@piyushdoorwar/yamlet 1.14.0 → 1.15.0

package/dist/yamlet.js

@@ -17654,8 +17654,8 @@ var require_lodash = __commonJS({
           }
           value = toNumber(value);
           if (value === INFINITY || value === -INFINITY) {
-            var sign = value < 0 ? -1 : 1;
-            return sign * MAX_INTEGER;
+            var sign2 = value < 0 ? -1 : 1;
+            return sign2 * MAX_INTEGER;
           }
           return value === value ? value : 0;
         }
@@ -19851,8 +19851,8 @@ var require_moment = __commonJS({
         return units;
       }
       function zeroFill(number, targetLength, forceSign) {
-        var absNumber = "" + Math.abs(number), zerosToFill = targetLength - absNumber.length, sign2 = number >= 0;
-        return (sign2 ? forceSign ? "+" : "" : "-") + Math.pow(10, Math.max(0, zerosToFill)).toString().substr(1) + absNumber;
+        var absNumber = "" + Math.abs(number), zerosToFill = targetLength - absNumber.length, sign3 = number >= 0;
+        return (sign3 ? forceSign ? "+" : "" : "-") + Math.pow(10, Math.max(0, zerosToFill)).toString().substr(1) + absNumber;
       }
       var formattingTokens = /(\[[^\[]*\])|(\\e)|(\\)?(eHHmm|[Hh]mm(ss)?|Mo|MM?M?M?|Do|DDDo|DD?D?D?|ddd?d?|do?|w[o|w]?|W[o|W]?|Qo?|N{1,5}|YYYYYY|YYYYY|YYYY|YY|y{2,4}|yo?|gg(ggg?)?|GG(GGG?)?|e|E|a|A|hh?|HH?|kk?|mm?|ss?|S{1,9}|x|X|zz?|ZZ?|.)/g, localFormattingTokens = /(\[[^\[]*\])|(\\)?(LTS|LT|LL?L?L?|l{1,4})/g, formatFunctions = {}, formatTokenFunctions = {};
       function addFormatToken(token2, padded, ordinal3, callback) {
@@ -21955,12 +21955,12 @@ var require_moment = __commonJS({
       }
       function offset(token2, separator) {
         addFormatToken(token2, 0, 0, function() {
-          var offset2 = this.utcOffset(), sign2 = "+";
+          var offset2 = this.utcOffset(), sign3 = "+";
           if (offset2 < 0) {
             offset2 = -offset2;
-            sign2 = "-";
+            sign3 = "-";
           }
-          return sign2 + zeroFill(~~(offset2 / 60), 2) + separator + zeroFill(~~offset2 % 60, 2);
+          return sign3 + zeroFill(~~(offset2 / 60), 2) + separator + zeroFill(~~offset2 % 60, 2);
         });
       }
       offset("Z", ":");
@@ -22120,7 +22120,7 @@ var require_moment = __commonJS({
       }
       var aspNetRegex = /^(-|\+)?(?:(\d*)[. ])?(\d+):(\d+)(?::(\d+)(\.\d*)?)?$/, isoRegex = /^(-|\+)?P(?:([-+]?[0-9,.]*)Y)?(?:([-+]?[0-9,.]*)M)?(?:([-+]?[0-9,.]*)W)?(?:([-+]?[0-9,.]*)D)?(?:T(?:([-+]?[0-9,.]*)H)?(?:([-+]?[0-9,.]*)M)?(?:([-+]?[0-9,.]*)S)?)?$/;
       function createDuration(input, key) {
-        var duration = input, match = null, sign2, ret, diffRes;
+        var duration = input, match = null, sign3, ret, diffRes;
         if (isDuration(input)) {
           duration = {
             ms: input._milliseconds,
@@ -22135,26 +22135,26 @@ var require_moment = __commonJS({
             duration.milliseconds = +input;
           }
         } else if (match = aspNetRegex.exec(input)) {
-          sign2 = match[1] === "-" ? -1 : 1;
+          sign3 = match[1] === "-" ? -1 : 1;
           duration = {
             y: 0,
-            d: toInt(match[DATE]) * sign2,
-            h: toInt(match[HOUR]) * sign2,
-            m: toInt(match[MINUTE]) * sign2,
-            s: toInt(match[SECOND]) * sign2,
-            ms: toInt(absRound(match[MILLISECOND] * 1e3)) * sign2
+            d: toInt(match[DATE]) * sign3,
+            h: toInt(match[HOUR]) * sign3,
+            m: toInt(match[MINUTE]) * sign3,
+            s: toInt(match[SECOND]) * sign3,
+            ms: toInt(absRound(match[MILLISECOND] * 1e3)) * sign3
             // the millisecond decimal point is included in the match
           };
         } else if (match = isoRegex.exec(input)) {
-          sign2 = match[1] === "-" ? -1 : 1;
+          sign3 = match[1] === "-" ? -1 : 1;
           duration = {
-            y: parseIso(match[2], sign2),
-            M: parseIso(match[3], sign2),
-            w: parseIso(match[4], sign2),
-            d: parseIso(match[5], sign2),
-            h: parseIso(match[6], sign2),
-            m: parseIso(match[7], sign2),
-            s: parseIso(match[8], sign2)
+            y: parseIso(match[2], sign3),
+            M: parseIso(match[3], sign3),
+            w: parseIso(match[4], sign3),
+            d: parseIso(match[5], sign3),
+            h: parseIso(match[6], sign3),
+            m: parseIso(match[7], sign3),
+            s: parseIso(match[8], sign3)
           };
         } else if (duration == null) {
           duration = {};
@@ -22178,9 +22178,9 @@ var require_moment = __commonJS({
       }
       createDuration.fn = Duration.prototype;
       createDuration.invalid = createInvalid;
-      function parseIso(inp, sign2) {
+      function parseIso(inp, sign3) {
         var res = inp && parseFloat(inp.replace(",", "."));
-        return (isNaN(res) ? 0 : res) * sign2;
+        return (isNaN(res) ? 0 : res) * sign3;
       }
       function positiveMomentsDifference(base2, other) {
         var res = {};
@@ -23549,7 +23549,7 @@ var require_moment = __commonJS({
         return locale2.postformat(output);
       }
       var abs = Math.abs;
-      function sign(x) {
+      function sign2(x) {
         return (x > 0) - (x < 0) || +x;
       }
       function toISOString() {
@@ -23568,9 +23568,9 @@ var require_moment = __commonJS({
         months2 %= 12;
         s = seconds2 ? seconds2.toFixed(3).replace(/\.?0+$/, "") : "";
         totalSign = total < 0 ? "-" : "";
-        ymSign = sign(this._months) !== sign(total) ? "-" : "";
-        daysSign = sign(this._days) !== sign(total) ? "-" : "";
-        hmsSign = sign(this._milliseconds) !== sign(total) ? "-" : "";
+        ymSign = sign2(this._months) !== sign2(total) ? "-" : "";
+        daysSign = sign2(this._days) !== sign2(total) ? "-" : "";
+        hmsSign = sign2(this._milliseconds) !== sign2(total) ? "-" : "";
