@testsmith/api-spector 0.4.8 → 0.5.0

package/out/renderer/assets/{index-CEKgq6t0.js → index-Cj7BRfK2.js}

@@ -13403,6 +13403,38 @@ const createWsSlice = (set2) => ({
     if (s.wsConnections[requestId]) s.wsConnections[requestId].messages = [];
   })
 });
+const GRPC_MESSAGE_CAP = 1e3;
+const blank = () => ({ status: "idle", messages: [], services: [] });
+const createGrpcSlice = (set2) => ({
+  grpcCalls: {},
+  setGrpcStatus: (requestId, status, extra) => set2((s) => {
+    const c = s.grpcCalls[requestId] ??= blank();
+    c.status = status;
+    c.code = extra?.code;
+    c.codeName = extra?.codeName;
+    c.error = extra?.error;
+  }),
+  addGrpcMessage: (requestId, message) => set2((s) => {
+    const c = s.grpcCalls[requestId] ??= blank();
+    c.messages.push(message);
+    if (c.messages.length > GRPC_MESSAGE_CAP) {
+      c.messages.splice(0, c.messages.length - GRPC_MESSAGE_CAP);
+    }
+  }),
+  clearGrpcMessages: (requestId) => set2((s) => {
+    if (s.grpcCalls[requestId]) s.grpcCalls[requestId].messages = [];
+  }),
+  setGrpcServices: (requestId, services) => set2((s) => {
+    const c = s.grpcCalls[requestId] ??= blank();
+    c.services = services;
+    c.protoError = void 0;
+  }),
+  setGrpcProtoError: (requestId, error2) => set2((s) => {
+    const c = s.grpcCalls[requestId] ??= blank();
+    c.protoError = error2;
+    if (error2) c.services = [];
+  })
+});
 const LIVE_EVENT_CAP = 5e3;
 const createStreamSlice = (set2) => ({
   liveStream: null,
@@ -13706,6 +13738,19 @@ const createCollectionsSlice = (set2, get2) => ({
     s.activeCollectionId = col.id;
     if (s.workspace) s.workspace.collections.push(relPath);
   }),
+  addCollectionObject: (data) => {
+    let id2 = data.id;
+    set2((s) => {
+      const existingNames = Object.values(s.collections).map((c) => c.data.name);
+      data.name = uniqueName(data.name, existingNames);
+      const relPath = colRelPath(data.name, data.id);
+      s.collections[data.id] = { relPath, data, dirty: true };
+      s.activeCollectionId = data.id;
+      if (s.workspace) s.workspace.collections.push(relPath);
+      id2 = data.id;
+    });
+    return id2;
+  },
   renameCollection: (id2, name2) => set2((s) => {
     if (!s.collections[id2]) return;
     const oldRelPath = s.collections[id2].relPath;
@@ -14278,6 +14323,8 @@ const createUiSlice = (set2) => ({
   quickInsertsOpen: true,
   sendSignal: 0,
   collectionPanelOpen: false,
+  coverageOpen: false,
+  compareOpen: false,
   setShowGeneratorPanel: (v) => set2((s) => {
     s.showGeneratorPanel = v;
   }),
@@ -14331,12 +14378,27 @@ const createUiSlice = (set2) => ({
   }),
   setCollectionPanelOpen: (open) => set2((s) => {
     s.collectionPanelOpen = open;
+  }),
+  setCoverageOpen: (open) => set2((s) => {
+    s.coverageOpen = open;
+  }),
+  setCompareOpen: (open) => set2((s) => {
+    s.compareOpen = open;
+  }),
+  // The OpenAPI spec used for coverage travels with the workspace (persisted on
+  // save), mirroring how theme/zoom are stored.
+  setCoverageSpec: (spec) => set2((s) => {
+    if (s.workspace) {
+      if (!s.workspace.settings) s.workspace.settings = {};
+      s.workspace.settings.coverageSpec = spec;
+    }
   })
 });
 const useStore = create()(
   immer((set2, get2, api) => ({
     // ── Slice composition ─────────────────────────────────────────────────────
     ...createWsSlice(set2),
+    ...createGrpcSlice(set2),
     ...createStreamSlice(set2),
     ...createHistorySlice(set2, get2),
     ...createRunnerSlice(set2),
@@ -14430,7 +14492,7 @@ const useStore = create()(
     })
   }))
 );
-const { electron: electron$v } = window;
+const { electron: electron$y } = window;
 function useAutoSave() {
   const collections = useStore((s) => s.collections);
   useStore((s) => s.environments);
@@ -14446,7 +14508,7 @@ function useAutoSave() {
       for (const { relPath, data, dirty } of dirtyCollections) {
         if (!dirty) continue;
         try {
-          await electron$v.saveCollection(relPath, data);
+          await electron$y.saveCollection(relPath, data);
           markCollectionClean(data.id);
         } catch (e) {
           console.error("Auto-save failed for", relPath, e);
@@ -14462,7 +14524,7 @@ function useAutoSave() {
     if (wsTimerRef.current) clearTimeout(wsTimerRef.current);
     wsTimerRef.current = setTimeout(async () => {
       try {
-        await electron$v.saveWorkspace(workspace);
+        await electron$y.saveWorkspace(workspace);
       } catch {
       }
     }, 300);
@@ -14471,7 +14533,7 @@ function useAutoSave() {
     };
   }, [workspace]);
 }
-const { electron: electron$u } = window;
+const { electron: electron$x } = window;
 function useWorkspaceLoader() {
   const loadCollection = useStore((s) => s.loadCollection);
   const loadEnvironment = useStore((s) => s.loadEnvironment);
@@ -14495,7 +14557,7 @@ function useWorkspaceLoader() {
     if (typeof ws2.settings?.zoom === "number") setZoom(ws2.settings.zoom);
     if (ws2.settings?.persistHistory) {
       try {
-        const entries = await electron$u.loadHistory();
+        const entries = await electron$x.loadHistory();
         useStore.getState().setHistory(entries);
       } catch {
       }
@@ -14504,14 +14566,14 @@ function useWorkspaceLoader() {
     }
     for (const colPath of ws2.collections ?? []) {
       try {
-        const col = await electron$u.loadCollection(colPath);
+        const col = await electron$x.loadCollection(colPath);
         loadCollection(colPath, col);
       } catch {
       }
     }
     for (const envPath of ws2.environments ?? []) {
       try {
-        const env = await electron$u.loadEnvironment(envPath);
+        const env = await electron$x.loadEnvironment(envPath);
         loadEnvironment(envPath, env);
       } catch {
       }
@@ -14530,19 +14592,19 @@ function useWorkspaceLoader() {
     }
     for (const relPath of ws2.mocks ?? []) {
       try {
-        const mockData = await electron$u.loadMock(relPath);
+        const mockData = await electron$x.loadMock(relPath);
         loadMock(relPath, mockData);
       } catch {
       }
     }
     try {
-      const snapshots = await electron$u.listContractSnapshots(ws2.contracts ?? []);
+      const snapshots = await electron$x.listContractSnapshots(ws2.contracts ?? []);
       for (const { relPath, snapshot } of snapshots) loadContractSnapshot(relPath, snapshot);
     } catch {
     }
     if ((ws2.collections ?? []).length > 0) {
       try {
-        const firstCol = await electron$u.loadCollection(ws2.collections[0]);
+        const firstCol = await electron$x.loadCollection(ws2.collections[0]);
         setActiveCollection(firstCol.id);
       } catch {
       }
@@ -36428,7 +36490,7 @@ function CollectionSettingsModal({ collection, onClose }) {
     }
   );
 }
-const { electron: electron$t } = window;
+const { electron: electron$w } = window;
 function normalisePath(url) {
   let path = url.replace(/^\{\{[^}]+\}\}/, "").replace(/^https?:\/\/[^/]+/, "");
   if (!path.startsWith("/")) path = "/" + path;
@@ -36515,7 +36577,7 @@ function SchemaSyncModal({
     setLoading(true);
     setError(null);
     try {
-      const entries = await electron$t.extractOpenApiSchemas();
+      const entries = await electron$w.extractOpenApiSchemas();
       if (!entries) {
         setLoading(false);
         return;
@@ -36534,7 +36596,7 @@ function SchemaSyncModal({
     setLoading(true);
     setError(null);
     try {
-      const entries = await electron$t.extractOpenApiSchemasFromUrl(trimmed);
+      const entries = await electron$w.extractOpenApiSchemasFromUrl(trimmed);
       setSpecEntries(entries);
       autoSelectChanged(entries);
     } catch (err) {
@@ -36567,7 +36629,7 @@ function SchemaSyncModal({
       }
       const entry = useStore.getState().collections[collectionId];
       if (entry) {
-        await electron$t.saveCollection(entry.relPath, entry.data);
+        await electron$w.saveCollection(entry.relPath, entry.data);
         markCollectionClean(collectionId);
       }
       onClose();
@@ -36852,14 +36914,14 @@ function collectTagged(folder, requests, collectionVars, filterTags, parentPath
 }
 function collectAllTags(folder, requests) {
   const tags2 = /* @__PURE__ */ new Set();
-  function walk(f) {
+  function walk2(f) {
     (f.tags ?? []).forEach((t2) => tags2.add(t2));
     for (const reqId of f.requestIds) {
       (requests[reqId]?.meta?.tags ?? []).forEach((t2) => tags2.add(t2));
     }
-    f.folders.forEach(walk);
+    f.folders.forEach(walk2);
   }
-  walk(folder);
+  walk2(folder);
   return Array.from(tags2).sort();
 }
 function folderPathTo(root2, requestId) {
@@ -36982,7 +37044,7 @@ function hasContract(r) {
   const c = r.contract;
   return !!c && (c.statusCode != null || !!c.bodySchema || !!c.bodyMatcher || (c.headers?.length ?? 0) > 0 || (c.providerStates?.length ?? 0) > 0);
 }
-const { electron: electron$s } = window;
+const { electron: electron$v } = window;
 function cloudEnabled() {
   return Boolean(useStore.getState().workspace?.settings?.cloud?.enabled);
 }
@@ -36991,7 +37053,7 @@ function assertEnabled() {
 }
 async function pushContractToCloud(requests, opts) {
   assertEnabled();
-  return electron$s.cloudPushPact({
+  return electron$v.cloudPushPact({
     consumer: opts.consumer,
     provider: opts.provider,
     consumerVersion: opts.version,
@@ -37000,15 +37062,15 @@ async function pushContractToCloud(requests, opts) {
 }
 async function pushProviderSpecToCloud(opts) {
   assertEnabled();
-  return electron$s.cloudPushSpec(opts);
+  return electron$v.cloudPushSpec(opts);
 }
 function openCloudMatrix() {
-  void electron$s.cloudOpenMatrix();
+  void electron$v.cloudOpenMatrix();
 }
 async function getCloudMockRoutes(name2) {
   if (!cloudEnabled()) return null;
   try {
-    const res = await electron$s.cloudGetMock(name2);
+    const res = await electron$v.cloudGetMock(name2);
     return res.exists ? res.routes ?? [] : null;
   } catch {
     return null;
@@ -37017,7 +37079,7 @@ async function getCloudMockRoutes(name2) {
 async function pushMockToCloud(server, routeIds) {
   assertEnabled();
   const routes = routeIds ? (server.routes ?? []).filter((r) => routeIds.includes(r.id)) : server.routes ?? [];
-  return electron$s.cloudPushMock({ ...server, routes });
+  return electron$v.cloudPushMock({ ...server, routes });
 }
 async function pushRequestAsMonitor(request, opts) {
   assertEnabled();
@@ -37038,7 +37100,7 @@ async function pushRequestAsMonitor(request, opts) {
     ...request.headers
   ];
   const mergedRequest = { ...request, auth: mergedAuth, headers: mergedHeaders };
-  return electron$s.cloudPushMonitor(
+  return electron$v.cloudPushMonitor(
     {
       request: mergedRequest,
       setup,
@@ -37796,16 +37858,16 @@ function methodColor$2(method) {
 }
 function collectMatches(col, q) {
   const out = [];
-  const walk = (folder, path) => {
+  const walk2 = (folder, path) => {
     for (const reqId of folder.requestIds) {
       const req = col.requests[reqId];
       if (!req) continue;
       const hay = [req.name, req.url, req.method, ...req.meta?.tags ?? []].join(" ").toLowerCase();
       if (hay.includes(q)) out.push({ collectionId: col.id, collectionName: col.name, req, path });
     }
-    for (const sub of folder.folders) walk(sub, [...path, sub.name]);
+    for (const sub of folder.folders) walk2(sub, [...path, sub.name]);
   };
-  walk(col.rootFolder, []);
+  walk2(col.rootFolder, []);
   return out;
 }
 function CollectionTree() {
@@ -56448,7 +56510,7 @@ function withContentType(headers, value) {
   if (idx === -1) return [...headers, next];
   return headers.map((h, i) => i === idx ? { ...h, value, enabled: true } : h);
 }
-const { electron: electron$r } = window;
+const { electron: electron$u } = window;
 function ParamTree({ params, depth = 0 }) {
   if (params.length === 0) {
     return /* @__PURE__ */ jsxRuntimeExports.jsx("p", { className: "text-[10px] text-surface-600 italic", children: "No parameters declared in WSDL." });
@@ -56462,7 +56524,7 @@ function ParamTree({ params, depth = 0 }) {
 }
 function SoapEditor({ request, onChange }) {
   const soap = request.body.soap ?? { wsdlUrl: "", envelope: "" };
-  const [operations, setOperations] = reactExports.useState([]);
+  const [operations2, setOperations] = reactExports.useState([]);
   const [endpoints, setEndpoints] = reactExports.useState([]);
   const [targetNs, setTargetNs] = reactExports.useState("");
   const [fetchError, setFetchError] = reactExports.useState(null);
@@ -56474,7 +56536,7 @@ function SoapEditor({ request, onChange }) {
     let cancelled = false;
     (async () => {
       try {
-        const result = await electron$r.wsdlFetch(url);
+        const result = await electron$u.wsdlFetch(url);
         if (cancelled) return;
         setOperations(result.operations);
         setEndpoints(result.endpoints);
@@ -56511,7 +56573,7 @@ function SoapEditor({ request, onChange }) {
     setFetching(true);
     setFetchError(null);
     try {
-      const result = await electron$r.wsdlFetch(soap.wsdlUrl.trim());
+      const result = await electron$u.wsdlFetch(soap.wsdlUrl.trim());
       setOperations(result.operations);
       setEndpoints(result.endpoints);
       setTargetNs(result.targetNamespace);
@@ -56527,11 +56589,11 @@ function SoapEditor({ request, onChange }) {
   function selectOperation(op) {
     applyOperation(op);
   }
-  const selected = operations.find((o) => o.name === soap.operationName) ?? operations[0];
+  const selected = operations2.find((o) => o.name === soap.operationName) ?? operations2[0];
   const primaryEndpoint = endpoints[0]?.address;
-  const versions = Array.from(new Set(operations.map((o) => o.soapVersion))).sort();
+  const versions = Array.from(new Set(operations2.map((o) => o.soapVersion))).sort();
   const hasSavedSoap = Boolean(soap.envelope?.trim() || soap.operationName || soap.wsdlUrl?.trim());
-  const showFullUi = operations.length > 0;
+  const showFullUi = operations2.length > 0;
   const showFallback = !showFullUi && hasSavedSoap;
   const showEmpty = !showFullUi && !showFallback;
   return /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex flex-col gap-3 h-full min-h-0", children: [
@@ -56555,12 +56617,12 @@ function SoapEditor({ request, onChange }) {
           onClick: fetchWsdl,
           disabled: fetching || !soap.wsdlUrl.trim(),
           className: "px-3 py-1.5 text-xs bg-blue-700 hover:bg-blue-600 disabled:bg-surface-800 disabled:text-surface-600 rounded transition-colors whitespace-nowrap",
-          children: fetching ? "Fetching…" : operations.length > 0 ? "Refresh" : "Fetch WSDL"
+          children: fetching ? "Fetching…" : operations2.length > 0 ? "Refresh" : "Fetch WSDL"
         }
       )
     ] }),
     fetchError && /* @__PURE__ */ jsxRuntimeExports.jsx("p", { className: "text-xs text-red-400 bg-red-950/30 border border-red-900 rounded px-2.5 py-1.5", children: fetchError }),
-    operations.length > 0 && /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "bg-surface-900/40 border border-surface-800 rounded-md px-3 py-2 text-[11px] flex flex-col gap-1", children: [
+    operations2.length > 0 && /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "bg-surface-900/40 border border-surface-800 rounded-md px-3 py-2 text-[11px] flex flex-col gap-1", children: [
       /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex items-center gap-2 text-surface-500", children: [
         /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "uppercase tracking-wider text-[9px] font-semibold text-surface-600 w-20 shrink-0", children: "Endpoint" }),
         /* @__PURE__ */ jsxRuntimeExports.jsx("code", { className: "text-surface-200 font-mono truncate", children: primaryEndpoint ?? "(not declared)" })
@@ -56572,7 +56634,7 @@ function SoapEditor({ request, onChange }) {
       /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex items-center gap-2 text-surface-500", children: [
         /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "uppercase tracking-wider text-[9px] font-semibold text-surface-600 w-20 shrink-0", children: "Operations" }),
         /* @__PURE__ */ jsxRuntimeExports.jsxs("span", { className: "text-surface-300", children: [
-          operations.length,
+          operations2.length,
           /* @__PURE__ */ jsxRuntimeExports.jsxs("span", { className: "text-surface-600", children: [
             " · SOAP ",
             versions.join(", ")
@@ -56583,7 +56645,7 @@ function SoapEditor({ request, onChange }) {
     showFullUi && /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex gap-3 min-h-0 flex-1", children: [
       /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "w-44 shrink-0 flex flex-col bg-surface-900/40 border border-surface-800 rounded-md overflow-hidden", children: [
         /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "px-2.5 py-1.5 text-[9px] uppercase tracking-wider font-semibold text-surface-600 border-b border-surface-800", children: "Operations" }),
-        /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "overflow-y-auto flex-1", children: operations.map((op) => {
+        /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "overflow-y-auto flex-1", children: operations2.map((op) => {
           const active = selected && op.name === selected.name && op.soapVersion === selected.soapVersion;
           return /* @__PURE__ */ jsxRuntimeExports.jsxs(
             "button",
@@ -56781,7 +56843,7 @@ function BodyTab({ request, onChange }) {
     mode === "soap" && /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "flex-1 min-h-0", children: /* @__PURE__ */ jsxRuntimeExports.jsx(SoapEditor, { request, onChange }) })
   ] });
 }
-const { electron: electron$q } = window;
+const { electron: electron$t } = window;
 const AUTH_TYPES = ["none", "bearer", "basic", "digest", "ntlm", "apikey", "oauth2"];
 function AuthTab({ request, onChange }) {
   const auth = request.auth;
@@ -56795,7 +56857,7 @@ function AuthTab({ request, onChange }) {
   }
   async function saveSecret(ref2) {
     if (!secretValue || !ref2) return;
-    await electron$q.setSecret(ref2, secretValue);
+    await electron$t.setSecret(ref2, secretValue);
     setSaved(true);
     setSecretValue("");
     setTimeout(() => setSaved(false), 2e3);
@@ -56807,7 +56869,7 @@ function AuthTab({ request, onChange }) {
     setOauth2Error("");
     try {
       const vars = {};
-      const result = await electron$q.oauth2StartFlow(oauth2Auth, vars);
+      const result = await electron$t.oauth2StartFlow(oauth2Auth, vars);
       setAuth({
         oauth2CachedToken: result.accessToken,
         oauth2TokenExpiry: result.expiresAt
@@ -56825,7 +56887,7 @@ function AuthTab({ request, onChange }) {
     setOauth2Status("fetching");
     setOauth2Error("");
     try {
-      const result = await electron$q.oauth2RefreshToken(oauth2Auth, {}, oauth2RefreshToken);
+      const result = await electron$t.oauth2RefreshToken(oauth2Auth, {}, oauth2RefreshToken);
       setAuth({
         oauth2CachedToken: result.accessToken,
         oauth2TokenExpiry: result.expiresAt
@@ -60546,8 +60608,8 @@ function getData($data, { dataLevel, dataNames, dataPathArr }) {
       return data;
   }
   let expr = data;
-  const segments = jsonPointer.split("/");
-  for (const segment of segments) {
+  const segments2 = jsonPointer.split("/");
+  for (const segment of segments2) {
     if (segment) {
       data = (0, codegen_1$n._)`${data}${(0, codegen_1$n.getProperty)((0, util_1$m.unescapeJsonPointer)(segment))}`;
       expr = (0, codegen_1$n._)`${expr} && ${data}`;
@@ -60695,7 +60757,7 @@ function compileSchema(sch) {
   }
 }
 compile.compileSchema = compileSchema;
-function resolveRef(root2, baseId, ref2) {
+function resolveRef$3(root2, baseId, ref2) {
   var _a2;
   ref2 = (0, resolve_1.resolveUrl)(this.opts.uriResolver, baseId, ref2);
   const schOrFunc = root2.refs[ref2];
@@ -60712,7 +60774,7 @@ function resolveRef(root2, baseId, ref2) {
     return;
   return root2.refs[ref2] = inlineOrCompile.call(this, _sch);
 }
-compile.resolveRef = resolveRef;
+compile.resolveRef = resolveRef$3;
 function inlineOrCompile(sch) {
   if ((0, resolve_1.inlineRef)(sch.schema, this.opts.inlineRefs))
