zreq-core is in active development. The figures on this page are derived from the crate source as it stands today (Cargo.toml, src/lib.rs, src/ffi.rs, PORT_REPORT.md): version, crate-types, the dotted commands matched in Engine::invoke, the exported C symbols, and the hand-assessed Postman coverage. The "planned" column lists work that is not yet implemented — it is a roadmap, not a claim of coverage.
Module map
| module | role today | planned |
|---|---|---|
| lib (Engine) | one dotted command surface via Engine::invoke; event sink; id allocation; workspace + history persistence | more dispatch coverage as modules grow |
| model | workspace · collection · folder · request · environment · variable · auth · body · cookie types | path-variable rows, richer secret handling |
| http | prepare (vars + path vars + query + auth + body → wire form) always on; send over reqwest blocking behind net, with per-request timeout | interactive mid-flight cancel, streaming responses |
| auth | basic · bearer · api-key · oauth2 (attach + client_credentials/password/refresh token fetch); signed digest (RFC 2617) · oauth1 (RFC 5849) · awsv4 · hawk; inheritance walk in lib | ntlm (connection-bound handshake), oauth2 auth-code redirect (host) |
| crypto | dependency-free MD5 · SHA-1 · SHA-256 · HMAC, pinned to RFC/FIPS test vectors, for the auth signers | nothing — frozen primitives |
| vars | {{var}} substitution with collection > env > global precedence; dynamic {{$guid}}/{{$timestamp}}/… generators; data-row overlay for the runner | secret masking surface |
| store / history | named multi-workspace JSON persistence (dirs paths) with per-workspace history; capped newest-first request log that captures the full request for one-click replay | indexing, search |
| settings | Postman Settings (settings.get/update/reset/path): TLS verification, redirects, default timeout, max response size, proxy — drive every send; theme/appearance persisted | per-host client certificates |
| codegen | snippet generation: curl · raw http · fetch · python requests · httpie · Go · Java · C# · PHP · Ruby · Node | more niche targets |
| import | curl · Postman Collection v2.1 · OpenAPI 3 (paths + params + body + $ref resolution + schema examples) · HAR 1.2 import; full Postman v2.1 export (body/auth/scripts) | OpenAPI securitySchemes→auth |
| runner | collection runner (runner.run): depth-first request plan with resolved auth + CSV/JSON data-file iterations | parallel iterations, request delays |
| ws (feature) | WebSocket send-and-collect (ws.exchange) over tungstenite (sync, native-tls for wss) | persistent interactive streaming (host) |
| grpc (feature) | unary gRPC (grpc.call) via gRPC-Web framing over reqwest; runtime .proto compile (protox) + dynamic JSON<->protobuf (prost-reflect) | streaming RPCs (host) |
| script | native pm.* subset: assertions (status · code · responseTime · body-include · header) + pm.*.set() variable writes | nothing — no JS sandbox by design (durable-deps rule) |
| ffi | C ABI: zrq_init · zrq_invoke · zrq_set_event_callback · zrq_string_free | richer event payloads |
tauri_plugin (feature tauri) | Tauri v2 command (zrq_invoke) + setup; events on zrq-event | mountable webui packaging |
Build surfaces
The crate declares crate-type = ["rlib", "staticlib", "cdylib"]. The rlib links natively into Rust/Tauri hosts; the staticlib/cdylib expose the C ABI for non-Rust hosts (header include/zreq_core.h, hand-written, no cbindgen). The default net feature pulls in reqwest (blocking + native-tls); building --no-default-features yields a pure core with zero TLS/network deps that compiles in headless CI — request preparation and code generation still work without it. The optional tauri feature adds the Tauri v2 command layer.
Verification
The crate carries in-source unit and integration tests across the engine and its modules: the command surface (version reporting, collection/request CRUD, auth inheritance, an import-curl flow, unknown-command error tagging), plus module-level tests in vars (precedence, unknown-left-verbatim, dynamic guid shape), http (query merge + content-type), script (status / body-include / header assertions), import and store. Tests for the pure core run without network access and pass identically in a headless Linux CI; the http::send transport is feature-gated so the default test path needs no live server. The test scripting layer is an honest subset — it recognizes the common pm.* idioms and reports unrecognized assertions as skipped rather than silently passing.