@wirebench/engine 2.2.1 → 3.1.0-rc.1

package/dist/secrets/scan/walk.d.ts

@@ -0,0 +1,70 @@
+import type { Project } from '../../project/model.js';
+import type { DetectContext, SecretRule } from './rules.js';
+/**
+ * Where a finding's value is stored. The finding's `valueStart`/`valueEnd` index into that stored
+ * text: the entry's value for the keyed kinds and the properties, the text itself for the others.
+ *
+ * Beyond the spec's fields, `index` pins a keyed entry by its position in its list (names may
+ * repeat), `field` is the position of the form field or multipart text part a `rest-body` finding
+ * sits in and `name` that field's name (both absent for a raw body), and `messageId` names the
+ * saved message of a `ws-message` finding. `rest-url` and `ws-url` are the request's URL text, with
+ * `name` the query parameter a finding in it sits under (absent for any other finding in the URL,
+ * a userinfo password included); `rest-query` and `ws-query` are its query table.
+ * `grpc-api-metadata` and `ws-api-header` are the entries set on the API itself, sent by every
+ * request in it.
+ */
+export type SecretLocation = {
+    readonly kind: 'soap-header' | 'rest-header' | 'rest-query' | 'grpc-metadata' | 'ws-header' | 'ws-query';
+    readonly requestId: string;
+    readonly name: string;
+    readonly index: number;
+} | {
+    readonly kind: 'grpc-api-metadata' | 'ws-api-header';
+    readonly apiId: string;
+    readonly name: string;
+    readonly index: number;
+} | {
+    readonly kind: 'rest-body';
+    readonly requestId: string;
+    readonly field?: number;
+    readonly name?: string;
+} | {
+    readonly kind: 'soap-body' | 'grpc-message';
+    readonly requestId: string;
+} | {
+    readonly kind: 'rest-url' | 'ws-url';
+    readonly requestId: string;
+    readonly name?: string;
+} | {
+    readonly kind: 'ws-message';
+    readonly requestId: string;
+    readonly messageId: string;
+} | {
+    readonly kind: 'project-property';
+    readonly name: string;
+} | {
+    readonly kind: 'env-property';
+    readonly environmentId: string;
+    readonly name: string;
+};
+export interface SecretFinding {
+    /** sha256 of the location and value, hex, first 16 characters: stable while neither changes. */
+    readonly id: string;
+    readonly location: SecretLocation;
+    readonly rule: SecretRule;
+    /** Display path, `Billing API › GET /invoices › header Authorization`. */
+    readonly label: string;
+    readonly valueStart: number;
+    readonly valueEnd: number;
+    /** The credential itself; never crosses IPC (the wire shape carries `maskedPreview`). */
+    readonly value: string;
+}
+/** One stored text to scan. */
+export interface ScanTarget {
+    readonly location: SecretLocation;
+    readonly label: string;
+    readonly text: string;
+    readonly context: DetectContext;
+}
+/** Every scannable stored text in `project`, in explorer order within each container kind. */
+export declare function scanTargets(project: Project): Generator<ScanTarget>;

