apitestcenter 0.7.0 → 0.9.0

package/dist/cli.mjs

@@ -804,14 +804,41 @@ function safeSegment(text, fallback = "untitled") {
   return s || fallback;
 }
 function defaultOAuth() {
-  return { grant: "client_credentials", tokenUrl: "", authUrl: "", redirectUri: DEFAULT_REDIRECT_URI, clientId: "", clientSecret: "", scope: "", username: "", password: "", clientAuth: "basic", pkce: true, extra: [] };
+  return {
+    grant: "client_credentials",
+    tokenUrl: "",
+    authUrl: "",
+    redirectUri: DEFAULT_REDIRECT_URI,
+    clientId: "",
+    clientSecret: "",
+    scope: "",
+    username: "",
+    password: "",
+    clientAuth: "basic",
+    pkce: true,
+    extra: [],
+    privateKey: "",
+    assertionAlgorithm: "RS256",
+    issuer: "",
+    subject: "",
+    audience: "",
+    kid: "",
+    certificate: "",
+    extraClaims: "",
+    samlSource: "idp",
+    idpUrl: "",
+    userId: "",
+    companyId: "",
+    assertion: ""
+  };
 }
 function oauthFromUnknown(value) {
   const base = defaultOAuth();
   if (!value || typeof value !== "object") return base;
   const v = value;
   const s = (x, d) => typeof x === "string" ? x : d;
-  const grants = ["client_credentials", "password", "authorization_code"];
+  const grants = ["client_credentials", "password", "authorization_code", "jwt_bearer", "saml_bearer"];
+  const algs = ["RS256", "RS384", "RS512", "PS256", "ES256", "ES384"];
   return {
     grant: grants.includes(v.grant) ? v.grant : base.grant,
     tokenUrl: s(v.tokenUrl, ""),
@@ -822,8 +849,21 @@ function oauthFromUnknown(value) {
     scope: s(v.scope, ""),
     username: s(v.username, ""),
     password: s(v.password, ""),
-    clientAuth: v.clientAuth === "body" ? "body" : "basic",
+    clientAuth: v.clientAuth === "body" ? "body" : v.clientAuth === "private_key_jwt" ? "private_key_jwt" : "basic",
     pkce: v.pkce !== false,
+    privateKey: s(v.privateKey, ""),
+    assertionAlgorithm: algs.includes(v.assertionAlgorithm) ? v.assertionAlgorithm : "RS256",
+    issuer: s(v.issuer, ""),
+    subject: s(v.subject, ""),
+    audience: s(v.audience, ""),
+    kid: s(v.kid, ""),
+    certificate: s(v.certificate, ""),
+    extraClaims: s(v.extraClaims, ""),
+    samlSource: v.samlSource === "assertion" ? "assertion" : "idp",
+    idpUrl: s(v.idpUrl, ""),
+    userId: s(v.userId, ""),
+    companyId: s(v.companyId, ""),
+    assertion: s(v.assertion, ""),
     extra: (Array.isArray(v.extra) ? v.extra : []).flatMap((e) => e && typeof e.key === "string" ? [{ key: e.key, value: s(e.value, "") }] : [])
   };
 }
@@ -858,9 +898,28 @@ function jwtFromUnknown(value) {
     prefix: s(v.prefix, base.prefix)
   };
 }
+function defaultOAuth1() {
+  return { consumerKey: "", consumerSecret: "", token: "", tokenSecret: "", signatureMethod: "HMAC-SHA256", realm: "", addTo: "header" };
+}
+function oauth1FromUnknown(value) {
+  const base = defaultOAuth1();
+  if (!value || typeof value !== "object") return base;
+  const v = value;
+  const s = (x, d) => typeof x === "string" ? x : d;
+  const methods = ["HMAC-SHA256", "HMAC-SHA1", "PLAINTEXT"];
+  return {
+    consumerKey: s(v.consumerKey, ""),
+    consumerSecret: s(v.consumerSecret, ""),
+    token: s(v.token, ""),
+    tokenSecret: s(v.tokenSecret, ""),
+    signatureMethod: methods.includes(v.signatureMethod) ? v.signatureMethod : base.signatureMethod,
+    realm: s(v.realm, ""),
+    addTo: v.addTo === "query" ? "query" : "header"
+  };
+}
 function emptyFolderSettings() {
   return {
-    auth: { authMode: "inherit", oauth: defaultOAuth(), aws: defaultAws(), jwt: defaultJwt(), domain: "", token: "", username: "", password: "", apiName: "X-API-Key", apiValue: "", apiIn: "header" },
+    auth: { authMode: "inherit", oauth: defaultOAuth(), oauth1: defaultOAuth1(), aws: defaultAws(), jwt: defaultJwt(), domain: "", token: "", username: "", password: "", apiName: "X-API-Key", apiValue: "", apiIn: "header" },
     headers: [],
     variables: []
   };
@@ -871,7 +930,7 @@ function folderFromUnknown(value) {
   const v = value;
   const a = v.auth ?? {};
   const s = (x, d) => typeof x === "string" ? x : d;
-  const modes = ["inherit", "none", "bearer", "basic", "api_key", "oauth2", "digest", "ntlm", "aws_sigv4", "jwt"];
+  const modes = ["inherit", "none", "bearer", "basic", "api_key", "oauth2", "digest", "ntlm", "aws_sigv4", "jwt", "oauth1"];
   const authMode2 = modes.includes(a.authMode) ? a.authMode : "inherit";
   const headers = (Array.isArray(v.headers) ? v.headers : []).flatMap(
     (h) => h && typeof h.key === "string" ? [{ key: h.key, value: s(h.value, "") }] : []
@@ -881,6 +940,7 @@ function folderFromUnknown(value) {
     auth: {
       authMode: authMode2,
       oauth: oauthFromUnknown(a.oauth),
+      oauth1: oauth1FromUnknown(a.oauth1),
       aws: awsFromUnknown(a.aws),
       jwt: jwtFromUnknown(a.jwt),
       domain: s(a.domain, ""),
@@ -917,7 +977,7 @@ var init_workspace = __esm({
     FOLDER_FILE = "_folder.json";
     MAX_FOLDER_DEPTH = 6;
     DEFAULT_REDIRECT_URI = "http://127.0.0.1:53682/callback";
-    NESTED_SECRET_FIELDS = { oauth: ["clientSecret", "password"], aws: ["secretAccessKey", "sessionToken"], jwt: ["secret", "privateKey"] };
+    NESTED_SECRET_FIELDS = { oauth: ["clientSecret", "password", "privateKey", "assertion"], aws: ["secretAccessKey", "sessionToken"], jwt: ["secret", "privateKey"], oauth1: ["consumerSecret", "tokenSecret"] };
   }
 });
 
@@ -16010,7 +16070,7 @@ function checkLabel(check2) {
     case "body":
       return `body ${check2.op === "contains" ? "contains" : "does not contain"} "${clip(check2.value)}"`;
     case "json":
-      return check2.op === "exists" ? `${jsonPathLabel(check2.path)} exists` : `${jsonPathLabel(check2.path)} ${check2.op === "equals" ? "=" : check2.op === "not_equals" ? "\u2260" : "contains"} "${clip(check2.value)}"`;
+      return check2.op === "exists" || check2.op === "not_exists" ? `${jsonPathLabel(check2.path)} ${check2.op === "exists" ? "exists" : "does not exist"}` : `${jsonPathLabel(check2.path)} ${check2.op === "equals" ? "=" : check2.op === "not_equals" ? "\u2260" : "contains"} "${clip(check2.value)}"`;
     case "header":
       return check2.op === "exists" ? `header ${check2.name} exists` : `header ${check2.name} ${check2.op === "equals" ? "=" : "contains"} "${clip(check2.value)}"`;
     case "time":
@@ -16055,7 +16115,7 @@ var init_checks3 = __esm({
       external_exports.object({
         type: external_exports.literal("json"),
         path: external_exports.string().min(1).max(300),
-        op: external_exports.enum(["exists", "equals", "not_equals", "contains"]),
+        op: external_exports.enum(["exists", "not_exists", "equals", "not_equals", "contains"]),
         value: external_exports.string().max(2e3).default("")
       }).strict(),
       external_exports.object({
@@ -16118,6 +16178,7 @@ function __atcCheck(check, res) {
     try { parsed = JSON.parse(res.body); } catch (e) { return false; }
     var got = __atcJsonGet(parsed, check.path);
     if (check.op === "exists") return got.found;
+    if (check.op === "not_exists") return !got.found;
     if (!got.found) return check.op === "not_equals";
     var text = __atcAsText(got.value);
     if (check.op === "equals") return text === check.value;
@@ -16307,18 +16368,18 @@ var init_definition = __esm({
       thinkTimeMs: external_exports.number().min(0).default(0),
       thinkJitterMs: external_exports.number().min(0).default(0),
       gracefulStop: durationSchema.default("10s")
-    }).strict().superRefine((load2, ctx) => {
-      if ((load2.executor === "ramping-vus" || load2.executor === "ramping-arrival-rate") && load2.stages.length === 0) {
+    }).strict().superRefine((load3, ctx) => {
+      if ((load3.executor === "ramping-vus" || load3.executor === "ramping-arrival-rate") && load3.stages.length === 0) {
         ctx.addIssue({
           code: external_exports.ZodIssueCode.custom,
-          message: `${load2.executor} requires at least one stage`,
+          message: `${load3.executor} requires at least one stage`,
           path: ["stages"]
         });
       }
-      if (load2.executor === "constant-arrival-rate" && !load2.rate) {
+      if (load3.executor === "constant-arrival-rate" && !load3.rate) {
         ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: "constant-arrival-rate needs a rate", path: ["rate"] });
       }
-      if (!isArrivalRate(load2.executor) && load2.stages.some((s) => s.target > 500)) {
+      if (!isArrivalRate(load3.executor) && load3.stages.some((s) => s.target > 500)) {
         ctx.addIssue({ code: external_exports.ZodIssueCode.custom, message: "A stage can use at most 500 virtual users", path: ["stages"] });
       }
     });
@@ -16341,9 +16402,11 @@ var init_definition = __esm({
       maxRedirects: external_exports.number().int().min(0).max(20).default(5),
       httpVersion: external_exports.enum(["1.1", "2"]).default("1.1"),
       tlsSkipVerify: external_exports.boolean().default(false),
-      connectionReuse: external_exports.boolean().default(true)
+      connectionReuse: external_exports.boolean().default(true),
+      /** Send cookies from the jar and keep the ones the API sets (like a browser). */
+      cookies: external_exports.boolean().default(true)
     }).strict();
-    oauthGrants = ["client_credentials", "password", "authorization_code"];
+    oauthGrants = ["client_credentials", "password", "authorization_code", "jwt_bearer", "saml_bearer"];
     oauthConfigSchema = external_exports.object({
       grant: external_exports.enum(oauthGrants),
       tokenUrl: external_exports.string().url(),
@@ -16355,7 +16418,25 @@ var init_definition = __esm({
       username: external_exports.string().default(""),
       password: external_exports.string().default(""),
       /** How the client id and secret go to the token endpoint. */
-      clientAuth: external_exports.enum(["basic", "body"]).default("basic"),
+      /** basic / body: the client secret; private_key_jwt: a JWT signed with the private key (client assertion). */
+      clientAuth: external_exports.enum(["basic", "body", "private_key_jwt"]).default("basic"),
+      // Signed assertions (JWT bearer grant, client assertion).
+      privateKey: external_exports.string().default(""),
+      assertionAlgorithm: external_exports.enum(["RS256", "RS384", "RS512", "PS256", "ES256", "ES384"]).default("RS256"),
+      issuer: external_exports.string().default(""),
+      subject: external_exports.string().default(""),
+      audience: external_exports.string().default(""),
+      kid: external_exports.string().default(""),
+      /** The certificate (PEM) of the key: its thumbprint goes in the JWT header (x5t), as Azure AD wants. */
+      certificate: external_exports.string().default(""),
+      /** More claims for the JWT bearer assertion, as JSON. */
+      extraClaims: external_exports.string().default(""),
+      // SAML 2.0 bearer (SAP SuccessFactors).
+      samlSource: external_exports.enum(["idp", "assertion"]).default("idp"),
+      idpUrl: external_exports.string().default(""),
+      userId: external_exports.string().default(""),
+      companyId: external_exports.string().default(""),
+      assertion: external_exports.string().default(""),
       pkce: external_exports.boolean().default(true),
       /** Extra token-request fields, e.g. audience or resource. */
       extra: external_exports.array(keyValueSchema).max(20).default([])
@@ -16376,6 +16457,17 @@ var init_definition = __esm({
         headerName: external_exports.string().min(1).default("Authorization"),
         prefix: external_exports.string().default("Bearer")
       }).strict(),
+      // OAuth 1.0 (RFC 5849): every request signed with the consumer and token secrets (NetSuite TBA…).
+      external_exports.object({
+        mode: external_exports.literal("oauth1"),
+        consumerKey: external_exports.string().min(1),
+        consumerSecret: external_exports.string(),
+        token: external_exports.string().default(""),
+        tokenSecret: external_exports.string().default(""),
+        signatureMethod: external_exports.enum(["HMAC-SHA256", "HMAC-SHA1", "PLAINTEXT"]).default("HMAC-SHA256"),
+        realm: external_exports.string().default(""),
+        addTo: external_exports.enum(["header", "query"]).default("header")
+      }).strict(),
       // AWS Signature Version 4: every request is signed (API Gateway, S3, Lambda function URLs…).
       external_exports.object({
         mode: external_exports.literal("aws_sigv4"),
@@ -24007,9 +24099,14 @@ function defaultRequestDraft() {
     params: [],
     headers: [],
     bodyMode: "none",
+    graphqlQuery: "",
+    graphqlVariables: "",
+    graphqlOperation: "",
+    graphqlErrorsFail: true,
     bodyText: "",
     authMode: "inherit",
     oauth: defaultOAuth(),
+    oauth1: defaultOAuth1(),
     aws: defaultAws(),
     jwt: defaultJwt(),
     domain: "",
@@ -24022,6 +24119,7 @@ function defaultRequestDraft() {
     timeout: "60s",
     maxRedirects: 5,
     connectionReuse: true,
+    useCookies: true,
     tlsSkip: false,
     checks: [],
     before: null,
@@ -24064,8 +24162,8 @@ function requestFromUnknown(value) {
   const base = defaultRequestDraft();
   if (!value || typeof value !== "object") return base;
   const item = value;
-  const bodyMode = item.bodyMode === "json" || item.bodyMode === "text" ? item.bodyMode : "none";
-  const authMode2 = item.authMode === "bearer" || item.authMode === "basic" || item.authMode === "api_key" || item.authMode === "inherit" || item.authMode === "oauth2" || item.authMode === "digest" || item.authMode === "ntlm" || item.authMode === "aws_sigv4" || item.authMode === "jwt" ? item.authMode : item.authMode === void 0 ? "inherit" : "none";
+  const bodyMode = item.bodyMode === "json" || item.bodyMode === "text" || item.bodyMode === "graphql" ? item.bodyMode : "none";
+  const authMode2 = item.authMode === "bearer" || item.authMode === "basic" || item.authMode === "api_key" || item.authMode === "inherit" || item.authMode === "oauth2" || item.authMode === "digest" || item.authMode === "ntlm" || item.authMode === "aws_sigv4" || item.authMode === "jwt" || item.authMode === "oauth1" ? item.authMode : item.authMode === void 0 ? "inherit" : "none";
   return {
     method: METHODS.includes(item.method) ? item.method : "GET",
     url: str(item.url, ""),
@@ -24075,8 +24173,13 @@ function requestFromUnknown(value) {
     headers: rows(item.headers),
     bodyMode,
     bodyText: str(item.bodyText, ""),
+    graphqlQuery: str(item.graphqlQuery, ""),
+    graphqlVariables: str(item.graphqlVariables, ""),
+    graphqlOperation: str(item.graphqlOperation, ""),
+    graphqlErrorsFail: item.graphqlErrorsFail !== false,
     authMode: authMode2,
     oauth: oauthFromUnknown(item.oauth),
+    oauth1: oauth1FromUnknown(item.oauth1),
     aws: awsFromUnknown(item.aws),
     jwt: jwtFromUnknown(item.jwt),
     domain: str(item.domain, ""),
@@ -24089,6 +24192,7 @@ function requestFromUnknown(value) {
     timeout: str(item.timeout, base.timeout),
     maxRedirects: num(item.maxRedirects, base.maxRedirects),
     connectionReuse: item.connectionReuse !== false,
+    useCookies: item.useCookies !== false,
     tlsSkip: item.tlsSkip === true,
     checks: checksFrom(item.checks),
     before: beforeFrom(item.before),
@@ -24099,12 +24203,12 @@ function requestFromUnknown(value) {
     })
   };
 }
-function applyPreset(load2, preset) {
-  if (preset === "custom") return { ...load2, preset };
-  return { preset, mode: "users", rps: load2.rps, maxVus: load2.maxVus, stages: null, ...LOAD_KNOB_PRESETS[preset] };
+function applyPreset(load3, preset) {
+  if (preset === "custom") return { ...load3, preset };
+  return { preset, mode: "users", rps: load3.rps, maxVus: load3.maxVus, stages: null, ...LOAD_KNOB_PRESETS[preset] };
 }
-function toLoadConfig(load2) {
-  const { preset: _preset, ...knobs } = load2;
+function toLoadConfig(load3) {
+  const { preset: _preset, ...knobs } = load3;
   return loadFromLabKnobs(knobs);
 }
 function withUrl(draft, value) {
@@ -24119,12 +24223,12 @@ function hasBody(method) {
 function draftRuntimeNames(draft) {
   return runtimeVariableNames({ setup: draft.before, data: draft.testData });
 }
-function buildPayload(draft, load2, name, targets) {
+function buildPayload(draft, load3, name, targets) {
   const parts = requestParts(draft);
   return {
     name: name.slice(0, 120),
     ...parts,
-    load: load2,
+    load: load3,
     targets,
     setup: void 0,
     data: draft.testData && draft.testData.rows.length ? draft.testData : void 0,
@@ -24178,6 +24282,11 @@ function requestParts(draft) {
     if (!a.accessKeyId.trim() || !a.secretAccessKey) throw new Error("AWS signing needs the access key ID and the secret access key");
     if (!a.region.trim() || !a.service.trim()) throw new Error("AWS signing needs the region (like eu-west-1) and the service (like execute-api or s3)");
     auth = { mode: "aws_sigv4", accessKeyId: a.accessKeyId.trim(), secretAccessKey: a.secretAccessKey, sessionToken: a.sessionToken.trim(), region: a.region.trim(), service: a.service.trim() };
+  } else if (draft.authMode === "oauth1") {
+    const o = draft.oauth1;
+    if (!o.consumerKey.trim()) throw new Error("OAuth 1.0 needs the consumer key");
+    if (o.token.trim() && !o.tokenSecret) throw new Error("OAuth 1.0: the token needs its token secret");
+    auth = { mode: "oauth1", consumerKey: o.consumerKey.trim(), consumerSecret: o.consumerSecret, token: o.token.trim(), tokenSecret: o.tokenSecret, signatureMethod: o.signatureMethod, realm: o.realm.trim(), addTo: o.addTo };
   } else if (draft.authMode === "jwt") {
     const j = draft.jwt;
     const hmac3 = j.algorithm.startsWith("HS");
@@ -24200,6 +24309,17 @@ function requestParts(draft) {
       if (bare) throw new Error(`Put quotes around {{${bare}}} in the JSON body \u2014 values from test data and run-first steps are filled in as text`);
       throw new Error(`Body is not valid JSON: ${err instanceof Error ? err.message : "parse error"}`);
     }
+  } else if (hasBody(draft.method) && draft.bodyMode === "graphql") {
+    if (!draft.graphqlQuery.trim()) throw new Error("Write the GraphQL query");
+    let variables = {};
+    if (draft.graphqlVariables.trim()) {
+      try {
+        variables = JSON.parse(draft.graphqlVariables);
+      } catch (err) {
+        throw new Error(`GraphQL variables are not valid JSON: ${err instanceof Error ? err.message : "parse error"} \u2014 put quotes around "{{values}}" from test data`);
+      }
+    }
+    body = { mode: "json", json: { query: draft.graphqlQuery, variables, ...draft.graphqlOperation.trim() ? { operationName: draft.graphqlOperation.trim() } : {} } };
   } else if (hasBody(draft.method) && draft.bodyMode === "text") {
     body = { mode: "text", text: draft.bodyText };
   }
@@ -24211,7 +24331,11 @@ function requestParts(draft) {
       headers: draft.headers.filter((h) => h.key.trim()),
       body,
       expectedStatus: [],
-      checks: usableChecks(draft.checks)
+      // GraphQL answers 200 even when the query failed; "errors" in the answer is the failure.
