@testsmith/api-spector 0.3.0 → 0.3.2

package/out/main/chunks/{request-collection-d2vgYls1.js → request-collection-8TOVNXE0.js}

@@ -23,7 +23,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 const undici = require("undici");
 const promises = require("fs/promises");
-const authBuilder = require("./auth-builder-CRQayp8x.js");
+const authBuilder = require("./auth-builder-CUs9yzOF.js");
 const vm = require("vm");
 const crypto = require("crypto");
 const dayjs = require("dayjs");
@@ -32,7 +32,6 @@ const jsonpathPlus = require("jsonpath-plus");
 const xmldom = require("@xmldom/xmldom");
 const path = require("path");
 const Ajv = require("ajv");
-const ipcValidate = require("./ipc-validate-CscN4HfG.js");
 function _interopNamespaceDefault(e) {
   const n = Object.create(null, { [Symbol.toStringTag]: { value: "Module" } });
   if (e) {
@@ -509,59 +508,6 @@ function maskHeaders(headers, patterns) {
   }
   return result;
 }
-function asObject(value) {
-  return value && typeof value === "object" ? value : null;
-}
-function readStringField(obj, key) {
-  const value = obj?.[key];
-  return typeof value === "string" && value ? value : void 0;
-}
-function safeProxySummary(proxy) {
-  if (!proxy?.url?.trim()) return "off";
-  try {
-    const normalized = buildProxyUri({ url: proxy.url });
-    const parsed = new URL(normalized);
-    const host = parsed.port ? `${parsed.hostname}:${parsed.port}` : parsed.hostname;
-    const auth = proxy.auth ? "yes" : "no";
-    return `${parsed.protocol}//${host} auth=${auth}`;
-  } catch {
-    return `invalid input "${proxy.url}"`;
-  }
-}
-function safeTlsSummary(tls) {
-  if (!tls) return "off";
-  const parts = [];
-  if (tls.rejectUnauthorized !== void 0) parts.push(`rejectUnauthorized=${String(tls.rejectUnauthorized)}`);
-  if (tls.caCertPath) parts.push(`ca=${tls.caCertPath}`);
-  if (tls.clientCertPath) parts.push(`cert=${tls.clientCertPath}`);
-  if (tls.clientKeyPath) parts.push(`key=${tls.clientKeyPath}`);
-  return parts.length ? parts.join(", ") : "on";
-}
-function formatRequestError(err, context) {
-  const obj = asObject(err);
-  const message = err instanceof Error ? err.message : String(err);
-  const code = readStringField(obj, "code");
-  const stack = err instanceof Error ? err.stack : void 0;
-  const causeObj = obj ? asObject(obj["cause"]) : null;
-  const causeMessage = readStringField(causeObj, "message");
-  const causeCode = readStringField(causeObj, "code");
-  const lines = [
-    `[request:send] ${context.method} ${context.resolvedUrl}`,
-    `[request:send] requestId=${context.requestId}`,
-    `[request:send] proxy=${safeProxySummary(context.proxy)}`,
-    `[request:send] tls=${safeTlsSummary(context.tls)}`,
-    `[request:send] error=${message}${code ? ` (code=${code})` : ""}`
-  ];
-  if (causeMessage) {
-    lines.push(`[request:send] cause=${causeMessage}${causeCode ? ` (code=${causeCode})` : ""}`);
-  }
-  if (stack) {
-    const preview = stack.split("\n").slice(0, 6).join("\n");
-    lines.push("[request:send] stack:");
-    lines.push(preview);
-  }
-  return lines.join("\n");
-}
 const schemaAjv = new Ajv({ allErrors: true, strict: false });
 function buildSchemaTestResults(schemaText, body) {
   const trimmed = schemaText?.trim();
@@ -639,6 +585,12 @@ function buildProtocolFaultTests(bodyMode, body) {
   }
   return [];
 }
+function applyRequestDefaults(req) {
+  if (!req.headers) req.headers = [];
+  if (!req.params) req.params = [];
+  if (!req.body) req.body = { mode: "none" };
+  if (!req.auth) req.auth = { type: "none" };
+}
 async function buildDispatcher(proxy, tls) {
   const connectOpts = {};
   let hasTls = false;
@@ -666,11 +618,11 @@ async function buildDispatcher(proxy, tls) {
       }
