@testsmith/api-spector 0.3.4 → 0.3.6

package/out/main/index.js

@@ -22,28 +22,28 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 const electron = require("electron");
-const handle = require("./chunks/handle-C0IQL-Vl.js");
+const handle = require("./chunks/handle-BtRMtQJg.js");
 const path = require("path");
 const fs = require("fs");
 const promises = require("fs/promises");
-const requestCollection = require("./chunks/request-collection-8TOVNXE0.js");
-const authBuilder = require("./chunks/auth-builder-CUs9yzOF.js");
+const requestExec = require("./chunks/request-exec-DbNHbA8x.js");
 const ipcValidate = require("./chunks/ipc-validate-k6KI8adf.js");
 const uuid = require("uuid");
 const jsYaml = require("js-yaml");
 const undici = require("undici");
 const JSZip = require("jszip");
+const requestCollection = require("./chunks/request-collection-CBuPjBwa.js");
 const mockServer = require("./chunks/mock-server-DSLR2ulH.js");
 const http = require("http");
 const WebSocket = require("ws");
-const soapHandler = require("./chunks/soap-handler-B9x_YCtj.js");
+const soapHandler = require("./chunks/soap-handler-CqXVreNa.js");
 const os = require("os");
 const crypto = require("crypto");
-const snapshots = require("./chunks/snapshots-UFd3XgSS.js");
+const snapshots = require("./chunks/snapshots-rV5tPwAd.js");
 const simpleGit = require("simple-git");
-const recorder = require("./chunks/recorder-DFxJgn9c.js");
-require("vm");
+const recorder = require("./chunks/recorder-0Ij921El.js");
 require("dayjs");
+require("vm");
 require("tv4");
 require("jsonpath-plus");
 require("@xmldom/xmldom");
@@ -67,7 +67,7 @@ function atomicWrite(path2, data) {
   return promises.writeFile(path2, data, "utf8");
 }
 const SPECTOR_GITIGNORE = [
-  "# API Spector — never commit secrets",
+  "# API Spector - never commit secrets",
   "*.secrets",
   ".env",
   ".env.local",
@@ -102,7 +102,7 @@ function readmeContents(workspaceFileName) {
     `# API tests`,
     ``,
     `This folder is an [API Spector](https://github.com/testsmith-io/api-spector) workspace.`,
-    `Everything here is plain JSON — diff it, commit it, review it like any other code.`,
+    `Everything here is plain JSON - diff it, commit it, review it like any other code.`,
     ``,
     `## Layout`,
     ``,
@@ -144,7 +144,7 @@ function readmeContents(workspaceFileName) {
     `## A note on secrets`,
     ``,
     `Secret values (passwords, OAuth client secrets, API keys) are stored in your`,
-    `OS keychain — **not** in this folder. Environment files only reference the`,
+    `OS keychain - **not** in this folder. Environment files only reference the`,
     `keychain entry by name, so it's safe to commit them.`,
     ``
   ].join("\n");
@@ -223,7 +223,7 @@ function registerFileHandlers(ipc) {
     const wsPath = result.filePaths[0];
     workspaceDir = path.dirname(wsPath);
     workspaceFile = wsPath;
-    await requestCollection.loadGlobals(workspaceDir);
+    await requestExec.loadGlobals(workspaceDir);
     await saveLastWorkspacePath(wsPath);
     const raw = await promises.readFile(wsPath, "utf8");
     return { workspace: JSON.parse(raw), workspacePath: wsPath };
@@ -239,7 +239,7 @@ function registerFileHandlers(ipc) {
     if (result.canceled || !result.filePath) return null;
     workspaceDir = path.dirname(result.filePath);
     workspaceFile = result.filePath;
-    await requestCollection.loadGlobals(workspaceDir);
+    await requestExec.loadGlobals(workspaceDir);
     await promises.mkdir(path.join(workspaceDir, "collections"), { recursive: true });
     await promises.mkdir(path.join(workspaceDir, "environments"), { recursive: true });
     await ensureGitignore(workspaceDir);
@@ -317,10 +317,10 @@ function registerFileHandlers(ipc) {
     await promises.writeFile(result.filePath, content, "utf8");
     return true;
   });
-  handle.handleIpc(ipc, handle.IPC.globals.get, () => requestCollection.getGlobals());
+  handle.handleIpc(ipc, handle.IPC.globals.get, () => requestExec.getGlobals());
   handle.handleIpc(ipc, handle.IPC.globals.set, async (_e, patch) => {
-    requestCollection.setGlobals(patch);
-    await requestCollection.persistGlobals();
+    requestExec.setGlobals(patch);
+    await requestExec.persistGlobals();
   });
   handle.handleIpc(ipc, handle.IPC.file.closeWorkspace, async () => {
     workspaceDir = null;
@@ -342,7 +342,7 @@ function registerFileHandlers(ipc) {
       const workspace = JSON.parse(raw);
       workspaceDir = path.dirname(wsPath);
       workspaceFile = wsPath;
-      await requestCollection.loadGlobals(workspaceDir);
+      await requestExec.loadGlobals(workspaceDir);
       return { workspace, workspacePath: wsPath };
     } catch {
       return null;
@@ -364,7 +364,7 @@ async function tryOpenWorkspaceInDir(dir) {
     const workspace = JSON.parse(raw);
     workspaceDir = dir;
     workspaceFile = wsPath;
-    await requestCollection.loadGlobals(workspaceDir);
+    await requestExec.loadGlobals(workspaceDir);
     return { workspace, workspacePath: wsPath };
   } catch {
     return null;
@@ -383,7 +383,7 @@ function readStringField(obj, key) {
 function safeProxySummary(proxy) {
   if (!proxy?.url?.trim()) return "off";
   try {
-    const normalized = requestCollection.buildProxyUri({ url: proxy.url });
+    const normalized = requestExec.buildProxyUri({ url: proxy.url });
     const parsed = new URL(normalized);
