wayfarer-cli 2.1.0 → 2.2.0

package/dist/wayfarer-cli.mjs

@@ -7493,9 +7493,9 @@ function isTextType(mediaType) {
   const subtype = type.slice(type.indexOf("/") + 1);
   return type.startsWith("text/") || subtype === "xml" || subtype.startsWith("xml-") || subtype.endsWith("+xml") || TEXT_WORDS.some((word) => type.includes(word));
 }
-function decodeResponseBody(bytes, contentType2) {
+function readBody(bytes, contentType2) {
   if (!bytes || bytes.byteLength === 0) {
-    return null;
+    return { value: null };
   }
   const type = (contentType2 ?? "").trim();
   const mediaType = type.split(";")[0].trim();
@@ -7505,21 +7505,21 @@ function decodeResponseBody(bytes, contentType2) {
       text3 = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
     } catch (error) {
       if (!(error instanceof TypeError)) throw error;
-      return new BinaryBody(bytes, "");
+      return { value: new BinaryBody(bytes, "") };
     }
   } else if (JSON_TYPE.test(mediaType) || isTextType(mediaType)) {
     text3 = decodeText(bytes, charsetOf(type));
   } else {
-    return new BinaryBody(bytes, mediaType);
+    return { value: new BinaryBody(bytes, mediaType) };
   }
   const trimmed = text3.trim();
   if (JSON_TYPE.test(mediaType) || trimmed.startsWith("{") || trimmed.startsWith("[")) {
     const parsed2 = parseJson(text3);
     if (parsed2.ok && parsed2.value !== null && (JSON_TYPE.test(mediaType) || typeof parsed2.value === "object")) {
-      return parsed2.value;
+      return { value: parsed2.value, text: text3 };
     }
   }
-  return text3;
+  return { value: text3, text: text3 };
 }
 function charsetOf(contentType2) {
   const match = /;\s*charset\s*=\s*"?([^";\s]+)"?/i.exec(contentType2);
@@ -7533,12 +7533,12 @@ function decodeText(bytes, charset) {
     return new TextDecoder("utf-8").decode(bytes);
   }
 }
-function decodeEnvelope(envelope) {
+function readEnvelope(envelope) {
   const contentType2 = envelope.headers.find(([name]) => name.toLowerCase() === "content-type")?.[1];
   if (envelope.body instanceof Blob) {
-    return new BinaryBody(envelope.body, (contentType2 ?? "").split(";")[0].trim());
+    return { value: new BinaryBody(envelope.body, (contentType2 ?? "").split(";")[0].trim()) };
   }
-  return decodeResponseBody(envelope.body, contentType2);
+  return readBody(envelope.body, contentType2);
 }
 
 // ../core/src/id.ts
@@ -7589,15 +7589,16 @@ function buildAuthHeaders(auth3) {
     return { Authorization: `Bearer ${auth3.token}` };
   }
   if (auth3.type === "basic" && auth3.username) {
-    const bytes = new TextEncoder().encode(`${auth3.username}:${auth3.password}`);
-    const encoded = btoa(String.fromCharCode(...bytes));
-    return { Authorization: `Basic ${encoded}` };
+    return { Authorization: basicCredentials(auth3.username, auth3.password) };
   }
   if (auth3.type === "apikey" && auth3.key && auth3.in === "header") {
     return Object.fromEntries([[auth3.key, auth3.value]]);
   }
   return {};
 }
+function basicCredentials(user, password) {
+  return `Basic ${btoa(String.fromCharCode(...new TextEncoder().encode(`${user}:${password}`)))}`;
+}
 function buildAuthQueryParam(auth3) {
   if (auth3.type === "apikey" && auth3.key && auth3.in === "query") {
     return { key: auth3.key, value: auth3.value };
@@ -7662,86 +7663,117 @@ function credentialsOf(auth3) {
   }
 }
 
-// ../core/src/auth/sigv4.ts
+// ../core/src/vault/vault-crypto.ts
+var KDF_ITERATIONS = 6e5;
+var MAX_KDF_ITERATIONS = 1e7;
+var IV_BYTES = 12;
+var AES = { name: "AES-GCM", length: 256 };
+var VAULT_FILE_FORMAT = "wayfarer/vault";
+function fromBase64Url(text3) {
+  const binary = atob(text3.replace(/-/g, "+").replace(/_/g, "/"));
+  return Uint8Array.from(binary, (char) => char.charCodeAt(0));
+}
 var utf8 = (text3) => new TextEncoder().encode(text3);
-var sha256 = async (data) => new Uint8Array(await crypto.subtle.digest("SHA-256", data));
-var hmac = async (key, data) => new Uint8Array(
-  await crypto.subtle.sign(
-    "HMAC",
-    await crypto.subtle.importKey("raw", key, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]),
-    utf8(data)
-  )
-);
-var hex = (bytes) => Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
-var encode = (text3) => encodeURIComponent(text3).replace(/[!'()*]/g, (mark) => `%${mark.charCodeAt(0).toString(16).toUpperCase()}`);
-var decode = (text3) => {
+async function deriveKek(passphrase, kdf) {
+  if (!crypto.subtle) {
+    throw new Error("The vault needs a secure page: open Wayfarer over https or on localhost.");
+  }
+  const material = await crypto.subtle.importKey("raw", utf8(passphrase), "PBKDF2", false, ["deriveKey"]);
+  return crypto.subtle.deriveKey(
+    { name: "PBKDF2", salt: fromBase64Url(kdf.salt), iterations: kdf.iterations, hash: "SHA-256" },
+    material,
+    AES,
+    false,
+    ["wrapKey", "unwrapKey"]
+  );
+}
+async function unwrap(record, passphrase, extractable) {
+  const bytes = fromBase64Url(record.wrappedDek);
+  const kek = await deriveKek(passphrase, record.kdf);
   try {
-    return decodeURIComponent(text3);
+    return await crypto.subtle.unwrapKey(
+      "raw",
+      bytes.slice(IV_BYTES),
+      kek,
+      { name: "AES-GCM", iv: bytes.slice(0, IV_BYTES) },
+      AES,
+      extractable,
+      ["encrypt", "decrypt"]
+    );
   } catch (error) {
-    if (!(error instanceof URIError)) throw error;
-    return text3;
+    if (error instanceof Error && error.name === "OperationError") return null;
+    throw error;
   }
-};
-async function signV4(request, credentials, at) {
-  const url = new URL(request.url);
-  const s3 = credentials.service === "s3";
-  const segments = url.pathname.split("/");
-  const kept = segments.filter(Boolean);
-  const path = s3 ? segments.map((segment) => encode(decode(segment))).join("/") : `/${kept.map(encode).join("/")}${kept.length && url.pathname.endsWith("/") ? "/" : ""}`;
-  const query = url.search.slice(1).split("&").filter(Boolean).map((pair) => {
-    const cut = pair.indexOf("=");
-    return [
-      encode(decode(cut === -1 ? pair : pair.slice(0, cut))),
-      encode(decode(cut === -1 ? "" : pair.slice(cut + 1)))
-    ];
-  }).sort(
-    ([keyA, valueA], [keyB, valueB]) => keyA === keyB ? valueA < valueB ? -1 : valueA > valueB ? 1 : 0 : keyA < keyB ? -1 : 1
-  ).map(([key2, value]) => `${key2}=${value}`).join("&");
-  const date = at.toISOString().replace(/[-:]|\.\d{3}/g, "");
-  const day = date.slice(0, 8);
-  const body3 = typeof request.body === "string" ? utf8(request.body) : new Uint8Array(request.body ?? []);
-  const bodyHash = hex(await sha256(body3));
-  const added2 = [
-    ["X-Amz-Date", date],
-    ...credentials.sessionToken ? [["X-Amz-Security-Token", credentials.sessionToken]] : [],
-    ...s3 ? [["X-Amz-Content-Sha256", bodyHash]] : []
-  ];
-  const byName = /* @__PURE__ */ new Map();
-  const own3 = request.headers.filter(
-    ([name]) => !added2.some(([written]) => written.toLowerCase() === name.toLowerCase()) && name.toLowerCase() !== "host"
+}
+function unwrapDek(record, passphrase) {
+  return unwrap(record, passphrase, false);
+}
+async function decryptSecret(dek, id, envelope) {
+  const plain = await crypto.subtle.decrypt(
+    { name: "AES-GCM", iv: fromBase64Url(envelope.iv), additionalData: utf8(id) },
+    dek,
+    fromBase64Url(envelope.ct)
   );
-  for (const [name, value] of [["Host", url.host], ...own3, ...added2]) {
-    const key2 = name.toLowerCase();
