@apilift/cli 1.7.2 → 1.8.0

package/dist/apilift-collector.js

@@ -27962,7 +27962,7 @@ function bodyIssues(v2, ctx) {
     if (name.toLowerCase() === "content-type" && (v2.form !== void 0 || v2.body !== void 0) && value !== (v2.form !== void 0 ? "application/x-www-form-urlencoded" : "application/json"))
       ctx.addIssue({ code: "custom", message: "Content-Type conflicts with declared body encoding" });
 }
-var import__, resourceKinds, resourceKindSchema, segmentSchema, appSlugSchema, actionNameSchema, generatedNameSchema, inputNameSchema, pointerSchema, categorySlugs, categorySchema, title, description, requiredDescription, originSchema, httpUrlSchema, requestUrlSchema, ajv, jsonSchema, valueSchema, htmlFieldSchema, htmlExtractionSchema, continuationSchema, responseSchema, baseRequestSchema, readPreparationSchema, requestSchema, proofPointer, proofComparison, proofKey, proofSelection, proofSchema, appDefinitionSchema, entityDefinitionSchema, generatedSchema, executableActionSchema, unavailableActionSchema, actionDefinitionSchema, locatorSchema, observeSchema, injectSchema, credentialSchema, probeSchema, transportDefinitionSchema, browserContextDefinitionSchema, definitionSchemas;
+var import__, resourceKinds, resourceKindSchema, segmentSchema, appSlugSchema, actionNameSchema, generatedNameSchema, inputNameSchema, pointerSchema, categorySlugs, categorySchema, title, description, requiredDescription, originSchema, httpUrlSchema, requestUrlSchema, ajv, jsonSchema, valueSchema, htmlFieldSchema, htmlExtractionSchema, continuationSchema, responseSchema, baseRequestSchema, readPreparationSchema, requestSchema, proofPointer, proofComparison, proofKey, proofSelection, proofSchema, appDefinitionSchema, entityDefinitionSchema, generatedSchema, executableActionSchema, unavailableActionSchema, actionDefinitionSchema, locatorSchema, observeSchema, injectSchema, credentialSchema, basicComponent, httpBasicSchema, probeSchema, transportDefinitionSchema, browserContextDefinitionSchema, definitionSchemas;
 var init_schema = __esm({
   "../../packages/core/dist/definitions/schema.js"() {
     "use strict";
@@ -28103,8 +28103,10 @@ var init_schema = __esm({
     observeSchema = external_exports.strictObject({ kind: external_exports.literal("observe"), request: external_exports.strictObject({ method: external_exports.string(), urlPattern: external_exports.string() }), extract: external_exports.strictObject({ in: external_exports.enum(["request-header", "response-header", "response-body"]), name: external_exports.string().optional(), path: pointerSchema.optional() }), trigger: external_exports.union([external_exports.strictObject({ kind: external_exports.literal("navigate"), url: httpUrlSchema }), external_exports.strictObject({ kind: external_exports.literal("selector"), selector: external_exports.string() })]).optional(), cache: external_exports.literal("browser-session") });
     injectSchema = external_exports.strictObject({ from: external_exports.union([locatorSchema, observeSchema]), to: external_exports.union([external_exports.strictObject({ in: external_exports.literal("header"), name: external_exports.string() }), external_exports.strictObject({ in: external_exports.literal("query"), name: external_exports.string() }), external_exports.strictObject({ in: external_exports.literal("body"), path: pointerSchema }), external_exports.strictObject({ in: external_exports.literal("form"), name: external_exports.string().min(1) })]) });
     credentialSchema = external_exports.strictObject({ name: generatedNameSchema, header: external_exports.string().regex(/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/), prefix: external_exports.string().max(80).refine((v2) => !/[\r\n]/.test(v2)).optional() });
+    basicComponent = external_exports.union([generatedNameSchema, external_exports.strictObject({ literal: external_exports.string().max(128).refine((v2) => ![...v2].some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127), "Control characters are not allowed") })]);
+    httpBasicSchema = external_exports.strictObject({ username: basicComponent.optional(), password: basicComponent.optional() }).refine((v2) => Object.values(v2).some((value) => typeof value === "string"), "Name at least one saved credential field; the omitted component is empty");
     probeSchema = external_exports.strictObject({ effect: external_exports.literal("read").optional(), request: requestSchema, response: responseSchema, inputs: jsonSchema.optional() });
-    transportDefinitionSchema = external_exports.strictObject({ title, description: requiredDescription, mode: external_exports.enum(["direct", "browser"]), baseUrl: requestUrlSchema.optional(), allowedOrigins: external_exports.array(originSchema).min(1).max(100), browserContext: segmentSchema.optional(), credentials: external_exports.array(credentialSchema).max(16).optional(), inject: external_exports.array(injectSchema).optional(), identity: readPreparationSchema.extend({ paths: external_exports.array(pointerSchema).min(1).max(8) }).optional(), probes: external_exports.record(external_exports.string(), probeSchema) }).superRefine((v2, ctx) => {
+    transportDefinitionSchema = external_exports.strictObject({ title, description: requiredDescription, mode: external_exports.enum(["direct", "browser"]), baseUrl: requestUrlSchema.optional(), allowedOrigins: external_exports.array(originSchema).min(1).max(100), browserContext: segmentSchema.optional(), credentials: external_exports.array(credentialSchema).max(16).optional(), httpBasic: httpBasicSchema.optional(), inject: external_exports.array(injectSchema).optional(), identity: readPreparationSchema.extend({ paths: external_exports.array(pointerSchema).min(1).max(8) }).optional(), probes: external_exports.record(external_exports.string(), probeSchema) }).superRefine((v2, ctx) => {
       if (new Set(v2.allowedOrigins).size !== v2.allowedOrigins.length)
         ctx.addIssue({ code: "custom", path: ["allowedOrigins"], message: "Origins must be distinct" });
       if (v2.mode === "direct" && !v2.baseUrl)
@@ -28119,7 +28121,8 @@ var init_schema = __esm({
         const names = v2.credentials.map((c) => c.name), headers = v2.credentials.map((c) => c.header.toLowerCase());
         if (new Set(names).size !== names.length)
           ctx.addIssue({ code: "custom", path: ["credentials"], message: "Credential names must be unique" });
-        if (new Set(headers).size !== headers.length)
+        const ordinaryHeaders = v2.credentials.filter((c) => !Object.values(v2.httpBasic ?? {}).includes(c.name)).map((c) => c.header.toLowerCase());
+        if (new Set(ordinaryHeaders).size !== ordinaryHeaders.length)
           ctx.addIssue({ code: "custom", path: ["credentials"], message: "Credential headers must be unique" });
         for (const [i, header] of headers.entries())
           if (["cookie", "host", "content-length", "origin", "referer"].includes(header))
@@ -28129,6 +28132,25 @@ var init_schema = __esm({
             ctx.addIssue({ code: "custom", path: ["allowedOrigins", i], message: "Credentials require HTTPS origins" });
         });
       }
+      if (v2.httpBasic) {
+        if (v2.mode !== "direct")
+          ctx.addIssue({ code: "custom", path: ["httpBasic"], message: "HTTP Basic encoding requires direct mode" });
+        const names = Object.values(v2.httpBasic).filter((value) => typeof value === "string");
+        if (new Set(names).size !== names.length)
+          ctx.addIssue({ code: "custom", path: ["httpBasic"], message: "Basic username and password must use distinct saved fields" });
+        for (const [slot, name] of Object.entries(v2.httpBasic)) {
+          if (typeof name !== "string") {
+            if (slot === "username" && name.literal.includes(":"))
+              ctx.addIssue({ code: "custom", path: ["httpBasic", slot], message: "Basic username cannot contain a colon" });
+            continue;
+          }
+          const field = v2.credentials?.find((c) => c.name === name);
+          if (!field || field.header.toLowerCase() !== "authorization" || field.prefix)
+            ctx.addIssue({ code: "custom", path: ["httpBasic", slot], message: "Reference a raw saved field with header Authorization and no prefix" });
+        }
+        if (v2.credentials?.some((c) => c.header.toLowerCase() === "authorization" && !names.includes(c.name)))
+          ctx.addIssue({ code: "custom", path: ["credentials"], message: "Basic authentication owns Authorization; remove conflicting credentials" });
+      }
       for (const origin of v2.allowedOrigins)
         if (!Object.hasOwn(v2.probes, origin))
           ctx.addIssue({ code: "custom", path: ["probes"], message: `Missing probe for ${origin}` });
@@ -28173,10 +28195,19 @@ var init_rules = __esm({
   }
 });
 