     }
   }
-  if (proxy?.url) {
+  if (proxy?.url?.trim()) {
     return new undici.ProxyAgent({
-      uri: proxyUri,
-      requestTls: proxyConnect,
-      proxyTls: proxyConnect
+      uri: buildProxyUri({ url: proxy.url, auth: proxy.auth }),
+      requestTls: hasTls ? connectOpts : void 0,
+      proxyTls: hasTls ? connectOpts : void 0
     });
   }
   if (hasTls) {
@@ -678,309 +630,300 @@ async function buildDispatcher(proxy, tls) {
   }
   return void 0;
 }
-function registerRequestHandler(ipc) {
-  ipc.handle("request:send", async (_e, payload) => {
-    ipcValidate.validateSendRequestPayload(payload);
-    const {
-      request: req,
-      environment,
-      collectionVars,
-      globals: payloadGlobals,
-      proxy,
-      tls,
-      piiMaskPatterns = []
-    } = payload;
-    if (!req.headers) req.headers = [];
-    if (!req.params) req.params = [];
-    if (!req.body) req.body = { mode: "none" };
-    if (!req.auth) req.auth = { type: "none" };
-    const start = Date.now();
-    const liveGlobals = getGlobals();
-    const mergedGlobals = { ...payloadGlobals, ...liveGlobals };
-    const envVars = await authBuilder.buildEnvVars(environment);
-    let localVars = {};
-    const decryptionWarnings = [];
-    if (environment) {
-      const masterKeySet = Boolean(process.env["API_SPECTOR_MASTER_KEY"]);
-      for (const v of environment.variables) {
-        if (!v.enabled || !v.secret || !v.secretEncrypted) continue;
-        if (!masterKeySet) {
-          decryptionWarnings.push(`[warn] Secret "${v.key}" was not decrypted: API_SPECTOR_MASTER_KEY is not set. Use the master password modal or export the variable in your shell.`);
-        } else if (envVars[v.key] === void 0) {
-          decryptionWarnings.push(`[warn] Secret "${v.key}" could not be decrypted: wrong password or corrupted data.`);
-        }
-      }
-    }
-    const dynamicVars = await authBuilder.buildDynamicVars();
-    let vars = authBuilder.mergeVars(envVars, collectionVars, mergedGlobals, localVars, dynamicVars);
-    let preScriptMeta = { consoleOutput: [] };
-    let updatedCollectionVars = { ...collectionVars };
-    let updatedEnvVars = { ...envVars };
-    let updatedGlobals = { ...mergedGlobals };
-    if (req.preRequestScript?.trim()) {
-      const result = await runScript(authBuilder.interpolate(req.preRequestScript, vars), {
-        envVars: { ...envVars },
-        collectionVars: { ...collectionVars },
-        globals: { ...mergedGlobals },
-        localVars: {}
-      });
-      preScriptMeta = { error: result.error, consoleOutput: result.consoleOutput };
-      localVars = result.updatedLocalVars;
-      updatedEnvVars = result.updatedEnvVars;
-      updatedCollectionVars = result.updatedCollectionVars;
-      updatedGlobals = result.updatedGlobals;
-      patchGlobals(result.updatedGlobals);
-      await persistGlobals();
-      vars = authBuilder.mergeVars(updatedEnvVars, updatedCollectionVars, updatedGlobals, localVars, dynamicVars);
-    }
-    let response;
-    let scriptResponse;
-    let sentRequest = { method: req.method, url: "", headers: {} };
-    const resolvedUrl = authBuilder.buildUrl(req.url, req.params, vars);
-    const secretValues = /* @__PURE__ */ new Set();
-    if (environment) {
-      for (const v of environment.variables) {
-        if (!v.enabled) continue;
-        if ((v.secret || v.envRef) && envVars[v.key]) {
-          secretValues.add(envVars[v.key]);
-        }
-      }
-    }
-    function redactSecrets(s) {
-      if (!secretValues.size) return s;
-      let result = s;
-      for (const secret of secretValues) {
-        if (secret) result = result.split(secret).join("[*****]");
+function buildBodyAndApplyHeaders(req, vars, headers) {
