lacspace-http 0.1.0

package/dist/cli.js

@@ -0,0 +1,1284 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { stdout, stderr, argv, exit, env } from "process";
+import { readFileSync, writeFileSync } from "fs";
+
+// src/request.ts
+function parseHeaderStrings(raw) {
+  const out = [];
+  for (const h of raw) {
+    const colon = h.indexOf(":");
+    if (colon === -1) continue;
+    out.push([h.slice(0, colon).trim(), h.slice(colon + 1).trim()]);
+  }
+  return out;
+}
+function hasHeader(headers, name) {
+  return headers.some(([k]) => k.toLowerCase() === name.toLowerCase());
+}
+function coerceKvValue(raw, rawJson) {
+  if (rawJson) {
+    try {
+      return JSON.parse(raw);
+    } catch {
+      return raw;
+    }
+  }
+  return raw;
+}
+function base64(input) {
+  return Buffer.from(input, "utf8").toString("base64");
+}
+function assembleRequest(url, o = {}) {
+  const headers = parseHeaderStrings(o.headers ?? []);
+  let finalUrl = url;
+  if (o.query && o.query.length) {
+    const qs = [];
+    for (const q of o.query) {
+      const eq = q.indexOf("=");
+      const k = eq === -1 ? q : q.slice(0, eq);
+      const v = eq === -1 ? "" : q.slice(eq + 1);
+      qs.push(`${encodeURIComponent(k)}=${encodeURIComponent(v)}`);
+    }
+    const joined = qs.join("&");
+    finalUrl += (url.includes("?") ? "&" : "?") + joined;
+  }
+  let body;
+  let contentType;
+  if (o.json !== void 0) {
+    body = o.json;
+    contentType = "application/json";
+  } else if (o.jsonKv && o.jsonKv.length) {
+    const obj = {};
+    for (const pair of o.jsonKv) {
+      const rawJson = pair.includes(":=");
+      const sep = rawJson ? ":=" : "=";
+      const idx = pair.indexOf(sep);
+      if (idx === -1) continue;
+      const k = pair.slice(0, idx);
+      const v = pair.slice(idx + sep.length);
+      obj[k] = coerceKvValue(v, rawJson);
+    }
+    body = JSON.stringify(obj);
+    contentType = "application/json";
+  } else if (o.form && o.form.length) {
+    const params = new URLSearchParams();
+    for (const f of o.form) {
+      const eq = f.indexOf("=");
+      params.append(eq === -1 ? f : f.slice(0, eq), eq === -1 ? "" : f.slice(eq + 1));
+    }
+    body = params.toString();
+    contentType = "application/x-www-form-urlencoded";
+  } else if (o.data !== void 0) {
+    body = o.data;
+  }
+  if (contentType && !hasHeader(headers, "content-type")) {
+    headers.push(["Content-Type", contentType]);
+  }
+  if (o.bearer && !hasHeader(headers, "authorization")) {
+    headers.push(["Authorization", `Bearer ${o.bearer}`]);
+  } else if (o.user && !hasHeader(headers, "authorization")) {
+    headers.push(["Authorization", `Basic ${base64(o.user)}`]);
+  }
+  const method = (o.method ?? (body !== void 0 ? "POST" : "GET")).toUpperCase();
+  const spec = { method, url: finalUrl, headers };
+  if (body !== void 0) spec.body = body;
+  return spec;
+}
+var REDIRECT_STATUS = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
+function headersToObject(h) {
+  const out = {};
+  if (h && typeof h.forEach === "function") {
+    h.forEach((v, k) => {
+      out[k.toLowerCase()] = v;
+    });
+  } else if (h && typeof h === "object") {
+    for (const [k, v] of Object.entries(h)) out[k.toLowerCase()] = String(v);
+  }
+  return out;
+}
+async function readCapped(res, maxSize) {
+  const body = res.body;
+  if (!body || typeof body.getReader !== "function") {
+    const text = await res.text();
+    const buf2 = Buffer.from(text, "utf8");
+    if (buf2.length > maxSize) {
+      return { text: buf2.subarray(0, maxSize).toString("utf8"), size: maxSize, truncated: true };
+    }
+    return { text, size: buf2.length, truncated: false };
+  }
+  const reader = body.getReader();
+  const chunks = [];
+  let size = 0;
+  let truncated = false;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    if (value) {
+      chunks.push(Buffer.from(value));
+      size += value.byteLength;
+      if (size > maxSize) {
+        truncated = true;
+        try {
+          await reader.cancel();
+        } catch {
+        }
+        break;
+      }
+    }
+  }
+  let buf = Buffer.concat(chunks);
+  if (truncated) buf = buf.subarray(0, maxSize);
+  return { text: buf.toString("utf8"), size: buf.length, truncated };
+}
+function looksJson(contentType, text) {
+  if (contentType && /\bjson\b/i.test(contentType)) return true;
+  const t = text.trimStart();
+  return t.startsWith("{") || t.startsWith("[");
+}
+function hostOf(url) {
+  try {
+    return new URL(url).host;
+  } catch {
+    return "";
+  }
+}
+async function sendRequest(spec, opts = {}) {
+  const timeoutMs = opts.timeoutMs ?? 3e4;
+  const maxSize = opts.maxSize ?? 10 * 1024 * 1024;
+  const maxRedirects = opts.maxRedirects ?? 5;
+  const follow = opts.followRedirects ?? true;
+  const doFetch = opts.fetchImpl ?? globalThis.fetch;
+  if (typeof doFetch !== "function") {
+    throw new Error("global fetch is unavailable \u2014 Node 20+ (or a fetchImpl) is required.");
+  }
+  const originHost = hostOf(spec.url);
+  let currentUrl = spec.url;
+  let method = spec.method;
+  let body = spec.body;
