apitestcenter 0.12.0 → 0.13.0

package/dist/cli.mjs

@@ -16866,7 +16866,7 @@ function loadFromLabKnobs(knobs) {
     ...extras
   };
 }
-var httpMethodSchema, durationSchema, headerNameSchema, keyValueSchema, requestHeaderSchema, bodySchema, httpRequestSchema, loadStageSchema, LOAD_EXECUTORS, loadConfigSchema, runTargetsSchema, thresholdSchema, httpClientOptionsSchema, oauthGrants, oauthConfigSchema, sessionAuthSchema, VARIABLE_NAME, variableNameSchema, extractRuleSchema, setupStepSchema, testDataSchema, testDefinitionSchema, requestScriptsSchema, labRequestSchema, labRunSchema, loadExtras, LOAD_PRESETS, LOAD_KNOB_PRESETS;
+var httpMethodSchema, durationSchema, headerNameSchema, keyValueSchema, requestHeaderSchema, fileRefSchema, multipartPartSchema, bodySchema, httpRequestSchema, loadStageSchema, LOAD_EXECUTORS, loadConfigSchema, runTargetsSchema, thresholdSchema, httpClientOptionsSchema, oauthGrants, oauthConfigSchema, sessionAuthSchema, VARIABLE_NAME, variableNameSchema, extractRuleSchema, setupStepSchema, testDataSchema, testDefinitionSchema, requestScriptsSchema, labRequestSchema, labRunSchema, loadExtras, LOAD_PRESETS, LOAD_KNOB_PRESETS;
 var init_definition = __esm({
   "../shared/src/definition.ts"() {
     "use strict";
@@ -16894,6 +16894,16 @@ var init_definition = __esm({
       key: headerNameSchema,
       value: external_exports.string()
     });
+    fileRefSchema = external_exports.object({
+      id: external_exports.string().regex(/^[a-z0-9-]{8,64}$/, "not a file id"),
+      name: external_exports.string().min(1).max(255),
+      size: external_exports.number().int().nonnegative(),
+      contentType: external_exports.string().max(200).default("application/octet-stream")
+    });
+    multipartPartSchema = external_exports.discriminatedUnion("kind", [
+      external_exports.object({ kind: external_exports.literal("text"), key: external_exports.string().min(1), value: external_exports.string() }).strict(),
+      external_exports.object({ kind: external_exports.literal("file"), key: external_exports.string().min(1), file: fileRefSchema }).strict()
+    ]);
     bodySchema = external_exports.discriminatedUnion("mode", [
       external_exports.object({ mode: external_exports.literal("none") }).strict(),
       external_exports.object({ mode: external_exports.literal("json"), json: external_exports.unknown() }).strict(),
@@ -16906,6 +16916,17 @@ var init_definition = __esm({
         mode: external_exports.literal("raw"),
         raw: external_exports.string(),
         contentType: external_exports.string().min(1)
+      }).strict(),
+      // A form with files (multipart/form-data): text fields and files, in order.
+      external_exports.object({
+        mode: external_exports.literal("multipart"),
+        parts: external_exports.array(multipartPartSchema).max(100)
+      }).strict(),
+      // One file as the whole body (an image, a PDF, a ZIP…).
+      external_exports.object({
+        mode: external_exports.literal("file"),
+        file: fileRefSchema,
+        contentType: external_exports.string().min(1)
       }).strict()
     ]);
     httpRequestSchema = external_exports.object({
@@ -17203,7 +17224,7 @@ function fillLab(lab, vars2, { builtins = true } = {}) {
   const deep = (v) => fillDeep(v, vars2, builtins);
   const { request: request3, auth } = lab;
   const body = request3.body;
-  const filledBody = body.mode === "json" ? { ...body, json: deep(body.json) } : body.mode === "text" ? { ...body, text: raw(body.text) } : body.mode === "form" ? { ...body, fields: body.fields.map((f) => ({ key: raw(f.key), value: raw(f.value) })) } : body.mode === "raw" ? { ...body, raw: raw(body.raw) } : body;
+  const filledBody = body.mode === "json" ? { ...body, json: deep(body.json) } : body.mode === "text" ? { ...body, text: raw(body.text) } : body.mode === "form" ? { ...body, fields: body.fields.map((f) => ({ key: raw(f.key), value: raw(f.value) })) } : body.mode === "raw" ? { ...body, raw: raw(body.raw) } : body.mode === "multipart" ? { ...body, parts: body.parts.map((p) => p.kind === "text" ? { ...p, key: raw(p.key), value: raw(p.value) } : { ...p, key: raw(p.key) }) } : body;
   const filledAuth = auth.mode === "bearer" ? { ...auth, token: raw(auth.token) } : auth.mode === "basic" ? { ...auth, username: raw(auth.username), password: raw(auth.password) } : auth.mode === "api_key" ? { ...auth, name: raw(auth.name), value: raw(auth.value) } : auth;
   return {
     ...lab,
@@ -20740,9 +20761,9 @@ var require_stringifyDocument = __commonJS({
       const lines = [];
       let hasDirectives = options.directives === true;
       if (options.directives !== false && doc.directives) {
-        const dir2 = doc.directives.toString(doc);
-        if (dir2) {
-          lines.push(dir2);
+        const dir3 = doc.directives.toString(doc);
+        if (dir3) {
+          lines.push(dir3);
           hasDirectives = true;
         } else if (doc.directives.docStart)
           hasDirectives = true;
@@ -24856,6 +24877,9 @@ function defaultRequestDraft() {
     graphqlOperation: "",
     graphqlErrorsFail: true,
     bodyText: "",
+    formRows: [],
+    bodyFile: null,
+    bodyFileType: "",
     authMode: "inherit",
     oauth: defaultOAuth(),
     oauth1: defaultOAuth1(),
@@ -24905,6 +24929,17 @@ function checksFrom(value) {
     return parsed.success ? [parsed.data] : [];
   });
 }
+function fileFrom(value) {
+  const parsed = fileRefSchema.safeParse(value);
+  return parsed.success ? parsed.data : null;
+}
+function formRowsFrom(value) {
+  if (!Array.isArray(value)) return [];
+  return value.slice(0, 100).map((row) => {
+    const item = row ?? {};
+    return { key: typeof item.key === "string" ? item.key : "", value: typeof item.value === "string" ? item.value : "", kind: item.kind === "file" ? "file" : "text", file: fileFrom(item.file) };
+  });
+}
 function rows(value) {
   if (!Array.isArray(value)) return [];
   return value.map((row) => {
@@ -24919,7 +24954,7 @@ function requestFromUnknown(value) {
   const base = defaultRequestDraft();
   if (!value || typeof value !== "object") return base;
   const item = value;
-  const bodyMode = item.bodyMode === "json" || item.bodyMode === "text" || item.bodyMode === "graphql" ? item.bodyMode : "none";
+  const bodyMode = BODY_MODES.includes(item.bodyMode) ? item.bodyMode : "none";
   const authMode2 = item.authMode === "bearer" || item.authMode === "basic" || item.authMode === "api_key" || item.authMode === "inherit" || item.authMode === "oauth2" || item.authMode === "digest" || item.authMode === "ntlm" || item.authMode === "aws_sigv4" || item.authMode === "jwt" || item.authMode === "oauth1" ? item.authMode : item.authMode === void 0 ? "inherit" : "none";
   return {
     method: METHODS.includes(item.method) ? item.method : "GET",
@@ -24930,6 +24965,9 @@ function requestFromUnknown(value) {
     headers: rows(item.headers),
     bodyMode,
     bodyText: str(item.bodyText, ""),
+    formRows: formRowsFrom(item.formRows),
+    bodyFile: fileFrom(item.bodyFile),
+    bodyFileType: str(item.bodyFileType, ""),
     graphqlQuery: str(item.graphqlQuery, ""),
     graphqlVariables: str(item.graphqlVariables, ""),
     graphqlOperation: str(item.graphqlOperation, ""),
@@ -25085,6 +25123,20 @@ function requestParts(draft) {
     body = { mode: "json", json: { query: draft.graphqlQuery, variables, ...draft.graphqlOperation.trim() ? { operationName: draft.graphqlOperation.trim() } : {} } };
   } else if (hasBody(draft.method) && draft.bodyMode === "text") {
     body = { mode: "text", text: draft.bodyText };
+  } else if (hasBody(draft.method) && draft.bodyMode === "form") {
+    body = { mode: "form", fields: draft.formRows.filter((r) => r.kind === "text" && r.key.trim()).map((r) => ({ key: r.key, value: r.value })) };
+  } else if (hasBody(draft.method) && draft.bodyMode === "multipart") {
+    const parts2 = [];
+    for (const r of draft.formRows) {
+      if (!r.key.trim()) continue;
+      if (r.kind === "text") parts2.push({ kind: "text", key: r.key, value: r.value });
+      else if (r.file) parts2.push({ kind: "file", key: r.key, file: r.file });
+      else throw new Error(`Choose a file for "${r.key}" in the body`);
+    }
+    body = { mode: "multipart", parts: parts2 };
+  } else if (hasBody(draft.method) && draft.bodyMode === "file") {
+    if (!draft.bodyFile) throw new Error("Choose the file to send as the body");
+    body = { mode: "file", file: draft.bodyFile, contentType: draft.bodyFileType.trim() || draft.bodyFile.contentType || "application/octet-stream" };
   }
   return {
     request: {
@@ -25250,7 +25302,7 @@ function oauthWire(o) {
     assertion: o.assertion.trim()
   };
 }
-var METHODS, DEFAULT_LOAD, str, num, TEMPLATED, DURATION;
+var METHODS, BODY_MODES, DEFAULT_LOAD, str, num, TEMPLATED, DURATION;
 var init_draft = __esm({
   "../shared/src/draft.ts"() {
     "use strict";
@@ -25263,6 +25315,7 @@ var init_draft = __esm({
     init_url_parts();
     init_workspace();
     METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"];
+    BODY_MODES = ["none", "json", "text", "graphql", "form", "multipart", "file"];
     DEFAULT_LOAD = { preset: "smoke", ...LOAD_KNOB_PRESETS.smoke };
     str = (v, fallback) => typeof v === "string" ? v : fallback;
     num = (v, fallback) => typeof v === "number" && Number.isFinite(v) ? v : fallback;
@@ -26500,6 +26553,91 @@ var init_graphql = __esm({
   }
 });
 
+// ../shared/src/multipart.ts
+function multipartBoundary() {
+  let s = "";
+  for (let i = 0; i < 24; i++) s += "0123456789abcdefghijklmnopqrstuvwxyz"[Math.floor(Math.random() * 36)];
+  return `----ApiTestCenter${s}`;
+}
+function quoted(name) {
+  return `"${name.replace(/"/g, "%22").replace(/\r/g, "%0D").replace(/\n/g, "%0A")}"`;
+}
+function partHead(part, boundary) {
+  if (part.kind === "text") return `--${boundary}\r
+Content-Disposition: form-data; name=${quoted(part.key)}\r
+\r
+`;
+  return `--${boundary}\r
+Content-Disposition: form-data; name=${quoted(part.key)}; filename=${quoted(part.file.name)}\r
+Content-Type: ${part.file.contentType || "application/octet-stream"}\r
+\r
+`;
+}
+function multipartContentType(boundary) {
+  return `multipart/form-data; boundary=${boundary}`;
+}
+function buildMultipart(parts, boundary) {
+  const enc = new TextEncoder();
+  const chunks = [];
+  for (const part of parts) {
+    chunks.push(enc.encode(partHead(part, boundary)));
+    chunks.push(part.kind === "text" ? enc.encode(part.value) : part.bytes);
+    chunks.push(enc.encode("\r\n"));
+  }
+  chunks.push(enc.encode(`--${boundary}--\r
+`));
+  const out = new Uint8Array(chunks.reduce((n, c) => n + c.length, 0));
+  let at = 0;
+  for (const c of chunks) {
+    out.set(c, at);
+    at += c.length;
+  }
+  return out;
+}
+function formatBytes(n) {
+  if (n < 1024) return `${n} B`;
+  if (n < 1024 * 1024) return `${(n / 1024).toFixed(1)} KB`;
+  return `${(n / 1024 / 1024).toFixed(1)} MB`;
+}
+function multipartPreview(parts, boundary) {
+  let out = "";
+  for (const part of parts) out += partHead(part, boundary) + (part.kind === "text" ? part.value : `<file: ${part.file.name}, ${formatBytes(part.file.size)}>`) + "\r\n";
+  return `${out}--${boundary}--\r
+`;
+}
+function guessContentType(name) {
+  const ext = /\.([a-z0-9]+)$/i.exec(name)?.[1]?.toLowerCase() ?? "";
+  const types = {
+    json: "application/json",
+    xml: "application/xml",
+    pdf: "application/pdf",
+    zip: "application/zip",
+    gz: "application/gzip",
+    csv: "text/csv",
+    txt: "text/plain",
+    html: "text/html",
+    png: "image/png",
+    jpg: "image/jpeg",
+    jpeg: "image/jpeg",
+    gif: "image/gif",
+    webp: "image/webp",
+    svg: "image/svg+xml",
+    mp4: "video/mp4",
+    mp3: "audio/mpeg",
+    wav: "audio/wav",
+    doc: "application/msword",
+    docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+    xls: "application/vnd.ms-excel",
+    xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"
+  };
+  return types[ext] ?? "application/octet-stream";
+}
+var init_multipart = __esm({
+  "../shared/src/multipart.ts"() {
+    "use strict";
+  }
+});
+
 // ../shared/src/export-fields.ts
 function roundN(n, digits = 2) {
   if (!Number.isFinite(n)) return 0;
@@ -27462,6 +27600,7 @@ var init_src = __esm({
     init_sigv4();
     init_oauth1();
     init_graphql();
+    init_multipart();
     init_latency_bins();
     init_checks3();
     init_definition();
@@ -27527,8 +27666,8 @@ token, password, or key.
       entries = /* @__PURE__ */ new Map();
       loaded = false;
       queue = Promise.resolve();
-      constructor(dir2 = resolveDataDir()) {
-        this.dir = dir2;
+      constructor(dir3 = resolveDataDir()) {
+        this.dir = dir3;
       }
       /** Run one mutation at a time, so two saves never race on index.json or a baseline flip. */
       serial(task) {
@@ -27855,6 +27994,61 @@ var init_k6 = __esm({
   }
 });
 
