@wirebench/engine 2.2.1 → 3.1.0-rc.1

package/dist/run/script-support.js

@@ -0,0 +1,68 @@
+import { resolveSecretTokens } from '../secrets/resolve.js';
+import { scriptError, } from '../script/request-scripts.js';
+/** The values of the secrets a request's scripts list. */
+export async function listedSecrets(names, getSecret) {
+    return names.length === 0 ? {} : resolveSecretTokens(names, getSecret);
+}
+/** A script's tests as a report's assertions. */
+export function scriptAssertions(tests) {
+    return tests.map((test) => ({
+        type: 'script',
+        label: test.name,
+        outcome: test.passed ? 'passed' : 'failed',
+        ...(test.message !== undefined ? { message: test.message } : {}),
+    }));
+}
+/**
+ * Adds a script's values to a run's values. A value marked secret, or holding a credential the run
+ * knows, is reported for masking first (ADR-0015).
+ */
+export function mergeScriptValues(target, values, onSecretValue, containsKnownSecret) {
+    for (const { name, value, secret } of values) {
+        if (secret || containsKnownSecret?.(value) === true)
+            onSecretValue?.(value);
+        target.set(name, value);
+    }
+}
+/**
+ * The scripts of one send of `scripted`. The run and the app both send through this, so a value a
+ * script marks secret is masked before anything about the send is shown, in either.
+ */
+export function scriptSession(scripting, scripted, values, options = {}) {
+    const tests = [];
+    const set = [];
+    const lines = [];
+    let truncated = false;
+    const collect = (outcome) => {
+        tests.push(...outcome.tests);
+        set.push(...outcome.values);
+        lines.push(...outcome.log.lines);
+        truncated ||= outcome.log.truncated;
+        for (const { value, secret } of outcome.values) {
+            if (secret || options.containsKnownSecret?.(value) === true)
+                options.onSecretValue?.(value);
+        }
+    };
+    return {
+        pre: async (before) => {
+            if (scripted.scripts.pre === undefined)
+                return before;
+            const outcome = await scripting.pre(scripted, before, values);
+            collect(outcome);
+            return (outcome.request ?? before);
+        },
+        post: async (sent, response) => {
+            let error;
+            if (scripted.scripts.post !== undefined) {
+                const later = { ...values, vars: { ...values.vars, ...Object.fromEntries(set.map((v) => [v.name, v.value])) } };
+                const outcome = await scripting.post(scripted, sent, response, later);
+                collect(outcome);
+                if (!outcome.ok) {
+                    const thrown = scriptError(outcome.error, scripting.fileOf(scripted, 'post'));
+                    error = { code: thrown.code, message: thrown.message };
+                }
+            }
+            return { tests, values: set, log: { lines, truncated }, ...(error !== undefined ? { error } : {}) };
+        },
+    };
+}

package/dist/run/secret-needs.d.ts

@@ -1,6 +1,9 @@
-import type { Project } from '../project/model.js';
+import type { Project, PropertyMap } from '../project/model.js';
+import type { ProtocolRegistry } from '../protocol/registry.js';
+import type { SelectedRequest } from '../protocols.js';
 import type { SecretNeed } from '../secrets/env-names.js';
-import type { SelectedRequest } from './select.js';
+import type { Workspace } from '../workspace/model.js';
+export { secretNamesInValue } from './send-helpers.js';
 /** One secret a run needs, and which requests need it. */
 export interface LocatedSecretNeed extends SecretNeed {
     /** Display paths of the requests that need it. */
@@ -8,6 +11,10 @@ export interface LocatedSecretNeed extends SecretNeed {
 }
 /**
  * The secrets `selected` needs, one entry per ref in first-use order, each with every request
- * that uses it. The first declaration of a ref supplies its name and purpose.