+      checks: [
+        ...usableChecks(draft.checks),
+        ...hasBody(draft.method) && draft.bodyMode === "graphql" && draft.graphqlErrorsFail ? [{ type: "json", path: "errors", op: "not_exists", value: "" }] : []
+      ]
     },
     auth,
     options: {
@@ -24219,7 +24343,8 @@ function requestParts(draft) {
       maxRedirects: draft.maxRedirects,
       httpVersion: "1.1",
       tlsSkipVerify: draft.tlsSkip,
-      connectionReuse: draft.connectionReuse
+      connectionReuse: draft.connectionReuse,
+      cookies: draft.useCookies
     }
   };
 }
@@ -24250,22 +24375,22 @@ function durationError(value, allowZero = true) {
   if (!allowZero && /^0+(\.0+)?(ms|s|m|h)$/.test(value.trim())) return "Must be longer than 0";
   return void 0;
 }
-function loadProblem(load2) {
-  if (load2.stages && load2.stages.length) {
-    for (const [i, stage] of load2.stages.entries()) {
+function loadProblem(load3) {
+  if (load3.stages && load3.stages.length) {
+    for (const [i, stage] of load3.stages.entries()) {
       const bad = durationError(stage.duration, false);
       if (bad) return `Stage ${i + 1}: ${bad}`;
       if (!(stage.target >= 0)) return `Stage ${i + 1}: target must be 0 or more`;
-      if (load2.mode !== "rate" && stage.target > 500) return `Stage ${i + 1}: at most 500 virtual users`;
+      if (load3.mode !== "rate" && stage.target > 500) return `Stage ${i + 1}: at most 500 virtual users`;
     }
-    if (!load2.stages.some((s) => s.target > 0)) return "At least one stage needs a target above 0";
-    return durationError(load2.gracefulStop) ?? null;
+    if (!load3.stages.some((s) => s.target > 0)) return "At least one stage needs a target above 0";
+    return durationError(load3.gracefulStop) ?? null;
   }
-  if (load2.mode === "rate") {
-    if (!(load2.rps >= 1 && load2.rps <= 1e5)) return "Requests per second must be 1\u2013100,000";
-    if (!(load2.maxVus >= 1 && load2.maxVus <= 2e3)) return "Max virtual users must be 1\u20132,000";
-  } else if (!(load2.vus >= 1 && load2.vus <= 500)) return "Virtual users must be 1\u2013500";
-  return durationError(load2.duration, false) ?? durationError(load2.rampUp) ?? durationError(load2.rampDown) ?? durationError(load2.gracefulStop) ?? null;
+  if (load3.mode === "rate") {
+    if (!(load3.rps >= 1 && load3.rps <= 1e5)) return "Requests per second must be 1\u2013100,000";
+    if (!(load3.maxVus >= 1 && load3.maxVus <= 2e3)) return "Max virtual users must be 1\u20132,000";
+  } else if (!(load3.vus >= 1 && load3.vus <= 500)) return "Virtual users must be 1\u2013500";
+  return durationError(load3.duration, false) ?? durationError(load3.rampUp) ?? durationError(load3.rampDown) ?? durationError(load3.gracefulStop) ?? null;
 }
 function applyFolders(draft, folders) {
   let next = draft;
@@ -24275,7 +24400,7 @@ function applyFolders(draft, folders) {
     const a = from?.settings.auth;
     if (from && a && a.authMode !== "none") {
       authFrom = from.path;
-      next = { ...next, authMode: a.authMode, oauth: a.oauth, aws: a.aws, jwt: a.jwt, domain: a.domain, token: a.token, username: a.username, password: a.password, apiName: a.apiName, apiValue: a.apiValue, apiIn: a.apiIn };
+      next = { ...next, authMode: a.authMode, oauth: a.oauth, oauth1: a.oauth1, aws: a.aws, jwt: a.jwt, domain: a.domain, token: a.token, username: a.username, password: a.password, apiName: a.apiName, apiValue: a.apiValue, apiIn: a.apiIn };
     } else {
       next = { ...next, authMode: "none" };
     }
@@ -24298,6 +24423,20 @@ function oauthWire(o) {
     throw new Error("The redirect URL must be on this computer, like http://127.0.0.1:53682/callback \u2014 add the same one in your OAuth app");
   }
   if (!o.clientId.trim()) throw new Error("OAuth 2.0 needs a client ID");
+  const needsKey = o.grant === "jwt_bearer" || o.clientAuth === "private_key_jwt" || o.grant === "saml_bearer" && o.samlSource === "idp";
+  if (needsKey && !o.privateKey.trim()) throw new Error("OAuth 2.0: this sign-in needs the private key (PEM)");
+  if (o.grant === "jwt_bearer" && o.extraClaims.trim()) {
+    try {
+      const c = JSON.parse(o.extraClaims);
+      if (!c || typeof c !== "object" || Array.isArray(c)) throw new Error("x");
+    } catch {
+      throw new Error("OAuth 2.0: the extra claims must be a JSON object");
+    }
+  }
+  if (o.grant === "saml_bearer" && o.samlSource === "idp" && (!/^https?:\/\//i.test(o.idpUrl.trim()) || !o.userId.trim())) {
+    throw new Error("SAML bearer needs the assertion URL (SuccessFactors: https://<api-server>/oauth/idp) and the user ID");
+  }
+  if (o.grant === "saml_bearer" && o.samlSource === "assertion" && !o.assertion.trim()) throw new Error("SAML bearer needs the assertion (base64)");
   return {
     grant: o.grant,
     tokenUrl,
@@ -24310,7 +24449,20 @@ function oauthWire(o) {
     password: o.password,
     clientAuth: o.clientAuth,
     pkce: o.pkce,
-    extra: o.extra.filter((e) => e.key.trim())
+    extra: o.extra.filter((e) => e.key.trim()),
+    privateKey: o.privateKey.trim(),
+    assertionAlgorithm: o.assertionAlgorithm,
+    issuer: o.issuer.trim(),
+    subject: o.subject.trim(),
+    audience: o.audience.trim(),
+    kid: o.kid.trim(),
+    certificate: o.certificate.trim(),
+    extraClaims: o.extraClaims.trim(),
+    samlSource: o.samlSource,
+    idpUrl: o.idpUrl.trim(),
+    userId: o.userId.trim(),
+    companyId: o.companyId.trim(),
+    assertion: o.assertion.trim()
   };
 }
 var METHODS, DEFAULT_LOAD, str, num, TEMPLATED, DURATION;
@@ -24334,12 +24486,15 @@ var init_draft = __esm({
       "params",
       "headers",
       "bodyText",
+      "graphqlQuery",
+      "graphqlVariables",
       "token",
       "username",
       "password",
       "apiName",
       "apiValue",
       "oauth",
+      "oauth1",
       "aws",
       "jwt",
       "domain"
@@ -25189,10 +25344,10 @@ function checksRate(r) {
   return passes + fails ? passes / (passes + fails) : null;
 }
 function plannedLoad(r) {
-  const load2 = r.definition.load;
-  const rate = load2.executor.endsWith("arrival-rate");
-  const peak = rate ? load2.rate ?? Math.max(0, ...load2.stages.map((s) => s.target)) : Math.max(0, ...load2.stages.map((s) => s.target));
-  const ms3 = load2.stages.reduce((n, s) => n + durationToMs(s.duration), 0);
+  const load3 = r.definition.load;
+  const rate = load3.executor.endsWith("arrival-rate");
+  const peak = rate ? load3.rate ?? Math.max(0, ...load3.stages.map((s) => s.target)) : Math.max(0, ...load3.stages.map((s) => s.target));
+  const ms3 = load3.stages.reduce((n, s) => n + durationToMs(s.duration), 0);
   return { rate, peak, ms: ms3 };
 }
 function fairness(before, after) {
@@ -25473,6 +25628,90 @@ function __atcSign(method, url, headers, body) {
   }
 });
 
+// ../shared/src/oauth1.ts
+function pctEncode(s) {
+  return encodeURIComponent(s).replace(/[!'()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+function decodeForm(s) {
+  try {
+    return decodeURIComponent(s.replace(/\+/g, " "));
+  } catch {
+    return s;
+  }
+}
+function formPairs(text) {
+  return text.replace(/^\?/, "").split("&").filter(Boolean).map((p) => {
+    const i = p.indexOf("=");
+    return [decodeForm(i < 0 ? p : p.slice(0, i)), decodeForm(i < 0 ? "" : p.slice(i + 1))];
+  });
+}
+function oauth1BaseString(method, url2, params) {
+  const m = /^(https?):\/\/([^/?#]+)([^?#]*)/i.exec(url2);
+  if (!m) throw new Error("OAuth 1.0 needs a full http(s) address");
+  const scheme = m[1].toLowerCase();
+  let host2 = m[2].toLowerCase();
+  if (scheme === "https" && host2.endsWith(":443") || scheme === "http" && host2.endsWith(":80")) host2 = host2.replace(/:\d+$/, "");
+  const base = `${scheme}://${host2}${m[3] || "/"}`;
+  const normalized = params.map(([k, v]) => [pctEncode(k), pctEncode(v)]).sort(([a, av], [b, bv]) => a < b ? -1 : a > b ? 1 : av < bv ? -1 : av > bv ? 1 : 0).map(([k, v]) => `${k}=${v}`).join("&");
+  return [method.toUpperCase(), pctEncode(base), pctEncode(normalized)].join("&");
+}
+function oauth1Params(c, nonce, timestamp) {
+  const p = [
+    ["oauth_consumer_key", c.consumerKey],
+    ["oauth_nonce", nonce],
+    ["oauth_signature_method", c.signatureMethod],
+    ["oauth_timestamp", String(timestamp)],
+    ["oauth_version", "1.0"]
+  ];
+  if (c.token) p.push(["oauth_token", c.token]);
+  return p;
+}
+function oauth1SigningKey(c) {
+  return `${pctEncode(c.consumerSecret)}&${pctEncode(c.tokenSecret)}`;
+}
+function oauth1Header(c, oauth) {
+  const parts = oauth.map(([k, v]) => `${pctEncode(k)}="${pctEncode(v)}"`);
+  return `OAuth ${c.realm ? `realm="${c.realm.replace(/"/g, "")}", ` : ""}${parts.join(", ")}`;
+}
+var OAUTH1_JS;
+var init_oauth1 = __esm({
+  "../shared/src/oauth1.ts"() {
+    "use strict";
+    OAUTH1_JS = `
+function __atcPct(s) { return encodeURIComponent(s).replace(/[!'()*]/g, function (c) { return "%" + c.charCodeAt(0).toString(16).toUpperCase(); }); }
+function __atcForm(t) { return t.replace(/^\\?/, "").split("&").filter(Boolean).map(function (p) { var i = p.indexOf("="); var d = function (x) { try { return decodeURIComponent(x.replace(/\\+/g, " ")); } catch (e) { return x; } }; return [d(i < 0 ? p : p.slice(0, i)), d(i < 0 ? "" : p.slice(i + 1))]; }); }
+function __atcOAuth1(method, url, headers, body) {
+  var c = OAUTH1;
+  var m = /^(https?):\\/\\/([^/?#]+)([^?#]*)(\\?[^#]*)?/i.exec(url);
+  var scheme = m[1].toLowerCase(), host = m[2].toLowerCase();
+  if ((scheme === "https" && /:443$/.test(host)) || (scheme === "http" && /:80$/.test(host))) host = host.replace(/:\\d+$/, "");
+  var nonce = ""; var abc = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
+  for (var i = 0; i < 32; i++) nonce += abc.charAt(Math.floor(Math.random() * abc.length));
+  var oauth = [["oauth_consumer_key", c.consumerKey], ["oauth_nonce", nonce], ["oauth_signature_method", c.signatureMethod], ["oauth_timestamp", String(Math.floor(Date.now() / 1000))], ["oauth_version", "1.0"]];
+  if (c.token) oauth.push(["oauth_token", c.token]);
+  var params = oauth.concat(__atcForm(m[4] || ""));
+  var ct = ""; for (var k in headers) if (k.toLowerCase() === "content-type") ct = String(headers[k]);
+  if (body && ct.indexOf("application/x-www-form-urlencoded") === 0) params = params.concat(__atcForm(body));
+  var norm = params.map(function (p) { return [__atcPct(p[0]), __atcPct(p[1])]; }).sort(function (a, b) { return a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : a[1] < b[1] ? -1 : a[1] > b[1] ? 1 : 0; }).map(function (p) { return p[0] + "=" + p[1]; }).join("&");
+  var baseString = [method.toUpperCase(), __atcPct(scheme + "://" + host + (m[3] || "/")), __atcPct(norm)].join("&");
+  var key = __atcPct(c.consumerSecret) + "&" + __atcPct(c.tokenSecret);
+  var sig = c.signatureMethod === "PLAINTEXT" ? key : crypto.hmac(c.signatureMethod === "HMAC-SHA1" ? "sha1" : "sha256", key, baseString, "base64");
+  oauth.push(["oauth_signature", sig]);
+  if (c.addTo === "query") return url + (m[4] ? "&" : "?") + oauth.map(function (p) { return __atcPct(p[0]) + "=" + __atcPct(p[1]); }).join("&");
+  headers.Authorization = "OAuth " + (c.realm ? 'realm="' + c.realm.replace(/"/g, "") + '", ' : "") + oauth.map(function (p) { return __atcPct(p[0]) + '="' + __atcPct(p[1]) + '"'; }).join(", ");
+  return url;
+}
+`;
+  }
+});
+
+// ../shared/src/graphql.ts
+var init_graphql = __esm({
+  "../shared/src/graphql.ts"() {
+    "use strict";
+  }
+});
+
 // ../shared/src/export-fields.ts
 function roundN(n, digits = 2) {
   if (!Number.isFinite(n)) return 0;
@@ -26429,6 +26668,8 @@ var init_src = __esm({
     init_before_after();
     init_ci_templates();
     init_sigv4();
+    init_oauth1();
+    init_graphql();
     init_latency_bins();
     init_checks3();
     init_definition();
@@ -26878,21 +27119,21 @@ function k6Thresholds(targets, hasChecks) {
   if (hasChecks && targets.checksRate != null) out.checks = [wrap(`rate>=${targets.checksRate}`)];
   return out;
 }
-function scenarioBlock(load2) {
-  const common = { gracefulStop: load2.gracefulStop };
-  switch (load2.executor) {
+function scenarioBlock(load3) {
+  const common = { gracefulStop: load3.gracefulStop };
+  switch (load3.executor) {
     case "constant-vus":
-      return { executor: "constant-vus", vus: load2.vus, duration: load2.duration, ...common };
+      return { executor: "constant-vus", vus: load3.vus, duration: load3.duration, ...common };
     case "ramping-vus":
-      return { executor: "ramping-vus", startVUs: load2.startVUs ?? 0, stages: load2.stages, ...common };
+      return { executor: "ramping-vus", startVUs: load3.startVUs ?? 0, stages: load3.stages, ...common };
     case "constant-arrival-rate":
       return {
         executor: "constant-arrival-rate",
-        rate: load2.rate,
+        rate: load3.rate,
         timeUnit: "1s",
-        duration: load2.duration,
-        preAllocatedVUs: load2.vus,
-        maxVUs: Math.max(load2.vus, load2.maxVUs ?? load2.vus),
+        duration: load3.duration,
+        preAllocatedVUs: load3.vus,
+        maxVUs: Math.max(load3.vus, load3.maxVUs ?? load3.vus),
         ...common
       };
     case "ramping-arrival-rate":
@@ -26900,9 +27141,9 @@ function scenarioBlock(load2) {
         executor: "ramping-arrival-rate",
         startRate: 0,
         timeUnit: "1s",
-        preAllocatedVUs: load2.vus,
-        maxVUs: Math.max(load2.vus, load2.maxVUs ?? load2.vus),
-        stages: load2.stages,
+        preAllocatedVUs: load3.vus,
+        maxVUs: Math.max(load3.vus, load3.maxVUs ?? load3.vus),
+        stages: load3.stages,
         ...common
       };
   }
@@ -26950,13 +27191,20 @@ function generateK6Script(run2, extra2 = {}) {
   }
   if (run2.auth.mode === "bearer") {
     env.ATC_TOKEN = normalizeBearerToken(run2.auth.token);
-    if (extra2.oauthRefresh) env.ATC_OAUTH = JSON.stringify(extra2.oauthRefresh);
+    if (extra2.oauthRefresh) {
+      const { bodies, ...plan } = extra2.oauthRefresh;
+      env.ATC_OAUTH = JSON.stringify(bodies ? { ...plan, start: bodies.start, stepSec: bodies.stepSec } : plan);
+      if (bodies) files["oauth.json"] = JSON.stringify(bodies.list);
+    }
   } else if (run2.auth.mode === "basic") {
     env.ATC_BASIC_USER = run2.auth.username;
     env.ATC_BASIC_PASS = run2.auth.password;
   } else if (run2.auth.mode === "api_key" && run2.auth.in === "header") {
     env.ATC_API_NAME = run2.auth.name;
     env.ATC_API_KEY = run2.auth.value;
+  } else if (run2.auth.mode === "oauth1") {
+    const { mode: _mode, ...creds } = run2.auth;
+    env.ATC_OAUTH1 = JSON.stringify(creds);
   } else if (run2.auth.mode === "aws_sigv4") {
     const { mode: _mode, ...creds } = run2.auth;
     env.ATC_AWS = JSON.stringify(creds);
@@ -26990,7 +27238,7 @@ function __atcRow() {
   const script = `import http from "k6/http";
 import { check, sleep } from "k6";
 import encoding from "k6/encoding";
-${run2.auth.mode === "aws_sigv4" ? `import crypto from "k6/crypto";
+${run2.auth.mode === "aws_sigv4" || run2.auth.mode === "oauth1" ? `import crypto from "k6/crypto";
 ` : ""}${data ? `import exec from "k6/execution";
 import { SharedArray } from "k6/data";
 ` : ""}
@@ -26999,18 +27247,23 @@ export const options = Object.assign(${optionsBlock(run2)}, __ENV.ATC_TLS_AUTH ?
