@umeshindu222/apisnap 1.2.1 → 1.2.3

package/dist/core/runner.js

@@ -36,7 +36,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-const fs_1 = __importDefault(require("fs"));
+const fs_1 = __importStar(require("fs"));
 const path_1 = __importDefault(require("path"));
 const axios_1 = __importDefault(require("axios"));
 const chalk_1 = __importDefault(require("chalk"));
@@ -44,6 +44,75 @@ const ora_1 = __importDefault(require("ora"));
 const commander_1 = require("commander");
 const program = new commander_1.Command();
 const { version } = require('../../package.json');
+function interpolateEnv(value) {
+    if (typeof value === 'string') {
+        return value.replace(/\$([A-Z_][A-Z0-9_]*)/g, (match, key) => process.env[key] ?? match);
+    }
+    if (Array.isArray(value)) {
+        return value.map((item) => interpolateEnv(item));
+    }
+    if (value && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, interpolateEnv(v)]));
+    }
+    return value;
+}
+function globToRegExp(pattern) {
+    const escaped = pattern
+        .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+        .replace(/\*/g, '.*')
+        .replace(/\?/g, '.');
+    return new RegExp(`^${escaped}$`);
+}
+function pathMatchesFilter(pathname, pattern) {
+    if (pattern.includes('*') || pattern.includes('?')) {
+        return globToRegExp(pattern).test(pathname);
+    }
+    return pathname.includes(pattern);
+}
+function percentile(sorted, p) {
+    if (sorted.length === 0)
+        return 0;
+    const index = Math.ceil((p / 100) * sorted.length) - 1;
+    return sorted[Math.max(0, Math.min(index, sorted.length - 1))];
+}
+function parseRetryAfterMs(retryAfterHeader) {
+    const raw = Array.isArray(retryAfterHeader) ? retryAfterHeader[0] : retryAfterHeader;
+    if (!raw)
+        return 2000;
+    const asSeconds = Number.parseInt(raw, 10);
+    if (Number.isFinite(asSeconds)) {
+        return Math.max(0, asSeconds * 1000);
+    }
+    const dateMs = Date.parse(raw);
+    if (Number.isFinite(dateMs)) {
+        return Math.max(0, dateMs - Date.now());
+    }
+    return 2000;
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function normalizeOpenApiPath(p) {
+    return p.replace(/\{([^}]+)\}/g, ':$1');
+}
+function parseOpenApiEndpoints(spec) {
+    if (!spec || typeof spec !== 'object' || typeof spec.paths !== 'object') {
+        return [];
+    }
+    const validMethods = new Set(['get', 'post', 'put', 'patch', 'delete', 'options', 'head']);
+    const endpoints = [];
+    for (const [rawPath, pathItem] of Object.entries(spec.paths)) {
+        if (!pathItem || typeof pathItem !== 'object')
+            continue;
+        const methods = Object.keys(pathItem)
+            .filter((method) => validMethods.has(method.toLowerCase()))
+            .map((method) => method.toUpperCase());
+        if (methods.length > 0) {
+            endpoints.push({ path: normalizeOpenApiPath(rawPath), methods });
+        }
+    }
+    return endpoints;
+}
 // ─── Config File Loader ───────────────────────────────────────────────────────
 function loadConfigFile(env) {
     const configNames = ['.apisnaprc', '.apisnaprc.json', 'apisnap.config.json'];
@@ -51,16 +120,17 @@ function loadConfigFile(env) {
         const filePath = path_1.default.resolve(process.cwd(), name);
         if (fs_1.default.existsSync(filePath)) {
             try {
-                // Strip BOM if present (fixes Windows PowerShell encoding issue)
                 let raw = fs_1.default.readFileSync(filePath, 'utf-8');
-                raw = raw.replace(/^\uFEFF/, '');
-                raw = raw.trim();
+                raw = raw.replace(/^\uFEFF/, '').trim();
                 const config = JSON.parse(raw);
                 console.log(chalk_1.default.gray(`   Config: ${name}${env ? ` (env: ${env})` : ''}\n`));
+                const envMerged = env && config.envs?.[env]
+                    ? { ...config, ...config.envs[env] }
+                    : config;
                 if (env && config.envs?.[env]) {
-                    return { ...config, ...config.envs[env] };
+                    return interpolateEnv(envMerged);
                 }
-                return config;
+                return interpolateEnv(envMerged);
             }
             catch (e) {
                 console.warn(chalk_1.default.yellow(`⚠️  Could not parse config file: ${name}`));
@@ -89,16 +159,23 @@ function validateConfig(config) {
     if (config.envs && (typeof config.envs !== 'object' || Array.isArray(config.envs) || config.envs === null)) {
         errors.push({ field: 'envs', message: '"envs" must be an object', fix: '"envs": {"staging": {"baseUrl": "https://staging.example.com"}}' });
     }
+    if (config.authFlow) {
+        const af = config.authFlow;
+        if (!af.url)
+            errors.push({ field: 'authFlow.url', message: '"authFlow.url" is required', fix: '"authFlow": { "url": "/auth/login", ... }' });
+        if (!af.body)
+            errors.push({ field: 'authFlow.body', message: '"authFlow.body" is required', fix: '"authFlow": { "body": { "username": "test", "password": "pass" } }' });
+        if (!af.tokenPath)
+            errors.push({ field: 'authFlow.tokenPath', message: '"authFlow.tokenPath" is required', fix: '"authFlow": { "tokenPath": "token" }' });
+    }
     return errors;
 }
 function parseIntOption(value, name, defaultValue, options = {}) {
-    if (value === undefined || value === null || value === '') {
+    if (value === undefined || value === null || value === '')
         return defaultValue;
-    }
     const numericValue = typeof value === 'number' ? value : Number(String(value));
     if (!Number.isFinite(numericValue) || !Number.isInteger(numericValue)) {
         console.error(chalk_1.default.red(`\n  ✖  Invalid value for --${name}: "${value}" must be a whole number.`));
-        console.error(chalk_1.default.gray(`     Example: --${name} ${defaultValue}\n`));
         process.exit(1);
     }
     if (options.min !== undefined && numericValue < options.min) {
@@ -111,15 +188,13 @@ function parseIntOption(value, name, defaultValue, options = {}) {
     }
     return numericValue;
 }
-// ─── Header Parser ─────────────────────────────────────────────────────────
+// ─── Header Parser ────────────────────────────────────────────────────────
 function parseHeaders(headerArgs) {
     const headers = {};
     for (const h of headerArgs) {
         const colonIdx = h.indexOf(':');
         if (colonIdx > 0) {
-            const key = h.slice(0, colonIdx).trim();
-            const value = h.slice(colonIdx + 1).trim();
-            headers[key] = value;
+            headers[h.slice(0, colonIdx).trim()] = h.slice(colonIdx + 1).trim();
         }
         else {
             console.warn(chalk_1.default.yellow(`⚠️  Skipping malformed header: "${h}" (expected "Key: Value")`));
@@ -127,12 +202,78 @@ function parseHeaders(headerArgs) {
     }
     return headers;
 }
+// ─── Dot-path resolver (for token extraction) ────────────────────────────────
+function resolveDotPath(obj, dotPath) {
+    const parts = dotPath.split('.');
+    let current = obj;
+    for (const part of parts) {
+        if (current == null || typeof current !== 'object')
+            return null;
+        current = current[part];
+    }
+    return typeof current === 'string' ? current : (current != null ? String(current) : null);
+}
+// ─── Auth Flow Executor ───────────────────────────────────────────────────────
+async function executeAuthFlow(authFlow, baseUrl, timeout) {
+    const authSpinner = (0, ora_1.default)('  Authenticating via auth flow...').start();
+    try {