+ * that uses it. The first declaration of a ref supplies its name and purpose. `overrides` are the
+ * run's `--var` properties, laid over the environment's as a send lays them. With a `workspace`
+ * the scopes are the ones a send inside it expands against: the workspace's properties, and each
+ * workspace environment with its linked project environment. `registry` is the set of protocol
+ * modules asked for their needs; the built-in ones by default.
  */
-export declare function secretNeedsOf(selected: readonly SelectedRequest[], project: Project): LocatedSecretNeed[];
+export declare function secretNeedsOf(selected: readonly SelectedRequest[], project: Project, overrides?: PropertyMap, workspace?: Workspace, registry?: ProtocolRegistry): LocatedSecretNeed[];

package/dist/run/secret-needs.js

@@ -1,112 +1,64 @@
 /**
  * Every secret a selection of requests will ask for, found before anything is sent, so a pipeline
  * can be told which variables to set (`wirebench secrets list`) and a run knows which names to
- * read. It walks the same sources `prepareSend` resolves: effective auth, the request's keystore,
- * and the WS-Security configurations it selects, with the keystores those lead to.
+ * read. The generic part is here: every `${secret:name}` the request's own text reaches, and the
+ * secrets its scripts list. What a protocol's configuration needs (effective auth, the request's
+ * keystore, signing, WS-Security) is its module's answer, walking the same sources its send resolves.
  */
-import { toKeystoreDef } from '../project/keystores.js';
-import { toWssIncomingConfig, toWssOutgoingConfig } from '../project/wss-configs.js';
-import { secretNeedsOfAuth } from '../secrets/env-names.js';
-import { restEffectiveAuth, soapEffectiveAuth } from './effective-auth.js';
-const present = (id) => id !== undefined && id.length > 0;
-/** A keystore's password, when the registry entry has one; an unreadable entry needs nothing here. */
-function keystoreNeeds(project, keystoreId) {
-    if (!present(keystoreId)) {
-        return [];
-    }
-    const ref = project.wss.keystores.find((candidate) => candidate.id === keystoreId);
-    if (ref === undefined) {
-        return [];
-    }
-    try {
-        const def = toKeystoreDef(ref);
-        return present(def.passwordSecretRef)
-            ? [
-                {
-                    ref: def.passwordSecretRef,
-                    ...(def.passwordEnv !== undefined ? { envName: def.passwordEnv } : {}),
-                    purpose: `keystore password for "${def.name}"`,
-                },
-            ]
-            : [];
-    }
-    catch {
-        // `prepareSend` refuses such a request with its own error; it needs no secret before then.
-        return [];
-    }
-}
-/** Parses a WS-Security configuration by id; missing or unreadable is prepare's error, not a need. */
-function findConfig(refs, id, convert) {
-    if (!present(id)) {
-        return undefined;
-    }
-    const ref = refs.find((candidate) => candidate.id === id);
-    if (ref === undefined) {
-        return undefined;
-    }
-    try {
-        return convert(ref);
-    }
-    catch {
-        return undefined;
+import { resolveScopes } from '../project/environments.js';
+import { defaultRegistry } from '../protocols.js';
+import { activeScripts } from '../script/request-scripts.js';
+import { secretEnvName, secretPseudoRef } from '../secrets/secret-token.js';
+import { resolveWorkspaceScopes, withActiveEnvironment } from '../workspace/environments.js';
+import { secretNamesInValue } from './send-helpers.js';
+export { secretNamesInValue } from './send-helpers.js';
+function tokenNeeds(selected, scopeSets) {
+    // A script's own text is code, not a template: nothing in it is a reference. The secrets its
+    // request lists for `secrets.get` are needed instead (#63).
