wayfarer-cli 2.0.2 → 2.2.0

package/dist/wayfarer-cli.mjs

@@ -7469,7 +7469,7 @@ function stringifyJson(value, space) {
   }
 }
 var MAX_IMPORT_BYTES = 10 * 1024 * 1024;
-var IMPORT_TOO_LARGE = "The file is larger than 10 MB.";
+var IMPORT_TOO_LARGE = "A file to import can be 10 MB at most, and this one is larger.";
 function isOversizedImport(input) {
   return typeof input === "string" && input.length > MAX_IMPORT_BYTES;
 }
@@ -7493,9 +7493,9 @@ function isTextType(mediaType) {
   const subtype = type.slice(type.indexOf("/") + 1);
   return type.startsWith("text/") || subtype === "xml" || subtype.startsWith("xml-") || subtype.endsWith("+xml") || TEXT_WORDS.some((word) => type.includes(word));
 }
-function decodeResponseBody(bytes, contentType2) {
+function readBody(bytes, contentType2) {
   if (!bytes || bytes.byteLength === 0) {
-    return null;
+    return { value: null };
   }
   const type = (contentType2 ?? "").trim();
   const mediaType = type.split(";")[0].trim();
@@ -7505,21 +7505,21 @@ function decodeResponseBody(bytes, contentType2) {
       text3 = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
     } catch (error) {
       if (!(error instanceof TypeError)) throw error;
-      return new BinaryBody(bytes, "");
+      return { value: new BinaryBody(bytes, "") };
     }
   } else if (JSON_TYPE.test(mediaType) || isTextType(mediaType)) {
     text3 = decodeText(bytes, charsetOf(type));
   } else {
-    return new BinaryBody(bytes, mediaType);
+    return { value: new BinaryBody(bytes, mediaType) };
   }
   const trimmed = text3.trim();
   if (JSON_TYPE.test(mediaType) || trimmed.startsWith("{") || trimmed.startsWith("[")) {
     const parsed2 = parseJson(text3);
     if (parsed2.ok && parsed2.value !== null && (JSON_TYPE.test(mediaType) || typeof parsed2.value === "object")) {
-      return parsed2.value;
+      return { value: parsed2.value, text: text3 };
     }
   }
-  return text3;
+  return { value: text3, text: text3 };
 }
 function charsetOf(contentType2) {
   const match = /;\s*charset\s*=\s*"?([^";\s]+)"?/i.exec(contentType2);
@@ -7533,12 +7533,12 @@ function decodeText(bytes, charset) {
     return new TextDecoder("utf-8").decode(bytes);
   }
 }
-function decodeEnvelope(envelope) {
+function readEnvelope(envelope) {
   const contentType2 = envelope.headers.find(([name]) => name.toLowerCase() === "content-type")?.[1];
   if (envelope.body instanceof Blob) {
-    return new BinaryBody(envelope.body, (contentType2 ?? "").split(";")[0].trim());
+    return { value: new BinaryBody(envelope.body, (contentType2 ?? "").split(";")[0].trim()) };
   }
-  return decodeResponseBody(envelope.body, contentType2);
+  return readBody(envelope.body, contentType2);
 }
 
 // ../core/src/id.ts
@@ -7554,7 +7554,10 @@ function newId() {
 // ../core/src/view/json-path.ts
 var EVERY = "\0";
 function evaluatePath(value, path) {
-  return walk(value, path.replace(/\[\*\]/g, `.${EVERY}`).replace(/\[(\d+)\]/g, ".$1").split(".").filter(Boolean));
+  return walk(
+    value,
+    path.replace(/\[\*\]/g, `.${EVERY}`).replace(/\[(\d+)\]/g, ".$1").split(".").filter(Boolean)
+  );
 }
 function walk(value, segments) {
   let current = value;
@@ -7586,15 +7589,16 @@ function buildAuthHeaders(auth3) {
     return { Authorization: `Bearer ${auth3.token}` };
   }
   if (auth3.type === "basic" && auth3.username) {
-    const bytes = new TextEncoder().encode(`${auth3.username}:${auth3.password}`);
-    const encoded = btoa(String.fromCharCode(...bytes));
-    return { Authorization: `Basic ${encoded}` };
+    return { Authorization: basicCredentials(auth3.username, auth3.password) };
   }
   if (auth3.type === "apikey" && auth3.key && auth3.in === "header") {
     return Object.fromEntries([[auth3.key, auth3.value]]);
   }
   return {};
 }
+function basicCredentials(user, password) {
+  return `Basic ${btoa(String.fromCharCode(...new TextEncoder().encode(`${user}:${password}`)))}`;
+}
 function buildAuthQueryParam(auth3) {
   if (auth3.type === "apikey" && auth3.key && auth3.in === "query") {
     return { key: auth3.key, value: auth3.value };
@@ -7610,7 +7614,14 @@ function resolveAuth(auth3, resolve) {
     case "apikey":
       return { ...auth3, key: resolve(auth3.key), value: resolve(auth3.value) };
     case "awsv4":
-      return { ...auth3, accessKey: resolve(auth3.accessKey), secretKey: resolve(auth3.secretKey), sessionToken: resolve(auth3.sessionToken), region: resolve(auth3.region), service: resolve(auth3.service) };
+      return {
+        ...auth3,
+        accessKey: resolve(auth3.accessKey),
+        secretKey: resolve(auth3.secretKey),
+        sessionToken: resolve(auth3.sessionToken),
+        region: resolve(auth3.region),
+        service: resolve(auth3.service)
+      };
     case "oauth2":
       return {
         ...auth3,
@@ -7652,55 +7663,117 @@ function credentialsOf(auth3) {
   }
 }
 
-// ../core/src/auth/sigv4.ts
+// ../core/src/vault/vault-crypto.ts
+var KDF_ITERATIONS = 6e5;
+var MAX_KDF_ITERATIONS = 1e7;
+var IV_BYTES = 12;
+var AES = { name: "AES-GCM", length: 256 };
+var VAULT_FILE_FORMAT = "wayfarer/vault";
+function fromBase64Url(text3) {
+  const binary = atob(text3.replace(/-/g, "+").replace(/_/g, "/"));
+  return Uint8Array.from(binary, (char) => char.charCodeAt(0));
+}
 var utf8 = (text3) => new TextEncoder().encode(text3);
-var sha256 = async (data) => new Uint8Array(await crypto.subtle.digest("SHA-256", data));
-var hmac = async (key, data) => new Uint8Array(await crypto.subtle.sign("HMAC", await crypto.subtle.importKey("raw", key, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]), utf8(data)));
-var hex = (bytes) => Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
-var encode = (text3) => encodeURIComponent(text3).replace(/[!'()*]/g, (mark) => `%${mark.charCodeAt(0).toString(16).toUpperCase()}`);
-var decode = (text3) => {
+async function deriveKek(passphrase, kdf) {
+  if (!crypto.subtle) {
+    throw new Error("The vault needs a secure page: open Wayfarer over https or on localhost.");
+  }
+  const material = await crypto.subtle.importKey("raw", utf8(passphrase), "PBKDF2", false, ["deriveKey"]);
+  return crypto.subtle.deriveKey(
+    { name: "PBKDF2", salt: fromBase64Url(kdf.salt), iterations: kdf.iterations, hash: "SHA-256" },
+    material,
+    AES,
+    false,
+    ["wrapKey", "unwrapKey"]
+  );
+}
+async function unwrap(record, passphrase, extractable) {
+  const bytes = fromBase64Url(record.wrappedDek);
+  const kek = await deriveKek(passphrase, record.kdf);
   try {
-    return decodeURIComponent(text3);
+    return await crypto.subtle.unwrapKey(
+      "raw",
+      bytes.slice(IV_BYTES),
+      kek,
+      { name: "AES-GCM", iv: bytes.slice(0, IV_BYTES) },
+      AES,
+      extractable,
+      ["encrypt", "decrypt"]
+    );
   } catch (error) {
-    if (!(error instanceof URIError)) throw error;
-    return text3;
+    if (error instanceof Error && error.name === "OperationError") return null;
+    throw error;
   }
-};
-async function signV4(request, credentials, at) {
-  const url = new URL(request.url);
-  const s3 = credentials.service === "s3";
-  const segments = url.pathname.split("/");
-  const kept = segments.filter(Boolean);
-  const path = s3 ? segments.map((segment) => encode(decode(segment))).join("/") : `/${kept.map(encode).join("/")}${kept.length && url.pathname.endsWith("/") ? "/" : ""}`;
-  const query = url.search.slice(1).split("&").filter(Boolean).map((pair) => {
-    const cut = pair.indexOf("=");
-    return [encode(decode(cut === -1 ? pair : pair.slice(0, cut))), encode(decode(cut === -1 ? "" : pair.slice(cut + 1)))];
-  }).sort(([keyA, valueA], [keyB, valueB]) => keyA === keyB ? valueA < valueB ? -1 : valueA > valueB ? 1 : 0 : keyA < keyB ? -1 : 1).map(([key2, value]) => `${key2}=${value}`).join("&");
-  const date = at.toISOString().replace(/[-:]|\.\d{3}/g, "");
-  const day = date.slice(0, 8);
-  const body3 = typeof request.body === "string" ? utf8(request.body) : new Uint8Array(request.body ?? []);
-  const bodyHash = hex(await sha256(body3));
-  const added2 = [["X-Amz-Date", date], ...credentials.sessionToken ? [["X-Amz-Security-Token", credentials.sessionToken]] : [], ...s3 ? [["X-Amz-Content-Sha256", bodyHash]] : []];
-  const byName = /* @__PURE__ */ new Map();
-  const own3 = request.headers.filter(([name]) => !added2.some(([written]) => written.toLowerCase() === name.toLowerCase()) && name.toLowerCase() !== "host");
-  for (const [name, value] of [["Host", url.host], ...own3, ...added2]) {
-    const key2 = name.toLowerCase();
-    byName.set(key2, [...byName.get(key2) ?? [], value.trim().replace(/\s+/g, " ")]);
+}
+function unwrapDek(record, passphrase) {
+  return unwrap(record, passphrase, false);
+}
+async function decryptSecret(dek, id, envelope) {
+  const plain = await crypto.subtle.decrypt(
+    { name: "AES-GCM", iv: fromBase64Url(envelope.iv), additionalData: utf8(id) },
+    dek,
+    fromBase64Url(envelope.ct)
+  );
+  return new TextDecoder().decode(plain);
+}
+function field(value, key) {
+  return typeof value === "object" && value !== null && Object.hasOwn(value, key) ? value[key] : void 0;
+}
+var isBase64Url = (value) => typeof value === "string" && /^[\w-]+$/.test(value);
+function validateVaultFile(value) {
+  const issues = [];
+  const fail = (path, message) => issues.push({ path, message });
+  if (typeof value !== "object" || value === null) {
+    fail("$", "Value must be an object.");
+    return issues;
   }
-  const names = [...byName.keys()].sort();
-  const signedHeaders = names.join(";");
-  const canonicalRequest = [request.method, path, query, ...names.map((name) => `${name}:${(byName.get(name) ?? []).join(",")}`), "", signedHeaders, bodyHash].join("\n");
-  const scope = `${day}/${credentials.region}/${credentials.service}/aws4_request`;
-  const stringToSign = ["AWS4-HMAC-SHA256", date, scope, hex(await sha256(utf8(canonicalRequest)))].join("\n");
-  let key = utf8(`AWS4${credentials.secretKey}`);
-  for (const part of [day, credentials.region, credentials.service, "aws4_request"]) key = await hmac(key, part);
-  const signature = hex(await hmac(key, stringToSign));
-  return {
-    headers: [...added2, ["Authorization", `AWS4-HMAC-SHA256 Credential=${credentials.accessKey}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`]],
-    canonicalRequest,
-    stringToSign,
-    signature
-  };
+  if (field(value, "$id") !== VAULT_FILE_FORMAT) {
+    fail("$id", `Not a Wayfarer vault file: "$id" must be "${VAULT_FILE_FORMAT}".`);
+    return issues;
+  }
+  const vault = field(value, "vault");
+  if (typeof vault !== "object" || vault === null) {
+    fail("vault", "Value must be an object.");
+  } else {
+    const kdf = field(vault, "kdf");
+    if (typeof kdf !== "object" || kdf === null) {
+      fail("vault.kdf", "Value must be an object.");
+    } else {
+      if (field(kdf, "alg") !== "PBKDF2-SHA256") fail("vault.kdf.alg", 'Value must be "PBKDF2-SHA256".');
+      const iterations = field(kdf, "iterations");
+      if (!(Number.isInteger(iterations) && iterations >= KDF_ITERATIONS && iterations <= MAX_KDF_ITERATIONS)) {
+        fail("vault.kdf.iterations", `Value must be a whole number from ${KDF_ITERATIONS} to ${MAX_KDF_ITERATIONS}.`);
+      }
+      if (!isBase64Url(field(kdf, "salt"))) fail("vault.kdf.salt", "Value must be base64url text.");
+    }
+    if (!isBase64Url(field(vault, "wrappedDek"))) fail("vault.wrappedDek", "Value must be base64url text.");
+  }
+  const secrets = field(value, "secrets");
+  if (!Array.isArray(secrets)) {
+    fail("secrets", "Value must be an array.");
+    return issues;
+  }
+  secrets.forEach((secret, index) => {
+    const path = `secrets[${index}]`;
+    if (typeof secret !== "object" || secret === null) {
+      fail(path, "Value must be an object.");
+      return;
+    }
+    const id = field(secret, "id");
+    if (typeof id !== "string" || !id) fail(`${path}.id`, "Value must be a non-empty string.");
+    if (typeof field(secret, "name") !== "string") fail(`${path}.name`, "Value must be a string.");
+    const environmentId = field(secret, "environmentId");
+    if (environmentId !== void 0 && typeof environmentId !== "string")
+      fail(`${path}.environmentId`, "Value must be a string.");
+    const envelope = field(secret, "envelope");
+    if (typeof envelope !== "object" || envelope === null) {
+      fail(`${path}.envelope`, "Value must be an object.");
+      return;
+    }
+    if (!isBase64Url(field(envelope, "iv"))) fail(`${path}.envelope.iv`, "Value must be base64url text.");
+    if (!isBase64Url(field(envelope, "ct"))) fail(`${path}.envelope.ct`, "Value must be base64url text.");
+  });
+  return issues;
 }
 
 // ../core/src/auth/oauth2.ts
@@ -7708,7 +7781,13 @@ var OAuthError = class extends Error {
   name = "OAuthError";
 };
 function oauthTokenKey(auth3) {
-  return JSON.stringify([auth3.grant, auth3.tokenUrl, auth3.clientId, auth3.scope, auth3.grant === "password" ? auth3.username : ""]);
+  return JSON.stringify([
+    auth3.grant,
+    auth3.tokenUrl,
+    auth3.clientId,
+    auth3.scope,
+    auth3.grant === "password" ? auth3.username : ""
+  ]);
 }
 
 // ../core/src/model/collection.ts
@@ -7725,15 +7804,50 @@ function folderChain(folders, folderId) {
   }
   return chain;
 }
-function childrenInOrder(tree, parent) {
-  const entries = [
-    ...tree.folders.filter((folder) => folder.parentFolderId === parent).map((folder) => ({ order: folder.order, kind: 0, id: folder.id, child: { folder } })),
-    ...tree.requests.filter((request) => request.folderId === parent).map((request) => ({ order: request.order, kind: 1, id: request.id, child: { request } }))
+function childrenInOrder(tree) {
+  const byParent = /* @__PURE__ */ new Map();
+  const add = (parent, entry) => {
+    const siblings = byParent.get(parent);
+    if (siblings) siblings.push(entry);
+    else byParent.set(parent, [entry]);
+  };
+  for (const folder of tree.folders)
+    add(folder.parentFolderId, { order: folder.order, kind: 0, id: folder.id, child: { folder } });
+  for (const request of tree.requests)
+    add(request.folderId, { order: request.order, kind: 1, id: request.id, child: { request } });
+  const sorted = new Map(
+    [...byParent].map(([parent, entries]) => [
+      parent,
+      entries.sort((a, b) => a.order - b.order || a.kind - b.kind || a.id.localeCompare(b.id)).map((entry) => entry.child)
+    ])
+  );
+  return (parent) => sorted.get(parent) ?? [];
+}
+function treeInOrder(tree) {
+  const entered = /* @__PURE__ */ new Set();
+  const childrenOf = childrenInOrder(tree);
+  const walk2 = (parent) => childrenOf(parent).flatMap((child) => {
+    if (child.request !== void 0) return [{ kind: "request", request: child.request }];
+    const { folder } = child;
+    if (!folder || entered.has(folder.id)) return [];
+    entered.add(folder.id);
+    return [{ kind: "folder", folder }, ...walk2(folder.id)];
+  });
+  const listed = walk2(void 0);
+  const seen = new Set(listed.map((item) => item.kind === "request" ? item.request : item.folder));
+  return [
+    ...listed,
+    ...tree.folders.filter((folder) => !seen.has(folder)).map((folder) => ({ kind: "folder", folder })),
+    ...tree.requests.filter((request) => !seen.has(request)).map((request) => ({ kind: "request", request }))
   ];
-  return entries.sort((a, b) => a.order - b.order || a.kind - b.kind || a.id.localeCompare(b.id)).map((entry) => entry.child);
 }
 function ancestorsOf(collection, folders, folderId) {
-  const named2 = (kind, { name, variables: variables2, auth: auth3, scripts: scripts2 }) => ({ name: `${kind} "${name}"`, variables: variables2, auth: auth3, scripts: scripts2 });
+  const named2 = (kind, { name, variables: variables2, auth: auth3, scripts: scripts2 }) => ({
+    name: `${kind} "${name}"`,
+    variables: variables2,
+    auth: auth3,
+    scripts: scripts2
+  });
   return [named2("collection", collection), ...folderChain(folders, folderId).map((folder) => named2("folder", folder))];
 }
 var ENVIRONMENTS_FORMAT = "wayfarer/environments";
@@ -7752,7 +7866,15 @@ var RAW_CONTENT_TYPES = {
   javascript: "application/javascript"
 };
 var OAUTH_GRANTS = ["authorization_code", "client_credentials", "password"];
-var AUTH_TYPES = ["inherit", "none", "bearer", "basic", "apikey", "awsv4", "oauth2"];
+var AUTH_TYPES = [
+  "inherit",
+  "none",
+  "bearer",
+  "basic",
+  "apikey",
+  "awsv4",
+  "oauth2"
+];
 var ASSERTION_TARGETS = ["status", "body", "header", "duration"];
 var ASSERTION_OPERATORS = [
   "equals",
@@ -7784,7 +7906,7 @@ function emptyRequest() {
 function isObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function field(object, key) {
+function field2(object, key) {
   return Object.hasOwn(object, key) ? object[key] : void 0;
 }
 var Checker = class {
@@ -7798,12 +7920,12 @@ var Checker = class {
     return null;
   }
   string(object, key, path, optional = false) {
-    const value = field(object, key);
+    const value = field2(object, key);
     if (typeof value === "string" || optional && value === void 0) return;
     this.fail(`${path}.${key}`, "Value must be a string.");
   }
   oneOf(object, key, path, allowed, optional = false) {
-    const value = field(object, key);
+    const value = field2(object, key);
     if (optional && value === void 0 || typeof value === "string" && allowed.includes(value)) return;
     this.fail(`${path}.${key}`, `Value must be one of ${allowed.join(", ")}.`);
   }
@@ -7819,7 +7941,7 @@ var Checker = class {
     });
   }
   enabled(row, rowPath) {
-    if (typeof field(row, "enabled") !== "boolean") {
+    if (typeof field2(row, "enabled") !== "boolean") {
       this.fail(`${rowPath}.enabled`, "Value must be true or false.");
     }
   }
@@ -7828,7 +7950,8 @@ var Checker = class {
       this.string(row, "key", rowPath);
       this.string(row, "value", rowPath);
       this.enabled(row, rowPath);
-      if (Object.hasOwn(row, "json") && (field(row, "json") !== true || !isJsonText(field(row, "value")))) this.fail(`${rowPath}.json`, "Value must be true, on a value that is JSON.");
+      if (Object.hasOwn(row, "json") && (field2(row, "json") !== true || !isJsonText(field2(row, "value"))))
+        this.fail(`${rowPath}.json`, "Value must be true, on a value that is JSON.");
     });
   }
   /** `inherit` is for a request and a folder: a collection has nothing above it. */
@@ -7836,7 +7959,7 @@ var Checker = class {
     const auth3 = this.object(value, path);
     if (!auth3) return;
     this.oneOf(auth3, "type", path, inherit ? AUTH_TYPES : AUTH_TYPES.filter((type2) => type2 !== "inherit"));
-    const type = field(auth3, "type");
+    const type = field2(auth3, "type");
     if (type === "bearer") {
       this.string(auth3, "token", path);
     } else if (type === "basic") {
@@ -7850,9 +7973,11 @@ var Checker = class {
       for (const key of ["accessKey", "secretKey", "sessionToken", "region", "service"]) this.string(auth3, key, path);
     } else if (type === "oauth2") {
       this.oneOf(auth3, "grant", path, OAUTH_GRANTS);
-      for (const key of ["authUrl", "tokenUrl", "clientId", "clientSecret", "scope", "username", "password"]) this.string(auth3, key, path);
+      for (const key of ["authUrl", "tokenUrl", "clientId", "clientSecret", "scope", "username", "password"])
+        this.string(auth3, key, path);
       this.oneOf(auth3, "clientAuth", path, ["header", "body"]);
-      if (typeof field(auth3, "retryOn401") !== "boolean") this.fail(`${path}.retryOn401`, "Value must be true or false.");
+      if (typeof field2(auth3, "retryOn401") !== "boolean")
+        this.fail(`${path}.retryOn401`, "Value must be true or false.");
     }
   }
   scripts(value, path) {
@@ -7875,9 +8000,9 @@ function validateInherited(value, path, kind) {
   const check = new Checker();
   const node = check.object(value, path);
   if (!node) return check.issues;
-  check.auth(field(node, "auth"), `${path}.auth`, kind === "folder");
-  check.scripts(field(node, "scripts"), `${path}.scripts`);
-  if (kind === "folder") check.rows(field(node, "variables"), `${path}.variables`);
+  check.auth(field2(node, "auth"), `${path}.auth`, kind === "folder");
+  check.scripts(field2(node, "scripts"), `${path}.scripts`);
+  if (kind === "folder") check.rows(field2(node, "variables"), `${path}.variables`);
   else check.oneOf(node, "route", path, ["auto", "direct", "bridge"], true);
   return check.issues;
 }
@@ -7885,75 +8010,75 @@ function validateRequestContent(value, path) {
   const check = new Checker();
   const request = check.object(value, path);
   if (!request) return check.issues;
-  const method = field(request, "method");
+  const method = field2(request, "method");
   if (typeof method !== "string" || !isHttpMethod(method)) {
     check.fail(`${path}.method`, "Value must be an HTTP method: one word of at most 32 characters, in upper case.");
   }
-  if (typeof field(request, "url") !== "string" || !field(request, "url").trim()) {
+  if (typeof field2(request, "url") !== "string" || !field2(request, "url").trim()) {
     check.fail(`${path}.url`, "Value must be a non-empty string.");
   }
-  check.rows(field(request, "params"), `${path}.params`);
-  check.rows(field(request, "headers"), `${path}.headers`);
-  const body3 = check.object(field(request, "body"), `${path}.body`);
+  check.rows(field2(request, "params"), `${path}.params`);
+  check.rows(field2(request, "headers"), `${path}.headers`);
+  const body3 = check.object(field2(request, "body"), `${path}.body`);
   if (body3) {
-    const mode = field(body3, "mode");
+    const mode = field2(body3, "mode");
     check.oneOf(body3, "mode", `${path}.body`, BODY_MODES);
-    const part = (name) => field(body3, name) !== void 0 || mode === name ? name : null;
+    const part = (name) => field2(body3, name) !== void 0 || mode === name ? name : null;
     if (part("raw")) {
-      const raw = check.object(field(body3, "raw"), `${path}.body.raw`);
+      const raw = check.object(field2(body3, "raw"), `${path}.body.raw`);
       if (raw) {
         check.oneOf(raw, "language", `${path}.body.raw`, RAW_LANGUAGES);
         check.string(raw, "text", `${path}.body.raw`);
       }
     }
     if (part("urlencoded")) {
-      check.rows(field(body3, "urlencoded"), `${path}.body.urlencoded`);
+      check.rows(field2(body3, "urlencoded"), `${path}.body.urlencoded`);
     }
     if (part("multipart")) {
-      check.list(field(body3, "multipart"), `${path}.body.multipart`, (item, itemPath) => {
+      check.list(field2(body3, "multipart"), `${path}.body.multipart`, (item, itemPath) => {
         check.string(item, "key", itemPath);
         check.enabled(item, itemPath);
         check.oneOf(item, "kind", itemPath, ["text", "file"]);
-        if (field(item, "kind") === "text") check.string(item, "value", itemPath);
-        if (field(item, "kind") === "file") check.fileRef(item, itemPath);
+        if (field2(item, "kind") === "text") check.string(item, "value", itemPath);
+        if (field2(item, "kind") === "file") check.fileRef(item, itemPath);
       });
     }
     if (part("graphql")) {
-      const graphql = check.object(field(body3, "graphql"), `${path}.body.graphql`);
+      const graphql = check.object(field2(body3, "graphql"), `${path}.body.graphql`);
       if (graphql) {
         check.string(graphql, "query", `${path}.body.graphql`);
         check.string(graphql, "variables", `${path}.body.graphql`);
       }
     }
-    if (field(body3, "binary") !== void 0) {
-      const binary = check.object(field(body3, "binary"), `${path}.body.binary`);
+    if (field2(body3, "binary") !== void 0) {
+      const binary = check.object(field2(body3, "binary"), `${path}.body.binary`);
       if (binary) {
         check.fileRef(binary, `${path}.body.binary`);
         check.string(binary, "contentType", `${path}.body.binary`, true);
       }
     }
   }
-  check.auth(field(request, "auth"), `${path}.auth`, true);
-  check.scripts(field(request, "scripts"), `${path}.scripts`);
-  check.list(field(request, "tests"), `${path}.tests`, (test, testPath) => {
+  check.auth(field2(request, "auth"), `${path}.auth`, true);
+  check.scripts(field2(request, "scripts"), `${path}.scripts`);
+  check.list(field2(request, "tests"), `${path}.tests`, (test, testPath) => {
     check.string(test, "id", testPath);
     check.oneOf(test, "target", testPath, ASSERTION_TARGETS);
     check.oneOf(test, "operator", testPath, ASSERTION_OPERATORS);
     check.string(test, "key", testPath, true);
     check.string(test, "expected", testPath, true);
   });
-  const settings = check.object(field(request, "settings"), `${path}.settings`);
+  const settings = check.object(field2(request, "settings"), `${path}.settings`);
   if (settings) {
-    const timeout = field(settings, "timeoutMs");
+    const timeout = field2(settings, "timeoutMs");
     if (timeout !== void 0 && !(typeof timeout === "number" && Number.isFinite(timeout) && timeout >= 0)) {
       check.fail(`${path}.settings.timeoutMs`, "Value must be a number, 0 or more.");
     }
-    const follow = field(settings, "followRedirects");
+    const follow = field2(settings, "followRedirects");
     if (follow !== void 0 && typeof follow !== "boolean") {
       check.fail(`${path}.settings.followRedirects`, "Value must be true or false.");
     }
     check.oneOf(settings, "route", `${path}.settings`, ["auto", "direct", "bridge"], true);
-    const insecure = field(settings, "tlsInsecure");
+    const insecure = field2(settings, "tlsInsecure");
     if (insecure !== void 0 && typeof insecure !== "boolean") {
       check.fail(`${path}.settings.tlsInsecure`, "Value must be true or false.");
     }
@@ -7989,16 +8114,12 @@ function validateCollection(input) {
   if (!Array.isArray(value.folders)) {
     errors.push({ path: "folders", message: "Folders must be an array." });
   } else {
-    value.folders.forEach(
-      (folder, index) => validateFolderDoc(folder, `folders[${index}]`, errors)
-    );
+    value.folders.forEach((folder, index) => validateFolderDoc(folder, `folders[${index}]`, errors));
   }
   if (!Array.isArray(value.requests)) {
     errors.push({ path: "requests", message: "Requests must be an array." });
   } else {
-    value.requests.forEach(
-      (request, index) => validateRequestDoc(request, `requests[${index}]`, errors)
-    );
+    value.requests.forEach((request, index) => validateRequestDoc(request, `requests[${index}]`, errors));
   }
   if (!value.meta) {
     errors.push({ path: "meta", message: "Missing export meta block." });
@@ -8047,25 +8168,14 @@ function buildPlan(payload, duplicate) {
     {
       type: "collection",
       name: payload.collection.name,
-      id: payload.collection.id ?? payload.collection.meta.id,
+      id: payload.collection.meta.id,
       action
     }
   ];
-  for (const folder of payload.folders) {
-    entries.push({
-      type: "folder",
-      name: folder.name,
-      id: folder.id ?? folder.meta.id,
-      action
-    });
-  }
-  for (const request of payload.requests) {
-    entries.push({
-      type: "request",
-      name: request.name || request.url,
-      id: request.id ?? request.meta.id,
-      action
-    });
+  for (const child of treeInOrder(payload)) {
+    entries.push(
+      child.kind === "request" ? { type: "request", name: child.request.name || child.request.url, id: child.request.meta.id, action } : { type: "folder", name: child.folder.name, id: child.folder.meta.id, action }
+    );
   }
   return entries;
 }
@@ -8176,9 +8286,7 @@ function touchMeta(meta) {
   return { ...meta, updatedAt: Date.now() };
 }
 function ensureDocId(doc) {
-  if (!doc.id) {
-    doc.id = doc.meta.id;
-  }
+  doc.id = doc.meta.id;
   return doc;
 }
 