         return totalSign + "P" + (years2 ? ymSign + years2 + "Y" : "") + (months2 ? ymSign + months2 + "M" : "") + (days2 ? daysSign + days2 + "D" : "") + (hours2 || minutes2 || seconds2 ? "T" : "") + (hours2 ? hmsSign + hours2 + "H" : "") + (minutes2 ? hmsSign + minutes2 + "M" : "") + (seconds2 ? hmsSign + s + "S" : "");
       }
       var proto = Duration.prototype;
@@ -24166,8 +24166,9 @@ function digestAuthorization(c, opts) {
   const nc = (opts.nc ?? 1).toString(16).padStart(8, "0");
   let ha1 = H(`${opts.username}:${c.realm}:${opts.password}`);
   if (alg.endsWith("-SESS")) ha1 = H(`${ha1}:${c.nonce}:${cnonce}`);
-  const ha2 = H(`${opts.method}:${opts.uri}`);
-  const qop = c.qop?.split(",").map((q2) => q2.trim()).find((q2) => q2 === "auth");
+  const offered = c.qop?.split(",").map((q2) => q2.trim().toLowerCase()) ?? [];
+  const qop = offered.includes("auth") ? "auth" : offered.includes("auth-int") ? "auth-int" : void 0;
+  const ha2 = qop === "auth-int" ? H(`${opts.method}:${opts.uri}:${createHash(hashName).update(opts.body ?? "").digest("hex")}`) : H(`${opts.method}:${opts.uri}`);
   const response = qop ? H(`${ha1}:${c.nonce}:${nc}:${cnonce}:${qop}:${ha2}`) : H(`${ha1}:${c.nonce}:${ha2}`);
   const q = (s) => `"${s.replace(/(["\\])/g, "\\$1")}"`;
   const parts = [
@@ -24213,18 +24214,48 @@ function signAwsV4(opts) {
   const canonicalHeaders = names.map((k) => `${k}:${signed.get(k)}
 `).join("");
   const signedHeaders = names.join(";");
-  const path5 = url2.pathname || "/";
-  const canonicalPath = service === "s3" ? path5 : path5.split("/").map((seg) => awsEncode(decodeSafe(seg))).map((seg) => awsEncode(seg)).join("/");
-  const canonicalQuery = [...url2.searchParams.entries()].map(([k, v]) => [awsEncode(k), awsEncode(v)]).sort(([a, x], [b, y]) => a < b ? -1 : a > b ? 1 : x < y ? -1 : x > y ? 1 : 0).map(([k, v]) => `${k}=${v}`).join("&");
-  const canonicalRequest = [opts.method.toUpperCase(), canonicalPath, canonicalQuery, canonicalHeaders, signedHeaders, payloadHash].join("\n");
+  const canonicalRequest = [opts.method.toUpperCase(), canonicalPath(url2, service), canonicalQuery([...url2.searchParams.entries()]), canonicalHeaders, signedHeaders, payloadHash].join("\n");
   const scope = `${date}/${region}/${service}/aws4_request`;
-  const stringToSign = ["AWS4-HMAC-SHA256", amzDate, scope, sha256(canonicalRequest)].join("\n");
-  const kDate = hmac(`AWS4${opts.aws.secretKey}`, date);
-  const kSigning = hmac(hmac(hmac(kDate, region), service), "aws4_request");
-  const signature = createHmac("sha256", kSigning).update(stringToSign).digest("hex");
+  const signature = sign(canonicalRequest, { amzDate, date, region, service, scope, secretKey: opts.aws.secretKey });
   added.push({ key: "Authorization", value: `AWS4-HMAC-SHA256 Credential=${opts.aws.accessKey}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`, enabled: true });
   return added;
 }
+function canonicalPath(url2, service) {
+  const once = (url2.pathname || "/").split("/").map((seg) => awsEncode(decodeSafe(seg)));
+  return (service === "s3" ? once : once.map((seg) => awsEncode(seg))).join("/");
+}
+function canonicalQuery(entries) {
+  return entries.map(([k, v]) => [awsEncode(k), awsEncode(v)]).sort(([a, x], [b, y]) => a < b ? -1 : a > b ? 1 : x < y ? -1 : x > y ? 1 : 0).map(([k, v]) => `${k}=${v}`).join("&");
+}
+function sign(canonicalRequest, s) {
+  const stringToSign = ["AWS4-HMAC-SHA256", s.amzDate, s.scope, sha256(canonicalRequest)].join("\n");
+  const kDate = hmac(`AWS4${s.secretKey}`, s.date);
+  const kSigning = hmac(hmac(hmac(kDate, s.region), s.service), "aws4_request");
+  return createHmac("sha256", kSigning).update(stringToSign).digest("hex");
+}
+function presignAwsV4(opts) {
+  const url2 = new URL(opts.url);
+  const guessed = awsScopeFromHost(url2.hostname);
+  const region = opts.aws.region.trim() || guessed.region || "us-east-1";
+  const service = opts.aws.service.trim() || guessed.service || "execute-api";
+  const amzDate = (opts.now ?? /* @__PURE__ */ new Date()).toISOString().replace(/[:-]|\.\d{3}/g, "");
+  const date = amzDate.slice(0, 8);
+  const scope = `${date}/${region}/${service}/aws4_request`;
+  const entries = [
+    ...[...url2.searchParams.entries()].filter(([k]) => !k.toLowerCase().startsWith("x-amz-")),
+    ["X-Amz-Algorithm", "AWS4-HMAC-SHA256"],
+    ["X-Amz-Credential", `${opts.aws.accessKey}/${scope}`],
+    ["X-Amz-Date", amzDate],
+    ["X-Amz-Expires", String(opts.expiresSeconds ?? 3600)],
+    ["X-Amz-SignedHeaders", "host"]
+  ];
+  if (opts.aws.sessionToken.trim()) entries.push(["X-Amz-Security-Token", opts.aws.sessionToken.trim()]);
+  const query = canonicalQuery(entries);
+  const canonicalRequest = [opts.method.toUpperCase(), canonicalPath(url2, service), query, `host:${url2.host}
+`, "host", service === "s3" ? "UNSIGNED-PAYLOAD" : sha256(opts.body ?? "")].join("\n");
+  const signature = sign(canonicalRequest, { amzDate, date, region, service, scope, secretKey: opts.aws.secretKey });
+  return `${url2.origin}${url2.pathname}?${query}&X-Amz-Signature=${signature}${url2.hash}`;
+}
 function decodeSafe(s) {
   try {
     return decodeURIComponent(s);
@@ -24329,7 +24360,10 @@ function parseTokenBody(text3, contentType) {
   const result = { accessToken, raw };
   if (typeof o.refresh_token === "string" && o.refresh_token) result.refreshToken = o.refresh_token;
   if (typeof o.token_type === "string" && o.token_type) result.tokenType = o.token_type;
-  if (Number.isFinite(expires) && expires > 0) result.expiresIn = expires;
+  if (Number.isFinite(expires) && expires > 0) {
+    result.expiresIn = expires;
+    result.expiresAt = Date.now() + expires * 1e3;
+  }
   return result;
 }
 async function requestToken(cfg, resolve2, form, opts = {}) {
@@ -24388,7 +24422,8 @@ async function refreshAccessToken(cfg, resolve2, opts) {
   const form = { grant_type: "refresh_token", refresh_token: refreshToken };
   const scope = resolve2(cfg.scope).trim();
   if (scope) form.scope = scope;
