@specific.dev/spectest 0.24.0 → 0.27.0

package/dist/aws-sigv4.d.ts

@@ -0,0 +1,42 @@
+export interface SigV4Credentials {
+    accessKeyId: string;
+    secretAccessKey: string;
+    /** Session token for temporary credentials (STS/assume-role). */
+    sessionToken?: string;
+}
+export interface SigV4Scope {
+    region: string;
+    service: string;
+}
+/** Infer the region + service to sign for. The app's own (dummy-credentialed)
+ *  request still carries a real credential SCOPE — that's authoritative; the
+ *  host is a fallback. Returns `undefined` when nothing is derivable. */
+export declare function inferSigV4Scope(args: {
+    authorization?: string | null;
+    credentialParam?: string | null;
+    host: string;
+}): SigV4Scope | undefined;
+export interface SignedRequest {
+    /** Headers to SET on the outbound request (lowercased). Includes
+     *  `authorization`, `x-amz-date`, `x-amz-content-sha256`, and
+     *  `x-amz-security-token` when session credentials are used. */
+    headers: Record<string, string>;
+    /** Canonical query string to place on the wire (matches the signature). */
+    canonicalQuery: string;
+}
+/** Sign an outbound request with SigV4 (header authorization). `additionalHeaders`
+ *  (e.g. `x-amz-target`, `content-type`) are folded into the signed set — they
+ *  must already be present on the outbound request with these exact values. */
+export declare function signAwsV4Request(args: {
+    method: string;
+    /** Wire path (as the app sent it, already once-encoded). */
+    path: string;
+    /** Query params to send (SigV4 `x-amz-*` params already stripped). */
+    query: URLSearchParams;
+    host: string;
+    body: Uint8Array;
+    credentials: SigV4Credentials;
+    scope: SigV4Scope;
+    additionalHeaders?: Record<string, string>;
+    now?: Date;
+}): SignedRequest;

package/dist/aws-sigv4.js

@@ -0,0 +1,166 @@
+// AWS Signature Version 4 signer — dependency-free, over `node:crypto`.
+//
+// Used by `components/replayFake.ts` to RE-SIGN a request on the record-mode
+// egress forward. The app under test signs with throwaway dummy credentials
+// (any AWS SDK refuses to build a request without *some* credential); the
+// broker strips that dummy signature and re-signs the exact outbound request
+// with the real credentials brokered eval-scoped from the platform Secrets
+// store. Because signing happens at forward time over the real outbound
+// canonical request, `x-amz-date` / `x-amz-content-sha256` / `authorization`
+// are always internally consistent — which is exactly what static header
+// injection cannot achieve for SigV4 (the signature is a keyed HMAC over the
+// whole request, not a static token).
+//
+// Scope note: this implements the standard non-S3 canonicalization (path
+// URI-encoded once more on top of the wire path; query canonicalized with
+// %20). That is correct for the single-host JSON services this targets
+// (DynamoDB, SQS, STS, …). S3 (single-encoded path, virtual-hosted style)
+// and streaming/chunked signatures are out of scope.
+import { createHash, createHmac } from "node:crypto";
+function hmac(key, data) {
+    return createHmac("sha256", key).update(data, "utf8").digest();
+}
+function sha256Hex(data) {
+    const buf = typeof data === "string" ? Buffer.from(data, "utf8") : Buffer.from(data);
+    return createHash("sha256").update(buf).digest("hex");
+}
+/** RFC 3986 URI-encode per the SigV4 rules: unreserved chars pass through,
+ *  everything else is `%XX` over the UTF-8 bytes. `/` is encoded only when
+ *  `encodeSlash` (true for query components, false for path segments). */
+function awsUriEncode(input, encodeSlash) {
+    let out = "";
+    for (const byte of Buffer.from(input, "utf8")) {
+        const isUnreserved = (byte >= 0x41 && byte <= 0x5a) || // A-Z
+            (byte >= 0x61 && byte <= 0x7a) || // a-z
+            (byte >= 0x30 && byte <= 0x39) || // 0-9
+            byte === 0x2d || // -
+            byte === 0x2e || // .