+// ../../packages/core/dist/definitions/credential-contract.js
+var init_credential_contract = __esm({
+  "../../packages/core/dist/definitions/credential-contract.js"() {
+    "use strict";
+    init_json();
+  }
+});
+
 // ../../packages/core/dist/definitions/metadata.js
 var init_metadata = __esm({
   "../../packages/core/dist/definitions/metadata.js"() {
     "use strict";
+    init_credential_contract();
   }
 });
 
@@ -28221,14 +28252,6 @@ var init_categories = __esm({
   }
 });
 
-// ../../packages/core/dist/definitions/credential-contract.js
-var init_credential_contract = __esm({
-  "../../packages/core/dist/definitions/credential-contract.js"() {
-    "use strict";
-    init_json();
-  }
-});
-
 // ../../packages/core/dist/definitions/index.js
 var init_definitions = __esm({
   "../../packages/core/dist/definitions/index.js"() {
@@ -28438,7 +28461,7 @@ function createCliApi(baseUrl, fetcher = fetch, token, sessionId) {
   const transport = async (input2, init) => {
     const method = init?.method ?? "GET";
     const headers = new Headers(init?.headers);
-    headers.set("Apilift-Capabilities", "distributed-rollouts-v1,discovery-proof-v2,dynamic-bindings-v1,collection-proof-v3,web-responses-v1,bounded-catalog-v1");
+    headers.set("Apilift-Capabilities", "distributed-rollouts-v1,discovery-proof-v2,dynamic-bindings-v1,collection-proof-v3,web-responses-v1,bounded-catalog-v1,http-basic-v1");
     headers.set("Apilift-Client", `cli/${cliVersion}`);
     if (token) headers.set("Authorization", `Bearer ${token}`);
     if (sessionId) headers.set("Apilift-Session", sessionId);

package/dist/apilift-native-host.js

@@ -29173,8 +29173,10 @@ var locatorSchema = external_exports.strictObject({ kind: external_exports.liter
 var observeSchema = external_exports.strictObject({ kind: external_exports.literal("observe"), request: external_exports.strictObject({ method: external_exports.string(), urlPattern: external_exports.string() }), extract: external_exports.strictObject({ in: external_exports.enum(["request-header", "response-header", "response-body"]), name: external_exports.string().optional(), path: pointerSchema.optional() }), trigger: external_exports.union([external_exports.strictObject({ kind: external_exports.literal("navigate"), url: httpUrlSchema }), external_exports.strictObject({ kind: external_exports.literal("selector"), selector: external_exports.string() })]).optional(), cache: external_exports.literal("browser-session") });
 var injectSchema = external_exports.strictObject({ from: external_exports.union([locatorSchema, observeSchema]), to: external_exports.union([external_exports.strictObject({ in: external_exports.literal("header"), name: external_exports.string() }), external_exports.strictObject({ in: external_exports.literal("query"), name: external_exports.string() }), external_exports.strictObject({ in: external_exports.literal("body"), path: pointerSchema }), external_exports.strictObject({ in: external_exports.literal("form"), name: external_exports.string().min(1) })]) });
 var credentialSchema = external_exports.strictObject({ name: generatedNameSchema, header: external_exports.string().regex(/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/), prefix: external_exports.string().max(80).refine((v) => !/[\r\n]/.test(v)).optional() });
+var basicComponent = external_exports.union([generatedNameSchema, external_exports.strictObject({ literal: external_exports.string().max(128).refine((v) => ![...v].some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127), "Control characters are not allowed") })]);
+var httpBasicSchema = external_exports.strictObject({ username: basicComponent.optional(), password: basicComponent.optional() }).refine((v) => Object.values(v).some((value) => typeof value === "string"), "Name at least one saved credential field; the omitted component is empty");
 var probeSchema = external_exports.strictObject({ effect: external_exports.literal("read").optional(), request: requestSchema, response: responseSchema, inputs: jsonSchema.optional() });
-var transportDefinitionSchema = external_exports.strictObject({ title, description: requiredDescription, mode: external_exports.enum(["direct", "browser"]), baseUrl: requestUrlSchema.optional(), allowedOrigins: external_exports.array(originSchema).min(1).max(100), browserContext: segmentSchema.optional(), credentials: external_exports.array(credentialSchema).max(16).optional(), inject: external_exports.array(injectSchema).optional(), identity: readPreparationSchema.extend({ paths: external_exports.array(pointerSchema).min(1).max(8) }).optional(), probes: external_exports.record(external_exports.string(), probeSchema) }).superRefine((v, ctx) => {
+var transportDefinitionSchema = external_exports.strictObject({ title, description: requiredDescription, mode: external_exports.enum(["direct", "browser"]), baseUrl: requestUrlSchema.optional(), allowedOrigins: external_exports.array(originSchema).min(1).max(100), browserContext: segmentSchema.optional(), credentials: external_exports.array(credentialSchema).max(16).optional(), httpBasic: httpBasicSchema.optional(), inject: external_exports.array(injectSchema).optional(), identity: readPreparationSchema.extend({ paths: external_exports.array(pointerSchema).min(1).max(8) }).optional(), probes: external_exports.record(external_exports.string(), probeSchema) }).superRefine((v, ctx) => {
   if (new Set(v.allowedOrigins).size !== v.allowedOrigins.length)
     ctx.addIssue({ code: "custom", path: ["allowedOrigins"], message: "Origins must be distinct" });
   if (v.mode === "direct" && !v.baseUrl)
@@ -29189,7 +29191,8 @@ var transportDefinitionSchema = external_exports.strictObject({ title, descripti
     const names2 = v.credentials.map((c) => c.name), headers = v.credentials.map((c) => c.header.toLowerCase());
     if (new Set(names2).size !== names2.length)
       ctx.addIssue({ code: "custom", path: ["credentials"], message: "Credential names must be unique" });
-    if (new Set(headers).size !== headers.length)
+    const ordinaryHeaders = v.credentials.filter((c) => !Object.values(v.httpBasic ?? {}).includes(c.name)).map((c) => c.header.toLowerCase());
+    if (new Set(ordinaryHeaders).size !== ordinaryHeaders.length)
       ctx.addIssue({ code: "custom", path: ["credentials"], message: "Credential headers must be unique" });
     for (const [i, header] of headers.entries())
       if (["cookie", "host", "content-length", "origin", "referer"].includes(header))
@@ -29199,6 +29202,25 @@ var transportDefinitionSchema = external_exports.strictObject({ title, descripti
         ctx.addIssue({ code: "custom", path: ["allowedOrigins", i], message: "Credentials require HTTPS origins" });
     });
   }
+  if (v.httpBasic) {
+    if (v.mode !== "direct")
+      ctx.addIssue({ code: "custom", path: ["httpBasic"], message: "HTTP Basic encoding requires direct mode" });
+    const names2 = Object.values(v.httpBasic).filter((value) => typeof value === "string");
+    if (new Set(names2).size !== names2.length)
+      ctx.addIssue({ code: "custom", path: ["httpBasic"], message: "Basic username and password must use distinct saved fields" });
+    for (const [slot, name] of Object.entries(v.httpBasic)) {
+      if (typeof name !== "string") {
+        if (slot === "username" && name.literal.includes(":"))
+          ctx.addIssue({ code: "custom", path: ["httpBasic", slot], message: "Basic username cannot contain a colon" });
+        continue;
+      }
+      const field = v.credentials?.find((c) => c.name === name);
+      if (!field || field.header.toLowerCase() !== "authorization" || field.prefix)
+        ctx.addIssue({ code: "custom", path: ["httpBasic", slot], message: "Reference a raw saved field with header Authorization and no prefix" });
+    }
+    if (v.credentials?.some((c) => c.header.toLowerCase() === "authorization" && !names2.includes(c.name)))
+      ctx.addIssue({ code: "custom", path: ["credentials"], message: "Basic authentication owns Authorization; remove conflicting credentials" });
+  }
   for (const origin of v.allowedOrigins)
     if (!Object.hasOwn(v.probes, origin))
       ctx.addIssue({ code: "custom", path: ["probes"], message: `Missing probe for ${origin}` });
@@ -29497,6 +29519,13 @@ function validateDefinition(kind, name, value) {
 