@@ -8242,7 +8350,8 @@ function graphqlPayload(query, variables2) {
   if (!variables2.trim()) return { text: JSON.stringify({ query }) };
   const parsed2 = parseJson(variables2);
   if (!parsed2.ok) return { error: "The GraphQL variables are not JSON." };
-  if (typeof parsed2.value !== "object" || parsed2.value === null || Array.isArray(parsed2.value)) return { error: "The GraphQL variables must be a JSON object." };
+  if (typeof parsed2.value !== "object" || parsed2.value === null || Array.isArray(parsed2.value))
+    return { error: "The GraphQL variables must be a JSON object." };
   return { text: JSON.stringify({ query, variables: parsed2.value }) };
 }
 function graphqlText(query, variables2) {
@@ -8317,7 +8426,10 @@ var Redactor = class {
   }
   /** Headers as sent or received: a credential header's value is masked whole. */
   headers(headers2, options = {}) {
-    return headers2.map(([name, value]) => [this.text(name), !options.credentials && isCredentialHeader(name) ? MASK : this.text(value)]);
+    return headers2.map(([name, value]) => [
+      this.text(name),
+      !options.credentials && isCredentialHeader(name) ? MASK : this.text(value)
+    ]);
   }
   /**
    * Rows of a template (headers, or variables by name): a value typed in for
@@ -8325,7 +8437,10 @@ var Redactor = class {
    * credential but a reference to one, and is kept.
    */
   rows(rows2, options = {}) {
-    return rows2.map((row) => ({ ...row, value: isCredentialHeader(row.key) ? this.credential(row.value, options) : this.text(row.value) }));
+    return rows2.map((row) => ({
+      ...row,
+      value: isCredentialHeader(row.key) ? this.credential(row.value, options) : this.text(row.value)
+    }));
   }
   auth(auth3, options = {}) {
     switch (auth3.type) {
@@ -8336,9 +8451,17 @@ var Redactor = class {
       case "apikey":
         return { ...auth3, value: this.credential(auth3.value, options) };
       case "awsv4":
-        return { ...auth3, secretKey: this.credential(auth3.secretKey, options), sessionToken: this.credential(auth3.sessionToken, options) };
+        return {
+          ...auth3,
+          secretKey: this.credential(auth3.secretKey, options),
+          sessionToken: this.credential(auth3.sessionToken, options)
+        };
       case "oauth2":
-        return { ...auth3, clientSecret: this.credential(auth3.clientSecret, options), password: this.credential(auth3.password, options) };
+        return {
+          ...auth3,
+          clientSecret: this.credential(auth3.clientSecret, options),
+          password: this.credential(auth3.password, options)
+        };
       case "none":
       case "inherit":
         return auth3;
@@ -8359,9 +8482,15 @@ var Redactor = class {
     return {
       ...body3,
       ...body3.raw && { raw: { ...body3.raw, text: this.text(body3.raw.text) } },
-      ...body3.graphql && { graphql: { query: this.text(body3.graphql.query), variables: this.text(body3.graphql.variables) } },
+      ...body3.graphql && {
+        graphql: { query: this.text(body3.graphql.query), variables: this.text(body3.graphql.variables) }
+      },
       ...body3.urlencoded && { urlencoded: body3.urlencoded.map((row) => ({ ...row, value: this.text(row.value) })) },
-      ...body3.multipart && { multipart: body3.multipart.map((part) => part.kind === "text" ? { ...part, value: this.text(part.value) } : part) }
+      ...body3.multipart && {
+        multipart: body3.multipart.map(
+          (part) => part.kind === "text" ? { ...part, value: this.text(part.value) } : part
+        )
+      }
     };
   }
   credential(value, options) {
@@ -8375,6 +8504,53 @@ function isCurlCommand(text3) {
   return /^\s*curl(\.exe)?(\s|$)/i.test(text3);
 }
 
+// ../core/src/import/script-scan.ts
+var START = String.raw`(?<![\w$.])`;
+var escape = (text3) => text3.replace(/[.*+?^${}()|[\]\\/]/g, "\\$&");
+var member = (name) => ({
+  api: name,
+  finds: [[name, new RegExp(`${START}${escape(name)}(?![\\w$])`)]]
+});
+var required = (module) => [
+  `require('${module}')`,
+  new RegExp(`${START}require\\(\\s*["']${escape(module)}["']\\s*\\)`)
+];
+var called = (name) => [name, new RegExp(`${START}${escape(name)}\\s*\\(`)];
+var used = (name) => [name, new RegExp(`${START}${escape(name)}\\s*[.(]`)];
+var SCRIPT_SCAN = [
+  ...[
+    "pm.cookies.get",
+    "pm.cookies.has",
+    "pm.cookies.toObject",
+    "pm.cookies.jar",
+    "pm.visualizer.set",
+    "pm.vault.get",
+    "pm.require",
+    "postman.getResponseCookie"
+  ].map(member),
+  {
+    api: "legacy library globals (_, CryptoJS, tv4, cheerio, xml2Json, Backbone)",
+    finds: ["tv4", "cheerio", "xml2Json", "Backbone"].map(used)
+  },
+  {
+    api: "clearTimeout, setInterval, clearInterval",
+    finds: ["clearTimeout", "setInterval", "clearInterval"].map(called)
+  },
+  ...["ajv", "cheerio", "csv-parse/lib/sync", "postman-collection", "tv4", "xml2js"].map((module) => ({
+    api: `require('${module}')`,
+    finds: [required(module)]
+  })),
+  {
+    api: "require of a Node module (buffer, events, path, querystring, stream, string_decoder, timers, url, util)",
+    finds: ["buffer", "events", "path", "querystring", "stream", "string_decoder", "timers", "url", "util"].map(
+      required
+    )
+  }
+];
+function unsupportedApis(script) {
+  return SCRIPT_SCAN.flatMap((entry) => entry.finds).filter(([, pattern]) => pattern.test(script)).map(([label]) => label);
+}
+
 // ../core/src/model/variables.ts
 var SECRET_REFERENCE = /^\s*\{\{\s*\$secret\.[a-z0-9-]+\s*\}\}\s*$/i;
 function protectedSecretId(value) {
@@ -8382,10 +8558,11 @@ function protectedSecretId(value) {
 }
 function applyVariableChanges(rows2, changes) {
   let next = rows2;
-  for (const { key, value, keepSecret, json } of changes) {
-    const made = () => ({ key, value: value ?? "", enabled: true, ...json && { json } });
+  for (const { key, value, keepSecret, json, enabled } of changes) {
+    const made = () => ({ key, value: value ?? "", enabled: enabled ?? true, ...json && { json } });
     const first = next.findIndex((row) => row.key === key);
-    if (value !== null && keepSecret && next.some((row) => row.key === key && SECRET_REFERENCE.test(row.value))) continue;
+    if (value !== null && keepSecret && next.some((row) => row.key === key && SECRET_REFERENCE.test(row.value)))
+      continue;
     if (value === null) {
       next = next.filter((row) => row.key !== key);
     } else if (first === -1) {
@@ -8401,122 +8578,11 @@ function variablesByName(rows2) {
 }
 function scriptVariables(rows2) {
   const byName = /* @__PURE__ */ new Map();
-  for (const row of rows2) if (row.enabled && row.key) byName.set(row.key, row.json ? [row.key, row.value, true] : [row.key, row.value]);
+  for (const row of rows2)
+    if (row.enabled && row.key) byName.set(row.key, row.json ? [row.key, row.value, true] : [row.key, row.value]);
   return [...byName.values()];
 }
 
-// ../core/src/vault/vault-crypto.ts
-var KDF_ITERATIONS = 6e5;
-var MAX_KDF_ITERATIONS = 1e7;
-var IV_BYTES = 12;
-var AES = { name: "AES-GCM", length: 256 };
-var VAULT_FILE_FORMAT = "wayfarer/vault";
-function fromBase64Url(text3) {
-  const binary = atob(text3.replace(/-/g, "+").replace(/_/g, "/"));
-  return Uint8Array.from(binary, (char) => char.charCodeAt(0));
-}
-var utf82 = (text3) => new TextEncoder().encode(text3);
-async function deriveKek(passphrase, kdf) {
-  if (!crypto.subtle) {
-    throw new Error("The vault needs a secure page: open Wayfarer over https or on localhost.");
-  }
-  const material = await crypto.subtle.importKey("raw", utf82(passphrase), "PBKDF2", false, ["deriveKey"]);
-  return crypto.subtle.deriveKey(
-    { name: "PBKDF2", salt: fromBase64Url(kdf.salt), iterations: kdf.iterations, hash: "SHA-256" },
-    material,
-    AES,
-    false,
-    ["wrapKey", "unwrapKey"]
-  );
-}
-async function unwrap(record, passphrase, extractable) {
-  const bytes = fromBase64Url(record.wrappedDek);
-  const kek = await deriveKek(passphrase, record.kdf);
-  try {
-    return await crypto.subtle.unwrapKey(
-      "raw",
-      bytes.slice(IV_BYTES),
-      kek,
-      { name: "AES-GCM", iv: bytes.slice(0, IV_BYTES) },
-      AES,
-      extractable,
-      ["encrypt", "decrypt"]
-    );
-  } catch (error) {
-    if (error instanceof Error && error.name === "OperationError") return null;
-    throw error;
-  }
-}
-function unwrapDek(record, passphrase) {
-  return unwrap(record, passphrase, false);
-}
-async function decryptSecret(dek, id, envelope) {
-  const plain = await crypto.subtle.decrypt(
-    { name: "AES-GCM", iv: fromBase64Url(envelope.iv), additionalData: utf82(id) },
-    dek,
-    fromBase64Url(envelope.ct)
-  );
-  return new TextDecoder().decode(plain);
-}
-function field2(value, key) {
-  return typeof value === "object" && value !== null && Object.hasOwn(value, key) ? value[key] : void 0;
-}
-var isBase64Url = (value) => typeof value === "string" && /^[\w-]+$/.test(value);
-function validateVaultFile(value) {
-  const issues = [];
-  const fail = (path, message) => issues.push({ path, message });
-  if (typeof value !== "object" || value === null) {
-    fail("$", "Value must be an object.");
-    return issues;
-  }
-  if (field2(value, "$id") !== VAULT_FILE_FORMAT) {
-    fail("$id", `Not a Wayfarer vault file: "$id" must be "${VAULT_FILE_FORMAT}".`);
-    return issues;
-  }
-  const vault = field2(value, "vault");
-  if (typeof vault !== "object" || vault === null) {
-    fail("vault", "Value must be an object.");
-  } else {
-    const kdf = field2(vault, "kdf");
-    if (typeof kdf !== "object" || kdf === null) {
-      fail("vault.kdf", "Value must be an object.");
-    } else {
-      if (field2(kdf, "alg") !== "PBKDF2-SHA256") fail("vault.kdf.alg", 'Value must be "PBKDF2-SHA256".');
-      const iterations = field2(kdf, "iterations");
-      if (!(Number.isInteger(iterations) && iterations >= KDF_ITERATIONS && iterations <= MAX_KDF_ITERATIONS)) {
-        fail("vault.kdf.iterations", `Value must be a whole number from ${KDF_ITERATIONS} to ${MAX_KDF_ITERATIONS}.`);
-      }
-      if (!isBase64Url(field2(kdf, "salt"))) fail("vault.kdf.salt", "Value must be base64url text.");
-    }
-    if (!isBase64Url(field2(vault, "wrappedDek"))) fail("vault.wrappedDek", "Value must be base64url text.");
-  }
-  const secrets = field2(value, "secrets");
-  if (!Array.isArray(secrets)) {
-    fail("secrets", "Value must be an array.");
-    return issues;
-  }
-  secrets.forEach((secret, index) => {
-    const path = `secrets[${index}]`;
-    if (typeof secret !== "object" || secret === null) {
-      fail(path, "Value must be an object.");
-      return;
-    }
-    const id = field2(secret, "id");
-    if (typeof id !== "string" || !id) fail(`${path}.id`, "Value must be a non-empty string.");
-    if (typeof field2(secret, "name") !== "string") fail(`${path}.name`, "Value must be a string.");
-    const environmentId = field2(secret, "environmentId");
-    if (environmentId !== void 0 && typeof environmentId !== "string") fail(`${path}.environmentId`, "Value must be a string.");
-    const envelope = field2(secret, "envelope");
-    if (typeof envelope !== "object" || envelope === null) {
-      fail(`${path}.envelope`, "Value must be an object.");
-      return;
-    }
-    if (!isBase64Url(field2(envelope, "iv"))) fail(`${path}.envelope.iv`, "Value must be base64url text.");
-    if (!isBase64Url(field2(envelope, "ct"))) fail(`${path}.envelope.ct`, "Value must be base64url text.");
-  });
-  return issues;
-}
-
 // ../core/src/variables/resolver.ts
 var VARIABLE_SCOPES = ["local", "data", "environment", "folder", "collection", "global"];
 var MAX_VARIABLE_DEPTH = 10;
@@ -8565,6 +8631,12 @@ var VariableResolver = class {
   unresolved = /* @__PURE__ */ new Set();
   /** Ids of secrets that were referenced and not given. */
   lockedSecrets = /* @__PURE__ */ new Set();
+  /**
+   * Each variable whose value was a secret that was given, by name, with the
+   * scope it was found in. A reference written into a text itself is named
+   * as written, with no scope.
+   */
+  vaulted = /* @__PURE__ */ new Map();
   scopes;
   /** `text` with its variables replaced. Throws `VariableNestingError`. */
   resolve(text3) {
@@ -8577,7 +8649,8 @@ var VariableResolver = class {
       ...this.tokensOf(row.value, "header", `header-${index}-value`)
     ]);
     const body3 = (payload.body ?? []).flatMap((text3, index) => this.tokensOf(text3, "body", `body-${index}`));
-    return [...this.tokensOf(payload.url ?? "", "url", "endpoint"), ...header, ...body3];
+    const auth3 = (payload.auth ?? []).flatMap((text3, index) => this.tokensOf(text3, "auth", `auth-${index}`));
+    return [...this.tokensOf(payload.url ?? "", "url", "endpoint"), ...header, ...body3, ...auth3];
   }
   tokensOf(text3, location, field4) {
     const names = new Set([...text3.matchAll(PLACEHOLDER)].map((match) => match[1].trim()));
@@ -8588,6 +8661,7 @@ var VariableResolver = class {
     if (DYNAMIC.has(name)) return { source: "dynamic" };
     const found = this.find(name);
     if (!found) return { source: "missing" };
+    if (SECRET_REFERENCE.test(found.value)) return { source: found.scope, vaulted: true };
     try {
       return { source: found.scope, value: this.expand(found.value, [name]) };
     } catch (error) {
@@ -8614,6 +8688,8 @@ var VariableResolver = class {
           return written;
         }
         this.taint.add(plaintext);
+        const holder = chain.at(-1);
+        this.vaulted.set(holder ?? written, holder === void 0 ? void 0 : this.find(holder)?.scope);
         return plaintext;
       }
       const dynamic = DYNAMIC.get(name);
@@ -8644,6 +8720,80 @@ function withJarCookies(headers2, cookies) {
   return headers2.map((header, index) => index === at ? [header[0], `${header[1]}; ${cookieHeader(added2)}`] : header);
 }
 
+// ../core/src/send/record.ts
+function formatDuration(ms) {
+  if (ms === void 0 || ms === null || !(ms >= 0)) return "\u2014";
+  if (ms > 0 && ms < 0.5) return "<1 ms";
+  if (Math.round(ms) < 1e3) return `${Math.round(ms)} ms`;
+  return `${(ms / 1e3).toFixed(1)} s`;
+}
+var isFields = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var SCOPE_NAMES = VARIABLE_SCOPES;
+var FAILURE_KINDS = ["network", "timeout", "aborted", "bridge"];
+function recordProblems(value, path) {
+  const problems = [];
+  const object = (at, held, fields) => {
+    if (!isFields(held)) {
+      problems.push(`${at}: Value must be an object.`);
+      return;
+    }
+    for (const key of Object.keys(held))
+      if (!Object.hasOwn(fields, key)) problems.push(`${at}.${key}: The app writes no such field.`);
+    for (const [key, check] of Object.entries(fields)) {
+      const field4 = Object.hasOwn(held, key) ? held[key] : void 0;
+      if (!check(field4, `${at}.${key}`)) problems.push(`${at}.${key}: Value is not one the app writes.`);
+    }
+  };
+  const optional = (check) => (field4, where) => field4 === void 0 || check(field4, where);
+  const text3 = (field4) => typeof field4 === "string";
+  const yes = (field4) => field4 === true;
+  const flag2 = (field4) => typeof field4 === "boolean";
+  const texts = (field4) => Array.isArray(field4) && field4.every(text3);
+  const nested = (fields) => (field4, where) => {
+    object(where, field4, fields);
+    return true;
+  };
+  object(path, value, {
+    status: optional(
+      nested({
+        code: (field4) => Number.isInteger(field4) && field4 >= 0 && field4 <= 999,
+        text: text3
+      })
+    ),
+    durationMs: (field4) => typeof field4 === "number" && Number.isFinite(field4) && field4 >= 0,
+    route: (field4) => field4 === "direct" || field4 === "bridge",
+    unpaired: optional(yes),
+    host: text3,
+    secrets: (field4, where) => {
+      if (!Array.isArray(field4)) return false;
+      field4.forEach(
+        (secret, index) => object(`${where}[${index}]`, secret, {
+          name: text3,
+          scope: optional((scope) => typeof scope === "string" && SCOPE_NAMES.includes(scope)),
+          holder: optional(text3)
+        })
+      );
+      return true;
+    },
+    masked: nested({
+      address: optional(yes),
+      headers: texts,
+      body: optional(yes),
+      responseHeaders: texts,
+      responseBody: optional(yes)
+    }),
+    kept: nested({ response: flag2, body: flag2, quoteLeftOut: optional(yes) }),
+    failure: optional(
+      nested({
+        kind: (field4) => typeof field4 === "string" && FAILURE_KINDS.includes(field4),
+        reported: text3,
+        summary: text3
+      })
+    )
+  });
+  return problems;
+}
+
 // ../core/src/transport/sse.ts
 var SseParser = class {
   rest = "";
@@ -8692,13 +8842,15 @@ var SseParser = class {
 // ../core/src/transport/transport.ts
 var STREAM_BODY_BYTES = 1024 * 1024;
 var TransportError = class extends Error {
-  constructor(kind, message, status) {
+  constructor(kind, message, status, responded = false) {
     super(message);
     this.kind = kind;
     this.status = status;
+    this.responded = responded;
   }
   kind;
   status;
+  responded;
   name = "TransportError";
 };
 var DISPLAY_CAP_BYTES = 50 * 1024 * 1024;
@@ -8708,23 +8860,30 @@ async function withDeadline(options, run) {
   const cancel = () => controller.abort();
   if (options.signal.aborted) cancel();
   options.signal.addEventListener("abort", cancel);
-  const timer = options.timeoutMs > 0 ? setTimeout(() => {
-    timedOut = true;
-    controller.abort();
-  }, options.timeoutMs) : void 0;
+  const timer = options.timeoutMs > 0 ? setTimeout(
+    () => {
+      timedOut = true;
+      controller.abort();
+    },
+    Math.min(options.timeoutMs, 2 ** 31 - 1)
+  ) : void 0;
   try {
     return await run(controller.signal, () => clearTimeout(timer));
   } catch (cause) {
     if (cause instanceof TransportError) throw cause;
-    if (timedOut) throw new TransportError("timeout", `Timed out after ${options.timeoutMs} ms`);
-    if (options.signal.aborted) throw new TransportError("aborted", "The request was cancelled.");
+    if (timedOut)
+      throw new TransportError(
+        "timeout",
+        `No response within ${formatDuration(options.timeoutMs)}, the request timeout.`
+      );
+    if (options.signal.aborted) throw new TransportError("aborted", "You stopped the request.");
     throw new TransportError("network", networkMessage(cause));
   } finally {
     clearTimeout(timer);
     options.signal.removeEventListener("abort", cancel);
   }
 }
-async function readBody(response, cap = DISPLAY_CAP_BYTES) {
+async function readBody2(response, cap = DISPLAY_CAP_BYTES) {
   if (!response.body) return response.arrayBuffer();
   const reader2 = response.body.getReader();
   let chunks = [];
@@ -8758,7 +8917,7 @@ async function readEventStream(response, signal, onEvent) {
   const kept = new Uint8Array(STREAM_BODY_BYTES);
   let size = 0;
   let truncated = false;
-  let stopped = false;
+  let stopped2 = false;
   const reader2 = response.body?.getReader();
   try {
     for (; ; ) {
@@ -8768,13 +8927,14 @@ async function readEventStream(response, signal, onEvent) {
       kept.set(chunk.value.subarray(0, room), size);
       size += Math.min(room, chunk.value.byteLength);
       if (chunk.value.byteLength > room) truncated = true;
-      for (const event of parser.push(decoder.decode(chunk.value, { stream: true }))) onEvent({ ...event, timeMs: Date.now() - started });
+      for (const event of parser.push(decoder.decode(chunk.value, { stream: true })))
+        onEvent({ ...event, timeMs: Date.now() - started });
     }
   } catch (error) {
     if (!signal.aborted) throw error;
-    stopped = true;
+    stopped2 = true;
   }
-  return { body: kept.slice(0, size).buffer, stream: { stopped, ...truncated && { truncated } } };
+  return { body: kept.slice(0, size).buffer, stream: { stopped: stopped2, ...truncated && { truncated } } };
 }
 function networkMessage(cause) {
   if (!(cause instanceof Error)) return String(cause);
@@ -8791,7 +8951,8 @@ var FetchTransport = class {
   fetchFn;
   displayCap;
   send(request, options) {
-    return withDeadline(options, async (signal, arrived) => {
+    let responded = false;
+    const sent = withDeadline(options, async (signal, arrived) => {
       const response = await this.fetchFn(request.url, {
         method: request.method,
         headers: request.headers,
@@ -8802,9 +8963,10 @@ var FetchTransport = class {
         redirect: "follow",
         signal
       });
+      responded = true;
       const { onEvent } = options;
       const events = onEvent && /^text\/event-stream\b/i.test(response.headers.get("content-type") ?? "") ? (arrived(), await readEventStream(response, signal, onEvent)) : void 0;
-      const body3 = events?.body ?? await readBody(response, this.displayCap);
+      const body3 = events?.body ?? await readBody2(response, this.displayCap);
       return {
         status: response.status,
         statusText: response.statusText,
@@ -8817,6 +8979,11 @@ var FetchTransport = class {
         ...events && { stream: events.stream }
       };
     });
+    return sent.catch((error) => {
+      if (responded && error instanceof TransportError && error.kind === "network")
+        throw new TransportError("network", error.message, void 0, true);
+      throw error;
+    });
   }
 };
 
@@ -9519,7 +9686,7 @@ var _HMAC = class {
     this.iHash.destroy();
   }
 };
-var hmac2 = /* @__PURE__ */ (() => {
+var hmac = /* @__PURE__ */ (() => {
   const hmac_ = ((hash, key, message) => new _HMAC(hash, key).update(message).digest());
   hmac_.create = (hash, key) => new _HMAC(hash, key);
   return hmac_;
@@ -9963,18 +10130,19 @@ var _SHA256 = class extends SHA2_32B {
     super(32, SHA256_IV);
   }
 };
-var sha2562 = /* @__PURE__ */ createHasher(
+var sha256 = /* @__PURE__ */ createHasher(
   () => new _SHA256(),
   /* @__PURE__ */ oidNist(1)
 );
 
 // ../core/src/scripting/vm-crypto.ts
-var HASHES = { MD5: md5, SHA1: sha1, SHA256: sha2562 };
+var HASHES = { MD5: md5, SHA1: sha1, SHA256: sha256 };
 var isVmHash = (name) => Object.hasOwn(HASHES, name);
 var VM_ENCODINGS = ["utf8", "hex", "base64"];
 function fromWords(json) {
   const list4 = JSON.parse(json);
-  if (!Array.isArray(list4) || !list4.every((entry) => typeof entry === "number")) throw new TypeError("Expected a WordArray.");
+  if (!Array.isArray(list4) || !list4.every((entry) => typeof entry === "number"))
+    throw new TypeError("Expected a WordArray.");
   const [length, ...words] = list4;
   const bytes = new Uint8Array(Math.max(0, Math.min(length, words.length * 4)));
   for (let i = 0; i < bytes.length; i++) bytes[i] = words[i >>> 2] >>> 24 - i % 4 * 8 & 255;
@@ -9994,11 +10162,14 @@ function vmHash(name, format, payload) {
   return toWords(HASHES[name](bytesOf(format, payload)));
 }
 function vmHmac(name, keyFormat, key, format, payload) {
-  return toWords(hmac2(HASHES[name], bytesOf(keyFormat, key), bytesOf(format, payload)));
+  return toWords(hmac(HASHES[name], bytesOf(keyFormat, key), bytesOf(format, payload)));
 }
 function vmEncode(encoding, text3) {
   if (encoding === "utf8") return toWords(new TextEncoder().encode(text3));
-  if (encoding === "hex") return toWords(Uint8Array.from({ length: text3.length >>> 1 }, (_, i) => parseInt(text3.slice(i * 2, i * 2 + 2), 16) || 0));
+  if (encoding === "hex")
+    return toWords(
+      Uint8Array.from({ length: text3.length >>> 1 }, (_, i) => parseInt(text3.slice(i * 2, i * 2 + 2), 16) || 0)
+    );
   return toWords(Uint8Array.from(atob(text3.replace(/=+$/, "")), (char) => char.charCodeAt(0)));
 }
 function vmDecode(encoding, words) {
@@ -10014,7 +10185,9 @@ function vmDecode(encoding, words) {
 }
 function vmRandom(count) {
   if (!Number.isInteger(count) || count < 0 || count > 65536) throw new RangeError("Expected up to 65536 bytes.");
-  return Array.from(crypto.getRandomValues(new Uint8Array(count)), (byte) => byte.toString(16).padStart(2, "0")).join("");
+  return Array.from(crypto.getRandomValues(new Uint8Array(count)), (byte) => byte.toString(16).padStart(2, "0")).join(
+    ""
+  );
 }
 