-    byName.set(key2, [...byName.get(key2) ?? [], value.trim().replace(/\s+/g, " ")]);
+  return new TextDecoder().decode(plain);
+}
+function field(value, key) {
+  return typeof value === "object" && value !== null && Object.hasOwn(value, key) ? value[key] : void 0;
+}
+var isBase64Url = (value) => typeof value === "string" && /^[\w-]+$/.test(value);
+function validateVaultFile(value) {
+  const issues = [];
+  const fail = (path, message) => issues.push({ path, message });
+  if (typeof value !== "object" || value === null) {
+    fail("$", "Value must be an object.");
+    return issues;
   }
-  const names = [...byName.keys()].sort();
-  const signedHeaders = names.join(";");
-  const canonicalRequest = [
-    request.method,
-    path,
-    query,
-    ...names.map((name) => `${name}:${(byName.get(name) ?? []).join(",")}`),
-    "",
-    signedHeaders,
-    bodyHash
-  ].join("\n");
-  const scope = `${day}/${credentials.region}/${credentials.service}/aws4_request`;
-  const stringToSign = ["AWS4-HMAC-SHA256", date, scope, hex(await sha256(utf8(canonicalRequest)))].join("\n");
-  let key = utf8(`AWS4${credentials.secretKey}`);
-  for (const part of [day, credentials.region, credentials.service, "aws4_request"]) key = await hmac(key, part);
-  const signature = hex(await hmac(key, stringToSign));
-  return {
-    headers: [
-      ...added2,
-      [
-        "Authorization",
-        `AWS4-HMAC-SHA256 Credential=${credentials.accessKey}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`
-      ]
-    ],
-    canonicalRequest,
-    stringToSign,
-    signature
-  };
+  if (field(value, "$id") !== VAULT_FILE_FORMAT) {
+    fail("$id", `Not a Wayfarer vault file: "$id" must be "${VAULT_FILE_FORMAT}".`);
+    return issues;
+  }
+  const vault = field(value, "vault");
+  if (typeof vault !== "object" || vault === null) {
+    fail("vault", "Value must be an object.");
+  } else {
+    const kdf = field(vault, "kdf");
+    if (typeof kdf !== "object" || kdf === null) {
+      fail("vault.kdf", "Value must be an object.");
+    } else {
+      if (field(kdf, "alg") !== "PBKDF2-SHA256") fail("vault.kdf.alg", 'Value must be "PBKDF2-SHA256".');
+      const iterations = field(kdf, "iterations");
+      if (!(Number.isInteger(iterations) && iterations >= KDF_ITERATIONS && iterations <= MAX_KDF_ITERATIONS)) {
+        fail("vault.kdf.iterations", `Value must be a whole number from ${KDF_ITERATIONS} to ${MAX_KDF_ITERATIONS}.`);
+      }
+      if (!isBase64Url(field(kdf, "salt"))) fail("vault.kdf.salt", "Value must be base64url text.");
+    }
+    if (!isBase64Url(field(vault, "wrappedDek"))) fail("vault.wrappedDek", "Value must be base64url text.");
+  }
+  const secrets = field(value, "secrets");
+  if (!Array.isArray(secrets)) {
+    fail("secrets", "Value must be an array.");
+    return issues;
+  }
+  secrets.forEach((secret, index) => {
+    const path = `secrets[${index}]`;
+    if (typeof secret !== "object" || secret === null) {
+      fail(path, "Value must be an object.");
+      return;
+    }
+    const id = field(secret, "id");
+    if (typeof id !== "string" || !id) fail(`${path}.id`, "Value must be a non-empty string.");
+    if (typeof field(secret, "name") !== "string") fail(`${path}.name`, "Value must be a string.");
+    const environmentId = field(secret, "environmentId");
+    if (environmentId !== void 0 && typeof environmentId !== "string")
+      fail(`${path}.environmentId`, "Value must be a string.");
+    const envelope = field(secret, "envelope");
+    if (typeof envelope !== "object" || envelope === null) {
+      fail(`${path}.envelope`, "Value must be an object.");
+      return;
+    }
+    if (!isBase64Url(field(envelope, "iv"))) fail(`${path}.envelope.iv`, "Value must be base64url text.");
+    if (!isBase64Url(field(envelope, "ct"))) fail(`${path}.envelope.ct`, "Value must be base64url text.");
+  });
+  return issues;
 }
 
 // ../core/src/auth/oauth2.ts
@@ -7772,12 +7804,42 @@ function folderChain(folders, folderId) {
   }
   return chain;
 }
-function childrenInOrder(tree, parent) {
-  const entries = [
-    ...tree.folders.filter((folder) => folder.parentFolderId === parent).map((folder) => ({ order: folder.order, kind: 0, id: folder.id, child: { folder } })),
-    ...tree.requests.filter((request) => request.folderId === parent).map((request) => ({ order: request.order, kind: 1, id: request.id, child: { request } }))
+function childrenInOrder(tree) {
+  const byParent = /* @__PURE__ */ new Map();
+  const add = (parent, entry) => {
+    const siblings = byParent.get(parent);
+    if (siblings) siblings.push(entry);
+    else byParent.set(parent, [entry]);
+  };
+  for (const folder of tree.folders)
+    add(folder.parentFolderId, { order: folder.order, kind: 0, id: folder.id, child: { folder } });
+  for (const request of tree.requests)
+    add(request.folderId, { order: request.order, kind: 1, id: request.id, child: { request } });
+  const sorted = new Map(
+    [...byParent].map(([parent, entries]) => [
+      parent,
+      entries.sort((a, b) => a.order - b.order || a.kind - b.kind || a.id.localeCompare(b.id)).map((entry) => entry.child)
+    ])
+  );
+  return (parent) => sorted.get(parent) ?? [];
+}
+function treeInOrder(tree) {
+  const entered = /* @__PURE__ */ new Set();
+  const childrenOf = childrenInOrder(tree);
+  const walk2 = (parent) => childrenOf(parent).flatMap((child) => {
+    if (child.request !== void 0) return [{ kind: "request", request: child.request }];
+    const { folder } = child;
+    if (!folder || entered.has(folder.id)) return [];
+    entered.add(folder.id);
+    return [{ kind: "folder", folder }, ...walk2(folder.id)];
+  });
+  const listed = walk2(void 0);
+  const seen = new Set(listed.map((item) => item.kind === "request" ? item.request : item.folder));
+  return [
+    ...listed,
+    ...tree.folders.filter((folder) => !seen.has(folder)).map((folder) => ({ kind: "folder", folder })),
+    ...tree.requests.filter((request) => !seen.has(request)).map((request) => ({ kind: "request", request }))
   ];
-  return entries.sort((a, b) => a.order - b.order || a.kind - b.kind || a.id.localeCompare(b.id)).map((entry) => entry.child);
 }
 function ancestorsOf(collection, folders, folderId) {
   const named2 = (kind, { name, variables: variables2, auth: auth3, scripts: scripts2 }) => ({
@@ -7844,7 +7906,7 @@ function emptyRequest() {
 function isObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function field(object, key) {
+function field2(object, key) {
   return Object.hasOwn(object, key) ? object[key] : void 0;
 }
 var Checker = class {
@@ -7858,12 +7920,12 @@ var Checker = class {
     return null;
   }
   string(object, key, path, optional = false) {
-    const value = field(object, key);
+    const value = field2(object, key);
     if (typeof value === "string" || optional && value === void 0) return;
     this.fail(`${path}.${key}`, "Value must be a string.");
   }
   oneOf(object, key, path, allowed, optional = false) {
-    const value = field(object, key);
+    const value = field2(object, key);
     if (optional && value === void 0 || typeof value === "string" && allowed.includes(value)) return;
     this.fail(`${path}.${key}`, `Value must be one of ${allowed.join(", ")}.`);
   }
@@ -7879,7 +7941,7 @@ var Checker = class {
     });
   }
   enabled(row, rowPath) {
-    if (typeof field(row, "enabled") !== "boolean") {