+            byte === 0x5f || // _
+            byte === 0x7e; // ~
+        if (isUnreserved) {
+            out += String.fromCharCode(byte);
+        }
+        else if (byte === 0x2f && !encodeSlash) {
+            out += "/";
+        }
+        else {
+            out += "%" + byte.toString(16).toUpperCase().padStart(2, "0");
+        }
+    }
+    return out;
+}
+/** Canonical URI = the absolute path, URI-encoded once more (non-S3 rule).
+ *  For the near-universal `/` path of JSON services this is just `/`. */
+function canonicalUri(path) {
+    if (!path || path === "/")
+        return "/";
+    return path
+        .split("/")
+        .map((seg) => awsUriEncode(seg, false))
+        .join("/");
+}
+/** Canonical query string: each key/value AWS-URI-encoded, sorted by encoded
+ *  key then value, joined by `&`. Also the exact string to put on the wire so
+ *  the received query re-canonicalizes to what we signed (URLSearchParams
+ *  would encode spaces as `+`, diverging from the signed `%20`). */
+function canonicalQuery(params) {
+    const pairs = [];
+    for (const [k, v] of params)
+        pairs.push([awsUriEncode(k, true), awsUriEncode(v, true)]);
+    pairs.sort((a, b) => a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : a[1] < b[1] ? -1 : a[1] > b[1] ? 1 : 0);
+    return pairs.map(([k, v]) => `${k}=${v}`).join("&");
+}
+/** `20260722T101112Z` (amzDate) + `20260722` (dateStamp) from a Date. */
+function amzDates(now) {
+    const amzDate = now.toISOString().replace(/[:-]|\.\d{3}/g, "");
+    return { amzDate, dateStamp: amzDate.slice(0, 8) };
+}
+/** Parse the `<AKID>/<date>/<region>/<service>/aws4_request` credential scope
+ *  out of an `Authorization` header or an `X-Amz-Credential` query value. */
+function scopeFromCredential(cred) {
+    if (!cred)
+        return undefined;
+    const m = /Credential=([^,\s]+)/.exec(cred);
+    const scope = m ? m[1] : cred;
+    const parts = scope.split("/");
+    if (parts.length >= 5 && parts[4] === "aws4_request" && parts[2] && parts[3]) {
+        return { region: parts[2], service: parts[3] };
+    }
+    return undefined;
+}
+/** Fallback: derive scope from a `<service>.<region>.amazonaws.com` host. */
+function scopeFromHost(host) {
+    if (!host.endsWith(".amazonaws.com"))
+        return undefined;
+    const label = host.slice(0, -".amazonaws.com".length);
+    const parts = label.split(".");
+    if (parts.length === 1 && parts[0])
+        return { service: parts[0], region: "us-east-1" };
+    if (parts.length === 2 && parts[0] && parts[1])
+        return { service: parts[0], region: parts[1] };
+    // `bucket.s3.region` (S3 virtual-host) is out of scope, but recover what we can.
+    const s3i = parts.indexOf("s3");
+    if (s3i >= 0 && parts[s3i + 1])
+        return { service: "s3", region: parts[s3i + 1] };
+    return undefined;
+}
+/** Infer the region + service to sign for. The app's own (dummy-credentialed)
+ *  request still carries a real credential SCOPE — that's authoritative; the
+ *  host is a fallback. Returns `undefined` when nothing is derivable. */
+export function inferSigV4Scope(args) {
+    return (scopeFromCredential(args.authorization) ??
+        scopeFromCredential(args.credentialParam) ??
