Read OAuth 2.0 token responses from the send instead of the filesystem

Both token requests opened HttpResponse.bodyPath with readFileSync, which ties the plugin to bodies living on a filesystem. The send now hands the body back, so they read it from there and keep working once bodies move into the blob DB and in the browser Worker, where there is no fs to read. text() on a response with no body returns "", which is what the bodyPath check produced, so an empty response still parses to {} rather than throwing.
Hand the body back from send instead of holding it for a lookup
2026-08-24 04:13:59 +02:00 · 2026-08-16 10:09:43 -07:00 · 2026-08-16 10:07:44 -07:00 · 2026-08-16 10:00:35 -07:00 · 2026-08-16 09:54:56 -07:00 · 2026-08-16 09:35:03 -07:00
167 changed files with 8845 additions and 6185 deletions
@@ -2,6 +2,18 @@
 # It is not intended for manual editing.
 version = 4

+[[package]]
+name = "accessory"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc86a613208ca7d144ca24f6ec49c5cdfa5c05a46f2f7ab5880ff99371f165de"
+dependencies = [
+ "macroific 3.0.1",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
 [[package]]
 name = "adler2"
 version = "2.0.0"
@@ -40,18 +52,6 @@ dependencies = [
 "version_check",
 ]

-[[package]]
-name = "ahash"
-version = "0.8.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
-dependencies = [
- "cfg-if",
- "once_cell",
- "version_check",
- "zerocopy",
-]
-
 [[package]]
 name = "aho-corasick"
 version = "0.6.10"
@@ -613,15 +613,11 @@ checksum = "edca88bc138befd0323b20752846e6587272d3b03b0343c8ea28a6f819e6e71f"
 dependencies = [
 "async-trait",
 "axum-core",
- "axum-macros",
- "base64 0.22.1",
 "bytes",
 "futures-util",
 "http",
 "http-body",
 "http-body-util",
- "hyper",
- "hyper-util",
 "itoa",
 "matchit",
 "memchr",
@@ -630,17 +626,10 @@ dependencies = [
 "pin-project-lite",
 "rustversion",
 "serde",
- "serde_json",
- "serde_path_to_error",
- "serde_urlencoded",
- "sha1",
 "sync_wrapper",
- "tokio",
- "tokio-tungstenite 0.24.0",
 "tower 0.5.2",
 "tower-layer",
 "tower-service",
- "tracing",
 ]

 [[package]]
@@ -661,18 +650,6 @@ dependencies = [
 "sync_wrapper",
 "tower-layer",
 "tower-service",
- "tracing",
-]
-
-[[package]]
-name = "axum-macros"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57d123550fa8d071b7255cb0cc04dc302baa6c8c4a79f55701552684d8399bce"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.101",
 ]

 [[package]]
@@ -1089,10 +1066,11 @@ dependencies = [

 [[package]]
 name = "cc"
-version = "1.2.26"
+version = "1.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "956a5e21988b87f372569b66183b78babf23ebc2e744b733e4350a752c4dafac"
+checksum = "509591b7bcd67f4ef775afad7662703b4935daaa6ec0e5605cfb1090b32a2b6d"
 dependencies = [
+ "find-msvc-tools",
 "jobserver",
 "libc",
 "shlex",
@@ -1409,6 +1387,16 @@ dependencies = [
 "windows-sys 0.61.2",
 ]

+[[package]]
+name = "console_error_panic_hook"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a06aeb73f470f66dcdbf7223caeebb85984942f22f1adb2a088cf9668146bbbc"
+dependencies = [
+ "cfg-if",
+ "wasm-bindgen",
+]
+
 [[package]]
 name = "const-random"
 version = "0.1.18"
@@ -1893,6 +1881,20 @@ version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "da692b8d1080ea3045efaab14434d40468c3d8657e42abddfffca87b428f4c1b"

+[[package]]
+name = "delegate-display"
+version = "3.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "54e3a499943fd5180aeffcb708164ffb22125ceeccb05491b5297981d37d6249"
+dependencies = [
+ "impartial-ord",
+ "itoa",
+ "macroific 3.0.1",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
 [[package]]
 name = "deranged"
 version = "0.5.5"
@@ -2384,6 +2386,18 @@ dependencies = [
 "regex-syntax 0.8.5",
 ]

+[[package]]
+name = "fancy_constructor"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4a8211ab12c36b63c269e17873331dc1da196a3edb7a5c79015677ef972da34a"
+dependencies = [
+ "macroific 3.0.1",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
 [[package]]
 name = "fast-glob"
 version = "1.0.0"
@@ -2440,6 +2454,12 @@ dependencies = [
 "windows-sys 0.59.0",
 ]

+[[package]]
+name = "find-msvc-tools"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d45db016d36b838f563236e9193d0ee6ce38f3f68b6c94e914b4929c96bbb890"
+
 [[package]]
 name = "fixedbitset"
 version = "0.4.2"
@@ -2872,8 +2892,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "335ff9f135e4384c8150d6f27c6daed433577f86b4750418338c01a1a2528592"
 dependencies = [
 "cfg-if",
+ "js-sys",
 "libc",
 "wasi 0.11.0+wasi-snapshot-preview1",
+ "wasm-bindgen",
 ]

 [[package]]
@@ -3114,7 +3136,7 @@ version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
 dependencies = [
- "ahash 0.7.8",
+ "ahash",
 ]

 [[package]]
@@ -3122,9 +3144,6 @@ name = "hashbrown"
 version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
-dependencies = [
- "ahash 0.8.12",
-]

 [[package]]
 name = "hashbrown"
@@ -3154,11 +3173,11 @@ checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"

 [[package]]
 name = "hashlink"
-version = "0.9.1"
+version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ba4ff7128dee98c7dc9794b6a411377e1404dba1c97deb8d1a55297bd25d8af"
+checksum = "824e001ac4f3012dd16a264bec811403a67ca9deb6c102fc5049b32c4574b35f"
 dependencies = [
- "hashbrown 0.14.5",
+ "hashbrown 0.16.1",
 ]

 [[package]]
@@ -3256,12 +3275,6 @@ version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "21dec9db110f5f872ed9699c3ecf50cf16f423502706ba5c72462e28d3157573"

-[[package]]
-name = "http-range-header"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9171a2ea8a68358193d15dd5d70c1c10a2afc3e7e4c5bc92bc9f025cebd7359c"
-
 [[package]]
 name = "httparse"
 version = "1.10.1"
@@ -3526,6 +3539,17 @@ dependencies = [
 "tiff",
 ]

+[[package]]
+name = "impartial-ord"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc680e03d1a08bdc1c01b60e0c39723430ced63d8cabd93cee0449b6ba916a25"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
 [[package]]
 name = "include_dir"
 version = "0.7.4"
@@ -3545,6 +3569,40 @@ dependencies = [
 "quote",
 ]

+[[package]]
+name = "indexed_db_futures"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69ff41758cbd104e91033bb53bc449bec7eea65652960c81eddf3fc146ecea19"
+dependencies = [
+ "accessory",
+ "cfg-if",
+ "delegate-display",
+ "derive_more 2.1.1",
+ "fancy_constructor",
+ "indexed_db_futures_macros_internal",
+ "js-sys",
+ "sealed 0.6.0",
+ "smallvec",
+ "thiserror 2.0.17",
+ "tokio",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
+[[package]]
+name = "indexed_db_futures_macros_internal"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "caeba94923b68f254abef921cea7e7698bf4675fdd89d7c58bf1ed885b49a27d"
+dependencies = [
+ "macroific 2.0.0",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.101",
+]
+
 [[package]]
 name = "indexmap"
 version = "1.9.3"
@@ -3590,17 +3648,6 @@ dependencies = [
 "cfb",
 ]

-[[package]]
-name = "inherent"
-version = "1.0.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c38228f24186d9cc68c729accb4d413be9eaed6ad07ff79e0270d9e56f3de13"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.101",
-]
-
 [[package]]
 name = "inotify"
 version = "0.11.0"
@@ -4036,9 +4083,9 @@ dependencies = [

 [[package]]
 name = "libsqlite3-sys"
-version = "0.30.1"
+version = "0.36.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e99fb7a497b1e3339bc746195567ed8d3e24945ecd636e3619d20b9de9e9149"
+checksum = "95b4103cffefa72eb8428cb6b47d6627161e51c2739fc5e3b734584157bc642a"
 dependencies = [
 "cc",
 "pkg-config",
@@ -4138,6 +4185,102 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c41e0c4fef86961ac6d6f8a82609f55f31b05e4fce149ac5710e439df7619ba4"

+[[package]]
+name = "macroific"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89f276537b4b8f981bf1c13d79470980f71134b7bdcc5e6e911e910e556b0285"
+dependencies = [
+ "macroific_attr_parse 2.0.0",
+ "macroific_core 2.0.0",
+ "macroific_macro 2.0.0",
+]
+
+[[package]]
+name = "macroific"
+version = "3.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c437abb3bf40939b00d1dff858ed2050d948bc230dee39546ed16795fcf10ec2"
+dependencies = [
+ "macroific_attr_parse 3.0.1",
+ "macroific_core 3.0.1",
+ "macroific_macro 3.0.1",
+]
+
+[[package]]
+name = "macroific_attr_parse"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ad4023761b45fcd36abed8fb7ae6a80456b0a38102d55e89a57d9a594a236be9"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "sealed 0.6.0",
+ "syn 2.0.101",
+]
+
+[[package]]
+name = "macroific_attr_parse"
+version = "3.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aeb7a82ec1aa16094da719be18615d79cb2574b037358e4e6c6d96eedcff3a93"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "sealed 0.7.0",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "macroific_core"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0a7594d3c14916fa55bef7e9d18c5daa9ed410dd37504251e4b75bbdeec33e3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "sealed 0.6.0",
+ "syn 2.0.101",
+]
+
+[[package]]
+name = "macroific_core"
+version = "3.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26c8e789484d2fa216eee9d5e0565ba80ccda389bcf0e111143a7b8f4792336e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "sealed 0.7.0",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "macroific_macro"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4da6f2ed796261b0a74e2b52b42c693bb6dee1effba3a482c49592659f824b3b"
+dependencies = [
+ "macroific_attr_parse 2.0.0",
+ "macroific_core 2.0.0",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.101",
+]
+
+[[package]]
+name = "macroific_macro"
+version = "3.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e30d63cb102648965753f0d47a6ab171b1cbb1fb5c363f4784ea986782fc7b77"
+dependencies = [
+ "macroific_attr_parse 3.0.1",
+ "macroific_core 3.0.1",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
 [[package]]
 name = "malloc_buf"
 version = "0.0.6"
@@ -6271,9 +6414,9 @@ dependencies = [

 [[package]]
 name = "r2d2_sqlite"
-version = "0.25.0"
+version = "0.32.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb14dba8247a6a15b7fdbc7d389e2e6f03ee9f184f87117706d509c092dfe846"
+checksum = "a2ebd03c29250cdf191da93a35118b4567c2ef0eacab54f65e058d6f4c9965f6"
 dependencies = [
 "r2d2",
 "rusqlite",
@@ -7159,10 +7302,20 @@ dependencies = [
 ]

 [[package]]
-name = "rusqlite"
-version = "0.32.1"
+name = "rsqlite-vfs"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7753b721174eb8ff87a9a0e799e2d7bc3749323e773db92e0984debb00019d6e"
+checksum = "c51c9ae4df8a7fba42103df5c621fa3c37eccf3a3c650879e90fc48b11cc192c"
+dependencies = [
+ "hashbrown 0.16.1",
+ "thiserror 2.0.17",
+]
+
+[[package]]
+name = "rusqlite"
+version = "0.38.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1c93dd1c9683b438c392c492109cb702b8090b2bfc8fed6f6e4eb4523f17af3"
 dependencies = [
 "bitflags 2.11.0",
 "chrono",
@@ -7171,6 +7324,7 @@ dependencies = [
 "hashlink",
 "libsqlite3-sys",
 "smallvec",
+ "sqlite-wasm-rs",
 ]

 [[package]]
@@ -7452,20 +7606,20 @@ checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"

 [[package]]
 name = "sea-query"
-version = "0.32.6"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "64c91783d1514b99754fc6a4079081dcc2c587dadbff65c48c7f62297443536a"
+checksum = "546040c653a705e60ec65ecd3191a809603734bebbc225775916dea9ae409b31"
 dependencies = [
 "chrono",
- "inherent",
+ "itoa",
 "sea-query-derive",
 ]

 [[package]]
 name = "sea-query-derive"
-version = "0.4.3"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bae0cbad6ab996955664982739354128c58d16e126114fe88c2a493642502aab"
+checksum = "a0b0f466921cdd3cf4b89d5c3ac2173dba89a873ab395b123a645de181ec7537"
 dependencies = [
 "darling 0.20.11",
 "heck 0.4.1",
@@ -7477,9 +7631,9 @@ dependencies = [

 [[package]]
 name = "sea-query-rusqlite"
-version = "0.7.0"
+version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3743bbdfb24b1a84cc1a6fbf4b1188e6851f6e00ea20944b44c56bf03a585bb4"
+checksum = "1ec6038023c8517c623e5bf9606b3c54d40bc8296bb6b2986040428dd84deddd"
 dependencies = [
 "rusqlite",
 "sea-query",
@@ -7491,6 +7645,28 @@ version = "4.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1c107b6f4780854c8b126e228ea8869f4d7b71260f962fefb57b996b8959ba6b"

+[[package]]
+name = "sealed"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22f968c5ea23d555e670b449c1c5e7b2fc399fdaec1d304a17cd48e288abc107"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.101",
+]
+
+[[package]]
+name = "sealed"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b68e2ea526d9fb32f23ca8894fb5da9e743f34c2f41701f0501dc8a25c4b343"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
 [[package]]
 name = "security-framework"
 version = "2.11.1"
@@ -7890,9 +8066,9 @@ dependencies = [

 [[package]]
 name = "shlex"
-version = "1.3.0"
+version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"

 [[package]]
 name = "signal-hook"
@@ -8060,6 +8236,34 @@ dependencies = [
 "system-deps",
 ]

+[[package]]
+name = "sqlite-wasm-rs"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc3efc0da82635d7e1ced0053bbbfa8c7ab9645d0bf36ceb4f7127bb85315d75"
+dependencies = [
+ "cc",
+ "js-sys",
+ "rsqlite-vfs",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "sqlite-wasm-vfs"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f7a5c9ac229421d577bb5a9bb59048838509958b218dd4e0b3c1214a87c361e"
+dependencies = [
+ "indexed_db_futures",
+ "js-sys",
+ "rsqlite-vfs",
+ "thiserror 2.0.17",
+ "tokio",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
 [[package]]
 name = "stable_deref_trait"
 version = "1.2.0"
@@ -8194,6 +8398,17 @@ dependencies = [
 "unicode-ident",
 ]

+[[package]]
+name = "syn"
+version = "3.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
 [[package]]
 name = "sync_wrapper"
 version = "1.0.2"
@@ -9109,18 +9324,6 @@ dependencies = [
 "tokio",
 ]

-[[package]]
-name = "tokio-tungstenite"
-version = "0.24.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "edc5f74e248dc973e0dbb7b74c7e0d6fcc301c694ff50049504004ef4d0cdcd9"
-dependencies = [
- "futures-util",
- "log 0.4.29",
- "tokio",
- "tungstenite 0.24.0",
-]
-
 [[package]]
 name = "tokio-tungstenite"
 version = "0.26.2"
@@ -9134,7 +9337,7 @@ dependencies = [
 "rustls-pki-types",
 "tokio",
 "tokio-rustls",
- "tungstenite 0.26.2",
+ "tungstenite",
 ]

 [[package]]
@@ -9328,7 +9531,6 @@ dependencies = [
 "tokio",
 "tower-layer",
 "tower-service",
- "tracing",
 ]

 [[package]]
@@ -9339,23 +9541,13 @@ checksum = "68d6fdd9f81c2819c9a8b0e0cd91660e7746a8e6ea2ba7c6b2b057985f6bcb51"
 dependencies = [
 "bitflags 2.11.0",
 "bytes",
- "futures-core",
 "futures-util",
 "http",
 "http-body",
- "http-body-util",
- "http-range-header",
- "httpdate",
- "mime",
- "mime_guess",
- "percent-encoding",
 "pin-project-lite",
- "tokio",
- "tokio-util",
 "tower 0.5.2",
 "tower-layer",
 "tower-service",
- "tracing",
 "url",
 ]

@@ -9377,7 +9569,6 @@ version = "0.1.41"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "784e0ac535deb450455cbfa28a6f0df145ea1bb7ae51b821cf5e7927fdcfbdd0"
 dependencies = [
- "log 0.4.29",
 "pin-project-lite",
 "tracing-attributes",
 "tracing-core",
@@ -9524,24 +9715,6 @@ dependencies = [
 "termcolor",
 ]

-[[package]]
-name = "tungstenite"
-version = "0.24.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18e5b8366ee7a95b16d32197d0b2604b43a0be89dc5fac9f8e96ccafbaedda8a"
-dependencies = [
- "byteorder",
- "bytes",
- "data-encoding",
- "http",
- "httparse",
- "log 0.4.29",
- "rand 0.8.5",
- "sha1",
- "thiserror 1.0.69",
- "utf-8",
-]
-
 [[package]]
 name = "tungstenite"
 version = "0.26.2"
@@ -11023,6 +11196,7 @@ name = "yaak"
 version = "0.1.0"
 dependencies = [
 "async-trait",
+ "base64 0.22.1",
 "log 0.4.29",
 "md5 0.8.0",
 "serde_json",
@@ -11087,13 +11261,14 @@ dependencies = [
 "thiserror 2.0.17",
 "tokio",
 "tokio-stream",
- "tokio-tungstenite 0.26.2",
+ "tokio-tungstenite",
 "tokio-util",
 "ts-rs",
 "url",
 "uuid",
 "yaak",
 "yaak-api",
+ "yaak-commands",
 "yaak-common",
 "yaak-core",
 "yaak-crypto",
@@ -11106,6 +11281,7 @@ dependencies = [
 "yaak-models",
 "yaak-plugins",
 "yaak-rpc",
+ "yaak-rpc-schema",
 "yaak-sse",
 "yaak-sync",
 "yaak-system-appearance",
@@ -11172,6 +11348,24 @@ dependencies = [
 "zip",
 ]

+[[package]]
+name = "yaak-commands"
+version = "0.0.0"
+dependencies = [
+ "log 0.4.29",
+ "serde_json",
+ "tempfile",
+ "thiserror 2.0.17",
+ "tokio",
+ "yaak",
+ "yaak-core",
+ "yaak-crypto",
+ "yaak-models",
+ "yaak-plugins",
+ "yaak-rpc-schema",
+ "yaak-templates",
+]
+
 [[package]]
 name = "yaak-common"
 version = "0.1.0"
@@ -11206,6 +11400,7 @@ name = "yaak-database"
 version = "0.1.0"
 dependencies = [
 "chrono",
+ "getrandom 0.2.16",
 "include_dir",
 "log 0.4.29",
 "nanoid",
@@ -11218,6 +11413,7 @@ dependencies = [
 "serde_json",
 "thiserror 2.0.17",
 "ts-rs",
+ "uuid",
 ]

 [[package]]
@@ -11388,7 +11584,7 @@ dependencies = [
 "sha2",
 "thiserror 2.0.17",
 "tokio",
- "tokio-tungstenite 0.26.2",
+ "tokio-tungstenite",
 "ts-rs",
 "yaak-common",
 "yaak-crypto",
@@ -11444,37 +11640,19 @@ dependencies = [
 ]

 [[package]]
-name = "yaak-server"
-version = "0.1.0"
+name = "yaak-rpc-schema"
+version = "0.0.0"
 dependencies = [
- "axum",
- "charset",
- "chrono",
- "clap",
- "dirs",
- "env_logger",
- "eventsource-client",
- "futures",
- "include_dir",
- "log 0.4.29",
- "mime_guess",
- "pretty_graphql",
- "rand 0.8.5",
 "serde",
- "serde_json",
- "serde_urlencoded",
- "tokio",
- "tower-http",
- "yaak",
- "yaak-common",
- "yaak-core",
- "yaak-crypto",
- "yaak-http",
+ "ts-rs",
+ "yaak-git",
+ "yaak-grpc",
 "yaak-models",
 "yaak-plugins",
- "yaak-rpc",
 "yaak-sse",
+ "yaak-sync",
 "yaak-templates",
+ "yaak-ws",
 ]

 [[package]]
@@ -11519,6 +11697,7 @@ version = "0.1.0"
 dependencies = [
 "regex 1.11.1",
 "tauri",
+ "yaak-core",
 ]

 [[package]]
@@ -11542,6 +11721,7 @@ version = "0.1.0"
 dependencies = [
 "log 0.4.29",
 "p12",
+ "pem",
 "rustls",
 "rustls-pemfile",
 "rustls-platform-verifier",
@@ -11552,6 +11732,23 @@ dependencies = [
 "yasna",
 ]

+[[package]]
+name = "yaak-web"
+version = "0.1.0"
+dependencies = [
+ "console_error_panic_hook",
+ "js-sys",
+ "log 0.4.29",
+ "serde",
+ "serde-wasm-bindgen",
+ "serde_json",
+ "sqlite-wasm-rs",
+ "sqlite-wasm-vfs",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "yaak-models",
+]
+
 [[package]]
 name = "yaak-window"
 version = "0.1.0"
@@ -11577,7 +11774,7 @@ dependencies = [
 "serde_json",
 "thiserror 2.0.17",
 "tokio",
- "tokio-tungstenite 0.26.2",
+ "tokio-tungstenite",
 "url",
 "yaak-http",
 "yaak-models",
@@ -2,9 +2,11 @@
 resolver = "2"
 members = [
  "crates/yaak",
+  "crates/yaak-commands",
  # Common/foundation crates
  "crates/common/yaak-database",
  "crates/common/yaak-rpc",
+  "crates/common/yaak-rpc-schema",
  # Shared crates (no Tauri dependency)
  "crates/yaak-core",
  "crates/yaak-common",
@@ -19,14 +21,13 @@ members = [
  "crates/yaak-templates",
  "crates/yaak-tls",
  "crates/yaak-ws",
+  "crates/yaak-web",
  "crates/yaak-api",
  "crates/yaak-proxy",
  # Proxy-specific crates
  "crates-proxy/yaak-proxy-lib",
  # CLI crates
  "crates-cli/yaak-cli",
-  # Headless server crates
-  "crates-server/yaak-server",
  # Tauri-specific crates
  "crates-tauri/yaak-app-client",
  "crates-tauri/yaak-app-proxy",
@@ -65,10 +66,12 @@ ts-rs = "11.1.0"
 # Internal crates - common/foundation
 yaak-database = { path = "crates/common/yaak-database" }
 yaak-rpc = { path = "crates/common/yaak-rpc" }
+yaak-rpc-schema = { path = "crates/common/yaak-rpc-schema" }