-  const result = await requestToken(cfg, resolve2, form, opts);
+  const refreshUrl = resolve2(cfg.refreshTokenUrl ?? "").trim();
+  const result = await requestToken(refreshUrl ? { ...cfg, accessTokenUrl: cfg.refreshTokenUrl } : cfg, resolve2, form, opts);
   if (!result.refreshToken) result.refreshToken = refreshToken;
   return result;
 }
@@ -24396,7 +24431,13 @@ var cache = /* @__PURE__ */ new Map();
 var EXPIRY_MARGIN_MS = 3e4;
 var DEFAULT_LIFETIME_S = 3600;
 function cacheKey(cfg, resolve2) {
-  return [cfg.grantType, resolve2(cfg.accessTokenUrl), resolve2(cfg.clientId), resolve2(cfg.scope), resolve2(cfg.username), cfg.clientAuthentication, resolve2(cfg.audience ?? ""), resolve2(cfg.resource ?? "")].join("|");
+  return [cfg.grantType, resolve2(cfg.accessTokenUrl), resolve2(cfg.clientId), resolve2(cfg.clientSecret), resolve2(cfg.scope), resolve2(cfg.username), resolve2(cfg.password), cfg.clientAuthentication, resolve2(cfg.audience ?? ""), resolve2(cfg.resource ?? "")].join("|");
+}
+function forgetCachedToken(cfg, resolve2) {
+  cache.delete(cacheKey(cfg, resolve2));
+}
+function isExpired(expiresAt) {
+  return !!expiresAt && expiresAt - EXPIRY_MARGIN_MS < Date.now();
 }
 function canFetchAutomatically(cfg, resolve2) {
   if (cfg.grantType !== "client_credentials" && cfg.grantType !== "password") return false;
@@ -29433,24 +29474,24 @@ function parse(formula) {
   }
   let idx = 0;
   let a = 0;
-  let sign = readSign();
+  let sign2 = readSign();
   let number = readNumber();
   if (idx < formula.length && formula.charAt(idx) === "n") {
     idx++;
-    a = sign * (number !== null && number !== void 0 ? number : 1);
+    a = sign2 * (number !== null && number !== void 0 ? number : 1);
     skipWhitespace();
     if (idx < formula.length) {
-      sign = readSign();
+      sign2 = readSign();
       skipWhitespace();
       number = readNumber();
     } else {
-      sign = number = 0;
+      sign2 = number = 0;
     }
   }
   if (number === null || idx < formula.length) {
     throw new Error(`n-th rule couldn't be parsed ('${formula}')`);
   }
-  return [a, sign * number];
+  return [a, sign2 * number];
   function readSign() {
     if (formula.charAt(idx) === "-") {
       idx++;
@@ -32458,8 +32499,9 @@ async function exchange(opts) {
       await res.body.dump();
       redirects.push({ statusCode: res.statusCode, url: url2 });
       const next2 = new URL(location, url2);
-      if (next2.host !== new URL(url2).host && !opts.keepAuth) {
-        headers = headers.filter((h) => !["authorization", "cookie", "x-amz-security-token", "x-amz-date", "x-amz-content-sha256"].includes(h.key.toLowerCase()));
+      if (next2.origin !== new URL(url2).origin && !opts.keepAuth) {
+        const drop = /* @__PURE__ */ new Set(["authorization", "proxy-authorization", "cookie", "x-amz-security-token", "x-amz-date", "x-amz-content-sha256", ...(opts.credentialHeaders ?? []).map((h) => h.toLowerCase())]);
+        headers = headers.filter((h) => !drop.has(h.key.toLowerCase()));
         explicitCookie = void 0;
       }
       if (res.statusCode === 303 || (res.statusCode === 301 || res.statusCode === 302) && method === "POST" && !opts.keepMethod) {
@@ -32678,7 +32720,7 @@ async function execute(input) {
   if (req.preRequestScript?.trim()) {
     const before2 = tests.length;
     try {
-      await runScript({ ...scriptBase, script: req.preRequestScript, phase: "pre", throwOnFailure: input.throwOnTestFailure });
+      await runScript({ ...scriptBase, script: req.preRequestScript, phase: "pre" });
       requestTests += tests.length - before2;
     } catch (e) {
       return finish(errorResponse(emptyResponse(req.method, req.url), `Pre-request script error: ${errMessage2(e)}`));
@@ -32691,14 +32733,35 @@ async function execute(input) {
   const resolve2 = (s) => resolveVariables(s ?? "", ctx);
   const auth = effectiveAuth(req, collection, folders);
   let oauthToken;
-  if (auth.type === "oauth2" && canFetchAutomatically(auth.oauth2, resolve2)) {
-    try {
-      oauthToken = (await getCachedToken(auth.oauth2, resolve2, { dispatcher, signal: input.signal })).accessToken;
-    } catch (e) {
-      return finish(errorResponse(emptyResponse(req.method, resolve2(req.url)), `OAuth 2.0 token request failed: ${errMessage2(e)}`));
+  const remember = (t) => {
+    const source = req.auth.type === "inherit" ? folders.some((f) => f.auth === auth) ? "folder" : "collection" : "request";
+    oauthRefreshed = { accessToken: t.accessToken, refreshToken: t.refreshToken, expiresAt: t.expiresAt, source };
+    if (source === "folder") oauthRefreshed.folderId = [...folders].reverse().find((f) => f.auth === auth)?.id;
+  };
+  if (auth.type === "oauth2") {
+    const cfg = auth.oauth2;
+    const known = refreshedTokenFor(cfg, resolve2);
+    if (known) oauthToken = known.accessToken;
+    const current = known?.accessToken ?? resolve2(cfg.accessToken).trim();
+    let usable = !!current && !isExpired(known ? known.expiresAt : cfg.expiresAt);
+    if (!usable && current && resolve2(cfg.refreshToken).trim()) {
+      try {
+        const t = await refreshAndRemember(cfg, resolve2, { dispatcher, signal: input.signal });
+        oauthToken = t.accessToken;
+        remember(t);
+        usable = true;
+        logs.push("OAuth 2.0: the access token had expired; got a new one with the refresh token.");
+      } catch (e) {
+        logs.push(`[warn] OAuth 2.0: refreshing the expired token failed: ${errMessage2(e)}`);
+      }
+    }
+    if (!usable && canFetchAutomatically(cfg, resolve2)) {
+      try {
+        oauthToken = (await getCachedToken(cfg, resolve2, { dispatcher, signal: input.signal })).accessToken;
+      } catch (e) {
+        return finish(errorResponse(emptyResponse(req.method, resolve2(req.url)), `OAuth 2.0 token request failed: ${errMessage2(e)}`));
+      }
     }
-  } else if (auth.type === "oauth2") {
-    oauthToken = refreshedTokenFor(auth.oauth2, resolve2)?.accessToken;