     return sch.schema;
@@ -61909,9 +61971,9 @@ uri$1.default = uri;
       const rules2 = this.RULES.all;
       metaSchema = JSON.parse(JSON.stringify(metaSchema));
       for (const jsonPointer of keywordsJsonPointers) {
-        const segments = jsonPointer.split("/").slice(1);
+        const segments2 = jsonPointer.split("/").slice(1);
         let keywords2 = metaSchema;
-        for (const seg of segments)
+        for (const seg of segments2)
           keywords2 = keywords2[seg];
         for (const key in rules2) {
           const rule = rules2[key];
@@ -64148,7 +64210,7 @@ function SchemaTab({ request, onChange }) {
     ] }) })
   ] });
 }
-const { electron: electron$p } = window;
+const { electron: electron$s } = window;
 const EMPTY = { statusCode: 200, headers: [], bodySchema: "" };
 function ContractTab({ request, onChange }) {
   const activeTab = useStore((s) => s.tabs.find((t2) => t2.id === s.activeTabId));
@@ -64162,7 +64224,7 @@ function ContractTab({ request, onChange }) {
     if (!lastResponse?.body) return;
     setInferring(true);
     try {
-      const schema = await electron$p.inferContractSchema(lastResponse.body);
+      const schema = await electron$s.inferContractSchema(lastResponse.body);
       if (schema) update({ bodySchema: schema });
     } finally {
       setInferring(false);
@@ -64360,8 +64422,8 @@ function StreamTab({ request, onChange }) {
     ] })
   ] });
 }
-const { electron: electron$o } = window;
-function formatTime$1(ts) {
+const { electron: electron$r } = window;
+function formatTime$2(ts) {
   const d = new Date(ts);
   const hh = String(d.getHours()).padStart(2, "0");
   const mm = String(d.getMinutes()).padStart(2, "0");
@@ -64380,14 +64442,14 @@ function WebSocketPanel({ request }) {
   const [sendText, setSendText] = reactExports.useState("");
   const logEndRef = reactExports.useRef(null);
   reactExports.useEffect(() => {
-    electron$o.onWsMessage(({ requestId, message }) => {
+    electron$r.onWsMessage(({ requestId, message }) => {
       addWsMessage(requestId, message);
     });
-    electron$o.onWsStatus(({ requestId, status, error: error2 }) => {
+    electron$r.onWsStatus(({ requestId, status, error: error2 }) => {
       setWsStatus(requestId, status, error2);
     });
     return () => {
-      electron$o.offWsEvents();
+      electron$r.offWsEvents();
     };
   }, [addWsMessage, setWsStatus]);
   reactExports.useEffect(() => {
@@ -64400,19 +64462,19 @@ function WebSocketPanel({ request }) {
       if (h.enabled && h.key) headers[h.key] = h.value;
     }
     try {
-      await electron$o.wsConnect(request.id, request.url, headers);
+      await electron$r.wsConnect(request.id, request.url, headers);
     } catch (err) {
       setWsStatus(request.id, "error", err instanceof Error ? err.message : String(err));
     }
   }
   async function disconnect() {
-    await electron$o.wsDisconnect(request.id);
+    await electron$r.wsDisconnect(request.id);
   }
   async function sendMessage() {
     const text = sendText.trim();
     if (!text || !isConnected) return;
     try {
-      await electron$o.wsSend(request.id, text);
+      await electron$r.wsSend(request.id, text);
       const msg = {
         id: crypto.randomUUID(),
         direction: "sent",
@@ -64475,7 +64537,7 @@ function WebSocketPanel({ request }) {
           children: [
             /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: `flex-shrink-0 font-mono font-bold ${msg.direction === "sent" ? "text-blue-400" : "text-emerald-400"}`, children: msg.direction === "sent" ? "→" : "←" }),
             /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "flex-1 font-mono text-surface-300 whitespace-pre-wrap break-all", children: msg.data }),
-            /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "flex-shrink-0 text-surface-400 font-mono text-[10px] mt-px", children: formatTime$1(msg.timestamp) })
+            /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "flex-shrink-0 text-surface-400 font-mono text-[10px] mt-px", children: formatTime$2(msg.timestamp) })
           ]
         },
         msg.id
@@ -64515,6 +64577,209 @@ function WebSocketPanel({ request }) {
     ] })
   ] });
 }
+const { electron: electron$q } = window;
+function formatTime$1(ts) {
+  const d = new Date(ts);
+  const p2 = (n, w = 2) => String(n).padStart(w, "0");
+  return `${p2(d.getHours())}:${p2(d.getMinutes())}:${p2(d.getSeconds())}.${p2(d.getMilliseconds(), 3)}`;
+}
+const DEFAULT_GRPC = { message: "{}", metadata: [], plaintext: false };
+function metaToText(meta2) {
+  return (meta2 ?? []).map((m) => `${m.key}: ${m.value}`).join("\n");
+}
+function textToMeta(text) {
+  return text.split("\n").map((line) => {
+    const i = line.indexOf(":");
+    if (i === -1) return null;
+    const key = line.slice(0, i).trim();
+    if (!key) return null;
+    return { key, value: line.slice(i + 1).trim(), enabled: true };
+  }).filter((x) => x !== null);
+}
+function GrpcPanel({ request, onChange }) {
+  const grpc = { ...DEFAULT_GRPC, ...request.body.grpc ?? {} };
+  const grpcCalls = useStore((s) => s.grpcCalls);
+  const setGrpcStatus = useStore((s) => s.setGrpcStatus);
+  const addGrpcMessage = useStore((s) => s.addGrpcMessage);
+  const clearGrpcMessages = useStore((s) => s.clearGrpcMessages);
+  const setGrpcServices = useStore((s) => s.setGrpcServices);
+  const setGrpcProtoError = useStore((s) => s.setGrpcProtoError);
+  const call = grpcCalls[request.id] ?? { status: "idle", messages: [], services: [] };
+  const isRunning = call.status === "running";
+  const [loadingProto, setLoadingProto] = reactExports.useState(false);
+  const logEndRef = reactExports.useRef(null);
+  function patchGrpc(changes) {
+    onChange({ body: { ...request.body, mode: "grpc", grpc: { ...grpc, ...changes } } });
+  }
+  reactExports.useEffect(() => {
+    electron$q.onGrpcMessage(({ requestId, message }) => {
+      addGrpcMessage(requestId, message);
+    });
+    electron$q.onGrpcStatus(({ requestId, status, code: code2, codeName, error: error2 }) => {
+      setGrpcStatus(requestId, status, { code: code2, codeName, error: error2 });
+    });
+    return () => electron$q.offGrpcEvents();
+  }, [addGrpcMessage, setGrpcStatus]);
+  reactExports.useEffect(() => {
+    logEndRef.current?.scrollIntoView({ behavior: "smooth" });
+  }, [call.messages.length]);
+  const selectedService = reactExports.useMemo(
+    () => call.services.find((s) => s.name === grpc.serviceName),
+    [call.services, grpc.serviceName]
+  );
+  async function loadProto() {
+    if (!grpc.protoSource?.trim() && !grpc.protoPath?.trim()) return;
+    setLoadingProto(true);
+    try {
+      const result = await electron$q.grpcLoadProto({ protoSource: grpc.protoSource, protoPath: grpc.protoPath });
+      const services = result.services;
+      setGrpcServices(request.id, services);
+      if (services.length && !services.some((s) => s.name === grpc.serviceName)) {
+        patchGrpc({ serviceName: services[0].name, methodName: services[0].methods[0]?.name });
+      }
+    } catch (err) {
+      setGrpcProtoError(request.id, err instanceof Error ? err.message : String(err));
+    } finally {
+      setLoadingProto(false);
+    }
+  }
+  async function invoke() {
+    if (!request.url || !grpc.serviceName || !grpc.methodName) return;
+    clearGrpcMessages(request.id);
+    addGrpcMessage(request.id, { id: crypto.randomUUID(), direction: "sent", data: grpc.message || "{}", timestamp: Date.now() });
+    const metadata2 = {};
+    for (const m of grpc.metadata ?? []) if (m.enabled && m.key) metadata2[m.key] = m.value;
+    try {
+      await electron$q.grpcInvoke(request.id, {
+        target: request.url,
+        serviceName: grpc.serviceName,
+        methodName: grpc.methodName,
+        message: grpc.message || "{}",
+        metadata: metadata2,
+        plaintext: grpc.plaintext,
+        protoSource: grpc.protoSource,
+        protoPath: grpc.protoPath
+      });
+    } catch (err) {
+      setGrpcStatus(request.id, "error", { error: err instanceof Error ? err.message : String(err) });
+    }
+  }
+  function cancel() {
+    electron$q.grpcCancel(request.id);
+  }
+  const statusColors = {
+    running: "bg-amber-400",
+    completed: "bg-emerald-500",
+    error: "bg-red-500",
+    idle: "bg-surface-600"
+  };
+  const inputCls = "bg-surface-800 border border-surface-700 rounded px-2 py-1.5 text-xs focus:outline-none focus:border-blue-500";
+  return /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex flex-col h-full min-h-0", children: [
+    /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "px-4 pt-2 pb-1 flex-shrink-0 flex items-center gap-2", children: [
+      /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "text-xs font-bold text-violet-400 bg-surface-800 border border-surface-700 rounded px-2 py-1", children: "gRPC" }),
+      /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "text-[10px] text-surface-600", children: "Set the target (host:port) in the URL field above." }),
+      /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: `ml-auto w-2 h-2 rounded-full ${statusColors[call.status] ?? "bg-surface-600"}`, title: call.status }),
+      call.codeName && /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "text-[10px] font-mono text-surface-400", children: call.codeName })
+    ] }),
+    /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex-1 min-h-0 overflow-y-auto px-4 pb-2 flex flex-col gap-3", children: [
+      /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { children: [
+        /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex items-center justify-between mb-1", children: [
+          /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-[11px] text-surface-400", children: "Proto (paste .proto source, or a file path below)" }),
+          /* @__PURE__ */ jsxRuntimeExports.jsx("button", { onClick: loadProto, disabled: loadingProto, className: "text-[10px] px-2 py-0.5 rounded border border-surface-700 text-surface-300 hover:border-violet-500 hover:text-violet-400 disabled:opacity-40", children: loadingProto ? "Loading…" : "Load proto" })
+        ] }),
+        /* @__PURE__ */ jsxRuntimeExports.jsx(
+          "textarea",
+          {
+            value: grpc.protoSource ?? "",
+            onChange: (e) => patchGrpc({ protoSource: e.target.value }),
+            rows: 4,
+            spellCheck: false,
+            placeholder: 'syntax = "proto3";\npackage helloworld;\nservice Greeter { rpc SayHello (HelloRequest) returns (HelloReply); }',
+            className: "w-full resize-y bg-surface-950 border border-surface-800 rounded px-3 py-2 text-xs font-mono focus:outline-none focus:border-violet-500 placeholder-surface-700"
+          }
+        ),
+        /* @__PURE__ */ jsxRuntimeExports.jsx(
+          "input",
+          {
+            value: grpc.protoPath ?? "",
+            onChange: (e) => patchGrpc({ protoPath: e.target.value }),
+            placeholder: "/path/to/service.proto (optional; used if source is empty)",
+            className: `${inputCls} w-full font-mono mt-1`
+          }
+        ),
+        call.protoError && /* @__PURE__ */ jsxRuntimeExports.jsx("p", { className: "text-[10px] text-red-400 mt-1", children: call.protoError })
+      ] }),
+      /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "grid grid-cols-[1fr_1fr_auto] gap-2 items-end", children: [
+        /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { children: [
+          /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "block text-[11px] text-surface-400 mb-1", children: "Service" }),
+          /* @__PURE__ */ jsxRuntimeExports.jsxs("select", { value: grpc.serviceName ?? "", onChange: (e) => patchGrpc({ serviceName: e.target.value, methodName: call.services.find((s) => s.name === e.target.value)?.methods[0]?.name }), className: `${inputCls} w-full`, children: [
+            /* @__PURE__ */ jsxRuntimeExports.jsx("option", { value: "", children: call.services.length ? "Select…" : "Load a proto first" }),
+            call.services.map((s) => /* @__PURE__ */ jsxRuntimeExports.jsx("option", { value: s.name, children: s.name }, s.name))
+          ] })
+        ] }),
+        /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { children: [
+          /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "block text-[11px] text-surface-400 mb-1", children: "Method" }),
+          /* @__PURE__ */ jsxRuntimeExports.jsxs("select", { value: grpc.methodName ?? "", onChange: (e) => patchGrpc({ methodName: e.target.value }), className: `${inputCls} w-full`, children: [
+            /* @__PURE__ */ jsxRuntimeExports.jsx("option", { value: "", children: "Select…" }),
+            selectedService?.methods.map((m) => /* @__PURE__ */ jsxRuntimeExports.jsxs("option", { value: m.name, children: [
+              m.name,
+              m.responseStream ? " (stream)" : ""
+            ] }, m.name))
+          ] })
+        ] }),
+        /* @__PURE__ */ jsxRuntimeExports.jsxs("label", { className: "flex items-center gap-1.5 text-xs text-surface-300 pb-1.5", children: [
+          /* @__PURE__ */ jsxRuntimeExports.jsx("input", { type: "checkbox", checked: !!grpc.plaintext, onChange: (e) => patchGrpc({ plaintext: e.target.checked }) }),
+          "Plaintext"
+        ] })
+      ] }),
+      /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { children: [
+        /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "block text-[11px] text-surface-400 mb-1", children: "Request message (JSON)" }),
+        /* @__PURE__ */ jsxRuntimeExports.jsx(
+          "textarea",
+          {
+            value: grpc.message,
+            onChange: (e) => patchGrpc({ message: e.target.value }),
+            rows: 4,
+            spellCheck: false,
+            placeholder: '{ "name": "world" }',
+            className: "w-full resize-y bg-surface-950 border border-surface-800 rounded px-3 py-2 text-xs font-mono focus:outline-none focus:border-violet-500 placeholder-surface-700"
+          }
+        )
+      ] }),
+      /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { children: [
+        /* @__PURE__ */ jsxRuntimeExports.jsxs("label", { className: "block text-[11px] text-surface-400 mb-1", children: [
+          "Metadata (one ",
+          /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "font-mono", children: "key: value" }),
+          " per line)"
+        ] }),
+        /* @__PURE__ */ jsxRuntimeExports.jsx(
+          "textarea",
+          {
+            value: metaToText(grpc.metadata),
+            onChange: (e) => patchGrpc({ metadata: textToMeta(e.target.value) }),
+            rows: 2,
+            spellCheck: false,
+            placeholder: "authorization: Bearer {{TOKEN}}",
+            className: "w-full resize-y bg-surface-950 border border-surface-800 rounded px-3 py-2 text-xs font-mono focus:outline-none focus:border-violet-500 placeholder-surface-700"
+          }
+        )
+      ] }),
+      /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex items-center gap-2", children: [
+        isRunning ? /* @__PURE__ */ jsxRuntimeExports.jsx("button", { onClick: cancel, className: "px-4 py-1.5 bg-red-700 hover:bg-red-600 rounded text-sm font-medium", children: "Cancel" }) : /* @__PURE__ */ jsxRuntimeExports.jsx("button", { onClick: invoke, disabled: !request.url || !grpc.serviceName || !grpc.methodName, className: "px-4 py-1.5 bg-violet-600 hover:bg-violet-500 disabled:bg-surface-800 disabled:text-surface-500 rounded text-sm font-medium", children: "Invoke" }),
+        call.messages.length > 0 && /* @__PURE__ */ jsxRuntimeExports.jsx("button", { onClick: () => clearGrpcMessages(request.id), className: "text-[10px] text-surface-600 hover:text-surface-400 ml-auto", children: "Clear" })
+      ] }),
+      call.status === "error" && call.error && /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "px-3 py-1.5 bg-red-900/40 border border-red-700/50 rounded text-xs text-red-400", children: call.error }),
+      /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "border border-surface-800 rounded bg-surface-950 min-h-[120px]", children: call.messages.length === 0 ? /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "p-4 text-center text-xs text-surface-500", children: "No messages yet" }) : /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "p-2 flex flex-col gap-1", children: [
+        call.messages.map((msg) => /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: `flex gap-2 items-start text-xs rounded px-2 py-1.5 ${msg.direction === "sent" ? "bg-blue-900/30 border border-blue-800/40" : "bg-emerald-900/20 border border-emerald-800/30"}`, children: [
+          /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: `flex-shrink-0 font-mono font-bold ${msg.direction === "sent" ? "text-blue-400" : "text-emerald-400"}`, children: msg.direction === "sent" ? "→" : "←" }),
+          /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "flex-1 font-mono text-surface-300 whitespace-pre-wrap break-all", children: msg.data }),
+          /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "flex-shrink-0 text-surface-400 font-mono text-[10px] mt-px", children: formatTime$1(msg.timestamp) })
+        ] }, msg.id)),
+        /* @__PURE__ */ jsxRuntimeExports.jsx("div", { ref: logEndRef })
+      ] }) })
+    ] })
+  ] });
+}
 function statusColor$3(code2) {
   const d = String(code2)[0];
   return d === "2" ? "text-emerald-400" : d === "3" ? "text-amber-400" : "text-red-400";
@@ -64770,7 +65035,7 @@ function FuzzResultsPanel({ report, onClear }) {
     ] }) })
   ] });
 }
-const { electron: electron$n } = window;
+const { electron: electron$p } = window;
 const WRITE_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
 function FuzzModal({ request, onClose }) {
   const environments = useStore((s) => s.environments);
@@ -64796,7 +65061,7 @@ function FuzzModal({ request, onClose }) {
       const env = resolveEnvironmentById(environments, activeEnvironmentId);
       const envVars = env ? Object.fromEntries(env.variables.filter((v) => v.enabled).map((v) => [v.key, v.value])) : {};
       const collectionVars = activeCollectionId ? collections[activeCollectionId]?.data.collectionVariables ?? {} : {};
-      const result = await electron$n.fuzzContracts({
+      const result = await electron$p.fuzzContracts({
         requests: [request],
         envVars,
         collectionVars,
@@ -64888,7 +65153,7 @@ function FuzzModal({ request, onClose }) {
     }
   );
 }
-const { electron: electron$m } = window;
+const { electron: electron$o } = window;
 const METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS", "QUERY"];
 const METHOD_COLORS = {
   GET: "text-emerald-400",
@@ -65013,7 +65278,7 @@ function RequestBuilder({ request }) {
             activeEnvironmentId
           );
           const hookSessionVars = useStore.getState().sessionVars;
-          const r = await electron$m.sendRequest({
+          const r = await electron$o.sendRequest({
             ...basePayload,
             environment: hookEnv,
             request: hook,
@@ -65061,7 +65326,7 @@ function RequestBuilder({ request }) {
       startLiveStream(activeTabId, streamId);
       let result;
       try {
-        result = await electron$m.sendRequest({
+        result = await electron$o.sendRequest({
           ...basePayload,
           environment: freshEnv,
           request: mergedRequest,
@@ -65093,7 +65358,7 @@ function RequestBuilder({ request }) {
             activeEnvironmentId
           );
           const hookSessionVars = useStore.getState().sessionVars;
-          const r = await electron$m.sendRequest({
+          const r = await electron$o.sendRequest({
             ...basePayload,
             environment: hookEnv,
             request: hook,
@@ -65143,6 +65408,7 @@ function RequestBuilder({ request }) {
   const hasPostScript = Boolean(request.postRequestScript?.trim());
   const isWs = request.protocol === "websocket";
   const isSoap = request.protocol === "soap";
+  const isGrpc = request.protocol === "grpc";
   const isExample = !!activeAppTab?.exampleId;
   const tabs = [
     // SOAP collapses Params + Body into a single "SOAP" tab — the WSDL drives both.