 # Internal crates - shared
 yaak-core = { path = "crates/yaak-core" }
 yaak = { path = "crates/yaak" }
+yaak-commands = { path = "crates/yaak-commands" }
 yaak-common = { path = "crates/yaak-common" }
 yaak-crypto = { path = "crates/yaak-crypto" }
 yaak-git = { path = "crates/yaak-git" }
@@ -44,6 +44,25 @@ After bootstrapping, start the app in development mode:
 npm start
 ```

+## Run the App in a Browser
+
+The client can also run as a plain web page, with no Tauri and no local process
+behind it. Set `YAAK_TARGET=web` and start the frontend on its own:
+
+```shell
+YAAK_TARGET=web npm run dev --workspace @yaakapp/yaak-client
+```
+
+That flag picks the browser host in `packages/platform/src/web/`, which answers
+commands from an IndexedDB database the page owns instead of from the Rust
+engine. Data persists across reloads and is shared between tabs on the same
+origin. Sending HTTP is not available yet — the Send button reports that and
+everything else about the request is still saved. `packages/platform/src/web/README.md`
+lists which commands the browser host implements and which it declines.
+
+Desktop builds are unaffected: without the flag the platform package installs
+the Tauri host exactly as before.
+
 ## SQLite Migrations

 New migrations can be created from the `src-tauri/` directory:
@@ -1,3 +1,4 @@
+import { platform } from "@yaakapp-internal/platform";
 import type { SettingsTab } from "../components/Settings/Settings";
 import { activeWorkspaceIdAtom } from "../hooks/useActiveWorkspace";
 import { createFastMutation } from "../hooks/useFastMutation";
@@ -14,11 +15,19 @@ export const openSettings = createFastMutation<void, string, SettingsTabWithSubt
    const workspaceId = jotaiStore.get(activeWorkspaceIdAtom);
    if (workspaceId == null) return;

-    const location = router.buildLocation({
-      to: "/workspaces/$workspaceId/settings",
-      params: { workspaceId },
-      search: { tab: (tab ?? undefined) as SettingsTab | undefined },
-    });
+    const to = "/workspaces/$workspaceId/settings" as const;
+    const params = { workspaceId };
+    const search = { tab: (tab ?? undefined) as SettingsTab | undefined };
+
+    // Settings is its own window where the host has windows to give. Where it
+    // doesn't — a browser tab — the same route opens in place, which is the
+    // whole difference: it is already a route, not a separate app.
+    if (!platform.capabilities.multiWindow) {
+      await router.navigate({ to, params, search });
+      return;
+    }
+
+    const location = router.buildLocation({ to, params, search });

    await rpc("cmd_new_child_window", {
      url: location.href,
@@ -1,3 +1,4 @@
+import { platform } from "@yaakapp-internal/platform";
 import { createFastMutation } from "../hooks/useFastMutation";
 import { getRecentCookieJars } from "../hooks/useRecentCookieJars";
 import { getRecentEnvironments } from "../hooks/useRecentEnvironments";
@@ -24,7 +25,9 @@ export const switchWorkspace = createFastMutation<
      request_id: requestId,
    };

-    if (inNewWindow) {
+    // A host without windows opens the workspace here instead. Refusing would
+    // strand the user on the workspace they were trying to leave.
+    if (inNewWindow && platform.capabilities.multiWindow) {
      const location = router.buildLocation({
        to: "/workspaces/$workspaceId",
        params: { workspaceId },
@@ -410,7 +410,7 @@ function EnsureCompleteResponse({
  Component,
 }: {
  response: HttpResponse;
-  Component: ComponentType<{ url: string }>;
+  Component: ComponentType<{ bodyUrl: string }>;
 }) {
  // Wait until the response has been fully-downloaded before asking for it
  const complete = response.state === "closed";
@@ -432,7 +432,7 @@ function EnsureCompleteResponse({
    return <div>Empty response body</div>;
  }

-  return <Component url={bodyUrl.data} />;
+  return <Component bodyUrl={bodyUrl.data} />;
 }

 function HttpSvgViewer({ response }: { response: HttpResponse }) {
@@ -1,56 +1,138 @@
-import { VStack } from "@yaakapp-internal/ui";
-import { useState } from "react";
+import { platform } from "@yaakapp-internal/platform";
+import { Icon, VStack } from "@yaakapp-internal/ui";
+import classNames from "classnames";
+import { useEffect, useRef, useState } from "react";
 import { useLocalStorage } from "react-use";
 import { CommercialUseBanner } from "./CommercialUseBanner";
 import { Button } from "./core/Button";
-import { SelectFile } from "./SelectFile";
+import { PlainInput } from "./core/PlainInput";

 interface Props {
-  importData: (filePath: string) => Promise<void>;
+  importFile: (filePath: string) => Promise<void>;
+  importUrl: (url: string) => Promise<void>;
 }

-export function ImportDataDialog({ importData }: Props) {
+/**
+ * An absolute or relative path is unambiguously a file. Everything else is treated as a URL, so a
+ * bare host like `example.com/openapi.json` still works (the backend defaults it to https).
+ */
+function isFilePath(value: string): boolean {
+  return (
+    value.startsWith("/") ||
+    value.startsWith("./") ||
+    value.startsWith("../") ||
+    value.startsWith("~/") ||
+    value.startsWith("\\\\") ||
+    /^[a-zA-Z]:[\\/]/.test(value)
+  );
+}
+
+function fileName(path: string): string {
+  return path.split(/[/\\]/).at(-1) || path;
+}
+
+export function ImportDataDialog({ importFile, importUrl }: Props) {
  const [isLoading, setIsLoading] = useState<boolean>(false);
-  const [filePath, setFilePath] = useLocalStorage<string | null>("importFilePath", null);
+  // A file path or a URL. Both inputs write here, so there is only ever one thing to import
+  const [source, setSource] = useLocalStorage<string | null>("importPathOrUrl", null);
+  const [forceUpdateKey, setForceUpdateKey] = useState<number>(0);
+  const [isHovering, setIsHovering] = useState<boolean>(false);
+  const ref = useRef<HTMLDivElement>(null);
+  const trimmedSource = source?.trim() ?? "";
+  const filePath = isFilePath(trimmedSource) ? trimmedSource : null;
+
+  const selectSource = (value: string) => {
+    setSource(value);
+    // Remount the input so it shows the path of the newly-picked file
+    setForceUpdateKey((k) => k + 1);
+  };
+
+  // Accept a file dropped anywhere on the dialog, the way SelectFile does for its button
+  useEffect(() => {
+    return platform.window.onDragDrop((event) => {
+      if (event.type === "over") {
+        const p = event.position;
+        const r = ref.current?.getBoundingClientRect();
+        if (r == null) return;
+        setIsHovering(p.x >= r.left && p.x <= r.right && p.y >= r.top && p.y <= r.bottom);
+      } else if (event.type === "drop" && isHovering) {
+        const p = event.paths[0];
+        if (p) selectSource(p);
+        setIsHovering(false);
+      } else {
+        setIsHovering(false);
+      }
+    });
+  }, [isHovering, setSource]);
+
+  const handleSelectFile = async () => {
+    const selected = await platform.dialog.open({ title: "Select File", multiple: false });
+    if (selected == null) return;
+    selectSource(selected);
+  };
+
+  const handleImport = async () => {
+    setIsLoading(true);
+    try {
+      if (filePath != null) {
+        await importFile(filePath);
+      } else {
+        await importUrl(trimmedSource);
+      }
+    } finally {
+      setIsLoading(false);
+    }
+  };

  return (
-    <VStack space={5} className="pb-4">
+    <VStack ref={ref} space={4} className="pb-4">
      <CommercialUseBanner source="data-import" title="Importing work data?" />

-      <VStack space={1}>
-        <ul className="list-disc pl-5">
-          <li>OpenAPI 3.0, 3.1</li>
-          <li>Postman Collection v2, v2.1</li>
-          <li>Insomnia v4+</li>
-          <li>Swagger 2.0</li>
-          <li>
-            Curl commands <em className="text-text-subtle">(or paste into URL)</em>
-          </li>
-        </ul>
-      </VStack>
-      <VStack space={2}>
-        <SelectFile
-          filePath={filePath ?? null}
-          onChange={({ filePath }) => setFilePath(filePath)}
-        />
-        {filePath && (
-          <Button
-            color="primary"
-            disabled={!filePath || isLoading}
-            isLoading={isLoading}
-            size="sm"
-            onClick={async () => {
-              setIsLoading(true);
-              try {
-                await importData(filePath);
-              } finally {
-                setIsLoading(false);
-              }
-            }}
-          >
-            {isLoading ? "Importing" : "Import"}
-          </Button>
+      <button
+        type="button"
+        onClick={handleSelectFile}
+        className={classNames(
+          "w-full rounded-lg border border-dashed px-4 py-6",
+          "flex flex-col items-center gap-1 text-center",
+          isHovering ? "border-notice bg-surface-highlight" : "border-border hover:border-text",
        )}
+      >
+        <Icon icon="folder_input" className="text-text-subtlest w-8! h-8! mb-2" />
+        {/* Fixed height so the region doesn't resize between the empty and selected states */}
+        <div className="h-6 w-full flex items-center justify-center">
+          {filePath == null ? (
+            <div className="text-text">
+              <strong className="font-semibold">Choose a file</strong> or drag it here
+            </div>
+          ) : (
+            <div className="text-text font-mono text-xs max-w-full truncate" title={filePath}>
+              {fileName(filePath)}
+            </div>
+          )}
+        </div>
+        <div className="text-xs text-text-subtlest">
+          Supports OpenAPI, Swagger, Postman, Insomnia, and curl
+        </div>
+      </button>
+
+      <VStack space={2}>
+        <PlainInput
+          label="Or enter a file path or URL"
+          size="sm"
+          placeholder="https://example.com/openapi.json"
+          defaultValue={source ?? ""}
+          forceUpdateKey={String(forceUpdateKey)}
+          onChange={setSource}
+        />
+        <Button
+          color="primary"
+          disabled={trimmedSource === "" || isLoading}
+          isLoading={isLoading}
+          size="sm"
+          onClick={handleImport}
+        >
+          {isLoading ? "Importing" : "Import"}
+        </Button>
      </VStack>
    </VStack>
  );
@@ -36,12 +36,16 @@ import { fireAndForget } from "../../lib/fireAndForget";
 import { ErrorBoundary } from "../ErrorBoundary";
 import { Button } from "./Button";
 import { Hotkey } from "./Hotkey";
+import { IconButton } from "./IconButton";
+import type { SeparatorAction } from "./Separator";
 import { Separator } from "./Separator";

 export type DropdownItemSeparator = {
  type: "separator";
  label?: ReactNode;
  hidden?: boolean;
+  /** A control shown beside the label, eg. revealing the labelled file on disk. */
+  action?: SeparatorAction;
 };

 export type DropdownItemContent = {
@@ -66,6 +70,12 @@ export type DropdownItemDefault = {
  submenu?: DropdownItem[];
  /** If true, submenu opens on click instead of hover */
  submenuOpenOnClick?: boolean;
+  /**
+   * How the submenu opens. "row" (default) opens it from the row itself (hover, or click
+   * with submenuOpenOnClick). "button" keeps the row selectable via onSelect and renders
+   * a dedicated button on the right that opens the submenu.
+   */
+  submenuTrigger?: "row" | "button";
  icon?: IconProps["icon"];
 };

@@ -502,9 +512,15 @@ const Menu = forwardRef<Omit<DropdownRef, "open" | "isOpen" | "toggle" | "items"
          }
        }

-        if (!item.keepOpenOnSelect) handleCloseAll();
+        if (!item.keepOpenOnSelect) {
+          handleCloseAll();
+        } else if (isSubmenu) {
+          // Keep the parent menu open, but close this submenu — its items may no
+          // longer describe the row after the action (e.g. Pin → Unpin, Remove)
+          handleClose();
+        }
      },
-      [handleCloseAll, setSelectedIndex],
+      [handleCloseAll, handleClose, isSubmenu, setSelectedIndex],
    );

    useImperativeHandle(ref, () => {
@@ -629,7 +645,7 @@ const Menu = forwardRef<Omit<DropdownRef, "open" | "isOpen" | "toggle" | "items"
        const item = filteredItems[selectedIndex ?? -1];
        if (!item || item.type === "separator" || item.type === "content") return;
        e.preventDefault();
-        if (item.submenu) {
+        if (item.submenu && item.submenuTrigger !== "button") {
          const parent = document.activeElement as HTMLButtonElement;
          if (parent) {
            setActiveSubmenu({ item, parent, viaKeyboard: true });
@@ -648,9 +664,11 @@ const Menu = forwardRef<Omit<DropdownRef, "open" | "isOpen" | "toggle" | "items"
          clearTimeout(submenuTimeoutRef.current);
        }

-        if (item.submenu && !item.submenuOpenOnClick) {
+        if (item.submenu && !item.submenuOpenOnClick && item.submenuTrigger !== "button") {
          setActiveSubmenu({ item, parent });
-        } else if (activeSubmenu) {
+        } else if (activeSubmenu && activeSubmenu.item !== item) {
+          // Hovering the row that owns the open submenu must not dismiss it — the
+          // pointer travels across the row on its way to a button-triggered submenu
          submenuTimeoutRef.current = window.setTimeout(() => {
            const submenuEl = submenuRef.current;
            if (!submenuEl || !activeSubmenu) {
@@ -776,6 +794,7 @@ const Menu = forwardRef<Omit<DropdownRef, "open" | "isOpen" | "toggle" | "items"
                  // oxlint-disable-next-line no-array-index-key -- Nothing else available
                  key={i}
                  className={classNames("my-1.5", item.label ? "ml-2" : null)}
+                  action={item.action}
                >
                  {item.label}
                </Separator>
@@ -797,6 +816,7 @@ const Menu = forwardRef<Omit<DropdownRef, "open" | "isOpen" | "toggle" | "items"
                onFocus={handleFocus}
                onSelect={handleSelect}
                onHover={handleItemHover}
+                onOpenSubmenu={(item, el) => setActiveSubmenu({ item, parent: el })}
                // oxlint-disable-next-line no-array-index-key -- It's fine
                key={i}
                item={item}
@@ -868,6 +888,7 @@ interface MenuItemProps {
  onSelect: (item: DropdownItemDefault, el?: HTMLButtonElement) => Promise<void>;
  onFocus: (item: DropdownItemDefault) => void;
  onHover: (item: DropdownItemDefault, el: HTMLButtonElement) => void;
+  onOpenSubmenu: (item: DropdownItemDefault, el: HTMLButtonElement) => void;
  focused: boolean;
  isParentOfActiveSubmenu?: boolean;
 }
@@ -879,6 +900,7 @@ function MenuItem({
  onHover,
  item,
  onSelect,
+  onOpenSubmenu,
  isParentOfActiveSubmenu,
  ...props
 }: MenuItemProps) {
@@ -914,19 +936,22 @@ function MenuItem({
    e.currentTarget.focus();
  };

-  const rightSlot = item.submenu ? (
-    <Icon icon="chevron_right" color="secondary" />
-  ) : (
-    (item.rightSlot ?? <Hotkey variant="text" action={item.hotKeyAction ?? null} />)
-  );
+  const hasButtonSubmenu = item.submenu != null && item.submenuTrigger === "button";

-  return (
+  const rightSlot =
+    item.submenu && !hasButtonSubmenu ? (
+      <Icon icon="chevron_right" color="secondary" />
+    ) : (
+      (item.rightSlot ?? <Hotkey variant="text" action={item.hotKeyAction ?? null} />)
+    );
+
+  const button = (
    <Button
      ref={initRef}
      size="sm"
      tabIndex={-1}
-      onMouseEnter={handleMouseEnter}
-      onMouseLeave={(e) => e.currentTarget.blur()}
+      onMouseEnter={hasButtonSubmenu ? undefined : handleMouseEnter}
+      onMouseLeave={hasButtonSubmenu ? undefined : (e) => e.currentTarget.blur()}
      disabled={item.disabled}
      onFocus={handleFocus}
      onClick={handleClick}
@@ -947,6 +972,7 @@ function MenuItem({
        "min-w-32 outline-hidden px-2 mx-1.5 flex whitespace-nowrap",
        "focus:bg-surface-highlight focus:text rounded-sm focus:outline-hidden focus-visible:outline-1",
        isParentOfActiveSubmenu && "bg-surface-highlight text rounded-sm",
+        hasButtonSubmenu && "pr-8",
        item.color === "danger" && "text-danger!",
        item.color === "primary" && "text-primary!",
        item.color === "success" && "text-success!",
@@ -959,6 +985,52 @@ function MenuItem({
      <div className={classNames("truncate min-w-20")}>{item.label}</div>
    </Button>
  );
+
+  if (!hasButtonSubmenu) {
+    return button;
+  }
+
+  // The submenu trigger overlays the row as a sibling (not a child) because the row is
+  // itself a button and buttons cannot nest. Hover handling lives on this wrapper so the
+  // row keeps its focus highlight while the mouse is over the trigger.
+  return (
+    <div
+      className="relative grid group/menuitem"
+      onMouseEnter={() => {
+        const el = buttonRef.current;
+        if (el == null) return;
+        onHover(item, el);
+        el.focus();
+      }}
+      onMouseLeave={() => buttonRef.current?.blur()}
+    >
+      {button}
+      <div
+        className={classNames(
+          "absolute right-1.5 inset-y-0 flex items-center",
+          "opacity-0 group-hover/menuitem:opacity-100 group-focus-within/menuitem:opacity-100",
+        )}
+      >
+        <IconButton
+          color="custom"
+          size="2xs"
+          tabIndex={-1}
+          icon="ellipsis_vertical"
+          iconColor="secondary"
+          title="More actions"
+          className="h-full! w-7!"
+          onMouseDown={(e) => {
+            // Prevent the trigger from stealing focus, which would unhighlight the row
+            e.preventDefault();
+          }}
+          onClick={(e) => {
+            e.stopPropagation();
+            onOpenSubmenu(item, e.currentTarget);
+          }}
+        />
+      </div>
+    </div>
+  );
 }

 interface MenuItemHotKeyProps {
@@ -1,13 +1,31 @@
 import type { Color } from "@yaakapp-internal/plugins";
+import type { IconProps } from "@yaakapp-internal/ui";
+import { IconButton } from "@yaakapp-internal/ui";
 import classNames from "classnames";
 import type { ReactNode } from "react";

+/**
+ * A single control attached to a labelled separator, rendered between the label
+ * and the rule.
+ *
+ * Declared rather than passed as a node so the separator keeps ownership of the
+ * things that are easy to get wrong by hand: matching the label's colour, and
+ * staying out of the rule's way when the label is long.
+ */
+export interface SeparatorAction {
+  icon: IconProps["icon"];
+  /** Tooltip and accessible name. Required — the control is icon-only. */
+  title: string;
+  onClick: () => void;
+}
+
 interface Props {
  orientation?: "horizontal" | "vertical";
  dashed?: boolean;
  className?: string;
  children?: ReactNode;
  color?: Color;
+  action?: SeparatorAction;
 }

 export function Separator({
@@ -16,15 +34,31 @@ export function Separator({
  dashed,
  orientation = "horizontal",
  children,
+  action,
 }: Props) {
  return (
    <div role="presentation" className={classNames(className, "flex items-center w-full")}>
      {children && (
        <div className="text-sm text-text-subtlest mr-2 whitespace-nowrap">{children}</div>
      )}
+      {action && (
+        <IconButton
+          size="2xs"
+          iconSize="xs"
+          className="shrink-0 mr-2 -ml-1"
+          // Forced, because the button itself sets `text-text` at full strength.
+          iconClassName="text-text-subtlest!"
+          icon={action.icon}
+          title={action.title}
+          onClick={action.onClick}
+        />
+      )}
      <div
        className={classNames(
          "opacity-60",
+          // Keep a stub of the line visible no matter how long the label is —
+          // `w-full` alone gets squeezed to nothing by a wide label.
+          orientation === "horizontal" && "min-w-8",
          color == null && "border-border",
          color === "primary" && "border-primary",
          color === "secondary" && "border-secondary",
@@ -1,4 +1,5 @@
 import type { HttpRequest } from "@yaakapp-internal/models";
+import { platform } from "@yaakapp-internal/platform";

 import { useAtom } from "jotai";
 import { useCallback, useEffect, useMemo } from "react";
@@ -11,6 +12,7 @@ import type { DropdownItem } from "../core/Dropdown";
 import { Dropdown } from "../core/Dropdown";
 import type { EditorProps } from "../core/Editor/Editor";
 import { Editor } from "../core/Editor/LazyEditor";
+import { IconButton } from "../core/IconButton";
 import type { RadioDropdownItem } from "../core/RadioDropdown";
 import { RadioDropdown } from "../core/RadioDropdown";
 import { Banner, FormattedError, Icon } from "@yaakapp-internal/ui";
@@ -18,6 +20,7 @@ import { Separator } from "../core/Separator";
 import { tryFormatGraphql } from "../../lib/formatters";
 import { parseGraphQLOperationNames } from "../../lib/graphqlOperationNames";
 import { normalizeGraphQLBody } from "../../lib/requestBodyConversion";
+import { revealInFinderText } from "../../lib/reveal";
 import { showGraphQLDocExplorerAtom } from "./graphqlAtoms";

 type Props = Pick<EditorProps, "heightMode" | "className" | "forceUpdateKey"> & {
@@ -28,6 +31,10 @@ type Props = Pick<EditorProps, "heightMode" | "className" | "forceUpdateKey"> &

 const OPERATION_NAME_NOT_SPECIFIED = "";

+// How much of the end of a schema filename is pinned when middle-truncating it.
+// Enough to keep the extension and a little of the name before it.
+const FILE_NAME_TAIL_CHARS = 12;
+
 export function GraphQLEditor(props: Props) {
  // There's some weirdness with stale onChange being called when switching requests, so we'll
  // key on the request ID as a workaround for now.
@@ -38,9 +45,41 @@ function GraphQLEditorInner({ request, onChange, baseRequest, ...extraEditorProp
  const [autoIntrospectDisabled, setAutoIntrospectDisabled] = useLocalStorage<
    Record<string, boolean>
  >("graphQLAutoIntrospectDisabled", {});
-  const { schema, isLoading, error, refetch, clear } = useIntrospectGraphQL(baseRequest, {
+  const {
+    schema,
+    isLoading,
+    error,
+    refetch,
+    clear,
+    loadFromFile,
+    reloadFromFile,
+    removeSchemaFile,
+    filePath,
+  } = useIntrospectGraphQL(baseRequest, {
    disabled: autoIntrospectDisabled?.[baseRequest.id],
  });
+
+  // Last path segment, for display only. The host owns real path semantics; this
+  // just needs something short enough to label the divider with.
+  const fileName = useMemo(() => filePath?.split(/[/\\]/).pop() || filePath, [filePath]);
+
+  // Selecting a file is all it takes — the request's source becomes that file,
+  // which is what keeps automatic introspection from overwriting it.
+  const handleLoadFromFile = useCallback(async () => {
+    const selected = await platform.dialog.open({
+      title: "Load GraphQL Schema",
+      multiple: false,
+      filters: [
+        {
+          name: "GraphQL Schema",
+          extensions: ["graphql", "graphqls", "gql", "json"],
+        },
+      ],
+    });
+    if (selected == null) return;
+
+    await loadFromFile(selected);
+  }, [loadFromFile]);
  const [currentBody, setCurrentBody] = useStateWithDeps<{
    query: string;
    variables: string | undefined;
@@ -160,14 +199,37 @@ function GraphQLEditorInner({ request, onChange, baseRequest, ...extraEditorProp
              ...((schema != null
                ? [
                    {
-                      label: "Clear",
+                      label: "Clear Schema",
                      onSelect: clear,
                      color: "danger",
                      leftSlot: <Icon icon="trash" />,
                    },
-                    { type: "separator" },
                  ]
                : []) satisfies DropdownItem[]),
+              {
+                // Labels the source actions below it, so the menu says where the
+                // schema came from without spending a row on it.
+                type: "separator",
+                hidden: schema == null && filePath == null,
+                label:
+                  fileName == null || filePath == null ? undefined : (
+                    // Middle truncation: the head shrinks and ellipsizes while the
+                    // tail is pinned, so the extension always survives. Full path
+                    // on hover.
+                    <div className="flex min-w-0 max-w-[16rem] font-mono text-xs" title={filePath}>
+                      <span className="truncate">{fileName.slice(0, -FILE_NAME_TAIL_CHARS)}</span>
+                      <span className="shrink-0">{fileName.slice(-FILE_NAME_TAIL_CHARS)}</span>
+                    </div>
+                  ),
+                action:
+                  filePath == null
+                    ? undefined
+                    : {
+                        icon: "folder_symlink",
+                        title: revealInFinderText,
+                        onClick: () => platform.revealItemInDir(filePath),
+                      },
+              },
              {
                hidden: !error,
                label: (
@@ -210,25 +272,33 @@ function GraphQLEditorInner({ request, onChange, baseRequest, ...extraEditorProp
                type: "content",
              },
              {
-                hidden: schema == null,
-                label: `${isDocOpen ? "Hide" : "Show"} Documentation`,
-                leftSlot: <Icon icon="book_open_text" />,
-                onSelect: () => {
-                  setGraphqlDocStateAtomValue((v) => ({
-                    ...v,
-                    [request.id]: isDocOpen ? undefined : null,
-                  }));
+                // One refresh action for either source: re-read the file, or
+                // re-introspect the server.
+                label: "Reload Schema",
+                leftSlot: <Icon icon="refresh" spin={isLoading} />,
+                keepOpenOnSelect: true,
+                // Failures surface through the hook's error state either way.
+                onSelect: async () => {
+                  if (filePath != null) await reloadFromFile();
+                  else await refetch();
                },
              },
              {
-                label: "Introspect Schema",
-                leftSlot: <Icon icon="refresh" spin={isLoading} />,
-                keepOpenOnSelect: true,
-                onSelect: refetch,
+                label: filePath == null ? "Load Schema from File…" : "Load a Different File…",
+                leftSlot: <Icon icon="import" />,
+                onSelect: handleLoadFromFile,
              },
-              { type: "separator", label: "Setting" },
              {
-                label: "Automatic Introspection",
+                hidden: filePath == null,
+                label: "Stop Using File",
+                leftSlot: <Icon icon="x" />,
+                onSelect: removeSchemaFile,
+              },
+              { type: "separator", label: "Settings" },
+              {
+                // Governs both sources: re-introspecting the server, and
+                // re-reading the file when the request is opened.
+                label: filePath == null ? "Automatic Introspection" : "Automatic Reload",
                keepOpenOnSelect: true,
                onSelect: () => {
                  setAutoIntrospectDisabled({
@@ -261,6 +331,29 @@ function GraphQLEditorInner({ request, onChange, baseRequest, ...extraEditorProp
          </Dropdown>
        )}
      </div>,
+      // Sits after the schema control it depends on. Always rendered, disabled
+      // without a schema, so the row never changes shape.
+      <div key="documentation" className="opacity-100!">
+          <IconButton
+            size="sm"
+            variant="border"
+            icon="book_open_text"
+            disabled={schema == null}
+            title={
+              schema == null
+                ? "Documentation unavailable without a schema"
+                : isDocOpen
+                  ? "Hide Documentation"
+                  : "Show Documentation"
+            }
+            onClick={() => {
+              setGraphqlDocStateAtomValue((v) => ({
+                ...v,
+                [request.id]: isDocOpen ? undefined : null,
+              }));
+            }}
+          />
+      </div>,
    ],
    [
      schema,
@@ -272,6 +365,11 @@ function GraphQLEditorInner({ request, onChange, baseRequest, ...extraEditorProp
      isLoading,
      operationNames,
      refetch,
+      handleLoadFromFile,
+      reloadFromFile,
+      removeSchemaFile,
+      filePath,
+      fileName,
      autoIntrospectDisabled,
      baseRequest.id,
      setGraphqlDocStateAtomValue,
@@ -1,18 +1,18 @@
 import { useEffect, useState } from "react";

 interface Props {
-  /** A URL the host resolved, for a body it already stored. */
-  url?: string;
+  /** A URL for the body the host already stored. */
+  bodyUrl?: string;
  data?: Uint8Array;
  mimeType?: string;
 }

-export function AudioViewer({ url, data, mimeType }: Props) {
+export function AudioViewer({ bodyUrl, data, mimeType }: Props) {
  const [src, setSrc] = useState<string>();

  useEffect(() => {
-    if (url) {
-      setSrc(url);
+    if (bodyUrl) {
+      setSrc(bodyUrl);
    } else if (data) {
      // The type matters here in a way it doesn't for an image: a media element goes by what
      // the blob declares rather than sniffing it, so an Ogg labelled as MP3 won't play
@@ -23,7 +23,7 @@ export function AudioViewer({ url, data, mimeType }: Props) {
    } else {
      setSrc(undefined);
    }
-  }, [url, data, mimeType]);
+  }, [bodyUrl, data, mimeType]);

  // oxlint-disable-next-line jsx-a11y/media-has-caption
  return <audio className="w-full" controls src={src} />;
@@ -1,7 +1,9 @@
 import type { HttpResponse } from "@yaakapp-internal/models";
-import { useMemo, useState } from "react";
+import { useQueryClient } from "@tanstack/react-query";
+import { useCallback } from "react";
 import { useCopyHttpResponse } from "../../hooks/useCopyHttpResponse";
-import { useResponseBodyText } from "../../hooks/useResponseBodyText";
+import { responseBodyTextQuery, useResponseBodyText } from "../../hooks/useResponseBodyText";
+import { useResponseFilter } from "../../hooks/useResponseFilter";
 import { useSaveResponse } from "../../hooks/useSaveResponse";
 import { languageFromContentType } from "../../lib/contentType";
 import { getContentTypeFromHeaders } from "../../lib/model_util";
@@ -52,30 +54,25 @@ interface HttpTextViewerProps {
 }

 function HttpTextViewer({ response, text, language, pretty, className }: HttpTextViewerProps) {
-  const [currentFilter, setCurrentFilter] = useState<string | null>(null);
-  const filteredBody = useResponseBodyText({ response, filter: currentFilter });
+  const queryClient = useQueryClient();
+  const filter = useResponseFilter({
+    stateKey: `response.body.${response.requestId}`,
+    // Shares the display query's cache entry, so the verdict costs no extra RPC
+    runFilter: useCallback(
+      (f: string) => queryClient.fetchQuery(responseBodyTextQuery({ response, filter: f })),
+      [queryClient, response],
+    ),
+  });
+  const filteredBody = useResponseBodyText({ response, filter: filter.appliedFilter });
  const saveResponse = useSaveResponse(response);
  const copyResponse = useCopyHttpResponse(response);
  const actionsDisabled = response.state !== "closed" && response.status >= 100;

-  const filterCallback = useMemo(
-    () => (filter: string) => {
-      setCurrentFilter(filter);
-      return {
-        data: filteredBody.data,
-        isPending: filteredBody.isPending,
-        error: !!filteredBody.error,
-      };
-    },
-    [filteredBody],
-  );
-
  return (
    <TextViewer
      text={text}
      language={language}
      stateKey={`response.body.${response.id}`}
-      filterStateKey={`response.body.${response.requestId}`}
      pretty={pretty}
      className={className}
      footerActions={[
@@ -98,7 +95,12 @@ function HttpTextViewer({ response, text, language, pretty, className }: HttpTex
          className="border !border-border-subtle"
        />,
      ]}
-      onFilter={filterCallback}
+      filter={filter}
+      filterResult={{
+        data: filteredBody.data,
+        isPending: filteredBody.isPending,
+        error: !!filteredBody.error,
+      }}
    />
  );
 }
@@ -3,8 +3,8 @@ import { useEffect, useState } from "react";

 type Props = { className?: string; mimeType?: string } & (
  | {
-      /** A URL the host resolved, for a body it already stored. */
-      url: string;
+      /** A URL for the body the host already stored. */
+      bodyUrl: string;
    }
  | {
      data: ArrayBuffer;
@@ -13,12 +13,12 @@ type Props = { className?: string; mimeType?: string } & (

 export function ImageViewer({ className, mimeType, ...props }: Props) {
  const [src, setSrc] = useState<string>();
-  const url = "url" in props ? props.url : null;
+  const bodyUrl = "bodyUrl" in props ? props.bodyUrl : null;
  const data = "data" in props ? props.data : null;

  useEffect(() => {
-    if (url != null) {
-      setSrc(url);
+    if (bodyUrl != null) {
+      setSrc(bodyUrl);
    } else if (data != null) {
      const blob = new Blob([data], { type: mimeType ?? "image/png" });
      const objectUrl = URL.createObjectURL(blob);
@@ -27,7 +27,7 @@ export function ImageViewer({ className, mimeType, ...props }: Props) {
    } else {
      setSrc(undefined);
    }
-  }, [url, data, mimeType]);
+  }, [bodyUrl, data, mimeType]);

  return (
    <img
@@ -17,8 +17,8 @@ fireAndForget(
 );

 interface Props {
-  /** A URL the host resolved, for a body it already stored. */
-  url?: string;
+  /** A URL for the body the host already stored. */
+  bodyUrl?: string;
  data?: Uint8Array;
 }

@@ -27,7 +27,7 @@ const options = {
  standardFontDataUrl: "/standard_fonts/",
 };

-export function PdfViewer({ url, data }: Props) {
+export function PdfViewer({ bodyUrl, data }: Props) {
  const containerRef = useRef<HTMLDivElement>(null);
  const [numPages, setNumPages] = useState<number>();

@@ -36,8 +36,8 @@ export function PdfViewer({ url, data }: Props) {
  // During render, not in an effect: an effect leaves the first paint with no file, and
  // `Document` renders its "Failed to load PDF file" state for that frame before recovering
  const src = useMemo(() => {
-    if (url) {
-      return url;
+    if (bodyUrl) {
+      return bodyUrl;
    }
    if (data) {
      // Create a copy to avoid "Buffer is already detached" errors
@@ -45,7 +45,7 @@ export function PdfViewer({ url, data }: Props) {
      return { data: new Uint8Array(data) };
    }
    return undefined;
-  }, [url, data]);
+  }, [bodyUrl, data]);

  const onDocumentLoadSuccess = ({ numPages: nextNumPages }: PDFDocumentProxy): void => {