 // ../core/src/scripting/host.ts
@@ -10039,7 +10212,10 @@ var SCRIPT_LIMITS = {
 var WASM_PAGE = 65536;
 var ENGINE_INITIAL_PAGES = 256;
 function scriptMemory(limits = SCRIPT_LIMITS) {
-  return { initial: ENGINE_INITIAL_PAGES, maximum: Math.max(ENGINE_INITIAL_PAGES, Math.floor(limits.memoryBytes / WASM_PAGE)) };
+  return {
+    initial: ENGINE_INITIAL_PAGES,
+    maximum: Math.max(ENGINE_INITIAL_PAGES, Math.floor(limits.memoryBytes / WASM_PAGE))
+  };
 }
 var LOG_TRUNCATED = "[console output truncated]";
 function emptyChanges() {
@@ -10054,9 +10230,30 @@ async function runScript(quickjs, source, context, limits = SCRIPT_LIMITS, servi
   const scope = (rows2 = []) => new Map(rows2.map(([name, value]) => [name, value]));
   const marked = (rows2 = []) => new Set(rows2.filter(([, value, json]) => json === true && isJsonText(value)).map(([name]) => name));
   const state = {
-    values: { local: scope(), data: scope(context.data), environment: scope(context.environment), folder: scope(context.folder), collection: scope(context.collection), global: scope(context.globals) },
-    json: { local: marked(), data: marked(context.data), environment: marked(context.environment), folder: marked(context.folder), collection: marked(context.collection), global: marked(context.globals) },
-    changes: { local: /* @__PURE__ */ new Map(), data: /* @__PURE__ */ new Map(), environment: /* @__PURE__ */ new Map(), folder: /* @__PURE__ */ new Map(), collection: /* @__PURE__ */ new Map(), global: /* @__PURE__ */ new Map() },
+    values: {
+      local: scope(),
+      data: scope(context.data),
+      environment: scope(context.environment),
+      folder: scope(context.folder),
+      collection: scope(context.collection),
+      global: scope(context.globals)
+    },
+    json: {
+      local: marked(),
+      data: marked(context.data),
+      environment: marked(context.environment),
+      folder: marked(context.folder),
+      collection: marked(context.collection),
+      global: marked(context.globals)
+    },
+    changes: {
+      local: /* @__PURE__ */ new Map(),
+      data: /* @__PURE__ */ new Map(),
+      environment: /* @__PURE__ */ new Map(),
+      folder: /* @__PURE__ */ new Map(),
+      collection: /* @__PURE__ */ new Map(),
+      global: /* @__PURE__ */ new Map()
+    },
     sends: 0,
     inFlight: 0,
     answers: [],
@@ -10066,7 +10263,11 @@ async function runScript(quickjs, source, context, limits = SCRIPT_LIMITS, servi
     tests: [],
     timers: /* @__PURE__ */ new Map()
   };
-  const changed = (name) => [...state.changes[name]].map(([key, value]) => ({ key, value, ...value !== null && state.json[name].has(key) && { json: true } }));
+  const changed = (name) => [...state.changes[name]].map(([key, value]) => ({
+    key,
+    value,
+    ...value !== null && state.json[name].has(key) && { json: true }
+  }));
   const result = (error, limit) => ({
     logs: state.logs,
     changes: { environment: changed("environment"), collection: changed("collection"), global: changed("global") },
@@ -10086,7 +10287,8 @@ async function runScript(quickjs, source, context, limits = SCRIPT_LIMITS, servi
   try {
     failure = await evaluate(vm, runtime, source, context, state, deadline, limits, services);
   } catch (error) {
-    if (error instanceof RangeError || error instanceof Error && error.name === "InternalError") return result(void 0, "stack");
+    if (error instanceof RangeError || error instanceof Error && error.name === "InternalError")
+      return result(void 0, "stack");
     throw error;
   }
   vm.dispose();
@@ -10099,8 +10301,17 @@ async function evaluate(vm, runtime, source, context, state, deadline, limits, s
       if (Date.now() >= deadline.at) return { message: "", limit: "timeout" };
       const kind = vm.typeof(error);
       if (kind === "string") return { message: vm.getString(error) };
+      if (kind === "number" || kind === "boolean" || kind === "undefined") return { message: String(vm.dump(error)) };
       if (kind !== "object") return { message: "Script failed." };
-      if (vm.sameValue(error, vm.null)) return { message: "", limit: "memory" };
+      if (vm.sameValue(error, vm.null)) {
+        const probe = vm.evalCode("({})");
+        if (probe.error) {
+          probe.error.dispose();
+          return { message: "", limit: "memory" };
+        }
+        probe.value.dispose();
+        return { message: "null" };
+      }
       const name = property(vm, error, "name");
       const message = property(vm, error, "message") ?? "Script failed.";
       if (name === "InternalError" && message === "out of memory") return { message, limit: "memory" };
@@ -10130,7 +10341,8 @@ async function evaluate(vm, runtime, source, context, state, deadline, limits, s
   };
   const charge = (...written) => {
     state.written += written.reduce((sum, part) => sum + part.length, 0);
-    if (state.written > limits.maxOutputBytes) throw new RangeError("Script wrote too many test results and variables.");
+    if (state.written > limits.maxOutputBytes)
+      throw new RangeError("Script wrote too many test results and variables.");
   };
   const scopeOf = (handle) => {
     const name = text3(handle);
@@ -10153,7 +10365,9 @@ async function evaluate(vm, runtime, source, context, state, deadline, limits, s
   });
   bind("varHas", (where, key) => lookUp(where, text3(key)) === void 0 ? vm.false : vm.true);
   bind("varAll", (where) => {
-    const of2 = (name) => [...state.values[name]].map(([key, value]) => `[${JSON.stringify(key)},${state.json[name].has(key) ? value : JSON.stringify(value)}]`);
+    const of2 = (name) => [...state.values[name]].map(
+      ([key, value]) => `[${JSON.stringify(key)},${state.json[name].has(key) ? value : JSON.stringify(value)}]`
+    );
     const entries = any(where) ? [...VARIABLE_ORDER].reverse().flatMap(of2) : of2(scopeOf(where));
     return vm.newString(`[${entries.join(",")}]`);
   });
@@ -10219,7 +10433,8 @@ async function evaluate(vm, runtime, source, context, state, deadline, limits, s
     const id = text3(name);
     const source2 = services.libraries?.get(id);
     if (source2 !== void 0) return vm.newString(source2);
-    if (VM_LIBRARIES.includes(id)) throw new Error(`require('${id}'): write the module's name out in the script, as require('${id}')`);
+    if (VM_LIBRARIES.includes(id))
+      throw new Error(`require('${id}'): write the module's name out in the script, as require('${id}')`);
     return void 0;
   });
   const hash = (handle) => {
@@ -10234,7 +10449,10 @@ async function evaluate(vm, runtime, source, context, state, deadline, limits, s
     return found;
   };
   bind("hash", (name, format, payload) => vm.newString(vmHash(hash(name), text3(format), text3(payload))));
-  bind("hmac", (name, keyFormat, key, format, payload) => vm.newString(vmHmac(hash(name), text3(keyFormat), text3(key), text3(format), text3(payload))));
+  bind(
+    "hmac",
+    (name, keyFormat, key, format, payload) => vm.newString(vmHmac(hash(name), text3(keyFormat), text3(key), text3(format), text3(payload)))
+  );
   bind("encode", (name, value) => vm.newString(vmEncode(encoding(name), text3(value))));
   bind("decode", (name, words) => vm.newString(vmDecode(encoding(name), text3(words))));
   bind("random", (count) => vm.newString(vmRandom(number(count))));
@@ -10258,7 +10476,10 @@ async function evaluate(vm, runtime, source, context, state, deadline, limits, s
     state.answers.push([call, ok, JSON.stringify(value)]);
     state.wake?.();
   };
-  const refused = (error) => ({ name: error instanceof Error ? error.name : "Error", message: error instanceof Error ? error.message : String(error) });
+  const refused = (error) => ({
+    name: error instanceof Error ? error.name : "Error",
+    message: error instanceof Error ? error.message : String(error)
+  });
   bind("sendFailed", (call, name, message) => {
     answer(number(call), false, { name: text3(name), message: text3(message) });
     return void 0;
@@ -10267,7 +10488,10 @@ async function evaluate(vm, runtime, source, context, state, deadline, limits, s
     const [id, body3] = [number(call), text3(json)];
     state.sends++;
     if (state.sends > limits.maxSendRequests) {
-      answer(id, false, { name: "Error", message: `pm.sendRequest: a script may make ${limits.maxSendRequests} requests, and this is one more.` });
+      answer(id, false, {
+        name: "Error",
+        message: `pm.sendRequest: a script may make ${limits.maxSendRequests} requests, and this is one more.`
+      });
       return void 0;
     }
     const send = services.send;
@@ -10370,12 +10594,15 @@ async function evaluate(vm, runtime, source, context, state, deadline, limits, s
   }
 }
 var VARIABLE_ORDER = VARIABLE_SCOPES;
-var isPairs = (value) => Array.isArray(value) && value.every((pair) => Array.isArray(pair) && pair.length === 2 && typeof pair[0] === "string" && typeof pair[1] === "string");
+var isPairs = (value) => Array.isArray(value) && value.every(
+  (pair) => Array.isArray(pair) && pair.length === 2 && typeof pair[0] === "string" && typeof pair[1] === "string"
+);
 function parsed(json) {
   const value = JSON.parse(json);
   if (value === null || typeof value !== "object" || Array.isArray(value)) throw new TypeError("Expected a request.");
   const request = value;
-  if (typeof request["method"] !== "string" || !isHttpMethod(request["method"])) throw new TypeError("The request's method is not an HTTP method.");
+  if (typeof request["method"] !== "string" || !isHttpMethod(request["method"]))
+    throw new TypeError("The request's method is not an HTTP method.");
   if (typeof request["url"] !== "string" || !request["url"].trim()) throw new TypeError("The request has no address.");
   if (!isPairs(request["headers"])) throw new TypeError("The request's headers are not a list of names and values.");
   return request;
@@ -10384,15 +10611,26 @@ function sendRequest(json) {
   const request = parsed(json);
   const body3 = request["body"];
   if (body3 !== void 0 && typeof body3 !== "string") throw new TypeError("The request's body is not text.");
-  return { method: request["method"], url: request["url"], headers: request["headers"], ...body3 !== void 0 && { body: body3 } };
+  return {
+    method: request["method"],
+    url: request["url"],
+    headers: request["headers"],
+    ...body3 !== void 0 && { body: body3 }
+  };
 }
 function scriptRequest(json) {
   const request = parsed(json);
   const body3 = request["body"];
-  const base = { method: request["method"], url: request["url"], headers: request["headers"] };
+  const base = {
+    method: request["method"],
+    url: request["url"],
+    headers: request["headers"]
+  };
   if (body3?.mode === "raw" && typeof body3.raw === "string") return { ...base, body: { mode: "raw", raw: body3.raw } };
-  if (body3?.mode === "urlencoded" && isPairs(body3.urlencoded)) return { ...base, body: { mode: "urlencoded", urlencoded: body3.urlencoded } };
-  if (body3?.mode === "none" || body3?.mode === "multipart" || body3?.mode === "binary") return { ...base, body: { mode: body3.mode } };
+  if (body3?.mode === "urlencoded" && isPairs(body3.urlencoded))
+    return { ...base, body: { mode: "urlencoded", urlencoded: body3.urlencoded } };
+  if (body3?.mode === "none" || body3?.mode === "multipart" || body3?.mode === "binary")
+    return { ...base, body: { mode: body3.mode } };
   throw new TypeError("The request's body is not one a script can set.");
 }
 function property(vm, object, name) {
@@ -10404,25 +10642,6 @@ function property(vm, object, name) {
   }
 }
 
-// ../core/src/scripting/request-view.ts
-function scriptRequestOf(content) {
-  const rows2 = (list4) => list4.filter((row) => row.enabled && row.key).map((row) => [row.key, row.value]);
-  const { body: body3 } = content;
-  const seen = body3.mode === "raw" ? { mode: "raw", raw: body3.raw?.text ?? "" } : body3.mode === "graphql" ? { mode: "raw", raw: graphqlText(body3.graphql?.query ?? "", body3.graphql?.variables ?? "") } : body3.mode === "urlencoded" ? { mode: "urlencoded", urlencoded: rows2(body3.urlencoded ?? []) } : { mode: body3.mode };
-  return { method: content.method, url: content.url, headers: rows2(content.headers), body: seen };
-}
-function withScriptRequest(content, request) {
-  const rows2 = (pairs2) => pairs2.map(([key, value]) => ({ key, value, enabled: true }));
-  const untouched = content.body.mode === "graphql" && request.body.mode === "raw" && request.body.raw === graphqlText(content.body.graphql?.query ?? "", content.body.graphql?.variables ?? "");
-  const body3 = untouched ? content.body : request.body.mode === "raw" ? { ...content.body, mode: "raw", raw: { language: content.body.mode === "graphql" ? "json" : content.body.raw?.language ?? "text", text: request.body.raw } } : request.body.mode === "urlencoded" ? { ...content.body, mode: "urlencoded", urlencoded: rows2(request.body.urlencoded) } : content.body;
-  return { ...content, method: request.method, url: request.url, headers: rows2(request.headers), body: body3 };
-}
-function sentScriptRequest(content, sent) {
-  const { mode } = content.body;
-  const body3 = mode === "multipart" || mode === "binary" ? { mode } : sent.body === void 0 ? { mode: "none" } : mode === "urlencoded" ? { mode, urlencoded: [...new URLSearchParams(sent.body)] } : { mode: "raw", raw: sent.body };
-  return { method: sent.method, url: sent.url, headers: sent.headers, body: body3 };
-}
-
 // ../core/src/scripting/trust.ts
 function scriptsOf(holder) {
   return [holder.scripts.pre, holder.scripts.post].filter((script) => script.trim());
@@ -10434,7 +10653,8 @@ function runFailed(result) {
 }
 function requestsInOrder(tree, folderId) {
   const entered = /* @__PURE__ */ new Set();
-  const inOrder = (parent) => childrenInOrder(tree, parent).flatMap((child) => {
+  const childrenOf = childrenInOrder(tree);
+  const inOrder = (parent) => childrenOf(parent).flatMap((child) => {
     if (child.request) return [child.request];
     if (entered.has(child.folder.id)) return [];
     entered.add(child.folder.id);
@@ -10457,7 +10677,12 @@ async function runRequests(requests, send, options = {}) {
   const count = options.iterations ?? (data.length || 1);
   const signal = options.signal ?? new AbortController().signal;
   const results = [];
-  const report = (ended, reason) => ({ iterations: count, results, ended, ...reason !== void 0 && { reason } });
+  const report = (ended, reason) => ({
+    iterations: count,
+    results,
+    ended,
+    ...reason !== void 0 && { reason }
+  });
   let first = true;
   for (let index = 0; index < count; index++) {
     const iteration = { index, count, data: data[Math.min(index, data.length - 1)] ?? [] };
@@ -10479,31 +10704,59 @@ async function runRequests(requests, send, options = {}) {
   return report("completed");
 }
 
+// ../core/src/run/words.ts
+function runEnding(report) {
+  switch (report.ended) {
+    case "completed":
+      return "The run is complete.";
+    case "cancelled":
+      return "You stopped the run.";
+    case "failed":
+      return "The run stopped at the first failure.";
+    case "ended":
+      return `The run was stopped. ${report.reason ?? ""}`.trim();
+  }
+}
+function runCounts(report) {
+  const { results, iterations } = report;
+  const tests2 = results.flatMap((result) => result.tests);
+  const failed = results.filter(runFailed).length;
+  const passed = tests2.filter((test) => test.passed).length;
+  return `${results.length} ${results.length === 1 ? "result" : "results"} in ${iterations} ${iterations === 1 ? "iteration" : "iterations"}; ${failed} failed; ${passed} of ${tests2.length} tests passed.`;
+}
+function sharedErrors(results) {
+  const counts2 = /* @__PURE__ */ new Map();
+  for (const { error } of results) if (error !== void 0) counts2.set(error, (counts2.get(error) ?? 0) + 1);
+  return [...counts2].filter(([, count]) => count >= 2).sort((a, b) => b[1] - a[1]).map(([error, count]) => ({ error, count }));
+}
+function sharedErrorHeading(count) {
+  return `${count} requests failed with the same error.`;
+}
+
 // ../core/src/send/wire.ts
 var SECRET_PLACEHOLDER = /\{\{\s*\$secret\./;
 function containsSecretPlaceholder(request) {
   const wire = [
     request.url,
-    percentDecoded(request.url),
+    formDecoded(request.url),
     JSON.stringify(request.headers),
     ...request.headers.map(([, value]) => decodeBasicCredentials(value)),
     // An OAuth 2.0 token request names its client in Basic credentials that are form-encoded first (RFC 6749, 2.3.1).
-    ...request.headers.map(([, value]) => percentDecoded(decodeBasicCredentials(value))),
+    ...request.headers.map(([, value]) => formDecoded(decodeBasicCredentials(value))),
     ...bodyTexts(request.body)
   ];
   return wire.some((text3) => SECRET_PLACEHOLDER.test(text3));
 }
-function percentDecoded(text3) {
-  try {
-    return decodeURIComponent(text3);
-  } catch (error) {
-    if (!(error instanceof URIError)) throw error;
-    return "";
-  }
+function formDecoded(text3) {
+  return text3.replaceAll("+", " ").replace(
+    /(?:%[0-9a-f]{2})+/gi,
+    (run) => utf82.decode(Uint8Array.from(run.slice(1).split("%"), (hex2) => parseInt(hex2, 16)))
+  );
 }
+var utf82 = new TextDecoder();
 function bodyTexts(body3) {
   if (typeof body3 === "string") {
-    return [body3, percentDecoded(body3.replaceAll("+", " "))];
+    return [body3, formDecoded(body3)];
   }
   if (body3 instanceof FormData) {
     return [...body3].flatMap(([name, value]) => [name, typeof value === "string" ? value : value.name]);
@@ -10521,6 +10774,32 @@ function decodeBasicCredentials(headerValue) {
   }
 }
 