+        scopeFromHost(args.host));
+}
+/** Sign an outbound request with SigV4 (header authorization). `additionalHeaders`
+ *  (e.g. `x-amz-target`, `content-type`) are folded into the signed set — they
+ *  must already be present on the outbound request with these exact values. */
+export function signAwsV4Request(args) {
+    const { amzDate, dateStamp } = amzDates(args.now ?? new Date());
+    const payloadHash = sha256Hex(args.body);
+    const signedHeaders = {};
+    for (const [k, v] of Object.entries(args.additionalHeaders ?? {})) {
+        signedHeaders[k.toLowerCase()] = v.trim();
+    }
+    signedHeaders["host"] = args.host;
+    signedHeaders["x-amz-content-sha256"] = payloadHash;
+    signedHeaders["x-amz-date"] = amzDate;
+    if (args.credentials.sessionToken) {
+        signedHeaders["x-amz-security-token"] = args.credentials.sessionToken;
+    }
+    const names = Object.keys(signedHeaders).sort();
+    const canonicalHeaders = names.map((n) => `${n}:${signedHeaders[n]}\n`).join("");
+    const signedHeaderList = names.join(";");
+    const cq = canonicalQuery(args.query);
+    const canonicalRequest = [
+        args.method.toUpperCase(),
+        canonicalUri(args.path),
+        cq,
+        canonicalHeaders,
+        signedHeaderList,
+        payloadHash,
+    ].join("\n");
+    const credentialScope = `${dateStamp}/${args.scope.region}/${args.scope.service}/aws4_request`;
+    const stringToSign = [
+        "AWS4-HMAC-SHA256",
+        amzDate,
+        credentialScope,
+        sha256Hex(canonicalRequest),
+    ].join("\n");
+    const kDate = hmac("AWS4" + args.credentials.secretAccessKey, dateStamp);
+    const kRegion = hmac(kDate, args.scope.region);
+    const kService = hmac(kRegion, args.scope.service);
+    const kSigning = hmac(kService, "aws4_request");
+    const signature = createHmac("sha256", kSigning).update(stringToSign, "utf8").digest("hex");
+    const authorization = `AWS4-HMAC-SHA256 Credential=${args.credentials.accessKeyId}/${credentialScope}, ` +
+        `SignedHeaders=${signedHeaderList}, Signature=${signature}`;
+    const headers = {
+        authorization,
+        "x-amz-date": amzDate,
+        "x-amz-content-sha256": payloadHash,
+    };
+    if (args.credentials.sessionToken) {
+        headers["x-amz-security-token"] = args.credentials.sessionToken;
+    }
+    return { headers, canonicalQuery: cq };
+}

package/dist/browser.d.ts

@@ -0,0 +1,314 @@
+import type { Wrapped } from "./inspect.js";
+import type { GetByRoleOptions, GetByTextOptions, Locator } from "./locator.js";
+import type { Page } from "playwright-core";
+export interface BrowserOptions {
+    /** Viewport width in pixels. Default 1280. Ignored when `frame: "mobile"`
+     * (the device preset's viewport wins). */
+    width?: number;
+    /** Viewport height in pixels. Default 720. Ignored when `frame: "mobile"`. */
+    height?: number;
+    /**
+     * Which device frame this session represents. `"browser"` (default) is a
+     * desktop viewport rendered as a browser window in the replay; `"mobile"`
+     * emulates a phone (viewport + DPR + mobile UA + touch via CDP) and the
+     * replay wraps the capture in a phone bezel. The mobile device is fixed
+     * (latest iPhone) and not caller-configurable — see `ctx.mobile`.
+     */
+    frame?: "browser" | "mobile";
+    /** Initial URL to navigate to before the constructor returns. */
+    url?: string;
+    /**
+     * Script installed (before the session's first navigation) to run in every
+     * document loaded from now on, BEFORE the document's own scripts — the
+     * deterministic way to plant shims (reduced-motion, `Notification`, …) that
+     * must beat the app bundle. Unlike installing one after the session is
+     * handed back, this wins the race on the FIRST document too, so no relaunch
+     * is needed. Rides snapshots into `dependsOn` children. For a mobile app,
+     * declare it once on the handle instead — `expo({ initScript })`.
+     */
+    initScript?: string;
+    /**
+     * Sink that receives rrweb event chunks. Each Browser op (navigate,
+     * click, …) calls `recordStep` with the events that landed in
+     * `window.__spectestRrwebEvents` since the last drain. The daemon
+     * passes a per-test, per-session sink; if `null` (e.g. tests calling
+     * `openBrowser` directly without a test context), rrweb still
+     * records page-side but the buffer is discarded on close.
+     */
+    recorder?: BrowserSessionRecorder | null;
+}
+/** One Browser-action's worth of rrweb events, in the order rrweb emitted them. */
+export interface BrowserSessionStep {
+    /** Monotonic counter within the session. */
+    stepSeq: number;
+    /** Browser action that triggered this drain — same set as in the
+     * per-op event log, plus `"close"` for the final pre-teardown drain. */
+    action: BrowserAction | "close";
+    /** Ms since the session was opened. */
+    tOffsetMs: number;
+    /** rrweb events as emitted by `rrweb.record`'s `emit` callback. */
+    events: unknown[];
+}
+import type { BrowserAction } from "./recorder.js";
+export type { BrowserAction } from "./recorder.js";
+/** Sink the daemon passes in to collect per-session rrweb event chunks. */
+export interface BrowserSessionRecorder {
+    /**
+     * Stable ID of this session — echoed into the per-op event log so
+     * the dashboard can link a browser event to its replay player.
