@sdods/core 0.7.1 → 0.8.0

package/dist/load/profile.js

@@ -0,0 +1,109 @@
+import { existsSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { ZodError } from 'zod';
+import { LOAD_READ_METHODS, LoadProfileSchema, } from '@sdods/contracts';
+import { SdodsConfigError } from '../errors.js';
+import { assertNoSecretLiterals } from '../config/interpolate.js';
+import { readYamlFile, zodToConfigError } from '../config/resolve.js';
+export const LOAD_DIR = 'load';
+const PROFILE_NAME_RE = /^[a-z0-9][a-z0-9._-]*$/i;
+/** Profile names under `projects/<slug>/load/`, without the extension. */
+export function listLoadProfiles(projectRoot) {
+    const dir = join(projectRoot, LOAD_DIR);
+    if (!existsSync(dir))
+        return [];
+    return readdirSync(dir)
+        .filter((f) => /\.ya?ml$/.test(f))
+        .map((f) => f.replace(/\.ya?ml$/, ''))
+        .sort();
+}
+export function loadProfileFile(projectRoot, name) {
+    if (!PROFILE_NAME_RE.test(name))
+        return undefined;
+    for (const ext of ['yaml', 'yml']) {
+        const file = join(projectRoot, LOAD_DIR, `${name}.${ext}`);
+        if (existsSync(file))
+            return file;
+    }
+    return undefined;
+}
+export function parseLoadProfile(raw, file = '<profile>') {
+    assertNoSecretLiterals(raw, 'profile');
+    try {
+        return LoadProfileSchema.parse(raw ?? {});
+    }
+    catch (e) {
+        if (e instanceof ZodError)
+            throw zodToConfigError(e, file);
+        throw e;
+    }
+}
+export function readLoadProfile(projectRoot, name) {
+    const file = loadProfileFile(projectRoot, name);
+    if (!file) {
+        const known = listLoadProfiles(projectRoot);
+        throw new SdodsConfigError(`No load profile "${name}" in ${join(projectRoot, LOAD_DIR)}.`, {
+            code: 'CONFIG_NOT_FOUND',
+            hint: known.length
+                ? `Known profiles: ${known.join(', ')}.`
+                : `Create ${LOAD_DIR}/${name}.yaml in the project folder (see the load testing guide).`,
+            docsPath: '/docs/guides/load-testing',
+        });
+    }
+    return parseLoadProfile(readYamlFile(file), file);
+}
+/** The most virtual users the profile reaches: `vus`, or the highest stage target. */
+export function peakVus(profile) {
+    if (profile.stages)
+        return Math.max(...profile.stages.map((s) => s.target));
+    return profile.vus ?? 1;
+}
+/**
+ * Why this environment may not take this profile. Empty means it may.
+ * Checked before every real run; `--dry-run` only reports it.
+ */
+export function loadGuardProblems(env, profile) {
+    const problems = [];
+    const load = env.load;
+    if (!load?.allowed) {
+        problems.push(`environment "${env.name}" has not opted in to load tests (envs/${env.name}.yaml has no \`load: { allowed: true }\`)`);
+    }
+    const peak = peakVus(profile);
+    if (load?.maxVus !== undefined && peak > load.maxVus) {
+        problems.push(`profile peaks at ${peak} virtual users, above load.maxVus ${load.maxVus} for "${env.name}"`);
+    }
+    const writes = profile.requests.filter((r) => !LOAD_READ_METHODS.includes(r.method));
+    if (writes.length && !load?.allowWrites) {
+        problems.push(`profile sends ${[...new Set(writes.map((r) => r.method))].join(', ')} requests and "${env.name}" does not set load.allowWrites: true`);
+    }
+    return problems;
+}
+/**
+ * The load goes to `SDODS_API_BASE_URL` when it is set. The opt-in is for the environment file, so
+ * an override that points at another host is refused unless that file sets
+ * `load.allowBaseUrlOverride: true`. Both URLs are compared without trailing slashes.
