@testsmith/api-spector 0.7.8 → 0.7.9

package/out/main/chunks/{broker-client-BYpWeOWT.js → broker-client-CJBfpvbd.js}

@@ -3,7 +3,7 @@ const promises = require("node:fs/promises");
 const path = require("node:path");
 const crypto = require("node:crypto");
 const undici = require("undici");
-const requestExec = require("./request-exec-Cv2jkrO1.js");
+const requestExec = require("./request-exec-CgyqbNWk.js");
 const Ajv = require("ajv");
 const jsYaml = require("js-yaml");
 require("node:http");

package/out/main/chunks/{perf-run-uZBqnG3S.js → perf-run-Co_5unBR.js}

@@ -1,5 +1,5 @@
 "use strict";
-const requestExec = require("./request-exec-Cv2jkrO1.js");
+const requestExec = require("./request-exec-CgyqbNWk.js");
 const grpc = require("@grpc/grpc-js");
 const protoLoader = require("@grpc/proto-loader");
 const fs = require("node:fs");

package/out/main/chunks/{request-exec-Cv2jkrO1.js → request-exec-CgyqbNWk.js}

@@ -841,6 +841,10 @@ function buildUrl(baseUrl, params, vars) {
     templateTokens.add(String(name).trim());
     return "";
   });
+  baseUrl.replaceAll(/\[([A-Za-z_]\w*)\]/g, (_m, name) => {
+    templateTokens.add(String(name));
+    return "";
+  });
   const enabled = (params ?? []).filter((p) => p.enabled && p.key);
   const pathRows = [];
   const queryRows = [];
@@ -853,7 +857,8 @@ function buildUrl(baseUrl, params, vars) {
     ...vars,
     ...Object.fromEntries(pathRows.map((p) => [p.key, interpolate(p.value, vars)]))
   } : vars;
-  const url = interpolate(baseUrl, mergedVars);
+  let url = interpolate(baseUrl, mergedVars);
+  url = url.replaceAll(/\[([A-Za-z_]\w*)\]/g, (m, name) => name in mergedVars ? mergedVars[name] : m);
   if (!queryRows.length) return url;
   const sep = url.includes("?") ? "&" : "?";
   const qs = queryRows.map((p) => `${encodeURIComponent(interpolate(p.key, vars))}=${encodeURIComponent(interpolate(p.value, vars))}`).join("&");

package/out/main/contract.js

@@ -2,7 +2,7 @@
 "use strict";
 const promises = require("node:fs/promises");
 const path = require("node:path");
-const brokerClient = require("./chunks/broker-client-BYpWeOWT.js");
+const brokerClient = require("./chunks/broker-client-CJBfpvbd.js");
 const escape = require("./chunks/escape-DDVAlOvZ.js");
 const crypto = require("node:crypto");
 const undici = require("undici");
@@ -11,7 +11,7 @@ const cliCommon = require("./chunks/cli-common-GnihVSjU.js");
 const node_child_process = require("node:child_process");
 const jsYaml = require("js-yaml");
 const environments = require("./chunks/environments-iM3SUM-4.js");
-require("./chunks/request-exec-Cv2jkrO1.js");
+require("./chunks/request-exec-CgyqbNWk.js");
 require("fs/promises");
 require("tls");
 require("./chunks/handle-Crv1i9hb.js");

package/out/main/flow.js

@@ -2,7 +2,7 @@
 "use strict";
 const promises = require("node:fs/promises");
 const path = require("node:path");
-const requestExec = require("./chunks/request-exec-Cv2jkrO1.js");
+const requestExec = require("./chunks/request-exec-CgyqbNWk.js");
 const requestCollection = require("./chunks/request-collection-gkOYlWml.js");
 const environments = require("./chunks/environments-iM3SUM-4.js");
 const flowEngine = require("./chunks/flow-engine-BxwjEy37.js");
@@ -268,7 +268,7 @@ async function main() {
   const envName = args.environment ?? args.env;
   const env = environments.selectEnvironment(workspace, environments$1, envName);
   const verbose = Boolean(args.verbose);
-  const version = `v${"0.7.8"}`;
+  const version = `v${"0.7.9"}`;
   console.log("");
   console.log(cliCommon.color("  API Flow Runner" + (version ? ` ${version}` : ""), cliCommon.C.bold, cliCommon.C.white));
   console.log(cliCommon.color(`  Flow:        ${flow.name}`, cliCommon.C.gray));