+    const { scripts, ...request } = selected.request;
+    const names = new Set(scopeSets.flatMap((scopes) => secretNamesInValue(request, scopes)));
+    for (const name of activeScripts(scripts)?.secrets ?? []) {
+        names.add(name);
     }
+    return [...names].map((name) => ({
+        ref: secretPseudoRef(name),
+        envName: secretEnvName(name),
+        purpose: `secret "${name}"`,
+    }));
 }
-/** WS-Security passwords carry no `…Env` name: they resolve through their ref-derived variable. */
-function outgoingNeeds(project, config) {
-    const needs = [];
-    for (const entry of config.entries) {
-        if (entry.kind === 'username-token') {
-            const ref = entry.passwordRef ?? config.defaultPasswordRef;
-            if (entry.passwordType !== 'none' && present(ref)) {
-                needs.push({ ref, purpose: `WS-Security password for "${entry.username}"` });
-            }
-        }
-        else if (entry.kind === 'signature') {
-            needs.push(...keystoreNeeds(project, entry.keystoreRef));
-            if (present(entry.keyPasswordRef)) {
-                needs.push({ ref: entry.keyPasswordRef, purpose: `WS-Security signing key password ("${config.name}")` });
-            }
-        }
-        else if (entry.kind === 'encryption') {
-            needs.push(...keystoreNeeds(project, entry.keystoreRef));
-        }
-    }
-    return needs;
+/** The generic needs of `selected`, then what its protocol's configuration needs. */
+function needsOf(selected, project, scopeSets, registry) {
+    const run = registry.find(selected.kind)?.run;
+    return [...tokenNeeds(selected, scopeSets), ...(run !== undefined ? run.secretNeeds(selected, project) : [])];
 }
-function incomingNeeds(project, config) {
-    return [
-        ...keystoreNeeds(project, config.decryptKeystoreRef),
-        ...(present(config.decryptKeyPasswordRef)
-            ? [{ ref: config.decryptKeyPasswordRef, purpose: `WS-Security decryption key password ("${config.name}")` }]
-            : []),
-        ...keystoreNeeds(project, config.signatureKeystoreRef),
-    ];
-}
-function needsOf(selected, project) {
-    if (selected.kind === 'rest') {
-        return [
-            ...secretNeedsOfAuth(restEffectiveAuth(selected)),
-            ...keystoreNeeds(project, selected.request.settings.sslKeystoreRef),
-        ];
-    }
-    const { request } = selected;
-    const outgoing = findConfig(project.wss.outgoing, request.wssOutgoingRef, toWssOutgoingConfig);
-    const incoming = findConfig(project.wss.incoming, request.wssIncomingRef, toWssIncomingConfig);
-    return [
-        ...secretNeedsOfAuth(soapEffectiveAuth(selected)),
-        ...keystoreNeeds(project, request.properties.sslKeystoreRef),
-        ...(outgoing !== undefined ? outgoingNeeds(project, outgoing) : []),
-        ...(incoming !== undefined ? incomingNeeds(project, incoming) : []),
-    ];
+/** A workspace's scopes with no environment active, then under each of its environments in turn. */
+function workspaceScopeSets(workspace, project) {
+    return [undefined, ...workspace.environments.map((environment) => environment.id)].map((environmentId) => resolveWorkspaceScopes({ workspace: withActiveEnvironment(workspace, environmentId), project, globals: {} }));
 }
 /**
  * The secrets `selected` needs, one entry per ref in first-use order, each with every request
- * that uses it. The first declaration of a ref supplies its name and purpose.
+ * that uses it. The first declaration of a ref supplies its name and purpose. `overrides` are the
+ * run's `--var` properties, laid over the environment's as a send lays them. With a `workspace`
+ * the scopes are the ones a send inside it expands against: the workspace's properties, and each
+ * workspace environment with its linked project environment. `registry` is the set of protocol
+ * modules asked for their needs; the built-in ones by default.
  */
-export function secretNeedsOf(selected, project) {
+export function secretNeedsOf(selected, project, overrides = {}, workspace, registry = defaultRegistry()) {
     const byRef = new Map();
+    // A token a property holds counts whichever environment a run picks: project properties alone,
+    // then each environment laid over them. No process environment, so this stays pure.