 // ../../packages/core/dist/definitions/analysis.js
 var import__2 = __toESM(require__(), 1);
+
+// ../../packages/core/dist/definitions/credential-contract.js
+function credentialAuthoringIssues(transport) {
+  return (transport.credentials ?? []).flatMap((field, index) => field.header.toLowerCase() === "authorization" && /^Basic(?:\s|$)/iu.test(field.prefix ?? "") ? [{ path: `/credentials/${index}/prefix`, message: "Use raw saved credential fields with httpBasic and no prefix. Apilift encodes at dispatch; never ask the person to encode a key." }] : []);
+}
+
+// ../../packages/core/dist/definitions/analysis.js
 var ajv2 = new import__2.default({ strict: false, validateFormats: false });
 
 // ../../packages/core/dist/definitions/categories.js
@@ -29963,7 +29992,7 @@ function createCliApi(baseUrl, fetcher = fetch, token, sessionId) {
   const transport = async (input2, init) => {
     const method = init?.method ?? "GET";
     const headers = new Headers(init?.headers);
-    headers.set("Apilift-Capabilities", "distributed-rollouts-v1,discovery-proof-v2,dynamic-bindings-v1,collection-proof-v3,web-responses-v1,bounded-catalog-v1");
+    headers.set("Apilift-Capabilities", "distributed-rollouts-v1,discovery-proof-v2,dynamic-bindings-v1,collection-proof-v3,web-responses-v1,bounded-catalog-v1,http-basic-v1");
     headers.set("Apilift-Client", `cli/${cliVersion}`);
     if (token) headers.set("Authorization", `Bearer ${token}`);
     if (sessionId) headers.set("Apilift-Session", sessionId);
@@ -31188,6 +31217,7 @@ function readCredentialDraft(filePath) {
     throw new Error(`Repair the selected transport draft at ${filePath}: ${paths.join(", ") || "/definition"}. Run discover check for field guidance`);
   }
   const transport = checked.definition;
+  if (credentialAuthoringIssues(transport).length) throw new Error(`Replace the encoded Basic credential contract in ${filePath}: declare raw saved fields and definition.httpBasic with no prefix. Apilift encodes at dispatch; do not ask the person to encode a key`);
   if (!transport.description.trim()) throw new Error(`Research credential acquisition and edit /definition/description in ${filePath}. Run discover check before secure setup`);
   return { transport, fingerprint: createHash4("sha256").update(canonicalJson(transport)).digest("hex") };
 }