+// ../core/src/scripting/request-view.ts
+function scriptRequestOf(content) {
+  const rows2 = (list4) => list4.filter((row) => row.enabled && row.key).map((row) => [row.key, row.value]);
+  const { body: body3 } = content;
+  const seen = body3.mode === "raw" ? { mode: "raw", raw: body3.raw?.text ?? "" } : body3.mode === "graphql" ? { mode: "raw", raw: graphqlText(body3.graphql?.query ?? "", body3.graphql?.variables ?? "") } : body3.mode === "urlencoded" ? { mode: "urlencoded", urlencoded: rows2(body3.urlencoded ?? []) } : { mode: body3.mode };
+  return { method: content.method, url: content.url, headers: rows2(content.headers), body: seen };
+}
+function withScriptRequest(content, request) {
+  const rows2 = (pairs2) => pairs2.map(([key, value]) => ({ key, value, enabled: true }));
+  const untouched = content.body.mode === "graphql" && request.body.mode === "raw" && request.body.raw === graphqlText(content.body.graphql?.query ?? "", content.body.graphql?.variables ?? "");
+  const body3 = untouched ? content.body : request.body.mode === "raw" ? {
+    ...content.body,
+    mode: "raw",
+    raw: {
+      language: content.body.mode === "graphql" ? "json" : content.body.raw?.language ?? "text",
+      text: request.body.raw
+    }
+  } : request.body.mode === "urlencoded" ? { ...content.body, mode: "urlencoded", urlencoded: rows2(request.body.urlencoded) } : content.body;
+  return { ...content, method: request.method, url: request.url, headers: rows2(request.headers), body: body3 };
+}
+function sentScriptRequest(content, sent) {
+  const { mode } = content.body;
+  const body3 = mode === "multipart" || mode === "binary" ? { mode } : sent.body === void 0 ? { mode: "none" } : mode === "urlencoded" ? { mode, urlencoded: [...new URLSearchParams(sent.body)] } : { mode: "raw", raw: sent.body };
+  return { method: sent.method, url: sent.url, headers: sent.headers, body: body3 };
+}
+
 // ../core/src/send/assertions.ts
 function runAssertions(assertions, response) {
   return assertions.map((assertion) => evaluate2(assertion, response));
@@ -10682,19 +10961,22 @@ var RequestSkipped = class extends SendBlockedError {
   scriptLogs;
   nextRequest;
 };
-var NETWORK_ERROR_TEXT = "Network error \u2014 no response was received. The host may not resolve (DNS), may have refused the connection, or may not allow cross-origin requests from this site (CORS). The browser does not reveal which. Check the URL and your connection; for CORS, the Local Bridge can relay the request.";
-var networkErrorWithoutPage = (reason) => `Network error \u2014 no response was received: ${reason}. Check the URL, that the host resolves, and that it accepts connections.`;
+var NO_RESPONSE_TEXT = "The request got no response. The browser does not say why: the name may not resolve, the server may have refused the connection, or it does not allow requests from this page (CORS). Send it through the Local Bridge to see which.";
+var OFFLINE_TEXT = "The request got no response: this browser is offline. Connect, then send it again.";
+var noResponseWithoutPage = (reason) => `The request got no response: ${reason}. Check the address, that the name resolves and that the server accepts connections.`;
 var SECRET_PLACEHOLDER_BLOCKED = "This request refers to a vault secret that could not be read (it may have been deleted), so it was not sent. Give the variable a value again.";
 function sentBodyPreview(body3) {
   if (body3 === void 0 || typeof body3 === "string") return body3;
   const file = (blob) => `(${blob.size} bytes${blob.type ? `, ${blob.type}` : ""})`;
   if (body3 instanceof FormData) {
-    return [...body3].map(([name, value]) => typeof value === "string" ? `${name}=${value}` : `${name}=@${value.name} ${file(value)}`).join("\n");
+    return [...body3].map(
+      ([name, value]) => typeof value === "string" ? `${name}=${value}` : `${name}=@${value.name} ${file(value)}`
+    ).join("\n");
   }
   return `@file ${file(body3)}`;
 }
 function scriptResponse(response) {
-  const body3 = bodyText(response.body);
+  const body3 = response.text ?? bodyText(response.body);
   return {
     code: response.statusCode,
     status: response.statusText,
@@ -10710,7 +10992,10 @@ function bodyText(body3) {
   return stringifyJson(body3) ?? "";
 }
 function lastNext(runs) {
-  return runs.reduce((last, run) => run.result.nextRequest !== void 0 ? run.result.nextRequest : last, void 0);
+  return runs.reduce(
+    (last, run) => run.result.nextRequest !== void 0 ? run.result.nextRequest : last,
+    void 0
+  );
 }
 function scriptsToRun(spec, kind) {
   const label = kind === "pre" ? "Pre-request script" : "Post-response script";
@@ -10722,7 +11007,11 @@ function scriptsToRun(spec, kind) {
 function scriptRows(result, name, redactor) {
   if (!result) return [];
   const rows2 = result.error === void 0 ? result.testResults : [...result.testResults, { label: name, passed: false, error: result.error, source: "script" }];
-  return rows2.map((row) => ({ ...row, label: redactor.text(row.label), ...row.error !== void 0 && { error: redactor.text(row.error) } }));
+  return rows2.map((row) => ({
+    ...row,
+    label: redactor.text(row.label),
+    ...row.error !== void 0 && { error: redactor.text(row.error) }
+  }));
 }
 async function exchange(spec, ports) {
   const createdAt = Date.now();
@@ -10733,7 +11022,11 @@ async function exchange(spec, ports) {
   let undo = () => Promise.resolve();
   const preScripts = spec.runScripts ? scriptsToRun(spec, "pre") : [];
   if (preScripts.length) {
-    const before = { environment: ports.environment()?.vars ?? [], global: ports.globals(), collection: spec.collection?.variables() ?? [] };
+    const before = {
+      environment: ports.environment()?.vars ?? [],
+      global: ports.globals(),
+      collection: spec.collection?.variables() ?? []
+    };
     const touched = emptyChanges();
     const restoreSecrets = [];
     const was = (rows2, names) => names.map(({ key }) => {
@@ -10741,29 +11034,54 @@ async function exchange(spec, ports) {
       return { key, value, ...json && { json } };
     });
     undo = async () => {
-      await applyChanges(ports, spec, { environment: was(before.environment, touched.environment), global: was(before.global, touched.global), collection: was(before.collection, touched.collection) }, []);
+      await applyChanges(
+        ports,
+        spec,
+        {
+          environment: was(before.environment, touched.environment),
+          global: was(before.global, touched.global),
+          collection: was(before.collection, touched.collection)
+        },
+        []
+      );
       for (const restore of restoreSecrets.reverse()) await restore();
     };
     timings.preScriptMs = 0;
     for (const { name, text: text3 } of preScripts) {
       const scriptStarted = performance.now();
-      const result = await ports.runScript(text3, environmentSnapshot(ports), void 0, scriptExtras(ports, spec, "prerequest", scriptRequestOf(template)));
+      const result = await ports.runScript(
+        text3,
+        environmentSnapshot(ports),
+        void 0,
+        scriptExtras(ports, spec, "prerequest", scriptRequestOf(template))
+      );
       timings.preScriptMs += Math.round(performance.now() - scriptStarted);
+      stopped(spec);
       preRuns.push({ name, result });
       const { changes } = result;
       restoreSecrets.push(await applyChanges(ports, spec, changes, notes));
       for (const scope of ["environment", "global", "collection"]) touched[scope].push(...changes[scope]);
       if (result.error !== void 0) {
         const nothing = new Redactor([]);
-        throw new PreRequestScriptError(preRuns.flatMap((run) => scriptRows(run.result, run.name, nothing)), [...preRuns.flatMap((run) => run.result.logs), ...notes], timings, name);
+        throw new PreRequestScriptError(
+          preRuns.flatMap((run) => scriptRows(run.result, run.name, nothing)),
+          [...preRuns.flatMap((run) => run.result.logs), ...notes],
+          timings,
+          name
+        );
       }
       if (result.request) template = withScriptRequest(template, result.request);
     }
     if (spec.iteration && preRuns.some((run) => run.result.skipRequest)) {
       const nothing = new Redactor([]);
-      throw new RequestSkipped(preRuns.flatMap((run) => scriptRows(run.result, run.name, nothing)), [...preRuns.flatMap((run) => run.result.logs), ...notes], lastNext(preRuns));
+      throw new RequestSkipped(
+        preRuns.flatMap((run) => scriptRows(run.result, run.name, nothing)),
+        [...preRuns.flatMap((run) => run.result.logs), ...notes],
+        lastNext(preRuns)
+      );
     }
   }
+  stopped(spec);
   let request;
   try {
     const built2 = spec.buildRequest(template);
@@ -10782,16 +11100,22 @@ async function exchange(spec, ports) {
   const jar = ports.cookies;
   const cookies = jar && {
     for: (url) => {
-      const found = jar.for(url).filter((cookie) => !containsSecretPlaceholder({ url: "", headers: [["Cookie", `${cookie.name}=${cookie.value}`]] }));
+      const found = jar.for(url).filter(
+        (cookie) => !containsSecretPlaceholder({ url: "", headers: [["Cookie", `${cookie.name}=${cookie.value}`]] })
+      );
       sentCookies ??= found;
       for (const cookie of found) cookieValues.add(cookie.value);
       return found;
     },
     store: (url, setCookies) => void jar.store(url, setCookies, request.secrets)
   };
-  const policy = { route: spec.route ?? ports.transport.route(), ...spec.askRoute && { ask: spec.askRoute } };
+  const policy = {
+    route: spec.route ?? ports.transport.route(),
+    ...spec.askRoute && { ask: spec.askRoute }
+  };
   const transmit = async () => {
     startedAt = performance.now();
+    delete policy.startedAt;
     sentCookies = void 0;
     try {
       return await ports.transport.send(
@@ -10827,10 +11151,10 @@ async function exchange(spec, ports) {
       outcome = await transmit();
     }
   }
-  const durationMs = Math.round(performance.now() - startedAt);
+  const durationMs = Math.round(performance.now() - (policy.startedAt ?? startedAt));
   timings.requestMs = durationMs;
   ports.watch?.received(request.url);
-  const shaped = outcome instanceof TransportError ? shapeFailure(outcome, request.url, ports.page) : shapeResponse(outcome, request.url, ports.page);
+  const shaped = outcome instanceof TransportError ? shapeFailure(outcome, ports.page, ports.online?.()) : shapeResponse(outcome, ports.page);
   const redactor = new Redactor([...request.secrets, ...request.credentials, ...cookieValues]);
   const secrets = new Redactor(request.secrets);
   const post = await runPostScriptAndAssertions(
@@ -10848,7 +11172,15 @@ async function exchange(spec, ports) {
     notes,
     secrets,
     timings,
-    { statusCode: shaped.response.statusCode ?? 0, statusText: shaped.response.statusText ?? "", body: shaped.body, headers: shaped.headers, durationMs, sizeBytes: outcome instanceof TransportError ? void 0 : outcome.sizes.decoded }
+    {
+      statusCode: shaped.response.statusCode ?? 0,
+      statusText: shaped.response.statusText ?? "",
+      body: shaped.body,
+      ...shaped.text !== void 0 && { text: shaped.text },
+      headers: shaped.headers,
+      durationMs,
+      sizeBytes: outcome instanceof TransportError ? void 0 : outcome.sizes.decoded
+    }
   );
   const runs = [...preRuns, ...post.scripts];
   const testResults = [...runs.flatMap((run) => scriptRows(run.result, run.name, redactor)), ...post.assertions];
@@ -10868,7 +11200,10 @@ async function exchange(spec, ports) {
       ...preview !== void 0 && { bodyPreview: keep(preview).text }
     },
     route: outcome instanceof TransportError ? policy.took ?? ports.transport.first(policy.route) : outcome.route,
-    durationMs
+    durationMs,
+    ...spec.info && {
+      sentFrom: { name: redactor.text(spec.info.requestName), path: spec.info.path.map((name) => redactor.text(name)) }
+    }
   };
   if (!(outcome instanceof TransportError)) {
     history.response = {
@@ -10882,7 +11217,25 @@ async function exchange(spec, ports) {
     history.error = redactor.text(shaped.historyError);
   }
   const nextRequest = lastNext(runs);
+  const record = recordOf(history, {
+    sentHeaders: withJarCookies(request.headers, sentCookies ?? []),
+    sentUrl: request.url,
+    sentPreview: preview,
+    received: outcome instanceof TransportError ? void 0 : { headers: shaped.headerList, body: shaped.bodyText },
+    vaulted: (request.vaulted ?? []).map((secret) => ({
+      ...secret,
+      ...secret.scope && { holder: holderOf(secret.scope, ports, spec) }
+    })),
+    unpaired: outcome instanceof TransportError && history.route === "direct" && policy.unpaired === true,
+    failure: outcome instanceof TransportError ? {
+      kind: outcome.kind,
+      reported: redactor.text(outcome.message),
+      summary: redactor.text(firstSentence(shaped.response.errorText))
+    } : void 0
+  });
+  history.record = record;
   return {
+    record,
     durationMs,
     timings,
     ...!(outcome instanceof TransportError) && outcome.timings && { relayTimings: outcome.timings },
@@ -10894,21 +11247,57 @@ async function exchange(spec, ports) {
     ...nextRequest !== void 0 && { nextRequest }
   };
 }
-function shapeResponse(envelope, url, page) {
-  const body3 = decodeEnvelope(envelope);
+function stopped(spec) {
+  if (spec.signal?.aborted) throw new SendBlockedError("You stopped the request. Nothing was sent.");
+}
+function firstSentence(text3) {
+  const match = /^.*?[.!?](?=\s|$)/s.exec(text3.trim());
+  return (match ? match[0] : text3).trim();
+}
+function holderOf(scope, ports, spec) {
+  if (scope === "environment") {
+    const name = ports.environment()?.name;
+    return name === void 0 ? void 0 : `environment "${name}"`;
+  }
+  if (scope === "collection") return spec.inherited?.[0]?.name;
+  return void 0;
+}
+function recordOf(history, raw) {
+  const changed = (kept, sent) => kept.filter(([, value], index) => value !== sent[index]?.[1]).map(([name]) => name);
+  const response = history.response;
+  const keptUrl = history.sent.url;
+  return {
+    ...response && { status: { code: response.status, text: response.statusText } },
+    durationMs: history.durationMs ?? 0,
+    route: history.route,
+    host: URL.parse(keptUrl)?.host || keptUrl,
+    secrets: raw.vaulted,
+    masked: {
+      ...keptUrl !== raw.sentUrl && { address: true },
+      headers: [...new Set(changed(history.sent.headers, raw.sentHeaders))],
+      ...raw.sentPreview !== void 0 && history.sent.bodyPreview !== raw.sentPreview.slice(0, HISTORY_BODY_LIMIT) && { body: true },
+      responseHeaders: response && raw.received ? [...new Set(changed(response.headers, raw.received.headers))] : [],
+      ...response?.body && raw.received?.body !== void 0 && response.body.text !== raw.received.body.slice(0, HISTORY_BODY_LIMIT) && { responseBody: true }
+    },
+    kept: { response: response !== void 0, body: response?.body !== void 0 },
+    ...raw.unpaired && { unpaired: true },
+    ...raw.failure && { failure: raw.failure }
+  };
+}
+function shapeResponse(envelope, page) {
+  const { value: body3, text: sentText } = readEnvelope(envelope);
   const isError = envelope.status < 200 || envelope.status >= 300;
-  const failureText = `Http failure response for ${url}: ${envelope.status} ${envelope.statusText}`;
-  const shown = isError ? body3 ?? failureText : body3;
+  const shown = body3;
   const bodyIsJson = isJsonPayload(shown);
   const text3 = bodyIsJson ? serializeJsonPayload(shown) : stringifyPayload(shown);
   const header = (name) => envelope.headers.find(([key]) => key.toLowerCase() === name)?.[1];
   const contentLength = Number(header("content-length") || NaN);
   return {
     body: body3,
+    ...sentText !== void 0 && { text: sentText },
     headers: Object.fromEntries(envelope.headers),
     headerList: envelope.headers,
     bodyText: body3 === void 0 || body3 === null || body3 instanceof BinaryBody ? void 0 : text3,
-    historyError: isError ? failureText : void 0,
     response: {
       isError,
       statusCode: envelope.status,
@@ -10917,34 +11306,36 @@ function shapeResponse(envelope, url, page) {
       dataText: isError ? "" : text3,
       errorText: isError ? text3 : "",
       headersView: envelope.headers.map(([name, value]) => ({ name, value })).sort((a, b) => a.name.localeCompare(b.name)),
-      contentLength: Number.isFinite(contentLength) ? contentLength : void 0,
+      contentLength: Number.isFinite(contentLength) ? contentLength : envelope.sizes.decoded,
       binary: body3 instanceof BinaryBody ? body3 : void 0,
       redirectedTo: envelope.redirected ? envelope.finalUrl : void 0,
       route: envelope.route,
       contentType: header("content-type"),
-      // Outside a page nothing is withheld: no browser stands between.
-      headersLimited: page !== void 0 && envelope.route === "direct" && URL.parse(envelope.finalUrl, page)?.origin !== URL.parse(page)?.origin,
+      // Outside a page nothing is withheld: no browser stands between. A wildcard exposes every header
+      // but Set-Cookie to a request without credentials, which every direct send is (U-173).
+      headersLimited: page !== void 0 && envelope.route === "direct" && URL.parse(envelope.finalUrl, page)?.origin !== URL.parse(page)?.origin && !(header("access-control-expose-headers") ?? "").split(",").some((name) => name.trim() === "*"),
       ...envelope.stream && { stream: envelope.stream },
       ...envelope.redirects && { redirects: envelope.redirects },
       ...envelope.tlsInsecure && { tlsInsecure: true }
     }
   };
 }
-function shapeFailure(failure, url, page) {
+function shapeFailure(failure, page, online) {
   const network = failure.kind === "network";
-  const statusCode = network ? 0 : failure.kind === "bridge" ? failure.status ?? 0 : void 0;
+  const said2 = network || failure.kind === "bridge";
+  const errorText = !network ? failure.message : page === void 0 ? noResponseWithoutPage(failure.message) : online === false ? OFFLINE_TEXT : NO_RESPONSE_TEXT;
   return {
-    body: network ? void 0 : failure.message,
+    body: said2 ? void 0 : failure.message,
     headers: {},
     headerList: [],
-    historyError: network ? `Http failure response for ${url}: 0 Unknown Error` : failure.message,
+    historyError: network ? page === void 0 ? `No response: ${failure.message}.` : online === false ? "No response: this browser is offline." : "No response. The browser does not say why." : failure.message,
     response: {
       isError: true,
-      statusCode,
-      statusText: network ? "Unknown Error" : "",
+      statusCode: void 0,
+      statusText: "",
       bodyIsJson: false,
       dataText: "",
-      errorText: !network ? failure.message : page === void 0 ? networkErrorWithoutPage(failure.message) : NETWORK_ERROR_TEXT,
+      errorText,
       headersView: []
     }
   };
@@ -10953,13 +11344,21 @@ async function runPostScriptAndAssertions(ports, spec, sent, notes, variables2,
   const scripts2 = [];
   for (const { name, text: text3 } of spec.runScripts ? scriptsToRun(spec, "post") : []) {
     const scriptStarted = performance.now();
-    const result = await ports.runScript(text3, environmentSnapshot(ports), response, scriptExtras(ports, spec, "test", sent));
+    const result = await ports.runScript(
+      text3,
+      environmentSnapshot(ports),
+      response,
+      scriptExtras(ports, spec, "test", sent)
+    );
     timings.postScriptMs = (timings.postScriptMs ?? 0) + Math.round(performance.now() - scriptStarted);
     scripts2.push({ name, result });
     await applyChanges(ports, spec, result.changes, notes, variables2);
   }
   const { statusCode, body: body3, headers: headers2, durationMs } = response;
-  return { scripts: scripts2, assertions: spec.tests.length ? runAssertions(spec.tests, { statusCode, body: body3, headers: headers2, durationMs }) : [] };
+  return {
+    scripts: scripts2,
+    assertions: spec.tests.length ? runAssertions(spec.tests, { statusCode, body: body3, headers: headers2, durationMs }) : []
+  };
 }
 function environmentSnapshot(ports) {
   return scriptVariables(ports.environment()?.vars ?? []);
@@ -10972,30 +11371,56 @@ function scriptExtras(ports, spec, eventName, request) {
     ...spec.iteration && { data: scriptVariables(spec.iteration.data) },
     collection: scriptVariables(spec.collection?.variables() ?? []),
     request,
-    info: { eventName, requestName: spec.info?.requestName ?? "", requestId: spec.info?.requestId ?? "", ...spec.iteration && { iteration: spec.iteration.index, iterationCount: spec.iteration.count } },
+    info: {
+      eventName,
+      requestName: spec.info?.requestName ?? "",
+      requestId: spec.info?.requestId ?? "",
+      ...spec.iteration && { iteration: spec.iteration.index, iterationCount: spec.iteration.count }
+    },
     send: (request2) => sendForScript(ports, request2, spec.signal, spec.route)
   };
 }
 async function sendForScript(ports, request, signal, route = ports.transport.route()) {
   if (containsSecretPlaceholder(request)) {
-    throw Object.assign(new Error("pm.sendRequest with a vault secret is not supported \u2014 see docs/postman-compatibility.md#pm-sendrequest"), { name: "WayfarerUnsupportedError" });
+    throw Object.assign(
+      new Error(
+        "pm.sendRequest with a vault secret is not supported \u2014 see docs/postman-compatibility.md#pm-sendrequest"
+      ),
+      { name: "WayfarerUnsupportedError" }
+    );
   }
   const startedAt = performance.now();
-  const envelope = await ports.transport.send(request, { signal: signal ?? new AbortController().signal, timeoutMs: ports.timeoutMs() }, { route });
-  const shaped = shapeResponse(envelope, request.url, ports.page);
+  const policy = { route };
+  const envelope = await ports.transport.send(
+    request,
+    {
+      signal: signal ?? new AbortController().signal,
+      timeoutMs: ports.timeoutMs(),
+      // Followed on every route, as a browser follows it: the vault is not read for this request, so no secret is held to its host.
+      redirects: { follow: true, stayOnHost: false }
+    },
+    policy
+  );
+  const shaped = shapeResponse(envelope, ports.page);
   return scriptResponse({
     statusCode: envelope.status,
     statusText: envelope.statusText,
     body: shaped.body,
+    ...shaped.text !== void 0 && { text: shaped.text },
     headers: shaped.headers,
-    durationMs: Math.round(performance.now() - startedAt),
+    durationMs: Math.round(performance.now() - (policy.startedAt ?? startedAt)),
     sizeBytes: envelope.sizes.decoded
   });
 }
 async function applyChanges(ports, spec, changes, notes, secrets) {
   const active = ports.environment();
   const replaced = /* @__PURE__ */ new Map();
-  const kept = async (api, rows2, scope) => (await intoVault(ports, api, rows2, scope, notes, replaced)).map(({ key, value, json }) => ({ key, value: value === null || !secrets ? value : secrets.text(value), keepSecret: true, ...json && { json } }));
+  const kept = async (api, rows2, scope) => (await intoVault(ports, api, rows2, scope, notes, replaced)).map(({ key, value, json }) => ({
+    key,
+    value: value === null || !secrets ? value : secrets.text(value),
+    keepSecret: true,
+    ...json && { json }
+  }));
   const environment2 = await kept("pm.environment", active?.vars ?? [], changes.environment);
   const global = await kept("pm.globals", ports.globals(), changes.global);
   const collection = await kept("pm.collectionVariables", spec.collection?.variables() ?? [], changes.collection);
@@ -11006,7 +11431,10 @@ async function applyChanges(ports, spec, changes, notes, secrets) {
   if (global.length) await ports.changeGlobals(global);
   if (collection.length) {
     if (spec.collection) await spec.collection.change(collection);
-    else notes.push("[warn] pm.collectionVariables: this request is in no collection, so what the script set was not kept.");
+    else
+      notes.push(
+        "[warn] pm.collectionVariables: this request is in no collection, so what the script set was not kept."
+      );
   }
   return async () => {
     for (const [id, plaintext] of replaced) await ports.vault.replaceSecret(id, plaintext);
@@ -11026,7 +11454,8 @@ async function intoVault(ports, api, rows2, changes, notes, replaced) {
         continue;
       }
       const old = await ports.vault.readSecret(id);
-      if (old === null || !await ports.vault.replaceSecret(id, change.value)) refused("the secret this variable refers to is not in the vault");
+      if (old === null || !await ports.vault.replaceSecret(id, change.value))
+        refused("the secret this variable refers to is not in the vault");
       else if (!replaced.has(id)) replaced.set(id, old);
     }
   }
@@ -11063,13 +11492,97 @@ function stringifyPayload(payload) {
   if (typeof payload === "string") {
     return payload;
   }
-  return stringifyJson(payload, 4) ?? String(payload);
+  return stringifyJson(payload, 4) ?? String(payload);
+}
+
+// ../core/src/auth/sigv4.ts
+var utf83 = (text3) => new TextEncoder().encode(text3);
+var sha2562 = async (data) => new Uint8Array(await crypto.subtle.digest("SHA-256", data));
+var hmac2 = async (key, data) => new Uint8Array(
+  await crypto.subtle.sign(
+    "HMAC",
+    await crypto.subtle.importKey("raw", key, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]),
+    utf83(data)
+  )
+);
+var hex = (bytes) => Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+var encode = (text3) => encodeURIComponent(text3).replace(/[!'()*]/g, (mark) => `%${mark.charCodeAt(0).toString(16).toUpperCase()}`);
+var decode = (text3) => {
+  try {
+    return decodeURIComponent(text3);
+  } catch (error) {
+    if (!(error instanceof URIError)) throw error;
+    return text3;
+  }
+};
+async function signV4(request, credentials, at) {
+  const url = new URL(request.url);
+  const s3 = credentials.service === "s3";
+  const segments = url.pathname.split("/");
+  const kept = segments.filter(Boolean);
+  const path = s3 ? segments.map((segment) => encode(decode(segment))).join("/") : `/${kept.map(encode).join("/")}${kept.length && url.pathname.endsWith("/") ? "/" : ""}`;
+  const query = url.search.slice(1).split("&").filter(Boolean).map((pair) => {
+    const cut = pair.indexOf("=");
+    return [
+      encode(decode(cut === -1 ? pair : pair.slice(0, cut))),
+      encode(decode(cut === -1 ? "" : pair.slice(cut + 1)))
+    ];
+  }).sort(
+    ([keyA, valueA], [keyB, valueB]) => keyA === keyB ? valueA < valueB ? -1 : valueA > valueB ? 1 : 0 : keyA < keyB ? -1 : 1
+  ).map(([key2, value]) => `${key2}=${value}`).join("&");
+  const date = at.toISOString().replace(/[-:]|\.\d{3}/g, "");
+  const day = date.slice(0, 8);
+  const body3 = typeof request.body === "string" ? utf83(request.body) : new Uint8Array(request.body ?? []);
+  const bodyHash = hex(await sha2562(body3));
+  const added2 = [
+    ["X-Amz-Date", date],
+    ...credentials.sessionToken ? [["X-Amz-Security-Token", credentials.sessionToken]] : [],
+    ...s3 ? [["X-Amz-Content-Sha256", bodyHash]] : []
+  ];
+  const byName = /* @__PURE__ */ new Map();
+  const own3 = request.headers.filter(
+    ([name]) => !added2.some(([written]) => written.toLowerCase() === name.toLowerCase()) && name.toLowerCase() !== "host"
+  );
+  for (const [name, value] of [["Host", url.host], ...own3, ...added2]) {
+    const key2 = name.toLowerCase();
+    byName.set(key2, [...byName.get(key2) ?? [], value.trim().replace(/\s+/g, " ")]);
+  }
+  const names = [...byName.keys()].sort();
+  const signedHeaders = names.join(";");
+  const canonicalRequest = [
+    request.method,
+    path,
+    query,
+    ...names.map((name) => `${name}:${(byName.get(name) ?? []).join(",")}`),
+    "",
+    signedHeaders,
+    bodyHash
+  ].join("\n");
+  const scope = `${day}/${credentials.region}/${credentials.service}/aws4_request`;
+  const stringToSign = ["AWS4-HMAC-SHA256", date, scope, hex(await sha2562(utf83(canonicalRequest)))].join("\n");
+  let key = utf83(`AWS4${credentials.secretKey}`);
+  for (const part of [day, credentials.region, credentials.service, "aws4_request"]) key = await hmac2(key, part);
+  const signature = hex(await hmac2(key, stringToSign));
+  return {
+    headers: [
+      ...added2,
+      [
+        "Authorization",
+        `AWS4-HMAC-SHA256 Credential=${credentials.accessKey}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`
+      ]
+    ],
+    canonicalRequest,
+    stringToSign,
+    signature
+  };
 }
 
 // ../core/src/send/build.ts
 var UnresolvedVariablesError = class extends SendBlockedError {
   constructor(names) {
-    super(`${names.map((name) => `{{${name}}}`).join(", ")} ${names.length === 1 ? "has" : "have"} no value. The request was not sent.`);
+    super(
+      `${names.map((name) => `{{${name}}}`).join(", ")} ${names.length === 1 ? "has" : "have"} no value. The request was not sent.`
+    );
     this.names = names;
   }
   names;
@@ -11087,6 +11600,14 @@ function normalizeUrl(text3) {
   const address2 = text3.replace(/[\t\n\r]/g, encodeURIComponent);
   return hasExplicitScheme(address2) ? address2 : `https://${address2}`;
 }
+function validateUrl(text3) {
+  if (!text3) return false;
+  const parsed2 = URL.parse(normalizeUrl(text3));
+  if (!parsed2 || parsed2.protocol !== "http:" && parsed2.protocol !== "https:" || !parsed2.hostname) return false;
+  if (hasExplicitScheme(text3)) return true;
+  const { hostname } = parsed2;
+  return hostname === "localhost" || hostname.includes(".") || hostname.includes(":") || !!parsed2.port;
+}
 function appendQueryParam(url, key, value) {
   const parsed2 = URL.parse(normalizeUrl(url));
   if (!parsed2) {
@@ -11141,17 +11662,24 @@ function buildRequest(content, context) {
       if (resolver.unresolved.size && context.blockUnresolved) {
         throw new UnresolvedVariablesError([...resolver.unresolved]);
       }
+      if (!validateUrl(resolver.resolve(content.url.trim()))) {
+        throw new SendBlockedError(
+          "This is not an address a request can go to. Write it as https://host/path. Nothing was sent."
+        );
+      }
       return request;
     };
     return built2 instanceof Promise ? built2.then(check) : check(built2);
   };
-  if (!probe.lockedSecrets.size) return checked(new VariableResolver(scopes()));
-  const withSecrets = () => context.readSecrets([...probe.lockedSecrets]).then((secrets) => checked(new VariableResolver(scopes(), (id) => secrets.get(id))));
+  const oauth = sentAuth(content.auth, context.ancestors).type === "oauth2";
+  if (!probe.lockedSecrets.size && !oauth) return checked(new VariableResolver(scopes()));
+  const withSecrets = () => probe.lockedSecrets.size ? context.readSecrets([...probe.lockedSecrets]).then((secrets) => checked(new VariableResolver(scopes(), (id) => secrets.get(id)))) : checked(new VariableResolver(scopes()));
   const from = composed && hostOf(composed.url, composed.scopes);
   const to = hostOf(endpointText, scopes());
   if (from === void 0 || from === to || composed?.accepted?.has(to)) return withSecrets();
   return (context.askHost?.(from, to) ?? Promise.resolve(false)).then((accepted) => {
-    if (!accepted) throw new SendDeclinedError("The request was not sent, and what the pre-request script set was undone.");
+    if (!accepted)
+      throw new SendDeclinedError("The request was not sent, and what the pre-request script set was undone.");
     composed?.accepted?.add(to);
     return withSecrets();
   });
@@ -11161,11 +11689,17 @@ function build(content, resolver, context) {
   const auth3 = resolveAuth(sentAuth(content.auth, context.ancestors), resolve);
   const withoutValue = [...resolver.unresolved];
   const sent = isBodyMethod(content.method) ? resolveBody(content.body, resolve, context) : void 0;
-  const finish = (body3, token2) => sign(assemble(content, body3, resolver, { ancestors: context.ancestors, token: token2, lastEventId: context.lastEventId }), auth3);
+  const finish = (body3, token2) => sign(
+    assemble(content, body3, resolver, { ancestors: context.ancestors, token: token2, lastEventId: context.lastEventId }),
+    auth3
+  );
   const oauth = auth3.type === "oauth2" ? oauthOf(content.auth, context.ancestors, context.scopes()) : null;
-  if (auth3.type !== "oauth2" || !oauth) return sent instanceof Promise ? sent.then((body3) => finish(body3)) : finish(sent);
+  if (auth3.type !== "oauth2" || !oauth)
+    return sent instanceof Promise ? sent.then((body3) => finish(body3)) : finish(sent);
   if (withoutValue.length) {
-    throw new SendBlockedError(`The OAuth 2.0 auth uses ${withoutValue.map((name) => `{{${name}}}`).join(", ")}, which ${withoutValue.length === 1 ? "has" : "have"} no value. No token was asked for, and nothing was sent.`);
+    throw new SendBlockedError(
+      `The OAuth 2.0 auth uses ${withoutValue.map((name) => `{{${name}}}`).join(", ")}, which ${withoutValue.length === 1 ? "has" : "have"} no value. No token was asked for, and nothing was sent.`
+    );
   }
   if (!context.oauthToken) throw new SendBlockedError("OAuth 2.0 tokens are not fetched here. Nothing was sent.");
   const token = context.oauthToken(auth3, oauth.key, context.renewToken ?? false).catch((error) => {
@@ -11176,18 +11710,30 @@ function build(content, resolver, context) {
 function sign(built2, auth3) {
   if (auth3.type !== "awsv4" || !URL.canParse(built2.url)) return built2;
   if (built2.body instanceof FormData) {
-    throw new SendBlockedError("AWS Signature cannot sign a multipart form: the browser writes the form's boundary as it sends, so the app does not have the bytes to sign. Send a file as a File body, or the fields as a URL-encoded form. Nothing was sent.");
+    throw new SendBlockedError(
+      "AWS Signature cannot sign a multipart form: the browser writes the form's boundary as it sends, so the app does not have the bytes to sign. Send a file as a File body, or the fields as a URL-encoded form. Nothing was sent."
+    );
   }
-  if (!globalThis.crypto?.subtle) throw new SendBlockedError("AWS Signature needs the browser's cryptography, which a page has only over https or from localhost. Nothing was sent.");
+  if (!globalThis.crypto?.subtle)
+    throw new SendBlockedError(
+      "AWS Signature needs the browser's cryptography, which a page has only over https or from localhost. Nothing was sent."
+    );
   const add = async (body3) => {
     const own3 = built2.headers.filter(([name]) => /^(content-type$|x-amz-)/i.test(name));
-    const { headers: signature } = await signV4({ method: built2.method, url: built2.url, headers: own3, body: body3 }, auth3, /* @__PURE__ */ new Date());
+    const { headers: signature } = await signV4(
+      { method: built2.method, url: built2.url, headers: own3, body: body3 },
+      auth3,
+      /* @__PURE__ */ new Date()
+    );
     const replaced = new Set(signature.map(([name]) => name.toLowerCase()));
     return {
       ...built2,
       headers: [...built2.headers.filter(([name]) => !replaced.has(name.toLowerCase())), ...signature],
       // The signature's header too: a server may send it back.
-      credentials: [...built2.credentials, ...signature.filter(([name]) => isCredentialHeader(name)).map(([, value]) => value)]
+      credentials: [
+        ...built2.credentials,
+        ...signature.filter(([name]) => isCredentialHeader(name)).map(([, value]) => value)
+      ]
     };
   };
   if (built2.body instanceof Blob) return built2.body.arrayBuffer().then((bytes) => add(new Uint8Array(bytes)));
@@ -11219,8 +11765,16 @@ function assemble(content, sent, resolver, extra) {
     body: sent?.data,
     // An OAuth 2.0 token is kept like a vault secret and masked like one: in history, in every export, and in what a script is shown.
     secrets: [...resolver.taint, ...extra.token ? [extra.token] : []],
+    // By name only, for the exchange record (D4.12): the variables that brought a vault secret in, and the token.
+    vaulted: [
+      ...[...resolver.vaulted].map(([name, scope]) => ({ name, ...scope && { scope } })),
+      ...extra.token ? [{ name: "OAuth 2.0 token" }] : []
+    ],
     // Also what a credential header carries, typed by hand or built from the Auth tab: a server may send it back.
-    credentials: [...credentialsOf(auth3), ...headers2.filter(([name]) => isCredentialHeader(name)).map(([, value]) => value)].filter((value) => value)
+    credentials: [
+      ...credentialsOf(auth3),
+      ...headers2.filter(([name]) => isCredentialHeader(name)).map(([, value]) => value)
+    ].filter((value) => value)
   };
 }
 function resolveBody(body3, resolve, context) {
@@ -11241,7 +11795,11 @@ function resolveBody(body3, resolve, context) {
       return { data: new URLSearchParams(pairs2).toString(), contentType: "application/x-www-form-urlencoded" };
     }
     case "multipart":
-      return multipartForm((body3.multipart ?? []).filter((item) => item.enabled), resolve, context);
+      return multipartForm(
+        (body3.multipart ?? []).filter((item) => item.enabled),
+        resolve,
+        context
+      );
     case "binary":
       return binaryFile(body3.binary, context);
   }
@@ -11284,10 +11842,19 @@ async function runOutcome(send, declined) {
       exchange: result.history
     };
   } catch (error) {
-    if (error instanceof RequestSkipped) return { outcome: { skipped: true, tests: tests(error.testResults), ...error.nextRequest !== void 0 && { nextRequest: error.nextRequest } } };
+    if (error instanceof RequestSkipped)
+      return {
+        outcome: {
+          skipped: true,
+          tests: tests(error.testResults),
+          ...error.nextRequest !== void 0 && { nextRequest: error.nextRequest }
+        }
+      };
     if (error instanceof SendDeclinedError) return { outcome: { error: error.message, tests: [], end: declined } };
-    if (error instanceof PreRequestScriptError) return { outcome: { error: error.message, tests: tests(error.testResults) } };
-    if (error instanceof SendBlockedError || error instanceof VariableNestingError) return { outcome: { error: error.message, tests: [] } };
+    if (error instanceof PreRequestScriptError)
+      return { outcome: { error: error.message, tests: tests(error.testResults) } };
+    if (error instanceof SendBlockedError || error instanceof VariableNestingError)
+      return { outcome: { error: error.message, tests: [] } };
     throw error;
   }
 }
@@ -11314,7 +11881,14 @@ function validateWorkspaceFile(value) {
     }
     return records;
   };
-  const [collections, folders, requests, environments, secrets, meta] = ["collections", "folders", "requests", "environments", "secrets", "meta"].map(list4);
+  const [collections, folders, requests, environments, secrets, meta] = [
+    "collections",
+    "folders",
+    "requests",
+    "environments",
+    "secrets",
+    "meta"
+  ].map(list4);
   if (errors.length) return errors;
   const idOf2 = (doc) => isObject2(doc["meta"]) ? doc["meta"]["id"] : void 0;
   const known = new Set(collections.map(idOf2));
@@ -11327,12 +11901,21 @@ function validateWorkspaceFile(value) {
       folders: folders.filter((folder) => folder["collectionId"] === id),
       requests: requests.filter((request) => request["collectionId"] === id)
     });
-    errors.push(...(result.errors ?? []).map((issue) => `collection "${String(collection["name"])}": ${issue.path}: ${issue.message}`));
-    if (!isObject2(collection["scriptTrust"])) errors.push(`collection "${String(collection["name"])}": scriptTrust is missing.`);
+    errors.push(
+      ...(result.errors ?? []).map(
+        (issue) => `collection "${String(collection["name"])}": ${issue.path}: ${issue.message}`
+      )
+    );
+    if (!isObject2(collection["scriptTrust"]))
+      errors.push(`collection "${String(collection["name"])}": scriptTrust is missing.`);
   }
-  for (const [kind, docs] of [["folders", folders], ["requests", requests]]) {
+  for (const [kind, docs] of [
+    ["folders", folders],
+    ["requests", requests]
+  ]) {
     docs.forEach((doc, index) => {
-      if (!known.has(doc["collectionId"])) errors.push(`stores.${kind}[${index}]: belongs to a collection that is not in the file.`);
+      if (!known.has(doc["collectionId"]))
+        errors.push(`stores.${kind}[${index}]: belongs to a collection that is not in the file.`);
     });
   }
   errors.push(...validateEnvironmentExport({ $id: ENVIRONMENTS_FORMAT, environments }).errors ?? []);
@@ -11341,9 +11924,14 @@ function validateWorkspaceFile(value) {
     const key = record["key"];
     if (key === META_STATE_KEY) {
       const active = record["activeEnvironmentId"];
-      if (active !== null && active !== void 0 && typeof active !== "string") errors.push("stores.meta: the active environment must be an id or null.");
+      if (active !== null && active !== void 0 && typeof active !== "string")
+        errors.push("stores.meta: the active environment must be an id or null.");
     } else if (key === META_GLOBALS_KEY) {
-      errors.push(...validateRows(record["variables"], "stores.meta.globals.variables").map((issue) => `${issue.path}: ${issue.message}`));
+      errors.push(
+        ...validateRows(record["variables"], "stores.meta.globals.variables").map(
+          (issue) => `${issue.path}: ${issue.message}`
+        )
+      );
     } else if (key === META_VAULT_KEY) {
       vault = record;
     } else {
@@ -11354,7 +11942,8 @@ function validateWorkspaceFile(value) {
     const issues = validateVaultFile({ $id: VAULT_FILE_FORMAT, vault, secrets });
     errors.push(...issues.map((issue) => `vault: ${issue.path}: ${issue.message}`));
     secrets.forEach((secret, index) => {
-      if (!isObject2(secret["meta"]) || secret["meta"]["id"] !== secret["id"]) errors.push(`stores.secrets[${index}]: meta.id must be the secret's id.`);
+      if (!isObject2(secret["meta"]) || secret["meta"]["id"] !== secret["id"])
+        errors.push(`stores.secrets[${index}]: meta.id must be the secret's id.`);
     });
   }
   const history = own(stores, "history");
@@ -11363,16 +11952,47 @@ function validateWorkspaceFile(value) {
       const path = `stores.history[${index}]`;
       const sent = entry["sent"];
       if (typeof entry["createdAt"] !== "number") errors.push(`${path}.createdAt: Value must be a number.`);
-      if (entry["route"] !== "direct" && entry["route"] !== "bridge") errors.push(`${path}.route: Value must be direct or bridge.`);
+      if (entry["route"] !== "direct" && entry["route"] !== "bridge")
+        errors.push(`${path}.route: Value must be direct or bridge.`);
       if (!isObject2(sent) || typeof sent["method"] !== "string" || typeof sent["url"] !== "string" || !Array.isArray(sent["headers"])) {
         errors.push(`${path}.sent: Value must hold a method, a URL and headers.`);
       }
-      errors.push(...validateRequestContent(entry["template"], `${path}.template`).map((issue) => `${issue.path}: ${issue.message}`));
+      errors.push(
+        ...validateRequestContent(entry["template"], `${path}.template`).map(
+          (issue) => `${issue.path}: ${issue.message}`
+        )
+      );
+      if (Object.hasOwn(entry, "record")) errors.push(...recordProblems(entry["record"], `${path}.record`));
+      if (Object.hasOwn(entry, "model")) {
+        const model = entry["model"];
+        if (!isObject2(model) || !["tests", "draft", "explain", "test"].includes(String(model["action"])) || typeof model["model"] !== "string" || Object.keys(model).some((key) => key !== "action" && key !== "model"))
+          errors.push(`${path}.model: Value must be the action and the model's name.`);
+      }
+      if (Object.hasOwn(entry, "sentFrom")) {
+        const from = entry["sentFrom"];
+        if (!isObject2(from) || typeof from["name"] !== "string" || !Array.isArray(from["path"]) || !from["path"].every((name) => typeof name === "string") || Object.keys(from).some((key) => key !== "name" && key !== "path"))
+          errors.push(
+            `${path}.sentFrom: Value must be the request's name and the names of its collection and folders.`
+          );
+      }
     });
   }
   return errors;
 }
 
