@testsmith/api-spector 0.1.4 → 0.1.6

package/out/renderer/assets/{index-D-jqC4fC.js → index-D5-etZ-W.js}

@@ -905,6 +905,7 @@ function checkDCE$1() {
   reactDom.exports = reactDom_production;
 }
 var reactDomExports = reactDom.exports;
+const ReactDOM$2 = /* @__PURE__ */ getDefaultExportFromCjs(reactDomExports);
 /**
  * @license React
  * react-dom-client.production.js
@@ -13410,9 +13411,10 @@ const useStore = create()(
     activeCollectionId: null,
     activeEnvironmentId: localStorage.getItem("activeEnvironmentId") ?? null,
     globals: {},
+    sessionVars: {},
     showGeneratorPanel: false,
     theme: localStorage.getItem("theme") ?? "dark",
-    zoom: Number(localStorage.getItem("zoom") ?? "1"),
+    zoom: Number(localStorage.getItem("zoom") ?? "1.1"),
     history: [],
     sidebarTab: "collections",
     workspaceSettingsOpen: false,
@@ -13446,6 +13448,7 @@ const useStore = create()(
       s.activeTabId = null;
       s.activeCollectionId = null;
       s.globals = {};
+      s.sessionVars = {};
       s.runnerResults = [];
       s.runnerRunning = false;
       s.runnerModal = { open: false, collectionId: null, folderId: null, filterTags: [] };
@@ -13639,6 +13642,12 @@ const useStore = create()(
       s.collections[id2].data.tls = tls;
       s.collections[id2].dirty = true;
     }),
+    updateCollectionAuthAndHeaders: (id2, auth, headers) => set2((s) => {
+      if (!s.collections[id2]) return;
+      s.collections[id2].data.auth = auth;
+      s.collections[id2].data.headers = headers;
+      s.collections[id2].dirty = true;
+    }),
     // ── Folder CRUD ───────────────────────────────────────────────────────────
     addFolder: (collectionId, parentFolderId, name2) => set2((s) => {
       const col = s.collections[collectionId]?.data;
@@ -13758,6 +13767,37 @@ const useStore = create()(
       s.tabs.push(tab);
       s.activeTabId = tab.id;
     }),
+    moveRequest: (srcCollectionId, requestId, destCollectionId, destFolderId, destIndex) => set2((s) => {
+      const srcCol = s.collections[srcCollectionId]?.data;
+      const destCol = s.collections[destCollectionId]?.data;
+      if (!srcCol || !destCol) return;
+      const req = srcCol.requests[requestId];
+      if (!req) return;
+      const srcFolder = findFolderContaining(srcCol.rootFolder, requestId);
+      const srcIdx = srcFolder ? srcFolder.requestIds.indexOf(requestId) : -1;
+      removeFromFolder(srcCol.rootFolder, requestId);
+      s.collections[srcCollectionId].dirty = true;
+      if (srcCollectionId !== destCollectionId) {
+        delete srcCol.requests[requestId];
+        destCol.requests[requestId] = req;
+        const tab = s.tabs.find((t2) => t2.requestId === requestId);
+        if (tab) tab.collectionId = destCollectionId;
+      }
+      const destFolder = findFolder(destCol.rootFolder, destFolderId);
+      if (destFolder) {
+        if (destIndex !== void 0) {
+          let adjusted = destIndex;
+          if (srcCollectionId === destCollectionId && srcFolder?.id === destFolder.id && srcIdx < destIndex) {
+            adjusted--;
+          }
+          adjusted = Math.max(0, Math.min(adjusted, destFolder.requestIds.length));
+          destFolder.requestIds.splice(adjusted, 0, requestId);
+        } else {
+          destFolder.requestIds.push(requestId);
+        }
+      }
+      s.collections[destCollectionId].dirty = true;
+    }),
     // ── Tags ──────────────────────────────────────────────────────────────────
     updateFolderTags: (collectionId, folderId, tags2) => set2((s) => {
       const col = s.collections[collectionId]?.data;
@@ -13802,16 +13842,12 @@ const useStore = create()(
       const state = useStore.getState();
       const colEntry = Object.values(state.collections).find((c) => c.data.requests[requestId]);
       if (!colEntry) return { auth: null, headers: [] };
+      let inheritedAuth = colEntry.data.auth && colEntry.data.auth.type !== "none" ? colEntry.data.auth : null;
+      let inheritedHeaders = colEntry.data.headers?.filter((h) => h.enabled && h.key) ?? [];
       const path = findFolderPath(colEntry.data.rootFolder, requestId);
-      let inheritedAuth = null;
-      let inheritedHeaders = [];
       for (const folder of path) {
-        if (folder.auth && folder.auth.type !== "none") {
-          inheritedAuth = folder.auth;
-        }
-        if (folder.headers && folder.headers.length > 0) {
-          inheritedHeaders = [...inheritedHeaders, ...folder.headers];
-        }
+        if (folder.auth && folder.auth.type !== "none") inheritedAuth = folder.auth;
+        if (folder.headers?.length) inheritedHeaders = [...inheritedHeaders, ...folder.headers];
       }
       return { auth: inheritedAuth, headers: inheritedHeaders };
     },
@@ -13868,6 +13904,7 @@ const useStore = create()(
         }
       }
       s.globals = { ...s.globals, ...result.updatedGlobals };
+      s.sessionVars = { ...s.sessionVars, ...result.updatedLocalVars };
     }),
     // ── Theme & zoom ──────────────────────────────────────────────────────────
     setTheme: (t2) => set2((s) => {
@@ -34505,18 +34542,35 @@ function mockScriptCompletionExtension() {
     ]
   });
 }
+const SCRIPT_SET_RE = /\bsp\.(?:variables|collectionVariables|environment|globals)\.set\(\s*["']([^"']+)["']/g;
+function extractScriptVarNames(script) {
+  if (!script) return [];
+  const names2 = [];
+  let m;
+  SCRIPT_SET_RE.lastIndex = 0;
+  while ((m = SCRIPT_SET_RE.exec(script)) !== null) names2.push(m[1]);
+  return names2;
+}
 function useVarNames() {
   const activeEnvironmentId = useStore((s) => s.activeEnvironmentId);
   const activeCollectionId = useStore((s) => s.activeCollectionId);
   const environments = useStore((s) => s.environments);
   const collections = useStore((s) => s.collections);
   const globals = useStore((s) => s.globals);
+  const sessionVars = useStore((s) => s.sessionVars);
   return reactExports.useMemo(() => {
     const names2 = /* @__PURE__ */ new Set();
     Object.keys(globals).forEach((k) => names2.add(k));
+    Object.keys(sessionVars).forEach((k) => names2.add(k));
     if (activeCollectionId) {
-      const colVars = collections[activeCollectionId]?.data.collectionVariables ?? {};
-      Object.keys(colVars).forEach((k) => names2.add(k));
+      const col = collections[activeCollectionId]?.data;
+      if (col) {
+        Object.keys(col.collectionVariables ?? {}).forEach((k) => names2.add(k));
+        for (const req of Object.values(col.requests)) {
+          extractScriptVarNames(req.preRequestScript).forEach((k) => names2.add(k));
+          extractScriptVarNames(req.postRequestScript).forEach((k) => names2.add(k));
+        }
+      }
     }
     if (activeEnvironmentId) {
       const envVars = environments[activeEnvironmentId]?.data.variables ?? [];
@@ -34528,7 +34582,8 @@ function useVarNames() {
     activeCollectionId,
     environments,
     collections,
-    globals
+    globals,
+    sessionVars
   ]);
 }
 function useVarValues() {
@@ -34566,24 +34621,80 @@ function parseVarTokens(str) {
   }
   return found;
 }
-function VarInput({ value, onChange, className, wrapperClassName, ...rest }) {
+function PortalDropdown({
+  pos,
+  items: items2,
+  activeIndex,
+  mode,
+  onPick
+}) {
+  return ReactDOM$2.createPortal(
+    /* @__PURE__ */ jsxRuntimeExports.jsx(
+      "ul",
+      {
+        style: { position: "fixed", top: pos.top, left: pos.left, minWidth: pos.minWidth, zIndex: 9999 },
+        className: "max-h-52 overflow-y-auto bg-surface-800 border border-surface-600 rounded shadow-xl text-xs",
+        children: items2.map((s, i) => /* @__PURE__ */ jsxRuntimeExports.jsx("li", { children: /* @__PURE__ */ jsxRuntimeExports.jsx(
+          "button",
+          {
+            onMouseDown: (e) => {
+              e.preventDefault();
+              onPick(s);
+            },
+            className: `w-full text-left px-3 py-1.5 font-mono transition-colors ${i === activeIndex ? "bg-blue-600 text-white" : "hover:bg-surface-700"}`,