package/dist/secrets/scan/walk.js

@@ -0,0 +1,156 @@
+const SEP = ' › ';
+function* keyed(kind, ownerId, path, noun, nameKind, entries) {
+    for (let index = 0; index < entries.length; index++) {
+        const { name, value } = entries[index];
+        if (value === '')
+            continue;
+        yield {
+            location: kind === 'grpc-api-metadata' || kind === 'ws-api-header'
+                ? { kind, apiId: ownerId, name, index }
+                : { kind, requestId: ownerId, name, index },
+            label: `${path}${SEP}${noun} ${name}`,
+            text: value,
+            context: { fieldName: name, nameKind },
+        };
+    }
+}
+function rawContentType(body) {
+    if (body.contentType !== undefined)
+        return body.contentType;
+    if (body.language === 'json')
+        return 'application/json';
+    if (body.language === 'xml')
+        return 'application/xml';
+    return 'text/plain';
+}
+function* restBody(request, path) {
+    const { body } = request;
+    if (body.kind === 'raw') {
+        if (body.text !== '') {
+            yield {
+                location: { kind: 'rest-body', requestId: request.id },
+                label: `${path}${SEP}body`,
+                text: body.text,
+                context: { contentType: rawContentType(body) },
+            };
+        }
+        return;
+    }
+    const fields = body.kind === 'form' ? body.fields : body.kind === 'multipart' ? body.parts : [];
+    for (let field = 0; field < fields.length; field++) {
+        const entry = fields[field];
+        if (!('value' in entry) || entry.value === '')
+            continue;
+        yield {
+            location: { kind: 'rest-body', requestId: request.id, field, name: entry.name },
+            label: `${path}${SEP}body field ${entry.name}`,
+            text: entry.value,
+            context: { fieldName: entry.name, nameKind: 'field' },
+        };
+    }
+}
+/** A request's URL, scanned for its query parameters as form pairs and for any shape. */
+function url(kind, requestId, path, text) {
+    return {
+        location: { kind, requestId },
+        label: `${path}${SEP}URL`,
+        text,
+        context: { contentType: 'application/x-www-form-urlencoded', nameKind: 'query' },
+    };
+}
+function* restRequest(request, prefix) {
+    const path = `${prefix}${SEP}${request.name}`;
+    if (request.url !== '')
+        yield url('rest-url', request.id, path, request.url);
+    yield* keyed('rest-query', request.id, path, 'query', 'query', request.query);
+    yield* keyed('rest-header', request.id, path, 'header', 'header', request.headers);
+    yield* restBody(request, path);
+}
+function* grpcRequest(request, prefix) {
+    const path = `${prefix}${SEP}${request.name}`;
+    yield* keyed('grpc-metadata', request.id, path, 'metadata', 'header', request.metadata);
+    if (request.message !== '') {
+        yield {
+            location: { kind: 'grpc-message', requestId: request.id },
+            label: `${path}${SEP}message`,
+            text: request.message,
+            context: { contentType: 'application/json' },
+        };
+    }
+}
+function* wsRequest(request, prefix) {
+    const path = `${prefix}${SEP}${request.name}`;
+    if (request.url !== '')
+        yield url('ws-url', request.id, path, request.url);
+    yield* keyed('ws-query', request.id, path, 'query', 'query', request.query);
+    yield* keyed('ws-header', request.id, path, 'header', 'header', request.headers);
+    for (const message of request.messages) {
+        if (message.format !== 'text' || message.content === '')
+            continue;
+        yield {
+            location: { kind: 'ws-message', requestId: request.id, messageId: message.id },
+            label: `${path}${SEP}message ${message.name}`,
+            text: message.content,
+            context: {},
+        };
+    }
+}
+function* tree(node, prefix, visit) {
+    for (const request of node.requests)
+        yield* visit(request, prefix);
+    for (const folder of node.folders)
+        yield* tree(folder, `${prefix}${SEP}${folder.name}`, visit);
+}
+/** Every scannable stored text in `project`, in explorer order within each container kind. */
+export function* scanTargets(project) {
+    for (const [name, value] of Object.entries(project.properties)) {
+        if (value === '')
+            continue;
+        yield {
+            location: { kind: 'project-property', name },
+            label: `${project.name}${SEP}property ${name}`,
+            text: value,
+            context: { fieldName: name, nameKind: 'property' },
+        };
+    }
+    for (const env of project.environments) {
+        for (const [name, value] of Object.entries(env.properties)) {
+            if (value === '')
+                continue;
+            yield {
+                location: { kind: 'env-property', environmentId: env.id, name },
+                label: `Environment ${env.name}${SEP}property ${name}`,
+                text: value,
+                context: { fieldName: name, nameKind: 'property' },
+            };
+        }
+    }
+    for (const iface of project.interfaces) {
+        for (const operation of iface.operations) {
+            for (const request of operation.requests) {
+                const path = `${iface.name}${SEP}${operation.name}${SEP}${request.name}`;
+                yield* keyed('soap-header', request.id, path, 'header', 'header', request.headers);
+                if (request.envelopeXml !== '') {
+                    yield {
+                        location: { kind: 'soap-body', requestId: request.id },
+                        label: `${path}${SEP}envelope`,
+                        text: request.envelopeXml,
+                        context: { contentType: 'text/xml' },
+                    };
+                }
+            }
+        }
+    }
+    for (const api of project.apis)
+        yield* tree(api, api.name, restRequest);
+    if (project.webhooks !== undefined)
+        yield* tree(project.webhooks, 'Webhooks', restRequest);
+    for (const api of project.grpcApis) {
+        yield* keyed('grpc-api-metadata', api.id, api.name, 'metadata', 'header', api.metadata);
+        yield* tree(api, api.name, grpcRequest);
+    }
+    for (const api of project.wsApis) {
+        yield* keyed('ws-api-header', api.id, api.name, 'header', 'header', api.headers);
+        yield* tree(api, api.name, wsRequest);
+    }
+}

