@showrun/core 0.1.0 → 0.1.1

package/dist/httpReplay.js

@@ -0,0 +1,102 @@
+/**
+ * HTTP-only execution engine for request snapshots.
+ *
+ * When every `network_replay` step in a flow has a valid snapshot and no
+ * DOM extraction steps exist, the flow can be executed purely via HTTP
+ * requests — no browser needed.
+ */
+import { isSnapshotStale, validateResponse, applyOverrides, } from './requestSnapshot.js';
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+/** Default timeout for HTTP replay requests (30 seconds). */
+const DEFAULT_TIMEOUT_MS = 30_000;
+// ---------------------------------------------------------------------------
+// HTTP-only compatibility check
+// ---------------------------------------------------------------------------
+/** Step types that require DOM access for data extraction (force browser mode). */
+const DOM_EXTRACTION_STEPS = new Set(['extract_text', 'extract_title', 'extract_attribute']);
+/**
+ * Check whether a flow can run in HTTP-only mode.
+ *
+ * Requirements:
+ * 1. Every `network_replay` step has a corresponding, non-stale snapshot.
+ * 2. No DOM extraction steps exist in the flow.
+ */
+export function isFlowHttpCompatible(steps, snapshots) {
+    if (!snapshots)
+        return false;
+    // Check for DOM extraction steps
+    for (const step of steps) {
+        if (DOM_EXTRACTION_STEPS.has(step.type)) {
+            return false;
+        }
+    }
+    // Check that every network_replay step has a valid snapshot
+    const replaySteps = steps.filter((s) => s.type === 'network_replay');
+    if (replaySteps.length === 0)
+        return false; // No point in HTTP mode without replay steps
+    for (const step of replaySteps) {
+        const snapshot = snapshots.snapshots[step.id];
+        if (!snapshot)
+            return false;
+        if (isSnapshotStale(snapshot))
+            return false;
+    }
+    return true;
+}
+// ---------------------------------------------------------------------------
+// HTTP replay
+// ---------------------------------------------------------------------------
+/**
+ * Make a direct HTTP request using snapshot data + applied overrides.
+ * Uses Node's native `fetch()` with an AbortController timeout.
+ */
+export async function replayFromSnapshot(snapshot, inputs, vars, options) {
+    const timeoutMs = options?.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const { url, method, headers, body } = applyOverrides(snapshot, inputs, vars, options?.secrets);
+    // Remove content-length — the snapshot captures the original request's
+    // content-length, but overrides may change the body size. Node's fetch()
+    // sets the correct content-length automatically from the actual body.
+    delete headers['content-length'];
+    delete headers['Content-Length'];
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    const fetchOptions = {
+        method,
+        headers,
+        signal: controller.signal,
+    };
+    if (body && method !== 'GET' && method !== 'HEAD') {
+        fetchOptions.body = body;
+    }
+    try {
+        const response = await fetch(url, fetchOptions);
+        const responseBody = await response.text();
+        const contentType = response.headers.get('content-type') ?? undefined;
+        return {
+            status: response.status,
+            contentType,
+            body: responseBody,
+            bodySize: Buffer.byteLength(responseBody, 'utf8'),
+        };
+    }
+    catch (err) {
+        if (err instanceof Error && err.name === 'AbortError') {
+            throw new Error(`HTTP replay timed out after ${timeoutMs}ms for ${method} ${url}`);
+        }
+        throw err;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * Replay a snapshot and validate the response.
+ * Returns the result along with validation info.
+ */
+export async function replayAndValidate(snapshot, inputs, vars, options) {
+    const result = await replayFromSnapshot(snapshot, inputs, vars, options);
+    const validation = validateResponse(snapshot, result);
+    return { result, validation };
+}

package/dist/index.d.ts

@@ -10,6 +10,9 @@ export * from './browserLauncher.js';
 export * from './browserPersistence.js';
 export * from './packUtils.js';
 export * from './packVersioning.js';
+export * from './config.js';
+export * from './requestSnapshot.js';
+export * from './httpReplay.js';
 export * from './dsl/types.js';
 export * from './dsl/builders.js';
 export * from './dsl/interpreter.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAC;AACpC,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AAGpC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAC;AACpC,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAGhC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC"}