+  const redirectChain = [];
+  let crossHost = false;
+  const start = Date.now();
+  for (let hop = 0; ; hop++) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    let res;
+    try {
+      res = await doFetch(currentUrl, {
+        method,
+        headers: spec.headers,
+        ...body !== void 0 ? { body } : {},
+        redirect: "manual",
+        signal: controller.signal
+      });
+    } catch (err) {
+      clearTimeout(timer);
+      if (err?.name === "AbortError") {
+        throw new Error(`Request timed out after ${timeoutMs}ms: ${currentUrl}`);
+      }
+      throw err;
+    }
+    clearTimeout(timer);
+    const location = res.headers.get?.("location") ?? void 0;
+    if (follow && REDIRECT_STATUS.has(res.status) && location && hop < maxRedirects) {
+      const nextUrl = new URL(location, currentUrl).toString();
+      if (hostOf(nextUrl) !== originHost) crossHost = true;
+      redirectChain.push(currentUrl);
+      if (res.status === 303 || (res.status === 301 || res.status === 302) && method === "POST") {
+        method = "GET";
+        body = void 0;
+      }
+      currentUrl = nextUrl;
+      try {
+        await res.text();
+      } catch {
+      }
+      continue;
+    }
+    const headers = headersToObject(res.headers);
+    const { text, size, truncated } = await readCapped(res, maxSize);
+    const timeMs = Date.now() - start;
+    const record = {
+      status: res.status,
+      statusText: res.statusText || "",
+      headers,
+      timeMs,
+      size,
+      body: text,
+      url: currentUrl,
+      redirected: redirectChain.length > 0,
+      redirectChain,
+      ok: res.status >= 200 && res.status < 300,
+      truncated,
+      crossHostRedirect: crossHost
+    };
+    if (looksJson(headers["content-type"], text)) {
+      try {
+        record.json = JSON.parse(text);
+      } catch {
+      }
+    }
+    return record;
+  }
+}
+function shq(s) {
+  return `'${s.replace(/'/g, `'\\''`)}'`;
+}
+function toCurl(spec, opts = {}) {
+  const parts = ["curl"];
+  if (spec.method !== "GET") parts.push("-X", spec.method);
+  for (const [k, v] of spec.headers) {
+    let value = v;
+    if (!opts.showSecrets && k.toLowerCase() === "authorization") {
+      const scheme = v.split(/\s+/)[0] ?? "";
+      value = /^(Bearer|Basic)$/i.test(scheme) ? `${scheme} ***` : "***";
+    }
+    parts.push("-H", shq(`${k}: ${value}`));
+  }
+  if (spec.body !== void 0) parts.push("--data-raw", shq(spec.body));
+  if (opts.followRedirects === false) {
+  } else {
+    parts.push("-L");
+    if (opts.maxRedirects !== void 0) parts.push("--max-redirs", String(opts.maxRedirects));
+  }
+  parts.push(shq(spec.url));
+  return parts.join(" ");
+}
+
+// src/httpfile.ts
+var METHODS = /* @__PURE__ */ new Set([
+  "GET",
+  "HEAD",
+  "POST",
+  "PUT",
+  "PATCH",
+  "DELETE",
+  "OPTIONS",
+  "TRACE",
+  "CONNECT"
+]);
+function isSeparator(line) {
+  return /^###/.test(line.trim());
+}
+function isComment(line) {
+  const t = line.trim();
+  return t.startsWith("#") || t.startsWith("//");
+}
+function commentBody(line) {
+  const t = line.trim();
+  if (t.startsWith("//")) return t.slice(2).trim();
+  return t.replace(/^#+/, "").trim();
+}
+function parseRequestLine(line) {
+  const parts = line.trim().split(/\s+/);
+  let method = "GET";
+  let rest = parts;
+  const first = (parts[0] ?? "").toUpperCase();
+  if (METHODS.has(first)) {
+    method = first;
+    rest = parts.slice(1);
+  }
+  if (rest.length > 1 && /^HTTP\/\d/i.test(rest[rest.length - 1])) rest = rest.slice(0, -1);
+  const url = rest.join(" ").trim();
+  return { method, url };
+}
+function parseHttpFile(source) {
+  const rawLines = source.split(/\r?\n/);
+  const blocks = [];
+  let current = { start: 0, lines: [] };
+  rawLines.forEach((line, idx) => {
+    if (isSeparator(line)) {
+      blocks.push(current);
+      current = { start: idx + 1, lines: [] };
+    } else {
+      current.lines.push(line);
+    }
+  });
+  blocks.push(current);
+  const requests = [];
+  for (const block of blocks) {
+    const req = parseBlock(block.lines, block.start);
+    if (req) requests.push(req);
+  }
+  return requests;
+}
+function parseBlock(lines, startLine) {
+  let name;
+  const captures = [];
+  const assertions = [];
+  let i = 0;
+  for (; i < lines.length; i++) {
+    const line = lines[i];
+    if (line.trim() === "") continue;
+    if (!isComment(line)) break;
+    const body2 = commentBody(line);
+    const at = /^@(\w+)\s*(.*)$/.exec(body2);
+    if (at) {
+      const directive2 = at[1].toLowerCase();
+      const arg = at[2].trim();
+      if (directive2 === "name") name = arg.replace(/^=?\s*/, "").trim() || void 0;
+      else if (directive2 === "capture") {
+        const eq = arg.indexOf("=");
+        if (eq !== -1) {
+          const cname = arg.slice(0, eq).trim();
+          const source = arg.slice(eq + 1).trim();
+          if (cname && source) captures.push({ name: cname, source });
+        }
+      } else if (directive2 === "assert") {
+        if (arg) assertions.push({ expr: arg });
+      }
+    }
+  }
+  for (; i < lines.length; i++) {
