchema(val, b, { maxProblems: 1 });
+                if (trial.length === 0)
+                    visit(val, b, path, applied);
+                else if (trial[0]?.keyword === 'budget')
+                    undecided = true;
+            }
+        }
+        if (Array.isArray(val)) {
+            val.forEach((item, i) => visit(item, itemSchema(sch, i), `${path}/${i}`, new Set()));
+        }
+        else if (isObject(val)) {
+            const properties = isObject(sch['properties']) ? sch['properties'] : {};
+            for (const key of Object.keys(val)) {
+                const childPath = `${path}/${escapeSegment(key)}`;
+                const own = Object.prototype.hasOwnProperty.call(properties, key);
+                const propSchema = own ? properties[key] : sch['additionalProperties'];
+                if (isObject(propSchema) && propSchema['writeOnly'] === true && problems.length < max) {
+                    problems.push({
+                        path: childPath,
+                        keyword: 'writeOnly',
+                        message: `"${key}" is write-only and must not be in a response`,
+                    });
+                }
+                visit(val[key], propSchema, childPath, new Set());
+            }
+        }
+    };
+    visit(value, schema, '', new Set());
+    return { problems, capped, expired: outOfTime, undecided };
+}
+export function checkRestResponse(input, options) {
+    const skipped = { status: 'skipped', problems: [], notes: [] };
+    if (input.language !== 'json' || input.streamed)
+        return skipped;
+    if (utf8Length(input.bodyText, MAX_CHECKED_BODY_BYTES) > MAX_CHECKED_BODY_BYTES)
+        return skipped;
+    const { operation, responses } = input;
+    if (operation === undefined || responses === undefined)
+        return { status: 'no-contract', problems: [], notes: [] };
+    // Only a body detected as JSON gets here, so one with no Content-Type is read as `application/json`.
+    const contentType = input.contentType?.trim() ? input.contentType : 'application/json';
+    const selection = selectResponse(responses, input.status, contentType);
+    if (selection.kind === 'unmatched') {
+        return {
+            status: 'unmatched',
+            operation,
+            problems: [],
+            notes: [`the contract declares no ${input.status} response`],
+        };
+    }
+    const { responseKey } = selection;
+    if (selection.kind === 'no-body') {
+        if (input.bodyText.trim() === '')
+            return { status: 'ok', operation, responseKey, problems: [], notes: [] };
+        return {
+            status: 'violation',
+            operation,
+            responseKey,
+            problems: [{ path: '', keyword: 'body', message: 'the contract declares no body' }],
+            notes: [],
+        };
+    }
+    if (selection.kind === 'no-schema')
+        return { status: 'no-schema', operation, responseKey, problems: [], notes: [] };
+    const { mediaType, schema } = selection;
+    const found = { operation, responseKey, mediaType };
+    let value;
+    try {
+        value = JSON.parse(input.bodyText);
+    }
+    catch {
+        return {
+            status: 'violation',
+            ...found,
+            problems: [{ path: '', keyword: 'json', message: 'not valid JSON' }],
+            notes: [],
+        };
+    }
+    const now = options?.now ?? (() => performance.now());
+    const budgetMs = options?.budgetMs ?? DEFAULT_REST_CHECK_BUDGET_MS;
+    const start = now();
+    const notes = unsupportedKeywordsIn(schema).map((k) => `\`${k}\` is not checked`);
+    const notChecked = { status: 'not-checked', ...found, problems: [], notes };
+    const expired = () => now() - start > budgetMs;
+    let problems;
+    let stopped;
+    try {
+        const checked = validateJsonSchema(value, schema, {
+            maxProblems: MAX_CONTRACT_PROBLEMS,
+            maxNodes: MAX_REST_CHECK_NODES,
+            redactValues: true,
+        });
+        if (expired())
+            return notChecked;
+        // A stop on the node or depth cap is not a fault of the body: it only means part went unchecked.