 ${CHECK_EVALUATOR_JS}
 ${dataBlock}${run2.auth.mode === "aws_sigv4" ? `
 const AWS = JSON.parse(__ENV.ATC_AWS);
-${SIGV4_JS}` : ""}
+${SIGV4_JS}` : ""}${run2.auth.mode === "oauth1" ? `
+const OAUTH1 = JSON.parse(__ENV.ATC_OAUTH1);
+${OAUTH1_JS}` : ""}
 const CHECKS = JSON.parse(__ENV.ATC_CHECKS || "[]");
 // JWT: tokens signed by the app for the whole run; each is used for its stretch of time.
 const JWT = __ENV.ATC_JWT ? JSON.parse(__ENV.ATC_JWT) : null;
 const JWTS = JWT ? JSON.parse(open("./jwt.json")) : [];
 // OAuth 2.0: each simulated user gets a new token shortly before the current one runs out.
 const OAUTH = __ENV.ATC_OAUTH ? JSON.parse(__ENV.ATC_OAUTH) : null;
+const OAUTH_BODIES = OAUTH && OAUTH.stepSec ? JSON.parse(open("./oauth.json")) : null;
 let __atcToken = __ENV.ATC_TOKEN || "";
 let __atcExpires = OAUTH ? OAUTH.expiresAt : 0;
 function __atcFreshToken() {
   if (OAUTH && Date.now() > __atcExpires - 30000) {
-    const r = http.post(OAUTH.tokenUrl, OAUTH.body, { headers: OAUTH.headers, tags: { name: "OAuth token" } });
+    const body = OAUTH_BODIES ? OAUTH_BODIES[Math.max(0, Math.min(OAUTH_BODIES.length - 1, Math.floor((Date.now() / 1000 - OAUTH.start) / OAUTH.stepSec)))] : OAUTH.body;
+    // responseType: the run may discard bodies to save memory, but the token is in this one.
+    const r = http.post(OAUTH.tokenUrl, body, { headers: OAUTH.headers, responseType: "text", tags: { name: "OAuth token" } });
     let json = null;
     try { json = r.json(); } catch (e) { json = null; }
     if (r.status >= 200 && r.status < 300 && json && json.access_token) {
@@ -27028,12 +27281,14 @@ export default function () {
   ${data ? 'const vars = __atcRow();\n  const f = function (text, mode) { return __atcFill(text, vars, mode || "raw"); };' : "const f = function (text) { return text; };"}
   const headers = JSON.parse(__ENV.ATC_HEADERS || "{}");
   for (const key in headers) headers[key] = f(headers[key]);
+  if (__ENV.ATC_COOKIE) headers.Cookie = __ENV.ATC_COOKIE;
   if (__ENV.ATC_TOKEN) headers.Authorization = "Bearer " + f(__atcFreshToken());
   if (__ENV.ATC_BASIC_USER !== undefined) headers.Authorization = "Basic " + encoding.b64encode(f(__ENV.ATC_BASIC_USER) + ":" + f(__ENV.ATC_BASIC_PASS || ""));
   if (__ENV.ATC_API_NAME && __ENV.ATC_API_KEY) headers[f(__ENV.ATC_API_NAME)] = f(__ENV.ATC_API_KEY);
   if (JWT) headers[JWT.headerName] = (JWT.prefix ? JWT.prefix + " " : "") + JWTS[Math.max(0, Math.min(JWTS.length - 1, Math.floor((Date.now() / 1000 - JWT.start) / JWT.stepSec)))];
   const body = __ENV.ATC_BODY ? f(__ENV.ATC_BODY, __ENV.ATC_BODY_FILL) : null;
   let target = f(__ENV.ATC_URL, "url");
+  if (__ENV.ATC_OAUTH1) target = __atcOAuth1(__ENV.ATC_METHOD, target, headers, body);
   if (__ENV.ATC_AWS) __atcSign(__ENV.ATC_METHOD, target, headers, body);
   if (__ENV.ATC_AUTH_KIND) target = target.replace("://", "://" + encodeURIComponent(f(__ENV.ATC_AUTH_USER)) + ":" + encodeURIComponent(f(__ENV.ATC_AUTH_PASS || "")) + "@");
   const res = http.request(__ENV.ATC_METHOD, target, body, {
@@ -27058,17 +27313,18 @@ export default function () {
 `;
   return { script, env, files };
 }
-function loadDurationHintMs(load2) {
-  if (load2.stages.length > 0) {
-    return load2.stages.reduce((sum, stage) => sum + durationToMs(stage.duration), 0);
+function loadDurationHintMs(load3) {
+  if (load3.stages.length > 0) {
+    return load3.stages.reduce((sum, stage) => sum + durationToMs(stage.duration), 0);
   }
-  return durationToMs(load2.duration);
+  return durationToMs(load3.duration);
 }
 var init_k6_script = __esm({
   "../shared/src/k6-script.ts"() {
     "use strict";
     init_chain();
     init_checks3();
+    init_oauth1();
     init_sigv4();
     init_definition();
   }
@@ -44903,10 +45159,12 @@ var require_lib = __commonJS({
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { mkdir as mkdir2, readFile as readFile2, rename as rename2, writeFile as writeFile2 } from "node:fs/promises";
 import { join as join4 } from "node:path";
-import { createSecureContext } from "node:tls";
-function useCertificateStore(dataDir, store2) {
+import { X509Certificate } from "node:crypto";
+import * as tlsModule from "node:tls";
+import { connect as tlsSocket, createSecureContext, rootCertificates } from "node:tls";
+function useCertificateStore(dataDir, store3) {
   dir = dataDir;
-  secrets = store2;
+  secrets = store3;
 }
 function addTemporaryCertificate(host2, material) {
   checkMaterial(material);
@@ -44928,23 +45186,104 @@ function hostMatches(pattern, url2) {
   }
   return name === host2;
 }
-async function readAll() {
-  if (!dir) return [];
+async function readStore() {
+  if (!dir) return { certificates: [], cas: [] };
   try {
     const raw = JSON.parse(await readFile2(join4(dir, "certificates.json"), "utf8"));
-    return Array.isArray(raw.certificates) ? raw.certificates.filter((c) => c && typeof c.id === "string" && typeof c.host === "string") : [];
+    return {
+      certificates: Array.isArray(raw.certificates) ? raw.certificates.filter((c) => c && typeof c.id === "string" && typeof c.host === "string") : [],
+      cas: Array.isArray(raw.cas) ? raw.cas.filter((c) => c && typeof c.id === "string" && typeof c.pem === "string") : []
+    };
   } catch {
-    return [];
+    return { certificates: [], cas: [] };
   }
 }
-async function writeAll(list) {
+async function readAll() {
+  return (await readStore()).certificates;
+}
+async function writeStore(next) {
   await mkdir2(dir, { recursive: true });
   const file2 = join4(dir, "certificates.json");
   const tmp = `${file2}.${process.pid}.tmp`;
-  await writeFile2(tmp, `${JSON.stringify({ version: 1, certificates: list }, null, 2)}
+  await writeFile2(tmp, `${JSON.stringify({ version: 1, ...next }, null, 2)}
 `, "utf8");
   await rename2(tmp, file2);
 }
+async function writeAll(list) {
+  await writeStore({ ...await readStore(), certificates: list });
+}
+async function listCas() {
+  return (await readStore()).cas.map(({ pem: _pem, ...rest }) => rest);
+}
+async function addCas(pemText) {
+  const blocks = pemText.match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g) ?? [];
+  if (!blocks.length) throw new Error("No certificate in that file \u2014 it should contain -----BEGIN CERTIFICATE-----");
+  const store3 = await readStore();
+  for (const pem of blocks) {
+    let x;
+    try {
+      x = new X509Certificate(pem);
+    } catch {
+      throw new Error("A certificate in that file can't be read");
+    }
+    if (!x.ca) throw new Error(`${x.subject.split("\n").find((l) => l.startsWith("CN="))?.slice(3) ?? "That certificate"} is not a certificate authority \u2014 add the CA that issued the server's certificate`);
+    if (store3.cas.some((c) => c.pem.replace(/\s/g, "") === pem.replace(/\s/g, ""))) continue;
+    const cn = x.subject.split("\n").find((l) => l.startsWith("CN="))?.slice(3) ?? x.subject.replace(/\n/g, ", ");
+    store3.cas.push({ id: randomUUID2(), subject: cn, expires: new Date(x.validTo).toISOString(), pem });
+  }
+  await writeStore(store3);
+  casCache = null;
+  return listCas();
+}
+async function removeCa(id) {
+  const store3 = await readStore();
+  if (!store3.cas.some((c) => c.id === id)) return false;
+  await writeStore({ ...store3, cas: store3.cas.filter((c) => c.id !== id) });
+  casCache = null;
+  return true;
+}
+async function trustedCas() {
+  casCache ??= (await readStore()).cas;
+  return casCache.map((c) => c.pem);
+}
+function systemCas() {
+  if (systemCache) return systemCache;
+  const get = tlsModule.getCACertificates;
+  try {
+    systemCache = get ? get("system") : [];
+  } catch {
+    systemCache = [];
+  }
+  return systemCache;
+}
+async function trustPool() {
+  const added = await trustedCas();
+  const system = systemCas();
+  return added.length || system.length ? [...rootCertificates, ...system, ...added] : null;
+}
+async function needsTrustedCa(target) {
+  const extra2 = await trustedCas();
+  let url2;
+  try {
+    url2 = new URL(target);
+  } catch {
+    return false;
+  }
+  if (!extra2.length || url2.protocol !== "https:") return false;
+  const ok = (ca) => new Promise((resolve5) => {
+    const sock = tlsSocket({ host: url2.hostname, port: Number(url2.port || 443), servername: url2.hostname, ca, timeout: 8e3, rejectUnauthorized: false }, () => {
+      resolve5(sock.authorized);
+      sock.end();
+    });
+    sock.on("error", () => resolve5(false));
+    sock.on("timeout", () => {
+      sock.destroy();
+      resolve5(false);
+    });
+  });
+  const system = systemCas();
+  return !await ok(system.length ? [...rootCertificates, ...system] : void 0) && await ok([...rootCertificates, ...system, ...extra2]);
+}
 async function listCertificates() {
   return (await readAll()).map(({ cert: _cert, ...summary }) => summary);
 }
@@ -45049,8 +45388,18 @@ async function k6TlsAuth(urls) {
 }
 async function tlsConnect(target, skipVerify = false) {
   const m = await certificateFor(target);
-  if (!m && !skipVerify) return void 0;
-  return { ...skipVerify ? { rejectUnauthorized: false } : {}, ...m ? { cert: m.cert, key: m.key, pfx: m.pfx, passphrase: m.passphrase } : {} };
+  const pool = await trustPool();
+  if (!m && !skipVerify && !pool) return void 0;
+  return {
+    ...skipVerify ? { rejectUnauthorized: false } : {},
+    // Added to the usual roots, not instead of them.