+// ../core/src/import/import-error.ts
+var ImportError = class extends Error {
+  constructor(message, issues = [], cause) {
+    super(message, { cause });
+    this.issues = issues;
+  }
+  issues;
+  name = "ImportError";
+};
+
+// ../core/src/share/link.ts
+var SHARE_LINK_MAX_BYTES = 12 * 1024;
+
 // ../core/src/run/data-file.ts
 var DataFileError = class extends Error {
   name = "DataFileError";
@@ -11414,28 +12034,37 @@ function parseDataFile(text3, fileName) {
   if (/\.json$/i.test(fileName)) {
     const parsed2 = parseJson(text3);
     const isObject5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-    if (!parsed2.ok || !Array.isArray(parsed2.value) || !parsed2.value.every(isObject5)) throw new DataFileError("A JSON data file is a list of objects, one for each iteration.");
+    if (!parsed2.ok || !Array.isArray(parsed2.value) || !parsed2.value.every(isObject5))
+      throw new DataFileError("A JSON data file is a list of objects, one for each iteration.");
     return parsed2.value.map(
-      (entry) => Object.entries(entry).map(([key, value]) => typeof value === "string" ? { key, value, enabled: true } : { key, value: stringifyJson(value) ?? "null", enabled: true, json: true })
+      (entry) => Object.entries(entry).map(
+        ([key, value]) => typeof value === "string" ? { key, value, enabled: true } : { key, value: stringifyJson(value) ?? "null", enabled: true, json: true }
+      )
     );
   }
   const [names, ...records] = parseCsv(text3);
-  if (!names?.some((name) => name)) throw new DataFileError("A CSV data file has the names of its values in its first line.");
-  return records.filter((record) => record.length > 1 || record[0] !== "").map((record) => names.flatMap((key, index) => key ? [{ key, value: record[index] ?? "", enabled: true }] : []));
+  if (!names?.some((name) => name))
+    throw new DataFileError("A CSV data file has the names of its values in its first line.");
+  return records.filter((record) => record.length > 1 || record[0] !== "").map(
+    (record) => names.flatMap((key, index) => key ? [{ key, value: record[index] ?? "", enabled: true }] : [])
+  );
 }
 
-// ../core/src/import/import-error.ts
-var ImportError = class extends Error {
-  constructor(message, issues = []) {
-    super(message);
-    this.issues = issues;
-  }
-  issues;
-  name = "ImportError";
-};
-
 // ../core/src/import/curl.ts
-var ANSI_C = { n: "\n", t: "	", r: "\r", a: "\x07", b: "\b", e: "\x1B", f: "\f", v: "\v", "\\": "\\", "'": "'", '"': '"', "?": "?" };
+var ANSI_C = {
+  n: "\n",
+  t: "	",
+  r: "\r",
+  a: "\x07",
+  b: "\b",
+  e: "\x1B",
+  f: "\f",
+  v: "\v",
+  "\\": "\\",
+  "'": "'",
+  '"': '"',
+  "?": "?"
+};
 function ansiEscape(text3, at) {
   const numbered = [
     [/^x([0-9a-fA-F]{1,2})/, 16],
@@ -11546,6 +12175,7 @@ var VALUE_OPTIONS = {
   "--data-raw": "data-raw",
   "--data-binary": "data-binary",
   "--data-urlencode": "data-urlencode",
+  "--json": "json",
   "-F": "form",
   "--form": "form",
   "--form-string": "form-string",
@@ -11568,7 +12198,33 @@ var FLAGS = {
   "--insecure": "insecure",
   "--compressed": "compressed"
 };
-var QUIET_FLAGS = /* @__PURE__ */ new Set(["-s", "--silent", "-S", "--show-error", "-v", "--verbose", "-i", "--include", "-L", "--location", "-f", "--fail", "-#", "--progress-bar", "-g", "--globoff", "-N", "--no-buffer", "--http1.1", "--http2", "-4", "-6", "-q", "-n", "-j"]);
+var QUIET_FLAGS = /* @__PURE__ */ new Set([
+  "-s",
+  "--silent",
+  "-S",
+  "--show-error",
+  "-v",
+  "--verbose",
+  "-i",
+  "--include",
+  "-L",
+  "--location",
+  "-f",
+  "--fail",
+  "-#",
+  "--progress-bar",
+  "-g",
+  "--globoff",
+  "-N",
+  "--no-buffer",
+  "--http1.1",
+  "--http2",
+  "-4",
+  "-6",
+  "-q",
+  "-n",
+  "-j"
+]);
 var SKIPPED_VALUE_OPTIONS = /* @__PURE__ */ new Set([
   "-o",
   "--output",
@@ -11625,7 +12281,16 @@ var SKIPPED_VALUE_OPTIONS = /* @__PURE__ */ new Set([
   "--trace-ascii",
   "--stderr",
   "--proto",
-  "--proto-default"
+  "--proto-default",
+  "--url-query",
+  "--proxy-header",
+  "--socks5",
+  "--socks5-hostname",
+  "--preproxy",
+  "--request-target",
+  "--doh-url",
+  "--output-dir",
+  "--netrc-file"
 ]);
 var formEncode = (text3) => new URLSearchParams([[text3, ""]]).toString().slice(0, -1);
 var contentType = (headers2) => headers2.filter(([name]) => name.toLowerCase() === "content-type").at(-1)?.[1];
@@ -11650,7 +12315,9 @@ function formPart(value, warnings) {
   if (quotedFile) return { name, fileName: quotedFile[1].replace(/\\(.)/g, "$1") };
   if (content.startsWith("@")) return { name, fileName: content.slice(1).split(/[;,]/)[0] };
   if (content.startsWith("<")) {
-    warnings.push(`The form part ${name} takes its text from the file ${content.slice(1).split(";")[0]}, which was not read: the part is empty.`);
+    warnings.push(
+      `The form part ${name} takes its text from the file ${content.slice(1).split(";")[0]}, which was not read: the part is empty.`
+    );
     return { name, value: "" };
   }
   return { name, value: content.replace(/;type=[^;]*$/, "") };
@@ -11665,7 +12332,7 @@ function parseCurl(text3) {
   const urls = [];
   let method;
   let basic;
-  let [get, head, binaryOnly] = [false, false, true];
+  let [get, head, binaryOnly, json] = [false, false, true, false];
   const take = (kind, value) => {
     switch (kind) {
       case "method":
@@ -11680,7 +12347,9 @@ function parseCurl(text3) {
       }
       case "data":
       case "data-binary":
-        if (kind === "data") binaryOnly = false;
+      case "json":
+        if (kind === "json") json = true;
+        if (kind !== "data-binary") binaryOnly = false;
         data.push(value.startsWith("@") ? { file: value.slice(1) } : { text: value });
         break;
       case "data-raw":
@@ -11733,7 +12402,8 @@ function parseCurl(text3) {
     } else if (word.startsWith("--")) {
       if (Object.hasOwn(VALUE_OPTIONS, word)) take(VALUE_OPTIONS[word], valueOf(word));
       else if (Object.hasOwn(FLAGS, word)) ({ get, head } = flag(FLAGS[word], { get, head }, warnings));
-      else if (SKIPPED_VALUE_OPTIONS.has(word)) warnings.push(`${word} ${valueOf(word)} was left out: the app has nothing it applies to.`);
+      else if (SKIPPED_VALUE_OPTIONS.has(word))
+        warnings.push(`${word} ${valueOf(word)} was left out: the app has nothing it applies to.`);
       else if (!QUIET_FLAGS.has(word)) warnings.push(`${word} was left out: the app does not know this option.`);
     } else {
       for (let at = 1; at < word.length; at++) {
@@ -11753,14 +12423,23 @@ function parseCurl(text3) {
     }
   }
   if (!urls.length) throw new ImportError("The cURL command has no address.");
-  if (urls.length > 1) warnings.push(`The command names ${urls.length} addresses. The first is used; the others were left out: ${urls.slice(1).join(", ")}.`);
+  if (urls.length > 1)
+    warnings.push(
+      `The command names ${urls.length} addresses. The first is used; the others were left out: ${urls.slice(1).join(", ")}.`
+    );
   let url = urls[0];
+  if (json) {
+    for (const name of ["Content-Type", "Accept"])
+      if (!headers2.some(([named2]) => named2.toLowerCase() === name.toLowerCase()))
+        headers2.push([name, "application/json"]);
+  }
   const type = (contentType(headers2) ?? "").toLowerCase();
   let body3 = { mode: "none" };
   const files = data.flatMap((datum) => "file" in datum ? [datum.file] : []);
   if (parts.length) {
     body3 = { mode: "multipart", parts };
-    if (data.length) warnings.push("The command has both a form (-F) and data (-d). curl refuses that; the form is kept.");
+    if (data.length)
+      warnings.push("The command has both a form (-F) and data (-d). curl refuses that; the form is kept.");
   } else if (get) {
     const query = data.flatMap((datum) => "text" in datum ? [datum.text] : []).join("&");
     if (files.length) warnings.push(`The data of the file ${files.join(", ")} was left out: the file was not read.`);
@@ -11770,17 +12449,26 @@ function parseCurl(text3) {
   } else if (data.length) {
     if (files.length) warnings.push(`The data of the file ${files.join(", ")} was left out: the file was not read.`);
     const wire = data.flatMap((datum) => "text" in datum ? [datum.text] : []).join("&");
-    body3 = !type || type.startsWith("application/x-www-form-urlencoded") ? { mode: "urlencoded", fields: [...new URLSearchParams(wire)] } : { mode: "raw", text: wire };
+    const pairs2 = wire.split("&").every((piece) => /^[\w.~%+\-[\]]*(=|$)/.test(piece));
+    if (!type && !pairs2) headers2.push(["Content-Type", "application/x-www-form-urlencoded"]);
+    body3 = !type && pairs2 || type.startsWith("application/x-www-form-urlencoded") ? { mode: "urlencoded", fields: [...new URLSearchParams(wire)] } : { mode: "raw", text: wire };
   }
   method ??= head ? "HEAD" : body3.mode === "none" ? "GET" : "POST";
-  if (!isHttpMethod(method)) throw new ImportError(`The cURL command's method, ${method}, is not an HTTP method: one word of at most 32 characters.`);
+  if (!isHttpMethod(method))
+    throw new ImportError(
+      `The cURL command's method, ${method}, is not an HTTP method: one word of at most 32 characters.`
+    );
   return { request: { method, url, headers: headers2, body: body3 }, ...basic && { basic }, warnings };
 }
 function flag(kind, state, warnings) {
   if (kind === "get") return { ...state, get: true };
   if (kind === "head") return { ...state, head: true };
-  if (kind === "insecure") warnings.push("-k (do not check the server's certificate) was left out: a browser always checks it, and the Local Bridge cannot skip the check yet.");
-  if (kind === "compressed") warnings.push("--compressed was left out: the browser asks for a compressed answer by itself.");
+  if (kind === "insecure")
+    warnings.push(
+      "-k (do not check the server's certificate) was left out: a browser always checks it, and the Local Bridge cannot skip the check yet."
+    );
+  if (kind === "compressed")
+    warnings.push("--compressed was left out: the browser asks for a compressed answer by itself.");
   return state;
 }
 function languageOf(type) {
@@ -11799,8 +12487,15 @@ function curlRequest(parsed2) {
   const language = languageOf(type.toLowerCase());
   const row = (key, value) => ({ key, value, enabled: true });
   const implied = body3.mode === "urlencoded" ? "application/x-www-form-urlencoded" : body3.mode === "multipart" ? "multipart/form-data" : body3.mode === "raw" ? RAW_CONTENT_TYPES[language] : null;
-  const headers2 = request.headers.filter(([name, value]) => !(name.toLowerCase() === "content-type" && implied !== null && value.toLowerCase().split(";")[0].trim() === implied));
-  const content = { ...emptyRequest(), method: request.method, url: request.url, headers: headers2.map(([name, value]) => row(name, value)) };
+  const headers2 = request.headers.filter(
+    ([name, value]) => !(name.toLowerCase() === "content-type" && implied !== null && value.toLowerCase().split(";")[0].trim() === implied)
+  );
+  const content = {
+    ...emptyRequest(),
+    method: request.method,
+    url: request.url,
+    headers: headers2.map(([name, value]) => row(name, value))
+  };
   if (basic) content.auth = { type: "basic", ...basic };
   if (body3.mode === "raw") {
     content.body = { mode: "raw", raw: { language, text: body3.text } };
@@ -11809,12 +12504,23 @@ function curlRequest(parsed2) {
   } else if (body3.mode === "multipart") {
     content.body = {
       mode: "multipart",
-      multipart: body3.parts.map((part) => "value" in part ? { kind: "text", key: part.name, value: part.value, enabled: true } : { kind: "file", key: part.name, fileId: "", fileName: part.fileName, enabled: true })
+      multipart: body3.parts.map(
+        (part) => "value" in part ? { kind: "text", key: part.name, value: part.value, enabled: true } : { kind: "file", key: part.name, fileId: "", fileName: part.fileName, enabled: true }
+      )
     };
-    for (const part of body3.parts) if ("fileName" in part) warnings.push(`The form part ${part.name} sends the file ${part.fileName}. Choose the file again in the Body tab: a command names a file, it does not hold it.`);
+    for (const part of body3.parts)
+      if ("fileName" in part)
+        warnings.push(
+          `The form part ${part.name} sends the file ${part.fileName}. Choose the file again in the Body tab: a command names a file, it does not hold it.`
+        );
   } else if (body3.mode === "binary") {
-    content.body = { mode: "binary", ...type && { binary: { fileId: "", fileName: body3.fileName, contentType: type } } };
-    warnings.push(`The body is the file ${body3.fileName}. Choose the file again in the Body tab: a command names a file, it does not hold it.`);
+    content.body = {
+      mode: "binary",
+      ...type && { binary: { fileId: "", fileName: body3.fileName, contentType: type } }
+    };
+    warnings.push(
+      `The body is the file ${body3.fileName}. Choose the file again in the Body tab: a command names a file, it does not hold it.`
+    );
   }
   return { content, warnings };
 }
@@ -11835,16 +12541,23 @@ function bodyOf(postData, warnings) {
   const params = list(own2(postData, "params"));
   if (type.startsWith("multipart/form-data")) {
     if (!params.length) {
-      warnings.push("Its multipart body is in the file as text only, with a boundary of that one send. It is kept as text.");
+      warnings.push(
+        "Its multipart body is in the file as text only, with a boundary of that one send. It is kept as text."
+      );
       return { mode: "raw", text: text(own2(postData, "text")) };
     }
     return {
       mode: "multipart",
-      parts: params.map((param) => typeof own2(param, "fileName") === "string" ? { name: text(own2(param, "name")), fileName: text(own2(param, "fileName")) } : { name: text(own2(param, "name")), value: text(own2(param, "value")) })
+      parts: params.map(
+        (param) => typeof own2(param, "fileName") === "string" ? { name: text(own2(param, "name")), fileName: text(own2(param, "fileName")) } : { name: text(own2(param, "name")), value: text(own2(param, "value")) }
+      )
     };
   }
   if (type.startsWith("application/x-www-form-urlencoded")) {
-    return { mode: "urlencoded", fields: params.length ? params.map((param) => [text(own2(param, "name")), text(own2(param, "value"))]) : [...new URLSearchParams(text(own2(postData, "text")))] };
+    return {
+      mode: "urlencoded",
+      fields: params.length ? params.map((param) => [text(own2(param, "name")), text(own2(param, "value"))]) : [...new URLSearchParams(text(own2(postData, "text")))]
+    };
   }
   const body3 = text(own2(postData, "text"));
   if (own2(postData, "encoding") === "base64") {
@@ -11859,11 +12572,18 @@ function parseHar(value) {
   return entries.flatMap((entry, index) => {
     const request = own2(entry, "request");
     const [method, url] = isObject3(request) ? [text(own2(request, "method")).toUpperCase(), text(own2(request, "url"))] : ["", ""];
-    if (!isObject3(request) || !method || !url) throw new ImportError(`The HAR's entry ${index + 1} has no request with a method and a URL.`);
+    if (!isObject3(request) || !method || !url)
+      throw new ImportError(`The HAR's entry ${index + 1} has no request with a method and a URL.`);
     const warnings = [];
     const headers2 = list(own2(request, "headers")).map((header) => [text(own2(header, "name")), text(own2(header, "value"))]).filter(([name]) => name && !name.startsWith(":"));
     const path = URL.canParse(url) ? new URL(url).pathname : url;
-    return [{ name: `${method} ${path}`, request: { method, url, headers: headers2, body: bodyOf(own2(request, "postData"), warnings) }, warnings }];
+    return [
+      {
+        name: `${method} ${path}`,
+        request: { method, url, headers: headers2, body: bodyOf(own2(request, "postData"), warnings) },
+        warnings
+      }
+    ];
   });
 }
 
@@ -11896,7 +12616,12 @@ function addressParts(raw) {
   const host = colon === -1 ? authority : authority.slice(0, colon);
   return {
     ...protocol !== void 0 && { protocol: back(protocol) },
-    ...user !== void 0 && { auth: { user: back(user.split(":")[0]), ...user.includes(":") && { password: back(user.slice(user.indexOf(":") + 1)) } } },
+    ...user !== void 0 && {
+      auth: {
+        user: back(user.split(":")[0]),
+        ...user.includes(":") && { password: back(user.slice(user.indexOf(":") + 1)) }
+      }
+    },
     host: host.startsWith("[") ? [back(host)] : host.split(".").map(back),
     ...port !== void 0 && { port: back(port) },
     ...path !== void 0 && { path: path.split("/").map(back) },
@@ -11931,7 +12656,11 @@ var description = (value) => {
   const words = isObject4(value) ? text2(field3(value, "content")) : text2(value);
   return words ? { description: words } : {};
 };
-var rows = (value) => objects(value).map((entry) => ({ key: text2(field3(entry, "key") ?? field3(entry, "id")), value: text2(field3(entry, "value")), enabled: field3(entry, "disabled") !== true }));
+var rows = (value) => objects(value).map((entry) => ({
+  key: text2(field3(entry, "key") ?? field3(entry, "id")),
+  value: text2(field3(entry, "value")),
+  enabled: field3(entry, "disabled") !== true
+}));
 function headers(value) {
   if (typeof value !== "string") return rows(value);
   return value.split(/\r?\n/).filter((line2) => line2.trim()).map((line2) => {
@@ -11956,15 +12685,30 @@ function auth(value, item, warnings, top) {
     case "apikey":
       return { type, key: read("key"), value: read("value"), in: read("in") === "query" ? "query" : "header" };
     case "awsv4":
-      return { type, accessKey: read("accessKey"), secretKey: read("secretKey"), sessionToken: read("sessionToken"), region: read("region"), service: read("service") };
+      return {
+        type,
+        accessKey: read("accessKey"),
+        secretKey: read("secretKey"),
+        sessionToken: read("sessionToken"),
+        region: read("region"),
+        service: read("service")
+      };
     case "oauth2": {
       const grant = OAUTH_GRANTS_OF.get(read("grant_type"));
       if (!grant) {
-        warnings.push({ item, message: `Its auth is OAuth 2.0 with a grant the app does not have (${read("grant_type").slice(0, 40)}) and is left out: it is sent with no auth.` });
+        warnings.push({
+          item,
+          message: `Its auth is OAuth 2.0 with a grant the app does not have (${read("grant_type").slice(0, 40)}) and is left out: it is sent with no auth.`
+        });
         return { type: "none" };
       }
-      if (read("accessToken")) warnings.push({ item, message: "The OAuth 2.0 token in the file is not kept: get one in the Auth tab." });
-      if (read("addTokenTo") === "queryParams") warnings.push({ item, message: "Its OAuth 2.0 token was added to the address: the app sends it in the Authorization header." });
+      if (read("accessToken"))
+        warnings.push({ item, message: "The OAuth 2.0 token in the file is not kept: get one in the Auth tab." });
+      if (read("addTokenTo") === "queryParams")
+        warnings.push({
+          item,
+          message: "Its OAuth 2.0 token was added to the address: the app sends it in the Authorization header."
+        });
       return {
         type,
         grant,
@@ -11980,7 +12724,10 @@ function auth(value, item, warnings, top) {
       };
     }
     default:
-      warnings.push({ item, message: `Its auth is of a type the app does not have (${type || "no type"}) and is left out: it is sent with no auth.` });
+      warnings.push({
+        item,
+        message: `Its auth is of a type the app does not have (${type || "no type"}) and is left out: it is sent with no auth.`
+      });
       return { type: "none" };
   }
 }
@@ -11998,21 +12745,30 @@ function scripts(value, item, warnings) {
     return Array.isArray(exec) ? exec.map(text2).join("\n") : text2(exec);
   }).join("\n");
   const others = objects(value).map((event) => text2(field3(event, "listen"))).filter((listen) => listen !== "prerequest" && listen !== "test");
-  if (others.length) warnings.push({ item, message: `A script for "${others[0]}" is left out: the app runs a script before a request and after its response.` });
+  if (others.length)
+    warnings.push({
+      item,
+      message: `A script for "${others[0]}" is left out: the app runs a script before a request and after its response.`
+    });
   return { pre: of2("prerequest"), post: of2("test") };
 }
 function address(value, item, warnings) {
   const inText = (url2) => (addressParts(url2).query ?? []).map((entry) => ({ key: entry.key, value: entry.value ?? "", enabled: true }));
   if (!isObject4(value)) return { url: text2(value), params: inText(text2(value)) };
-  const kept = (part, marks) => part.split(/(\{\{[^{}]*\}\})/).map((piece, index) => index % 2 ? piece : piece.replace(marks, (mark) => `%${mark.charCodeAt(0).toString(16).toUpperCase()}`)).join("");
+  const kept = (part, marks) => part.split(/(\{\{[^{}]*\}\})/).map(
+    (piece, index) => index % 2 ? piece : piece.replace(marks, (mark) => `%${mark.charCodeAt(0).toString(16).toUpperCase()}`)
+  ).join("");
   const params = objects(field3(value, "query")).map((entry) => {
     const enabled = field3(entry, "disabled") !== true;
-    return { key: enabled ? kept(text2(field3(entry, "key")), /[#&=]/g) : text2(field3(entry, "key")), value: enabled ? kept(text2(field3(entry, "value")), /[#&]/g) : text2(field3(entry, "value")), enabled };
+    return {
+      key: enabled ? kept(text2(field3(entry, "key")), /[#&=]/g) : text2(field3(entry, "key")),
+      value: enabled ? kept(text2(field3(entry, "value")), /[#&]/g) : text2(field3(entry, "value")),
+      enabled
+    };
   });
-  const off = params.filter((row) => !row.enabled).map((row) => row.key);
-  if (off.length) warnings.push({ item, message: `${off.length === 1 ? `A query parameter that is switched off (${off[0]}) is` : `${off.length} query parameters that are switched off are`} kept for an export, but the composer has no switch for a parameter: it does not show one, and saving the request there drops it.` });
   const host = field3(value, "host");
-  if (host === void 0) return { url: text2(field3(value, "raw")), params: params.length ? params : inText(text2(field3(value, "raw"))) };
+  if (host === void 0)
+    return { url: text2(field3(value, "raw")), params: params.length ? params : inText(text2(field3(value, "raw"))) };
   const variables2 = objects(field3(value, "variable"));
   const replaced = [];
   const named2 = [];
@@ -12029,11 +12785,21 @@ function address(value, item, warnings) {
   const protocol = field3(value, "protocol");
   const port = field3(value, "port");
   const path = field3(value, "path");
-  const query = objects(field3(value, "query")).filter((entry) => field3(entry, "disabled") !== true).map((entry) => field3(entry, "value") === null || field3(entry, "value") === void 0 ? kept(text2(field3(entry, "key")), /[#&=]/g) : `${kept(text2(field3(entry, "key")), /[#&=]/g)}=${kept(text2(field3(entry, "value")), /[#&]/g)}`);
+  const query = objects(field3(value, "query")).filter((entry) => field3(entry, "disabled") !== true).map(
+    (entry) => field3(entry, "value") === null || field3(entry, "value") === void 0 ? kept(text2(field3(entry, "key")), /[#&=]/g) : `${kept(text2(field3(entry, "key")), /[#&=]/g)}=${kept(text2(field3(entry, "value")), /[#&]/g)}`
+  );
   const hash = field3(value, "hash");
   const url = (protocol === void 0 ? "" : `${text2(protocol)}://`) + (isObject4(login) ? `${text2(field3(login, "user"))}${field3(login, "password") === void 0 ? "" : `:${text2(field3(login, "password"))}`}@` : "") + joined(host, ".") + (port === void 0 ? "" : `:${text2(port)}`) + (path === void 0 ? "" : `/${Array.isArray(path) ? joined(path, "/", inPath) : text2(path).replace(/^\//, "").split("/").map(inPath).join("/")}`) + (query.length ? `?${query.join("&")}` : "") + (hash === void 0 ? "" : `#${text2(hash)}`);
-  if (replaced.length) warnings.push({ item, message: `${replaced.length === 1 ? `The path variable ${replaced[0]} is` : `The path variables ${replaced.join(", ")} are`} replaced by ${replaced.length === 1 ? "its value" : "their values"} in the address: the app has no path variables.` });
-  if (named2.length) warnings.push({ item, message: `${named2.length === 1 ? `The path variable ${named2[0]} has` : `The path variables ${named2.join(", ")} have`} no value in the file: in the address ${named2.length === 1 ? "it is" : "they are"} ${named2.map((part) => `{{${part.slice(1)}}}`).join(", ")}, to be given a value as ${named2.length === 1 ? "a variable" : "variables"}.` });
+  if (replaced.length)
+    warnings.push({
+      item,
+      message: `${replaced.length === 1 ? `The path variable ${replaced[0]} is` : `The path variables ${replaced.join(", ")} are`} replaced by ${replaced.length === 1 ? "its value" : "their values"} in the address: the app has no path variables.`
+    });
+  if (named2.length)
+    warnings.push({
+      item,
+      message: `${named2.length === 1 ? `The path variable ${named2[0]} has` : `The path variables ${named2.join(", ")} have`} no value in the file: in the address ${named2.length === 1 ? "it is" : "they are"} ${named2.map((part) => `{{${part.slice(1)}}}`).join(", ")}, to be given a value as ${named2.length === 1 ? "a variable" : "variables"}.`
+    });
   return { url, params };
 }
 function body(value, item, warnings) {
@@ -12053,11 +12819,19 @@ function body(value, item, warnings) {
         return field3(part, "type") === "file" ? { key, enabled, kind: "file", fileId: "", fileName: file(field3(part, "src")) } : { key, enabled, kind: "text", value: text2(field3(part, "value")) };
       })
     },
-    ...isObject4(field3(value, "file")) && { binary: { fileId: "", fileName: file(field3(field3(value, "file"), "src")) } },
+    ...isObject4(field3(value, "file")) && {
+      binary: { fileId: "", fileName: file(field3(field3(value, "file"), "src")) }
+    },
     // Postman keeps the variables as text, as the app does.
-    ...isObject4(field3(value, "graphql")) && { graphql: { query: text2(field3(field3(value, "graphql"), "query")), variables: text2(field3(field3(value, "graphql"), "variables")) } }
+    ...isObject4(field3(value, "graphql")) && {
+      graphql: {
+        query: text2(field3(field3(value, "graphql"), "query")),
+        variables: text2(field3(field3(value, "graphql"), "variables"))
+      }
+    }
   };
-  if (kept.multipart?.some((part) => part.kind === "file") || kept.binary) warnings.push({ item, message: "A file of its body is named, not included: choose it again in the Body tab." });
+  if (kept.multipart?.some((part) => part.kind === "file") || kept.binary)
+    warnings.push({ item, message: "A file of its body is named, not included: choose it again in the Body tab." });
   if (field3(value, "disabled") === true) return { mode: "none", ...kept };
   switch (field3(value, "mode")) {
     case "raw":
@@ -12075,7 +12849,10 @@ function body(value, item, warnings) {
     case "none":
       return { mode: "none", ...kept };
     default:
-      warnings.push({ item, message: `Its body is of a kind the app does not have (${text2(field3(value, "mode"))}) and is left out.` });
+      warnings.push({
+        item,
+        message: `Its body is of a kind the app does not have (${text2(field3(value, "mode"))}) and is left out.`
+      });
       return { mode: "none", ...kept };
   }
 }
@@ -12120,7 +12897,10 @@ function postmanCollection(value) {
       const method = text2(field3(source, "method") ?? "GET").toUpperCase();
       examples += list2(field3(entry, "response")).length;
       if (!url.trim() || !isHttpMethod(method)) {
-        warnings.push({ item: item2, message: !url.trim() ? "It has no address and is left out." : `Its method (${method.slice(0, 40)}) is not an HTTP method and it is left out.` });
+        warnings.push({
+          item: item2,
+          message: !url.trim() ? "It has no address and is left out." : `Its method (${method.slice(0, 40)}) is not an HTTP method and it is left out.`
+        });
         continue;
       }
       requests.push({
@@ -12145,7 +12925,11 @@ function postmanCollection(value) {
   };
   walk2(field3(value, "item"), void 0, 0);
   const item = `collection "${name}"`;
-  if (examples) warnings.push({ item, message: `${examples} saved ${examples === 1 ? "response is" : "responses are"} left out: the app keeps responses in its history, not in a collection.` });
+  if (examples)
+    warnings.push({
+      item,
+      message: `${examples} saved ${examples === 1 ? "response is" : "responses are"} left out: the app keeps responses in its history, not in a collection.`
+    });
   return {
     payload: {
       $id: COLLECTION_FORMAT,
@@ -12177,9 +12961,18 @@ function postmanEnvironment(value) {
       meta: { id, createdAt: now, updatedAt: now },
       name,
       order: 0,
-      vars: objects(isObject4(value) ? field3(value, "values") : value).map((entry) => ({ key: text2(field3(entry, "key")), value: text2(field3(entry, "value")), enabled: field3(entry, "enabled") !== false && field3(entry, "disabled") !== true }))
+      vars: objects(isObject4(value) ? field3(value, "values") : value).map((entry) => ({
+        key: text2(field3(entry, "key")),
+        value: text2(field3(entry, "value")),
+        enabled: field3(entry, "enabled") !== false && field3(entry, "disabled") !== true
+      }))
     },
-    warnings: globals ? [{ item: `environment "${name}"`, message: "Postman's globals are imported as an environment: choose it as the active environment, or copy what you need into the app's globals." }] : []
+    warnings: globals ? [
+      {
+        item: `environment "${name}"`,
+        message: "Postman's globals are imported as an environment: choose it as the active environment, or copy what you need into the app's globals."
+      }
+    ] : []
   };
 }
 