+            children: mode === "var" ? /* @__PURE__ */ jsxRuntimeExports.jsxs(jsxRuntimeExports.Fragment, { children: [
+              /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "text-surface-500", children: "{{" }),
+              /* @__PURE__ */ jsxRuntimeExports.jsx("span", { children: s }),
+              /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "text-surface-500", children: "}}" })
+            ] }) : s
+          }
+        ) }, s))
+      }
+    ),
+    document.body
+  );
+}
+function VarInput({ value, onChange, className, wrapperClassName, staticSuggestions, ...rest }) {
   const varNames = useVarNames();
   const varValues = useVarValues();
   const inputRef = reactExports.useRef(null);
   const [suggestions, setSuggestions] = reactExports.useState([]);
+  const [suggestionMode, setSuggestionMode] = reactExports.useState("var");
   const [activeIndex, setActiveIndex] = reactExports.useState(-1);
+  const [dropPos, setDropPos] = reactExports.useState(null);
   const [showPreview, setShowPreview] = reactExports.useState(false);
+  reactExports.useEffect(() => {
+    if (suggestions.length === 0) {
+      setDropPos(null);
+      return;
+    }
+    const el = inputRef.current;
+    if (!el) return;
+    const r = el.getBoundingClientRect();
+    setDropPos({ top: r.bottom + 2, left: r.left, minWidth: r.width });
+  }, [suggestions.length]);
   function detectQuery(val, cursor2) {
     const before = val.slice(0, cursor2);
-    const match = /\{\{(\w*)$/.exec(before);
-    if (!match) {
+    const varMatch = /\{\{(\w*)$/.exec(before);
+    if (varMatch) {
+      const q = varMatch[1].toLowerCase();
+      const filtered = varNames.filter((n) => n.toLowerCase().includes(q));
+      setSuggestions(filtered);
+      setSuggestionMode("var");
+      setActiveIndex(-1);
+    } else if (staticSuggestions) {
+      const q = val.toLowerCase();
+      const filtered = q ? staticSuggestions.filter((s) => s.toLowerCase().includes(q)).sort((a, b) => {
+        const aP = a.toLowerCase().startsWith(q) ? 0 : 1;
+        const bP = b.toLowerCase().startsWith(q) ? 0 : 1;
+        return aP - bP;
+      }).slice(0, 20) : staticSuggestions.slice(0, 20);
+      setSuggestions(filtered);
+      setSuggestionMode("static");
+      setActiveIndex(-1);
+    } else {
       setSuggestions([]);
-      return;
     }
-    const q = match[1].toLowerCase();
-    const filtered = varNames.filter((n) => n.toLowerCase().includes(q));
-    setSuggestions(filtered);
-    setActiveIndex(-1);
   }
   function handleChange(e) {
     const newVal = e.target.value;
@@ -34591,6 +34702,10 @@ function VarInput({ value, onChange, className, wrapperClassName, ...rest }) {
     onChange(newVal);
     detectQuery(newVal, cursor2);
   }
+  function handleFocus(e) {
+    detectQuery(value, e.target.selectionStart ?? value.length);
+    rest.onFocus?.(e);
+  }
   function handleKeyDown(e) {
     if (suggestions.length === 0) return;
     if (e.key === "ArrowDown") {
@@ -34606,21 +34721,28 @@ function VarInput({ value, onChange, className, wrapperClassName, ...rest }) {
       setSuggestions([]);
     }
   }
-  const apply = reactExports.useCallback((name2) => {
+  const apply = reactExports.useCallback((suggestion) => {
+    if (suggestionMode === "static") {
+      onChange(suggestion);
+      setSuggestions([]);
+      return;
+    }
     const el = inputRef.current;
     const cursor2 = el?.selectionStart ?? value.length;
     const before = value.slice(0, cursor2);
     const after = value.slice(cursor2);
     const match = /\{\{(\w*)$/.exec(before);
     if (!match) return;
-    const newVal = before.slice(0, match.index) + `{{${name2}}}` + after;
-    const newCursor = match.index + name2.length + 4;
+    const newVal = before.slice(0, match.index) + `{{${suggestion}}}` + after;
+    const newCursor = match.index + suggestion.length + 4;
     onChange(newVal);
     setSuggestions([]);
     requestAnimationFrame(() => el?.setSelectionRange(newCursor, newCursor));
-  }, [value, onChange]);
-  function handleBlur() {
+  }, [suggestionMode, value, onChange]);
+  function handleBlur(e) {
     setTimeout(() => setSuggestions([]), 150);
+    setShowPreview(false);
+    rest.onBlur?.(e);
   }
   const tokens = parseVarTokens(value);
   const hasVars = tokens.length > 0;
@@ -34628,6 +34750,7 @@ function VarInput({ value, onChange, className, wrapperClassName, ...rest }) {
     name: name2,
     resolved: varValues[name2] ?? null
   }));
+  const { onFocus: _f, onBlur: _b, ...inputRest } = rest;
   return /* @__PURE__ */ jsxRuntimeExports.jsxs(
     "div",
     {
@@ -34642,26 +34765,22 @@ function VarInput({ value, onChange, className, wrapperClassName, ...rest }) {
             value,
             onChange: handleChange,
             onKeyDown: handleKeyDown,
+            onFocus: handleFocus,
             onBlur: handleBlur,
             className: `w-full ${className ?? ""}`,
-            ...rest
+            ...inputRest
           }
         ),
-        suggestions.length > 0 && /* @__PURE__ */ jsxRuntimeExports.jsx("ul", { className: "absolute left-0 top-full mt-0.5 z-50 min-w-[160px] max-h-44 overflow-y-auto bg-surface-800 border border-surface-600 rounded shadow-xl text-xs", children: suggestions.map((name2, i) => /* @__PURE__ */ jsxRuntimeExports.jsx("li", { children: /* @__PURE__ */ jsxRuntimeExports.jsxs(
-          "button",
+        suggestions.length > 0 && dropPos && /* @__PURE__ */ jsxRuntimeExports.jsx(
+          PortalDropdown,
           {
-            onMouseDown: (e) => {
-              e.preventDefault();
-              apply(name2);
-            },
-            className: `w-full text-left px-3 py-1.5 font-mono transition-colors ${i === activeIndex ? "bg-blue-600 text-white" : "hover:bg-surface-700"}`,
-            children: [
-              /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "text-surface-500", children: "{{" }),
-              /* @__PURE__ */ jsxRuntimeExports.jsx("span", { children: name2 }),
-              /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "text-surface-500", children: "}}" })
-            ]
+            pos: dropPos,
+            items: suggestions,
+            activeIndex,
+            mode: suggestionMode,
+            onPick: apply
           }
-        ) }, name2)) }),
+        ),
         showPreview && suggestions.length === 0 && previewItems.length > 0 && /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "absolute left-0 top-full mt-0.5 z-50 bg-surface-800 border border-surface-600 rounded shadow-xl text-xs min-w-[220px] max-w-[420px]", children: previewItems.map(({ name: name2, resolved }) => /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex items-baseline gap-2 px-3 py-1.5 border-b border-surface-700 last:border-0", children: [
           /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "font-mono text-blue-400 shrink-0", children: `{{${name2}}}` }),
           /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "text-surface-500 mx-0.5", children: "→" }),
@@ -34671,7 +34790,113 @@ function VarInput({ value, onChange, className, wrapperClassName, ...rest }) {
     }
   );
 }
-function KVTable({ rows, onChange, keyPlaceholder = "Key", valuePlaceholder = "Value" }) {
+const HEADER_NAMES = [
+  "Accept",
+  "Authorization",
+  "Content-Type",
+  "Cache-Control",
+  "Accept-Language",
+  "Accept-Encoding",
+  "Connection",
+  "Content-Encoding",
+  "Content-Length",
+  "Cookie",
+  "Host",
+  "Origin",
+  "Referer",
+  "User-Agent",
+  "X-Api-Key",
+  "X-Auth-Token",
+  "X-Correlation-ID",
+  "X-Request-ID",
+  "X-Forwarded-For",
+  "X-Requested-With",
+  "X-Tenant-ID",
+  "If-Match",
+  "If-None-Match",
+  "If-Modified-Since",
+  "If-Unmodified-Since",
+  "If-Range",
+  "Date",
+  "Expect",
+  "From",
+  "Max-Forwards",
+  "Pragma",
+  "Proxy-Authorization",
+  "Range",
+  "TE",
+  "Upgrade",
+  "Via",
+  "Warning"
+];
+const HEADER_VALUE_SUGGESTIONS = {
+  "accept": [
+    "application/json",