+    ...pool ? { ca: pool } : {},
+    ...m ? { cert: m.cert, key: m.key, pfx: m.pfx, passphrase: m.passphrase } : {}
+  };
+}
+async function caBundle() {
+  const cas = await trustedCas();
+  return cas.length ? [...rootCertificates, ...systemCas(), ...cas].join("\n") : null;
 }
 function registerCertificateRoutes(app2) {
   app2.get("/certificates", async () => listCertificates());
@@ -45067,12 +45416,27 @@ function registerCertificateRoutes(app2) {
     "/certificates/:id",
     async (request3, reply) => await deleteCertificate(request3.params.id) ? { removed: 1 } : reply.code(404).send({ error: "certificate not found" })
   );
+  app2.get("/certificates/cas", async () => listCas());
+  app2.get("/certificates/system", async () => ({ count: systemCas().length }));
+  app2.post("/certificates/cas", async (request3, reply) => {
+    const pem = request3.body?.pem;
+    if (typeof pem !== "string" || pem.length > 2e6) return reply.code(400).send({ error: "Send the CA file's text as pem" });
+    try {
+      return await addCas(pem);
+    } catch (err) {
+      return reply.code(422).send({ error: err instanceof Error ? err.message : String(err) });
+    }
+  });
+  app2.delete(
+    "/certificates/cas/:id",
+    async (request3, reply) => await removeCa(request3.params.id) ? { removed: 1 } : reply.code(404).send({ error: "not found" })
+  );
   app2.get("/certificates/match", async (request3) => {
     const m = await certificateFor(request3.query.url ?? "").catch(() => null);
     return { host: m?.host ?? null };
   });
 }
-var import_node_forge, dir, secrets, extra, saveBody;
+var import_node_forge, dir, secrets, extra, casCache, systemCache, saveBody;
 var init_certificates = __esm({
   "../../apps/engine/src/certificates.ts"() {
     "use strict";
@@ -45081,6 +45445,8 @@ var init_certificates = __esm({
     dir = "";
     secrets = null;
     extra = [];
+    casCache = null;
+    systemCache = null;
     saveBody = external_exports.object({
       id: external_exports.string().optional(),
       host: external_exports.string().min(1).max(253),
@@ -45094,6 +45460,113 @@ var init_certificates = __esm({
   }
 });
 
+// ../../apps/engine/src/cookies.ts
+function useCookieStore(secrets2) {
+  store = secrets2;
+  jar = null;
+}
+async function load() {
+  if (jar) return jar;
+  try {
+    const raw = store ? await store.get(KEY) : null;
+    jar = raw ? JSON.parse(raw).filter((c) => c.expires !== null) : [];
+  } catch {
+    jar = [];
+  }
+  return jar;
+}
+async function save(next) {
+  const now = Date.now();
+  jar = next.filter((c) => c.expires === null || c.expires > now).slice(-MAX);
+  await store?.set(KEY, JSON.stringify(jar));
+}
+function defaultPath(url2) {
+  const p = url2.pathname;
+  if (!p.startsWith("/") || p.lastIndexOf("/") === 0) return "/";
+  return p.slice(0, p.lastIndexOf("/"));
+}
+function parseSetCookie(header, url2, now = Date.now()) {
+  const [pair, ...attrs] = header.split(";");
+  const eq = pair.indexOf("=");
+  if (eq <= 0) return null;
+  const host2 = url2.hostname.toLowerCase();
+  const cookie = { name: pair.slice(0, eq).trim(), value: pair.slice(eq + 1).trim(), domain: host2, includeSubdomains: false, path: defaultPath(url2), expires: null, secure: false, httpOnly: false };
+  let maxAge = null;
+  for (const raw of attrs) {
+    const i = raw.indexOf("=");
+    const k = (i < 0 ? raw : raw.slice(0, i)).trim().toLowerCase();
+    const v = i < 0 ? "" : raw.slice(i + 1).trim();
+    if (k === "domain" && v) {
+      const d = v.replace(/^\./, "").toLowerCase();
+      if (host2 !== d && !host2.endsWith(`.${d}`)) return null;
+      cookie.domain = d;
+      cookie.includeSubdomains = true;
+    } else if (k === "path" && v.startsWith("/")) cookie.path = v;
+    else if (k === "expires") {
+      const t = Date.parse(v);
+      if (Number.isFinite(t)) cookie.expires = t;
+    } else if (k === "max-age" && /^-?\d+$/.test(v)) maxAge = Number(v);
+    else if (k === "secure") cookie.secure = true;
+    else if (k === "httponly") cookie.httpOnly = true;
+    else if (k === "samesite") cookie.sameSite = v;
+  }
+  if (maxAge !== null) cookie.expires = now + maxAge * 1e3;
+  return cookie;
+}
+function matches(c, url2, now) {
+  const host2 = url2.hostname.toLowerCase();
+  const domainOk = c.includeSubdomains ? host2 === c.domain || host2.endsWith(`.${c.domain}`) : host2 === c.domain;
+  const path = url2.pathname || "/";
+  const pathOk = path === c.path || path.startsWith(c.path) && (c.path.endsWith("/") || path[c.path.length] === "/");
+  return domainOk && pathOk && (!c.secure || url2.protocol === "https:") && (c.expires === null || c.expires > now);
+}
+async function cookieHeader(target) {
+  let url2;
+  try {
+    url2 = typeof target === "string" ? new URL(target) : target;
+  } catch {
+    return "";
+  }
+  const now = Date.now();
+  return (await load()).filter((c) => matches(c, url2, now)).sort((a, b) => b.path.length - a.path.length).map((c) => `${c.name}=${c.value}`).join("; ");
+}
+async function storeCookies(target, setCookie) {
+  if (!setCookie || Array.isArray(setCookie) && !setCookie.length) return;
+  const url2 = typeof target === "string" ? new URL(target) : target;
+  const now = Date.now();
+  let next = [...await load()];
+  for (const header of Array.isArray(setCookie) ? setCookie : [setCookie]) {
+    const c = parseSetCookie(header, url2, now);
+    if (!c) continue;
+    next = next.filter((o) => !(o.name === c.name && o.domain === c.domain && o.path === c.path));
+    if (c.expires === null || c.expires > now) next.push(c);
+  }
+  await save(next);
+}
+async function listCookies() {
+  const now = Date.now();
+  return (await load()).filter((c) => c.expires === null || c.expires > now);
+}
+function registerCookieRoutes(app2) {
+  app2.get("/cookies", async () => (await listCookies()).map((c) => ({ ...c, value: c.value.length > 12 ? `${c.value.slice(0, 6)}\u2026${c.value.slice(-3)}` : c.value })));
+  app2.post("/cookies/delete", async (request3) => {
+    const b = request3.body ?? {};
+    const list = await load();
+    await save(b.all ? [] : b.domainOnly ? list.filter((c) => c.domain !== b.domainOnly) : list.filter((c) => !(c.name === b.name && c.domain === b.domain && c.path === b.path)));
+    return { left: (await listCookies()).length };
+  });
+}
+var KEY, MAX, store, jar;
+var init_cookies = __esm({
+  "../../apps/engine/src/cookies.ts"() {
+    "use strict";
+    KEY = "cookies";
+    MAX = 500;
+    store = null;
+    jar = null;
+  }
+});
+
 // ../../apps/engine/src/jwt.ts
 import { createHmac, createPrivateKey, sign as cryptoSign, constants as constants2 } from "node:crypto";
 function privateKey(pem) {
@@ -45103,7 +45576,7 @@ function privateKey(pem) {
     throw new Error(`the private key can't be read (${err instanceof Error ? err.message : "bad PEM"}) \u2014 paste the whole PEM, from -----BEGIN to -----END`);
   }
 }
-function signJwt(c, now = Math.floor(Date.now() / 1e3)) {
+function signJwt(c, now = Math.floor(Date.now() / 1e3), headerExtra = {}) {
   let claims;
   try {
     claims = JSON.parse(c.payload || "{}");
@@ -45113,6 +45586,7 @@ function signJwt(c, now = Math.floor(Date.now() / 1e3)) {
   const body = { iat: now, exp: now + c.lifetimeSec, ...claims };
   const header = { alg: c.algorithm, typ: "JWT" };
   if (c.kid) header.kid = c.kid;
+  Object.assign(header, headerExtra);
   const input = `${b64url(JSON.stringify(header))}.${b64url(JSON.stringify(body))}`;
   const bits = c.algorithm.slice(2);
   const hash2 = `sha${bits}`;
@@ -59388,13 +59862,13 @@ var require_mock_call_history = __commonJS({
     "use strict";
     var { kMockCallHistoryAddLog } = require_mock_symbols();
     var { InvalidArgumentError } = require_errors2();
-    function handleFilterCallsWithOptions(criteria, options, handler, store2, allLogs) {
+    function handleFilterCallsWithOptions(criteria, options, handler, store3, allLogs) {
       switch (options.operator) {
         case "OR":
-          store2.push(...handler(criteria, allLogs));
-          return store2;
+          store3.push(...handler(criteria, allLogs));
+          return store3;
         case "AND":
-          return handler(criteria, store2);
+          return handler(criteria, store3);
         default:
           throw new InvalidArgumentError("options.operator must to be a case insensitive string equal to 'OR' or 'AND'");
       }
@@ -62049,12 +62523,12 @@ var require_cache = __commonJS({
       }
       return false;
     }
-    function assertCacheStore(store2, name = "CacheStore") {
-      if (typeof store2 !== "object" || store2 === null) {
-        throw new TypeError(`expected type of ${name} to be a CacheStore, got ${store2 === null ? "null" : typeof store2}`);
+    function assertCacheStore(store3, name = "CacheStore") {
+      if (typeof store3 !== "object" || store3 === null) {
+        throw new TypeError(`expected type of ${name} to be a CacheStore, got ${store3 === null ? "null" : typeof store3}`);
       }
       for (const fn of ["get", "createWriteStream", "delete"]) {
-        if (typeof store2[fn] !== "function") {
+        if (typeof store3[fn] !== "function") {
           throw new TypeError(`${name} needs to have a \`${fn}()\` function`);
         }
       }
@@ -62677,15 +63151,15 @@ var require_cache_handler = __commonJS({
       }
       return locationUrl.pathname + locationUrl.search;
     }
-    function deleteCachedUri(store2, cacheKey, path) {
-      deleteCachedValue(store2, {
+    function deleteCachedUri(store3, cacheKey, path) {
+      deleteCachedValue(store3, {
         ...cacheKey,
         path
       });
       for (let i = 0; i < util.safeHTTPMethods.length; i++) {
         const method = util.safeHTTPMethods[i];
         if (method !== cacheKey.method) {
-          deleteCachedValue(store2, {
+          deleteCachedValue(store3, {
             ...cacheKey,
             method,
             path
@@ -62693,7 +63167,7 @@ var require_cache_handler = __commonJS({
         }
       }
     }
-    function deleteLocationTargets(store2, cacheKey, headerValue) {
+    function deleteLocationTargets(store3, cacheKey, headerValue) {
       if (headerValue === void 0) {
         return;
       }
@@ -62701,14 +63175,14 @@ var require_cache_handler = __commonJS({
       for (let i = 0; i < values.length; i++) {
         const path = getSameOriginPath(cacheKey, values[i]);
         if (path !== void 0) {
-          deleteCachedUri(store2, cacheKey, path);
+          deleteCachedUri(store3, cacheKey, path);
         }
       }
     }
-    function invalidateUnsafeRequest(store2, cacheKey, resHeaders) {
-      deleteCachedUri(store2, cacheKey, cacheKey.path);
-      deleteLocationTargets(store2, cacheKey, resHeaders.location);
-      deleteLocationTargets(store2, cacheKey, resHeaders["content-location"]);
+    function invalidateUnsafeRequest(store3, cacheKey, resHeaders) {
+      deleteCachedUri(store3, cacheKey, cacheKey.path);
+      deleteLocationTargets(store3, cacheKey, resHeaders.location);
+      deleteLocationTargets(store3, cacheKey, resHeaders["content-location"]);
     }
     var CacheHandler = class {
       /**
@@ -62740,8 +63214,8 @@ var require_cache_handler = __commonJS({
        * @param {import('../../types/cache-interceptor.d.ts').default.CacheKey} cacheKey
        * @param {import('../../types/dispatcher.d.ts').default.DispatchHandler} handler
        */
-      constructor({ store: store2, type, cacheByDefault }, cacheKey, handler) {
-        this.#store = store2;
+      constructor({ store: store3, type, cacheByDefault }, cacheKey, handler) {
+        this.#store = store3;
         this.#cacheType = type;
         this.#cacheByDefault = cacheByDefault;
         this.#cacheKey = cacheKey;
@@ -62935,15 +63409,15 @@ var require_cache_handler = __commonJS({
         this.#handler.onResponseError?.(controller, err);
       }
     };
-    function deleteCachedValue(store2, cacheKey) {
+    function deleteCachedValue(store3, cacheKey) {
       try {
-        store2.delete(cacheKey)?.catch?.(noop);
+        store3.delete(cacheKey)?.catch?.(noop);
       } catch {
       }
     }
-    function deleteCachedValueIfNotModified(statusCode, store2, cacheKey) {
+    function deleteCachedValueIfNotModified(statusCode, store3, cacheKey) {
       if (statusCode === 304) {
-        deleteCachedValue(store2, cacheKey);
+        deleteCachedValue(store3, cacheKey);
       }
     }
     function revalidationResponseDisallowsCachedReuse(cacheType, resHeaders, cacheControlDirectives) {
@@ -63226,7 +63700,7 @@ var require_memory_cache_store = __commonJS({
         assertCacheKey(key);
         assertCacheValue(val);
         const topLevelKey = `${key.origin}:${key.path}`;
-        const store2 = this;
+        const store3 = this;
         const entry = { ...key, ...val, body: [], size: 0 };
         return new Writable({
           write(chunk, encoding, callback) {
@@ -63234,7 +63708,7 @@ var require_memory_cache_store = __commonJS({
               chunk = Buffer.from(chunk, encoding);
             }
             entry.size += chunk.byteLength;
-            if (entry.size > store2.#maxEntrySize) {
+            if (entry.size > store3.#maxEntrySize) {
               this.destroy();
             } else {
               entry.body.push(chunk);
@@ -63242,42 +63716,42 @@ var require_memory_cache_store = __commonJS({
             callback(null);
           },
           final(callback) {
-            let entries = store2.#entries.get(topLevelKey);
+            let entries = store3.#entries.get(topLevelKey);
             if (!entries) {
               entries = [];
-              store2.#entries.set(topLevelKey, entries);
+              store3.#entries.set(topLevelKey, entries);
             }
             const previousEntry = findEntry(key, entries, Date.now());
             if (previousEntry) {
               const index = entries.indexOf(previousEntry);
               entries.splice(index, 1, entry);
-              store2.#size -= previousEntry.size;
+              store3.#size -= previousEntry.size;
             } else {
               entries.push(entry);
-              store2.#count += 1;
-            }
-            store2.#size += entry.size;
-            if (store2.#size > store2.#maxSize || store2.#count > store2.#maxCount) {
-              if (!store2.#hasEmittedMaxSizeEvent) {
-                store2.emit("maxSizeExceeded", {
-                  size: store2.#size,
-                  maxSize: store2.#maxSize,
-                  count: store2.#count,
-                  maxCount: store2.#maxCount
+              store3.#count += 1;
+            }
+            store3.#size += entry.size;
+            if (store3.#size > store3.#maxSize || store3.#count > store3.#maxCount) {
+              if (!store3.#hasEmittedMaxSizeEvent) {
+                store3.emit("maxSizeExceeded", {
+                  size: store3.#size,
+                  maxSize: store3.#maxSize,
+                  count: store3.#count,
+                  maxCount: store3.#maxCount
                 });
-                store2.#hasEmittedMaxSizeEvent = true;
+                store3.#hasEmittedMaxSizeEvent = true;
               }
-              for (const [key2, entries2] of store2.#entries) {
+              for (const [key2, entries2] of store3.#entries) {
                 for (const entry2 of entries2.splice(0, entries2.length / 2)) {
-                  store2.#size -= entry2.size;
-                  store2.#count -= 1;
+                  store3.#size -= entry2.size;
+                  store3.#count -= 1;
                 }
                 if (entries2.length === 0) {
-                  store2.#entries.delete(key2);
+                  store3.#entries.delete(key2);
                 }
               }
-              if (store2.#size < store2.#maxSize && store2.#count < store2.#maxCount) {
-                store2.#hasEmittedMaxSizeEvent = false;
+              if (store3.#size < store3.#maxSize && store3.#count < store3.#maxCount) {
+                store3.#hasEmittedMaxSizeEvent = false;
               }
             }
             callback(null);
@@ -63524,9 +63998,9 @@ var require_cache2 = __commonJS({
     function revalidationResponseUpdatesCacheControl(headers) {
       return headers["cache-control"] !== void 0;
     }
-    function deleteCachedValue(store2, cacheKey) {
+    function deleteCachedValue(store3, cacheKey) {
       try {
-        store2.delete(cacheKey)?.catch?.(nop);
+        store3.delete(cacheKey)?.catch?.(nop);
       } catch {
       }
     }
@@ -63761,7 +64235,7 @@ var require_cache2 = __commonJS({
     }
     module.exports = (opts = {}) => {
       const {
-        store: store2 = new MemoryCacheStore(),
+        store: store3 = new MemoryCacheStore(),
         methods = ["GET"],
         cacheByDefault = void 0,
         type = "shared",
@@ -63770,7 +64244,7 @@ var require_cache2 = __commonJS({
       if (typeof opts !== "object" || opts === null) {
         throw new TypeError(`expected type of opts to be an Object, got ${opts === null ? "null" : typeof opts}`);
       }
-      assertCacheStore(store2, "opts.store");
+      assertCacheStore(store3, "opts.store");
       assertCacheMethods(methods, "opts.methods");
       assertCacheOrigins(origins, "opts.origins");
       if (typeof cacheByDefault !== "undefined" && typeof cacheByDefault !== "number") {
@@ -63780,7 +64254,7 @@ var require_cache2 = __commonJS({
         throw new TypeError(`expected opts.type to be shared, private, or undefined, got ${typeof type}`);
       }
       const globalOpts = {
-        store: store2,
+        store: store3,
         methods,
         cacheByDefault,
         type
@@ -63828,7 +64302,7 @@ var require_cache2 = __commonJS({
             return dispatch(opts2, handler);
           }
           const cacheKey = makeCacheKey(opts2);
-          const result = store2.get(cacheKey);
+          const result = store3.get(cacheKey);