     const host = parsed.port ? `${parsed.hostname}:${parsed.port}` : parsed.hostname;
     const auth = proxy.auth ? "yes" : "no";
@@ -438,11 +438,11 @@ function registerRequestHandler(ipc) {
       tls,
       piiMaskPatterns = []
     } = payload;
-    requestCollection.applyRequestDefaults(req);
+    requestExec.applyRequestDefaults(req);
     const start = Date.now();
-    const liveGlobals = requestCollection.getGlobals();
+    const liveGlobals = requestExec.getGlobals();
     const mergedGlobals = { ...payloadGlobals, ...liveGlobals };
-    const envVars = await authBuilder.buildEnvVars(environment);
+    const envVars = await requestExec.buildEnvVars(environment);
     let localVars = {};
     const decryptionWarnings = [];
     if (environment) {
@@ -456,14 +456,14 @@ function registerRequestHandler(ipc) {
         }
       }
     }
-    const dynamicVars = await authBuilder.buildDynamicVars();
-    let vars = authBuilder.mergeVars(envVars, collectionVars, mergedGlobals, localVars, dynamicVars);
+    const dynamicVars = await requestExec.buildDynamicVars();
+    let vars = requestExec.mergeVars(envVars, collectionVars, mergedGlobals, localVars, dynamicVars);
     let preScriptMeta = { consoleOutput: [] };
     let updatedCollectionVars = { ...collectionVars };
     let updatedEnvVars = { ...envVars };
     let updatedGlobals = { ...mergedGlobals };
     if (req.preRequestScript?.trim()) {
-      const result = await requestCollection.runScript(authBuilder.interpolate(req.preRequestScript, vars), {
+      const result = await requestExec.runScript(requestExec.interpolate(req.preRequestScript, vars), {
         envVars: { ...envVars },
         collectionVars: { ...collectionVars },
         globals: { ...mergedGlobals },
@@ -474,14 +474,14 @@ function registerRequestHandler(ipc) {
       updatedEnvVars = result.updatedEnvVars;
       updatedCollectionVars = result.updatedCollectionVars;
       updatedGlobals = result.updatedGlobals;
-      requestCollection.patchGlobals(result.updatedGlobals);
-      await requestCollection.persistGlobals();
-      vars = authBuilder.mergeVars(updatedEnvVars, updatedCollectionVars, updatedGlobals, localVars, dynamicVars);
+      requestExec.patchGlobals(result.updatedGlobals);
+      await requestExec.persistGlobals();
+      vars = requestExec.mergeVars(updatedEnvVars, updatedCollectionVars, updatedGlobals, localVars, dynamicVars);
     }
     let response;
     let scriptResponse;
     let sentRequest = { method: req.method, url: "", headers: {} };
-    const resolvedUrl = authBuilder.buildUrl(req.url, req.params, vars);
+    const resolvedUrl = requestExec.buildUrl(req.url, req.params, vars);
     const secretValues = /* @__PURE__ */ new Set();
     if (environment) {
       for (const v of environment.variables) {
@@ -512,8 +512,8 @@ function registerRequestHandler(ipc) {
       };
     }
     try {
-      const dispatcher = await requestCollection.buildDispatcher(proxy, tls);
-      const exchange = await requestCollection.performHttpExchange({
+      const dispatcher = await requestExec.buildDispatcher(proxy, tls);
+      const exchange = await requestExec.performHttpExchange({
         req,
         vars,
         resolvedUrl,
@@ -524,8 +524,8 @@ function registerRequestHandler(ipc) {
           sentRequest = sent;
         }
       });
-      const maskedBody = requestCollection.maskPii(exchange.responseBody, piiMaskPatterns);
-      const maskedHeaders = requestCollection.maskHeaders(exchange.rawHeaders, piiMaskPatterns);
+      const maskedBody = requestExec.maskPii(exchange.responseBody, piiMaskPatterns);
+      const maskedHeaders = requestExec.maskHeaders(exchange.rawHeaders, piiMaskPatterns);
       const bodySize = Buffer.byteLength(exchange.responseBody, "utf8");
       response = {
         status: exchange.status,
@@ -563,12 +563,12 @@ function registerRequestHandler(ipc) {
       };
       scriptResponse = response;
     }
-    const schemaTestResults = !response.error ? requestCollection.buildSchemaTestResults(req.schema, scriptResponse.body) : [];
+    const schemaTestResults = !response.error ? requestExec.buildSchemaTestResults(req.schema, scriptResponse.body) : [];
     let postTestResults = [];
     let postConsole = [];
     let postError;
     if (req.postRequestScript?.trim() && !response.error) {
-      const result = await requestCollection.runScript(authBuilder.interpolate(req.postRequestScript, vars), {
+      const result = await requestExec.runScript(requestExec.interpolate(req.postRequestScript, vars), {
         envVars: { ...updatedEnvVars },
         collectionVars: { ...updatedCollectionVars },
         globals: { ...updatedGlobals },
@@ -584,15 +584,15 @@ function registerRequestHandler(ipc) {
       updatedCollectionVars = result.updatedCollectionVars;
       updatedGlobals = result.updatedGlobals;
       localVars = result.updatedLocalVars;
-      requestCollection.patchGlobals(result.updatedGlobals);
-      await requestCollection.persistGlobals();
+      requestExec.patchGlobals(result.updatedGlobals);
+      await requestExec.persistGlobals();
     }
     const combinedTestResults = [...schemaTestResults, ...postTestResults];
     if (!response.error && response.status >= 400 && combinedTestResults.length === 0) {
       combinedTestResults.push({
         name: `HTTP status ${response.status} ${response.statusText}`.trim(),
         passed: false,