package/dist/apilift.js

@@ -28032,7 +28032,7 @@ function bodyIssues(v, ctx) {
     if (name.toLowerCase() === "content-type" && (v.form !== void 0 || v.body !== void 0) && value !== (v.form !== void 0 ? "application/x-www-form-urlencoded" : "application/json"))
       ctx.addIssue({ code: "custom", message: "Content-Type conflicts with declared body encoding" });
 }
-var import__, resourceKinds, resourceKindSchema, segmentSchema, appSlugSchema, actionNameSchema, generatedNameSchema, inputNameSchema, pointerSchema, categorySlugs, categorySchema, title, description, requiredDescription, originSchema, httpUrlSchema, requestUrlSchema, ajv, jsonSchema, valueSchema, htmlFieldSchema, htmlExtractionSchema, continuationSchema, responseSchema, baseRequestSchema, readPreparationSchema, requestSchema, proofPointer, proofComparison, proofKey, proofSelection, proofSchema, appDefinitionSchema, entityDefinitionSchema, generatedSchema, executableActionSchema, unavailableActionSchema, actionDefinitionSchema, locatorSchema, observeSchema, injectSchema, credentialSchema, probeSchema, transportDefinitionSchema, browserContextDefinitionSchema, definitionSchemas;
+var import__, resourceKinds, resourceKindSchema, segmentSchema, appSlugSchema, actionNameSchema, generatedNameSchema, inputNameSchema, pointerSchema, categorySlugs, categorySchema, title, description, requiredDescription, originSchema, httpUrlSchema, requestUrlSchema, ajv, jsonSchema, valueSchema, htmlFieldSchema, htmlExtractionSchema, continuationSchema, responseSchema, baseRequestSchema, readPreparationSchema, requestSchema, proofPointer, proofComparison, proofKey, proofSelection, proofSchema, appDefinitionSchema, entityDefinitionSchema, generatedSchema, executableActionSchema, unavailableActionSchema, actionDefinitionSchema, locatorSchema, observeSchema, injectSchema, credentialSchema, basicComponent, httpBasicSchema, probeSchema, transportDefinitionSchema, browserContextDefinitionSchema, definitionSchemas;
 var init_schema = __esm({
   "../../packages/core/dist/definitions/schema.js"() {
     "use strict";
@@ -28173,8 +28173,10 @@ var init_schema = __esm({
     observeSchema = external_exports.strictObject({ kind: external_exports.literal("observe"), request: external_exports.strictObject({ method: external_exports.string(), urlPattern: external_exports.string() }), extract: external_exports.strictObject({ in: external_exports.enum(["request-header", "response-header", "response-body"]), name: external_exports.string().optional(), path: pointerSchema.optional() }), trigger: external_exports.union([external_exports.strictObject({ kind: external_exports.literal("navigate"), url: httpUrlSchema }), external_exports.strictObject({ kind: external_exports.literal("selector"), selector: external_exports.string() })]).optional(), cache: external_exports.literal("browser-session") });
     injectSchema = external_exports.strictObject({ from: external_exports.union([locatorSchema, observeSchema]), to: external_exports.union([external_exports.strictObject({ in: external_exports.literal("header"), name: external_exports.string() }), external_exports.strictObject({ in: external_exports.literal("query"), name: external_exports.string() }), external_exports.strictObject({ in: external_exports.literal("body"), path: pointerSchema }), external_exports.strictObject({ in: external_exports.literal("form"), name: external_exports.string().min(1) })]) });
     credentialSchema = external_exports.strictObject({ name: generatedNameSchema, header: external_exports.string().regex(/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/), prefix: external_exports.string().max(80).refine((v) => !/[\r\n]/.test(v)).optional() });
+    basicComponent = external_exports.union([generatedNameSchema, external_exports.strictObject({ literal: external_exports.string().max(128).refine((v) => ![...v].some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127), "Control characters are not allowed") })]);
+    httpBasicSchema = external_exports.strictObject({ username: basicComponent.optional(), password: basicComponent.optional() }).refine((v) => Object.values(v).some((value) => typeof value === "string"), "Name at least one saved credential field; the omitted component is empty");
     probeSchema = external_exports.strictObject({ effect: external_exports.literal("read").optional(), request: requestSchema, response: responseSchema, inputs: jsonSchema.optional() });
-    transportDefinitionSchema = external_exports.strictObject({ title, description: requiredDescription, mode: external_exports.enum(["direct", "browser"]), baseUrl: requestUrlSchema.optional(), allowedOrigins: external_exports.array(originSchema).min(1).max(100), browserContext: segmentSchema.optional(), credentials: external_exports.array(credentialSchema).max(16).optional(), inject: external_exports.array(injectSchema).optional(), identity: readPreparationSchema.extend({ paths: external_exports.array(pointerSchema).min(1).max(8) }).optional(), probes: external_exports.record(external_exports.string(), probeSchema) }).superRefine((v, ctx) => {
+    transportDefinitionSchema = external_exports.strictObject({ title, description: requiredDescription, mode: external_exports.enum(["direct", "browser"]), baseUrl: requestUrlSchema.optional(), allowedOrigins: external_exports.array(originSchema).min(1).max(100), browserContext: segmentSchema.optional(), credentials: external_exports.array(credentialSchema).max(16).optional(), httpBasic: httpBasicSchema.optional(), inject: external_exports.array(injectSchema).optional(), identity: readPreparationSchema.extend({ paths: external_exports.array(pointerSchema).min(1).max(8) }).optional(), probes: external_exports.record(external_exports.string(), probeSchema) }).superRefine((v, ctx) => {
       if (new Set(v.allowedOrigins).size !== v.allowedOrigins.length)
         ctx.addIssue({ code: "custom", path: ["allowedOrigins"], message: "Origins must be distinct" });
       if (v.mode === "direct" && !v.baseUrl)
@@ -28189,7 +28191,8 @@ var init_schema = __esm({
         const names2 = v.credentials.map((c) => c.name), headers = v.credentials.map((c) => c.header.toLowerCase());
         if (new Set(names2).size !== names2.length)
           ctx.addIssue({ code: "custom", path: ["credentials"], message: "Credential names must be unique" });
-        if (new Set(headers).size !== headers.length)
+        const ordinaryHeaders = v.credentials.filter((c) => !Object.values(v.httpBasic ?? {}).includes(c.name)).map((c) => c.header.toLowerCase());
+        if (new Set(ordinaryHeaders).size !== ordinaryHeaders.length)
           ctx.addIssue({ code: "custom", path: ["credentials"], message: "Credential headers must be unique" });
         for (const [i, header] of headers.entries())
           if (["cookie", "host", "content-length", "origin", "referer"].includes(header))
@@ -28199,6 +28202,25 @@ var init_schema = __esm({
             ctx.addIssue({ code: "custom", path: ["allowedOrigins", i], message: "Credentials require HTTPS origins" });
         });
       }
+      if (v.httpBasic) {
+        if (v.mode !== "direct")
+          ctx.addIssue({ code: "custom", path: ["httpBasic"], message: "HTTP Basic encoding requires direct mode" });
+        const names2 = Object.values(v.httpBasic).filter((value) => typeof value === "string");
+        if (new Set(names2).size !== names2.length)
+          ctx.addIssue({ code: "custom", path: ["httpBasic"], message: "Basic username and password must use distinct saved fields" });
+        for (const [slot, name] of Object.entries(v.httpBasic)) {
+          if (typeof name !== "string") {
+            if (slot === "username" && name.literal.includes(":"))
+              ctx.addIssue({ code: "custom", path: ["httpBasic", slot], message: "Basic username cannot contain a colon" });
+            continue;
+          }
+          const field = v.credentials?.find((c) => c.name === name);
+          if (!field || field.header.toLowerCase() !== "authorization" || field.prefix)
+            ctx.addIssue({ code: "custom", path: ["httpBasic", slot], message: "Reference a raw saved field with header Authorization and no prefix" });
+        }
+        if (v.credentials?.some((c) => c.header.toLowerCase() === "authorization" && !names2.includes(c.name)))
+          ctx.addIssue({ code: "custom", path: ["credentials"], message: "Basic authentication owns Authorization; remove conflicting credentials" });
+      }
       for (const origin of v.allowedOrigins)
         if (!Object.hasOwn(v.probes, origin))
           ctx.addIssue({ code: "custom", path: ["probes"], message: `Missing probe for ${origin}` });
@@ -28439,7 +28461,7 @@ function executableProjection(kind, definition2) {
       result4.inputs = inputDefault;
     return result4;
   }
-  const keys = kind === "transport" ? ["mode", "baseUrl", "allowedOrigins", "browserContext", "credentials", "inject", "identity", "probes"] : ["pageOrigin", "startUrl"];
+  const keys = kind === "transport" ? ["mode", "baseUrl", "allowedOrigins", "browserContext", "credentials", "httpBasic", "inject", "identity", "probes"] : ["pageOrigin", "startUrl"];
   const result3 = {};
   for (const key of keys) {
     const value = definition2[key];
@@ -28588,6 +28610,46 @@ var init_rules = __esm({
   }
 });
 