    setNumPages(nextNumPages);
@@ -0,0 +1,96 @@
+import { Icon } from "@yaakapp-internal/ui";
+import type { RecentFilter } from "../../hooks/useRecentFilters";
+import { Dropdown, type DropdownItem } from "../core/Dropdown";
+import { IconButton } from "../core/IconButton";
+
+interface Props {
+  recentFilters: RecentFilter[];
+  activeFilter: string | null;
+  onSelect: (value: string) => void;
+  onRemove: (value: string) => void;
+  onTogglePin: (value: string) => void;
+  onClear: () => void;
+}
+
+export function RecentFiltersDropdown({
+  recentFilters,
+  activeFilter,
+  onSelect,
+  onRemove,
+  onTogglePin,
+  onClear,
+}: Props) {
+  const pinned = recentFilters.filter((f) => f.pinned);
+  const unpinned = recentFilters.filter((f) => !f.pinned);
+
+  const toItem = (filter: RecentFilter): DropdownItem => ({
+    label: (
+      <div className="font-mono text-sm truncate max-w-sm" title={filter.value}>
+        {filter.value}
+      </div>
+    ),
+    leftSlot: <Icon icon={filter.value === activeFilter ? "check" : "empty"} />,
+    onSelect: () => onSelect(filter.value),
+    submenuTrigger: "button",
+    submenu: [
+      {
+        label: filter.pinned ? "Unpin" : "Pin",
+        icon: filter.pinned ? "unpin" : "pin",
+        keepOpenOnSelect: true,
+        onSelect: () => onTogglePin(filter.value),
+      },
+      {
+        label: "Remove",
+        icon: "trash",
+        color: "danger",
+        keepOpenOnSelect: true,
+        onSelect: () => onRemove(filter.value),
+      },
+    ],
+  });
+
+  const items: DropdownItem[] = [];
+
+  if (recentFilters.length === 0) {
+    items.push({
+      type: "content",
+      label: (
+        <span className="block px-4 py-1 text-sm text-text-subtle">
+          Filters you use are remembered here
+        </span>
+      ),
+    });
+  }
+
+  if (pinned.length > 0) {
+    items.push({ type: "separator", label: "Pinned" }, ...pinned.map(toItem));
+  }
+
+  if (unpinned.length > 0) {
+    items.push({ type: "separator", label: "Recent" }, ...unpinned.map(toItem));
+  }
+
+  if (recentFilters.length > 0) {
+    items.push(
+      { type: "separator" },
+      {
+        label: "Clear All",
+        leftSlot: <Icon icon="trash" />,
+        color: "danger",
+        onSelect: onClear,
+      },
+    );
+  }
+
+  return (
+    <Dropdown items={items}>
+      <IconButton
+        size="xs"
+        icon="filter"
+        title="Recent filters"
+        iconColor="secondary"
+        className="w-8 ml-0.5 mr-1 h-auto!"
+      />
+    </Dropdown>
+  );
+}
@@ -1,14 +1,15 @@
-import classNames from "classnames";
 import type { ReactNode } from "react";
 import { Children, useCallback, useMemo } from "react";
-import { createGlobalState } from "react-use";
-import { useDebouncedValue } from "@yaakapp-internal/ui";
+import { Banner, HStack, Icon, InlineCode } from "@yaakapp-internal/ui";
 import { useFormatText } from "../../hooks/useFormatText";
+import type { ResponseFilterApi } from "../../hooks/useResponseFilter";
+import { Button } from "../core/Button";
 import type { EditorProps } from "../core/Editor/Editor";
 import { hyperlink } from "../core/Editor/hyperlink/extension";
 import { Editor } from "../core/Editor/LazyEditor";
 import { IconButton } from "../core/IconButton";
 import { Input } from "../core/Input";
+import { RecentFiltersDropdown } from "./RecentFiltersDropdown";

 const extraExtensions = [hyperlink];

@@ -16,57 +17,45 @@ interface Props {
  text: string;
  language: EditorProps["language"];
  stateKey: string | null;
-  filterStateKey?: string | null;
  pretty?: boolean;
  className?: string;
  footerActions?: ReactNode;
-  onFilter?: (filter: string) => {
+  filter?: ResponseFilterApi;
+  filterResult?: {
    data: string | null | undefined;
    isPending: boolean;
    error: boolean;
  };
 }

-const useFilterText = createGlobalState<Record<string, string | null>>({});
-
 export function TextViewer({
  language,
  text,
  stateKey,
-  filterStateKey,
  pretty,
  className,
  footerActions,
-  onFilter,
+  filter,
+  filterResult,
 }: Props) {
-  const filterKey = filterStateKey ?? stateKey;
-  const [filterTextMap, setFilterTextMap] = useFilterText();
-  const filterText = filterKey ? (filterTextMap[filterKey] ?? null) : null;
-  const debouncedFilterText = useDebouncedValue(filterText);
-  const setFilterText = useCallback(
-    (v: string | null) => {
-      if (!filterKey) return;
-      setFilterTextMap((m) => ({ ...m, [filterKey]: v }));
+  const canFilter =
+    filter != null && (language === "json" || language === "xml" || language === "html");
+  const isSearching = filter?.isSearching ?? false;
+  const appliedFilter = filter?.appliedFilter ?? null;
+  const resultError = filterResult?.error ?? false;
+
+  const handleFilterKeyDown = useCallback(
+    (e: KeyboardEvent) => {
+      if (filter == null) return;
+      if (e.key === "Escape") {
+        filter.toggleSearch();
+      } else if (e.key === "Enter" && filter.filterText != null) {
+        filter.applyFilter(filter.filterText);
+      }
    },
-    [filterKey, setFilterTextMap],
+    [filter],
  );

-  const isSearching = filterText != null;
-  const filteredResponse =
-    onFilter && debouncedFilterText
-      ? onFilter(debouncedFilterText)
-      : { data: null, isPending: false, error: false };
-
-  const toggleSearch = useCallback(() => {
-    if (isSearching) {
-      setFilterText(null);
-    } else {
-      setFilterText("");
-    }
-  }, [isSearching, setFilterText]);
-
-  const canFilter = onFilter && (language === "json" || language === "xml" || language === "html");
-
  const actions = useMemo<ReactNode[]>(() => {
    const nodes: ReactNode[] = isSearching ? [] : Children.toArray(footerActions);

@@ -76,8 +65,8 @@ export function TextViewer({
      nodes.push(
        <div key="input" className="w-full opacity-100!">
          <Input
-            key={filterKey ?? "filter"}
-            validate={!filteredResponse.error}
+            key={filter.stateKey ?? "filter"}
+            validate={!resultError}
            hideLabel
            autoFocus
            containerClassName="bg-surface"
@@ -85,39 +74,62 @@ export function TextViewer({
            placeholder={language === "json" ? "JSONPath expression" : "XPath expression"}
            label="Filter expression"
            name="filter"
-            defaultValue={filterText}
-            onKeyDown={(e) => e.key === "Escape" && toggleSearch()}
-            onChange={setFilterText}
-            stateKey={filterKey ? `filter.${filterKey}` : null}
+            defaultValue={filter.filterText}
+            forceUpdateKey={filter.filterUpdateKey}
+            onKeyDown={handleFilterKeyDown}
+            onChange={filter.setFilterText}
+            stateKey={filter.stateKey ? `filter.${filter.stateKey}` : null}
+            leftSlot={
+              <div className="py-0.5 flex">
+                <RecentFiltersDropdown
+                  recentFilters={filter.recentFilters}
+                  activeFilter={filter.appliedFilter}
+                  onSelect={filter.replaceFilter}
+                  onRemove={filter.removeRecentFilter}
+                  onTogglePin={filter.togglePinRecentFilter}
+                  onClear={filter.clearRecentFilters}
+                />
+              </div>
+            }
+            rightSlot={
+              <div className="py-0.5 flex">
+                <IconButton
+                  size="xs"
+                  icon="x"
+                  title="Close filter"
+                  iconColor="secondary"
+                  onClick={filter.toggleSearch}
+                  className="w-8 mr-0.5 h-auto!"
+                />
+              </div>
+            }
          />
        </div>,
      );
+    } else {
+      nodes.push(
+        <IconButton
+          key="icon"
+          size="sm"
+          isLoading={filterResult?.isPending ?? false}
+          icon="filter"
+          title="Filter response"
+          onClick={filter.toggleSearch}
+          className="border border-border-subtle!"
+        />,
+      );
    }

-    nodes.push(
-      <IconButton
-        key="icon"
-        size="sm"
-        isLoading={filteredResponse.isPending}
-        icon={isSearching ? "x" : "filter"}
-        title={isSearching ? "Close filter" : "Filter response"}
-        onClick={toggleSearch}
-        className={classNames("border border-border-subtle!", isSearching && "opacity-100!")}
-      />,
-    );
-
    return nodes;
  }, [
    canFilter,
    footerActions,
-    filterKey,
-    filterText,
-    filteredResponse.error,
-    filteredResponse.isPending,
+    filter,
+    filterResult?.isPending,
+    resultError,
    isSearching,
    language,
-    setFilterText,
-    toggleSearch,
+    handleFilterKeyDown,
  ]);

  const formattedBody = useFormatText({ text, language, pretty: pretty ?? false });
@@ -126,11 +138,11 @@ export function TextViewer({
  }

  let body: string;
-  if (isSearching && filterText?.length > 0) {
-    if (filteredResponse.error) {
+  if (appliedFilter) {
+    if (resultError) {
      body = "";
    } else {
-      body = filteredResponse.data != null ? filteredResponse.data : "";
+      body = filterResult?.data != null ? filterResult.data : "";
    }
  } else {
    body = formattedBody;
@@ -143,15 +155,61 @@ export function TextViewer({
  }

  return (
-    <Editor
-      readOnly
-      className={className}
-      defaultValue={body}
-      language={language}
-      actions={actions}
-      extraExtensions={extraExtensions}
-      stateKey={stateKey}
-    />
+    <div className="grid grid-rows-[auto_minmax(0,1fr)] h-full w-full">
+      {appliedFilter && filter != null ? (
+        <AppliedFilterBar
+          filter={appliedFilter}
+          error={resultError}
+          onClear={() => filter.replaceFilter("")}
+        />
+      ) : (
+        <span />
+      )}
+      <Editor
+        readOnly
+        className={className}
+        defaultValue={body}
+        language={language}
+        actions={actions}
+        extraExtensions={extraExtensions}
+        stateKey={stateKey}
+      />
+    </div>
+  );
+}
+
+/**
+ * Shows what's actually filtering the body, which the filter box below can't convey
+ * once it holds an edited expression that hasn't been applied yet.
+ */
+function AppliedFilterBar({
+  filter,
+  error,
+  onClear,
+}: {
+  filter: string;
+  error: boolean;
+  onClear: () => void;
+}) {
+  return (
+    <Banner color={error ? "danger" : "info"} className="py-1! mb-2! text-sm">
+      <HStack space={2} className="min-w-0">
+        <Icon icon="filter" size="xs" className="shrink-0 opacity-70" />
+        <span className="truncate min-w-0" title={filter}>
+          Response filtered by <InlineCode>{filter}</InlineCode>
+          {error && " (invalid expression)"}
+        </span>
+        <Button
+          size="2xs"
+          variant="border"
+          color={error ? "danger" : "info"}
+          className="ml-auto shrink-0"
+          onClick={onClear}
+        >
+          Clear
+        </Button>
+      </HStack>
+    </Banner>
  );
 }

@@ -1,18 +1,18 @@
 import { useEffect, useState } from "react";

 interface Props {
-  /** A URL the host resolved, for a body it already stored. */
-  url?: string;
+  /** A URL for the body the host already stored. */
+  bodyUrl?: string;
  data?: Uint8Array;
  mimeType?: string;
 }

-export function VideoViewer({ url, data, mimeType }: Props) {
+export function VideoViewer({ bodyUrl, data, mimeType }: Props) {
  const [src, setSrc] = useState<string>();

  useEffect(() => {
-    if (url) {
-      setSrc(url);
+    if (bodyUrl) {
+      setSrc(bodyUrl);
    } else if (data) {
      // As in AudioViewer: a media element trusts the declared type instead of sniffing
      const blob = new Blob([new Uint8Array(data)], { type: mimeType ?? "video/mp4" });
@@ -22,7 +22,7 @@ export function VideoViewer({ url, data, mimeType }: Props) {
    } else {
      setSrc(undefined);
    }
-  }, [url, data, mimeType]);
+  }, [bodyUrl, data, mimeType]);

  // oxlint-disable-next-line jsx-a11y/media-has-caption
  return <video className="w-full" controls src={src} />;
@@ -0,0 +1,18 @@
+import { useKeyValue } from "./useKeyValue";
+
+// The file a request's GraphQL schema is loaded from, or null when the schema
+// comes from an introspection request.
+//
+// This is the *source*, not the schema. The introspection row it produces is a
+// cache that expires on its own; this outlives it and regenerates it, the same
+// way gRPC keeps its proto file list separate from a reflection result.
+export function graphqlSchemaFileArgs(requestId: string | null) {
+  return {
+    namespace: "global" as const,
+    key: ["graphql_schema_file", requestId ?? "n/a"],
+  };
+}
+
+export function useGraphQLSchemaFile(requestId: string | null) {
+  return useKeyValue<string | null>({ ...graphqlSchemaFileArgs(requestId), fallback: null });
+}
@@ -1,13 +1,14 @@
 import { useQuery, useQueryClient } from "@tanstack/react-query";
-
 import type { GraphQlIntrospection, HttpRequest } from "@yaakapp-internal/models";
+import { platform } from "@yaakapp-internal/platform";
 import type { GraphQLSchema, IntrospectionQuery } from "graphql";
 import { buildClientSchema, getIntrospectionQuery } from "graphql";
-import { useCallback, useEffect, useMemo, useState } from "react";
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import { tryBuildIntrospectionFromFile } from "../lib/graphqlSchema";
 import { minPromiseMillis } from "../lib/minPromiseMillis";
-import { getResponseBodyText } from "../lib/responseBody";
 import { sendEphemeralRequest } from "../lib/sendEphemeralRequest";
 import { useActiveEnvironment } from "./useActiveEnvironment";
+import { useGraphQLSchemaFile } from "./useGraphQLSchemaFile";
 import { useDebouncedValue } from "@yaakapp-internal/ui";
 import { rpc } from "../lib/rpc";

@@ -31,6 +32,11 @@ export function useIntrospectGraphQL(

  const introspection = useIntrospectionResult(baseRequest);

+  // The schema's source. Outlives the introspection row it produces, so a
+  // request configured with a file keeps working after the row is swept.
+  const schemaFile = useGraphQLSchemaFile(baseRequest.id);
+  const filePath = schemaFile.value ?? null;
+
  const upsertIntrospection = useCallback(
    async (content: string | null) => {
      const v = await rpc<GraphQlIntrospection>("models_upsert_graphql_introspection", {
@@ -55,7 +61,7 @@ export function useIntrospectGraphQL(
        bodyType: "application/json",
        body: { text: introspectionRequestBody },
      };
-      const response = await minPromiseMillis(
+      const { response, body } = await minPromiseMillis(
        sendEphemeralRequest(args, activeEnvironment?.id ?? null),
        700,
      );
@@ -64,14 +70,16 @@ export function useIntrospectGraphQL(
        return setError(response.error);
      }

-      const bodyText = await getResponseBodyText({ response, filter: null });
+      // The send hands back the only copy of the body — an unsaved response has
+      // nothing on disk and no row to read it back from
+      const bodyText = new TextDecoder("utf-8").decode(new Uint8Array(body));
      if (response.status < 200 || response.status >= 300) {
        return setError(
          `Request failed with status ${response.status}.\nThe response text is:\n\n${bodyText}`,
        );
      }

-      if (bodyText === null) {
+      if (bodyText === "") {
        return setError("Empty body returned in response");
      }

@@ -91,15 +99,109 @@ export function useIntrospectGraphQL(
      return;
    }

-    refetch().catch(console.error);
-  }, [baseRequest.id, debouncedRequest.url, debouncedRequest.method, activeEnvironment?.id]);
+    // A request pointed at a file gets its schema from that file. Introspecting
+    // here would overwrite it on the next URL edit.
+    if (filePath != null) {
+      return;
+    }

+    refetch().catch(console.error);
+  }, [
+    baseRequest.id,
+    debouncedRequest.url,
+    debouncedRequest.method,
+    activeEnvironment?.id,
+    filePath,
+  ]);
+
+  // Clears the schema, not the source. Removing a file source is a separate
+  // action, because the source is what would rebuild this a moment later.
  const clear = useCallback(async () => {
    setError("");
    setSchema(null);
    await upsertIntrospection(null);
  }, [upsertIntrospection]);

+  // Reads a schema file and produces an introspection row from it, the same way
+  // `refetch` produces one from a server. Does not touch the stored source.
+  const introspectFromFile = useCallback(
+    async (path: string): Promise<{ ok: true } | { ok: false; error: string }> => {
+      try {
+        setIsLoading(true);
+        setError(undefined);
+
+        const fileContent = await platform.files.readText(path);
+        const result = tryBuildIntrospectionFromFile(fileContent);
+
+        if ("error" in result) {
+          setError(result.error);
+          return { ok: false, error: result.error };
+        }
+
+        await upsertIntrospection(result.content);
+        return { ok: true };
+      } catch (err) {
+        // The host rejects with a bare string for a missing or unreadable path,
+        // so this can't assume an Error.
+        const message = err instanceof Error ? err.message : String(err);
+        setError(message);
+        return { ok: false, error: message };
+      } finally {
+        setIsLoading(false);
+      }
+    },
+    [upsertIntrospection],
+  );
+
+  // Points the request at a file and immediately builds its schema from it.
+  const loadFromFile = useCallback(
+    async (path: string) => {
+      const result = await introspectFromFile(path);
+      if (result.ok) await schemaFile.set(path);
+      return result;
+    },
+    [introspectFromFile, schemaFile],
+  );
+
+  const reloadFromFile = useCallback(async () => {
+    if (filePath == null) return { ok: false as const, error: "No schema file to reload" };
+    return introspectFromFile(filePath);
+  }, [filePath, introspectFromFile]);
+
+  // The file-source counterpart of automatic introspection: re-read the file
+  // when the request is opened, so an edited schema is picked up without asking.
+  //
+  // A missing row is repaired even with the setting off — that is recovering
+  // from the 7-day sweep, not keeping the schema fresh, and skipping it would
+  // make the schema disappear with no visible cause.
+  const reloadedFor = useRef<string | null>(null);
+  useEffect(() => {
+    if (filePath == null || introspection.isLoading) return;
+    // Only attempt once per path, so an unreadable file doesn't spin.
+    if (reloadedFor.current === filePath) return;
+
+    const hasContent = (introspection.data?.content ?? "") !== "";
+    if (hasContent && options.disabled) return;
+
+    reloadedFor.current = filePath;
+    introspectFromFile(filePath).catch(console.error);
+  }, [
+    filePath,
+    introspection.data?.content,
+    introspection.isLoading,
+    introspectFromFile,
+    options.disabled,
+  ]);
+
+  // Stops using the file. The schema goes with it, since the file is what
+  // produced it; introspection repopulates if it's set to run automatically.
+  const removeSchemaFile = useCallback(async () => {
+    setError("");
+    setSchema(null);
+    await schemaFile.set(null);
+    await upsertIntrospection(null);
+  }, [schemaFile, upsertIntrospection]);
+
  useEffect(() => {
    if (introspection.data?.content == null || introspection.data.content === "") {
      return;
@@ -113,7 +215,17 @@ export function useIntrospectGraphQL(
    }
  }, [introspection.data?.content]);

-  return { schema, isLoading, error, refetch, clear };
+  return {
+    schema,
+    isLoading,
+    error,
+    refetch,
+    clear,
+    loadFromFile,
+    reloadFromFile,
+    removeSchemaFile,
+    filePath,
+  };
 }

 function useIntrospectionResult(request: HttpRequest) {
@@ -0,0 +1,67 @@
+import { useCallback } from "react";
+import { useKeyValue } from "./useKeyValue";
+
+export interface RecentFilter {
+  value: string;
+  pinned?: boolean;
+}
+
+const MAX_RECENT_FILTERS = 20;
+const kvKey = (filterStateKey: string) => `recent_filters::${filterStateKey}`;
+const namespace = "global";
+const fallback: RecentFilter[] = [];
+
+export function useRecentFilters(filterStateKey: string | null) {
+  const { value, set } = useKeyValue<RecentFilter[]>({
+    key: kvKey(filterStateKey ?? "n/a"),
+    namespace,
+    fallback,
+  });
+
+  const addFilter = useCallback(
+    async (rawValue: string) => {
+      const value = rawValue.trim();
+      if (filterStateKey == null || value === "") return;
+      await set((prev) => {
+        // Returning the same reference skips the write, so re-committing the
+        // expression already at the top (on every blur) costs nothing
+        if (prev[0]?.value === value) return prev;
+        const existing = prev.find((f) => f.value === value);
+        const rest = prev.filter((f) => f.value !== value);
+        return trim([{ value, pinned: existing?.pinned }, ...rest]);
+      });
+    },
+    [filterStateKey, set],
+  );
+
+  const removeFilter = useCallback(
+    async (value: string) => set((prev) => prev.filter((f) => f.value !== value)),
+    [set],
+  );
+
+  const togglePin = useCallback(
+    async (value: string) =>
+      set((prev) => prev.map((f) => (f.value === value ? { ...f, pinned: !f.pinned } : f))),
+    [set],
+  );
+
+  const clearFilters = useCallback(async () => set([]), [set]);
+
+  return { recentFilters: value ?? fallback, addFilter, removeFilter, togglePin, clearFilters };
+}
+
+/** Bound the list, evicting the oldest unpinned entries before any pinned ones */
+function trim(filters: RecentFilter[]): RecentFilter[] {
+  const excess = filters.length - MAX_RECENT_FILTERS;
+  if (excess <= 0) return filters;
+
+  const evicted = new Set<number>();
+  for (let i = filters.length - 1; i >= 0 && evicted.size < excess; i--) {
+    if (!filters[i]?.pinned) evicted.add(i);
+  }
+  for (let i = filters.length - 1; i >= 0 && evicted.size < excess; i--) {
+    evicted.add(i);
+  }
+
+  return filters.filter((_, i) => !evicted.has(i));
+}
@@ -2,6 +2,25 @@ import { useQuery } from "@tanstack/react-query";
 import type { HttpResponse } from "@yaakapp-internal/models";
 import { getResponseBodyBytes, getResponseBodyText } from "../lib/responseBody";

+export function responseBodyTextQuery({
+  response,
+  filter,
+}: {
+  response: HttpResponse;
+  filter: string | null;
+}) {
+  return {
+    queryKey: [
+      "response_body_text",
+      response.id,
+      response.updatedAt,
+      response.contentLength,
+      filter ?? "",
+    ],
+    queryFn: () => getResponseBodyText({ response, filter }),
+  };
+}
+
 export function useResponseBodyText({
  response,
  filter,
@@ -11,14 +30,7 @@ export function useResponseBodyText({
 }) {
  return useQuery({
    placeholderData: (prev) => prev, // Keep previous data on refetch
-    queryKey: [
-      "response_body_text",
-      response.id,
-      response.updatedAt,
-      response.contentLength,
-      filter ?? "",
-    ],
-    queryFn: () => getResponseBodyText({ response, filter }),
+    ...responseBodyTextQuery({ response, filter }),
  });
 }

@@ -18,6 +18,7 @@ export function useResponseBodyUrl(response: HttpResponse | null) {
  return useQuery({
    queryKey: ["response_body_url", responseId, response?.updatedAt ?? ""],
    enabled: responseId != null,
-    queryFn: () => (responseId == null ? null : platform.files.responseBodyUrl(responseId)),
+    // A response body is stored under the response's own id
+    queryFn: () => (responseId == null ? null : platform.blobs.url(responseId)),
  });
 }
@@ -0,0 +1,129 @@
+import { useCallback, useState } from "react";
+import { createGlobalState } from "react-use";
+import type { RecentFilter } from "./useRecentFilters";
+import { useRecentFilters } from "./useRecentFilters";
+
+/** What's typed in the filter box. `null` means the filter box is closed */
+const useFilterTextMap = createGlobalState<Record<string, string | null>>({});
+
+/** What's actually applied to the response. Only changes on an explicit apply */
+const useAppliedFilterMap = createGlobalState<Record<string, string | null>>({});
+
+export interface ResponseFilterApi {
+  stateKey: string | null;
+  /** Draft text in the filter box, or `null` when the box is closed */
+  filterText: string | null;
+  /** The expression currently filtering the response */
+  appliedFilter: string | null;
+  isSearching: boolean;
+  /** The box holds an expression that isn't the one currently applied */
+  isDirty: boolean;
+  /** Bumped when the (uncontrolled) filter input must re-read its defaultValue */
+  filterUpdateKey: number;
+  setFilterText: (value: string | null) => void;
+  /** Apply the expression to the response, recording it if the filter accepts it */
+  applyFilter: (value: string) => void;
+  /** Like applyFilter, but also replaces what's shown in the filter box */
+  replaceFilter: (value: string) => void;
+  toggleSearch: () => void;
+  recentFilters: RecentFilter[];
+  removeRecentFilter: (value: string) => void;
+  togglePinRecentFilter: (value: string) => void;
+  clearRecentFilters: () => void;
+}
+
+/**
+ * Draft/applied state and history for a response filter (JSONPath/XPath).
+ *
+ * History records at most one entry per apply gesture, and only after `runFilter`
+ * confirms the plugin accepts the expression — the plugin is the sole judge of
+ * validity. Because nothing but the gesture ever writes, refetches can't resurrect
+ * deleted entries and a gesture can't record into another request's history.
+ */
+export function useResponseFilter({
+  stateKey,
+  runFilter,
+}: {
+  stateKey: string | null;
+  /** Evaluate an expression, rejecting if the filter plugin reports an error */
+  runFilter: (filter: string) => Promise<unknown>;
+}): ResponseFilterApi {
+  const [filterTextMap, setFilterTextMap] = useFilterTextMap();
+  const [appliedFilterMap, setAppliedFilterMap] = useAppliedFilterMap();
+  const filterText = stateKey ? (filterTextMap[stateKey] ?? null) : null;
+  const appliedFilter = stateKey ? (appliedFilterMap[stateKey] ?? null) : null;
+
+  const setFilterText = useCallback(
+    (v: string | null) => {
+      if (!stateKey) return;
+      setFilterTextMap((m) => ({ ...m, [stateKey]: v }));
+    },
+    [stateKey, setFilterTextMap],
+  );
+
+  const setAppliedFilter = useCallback(
+    (v: string | null) => {
+      if (!stateKey) return;
+      setAppliedFilterMap((m) => ({ ...m, [stateKey]: v }));
+    },
+    [stateKey, setAppliedFilterMap],
+  );
+
+  const {
+    recentFilters,
+    addFilter,
+    removeFilter: removeRecentFilter,
+    togglePin: togglePinRecentFilter,
+    clearFilters: clearRecentFilters,
+  } = useRecentFilters(stateKey);
+
+  const applyFilter = useCallback(
+    (value: string) => {
+      setFilterText(value);
+      const applied = value.trim() === "" ? null : value.trim();
+      setAppliedFilter(applied);
+      if (applied == null) return;
+      runFilter(applied).then(
+        () => addFilter(applied),
+        () => {}, // Rejected by the filter plugin — don't record
+      );
+    },
+    [setFilterText, setAppliedFilter, runFilter, addFilter],
+  );
+
+  const [filterUpdateKey, setFilterUpdateKey] = useState(0);
+  const replaceFilter = useCallback(
+    (value: string) => {
+      applyFilter(value);
+      setFilterUpdateKey((k) => k + 1);
+    },
+    [applyFilter],
+  );
+
+  const isSearching = filterText != null;
+  const toggleSearch = useCallback(() => {
+    if (isSearching) {
+      setFilterText(null);
+      setAppliedFilter(null);
+    } else {
+      setFilterText("");
+    }
+  }, [isSearching, setFilterText, setAppliedFilter]);
+
+  return {
+    stateKey,
+    filterText,
+    appliedFilter,
+    isSearching,
+    isDirty: filterText != null && filterText.trim() !== (appliedFilter ?? ""),
+    filterUpdateKey,
+    setFilterText,
+    applyFilter,
+    replaceFilter,
+    toggleSearch,
+    recentFilters,
+    removeRecentFilter,
+    togglePinRecentFilter,
+    clearRecentFilters,
+  };
+}
@@ -25,6 +25,10 @@ export function useSaveResponse(response: HttpResponse | null) {
        defaultPath: ext ? `${slug}.${ext}` : slug,
        title: "Save Response",
      });
+      if (filepath == null) {
+        return; // Cancelled
+      }
+
      await rpc("cmd_save_response", { responseId: response.id, filepath });
      showToast({
        message: (
@@ -0,0 +1,85 @@
+import { buildSchema, introspectionFromSchema } from "graphql";
+import { describe, expect, test } from "vite-plus/test";
+import { tryBuildIntrospectionFromFile } from "./graphqlSchema";
+
+const sdl = `
+  type Query {
+    hello: String!
+    user(id: ID!): User
+  }
+
+  type User {
+    id: ID!
+    name: String
+  }
+`;
+
+const introspection = introspectionFromSchema(buildSchema(sdl));
+
+describe("tryBuildIntrospectionFromFile", () => {
+  test("accepts introspection JSON wrapped in { data: ... }", () => {
+    const input = JSON.stringify({ data: introspection });
+    const result = tryBuildIntrospectionFromFile(input);
+
+    expect("schema" in result).toBe(true);
+    if ("schema" in result) {
+      expect(result.schema.getQueryType()?.getFields()).toHaveProperty("hello");
+      // Output content is the normalized, persistable shape.
+      expect(JSON.parse(result.content)).toHaveProperty("data.__schema");
+    }
+  });
+
+  test("accepts bare introspection JSON without a data wrapper", () => {
+    const input = JSON.stringify(introspection);
+    const result = tryBuildIntrospectionFromFile(input);
+
+    expect("schema" in result).toBe(true);
+    if ("schema" in result) {
+      expect(result.schema.getQueryType()?.getFields()).toHaveProperty("user");
+      // Bare input is wrapped on the way out.
+      expect(JSON.parse(result.content)).toHaveProperty("data.__schema");
+    }
+  });
+
+  test("accepts a GraphQL SDL string", () => {
+    const result = tryBuildIntrospectionFromFile(sdl);
+
+    expect("schema" in result).toBe(true);
+    if ("schema" in result) {
+      const fields = result.schema.getQueryType()?.getFields() ?? {};
+      expect(fields).toHaveProperty("hello");
+      expect(fields).toHaveProperty("user");
+      // SDL is converted to introspection JSON for storage.
+      expect(JSON.parse(result.content)).toHaveProperty("data.__schema");
+    }
+  });
+
+  test("returns an error for JSON that is neither introspection nor SDL", () => {
+    const result = tryBuildIntrospectionFromFile('{"unrelated":"value"}');
+
+    expect("error" in result).toBe(true);
+    if ("error" in result) {
+      expect(result.error).toMatch(/Could not parse file as introspection JSON or GraphQL SDL/);
+    }
+  });
+
+  test("returns an error for content that is neither valid JSON nor valid SDL", () => {
+    const result = tryBuildIntrospectionFromFile("not a schema!@#$");
+
+    expect("error" in result).toBe(true);
+    if ("error" in result) {
+      expect(result.error).toMatch(/Could not parse file as introspection JSON or GraphQL SDL/);
+    }
+  });
+
+  test("returns an error when introspection JSON has a malformed __schema", () => {
+    // Has the data.__schema shape but the contents are invalid for buildClientSchema.
+    const input = JSON.stringify({ data: { __schema: { broken: true } } });
+    const result = tryBuildIntrospectionFromFile(input);
+
+    expect("error" in result).toBe(true);
+    if ("error" in result) {
+      expect(result.error).toMatch(/Failed to build schema from introspection JSON/);
+    }
+  });
+});
@@ -0,0 +1,51 @@
+import type { GraphQLSchema, IntrospectionQuery } from "graphql";
+import { buildClientSchema, buildSchema, introspectionFromSchema } from "graphql";
+
+// Accepts either a GraphQL introspection JSON ({ data: { __schema } } or
+// { __schema }) or an SDL string and normalizes both into the wrapped
+// { data: <introspection> } JSON shape used by the introspection store.
+export function tryBuildIntrospectionFromFile(
+  fileContent: string,
+): { schema: GraphQLSchema; content: string } | { error: string } {
+  let parsedJson: unknown;
+  try {
+    parsedJson = JSON.parse(fileContent);
+  } catch {
+    parsedJson = undefined;
+  }
+
+  if (parsedJson != null && typeof parsedJson === "object") {
+    const candidates: unknown[] = [(parsedJson as { data?: unknown }).data, parsedJson];
+
+    for (const candidate of candidates) {
+      if (
+        candidate != null &&
+        typeof candidate === "object" &&
+        "__schema" in (candidate as Record<string, unknown>)
+      ) {
+        try {
+          const schema = buildClientSchema(candidate as IntrospectionQuery, {});
+          return { schema, content: JSON.stringify({ data: candidate }) };
+        } catch (e) {
+          return {
+            error: `Failed to build schema from introspection JSON: ${errorMessage(e)}`,
+          };
+        }
+      }
+    }
+  }
+
+  try {
+    const schema = buildSchema(fileContent);
+    const introspection = introspectionFromSchema(schema);
+    return { schema, content: JSON.stringify({ data: introspection }) };
+  } catch (e) {
+    return {
+      error: `Could not parse file as introspection JSON or GraphQL SDL: ${errorMessage(e)}`,
+    };
+  }
+}
+
+function errorMessage(e: unknown): string {
+  return e instanceof Error ? e.message : String(e);
+}
@@ -2,11 +2,9 @@ import type { BatchUpsertResult } from "@yaakapp-internal/models";
 import { FormattedError, VStack } from "@yaakapp-internal/ui";
 import { Button } from "../components/core/Button";
 import { ImportDataDialog } from "../components/ImportDataDialog";
-import { activeWorkspaceAtom } from "../hooks/useActiveWorkspace";
 import { createFastMutation } from "../hooks/useFastMutation";
 import { showAlert } from "./alert";
 import { showDialog } from "./dialog";
-import { jotaiStore } from "./jotai";
 import { pluralizeCount } from "./pluralize";
 import { router } from "./router";
 import { rpc } from "./rpc";
@@ -28,12 +26,9 @@ export const importData = createFastMutation({
        title: "Import Data",
        size: "sm",
        render: ({ hide }) => {
-          const importAndHide = async (filePath: string) => {
+          const importAndHide = async (runImport: () => Promise<BatchUpsertResult>) => {
            try {
-              const didImport = await performImport(filePath);
-              if (!didImport) {
-                return;
-              }
+              await finishImport(await runImport());
              resolve();