-        error: `Request returned ${response.status} — no assertion was defined to verify the status code.`
+        error: `Request returned ${response.status} - no assertion was defined to verify the status code.`
       });
     }
     const scriptResult = {
@@ -610,9 +610,9 @@ function registerRequestHandler(ipc) {
   });
   handle.handleIpc(ipc, handle.IPC.script.runHook, async (_e, payload) => {
     const { script, envVars, collectionVars, globals } = payload;
-    const result = await requestCollection.runScript(script, { envVars, collectionVars, globals, localVars: {} });
-    requestCollection.patchGlobals(result.updatedGlobals);
-    await requestCollection.persistGlobals();
+    const result = await requestExec.runScript(script, { envVars, collectionVars, globals, localVars: {} });
+    requestExec.patchGlobals(result.updatedGlobals);
+    await requestExec.persistGlobals();
     return {
       updatedEnvVars: result.updatedEnvVars,
       updatedCollectionVars: result.updatedCollectionVars,
@@ -1015,7 +1015,7 @@ function buildAuth(security, securitySchemes) {
   }
   return { type: "none" };
 }
-const HTTP_METHODS$1 = ["get", "post", "put", "patch", "delete", "head", "options"];
+const HTTP_METHODS$1 = ["get", "post", "put", "patch", "delete", "head", "options", "query"];
 function buildCollection(spec) {
   const info = spec.info ?? {};
   const servers = spec.servers ?? [{}];
@@ -1262,7 +1262,7 @@ function parseKv(blockContent) {
   }
   return result;
 }
-const HTTP_METHODS = ["get", "post", "put", "patch", "delete", "head", "options"];
+const HTTP_METHODS = ["get", "post", "put", "patch", "delete", "head", "options", "query"];
 function parseBruFile(content, fileName) {
   const meta = parseKv(extractBlock(content, "meta"));
   let method = "GET";
@@ -1375,7 +1375,7 @@ async function importBruno(filePath) {
     requests
   };
 }
-const METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"];
+const METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS", "QUERY"];
 const HTTP_TO_SPECTOR = {
   $guid: "$uuid",
   $randomInt: "$randomInt",
@@ -1734,6 +1734,13 @@ function renderTree(paths) {
   }
   return [".", ...render(root)].join("\n");
 }
+const PLAYWRIGHT_VERBS = ["get", "post", "put", "patch", "delete", "head"];
+const SUPERTEST_VERBS = ["get", "post", "put", "patch", "delete", "head", "options"];
+function restAssuredCall(method, pathArg) {
+  const verbs = ["get", "post", "put", "patch", "delete", "head", "options"];
+  return verbs.includes(method) ? `.${method}(${pathArg})` : `.request("${method.toUpperCase()}", ${pathArg})`;
+}
+const ROBOT_REQUESTS_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"];
 function safeName(name) {
   return name.replace(/[^\w\s]/g, " ").split(/\s+/).filter(Boolean).map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(" ");
 }
@@ -1774,14 +1781,14 @@ function buildNameMap(root, requests) {
 function buildVariablesFile(environment) {
   const lines = ["*** Variables ***"];
   if (!environment) {
-    lines.push("# No environment — add your variables here");
+    lines.push("# No environment - add your variables here");
     lines.push("${BASE_URL}    http://localhost:8080");
     return lines.join("\n") + "\n";
   }
   for (const v of environment.variables) {
     if (!v.enabled) continue;
     if (v.secret) {
-      lines.push(`# ${envVar(v.key)} — stored in OS keychain, never hardcoded`);
+      lines.push(`# ${envVar(v.key)} - stored in OS keychain, never hardcoded`);
     } else {
       lines.push(`${robotVar(v.key)}    ${v.value}`);
     }
@@ -1817,7 +1824,13 @@ function buildKeywordsFile(collection, varMap, nameMap, hookExtractedVars) {
       const url = interpolate(req.url, varMap);
       const method = req.method.charAt(0) + req.method.slice(1).toLowerCase();
       lines.push(kwName);
-      lines.push(`    [Documentation]    Hook: ${req.hookType} — ${req.name}`);
+      lines.push(`    [Documentation]    Hook: ${req.hookType} - ${req.name}`);
+      if (!ROBOT_REQUESTS_METHODS.includes(req.method)) {
+        lines.push(`    Log    ${req.method} is not supported by robotframework-requests - hook skipped    WARN`);
+        lines.push(`    RETURN    \${None}`);
+        lines.push("");
+        continue;
+      }
       const { body } = req;
       if (hasBody(req) && body.mode === "json" && body.json) {
         const bodyPairs = jsonToRfDictPairs(body.json, varMap);
@@ -1853,6 +1866,12 @@ function buildKeywordsFile(collection, varMap, nameMap, hookExtractedVars) {
       const url = interpolate(req.url, varMap);
       lines.push(kwName);
       lines.push(`    [Documentation]    ${req.description || req.name}`);
+      if (!ROBOT_REQUESTS_METHODS.includes(req.method)) {
+        lines.push(`    Log    ${req.method} is not supported by robotframework-requests - request skipped    WARN`);
+        lines.push(`    RETURN    \${None}`);
+        lines.push("");
+        continue;
+      }
       const inherited = requestCollection.resolveInheritedAuthAndHeaders(reqId, collection);
       const effectiveAuth = resolveEffectiveAuth(req, inherited);
       const allHeaders = mergeHeaders(req, inherited);
@@ -1996,7 +2015,7 @@ function buildTestSuite(collection, environment, nameMap) {
 }
 function buildReadme$6(collectionName, filePaths) {
   const tree = renderTree(filePaths);
-  return `# ${collectionName} — API Tests (Robot Framework)
+  return `# ${collectionName} - API Tests (Robot Framework)
 
