@wirebench/engine 2.2.1 → 3.1.0-rc.1

package/dist/xsd/locate.d.ts

@@ -1,36 +1,8 @@
 import type { QName } from '../wsdl/qname.js';
 import type { ElementDecl, ResolvedAttribute, SourceRef } from './model.js';
 import type { SchemaSet } from './schema-set.js';
-/** A half-open character range in a text document. */
-export interface TextRange {
-    readonly start: number;
-    readonly end: number;
-}
-/** What the completion provider needs to offer children of the element the cursor is in. */
-export interface CompletionContext {
-    /** Ancestor chain of the element that would contain the completed child, outermost first. */
-    readonly path: readonly QName[];
-    /** The (possibly empty) element name typed so far after `<`, including any prefix. */
-    readonly partial: string;
-    /** Namespace prefixes in scope at the cursor. */
-    readonly prefixes: Readonly<Record<string, string>>;
-    /** The range of `partial` in the document, to replace with the accepted completion. */
-    readonly replaceRange: TextRange;
-}
-/**
- * Ancestor chain (outermost first) of the element containing `offset`,
- * resolved to expanded QNames via the `xmlns` declarations in scope at that
- * point in the text.
- */
-export declare function elementPathAt(text: string, offset: number): QName[];
-/**
- * Pure text analysis for the completion provider: detects an in-progress
- * `<partial` element-name token ending at `offset` and reports the ancestor
- * path, in-scope prefixes and the range to replace with the accepted item.
- * Returns `undefined` when the cursor is not positioned right after an open
- * `<` (e.g. mid-attribute, or not inside a tag at all).
- */
-export declare function completionContextAt(text: string, offset: number): CompletionContext | undefined;
+export { completionContextAt, elementPathAt } from '../xml/locate.js';
+export type { CompletionContext, TextRange } from '../xml/locate.js';
 /** Element declarations legal as children of the element at `path`, in schema order (substitution members included). */
 export declare function childrenAllowedAt(schemaSet: SchemaSet, path: readonly QName[]): ElementDecl[];
 /** Attributes legal on the element at `path`. */