+    "application/xml",
+    "text/html",
+    "text/plain",
+    "application/ld+json",
+    "*/*"
+  ],
+  "content-type": [
+    "application/json",
+    "application/xml",
+    "application/x-www-form-urlencoded",
+    "multipart/form-data",
+    "text/plain",
+    "text/html",
+    "text/xml",
+    "application/octet-stream",
+    "application/graphql",
+    "application/ld+json"
+  ],
+  "cache-control": [
+    "no-cache",
+    "no-store",
+    "max-age=0",
+    "max-age=3600",
+    "must-revalidate",
+    "private",
+    "public"
+  ],
+  "connection": [
+    "keep-alive",
+    "close",
+    "upgrade"
+  ],
+  "accept-encoding": [
+    "gzip",
+    "deflate",
+    "br",
+    "gzip, deflate, br",
+    "identity",
+    "*"
+  ],
+  "accept-language": [
+    "en-US",
+    "en-US,en;q=0.9",
+    "en",
+    "*"
+  ],
+  "pragma": [
+    "no-cache"
+  ],
+  "transfer-encoding": [
+    "chunked",
+    "gzip",
+    "deflate",
+    "compress",
+    "identity"
+  ],
+  "upgrade": [
+    "websocket",
+    "HTTP/2.0"
+  ]
+};
+function getValueSuggestions(headerName) {
+  return HEADER_VALUE_SUGGESTIONS[headerName.toLowerCase()];
+}
+function KVTable({ rows, onChange, keyPlaceholder = "Key", valuePlaceholder = "Value", headerMode }) {
   const [descVisible, setDescVisible] = reactExports.useState(
     () => new Set(rows.map((r, i) => r.description ? i : -1).filter((i) => i >= 0))
   );
@@ -34725,7 +34950,8 @@ function KVTable({ rows, onChange, keyPlaceholder = "Key", valuePlaceholder = "V
             onChange: (v) => update(idx, { key: v }),
             placeholder: keyPlaceholder,
             wrapperClassName: "flex-1",
-            className: "bg-surface-800 border border-surface-700 rounded px-2 py-1 focus:outline-none focus:border-blue-500 font-mono"
+            className: "bg-surface-800 border border-surface-700 rounded px-2 py-1 focus:outline-none focus:border-blue-500 font-mono",
+            staticSuggestions: headerMode ? HEADER_NAMES : void 0
           }
         ),
         /* @__PURE__ */ jsxRuntimeExports.jsx(
@@ -34735,7 +34961,8 @@ function KVTable({ rows, onChange, keyPlaceholder = "Key", valuePlaceholder = "V
             onChange: (v) => update(idx, { value: v }),
             placeholder: valuePlaceholder,
             wrapperClassName: "flex-1",
-            className: "bg-surface-800 border border-surface-700 rounded px-2 py-1 focus:outline-none focus:border-blue-500 font-mono"
+            className: "bg-surface-800 border border-surface-700 rounded px-2 py-1 focus:outline-none focus:border-blue-500 font-mono",
+            staticSuggestions: headerMode ? getValueSuggestions(row.key) ?? void 0 : void 0
           }
         ),
         /* @__PURE__ */ jsxRuntimeExports.jsx(
@@ -34769,7 +34996,7 @@ function KVTable({ rows, onChange, keyPlaceholder = "Key", valuePlaceholder = "V
     /* @__PURE__ */ jsxRuntimeExports.jsx("button", { onClick: add2, className: "mt-1 text-surface-400 hover:text-white transition-colors", children: "+ Add" })
   ] });
 }
-const AUTH_TYPES$1 = ["none", "bearer", "basic", "digest", "ntlm", "apikey"];
+const AUTH_TYPES$2 = ["none", "bearer", "basic", "digest", "ntlm", "apikey"];
 function FolderSettingsModal({ collectionId, folder, onClose }) {
   const updateFolder = useStore((s) => s.updateFolder);
   const [activeTab, setActiveTab] = reactExports.useState("auth");
@@ -34820,7 +35047,8 @@ function FolderSettingsModal({ collectionId, folder, onClose }) {
                   rows: headers,
                   onChange: setHeaders,
                   keyPlaceholder: "Header-Name",
-                  valuePlaceholder: "value"
+                  valuePlaceholder: "value",
+                  headerMode: true
                 }
               )
             ] }),
@@ -34853,7 +35081,7 @@ function FolderAuthPanel({ auth, onChange }) {
     /* @__PURE__ */ jsxRuntimeExports.jsx("p", { className: "text-[10px] text-surface-600", children: "Auth configured here is inherited by all requests in this folder unless the request overrides it with its own non-none auth type." }),
     /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex flex-wrap items-center gap-2", children: [
       /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "text-surface-400", children: "Type:" }),
-      AUTH_TYPES$1.map((t2) => /* @__PURE__ */ jsxRuntimeExports.jsxs("label", { className: "flex items-center gap-1 cursor-pointer", children: [
+      AUTH_TYPES$2.map((t2) => /* @__PURE__ */ jsxRuntimeExports.jsxs("label", { className: "flex items-center gap-1 cursor-pointer", children: [
         /* @__PURE__ */ jsxRuntimeExports.jsx(
           "input",
           {
@@ -34999,14 +35227,23 @@ function FolderAuthPanel({ auth, onChange }) {
     ] }) })
   ] });
 }
+const AUTH_TYPES$1 = ["none", "bearer", "basic", "digest", "ntlm", "apikey"];
 function CollectionSettingsModal({ collection, onClose }) {
   const updateCollectionTls = useStore((s) => s.updateCollectionTls);
+  const updateCollectionAuthAndHeaders = useStore((s) => s.updateCollectionAuthAndHeaders);
+  const [activeTab, setActiveTab] = reactExports.useState("auth");
+  const [auth, setAuth] = reactExports.useState(collection.auth ?? { type: "none" });
+  const [headers, setHeaders] = reactExports.useState(collection.headers ?? []);
   const existing = collection.tls;
   const [caCertPath, setCaCertPath] = reactExports.useState(existing?.caCertPath ?? "");
   const [clientCertPath, setClientCertPath] = reactExports.useState(existing?.clientCertPath ?? "");
   const [clientKeyPath, setClientKeyPath] = reactExports.useState(existing?.clientKeyPath ?? "");
   const [rejectUnauthorized, setRejectUnauthorized] = reactExports.useState(existing?.rejectUnauthorized !== false);
+  function patchAuth(patch) {
+    setAuth((prev) => ({ ...prev, ...patch }));
+  }
   function save() {
+    updateCollectionAuthAndHeaders(collection.id, auth, headers);
     const hasAny = caCertPath.trim() || clientCertPath.trim() || clientKeyPath.trim();
     updateCollectionTls(collection.id, hasAny ? {
       caCertPath: caCertPath.trim() || void 0,
@@ -35024,65 +35261,90 @@ function CollectionSettingsModal({ collection, onClose }) {
       children: /* @__PURE__ */ jsxRuntimeExports.jsxs(
         "div",
         {
-          className: "w-[560px] bg-surface-900 border border-surface-800 rounded-lg shadow-2xl flex flex-col max-h-[80vh]",
+          className: "w-[600px] bg-surface-900 border border-surface-800 rounded-lg shadow-2xl flex flex-col max-h-[80vh]",
           onClick: (e) => e.stopPropagation(),
           children: [
             /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex items-center justify-between px-4 py-2.5 border-b border-surface-800 shrink-0", children: [
               /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { children: [
                 /* @__PURE__ */ jsxRuntimeExports.jsx("h2", { className: "text-sm font-semibold", children: "Collection settings" }),
-                /* @__PURE__ */ jsxRuntimeExports.jsx("p", { className: "text-[10px] text-surface-600 mt-0.5", children: collection.name })
+                /* @__PURE__ */ jsxRuntimeExports.jsxs("p", { className: "text-[10px] text-surface-600 mt-0.5", children: [
+                  collection.name,
+                  " — auth and headers inherited by all requests in this collection"
+                ] })
               ] }),
               /* @__PURE__ */ jsxRuntimeExports.jsx("button", { onClick: onClose, className: "text-surface-400 hover:text-white text-lg leading-none", children: "×" })
             ] }),
-            /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "px-4 py-3 flex-1 overflow-y-auto text-xs flex flex-col gap-3", children: [
-              /* @__PURE__ */ jsxRuntimeExports.jsx("p", { className: "text-surface-500", children: "TLS settings override the workspace-level configuration for every request in this collection. Leave all paths empty to inherit from the workspace." }),
