@testsmith/api-spector 0.6.0 → 0.6.2

package/out/main/index.js

@@ -22,18 +22,19 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 const electron = require("electron");
-const handle = require("./chunks/handle-BFaeFA0A.js");
+const handle = require("./chunks/handle-CL-nWtYA.js");
 const path = require("path");
 const fs$1 = require("fs");
 const promises = require("fs/promises");
 const crypto = require("crypto");
 const JSZip = require("jszip");
-const requestExec = require("./chunks/request-exec-5_3279w1.js");
+const dataFiles = require("./chunks/data-files-Br2h3Dt2.js");
+const requestExec = require("./chunks/request-exec-DAFA6Fap.js");
 const ipcValidate = require("./chunks/ipc-validate-sqUFqRmE.js");
 const uuid = require("uuid");
 const jsYaml = require("js-yaml");
 const undici = require("undici");
-const requestCollection = require("./chunks/request-collection-BQIo1765.js");
+const requestCollection = require("./chunks/request-collection-Hqh3I3rs.js");
 const mockServer = require("./chunks/mock-server-BxiXhP1m.js");
 const http = require("http");
 const WebSocket = require("ws");
@@ -42,10 +43,11 @@ const os = require("node:os");
 const path$1 = require("node:path");
 const grpc = require("@grpc/grpc-js");
 const protoLoader = require("@grpc/proto-loader");
-const soapHandler = require("./chunks/soap-handler-CWn3o6Py.js");
+const soapHandler = require("./chunks/soap-handler-BAPCALkN.js");
+const escape = require("./chunks/escape-BwPM4Tf6.js");
 const promises$1 = require("node:fs/promises");
 const os$1 = require("os");
-const snapshots = require("./chunks/snapshots-Y33M1SEy.js");
+const brokerClient = require("./chunks/broker-client-WEymdqAK.js");
 const simpleGit = require("simple-git");
 const recorder = require("./chunks/recorder-0Ij921El.js");
 require("tls");
@@ -332,14 +334,16 @@ Create a workspace in this folder and add "${path.basename(wsPath)}" to it? The
   });
   handle.handleIpc(ipc, handle.IPC.file.loadCollection, async (_e, relPath) => {
     if (!workspaceDir) throw new Error("No workspace open");
-    const raw = await promises.readFile(path.resolve(workspaceDir, relPath), "utf8");
-    return JSON.parse(raw);
+    const fullPath = path.resolve(workspaceDir, relPath);
+    const raw = await promises.readFile(fullPath, "utf8");
+    return dataFiles.inlineDataSets(JSON.parse(raw), path.dirname(fullPath));
   });
   handle.handleIpc(ipc, handle.IPC.file.saveCollection, async (_e, relPath, col) => {
     if (!workspaceDir) throw new Error("No workspace open");
     const fullPath = path.resolve(workspaceDir, relPath);
     await promises.mkdir(path.dirname(fullPath), { recursive: true });
-    await atomicWrite(fullPath, JSON.stringify(col, null, 2));
+    const toWrite = await dataFiles.externalizeDataSets(col, path.dirname(fullPath));
+    await atomicWrite(fullPath, JSON.stringify(toWrite, null, 2));
   });
   handle.handleIpc(ipc, handle.IPC.file.loadEnvironment, async (_e, relPath) => {
     if (!workspaceDir) throw new Error("No workspace open");
@@ -942,6 +946,77 @@ function registerRequestHandler(ipc) {
     };
   });
 }
+const AI_OPENAI_TOKEN_REF = "ai:openai:token";
+const DEFAULT_AI_MODEL = "gpt-4o-mini";
+const OPENAI_URL = "https://api.openai.com/v1/chat/completions";
+function systemPrompt(level) {
+  return [
+    "You write clear, concise API documentation in GitHub-flavored Markdown.",
+    `You are documenting an API ${level}.`,
+    "Return ONLY markdown — no preamble, no code fences around the whole answer.",
+    "Use short paragraphs and headings. Describe purpose, key parameters, request/response shape,",
+    "auth if relevant, and any gotchas. Do not invent endpoints or fields that are not in the context.",
+    "Keep it practical for a developer who will call this API."