+  let body;
+  if (req.body.mode === "json" && req.body.json) {
+    body = authBuilder.interpolate(req.body.json, vars);
+    if (!headers.has("content-type")) headers.set("Content-Type", "application/json");
+  } else if (req.body.mode === "form" && req.body.form) {
+    body = req.body.form.filter((p) => p.enabled && p.key).map((p) => `${encodeURIComponent(authBuilder.interpolate(p.key, vars))}=${encodeURIComponent(authBuilder.interpolate(p.value, vars))}`).join("&");
+    if (!headers.has("content-type")) headers.set("Content-Type", "application/x-www-form-urlencoded");
+  } else if (req.body.mode === "raw" && req.body.raw) {
+    body = authBuilder.interpolate(req.body.raw, vars);
+    if (!headers.has("content-type")) headers.set("Content-Type", req.body.rawContentType ?? "text/plain");
+  } else if (req.body.mode === "graphql" && req.body.graphql) {
+    const gql = req.body.graphql;
+    const gqlBody = { query: authBuilder.interpolate(gql.query, vars) };
+    const rawVars = gql.variables?.trim();
+    if (rawVars) {
+      try {
+        gqlBody.variables = JSON.parse(authBuilder.interpolate(rawVars, vars));
+      } catch {
       }
-      return result;
     }
-    function redactSentRequest(sr) {
-      const headers = {};
-      for (const [k, v] of Object.entries(sr.headers)) {
-        headers[k] = redactSecrets(v);
-      }
-      return {
-        method: sr.method,
-        url: redactSecrets(sr.url),
-        headers,
-        body: sr.body !== void 0 ? redactSecrets(sr.body) : void 0
-      };
+    if (gql.operationName?.trim()) gqlBody.operationName = gql.operationName.trim();
+    body = JSON.stringify(gqlBody);
+    if (!headers.has("content-type")) headers.set("Content-Type", "application/json");
+  } else if (req.body.mode === "soap" && req.body.soap) {
+    body = authBuilder.interpolate(req.body.soap.envelope, vars);
+    if (!headers.has("content-type")) headers.set("Content-Type", "text/xml; charset=utf-8");
+    if (req.body.soap.soapAction && !headers.has("soapaction")) {
+      headers.set("SOAPAction", req.body.soap.soapAction);
     }
-    try {
-      const dispatcher = await buildDispatcher(proxy, tls);
-      if (req.auth.type === "oauth2") {
-        const now = Date.now();
-        const tokenMissing = !req.auth.oauth2CachedToken;
-        const tokenExpired = req.auth.oauth2TokenExpiry ? req.auth.oauth2TokenExpiry <= now + 5e3 : true;
-        if (tokenMissing || tokenExpired) {
-          const result = await authBuilder.fetchOAuth2Token(req.auth, vars);
-          req.auth.oauth2CachedToken = result.accessToken;
-          req.auth.oauth2TokenExpiry = result.expiresAt;
-        }
-      }
-      const authHeaders = await authBuilder.buildAuthHeaders(req.auth, vars);
-      const apiKeyParam = await authBuilder.buildApiKeyParam(req.auth, vars);
-      let finalUrl = resolvedUrl;
-      if (apiKeyParam) {
-        const sep = finalUrl.includes("?") ? "&" : "?";
-        finalUrl += `${sep}${encodeURIComponent(apiKeyParam.key)}=${encodeURIComponent(apiKeyParam.value)}`;
-      }
-      const buildHeaders = () => {
-        const h = new undici.Headers();
-        for (const header of req.headers) {
-          if (header.enabled && header.key) {
-            h.set(authBuilder.interpolate(header.key, vars), authBuilder.interpolate(header.value, vars));
-          }
-        }
-        for (const [k, v] of Object.entries(authHeaders)) h.set(k, v);
-        return h;
-      };
-      let body;
-      if (req.body.mode === "json" && req.body.json) {
-        body = authBuilder.interpolate(req.body.json, vars);
-      } else if (req.body.mode === "form" && req.body.form) {