+    if (typeof field2(row, "enabled") !== "boolean") {
       this.fail(`${rowPath}.enabled`, "Value must be true or false.");
     }
   }
@@ -7888,7 +7950,7 @@ var Checker = class {
       this.string(row, "key", rowPath);
       this.string(row, "value", rowPath);
       this.enabled(row, rowPath);
-      if (Object.hasOwn(row, "json") && (field(row, "json") !== true || !isJsonText(field(row, "value"))))
+      if (Object.hasOwn(row, "json") && (field2(row, "json") !== true || !isJsonText(field2(row, "value"))))
         this.fail(`${rowPath}.json`, "Value must be true, on a value that is JSON.");
     });
   }
@@ -7897,7 +7959,7 @@ var Checker = class {
     const auth3 = this.object(value, path);
     if (!auth3) return;
     this.oneOf(auth3, "type", path, inherit ? AUTH_TYPES : AUTH_TYPES.filter((type2) => type2 !== "inherit"));
-    const type = field(auth3, "type");
+    const type = field2(auth3, "type");
     if (type === "bearer") {
       this.string(auth3, "token", path);
     } else if (type === "basic") {
@@ -7914,7 +7976,7 @@ var Checker = class {
       for (const key of ["authUrl", "tokenUrl", "clientId", "clientSecret", "scope", "username", "password"])
         this.string(auth3, key, path);
       this.oneOf(auth3, "clientAuth", path, ["header", "body"]);
-      if (typeof field(auth3, "retryOn401") !== "boolean")
+      if (typeof field2(auth3, "retryOn401") !== "boolean")
         this.fail(`${path}.retryOn401`, "Value must be true or false.");
     }
   }
@@ -7938,9 +8000,9 @@ function validateInherited(value, path, kind) {
   const check = new Checker();
   const node = check.object(value, path);
   if (!node) return check.issues;
-  check.auth(field(node, "auth"), `${path}.auth`, kind === "folder");
-  check.scripts(field(node, "scripts"), `${path}.scripts`);
-  if (kind === "folder") check.rows(field(node, "variables"), `${path}.variables`);
+  check.auth(field2(node, "auth"), `${path}.auth`, kind === "folder");
+  check.scripts(field2(node, "scripts"), `${path}.scripts`);
+  if (kind === "folder") check.rows(field2(node, "variables"), `${path}.variables`);
   else check.oneOf(node, "route", path, ["auto", "direct", "bridge"], true);
   return check.issues;
 }
@@ -7948,75 +8010,75 @@ function validateRequestContent(value, path) {
   const check = new Checker();
   const request = check.object(value, path);
   if (!request) return check.issues;
-  const method = field(request, "method");
+  const method = field2(request, "method");
   if (typeof method !== "string" || !isHttpMethod(method)) {
     check.fail(`${path}.method`, "Value must be an HTTP method: one word of at most 32 characters, in upper case.");
   }
-  if (typeof field(request, "url") !== "string" || !field(request, "url").trim()) {
+  if (typeof field2(request, "url") !== "string" || !field2(request, "url").trim()) {
     check.fail(`${path}.url`, "Value must be a non-empty string.");
   }
-  check.rows(field(request, "params"), `${path}.params`);
-  check.rows(field(request, "headers"), `${path}.headers`);
-  const body3 = check.object(field(request, "body"), `${path}.body`);
+  check.rows(field2(request, "params"), `${path}.params`);
+  check.rows(field2(request, "headers"), `${path}.headers`);
+  const body3 = check.object(field2(request, "body"), `${path}.body`);
   if (body3) {
-    const mode = field(body3, "mode");
+    const mode = field2(body3, "mode");
     check.oneOf(body3, "mode", `${path}.body`, BODY_MODES);
-    const part = (name) => field(body3, name) !== void 0 || mode === name ? name : null;
+    const part = (name) => field2(body3, name) !== void 0 || mode === name ? name : null;
     if (part("raw")) {
-      const raw = check.object(field(body3, "raw"), `${path}.body.raw`);
+      const raw = check.object(field2(body3, "raw"), `${path}.body.raw`);
       if (raw) {
         check.oneOf(raw, "language", `${path}.body.raw`, RAW_LANGUAGES);
         check.string(raw, "text", `${path}.body.raw`);
       }
     }
     if (part("urlencoded")) {
-      check.rows(field(body3, "urlencoded"), `${path}.body.urlencoded`);
+      check.rows(field2(body3, "urlencoded"), `${path}.body.urlencoded`);
     }
     if (part("multipart")) {
-      check.list(field(body3, "multipart"), `${path}.body.multipart`, (item, itemPath) => {
+      check.list(field2(body3, "multipart"), `${path}.body.multipart`, (item, itemPath) => {
         check.string(item, "key", itemPath);
         check.enabled(item, itemPath);
         check.oneOf(item, "kind", itemPath, ["text", "file"]);
-        if (field(item, "kind") === "text") check.string(item, "value", itemPath);
-        if (field(item, "kind") === "file") check.fileRef(item, itemPath);
+        if (field2(item, "kind") === "text") check.string(item, "value", itemPath);
+        if (field2(item, "kind") === "file") check.fileRef(item, itemPath);
       });
     }
     if (part("graphql")) {
-      const graphql = check.object(field(body3, "graphql"), `${path}.body.graphql`);
+      const graphql = check.object(field2(body3, "graphql"), `${path}.body.graphql`);
       if (graphql) {
         check.string(graphql, "query", `${path}.body.graphql`);
         check.string(graphql, "variables", `${path}.body.graphql`);
       }
     }
-    if (field(body3, "binary") !== void 0) {
-      const binary = check.object(field(body3, "binary"), `${path}.body.binary`);
+    if (field2(body3, "binary") !== void 0) {
+      const binary = check.object(field2(body3, "binary"), `${path}.body.binary`);
       if (binary) {
         check.fileRef(binary, `${path}.body.binary`);
         check.string(binary, "contentType", `${path}.body.binary`, true);
       }
     }
   }
-  check.auth(field(request, "auth"), `${path}.auth`, true);
-  check.scripts(field(request, "scripts"), `${path}.scripts`);
-  check.list(field(request, "tests"), `${path}.tests`, (test, testPath) => {
+  check.auth(field2(request, "auth"), `${path}.auth`, true);
+  check.scripts(field2(request, "scripts"), `${path}.scripts`);
+  check.list(field2(request, "tests"), `${path}.tests`, (test, testPath) => {
     check.string(test, "id", testPath);
     check.oneOf(test, "target", testPath, ASSERTION_TARGETS);
     check.oneOf(test, "operator", testPath, ASSERTION_OPERATORS);
     check.string(test, "key", testPath, true);
     check.string(test, "expected", testPath, true);
   });
-  const settings = check.object(field(request, "settings"), `${path}.settings`);
+  const settings = check.object(field2(request, "settings"), `${path}.settings`);
   if (settings) {
-    const timeout = field(settings, "timeoutMs");
+    const timeout = field2(settings, "timeoutMs");
     if (timeout !== void 0 && !(typeof timeout === "number" && Number.isFinite(timeout) && timeout >= 0)) {
       check.fail(`${path}.settings.timeoutMs`, "Value must be a number, 0 or more.");
     }
-    const follow = field(settings, "followRedirects");
+    const follow = field2(settings, "followRedirects");
     if (follow !== void 0 && typeof follow !== "boolean") {
       check.fail(`${path}.settings.followRedirects`, "Value must be true or false.");
     }
     check.oneOf(settings, "route", `${path}.settings`, ["auto", "direct", "bridge"], true);
-    const insecure = field(settings, "tlsInsecure");
+    const insecure = field2(settings, "tlsInsecure");
     if (insecure !== void 0 && typeof insecure !== "boolean") {