package/dist/xsd/locate.js

@@ -1,113 +1,5 @@
 import { qnameEquals } from '../wsdl/qname.js';
-const OPEN_TAG_RE = /<([^\s/!?>][^\s/>]*)((?:\s+[^<>]*)?)\s*(\/?)>/g;
-const ATTR_RE = /([:\w.-]+)\s*=\s*(?:"([^"]*)"|'([^']*)')/g;
-const XML_PREFIX = 'xml';
-const XML_NS = 'http://www.w3.org/XML/1998/namespace';
-/** Extracts `xmlns`/`xmlns:prefix` declarations from a tag's raw attribute text. */
-function xmlnsDeclarations(rawAttrs) {
-    const decls = {};
-    const re = new RegExp(ATTR_RE);
-    let m;
-    while ((m = re.exec(rawAttrs)) !== null) {
-        const attrName = m[1];
-        const value = m[2] ?? m[3] ?? '';
-        if (attrName === 'xmlns') {
-            decls[''] = value;
-        }
-        else if (attrName.startsWith('xmlns:')) {
-            decls[attrName.slice('xmlns:'.length)] = value;
-        }
-    }
-    return decls;
-}
-function resolvePrefixed(name, prefixes) {
-    const colon = name.indexOf(':');
-    if (colon === -1) {
-        return { namespaceUri: prefixes[''] ?? '', localName: name };
-    }
-    const prefix = name.slice(0, colon);
-    const localName = name.slice(colon + 1);
-    if (prefix === XML_PREFIX) {
-        return { namespaceUri: XML_NS, localName };
-    }
-    return { namespaceUri: prefixes[prefix] ?? '', localName };
-}
-/**
- * Walks open/close tags textually (never a DOM parse) to find the in-scope
- * ancestor stack ending just before `offset`. Tolerant of an unfinished tag
- * at the cursor: a `<…` with no closing `>` yet in the text simply does not
- * match and is ignored.
- */
-function scopeStackAt(text, offset) {
-    const stack = [];
-    const re = new RegExp(OPEN_TAG_RE);
-    let m;
-    while ((m = re.exec(text)) !== null) {
-        const matchEnd = m.index + m[0].length;
-        if (matchEnd > offset) {
-            break;
-        }
-        const raw = m[0];
-        if (raw.startsWith('</')) {
-            // Tolerant of stray/mismatched close tags: just pop, since the source text
-            // up to the cursor is assumed well-formed for the purpose of this walk.
-            if (stack.length > 0) {
-                stack.pop();
-            }
-            continue;
-        }
-        const name = m[1].replace(/^\//, '');
-        const rawAttrs = m[2] ?? '';
-        const selfClosing = m[3] === '/';
-        const parentPrefixes = stack.length > 0 ? stack[stack.length - 1].prefixes : {};
-        const ownDecls = xmlnsDeclarations(rawAttrs);
-        const prefixes = Object.keys(ownDecls).length > 0 ? { ...parentPrefixes, ...ownDecls } : parentPrefixes;
-        const qname = resolvePrefixed(name, prefixes);
-        if (!selfClosing) {
-            stack.push({ qname, prefixes });
-        }
-    }
-    return stack;
-}
-/**
- * Ancestor chain (outermost first) of the element containing `offset`,
- * resolved to expanded QNames via the `xmlns` declarations in scope at that
- * point in the text.
- */
-export function elementPathAt(text, offset) {
-    return scopeStackAt(text, offset).map((s) => s.qname);
-}
-/**
- * Pure text analysis for the completion provider: detects an in-progress
- * `<partial` element-name token ending at `offset` and reports the ancestor
- * path, in-scope prefixes and the range to replace with the accepted item.
- * Returns `undefined` when the cursor is not positioned right after an open
- * `<` (e.g. mid-attribute, or not inside a tag at all).
- */
-export function completionContextAt(text, offset) {
-    const before = text.slice(0, offset);
-    const ltIndex = before.lastIndexOf('<');
-    if (ltIndex === -1) {
-        return undefined;
-    }
-    const between = text.slice(ltIndex + 1, offset);
-    if (/[\s>/]/.test(between) || between.startsWith('/')) {
-        return undefined;
-    }
-    let end = offset;
-    while (end < text.length && /[\w:.-]/.test(text[end])) {
-        end += 1;
-    }
-    const path = elementPathAt(text, ltIndex);
-    const scope = scopeStackAt(text, ltIndex);
-    const prefixes = scope.length > 0 ? scope[scope.length - 1].prefixes : {};
-    return {
-        path,
-        partial: between,
-        prefixes,
-        replaceRange: { start: ltIndex + 1, end },
-    };
-}
+export { completionContextAt, elementPathAt } from '../xml/locate.js';
 function resolveDeclType(schemaSet, decl) {
     if (decl.type !== undefined) {
         const type = schemaSet.lookupType(decl.type);

package/dist/xsd/xml-scan.d.ts

@@ -54,6 +54,8 @@ export interface ScanXmlResult {
     readonly elements: readonly ScannedElement[];
     readonly problems: readonly string[];
 }
+/** Decodes the five predefined XML entities plus numeric character references. */
+export declare function decodeEntities(raw: string): string;
 /**
  * Scans an XML fragment into an element tree with exact ranges.
  *

package/dist/xsd/xml-scan.js

@@ -16,7 +16,7 @@ const ATTR_RE = /([^\s=/>]+)\s*=\s*(?:"([^"]*)"|'([^']*)')/g;
 const NAME_CHAR_RE = /[^\s/>]/;
 const XML_NS = 'http://www.w3.org/XML/1998/namespace';
 /** Decodes the five predefined XML entities plus numeric character references. */
-function decodeEntities(raw) {
+export function decodeEntities(raw) {
     return raw.replace(/&(#x[0-9a-fA-F]+|#\d+|[a-zA-Z]+);/g, (match, body) => {
         if (body === 'amp')
             return '&';

package/dist/xsd/xml-writer.d.ts

@@ -47,6 +47,8 @@ export declare class PrefixTable {
     private readonly taken;
     private counter;
     constructor(preferred: Readonly<Record<string, string>>);
+    /** Keeps `prefix` from being allocated: it is already bound in an enclosing scope. */
+    reserve(prefix: string): void;
     /** The prefix for `uri`, allocating one on first use. The empty namespace has no prefix. */
     prefixFor(uri: string, hint?: string): string;
     /** Renders `name` as a prefixed lexical QName. */