 ## Project structure
 
@@ -2005,7 +2024,7 @@ ${tree}
 \`\`\`
 
 > Secrets are read from OS environment variables (e.g. \`%{API_TOKEN}\`).
-> Never hardcode secrets — export them in your shell or CI environment.
+> Never hardcode secrets - export them in your shell or CI environment.
 
 ## Setup
 
@@ -2084,12 +2103,15 @@ function buildHookLines$1(req, sharedVars) {
     } catch {
     }
   }
+  const nativeVerb = PLAYWRIGHT_VERBS.includes(method);
+  if (!nativeVerb) optionParts.unshift(`method: '${req.method}'`);
   const opts = optionParts.length ? `, { ${optionParts.join(", ")} }` : "";
+  const hookCall = nativeVerb ? `request.${method}(${pathExpr}${opts})` : `request.fetch(${pathExpr}${opts})`;
   const lines = [];
   lines.push(`    // ${req.name}`);
   const parsed = parsePostScript(req.postRequestScript);
   if (parsed.extractions.length > 0) {
-    lines.push(`    const hookResponse = await request.${method}(${pathExpr}${opts});`);
+    lines.push(`    const hookResponse = await ${hookCall};`);
     lines.push(`    const hookJson = await hookResponse.json();`);
     for (const e of parsed.extractions) {
       const jsonPath = e.accessor.replace(/^json\.?/, "");
@@ -2099,7 +2121,7 @@ function buildHookLines$1(req, sharedVars) {
       lines.push(`    ${varName} = String(${expr});`);
     }
   } else {
-    lines.push(`    await request.${method}(${pathExpr}${opts});`);
+    lines.push(`    await ${hookCall};`);
   }
   return lines;
 }
@@ -2199,13 +2221,16 @@ ${lines.join("\n")}
         optionParts.push(`      data: \`${interpolateEnvVars(req.body.json, sharedVars)}\``);
       }
     }
+    const nativeVerb = PLAYWRIGHT_VERBS.includes(method);
+    if (!nativeVerb) optionParts.unshift(`      method: '${req.method}'`);
     const optionsStr = optionParts.length ? `, {
 ${optionParts.join(",\n")},
     }` : "";
+    const callExpr = nativeVerb ? `request.${method}(${pathExpr}${optionsStr})` : `request.fetch(${pathExpr}${optionsStr})`;
     const parsed = parsePostScript(req.postRequestScript);
     const lines = [
       `  test('${testName}', async ({ request }) => {`,
-      `    const response = await request.${method}(${pathExpr}${optionsStr});`
+      `    const response = await ${callExpr};`
     ];
     const needsJson = parsed.assertions.some((a) => a.accessor.startsWith("json")) || parsed.extractions.length > 0;
     if (needsJson) {
@@ -2284,7 +2309,7 @@ function buildPackageJson$3(collectionName) {
 }
 function buildReadme$5(collectionName, filePaths) {
   const tree = renderTree([...filePaths, ".env.local"]);
-  return `# ${collectionName} — API Tests (Playwright TypeScript)
+  return `# ${collectionName} - API Tests (Playwright TypeScript)
 