       check.fail(`${path}.settings.tlsInsecure`, "Value must be true or false.");
     }
@@ -8110,21 +8172,10 @@ function buildPlan(payload, duplicate) {
       action
     }
   ];
-  for (const folder of payload.folders) {
-    entries.push({
-      type: "folder",
-      name: folder.name,
-      id: folder.meta.id,
-      action
-    });
-  }
-  for (const request of payload.requests) {
-    entries.push({
-      type: "request",
-      name: request.name || request.url,
-      id: request.meta.id,
-      action
-    });
+  for (const child of treeInOrder(payload)) {
+    entries.push(
+      child.kind === "request" ? { type: "request", name: child.request.name || child.request.url, id: child.request.meta.id, action } : { type: "folder", name: child.folder.name, id: child.folder.meta.id, action }
+    );
   }
   return entries;
 }
@@ -8532,119 +8583,6 @@ function scriptVariables(rows2) {
   return [...byName.values()];
 }
 
-// ../core/src/vault/vault-crypto.ts
-var KDF_ITERATIONS = 6e5;
-var MAX_KDF_ITERATIONS = 1e7;
-var IV_BYTES = 12;
-var AES = { name: "AES-GCM", length: 256 };
-var VAULT_FILE_FORMAT = "wayfarer/vault";
-function fromBase64Url(text3) {
-  const binary = atob(text3.replace(/-/g, "+").replace(/_/g, "/"));
-  return Uint8Array.from(binary, (char) => char.charCodeAt(0));
-}
-var utf82 = (text3) => new TextEncoder().encode(text3);
-async function deriveKek(passphrase, kdf) {
-  if (!crypto.subtle) {
-    throw new Error("The vault needs a secure page: open Wayfarer over https or on localhost.");
-  }
-  const material = await crypto.subtle.importKey("raw", utf82(passphrase), "PBKDF2", false, ["deriveKey"]);
-  return crypto.subtle.deriveKey(
-    { name: "PBKDF2", salt: fromBase64Url(kdf.salt), iterations: kdf.iterations, hash: "SHA-256" },
-    material,
-    AES,
-    false,
-    ["wrapKey", "unwrapKey"]
-  );
-}
-async function unwrap(record, passphrase, extractable) {
-  const bytes = fromBase64Url(record.wrappedDek);
-  const kek = await deriveKek(passphrase, record.kdf);
-  try {
-    return await crypto.subtle.unwrapKey(
-      "raw",
-      bytes.slice(IV_BYTES),
-      kek,
-      { name: "AES-GCM", iv: bytes.slice(0, IV_BYTES) },
-      AES,
-      extractable,
-      ["encrypt", "decrypt"]
-    );
-  } catch (error) {
-    if (error instanceof Error && error.name === "OperationError") return null;
-    throw error;
-  }
-}
-function unwrapDek(record, passphrase) {
-  return unwrap(record, passphrase, false);
-}
-async function decryptSecret(dek, id, envelope) {
-  const plain = await crypto.subtle.decrypt(
-    { name: "AES-GCM", iv: fromBase64Url(envelope.iv), additionalData: utf82(id) },
-    dek,
-    fromBase64Url(envelope.ct)
-  );
-  return new TextDecoder().decode(plain);
-}
-function field2(value, key) {
-  return typeof value === "object" && value !== null && Object.hasOwn(value, key) ? value[key] : void 0;
-}
-var isBase64Url = (value) => typeof value === "string" && /^[\w-]+$/.test(value);
-function validateVaultFile(value) {
-  const issues = [];
-  const fail = (path, message) => issues.push({ path, message });
-  if (typeof value !== "object" || value === null) {
-    fail("$", "Value must be an object.");
-    return issues;
-  }
-  if (field2(value, "$id") !== VAULT_FILE_FORMAT) {
-    fail("$id", `Not a Wayfarer vault file: "$id" must be "${VAULT_FILE_FORMAT}".`);
-    return issues;
-  }
-  const vault = field2(value, "vault");
-  if (typeof vault !== "object" || vault === null) {
-    fail("vault", "Value must be an object.");
-  } else {
-    const kdf = field2(vault, "kdf");
-    if (typeof kdf !== "object" || kdf === null) {
-      fail("vault.kdf", "Value must be an object.");
-    } else {
-      if (field2(kdf, "alg") !== "PBKDF2-SHA256") fail("vault.kdf.alg", 'Value must be "PBKDF2-SHA256".');
-      const iterations = field2(kdf, "iterations");
-      if (!(Number.isInteger(iterations) && iterations >= KDF_ITERATIONS && iterations <= MAX_KDF_ITERATIONS)) {
-        fail("vault.kdf.iterations", `Value must be a whole number from ${KDF_ITERATIONS} to ${MAX_KDF_ITERATIONS}.`);
-      }
-      if (!isBase64Url(field2(kdf, "salt"))) fail("vault.kdf.salt", "Value must be base64url text.");
-    }
-    if (!isBase64Url(field2(vault, "wrappedDek"))) fail("vault.wrappedDek", "Value must be base64url text.");
-  }
-  const secrets = field2(value, "secrets");
-  if (!Array.isArray(secrets)) {
-    fail("secrets", "Value must be an array.");
-    return issues;
-  }
-  secrets.forEach((secret, index) => {
-    const path = `secrets[${index}]`;
-    if (typeof secret !== "object" || secret === null) {
-      fail(path, "Value must be an object.");
-      return;
-    }
-    const id = field2(secret, "id");
-    if (typeof id !== "string" || !id) fail(`${path}.id`, "Value must be a non-empty string.");
-    if (typeof field2(secret, "name") !== "string") fail(`${path}.name`, "Value must be a string.");
-    const environmentId = field2(secret, "environmentId");
-    if (environmentId !== void 0 && typeof environmentId !== "string")
-      fail(`${path}.environmentId`, "Value must be a string.");
-    const envelope = field2(secret, "envelope");
-    if (typeof envelope !== "object" || envelope === null) {
-      fail(`${path}.envelope`, "Value must be an object.");
-      return;
-    }
-    if (!isBase64Url(field2(envelope, "iv"))) fail(`${path}.envelope.iv`, "Value must be base64url text.");
-    if (!isBase64Url(field2(envelope, "ct"))) fail(`${path}.envelope.ct`, "Value must be base64url text.");
-  });
-  return issues;
-}
-
 // ../core/src/variables/resolver.ts
 var VARIABLE_SCOPES = ["local", "data", "environment", "folder", "collection", "global"];
 var MAX_VARIABLE_DEPTH = 10;
@@ -8904,13 +8842,15 @@ var SseParser = class {
 // ../core/src/transport/transport.ts
 var STREAM_BODY_BYTES = 1024 * 1024;
 var TransportError = class extends Error {
-  constructor(kind, message, status) {
+  constructor(kind, message, status, responded = false) {
     super(message);
     this.kind = kind;
     this.status = status;
+    this.responded = responded;
   }
   kind;
   status;
+  responded;
   name = "TransportError";
 };
 var DISPLAY_CAP_BYTES = 50 * 1024 * 1024;
@@ -8920,10 +8860,13 @@ async function withDeadline(options, run) {
   const cancel = () => controller.abort();
   if (options.signal.aborted) cancel();
   options.signal.addEventListener("abort", cancel);
-  const timer = options.timeoutMs > 0 ? setTimeout(() => {
-    timedOut = true;
-    controller.abort();
-  }, options.timeoutMs) : void 0;
+  const timer = options.timeoutMs > 0 ? setTimeout(
+    () => {
+      timedOut = true;
+      controller.abort();
+    },
+    Math.min(options.timeoutMs, 2 ** 31 - 1)
+  ) : void 0;
   try {
     return await run(controller.signal, () => clearTimeout(timer));
   } catch (cause) {
@@ -8940,7 +8883,7 @@ async function withDeadline(options, run) {
     options.signal.removeEventListener("abort", cancel);
   }
 }
-async function readBody(response, cap = DISPLAY_CAP_BYTES) {
+async function readBody2(response, cap = DISPLAY_CAP_BYTES) {
   if (!response.body) return response.arrayBuffer();
   const reader2 = response.body.getReader();
   let chunks = [];
@@ -8974,7 +8917,7 @@ async function readEventStream(response, signal, onEvent) {
   const kept = new Uint8Array(STREAM_BODY_BYTES);
   let size = 0;
   let truncated = false;
-  let stopped = false;