+        const loginUrl = authFlow.url.startsWith('http') ? authFlow.url : `${baseUrl}${authFlow.url}`;
+        const res = await axios_1.default.post(loginUrl, authFlow.body, {
+            timeout,
+            validateStatus: () => true,
+            headers: { 'Content-Type': 'application/json' },
+        });
+        if (res.status >= 400) {
+            authSpinner.fail(chalk_1.default.red(`Auth flow failed: ${res.status} ${res.statusText}`));
+            console.log(chalk_1.default.yellow(`  Hint: Check authFlow.body credentials and authFlow.url in your config.`));
+            return null;
+        }
+        const token = resolveDotPath(res.data, authFlow.tokenPath);
+        if (!token) {
+            authSpinner.fail(chalk_1.default.red(`Auth flow: could not find token at path "${authFlow.tokenPath}" in response`));
+            console.log(chalk_1.default.gray(`  Response body: ${JSON.stringify(res.data).slice(0, 200)}`));
+            return null;
+        }
+        const headerName = authFlow.headerName || 'Authorization';
+        const prefix = authFlow.prefix !== undefined ? authFlow.prefix : 'Bearer ';
+        const headerValue = `${prefix}${token}`;
+        authSpinner.succeed(chalk_1.default.green(`Auth flow succeeded → injecting ${headerName}: ${prefix}${token.slice(0, 8)}••••••`));
+        return { headerName, headerValue };
+    }
+    catch (err) {
+        authSpinner.fail(chalk_1.default.red(`Auth flow error: ${err.message}`));
+        return null;
+    }
+}
+// ─── Cookie Jar (session auth) ───────────────────────────────────────────────
+class CookieJar {
+    constructor() {
+        this.cookies = new Map();
+    }
+    ingest(setCookieHeaders) {
+        if (!setCookieHeaders)
+            return;
+        const headers = Array.isArray(setCookieHeaders) ? setCookieHeaders : [setCookieHeaders];
+        for (const header of headers) {
+            const [kv] = header.split(';');
+            const idx = kv.indexOf('=');
+            if (idx > 0) {
+                this.cookies.set(kv.slice(0, idx).trim(), kv.slice(idx + 1).trim());
+            }
+        }
+    }
+    toString() {
+        return [...this.cookies.entries()].map(([k, v]) => `${k}=${v}`).join('; ');
+    }
+    has() {
+        return this.cookies.size > 0;
+    }
+}
 // ─── Smart Path Param Replacement ────────────────────────────────────────────
 function replacePath(rawPath, paramMap = {}) {
     return rawPath.replace(/:([a-zA-Z0-9_]+)/g, (_, param) => {
         if (paramMap[param])
             return paramMap[param];
-        // Smart defaults based on param name
         if (/id$/i.test(param))
             return '1';
         if (/slug$/i.test(param))
@@ -147,9 +288,13 @@ function replacePath(rawPath, paramMap = {}) {
             return '1';
         if (/limit$/i.test(param))
             return '10';
-        return '1'; // fallback
+        return '1';
     });
 }
+// ─── Exponential Backoff ──────────────────────────────────────────────────────
+function backoffDelay(attempt, baseMs = 300) {
+    return Math.min(baseMs * Math.pow(2, attempt) + Math.random() * 100, 10000);
+}
 // ─── Concurrency Limiter ──────────────────────────────────────────────────────
 async function runWithConcurrency(tasks, limit) {
     const results = Array.from({ length: tasks.length }, () => new Error('Task never executed'));
@@ -165,13 +310,86 @@ async function runWithConcurrency(tasks, limit) {
             }
         }
     }
-    // Spin up `limit` workers — each pulls the next task when free
     const workers = Array.from({ length: Math.min(limit, tasks.length) }, worker);
     await Promise.all(workers);
     return results;
 }
+// ─── Baseline Diff Engine ─────────────────────────────────────────────────────
+function diffAgainstBaseline(current, baselinePath) {
+    if (!fs_1.default.existsSync(baselinePath))
+        return null;
+    let baseline;
+    try {
+        baseline = JSON.parse(fs_1.default.readFileSync(baselinePath, 'utf-8'));
+    }
+    catch {
+        console.warn(chalk_1.default.yellow(`⚠️  Could not parse baseline file: ${baselinePath}`));
+        return null;
+    }
+    const baselineMap = new Map(baseline.results.map(r => [`${r.method}:${r.path}`, r]));
+    const currentMap = new Map(current.results.map(r => [`${r.method}:${r.path}`, r]));
+    const regressions = [];
+    const improvements = [];
+    let unchanged = 0;
+    const baselineKeys = new Set(baselineMap.keys());
+    const currentKeys = new Set(currentMap.keys());
+    const newEndpoints = [...currentKeys].filter(k => !baselineKeys.has(k));
+    const removedEndpoints = [...baselineKeys].filter(k => !currentKeys.has(k));
+    for (const [key, curr] of currentMap) {
+        const prev = baselineMap.get(key);
+        if (!prev)
+            continue;
+        const wasOk = prev.success;
+        const isOk = curr.success;
+        const wasSlow = prev.slow;
+        const isSlow = curr.slow;
+        if (wasOk && !isOk) {
+            regressions.push({ path: curr.path, method: curr.method, prev: { status: prev.status, duration: prev.duration }, curr: { status: curr.status, duration: curr.duration, error: curr.error }, reason: `Status changed ${prev.status} → ${curr.status}` });
+        }
+        else if (!wasOk && isOk) {
+            improvements.push({ path: curr.path, method: curr.method, reason: `Fixed: ${prev.status} → ${curr.status}` });
+        }
+        else if (isOk && !wasSlow && isSlow) {
+            regressions.push({ path: curr.path, method: curr.method, prev: { duration: prev.duration }, curr: { duration: curr.duration }, reason: `Latency spike: ${prev.duration}ms → ${curr.duration}ms` });
+        }
+        else if (isOk && wasSlow && !isSlow) {
+            improvements.push({ path: curr.path, method: curr.method, reason: `Faster: ${prev.duration}ms → ${curr.duration}ms` });
+        }
+        else {
+            unchanged++;
+        }
+    }
+    return { regressions, improvements, unchanged, newEndpoints, removedEndpoints };
+}
+function printDiffReport(diff) {
+    console.log(chalk_1.default.bold('\n🔍 Regression Diff:'));
+    if (diff.regressions.length === 0 && diff.improvements.length === 0) {
+        console.log(chalk_1.default.green('  ✅ No regressions — results match baseline.'));
+    }
+    if (diff.regressions.length > 0) {
+        console.log(chalk_1.default.red.bold(`\n  ⛔ ${diff.regressions.length} regression(s):`));
+        for (const r of diff.regressions) {
+            console.log(chalk_1.default.red(`    ✖ [${r.method}] ${r.path}`));
+            console.log(chalk_1.default.gray(`      ${r.reason}`));
+        }
+    }
+    if (diff.improvements.length > 0) {
+        console.log(chalk_1.default.green.bold(`\n  🎉 ${diff.improvements.length} improvement(s):`));
+        for (const i of diff.improvements) {
+            console.log(chalk_1.default.green(`    ✔ [${i.method}] ${i.path}`));
+            console.log(chalk_1.default.gray(`      ${i.reason}`));
+        }
+    }
+    if (diff.newEndpoints.length > 0) {
+        console.log(chalk_1.default.cyan(`\n  🆕 ${diff.newEndpoints.length} new endpoint(s): ${diff.newEndpoints.join(', ')}`));
+    }
+    if (diff.removedEndpoints.length > 0) {
+        console.log(chalk_1.default.yellow(`\n  🗑  ${diff.removedEndpoints.length} removed endpoint(s): ${diff.removedEndpoints.join(', ')}`));
+    }
+    console.log(chalk_1.default.gray(`\n  Unchanged: ${diff.unchanged} endpoint(s)`));
+}
 // ─── HTML Report Generator ────────────────────────────────────────────────────
-function generateHTMLReport(data) {
+function writeHTMLReport(filePath, data, diff) {