+  ].join(" ");
+}
+function registerAiHandlers(ipc) {
+  handle.handleIpc(ipc, handle.IPC.ai.generateDocs, async (_e, input) => {
+    const token = await requestExec.getSecret(AI_OPENAI_TOKEN_REF);
+    if (!token) {
+      throw new Error("No OpenAI API key configured. Add one in Settings → AI.");
+    }
+    const model = input.model?.trim() || DEFAULT_AI_MODEL;
+    const userParts = [
+      `Name: ${input.name}`,
+      "",
+      input.context
+    ];
+    if (input.existing?.trim()) {
+      userParts.push("", "Existing documentation to refine and expand (keep what is still accurate):", input.existing.trim());
+    }
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 6e4);
+    try {
+      const res = await fetch(OPENAI_URL, {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          authorization: `Bearer ${token}`
+        },
+        body: JSON.stringify({
+          model,
+          temperature: 0.3,
+          messages: [
+            { role: "system", content: systemPrompt(input.level) },
+            { role: "user", content: userParts.join("\n") }
+          ]
+        }),
+        signal: controller.signal,
+        // @ts-expect-error undici accepts a dispatcher for proxy/TLS support
+        dispatcher: await requestExec.buildDispatcher(void 0, void 0)
+      });
+      if (!res.ok) {
+        let detail = `HTTP ${res.status}`;
+        try {
+          const body = await res.json();
+          if (body?.error?.message) detail = body.error.message;
+        } catch {
+        }
+        if (res.status === 401) detail = "OpenAI rejected the API key (401). Check the key in Settings → AI.";
+        throw new Error(`Doc generation failed: ${detail}`);
+      }
+      const data = await res.json();
+      const content = data.choices?.[0]?.message?.content?.trim();
+      if (!content) throw new Error("The model returned an empty response.");
+      return content;
+    } catch (e) {
+      if (e instanceof Error && e.name === "AbortError") throw new Error("Doc generation timed out after 60s.");
+      throw e;
+    } finally {
+      clearTimeout(timeout);
+    }
+  });
+}
 const POSTMAN_RULES = [
   // Variables — environment
   [/\bpm\.environment\.get\(/g, "sp.environment.get("],
@@ -1433,6 +1508,10 @@ function buildCollection(spec) {
   const globalSecurity = spec.security ?? [];
   const requests = {};
   const foldersByTag = {};
+  const tagDescriptions = {};
+  for (const tg of spec.tags ?? []) {
+    if (tg?.name && tg.description) tagDescriptions[tg.name] = tg.description;
+  }
   for (const [pathStr, pathItem] of Object.entries(spec.paths ?? {})) {
     const resolved = resolve(spec, pathItem);
     const pathLevelParams = resolved.parameters ?? [];
@@ -1462,14 +1541,14 @@ function buildCollection(spec) {
         params,
         auth: buildAuth(security, securitySchemes),
         body,
-        description: operation.description ?? "",
+        description: operation.description || operation.summary || "",
         meta: { tags },
         ...responseSchema ? { schema: responseSchema } : {},
         ...examples ? { examples } : {}
       };
       requests[req.id] = req;
       if (!foldersByTag[tag]) {
-        foldersByTag[tag] = { id: uuid.v4(), name: tag, description: "", folders: [], requestIds: [] };
+        foldersByTag[tag] = { id: uuid.v4(), name: tag, description: tagDescriptions[tag] ?? "", folders: [], requestIds: [] };
       }
       foldersByTag[tag].requestIds.push(req.id);
     }
@@ -1744,7 +1823,8 @@ function parseBruFile(content, fileName) {
     params,
     auth,
     body,
-    description: "",
+    // Bruno keeps request documentation in a `docs { ... }` block (markdown).