+    if (lines[i].trim() === "") continue;
+    break;
+  }
+  if (i >= lines.length) return void 0;
+  const requestLineIdx = i;
+  const { method, url: firstUrl } = parseRequestLine(lines[i]);
+  i++;
+  let url = firstUrl;
+  while (i < lines.length) {
+    const raw = lines[i];
+    const t = raw.trim();
+    if (t !== "" && /^[?&]/.test(t) && /^\s/.test(raw)) {
+      url += t;
+      i++;
+    } else break;
+  }
+  const headers = [];
+  for (; i < lines.length; i++) {
+    const line = lines[i];
+    if (line.trim() === "") {
+      i++;
+      break;
+    }
+    if (isComment(line)) {
+      const body2 = commentBody(line);
+      const at = /^@(\w+)\s*(.*)$/.exec(body2);
+      if (at) {
+        const directive2 = at[1].toLowerCase();
+        const arg = at[2].trim();
+        if (directive2 === "assert" && arg) assertions.push({ expr: arg });
+        else if (directive2 === "capture") {
+          const eq = arg.indexOf("=");
+          if (eq !== -1) captures.push({ name: arg.slice(0, eq).trim(), source: arg.slice(eq + 1).trim() });
+        }
+      }
+      continue;
+    }
+    const colon = line.indexOf(":");
+    if (colon === -1) continue;
+    const key = line.slice(0, colon).trim();
+    const value = line.slice(colon + 1).trim();
+    if (key) headers.push([key, value]);
+  }
+  const bodyLines = [];
+  const directive = /^\s*(?:#+|\/\/)\s*@(name|capture|assert)\b\s*(.*)$/;
+  for (const line of lines.slice(i)) {
+    const m = directive.exec(line);
+    if (m) {
+      const kind = m[1].toLowerCase();
+      const arg = m[2].trim();
+      if (kind === "name") {
+        if (arg) name = arg.replace(/^=?\s*/, "").trim();
+      } else if (kind === "capture") {
+        const eq = arg.indexOf("=");
+        if (eq !== -1) {
+          const cname = arg.slice(0, eq).trim();
+          const source = arg.slice(eq + 1).trim();
+          if (cname && source) captures.push({ name: cname, source });
+        }
+      } else if (kind === "assert" && arg) {
+        assertions.push({ expr: arg });
+      }
+      continue;
+    }
+    bodyLines.push(line);
+  }
+  const bodyText = bodyLines.join("\n").replace(/^\n+/, "").replace(/\s+$/, "");
+  const body = bodyText.length > 0 ? bodyText : void 0;
+  const req = {
+    method,
+    url,
+    headers,
+    captures,
+    assertions,
+    line: startLine + requestLineIdx + 1
+  };
+  if (name !== void 0) req.name = name;
+  if (body !== void 0) req.body = body;
+  return req;
+}
+
+// src/jsonpath.ts
+var IDENT = /[A-Za-z0-9_$-]/;
+function parseJsonPath(path) {
+  const s = path.trim();
+  const segs = [];
+  let i = 0;
+  if (s[i] === "$") i++;
+  if (segs.length === 0 && i < s.length && s[i] !== "." && s[i] !== "[") {
+    let j = i;
+    while (j < s.length && IDENT.test(s[j])) j++;
+    if (j === i) throw new Error(`Invalid JSON path: "${path}"`);
+    segs.push({ type: "key", key: s.slice(i, j) });
+    i = j;
+  }
+  while (i < s.length) {
+    const ch = s[i];
+    if (ch === ".") {
+      i++;
+      let j = i;
+      while (j < s.length && IDENT.test(s[j])) j++;
+      if (j === i) throw new Error(`Invalid JSON path: "${path}"`);
+      segs.push({ type: "key", key: s.slice(i, j) });
+      i = j;
+    } else if (ch === "[") {
+      i++;
+      const quote = s[i];
+      if (quote === "'" || quote === '"') {
+        i++;
+        let j = i;
+        while (j < s.length && s[j] !== quote) j++;
+        if (j >= s.length) throw new Error(`Unterminated quote in JSON path: "${path}"`);
+        segs.push({ type: "key", key: s.slice(i, j) });
+        i = j + 1;
+      } else {
+        let j = i;
+        while (j < s.length && s[j] !== "]") j++;
+        const raw = s.slice(i, j).trim();
+        const num = Number(raw);
+        if (raw === "" || !Number.isInteger(num)) {
+          throw new Error(`Invalid array index "${raw}" in JSON path: "${path}"`);
+        }
+        segs.push({ type: "index", index: num });
+        i = j;
+      }
+      if (s[i] !== "]") throw new Error(`Expected "]" in JSON path: "${path}"`);
+      i++;
+    } else {
+      throw new Error(`Unexpected "${ch}" in JSON path: "${path}"`);
+    }
+  }
+  return segs;
+}
+function evalPath(root, path) {
+  const segs = parseJsonPath(path);
+  let cur = root;
+  for (const seg of segs) {
+    if (cur === null || cur === void 0) return void 0;
+    if (seg.type === "key") {
+      if (typeof cur !== "object") return void 0;
+      cur = cur[seg.key];
+    } else {
+      if (!Array.isArray(cur)) return void 0;
+      const idx = seg.index < 0 ? cur.length + seg.index : seg.index;
+      cur = cur[idx];
+    }
+  }
+  return cur;
+}
+
+// src/assert.ts
+var BINARY_OPS = ["==", "!=", "<=", ">=", "<", ">", "contains", "matches"];
+var UNARY_OPS = ["exists", "empty"];
+function parseAssertion(expr) {
+  const raw = expr.trim();
+  const tokens = raw.split(/\s+/);
+  const last = tokens[tokens.length - 1] ?? "";
+  if (UNARY_OPS.includes(last) && tokens.length === 2) {
+    return { lhs: tokens[0], op: last, raw };
+  }
+  for (let i = 1; i < tokens.length - 1; i++) {