package/dist/index.js

@@ -10,6 +10,9 @@ export * from './browserLauncher.js';
 export * from './browserPersistence.js';
 export * from './packUtils.js';
 export * from './packVersioning.js';
+export * from './config.js';
+export * from './requestSnapshot.js';
+export * from './httpReplay.js';
 // DSL exports
 export * from './dsl/types.js';
 export * from './dsl/builders.js';

package/dist/jsonPackValidator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jsonPackValidator.d.ts","sourceRoot":"","sources":["../src/jsonPackValidator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAClE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAG9C;;GAEG;AACH,wBAAgB,6BAA6B,CAC3C,YAAY,EAAE,qBAAqB,EAAE,EACrC,IAAI,EAAE,OAAO,EAAE,GACd,IAAI,CAsBN;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAsCzD"}
+{"version":3,"file":"jsonPackValidator.d.ts","sourceRoot":"","sources":["../src/jsonPackValidator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAClE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAS9C;;GAEG;AACH,wBAAgB,6BAA6B,CAC3C,YAAY,EAAE,qBAAqB,EAAE,EACrC,IAAI,EAAE,OAAO,EAAE,GACd,IAAI,CA0BN;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAsCzD"}

package/dist/jsonPackValidator.js

@@ -1,13 +1,18 @@
 import { validateFlow, ValidationError } from './dsl/validation.js';
+/** Step types that produce collectible output via an "out" parameter */
+const STEPS_WITH_OUT = new Set([
+    'extract_title', 'extract_text', 'extract_attribute',
+    'network_replay', 'network_extract',
+]);
 /**
  * Validates that collectibles referenced in flow steps exist
  */
 export function validateCollectiblesMatchFlow(collectibles, flow) {
     const collectibleNames = new Set(collectibles.map((c) => c.name));
     const referencedOuts = new Set();
-    // Extract all 'out' parameters from extraction steps
+    // Extract all 'out' parameters from steps that write to collectibles
     for (const step of flow) {
-        if (step.type === 'extract_title' || step.type === 'extract_text' || step.type === 'extract_attribute') {
+        if (STEPS_WITH_OUT.has(step.type)) {
             const out = step.params?.out;
             if (out && typeof out === 'string') {
                 referencedOuts.add(out);
@@ -15,11 +20,15 @@ export function validateCollectiblesMatchFlow(collectibles, flow) {
         }
     }
     // Check that all referenced outs exist in collectibles
+    const mismatches = [];
     for (const out of referencedOuts) {
         if (!collectibleNames.has(out)) {
-            throw new ValidationError(`Flow references collectible "${out}" in extraction step, but it's not defined in collectibles schema`);
+            mismatches.push(out);
         }
     }
+    if (mismatches.length > 0) {
+        throw new ValidationError(`Flow step(s) write to undeclared collectible(s): [${mismatches.join(', ')}]. Only declared collectibles are returned in the output. Declared: [${[...collectibleNames].join(', ')}]`);
+    }
 }
 /**
  * Validates a JSON Task Pack structure

package/dist/loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../src/loader.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAsC,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAGnH;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,CAAC,CAAC;IACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED;;;;;;GAMG;AACH,qBAAa,cAAc;IACzB;;OAEG;IACH,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,gBAAgB;IA4BvD;;OAEG;WACU,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAwC9D;;;OAGG;IACH,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAwB5D;;OAEG;IACH,MAAM,CAAC,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,gBAAgB,EAAE;CAQlE"}
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../src/loader.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAsC,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAInH;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,CAAC,CAAC;IACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED;;;;;;GAMG;AACH,qBAAa,cAAc;IACzB;;OAEG;IACH,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,gBAAgB;IA4BvD;;OAEG;WACU,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IA4C9D;;;OAGG;IACH,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAwB5D;;OAEG;IACH,MAAM,CAAC,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,gBAAgB,EAAE;CAQlE"}