+    description: extractBlock(content, "docs")?.trim() ?? "",
     preRequestScript: extractBlock(content, "script:pre-request") ? translateScript(extractBlock(content, "script:pre-request").trim(), "bruno") || void 0 : void 0,
     postRequestScript: extractBlock(content, "script:post-response") ? translateScript(extractBlock(content, "script:post-response").trim(), "bruno") || void 0 : void 0,
     meta: { seq: meta["seq"] !== void 0 ? Number(meta["seq"]) : 0 }
@@ -4631,7 +4711,9 @@ function registerRunnerHandler(ipc) {
         dispatcher,
         piiMaskPatterns,
         proxy,
-        tls
+        tls,
+        expectStatus: item.expectStatus,
+        owaspTag: item.owaspTag
       });
       runEnvVars = updatedEnvVars;
       runCollectionVars = updatedCollectionVars;
@@ -5251,9 +5333,7 @@ function generateMarkdown(payload) {
   }
   return lines.join("\n");
 }
-function escHtml(s) {
-  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
-}
+const escHtml = escape.escapeHtml;
 const METHOD_COLORS = {
   GET: "#34d399",
   POST: "#60a5fa",
@@ -5443,7 +5523,7 @@ function inferSchemaFromJson(json) {
 async function resolveSnapshotSpec(relPath) {
   const dir = getWorkspaceDir();
   if (!dir) throw new Error("No workspace open - cannot resolve snapshot.");
-  const snap = await snapshots.loadSnapshot(dir, relPath);
+  const snap = await brokerClient.loadSnapshot(dir, relPath);
   const tmp = path.join(os$1.tmpdir(), `api-spector-${crypto.randomUUID()}.${snap.format === "yaml" ? "yaml" : "json"}`);
   await promises.writeFile(tmp, snap.spec, "utf8");
   return { specPath: tmp };
@@ -5455,7 +5535,7 @@ function registerContractHandlers(ipc) {
     let requests = payload.requests;
     let { specUrl, specPath } = payload;
     if (mode !== "provider") {
-      const designReqs = await snapshots.loadDesignContractRequests(
+      const designReqs = await brokerClient.loadDesignContractRequests(
         { designContracts: payload.designContracts },
         getWorkspaceDir() ?? void 0
       );
@@ -5476,13 +5556,13 @@ function registerContractHandlers(ipc) {
     }
     switch (mode) {
       case "consumer":
-        return snapshots.runConsumerContracts(requests, envVars, collectionVars, providerBaseUrl);
+        return brokerClient.runConsumerContracts(requests, envVars, collectionVars, providerBaseUrl);
       case "provider":
-        return snapshots.runProviderVerification(requests, envVars, collectionVars, specUrl, specPath, requestBaseUrl);
+        return brokerClient.runProviderVerification(requests, envVars, collectionVars, specUrl, specPath, requestBaseUrl);
       case "provider-live":
-        return snapshots.runLiveProviderVerification(requests, envVars, collectionVars, providerBaseUrl, stateHandlerUrl);
+        return brokerClient.runLiveProviderVerification(requests, envVars, collectionVars, providerBaseUrl, stateHandlerUrl);
       case "bidirectional":
-        return snapshots.runBidirectional(requests, envVars, collectionVars, specUrl, specPath, requestBaseUrl);
+        return brokerClient.runBidirectional(requests, envVars, collectionVars, specUrl, specPath, requestBaseUrl);
     }
   });
   handle.handleIpc(ipc, handle.IPC.contract.inferSchema, (_e, jsonBody) => {
@@ -5496,7 +5576,7 @@ function registerContractHandlers(ipc) {
       filters: [{ name: "HTML", extensions: ["html"] }]
     });
     if (canceled || !filePath) return false;
-    await promises.writeFile(filePath, snapshots.reportToHtml(report, { generatedAt: (/* @__PURE__ */ new Date()).toISOString(), ...meta }), "utf8");
+    await promises.writeFile(filePath, brokerClient.reportToHtml(report, { generatedAt: (/* @__PURE__ */ new Date()).toISOString(), ...meta }), "utf8");
     return true;
   });
   handle.handleIpc(ipc, handle.IPC.contract.exportDesignPact, async (_e, contract) => {
@@ -5506,31 +5586,31 @@ function registerContractHandlers(ipc) {
     const relPath = path.join("pacts", `${safe(contract.consumer)}-${safe(contract.provider)}.pact.json`);