@@ -65190,7 +65456,7 @@ function RequestBuilder({ request }) {
           "button",
           {
             onClick: () => update({ protocol: "http" }),
-            className: `px-2 py-1.5 transition-colors ${request.protocol !== "websocket" && request.protocol !== "soap" ? "bg-blue-600 text-white" : "text-surface-500 hover:text-white"}`,
+            className: `px-2 py-1.5 transition-colors ${!isWs && !isSoap && !isGrpc ? "bg-blue-600 text-white" : "text-surface-500 hover:text-white"}`,
             title: "HTTP request",
             children: "HTTP"
           }
@@ -65219,9 +65485,21 @@ function RequestBuilder({ request }) {
             title: "SOAP - endpoint and method are derived from the WSDL",
             children: "SOAP"
           }
+        ),
+        /* @__PURE__ */ jsxRuntimeExports.jsx(
+          "button",
+          {
+            onClick: () => update({
+              protocol: "grpc",
+              body: request.body.mode === "grpc" ? request.body : { ...request.body, mode: "grpc", grpc: request.body.grpc ?? { message: "{}", metadata: [], plaintext: false } }
+            }),
+            className: `px-2 py-1.5 transition-colors ${isGrpc ? "bg-violet-700 text-violet-100" : "text-surface-500 hover:text-white"}`,
+            title: "gRPC - proto-defined services over HTTP/2",
+            children: "gRPC"
+          }
         )
       ] }),
-      !isWs && !isSoap && (customVerb ? /* @__PURE__ */ jsxRuntimeExports.jsx(
+      !isWs && !isSoap && !isGrpc && (customVerb ? /* @__PURE__ */ jsxRuntimeExports.jsx(
         "input",
         {
           autoFocus: true,
@@ -65262,18 +65540,26 @@ function RequestBuilder({ request }) {
           children: "POST"
         }
       ),
+      isGrpc && /* @__PURE__ */ jsxRuntimeExports.jsx(
+        "span",
+        {
+          className: "bg-surface-900 border border-surface-700 rounded px-2 py-1.5 text-xs font-bold text-violet-400 select-none",
+          title: "gRPC target is host:port",
+          children: "gRPC"
+        }
+      ),
       /* @__PURE__ */ jsxRuntimeExports.jsx(
         VarInput,
         {
           value: request.url,
           onChange: (url) => update({ url }),
           onPaste: handleUrlPaste,
-          placeholder: isWs ? "ws://example.com/socket" : isSoap ? "Endpoint (auto-filled from WSDL <soap:address>)" : "https://api.example.com/endpoint",
+          placeholder: isWs ? "ws://example.com/socket" : isSoap ? "Endpoint (auto-filled from WSDL <soap:address>)" : isGrpc ? "localhost:50051" : "https://api.example.com/endpoint",
           wrapperClassName: "flex-1",
           className: `border rounded px-3 py-1.5 text-sm focus:outline-none focus:border-blue-500 font-mono placeholder-surface-700 ${isSoap ? "bg-surface-900 border-amber-900/50 text-surface-300" : "bg-surface-800 border-surface-700"}`
         }
       ),
-      !isWs && /* @__PURE__ */ jsxRuntimeExports.jsxs(jsxRuntimeExports.Fragment, { children: [
+      !isWs && !isGrpc && /* @__PURE__ */ jsxRuntimeExports.jsxs(jsxRuntimeExports.Fragment, { children: [
         /* @__PURE__ */ jsxRuntimeExports.jsx(
           "button",
           {
@@ -65295,7 +65581,7 @@ function RequestBuilder({ request }) {
       ] })
     ] }),
     showFuzz && /* @__PURE__ */ jsxRuntimeExports.jsx(FuzzModal, { request, onClose: () => setShowFuzz(false) }),
-    isWs ? /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "flex-1 min-h-0 overflow-hidden", children: /* @__PURE__ */ jsxRuntimeExports.jsx(WebSocketPanel, { request }) }) : /* @__PURE__ */ jsxRuntimeExports.jsxs(jsxRuntimeExports.Fragment, { children: [
+    isWs ? /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "flex-1 min-h-0 overflow-hidden", children: /* @__PURE__ */ jsxRuntimeExports.jsx(WebSocketPanel, { request }) }) : isGrpc ? /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "flex-1 min-h-0 overflow-hidden", children: /* @__PURE__ */ jsxRuntimeExports.jsx(GrpcPanel, { request, onChange: update }) }) : /* @__PURE__ */ jsxRuntimeExports.jsxs(jsxRuntimeExports.Fragment, { children: [
       /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex border-b border-surface-800 px-4 gap-0 flex-shrink-0", children: [
         tabs.map((tab) => /* @__PURE__ */ jsxRuntimeExports.jsxs(
           "button",
@@ -65828,7 +66114,7 @@ function InteractiveBody({ body, contentType, onAssert }) {
     treeContent
   ] });
 }
-const { electron: electron$l } = window;
+const { electron: electron$n } = window;
 const RENDER_TAIL = 500;
 const CLOSE_LABEL = {
   complete: "closed",
@@ -65869,7 +66155,7 @@ function StreamView({ events, streaming, streamId, streamClose, firstEventMs })
     if (!streamId) return;
     setStopping(true);
     try {
-      await electron$l.stopStream(streamId);
+      await electron$n.stopStream(streamId);
     } catch {
     }
   }
@@ -66031,7 +66317,7 @@ function HookResultsPanel({ results }) {
     }) })
   ] });
 }
-const { electron: electron$k } = window;
+const { electron: electron$m } = window;
 function extractPath(url) {
   try {
     return new URL(url).pathname || "/";
@@ -66085,14 +66371,14 @@ function SaveAsMockModal({ onClose }) {
         const entry = state.mocks[serverId];
         const updated = { ...entry.data, name: newServerName, port: Number(newServerPort), routes: [route] };
         updateMock(serverId, updated);
-        await electron$k.saveMock(entry.relPath, updated);
+        await electron$m.saveMock(entry.relPath, updated);
         const ws2 = useStore.getState().workspace;
-        if (ws2) await electron$k.saveWorkspace(ws2);
+        if (ws2) await electron$m.saveWorkspace(ws2);
       } else {
         const entry = useStore.getState().mocks[serverId];
         const updated = { ...entry.data, routes: [...entry.data.routes, route] };
         updateMock(serverId, updated);
-        await electron$k.saveMock(entry.relPath, updated);
+        await electron$m.saveMock(entry.relPath, updated);
       }
       onClose();
     } finally {
@@ -66519,7 +66805,7 @@ function validateHttpSemantics(res, opts = {}) {
   const order = { error: 0, warning: 1, hint: 2 };
   return f.sort((a, b) => order[a.severity] - order[b.severity]);
 }
-const { electron: electron$j } = window;
+const { electron: electron$l } = window;
 function xmlWellFormed(body) {
   try {
     const doc2 = new DOMParser().parseFromString(body, "application/xml");
@@ -66538,6 +66824,8 @@ function requestBodyText(body) {
       return body.graphql?.query ?? "";
     case "soap":
       return body.soap?.envelope ?? "";
+    case "grpc":
+      return body.grpc?.message ?? "";
     case "form":
       return (body.form ?? []).filter((p2) => p2.enabled && p2.key).map((p2) => `${p2.key}=${p2.value}`).join("\n");
     default:
@@ -66657,7 +66945,7 @@ function ResponseViewer() {
   const contractToast = useToast(2500);
   async function saveAsContract() {
     if (!response || !requestId || !activeTabId) return;
-    const schema = response.body ? await electron$j.inferContractSchema(response.body) : null;
+    const schema = response.body ? await electron$l.inferContractSchema(response.body) : null;
     const contentType2 = response.headers["content-type"];
     const headers = contentType2 ? [{ key: "content-type", value: contentType2, required: true }] : [];
     updateRequest(requestId, {
@@ -66965,7 +67253,7 @@ function ResponseViewer() {
     ] }) })
   ] });
 }
-const { electron: electron$i } = window;
+const { electron: electron$k } = window;
 const TARGETS = [
   { id: "robot_framework", label: "Robot Framework", description: "Python RequestsLibrary keywords + test suite" },
   { id: "playwright_ts", label: "Playwright TS", description: "TypeScript page-object API classes + spec files" },
@@ -67006,7 +67294,7 @@ function GeneratorPanel() {
     try {
       const col = collections[selectedCollectionId]?.data;
       const env = resolveEnvironmentById(environments, activeEnvironmentId);
-      const generated = await electron$i.generateCode({ collection: col, environment: env, target });
+      const generated = await electron$k.generateCode({ collection: col, environment: env, target });
       setFiles(generated);
       setSelectedFile(generated[0]?.path ?? null);
     } catch (e) {
@@ -67018,7 +67306,7 @@ function GeneratorPanel() {
   async function saveZip() {
     if (files.length === 0) return;
     const col = collections[selectedCollectionId]?.data;
-    await electron$i.saveGeneratedFilesAsZip(files, col?.name ?? "api-tests", target);
+    await electron$k.saveGeneratedFilesAsZip(files, col?.name ?? "api-tests", target);
   }
   const selectedContent = files.find((f) => f.path === selectedFile)?.content ?? "";
   const activeTarget = TARGETS.find((t2) => t2.id === target);
@@ -67202,7 +67490,7 @@ function historyToHar(entries, creatorVersion = "1.0") {
     }
   }, null, 2);
 }
-const { electron: electron$h } = window;
+const { electron: electron$j } = window;
 const STATUS_COLOR = {
   "2": "text-emerald-400",
   "3": "text-amber-400",
@@ -67250,7 +67538,7 @@ function HistoryPanel() {
   }
   async function downloadHar() {
     const stamp = (/* @__PURE__ */ new Date()).toISOString().slice(0, 19).replace(/[:T]/g, "-");
-    await electron$h.saveResults(historyToHar(history2), `api-spector-history-${stamp}.har`);
+    await electron$j.saveResults(historyToHar(history2), `api-spector-history-${stamp}.har`);
   }
   function open(entry) {
     setSelected(entry);
@@ -67381,30 +67669,30 @@ function HistoryRow({
     }
   );
 }
-const { electron: electron$g } = window;
+const { electron: electron$i } = window;
 function WelcomeScreen() {
   const { applyWorkspace } = useWorkspaceLoader();
   const [recents, setRecents] = reactExports.useState([]);
   const [update, setUpdate] = reactExports.useState(null);
   reactExports.useEffect(() => {
-    electron$g.getRecentWorkspaces().then(setRecents).catch(() => setRecents([]));
-    electron$g.checkForUpdate().then((info) => {
+    electron$i.getRecentWorkspaces().then(setRecents).catch(() => setRecents([]));
+    electron$i.checkForUpdate().then((info) => {
       if (info?.updateAvailable) setUpdate(info);
     }).catch(() => {
     });
   }, []);
   async function openWorkspace() {
-    const result = await electron$g.openWorkspace();
+    const result = await electron$i.openWorkspace();
     if (!result) return;
     await applyWorkspace(result.workspace, result.workspacePath);
   }
   async function newWorkspace() {
-    const result = await electron$g.newWorkspace();
+    const result = await electron$i.newWorkspace();
     if (!result) return;
     await applyWorkspace(result.workspace, result.workspacePath);
   }
   async function openRecent(path) {
-    const result = await electron$g.openWorkspacePath(path);
+    const result = await electron$i.openWorkspacePath(path);
     if (!result) {
       setRecents((prev) => prev.filter((r) => r.path !== path));
       return;
@@ -67444,7 +67732,7 @@ function WelcomeScreen() {
       /* @__PURE__ */ jsxRuntimeExports.jsx("p", { className: "text-surface-400 text-sm max-w-sm", children: "Local-first API testing with Robot Framework & Playwright code generation. Secrets stay on your machine." }),
       /* @__PURE__ */ jsxRuntimeExports.jsxs("p", { className: "text-[11px] mt-3", style: { color: "var(--text-muted)" }, children: [
         "version ",
-        "0.4.8"
+        "0.5.0"
       ] })
     ] }),
     /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex flex-col gap-3 w-64", children: [
@@ -67488,7 +67776,7 @@ function WelcomeScreen() {
     ] })
   ] });
 }
-const { electron: electron$f } = window;
+const { electron: electron$h } = window;
 const EXAMPLES = [
   {
     label: "macOS / Linux  (~/.zshrc or ~/.bashrc)",
@@ -67512,7 +67800,7 @@ function MasterKeyModal({ onSuccess, onCancel }) {
       setError("Password cannot be empty.");
       return;
     }
-    await electron$f.setMasterKey(password);
+    await electron$h.setMasterKey(password);
     onSuccess(password);
   }
   function copy(idx, text) {
@@ -67596,7 +67884,7 @@ function MasterKeyModal({ onSuccess, onCancel }) {
     }
   );
 }
-const { electron: electron$e } = window;
+const { electron: electron$g } = window;
 async function shortHash(value) {
   const buf = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
   return Array.from(new Uint8Array(buf)).map((b) => b.toString(16).padStart(2, "0")).join("").slice(0, 8);
@@ -67723,7 +68011,7 @@ function EnvironmentEditor({ onClose }) {
   async function saveEncrypted(idx) {
     const plaintext = secretInputs[idx] ?? "";
     if (!plaintext) return;
-    const { set: set2 } = await electron$e.checkMasterKey();
+    const { set: set2 } = await electron$g.checkMasterKey();
     if (!set2) {
       setPendingEncryptIdx(idx);
       return;
@@ -67760,9 +68048,9 @@ function EnvironmentEditor({ onClose }) {
         } : state.workspace
       }));
       const ws2 = useStore.getState().workspace;
-      if (ws2) await electron$e.saveWorkspace(ws2);
+      if (ws2) await electron$g.saveWorkspace(ws2);
     }
-    await electron$e.saveEnvironment(newRelPath, env);
+    await electron$g.saveEnvironment(newRelPath, env);
   }
   return /* @__PURE__ */ jsxRuntimeExports.jsxs(jsxRuntimeExports.Fragment, { children: [
     pendingEncryptIdx !== null && /* @__PURE__ */ jsxRuntimeExports.jsx(
@@ -68072,7 +68360,7 @@ function EnvironmentEditor({ onClose }) {
     )
   ] });
 }
-const { electron: electron$d } = window;
+const { electron: electron$f } = window;
 function EnvironmentBar({ inline = false }) {
   const environments = useStore((s) => s.environments);
   const activeEnvironmentId = useStore((s) => s.activeEnvironmentId);
@@ -68087,7 +68375,7 @@ function EnvironmentBar({ inline = false }) {
     if (id2) {
       const hasSecrets = environments[id2]?.data.variables.some((v) => v.enabled && v.secret);
       if (hasSecrets) {
-        const { set: set2 } = await electron$d.checkMasterKey();
+        const { set: set2 } = await electron$f.checkMasterKey();
         if (!set2) {
           setPendingEnvId(id2);
           return;
@@ -68141,7 +68429,7 @@ function EnvironmentBar({ inline = false }) {
     controls
   ] });
 }
-const { electron: electron$c } = window;
+const { electron: electron$e } = window;
 const DEFAULT_PII_PATTERNS = ["authorization", "password", "token", "secret", "api-key", "x-api-key"];
 const ZOOM_STEPS = [0.75, 0.9, 1, 1.1, 1.25, 1.5];
 function WorkspaceSettingsModal({ onClose }) {
@@ -68166,7 +68454,6 @@ function WorkspaceSettingsModal({ onClose }) {
     existing.tls?.rejectUnauthorized !== false
     // default true
   );
-  const [dashboardUrl, setDashboardUrl] = reactExports.useState(existing.dashboardUrl ?? "");
   const [cloudEnabled2, setCloudEnabled] = reactExports.useState(existing.cloud?.enabled ?? false);
   const [cloudToken, setCloudToken] = reactExports.useState("");
   const cloudTokenSet = existing.cloud?.tokenSet ?? false;
@@ -68174,13 +68461,44 @@ function WorkspaceSettingsModal({ onClose }) {
   async function testCloud() {
     setCloudTest({ status: "testing" });
     try {
-      if (cloudToken.trim()) await electron$c.setSecret("cloud:token", cloudToken.trim());
-      const me = await electron$c.cloudTest();
+      if (cloudToken.trim()) await electron$e.setSecret("cloud:token", cloudToken.trim());
+      const me = await electron$e.cloudTest();
       setCloudTest({ status: "ok", msg: `Connected as ${me.email} · ${me.organization} (${me.plan})` });
     } catch (e) {
       setCloudTest({ status: "err", msg: e.message });
     }
   }
+  const sec = existing.secrets ?? {};
+  const [vAddress, setVAddress] = reactExports.useState(sec.vault?.address ?? "");
+  const [vNamespace, setVNamespace] = reactExports.useState(sec.vault?.namespace ?? "");
+  const [vAuthMethod, setVAuthMethod] = reactExports.useState(sec.vault?.authMethod ?? "token");
+  const [vRoleId, setVRoleId] = reactExports.useState(sec.vault?.roleId ?? "");
+  const [vJwtRole, setVJwtRole] = reactExports.useState(sec.vault?.jwtRole ?? "");
+  const [vLoginMount, setVLoginMount] = reactExports.useState(sec.vault?.loginMount ?? "");
+  const [vKvVersion, setVKvVersion] = reactExports.useState(sec.vault?.kvVersion ?? "auto");
+  const [vSkipVerify, setVSkipVerify] = reactExports.useState(sec.vault?.skipVerify ?? false);
+  const [awsRegion, setAwsRegion] = reactExports.useState(sec.aws?.region ?? "");
+  const [azVault, setAzVault] = reactExports.useState(sec.azure?.vault ?? "");
+  const [azTenantId, setAzTenantId] = reactExports.useState(sec.azure?.tenantId ?? "");
+  const [azClientId, setAzClientId] = reactExports.useState(sec.azure?.clientId ?? "");
+  const [opConnectHost, setOpConnectHost] = reactExports.useState(sec.onePassword?.connectHost ?? "");
+  const [oidc, setOidc] = reactExports.useState({ status: "idle" });
+  async function vaultOidcLogin() {
+    setOidc({ status: "busy", msg: "Complete the sign-in in your browser…" });
+    try {
+      const r = await electron$e.vaultOidcLogin({
+        address: vAddress.trim(),
+        mount: vLoginMount.trim() || void 0,
+        role: vJwtRole.trim() || void 0,
+        namespace: vNamespace.trim() || void 0,
+        skipVerify: vSkipVerify
+      });
+      const mins = Math.round((r.expiresInSeconds ?? 0) / 60);
+      setOidc({ status: "ok", msg: `Signed in${mins ? ` · token expires in ~${mins} min` : ""}` });
+    } catch (e) {
+      setOidc({ status: "err", msg: e.message });
+    }
+  }
   const [patterns, setPatterns] = reactExports.useState(
     existing.piiMaskPatterns ?? DEFAULT_PII_PATTERNS
   );