+    const withOverrides = (scopes) => ({
+        ...scopes,
+        env: { ...(scopes.env ?? {}), ...overrides },
+    });
+    const scopeSets = (workspace === undefined
+        ? [
+            resolveScopes(project, undefined, {}, {}),
+            ...project.environments.map((environment) => resolveScopes(project, environment.id, {}, {})),
+        ]
+        : workspaceScopeSets(workspace, project)).map(withOverrides);
     for (const item of selected) {
-        for (const need of needsOf(item, project)) {
+        for (const need of needsOf(item, project, scopeSets, registry)) {
             const known = byRef.get(need.ref);
             if (known === undefined) {
                 byRef.set(need.ref, { need, usedBy: [item.path] });

package/dist/run/select.d.ts

@@ -1,34 +1,43 @@
 /**
  * Which requests a run covers, and in what order: the order the explorer shows, so a report reads
- * like the project. Interfaces and APIs share one ordering space (see `Project.apis`).
+ * like the project. Every container shares one ordering space (see `Project.apis`). The requests
+ * themselves come from the protocol modules: nothing here names a protocol.
  */
-import type { Interface, OperationDef, Project, SoapRequestDef } from '../project/model.js';
-import type { RestApi, RestFolder, RestRequestDef } from '../rest/model.js';
-/** One saved request selected for a run, with enough context to send and report it. */
-export type SelectedRequest = {
-    readonly kind: 'soap';
-    readonly path: string;
-    readonly group: string;
-    readonly iface: Interface;
-    readonly operation: OperationDef;
-    readonly request: SoapRequestDef;
-} | {
-    readonly kind: 'rest';
-    readonly path: string;
-    readonly group: string;
-    readonly api: RestApi;
-    readonly chain: readonly RestFolder[];
-    readonly request: RestRequestDef;
-};
+import type { Project } from '../project/model.js';
+import type { ProtocolRegistry } from '../protocol/registry.js';
+import type { SelectedRequest } from '../protocols.js';
+export type { SelectedRequest } from '../protocols.js';
 /**
  * Resolves `selectors` (display paths or on-disk paths, matched at a `/` boundary) against the
- * project's requests, in explorer order. An empty `selectors` list selects everything. A gRPC or
- * WebSocket API is skipped: neither is runnable from the command line in this slice, and there is
- * no per-selector reason to report — a selector naming one simply matches nothing and surfaces
- * through `unmatched`, same as a typo would. `unmatched` lists every selector that covered no
- * request, so the runner can refuse the run rather than quietly test nothing.
+ * project's requests, in explorer order. An empty `selectors` list selects everything but the webhook
+ * items: those deliver to a receiver rather than test an API, so a run sends one only when a selector
+ * covers it (`Webhooks/…` or `webhooks/requests/…`). A gRPC request that streams, and a request its
+ * contract no longer has, are skipped: neither is runnable from the command line yet, and there is no
+ * per-selector reason to report — a selector naming one simply matches nothing and surfaces through
+ * `unmatched`, same as a typo would. `unmatched` lists every selector that covered no request, so the
+ * runner can refuse the run rather than quietly test nothing.
+ *
+ * `registry` is the set of protocol modules asked for their requests; the built-in ones by default.
  */
-export declare function selectRequests(project: Project, selectors: readonly string[]): {
+export declare function selectRequests(project: Project, selectors: readonly string[], registry?: ProtocolRegistry): {
     selected: SelectedRequest[];
     unmatched: string[];
 };
+/** Where a sequence step's request id leads. */
+export type StepRequestLookup = {
+    readonly kind: 'found';
+    readonly selected: SelectedRequest;
+} | {
+    readonly kind: 'missing';
+} | {
+    readonly kind: 'unsupported';
+    readonly reason: string;
+};
+/**
+ * Finds the request a sequence step names by id, among the requests a run can send, with the same
+ * context `selectRequests` gives. A request that exists but cannot run (a webhook item, a streaming
+ * gRPC call, one orphaned by its contract) says why, so the step errors with a reason rather than as
+ * missing. Every module is asked for a reason before any candidate is looked
+ * at: a webhook item is a candidate of a run, and still not a step.