     const fullPath = path.join(dir, relPath);
     await promises.mkdir(path.join(dir, "pacts"), { recursive: true });
-    await promises.writeFile(fullPath, JSON.stringify(snapshots.designContractToPact(contract), null, 2), "utf8");
+    await promises.writeFile(fullPath, JSON.stringify(brokerClient.designContractToPact(contract), null, 2), "utf8");
     return relPath;
   });
   handle.handleIpc(ipc, handle.IPC.contract.captureSnapshot, async (_e, opts) => {
     const dir = getWorkspaceDir();
     if (!dir) throw new Error("No workspace open - cannot capture snapshot.");
-    const snapshot = await snapshots.captureSnapshot(dir, opts);
-    const relPath = snapshots.relPathOf(snapshot);
+    const snapshot = await brokerClient.captureSnapshot(dir, opts);
+    const relPath = brokerClient.relPathOf(snapshot);
     if (!relPath) throw new Error("Snapshot created but relPath was not attached.");
     return { relPath, snapshot };
   });
   handle.handleIpc(ipc, handle.IPC.contract.listSnapshots, async (_e, registered = []) => {
     const dir = getWorkspaceDir();
     if (!dir) return [];
-    return snapshots.listSnapshots(dir, registered);
+    return brokerClient.listSnapshots(dir, registered);
   });
   handle.handleIpc(ipc, handle.IPC.contract.loadSnapshot, async (_e, relPath) => {
     const dir = getWorkspaceDir();
     if (!dir) throw new Error("No workspace open.");
-    return snapshots.loadSnapshot(dir, relPath);
+    return brokerClient.loadSnapshot(dir, relPath);
   });
   handle.handleIpc(ipc, handle.IPC.contract.deleteSnapshot, async (_e, relPath) => {
     const dir = getWorkspaceDir();
     if (!dir) return;
-    await snapshots.deleteSnapshot(dir, relPath);
+    await brokerClient.deleteSnapshot(dir, relPath);
   });
   handle.handleIpc(ipc, handle.IPC.contract.fuzz, async (_e, payload) => {
     let { specUrl, specPath } = payload;
@@ -5539,7 +5619,7 @@ function registerContractHandlers(ipc) {
       specPath = resolved.specPath;
       specUrl = void 0;
     }
-    return snapshots.runFuzz({ ...payload, specUrl, specPath });
+    return brokerClient.runFuzz({ ...payload, specUrl, specPath });
   });
   handle.handleIpc(ipc, handle.IPC.contract.recordResult, async (_e, opts) => {
     const dir = getWorkspaceDir();
@@ -5547,7 +5627,7 @@ function registerContractHandlers(ipc) {
     const pacticipant = opts.pacticipant?.trim();
     const version = opts.version?.trim();
     if (!pacticipant || !version) throw new Error("Pacticipant and version are required.");
-    const file = await snapshots.recordResult(dir, pacticipant, version, opts.report, (/* @__PURE__ */ new Date()).toISOString());
+    const file = await brokerClient.recordResult(dir, pacticipant, version, opts.report, (/* @__PURE__ */ new Date()).toISOString());
     return { file };
   });
 }
@@ -5598,6 +5678,17 @@ function registerGitHandlers(ipc) {
   handle.handleIpc(ipc, handle.IPC.git.markResolved, async (_e, filePath) => {
     await git().add([filePath]);
   });
+  handle.handleIpc(ipc, handle.IPC.git.readConflict, async (_e, filePath) => {
+    const dir = getWorkspaceDir();
+    if (!dir) throw new Error("No workspace open");
+    return promises.readFile(path.join(dir, filePath), "utf8");
+  });
+  handle.handleIpc(ipc, handle.IPC.git.writeResolved, async (_e, filePath, content) => {
+    const dir = getWorkspaceDir();
+    if (!dir) throw new Error("No workspace open");
+    await promises.writeFile(path.join(dir, filePath), content, "utf8");
+    await git().add([filePath]);
+  });
   handle.handleIpc(ipc, handle.IPC.git.diff, async (_e, filePath) => {
     if (filePath) return git().diff(["--", filePath]);
     return git().diff();
@@ -5683,8 +5774,11 @@ function registerGitHandlers(ipc) {
   handle.handleIpc(ipc, handle.IPC.git.deleteBranch, async (_e, name, force = false) => {
     await git().deleteLocalBranch(name, force);
   });
-  handle.handleIpc(ipc, handle.IPC.git.pull, async () => {