+     */
+    readonly sessionId: string;
+    /** Called for each drained chunk of rrweb events. */
+    recordStep(step: BrowserSessionStep): void;
+    /** Optional: called whenever `Browser.goto(url)` is invoked. */
+    noteNavigation?(url: string): void;
+    /**
+     * Optional: register a captured artifact (screenshot bytes) for upload.
+     * Present only in eval context — the daemon wires it to the per-eval
+     * collector, and its absence is what makes `screenshot()` throw during
+     * test runs (artifacts are eval-only for now). Throws when the eval's
+     * artifact byte budget is exhausted.
+     */
+    registerArtifact?(artifact: {
+        id: string;
+        kind: "screenshot";
+        contentType: string;
+        sizeBytes: number;
+        bytesBase64: string;
+    }): void;
+}
+/** The page keyboard — Playwright's `page.keyboard`. Each method records one
+ *  browser event. */
+export interface Keyboard {
+    /** Press a key or chord by name (`"Enter"`, `"Tab"`, `"Control+A"`). */
+    press(key: string): Promise<void>;
+    /** Type character-by-character (fires keydown/keyup per char). */
+    type(text: string): Promise<void>;
+    /** Insert text in one shot (no per-char keydown — the paste path). */
+    insertText(text: string): Promise<void>;
+}
+/** The page mouse — Playwright's `page.mouse`. Coordinates are viewport CSS
+ *  pixels. Prefer locators; use these only for canvas/coordinate targets. */
+export interface Mouse {
+    click(x: number, y: number, opts?: {
+        button?: "left" | "right" | "middle";
+        clickCount?: number;
+    }): Promise<void>;
+    dblclick(x: number, y: number): Promise<void>;
+    move(x: number, y: number): Promise<void>;
+    /** Wheel-scroll by a pixel delta. */
+    wheel(dx: number, dy: number): Promise<void>;
+}
+/**
+ * Headless browser session — Playwright `Page`-shaped. Select elements with
+ * the `getBy*`/`locator` roots (returning a {@link Locator}) and act on them;
+ * drive raw input via `keyboard`/`mouse`. Operations are sequential per
+ * session — the recorder attributes each op's rrweb drain to it — so for
+ * parallel browsing open multiple sessions.
+ */
+export interface Browser {
+    /** Current page URL (Playwright's synchronous `page.url()`). */
+    url(): string;
+    /** Current page `<title>` (async, like Playwright's `page.title()`). */
+    title(): Promise<string>;
+    /** Navigate to a URL; resolves when the main frame's load completes. */
+    goto(url: string): Promise<void>;
+    /** Navigate back in session history. */
+    goBack(): Promise<void>;
+    /** Navigate forward in session history. */
+    goForward(): Promise<void>;
+    /** Reload the current page. */
+    reload(): Promise<void>;
+    readonly keyboard: Keyboard;
+    readonly mouse: Mouse;
+    /** Root CSS query. */
+    locator(css: string): Locator;
+    getByRole(role: string, opts?: GetByRoleOptions): Locator;
+    getByText(text: string | RegExp, opts?: GetByTextOptions): Locator;
+    getByLabel(text: string | RegExp, opts?: GetByTextOptions): Locator;
+    getByPlaceholder(text: string | RegExp, opts?: GetByTextOptions): Locator;
+    getByAltText(text: string | RegExp, opts?: GetByTextOptions): Locator;
+    getByTitle(text: string | RegExp, opts?: GetByTextOptions): Locator;
+    getByTestId(testId: string): Locator;
+    /**
+     * Evaluate JS in the page and return the JSON-deserialised, provenance-
+     * wrapped result. `fn` is a real function (serialized by Playwright, with an
+     * optional serializable `arg`) or a string expression / statement body
+     * (auto-wrapped in an async IIFE, so `return`/`await` work).
+     *
+     * `description` is a short human label ("read rendered todo list") surfaced
+     * in the timeline so the step list isn't a wall of minified code — spectest
+     * keeps it (the one deviation from Playwright's bare `evaluate`).