-        body = req.body.form.filter((p) => p.enabled && p.key).map((p) => `${encodeURIComponent(authBuilder.interpolate(p.key, vars))}=${encodeURIComponent(authBuilder.interpolate(p.value, vars))}`).join("&");
-      } else if (req.body.mode === "raw" && req.body.raw) {
-        body = authBuilder.interpolate(req.body.raw, vars);
-      } else if (req.body.mode === "graphql" && req.body.graphql) {
-        const gql = req.body.graphql;
-        const gqlBody = { query: authBuilder.interpolate(gql.query, vars) };
-        const rawVars = gql.variables?.trim();
-        if (rawVars) {
-          try {
-            gqlBody.variables = JSON.parse(authBuilder.interpolate(rawVars, vars));
-          } catch {
-          }
-        }
-        if (gql.operationName?.trim()) gqlBody.operationName = gql.operationName.trim();
-        body = JSON.stringify(gqlBody);
-      } else if (req.body.mode === "soap" && req.body.soap) {
-        const soap = req.body.soap;
-        body = authBuilder.interpolate(soap.envelope, vars);
-      }
-      const methodHasBody = !["GET", "HEAD"].includes(req.method);
-      const applyBodyHeaders = (h) => {
-        if (body !== void 0) {
-          if (!h.has("content-type")) {
-            if (req.body.mode === "json" || req.body.mode === "graphql") h.set("Content-Type", "application/json");
-            else if (req.body.mode === "form") h.set("Content-Type", "application/x-www-form-urlencoded");
-            else if (req.body.mode === "raw") h.set("Content-Type", req.body.rawContentType ?? "text/plain");
-            else if (req.body.mode === "soap") h.set("Content-Type", "text/xml; charset=utf-8");
-          }
-          if (req.body.mode === "soap" && req.body.soap?.soapAction && !h.has("soapaction")) {
-            h.set("SOAPAction", req.body.soap.soapAction);
-          }
-        }
-        return h;
-      };
-      const captureSent = (h) => {
-        const capturedHeaders = {};
-        h.forEach((value, key) => {
-          capturedHeaders[key] = value;
-        });
-        sentRequest = { method: req.method, url: finalUrl, headers: capturedHeaders, body: methodHasBody ? body : void 0 };
-        return capturedHeaders;
-      };
-      const doFetch = async (overrideHeaders) => {
-        const h = applyBodyHeaders(overrideHeaders ?? buildHeaders());
-        captureSent(h);
-        return undici.fetch(finalUrl, {
-          method: req.method,
-          headers: h,
-          body: methodHasBody ? body : void 0,
-          dispatcher
-        });
-      };
-      let fetchResp;
-      if (req.auth.type === "ntlm") {
-        const h = applyBodyHeaders(buildHeaders());
-        const capturedHeaders = captureSent(h);
-        fetchResp = await authBuilder.performNtlmRequest({
-          url: finalUrl,
-          method: req.method,
-          auth: req.auth,
-          vars,
-          baseHeaders: capturedHeaders,
-          body: methodHasBody ? body : void 0,
-          tls,
-          proxy
-        });
-      } else if (req.auth.type === "digest") {
-        const probeFetch = async (url, init) => {
-          return undici.fetch(url, {
-            ...init,
-            dispatcher
-          });
-        };
-        const digestHeader = await authBuilder.performDigestAuth(finalUrl, req.method, req.auth, vars, probeFetch);
-        const h = buildHeaders();
-        if (digestHeader) h.set("Authorization", digestHeader);
-        fetchResp = await doFetch(h);
-      } else {
-        fetchResp = await doFetch();
-      }
-      const responseBody = await fetchResp.text();
-      const durationMs = Date.now() - start;
-      const rawResponseHeaders = {};
-      fetchResp.headers.forEach((value, key) => {
-        rawResponseHeaders[key] = value;
-      });