@@ -68212,8 +68530,6 @@ function WorkspaceSettingsModal({ onClose }) {
       rejectUnauthorized
     };
     settings.piiMaskPatterns = patterns;
-    if (dashboardUrl.trim()) settings.dashboardUrl = dashboardUrl.trim();
-    else delete settings.dashboardUrl;
     if (cloudEnabled2 || cloudTokenSet || cloudToken.trim()) {
       settings.cloud = {
         enabled: cloudEnabled2,
@@ -68222,16 +68538,36 @@ function WorkspaceSettingsModal({ onClose }) {
     } else {
       delete settings.cloud;
     }
-    if (cloudToken.trim()) await electron$c.setSecret("cloud:token", cloudToken.trim());
+    if (cloudToken.trim()) await electron$e.setSecret("cloud:token", cloudToken.trim());
     if (defaultEnvironment) settings.defaultEnvironment = defaultEnvironment;
     else delete settings.defaultEnvironment;
     if (persistHistory) settings.persistHistory = true;
     else delete settings.persistHistory;
+    const secrets = {};
+    const vault = {};
+    if (vAddress.trim()) vault.address = vAddress.trim();
+    if (vNamespace.trim()) vault.namespace = vNamespace.trim();
+    if (vAuthMethod !== "token") vault.authMethod = vAuthMethod;
+    if (vRoleId.trim()) vault.roleId = vRoleId.trim();
+    if (vJwtRole.trim()) vault.jwtRole = vJwtRole.trim();
+    if (vLoginMount.trim()) vault.loginMount = vLoginMount.trim();
+    if (vKvVersion !== "auto") vault.kvVersion = vKvVersion;
+    if (vSkipVerify) vault.skipVerify = true;
+    if (Object.keys(vault).length) secrets.vault = vault;
+    if (awsRegion.trim()) secrets.aws = { region: awsRegion.trim() };
+    const azure = {};
+    if (azVault.trim()) azure.vault = azVault.trim();
+    if (azTenantId.trim()) azure.tenantId = azTenantId.trim();
+    if (azClientId.trim()) azure.clientId = azClientId.trim();
+    if (Object.keys(azure).length) secrets.azure = azure;
+    if (opConnectHost.trim()) secrets.onePassword = { connectHost: opConnectHost.trim() };
+    if (Object.keys(secrets).length) settings.secrets = secrets;
+    else delete settings.secrets;
     updateWorkspaceSettings(settings);
     const updated = useStore.getState().workspace;
-    if (updated) await electron$c.saveWorkspace(updated);
+    if (updated) await electron$e.saveWorkspace(updated);
     if (persistHistory) {
-      await electron$c.saveHistory(useStore.getState().history).catch(() => {
+      await electron$e.saveHistory(useStore.getState().history).catch(() => {
       });
     }
     onClose();
@@ -68247,7 +68583,7 @@ function WorkspaceSettingsModal({ onClose }) {
     { id: "proxy", label: "Proxy" },
     { id: "tls", label: "TLS / Certificates" },
     { id: "privacy", label: "Privacy" },
-    { id: "contracts", label: "Contracts" },
+    { id: "secrets", label: "Secrets" },
     { id: "cloud", label: "Cloud" }
   ];
   return /* @__PURE__ */ jsxRuntimeExports.jsxs(
@@ -68390,21 +68726,6 @@ function WorkspaceSettingsModal({ onClose }) {
               ] })
             ] })
           ] }),
-          activeTab === "contracts" && /* @__PURE__ */ jsxRuntimeExports.jsxs(jsxRuntimeExports.Fragment, { children: [
-            /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex flex-col gap-1", children: [
-              /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-[10px] uppercase tracking-wider text-surface-600 font-medium", children: "Dashboard URL (optional)" }),
-              /* @__PURE__ */ jsxRuntimeExports.jsx(
-                "input",
-                {
-                  value: dashboardUrl,
-                  onChange: (e) => setDashboardUrl(e.target.value),
-                  placeholder: "http://localhost:8080",
-                  className: "bg-surface-800 border border-surface-700 rounded px-2.5 py-1.5 focus:outline-none focus:border-blue-500 font-mono placeholder-surface-600"
-                }
-              )
-            ] }),
-            /* @__PURE__ */ jsxRuntimeExports.jsx("p", { className: "text-surface-600 text-[11px]", children: 'Where your contract dashboard is served (api-spector contract report --serve, locally or as a docker container). Adds an "Open dashboard" link to the contract results panel. The link is view-only: recorded results reach the dashboard through the workspace files, not through this URL.' })
-          ] }),
           activeTab === "cloud" && /* @__PURE__ */ jsxRuntimeExports.jsxs(jsxRuntimeExports.Fragment, { children: [
             /* @__PURE__ */ jsxRuntimeExports.jsxs("label", { className: "flex items-start gap-2 cursor-pointer", children: [
               /* @__PURE__ */ jsxRuntimeExports.jsx(
@@ -68549,6 +68870,200 @@ function WorkspaceSettingsModal({ onClose }) {
                 }
               )
             ] })
+          ] }),
+          activeTab === "secrets" && /* @__PURE__ */ jsxRuntimeExports.jsxs(jsxRuntimeExports.Fragment, { children: [
+            /* @__PURE__ */ jsxRuntimeExports.jsxs("p", { className: "text-surface-600 text-[11px]", children: [
+              "Reference secrets from an external manager instead of storing them. Put a reference like",
+              " ",
+              /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "font-mono text-surface-400", children: "vault:secret/data/app#token" }),
+              " in an environment variable or an auth field; it is resolved at send-time and never written to the workspace. This connection config is non-secret — tokens and secret-ids come from your environment (or the Vault sign-in below)."
+            ] }),
+            /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex flex-col gap-2 border border-surface-800 rounded p-3", children: [
+              /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "text-[10px] uppercase tracking-wider text-surface-500 font-semibold", children: "HashiCorp Vault" }),
+              /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex flex-col gap-1", children: [
+                /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-[10px] uppercase tracking-wider text-surface-600 font-medium", children: "Address (VAULT_ADDR)" }),
+                /* @__PURE__ */ jsxRuntimeExports.jsx(
+                  "input",
+                  {
+                    value: vAddress,
+                    onChange: (e) => setVAddress(e.target.value),
+                    placeholder: "https://vault.acme.internal:8200",
+                    className: "bg-surface-800 border border-surface-700 rounded px-2.5 py-1.5 focus:outline-none focus:border-blue-500 font-mono placeholder-surface-600"
+                  }
+                )
+              ] }),
+              /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "grid grid-cols-2 gap-2", children: [
+                /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex flex-col gap-1", children: [
+                  /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-[10px] uppercase tracking-wider text-surface-600 font-medium", children: "Namespace" }),
+                  /* @__PURE__ */ jsxRuntimeExports.jsx(
+                    "input",
+                    {
+                      value: vNamespace,
+                      onChange: (e) => setVNamespace(e.target.value),
+                      placeholder: "(Enterprise)",
+                      className: "bg-surface-800 border border-surface-700 rounded px-2.5 py-1.5 focus:outline-none focus:border-blue-500 font-mono placeholder-surface-600"
+                    }
+                  )
+                ] }),
+                /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex flex-col gap-1", children: [
+                  /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-[10px] uppercase tracking-wider text-surface-600 font-medium", children: "Auth method" }),
+                  /* @__PURE__ */ jsxRuntimeExports.jsxs(
+                    "select",
+                    {
+                      value: vAuthMethod,
+                      onChange: (e) => setVAuthMethod(e.target.value),
+                      className: "bg-surface-800 border border-surface-700 rounded px-2.5 py-1.5 focus:outline-none focus:border-blue-500",
+                      children: [
+                        /* @__PURE__ */ jsxRuntimeExports.jsx("option", { value: "token", children: "Token / OIDC" }),
+                        /* @__PURE__ */ jsxRuntimeExports.jsx("option", { value: "approle", children: "AppRole" }),
+                        /* @__PURE__ */ jsxRuntimeExports.jsx("option", { value: "jwt", children: "JWT (CI)" })
+                      ]
+                    }
+                  )
+                ] })
+              ] }),
+              /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "grid grid-cols-2 gap-2", children: [
+                /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex flex-col gap-1", children: [
+                  /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-[10px] uppercase tracking-wider text-surface-600 font-medium", children: "Role (AppRole/JWT/OIDC)" }),
+                  /* @__PURE__ */ jsxRuntimeExports.jsx(
+                    "input",
+                    {
+                      value: vJwtRole,
+                      onChange: (e) => setVJwtRole(e.target.value),
+                      placeholder: "apispector",
+                      className: "bg-surface-800 border border-surface-700 rounded px-2.5 py-1.5 focus:outline-none focus:border-blue-500 font-mono placeholder-surface-600"
+                    }
+                  )
+                ] }),
+                /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex flex-col gap-1", children: [
+                  /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-[10px] uppercase tracking-wider text-surface-600 font-medium", children: "Login mount" }),
+                  /* @__PURE__ */ jsxRuntimeExports.jsx(
+                    "input",
+                    {
+                      value: vLoginMount,
+                      onChange: (e) => setVLoginMount(e.target.value),
+                      placeholder: "oidc / approle / jwt",
+                      className: "bg-surface-800 border border-surface-700 rounded px-2.5 py-1.5 focus:outline-none focus:border-blue-500 font-mono placeholder-surface-600"
+                    }
+                  )
+                ] })
+              ] }),
+              vAuthMethod === "approle" && /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex flex-col gap-1", children: [
+                /* @__PURE__ */ jsxRuntimeExports.jsxs("label", { className: "text-[10px] uppercase tracking-wider text-surface-600 font-medium", children: [
+                  "Role ID ",
+                  /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "text-surface-600 normal-case", children: "(secret id via VAULT_SECRET_ID)" })
+                ] }),
+                /* @__PURE__ */ jsxRuntimeExports.jsx(
+                  "input",
+                  {
+                    value: vRoleId,
+                    onChange: (e) => setVRoleId(e.target.value),
+                    className: "bg-surface-800 border border-surface-700 rounded px-2.5 py-1.5 focus:outline-none focus:border-blue-500 font-mono"
+                  }
+                )
+              ] }),
+              /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex items-center gap-3", children: [
+                /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex flex-col gap-1", children: [
+                  /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-[10px] uppercase tracking-wider text-surface-600 font-medium", children: "KV version" }),
+                  /* @__PURE__ */ jsxRuntimeExports.jsxs(
+                    "select",
+                    {
+                      value: vKvVersion,
+                      onChange: (e) => setVKvVersion(e.target.value),
+                      className: "bg-surface-800 border border-surface-700 rounded px-2.5 py-1.5 focus:outline-none focus:border-blue-500",
+                      children: [
+                        /* @__PURE__ */ jsxRuntimeExports.jsx("option", { value: "auto", children: "auto" }),
+                        /* @__PURE__ */ jsxRuntimeExports.jsx("option", { value: "2", children: "v2" }),
+                        /* @__PURE__ */ jsxRuntimeExports.jsx("option", { value: "1", children: "v1" })
+                      ]
+                    }
+                  )
+                ] }),
+                /* @__PURE__ */ jsxRuntimeExports.jsxs("label", { className: "flex items-center gap-2 mt-4 cursor-pointer", children: [
+                  /* @__PURE__ */ jsxRuntimeExports.jsx("input", { type: "checkbox", checked: vSkipVerify, onChange: (e) => setVSkipVerify(e.target.checked) }),
+                  /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "text-surface-300", children: "Skip TLS verify (dev)" })
+                ] })
+              ] }),
+              /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex items-center gap-2 mt-1", children: [
+                /* @__PURE__ */ jsxRuntimeExports.jsx(
+                  "button",
+                  {
+                    onClick: vaultOidcLogin,
+                    disabled: !vAddress.trim() || oidc.status === "busy",
+                    className: "px-3 py-1.5 bg-surface-700 hover:bg-surface-600 disabled:opacity-40 rounded transition-colors",
+                    children: oidc.status === "busy" ? "Waiting for browser…" : "Sign in with OIDC"
+                  }
+                ),
+                oidc.msg && /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: `text-[11px] ${oidc.status === "ok" ? "text-green-400" : oidc.status === "err" ? "text-red-400" : "text-surface-500"}`, children: oidc.msg })
+              ] }),
+              /* @__PURE__ */ jsxRuntimeExports.jsx("p", { className: "text-surface-600 text-[11px]", children: "Opens your browser to sign in; the short-lived token is used for this session only." })
+            ] }),
+            /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex flex-col gap-1", children: [
+              /* @__PURE__ */ jsxRuntimeExports.jsxs("label", { className: "text-[10px] uppercase tracking-wider text-surface-600 font-medium", children: [
+                "AWS region ",
+                /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "text-surface-600 normal-case", children: "(credentials from AWS_* env)" })
+              ] }),
+              /* @__PURE__ */ jsxRuntimeExports.jsx(
+                "input",
+                {
+                  value: awsRegion,
+                  onChange: (e) => setAwsRegion(e.target.value),
+                  placeholder: "eu-west-1",
+                  className: "bg-surface-800 border border-surface-700 rounded px-2.5 py-1.5 focus:outline-none focus:border-blue-500 font-mono placeholder-surface-600"
+                }
+              )
+            ] }),
+            /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "grid grid-cols-3 gap-2", children: [
+              /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex flex-col gap-1", children: [
+                /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-[10px] uppercase tracking-wider text-surface-600 font-medium", children: "Azure vault" }),
+                /* @__PURE__ */ jsxRuntimeExports.jsx(
+                  "input",
+                  {
+                    value: azVault,
+                    onChange: (e) => setAzVault(e.target.value),
+                    placeholder: "acme-kv",
+                    className: "bg-surface-800 border border-surface-700 rounded px-2.5 py-1.5 focus:outline-none focus:border-blue-500 font-mono placeholder-surface-600"
+                  }
+                )
+              ] }),
+              /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex flex-col gap-1", children: [
+                /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-[10px] uppercase tracking-wider text-surface-600 font-medium", children: "Tenant id" }),
+                /* @__PURE__ */ jsxRuntimeExports.jsx(
+                  "input",
+                  {
+                    value: azTenantId,
+                    onChange: (e) => setAzTenantId(e.target.value),
+                    className: "bg-surface-800 border border-surface-700 rounded px-2.5 py-1.5 focus:outline-none focus:border-blue-500 font-mono"
+                  }
+                )
+              ] }),
+              /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex flex-col gap-1", children: [
+                /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-[10px] uppercase tracking-wider text-surface-600 font-medium", children: "Client id" }),
+                /* @__PURE__ */ jsxRuntimeExports.jsx(
+                  "input",
+                  {
+                    value: azClientId,
+                    onChange: (e) => setAzClientId(e.target.value),
+                    className: "bg-surface-800 border border-surface-700 rounded px-2.5 py-1.5 focus:outline-none focus:border-blue-500 font-mono"
+                  }
+                )
+              ] })
+            ] }),
+            /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex flex-col gap-1", children: [
+              /* @__PURE__ */ jsxRuntimeExports.jsxs("label", { className: "text-[10px] uppercase tracking-wider text-surface-600 font-medium", children: [
+                "1Password Connect host ",
+                /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "text-surface-600 normal-case", children: "(token from OP_CONNECT_TOKEN)" })
+              ] }),
+              /* @__PURE__ */ jsxRuntimeExports.jsx(
+                "input",
+                {
