REQUESTPARCEL / FIELD GUIDE / VERSION 1.0.1
A request your recipient
can actually inspect.
Package one supported cURL request, explicitly selected files and expected/observed notes. The recipient can review the case and run a no-network preview without the authoring app.
Open the authoring workspace (buyer package only)
1. Open locally and try the example
Extract the entire buyer ZIP into a normal writable folder. Open app/index.html in Chrome. There is no installation, account, server, npm step or internet dependency for authoring. Keep all extracted app files together. Tested on Ubuntu 22.04.5, Chrome 152.0.7977.82. Other browsers and operating systems have not been verified.
- Click Try the upload example. It loads the fictional CASE-001 request and an original 65-byte report attachment.
- Read the two multipart rows:
documenthastext/plain, andmetadatahasapplication/json. The URL ishttp://127.0.0.1:8765/upload. - Review the expected/observed notes and the attachment contents in
examples/report.txt. Confirm the review checkbox, then click Export recipient ZIP.
The resulting request-parcel-case.zip contains the case, attachment, readable notes, hash inventory, license and runner. Downloading does not send a request. The expected sample result is HTTP 200 after you start the separate example server and explicitly send. A packet being complete does not prove a bug reproduced.
2. Bring your own request and files
Paste a single supported POSIX-style cURL command, then click Read request. Editing the command clears the parsed working case; read it again and rematch files. Unsupported options block with a correction. RequestParcel does not evaluate shell code or read a pasted local path.
curl 'https://api.example.invalid/upload' \
-H 'Authorization: FICTIONAL_MARKER' \
-F 'document=@report.txt;type=text/plain' \
-F 'metadata={"mode":"strict"};type=application/json'For every unresolved attachment, choose the matching file. Even repeated references or identical basenames get separate rows and generated IDs. Check the byte count and SHA-256. Selecting a file never changes the original. You can select a different file in the same row to correct a match.
Review all headers. Authorization, Cookie and X-API-Key must be removed or replaced using Replace credential with prompt. Any other whole header can also use a runtime prompt. The original value is removed from the model and the command editor is cleared. This is intentionally irreversible unless you paste the command again. Values supplied by a recipient must include any needed scheme such as Bearer . The runner prompts for the complete header value.
Review the URL, query, body, each file's contents, field order, transmitted filenames and both notes. Those retained contents are not scrubbed. Use the source command to correct the URL or part values and read it again. Add concise expected and observed results. Confirm review only when ready to share.
3. Exact supported command table
| Input | Behavior and boundary |
|---|---|
curl 'http(s)://…', --url | Exactly one URL. ASCII DNS/IPv4 host, optional port, path and query. Quote URL punctuation. No URL credentials, fragment, IPv6 literal, backslash or whitespace. |
-X, --request | One explicit GET, POST, PUT, PATCH or DELETE. Otherwise GET with no body; POST with data or multipart. |
-H, --header | Repeated Name: value headers retain order. Empty/suppressed headers and Host, Content-Length, Transfer-Encoding, Connection, Expect, Proxy-Authorization are rejected. Multipart rejects a top-level Content-Type. |
--data-raw | One literal UTF-8 body, including a leading @. No repeated data flags or mixing with multipart. |
--data-binary | One literal UTF-8 body or @file reference explicitly bound to bytes. Use @file for arbitrary binary including NUL. |
-F, --form | Repeated name=value or name=@file; optional literal ;type=media/type. File parts require explicit ;type=media/type and may add ;filename=simple-name. No <file, nested multipart, comma file lists, custom part headers or encoders. |
--form-string | Literal name=value. @ and ;type= text inside the value stay literal. |
-s, --silent, -S, --show-error | Accepted as presentation options. The runner always uses its own concise status output. |
Short flags must be separate tokens, never clusters. Use single/double shell quotes and backslash continuation. No expansion, substitutions, pipes, redirects, chaining, assignments, ANSI-C quotes, multiple commands or PowerShell/cmd grammar. Literal $ is supported inside single quotes or escaped according to POSIX rules.
Multipart field names use letters, digits, dot, dash or underscore (1–128 characters). Transmitted filenames use ASCII letters, digits, spaces, dot, dash and underscore (1–128 characters; never just . or ..). Media types are simple type/subtype without parameters. Typed literal fields cannot contain semicolons, backslashes or line breaks or start with @, < or a double quote. Use --form-string for an untyped literal when suitable. File references cannot contain commas, semicolons, quotes or backslashes.
Limits: command 64 KiB; 100 headers and 100 parts; 20 attached files, 10 MiB each and 50 MiB total; inline value 1 MiB; complete case metadata 2 MiB; each note 8 KiB (the editor caps input at 8,000 characters); saved project 72 MiB. Larger cases must be reduced externally. Browser memory use exceeds the attachment size during export.