 ## Project structure
 
@@ -2292,7 +2317,7 @@ function buildReadme$5(collectionName, filePaths) {
 ${tree}
 \`\`\`
 
-> \`.env.local\` is git-ignored — fill in your secrets before running.
+> \`.env.local\` is git-ignored - fill in your secrets before running.
 
 ## Setup
 
@@ -2364,11 +2389,14 @@ function buildHookLines(req, sharedVars) {
     } catch {
     }
   }
+  const nativeVerb = PLAYWRIGHT_VERBS.includes(method);
+  if (!nativeVerb) optParts.unshift(`method: '${req.method}'`);
   const opts = optParts.length ? `, { ${optParts.join(", ")} }` : "";
+  const hookCall = nativeVerb ? `request.${method}(${pathExpr}${opts})` : `request.fetch(${pathExpr}${opts})`;
   const lines = [`    // ${req.name}`];
   const parsed = parsePostScript(req.postRequestScript);
   if (parsed.extractions.length > 0) {
-    lines.push(`    const hookResponse = await request.${method}(${pathExpr}${opts});`);
+    lines.push(`    const hookResponse = await ${hookCall};`);
     lines.push(`    const hookJson = await hookResponse.json();`);
     for (const e of parsed.extractions) {
       const jp = e.accessor.replace(/^json\.?/, "");
@@ -2378,7 +2406,7 @@ function buildHookLines(req, sharedVars) {
       lines.push(`    ${varName} = String(${expr});`);
     }
   } else {
-    lines.push(`    await request.${method}(${pathExpr}${opts});`);
+    lines.push(`    await ${hookCall};`);
   }
   return lines;
 }
@@ -2476,13 +2504,16 @@ ${lines.join("\n")}
         optionParts.push(`      data: \`${interpolateEnvVars(req.body.json, sharedVars)}\``);
       }
     }
+    const nativeVerb = PLAYWRIGHT_VERBS.includes(method);
+    if (!nativeVerb) optionParts.unshift(`      method: '${req.method}'`);
     const optionsStr = optionParts.length ? `, {
 ${optionParts.join(",\n")},
     }` : "";
+    const callExpr = nativeVerb ? `request.${method}(${pathExpr}${optionsStr})` : `request.fetch(${pathExpr}${optionsStr})`;
     const parsed = parsePostScript(req.postRequestScript);
     const lines = [
       `  test('${testName}', async ({ request }) => {`,
-      `    const response = await request.${method}(${pathExpr}${optionsStr});`
+      `    const response = await ${callExpr};`
     ];
     const needsJson = parsed.assertions.some((a) => a.accessor.startsWith("json")) || parsed.extractions.length > 0;
     if (needsJson) {
@@ -2551,7 +2582,7 @@ function buildPackageJson$2(collectionName) {
 }
 function buildReadme$4(collectionName, filePaths) {
   const tree = renderTree([...filePaths, ".env.local"]);
-  return `# ${collectionName} — API Tests (Playwright JavaScript)
+  return `# ${collectionName} - API Tests (Playwright JavaScript)
 
 ## Project structure
 
@@ -2559,7 +2590,7 @@ function buildReadme$4(collectionName, filePaths) {
 ${tree}
 \`\`\`
 
-> \`.env.local\` is git-ignored — fill in your secrets before running.
+> \`.env.local\` is git-ignored - fill in your secrets before running.
 