-    await git().pull();
+  handle.handleIpc(ipc, handle.IPC.git.fetch, async () => {
+    await git().fetch(["--prune"]);
+  });
+  handle.handleIpc(ipc, handle.IPC.git.pull, async (_e, rebase = false) => {
+    await git().raw(["pull", ...rebase ? ["--rebase"] : []]);
   });
   handle.handleIpc(ipc, handle.IPC.git.push, async (_e, setUpstream) => {
     if (setUpstream) {
@@ -5744,7 +5838,7 @@ function registerRecordHandlers(ipc, getWebContents) {
   });
 }
 const CLOUD_TOKEN_REF = "cloud:token";
-const CLOUD_ENDPOINT = (process.env["API_SPECTOR_CLOUD_ENDPOINT"] || "https://api-spector.dev").replace(/\/+$/, "");
+const CLOUD_ENDPOINT = brokerClient.resolveCloudEndpoint();
 async function cloudFetch(path2, method, body) {
   const token = await requestExec.getSecret(CLOUD_TOKEN_REF);
   if (!token) throw new Error("No cloud API token set. Add one in Settings → Cloud.");
@@ -5871,7 +5965,7 @@ function registerCloudHandlers(ipc) {
     return cloudFetch("/api/mocks/" + encodeURIComponent(slugify(name)), "GET");
   });
   handle.handleIpc(ipc, handle.IPC.cloud.pushPact, async (_e, input) => {
-    const pact = snapshots.exportPact(input.consumer, input.provider, input.requests ?? []);
+    const pact = brokerClient.exportPact(input.consumer, input.provider, input.requests ?? []);
     return cloudFetch("/api/contracts", "PUT", {
       consumer: input.consumer,
       consumerVersion: input.consumerVersion,
@@ -5880,7 +5974,7 @@ function registerCloudHandlers(ipc) {
     });
   });
   handle.handleIpc(ipc, handle.IPC.cloud.pushDesignContract, async (_e, input) => {
-    const pact = snapshots.designContractToPact(input.contract);
+    const pact = brokerClient.designContractToPact(input.contract);
     return cloudFetch("/api/contracts", "PUT", {
       consumer: input.contract.consumer,
       consumerVersion: input.consumerVersion,
@@ -5945,7 +6039,7 @@ function isNewer(a, b) {
   return a2 > b2;
 }
 async function checkForUpdate() {
-  const current = "0.6.0";
+  const current = "0.6.2";
   try {
     const res = await fetch(REGISTRY_URL, { signal: AbortSignal.timeout(4e3) });
     if (!res.ok) return null;
@@ -6124,6 +6218,7 @@ electron.app.whenReady().then(async () => {
   registerFileHandlers(electron.ipcMain);
   registerRequestHandler(electron.ipcMain);
   requestExec.registerSecretHandlers(electron.ipcMain);
+  registerAiHandlers(electron.ipcMain);
   registerImportHandlers(electron.ipcMain);
   registerGenerateHandlers(electron.ipcMain);
   registerRunnerHandler(electron.ipcMain);

package/out/main/lib.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const mockServer = require("./chunks/mock-server-BxiXhP1m.js");
-const requestExec = require("./chunks/request-exec-5_3279w1.js");
+const requestExec = require("./chunks/request-exec-DAFA6Fap.js");
 require("http");
 require("crypto");
 require("vm");
@@ -10,7 +10,7 @@ require("@xmldom/xmldom");
 require("undici");
 require("fs/promises");
 require("tls");
-require("./chunks/handle-BFaeFA0A.js");
+require("./chunks/handle-CL-nWtYA.js");
 require("node:fs");
 require("node:os");
 require("node:path");

package/out/main/mock.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 "use strict";
 const mockServer = require("./chunks/mock-server-BxiXhP1m.js");
-const cliCommon = require("./chunks/cli-common-BKYgsbGB.js");
+const cliCommon = require("./chunks/cli-common-vASoDfQH.js");
 require("http");
 require("crypto");
 require("vm");
@@ -9,6 +9,7 @@ require("dayjs");
 require("@xmldom/xmldom");
 require("fs/promises");
 require("path");
+require("./chunks/data-files-Br2h3Dt2.js");
 async function main() {
   const args = cliCommon.parseArgs(process.argv.slice(2), ["name"]);
   if (args.help) {

package/out/main/record.js

@@ -3,10 +3,11 @@
 const promises = require("fs/promises");
 const path = require("path");
 const recorder = require("./chunks/recorder-0Ij921El.js");
-const cliCommon = require("./chunks/cli-common-BKYgsbGB.js");