4. Export and reopen
Export recipient ZIP creates case.json, files/NNN.bin, manifest.json, README.md, README.html, replay.py and LICENSE.txt. The original command, binding paths and replaced header values are not written. The transmitted basename remains part of request semantics: review it too.
Save reviewed project downloads JSON with the same reviewed model and base64 attachments. Use Open saved project to validate and reopen that JSON, then review again. Arbitrary ZIP import is not supported. Invalid JSON, duplicate keys, missing fields, invalid base64, changed attachment bytes or oversized values are refused. Recipient packets and saved projects are different formats.
The SHA-256 inventory detects changes, not authenticity. Do not treat a valid hash as proof that an unknown sender's code is trustworthy.
5. Preview first, then explicitly send
Recipient requirements: Linux, Python 3.10+ and cURL 7.81+. Tested with Python 3.10.12 and cURL 7.81.0. No authoring app or Python packages are needed. Extract the entire recipient ZIP. Read README, case.json and the files; inspect code from an unfamiliar sender before running it.
python3 replay.py
The default checks the inventory and reports the method, URL and counts. It opens no network connection. Relative attachments resolve inside the packet, even if you launch the script from another working directory.
For the fictional example only, start the separate server in another terminal from the buyer/free pack:
python3 examples/demo_server.py
The demo binds only 127.0.0.1:8765, reads at most 1 MiB with a three-second socket timeout and does not persist uploads. It is separate from every recipient packet. Stop it with Ctrl-C.
Back in the recipient packet, explicitly authorize the exact origin:
python3 replay.py --send --allow-origin http://127.0.0.1:8765
Sending may modify the chosen API. Use only a target you intend to contact. The sample prints HTTP status: 200. For a failing example, change only the command's metadata part type from application/json to text/plain, read the request, reselect report.txt and export another packet. Sending that case prints HTTP status: 415 and exits 3.
Runtime credentials require an interactive terminal and are entered using a hidden prompt. They pass to cURL through stdin configuration, not arguments, files or environment. No redirects, retries, inherited proxy settings or inherited .curlrc are used. URL globbing is disabled. TLS verification remains enabled. The runner discards the response body, reports only the status, uses a 3-second connect timeout and 10-second total request timeout. Exit 0 means a preview or 2xx response; 3 means non-2xx; 2 means validation or transport failure. Non-2xx can be the intended reproduction.
6. Troubleshooting
| What you see | Next step |
|---|---|
| Export stays disabled | Read the request, match every attachment, replace/remove recognized credential headers, and check the review box. Editing notes resets that confirmation. |
| Unsupported option or multipart syntax | Use the table above. Do not remove an option if doing so changes the case you need to reproduce; use a different tool for requests outside this subset. |
| File requires explicit type | Add the intended ;type=media/type. This avoids changing filename-based type inference when the file is packaged under a generated ID. |
| Inventory mismatch / missing file / unlisted member | Extract into a fresh empty folder or ask its author for a new export. Extra files (including hidden files), extra directories and unlisted attachments are refused. Keep the demo server and your own notes outside the recipient folder. Do not disable verification or silently edit the packet. |
| Wrong allow-origin | Copy the exact scheme, host and port from the preview, without a path or trailing slash. An explicitly written default port also belongs to the exact origin. |
| Connection refused / status 000 | Start the fictional demo server when using the example. For another endpoint, check reachability, TLS and the 10-second timeout. Custom proxies and certificates are outside scope. |
| Address already in use | Stop your own earlier demo server. Do not terminate another person's process. |
| Credential prompt refused | Run in an interactive terminal. Redirected stdin is intentionally not a credential input channel. |
| Blank or incomplete local UI | Extract all files first; open app/index.html in tested Linux Chrome. No npm installation is required. |
7. Privacy, limitations and uninstall
Authoring stays in browser memory. There is no telemetry, localStorage, remote font, CDN or network API in the app. Refresh or Clear workspace removes the working state. Downloaded projects and ZIPs persist wherever your browser saves them. These may contain sensitive retained contents: RequestParcel is not a complete sanitiser. It does not inspect binary files for secrets.
This is a bounded support handoff tool, not a full API client, raw-wire recorder, HAR tool, authentication helper or guaranteed bug reproducer. No Windows/macOS, proprietary API integration or accessibility compliance claim is made. An upload may still differ because of endpoint state or cURL behavior outside the supported subset.
To uninstall, close the page and remove the extracted folder and any unwanted downloads. Stop your own demo server with Ctrl-C. No service or account is installed.
The free pack contains this guide, screenshots and the fictional example/server. It does not include the paid authoring app. Source code distributed in the buyer package uses the included MIT license. Example text and visuals are original first-party material.