-              /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex flex-col gap-1", children: [
-                /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-[10px] uppercase tracking-wider text-surface-600 font-medium", children: "CA Certificate path" }),
-                /* @__PURE__ */ jsxRuntimeExports.jsx(
-                  "input",
-                  {
-                    value: caCertPath,
-                    onChange: (e) => setCaCertPath(e.target.value),
-                    placeholder: "/path/to/ca.crt  (leave empty to inherit)",
-                    className: "bg-surface-800 border border-surface-700 rounded px-2.5 py-1.5 focus:outline-none focus:border-blue-500 font-mono placeholder-surface-600"
-                  }
-                )
-              ] }),
-              /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex flex-col gap-1", children: [
-                /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-[10px] uppercase tracking-wider text-surface-600 font-medium", children: "Client certificate path" }),
-                /* @__PURE__ */ jsxRuntimeExports.jsx(
-                  "input",
-                  {
-                    value: clientCertPath,
-                    onChange: (e) => setClientCertPath(e.target.value),
-                    placeholder: "/path/to/client.crt  (leave empty to inherit)",
-                    className: "bg-surface-800 border border-surface-700 rounded px-2.5 py-1.5 focus:outline-none focus:border-blue-500 font-mono placeholder-surface-600"
-                  }
-                )
-              ] }),
-              /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex flex-col gap-1", children: [
-                /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-[10px] uppercase tracking-wider text-surface-600 font-medium", children: "Client key path" }),
-                /* @__PURE__ */ jsxRuntimeExports.jsx(
-                  "input",
-                  {
-                    value: clientKeyPath,
-                    onChange: (e) => setClientKeyPath(e.target.value),
-                    placeholder: "/path/to/client.key  (leave empty to inherit)",
-                    className: "bg-surface-800 border border-surface-700 rounded px-2.5 py-1.5 focus:outline-none focus:border-blue-500 font-mono placeholder-surface-600"
-                  }
-                )
-              ] }),
-              /* @__PURE__ */ jsxRuntimeExports.jsxs("label", { className: "flex items-center gap-2 cursor-pointer", children: [
-                /* @__PURE__ */ jsxRuntimeExports.jsx(
-                  "input",
-                  {
-                    type: "checkbox",
-                    checked: rejectUnauthorized,
-                    onChange: (e) => setRejectUnauthorized(e.target.checked),
-                    className: "accent-blue-500"
-                  }
-                ),
-                /* @__PURE__ */ jsxRuntimeExports.jsx("span", { children: "Reject unauthorized / self-signed certificates" })
+            /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "flex border-b border-surface-800 px-4 shrink-0", children: ["auth", "headers", "tls"].map((t2) => /* @__PURE__ */ jsxRuntimeExports.jsx(
+              "button",
+              {
+                onClick: () => setActiveTab(t2),
+                className: `px-3 py-1.5 text-xs transition-colors border-b-2 -mb-px capitalize ${activeTab === t2 ? "border-blue-500 text-white" : "border-transparent text-surface-400 hover:text-white"}`,
+                children: t2 === "tls" ? "TLS" : t2
+              },
+              t2
+            )) }),
+            /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "px-4 py-3 flex-1 overflow-y-auto text-xs", children: [
+              activeTab === "auth" && /* @__PURE__ */ jsxRuntimeExports.jsx(CollectionAuthPanel, { auth, onChange: patchAuth }),
+              activeTab === "headers" && /* @__PURE__ */ jsxRuntimeExports.jsx(
+                KVTable,
+                {
+                  rows: headers,
+                  onChange: setHeaders,
+                  keyPlaceholder: "Header-Name",
+                  valuePlaceholder: "value",
+                  headerMode: true
+                }
+              ),
+              activeTab === "tls" && /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex flex-col gap-3", children: [
+                /* @__PURE__ */ jsxRuntimeExports.jsx("p", { className: "text-surface-500", children: "TLS settings override the workspace-level configuration for every request in this collection. Leave all paths empty to inherit from the workspace." }),
+                /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex flex-col gap-1", children: [
+                  /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-[10px] uppercase tracking-wider text-surface-600 font-medium", children: "CA Certificate path" }),
+                  /* @__PURE__ */ jsxRuntimeExports.jsx(
+                    "input",
+                    {
+                      value: caCertPath,
+                      onChange: (e) => setCaCertPath(e.target.value),
+                      placeholder: "/path/to/ca.crt  (leave empty to inherit)",
+                      className: "bg-surface-800 border border-surface-700 rounded px-2.5 py-1.5 focus:outline-none focus:border-blue-500 font-mono placeholder-surface-600"
+                    }
+                  )
+                ] }),
+                /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex flex-col gap-1", children: [
+                  /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-[10px] uppercase tracking-wider text-surface-600 font-medium", children: "Client certificate path" }),
+                  /* @__PURE__ */ jsxRuntimeExports.jsx(
+                    "input",
+                    {
+                      value: clientCertPath,
+                      onChange: (e) => setClientCertPath(e.target.value),
+                      placeholder: "/path/to/client.crt  (leave empty to inherit)",
+                      className: "bg-surface-800 border border-surface-700 rounded px-2.5 py-1.5 focus:outline-none focus:border-blue-500 font-mono placeholder-surface-600"
+                    }
+                  )
+                ] }),
+                /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex flex-col gap-1", children: [
+                  /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-[10px] uppercase tracking-wider text-surface-600 font-medium", children: "Client key path" }),
+                  /* @__PURE__ */ jsxRuntimeExports.jsx(
+                    "input",
+                    {
+                      value: clientKeyPath,
+                      onChange: (e) => setClientKeyPath(e.target.value),
+                      placeholder: "/path/to/client.key  (leave empty to inherit)",
+                      className: "bg-surface-800 border border-surface-700 rounded px-2.5 py-1.5 focus:outline-none focus:border-blue-500 font-mono placeholder-surface-600"
+                    }
+                  )
+                ] }),
+                /* @__PURE__ */ jsxRuntimeExports.jsxs("label", { className: "flex items-center gap-2 cursor-pointer", children: [
+                  /* @__PURE__ */ jsxRuntimeExports.jsx(
+                    "input",
+                    {
+                      type: "checkbox",
+                      checked: rejectUnauthorized,
+                      onChange: (e) => setRejectUnauthorized(e.target.checked),
+                      className: "accent-blue-500"
+                    }
+                  ),
+                  /* @__PURE__ */ jsxRuntimeExports.jsx("span", { children: "Reject unauthorized / self-signed certificates" })
+                ] })
               ] })
             ] }),
             /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex gap-2 px-4 py-3 border-t border-surface-800 shrink-0", children: [
@@ -35109,6 +35371,160 @@ function CollectionSettingsModal({ collection, onClose }) {