package/out/main/index.js

@@ -29,7 +29,7 @@ const promises = require("node:fs/promises");
 const crypto = require("node:crypto");
 const JSZip = require("jszip");
 const dataFiles = require("./chunks/data-files-BYqhsoPe.js");
-const requestExec = require("./chunks/request-exec-Cv2jkrO1.js");
+const requestExec = require("./chunks/request-exec-CgyqbNWk.js");
 const ipcValidate = require("./chunks/ipc-validate-sqUFqRmE.js");
 const uuid = require("uuid");
 const jsYaml = require("js-yaml");
@@ -48,7 +48,7 @@ const grpc = require("@grpc/grpc-js");
 const protoLoader = require("@grpc/proto-loader");
 const soapHandler = require("./chunks/soap-handler-Brr7BPWO.js");
 const escape = require("./chunks/escape-DDVAlOvZ.js");
-const brokerClient = require("./chunks/broker-client-BYpWeOWT.js");
+const brokerClient = require("./chunks/broker-client-CJBfpvbd.js");
 const simpleGit = require("simple-git");
 const recorder = require("./chunks/recorder-BkO8G_mB.js");
 const electronUpdater = require("electron-updater");
@@ -5498,6 +5498,11 @@ function registerMockHandlers(ipc) {
     return JSON.parse(raw);
   });
 }
+async function resolveVars(ctx) {
+  const envVars = await requestExec.buildEnvVars(ctx?.environment ?? null);
+  const dynamic = await requestExec.buildDynamicVars();
+  return requestExec.mergeVars(envVars, ctx?.collectionVars ?? {}, ctx?.globals ?? {}, {}, dynamic);
+}
 async function resolveClientSecret(auth, vars) {
   let secret = auth.oauth2ClientSecret ?? "";
   if (!secret && auth.oauth2ClientSecretRef) {
@@ -5518,7 +5523,8 @@ async function browserFlow(auth, vars, flow) {
   authUrlFull.searchParams.set("client_id", clientId);
   authUrlFull.searchParams.set("redirect_uri", redirectUri);
   authUrlFull.searchParams.set("state", state);
-  if (auth.oauth2Scopes) authUrlFull.searchParams.set("scope", auth.oauth2Scopes);
+  const scopes = requestExec.interpolate(auth.oauth2Scopes ?? "", vars);
+  if (scopes) authUrlFull.searchParams.set("scope", scopes);
   const captured = await new Promise((resolve2, reject) => {
     const server = http.createServer((req, res) => {
       const reqUrl = new URL(req.url ?? "/", `http://localhost:${port}`);
@@ -5593,15 +5599,17 @@ async function browserFlow(auth, vars, flow) {
   };
 }
 function registerOAuth2Handlers(ipc) {
-  handle.handleIpc(ipc, handle.IPC.oauth2.startFlow, async (_e, auth, vars) => {
+  handle.handleIpc(ipc, handle.IPC.oauth2.startFlow, async (_e, auth, ctx) => {
     if (auth.type !== "oauth2") throw new Error("OAuth 2.0: auth is not an oauth2 config.");
+    const vars = await resolveVars(ctx);
     const flow = auth.oauth2Flow ?? "client_credentials";
     if (flow === "authorization_code" || flow === "implicit") {
       return browserFlow(auth, vars, flow);
     }
     return requestExec.fetchOAuth2Token(auth, vars);
   });
-  handle.handleIpc(ipc, handle.IPC.oauth2.refreshToken, async (_e, auth, vars, refreshToken) => {
+  handle.handleIpc(ipc, handle.IPC.oauth2.refreshToken, async (_e, auth, ctx, refreshToken) => {
+    const vars = await resolveVars(ctx);
     const tokenUrl = requestExec.interpolate(auth.oauth2TokenUrl ?? "", vars);
     const clientId = requestExec.interpolate(auth.oauth2ClientId ?? "", vars);
     let clientSecret = auth.oauth2ClientSecret ?? "";
@@ -7268,9 +7276,9 @@ function registerCloudHandlers(ipc) {
     const liveGlobals = { ...globals, ...requestExec.getGlobals() };
     const staticVars = requestExec.mergeVars(envVars, collectionVars ?? {}, liveGlobals, {}, {});
     const setup = input.setup ?? [];
-    const resolveVars = omitKeys(staticVars, setVarNames(setup));
-    const monitorRequest = resolveRequest(request, resolveVars);
-    const setupRequests = setup.map((h) => resolveRequest(h, resolveVars));
+    const resolveVars2 = omitKeys(staticVars, setVarNames(setup));
+    const monitorRequest = resolveRequest(request, resolveVars2);
+    const setupRequests = setup.map((h) => resolveRequest(h, resolveVars2));
     const payload = {
       name: input.name || request.name || "Monitor",
       target_url: monitorRequest.url,
@@ -7293,7 +7301,7 @@ function isNewer(a, b) {
   return a2 > b2;
 }
 async function checkForUpdate() {
-  const current = "0.7.8";
+  const current = "0.7.9";
   try {
     const res = await fetch(REGISTRY_URL, { signal: AbortSignal.timeout(4e3) });
     if (!res.ok) return null;

package/out/main/lib.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const mockServer = require("./chunks/mock-server-C4kTFkod.js");
-const requestExec = require("./chunks/request-exec-Cv2jkrO1.js");
+const requestExec = require("./chunks/request-exec-CgyqbNWk.js");
 const flowEngine = require("./chunks/flow-engine-BxwjEy37.js");
 require("node:http");
 require("node:crypto");

package/out/main/perf-worker.js

@@ -1,6 +1,6 @@
 "use strict";
-const perfRun = require("./chunks/perf-run-uZBqnG3S.js");
-const requestExec = require("./chunks/request-exec-Cv2jkrO1.js");
+const perfRun = require("./chunks/perf-run-Co_5unBR.js");
+const requestExec = require("./chunks/request-exec-CgyqbNWk.js");
 require("@grpc/grpc-js");
 require("@grpc/proto-loader");
 require("node:fs");

package/out/main/perf.js

@@ -2,10 +2,10 @@
 "use strict";
 const promises = require("node:fs/promises");
 const path = require("node:path");
-const requestExec = require("./chunks/request-exec-Cv2jkrO1.js");
+const requestExec = require("./chunks/request-exec-CgyqbNWk.js");
 const environments = require("./chunks/environments-iM3SUM-4.js");
 const flowEngine = require("./chunks/flow-engine-BxwjEy37.js");
-const perfRun = require("./chunks/perf-run-uZBqnG3S.js");
+const perfRun = require("./chunks/perf-run-Co_5unBR.js");
 const perfReport = require("./chunks/perf-report-ChaO3K0w.js");
 const cliCommon = require("./chunks/cli-common-GnihVSjU.js");
 require("undici");
@@ -191,7 +191,7 @@ async function main() {
     targetLabel = `flow: ${flow.name}`;
   }
   const load = perfRun.deriveLoad(plan);
-  const version = `v${"0.7.8"}`;
+  const version = `v${"0.7.9"}`;
   console.log("");
   console.log(cliCommon.color("  API Performance" + (version ? ` ${version}` : ""), cliCommon.C.bold, cliCommon.C.white));
   console.log(cliCommon.color(`  Plan:        ${plan.name}`, cliCommon.C.gray));