+                  value: opConnectHost,
+                  onChange: (e) => setOpConnectHost(e.target.value),
+                  placeholder: "https://op.acme.internal",
+                  className: "bg-surface-800 border border-surface-700 rounded px-2.5 py-1.5 focus:outline-none focus:border-blue-500 font-mono placeholder-surface-600"
+                }
+              )
+            ] })
           ] })
         ] }),
         /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex gap-2 px-4 py-3 border-t border-surface-800 flex-shrink-0", children: [
@@ -68573,7 +69088,7 @@ function WorkspaceSettingsModal({ onClose }) {
     }
   );
 }
-const { electron: electron$b } = window;
+const { electron: electron$d } = window;
 function DocsGeneratorModal({ onClose }) {
   const collections = useStore((s) => s.collections);
   const collectionList = Object.values(collections);
@@ -68613,9 +69128,9 @@ function DocsGeneratorModal({ onClose }) {
     setGenerating(true);
     setError(null);
     try {
-      const content2 = await electron$b.generateDocs(buildPayload());
+      const content2 = await electron$d.generateDocs(buildPayload());
       const filename = format2 === "html" ? "api-docs.html" : "api-docs.md";
-      await electron$b.saveResults(content2, filename);
+      await electron$d.saveResults(content2, filename);
     } catch (err) {
       setError(err instanceof Error ? err.message : String(err));
     } finally {
@@ -68626,7 +69141,7 @@ function DocsGeneratorModal({ onClose }) {
     setGenerating(true);
     setError(null);
     try {
-      const content2 = await electron$b.generateDocs(buildPayload());
+      const content2 = await electron$d.generateDocs(buildPayload());
       setPreview(content2);
     } catch (err) {
       setError(err instanceof Error ? err.message : String(err));
@@ -68975,7 +69490,7 @@ function parseCurl(command2) {
   }
   return { name: name2, method: resolvedMethod, url, headers, params: [], auth, body };
 }
-const { electron: electron$a } = window;
+const { electron: electron$c } = window;
 const OPTIONS = [
   { id: "postman", label: "Postman", description: "Collection v2.1 JSON" },
   { id: "openapi", label: "OpenAPI", description: "JSON or YAML (v3.x)", supportsUrl: true },
@@ -68987,16 +69502,16 @@ const OPTIONS = [
 ];
 function listEndpoints(col) {
   const result = [];
-  function walk(folder, path) {
+  function walk2(folder, path) {
     for (const id2 of folder.requestIds) {
       const req = col.requests[id2];
       if (req) result.push({ request: req, folderPath: path });
     }
     for (const sub of folder.folders) {
-      walk(sub, [...path, sub.name]);
+      walk2(sub, [...path, sub.name]);
     }
   }
-  walk(col.rootFolder, []);
+  walk2(col.rootFolder, []);
   return result;
 }
 function ImportModal({ onImport, onClose }) {
@@ -69050,12 +69565,12 @@ function ImportModal({ onImport, onClose }) {
     setError(null);
     try {
       let col = null;
-      if (opt2.id === "postman") col = await electron$a.importPostman();
-      if (opt2.id === "openapi") col = await electron$a.importOpenApi();
-      if (opt2.id === "insomnia") col = await electron$a.importInsomnia();
-      if (opt2.id === "bruno") col = await electron$a.importBruno();
-      if (opt2.id === "http") col = await electron$a.importHttpFile();
-      if (opt2.id === "spector") col = await electron$a.importSpectorCollection();
+      if (opt2.id === "postman") col = await electron$c.importPostman();
+      if (opt2.id === "openapi") col = await electron$c.importOpenApi();
+      if (opt2.id === "insomnia") col = await electron$c.importInsomnia();
+      if (opt2.id === "bruno") col = await electron$c.importBruno();
+      if (opt2.id === "http") col = await electron$c.importHttpFile();
+      if (opt2.id === "spector") col = await electron$c.importSpectorCollection();
       if (!col) {
         setLoading(false);
         return;
@@ -69078,7 +69593,7 @@ function ImportModal({ onImport, onClose }) {
     setLoading(true);
     setError(null);
     try {
-      const col = await electron$a.importOpenApiFromUrl(trimmed);
+      const col = await electron$c.importOpenApiFromUrl(trimmed);
       if (col) enterPreview(col);
     } catch (err) {
       setError(err instanceof Error ? err.message : String(err));
@@ -69185,7 +69700,7 @@ function ImportModal({ onImport, onClose }) {
         mergeIntoCollection(target, prunedRoot, prunedRequests);
         const entry = useStore.getState().collections[target];
         if (entry) {
-          await electron$a.saveCollection(entry.relPath, entry.data);
+          await electron$c.saveCollection(entry.relPath, entry.data);
           markCollectionClean(target);
         }
         setActiveCollection(target);
@@ -69212,7 +69727,7 @@ function ImportModal({ onImport, onClose }) {
         variables: [{ key: name2, value, enabled: true }]
       };
       const relPath = envRelPath(finalName, envId);
-      await electron$a.saveEnvironment(relPath, env);
+      await electron$c.saveEnvironment(relPath, env);
       useStore.setState((s) => {
         s.environments[envId] = { relPath, data: env };
         if (!s.activeEnvironmentId) s.activeEnvironmentId = envId;
@@ -69222,7 +69737,7 @@ function ImportModal({ onImport, onClose }) {
         return s;
       });
       const ws2 = useStore.getState().workspace;
-      if (ws2) await electron$a.saveWorkspace(ws2);
+      if (ws2) await electron$c.saveWorkspace(ws2);
     } else {
       const entry = state.environments[envTarget];
       if (!entry) throw new Error("Target environment not found");
@@ -69237,7 +69752,7 @@ function ImportModal({ onImport, onClose }) {
       } else {
         updated.variables = [...updated.variables, { key: name2, value, enabled: true }];
       }
-      await electron$a.saveEnvironment(entry.relPath, updated);
+      await electron$c.saveEnvironment(entry.relPath, updated);
       useStore.getState().updateEnvironment(envTarget, updated);
     }
   }
@@ -69604,16 +70119,16 @@ function pruneFolder(src, _col, keep, _out) {
 }
 function collectRequestsByFolder(folder, src) {
   const out = {};
-  function walk(f) {
+  function walk2(f) {
     for (const id2 of f.requestIds) {
       if (src.requests[id2]) out[id2] = src.requests[id2];
     }
-    for (const sub of f.folders) walk(sub);
+    for (const sub of f.folders) walk2(sub);
   }
-  walk(folder);
+  walk2(folder);
   return out;
 }
-const { electron: electron$9 } = window;
+const { electron: electron$b } = window;
 function Toolbar({ onOpenDocs: _onOpenDocs }) {
   const { applyWorkspace } = useWorkspaceLoader();
   const workspace = useStore((s) => s.workspace);
@@ -69636,13 +70151,13 @@ function Toolbar({ onOpenDocs: _onOpenDocs }) {
     try {
       for (const { relPath, data, dirty } of Object.values(collections)) {
         if (!dirty) continue;
-        await electron$9.saveCollection(relPath, data);
+        await electron$b.saveCollection(relPath, data);
         markCollectionClean(data.id);
       }
       for (const { relPath, data } of Object.values(environments)) {
-        await electron$9.saveEnvironment(relPath, data);
+        await electron$b.saveEnvironment(relPath, data);
       }
-      if (workspace) await electron$9.saveWorkspace(workspace);
+      if (workspace) await electron$b.saveWorkspace(workspace);
     } finally {
       setSaving(false);
     }
@@ -69650,14 +70165,14 @@ function Toolbar({ onOpenDocs: _onOpenDocs }) {
   async function afterImport(col) {
     if (!col) return;
     const relPath = colRelPath(col.name, col.id);
-    await electron$9.saveCollection(relPath, col);
+    await electron$b.saveCollection(relPath, col);
     loadCollection(relPath, col);
     setActiveCollection(col.id);
     const ws2 = useStore.getState().workspace;
     if (ws2 && !ws2.collections.includes(relPath)) {
       const updated = { ...ws2, collections: [...ws2.collections, relPath] };
       useStore.setState({ workspace: updated });
-      await electron$9.saveWorkspace(updated);
+      await electron$b.saveWorkspace(updated);
     }
   }
   if (!workspace) return null;
@@ -69746,7 +70261,7 @@ function Toolbar({ onOpenDocs: _onOpenDocs }) {
           "button",
           {
             onClick: async () => {
-              const result = await electron$9.openWorkspace();
+              const result = await electron$b.openWorkspace();
               if (result) await applyWorkspace(result.workspace, result.workspacePath);
             },
             className: "px-2.5 py-1 text-xs bg-surface-800 hover:bg-surface-700 rounded transition-colors",
@@ -69758,7 +70273,7 @@ function Toolbar({ onOpenDocs: _onOpenDocs }) {
           "button",
           {
             onClick: async () => {
-              const result = await electron$9.newWorkspace();
+              const result = await electron$b.newWorkspace();
               if (result) await applyWorkspace(result.workspace, result.workspacePath);
             },
             className: "px-2.5 py-1 text-xs bg-surface-800 hover:bg-surface-700 rounded transition-colors",
@@ -69770,7 +70285,7 @@ function Toolbar({ onOpenDocs: _onOpenDocs }) {
           "button",
           {
             onClick: async () => {
-              await electron$9.closeWorkspace();
+              await electron$b.closeWorkspace();
               closeWorkspace();
             },
             className: "px-2.5 py-1 text-xs bg-surface-800 hover:bg-surface-700 rounded transition-colors",
@@ -70221,7 +70736,7 @@ api-tests:
 function EmptyState({ message }) {
   return /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "flex items-center justify-center h-24 text-surface-400 text-xs", children: message });
 }
-const { electron: electron$8 } = window;
+const { electron: electron$a } = window;
 const HOOK_BADGE = {
   beforeAll: { label: "BEFORE ALL", cls: "bg-violet-700 text-white" },
   before: { label: "BEFORE", cls: "bg-violet-600 text-white" },
@@ -70341,13 +70856,13 @@ function RunnerModal() {
     setSummary(null);
     setRunnerRunning(true);
     progressIdxRef.current = 0;
-    electron$8.onRunProgress((result) => {
+    electron$a.onRunProgress((result) => {
       const idx = progressIdxRef.current;
       patchRunnerResult(idx, result);
       if (result.status !== "running") progressIdxRef.current++;
     });
     try {
-      const s = await electron$8.runCollection({
+      const s = await electron$a.runCollection({
         items: items2,
         environment: env,
         globals,
@@ -70358,7 +70873,7 @@ function RunnerModal() {
       });
       setSummary(s);
     } finally {
-      electron$8.offRunProgress();
+      electron$a.offRunProgress();
       setRunnerRunning(false);
     }
   }, [collectionId, folderId, filterTags, selectedEnvId, environments, globals, colEntry, requestDelay, workspaceSettings, setRunnerResults, patchRunnerResult, setRunnerRunning]);
@@ -70584,7 +71099,7 @@ function RunnerModal() {
                   };
                   const content2 = exportFormat === "junit" ? buildJUnitReport(runnerResults, summary, meta2) : exportFormat === "html" ? buildHtmlReport(runnerResults, summary, meta2) : buildJsonReport(runnerResults, summary, meta2);
                   const ext = exportFormat === "junit" ? "xml" : exportFormat === "html" ? "html" : "json";
-                  electron$8.saveResults(content2, `spector-results.${ext}`);
+                  electron$a.saveResults(content2, `spector-results.${ext}`);
                 },
                 className: "px-2.5 py-0.5 bg-surface-800 hover:bg-surface-700 rounded transition-colors text-[11px] whitespace-nowrap",
                 children: "Export results"
@@ -70596,11 +71111,843 @@ function RunnerModal() {
     }
   );
 }
+const HTTP_METHODS$2 = ["get", "put", "post", "delete", "options", "head", "patch", "trace"];
+function normalizePath(url) {
+  let u = (url || "").trim();
+  u = u.split("#")[0].split("?")[0];
+  u = u.replace(/\{\{[^}]*\}\}/g, "");
+  u = u.replace(/^[a-z0-9+.-]+:\/\/[^/]*/i, "");
+  u = u.replace(/\/{2,}/g, "/");
+  if (!u.startsWith("/")) u = "/" + u;
+  u = u.replace(/\/+$/, "");
+  return u === "" ? "/" : u;
+}
+function segments(path) {
+  return path.split("/").filter(Boolean);
+}
+function isParam(seg) {
+  return seg.startsWith("{") && seg.endsWith("}");
+}
+function pathMatches(requestUrl, template) {
+  const reqSegs = segments(normalizePath(requestUrl));
+  const tplSegs = segments(template);
+  if (reqSegs.length < tplSegs.length) return false;
+  const tail = reqSegs.slice(reqSegs.length - tplSegs.length);
+  return tplSegs.every((seg, i) => isParam(seg) ? tail[i] !== void 0 && tail[i] !== "" : tail[i] === seg);
+}
+function resolveRef$2(spec, ref2) {
+  const parts = ref2.replace(/^#\//, "").split("/");
+  return parts.reduce((o, k) => o?.[decodeURIComponent(k.replace(/~1/g, "/").replace(/~0/g, "~"))], spec);
+}
+function deref$2(spec, node, depth = 0, seen = /* @__PURE__ */ new Set()) {
+  if (!node || typeof node !== "object" || depth > 8) return node;
+  if (Array.isArray(node)) return node.map((n) => deref$2(spec, n, depth + 1, seen));
+  if ("$ref" in node) {
+    const target = resolveRef$2(spec, node.$ref);
+    if (!target || seen.has(target)) return {};
+    return deref$2(spec, target, depth + 1, /* @__PURE__ */ new Set([...seen, target]));
+  }
+  const out = {};
+  for (const [k, v] of Object.entries(node)) out[k] = deref$2(spec, v, depth + 1, seen);
+  return out;
+}
+function flattenSchemaPaths(schema, prefix2 = "", depth = 0) {
+  if (!schema || typeof schema !== "object" || depth > 8) return [];
+  const type2 = Array.isArray(schema.type) ? schema.type[0] : schema.type;
+  const out = [];
+  if (type2 === "object" || schema.properties) {
+    for (const [name2, sub] of Object.entries(schema.properties ?? {})) {
+      const path = prefix2 ? `${prefix2}.${name2}` : name2;
+      out.push(path);
+      out.push(...flattenSchemaPaths(sub, path, depth + 1));
+    }
+  } else if (type2 === "array" && schema.items) {
+    out.push(...flattenSchemaPaths(schema.items, `${prefix2}[]`, depth + 1));
+  }
+  return out;
+}
+function flattenValuePaths(value, prefix2 = "", depth = 0) {
+  if (value == null || typeof value !== "object" || depth > 8) return [];
+  const out = [];
+  if (Array.isArray(value)) {
+    for (const el of value) out.push(...flattenValuePaths(el, `${prefix2}[]`, depth + 1));
+  } else {
+    for (const [k, v] of Object.entries(value)) {
+      const path = prefix2 ? `${prefix2}.${k}` : k;
+      out.push(path);
+      out.push(...flattenValuePaths(v, path, depth + 1));
+    }
+  }
+  return [...new Set(out)];
+}
+function successResponseSchema$1(spec, responses) {
+  const code2 = Object.keys(responses ?? {}).filter((c) => /^2\d\d$/.test(c)).sort()[0];
+  if (!code2) return void 0;
+  const schema = responses[code2]?.content?.["application/json"]?.schema ?? responses[code2]?.content?.["application/json;charset=utf-8"]?.schema;
+  return schema ? deref$2(spec, schema) : void 0;
+}
+function enumerateOperations(spec) {
+  const doc2 = spec ?? {};
+  const ops2 = [];
+  for (const [path, item] of Object.entries(doc2.paths ?? {})) {
+    if (!item || typeof item !== "object") continue;
+    for (const [method, op] of Object.entries(item)) {
+      if (!HTTP_METHODS$2.includes(method.toLowerCase())) continue;
+      if (!op || typeof op !== "object") continue;
+      const declaredStatuses = Object.keys(op.responses ?? {}).filter((c) => /^\d{3}$/.test(c));
+      ops2.push({ method: method.toUpperCase(), path, operationId: op.operationId, declaredStatuses, responses: op.responses });
+    }
+  }
+  return ops2;
+}
+function round(n) {
+  return Math.round(n * 10) / 10;
+}
+function computeCoverage(spec, requests, observations = []) {
+  const doc2 = spec ?? {};
+  const operations2 = enumerateOperations(spec).map((op) => {
+    const mapped = requests.filter((r) => r.method.toUpperCase() === op.method && pathMatches(r.url, op.path));
+    const obs = observations.filter((o) => o.method.toUpperCase() === op.method && pathMatches(o.url, op.path));
+    const asserted = mapped.map((r) => r.expectedStatus).filter((s) => typeof s === "number");
+    const seen = obs.map((o) => o.status);
+    const covered = /* @__PURE__ */ new Set([...asserted, ...seen]);
+    const coveredStatuses2 = op.declaredStatuses.filter((code2) => covered.has(Number(code2)));
+    const hasNegativeTest = [...covered].some((s) => s >= 400);
+    const declaredProperties2 = flattenSchemaPaths(successResponseSchema$1(doc2, op.responses ?? {}));
+    const observedPaths = new Set(obs.flatMap((o) => o.responsePaths ?? []));
+    const coveredProperties2 = declaredProperties2.filter((p2) => observedPaths.has(p2));
+    return {
+      method: op.method,
+      path: op.path,
+      operationId: op.operationId,
+      tested: mapped.length > 0 || obs.length > 0,
+      requests: mapped.map((r) => r.name),
+      declaredStatuses: op.declaredStatuses,
+      coveredStatuses: coveredStatuses2,
+      hasNegativeTest,
+      declaredProperties: declaredProperties2,
+      coveredProperties: coveredProperties2
+    };
+  });
+  const tested = operations2.filter((o) => o.tested).length;
+  const declaredStatuses = operations2.reduce((n, o) => n + o.declaredStatuses.length, 0);
+  const coveredStatuses = operations2.reduce((n, o) => n + o.coveredStatuses.length, 0);
+  const declaredProperties = operations2.reduce((n, o) => n + o.declaredProperties.length, 0);
+  const coveredProperties = operations2.reduce((n, o) => n + o.coveredProperties.length, 0);