@@ -12190,10 +12983,16 @@ function isInsomnia(value) {
   return field3(value, "_type") === "export" || Object.hasOwn(value, "__export_format") || /^\w+\.insomnia(\.rest)?\/\d/.test(text2(field3(value, "type")));
 }
 var VARIABLE = /\{\{\s*(?:_\.|_(?=\[))?((?:\w[\w-]*|\[(?:'[^'\]]*'|"[^"\]]*")\])(?:\.\w[\w-]*|\[(?:'[^'\]]*'|"[^"\]]*")\])*)\s*\}\}/g;
-var variables = (value) => value.replace(VARIABLE, (_match, path) => `{{${path.replace(/\[(?:'([^'\]]*)'|"([^"\]]*)")\]/g, (_part, single, double) => `.${single ?? double ?? ""}`).replace(/^\./, "")}}}`);
+var variables = (value) => value.replace(
+  VARIABLE,
+  (_match, path) => `{{${path.replace(/\[(?:'([^'\]]*)'|"([^"\]]*)")\]/g, (_part, single, double) => `.${single ?? double ?? ""}`).replace(/^\./, "")}}}`
+);
 function foreign(value) {
   const found = [];
-  for (const [open, close] of [["{%", "%}"], ["{{", "}}"]]) {
+  for (const [open, close] of [
+    ["{%", "%}"],
+    ["{{", "}}"]
+  ]) {
     let at = value.indexOf(open);
     while (at !== -1) {
       const end = value.indexOf(close, at + 2);
@@ -12214,7 +13013,11 @@ function reader(item, warnings) {
       return turned;
     },
     done: () => {
-      if (templates.length) warnings.push({ item, message: `It uses a template of Insomnia's (${templates[0].slice(0, 40)}${templates.length > 1 ? `, and ${templates.length - 1} more` : ""}), which the app does not have: the text is kept as written.` });
+      if (templates.length)
+        warnings.push({
+          item,
+          message: `It uses a template of Insomnia's (${templates[0].slice(0, 40)}${templates.length > 1 ? `, and ${templates.length - 1} more` : ""}), which the app does not have: the text is kept as written.`
+        });
     }
   };
 }
@@ -12230,7 +13033,11 @@ function environment(name, vars) {
   const now = Date.now();
   return { id, meta: { id, createdAt: now, updatedAt: now }, name, order: 0, vars };
 }
-var pairs = (value, said2) => objects(value).map((entry) => ({ key: said2(field3(entry, "name")), value: said2(field3(entry, "value")), ...field3(entry, "disabled") === true && { disabled: true } })).filter((entry) => entry.key !== "" || entry.value !== "");
+var pairs = (value, said2) => objects(value).map((entry) => ({
+  key: said2(field3(entry, "name")),
+  value: said2(field3(entry, "value")),
+  ...field3(entry, "disabled") === true && { disabled: true }
+})).filter((entry) => entry.key !== "" || entry.value !== "");
 function auth2(value, said2) {
   if (!isObject4(value) || typeof field3(value, "type") !== "string" || field3(value, "disabled") === true) return {};
   const type = text2(field3(value, "type"));
@@ -12243,18 +13050,44 @@ function auth2(value, said2) {
     case "bearer": {
       const prefix = read("prefix").trim();
       if (!prefix || prefix === "Bearer") return { auth: { type, bearer: { token: read("token") } } };
-      return { auth: { type: "apikey", apikey: { key: "Authorization", value: prefix === "NO_PREFIX" ? read("token") : `${prefix} ${read("token")}`, in: "header" } } };
+      return {
+        auth: {
+          type: "apikey",
+          apikey: {
+            key: "Authorization",
+            value: prefix === "NO_PREFIX" ? read("token") : `${prefix} ${read("token")}`,
+            in: "header"
+          }
+        }
+      };
     }
     case "apikey": {
       const place = text2(field3(value, "addTo"));
       if (place && place !== "header" && place !== "queryParams") return { auth: { type: `an API key in a ${place}` } };
-      return { auth: { type, apikey: { key: read("key"), value: read("value"), in: place === "queryParams" ? "query" : "header" } } };
+      return {
+        auth: {
+          type,
+          apikey: { key: read("key"), value: read("value"), in: place === "queryParams" ? "query" : "header" }
+        }
+      };
     }
     case "iam":
-      return { auth: { type: "awsv4", awsv4: { accessKey: read("accessKeyId"), secretKey: read("secretAccessKey"), sessionToken: read("sessionToken"), region: read("region"), service: read("service") } } };
+      return {
+        auth: {
+          type: "awsv4",
+          awsv4: {
+            accessKey: read("accessKeyId"),
+            secretKey: read("secretAccessKey"),
+            sessionToken: read("sessionToken"),
+            region: read("region"),
+            service: read("service")
+          }
+        }
+      };
     case "oauth2": {
       const grant = read("grantType");
-      if (grant !== "authorization_code" && grant !== "client_credentials" && grant !== "password") return { auth: { type, oauth2: { grant_type: grant || "none said" } } };
+      if (grant !== "authorization_code" && grant !== "client_credentials" && grant !== "password")
+        return { auth: { type, oauth2: { grant_type: grant || "none said" } } };
       return {
         auth: {
           type,
@@ -12291,8 +13124,10 @@ function body2(value, said2) {
       }
     };
   }
-  if (type === "application/x-www-form-urlencoded" && Array.isArray(params)) return { body: { mode: "urlencoded", urlencoded: pairs(params, said2) } };
-  if (typeof field3(value, "fileName") === "string" && typeof field3(value, "text") !== "string") return { body: { mode: "file", file: { src: field3(value, "fileName") } } };
+  if (type === "application/x-www-form-urlencoded" && Array.isArray(params))
+    return { body: { mode: "urlencoded", urlencoded: pairs(params, said2) } };
+  if (typeof field3(value, "fileName") === "string" && typeof field3(value, "text") !== "string")
+    return { body: { mode: "file", file: { src: field3(value, "fileName") } } };
   if (typeof field3(value, "text") !== "string" || !type && !field3(value, "text")) return {};
   const language = /json|graphql/.test(type) ? "json" : type.includes("xml") ? "xml" : type.includes("html") ? "html" : type.includes("javascript") ? "javascript" : "text";
   return { body: { mode: "raw", raw: said2(field3(value, "text")), options: { raw: { language } } } };
@@ -12301,7 +13136,11 @@ function builder(warnings) {
   const folderVariables = [];
   const scripts2 = (item, { pre, post }) => {
     const kinds = [text2(pre).trim() && "pre-request", text2(post).trim() && "after-response"].filter(Boolean);
-    if (kinds.length) warnings.push({ item, message: `Its ${kinds.join(" and ")} ${kinds.length > 1 ? "scripts are" : "script is"} left out: an Insomnia script calls Insomnia's own "insomnia" object, which the app does not have.` });
+    if (kinds.length)
+      warnings.push({
+        item,
+        message: `Its ${kinds.join(" and ")} ${kinds.length > 1 ? "scripts are" : "script is"} left out: an Insomnia script calls Insomnia's own "insomnia" object, which the app does not have.`
+      });
   };
   const request = ({ source, name, description: description2, scripts: own3 }) => {
     const item = `request "${name || "Request"}"`;
@@ -12313,7 +13152,11 @@ function builder(warnings) {
         method: text2(field3(source, "method")),
         description: description2,
         // Insomnia holds the query's rows beside the address, and sends both.
-        url: { ...url, query: [...url.query ?? [], ...pairs(field3(source, "parameters"), said2)], variable: pairs(field3(source, "pathParameters"), said2) },
+        url: {
+          ...url,
+          query: [...url.query ?? [], ...pairs(field3(source, "parameters"), said2)],
+          variable: pairs(field3(source, "pathParameters"), said2)
+        },
         header: pairs(field3(source, "headers"), said2),
         ...body2(field3(source, "body"), said2),
         ...auth2(field3(source, "authentication"), said2)
@@ -12329,7 +13172,14 @@ function builder(warnings) {
     const variable = rowsOf(field3(source, "environment"), said2);
     folderVariables.push(...variable.map(({ key }) => ({ item, key })));
     const headers2 = pairs(field3(source, "headers"), said2).filter((header) => !header.disabled);
-    if (headers2.length) warnings.push({ item, message: `Its headers (${headers2.map((header) => header.key).join(", ").slice(0, 200)}) are left out: in Insomnia a folder's headers are sent with each request in it, and the app has no headers on a folder. Add them to its requests.` });
+    if (headers2.length)
+      warnings.push({
+        item,
+        message: `Its headers (${headers2.map((header) => header.key).join(", ").slice(
+          0,
+          200
+        )}) are left out: in Insomnia a folder's headers are sent with each request in it, and the app has no headers on a folder. Add them to its requests.`
+      });
     scripts2(item, own3);
     done();
     return { name, description: description2, item: children, variable, ...auth2(field3(source, "authentication"), said2) };
@@ -12337,7 +13187,11 @@ function builder(warnings) {
   const compare = (environments) => {
     for (const { item, key } of folderVariables) {
       const also = environments.find((entry) => entry.vars.some((row) => row.key === key));
-      if (also) warnings.push({ item, message: `Its variable ${key} is also in the environment "${also.name}". Insomnia uses the folder's value; the app uses the environment's when that environment is active.` });
+      if (also)
+        warnings.push({
+          item,
+          message: `Its variable ${key} is also in the environment "${also.name}". Insomnia uses the folder's value; the app uses the environment's when that environment is active.`
+        });
     }
   };
   return { request, folder, compare };
@@ -12349,7 +13203,10 @@ function format5(value) {
   const tree = field3(value, "collection");
   const held = field3(value, "environments");
   const type = text2(field3(value, "type"));
-  if (!Array.isArray(tree) && !isObject4(held)) throw new ImportError(`This Insomnia file (${type.slice(0, 60)}) holds no requests and no environments, so there is nothing to import.`);
+  if (!Array.isArray(tree) && !isObject4(held))
+    throw new ImportError(
+      `This Insomnia file (${type.slice(0, 60)}) holds no requests and no environments, so there is nothing to import.`
+    );
   const name = text2(field3(value, "name")).trim() || UNNAMED;
   const item = Array.isArray(tree) ? `collection "${name}"` : `environment "${name}"`;
   const { said: said2, done } = reader(item, warnings);
@@ -12358,15 +13215,26 @@ function format5(value) {
     if (depth > MAX_DEPTH) throw tooDeep();
     return objects(items).flatMap((source) => {
       const own3 = isObject4(field3(source, "scripts")) ? field3(source, "scripts") : {};
-      const entry = { source, name: text2(field3(source, "name")).trim(), description: described(source), scripts: { pre: field3(own3, "preRequest"), post: field3(own3, "afterResponse") } };
+      const entry = {
+        source,
+        name: text2(field3(source, "name")).trim(),
+        description: described(source),
+        scripts: { pre: field3(own3, "preRequest"), post: field3(own3, "afterResponse") }
+      };
       if (Array.isArray(field3(source, "children"))) return [folder(entry, level(field3(source, "children"), depth + 1))];
       if (typeof field3(source, "method") === "string") return [request(entry)];
-      warnings.push({ item: `request "${entry.name || "Request"}"`, message: "It is not an HTTP request (gRPC, WebSocket or Socket.IO) and is left out." });
+      warnings.push({
+        item: `request "${entry.name || "Request"}"`,
+        message: "It is not an HTTP request (gRPC, WebSocket or Socket.IO) and is left out."
+      });
       return [];
     });
   };
   const base = isObject4(held) ? rowsOf(field3(held, "data"), said2) : [];
-  const subs = objects(isObject4(held) ? field3(held, "subEnvironments") : []).map((sub) => ({ name: text2(field3(sub, "name")).trim() || "Environment", vars: rowsOf(field3(sub, "data"), said2) }));
+  const subs = objects(isObject4(held) ? field3(held, "subEnvironments") : []).map((sub) => ({
+    name: text2(field3(sub, "name")).trim() || "Environment",
+    vars: rowsOf(field3(sub, "data"), said2)
+  }));
   const spec = field3(value, "spec");
   const contents = isObject4(spec) ? field3(spec, "contents") : void 0;
   const left = [
@@ -12375,13 +13243,28 @@ function format5(value) {
     objects(field3(value, "testSuites")).length > 0 && "unit tests",
     isObject4(spec) && (typeof field3(spec, "file") === "string" || isObject4(contents) && Object.keys(contents).length > 0) && "API specification"
   ].filter((kind) => typeof kind === "string");
-  if (left.length) warnings.push({ item, message: `Its ${left.length > 1 ? `${left.slice(0, -1).join(", ")} and ${left.at(-1)} are` : `${left[0]} ${left[0].endsWith("s") ? "are" : "is"}`} left out: the app imports requests, folders and environments.` });
+  if (left.length)
+    warnings.push({
+      item,
+      message: `Its ${left.length > 1 ? `${left.slice(0, -1).join(", ")} and ${left.at(-1)} are` : `${left[0]} ${left[0].endsWith("s") ? "are" : "is"}`} left out: the app imports requests, folders and environments.`
+    });
   let result;
   if (Array.isArray(tree)) {
-    result = { collections: [{ info: { name, description: described(value) }, variable: base, item: level(tree, 1) }], environments: subs.map((sub) => environment(sub.name, sub.vars)), warnings };
+    result = {
+      collections: [{ info: { name, description: described(value) }, variable: base, item: level(tree, 1) }],
+      environments: subs.map((sub) => environment(sub.name, sub.vars)),
+      warnings
+    };
   } else {
-    const merged = (own3) => [...own3, ...base.filter((row) => !own3.some((other) => other.key === row.key))];
-    result = { collections: [], environments: [environment(name, base), ...subs.map((sub) => environment(sub.name, merged(sub.vars)))], warnings };
+    const merged = (own3) => [
+      ...own3,
+      ...base.filter((row) => !own3.some((other) => other.key === row.key))
+    ];
+    result = {
+      collections: [],
+      environments: [environment(name, base), ...subs.map((sub) => environment(sub.name, merged(sub.vars)))],
+      warnings
+    };
   }
   done();
   compare(result.environments);
@@ -12390,7 +13273,9 @@ function format5(value) {
 function format4(value) {
   const version = field3(value, "__export_format");
   if (version !== 4) {
-    throw new ImportError(`This is an Insomnia export of ${version === void 0 ? "a format with no number" : `format ${text2(version).slice(0, 20)}`}, which Wayfarer does not read. Export from a current Insomnia (format 4 or 5) and import that.`);
+    throw new ImportError(
+      `This is an Insomnia export of ${version === void 0 ? "a format with no number" : `format ${text2(version).slice(0, 20)}`}, which Wayfarer does not read. Export from a current Insomnia (format 4 or 5) and import that.`
+    );
   }
   const warnings = [];
   const { request, folder, compare } = builder(warnings);
@@ -12401,7 +13286,9 @@ function format4(value) {
   const children = /* @__PURE__ */ new Map();
   for (const resource of resources) {
     const parent = text2(field3(resource, "parentId"));
-    children.set(parent, [...children.get(parent) ?? [], resource]);
+    const siblings = children.get(parent);
+    if (siblings) siblings.push(resource);
+    else children.set(parent, [resource]);
   }
   for (const list4 of children.values()) list4.sort((a, b) => sortKey(a) - sortKey(b));
   const under = (parent, type) => parent === "" ? [] : (children.get(parent) ?? []).filter((resource) => kind(resource) === type);
@@ -12411,7 +13298,12 @@ function format4(value) {
     return (parent === "" ? [] : children.get(parent) ?? []).flatMap((source) => {
       if (placed.has(source) || kind(source) !== "request" && kind(source) !== "request_group") return [];
       placed.add(source);
-      const entry = { source, name: text2(field3(source, "name")).trim(), description: field3(source, "description"), scripts: { pre: field3(source, "preRequestScript"), post: field3(source, "afterResponseScript") } };
+      const entry = {
+        source,
+        name: text2(field3(source, "name")).trim(),
+        description: field3(source, "description"),
+        scripts: { pre: field3(source, "preRequestScript"), post: field3(source, "afterResponseScript") }
+      };
       return [kind(source) === "request_group" ? folder(entry, level(id(source), depth + 1)) : request(entry)];
     });
   };
@@ -12419,7 +13311,11 @@ function format4(value) {
   const collections = workspaces.map((workspace) => {
     const name = text2(field3(workspace, "name")).trim() || UNNAMED;
     const { said: said2, done } = reader(`collection "${name}"`, warnings);
-    const collection = { info: { name, description: field3(workspace, "description") }, variable: under(id(workspace), "environment").flatMap((base) => rowsOf(field3(base, "data"), said2)), item: level(id(workspace), 1) };
+    const collection = {
+      info: { name, description: field3(workspace, "description") },
+      variable: under(id(workspace), "environment").flatMap((base) => rowsOf(field3(base, "data"), said2)),
+      item: level(id(workspace), 1)
+    };
     done();
     return collection;
   });
@@ -12432,16 +13328,38 @@ function format4(value) {
     done();
     return made;
   });
-  const known = new Set(resources.filter((resource) => kind(resource) === "workspace" || kind(resource) === "request_group").map(id));
+  const known = new Set(
+    resources.filter((resource) => kind(resource) === "workspace" || kind(resource) === "request_group").map(id)
+  );
   const loose = [...children.keys()].filter((parent) => parent !== "" && !known.has(parent)).flatMap((parent) => level(parent, 1));
   if (loose.length) collections.push({ info: { name: UNNAMED, description: void 0 }, variable: [], item: loose });
-  const unplaced = resources.filter((resource) => (kind(resource) === "request" || kind(resource) === "request_group") && !placed.has(resource)).length;
-  if (unplaced) warnings.push({ item: "file", message: `${unplaced} ${unplaced === 1 ? "request or folder is" : "requests and folders are"} left out: the file does not say which collection ${unplaced === 1 ? "it is" : "they are"} in.` });
+  const unplaced = resources.filter(
+    (resource) => (kind(resource) === "request" || kind(resource) === "request_group") && !placed.has(resource)
+  ).length;
+  if (unplaced)
+    warnings.push({
+      item: "file",
+      message: `${unplaced} ${unplaced === 1 ? "request or folder is" : "requests and folders are"} left out: the file does not say which collection ${unplaced === 1 ? "it is" : "they are"} in.`
+    });
   for (const resource of resources) {
-    if (kind(resource).endsWith("_request")) warnings.push({ item: `request "${text2(field3(resource, "name")).trim() || "Request"}"`, message: "It is not an HTTP request (gRPC, WebSocket or Socket.IO) and is left out." });
+    if (kind(resource).endsWith("_request"))
+      warnings.push({
+        item: `request "${text2(field3(resource, "name")).trim() || "Request"}"`,
+        message: "It is not an HTTP request (gRPC, WebSocket or Socket.IO) and is left out."
+      });
   }
-  const others = [...new Set(resources.filter((resource) => !["workspace", "request", "request_group", "environment"].includes(kind(resource)) && !kind(resource).endsWith("_request") && !(kind(resource) === "cookie_jar" && objects(field3(resource, "cookies")).length === 0) && !(kind(resource) === "api_spec" && !text2(field3(resource, "contents")).trim())).map((resource) => kind(resource).slice(0, 30)))];
-  if (others.length) warnings.push({ item: "file", message: `What the file holds that is not a request, a folder or an environment is left out (${others.slice(0, 8).join(", ")}).` });
+  const others = [
+    ...new Set(
+      resources.filter(
+        (resource) => !["workspace", "request", "request_group", "environment"].includes(kind(resource)) && !kind(resource).endsWith("_request") && !(kind(resource) === "cookie_jar" && objects(field3(resource, "cookies")).length === 0) && !(kind(resource) === "api_spec" && !text2(field3(resource, "contents")).trim())
+      ).map((resource) => kind(resource).slice(0, 30))
+    )
+  ];
+  if (others.length)
+    warnings.push({
+      item: "file",
+      message: `What the file holds that is not a request, a folder or an environment is left out (${others.slice(0, 8).join(", ")}).`
+    });
   compare(environments);
   return { collections, environments, warnings };
 }
@@ -12487,13 +13405,19 @@ function openApiCollection(root) {
   const swagger = field3(root, "swagger") !== void 0;
   const version = text2(field3(root, swagger ? "swagger" : "openapi")).slice(0, 20);
   if (swagger ? !/^2(\.0)?$/.test(version) : !/^3(\.|$)/.test(version)) {
-    throw new ImportError(`This is ${swagger ? "a Swagger" : "an OpenAPI"} description of version ${version || "none"}, which Wayfarer does not read. It reads OpenAPI 3.0 and 3.1 and Swagger 2.0.`);
+    throw new ImportError(
+      `This is ${swagger ? "a Swagger" : "an OpenAPI"} description of version ${version || "none"}, which Wayfarer does not read. It reads OpenAPI 3.0 and 3.1 and Swagger 2.0.`
+    );
   }
   const warnings = [];
   const info = field3(root, "info");
   const name = text2(isObject4(info) ? field3(info, "title") : "").trim() || UNNAMED2;
   const top = `collection "${name}"`;
-  if (!swagger && !/^3(\.[01](\.|$)|$)/.test(version)) warnings.push({ item: top, message: `The file is written for OpenAPI ${version}: it is read as OpenAPI 3.1, and what is newer is left out.` });
+  if (!swagger && !/^3(\.[01](\.|$)|$)/.test(version))
+    warnings.push({
+      item: top,
+      message: `The file is written for OpenAPI ${version}: it is read as OpenAPI 3.1, and what is newer is left out.`
+    });
   let item = top;
   const unread = /* @__PURE__ */ new Map();
   const note = (kind, ref) => {
@@ -12542,7 +13466,8 @@ function openApiCollection(root) {
     const of2 = (raw, depth) => {
       const schema = resolve(raw);
       if (!isObject4(schema) || left-- <= 0 || depth > MAX_DEPTH || open.has(schema)) return null;
-      for (const key of ["example", "default", "const"]) if (field3(schema, key) !== void 0) return field3(schema, key);
+      for (const key of ["example", "default", "const"])
+        if (field3(schema, key) !== void 0) return field3(schema, key);
       for (const key of ["examples", "enum"]) if (list3(field3(schema, key)).length) return list3(field3(schema, key))[0];
       open.add(schema);
       try {
@@ -12555,7 +13480,8 @@ function openApiCollection(root) {
           });
           parts.push(Object.fromEntries(sent.map((key) => [key, of2(field3(properties, key), depth + 1)])));
         }
-        if (parts.length) return parts.some(isObject4) ? Object.fromEntries(parts.filter(isObject4).flatMap((part) => Object.entries(part))) : parts[0];
+        if (parts.length)
+          return parts.some(isObject4) ? Object.fromEntries(parts.filter(isObject4).flatMap((part) => Object.entries(part))) : parts[0];
         const choice = [...list3(field3(schema, "oneOf")), ...list3(field3(schema, "anyOf"))][0];
         if (choice !== void 0) return of2(choice, depth + 1);
         const types = field3(schema, "type");
@@ -12581,20 +13507,43 @@ function openApiCollection(root) {
     const schema = resolve(raw);
     return isObject4(schema) && (field3(schema, "type") === "file" || field3(schema, "format") === "binary");
   };
-  const form = (type, fields) => type.startsWith("multipart/") ? { mode: "formdata", formdata: fields.map(({ key, schema, value }) => isFile(schema) ? { key, type: "file", src: "" } : { key, type: "text", value: said(value) }) } : { mode: "urlencoded", urlencoded: fields.map(({ key, value }) => ({ key, value: said(value) })) };
+  const form = (type, fields) => type.startsWith("multipart/") ? {
+    mode: "formdata",
+    formdata: fields.map(
+      ({ key, schema, value }) => isFile(schema) ? { key, type: "file", src: "" } : { key, type: "text", value: said(value) }
+    )
+  } : { mode: "urlencoded", urlencoded: fields.map(({ key, value }) => ({ key, value: said(value) })) };
   const bodyOf2 = (type, media) => {
     const kind = type.toLowerCase();
     const schema = resolve(field3(media, "schema"));
     const value = example(media) ?? sample(schema, true);
     if (kind.startsWith("multipart/") || kind === "application/x-www-form-urlencoded") {
       const properties = isObject4(schema) ? field3(schema, "properties") : void 0;
-      return { body: form(kind, Object.keys(isObject4(value) ? value : {}).map((key) => ({ key, schema: isObject4(properties) ? field3(properties, key) : void 0, value: value[key] }))), header: [] };
+      return {
+        body: form(
+          kind,
+          Object.keys(isObject4(value) ? value : {}).map((key) => ({
+            key,
+            schema: isObject4(properties) ? field3(properties, key) : void 0,
+            value: value[key]
+          }))
+        ),
+        header: []
+      };
     }
-    if (kind === "application/octet-stream" || isFile(schema)) return { body: { mode: "file", file: { src: "" } }, header: [] };
+    if (kind === "application/octet-stream" || isFile(schema))
+      return { body: { mode: "file", file: { src: "" } }, header: [] };
     const language = /json|\*/.test(kind) ? "json" : kind.includes("xml") ? "xml" : kind.includes("html") ? "html" : kind.includes("javascript") ? "javascript" : "text";
     const raw = typeof value === "string" ? value : language === "json" && value !== null ? JSON.stringify(value, null, 2) : "";
-    if (!raw) warnings.push({ item, message: `Its body (${type.slice(0, 80)}) has no example in the file that the app can write out: the body is empty.` });
-    return { body: { mode: "raw", raw, options: { raw: { language } } }, header: kind.includes("*") || RAW_CONTENT_TYPES[language] === kind ? [] : [{ key: "Content-Type", value: type }] };
+    if (!raw)
+      warnings.push({
+        item,
+        message: `Its body (${type.slice(0, 80)}) has no example in the file that the app can write out: the body is empty.`
+      });
+    return {
+      body: { mode: "raw", raw, options: { raw: { language } } },
+      header: kind.includes("*") || RAW_CONTENT_TYPES[language] === kind ? [] : [{ key: "Content-Type", value: type }]
+    };
   };
   const components = field3(root, "components");
   const schemes = swagger ? field3(root, "securityDefinitions") : isObject4(components) ? field3(components, "securitySchemes") : void 0;
@@ -12602,16 +13551,22 @@ function openApiCollection(root) {
     if (!Array.isArray(requirements)) return {};
     const names = Object.keys(requirements.find(isObject4) ?? {});
     if (!names.length) return { auth: { type: "noauth" } };
-    if (names.length > 1) warnings.push({ item, message: `It needs ${names.length} security schemes together (${named(names)}): only the first is set.` });
+    if (names.length > 1)
+      warnings.push({
+        item,
+        message: `It needs ${names.length} security schemes together (${named(names)}): only the first is set.`
+      });
     const scheme = resolve(isObject4(schemes) ? field3(schemes, names[0]) : void 0);
     if (!isObject4(scheme)) return { auth: { type: `${names[0].slice(0, 60)}, which the file does not describe` } };
     const type = text2(field3(scheme, "type"));
     const how = text2(field3(scheme, "scheme")).toLowerCase();
-    if (type === "basic" || type === "http" && how === "basic") return { auth: { type: "basic", basic: { username: "{{authUsername}}", password: "{{authPassword}}" } } };
+    if (type === "basic" || type === "http" && how === "basic")
+      return { auth: { type: "basic", basic: { username: "{{authUsername}}", password: "{{authPassword}}" } } };
     if (type === "http" && how === "bearer") return { auth: { type: "bearer", bearer: { token: "{{bearerToken}}" } } };
     if (type === "apiKey") {
       const place = text2(field3(scheme, "in"));
-      if (place !== "header" && place !== "query") return { auth: { type: `an API key in a ${place.slice(0, 20) || "place the file does not say"}` } };
+      if (place !== "header" && place !== "query")
+        return { auth: { type: `an API key in a ${place.slice(0, 20) || "place the file does not say"}` } };
       return { auth: { type: "apikey", apikey: { key: text2(field3(scheme, "name")), value: "{{apiKey}}", in: place } } };
     }
     if (type === "oauth2") {
@@ -12621,7 +13576,15 @@ function openApiCollection(root) {
       const client = flow("clientCredentials", "application");
       const password = flow("password", "password");
       const chosen = code ?? client ?? password;
-      if (!isObject4(chosen)) return { auth: { type, oauth2: { grant_type: (swagger ? text2(field3(scheme, "flow")) : Object.keys(isObject4(flows) ? flows : {})[0]) || "none said" } } };
+      if (!isObject4(chosen))
+        return {
+          auth: {
+            type,
+            oauth2: {
+              grant_type: (swagger ? text2(field3(scheme, "flow")) : Object.keys(isObject4(flows) ? flows : {})[0]) || "none said"
+            }
+          }
+        };
       const asked = field3(requirements.find(isObject4) ?? {}, names[0]);
       const scopes = field3(chosen, "scopes");
       const scope = (Array.isArray(asked) && asked.length ? asked.map(text2) : isObject4(scopes) ? Object.keys(scopes) : []).join(" ");
@@ -12654,14 +13617,24 @@ function openApiCollection(root) {
     return withoutEndSlash(filled);
   };
   const host = text2(field3(root, "host"));
-  const base = swagger ? withoutEndSlash(`${host && `${text2(list3(field3(root, "schemes"))[0] ?? "https")}://${host}`}${text2(field3(root, "basePath"))}`) : server(field3(root, "servers")) ?? "";
+  const base = swagger ? withoutEndSlash(
+    `${host && `${text2(list3(field3(root, "schemes"))[0] ?? "https")}://${host}`}${text2(field3(root, "basePath"))}`
+  ) : server(field3(root, "servers")) ?? "";
   if (!/^([a-z][a-z0-9+.-]*:\/\/|\{\{)/i.test(base)) {
-    warnings.push({ item: top, message: `The file gives no full address for its server (${base.slice(0, 80) || "it names none"}): give the collection's variable baseUrl the server's address before you send.` });
+    warnings.push({
+      item: top,
+      message: `The file gives no full address for its server (${base.slice(0, 80) || "it names none"}): give the collection's variable baseUrl the server's address before you send.`
+    });
   }
   const others = list3(field3(root, "servers")).length - 1;
-  if (!swagger && others > 0) warnings.push({ item: top, message: `The file names ${others + 1} servers: the collection's variable baseUrl holds the first (${base.slice(0, 80)}).` });
+  if (!swagger && others > 0)
+    warnings.push({
+      item: top,
+      message: `The file names ${others + 1} servers: the collection's variable baseUrl holds the first (${base.slice(0, 80)}).`
+    });
   const folders = /* @__PURE__ */ new Map();
-  for (const tag of list3(field3(root, "tags")).filter(isObject4)) folders.set(text2(field3(tag, "name")), { description: field3(tag, "description"), item: [] });
+  for (const tag of list3(field3(root, "tags")).filter(isObject4))
+    folders.set(text2(field3(tag, "name")), { description: field3(tag, "description"), item: [] });
   const loose = [];
   const paths = field3(root, "paths");
   for (const path of isObject4(paths) ? Object.keys(paths) : []) {
@@ -12674,7 +13647,8 @@ function openApiCollection(root) {
       const requestName = text2(field3(operation, "summary")).trim() || text2(field3(operation, "operationId")).trim() || `${method.toUpperCase()} ${path}`;
       item = `request "${requestName}"`;
       const parameters = /* @__PURE__ */ new Map();
-      for (const parameter of [...resolved(field3(pathItem, "parameters")), ...resolved(field3(operation, "parameters"))]) parameters.set(`${text2(field3(parameter, "in"))}:${text2(field3(parameter, "name"))}`, parameter);
+      for (const parameter of [...resolved(field3(pathItem, "parameters")), ...resolved(field3(operation, "parameters"))])
+        parameters.set(`${text2(field3(parameter, "in"))}:${text2(field3(parameter, "name"))}`, parameter);
       const query = [];
       const header = [];
       const cookies = [];
@@ -12691,7 +13665,12 @@ function openApiCollection(root) {
         if (place === "formData") fields.push({ key, schema: parameter, value });
         else if (place === "query") query.push({ key, value: said(value) });
         else if (place === "cookie") cookies.push(`${key}=${said(value)}`);
-        else if (place === "header" && !/^(accept|content-type|authorization)$/i.test(key)) header.push({ key, value: said(value), ...field3(parameter, "required") !== true && said(value) === "" && { disabled: true } });
+        else if (place === "header" && !/^(accept|content-type|authorization)$/i.test(key))
+          header.push({
+            key,
+            value: said(value),
+            ...field3(parameter, "required") !== true && said(value) === "" && { disabled: true }
+          });
       }
       if (cookies.length) header.push({ key: "Cookie", value: cookies.join("; ") });
       let body3;
@@ -12699,19 +13678,30 @@ function openApiCollection(root) {
       const requestBody = resolve(field3(operation, "requestBody"));
       const content = isObject4(requestBody) ? field3(requestBody, "content") : void 0;
       if (fields.length) {
-        body3 = form(consumes.some((type) => type.startsWith("multipart/")) || fields.some(({ schema }) => isFile(schema)) ? "multipart/form-data" : "application/x-www-form-urlencoded", fields);
+        body3 = form(
+          consumes.some((type) => type.startsWith("multipart/")) || fields.some(({ schema }) => isFile(schema)) ? "multipart/form-data" : "application/x-www-form-urlencoded",
+          fields
+        );
       } else if (inBody || isObject4(content)) {
         const types = inBody ? consumes.length ? consumes : ["application/json"] : Object.keys(content).filter((type2) => isObject4(field3(content, type2)));
         const type = types.find((entry) => /json/i.test(entry)) ?? types[0];
         if (type !== void 0) {
-          if (!inBody && types.length > 1) warnings.push({ item, message: `Its body is described in ${types.length} media types (${named(types)}): the request has the ${type.slice(0, 80)} one.` });
+          if (!inBody && types.length > 1)
+            warnings.push({
+              item,
+              message: `Its body is described in ${types.length} media types (${named(types)}): the request has the ${type.slice(0, 80)} one.`
+            });
           const made2 = bodyOf2(type, inBody ?? field3(content, type));
           body3 = made2.body;
           header.push(...made2.header);
         }
       }
       const tags = list3(field3(operation, "tags")).map(text2).filter(Boolean);
-      if (tags.length > 1) warnings.push({ item, message: `It has ${tags.length} tags (${named(tags)}): it is in the folder of the first.` });
+      if (tags.length > 1)
+        warnings.push({
+          item,
+          message: `It has ${tags.length} tags (${named(tags)}): it is in the folder of the first.`
+        });
       const own3 = server(field3(operation, "servers")) ?? server(field3(pathItem, "servers"));
       const request = {
         name: requestName,
@@ -12719,7 +13709,11 @@ function openApiCollection(root) {
           method: method.toUpperCase(),
           description: field3(operation, "description"),
           // A `{name}` of the path is the variable `{{name}}`, which the composer asks for before it sends.
-          url: { host: [own3 ?? "{{baseUrl}}"], path: path.replace(/^\//, "").split("/").map((part) => part.replace(/\{([^{}]+)\}/g, "{{$1}}")), query },
+          url: {
+            host: [own3 ?? "{{baseUrl}}"],
+            path: path.replace(/^\//, "").split("/").map((part) => part.replace(/\{([^{}]+)\}/g, "{{$1}}")),
+            query
+          },
           header,
           ...body3 && { body: body3 },
           ...auth3(field3(operation, "security"))
@@ -12731,48 +13725,50 @@ function openApiCollection(root) {
     }
   }
   item = top;
-  const made = { info: { name, description: isObject4(info) ? field3(info, "description") : void 0 }, variable: [{ key: "baseUrl", value: base }], ...auth3(field3(root, "security")) };
+  const made = {
+    info: { name, description: isObject4(info) ? field3(info, "description") : void 0 },
+    variable: [{ key: "baseUrl", value: base }],
+    ...auth3(field3(root, "security"))
+  };
   const tagged = [...folders].filter(([, folder]) => folder.item.length).map(([folderName, folder]) => ({ name: folderName, description: folder.description, item: folder.item }));
-  if (!tagged.length && !loose.length) throw new ImportError("This OpenAPI file describes no operation under `paths`, so there is no request to import.");
+  if (!tagged.length && !loose.length)
+    throw new ImportError("This OpenAPI file describes no operation under `paths`, so there is no request to import.");
   for (const [where, { outside, missing }] of unread) {
-    if (outside.size) warnings.push({ item: where, message: `It refers to ${outside.size === 1 ? "another file or an address" : `${outside.size} other files or addresses`} (${named([...outside])}). An import fetches nothing: what ${outside.size === 1 ? "it describes" : "they describe"} is left out.` });
-    if (missing.size) warnings.push({ item: where, message: `It refers to ${missing.size === 1 ? "a part" : `${missing.size} parts`} of the file that ${missing.size === 1 ? "is" : "are"} not there or ${missing.size === 1 ? "leads" : "lead"} back to ${missing.size === 1 ? "itself" : "themselves"} (${named([...missing])}), and ${missing.size === 1 ? "that is" : "those are"} left out.` });
+    if (outside.size)
+      warnings.push({
+        item: where,
+        message: `It refers to ${outside.size === 1 ? "another file or an address" : `${outside.size} other files or addresses`} (${named([...outside])}). An import fetches nothing: what ${outside.size === 1 ? "it describes" : "they describe"} is left out.`
+      });
+    if (missing.size)
+      warnings.push({
+        item: where,
+        message: `It refers to ${missing.size === 1 ? "a part" : `${missing.size} parts`} of the file that ${missing.size === 1 ? "is" : "are"} not there or ${missing.size === 1 ? "leads" : "lead"} back to ${missing.size === 1 ? "itself" : "themselves"} (${named([...missing])}), and ${missing.size === 1 ? "that is" : "those are"} left out.`
+      });
   }
   return { collection: { ...made, item: [...tagged, ...loose] }, warnings };
 }
 