           if (result && typeof result.then === "function") {
             return result.then((result2) => handleResult(
               dispatch,
@@ -64791,12 +65265,12 @@ var require_sqlite_cache_store = __commonJS({
         assertCacheValue(value);
         let size = 0;
         const body = [];
-        const store2 = this;
+        const store3 = this;
         return new Writable({
           decodeStrings: true,
           write(chunk, encoding, callback) {
             size += chunk.byteLength;
-            if (size <= store2.#maxEntrySize) {
+            if (size <= store3.#maxEntrySize) {
               body.push(chunk);
             } else {
               this.destroy();
@@ -64804,7 +65278,7 @@ var require_sqlite_cache_store = __commonJS({
             callback();
           },
           final(callback) {
-            store2.set(key, { ...value, body });
+            store3.set(key, { ...value, body });
             callback();
           }
         });
@@ -64868,17 +65342,17 @@ var require_sqlite_cache_store = __commonJS({
           if (now >= value.deleteAt && !canBeExpired) {
             continue;
           }
-          let matches = true;
+          let matches2 = true;
           if (value.vary) {
             const vary = JSON.parse(value.vary);
             for (const header in vary) {
               if (!headerValueEquals(headers[header], vary[header])) {
-                matches = false;
+                matches2 = false;
                 break;
               }
             }
           }
-          if (matches) {
+          if (matches2) {
             return value;
           }
         }
@@ -68771,7 +69245,7 @@ var require_parse = __commonJS({
     var { maxNameValuePairSize, maxAttributeValueSize } = require_constants4();
     var { isCTLExcludingHtab } = require_util5();
     var assert2 = __require("node:assert");
-    function parseSetCookie(header) {
+    function parseSetCookie2(header) {
       if (isCTLExcludingHtab(header)) {
         return null;
       }
@@ -68895,7 +69369,7 @@ var require_parse = __commonJS({
       return parseUnparsedAttributes(unparsedAttributes, cookieAttributeList);
     }
     module.exports = {
-      parseSetCookie,
+      parseSetCookie: parseSetCookie2,
       parseUnparsedAttributes
     };
   }
@@ -68905,7 +69379,7 @@ var require_parse = __commonJS({
 var require_cookies = __commonJS({
   "../../node_modules/.pnpm/undici@8.10.0/node_modules/undici/lib/web/cookies/index.js"(exports, module) {
     "use strict";
-    var { parseSetCookie } = require_parse();
+    var { parseSetCookie: parseSetCookie2 } = require_parse();
     var { stringify } = require_util5();
     var { webidl } = require_webidl();
     var { Headers } = require_headers();
@@ -68944,11 +69418,11 @@ var require_cookies = __commonJS({
       if (!cookies) {
         return [];
       }
-      return cookies.map((pair) => parseSetCookie(pair));
+      return cookies.map((pair) => parseSetCookie2(pair));
     }
     function parseCookie(cookie) {
       cookie = webidl.converters.DOMString(cookie);
-      return parseSetCookie(cookie);
+      return parseSetCookie2(cookie);
     }
     function setCookie(headers, cookie) {
       webidl.argumentLengthCheck(arguments, 2, "setCookie");
@@ -72104,19 +72578,19 @@ ${captureLines}` : capture.stack;
 });
 
 // ../../apps/engine/src/oauth.ts
-import { createHash as createHash2, randomBytes, randomUUID as randomUUID3 } from "node:crypto";
+import { X509Certificate as X509Certificate2, createHash as createHash2, randomBytes, randomUUID as randomUUID3 } from "node:crypto";
 import { createServer } from "node:http";
 function useOAuthStore(secrets2) {
-  store = secrets2;
+  store2 = secrets2;
 }
 function oauthKey(c) {
   const id = JSON.stringify([c.grant, c.tokenUrl, c.authUrl, c.clientId, c.clientSecret, c.scope, c.username, c.password, [...c.extra].map((e) => `${e.key}=${e.value}`).sort()]);
   return createHash2("sha256").update(id).digest("hex").slice(0, 32);
 }
-async function load(key) {
+async function load2(key) {
   const hit = memory.get(key);
   if (hit) return hit;
-  const raw = await store?.get(`oauth:${key}`);
+  const raw = await store2?.get(`oauth:${key}`);
   if (!raw) return null;
   try {
     const token = JSON.parse(raw);
@@ -72126,21 +72600,54 @@ async function load(key) {
     return null;
   }
 }
-async function save(key, token) {
+async function save2(key, token) {
   memory.set(key, token);
-  await store?.set(`oauth:${key}`, JSON.stringify(token));
+  await store2?.set(`oauth:${key}`, JSON.stringify(token));
 }
 async function clearToken(c) {
   const key = oauthKey(c);
   memory.delete(key);
-  await store?.set(`oauth:${key}`, "");
+  await store2?.set(`oauth:${key}`, "");
 }
-function tokenRequest(c, fields) {
+function thumbprint(pem) {
+  if (!pem.trim()) return void 0;
+  try {
+    return Buffer.from(new X509Certificate2(pem).fingerprint.replace(/:/g, ""), "hex").toString("base64url");
+  } catch {
+    throw new OAuthError("the certificate can't be read \u2014 paste the whole PEM, from -----BEGIN CERTIFICATE----- to -----END CERTIFICATE-----");
+  }
+}
+function signedAssertion(c, claims, now) {
+  const x5t = thumbprint(c.certificate);
+  try {
+    return signJwt(
+      { algorithm: c.assertionAlgorithm, key: c.privateKey, payload: JSON.stringify({ jti: randomUUID3(), ...claims }), lifetimeSec: 300, kid: c.kid, headerName: "", prefix: "" },
+      now,
+      x5t ? { x5t } : {}
+    );
+  } catch (err) {
+    throw new OAuthError(err instanceof Error ? err.message : String(err));
+  }
+}
+function extraClaims(c) {
+  if (!c.extraClaims) return {};
+  try {
+    return JSON.parse(c.extraClaims);
+  } catch {
+    throw new OAuthError("the extra claims are not valid JSON");
+  }
+}
+function tokenRequest(c, fields, now = Math.floor(Date.now() / 1e3)) {
   const form = new URLSearchParams(fields);
   if (c.scope && !form.has("scope") && fields.grant_type !== "authorization_code") form.set("scope", c.scope);
   for (const e of c.extra) if (e.key.trim()) form.set(e.key.trim(), e.value);
   const headers = { "content-type": "application/x-www-form-urlencoded", accept: "application/json" };
-  if (c.clientAuth === "basic" && c.clientSecret) {
+  if (c.clientAuth === "private_key_jwt") {
+    form.set("client_id", c.clientId);
+    form.set("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer");
+    form.set("client_assertion", signedAssertion(c, { iss: c.clientId, sub: c.clientId, aud: c.audience || c.tokenUrl }, now));
+  } else if (fields.grant_type === JWT_BEARER && !c.clientSecret) {
+  } else if (c.clientAuth === "basic" && c.clientSecret) {
     headers.authorization = `Basic ${Buffer.from(`${encodeURIComponent(c.clientId)}:${encodeURIComponent(c.clientSecret)}`).toString("base64")}`;
   } else {
     form.set("client_id", c.clientId);
@@ -72182,39 +72689,84 @@ async function postToken(c, fields) {
     obtainedAt: Date.now()
   };
 }
-function grantFields(c) {
+async function grantFields(c, now = Math.floor(Date.now() / 1e3)) {
   if (c.grant === "client_credentials") return { grant_type: "client_credentials" };
   if (c.grant === "password") return { grant_type: "password", username: c.username, password: c.password };
+  if (c.grant === "jwt_bearer") {
+    const claims = { iss: c.issuer || c.clientId, ...c.subject ? { sub: c.subject } : {}, aud: c.audience || c.tokenUrl, ...extraClaims(c) };
+    return { grant_type: JWT_BEARER, assertion: signedAssertion(c, claims, now) };
+  }
+  if (c.grant === "saml_bearer") {
+    const fields = { grant_type: SAML_BEARER, assertion: c.samlSource === "assertion" ? c.assertion : await samlFromIdp(c) };
+    if (c.companyId) fields.company_id = c.companyId;
+    return fields;
+  }
   throw new OAuthError("sign in first \u2014 press \u201CSign in in the browser\u201D on the Auth tab; the token is then kept and refreshed");
 }
+async function samlFromIdp(c) {
+  const key = c.privateKey.replace(/-----[^-]+-----/g, "").replace(/\s+/g, "");
+  const form = new URLSearchParams({ client_id: c.clientId, user_id: c.userId, token_url: c.tokenUrl, private_key: key });
+  if (c.companyId) form.set("company_id", c.companyId);
+  let status;
+  let text;
+  try {
+    const connect = await tlsConnect(c.idpUrl);
+    const res = await (0, import_undici.request)(c.idpUrl, { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded" }, body: form.toString(), headersTimeout: 2e4, bodyTimeout: 2e4, dispatcher: connect ? new import_undici.Agent({ connect }) : void 0 });
+    status = res.statusCode;
+    text = (await res.body.text()).trim();
+  } catch (err) {
+    throw new OAuthError(`couldn't reach the assertion URL (${err instanceof Error ? err.message : "network error"})`);
+  }
+  if (status < 200 || status >= 300 || !text || text.startsWith("{") || text.startsWith("<")) {
+    throw new OAuthError(`the assertion URL answered ${status} (${text.slice(0, 160) || "no details"}) \u2014 check the client ID, user ID and private key`);
+  }
+  return text;
+}
 async function getToken(c, opts = {}) {
   const key = oauthKey(c);
-  const kept = await load(key);
+  const kept = await load2(key);
   if (!opts.force && fresh(kept)) return kept;
   if (kept?.refreshToken) {
     try {
       const next = await postToken(c, { grant_type: "refresh_token", refresh_token: kept.refreshToken });
       const token2 = { ...next, refreshToken: next.refreshToken ?? kept.refreshToken };
-      await save(key, token2);
+      await save2(key, token2);
       return token2;
     } catch (err) {
       if (c.grant === "authorization_code") throw new OAuthError(`the refresh token stopped working (${err instanceof Error ? err.message : "error"}) \u2014 sign in in the browser again`);
     }
   }
-  const token = await postToken(c, grantFields(c));
-  await save(key, token);
+  const token = await postToken(c, await grantFields(c));
+  await save2(key, token);
   return token;
 }
 async function tokenStatus(c) {
-  const t = await load(oauthKey(c));
+  const t = await load2(oauthKey(c));
   if (!t?.accessToken) return { hasToken: false, expiresAt: null, canRefresh: c.grant !== "authorization_code" };
   return { hasToken: true, expiresAt: t.expiresAt, scope: t.scope, canRefresh: Boolean(t.refreshToken) || c.grant !== "authorization_code", preview: `${t.accessToken.slice(0, 6)}\u2026` };
 }
-function refreshPlan(c, t) {
+async function refreshPlan(c, t, runMs = 36e5) {
   if (t.expiresAt === null) return null;
-  const fields = c.grant === "authorization_code" ? t.refreshToken ? { grant_type: "refresh_token", refresh_token: t.refreshToken } : null : grantFields(c);
-  if (!fields) return null;
-  return { tokenUrl: c.tokenUrl, ...tokenRequest(c, fields), expiresAt: t.expiresAt };
+  if (c.grant === "authorization_code") {
+    return t.refreshToken ? { tokenUrl: c.tokenUrl, ...tokenRequest(c, { grant_type: "refresh_token", refresh_token: t.refreshToken }), expiresAt: t.expiresAt } : null;
+  }
+  if (c.grant === "saml_bearer" && c.samlSource === "idp") return null;
+  const signs = c.grant === "jwt_bearer" || c.clientAuth === "private_key_jwt";
+  if (!signs) {
+    return { tokenUrl: c.tokenUrl, ...tokenRequest(c, await grantFields(c)), expiresAt: t.expiresAt };
+  }
+  const start = Math.floor(Date.now() / 1e3);
+  const stepSec = 240;
+  const count = Math.min(2e3, Math.ceil((runMs / 1e3 + 120) / stepSec));
+  const list = [];
+  let headers = {};
+  for (let i = 0; i < count; i++) {
+    const now = start + i * stepSec;
+    const req = tokenRequest(c, await grantFields(c, now), now);
+    headers = req.headers;
+    list.push(req.body);
+  }
+  return { tokenUrl: c.tokenUrl, headers, body: list[0], expiresAt: t.expiresAt, bodies: { start, stepSec, list } };
 }
 async function startAuthorization(c) {
   const redirect = new URL(c.redirectUri);
@@ -72257,7 +72809,7 @@ async function startAuthorization(c) {
     if (!code) return finish(false, "No code came back.");
     const fields = { grant_type: "authorization_code", code, redirect_uri: c.redirectUri };
     if (c.pkce) fields.code_verifier = verifier;
-    postToken(c, fields).then((token) => save(oauthKey(c), token)).then(() => finish(true, "You can close this tab and go back to APITestCenter.")).catch((err) => finish(false, err instanceof Error ? `Couldn't get the token: ${err.message}` : "Couldn't get the token."));
+    postToken(c, fields).then((token) => save2(oauthKey(c), token)).then(() => finish(true, "You can close this tab and go back to APITestCenter.")).catch((err) => finish(false, err instanceof Error ? `Couldn't get the token: ${err.message}` : "Couldn't get the token."));
   });
   await new Promise((resolve5, reject) => {
     server.once(
@@ -72319,14 +72871,15 @@ function registerOAuthRoutes(app2) {
   });
   app2.get("/oauth/authorize/:id", async (request3) => authorizationStatus(request3.params.id));
 }
-var import_undici, store, memory, OAuthError, HINTS, fresh, pending, page, b64url2;
+var import_undici, store2, memory, OAuthError, HINTS, JWT_BEARER, SAML_BEARER, fresh, pending, page, b64url2;
 var init_oauth = __esm({
   "../../apps/engine/src/oauth.ts"() {
     "use strict";
     init_src();
     import_undici = __toESM(require_undici(), 1);
     init_certificates();
-    store = null;
+    init_jwt();
+    store2 = null;
     memory = /* @__PURE__ */ new Map();
     OAuthError = class extends Error {
     };
@@ -72337,6 +72890,8 @@ var init_oauth = __esm({
       invalid_scope: "the scope isn't allowed for this client",
       unsupported_grant_type: "the server doesn't offer this grant type"
     };
+    JWT_BEARER = "urn:ietf:params:oauth:grant-type:jwt-bearer";
+    SAML_BEARER = "urn:ietf:params:oauth:grant-type:saml2-bearer";
     fresh = (t, marginMs = 6e4) => Boolean(t && (t.expiresAt === null || t.expiresAt - marginMs > Date.now()));
     pending = /* @__PURE__ */ new Map();
     page = (title, text) => `<!doctype html><meta charset="utf-8"><title>${title}</title><body style="font-family:system-ui;background:#0b0f14;color:#e6edf3;display:grid;place-items:center;height:100vh;margin:0"><div style="max-width:28rem;text-align:center"><h1 style="font-size:1.3rem">${title}</h1><p style="color:#9aa7b4">${text}</p></div>`;
@@ -72518,6 +73073,30 @@ var init_aws_sign = __esm({
   }
 });
 
+// ../../apps/engine/src/oauth1-sign.ts
+import { createHmac as createHmac4, randomBytes as randomBytes3 } from "node:crypto";
+function signOAuth1(c, req, nonce = randomBytes3(16).toString("hex"), timestamp = Math.floor(Date.now() / 1e3)) {
+  const oauth = oauth1Params(c, nonce, timestamp);
+  const query = /\?([^#]*)/.exec(req.url)?.[1] ?? "";
+  const params = [...oauth, ...formPairs(query)];
+  if (req.body && /^application\/x-www-form-urlencoded/i.test(req.contentType ?? "")) params.push(...formPairs(req.body));
+  const baseString = oauth1BaseString(req.method, req.url, params);
+  const key = oauth1SigningKey(c);
+  const signature = c.signatureMethod === "PLAINTEXT" ? key : createHmac4(c.signatureMethod === "HMAC-SHA1" ? "sha1" : "sha256", key).update(baseString).digest("base64");
+  const signed = [...oauth, ["oauth_signature", signature]];
+  if (c.addTo === "query") {
+    const extra2 = signed.map(([k, v]) => `${pctEncode(k)}=${pctEncode(v)}`).join("&");
+    return { url: `${req.url}${req.url.includes("?") ? "&" : "?"}${extra2}`, signature, baseString };
+  }
+  return { url: req.url, authorization: oauth1Header(c, signed), signature, baseString };
+}
+var init_oauth1_sign = __esm({
+  "../../apps/engine/src/oauth1-sign.ts"() {
+    "use strict";
+    init_src();
+  }
+});
+
 // ../../apps/engine/src/probe.ts
 function redactHeaders(headers, extraNames = []) {
   const extra2 = new Set(extraNames.map((n) => n.toLowerCase()));
@@ -72617,6 +73196,17 @@ async function runProbe(input) {
   const saved = parsed.save?.length && !sent.result.error ? takeValues(parsed.save, sent) : void 0;
   return { ...sent.result, setup, dataRow: parsed.data ? { row: 1, of: parsed.data.rows.length } : void 0, saved };
 }
+async function probeFull(input) {
+  const parsed = parseLab(input);
+  let vars = {};
+  if (parsed.setup) {
+    const step = await runSetupStep(parsed.setup);
+    if (!step.result.ok) return { status: 0, body: "", error: step.result.error };
+    vars = step.vars;
+  }
+  const sent = await sendOnce(fillLab(parsed, vars));
+  return { status: sent.result.status, body: sent.raw.slice(0, 2e7), error: sent.result.error };
+}
 function takeValues(rules, sent) {
   const res = { status: sent.result.status, headers: sent.lowered, body: sent.raw, durationMs: sent.result.durationMs };
   return rules.map((rule) => {
@@ -72714,6 +73304,16 @@ async function sendRaw(lab, extra2 = {}) {
   if (encoded.contentType && !Object.keys(headers).some((k) => k.toLowerCase() === "content-type")) {
     headers["content-type"] = encoded.contentType;
   }
+  let target = url2;
+  if (lab.auth.mode === "oauth1") {
+    const { mode: _mode, ...creds } = lab.auth;
+    const contentType = Object.entries(headers).find(([k]) => k.toLowerCase() === "content-type")?.[1];
+    const signed = signOAuth1(creds, { method: lab.request.method, url: url2.toString(), contentType, body: encoded.body });
+    if (signed.authorization) {
+      headers.authorization = signed.authorization;
+      secretNames.push("authorization");
+    } else target = new URL(signed.url);
+  }
   if (lab.auth.mode === "aws_sigv4") {
     const { mode: _mode, ...creds } = lab.auth;
     Object.assign(headers, signAws(creds, { method: lab.request.method, url: url2.toString(), headers, body: encoded.body }));
@@ -72721,20 +73321,39 @@ async function sendRaw(lab, extra2 = {}) {
   }
   const options = lab.options;
   const timeout = durationToMs(options.timeout);
-  const dispatcher = extra2.dispatcher ?? new import_undici2.Agent({
-    // A client certificate (mutual TLS) for this host, if one is set.