package/out/main/runner.js

@@ -2,7 +2,7 @@
 "use strict";
 const promises = require("node:fs/promises");
 const path = require("node:path");
-const requestExec = require("./chunks/request-exec-Cv2jkrO1.js");
+const requestExec = require("./chunks/request-exec-CgyqbNWk.js");
 const escape = require("./chunks/escape-DDVAlOvZ.js");
 const requestCollection = require("./chunks/request-collection-gkOYlWml.js");
 const runConcurrent = require("./chunks/run-concurrent-468tH0AX.js");
@@ -551,7 +551,7 @@ async function main() {
   } else if (!envName && workspace.settings?.defaultEnvironment && !env) {
     console.warn(cliCommon.color(`Warning: default environment "${workspace.settings.defaultEnvironment}" not found. Running without environment.`, cliCommon.C.yellow));
   }
-  const version = `v${"0.7.8"}`;
+  const version = `v${"0.7.9"}`;
   console.log("");
   console.log(cliCommon.color("  API Test Runner" + (version ? ` ${version}` : ""), cliCommon.C.bold, cliCommon.C.white));
   console.log(cliCommon.color(`  Workspace:   ${wsPath}`, cliCommon.C.gray));

package/out/preload/index.js

@@ -396,8 +396,10 @@ const api = {
   // ─── HashiCorp Vault (interactive OIDC login) ─────────────────────────────
   vaultOidcLogin: (opts) => electron.ipcRenderer.invoke(IPC.vault.oidcLogin, opts),
   // ─── OAuth 2.0 ────────────────────────────────────────────────────────────
-  oauth2StartFlow: (auth, vars) => electron.ipcRenderer.invoke(IPC.oauth2.startFlow, auth, vars),
-  oauth2RefreshToken: (auth, vars, refreshToken) => electron.ipcRenderer.invoke(IPC.oauth2.refreshToken, auth, vars, refreshToken),
+  // `ctx` is the active scope; main resolves the full {{var}} map from it
+  // (environment incl. secret-manager refs, collection vars, globals).
+  oauth2StartFlow: (auth, ctx) => electron.ipcRenderer.invoke(IPC.oauth2.startFlow, auth, ctx),
+  oauth2RefreshToken: (auth, ctx, refreshToken) => electron.ipcRenderer.invoke(IPC.oauth2.refreshToken, auth, ctx, refreshToken),
   // ─── Cloud integration ────────────────────────────────────────────────────────
   cloudTest: () => electron.ipcRenderer.invoke(IPC.cloud.test),
   cloudPushMock: (server) => electron.ipcRenderer.invoke(IPC.cloud.pushMock, server),

package/out/renderer/assets/{GraphQLEditor-Dv2K4wdd.js → GraphQLEditor-CXvLKrnv.js}

@@ -1,5 +1,5 @@
 import { l as linter, E as EditorView, L as LanguageSupport, f as LRLanguage, s as styleTags, i as indentNodeProp, m as delimitedIndent, n as foldNodeProp, p as foldInside, S as StateField, q as LRParser, u as StateEffect, v as tags, a as reactExports, j as jsxRuntimeExports, d as ReactCodeMirror, o as oneDark, c as json } from "./codemirror-CdIFBPs2.js";
-import { u as useT, a as useStore, b as useActiveEnvironment, i as isSubscriptionQuery } from "./index-CtCdFiRx.js";
+import { u as useT, a as useStore, b as useActiveEnvironment, i as isSubscriptionQuery } from "./index-BUFSn_qD.js";
 import "./ajv-CJPwFjiP.js";
 function devAssert(condition, message) {
   const booleanCondition = Boolean(condition);

package/out/renderer/assets/{SoapEditor-Cnz3M4Dz.js → SoapEditor-7hxhISPZ.js}

@@ -1,5 +1,5 @@
 import { a as reactExports, j as jsxRuntimeExports, d as ReactCodeMirror, o as oneDark, x as xml } from "./codemirror-CdIFBPs2.js";
-import { u as useT, c as btnPrimaryCls, d as commentKeymap } from "./index-CtCdFiRx.js";
+import { u as useT, c as btnPrimaryCls, d as commentKeymap } from "./index-BUFSn_qD.js";
 import "./ajv-CJPwFjiP.js";
 const SOAP_11_CONTENT_TYPE = "text/xml; charset=utf-8";
 const SOAP_12_CONTENT_TYPE = "application/soap+xml; charset=utf-8";