   }
   let built;
   try {
@@ -32720,7 +32783,12 @@ async function execute(input) {
     let incomplete;
     const withBodyType = (list) => prepared.contentType ? [...list.filter((h) => h.key.toLowerCase() !== "content-type"), { key: "Content-Type", value: prepared.contentType, enabled: true }] : list;
     let headers = withBodyType(built.headers);
-    if (auth.type === "awsv4") {
+    if (auth.type === "awsv4" && auth.aws.addToQuery) {
+      const a = auth.aws;
+      const aws = { accessKey: resolve2(a.accessKey), secretKey: resolve2(a.secretKey), sessionToken: resolve2(a.sessionToken), region: resolve2(a.region), service: resolve2(a.service) };
+      built = { ...built, url: presignAwsV4({ method: built.method, url: built.url, aws, body: prepared.body }) };
+      headers = headers.filter((h) => h.key.toLowerCase() !== "authorization");
+    } else if (auth.type === "awsv4") {
       const a = auth.aws;
       headers = [
         ...headers.filter((h) => h.key.toLowerCase() !== "authorization"),
@@ -32736,7 +32804,8 @@ async function execute(input) {
     const send = (extra = [], live = true) => exchange({
       url: built.url,
       method: built.method,
-      headers: [...headers, ...extra],
+      // Headers computed at send time (Digest) replace ones of the same name.
+      headers: [...headers.filter((h) => !extra.some((x) => x.key.toLowerCase() === h.key.toLowerCase())), ...extra],
       body: prepared.body,
       dispatcher,
       signal,
@@ -32744,6 +32813,7 @@ async function execute(input) {
       maxRedirects: settings.maxRedirects,
       keepMethod: settings.followOriginalMethod,
       keepAuth: settings.followAuthorizationHeader,
+      credentialHeaders: auth.type === "apikey" && auth.apiKeyIn !== "query" && resolve2(auth.apiKeyName).trim() ? [resolve2(auth.apiKeyName).trim()] : void 0,
       jar: settings.disableCookieJar ? void 0 : input.cookieJar,
       onHead: input.onHead && live ? (status, headers2, firstByteMs) => input.onHead({ statusCode: status, reasonPhrase: STATUS_CODES[status] ?? "", headers: toHeaderList(headers2), contentType: headerValue(headers2, "content-type") ?? "", firstByteMs: Math.round(firstByteMs) }) : void 0,
       onChunk: live ? input.onChunk : void 0,
@@ -32755,21 +32825,30 @@ async function execute(input) {
         const challenge = probe.status === 401 ? parseDigestChallenge(headerValue(probe.headers, "www-authenticate")) : void 0;
         if (challenge) {
           const u = new URL(built.url);
-          const authorization = digestAuthorization(challenge, { username: resolve2(auth.username), password: resolve2(auth.password), method: built.method, uri: u.pathname + u.search });
+          const authorization = digestAuthorization(challenge, { username: resolve2(auth.username), password: resolve2(auth.password), method: built.method, uri: u.pathname + u.search, body: prepared.body });
           ex = await send([{ key: "Authorization", value: authorization, enabled: true }]);
         } else ex = probe;
       } else ex = await send();
-      if (ex.status === 401 && auth.type === "oauth2" && !canFetchAutomatically(auth.oauth2, resolve2) && resolve2(auth.oauth2.refreshToken).trim()) {
+      if (ex.status === 401 && auth.type === "oauth2") {
+        const cfg = auth.oauth2;
+        let token;
         try {
-          const token = await refreshAndRemember(auth.oauth2, resolve2, { dispatcher, signal });
+          if (!oauthRefreshed && resolve2(cfg.refreshToken).trim()) {
+            token = await refreshAndRemember(cfg, resolve2, { dispatcher, signal });
+            logs.push("OAuth 2.0: the access token was rejected; got a new one with the refresh token and sent again.");
+          } else if (canFetchAutomatically(cfg, resolve2)) {
+            forgetCachedToken(cfg, resolve2);
+            token = await getCachedToken(cfg, resolve2, { dispatcher, signal });
+            logs.push("OAuth 2.0: the access token was rejected; fetched a new one and sent again.");
+          }
+        } catch (e) {
+          logs.push(`[warn] OAuth 2.0: getting a new token failed: ${errMessage2(e)}`);
+        }
+        if (token) {
           built = buildRequest(req, { ctx, collection, folders, oauthToken: token.accessToken });
           headers = withBodyType(built.headers);
-          oauthRefreshed = { accessToken: token.accessToken, refreshToken: token.refreshToken, source: req.auth.type === "inherit" ? folders.some((f) => f.auth === auth) ? "folder" : "collection" : "request" };
-          if (oauthRefreshed.source === "folder") oauthRefreshed.folderId = [...folders].reverse().find((f) => f.auth === auth)?.id;
-          logs.push("OAuth 2.0: the access token was rejected; got a new one with the refresh token and sent again.");
+          remember(token);
           ex = await send();
-        } catch (e) {
-          logs.push(`[warn] OAuth 2.0: refreshing the token failed: ${errMessage2(e)}`);
         }
       }
       if (ex.truncated) {
@@ -32809,7 +32888,7 @@ async function execute(input) {
   if (req.postResponseScript?.trim()) {
     const before2 = tests.length;
     try {
-      await runScript({ ...scriptBase, script: req.postResponseScript, phase: "post", response, throwOnFailure: input.throwOnTestFailure });
+      await runScript({ ...scriptBase, script: req.postResponseScript, phase: "post", response });
     } catch (e) {
       const message = errMessage2(e);
       const last2 = tests.at(-1);
@@ -33073,6 +33152,7 @@ function parseDataFile(text3, filename) {
 }
 
 // core/src/workspaceStore.ts
+import { createHash as createHash2 } from "node:crypto";
 import { existsSync as existsSync3, promises as fs2, statSync as statSync2 } from "node:fs";
 import path4 from "node:path";
 
@@ -33080,6 +33160,7 @@ import path4 from "node:path";
 var environmentScope = (id) => `environment:${id}`;
 var collectionScope = (id) => `collection:${id}`;