-      const maskedBody = maskPii(responseBody, piiMaskPatterns);
-      const maskedHeaders = maskHeaders(rawResponseHeaders, piiMaskPatterns);
-      response = {
-        status: fetchResp.status,
-        statusText: fetchResp.statusText,
-        headers: maskedHeaders,
-        body: maskedBody,
-        bodySize: Buffer.byteLength(responseBody, "utf8"),
-        durationMs
-      };
-      scriptResponse = {
-        status: fetchResp.status,
-        statusText: fetchResp.statusText,
-        headers: rawResponseHeaders,
-        body: responseBody,
-        bodySize: Buffer.byteLength(responseBody, "utf8"),
-        durationMs
-      };
-    } catch (err) {
-      const diagnostic = formatRequestError(err, {
-        requestId: req.id,
-        method: req.method,
-        resolvedUrl,
-        proxy,
-        tls
-      });
-      console.error(diagnostic);
-      response = {
-        status: 0,
-        statusText: "Error",
-        headers: {},
-        body: "",
-        bodySize: 0,
-        durationMs: Date.now() - start,
-        error: diagnostic
-      };
-      scriptResponse = response;
+  }
+  return body;
+}
+async function performHttpExchange(opts) {
+  const { req, vars, resolvedUrl, dispatcher, proxy, tls, onSent } = opts;
+  const start = Date.now();
+  if (req.auth.type === "oauth2") {
+    const now = Date.now();
+    const tokenMissing = !req.auth.oauth2CachedToken;
+    const tokenExpired = req.auth.oauth2TokenExpiry ? req.auth.oauth2TokenExpiry <= now + 5e3 : true;
+    if (tokenMissing || tokenExpired) {
+      const result = await authBuilder.fetchOAuth2Token(req.auth, vars);
+      req.auth.oauth2CachedToken = result.accessToken;
+      req.auth.oauth2TokenExpiry = result.expiresAt;
     }
-    const schemaTestResults = !response.error ? buildSchemaTestResults(req.schema, scriptResponse.body) : [];
-    let postTestResults = [];
-    let postConsole = [];
-    let postError;
-    if (req.postRequestScript?.trim() && !response.error) {
-      const result = await runScript(authBuilder.interpolate(req.postRequestScript, vars), {
-        envVars: { ...updatedEnvVars },
-        collectionVars: { ...updatedCollectionVars },
-        globals: { ...updatedGlobals },
-        localVars: { ...localVars },
-        // Pass the *unmasked* response so the script can extract real values
-        // (tokens, ids, …). The displayed `response` keeps the redacted copy.
-        response: scriptResponse
+  }
+  const authHeaders = await authBuilder.buildAuthHeaders(req.auth, vars);
+  const apiKeyParam = await authBuilder.buildApiKeyParam(req.auth, vars);
+  let finalUrl = resolvedUrl;
+  if (apiKeyParam) {
+    const sep = finalUrl.includes("?") ? "&" : "?";
+    finalUrl += `${sep}${encodeURIComponent(apiKeyParam.key)}=${encodeURIComponent(apiKeyParam.value)}`;
+  }
+  const headers = new undici.Headers();
+  for (const h of req.headers) {
+    if (h.enabled && h.key) headers.set(authBuilder.interpolate(h.key, vars), authBuilder.interpolate(h.value, vars));
+  }
+  for (const [k, v] of Object.entries(authHeaders)) headers.set(k, v);
+  const body = buildBodyAndApplyHeaders(req, vars, headers);
+  const methodHasBody = !["GET", "HEAD"].includes(req.method);
+  const effectiveBody = methodHasBody ? body : void 0;
+  const captureSent = (h) => {
+    const captured = {};
+    h.forEach((value, key) => {
+      captured[key] = value;
+    });
+    onSent?.({ method: req.method, url: finalUrl, headers: captured, body: effectiveBody });
+    return captured;
+  };
+  const doFetch = (h) => undici.fetch(finalUrl, {
+    method: req.method,
+    headers: h,
+    body: effectiveBody,
+    dispatcher
+  });
+  let sentHeaders;
+  let fetchResp;
+  if (req.auth.type === "ntlm") {