package/out/renderer/assets/{index-CtCdFiRx.js → index-BUFSn_qD.js}

@@ -1,4 +1,4 @@
-const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["./GraphQLEditor-Dv2K4wdd.js","./codemirror-CdIFBPs2.js","./ajv-CJPwFjiP.js","./SoapEditor-Cnz3M4Dz.js"])))=>i.map(i=>d[i]);
+const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["./GraphQLEditor-CXvLKrnv.js","./codemirror-CdIFBPs2.js","./ajv-CJPwFjiP.js","./SoapEditor-7hxhISPZ.js"])))=>i.map(i=>d[i]);
 import { r as requireReact, g as getDefaultExportFromCjs, R as React, a as reactExports, b as autocompletion, h as hoverTooltip, j as jsxRuntimeExports, k as keymap, t as toggleComment, x as xml, c as json, d as ReactCodeMirror, o as oneDark, e as javascript } from "./codemirror-CdIFBPs2.js";
 import { r as requireAjv } from "./ajv-CJPwFjiP.js";
 var client = { exports: {} };
@@ -24384,12 +24384,15 @@ const ICON = {
 };
 function parseVarTokens(str) {
   const found = [];
-  const re = /\{\{([^}]+)\}\}/g;
-  let m;
-  while ((m = re.exec(str)) !== null) {
-    const name = m[1].trim();
-    if (!found.includes(name)) found.push(name);
-  }
+  const seen2 = /* @__PURE__ */ new Set();
+  const push = (name, display) => {
+    if (!seen2.has(display)) {
+      seen2.add(display);
+      found.push({ name, display });
+    }
+  };
+  for (const m of str.matchAll(/\{\{([^}]+)\}\}/g)) push(m[1].trim(), `{{${m[1].trim()}}}`);
+  for (const m of str.matchAll(/\[([A-Za-z_]\w*)\]/g)) push(m[1], `[${m[1]}]`);
   return found;
 }
 function PortalDropdown({
@@ -24425,11 +24428,14 @@ function PortalDropdown({
     document.body
   );
 }
-function VarInput({ value: value2, onChange, className, wrapperClassName, staticSuggestions, ...rest }) {
+function VarInput({ value: value2, onChange, className, wrapperClassName, staticSuggestions, extraVars, ...rest }) {
   const t2 = useT();
   const varNames = useVarNames();
   const varValues = useVarValues();
   const inputRef = reactExports.useRef(null);
+  const extraKeys = extraVars ? Object.keys(extraVars) : [];
+  const mergedNames = extraKeys.length ? Array.from(/* @__PURE__ */ new Set([...extraKeys, ...varNames])) : varNames;
+  const mergedValues = extraKeys.length ? { ...varValues, ...extraVars } : varValues;
   const [suggestions, setSuggestions] = reactExports.useState([]);
   const [suggestionMode, setSuggestionMode] = reactExports.useState("var");
   const [activeIndex, setActiveIndex] = reactExports.useState(-1);
@@ -24482,7 +24488,7 @@ function VarInput({ value: value2, onChange, className, wrapperClassName, static
     m = /\{\{(\$?\w*)$/.exec(before);
     if (m) {
       const q = m[1].toLowerCase();
-      const vars = varNames.filter((n2) => n2.toLowerCase().includes(q)).map((n2) => ({ label: n2, insert: n2, type: "variable", close: true, boost: n2.startsWith("$") ? 1 : 0 }));
+      const vars = mergedNames.filter((n2) => n2.toLowerCase().includes(q)).map((n2) => ({ label: n2, insert: n2, type: "variable", close: true, boost: n2.startsWith("$") ? 1 : 0 }));
       const starters = [
         { label: "faker", insert: "faker.", type: "property" },
         { label: "dayjs", insert: "dayjs().", type: "function" }
@@ -24559,9 +24565,10 @@ function VarInput({ value: value2, onChange, className, wrapperClassName, static
   }
   const tokens = parseVarTokens(value2);
   const hasVars = tokens.length > 0;
-  const previewItems = tokens.map((name) => ({
+  const previewItems = tokens.map(({ name, display }) => ({
     name,
-    resolved: varValues[name] ?? null
+    display,
+    resolved: mergedValues[name] ?? null
   }));
   const { onFocus: _f, onBlur: _b, ...inputRest } = rest;
   return /* @__PURE__ */ jsxRuntimeExports.jsxs(
@@ -24594,11 +24601,11 @@ function VarInput({ value: value2, onChange, className, wrapperClassName, static
             onPick: apply
           }
         ),
-        showPreview && suggestions.length === 0 && previewItems.length > 0 && /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "absolute left-0 top-full mt-0.5 z-50 bg-surface-800 border border-surface-600 rounded shadow-xl text-xs min-w-[220px] max-w-[420px]", children: previewItems.map(({ name, resolved }) => /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex items-baseline gap-2 px-3 py-1.5 border-b border-surface-700 last:border-0", children: [
-          /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "font-mono text-blue-400 shrink-0", children: `{{${name}}}` }),
+        showPreview && suggestions.length === 0 && previewItems.length > 0 && /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "absolute left-0 top-full mt-0.5 z-50 bg-surface-800 border border-surface-600 rounded shadow-xl text-xs min-w-[220px] max-w-[420px]", children: previewItems.map(({ display, resolved }) => /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex items-baseline gap-2 px-3 py-1.5 border-b border-surface-700 last:border-0", children: [
+          /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "font-mono text-blue-400 shrink-0", children: display }),
           /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "text-surface-500 mx-0.5", children: "→" }),
           resolved !== null ? /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "font-mono text-emerald-400 truncate", children: resolved }) : /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "text-orange-400 italic", children: t2("undefined") })
-        ] }, name)) })
+        ] }, display)) })
       ]
     }
   );
@@ -24933,6 +24940,14 @@ function Modal({
 const { electron: electron$F } = window;
 function Oauth2Form({ auth, onChange }) {