+ */
+export declare function findStepRequest(project: Project, requestId: string, registry?: ProtocolRegistry): StepRequestLookup;

package/dist/run/select.js

@@ -1,48 +1,18 @@
-const byOrder = (a, b) => a.order - b.order || a.name.localeCompare(b.name);
-function walkRest(api, chain, node, group, diskDir, out) {
-    const children = [
-        ...node.requests.map((request) => ({
-            tag: 'request',
-            order: request.order,
-            name: request.name,
-            request,
-        })),
-        ...node.folders.map((folder) => ({ tag: 'folder', order: folder.order, name: folder.name, folder })),
-    ].sort(byOrder);
-    for (const child of children) {
-        if (child.tag === 'request') {
-            if (child.request.orphaned !== true) {
-                out.push({
-                    item: { kind: 'rest', path: `${group}/${child.request.name}`, group, api, chain, request: child.request },
-                    diskPath: `${diskDir}/${child.request.slug}`,
-                });
-            }
-        }
-        else {
-            walkRest(api, [...chain, child.folder], child.folder, `${group}/${child.folder.name}`, `${diskDir}/${child.folder.slug}`, out);
-        }
-    }
-}
-function candidates(project) {
-    const out = [];
-    for (const container of [...project.interfaces, ...project.apis].sort(byOrder)) {
-        if (container.kind === 'rest') {
-            walkRest(container, [], container, container.name, `apis/${container.slug}/requests`, out);
-            continue;
-        }
-        for (const operation of [...container.operations].sort(byOrder)) {
-            const group = `${container.name}/${operation.name}`;
-            for (const request of [...operation.requests].sort(byOrder)) {
-                if (request.orphaned !== true) {
-                    out.push({
-                        item: { kind: 'soap', path: `${group}/${request.name}`, group, iface: container, operation, request },
-                        diskPath: `interfaces/${container.slug}/operations/${operation.slug}/${request.slug}`,
-                    });
-                }
-            }
-        }
-    }
-    return out;
+import { defaultRegistry } from '../protocols.js';
+import { byOrder } from './tree.js';
+/**
+ * A module's selection under the built-in union. A registry may hold a module that is not built in;
+ * its items travel under this type too, and a caller that narrows on `kind` simply never matches them.
+ */
+const asSelected = (item) => item;
+/** Every runnable request, container by container in explorer order, `explicitOnly` groups last. */
+function candidates(project, registry) {
+    const groups = registry.modules.flatMap((module) => module.run?.groups(project) ?? []);
+    const inOrder = [
+        ...groups.filter((group) => group.explicitOnly !== true).sort(byOrder),
+        ...groups.filter((group) => group.explicitOnly === true).sort(byOrder),
+    ];
+    return inOrder.flatMap((group) => group.candidates.map(({ item, diskPath }) => ({ item, diskPath, explicitOnly: group.explicitOnly === true })));
 }
 function normalise(selector) {
     return selector
@@ -54,23 +24,44 @@ function normalise(selector) {
 const covers = (selector, candidate) => candidate === selector || candidate.startsWith(`${selector}/`);
 /**
  * Resolves `selectors` (display paths or on-disk paths, matched at a `/` boundary) against the
- * project's requests, in explorer order. An empty `selectors` list selects everything. A gRPC or
- * WebSocket API is skipped: neither is runnable from the command line in this slice, and there is
- * no per-selector reason to report — a selector naming one simply matches nothing and surfaces
- * through `unmatched`, same as a typo would. `unmatched` lists every selector that covered no
- * request, so the runner can refuse the run rather than quietly test nothing.