     const passRate = data.summary.total > 0
         ? Math.round((data.summary.passed / data.summary.total) * 100)
         : 0;
@@ -182,19 +400,24 @@ function generateHTMLReport(data) {
             return '#fef9c3';
         return '#f0fdf4';
     };
-    const rows = data.results.map(r => `
-    <tr style="background:${rowColor(r)}">
-      <td><span class="badge badge-${r.method.toLowerCase()}">${r.method}</span></td>
-      <td><code>${r.path}</code></td>
-      <td>${r.success
-        ? `<span class="ok">✔ ${r.status}</span>`
-        : `<span class="fail">✖ ${r.status || 'ERR'}</span>`}</td>
-      <td>${r.slow ? `<span class="slow">⚠️ ${r.duration}ms</span>` : `${r.duration}ms`}</td>
-      <td>${r.retries > 0 ? `${r.retries} retry` : '—'}</td>
-      <td>${r.error ? `<span class="errtext">${r.error}</span>` : '—'}</td>
-    </tr>
-  `).join('');
-    return `<!DOCTYPE html>
+    const diffSection = diff ? `
+  <div class="diff-section">
+    <h2>🔍 Regression Diff</h2>
+    ${diff.regressions.length === 0 && diff.improvements.length === 0
+        ? '<p class="no-regressions">✅ No regressions — results match baseline.</p>'
+        : ''}
+    ${diff.regressions.length > 0 ? `
+      <h3 class="red">⛔ ${diff.regressions.length} Regression(s)</h3>
+      <ul>${diff.regressions.map(r => `<li><strong>[${r.method}] ${r.path}</strong> — ${r.reason}</li>`).join('')}</ul>
+    ` : ''}
+    ${diff.improvements.length > 0 ? `
+      <h3 class="green">🎉 ${diff.improvements.length} Improvement(s)</h3>
+      <ul>${diff.improvements.map(i => `<li><strong>[${i.method}] ${i.path}</strong> — ${i.reason}</li>`).join('')}</ul>
+    ` : ''}
+    ${diff.newEndpoints.length > 0 ? `<p class="blue">🆕 New: ${diff.newEndpoints.join(', ')}</p>` : ''}
+    ${diff.removedEndpoints.length > 0 ? `<p class="yellow">🗑 Removed: ${diff.removedEndpoints.join(', ')}</p>` : ''}
+  </div>` : '';
+    const head = `<!DOCTYPE html>
 <html lang="en">
 <head>
   <meta charset="UTF-8"/>
@@ -203,6 +426,8 @@ function generateHTMLReport(data) {
     *{box-sizing:border-box;margin:0;padding:0}
     body{font-family:'Segoe UI',system-ui,sans-serif;background:#f8fafc;color:#1e293b;padding:2rem}
     h1{font-size:1.8rem;margin-bottom:.25rem}
+    h2{font-size:1.2rem;margin:1.5rem 0 .75rem}
+    h3{font-size:1rem;margin:.75rem 0 .4rem}
     .sub{color:#64748b;font-size:.9rem;margin-bottom:2rem}
     .cards{display:grid;grid-template-columns:repeat(auto-fit,minmax(140px,1fr));gap:1rem;margin-bottom:2rem}
     .card{background:#fff;border-radius:12px;padding:1.2rem;box-shadow:0 1px 4px rgba(0,0,0,.08);text-align:center}
@@ -217,8 +442,13 @@ function generateHTMLReport(data) {
     .badge-delete{background:#dc2626}.badge-patch{background:#7c3aed}
     .ok{color:#16a34a;font-weight:600}.fail{color:#dc2626;font-weight:600}.slow{color:#ca8a04;font-weight:600}
     .errtext{color:#dc2626;font-size:.8rem}
+    .auth-tag{background:#e0e7ff;color:#3730a3;border-radius:4px;padding:.1rem .4rem;font-size:.75rem;font-weight:600}
     .progress{background:#e2e8f0;border-radius:999px;height:10px;margin:1rem 0}
     .progress-bar{background:#16a34a;height:10px;border-radius:999px;transition:width .3s}
+    .diff-section{background:#fff;border-radius:12px;padding:1.5rem;margin-top:2rem;box-shadow:0 1px 4px rgba(0,0,0,.08)}
+    .diff-section ul{padding-left:1.25rem;margin:.5rem 0}
+    .diff-section li{margin:.3rem 0;font-size:.9rem}
+    .no-regressions{color:#16a34a;font-weight:600}
     footer{margin-top:2rem;color:#94a3b8;font-size:.8rem;text-align:center}
   </style>
 </head>
@@ -232,6 +462,9 @@ function generateHTMLReport(data) {
     <div class="card"><div class="num red">${data.summary.failed}</div><div class="lbl">Failed</div></div>
     <div class="card"><div class="num yellow">${data.summary.slow}</div><div class="lbl">Slow (&gt;${data.config.slowThreshold}ms)</div></div>
     <div class="card"><div class="num blue">${data.summary.avgDuration}ms</div><div class="lbl">Avg Response</div></div>
+        <div class="card"><div class="num blue">${data.summary.p50Duration}ms</div><div class="lbl">p50</div></div>
+        <div class="card"><div class="num blue">${data.summary.p95Duration}ms</div><div class="lbl">p95</div></div>
+        <div class="card"><div class="num blue">${data.summary.p99Duration}ms</div><div class="lbl">p99</div></div>
     <div class="card"><div class="num ${passRate === 100 ? 'green' : passRate >= 80 ? 'yellow' : 'red'}">${passRate}%</div><div class="lbl">Pass Rate</div></div>
   </div>
 
@@ -239,14 +472,38 @@ function generateHTMLReport(data) {
 
   <table>
     <thead>
-      <tr><th>Method</th><th>Path</th><th>Status</th><th>Duration</th><th>Retries</th><th>Error</th></tr>
+      <tr><th>Method</th><th>Path</th><th>Status</th><th>Duration</th><th>Retries</th><th>Auth</th><th>Error</th></tr>
     </thead>
-    <tbody>${rows}</tbody>
+        <tbody>`;
+    const foot = `</tbody>
   </table>
 
+  ${diffSection}
+
   <footer>APISnap v${data.version} — MIT License</footer>
 </body>
 </html>`;
+    return new Promise((resolve, reject) => {
+        const out = (0, fs_1.createWriteStream)(filePath, { encoding: 'utf8' });
+        out.on('error', reject);
+        out.on('finish', resolve);
+        out.write(head);
+        for (const r of data.results) {
+            out.write(`
+        <tr style="background:${rowColor(r)}">
+            <td><span class="badge badge-${r.method.toLowerCase()}">${r.method}</span></td>
+            <td><code>${r.path}</code></td>
+            <td>${r.success
+                ? `<span class="ok">✔ ${r.status}</span>`
+                : `<span class="fail">✖ ${r.status || 'ERR'}</span>`}</td>
+            <td>${r.slow ? `<span class="slow">⚠️ ${r.duration}ms</span>` : `${r.duration}ms`}</td>
+            <td>${r.retries > 0 ? `${r.retries} retry` : '—'}</td>
+            <td>${r.authMethod ? `<span class="auth-tag">${r.authMethod}</span>` : '—'}</td>
+            <td>${r.error ? `<span class="errtext">${r.error}</span>` : '—'}</td>
+        </tr>`);
+        }
+        out.end(foot);
+    });
 }
 // ─── Main CLI ─────────────────────────────────────────────────────────────────
 program
@@ -260,7 +517,16 @@ program
     console.log(chalk_1.default.gray('  This creates a .apisnaprc.json in your project root.\n'));
     const port = (await q(chalk_1.default.white('  Server port? ') + chalk_1.default.gray('[3000]: '))).trim() || '3000';
     const slowInput = (await q(chalk_1.default.white('  Slow threshold (ms)? ') + chalk_1.default.gray('[200]: '))).trim() || '200';
-    const authRaw = await q(chalk_1.default.white('  Auth token? ') + chalk_1.default.gray('(leave blank to skip): '));
+    const authRaw = await q(chalk_1.default.white('  Static auth token? ') + chalk_1.default.gray('(leave blank to skip): '));
+    const useAuthFlow = (await q(chalk_1.default.white('  Set up auth flow (auto-login)? ') + chalk_1.default.gray('[y/N]: '))).trim().toLowerCase() === 'y';
+    let authFlowConfig = null;
+    if (useAuthFlow) {
+        const loginUrl = (await q(chalk_1.default.white('    Login endpoint? ') + chalk_1.default.gray('[/auth/login]: '))).trim() || '/auth/login';
+        const username = (await q(chalk_1.default.white('    Username/email field value: '))).trim();
+        const password = (await q(chalk_1.default.white('    Password field value: '))).trim();
+        const tokenPath = (await q(chalk_1.default.white('    Token path in response? ') + chalk_1.default.gray('[token]: '))).trim() || 'token';
+        authFlowConfig = { url: loginUrl, body: { username, password }, tokenPath };
+    }