+        stopped = checked.find((p) => p.keyword === 'budget')?.message;
+        problems = checked.filter((p) => p.keyword !== 'budget');
+        if (problems.length < MAX_CONTRACT_PROBLEMS) {
+            const pass = writeOnlyProblems(value, schema, MAX_CONTRACT_PROBLEMS - problems.length, expired);
+            if (pass.expired)
+                return notChecked;
+            problems.push(...pass.problems);
+            if (pass.capped)
+                notes.push(`write-only check stopped after ${MAX_WRITE_ONLY_NODES} nodes`);
+            if (pass.undecided) {
+                notes.push('write-only check could not tell which anyOf/oneOf branch a value matches, so did not follow it');
+            }
+        }
+    }
+    catch (error) {
+        // The validator stops self-referencing schemas itself; this is the last resort should some
+        // shape still exhaust the stack.
+        if (error instanceof RangeError)
+            return notChecked;
+        throw error;
+    }
+    if (expired())
+        return notChecked;
+    if (stopped !== undefined) {
+        if (problems.length === 0)
+            return { ...notChecked, notes: [stopped, ...notes] };
+        notes.unshift(`partial check: ${stopped}`);
+    }
+    return { status: problems.length === 0 ? 'ok' : 'violation', ...found, problems: capped(problems), notes };
+}

package/dist/rest/cookie-jar.d.ts

@@ -0,0 +1,62 @@
+/**
+ * The cookie jar (cookie jar and current values spec §1): what REST responses set, kept per
+ * workspace in the app and per run on the command line, and sent back by requests whose *Send
+ * cookies* setting is on.
+ *
+ * Storing follows RFC 6265 §5.3, and RFC 6265bis §5.6 for Secure. A cookie's identity is its name,
+ * domain and path. A newer cookie replaces an older one but keeps its creation time. A cookie that
+ * is already expired deletes the stored one instead. There is no public-suffix list: see
+ * `docs/security.md`, "The cookie jar".
+ */
+import type { Cookie, CookieJarHost, CookieKey, CookieVerdict, StoredCookie } from '../http/cookies.js';
+export type { CookieJarHost, CookieKey, CookieRejection, CookieVerdict, StoredCookie } from '../http/cookies.js';
+/** At most this many cookies per domain (spec §1.2). */
+export declare const MAX_COOKIES_PER_DOMAIN = 50;
+/** At most this many cookies in one jar. */
+export declare const MAX_COOKIES = 3000;
+/** A name plus value over this many UTF-8 bytes is not stored. */
+export declare const MAX_COOKIE_BYTES = 4096;
+export declare class CookieJar {
+    private readonly cookies;
+    constructor(initial?: readonly StoredCookie[]);
+    /** Stores what a response to `url` set, at `now`: one verdict per cookie, in order. */
+    store(url: string, cookies: readonly Cookie[], now: number): CookieVerdict[];
+    /** The cookies a request to `url` carries at `now`, in RFC 6265 §5.4 order. */
+    cookiesFor(url: string, now: number): StoredCookie[];
+    /** Every unexpired cookie, by domain, then name, then path. */
+    list(now: number): StoredCookie[];
+    /**
+     * Stores `cookie` as given, replacing one of the same identity. The manager's edit: the domain and
+     * Secure rules are skipped (it picks its own domain), but the jar's size limits still hold.
+     */
+    set(cookie: StoredCookie, now?: number): void;
+    remove(key: CookieKey): boolean;
+    /** Removes every cookie stored under `domain` (lowercased, leading dot ignored); how many went. */
+    removeDomain(domain: string): number;
+    clear(): void;
+    /** The cookies worth saving: unexpired, with an expiry. */
+    persistent(now: number): StoredCookie[];
+    private storeOne;
+    private dropExpired;
+    private enforceLimits;
+    private evict;
+}
+/** A {@link CookieJarHost} over `jar`, reading the time from `now`. */
+export declare function jarCookieHost(jar: CookieJar, now?: () => number): CookieJarHost;
+/**
+ * The `Cookie` header a request carries: the pairs it sets by hand, then the jar's, in the order
+ * given. A jar cookie is left out when a hand-set pair has its name. Unlike `cookieHeader`, two jar
+ * cookies of one name on different paths both go, most specific first, as RFC 6265 §5.4 sends them.