package/dist/loader.js

@@ -1,5 +1,6 @@
 import { readFileSync, existsSync } from 'fs';
 import { join } from 'path';
+import { loadSnapshots } from './requestSnapshot.js';
 /**
  * Loads a Task Pack from a directory path
  *
@@ -54,6 +55,8 @@ export class TaskPackLoader {
         if (!flowData.flow || !Array.isArray(flowData.flow)) {
             throw new Error('flow.json must have a "flow" array');
         }
+        // Optionally load snapshots.json (not an error if missing)
+        const snapshots = loadSnapshots(packPath);
         return {
             metadata: {
                 id: manifest.id,
@@ -66,6 +69,7 @@ export class TaskPackLoader {
             flow: flowData.flow,
             auth: manifest.auth,
             browser: manifest.browser,
+            ...(snapshots ? { snapshots } : {}),
         };
     }
     /**

package/dist/requestSnapshot.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Request Snapshot types and utilities.
+ *
+ * Snapshots record the HTTP request/response details of `network_replay` steps
+ * so they can be replayed at runtime via direct HTTP calls — no browser needed.
+ */
+export interface RequestSnapshot {
+    stepId: string;
+    capturedAt: number;
+    /** TTL in milliseconds. null = indefinite (never expires by default). */
+    ttl: number | null;
+    request: {
+        method: string;
+        url: string;
+        headers: Record<string, string>;
+        body: string | null;
+    };
+    overrides?: {
+        /** Direct URL override (replaces the snapshot's request URL entirely). */
+        url?: string;
+        /** Direct body override (replaces the snapshot's request body entirely). */
+        body?: string;
+        setQuery?: Record<string, string>;
+        setHeaders?: Record<string, string>;
+        urlReplace?: Array<{
+            find: string;
+            replace: string;
+        }>;
+        bodyReplace?: Array<{
+            find: string;
+            replace: string;
+        }>;
+    };
+    responseValidation: {
+        expectedStatus: number;
+        expectedContentType: string;
+        /** Top-level JSON keys expected in the response body. */
+        expectedKeys: string[];
+    };
+    /** Header names that contain auth data (e.g. authorization, cookie). */
+    sensitiveHeaders: string[];
+}
+export interface SnapshotFile {
+    version: 1;
+    snapshots: Record<string, RequestSnapshot>;
+}
+/**
+ * Check if a snapshot is stale based on its TTL.
+ * Returns false when `ttl` is null (indefinite).
+ */
+export declare function isSnapshotStale(snapshot: RequestSnapshot): boolean;
+export interface ValidationResult {
+    valid: boolean;
+    reason?: string;
+}
+/**
+ * Validate an HTTP response against a snapshot's expected shape.
+ */
+export declare function validateResponse(snapshot: RequestSnapshot, response: {
+    status: number;
+    contentType?: string;
+    body: string;
+}): ValidationResult;
+/**
+ * Apply overrides from the snapshot to produce the final request parameters.
+ * Template expressions ({{inputs.x}}, {{vars.y}}, {{secret.z}}) are resolved
+ * using Nunjucks — the same engine as the DSL interpreter, including filters.
+ */
+export declare function applyOverrides(snapshot: RequestSnapshot, inputs: Record<string, unknown>, vars: Record<string, unknown>, secrets?: Record<string, string>): {
+    url: string;
+    method: string;
+    headers: Record<string, string>;
+    body: string | null;
+};
+/**
+ * Load snapshots.json from a pack directory. Returns null if not found.
+ */
+export declare function loadSnapshots(packPath: string): SnapshotFile | null;
+/**
+ * Write snapshots.json to a pack directory.
+ */
+export declare function writeSnapshots(packPath: string, snapshots: SnapshotFile): void;
+/**
+ * Extract top-level keys from a JSON string. Returns empty array on parse failure.
+ */
+export declare function extractTopLevelKeys(jsonText: string | undefined | null): string[];
+/**
+ * Detect which headers in a record are sensitive (contain auth data).
+ */
+export declare function detectSensitiveHeaders(headers: Record<string, string>): string[];
+//# sourceMappingURL=requestSnapshot.d.ts.map