package/dist/xsd/xml-writer.js

@@ -65,6 +65,10 @@ export class PrefixTable {
     constructor(preferred) {
         this.preferred = preferred;
     }
+    /** Keeps `prefix` from being allocated: it is already bound in an enclosing scope. */
+    reserve(prefix) {
+        this.taken.add(prefix);
+    }
     /** The prefix for `uri`, allocating one on first use. The empty namespace has no prefix. */
     prefixFor(uri, hint) {
         if (uri === '') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirebench/engine",
-  "version": "2.2.1",
+  "version": "3.1.0-rc.1",
   "license": "Apache-2.0",
   "type": "module",
   "repository": {
@@ -42,17 +42,28 @@
       "types": "./dist/grpc/browser.d.ts",
       "default": "./dist/grpc/browser.js"
     },
+    "./asyncapi": {
+      "types": "./dist/asyncapi/browser.d.ts",
+      "default": "./dist/asyncapi/browser.js"
+    },
+    "./snapshot": {
+      "types": "./dist/snapshot/index.d.ts",
+      "default": "./dist/snapshot/index.js"
+    },
     "./detect": {
       "types": "./dist/import-detect.d.ts",
       "default": "./dist/import-detect.js"
     }
   },
   "dependencies": {
+    "@jitl/quickjs-wasmfile-release-sync": "0.32.0",
     "@xmldom/xmldom": "^0.9.12",
     "fontoxpath": "^3.34.0",
     "jsonpath-plus": "^10.4.0",
     "node-forge": "^1.3.1",
     "protobufjs": "^8.8.0",
+    "quickjs-emscripten-core": "0.32.0",
+    "typescript": "~5.9.3",
     "ulidx": "^2.4.1",
     "undici": "^8",
     "xml-crypto": "^6.1.2",

package/dist/generate.d.ts

@@ -1,12 +0,0 @@
-/**
- * Convenience wrappers around `buildSampleRequest`/`buildEmptyRequest` that
- * take an {@link ImportResult} directly, so callers don't have to thread
- * `definition`/`schemaSet` through by hand.
- */
-import type { GeneratedRequest, OperationRef, RequestBuildOptions } from './soap/request-builder.js';
-import type { GenerateOptions } from './xsd/sample-generator.js';
-import type { ImportResult } from './types.js';
-/** Builds the sample SOAP request for one operation of an imported definition. */
-export declare function generateRequest(result: ImportResult, op: OperationRef, genOptions?: Partial<GenerateOptions>, options?: RequestBuildOptions): GeneratedRequest;
-/** Builds an empty SOAP request (empty `Header`/`Body`) for one operation of an imported definition. */
-export declare function generateEmptyRequest(result: ImportResult, op: OperationRef, options?: RequestBuildOptions): GeneratedRequest;

package/dist/operations.d.ts

@@ -1,12 +0,0 @@
-/**
- * Builds the operation-picker summary (`OperationSummary[]`) for an imported
- * WSDL definition: every binding operation, cross-referenced with the ports
- * (and their services) that expose it.
- */
-import type { WsdlDefinition } from './wsdl/model.js';
-import type { OperationSummary } from './types.js';
-/**
- * Walks every `binding` x `operation` pair in `definition`, mapping each to
- * the ports (and their services) that reference the binding.
- */
-export declare function summarizeOperations(definition: WsdlDefinition): readonly OperationSummary[];

package/dist/run/effective-auth.d.ts

@@ -1,10 +0,0 @@
-import type { AuthConfig, EndpointAuth } from '../project/model.js';
-import type { SelectedRequest } from './select.js';
-/** A SOAP request's own auth, combined with its endpoint's, falling back to the interface's. */
-export declare function soapEffectiveAuth(selected: Extract<SelectedRequest, {
-    kind: 'soap';
-}>): EndpointAuth | undefined;
-/** Innermost first, as the app's `authChainFor` builds it: request, its folders inside-out, the API. */
-export declare function restEffectiveAuth(selected: Extract<SelectedRequest, {
-    kind: 'rest';
-}>): AuthConfig;

