integration-tour 1.0.8 → 1.0.9

package/dist/cli.js

@@ -5286,6 +5286,18 @@ function credentialName(name) {
   if (/^key$/i.test(name.trim()) || /(type|kind|url|uri|endpoint|expires?(_?(in|at))?|name|count|length|hint|prefix)$/i.test(name)) return false;
   return secretName(name) || /(^|[^a-z])auth([^a-z]|$)/i.test(name);
 }
+var BOT_TOKEN = /^bot\d{5,}:[\w-]{30,}$/;
+var PREFIXED_ID = /^[a-z]{1,10}_/;
+function pathSecret(segment) {
+  const s = segment.trim();
+  if (BOT_TOKEN.test(s)) return "bot_token";
+  if (SECRET_VALUE.test(s)) return "token";
+  const random = s.length >= 24 && /^[A-Za-z0-9_\-.~:]+$/.test(s) && /[a-z]/.test(s) && /[A-Z]/.test(s) && /\d/.test(s);
+  return random && !PREFIXED_ID.test(s) ? "token" : void 0;
+}
+function withoutUserinfo(address) {
+  return address.replace(/^([a-z][a-z\d+.-]*:\/\/)?[^/@\s]*@/i, (_, scheme) => scheme ?? "");
+}
 function hiddenAs(name) {
   return /passw(or)?d|pwd/i.test(name) ? "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" : placeholder(name || "secret");
 }
@@ -5422,7 +5434,7 @@ function decoded(text3) {
 }
 var LOCAL_HOST = /^(localhost|127\.\d+\.\d+\.\d+|0\.0\.0\.0|\[::1\])(:|\/|$)/i;
 function serverOf(url, vars, unset) {
-  let host = vars.fill(url.host, false).trim();
+  let host = withoutUserinfo(vars.fill(url.host, false).trim());
   const left = [...host.matchAll(VARIABLE)].map((m) => m[1].trim());
   for (const name of left) unset.add(name);
   if (left.length) {
@@ -5438,7 +5450,7 @@ function serverOf(url, vars, unset) {
   return `${protocol}://${host}${url.port ? `:${vars.fill(url.port, false)}` : ""}`.replace(/\/+$/, "");
 }
 var VERSION = /^(v\d+(\.\d+)*|\d{4}-\d{2}-\d{2})$/i;
-function pathOf(url, vars, params) {
+function pathOf(url, vars, params, hid) {
   const segments = url.path.map((s) => s.trim()).filter(Boolean);
   const out = segments.map((segment) => {
     const colon = segment.match(/^:([A-Za-z_][\w-]*)(.*)$/);
@@ -5447,6 +5459,14 @@ function pathOf(url, vars, params) {
       if (!params.has(name)) params.set(name, colonParam(name, url.variables, vars));
       return `{${name}}${vars.fill(rest, false)}`;
     }
+    const secret = segment.includes("{{") ? void 0 : pathSecret(decoded(segment));
+    if (secret) {
+      let param = secret;
+      for (let n = 2; params.has(param); n++) param = `${secret}_${n}`;
+      params.set(param, { name: param, in: "path", required: true, schema: { type: "string" }, example: placeholder(param) });
+      hid.add(param);
+      return `{${param}}`;
+    }
     return segment.replace(VARIABLE, (whole, raw) => {
       const name = raw.trim();
       const value = vars.value(name, false);
@@ -5861,7 +5881,7 @@ function convertPostman(raw, environments = [], source) {
     const method = FIXED_METHODS.has(rawMethod.toLowerCase()) ? rawMethod.toLowerCase() : rawMethod.toUpperCase();
     const server = serverOf(url, vars, unsetHosts);
     const pathParams = /* @__PURE__ */ new Map();
-    let path = pathOf(url, vars, pathParams);
+    let path = pathOf(url, vars, pathParams, hid);
     const shape = path.replace(/\{[^}]+\}/g, "{}");
     const known = shapes.get(shape);
     if (known && known !== path) {
@@ -11051,7 +11071,7 @@ function unknownKeys(raw, known, where, problems) {
 }
 
 // package.json
-var version = "1.0.8";
+var version = "1.0.9";
 
 // src/files.ts
 var import_node_fs = require("node:fs");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "integration-tour",
-  "version": "1.0.8",
+  "version": "1.0.9",
   "description": "Renders integration videos of your API or MCP server from its OpenAPI spec or tools, in your own build, so they stay in step with it.",
   "keywords": [
     "openapi",