package/dist/secrets/secret-refs.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The keychain references (`sec_…`) a model carries, wherever they sit: an auth's `passwordRef`, a
+ * `tokenRef`, a `valueRef`, an OAuth client secret. Team secrets back-fill the vault from them (§3.1).
+ * Pure: no I/O.
+ */
+/** The shape `SecretStore` mints (`sec_` and lowercase hex); a little looser, so an older ref still counts. */
+export declare const SECRET_REF_PATTERN: RegExp;
+export declare function secretRefsInValue(value: unknown): string[];

package/dist/secrets/secret-refs.js

@@ -0,0 +1,25 @@
+/**
+ * The keychain references (`sec_…`) a model carries, wherever they sit: an auth's `passwordRef`, a
+ * `tokenRef`, a `valueRef`, an OAuth client secret. Team secrets back-fill the vault from them (§3.1).
+ * Pure: no I/O.
+ */
+/** The shape `SecretStore` mints (`sec_` and lowercase hex); a little looser, so an older ref still counts. */
+export const SECRET_REF_PATTERN = /^sec_[0-9a-z]{16,64}$/;
+export function secretRefsInValue(value) {
+    const found = new Set();
+    const visit = (current) => {
+        if (typeof current === 'string') {
+            if (SECRET_REF_PATTERN.test(current)) {
+                found.add(current);
+            }
+        }
+        else if (Array.isArray(current)) {
+            current.forEach(visit);
+        }
+        else if (current !== null && typeof current === 'object' && !ArrayBuffer.isView(current)) {
+            Object.values(current).forEach(visit);
+        }
+    };
+    visit(value);
+    return [...found];
+}

package/dist/secrets/secret-token.d.ts

@@ -0,0 +1,17 @@
+/**
+ * The `${secret:name}` token: the file-visible form of a value stored in the keychain-backed
+ * secret store. `name` is stable across machines (unlike the store's opaque `sec_…` ref) and is
+ * what CI sets through `WIREBENCH_SECRET_<NAME>`. See docs/specs/2026-09-22-secret-scanning-design.md.
+ *
+ * Pure module: no I/O, no dependency on the rest of the engine.
+ */
+/** A secret name: a valid environment-variable suffix. */
+export declare const SECRET_NAME_PATTERN: RegExp;
+/** The literal `${secret:name}` text to write into a project file in place of a value. */
+export declare function secretToken(name: string): string;
+/** The pseudo-ref passed to a `GetSecret` resolver for a secret named `name`. */
+export declare function secretPseudoRef(name: string): string;
+/** The name inside a `secret:<name>` pseudo-ref, or `undefined` when `ref` isn't one. */
+export declare function parseSecretPseudoRef(ref: string): string | undefined;
+/** The `WIREBENCH_SECRET_<NAME>` environment variable suffix for a secret named `name`. */
+export declare function secretEnvName(name: string): string;

package/dist/secrets/secret-token.js

@@ -0,0 +1,25 @@
+/**
+ * The `${secret:name}` token: the file-visible form of a value stored in the keychain-backed
+ * secret store. `name` is stable across machines (unlike the store's opaque `sec_…` ref) and is
+ * what CI sets through `WIREBENCH_SECRET_<NAME>`. See docs/specs/2026-09-22-secret-scanning-design.md.
+ *
+ * Pure module: no I/O, no dependency on the rest of the engine.
+ */
+/** A secret name: a valid environment-variable suffix. */
+export const SECRET_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** The literal `${secret:name}` text to write into a project file in place of a value. */
+export function secretToken(name) {
+    return `\${secret:${name}}`;
+}
+/** The pseudo-ref passed to a `GetSecret` resolver for a secret named `name`. */
+export function secretPseudoRef(name) {
+    return `secret:${name}`;
+}
+/** The name inside a `secret:<name>` pseudo-ref, or `undefined` when `ref` isn't one. */
+export function parseSecretPseudoRef(ref) {
+    return ref.startsWith('secret:') ? ref.slice('secret:'.length) : undefined;
+}
+/** The `WIREBENCH_SECRET_<NAME>` environment variable suffix for a secret named `name`. */
+export function secretEnvName(name) {
+    return name.toUpperCase();
+}