 ## Setup
 
@@ -2643,6 +2674,10 @@ function buildTestFile$1(folderName, folder, collection) {
   function buildSupertestHookLines(h) {
     const lines = [`    // ${h.name}`];
     const method = h.method.toLowerCase();
+    if (!SUPERTEST_VERBS.includes(method)) {
+      lines.push(`    // ${h.method} (RFC 10008) is not supported by supertest -- hook skipped`);
+      return lines;
+    }
     const path2 = h.url.replace(/^https?:\/\/[^/]+/, "") || "/";
     const parsed = parsePostScript(h.postRequestScript);
     if (parsed.extractions.length > 0) {
@@ -2687,6 +2722,13 @@ ${lines.join("\n")}
     const allHeaders = mergeHeaders(req, inherited);
     const enabledParams = req.params.filter((p) => p.enabled && p.key);
     const lines = [];
+    if (!SUPERTEST_VERBS.includes(method)) {
+      lines.push(`  // ${req.method} (RFC 10008) is not supported by supertest`);
+      lines.push(`  it.skip('${nameMap.get(reqId)} [${req.method} unsupported]', () => {});`);
+      lines.push("");
+      tests.push(...lines);
+      continue;
+    }
     lines.push(`  it('${nameMap.get(reqId)}', async () => {`);
     lines.push(`    const res = await api`);
     lines.push(`      .${method}(\`${path2}\`)`);
@@ -2800,7 +2842,7 @@ function buildTsConfig() {
 }
 function buildReadme$3(collectionName, filePaths) {
   const tree = renderTree([...filePaths, ".env.local"]);
-  return `# ${collectionName} — API Tests (Supertest + Jest TypeScript)
+  return `# ${collectionName} - API Tests (Supertest + Jest TypeScript)
 
 ## Project structure
 
@@ -2808,7 +2850,7 @@ function buildReadme$3(collectionName, filePaths) {
 ${tree}
 \`\`\`
 
-> \`.env.local\` is git-ignored — fill in your secrets before running.
+> \`.env.local\` is git-ignored - fill in your secrets before running.
 
 ## Setup
 
@@ -2896,6 +2938,10 @@ function buildTestFile(folderName, folder, collection) {
   function buildJsHookLines(h) {
     const lines = [`    // ${h.name}`];
     const method = h.method.toLowerCase();
+    if (!SUPERTEST_VERBS.includes(method)) {
+      lines.push(`    // ${h.method} (RFC 10008) is not supported by supertest -- hook skipped`);
+      return lines;
+    }
     const path2 = h.url.replace(/^https?:\/\/[^/]+/, "") || "/";
     const parsed = parsePostScript(h.postRequestScript);
     if (parsed.extractions.length > 0) {
@@ -2940,6 +2986,13 @@ ${lines.join("\n")}
     const allHeaders = mergeHeaders(req, inherited);
     const enabledParams = req.params.filter((p) => p.enabled && p.key);
     const lines = [];
+    if (!SUPERTEST_VERBS.includes(method)) {
+      lines.push(`  // ${req.method} (RFC 10008) is not supported by supertest`);
+      lines.push(`  it.skip('${nameMap.get(reqId)} [${req.method} unsupported]', () => {});`);
+      lines.push("");
+      tests.push(...lines);
+      continue;
+    }
     lines.push(`  it('${nameMap.get(reqId)}', async () => {`);
     lines.push(`    const res = await api`);
     lines.push(`      .${method}(\`${path2}\`)`);
@@ -3035,7 +3088,7 @@ function buildPackageJson(collectionName) {
 }
 function buildReadme$2(collectionName, filePaths) {
   const tree = renderTree([...filePaths, ".env.local"]);
-  return `# ${collectionName} — API Tests (Supertest + Jest JavaScript)
+  return `# ${collectionName} - API Tests (Supertest + Jest JavaScript)
 
 ## Project structure
 
@@ -3043,7 +3096,7 @@ function buildReadme$2(collectionName, filePaths) {
 ${tree}
 \`\`\`
 
-> \`.env.local\` is git-ignored — fill in your secrets before running.
+> \`.env.local\` is git-ignored - fill in your secrets before running.
 
 ## Setup
 
@@ -3234,7 +3287,7 @@ function buildTestClass(folderName, folder, collection) {
         const escaped = h.body.json.replace(/"/g, '\\"').replace(/\n/g, "\\n");
         lines.push(`            .body("${escaped}")`);
       }
-      lines.push(`            .when().${method}("${path2}");`);
+      lines.push(`            .when()${restAssuredCall(method, `"${path2}"`)};`);
       for (const e of parsed.extractions) {
         const jp = accessorToJsonPath(e.accessor);
         const varName = toEnvVar(e.varName);
@@ -3242,7 +3295,7 @@ function buildTestClass(folderName, folder, collection) {
         lines.push(`        ${varName} = hookResponse.jsonPath().getString("${jp}");`);
       }
     } else {
-      lines.push(`        given().spec(requestSpec).when().${method}("${path2}");`);
+      lines.push(`        given().spec(requestSpec).when()${restAssuredCall(method, `"${path2}"`)};`);
     }
     return lines;
   }
@@ -3318,7 +3371,7 @@ ${lines.join("\n")}
       }
     }
     lines.push(`        .when()`);
-    lines.push(`            .${method}(${javaPath})`);
+    lines.push(`            ${restAssuredCall(method, javaPath)}`);
     lines.push(`        .then()`);
     const parsed = parsePostScript(req.postRequestScript);
     if (parsed.assertions.length > 0) {
@@ -3374,7 +3427,7 @@ ${methods.join("\n\n")}
 }
 function buildReadme$1(collectionName, filePaths) {
   const tree = renderTree(filePaths);
-  return `# ${collectionName} — API Tests (REST Assured + JUnit 5)
+  return `# ${collectionName} - API Tests (REST Assured + JUnit 5)
 