+// ../../packages/core/dist/definitions/credential-contract.js
+function credentialAuthoringIssues(transport) {
+  return (transport.credentials ?? []).flatMap((field, index2) => field.header.toLowerCase() === "authorization" && /^Basic(?:\s|$)/iu.test(field.prefix ?? "") ? [{ path: `/credentials/${index2}/prefix`, message: "Use raw saved credential fields with httpBasic and no prefix. Apilift encodes at dispatch; never ask the person to encode a key." }] : []);
+}
+function credentialContractKey(transport) {
+  return canonicalJson({ mode: transport.mode, origins: [...transport.allowedOrigins].sort(), baseOrigin: transport.baseUrl ? new URL(transport.baseUrl).origin : null, browserContext: transport.browserContext ?? null, credentials: [...transport.credentials ?? []].sort((a, b) => a.name.localeCompare(b.name)), ...transport.httpBasic ? { httpBasic: transport.httpBasic } : {}, inject: transport.inject ?? [] });
+}
+function credentialHeaders(requirements, values, basic) {
+  const headers = /* @__PURE__ */ Object.create(null);
+  const read = (name) => {
+    const value = values[name];
+    if (typeof value !== "string" || !value || [...value].some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127))
+      throw new Error("Saved credential is missing or contains invalid characters; configure it again");
+    return value;
+  };
+  for (const field of requirements) {
+    if (basic && Object.values(basic).includes(field.name))
+      continue;
+    headers[field.header] = `${field.prefix ?? ""}${read(field.name)}`;
+  }
+  if (basic) {
+    const component = (value) => typeof value === "string" ? read(value) : value?.literal ?? "";
+    const username = component(basic.username), password = component(basic.password);
+    if (username.includes(":"))
+      throw new Error("HTTP Basic username cannot contain a colon; configure it again");
+    const bytes = new TextEncoder().encode(`${username}:${password}`);
+    let binary = "";
+    for (const byte of bytes)
+      binary += String.fromCharCode(byte);
+    headers.Authorization = `Basic ${btoa(binary)}`;
+  }
+  return headers;
+}
+var init_credential_contract = __esm({
+  "../../packages/core/dist/definitions/credential-contract.js"() {
+    "use strict";
+    init_json();
+  }
+});
+
 // ../../packages/core/dist/definitions/metadata.js
 function describedProperties(schema) {
   if (!schema || typeof schema !== "object" || Array.isArray(schema))
@@ -28669,6 +28731,7 @@ function metadataIssues(kind, definition2) {
       schemaMetadataIssues(definition2.response.schema, "/response/schema", issues, true);
   }
   if (kind === "transport" && "probes" in definition2) {
+    issues.push(...credentialAuthoringIssues(definition2));
     for (const [origin, probe] of Object.entries(definition2.probes)) {
       if (probe.inputs !== void 0)
         schemaMetadataIssues(probe.inputs, `/probes/${pointer(origin)}/inputs`, issues, true);
@@ -28688,6 +28751,7 @@ var metadataLimits, placeholders, pointer;
 var init_metadata = __esm({
   "../../packages/core/dist/definitions/metadata.js"() {
     "use strict";
+    init_credential_contract();
     metadataLimits = { title: 80, app: 120, entity: 240, action: 600, transport: 1e3, "browser-context": 240, field: 600, editorial: 2e4 };
     placeholders = /^(?:todo|tbd|replace me|pending .*documentation|resource identifier|native type discriminator|native result|one filter(?:\/reference)? value)[.!]?$/iu;
     pointer = (value) => value.replaceAll("~", "~0").replaceAll("/", "~1");
@@ -28765,17 +28829,6 @@ var init_categories = __esm({
   }
 });
 