     const skipRaw = await q(chalk_1.default.white('  Paths to skip? ') + chalk_1.default.gray('e.g. /admin,/internal (or blank): '));
     const configPath = path_1.default.resolve(process.cwd(), '.apisnaprc.json');
     const alreadyExists = fs_1.default.existsSync(configPath);
@@ -278,39 +544,109 @@ program
         port,
         slow: Number.isNaN(parsedSlow) ? 200 : parsedSlow,
     };
-    if (authRaw.trim()) {
+    if (authRaw.trim())
         config.headers = [`Authorization: Bearer ${authRaw.trim()}`];
-    }
-    if (skipRaw.trim()) {
+    if (authFlowConfig)
+        config.authFlow = authFlowConfig;
+    if (skipRaw.trim())
         config.skip = skipRaw.split(',').map(s => s.trim()).filter(Boolean);
-    }
     fs_1.default.writeFileSync(configPath, JSON.stringify(config, null, 2));
     console.log(chalk_1.default.green('\n  ✅ Created .apisnaprc.json\n'));
     console.log(chalk_1.default.gray('  Next steps:'));
     console.log(chalk_1.default.cyan('    1. Start your server'));
     console.log(chalk_1.default.cyan('    2. Run: apisnap\n'));
 });
+program
+    .command('doctor')
+    .description('Diagnose your APISnap setup')
+    .option('-p, --port <number>', 'Port your server is running on')
+    .option('--env <name>', 'Use environment profile from config')
+    .action(async (options) => {
+    const fileConfig = loadConfigFile(options.env);
+    const port = options.port || fileConfig.port || '3000';
+    const discoveryUrl = `http://localhost:${port}/__apisnap_discovery`;
+    const checks = [
+        {
+            name: 'Config valid',
+            run: async () => validateConfig(fileConfig).length === 0,
+        },
+        {
+            name: 'Server reachable',
+            run: async () => {
+                const res = await axios_1.default.get(discoveryUrl, { timeout: 2000, validateStatus: () => true });
+                return res.status < 500;
+            },
+        },
+        {
+            name: 'Middleware installed',
+            run: async () => {
+                const res = await axios_1.default.get(discoveryUrl, { timeout: 2000, validateStatus: () => true });
+                return res.status === 200 && res.data?.tool === 'APISnap';
+            },
+        },
+    ];
+    if (fileConfig.authFlow) {
+        checks.push({
+            name: 'Auth flow works',
+            run: async () => {
+                const baseUrl = fileConfig.baseUrl || `http://localhost:${port}`;
+                const timeout = parseIntOption(fileConfig.timeout, 'timeout', 5000, { min: 100 });
+                const authResult = await executeAuthFlow(fileConfig.authFlow, baseUrl, timeout);
+                return !!authResult;
+            },
+        });
+    }
+    let failedChecks = 0;
+    console.log(chalk_1.default.bold('\n🩺 APISnap Doctor\n'));
+    for (const check of checks) {
+        try {
+            const ok = await check.run();
+            if (ok) {
+                console.log(chalk_1.default.green(`  ✅ ${check.name}`));
+            }
+            else {
+                failedChecks++;
+                console.log(chalk_1.default.red(`  ❌ ${check.name}`));
+            }
+        }
+        catch (error) {
+            failedChecks++;
+            console.log(chalk_1.default.red(`  ❌ ${check.name}`));
+            console.log(chalk_1.default.gray(`     ${error.message}`));
+        }
+    }
+    console.log();
+    process.exit(failedChecks > 0 ? 1 : 0);
+});
 program
     .name('apisnap')
     .description('Instant API health-check CLI for Express.js')
     .version(version)
     .option('-p, --port <number>', 'Port your server is running on')
-    .option('-H, --header <string>', 'Custom header — can be used multiple times (e.g. -H "Authorization: Bearer TOKEN" -H "x-api-key: SECRET")', collect, [])
+    .option('-H, --header <string>', 'Custom header (repeatable)', collect, [])
     .option('-c, --cookie <string>', 'Cookie string (e.g. "sessionId=abc; token=xyz")')
     .option('-s, --slow <number>', 'Slow response threshold in ms')
     .option('-t, --timeout <number>', 'Request timeout in ms')
-    .option('-r, --retry <number>', 'Retry failed requests N times')
-    .option('-e, --export <filename>', 'Export JSON report (e.g. report)')
-    .option('--html <filename>', 'Export HTML report (e.g. report)')
+    .option('-r, --retry <number>', 'Retry failed requests N times (uses exponential backoff)')
+    .option('-e, --export <filename>', 'Export JSON report')
+    .option('--html <filename>', 'Export HTML report')
     .option('--only <methods>', 'Only test specific methods (e.g. "GET,POST")')
-    .option('--env <name>', 'Use environment profile from config (e.g. staging, prod)')
-    .option('--base-url <url>', 'Override base URL (e.g. https://staging.myapp.com)')
-    .option('--params <json>', 'JSON map of param overrides (e.g. \'{"id":"42"}\')')
+    .option('--env <name>', 'Use environment profile from config')
+    .option('--base-url <url>', 'Override base URL')
+    .option('--params <json>', 'JSON map of param overrides')
+    .option('--filter <pattern>', 'Only test paths matching pattern (glob or substring)')
+    .option('--dry-run', 'Preview endpoints and config without sending requests')
+    .option('--watch', 'Re-run checks when project files change')
+    .option('--openapi <file>', 'Use OpenAPI JSON file for route discovery')
     .option('--fail-on-slow', 'Exit with code 1 if any slow routes are found')
     .option('--concurrency <number>', 'How many requests to run in parallel (default: 1)')
-    .option('--body <json>', 'Default JSON body for POST/PUT/PATCH requests (e.g. \'{"name":"test"}\')')
+    .option('--body <json>', 'Default JSON body for POST/PUT/PATCH requests')
+    .option('--auth-flow', 'Execute auth flow from config to obtain token automatically')
+    .option('--save-baseline <filename>', 'Save results as baseline for future diffs (e.g. baseline)')
+    .option('--diff <filename>', 'Diff current results against a saved baseline (e.g. baseline.json)')
+    .option('--ci', 'CI mode: structured JSON to stdout, strict exit codes, no spinners')
+    .option('--session', 'Enable cookie jar — capture Set-Cookie from login and replay on requests')
     .action(async (options) => {
-    // Merge config file with CLI options (CLI takes precedence)
     const fileConfig = loadConfigFile(options.env);
     const configErrors = validateConfig(fileConfig);
     if (configErrors.length > 0) {
@@ -322,27 +658,31 @@ program
         process.exit(1);
     }
     const mergedOptions = { ...fileConfig, ...options };
+    const ciMode = !!mergedOptions.ci;
     const port = mergedOptions.port || '3000';
     const slowThreshold = parseIntOption(mergedOptions.slow, 'slow', 200, { min: 1 });
     const timeout = parseIntOption(mergedOptions.timeout, 'timeout', 5000, { min: 100 });
     const retryCount = parseIntOption(mergedOptions.retry, 'retry', 0, { min: 0, max: 10 });
+    const concurrency = parseIntOption(mergedOptions.concurrency, 'concurrency', 1, { min: 1, max: 50 });
     const onlyMethods = mergedOptions.only
         ? mergedOptions.only.split(',').map((m) => m.trim().toUpperCase())
         : null;
-    const paramOverrides = mergedOptions.params
-        ? (typeof mergedOptions.params === 'string'
-            ? JSON.parse(mergedOptions.params) // from CLI flag — parse it
-            : mergedOptions.params) // from config file — already an object
-        : (fileConfig.params || {});
-    const concurrency = parseIntOption(mergedOptions.concurrency, 'concurrency', 1, { min: 1, max: 50 });
+    const cliParams = mergedOptions.params
+        ? (typeof mergedOptions.params === 'string' ? JSON.parse(mergedOptions.params) : mergedOptions.params)