+  const withoutNegativeTest = operations2.filter((o) => o.tested && !o.hasNegativeTest).length;
+  return {
+    spec: { title: doc2.info?.title, version: doc2.info?.version },
+    totals: {
+      operations: operations2.length,
+      tested,
+      untested: operations2.length - tested,
+      operationPct: operations2.length ? round(tested / operations2.length * 100) : 0,
+      declaredStatuses,
+      coveredStatuses,
+      statusPct: declaredStatuses ? round(coveredStatuses / declaredStatuses * 100) : 0,
+      withoutNegativeTest,
+      declaredProperties,
+      coveredProperties,
+      propertyPct: declaredProperties ? round(coveredProperties / declaredProperties * 100) : 0
+    },
+    operations: operations2
+  };
+}
+const HTTP_METHODS$1 = ["get", "put", "post", "delete", "options", "head", "patch", "trace"];
+function resolveRef$1(spec, ref2) {
+  const parts = ref2.replace(/^#\//, "").split("/");
+  return parts.reduce((o, k) => o?.[decodeURIComponent(k.replace(/~1/g, "/").replace(/~0/g, "~"))], spec);
+}
+function deref$1(spec, node, depth = 0, seen = /* @__PURE__ */ new Set()) {
+  if (!node || typeof node !== "object" || depth > 8) return node;
+  if (Array.isArray(node)) return node.map((n) => deref$1(spec, n, depth + 1, seen));
+  if ("$ref" in node) {
+    const target = resolveRef$1(spec, node.$ref);
+    if (!target || seen.has(target)) return {};
+    return deref$1(spec, target, depth + 1, /* @__PURE__ */ new Set([...seen, target]));
+  }
+  const out = {};
+  for (const [k, v] of Object.entries(node)) out[k] = deref$1(spec, v, depth + 1, seen);
+  return out;
+}
+function jsonSchemaFor(spec, responses, code2) {
+  const resp = responses?.[code2];
+  const schema = resp?.content?.["application/json"]?.schema ?? resp?.content?.["application/json;charset=utf-8"]?.schema;
+  return schema ? deref$1(spec, schema) : void 0;
+}
+function sampleValue(schema) {
+  if (!schema || typeof schema !== "object") return "string";
+  if (schema.example !== void 0) return schema.example;
+  if (schema.default !== void 0) return schema.default;
+  if (Array.isArray(schema.enum) && schema.enum.length) return schema.enum[0];
+  const type2 = Array.isArray(schema.type) ? schema.type[0] : schema.type;
+  switch (type2) {
+    case "integer":
+    case "number": {
+      const min = schema.minimum ?? (schema.exclusiveMinimum != null ? schema.exclusiveMinimum + 1 : void 0);
+      const max = schema.maximum ?? (schema.exclusiveMaximum != null ? schema.exclusiveMaximum - 1 : void 0);
+      if (min != null) return min;
+      if (max != null) return max;
+      return type2 === "integer" ? 1 : 1.5;
+    }
+    case "boolean":
+      return true;
+    case "array":
+      return [sampleValue(schema.items ?? {})];
+    case "object": {
+      const out = {};
+      const props = schema.properties ?? {};
+      const required2 = schema.required ?? [];
+      for (const [name2, propSchema] of Object.entries(props)) out[name2] = sampleValue(propSchema);
+      for (const name2 of required2) if (!(name2 in out)) out[name2] = "string";
+      return out;
+    }
+    case "string":
+    default:
+      return sampleString(schema);
+  }
+}
+function sampleString(schema) {
+  switch (schema.format) {
+    case "email":
+      return "user@example.com";
+    case "uuid":
+      return "00000000-0000-0000-0000-000000000000";
+    case "date":
+      return "2020-01-01";
+    case "date-time":
+      return "2020-01-01T00:00:00Z";
+    case "uri":
+    case "url":
+      return "https://example.com";
+    case "hostname":
+      return "example.com";
+    case "ipv4":
+      return "127.0.0.1";
+    default: {
+      const min = schema.minLength ?? 0;
+      let s = "string";
+      if (min > s.length) s = s.padEnd(min, "x");
+      if (schema.maxLength != null && s.length > schema.maxLength) s = s.slice(0, schema.maxLength);
+      return s;
+    }
+  }
+}
+function collectParams(spec, pathItem, op) {
+  const raw = [...pathItem?.parameters ?? [], ...op?.parameters ?? []].map((p2) => deref$1(spec, p2));
+  const byKey = /* @__PURE__ */ new Map();
+  for (const p2 of raw) if (p2?.name && p2?.in) byKey.set(`${p2.in}:${p2.name}`, p2);
+  return [...byKey.values()];
+}
+function successCode(responses) {
+  const codes = Object.keys(responses ?? {}).filter((c) => /^2\d\d$/.test(c)).map(Number).sort((a, b) => a - b);
+  return codes[0] ?? 200;
+}
+function negativeCode(responses) {
+  const codes = Object.keys(responses ?? {}).filter((c) => /^4\d\d$/.test(c)).map(Number).sort((a, b) => a - b);
+  return codes[0] ?? 400;
+}
+function baseTest(method, path, op, params) {
+  const pathParams = {};
+  for (const p2 of params.filter((p22) => p22.in === "path")) pathParams[p2.name] = sampleValue(p2.schema ?? {});
+  const query = params.filter((p2) => p2.in === "query" && p2.required).map((p2) => ({ key: p2.name, value: String(sampleValue(p2.schema ?? {})) }));
+  const headers = params.filter((p2) => p2.in === "header" && p2.required).map((p2) => ({ key: p2.name, value: String(sampleValue(p2.schema ?? {})) }));
+  return { operationId: op?.operationId, method, path, pathParams, query, headers };
+}
+function requestBodySchema(spec, op) {
+  const rb = deref$1(spec, op?.requestBody);
+  const schema = rb?.content?.["application/json"]?.schema;
+  return schema;
+}
+function generateForOperation(spec, method, path, pathItem, op, opts) {
+  const tests = [];
+  const params = collectParams(spec, pathItem, op);
+  const responses = op?.responses ?? {};
+  const okCode = successCode(responses);
+  const badCode = negativeCode(responses);
+  const bodySchema = requestBodySchema(spec, op);
+  const validBody = bodySchema ? sampleValue(bodySchema) : void 0;
+  const base2 = baseTest(method, path, op, params);
+  const label = `${method} ${path}`;
+  tests.push({
+    ...base2,
+    name: `${label} - happy path`,
+    category: "happy",
+    body: validBody !== void 0 ? JSON.stringify(validBody, null, 2) : void 0,
+    expectedStatus: okCode,
+    responseSchema: jsonSchemaFor(spec, responses, String(okCode)) ? JSON.stringify(jsonSchemaFor(spec, responses, String(okCode)), null, 2) : void 0
+  });
+  const props = bodySchema?.properties ?? {};
+  const required2 = bodySchema?.required ?? [];
+  if (opts.includeNegative && validBody && typeof validBody === "object") {
+    let n = 0;
+    for (const field of required2) {
+      if (n >= opts.maxNegativePerOp) break;
+      const mutated = { ...validBody };
+      delete mutated[field];
+      tests.push({ ...base2, name: `${label} - missing ${field}`, category: "negative", body: JSON.stringify(mutated, null, 2), expectedStatus: badCode });
+      n++;
+    }
+    for (const [field, ps] of Object.entries(props)) {
+      if (n >= opts.maxNegativePerOp) break;
+      const t2 = Array.isArray(ps.type) ? ps.type[0] : ps.type;
+      if (t2 !== "string" && t2 !== "integer" && t2 !== "number" && t2 !== "boolean") continue;
+      const wrong = t2 === "string" ? 12345 : "not-a-valid-value";
+      tests.push({ ...base2, name: `${label} - ${field} wrong type`, category: "negative", body: JSON.stringify({ ...validBody, [field]: wrong }, null, 2), expectedStatus: badCode });
+      n++;
+    }
+  }
+  if (opts.includeBoundary && validBody && typeof validBody === "object") {
+    let n = 0;
+    for (const [field, ps] of Object.entries(props)) {
+      if (n >= opts.maxBoundaryPerOp) break;
+      const t2 = Array.isArray(ps.type) ? ps.type[0] : ps.type;
+      if ((t2 === "integer" || t2 === "number") && ps.minimum != null) {
+        tests.push({ ...base2, name: `${label} - ${field} below minimum`, category: "boundary", body: JSON.stringify({ ...validBody, [field]: ps.minimum - 1 }, null, 2), expectedStatus: badCode });
+        n++;
+      } else if ((t2 === "integer" || t2 === "number") && ps.maximum != null) {
+        tests.push({ ...base2, name: `${label} - ${field} above maximum`, category: "boundary", body: JSON.stringify({ ...validBody, [field]: ps.maximum + 1 }, null, 2), expectedStatus: badCode });
+        n++;
+      } else if (t2 === "string" && ps.maxLength != null) {
+        tests.push({ ...base2, name: `${label} - ${field} too long`, category: "boundary", body: JSON.stringify({ ...validBody, [field]: "x".repeat(ps.maxLength + 1) }, null, 2), expectedStatus: badCode });
+        n++;
+      }
+    }
+  }
+  return tests;
+}
+function generateTests(spec, options = {}) {
+  const opts = {
+    only: options.only ?? /* @__PURE__ */ new Set(),
+    includeNegative: options.includeNegative ?? true,
+    includeBoundary: options.includeBoundary ?? true,
+    maxNegativePerOp: options.maxNegativePerOp ?? 4,
+    maxBoundaryPerOp: options.maxBoundaryPerOp ?? 4
+  };
+  const doc2 = spec ?? {};
+  const out = [];
+  for (const [path, item] of Object.entries(doc2.paths ?? {})) {
+    if (!item || typeof item !== "object") continue;
+    for (const [method, op] of Object.entries(item)) {
+      if (!HTTP_METHODS$1.includes(method.toLowerCase())) continue;
+      if (!op || typeof op !== "object") continue;
+      if (opts.only.size && !opts.only.has(`${method.toUpperCase()} ${path}`)) continue;
+      out.push(...generateForOperation(doc2, method.toUpperCase(), path, item, op, opts));
+    }
+  }
+  return out;
+}
+function testUrl(test, baseVar = "{{baseUrl}}") {
+  let path = test.path;
+  for (const [name2, value] of Object.entries(test.pathParams)) {
+    path = path.replace(new RegExp(`\\{${name2}\\}`, "g"), encodeURIComponent(String(value)));
+  }
+  const qs = test.query.filter((q) => q.key).map((q) => `${encodeURIComponent(q.key)}=${encodeURIComponent(q.value)}`).join("&");
+  return `${baseVar}${path}${qs ? `?${qs}` : ""}`;
+}
+function toApiRequest(test, id2) {
+  const headers = test.headers.map((h) => ({ key: h.key, value: h.value, enabled: true }));
+  return {
+    id: id2,
+    name: test.name,
+    method: test.method,
+    url: testUrl(test),
+    headers,
+    params: [],
+    auth: { type: "none" },
+    body: test.body !== void 0 ? { mode: "json", json: test.body } : { mode: "none" },
+    contract: {
+      statusCode: test.expectedStatus,
+      ...test.responseSchema ? { bodySchema: test.responseSchema } : {}
+    },
+    meta: { tags: [test.category] }
+  };
+}
+const { electron: electron$9 } = window;
+function Bar({ pct }) {
+  const color = pct >= 80 ? "bg-emerald-500" : pct >= 50 ? "bg-amber-500" : "bg-red-500";
+  return /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "h-2 w-full rounded bg-surface-800 overflow-hidden", children: /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: `h-full ${color}`, style: { width: `${pct}%` } }) });
+}
+function Stat({ value, label }) {
+  return /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex-1", children: [
+    /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "text-2xl font-bold text-white", children: value }),
+    /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "text-[11px] text-surface-400", children: label })
+  ] });
+}
+function CoverageModal() {
+  const open = useStore((s) => s.coverageOpen);
+  const setOpen = useStore((s) => s.setCoverageOpen);
+  const collections = useStore((s) => s.collections);
+  const history2 = useStore((s) => s.history);
+  const savedSpec = useStore((s) => s.workspace?.settings?.coverageSpec);
+  const setCoverageSpec = useStore((s) => s.setCoverageSpec);
+  const addCollectionObject = useStore((s) => s.addCollectionObject);
+  const [source, setSource] = reactExports.useState(savedSpec ?? "");
+  const [pasted, setPasted] = reactExports.useState("");
+  const [report, setReport] = reactExports.useState(null);
+  const [spec, setSpec] = reactExports.useState(null);
+  const [error2, setError] = reactExports.useState(null);
+  const [busy, setBusy] = reactExports.useState(false);
+  const [onlyGaps, setOnlyGaps] = reactExports.useState(false);
+  const [generated, setGenerated] = reactExports.useState(null);
+  const requests = reactExports.useMemo(() => {
+    const out = [];
+    for (const entry of Object.values(collections)) {
+      for (const req of Object.values(entry.data.requests)) {
+        if (req.disabled) continue;
+        out.push({ name: `${entry.data.name} / ${req.name}`, method: req.method, url: req.url, expectedStatus: req.contract?.statusCode });
+      }
+    }
+    return out;
+  }, [collections]);
+  const observations = reactExports.useMemo(() => {
+    return history2.map((h) => {
+      let responsePaths;
+      try {
+        if (h.response?.body) responsePaths = flattenValuePaths(JSON.parse(h.response.body));
+      } catch {
+      }
+      return { method: h.request.method, url: h.resolvedUrl, status: h.response?.status ?? 0, responsePaths };
+    });
+  }, [history2]);
+  async function compute() {
+    setBusy(true);
+    setError(null);
+    try {
+      const isUrl = /^https?:\/\//i.test(source.trim());
+      const spec2 = await electron$9.coverageLoadSpec(
+        pasted.trim() ? { text: pasted } : isUrl ? { url: source.trim() } : { path: source.trim() }
+      );
+      if (source.trim() && !pasted.trim()) setCoverageSpec(source.trim());
+      setSpec(spec2);
+      setReport(computeCoverage(spec2, requests, observations));
+      setGenerated(null);
+    } catch (err) {
+      setError(err instanceof Error ? err.message : String(err));
+      setReport(null);
+    } finally {
+      setBusy(false);
+    }
+  }
+  function generateForGaps() {
+    if (!spec || !report) return;
+    const only = new Set(report.operations.filter((o) => !o.tested).map((o) => `${o.method} ${o.path}`));
+    if (only.size === 0) return;
+    const tests = generateTests(spec, { only });
+    const requestIds = [];
+    const requestMap = {};
+    for (const t22 of tests) {
+      const id2 = crypto.randomUUID();
+      requestMap[id2] = toApiRequest(t22, id2);
+      requestIds.push(id2);
+    }
+    const name2 = `${report.spec.title ?? "API"} tests (generated)`;
+    const collection = {
+      version: "1.0",
+      id: crypto.randomUUID(),
+      name: name2,
+      description: "Generated for untested operations from the OpenAPI spec.",
+      rootFolder: { id: crypto.randomUUID(), name: "root", description: "", folders: [], requestIds },
+      requests: requestMap
+    };
+    addCollectionObject(collection);
+    setGenerated(`Added ${tests.length} tests for ${only.size} untested operations as "${collection.name}".`);
+  }
+  if (!open) return null;
+  const t2 = report?.totals;
+  const shownOps = report?.operations.filter((o) => !onlyGaps || !o.tested || !o.hasNegativeTest) ?? [];
+  return /* @__PURE__ */ jsxRuntimeExports.jsxs(
+    Modal,
+    {
+      onClose: () => setOpen(false),
+      overlayClassName: "bg-black/50 z-50 flex items-start justify-center pt-16",
+      panelClassName: "bg-surface-900 border border-surface-800 rounded-lg shadow-2xl flex flex-col w-[760px] max-h-[82vh]",
+      title: "API test coverage",
+      subtitle: "How much of an OpenAPI contract this workspace tests",
+      children: [
+        /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "px-4 py-3 border-b border-surface-800 flex flex-col gap-2 flex-shrink-0", children: [
+          /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-[11px] text-surface-400", children: "OpenAPI spec (file path or URL)" }),
+          /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex gap-2", children: [
+            /* @__PURE__ */ jsxRuntimeExports.jsx(
+              "input",
+              {
+                value: source,
+                onChange: (e) => setSource(e.target.value),
+                placeholder: "./openapi.yaml  or  https://api.example.com/openapi.json",
+                className: "flex-1 bg-surface-800 border border-surface-700 rounded px-3 py-1.5 text-sm font-mono focus:outline-none focus:border-blue-500"
+              }
+            ),
+            /* @__PURE__ */ jsxRuntimeExports.jsx(
+              "button",
+              {
+                onClick: compute,
+                disabled: busy || !source.trim() && !pasted.trim(),
+                className: "px-4 py-1.5 bg-blue-600 hover:bg-blue-500 disabled:bg-surface-800 disabled:text-surface-500 rounded text-sm font-medium",
+                children: busy ? "…" : "Measure"
+              }
+            )
+          ] }),
+          /* @__PURE__ */ jsxRuntimeExports.jsxs("details", { className: "text-[11px] text-surface-500", children: [
+            /* @__PURE__ */ jsxRuntimeExports.jsx("summary", { className: "cursor-pointer hover:text-surface-300", children: "or paste spec" }),
+            /* @__PURE__ */ jsxRuntimeExports.jsx(
+              "textarea",
+              {
+                value: pasted,
+                onChange: (e) => setPasted(e.target.value),
+                rows: 4,
+                placeholder: "Paste OpenAPI JSON or YAML here",
+                className: "mt-1 w-full resize-y bg-surface-950 border border-surface-800 rounded px-3 py-2 text-xs font-mono focus:outline-none focus:border-blue-500"
+              }
+            )
+          ] }),
+          error2 && /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "text-xs text-red-400", children: error2 })
+        ] }),
+        /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "px-4 py-3 flex-1 overflow-y-auto min-h-0", children: !report ? /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "text-sm text-surface-500 text-center py-10", children: [
+          "Point at your OpenAPI spec and choose ",
+          /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "text-surface-300", children: "Measure" }),
+          " to see which operations are tested."