 var GLOBALS_SCOPE = "globals";
+var TOKENS_SCOPE = "oauth-tokens";
 var currentScope = (scope) => `current:${scope}`;
 
 // core/src/pathNaming.ts
@@ -33368,6 +33449,7 @@ function readOAuth2(o) {
     refreshToken: get2("refreshToken", "refresh_token") ?? "",
     headerPrefix: get2("headerPrefix", "tokenType")?.trim() || d.headerPrefix,
     accessTokenUrl: get2("accessTokenUrl", "tokenUrl", "access_token_url") ?? "",
+    ...get2("refreshTokenUrl", "refresh_token_url") ? { refreshTokenUrl: get2("refreshTokenUrl", "refresh_token_url") } : {},
     authUrl: get2("authUrl", "authorizationUrl", "auth_url") ?? "",
     clientId: get2("clientId", "client_id") ?? "",
     clientSecret: get2("clientSecret", "client_secret") ?? "",
@@ -33399,7 +33481,8 @@ function readAuth(raw, fallback = "none") {
     secretKey: aws("secretKey"),
     sessionToken: aws("sessionToken"),
     region: aws("region") || a.aws.region,
-    service: aws("service")
+    service: aws("service"),
+    ...["true", "1"].includes((aws("addAuthDataToQuery") || aws("addToQuery")).toLowerCase()) ? { addToQuery: true } : {}
   };
   a.apiKeyName = credential(raw.apikey, "key") ?? (type === "apikey" ? credential(raw.credentials, "key") : void 0) ?? str(raw.key);
   a.apiKeyValue = credential(raw.apikey, "value") ?? (type === "apikey" ? credential(raw.credentials, "value") : void 0) ?? str(raw.value);
@@ -33417,6 +33500,7 @@ function writeOAuth2(o) {
     if (v) out[k] = v;
   };
   put2("accessTokenUrl", o.accessTokenUrl);
+  put2("refreshTokenUrl", o.refreshTokenUrl);
   put2("authUrl", o.authUrl);
   put2("clientId", o.clientId);
   put2("clientSecret", o.clientSecret);
@@ -33424,8 +33508,6 @@ function writeOAuth2(o) {
   put2("redirect_uri", o.redirectUri);
   put2("username", o.username);
   put2("password", o.password);
-  put2("accessToken", o.accessToken);
-  put2("refreshToken", o.refreshToken);
   if (o.headerPrefix && o.headerPrefix !== "Bearer") out.tokenType = o.headerPrefix;
   out.addTokenTo = o.addTokenTo === "query" ? "queryParams" : "header";
   out.client_authentication = o.clientAuthentication === "body" ? "body" : "header";
@@ -33454,6 +33536,8 @@ var MODELED_CREDENTIALS = new Set(
     "accessTokenUrl",
     "tokenUrl",
     "access_token_url",
+    "refreshTokenUrl",
+    "refresh_token_url",
     "authUrl",
     "authorizationUrl",
     "auth_url",
@@ -33476,10 +33560,19 @@ var MODELED_CREDENTIALS = new Set(
     "secretKey",
     "sessionToken",
     "region",
-    "service"
+    "service",
+    "addAuthDataToQuery",
+    "addToQuery"
   ].map((k) => k.toLowerCase())
 );
-var normalizedAuth = (v) => writeAuth(readAuth(v, "none"));
+var TOKEN_KEYS = /* @__PURE__ */ new Set(["accesstoken", "access_token", "refreshtoken", "refresh_token"]);
+function hasTokenIn(v) {
+  if (Array.isArray(v)) return v.some(hasTokenIn);
+  if (!isObj(v)) return false;
+  if (typeof v.key === "string" && TOKEN_KEYS.has(v.key.toLowerCase()) && v.value) return true;
+  return Object.entries(v).some(([k, val2]) => TOKEN_KEYS.has(k.toLowerCase()) && !!val2 || hasTokenIn(val2));
+}
+var normalizedAuth = (v) => ({ ...writeAuth(readAuth(v, "none")), ...hasTokenIn(v) ? { token: true } : {} });
 function mergeAuth(ours, original) {
   if (!isObj(original) || str(original.type).toLowerCase() !== str(ours.type).toLowerCase() || !isObj(original.credentials)) return ours;
   const extra = Object.entries(original.credentials).filter(([k]) => !MODELED_CREDENTIALS.has(k.toLowerCase()));
@@ -33507,6 +33600,7 @@ function writeAuth(a) {
       put2("sessionToken", a.aws.sessionToken);
       put2("region", a.aws.region);
       put2("service", a.aws.service);
+      if (a.aws.addToQuery) creds.addAuthDataToQuery = true;
       break;
     case "apikey":
       put2("key", a.apiKeyName);
@@ -33705,6 +33799,10 @@ function readExamples(raw) {
     };
     if (o.contentType) e.contentType = str(o.contentType);
     if (o.savedAt) e.savedAt = str(o.savedAt);
+    if (isObj(o.request) && (o.request.method || o.request.url)) {
+      e.request = { method: str(o.request.method) || "GET", url: str(o.request.url) };
+      if (o.request.body) e.request.body = str(o.request.body);
+    }
     return e;
   });
 }
@@ -33717,6 +33815,7 @@ function writeExamples(list) {
     if (e.contentType) o.contentType = e.contentType;
     if (e.body) o.body = e.body;
     if (e.savedAt) o.savedAt = e.savedAt;
+    if (e.request) o.request = { method: e.request.method, url: e.request.url, ...e.request.body ? { body: e.request.body } : {} };
     return o;
   });
 }
@@ -34202,8 +34301,12 @@ var WorkspaceStore = class _WorkspaceStore {
   async deleteCollection(id) {
     return this.enqueue(async () => {
       const c = this.requireCollection(id);
-      if (c.directoryPath) await fs2.rm(c.directoryPath, { recursive: true, force: true });
+      if (c.directoryPath) {
+        await fs2.rm(c.directoryPath, { recursive: true, force: true });
+        this.forget(c.directoryPath);
+      }
       await this.dropLocal(collectionScope(c.id));
+      await this.dropTokens(c);
       this.workspace.collections = this.workspace.collections.filter((x) => x !== c);
       return c;
     });
@@ -34214,6 +34317,7 @@ var WorkspaceStore = class _WorkspaceStore {
       if (!src.directoryPath) throw new Error("Collection has no directory");
       const name = copyName(src.name);
       const dir = uniqueDirectoryPath(this.workspace.collectionsPath, fileSafeName(name, "Collection"));
+      this.forget(dir);
       await fs2.cp(src.directoryPath, dir, { recursive: true });
       const c = structuredClone(src);
       repathTree(c, src.directoryPath, dir);
@@ -34221,7 +34325,7 @@ var WorkspaceStore = class _WorkspaceStore {
       c.name = name;
       c.filePath = path4.join(dir, DEFINITION_FILE);
       c.order = nextOrder(this.workspace.collections);
-      await this.writeTree(c);
+      await this.writeCopy(c, dir);
       this.workspace.collections.push(c);