-// ../../packages/core/dist/definitions/credential-contract.js
-function credentialContractKey(transport) {
-  return canonicalJson({ mode: transport.mode, origins: [...transport.allowedOrigins].sort(), baseOrigin: transport.baseUrl ? new URL(transport.baseUrl).origin : null, browserContext: transport.browserContext ?? null, credentials: [...transport.credentials ?? []].sort((a, b) => a.name.localeCompare(b.name)), inject: transport.inject ?? [] });
-}
-var init_credential_contract = __esm({
-  "../../packages/core/dist/definitions/credential-contract.js"() {
-    "use strict";
-    init_json();
-  }
-});
-
 // ../../packages/core/dist/definitions/index.js
 var init_definitions = __esm({
   "../../packages/core/dist/definitions/index.js"() {
@@ -30768,6 +30821,7 @@ function draftTemplate(kind) {
     "// verification.probeOrigin selects one origin key; verification.inputs supplies local sample values when the probe needs them.",
     "// Keep verification.review pending until discover run succeeds; inspect its output, then choose accepted or rejected and explain verification.notes.",
     "// Browser page-derived auth belongs in definition.inject, not definition.credentials. credentials declares separately saved human-provided secrets; leave it [] when browser login supplies access.",
+    '// Direct HTTP Basic accepts original secrets: credentials: [{name:"api-key",header:"Authorization"}], httpBasic: {password:"api-key"}. The username is empty. For a key as username use httpBasic: {username:"api-key"}; for two saved fields name both. A documented fixed public label may use username: {literal:"api"}; actual secrets always name saved fields. Omitted components are empty. Do not set a prefix or ask the person to encode anything; Apilift constructs Basic authentication at dispatch.',
     `// Invented notes app example inside definition (replace only with observed addresses and nonsecret prefix): ${JSON.stringify(browserLocatorExample)}`,
     "// A locator hypothesis is not proof. Never copy a token value; verify the browser connection with discover run before accepting it.",
     ""
@@ -31205,7 +31259,7 @@ function createCliApi(baseUrl, fetcher = fetch, token, sessionId) {
   const transport = async (input2, init) => {
     const method = init?.method ?? "GET";
     const headers = new Headers(init?.headers);
-    headers.set("Apilift-Capabilities", "distributed-rollouts-v1,discovery-proof-v2,dynamic-bindings-v1,collection-proof-v3,web-responses-v1,bounded-catalog-v1");
+    headers.set("Apilift-Capabilities", "distributed-rollouts-v1,discovery-proof-v2,dynamic-bindings-v1,collection-proof-v3,web-responses-v1,bounded-catalog-v1,http-basic-v1");
     headers.set("Apilift-Client", `cli/${cliVersion}`);
     if (token) headers.set("Authorization", `Bearer ${token}`);
     if (sessionId) headers.set("Apilift-Session", sessionId);
@@ -38547,6 +38601,7 @@ function readCredentialDraft(filePath) {
     throw new Error(`Repair the selected transport draft at ${filePath}: ${paths2.join(", ") || "/definition"}. Run discover check for field guidance`);
   }
   const transport = checked.definition;
+  if (credentialAuthoringIssues(transport).length) throw new Error(`Replace the encoded Basic credential contract in ${filePath}: declare raw saved fields and definition.httpBasic with no prefix. Apilift encodes at dispatch; do not ask the person to encode a key`);
   if (!transport.description.trim()) throw new Error(`Research credential acquisition and edit /definition/description in ${filePath}. Run discover check before secure setup`);
   return { transport, fingerprint: createHash5("sha256").update(canonicalJson(transport)).digest("hex") };
 }
@@ -38554,6 +38609,7 @@ var init_credential_draft = __esm({
   "src/discovery/credential-draft.ts"() {
     "use strict";
     init_json();
+    init_definitions();
     init_envelope();
   }
 });
@@ -40510,7 +40566,12 @@ Inspect current action documentation: ${prefix2(`actions show ${appName} ${actio
         const values = await store.read(selectedCredential, { workspaceId: installation.workspaceId, appId: bundle2.app.id, appTitle: bundle2.app.slug, transportName: action.transport, legacyCredentialContract: "legacyCredentialContract" in requirements ? requirements.legacyCredentialContract : void 0, requirements: transport.credentials ?? [], credentialContract: credentialContractKey(transport), destinations: transport.allowedOrigins });
         responseSecrets.push(...Object.values(values));
         const headers = new Headers(request2.init.headers);
-        for (const requirement2 of transport.credentials ?? []) headers.set(requirement2.header, `${requirement2.prefix ?? ""}${values[requirement2.name]}`);
+        const injected = credentialHeaders(transport.credentials ?? [], values, transport.httpBasic);
+        responseSecrets.push(...retainedBasicSecrets(transport, injected));
+        for (const [name, value] of Object.entries(injected)) {
+          headers.set(name, value);
+          responseSecrets.push(value);
+        }
         request2 = { ...request2, init: { ...request2.init, headers } };
       } finally {
         store.close();
@@ -40541,7 +40602,7 @@ ${action.effect !== "read" && primary.response.status >= 500 ? readRecovery : ""
     } else {
       const value = projected(decodeResponse(primary, action.response), action, generated);
       outcome = "success";
-      output2 = result(`${JSON.stringify(value, null, 2)}
+      output2 = result(`${JSON.stringify(privateEvidence(value, responseSecrets).value, null, 2)}
 `, true);
     }
   } catch (error62) {
@@ -40575,6 +40636,7 @@ Inspect saved entries: ${prefix2(`credentials list ${appName} ${action.transport
 `, 5, !!dispatchedAt);
     }
   }
+  output2 = { ...output2, stdout: privateEvidence(output2.stdout, responseSecrets).value, stderr: privateEvidence(output2.stderr, responseSecrets).value };
   if (browserExecution.scope) await liveBrowser?.closeScope(browserExecution.scope.id).catch(() => {
   });
   const report = { id: reportId, connectionFingerprint: await hashJson({ transport: transportVersion.executableHash, credential: selectedCredential ?? null, browser: browserPage?.pageOrigin ?? null }), ...bundle2.receipt ? { receiptId: bundle2.receipt.id } : {}, appId: bundle2.app.id, actionName, actionVersion: actionVersion.version, closureHash: bundle2.closure.hash, purpose: "run", clientFamily: "cli", agent: session.agent, outcome, ...diagnostic ? { diagnostic } : {}, startedAt, ...dispatchedAt ? { dispatchedAt } : {}, finishedAt: (/* @__PURE__ */ new Date()).toISOString() };
@@ -40647,8 +40709,35 @@ function checkSavedProof(action, body, primary, inputs) {
   if (!action.proof) return void 0;
   return confirmProof(action.proof, body, primary, inputs, body === null && action.proof.absent && !action.proof.select ? 404 : 200);
 }
+function retainedBasicSecrets(transport, headers) {
+  if (transport.httpBasic) return [];
+  const header = Object.entries(headers).find(([name]) => name.toLowerCase() === "authorization")?.[1];
+  const payload = /^Basic\s+([A-Za-z0-9+/]+={0,2})$/iu.exec(header ?? "")?.[1];
+  if (!payload) return [];
+  const bytes = Buffer.from(payload, "base64"), decoded = /* @__PURE__ */ new Set([bytes.toString("latin1")]);
+  try {
+    decoded.add(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+  } catch {
+  }
+  return [...decoded].flatMap((value) => {
+    const at = value.indexOf(":");
+    return at < 0 ? [] : [value, value.slice(0, at), value.slice(at + 1)].filter(Boolean);
+  });
+}
 function privateEvidence(value, credentials) {
   const secrets = new Set(credentials.filter(Boolean));
+  for (const value2 of [...secrets]) {
+    const raw = value2.replace(/^[A-Za-z]{2,12} /u, "");
+    for (const secret of [value2, raw]) {
+      secrets.add(secret);
+      secrets.add(encodeURIComponent(secret));
+      secrets.add(encodeURIComponent(secret).replace(/%[0-9A-F]{2}/gu, (escape6) => escape6.toLowerCase()));
+      secrets.add(new URLSearchParams([["", secret]]).toString().slice(1));
+      secrets.add(JSON.stringify(secret).slice(1, -1));
+      secrets.add(Buffer.from(secret, "utf8").toString("base64"));
+      secrets.add(Buffer.from(secret, "utf8").toString("base64url"));
+    }
+  }
   JSON.stringify(value, (_key, child) => {
     if (typeof child === "string" && /^\s*</u.test(child)) for (const secret of htmlSecrets(child)) secrets.add(secret);
     return child;
@@ -40659,18 +40748,25 @@ function privateEvidence(value, credentials) {
     return child;
   });
   let redacted = JSON.stringify(value).includes("[REDACTED]");
-  const text4 = JSON.stringify(value, (_key, child) => {
-    if (typeof child === "string") {
-      let safe = child;
-      for (const secret of [...secrets].sort((a, b) => b.length - a.length)) if (secret && safe.includes(secret)) {
-        redacted = true;
-        safe = safe.split(secret).join("[REDACTED]");
-      }
-      return safe;
+  const ordered = [...secrets].filter(Boolean).sort((a, b) => b.length - a.length);
+  const hide2 = (text4) => {
+    for (const secret of ordered) if (text4.includes(secret)) {
+      redacted = true;
+      text4 = text4.split(secret).join("[REDACTED]");
     }
+    return text4;
+  };
+  const visit4 = (child) => {
+    if (typeof child === "string") return hide2(child);
+    if (typeof child === "number" && secrets.has(String(child))) {
+      redacted = true;
+      return "[REDACTED]";
+    }
+    if (Array.isArray(child)) return child.map(visit4);
+    if (child && typeof child === "object") return Object.fromEntries(Object.entries(child).map(([key, entry2]) => [hide2(key), visit4(entry2)]));
     return child;
-  });
-  return { value: JSON.parse(text4), redacted };
+  };
+  return { value: visit4(value), redacted };
 }
 async function executeDraftVerification(input2) {
   const { transport } = input2;
@@ -40762,7 +40858,12 @@ async function executeDraftVerification(input2) {
         const values2 = await store.read(credential2, { workspaceId: installation.workspaceId, ...credentialDraftId ? { draftId: credentialDraftId } : {}, appId: input2.appId, appTitle: input2.appSlug, transportName: input2.kind === "action" && action && "transport" in action ? action.transport : input2.name, requirements: transport.credentials ?? [], credentialContract: credentialContractKey(transport), destinations: transport.allowedOrigins });
         knownCredentials.push(...Object.values(values2));
         const headers = new Headers(request2.init.headers);
-        for (const requirement2 of transport.credentials ?? []) headers.set(requirement2.header, `${requirement2.prefix ?? ""}${values2[requirement2.name]}`);
+        const injected = credentialHeaders(transport.credentials ?? [], values2, transport.httpBasic);
+        knownCredentials.push(...retainedBasicSecrets(transport, injected));
+        for (const [name, value] of Object.entries(injected)) {
+          headers.set(name, value);
+          knownCredentials.push(value);
+        }
         request2 = { ...request2, init: { ...request2.init, headers } };
       } finally {
         store.close();
@@ -40832,7 +40933,7 @@ async function executeDraftVerification(input2) {
     if (input2.kind === "transport") {
       const selected = projected(decoded, { response: probe.response }, generated);
       if (probe.response.schema && !ajv3.compile(probe.response.schema)(selected)) return { ok: false, message: "Probe response does not match its declared schema", exitCode: 12, dispatched };
-      return { ok: true, output: selected, proof: "not-applicable", dispatched: true };
+      return { ok: true, output: privateEvidence(selected, knownCredentials).value, proof: "not-applicable", dispatched: true };
     }
     const executable = action;
     const value = projected(decoded, executable, generated);
@@ -40847,11 +40948,11 @@ async function executeDraftVerification(input2) {
       } catch (error62) {
         throw new ResponseContractFailure(error62 instanceof Error ? error62.message : "Readback did not confirm success");
       }
-      return { ok: true, output: value, proof: "passed", dispatched: true, ...context ? { context } : {} };
+      return { ok: true, output: privateEvidence(value, knownCredentials).value, proof: "passed", dispatched: true, ...context ? { context } : {} };
     }
-    return { ok: true, output: value, proof: "not-applicable", dispatched: true, ...context ? { context } : {} };
+    return { ok: true, output: privateEvidence(value, knownCredentials).value, proof: "not-applicable", dispatched: true, ...context ? { context } : {} };
   } catch (error62) {
-    return { ok: false, message: `${(error62 instanceof Error ? error62.message : "The test did not return").replace(/[.\s]+$/u, "")}. ${dispatched ? input2.kind === "transport" || action && "effect" in action && action.effect === "read" ? "The read did not return complete evidence" : "The request may have reached the app; inspect its state before another mutation" : "No app request was sent"}`, exitCode: error62 instanceof ResponseContractFailure ? 12 : dispatched || error62 instanceof BrowserControlError || ["extension-unavailable", "capture-server-unavailable", "native-host-upgrade-required"].includes(error62?.code ?? "") ? 5 : 2, dispatched };
+    return { ok: false, message: privateEvidence(`${(error62 instanceof Error ? error62.message : "The test did not return").replace(/[.\s]+$/u, "")}. ${dispatched ? input2.kind === "transport" || action && "effect" in action && action.effect === "read" ? "The read did not return complete evidence" : "The request may have reached the app; inspect its state before another mutation" : "No app request was sent"}`, knownCredentials).value, exitCode: error62 instanceof ResponseContractFailure ? 12 : dispatched || error62 instanceof BrowserControlError || ["extension-unavailable", "capture-server-unavailable", "native-host-upgrade-required"].includes(error62?.code ?? "") ? 5 : 2, dispatched };
   } finally {
     if (browserExecution.scope) await liveBrowser?.closeScope(browserExecution.scope.id).catch(() => {
     });
@@ -41501,17 +41602,20 @@ List current entries: ${command3(invocation, `credentials list ${selectedApp.slu
       if (!current.requirements.length) return ok3(`This connection requires no stored credential.
 ${current.instructions}
 `);
+      if (credentialAuthoringIssues({ credentials: current.requirements }).length) return fail4(`This connection expects an encoded Basic value. Update it to raw saved fields with httpBasic before opening secure setup; do not ask the person to encode a key.
+Open ${command3(invocation, `apps update ${selectedApp.slug}`)}, then ${command3(invocation, `discover draft transport ${transportName}`)}.
+`, 2);
       const expiresAt = new Date(Date.now() + 30 * 6e4).toISOString();
       const draftId = ownedDraft && draftContract ? randomUUID8() : void 0;
       if (draftId && ownedDraft && draftContract) store.registerDraft({ ...current, draftId, expiresAt, source: { draftId: ownedDraft.id, sessionId: session.id, fingerprint: draftContract.fingerprint } });
       const link = { ...draftId ? { draftId } : {}, appId: selectedApp.id, appTitle: selectedApp.title, transportName, instructions: current.instructions, requirements: current.requirements, sessionId: session.id, expiresAt };
       const url3 = `${siteUrl2}/dashboard/credentials/setup#${Buffer.from(canonicalJson(link)).toString("base64url")}`;
       return ok3(`${selectedApp.title}'s ${transportName} connection needs a credential. The user must obtain and save it; do not ask them to paste it into chat or arguments.
-
+${ownedDraft ? "Keep this transport draft selected and unchanged until the user confirms Saved. Editing it, discover defer, discard or close invalidates this link. Continue read-only research while waiting; switch drafts only after setup and verification.\n" : ""}
 Give the user these instructions:
 ${current.instructions}
 Open ${url3}
-Choose Configure credential in the dashboard, then choose a local label and enter the value in the extension's secure form. The form must show Saved. This entry is selected for this requesting session.
+Choose Configure credential in the dashboard, then choose a local label and enter the original credential in the extension's secure form. The form must show Saved. This entry is selected for this requesting session.
 