+    const t = tokens[i];
+    if (BINARY_OPS.includes(t)) {
+      const lhs = tokens.slice(0, i).join(" ");
+      const rhs = tokens.slice(i + 1).join(" ");
+      return { lhs, op: t, rhs, raw };
+    }
+  }
+  throw new Error(`Cannot parse assertion: "${raw}"`);
+}
+function resolveLhs(lhs, rec) {
+  const l = lhs.trim();
+  if (l === "status") return rec.status;
+  if (l === "time" || l === "duration") return rec.timeMs;
+  if (l === "size") return rec.size;
+  if (l === "body") return rec.body;
+  if (l === "url") return rec.url;
+  if (l.startsWith("body.")) {
+    const path = l.slice(5);
+    const root = rec.json !== void 0 ? rec.json : tryParse(rec.body);
+    return evalPath(root, path);
+  }
+  if (l.startsWith("header.")) {
+    return rec.headers[l.slice(7).toLowerCase()];
+  }
+  return void 0;
+}
+function tryParse(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+}
+function parseLiteral(raw) {
+  const s = raw.trim();
+  if (s.startsWith('"') && s.endsWith('"') && s.length >= 2 || s.startsWith("'") && s.endsWith("'") && s.length >= 2) {
+    return s.slice(1, -1);
+  }
+  if (s === "true") return true;
+  if (s === "false") return false;
+  if (s === "null") return null;
+  if (s !== "" && !Number.isNaN(Number(s))) return Number(s);
+  return s;
+}
+function isEmpty(v) {
+  if (v === void 0 || v === null) return true;
+  if (typeof v === "string") return v.length === 0;
+  if (Array.isArray(v)) return v.length === 0;
+  if (typeof v === "object") return Object.keys(v).length === 0;
+  return false;
+}
+function looseEqual(actual, expected) {
+  if (typeof expected === "number") return Number(actual) === expected;
+  if (typeof expected === "boolean") {
+    if (typeof actual === "boolean") return actual === expected;
+    return String(actual) === String(expected);
+  }
+  if (expected === null) return actual === null || actual === void 0;
+  return String(actual) === String(expected);
+}
+function evalAssertion(assertion, rec) {
+  const actual = resolveLhs(assertion.lhs, rec);
+  const expected = assertion.rhs !== void 0 ? parseLiteral(assertion.rhs) : void 0;
+  let ok = false;
+  switch (assertion.op) {
+    case "==":
+      ok = looseEqual(actual, expected);
+      break;
+    case "!=":
+      ok = !looseEqual(actual, expected);
+      break;
+    case "<":
+      ok = Number(actual) < Number(expected);
+      break;
+    case "<=":
+      ok = Number(actual) <= Number(expected);
+      break;
+    case ">":
+      ok = Number(actual) > Number(expected);
+      break;
+    case ">=":
+      ok = Number(actual) >= Number(expected);
+      break;
+    case "contains": {
+      if (Array.isArray(actual)) ok = actual.map((x) => String(x)).includes(String(expected));
+      else ok = String(actual).toLowerCase().includes(String(expected).toLowerCase());
+      break;
+    }
+    case "matches": {
+      try {
+        ok = new RegExp(String(expected)).test(String(actual));
+      } catch {
+        ok = false;
+      }
+      break;
+    }
+    case "exists":
+      ok = actual !== void 0 && actual !== null;
+      break;
+    case "empty":
+      ok = isEmpty(actual);
+      break;
+  }
+  const shownActual = typeof actual === "object" ? JSON.stringify(actual) : String(actual);
+  const message = assertion.rhs !== void 0 ? `${assertion.lhs} ${assertion.op} ${assertion.rhs} (actual: ${shownActual})` : `${assertion.lhs} ${assertion.op} (actual: ${shownActual})`;
+  const result = { ok, assertion, actual, message };
+  if (expected !== void 0) result.expected = expected;
+  return result;
+}
+function captureValue(source, rec) {
+  const v = resolveLhs(source, rec);
+  if (v === void 0 || v === null) return void 0;
+  return typeof v === "object" ? JSON.stringify(v) : String(v);
+}
+
+// src/vars.ts
+import { randomUUID } from "crypto";
+function makeScope(...sources) {
+  const scope = /* @__PURE__ */ new Map();
+  for (const src of sources) {
+    if (!src) continue;
+    for (const [k, v] of Object.entries(src)) scope.set(k, v);
+  }
+  return scope;
+}
+function resolveOne(expr, scope) {
+  if (scope.has(expr)) return scope.get(expr);
+  if (expr.startsWith("$")) {
+    const [name, ...rest] = expr.slice(1).split(/\s+/);
+    switch (name) {
+      case "timestamp":
+        return String(Math.floor(Date.now() / 1e3));
+      case "isoTimestamp":
+      case "datetime":
+        return (/* @__PURE__ */ new Date()).toISOString();
+      case "guid":
+      case "uuid":
+        return randomUUID();
+      case "randomInt": {
+        const min = Number(rest[0] ?? 0);
+        const max = Number(rest[1] ?? 100);
+        if (Number.isNaN(min) || Number.isNaN(max) || max < min) return void 0;
+        return String(min + Math.floor(Math.random() * (max - min + 1)));
+      }
+      case "processEnv":
+      case "env": {
+        const key = rest[0];
+        return key ? process.env[key] : void 0;
+      }
+      default:
+        return void 0;
+    }
+  }
+  return void 0;
+}
+function resolveVars(text, scope) {
+  const missing = [];
+  const out = text.replace(/\{\{\s*([^{}]+?)\s*\}\}/g, (whole, rawExpr) => {