+ */
+export function baseUrlOverrideProblems(env, envBaseUrl, override) {
+    const norm = (u) => u.trim().replace(/\/+$/, '');
+    if (!override || norm(override) === norm(envBaseUrl) || env.load?.allowBaseUrlOverride)
+        return [];
+    return [
+        `SDODS_API_BASE_URL (${norm(override)}) is not the api.baseUrl of "${env.name}" (${norm(envBaseUrl)}), and envs/${env.name}.yaml does not set load.allowBaseUrlOverride: true`,
+    ];
+}
+export function assertLoadAllowed(env, profile, extraProblems = []) {
+    const problems = [...loadGuardProblems(env, profile), ...extraProblems];
+    if (!problems.length)
+        return;
+    throw new SdodsConfigError(`Refusing to run a load test: ${problems.join('; ')}.`, {
+        hint: `Only opt in an environment you own and that is sized for load — never production. ` +
+            `In envs/${env.name}.yaml: load: { allowed: true, maxVus: 50, allowWrites: false }. ` +
+            (extraProblems.length
+                ? 'Unset SDODS_API_BASE_URL, or set load.allowBaseUrlOverride: true in the environment file if the override is intended. '
+                : '') +
+            '`--dry-run` writes the script without running it.',
+        docsPath: '/docs/guides/load-testing',
+        details: { problems },
+    });
+}
+//# sourceMappingURL=profile.js.map

package/dist/load/run.d.ts

@@ -0,0 +1,85 @@
+import { SdodsError } from '../errors.js';
+export declare const K6_INSTALL_URL = "https://grafana.com/docs/k6/latest/set-up/install-k6/";
+export declare const K6_DEFAULT_IMAGE = "grafana/k6:latest";
+/** k6 exits with 99 when one or more thresholds failed. */
+export declare const K6_THRESHOLDS_FAILED = 99;
+export type LoadRunner = 'auto' | 'k6' | 'docker';
+export type LoadStdio = 'inherit' | 'pipe' | 'stderr';
+/** Absolute path of an executable on `PATH`, or undefined. */
+export declare function findExecutable(name: string, env?: NodeJS.ProcessEnv): string | undefined;
+export declare function k6MissingError(runner: LoadRunner): SdodsError;
+/** sdods exit code for a k6 exit code: 0 passes, anything else (99 = thresholds) fails with 1. */
+export declare function mapK6ExitCode(code: number): {
+    exitCode: number;
+    thresholdsFailed: boolean;
+};
+export interface RunK6Options {
+    outDir: string;
+    scriptFile: string;
+    summaryFile: string;
+    runner?: LoadRunner;
+    image?: string;
+    /** Environment for the k6 process; k6 exposes it to the script as `__ENV`. */
+    env: NodeJS.ProcessEnv;
+    /** Names passed into the container with `-e NAME` (values stay out of the command line). */
+    passEnv?: string[];
+    /** `stderr` sends k6's output to stderr so stdout stays machine-readable (`--json`). */
+    stdio?: LoadStdio;
+}
+export interface RunK6Result {
+    runner: 'k6' | 'docker';
+    command: string;
+    k6ExitCode: number;
+    stdout: string;
+    stderr: string;
+}
+export declare function runK6(opts: RunK6Options): Promise<RunK6Result>;
+export interface LoadSummary {
+    requests?: number;
+    p95Ms?: number;
+    failedRate?: number;
+    checksRate?: number;
+}
+/** A few headline numbers from k6's `--summary-export` JSON; absent metrics stay undefined. */
+export declare function readK6Summary(file: string): LoadSummary | undefined;
+export interface RunLoadOptions {
+    rootDir: string;
+    projectRoot: string;
+    profile: string;
+    env?: string;
+    /** Where to write script.js, summary.json and load.json. Default `.sdods/runs/<id>/load/<profile>`. */
+    outDir?: string;
+    dryRun?: boolean;
+    runner?: LoadRunner;
+    image?: string;
+    processEnv?: NodeJS.ProcessEnv;
+    stdio?: LoadStdio;
+    /** Progress lines (target, peak VUs, warnings), printed before k6 starts. */
+    log?: (line: string) => void;
+}
+export interface LoadRunResult {
+    project: string;
+    env: string;
+    profile: string;
+    target: string;
+    peakVus: number;
+    outDir: string;
+    scriptFile: string;
+    summaryFile?: string;
+    dryRun: boolean;
+    /** Reasons a real run would be refused (reported by --dry-run; a real run throws instead). */
+    guardProblems: string[];
+    requiredEnv: string[];
+    runner?: 'k6' | 'docker';
+    k6ExitCode?: number;
+    thresholdsFailed: boolean;
+    summary?: LoadSummary;
+    exitCode: number;
+}
+/**
+ * Generate a k6 script for a load profile and run it against an environment that opted in.