package/dist/run/effective-auth.js

@@ -1,19 +0,0 @@
-/**
- * The authentication a selected request would send with, before any secret is resolved. Both
- * `prepareSend` and `secretNeedsOf` read it from here, so the secrets a run is told it needs are
- * exactly the secrets its sends will ask for.
- */
-import { effectiveAuth } from '../project/endpoints.js';
-import { resolveAuthEndpoint } from '../project/environments.js';
-import { resolveAuthChain } from '../rest/auth.js';
-/** A SOAP request's own auth, combined with its endpoint's, falling back to the interface's. */
-export function soapEffectiveAuth(selected) {
-    const { iface, request } = selected;
-    const endpoint = resolveAuthEndpoint(iface, request);
-    return effectiveAuth(request.auth, endpoint?.auth, endpoint?.authMode ?? 'override', iface.auth);
-}
-/** Innermost first, as the app's `authChainFor` builds it: request, its folders inside-out, the API. */
-export function restEffectiveAuth(selected) {
-    const { api, chain, request } = selected;
-    return resolveAuthChain([request.auth, ...[...chain].reverse().map((folder) => folder.auth), api.auth]);
-}

package/dist/run/prepare.d.ts

@@ -1,43 +0,0 @@
-import type { ProxyOptions } from '../http/types.js';
-import type { Project, PropertyMap } from '../project/model.js';
-import type { PropertyScopes } from '../project/properties.js';
-import type { RestSendInput } from '../rest/send.js';
-import type { GetSecret } from '../secrets/resolve.js';
-import type { SoapSendInput } from '../types.js';
-import type { SelectedRequest } from './select.js';
-/** Everything a run supplies around the saved requests it sends. */
-export interface RunContext {
-    readonly project: Project;
-    /** The project folder: keystores, attachments and file bodies are read from inside it only. */
-    readonly projectDir: string;
-    readonly environmentId?: string;
-    /** `--var` overrides, laid over the environment's properties. */
-    readonly overrides: PropertyMap;
-    readonly getSecret: GetSecret;
-    readonly timeoutMs?: number;
-    readonly insecure?: boolean;
-    readonly proxyFor?: (url: string) => ProxyOptions | undefined;
-    readonly signal?: AbortSignal;
-    /**
-     * The WSDL-derived default `wsa:Action` for a SOAP request, as the app takes it from the
-     * interface's imported definition. Absent (or returning `''`) when no definition is at hand:
-     * an explicit `wsa:Action` or the request's SOAPAction then still applies.
-     */
-    readonly defaultWsaActionFor?: (selected: Extract<SelectedRequest, {
-        kind: 'soap';
-    }>) => string;
-}
-/** One request, ready for `sendSoapRequest` (with `scopes`) or `sendRest`. */
-export type PreparedSend = {
-    readonly kind: 'soap';
-    readonly input: SoapSendInput;
-    readonly scopes: PropertyScopes;
-} | {
-    readonly kind: 'rest';
-    readonly input: RestSendInput;
-};
-/**
- * @throws WirebenchError `unresolved-properties` | `endpoint-unresolved` | `secret-missing` |
- * `auth-grant-unsupported` | `wss-config-missing` | `keystore-missing`
- */
-export declare function prepareSend(selected: SelectedRequest, context: RunContext): Promise<PreparedSend>;