package/dist/sequence/file.d.ts

@@ -0,0 +1,169 @@
+/**
+ * `sequences/<slug>.sequence.yaml`: parsing, validation and serialisation of one sequence file.
+ *
+ * The file may come from a teammate or a branch just pulled, so it is untrusted input: its size is
+ * checked before it is parsed, it is parsed with the project's YAML parser (core schema, aliases capped
+ * by the library), and every count is bounded by {@link SEQUENCE_LIMITS}. It names requests only by id,
+ * so nothing in it can name a path on disk.
+ *
+ * Like every project schema, objects are `looseObject`: an unknown key is ignored and not written back.
+ * That is only safe because a file whose `version` is newer than {@link SEQUENCE_VERSION} is refused
+ * whole rather than read in part, and a refused file is never deleted by a save (`save.ts`).
+ */
+import { z } from 'zod';
+import type { SequenceDef } from './model.js';
+/** Directory holding every sequence file, beside `interfaces/` and `apis/`. */
+export declare const SEQUENCES_DIR = "sequences";
+/** Suffix identifying a sequence file. */
+export declare const SEQUENCE_SUFFIX = ".sequence.yaml";
+/** One sequence file, after its `kind` and `version` have been checked. */
+export declare const sequenceFileSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"sequence">;
+    version: z.ZodLiteral<1>;
+    id: z.ZodString;
+    name: z.ZodString;
+    order: z.ZodNumber;
+    description: z.ZodOptional<z.ZodString>;
+    settings: z.ZodDefault<z.ZodObject<{
+        stopOnFailure: z.ZodDefault<z.ZodBoolean>;
+        stepTimeoutMs: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$loose>>;
+    steps: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodOptional<z.ZodString>;
+        request: z.ZodString;
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        requestAssertions: z.ZodDefault<z.ZodBoolean>;
+        transfers: z.ZodDefault<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            from: z.ZodLiteral<"body">;
+            language: z.ZodEnum<{
+                xpath: "xpath";
+                xquery: "xquery";
+                jsonpath: "jsonpath";
+            }>;
+            expression: z.ZodString;
+            namespaces: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            name: z.ZodString;
+            secret: z.ZodOptional<z.ZodBoolean>;
+            optional: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$loose>, z.ZodObject<{
+            from: z.ZodLiteral<"header">;
+            header: z.ZodString;
+            name: z.ZodString;
+            secret: z.ZodOptional<z.ZodBoolean>;
+            optional: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$loose>, z.ZodObject<{
+            from: z.ZodLiteral<"status">;
+            name: z.ZodString;
+            secret: z.ZodOptional<z.ZodBoolean>;
+            optional: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$loose>, z.ZodObject<{
+            from: z.ZodLiteral<"cookie">;
+            cookie: z.ZodString;
+            name: z.ZodString;
+            secret: z.ZodOptional<z.ZodBoolean>;
+            optional: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$loose>], "from">>>;
+        assertions: z.ZodDefault<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"status">;
+            equals: z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodNumber, z.ZodNumber, z.ZodString, z.ZodEnum<{
+                [x: string]: string;
+            }>]>, z.ZodArray<z.ZodUnion<readonly [z.ZodNumber, z.ZodNumber, z.ZodString, z.ZodEnum<{
+                [x: string]: string;
+            }>]>>]>;
+            name: z.ZodOptional<z.ZodString>;
+        }, z.core.$loose>, z.ZodObject<{
+            type: z.ZodLiteral<"soap-fault">;
+            expect: z.ZodDefault<z.ZodEnum<{
+                none: "none";
+                present: "present";
+            }>>;
+            name: z.ZodOptional<z.ZodString>;
+        }, z.core.$loose>, z.ZodObject<{
+            type: z.ZodLiteral<"match">;
+            language: z.ZodEnum<{
+                xpath: "xpath";
