http_stat/

stats.rs

// See the License for the specific language governing permissions and
// limitations under the License.

// Copyright 2025 Tree xie.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

use crate::i18n::Lang;
use crate::tcp_info::{TcpInfo, TcpInfoDelta};
use bytes::Bytes;
use bytesize::ByteSize;
use heck::ToTrainCase;
use http::HeaderMap;
use http::HeaderValue;
use http::StatusCode;
use nu_ansi_term::Color::{LightCyan, LightGreen, LightRed, LightYellow};
use serde_json::{json, Map, Value};
use std::fmt;
use std::io::Write;
use std::time::Duration;
use tempfile::NamedTempFile;
use time::{OffsetDateTime, UtcOffset};
use unicode_truncate::Alignment;
use unicode_truncate::UnicodeTruncateStr;

pub static ALPN_HTTP2: &str = "h2";
pub static ALPN_HTTP1: &str = "http/1.1";
pub static ALPN_HTTP3: &str = "h3";

// Format a Unix timestamp (seconds) as "YYYY-MM-DD HH:MM:SS ±HH:MM" in the
// local timezone. Falls back to UTC if the local offset can't be determined.
pub(crate) fn format_time(timestamp_seconds: i64) -> String {
    let Ok(utc) = OffsetDateTime::from_unix_timestamp(timestamp_seconds) else {
        return timestamp_seconds.to_string();
    };
    let offset = UtcOffset::current_local_offset().unwrap_or(UtcOffset::UTC);
    let dt = utc.to_offset(offset);
    let (h, m, _) = offset.as_hms();
    format!(
        "{:04}-{:02}-{:02} {:02}:{:02}:{:02} {}{:02}:{:02}",
        dt.year(),
        dt.month() as u8,
        dt.day(),
        dt.hour(),
        dt.minute(),
        dt.second(),
        if h < 0 || m < 0 { '-' } else { '+' },
        h.unsigned_abs(),
        m.unsigned_abs(),
    )
}

pub fn format_duration(duration: Duration) -> String {
    if duration > Duration::from_secs(1) {
        return format!("{:.2}s", duration.as_secs_f64());
    }
    if duration > Duration::from_millis(1) {
        return format!("{}ms", duration.as_millis());
    }
    format!("{}µs", duration.as_micros())
}

/// Format a throughput value (bytes/s) into a human-readable string using
/// decimal units (MB/s = 10^6 B/s, the network-convention) — bandwidth is
/// almost universally reported in decimal, even when storage uses binary.
pub fn format_throughput(bytes_per_sec: f64) -> String {
    if !bytes_per_sec.is_finite() || bytes_per_sec <= 0.0 {
        return "-".to_string();
    }
    if bytes_per_sec >= 1_000_000.0 {
        format!("{:.1} MB/s", bytes_per_sec / 1_000_000.0)
    } else if bytes_per_sec >= 1_000.0 {
        format!("{:.1} KB/s", bytes_per_sec / 1_000.0)
    } else {
        format!("{bytes_per_sec:.0} B/s")
    }
}

/// Size of the "first chunk" window used for throughput splitting.
pub const FIRST_CHUNK_BYTES: usize = 100 * 1024;
/// Threshold above which we render the overall Throughput line.
pub const THROUGHPUT_DISPLAY_THRESHOLD: usize = 1024 * 1024;