+ */
+export declare function mergeCookieHeader(jarCookies: readonly StoredCookie[], handSet: string | undefined): string | undefined;
+/** Options for {@link cookiesToSend}. */
+export interface CookieMatchOptions {
+    /** When the cookies were received, for a `Max-Age` that is relative to that moment. */
+    readonly setAt?: Date;
+}
+/**
+ * The cookies of `cookies` that a request to `url` should carry at `now`, in the order given. Kept
+ * for the engine's public API: each cookie is stored, as received from `url`, in a throwaway jar and
+ * kept when that jar would send it back to `url`.
+ */
+export declare function cookiesToSend(cookies: readonly Cookie[], url: string, now?: Date, options?: CookieMatchOptions): Cookie[];

package/dist/rest/cookie-jar.js

@@ -0,0 +1,262 @@
+import { defaultPath, domainMatches, pathMatches } from './cookies.js';
+/** At most this many cookies per domain (spec §1.2). */
+export const MAX_COOKIES_PER_DOMAIN = 50;
+/** At most this many cookies in one jar. */
+export const MAX_COOKIES = 3000;
+/** A name plus value over this many UTF-8 bytes is not stored. */
+export const MAX_COOKIE_BYTES = 4096;
+const IPV4 = /^\d{1,3}(?:\.\d{1,3}){3}$/;
+const encoder = new TextEncoder();
+/** Strip IPv6 brackets from hostname (URL.hostname keeps them). */
+function stripIpv6Brackets(hostname) {
+    return hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;
+}
+function isIpAddress(host) {
+    return IPV4.test(host) || host.includes(':') || host.startsWith('[');
+}
+function idOf(key) {
+    return `${key.domain}\n${key.path}\n${key.name}`;
+}
+/** The desktop wire schema's rules: nothing that would break the `Cookie` header a cookie is sent in. */
+const BAD_NAME = /[;=\s\u0000-\u001f\u007f]/;
+const BAD_VALUE = /[;\r\n\0]/;
+function rejected(reason) {
+    return { stored: false, reason };
+}
+/** When `cookie` expires, from Max-Age first and then Expires (§5.3 step 3); undefined for a session cookie. */
+function expiresAtOf(cookie, now) {
+    if (cookie.maxAge !== undefined) {
+        return now + cookie.maxAge * 1000;
+    }
+    if (cookie.expires === undefined) {
+        return undefined;
+    }
+    const at = Date.parse(cookie.expires);
+    return Number.isNaN(at) ? undefined : at;
+}
+/** The domain a cookie from `host` is stored under, or why it is refused (spec §1.3). */
+function scopeOf(cookie, host) {
+    const declared = (cookie.domain ?? '').replace(/^\./, '').toLowerCase();
+    if (declared === '') {
+        return { domain: host, hostOnly: true };
+    }
+    const restricted = isIpAddress(declared) || !declared.includes('.');
+    if (declared === host) {
+        // An IP or a single label is honoured only as the host itself, and then only host-only.