-    connect: await tlsConnect(url2, options.tlsSkipVerify)
-  }).compose(import_undici2.interceptors.redirect({ maxRedirections: options.maxRedirects }));
+  const useJar = options.cookies !== false && !extra2.dispatcher;
+  const ownCookie = Object.keys(headers).some((k) => k.toLowerCase() === "cookie");
+  const agent = extra2.dispatcher ?? new import_undici2.Agent({ connect: await tlsConnect(url2, options.tlsSkipVerify) });
+  const dispatcher = extra2.dispatcher ?? (useJar ? agent : agent.compose(import_undici2.interceptors.redirect({ maxRedirections: options.maxRedirects })));
   const started = performance.now();
   try {
-    const response = await (0, import_undici2.request)(url2, {
-      method: lab.request.method,
-      headers,
-      body: encoded.body,
-      headersTimeout: timeout,
-      bodyTimeout: timeout,
-      dispatcher
-    });
+    let current = target;
+    let method = lab.request.method;
+    let body = encoded.body;
+    let response;
+    for (let hops = 0; ; hops++) {
+      const sendHeaders = { ...headers };
+      if (useJar && !ownCookie) {
+        const jar2 = await cookieHeader(current);
+        if (jar2) sendHeaders.cookie = jar2;
+      }
+      response = await (0, import_undici2.request)(current, { method, headers: sendHeaders, body, headersTimeout: timeout, bodyTimeout: timeout, dispatcher });
+      if (!useJar) break;
+      await storeCookies(current, response.headers["set-cookie"]);
+      const location = response.headers.location;
+      if (![301, 302, 303, 307, 308].includes(response.statusCode) || typeof location !== "string" || hops >= options.maxRedirects) break;
+      await response.body.dump();
+      const next = new URL(location, current);
+      if (next.origin !== current.origin) {
+        for (const k of Object.keys(headers)) if (k.toLowerCase() === "authorization") delete headers[k];
+      }
+      if (response.statusCode === 303 || (response.statusCode === 301 || response.statusCode === 302) && method === "POST") {
+        method = "GET";
+        body = void 0;
+        for (const k of Object.keys(headers)) if (k.toLowerCase() === "content-type") delete headers[k];
+      }
+      current = next;
+    }
     const raw = await response.body.text();
     const durationMs = Math.round((performance.now() - started) * 10) / 10;
     const truncated = raw.length > BODY_LIMIT;
@@ -72789,8 +73408,10 @@ var init_probe = __esm({
     import_undici2 = __toESM(require_undici(), 1);
     init_challenge_auth();
     init_aws_sign();
+    init_oauth1_sign();
     init_jwt();
     init_certificates();
+    init_cookies();
     init_oauth();
     BODY_LIMIT = 64 * 1024;
   }
@@ -73138,12 +73759,12 @@ function dataDefinition(lab) {
   };
 }
 function loadDefinition(run2) {
-  const load2 = run2.lab.load;
-  const rate = isArrivalRate(load2.executor);
+  const load3 = run2.lab.load;
+  const rate = isArrivalRate(load3.executor);
   return {
-    executor: load2.executor,
-    rate: rate ? load2.rate ?? Math.max(0, ...load2.stages.map((s) => s.target)) : void 0,
-    stages: load2.stages.length > 0 ? load2.stages : [{ duration: load2.duration, target: rate ? load2.rate ?? 0 : load2.vus }]
+    executor: load3.executor,
+    rate: rate ? load3.rate ?? Math.max(0, ...load3.stages.map((s) => s.target)) : void 0,
+    stages: load3.stages.length > 0 ? load3.stages : [{ duration: load3.duration, target: rate ? load3.rate ?? 0 : load3.vus }]
   };
 }
 function liveSummaryParts(run2) {
@@ -73362,7 +73983,7 @@ async function startRun(lab, repoRoot2) {
     } catch (err) {
       throw Object.assign(new Error(`OAuth 2.0: ${err instanceof Error ? err.message : String(err)}`), { statusCode: 422 });
     }
-    refresh = refreshPlan(config2, token);
+    refresh = await refreshPlan(config2, token, loadDurationHintMs(filled.load));
     filled = { ...filled, auth: { mode: "bearer", token: token.accessToken } };
   }
   let tlsAuth;
@@ -73382,7 +74003,19 @@ async function startRun(lab, repoRoot2) {
     }
     filled = { ...filled, auth: { mode: "none" } };
   }
+  const bundle = await caBundle();
+  if (bundle && process.platform !== "linux" && !filled.options.tlsSkipVerify && await needsTrustedCa(filled.request.url)) {
+    filled = { ...filled, options: { ...filled.options, tlsSkipVerify: true } };
+  }
   const generated = generateK6Script(filled, { oauthRefresh: refresh, tlsAuth, jwt: jwt2 });
+  if (filled.options.cookies !== false && !filled.request.headers.some((h) => h.key.toLowerCase() === "cookie")) {
+    const jar2 = await cookieHeader(filled.request.url);
+    if (jar2) generated.env.ATC_COOKIE = jar2;
+  }
+  if (bundle && process.platform === "linux") {
+    await writeFile3(join5(dir2, "ca-bundle.pem"), bundle, "utf8");
+    generated.env.SSL_CERT_FILE = join5(dir2, "ca-bundle.pem");
+  }
   await writeFile3(scriptPath, generated.script, "utf8");
   for (const [name, text] of Object.entries(generated.files)) await writeFile3(join5(dir2, name), text, "utf8");
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -73529,6 +74162,7 @@ var init_load_run = __esm({
     init_k6_script();
     init_src();
     init_certificates();
+    init_cookies();
     init_jwt();
     init_oauth();
     init_probe();
@@ -73542,7 +74176,7 @@ var init_load_run = __esm({
 });
 
 // ../../apps/engine/src/secret-store.ts
-import { createCipheriv, createDecipheriv, randomBytes as randomBytes3 } from "node:crypto";
+import { createCipheriv, createDecipheriv, randomBytes as randomBytes4 } from "node:crypto";
 import { readFile as readFile4, rename as rename3, writeFile as writeFile4 } from "node:fs/promises";
 import { join as join6 } from "node:path";
 var SecretStore;
@@ -73579,7 +74213,7 @@ var init_secret_store = __esm({
       }
       async persist() {
         if (!this.key) return;
-        const iv = randomBytes3(12);
+        const iv = randomBytes4(12);
         const cipher = createCipheriv("aes-256-gcm", this.key, iv);
         const body = Buffer.concat([cipher.update(JSON.stringify(Object.fromEntries(this.values)), "utf8"), cipher.final()]);
         const tmp = `${this.file}.${process.pid}.tmp`;
@@ -78624,14 +79258,14 @@ var require_wrap_thenable = __commonJS({
     var { setErrorStatusCode } = require_error_status();
     var diagnostics = __require("node:diagnostics_channel");
     var channels = diagnostics.tracingChannel("fastify.request.handler");
-    function wrapThenable(thenable, reply, store2) {
-      if (store2) store2.async = true;
+    function wrapThenable(thenable, reply, store3) {
+      if (store3) store3.async = true;
       thenable.then(function(payload) {
         if (reply[kReplyHijacked] === true) {
           return;
         }
-        if (store2) {
-          channels.asyncStart.publish(store2);
+        if (store3) {
+          channels.asyncStart.publish(store3);
         }
         try {
           if (payload !== void 0 || //
@@ -78645,16 +79279,16 @@ var require_wrap_thenable = __commonJS({
             }
           }
         } finally {
-          if (store2) {
-            channels.asyncEnd.publish(store2);
+          if (store3) {
+            channels.asyncEnd.publish(store3);
           }
         }
       }, function(err) {
-        if (store2) {
-          store2.error = err;
+        if (store3) {
+          store3.error = err;
           setErrorStatusCode(reply, err);
-          channels.error.publish(store2);
-          channels.asyncStart.publish(store2);
+          channels.error.publish(store3);
+          channels.asyncStart.publish(store3);
         }
         try {
           if (reply.sent === true) {
@@ -78666,8 +79300,8 @@ var require_wrap_thenable = __commonJS({
         } catch (err2) {
           reply.send(err2);
         } finally {
-          if (store2) {
-            channels.asyncEnd.publish(store2);
+          if (store3) {
+            channels.asyncEnd.publish(store3);
           }
         }
       });
@@ -78994,10 +79628,10 @@ var require_content_type = __commonJS({
         this.#subtype = subtype;
         this.#valid = true;
         this.#empty = false;
-        let matches = keyValuePairsReg.exec(paramsList);
-        while (matches) {
-          const key = matches[1].toLowerCase();
-          let value = matches[2];
+        let matches2 = keyValuePairsReg.exec(paramsList);
+        while (matches2) {
+          const key = matches2[1].toLowerCase();
+          let value = matches2[2];
           if (value.charCodeAt(0) === 34) {
             value = value.slice(1, -1);
             if (value.indexOf("\\") !== -1) {
@@ -79005,7 +79639,7 @@ var require_content_type = __commonJS({
             }
           }
           this.#parameters.set(key, value);
-          matches = keyValuePairsReg.exec(paramsList);
+          matches2 = keyValuePairsReg.exec(paramsList);
         }
       }
       get [Symbol.toStringTag]() {
@@ -79183,7 +79817,7 @@ var require_handle_request = __commonJS({
       if (!channels.hasSubscribers || context[kFourOhFourContext] === null) {
         preHandlerCallbackInner(err, request3, reply);
       } else {
-        const store2 = {
+        const store3 = {
           request: request3,
           reply,
           async: false,
@@ -79192,19 +79826,19 @@ var require_handle_request = __commonJS({
             method: context.config.method
           }
         };
-        reply[kDiagnosticsStore] = store2;
-        channels.start.runStores(store2, preHandlerCallbackInner, void 0, err, request3, reply, store2);
+        reply[kDiagnosticsStore] = store3;
+        channels.start.runStores(store3, preHandlerCallbackInner, void 0, err, request3, reply, store3);
       }
     }
-    function preHandlerCallbackInner(err, request3, reply, store2) {
+    function preHandlerCallbackInner(err, request3, reply, store3) {
       const context = request3[kRouteContext];
       try {
         if (err != null) {
           reply[kReplyIsError] = true;
-          if (store2) {
-            store2.error = err;
+          if (store3) {
+            store3.error = err;
             setErrorStatusCode(reply, err);
-            channels.error.publish(store2);
+            channels.error.publish(store3);
           }
           reply.send(err);
           return;
@@ -79213,10 +79847,10 @@ var require_handle_request = __commonJS({
         try {
           result = context.handler(request3, reply);
         } catch (err2) {
-          if (store2) {
-            store2.error = err2;
+          if (store3) {
+            store3.error = err2;
             setErrorStatusCode(reply, err2);
-            channels.error.publish(store2);
+            channels.error.publish(store3);
           }
           reply[kReplyIsError] = true;
           reply.send(err2);
@@ -79224,13 +79858,13 @@ var require_handle_request = __commonJS({
         }
         if (result !== void 0) {
           if (result !== null && typeof result.then === "function") {
-            wrapThenable(result, reply, store2);
+            wrapThenable(result, reply, store3);
           } else {
             reply.send(result);
           }
         }
       } finally {
-        if (store2) channels.end.publish(store2);
+        if (store3) channels.end.publish(store3);
       }
     }
     module.exports = handleRequest;
@@ -83627,8 +84261,8 @@ var require_tools = __commonJS({
       if (asJsonChan.hasSubscribers === false) {
         return _asJson.call(this, obj, msg, num3, time3);
       }
-      const store2 = { instance: this, arguments };
-      return asJsonChan.traceSync(_asJson, store2, this, obj, msg, num3, time3);
+      const store3 = { instance: this, arguments };
+      return asJsonChan.traceSync(_asJson, store3, this, obj, msg, num3, time3);
     }
     function _asJson(obj, msg, num3, time3) {
       const stringify2 = this[stringifySym];
@@ -85896,8 +86530,8 @@ var require_error_handler = __commonJS({
         const result = func(error51, reply.request, reply);
         if (result !== void 0) {
           if (result !== null && typeof result.then === "function") {
-            const store2 = reply[kDiagnosticsStore] || null;
-            wrapThenable(result, reply, store2);
+            const store3 = reply[kDiagnosticsStore] || null;
+            wrapThenable(result, reply, store3);
           } else {
             reply.send(result);
           }
@@ -88216,11 +88850,11 @@ var require_request3 = __commonJS({
       port: {
         get() {
           const portReg = /(?<port>:\d+)$/;
-          const matches = portReg.exec(this.host);
-          if (matches === null || matches[1] === void 0) {
+          const matches2 = portReg.exec(this.host);
+          if (matches2 === null || matches2[1] === void 0) {
             return null;
           }
-          return parseInt(matches.groups.port.slice(1), 10);
+          return parseInt(matches2.groups.port.slice(1), 10);
         }
       },
       protocol: {
@@ -91627,11 +92261,11 @@ var require_validate = __commonJS({
         jsonPointer = $data;
         data = names_1.default.rootData;
       } else {
-        const matches = RELATIVE_JSON_POINTER.exec($data);
-        if (!matches)
+        const matches2 = RELATIVE_JSON_POINTER.exec($data);
+        if (!matches2)
           throw new Error(`Invalid JSON-pointer: ${$data}`);
-        const up = +matches[1];
-        jsonPointer = matches[2];
+        const up = +matches2[1];
+        jsonPointer = matches2[2];
         if (jsonPointer === "#") {
           if (up >= dataLevel)
             throw new Error(errorMsg("property/index", up));
@@ -92328,11 +92962,11 @@ var require_schemes = __commonJS({
         urnComponent.error = "URN can not be parsed";
         return urnComponent;
       }
-      const matches = urnComponent.path.match(URN_REG);
-      if (matches) {
+      const matches2 = urnComponent.path.match(URN_REG);
+      if (matches2) {
         const scheme = options.scheme || urnComponent.scheme || "urn";
-        urnComponent.nid = matches[1].toLowerCase();
-        urnComponent.nss = matches[2];
+        urnComponent.nid = matches2[1].toLowerCase();
+        urnComponent.nss = matches2[2];
         const urnScheme = `${scheme}:${options.nid || urnComponent.nid}`;
         const schemeHandler = getSchemeHandler(urnScheme);
         urnComponent.path = void 0;
@@ -92609,8 +93243,8 @@ var require_fast_uri = __commonJS({
     var URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u;
     var AUTHORITY_PREFIX = /^(?:[^#/:?]+:)?\/\/([^/?#]*)/;
     var AUTHORITY_INTRODUCER_REGION = /^(?:[^#/:?]+:)?([/\\\t\n\r]*)/;
-    function getParseError(parsed, matches) {
-      if (matches[2] !== void 0 && parsed.path && parsed.path[0] !== "/") {
+    function getParseError(parsed, matches2) {
+      if (matches2[2] !== void 0 && parsed.path && parsed.path[0] !== "/") {
         return 'URI path must start with "/" when authority is present.';
       }
       if (typeof parsed.port === "number" && (parsed.port < 0 || parsed.port > 65535)) {
@@ -92657,19 +93291,19 @@ var require_fast_uri = __commonJS({
           }
         }
       }
-      const matches = uri.match(URI_PARSE);
-      if (matches) {
-        parsed.scheme = matches[1];
-        parsed.userinfo = matches[3];
-        parsed.host = matches[4];
-        parsed.port = parseInt(matches[5], 10);
-        parsed.path = matches[6] || "";
-        parsed.query = matches[7];
-        parsed.fragment = matches[8];
+      const matches2 = uri.match(URI_PARSE);
+      if (matches2) {
+        parsed.scheme = matches2[1];
+        parsed.userinfo = matches2[3];
+        parsed.host = matches2[4];
+        parsed.port = parseInt(matches2[5], 10);
+        parsed.path = matches2[6] || "";
+        parsed.query = matches2[7];
+        parsed.fragment = matches2[8];
         if (isNaN(parsed.port)) {
-          parsed.port = matches[5];
+          parsed.port = matches2[5];
         }
-        const parseError = getParseError(parsed, matches);
+        const parseError = getParseError(parsed, matches2);
         if (parseError !== void 0) {
           parsed.error = parsed.error || parseError;
           malformedAuthorityOrPort = true;
@@ -95547,24 +96181,24 @@ var require_timestamp2 = __commonJS({
     }
     exports.default = validTimestamp;
     function validDate(str2) {
-      const matches = DATE.exec(str2);
-      if (!matches)
+      const matches2 = DATE.exec(str2);
+      if (!matches2)
         return false;
-      const y = +matches[1];
-      const m = +matches[2];
-      const d = +matches[3];
+      const y = +matches2[1];
+      const m = +matches2[2];
+      const d = +matches2[3];
       return m >= 1 && m <= 12 && d >= 1 && (d <= DAYS[m] || // leap year: https://tools.ietf.org/html/rfc3339#appendix-C
       m === 2 && d === 29 && (y % 100 === 0 ? y % 400 === 0 : y % 4 === 0));
     }
     function validTime(str2) {
-      const matches = TIME.exec(str2);
-      if (!matches)
+      const matches2 = TIME.exec(str2);
+      if (!matches2)
         return false;
-      const hr = +matches[1];
-      const min = +matches[2];
-      const sec = +matches[3];
-      const tzH = +(matches[4] || 0);
-      const tzM = +(matches[5] || 0);
+      const hr = +matches2[1];
+      const min = +matches2[2];
+      const sec = +matches2[3];
+      const tzH = +(matches2[4] || 0);
+      const tzM = +(matches2[5] || 0);
       return hr <= 23 && min <= 59 && sec <= 59 || // leap second
       hr - tzH === 23 && min - tzM === 59 && sec === 60;
     }
@@ -96518,19 +97152,19 @@ var require_parseJson = __commonJS({
     function parseJson(s, pos) {
       let endPos;
       parseJson.message = void 0;
-      let matches;
+      let matches2;
       if (pos)
         s = s.slice(pos);
       try {
         parseJson.position = pos + s.length;
         return JSON.parse(s);
       } catch (e) {
-        matches = rxParseJson.exec(e.message);
-        if (!matches) {
+        matches2 = rxParseJson.exec(e.message);
+        if (!matches2) {
           parseJson.message = "unexpected end";
           return void 0;
         }
-        endPos = +matches[1];
+        endPos = +matches2[1];
         const c = s[endPos];
         s = s.slice(0, endPos);
         parseJson.position = pos + endPos;
@@ -97612,11 +98246,11 @@ var require_schemes2 = __commonJS({
         urnComponent.error = "URN can not be parsed";
         return urnComponent;
       }
-      const matches = urnComponent.path.match(URN_REG);
-      if (matches) {
+      const matches2 = urnComponent.path.match(URN_REG);
+      if (matches2) {
         const scheme = options.scheme || urnComponent.scheme || "urn";
-        urnComponent.nid = matches[1].toLowerCase();
-        urnComponent.nss = matches[2];
+        urnComponent.nid = matches2[1].toLowerCase();
+        urnComponent.nss = matches2[2];
         const urnScheme = `${scheme}:${options.nid || urnComponent.nid}`;
         const schemeHandler = getSchemeHandler(urnScheme);
         urnComponent.path = void 0;
@@ -97893,8 +98527,8 @@ var require_fast_uri2 = __commonJS({
     var URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u;
     var AUTHORITY_PREFIX = /^(?:[^#/:?]+:)?\/\/([^/?#]*)/;
     var AUTHORITY_INTRODUCER_REGION = /^(?:[^#/:?]+:)?([/\\\t\n\r]*)/;
-    function getParseError(parsed, matches) {
-      if (matches[2] !== void 0 && parsed.path && parsed.path[0] !== "/") {
+    function getParseError(parsed, matches2) {
+      if (matches2[2] !== void 0 && parsed.path && parsed.path[0] !== "/") {
         return 'URI path must start with "/" when authority is present.';
       }
       if (typeof parsed.port === "number" && (parsed.port < 0 || parsed.port > 65535)) {
@@ -97941,19 +98575,19 @@ var require_fast_uri2 = __commonJS({
           }
         }
       }
-      const matches = uri.match(URI_PARSE);
-      if (matches) {
-        parsed.scheme = matches[1] === void 0 ? void 0 : matches[1].toLowerCase();
-        parsed.userinfo = matches[3];
-        parsed.host = matches[4];
-        parsed.port = parseInt(matches[5], 10);
-        parsed.path = matches[6] || "";
-        parsed.query = matches[7];
-        parsed.fragment = matches[8];
+      const matches2 = uri.match(URI_PARSE);
+      if (matches2) {
+        parsed.scheme = matches2[1] === void 0 ? void 0 : matches2[1].toLowerCase();
+        parsed.userinfo = matches2[3];
+        parsed.host = matches2[4];
+        parsed.port = parseInt(matches2[5], 10);
+        parsed.path = matches2[6] || "";
+        parsed.query = matches2[7];
+        parsed.fragment = matches2[8];
         if (isNaN(parsed.port)) {
-          parsed.port = matches[5];
+          parsed.port = matches2[5];
         }
-        const parseError = getParseError(parsed, matches);
+        const parseError = getParseError(parsed, matches2);
         if (parseError !== void 0) {
           parsed.error = parsed.error || parseError;
           malformedAuthorityOrPort = true;
@@ -98150,12 +98784,12 @@ var require_formats = __commonJS({
     var DATE = /^(\d\d\d\d)-(\d\d)-(\d\d)$/;
     var DAYS = [0, 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
     function date5(str2) {
-      const matches = DATE.exec(str2);
-      if (!matches)
+      const matches2 = DATE.exec(str2);
+      if (!matches2)
         return false;
-      const year = +matches[1];
-      const month = +matches[2];
-      const day = +matches[3];
+      const year = +matches2[1];
+      const month = +matches2[2];
+      const day = +matches2[3];
       return month >= 1 && month <= 12 && day >= 1 && day <= (month === 2 && isLeapYear(year) ? 29 : DAYS[month]);
     }
     function compareDate(d1, d2) {
@@ -98170,16 +98804,16 @@ var require_formats = __commonJS({
     var TIME = /^(\d\d):(\d\d):(\d\d(?:\.\d+)?)(z|([+-])(\d\d)(?::?(\d\d))?)?$/i;
     function getTime(strictTimeZone) {
       return function time3(str2) {
-        const matches = TIME.exec(str2);
-        if (!matches)
+        const matches2 = TIME.exec(str2);
+        if (!matches2)
           return false;
-        const hr = +matches[1];
-        const min = +matches[2];
-        const sec = +matches[3];
-        const tz = matches[4];
-        const tzSign = matches[5] === "-" ? -1 : 1;
-        const tzH = +(matches[6] || 0);
-        const tzM = +(matches[7] || 0);
+        const hr = +matches2[1];
+        const min = +matches2[2];
+        const sec = +matches2[3];
+        const tz = matches2[4];
+        const tzSign = matches2[5] === "-" ? -1 : 1;
+        const tzH = +(matches2[6] || 0);
+        const tzM = +(matches2[7] || 0);
         if (tzH > 23 || tzM > 59 || strictTimeZone && !tz)
           return false;
         if (hr <= 23 && min <= 59 && sec < 60)
@@ -105663,8 +106297,8 @@ var require_http_method = __commonJS({
           get: (type) => {
             return handlers.get(type) || null;
           },
-          set: (type, store2) => {
-            handlers.set(type, store2);
+          set: (type, store3) => {
+            handlers.set(type, store3);
           }
         };
       },
@@ -105903,14 +106537,14 @@ var require_handler_storage = __commonJS({
       // Builds a store object that maps from constraint values to a bitmap of handler indexes which pass the constraint for a value
       // So for a host constraint, this might look like { "fastify.io": 0b0010, "google.ca": 0b0101 }, meaning the 3rd handler is constrainted to fastify.io, and the 2nd and 4th handlers are constrained to google.ca.