+        : {};
+    const paramOverrides = {
+        ...(fileConfig.params || {}),
+        ...(cliParams || {}),
+    };
     const defaultBody = mergedOptions.body
-        ? (typeof mergedOptions.body === 'string'
-            ? JSON.parse(mergedOptions.body)
-            : mergedOptions.body)
+        ? (typeof mergedOptions.body === 'string' ? JSON.parse(mergedOptions.body) : mergedOptions.body)
         : (fileConfig.body || null);
     const baseUrl = mergedOptions.baseUrl || mergedOptions['base-url'] || `http://localhost:${port}`;
     const discoveryUrl = `http://localhost:${port}/__apisnap_discovery`;
-    // Build headers
+    const useAuthFlow = !!(mergedOptions.authFlow || mergedOptions['auth-flow']);
+    const useSession = !!mergedOptions.session;
+    const watchMode = !!mergedOptions.watch;
+    let cachedEndpoints = null;
     const headerArgs = [
         ...(Array.isArray(mergedOptions.header) ? mergedOptions.header : []),
         ...(Array.isArray(fileConfig.headers) ? fileConfig.headers : []),
@@ -351,65 +691,131 @@ program
         ...parseHeaders(headerArgs),
         'User-Agent': `APISnap/${version}`,
     };
-    if (mergedOptions.cookie) {
+    if (mergedOptions.cookie)
         customHeaders['Cookie'] = mergedOptions.cookie;
+    let authMethod;
+    const cookieJar = new CookieJar();
+    if (useAuthFlow && fileConfig.authFlow) {
+        const authResult = await executeAuthFlow(fileConfig.authFlow, baseUrl, timeout);
+        if (authResult) {
+            customHeaders[authResult.headerName] = authResult.headerValue;
+            authMethod = 'auth-flow';
+        }
+    }
+    else if (headerArgs.some(h => /^authorization:/i.test(h))) {
+        authMethod = 'static-token';
     }
-    // ── Banner ──────────────────────────────────────────────────────────────
-    console.log(chalk_1.default.bold.cyan(`\n📸 APISnap v${version}`));
-    console.log(chalk_1.default.gray(`   Target:     ${baseUrl}`));
-    console.log(chalk_1.default.gray(`   Slow:       >${slowThreshold}ms`));
-    console.log(chalk_1.default.gray(`   Timeout:    ${timeout}ms`));
-    if (retryCount > 0)
-        console.log(chalk_1.default.gray(`   Retries:    ${retryCount}`));
-    if (concurrency > 1)
-        console.log(chalk_1.default.gray(`   Concurrency: ${concurrency}`));
-    if (defaultBody)
-        console.log(chalk_1.default.gray(`   Body:        ${JSON.stringify(defaultBody)}`));
-    if (Object.keys(customHeaders).filter(k => k !== 'User-Agent').length > 0) {
+    else if (mergedOptions.cookie) {
+        authMethod = 'cookie';
+    }
+    if (!ciMode) {
+        console.log(chalk_1.default.bold.cyan(`\n📸 APISnap v${version}`));
+        console.log(chalk_1.default.gray(`   Target:      ${baseUrl}`));
+        console.log(chalk_1.default.gray(`   Slow:        >${slowThreshold}ms`));
+        console.log(chalk_1.default.gray(`   Timeout:     ${timeout}ms`));
+        if (retryCount > 0)
+            console.log(chalk_1.default.gray(`   Retries:     ${retryCount} (exponential backoff)`));
+        if (concurrency > 1)
+            console.log(chalk_1.default.gray(`   Concurrency: ${concurrency}`));
+        if (defaultBody)
+            console.log(chalk_1.default.gray(`   Body:        ${JSON.stringify(defaultBody)}`));
+        if (authMethod)
+            console.log(chalk_1.default.gray(`   Auth:        ${authMethod}`));
+        if (useSession)
+            console.log(chalk_1.default.gray(`   Session:     cookie jar enabled`));
+        if (onlyMethods)
+            console.log(chalk_1.default.gray(`   Filter:      ${onlyMethods.join(', ')}`));
         const safeHeaders = { ...customHeaders };
-        // Mask auth tokens in output
         Object.keys(safeHeaders).forEach(k => {
-            if (/auth|token|key|secret|cookie/i.test(k)) {
+            if (/auth|token|key|secret|cookie/i.test(k))
                 safeHeaders[k] = safeHeaders[k].slice(0, 8) + '••••••';
-            }
         });
         delete safeHeaders['User-Agent'];
-        console.log(chalk_1.default.gray(`   Headers:    ${JSON.stringify(safeHeaders)}`));
+        if (Object.keys(safeHeaders).length > 0)
+            console.log(chalk_1.default.gray(`   Headers:     ${JSON.stringify(safeHeaders)}`));
+        console.log();
     }
-    if (onlyMethods)
-        console.log(chalk_1.default.gray(`   Filter:     ${onlyMethods.join(', ')}`));
-    console.log();
-    const spinner = (0, ora_1.default)('Connecting to discovery endpoint...').start();
+    const spinner = ciMode ? null : (0, ora_1.default)('Connecting to discovery endpoint...').start();
     const results = [];
     try {
-        // ── Discovery ───────────────────────────────────────────────────────
-        const discovery = await axios_1.default.get(discoveryUrl, { timeout: 5000 });
-        let { endpoints } = discovery.data;
-        // Filter by method if --only flag provided
+        let endpoints = [];
+        const openApiPath = mergedOptions.openapi ?? fileConfig.openapi;
+        if (openApiPath) {
+            const configuredPath = openApiPath === true ? './openapi.json' : String(openApiPath);
+            const resolvedOpenApi = path_1.default.isAbsolute(configuredPath)
+                ? configuredPath
+                : path_1.default.resolve(process.cwd(), configuredPath);
+            const openApiRaw = fs_1.default.readFileSync(resolvedOpenApi, 'utf-8');
+            const openApiSpec = JSON.parse(openApiRaw);
+            endpoints = parseOpenApiEndpoints(openApiSpec);
+            if (spinner)
+                spinner.succeed(chalk_1.default.green(`Loaded ${endpoints.length} endpoint${endpoints.length !== 1 ? 's' : ''} from OpenAPI spec.`));
+        }
+        else if (watchMode && cachedEndpoints) {
+            endpoints = cachedEndpoints;
+            if (spinner)
+                spinner.succeed(chalk_1.default.green(`Using cached discovery (${endpoints.length} endpoint${endpoints.length !== 1 ? 's' : ''}).`));
+        }
+        else {
+            const discovery = await axios_1.default.get(discoveryUrl, { timeout: 5000 });
+            endpoints = discovery.data.endpoints;
+            if (watchMode)
+                cachedEndpoints = endpoints;
+        }
+        if (fileConfig.skip?.length) {
+            endpoints = endpoints.filter((e) => !fileConfig.skip.some((s) => e.path.startsWith(s)));
+        }
         if (onlyMethods) {
             endpoints = endpoints.filter((e) => e.methods.some((m) => onlyMethods.includes(m)));
         }
-        spinner.succeed(chalk_1.default.green(`Connected! Found ${endpoints.length} endpoint${endpoints.length !== 1 ? 's' : ''} to test.\n`));
+        if (mergedOptions.filter) {
+            endpoints = endpoints.filter((e) => pathMatchesFilter(e.path, mergedOptions.filter));
+        }
+        if (spinner?.isSpinning)
+            spinner.succeed(chalk_1.default.green(`Connected! Found ${endpoints.length} endpoint${endpoints.length !== 1 ? 's' : ''} to test.\n`));
+        if (mergedOptions['dry-run']) {
+            if (!ciMode) {
+                console.log(chalk_1.default.bold('\n🧪 Dry Run Endpoints:\n'));
+                endpoints.forEach((e) => {
+                    const method = (e.methods?.[0] || 'GET').padEnd(7);
+                    const resolved = replacePath(e.path, paramOverrides);
+                    console.log(`  ${method} ${resolved}`);
+                });
+                console.log();
+            }
+            process.exit(0);
+        }
         let passed = 0, failed = 0, slow = 0;
         const allDurations = [];