 After the user confirms saving, ${ownedDraft ? `continue verification: ${command3(invocation, "discover run")}.` : "continue the action you were preparing."} Saving does not prove the credential works.
 `);
@@ -43584,15 +43688,20 @@ async function captureView(item, part, pointer6, scopeId, root2, invocation) {
 ` : "--part must be request or response.\n");
   const body = await selectedBody(item, part, scopeId, root2, deadline);
   const unavailable = part === "request" ? entry2.reqBodyState ?? entry2.requestMaterialUnavailable : entry2.resBodyState ?? entry2.bodyUnavailable;
+  const redactionReason = unavailable === "redaction-unavailable" ? (() => {
+    const reasons = String(entry2.requestMaterialUnavailable ?? "").split(",").filter((reason) => ["request-extra-info-unavailable", "response-extra-info-unavailable", "short-sensitive-fragment-unredactable"].includes(reason));
+    return `Redaction could not safely retain this body${reasons.length ? `: ${reasons.join(", ")}` : ""}. ${reasons.includes("short-sensitive-fragment-unredactable") ? "Update Companion before another capture; setup connectivity checks do not test this redaction case. " : ""}Use other retained evidence or an authorized alternative route; do not repeat a mutation to recover its body.
+`;
+  })() : "";
   const artifact = entry2[part === "request" ? "reqBodyArtifact" : "resBodyArtifact"];
   if ((artifact || part === "response" && entry2.pending) && body === null) return fail5(`Captured ${part} body for c${item.seq} is still collecting. Retry ${command4(invocation, `discover capture show c${item.seq}${part === "request" ? " --part request" : ""}`)}; no app request is sent.
 `, 12);
   if (typeof body !== "string" && part === "request") return ok4(`Captured request metadata for c${item.seq}; body is ${String(unavailable ?? "absent")}.
-${candidateLine(item)}
+${redactionReason}${candidateLine(item)}
 ${requestHeaderSummary(entry2)}${requestQuerySummary(entry2)}This reads retained evidence; it sends no app request.
 `);
   if (typeof body !== "string") return fail5(`Captured ${part} body for c${item.seq} is ${String(unavailable ?? "unavailable")}. Metadata: ${candidateLine(item)}
-`);
+${redactionReason}`);
   let parsed;
   try {
     parsed = JSON.parse(body);