+ * The environment is read uninterpolated so `${VAR}` secrets become `__ENV` lookups; their values
+ * reach k6 through its process environment only.
+ */
+export declare function runLoad(opts: RunLoadOptions): Promise<LoadRunResult>;
+//# sourceMappingURL=run.d.ts.map

package/dist/load/run.js

@@ -0,0 +1,255 @@
+import { accessSync, constants, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { delimiter, join, resolve as resolvePath } from 'node:path';
+import { execa } from 'execa';
+import { newRunId } from '@sdods/contracts';
+import { SdodsConfigError, SdodsError } from '../errors.js';
+import { DEFAULT_ARTIFACTS_DIR } from '../config/defaults.js';
+import { loadDotEnvLayer } from '../config/env-files.js';
+import { assertNoSecretLiterals, interpolateString } from '../config/interpolate.js';
+import { loadEnvFile, loadProjectFile } from '../config/resolve.js';
+import { assertLoadAllowed, baseUrlOverrideProblems, loadGuardProblems, peakVus, readLoadProfile, } from './profile.js';
+import { generateK6Script } from './script.js';
+export const K6_INSTALL_URL = 'https://grafana.com/docs/k6/latest/set-up/install-k6/';
+export const K6_DEFAULT_IMAGE = 'grafana/k6:latest';
+/** k6 exits with 99 when one or more thresholds failed. */
+export const K6_THRESHOLDS_FAILED = 99;
+/** Absolute path of an executable on `PATH`, or undefined. */
+export function findExecutable(name, env = process.env) {
+    const exts = process.platform === 'win32' ? (env.PATHEXT ?? '.EXE;.CMD;.BAT').split(';') : [''];
+    for (const dir of (env.PATH ?? env.Path ?? '').split(delimiter)) {
+        if (!dir)
+            continue;
+        for (const ext of exts) {
+            const file = join(dir, name + ext);
+            try {
+                accessSync(file, constants.X_OK);
+                return file;
+            }
+            catch {
+                // keep looking
+            }
+        }
+    }
+    return undefined;
+}
+export function k6MissingError(runner) {
+    if (runner === 'docker') {
+        return new SdodsError('NOT_SUPPORTED', '`--runner docker` needs docker on PATH.', {
+            hint: `Install Docker, or install k6 itself (${K6_INSTALL_URL}) and use --runner k6.`,
+            docsPath: '/docs/guides/load-testing',
+            exitCode: 2,
+        });
+    }
+    return new SdodsError('NOT_SUPPORTED', 'k6 is not installed (no `k6` on PATH).', {
+        hint: `Install k6: ${K6_INSTALL_URL} (macOS: brew install k6), or run it in Docker with ` +
+            '`--runner docker`. `--dry-run` writes the script without k6.',
+        docsPath: '/docs/guides/load-testing',
+        exitCode: 2,
+    });
+}
+/** sdods exit code for a k6 exit code: 0 passes, anything else (99 = thresholds) fails with 1. */
+export function mapK6ExitCode(code) {
+    if (code === 0)
+        return { exitCode: 0, thresholdsFailed: false };
+    return { exitCode: 1, thresholdsFailed: code === K6_THRESHOLDS_FAILED };
+}
+export async function runK6(opts) {
+    const runner = opts.runner ?? 'auto';
+    let file;
+    let args;
+    let used;
+    const k6 = runner === 'docker' ? undefined : findExecutable('k6', opts.env);
+    if (k6) {
+        used = 'k6';
+        file = k6;
+        args = ['run', '--summary-export', opts.summaryFile, opts.scriptFile];
+    }
+    else if (runner === 'docker') {
+        const docker = findExecutable('docker', opts.env);
+        if (!docker)
+            throw k6MissingError('docker');
+        used = 'docker';
+        file = docker;
+        const mount = resolvePath(opts.outDir);
+        args = [
+            'run',
+            '--rm',
+            '-i',
+            '-v',
+            `${mount}:/sdods-load`,
+            ...(opts.passEnv ?? []).flatMap((name) => ['-e', name]),
+            opts.image ?? K6_DEFAULT_IMAGE,
+            'run',
+            '--summary-export',
+            `/sdods-load/${relativeTo(mount, opts.summaryFile)}`,
+            `/sdods-load/${relativeTo(mount, opts.scriptFile)}`,
+        ];
+    }
+    else {
+        throw k6MissingError(runner);
+    }
+    const res = await execa(file, args, {
+        env: opts.env,
+        extendEnv: false,
+        reject: false,
+        stdio: opts.stdio === 'stderr' ? ['ignore', 2, 2] : (opts.stdio ?? 'inherit'),