-        // ── Test Each Endpoint ───────────────────────────────────────────────
-        // ── Build task list ───────────────────────────────────────────────────────
         const tasks = endpoints.map((endpoint) => async () => {
             const method = endpoint.methods[0];
             const rawPath = endpoint.path;
             const resolvedPath = replacePath(rawPath, paramOverrides);
             const fullUrl = `${baseUrl}${resolvedPath}`;
-            // Per-route body: check fileConfig.routes first, fall back to defaultBody
             const routeConfig = (fileConfig.routes || []).find((r) => r.path === rawPath || r.path === resolvedPath);
             const requestBody = routeConfig?.body ?? defaultBody;
+            const routeTimeout = routeConfig?.timeout ?? timeout;
+            const requestHeaders = { ...customHeaders };
+            if (routeConfig?.headers) {
+                Object.assign(requestHeaders, parseHeaders(routeConfig.headers));
+            }
+            if (routeConfig?.auth === 'none') {
+                delete requestHeaders['Authorization'];
+                delete requestHeaders['Cookie'];
+            }
+            if (useSession && cookieJar.has() && routeConfig?.auth !== 'none') {
+                const existing = requestHeaders['Cookie'] || '';
+                requestHeaders['Cookie'] = [existing, cookieJar.toString()].filter(Boolean).join('; ');
+            }
             const testResult = {
                 method, path: rawPath, fullUrl,
                 status: 0, statusText: '', duration: 0,
                 success: false, slow: false, retries: 0,
+                authMethod: routeConfig?.auth === 'none' ? 'none' : authMethod,
             };
-            const testSpinner = (0, ora_1.default)({
+            const testSpinner = (ciMode || concurrency > 1) ? null : (0, ora_1.default)({
                 text: `${chalk_1.default.bold(method.padEnd(7))} ${chalk_1.default.dim(rawPath)}`,
-                prefixText: '  '
+                prefixText: '  ',
             }).start();
             let lastError = null;
             let attempt = 0;
@@ -419,13 +825,22 @@ program
                     const res = await (0, axios_1.default)({
                         method,
                         url: fullUrl,
-                        headers: customHeaders,
-                        timeout,
+                        headers: requestHeaders,
+                        timeout: routeTimeout,
                         validateStatus: () => true,
-                        // Only send body for methods that accept one
                         data: ['POST', 'PUT', 'PATCH'].includes(method) ? requestBody : undefined,
                     });
                     const duration = Date.now() - start;
+                    if (res.status === 429) {
+                        const retryAfterMs = parseRetryAfterMs(res.headers['retry-after']);
+                        if (!ciMode) {
+                            process.stdout.write(chalk_1.default.gray(`     rate-limited — waiting ${retryAfterMs}ms...\n`));
+                        }
+                        await sleep(retryAfterMs);
+                        continue;
+                    }
+                    if (useSession)
+                        cookieJar.ingest(res.headers['set-cookie']);
                     testResult.duration = duration;
                     testResult.status = res.status;
                     testResult.statusText = res.statusText;
@@ -437,34 +852,41 @@ program
                         const durationStr = testResult.slow
                             ? chalk_1.default.yellow.bold(`${duration}ms ← slow!`)
                             : chalk_1.default.gray(`${duration}ms`);
-                        const msg = `${chalk_1.default.bold(method.padEnd(7))} ${chalk_1.default.white(rawPath.padEnd(35))} ` +
-                            `${chalk_1.default.green(`[${res.status}]`)} ${durationStr}`;
-                        testResult.slow ? testSpinner.warn(msg) : testSpinner.succeed(msg);
+                        const msg = `${chalk_1.default.bold(method.padEnd(7))} ${chalk_1.default.white(rawPath.padEnd(35))} ${chalk_1.default.green(`[${res.status}]`)} ${durationStr}`;
+                        if (testSpinner)
+                            testResult.slow ? testSpinner.warn(msg) : testSpinner.succeed(msg);
                         passed++;
                         if (testResult.slow)
                             slow++;
                     }
                     else {
-                        testSpinner.fail(`${chalk_1.default.bold(method.padEnd(7))} ${chalk_1.default.white(rawPath.padEnd(35))} ` +
-                            `${chalk_1.default.red(`[${res.status} ${res.statusText}]`)} ${chalk_1.default.gray(`${duration}ms`)}`);
+                        if (testSpinner)
+                            testSpinner.fail(`${chalk_1.default.bold(method.padEnd(7))} ${chalk_1.default.white(rawPath.padEnd(35))} ${chalk_1.default.red(`[${res.status} ${res.statusText}]`)} ${chalk_1.default.gray(`${duration}ms`)}`);
                         const paramNames = [...rawPath.matchAll(/:([a-zA-Z0-9_]+)/g)].map(match => match[1]);
-                        const exampleParams = paramNames.reduce((acc, paramName) => ({ ...acc, [paramName]: '1' }), {});
-                        if (res.status === 401 || res.status === 403) {
-                            const hint = res.status === 401
-                                ? 'No credentials sent — add to .apisnaprc: "headers": ["Authorization: Bearer TOKEN"]'
-                                : 'Token lacks permission for this route';
-                            console.log(chalk_1.default.yellow(`     hint: ${hint}`));
-                        }
-                        else if (res.status === 404 && paramNames.length > 0) {
-                            console.log(chalk_1.default.yellow('     hint: path needs params — add to .apisnaprc:'));
-                            console.log(chalk_1.default.gray(`       "params": ${JSON.stringify(exampleParams)}`));
-                        }
-                        else if (res.status === 404) {
-                            console.log(chalk_1.default.yellow('     hint: route not found — is the server fully started?'));
-                        }
-                        else if (res.status === 400 || res.status === 422) {
-                            console.log(chalk_1.default.yellow('     hint: add a request body to .apisnaprc under "routes":'));
-                            console.log(chalk_1.default.gray(`       { "path": "${rawPath}", "body": {"field": "value"} }`));
+                        const exampleParams = paramNames.reduce((acc, p) => ({ ...acc, [p]: '1' }), {});
+                        if (!ciMode) {
+                            if (res.status === 401) {
+                                if (useAuthFlow) {
+                                    console.log(chalk_1.default.yellow('     hint: auth flow ran but this route still returned 401 — check token permissions'));
+                                }
+                                else {
+                                    console.log(chalk_1.default.yellow('     hint: No credentials — use --auth-flow or add "headers" / "authFlow" to .apisnaprc'));
+                                }
+                            }
+                            else if (res.status === 403) {
+                                console.log(chalk_1.default.yellow('     hint: Token lacks permission for this route — check RBAC/scopes'));
+                            }
+                            else if (res.status === 404 && paramNames.length > 0) {