package/dist/run/prepare.js

@@ -1,280 +0,0 @@
-/**
- * Turns one saved request into a send input, for a host with no editor: no draft to apply, no
- * user preferences to fold in, no renderer to keep credentials from. It composes the same engine
- * functions the app's main process does, in the same order, so a request runs in a pipeline the
- * way it runs when its author presses Send.
- *
- * What the app reads from the user's preferences — a global client keystore, a CA bundle, a
- * proxy, global properties — has no counterpart here: a run is described by the project and its
- * command line alone. Trust anchors beyond Node's own come from `NODE_EXTRA_CA_CERTS`.
- */
-import { readFile, stat } from 'node:fs/promises';
-import { isAbsolute, resolve as resolvePath } from 'node:path';
-import { WirebenchError } from '../errors.js';
-import { isInsideRealDir } from '../fs.js';
-import { createFileAttachmentResolver, readAttachment } from '../project/attachments-cache.js';
-import { resolveApiBaseUrl, resolveEndpoint, resolveScopes } from '../project/environments.js';
-import { toKeystoreDef } from '../project/keystores.js';
-import { expandSendInput } from '../project/properties.js';
-import { toWssIncomingConfig, toWssOutgoingConfig } from '../project/wss-configs.js';
-import { expandRestSendInput } from '../rest/expand.js';
-import { resolveAuthConfig, resolveEndpointAuth, toSendAuth } from '../secrets/resolve.js';
-import { toRestSendInput, toSendInput } from '../send-options.js';
-import { effectiveWsa } from '../wsa/model.js';
-import { loadKeystore, toTlsClientIdentity } from '../wss/keystore/index.js';
-import { createWssContext } from '../wss/model.js';
-import { restEffectiveAuth, soapEffectiveAuth } from './effective-auth.js';
-function scopesFor(context) {
-    const scopes = resolveScopes(context.project, context.environmentId, {}, process.env);
-    return { ...scopes, env: { ...(scopes.env ?? {}), ...context.overrides } };
-}
-function unresolvedError(path, unresolved) {
-    const exprs = unresolved.map((ref) => ref.expr);
-    return new WirebenchError('unresolved-properties', `"${path}" has property references nothing resolves: ${exprs.join(', ')}`, { details: { path, unresolved: exprs } });
-}
-/** A secret the project names but the run was not given: refused, never sent without. */
-async function requiredSecret(ref, getSecret) {
-    const value = await getSecret(ref);
-    if (value === undefined) {
-        throw new WirebenchError('secret-missing', `Secret ${ref} was not supplied to this run.`, { details: { ref } });
-    }
-    return value;
-}
-/**
- * `path` resolved against the project folder, refused when it lands outside it. The app also
- * accepts a file its user picked through a dialog; a pipeline has no such user, so the project
- * folder is the whole boundary.
- */
-async function insideProject(context, path, code, name) {
-    const resolved = resolvePath(context.projectDir, path);
-    if (!(await isInsideRealDir(context.projectDir, resolved))) {
-        throw new WirebenchError(code, `"${name}" resolves outside the project folder.`, { details: { path } });
-    }
-    return resolved;
-}
-/** Mirrors the app's keystore loading, minus its cache: a run loads each keystore it needs. */
-async function loadKeystoreById(context, keystoreId) {
-    const ref = context.project.wss.keystores.find((candidate) => candidate.id === keystoreId);
-    if (ref === undefined) {
-        return undefined;
-    }
-    const def = toKeystoreDef(ref);
-    const path = await insideProject(context, def.path, 'keystore-outside-project', def.name);
-    try {
-        await stat(path);
-    }
-    catch (error) {
-        throw new WirebenchError('keystore-unreadable', `The keystore file "${def.path}" could not be read.`, {
-            details: { id: def.id },
-            cause: error,
-        });
-    }
-    const password = def.passwordSecretRef === undefined ? undefined : await requiredSecret(def.passwordSecretRef, context.getSecret);
-    return loadKeystore(await readFile(path), { type: def.type, ...(password !== undefined ? { password } : {}) });
-}
-/** The `cert`/`key` a request's own keystore presents; there is no global keystore in a run. */
-async function clientIdentityFor(context, keystoreId) {
-    if (keystoreId === undefined || keystoreId.length === 0) {
-        return undefined;
-    }
-    const keystore = await loadKeystoreById(context, keystoreId);
-    const def = context.project.wss.keystores.find((candidate) => candidate.id === keystoreId);
-    if (keystore === undefined || def === undefined) {
-        throw new WirebenchError('keystore-missing', 'This request selects a keystore the project no longer has.', {
-            details: { keystoreId },
-        });
-    }
-    const identity = toTlsClientIdentity(keystore, toKeystoreDef(def).defaultAlias);