   const t2 = useT();
+  const activeEnv = useActiveEnvironment();
+  const globals = useStore$1((s) => s.globals);
+  const activeCollectionId = useStore$1((s) => s.activeCollectionId);
+  const collections = useStore$1((s) => s.collections);
+  function resolveCtx() {
+    const collectionVars = activeCollectionId ? collections[activeCollectionId]?.data.collectionVariables ?? {} : {};
+    return { environment: activeEnv, collectionVars, globals };
+  }
   const [secretValue, setSecretValue] = reactExports.useState("");
   const [saved, setSaved] = reactExports.useState(false);
   const [status, setStatus] = reactExports.useState("idle");
@@ -24951,7 +24966,7 @@ function Oauth2Form({ auth, onChange }) {
     setStatus("fetching");
     setError("");
     try {
-      const result = await electron$F.oauth2StartFlow(auth, {});
+      const result = await electron$F.oauth2StartFlow(auth, resolveCtx());
       onChange({ oauth2CachedToken: result.accessToken, oauth2TokenExpiry: result.expiresAt });
       if (result.refreshToken) setRefreshToken(result.refreshToken);
       setStatus("ok");
@@ -24965,7 +24980,7 @@ function Oauth2Form({ auth, onChange }) {
     setStatus("fetching");
     setError("");
     try {
-      const result = await electron$F.oauth2RefreshToken(auth, {}, refreshToken);
+      const result = await electron$F.oauth2RefreshToken(auth, resolveCtx(), refreshToken);
       onChange({ oauth2CachedToken: result.accessToken, oauth2TokenExpiry: result.expiresAt });
       if (result.refreshToken) setRefreshToken(result.refreshToken);
       setStatus("ok");
@@ -25013,10 +25028,10 @@ function Oauth2Form({ auth, onChange }) {
     flow !== "implicit" && /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { children: [
       /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-surface-400", children: t2("Token URL") }),
       /* @__PURE__ */ jsxRuntimeExports.jsx(
-        "input",
+        VarInput,
         {
           value: auth.oauth2TokenUrl ?? "",
-          onChange: (e) => onChange({ oauth2TokenUrl: e.target.value }),
+          onChange: (v) => onChange({ oauth2TokenUrl: v }),
           placeholder: "https://auth.example.com/oauth/token",
           className: "mt-1 w-full bg-surface-800 border border-surface-700 rounded px-2 py-1 focus:outline-none focus:border-blue-500 font-mono"
         }
@@ -25026,10 +25041,10 @@ function Oauth2Form({ auth, onChange }) {
       /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex-1", children: [
         /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-surface-400", children: t2("Auth URL") }),
         /* @__PURE__ */ jsxRuntimeExports.jsx(
-          "input",
+          VarInput,
           {
             value: auth.oauth2AuthUrl ?? "",
-            onChange: (e) => onChange({ oauth2AuthUrl: e.target.value }),
+            onChange: (v) => onChange({ oauth2AuthUrl: v }),
             placeholder: "https://auth.example.com/oauth/authorize",
             className: "mt-1 w-full bg-surface-800 border border-surface-700 rounded px-2 py-1 focus:outline-none focus:border-blue-500 font-mono"
           }
@@ -25052,10 +25067,10 @@ function Oauth2Form({ auth, onChange }) {
       /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex-1", children: [
         /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-surface-400", children: t2("Client ID") }),
         /* @__PURE__ */ jsxRuntimeExports.jsx(
-          "input",
+          VarInput,
           {
             value: auth.oauth2ClientId ?? "",
-            onChange: (e) => onChange({ oauth2ClientId: e.target.value }),
+            onChange: (v) => onChange({ oauth2ClientId: v }),
             className: "mt-1 w-full bg-surface-800 border border-surface-700 rounded px-2 py-1 focus:outline-none focus:border-blue-500"
           }
         )
@@ -25131,10 +25146,10 @@ function Oauth2Form({ auth, onChange }) {
       /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex-1", children: [
         /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-surface-400", children: t2("Username") }),
         /* @__PURE__ */ jsxRuntimeExports.jsx(
-          "input",
+          VarInput,
           {
             value: auth.username ?? "",
-            onChange: (e) => onChange({ username: e.target.value }),
+            onChange: (v) => onChange({ username: v }),
             className: "mt-1 w-full bg-surface-800 border border-surface-700 rounded px-2 py-1 focus:outline-none focus:border-blue-500"
           }
         )
@@ -25142,11 +25157,10 @@ function Oauth2Form({ auth, onChange }) {
       /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex-1", children: [
         /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-surface-400", children: t2("Password") }),
         /* @__PURE__ */ jsxRuntimeExports.jsx(
-          "input",
+          VarInput,
           {
-            type: "password",
             value: auth.password ?? "",
-            onChange: (e) => onChange({ password: e.target.value }),
+            onChange: (v) => onChange({ password: v }),
             className: "mt-1 w-full bg-surface-800 border border-surface-700 rounded px-2 py-1 focus:outline-none focus:border-blue-500 font-mono"
           }
         )
@@ -25159,10 +25173,10 @@ function Oauth2Form({ auth, onChange }) {
         /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "text-surface-600", children: t2("(space-separated)") })
       ] }),
       /* @__PURE__ */ jsxRuntimeExports.jsx(
-        "input",
+        VarInput,
         {
           value: auth.oauth2Scopes ?? "",
