feat: multi step api runner

[shahzad31]

Summary

Adds apiJourney(...) — runs API-only checks without launching a browser. Same DSL shape as journey(...), but the callback receives an isolated APIRequestContext instead of a Page/Browser driver. Pushes to Kibana as an HTTP-type monitor.

import { apiJourney, monitor, step, expect } from '@elastic/synthetics';

apiJourney('orders API health', ({ request, params }) => {
  monitor.use({ schedule: 1, locations: ['us_east'] });

  let token: string;
  step('obtain OAuth2 token', async () => {
    const r = await request.post(`${params.authUrl}/oauth2/token`, {
      form: { grant_type: 'client_credentials', client_id: params.clientId, client_secret: params.clientSecret },
    });
    expect(r.status()).toBe(200);
    token = (await r.json()).access_token;
  });

  step('check /orders', async () => {
    const r = await request.get(`${params.apiUrl}/orders`, {
      headers: { Authorization: `Bearer ${token}` },
    });
    expect(r.status()).toBe(200);
  });
});

Requires Playwright ≥ 1.61. TLS and remote-address capture use the native APIResponse.securityDetails() / APIResponse.serverAddr() APIs added in microsoft/playwright#40932.

Closes

• Multi Step scriptable lightweight API Journeys #137 — Multi-step lightweight API journeys (5+ year ask)
• [proposal] Lightweight API journeys DSL #900 — API journeys DSL proposal
• capture Network information related to the APIRequestContext #931 — Network capture for APIRequestContext
• Internal customer summary: elastic/synthetics-dev#464

What's in the PR

• APIJourney DSL — subclass of Journey, monitor type 'http', full monitor.use(...) / params / expect / .skip / .only support.
• No browser when not needed — runner skips launchBrowser if no browser journeys are registered.
• APINetworkManager — intercepts APIRequestContext.fetch (the single funnel) and captures URL, method, status, headers (redacted), body bytes, timings, and step attribution.
• Native TLS / remote address — reads APIResponse.securityDetails() (cert issuer / subject / validFrom / validTo / protocol) and APIResponse.serverAddr() (remote IP / port) straight off the response from the actual request, mirroring the browser network path. HTTPS and plain HTTP surface server.ip / server.port; cert info follows redirects to the final hop. No extra socket or parallel handshake.
• Playwright 1.61 bump + codegen vendoring — 1.61 bundles its server code into coreBundle.js and no longer exports the recorder's codegen classes, so the minimal slice SyntheticsGenerator extends (_asLocator / _generateActionCall / JavaScriptFormatter) is vendored into src/formatter/codegen.ts, reusing Playwright's still-exported iso helpers. Recorder snapshots are unchanged.
• PluginManager — common NetworkPlugin interface so API network data isn't dropped at journey-end.
• JSONReporter — emits journey.type: 'api', omits browser-only fields, surfaces tls.* and server.ip / server.port.

Tests

All green across:

• dsl/api-journey, core/api-journey-register — DSL + factory
• plugins/api-network, plugins/plugin-manager — capture, native TLS / remote-addr, orchestration
• core/api-runner — e2e, no-browser, failure path, empty-step grouping, cookie isolation, HTTPS with TLS / IP / body-bytes
• reporters/json — type: 'api' emission, server / TLS fields
• formatter/javascript — recorder codegen snapshots unchanged against the vendored generator

Manual verification

Ran the built CLI against api.github.com, httpbin.org, and a local self-signed HTTPS server. Confirmed: no browser spawned, full tls.* / server.* / body.bytes populated, cookies isolated, redaction still works.

Docs

• README updated with browser vs. API journey sections.
• examples/todos/api.journey.ts runnable example added.

Follow-ups (separate PRs)

1. Kibana UI — handle journey.type: 'api' in waterfall, monitor list, data stream. Open question from [proposal] Lightweight API journeys DSL #900 needs an answer.
2. mTLS client cert — to fully solve elastic/enhancements#25818 (Atos France).
3. Finer timing breakdown (dns, connect, ssl, wait, receive) — APIResponse doesn't expose per-phase timings; needs Node http.Agent hooks (or a future Playwright API).
4. HAR export integration — Playwright already records API timings to HAR (microsoft/playwright#32613); could complement the response fields.

[vigneshshanmugam]

Ideally I would like us to have a base Journey class that both BrowserJourney and APIJourney extends from and the runner should be a single entity that decides how to run each of them. I am not in favor of having multiple runners.

[vigneshshanmugam]

Did a first pass.