+        ] }) : /* @__PURE__ */ jsxRuntimeExports.jsxs(jsxRuntimeExports.Fragment, { children: [
+          /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "mb-3", children: [
+            /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex justify-between text-xs mb-1", children: [
+              /* @__PURE__ */ jsxRuntimeExports.jsxs("span", { className: "text-surface-300", children: [
+                report.spec.title ?? "API",
+                report.spec.version ? ` v${report.spec.version}` : ""
+              ] }),
+              /* @__PURE__ */ jsxRuntimeExports.jsxs("span", { className: "text-surface-400", children: [
+                t2.operationPct,
+                "% operations tested"
+              ] })
+            ] }),
+            /* @__PURE__ */ jsxRuntimeExports.jsx(Bar, { pct: t2.operationPct })
+          ] }),
+          /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex gap-4 mb-4 border-b border-surface-800 pb-3", children: [
+            /* @__PURE__ */ jsxRuntimeExports.jsx(Stat, { value: `${t2.tested}/${t2.operations}`, label: "operations tested" }),
+            /* @__PURE__ */ jsxRuntimeExports.jsx(Stat, { value: `${t2.coveredStatuses}/${t2.declaredStatuses}`, label: "response codes covered" }),
+            t2.declaredProperties > 0 && /* @__PURE__ */ jsxRuntimeExports.jsx(Stat, { value: `${t2.propertyPct}%`, label: "response shape seen in runs" }),
+            /* @__PURE__ */ jsxRuntimeExports.jsx(Stat, { value: /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: t2.untested ? "text-amber-400" : "text-emerald-400", children: t2.untested }), label: "never tested" }),
+            /* @__PURE__ */ jsxRuntimeExports.jsx(Stat, { value: /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: t2.withoutNegativeTest ? "text-amber-400" : "text-emerald-400", children: t2.withoutNegativeTest }), label: "no negative test" })
+          ] }),
+          /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex items-center justify-between mb-2 gap-3", children: [
+            /* @__PURE__ */ jsxRuntimeExports.jsxs("label", { className: "flex items-center gap-2 text-xs text-surface-400", children: [
+              /* @__PURE__ */ jsxRuntimeExports.jsx("input", { type: "checkbox", checked: onlyGaps, onChange: (e) => setOnlyGaps(e.target.checked) }),
+              "Show only gaps (untested or missing a negative test)"
+            ] }),
+            t2.untested > 0 && /* @__PURE__ */ jsxRuntimeExports.jsxs(
+              "button",
+              {
+                onClick: generateForGaps,
+                title: "Generate happy-path, negative, and boundary tests for the untested operations",
+                className: "px-3 py-1 text-xs bg-violet-600 hover:bg-violet-500 rounded font-medium shrink-0",
+                children: [
+                  "Generate tests for ",
+                  t2.untested,
+                  " gap",
+                  t2.untested !== 1 ? "s" : ""
+                ]
+              }
+            )
+          ] }),
+          generated && /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "mb-2 px-3 py-1.5 rounded bg-emerald-900/20 border border-emerald-800/40 text-xs text-emerald-300", children: [
+            generated,
+            " Re-measure to see the coverage rise."
+          ] }),
+          /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "flex flex-col gap-0.5", children: shownOps.map((op, i) => /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex items-center gap-2 text-xs py-1 border-b border-surface-800/50", children: [
+            /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: op.tested ? "text-emerald-400" : "text-red-400", children: op.tested ? "✓" : "✗" }),
+            /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "font-mono font-bold text-surface-300 w-14 shrink-0", children: op.method }),
+            /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: `font-mono flex-1 ${op.tested ? "text-white" : "text-surface-500"}`, children: op.path }),
+            op.declaredStatuses.length > 0 && /* @__PURE__ */ jsxRuntimeExports.jsxs("span", { className: "text-surface-500 shrink-0", children: [
+              op.coveredStatuses.length,
+              "/",
+              op.declaredStatuses.length,
+              " codes"
+            ] }),
+            op.tested && !op.hasNegativeTest && /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "text-amber-400 shrink-0", children: "no negative" })
+          ] }, `${op.method}-${op.path}-${i}`)) })
+        ] }) })
+      ]
+    }
+  );
+}
+const HTTP_METHODS = ["get", "put", "post", "delete", "options", "head", "patch", "trace"];
+function resolveRef(spec, ref2) {
+  const parts = ref2.replace(/^#\//, "").split("/");
+  return parts.reduce((o, k) => o?.[decodeURIComponent(k.replace(/~1/g, "/").replace(/~0/g, "~"))], spec);
+}
+function deref(spec, node, depth = 0, seen = /* @__PURE__ */ new Set()) {
+  if (!node || typeof node !== "object" || depth > 8) return node;
+  if (Array.isArray(node)) return node.map((n) => deref(spec, n, depth + 1, seen));
+  if ("$ref" in node) {
+    const target = resolveRef(spec, node.$ref);
+    if (!target || seen.has(target)) return {};
+    return deref(spec, target, depth + 1, /* @__PURE__ */ new Set([...seen, target]));
+  }
+  const out = {};
+  for (const [k, v] of Object.entries(node)) out[k] = deref(spec, v, depth + 1, seen);
+  return out;
+}
+function walk(schema, prefix2, depth, types2, required2) {
+  if (!schema || typeof schema !== "object" || depth > 8) return;
+  const type2 = Array.isArray(schema.type) ? schema.type[0] : schema.type;
+  if (type2 === "object" || schema.properties) {
+    const req = schema.required ?? [];
+    for (const [name2, sub] of Object.entries(schema.properties ?? {})) {
+      const p2 = prefix2 ? `${prefix2}.${name2}` : name2;
+      const subType = (Array.isArray(sub?.type) ? sub.type[0] : sub?.type) ?? (sub?.properties ? "object" : "any");
+      types2.set(p2, subType);
+      if (req.includes(name2)) required2.add(p2);
+      walk(sub, p2, depth + 1, types2, required2);
+    }
+  } else if (type2 === "array" && schema.items) {
+    walk(schema.items, `${prefix2}[]`, depth + 1, types2, required2);
+  }
+}
+function schemaInfo(spec, schema) {
+  const types2 = /* @__PURE__ */ new Map();
+  const required2 = /* @__PURE__ */ new Set();
+  if (schema) walk(deref(spec, schema), "", 0, types2, required2);
+  return { types: types2, required: required2 };
+}
+function requestSchema(spec, op) {
+  return deref(spec, op?.requestBody)?.content?.["application/json"]?.schema;
+}
+function successResponseSchema(spec, op) {
+  const responses = op?.responses ?? {};
+  const code2 = Object.keys(responses).filter((c) => /^2\d\d$/.test(c)).sort()[0];
+  return code2 ? deref(spec, responses[code2])?.content?.["application/json"]?.schema : void 0;
+}
+function paramRequired(spec, pathItem, op) {
+  const raw = [...pathItem?.parameters ?? [], ...op?.parameters ?? []].map((p2) => deref(spec, p2));
+  const m = /* @__PURE__ */ new Map();
+  for (const p2 of raw) if (p2?.name && p2?.in) m.set(`${p2.in}:${p2.name}`, !!p2.required);
+  return m;
+}
+function operations(spec) {
+  const map = /* @__PURE__ */ new Map();
+  for (const [path, item] of Object.entries(spec?.paths ?? {})) {
+    if (!item || typeof item !== "object") continue;
+    for (const [method, op] of Object.entries(item)) {
+      if (!HTTP_METHODS.includes(method.toLowerCase())) continue;
+      map.set(`${method.toUpperCase()} ${path}`, { method: method.toUpperCase(), path, pathItem: item, op });
+    }
+  }
+  return map;
+}
+function diffSpecs(oldSpec, newSpec) {
+  const oldOps = operations(oldSpec);
+  const newOps = operations(newSpec);
+  const changes = [];
+  for (const [key, o] of oldOps) {
+    if (!newOps.has(key)) {
+      changes.push({ kind: "operation-removed", breaking: true, method: o.method, path: o.path, detail: `Operation ${key} was removed` });
+    }
+  }
+  for (const [key, n] of newOps) {
+    if (!oldOps.has(key)) {
+      changes.push({ kind: "operation-added", breaking: false, method: n.method, path: n.path, detail: `Operation ${key} was added` });
+      continue;
+    }
+    const o = oldOps.get(key);
+    const label = `${n.method} ${n.path}`;
+    const oReq = schemaInfo(oldSpec, requestSchema(oldSpec, o.op));
+    const nReq = schemaInfo(newSpec, requestSchema(newSpec, n.op));
+    for (const p2 of nReq.required) {
+      if (!oReq.required.has(p2)) {
+        changes.push({ kind: "request-required-added", breaking: true, method: n.method, path: n.path, detail: `${label}: request field "${p2}" is now required` });
+      }
+    }
+    for (const [p2, t2] of nReq.types) {
+      const ot = oReq.types.get(p2);
+      if (ot && ot !== t2) {
+        changes.push({ kind: "request-type-changed", breaking: true, method: n.method, path: n.path, detail: `${label}: request field "${p2}" type ${ot} -> ${t2}` });
+      }
+    }
+    const oRes = schemaInfo(oldSpec, successResponseSchema(oldSpec, o.op));
+    const nRes = schemaInfo(newSpec, successResponseSchema(newSpec, n.op));
+    for (const [p2, t2] of oRes.types) {
+      if (!nRes.types.has(p2)) {
+        changes.push({ kind: "response-removed", breaking: true, method: n.method, path: n.path, detail: `${label}: response field "${p2}" was removed` });
+      } else if (nRes.types.get(p2) !== t2) {
+        changes.push({ kind: "response-type-changed", breaking: true, method: n.method, path: n.path, detail: `${label}: response field "${p2}" type ${t2} -> ${nRes.types.get(p2)}` });
+      }
+    }
+    const oParams = paramRequired(oldSpec, o.pathItem, o.op);
+    const nParams = paramRequired(newSpec, n.pathItem, n.op);
+    for (const [k, req] of nParams) {
+      if (req && !oParams.get(k)) {
+        changes.push({ kind: "param-required-added", breaking: true, method: n.method, path: n.path, detail: `${label}: parameter "${k}" is now required` });
+      }
+    }
+    const oCodes = Object.keys(o.op?.responses ?? {}).filter((c) => /^2\d\d$/.test(c));
+    const nCodes = new Set(Object.keys(n.op?.responses ?? {}));
+    for (const c of oCodes) {
+      if (!nCodes.has(c)) {
+        changes.push({ kind: "success-code-removed", breaking: true, method: n.method, path: n.path, detail: `${label}: success response ${c} was removed` });
+      }
+    }
+  }
+  return changes;
+}
+function summarizeDiff(changes) {
+  return {
+    breaking: changes.filter((c) => c.breaking).length,
+    nonBreaking: changes.filter((c) => !c.breaking).length
+  };
+}
+const { electron: electron$8 } = window;
+function SpecField({ label, value, onSource, onText }) {
+  return /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex-1", children: [
+    /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-[11px] text-surface-400", children: label }),
+    /* @__PURE__ */ jsxRuntimeExports.jsx(
+      "input",
+      {
+        value: value.source,
+        onChange: (e) => onSource(e.target.value),
+        placeholder: "./openapi.yaml or URL",
+        className: "mt-1 w-full bg-surface-800 border border-surface-700 rounded px-2 py-1.5 text-xs font-mono focus:outline-none focus:border-blue-500"
+      }
+    ),
+    /* @__PURE__ */ jsxRuntimeExports.jsxs("details", { className: "text-[10px] text-surface-500 mt-1", children: [
+      /* @__PURE__ */ jsxRuntimeExports.jsx("summary", { className: "cursor-pointer hover:text-surface-300", children: "or paste" }),
+      /* @__PURE__ */ jsxRuntimeExports.jsx(
+        "textarea",
+        {
+          value: value.text,
+          onChange: (e) => onText(e.target.value),
+          rows: 3,
+          className: "mt-1 w-full resize-y bg-surface-950 border border-surface-800 rounded px-2 py-1.5 text-[11px] font-mono focus:outline-none focus:border-blue-500"
+        }
+      )
+    ] })
+  ] });
+}
+function CompareModal() {
+  const open = useStore((s) => s.compareOpen);
+  const setOpen = useStore((s) => s.setCompareOpen);
+  const collections = useStore((s) => s.collections);
+  const savedSpec = useStore((s) => s.workspace?.settings?.coverageSpec);
+  const [oldIn, setOldIn] = reactExports.useState({ source: "", text: "" });
+  const [newIn, setNewIn] = reactExports.useState({ source: savedSpec ?? "", text: "" });
+  const [changes, setChanges] = reactExports.useState(null);
+  const [error2, setError] = reactExports.useState(null);
+  const [busy, setBusy] = reactExports.useState(false);
+  const requests = reactExports.useMemo(() => {
+    const out = [];
+    for (const entry of Object.values(collections)) {
+      for (const req of Object.values(entry.data.requests)) {
+        if (req.disabled) continue;
+        out.push({ name: `${entry.data.name} / ${req.name}`, method: req.method, url: req.url });
+      }
+    }
+    return out;
+  }, [collections]);
+  const load = (i) => electron$8.coverageLoadSpec(i.text.trim() ? { text: i.text } : /^https?:\/\//i.test(i.source.trim()) ? { url: i.source.trim() } : { path: i.source.trim() });
+  async function run() {
+    setBusy(true);
+    setError(null);
+    try {
+      const [oldSpec, newSpec] = await Promise.all([load(oldIn), load(newIn)]);
+      setChanges(diffSpecs(oldSpec, newSpec));
+    } catch (err) {
+      setError(err instanceof Error ? err.message : String(err));
+      setChanges(null);
+    } finally {
+      setBusy(false);
+    }
+  }
+  const impact = reactExports.useMemo(() => {
+    if (!changes) return null;
+    const affected = changes.filter((c) => c.breaking && c.method).map((change) => ({
+      change,
+      tests: requests.filter((r) => r.method.toUpperCase() === change.method && pathMatches(r.url, change.path)).map((r) => r.name)
+    }));
+    const hitTests = new Set(affected.flatMap((a) => a.tests));
+    return { affected, hitTests: hitTests.size };
+  }, [changes, requests]);
+  if (!open) return null;
+  const sum = changes ? summarizeDiff(changes) : null;
+  const canRun = (oldIn.source.trim() || oldIn.text.trim()) && (newIn.source.trim() || newIn.text.trim());
+  return /* @__PURE__ */ jsxRuntimeExports.jsxs(
+    Modal,
+    {
+      onClose: () => setOpen(false),
+      overlayClassName: "bg-black/50 z-50 flex items-start justify-center pt-16",
+      panelClassName: "bg-surface-900 border border-surface-800 rounded-lg shadow-2xl flex flex-col w-[760px] max-h-[82vh]",
+      title: "Compare API specs",
+      subtitle: "Breaking-change detection and impact on your tests",
+      children: [
+        /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "px-4 py-3 border-b border-surface-800 flex-shrink-0", children: [
+          /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex gap-3 items-start", children: [
+            /* @__PURE__ */ jsxRuntimeExports.jsx(SpecField, { label: "Baseline (old)", value: oldIn, onSource: (s) => setOldIn({ ...oldIn, source: s }), onText: (t2) => setOldIn({ ...oldIn, text: t2 }) }),
+            /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "text-surface-500 pt-6", children: "->" }),
+            /* @__PURE__ */ jsxRuntimeExports.jsx(SpecField, { label: "Candidate (new)", value: newIn, onSource: (s) => setNewIn({ ...newIn, source: s }), onText: (t2) => setNewIn({ ...newIn, text: t2 }) })
+          ] }),
+          /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "flex justify-end mt-2", children: /* @__PURE__ */ jsxRuntimeExports.jsx(
+            "button",
+            {
+              onClick: run,
+              disabled: busy || !canRun,
+              className: "px-4 py-1.5 bg-blue-600 hover:bg-blue-500 disabled:bg-surface-800 disabled:text-surface-500 rounded text-sm font-medium",
+              children: busy ? "…" : "Compare"
+            }
+          ) }),
+          error2 && /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "text-xs text-red-400 mt-2", children: error2 })
+        ] }),
+        /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "px-4 py-3 flex-1 overflow-y-auto min-h-0 text-xs", children: !changes ? /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "text-surface-500 text-center py-10", children: [
+          "Point at two spec versions and choose ",
+          /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "text-surface-300", children: "Compare" }),
+          "."
+        ] }) : changes.length === 0 ? /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "text-emerald-400 text-center py-10", children: "No differences between the specs." }) : /* @__PURE__ */ jsxRuntimeExports.jsxs(jsxRuntimeExports.Fragment, { children: [
+          sum.breaking > 0 && /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "mb-3", children: [
+            /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "text-red-400 font-bold uppercase tracking-wide text-[11px] mb-1", children: "Breaking changes" }),
+            changes.filter((c) => c.breaking).map((c, i) => /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex gap-2 text-surface-300 py-0.5", children: [
+              /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "text-red-400", children: "✗" }),
+              c.detail
+            ] }, i))
+          ] }),
+          sum.nonBreaking > 0 && /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "mb-3", children: [
+            /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "text-emerald-400 font-bold uppercase tracking-wide text-[11px] mb-1", children: "Non-breaking" }),
+            changes.filter((c) => !c.breaking).map((c, i) => /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex gap-2 text-surface-400 py-0.5", children: [
+              /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "text-emerald-400", children: "✓" }),
+              c.detail
+            ] }, i))
+          ] }),
+          /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "mt-3 pt-3 border-t border-surface-800", children: sum.breaking === 0 ? /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "text-emerald-400 font-medium", children: "No breaking changes. Safe to deploy." }) : impact.hitTests === 0 ? /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "text-amber-400", children: [
+            sum.breaking,
+            " breaking change",
+            sum.breaking !== 1 ? "s" : "",
+            ", but no test in this workspace exercises the affected operations. Add tests, then re-check."