       // The store's implementation comes from the strategies provided to the Router.
-      _buildConstraintStore(store2, constraint) {
+      _buildConstraintStore(store3, constraint) {
         for (let i = 0; i < this.handlers.length; i++) {
           const handler = this.handlers[i];
           const constraintValue = handler.constraints[constraint];
           if (constraintValue !== void 0) {
-            let indexes = store2.get(constraintValue) || 0;
+            let indexes = store3.get(constraintValue) || 0;
             indexes |= 1 << i;
-            store2.set(constraintValue, indexes);
+            store3.set(constraintValue, indexes);
           }
         }
       }
@@ -105935,9 +106569,9 @@ var require_handler_storage = __commonJS({
       _compileGetHandlerMatchingConstraints(constrainer) {
         this.constrainedHandlerStores = {};
         for (const constraint of this.constraints) {
-          const store2 = constrainer.newStoreForConstraint(constraint);
-          this.constrainedHandlerStores[constraint] = store2;
-          this._buildConstraintStore(store2, constraint);
+          const store3 = constrainer.newStoreForConstraint(constraint);
+          this.constrainedHandlerStores[constraint] = store3;
+          this._buildConstraintStore(store3, constraint);
         }
         const lines = [];
         lines.push(`
@@ -106200,7 +106834,7 @@ var require_accept_version = __commonJS({
       this.maxMinors = {};
       this.maxPatches = {};
     }
-    SemVerStore.prototype.set = function(version2, store2) {
+    SemVerStore.prototype.set = function(version2, store3) {
       if (typeof version2 !== "string") {
         throw new TypeError("Version should be a string");
       }
@@ -106213,21 +106847,21 @@ var require_accept_version = __commonJS({
       patch = Number(patch) || 0;
       if (major >= this.maxMajor) {
         this.maxMajor = major;
-        this.store.set("x", store2);
-        this.store.set("*", store2);
-        this.store.set("x.x", store2);
-        this.store.set("x.x.x", store2);
+        this.store.set("x", store3);
+        this.store.set("*", store3);
+        this.store.set("x.x", store3);
+        this.store.set("x.x.x", store3);
       }
       if (minor >= (this.maxMinors[major] || 0)) {
         this.maxMinors[major] = minor;
-        this.store.set(`${major}.x`, store2);
-        this.store.set(`${major}.x.x`, store2);
+        this.store.set(`${major}.x`, store3);
+        this.store.set(`${major}.x.x`, store3);
       }
       if (patch >= (this.maxPatches[`${major}.${minor}`] || 0)) {
         this.maxPatches[`${major}.${minor}`] = patch;
-        this.store.set(`${major}.${minor}.x`, store2);
+        this.store.set(`${major}.${minor}.x`, store3);
       }
-      this.store.set(`${major}.${minor}.${patch}`, store2);
+      this.store.set(`${major}.${minor}.${patch}`, store3);
       return this;
     };
     SemVerStore.prototype.get = function(version2) {
@@ -106695,10 +107329,10 @@ var require_find_my_way = __commonJS({
       this.trees = /* @__PURE__ */ Object.create(null);
       this._treeGET = null;
     }
-    Router.prototype.on = function on(method, path, opts, handler, store2) {
+    Router.prototype.on = function on(method, path, opts, handler, store3) {
       if (typeof opts === "function") {
         if (handler !== void 0) {
-          store2 = handler;
+          store3 = handler;
         }
         handler = opts;
         opts = {};
@@ -106712,8 +107346,8 @@ var require_find_my_way = __commonJS({
         assert2(path.length === optionalParamMatch.index + optionalParamMatch[0].length, "Optional Parameter needs to be the last parameter of the path");
         const pathFull = path.replace(OPTIONAL_PARAM_REGEXP, "$1$2");
         const pathOptional = path.replace(OPTIONAL_PARAM_REGEXP, "$2") || "/";
-        this.on(method, pathFull, opts, handler, store2);
-        this.on(method, pathOptional, opts, handler, store2);
+        this.on(method, pathFull, opts, handler, store3);
+        this.on(method, pathOptional, opts, handler, store3);
         return;
       }
       const route = path;
@@ -106727,10 +107361,10 @@ var require_find_my_way = __commonJS({
       for (const method2 of methods) {
         assert2(typeof method2 === "string", "Method should be a string");
         assert2(httpMethods.includes(method2), `Method '${method2}' is not an http method.`);
-        this._on(method2, path, opts, handler, store2, route);
+        this._on(method2, path, opts, handler, store3, route);
       }
     };
-    Router.prototype._on = function _on(method, path, opts, handler, store2) {
+    Router.prototype._on = function _on(method, path, opts, handler, store3) {
       let constraints = {};
       if (opts.constraints !== void 0) {
         assert2(typeof opts.constraints === "object" && opts.constraints !== null, "Constraints should be an object");
@@ -106851,7 +107485,7 @@ var require_find_my_way = __commonJS({
           throw new Error(`Method '${method}' already declared for route '${pattern}' with constraints '${JSON.stringify(constraints)}'`);
         }
       }
-      const route = { method, path, pattern, params, opts, handler, store: store2 };
+      const route = { method, path, pattern, params, opts, handler, store: store3 };
       this.routes.push(route);
       currentNode.addRoute(route, this.constrainer);
     };
@@ -107199,8 +107833,8 @@ var require_find_my_way = __commonJS({
     Router.prototype._rebuild = function(routes2) {
       this.reset();
       for (const route of routes2) {
-        const { method, path, opts, handler, store: store2 } = route;
-        this._on(method, path, opts, handler, store2);
+        const { method, path, opts, handler, store: store3 } = route;
+        this._on(method, path, opts, handler, store3);
       }
     };
     Router.prototype._defaultRoute = function(req, res, ctx) {
@@ -107260,12 +107894,12 @@ var require_find_my_way = __commonJS({
       if (!httpMethods.hasOwnProperty(i)) continue;
       const m = httpMethods[i];
       const methodName = m.toLowerCase();
-      Router.prototype[methodName] = function(path, handler, store2) {
-        return this.on(m, path, handler, store2);
+      Router.prototype[methodName] = function(path, handler, store3) {
+        return this.on(m, path, handler, store3);
       };
     }
-    Router.prototype.all = function(path, handler, store2) {
-      this.on(httpMethods, path, handler, store2);
+    Router.prototype.all = function(path, handler, store3) {
+      this.on(httpMethods, path, handler, store3);
     };
     Router.sanitizeUrlPath = function sanitizeUrlPath(url2, useSemicolonDelimiter) {
       const decoded = safeDecodeURI(url2, useSemicolonDelimiter);
@@ -108145,7 +108779,7 @@ var require_dist5 = __commonJS({
     exports.stringifyCookie = stringifyCookie;
     exports.stringifySetCookie = stringifySetCookie;
     exports.serialize = stringifySetCookie;
-    exports.parseSetCookie = parseSetCookie;
+    exports.parseSetCookie = parseSetCookie2;
     exports.stringifySetCookie = stringifySetCookie;
     exports.serialize = stringifySetCookie;
     var cookieNameRegExp = /^[\u0021-\u003A\u003C\u003E-\u007E]+$/;
@@ -108282,7 +108916,7 @@ var require_dist5 = __commonJS({
       }
       return str2;
     }
-    function parseSetCookie(str2, options) {
+    function parseSetCookie2(str2, options) {
       const dec = options?.decode || decode4;
       const len = str2.length;
       const endIdx = endIndex(str2, 0, len);
@@ -110973,43 +111607,43 @@ var init_serve_ui = __esm({
 });
 
 // ../../apps/engine/src/history-routes.ts
-function registerHistoryRoutes(app2, store2) {
-  app2.get("/history", async () => store2.index());
+function registerHistoryRoutes(app2, store3) {
+  app2.get("/history", async () => store3.index());
   app2.get("/history/runs/:id", async (request3, reply) => {
-    const doc = await store2.readRun(request3.params.id);
+    const doc = await store3.readRun(request3.params.id);
     return doc ?? reply.code(404).send({ error: "run not found in history" });
   });
   app2.get("/history/compares/:id", async (request3, reply) => {
-    const doc = await store2.readCompare(request3.params.id);
+    const doc = await store3.readCompare(request3.params.id);
     return doc ?? reply.code(404).send({ error: "compare not found in history" });
   });
   app2.patch("/history/runs/:id", async (request3, reply) => {
     const parsed = runPatch.safeParse(request3.body);
     if (!parsed.success) return reply.code(400).send({ error: "invalid update", issues: parsed.error.issues });
-    const summary = await store2.updateRun(request3.params.id, parsed.data);
+    const summary = await store3.updateRun(request3.params.id, parsed.data);
     return summary ?? reply.code(404).send({ error: "run not found in history" });
   });
   app2.patch("/history/compares/:id", async (request3, reply) => {
     const parsed = comparePatch.safeParse(request3.body);
     if (!parsed.success) return reply.code(400).send({ error: "invalid update", issues: parsed.error.issues });
-    const summary = await store2.updateCompare(request3.params.id, parsed.data);
+    const summary = await store3.updateCompare(request3.params.id, parsed.data);
     return summary ?? reply.code(404).send({ error: "compare not found in history" });
   });
   app2.post("/history/delete", async (request3, reply) => {
     const parsed = removeBody.safeParse(request3.body);
     if (!parsed.success) return reply.code(400).send({ error: "invalid delete", issues: parsed.error.issues });
-    return { removed: await store2.remove(parsed.data) };
+    return { removed: await store3.remove(parsed.data) };
   });
   app2.post("/history/import", async (request3, reply) => {
     try {
       const raw = request3.body;
       const parsed = parseExportFile(raw);
       if (parsed.kind === "report") {
-        return { kind: "run", summary: await store2.saveRun(parsed.report, { ...raw?.meta, source: "import" }) };
+        return { kind: "run", summary: await store3.saveRun(parsed.report, { ...raw?.meta, source: "import" }) };
       }
       return {
         kind: "compare",
-        summary: await store2.saveCompare({ apis: parsed.doc.apis, mode: parsed.doc.mode, name: raw?.meta?.name, source: "import" })
+        summary: await store3.saveCompare({ apis: parsed.doc.apis, mode: parsed.doc.mode, name: raw?.meta?.name, source: "import" })
       };
     } catch (err) {
       return reply.code(400).send({ error: err instanceof Error ? err.message : "Not an APITestCenter report" });
@@ -111020,7 +111654,7 @@ function registerHistoryRoutes(app2, store2) {
     if (!parsed.success) return reply.code(400).send({ error: "invalid compare", issues: parsed.error.issues });
     const doc = { kind: "compare", apis: parsed.data.apis };
     if (!isCompareExport(doc)) return reply.code(400).send({ error: "each API needs a run report" });
-    return store2.saveCompare({
+    return store3.saveCompare({
       apis: parsed.data.apis,
       mode: parsed.data.mode,
       name: parsed.data.name,
@@ -111031,7 +111665,7 @@ function registerHistoryRoutes(app2, store2) {
     const parsed = revealBody.safeParse(request3.body ?? {});
     if (!parsed.success) return reply.code(400).send({ error: "invalid target" });
     const { folder, id } = parsed.data;
-    return { path: await store2.reveal(folder && id ? { folder, id } : void 0) };
+    return { path: await store3.reveal(folder && id ? { folder, id } : void 0) };
   });
 }
 var runPatch, comparePatch, removeBody, compareBody, revealBody;
@@ -111089,53 +111723,53 @@ var init_settings_routes = __esm({
 });
 
 // ../../apps/engine/src/workspace-routes.ts
-function registerWorkspaceRoutes(app2, store2, onFolderMoved) {
-  app2.get("/workspace", async () => store2.index());
-  app2.get("/workspace/folders", async (request3) => store2.getFolder(request3.query.path ?? ""));
-  app2.get("/workspace/folders/chain", async (request3) => store2.folderChain(request3.query.collection ?? ""));
+function registerWorkspaceRoutes(app2, store3, onFolderMoved) {
+  app2.get("/workspace", async () => store3.index());
+  app2.get("/workspace/folders", async (request3) => store3.getFolder(request3.query.path ?? ""));
+  app2.get("/workspace/folders/chain", async (request3) => store3.folderChain(request3.query.collection ?? ""));
   app2.put("/workspace/folders", async (request3, reply) => {
     const parsed = external_exports.object({ path: external_exports.string().min(1).max(400), settings: external_exports.unknown() }).strict().safeParse(request3.body);
     if (!parsed.success) return reply.code(400).send({ error: "invalid folder", issues: parsed.error.issues });
-    return store2.saveFolder(parsed.data.path, parsed.data.settings);
+    return store3.saveFolder(parsed.data.path, parsed.data.settings);
   });
   app2.post("/workspace/folders/move", async (request3, reply) => {
     const parsed = external_exports.object({ from: external_exports.string().min(1).max(400), to: external_exports.string().min(1).max(400) }).strict().safeParse(request3.body);
     if (!parsed.success) return reply.code(400).send({ error: "invalid move", issues: parsed.error.issues });
-    const moved = await store2.moveFolder(parsed.data.from, parsed.data.to);
+    const moved = await store3.moveFolder(parsed.data.from, parsed.data.to);
     await onFolderMoved?.(moved.from, moved.to);
     return moved;
   });
   app2.delete("/workspace/folders", async (request3, reply) => {
-    return await store2.deleteFolder(request3.query.path ?? "") ? { removed: 1 } : reply.code(404).send({ error: "folder not found" });
+    return await store3.deleteFolder(request3.query.path ?? "") ? { removed: 1 } : reply.code(404).send({ error: "folder not found" });
   });
   app2.get("/workspace/requests/:id", async (request3, reply) => {
-    const saved = await store2.getRequest(request3.params.id);
+    const saved = await store3.getRequest(request3.params.id);
     return saved ?? reply.code(404).send({ error: "saved request not found" });
   });
   app2.post("/workspace/requests", async (request3, reply) => {
     const parsed = requestBody.safeParse(request3.body);
     if (!parsed.success) return reply.code(400).send({ error: "invalid request", issues: parsed.error.issues });
-    return store2.saveRequest(parsed.data);
+    return store3.saveRequest(parsed.data);
   });
   app2.put("/workspace/requests/:id", async (request3, reply) => {
     const parsed = requestBody.safeParse(request3.body);
     if (!parsed.success) return reply.code(400).send({ error: "invalid request", issues: parsed.error.issues });
-    return store2.saveRequest({ ...parsed.data, id: request3.params.id });
+    return store3.saveRequest({ ...parsed.data, id: request3.params.id });
   });
   app2.delete("/workspace/requests/:id", async (request3, reply) => {
-    return await store2.deleteRequest(request3.params.id) ? { removed: 1 } : reply.code(404).send({ error: "saved request not found" });
+    return await store3.deleteRequest(request3.params.id) ? { removed: 1 } : reply.code(404).send({ error: "saved request not found" });
   });
-  app2.put("/workspace/environments", async (request3) => store2.saveEnvironments(request3.body));
+  app2.put("/workspace/environments", async (request3) => store3.saveEnvironments(request3.body));
   app2.post("/workspace/import", async (request3, reply) => {
     const parsed = importBody.safeParse(request3.body);
     if (!parsed.success) return reply.code(400).send({ error: "invalid import", issues: parsed.error.issues });
     const saved = [];
-    for (const f of parsed.data.folders) await store2.saveFolder(f.path, f.settings);
-    for (const r of parsed.data.requests) saved.push(await store2.saveRequest(r));
+    for (const f of parsed.data.folders) await store3.saveFolder(f.path, f.settings);
+    for (const r of parsed.data.requests) saved.push(await store3.saveRequest(r));
     let added = 0;
     let merged = 0;
     if (parsed.data.environments.length) {
-      const envs = await store2.environments();
+      const envs = await store3.environments();
       for (const incoming of parsed.data.environments) {
         const existing = envs.find((e) => e.name.toLowerCase() === incoming.name.toLowerCase());
         if (existing) {
@@ -111147,7 +111781,7 @@ function registerWorkspaceRoutes(app2, store2, onFolderMoved) {
           added++;
         }
       }
-      await store2.saveEnvironments(envs);
+      await store3.saveEnvironments(envs);
     }
     return { requests: saved.length, firstId: saved[0]?.id ?? null, environments: { added, merged } };
   });
@@ -111178,7 +111812,7 @@ var init_workspace_routes = __esm({
 });
 
 // ../../apps/engine/src/demo-api.ts
-import { randomBytes as randomBytes4 } from "node:crypto";
+import { randomBytes as randomBytes5 } from "node:crypto";
 function registerDemoApi(api) {
   const tokens = /* @__PURE__ */ new Map();
   const created = /* @__PURE__ */ new Map();
@@ -111204,7 +111838,7 @@ function registerDemoApi(api) {
       return reply.code(401).send({ error: 'Use any username with the password "demo".' });
     }
     if (tokens.size > 5e3) tokens.clear();
-    const token = `demo-${randomBytes4(12).toString("hex")}`;
+    const token = `demo-${randomBytes5(12).toString("hex")}`;
     tokens.set(token, username);
     return { data: { token, user: username, expiresIn: 3600 } };
   });
@@ -111534,6 +112168,8 @@ async function routes(api) {
     status: "ok",
     service: "engine",
     version: appVersion,
+    // "cli": started by `atc ui` — the screens say so when it stops.