+ * project's requests, in explorer order. An empty `selectors` list selects everything but the webhook
+ * items: those deliver to a receiver rather than test an API, so a run sends one only when a selector
+ * covers it (`Webhooks/…` or `webhooks/requests/…`). A gRPC request that streams, and a request its
+ * contract no longer has, are skipped: neither is runnable from the command line yet, and there is no
+ * per-selector reason to report — a selector naming one simply matches nothing and surfaces through
+ * `unmatched`, same as a typo would. `unmatched` lists every selector that covered no request, so the
+ * runner can refuse the run rather than quietly test nothing.
+ *
+ * `registry` is the set of protocol modules asked for their requests; the built-in ones by default.
  */
-export function selectRequests(project, selectors) {
-    const all = candidates(project);
+export function selectRequests(project, selectors, registry = defaultRegistry()) {
+    const all = candidates(project, registry);
     if (selectors.length === 0) {
-        return { selected: all.map((c) => c.item), unmatched: [] };
+        return { selected: all.filter((c) => !c.explicitOnly).map((c) => asSelected(c.item)), unmatched: [] };
     }
     const matches = (selector, c) => {
         const s = normalise(selector);
         return covers(s, c.item.path) || covers(s, c.diskPath);
     };
     return {
-        selected: all.filter((c) => selectors.some((s) => matches(s, c))).map((c) => c.item),
+        selected: all.filter((c) => selectors.some((s) => matches(s, c))).map((c) => asSelected(c.item)),
         unmatched: selectors.filter((s) => !all.some((c) => matches(s, c))),
     };
 }
+/**
+ * Finds the request a sequence step names by id, among the requests a run can send, with the same
+ * context `selectRequests` gives. A request that exists but cannot run (a webhook item, a streaming
+ * gRPC call, one orphaned by its contract) says why, so the step errors with a reason rather than as
+ * missing. Every module is asked for a reason before any candidate is looked
+ * at: a webhook item is a candidate of a run, and still not a step.
+ */
+export function findStepRequest(project, requestId, registry = defaultRegistry()) {
+    for (const module of registry.modules) {
+        const reason = module.run?.whyNotRunnable(project, requestId);
+        if (reason !== undefined) {
+            return { kind: 'unsupported', reason };
+        }
+    }
+    const runnable = candidates(project, registry).find((candidate) => candidate.item.request.id === requestId);
+    return runnable !== undefined ? { kind: 'found', selected: asSelected(runnable.item) } : { kind: 'missing' };
+}

package/dist/run/send-helpers.d.ts

@@ -0,0 +1,93 @@
+import { WirebenchError } from '../errors.js';
+import type { TlsOptions } from '../http/types.js';
+import type { BaseUrlSource } from '../project/environments.js';
+import type { AuthConfig, Project } from '../project/model.js';
+import type { PropertyScopes, UnresolvedRef } from '../project/properties.js';
+import type { SecretPlaceholders } from '../script/send.js';
+import type { SecretNeed } from '../secrets/env-names.js';
+import { resolveAuthConfig } from '../secrets/resolve.js';
+import type { GetSecret } from '../secrets/resolve.js';
+import type { SendAuth } from '../http/auth/send-auth.js';
+import type { Keystore } from '../keystore/index.js';
+import type { RunContext } from './context.js';
+import type { RunTokenSource } from './oauth2-token.js';
+/**
+ * The `${secret:name}` names anywhere in `value`'s strings — a send input or a saved request —
+ * following property values through `scopes`, in first-use order. Binary data is skipped.
+ */
+export declare function secretNamesInValue(value: unknown, scopes?: PropertyScopes): string[];
+/**
+ * `scopes` with the value of every `${secret:name}` token `input` reaches. Each value comes from
+ * `getSecret`, so a host that masks what it hands out (the CLI's `createEnvSecrets`) masks these too.
+ */
+export declare function withSecrets(input: unknown, scopes: PropertyScopes, getSecret: GetSecret, placeholders?: SecretPlaceholders): Promise<PropertyScopes>;
+/** A send resolved (spec §3.4): what it would send, and the references nothing resolves in it. */
+export interface Resolved<I> {
+    readonly input: I;
+    readonly unresolved: readonly UnresolvedRef[];
+}
+/**
+ * The refusal for a request whose text holds property references nothing resolves, under the code
+ * its protocol raises (spec §8).