+    sentHeaders = captureSent(headers);
+    fetchResp = await authBuilder.performNtlmRequest({
+      url: finalUrl,
+      method: req.method,
+      auth: req.auth,
+      vars,
+      baseHeaders: sentHeaders,
+      body: effectiveBody,
+      tls,
+      proxy
+    });
+  } else if (req.auth.type === "digest") {
+    const probeFetch = (url, init) => undici.fetch(url, {
+      ...init,
+      dispatcher
+    });
+    const digestHeader = await authBuilder.performDigestAuth(finalUrl, req.method, req.auth, vars, probeFetch);
+    if (digestHeader) headers.set("Authorization", digestHeader);
+    sentHeaders = captureSent(headers);
+    fetchResp = await doFetch(headers);
+  } else {
+    sentHeaders = captureSent(headers);
+    fetchResp = await doFetch(headers);
+  }
+  const responseBody = await fetchResp.text();
+  const rawHeaders = {};
+  fetchResp.headers.forEach((value, key) => {
+    rawHeaders[key] = value;
+  });
+  return {
+    status: fetchResp.status,
+    statusText: fetchResp.statusText,
+    rawHeaders,
+    responseBody,
+    durationMs: Date.now() - start,
+    sentHeaders,
+    sentBody: effectiveBody,
+    finalUrl
+  };
+}
+function deriveRunStatus(postScriptError, testResults, httpStatus) {
+  const httpFailed = httpStatus >= 400;
+  if (postScriptError) return "error";
+  if (testResults.length > 0) return testResults.every((t) => t.passed) ? "passed" : "failed";
+  return httpFailed ? "failed" : "passed";
+}
+function syntheticHttpFailure(status, statusText) {
+  return {
+    name: `HTTP status ${status} ${statusText}`.trim(),
+    passed: false,
+    error: `Request returned ${status} — no assertion was defined to verify the status code.`
+  };
+}
+async function executeRunnerRequest(opts) {
+  const { req, collectionVars, envVars, globals: globals2, dispatcher, piiMaskPatterns, proxy, tls, onScriptOutput } = opts;
+  let { localVars } = opts;
+  applyRequestDefaults(req);
+  const base = {
+    requestId: req.id,
+    name: req.name,
+    method: req.method,
+    resolvedUrl: req.url,
+    status: "running"
+  };
+  const dynamicVars = await authBuilder.buildDynamicVars();
+  let vars = authBuilder.mergeVars(envVars, collectionVars, globals2, localVars, dynamicVars);
+  let updatedEnvVars = { ...envVars };
+  let updatedCollectionVars = { ...collectionVars };
+  let updatedGlobals = { ...globals2 };
+  let preScriptError;
+  if (req.preRequestScript?.trim()) {
+    const r = await runScript(authBuilder.interpolate(req.preRequestScript, vars), {
+      envVars: { ...envVars },
+      collectionVars: { ...collectionVars },
+      globals: { ...globals2 },
+      localVars: { ...localVars },
+      piiMaskPatterns
+    });
+    preScriptError = r.error;
+    localVars = r.updatedLocalVars;
+    updatedEnvVars = r.updatedEnvVars;
+    updatedCollectionVars = r.updatedCollectionVars;
+    updatedGlobals = r.updatedGlobals;
+    patchGlobals(r.updatedGlobals);
+    await persistGlobals();
+    onScriptOutput?.("pre", r.consoleOutput, r.error);
+    vars = authBuilder.mergeVars(updatedEnvVars, updatedCollectionVars, updatedGlobals, localVars, dynamicVars);
+  }
+  const resolvedUrl = authBuilder.buildUrl(req.url, req.params, vars);
+  base.resolvedUrl = resolvedUrl;
+  const start = Date.now();
+  try {
+    const exchange = await performHttpExchange({ req, vars, resolvedUrl, dispatcher, proxy, tls });
+    const maskedBody = maskPii(exchange.responseBody, piiMaskPatterns);
+    const maskedHeaders = maskHeaders(exchange.rawHeaders, piiMaskPatterns);
+    const scriptResponse = {
+      status: exchange.status,
+      statusText: exchange.statusText,
+      headers: exchange.rawHeaders,
+      body: exchange.responseBody,