+// ../../apps/engine/src/file-store.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+import { existsSync as existsSync2, readFileSync } from "node:fs";
+import { mkdir as mkdir2, writeFile as writeFile2 } from "node:fs/promises";
+import { join as join4 } from "node:path";
+function useFileStore(dataDir) {
+  dir = join4(dataDir, "files");
+}
+function filesDir() {
+  return dir || join4(resolveDataDir(), "files");
+}
+async function saveFile(name, bytes2, contentType) {
+  if (bytes2.length > FILE_MAX) throw Object.assign(new Error("A file can be up to 50 MB"), { statusCode: 413 });
+  const id = randomUUID2();
+  await mkdir2(filesDir(), { recursive: true });
+  await writeFile2(join4(filesDir(), id), bytes2);
+  const clean = name.replace(/[\\/]/g, "_").trim().slice(0, 255) || "file";
+  const type = contentType && contentType !== "application/octet-stream" ? contentType : guessContentType(clean);
+  return { id, name: clean, size: bytes2.length, contentType: type };
+}
+function fileBytes(file2) {
+  const path = join4(filesDir(), file2.id);
+  if (!/^[a-z0-9-]{8,64}$/.test(file2.id) || !existsSync2(path)) {
+    throw new Error(`The file "${file2.name}" isn't in this data folder (${filesDir()}) \u2014 choose it again in the Body tab`);
+  }
+  return readFileSync(path);
+}
+function encodeMultipart(parts) {
+  const boundary = multipartBoundary();
+  const filled = parts.map((p) => p.kind === "text" ? p : { ...p, bytes: fileBytes(p.file) });
+  return { bytes: Buffer.from(buildMultipart(filled, boundary)), contentType: multipartContentType(boundary), preview: multipartPreview(parts, boundary) };
+}
+function registerFileRoutes(api) {
+  api.addContentTypeParser("*", { parseAs: "buffer", bodyLimit: FILE_MAX }, (_req, body, done) => done(null, body));
+  api.post("/files", { bodyLimit: FILE_MAX }, async (request3, reply) => {
+    const body = request3.body;
+    if (!Buffer.isBuffer(body)) return reply.code(400).send({ error: "Send the file's bytes as the body" });
+    try {
+      return await saveFile(String(request3.query.name ?? "file"), body, request3.query.type || void 0);
+    } catch (err) {
+      return reply.code(err.statusCode ?? 500).send({ error: err instanceof Error ? err.message : "Could not keep the file" });
+    }
+  });
+}
+var FILE_MAX, dir;
+var init_file_store = __esm({
+  "../../apps/engine/src/file-store.ts"() {
+    "use strict";
+    init_src();
+    init_history_store();
+    FILE_MAX = 50 * 1024 * 1024;
+    dir = "";
+  }
+});
+
 // ../shared/src/k6-script.ts
 function targetUrl(run2) {
   const url2 = new URL(run2.request.url);
@@ -27874,18 +28068,22 @@ function publicHeaders(run2) {
     if (pair.key) headers[pair.key] = pair.value;
   }
   const body = run2.request.body;
+  if (body.mode === "multipart") {
+    for (const k of Object.keys(headers)) if (k.toLowerCase() === "content-type") delete headers[k];
+  }
   const hasContentType = Object.keys(headers).some((k) => k.toLowerCase() === "content-type");
   if (!hasContentType) {
     if (body.mode === "json") headers["content-type"] = "application/json";
     else if (body.mode === "text") headers["content-type"] = "text/plain";
     else if (body.mode === "form") headers["content-type"] = "application/x-www-form-urlencoded";
     else if (body.mode === "raw") headers["content-type"] = body.contentType;
+    else if (body.mode === "file") headers["content-type"] = body.contentType;
   }
   return headers;
 }
 function encodeBody(run2) {
   const { body } = run2.request;
-  if (body.mode === "none") return "";
+  if (body.mode === "none" || body.mode === "multipart" || body.mode === "file") return "";
   if (body.mode === "json") {
     return typeof body.json === "string" ? body.json : JSON.stringify(body.json ?? {});
   }
@@ -28017,6 +28215,35 @@ function generateK6Script(run2, extra2 = {}) {
   }
   const bodyMode = run2.request.body.mode;
   env.ATC_BODY_FILL = bodyMode === "json" ? "json" : bodyMode === "form" ? "url" : "raw";
+  const reqBody = run2.request.body;
+  const bytesOf = (id, name) => {
+    const bytes2 = extra2.fileBytes?.[id];
+    if (!bytes2) throw new Error(`The file "${name}" isn't available for the load test`);
+    return bytes2;
+  };
+  const partFiles = [];
+  let bodyBin = false;
+  if (reqBody.mode === "file") {
+    files["body.bin"] = bytesOf(reqBody.file.id, reqBody.file.name);
+    bodyBin = true;
+  } else if (reqBody.mode === "multipart" && run2.auth.mode === "aws_sigv4") {
+    const boundary = multipartBoundary();
+    const parts = reqBody.parts.map((p) => p.kind === "text" ? p : { ...p, bytes: bytesOf(p.file.id, p.file.name) });
+    files["body.bin"] = buildMultipart(parts, boundary);
+    const headers = JSON.parse(env.ATC_HEADERS);
+    headers["content-type"] = multipartContentType(boundary);
+    env.ATC_HEADERS = JSON.stringify(headers);
+    bodyBin = true;
+  } else if (reqBody.mode === "multipart") {
+    const parts = reqBody.parts.map((p, i) => {
+      if (p.kind === "text") return { key: p.key, value: p.value };
+      const name = `file-${i}.bin`;
+      files[name] = bytesOf(p.file.id, p.file.name);
+      partFiles.push(name);
+      return { key: p.key, file: name, name: p.file.name, type: p.file.contentType };
+    });
+    files["parts.json"] = JSON.stringify(parts);
+  }
   if (data) {
     files["data.json"] = JSON.stringify(data.rows);
     env.ATC_DATA_COLUMNS = JSON.stringify(data.columns);
@@ -28070,7 +28297,13 @@ function __atcKeep(out) {
 }
 ` : ""}${run2.auth.mode === "aws_sigv4" ? `
 const AWS = JSON.parse(__ENV.ATC_AWS);
-${SIGV4_JS}` : ""}${run2.auth.mode === "oauth1" ? `
+${SIGV4_JS}` : ""}${bodyBin ? `
+// The body: a file, read once.
+const __atcBodyBin = open("./body.bin", "b");` : ""}${files["parts.json"] ? `
+// A form with files: the fields, and the files, read once.
+const __atcParts = JSON.parse(open("./parts.json"));
+const __atcPartFiles = {};
+${partFiles.map((n) => `__atcPartFiles[${JSON.stringify(n)}] = open(${JSON.stringify(`./${n}`)}, "b");`).join("\n")}` : ""}${run2.auth.mode === "oauth1" ? `
 const OAUTH1 = JSON.parse(__ENV.ATC_OAUTH1);
 ${OAUTH1_JS}` : ""}
 const CHECKS = __ENV.ATC_CHECKS_FILE ? JSON.parse(open("./checks.json")) : JSON.parse(__ENV.ATC_CHECKS || "[]");
@@ -28127,7 +28360,11 @@ export default ${scripts ? "async " : ""}function () {
     body = out.request.body === undefined ? null : f(out.request.body, __ENV.ATC_BODY_FILL);
     if (out.error) check(null, { "pre-request script ran": () => false });
   }` : ""}
-  if (__ENV.ATC_COOKIE) headers.Cookie = __ENV.ATC_COOKIE;
+${bodyBin ? `  body = __atcBodyBin;
+` : files["parts.json"] ? `  // Test data and built-in values fill the text fields, for each request.
+  body = {};
+  for (const p of __atcParts) body[f(p.key)] = p.file ? http.file(__atcPartFiles[p.file], p.name, p.type) : f(p.value);
+` : ""}  if (__ENV.ATC_COOKIE) headers.Cookie = __ENV.ATC_COOKIE;
   if (__ENV.ATC_TOKEN) headers.Authorization = "Bearer " + f(__atcFreshToken());
   if (__ENV.ATC_BASIC_USER !== undefined) headers.Authorization = "Basic " + encoding.b64encode(f(__ENV.ATC_BASIC_USER) + ":" + f(__ENV.ATC_BASIC_PASS || ""));
   if (__ENV.ATC_API_NAME && __ENV.ATC_API_KEY) headers[f(__ENV.ATC_API_NAME)] = f(__ENV.ATC_API_KEY);
@@ -28149,7 +28386,7 @@ export default ${scripts ? "async " : ""}function () {
     const named = {};
     for (const item of CHECKS) named[item.label] = () => __atcCheck(item.check, view);${scripts ? `
     if (__atcPost) {
-      const out = await __atcScriptRunAsync(__atcPost, { phase: "post", name: __ENV.ATC_NAME, iteration: __atcIteration, request: { method: method, url: target, headers: [], body: body === null ? undefined : body }, response: { code: res.status, headers: lower, body: view.body || "", responseTime: res.timings.duration }, vars: vars }, __atcHost);
+      const out = await __atcScriptRunAsync(__atcPost, { phase: "post", name: __ENV.ATC_NAME, iteration: __atcIteration, request: { method: method, url: target, headers: [], body: typeof body === "string" ? body : undefined }, response: { code: res.status, headers: lower, body: view.body || "", responseTime: res.timings.duration }, vars: vars }, __atcHost);
       __atcKeep(out);
       // Each pm.test is a check; a test that throws in one request fails in that one only.
       for (const t of out.tests) named[t.name] = () => t.ok;
@@ -28178,6 +28415,7 @@ var init_k6_script = __esm({
     init_scripts();
     init_oauth1();
     init_sigv4();
+    init_multipart();
     init_definition();
   }
 });
@@ -32588,9 +32826,9 @@ var require_sha256 = __commonJS({
     var forge2 = require_forge();
     require_md();
     require_util();
-    var sha256 = module.exports = forge2.sha256 = forge2.sha256 || {};
-    forge2.md.sha256 = forge2.md.algorithms.sha256 = sha256;
-    sha256.create = function() {
+    var sha2562 = module.exports = forge2.sha256 = forge2.sha256 || {};
+    forge2.md.sha256 = forge2.md.algorithms.sha256 = sha2562;
+    sha2562.create = function() {
       if (!_initialized) {
         _init();
       }
@@ -46008,14 +46246,14 @@ var require_lib = __commonJS({
 });
 