 ## Project structure
 
@@ -3774,10 +3827,10 @@ ${scenarios.join("\n\n")}
 }
 function buildReadme(collectionName, filePaths) {
   const tree = renderTree(filePaths);
-  return `# ${collectionName} — API Tests (Karate + JUnit 5)
+  return `# ${collectionName} - API Tests (Karate + JUnit 5)
 
 Karate is a BDD-flavoured API test framework that uses Gherkin feature files
-(no glue code) — see https://docs.karatelabs.io for the full reference.
+(no glue code) - see https://docs.karatelabs.io for the full reference.
 
 ## Project structure
 
@@ -3982,17 +4035,17 @@ const sleep = (ms) => new Promise((resolve2) => setTimeout(resolve2, ms));
 function registerRunnerHandler(ipc) {
   handle.handleIpc(ipc, handle.IPC.runner.start, async (event, payload) => {
     const { items, environment, globals: payloadGlobals, proxy, tls, piiMaskPatterns = [], requestDelay = 0 } = payload;
-    const envVars = await authBuilder.buildEnvVars(environment);
-    const liveGlobals = requestCollection.getGlobals();
+    const envVars = await requestExec.buildEnvVars(environment);
+    const liveGlobals = requestExec.getGlobals();
     const globals = { ...payloadGlobals, ...liveGlobals };
-    const dispatcher = await requestCollection.buildDispatcher(proxy, tls);
+    const dispatcher = await requestExec.buildDispatcher(proxy, tls);
     const summary = { total: items.length, passed: 0, failed: 0, errors: 0, skipped: 0, durationMs: 0 };
     const totalStart = Date.now();
     let runEnvVars = { ...envVars };
     let runCollectionVars = {};
     let runGlobals = { ...globals };
     let runLocalVars = {};
-    const skipTracker = new requestCollection.HookSkipTracker();
+    const skipTracker = new requestExec.HookSkipTracker();
     for (const item of items) {
       const skipReason = skipTracker.shouldSkip(item);
       if (skipReason) {
@@ -4022,7 +4075,7 @@ function registerRunnerHandler(ipc) {
         scopePath: item.scopePath
       };
       event.sender.send(handle.IPC.runner.progress, { requestId: item.request.id, ...runningUpdate });
-      const { result, updatedEnvVars, updatedCollectionVars, updatedGlobals, updatedLocalVars } = await requestCollection.executeRunnerRequest({
+      const { result, updatedEnvVars, updatedCollectionVars, updatedGlobals, updatedLocalVars } = await requestExec.executeRunnerRequest({
         req: item.request,
         collectionVars: { ...item.collectionVars, ...runCollectionVars },
         envVars: runEnvVars,
@@ -4089,14 +4142,14 @@ function registerOAuth2Handlers(ipc) {
   handle.handleIpc(ipc, handle.IPC.oauth2.startFlow, async (_e, auth, vars) => {
     const port = auth.oauth2RedirectPort ?? 9876;
     const redirectUri = `http://localhost:${port}/callback`;
-    const authUrl = authBuilder.interpolate(auth.oauth2AuthUrl ?? "", vars);
-    const tokenUrl = authBuilder.interpolate(auth.oauth2TokenUrl ?? "", vars);
-    const clientId = authBuilder.interpolate(auth.oauth2ClientId ?? "", vars);
+    const authUrl = requestExec.interpolate(auth.oauth2AuthUrl ?? "", vars);
+    const tokenUrl = requestExec.interpolate(auth.oauth2TokenUrl ?? "", vars);
+    const clientId = requestExec.interpolate(auth.oauth2ClientId ?? "", vars);
     let clientSecret = auth.oauth2ClientSecret ?? "";
     if (!clientSecret && auth.oauth2ClientSecretRef) {
-      clientSecret = await authBuilder.getSecret(auth.oauth2ClientSecretRef) ?? "";
+      clientSecret = await requestExec.getSecret(auth.oauth2ClientSecretRef) ?? "";
     }
-    clientSecret = authBuilder.interpolate(clientSecret, vars);
+    clientSecret = requestExec.interpolate(clientSecret, vars);
     if (!authUrl) throw new Error("OAuth 2.0: authUrl is required for authorization_code flow.");
     if (!tokenUrl) throw new Error("OAuth 2.0: tokenUrl is required for authorization_code flow.");
     if (!clientId) throw new Error("OAuth 2.0: clientId is required.");
@@ -4171,13 +4224,13 @@ function registerOAuth2Handlers(ipc) {
     };
   });
   handle.handleIpc(ipc, handle.IPC.oauth2.refreshToken, async (_e, auth, vars, refreshToken) => {
-    const tokenUrl = authBuilder.interpolate(auth.oauth2TokenUrl ?? "", vars);
-    const clientId = authBuilder.interpolate(auth.oauth2ClientId ?? "", vars);