+  let stopped2 = false;
   const reader2 = response.body?.getReader();
   try {
     for (; ; ) {
@@ -8989,9 +8932,9 @@ async function readEventStream(response, signal, onEvent) {
     }
   } catch (error) {
     if (!signal.aborted) throw error;
-    stopped = true;
+    stopped2 = true;
   }
-  return { body: kept.slice(0, size).buffer, stream: { stopped, ...truncated && { truncated } } };
+  return { body: kept.slice(0, size).buffer, stream: { stopped: stopped2, ...truncated && { truncated } } };
 }
 function networkMessage(cause) {
   if (!(cause instanceof Error)) return String(cause);
@@ -9008,7 +8951,8 @@ var FetchTransport = class {
   fetchFn;
   displayCap;
   send(request, options) {
-    return withDeadline(options, async (signal, arrived) => {
+    let responded = false;
+    const sent = withDeadline(options, async (signal, arrived) => {
       const response = await this.fetchFn(request.url, {
         method: request.method,
         headers: request.headers,
@@ -9019,9 +8963,10 @@ var FetchTransport = class {
         redirect: "follow",
         signal
       });
+      responded = true;
       const { onEvent } = options;
       const events = onEvent && /^text\/event-stream\b/i.test(response.headers.get("content-type") ?? "") ? (arrived(), await readEventStream(response, signal, onEvent)) : void 0;
-      const body3 = events?.body ?? await readBody(response, this.displayCap);
+      const body3 = events?.body ?? await readBody2(response, this.displayCap);
       return {
         status: response.status,
         statusText: response.statusText,
@@ -9034,6 +8979,11 @@ var FetchTransport = class {
         ...events && { stream: events.stream }
       };
     });
+    return sent.catch((error) => {
+      if (responded && error instanceof TransportError && error.kind === "network")
+        throw new TransportError("network", error.message, void 0, true);
+      throw error;
+    });
   }
 };
 
@@ -9736,7 +9686,7 @@ var _HMAC = class {
     this.iHash.destroy();
   }
 };
-var hmac2 = /* @__PURE__ */ (() => {
+var hmac = /* @__PURE__ */ (() => {
   const hmac_ = ((hash, key, message) => new _HMAC(hash, key).update(message).digest());
   hmac_.create = (hash, key) => new _HMAC(hash, key);
   return hmac_;
@@ -10180,13 +10130,13 @@ var _SHA256 = class extends SHA2_32B {
     super(32, SHA256_IV);
   }
 };
-var sha2562 = /* @__PURE__ */ createHasher(
+var sha256 = /* @__PURE__ */ createHasher(
   () => new _SHA256(),
   /* @__PURE__ */ oidNist(1)
 );
 
 // ../core/src/scripting/vm-crypto.ts
-var HASHES = { MD5: md5, SHA1: sha1, SHA256: sha2562 };
+var HASHES = { MD5: md5, SHA1: sha1, SHA256: sha256 };
 var isVmHash = (name) => Object.hasOwn(HASHES, name);
 var VM_ENCODINGS = ["utf8", "hex", "base64"];
 function fromWords(json) {
@@ -10212,7 +10162,7 @@ function vmHash(name, format, payload) {
   return toWords(HASHES[name](bytesOf(format, payload)));
 }
 function vmHmac(name, keyFormat, key, format, payload) {
-  return toWords(hmac2(HASHES[name], bytesOf(keyFormat, key), bytesOf(format, payload)));
+  return toWords(hmac(HASHES[name], bytesOf(keyFormat, key), bytesOf(format, payload)));
 }
 function vmEncode(encoding, text3) {
   if (encoding === "utf8") return toWords(new TextEncoder().encode(text3));
@@ -10351,8 +10301,17 @@ async function evaluate(vm, runtime, source, context, state, deadline, limits, s
       if (Date.now() >= deadline.at) return { message: "", limit: "timeout" };
       const kind = vm.typeof(error);
       if (kind === "string") return { message: vm.getString(error) };
+      if (kind === "number" || kind === "boolean" || kind === "undefined") return { message: String(vm.dump(error)) };
       if (kind !== "object") return { message: "Script failed." };
-      if (vm.sameValue(error, vm.null)) return { message: "", limit: "memory" };
+      if (vm.sameValue(error, vm.null)) {
+        const probe = vm.evalCode("({})");
+        if (probe.error) {
+          probe.error.dispose();
+          return { message: "", limit: "memory" };
+        }
+        probe.value.dispose();
+        return { message: "null" };
+      }
       const name = property(vm, error, "name");
       const message = property(vm, error, "message") ?? "Script failed.";
       if (name === "InternalError" && message === "out of memory") return { message, limit: "memory" };
@@ -10683,32 +10642,6 @@ function property(vm, object, name) {
   }
 }
 
-// ../core/src/scripting/request-view.ts
-function scriptRequestOf(content) {
-  const rows2 = (list4) => list4.filter((row) => row.enabled && row.key).map((row) => [row.key, row.value]);
-  const { body: body3 } = content;
-  const seen = body3.mode === "raw" ? { mode: "raw", raw: body3.raw?.text ?? "" } : body3.mode === "graphql" ? { mode: "raw", raw: graphqlText(body3.graphql?.query ?? "", body3.graphql?.variables ?? "") } : body3.mode === "urlencoded" ? { mode: "urlencoded", urlencoded: rows2(body3.urlencoded ?? []) } : { mode: body3.mode };
-  return { method: content.method, url: content.url, headers: rows2(content.headers), body: seen };
-}
-function withScriptRequest(content, request) {
-  const rows2 = (pairs2) => pairs2.map(([key, value]) => ({ key, value, enabled: true }));
-  const untouched = content.body.mode === "graphql" && request.body.mode === "raw" && request.body.raw === graphqlText(content.body.graphql?.query ?? "", content.body.graphql?.variables ?? "");
-  const body3 = untouched ? content.body : request.body.mode === "raw" ? {
-    ...content.body,
-    mode: "raw",
-    raw: {
-      language: content.body.mode === "graphql" ? "json" : content.body.raw?.language ?? "text",
-      text: request.body.raw
-    }
-  } : request.body.mode === "urlencoded" ? { ...content.body, mode: "urlencoded", urlencoded: rows2(request.body.urlencoded) } : content.body;
-  return { ...content, method: request.method, url: request.url, headers: rows2(request.headers), body: body3 };
-}
-function sentScriptRequest(content, sent) {
-  const { mode } = content.body;
-  const body3 = mode === "multipart" || mode === "binary" ? { mode } : sent.body === void 0 ? { mode: "none" } : mode === "urlencoded" ? { mode, urlencoded: [...new URLSearchParams(sent.body)] } : { mode: "raw", raw: sent.body };
-  return { method: sent.method, url: sent.url, headers: sent.headers, body: body3 };
-}
-
 // ../core/src/scripting/trust.ts
 function scriptsOf(holder) {
   return [holder.scripts.pre, holder.scripts.post].filter((script) => script.trim());
@@ -10720,7 +10653,8 @@ function runFailed(result) {
 }
 function requestsInOrder(tree, folderId) {
   const entered = /* @__PURE__ */ new Set();
-  const inOrder = (parent) => childrenInOrder(tree, parent).flatMap((child) => {
+  const childrenOf = childrenInOrder(tree);
+  const inOrder = (parent) => childrenOf(parent).flatMap((child) => {
     if (child.request) return [child.request];
     if (entered.has(child.folder.id)) return [];
     entered.add(child.folder.id);
@@ -10804,26 +10738,25 @@ var SECRET_PLACEHOLDER = /\{\{\s*\$secret\./;
 function containsSecretPlaceholder(request) {
   const wire = [
     request.url,
-    percentDecoded(request.url),
+    formDecoded(request.url),
     JSON.stringify(request.headers),
     ...request.headers.map(([, value]) => decodeBasicCredentials(value)),
     // An OAuth 2.0 token request names its client in Basic credentials that are form-encoded first (RFC 6749, 2.3.1).