-    return { cert: identity.cert, key: identity.key };
-}
-/** Identity, then the only two trust opt-outs a run honours: `--insecure` and the file's own flag. */
-async function tlsFor(context, keystoreId, trustInvalid) {
-    const identity = await clientIdentityFor(context, keystoreId);
-    const skipVerify = context.insecure === true || trustInvalid;
-    if (identity === undefined && !skipVerify) {
-        return undefined;
-    }
-    return { ...identity, ...(skipVerify ? { rejectUnauthorized: false } : {}) };
-}
-/**
- * WS-Addressing as the app's `wsaFor` builds it. The WSDL-derived default action comes from the
- * host's `defaultWsaActionFor`; without one it is empty, as it is in the app for an interface not
- * yet hydrated, and an explicit `wsa:Action` or the request's SOAPAction still applies.
- */
-function wsaFor(selected, context) {
-    const config = effectiveWsa(selected.iface.wsa, selected.request.wsa);
-    return config.enabled ? { config, defaultAction: context.defaultWsaActionFor?.(selected) ?? '' } : undefined;
-}
-/** The app's `wssFor`: a selected configuration the project no longer has refuses the send. */
-function wssFor(selected, context) {
-    const { request } = selected;
-    const pick = (id) => (id === undefined || id.length === 0 ? undefined : id);
-    const outgoingId = pick(request.wssOutgoingRef);
-    const incomingId = pick(request.wssIncomingRef);
-    if (outgoingId === undefined && incomingId === undefined) {
-        return undefined;
-    }
-    const find = (refs, id, convert) => {
-        const ref = refs.find((candidate) => candidate.id === id);
-        if (ref !== undefined) {
-            try {
-                return convert(ref);
-            }
-            catch {
-                // An unreadable configuration is treated as the app treats it: as missing.
-            }
-        }
-        throw new WirebenchError('wss-config-missing', 'This request selects a WS-Security configuration the project no longer has.', { details: { configId: id } });
-    };
-    const outgoing = outgoingId === undefined ? undefined : find(context.project.wss.outgoing, outgoingId, toWssOutgoingConfig);
-    const incoming = incomingId === undefined ? undefined : find(context.project.wss.incoming, incomingId, toWssIncomingConfig);
-    const { properties } = request;
-    return {
-        ...(outgoing !== undefined ? { outgoing } : {}),
-        ...(incoming !== undefined ? { incoming } : {}),
-        ctx: createWssContext({
-            keystores: (ref) => loadKeystoreById(context, ref),
-            secrets: (ref) => requiredSecret(ref, context.getSecret),
-        }),
-        requestProperties: {
-            ...(properties.wssPasswordType !== undefined ? { wssPasswordType: properties.wssPasswordType } : {}),
-            ...(properties.wssTimeToLive !== undefined ? { wssTimeToLive: properties.wssTimeToLive } : {}),
-        },
-    };
-}
-/**
- * The app's `attachmentResolvers`, with the project folder as the only read boundary: a `cache`
- * attachment comes out of `attachments/`, a `path` one from its first existing candidate (resource
- * root, then the project), and an inline `file:` reference from the project folder.
- */
-function attachmentResolvers(context) {
-    const { projectDir } = context;
-    const resourceRoot = context.project.settings.resourceRoot;
-    const read = createFileAttachmentResolver(projectDir, resourceRoot);
-    return {
-        resolver: async (attachment) => {
-            if (attachment.source.kind === 'path') {
-                const { path } = attachment.source;
-                const candidates = isAbsolute(path)
-                    ? [path]
-                    : [...(resourceRoot !== undefined ? [resolvePath(resourceRoot, path)] : []), resolvePath(projectDir, path)];
-                for (const candidate of candidates) {
-                    const exists = await stat(candidate).then(() => true, () => false);
-                    if (exists) {
-                        await insideProject(context, candidate, 'attachment-outside-project', attachment.name);
-                        return new Uint8Array(await readFile(candidate));
-                    }
-                }
-            }
-            return read(attachment);
-        },
-        resolveFile: async (path) => new Uint8Array(await readFile(await insideProject(context, path, 'inline-file-outside-project', path))),
-        resourceRoot: projectDir,
-    };
-}
-/** A REST multipart file part or binary body, read from inside the project folder. */
-function restFileResolver(context) {
-    return async (source) => source.kind === 'cache'
-        ? readAttachment(context.projectDir, source.sha256)
-        : new Uint8Array(await readFile(await insideProject(context, source.path, 'rest-file-outside-project', source.path)));
-}