+      bodySize: Buffer.byteLength(exchange.responseBody, "utf8"),
+      durationMs: exchange.durationMs
+    };
+    const schemaTestResults = buildSchemaTestResults(req.schema, exchange.responseBody);
+    const protocolFaultTests = buildProtocolFaultTests(req.body.mode, exchange.responseBody);
+    let testResults = [...schemaTestResults, ...protocolFaultTests];
+    let consoleOutput = [];
+    let postScriptError;
+    if (req.postRequestScript?.trim()) {
+      const r = await runScript(authBuilder.interpolate(req.postRequestScript, vars), {
+        envVars: updatedEnvVars,
+        collectionVars: updatedCollectionVars,
+        globals: updatedGlobals,
+        localVars,
+        response: scriptResponse,
+        piiMaskPatterns
       });
-      postTestResults = result.testResults;
-      postConsole = result.consoleOutput;
-      postError = result.error;
-      updatedEnvVars = result.updatedEnvVars;
-      updatedCollectionVars = result.updatedCollectionVars;
-      updatedGlobals = result.updatedGlobals;
-      localVars = result.updatedLocalVars;
-      patchGlobals(result.updatedGlobals);
+      testResults = [...schemaTestResults, ...protocolFaultTests, ...r.testResults];
+      consoleOutput = r.consoleOutput;
+      postScriptError = r.error;
+      updatedEnvVars = r.updatedEnvVars;
+      updatedCollectionVars = r.updatedCollectionVars;
+      updatedGlobals = r.updatedGlobals;
+      localVars = r.updatedLocalVars;
+      patchGlobals(r.updatedGlobals);
       await persistGlobals();
+      onScriptOutput?.("post", r.consoleOutput, r.error);
     }
-    const combinedTestResults = [...schemaTestResults, ...postTestResults];
-    if (!response.error && response.status >= 400 && combinedTestResults.length === 0) {
-      combinedTestResults.push({
-        name: `HTTP status ${response.status} ${response.statusText}`.trim(),
-        passed: false,
-        error: `Request returned ${response.status} — no assertion was defined to verify the status code.`
-      });
+    const status = deriveRunStatus(postScriptError, testResults, exchange.status);
+    if (exchange.status >= 400 && testResults.length === 0) {
+      testResults = [...testResults, syntheticHttpFailure(exchange.status, exchange.statusText)];
     }
-    const scriptResult = {
-      testResults: combinedTestResults,
-      consoleOutput: [...decryptionWarnings, ...preScriptMeta.consoleOutput, ...postConsole],
+    return {
+      result: {
+        ...base,
+        status,
+        httpStatus: exchange.status,
+        durationMs: exchange.durationMs,
+        testResults,
+        consoleOutput,
+        preScriptError,
+        postScriptError,
+        sentRequest: { headers: exchange.sentHeaders, body: exchange.sentBody },
+        receivedResponse: {
+          status: exchange.status,
+          statusText: exchange.statusText,
+          headers: maskedHeaders,
+          body: maskedBody
+        }
+      },
       updatedEnvVars,
       updatedCollectionVars,
       updatedGlobals,
-      updatedLocalVars: localVars,
-      resolvedUrl,
-      preScriptError: preScriptMeta.error,
-      postScriptError: postError
+      updatedLocalVars: localVars
     };
-    return { response, scriptResult, sentRequest: redactSentRequest(sentRequest) };
-  });
-  ipc.handle("script:run-hook", async (_e, payload) => {
-    const { script, envVars, collectionVars, globals: globals2 } = payload;
-    const result = await runScript(script, { envVars, collectionVars, globals: globals2, localVars: {} });
-    patchGlobals(result.updatedGlobals);
-    await persistGlobals();
+  } catch (err) {
     return {
-      updatedEnvVars: result.updatedEnvVars,
-      updatedCollectionVars: result.updatedCollectionVars,