+    });
+    if (res.failed && typeof res.exitCode !== 'number') {
+        throw new SdodsError('RUN_FAILED', `Could not start ${used}: ${res.message}`, {
+            docsPath: '/docs/guides/load-testing',
+        });
+    }
+    return {
+        runner: used,
+        command: [used, ...args].join(' '),
+        k6ExitCode: res.exitCode ?? 1,
+        stdout: typeof res.stdout === 'string' ? res.stdout : '',
+        stderr: typeof res.stderr === 'string' ? res.stderr : '',
+    };
+}
+function relativeTo(dir, file) {
+    const abs = resolvePath(file);
+    if (!abs.startsWith(dir + '/') && !abs.startsWith(dir + '\\')) {
+        throw new SdodsError('INTERNAL', `${abs} is not inside ${dir}; docker cannot mount it.`);
+    }
+    return abs.slice(dir.length + 1).replace(/\\/g, '/');
+}
+/** A few headline numbers from k6's `--summary-export` JSON; absent metrics stay undefined. */
+export function readK6Summary(file) {
+    if (!existsSync(file))
+        return undefined;
+    try {
+        const metrics = JSON.parse(readFileSync(file, 'utf8'))
+            .metrics;
+        if (!metrics)
+            return undefined;
+        const num = (v) => (typeof v === 'number' ? v : undefined);
+        return {
+            requests: num(metrics.http_reqs?.count),
+            p95Ms: num(metrics.http_req_duration?.['p(95)']),
+            failedRate: num(metrics.http_req_failed?.value ?? metrics.http_req_failed?.rate),
+            checksRate: num(metrics.checks?.value ?? metrics.checks?.rate),
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Generate a k6 script for a load profile and run it against an environment that opted in.
+ * The environment is read uninterpolated so `${VAR}` secrets become `__ENV` lookups; their values
+ * reach k6 through its process environment only.
+ */
+export async function runLoad(opts) {
+    const processEnv = opts.processEnv ?? process.env;
+    const log = opts.log ?? (() => { });
+    const project = loadProjectFile(opts.projectRoot);
+    const envName = opts.env ?? processEnv.SDODS_ENV ?? project.envs.default;
+    if (!project.envs.available.includes(envName)) {
+        throw new SdodsConfigError(`Environment "${envName}" is not in envs.available [${project.envs.available.join(', ')}] for project ${project.slug}.`, { code: 'ENV_NOT_FOUND' });
+    }
+    const env = loadEnvFile(opts.projectRoot, envName);
+    assertNoSecretLiterals(env, 'env');
+    const profile = readLoadProfile(opts.projectRoot, opts.profile);
+    const vars = {
+        ...loadDotEnvLayer(opts.rootDir, opts.projectRoot, envName).values,
+        ...processEnv,
+    };
+    const envBaseUrl = interpolateString(env.api.baseUrl, { vars, onUnresolved: 'throw' }, 'env.api.baseUrl').replace(/\/+$/, '');
+    const override = processEnv.SDODS_API_BASE_URL || undefined;
+    const overrideProblems = baseUrlOverrideProblems(env, envBaseUrl, override);
+    const target = (override ?? envBaseUrl).trim().replace(/\/+$/, '');
+    const peak = peakVus(profile);
+    const guardProblems = [...loadGuardProblems(env, profile), ...overrideProblems];
+    const { script, requiredEnv } = generateK6Script({
+        project: project.slug,
+        profileName: opts.profile,
+        profile,
+        env,
+        baseUrl: target,
+    });
+    log(`target   ${target}`);
+    log(`peak VUs ${peak}${profile.stages ? ` (stages)` : ''}`);
+    if (opts.dryRun) {
+        for (const p of guardProblems)
+            log(`warning: a real run would be refused: ${p}`);
+    }
+    else {
+        // Refuse before writing anything: a refused run leaves no run directory behind.
+        assertLoadAllowed(env, profile, overrideProblems);
+        const missing = requiredEnv.filter((name) => !vars[name]);
+        if (missing.length) {
+            throw new SdodsConfigError(`The load script reads ${missing.map((n) => `\${${n}}`).join(', ')} and ${missing.length === 1 ? 'it is' : 'they are'} not set.`, {
+                code: 'CONFIG_UNRESOLVED_VAR',
+                hint: `Add ${missing[0]}=... to .env.${envName} (repo root or project folder), or export it in the shell.`,
+                details: { variables: missing },
+            });
+        }
+    }
+    const outDir = resolvePath(opts.outDir ??