-    ...request.headers.map(([, value]) => percentDecoded(decodeBasicCredentials(value))),
+    ...request.headers.map(([, value]) => formDecoded(decodeBasicCredentials(value))),
     ...bodyTexts(request.body)
   ];
   return wire.some((text3) => SECRET_PLACEHOLDER.test(text3));
 }
-function percentDecoded(text3) {
-  try {
-    return decodeURIComponent(text3);
-  } catch (error) {
-    if (!(error instanceof URIError)) throw error;
-    return "";
-  }
+function formDecoded(text3) {
+  return text3.replaceAll("+", " ").replace(
+    /(?:%[0-9a-f]{2})+/gi,
+    (run) => utf82.decode(Uint8Array.from(run.slice(1).split("%"), (hex2) => parseInt(hex2, 16)))
+  );
 }
+var utf82 = new TextDecoder();
 function bodyTexts(body3) {
   if (typeof body3 === "string") {
-    return [body3, percentDecoded(body3.replaceAll("+", " "))];
+    return [body3, formDecoded(body3)];
   }
   if (body3 instanceof FormData) {
     return [...body3].flatMap(([name, value]) => [name, typeof value === "string" ? value : value.name]);
@@ -10841,6 +10774,32 @@ function decodeBasicCredentials(headerValue) {
   }
 }
 
+// ../core/src/scripting/request-view.ts
+function scriptRequestOf(content) {
+  const rows2 = (list4) => list4.filter((row) => row.enabled && row.key).map((row) => [row.key, row.value]);
+  const { body: body3 } = content;
+  const seen = body3.mode === "raw" ? { mode: "raw", raw: body3.raw?.text ?? "" } : body3.mode === "graphql" ? { mode: "raw", raw: graphqlText(body3.graphql?.query ?? "", body3.graphql?.variables ?? "") } : body3.mode === "urlencoded" ? { mode: "urlencoded", urlencoded: rows2(body3.urlencoded ?? []) } : { mode: body3.mode };
+  return { method: content.method, url: content.url, headers: rows2(content.headers), body: seen };
+}
+function withScriptRequest(content, request) {
+  const rows2 = (pairs2) => pairs2.map(([key, value]) => ({ key, value, enabled: true }));
+  const untouched = content.body.mode === "graphql" && request.body.mode === "raw" && request.body.raw === graphqlText(content.body.graphql?.query ?? "", content.body.graphql?.variables ?? "");
+  const body3 = untouched ? content.body : request.body.mode === "raw" ? {
+    ...content.body,
+    mode: "raw",
+    raw: {
+      language: content.body.mode === "graphql" ? "json" : content.body.raw?.language ?? "text",
+      text: request.body.raw
+    }
+  } : request.body.mode === "urlencoded" ? { ...content.body, mode: "urlencoded", urlencoded: rows2(request.body.urlencoded) } : content.body;
+  return { ...content, method: request.method, url: request.url, headers: rows2(request.headers), body: body3 };
+}
+function sentScriptRequest(content, sent) {
+  const { mode } = content.body;
+  const body3 = mode === "multipart" || mode === "binary" ? { mode } : sent.body === void 0 ? { mode: "none" } : mode === "urlencoded" ? { mode, urlencoded: [...new URLSearchParams(sent.body)] } : { mode: "raw", raw: sent.body };
+  return { method: sent.method, url: sent.url, headers: sent.headers, body: body3 };
+}
+
 // ../core/src/send/assertions.ts
 function runAssertions(assertions, response) {
   return assertions.map((assertion) => evaluate2(assertion, response));
@@ -11017,7 +10976,7 @@ function sentBodyPreview(body3) {
   return `@file ${file(body3)}`;
 }
 function scriptResponse(response) {
-  const body3 = bodyText(response.body);
+  const body3 = response.text ?? bodyText(response.body);
   return {
     code: response.statusCode,
     status: response.statusText,
@@ -11097,6 +11056,7 @@ async function exchange(spec, ports) {
         scriptExtras(ports, spec, "prerequest", scriptRequestOf(template))
       );
       timings.preScriptMs += Math.round(performance.now() - scriptStarted);
+      stopped(spec);
       preRuns.push({ name, result });
       const { changes } = result;
       restoreSecrets.push(await applyChanges(ports, spec, changes, notes));
@@ -11121,6 +11081,7 @@ async function exchange(spec, ports) {
       );
     }
   }
+  stopped(spec);
   let request;
   try {
     const built2 = spec.buildRequest(template);
@@ -11154,6 +11115,7 @@ async function exchange(spec, ports) {
   };
   const transmit = async () => {
     startedAt = performance.now();
+    delete policy.startedAt;
     sentCookies = void 0;
     try {
       return await ports.transport.send(
@@ -11189,7 +11151,7 @@ async function exchange(spec, ports) {
       outcome = await transmit();
     }
   }
-  const durationMs = Math.round(performance.now() - startedAt);
+  const durationMs = Math.round(performance.now() - (policy.startedAt ?? startedAt));
   timings.requestMs = durationMs;
   ports.watch?.received(request.url);
   const shaped = outcome instanceof TransportError ? shapeFailure(outcome, ports.page, ports.online?.()) : shapeResponse(outcome, ports.page);
@@ -11214,6 +11176,7 @@ async function exchange(spec, ports) {
       statusCode: shaped.response.statusCode ?? 0,
       statusText: shaped.response.statusText ?? "",
       body: shaped.body,
+      ...shaped.text !== void 0 && { text: shaped.text },
       headers: shaped.headers,
       durationMs,
       sizeBytes: outcome instanceof TransportError ? void 0 : outcome.sizes.decoded
@@ -11284,6 +11247,9 @@ async function exchange(spec, ports) {
     ...nextRequest !== void 0 && { nextRequest }
   };
 }
+function stopped(spec) {
+  if (spec.signal?.aborted) throw new SendBlockedError("You stopped the request. Nothing was sent.");
+}
 function firstSentence(text3) {
   const match = /^.*?[.!?](?=\s|$)/s.exec(text3.trim());
   return (match ? match[0] : text3).trim();
@@ -11319,7 +11285,7 @@ function recordOf(history, raw) {
   };
 }
 function shapeResponse(envelope, page) {
-  const body3 = decodeEnvelope(envelope);
+  const { value: body3, text: sentText } = readEnvelope(envelope);
   const isError = envelope.status < 200 || envelope.status >= 300;
   const shown = body3;
   const bodyIsJson = isJsonPayload(shown);
@@ -11328,6 +11294,7 @@ function shapeResponse(envelope, page) {
   const contentLength = Number(header("content-length") || NaN);
   return {
     body: body3,
+    ...sentText !== void 0 && { text: sentText },
     headers: Object.fromEntries(envelope.headers),
     headerList: envelope.headers,
     bodyText: body3 === void 0 || body3 === null || body3 instanceof BinaryBody ? void 0 : text3,
@@ -11423,18 +11390,25 @@ async function sendForScript(ports, request, signal, route = ports.transport.rou
     );
   }
   const startedAt = performance.now();
+  const policy = { route };
   const envelope = await ports.transport.send(
     request,
-    { signal: signal ?? new AbortController().signal, timeoutMs: ports.timeoutMs() },
-    { route }
+    {
+      signal: signal ?? new AbortController().signal,
+      timeoutMs: ports.timeoutMs(),
+      // Followed on every route, as a browser follows it: the vault is not read for this request, so no secret is held to its host.
+      redirects: { follow: true, stayOnHost: false }
+    },
+    policy
   );
   const shaped = shapeResponse(envelope, ports.page);
   return scriptResponse({
     statusCode: envelope.status,
     statusText: envelope.statusText,
     body: shaped.body,
+    ...shaped.text !== void 0 && { text: shaped.text },
     headers: shaped.headers,
-    durationMs: Math.round(performance.now() - startedAt),
+    durationMs: Math.round(performance.now() - (policy.startedAt ?? startedAt)),
     sizeBytes: envelope.sizes.decoded
   });
 }
@@ -11521,6 +11495,88 @@ function stringifyPayload(payload) {
   return stringifyJson(payload, 4) ?? String(payload);
 }
 
+// ../core/src/auth/sigv4.ts
+var utf83 = (text3) => new TextEncoder().encode(text3);
+var sha2562 = async (data) => new Uint8Array(await crypto.subtle.digest("SHA-256", data));
+var hmac2 = async (key, data) => new Uint8Array(
+  await crypto.subtle.sign(
+    "HMAC",
+    await crypto.subtle.importKey("raw", key, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]),
+    utf83(data)
+  )
+);
+var hex = (bytes) => Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+var encode = (text3) => encodeURIComponent(text3).replace(/[!'()*]/g, (mark) => `%${mark.charCodeAt(0).toString(16).toUpperCase()}`);
+var decode = (text3) => {
+  try {
+    return decodeURIComponent(text3);
+  } catch (error) {
+    if (!(error instanceof URIError)) throw error;
+    return text3;
+  }
+};
+async function signV4(request, credentials, at) {
+  const url = new URL(request.url);
+  const s3 = credentials.service === "s3";
+  const segments = url.pathname.split("/");
+  const kept = segments.filter(Boolean);
+  const path = s3 ? segments.map((segment) => encode(decode(segment))).join("/") : `/${kept.map(encode).join("/")}${kept.length && url.pathname.endsWith("/") ? "/" : ""}`;
+  const query = url.search.slice(1).split("&").filter(Boolean).map((pair) => {
+    const cut = pair.indexOf("=");
+    return [
+      encode(decode(cut === -1 ? pair : pair.slice(0, cut))),
+      encode(decode(cut === -1 ? "" : pair.slice(cut + 1)))
+    ];
+  }).sort(
+    ([keyA, valueA], [keyB, valueB]) => keyA === keyB ? valueA < valueB ? -1 : valueA > valueB ? 1 : 0 : keyA < keyB ? -1 : 1
+  ).map(([key2, value]) => `${key2}=${value}`).join("&");
+  const date = at.toISOString().replace(/[-:]|\.\d{3}/g, "");
+  const day = date.slice(0, 8);
+  const body3 = typeof request.body === "string" ? utf83(request.body) : new Uint8Array(request.body ?? []);
+  const bodyHash = hex(await sha2562(body3));
+  const added2 = [
+    ["X-Amz-Date", date],
+    ...credentials.sessionToken ? [["X-Amz-Security-Token", credentials.sessionToken]] : [],
