zreq-core is in active development. The figures on this page are derived from the crate source as it stands today (Cargo.toml, src/lib.rs, src/ffi.rs, PORT_REPORT.md): version, crate-types, the dotted commands matched in Engine::invoke, the exported C symbols, and the hand-assessed Postman coverage. The "planned" column lists work that is not yet implemented — it is a roadmap, not a claim of coverage.
Module map
| module | role today | planned |
|---|---|---|
| lib (Engine) | one dotted command surface via Engine::invoke; event sink; id allocation; workspace + history persistence | more dispatch coverage as modules grow |
| model | workspace · collection · folder · request · environment · variable · auth · body · cookie types | path-variable rows, richer secret handling |
| http | prepare (vars + path vars + query + auth + body → wire form) always on; send over reqwest blocking behind net, with per-request timeout | interactive mid-flight cancel, streaming responses |
| auth | basic · bearer · api-key · oauth2 (attach + client_credentials/password/refresh token fetch); signed digest (RFC 2617) · oauth1 (RFC 5849) · awsv4 · hawk; inheritance walk in lib | ntlm (connection-bound handshake), oauth2 auth-code redirect (host) |
| crypto | dependency-free MD5 · SHA-1 · SHA-256 · HMAC, pinned to RFC/FIPS test vectors, for the auth signers | nothing — frozen primitives |
| vars | {{var}} substitution with collection > env > global precedence; dynamic {{$guid}}/{{$timestamp}}/… generators; data-row overlay for the runner | secret masking surface |
| store / history | named multi-workspace JSON persistence (dirs paths) with per-workspace history; capped newest-first request log that captures the full request for one-click replay | indexing, search |
| settings | Postman Settings (settings.get/update/reset/path): TLS verification, redirects, default timeout, max response size, proxy — drive every send; theme/appearance persisted | per-host client certificates |
| codegen | snippet generation across 16 targets: curl · wget · raw http · fetch · Node · python requests · httpie · Go · Java · Kotlin · C# · PowerShell · PHP · Ruby · Rust reqwest · Swift URLSession | more niche targets |
| import | curl · Postman Collection v2.1 · OpenAPI 3 (paths + params + body + $ref resolution + schema examples) · HAR 1.2 · Insomnia v4 · Bruno .bru · HTTPie import; export to Postman v2.1 (body/auth/scripts) · HAR · OpenAPI · Bruno | OpenAPI securitySchemes→auth |
| runner | collection runner (runner.run): depth-first request plan with resolved auth + CSV/JSON data-file iterations, each item stamped with its offset from the run's first send; plus the loop re-fire window (runner.loop) — intersect a [from_ms, to_ms) loop region with those regions and re-send only what it covers, in parallel over one pooled client when chain.plan shows no producer→consumer edge with both ends inside the window, otherwise in listed order with the forcing edges reported | parallel iterations, request delays |
| ws (feature) | WebSocket send-and-collect (ws.exchange) over tungstenite (sync, native-tls for wss) | persistent interactive streaming (host) |
| grpc (feature) | unary gRPC (grpc.call) via gRPC-Web framing over reqwest; runtime .proto compile (protox) + dynamic JSON<->protobuf (prost-reflect) | streaming RPCs (host) |
| script | native pm.* subset: assertions (status · code · responseTime · body-include · header) + pm.*.set() variable writes | nothing — no JS sandbox by design (durable-deps rule) |
| ffi | C ABI: zrq_init · zrq_invoke · zrq_set_event_callback · zrq_string_free | richer event payloads |
tauri_plugin (feature tauri) | Tauri v2 command (zrq_invoke) + setup; events on zrq-event | mountable webui packaging |
| fuzzloop | Schema-Feedback Fuzzer (fuzz.explore) — closed-loop novelty-guided black-box fuzzer over the static corpus, keyed on each response’s inferred schema fingerprint | corpus minimisation |
| chainplan | Auto-Chain Dependency Planner (chain.plan) — infers producer→consumer data-flow across a collection from pm.*.set() writes vs {{var}} reads, and orders the run | cycle repair suggestions |
| session | Causal Session Replay (session.record · list · remove · clear · provenance · blastradius · counterfactual) — value-provenance mining and counterfactual replay over a recorded run | cross-session diff |
| cors | Browser CORS Preflight Simulator (cors.simulate) — the WHATWG Fetch CORS protocol offline: simple-vs-preflight classification, synthesised OPTIONS, Allow-Methods/Headers check, exposed headers, max-age | credentialed-wildcard lint |
| cachesim | HTTP Cache-Behaviour Simulator (cache.simulate) — RFC 9111 storability, freshness, age and the serve/revalidate verdict for a request/response pair | Vary-key modelling |
| cookiejar · ratelimit · responses | The response inspectors the GUI surfaces: the cookie jar, parsed rate-limit headers, and body extractors | more header families |
| assertion · schema · schemainfer · schemagen · jsonpath · jmespath · diff · lint · scriptlint · explain · sla · har_stats · openapi_diff | The extraction, validation and analysis surface — JSONPath/JMESPath queries, JSON Schema validate/infer/generate, structural diff, collection and script lints, request explain, SLA checks, HAR statistics, OpenAPI diff | — |
| graphql · soap · sse · wsframe · protowire · proto · asyncapi · hypermedia · negotiate · conditional · chunked · retry · mock | Protocol modelling beside the transports — GraphQL and SOAP envelopes, SSE and WebSocket frame decoding, protobuf wire decode, AsyncAPI, hypermedia link following, content negotiation, conditional requests, chunked transfer, retry policy, and the offline mock responder | — |
| digest · encoding · jwt · fuzz | The self-contained primitive commands: message digests and HMAC (hash.compute, hmac.compute), byte-encoding conversion (encoding.convert), JWT decode/encode with HMAC verification, and security/robustness fuzz-vector generation (request.fuzz) | — |
| effect · unwind · entity · coherence | Write Effect Attribution (effect.attribute/effect.intents) with the reversible-fuzzing inverse-verb table and compensation plan behind it; cross-endpoint entity coherence (entity.coherence/entity.views) and cross-representation coherence (repr.*) | — |
| peer | The client half of the GUI Automation Bus inside the engine — peer.list · peer.get · peer.verbs · peer.call · peer.step | — |
| httpsig · pkce · secret · dotenv · envmerge · template · dataset · formdata · binfmt · xmlconv | HTTP message signatures, OAuth PKCE, secret detection, .env import/export, environment merge, templating, data-file iteration, multipart form data, binary format sniffing and XML↔JSON conversion | — |
Build surfaces
The crate declares crate-type = ["rlib", "staticlib", "cdylib"]. The rlib links natively into Rust/Tauri hosts; the staticlib/cdylib expose the C ABI for non-Rust hosts (header include/zreq_core.h, hand-written, no cbindgen). The default net feature pulls in reqwest (blocking + native-tls); building --no-default-features yields a pure core with zero TLS/network deps that compiles in headless CI — request preparation and code generation still work without it. The optional tauri feature adds the Tauri v2 command layer.
Verification
The crate carries in-source unit and integration tests across the engine and its modules: the command surface (version reporting, collection/request CRUD, auth inheritance, an import-curl flow, unknown-command error tagging), plus module-level tests in vars (precedence, unknown-left-verbatim, dynamic guid shape), http (query merge + content-type), script (status / body-include / header assertions), import and store. Tests for the pure core run without network access and pass identically in a headless Linux CI; the http::send transport is feature-gated so the default test path needs no live server. The test scripting layer is an honest subset — it recognizes the common pm.* idioms and reports unrecognized assertions as skipped rather than silently passing.