struct Timeline {
    name: String,
    duration: Duration,
}

/// Statistics and information collected during an HTTP request.
///
/// This struct contains timing information for each phase of the request,
/// connection details, TLS information, and response data.
///
/// # Fields
///
/// * `dns_lookup` - Time taken for DNS resolution
/// * `quic_connect` - Time taken to establish QUIC connection (for HTTP/3)
/// * `tcp_connect` - Time taken to establish TCP connection
/// * `tls_handshake` - Time taken for TLS handshake (for HTTPS)
/// * `request_send` - Time to send the request headers and body
/// * `server_processing` - Time from request fully sent to first response byte
/// * `content_transfer` - Time taken to transfer the response body
/// * `total` - Total time taken for the entire request
/// * `addr` - Resolved IP address and port
/// * `status` - HTTP response status code
/// * `tls` - TLS protocol version used
/// * `alpn` - Application-Layer Protocol Negotiation (ALPN) protocol selected
/// * `cert_not_before` - Certificate validity start time
/// * `cert_not_after` - Certificate validity end time
/// * `cert_cipher` - TLS cipher suite used
/// * `cert_domains` - List of domains in the certificate's Subject Alternative Names
/// * `body` - Response body content
/// * `headers` - Response headers
/// * `error` - Any error that occurred during the request
#[derive(Default, Debug, Clone)]
pub struct HttpStat {
    pub is_grpc: bool,
    pub request_headers: HeaderMap<HeaderValue>,
    /// True when a real DNS resolution was attempted for this request.
    /// Stays false for IP-literal hosts, `--resolve` pins and proxied
    /// requests (the proxy resolves the target itself), so `exit_code()`
    /// can tell "DNS failed" apart from "DNS was never needed".
    pub dns_attempted: bool,
    pub dns_lookup: Option<Duration>,
    /// Cold connect cost (TCP + TLS) to the DNS server. Only populated when
    /// using DoH or DoT — for plain UDP DNS this stays None. When present,
    /// the `dns_lookup` total can be split into `dns_connect` and a derived
    /// `dns_query = dns_lookup - dns_connect`, making it possible to tell
    /// whether DoH/DoT latency comes from TLS handshake or query processing.
    pub dns_connect: Option<Duration>,
    pub quic_connect: Option<Duration>,
    pub tcp_connect: Option<Duration>,
    /// Kernel TCP statistics sampled right after `connect(2)`. Provides the
    /// baseline RTT, MSS and initial cwnd before any application data flows.
    /// Linux + macOS only — None on other platforms.
    pub tcp_info_post_connect: Option<TcpInfo>,
    /// Kernel TCP statistics sampled after the response body has been fully
    /// received. The diff against `tcp_info_post_connect` reveals retransmits
    /// during the request — the diagnostic answer to "was Content Transfer
    /// slow because of packet loss or just slow start?".
    pub tcp_info_final: Option<TcpInfo>,
    pub tls_handshake: Option<Duration>,
    pub request_send: Option<Duration>,
    pub server_processing: Option<Duration>,
    pub content_transfer: Option<Duration>,
    /// Bytes actually received over the wire (pre-decompression). For an
    /// uncompressed response this matches `body_size`; for `gzip`/`br`/`zstd`
    /// it's smaller and is the right denominator for *network* throughput.
    pub wire_body_size: Option<usize>,
    /// Time from the start of `content_transfer` until the first 100 KiB of
    /// body bytes had arrived. Combined with the overall content_transfer
    /// duration, it splits download throughput into "first 100 KB" vs
    /// "tail" — the former is TCP slow-start dominated, the latter is the
    /// steady-state rate the server can sustain.
    pub time_to_first_100k: Option<Duration>,
    pub server_timing: Option<Vec<ServerTiming>>,
    /// Parsed `Alt-Svc` advertisements (RFC 7838). Tells the user "this
    /// server announced h3 on port X" without requiring a second probe.
    pub alt_svc: Option<Vec<AltSvc>>,
    /// Parsed `Strict-Transport-Security` policy (RFC 6797).
    pub hsts: Option<Hsts>,
    pub total: Option<Duration>,
    pub addr: Option<String>,
    pub grpc_status: Option<String>,
    pub status: Option<StatusCode>,
    pub tls: Option<String>,
    pub tls_resumed: Option<bool>,
    pub tls_early_data_accepted: Option<bool>,
    pub tls_ocsp_stapled: Option<bool>,
    pub alpn: Option<String>,
    pub subject: Option<String>,
    pub issuer: Option<String>,
    pub cert_not_before: Option<String>,
    pub cert_not_after: Option<String>,
    pub cert_cipher: Option<String>,
    pub cert_domains: Option<Vec<String>>,
    pub certificates: Option<Vec<Certificate>>,
    pub body: Option<Bytes>,
    pub body_size: Option<usize>,
    pub headers: Option<HeaderMap<HeaderValue>>,
    pub error: Option<String>,
    pub silent: bool,
    pub verbose: bool,
    pub pretty: bool,
    pub include_headers: Option<Vec<String>>,
    pub exclude_headers: Option<Vec<String>>,
    pub waterfall: bool,
    pub jq_filter: Option<String>,
    /// When true, render the Kernel TCP block even without `--verbose`.
    /// Driven by the CLI `--tcp-info` flag.
    pub show_tcp_info: bool,
    /// Display language for the terminal renderer. JSON output is always
    /// in English (machine contract). Driven by `--lang` or auto-detected
    /// from LC_ALL/LC_MESSAGES/LANG.
    pub lang: Lang,
    /// Display Response Version
    pub version: Option<String>,
}