-          onChange: (e) => onChange({ oauth2Scopes: e.target.value }),
+          onChange: (v) => onChange({ oauth2Scopes: v }),
           placeholder: t2("read write"),
           className: "mt-1 w-full bg-surface-800 border border-surface-700 rounded px-2 py-1 focus:outline-none focus:border-blue-500"
         }
@@ -25266,109 +25280,24 @@ function AuthEditor({
       }
     ) : /* @__PURE__ */ jsxRuntimeExports.jsx(PlainCredentialsFields, { auth, onChange })),
     auth.type === "ntlm" && (secrets ? /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex flex-col gap-2", children: [
-      /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex gap-2", children: [
-        /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex-1", children: [
-          /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-surface-400", children: t2("Username") }),
-          /* @__PURE__ */ jsxRuntimeExports.jsx(
-            "input",
-            {
-              value: auth.username ?? "",
-              onChange: (e) => onChange({ username: e.target.value }),
-              className: "mt-1 w-full bg-surface-800 border border-surface-700 rounded px-2 py-1 focus:outline-none focus:border-blue-500"
-            }
-          )
-        ] }),
-        /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex-1", children: [
-          /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-surface-400", children: t2("Password") }),
-          /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex gap-1 mt-1", children: [
-            /* @__PURE__ */ jsxRuntimeExports.jsx(
-              "input",
-              {
-                type: "password",
-                value: secrets.secretValue,
-                onChange: (e) => secrets.setSecretValue(e.target.value),
-                placeholder: auth.passwordSecretRef ? t2('Stored as ":ref"', { ref: auth.passwordSecretRef }) : t2("Password"),
-                className: "flex-1 bg-surface-800 border border-surface-700 rounded px-2 py-1 focus:outline-none focus:border-blue-500 font-mono"
-              }
-            ),
-            /* @__PURE__ */ jsxRuntimeExports.jsx(
-              "button",
-              {
-                onClick: () => {
-                  const ref = auth.passwordSecretRef ?? "NTLM_PASSWORD";
-                  onChange({ passwordSecretRef: ref });
-                  void secrets.saveSecret(ref);
-                },
-                className: "px-2 py-1 bg-blue-700 hover:bg-blue-600 rounded transition-colors",
-                children: secrets.saved ? "✓" : t2("Save")
-              }
-            )
-          ] })
-        ] })
-      ] }),
-      /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex gap-2", children: [
-        /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex-1", children: [
-          /* @__PURE__ */ jsxRuntimeExports.jsxs("label", { className: "text-surface-400", children: [
-            t2("Domain"),
-            " ",
-            /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "text-surface-600", children: t2("(optional)") })
-          ] }),
-          /* @__PURE__ */ jsxRuntimeExports.jsx(
-            "input",
-            {
-              value: auth.ntlmDomain ?? "",
-              onChange: (e) => onChange({ ntlmDomain: e.target.value }),
-              placeholder: "WORKGROUP",
-              className: "mt-1 w-full bg-surface-800 border border-surface-700 rounded px-2 py-1 focus:outline-none focus:border-blue-500"
-            }
-          )
-        ] }),
-        /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex-1", children: [
-          /* @__PURE__ */ jsxRuntimeExports.jsxs("label", { className: "text-surface-400", children: [
-            t2("Workstation"),
-            " ",
-            /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "text-surface-600", children: t2("(optional)") })
-          ] }),
-          /* @__PURE__ */ jsxRuntimeExports.jsx(
-            "input",
-            {
-              value: auth.ntlmWorkstation ?? "",
-              onChange: (e) => onChange({ ntlmWorkstation: e.target.value }),
-              placeholder: "MACHINE",
-              className: "mt-1 w-full bg-surface-800 border border-surface-700 rounded px-2 py-1 focus:outline-none focus:border-blue-500"
-            }
-          )
-        ] })
-      ] }),
+      /* @__PURE__ */ jsxRuntimeExports.jsx(
+        BasicCredentialsFields,
+        {
+          auth,
+          secretValue: secrets.secretValue,
+          setSecretValue: secrets.setSecretValue,
+          saved: secrets.saved,
+          setAuth: onChange,
+          saveSecret: secrets.saveSecret,
+          label: t2("NTLM Auth"),
+          secretRefDefault: "NTLM_PASSWORD"
+        }
+      ),
+      /* @__PURE__ */ jsxRuntimeExports.jsx(NtlmDomainFields, { auth, onChange }),
       /* @__PURE__ */ jsxRuntimeExports.jsx("p", { className: "text-surface-400 text-[10px] bg-surface-800 border border-surface-700 rounded px-2 py-1", children: t2("Uses NTLMv2 over a single keep-alive connection. Not supported through a proxy.") })
     ] }) : /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex flex-col gap-2", children: [
       /* @__PURE__ */ jsxRuntimeExports.jsx(PlainCredentialsFields, { auth, onChange }),
-      /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex gap-2", children: [
-        /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex-1", children: [
-          /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-surface-400", children: t2("Domain") }),
-          /* @__PURE__ */ jsxRuntimeExports.jsx(
-            "input",