-async function prepareSoap(selected, context) {
-    const { iface, request } = selected;
-    const resolved = resolveEndpoint(context.project, context.environmentId, iface, request);
-    if (resolved.url === undefined) {
-        throw new WirebenchError('endpoint-unresolved', `No endpoint resolves for "${selected.path}"`, {
-            details: { path: selected.path },
-        });
-    }
-    const auth = await resolveEndpointAuth(soapEffectiveAuth(selected), context.getSecret);
-    const base = toSendInput({
-        request: {
-            properties: request.properties,
-            soapVersion: request.soapVersion,
-            ...(request.soapAction !== undefined ? { soapAction: request.soapAction } : {}),
-            headers: request.headers,
-            envelopeXml: request.envelopeXml,
-        },
-        endpoint: resolved.url,
-        projectSettings: context.project.settings,
-        attachments: request.attachments,
-        attachmentResolvers: attachmentResolvers(context),
-    });
-    const scopes = scopesFor(context);
-    const tls = await tlsFor(context, request.properties.sslKeystoreRef, resolved.endpoint?.trustInvalid === true);
-    const proxy = context.proxyFor?.(resolved.url);
-    const wsa = wsaFor(selected, context);
-    const wss = wssFor(selected, context);
-    const sendAuth = toSendAuth(auth);
-    // The attachments and MTOM options ride on `base`, as the app's `sendAttachmentsFor` builds them.
-    const input = {
-        ...base,
-        ...(sendAuth !== undefined ? { auth: sendAuth } : {}),
-        ...(context.timeoutMs !== undefined ? { timeoutMs: context.timeoutMs } : {}),
-        ...(tls !== undefined ? { tls: { ...base.tls, ...tls } } : {}),
-        ...(proxy !== undefined ? { proxy } : {}),
-        ...(wsa !== undefined ? { wsa } : {}),
-        ...(wss !== undefined ? { wss } : {}),
-        ...(context.signal !== undefined ? { signal: context.signal } : {}),
-    };
-    // Refused here, before the wire: the engine would report the same refs on the exchange, but by
-    // then a half-expanded envelope has already been sent to somebody's service.
-    const { unresolved } = expandSendInput(input, scopes);
-    if (unresolved.length > 0) {
-        throw unresolvedError(selected.path, unresolved);
-    }
-    return { kind: 'soap', input, scopes };
-}
-async function prepareRest(selected, context) {
-    const { api, request } = selected;
-    const configured = restEffectiveAuth(selected);
-    if (configured.type === 'oauth2') {
-        throw new WirebenchError('auth-grant-unsupported', configured.grant === 'authorization-code'
-            ? 'This request signs in through a browser (OAuth2 authorization code), which a pipeline cannot do.'
-            : 'OAuth2 is not supported by the runner yet.', { details: { path: selected.path, grant: configured.grant } });
-    }
-    const auth = await resolveAuthConfig(configured, context.getSecret);
-    const scopes = scopesFor(context);
-    const baseUrl = resolveApiBaseUrl(context.project, context.environmentId, api).url;
-    const tls = await tlsFor(context, request.settings.sslKeystoreRef, request.settings.trustInvalid === true);
-    const unexpanded = toRestSendInput({
-        request: {
-            method: request.method,
-            url: request.url,
-            pathParams: request.pathParams,
-            query: request.query,
-            headers: request.headers,
-            body: request.body,
-            settings: request.settings,
-        },
-        baseUrl,
-        projectSettings: context.project.settings,
-        ...(auth !== undefined ? { auth } : {}),
-        ...(tls !== undefined ? { tls } : {}),
-        resolveFile: restFileResolver(context),
-        ...(context.signal !== undefined ? { signal: context.signal } : {}),
-    });
-    const { input, unresolved } = expandRestSendInput(unexpanded, scopes, {
-        escape: request.settings.escapeProperties === true,
-    });
-    if (unresolved.length > 0) {
-        throw unresolvedError(selected.path, unresolved);
-    }
-    // As the app does: the proxy is chosen for the base URL, or the request's own when it has none.
-    const proxy = context.proxyFor?.(input.baseUrl === '' ? input.request.url : input.baseUrl);
-    return {
-        kind: 'rest',
-        input: {
-            ...input,
-            ...(proxy !== undefined ? { proxy } : {}),
-            ...(context.timeoutMs !== undefined ? { settings: { ...input.settings, timeoutMs: context.timeoutMs } } : {}),
-        },
-    };
-}
-/**
- * @throws WirebenchError `unresolved-properties` | `endpoint-unresolved` | `secret-missing` |
- * `auth-grant-unsupported` | `wss-config-missing` | `keystore-missing`
- */
-export function prepareSend(selected, context) {
-    return selected.kind === 'soap' ? prepareSoap(selected, context) : prepareRest(selected, context);
-}