+    const expr = rawExpr.trim();
+    const val = resolveOne(expr, scope);
+    if (val === void 0) {
+      missing.push(expr);
+      return whole;
+    }
+    return val;
+  });
+  return { text: out, missing };
+}
+function parseEnvJson(json, envName) {
+  let doc;
+  try {
+    doc = JSON.parse(json);
+  } catch (err) {
+    throw new Error(`Invalid env JSON: ${err.message}`);
+  }
+  if (typeof doc !== "object" || doc === null) {
+    throw new Error("Env JSON must be an object of { envName: { key: value } }.");
+  }
+  const record = doc;
+  const flatten = (block) => {
+    const out = {};
+    if (typeof block !== "object" || block === null) return out;
+    for (const [k, v] of Object.entries(block)) {
+      out[k] = typeof v === "string" ? v : JSON.stringify(v);
+    }
+    return out;
+  };
+  const shared = flatten(record["$shared"]);
+  if (!(envName in record)) {
+    const names = Object.keys(record).filter((n) => n !== "$shared");
+    throw new Error(`Environment "${envName}" not found. Available: ${names.join(", ") || "(none)"}`);
+  }
+  return { ...shared, ...flatten(record[envName]) };
+}
+function parseDotenv(text) {
+  const out = {};
+  for (const line of text.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const eq = trimmed.indexOf("=");
+    if (eq === -1) continue;
+    const key = trimmed.slice(0, eq).trim().replace(/^export\s+/, "");
+    let val = trimmed.slice(eq + 1).trim();
+    if (val.startsWith('"') && val.endsWith('"') || val.startsWith("'") && val.endsWith("'")) {
+      val = val.slice(1, -1);
+    }
+    if (key) out[key] = val;
+  }
+  return out;
+}
+function parseKvPairs(pairs) {
+  const out = {};
+  for (const p of pairs) {
+    const eq = p.indexOf("=");
+    if (eq === -1) continue;
+    out[p.slice(0, eq).trim()] = p.slice(eq + 1);
+  }
+  return out;
+}
+
+// src/runner.ts
+function resolveSpec(req, scope) {
+  const missing = [];
+  const collect = (r) => {
+    missing.push(...r.missing);
+    return r.text;
+  };
+  const url = collect(resolveVars(req.url, scope));
+  const headers = req.headers.map(([k, v]) => [
+    collect(resolveVars(k, scope)),
+    collect(resolveVars(v, scope))
+  ]);
+  const spec = { method: req.method, url, headers };
+  if (req.body !== void 0) spec.body = collect(resolveVars(req.body, scope));
+  return { spec, missing };
+}
+async function runHttpFile(source, opts = {}) {
+  const requests = parseHttpFile(source);
+  const scope = makeScope(opts.env, opts.vars);
+  const results = [];
+  const selected = opts.name ? requests.filter((r) => r.name === opts.name) : requests;
+  const sendOpts = {};
+  if (opts.timeoutMs !== void 0) sendOpts.timeoutMs = opts.timeoutMs;
+  if (opts.maxSize !== void 0) sendOpts.maxSize = opts.maxSize;
+  if (opts.maxRedirects !== void 0) sendOpts.maxRedirects = opts.maxRedirects;
+  if (opts.followRedirects !== void 0) sendOpts.followRedirects = opts.followRedirects;
+  if (opts.fetchImpl !== void 0) sendOpts.fetchImpl = opts.fetchImpl;
+  for (const req of selected) {
+    const { spec, missing } = resolveSpec(req, scope);
+    const result = {
+      method: spec.method,
+      url: spec.url,
+      line: req.line,
+      missingVars: missing,
+      assertions: [],
+      captured: {},
+      ok: false
+    };
+    if (req.name !== void 0) result.name = req.name;
+    try {
+      const rec = await sendRequest(spec, sendOpts);
+      result.response = rec;
+      for (const cap of req.captures) {
+        const value = captureValue(cap.source, rec);
+        if (value !== void 0) {
+          result.captured[cap.name] = value;
+          scope.set(cap.name, value);
+        }
+      }
+      let allPass = true;
+      for (const a of req.assertions) {
+        try {
+          const ar = evalAssertion(parseAssertion(a.expr), rec);
+          result.assertions.push(ar);
+          if (!ar.ok) allPass = false;
+        } catch (err) {
+          result.assertions.push({
+            ok: false,
+            assertion: { lhs: a.expr, op: "==", raw: a.expr },
+            actual: void 0,
+            message: `invalid assertion "${a.expr}": ${err.message}`
+          });
+          allPass = false;
+        }
+      }
+      result.ok = allPass && missing.length === 0;
+    } catch (err) {
+      result.error = err.message;
+      result.ok = false;
+    }
+    results.push(result);
+    opts.onResult?.(result);
+  }
+  const passed = results.filter((r) => r.ok).length;
+  const failed = results.length - passed;
+  return { results, passed, failed, ok: failed === 0 && results.length > 0 };
+}
+
+// src/format.ts
+var ANSI = {
+  reset: "\x1B[0m",
+  dim: "\x1B[2m",
+  green: "\x1B[32m",
+  red: "\x1B[31m",
+  yellow: "\x1B[33m",
+  cyan: "\x1B[36m",
+  magenta: "\x1B[35m",
+  blue: "\x1B[34m"
+};
+function humanSize(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  const units = ["KB", "MB", "GB", "TB"];
+  let n = bytes / 1024;
+  let i = 0;
+  while (n >= 1024 && i < units.length - 1) {
+    n /= 1024;
+    i++;
+  }
+  return `${n.toFixed(1)} ${units[i]}`;
+}
+function statusColor(status) {