            } catch (err) {
              reject(err);
@@ -41,20 +36,23 @@ export const importData = createFastMutation({
              hide();
            }
          };
-          return <ImportDataDialog importData={importAndHide} />;
+          return (
+            <ImportDataDialog
+              importFile={(filePath) =>
+                importAndHide(() => rpc<BatchUpsertResult>("cmd_import_data", { filePath }))
+              }
+              importUrl={(url) =>
+                importAndHide(() => rpc<BatchUpsertResult>("cmd_import_url", { url }))
+              }
+            />
+          );
        },
      });
    });
  },
 });

-async function performImport(filePath: string): Promise<boolean> {
-  const activeWorkspace = jotaiStore.get(activeWorkspaceAtom);
-  const imported = await rpc<BatchUpsertResult>("cmd_import_data", {
-    filePath,
-    workspaceId: activeWorkspace?.id,
-  });
-
+async function finishImport(imported: BatchUpsertResult): Promise<void> {
  const importedWorkspace = imported.workspaces[0];

  showDialog({
@@ -103,6 +101,4 @@ async function performImport(filePath: string): Promise<boolean> {
      search: { environment_id: environmentId },
    });
  }
-
-  return true;
 }
@@ -68,7 +68,8 @@ export async function getResponseBodySseSummary(
 export async function getResponseBodyBytes(
  response: HttpResponse,
 ): Promise<Uint8Array<ArrayBuffer> | null> {
-  return platform.files.readResponseBody(response.id);
+  // A response body is stored under the response's own id
+  return platform.blobs.read(response.id);
 }

 async function getResponseBodyDecoded(response: HttpResponse): Promise<string | null> {
@@ -1,6 +1,6 @@
 import type { RpcPayload } from "@yaakapp-internal/platform";
 import { platform } from "@yaakapp-internal/platform";
-import type { RpcSchema } from "@yaakapp-internal/tauri-client";
+import type { RpcSchema } from "@yaakapp-internal/rpc-schema";

 /**
 * Every backend command the app can call: the generated wire schema, one field
@@ -1,11 +1,12 @@
-import type { HttpRequest, HttpResponse } from "@yaakapp-internal/models";
+import type { HttpRequest } from "@yaakapp-internal/models";
+import type { EphemeralHttpResponse } from "@yaakapp-internal/rpc-schema";
 import { getActiveCookieJar } from "../hooks/useActiveCookieJar";
 import { rpc } from "./rpc";

 export async function sendEphemeralRequest(
  request: HttpRequest,
  environmentId: string | null,
-): Promise<HttpResponse> {
+): Promise<EphemeralHttpResponse> {
  // Remove some things that we don't want to associate
  const newRequest = { ...request };
  return rpc("cmd_send_ephemeral_request", {
@@ -17,9 +17,37 @@ const standardFontsDir = normalizePath(
  path.join(path.dirname(require.resolve("pdfjs-dist/package.json")), "standard_fonts"),
 );

+/**
+ * Which host the platform package installs. `web` builds Yaak to run in a plain
+ * browser tab, with its own IndexedDB store instead of the Rust engine; anything
+ * else builds the desktop app exactly as before.
+ */
+const yaakTarget = process.env.YAAK_TARGET === "web" ? "web" : "desktop";
+
 // https://vitejs.dev/config/
 export default defineConfig(async () => {
  return {
+    resolve: {
+      alias:
+        yaakTarget === "web"
+          ? {
+              // Resolve the platform package to its browser entry, so a web
+              // build never pulls `@tauri-apps/*` into the graph at all. A
+              // build-time branch inside the package would not manage that:
+              // the dead branch folds away, but the imports it guarded stay.
+              "@yaakapp-internal/platform": path.resolve(
+                import.meta.dirname,
+                "../../packages/platform/src/index.web.ts",
+              ),
+            }
+          : {},
+    },
+    // The browser host runs the model layer in a worker; that bundle needs the
+    // same wasm and top-level-await handling as the main one.
+    worker: {
+      format: "es" as const,
+      plugins: () => [wasm(), topLevelAwait()],
+    },
    plugins: [
      wasm(),
      tanstackRouter({
@@ -1,5 +1,7 @@
 use crate::context::CliExecutionContext;
 use arboard::Clipboard;
+use base64::Engine;
+use base64::prelude::BASE64_STANDARD;
 use console::Term;
 use inquire::{Confirm, Editor, Password, PasswordDisplayMode, Select, Text};
 use serde_json::Value;
@@ -12,6 +14,7 @@ use yaak::plugin_events::{
    GroupedPluginEvent, HostRequest, SharedPluginEventContext, handle_shared_plugin_event,
 };
 use yaak::render::{render_grpc_request, render_http_request};
+use yaak::response_body::FileResponseBodyStore;
 use yaak::send::{SendHttpRequestWithPluginsParams, send_http_request_with_plugins};
 use yaak_crypto::manager::EncryptionManager;
 use yaak_http::cookies::get_cookie_value_from_jar;
@@ -131,6 +134,7 @@ async fn build_plugin_reply(

    match handle_shared_plugin_event(
        &host_context.query_manager,
+        &FileResponseBodyStore::new(&host_context.query_manager),
        &event.payload,
        SharedPluginEventContext { plugin_name, workspace_id: shared_workspace_id },
    ) {
@@ -223,7 +227,15 @@ async fn build_plugin_reply(
                .await
                {
                    Ok(result) => Some(InternalEventPayload::SendHttpRequestResponse(
-                        SendHttpRequestResponse { http_response: result.response },
+                        SendHttpRequestResponse {
+                            http_response: result.response,
+                            // Nothing saved this body, so the reply is the only
+                            // place the plugin can get it.
+                            body: result
+                                .response_body
+                                .returned_bytes()
+                                .map(|b| BASE64_STANDARD.encode(b)),
+                        },
                    )),
                    Err(err) => Some(InternalEventPayload::ErrorResponse(ErrorResponse {
                        error: format!("Failed to send HTTP request in CLI: {err}"),
@@ -10,9 +10,9 @@ chrono = { workspace = true, features = ["serde"] }
 log = { workspace = true }
 include_dir = "0.7"
 r2d2 = "0.8.10"
-r2d2_sqlite = "0.25.0"
-rusqlite = { version = "0.32.1", features = ["bundled", "chrono"] }
-sea-query = { version = "0.32.1", features = ["with-chrono", "attr"] }
+r2d2_sqlite = "0.32"
+rusqlite = { version = "0.38", features = ["bundled", "chrono"] }
+sea-query = { version = "1.0", features = ["with-chrono", "attr"] }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
 ts-rs = { workspace = true, features = ["chrono-impl"] }
@@ -1,47 +0,0 @@
-[package]
-name = "yaak-server"
-version = "0.1.0"
-edition = "2024"
-publish = false
-
-[[bin]]
-name = "yaak-bridge"
-path = "src/main.rs"
-
-[dependencies]
-axum = { version = "0.7", features = ["ws", "macros"] }
-charset = "0.1"
-chrono = { workspace = true }
-clap = { version = "4", features = ["derive", "env"] }
-dirs = "6"
-env_logger = "0.11"
-eventsource-client = { git = "https://github.com/yaakapp/rust-eventsource-client", version = "0.14.0" }
-futures = "0.3"
-include_dir = "0.7"
-log = { workspace = true }
-mime_guess = "2"
-pretty_graphql = "0.2"
-rand = "0.8"
-serde = { workspace = true }
-serde_json = { workspace = true }
-serde_urlencoded = "0.7"
-tokio = { workspace = true, features = [
-  "rt-multi-thread",
-  "macros",
-  "io-util",
-  "net",
-  "signal",
-  "time",
-  "sync",
-] }
-tower-http = { version = "0.6", features = ["cors", "fs", "trace"] }
-yaak = { workspace = true }
-yaak-common = { workspace = true }
-yaak-core = { workspace = true }
-yaak-crypto = { workspace = true }
-yaak-http = { workspace = true }
-yaak-models = { workspace = true }
-yaak-plugins = { workspace = true }
-yaak-rpc = { workspace = true }
-yaak-sse = { workspace = true }
-yaak-templates = { workspace = true }
@@ -1,94 +0,0 @@
-# Yaak Bridge
-
-A headless binary that runs the real Yaak engine for a browser tab.
-
-The tab is the unmodified Yaak UI. Everything a page cannot do — send an HTTP
-request and see every response header, follow redirects, keep a cookie jar, run
-the plugin runtime, read a response body off disk — happens in this process,
-reached over local HTTP and a WebSocket.
-
-This is the reason a browser Yaak can be credible at all. An in-page `fetch`
-sender only ever sees the CORS-safelisted response headers: measured against
-httpbin, a server that sent 8 headers yielded 2. Through the bridge the same
-request yields all 8, plus the redirect chain, `Set-Cookie`, connection timings
-and client certificates.
-
-## Running it
-
-Start the bridge:
-
-```bash
-cargo run -p yaak-server -- --port 9444
-```
-
-It binds `127.0.0.1` only and prints a bearer token that every route requires.
-
-Then point a frontend at it. In dev, run Vite separately and tell it where the
-bridge is:
-
-```bash
-YAAK_CLIENT_DEV_PORT=1472 VITE_YAAK_BRIDGE_URL=http://127.0.0.1:9444 npm run dev --workspace apps/yaak-client
-```
-
-Open `http://localhost:1472/?bridgeToken=<token>`. The token is consumed from
-the query, kept for the session, and stripped from the address bar. Without one
-you get a small connect form.
-
-To serve the built frontend from the bridge itself instead, so there is only one
-process:
-
-```bash
-npm run build --workspace apps/yaak-client
-cargo run -p yaak-server -- --web-dir dist/apps/yaak-client
-```
-
-## Shape
-
-| Route | What it carries |
-| --- | --- |
-| `POST /rpc` | The yaak-rpc envelope, the same one Tauri's `invoke` wraps on the desktop |
-| `GET /events` | WebSocket. Server to client: `model_writes`, `stream_{id}`, toasts, plugin events. Client to server: the tab's location, and replies to prompts |
-| `GET /responses/:id/body` | Response bodies, with Range support. Replaces reading `bodyPath` off disk |
-| `GET /bridge/info` | Capabilities and the implemented command list |
-
-Auth is a bearer token in the `Authorization` header, or a `token` query
-parameter for the two requests the browser issues itself (the WebSocket, and
-`<img src>`-style body loads). It is dev-grade and deliberately minimal: OTP
-pairing and request encryption replace it, and `require_token` in `http.rs` is
-where they go.
-
-## Relationship to the other hosts
-
-The engine crates under `crates/` are Tauri-free, and `crates-cli/yaak-cli`
-already proved they run headless. This crate is structurally the CLI's
-`CliContext` with an event hub attached — same `init_standalone` database, same
-`PluginManager` over the same Node sidecar.
-
-Two things are ported deliberately rather than invented:
-
- **Model writes** (`model_writes.rs`) keep the desktop's two paths: an
-  in-memory channel for writes this process made, and a poll of the
-  `model_changes` table so external writers — the CLI, the desktop app open on
-  the same database — show up live in the browser.
- **Plugin host requests** (`plugin_events.rs`) let `yaak::plugin_events`
-  answer everything that is only a database question, exactly as the CLI and the
-  desktop do. Only the host-specific arms differ, and where the CLI answers a
-  prompt from a TTY, the bridge round-trips it to the tab the way the desktop
-  round-trips it to a window.
-
-## Known gaps
-
- **Settings is unreachable.** The desktop opens it via `cmd_new_child_window`.
-  A tab is one window, `multiWindow` is false, and this task did not add in-page
-  routing for it.
- **One tab at a time.** Model writes broadcast correctly to every connected
-  tab, so two tabs stay in sync for reads. What breaks is the session: the
-  tab's reported URL lives in a single slot, so with two tabs in different
-  workspaces a plugin's template render resolves against whichever attached
-  last. Prompts also broadcast, so a dialog raised by one tab appears in both.
- **No local files.** There is no file dialog, so request bodies from disk,
-  export, and save-response are unsupported. `cmd_import_data` is registered and
-  works, but only for a path typed by hand on the bridge's machine.
- **Command subset.** Roughly 40 of the desktop's 107 commands are implemented.
-  The rest return a structured "not supported on this host" error naming the
-  command; `UNSUPPORTED_COMMANDS` in `rpc/mod.rs` lists them.
@@ -1,117 +0,0 @@
-//! The events channel: everything the browser tab would have received as a
-//! Tauri window event.
-//!
-//! Two directions ride the same WebSocket. Server to client is a broadcast, so
-//! `model_writes`, `stream_{id}` messages, toasts and plugin events all reach
-//! the tab through one pipe. Client to server exists because some plugin host
-//! requests are questions — a prompt round-trips through the UI and comes back
-//! keyed by the originating event's id, exactly as the desktop app's
-//! `call_frontend` does with window events.
-
-use serde::{Deserialize, Serialize};
-use std::collections::HashMap;
-use std::sync::{Arc, Mutex};
-use tokio::sync::{broadcast, mpsc};
-
-/// One frame in either direction: a name and a JSON payload.
-///
-/// Deliberately the same shape both ways, and the same shape as the desktop's
-/// event payloads, so `platform.listen` on the browser side hands the payload
-/// to callers unwrapped.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct EventFrame {
-    pub event: String,
-    #[serde(default)]
-    pub payload: serde_json::Value,
-}
-
-#[derive(Clone)]
-pub struct EventHub {
-    outbound: broadcast::Sender<EventFrame>,
-    /// Listeners waiting on a named event from the client, keyed by event name.
-    inbound: Arc<Mutex<HashMap<String, Vec<mpsc::UnboundedSender<serde_json::Value>>>>>,
-}
-
-/// A subscription to one named client-sent event. Deregisters on drop, so a
-/// prompt that is never answered doesn't leak a listener for the process's life.
-pub struct InboundSubscription {
-    event: String,
-    rx: mpsc::UnboundedReceiver<serde_json::Value>,
-    inbound: Arc<Mutex<HashMap<String, Vec<mpsc::UnboundedSender<serde_json::Value>>>>>,
-}
-
-impl InboundSubscription {
-    pub async fn recv(&mut self) -> Option<serde_json::Value> {
-        self.rx.recv().await
-    }
-}
-
-impl Drop for InboundSubscription {
-    fn drop(&mut self) {
-        let mut inbound = match self.inbound.lock() {
-            Ok(inbound) => inbound,
-            Err(poisoned) => poisoned.into_inner(),
-        };
-        if let Some(senders) = inbound.get_mut(&self.event) {
-            senders.retain(|tx| !tx.is_closed());
-            if senders.is_empty() {
-                inbound.remove(&self.event);
-            }
-        }
-    }
-}
-
-impl EventHub {
-    pub fn new() -> Self {
-        // Bounded: a tab that stops reading gets dropped frames rather than
-        // growing the server's memory without limit. Model writes are the
-        // high-volume case (imports, bulk deletes) and they arrive in batches.
-        let (outbound, _) = broadcast::channel(1024);
-        Self { outbound, inbound: Arc::new(Mutex::new(HashMap::new())) }
-    }
-
-    /// Send an event to every connected tab. Fails silently when none is
-    /// connected, which is the normal state before a browser attaches.
-    pub fn emit<T: Serialize>(&self, event: impl Into<String>, payload: &T) {
-        let payload = match serde_json::to_value(payload) {
-            Ok(payload) => payload,
-            Err(e) => {
-                log::warn!("Failed to serialize event payload: {e}");
-                return;
-            }
-        };
-        let _ = self.outbound.send(EventFrame { event: event.into(), payload });
-    }
-
-    pub fn subscribe(&self) -> broadcast::Receiver<EventFrame> {
-        self.outbound.subscribe()
-    }
-
-    /// Listen for a named event sent *by* the client.
-    pub fn subscribe_inbound(&self, event: impl Into<String>) -> InboundSubscription {
-        let event = event.into();
-        let (tx, rx) = mpsc::unbounded_channel();
-        let mut inbound = match self.inbound.lock() {
-            Ok(inbound) => inbound,
-            Err(poisoned) => poisoned.into_inner(),
-        };
-        inbound.entry(event.clone()).or_default().push(tx);
-        drop(inbound);
-        InboundSubscription { event, rx, inbound: Arc::clone(&self.inbound) }
-    }
-
-    /// Route a frame that arrived from a tab to whoever is waiting on it.
-    pub fn dispatch_inbound(&self, frame: EventFrame) {
-        let mut inbound = match self.inbound.lock() {
-            Ok(inbound) => inbound,
-            Err(poisoned) => poisoned.into_inner(),
-        };
-        let Some(senders) = inbound.get_mut(&frame.event) else {
-            return;
-        };
-        senders.retain(|tx| tx.send(frame.payload.clone()).is_ok());
-        if senders.is_empty() {
-            inbound.remove(&frame.event);
-        }
-    }
-}
@@ -1,355 +0,0 @@
-//! The front door: one HTTP surface for the browser tab.
-//!
-//! Three routes carry everything. `POST /rpc` is the yaak-rpc envelope, byte for
-//! byte what the desktop puts inside Tauri's `invoke`. `GET /events` is the
-//! WebSocket that replaces window events, in both directions. And
-//! `GET /responses/:id/body` replaces reading `bodyPath` off disk, which a tab
-//! cannot do.
-
-use crate::events::EventFrame;
-use crate::rpc::BridgeCtx;
-use crate::session::SessionContext;
-use crate::state::BridgeState;
-use axum::body::Body;
-use axum::extract::ws::{Message, WebSocket, WebSocketUpgrade};
-use axum::extract::{Path, Query, Request, State};
-use axum::http::{HeaderMap, StatusCode, header};
-use axum::middleware::Next;
-use axum::response::{IntoResponse, Response};
-use axum::routing::{get, post};
-use axum::{Json, Router};
-use serde::{Deserialize, Serialize};
-use std::sync::Arc;
-use tokio::io::{AsyncReadExt, AsyncSeekExt};
-use tower_http::cors::CorsLayer;
-use yaak_rpc::{RpcRequest, RpcResponse, RpcRouter};
-
-#[derive(Clone)]
-pub struct AppState {
-    pub state: Arc<BridgeState>,
-    pub router: Arc<RpcRouter<BridgeCtx>>,
-}
-
-pub fn build_app(state: Arc<BridgeState>, router: Arc<RpcRouter<BridgeCtx>>) -> Router {
-    let app_state = AppState { state: state.clone(), router };
-
-    let api = Router::new()
-        .route("/bridge/info", get(bridge_info))
-        .route("/rpc", post(rpc_handler))
-        .route("/events", get(events_handler))
-        .route("/responses/:id/body", get(response_body))
-        .layer(axum::middleware::from_fn_with_state(state.clone(), require_token))
-        // The dev setup serves the frontend from Vite on another port, so the
-        // tab's origin is not the bridge's. Credentials never ride on cookies
-        // here — the token is explicit — so a permissive CORS layer is safe and
-        // is bounded by the token check that runs before it.
-        .layer(CorsLayer::permissive())
-        .with_state(app_state);
-
-    match std::env::var("YAAK_BRIDGE_WEB_DIR").ok() {
-        // Serving the built frontend makes the bridge a single process to run.
-        // `index.html` is the fallback because the router owns the paths.
-        Some(dir) => api.fallback_service(
-            tower_http::services::ServeDir::new(&dir)
-                .fallback(tower_http::services::ServeFile::new(format!("{dir}/index.html"))),
-        ),
-        None => api,
-    }
-}
-
-// -- Auth --
-
-#[derive(Debug, Deserialize)]
-struct TokenQuery {
-    token: Option<String>,
-}
-
-/// Dev-grade bearer check on every route.
-///
-/// The header is the normal path. The query parameter exists because two of
-/// these are opened by the browser itself — the WebSocket and the `<img src>`
-/// pointing at a response body — and neither lets the page set headers.
-///
-/// This is the seam where OTP pairing and per-session keys go. It is not one
-/// today: the token is a process-lifetime shared secret, and anything that can
-/// read the tab's URL can read it.
-async fn require_token(
-    State(state): State<Arc<BridgeState>>,
-    request: Request,
-    next: Next,
-) -> Response {
-    let from_header = request
-        .headers()
-        .get(header::AUTHORIZATION)
-        .and_then(|v| v.to_str().ok())
-        .and_then(|v| v.strip_prefix("Bearer "))
-        .map(|v| v.to_string());
-
-    let from_query = request
-        .uri()
-        .query()
-        .and_then(|q| serde_urlencoded::from_str::<TokenQuery>(q).ok())
-        .and_then(|q| q.token);
-
-    let presented = from_header.or(from_query);
-
-    match presented {
-        Some(token) if constant_time_eq(&token, &state.token) => next.run(request).await,
-        _ => (StatusCode::UNAUTHORIZED, "Invalid or missing bridge token").into_response(),
-    }
-}
-
-/// Compares without returning early on the first differing byte, so a caller
-/// can't learn the token one character at a time.
-fn constant_time_eq(a: &str, b: &str) -> bool {
-    if a.len() != b.len() {
-        return false;
-    }
-    a.bytes().zip(b.bytes()).fold(0u8, |acc, (x, y)| acc | (x ^ y)) == 0
-}
-
-// -- Routes --
-
-#[derive(Debug, Serialize)]
-#[serde(rename_all = "camelCase")]
-struct BridgeInfo {
-    name: String,
-    version: String,
-    capabilities: crate::state::BridgeCapabilities,
-    /// Commands this build implements. The browser host uses it to fail fast
-    /// with a clear message instead of waiting for a round trip.
-    commands: Vec<String>,
-}
-
-async fn bridge_info(State(app): State<AppState>) -> Json<BridgeInfo> {
-    Json(BridgeInfo {
-        name: "Yaak Bridge".to_string(),
-        version: env!("CARGO_PKG_VERSION").to_string(),
-        capabilities: app.state.capabilities.clone(),
-        commands: crate::rpc::implemented_commands(&app.router),
-    })
-}
-
-/// One envelope in, one out. Errors are carried inside the envelope, not as an
-/// HTTP status, so the browser host can reject the caller's promise with the
-/// backend's own message.
-async fn rpc_handler(
-    State(app): State<AppState>,
-    Json(req): Json<RpcRequest>,
-) -> Json<RpcResponse> {
-    let ctx = BridgeCtx { state: app.state.clone(), session: app.state.session.get() };
-    log::debug!("RPC {}", req.cmd);
-    let response = app.router.handle(req, &ctx).await;
-    if let RpcResponse::Error { error, .. } = &response {
-        log::warn!("RPC failed: {error}");
-    }
-    Json(response)
-}
-
-async fn events_handler(State(app): State<AppState>, ws: WebSocketUpgrade) -> Response {
-    ws.on_upgrade(move |socket| handle_events_socket(socket, app))
-}
-
-/// The tab's first frame reports who and where it is; everything after that is
-/// a reply to something the server asked.
-#[derive(Debug, Deserialize)]
-#[serde(rename_all = "camelCase")]
-struct AttachPayload {
-    label: String,
-    url: String,
-}
-
-async fn handle_events_socket(socket: WebSocket, app: AppState) {
-    use futures::{SinkExt, StreamExt};
-
-    let (mut sink, mut stream) = socket.split();
-    let mut outbound = app.state.events.subscribe();
-
-    // Server to client.
-    let send_task = tokio::spawn(async move {
-        loop {
-            match outbound.recv().await {
-                Ok(frame) => {
-                    let Ok(text) = serde_json::to_string(&frame) else {
-                        continue;
-                    };
-                    if sink.send(Message::Text(text)).await.is_err() {
-                        break;
-                    }
-                }
-                // A tab that fell behind has missed writes, and the model store
-                // would be silently stale. Close instead, so a reconnect
-                // re-reads the workspace from scratch.
-                Err(tokio::sync::broadcast::error::RecvError::Lagged(n)) => {
-                    log::warn!("Events client lagged by {n} frames; closing so it resyncs");
-                    break;
-                }
-                Err(tokio::sync::broadcast::error::RecvError::Closed) => break,
-            }
-        }
-    });
-
-    // Client to server.
-    let state = app.state.clone();
-    let recv_task = tokio::spawn(async move {
-        while let Some(Ok(message)) = stream.next().await {
-            let Message::Text(text) = message else {
-                continue;
-            };
-            let Ok(frame) = serde_json::from_str::<EventFrame>(&text) else {
-                log::warn!("Ignoring malformed event frame from browser");
-                continue;
-            };
-
-            // `bridge_attach` is the browser telling us what the desktop would
-            // have read off the window: its label and its current URL.
-            if frame.event == "bridge_attach" {
-                match serde_json::from_value::<AttachPayload>(frame.payload.clone()) {
-                    Ok(attach) => {
-                        log::info!("Browser attached: {} at {}", attach.label, attach.url);
-                        state.session.set(SessionContext {
-                            label: attach.label,
-                            url: attach.url,
-                        });
-                    }
-                    Err(e) => log::warn!("Bad bridge_attach payload: {e}"),
-                }
-                continue;
-            }
-
-            state.events.dispatch_inbound(frame);
-        }
-    });
-
-    tokio::select! {
-        _ = send_task => {},
-        _ = recv_task => {},
-    }
-}
-
-#[derive(Debug, Deserialize)]
-struct BodyQuery {
-    /// Present so the shared token extractor doesn't reject the request; the
-    /// value itself is checked in the middleware.
-    #[allow(dead_code)]
-    token: Option<String>,
-}
-
-/// Stream a response body, with Range support.
-///
-/// Keyed by response id rather than by path: the tab hands back a `bodyPath`
-/// the backend gave it, and resolving that through the database means this
-/// route can only ever serve a file the engine wrote, not an arbitrary path a
-/// page asked for. Range matters because the video and audio viewers seek.
-async fn response_body(
-    State(app): State<AppState>,
-    Path(id): Path<String>,
-    Query(_q): Query<BodyQuery>,
-    headers: HeaderMap,
-) -> Response {
-    let response = match app.state.db().get_http_response(&id) {
-        Ok(response) => response,
-        Err(_) => return (StatusCode::NOT_FOUND, "No such response").into_response(),
-    };
-
-    let Some(body_path) = response.body_path else {
-        return (StatusCode::NOT_FOUND, "Response has no body").into_response();
-    };
-
-    let mut file = match tokio::fs::File::open(&body_path).await {
-        Ok(file) => file,
-        Err(e) => return (StatusCode::NOT_FOUND, format!("Body unavailable: {e}")).into_response(),
-    };
-
-    let total = match file.metadata().await {
-        Ok(meta) => meta.len(),
-        Err(e) => {
-            return (StatusCode::INTERNAL_SERVER_ERROR, format!("Body unreadable: {e}"))
-                .into_response();
-        }
-    };
-
-    let content_type = response
-        .headers
-        .iter()
-        .find(|h| h.name.eq_ignore_ascii_case("content-type"))
-        .map(|h| h.value.clone())
-        .unwrap_or_else(|| "application/octet-stream".to_string());
-
-    let range = headers.get(header::RANGE).and_then(|v| v.to_str().ok()).and_then(parse_range);
-
-    let (start, end, status) = match range {
-        Some((start, end)) => {
-            let end = end.unwrap_or(total.saturating_sub(1)).min(total.saturating_sub(1));
-            if total == 0 || start > end {
-                return Response::builder()
-                    .status(StatusCode::RANGE_NOT_SATISFIABLE)
-                    .header(header::CONTENT_RANGE, format!("bytes */{total}"))
-                    .body(Body::empty())
-                    .unwrap();
-            }
-            (start, end, StatusCode::PARTIAL_CONTENT)
-        }
-        None => (0, total.saturating_sub(1), StatusCode::OK),
-    };
-
-    let length = if total == 0 { 0 } else { end - start + 1 };
-
-    if file.seek(std::io::SeekFrom::Start(start)).await.is_err() {
-        return (StatusCode::INTERNAL_SERVER_ERROR, "Failed to seek body").into_response();
-    }
-
-    let mut buf = vec![0u8; length as usize];
-    if let Err(e) = file.read_exact(&mut buf).await {
-        return (StatusCode::INTERNAL_SERVER_ERROR, format!("Failed to read body: {e}"))
-            .into_response();
-    }
-
-    let mut builder = Response::builder()
-        .status(status)
-        .header(header::CONTENT_TYPE, content_type)
-        .header(header::ACCEPT_RANGES, "bytes")
-        .header(header::CONTENT_LENGTH, length);
-
-    if status == StatusCode::PARTIAL_CONTENT {
-        builder = builder.header(header::CONTENT_RANGE, format!("bytes {start}-{end}/{total}"));
-    }
-
-    builder.body(Body::from(buf)).unwrap()
-}
-
-/// Parses a single `bytes=start-end` range. Multi-range requests are not
-/// answered as multipart; the first range is used, which browsers accept.
-fn parse_range(value: &str) -> Option<(u64, Option<u64>)> {
-    let spec = value.strip_prefix("bytes=")?.split(',').next()?.trim();
-    let (start, end) = spec.split_once('-')?;
-    if start.is_empty() {
-        return None;
-    }
-    let start: u64 = start.parse().ok()?;
-    let end = if end.is_empty() { None } else { Some(end.parse().ok()?) };
-    Some((start, end))
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn parses_ranges() {
-        assert_eq!(parse_range("bytes=0-499"), Some((0, Some(499))));
-        assert_eq!(parse_range("bytes=500-"), Some((500, None)));
-        assert_eq!(parse_range("bytes=0-99,200-299"), Some((0, Some(99))));
-        // Suffix ranges ("last 500 bytes") aren't supported; callers get the
-        // whole body, which is correct if wasteful.
-        assert_eq!(parse_range("bytes=-500"), None);
-        assert_eq!(parse_range("nonsense"), None);
-    }
-
-    #[test]
-    fn token_comparison_requires_exact_match() {
-        assert!(constant_time_eq("abc", "abc"));
-        assert!(!constant_time_eq("abc", "abd"));
-        assert!(!constant_time_eq("abc", "abcd"));
-    }
-}
@@ -1,121 +0,0 @@
-//! Yaak Bridge — the local companion that runs the real Yaak engine for a
-//! browser tab.
-//!
-//! The tab is the Yaak UI, unchanged. Everything it cannot do in a page —
-//! sending an HTTP request and seeing every response header, following
-//! redirects, keeping a cookie jar, running plugins, reading a response body
-//! off disk — happens in this process, over a local HTTP and WebSocket
-//! connection.
-//!
-//! Loopback only, and every route needs the token printed at startup.
-
-mod events;
-mod http;
-mod model_writes;
-mod plugin_events;
-mod rpc;
-mod session;
-mod state;
-
-use clap::Parser;
-use rand::Rng;
-use std::net::SocketAddr;
-use std::path::PathBuf;
-use std::sync::Arc;
-
-const APP_ID: &str = "app.yaak.bridge";
-
-#[derive(Parser, Debug)]
-#[command(name = "yaak-bridge", about = "Run the Yaak engine for a browser tab")]
-struct Args {
-    /// Port to listen on. Loopback only, always.
-    #[arg(long, default_value_t = 9444, env = "YAAK_BRIDGE_PORT")]
-    port: u16,
-
-    /// Where the database, plugins and response bodies live.
-    #[arg(long, env = "YAAK_BRIDGE_DATA_DIR")]
-    data_dir: Option<PathBuf>,
-
-    /// Use a fixed token instead of generating one. For scripted dev loops.
-    #[arg(long, env = "YAAK_BRIDGE_TOKEN")]
-    token: Option<String>,
-
-    /// Where the frontend was built to. Serving it makes this the only process
-    /// to run; without it, point a Vite dev server at this bridge instead.
-    #[arg(long, env = "YAAK_BRIDGE_WEB_DIR")]
-    web_dir: Option<PathBuf>,
-}
-
-#[tokio::main]
-async fn main() {
-    env_logger::Builder::from_env(env_logger::Env::default().default_filter_or("info")).init();
-
-    let args = Args::parse();
-
-    let data_dir = args.data_dir.unwrap_or_else(default_data_dir);
-    if let Err(e) = std::fs::create_dir_all(&data_dir) {
-        eprintln!("Error: failed to create data dir {}: {e}", data_dir.display());
-        std::process::exit(1);
-    }
-
-    if let Some(web_dir) = &args.web_dir {
-        // Read back by the router; keeping it in the environment avoids
-        // threading an option through every layer for a dev-mode convenience.
-        unsafe { std::env::set_var("YAAK_BRIDGE_WEB_DIR", web_dir) };
-    }
-
-    let token = args.token.unwrap_or_else(generate_token);
-    let is_dev = cfg!(debug_assertions);
-
-    let mut state = state::BridgeState::new(data_dir.clone(), APP_ID, token.clone(), is_dev);
-    state.init_plugins().await;
-    let state = Arc::new(state);
-
-    let router = Arc::new(rpc::build_router());
-    let app = http::build_app(state.clone(), router);
-
-    let addr = SocketAddr::from(([127, 0, 0, 1], args.port));
-    let listener = match tokio::net::TcpListener::bind(addr).await {
-        Ok(listener) => listener,
-        Err(e) => {
-            eprintln!("Error: failed to bind {addr}: {e}");
-            std::process::exit(1);
-        }
-    };
-
-    let base = format!("http://127.0.0.1:{}", args.port);
-    println!();
-    println!("  Yaak Bridge listening on {base}");
-    println!("  Data dir: {}", data_dir.display());
-    println!("  Plugins:  {}", if state.capabilities.plugins { "running" } else { "unavailable" });
-    println!();
-    if std::env::var("YAAK_BRIDGE_WEB_DIR").is_ok() {
-        println!("  Open: {base}/?bridgeToken={token}");
-    } else {
-        println!("  Token: {token}");
-        println!("  Open your dev server with ?bridgeToken={token}");
-    }
-    println!();
-
-    let shutdown_state = state.clone();
-    let server = axum::serve(listener, app).with_graceful_shutdown(async move {
-        let _ = tokio::signal::ctrl_c().await;
-        log::info!("Shutting down");
-        shutdown_state.shutdown().await;
-    });
-
-    if let Err(e) = server.await {
-        eprintln!("Error: server failed: {e}");
-        std::process::exit(1);
-    }
-}
-
-fn default_data_dir() -> PathBuf {
-    dirs::data_dir().unwrap_or_else(|| PathBuf::from(".")).join("yaak-bridge")
-}
-
-/// A 256-bit random token, hex encoded. Per process, never written to disk.
-fn generate_token() -> String {
-    let bytes: [u8; 32] = rand::thread_rng().r#gen();
-    bytes.iter().map(|b| format!("{b:02x}")).collect()
-}
@@ -1,125 +0,0 @@
-//! Pushing model writes to the connected tab.
-//!
-//! A direct port of the desktop's two paths (see
-//! crates-tauri/yaak-app-client/src/models_ext.rs), and for the same reason:
-//! the in-memory channel is the fast path for writes this process made on a
-//! client's behalf, while polling the `model_changes` table is what makes an
-//! external writer — the CLI, a second bridge, the desktop app open on the same
-//! database — show up live in the browser. Keeping both means the browser