       return c;
     });
@@ -34242,19 +34346,24 @@ var WorkspaceStore = class _WorkspaceStore {
         for (const [i, r] of node.requests.entries()) {
           r.order = (i + 1) * ORDER_STEP;
           r.sourceFilePath = uniqueFilePath(nodeDir, fileSafeName(r.name, "New Request"), REQUEST_SUFFIX);
-          await this.writeFile(r.sourceFilePath, requestToYaml(r, void 0, r.sourceFilePath));
+          const text3 = requestToYaml(r, void 0, r.sourceFilePath);
+          await this.writeFile(r.sourceFilePath, text3);
+          r.baseHash = textHash(text3);
+          await this.saveToken(r.id, r.auth);
         }
         for (const [i, f] of node.folders.entries()) {
           f.order = (i + 1) * ORDER_STEP;
           f.directoryPath = uniqueDirectoryPath(nodeDir, fileSafeName(f.name, "New Folder"));
           await fs2.mkdir(f.directoryPath, { recursive: true });
           await this.writeFile(path4.join(f.directoryPath, DEFINITION_FILE), folderToYaml(f, void 0, path4.basename(f.directoryPath)));
+          await this.saveToken(f.id, f.auth);
           await placeAndWrite(f, f.directoryPath);
         }
       };
       await placeAndWrite(c, dir);
       await this.saveLocal(collectionScope(c.id), c.variables);
       await this.writeFile(c.filePath, collectionToYaml(c));
+      await this.saveToken(c.id, c.auth);
       ws.collections.push(c);
       return c;
     });
@@ -34290,7 +34399,11 @@ var WorkspaceStore = class _WorkspaceStore {
     return this.enqueue(async () => {
       const hit = this.locateFolder(id);
       if (!hit) throw new Error(`Folder not found: ${id}`);
-      if (hit.folder.directoryPath) await fs2.rm(hit.folder.directoryPath, { recursive: true, force: true });
+      if (hit.folder.directoryPath) {
+        await fs2.rm(hit.folder.directoryPath, { recursive: true, force: true });
+        this.forget(hit.folder.directoryPath);
+      }
+      await this.dropTokens(hit.folder);
       hit.list.splice(hit.list.indexOf(hit.folder), 1);
       return hit.folder;
     });
@@ -34303,12 +34416,13 @@ var WorkspaceStore = class _WorkspaceStore {
       const srcDir = src.directoryPath;
       const name = copyName(src.name);
       const dir = uniqueDirectoryPath(path4.dirname(srcDir), fileSafeName(name, "Folder"));
+      this.forget(dir);
       await fs2.cp(srcDir, dir, { recursive: true });
       const f = structuredClone(src);
       repathTree(f, srcDir, dir);
       freshIds(f);
       f.name = name;
-      await this.writeTree(f);
+      await this.writeCopy(f, dir);
       hit.list.splice(hit.list.indexOf(src) + 1, 0, f);
       await this.saveContainerOrder(hit.collection, hit.folders.at(-1) ?? null);
       return f;
@@ -34323,7 +34437,10 @@ var WorkspaceStore = class _WorkspaceStore {
       const id = init?.id && !this.idInUse(init.id) ? init.id : newId();
       const r = newRequest({ ...init, id, name, sourceFilePath: file, order: nextOrder(node.requests) });
       r.method = (r.method || "GET").toUpperCase();
-      await this.writeFile(file, requestToYaml(r, void 0, file));
+      const text3 = requestToYaml(r, void 0, file);
+      await this.writeFile(file, text3);
+      r.baseHash = textHash(text3);
+      await this.saveToken(r.id, r.auth);
       node.requests.push(r);
       return r;
     });
@@ -34345,7 +34462,15 @@ var WorkspaceStore = class _WorkspaceStore {
       };
       if (!existing.sourceFilePath) throw new Error("Request has no file path");
       if (!updated.name.trim()) updated.name = existing.name;
-      await this.writeRequest(updated, opts.force);
+      let force = opts.force === true;
+      if (!force && request3.baseHash) {
+        const now = await readIfExists(existing.sourceFilePath);
+        if (now !== void 0 && textHash(now) !== request3.baseHash) {
+          throw conflict(`${this.relPath(existing.sourceFilePath)} changed on disk since this request was opened (a git pull or another editor?). Overwrite it, or use the disk version.`, "changed");
+        }
+        force = now !== void 0 && !this.track.broken.has(existing.sourceFilePath);
+      }
+      await this.writeRequest(updated, force);
       hit.list[hit.list.indexOf(existing)] = updated;
       return updated;
     });
@@ -34354,7 +34479,11 @@ var WorkspaceStore = class _WorkspaceStore {
     return this.enqueue(async () => {
       const hit = this.locateRequest(id);
       if (!hit) throw new Error(`Request not found: ${id}`);
-      if (hit.request.sourceFilePath) await fs2.rm(hit.request.sourceFilePath, { force: true });
+      if (hit.request.sourceFilePath) {
+        await fs2.rm(hit.request.sourceFilePath, { force: true });
+        this.forget(hit.request.sourceFilePath);
+      }
+      await this.dropTokens(hit.request);
       hit.list.splice(hit.list.indexOf(hit.request), 1);
       return hit.request;
     });
@@ -34369,7 +34498,10 @@ var WorkspaceStore = class _WorkspaceStore {
       for (const e of r.examples ?? []) e.id = newId();
       r.name = copyName(src.name);
       r.sourceFilePath = uniqueFilePath(path4.dirname(src.sourceFilePath), fileSafeName(r.name, "New Request"), REQUEST_SUFFIX);
-      await this.writeFile(r.sourceFilePath, requestToYaml(r, await readIfExists(src.sourceFilePath), r.sourceFilePath));
+      const text3 = requestToYaml(r, await readIfExists(src.sourceFilePath), r.sourceFilePath);
+      await this.writeFile(r.sourceFilePath, text3);
+      r.baseHash = textHash(text3);
+      await this.saveToken(r.id, r.auth);
       hit.list.splice(hit.list.indexOf(src) + 1, 0, r);
       await this.saveContainerOrder(hit.collection, hit.folders.at(-1) ?? null);
       return r;
@@ -34435,7 +34567,8 @@ var WorkspaceStore = class _WorkspaceStore {
       const fresh = await this.changedOnDisk(file);
       if (fresh !== void 0) {
         try {
-          r = { ...requestFromDto(loadYaml(fresh), file), id: r.id };
+          r = { ...requestFromDto(loadYaml(fresh), file), id: r.id, baseHash: textHash(fresh) };