     }
   );
 }
+function CollectionAuthPanel({ auth, onChange }) {
+  return /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex flex-col gap-3", children: [
+    /* @__PURE__ */ jsxRuntimeExports.jsx("p", { className: "text-[10px] text-surface-600", children: "Auth configured here is inherited by all requests in this collection unless a folder or request overrides it with its own non-none auth type." }),
+    /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex flex-wrap items-center gap-2", children: [
+      /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "text-surface-400", children: "Type:" }),
+      AUTH_TYPES$1.map((t2) => /* @__PURE__ */ jsxRuntimeExports.jsxs("label", { className: "flex items-center gap-1 cursor-pointer", children: [
+        /* @__PURE__ */ jsxRuntimeExports.jsx(
+          "input",
+          {
+            type: "radio",
+            value: t2,
+            checked: auth.type === t2,
+            onChange: () => onChange({ type: t2 }),
+            className: "accent-blue-500"
+          }
+        ),
+        /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: auth.type === t2 ? "text-white" : "text-surface-400", children: t2 })
+      ] }, t2))
+    ] }),
+    auth.type === "bearer" && /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex flex-col gap-1", children: [
+      /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-surface-400", children: "Token" }),
+      /* @__PURE__ */ jsxRuntimeExports.jsx(
+        "input",
+        {
+          value: auth.token ?? "",
+          onChange: (e) => onChange({ token: e.target.value }),
+          placeholder: "Bearer token",
+          className: "bg-surface-800 border border-surface-700 rounded px-2 py-1 font-mono focus:outline-none focus:border-blue-500"
+        }
+      )
+    ] }),
+    (auth.type === "basic" || auth.type === "digest") && /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex gap-2", children: [
+      /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex-1", children: [
+        /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-surface-400", children: "Username" }),
+        /* @__PURE__ */ jsxRuntimeExports.jsx(
+          "input",
+          {
+            value: auth.username ?? "",
+            onChange: (e) => onChange({ username: e.target.value }),
+            className: "mt-1 w-full bg-surface-800 border border-surface-700 rounded px-2 py-1 focus:outline-none focus:border-blue-500"
+          }
+        )
+      ] }),
+      /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex-1", children: [
+        /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-surface-400", children: "Password" }),
+        /* @__PURE__ */ jsxRuntimeExports.jsx(
+          "input",
+          {
+            type: "password",
+            value: auth.password ?? "",
+            onChange: (e) => onChange({ password: e.target.value }),
+            className: "mt-1 w-full bg-surface-800 border border-surface-700 rounded px-2 py-1 font-mono focus:outline-none focus:border-blue-500"
+          }
+        )
+      ] })
+    ] }),
+    auth.type === "ntlm" && /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex flex-col gap-2", children: [
+      /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex gap-2", children: [
+        /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex-1", children: [
+          /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-surface-400", children: "Username" }),
+          /* @__PURE__ */ jsxRuntimeExports.jsx(
+            "input",
+            {
+              value: auth.username ?? "",
+              onChange: (e) => onChange({ username: e.target.value }),
+              className: "mt-1 w-full bg-surface-800 border border-surface-700 rounded px-2 py-1 focus:outline-none focus:border-blue-500"
+            }
+          )
+        ] }),
+        /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex-1", children: [
+          /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-surface-400", children: "Password" }),
+          /* @__PURE__ */ jsxRuntimeExports.jsx(
+            "input",
+            {
+              type: "password",
+              value: auth.password ?? "",
+              onChange: (e) => onChange({ password: e.target.value }),
+              className: "mt-1 w-full bg-surface-800 border border-surface-700 rounded px-2 py-1 font-mono focus:outline-none focus:border-blue-500"
+            }
+          )
+        ] })
+      ] }),
+      /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex gap-2", children: [
+        /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex-1", children: [
+          /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-surface-400", children: "Domain" }),
+          /* @__PURE__ */ jsxRuntimeExports.jsx(
+            "input",
+            {
+              value: auth.ntlmDomain ?? "",
+              onChange: (e) => onChange({ ntlmDomain: e.target.value }),
+              placeholder: "WORKGROUP",
+              className: "mt-1 w-full bg-surface-800 border border-surface-700 rounded px-2 py-1 focus:outline-none focus:border-blue-500"
+            }
+          )
+        ] }),
+        /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex-1", children: [
+          /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-surface-400", children: "Workstation" }),
+          /* @__PURE__ */ jsxRuntimeExports.jsx(
+            "input",
+            {
+              value: auth.ntlmWorkstation ?? "",
+              onChange: (e) => onChange({ ntlmWorkstation: e.target.value }),
+              placeholder: "MACHINE",
+              className: "mt-1 w-full bg-surface-800 border border-surface-700 rounded px-2 py-1 focus:outline-none focus:border-blue-500"
+            }
+          )
+        ] })
+      ] })
+    ] }),
+    auth.type === "apikey" && /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "flex flex-col gap-1.5", children: /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex gap-2", children: [
+      /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { children: [
+        /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-surface-400", children: "Key name" }),
+        /* @__PURE__ */ jsxRuntimeExports.jsx(
+          "input",
+          {
+            value: auth.apiKeyName ?? "X-API-Key",
+            onChange: (e) => onChange({ apiKeyName: e.target.value }),
+            className: "mt-1 w-full bg-surface-800 border border-surface-700 rounded px-2 py-1 focus:outline-none focus:border-blue-500"
+          }
+        )
+      ] }),
+      /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { children: [
+        /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-surface-400", children: "In" }),
+        /* @__PURE__ */ jsxRuntimeExports.jsxs(
+          "select",
+          {
+            value: auth.apiKeyIn ?? "header",
+            onChange: (e) => onChange({ apiKeyIn: e.target.value }),
+            className: "mt-1 w-full bg-surface-800 border border-surface-700 rounded px-2 py-1 focus:outline-none focus:border-blue-500",
+            children: [
+              /* @__PURE__ */ jsxRuntimeExports.jsx("option", { value: "header", children: "Header" }),
+              /* @__PURE__ */ jsxRuntimeExports.jsx("option", { value: "query", children: "Query" })
+            ]
+          }
+        )
+      ] }),
+      /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex-1", children: [
+        /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-surface-400", children: "Value" }),
+        /* @__PURE__ */ jsxRuntimeExports.jsx(
+          "input",
+          {
+            value: auth.apiKeyValue ?? "",
+            onChange: (e) => onChange({ apiKeyValue: e.target.value }),
+            placeholder: "API key value",
+            className: "mt-1 w-full bg-surface-800 border border-surface-700 rounded px-2 py-1 font-mono focus:outline-none focus:border-blue-500"
+          }
+        )