#[derive(Debug, Clone)]
pub struct Certificate {
    pub subject: String,
    pub issuer: String,
    pub not_before: String,
    pub not_after: String,
}

/// A single entry parsed from the `Server-Timing` response header (RFC 8673 / W3C).
///
/// Format: `name[;dur=<ms>][;desc="<text>"]`, possibly multiple comma-separated entries
/// per header, possibly multiple `Server-Timing` headers.
#[derive(Debug, Clone)]
pub struct ServerTiming {
    pub name: String,
    pub duration: Option<Duration>,
    pub description: Option<String>,
}

/// Parse all `Server-Timing` header values into a flat list of entries.
/// Returns `None` if the input iterator yields no entries.
pub fn parse_server_timing<'a, I>(values: I) -> Option<Vec<ServerTiming>>
where
    I: IntoIterator<Item = &'a str>,
{
    let mut out = Vec::new();
    for raw in values {
        for part in split_top_level_commas(raw) {
            let mut subparts = part.split(';').map(str::trim);
            let name = match subparts.next() {
                Some(n) if !n.is_empty() => n.to_string(),
                _ => continue,
            };
            let mut entry = ServerTiming {
                name,
                duration: None,
                description: None,
            };
            for kv in subparts {
                let Some(eq) = kv.find('=') else { continue };
                let key = kv[..eq].trim().to_ascii_lowercase();
                let mut val = kv[eq + 1..].trim();
                if val.starts_with('"') && val.ends_with('"') && val.len() >= 2 {
                    val = &val[1..val.len() - 1];
                }
                match key.as_str() {
                    "dur" => {
                        if let Ok(ms) = val.parse::<f64>() {
                            if ms.is_finite() && ms >= 0.0 {
                                entry.duration = Some(Duration::from_secs_f64(ms / 1000.0));
                            }
                        }
                    }
                    "desc" => entry.description = Some(val.to_string()),
                    _ => {}
                }
            }
            out.push(entry);
        }
    }
    if out.is_empty() {
        None
    } else {
        Some(out)
    }
}

/// A single entry from the `Alt-Svc` response header (RFC 7838).
///
/// Format: `protocol-id=authority; ma=<seconds>; persist=<0|1>`. Multiple
/// entries are comma-separated; the special value `clear` (handled by the
/// parser) clears the current advertisement set.
#[derive(Debug, Clone)]
pub struct AltSvc {
    pub protocol: String,
    pub authority: String,
    pub max_age: Option<u64>,
}

/// Parsed `Strict-Transport-Security` directive (RFC 6797).
#[derive(Debug, Clone)]
pub struct Hsts {
    pub max_age: u64,
    pub include_subdomains: bool,
    pub preload: bool,
}

/// Parse one or more `Alt-Svc` header values into a flat list.
///
/// Returns `None` if no entries were found. `clear` resets accumulation.
pub fn parse_alt_svc<'a, I>(values: I) -> Option<Vec<AltSvc>>
where
    I: IntoIterator<Item = &'a str>,
{
    let mut out: Vec<AltSvc> = Vec::new();
    for raw in values {
        for part in split_top_level_commas(raw) {
            if part.eq_ignore_ascii_case("clear") {
                out.clear();
                continue;
            }
            let mut subparts = part.split(';').map(str::trim);
            let head = match subparts.next() {
                Some(h) if !h.is_empty() => h,
                _ => continue,
            };
            let Some(eq) = head.find('=') else { continue };
            let protocol = head[..eq].trim().to_string();
            let mut authority = head[eq + 1..].trim().to_string();
            if authority.starts_with('"') && authority.ends_with('"') && authority.len() >= 2 {
                authority = authority[1..authority.len() - 1].to_string();
            }
            let mut entry = AltSvc {
                protocol,
                authority,
                max_age: None,
            };
            for kv in subparts {
                let Some(eq) = kv.find('=') else { continue };
                let key = kv[..eq].trim().to_ascii_lowercase();
                let val = kv[eq + 1..].trim().trim_matches('"');
                if key == "ma" {
                    if let Ok(n) = val.parse::<u64>() {
                        entry.max_age = Some(n);
                    }
                }
            }
            out.push(entry);
        }
    }
    if out.is_empty() {
        None
    } else {
        Some(out)
    }
}