+        return { domain: host, hostOnly: restricted };
+    }
+    if (restricted) {
+        return 'domain-not-allowed';
+    }
+    return domainMatches(host, declared) ? { domain: declared, hostOnly: false } : 'domain-mismatch';
+}
+/** RFC 6265 §5.4 step 2: longer paths first, then the earlier created. */
+function sendOrder(a, b) {
+    return b.path.length - a.path.length || a.createdAt - b.createdAt;
+}
+/** Which cookie a full jar lets go first: the soonest to expire (a session cookie last), then the oldest. */
+function evictionOrder(a, b) {
+    const aExpires = a.expiresAt ?? Number.POSITIVE_INFINITY;
+    const bExpires = b.expiresAt ?? Number.POSITIVE_INFINITY;
+    if (aExpires !== bExpires) {
+        return aExpires < bExpires ? -1 : 1;
+    }
+    return a.createdAt - b.createdAt;
+}
+function listOrder(a, b) {
+    return a.domain.localeCompare(b.domain) || a.name.localeCompare(b.name) || a.path.localeCompare(b.path);
+}
+export class CookieJar {
+    cookies = new Map();
+    constructor(initial = []) {
+        for (const cookie of initial) {
+            this.cookies.set(idOf(cookie), cookie);
+        }
+    }
+    /** Stores what a response to `url` set, at `now`: one verdict per cookie, in order. */
+    store(url, cookies, now) {
+        let target;
+        try {
+            target = new URL(url);
+        }
+        catch {
+            return cookies.map(() => rejected('malformed'));
+        }
+        return cookies.map((cookie) => this.storeOne(cookie, target, now));
+    }
+    /** The cookies a request to `url` carries at `now`, in RFC 6265 §5.4 order. */
+    cookiesFor(url, now) {
+        this.dropExpired(now);
+        let target;
+        try {
+            target = new URL(url);
+        }
+        catch {
+            return [];
+        }
+        const host = stripIpv6Brackets(target.hostname).toLowerCase();
+        const secureContext = target.protocol === 'https:';
+        const path = target.pathname === '' ? '/' : target.pathname;
+        return [...this.cookies.values()]
+            .filter((cookie) => (cookie.hostOnly ? host === cookie.domain : domainMatches(host, cookie.domain)) &&
+            pathMatches(path, cookie.path) &&
+            (!cookie.secure || secureContext))
+            .sort(sendOrder);
+    }
+    /** Every unexpired cookie, by domain, then name, then path. */
+    list(now) {
+        this.dropExpired(now);
+        return [...this.cookies.values()].sort(listOrder);
+    }
+    /**
+     * Stores `cookie` as given, replacing one of the same identity. The manager's edit: the domain and
+     * Secure rules are skipped (it picks its own domain), but the jar's size limits still hold.
+     */
+    set(cookie, now = Date.now()) {
+        if (cookie.name === '' || BAD_NAME.test(cookie.name)) {
+            throw new RangeError('A cookie name is not empty and has no whitespace, control character, semicolon or equals sign.');
+        }
+        if (BAD_VALUE.test(cookie.value)) {
+            throw new RangeError('A cookie value has no semicolon, line break or NUL.');
+        }
+        this.cookies.set(idOf(cookie), cookie);
+        this.enforceLimits(cookie.domain, now);
+    }
+    remove(key) {
+        return this.cookies.delete(idOf(key));
+    }
+    /** Removes every cookie stored under `domain` (lowercased, leading dot ignored); how many went. */
+    removeDomain(domain) {
+        const target = domain.replace(/^\./, '').toLowerCase();
+        let removed = 0;
+        for (const [id, cookie] of this.cookies) {
+            if (cookie.domain === target) {
+                this.cookies.delete(id);
+                removed += 1;
+            }
+        }
+        return removed;
+    }
+    clear() {
+        this.cookies.clear();
+    }
+    /** The cookies worth saving: unexpired, with an expiry. */
+    persistent(now) {
+        return this.list(now).filter((cookie) => cookie.expiresAt !== undefined);
+    }
+    storeOne(cookie, target, now) {
+        if (cookie.malformed === true || cookie.name === '' || BAD_NAME.test(cookie.name) || BAD_VALUE.test(cookie.value)) {
+            return rejected('malformed');
+        }
+        if (encoder.encode(cookie.name).length + encoder.encode(cookie.value).length > MAX_COOKIE_BYTES) {
+            return rejected('too-large');
+        }
+        const secureContext = target.protocol === 'https:';