+      ] })
+    ] }) })
+  ] });
+}
+const DragCtx = reactExports.createContext({ dragging: null, setDragging: () => {
+}, onDrop: () => {
+} });
 function InlineEdit({
   value,
   onCommit,
@@ -35356,16 +35772,23 @@ function CollectionTree() {
   const updateRequestTags = useStore((s) => s.updateRequestTags);
   const updateRequest = useStore((s) => s.updateRequest);
   const openRunner = useStore((s) => s.openRunner);
+  const moveRequest = useStore((s) => s.moveRequest);
   const colList = Object.values(collections);
   const [pendingConfirm, setPendingConfirm] = reactExports.useState(null);
   const [newRequestId, setNewRequestId] = reactExports.useState(null);
+  const [dragging, setDragging] = reactExports.useState(null);
   function confirmThen(message, action) {
     setPendingConfirm({ message, onConfirm: () => {
       action();
       setPendingConfirm(null);
     } });
   }
-  return /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex flex-col flex-1 min-h-0 select-none", children: [
+  function onDrop(destCollectionId, destFolderId, destIndex) {
+    if (!dragging) return;
+    moveRequest(dragging.collectionId, dragging.requestId, destCollectionId, destFolderId, destIndex);
+    setDragging(null);
+  }
+  return /* @__PURE__ */ jsxRuntimeExports.jsx(DragCtx.Provider, { value: { dragging, setDragging, onDrop }, children: /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex flex-col flex-1 min-h-0 select-none", children: [
     pendingConfirm && /* @__PURE__ */ jsxRuntimeExports.jsx(
       ConfirmDialog,
       {
@@ -35410,7 +35833,7 @@ function CollectionTree() {
         /* @__PURE__ */ jsxRuntimeExports.jsx("p", { className: "pt-1", children: "or import from Postman / OpenAPI above." })
       ] })
     ] })
-  ] });
+  ] }) });
 }
 function CollectionNode({
   col,
@@ -35441,6 +35864,8 @@ function CollectionNode({
   const [renaming, setRenaming] = reactExports.useState(false);
   const [showSettings, setShowSettings] = reactExports.useState(false);
   const [expandCtrl, setExpandCtrl] = reactExports.useState({ value: true, seq: 0 });
+  const [dropOver, setDropOver] = reactExports.useState(false);
+  const dragCtx = reactExports.useContext(DragCtx);
   function expandAll() {
     setExpandCtrl((c) => ({ value: true, seq: c.seq + 1 }));
   }
@@ -35451,11 +35876,21 @@ function CollectionNode({
     /* @__PURE__ */ jsxRuntimeExports.jsxs(
       "div",
       {
-        className: `group flex items-start gap-1 px-2 py-1.5 cursor-pointer hover:bg-surface-800 transition-colors ${isActive ? "text-[var(--text-primary)]" : "text-surface-400"}`,
+        className: `group flex items-start gap-1 px-2 py-1.5 cursor-pointer hover:bg-surface-800 transition-colors ${isActive ? "text-[var(--text-primary)]" : "text-surface-400"} ${dropOver ? "outline outline-1 outline-blue-500 rounded" : ""}`,
         onClick: () => {
           onSelectCollection();
           setExpanded((e) => !e);
         },
+        onDragOver: dragCtx.dragging ? (e) => {
+          e.preventDefault();
+          setDropOver(true);
+        } : void 0,
+        onDragLeave: () => setDropOver(false),
+        onDrop: (e) => {
+          e.preventDefault();
+          setDropOver(false);
+          dragCtx.onDrop(col.id, col.rootFolder.id);
+        },
         children: [
           /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "text-[10px] w-3 text-center shrink-0 mt-0.5", children: expanded ? "▾" : "▸" }),
           /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "flex-1 min-w-0", children: renaming ? /* @__PURE__ */ jsxRuntimeExports.jsx(
@@ -35539,6 +35974,8 @@ function FolderRow({
   const [renaming, setRenaming] = reactExports.useState(false);
   const [showSettings, setShowSettings] = reactExports.useState(false);
   const [addingTag, setAddingTag] = reactExports.useState(false);
+  const [dropOver, setDropOver] = reactExports.useState(false);
+  const dragCtx = reactExports.useContext(DragCtx);
   const tags2 = folder.tags ?? [];
   const indent = depth * 12 + 8;
   const hasInheritedConfig = folder.auth && folder.auth.type !== "none" || folder.headers && folder.headers.length > 0;
@@ -35546,9 +35983,19 @@ function FolderRow({
     /* @__PURE__ */ jsxRuntimeExports.jsxs(
       "div",
       {
-        className: "group flex items-start gap-1 py-1 hover:bg-surface-800 transition-colors cursor-pointer text-surface-400",
+        className: `group flex items-start gap-1 py-1 hover:bg-surface-800 transition-colors cursor-pointer text-surface-400 ${dropOver ? "outline outline-1 outline-blue-500 rounded" : ""}`,
         style: { paddingLeft: indent },
         onClick: () => setExpanded((e) => !e),
+        onDragOver: dragCtx.dragging ? (e) => {
+          e.preventDefault();
+          setDropOver(true);
+        } : void 0,
+        onDragLeave: () => setDropOver(false),
+        onDrop: (e) => {
+          e.preventDefault();
+          setDropOver(false);
+          dragCtx.onDrop(collectionId, folder.id);
+        },
         children: [
           /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "text-[10px] w-3 text-center shrink-0 mt-0.5", children: expanded ? "▾" : "▸" }),
           /* @__PURE__ */ jsxRuntimeExports.jsx(FolderIcon, { className: `shrink-0 mt-0.5 ${hasInheritedConfig ? "text-blue-500" : "text-amber-600"}` }),
@@ -35668,13 +36115,16 @@ function FolderContents({
       },
       sub.id
     )),
-    folder.requestIds.map((reqId) => {
+    folder.requestIds.map((reqId, reqIndex) => {
       const req = requests[reqId];
       if (!req) return null;
       return /* @__PURE__ */ jsxRuntimeExports.jsx(
         RequestRow,
         {
           reqId: req.id,
+          collectionId,
+          folderId: folder.id,
+          reqIndex,
           name: req.name,
           method: req.method,
           hookType: req.hookType,
@@ -35707,7 +36157,10 @@ const HOOK_COLORS = {
   afterAll: "bg-cyan-800 text-white"
 };
 function RequestRow({
-  reqId: _reqId,
+  reqId,
+  collectionId,
+  folderId,
+  reqIndex,
   name: name2,
   method,
   hookType,
@@ -35724,6 +36177,8 @@ function RequestRow({
 }) {
   const [renaming, setRenaming] = reactExports.useState(autoRename);
   const [addingTag, setAddingTag] = reactExports.useState(false);
+  const [dropPos, setDropPos] = reactExports.useState(null);
+  const dragCtx = reactExports.useContext(DragCtx);
   const hookMenuItems = [
     ...["beforeAll", "before", "after", "afterAll"].map((ht) => ({
       type: "item",
@@ -35731,55 +36186,84 @@ function RequestRow({
       onClick: () => onSetHookType(hookType === ht ? void 0 : ht)
     }))
   ];
-  return /* @__PURE__ */ jsxRuntimeExports.jsxs(
-    "div",
-    {
-      className: `group flex items-start gap-1.5 py-1 pr-1 rounded-sm cursor-pointer transition-colors ${isActive ? "bg-surface-800 text-[var(--text-primary)]" : "text-surface-300 hover:bg-surface-800"}`,
-      style: { paddingLeft: indent },
-      onClick: onSelect,
-      onDoubleClick: () => setRenaming(true),
-      children: [
-        /* @__PURE__ */ jsxRuntimeExports.jsx(MethodBadge, { method, size: "xs" }),
-        /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex-1 min-w-0", children: [
-          renaming ? /* @__PURE__ */ jsxRuntimeExports.jsx(
-            InlineEdit,
-            {
-              value: name2,
-              onCommit: (v) => {
-                onRename(v);
-                setRenaming(false);
-              },
-              onCancel: () => setRenaming(false),
-              className: "w-full text-xs"
-            }
-          ) : /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex items-center gap-1 min-w-0", children: [
-            /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "text-xs truncate", children: name2 }),
-            hookType && /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: `shrink-0 text-[9px] font-bold px-1 py-px rounded ${HOOK_COLORS[hookType]}`, children: HOOK_LABELS[hookType].toUpperCase() })
+  function handleDragOver(e) {