+    ...s3 ? [["X-Amz-Content-Sha256", bodyHash]] : []
+  ];
+  const byName = /* @__PURE__ */ new Map();
+  const own3 = request.headers.filter(
+    ([name]) => !added2.some(([written]) => written.toLowerCase() === name.toLowerCase()) && name.toLowerCase() !== "host"
+  );
+  for (const [name, value] of [["Host", url.host], ...own3, ...added2]) {
+    const key2 = name.toLowerCase();
+    byName.set(key2, [...byName.get(key2) ?? [], value.trim().replace(/\s+/g, " ")]);
+  }
+  const names = [...byName.keys()].sort();
+  const signedHeaders = names.join(";");
+  const canonicalRequest = [
+    request.method,
+    path,
+    query,
+    ...names.map((name) => `${name}:${(byName.get(name) ?? []).join(",")}`),
+    "",
+    signedHeaders,
+    bodyHash
+  ].join("\n");
+  const scope = `${day}/${credentials.region}/${credentials.service}/aws4_request`;
+  const stringToSign = ["AWS4-HMAC-SHA256", date, scope, hex(await sha2562(utf83(canonicalRequest)))].join("\n");
+  let key = utf83(`AWS4${credentials.secretKey}`);
+  for (const part of [day, credentials.region, credentials.service, "aws4_request"]) key = await hmac2(key, part);
+  const signature = hex(await hmac2(key, stringToSign));
+  return {
+    headers: [
+      ...added2,
+      [
+        "Authorization",
+        `AWS4-HMAC-SHA256 Credential=${credentials.accessKey}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`
+      ]
+    ],
+    canonicalRequest,
+    stringToSign,
+    signature
+  };
+}
+
 // ../core/src/send/build.ts
 var UnresolvedVariablesError = class extends SendBlockedError {
   constructor(names) {
@@ -11544,6 +11600,14 @@ function normalizeUrl(text3) {
   const address2 = text3.replace(/[\t\n\r]/g, encodeURIComponent);
   return hasExplicitScheme(address2) ? address2 : `https://${address2}`;
 }
+function validateUrl(text3) {
+  if (!text3) return false;
+  const parsed2 = URL.parse(normalizeUrl(text3));
+  if (!parsed2 || parsed2.protocol !== "http:" && parsed2.protocol !== "https:" || !parsed2.hostname) return false;
+  if (hasExplicitScheme(text3)) return true;
+  const { hostname } = parsed2;
+  return hostname === "localhost" || hostname.includes(".") || hostname.includes(":") || !!parsed2.port;
+}
 function appendQueryParam(url, key, value) {
   const parsed2 = URL.parse(normalizeUrl(url));
   if (!parsed2) {
@@ -11598,12 +11662,18 @@ function buildRequest(content, context) {
       if (resolver.unresolved.size && context.blockUnresolved) {
         throw new UnresolvedVariablesError([...resolver.unresolved]);
       }
+      if (!validateUrl(resolver.resolve(content.url.trim()))) {
+        throw new SendBlockedError(
+          "This is not an address a request can go to. Write it as https://host/path. Nothing was sent."
+        );
+      }
       return request;
     };
     return built2 instanceof Promise ? built2.then(check) : check(built2);
   };
-  if (!probe.lockedSecrets.size) return checked(new VariableResolver(scopes()));
-  const withSecrets = () => context.readSecrets([...probe.lockedSecrets]).then((secrets) => checked(new VariableResolver(scopes(), (id) => secrets.get(id))));
+  const oauth = sentAuth(content.auth, context.ancestors).type === "oauth2";
+  if (!probe.lockedSecrets.size && !oauth) return checked(new VariableResolver(scopes()));
+  const withSecrets = () => probe.lockedSecrets.size ? context.readSecrets([...probe.lockedSecrets]).then((secrets) => checked(new VariableResolver(scopes(), (id) => secrets.get(id)))) : checked(new VariableResolver(scopes()));
   const from = composed && hostOf(composed.url, composed.scopes);
   const to = hostOf(endpointText, scopes());
   if (from === void 0 || from === to || composed?.accepted?.has(to)) return withSecrets();
@@ -12105,6 +12175,7 @@ var VALUE_OPTIONS = {
   "--data-raw": "data-raw",
   "--data-binary": "data-binary",
   "--data-urlencode": "data-urlencode",
+  "--json": "json",
   "-F": "form",
   "--form": "form",
   "--form-string": "form-string",
@@ -12210,7 +12281,16 @@ var SKIPPED_VALUE_OPTIONS = /* @__PURE__ */ new Set([
   "--trace-ascii",
   "--stderr",
   "--proto",
-  "--proto-default"
+  "--proto-default",
+  "--url-query",
+  "--proxy-header",
+  "--socks5",
+  "--socks5-hostname",
+  "--preproxy",
+  "--request-target",
+  "--doh-url",
+  "--output-dir",
+  "--netrc-file"
 ]);
 var formEncode = (text3) => new URLSearchParams([[text3, ""]]).toString().slice(0, -1);
 var contentType = (headers2) => headers2.filter(([name]) => name.toLowerCase() === "content-type").at(-1)?.[1];
@@ -12252,7 +12332,7 @@ function parseCurl(text3) {
   const urls = [];
   let method;
   let basic;
-  let [get, head, binaryOnly] = [false, false, true];
+  let [get, head, binaryOnly, json] = [false, false, true, false];
   const take = (kind, value) => {
     switch (kind) {
       case "method":
@@ -12267,7 +12347,9 @@ function parseCurl(text3) {
       }
       case "data":
       case "data-binary":
-        if (kind === "data") binaryOnly = false;
+      case "json":
+        if (kind === "json") json = true;
+        if (kind !== "data-binary") binaryOnly = false;
         data.push(value.startsWith("@") ? { file: value.slice(1) } : { text: value });
         break;
       case "data-raw":
@@ -12346,6 +12428,11 @@ function parseCurl(text3) {
       `The command names ${urls.length} addresses. The first is used; the others were left out: ${urls.slice(1).join(", ")}.`
     );
   let url = urls[0];
+  if (json) {
+    for (const name of ["Content-Type", "Accept"])
+      if (!headers2.some(([named2]) => named2.toLowerCase() === name.toLowerCase()))
+        headers2.push([name, "application/json"]);
+  }
   const type = (contentType(headers2) ?? "").toLowerCase();
   let body3 = { mode: "none" };
   const files = data.flatMap((datum) => "file" in datum ? [datum.file] : []);
@@ -12362,7 +12449,9 @@ function parseCurl(text3) {
   } else if (data.length) {
     if (files.length) warnings.push(`The data of the file ${files.join(", ")} was left out: the file was not read.`);
     const wire = data.flatMap((datum) => "text" in datum ? [datum.text] : []).join("&");
-    body3 = !type || type.startsWith("application/x-www-form-urlencoded") ? { mode: "urlencoded", fields: [...new URLSearchParams(wire)] } : { mode: "raw", text: wire };
+    const pairs2 = wire.split("&").every((piece) => /^[\w.~%+\-[\]]*(=|$)/.test(piece));
+    if (!type && !pairs2) headers2.push(["Content-Type", "application/x-www-form-urlencoded"]);
+    body3 = !type && pairs2 || type.startsWith("application/x-www-form-urlencoded") ? { mode: "urlencoded", fields: [...new URLSearchParams(wire)] } : { mode: "raw", text: wire };
   }
   method ??= head ? "HEAD" : body3.mode === "none" ? "GET" : "POST";
   if (!isHttpMethod(method))
@@ -13197,7 +13286,9 @@ function format4(value) {
   const children = /* @__PURE__ */ new Map();
   for (const resource of resources) {
     const parent = text2(field3(resource, "parentId"));
-    children.set(parent, [...children.get(parent) ?? [], resource]);
+    const siblings = children.get(parent);
+    if (siblings) siblings.push(resource);
+    else children.set(parent, [resource]);
   }
   for (const list4 of children.values()) list4.sort((a, b) => sortKey(a) - sortKey(b));
   const under = (parent, type) => parent === "" ? [] : (children.get(parent) ?? []).filter((resource) => kind(resource) === type);
@@ -13667,13 +13758,17 @@ var NOT_READABLE = "The file is neither JSON nor YAML that can be read, so it is
 function parseYaml(text3) {
   if (text3.length > MAX_YAML_CHARS) throw new ImportError(YAML_TOO_LARGE);
   try {
-    return (0, import_yaml.parse)(text3, {
-      maxAliasCount: MAX_YAML_ALIASES,
-      schema: "core",
-      logLevel: "error",
-      uniqueKeys: false,
-      prettyErrors: false
-    });
+    return JSON.parse(
+      JSON.stringify(
+        (0, import_yaml.parse)(text3, {
+          maxAliasCount: MAX_YAML_ALIASES,
+          schema: "core",
+          logLevel: "error",
+          uniqueKeys: false,
+          prettyErrors: false
+        })
+      )
+    );
   } catch (error) {
     throw new ImportError(error instanceof Error && /alias count/i.test(error.message) ? YAML_ALIASES : NOT_READABLE);
   }
@@ -13782,7 +13877,13 @@ function added(payload) {
   return { payload: checked, plan };
 }
 function importText(text3, options = {}) {
-  const imported = readText(text3, options);
+  let imported;
+  try {
+    imported = readText(text3, options);
+  } catch (error) {
+    if (error instanceof RangeError) throw new ImportError("The file is nested too deeply to read.");
+    throw error;
+  }
   return {
     ...imported,
     report: {
@@ -14053,7 +14154,7 @@ function runReportHtml(report, info) {
 :root { color-scheme: light dark; ${palette(REPORT_COLOURS.light)} }
 @media (prefers-color-scheme: dark) { :root { ${palette(REPORT_COLOURS.dark)} } }
 body { margin: 0; padding: 24px 16px; background: var(--canvas); color: var(--primary);
-  font: 14px/1.5 "Atkinson Hyperlegible Next", system-ui, sans-serif; }
+  font: 14px/1.5 Figtree, system-ui, sans-serif; }
 main { max-width: 1100px; margin: 0 auto; }
 h1 { margin: 0 0 4px; font-size: 1.375rem; font-weight: 600; }
 .meta, .counts { margin: 0 0 16px; color: var(--secondary); }
@@ -14262,6 +14363,8 @@ Options:
   -e, --environment <file>  The variables: a Wayfarer environments file or a
                             Postman environment. A workspace backup brings
                             its active environment unless one is given.