-// ../core/src/import/script-scan.ts
-var START = String.raw`(?<![\w$.])`;
-var escape = (text3) => text3.replace(/[.*+?^${}()|[\]\\/]/g, "\\$&");
-var member = (name) => ({ api: name, finds: [[name, new RegExp(`${START}${escape(name)}(?![\\w$])`)]] });
-var required = (module) => [`require('${module}')`, new RegExp(`${START}require\\(\\s*["']${escape(module)}["']\\s*\\)`)];
-var called = (name) => [name, new RegExp(`${START}${escape(name)}\\s*\\(`)];
-var used = (name) => [name, new RegExp(`${START}${escape(name)}\\s*[.(]`)];
-var SCRIPT_SCAN = [
-  ...["pm.cookies.get", "pm.cookies.has", "pm.cookies.toObject", "pm.cookies.jar", "pm.visualizer.set", "pm.vault.get", "pm.require", "postman.getResponseCookie"].map(member),
-  { api: "legacy library globals (_, CryptoJS, tv4, cheerio, xml2Json, Backbone)", finds: ["tv4", "cheerio", "xml2Json", "Backbone"].map(used) },
-  { api: "clearTimeout, setInterval, clearInterval", finds: ["clearTimeout", "setInterval", "clearInterval"].map(called) },
-  ...["ajv", "cheerio", "csv-parse/lib/sync", "postman-collection", "tv4", "xml2js"].map((module) => ({ api: `require('${module}')`, finds: [required(module)] })),
-  {
-    api: "require of a Node module (buffer, events, path, querystring, stream, string_decoder, timers, url, util)",
-    finds: ["buffer", "events", "path", "querystring", "stream", "string_decoder", "timers", "url", "util"].map(required)
-  }
-];
-function unsupportedApis(script) {
-  return SCRIPT_SCAN.flatMap((entry) => entry.finds).filter(([, pattern]) => pattern.test(script)).map(([label]) => label);
-}
-
 // ../core/src/import/yaml.ts
 var import_yaml = __toESM(require_dist(), 1);
 var MAX_YAML_ALIASES = 100;
 var MAX_YAML_CHARS = 1024 * 1024;
 var YAML_ALIASES = `The YAML file repeats parts of itself through aliases ${MAX_YAML_ALIASES} times or more and is refused: a file written that way grows without end as it is read.`;
-var YAML_TOO_LARGE = "The file is not JSON, and at more than 1 MB it is too large to be read as YAML: a YAML file takes far more memory to read than a JSON file of its size. If it is YAML, convert it to JSON and import that.";
+var YAML_TOO_LARGE = "This file is not JSON, and a YAML file can be 1 MB at most: reading YAML takes far more memory than JSON. Convert it to JSON and import that.";
 var NOT_READABLE = "The file is neither JSON nor YAML that can be read, so it is not a file Wayfarer can import.";
 function parseYaml(text3) {
   if (text3.length > MAX_YAML_CHARS) throw new ImportError(YAML_TOO_LARGE);
   try {
-    return (0, import_yaml.parse)(text3, { maxAliasCount: MAX_YAML_ALIASES, schema: "core", logLevel: "error", uniqueKeys: false, prettyErrors: false });
+    return JSON.parse(
+      JSON.stringify(
+        (0, import_yaml.parse)(text3, {
+          maxAliasCount: MAX_YAML_ALIASES,
+          schema: "core",
+          logLevel: "error",
+          uniqueKeys: false,
+          prettyErrors: false
+        })
+      )
+    );
   } catch (error) {
     throw new ImportError(error instanceof Error && /alias count/i.test(error.message) ? YAML_ALIASES : NOT_READABLE);
   }
@@ -12812,7 +13808,12 @@ function scriptWarnings(item, scripts2) {
     const found = unsupportedApis(scripts2[kind]);
     if (!found.length) return [];
     const names = found.length > 1 ? `${found.slice(0, -1).join(", ")} and ${found.at(-1)}` : found[0];
-    return [{ item, message: `Its ${kind === "pre" ? "pre-request" : "post-response"} script uses ${names}, which Wayfarer does not have. The script will end in an error there.` }];
+    return [
+      {
+        item,
+        message: `Its ${kind === "pre" ? "pre-request" : "post-response"} script uses ${names}, which Wayfarer does not have, so the script stops with an error there.`
+      }
+    ];
   });
 }
 function inheritedScriptWarnings(payload) {
@@ -12827,9 +13828,13 @@ function curlToRequest(text3) {
   const parsed2 = parseCurl(text3);
   const { content, warnings } = curlRequest(parsed2);
   const issues = validateRequestContent(content, "request");
-  if (issues.length) throw new ImportError("The cURL command does not make a request the app can hold.", issues);
+  if (issues.length) throw new ImportError("This cURL command does not describe a request Wayfarer can send.", issues);
   const address2 = URL.parse(parsed2.request.url);
-  return { name: `${content.method} ${address2 ? address2.host + address2.pathname : parsed2.request.url}`, content, warnings };
+  return {
+    name: `${content.method} ${address2 ? address2.host + address2.pathname : parsed2.request.url}`,
+    content,
+    warnings
+  };
 }
 function built(format, name, requests) {
   const now = Date.now();
@@ -12838,7 +13843,15 @@ function built(format, name, requests) {
   const payload = {
     $id: COLLECTION_FORMAT,
     meta: top,
-    collection: { id: top.id, meta: top, name, order: 0, variables: [], auth: { type: "none" }, scripts: { pre: "", post: "" } },
+    collection: {
+      id: top.id,
+      meta: top,
+      name,
+      order: 0,
+      variables: [],
+      auth: { type: "none" },
+      scripts: { pre: "", post: "" }
+    },
     folders: [],
     requests: requests.map(({ name: requestName, content }, order) => {
       const own3 = meta();
@@ -12850,7 +13863,9 @@ function built(format, name, requests) {
       format,
       formatName: IMPORT_FORMATS[format],
       counts: { collections: 1, folders: 0, requests: requests.length, environments: 0 },
-      warnings: requests.flatMap(({ name: requestName, warnings }) => warnings.map((message) => ({ item: `request "${requestName}"`, message })))
+      warnings: requests.flatMap(
+        ({ name: requestName, warnings }) => warnings.map((message) => ({ item: `request "${requestName}"`, message }))
+      )
     },
     collections: [added(payload)],
     environments: []
@@ -12858,10 +13873,63 @@ function built(format, name, requests) {
 }
 function added(payload) {
   const { payload: checked, plan, errors } = importCollection(payload, { duplicateAsNew: true });
-  if (!checked || !plan) throw new ImportError(`The file does not make requests the app can hold.`, errors ?? []);
+  if (!checked || !plan) throw new ImportError("This file holds no request Wayfarer can read.", errors ?? []);
   return { payload: checked, plan };
 }
 function importText(text3, options = {}) {
+  let imported;
+  try {
+    imported = readText(text3, options);
+  } catch (error) {
+    if (error instanceof RangeError) throw new ImportError("The file is nested too deeply to read.");
+    throw error;
+  }
+  return {
+    ...imported,
+    report: {
+      ...imported.report,
+      warnings: [...imported.report.warnings, ...unsetVariableWarnings(imported.collections, imported.environments)]
+    }
+  };
+}
+var PLAIN_VARIABLE = /^[\w.-]+$/;
+var PLACEHOLDERS = /{{([^{}]*)}}/g;
+var SCRIPT_SETS = /\.set\(\s*["'`]([^"'`]+)["'`]/g;
+function unsetVariableWarnings(collections, environments) {
+  return collections.flatMap(({ payload }) => {
+    const set = /* @__PURE__ */ new Set([
+      ...[payload.collection, ...payload.folders].flatMap((holder) => holder.variables.map((row) => row.key)),
+      ...environments.flatMap((environment2) => environment2.vars.map((row) => row.key))
+    ]);
+    const scripts2 = [payload.collection, ...payload.folders, ...payload.requests].flatMap(({ scripts: scripts3 }) => [
+      scripts3.pre,
+      scripts3.post
+    ]);
+    for (const script of scripts2) for (const [, name] of script.matchAll(SCRIPT_SETS)) set.add(name);
+    const uses = payload.requests.map(({ url, headers: headers2, body: body3, auth: auth3 }) => {
+      const text3 = JSON.stringify({ url, headers: headers2, body: body3, auth: auth3 });
+      return new Set(
+        [...text3.matchAll(PLACEHOLDERS)].map(([, name]) => name.trim()).filter((name) => PLAIN_VARIABLE.test(name))
+      );
+    });
+    const unset = [...new Set(uses.flatMap((names2) => [...names2]))].filter((name) => !set.has(name)).sort();
+    if (!unset.length) return [];
+    const using = uses.filter((names2) => unset.some((name) => names2.has(name))).length;
+    const total = payload.requests.length;
+    const listed = unset.slice(0, unset.length > 5 ? 5 : unset.length).map((name) => `{{${name}}}`);
+    if (unset.length > 5) listed.push(`${unset.length - 5} more`);
+    const names = listed.length < 2 ? listed[0] : `${listed.slice(0, -1).join(", ")} and ${listed.at(-1)}`;
+    const which = using === total ? total === 1 ? "its request uses" : total === 2 ? "both requests use" : `all ${total} requests use` : `${using} of its ${total} requests ${using === 1 ? "uses" : "use"}`;
+    const it = unset.length === 1 ? "it" : "them";
+    return [
+      {
+        item: `collection "${payload.collection.name}"`,
+        message: `${names} ${unset.length === 1 ? "has" : "have"} no value in the file, and ${which} ${it}: give ${it} a value in an environment or in the collection's settings before you send.`
+      }
+    ];
+  });
+}
+function readText(text3, options) {
   if (isOversizedImport(text3)) throw new ImportError(IMPORT_TOO_LARGE);
   if (text3.startsWith("\uFEFF")) text3 = text3.slice(1);
   if (isCurlCommand(text3)) {
@@ -12873,8 +13941,12 @@ function importText(text3, options = {}) {
   if (!json.ok && (typeof value !== "object" || value === null)) throw new ImportError(NOT_READABLE);
   const format = detectFormat(value);
   if (!format) {
-    if (of(idOf(value), "wayfarer/workspace")) throw new ImportError("This is a workspace backup, which replaces everything. Restore it in Settings.");
-    if (isPostmanV1(value)) throw new ImportError("This is a Postman Collection v1 file, which Wayfarer does not read. In Postman, export the collection as Collection v2.1 and import that.");
+    if (of(idOf(value), "wayfarer/workspace"))
+      throw new ImportError("This is a workspace backup, which replaces everything. Restore it in Settings.");
+    if (isPostmanV1(value))
+      throw new ImportError(
+        "This is a Postman Collection v1 file, which Wayfarer does not read. In Postman, export the collection as Collection v2.1 and import that."
+      );
     throw new ImportError(UNKNOWN);
   }
   const report = (counts2, warnings) => ({
@@ -12884,7 +13956,10 @@ function importText(text3, options = {}) {
     warnings
   });
   if (format === "har") {
-    const requests = parseHar(value).map(({ name, request, warnings }) => ({ name, ...curlRequest({ request, warnings }) }));
+    const requests = parseHar(value).map(({ name, request, warnings }) => ({
+      name,
+      ...curlRequest({ request, warnings })
+    }));
     return built("har", "Imported from HAR", requests);
   }
   if (format === "postman-collection" || format === "openapi") {
@@ -12892,7 +13967,11 @@ function importText(text3, options = {}) {
     const { payload: payload2, warnings } = postmanCollection(source.collection);
     const collection = added(payload2);
     return {
-      report: report({ collections: 1, folders: payload2.folders.length, requests: payload2.requests.length }, [...source.warnings, ...warnings, ...inheritedScriptWarnings(collection.payload)]),
+      report: report({ collections: 1, folders: payload2.folders.length, requests: payload2.requests.length }, [
+        ...source.warnings,
+        ...warnings,
+        ...inheritedScriptWarnings(collection.payload)
+      ]),
       collections: [collection],
       environments: []
     };
@@ -12905,10 +13984,15 @@ function importText(text3, options = {}) {
     if (issues.length) throw new ImportError("The file's environments are not ones the app can hold.", issues);
     const count = (of2) => collections.reduce((sum, { payload: payload2 }) => sum + of2(payload2).length, 0);
     return {
-      report: report({ collections: collections.length, folders: count((payload2) => payload2.folders), requests: count((payload2) => payload2.requests), environments: environments.length }, [
-        ...warnings,
-        ...read.flatMap((collection) => collection.warnings)
-      ]),
+      report: report(
+        {
+          collections: collections.length,
+          folders: count((payload2) => payload2.folders),
+          requests: count((payload2) => payload2.requests),
+          environments: environments.length
+        },
+        [...warnings, ...read.flatMap((collection) => collection.warnings)]
+      ),
       collections,
       environments
     };
@@ -12921,12 +14005,28 @@ function importText(text3, options = {}) {
   }
   if (format === "wayfarer-environments") {
     const result = validateEnvironmentExport(value);
-    if (!result.payload) throw new ImportError("The file is not a valid Wayfarer environments file.", (result.errors ?? []).map((message) => ({ path: "", message })));
-    return { report: report({ environments: result.payload.length }, []), collections: [], environments: result.payload };
+    if (!result.payload)
+      throw new ImportError(
+        "The file is not a valid Wayfarer environments file.",
+        (result.errors ?? []).map((message) => ({ path: "", message }))
+      );
+    return {
+      report: report({ environments: result.payload.length }, []),
+      collections: [],
+      environments: result.payload
+    };
   }
   const { payload, plan, errors } = importCollection(value, options);
-  if (!payload || !plan) throw new ImportError("The file is not a valid Wayfarer collection.", errors ?? []);
-  return { report: report({ collections: 1, folders: payload.folders.length, requests: payload.requests.length }, inheritedScriptWarnings(payload)), collections: [{ payload, plan }], environments: [] };
+  if (!payload || !plan)
+    throw new ImportError("This file is not a Wayfarer collection. What does not match is listed below.", errors ?? []);
+  return {
+    report: report(
+      { collections: 1, folders: payload.folders.length, requests: payload.requests.length },
+      inheritedScriptWarnings(payload)
+    ),
+    collections: [{ payload, plan }],
+    environments: []
+  };
 }
 