+        if (cookie.secure === true && !secureContext) {
+            return rejected('secure-over-http');
+        }
+        const host = stripIpv6Brackets(target.hostname).toLowerCase();
+        const scope = scopeOf(cookie, host);
+        if (typeof scope === 'string') {
+            return rejected(scope);
+        }
+        const declaredPath = cookie.path;
+        const path = declaredPath !== undefined && declaredPath.startsWith('/') ? declaredPath : defaultPath(target.pathname);
+        const id = idOf({ name: cookie.name, domain: scope.domain, path });
+        const existing = this.cookies.get(id);
+        if (existing?.secure === true && !secureContext) {
+            return rejected('secure-over-http');
+        }
+        // RFC 6265bis §5.3 step 13: refuse a non-Secure cookie if the jar holds a Secure cookie shadowing it
+        if (!secureContext && cookie.secure !== true) {
+            for (const candidate of this.cookies.values()) {
+                if (candidate.secure &&
+                    candidate.name === cookie.name &&
+                    (domainMatches(candidate.domain, scope.domain) || domainMatches(scope.domain, candidate.domain)) &&
+                    pathMatches(path, candidate.path)) {
+                    return rejected('secure-over-http');
+                }
+            }
+        }
+        const expiresAt = expiresAtOf(cookie, now);
+        if (expiresAt !== undefined && expiresAt <= now) {
+            this.cookies.delete(id);
+            return rejected('deleted');
+        }
+        this.cookies.set(id, {
+            name: cookie.name,
+            value: cookie.value,
+            domain: scope.domain,
+            hostOnly: scope.hostOnly,
+            path,
+            ...(expiresAt !== undefined ? { expiresAt } : {}),
+            secure: cookie.secure === true,
+            httpOnly: cookie.httpOnly === true,
+            ...(cookie.sameSite !== undefined ? { sameSite: cookie.sameSite } : {}),
+            createdAt: existing?.createdAt ?? now,
+        });
+        this.enforceLimits(scope.domain, now);
+        return { stored: true };
+    }
+    dropExpired(now) {
+        for (const [id, cookie] of this.cookies) {
+            if (cookie.expiresAt !== undefined && cookie.expiresAt <= now) {
+                this.cookies.delete(id);
+            }
+        }
+    }
+    enforceLimits(domain, now) {
+        this.dropExpired(now);
+        const inDomain = [...this.cookies.values()].filter((cookie) => cookie.domain === domain);
+        this.evict(inDomain, inDomain.length - MAX_COOKIES_PER_DOMAIN);
+        this.evict([...this.cookies.values()], this.cookies.size - MAX_COOKIES);
+    }
+    evict(candidates, count) {
+        if (count <= 0) {
+            return;
+        }
+        for (const cookie of [...candidates].sort(evictionOrder).slice(0, count)) {
+            this.cookies.delete(idOf(cookie));
+        }
+    }
+}
+/** A {@link CookieJarHost} over `jar`, reading the time from `now`. */
+export function jarCookieHost(jar, now = () => Date.now()) {
+    return {
+        cookiesFor: (url) => jar.cookiesFor(url, now()),
+        remember: (url, cookies) => jar.store(url, cookies, now()),
+    };
+}
+/**
+ * The `Cookie` header a request carries: the pairs it sets by hand, then the jar's, in the order
+ * given. A jar cookie is left out when a hand-set pair has its name. Unlike `cookieHeader`, two jar
+ * cookies of one name on different paths both go, most specific first, as RFC 6265 §5.4 sends them.
+ */
+export function mergeCookieHeader(jarCookies, handSet) {
+    const hand = (handSet ?? '')
+        .split(';')
+        .map((pair) => pair.trim())
+        .filter((pair) => pair !== '');
+    const handNames = new Set(hand.map((pair) => {
+        const equals = pair.indexOf('=');
+        return (equals === -1 ? pair : pair.slice(0, equals)).trim();
+    }));
+    const pairs = [
+        ...hand,
+        ...jarCookies.filter((cookie) => !handNames.has(cookie.name)).map((cookie) => `${cookie.name}=${cookie.value}`),
+    ];
+    return pairs.length === 0 ? undefined : pairs.join('; ');
+}
+/**
+ * The cookies of `cookies` that a request to `url` should carry at `now`, in the order given. Kept
+ * for the engine's public API: each cookie is stored, as received from `url`, in a throwaway jar and
+ * kept when that jar would send it back to `url`.