+const cliCommon = require("./chunks/cli-common-vASoDfQH.js");
 require("http");
 require("crypto");
 require("undici");
+require("./chunks/data-files-Br2h3Dt2.js");
 function methodBadge(method) {
   const m = method.toUpperCase();
   const c = m === "GET" ? cliCommon.C.green : m === "POST" ? cliCommon.C.cyan : m === "PUT" || m === "PATCH" ? cliCommon.C.yellow : m === "DELETE" ? cliCommon.C.red : cliCommon.C.white;

package/out/main/runner.js

@@ -2,13 +2,14 @@
 "use strict";
 const promises = require("fs/promises");
 const path = require("path");
-const requestExec = require("./chunks/request-exec-5_3279w1.js");
-const requestCollection = require("./chunks/request-collection-BQIo1765.js");
+const requestExec = require("./chunks/request-exec-DAFA6Fap.js");
+const escape = require("./chunks/escape-BwPM4Tf6.js");
+const requestCollection = require("./chunks/request-collection-Hqh3I3rs.js");
 const environments = require("./chunks/environments-iM3SUM-4.js");
-const cliCommon = require("./chunks/cli-common-BKYgsbGB.js");
+const cliCommon = require("./chunks/cli-common-vASoDfQH.js");
 require("undici");
 require("tls");
-require("./chunks/handle-BFaeFA0A.js");
+require("./chunks/handle-CL-nWtYA.js");
 require("node:fs");
 require("node:os");
 require("node:path");
@@ -22,6 +23,7 @@ require("@xmldom/xmldom");
 require("http");
 require("ajv");
 require("uuid");
+require("./chunks/data-files-Br2h3Dt2.js");
 function buildJsonReport(results, summary, meta = {}) {
   return JSON.stringify({
     timestamp: meta.timestamp ?? (/* @__PURE__ */ new Date()).toISOString(),
@@ -50,7 +52,7 @@ function buildJsonReport(results, summary, meta = {}) {
   }, null, 2);
 }
 function buildHtmlReport(results, summary, meta = {}) {
-  const esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+  const esc = escape.escapeHtml;
   function prettyJson(s) {
     try {
       return esc(JSON.stringify(JSON.parse(s), null, 2));
@@ -295,7 +297,7 @@ function buildHtmlReport(results, summary, meta = {}) {
 `;
 }
 function buildJUnitReport(results, summary, meta = {}) {
-  const esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+  const esc = escape.escapeHtml;
   const suiteName = esc(meta.collection ?? "API Tests");
   const totalSec = (summary.durationMs / 1e3).toFixed(3);
   const ts = meta.timestamp ?? (/* @__PURE__ */ new Date()).toISOString();
@@ -345,6 +347,70 @@ ${failures.join("\n")}
   ];
   return lines.join("\n") + "\n";
 }
+const OWASP_BY_TAG = {
+  BOLA: { id: "API1:2023", name: "Broken Object Level Authorization", ref: "https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/" },
+  AUTH: { id: "API2:2023", name: "Broken Authentication", ref: "https://owasp.org/API-Security/editions/2023/en/0xa2-broken-authentication/" },
+  "MASS-ASSIGN": { id: "API3:2023", name: "Broken Object Property Level Authorization", ref: "https://owasp.org/API-Security/editions/2023/en/0xa3-broken-object-property-level-authorization/" },
+  RESOURCE: { id: "API4:2023", name: "Unrestricted Resource Consumption", ref: "https://owasp.org/API-Security/editions/2023/en/0xa4-unrestricted-resource-consumption/" },
+  "FUNC-AUTH": { id: "API5:2023", name: "Broken Function Level Authorization", ref: "https://owasp.org/API-Security/editions/2023/en/0xa5-broken-function-level-authorization/" },
+  "BIZ-FLOW": { id: "API6:2023", name: "Unrestricted Access to Sensitive Business Flows", ref: "https://owasp.org/API-Security/editions/2023/en/0xa6-unrestricted-access-to-sensitive-business-flows/" },
+  SSRF: { id: "API7:2023", name: "Server Side Request Forgery", ref: "https://owasp.org/API-Security/editions/2023/en/0xa7-server-side-request-forgery/" },
+  CONFIG: { id: "API8:2023", name: "Security Misconfiguration", ref: "https://owasp.org/API-Security/editions/2023/en/0xa8-security-misconfiguration/" },
+  INVENTORY: { id: "API9:2023", name: "Improper Inventory Management", ref: "https://owasp.org/API-Security/editions/2023/en/0xa9-improper-inventory-management/" },