-      updatedGlobals: result.updatedGlobals,
-      consoleOutput: result.consoleOutput,
-      error: result.error
+      result: {
+        ...base,
+        status: "error",
+        durationMs: Date.now() - start,
+        error: err instanceof Error ? err.cause instanceof Error ? `${err.message}: ${err.cause.message}` : err.message : String(err),
+        preScriptError
+      },
+      updatedEnvVars,
+      updatedCollectionVars,
+      updatedGlobals,
+      updatedLocalVars: localVars
     };
-  });
+  }
+}
+class HookSkipTracker {
+  /** Scopes whose beforeAll hook failed — all their requests are skipped. */
+  failedScopes = /* @__PURE__ */ new Set();
+  /** Main request IDs whose before hook failed — that request is skipped. */
+  skipRequests = /* @__PURE__ */ new Set();
+  /** Returns the human-readable skip reason, or undefined to run the item. */
+  shouldSkip(item) {
+    const { isHook, hookType, scopeId, scopeAncestors, mainRequestId } = item;
+    if (isHook) {
+      if (hookType === "beforeAll") {
+        if ((scopeAncestors ?? []).some((id) => this.failedScopes.has(id))) {
+          return "Skipped — outer scope hook failed";
+        }
+      } else if (hookType === "before") {
+        const allScopes2 = [...scopeAncestors ?? [], scopeId].filter(Boolean);
+        if (allScopes2.some((id) => this.failedScopes.has(id))) {
+          return "Skipped — scope hook failed";
+        }
+        if (mainRequestId && this.skipRequests.has(mainRequestId)) {
+          return "Skipped — before hook failed";
+        }
+      }
+      return void 0;
+    }
+    const allScopes = [...scopeAncestors ?? [], scopeId].filter(Boolean);
+    if (allScopes.some((id) => this.failedScopes.has(id))) {
+      return "Skipped — beforeAll hook failed";
+    }
+    if (this.skipRequests.has(item.request.id)) {
+      return "Skipped — before hook failed";
+    }
+    return void 0;
+  }
+  /** Record an executed item's outcome so later items skip when appropriate.
+   *  A 'skipped' hook (HTTP 2xx with no assertions) is not a failure — only
+   *  real failures or errors propagate to dependent requests. */
+  recordResult(item, status) {
+    const failed = status === "failed" || status === "error";
+    if (!item.isHook || !failed) return;
+    if (item.hookType === "beforeAll" && item.scopeId) {
+      this.failedScopes.add(item.scopeId);
+    } else if (item.hookType === "before" && item.mainRequestId) {
+      this.skipRequests.add(item.mainRequestId);
+    }
+  }
 }
 function makeHook(req, collectionVars, hookType, scopeId, scopeAncestors, scopePath, mainRequestId) {
   return { request: req, collectionVars, isHook: true, hookType, scopeId, scopeAncestors, scopePath, mainRequestId };
@@ -1096,18 +1039,21 @@ function buildRunPlan(collection, folderId, filterTags) {
     );
   }
 }
+exports.HookSkipTracker = HookSkipTracker;
+exports.applyRequestDefaults = applyRequestDefaults;
 exports.buildDispatcher = buildDispatcher;
-exports.buildProtocolFaultTests = buildProtocolFaultTests;
+exports.buildProxyUri = buildProxyUri;
 exports.buildRunPlan = buildRunPlan;
 exports.buildSchemaTestResults = buildSchemaTestResults;
+exports.executeRunnerRequest = executeRunnerRequest;
 exports.getAllApplicableHooks = getAllApplicableHooks;
 exports.getGlobals = getGlobals;
 exports.loadGlobals = loadGlobals;
 exports.maskHeaders = maskHeaders;
 exports.maskPii = maskPii;
 exports.patchGlobals = patchGlobals;
+exports.performHttpExchange = performHttpExchange;
 exports.persistGlobals = persistGlobals;
-exports.registerRequestHandler = registerRequestHandler;
 exports.resolveInheritedAuthAndHeaders = resolveInheritedAuthAndHeaders;
 exports.runScript = runScript;
 exports.setGlobals = setGlobals;