+     */
+    evaluate<T = unknown>(description: string, fn: string | ((arg?: unknown) => T | Promise<T>), arg?: unknown): Promise<Wrapped<T>>;
+    /**
+     * Poll `fn` in the page until it returns a truthy value (Playwright's
+     * `page.waitForFunction`), recorded as ONE step with the total wait + poll
+     * count. `fn` is a function (with optional `arg`) or a string expression.
+     * `description` labels the step. Defaults: 5 s timeout, 100 ms polling.
+     */
+    waitForFunction<T = unknown>(description: string, fn: string | ((arg?: unknown) => T), arg?: unknown, options?: {
+        timeout?: number;
+        polling?: number;
+    }): Promise<Wrapped<T>>;
+    /**
+     * Capture a PNG screenshot of the viewport and upload it as a downloadable
+     * **artifact**. Resolves to the artifact's `art_…` id — fetch it locally
+     * with `spectest artifact download <id>`. Eval-only (`spectest_eval` /
+     * `spectest env eval`); throws with a clear message during test runs.
+     */
+    screenshot(): Promise<string>;
+    /**
+     * Destroy the underlying view. Idempotent; drains pending rrweb events
+     * first. For the persistent session behind `ctx.browser()`/`ctx.mobile()`
+     * this is the escape hatch to a FRESH browser — the shared instance is
+     * discarded and the next call creates a new one. Don't call it for routine
+     * cleanup: the daemon detaches recording at test end and keeps the browser
+     * alive so dependent tests inherit its state.
+     */
+    close(): Promise<void>;
+}
+/** The touchscreen — Playwright's `page.touchscreen`, but with the press
+ *  dwell RN Pressables need. Mobile sessions only. */
+export interface Touchscreen {
+    /** Touch-tap at viewport CSS coordinates. `duration` overrides the dwell. */
+    tap(x: number, y: number, opts?: {
+        duration?: number;
+    }): Promise<void>;
+}
+/**
+ * The internal impl type `buildBackend` returns — the {@link Browser} surface
+ * plus the mobile extensions and the low-level primitives the locator layer
+ * composes on. `ctx.browser()` exposes the narrower {@link Browser} view;
+ * `ctx.mobile()` the {@link import("./mobile.js").Mobile} view (adds
+ * `touchscreen`/`swipe`). The extras below are never in a public type.
+ */
+export interface MobileBackend extends Browser {
+    /** Safe-area insets emulated on this view (`null` on desktop views or when
+     *  the CDP override is unavailable). Stamped onto the session record. */
+    readonly safeAreaInsets: SafeAreaInsets | null;
+    readonly touchscreen: Touchscreen;
+    /** Swipe the screen (a touch drag from the center). Mobile extension —
+     *  Playwright has no swipe. */
+    swipe(direction: "up" | "down" | "left" | "right", opts?: {
+        distance?: number;
+    }): Promise<void>;
+    /** Touch-drag from (x,y) by (dx,dy) over a short move sequence. */
+    swipeBy(x: number, y: number, dx: number, dy: number): Promise<void>;
+    /**
+     * Evaluate a JS expression in the page WITHOUT recording an event or
+     * draining rrweb. rrweb keeps buffering page-side; the next recorded op
+     * drains it.
+     */
+    probe<T = unknown>(expression: string): Promise<T>;
+    /**
+     * Run `fn` against the live page WITHOUT recording an event or draining
+     * rrweb — the poll path for `expect(locator)` matchers (one browser event
+     * per retry would flood the timeline).
+     */
+    silentRead<T>(fn: (page: Page) => Promise<T>): Promise<T>;
+    /**
+     * Run `fn` against the live playwright {@link Page}, recorded as a single
+     * event (with the usual rrweb drain). The locator layer's hook: one
+     * author-facing action = one recorded event, however many playwright calls
+     * it composes. When `opts.wrap` the return value is provenance-wrapped
+     * (reads), so a later `expect(...)` nests under the step.
+     */
+    pageOp<T>(action: BrowserAction, fields: Partial<RecordableFields>, fn: (page: Page) => Promise<T>, opts?: {
+        wrap?: boolean;
+    }): Promise<T>;
+    /**
+     * Unrecorded CDP touch tap (touchStart → dwell → touchEnd). The locator
+     * layer composes it inside a {@link pageOp} so a locator `tap()` stays a
+     * single recorded event; `touchscreen.tap` is the recorded public twin.