+        join(opts.rootDir, processEnv.SDODS_ARTIFACTS_DIR || DEFAULT_ARTIFACTS_DIR, newRunId(), 'load', opts.profile));
+    mkdirSync(outDir, { recursive: true });
+    const scriptFile = join(outDir, 'script.js');
+    const summaryFile = join(outDir, 'summary.json');
+    writeFileSync(scriptFile, script);
+    const result = {
+        project: project.slug,
+        env: envName,
+        profile: opts.profile,
+        target,
+        peakVus: peak,
+        outDir,
+        scriptFile,
+        dryRun: Boolean(opts.dryRun),
+        guardProblems,
+        requiredEnv,
+        thresholdsFailed: false,
+        exitCode: 0,
+    };
+    const writeMeta = () => writeFileSync(join(outDir, 'load.json'), JSON.stringify({ ...result, finishedAt: new Date().toISOString() }, null, 2) + '\n');
+    if (opts.dryRun) {
+        writeMeta();
+        return result;
+    }
+    // Dotenv values reach k6 through its environment, never through the script or its arguments.
+    // Every variable the script reads, including `${VAR:-default}` ones set in .env files.
+    const referenced = [
+        ...new Set([...script.matchAll(/__ENV\.([A-Za-z_][A-Za-z0-9_]*)/g)].map((m) => m[1])),
+    ]
+        .filter((name) => vars[name] !== undefined)
+        .sort();
+    const k6Env = { ...processEnv };
+    for (const name of referenced)
+        k6Env[name] = vars[name];
+    // k6 reads K6_VUS, K6_STAGES, K6_DURATION, K6_ITERATIONS, K6_SCENARIOS and the rest as options that
+    // override the script, which would bypass the profile and load.maxVus. None are passed through.
+    const stripped = Object.keys(k6Env)
+        .filter((name) => /^K6_/i.test(name))
+        .sort();
+    for (const name of stripped)
+        delete k6Env[name];
+    if (stripped.length)
+        log(`warning: not passing ${stripped.join(', ')} to k6: k6 reads K6_* variables as options that override the profile and load.maxVus`);
+    const run = await runK6({
+        outDir,
+        scriptFile,
+        summaryFile,
+        runner: opts.runner,
+        image: opts.image,
+        env: k6Env,
+        passEnv: referenced.filter((name) => !stripped.includes(name)),
+        stdio: opts.stdio,
+    });
+    const mapped = mapK6ExitCode(run.k6ExitCode);
+    Object.assign(result, {
+        runner: run.runner,
+        k6ExitCode: run.k6ExitCode,
+        thresholdsFailed: mapped.thresholdsFailed,
+        exitCode: mapped.exitCode,
+        summaryFile: existsSync(summaryFile) ? summaryFile : undefined,
+        summary: readK6Summary(summaryFile),
+    });
+    writeMeta();
+    return result;
+}
+//# sourceMappingURL=run.js.map

package/dist/load/script.d.ts

@@ -0,0 +1,27 @@
+import type { EnvConfig, LoadProfile } from '@sdods/contracts';
+export interface K6ScriptInput {
+    project: string;
+    profileName: string;
+    profile: LoadProfile;
+    /**
+     * The environment as written in `envs/<env>.yaml`, NOT interpolated: `${VAR}` references in
+     * auth and headers must survive so they become `__ENV.VAR` lookups instead of inlined values.
+     */
+    env: EnvConfig;
+    /** Resolved `api.baseUrl` (not a secret); requests are sent to `baseUrl + path`. */
+    baseUrl: string;
+}
+export interface K6Script {
+    script: string;
+    /** Variables the script reads from `__ENV` with no default: they must be set when k6 runs. */
+    requiredEnv: string[];
+}
+/**
+ * A string that may contain `${VAR}` / `${VAR:-default}` as a JavaScript expression reading k6's
+ * `__ENV`, so secret values stay in the environment and never reach the generated file.