+    if (!dragCtx.dragging || dragCtx.dragging.requestId === reqId) return;
+    e.preventDefault();
+    const rect = e.currentTarget.getBoundingClientRect();
+    setDropPos(e.clientY < rect.top + rect.height / 2 ? "before" : "after");
+  }
+  function handleDrop(e) {
+    e.preventDefault();
+    e.stopPropagation();
+    const insertIndex = dropPos === "before" ? reqIndex : reqIndex + 1;
+    dragCtx.onDrop(collectionId, folderId, insertIndex);
+    setDropPos(null);
+  }
+  return /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "relative", children: [
+    dropPos === "before" && /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "absolute top-0 inset-x-0 h-0.5 bg-blue-500 z-10 pointer-events-none" }),
+    /* @__PURE__ */ jsxRuntimeExports.jsxs(
+      "div",
+      {
+        draggable: true,
+        className: `group flex items-start gap-1.5 py-1 pr-1 rounded-sm cursor-pointer transition-colors ${isActive ? "bg-surface-800 text-[var(--text-primary)]" : "text-surface-300 hover:bg-surface-800"}`,
+        style: { paddingLeft: indent },
+        onClick: onSelect,
+        onDoubleClick: () => setRenaming(true),
+        onDragStart: (e) => {
+          e.dataTransfer.effectAllowed = "move";
+          dragCtx.setDragging({ requestId: reqId, collectionId });
+        },
+        onDragEnd: () => {
+          dragCtx.setDragging(null);
+          setDropPos(null);
+        },
+        onDragOver: handleDragOver,
+        onDragLeave: () => setDropPos(null),
+        onDrop: handleDrop,
+        children: [
+          /* @__PURE__ */ jsxRuntimeExports.jsx(MethodBadge, { method, size: "xs" }),
+          /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex-1 min-w-0", children: [
+            renaming ? /* @__PURE__ */ jsxRuntimeExports.jsx(
+              InlineEdit,
+              {
+                value: name2,
+                onCommit: (v) => {
+                  onRename(v);
+                  setRenaming(false);
+                },
+                onCancel: () => setRenaming(false),
+                className: "w-full text-xs"
+              }
+            ) : /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex items-center gap-1 min-w-0", children: [
+              /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "text-xs truncate", children: name2 }),
+              hookType && /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: `shrink-0 text-[9px] font-bold px-1 py-px rounded ${HOOK_COLORS[hookType]}`, children: HOOK_LABELS[hookType].toUpperCase() })
+            ] }),
+            (tags2.length > 0 || addingTag) && /* @__PURE__ */ jsxRuntimeExports.jsx(
+              TagChips,
+              {
+                tags: tags2,
+                onRemove: (tag) => onUpdateTags(tags2.filter((t2) => t2 !== tag)),
+                onAdd: (tag) => onUpdateTags([...tags2, tag]),
+                forceAdding: addingTag,
+                onDoneAdding: () => setAddingTag(false)
+              }
+            )
           ] }),
-          (tags2.length > 0 || addingTag) && /* @__PURE__ */ jsxRuntimeExports.jsx(
-            TagChips,
-            {
-              tags: tags2,
-              onRemove: (tag) => onUpdateTags(tags2.filter((t2) => t2 !== tag)),
-              onAdd: (tag) => onUpdateTags([...tags2, tag]),
-              forceAdding: addingTag,
-              onDoneAdding: () => setAddingTag(false)
-            }
-          )
-        ] }),
-        /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "shrink-0", children: /* @__PURE__ */ jsxRuntimeExports.jsx(DotsBtn, { items: [
-          { type: "item", label: "Rename", icon: /* @__PURE__ */ jsxRuntimeExports.jsx(PencilIcon, {}), onClick: () => setRenaming(true) },
-          { type: "item", label: "Duplicate", icon: /* @__PURE__ */ jsxRuntimeExports.jsx(CopyIcon, {}), onClick: onDuplicate },
-          { type: "item", label: "Add tag", icon: /* @__PURE__ */ jsxRuntimeExports.jsx(TagIcon, {}), onClick: () => setAddingTag(true) },
-          { type: "separator" },
-          { type: "header", label: "Hook type" },
-          ...hookMenuItems,
-          { type: "separator" },
-          { type: "item", label: "Delete", icon: /* @__PURE__ */ jsxRuntimeExports.jsx(TrashIcon, {}), danger: true, onClick: onDelete }
-        ] }) })
-      ]
-    }
-  );
+          /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "shrink-0", children: /* @__PURE__ */ jsxRuntimeExports.jsx(DotsBtn, { items: [
+            { type: "item", label: "Rename", icon: /* @__PURE__ */ jsxRuntimeExports.jsx(PencilIcon, {}), onClick: () => setRenaming(true) },
+            { type: "item", label: "Duplicate", icon: /* @__PURE__ */ jsxRuntimeExports.jsx(CopyIcon, {}), onClick: onDuplicate },
+            { type: "item", label: "Add tag", icon: /* @__PURE__ */ jsxRuntimeExports.jsx(TagIcon, {}), onClick: () => setAddingTag(true) },
+            { type: "separator" },
+            { type: "header", label: "Hook type" },
+            ...hookMenuItems,
+            { type: "separator" },
+            { type: "item", label: "Delete", icon: /* @__PURE__ */ jsxRuntimeExports.jsx(TrashIcon, {}), danger: true, onClick: onDelete }
+          ] }) }),
+          dropPos === "after" && /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "absolute bottom-0 inset-x-0 h-0.5 bg-blue-500 z-10 pointer-events-none" })
+        ]
+      }
+    )
+  ] });
 }
 function DotsHorizontalIcon() {
   return /* @__PURE__ */ jsxRuntimeExports.jsx("svg", { className: "w-3.5 h-3.5", fill: "currentColor", viewBox: "0 0 20 20", children: /* @__PURE__ */ jsxRuntimeExports.jsx("path", { d: "M6 10a2 2 0 11-4 0 2 2 0 014 0zm6 0a2 2 0 11-4 0 2 2 0 014 0zm6 0a2 2 0 11-4 0 2 2 0 014 0z" }) });
@@ -35841,7 +36325,8 @@ function HeadersTab({ request, onChange }) {
       rows: request.headers,
       onChange: (rows) => onChange({ headers: rows }),
       keyPlaceholder: "Header-Name",
-      valuePlaceholder: "value"
+      valuePlaceholder: "value",
+      headerMode: true
     }
   );
 }
@@ -42007,39 +42492,17 @@ function AuthTab({ request, onChange }) {
         /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: auth.type === t2 ? "text-white" : "text-surface-400", children: t2 })
       ] }, t2))
     ] }),
-    auth.type === "bearer" && /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex flex-col gap-1.5", children: [
-      /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-surface-400", children: "Token" }),
-      /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex gap-2", children: [
-        /* @__PURE__ */ jsxRuntimeExports.jsx(
-          "input",
-          {
-            type: "password",
-            value: secretValue,
-            onChange: (e) => setSecretValue(e.target.value),
-            placeholder: auth.tokenSecretRef ? `Keychain ref: "${auth.tokenSecretRef}"` : "Paste token to store in keychain",
-            className: "flex-1 bg-surface-800 border border-surface-700 rounded px-2 py-1 focus:outline-none focus:border-blue-500 font-mono"
-          }
-        ),
-        /* @__PURE__ */ jsxRuntimeExports.jsx(
-          "input",
-          {
-            value: auth.tokenSecretRef ?? "API_TOKEN",
-            onChange: (e) => setAuth({ tokenSecretRef: e.target.value }),
-            placeholder: "Keychain key name",
-            className: "w-36 bg-surface-800 border border-surface-700 rounded px-2 py-1 focus:outline-none focus:border-blue-500"
-          }
-        ),
-        /* @__PURE__ */ jsxRuntimeExports.jsx(
-          "button",
-          {
-            onClick: () => saveSecret(auth.tokenSecretRef ?? "API_TOKEN"),
-            className: "px-2 py-1 bg-blue-700 hover:bg-blue-600 rounded transition-colors",
-            children: saved ? "✓" : "Save"
-          }
-        )
-      ] }),
-      /* @__PURE__ */ jsxRuntimeExports.jsx("p", { className: "text-surface-400 text-[10px]", children: "Token is stored in your OS keychain — never written to disk." })
-    ] }),