+  INJECTION: { id: "API10:2023", name: "Unsafe Consumption of APIs", ref: "https://owasp.org/API-Security/editions/2023/en/0xaa-unsafe-consumption-of-apis/" }
+};
+function owaspRuleForName(name) {
+  const m = /^\s*\[([A-Za-z-]+)\]/.exec(name ?? "");
+  return m ? OWASP_BY_TAG[m[1].toUpperCase()] ?? null : null;
+}
+function buildSarifReport(results, _summary, meta = {}) {
+  const rules = /* @__PURE__ */ new Map();
+  const addRule = (id, name, helpUri) => {
+    if (!rules.has(id)) rules.set(id, { id, name, ...helpUri ? { helpUri } : {} });
+  };
+  const sarifResults = [];
+  const emit = (rule, fallbackId, fallbackName, r, message) => {
+    const id = rule ? rule.id : fallbackId;
+    const name = rule ? rule.name : fallbackName;
+    addRule(id, name, rule?.ref);
+    sarifResults.push({
+      ruleId: id,
+      level: "error",
+      message: { text: `${r.method} ${r.resolvedUrl}${r.iterationLabel ? ` #${r.iterationLabel}` : ""} — ${message}` },
+      locations: [{ physicalLocation: { artifactLocation: { uri: r.resolvedUrl || r.name } } }]
+    });
+  };
+  for (const r of results) {
+    if (r.status === "error" && r.error) emit(owaspRuleForName(r.name), "request-error", "Request error", r, r.error);
+    if (r.preScriptError) emit(null, "pre-script-error", "Pre-request script error", r, r.preScriptError);
+    if (r.postScriptError) emit(null, "post-script-error", "Post-request script error", r, r.postScriptError);
+    for (const t of r.testResults ?? []) {
+      if (t.passed) continue;
+      const rule = owaspRuleForName(t.name) ?? owaspRuleForName(r.name);
+      emit(rule, "assertion-failed", "Assertion failed", r, `${t.name}${t.error ? `: ${t.error}` : ""}`);
+    }
+  }
+  return JSON.stringify({
+    version: "2.1.0",
+    $schema: "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+    runs: [{
+      tool: {
+        driver: {
+          name: "API Spector",
+          informationUri: "https://github.com/testsmith-io/api-spector",
+          rules: [...rules.values()].map((r) => ({
+            id: r.id,
+            name: r.name,
+            shortDescription: { text: r.name },
+            ...r.helpUri ? { helpUri: r.helpUri } : {}
+          }))
+        }
+      },
+      ...meta.timestamp ? { invocations: [{ executionSuccessful: sarifResults.length === 0, endTimeUtc: meta.timestamp }] } : {},
+      results: sarifResults
+    }]
+  }, null, 2);
+}
 function printResult(r, verbose) {
   const icon = r.status === "passed" ? cliCommon.color("✓", cliCommon.C.green, cliCommon.C.bold) : r.status === "failed" ? cliCommon.color("✗", cliCommon.C.red, cliCommon.C.bold) : r.status === "skipped" ? cliCommon.color("○", cliCommon.C.gray, cliCommon.C.bold) : cliCommon.color("⚠", cliCommon.C.yellow, cliCommon.C.bold);
   const http = r.httpStatus ? cliCommon.color(` ${r.httpStatus}`, r.httpStatus < 400 ? cliCommon.C.green : cliCommon.C.red) : "";
@@ -365,7 +431,7 @@ async function main() {
   const args = cliCommon.parseArgs(process.argv.slice(2));
   if (args.help) {
     console.log(
-      "\nUsage:\n  api-spector run --workspace <path> [--environment <name>] [--tags <a,b>]\n                  [--collection <name>] [--output <path>] [--format json|junit]\n                  [--verbose] [--bail]\n"
+      "\nUsage:\n  api-spector run --workspace <path> [--environment <name>] [--tags <a,b>]\n                  [--collection <name>] [--output <path>] [--format json|junit|html|sarif]\n                  [--verbose] [--bail]\n"
     );
     process.exit(0);
   }
@@ -380,9 +446,9 @@ async function main() {
   const verbose = Boolean(args.verbose);
   const bail = Boolean(args.bail);
   const outputPath = args.output;
-  const inferredFormat = outputPath ? path.extname(outputPath).toLowerCase() === ".xml" ? "junit" : path.extname(outputPath).toLowerCase() === ".html" ? "html" : "json" : "json";