+  if (status >= 200 && status < 300) return "green";
+  if (status >= 300 && status < 400) return "cyan";
+  if (status >= 400 && status < 500) return "yellow";
+  return "red";
+}
+function paint(color, s, enabled) {
+  return enabled ? `${ANSI[color]}${s}${ANSI.reset}` : s;
+}
+function prettyJson(value, color = false) {
+  const plain = JSON.stringify(value, null, 2);
+  if (plain === void 0) return String(value);
+  if (!color) return plain;
+  return plain.replace(
+    /("(?:\\.|[^"\\])*"(\s*:)?)|\b(true|false|null)\b|(-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?)/g,
+    (match, str, colon, lit) => {
+      if (str !== void 0) {
+        if (colon) return paint("blue", str.slice(0, str.length - colon.length), true) + colon;
+        return paint("green", str, true);
+      }
+      if (lit !== void 0) return paint("yellow", lit, true);
+      return paint("cyan", match, true);
+    }
+  );
+}
+
+// src/cli.ts
+var VERSION = "0.1.0";
+var NO_COLOR = !!env["NO_COLOR"];
+var COLOR = !NO_COLOR;
+var C = {
+  reset: "\x1B[0m",
+  bold: "\x1B[1m",
+  dim: "\x1B[2m",
+  green: "\x1B[32m",
+  cyan: "\x1B[36m",
+  yellow: "\x1B[33m",
+  red: "\x1B[31m",
+  magenta: "\x1B[35m",
+  blue: "\x1B[34m"
+};
+var c = (k, s) => COLOR ? `${C[k]}${s}${C.reset}` : s;
+var log = (s = "") => void stderr.write(s + "\n");
+var METHODS2 = /* @__PURE__ */ new Set([
+  "GET",
+  "HEAD",
+  "POST",
+  "PUT",
+  "PATCH",
+  "DELETE",
+  "OPTIONS",
+  "TRACE",
+  "CONNECT"
+]);
+function parseSize(raw) {
+  const m = /^(\d+(?:\.\d+)?)\s*(b|kb|mb|gb)?$/i.exec(raw.trim());
+  if (!m) return Number(raw);
+  const n = Number(m[1]);
+  const unit = (m[2] ?? "b").toLowerCase();
+  const mult = unit === "kb" ? 1024 : unit === "mb" ? 1024 ** 2 : unit === "gb" ? 1024 ** 3 : 1;
+  return Math.round(n * mult);
+}
+function parseArgs(list) {
+  const a = {
+    positional: [],
+    headers: [],
+    query: [],
+    form: [],
+    jsonKv: [],
+    jsonOut: false,
+    noRedirect: false,
+    include: false,
+    verbose: false,
+    fail: false,
+    curl: false,
+    showSecrets: false,
+    vars: [],
+    help: false,
+    version: false
+  };
+  for (let i = 0; i < list.length; i++) {
+    const arg = list[i];
+    const nextVal = () => list[++i] ?? "";
+    switch (arg) {
+      case "-H":
+      case "--header":
+        a.headers.push(nextVal());
+        break;
+      case "-q":
+      case "--query":
+        a.query.push(nextVal());
+        break;
+      case "--form":
+        a.form.push(nextVal());
+        break;
+      case "-j":
+        a.jsonKv.push(nextVal());
+        break;
+      case "-d":
+      case "--data":
+        a.data = nextVal();
+        break;
+      case "--json": {
+        const peek = list[i + 1];
+        if (peek !== void 0 && (peek.startsWith("{") || peek.startsWith("["))) a.json = nextVal();
+        else a.jsonOut = true;
+        break;
+      }
+      case "-b":
+      case "--bearer":
+        a.bearer = nextVal();
+        break;
+      case "-u":
+      case "--user":
+        a.user = nextVal();
+        break;
+      case "--timeout":
+        a.timeout = Number(nextVal());
+        break;
+      case "--max-redirects":
+        a.maxRedirects = Number(nextVal());
+        break;
+      case "--no-redirect":
+        a.noRedirect = true;
+        break;
+      case "--max-size":
+        a.maxSize = parseSize(nextVal());
+        break;
+      case "-o":
+      case "--out":
+        a.out = nextVal();
+        break;
+      case "-i":
+      case "--include":
+        a.include = true;
+        break;
+      case "-v":
+      case "--verbose":
+        a.verbose = true;
+        break;
+      case "--fail":
+        a.fail = true;
+        break;
+      case "--curl":
+        a.curl = true;
+        break;
+      case "--show-secrets":
+        a.showSecrets = true;
+        break;
+      case "--var":
+        a.vars.push(nextVal());
+        break;
+      case "--env":
+        a.envName = nextVal();
+        break;
+      case "--env-file":
+        a.envFile = nextVal();
+        break;
+      case "--name":
+        a.name = nextVal();
+        break;
+      case "-h":
+      case "--help":
+        a.help = true;
+        break;
+      case "--version":
+        a.version = true;
+        break;
+      default:
+        if (arg === "-V") a.version = true;
+        else if (!arg.startsWith("-")) a.positional.push(arg);
+        break;
+    }
+  }
+  return a;
+}
+var HELP = `
+${c("bold", c("magenta", "\u25C6 lacspace-http"))} ${c("dim", "\u2014 a keyless terminal API client + .http file runner")}
+
+${c("bold", "Usage")}
+  npx lacspace-http [METHOD] <url> [options]      ${c("dim", "# ad-hoc request")}
+  npx lacspace-http run <file.http> [options]     ${c("dim", "# run a .http/.rest file")}
+
+${c("bold", "Request options")}
+  -H, --header "K: V"    Add a request header (repeatable)
+  -q, --query k=v        Add a query-string param (repeatable)
+  -d, --data <str>       Raw request body (@file to read a file, @- for stdin)
+      --json '<obj>'     JSON body from a literal object/array + content-type