-            {
-              value: auth.ntlmDomain ?? "",
-              onChange: (e) => onChange({ ntlmDomain: e.target.value }),
-              placeholder: "WORKGROUP",
-              className: "mt-1 w-full bg-surface-800 border border-surface-700 rounded px-2 py-1 focus:outline-none focus:border-blue-500"
-            }
-          )
-        ] }),
-        /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex-1", children: [
-          /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-surface-400", children: t2("Workstation") }),
-          /* @__PURE__ */ jsxRuntimeExports.jsx(
-            "input",
-            {
-              value: auth.ntlmWorkstation ?? "",
-              onChange: (e) => onChange({ ntlmWorkstation: e.target.value }),
-              placeholder: "MACHINE",
-              className: "mt-1 w-full bg-surface-800 border border-surface-700 rounded px-2 py-1 focus:outline-none focus:border-blue-500"
-            }
-          )
-        ] })
-      ] })
+      /* @__PURE__ */ jsxRuntimeExports.jsx(NtlmDomainFields, { auth, onChange })
     ] })),
     auth.type === "apikey" && /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "flex flex-col gap-1.5", children: /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex gap-2", children: [
       /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { children: [
@@ -25474,6 +25403,46 @@ function PlainCredentialsFields({
     ] })
   ] });
 }
+function NtlmDomainFields({
+  auth,
+  onChange
+}) {
+  const t2 = useT();
+  return /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex gap-2", children: [
+    /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex-1", children: [
+      /* @__PURE__ */ jsxRuntimeExports.jsxs("label", { className: "text-surface-400", children: [
+        t2("Domain"),
+        " ",
+        /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "text-surface-600", children: t2("(optional)") })
+      ] }),
+      /* @__PURE__ */ jsxRuntimeExports.jsx(
+        VarInput,
+        {
+          value: auth.ntlmDomain ?? "",
+          onChange: (v) => onChange({ ntlmDomain: v }),
+          placeholder: "WORKGROUP",
+          className: "mt-1 w-full bg-surface-800 border border-surface-700 rounded px-2 py-1 focus:outline-none focus:border-blue-500"
+        }
+      )
+    ] }),
+    /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex-1", children: [
+      /* @__PURE__ */ jsxRuntimeExports.jsxs("label", { className: "text-surface-400", children: [
+        t2("Workstation"),
+        " ",
+        /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "text-surface-600", children: t2("(optional)") })
+      ] }),
+      /* @__PURE__ */ jsxRuntimeExports.jsx(
+        VarInput,
+        {
+          value: auth.ntlmWorkstation ?? "",
+          onChange: (v) => onChange({ ntlmWorkstation: v }),
+          placeholder: "MACHINE",
+          className: "mt-1 w-full bg-surface-800 border border-surface-700 rounded px-2 py-1 focus:outline-none focus:border-blue-500"
+        }
+      )
+    ] })
+  ] });
+}
 function BasicCredentialsFields({
   auth,
   secretValue,
@@ -25482,7 +25451,8 @@ function BasicCredentialsFields({
   setAuth,
   saveSecret,
   label,
-  note
+  note,
+  secretRefDefault = "API_PASSWORD"
 }) {
   const t2 = useT();
   const [keychainOpen, setKeychainOpen] = reactExports.useState(!!auth.passwordSecretRef);
@@ -25546,7 +25516,7 @@ function BasicCredentialsFields({
         /* @__PURE__ */ jsxRuntimeExports.jsx(
           "input",
           {
-            value: auth.passwordSecretRef ?? "API_PASSWORD",
+            value: auth.passwordSecretRef ?? secretRefDefault,
             onChange: (e) => setAuth({ passwordSecretRef: e.target.value }),
             placeholder: t2("Keychain key"),
             className: "w-32 bg-surface-800 border border-surface-700 rounded px-2 py-1 focus:outline-none focus:border-blue-500"
@@ -25556,7 +25526,7 @@ function BasicCredentialsFields({
           "button",
           {
             onClick: () => {
-              const ref = auth.passwordSecretRef ?? "API_PASSWORD";
+              const ref = auth.passwordSecretRef ?? secretRefDefault;
               setAuth({ passwordSecretRef: ref });
               void saveSecret(ref);
             },
@@ -28298,6 +28268,40 @@ function extractQueryParams(rawUrl, existing) {
   const kept = (existing ?? []).filter((p) => (p.key || p.value) && !pastedKeys.has(p.key));
   return { url: nextUrl, params: [...kept, ...parsed], changed: true };
 }
+const PATH_PARAM_RE = /\[([A-Za-z_]\w*)\]/g;
+function extractPathParamNames(url) {
+  const names = [];
+  for (const m of url.matchAll(PATH_PARAM_RE)) {
+    if (!names.includes(m[1])) names.push(m[1]);
+  }
+  return names;
+}
+function referencedNames(url) {
+  const names = new Set(extractPathParamNames(url));
+  for (const m of url.matchAll(/\{\{([^}]+)\}\}/g)) names.add(m[1].trim());
+  return names;
+}
+function syncParamsFromUrl(rawUrl, existing) {
+  const q = extractQueryParams(rawUrl, existing);
+  const url = q.url;
+  let changed2 = q.changed;
+  const pathNames = extractPathParamNames(url);
+  const referenced = referencedNames(url);
+  let params = q.params.filter((p) => {
+    if (p.paramType === "path" && !p.value && p.key && !referenced.has(p.key)) {
+      changed2 = true;
+      return false;
+    }
+    return true;
+  });
+  const have = new Set(params.filter((p) => p.key).map((p) => p.key));
+  const additions = pathNames.filter((n2) => !have.has(n2)).map((n2) => ({ key: n2, value: "", enabled: true, paramType: "path" }));