+                                console.log(chalk_1.default.yellow('     hint: path needs params — add to .apisnaprc:'));
+                                console.log(chalk_1.default.gray(`       "params": ${JSON.stringify(exampleParams)}`));
+                            }
+                            else if (res.status === 404) {
+                                console.log(chalk_1.default.yellow('     hint: route not found — is the server fully started?'));
+                            }
+                            else if (res.status === 400 || res.status === 422) {
+                                console.log(chalk_1.default.yellow('     hint: add a request body to .apisnaprc under "routes":'));
+                                console.log(chalk_1.default.gray(`       { "path": "${rawPath}", "body": {"field": "value"} }`));
+                            }
                         }
                         failed++;
                     }
@@ -474,42 +896,37 @@ program
                 catch (err) {
                     lastError = err;
                     attempt++;
-                    if (attempt <= retryCount)
-                        await new Promise(r => setTimeout(r, 500 * attempt));
+                    if (attempt <= retryCount) {
+                        const delay = backoffDelay(attempt - 1);
+                        if (!ciMode)
+                            process.stdout.write(chalk_1.default.gray(`     ↺ retry ${attempt}/${retryCount} in ${Math.round(delay)}ms...\n`));
+                        await new Promise(r => setTimeout(r, delay));
+                    }
                 }
             }
             if (lastError) {
                 testResult.success = false;
                 testResult.retries = attempt - 1;
                 testResult.error = lastError.code === 'ECONNABORTED' ? 'Timeout' : lastError.message;
-                testSpinner.fail(`${chalk_1.default.bold(method.padEnd(7))} ${chalk_1.default.white(rawPath.padEnd(35))} ` +
-                    chalk_1.default.red(`[${testResult.error}]`));
+                if (testSpinner)
+                    testSpinner.fail(`${chalk_1.default.bold(method.padEnd(7))} ${chalk_1.default.white(rawPath.padEnd(35))} ${chalk_1.default.red(`[${testResult.error}]`)}`);
                 failed++;
             }
             return testResult;
         });
-        // ── Run with concurrency limit ────────────────────────────────────────────
         const allResults = await runWithConcurrency(tasks, concurrency);
         for (let i = 0; i < allResults.length; i++) {
             const result = allResults[i];
             if (result instanceof Error) {
-                const endpoint = endpoints[i];
-                const method = endpoint?.methods?.[0] || 'UNKNOWN';
-                const rawPath = endpoint?.path || '(unknown route)';
-                const resolvedPath = replacePath(rawPath, paramOverrides);
-                const fullUrl = `${baseUrl}${resolvedPath}`;
-                console.error(chalk_1.default.red(`  Internal error on task ${i}: ${result.message}`));
+                const ep = endpoints[i];
+                const method = ep?.methods?.[0] || 'UNKNOWN';
+                const rawPath = ep?.path || '(unknown route)';
                 results.push({
-                    method,
-                    path: rawPath,
-                    fullUrl,
-                    status: 0,
-                    statusText: 'Internal Error',
-                    duration: 0,
-                    success: false,
-                    slow: false,
-                    error: `Internal task failure: ${result.message}`,
-                    retries: 0,
+                    method, path: rawPath,
+                    fullUrl: `${baseUrl}${replacePath(rawPath, paramOverrides)}`,
+                    status: 0, statusText: 'Internal Error', duration: 0,
+                    success: false, slow: false,
+                    error: `Internal task failure: ${result.message}`, retries: 0,
                 });
                 failed++;
             }
@@ -517,67 +934,113 @@ program
                 results.push(result);
             }
         }
-        // ── Summary ──────────────────────────────────────────────────────────
-        const avgDuration = allDurations.length > 0
-            ? Math.round(allDurations.reduce((a, b) => a + b, 0) / allDurations.length)
-            : 0;
-        const totalDuration = allDurations.reduce((a, b) => a + b, 0);
-        console.log(chalk_1.default.bold('\n📊 Summary:'));
-        console.log(`  ${chalk_1.default.green('✅ Passed: ')} ${chalk_1.default.bold(passed)}`);
-        console.log(`  ${chalk_1.default.red('❌ Failed: ')} ${chalk_1.default.bold(failed)}`);
-        console.log(`  ${chalk_1.default.yellow('⚠️  Slow:   ')} ${chalk_1.default.bold(slow)} (>${slowThreshold}ms)`);
-        console.log(`  ${chalk_1.default.cyan('⏱  Avg:    ')} ${chalk_1.default.bold(avgDuration + 'ms')}`);
-        console.log(`  ${chalk_1.default.cyan('🕐 Total:  ')} ${chalk_1.default.bold(totalDuration + 'ms')}`);
-        if (failed > 0) {
-            console.log(chalk_1.default.red.bold('\n⚠️  Some endpoints are unhealthy!'));
-        }
-        else if (slow > 0) {
-            console.log(chalk_1.default.yellow.bold('\n🐢 All alive, but some routes are slow!'));
+        if (!ciMode && concurrency > 1) {
+            for (const r of results) {
+                const statusLabel = r.success
+                    ? chalk_1.default.green(`[${r.status}]`)
+                    : chalk_1.default.red(`[${r.status || 'ERR'} ${r.statusText || ''}]`);
+                const durationLabel = r.slow
+                    ? chalk_1.default.yellow.bold(`${r.duration}ms ← slow!`)
+                    : chalk_1.default.gray(`${r.duration}ms`);
+                console.log(`  ${chalk_1.default.bold(r.method.padEnd(7))} ${chalk_1.default.white(r.path.padEnd(35))} ${statusLabel} ${durationLabel}`.trimEnd());
+                if (!r.success && r.error) {
+                    console.log(chalk_1.default.gray(`     ${r.error}`));
+                }
+            }
         }
-        else {
-            console.log(chalk_1.default.green.bold('\n✨ All systems nominal!'));
-        }
-        // ── Auth Troubleshooting Summary ─────────────────────────────────────
-        const authFailures = results.filter(r => r.status === 401 || r.status === 403);
-        if (authFailures.length > 0 && !headerArgs.length && !mergedOptions.cookie) {
-            console.log(chalk_1.default.bgYellow.black.bold('\n🔐 Auth Help'));
-            console.log(chalk_1.default.yellow('  You have ' + authFailures.length + ' auth failure(s) and no credentials were provided.'));
-            console.log(chalk_1.default.yellow('  Solutions:'));
-            console.log(chalk_1.default.gray('    JWT:     apisnap -H "Authorization: Bearer YOUR_JWT_TOKEN"'));
-            console.log(chalk_1.default.gray('    API Key: apisnap -H "x-api-key: YOUR_KEY"'));
-            console.log(chalk_1.default.gray('    Cookie:  apisnap --cookie "sessionId=abc123"'));
-            console.log(chalk_1.default.gray('    Multi:   apisnap -H "Authorization: Bearer TOKEN" -H "x-tenant: acme"'));
-            console.log(chalk_1.default.gray('    Config:  create .apisnaprc.json  (see README)\n'));
-        }
-        // ── Exports ──────────────────────────────────────────────────────────
+        const avgDuration = allDurations.length > 0 ? Math.round(allDurations.reduce((a, b) => a + b, 0) / allDurations.length) : 0;
+        const totalDuration = allDurations.reduce((a, b) => a + b, 0);