+          r.auth = withTokensOf(r0.auth, r.auth);
           node.requests[i] = r;
         } catch (e) {
           this.track.broken.set(file, parseMessage(e));
@@ -34453,7 +34586,9 @@ var WorkspaceStore = class _WorkspaceStore {
       const fresh = await this.changedOnDisk(file);
       if (fresh !== void 0) {
         try {
+          const before2 = f.auth;
           applyFolderMetadata(f, loadYaml(fresh));
+          f.auth = withTokensOf(before2, f.auth);
         } catch (e) {
           this.track.broken.set(file, parseMessage(e));
           continue;
@@ -34513,7 +34648,10 @@ var WorkspaceStore = class _WorkspaceStore {
       const list = this.workspace.environments;
       const env = list.find((e) => e.id === id);
       if (!env) throw new Error(`Environment not found: ${id}`);
-      if (env.filePath) await fs2.rm(env.filePath, { force: true });
+      if (env.filePath) {
+        await fs2.rm(env.filePath, { force: true });
+        this.forget(env.filePath);
+      }
       await this.dropLocal(environmentScope(env.id));
       list.splice(list.indexOf(env), 1);
       return env;
@@ -34536,13 +34674,28 @@ var WorkspaceStore = class _WorkspaceStore {
     return this.enqueue(async () => {
       const file = path4.join(this.workspace.globalsPath, GLOBALS_FILE);
       const legacy = path4.join(this.workspace.globalsPath, LEGACY_GLOBALS_FILE);
+      await this.assertWritable(legacy);
       await this.saveLocal(GLOBALS_SCOPE, vars);
       await this.writeFile(file, globalsToYaml(vars, await readIfExists(file) ?? await readIfExists(legacy)));
       await fs2.rm(legacy, { force: true });
+      this.track.seen.set(legacy, ABSENT);
       this.workspace.globals = structuredClone(vars);
       return this.workspace.globals;
     });
   }
+  /**
+   * A new OAuth 2.0 token for a collection or folder: kept in memory and the data folder
+   * only, so the YAML (which never holds tokens) isn't rewritten.
+   */
+  async setToken(id, t) {
+    return this.enqueue(async () => {
+      const node = this.findCollection(id) ?? this.locateFolder(id)?.folder;
+      const auth = node?.auth;
+      if (!node || auth?.type !== "oauth2") return;
+      node.auth = { ...auth, oauth2: { ...auth.oauth2, accessToken: t.accessToken, refreshToken: t.refreshToken || auth.oauth2.refreshToken, expiresAt: t.expiresAt } };
+      await this.saveToken(id, node.auth);
+    });
+  }
   // ---- Internals -----------------------------------------------------------
   enqueue(fn) {
     const run2 = this.queue.then(fn, fn);
@@ -34603,6 +34756,10 @@ var WorkspaceStore = class _WorkspaceStore {
     }
   }
   async writeFile(file, content, force = false) {
+    if (!this.track.broken.has(file) && await readIfExists(file) === content) {
+      this.track.seen.set(file, content);
+      return;
+    }
     await this.assertWritable(file, force);
     await writeFileAtomic(file, content);
     this.track.seen.set(file, content);
@@ -34623,6 +34780,28 @@ var WorkspaceStore = class _WorkspaceStore {
       }
     }
   }
+  /** Forgets what was read under a path that was deleted or is about to be filled by a copy. */
+  forget(target) {
+    for (const map2 of [this.track.seen, this.track.broken]) {
+      for (const file of [...map2.keys()]) if (file === target || file.startsWith(target + path4.sep)) map2.delete(file);
+    }
+  }
+  /** Removes the stored tokens of a deleted item and everything under it. */
+  async dropTokens(node) {
+    if (!this.local) return;
+    const ids = [];
+    const walk2 = (n) => {
+      ids.push(n.id);
+      for (const r of n.requests) ids.push(r.id);
+      for (const f of n.folders) walk2(f);
+    };
+    if ("folders" in node) walk2(node);
+    else ids.push(node.id);
+    const tokens = { ...this.local.get(TOKENS_SCOPE) };
+    if (!ids.some((id) => id in tokens)) return;
+    for (const id of ids) delete tokens[id];
+    await this.local.set(TOKENS_SCOPE, tokens);
+  }
   /** The file's text if it changed on disk since Yamlet read it (it is then taken as read). */
   async changedOnDisk(file) {
     const known = this.track.seen.get(file);
@@ -34636,34 +34815,49 @@ var WorkspaceStore = class _WorkspaceStore {
   async writeRequest(r, force = false) {
     const file = r.sourceFilePath;
     if (!file) return;
-    await this.assertWritable(file, force);
     const original = await readIfExists(file);
     const target = uniqueFilePath(path4.dirname(file), fileSafeName(r.name, "New Request"), REQUEST_SUFFIX, file);
     if (target !== file && existsSync3(file)) {
+      await this.assertWritable(file, force);
       await fs2.rename(file, target);
       this.moved(file, target);
     }
     r.sourceFilePath = target;
-    await this.writeFile(target, requestToYaml(r, original, target), force);
+    const text3 = requestToYaml(r, original, target);
+    await this.writeFile(target, text3, force);
+    r.baseHash = textHash(text3);
+    await this.saveToken(r.id, r.auth);
+  }
+  /** Keeps an item's OAuth 2.0 token (and expiry) in the data folder; the YAML never has it. */
+  async saveToken(id, auth) {
+    if (!this.local) return;
+    const tokens = { ...this.local.get(TOKENS_SCOPE) };
+    const o = auth?.type === "oauth2" ? auth.oauth2 : void 0;
+    const entry = o && (o.accessToken || o.refreshToken) ? JSON.stringify({ accessToken: o.accessToken, refreshToken: o.refreshToken, ...o.expiresAt ? { expiresAt: o.expiresAt } : {} }) : void 0;
+    if (tokens[id] === entry) return;
+    if (entry) tokens[id] = entry;
+    else delete tokens[id];
+    await this.local.set(TOKENS_SCOPE, tokens);
   }
   /** Writes `.resources/definition.yaml` (renaming the directory to match the name) and drops a legacy collection.yaml. */
   async writeCollection(c) {
     if (!c.directoryPath) throw new Error("Collection has no directory");
-    await this.assertWritable(path4.join(c.directoryPath, DEFINITION_FILE));