+ */
+export function cookiesToSend(cookies, url, now = new Date(), options = {}) {
+    const storedAt = (options.setAt ?? now).getTime();
+    return cookies.filter((cookie) => {
+        const jar = new CookieJar();
+        jar.store(url, [cookie], storedAt);
+        return jar.cookiesFor(url, now.getTime()).length > 0;
+    });
+}

package/dist/rest/cookies.d.ts

@@ -1,13 +1,11 @@
 /**
- * Which of a response's cookies go back out on the next send of the same request.
+ * RFC 6265 matching for the cookie jar (`rest/cookie-jar.ts`): domain-match and path-match (§5.1.3,
+ * §5.1.4), expiry (§5.3), and the `Cookie` header (§5.4).
  *
- * Wirebench keeps no cookie jar: a request remembers what its own last response set, for the
- * session only, and sends the matching ones when its *send cookies* setting is on. That is a
- * deliberate limit rather than an unfinished one — a shared jar makes one request's send depend on
- * another's, which is exactly what makes a saved request stop being reproducible — and nothing here
- * ever reaches disk.
- *
- * Matching follows RFC 6265 §5.1.3 and §5.1.4 (domain-match and path-match) and §5.3 (expiry).
+ * Every REST send stores what its responses set in a jar: the open workspace's in the app, the run's
+ * on the command line. A request sends the jar's matching cookies only when its *Send cookies*
+ * setting is on, which is off by default, so a saved request stays reproducible unless it opts in.
+ * The app saves only cookies with an expiry, encrypted; session cookies never reach disk.
  */
 import type { Cookie } from './response.js';
 /** True when `host` is `domain` or a subdomain of it (RFC 6265 §5.1.3). */
@@ -18,20 +16,6 @@ export declare function defaultPath(pathname: string): string;
 export declare function pathMatches(requestPath: string, cookiePath: string): boolean;
 /** Whether a cookie has expired at `now`, by `Max-Age` first and then `Expires` (§5.3). */
 export declare function isExpired(cookie: Cookie, now: Date, setAt?: Date): boolean;
-/** Options for {@link cookiesToSend}. */
-export interface CookieMatchOptions {
-    /** When the cookies were received, for a `Max-Age` that is relative to that moment. */
-    readonly setAt?: Date;
-}
-/**
- * The cookies of `cookies` that a request to `url` should carry at `now`.
- *
- * A cookie with no `Domain` is host-only, so it goes back only to the host that set it — which, for
- * a per-request memory, is the host it was sent from unless the URL changed. `Secure` cookies never
- * travel over plain HTTP, malformed lines are never sent at all, and an expired cookie is dropped
- * rather than sent and rejected.
- */
-export declare function cookiesToSend(cookies: readonly Cookie[], url: string, now?: Date, options?: CookieMatchOptions): Cookie[];
 /**
  * The `Cookie` header value for `cookies`, or `undefined` when there is nothing to send.
  *

package/dist/rest/cookies.js

@@ -1,13 +1,11 @@
 /**
- * Which of a response's cookies go back out on the next send of the same request.
+ * RFC 6265 matching for the cookie jar (`rest/cookie-jar.ts`): domain-match and path-match (§5.1.3,
+ * §5.1.4), expiry (§5.3), and the `Cookie` header (§5.4).
  *
- * Wirebench keeps no cookie jar: a request remembers what its own last response set, for the
- * session only, and sends the matching ones when its *send cookies* setting is on. That is a
- * deliberate limit rather than an unfinished one — a shared jar makes one request's send depend on
- * another's, which is exactly what makes a saved request stop being reproducible — and nothing here
- * ever reaches disk.