+ */
+export declare function envExpr(value: string, required: Set<string>): string;
+/** k6 `options` exactly as the profile declares them, tagged with project, env and profile. */
+export declare function k6Options(input: K6ScriptInput): Record<string, unknown>;
+export declare function generateK6Script(input: K6ScriptInput): K6Script;
+//# sourceMappingURL=script.d.ts.map

package/dist/load/script.js

@@ -0,0 +1,188 @@
+const VAR_RE = /\$\{([A-Za-z_][A-Za-z0-9_]*)(?::-([^}]*))?\}/g;
+/**
+ * A string that may contain `${VAR}` / `${VAR:-default}` as a JavaScript expression reading k6's
+ * `__ENV`, so secret values stay in the environment and never reach the generated file.
+ */
+export function envExpr(value, required) {
+    const parts = [];
+    let last = 0;
+    for (const m of value.matchAll(VAR_RE)) {
+        if (m.index > last)
+            parts.push(JSON.stringify(value.slice(last, m.index)));
+        const name = m[1];
+        if (m[2] === undefined) {
+            required.add(name);
+            parts.push(`__ENV.${name}`);
+        }
+        else {
+            parts.push(`(__ENV.${name} || ${JSON.stringify(m[2])})`);
+        }
+        last = m.index + m[0].length;
+    }
+    if (last < value.length || parts.length === 0)
+        parts.push(JSON.stringify(value.slice(last)));
+    return parts.join(' + ');
+}
+function valueExpr(value, required, indent) {
+    if (typeof value === 'string')
+        return envExpr(value, required);
+    if (Array.isArray(value)) {
+        if (!value.length)
+            return '[]';
+        const inner = indent + '  ';
+        return `[\n${value.map((v) => inner + valueExpr(v, required, inner)).join(',\n')},\n${indent}]`;
+    }
+    if (value && typeof value === 'object') {
+        const entries = Object.entries(value);
+        if (!entries.length)
+            return '{}';
+        const inner = indent + '  ';
+        return `{\n${entries
+            .map(([k, v]) => `${inner}${JSON.stringify(k)}: ${valueExpr(v, required, inner)}`)
+            .join(',\n')},\n${indent}}`;
+    }
+    return JSON.stringify(value ?? null);
+}
+function authLines(env, required) {
+    const auth = env.api.auth;
+    switch (auth.type) {
+        case 'none':
+            return { imports: [], setup: [], headers: [] };
+        case 'bearer':
+            return {
+                imports: [],
+                setup: [],
+                headers: [['Authorization', `"Bearer " + ${envExpr(auth.token, required)}`]],
+            };
+        case 'basic':
+            return {
+                imports: [`import encoding from 'k6/encoding';`],
+                setup: [],
+                headers: [
+                    [
+                        'Authorization',
+                        `"Basic " + encoding.b64encode(${envExpr(auth.username, required)} + ":" + ${envExpr(auth.password, required)})`,
+                    ],
+                ],
+            };
+        case 'header':
+            return { imports: [], setup: [], headers: [[auth.name, envExpr(auth.value, required)]] };
+        case 'oauth-client-credentials': {
+            const form = [
+                ['grant_type', '"client_credentials"'],
+                ['client_id', envExpr(auth.clientId, required)],
+                ['client_secret', envExpr(auth.clientSecret, required)],
+            ];
+            if (auth.scope)
+                form.push(['scope', envExpr(auth.scope, required)]);
+            if (auth.audience)
+                form.push(['audience', envExpr(auth.audience, required)]);
+            return {
+                imports: [],
+                setup: [
+                    `  // OAuth client-credentials token, minted once. A test longer than the token lifetime`,
+                    `  // will start failing with 401 when it expires.`,
+                    `  const tokenRes = http.post(${envExpr(auth.tokenUrl, required)}, {`,
+                    ...form.map(([k, v]) => `    ${k}: ${v},`),
+                    `  }, { headers: { Accept: "application/json" }, tags: { name: "oauth token" } });`,
+                    `  if (tokenRes.status !== 200) fail("token request failed with status " + tokenRes.status);`,
+                    `  data.token = tokenRes.json("access_token");`,
+                ],
+                headers: [['Authorization', `"Bearer " + data.token`]],
+            };
+        }
+    }
+}