 // ../../apps/engine/src/certificates.ts
-import { randomUUID as randomUUID2 } from "node:crypto";
-import { mkdir as mkdir2, readFile as readFile2, rename as rename2, writeFile as writeFile2 } from "node:fs/promises";
-import { join as join4 } from "node:path";
+import { randomUUID as randomUUID3 } from "node:crypto";
+import { mkdir as mkdir3, readFile as readFile2, rename as rename2, writeFile as writeFile3 } from "node:fs/promises";
+import { join as join5 } from "node:path";
 import { X509Certificate } from "node:crypto";
 import * as tlsModule from "node:tls";
 import { connect as tlsSocket, createSecureContext, rootCertificates } from "node:tls";
 function useCertificateStore(dataDir, store3) {
-  dir = dataDir;
+  dir2 = dataDir;
   secrets = store3;
 }
 function addTemporaryCertificate(host2, material) {
@@ -46039,9 +46277,9 @@ function hostMatches(pattern, url2) {
   return name === host2;
 }
 async function readStore() {
-  if (!dir) return { certificates: [], cas: [] };
+  if (!dir2) return { certificates: [], cas: [] };
   try {
-    const raw = JSON.parse(await readFile2(join4(dir, "certificates.json"), "utf8"));
+    const raw = JSON.parse(await readFile2(join5(dir2, "certificates.json"), "utf8"));
     return {
       certificates: Array.isArray(raw.certificates) ? raw.certificates.filter((c) => c && typeof c.id === "string" && typeof c.host === "string") : [],
       cas: Array.isArray(raw.cas) ? raw.cas.filter((c) => c && typeof c.id === "string" && typeof c.pem === "string") : []
@@ -46054,10 +46292,10 @@ async function readAll() {
   return (await readStore()).certificates;
 }
 async function writeStore(next) {
-  await mkdir2(dir, { recursive: true });
-  const file2 = join4(dir, "certificates.json");
+  await mkdir3(dir2, { recursive: true });
+  const file2 = join5(dir2, "certificates.json");
   const tmp = `${file2}.${process.pid}.tmp`;
-  await writeFile2(tmp, `${JSON.stringify({ version: 1, ...next }, null, 2)}
+  await writeFile3(tmp, `${JSON.stringify({ version: 1, ...next }, null, 2)}
 `, "utf8");
   await rename2(tmp, file2);
 }
@@ -46081,7 +46319,7 @@ async function addCas(pemText) {
     if (!x.ca) throw new Error(`${x.subject.split("\n").find((l) => l.startsWith("CN="))?.slice(3) ?? "That certificate"} is not a certificate authority \u2014 add the CA that issued the server's certificate`);
     if (store3.cas.some((c) => c.pem.replace(/\s/g, "") === pem.replace(/\s/g, ""))) continue;
     const cn = x.subject.split("\n").find((l) => l.startsWith("CN="))?.slice(3) ?? x.subject.replace(/\n/g, ", ");
-    store3.cas.push({ id: randomUUID2(), subject: cn, expires: new Date(x.validTo).toISOString(), pem });
+    store3.cas.push({ id: randomUUID3(), subject: cn, expires: new Date(x.validTo).toISOString(), pem });
   }
   await writeStore(store3);
   casCache = null;
@@ -46169,7 +46407,7 @@ async function saveCertificate(input) {
   if (input.kind === "pem" && (!material.cert || !material.key)) throw new Error("Choose the certificate file and its private key file");
   checkMaterial(material);
   const all = await readAll();
-  const id = input.id && all.some((c) => c.id === input.id) ? input.id : randomUUID2();
+  const id = input.id && all.some((c) => c.id === input.id) ? input.id : randomUUID3();
   await secrets.deletePrefix(`cert:${id}:`);
   if (material.key) await secrets.set(`cert:${id}:key`, material.key);
   if (material.pfx) await secrets.set(`cert:${id}:pfx`, material.pfx.toString("base64"));
@@ -46288,13 +46526,13 @@ function registerCertificateRoutes(app2) {
     return { host: m?.host ?? null };
   });
 }
-var import_node_forge, dir, secrets, extra, casCache, systemCache, saveBody;
+var import_node_forge, dir2, secrets, extra, casCache, systemCache, saveBody;
 var init_certificates = __esm({
   "../../apps/engine/src/certificates.ts"() {
     "use strict";
     import_node_forge = __toESM(require_lib(), 1);
     init_zod();
-    dir = "";
+    dir2 = "";
     secrets = null;
     extra = [];
     casCache = null;
@@ -61284,7 +61522,7 @@ var require_snapshot_utils = __commonJS({
 var require_snapshot_recorder = __commonJS({
   "../../node_modules/.pnpm/undici@8.10.0/node_modules/undici/lib/mock/snapshot-recorder.js"(exports, module) {
     "use strict";
-    var { writeFile: writeFile11, readFile: readFile12, mkdir: mkdir8 } = __require("node:fs/promises");
+    var { writeFile: writeFile12, readFile: readFile12, mkdir: mkdir9 } = __require("node:fs/promises");
     var { dirname: dirname4, resolve: resolve5 } = __require("node:path");
     var { setTimeout: setTimeout2, clearTimeout: clearTimeout2 } = __require("node:timers");
     var { InvalidArgumentError, UndiciError } = require_errors2();
@@ -61531,12 +61769,12 @@ var require_snapshot_recorder = __commonJS({
           throw new InvalidArgumentError("Snapshot path is required");
         }
         const resolvedPath = resolve5(path);
-        await mkdir8(dirname4(resolvedPath), { recursive: true });
+        await mkdir9(dirname4(resolvedPath), { recursive: true });
         const data = Array.from(this.#snapshots.entries()).map(([hash2, snapshot2]) => ({
           hash: hash2,
           snapshot: snapshot2
         }));
-        await writeFile11(resolvedPath, JSON.stringify(data, null, 2), { flush: true });
+        await writeFile12(resolvedPath, JSON.stringify(data, null, 2), { flush: true });
       }
       /**
        * Clears all recorded snapshots
@@ -73430,7 +73668,7 @@ ${captureLines}` : capture.stack;
 });
 
 // ../../apps/engine/src/oauth.ts
-import { X509Certificate as X509Certificate2, createHash as createHash2, randomBytes, randomUUID as randomUUID3 } from "node:crypto";
+import { X509Certificate as X509Certificate2, createHash as createHash2, randomBytes, randomUUID as randomUUID4 } from "node:crypto";
 import { createServer } from "node:http";
 function useOAuthStore(secrets2) {
   store2 = secrets2;
@@ -73473,7 +73711,7 @@ function signedAssertion(c, claims, now) {
   const x5t = thumbprint(c.certificate);
   try {
     return signJwt(
-      { algorithm: c.assertionAlgorithm, key: c.privateKey, payload: JSON.stringify({ jti: randomUUID3(), ...claims }), lifetimeSec: 300, kid: c.kid, headerName: "", prefix: "" },
+      { algorithm: c.assertionAlgorithm, key: c.privateKey, payload: JSON.stringify({ jti: randomUUID4(), ...claims }), lifetimeSec: 300, kid: c.kid, headerName: "", prefix: "" },
       now,
       x5t ? { x5t } : {}
     );
@@ -73627,7 +73865,7 @@ async function startAuthorization(c) {
   }
   const port2 = Number(redirect.port || 80);
   for (const [id2, p] of pending) if (p.port === port2 && p.status === "waiting") stopPending(id2, "replaced by a new sign-in");
-  const id = randomUUID3();
+  const id = randomUUID4();
   const state = b64url2(randomBytes(24));
   const verifier = b64url2(randomBytes(48));
   const url2 = new URL(c.authUrl);
@@ -77972,7 +78210,7 @@ var init_script_sandbox = __esm({
 });
 
 // ../../apps/engine/src/realtime.ts
-import { randomUUID as randomUUID4 } from "node:crypto";
+import { randomUUID as randomUUID5 } from "node:crypto";
 function add(s, e) {
   s.events.push({ at: Date.now() - s.started, ...e, text: e.text.length > 1e5 ? `${e.text.slice(0, 1e5)}\u2026 (cut)` : e.text });
   if (s.events.length > MAX_EVENTS) {
@@ -77982,7 +78220,7 @@ function add(s, e) {
 }
 function newSession(kind, url2) {
   if (sessions.size >= MAX_SESSIONS) [...sessions.values()].sort((a, b) => a.started - b.started)[0]?.close();
-  const s = { id: randomUUID4(), kind, url: url2, started: Date.now(), status: "connecting", events: [], dropped: 0, lastRead: Date.now(), close: () => void 0 };
+  const s = { id: randomUUID5(), kind, url: url2, started: Date.now(), status: "connecting", events: [], dropped: 0, lastRead: Date.now(), close: () => void 0 };
   sessions.set(s.id, s);
   return s;
 }
@@ -78199,6 +78437,11 @@ function applyAuth(headers, url2, auth) {
 }
 function encodeBody2(lab) {
   const { body } = lab.request;
+  if (body.mode === "multipart") {
+    const encoded = encodeMultipart(body.parts);
+    return { body: encoded.bytes, contentType: encoded.contentType, preview: encoded.preview, ownType: true };
+  }
+  if (body.mode === "file") return { body: fileBytes(body.file), contentType: body.contentType, preview: `<file: ${body.file.name}, ${formatBytes(body.file.size)}>` };
   if (body.mode === "none") return {};
   if (body.mode === "json") {
     return {
@@ -78319,8 +78562,21 @@ function scriptSender(lab) {
 }
 function scriptRequest(lab) {
   const url2 = fullUrl(lab);
+  const text = bodyText(lab);
+  return { method: lab.request.method, url: url2.toString(), headers: lab.request.headers.map((h) => [h.key, h.value]), ...text !== void 0 ? { body: text } : {} };
+}
+function bodyShape(lab) {
+  const { body } = lab.request;
+  if (body.mode === "multipart") return { form: body.parts.map((p) => p.kind === "text" ? { name: p.key, value: p.value } : { name: p.key, file: p.file.name, contentType: p.file.contentType }) };
+  if (body.mode === "file") return { file: { name: body.file.name, contentType: body.contentType } };
+  return void 0;
+}
+function bodyText(lab) {
+  const { body } = lab.request;
+  if (body.mode === "multipart") return multipartPreview(body.parts, "----ApiTestCenter");
+  if (body.mode === "file") return `<file: ${body.file.name}, ${formatBytes(body.file.size)}>`;
   const encoded = encodeBody2(lab);
-  return { method: lab.request.method, url: url2.toString(), headers: lab.request.headers.map((h) => [h.key, h.value]), ...encoded.body !== void 0 ? { body: encoded.body } : {} };
+  return typeof encoded.body === "string" ? encoded.body : void 0;
 }
 function applyScriptRequest(lab, out, vars2) {
   const before = scriptRequest(lab);
@@ -78330,7 +78586,7 @@ function applyScriptRequest(lab, out, vars2) {
   let body = lab.request.body;
   const newBody = r.body === void 0 ? void 0 : fill(r.body);
   if (newBody !== before.body || newBody !== r.body) {
-    const contentType = headers.find((h) => h.key.toLowerCase() === "content-type")?.value ?? encodeBody2(lab).contentType ?? "text/plain";
+    const contentType = headers.find((h) => h.key.toLowerCase() === "content-type")?.value ?? (lab.request.body.mode === "multipart" || lab.request.body.mode === "file" ? void 0 : encodeBody2(lab).contentType) ?? "text/plain";
     body = newBody === void 0 ? { mode: "none" } : { mode: "raw", raw: newBody, contentType };
   }
   const urlChanged = r.url !== before.url;
@@ -78459,7 +78715,16 @@ async function sendRaw(lab, extra2 = {}) {
     headers.authorization = extra2.authorization;
     secretNames.push("authorization");
   }
-  const encoded = encodeBody2(lab);
+  let encoded;
+  try {
+    encoded = encodeBody2(lab);
+  } catch (err) {
+    const error51 = err instanceof Error ? err.message : String(err);
+    return { raw: "", lowered: {}, result: { ok: false, status: 0, statusText: "error", headers: {}, body: "", truncated: false, durationMs: 0, url: url2.toString(), error: error51 } };
+  }
+  if (encoded.ownType) {
+    for (const k of Object.keys(headers)) if (k.toLowerCase() === "content-type") delete headers[k];
+  }
   if (encoded.contentType && !Object.keys(headers).some((k) => k.toLowerCase() === "content-type")) {
     headers["content-type"] = encoded.contentType;
   }
@@ -78467,7 +78732,7 @@ async function sendRaw(lab, extra2 = {}) {
   if (lab.auth.mode === "oauth1") {
     const { mode: _mode, ...creds } = lab.auth;
     const contentType = Object.entries(headers).find(([k]) => k.toLowerCase() === "content-type")?.[1];
-    const signed = signOAuth1(creds, { method: lab.request.method, url: url2.toString(), contentType, body: encoded.body });
+    const signed = signOAuth1(creds, { method: lab.request.method, url: url2.toString(), contentType, body: typeof encoded.body === "string" ? encoded.body : void 0 });
     if (signed.authorization) {
       headers.authorization = signed.authorization;
       secretNames.push("authorization");
@@ -78502,7 +78767,7 @@ async function sendRaw(lab, extra2 = {}) {
         const jar2 = await cookieHeader(current);
         if (jar2) sendHeaders.cookie = jar2;
       }
-      if (!sent) sent = describeSent(method, current, sendHeaders, body, [...secretNames, ...ALWAYS_SECRET], secretQuery, options.tlsSkipVerify);
+      if (!sent) sent = describeSent(method, current, sendHeaders, body, [...secretNames, ...ALWAYS_SECRET], secretQuery, options.tlsSkipVerify, encoded.preview, bodyShape(lab));
       else (sent.redirects ??= []).push(`${method} ${current.toString()}`);
       response = await (0, import_undici3.request)(current, { method, headers: sendHeaders, body, headersTimeout: timeout, bodyTimeout: timeout, dispatcher });
       const setCookie = response.headers["set-cookie"];
@@ -78594,14 +78859,16 @@ async function sendRaw(lab, extra2 = {}) {
     if (!extra2.dispatcher && !keepOpen) await dispatcher.close();
   }
 }
-function describeSent(method, url2, headers, body, secretHeaders, secretQuery, insecure) {
+function describeSent(method, url2, headers, bytes2, secretHeaders, secretQuery, insecure, preview, shape) {
   const list = [["host", url2.host], ...Object.entries(headers)];
-  if (body !== void 0) list.push(["content-length", String(Buffer.byteLength(body))]);
+  if (bytes2 !== void 0) list.push(["content-length", String(typeof bytes2 === "string" ? Buffer.byteLength(bytes2) : bytes2.length)]);
+  const body = bytes2 === void 0 ? void 0 : preview ?? (typeof bytes2 === "string" ? bytes2 : `<${bytes2.length} bytes>`);
   return {
     method,
     url: url2.toString(),
     headers: list,
     ...body !== void 0 ? { body: body.length > BODY_LIMIT ? body.slice(0, BODY_LIMIT) : body, bodyTruncated: body.length > BODY_LIMIT || void 0 } : {},
+    ...shape ?? {},
     secretHeaders: [...new Set(secretHeaders.map((h) => h.toLowerCase()))],
     secretQuery,
     // Only https has a certificate to skip.
@@ -78623,6 +78890,7 @@ var init_probe = __esm({
     init_oauth();
     init_script_sandbox();
     init_realtime();
+    init_file_store();
     BODY_LIMIT = 64 * 1024;
     IMAGE_LIMIT = 5 * 1024 * 1024;
     ALWAYS_SECRET = ["authorization", "proxy-authorization", "cookie", "x-api-key", "api-key", "x-amz-security-token"];
@@ -78896,9 +79164,9 @@ var init_k6_metrics = __esm({
 