-//! behaves like the desktop rather than like a cache.
-
-use crate::events::EventHub;
-use chrono::Utc;
-use log::error;
-use std::sync::mpsc::Receiver;
-use std::time::Duration;
-use yaak_models::query_manager::QueryManager;
-use yaak_models::util::{ModelPayload, UpdateSource};
-
-const MODEL_CHANGES_RETENTION_HOURS: i64 = 1;
-const MODEL_CHANGES_POLL_INTERVAL_MS: u64 = 1000;
-const MODEL_CHANGES_POLL_BATCH_SIZE: usize = 200;
-
-struct ModelChangeCursor {
-    created_at: String,
-    id: i64,
-}
-
-impl ModelChangeCursor {
-    fn from_launch_time() -> Self {
-        Self {
-            created_at: Utc::now().naive_utc().format("%Y-%m-%d %H:%M:%S%.3f").to_string(),
-            id: 0,
-        }
-    }
-}
-
-pub fn start(query_manager: &QueryManager, rx: Receiver<ModelPayload>, events: EventHub) {
-    if let Err(err) =
-        query_manager.connect().prune_model_changes_older_than_hours(MODEL_CHANGES_RETENTION_HOURS)
-    {
-        error!("Failed to prune model_changes rows on startup: {err:?}");
-    }
-
-    // Only stream writes that happen after this process started.
-    let cursor = ModelChangeCursor::from_launch_time();
-    let poll_query_manager = query_manager.clone();
-    let poll_events = events.clone();
-    tokio::spawn(async move {
-        run_model_change_poller(poll_query_manager, poll_events, cursor).await;
-    });
-
-    // `init_standalone` hands back a std (blocking) receiver, so it gets a
-    // thread rather than a task.
-    std::thread::spawn(move || {
-        while let Ok(payload) = rx.recv() {
-            let mut batch: Vec<ModelPayload> = Vec::new();
-            if matches!(payload.update_source, UpdateSource::Window { .. }) {
-                batch.push(payload);
-            }
-            // Coalesce anything already queued into the same frame.
-            while let Ok(next) = rx.try_recv() {
-                if matches!(next.update_source, UpdateSource::Window { .. }) {
-                    batch.push(next);
-                }
-            }
-            if batch.is_empty() {
-                continue;
-            }
-            events.emit("model_writes", &batch);
-        }
-    });
-}
-
-async fn run_model_change_poller(
-    query_manager: QueryManager,
-    events: EventHub,
-    mut cursor: ModelChangeCursor,
-) {
-    loop {
-        while drain_model_changes_batch(&query_manager, &events, &mut cursor) {}
-        tokio::time::sleep(Duration::from_millis(MODEL_CHANGES_POLL_INTERVAL_MS)).await;
-    }
-}
-
-fn drain_model_changes_batch(
-    query_manager: &QueryManager,
-    events: &EventHub,
-    cursor: &mut ModelChangeCursor,
-) -> bool {
-    let changes = match query_manager.connect().list_model_changes_since(
-        &cursor.created_at,
-        cursor.id,
-        MODEL_CHANGES_POLL_BATCH_SIZE,
-    ) {
-        Ok(changes) => changes,
-        Err(err) => {
-            error!("Failed to poll model_changes rows: {err:?}");
-            return false;
-        }
-    };
-
-    if changes.is_empty() {
-        return false;
-    }
-
-    let fetched_count = changes.len();
-    let mut batch: Vec<ModelPayload> = Vec::with_capacity(fetched_count);
-    for change in changes {
-        cursor.created_at = change.created_at;
-        cursor.id = change.id;
-
-        // Window-sourced writes already went out on the in-memory fast path.
-        if matches!(change.payload.update_source, UpdateSource::Window { .. }) {
-            continue;
-        }
-        batch.push(change.payload);
-    }
-
-    // One batch per drain so bulk writes don't flood the tab.
-    if !batch.is_empty() {
-        events.emit("model_writes", &batch);
-    }
-
-    fetched_count == MODEL_CHANGES_POLL_BATCH_SIZE
-}
@@ -1,582 +0,0 @@
-//! The bridge's plugin host.
-//!
-//! Same shape as the CLI's bridge (crates-cli/yaak-cli/src/plugin_events.rs):
-//! subscribe to the plugin manager, let `handle_shared_plugin_event` answer
-//! everything that is only a database question, and implement the rest here.
-//!
-//! Where it differs is that a UI is attached. The CLI answers a prompt from a
-//! TTY and refuses when there isn't one; the bridge does what the desktop does
-//! instead — pushes the event to the tab and waits for the reply keyed by the
-//! event's id. Toasts, clipboard writes and external URLs go the same way,
-//! because the browser is the only thing here that can show or do them.
-
-use crate::events::EventHub;
-use crate::session::SessionStore;
-use serde_json::Value;
-use std::path::PathBuf;
-use std::sync::Arc;
-use tokio::task::JoinHandle;
-use yaak::plugin_events::{
-    GroupedPluginEvent, HostRequest, SharedPluginEventContext, handle_shared_plugin_event,
-};
-use yaak::render::{render_grpc_request, render_http_request};
-use yaak::send::{SendHttpRequestWithPluginsParams, send_http_request_with_plugins};
-use yaak_crypto::manager::EncryptionManager;
-use yaak_http::cookies::get_cookie_value_from_jar;
-use yaak_http::manager::HttpConnectionManager;
-use yaak_models::blob_manager::BlobManager;
-use yaak_models::models::Environment;
-use yaak_models::queries::any_request::AnyRequest;
-use yaak_models::query_manager::QueryManager;
-use yaak_models::render::make_vars_hashmap;
-use yaak_models::util::UpdateSource;
-use yaak_plugins::events::{
-    EmptyPayload, ErrorResponse, GetCookieValueResponse, InternalEvent, InternalEventPayload,
-    ListCookieNamesResponse, ListOpenWorkspacesResponse, PluginContext, PromptTextResponse,
-    RenderGrpcRequestResponse, RenderHttpRequestResponse, SendHttpRequestResponse,
-    TemplateRenderResponse, WindowInfoResponse, WorkspaceInfo,
-};
-use yaak_plugins::manager::PluginManager;
-use yaak_plugins::plugin_handle::PluginHandle;
-use yaak_plugins::template_callback::PluginTemplateCallback;
-use yaak_templates::{RenderOptions, TemplateCallback, render_json_value_raw};
-
-pub struct BridgePluginEventBridge {
-    rx_id: String,
-    task: JoinHandle<()>,
-}
-
-struct BridgeHostContext {
-    query_manager: QueryManager,
-    blob_manager: BlobManager,
-    plugin_manager: Arc<PluginManager>,
-    encryption_manager: Arc<EncryptionManager>,
-    connection_manager: Arc<HttpConnectionManager>,
-    response_dir: PathBuf,
-    events: EventHub,
-    session: SessionStore,
-}
-
-impl BridgePluginEventBridge {
-    #[allow(clippy::too_many_arguments)]
-    pub async fn start(
-        plugin_manager: Arc<PluginManager>,
-        query_manager: QueryManager,
-        blob_manager: BlobManager,
-        encryption_manager: Arc<EncryptionManager>,
-        connection_manager: Arc<HttpConnectionManager>,
-        data_dir: PathBuf,
-        events: EventHub,
-        session: SessionStore,
-    ) -> Self {
-        let (rx_id, mut rx) = plugin_manager.subscribe("bridge").await;
-        let rx_id_for_task = rx_id.clone();
-        let pm = plugin_manager.clone();
-        let host_context = Arc::new(BridgeHostContext {
-            query_manager,
-            blob_manager,
-            plugin_manager,
-            encryption_manager,
-            connection_manager,
-            response_dir: data_dir.join("responses"),
-            events,
-            session,
-        });
-
-        let task = tokio::spawn(async move {
-            while let Some(event) = rx.recv().await {
-                // Events with reply IDs are replies to app-originated requests.
-                if event.reply_id.is_some() {
-                    continue;
-                }
-
-                let Some(plugin_handle) = pm.get_plugin_by_ref_id(&event.plugin_ref_id).await
-                else {
-                    log::warn!(
-                        "Ignoring plugin event with unknown plugin ref '{}'",
-                        event.plugin_ref_id
-                    );
-                    continue;
-                };
-
-                let pm = pm.clone();
-                let host_context = host_context.clone();
-
-                // Avoid deadlocks for nested plugin-host requests (for example, template functions
-                // that trigger additional host requests during render) by handling each event in
-                // its own task.
-                tokio::spawn(async move {
-                    let plugin_name = plugin_handle.info().name;
-                    let Some(reply_payload) = build_plugin_reply(
-                        host_context.as_ref(),
-                        &event,
-                        &plugin_name,
-                        &plugin_handle,
-                    )
-                    .await
-                    else {
-                        return;
-                    };
-
-                    if let Err(err) = pm.reply(&event, &reply_payload).await {
-                        log::warn!("Failed replying to plugin event: {err}");
-                    }
-                });
-            }
-
-            pm.unsubscribe(&rx_id_for_task).await;
-        });
-
-        Self { rx_id, task }
-    }
-
-    pub async fn shutdown(self, plugin_manager: &PluginManager) {
-        plugin_manager.unsubscribe(&self.rx_id).await;
-        self.task.abort();
-        let _ = self.task.await;
-    }
-}
-
-async fn build_plugin_reply(
-    host_context: &BridgeHostContext,
-    event: &InternalEvent,
-    plugin_name: &str,
-    plugin_handle: &PluginHandle,
-) -> Option<InternalEventPayload> {
-    let session = host_context.session.get();
-    let shared_workspace_id =
-        event.context.workspace_id.clone().or_else(|| session.workspace_id());
-
-    match handle_shared_plugin_event(
-        &host_context.query_manager,
-        &event.payload,
-        SharedPluginEventContext {
-            plugin_name,
-            workspace_id: shared_workspace_id.as_deref(),
-        },
-    ) {
-        GroupedPluginEvent::Handled(payload) => payload,
-        GroupedPluginEvent::ToHandle(host_request) => match host_request {
-            HostRequest::ErrorResponse(resp) => {
-                log::warn!("[plugin:{plugin_name}] error: {}", resp.error);
-                None
-            }
-            HostRequest::ReloadResponse(_) => None,
-
-            // The tab owns everything the user can see or the OS can do. These
-            // are fire-and-forget: the plugin gets its acknowledgement as soon
-            // as the frame is queued, matching the desktop, which also does not
-            // wait for the webview to paint.
-            HostRequest::ShowToast(req) => {
-                host_context.events.emit("show_toast", &req);
-                Some(InternalEventPayload::ShowToastResponse(EmptyPayload {}))
-            }
-            HostRequest::CopyText(req) => {
-                host_context.events.emit("bridge_copy_text", &req);
-                Some(InternalEventPayload::CopyTextResponse(EmptyPayload {}))
-            }
-            HostRequest::OpenExternalUrl(req) => {
-                host_context.events.emit("bridge_open_url", &req);
-                Some(InternalEventPayload::OpenExternalUrlResponse(EmptyPayload {}))
-            }
-
-            // Prompts are questions, so they round-trip: the tab renders the
-            // dialog and emits the answer back under the event's own id.
-            HostRequest::PromptText(_) => {
-                let reply = call_frontend(host_context, event).await;
-                Some(reply.unwrap_or(InternalEventPayload::PromptTextResponse(
-                    PromptTextResponse { value: None },
-                )))
-            }
-
-            // A form streams: the tab sends a response per interaction and the
-            // plugin re-renders, until one comes back marked done.
-            HostRequest::PromptForm(_) => {
-                host_context.events.emit("plugin_event", event);
-                if event.reply_id.is_none() {
-                    spawn_form_reply_pump(host_context, event, plugin_handle);
-                }
-                None
-            }
-
-            HostRequest::ListOpenWorkspaces(_) => {
-                let workspaces = match host_context.query_manager.connect().list_workspaces() {
-                    Ok(workspaces) => workspaces
-                        .into_iter()
-                        .map(|w| WorkspaceInfo {
-                            id: w.id.clone(),
-                            name: w.name,
-                            label: session.label.clone(),
-                        })
-                        .collect(),
-                    Err(err) => {
-                        return Some(InternalEventPayload::ErrorResponse(ErrorResponse {
-                            error: format!("Failed to list workspaces in bridge: {err}"),
-                        }));
-                    }
-                };
-                Some(InternalEventPayload::ListOpenWorkspacesResponse(ListOpenWorkspacesResponse {
-                    workspaces,
-                }))
-            }
-
-            HostRequest::SendHttpRequest(req) => {
-                let mut http_request = req.http_request.clone();
-                if http_request.workspace_id.is_empty() {
-                    let Some(workspace_id) = shared_workspace_id.clone() else {
-                        return Some(InternalEventPayload::ErrorResponse(ErrorResponse {
-                            error: "workspace_id is required to send HTTP requests in bridge"
-                                .to_string(),
-                        }));
-                    };
-                    http_request.workspace_id = workspace_id;
-                }
-
-                let cookie_jar_id = match session.cookie_jar_id() {
-                    Some(id) => Some(id),
-                    None => match host_context
-                        .query_manager
-                        .connect()
-                        .list_cookie_jars(http_request.workspace_id.as_str())
-                    {
-                        Ok(jars) => {
-                            jars.into_iter().min_by_key(|jar| jar.created_at).map(|jar| jar.id)
-                        }
-                        Err(err) => {
-                            return Some(InternalEventPayload::ErrorResponse(ErrorResponse {
-                                error: format!("Failed to list cookie jars in bridge: {err}"),
-                            }));
-                        }
-                    },
-                };
-
-                let plugin_context = PluginContext {
-                    workspace_id: Some(http_request.workspace_id.clone()),
-                    ..event.context.clone()
-                };
-
-                match send_http_request_with_plugins(SendHttpRequestWithPluginsParams {
-                    query_manager: &host_context.query_manager,
-                    blob_manager: &host_context.blob_manager,
-                    request: http_request,
-                    environment_id: session.environment_id().as_deref(),
-                    update_source: UpdateSource::Plugin,
-                    cookie_jar_id,
-                    response_dir: &host_context.response_dir,
-                    emit_events_to: None,
-                    emit_response_body_chunks_to: None,
-                    existing_response: None,
-                    plugin_manager: host_context.plugin_manager.clone(),
-                    encryption_manager: host_context.encryption_manager.clone(),
-                    plugin_context: &plugin_context,
-                    cancelled_rx: None,
-                    connection_manager: &host_context.connection_manager,
-                })
-                .await
-                {
-                    Ok(result) => Some(InternalEventPayload::SendHttpRequestResponse(
-                        SendHttpRequestResponse { http_response: result.response },
-                    )),
-                    Err(err) => Some(InternalEventPayload::ErrorResponse(ErrorResponse {
-                        error: format!("Failed to send HTTP request in bridge: {err}"),
-                    })),
-                }
-            }
-
-            HostRequest::RenderHttpRequest(req) => {
-                let mut http_request = req.http_request.clone();
-                if http_request.workspace_id.is_empty() {
-                    let Some(workspace_id) = shared_workspace_id.clone() else {
-                        return Some(InternalEventPayload::ErrorResponse(ErrorResponse {
-                            error: "workspace_id is required to render HTTP requests in bridge"
-                                .to_string(),
-                        }));
-                    };
-                    http_request.workspace_id = workspace_id;
-                }
-
-                let plugin_context = PluginContext {
-                    workspace_id: Some(http_request.workspace_id.clone()),
-                    ..event.context.clone()
-                };
-
-                let environment_chain = match host_context.query_manager.connect().resolve_environments(
-                    &http_request.workspace_id,
-                    http_request.folder_id.as_deref(),
-                    session.environment_id().as_deref(),
-                ) {
-                    Ok(chain) => chain,
-                    Err(err) => {
-                        return Some(InternalEventPayload::ErrorResponse(ErrorResponse {
-                            error: format!("Failed to resolve environments in bridge: {err}"),
-                        }));
-                    }
-                };
-
-                let template_callback = PluginTemplateCallback::new(
-                    host_context.plugin_manager.clone(),
-                    host_context.encryption_manager.clone(),
-                    &plugin_context,
-                    req.purpose.clone(),
-                );
-
-                match render_http_request(
-                    &http_request,
-                    environment_chain,
-                    &template_callback,
-                    &RenderOptions::throw(),
-                )
-                .await
-                {
-                    Ok(http_request) => Some(InternalEventPayload::RenderHttpRequestResponse(
-                        RenderHttpRequestResponse { http_request },
-                    )),
-                    Err(err) => Some(InternalEventPayload::ErrorResponse(ErrorResponse {
-                        error: format!("Failed to render HTTP request in bridge: {err}"),
-                    })),
-                }
-            }
-
-            HostRequest::RenderGrpcRequest(req) => {
-                let mut grpc_request = req.grpc_request.clone();
-                if grpc_request.workspace_id.is_empty() {
-                    let Some(workspace_id) = shared_workspace_id.clone() else {
-                        return Some(InternalEventPayload::ErrorResponse(ErrorResponse {
-                            error: "workspace_id is required to render gRPC requests in bridge"
-                                .to_string(),
-                        }));
-                    };
-                    grpc_request.workspace_id = workspace_id;
-                }
-
-                let plugin_context = PluginContext {
-                    workspace_id: Some(grpc_request.workspace_id.clone()),
-                    ..event.context.clone()
-                };
-
-                let environment_chain = match host_context.query_manager.connect().resolve_environments(
-                    &grpc_request.workspace_id,
-                    grpc_request.folder_id.as_deref(),
-                    session.environment_id().as_deref(),
-                ) {
-                    Ok(chain) => chain,
-                    Err(err) => {
-                        return Some(InternalEventPayload::ErrorResponse(ErrorResponse {
-                            error: format!("Failed to resolve environments in bridge: {err}"),
-                        }));
-                    }
-                };
-
-                let template_callback = PluginTemplateCallback::new(
-                    host_context.plugin_manager.clone(),
-                    host_context.encryption_manager.clone(),
-                    &plugin_context,
-                    req.purpose.clone(),
-                );
-
-                match render_grpc_request(
-                    &grpc_request,
-                    environment_chain,
-                    &template_callback,
-                    &RenderOptions::throw(),
-                )
-                .await
-                {
-                    Ok(grpc_request) => Some(InternalEventPayload::RenderGrpcRequestResponse(
-                        RenderGrpcRequestResponse { grpc_request },
-                    )),
-                    Err(err) => Some(InternalEventPayload::ErrorResponse(ErrorResponse {
-                        error: format!("Failed to render gRPC request in bridge: {err}"),
-                    })),
-                }
-            }
-
-            HostRequest::TemplateRender(req) => {
-                let Some(workspace_id) = shared_workspace_id.clone() else {
-                    return Some(InternalEventPayload::ErrorResponse(ErrorResponse {
-                        error: "workspace_id is required to render templates in bridge".to_string(),
-                    }));
-                };
-
-                let plugin_context =
-                    PluginContext { workspace_id: Some(workspace_id.clone()), ..event.context.clone() };
-
-                let folder_id = session.request_id().and_then(|rid| {
-                    match host_context.query_manager.connect().get_any_request(&rid) {
-                        Ok(AnyRequest::HttpRequest(r)) => r.folder_id,
-                        Ok(AnyRequest::GrpcRequest(r)) => r.folder_id,
-                        Ok(AnyRequest::WebsocketRequest(r)) => r.folder_id,
-                        Err(_) => None,
-                    }
-                });
-
-                let environment_chain = match host_context.query_manager.connect().resolve_environments(
-                    &workspace_id,
-                    folder_id.as_deref(),
-                    session.environment_id().as_deref(),
-                ) {
-                    Ok(chain) => chain,
-                    Err(err) => {
-                        return Some(InternalEventPayload::ErrorResponse(ErrorResponse {
-                            error: format!("Failed to resolve environments in bridge: {err}"),
-                        }));
-                    }
-                };
-
-                let template_callback = PluginTemplateCallback::new(
-                    host_context.plugin_manager.clone(),
-                    host_context.encryption_manager.clone(),
-                    &plugin_context,
-                    req.purpose.clone(),
-                );
-
-                match render_json_value(
-                    req.data.clone(),
-                    environment_chain,
-                    &template_callback,
-                    &RenderOptions::throw(),
-                )
-                .await
-                {
-                    Ok(data) => {
-                        Some(InternalEventPayload::TemplateRenderResponse(TemplateRenderResponse {
-                            data,
-                        }))
-                    }
-                    Err(err) => Some(InternalEventPayload::ErrorResponse(ErrorResponse {
-                        error: format!("Failed to render template data in bridge: {err}"),
-                    })),
-                }
-            }
-
-            HostRequest::ListCookieNames(_) => {
-                let Some(cookie_jar_id) = session.cookie_jar_id() else {
-                    return Some(InternalEventPayload::ListCookieNamesResponse(
-                        ListCookieNamesResponse { names: Vec::new() },
-                    ));
-                };
-                match host_context.query_manager.connect().get_cookie_jar(&cookie_jar_id) {
-                    Ok(jar) => Some(InternalEventPayload::ListCookieNamesResponse(
-                        ListCookieNamesResponse {
-                            names: jar.cookies.into_iter().map(|c| c.name).collect(),
-                        },
-                    )),
-                    Err(err) => Some(InternalEventPayload::ErrorResponse(ErrorResponse {
-                        error: format!("Failed to load cookie jar in bridge: {err}"),
-                    })),
-                }
-            }
-
-            HostRequest::GetCookieValue(req) => {
-                let Some(cookie_jar_id) = session.cookie_jar_id() else {
-                    return Some(InternalEventPayload::GetCookieValueResponse(
-                        GetCookieValueResponse { value: None },
-                    ));
-                };
-                match host_context.query_manager.connect().get_cookie_jar(&cookie_jar_id) {
-                    Ok(jar) => {
-                        let value =
-                            get_cookie_value_from_jar(jar.cookies, &req.name, req.domain.as_deref());
-                        Some(InternalEventPayload::GetCookieValueResponse(GetCookieValueResponse {
-                            value,
-                        }))
-                    }
-                    Err(err) => Some(InternalEventPayload::ErrorResponse(ErrorResponse {
-                        error: format!("Failed to load cookie jar in bridge: {err}"),
-                    })),
-                }
-            }
-
-            HostRequest::WindowInfo(req) => {
-                Some(InternalEventPayload::WindowInfoResponse(WindowInfoResponse {
-                    label: req.label.clone(),
-                    request_id: session.request_id(),
-                    workspace_id: shared_workspace_id.clone(),
-                    environment_id: session.environment_id(),
-                }))
-            }
-
-            // A tab is one window. Opening and closing them needs the
-            // multiWindow capability the bridge reports false.
-            HostRequest::OpenWindow(_) => Some(unsupported("open_window_request")),
-            HostRequest::CloseWindow(_) => Some(unsupported("close_window_request")),
-            HostRequest::OtherRequest(payload) => Some(unsupported(&payload.type_name())),
-        },
-    }
-}
-
-fn unsupported(type_name: &str) -> InternalEventPayload {
-    InternalEventPayload::ErrorResponse(ErrorResponse {
-        error: format!("Unsupported plugin request in bridge: {type_name}"),
-    })
-}
-
-/// Ask the tab and wait for its answer, keyed by the event's id — the same
-/// contract as the desktop's `call_frontend`.
-async fn call_frontend(
-    host_context: &BridgeHostContext,
-    event: &InternalEvent,
-) -> Option<InternalEventPayload> {
-    // Subscribe before emitting: the tab can answer faster than this task is
-    // rescheduled, and a reply that arrives before the listener exists is lost.
-    let mut replies = host_context.events.subscribe_inbound(event.id.clone());
-    host_context.events.emit("plugin_event", event);
-
-    let value = replies.recv().await?;
-    match serde_json::from_value::<InternalEvent>(value) {
-        Ok(reply) => Some(reply.payload),
-        Err(e) => {
-            log::warn!("Failed to parse plugin reply from browser: {e}");
-            None
-        }
-    }
-}
-
-/// Forward every form response the tab sends back to the plugin, until one is
-/// marked done.
-fn spawn_form_reply_pump(
-    host_context: &BridgeHostContext,
-    event: &InternalEvent,
-    plugin_handle: &PluginHandle,
-) {
-    let mut replies = host_context.events.subscribe_inbound(event.id.clone());
-    let plugin_handle = plugin_handle.clone();
-    let plugin_context = event.context.clone();
-
-    tokio::spawn(async move {
-        while let Some(value) = replies.recv().await {
-            let Ok(resp) = serde_json::from_value::<InternalEvent>(value) else {
-                log::warn!("Failed to parse form response from browser");
-                continue;
-            };
-
-            let is_done = matches!(
-                &resp.payload,
-                InternalEventPayload::PromptFormResponse(r) if r.done.unwrap_or(false)
-            );
-
-            let event_to_send = plugin_handle.build_event_to_send(
-                &plugin_context,
-                &resp.payload,
-                Some(resp.reply_id.unwrap_or_default()),
-            );
-            if let Err(e) = plugin_handle.send(&event_to_send).await {
-                log::warn!("Failed to forward form response to plugin: {e:?}");
-            }
-
-            if is_done {
-                break;
-            }
-        }
-    });
-}
-
-async fn render_json_value<T: TemplateCallback>(
-    value: Value,
-    environment_chain: Vec<Environment>,
-    cb: &T,
-    opt: &RenderOptions,
-) -> yaak_templates::error::Result<Value> {
-    let vars = &make_vars_hashmap(environment_chain);
-    render_json_value_raw(value, vars, cb, opt).await
-}
@@ -1,147 +0,0 @@
-//! The bridge's RPC surface.
-//!
-//! Same envelope and same command names as the desktop, dispatched through the
-//! same `RpcRouter`. Only the adapters differ: the desktop's take a Tauri
-//! window and read the workspace off its URL, while these take a `BridgeCtx`
-//! carrying the connected tab's reported URL. The bodies underneath call the
-//! same engine functions in `yaak`, `yaak-models` and `yaak-plugins`.
-//!
-//! This is a subset — enough to boot, edit, send and inspect. Anything not
-//! registered here still gets a well-formed answer: `unsupported_command`
-//! turns it into an RPC error naming the command and this host, so the frontend
-//! surfaces "not supported by the Yaak Bridge" instead of a bare failure.
-
-mod commands;
-
-pub use commands::implemented_commands;
-
-use crate::session::SessionContext;
-use crate::state::BridgeState;
-use std::sync::Arc;
-use yaak_plugins::events::PluginContext;
-use yaak_rpc::{RpcError, RpcRouter};
-
-/// Per-call context. The tab's identity and location, plus the engine.
-///
-/// Mirrors the desktop's `ClientCtx { window }`: the window there answers both
-/// "who is calling" and "what are they looking at", and those are exactly the
-/// two things a bridge call needs that the payload doesn't carry.
-#[derive(Clone)]
-pub struct BridgeCtx {
-    pub state: Arc<BridgeState>,
-    pub session: SessionContext,
-}
-
-impl BridgeCtx {
-    pub fn plugin_context(&self) -> PluginContext {
-        PluginContext::new(Some(self.session.label.clone()), self.session.workspace_id())
-    }
-
-    pub fn update_source(&self) -> yaak_models::util::UpdateSource {
-        yaak_models::util::UpdateSource::from_window_label(&self.session.label)
-    }
-
-    /// The plugin runtime, or an error naming the reason it isn't there.
-    pub fn plugins(&self) -> Result<Arc<yaak_plugins::manager::PluginManager>, RpcError> {
-        self.state.plugin_manager().ok_or_else(|| RpcError {
-            message: "The plugin runtime failed to start, so this command is unavailable"
-                .to_string(),
-        })
-    }
-}
-
-pub fn build_router() -> RpcRouter<BridgeCtx> {
-    commands::build_router()
-}
-
-/// Every command the desktop has that the bridge does not implement.
-///
-/// Registered explicitly rather than left to fall through to "unknown command",
-/// so the message says *why* — the frontend can tell a host that will never
-/// support git from one that is simply out of date.
-pub const UNSUPPORTED_COMMANDS: &[&str] = &[
-    // Multi-window. A tab is one window; Settings opens through this on the
-    // desktop and is therefore unreachable in the browser today.
-    "cmd_new_child_window",
-    "cmd_new_main_window",
-    // gRPC and WebSocket sending.
-    "cmd_grpc_reflect",
-    "cmd_grpc_go",
-    "cmd_grpc_request_actions",
-    "cmd_call_grpc_request_action",
-    "cmd_delete_all_grpc_connections",
-    "cmd_ws_connect",
-    "cmd_ws_send",
-    "cmd_ws_close",
-    "cmd_ws_delete_connections",
-    "cmd_websocket_request_actions",
-    "cmd_call_websocket_request_action",
-    // Git-backed workspaces.
-    "cmd_git_checkout",
-    "cmd_git_branch",
-    "cmd_git_delete_branch",
-    "cmd_git_delete_remote_branch",
-    "cmd_git_merge_branch",
-    "cmd_git_rename_branch",
-    "cmd_git_status",
-    "cmd_git_branch_info",
-    "cmd_git_worktree_status",
-    "cmd_git_log",
-    "cmd_git_log_for_file",
-    "cmd_git_file_diff_for_commit",
-    "cmd_git_initialize",
-    "cmd_git_clone",
-    "cmd_git_commit",
-    "cmd_git_fetch_all",
-    "cmd_git_push",
-    "cmd_git_pull",
-    "cmd_git_pull_force_reset",
-    "cmd_git_pull_merge",
-    "cmd_git_add",
-    "cmd_git_unstage",
-    "cmd_git_reset_changes",
-    "cmd_git_restore_files",
-    "cmd_git_restore_file_from_commit",
-    "cmd_git_add_credential",
-    "cmd_git_remotes",
-    "cmd_git_add_remote",
-    "cmd_git_rm_remote",
-    "cmd_git_watch_worktree_status",
-    // Filesystem sync.
-    "cmd_sync_calculate",
-    "cmd_sync_calculate_fs",
-    "cmd_sync_apply",
-    "cmd_sync_watch",
-    // Workspace encryption.
-    "cmd_enable_encryption",
-    "cmd_disable_encryption",
-    "cmd_reveal_workspace_key",
-    "cmd_set_workspace_key",
-    // Things that need a local filesystem the tab can point at.
-    //
-    // `cmd_http_response_body_path` is how the desktop host turns a response id
-    // into a file it can open; a tab has nothing to do with the answer and
-    // fetches `/responses/:id/body` instead.
-    "cmd_http_response_body_path",
-    "cmd_export_data",
-    "cmd_save_response",
-    "cmd_save_base64_to_binary",
-    "cmd_plugins_install_from_directory",
-    // Desktop application management.
-    "cmd_restart",
-    "cmd_check_for_updates",
-    "cmd_dismiss_notification",
-    "cmd_send_feedback",
-    "cmd_plugins_search",
-    "cmd_plugins_install",
-    "cmd_plugins_uninstall",
-    "cmd_plugins_updates",
-    "cmd_plugins_update_all",
-    "cmd_reload_plugins",
-];
-
-pub fn unsupported_command(cmd: &str) -> RpcError {
-    RpcError {
-        message: format!("`{cmd}` is not supported on this host (Yaak Bridge)"),
-    }
-}
@@ -1,140 +0,0 @@
-//! What the connected tab is currently looking at.
-//!
-//! The desktop reads workspace, environment, cookie jar and request straight off
-//! the window's URL (crates-tauri/yaak-tauri-utils/src/window.rs). A browser tab
-//! runs the same router and so has the same URL, but the server cannot see it —
-//! so the tab reports it, on connect and whenever it changes, and the same
-//! parsing happens here.
-//!
-//! One session for the whole process: this slice serves a single tab. A second
-//! tab overwrites the first's context rather than getting its own.
-
-use std::sync::{Arc, RwLock};
-