+function requestBlock(req, required) {
+    const name = req.name ?? `${req.method} ${req.path}`;
+    const headers = Object.entries(req.headers).map(([k, v]) => [
+        k,
+        envExpr(v, required),
+    ]);
+    let body = 'null';
+    if (typeof req.body === 'string')
+        body = envExpr(req.body, required);
+    else if (req.body !== undefined) {
+        body = `JSON.stringify(${valueExpr(req.body, required, '  ')})`;
+        if (!Object.keys(req.headers).some((h) => h.toLowerCase() === 'content-type'))
+            headers.unshift(['Content-Type', '"application/json"']);
+    }
+    const statuses = JSON.stringify(req.expect.status);
+    const checks = [
+        `    ${JSON.stringify(`${name}: status ${req.expect.status.join(' or ')}`)}: (r) => ${statuses}.includes(r.status),`,
+    ];
+    if (req.expect.bodyContains !== undefined)
+        checks.push(`    ${JSON.stringify(`${name}: body contains`)}: (r) => String(r.body).includes(${envExpr(req.expect.bodyContains, required)}),`);
+    if (req.expect.maxDurationMs !== undefined)
+        checks.push(`    ${JSON.stringify(`${name}: under ${req.expect.maxDurationMs}ms`)}: (r) => r.timings.duration < ${req.expect.maxDurationMs},`);
+    return [
+        `  res = http.request(${JSON.stringify(req.method)}, BASE_URL + ${envExpr(req.path, required)}, ${body}, {`,
+        `    headers: Object.assign({}, headers, {${headers.map(([k, v]) => ` ${JSON.stringify(k)}: ${v}`).join(',')}${headers.length ? ' ' : ''}}),`,
+        `    tags: { name: ${JSON.stringify(name)} },`,
+        `  });`,
+        `  check(res, {`,
+        ...checks,
+        `  });`,
+    ];
+}
+/** k6 `options` exactly as the profile declares them, tagged with project, env and profile. */
+export function k6Options(input) {
+    const p = input.profile;
+    const options = {};
+    if (p.stages)
+        options.stages = p.stages;
+    else {
+        options.vus = p.vus;
+        if (p.duration)
+            options.duration = p.duration;
+        if (p.iterations)
+            options.iterations = p.iterations;
+    }
+    options.thresholds = p.thresholds;
+    options.tags = { project: input.project, env: input.env.name, profile: input.profileName };
+    return options;
+}
+export function generateK6Script(input) {
+    const required = new Set();
+    const { profile, env } = input;
+    const useEnvAuth = profile.auth === 'env';
+    const auth = useEnvAuth ? authLines(env, required) : { imports: [], setup: [], headers: [] };
+    const commonHeaders = useEnvAuth
+        ? Object.entries(env.api.headers).map(([k, v]) => [k, envExpr(v, required)])
+        : [];
+    const requests = profile.requests.flatMap((r) => requestBlock(r, required));
+    const baseUrl = input.baseUrl.replace(/\/+$/, '');
+    const lines = [
+        `// Generated by \`sdods load -p ${input.project} -e ${env.name} ${input.profileName}\`. Do not edit: change`,
+        `// load/${input.profileName}.yaml and regenerate. Secrets are read from the environment (__ENV)`,
+        `// when k6 runs and are never written to this file.`,
+        `import http from 'k6/http';`,
+        `import { check, fail, sleep } from 'k6';`,
+        ...auth.imports,
+        ``,
+        `const BASE_URL = ${JSON.stringify(baseUrl)};`,
+        `const REQUIRED_ENV = ${JSON.stringify([...required].sort())};`,
+        ``,
+        `export const options = ${JSON.stringify(k6Options(input), null, 2)};`,
+        ``,
+        `export function setup() {`,
+        `  const missing = REQUIRED_ENV.filter((name) => !__ENV[name]);`,
+        `  if (missing.length) fail("missing environment variables: " + missing.join(", "));`,
+        `  const data = {};`,
+        ...auth.setup,
+        `  return data;`,
+        `}`,
+        ``,
+        `export default function (data) {`,
+        `  const headers = {${[...commonHeaders, ...auth.headers].map(([k, v]) => `\n    ${JSON.stringify(k)}: ${v},`).join('')}${commonHeaders.length || auth.headers.length ? '\n  ' : ''}};`,
+        `  let res;`,
+        ...requests,
+        ...(profile.thinkTimeSeconds > 0 ? [`  sleep(${profile.thinkTimeSeconds});`] : []),
+        `}`,
+        ``,
+    ];
+    // Every expression was rendered above, so `required` is complete by the time REQUIRED_ENV is.
+    const script = lines.join('\n');
+    return { script, requiredEnv: [...required].sort() };
+}
+//# sourceMappingURL=script.js.map