+  -j k=v                 JSON body shorthand (k:=v for a raw JSON value)
+      --form k=v         urlencoded form field (repeatable)
+  -b, --bearer <token>   Authorization: Bearer <token>
+  -u, --user user:pass   HTTP Basic auth
+      --timeout <ms>     Abort after ms (default 30000)
+      --no-redirect      Do not follow redirects
+      --max-redirects N  Follow at most N redirects (default 5)
+      --max-size <n>     Cap the response body read (e.g. 10mb, default 10MB)
+
+${c("bold", "Output options")}
+  -i, --include          Show response headers
+  -v, --verbose          Show the request line, headers and body too
+  -o, --out <file>       Write the response body to a file
+      --curl             Print the equivalent curl command (secrets masked)
+      --show-secrets     Do not mask credentials in --curl / --verbose
+      --fail             Exit non-zero on a non-2xx response
+      --json             Emit a machine record { status, headers, timeMs, body }
+
+${c("bold", "Runner options (run)")}
+      --env <name>       Select an env block from http-client.env.json
+      --env-file <path>  Load vars from a .json (needs --env) or .env file
+      --var k=v          Set/override a variable (repeatable)
+      --name <req>       Run only the request with this # @name
+
+  -h, --help             Show this help
+      --version          Print the version
+
+${c("bold", ".http directives")}
+  ${c("dim", "# @name login             name a request (for --name and chaining)")}
+  ${c("dim", "# @capture tok = body.$.token   grab a value for later requests")}
+  ${c("dim", "# @assert status == 200   fail the run if the check fails")}
+  ${c("dim", "# @assert body.$.ok == true \xB7 header.content-type contains json \xB7 time < 800")}
+
+${c("bold", "Examples")}
+  npx lacspace-http https://httpbin.org/get
+  npx lacspace-http POST https://httpbin.org/post -j name=Ada -j admin:=true
+  npx lacspace-http https://api.example.com/me -b "$TOKEN" -i
+  npx lacspace-http GET https://httpbin.org/get --curl
+  npx lacspace-http run api.http --env dev
+  npx lacspace-http run smoke.http --var host=http://localhost:3000
+`;
+function readStdin() {
+  try {
+    return readFileSync(0, "utf8");
+  } catch {
+    return "";
+  }
+}
+function resolveDataArg(data) {
+  if (data === "@-") return readStdin();
+  if (data.startsWith("@")) return readFileSync(data.slice(1), "utf8");
+  return data;
+}
+function fail(msg, jsonOut) {
+  if (jsonOut) stdout.write(JSON.stringify({ ok: false, error: msg }) + "\n");
+  else log(c("red", `
+\u2717 ${msg}
+`));
+  exit(1);
+}
+async function runAdHoc(args) {
+  let method;
+  let url;
+  const [p0, p1] = [args.positional[0], args.positional[1]];
+  if (p0 && METHODS2.has(p0.toUpperCase())) {
+    method = p0.toUpperCase();
+    url = p1;
+  } else {
+    url = p0;
+  }
+  if (!url) fail("a URL is required (see --help)", args.jsonOut);
+  if (!/^https?:\/\//i.test(url)) url = "http://" + url;
+  const asm = {
+    headers: args.headers,
+    query: args.query,
+    form: args.form,
+    jsonKv: args.jsonKv
+  };
+  if (method) asm.method = method;
+  if (args.data !== void 0) asm.data = resolveDataArg(args.data);
+  if (args.json !== void 0) asm.json = args.json;
+  if (args.bearer !== void 0) asm.bearer = args.bearer;
+  if (args.user !== void 0) asm.user = args.user;
+  const spec = assembleRequest(url, asm);
+  if (args.curl) {
+    const curlOpts = {
+      showSecrets: args.showSecrets,
+      followRedirects: !args.noRedirect
+    };
+    if (args.maxRedirects !== void 0) curlOpts.maxRedirects = args.maxRedirects;
+    stdout.write(toCurl(spec, curlOpts) + "\n");
+    return;
+  }
+  if (args.verbose) printRequest(spec, args.showSecrets);
+  const sendOpts = { followRedirects: !args.noRedirect };
+  if (args.timeout !== void 0) sendOpts.timeoutMs = args.timeout;
+  if (args.maxSize !== void 0) sendOpts.maxSize = args.maxSize;
+  if (args.maxRedirects !== void 0) sendOpts.maxRedirects = args.maxRedirects;
+  let rec;
+  try {
+    rec = await sendRequest(spec, sendOpts);
+  } catch (err) {
+    fail(err.message, args.jsonOut);
+  }
+  if (args.jsonOut) {
+    stdout.write(JSON.stringify({
+      status: rec.status,
+      statusText: rec.statusText,
+      headers: rec.headers,
+      timeMs: rec.timeMs,
+      size: rec.size,
+      url: rec.url,
+      redirected: rec.redirected,
+      truncated: rec.truncated,
+      body: rec.body
+    }) + "\n");
+    if (args.fail && !rec.ok) exit(1);
+    return;
+  }
+  printMeta(rec, args.include);
+  if (args.out) {
+    writeFileSync(args.out, rec.body);
+    log(`
+${c("green", "\u2713")} wrote ${c("bold", args.out)} ${c("dim", `(${humanSize(rec.size)})`)}
+`);
+  } else {
+    const ct = rec.headers["content-type"];
+    if (rec.json !== void 0) {
+      stdout.write(prettyJson(rec.json, COLOR && !!stdout.isTTY) + "\n");
+    } else {
+      stdout.write(rec.body + (rec.body.endsWith("\n") ? "" : "\n"));
+    }
+    void ct;
+  }
+  if (args.fail && !rec.ok) exit(1);
+}
+function printRequest(spec, showSecrets) {
+  log(`${c("blue", "\u2192")} ${c("bold", spec.method)} ${spec.url}`);