+    host: process.env.ATC_HOST ?? (uiDir ? "desktop" : "dev"),
     persistence: "files",
     dataDir: history.dir,
     k6: await detectK6(root),
@@ -111560,6 +112196,13 @@ async function routes(api) {
     return usage.setEnabled(request3.body.enabled);
   });
   await api.register(async (demo) => registerDemoApi(demo), { prefix: "/demo-api", logLevel: "warn" });
+  api.post("/graphql/introspect", async (request3, reply) => {
+    try {
+      return await probeFull(request3.body);
+    } catch (err) {
+      return reply.code(400).send({ error: err instanceof Error ? err.message : "invalid request" });
+    }
+  });
   api.post("/probe", async (request3, reply) => {
     const parsed = labRequestSchema.safeParse(request3.body);
     if (!parsed.success) {
@@ -111598,6 +112241,8 @@ async function routes(api) {
   useOAuthStore(secrets2);
   registerOAuthRoutes(api);
   useCertificateStore(history.dir, secrets2);
+  useCookieStore(secrets2);
+  registerCookieRoutes(api);
   registerCertificateRoutes(api);
   const suitePlans = new SuitePlans(history.dir);
   registerWorkspaceRoutes(api, workspace, (from, to) => suitePlans.move(from, to));
@@ -111639,7 +112284,7 @@ async function routes(api) {
 function engineUrl() {
   return listeningUrl;
 }
-var import_cors, import_dotenv, import_fastify, root, host, port, history, appVersion, usage, app, listeningUrl, uiDir;
+var import_cors, import_dotenv, import_fastify, root, tlsCheckWasOff, host, port, history, appVersion, usage, app, listeningUrl, uiDir;
 var init_index = __esm({
   async "../../apps/engine/src/index.ts"() {
     "use strict";
@@ -111662,9 +112307,12 @@ var init_index = __esm({
     init_suite_run();
     init_oauth();
     init_certificates();
+    init_cookies();
     init_local_servers();
     root = resolve3(dirname2(fileURLToPath(import.meta.url)), "../../..");
     if (!process.env.ATC_NO_DOTENV) (0, import_dotenv.config)({ path: resolve3(root, ".env") });
+    tlsCheckWasOff = process.env.NODE_TLS_REJECT_UNAUTHORIZED === "0";
+    if (tlsCheckWasOff) delete process.env.NODE_TLS_REJECT_UNAUTHORIZED;
     host = process.env.ENGINE_HOST ?? "127.0.0.1";
     port = Number(process.env.ENGINE_PORT ?? 4100);
     history = new HistoryStore();
@@ -111696,6 +112344,7 @@ var init_index = __esm({
       const url2 = `http://${host}:${typeof address === "object" && address ? address.port : port}`;
       listeningUrl = url2;
       app.log.info(`engine listening on ${url2}`);
+      if (tlsCheckWasOff) app.log.warn("NODE_TLS_REJECT_UNAUTHORIZED=0 is set on this computer and was ignored: certificates are checked against the system's trusted certificates; use Skip TLS certificate check on a request to turn it off there");
       if (!process.env.ATC_NO_READY_LINE) console.log(`ATC_READY ${url2}`);
     } catch (err) {
       app.log.error(err);
@@ -111709,7 +112358,8 @@ init_src();
 init_draft();
 init_history_store();
 init_k6();
-import { spawn as spawn3 } from "node:child_process";
+import { spawn as spawn3, spawnSync } from "node:child_process";
+import { tmpdir as tmpdir3 } from "node:os";
 import { randomUUID as randomUUID7 } from "node:crypto";
 import { existsSync as existsSync2, mkdirSync as mkdirSync2, readdirSync as readdirSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { readFile as readFile10, writeFile as writeFile9 } from "node:fs/promises";
@@ -111794,14 +112444,16 @@ init_secret_store();
 init_suite_run();
 init_oauth();
 init_certificates();
+init_cookies();
 init_workspace_store();
 var repoRoot = resolve4(dirname3(fileURLToPath2(import.meta.url)), "../../..");
 var EXIT = { passed: 0, failed: 1, error: 2 };
-var VERSION = "0.7.0";
+var VERSION = "0.9.0";
 var HELP = `APITestCenter CLI ${VERSION} \u2014 https://apitestcenter.com/docs/cli-and-ci.html
 
 Usage (apitestcenter, or the short name atc once installed)
-  atc ui [collection]                Open the app in your browser to build and edit tests
+  atc ui [collection]                Open the app in a window to build and edit tests
+                                     (--browser: a tab in your usual browser; --no-open: just print the address)
   atc init [collection]              Start api-tests/ in this repository, with a CI pipeline
   atc suite <collection> [options]   Send every request in a collection once and check each one
   atc run <request> [options]        Run a load test and exit 0 (passed) / 1 (failed) / 2 (error)
@@ -111886,7 +112538,8 @@ async function main() {
       help: { type: "boolean", short: "h" },
       version: { type: "boolean", short: "v" },
       data: { type: "string" },
-      "no-open": { type: "boolean" }
+      "no-open": { type: "boolean" },
+      browser: { type: "boolean" }
     }
   });
   const [command, target] = positionals;
@@ -111904,11 +112557,12 @@ async function main() {
   }
   if (command === "init") return init(target, values.data ?? "api-tests");
   const dataDir = resolveDataDir();
-  if (command === "ui") return ui(target, dataDir, values["no-open"] === true);
+  if (command === "ui") return ui(target, dataDir, values["no-open"] === true, values.browser === true);
   const secrets2 = new SecretStore(dataDir);
   const workspace = new WorkspaceStore(dataDir, secrets2);
   useOAuthStore(secrets2);
   useCertificateStore(dataDir, secrets2);
+  useCookieStore(secrets2);
   for (const spec of values.cert ?? []) {
     const eq = spec.indexOf("=");
     const files = eq > 0 ? spec.slice(eq + 1).split(",").map((f) => f.trim()).filter(Boolean) : [];
@@ -111967,7 +112621,7 @@ Environments (${index.environments.length})`);
     const message = err instanceof Error ? err.message : String(err);
     fail(message.replace(/needs an environment.*$/, "is not set \u2014 use --env <name> or --var name=value"));
   }
-  let load2 = values.preset ? applyPreset(DEFAULT_LOAD, values.preset) : { ...DEFAULT_LOAD };
+  let load3 = values.preset ? applyPreset(DEFAULT_LOAD, values.preset) : { ...DEFAULT_LOAD };
   const num3 = (v, label) => {
     if (v == null) return void 0;
     const n = Number(v);
@@ -111984,8 +112638,8 @@ Environments (${index.environments.length})`);
   };
   if (custom2.rps != null) custom2.mode = "rate";
   const overrides = Object.fromEntries(Object.entries(custom2).filter(([, v]) => v !== void 0));
-  if (Object.keys(overrides).length) load2 = { ...load2, ...overrides, stages: load2.stages && !values.duration ? load2.stages : null, preset: "custom" };
-  const problem = loadProblem(load2);
+  if (Object.keys(overrides).length) load3 = { ...load3, ...overrides, stages: load3.stages && !values.duration ? load3.stages : null, preset: "custom" };
+  const problem = loadProblem(load3);
   if (problem) fail(problem);
   const pct3 = (v) => v == null ? void 0 : (num3(v, "percent") ?? 0) / 100;
   const targets = values.p95 || values.p99 || values.errors || values.checks ? { p95Ms: num3(values.p95, "--p95"), p99Ms: num3(values.p99, "--p99"), errorRate: pct3(values.errors), checksRate: pct3(values.checks), abortOnFail: values.abort === true } : void 0;
@@ -112005,7 +112659,7 @@ Environments (${index.environments.length})`);
     if (!Number.isFinite(n) || n < 0) fail("--max-slower must be a percentage, like 10");
     return n / 100;
   })();
-  const payload = buildPayload(draft, toLoadConfig(load2), `${name} \xB7 CLI`, targets);
+  const payload = buildPayload(draft, toLoadConfig(load3), `${name} \xB7 CLI`, targets);
   const log = (line) => !values.quiet && console.log(line);
   if (draft.before) {
     const before = draft.before;
@@ -112036,7 +112690,7 @@ Environments (${index.environments.length})`);
     }
   }
   const started = await startRun(labRunSchema.parse(payload), repoRoot).catch((err) => fail(err instanceof Error ? err.message : String(err)));
-  log(`load   ${payload.request.method} ${displayTemplate(payload.request.url)} \xB7 ${load2.mode === "rate" ? `${load2.rps} req/s` : `${load2.vus} VUs`} \xB7 ${load2.duration}`);
+  log(`load   ${payload.request.method} ${displayTemplate(payload.request.url)} \xB7 ${load3.mode === "rate" ? `${load3.rps} req/s` : `${load3.vus} VUs`} \xB7 ${load3.duration}`);
   let interrupted = false;
   process.on("SIGINT", () => {
     if (interrupted) process.exit(EXIT.error);
@@ -112087,9 +112741,9 @@ compared with baseline \u201C${baseline.testName}\u201D (${baseline.startedAt.sl
   if (history2) log(`  saved to History in ${dataDir}`);
   return failed ? EXIT.failed : EXIT.passed;
 }
-async function ui(collection, dataDir, noOpen) {
+async function ui(collection, dataDir, noOpen, inBrowserTab = false) {
   const here = dirname3(fileURLToPath2(import.meta.url));
-  const uiDir2 = [resolve4(here, "ui"), resolve4(repoRoot, "apps/web/.next-desktop")].find((d) => existsSync2(resolve4(d, "index.html")));
+  const uiDir2 = [process.env.ATC_UI_DIR, resolve4(here, "ui"), resolve4(repoRoot, "apps/web/.next-desktop")].find((d) => Boolean(d) && existsSync2(resolve4(d, "index.html")));
   if (!uiDir2) fail("this build has no app screens. Use the npm package (npx apitestcenter ui), or run: pnpm --filter @apitestcenter/desktop build:ui");
   Object.assign(process.env, {
     ATC_UI_DIR: uiDir2,
@@ -112100,7 +112754,9 @@ async function ui(collection, dataDir, noOpen) {
     ATC_USAGE_URL: "",
     ATC_NO_DOTENV: "1",
     ATC_NO_READY_LINE: "1",
-    ATC_LOG_LEVEL: process.env.ATC_LOG_LEVEL ?? "warn"
+    ATC_LOG_LEVEL: process.env.ATC_LOG_LEVEL ?? "warn",
+    // The screens show "stopped" when this engine goes away (a browser tab can't be closed for them).
+    ATC_HOST: "cli"
   });
   if (!(await resolveK6Bin(repoRoot)).available) {
     const cached3 = cachedK6();
@@ -112115,10 +112771,54 @@ async function ui(collection, dataDir, noOpen) {
   console.log(`  tests in: ${dataDir}`);
   console.log("  Saved secrets last until you stop it \u2014 use {{variables}} for tests you commit.");
   console.log("  Press Ctrl+C to stop.");
-  if (!noOpen) openBrowser(page2);
+  if (!noOpen) {
+    const win = inBrowserTab ? null : openAppWindow(page2);
+    if (!win) openBrowser(page2);
+    else {
+      console.log("  Closing the window stops it too.");
+      const stop = (why) => {
+        if (why) console.log(why);
+        closeWindow(win);
+        process.exit(EXIT.passed);
+      };
+      process.on("SIGINT", () => stop("\nStopped."));
+      process.on("SIGTERM", () => stop(""));
+      win.on("exit", () => {
+        console.log("Window closed \u2014 stopped.");
+        process.exit(EXIT.passed);
+      });
+    }
+  }
   return new Promise(() => {
   });
 }
+function findAppBrowser() {
+  const env = process.env;
+  const candidates = process.platform === "win32" ? [env["ProgramFiles(x86)"], env.ProgramFiles, env.LOCALAPPDATA].flatMap(
+    (root2) => root2 ? [`${root2}\\Microsoft\\Edge\\Application\\msedge.exe`, `${root2}\\Google\\Chrome\\Application\\chrome.exe`, `${root2}\\BraveSoftware\\Brave-Browser\\Application\\brave.exe`] : []
+  ) : process.platform === "darwin" ? ["/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge", "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome", "/Applications/Chromium.app/Contents/MacOS/Chromium", "/Applications/Brave Browser.app/Contents/MacOS/Brave Browser"] : ["/usr/bin/microsoft-edge", "/usr/bin/google-chrome", "/usr/bin/google-chrome-stable", "/usr/bin/chromium", "/usr/bin/chromium-browser", "/usr/bin/brave-browser", "/snap/bin/chromium"];
+  return candidates.find((p) => existsSync2(p)) ?? null;
+}
+function openAppWindow(url2) {
+  const bin = findAppBrowser();
+  if (!bin) return null;
+  const profile = resolve4(tmpdir3(), "apitestcenter-ui-window");
+  try {
+    const child = spawn3(bin, [`--app=${url2}`, `--user-data-dir=${profile}`, "--no-first-run", "--no-default-browser-check", "--window-size=1440,900"], { stdio: "ignore", windowsHide: false });
+    child.on("error", () => openBrowser(url2));
+    return child;
+  } catch {
+    return null;
+  }
+}
+function closeWindow(win) {
+  if (win.exitCode !== null || !win.pid) return;
+  try {
+    if (process.platform === "win32") spawnSync("taskkill", ["/pid", String(win.pid), "/T", "/F"], { stdio: "ignore", windowsHide: true });
+    else win.kill("SIGTERM");
+  } catch {
+  }
+}
 function openBrowser(url2) {
   const [cmd, args] = process.platform === "win32" ? ["cmd", ["/c", "start", "", url2]] : process.platform === "darwin" ? ["open", [url2]] : ["xdg-open", [url2]];
   try {
@@ -112134,9 +112834,9 @@ async function init(collection, folder) {
     fail(`${folder} already has saved requests. Open them with: npx apitestcenter ui --data ${folder}`);
   }
   mkdirSync2(dir2, { recursive: true });
-  const store2 = new WorkspaceStore(dir2, new SecretStore(dir2));
-  await store2.saveEnvironments([{ id: randomUUID7(), name: "Local", variables: [{ key: "baseUrl", value: "http://localhost:3000", secret: false }] }]);
-  await store2.saveRequest({
+  const store3 = new WorkspaceStore(dir2, new SecretStore(dir2));
+  await store3.saveEnvironments([{ id: randomUUID7(), name: "Local", variables: [{ key: "baseUrl", value: "http://localhost:3000", secret: false }] }]);
+  await store3.saveRequest({
     name: "Health check",
     collection: name,
     request: { method: "GET", url: "{{baseUrl}}/health", checks: [{ type: "status", expect: "2xx" }] }