 // ../../apps/engine/src/load-run.ts
 import { spawn as spawn2 } from "node:child_process";
-import { mkdtemp, readFile as readFile3, rm, writeFile as writeFile3 } from "node:fs/promises";
+import { mkdtemp, readFile as readFile3, rm, writeFile as writeFile4 } from "node:fs/promises";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join5 } from "node:path";
+import { join as join6 } from "node:path";
 function onRunFinished(listener) {
   finishedListeners.push(listener);
 }
@@ -79197,9 +79465,9 @@ async function startRun(lab, repoRoot2) {
     filled = fillLab(lab, step.vars, { builtins: false });
   }
   const id = crypto.randomUUID();
-  const dir2 = await mkdtemp(join5(tmpdir2(), "atc-run-"));
-  const scriptPath = join5(dir2, "script.js");
-  const summaryPath = join5(dir2, "summary.json");
+  const dir3 = await mkdtemp(join6(tmpdir2(), "atc-run-"));
+  const scriptPath = join6(dir3, "script.js");
+  const summaryPath = join6(dir3, "summary.json");
   let refresh = null;
   if (filled.auth.mode === "oauth2") {
     const config2 = filled.auth.oauth;
@@ -79233,17 +79501,24 @@ async function startRun(lab, repoRoot2) {
   if (bundle && process.platform !== "linux" && !filled.options.tlsSkipVerify && await needsTrustedCa(filled.request.url)) {
     filled = { ...filled, options: { ...filled.options, tlsSkipVerify: true } };
   }
-  const generated = generateK6Script(filled, { oauthRefresh: refresh, tlsAuth, jwt: jwt2 });
+  const fileBytesById = {};
+  const body = filled.request.body;
+  try {
+    for (const file2 of body.mode === "file" ? [body.file] : body.mode === "multipart" ? body.parts.flatMap((p) => p.kind === "file" ? [p.file] : []) : []) fileBytesById[file2.id] = fileBytes(file2);
+  } catch (err) {
+    throw Object.assign(err instanceof Error ? err : new Error(String(err)), { statusCode: 422 });
+  }
+  const generated = generateK6Script(filled, { oauthRefresh: refresh, tlsAuth, jwt: jwt2, fileBytes: fileBytesById });
   if (filled.options.cookies !== false && !filled.request.headers.some((h) => h.key.toLowerCase() === "cookie")) {
     const jar2 = await cookieHeader(filled.request.url);
     if (jar2) generated.env.ATC_COOKIE = jar2;
   }
   if (bundle && process.platform === "linux") {
-    await writeFile3(join5(dir2, "ca-bundle.pem"), bundle, "utf8");
-    generated.env.SSL_CERT_FILE = join5(dir2, "ca-bundle.pem");
+    await writeFile4(join6(dir3, "ca-bundle.pem"), bundle, "utf8");
+    generated.env.SSL_CERT_FILE = join6(dir3, "ca-bundle.pem");
   }
-  await writeFile3(scriptPath, generated.script, "utf8");
-  for (const [name, text] of Object.entries(generated.files)) await writeFile3(join5(dir2, name), text, "utf8");
+  await writeFile4(scriptPath, generated.script, "utf8");
+  for (const [name, content] of Object.entries(generated.files)) await writeFile4(join6(dir3, name), content);
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   const run2 = {
     id,
@@ -79251,7 +79526,7 @@ async function startRun(lab, repoRoot2) {
     status: "running",
     startedAt,
     child: null,
-    dir: dir2,
+    dir: dir3,
     summaryPath,
     aggregator: Object.assign(new LiveAggregator(Date.parse(startedAt)), { skipChallenges: lab.auth.mode === "digest" || lab.auth.mode === "ntlm" }),
     report: {
@@ -79306,7 +79581,7 @@ async function startRun(lab, repoRoot2) {
       scriptPath
     ],
     {
-      cwd: dir2,
+      cwd: dir3,
       env: { ...process.env, ...generated.env },
       windowsHide: true
     }
@@ -79385,6 +79660,7 @@ var init_load_run = __esm({
   "../../apps/engine/src/load-run.ts"() {
     "use strict";
     init_src();
+    init_file_store();
     init_k6_script();
     init_src();
     init_certificates();
@@ -79403,8 +79679,8 @@ var init_load_run = __esm({
 
 // ../../apps/engine/src/secret-store.ts
 import { createCipheriv, createDecipheriv, randomBytes as randomBytes4 } from "node:crypto";
-import { readFile as readFile4, rename as rename3, writeFile as writeFile4 } from "node:fs/promises";
-import { join as join6 } from "node:path";
+import { readFile as readFile4, rename as rename3, writeFile as writeFile5 } from "node:fs/promises";
+import { join as join7 } from "node:path";
 var SecretStore;
 var init_secret_store = __esm({
   "../../apps/engine/src/secret-store.ts"() {
@@ -79414,8 +79690,8 @@ var init_secret_store = __esm({
       loaded = false;
       key;
       file;
-      constructor(dir2, keyBase64 = process.env.ATC_SECRET_KEY) {
-        this.file = join6(dir2, "secrets.enc");
+      constructor(dir3, keyBase64 = process.env.ATC_SECRET_KEY) {
+        this.file = join7(dir3, "secrets.enc");
         const key = keyBase64 ? Buffer.from(keyBase64, "base64") : null;
         this.key = key && key.length === 32 ? key : null;
       }
@@ -79443,7 +79719,7 @@ var init_secret_store = __esm({
         const cipher = createCipheriv("aes-256-gcm", this.key, iv);
         const body = Buffer.concat([cipher.update(JSON.stringify(Object.fromEntries(this.values)), "utf8"), cipher.final()]);
         const tmp = `${this.file}.${process.pid}.tmp`;
-        await writeFile4(tmp, Buffer.concat([iv, cipher.getAuthTag(), body]));
+        await writeFile5(tmp, Buffer.concat([iv, cipher.getAuthTag(), body]));
         await rename3(tmp, this.file);
       }
       async get(id) {
@@ -79466,9 +79742,9 @@ var init_secret_store = __esm({
 });
 
 // ../../apps/engine/src/suite-run.ts
-import { randomUUID as randomUUID5 } from "node:crypto";
-import { mkdir as mkdir3, readFile as readFile5, rename as rename4, writeFile as writeFile5 } from "node:fs/promises";
-import { join as join7 } from "node:path";
+import { randomUUID as randomUUID6 } from "node:crypto";
+import { mkdir as mkdir4, readFile as readFile5, rename as rename4, writeFile as writeFile6 } from "node:fs/promises";
+import { join as join8 } from "node:path";
 async function resolveSaved(workspace, saved, vars2, envName, patch = {}) {
   const applied = applyFolders({ ...requestFromUnknown(saved.request), ...patch }, await workspace.folderChain(saved.collection));
   return resolveDraft(applied.draft, { ...applied.vars, ...vars2 }, envName);
@@ -79483,7 +79759,7 @@ async function runSuite(workspace, plans, opts, onChange = () => {
   if (!inCollection.length) throw new StepProblem(opts.collection ? `No saved requests in "${opts.collection}"` : "No saved requests outside a collection");
   const ordered = orderSuite(inCollection, await plans.get(opts.collection));
   const run2 = {
-    id: randomUUID5(),
+    id: randomUUID6(),
     collection: opts.collection,
     environment: env?.name ?? null,
     status: "running",
@@ -79674,8 +79950,8 @@ var init_suite_run = __esm({
     SuitePlans = class {
       file;
       queue = Promise.resolve();
-      constructor(dir2) {
-        this.file = join7(dir2, "suites.json");
+      constructor(dir3) {
+        this.file = join8(dir3, "suites.json");
       }
       async readAll() {
         try {
@@ -79693,9 +79969,9 @@ var init_suite_run = __esm({
         const task = async () => {
           const all = await this.readAll();
           const next2 = Object.fromEntries(Object.entries(all).map(([k, v]) => [k === from || k.startsWith(`${from}/`) ? to + k.slice(from.length) : k, v]));
-          await mkdir3(join7(this.file, ".."), { recursive: true });
+          await mkdir4(join8(this.file, ".."), { recursive: true });
           const tmp = `${this.file}.tmp`;
-          await writeFile5(tmp, `${JSON.stringify({ version: 1, collections: next2 }, null, 2)}
+          await writeFile6(tmp, `${JSON.stringify({ version: 1, collections: next2 }, null, 2)}
 `, "utf8");
           await rename4(tmp, this.file);
         };
@@ -79707,9 +79983,9 @@ var init_suite_run = __esm({
         const task = async () => {
           const all = await this.readAll();
           all[collection] = normalizeSuitePlan(plan);
-          await mkdir3(join7(this.file, ".."), { recursive: true });
+          await mkdir4(join8(this.file, ".."), { recursive: true });
           const tmp = `${this.file}.tmp`;
-          await writeFile5(tmp, `${JSON.stringify({ version: 1, collections: all }, null, 2)}
+          await writeFile6(tmp, `${JSON.stringify({ version: 1, collections: all }, null, 2)}
 `, "utf8");
           await rename4(tmp, this.file);
           return all[collection];
@@ -79733,9 +80009,9 @@ var init_suite_run = __esm({
 });
 
 // ../../apps/engine/src/workspace-store.ts
-import { randomUUID as randomUUID6 } from "node:crypto";
-import { mkdir as mkdir4, readdir as readdir2, readFile as readFile6, rename as rename5, rm as rm2, rmdir, stat as stat2, unlink as unlink2, writeFile as writeFile6 } from "node:fs/promises";
-import { dirname, join as join8, relative, sep } from "node:path";
+import { randomUUID as randomUUID7 } from "node:crypto";
+import { mkdir as mkdir5, readdir as readdir2, readFile as readFile6, rename as rename5, rm as rm2, rmdir, stat as stat2, unlink as unlink2, writeFile as writeFile7 } from "node:fs/promises";
+import { dirname, join as join9, relative, sep } from "node:path";
 function putSecret(target, field, value) {
   const dot = field.indexOf(".");
   if (dot > 0) {
@@ -79774,11 +80050,11 @@ var init_workspace_store = __esm({
       root;
       envFile;
       queue = Promise.resolve();
-      constructor(dir2, secrets2) {
-        this.dir = dir2;
+      constructor(dir3, secrets2) {
+        this.dir = dir3;
         this.secrets = secrets2;
-        this.root = join8(dir2, "requests");
-        this.envFile = join8(dir2, "environments.json");
+        this.root = join9(dir3, "requests");
+        this.envFile = join9(dir3, "environments.json");
       }
       serial(task) {
         const next = this.queue.then(task, task);
@@ -79797,7 +80073,7 @@ var init_workspace_store = __esm({
             return;
           }
           for (const e of entries) {
-            const path = join8(folder, e.name);
+            const path = join9(folder, e.name);
             if (e.isDirectory() && depth < MAX_FOLDER_DEPTH) {
               folders.push(this.pathOf(path));
               await walk(path, depth + 1);
@@ -79811,12 +80087,12 @@ var init_workspace_store = __esm({
         return (await this.scan()).files;
       }
       /** A folder on disk → its path, "Orders/Admin". */
-      pathOf(dir2) {
-        const rel = relative(this.root, dir2);
+      pathOf(dir3) {
+        const rel = relative(this.root, dir3);
         return rel && rel !== "." ? rel.split(sep).join("/") : "";
       }
       dirOf(path) {
-        return path ? join8(this.root, ...path.split("/")) : this.root;
+        return path ? join9(this.root, ...path.split("/")) : this.root;
       }
       async readRequest(path) {
         try {
@@ -79887,7 +80163,7 @@ var init_workspace_store = __esm({
         const secrets2 = [];
         const folders = new Set([...picked.values()].flatMap((f) => folderChain(f.file.collection)));
         for (const path of [...folders].sort()) {
-          const file2 = join8(this.dirOf(path), FOLDER_FILE);
+          const file2 = join9(this.dirOf(path), FOLDER_FILE);
           try {
             const text = await readFile6(file2, "utf8");
             files.push({ path: relative(this.dir, file2).split(sep).join("/"), text });
@@ -79918,7 +80194,7 @@ var init_workspace_store = __esm({
       }
       saveRequest(input) {
         return this.serial(async () => {
-          const id = input.id || randomUUID6();
+          const id = input.id || randomUUID7();
           const existing = input.id ? await this.find(input.id) : null;
           const now = (/* @__PURE__ */ new Date()).toISOString();
           const request3 = { ...input.request };
@@ -79935,10 +80211,10 @@ var init_workspace_store = __esm({
             secretFields: secretFields.length ? secretFields : void 0
           };
           const folder = this.dirOf(collection);
-          await mkdir4(folder, { recursive: true });
-          const path = join8(folder, `${safeSegment(file2.name)}_${id.slice(0, 8)}.json`);
+          await mkdir5(folder, { recursive: true });
+          const path = join9(folder, `${safeSegment(file2.name)}_${id.slice(0, 8)}.json`);
           const tmp = `${path}.${process.pid}.tmp`;
-          await writeFile6(tmp, `${JSON.stringify(file2, null, 2)}
+          await writeFile7(tmp, `${JSON.stringify(file2, null, 2)}
 `, "utf8");
           await rename5(tmp, path);
           if (existing && existing.path !== path) await unlink2(existing.path).catch(() => void 0);
@@ -79957,7 +80233,7 @@ var init_workspace_store = __esm({
       }
       async readFolder(path) {
         try {
-          const raw = JSON.parse(await readFile6(join8(this.dirOf(path), FOLDER_FILE), "utf8"));
+          const raw = JSON.parse(await readFile6(join9(this.dirOf(path), FOLDER_FILE), "utf8"));
           return { ...folderFromUnknown(raw), id: typeof raw.id === "string" ? raw.id : "", secretFields: Array.isArray(raw.secretFields) ? raw.secretFields : void 0 };
         } catch {
           return null;
@@ -79991,13 +80267,13 @@ var init_workspace_store = __esm({
         return this.serial(async () => {
           const path = folderPath(input);
           if (!path) throw Object.assign(new Error("The top level has no folder settings"), { statusCode: 400 });
-          const dir2 = this.dirOf(path);
-          await mkdir4(dir2, { recursive: true });
+          const dir3 = this.dirOf(path);
+          await mkdir5(dir3, { recursive: true });
           const settings = folderFromUnknown(raw);
           const old = await this.readFolder(path);
-          const id = old?.id || randomUUID6();
+          const id = old?.id || randomUUID7();
           await this.secrets.deletePrefix(`folder:${id}:`);
-          const file2 = join8(dir2, FOLDER_FILE);
+          const file2 = join9(dir3, FOLDER_FILE);
           if (isEmptyFolder(settings)) {
             await unlink2(file2).catch(() => void 0);
             return { path, settings };
@@ -80013,7 +80289,7 @@ var init_workspace_store = __esm({
           }
           if (secretFields.length) onDisk.secretFields = secretFields;
           const tmp = `${file2}.${process.pid}.tmp`;
-          await writeFile6(tmp, `${JSON.stringify(onDisk, null, 2)}
+          await writeFile7(tmp, `${JSON.stringify(onDisk, null, 2)}
 `, "utf8");
           await rename5(tmp, file2);
           return await this.getFolder(path);
@@ -80030,7 +80306,7 @@ var init_workspace_store = __esm({
           if (inFolder(to, from)) throw bad("A folder can't move inside itself");
           if (await stat2(this.dirOf(to)).then(() => true, () => false)) throw bad(`There is already a folder "${to}"`);
           if (!await stat2(this.dirOf(from)).then(() => true, () => false)) throw Object.assign(new Error(`No folder "${from}"`), { statusCode: 404 });
-          await mkdir4(dirname(this.dirOf(to)), { recursive: true });
+          await mkdir5(dirname(this.dirOf(to)), { recursive: true });
           await rename5(this.dirOf(from), this.dirOf(to));
           return { from, to };
         });
@@ -80085,9 +80361,9 @@ var init_workspace_store = __esm({
             }
             onDisk.push({ id: env.id, name: env.name, variables });
           }
-          await mkdir4(this.dir, { recursive: true });
+          await mkdir5(this.dir, { recursive: true });
           const tmp = `${this.envFile}.${process.pid}.tmp`;
-          await writeFile6(tmp, `${JSON.stringify(onDisk, null, 2)}
+          await writeFile7(tmp, `${JSON.stringify(onDisk, null, 2)}
 `, "utf8");
           await rename5(tmp, this.envFile);
           return this.environments();
@@ -80097,6 +80373,247 @@ var init_workspace_store = __esm({
   }
 });
 