+  if (additions.length) {
+    changed2 = true;
+    params = [...params, ...additions];
+  }
+  return { url, params, changed: changed2 };
+}
 function ParamsTab({ request: request2, onChange }) {
   const t2 = useT();
   return /* @__PURE__ */ jsxRuntimeExports.jsx(
@@ -28423,8 +28427,8 @@ function jsonWithComments() {
 function xmlWithComments() {
   return [xml(), commentKeymap];
 }
-const GraphQLEditor = reactExports.lazy(() => __vitePreload(() => import("./GraphQLEditor-Dv2K4wdd.js"), true ? __vite__mapDeps([0,1,2]) : void 0, import.meta.url).then((m) => ({ default: m.GraphQLEditor })));
-const SoapEditor = reactExports.lazy(() => __vitePreload(() => import("./SoapEditor-Cnz3M4Dz.js"), true ? __vite__mapDeps([3,1,2]) : void 0, import.meta.url).then((m) => ({ default: m.SoapEditor })));
+const GraphQLEditor = reactExports.lazy(() => __vitePreload(() => import("./GraphQLEditor-CXvLKrnv.js"), true ? __vite__mapDeps([0,1,2]) : void 0, import.meta.url).then((m) => ({ default: m.GraphQLEditor })));
+const SoapEditor = reactExports.lazy(() => __vitePreload(() => import("./SoapEditor-7hxhISPZ.js"), true ? __vite__mapDeps([3,1,2]) : void 0, import.meta.url).then((m) => ({ default: m.SoapEditor })));
 function BodyTab({ request: request2, onChange }) {
   const t2 = useT();
   const editorFallback = /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "p-4 text-xs text-surface-500", children: t2("Loading editor…") });
@@ -31491,17 +31495,20 @@ function RequestBuilder({ request: request2 }) {
   }
   function handleUrlPaste(e) {
     const pasted = e.clipboardData.getData("text");
-    if (!pasted.includes("?")) return;
     const input = e.currentTarget;
     const start2 = input.selectionStart ?? request2.url.length;
     const end = input.selectionEnd ?? request2.url.length;
     const resulting = request2.url.slice(0, start2) + pasted + request2.url.slice(end);
-    const split = extractQueryParams(resulting, request2.params ?? []);
-    if (split.changed) {
+    const synced = syncParamsFromUrl(resulting, request2.params ?? []);
+    if (synced.changed) {
       e.preventDefault();
-      update({ url: split.url, params: split.params });
+      update({ url: synced.url, params: synced.params });
     }
   }
+  function handleUrlBlur() {
+    const synced = syncParamsFromUrl(request2.url, request2.params ?? []);
+    if (synced.changed) update({ url: synced.url, params: synced.params });
+  }
   const sendSignal = useStore$1((s) => s.sendSignal);
   const lastSendSignal = reactExports.useRef(sendSignal);
   reactExports.useEffect(() => {
@@ -31903,6 +31910,10 @@ function RequestBuilder({ request: request2 }) {
             value: request2.url,
             onChange: (url) => update({ url }),
             onPaste: handleUrlPaste,
+            onBlur: handleUrlBlur,
+            extraVars: Object.fromEntries(
+              (request2.params ?? []).filter((p) => p.enabled && p.key).map((p) => [p.key, p.value])
+            ),
             placeholder: isWs ? "ws://example.com/socket" : isSoap ? t2("Endpoint (auto-filled from WSDL <soap:address>)") : isGrpc ? "localhost:50051" : isMqtt ? "mqtt://broker.example.com:1883" : "https://api.example.com/endpoint",
             wrapperClassName: "flex-1",
             className: `border rounded px-3 py-1.5 text-sm focus:outline-none focus:border-blue-500 font-mono placeholder-surface-700 ${isSoap ? "bg-surface-900 border-amber-900/50 text-surface-300" : "bg-surface-800 border-surface-700"}`
@@ -35866,7 +35877,7 @@ function WelcomeScreen() {
         )
       ] }),
       /* @__PURE__ */ jsxRuntimeExports.jsx("p", { className: "text-surface-400 text-sm max-w-sm", children: t2("Local-first API testing with Robot Framework & Playwright code generation. Secrets stay on your machine.") }),
-      /* @__PURE__ */ jsxRuntimeExports.jsx("p", { className: "text-[11px] mt-3", style: { color: "var(--text-muted)" }, children: t2("version :version", { version: "0.7.8" }) })
+      /* @__PURE__ */ jsxRuntimeExports.jsx("p", { className: "text-[11px] mt-3", style: { color: "var(--text-muted)" }, children: t2("version :version", { version: "0.7.9" }) })
     ] }),
     /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex flex-col gap-3 w-64", children: [
       /* @__PURE__ */ jsxRuntimeExports.jsx(
@@ -56001,7 +56012,7 @@ function App() {
       /* @__PURE__ */ jsxRuntimeExports.jsx("span", { style: { color: "#6aa3c8" }, children: "Spector" }),
       /* @__PURE__ */ jsxRuntimeExports.jsxs("span", { className: "ml-2 text-[10px] font-normal opacity-50", children: [
         "v",
-        "0.7.8"
+        "0.7.9"
       ] }),
       /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "mx-2 opacity-30", children: "·" }),
       /* @__PURE__ */ jsxRuntimeExports.jsx(

package/out/renderer/index.html

@@ -5,7 +5,7 @@
   <meta charset="UTF-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1.0" />
   <title>API Spector</title>
-  <script type="module" crossorigin src="./assets/index-CtCdFiRx.js"></script>
+  <script type="module" crossorigin src="./assets/index-BUFSn_qD.js"></script>
   <link rel="modulepreload" crossorigin href="./assets/codemirror-CdIFBPs2.js">
   <link rel="modulepreload" crossorigin href="./assets/ajv-CJPwFjiP.js">
   <link rel="stylesheet" crossorigin href="./assets/index-DkhdKzQJ.css">

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@testsmith/api-spector",
   "productName": "API Spector",
-  "version": "0.7.8",
+  "version": "0.7.9",
   "description": "Local-first API testing tool to inspect, test and mock APIs",
   "repository": {
     "type": "git",