+     */
+    rawTap(x: number, y: number, durationMs?: number): Promise<void>;
+    /**
+     * Record ONE settled browser event for an `expect(locator)` web-first
+     * matcher and return its seq. The matcher already read the value by polling
+     * {@link silentRead} (one event per retry would flood the timeline); this
+     * emits the single timeline step — the locator label + the session seek
+     * point (`sessionTimestamp`) to the settled frame — so the assertion the
+     * caller records next nests under it via `sourceSeq`, exactly as
+     * `expect(await loc.isVisible())` does. Drains rrweb like any recorded op.
+     * Returns `undefined` when nothing is recording.
+     */
+    recordSettled(action: BrowserAction, fields: Partial<RecordableFields>, waitedMs: number, error?: string): Promise<number | undefined>;
+}
+/** iOS safe-area insets (CSS `env(safe-area-inset-*)`), in CSS px. */
+export interface SafeAreaInsets {
+    top: number;
+    right: number;
+    bottom: number;
+    left: number;
+}
+/**
+ * Pre-open `n` views into the pool (called by the daemon at the end of
+ * /bootstrap, before the warm-template snapshot is captured). Only
+ * default-viewport views are pooled — `openBrowser` with a custom
+ * width/height bypasses the pool.
+ */
+export declare function prewarmViewPool(n?: number): Promise<void>;
+/**
+ * Open a browser view (a page in the shared Chromium). Serves from the
+ * pre-opened pool when the caller uses the default viewport.
+ *
+ * This is the EPHEMERAL path — `close()` destroys the view. The daemon's
+ * `ctx.browser()`/`ctx.mobile()` go through {@link acquirePersistentBrowser}
+ * / {@link acquirePersistentMobileBackend} instead, which keep one view
+ * alive across tests so it rides snapshots/forks.
+ */
+export declare function openBrowser(opts?: BrowserOptions): Promise<Browser>;
+/**
+ * Like {@link openBrowser} but returns the {@link MobileBackend} superset
+ * (touch + probe). When `opts.frame === "mobile"` the view is created at the
+ * fixed device viewport, bypasses the (desktop-sized) pool, and has CDP
+ * device emulation applied before the first navigation. Desktop callers go
+ * through {@link openBrowser} and get the narrower {@link Browser} view of
+ * the same object.
+ */
+export declare function openMobileBackend(opts?: BrowserOptions): Promise<MobileBackend>;
+/**
+ * What acquiring a persistent session returns. `detach` is the test-end
+ * hook (final rrweb drain, stop writing to this test's recorder, keep the
+ * view alive); `browser.close()` is the author-facing escape hatch that
+ * actually destroys the view (the next `ctx.browser()` starts fresh).
+ */
+export interface PersistentBrowser {
+    browser: MobileBackend;
+    /** True when this call attached to a view inherited from an earlier
+     *  test (possibly across a snapshot fork) rather than creating one. */
+    attached: boolean;
+    /** Final rrweb drain + detach from the current recorder. The view stays
+     *  alive so the post-test snapshot captures it. Idempotent. */
+    detach(): Promise<void>;
+}
+/**
+ * Acquire THE persistent desktop browser (creating it on first use). There
+ * is deliberately a single one — `ctx.browser()` always returns it — so a
+ * test DAG shares one browsing session along each branch. The first call's
+ * options win; later calls attach to the existing view as-is.
+ */
+export declare function acquirePersistentBrowser(opts?: BrowserOptions): Promise<PersistentBrowser>;
+/**
+ * Acquire the persistent mobile session for an app URL (one per app). A
+ * fresh session navigates to the app; an attach continues on the live page.
+ */
+export declare function acquirePersistentMobileBackend(url: string, recorder: BrowserSessionRecorder | null, initScript?: string): Promise<PersistentBrowser>;
+export interface RecordableFields {
+    url: string;
+    selector: string;
+    description: string;
+    script: string;
+    scriptTruncated: boolean;
+    text: string;
+    textTruncated: boolean;
+    key: string;
+    dx: number;
+    dy: number;
+    x: number;
+    y: number;
+    format: string;
+    attempts: number;
+    artifactId: string;
+}