+// ../../apps/engine/src/practice-live.ts
+import { createHash as createHash5 } from "node:crypto";
+function frame(opcode, data) {
+  const len = data.length;
+  const head = len < 126 ? Buffer.from([128 | opcode, len]) : len < 65536 ? Buffer.from([128 | opcode, 126, len >> 8, len & 255]) : Buffer.concat([Buffer.from([128 | opcode, 127]), (() => {
+    const b = Buffer.alloc(8);
+    b.writeBigUInt64BE(BigInt(len));
+    return b;
+  })()]);
+  return Buffer.concat([head, data]);
+}
+function echo(req, socket) {
+  const key = req.headers["sec-websocket-key"];
+  if (typeof key !== "string") return socket.destroy();
+  const accept = createHash5("sha1").update(key + GUID).digest("base64");
+  socket.write(`HTTP/1.1 101 Switching Protocols\r
+Upgrade: websocket\r
+Connection: Upgrade\r
+Sec-WebSocket-Accept: ${accept}\r
+\r
+`);
+  const sendText = (value) => socket.write(frame(1, Buffer.from(JSON.stringify(value))));
+  sendText({ type: "welcome", message: "Practice WebSocket: send a message and it comes back." });
+  let buf = Buffer.alloc(0);
+  socket.on("data", (chunk) => {
+    buf = Buffer.concat([buf, chunk]);
+    for (; ; ) {
+      if (buf.length < 2) return;
+      const opcode = buf[0] & 15;
+      const masked = (buf[1] & 128) !== 0;
+      let len = buf[1] & 127;
+      let at = 2;
+      if (len === 126) {
+        if (buf.length < 4) return;
+        len = buf.readUInt16BE(2);
+        at = 4;
+      } else if (len === 127) {
+        if (buf.length < 10) return;
+        len = Number(buf.readBigUInt64BE(2));
+        at = 10;
+      }
+      if (len > 1e6) return socket.destroy();
+      const mask = masked ? buf.subarray(at, at + 4) : null;
+      at += masked ? 4 : 0;
+      if (buf.length < at + len) return;
+      const payload = Buffer.from(buf.subarray(at, at + len));
+      if (mask) for (let i = 0; i < payload.length; i++) payload[i] ^= mask[i % 4];
+      buf = buf.subarray(at + len);
+      if (opcode === 8) {
+        socket.end(frame(8, payload.subarray(0, 2)));
+        return;
+      }
+      if (opcode === 9) socket.write(frame(10, payload));
+      else if (opcode === 1) {
+        const text = payload.toString("utf8");
+        let parsed = text;
+        try {
+          parsed = JSON.parse(text);
+        } catch {
+        }
+        sendText({ type: "echo", you: parsed, at: (/* @__PURE__ */ new Date()).toISOString() });
+      }
+    }
+  });
+  socket.on("error", () => socket.destroy());
+}
+function attachPracticeWebSocket(server, path) {
+  server.on("upgrade", (req, socket) => {
+    if ((req.url ?? "").split("?")[0] !== path) return;
+    echo(req, socket);
+  });
+}
+function practiceEvents(res, onGone, count = 10, everyMs = 1e3) {
+  res.writeHead(200, { "content-type": "text/event-stream", "cache-control": "no-cache", connection: "keep-alive" });
+  res.write(": practice event stream \u2014 a tick a second\n\n");
+  let n = 0;
+  const timer = setInterval(() => {
+    n++;
+    res.write(`event: tick
+id: ${n}
+data: ${JSON.stringify({ n, at: (/* @__PURE__ */ new Date()).toISOString(), price: Math.round((40 + Math.random() * 5) * 100) / 100 })}
+
+`);
+    if (n >= count) {
+      clearInterval(timer);
+      res.end();
+    }
+  }, everyMs);
+  onGone(() => clearInterval(timer));
+}
+var GUID;
+var init_practice_live = __esm({
+  "../../apps/engine/src/practice-live.ts"() {
+    "use strict";
+    GUID = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11";
+  }
+});
+
+// ../../apps/engine/src/demo-api.ts
+import { createHash as createHash6, randomBytes as randomBytes5 } from "node:crypto";
+function parseMultipart(body, boundary) {
+  const parts = [];
+  const delimiter = Buffer.from(`--${boundary}`);
+  let at = body.indexOf(delimiter);
+  while (at >= 0) {
+    const start = at + delimiter.length;
+    if (body.subarray(start, start + 2).toString() === "--") break;
+    const headEnd = body.indexOf("\r\n\r\n", start);
+    const next = body.indexOf(delimiter, start);
+    if (headEnd < 0 || next < 0) break;
+    const head = body.subarray(start, headEnd).toString("utf8");
+    const param = (key) => {
+      const m = new RegExp(`;\\s*${key}=(?:"([^"]*)"|([^;\\s]+))`, "i").exec(head);
+      return m ? m[1] ?? m[2] : void 0;
+    };
+    const name = param("name");
+    const filename = param("filename");
+    const type = /content-type:\s*([^\r\n]+)/i.exec(head)?.[1]?.trim();
+    if (name !== void 0) parts.push({ name, ...filename !== void 0 ? { filename } : {}, ...type ? { type } : {}, data: body.subarray(headEnd + 4, next - 2) });
+    at = next;
+  }
+  return parts;
+}
+function registerDemoApi(api) {
+  const tokens = /* @__PURE__ */ new Map();
+  const created = /* @__PURE__ */ new Map();
+  let nextOrder = 2001;
+  const signedIn = (auth) => {
+    const header = auth ?? "";
+    return header.startsWith("Bearer ") ? tokens.get(header.slice(7)) : void 0;
+  };
+  api.get("/products", async () => {
+    await jitter(5, 25);
+    return { items: PRODUCTS, total: PRODUCTS.length };
+  });
+  api.get("/products/:id", async (request3, reply) => {
+    await jitter(5, 20);
+    const product = PRODUCTS.find((p) => String(p.id) === request3.params.id);
+    if (!product) return reply.code(404).send({ error: `No product ${request3.params.id}. Try 1 to ${PRODUCTS.length}.` });
+    return product;
+  });
+  api.post("/login", async (request3, reply) => {
+    await jitter(30, 40);
+    const username = typeof request3.body?.username === "string" ? request3.body.username.trim() : "";
+    if (!username || request3.body?.password !== "demo") {
+      return reply.code(401).send({ error: 'Use any username with the password "demo".' });
+    }
+    if (tokens.size > 5e3) tokens.clear();
+    const token = `demo-${randomBytes5(12).toString("hex")}`;
+    tokens.set(token, username);
+    return { data: { token, user: username, expiresIn: 3600 } };
+  });
+  api.get("/orders", async (request3, reply) => {
+    await jitter(10, 30);
+    const auth = request3.headers.authorization ?? "";
+    const user = auth.startsWith("Bearer ") ? tokens.get(auth.slice(7)) : void 0;
+    if (!user) return reply.code(401).send({ error: "Sign in first: POST /login, then send the token as a Bearer token." });
+    return {
+      user,
+      orders: [
+        { id: "A-1001", items: [PRODUCTS[0].name, PRODUCTS[1].name], total: PRODUCTS[0].price + PRODUCTS[1].price },
+        { id: "A-1002", items: [PRODUCTS[3].name], total: PRODUCTS[3].price }
+      ]
+    };
+  });
+  api.post("/orders", async (request3, reply) => {
+    await jitter(15, 30);
+    const user = signedIn(request3.headers.authorization);
+    if (!user) return reply.code(401).send({ error: "Sign in first: POST /login, then send the token as a Bearer token." });
+    const product = PRODUCTS.find((p) => p.id === Number(request3.body?.productId));
+    if (!product) return reply.code(400).send({ error: `Send { "productId": 1 } \u2014 a product id from 1 to ${PRODUCTS.length}.` });
+    const quantity = Math.min(99, Math.max(1, Math.floor(Number(request3.body?.quantity ?? 1)) || 1));
+    if (created.size > 5e3) created.clear();
+    const order = { id: `A-${nextOrder++}`, user, productId: product.id, quantity, total: product.price * quantity, status: "new" };
+    created.set(order.id, order);
+    return reply.code(201).send(order);
+  });
+  api.get("/orders/:id", async (request3, reply) => {
+    await jitter(5, 20);
+    if (!signedIn(request3.headers.authorization)) return reply.code(401).send({ error: "Sign in first: POST /login, then send the token as a Bearer token." });
+    const order = created.get(request3.params.id);
+    if (!order) return reply.code(404).send({ error: `No order ${request3.params.id}. Create one with POST /orders.` });
+    return order;
+  });
+  api.get("/slow", async (request3) => {
+    const ms3 = Math.min(3e3, Math.max(0, Number(request3.query.ms ?? 300) || 0));
+    await jitter(ms3, ms3 * 0.2);
+    return { waitedMs: ms3 };
+  });
+  api.get("/flaky", async (_request, reply) => {
+    await jitter(5, 30);
+    if (Math.random() < 0.1) return reply.code(500).send({ error: "Something went wrong (on purpose, about 1 in 10)." });
+    return { ok: true };
+  });
+  api.addContentTypeParser("*", { parseAs: "buffer", bodyLimit: 20 * 1024 * 1024 }, (_req, body, done) => done(null, body));
+  api.post("/upload", { bodyLimit: 20 * 1024 * 1024 }, async (request3, reply) => {
+    await jitter(10, 20);
+    const type = String(request3.headers["content-type"] ?? "");
+    const raw = Buffer.isBuffer(request3.body) ? request3.body : Buffer.from(typeof request3.body === "string" ? request3.body : JSON.stringify(request3.body ?? ""));
+    const boundary = /^multipart\/form-data;.*boundary="?([^";]+)"?/i.exec(type)?.[1];
+    if (/^multipart\/form-data/i.test(type) && !boundary) return reply.code(400).send({ error: "A multipart/form-data body needs a boundary in its Content-Type \u2014 leave Content-Type out and the app sets it." });
+    if (!boundary) return { kind: "file", contentType: type || null, size: raw.length, sha256: sha256(raw) };
+    const parts = parseMultipart(raw, boundary);
+    if (!parts.length) return reply.code(400).send({ error: "No fields found in the form." });
+    return {
+      kind: "form",
+      fields: Object.fromEntries(parts.filter((p) => p.filename === void 0).map((p) => [p.name, p.data.toString("utf8")])),
+      files: parts.filter((p) => p.filename !== void 0).map((p) => ({ field: p.name, name: p.filename, contentType: p.type ?? null, size: p.data.length, sha256: sha256(p.data) }))
+    };
+  });
+  api.get("/events", async (request3, reply) => {
+    reply.hijack();
+    practiceEvents(reply.raw, (stop) => request3.raw.on("close", stop));
+  });
+  attachPracticeWebSocket(api.server, `${api.prefix}/ws`);
+}
+var PRODUCTS, sha256, sleep, jitter;
+var init_demo_api = __esm({
+  "../../apps/engine/src/demo-api.ts"() {
+    "use strict";
+    init_practice_live();
+    PRODUCTS = [
+      ["Desk lamp", 39],
+      ["Notebook", 6],
+      ["Coffee mug", 12],
+      ["Headphones", 129],
+      ["Backpack", 74],
+      ["Water bottle", 18],
+      ["Keyboard", 89],
+      ["Plant pot", 15],
+      ["Phone stand", 22],
+      ["Sunglasses", 58],
+      ["Umbrella", 27],
+      ["Wall clock", 34]
+    ].map(([name, price], i) => ({ id: i + 1, name, price, inStock: i % 4 !== 3 }));
+    sha256 = (data) => createHash6("sha256").update(data).digest("hex");
+    sleep = (ms3) => new Promise((r) => setTimeout(r, ms3));
+    jitter = (base, spread) => sleep(base + Math.random() * spread);
+  }
+});
+
 // ../../apps/engine/src/mock-server.ts
 import { createServer as createServer2 } from "node:http";
 var MAX_ROUTES, MockServer;
@@ -88049,7 +88566,7 @@ var require_sonic_boom = __commonJS({
       if (!(this instanceof SonicBoom)) {
         return new SonicBoom(opts);
       }
-      let { fd, dest, minLength, maxLength, maxWrite, periodicFlush, sync, append = true, mkdir: mkdir8, retryEAGAIN, fsync, contentMode, mode } = opts || {};
+      let { fd, dest, minLength, maxLength, maxWrite, periodicFlush, sync, append = true, mkdir: mkdir9, retryEAGAIN, fsync, contentMode, mode } = opts || {};
       fd = fd || dest;
       this._len = 0;
       this.fd = -1;
@@ -88074,7 +88591,7 @@ var require_sonic_boom = __commonJS({
       this.append = append || false;
       this.mode = mode;
       this.retryEAGAIN = retryEAGAIN || (() => true);
-      this.mkdir = mkdir8 || false;
+      this.mkdir = mkdir9 || false;
       let fsWriteSync;
       let fsWrite;
       if (contentMode === kContentModeBuffer) {
@@ -88786,7 +89303,7 @@ var require_thread_stream = __commonJS({
     var { version: version2 } = require_package();
     var { EventEmitter } = __require("events");
     var { Worker: Worker2 } = __require("worker_threads");
-    var { join: join13 } = __require("path");
+    var { join: join14 } = __require("path");
     var { pathToFileURL } = __require("url");
     var { wait } = require_wait();
     var {
@@ -88837,7 +89354,7 @@ var require_thread_stream = __commonJS({
     function createWorker(stream, opts) {
       const { filename, workerData } = opts;
       const bundlerOverrides = "__bundlerPathsOverrides" in globalThis ? globalThis.__bundlerPathsOverrides : {};
-      const toExecute = bundlerOverrides["thread-stream-worker"] || join13(__dirname, "lib", "worker.js");
+      const toExecute = bundlerOverrides["thread-stream-worker"] || join14(__dirname, "lib", "worker.js");
       const worker = new Worker2(toExecute, {
         ...opts.workerOpts,
         name: opts.workerOpts?.name || "thread-stream",
@@ -89303,9 +89820,9 @@ var require_transport = __commonJS({
   "../../node_modules/.pnpm/pino@10.3.1/node_modules/pino/lib/transport.js"(exports, module) {
     "use strict";
     var { createRequire } = __require("module");
-    var { existsSync: existsSync3 } = __require("node:fs");
+    var { existsSync: existsSync4 } = __require("node:fs");
     var getCallers = require_caller();
-    var { join: join13, isAbsolute, sep: sep3 } = __require("node:path");
+    var { join: join14, isAbsolute, sep: sep3 } = __require("node:path");
     var { fileURLToPath: fileURLToPath3 } = __require("node:url");
     var sleep2 = require_atomic_sleep();
     var onExit = require_on_exit_leak_free();
@@ -89377,7 +89894,7 @@ var require_transport = __commonJS({
           return false;
         }
       }
-      return isAbsolute(path) && !existsSync3(path);
+      return isAbsolute(path) && !existsSync4(path);
     }
     function stripQuotes(value) {
       const first = value[0];
@@ -89458,7 +89975,7 @@ var require_transport = __commonJS({
         throw new Error("only one of target or targets can be specified");
       }
       if (targets) {
-        target = bundlerOverrides["pino-worker"] || join13(__dirname, "worker.js");
+        target = bundlerOverrides["pino-worker"] || join14(__dirname, "worker.js");
         options.targets = targets.filter((dest) => dest.target).map((dest) => {
           return {
             ...dest,
@@ -89476,7 +89993,7 @@ var require_transport = __commonJS({
           });
         });
       } else if (pipeline) {
-        target = bundlerOverrides["pino-worker"] || join13(__dirname, "worker.js");
+        target = bundlerOverrides["pino-worker"] || join14(__dirname, "worker.js");
         options.pipelines = [pipeline.map((dest) => {
           return {
             ...dest,
@@ -89499,7 +90016,7 @@ var require_transport = __commonJS({
           return origin;
         }
         if (origin === "pino/file") {
-          return join13(__dirname, "..", "file.js");
+          return join14(__dirname, "..", "file.js");
         }
         let fixTarget2;
         for (const filePath of callers) {
@@ -90479,7 +90996,7 @@ var require_safe_stable_stringify = __commonJS({
               return circularValue;
             }
             let res = "";
-            let join13 = ",";
+            let join14 = ",";
             const originalIndentation = indentation;
             if (Array.isArray(value)) {
               if (value.length === 0) {
@@ -90493,7 +91010,7 @@ var require_safe_stable_stringify = __commonJS({
                 indentation += spacer;
                 res += `
 ${indentation}`;
-                join13 = `,
+                join14 = `,
 ${indentation}`;
               }
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
@@ -90501,13 +91018,13 @@ ${indentation}`;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyFnReplacer(String(i), value, stack, replacer, spacer, indentation);
                 res += tmp2 !== void 0 ? tmp2 : "null";
-                res += join13;
+                res += join14;
               }
               const tmp = stringifyFnReplacer(String(i), value, stack, replacer, spacer, indentation);
               res += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res += `${join13}"... ${getItemCount(removedKeys)} not stringified"`;
+                res += `${join14}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               if (spacer !== "") {
                 res += `
@@ -90528,7 +91045,7 @@ ${originalIndentation}`;
             let separator = "";
             if (spacer !== "") {
               indentation += spacer;
-              join13 = `,
+              join14 = `,
 ${indentation}`;
               whitespace = " ";
             }
@@ -90542,13 +91059,13 @@ ${indentation}`;
               const tmp = stringifyFnReplacer(key2, value, stack, replacer, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}:${whitespace}${tmp}`;
-                separator = join13;
+                separator = join14;
               }
             }
             if (keyLength > maximumBreadth) {
               const removedKeys = keyLength - maximumBreadth;
               res += `${separator}"...":${whitespace}"${getItemCount(removedKeys)} not stringified"`;
-              separator = join13;
+              separator = join14;
             }
             if (spacer !== "" && separator.length > 1) {
               res = `
@@ -90589,7 +91106,7 @@ ${originalIndentation}`;
             }
             const originalIndentation = indentation;
             let res = "";
-            let join13 = ",";
+            let join14 = ",";
             if (Array.isArray(value)) {
               if (value.length === 0) {
                 return "[]";
@@ -90602,7 +91119,7 @@ ${originalIndentation}`;
                 indentation += spacer;
                 res += `
 ${indentation}`;
-                join13 = `,
+                join14 = `,
 ${indentation}`;
               }
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
@@ -90610,13 +91127,13 @@ ${indentation}`;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyArrayReplacer(String(i), value[i], stack, replacer, spacer, indentation);
                 res += tmp2 !== void 0 ? tmp2 : "null";
-                res += join13;
+                res += join14;
               }
               const tmp = stringifyArrayReplacer(String(i), value[i], stack, replacer, spacer, indentation);
               res += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res += `${join13}"... ${getItemCount(removedKeys)} not stringified"`;
+                res += `${join14}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               if (spacer !== "") {
                 res += `
@@ -90629,7 +91146,7 @@ ${originalIndentation}`;
             let whitespace = "";
             if (spacer !== "") {
               indentation += spacer;
-              join13 = `,
+              join14 = `,
 ${indentation}`;
               whitespace = " ";
             }
@@ -90638,7 +91155,7 @@ ${indentation}`;
               const tmp = stringifyArrayReplacer(key2, value[key2], stack, replacer, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}:${whitespace}${tmp}`;
-                separator = join13;
+                separator = join14;
               }
             }
             if (spacer !== "" && separator.length > 1) {
@@ -90696,20 +91213,20 @@ ${originalIndentation}`;
               indentation += spacer;
               let res2 = `
 ${indentation}`;
-              const join14 = `,
+              const join15 = `,
 ${indentation}`;
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
               let i = 0;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyIndent(String(i), value[i], stack, spacer, indentation);
                 res2 += tmp2 !== void 0 ? tmp2 : "null";
-                res2 += join14;
+                res2 += join15;
               }
               const tmp = stringifyIndent(String(i), value[i], stack, spacer, indentation);
               res2 += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res2 += `${join14}"... ${getItemCount(removedKeys)} not stringified"`;
+                res2 += `${join15}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               res2 += `
 ${originalIndentation}`;
@@ -90725,16 +91242,16 @@ ${originalIndentation}`;
               return '"[Object]"';
             }
             indentation += spacer;
-            const join13 = `,
+            const join14 = `,
 ${indentation}`;
             let res = "";
             let separator = "";
             let maximumPropertiesToStringify = Math.min(keyLength, maximumBreadth);
             if (isTypedArrayWithEntries(value)) {
-              res += stringifyTypedArray(value, join13, maximumBreadth);
+              res += stringifyTypedArray(value, join14, maximumBreadth);
               keys = keys.slice(value.length);
               maximumPropertiesToStringify -= value.length;
-              separator = join13;
+              separator = join14;
             }
             if (deterministic) {
               keys = sort(keys, comparator);
@@ -90745,13 +91262,13 @@ ${indentation}`;
               const tmp = stringifyIndent(key2, value[key2], stack, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}: ${tmp}`;
-                separator = join13;
+                separator = join14;
               }
             }
             if (keyLength > maximumBreadth) {
               const removedKeys = keyLength - maximumBreadth;
               res += `${separator}"...": "${getItemCount(removedKeys)} not stringified"`;
-              separator = join13;
+              separator = join14;
             }
             if (separator !== "") {
               res = `
@@ -114475,7 +114992,7 @@ var require_parse_url = __commonJS({
 var require_form_data = __commonJS({
   "../../node_modules/.pnpm/light-my-request@6.6.0/node_modules/light-my-request/lib/form-data.js"(exports, module) {
     "use strict";
-    var { randomUUID: randomUUID9 } = __require("node:crypto");
+    var { randomUUID: randomUUID10 } = __require("node:crypto");
     var { Readable } = __require("node:stream");
     var textEncoder;
     function isFormDataLike(payload) {
@@ -114483,7 +115000,7 @@ var require_form_data = __commonJS({
     }
     function formDataToStream(formdata) {
       textEncoder = textEncoder ?? new TextEncoder();
-      const boundary = `----formdata-${randomUUID9()}`;
+      const boundary = `----formdata-${randomUUID10()}`;
       const prefix = `--${boundary}\r
 Content-Disposition: form-data`;
       const escape2 = (str3) => str3.replace(/\n/g, "%0A").replace(/\r/g, "%0D").replace(/"/g, "%22");
@@ -116918,7 +117435,7 @@ ${body}`);
 