package/dist/requestSnapshot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestSnapshot.d.ts","sourceRoot":"","sources":["../src/requestSnapshot.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAWH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,OAAO,EAAE;QACP,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;KACrB,CAAC;IACF,SAAS,CAAC,EAAE;QACV,0EAA0E;QAC1E,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,4EAA4E;QAC5E,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAClC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACpC,UAAU,CAAC,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACtD,WAAW,CAAC,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACxD,CAAC;IACF,kBAAkB,EAAE;QAClB,cAAc,EAAE,MAAM,CAAC;QACvB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,yDAAyD;QACzD,YAAY,EAAE,MAAM,EAAE,CAAC;KACxB,CAAC;IACF,wEAAwE;IACxE,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,CAAC,CAAC;IACX,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CAC5C;AAMD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAGlE;AAMD,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,eAAe,EACzB,QAAQ,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC/D,gBAAgB,CA4ClB;AAiBD;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAoEvF;AAQD;;GAEG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAiBnE;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,GAAG,IAAI,CAG9E;AAQD;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,EAAE,CAWjF;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,EAAE,CAEhF"}

package/dist/requestSnapshot.js

@@ -0,0 +1,200 @@
+/**
+ * Request Snapshot types and utilities.
+ *
+ * Snapshots record the HTTP request/response details of `network_replay` steps
+ * so they can be replayed at runtime via direct HTTP calls — no browser needed.
+ */
+import { readFileSync, writeFileSync, existsSync } from 'fs';
+import { join } from 'path';
+import { resolveTemplate } from './dsl/templating.js';
+// ---------------------------------------------------------------------------
+// Staleness
+// ---------------------------------------------------------------------------
+/**
+ * Check if a snapshot is stale based on its TTL.
+ * Returns false when `ttl` is null (indefinite).
+ */
+export function isSnapshotStale(snapshot) {
+    if (snapshot.ttl === null)
+        return false;
+    return Date.now() - snapshot.capturedAt > snapshot.ttl;
+}
+/**
+ * Validate an HTTP response against a snapshot's expected shape.
+ */
+export function validateResponse(snapshot, response) {
+    const v = snapshot.responseValidation;
+    if (response.status !== v.expectedStatus) {
+        return {
+            valid: false,
+            reason: `Expected status ${v.expectedStatus}, got ${response.status}`,
+        };
+    }
+    if (v.expectedContentType &&
+        response.contentType &&
+        !response.contentType.toLowerCase().startsWith(v.expectedContentType.toLowerCase())) {
+        return {
+            valid: false,
+            reason: `Expected content-type starting with "${v.expectedContentType}", got "${response.contentType}"`,
+        };
+    }
+    if (v.expectedKeys.length > 0) {
+        try {
+            const parsed = JSON.parse(response.body);
+            if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+                const bodyKeys = Object.keys(parsed);
+                const missing = v.expectedKeys.filter((k) => !bodyKeys.includes(k));
+                if (missing.length > 0) {
+                    return {
+                        valid: false,
+                        reason: `Missing expected keys: ${missing.join(', ')}`,
+                    };
+                }
+            }
+        }
+        catch {
+            // If we expected JSON keys but can't parse, that's a validation failure
+            return {
+                valid: false,
+                reason: 'Response body is not valid JSON but expectedKeys were specified',
+            };
+        }
+    }
+    return { valid: true };
+}
+// ---------------------------------------------------------------------------
+// Override application
+// ---------------------------------------------------------------------------
+/**
+ * Resolve a template string using Nunjucks (same engine as the DSL interpreter).
+ * Supports {{inputs.x}}, {{vars.x}}, {{secret.x}} and filters like `| urlencode`.
+ */
+function resolveTemplateValue(template, ctx) {
+    return resolveTemplate(template, ctx);
+}
+/**
+ * Apply overrides from the snapshot to produce the final request parameters.
+ * Template expressions ({{inputs.x}}, {{vars.y}}, {{secret.z}}) are resolved
+ * using Nunjucks — the same engine as the DSL interpreter, including filters.
+ */
+export function applyOverrides(snapshot, inputs, vars, secrets) {
+    const ov = snapshot.overrides;
+    let url = snapshot.request.url;