package/dist/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "apilift",
-  "version": "1.7.2",
+  "version": "1.8.0",
   "description": "Use logged-in apps and discover missing actions with Apilift.",
   "author": {
     "name": "Apilift"

package/dist/plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "apilift",
-  "version": "1.7.2",
+  "version": "1.8.0",
   "description": "Use logged-in apps and discover missing actions with Apilift.",
   "author": {
     "name": "Apilift"

package/dist/plugin/skills/discover/references/documented-api.md

@@ -4,8 +4,10 @@ Search current first-party documentation for the selected operation and its auth
 
 HTML responses, URL-encoded forms, fresh CSRF tokens from one read-only preparation request and declared read navigation are supported direct operations when authorization permits. These formats do not establish a missing API route. Read [operation-contract.md](operation-contract.md) for the extraction and preparation contracts before deciding that a documented operation needs browser fallback. Browser-managed authentication or missing request documentation can still require browser observation; JavaScript-only rendering, uploads and workflows containing multiple writes remain outside these contracts.
 
-A direct connection is an independent `transport` draft. Give it a meaningful description, `mode: "direct"`, fixed `baseUrl`, explicit `allowedOrigins`, value-free `credentials` requirements and harmless read `probes` for its destinations. Research and write concrete HTTPS acquisition steps before testing an operation that needs a key. The app's `origin` is its primary UI location; it is not a substitute for a connection destination. A transport with several origins needs one successful, semantically reviewed `discover run` per origin by editing `verification.probeOrigin` between runs. For a read using POST or another non-GET method, declare its semantic read effect rather than deriving effect from method.
+A direct connection is an independent `transport` draft. Give it a meaningful description, `mode: "direct"`, fixed `baseUrl`, explicit `allowedOrigins`, value-free `credentials` requirements and harmless read `probes` for its destinations. Research and write concrete HTTPS acquisition steps before testing an operation that needs a key. Verify the issuance URL and visible controls from current official instructions or observed UI; never invent a settings route. If issuance requires an account-specific URL, publish the verified sign-in URL and navigation steps rather than an account identifier. The app's `origin` is its primary UI location; it is not a substitute for a connection destination. A transport with several origins needs one successful, semantically reviewed `discover run` per origin by editing `verification.probeOrigin` between runs. For a read using POST or another non-GET method, declare its semantic read effect rather than deriving effect from method.
 
-If verification reports a missing or changed credential, follow the returned `credentials add` setup link. The person enters the value through the secure form, and the agent then selects the intended saved entry for this session with the exact CLI continuation. Do not ask for a key in chat or store it in a draft, command, environment variable, or capture. Acquisition instructions are required even if a key is already saved; they let the next user provision access. Re-run the same selected transport verification after human setup and inspect its meaning before accepting review.
+For HTTP Basic, declare raw saved fields with `header: "Authorization"` and no prefix, then map their names in `definition.httpBasic`: `{password:"api-key"}` for an empty username, `{username:"api-key"}` for an empty password, or both named fields. Use `{literal:"api"}` for a documented fixed public component; never put an actual credential in a literal. Apilift encodes the values only at dispatch. The person enters the original key through the standard secure form; never ask them to Base64-encode, transform or expose it. A transport limitation does not establish that the documented operation is unavailable; assess other documented authentication before changing protocols.
+
+If verification reports a missing or changed credential, follow the returned `credentials add` setup link. Keep its transport draft selected and unchanged until the person confirms Saved: editing or releasing it invalidates that link. Continue only independent read-only research while waiting; verify the credential before switching drafts. The secure form selects the saved entry for this requesting session; use the exact CLI continuation if selecting an existing entry. Do not ask for a key in chat or store it in a draft, command, environment variable, or capture. Acquisition instructions are required even if a key is already saved; they let the next user provision access. If the person reports a wrong acquisition link, inspect the app's actual key controls and correct the transport description before generating a replacement setup link. Re-run the same selected transport verification after human setup and inspect its meaning before accepting review.
 
 A scoped harmless probe can take explicit local `verification.inputs`. Publish a reachable read action that supplies an app-owned identifier for later consumers; never embed an observed account identifier in a published probe or make the origin dynamic. Do not add a published context-variable resource. Begin browser fallback only after the requested documented operation, authorization, and provisioning route have been assessed. A local environment failure is not proof that the app lacks an API capability.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@apilift/cli",
-  "version": "1.7.2",
+  "version": "1.8.0",
   "private": false,
   "type": "module",
   "bin": {
@@ -37,7 +37,7 @@
   "engines": {
     "node": ">=24.16.0 <27"
   },
-  "gitHead": "9e4732871b0c2f7fcd0e7ef763da291488572b43",
+  "gitHead": "d71590d4126cee561a43649452a5f6f59d7961ab",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/egor-sergeev/apilift.git",