+    if (path4.basename(c.directoryPath) !== fileSafeName(c.name, "New Collection")) await this.assertWritable(path4.join(c.directoryPath, DEFINITION_FILE));
     await this.renameNodeDir(c, this.workspace.collectionsPath, fileSafeName(c.name, "New Collection"));
     const file = path4.join(c.directoryPath, DEFINITION_FILE);
     const legacy = path4.join(c.directoryPath, LEGACY_COLLECTION_FILE);
-    await this.assertWritable(file);
     await this.assertWritable(legacy);
     const original = await readIfExists(file) ?? await readIfExists(legacy);
     c.filePath = file;
     await this.saveLocal(collectionScope(c.id), c.variables);
     await this.writeFile(file, collectionToYaml(c, original));
+    await this.saveToken(c.id, c.auth);
     await fs2.rm(legacy, { force: true });
+    this.forget(legacy);
   }
   async writeFolder(f) {
     if (!f.directoryPath) return;
-    await this.assertWritable(path4.join(f.directoryPath, DEFINITION_FILE));
+    if (path4.basename(f.directoryPath) !== fileSafeName(f.name, "New Folder")) await this.assertWritable(path4.join(f.directoryPath, DEFINITION_FILE));
     await this.assertWritable(path4.join(f.directoryPath, LEGACY_FOLDER_FILE));
     await this.renameNodeDir(f, path4.dirname(f.directoryPath), fileSafeName(f.name, "New Folder"));
     const dir = f.directoryPath;
@@ -34671,7 +34865,19 @@ var WorkspaceStore = class _WorkspaceStore {
     const legacy = path4.join(dir, LEGACY_FOLDER_FILE);
     const original = await readIfExists(file) ?? await readIfExists(legacy);
     await this.writeFile(file, folderToYaml(f, original, path4.basename(dir)));
+    await this.saveToken(f.id, f.auth);
     await fs2.rm(legacy, { force: true });
+    this.forget(legacy);
+  }
+  /** Writes a freshly copied tree; if that fails, the copy is removed rather than left behind. */
+  async writeCopy(node, dir) {
+    try {
+      await this.writeTree(node);
+    } catch (e) {
+      await fs2.rm(dir, { recursive: true, force: true }).catch(() => void 0);
+      this.forget(dir);
+      throw e;
+    }
   }
   /** Rewrites every metadata and request file under a node (used after copying a directory). */
   async writeTree(node) {
@@ -34681,6 +34887,13 @@ var WorkspaceStore = class _WorkspaceStore {
     for (const f of node.folders) await this.writeTree(f);
   }
 };
+function withTokensOf(prev2, next2) {
+  if (prev2?.type !== "oauth2" || next2?.type !== "oauth2") return next2;
+  const { accessToken, refreshToken, expiresAt } = prev2.oauth2;
+  return { ...next2, oauth2: { ...next2.oauth2, accessToken, refreshToken, ...expiresAt ? { expiresAt } : {} } };
+}
+var ABSENT = "\0absent";
+var textHash = (text3) => createHash2("sha256").update(text3).digest("hex").slice(0, 32);
 function conflict(message, reason) {
   return Object.assign(new Error(message), { statusCode: 409, reason });
 }
@@ -34726,6 +34939,10 @@ async function loadWorkspace(root2, track) {
   const current = await readIfExists(globalsFile);
   const globalsText = current ?? await readIfExists(legacyGlobals);
   const globalsPath = current !== void 0 ? globalsFile : legacyGlobals;
+  if (current === void 0) track.seen.set(globalsFile, ABSENT);
+  if (globalsText === void 0 || current !== void 0) {
+    if (!await readIfExists(legacyGlobals)) track.seen.set(legacyGlobals, ABSENT);
+  }
   if (globalsText) {
     try {
       ws.globals = globalsFromYaml(globalsText);
@@ -34749,6 +34966,7 @@ async function loadCollection(dir, rel, track) {
   });
   const read = async (file, apply) => {
     const text3 = await readIfExists(file);
+    if (text3 === void 0) track.seen.set(file, ABSENT);
     if (!text3) return;
     try {
       apply(loadYaml(text3));
@@ -34771,6 +34989,7 @@ async function loadFolders(parentDir, rel, track) {
     const f = newFolder({ id: stableId("f", rel(dir)), name: entry.name, directoryPath: dir });
     for (const file of [DEFINITION_FILE, LEGACY_FOLDER_FILE]) {
       const meta = await readIfExists(path4.join(dir, file));
+      if (meta === void 0) track.seen.set(path4.join(dir, file), ABSENT);
       if (!meta) continue;
       try {
         applyFolderMetadata(f, loadYaml(meta));
@@ -34799,6 +35018,7 @@ async function loadRequests(dir, rel, track) {
       if (raw.$kind !== void 0 && String(raw.$kind) !== REQUEST_KIND) continue;
       const r = requestFromDto(raw, file);
       if (!String(raw.id ?? "").trim()) r.id = stableId("r", rel(file));
+      r.baseHash = textHash(text3);
       requests.push(r);
       track.seen.set(file, text3);
     } catch (e) {
@@ -34845,6 +35065,22 @@ function applyLocalValues(ws, local) {
   for (const e of ws.environments) overlay(e.variables, environmentScope(e.id));
   for (const c of ws.collections) overlay(c.variables, collectionScope(c.id));
   overlay(ws.globals, GLOBALS_SCOPE);
+  const tokens = local.get(TOKENS_SCOPE);
+  if (!tokens) return;
+  const withToken = (id, auth) => {
+    if (auth?.type !== "oauth2" || !tokens[id]) return;
+    try {
+      const t = JSON.parse(tokens[id]);
+      auth.oauth2 = { ...auth.oauth2, accessToken: t.accessToken ?? "", refreshToken: t.refreshToken ?? "", ...t.expiresAt ? { expiresAt: t.expiresAt } : {} };
+    } catch {
+    }
+  };
+  const walk2 = (node) => {
+    withToken(node.id, node.auth);
+    for (const r of node.requests) withToken(r.id, r.auth);
+    for (const f of node.folders) walk2(f);
+  };
+  ws.collections.forEach(walk2);
 }
 
 // core/src/runReports.ts
@@ -34880,7 +35116,7 @@ function formatJson(summary) {
 }
 
 // cli/src/index.ts
-var VERSION = true ? "1.14.0" : "0.0.0-dev";
+var VERSION = true ? "1.15.0" : "0.0.0-dev";
 setYamletVersion(VERSION);
 var CliError = class extends Error {
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piyushdoorwar/yamlet",
-  "version": "1.14.0",
+  "version": "1.15.0",
   "description": "Run Yamlet API collections (Git-friendly YAML) from the command line or CI.",
   "type": "module",
   "bin": {