 // ../../apps/engine/src/serve-ui.ts
 import { readFile as readFile7, stat as stat3 } from "node:fs/promises";
-import { extname, join as join9, normalize, resolve as resolve2, sep as sep2 } from "node:path";
+import { extname, join as join10, normalize, resolve as resolve2, sep as sep2 } from "node:path";
 async function isFile(path) {
   try {
     return (await stat3(path)).isFile();
@@ -116926,20 +117443,20 @@ async function isFile(path) {
     return false;
   }
 }
-function serveUi(app2, dir2) {
-  const root2 = resolve2(dir2);
+function serveUi(app2, dir3) {
+  const root2 = resolve2(dir3);
   app2.get("/*", async (request3, reply) => {
     const urlPath = decodeURIComponent((request3.url.split("?")[0] ?? "/").replace(/\/+$/, "") || "/");
-    const target = normalize(join9(root2, urlPath));
+    const target = normalize(join10(root2, urlPath));
     if (target !== root2 && !target.startsWith(root2 + sep2)) return reply.code(403).send("Forbidden");
-    const candidates = extname(target) ? [target] : [join9(target, "index.html"), `${target}.html`];
+    const candidates = extname(target) ? [target] : [join10(target, "index.html"), `${target}.html`];
     for (const file2 of candidates) {
       if (!await isFile(file2)) continue;
       const type = TYPES[extname(file2).toLowerCase()] ?? "application/octet-stream";
       const immutable = file2.includes(`${sep2}_next${sep2}static${sep2}`);
       return reply.header("content-type", type).header("cache-control", immutable ? "public, max-age=31536000, immutable" : "no-cache").send(await readFile7(file2));
     }
-    const notFound = join9(root2, "404.html");
+    const notFound = join10(root2, "404.html");
     return reply.code(404).header("content-type", TYPES[".html"]).send(await isFile(notFound) ? await readFile7(notFound) : "Not found");
   });
 }
@@ -117049,10 +117566,10 @@ var init_history_routes = __esm({
 });
 
 // ../../apps/engine/src/settings-routes.ts
-import { mkdir as mkdir5, readFile as readFile8, rename as rename6, writeFile as writeFile7 } from "node:fs/promises";
-import { join as join10 } from "node:path";
+import { mkdir as mkdir6, readFile as readFile8, rename as rename6, writeFile as writeFile8 } from "node:fs/promises";
+import { join as join11 } from "node:path";
 function registerSettingsRoutes(app2, dataDir) {
-  const file2 = join10(dataDir, "views.json");
+  const file2 = join11(dataDir, "views.json");
   async function read() {
     try {
       return normalizeViewsFile(JSON.parse(await readFile8(file2, "utf8")));
@@ -117064,9 +117581,9 @@ function registerSettingsRoutes(app2, dataDir) {
   app2.put("/settings/views", async (request3, reply) => {
     const next = normalizeViewsFile(request3.body);
     if (next.views.length > 100) return reply.code(400).send({ error: "At most 100 saved views" });
-    await mkdir5(dataDir, { recursive: true });
+    await mkdir6(dataDir, { recursive: true });
     const tmp = `${file2}.${process.pid}.tmp`;
-    await writeFile7(tmp, `${JSON.stringify(next, null, 2)}
+    await writeFile8(tmp, `${JSON.stringify(next, null, 2)}
 `, "utf8");
     await rename6(tmp, file2);
     return next;
@@ -117168,212 +117685,11 @@ var init_workspace_routes = __esm({
   }
 });
 