+ */
+export declare function unresolvedError(code: string, path: string, unresolved: readonly UnresolvedRef[]): WirebenchError;
+/**
+ * `path` resolved against the project folder, refused when it lands outside it. The app also
+ * accepts a file its user picked through a dialog; a pipeline has no such user, so the project
+ * folder is the whole boundary.
+ */
+export declare function insideProject(context: RunContext, path: string, code: string, name: string): Promise<string>;
+/** A keystore by its entry id: through the host's loader when it lends one, else from the project folder. */
+export declare function keystoreFor(context: RunContext, keystoreId: string): Promise<Keystore | undefined>;
+/** The `cert`/`key` a request's own keystore presents; there is no global keystore in a run. */
+export declare function clientIdentityFor(context: RunContext, keystoreId: string | undefined): Promise<TlsOptions | undefined>;
+/** Identity, then the only two trust opt-outs a run honours: `--insecure` and the file's own flag. */
+export declare function tlsFor(context: RunContext, keystoreId: string | undefined, trustInvalid: boolean): Promise<TlsOptions | undefined>;
+/** The run's shared token source, or a fresh one for a send outside a run. */
+export declare function tokenSourceOf(context: RunContext): RunTokenSource;
+/**
+ * A request's effective auth with its secrets resolved. OAuth2 client credentials obtains a token
+ * (the token request uses the request's own TLS, the proxy for the token URL and the run's
+ * timeout); the authorization-code grant needs a browser a pipeline does not have, and is refused.
+ *
+ * @throws WirebenchError `auth-grant-unsupported` | `secret-missing` | `unresolved-properties` |
+ * `oauth2-token-error` | `oauth2-token-malformed`
+ */
+export declare function authFor(configured: AuthConfig, path: string, context: RunContext, tls: TlsOptions | undefined): Promise<Awaited<ReturnType<typeof resolveAuthConfig>>>;
+/**
+ * Tells the host each credential a resolved auth puts on the wire, in the form it travels there,
+ * so a server that echoes one back has it masked: an API key's value, a bearer or OAuth2 access
+ * token, and Basic's `base64(user:password)`. A password is never reported bare — people choose
+ * them, so one is often ordinary text — and NTLM's password never travels at all.
+ */
+export declare function reportedAuth(auth: SendAuth | undefined, context: RunContext): SendAuth | undefined;
+/**
+ * An API's base URL (or target) and where it came from, through the workspace's environment when
+ * the run has a workspace: what a preview reports beside the URL.
+ */
+export declare function resolvedBaseUrl(context: Pick<RunContext, 'project' | 'environmentId' | 'workspace'>, api: {
+    readonly slug: string;
+    readonly baseUrl: string;
+}): {
+    readonly url: string;
+    readonly source: BaseUrlSource;
+};
+/** An API's base URL (or target), through the workspace's environment likewise. */
+export declare function baseUrlFor(context: RunContext, api: {
+    readonly slug: string;
+    readonly baseUrl: string;
+}): string;
+/**
+ * After a server refused the credentials a send carried, drops the run's OAuth2 token among them,
+ * so the next request behind that configuration fetches a new one instead of repeating the refusal.
+ * The refused request itself is never sent again.
+ */
+export declare function dropRefusedToken(context: RunContext, auth: SendAuth | undefined, refused: boolean): void;
+/** The origin a request went to, as a sent request reports it; nothing for a URL without one. */
+export declare function originOf(url: string): {
+    readonly origin?: string;
+};
+/** True for a reference that is set: neither absent nor empty. */
+export declare const present: (id: string | undefined) => id is string;
+/** A keystore's password, when the registry entry has one; an unreadable entry needs nothing here. */
+export declare function keystoreNeeds(project: Project, keystoreId: string | undefined): SecretNeed[];