+          ] }) : /* @__PURE__ */ jsxRuntimeExports.jsxs(jsxRuntimeExports.Fragment, { children: [
+            impact.affected.filter((a) => a.tests.length).map((a, i) => /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "mb-1", children: [
+              /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "text-amber-300", children: a.change.detail }),
+              a.tests.map((t2) => /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "text-surface-500 pl-4", children: [
+                "- ",
+                t2
+              ] }, t2))
+            ] }, i)),
+            /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "mt-2 text-red-400 font-bold", children: [
+              "Block deployment: ",
+              sum.breaking,
+              " breaking change",
+              sum.breaking !== 1 ? "s" : "",
+              " affect ",
+              impact.hitTests,
+              " test",
+              impact.hitTests !== 1 ? "s" : "",
+              "."
+            ] })
+          ] }) })
+        ] }) })
+      ]
+    }
+  );
+}
 function CollectionPanel() {
   const activeCollectionId = useStore((s) => s.activeCollectionId);
   const collections = useStore((s) => s.collections);
   const updateCollectionDataSet = useStore((s) => s.updateCollectionDataSet);
   const openRunner = useStore((s) => s.openRunner);
+  const setCoverageOpen = useStore((s) => s.setCoverageOpen);
+  const setCompareOpen = useStore((s) => s.setCompareOpen);
   const [activeTab, setActiveTab] = reactExports.useState("data");
   if (!activeCollectionId) {
     return /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "flex items-center justify-center h-full text-surface-400 text-sm", children: "Select a request from the sidebar" });
@@ -70622,17 +71969,37 @@ function CollectionPanel() {
           iterCount > 0 ? ` · ${iterCount} data row${iterCount !== 1 ? "s" : ""}` : ""
         ] })
       ] }),
-      /* @__PURE__ */ jsxRuntimeExports.jsxs(
-        "button",
-        {
-          onClick: () => openRunner(activeCollectionId),
-          className: "px-3 py-1.5 text-xs bg-emerald-700 hover:bg-emerald-600 rounded font-medium transition-colors flex items-center gap-1.5",
-          children: [
-            /* @__PURE__ */ jsxRuntimeExports.jsx("svg", { className: "w-3.5 h-3.5", viewBox: "0 0 20 20", fill: "currentColor", children: /* @__PURE__ */ jsxRuntimeExports.jsx("path", { fillRule: "evenodd", d: "M10 18a8 8 0 100-16 8 8 0 000 16zM9.555 7.168A1 1 0 008 8v4a1 1 0 001.555.832l3-2a1 1 0 000-1.664l-3-2z", clipRule: "evenodd" }) }),
-            "Run collection"
-          ]
-        }
-      )
+      /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex items-center gap-2", children: [
+        /* @__PURE__ */ jsxRuntimeExports.jsx(
+          "button",
+          {
+            onClick: () => setCoverageOpen(true),
+            title: "Measure how much of an OpenAPI spec this workspace tests",
+            className: "px-3 py-1.5 text-xs border border-surface-700 text-surface-300 hover:text-white hover:border-surface-500 rounded font-medium transition-colors",
+            children: "Coverage"
+          }
+        ),
+        /* @__PURE__ */ jsxRuntimeExports.jsx(
+          "button",
+          {
+            onClick: () => setCompareOpen(true),
+            title: "Diff two OpenAPI versions: breaking changes and which tests they affect",
+            className: "px-3 py-1.5 text-xs border border-surface-700 text-surface-300 hover:text-white hover:border-surface-500 rounded font-medium transition-colors",
+            children: "Compare"
+          }
+        ),
+        /* @__PURE__ */ jsxRuntimeExports.jsxs(
+          "button",
+          {
+            onClick: () => openRunner(activeCollectionId),
+            className: "px-3 py-1.5 text-xs bg-emerald-700 hover:bg-emerald-600 rounded font-medium transition-colors flex items-center gap-1.5",
+            children: [
+              /* @__PURE__ */ jsxRuntimeExports.jsx("svg", { className: "w-3.5 h-3.5", viewBox: "0 0 20 20", fill: "currentColor", children: /* @__PURE__ */ jsxRuntimeExports.jsx("path", { fillRule: "evenodd", d: "M10 18a8 8 0 100-16 8 8 0 000 16zM9.555 7.168A1 1 0 008 8v4a1 1 0 001.555.832l3-2a1 1 0 000-1.664l-3-2z", clipRule: "evenodd" }) }),
+              "Run collection"
+            ]
+          }
+        )
+      ] })
     ] }),
     /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "flex border-b border-surface-800 px-6 flex-shrink-0", children: [
       { id: "data", label: "Data", badge: iterCount > 0 ? iterCount : 0 },
@@ -72575,10 +73942,13 @@ function ContractPanel({ fuzzReport, setFuzzReport }) {
         },
         m
       )) }),
-      /* @__PURE__ */ jsxRuntimeExports.jsx("p", { className: "text-[10px] text-surface-500 leading-relaxed", children: mode === "consumer" ? "Sends requests to the real provider and validates each response against the contract defined in the Contract tab." : mode === "provider" ? "Static analysis: validates that your requests conform to the provider's published OpenAPI spec (no HTTP calls)." : mode === "provider-live" ? "Replays each contract against a running provider, seeding provider states first. The real provider verification." : mode === "fuzz" ? "Sends malformed inputs generated from the spec (or, with no spec, the request body) and flags responses that crash (5xx) or accept invalid input." : "Checks static schema compatibility between consumer contracts and provider spec, then verifies live responses." }),
-      (mode === "provider-live" || isFuzz) && /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex flex-col gap-2", children: [
+      /* @__PURE__ */ jsxRuntimeExports.jsx("p", { className: "text-[10px] text-surface-500 leading-relaxed", children: mode === "consumer" ? "Sends requests to the real provider and validates each response against the contract defined in the Contract tab. Set a base URL below to send host-less (design-first) contracts." : mode === "provider" ? "Static analysis: validates that your requests conform to the provider's published OpenAPI spec (no HTTP calls)." : mode === "provider-live" ? "Replays each contract against a running provider, seeding provider states first. The real provider verification." : mode === "fuzz" ? "Sends malformed inputs generated from the spec (or, with no spec, the request body) and flags responses that crash (5xx) or accept invalid input." : "Checks static schema compatibility between consumer contracts and provider spec, then verifies live responses." }),
+      (mode === "consumer" || mode === "provider-live" || isFuzz) && /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex flex-col gap-2", children: [
         /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { children: [
-          /* @__PURE__ */ jsxRuntimeExports.jsx("label", { className: "text-[10px] text-surface-500 uppercase tracking-wider font-medium block mb-1", children: "Provider base URL" }),
+          /* @__PURE__ */ jsxRuntimeExports.jsxs("label", { className: "text-[10px] text-surface-500 uppercase tracking-wider font-medium block mb-1", children: [
+            "Provider base URL ",
+            mode === "consumer" && /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "normal-case text-surface-600", children: "(optional)" })
+          ] }),
           /* @__PURE__ */ jsxRuntimeExports.jsx(
             "input",
             {
@@ -72588,7 +73958,7 @@ function ContractPanel({ fuzzReport, setFuzzReport }) {
               className: "w-full text-xs bg-surface-800 border border-surface-700 rounded px-2.5 py-1.5 focus:outline-none focus:border-blue-500 font-mono placeholder-surface-600"
             }
           ),
-          /* @__PURE__ */ jsxRuntimeExports.jsx("p", { className: "text-[10px] text-surface-600 mt-1 leading-relaxed", children: isFuzz ? "Required. Each fuzzed request is rebased onto this origin before it is sent." : "Each request is rebased onto this origin before being replayed against the live provider." })
+          /* @__PURE__ */ jsxRuntimeExports.jsx("p", { className: "text-[10px] text-surface-600 mt-1 leading-relaxed", children: isFuzz ? "Required. Each fuzzed request is rebased onto this origin before it is sent." : mode === "consumer" ? "Optional. Rebase each request onto this origin before sending, so design-first contracts that carry only a path (e.g. /brands) can run. Requests with a full URL are sent as-is." : "Each request is rebased onto this origin before being replayed against the live provider." })
         ] }),
         mode === "provider-live" && /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { children: [
           /* @__PURE__ */ jsxRuntimeExports.jsxs("label", { className: "text-[10px] text-surface-500 uppercase tracking-wider font-medium block mb-1", children: [
@@ -72913,7 +74283,6 @@ function ContractResultsPanel() {
   const clearReport = useStore((s) => s.setLastContractReport);
   const activeCollId = useStore((s) => s.activeCollectionId);
   const collections = useStore((s) => s.collections);
-  const dashboardUrl = useStore((s) => s.workspace?.settings?.dashboardUrl);
   const [recordOpen, setRecordOpen] = reactExports.useState(false);
   const [pacticipant, setPacticipant] = reactExports.useState("");
   const [version, setVersion] = reactExports.useState("");
@@ -72962,15 +74331,6 @@ function ContractResultsPanel() {
         report.durationMs,
         "ms"
       ] }),
-      dashboardUrl && /* @__PURE__ */ jsxRuntimeExports.jsx(
-        "button",
-        {
-          onClick: () => window.electron.openExternal(dashboardUrl),
-          className: "text-[11px] text-surface-500 hover:text-surface-200 transition-colors",
-          title: `Open the contract dashboard (${dashboardUrl})`,
-          children: "Open dashboard"
-        }
-      ),
       /* @__PURE__ */ jsxRuntimeExports.jsx(
         "button",
         {
@@ -73056,18 +74416,70 @@ function detectPlatform(remotes) {
   return "unknown";
 }
 const NODE_LTS = "lts/*";
-function generateCiContent(platform, envName, tags2, secretVars) {
+const PROVIDER_ENV = {
+  vault: ["VAULT_ADDR", "VAULT_ROLE_ID", "VAULT_SECRET_ID"],
+  aws: ["AWS_REGION", "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY"],
+  azure: ["AZURE_TENANT_ID", "AZURE_CLIENT_ID", "AZURE_CLIENT_SECRET"],
+  op: ["OP_CONNECT_HOST", "OP_CONNECT_TOKEN"]
+};
+function secretManagerOf(ref2) {
+  if (ref2.startsWith("op://")) return "op";
+  const scheme = ref2.split(":", 1)[0];
+  if (scheme === "vault" || scheme === "aws" || scheme === "azure") return scheme;
+  return null;
+}
+const INLINE_REF_RE = /\{\{\s*(vault:|aws:|azure:|op:\/\/)/g;
+function inlineSecretManagers(text) {
+  if (!text) return [];
+  const kinds = /* @__PURE__ */ new Set();
+  for (const m of text.matchAll(INLINE_REF_RE)) {
+    kinds.add(m[1] === "op://" ? "op" : m[1].slice(0, -1));
+  }
+  return [...kinds];
+}
+function requestSecretManagers(req) {
+  return inlineSecretManagers(JSON.stringify(req));
+}
+function providerEnvVars(managers) {
+  return [...new Set(managers.flatMap((k) => PROVIDER_ENV[k]))];
+}
+function generateCiContent(platform, envName, tags2, secretVars, secretManagers = []) {
   const runCmd = [
     "api-spector run --workspace .",
     envName ? `--environment "${envName}"` : "",
     tags2 ? `--tags "${tags2}"` : "",
     "--output results.html"
   ].filter(Boolean).join(" ");
-  const allSecretVars = secretVars.length ? ["API_SPECTOR_MASTER_KEY", ...secretVars] : [];
+  const managers = [...new Set(secretManagers)];
+  const usesVault = managers.includes("vault");
+  const encryptedVars = secretVars.length ? ["API_SPECTOR_MASTER_KEY", ...secretVars] : [];
   if (platform === "github") {
-    const secretHint = allSecretVars.length ? `      # ⚠ Add these secrets in: Settings → Secrets and variables → Actions
-` + allSecretVars.map((v) => `      #   ${v}`).join("\n") + "\n" : "";
-    const envBlock = allSecretVars.length ? "\n        env:\n" + allSecretVars.map((v) => `          ${v}: \${{ secrets.${v} }}`).join("\n") : "";
+    const ghProviderEnv = providerEnvVars(managers).filter((v) => v !== "VAULT_ROLE_ID" && v !== "VAULT_SECRET_ID");
+    const allSecretVars = [...encryptedVars, ...ghProviderEnv.filter((v) => v !== "VAULT_ADDR")];
+    const hintLines = [
+      ...allSecretVars.map((v) => `      #   ${v}`),
+      ...usesVault ? ["      #   VAULT_ADDR   (as a repository variable, not a secret)"] : []
+    ];
+    const secretHint = hintLines.length ? `      # ⚠ Add these in: Settings → Secrets and variables → Actions
+${hintLines.join("\n")}
+` : "";
+    const vaultStep = usesVault ? `      - name: Authenticate to Vault (OIDC)
+        uses: hashicorp/vault-action@v3
+        with:
+          url: \${{ vars.VAULT_ADDR }}
+          method: jwt
+          role: apispector-ci          # your Vault JWT/OIDC role
+          exportToken: true            # sets VAULT_TOKEN for later steps
+` : "";
+    const permissions = usesVault ? `    permissions:
+      contents: read
+      id-token: write                  # required for Vault OIDC
+` : "";
+    const envEntries = [
+      ...allSecretVars.map((v) => `          ${v}: \${{ secrets.${v} }}`),
+      ...usesVault ? ["          VAULT_ADDR: ${{ vars.VAULT_ADDR }}"] : []
+    ];
+    const envBlock = envEntries.length ? "\n        env:\n" + envEntries.join("\n") : "";
     return `name: API Tests
 
 on:
@@ -73078,13 +74490,13 @@ on:
 jobs:
   api-tests:
     runs-on: ubuntu-latest
-    steps:
+${permissions}    steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
           node-version: '${NODE_LTS}'
       - run: npm install -g @testsmith/api-spector
-${secretHint}      - name: Run API tests
+${vaultStep}${secretHint}      - name: Run API tests
         run: ${runCmd}${envBlock}
       - name: Upload test results
         if: always()
@@ -73095,6 +74507,7 @@ ${secretHint}      - name: Run API tests
 `;
   }
   if (platform === "gitlab") {
+    const allSecretVars = [...encryptedVars, ...providerEnvVars(managers)];
     const secretHint = allSecretVars.length ? `  # ⚠ Add these in: Settings → CI/CD → Variables
 ` + allSecretVars.map((v) => `  #   ${v}`).join("\n") + "\n" : "";
     const envBlock = allSecretVars.length ? "\n  variables:\n" + allSecretVars.map((v) => `    ${v}: $${v}`).join("\n") : "";
@@ -73113,6 +74526,7 @@ ${secretHint}  script:
 `;
   }
   if (platform === "azure") {
+    const allSecretVars = [...encryptedVars, ...providerEnvVars(managers)];
     const secretHint = allSecretVars.length ? `  # ⚠ Add these in: Pipelines → Library → Variable groups (mark as secret)
 ` + allSecretVars.map((v) => `  #   ${v}`).join("\n") + "\n" : "";
     const envBlock = allSecretVars.length ? "\n    env:\n" + allSecretVars.map((v) => `      ${v}: $(${v})`).join("\n") : "";
@@ -73806,6 +75220,7 @@ function BranchesTab({ onRefresh }) {
 function CiTab() {
   const environments = useStore((s) => s.environments);
   const envList = Object.values(environments);
+  const collections = useStore((s) => s.collections);
   const [remotes, setRemotes] = reactExports.useState([]);
   const [platform, setPlatform] = reactExports.useState("unknown");
   const [envId, setEnvId] = reactExports.useState("");
@@ -73825,10 +75240,13 @@ function CiTab() {
   reactExports.useEffect(() => {
     const env = envList.find((e) => e.data.id === envId);
     const secretVars = env ? env.data.variables.filter((v) => v.secret && v.enabled).map((v) => v.key) : [];
+    const envRefManagers = env ? env.data.variables.filter((v) => v.enabled && v.secretRef).map((v) => secretManagerOf(v.secretRef)).filter((k) => k !== null) : [];
+    const inlineManagers = Object.values(collections).flatMap((c) => Object.values(c.data.requests).flatMap(requestSecretManagers));
+    const secretManagers = [.../* @__PURE__ */ new Set([...envRefManagers, ...inlineManagers])];
     const envName = env?.data.name ?? "";
-    setPreview(generateCiContent(platform, envName, tags2, secretVars));
+    setPreview(generateCiContent(platform, envName, tags2, secretVars, secretManagers));
     setWritten(false);
-  }, [platform, envId, tags2, environments]);
+  }, [platform, envId, tags2, environments, collections]);
   async function write() {
     try {
       setError(null);
@@ -74413,6 +75831,8 @@ function App() {
   }
   return /* @__PURE__ */ jsxRuntimeExports.jsxs("div", { className: "flex flex-col h-screen bg-surface-950", style: { color: "var(--text-primary)" }, children: [
     /* @__PURE__ */ jsxRuntimeExports.jsx(RunnerModal, {}),
+    /* @__PURE__ */ jsxRuntimeExports.jsx(CoverageModal, {}),
+    /* @__PURE__ */ jsxRuntimeExports.jsx(CompareModal, {}),
     /* @__PURE__ */ jsxRuntimeExports.jsx(CommandPalette, {}),
     docsModalOpen && /* @__PURE__ */ jsxRuntimeExports.jsx(DocsGeneratorModal, { onClose: () => setDocsModalOpen(false) }),
     window.electron.platform !== "win32" && /* @__PURE__ */ jsxRuntimeExports.jsx("div", { className: "drag-region flex-shrink-0 bg-surface-950 flex items-center justify-center", children: /* @__PURE__ */ jsxRuntimeExports.jsxs("span", { className: "no-drag text-[11px] font-medium tracking-widest select-none", style: { color: "var(--text-muted)" }, children: [
@@ -74421,7 +75841,7 @@ function App() {
       /* @__PURE__ */ jsxRuntimeExports.jsx("span", { style: { color: "#6aa3c8" }, children: "Spector" }),
       /* @__PURE__ */ jsxRuntimeExports.jsxs("span", { className: "ml-2 text-[10px] font-normal opacity-50", children: [
         "v",
-        "0.4.8"
+        "0.5.0"
       ] }),
       /* @__PURE__ */ jsxRuntimeExports.jsx("span", { className: "mx-2 opacity-30", children: "·" }),
       /* @__PURE__ */ jsxRuntimeExports.jsx(