+  for (const [k, v] of spec.headers) {
+    let value = v;
+    if (!showSecrets && k.toLowerCase() === "authorization") {
+      const scheme = v.split(/\s+/)[0] ?? "";
+      value = /^(Bearer|Basic)$/i.test(scheme) ? `${scheme} ***` : "***";
+    }
+    log(`  ${c("dim", k + ":")} ${value}`);
+  }
+  if (spec.body !== void 0) log(`  ${c("dim", spec.body)}`);
+  log("");
+}
+function printMeta(rec, includeHeaders) {
+  const col = statusColor(rec.status);
+  const statusLine = `${rec.status} ${rec.statusText}`.trim();
+  const timeCol = rec.timeMs > 1e3 ? "yellow" : "dim";
+  log(
+    `${paint(col, statusLine, COLOR)} ${c("dim", "\xB7")} ${c(timeCol, rec.timeMs + "ms")} ${c("dim", "\xB7")} ${c("dim", humanSize(rec.size))}` + (rec.redirected ? ` ${c("dim", `\xB7 ${rec.redirectChain.length} redirect(s) \u2192 ${rec.url}`)}` : "") + (rec.truncated ? ` ${c("yellow", "\xB7 body truncated")}` : "") + (rec.crossHostRedirect ? ` ${c("yellow", "\xB7 crossed host")}` : "")
+  );
+  if (includeHeaders) {
+    for (const [k, v] of Object.entries(rec.headers)) log(`  ${c("cyan", k)}${c("dim", ":")} ${v}`);
+  }
+  log("");
+}
+function loadEnvVars(args) {
+  if (!args.envFile) {
+    if (args.envName) {
+      try {
+        const raw2 = readFileSync("http-client.env.json", "utf8");
+        return parseEnvJson(raw2, args.envName);
+      } catch {
+      }
+    }
+    return {};
+  }
+  const raw = readFileSync(args.envFile, "utf8");
+  if (/\.json$/i.test(args.envFile)) {
+    if (!args.envName) throw new Error("--env <name> is required with a JSON env file.");
+    return parseEnvJson(raw, args.envName);
+  }
+  return parseDotenv(raw);
+}
+async function runFile(args) {
+  const file = args.positional[1];
+  if (!file) fail("run needs a file: lacspace-http run <file.http>", args.jsonOut);
+  let source;
+  try {
+    source = readFileSync(file, "utf8");
+  } catch (err) {
+    fail(`cannot read ${file}: ${err.message}`, args.jsonOut);
+  }
+  let envVars;
+  try {
+    envVars = loadEnvVars(args);
+  } catch (err) {
+    fail(err.message, args.jsonOut);
+  }
+  const runOpts = {
+    env: envVars,
+    vars: parseKvPairs(args.vars),
+    followRedirects: !args.noRedirect
+  };
+  if (args.name !== void 0) runOpts.name = args.name;
+  if (args.timeout !== void 0) runOpts.timeoutMs = args.timeout;
+  if (args.maxSize !== void 0) runOpts.maxSize = args.maxSize;
+  if (args.maxRedirects !== void 0) runOpts.maxRedirects = args.maxRedirects;
+  if (!args.jsonOut) {
+    log(`
+${c("bold", c("magenta", "\u25C6 lacspace-http run"))}  ${c("dim", file)}`);
+    log("");
+    runOpts.onResult = (r) => printRunResult(r);
+  }
+  const result = await runHttpFile(source, runOpts);
+  if (args.jsonOut) {
+    stdout.write(JSON.stringify({
+      ok: result.ok,
+      passed: result.passed,
+      failed: result.failed,
+      results: result.results.map((r) => ({
+        name: r.name,
+        method: r.method,
+        url: r.url,
+        ok: r.ok,
+        status: r.response?.status,
+        timeMs: r.response?.timeMs,
+        error: r.error,
+        missingVars: r.missingVars,
+        captured: r.captured,
+        assertions: r.assertions.map((a) => ({ ok: a.ok, message: a.message }))
+      }))
+    }) + "\n");
+  } else {
+    const summary = `${result.passed} passed` + (result.failed ? `, ${c("red", result.failed + " failed")}` : "") + ` ${c("dim", `\xB7 ${result.results.length} request(s)`)}`;
+    log(`${result.ok ? c("green", "\u2713") : c("red", "\u2717")} ${summary}
+`);
+  }
+  if (!result.ok) exit(1);
+}
+function printRunResult(r) {
+  const label = r.name ? c("bold", r.name) : c("dim", `${r.method} ${r.url}`);
+  if (r.error) {
+    log(`  ${c("red", "\u2717")} ${label} ${c("dim", `L${r.line}`)}`);
+    log(`      ${c("red", r.error)}`);
+    return;
+  }
+  const st = r.response ? r.response.status : 0;
+  const stCol = statusColor(st);
+  const mark = r.ok ? c("green", "\u2713") : c("red", "\u2717");
+  log(`  ${mark} ${label} ${c("dim", "\u2192")} ${paint(stCol, String(st), COLOR)} ${c("dim", `${r.response?.timeMs ?? 0}ms`)}`);
+  for (const k of Object.keys(r.captured)) {
+    log(`      ${c("cyan", "captured")} ${k}=${c("dim", truncate(r.captured[k], 60))}`);
+  }
+  for (const a of r.assertions) {
+    const am = a.ok ? c("green", "\u2713") : c("red", "\u2717");
+    log(`      ${am} ${c("dim", "assert")} ${a.message}`);
+  }
+  if (r.missingVars.length) {
+    log(`      ${c("yellow", "\u26A0 unresolved vars:")} ${r.missingVars.join(", ")}`);
+  }
+}
+function truncate(s, n) {
+  return s.length > n ? s.slice(0, n) + "\u2026" : s;
+}
+async function main() {
+  const args = parseArgs(argv.slice(2));
+  if (args.version) {
+    stdout.write(VERSION + "\n");
+    return;
+  }
+  if (args.help || args.positional.length === 0) {
+    stdout.write(HELP + "\n");
+    return;
+  }
+  if (args.positional[0] === "run") {
+    await runFile(args);
+    return;
+  }
+  await runAdHoc(args);
+}
+main().catch((err) => {
+  log(c("red", `
+\u2717 ${err instanceof Error ? err.message : String(err)}
+`));
+  exit(1);
+});