 // ../core/src/run/report.ts
@@ -12939,10 +14039,21 @@ var counts = (results) => ({
   errors: results.filter((result) => result.error !== void 0).length
 });
 function runReportJson(report, info) {
-  return { $id: RUN_REPORT_FORMAT, ...info, iterations: report.iterations, ended: report.ended, ...report.reason !== void 0 && { reason: report.reason }, totals: counts(report.results), results: report.results };
+  return {
+    $id: RUN_REPORT_FORMAT,
+    ...info,
+    iterations: report.iterations,
+    ended: report.ended,
+    ...report.reason !== void 0 && { reason: report.reason },
+    totals: counts(report.results),
+    results: report.results
+  };
 }
 function xml(text3) {
-  return text3.replace(/[^\t\n\r -퟿-�\u{10000}-\u{10FFFF}]/gu, "\uFFFD").replace(/[&<>"\t\n\r]/g, (char) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "	": "&#9;", "\n": "&#10;", "\r": "&#13;" })[char] ?? char);
+  return text3.replace(/[^\t\n\r -퟿-�\u{10000}-\u{10FFFF}]/gu, "\uFFFD").replace(
+    /[&<>"\t\n\r]/g,
+    (char) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "	": "&#9;", "\n": "&#10;", "\r": "&#13;" })[char] ?? char
+  );
 }
 var seconds = (ms) => ((ms ?? 0) / 1e3).toFixed(3);
 function junitXml(report, info) {
@@ -12953,12 +14064,18 @@ function junitXml(report, info) {
       <failure type="AssertionFailure" message="${xml(test.error ?? "")}"/>
     </testcase>`
     );
-    if (result.error !== void 0) cases.push(`    <testcase name="${classname}" classname="${classname}">
+    if (result.error !== void 0)
+      cases.push(
+        `    <testcase name="${classname}" classname="${classname}">
       <error type="Error" message="${xml(result.error)}"/>
-    </testcase>`);
-    if (result.skipped) cases.push(`    <testcase name="${classname}" classname="${classname}">
+    </testcase>`
+      );
+    if (result.skipped)
+      cases.push(
+        `    <testcase name="${classname}" classname="${classname}">
       <skipped message="pm.execution.skipRequest()"/>
-    </testcase>`);
+    </testcase>`
+      );
     const totals2 = counts([result]);
     const name = xml(report.iterations > 1 ? `${result.name} (iteration ${result.iteration + 1})` : result.name);
     const open = `  <testsuite name="${name}" id="${xml(result.id)}" tests="${cases.length}" failures="${totals2.failedTests}" errors="${totals2.errors}" skipped="${totals2.skipped}" time="${seconds(result.durationMs)}"`;
@@ -12976,6 +14093,97 @@ ${cases.join("\n")}
     ""
   ].join("\n");
 }
+var REPORT_COLOURS = {
+  light: {
+    canvas: "#FBFAF8",
+    panel: "#F6F5F2",
+    primary: "#26231E",
+    secondary: "#55524D",
+    tertiary: "#726F69",
+    line: "#DEDAD3",
+    error: "#A51F1E"
+  },
+  dark: {
+    canvas: "#161513",
+    panel: "#22211E",
+    primary: "#EBE9E4",
+    secondary: "#C0BDB6",
+    tertiary: "#9A9790",
+    line: "#423F39",
+    error: "#F7958A"
+  }
+};
+function html(text3) {
+  return text3.replace(
+    /[&<>"']/g,
+    (char) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[char] ?? char
+  );
+}
+var palette = (colours) => Object.entries(colours).map(([name, value]) => `--${name}: ${value};`).join(" ");
+function runReportHtml(report, info) {
+  const shared = sharedErrors(report.results);
+  const sharedNote = (error) => {
+    const index = shared.findIndex((entry) => entry.error === error);
+    return index < 0 ? error : shared.length === 1 ? "Same error as above" : `Same error as ${index + 1} above`;
+  };
+  const rows2 = report.results.map((result, index) => {
+    const failed = result.tests.filter((test) => !test.passed);
+    const problems = [
+      ...result.error === void 0 ? [] : [sharedNote(result.error)],
+      ...failed.map((test) => test.error ? `${test.name}: ${test.error}` : test.name)
+    ];
+    const status = result.skipped ? "Skipped" : result.status ? `${result.status} ${result.statusText ?? ""}`.trim() : "No response";
+    return `<tr${runFailed(result) ? ' class="failed"' : ""}>
+<td>${index + 1}</td><td>${result.iteration + 1}</td>
+<td>${html(result.name)}${problems.map((problem) => `<p class="problem">${html(problem)}</p>`).join("")}</td>
+<td>${html(status)}</td><td>${result.durationMs === void 0 ? "\u2014" : `${result.durationMs} ms`}</td>
+<td>${result.tests.length ? `${result.tests.length - failed.length} of ${result.tests.length} passed` : "\u2014"}</td>
+</tr>`;
+  }).join("\n");
+  const sharedBlocks = shared.map(
+    ({ error, count }, index) => `<p class="shared">${shared.length > 1 ? `<b>${index + 1}.</b> ` : ""}<b>${html(sharedErrorHeading(count))}</b> ${html(error)}</p>`
+  ).join("\n");
+  return `<!doctype html>
+<html lang="en-GB">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'unsafe-inline'">
+<title>Run ${html(info.name)}</title>
+<style>
+:root { color-scheme: light dark; ${palette(REPORT_COLOURS.light)} }
+@media (prefers-color-scheme: dark) { :root { ${palette(REPORT_COLOURS.dark)} } }
+body { margin: 0; padding: 24px 16px; background: var(--canvas); color: var(--primary);
+  font: 14px/1.5 Figtree, system-ui, sans-serif; }
+main { max-width: 1100px; margin: 0 auto; }
+h1 { margin: 0 0 4px; font-size: 1.375rem; font-weight: 600; }
+.meta, .counts { margin: 0 0 16px; color: var(--secondary); }
+.shared { margin: 0 0 12px; padding: 10px 14px; border: 1px solid var(--error); border-radius: 8px; color: var(--error); }
+table { width: 100%; border-collapse: collapse; font-size: 0.8125rem; }
+th { text-align: start; font-weight: 500; color: var(--tertiary); }
+th, td { padding: 8px 10px; border-bottom: 1px solid var(--line); vertical-align: top; overflow-wrap: anywhere; }
+td:nth-child(4), td:nth-child(5) { font-family: "JetBrains Mono", ui-monospace, monospace; }
+.problem { margin: 4px 0 0; color: var(--error); font-size: 0.75rem; }
+tr.failed td:first-child { box-shadow: inset 2px 0 0 var(--error); }
+</style>
+</head>
+<body>
+<main>
+<h1>Run ${html(info.name)}</h1>
+<p class="meta">Started ${html(info.startedAt)}</p>
+<p class="counts">${html(runEnding(report))} ${html(runCounts(report))}</p>
+${sharedBlocks}
+<table>
+<thead><tr><th scope="col">#</th><th scope="col">Iteration</th><th scope="col">Request</th><th scope="col">Status</th><th scope="col">Time</th><th scope="col">Tests</th></tr></thead>
+<tbody>
+${rows2}
+</tbody>
+</table>
+</main>
+</body>
+</html>
+`;
+}
 
 // src/run.ts
 import variant from "@jitl/quickjs-wasmfile-release-sync";
@@ -13020,10 +14228,16 @@ async function runCollection(input, options) {
   const transport = new FetchTransport();
   const ports = {
     runScript: async (script, env, response, { send: send2, ...extras }) => {
-      const result = await runScript(await engine(), script, { ...extras, environment: env, ...response && { response: scriptResponse(response) } }, SCRIPT_LIMITS, {
-        libraries: await loadLibraries(script, loadLibrary, libraries),
-        ...send2 && { send: send2 }
-      });
+      const result = await runScript(
+        await engine(),
+        script,
+        { ...extras, environment: env, ...response && { response: scriptResponse(response) } },
+        SCRIPT_LIMITS,
+        {
+          libraries: await loadLibraries(script, loadLibrary, libraries),
+          ...send2 && { send: send2 }
+        }
+      );
       if (result.limit) engine = engines();
       return result;
     },
@@ -13038,7 +14252,9 @@ async function runCollection(input, options) {
     environment: () => environment2 && {
       name: environment2.name,
       vars: environment2.vars,
-      change: (changes) => Promise.resolve(environment2 && (environment2 = { ...environment2, vars: applyVariableChanges(environment2.vars, changes) }))
+      change: (changes) => Promise.resolve(
+        environment2 && (environment2 = { ...environment2, vars: applyVariableChanges(environment2.vars, changes) })
+      )
     },
     globals: () => globals,
     changeGlobals: (changes) => Promise.resolve(globals = applyVariableChanges(globals, changes)),
@@ -13060,7 +14276,13 @@ async function runCollection(input, options) {
   const send = async (doc, iteration, signal) => {
     const ancestors = ancestorsOf(source.collection, source.folders, doc.folderId);
     const folder = folderChain(source.folders, doc.folderId).flatMap((entry) => entry.variables);
-    const scopes = () => ({ environment: environment2?.vars, folder, collection: collectionVariables, global: globals, data: iteration.data });
+    const scopes = () => ({
+      environment: environment2?.vars,
+      folder,
+      collection: collectionVariables,
+      global: globals,
+      data: iteration.data
+    });
     const { outcome } = await runOutcome(
       () => exchange(
         {
@@ -13073,7 +14295,10 @@ async function runCollection(input, options) {
             scopes,
             ancestors,
             readSecrets: async (ids) => {
-              if (!vault) throw new SendBlockedError("This request uses a vault secret, and the run has no vault: give --vault-file, or run a workspace backup, with the passphrase in WAYFARER_VAULT_PASSPHRASE. Nothing was sent.");
+              if (!vault)
+                throw new SendBlockedError(
+                  "This request uses a vault secret, and the run has no vault: give --vault-file, or run a workspace backup, with the passphrase in WAYFARER_VAULT_PASSPHRASE. Nothing was sent."
+                );
               const found = /* @__PURE__ */ new Map();
               for (const id of ids) {
                 const value = await readSecret(id);
@@ -13081,12 +14306,27 @@ async function runCollection(input, options) {
               }
               return found;
             },
-            readFile: (ref) => Promise.reject(new SendBlockedError(`The file "${ref.fileName}" of this request's body is kept in the browser that picked it, not in the file run here. Nothing was sent.`)),
+            readFile: (ref) => Promise.reject(
+              new SendBlockedError(
+                `The file "${ref.fileName}" of this request's body is kept in the browser that picked it, not in the file run here. Nothing was sent.`
+              )
+            ),
             blockUnresolved: true,
-            composed: { url: doc.url, scopes: { ...baseline, folder, data: iteration.data }, accepted: acceptedHosts }
+            composed: {
+              url: doc.url,
+              scopes: { ...baseline, folder, data: iteration.data },
+              accepted: acceptedHosts
+            }
           }),
-          info: { requestName: doc.name, requestId: doc.id },
-          collection: { variables: () => collectionVariables, change: (changes) => Promise.resolve(collectionVariables = applyVariableChanges(collectionVariables, changes)) },
+          info: {
+            requestName: doc.name,
+            requestId: doc.id,
+            path: [source.collection.name, ...folderChain(source.folders, doc.folderId).map((entry) => entry.name)]
+          },
+          collection: {
+            variables: () => collectionVariables,
+            change: (changes) => Promise.resolve(collectionVariables = applyVariableChanges(collectionVariables, changes))
+          },
           inherited: ancestors,
           folderVariables: () => folder,
           signal,
@@ -13123,17 +14363,21 @@ Options:
   -e, --environment <file>  The variables: a Wayfarer environments file or a
                             Postman environment. A workspace backup brings
                             its active environment unless one is given.
+      --environment-name <name>
+                            Which environment of a file that holds several.
   -d, --data <file>         A data file, CSV or JSON: one iteration per row.
   -n, --iterations <n>      How many iterations (default: one per row of the
                             data file, or 1).
       --collection <name>   Which collection of a file that holds several.
-      --reporter <list>     cli, json, junit, comma-separated (default cli).
-                            json writes wayfarer-run.json and junit writes
-                            wayfarer-run.junit.xml, in --out.
+      --reporter <list>     cli, json, junit, html, comma-separated (default
+                            cli). json writes wayfarer-run.json, junit
+                            wayfarer-run.junit.xml and html wayfarer-run.html,
+                            in --out.
       --out <dir>           Where the reports are written (default: here).
       --bail                Stop at the first failure.
-      --timeout <ms>        Give up on a request after this long (default: no
-                            limit).
+      --timeout <ms>        Give up on a request after this long, at most
+                            300000 (default 300000: Node's fetch waits no
+                            longer for a response).
       --insecure            Do not verify servers' TLS certificates.
       --allow-scripts       Run the file's scripts. A file's scripts are not
                             reviewed, so a collection that has any is not run
@@ -13144,53 +14388,74 @@ Options:
   -v, --version
   -h, --help
 
-Exit codes: 0 every request answered and every test passed; 1 a test failed
-or a request got no response; 2 nothing was run (see the message).`;
+Exit codes: 0 every request answered and every test passed; 1 a test failed,
+a request got no response, or a report could not be written; 2 nothing was
+run (see the message).`;
+var NODE_FETCH_TIMEOUT_MS = 3e5;
 var Refusal = class extends Error {
 };
-async function readText(file, what) {
+async function readText2(file, what) {
   try {
     return await readFile(file, "utf8");
   } catch (error) {
-    throw new Refusal(`The ${what} ${file} could not be read: ${error instanceof Error ? error.message : String(error)}`);
+    throw new Refusal(
+      `The ${what} ${file} could not be read: ${error instanceof Error ? error.message : String(error)}`
+    );
   }
 }
-function pick(list4, name, what, file) {
+function pick(list4, name, what, flag2, file) {
   if (name !== void 0) {
     const found = list4.find((entry) => entry.name === name);
-    if (!found) throw new Refusal(`${file} has no ${what} named "${name}". It has: ${list4.map((entry) => `"${entry.name}"`).join(", ")}.`);
+    if (!found)
+      throw new Refusal(
+        `${file} has no ${what} named "${name}". It has: ${list4.map((entry) => `"${entry.name}"`).join(", ")}.`
+      );
     return found;
   }
-  if (list4.length > 1) throw new Refusal(`${file} holds ${list4.length} ${what}s: name one with --${what} (${list4.map((entry) => `"${entry.name}"`).join(", ")}).`);
+  if (list4.length > 1)
+    throw new Refusal(
+      `${file} holds ${list4.length} ${what}s: name one with --${flag2} (${list4.map((entry) => `"${entry.name}"`).join(", ")}).`
+    );
   const [only] = list4;
   if (!only) throw new Refusal(`${file} holds no ${what}.`);
   return only;
 }
 async function openVault(record, secrets, file) {
   const passphrase = process.env["WAYFARER_VAULT_PASSPHRASE"];
-  if (passphrase === void 0) throw new Refusal(`${file} holds a vault: set WAYFARER_VAULT_PASSPHRASE to its passphrase.`);
+  if (passphrase === void 0)
+    throw new Refusal(`${file} holds a vault: set WAYFARER_VAULT_PASSPHRASE to its passphrase.`);
   const dek = await unwrapDek(record, passphrase);
   if (!dek) throw new Refusal(`WAYFARER_VAULT_PASSPHRASE is not the passphrase of the vault in ${file}.`);
   return { dek, secrets: new Map(secrets.map((secret) => [secret.id, secret.envelope])) };
 }
 async function readSource(file, collection) {
-  const text3 = await readText(file, "file");
+  const text3 = await readText2(file, "file");
   const parsed2 = parseJson(text3);
   const id = parsed2.ok && typeof parsed2.value === "object" && parsed2.value !== null && "$id" in parsed2.value ? String(parsed2.value.$id) : "";
   if (id !== "wayfarer/workspace" && !id.startsWith("wayfarer/workspace/")) {
     try {
       const { collections } = importText(text3);
-      return { source: pick(collections.map(({ payload }) => ({ name: payload.collection.name, payload })), collection, "collection", file).payload, globals: [] };
+      return {
+        source: pick(
+          collections.map(({ payload }) => ({ name: payload.collection.name, payload })),
+          collection,
+          "collection",
+          "collection",
+          file
+        ).payload,
+        globals: []
+      };
     } catch (error) {
       if (error instanceof Error && error.name === "ImportError") throw new Refusal(`${file}: ${error.message}`);
       throw error;
     }
   }
   const errors = validateWorkspaceFile(parsed2.ok ? parsed2.value : void 0);
-  if (errors.length) throw new Refusal(`${file} is not a workspace backup this version reads:
+  if (errors.length)
+    throw new Refusal(`${file} is not a workspace backup this version reads:
   ${errors.join("\n  ")}`);
   const { stores } = parsed2.ok ? parsed2.value : {};
-  const chosen = pick(stores.collections, collection, "collection", file);
+  const chosen = pick(stores.collections, collection, "collection", "collection", file);
   const source = {
     $id: "wayfarer/collection",
     meta: chosen.meta,
@@ -13207,23 +14472,28 @@ async function readSource(file, collection) {
     ...environment2 && { environment: { name: environment2.name, vars: environment2.vars } },
     globals: meta(META_GLOBALS_KEY)?.["variables"] ?? [],
     // A backup's secrets are useful only with the passphrase: without one, a request that needs a secret says so.
-    ...vault && process.env["WAYFARER_VAULT_PASSPHRASE"] !== void 0 && { vault: await openVault(vault, stores.secrets, file) }
+    ...vault && process.env["WAYFARER_VAULT_PASSPHRASE"] !== void 0 && {
+      vault: await openVault(vault, stores.secrets, file)
+    }
   };
 }
-async function readEnvironment(file) {
+async function readEnvironment(file, name) {
   try {
-    const { environments } = importText(await readText(file, "environment"));
-    const { name, vars } = pick(environments, void 0, "environment", file);
-    return { name, vars };
+    const { environments } = importText(await readText2(file, "environment"));
+    const chosen = pick(environments, name, "environment", "environment-name", file);
+    return { name: chosen.name, vars: chosen.vars };
   } catch (error) {
     if (error instanceof Error && error.name === "ImportError") throw new Refusal(`${file}: ${error.message}`);
     throw error;
   }
 }
 async function readVaultFile(file) {
-  const parsed2 = parseJson(await readText(file, "vault file"));
+  const parsed2 = parseJson(await readText2(file, "vault file"));
   const issues = parsed2.ok ? validateVaultFile(parsed2.value) : [{ path: "", message: "not JSON" }];
-  if (issues.length) throw new Refusal(`${file} is not a vault file ("$id": "${VAULT_FILE_FORMAT}"): ${issues.map((issue) => `${issue.path} ${issue.message}`.trim()).join("; ")}`);
+  if (issues.length)
+    throw new Refusal(
+      `${file} is not a vault file ("$id": "${VAULT_FILE_FORMAT}"): ${issues.map((issue) => `${issue.path} ${issue.message}`.trim()).join("; ")}`
+    );
   const { vault, secrets } = parsed2.ok ? parsed2.value : {};
   return openVault(vault, secrets, file);
 }
@@ -13234,21 +14504,22 @@ function scriptHolders(source) {
     ...source.requests.filter((request) => scriptsOf(request).length).map((request) => `the request "${request.name}"`)
   ];
 }
-function line(result, iterations) {
+function line(result, iterations, said2) {
   const mark = runFailed(result) ? "\u2717" : result.skipped ? "-" : "\u2713";
   const where = iterations > 1 ? ` (iteration ${result.iteration + 1})` : "";
   const status = result.skipped ? "skipped" : result.status ? `${result.status} ${result.statusText ?? ""}`.trim() : "no response";
   const tests2 = result.tests.map((test) => `
     ${test.passed ? "\u2713" : "\u2717"} ${test.name}${test.error ? `: ${test.error}` : ""}`).join("");
-  const error = result.error !== void 0 ? `
-    ${result.error}` : "";
+  const repeated = result.error !== void 0 && said2.has(result.error);
+  if (result.error !== void 0) said2.add(result.error);
+  const error = result.error === void 0 ? "" : `
+    ${repeated ? "Same error as before." : result.error}`;
   return `${mark} ${result.name}${where}: ${status}${result.durationMs !== void 0 ? `, ${result.durationMs} ms` : ""}${tests2}${error}`;
 }
 function summary(report) {
-  const tests2 = report.results.flatMap((result) => result.tests);
-  const failed = report.results.filter(runFailed).length;
-  const ended = { completed: "", cancelled: " The run was cancelled.", failed: " The run stopped at the first failure.", ended: ` The run ended: ${report.reason ?? ""}` }[report.ended];
-  return `${report.results.length} results in ${report.iterations} iteration${report.iterations === 1 ? "" : "s"}; ${failed} failed; ${tests2.filter((test) => test.passed).length} of ${tests2.length} tests passed.${ended}`;
+  const shared = sharedErrors(report.results).map(({ error, count }) => `
+${sharedErrorHeading(count)} ${error}`);
+  return `${runEnding(report)} ${runCounts(report)}${shared.join("")}`;
 }
 async function main(argv) {
   const { values, positionals } = parseArgs({
@@ -13256,6 +14527,7 @@ async function main(argv) {
     allowPositionals: true,
     options: {
       environment: { type: "string", short: "e" },
+      "environment-name": { type: "string" },
       data: { type: "string", short: "d" },
       iterations: { type: "string", short: "n" },
       collection: { type: "string" },
@@ -13271,7 +14543,7 @@ async function main(argv) {
     }
   });
   if (values.version) {
-    console.log("2.0.2");
+    console.log("2.2.0");
     return 0;
   }
   const [command, file, ...rest] = positionals;
@@ -13279,11 +14551,14 @@ async function main(argv) {
     console.log(USAGE);
     return values.help ? 0 : 2;
   }
-  if (command !== "run" || file === void 0 || rest.length) throw new Refusal(`Unknown command or arguments: ${positionals.join(" ")}
+  if (command !== "run" || file === void 0 || rest.length)
+    throw new Refusal(`Unknown command or arguments: ${positionals.join(" ")}
 
 ${USAGE}`);
   const reporters = new Set(values.reporter.split(",").map((name) => name.trim()));
-  for (const name of reporters) if (!["cli", "json", "junit"].includes(name)) throw new Refusal(`Unknown reporter "${name}": choose from cli, json and junit.`);
+  for (const name of reporters)
+    if (!["cli", "json", "junit", "html"].includes(name))
+      throw new Refusal(`Unknown reporter "${name}": choose from cli, json, junit and html.`);
   const number = (text3, flag2) => {
     if (text3 === void 0) return void 0;
     if (!/^\d+$/.test(text3)) throw new Refusal(`--${flag2} takes a whole number, not "${text3}".`);
@@ -13292,47 +14567,73 @@ ${USAGE}`);
   const iterations = number(values.iterations, "iterations");
   if (iterations === 0) throw new Refusal("--iterations takes 1 or more.");
   const timeoutMs = number(values.timeout, "timeout") ?? 0;
+  if (timeoutMs > NODE_FETCH_TIMEOUT_MS)
+    throw new Refusal(`--timeout takes at most ${NODE_FETCH_TIMEOUT_MS}: Node's fetch waits no longer for a response.`);
   const read = await readSource(file, values.collection);
   const holders = scriptHolders(read.source);
   if (holders.length && !values["allow-scripts"]) {
-    throw new Refusal(`This collection has scripts, in ${holders.join(", ")}. A file's scripts have not been reviewed: read them, and run again with --allow-scripts only if you trust them. Nothing was sent.`);
+    throw new Refusal(
+      `This collection has scripts, in ${holders.join(", ")}. A file's scripts have not been reviewed: read them, and run again with --allow-scripts only if you trust them. Nothing was sent.`
+    );
   }
-  const environment2 = values.environment === void 0 ? read.environment : await readEnvironment(values.environment);
+  if (values["environment-name"] !== void 0 && values.environment === void 0)
+    throw new Refusal("--environment-name names an environment of the file given with --environment.");
+  const environment2 = values.environment === void 0 ? read.environment : await readEnvironment(values.environment, values["environment-name"]);
   const vault = values["vault-file"] === void 0 ? read.vault : await readVaultFile(values["vault-file"]);
   let data;
   if (values.data !== void 0) {
     try {
-      data = parseDataFile(await readText(values.data, "data file"), basename(values.data));
+      data = parseDataFile(await readText2(values.data, "data file"), basename(values.data));
     } catch (error) {
-      if (error instanceof Error && error.name === "DataFileError") throw new Refusal(`${values.data}: ${error.message}`);
+      if (error instanceof Error && error.name === "DataFileError")
+        throw new Refusal(`${values.data}: ${error.message}`);
       throw error;
     }
   }
   if (values.insecure) process.env["NODE_TLS_REJECT_UNAUTHORIZED"] = "0";
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
-  if (reporters.has("json") || reporters.has("junit")) {
+  if (reporters.has("json") || reporters.has("junit") || reporters.has("html")) {
     await mkdir(values.out, { recursive: true }).catch((error) => {
       throw new Refusal(`--out ${values.out}: ${error instanceof Error ? error.message : String(error)}`);
     });
   }
+  const said2 = /* @__PURE__ */ new Set();
   const report = await runCollection(
-    { source: read.source, ...environment2 && { environment: environment2 }, globals: read.globals, ...vault && { vault }, allowScripts: values["allow-scripts"], timeoutMs },
+    {
+      source: read.source,
+      ...environment2 && { environment: environment2 },
+      globals: read.globals,
+      ...vault && { vault },
+      allowScripts: values["allow-scripts"],
+      timeoutMs
+    },
     {
       ...iterations !== void 0 && { iterations },
       ...data && { data },
       stopOnFailure: values.bail,
       onResult: (result) => {
-        if (reporters.has("cli")) console.log(line(result, iterations ?? data?.length ?? 1));
+        if (reporters.has("cli")) console.log(line(result, iterations ?? data?.length ?? 1, said2));
       }
     }
   );
   const info = { name: read.source.collection.name, startedAt };
   if (reporters.has("cli")) console.log(`
 ${summary(report)}`);
-  if (reporters.has("json")) await writeFile(join(values.out, "wayfarer-run.json"), `${JSON.stringify(runReportJson(report, info), null, 2)}
-`);
-  if (reporters.has("junit")) await writeFile(join(values.out, "wayfarer-run.junit.xml"), junitXml(report, info));
-  return report.results.some(runFailed) ? 1 : 0;
+  const code = report.results.some(runFailed) ? 1 : 0;
+  try {
+    if (reporters.has("json"))
+      await writeFile(
+        join(values.out, "wayfarer-run.json"),
+        `${JSON.stringify(runReportJson(report, info), null, 2)}
+`
+      );
+    if (reporters.has("junit")) await writeFile(join(values.out, "wayfarer-run.junit.xml"), junitXml(report, info));
+    if (reporters.has("html")) await writeFile(join(values.out, "wayfarer-run.html"), runReportHtml(report, info));
+  } catch (error) {
+    console.error(`--out ${values.out}: ${error instanceof Error ? error.message : String(error)}`);
+    return 1;
+  }
+  return code;
 }
 main(process.argv.slice(2)).then(
   (code) => process.exitCode = code,