+    auth.type === "bearer" && /* @__PURE__ */ jsxRuntimeExports.jsx(
+      BearerPanel,
+      {
+        auth,
+        secretValue,
+        setSecretValue,
+        saved,
+        setAuth,
+        saveSecret
+      }
+    ),
     auth.type === "basic" && /* @__PURE__ */ jsxRuntimeExports.jsx(
       BasicCredentialsFields,
       {
@@ -42431,6 +42894,80 @@ function BasicCredentialsFields({
     note && /* @__PURE__ */ jsxRuntimeExports.jsx("p", { className: "text-surface-600 text-[10px]", children: note })
   ] });
 }
+function BearerPanel({
+  auth,
+  secretValue,
+  setSecretValue,
+  saved,
+  setAuth,
+  saveSecret
+}) {
+  const [keychainOpen, setKeychainOpen] = reactExports.useState(!!auth.tokenSecretRef);
+  return /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex flex-col gap-2", children: [
+    /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex flex-col gap-1", children: [
+      /* @__PURE__ */ jsxRuntimeExports.jsxs("label", { className: "text-surface-400", children: [
+        "Token",
+        " ",
+        /* @__PURE__ */ jsxRuntimeExports.jsxs("span", { className: "text-surface-500 text-[10px]", children: [
+          "— supports ",
+          "{{variables}}"
+        ] })
+      ] }),
+      /* @__PURE__ */ jsxRuntimeExports.jsx(
+        VarInput,
+        {
+          value: auth.token ?? "",
+          onChange: (v) => setAuth({ token: v }),
+          placeholder: "{{token}}  or paste a raw token",
+          className: "bg-surface-800 border border-surface-700 rounded px-2 py-1 focus:outline-none focus:border-blue-500 font-mono text-xs"
+        }
+      )
+    ] }),
+    /* @__PURE__ */ jsxRuntimeExports.jsxs(
+      "button",
+      {
+        onClick: () => setKeychainOpen((o) => !o),
+        className: "text-[10px] text-surface-500 hover:text-surface-300 text-left transition-colors w-fit",
+        children: [
+          keychainOpen ? "▾" : "▸",
+          " Store in OS keychain instead"
+        ]
+      }
+    ),
+    keychainOpen && /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex flex-col gap-1 pl-3 border-l border-surface-800", children: [
+      /* @__PURE__ */ jsxRuntimeExports.jsx("p", { className: "text-surface-500 text-[10px]", children: "Paste a raw token here to encrypt it in your OS keychain. Useful for static long-lived API tokens. Leave the value field above empty to use the keychain." }),
+      /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex gap-2", children: [
+        /* @__PURE__ */ jsxRuntimeExports.jsx(
+          "input",
+          {
+            type: "password",
+            value: secretValue,
+            onChange: (e) => setSecretValue(e.target.value),
+            placeholder: auth.tokenSecretRef ? `Stored as "${auth.tokenSecretRef}"` : "Paste token",
+            className: "flex-1 bg-surface-800 border border-surface-700 rounded px-2 py-1 focus:outline-none focus:border-blue-500 font-mono"
+          }
+        ),
+        /* @__PURE__ */ jsxRuntimeExports.jsx(
+          "input",
+          {
+            value: auth.tokenSecretRef ?? "API_TOKEN",
+            onChange: (e) => setAuth({ tokenSecretRef: e.target.value }),
+            placeholder: "Keychain key",
+            className: "w-32 bg-surface-800 border border-surface-700 rounded px-2 py-1 focus:outline-none focus:border-blue-500"
+          }
+        ),
+        /* @__PURE__ */ jsxRuntimeExports.jsx(
+          "button",
+          {
+            onClick: () => saveSecret(auth.tokenSecretRef ?? "API_TOKEN"),
+            className: "px-2 py-1 bg-blue-700 hover:bg-blue-600 rounded transition-colors",
+            children: saved ? "✓" : "Save"
+          }
+        )
+      ] })
+    ] })
+  ] });
+}
 const noSemi = 316, noSemiType = 317, incdec = 1, incdecPrefix = 2, questionDot = 3, JSXStartTag = 4, insertSemi = 318, spaces = 320, newline = 321, LineComment = 5, BlockComment = 6, Dialect_jsx = 0;
 const space = [
   9,
@@ -43012,16 +43549,22 @@ const SNIPPET_GROUPS = [
     group: "Variables — Set",
     items: [
       {
-        label: "Set variable",
-        code: `sp.variables.set("variable_name", "value");`
+        label: "Save token from response (use in next requests)",
+        code: `// Use collectionVariables so the value persists across requests
+const json = sp.response.json();
+sp.collectionVariables.set("token", json.access_token);`
+      },
+      {
+        label: "Set collection variable (persists across requests)",
+        code: `sp.collectionVariables.set("variable_name", "value");`
       },
       {
-        label: "Set environment variable",
+        label: "Set environment variable (key must exist in env)",
         code: `sp.environment.set("variable_name", "value");`
       },
       {
-        label: "Set collection variable",
-        code: `sp.collectionVariables.set("variable_name", "value");`
+        label: "Set variable (request-local only)",
+        code: `sp.variables.set("variable_name", "value");`
       },
       {
         label: "Set global variable",
@@ -49775,7 +50318,11 @@ function RequestBuilder({ request }) {
     setTabResponse(activeTabId, null, null);
     try {
       const activeEnv = activeEnvironmentId ? environments[activeEnvironmentId]?.data ?? null : null;
-      const collectionVars = activeCollectionId ? collections[activeCollectionId]?.data.collectionVariables ?? {} : {};
+      const sessionVars = useStore.getState().sessionVars;
+      const collectionVars = {
+        ...activeCollectionId ? collections[activeCollectionId]?.data.collectionVariables ?? {} : {},
+        ...sessionVars
+      };
       const inherited = useStore.getState().getInheritedAuthAndHeaders(request.id);
       const mergedAuth = request.auth.type !== "none" ? request.auth : inherited.auth ?? request.auth;
       const mergedHeaders = [
@@ -53381,7 +53928,7 @@ function RunnerModal() {
                   {
                     onClick: run,
                     disabled: runnerRunning,
-                    className: "px-4 py-1.5 text-xs bg-emerald-700 hover:bg-emerald-600 disabled:bg-surface-800 disabled:text-surface-400 rounded font-medium transition-colors flex items-center gap-1.5 whitespace-nowrap",
+                    className: "px-4 py-1.5 text-xs text-white bg-emerald-700 hover:bg-emerald-600 disabled:bg-surface-800 disabled:text-surface-400 rounded font-medium transition-colors flex items-center gap-1.5 whitespace-nowrap",
                     children: [
                       /* @__PURE__ */ jsxRuntimeExports.jsx("svg", { className: "w-3.5 h-3.5", viewBox: "0 0 20 20", fill: "currentColor", children: /* @__PURE__ */ jsxRuntimeExports.jsx("path", { fillRule: "evenodd", d: "M10 18a8 8 0 100-16 8 8 0 000 16zM9.555 7.168A1 1 0 008 8v4a1 1 0 001.555.832l3-2a1 1 0 000-1.664l-3-2z", clipRule: "evenodd" }) }),
                       runnerRunning ? "Running…" : "Run"
@@ -53489,7 +54036,7 @@ function RunnerModal() {
               },
               idx
             )) }) }) }),
-            summary && /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex items-center gap-3 px-4 py-2 border-t border-surface-800 bg-surface-950/50 flex-shrink-0 text-xs", children: [
+            summary && /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex items-center gap-3 px-4 py-2 border-t border-surface-800 bg-surface-800/30 flex-shrink-0 text-xs", children: [
               /* @__PURE__ */ jsxRuntimeExports.jsxs("span", { className: "text-emerald-400 font-medium", children: [
                 summary.passed,
                 " passed"
@@ -56195,7 +56742,7 @@ function App() {
       /* @__PURE__ */ jsxRuntimeExports.jsx("span", { style: { color: "#6aa3c8" }, children: "Spector" }),
       /* @__PURE__ */ jsxRuntimeExports.jsxs("span", { className: "ml-2 text-[10px] font-normal opacity-50", children: [
         "v",
-        "0.1.4"
+        "0.1.6"
       ] }),
       /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "mx-2 opacity-30", children: "·" }),
       /* @__PURE__ */ jsxRuntimeExports.jsx(