+                xquery: "xquery";
+                jsonpath: "jsonpath";
+            }>;
+            expression: z.ZodString;
+            namespaces: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            equals: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+            matches: z.ZodOptional<z.ZodString>;
+            exists: z.ZodOptional<z.ZodBoolean>;
+            name: z.ZodOptional<z.ZodString>;
+        }, z.core.$loose>, z.ZodObject<{
+            type: z.ZodLiteral<"schema">;
+            name: z.ZodOptional<z.ZodString>;
+        }, z.core.$loose>, z.ZodObject<{
+            type: z.ZodLiteral<"sla">;
+            maxMs: z.ZodNumber;
+            name: z.ZodOptional<z.ZodString>;
+        }, z.core.$loose>, z.ZodObject<{
+            type: z.ZodLiteral<"header">;
+            header: z.ZodString;
+            equals: z.ZodOptional<z.ZodString>;
+            matches: z.ZodOptional<z.ZodString>;
+            exists: z.ZodOptional<z.ZodBoolean>;
+            name: z.ZodOptional<z.ZodString>;
+        }, z.core.$loose>, z.ZodObject<{
+            type: z.ZodLiteral<"callback">;
+            catchUrl: z.ZodString;
+            withinMs: z.ZodDefault<z.ZodNumber>;
+            match: z.ZodDefault<z.ZodObject<{
+                method: z.ZodOptional<z.ZodString>;
+                path: z.ZodOptional<z.ZodString>;
+                pathMatches: z.ZodOptional<z.ZodString>;
+                headers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    equals: z.ZodOptional<z.ZodString>;
+                    matches: z.ZodOptional<z.ZodString>;
+                    exists: z.ZodOptional<z.ZodBoolean>;
+                    name: z.ZodString;
+                }, z.core.$loose>>>;
+                body: z.ZodOptional<z.ZodObject<{
+                    equals: z.ZodOptional<z.ZodString>;
+                    matches: z.ZodOptional<z.ZodString>;
+                    exists: z.ZodOptional<z.ZodBoolean>;
+                    language: z.ZodEnum<{
+                        xpath: "xpath";
+                        jsonpath: "jsonpath";
+                    }>;
+                    path: z.ZodString;
+                }, z.core.$loose>>;
+            }, z.core.$loose>>;
+            expect: z.ZodDefault<z.ZodArray<z.ZodObject<{
+                body: z.ZodOptional<z.ZodObject<{
+                    equals: z.ZodOptional<z.ZodString>;
+                    matches: z.ZodOptional<z.ZodString>;
+                    exists: z.ZodOptional<z.ZodBoolean>;
+                    language: z.ZodEnum<{
+                        xpath: "xpath";
+                        jsonpath: "jsonpath";
+                    }>;
+                    path: z.ZodString;
+                }, z.core.$loose>>;
+                header: z.ZodOptional<z.ZodObject<{
+                    equals: z.ZodOptional<z.ZodString>;
+                    matches: z.ZodOptional<z.ZodString>;
+                    exists: z.ZodOptional<z.ZodBoolean>;
+                    name: z.ZodString;
+                }, z.core.$loose>>;
+                signature: z.ZodOptional<z.ZodLiteral<"verified">>;
+            }, z.core.$loose>>>;
+            name: z.ZodOptional<z.ZodString>;
+        }, z.core.$loose>], "type">>>;
+    }, z.core.$loose>>>;
+}, z.core.$loose>;
+/** The relative path of a sequence's file. */
+export declare function sequenceFilePath(slug: string): string;
+/** The slug a sequence file's name gives it, or `undefined` for a name that is not a sequence file. */
+export declare function sequenceSlugOf(fileName: string): string | undefined;
+/**
+ * Parses one sequence file.
+ *
+ * @throws ProjectError `sequence-file-invalid` (too large, malformed YAML, not a sequence, or failing the
+ * schema or a limit), `sequence-version-too-new` (a `version` above {@link SEQUENCE_VERSION})
+ */
+export declare function parseSequenceFile(bytes: Uint8Array | string, file: string, slug: string): SequenceDef;
+/** Serialises a sequence as its file's content: keys sorted, defaults omitted, steps in order. */
+export declare function sequenceDocument(sequence: SequenceDef): string;