+        const sortedDurations = [...allDurations].sort((a, b) => a - b);
+        const p50Duration = percentile(sortedDurations, 50);
+        const p95Duration = percentile(sortedDurations, 95);
+        const p99Duration = percentile(sortedDurations, 99);
         const reportData = {
             tool: 'APISnap', version,
             generatedAt: new Date().toISOString(),
             config: { port, baseUrl, slowThreshold, timeout, headers: Object.keys(customHeaders).filter(k => k !== 'User-Agent') },
-            summary: { total: endpoints.length, passed, failed, slow, avgDuration, totalDuration },
+            summary: { total: endpoints.length, passed, failed, slow, avgDuration, totalDuration, p50Duration, p95Duration, p99Duration },
             results,
         };
+        const diffFile = mergedOptions.diff;
+        let diff = null;
+        if (diffFile) {
+            const diffPath = diffFile.endsWith('.json') ? diffFile : `${diffFile}.json`;
+            diff = diffAgainstBaseline(reportData, diffPath);
+            if (diff)
+                printDiffReport(diff);
+        }
+        if (!ciMode) {
+            console.log(chalk_1.default.bold('\n📊 Summary:'));
+            console.log(`  ${chalk_1.default.green('✅ Passed: ')} ${chalk_1.default.bold(passed)}`);
+            console.log(`  ${chalk_1.default.red('❌ Failed: ')} ${chalk_1.default.bold(failed)}`);
+            console.log(`  ${chalk_1.default.yellow('⚠️  Slow:   ')} ${chalk_1.default.bold(slow)} (>${slowThreshold}ms)`);
+            console.log(`  ${chalk_1.default.cyan('⏱  Avg:    ')} ${chalk_1.default.bold(avgDuration + 'ms')}`);
+            console.log(`  ${chalk_1.default.cyan('📈 p50:    ')} ${chalk_1.default.bold(p50Duration + 'ms')}`);
+            console.log(`  ${chalk_1.default.cyan('📈 p95:    ')} ${chalk_1.default.bold(p95Duration + 'ms')}`);
+            console.log(`  ${chalk_1.default.cyan('📈 p99:    ')} ${chalk_1.default.bold(p99Duration + 'ms')}`);
+            console.log(`  ${chalk_1.default.cyan('🕐 Total:  ')} ${chalk_1.default.bold(totalDuration + 'ms')}`);
+            if (failed > 0)
+                console.log(chalk_1.default.red.bold('\n⚠️  Some endpoints are unhealthy!'));
+            else if (slow > 0)
+                console.log(chalk_1.default.yellow.bold('\n🐢 All alive, but some routes are slow!'));
+            else
+                console.log(chalk_1.default.green.bold('\n✨ All systems nominal!'));
+            const authFailures = results.filter(r => r.status === 401 || r.status === 403);
+            if (authFailures.length > 0 && !headerArgs.length && !mergedOptions.cookie && !useAuthFlow) {
+                console.log(chalk_1.default.bgYellow.black.bold('\n🔐 Auth Help'));
+                console.log(chalk_1.default.yellow(`  You have ${authFailures.length} auth failure(s) and no credentials were provided.`));
+                console.log(chalk_1.default.yellow('  Solutions:'));
+                console.log(chalk_1.default.gray('    Auto-login:  add "authFlow" to .apisnaprc + run: apisnap --auth-flow'));
+                console.log(chalk_1.default.gray('    JWT:         apisnap -H "Authorization: Bearer YOUR_JWT_TOKEN"'));
+                console.log(chalk_1.default.gray('    API Key:     apisnap -H "x-api-key: YOUR_KEY"'));
+                console.log(chalk_1.default.gray('    Cookie:      apisnap --cookie "sessionId=abc123"'));
+                console.log(chalk_1.default.gray('    Session:     apisnap --session  (auto cookie jar)\n'));
+            }
+        }
+        const saveBaselineFlag = mergedOptions.saveBaseline || mergedOptions['save-baseline'];
+        if (saveBaselineFlag) {
+            const bp = saveBaselineFlag.endsWith('.json') ? saveBaselineFlag : `${saveBaselineFlag}.json`;
+            fs_1.default.writeFileSync(bp, JSON.stringify(reportData, null, 2));
+            if (!ciMode)
+                console.log(chalk_1.default.cyan(`\n💾 Baseline saved → ${chalk_1.default.white(bp)}`));
+        }
         if (mergedOptions.export) {
-            const filePath = mergedOptions.export.endsWith('.json') ? mergedOptions.export : `${mergedOptions.export}.json`;
-            fs_1.default.writeFileSync(filePath, JSON.stringify(reportData, null, 2));
-            console.log(chalk_1.default.cyan(`\n💾 JSON report → ${chalk_1.default.white(filePath)}`));
+            const fp = mergedOptions.export.endsWith('.json') ? mergedOptions.export : `${mergedOptions.export}.json`;
+            fs_1.default.writeFileSync(fp, JSON.stringify(reportData, null, 2));
+            if (!ciMode)
+                console.log(chalk_1.default.cyan(`\n💾 JSON report → ${chalk_1.default.white(fp)}`));
         }
         if (mergedOptions.html) {
-            const filePath = mergedOptions.html.endsWith('.html') ? mergedOptions.html : `${mergedOptions.html}.html`;
-            fs_1.default.writeFileSync(filePath, generateHTMLReport(reportData));
-            console.log(chalk_1.default.cyan(`🌐 HTML report → ${chalk_1.default.white(filePath)}`));
+            const fp = mergedOptions.html.endsWith('.html') ? mergedOptions.html : `${mergedOptions.html}.html`;
+            await writeHTMLReport(fp, reportData, diff);
+            if (!ciMode)
+                console.log(chalk_1.default.cyan(`🌐 HTML report → ${chalk_1.default.white(fp)}`));
+        }
+        if (ciMode) {
+            const ciOutput = {
+                ...reportData,
+                diff: diff ?? undefined,
+                exitCode: (failed > 0 || (mergedOptions['fail-on-slow'] && slow > 0) || (diff?.regressions?.length ?? 0) > 0) ? 1 : 0,
+            };
+            process.stdout.write(JSON.stringify(ciOutput, null, 2) + '\n');
         }
         console.log();
-        // Exit codes for CI/CD
-        const shouldFail = failed > 0 || (mergedOptions['fail-on-slow'] && slow > 0);
+        const hasRegressions = diff?.regressions?.length ?? 0;
+        const shouldFail = failed > 0
+            || (mergedOptions['fail-on-slow'] && slow > 0)
+            || (hasRegressions > 0);
         process.exit(shouldFail ? 1 : 0);
     }
     catch (error) {
-        spinner.fail(chalk_1.default.red('Could not connect to your server.'));
+        if (spinner)
+            spinner.fail(chalk_1.default.red('Could not connect to your server.'));
         const isRefused = error?.code === 'ECONNREFUSED';
         const isTimeout = error?.code === 'ECONNABORTED' || error?.code === 'ETIMEDOUT';
         const isNoInit = error?.response?.status === 404;
-        if (isRefused) {
+        if (ciMode) {
+            process.stdout.write(JSON.stringify({ error: error.message, code: error.code }) + '\n');
+        }
+        else if (isRefused) {
             console.log(chalk_1.default.yellow(`\n  Your server is not running on port ${port}.`));
             console.log(chalk_1.default.gray('  → Start it first, then run apisnap again.\n'));
         }
@@ -588,7 +1051,7 @@ program
         else if (isNoInit) {
             console.log(chalk_1.default.yellow('\n  Server is running but APISnap middleware not found.'));
             console.log(chalk_1.default.gray('  → Add this to your server AFTER your routes:\n'));
-            console.log(chalk_1.default.cyan('      const apisnap = require(\'@umeshindu222/apisnap\');'));
+            console.log(chalk_1.default.cyan("      const apisnap = require('@umeshindu222/apisnap');"));
             console.log(chalk_1.default.cyan('      apisnap.init(app);\n'));
         }
         else {
@@ -600,7 +1063,6 @@ program
         process.exit(1);
     }
 });
-// Allows -H to be used multiple times
 function collect(val, prev) {
     return prev.concat([val]);
 }