-#[derive(Debug, Clone, Default)]
-pub struct SessionContext {
-    /// Identifies the tab, and lands in `UpdateSource::Window { label }` so
-    /// model-write echo suppression works exactly as it does on the desktop.
-    pub label: String,
-    pub url: String,
-}
-
-impl SessionContext {
-    pub fn workspace_id(&self) -> Option<String> {
-        let rest = self.url.split("/workspaces/").nth(1)?;
-        let id: String =
-            rest.chars().take_while(|c| c.is_alphanumeric() || *c == '_').collect();
-        if id.is_empty() { None } else { Some(id) }
-    }
-
-    pub fn request_id(&self) -> Option<String> {
-        let rest = self.url.split("/requests/").nth(1)?;
-        let id: String =
-            rest.chars().take_while(|c| c.is_alphanumeric() || *c == '_').collect();
-        if id.is_empty() { None } else { Some(id) }
-    }
-
-    pub fn environment_id(&self) -> Option<String> {
-        self.query_param("environment_id")
-    }
-
-    pub fn cookie_jar_id(&self) -> Option<String> {
-        self.query_param("cookie_jar_id")
-    }
-
-    fn query_param(&self, key: &str) -> Option<String> {
-        let query = self.url.split('?').nth(1)?;
-        let value = query.split('&').find_map(|pair| {
-            let (k, v) = pair.split_once('=')?;
-            if k != key {
-                return None;
-            }
-            Some(percent_decode(v))
-        })?;
-
-        // The router writes `environment_id=null` when nothing is selected.
-        // Neither of these is an id, and treating them as one sends a lookup
-        // for a model that cannot exist.
-        if value.is_empty() || value == "null" || value == "undefined" {
-            return None;
-        }
-        Some(value)
-    }
-}
-
-fn percent_decode(input: &str) -> String {
-    let bytes = input.replace('+', " ").into_bytes();
-    let mut out: Vec<u8> = Vec::with_capacity(bytes.len());
-    let mut i = 0;
-    while i < bytes.len() {
-        if bytes[i] == b'%' && i + 2 < bytes.len() {
-            let hex = std::str::from_utf8(&bytes[i + 1..i + 3]).ok();
-            if let Some(byte) = hex.and_then(|h| u8::from_str_radix(h, 16).ok()) {
-                out.push(byte);
-                i += 3;
-                continue;
-            }
-        }
-        out.push(bytes[i]);
-        i += 1;
-    }
-    String::from_utf8_lossy(&out).to_string()
-}
-
-#[derive(Clone, Default)]
-pub struct SessionStore {
-    inner: Arc<RwLock<SessionContext>>,
-}
-
-impl SessionStore {
-    pub fn get(&self) -> SessionContext {
-        match self.inner.read() {
-            Ok(guard) => guard.clone(),
-            Err(poisoned) => poisoned.into_inner().clone(),
-        }
-    }
-
-    pub fn set(&self, context: SessionContext) {
-        let mut guard = match self.inner.write() {
-            Ok(guard) => guard,
-            Err(poisoned) => poisoned.into_inner(),
-        };
-        *guard = context;
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn ctx(url: &str) -> SessionContext {
-        SessionContext { label: "tab".into(), url: url.into() }
-    }
-
-    #[test]
-    fn parses_ids_from_a_router_url() {
-        let c = ctx(
-            "http://localhost:1472/workspaces/wk_abc123/requests/rq_def456?environment_id=ev_1&cookie_jar_id=cj_2",
-        );
-        assert_eq!(c.workspace_id().as_deref(), Some("wk_abc123"));
-        assert_eq!(c.request_id().as_deref(), Some("rq_def456"));
-        assert_eq!(c.environment_id().as_deref(), Some("ev_1"));
-        assert_eq!(c.cookie_jar_id().as_deref(), Some("cj_2"));
-    }
-
-    #[test]
-    fn placeholder_query_values_are_not_ids() {
-        let c = ctx("http://localhost:1472/workspaces/wk_a?environment_id=null&cookie_jar_id=");
-        assert_eq!(c.environment_id(), None);
-        assert_eq!(c.cookie_jar_id(), None);
-    }
-
-    #[test]
-    fn missing_parts_are_none() {
-        let c = ctx("http://localhost:1472/");
-        assert_eq!(c.workspace_id(), None);
-        assert_eq!(c.request_id(), None);
-        assert_eq!(c.environment_id(), None);
-        assert_eq!(c.cookie_jar_id(), None);
-    }
-}
@@ -1,244 +0,0 @@
-//! The bridge's engine handles, shared by every route.
-//!
-//! Structurally this is `CliContext` (crates-cli/yaak-cli/src/context.rs) with
-//! an event hub bolted on: the same `init_standalone` database, the same
-//! `PluginManager` over the same Node sidecar. What differs is that a browser
-//! tab is attached, so writes have to be pushed out as they happen instead of
-//! the process exiting when a command finishes.
-
-use crate::events::EventHub;
-use crate::plugin_events::BridgePluginEventBridge;
-use crate::session::SessionStore;
-use include_dir::{Dir, include_dir};
-use serde::Serialize;
-use std::fs;
-use std::path::{Path, PathBuf};
-use std::sync::Arc;
-use tokio::sync::Mutex;
-use yaak_crypto::manager::EncryptionManager;
-use yaak_http::manager::HttpConnectionManager;
-use yaak_models::blob_manager::BlobManager;
-use yaak_models::client_db::ClientDb;
-use yaak_models::query_manager::QueryManager;
-use yaak_plugins::events::PluginContext;
-use yaak_plugins::manager::PluginManager;
-
-const EMBEDDED_PLUGIN_RUNTIME: &str = include_str!(concat!(
-    env!("CARGO_MANIFEST_DIR"),
-    "/../../crates-tauri/yaak-app-client/vendored/plugin-runtime/index.cjs"
-));
-static EMBEDDED_VENDORED_PLUGINS: Dir<'_> =
-    include_dir!("$CARGO_MANIFEST_DIR/../../crates-tauri/yaak-app-client/vendored/plugins");
-
-/// What this host can do, mirroring `PlatformCapabilities` in
-/// packages/platform/src/types.ts.
-///
-/// Reported to the browser rather than hardcoded there, because the honest
-/// answer depends on how the bridge was built — these become cargo features as
-/// the surface grows, and the tab should not have to guess.
-#[derive(Debug, Clone, Serialize)]
-#[serde(rename_all = "camelCase")]
-pub struct BridgeCapabilities {
-    pub grpc: bool,
-    pub websocket: bool,
-    pub git: bool,
-    pub sync: bool,
-    pub tls_options: bool,
-    pub cookie_jar: bool,
-    pub local_files: bool,
-    pub timeline: bool,
-    pub multi_window: bool,
-    pub plugins: bool,
-    pub encryption: bool,
-    pub updater: bool,
-    pub clipboard_read: bool,
-    pub system_fonts: bool,
-    pub license: bool,
-}
-
-impl BridgeCapabilities {
-    /// The first slice: real HTTP sending with full fidelity, real plugins, a
-    /// real cookie jar and timeline. Everything the bridge has no route for is
-    /// reported false so the UI hides it rather than calling and failing.
-    fn for_this_build(plugins: bool) -> Self {
-        Self {
-            grpc: false,
-            websocket: false,
-            git: false,
-            sync: false,
-            // The engine does the TLS, so client certs and custom CAs are real.
-            tls_options: true,
-            cookie_jar: true,
-            // The bridge has a filesystem but the tab has no way to pick a path
-            // on it: there is no dialog implementation on this host.
-            local_files: false,
-            timeline: true,
-            multi_window: false,
-            plugins,
-            encryption: false,
-            updater: false,
-            clipboard_read: false,
-            system_fonts: false,
-            license: false,
-        }
-    }
-}
-
-pub struct BridgeState {
-    data_dir: PathBuf,
-    query_manager: QueryManager,
-    blob_manager: BlobManager,
-    pub encryption_manager: Arc<EncryptionManager>,
-    connection_manager: Arc<HttpConnectionManager>,
-    plugin_manager: Option<Arc<PluginManager>>,
-    plugin_event_bridge: Mutex<Option<BridgePluginEventBridge>>,
-    pub events: EventHub,
-    pub session: SessionStore,
-    pub capabilities: BridgeCapabilities,
-    /// Dev-grade shared secret, minted per process. The seam where OTP pairing
-    /// and per-session keys will go; deliberately not persisted.
-    pub token: String,
-    pub is_dev: bool,
-}
-
-impl BridgeState {
-    pub fn new(data_dir: PathBuf, app_id: &str, token: String, is_dev: bool) -> Self {
-        let db_path = data_dir.join("db.sqlite");
-        let blob_path = data_dir.join("blobs.sqlite");
-        let (query_manager, blob_manager, rx) =
-            match yaak_models::init_standalone(&db_path, &blob_path) {
-                Ok(v) => v,
-                Err(err) => {
-                    eprintln!("Error: Failed to initialize database: {err}");
-                    std::process::exit(1);
-                }
-            };
-        let encryption_manager = Arc::new(EncryptionManager::new(query_manager.clone(), app_id));
-        let events = EventHub::new();
-
-        // A Settings row has to exist before the frontend's first render — the
-        // singular model atom throws without one. `get_settings` upserts a
-        // default when it finds nothing, so touching it here is enough.
-        let _ = query_manager.connect().get_settings();
-
-        crate::model_writes::start(&query_manager, rx, events.clone());
-
-        Self {
-            data_dir,
-            query_manager,
-            blob_manager,
-            encryption_manager,
-            connection_manager: Arc::new(HttpConnectionManager::new()),
-            plugin_manager: None,
-            plugin_event_bridge: Mutex::new(None),
-            events,
-            session: SessionStore::default(),
-            capabilities: BridgeCapabilities::for_this_build(false),
-            token,
-            is_dev,
-        }
-    }
-
-    /// Start the Node plugin runtime and the host-request bridge. Mirrors
-    /// `CliContext::init_plugins`; a failure here is survivable, but sending
-    /// loses auth and template functions, so the capability flips off.
-    pub async fn init_plugins(&mut self) {
-        let vendored_plugin_dir = self.data_dir.join("vendored-plugins");
-        let installed_plugin_dir = self.data_dir.join("installed-plugins");
-        let node_bin_path = PathBuf::from("node");
-
-        prepare_embedded_vendored_plugins(&vendored_plugin_dir)
-            .expect("Failed to prepare bundled plugins");
-
-        let plugin_runtime_main =
-            std::env::var("YAAK_PLUGIN_RUNTIME").map(PathBuf::from).unwrap_or_else(|_| {
-                prepare_embedded_plugin_runtime(&self.data_dir)
-                    .expect("Failed to prepare embedded plugin runtime")
-            });
-
-        match PluginManager::new(
-            vendored_plugin_dir,
-            installed_plugin_dir,
-            node_bin_path,
-            plugin_runtime_main,
-            &self.query_manager,
-            &PluginContext::new_empty(),
-            false,
-        )
-        .await
-        {
-            Ok(plugin_manager) => {
-                let plugin_manager = Arc::new(plugin_manager);
-                let plugin_event_bridge = BridgePluginEventBridge::start(
-                    plugin_manager.clone(),
-                    self.query_manager.clone(),
-                    self.blob_manager.clone(),
-                    self.encryption_manager.clone(),
-                    self.connection_manager.clone(),
-                    self.data_dir.clone(),
-                    self.events.clone(),
-                    self.session.clone(),
-                )
-                .await;
-                self.plugin_manager = Some(plugin_manager);
-                *self.plugin_event_bridge.lock().await = Some(plugin_event_bridge);
-                self.capabilities.plugins = true;
-            }
-            Err(err) => {
-                log::warn!("Failed to initialize plugins: {err}");
-                self.capabilities.plugins = false;
-            }
-        }
-    }
-
-    pub fn data_dir(&self) -> &Path {
-        &self.data_dir
-    }
-
-    pub fn response_dir(&self) -> PathBuf {
-        self.data_dir.join("responses")
-    }
-
-    pub fn db(&self) -> ClientDb<'_> {
-        self.query_manager.connect()
-    }
-
-    pub fn query_manager(&self) -> &QueryManager {
-        &self.query_manager
-    }
-
-    pub fn blob_manager(&self) -> &BlobManager {
-        &self.blob_manager
-    }
-
-    pub fn connection_manager(&self) -> &HttpConnectionManager {
-        &self.connection_manager
-    }
-
-    pub fn plugin_manager(&self) -> Option<Arc<PluginManager>> {
-        self.plugin_manager.clone()
-    }
-
-    pub async fn shutdown(&self) {
-        if let Some(plugin_manager) = &self.plugin_manager {
-            if let Some(plugin_event_bridge) = self.plugin_event_bridge.lock().await.take() {
-                plugin_event_bridge.shutdown(plugin_manager).await;
-            }
-            plugin_manager.terminate().await;
-        }
-    }
-}
-
-fn prepare_embedded_plugin_runtime(data_dir: &Path) -> std::io::Result<PathBuf> {
-    let runtime_dir = data_dir.join("vendored").join("plugin-runtime");
-    fs::create_dir_all(&runtime_dir)?;
-    let runtime_main = runtime_dir.join("index.cjs");
-    fs::write(&runtime_main, EMBEDDED_PLUGIN_RUNTIME)?;
-    Ok(runtime_main)
-}
-
-fn prepare_embedded_vendored_plugins(vendored_plugin_dir: &Path) -> std::io::Result<()> {
-    fs::create_dir_all(vendored_plugin_dir)?;
-    EMBEDDED_VENDORED_PLUGINS.extract(vendored_plugin_dir)?;
-    Ok(())
-}
@@ -39,7 +39,7 @@ md5 = "0.8.0"
 notify = "8.0.0"
 pretty_graphql = "0.2"
 r2d2 = "0.8.10"
-r2d2_sqlite = "0.25.0"
+r2d2_sqlite = "0.32"
 mime_guess = "2.0.5"
 rand = "0.9.0"
 reqwest = { workspace = true, features = [
@@ -73,12 +73,14 @@ url = "2"
 tokio-util = { version = "0.7", features = ["codec"] }
 ts-rs = { workspace = true }
 yaak-rpc = { workspace = true }
+yaak-rpc-schema = { workspace = true }
 uuid = "1.12.1"
 yaak-api = { workspace = true }
 yaak-common = { workspace = true }
 yaak-tauri-utils = { workspace = true }
 yaak-core = { workspace = true }
 yaak = { workspace = true }
+yaak-commands = { workspace = true }
 yaak-crypto = { workspace = true }
 yaak-fonts = { workspace = true }
 yaak-git = { workspace = true }
@@ -1,7 +1,5 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

-export type GitWatchResult = { unlistenEvent: string, };
-
 export type PluginUpdateInfo = { name: string, currentVersion: string, latestVersion: string, };

 export type PluginUpdateNotification = { updateCount: number, plugins: Array<PluginUpdateInfo>, };
@@ -12,8 +10,6 @@ export type UpdateResponse = { "type": "ack" } | { "type": "action", action: Upd

 export type UpdateResponseAction = "install" | "skip";

-export type WatchResult = { unlistenEvent: string, };
-
 export type YaakNotification = { timestamp: string, timeout: number | null, id: string, title: string | null, message: string, color: string | null, action: YaakNotificationAction | null, };

 export type YaakNotificationAction = { label: string, url: string, };
@@ -1,4 +1,4 @@
-// ts-rs owns bindings/index.ts and rewrites it on export, so this hand-written
-// entry point is where the generated files come together.
-export * from "./bindings/gen_rpc";
+// ts-rs owns bindings/index.ts and rewrites it on export. What remains here
+// after the RPC schema moved to @yaakapp-internal/rpc-schema is the
+// desktop-only surface: updater and notification types.
 export * from "./bindings/index";
@@ -1,51 +1,8 @@
 use crate::PluginContextExt;
 use crate::error::Result;
-use std::sync::Arc;
-use tauri::{AppHandle, Manager, Runtime, State, WebviewWindow};
-use yaak_crypto::manager::EncryptionManager;
-use yaak_models::models::HttpRequestHeader;
-use yaak_models::queries::workspaces::default_headers;
+use tauri::{Runtime, State, WebviewWindow};
 use yaak_plugins::events::GetThemesResponse;
 use yaak_plugins::manager::PluginManager;
-use yaak_plugins::native_template_functions::{
-    decrypt_secure_template_function, encrypt_secure_template_function,
-};
-
-/// Extension trait for accessing the EncryptionManager from Tauri Manager types.
-pub trait EncryptionManagerExt<'a, R> {
-    fn crypto(&'a self) -> State<'a, EncryptionManager>;
-}
-
-impl<'a, R: Runtime, M: Manager<R>> EncryptionManagerExt<'a, R> for M {
-    fn crypto(&'a self) -> State<'a, EncryptionManager> {
-        self.state::<EncryptionManager>()
-    }
-}
-
-pub(crate) async fn cmd_decrypt_template<R: Runtime>(
-    window: WebviewWindow<R>,
-    template: &str,
-) -> Result<String> {
-    let encryption_manager = window.app_handle().state::<EncryptionManager>();
-    let plugin_context = window.plugin_context();
-    Ok(decrypt_secure_template_function(&encryption_manager, &plugin_context, template)?)
-}
-
-pub(crate) async fn cmd_secure_template<R: Runtime>(
-    app_handle: AppHandle<R>,
-    window: WebviewWindow<R>,
-    template: &str,
-) -> Result<String> {
-    let plugin_manager = Arc::new((*app_handle.state::<PluginManager>()).clone());
-    let encryption_manager = Arc::new((*app_handle.state::<EncryptionManager>()).clone());
-    let plugin_context = window.plugin_context();
-    Ok(encrypt_secure_template_function(
-        plugin_manager,
-        encryption_manager,
-        &plugin_context,
-        template,
-    )?)
-}

 pub(crate) async fn cmd_get_themes<R: Runtime>(
    window: WebviewWindow<R>,
@@ -53,40 +10,3 @@ pub(crate) async fn cmd_get_themes<R: Runtime>(
 ) -> Result<Vec<GetThemesResponse>> {
    Ok(plugin_manager.get_themes(&window.plugin_context()).await?)
 }
-
-pub(crate) async fn cmd_enable_encryption<R: Runtime>(
-    window: WebviewWindow<R>,
-    workspace_id: &str,
-) -> Result<()> {
-    window.crypto().ensure_workspace_key(workspace_id)?;
-    window.crypto().reveal_workspace_key(workspace_id)?;
-    Ok(())
-}
-
-pub(crate) async fn cmd_reveal_workspace_key<R: Runtime>(
-    window: WebviewWindow<R>,
-    workspace_id: &str,
-) -> Result<String> {
-    Ok(window.crypto().reveal_workspace_key(workspace_id)?)
-}
-
-pub(crate) async fn cmd_set_workspace_key<R: Runtime>(
-    window: WebviewWindow<R>,
-    workspace_id: &str,
-    key: &str,
-) -> Result<()> {
-    window.crypto().set_human_key(workspace_id, key)?;
-    Ok(())
-}
-
-pub(crate) async fn cmd_disable_encryption<R: Runtime>(
-    window: WebviewWindow<R>,
-    workspace_id: &str,
-) -> Result<()> {
-    window.crypto().disable_encryption(workspace_id)?;
-    Ok(())
-}
-
-pub(crate) fn cmd_default_headers() -> Vec<HttpRequestHeader> {
-    default_headers()
-}
@@ -41,6 +41,9 @@ pub enum Error {
    #[error(transparent)]
    YaakError(#[from] yaak::Error),

+    #[error(transparent)]
+    CommandError(#[from] yaak_commands::Error),
+
    #[error(transparent)]
    ClipboardError(#[from] tauri_plugin_clipboard_manager::Error),

@@ -2,7 +2,6 @@ use crate::error::{Error, Result};
 use chrono::Utc;
 use log::{debug, error, warn};
 use notify::Watcher;
-use serde::{Deserialize, Serialize};
 use std::path::Path;
 use std::sync::mpsc;
 use std::time::Duration;
@@ -10,18 +9,11 @@ use tauri::{AppHandle, Listener, Runtime};
 use tokio::select;
 use tokio::sync::watch;
 use tokio::time::sleep;
-use ts_rs::TS;
 use yaak_git::{GitWorktreeStatus, git_path_is_ignored, git_repository_paths, git_worktree_status};
+use yaak_rpc_schema::GitWatchResult;

 const GIT_STATUS_COALESCE_WINDOW: Duration = Duration::from_millis(250);

-#[derive(Debug, Clone, Serialize, Deserialize, TS)]
-#[serde(rename_all = "camelCase")]
-#[ts(export, export_to = "index.ts")]
-pub(crate) struct GitWatchResult {
-    unlisten_event: String,
-}
-
 pub(crate) async fn watch_git_worktree_status<R, F>(
    app_handle: AppHandle<R>,
    dir: &Path,
@@ -8,7 +8,7 @@ use std::sync::Arc;
 use std::time::Instant;
 use tauri::{AppHandle, Manager, Runtime, WebviewWindow};
 use tokio::sync::watch::Receiver;
-use yaak::send::{SendHttpRequestWithPluginsParams, send_http_request_with_plugins};
+use yaak::send::{ResponseBody, SendHttpRequestWithPluginsParams, send_http_request_with_plugins};
 use yaak_crypto::manager::EncryptionManager;
 use yaak_http::manager::HttpConnectionManager;
 use yaak_models::models::{CookieJar, Environment, HttpRequest, HttpResponse, HttpResponseState};
@@ -62,6 +62,12 @@ impl<R: Runtime> ResponseContext<R> {
    }
 }

+/// What a send produced: the response, and where its body went.
+pub struct SentHttpRequest {
+    pub response: HttpResponse,
+    pub body: ResponseBody,
+}
+
 pub async fn send_http_request<R: Runtime>(
    window: &WebviewWindow<R>,
    unrendered_request: &HttpRequest,
@@ -69,7 +75,7 @@ pub async fn send_http_request<R: Runtime>(
    environment: Option<Environment>,
    cookie_jar: Option<CookieJar>,
    cancelled_rx: &mut Receiver<bool>,
-) -> Result<HttpResponse> {
+) -> Result<SentHttpRequest> {
    send_http_request_with_context(
        window,
        unrendered_request,
@@ -90,7 +96,7 @@ pub async fn send_http_request_with_context<R: Runtime>(
    cookie_jar: Option<CookieJar>,
    cancelled_rx: &Receiver<bool>,
    plugin_context: &PluginContext,
-) -> Result<HttpResponse> {
+) -> Result<SentHttpRequest> {
    let app_handle = window.app_handle().clone();
    let update_source = UpdateSource::from_window_label(window.label());
    let mut response_ctx =
@@ -110,7 +116,7 @@ pub async fn send_http_request_with_context<R: Runtime>(
    .await;

    match result {
-        Ok(response) => Ok(response),
+        Ok(sent) => Ok(sent),
        Err(e) => {
            let error = e.to_string();
            let elapsed = start.elapsed().as_millis() as i32;
@@ -123,7 +129,12 @@ pub async fn send_http_request_with_context<R: Runtime>(
                }
                r.error = Some(error);
            });
-            Ok(response_ctx.response().clone())
+            // The send failed, so whatever body exists is the partial one
+            // already on disk under the response's id.
+            Ok(SentHttpRequest {
+                response: response_ctx.response().clone(),
+                body: ResponseBody::Stored,
+            })
        }
    }
 }
@@ -136,7 +147,7 @@ async fn send_http_request_inner<R: Runtime>(
    cancelled_rx: &Receiver<bool>,
    plugin_context: &PluginContext,
    response_ctx: &mut ResponseContext<R>,
-) -> Result<HttpResponse> {
+) -> Result<SentHttpRequest> {
    let app_handle = window.app_handle().clone();
    let plugin_manager = Arc::new((*app_handle.state::<PluginManager>()).clone());
    let encryption_manager = Arc::new((*app_handle.state::<EncryptionManager>()).clone());
@@ -165,7 +176,7 @@ async fn send_http_request_inner<R: Runtime>(
    .await
    .map_err(|e| GenericError(e.to_string()))?;

-    Ok(result.response)
+    Ok(SentHttpRequest { response: result.response, body: result.response_body })
 }

 pub fn resolve_http_request<R: Runtime>(
@@ -5,6 +5,7 @@ use std::fs::read_to_string;
 use std::io::ErrorKind;
 use tauri::{Manager, Runtime, WebviewWindow};
 use yaak::import::{self, ImportDataParams};
+use yaak_api::{ApiClientKind, yaak_api_client};
 use yaak_core::WorkspaceContext;
 use yaak_models::util::BatchUpsertResult;
 use yaak_plugins::manager::PluginManager;
@@ -13,10 +14,25 @@ use yaak_tauri_utils::window::WorkspaceWindowTrait;
 pub(crate) async fn import_data<R: Runtime>(
    window: &WebviewWindow<R>,
    file_path: &str,
+) -> Result<BatchUpsertResult> {
+    let contents = read_import_file(file_path)?;
+    import_contents(window, &contents).await
+}
+
+pub(crate) async fn import_url<R: Runtime>(
+    window: &WebviewWindow<R>,
+    url: &str,
+) -> Result<BatchUpsertResult> {
+    let contents = fetch_import_url(window, url).await?;
+    import_contents(window, &contents).await
+}
+
+async fn import_contents<R: Runtime>(
+    window: &WebviewWindow<R>,
+    contents: &str,
 ) -> Result<BatchUpsertResult> {
    let plugin_manager = window.state::<PluginManager>();
    let query_manager = window.db_manager();
-    let file = read_import_file(file_path)?;
    let plugin_context = window.plugin_context();
    let workspace_context = WorkspaceContext {
        workspace_id: window.workspace_id(),
@@ -30,11 +46,57 @@ pub(crate) async fn import_data<R: Runtime>(
        plugin_manager: &plugin_manager,
        plugin_context: &plugin_context,
        workspace_context,
-        contents: &file,
+        contents,
    })
    .await?)
 }

+/// Download an importable document (OpenAPI, Postman, Insomnia, …) so it can be fed to the same
+/// pipeline as a file on disk.
+///
+/// This uses Yaak's own API client, which follows the OS proxy but not the workspace's proxy,
+/// client certificate, or certificate-validation settings. Requests are unauthenticated, so
+/// specs behind auth must still be downloaded manually and imported as a file.
+async fn fetch_import_url<R: Runtime>(window: &WebviewWindow<R>, url: &str) -> Result<String> {
+    let url = normalize_import_url(url)?;
+    let app_version = window.app_handle().package_info().version.to_string();
+    let response = yaak_api_client(ApiClientKind::App, &app_version)?
+        .get(&url)
+        // The API client defaults to JSON, but specs are just as often YAML
+        .header("Accept", "*/*")
+        .send()
+        .await
+        .map_err(|err| Error::GenericError(format!("Failed to fetch {url}: {err}")))?;
+
+    let status = response.status();
+    if !status.is_success() {
+        return Err(Error::GenericError(format!("Failed to fetch {url}: responded with {status}")));
+    }
+
+    response
+        .text()
+        .await
+        .map_err(|err| Error::GenericError(format!("Failed to read response from {url}: {err}")))
+}
+
+fn normalize_import_url(url: &str) -> Result<String> {
+    let url = url.trim();
+    if url.is_empty() {
+        return Err(Error::GenericError("Import URL must not be empty".to_string()));
+    }
+
+    if url.starts_with("http://") || url.starts_with("https://") {
+        return Ok(url.to_string());
+    }
+
+    match url.split_once("://") {
+        Some((scheme, _)) => {
+            Err(Error::GenericError(format!("Import URL must be http or https, but got {scheme}")))
+        }
+        None => Ok(format!("https://{url}")),
+    }
+}
+
 fn read_import_file(file_path: &str) -> Result<String> {
    read_to_string(file_path).map_err(|err| {
        if err.kind() == ErrorKind::InvalidData {
@@ -71,4 +133,22 @@ mod tests {

        remove_file(path).expect("remove binary fixture");
    }
+
+    #[test]
+    fn normalize_import_url_defaults_to_https() {
+        assert_eq!(
+            normalize_import_url(" example.com/openapi.yaml ").unwrap(),
+            "https://example.com/openapi.yaml"
+        );
+        assert_eq!(
+            normalize_import_url("http://example.com/openapi.yaml").unwrap(),
+            "http://example.com/openapi.yaml"
+        );
+    }
+
+    #[test]
+    fn normalize_import_url_rejects_other_schemes() {
+        assert!(normalize_import_url("file:///tmp/openapi.yaml").is_err());
+        assert!(normalize_import_url("  ").is_err());
+    }
 }
@@ -4,7 +4,7 @@ use crate::error::Error::GenericError;
 use crate::error::Result;
 use crate::grpc::{build_metadata, metadata_to_map, resolve_grpc_request};
 use crate::http_request::{resolve_http_request, send_http_request};
-use crate::import::import_data;
+use crate::import::{import_data, import_url};
 use crate::models_ext::{BlobManagerExt, QueryManagerExt};
 use crate::notifications::YaakNotifier;
 use crate::render::{render_grpc_request, render_json_value, render_template};
@@ -14,7 +14,7 @@ use error::Result as YaakResult;
 use eventsource_client::{EventParser, SSE};
 use log::{debug, error, info, warn};
 use std::collections::HashMap;
-use std::path::{Path, PathBuf};
+use std::path::PathBuf;
 use std::str::FromStr;
 use std::sync::Arc;
 use std::time::Duration;
@@ -29,8 +29,8 @@ use tauri_plugin_log::{Builder, Target, TargetKind, log};
 use tokio::sync::Mutex;
 use tokio::task::block_in_place;
 use tokio::time;
-use yaak::export::{self, ExportDataParams};
-use yaak::responses::{is_response_id, response_body_path};
+use yaak::send::ResponseBody;
+use yaak_commands::responses::locate_response_body;
 use yaak_common::command::new_checked_command;
 use yaak_crypto::manager::EncryptionManager;
 use yaak_grpc::manager::{GrpcConfig, GrpcHandle};
@@ -38,8 +38,7 @@ use yaak_grpc::{Code, ServiceDefinition};
 use yaak_mac_window::AppHandleMacWindowExt;
 use yaak_models::models::{
    AnyModel, CookieJar, Environment, GrpcConnection, GrpcConnectionState, GrpcEvent,
-    GrpcEventType, HttpRequest, HttpResponse, HttpResponseEvent, HttpResponseState, Workspace,
-    WorkspaceMeta,
+    GrpcEventType, HttpRequest, HttpResponse, HttpResponseState, Workspace,
 };
 use yaak_models::util::{BatchUpsertResult, UpdateSource};
 use yaak_plugins::events::{
@@ -54,11 +53,10 @@ use yaak_plugins::events::{
    InternalEventPayload, JsonPrimitive, PluginContext, RenderPurpose, ShowToastRequest,
 };
 use yaak_plugins::manager::PluginManager;
-use yaak_plugins::plugin_meta::{PluginMetadata, get_plugin_meta};
 use yaak_plugins::template_callback::PluginTemplateCallback;
+use yaak_rpc_schema::{AppMetaData, EphemeralHttpResponse};
 use yaak_sse::sse::ServerSentEvent;
 use yaak_tauri_utils::window::WorkspaceWindowTrait;
-use yaak_templates::format_json::format_json;
 use yaak_templates::strip_json_comments::strip_json_comments;
 use yaak_templates::{RenderErrorBehavior, RenderOptions, Tokens, transform_args};
 use yaak_tls::find_client_certificate;
@@ -183,22 +181,6 @@ impl<R: Runtime> PluginContextExt<R> for WebviewWindow<R> {
    }
 }

-#[derive(serde::Serialize, ts_rs::TS)]
-#[serde(default, rename_all = "camelCase")]
-#[ts(export, export_to = "gen_rpc.ts")]
-pub struct AppMetaData {
-    is_dev: bool,
-    version: String,
-    cli_version: Option<String>,
-    name: String,
-    app_data_dir: String,
-    app_log_dir: String,
-    vendored_plugin_dir: String,
-    default_project_dir: String,
-    feature_updater: bool,
-    feature_license: bool,
-}
-
 async fn cmd_metadata<R: Runtime>(app_handle: AppHandle<R>) -> YaakResult<AppMetaData> {
    let app_data_dir = app_handle.path().app_data_dir()?;
    let app_log_dir = app_handle.path().app_log_dir()?;
@@ -982,13 +964,18 @@ async fn cmd_restart<R: Runtime>(app_handle: AppHandle<R>) -> YaakResult<()> {
    Ok(())
 }

+/// Send without saving anything.
+///
+/// The response never reaches the database, so its body cannot be read back by
+/// id later the way a saved response's can. It comes back here instead, which
+/// is the only copy the caller gets.
 async fn cmd_send_ephemeral_request<R: Runtime>(
    mut request: HttpRequest,
    environment_id: Option<&str>,
    cookie_jar_id: Option<&str>,
    window: WebviewWindow<R>,
    app_handle: AppHandle<R>,
-) -> YaakResult<HttpResponse> {
+) -> YaakResult<EphemeralHttpResponse> {
    let response = HttpResponse::default();
    request.id = "".to_string();
    let environment = match environment_id {
@@ -1007,11 +994,18 @@ async fn cmd_send_ephemeral_request<R: Runtime>(
        }
    });

-    send_http_request(&window, &request, &response, environment, cookie_jar, &mut cancel_rx).await
-}
+    let sent =
+        send_http_request(&window, &request, &response, environment, cookie_jar, &mut cancel_rx)
+            .await?;

-async fn cmd_format_json(text: &str) -> YaakResult<String> {
-    Ok(format_json(text, "  "))
+    // Blanking the request id above is what makes this send unsaved, so the
+    // engine always hands the body back. Failing loudly beats returning an
+    // empty body that reads as "the server sent nothing".
+    let ResponseBody::Returned(body) = sent.body else {
+        return Err(GenericError("Unsaved response did not return a body".to_string()));
+    };
+
+    Ok(EphemeralHttpResponse { response: sent.response, body })
 }

 async fn cmd_format_graphql(text: &str) -> YaakResult<String> {
@@ -1021,59 +1015,13 @@ async fn cmd_format_graphql(text: &str) -> YaakResult<String> {
    }
 }

-/// Where a response's body is, and what it is meant to be read as.
-struct ResponseBodyLocation {
-    /// None when the response has no stored body.
-    path: Option<PathBuf>,
-    /// The response's declared `Content-Type`, empty when it has none. An
-    /// ephemeral response has no headers to consult, so its body decodes as
-    /// UTF-8.
-    content_type: String,
-}
-
-/// Find a response's body from its id alone.
-///
-/// The frontend hands back an id and never a path, so nothing a caller says can
-/// point this at a file the engine didn't write. Persisted responses carry the
-/// path they were written to; ephemeral ones (GraphQL introspection) never
-/// reach the database, but their body still lands at `<response dir>/<id>`,
-/// which is how [`yaak::send`] builds the path in the first place.
-fn locate_response_body<R: Runtime>(
-    app_handle: &AppHandle<R>,
-    response_id: &str,
-) -> YaakResult<ResponseBodyLocation> {
-    if !is_response_id(response_id) {
-        return Err(GenericError(format!("Invalid response ID {response_id}")));
-    }
-
-    match app_handle.db().get_http_response(response_id) {
-        Ok(response) => Ok(ResponseBodyLocation {
-            path: response.body_path.map(PathBuf::from),
-            content_type: response
-                .headers
-                .iter()
-                .find(|h| h.name.eq_ignore_ascii_case("content-type"))
-                .map(|h| h.value.clone())
-                .unwrap_or_default(),
-        }),
-        Err(yaak_models::error::Error::ModelNotFound(_)) => {
-            let response_dir = app_handle.path().app_data_dir()?.join("responses");
-            Ok(ResponseBodyLocation {
-                path: Some(response_body_path(&response_dir, response_id)),
-                content_type: String::new(),
-            })
-        }
-        Err(e) => Err(e.into()),
-    }
-}
-
 async fn cmd_http_response_body<R: Runtime>(
    window: WebviewWindow<R>,
    plugin_manager: State<'_, PluginManager>,
    response_id: &str,
    filter: Option<&str>,
 ) -> YaakResult<FilterResponse> {
-    let location = locate_response_body(window.app_handle(), response_id)?;
+    let location = locate_response_body(&window.db(), response_id)?;
    let Some(body_path) = location.path else {
        return Ok(FilterResponse { content: String::new(), error: None });
    };
@@ -1091,41 +1039,11 @@ async fn cmd_http_response_body<R: Runtime>(
    }
 }

-/// The body's path on this machine, for the desktop host to read or hand to the
-/// webview's asset protocol.
-///
-/// The frontend holds response ids; only `packages/platform`'s Tauri host sees
-/// the path, and only because it is about to open the file itself. Hosts
-/// without a filesystem serve the same bytes over HTTP instead.
-async fn cmd_http_response_body_path<R: Runtime>(
-    app_handle: AppHandle<R>,
-    response_id: &str,
-) -> YaakResult<Option<String>> {
-    let location = locate_response_body(&app_handle, response_id)?;