+  const inferredFormat = outputPath ? path.extname(outputPath).toLowerCase() === ".xml" ? "junit" : path.extname(outputPath).toLowerCase() === ".html" ? "html" : path.extname(outputPath).toLowerCase() === ".sarif" ? "sarif" : "json" : "json";
   const explicitFormat = args.format?.toLowerCase();
-  const outputFormat = explicitFormat === "junit" || explicitFormat === "html" ? explicitFormat : inferredFormat;
+  const outputFormat = explicitFormat === "junit" || explicitFormat === "html" || explicitFormat === "sarif" ? explicitFormat : inferredFormat;
   let workspace, wsDir;
   try {
     ;
@@ -403,7 +469,7 @@ async function main() {
   } else if (!envName && workspace.settings?.defaultEnvironment && !env) {
     console.warn(cliCommon.color(`Warning: default environment "${workspace.settings.defaultEnvironment}" not found. Running without environment.`, cliCommon.C.yellow));
   }
-  const version = `v${"0.6.0"}`;
+  const version = `v${"0.6.2"}`;
   console.log("");
   console.log(cliCommon.color("  API Test Runner" + (version ? ` ${version}` : ""), cliCommon.C.bold, cliCommon.C.white));
   console.log(cliCommon.color(`  Workspace:   ${wsPath}`, cliCommon.C.gray));
@@ -442,7 +508,21 @@ async function main() {
   let firstColName;
   for (const col of collections) {
     if (colName && col.name.toLowerCase() !== colName.toLowerCase()) continue;
-    if (col.disabled) continue;
+    if (col.disabled) {
+      console.log(cliCommon.color(`  ┌ ${col.name}  (disabled)`, cliCommon.C.gray));
+      allResults.push({
+        requestId: col.id,
+        name: col.name,
+        method: "",
+        resolvedUrl: "",
+        status: "skipped",
+        error: "Collection disabled",
+        scopePath: []
+      });
+      summary.total++;
+      summary.skipped++;
+      continue;
+    }
     let items = requestCollection.buildRunPlan(col, null, filterTags);
     if (items.length === 0) continue;
     if (!firstColName) firstColName = col.name;
@@ -502,7 +582,9 @@ async function main() {
           dispatcher,
           piiMaskPatterns: piiPatterns,
           tls: effectiveTls,
-          onScriptOutput
+          onScriptOutput,
+          expectStatus: item.expectStatus,
+          owaspTag: item.owaspTag
         });
         result = out.result;
         runEnvVars = out.updatedEnvVars;
@@ -548,7 +630,7 @@ async function main() {
   if (outputPath) {
     const meta = { workspace: wsPath, environment: env?.name ?? null, collection: firstColName, timestamp };
     const maskedResults = allResults.map(maskResult);
-    const report = outputFormat === "junit" ? buildJUnitReport(maskedResults, summary, meta) : outputFormat === "html" ? buildHtmlReport(maskedResults, summary, meta) : buildJsonReport(maskedResults, summary, meta);
+    const report = outputFormat === "junit" ? buildJUnitReport(maskedResults, summary, meta) : outputFormat === "html" ? buildHtmlReport(maskedResults, summary, meta) : outputFormat === "sarif" ? buildSarifReport(maskedResults, summary, meta) : buildJsonReport(maskedResults, summary, meta);
     await promises.writeFile(path.resolve(outputPath), report, "utf8");
     console.log(cliCommon.color(`  Report written: ${outputPath} (${outputFormat})
 `, cliCommon.C.gray));

package/out/main/wsdl.js

@@ -4,12 +4,13 @@ const promises = require("fs/promises");
 const path = require("path");
 const https = require("https");
 const http = require("http");
-const soapHandler = require("./chunks/soap-handler-CWn3o6Py.js");
-const _import = require("./chunks/import-D9LH0isB.js");
-const cliCommon = require("./chunks/cli-common-BKYgsbGB.js");
-require("./chunks/handle-BFaeFA0A.js");
+const soapHandler = require("./chunks/soap-handler-BAPCALkN.js");
+const _import = require("./chunks/import-DdXhO56X.js");
+const cliCommon = require("./chunks/cli-common-vASoDfQH.js");
+require("./chunks/handle-CL-nWtYA.js");
 require("@xmldom/xmldom");
 require("uuid");
+require("./chunks/data-files-Br2h3Dt2.js");
 require("crypto");
 function fetchUrl(url) {
   return new Promise((resolveP, rejectP) => {