+    let body = snapshot.request.body;
+    const method = snapshot.request.method;
+    const headers = { ...snapshot.request.headers };
+    if (!ov) {
+        return { url, method, headers, body };
+    }
+    const ctx = { inputs, vars, secrets: secrets ?? {} };
+    // urlReplace
+    if (ov.urlReplace) {
+        for (const r of ov.urlReplace) {
+            const find = resolveTemplateValue(r.find, ctx);
+            const replace = resolveTemplateValue(r.replace, ctx);
+            try {
+                url = url.replace(new RegExp(find, 'g'), replace);
+            }
+            catch {
+                // If regex is invalid, try literal replace
+                url = url.split(find).join(replace);
+            }
+        }
+    }
+    // setQuery
+    if (ov.setQuery) {
+        const u = new URL(url);
+        for (const [k, v] of Object.entries(ov.setQuery)) {
+            const resolved = resolveTemplateValue(v, ctx);
+            u.searchParams.set(k, resolved);
+        }
+        url = u.toString();
+    }
+    // setHeaders
+    if (ov.setHeaders) {
+        for (const [k, v] of Object.entries(ov.setHeaders)) {
+            headers[k] = resolveTemplateValue(v, ctx);
+        }
+    }
+    // Direct URL override (applied after urlReplace, matching networkCapture.ts)
+    if (ov.url != null) {
+        url = resolveTemplateValue(ov.url, ctx);
+    }
+    // bodyReplace
+    if (body && ov.bodyReplace) {
+        for (const r of ov.bodyReplace) {
+            const find = resolveTemplateValue(r.find, ctx);
+            const replace = resolveTemplateValue(r.replace, ctx);
+            try {
+                body = body.replace(new RegExp(find, 'g'), replace);
+            }
+            catch {
+                body = body.split(find).join(replace);
+            }
+        }
+    }
+    // Direct body override (applied after bodyReplace, matching networkCapture.ts)
+    if (ov.body != null) {
+        body = resolveTemplateValue(ov.body, ctx);
+    }
+    return { url, method, headers, body };
+}
+// ---------------------------------------------------------------------------
+// File I/O
+// ---------------------------------------------------------------------------
+const SNAPSHOTS_FILENAME = 'snapshots.json';
+/**
+ * Load snapshots.json from a pack directory. Returns null if not found.
+ */
+export function loadSnapshots(packPath) {
+    const filePath = join(packPath, SNAPSHOTS_FILENAME);
+    if (!existsSync(filePath))
+        return null;
+    try {
+        const content = readFileSync(filePath, 'utf-8');
+        const data = JSON.parse(content);
+        if (data.version !== 1) {
+            console.warn(`[requestSnapshot] Unsupported snapshot version: ${data.version}`);
+            return null;
+        }
+        return data;
+    }
+    catch (err) {
+        console.warn(`[requestSnapshot] Failed to load snapshots.json: ${err instanceof Error ? err.message : String(err)}`);
+        return null;
+    }
+}
+/**
+ * Write snapshots.json to a pack directory.
+ */
+export function writeSnapshots(packPath, snapshots) {
+    const filePath = join(packPath, SNAPSHOTS_FILENAME);
+    writeFileSync(filePath, JSON.stringify(snapshots, null, 2), 'utf-8');
+}
+// ---------------------------------------------------------------------------
+// Capture helpers
+// ---------------------------------------------------------------------------
+const SENSITIVE_HEADER_NAMES = ['authorization', 'cookie', 'set-cookie', 'x-api-key', 'proxy-authorization'];
+/**
+ * Extract top-level keys from a JSON string. Returns empty array on parse failure.
+ */
+export function extractTopLevelKeys(jsonText) {
+    if (!jsonText)
+        return [];
+    try {
+        const parsed = JSON.parse(jsonText);
+        if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+            return Object.keys(parsed);
+        }
+        return [];
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Detect which headers in a record are sensitive (contain auth data).
+ */
+export function detectSensitiveHeaders(headers) {
+    return Object.keys(headers).filter((h) => SENSITIVE_HEADER_NAMES.includes(h.toLowerCase()));
+}

package/dist/runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../src/runner.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAc,MAAM,YAAY,CAAC;AAElE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGzC;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,iBAAkB,SAAQ,SAAS;IAClD;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,iBAAiB,CAAC,CA6L5B"}
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../src/runner.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAc,MAAM,YAAY,CAAC;AAElE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAWzC;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,iBAAkB,SAAQ,SAAS;IAClD;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,iBAAiB,CAAC,CA0O5B"}