-    Ok(location.path.map(|p| p.to_string_lossy().to_string()))
-}
-
-async fn cmd_http_request_body<R: Runtime>(
-    app_handle: AppHandle<R>,
-    response_id: &str,
-) -> YaakResult<Option<Vec<u8>>> {
-    let body_id = format!("{}.request", response_id);
-    let chunks = app_handle.blobs().get_chunks(&body_id)?;
-
-    if chunks.is_empty() {
-        return Ok(None);
-    }
-
-    // Concatenate all chunks
-    let body: Vec<u8> = chunks.into_iter().flat_map(|c| c.data).collect();
-    Ok(Some(body))
-}
-
 async fn cmd_get_sse_events<R: Runtime>(
    app_handle: AppHandle<R>,
    response_id: &str,
 ) -> YaakResult<Vec<ServerSentEvent>> {
-    let Some(body_path) = locate_response_body(&app_handle, response_id)?.path else {
+    let Some(body_path) = locate_response_body(&app_handle.db(), response_id)?.path else {
        return Ok(Vec::new());
    };

@@ -1148,14 +1066,6 @@ async fn cmd_get_sse_events<R: Runtime>(
    Ok(events)
 }

-async fn cmd_get_http_response_events<R: Runtime>(
-    app_handle: AppHandle<R>,
-    response_id: &str,
-) -> YaakResult<Vec<HttpResponseEvent>> {
-    let events: Vec<HttpResponseEvent> = app_handle.db().list_http_response_events(response_id)?;
-    Ok(events)
-}
-
 async fn cmd_import_data<R: Runtime>(
    window: WebviewWindow<R>,
    file_path: &str,
@@ -1163,6 +1073,13 @@ async fn cmd_import_data<R: Runtime>(
    import_data(&window, file_path).await
 }

+async fn cmd_import_url<R: Runtime>(
+    window: WebviewWindow<R>,
+    url: &str,
+) -> YaakResult<BatchUpsertResult> {
+    import_url(&window, url).await
+}
+
 async fn cmd_http_request_actions<R: Runtime>(
    window: WebviewWindow<R>,
    plugin_manager: State<'_, PluginManager>,
@@ -1441,22 +1358,6 @@ async fn cmd_curl_to_request<R: Runtime>(
        })?)
 }

-async fn cmd_export_data<R: Runtime>(
-    app_handle: AppHandle<R>,
-    export_path: &str,
-    workspace_ids: Vec<&str>,
-    include_private_environments: bool,
-) -> YaakResult<()> {
-    let version = app_handle.package_info().version.to_string();
-    Ok(export::export_data(ExportDataParams {
-        query_manager: &app_handle.db_manager(),
-        yaak_version: &version,
-        export_path: Path::new(export_path),
-        workspace_ids,
-        include_private_environments,
-    })?)
-}
-
 /// Decodes base64 and writes the bytes to a file the user picked.
 ///
 /// The webview can't do this itself: its `fs` permissions are read-only and scoped to the app
@@ -1480,20 +1381,6 @@ async fn cmd_save_base64_to_binary<R: Runtime>(
    Ok(())
 }

-async fn cmd_save_response<R: Runtime>(
-    app_handle: AppHandle<R>,
-    response_id: &str,
-    filepath: &str,
-) -> YaakResult<()> {
-    let response = app_handle.db().get_http_response(response_id)?;
-
-    let body_path =
-        response.body_path.ok_or(GenericError("Response does not have a body".to_string()))?;
-    fs::copy(body_path, filepath).map_err(|e| GenericError(e.to_string()))?;
-
-    Ok(())
-}
-
 async fn cmd_send_http_request<R: Runtime>(
    app_handle: AppHandle<R>,
    window: WebviewWindow<R>,
@@ -1547,7 +1434,7 @@ async fn cmd_send_http_request<R: Runtime>(
    )
    .await
    {
-        Ok(r) => r,
+        Ok(sent) => sent.response,
        Err(e) => {
            let resp = app_handle.db().get_http_response(&response.id)?;
            app_handle.db().upsert_http_response(
@@ -1577,90 +1464,6 @@ async fn cmd_reload_plugins<R: Runtime>(
    Ok(errors)
 }

-async fn cmd_plugin_info<R: Runtime>(
-    id: &str,
-    app_handle: AppHandle<R>,
-    plugin_manager: State<'_, PluginManager>,
-) -> YaakResult<PluginMetadata> {
-    let plugin = app_handle.db().get_plugin(id)?;
-    if let Some(plugin_handle) = plugin_manager
-        .get_plugin_by_dir(plugin.directory.as_str())
-        .await
-    {
-        return Ok(plugin_handle.info());
-    }
-
-    if let Ok(metadata) = get_plugin_meta(&PathBuf::from(&plugin.directory)) {
-        return Ok(metadata);
-    }
-
-    Ok(fallback_plugin_metadata(&plugin.directory))
-}
-
-fn fallback_plugin_metadata(directory: &str) -> PluginMetadata {
-    let display_name = PathBuf::from(directory)
-        .file_name()
-        .and_then(|name| name.to_str())
-        .filter(|name| !name.is_empty())
-        .unwrap_or(directory)
-        .to_string();
-
-    PluginMetadata {
-        version: "Unavailable".to_string(),
-        name: directory.to_string(),
-        display_name,
-        description: Some(format!("Plugin metadata could not be loaded from {directory}")),
-        homepage_url: None,
-        repository_url: None,
-    }
-}
-
-async fn cmd_delete_all_grpc_connections<R: Runtime>(
-    request_id: &str,
-    app_handle: AppHandle<R>,
-    window: WebviewWindow<R>,
-) -> YaakResult<()> {
-    Ok(app_handle.db().delete_all_grpc_connections_for_request(
-        request_id,
-        &UpdateSource::from_window_label(window.label()),
-    )?)
-}
-
-async fn cmd_delete_send_history<R: Runtime>(
-    workspace_id: &str,
-    app_handle: AppHandle<R>,
-    window: WebviewWindow<R>,
-) -> YaakResult<()> {
-    Ok(app_handle.with_tx(|tx| {
-        let source = &UpdateSource::from_window_label(window.label());
-        tx.delete_all_http_responses_for_workspace(workspace_id, source)?;
-        tx.delete_all_grpc_connections_for_workspace(workspace_id, source)?;
-        tx.delete_all_websocket_connections_for_workspace(workspace_id, source)?;
-        Ok(())
-    })?)
-}
-
-async fn cmd_delete_all_http_responses<R: Runtime>(
-    request_id: &str,
-    app_handle: AppHandle<R>,
-    window: WebviewWindow<R>,
-) -> YaakResult<()> {
-    app_handle.db().delete_all_http_responses_for_request(
-        request_id,
-        &UpdateSource::from_window_label(window.label()),
-    )?;
-    Ok(())
-}
-
-async fn cmd_get_workspace_meta<R: Runtime>(
-    app_handle: AppHandle<R>,
-    workspace_id: &str,
-) -> YaakResult<WorkspaceMeta> {
-    let db = app_handle.db();
-    let workspace = db.get_workspace(workspace_id)?;
-    Ok(db.get_or_create_workspace_meta(&workspace.id)?)
-}
-
 async fn cmd_new_child_window<R: Runtime>(
    parent_window: WebviewWindow<R>,
    url: &str,
@@ -12,10 +12,8 @@ use tauri_plugin_dialog::{DialogExt, MessageDialogKind};
 use yaak_models::blob_manager::BlobManager;
 use yaak_models::client_db::ClientDb;
 use yaak_models::error::Result;
-use yaak_models::models::{AnyModel, GraphQlIntrospection, GrpcEvent, Settings, WebsocketEvent};
 use yaak_models::query_manager::QueryManager;
 use yaak_models::util::{ModelPayload, UpdateSource};
-use yaak_plugins::manager::PluginManager;

 const MODEL_CHANGES_RETENTION_HOURS: i64 = 1;
 const MODEL_CHANGES_POLL_INTERVAL_MS: u64 = 1000;
@@ -123,163 +121,12 @@ impl<'a, R: Runtime, M: Manager<R>> QueryManagerExt<'a, R> for M {
 /// Extension trait for accessing the BlobManager from Tauri Manager types.
 pub trait BlobManagerExt<'a, R> {
    fn blob_manager(&'a self) -> State<'a, BlobManager>;
-    fn blobs(&'a self) -> yaak_models::blob_manager::BlobContext;
 }

 impl<'a, R: Runtime, M: Manager<R>> BlobManagerExt<'a, R> for M {
    fn blob_manager(&'a self) -> State<'a, BlobManager> {
        self.state::<BlobManager>()
    }
-
-    fn blobs(&'a self) -> yaak_models::blob_manager::BlobContext {
-        let manager = self.state::<BlobManager>();
-        manager.inner().connect()
-    }
-}
-
-// Commands for yaak-models
-use tauri::WebviewWindow;
-
-pub(crate) fn models_upsert<R: Runtime>(
-    window: WebviewWindow<R>,
-    model: AnyModel,
-) -> Result<String> {
-    let db = window.db();
-    let blobs = window.blob_manager();
-    let source = &UpdateSource::from_window_label(window.label());
-    yaak::models_ops::upsert_model(&db, &blobs, model, source)
-}
-
-// Async so cascading deletes (e.g. a workspace with thousands of requests) run on a
-// blocking thread instead of stalling the main thread and all other IPC.
-pub(crate) async fn models_delete<R: Runtime>(
-    window: WebviewWindow<R>,
-    model: AnyModel,
-) -> Result<String> {
-    use yaak_models::error::Error::GenericError;
-
-    tauri::async_runtime::spawn_blocking(move || {
-        let blobs = window.blob_manager();
-        // Use transaction for deletions because it might recurse
-        window.with_tx(|tx| {
-            let source = &UpdateSource::from_window_label(window.label());
-            yaak::models_ops::delete_model(tx, &blobs, model, source)
-        })
-    })
-    .await
-    .map_err(|e| GenericError(format!("Delete task failed: {e}")))?
-}
-
-pub(crate) fn models_duplicate<R: Runtime>(
-    window: WebviewWindow<R>,
-    model_type: String,
-    model_id: String,
-) -> Result<String> {
-    // Use transaction for duplications because it might recurse
-    window.with_tx(|tx| {
-        let source = &UpdateSource::from_window_label(window.label());
-        yaak::models_ops::duplicate_model(tx, &model_type, &model_id, source)
-    })
-}
-
-pub(crate) fn models_websocket_events<R: Runtime>(
-    app_handle: tauri::AppHandle<R>,
-    connection_id: &str,
-) -> Result<Vec<WebsocketEvent>> {
-    Ok(app_handle.db().list_websocket_events(connection_id)?)
-}
-
-pub(crate) fn models_grpc_events<R: Runtime>(
-    app_handle: tauri::AppHandle<R>,
-    connection_id: &str,
-) -> Result<Vec<GrpcEvent>> {
-    Ok(app_handle.db().list_grpc_events(connection_id)?)
-}
-
-pub(crate) fn models_get_settings<R: Runtime>(app_handle: tauri::AppHandle<R>) -> Result<Settings> {
-    Ok(app_handle.db().get_settings())
-}
-
-pub(crate) fn models_get_graphql_introspection<R: Runtime>(
-    app_handle: tauri::AppHandle<R>,
-    request_id: &str,
-) -> Result<Option<GraphQlIntrospection>> {
-    Ok(app_handle.db().get_graphql_introspection(request_id))
-}
-
-pub(crate) fn models_upsert_graphql_introspection<R: Runtime>(
-    app_handle: tauri::AppHandle<R>,
-    request_id: &str,
-    workspace_id: &str,
-    content: Option<String>,
-    window: WebviewWindow<R>,
-) -> Result<GraphQlIntrospection> {
-    let source = UpdateSource::from_window_label(window.label());
-    Ok(app_handle.db().upsert_graphql_introspection(workspace_id, request_id, content, &source)?)
-}
-
-pub(crate) async fn models_workspace_models<R: Runtime>(
-    window: WebviewWindow<R>,
-    workspace_id: Option<&str>,
-    plugin_manager: State<'_, PluginManager>,
-) -> Result<String> {
-    let mut l: Vec<AnyModel> = Vec::new();
-
-    // Add the global models
-    {
-        let db = window.db();
-        l.push(db.get_settings().into());
-        l.append(&mut db.list_workspaces()?.into_iter().map(Into::into).collect());
-        l.append(&mut db.list_key_values()?.into_iter().map(Into::into).collect());
-    }
-
-    let plugins = {
-        let db = window.db();
-        db.list_plugins()?
-    };
-
-    let plugins = plugin_manager.resolve_plugins_for_runtime_from_db(plugins).await;
-    l.append(&mut plugins.into_iter().map(Into::into).collect());
-
-    // Add the workspace children
-    if let Some(wid) = workspace_id {
-        let db = window.db();
-        l.append(&mut db.list_cookie_jars(wid)?.into_iter().map(Into::into).collect());
-        l.append(&mut db.list_environments_ensure_base(wid)?.into_iter().map(Into::into).collect());
-        l.append(&mut db.list_folders(wid)?.into_iter().map(Into::into).collect());
-        l.append(&mut db.list_grpc_connections(wid)?.into_iter().map(Into::into).collect());
-        l.append(&mut db.list_grpc_requests(wid)?.into_iter().map(Into::into).collect());
-        l.append(&mut db.list_http_requests(wid)?.into_iter().map(Into::into).collect());
-        l.append(&mut db.list_http_responses(wid, None)?.into_iter().map(Into::into).collect());
-        l.append(&mut db.list_websocket_connections(wid)?.into_iter().map(Into::into).collect());
-        l.append(&mut db.list_websocket_requests(wid)?.into_iter().map(Into::into).collect());
-        l.append(&mut db.list_workspace_metas(wid)?.into_iter().map(Into::into).collect());
-    }
-
-    let j = serde_json::to_string(&l)?;
-
-    Ok(escape_str_for_webview(&j))
-}
-
-fn escape_str_for_webview(input: &str) -> String {
-    input
-        .chars()
-        .map(|c| {
-            let code = c as u32;
-            // ASCII
-            if code <= 0x7F {
-                c.to_string()
-                // BMP characters encoded normally
-            } else if code < 0xFFFF {
-                format!("\\u{:04X}", code)
-                // Beyond BMP encoded a surrogate pairs
-            } else {
-                let high = ((code - 0x10000) >> 10) + 0xD800;
-                let low = ((code - 0x10000) & 0x3FF) + 0xDC00;
-                format!("\\u{:04X}\\u{:04X}", high, low)
-            }
-        })
-        .collect()
 }

 /// Initialize database managers as a plugin (for initialization order).
@@ -7,6 +7,8 @@ use crate::{
    call_frontend, cookie_jar_from_window, environment_from_window, get_window_from_plugin_context,
    workspace_from_window,
 };
+use base64::Engine;
+use base64::prelude::BASE64_STANDARD;
 use chrono::Utc;
 use log::error;
 use std::sync::Arc;
@@ -16,6 +18,7 @@ use tauri_plugin_opener::OpenerExt;
 use yaak::plugin_events::{
    GroupedPluginEvent, HostRequest, SharedPluginEventContext, handle_shared_plugin_event,
 };
+use yaak::response_body::FileResponseBodyStore;
 use yaak_crypto::manager::EncryptionManager;
 use yaak_http::cookies::get_cookie_value_from_jar;
 use yaak_models::models::{HttpResponse, Plugin};
@@ -54,6 +57,7 @@ pub(crate) async fn handle_plugin_event<R: Runtime>(

    match handle_shared_plugin_event(
        app_handle.db_manager().inner(),
+        &FileResponseBodyStore::new(app_handle.db_manager().inner()),
        &event.payload,
        SharedPluginEventContext {
            plugin_name: &plugin_name,
@@ -313,8 +317,13 @@ async fn handle_host_plugin_request<R: Runtime>(
            )
            .await?;

+            // An ad-hoc request saves nothing, so the engine hands the body
+            // back and this reply is the only place the plugin can get it.
+            let body = http_response.body.returned_bytes().map(|b| BASE64_STANDARD.encode(b));
+
            Ok(Some(InternalEventPayload::SendHttpRequestResponse(SendHttpRequestResponse {
-                http_response,
+                http_response: http_response.response,
+                body,
            })))
        }
        HostRequest::OpenWindow(req) => {
@@ -194,12 +194,6 @@ pub async fn cmd_plugins_uninstall<R: Runtime>(
    Ok(delete_and_uninstall(plugin_manager, &query_manager, &plugin_context, plugin_id).await?)
 }

-pub async fn cmd_plugin_init_errors(
-    plugin_manager: State<'_, PluginManager>,
-) -> Result<Vec<(String, String)>> {
-    Ok(plugin_manager.take_init_errors().await)
-}
-
 pub async fn cmd_plugins_updates<R: Runtime>(
    app_handle: AppHandle<R>,
 ) -> Result<PluginUpdatesResponse> {
@@ -6,11 +6,10 @@ use crate::error::Result;
 use crate::models_ext::{BlobManagerExt, QueryManagerExt};
 use chrono::Utc;
 use log::warn;
-use serde::{Deserialize, Serialize};
 use std::path::Path;
 use tauri::{AppHandle, Listener, Runtime};
 use tokio::sync::watch;
-use ts_rs::TS;
+use yaak_rpc_schema::WatchResult;
 use yaak_sync::error::Error::InvalidSyncDirectory;
 use yaak_sync::sync::{
    FsCandidate, SyncOp, apply_sync_ops, apply_sync_state_ops, compute_sync_ops, get_db_candidates,
@@ -57,13 +56,6 @@ pub(crate) async fn cmd_sync_apply<R: Runtime>(
    Ok(())
 }

-#[derive(Debug, Clone, Serialize, Deserialize, TS)]
-#[serde(rename_all = "camelCase")]
-#[ts(export, export_to = "index.ts")]
-pub(crate) struct WatchResult {
-    unlisten_event: String,
-}
-
 pub(crate) async fn sync_watch<R, F>(
    app_handle: AppHandle<R>,
    sync_dir: &Path,
@@ -29,17 +29,6 @@ use yaak_templates::{RenderErrorBehavior, RenderOptions};
 use yaak_tls::find_client_certificate;
 use yaak_ws::{WebsocketManager, render_websocket_request};

-pub async fn cmd_ws_delete_connections<R: Runtime>(
-    request_id: &str,
-    app_handle: AppHandle<R>,
-    window: WebviewWindow<R>,
-) -> Result<()> {
-    Ok(app_handle.db().delete_all_websocket_connections_for_request(
-        request_id,
-        &UpdateSource::from_window_label(window.label()),
-    )?)
-}
-
 pub async fn cmd_ws_send<R: Runtime>(
    connection_id: &str,
    environment_id: Option<&str>,
@@ -7,3 +7,4 @@ publish = false
 [dependencies]
 tauri = { workspace = true }
 regex = "1.11.0"
+yaak-core = { workspace = true }
@@ -1,38 +1,53 @@
 use regex::Regex;
-use tauri::{Runtime, WebviewWindow};
+use tauri::{Runtime, Url, WebviewWindow};
+use yaak_core::WorkspaceContext;

 pub trait WorkspaceWindowTrait {
    fn workspace_id(&self) -> Option<String>;
    fn cookie_jar_id(&self) -> Option<String>;
    fn environment_id(&self) -> Option<String>;
    fn request_id(&self) -> Option<String>;
+    /// All four at once, from a single read of the window URL.
+    fn workspace_context(&self) -> WorkspaceContext;
 }

 impl<R: Runtime> WorkspaceWindowTrait for WebviewWindow<R> {
    fn workspace_id(&self) -> Option<String> {
-        let url = self.url().unwrap();
-        let re = Regex::new(r"/workspaces/(?<id>\w+)").unwrap();
-        match re.captures(url.as_str()) {
-            None => None,
-            Some(captures) => captures.name("id").map(|c| c.as_str().to_string()),
-        }
+        workspace_id_from_url(&self.url().unwrap())
    }

    fn cookie_jar_id(&self) -> Option<String> {
-        let url = self.url().unwrap();
-        let mut query_pairs = url.query_pairs();
-        query_pairs.find(|(k, _v)| k == "cookie_jar_id").map(|(_k, v)| v.to_string())
+        query_param(&self.url().unwrap(), "cookie_jar_id")
    }

    fn environment_id(&self) -> Option<String> {
-        let url = self.url().unwrap();
-        let mut query_pairs = url.query_pairs();
-        query_pairs.find(|(k, _v)| k == "environment_id").map(|(_k, v)| v.to_string())
+        query_param(&self.url().unwrap(), "environment_id")
    }

    fn request_id(&self) -> Option<String> {
+        query_param(&self.url().unwrap(), "request_id")
+    }
+
+    fn workspace_context(&self) -> WorkspaceContext {
        let url = self.url().unwrap();
-        let mut query_pairs = url.query_pairs();
-        query_pairs.find(|(k, _v)| k == "request_id").map(|(_k, v)| v.to_string())
+        WorkspaceContext {
+            workspace_id: workspace_id_from_url(&url),
+            environment_id: query_param(&url, "environment_id"),
+            cookie_jar_id: query_param(&url, "cookie_jar_id"),
+            request_id: query_param(&url, "request_id"),
+        }
    }
 }
+
+fn workspace_id_from_url(url: &Url) -> Option<String> {
+    let re = Regex::new(r"/workspaces/(?<id>\w+)").unwrap();
+    match re.captures(url.as_str()) {
+        None => None,
+        Some(captures) => captures.name("id").map(|c| c.as_str().to_string()),
+    }
+}
+
+fn query_param(url: &Url, key: &str) -> Option<String> {
+    let mut query_pairs = url.query_pairs();
+    query_pairs.find(|(k, _v)| k == key).map(|(_k, v)| v.to_string())
+}
@@ -9,12 +9,20 @@ chrono = { version = "0.4.38", features = ["serde"] }
 include_dir = "0.7"
 log = { workspace = true }
 nanoid = "0.4.0"
-r2d2 = "0.8.10"
-r2d2_sqlite = { version = "0.25.0" }
-rusqlite = { version = "0.32.1", features = ["bundled", "chrono"] }
-sea-query = { version = "0.32.1", features = ["with-chrono", "attr"] }
-sea-query-rusqlite = { version = "0.7.0", features = ["with-chrono"] }
+rusqlite = { version = "0.38", features = ["bundled", "chrono"] }
+sea-query-rusqlite = { version = "0.8.0", features = ["with-chrono"] }
+sea-query = { version = "1.0", features = ["with-chrono", "attr"] }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
 thiserror = { workspace = true }
 ts-rs = { workspace = true }
+
+[target.'cfg(not(target_arch = "wasm32"))'.dependencies]
+r2d2 = "0.8.10"
+r2d2_sqlite = { version = "0.32" }
+
+# nanoid pulls getrandom, which needs to be told how to reach the browser's
+# CSPRNG on wasm32-unknown-unknown. Native targets are unaffected.
+[target.'cfg(target_arch = "wasm32")'.dependencies]
+getrandom = { version = "0.2", features = ["js"] }
+uuid = { version = "1", features = ["js"] }
@@ -1,9 +1,8 @@
-use r2d2::PooledConnection;
-use r2d2_sqlite::SqliteConnectionManager;
+use crate::pool::SqliteConn;
 use rusqlite::{Connection, Statement, ToSql, Transaction};

 pub enum ConnectionOrTx<'a> {
-    Connection(PooledConnection<SqliteConnectionManager>),
+    Connection(SqliteConn),
    Transaction(&'a Transaction<'a>),
 }

@@ -3,6 +3,7 @@ use crate::error::Error::ModelNotFound;
 use crate::error::Result;
 use crate::traits::UpsertModelInfo;
 use crate::update_source::UpdateSource;
+use sea_query::ExprTrait;
 use sea_query::{
    Asterisk, Expr, Func, IntoColumnRef, IntoIden, OnConflict, Query, SimpleExpr,
    SqliteQueryBuilder,
@@ -7,7 +7,7 @@ pub enum Error {
    SqlError(#[from] rusqlite::Error),

    #[error("SQL Pool error: {0}")]
-    SqlPoolError(#[from] r2d2::Error),
+    SqlPoolError(#[from] crate::pool::PoolError),

    #[error("Database error: {0}")]
    Database(String),
@@ -2,6 +2,7 @@ pub mod connection_or_tx;
 pub mod db_context;
 pub mod error;
 pub mod migrate;
+pub mod pool;
 pub mod traits;
 pub mod update_source;
 pub mod util;
@@ -11,13 +12,15 @@ pub use connection_or_tx::ConnectionOrTx;
 pub use db_context::DbContext;
 pub use error::{Error, Result};
 pub use migrate::run_migrations;
+pub use pool::{PoolError, SqliteConn, SqlitePool};
 pub use traits::{UpsertModelInfo, upsert_date};
 pub use update_source::{ModelChangeEvent, UpdateSource};
 pub use util::{generate_id, generate_id_of_length, generate_prefixed_id};

-// Re-export pool types that consumers will need
+// Re-export types that consumers will need
+#[cfg(not(target_arch = "wasm32"))]
 pub use r2d2;
+#[cfg(not(target_arch = "wasm32"))]
 pub use r2d2_sqlite;
 pub use rusqlite;
 pub use sea_query;
-pub use sea_query_rusqlite;
@@ -1,8 +1,7 @@
 use crate::error::Result;
+use crate::pool::SqlitePool;
 use include_dir::Dir;
 use log::{debug, info};
-use r2d2::Pool;
-use r2d2_sqlite::SqliteConnectionManager;
 use rusqlite::{OptionalExtension, params};

 const TRACKING_TABLE: &str = "_sqlx_migrations";
@@ -11,7 +10,7 @@ const TRACKING_TABLE: &str = "_sqlx_migrations";
 ///
 /// Migrations are sorted by filename (use timestamp prefixes like `00000001_init.sql`).
 /// Applied migrations are tracked in `_sqlx_migrations`.
-pub fn run_migrations(pool: &Pool<SqliteConnectionManager>, dir: &Dir<'_>) -> Result<()> {
+pub fn run_migrations(pool: &SqlitePool, dir: &Dir<'_>) -> Result<()> {
    info!("Running migrations");

    // Create tracking table
@@ -0,0 +1,80 @@
+//! Where connections come from.
+//!
+//! Every query in the model layer asks a pool for a connection, uses it, and
+//! hands it back. That is the whole contract, and it is the one place the
+//! desktop and the browser genuinely differ: the desktop has threads and wants
+//! an r2d2 pool; a browser tab has one thread, no way to spawn another, and one
+//! connection is exactly enough. Everything above this module is identical on
+//! both.
+//!
+//! On native targets `SqlitePool` *is* `r2d2::Pool` — a type alias, so nothing
+//! that already builds pools changes. On wasm it is one connection that every
+//! `get()` hands out a shared handle to.
+//!
+//! A `SqliteConn` only ever derefs immutably. The code above this layer opens
+//! transactions with [`rusqlite::Transaction::new_unchecked`], which takes
+//! `&Connection`; the `&mut` that `Connection::transaction` demands is a
+//! compile-time guard against nesting a transaction on one connection, and it
+//! is what would have forced the wasm pool to lend its connection exclusively.
+//! The model layer nests connections freely — a helper that already holds one
+//! calls another that asks for its own — so an exclusive lend would panic on
+//! the second ask. Sharing the handle instead makes nested *reads* work the way
+//! they do on the desktop; nested *write transactions* fail on both, only
+//! differently (here SQLite refuses the inner `BEGIN`; natively the inner
+//! connection blocks on `busy_timeout` and then fails).
+
+#[cfg(not(target_arch = "wasm32"))]
+mod imp {
+    use r2d2_sqlite::SqliteConnectionManager;
+
+    pub type SqlitePool = r2d2::Pool<SqliteConnectionManager>;
+    pub type SqliteConn = r2d2::PooledConnection<SqliteConnectionManager>;
+    pub type PoolError = r2d2::Error;
+}
+
+#[cfg(target_arch = "wasm32")]
+mod imp {
+    use rusqlite::Connection;
+    use std::ops::Deref;
+    use std::rc::Rc;
+
+    /// One connection, shared by everyone who asks.
+    ///
+    /// `Rc` rather than `Arc` because a `Connection` is `!Sync`, so wrapping
+    /// it in an `Arc` would buy no `Send`/`Sync` anyway — and there is one
+    /// thread here to be honest about.
+    #[derive(Clone, Debug)]
+    pub struct SqlitePool {
+        conn: Rc<Connection>,
+    }
+
+    impl SqlitePool {
+        pub fn single(conn: Connection) -> Self {
+            Self { conn: Rc::new(conn) }
+        }
+
+        /// Another handle to the connection. Cannot fail; the `Result` keeps
+        /// the signature identical to r2d2's so callers are written once.
+        pub fn get(&self) -> Result<SqliteConn, PoolError> {
+            Ok(SqliteConn(self.conn.clone()))
+        }
+    }
+
+    /// The error a `get()` would return if it could. It can't, so this has no
+    /// variants; it exists so `Error::SqlPoolError` has the same shape on both
+    /// targets.
+    #[derive(Debug, thiserror::Error)]
+    pub enum PoolError {}
+
+    #[derive(Debug)]
+    pub struct SqliteConn(Rc<Connection>);
+
+    impl Deref for SqliteConn {
+        type Target = Connection;
+        fn deref(&self) -> &Connection {
+            &self.0
+        }
+    }
+}
+
+pub use imp::*;
@@ -0,0 +1,18 @@
+[package]
+name = "yaak-rpc-schema"
+version = "0.0.0"
+edition = "2024"
+authors = ["Gregory Schier"]
+publish = false
+
+[dependencies]
+serde = { workspace = true, features = ["derive"] }
+ts-rs = { workspace = true }
+yaak-git = { workspace = true }
+yaak-grpc = { workspace = true }
+yaak-models = { workspace = true }
+yaak-plugins = { workspace = true }
+yaak-sse = { workspace = true }
+yaak-sync = { workspace = true }
+yaak-templates = { workspace = true }
+yaak-ws = { workspace = true }
@@ -0,0 +1,44 @@
+# yaak-rpc-schema
+
+The wire schema for the app's RPC surface: every command name, its request
+payload, and its response type, declared once.
+
+Every host that serves the Yaak UI — the desktop app today, the browser bridge
+and anything after it — imports these types and implements the commands against
+them. That is what keeps a request's shape from drifting between hosts, and it
+is why the TypeScript bindings (`bindings/gen_rpc.ts`, exposed to the frontend
+as `@yaakapp-internal/rpc-schema`) are generated from one place.
+
+Nothing here depends on Tauri or on any host. Request structs are plain data,
+and so are the few response types declared here rather than in an engine crate.
+Command *bodies* live with the host that runs them.
+
+## Adding a command
+
+1. Add its request struct and an entry in `with_commands!` in `src/lib.rs`.
+2. Write the adapter in each host — the desktop's live in
+   `crates-tauri/yaak-app-client/src/rpc_ext.rs`. A host that does not support
+   the command still has to say so; a missing adapter fails to compile.
+3. Regenerate the bindings: `cargo test -p yaak-rpc-schema` writes
+   `bindings/gen_rpc.ts`, which is committed.
+
+## How hosts consume the list
+
+`with_commands!` takes the name of a `macro_rules!` macro and calls it with the
+full `name(Req) -> Res` list. Each host writes a small macro that receives that
+list and builds its router:
+
+```rust
+macro_rules! register_commands {
+    ( $( $name:ident ( $req:ty ) -> $res:ty ),* $(,)? ) => {
+        pub fn build_router() -> RpcRouter<MyCtx> {
+            let mut router = RpcRouter::new();
+            $( router.register(stringify!($name), rpc_handler_async!($name)); )*
+            router
+        }
+    };
+}
+yaak_rpc_schema::with_commands!(register_commands);
+```
+
+The schema decides *what* commands exist; the host decides *how* each one runs.
@@ -0,0 +1,4 @@
+// The RPC wire schema, generated by ts-rs from the Rust declarations in
+// src/lib.rs. `RpcSchema` maps every command name to its (request, response)
+// pair; the app's `rpc()` helper derives its command union from it.
+export * from "./bindings/gen_rpc";
@@ -0,0 +1,6 @@
+{
+  "name": "@yaakapp-internal/rpc-schema",
+  "version": "1.0.0",
+  "private": true,
+  "main": "index.ts"
+}
@@ -0,0 +1,23 @@
+[package]
+name = "yaak-commands"
+version = "0.0.0"
+edition = "2024"
+authors = ["Gregory Schier"]
+publish = false
+
+[dependencies]
+log = { workspace = true }
+serde_json = { workspace = true }
+thiserror = { workspace = true }
+tokio = { workspace = true, features = ["rt"] }
+yaak = { workspace = true }
+yaak-core = { workspace = true }
+yaak-crypto = { workspace = true }
+yaak-models = { workspace = true }
+yaak-plugins = { workspace = true }
+yaak-rpc-schema = { workspace = true }
+yaak-templates = { workspace = true }
+
+[dev-dependencies]
+tempfile = "3"
+tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }
@@ -0,0 +1,23 @@
+//! Export and formatting.
+
+use crate::error::Result;
+use crate::host::Host;
+use std::path::Path;
+use yaak::export::{self, ExportDataParams};
+use yaak_rpc_schema::*;
+use yaak_templates::format_json::format_json;
+
+pub async fn cmd_export_data<H: Host>(host: H, req: CmdExportDataReq) -> Result<()> {
+    let version = host.app_version();
+    Ok(export::export_data(ExportDataParams {
+        query_manager: host.query_manager(),
+        yaak_version: &version,
+        export_path: Path::new(&req.export_path),
+        workspace_ids: req.workspace_ids.iter().map(|s| s.as_str()).collect(),
+        include_private_environments: req.include_private_environments,
+    })?)
+}
+
+pub async fn cmd_format_json<H: Host>(_host: H, req: CmdFormatJsonReq) -> Result<String> {
+    Ok(format_json(&req.text, "  "))
+}
@@ -0,0 +1,41 @@
+//! Workspace encryption keys and the `secure()` template function.
+
+use crate::error::Result;
+use crate::host::{Host, PluginHost};
+use yaak_plugins::native_template_functions::decrypt_secure_template_function;
+use yaak_rpc_schema::*;
+
+pub async fn cmd_enable_encryption<H: Host>(host: H, req: CmdEnableEncryptionReq) -> Result<()> {
+    host.encryption_manager().ensure_workspace_key(&req.workspace_id)?;
+    host.encryption_manager().reveal_workspace_key(&req.workspace_id)?;
+    Ok(())
+}
+
+pub async fn cmd_reveal_workspace_key<H: Host>(
+    host: H,
+    req: CmdRevealWorkspaceKeyReq,
+) -> Result<String> {
+    Ok(host.encryption_manager().reveal_workspace_key(&req.workspace_id)?)
+}
+
+pub async fn cmd_set_workspace_key<H: Host>(host: H, req: CmdSetWorkspaceKeyReq) -> Result<()> {
+    host.encryption_manager().set_human_key(&req.workspace_id, &req.key)?;
+    Ok(())
+}
+
+pub async fn cmd_disable_encryption<H: Host>(host: H, req: CmdDisableEncryptionReq) -> Result<()> {
+    host.encryption_manager().disable_encryption(&req.workspace_id)?;
+    Ok(())
+}
+
+pub async fn cmd_decrypt_template<H: Host>(host: H, req: CmdDecryptTemplateReq) -> Result<String> {
+    let plugin_context = host.plugin_context();
+    Ok(decrypt_secure_template_function(host.encryption_manager(), &plugin_context, &req.template)?)
+}
+
+pub async fn cmd_secure_template<H: PluginHost>(
+    host: H,
+    req: CmdSecureTemplateReq,
+) -> Result<String> {
+    host.encrypt_secure_template(&req.template).await
+}
@@ -0,0 +1,30 @@
+use thiserror::Error;
+
+#[derive(Debug, Error)]
+pub enum Error {
+    #[error(transparent)]
+    Yaak(#[from] yaak::Error),
+
+    #[error(transparent)]
+    Model(#[from] yaak_models::error::Error),
+
+    #[error(transparent)]
+    Plugin(#[from] yaak_plugins::error::Error),
+
+    #[error(transparent)]
+    Crypto(#[from] yaak_crypto::error::Error),
+
+    #[error(transparent)]
+    Template(#[from] yaak_templates::error::Error),
+
+    #[error("JSON error: {0}")]
+    Json(#[from] serde_json::Error),
+
+    #[error("I/O error: {0}")]
+    Io(#[from] std::io::Error),
+
+    #[error("{0}")]
+    Generic(String),
+}
+
+pub type Result<T> = std::result::Result<T, Error>;
@@ -0,0 +1,118 @@
+//! What a command needs from whatever is running it.
+//!
+//! A command handler is invoked on behalf of one client (a desktop window today)
+//! and needs a handful of things from its surroundings: the shared engine
+//! managers, who the client is, what the client is looking at, and a little
+//! about the app. `Host` is that handful and nothing more. The desktop
+//! implements it over a `WebviewWindow`; a server would implement it over a
+//! connection. Handlers are generic over it, so the same handler body runs
+//! under either without knowing which.
+//!
+//! The surface grows only when a handler being moved here needs something new,
+//! and stays as narrow as those handlers allow. What is deliberately *not* here
+//! is anything only a desktop can do — open a native window, run the updater,
+//! show a native dialog — those handlers stay with the desktop.
+
+use std::future::Future;
+use yaak_core::WorkspaceContext;
+use yaak_crypto::manager::EncryptionManager;
+use yaak_models::blob_manager::{BlobContext, BlobManager};
+use yaak_models::client_db::ClientDb;
+use yaak_models::models::Plugin;
+use yaak_models::query_manager::QueryManager;
+use yaak_models::util::UpdateSource;
+use yaak_plugins::events::PluginContext;
+use yaak_plugins::plugin_meta::PluginMetadata;
+
+/// Only `Clone` is required here. `Send`/`Sync`/`'static` are deliberately
+/// *not*: a browser host is single-threaded and its connection pool is an
+/// `Rc<Connection>` — `rusqlite::Connection` is not `Sync` to begin with — so a
+/// thread-safety bound on the trait would lock that host out of implementing it
+/// at all. The router needs those bounds and states them itself, which is where
+/// they belong: they are a property of a particular transport, not of a command.
+pub trait Host: Clone {
+    /// Stable identity of the client this call is for. On the desktop this is
+    /// the window label. It rides on every model write so the client that made
+    /// a change can tell its own echo from everyone else's.
+    fn client_id(&self) -> &str;
+
+    /// What the client is currently looking at: workspace, environment, cookie
+    /// jar, request. Read at call time, since the client can navigate between
+    /// calls (and during one).
+    fn session(&self) -> WorkspaceContext;
+