-// ../../apps/engine/src/practice-live.ts
-import { createHash as createHash5 } from "node:crypto";
-function frame(opcode, data) {
-  const len = data.length;
-  const head = len < 126 ? Buffer.from([128 | opcode, len]) : len < 65536 ? Buffer.from([128 | opcode, 126, len >> 8, len & 255]) : Buffer.concat([Buffer.from([128 | opcode, 127]), (() => {
-    const b = Buffer.alloc(8);
-    b.writeBigUInt64BE(BigInt(len));
-    return b;
-  })()]);
-  return Buffer.concat([head, data]);
-}
-function echo(req, socket) {
-  const key = req.headers["sec-websocket-key"];
-  if (typeof key !== "string") return socket.destroy();
-  const accept = createHash5("sha1").update(key + GUID).digest("base64");
-  socket.write(`HTTP/1.1 101 Switching Protocols\r
-Upgrade: websocket\r
-Connection: Upgrade\r
-Sec-WebSocket-Accept: ${accept}\r
-\r
-`);
-  const sendText = (value) => socket.write(frame(1, Buffer.from(JSON.stringify(value))));
-  sendText({ type: "welcome", message: "Practice WebSocket: send a message and it comes back." });
-  let buf = Buffer.alloc(0);
-  socket.on("data", (chunk) => {
-    buf = Buffer.concat([buf, chunk]);
-    for (; ; ) {
-      if (buf.length < 2) return;
-      const opcode = buf[0] & 15;
-      const masked = (buf[1] & 128) !== 0;
-      let len = buf[1] & 127;
-      let at = 2;
-      if (len === 126) {
-        if (buf.length < 4) return;
-        len = buf.readUInt16BE(2);
-        at = 4;
-      } else if (len === 127) {
-        if (buf.length < 10) return;
-        len = Number(buf.readBigUInt64BE(2));
-        at = 10;
-      }
-      if (len > 1e6) return socket.destroy();
-      const mask = masked ? buf.subarray(at, at + 4) : null;
-      at += masked ? 4 : 0;
-      if (buf.length < at + len) return;
-      const payload = Buffer.from(buf.subarray(at, at + len));
-      if (mask) for (let i = 0; i < payload.length; i++) payload[i] ^= mask[i % 4];
-      buf = buf.subarray(at + len);
-      if (opcode === 8) {
-        socket.end(frame(8, payload.subarray(0, 2)));
-        return;
-      }
-      if (opcode === 9) socket.write(frame(10, payload));
-      else if (opcode === 1) {
-        const text = payload.toString("utf8");
-        let parsed = text;
-        try {
-          parsed = JSON.parse(text);
-        } catch {
-        }
-        sendText({ type: "echo", you: parsed, at: (/* @__PURE__ */ new Date()).toISOString() });
-      }
-    }
-  });
-  socket.on("error", () => socket.destroy());
-}
-function attachPracticeWebSocket(server, path) {
-  server.on("upgrade", (req, socket) => {
-    if ((req.url ?? "").split("?")[0] !== path) return;
-    echo(req, socket);
-  });
-}
-function practiceEvents(res, onGone, count = 10, everyMs = 1e3) {
-  res.writeHead(200, { "content-type": "text/event-stream", "cache-control": "no-cache", connection: "keep-alive" });
-  res.write(": practice event stream \u2014 a tick a second\n\n");
-  let n = 0;
-  const timer = setInterval(() => {
-    n++;
-    res.write(`event: tick
-id: ${n}
-data: ${JSON.stringify({ n, at: (/* @__PURE__ */ new Date()).toISOString(), price: Math.round((40 + Math.random() * 5) * 100) / 100 })}
-
-`);
-    if (n >= count) {
-      clearInterval(timer);
-      res.end();
-    }
-  }, everyMs);
-  onGone(() => clearInterval(timer));
-}
-var GUID;
-var init_practice_live = __esm({
-  "../../apps/engine/src/practice-live.ts"() {
-    "use strict";
-    GUID = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11";
-  }
-});
-
-// ../../apps/engine/src/demo-api.ts
-import { randomBytes as randomBytes5 } from "node:crypto";
-function registerDemoApi(api) {
-  const tokens = /* @__PURE__ */ new Map();
-  const created = /* @__PURE__ */ new Map();
-  let nextOrder = 2001;
-  const signedIn = (auth) => {
-    const header = auth ?? "";
-    return header.startsWith("Bearer ") ? tokens.get(header.slice(7)) : void 0;
-  };
-  api.get("/products", async () => {
-    await jitter(5, 25);
-    return { items: PRODUCTS, total: PRODUCTS.length };
-  });
-  api.get("/products/:id", async (request3, reply) => {
-    await jitter(5, 20);
-    const product = PRODUCTS.find((p) => String(p.id) === request3.params.id);
-    if (!product) return reply.code(404).send({ error: `No product ${request3.params.id}. Try 1 to ${PRODUCTS.length}.` });
-    return product;
-  });
-  api.post("/login", async (request3, reply) => {
-    await jitter(30, 40);
-    const username = typeof request3.body?.username === "string" ? request3.body.username.trim() : "";
-    if (!username || request3.body?.password !== "demo") {
-      return reply.code(401).send({ error: 'Use any username with the password "demo".' });
-    }
-    if (tokens.size > 5e3) tokens.clear();
-    const token = `demo-${randomBytes5(12).toString("hex")}`;
-    tokens.set(token, username);
-    return { data: { token, user: username, expiresIn: 3600 } };
-  });
-  api.get("/orders", async (request3, reply) => {
-    await jitter(10, 30);
-    const auth = request3.headers.authorization ?? "";
-    const user = auth.startsWith("Bearer ") ? tokens.get(auth.slice(7)) : void 0;
-    if (!user) return reply.code(401).send({ error: "Sign in first: POST /login, then send the token as a Bearer token." });
-    return {
-      user,
-      orders: [
-        { id: "A-1001", items: [PRODUCTS[0].name, PRODUCTS[1].name], total: PRODUCTS[0].price + PRODUCTS[1].price },
-        { id: "A-1002", items: [PRODUCTS[3].name], total: PRODUCTS[3].price }
-      ]
-    };
-  });
-  api.post("/orders", async (request3, reply) => {
-    await jitter(15, 30);
-    const user = signedIn(request3.headers.authorization);
-    if (!user) return reply.code(401).send({ error: "Sign in first: POST /login, then send the token as a Bearer token." });
-    const product = PRODUCTS.find((p) => p.id === Number(request3.body?.productId));
-    if (!product) return reply.code(400).send({ error: `Send { "productId": 1 } \u2014 a product id from 1 to ${PRODUCTS.length}.` });
-    const quantity = Math.min(99, Math.max(1, Math.floor(Number(request3.body?.quantity ?? 1)) || 1));
-    if (created.size > 5e3) created.clear();
-    const order = { id: `A-${nextOrder++}`, user, productId: product.id, quantity, total: product.price * quantity, status: "new" };
-    created.set(order.id, order);
-    return reply.code(201).send(order);
-  });
-  api.get("/orders/:id", async (request3, reply) => {
-    await jitter(5, 20);
-    if (!signedIn(request3.headers.authorization)) return reply.code(401).send({ error: "Sign in first: POST /login, then send the token as a Bearer token." });
-    const order = created.get(request3.params.id);
-    if (!order) return reply.code(404).send({ error: `No order ${request3.params.id}. Create one with POST /orders.` });
-    return order;
-  });
-  api.get("/slow", async (request3) => {
-    const ms3 = Math.min(3e3, Math.max(0, Number(request3.query.ms ?? 300) || 0));
-    await jitter(ms3, ms3 * 0.2);
-    return { waitedMs: ms3 };
-  });
-  api.get("/flaky", async (_request, reply) => {
-    await jitter(5, 30);
-    if (Math.random() < 0.1) return reply.code(500).send({ error: "Something went wrong (on purpose, about 1 in 10)." });
-    return { ok: true };
-  });
-  api.get("/events", async (request3, reply) => {
-    reply.hijack();
-    practiceEvents(reply.raw, (stop) => request3.raw.on("close", stop));
-  });
-  attachPracticeWebSocket(api.server, `${api.prefix}/ws`);
-}
-var PRODUCTS, sleep, jitter;
-var init_demo_api = __esm({
-  "../../apps/engine/src/demo-api.ts"() {
-    "use strict";
-    init_practice_live();
-    PRODUCTS = [
-      ["Desk lamp", 39],
-      ["Notebook", 6],
-      ["Coffee mug", 12],
-      ["Headphones", 129],
-      ["Backpack", 74],
-      ["Water bottle", 18],
-      ["Keyboard", 89],
-      ["Plant pot", 15],
-      ["Phone stand", 22],
-      ["Sunglasses", 58],
-      ["Umbrella", 27],
-      ["Wall clock", 34]
-    ].map(([name, price], i) => ({ id: i + 1, name, price, inStock: i % 4 !== 3 }));
-    sleep = (ms3) => new Promise((r) => setTimeout(r, ms3));
-    jitter = (base, spread) => sleep(base + Math.random() * spread);
-  }
-});
-
 // ../../apps/engine/src/usage.ts
-import { randomUUID as randomUUID7 } from "node:crypto";
-import { mkdir as mkdir6, readFile as readFile9, rename as rename7, writeFile as writeFile8 } from "node:fs/promises";
+import { randomUUID as randomUUID8 } from "node:crypto";
+import { mkdir as mkdir7, readFile as readFile9, rename as rename7, writeFile as writeFile9 } from "node:fs/promises";
 import { arch, platform } from "node:os";
-import { join as join11 } from "node:path";
+import { join as join12 } from "node:path";
 var EMPTY, KEEP_DAYS, UsageStats;
 var init_usage = __esm({
   "../../apps/engine/src/usage.ts"() {
@@ -117385,8 +117701,8 @@ var init_usage = __esm({
       opts;
       state = null;
       writing = Promise.resolve();
-      constructor(dir2, opts) {
-        this.file = join11(dir2, "usage.json");
+      constructor(dir3, opts) {
+        this.file = join12(dir3, "usage.json");
         this.opts = opts;
       }
       async load() {
@@ -117395,20 +117711,20 @@ var init_usage = __esm({
           const raw = JSON.parse(await readFile9(this.file, "utf8"));
           this.state = {
             enabled: typeof raw.enabled === "boolean" ? raw.enabled : null,
-            installId: typeof raw.installId === "string" && raw.installId ? raw.installId : randomUUID7(),
+            installId: typeof raw.installId === "string" && raw.installId ? raw.installId : randomUUID8(),
             days: raw.days && typeof raw.days === "object" ? raw.days : {}
           };
         } catch {
-          this.state = { enabled: null, installId: randomUUID7(), days: {} };
+          this.state = { enabled: null, installId: randomUUID8(), days: {} };
         }
         return this.state;
       }
       save() {
         this.writing = this.writing.then(async () => {
           if (!this.state) return;
-          await mkdir6(join11(this.file, ".."), { recursive: true });
+          await mkdir7(join12(this.file, ".."), { recursive: true });
           const tmp = `${this.file}.${process.pid}.tmp`;
-          await writeFile8(tmp, `${JSON.stringify(this.state, null, 2)}
+          await writeFile9(tmp, `${JSON.stringify(this.state, null, 2)}
 `, "utf8");
           await rename7(tmp, this.file);
         }).catch(() => void 0);
@@ -117448,7 +117764,7 @@ var init_usage = __esm({
         const s = await this.load();
         s.enabled = enabled;
         if (!enabled) {
-          s.installId = randomUUID7();
+          s.installId = randomUUID8();
           s.days = {};
         }
         await this.save();
@@ -117632,8 +117948,8 @@ var init_local_servers = __esm({
 });
 