+      --environment-name <name>
+                            Which environment of a file that holds several.
   -d, --data <file>         A data file, CSV or JSON: one iteration per row.
   -n, --iterations <n>      How many iterations (default: one per row of the
                             data file, or 1).
@@ -14272,8 +14375,9 @@ Options:
                             in --out.
       --out <dir>           Where the reports are written (default: here).
       --bail                Stop at the first failure.
-      --timeout <ms>        Give up on a request after this long (default: no
-                            limit).
+      --timeout <ms>        Give up on a request after this long, at most
+                            300000 (default 300000: Node's fetch waits no
+                            longer for a response).
       --insecure            Do not verify servers' TLS certificates.
       --allow-scripts       Run the file's scripts. A file's scripts are not
                             reviewed, so a collection that has any is not run
@@ -14284,8 +14388,10 @@ Options:
   -v, --version
   -h, --help
 
-Exit codes: 0 every request answered and every test passed; 1 a test failed
-or a request got no response; 2 nothing was run (see the message).`;
+Exit codes: 0 every request answered and every test passed; 1 a test failed,
+a request got no response, or a report could not be written; 2 nothing was
+run (see the message).`;
+var NODE_FETCH_TIMEOUT_MS = 3e5;
 var Refusal = class extends Error {
 };
 async function readText2(file, what) {
@@ -14297,7 +14403,7 @@ async function readText2(file, what) {
     );
   }
 }
-function pick(list4, name, what, file) {
+function pick(list4, name, what, flag2, file) {
   if (name !== void 0) {
     const found = list4.find((entry) => entry.name === name);
     if (!found)
@@ -14308,7 +14414,7 @@ function pick(list4, name, what, file) {
   }
   if (list4.length > 1)
     throw new Refusal(
-      `${file} holds ${list4.length} ${what}s: name one with --${what} (${list4.map((entry) => `"${entry.name}"`).join(", ")}).`
+      `${file} holds ${list4.length} ${what}s: name one with --${flag2} (${list4.map((entry) => `"${entry.name}"`).join(", ")}).`
     );
   const [only] = list4;
   if (!only) throw new Refusal(`${file} holds no ${what}.`);
@@ -14334,6 +14440,7 @@ async function readSource(file, collection) {
           collections.map(({ payload }) => ({ name: payload.collection.name, payload })),
           collection,
           "collection",
+          "collection",
           file
         ).payload,
         globals: []
@@ -14348,7 +14455,7 @@ async function readSource(file, collection) {
     throw new Refusal(`${file} is not a workspace backup this version reads:
   ${errors.join("\n  ")}`);
   const { stores } = parsed2.ok ? parsed2.value : {};
-  const chosen = pick(stores.collections, collection, "collection", file);
+  const chosen = pick(stores.collections, collection, "collection", "collection", file);
   const source = {
     $id: "wayfarer/collection",
     meta: chosen.meta,
@@ -14370,11 +14477,11 @@ async function readSource(file, collection) {
     }
   };
 }
-async function readEnvironment(file) {
+async function readEnvironment(file, name) {
   try {
     const { environments } = importText(await readText2(file, "environment"));
-    const { name, vars } = pick(environments, void 0, "environment", file);
-    return { name, vars };
+    const chosen = pick(environments, name, "environment", "environment-name", file);
+    return { name: chosen.name, vars: chosen.vars };
   } catch (error) {
     if (error instanceof Error && error.name === "ImportError") throw new Refusal(`${file}: ${error.message}`);
     throw error;
@@ -14420,6 +14527,7 @@ async function main(argv) {
     allowPositionals: true,
     options: {
       environment: { type: "string", short: "e" },
+      "environment-name": { type: "string" },
       data: { type: "string", short: "d" },
       iterations: { type: "string", short: "n" },
       collection: { type: "string" },
@@ -14435,7 +14543,7 @@ async function main(argv) {
     }
   });
   if (values.version) {
-    console.log("2.1.0");
+    console.log("2.2.0");
     return 0;
   }
   const [command, file, ...rest] = positionals;
@@ -14459,6 +14567,8 @@ ${USAGE}`);
   const iterations = number(values.iterations, "iterations");
   if (iterations === 0) throw new Refusal("--iterations takes 1 or more.");
   const timeoutMs = number(values.timeout, "timeout") ?? 0;
+  if (timeoutMs > NODE_FETCH_TIMEOUT_MS)
+    throw new Refusal(`--timeout takes at most ${NODE_FETCH_TIMEOUT_MS}: Node's fetch waits no longer for a response.`);
   const read = await readSource(file, values.collection);
   const holders = scriptHolders(read.source);
   if (holders.length && !values["allow-scripts"]) {
@@ -14466,7 +14576,9 @@ ${USAGE}`);
       `This collection has scripts, in ${holders.join(", ")}. A file's scripts have not been reviewed: read them, and run again with --allow-scripts only if you trust them. Nothing was sent.`
     );
   }
-  const environment2 = values.environment === void 0 ? read.environment : await readEnvironment(values.environment);
+  if (values["environment-name"] !== void 0 && values.environment === void 0)
+    throw new Refusal("--environment-name names an environment of the file given with --environment.");
+  const environment2 = values.environment === void 0 ? read.environment : await readEnvironment(values.environment, values["environment-name"]);
   const vault = values["vault-file"] === void 0 ? read.vault : await readVaultFile(values["vault-file"]);
   let data;
   if (values.data !== void 0) {
@@ -14507,12 +14619,21 @@ ${USAGE}`);
   const info = { name: read.source.collection.name, startedAt };
   if (reporters.has("cli")) console.log(`
 ${summary(report)}`);
-  if (reporters.has("json"))
-    await writeFile(join(values.out, "wayfarer-run.json"), `${JSON.stringify(runReportJson(report, info), null, 2)}
-`);
-  if (reporters.has("junit")) await writeFile(join(values.out, "wayfarer-run.junit.xml"), junitXml(report, info));
-  if (reporters.has("html")) await writeFile(join(values.out, "wayfarer-run.html"), runReportHtml(report, info));
-  return report.results.some(runFailed) ? 1 : 0;
+  const code = report.results.some(runFailed) ? 1 : 0;
+  try {
+    if (reporters.has("json"))
+      await writeFile(
+        join(values.out, "wayfarer-run.json"),
+        `${JSON.stringify(runReportJson(report, info), null, 2)}
+`
+      );
+    if (reporters.has("junit")) await writeFile(join(values.out, "wayfarer-run.junit.xml"), junitXml(report, info));
+    if (reporters.has("html")) await writeFile(join(values.out, "wayfarer-run.html"), runReportHtml(report, info));
+  } catch (error) {
+    console.error(`--out ${values.out}: ${error instanceof Error ? error.message : String(error)}`);
+    return 1;
+  }
+  return code;
 }
 main(process.argv.slice(2)).then(
   (code) => process.exitCode = code,