+    const tokenUrl = requestExec.interpolate(auth.oauth2TokenUrl ?? "", vars);
+    const clientId = requestExec.interpolate(auth.oauth2ClientId ?? "", vars);
     let clientSecret = auth.oauth2ClientSecret ?? "";
     if (!clientSecret && auth.oauth2ClientSecretRef) {
-      clientSecret = await authBuilder.getSecret(auth.oauth2ClientSecretRef) ?? "";
+      clientSecret = await requestExec.getSecret(auth.oauth2ClientSecretRef) ?? "";
     }
-    clientSecret = authBuilder.interpolate(clientSecret, vars);
+    clientSecret = requestExec.interpolate(clientSecret, vars);
     if (!tokenUrl) throw new Error("OAuth 2.0: tokenUrl is required for refresh.");
     const { fetch: nodeFetch } = await import("undici");
     const params = new URLSearchParams();
@@ -4585,7 +4638,7 @@ function inferSchemaFromJson(json) {
 }
 async function resolveSnapshotSpec(relPath) {
   const dir = getWorkspaceDir();
-  if (!dir) throw new Error("No workspace open — cannot resolve snapshot.");
+  if (!dir) throw new Error("No workspace open - cannot resolve snapshot.");
   const snap = await snapshots.loadSnapshot(dir, relPath);
   const tmp = path.join(os.tmpdir(), `api-spector-${crypto.randomUUID()}.${snap.format === "yaml" ? "yaml" : "json"}`);
   await promises.writeFile(tmp, snap.spec, "utf8");
@@ -4605,7 +4658,7 @@ function registerContractHandlers(ipc) {
       case "consumer":
         return snapshots.runConsumerContracts(requests, envVars, collectionVars);
       case "provider":
-        return snapshots.runProviderVerification(requests, envVars, specUrl, specPath, requestBaseUrl);
+        return snapshots.runProviderVerification(requests, envVars, collectionVars, specUrl, specPath, requestBaseUrl);
       case "provider-live":
         return snapshots.runLiveProviderVerification(requests, envVars, collectionVars, providerBaseUrl, stateHandlerUrl);
       case "bidirectional":
@@ -4628,7 +4681,7 @@ function registerContractHandlers(ipc) {
   });
   handle.handleIpc(ipc, handle.IPC.contract.captureSnapshot, async (_e, opts) => {
     const dir = getWorkspaceDir();
-    if (!dir) throw new Error("No workspace open — cannot capture snapshot.");
+    if (!dir) throw new Error("No workspace open - cannot capture snapshot.");
     const snapshot = await snapshots.captureSnapshot(dir, opts);
     const relPath = snapshots.relPathOf(snapshot);
     if (!relPath) throw new Error("Snapshot created but relPath was not attached.");
@@ -4649,6 +4702,24 @@ function registerContractHandlers(ipc) {
     if (!dir) return;
     await snapshots.deleteSnapshot(dir, relPath);
   });
+  handle.handleIpc(ipc, handle.IPC.contract.fuzz, async (_e, payload) => {
+    let { specUrl, specPath } = payload;
+    if (payload.specSnapshotRelPath) {
+      const resolved = await resolveSnapshotSpec(payload.specSnapshotRelPath);
+      specPath = resolved.specPath;
+      specUrl = void 0;
+    }
+    return snapshots.runFuzz({ ...payload, specUrl, specPath });
+  });
+  handle.handleIpc(ipc, handle.IPC.contract.recordResult, async (_e, opts) => {
+    const dir = getWorkspaceDir();
+    if (!dir) throw new Error("No workspace open — cannot record result.");
+    const pacticipant = opts.pacticipant?.trim();
+    const version = opts.version?.trim();
+    if (!pacticipant || !version) throw new Error("Pacticipant and version are required.");
+    const file = await snapshots.recordResult(dir, pacticipant, version, opts.report, (/* @__PURE__ */ new Date()).toISOString());
+    return { file };
+  });
 }
 function git() {
   const dir = getWorkspaceDir();
@@ -4930,10 +5001,10 @@ function createWindow() {
 }
 electron.app.whenReady().then(async () => {
   if (process.platform !== "darwin") electron.Menu.setApplicationMenu(null);
-  await authBuilder.initSecretStore(electron.app.getPath("userData"));
+  await requestExec.initSecretStore(electron.app.getPath("userData"));
   registerFileHandlers(electron.ipcMain);
   registerRequestHandler(electron.ipcMain);
-  authBuilder.registerSecretHandlers(electron.ipcMain);
+  requestExec.registerSecretHandlers(electron.ipcMain);
   registerImportHandlers(electron.ipcMain);
   registerGenerateHandlers(electron.ipcMain);
   registerRunnerHandler(electron.ipcMain);