 // ../../apps/engine/src/response-history.ts
-import { mkdir as mkdir7, readFile as readFile10, rm as rm3, writeFile as writeFile9 } from "node:fs/promises";
-import { join as join12 } from "node:path";
+import { mkdir as mkdir8, readFile as readFile10, rm as rm3, writeFile as writeFile10 } from "node:fs/promises";
+import { join as join13 } from "node:path";
 function maskSecrets(body) {
   const t = body.trim();
   if (!(t.startsWith("{") || t.startsWith("["))) return { body, masked: false };
@@ -117671,11 +117987,11 @@ var init_response_history = __esm({
       dir;
       queue = Promise.resolve();
       constructor(dataDir) {
-        this.dir = join12(dataDir, "responses");
+        this.dir = join13(dataDir, "responses");
       }
       file(id) {
         if (!/^[\w-]{8,64}$/.test(id)) throw new Error("bad request id");
-        return join12(this.dir, `${id}.json`);
+        return join13(this.dir, `${id}.json`);
       }
       async read(id) {
         try {
@@ -117703,8 +118019,8 @@ var init_response_history = __esm({
             ...masked ? { masked } : {}
           };
           const answers2 = [answer, ...await this.read(id)].slice(0, KEEP);
-          await mkdir7(this.dir, { recursive: true });
-          await writeFile9(this.file(id), JSON.stringify({ version: 1, answers: answers2 }, null, 1), "utf8");
+          await mkdir8(this.dir, { recursive: true });
+          await writeFile10(this.file(id), JSON.stringify({ version: 1, answers: answers2 }, null, 1), "utf8");
         });
         this.queue = next.catch(() => void 0);
         return next;
@@ -117826,6 +118142,8 @@ async function routes(api) {
   useOAuthStore(secrets2);
   registerOAuthRoutes(api);
   useCertificateStore(history.dir, secrets2);
+  useFileStore(history.dir);
+  await api.register(async (scope) => registerFileRoutes(scope));
   useCookieStore(secrets2);
   registerCookieRoutes(api);
   registerCertificateRoutes(api);
@@ -117941,6 +118259,7 @@ var init_index = __esm({
     init_suite_run();
     init_oauth();
     init_certificates();
+    init_file_store();
     init_cookies();
     init_local_servers();
     init_mock_server();
@@ -117998,9 +118317,9 @@ init_history_store();
 init_k6();
 import { spawn as spawn3, spawnSync } from "node:child_process";
 import { tmpdir as tmpdir3 } from "node:os";
-import { randomUUID as randomUUID8 } from "node:crypto";
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, readdirSync as readdirSync2, writeFileSync as writeFileSync2 } from "node:fs";
-import { readFile as readFile11, writeFile as writeFile10 } from "node:fs/promises";
+import { randomUUID as randomUUID9 } from "node:crypto";
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readdirSync as readdirSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { readFile as readFile11, writeFile as writeFile11 } from "node:fs/promises";
 import { dirname as dirname3, resolve as resolve4 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { parseArgs } from "node:util";
@@ -118051,9 +118370,9 @@ async function downloadK6(log = () => {
     const tar = process.platform === "win32" && existsSync(systemTar) ? systemTar : "tar";
     execFileSync(tar, ["-xf", asset], { cwd: work, stdio: "ignore" });
     const exe = process.platform === "win32" ? "k6.exe" : "k6";
-    const find = (dir3) => {
-      for (const name of readdirSync(dir3)) {
-        const p = join3(dir3, name);
+    const find = (dir4) => {
+      for (const name of readdirSync(dir4)) {
+        const p = join3(dir4, name);
         if (statSync(p).isDirectory()) {
           const hit = find(p);
           if (hit) return hit;
@@ -118063,9 +118382,9 @@ async function downloadK6(log = () => {
     };
     const found = find(work);
     if (!found) throw new Error(`${exe} was not in ${asset}`);
-    const dir2 = k6CacheDir();
-    mkdirSync(dir2, { recursive: true });
-    const dest = join3(dir2, exe);
+    const dir3 = k6CacheDir();
+    mkdirSync(dir3, { recursive: true });
+    const dest = join3(dir3, exe);
     copyFileSync(found, dest);
     if (process.platform !== "win32") chmodSync(dest, 493);
     log(`k6 saved to ${dest}`);
@@ -118082,8 +118401,10 @@ init_secret_store();
 init_suite_run();
 init_oauth();
 init_certificates();
+init_file_store();
 init_cookies();
 init_workspace_store();
+init_demo_api();
 init_mock_server();
 
 // ../../apps/engine/src/mcp.ts
@@ -118442,7 +118763,7 @@ async function serveMcp(o) {
 // ../../apps/engine/src/cli.ts
 var repoRoot = resolve4(dirname3(fileURLToPath2(import.meta.url)), "../../..");
 var EXIT = { passed: 0, failed: 1, error: 2 };
-var VERSION = "0.12.0";
+var VERSION = "0.13.0";
 var HELP = `APITestCenter CLI ${VERSION} \u2014 https://apitestcenter.com/docs/cli-and-ci.html
 
 Usage (apitestcenter, or the short name atc once installed)
@@ -118550,7 +118871,7 @@ async function main() {
     process.exit(values.help ? EXIT.passed : EXIT.error);
   }
   if (values.data && command !== "init") {
-    if (!existsSync2(values.data)) fail(`no folder "${values.data}"`);
+    if (!existsSync3(values.data)) fail(`no folder "${values.data}"`);
     process.env.ATC_DATA_DIR = resolve4(values.data);
   }
   if (command === "init") return init(target, values.data ?? "api-tests");
@@ -118560,6 +118881,7 @@ async function main() {
   const workspace = new WorkspaceStore(dataDir, secrets2);
   useOAuthStore(secrets2);
   useCertificateStore(dataDir, secrets2);
+  useFileStore(dataDir);
   useCookieStore(secrets2);
   for (const spec of values.cert ?? []) {
     const eq = spec.indexOf("=");
@@ -118604,7 +118926,7 @@ Environments (${index.environments.length})`);
   let raw;
   let name;
   let collection = "";
-  if (existsSync2(target) && target.toLowerCase().endsWith(".json")) {
+  if (existsSync3(target) && target.toLowerCase().endsWith(".json")) {
     const file2 = JSON.parse(await readFile11(target, "utf8"));
     raw = file2.request ?? file2;
     name = file2.name ?? target;
@@ -118621,7 +118943,7 @@ Environments (${index.environments.length})`);
   }
   const env = values.env ? index.environments.find((e) => e.name === values.env || e.id === values.env) : void 0;
   if (values.env && !env) fail(`no environment "${values.env}". Run "atc list".`);
-  const vars2 = variablesOf(env);
+  const vars2 = { ...JSON.stringify(raw).includes("{{practice") ? await practiceVars() : {}, ...variablesOf(env) };
   for (const pair of values.var ?? []) {
     const i = pair.indexOf("=");
     if (i < 1) fail(`--var needs key=value, got "${pair}"`);
@@ -118742,12 +119064,12 @@ compared with baseline \u201C${baseline.testName}\u201D (${baseline.startedAt.sl
     console.log(`  ${compared.headline}`);
     console.log(`  ${gate.failed ? "\u2715" : "\u2713"} ${gate.reason}`);
   }
-  if (values.json) await writeFile10(values.json, exportRunJson(report), "utf8");
-  if (values.html) await writeFile10(values.html, exportRunHtml(report, { slo, before: baseline }), "utf8");
+  if (values.json) await writeFile11(values.json, exportRunJson(report), "utf8");
+  if (values.html) await writeFile11(values.html, exportRunHtml(report, { slo, before: baseline }), "utf8");
   const extra2 = gate ? [{ classname: "baseline", name: `no slower than the baseline by more than ${Math.round(maxSlower * 100)}%`, failure: gate.failed ? gate.reason : void 0 }] : [];
-  if (values.junit) await writeFile10(values.junit, exportRunJunit(report, verdict, targets?.checksRate ?? 0.99, extra2), "utf8");
+  if (values.junit) await writeFile11(values.junit, exportRunJunit(report, verdict, targets?.checksRate ?? 0.99, extra2), "utf8");
   if (values["save-baseline"]) {
-    await writeFile10(values["save-baseline"], exportRunJson(report), "utf8");
+    await writeFile11(values["save-baseline"], exportRunJson(report), "utf8");
     log(`  saved this run as a baseline \u2192 ${values["save-baseline"]}`);
   }
   for (const [flag, file2] of [["json", values.json], ["html", values.html], ["junit", values.junit]]) if (file2) log(`  wrote ${flag} \u2192 ${file2}`);
@@ -118756,7 +119078,7 @@ compared with baseline \u201C${baseline.testName}\u201D (${baseline.startedAt.sl
 }
 async function ui(collection, dataDir, noOpen, inBrowserTab = false) {
   const here = dirname3(fileURLToPath2(import.meta.url));
-  const uiDir2 = [process.env.ATC_UI_DIR, resolve4(here, "ui"), resolve4(repoRoot, "apps/web/.next-desktop")].find((d) => Boolean(d) && existsSync2(resolve4(d, "index.html")));
+  const uiDir2 = [process.env.ATC_UI_DIR, resolve4(here, "ui"), resolve4(repoRoot, "apps/web/.next-desktop")].find((d) => Boolean(d) && existsSync3(resolve4(d, "index.html")));
   if (!uiDir2) fail("this build has no app screens. Use the npm package (npx apitestcenter ui), or run: pnpm --filter @apitestcenter/desktop build:ui");
   Object.assign(process.env, {
     ATC_UI_DIR: uiDir2,
@@ -118812,7 +119134,7 @@ function findAppBrowser() {
   const candidates = process.platform === "win32" ? [env["ProgramFiles(x86)"], env.ProgramFiles, env.LOCALAPPDATA].flatMap(
     (root2) => root2 ? [`${root2}\\Microsoft\\Edge\\Application\\msedge.exe`, `${root2}\\Google\\Chrome\\Application\\chrome.exe`, `${root2}\\BraveSoftware\\Brave-Browser\\Application\\brave.exe`] : []
   ) : process.platform === "darwin" ? ["/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge", "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome", "/Applications/Chromium.app/Contents/MacOS/Chromium", "/Applications/Brave Browser.app/Contents/MacOS/Brave Browser"] : ["/usr/bin/microsoft-edge", "/usr/bin/google-chrome", "/usr/bin/google-chrome-stable", "/usr/bin/chromium", "/usr/bin/chromium-browser", "/usr/bin/brave-browser", "/snap/bin/chromium"];
-  return candidates.find((p) => existsSync2(p)) ?? null;
+  return candidates.find((p) => existsSync3(p)) ?? null;
 }
 function openAppWindow(url2) {
   const bin = findAppBrowser();
@@ -118844,24 +119166,24 @@ function openBrowser(url2) {
 }
 async function init(collection, folder) {
   const name = collection?.trim() || "My API";
-  const dir2 = resolve4(folder);
-  if (existsSync2(resolve4(dir2, "requests")) && readdirSync2(resolve4(dir2, "requests")).length) {
+  const dir3 = resolve4(folder);
+  if (existsSync3(resolve4(dir3, "requests")) && readdirSync2(resolve4(dir3, "requests")).length) {
     fail(`${folder} already has saved requests. Open them with: npx apitestcenter ui --data ${folder}`);
   }
-  mkdirSync2(dir2, { recursive: true });
-  const store3 = new WorkspaceStore(dir2, new SecretStore(dir2));
-  await store3.saveEnvironments([{ id: randomUUID8(), name: "Local", variables: [{ key: "baseUrl", value: "http://localhost:3000", secret: false }] }]);
+  mkdirSync2(dir3, { recursive: true });
+  const store3 = new WorkspaceStore(dir3, new SecretStore(dir3));
+  await store3.saveEnvironments([{ id: randomUUID9(), name: "Local", variables: [{ key: "baseUrl", value: "http://localhost:3000", secret: false }] }]);
   await store3.saveRequest({
     name: "Health check",
     collection: name,
     request: { method: "GET", url: "{{baseUrl}}/health", checks: [{ type: "status", expect: "2xx" }] }
   });
   const data = folder.replace(/\\/g, "/").replace(/\/+$/, "");
-  writeFileSync2(resolve4(dir2, "README.md"), ciReadme({ collection: name, environment: "Local", data }));
-  const ignore = resolve4(dir2, ".gitignore");
-  if (!existsSync2(ignore)) writeFileSync2(ignore, ["# Kept by APITestCenter on this computer \u2014 not tests, so not in git", "responses/", "runs/", "compares/", "usage.json", "secrets.enc", ""].join("\n"));
+  writeFileSync2(resolve4(dir3, "README.md"), ciReadme({ collection: name, environment: "Local", data }));
+  const ignore = resolve4(dir3, ".gitignore");
+  if (!existsSync3(ignore)) writeFileSync2(ignore, ["# Kept by APITestCenter on this computer \u2014 not tests, so not in git", "responses/", "runs/", "compares/", "usage.json", "secrets.enc", ""].join("\n"));
   const workflow = resolve4(".github/workflows/api-checks.yml");
-  const wroteWorkflow = !existsSync2(workflow);
+  const wroteWorkflow = !existsSync3(workflow);
   if (wroteWorkflow) {
     mkdirSync2(dirname3(workflow), { recursive: true });
     writeFileSync2(workflow, ciWorkflow({ collection: name, environment: "Local", data }));
@@ -118877,6 +119199,8 @@ async function init(collection, folder) {
 async function suite(collection, values, workspace, dataDir) {
   if (collection === void 0) fail('suite needs a collection name, or "" for requests outside any collection. Run "atc list".');
   const vars2 = {};
+  const inside = (await workspace.index()).requests.filter((r) => collection === "" ? r.collection === "" : r.collection === collection || r.collection.startsWith(`${collection}/`));
+  if (inside.some((r) => r.url.includes("{{practice"))) Object.assign(vars2, await practiceVars());
   for (const pair of values.var ?? []) {
     const i = pair.indexOf("=");
     if (i < 1) fail(`--var needs key=value, got "${pair}"`);
@@ -118913,12 +119237,22 @@ async function suite(collection, values, workspace, dataDir) {
   const ok = suitePassed(run2);
   console.log(`
 ${ok ? "PASS" : "FAIL"}  ${suiteHeadline(run2)}`);
-  if (values.json) await writeFile10(values.json, exportSuiteJson(run2), "utf8");
-  if (values.html) await writeFile10(values.html, exportSuiteHtml(run2), "utf8");
-  if (values.junit) await writeFile10(values.junit, exportSuiteJunit(run2), "utf8");
+  if (values.json) await writeFile11(values.json, exportSuiteJson(run2), "utf8");
+  if (values.html) await writeFile11(values.html, exportSuiteHtml(run2), "utf8");
+  if (values.junit) await writeFile11(values.junit, exportSuiteJunit(run2), "utf8");
   for (const [flag, file2] of [["json", values.json], ["html", values.html], ["junit", values.junit]]) if (file2) log(`  wrote ${flag} \u2192 ${file2}`);
   return ok ? EXIT.passed : EXIT.failed;
 }
+async function practiceVars() {
+  const { default: Fastify2 } = await Promise.resolve().then(() => __toESM(require_fastify(), 1));
+  const app2 = Fastify2({ logger: false });
+  await app2.register(async (demo) => registerDemoApi(demo), { prefix: "/demo-api" });
+  await app2.listen({ host: "127.0.0.1", port: 0 });
+  app2.server.unref();
+  const address = app2.server.address();
+  const port2 = typeof address === "object" && address ? address.port : 0;
+  return { practiceApi: `http://127.0.0.1:${port2}/demo-api`, practiceWs: `ws://127.0.0.1:${port2}/demo-api` };
+}
 async function mock(collection, portText, workspace) {
   if (collection === void 0) fail('say which collection to mock, e.g. atc mock "Orders API" (or "" for all requests)');
   const port2 = portText === void 0 ? 4010 : Number(portText);