- *
- * Matching follows RFC 6265 §5.1.3 and §5.1.4 (domain-match and path-match) and §5.3 (expiry).
+ * Every REST send stores what its responses set in a jar: the open workspace's in the app, the run's
+ * on the command line. A request sends the jar's matching cookies only when its *Send cookies*
+ * setting is on, which is off by default, so a saved request stays reproducible unless it opts in.
+ * The app saves only cookies with an expiry, encrypted; session cookies never reach disk.
  */
 /** True when `host` is `domain` or a subdomain of it (RFC 6265 §5.1.3). */
 export function domainMatches(host, domain) {
@@ -52,40 +50,6 @@ export function isExpired(cookie, now, setAt) {
     const expires = new Date(cookie.expires);
     return !Number.isNaN(expires.getTime()) && expires.getTime() <= now.getTime();
 }
-/**
- * The cookies of `cookies` that a request to `url` should carry at `now`.
- *
- * A cookie with no `Domain` is host-only, so it goes back only to the host that set it — which, for
- * a per-request memory, is the host it was sent from unless the URL changed. `Secure` cookies never
- * travel over plain HTTP, malformed lines are never sent at all, and an expired cookie is dropped
- * rather than sent and rejected.
- */
-export function cookiesToSend(cookies, url, now = new Date(), options = {}) {
-    let target;
-    try {
-        target = new URL(url);
-    }
-    catch {
-        return [];
-    }
-    const secureContext = target.protocol === 'https:';
-    const requestPath = target.pathname === '' ? '/' : target.pathname;
-    return cookies.filter((cookie) => {
-        if (cookie.malformed === true || cookie.name === '') {
-            return false;
-        }
-        if (cookie.secure === true && !secureContext) {
-            return false;
-        }
-        if (isExpired(cookie, now, options.setAt)) {
-            return false;
-        }
-        if (cookie.domain !== undefined && !domainMatches(target.hostname, cookie.domain)) {
-            return false;
-        }
-        return pathMatches(requestPath, cookie.path ?? defaultPath(requestPath));
-    });
-}
 /**
  * The `Cookie` header value for `cookies`, or `undefined` when there is nothing to send.
  *

package/dist/rest/curl.js

@@ -13,7 +13,7 @@
  */
 import { toCurl } from '../http/curl.js';
 import { entry, RAW_LANGUAGE_CONTENT_TYPES } from './model.js';
-import { applyAuth } from './auth.js';
+import { applyAuth } from '../http/auth/apply-auth.js';
 import { findHeredoc, findHereString } from '../http/heredoc.js';
 import { expandBundles, takesNoValue } from '../http/curl-flags.js';
 import { composeUrl, splitQuery, trimTrailingSlashes } from './url.js';
@@ -81,6 +81,9 @@ export function restToCurl(input, options = {}) {
     for (const [name, value] of Object.entries(applied.headers)) {
         headers.push({ name, value: redact ? CURL_REDACTED : value });
     }
+    // A request that asks the server for an event stream must not have curl buffer its output either,
+    // or `-N`'s whole point — seeing rows as they arrive — is lost.
+    const noBuffer = headers.some((header) => header.name.toLowerCase() === 'accept' && header.value.toLowerCase().includes('text/event-stream'));
     const transport = applied.transportAuth;
     const basic = transport?.type === 'basic'
         ? { username: transport.username, password: redact ? CURL_REDACTED : transport.password }
@@ -96,6 +99,7 @@ export function restToCurl(input, options = {}) {
         ...(input.settings.followRedirects && input.settings.maxRedirects !== undefined
             ? { maxRedirects: input.settings.maxRedirects }
             : {}),
+        ...(noBuffer ? { noBuffer: true } : {}),
     };
     return toCurl(command, options.shell !== undefined ? { shell: options.shell } : {});
 }