+    /// The app version, as reported to the Yaak API and stamped on exports.
+    fn app_version(&self) -> String;
+
+    fn query_manager(&self) -> &QueryManager;
+    fn blob_manager(&self) -> &BlobManager;
+    fn encryption_manager(&self) -> &EncryptionManager;
+
+    // -- Conveniences derived from the above; hosts do not override these --
+
+    fn update_source(&self) -> UpdateSource {
+        UpdateSource::from_window_label(self.client_id())
+    }
+
+    fn plugin_context(&self) -> PluginContext {
+        PluginContext::new(Some(self.client_id().to_string()), self.session().workspace_id)
+    }
+
+    fn db(&self) -> ClientDb<'_> {
+        self.query_manager().connect()
+    }
+
+    fn blobs(&self) -> BlobContext {
+        self.blob_manager().connect()
+    }
+}
+
+/// A host that can also reach plugins.
+///
+/// Separate from [`Host`] so that a command which only touches the database
+/// never demands a plugin runtime it does not call: a host with no plugins
+/// still serves those, and only handlers bounded on `PluginHost` are closed to
+/// it.
+///
+/// These are *operations*, not a handle. Handing back a `&PluginManager` would
+/// have been shorter, but that type is specifically "spawn a Node sidecar and
+/// talk to it over a socket", and a browser host runs plugins in a Worker it
+/// reaches by message — it can answer any of the questions below and can never
+/// produce that type. Naming the questions instead of the answerer is what lets
+/// both hosts exist.
+///
+/// Same rule as [`Host`]: this grows only when a migrated handler needs
+/// something new, and stays as narrow as those handlers allow. Today it is the
+/// four things batch 1 asks for.
+///
+/// The types crossing this boundary still come from `yaak-plugins` — fine on
+/// the desktop, and once its plain data types are split out from its runtime
+/// that becomes an import-path change here rather than an interface one.
+pub trait PluginHost: Host {
+    /// What the running plugin runtime knows about the plugin installed in
+    /// `directory`, or `None` if it has not loaded one from there. Callers fall
+    /// back to reading the plugin's manifest off disk.
+    fn loaded_plugin_metadata(
+        &self,
+        directory: &str,
+    ) -> impl Future<Output = Option<PluginMetadata>>;
+
+    /// Failures from plugin initialization, drained — reporting them clears
+    /// them, so a caller that drops these has lost them.
+    fn take_plugin_init_errors(&self) -> impl Future<Output = Vec<(String, String)>>;
+
+    /// The plugin rows as the runtime sees them: the database says what is
+    /// installed, the runtime knows which are bundled and what version actually
+    /// loaded. A host without a runtime can return them untouched.
+    fn resolve_plugins(&self, plugins: Vec<Plugin>) -> impl Future<Output = Vec<Plugin>>;
+
+    /// Re-encrypt the `secure(...)` values in a template.
+    ///
+    /// Whole operation rather than its pieces because the encryption is only
+    /// half of it: the value is also run through the plugin template functions,
+    /// so this needs the plugin runtime and not just a key.
+    fn encrypt_secure_template(
+        &self,
+        template: &str,
+    ) -> impl Future<Output = crate::Result<String>>;
+}
@@ -0,0 +1,23 @@
+//! Command handlers for the RPC surface, written against [`Host`] instead of
+//! any particular host.
+//!
+//! `yaak_rpc_schema` declares what each command is called and what it takes
+//! and returns; this crate is where the bodies live. Every handler has the
+//! shape the router wants — `async fn(host, Req) -> Result<Res>` — so a host
+//! registers one with a one-line adapter (or none at all), and never
+//! redeclares a command.
+//!
+//! Not every command is here yet. Handlers move in as they are freed of
+//! host-specific types; the ones that stay behind are the ones only a desktop
+//! can serve (native windows, the updater, dialogs) or that still lean on it.
+
+pub mod data;
+pub mod encryption;
+pub mod error;
+pub mod host;
+pub mod models;
+pub mod plugins;
+pub mod responses;
+
+pub use error::{Error, Result};
+pub use host::{Host, PluginHost};
@@ -0,0 +1,179 @@
+//! Reads and writes of models, keyed by the client's identity so the frontend
+//! can suppress its own echoes.
+
+use crate::error::Result;
+use crate::host::{Host, PluginHost};
+use yaak_models::models::{
+    AnyModel, GraphQlIntrospection, GrpcEvent, HttpRequestHeader, Settings, WebsocketEvent,
+    WorkspaceMeta,
+};
+use yaak_models::queries::workspaces::default_headers;
+use yaak_rpc_schema::*;
+
+pub async fn models_upsert<H: Host>(host: H, req: ModelsUpsertReq) -> Result<String> {
+    let db = host.db();
+    let blobs = host.blob_manager();
+    let source = host.update_source();
+    Ok(yaak_models::models_ops::upsert_model(&db, blobs, req.model, &source)?)
+}
+
+/// Deletes cascade — a workspace can hold thousands of requests — and run in a
+/// transaction, which holds a raw connection for the duration.
+///
+/// Whether that wants a blocking thread is the *host's* question, not the
+/// delete's: a desktop with a multi-threaded runtime should keep this off the
+/// runtime (see its adapter), while a single-threaded host has nothing to move
+/// it to and runs it here. So this is the plain version, and a host that wants
+/// to relocate it calls [`models_delete_blocking`] itself.
+pub async fn models_delete<H: Host>(host: H, req: ModelsDeleteReq) -> Result<String> {
+    models_delete_blocking(&host, req)
+}
+
+/// The body of [`models_delete`], callable from a blocking context.
+pub fn models_delete_blocking<H: Host>(host: &H, req: ModelsDeleteReq) -> Result<String> {
+    let source = host.update_source();
+    Ok(host.query_manager().with_tx(|tx| {
+        yaak_models::models_ops::delete_model(tx, host.blob_manager(), req.model, &source)
+    })?)
+}
+
+/// Duplicates recurse, so this runs in a transaction too.
+pub async fn models_duplicate<H: Host>(host: H, req: ModelsDuplicateReq) -> Result<String> {
+    let source = host.update_source();
+    Ok(host.query_manager().with_tx(|tx| {
+        yaak_models::models_ops::duplicate_model(tx, &req.model_type, &req.model_id, &source)
+    })?)
+}
+
+pub async fn models_websocket_events<H: Host>(
+    host: H,
+    req: ModelsWebsocketEventsReq,
+) -> Result<Vec<WebsocketEvent>> {
+    Ok(host.db().list_websocket_events(&req.connection_id)?)
+}
+
+pub async fn models_grpc_events<H: Host>(
+    host: H,
+    req: ModelsGrpcEventsReq,
+) -> Result<Vec<GrpcEvent>> {
+    Ok(host.db().list_grpc_events(&req.connection_id)?)
+}
+
+pub async fn models_get_settings<H: Host>(host: H, _req: ModelsGetSettingsReq) -> Result<Settings> {
+    Ok(host.db().get_settings())
+}
+
+pub async fn models_get_graphql_introspection<H: Host>(
+    host: H,
+    req: ModelsGetGraphqlIntrospectionReq,
+) -> Result<Option<GraphQlIntrospection>> {
+    Ok(host.db().get_graphql_introspection(&req.request_id))
+}
+
+pub async fn models_upsert_graphql_introspection<H: Host>(
+    host: H,
+    req: ModelsUpsertGraphqlIntrospectionReq,
+) -> Result<GraphQlIntrospection> {
+    let source = host.update_source();
+    Ok(host.db().upsert_graphql_introspection(
+        &req.workspace_id,
+        &req.request_id,
+        req.content,
+        &source,
+    )?)
+}
+
+/// Everything the frontend's model store needs to boot, as one JSON string.
+///
+/// A string rather than a `Vec<AnyModel>` because the desktop has to escape
+/// this payload before it crosses into the webview (see its adapter), and the
+/// frontend `JSON.parse`s either form the same way.
+pub async fn models_workspace_models<H: PluginHost>(
+    host: H,
+    req: ModelsWorkspaceModelsReq,
+) -> Result<String> {
+    let mut l: Vec<AnyModel> = Vec::new();
+
+    // Add the global models
+    {
+        let db = host.db();
+        l.push(db.get_settings().into());
+        l.append(&mut db.list_workspaces()?.into_iter().map(Into::into).collect());
+        l.append(&mut db.list_key_values()?.into_iter().map(Into::into).collect());
+    }
+
+    let plugins = {
+        let db = host.db();
+        db.list_plugins()?
+    };
+
+    let plugins = host.resolve_plugins(plugins).await;
+    l.append(&mut plugins.into_iter().map(Into::into).collect());
+
+    // Add the workspace children
+    if let Some(wid) = req.workspace_id.as_deref() {
+        let db = host.db();
+        l.append(&mut db.list_cookie_jars(wid)?.into_iter().map(Into::into).collect());
+        l.append(&mut db.list_environments_ensure_base(wid)?.into_iter().map(Into::into).collect());
+        l.append(&mut db.list_folders(wid)?.into_iter().map(Into::into).collect());
+        l.append(&mut db.list_grpc_connections(wid)?.into_iter().map(Into::into).collect());
+        l.append(&mut db.list_grpc_requests(wid)?.into_iter().map(Into::into).collect());
+        l.append(&mut db.list_http_requests(wid)?.into_iter().map(Into::into).collect());
+        l.append(&mut db.list_http_responses(wid, None)?.into_iter().map(Into::into).collect());
+        l.append(&mut db.list_websocket_connections(wid)?.into_iter().map(Into::into).collect());
+        l.append(&mut db.list_websocket_requests(wid)?.into_iter().map(Into::into).collect());
+        l.append(&mut db.list_workspace_metas(wid)?.into_iter().map(Into::into).collect());
+    }
+
+    Ok(serde_json::to_string(&l)?)
+}
+
+pub async fn cmd_get_workspace_meta<H: Host>(
+    host: H,
+    req: CmdGetWorkspaceMetaReq,
+) -> Result<WorkspaceMeta> {
+    let db = host.db();
+    let workspace = db.get_workspace(&req.workspace_id)?;
+    Ok(db.get_or_create_workspace_meta(&workspace.id)?)
+}
+
+pub async fn cmd_delete_all_grpc_connections<H: Host>(
+    host: H,
+    req: CmdDeleteAllGrpcConnectionsReq,
+) -> Result<()> {
+    Ok(host.db().delete_all_grpc_connections_for_request(&req.request_id, &host.update_source())?)
+}
+
+pub async fn cmd_delete_all_http_responses<H: Host>(
+    host: H,
+    req: CmdDeleteAllHttpResponsesReq,
+) -> Result<()> {
+    host.db().delete_all_http_responses_for_request(&req.request_id, &host.update_source())?;
+    Ok(())
+}
+
+pub async fn cmd_ws_delete_connections<H: Host>(
+    host: H,
+    req: CmdWsDeleteConnectionsReq,
+) -> Result<()> {
+    Ok(host
+        .db()
+        .delete_all_websocket_connections_for_request(&req.request_id, &host.update_source())?)
+}
+
+pub async fn cmd_delete_send_history<H: Host>(host: H, req: CmdDeleteSendHistoryReq) -> Result<()> {
+    Ok(host.query_manager().with_tx(|tx| {
+        let source = &host.update_source();
+        tx.delete_all_http_responses_for_workspace(&req.workspace_id, source)?;
+        tx.delete_all_grpc_connections_for_workspace(&req.workspace_id, source)?;
+        tx.delete_all_websocket_connections_for_workspace(&req.workspace_id, source)?;
+        Ok::<(), yaak_models::error::Error>(())
+    })?)
+}
+
+pub async fn cmd_default_headers<H: Host>(
+    _host: H,
+    _req: CmdDefaultHeadersReq,
+) -> Result<Vec<HttpRequestHeader>> {
+    Ok(default_headers())
+}
@@ -0,0 +1,48 @@
+//! Plugin queries: what the runtime has loaded, and what failed to load.
+
+use crate::error::Result;
+use crate::host::PluginHost;
+use std::path::PathBuf;
+use yaak_plugins::plugin_meta::{PluginMetadata, get_plugin_meta};
+use yaak_rpc_schema::*;
+
+pub async fn cmd_plugin_info<H: PluginHost>(
+    host: H,
+    req: CmdPluginInfoReq,
+) -> Result<PluginMetadata> {
+    let plugin = host.db().get_plugin(&req.id)?;
+    if let Some(metadata) = host.loaded_plugin_metadata(&plugin.directory).await {
+        return Ok(metadata);
+    }
+
+    if let Ok(metadata) = get_plugin_meta(&PathBuf::from(&plugin.directory)) {
+        return Ok(metadata);
+    }
+
+    Ok(fallback_plugin_metadata(&plugin.directory))
+}
+
+fn fallback_plugin_metadata(directory: &str) -> PluginMetadata {
+    let display_name = PathBuf::from(directory)
+        .file_name()
+        .and_then(|name| name.to_str())
+        .filter(|name| !name.is_empty())
+        .unwrap_or(directory)
+        .to_string();
+
+    PluginMetadata {
+        version: "Unavailable".to_string(),
+        name: directory.to_string(),
+        display_name,
+        description: Some(format!("Plugin metadata could not be loaded from {directory}")),
+        homepage_url: None,
+        repository_url: None,
+    }
+}
+
+pub async fn cmd_plugin_init_errors<H: PluginHost>(
+    host: H,
+    _req: CmdPluginInitErrorsReq,
+) -> Result<Vec<(String, String)>> {
+    Ok(host.take_plugin_init_errors().await)
+}
@@ -0,0 +1,86 @@
+//! Reading back what a send left behind: response events, request bodies, and
+//! where a response body lives.
+
+use crate::error::{Error, Result};
+use crate::host::Host;
+use std::fs;
+use std::path::PathBuf;
+use yaak_models::client_db::ClientDb;
+use yaak_models::models::HttpResponseEvent;
+use yaak_rpc_schema::*;
+
+/// Where a response's body is, and what it is meant to be read as.
+pub struct ResponseBodyLocation {
+    /// None when the response has no stored body.
+    pub path: Option<PathBuf>,
+    /// The response's declared `Content-Type`, empty when it has none.
+    pub content_type: String,
+}
+
+/// Find a response's body from its id alone.
+///
+/// The frontend hands back an id and never a path, so the only bodies reachable
+/// here are ones the engine wrote and the database still knows about. A
+/// response that was never saved has no entry, and its body came back from the
+/// send that made it.
+pub fn locate_response_body(db: &ClientDb, response_id: &str) -> Result<ResponseBodyLocation> {
+    let response = db.get_http_response(response_id)?;
+
+    Ok(ResponseBodyLocation {
+        path: response.body_path.map(PathBuf::from),
+        content_type: response
+            .headers
+            .iter()
+            .find(|h| h.name.eq_ignore_ascii_case("content-type"))
+            .map(|h| h.value.clone())
+            .unwrap_or_default(),
+    })
+}
+
+pub async fn cmd_get_http_response_events<H: Host>(
+    host: H,
+    req: CmdGetHttpResponseEventsReq,
+) -> Result<Vec<HttpResponseEvent>> {
+    let events: Vec<HttpResponseEvent> = host.db().list_http_response_events(&req.response_id)?;
+    Ok(events)
+}
+
+/// The body's path on this machine, for the desktop host to read or hand to the
+/// webview's asset protocol.
+///
+/// The frontend holds response ids; only `packages/platform`'s Tauri host sees
+/// the path, and only because it is about to open the file itself. Hosts
+/// without a filesystem serve the same bytes over HTTP instead.
+pub async fn cmd_http_response_body_path<H: Host>(
+    host: H,
+    req: CmdHttpResponseBodyPathReq,
+) -> Result<Option<String>> {
+    let location = locate_response_body(&host.db(), &req.response_id)?;
+    Ok(location.path.map(|p| p.to_string_lossy().to_string()))
+}
+
+pub async fn cmd_http_request_body<H: Host>(
+    host: H,
+    req: CmdHttpRequestBodyReq,
+) -> Result<Option<Vec<u8>>> {
+    let body_id = format!("{}.request", req.response_id);
+    let chunks = host.blobs().get_chunks(&body_id)?;
+
+    if chunks.is_empty() {
+        return Ok(None);
+    }
+
+    // Concatenate all chunks
+    let body: Vec<u8> = chunks.into_iter().flat_map(|c| c.data).collect();
+    Ok(Some(body))
+}
+
+pub async fn cmd_save_response<H: Host>(host: H, req: CmdSaveResponseReq) -> Result<()> {
+    let response = host.db().get_http_response(&req.response_id)?;
+
+    let body_path =
+        response.body_path.ok_or(Error::Generic("Response does not have a body".to_string()))?;
+    fs::copy(body_path, &req.filepath).map_err(|e| Error::Generic(e.to_string()))?;
+
+    Ok(())
+}
@@ -0,0 +1,237 @@
+//! A host that is nothing but the trait: a temp database, a fixed client id,
+//! a fixed session. It exists to prove that the handlers really do run without
+//! a desktop around them, and that the client's identity reaches the writes.
+//!
+//! Neither host here has a plugin runtime — no `PluginManager`, no sidecar.
+//! `TestHost` implements `Host` alone, so a handler that reaches for plugins
+//! would not compile against it. `SingleThreadedHost` goes further and answers
+//! `PluginHost` too, without one, which is only possible because that trait
+//! names operations rather than handing back a manager.
+
+use std::rc::Rc;
+use std::sync::{Arc, Mutex};
+use tempfile::TempDir;
+use yaak_commands::models::{
+    cmd_default_headers, cmd_get_workspace_meta, models_delete, models_upsert,
+    models_workspace_models,
+};
+use yaak_commands::{Host, PluginHost};
+use yaak_core::WorkspaceContext;
+use yaak_crypto::manager::EncryptionManager;
+use yaak_models::blob_manager::BlobManager;
+use yaak_models::models::{AnyModel, Plugin, Workspace};
+use yaak_models::query_manager::QueryManager;
+use yaak_models::util::{ModelPayload, UpdateSource};
+use yaak_plugins::plugin_meta::PluginMetadata;
+use yaak_rpc_schema::{
+    CmdDefaultHeadersReq, CmdGetWorkspaceMetaReq, ModelsDeleteReq, ModelsUpsertReq,
+    ModelsWorkspaceModelsReq,
+};
+
+#[derive(Clone)]
+struct TestHost {
+    inner: Arc<Inner>,
+}
+
+struct Inner {
+    _dir: TempDir,
+    query_manager: QueryManager,
+    blob_manager: BlobManager,
+    encryption_manager: EncryptionManager,
+    /// Every model write the database reported, so a test can check who it
+    /// says made them.
+    writes: Mutex<Vec<ModelPayload>>,
+    rx: Mutex<std::sync::mpsc::Receiver<ModelPayload>>,
+}
+
+impl TestHost {
+    fn new() -> Self {
+        let dir = TempDir::new().expect("temp dir");
+        let (query_manager, blob_manager, rx) = yaak_models::init_standalone(
+            dir.path().join("db.sqlite"),
+            dir.path().join("blobs.sqlite"),
+        )
+        .expect("init db");
+        let encryption_manager = EncryptionManager::new(query_manager.clone(), "app.yaak.test");
+        Self {
+            inner: Arc::new(Inner {
+                _dir: dir,
+                query_manager,
+                blob_manager,
+                encryption_manager,
+                writes: Mutex::new(Vec::new()),
+                rx: Mutex::new(rx),
+            }),
+        }
+    }
+
+    fn drain_writes(&self) -> Vec<ModelPayload> {
+        let rx = self.inner.rx.lock().unwrap();
+        let mut writes = self.inner.writes.lock().unwrap();
+        while let Ok(payload) = rx.try_recv() {
+            writes.push(payload);
+        }
+        writes.drain(..).collect()
+    }
+}
+
+impl Host for TestHost {
+    fn client_id(&self) -> &str {
+        "test-client"
+    }
+
+    fn session(&self) -> WorkspaceContext {
+        WorkspaceContext::new().with_workspace("wk_test")
+    }
+
+    fn app_version(&self) -> String {
+        "0.0.0-test".to_string()
+    }
+
+    fn query_manager(&self) -> &QueryManager {
+        &self.inner.query_manager
+    }
+
+    fn blob_manager(&self) -> &BlobManager {
+        &self.inner.blob_manager
+    }
+
+    fn encryption_manager(&self) -> &EncryptionManager {
+        &self.inner.encryption_manager
+    }
+}
+
+#[tokio::test(flavor = "multi_thread")]
+async fn writes_carry_the_client_id() {
+    let host = TestHost::new();
+
+    let workspace = Workspace { name: "From a test".to_string(), ..Default::default() };
+    let id = models_upsert(host.clone(), ModelsUpsertReq { model: AnyModel::Workspace(workspace) })
+        .await
+        .expect("upsert");
+    assert!(id.starts_with("wk_"), "unexpected id {id}");
+
+    let writes = host.drain_writes();
+    assert_eq!(writes.len(), 1);
+    assert!(
+        matches!(&writes[0].update_source, UpdateSource::Window { label } if label == "test-client"),
+        "the write should be attributed to the calling client, got {:?}",
+        writes[0].update_source,
+    );
+
+    let meta =
+        cmd_get_workspace_meta(host.clone(), CmdGetWorkspaceMetaReq { workspace_id: id.clone() })
+            .await
+            .expect("workspace meta");
+    assert_eq!(meta.workspace_id, id);
+
+    // Deletes cascade inside a transaction; make sure that path works with no
+    // host doing anything special around it.
+    let workspace = host.db().get_workspace(&id).expect("get workspace");
+    let deleted =
+        models_delete(host.clone(), ModelsDeleteReq { model: AnyModel::Workspace(workspace) })
+            .await
+            .expect("delete");
+    assert_eq!(deleted, id);
+    assert!(host.db().get_workspace(&id).is_err(), "workspace should be gone");
+}
+
+#[tokio::test]
+async fn host_free_handlers_need_no_state() {
+    let host = TestHost::new();
+    let headers = cmd_default_headers(host, CmdDefaultHeadersReq {}).await.expect("headers");
+    assert!(!headers.is_empty());
+}
+
+/// A host that is deliberately **not** `Send` or `Sync`: it keeps its state in
+/// an `Rc`, the way a single-threaded browser host has to, since
+/// `rusqlite::Connection` is not `Sync` to begin with. It also has no plugin
+/// runtime of any kind — no `PluginManager`, no sidecar, nothing to spawn.
+///
+/// Nothing here asserts much at runtime; the test is largely that it compiles.
+/// A `Host` demanding thread-safety, or a `PluginHost` handing back a
+/// `&PluginManager`, would shut such a host out of the traits entirely and this
+/// file would stop building.
+#[derive(Clone)]
+struct SingleThreadedHost {
+    inner: Rc<Inner>,
+}
+
+impl Host for SingleThreadedHost {
+    fn client_id(&self) -> &str {
+        "tab-1"
+    }
+
+    fn session(&self) -> WorkspaceContext {
+        WorkspaceContext::new()
+    }
+
+    fn app_version(&self) -> String {
+        "0.0.0-web".to_string()
+    }
+
+    fn query_manager(&self) -> &QueryManager {
+        &self.inner.query_manager
+    }
+
+    fn blob_manager(&self) -> &BlobManager {
+        &self.inner.blob_manager
+    }
+
+    fn encryption_manager(&self) -> &EncryptionManager {
+        &self.inner.encryption_manager
+    }
+}
+
+/// Answering plugin questions with no plugin runtime behind them. A browser
+/// host would put a `postMessage` round-trip to its Worker where these return
+/// constants; the shape of the trait is what makes either possible.
+impl PluginHost for SingleThreadedHost {
+    async fn loaded_plugin_metadata(&self, _directory: &str) -> Option<PluginMetadata> {
+        None
+    }
+
+    async fn take_plugin_init_errors(&self) -> Vec<(String, String)> {
+        Vec::new()
+    }
+
+    async fn resolve_plugins(&self, plugins: Vec<Plugin>) -> Vec<Plugin> {
+        // No runtime to enrich them with; the database rows are still the truth
+        // about what is installed.
+        plugins
+    }
+
+    async fn encrypt_secure_template(&self, _template: &str) -> yaak_commands::Result<String> {
+        Err(yaak_commands::Error::Generic("no plugin runtime on this host".into()))
+    }
+}
+
+#[tokio::test]
+async fn a_single_threaded_host_can_implement_the_trait() {
+    let TestHost { inner } = TestHost::new();
+    let host = SingleThreadedHost { inner: Rc::new(Arc::into_inner(inner).expect("sole owner")) };
+
+    let workspace = Workspace { name: "From one thread".to_string(), ..Default::default() };
+    let id = models_upsert(host.clone(), ModelsUpsertReq { model: AnyModel::Workspace(workspace) })
+        .await
+        .expect("upsert");
+
+    // A `PluginHost` command, on a host with no plugin runtime at all. This is
+    // the one that could not be written when the trait handed back a
+    // `&PluginManager`.
+    let json = models_workspace_models(
+        host.clone(),
+        ModelsWorkspaceModelsReq { workspace_id: Some(id.clone()) },
+    )
+    .await
+    .expect("workspace models");
+    assert!(json.contains(&id), "the workspace should be in its own bootstrap payload");
+
+    // The delete path too, since it is the one that used to reach for a
+    // blocking thread this host does not have.
+    let workspace = host.db().get_workspace(&id).expect("get workspace");
+    let deleted = models_delete(host, ModelsDeleteReq { model: AnyModel::Workspace(workspace) })
+        .await
+        .expect("delete");
+    assert_eq!(deleted, id);
+}
@@ -1,5 +1,3 @@
-use std::path::PathBuf;
-
 /// Context for a workspace operation.
 ///
 /// In Tauri, this is extracted from the WebviewWindow URL.
@@ -37,20 +35,3 @@ impl WorkspaceContext {
        self
    }
 }
-
-/// Application context trait for accessing app-level resources.
-///
-/// This abstracts over Tauri's `AppHandle` for path resolution and app identity.
-/// Implemented by Tauri's AppHandle and by CLI's own context struct.
-pub trait AppContext: Send + Sync + Clone {
-    /// Returns the path to the application data directory.
-    /// This is where the database and other persistent data are stored.
-    fn app_data_dir(&self) -> PathBuf;
-
-    /// Returns the application identifier (e.g., "app.yaak.desktop").
-    /// Used for keyring access and other platform-specific features.
-    fn app_identifier(&self) -> &str;
-
-    /// Returns true if running in development mode.
-    fn is_dev(&self) -> bool;
-}
@@ -6,5 +6,5 @@
 mod context;
 mod error;

-pub use context::{AppContext, WorkspaceContext};
+pub use context::WorkspaceContext;
 pub use error::{Error, Result};
@@ -4,7 +4,9 @@ use log::{debug, info, warn};
 use reqwest::{Client, ClientBuilder, Proxy, redirect};
 use std::sync::{Arc, Mutex};
 use yaak_models::models::DnsOverride;
-use yaak_tls::{ClientCertificateConfig, get_tls_config, load_client_identity_pkcs12};
+use yaak_tls::{
+    ClientCertificateConfig, NativeClientIdentity, get_tls_config, load_native_client_identity,
+};

 pub const HTTP2_MAX_RESPONSE_HEADER_LIST_SIZE: u32 = 1024 * 1024;

@@ -61,12 +63,19 @@ static IDENTITY_IMPORT: Mutex<()> = Mutex::new(());
 fn build_native_tls_identity(
    client_cert: Option<ClientCertificateConfig>,
 ) -> Result<Option<native_tls::Identity>> {
-    let Some((pkcs12, password)) = load_client_identity_pkcs12(client_cert)? else {
+    let Some(material) = load_native_client_identity(client_cert)? else {
        return Ok(None);
    };

    let _guard = IDENTITY_IMPORT.lock().unwrap_or_else(|e| e.into_inner());
-    Ok(Some(native_tls::Identity::from_pkcs12(&pkcs12, &password)?))
+    Ok(Some(match material {
+        NativeClientIdentity::Pkcs12 { data, password } => {
+            native_tls::Identity::from_pkcs12(&data, &password)?
+        }
+        NativeClientIdentity::Pkcs8 { chain_pem, key_pem } => {
+            native_tls::Identity::from_pkcs8(&chain_pem, &key_pem)?
+        }
+    }))
 }

 #[derive(Clone)]
@@ -11,11 +11,9 @@ hex = { workspace = true }
 include_dir = "0.7"
 log = { workspace = true }
 nanoid = "0.4.0"
-r2d2 = "0.8.10"
-r2d2_sqlite = { version = "0.25.0" }
-rusqlite = { version = "0.32.1", features = ["bundled", "chrono"] }
-sea-query = { version = "0.32.1", features = ["with-chrono", "attr"] }
-sea-query-rusqlite = { version = "0.7.0", features = ["with-chrono"] }
+rusqlite = { version = "0.38", features = ["bundled", "chrono"] }
+sea-query = { version = "1.0", features = ["with-chrono", "attr"] }
+sea-query-rusqlite = { version = "0.8.0", features = ["with-chrono"] }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
 schemars = { workspace = true }
@@ -23,3 +21,7 @@ sha2 = { workspace = true }
 thiserror = { workspace = true }
 ts-rs = { workspace = true, features = ["chrono-impl", "serde-json-impl"] }
 yaak-core = { workspace = true }
+
+[target.'cfg(not(target_arch = "wasm32"))'.dependencies]
+r2d2 = "0.8.10"
+r2d2_sqlite = { version = "0.32" }
@@ -2,9 +2,8 @@ use crate::error::Result;
 use crate::util::generate_prefixed_id;
 use include_dir::{Dir, include_dir};
 use log::{debug, info};
-use r2d2::Pool;
-use r2d2_sqlite::SqliteConnectionManager;
 use rusqlite::{OptionalExtension, params};
+use yaak_database::{SqliteConn, SqlitePool};

 static BLOB_MIGRATIONS_DIR: Dir = include_dir!("$CARGO_MANIFEST_DIR/blob_migrations");

@@ -29,11 +28,11 @@ impl BodyChunk {
 // whole app whenever the pool is exhausted.
 #[derive(Debug, Clone)]
 pub struct BlobManager {
-    pool: Pool<SqliteConnectionManager>,
+    pool: SqlitePool,
 }

 impl BlobManager {
-    pub fn new(pool: Pool<SqliteConnectionManager>) -> Self {
+    pub fn new(pool: SqlitePool) -> Self {
        Self { pool }
    }

@@ -45,7 +44,7 @@ impl BlobManager {

 /// Context for blob database operations.
 pub struct BlobContext {
-    conn: r2d2::PooledConnection<SqliteConnectionManager>,
+    conn: SqliteConn,
 }

 impl BlobContext {
@@ -131,7 +130,7 @@ impl BlobContext {
 }

 /// Run migrations for the blob database.
-pub fn migrate_blob_db(pool: &Pool<SqliteConnectionManager>) -> Result<()> {
+pub fn migrate_blob_db(pool: &SqlitePool) -> Result<()> {
    info!("Running blob database migrations");

    // Create migrations tracking table
@@ -198,9 +197,9 @@ pub fn migrate_blob_db(pool: &Pool<SqliteConnectionManager>) -> Result<()> {
 mod tests {
    use super::*;

-    fn create_test_pool() -> Pool<SqliteConnectionManager> {
-        let manager = SqliteConnectionManager::memory();
-        let pool = Pool::builder().max_size(1).build(manager).unwrap();
+    fn create_test_pool() -> SqlitePool {
+        let manager = r2d2_sqlite::SqliteConnectionManager::memory();
+        let pool = r2d2::Pool::builder().max_size(1).build(manager).unwrap();
        migrate_blob_db(&pool).unwrap();
        pool
    }
@@ -7,7 +7,7 @@ pub enum Error {
    SqlError(#[from] rusqlite::Error),

    #[error("SQL Pool error: {0}")]
-    SqlPoolError(#[from] r2d2::Error),
+    SqlPoolError(#[from] yaak_database::PoolError),

    #[error("Database error: {0}")]
    Database(String),
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Gregory Schier	0f8413c441	Read OAuth 2.0 token responses from the send instead of the filesystem Both token requests opened HttpResponse.bodyPath with readFileSync, which ties the plugin to bodies living on a filesystem. The send now hands the body back, so they read it from there and keep working once bodies move into the blob DB and in the browser Worker, where there is no fs to read. text() on a response with no body returns "", which is what the bodyPath check produced, so an empty response still parses to {} rather than throwing.	2026-08-16 10:09:43 -07:00
Gregory Schier	0e14625e62	Hand the body back from send instead of holding it for a lookup Holding an unsaved body against its response id let a plugin stash the id and read it in a later call, which would throw only sometimes and only for ad-hoc sends. Documenting that was never going to be enough. send now returns the response and its body together, so there is nothing to stash: an unsaved body is a value you were handed. ctx.httpResponse .body() goes back to meaning one thing, a saved response read by id, and refuses ids it has no row for. Reading is identical either way, so no caller has to know which kind of send it made.	2026-08-16 10:07:44 -07:00
Gregory Schier	8c72538102	Say on send() that an unsaved response's body is call-scoped	2026-08-16 10:00:35 -07:00
Gregory Schier	ffa6a610b8	Return the body of a send that saved nothing Replaces the response-directory fallback with what the frontend already does for ephemeral sends: the engine hands the body back, because it is the only copy. Guessing at a file named for an id was the store reaching around its own abstraction, and it is exactly what must not survive the move to blob storage. The send reply carries the bytes when the engine returned them, and the runtime holds them for the rest of the call that sent them, so ctx.httpResponse.body() answers for a saved and an unsaved response the same way. Unsaved ones now report a real contentType too, taken from the response the send already handed back.	2026-08-16 09:54:56 -07:00
Gregory Schier	8b031db685	Read bodies of responses the engine never recorded A send with no request behind it — a plugin's ad-hoc ctx.httpRequest.send, GraphQL introspection — gets a generated id and a body file, but no row. Resolving purely through the database refused those, which would have broken auth-oauth2 the moment it moved off readFileSync, since every request it sends is ad-hoc. The store now falls back to the response directory when there is no row, accepting only ids shaped the way the engine generates them. Such a response has no stored headers, so contentType is null and text() decodes as UTF-8 — which is what the filesystem readers did anyway.	2026-08-16 09:35:03 -07:00
Gregory Schier	96c8a95094	Add a plugin API for reading HTTP response bodies Plugins read bodies by response id through ctx.httpResponse.body() instead of opening HttpResponse.bodyPath themselves. The accessors are named after fetch's, minus the single-use semantics, since the bytes are durable and re-reading should work. Underneath is a chunked pull over the existing plugin protocol, so the host can move bodies off the filesystem without plugins noticing. text() now decodes with the response's charset rather than assuming UTF-8, and the buffering accessors refuse past 32 MiB and point at chunks().	2026-08-16 09:20:29 -07:00
Gregory Schier	6a02cbe525	Add a Host trait and move DB/model commands off Tauri (#558 )	2026-08-16 08:41:35 -07:00
Gregory Schier	6f91f76064	Run the desktop's model layer in the browser (#557 )	2026-08-16 07:34:48 -07:00
Gregory Schier	32e92d484b	Let yaak-models compile for wasm32-unknown-unknown (#556 )	2026-08-15 14:55:54 -07:00
Gregory Schier	cdbbef34f8	Fix native TLS client certificates on Linux (#554 )	2026-08-15 11:36:36 -07:00
Gregory SchierandClaude Fable 5	4838353585	Move the RPC wire schema into a Tauri-free crate (#553 ) Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-15 11:25:27 -07:00
Gregory Schier	93001e3da7	Extract generic model writes into yaak::models_ops (#552 )	2026-08-15 11:01:41 -07:00
VDShelk Claude Opus 4.7 Gregory Schier	b31c066717	Load GraphQL schema from file for autocomplete (#462 ) Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Gregory Schier <gschier1990@gmail.com>	2026-08-15 10:14:13 -07:00
Gregory Schier	5d1d24870a	Import from a URL in the Import Data dialog (#551 )	2026-08-15 10:03:43 -07:00
Gregory Schier	6f0d0ef275	Don't save response when the file dialog is cancelled	2026-08-15 09:06:07 -07:00
Gregory Schier	85a9b2a908	Address response bodies by response id instead of a filesystem path (#550 )	2026-08-15 08:21:23 -07:00
Gregory Schier	f3f05502d1	Make the HTTP send path runnable without a database (#545 )	2026-08-15 07:17:17 -07:00
pixel-hawk	2e0f7d1818	Add response filter history with pinning (#338 )	2026-08-14 22:44:11 -07:00
Gregory Schier	dc793181bb	Add submenuTrigger option for dropdown items (#548 )	2026-08-14 22:40:07 -07:00
Gregory Schier	7dfa7e07e3	Own response filter state where the filter runs (#549 )	2026-08-14 22:38:38 -07:00