/// Parse a single `Strict-Transport-Security` header value. Returns `None`
/// if `max-age` is missing or unparsable (a directive without `max-age` is
/// not a valid HSTS policy per RFC 6797 §6.1).
pub fn parse_hsts(value: &str) -> Option<Hsts> {
    let mut max_age: Option<u64> = None;
    let mut include_subdomains = false;
    let mut preload = false;
    for part in value.split(';').map(str::trim) {
        if part.is_empty() {
            continue;
        }
        let (key, val) = match part.find('=') {
            Some(eq) => (
                part[..eq].trim().to_ascii_lowercase(),
                Some(part[eq + 1..].trim().trim_matches('"')),
            ),
            None => (part.to_ascii_lowercase(), None),
        };
        match key.as_str() {
            "max-age" => {
                if let Some(v) = val {
                    if let Ok(n) = v.parse::<u64>() {
                        max_age = Some(n);
                    }
                }
            }
            "includesubdomains" => include_subdomains = true,
            "preload" => preload = true,
            _ => {}
        }
    }
    max_age.map(|m| Hsts {
        max_age: m,
        include_subdomains,
        preload,
    })
}

/// Split on top-level commas, ignoring commas inside double-quoted strings.
fn split_top_level_commas(s: &str) -> Vec<&str> {
    let mut parts = Vec::new();
    let mut start = 0usize;
    let mut in_quotes = false;
    let bytes = s.as_bytes();
    let mut i = 0;
    while i < bytes.len() {
        match bytes[i] {
            b'"' => in_quotes = !in_quotes,
            b',' if !in_quotes => {
                parts.push(s[start..i].trim());
                start = i + 1;
            }
            _ => {}
        }
        i += 1;
    }
    parts.push(s[start..].trim());
    parts
}

/// Apply a simple jq-style field selector to a JSON string.
///
/// Supported syntax:
///   .                    identity (pretty-print)
///   .field               object key access
///   .field.sub           nested key access
///   .[0]                 array index
///   .[]                  iterate all array/object values
///   combinations: .items[].name, .a.b[2].c, etc.
///
/// Returns `Err(reason)` when the body is not JSON or the filter uses syntax
/// outside this subset (pipes, functions, `select()`, `?`, …) so the caller
/// can show a clear message instead of silently printing the unfiltered body.
fn apply_jq_filter(body: &str, filter: &str) -> Result<String, String> {
    let root: serde_json::Value = serde_json::from_str(body)
        .map_err(|_| "response body is not JSON, cannot apply --jq filter".to_string())?;
    let trimmed = filter.trim();
    // Allow omitting the leading '.' for convenience (e.g. "os" → ".os")
    let owned;
    let normalized = if !trimmed.starts_with('.') {
        owned = format!(".{trimmed}");
        owned.as_str()
    } else {
        trimmed
    };

    // Tokenise the filter string into a list of access steps.
    #[derive(Debug)]
    enum Step {
        Key(String),
        Index(usize),
        Iter,
    }

    // Returns `None` for anything outside the supported subset; the caller
    // turns that into an "unsupported filter" error.
    fn tokenize(s: &str) -> Option<Vec<Step>> {
        let s = s.strip_prefix('.')?;
        if s.is_empty() {
            return Some(vec![]);
        }
        let mut steps = Vec::new();
        // Split on '.' but keep bracket expressions attached to the preceding key.
        // We walk char-by-char to handle `key[0].next` etc.
        let mut remaining = s;
        while !remaining.is_empty() {
            if remaining.starts_with('[') {
                // bracket at the start: .[0] or .[]
                let end = remaining.find(']')?;
                let inner = &remaining[1..end];
                if inner.is_empty() {
                    steps.push(Step::Iter);
                } else {
                    let idx: usize = inner.parse().ok()?;
                    steps.push(Step::Index(idx));
                }
                remaining = &remaining[end + 1..];
                if remaining.starts_with('.') {
                    remaining = &remaining[1..];
                }
            } else {
                // read up to next '.' or '['
                let end = remaining.find(['.', '[']).unwrap_or(remaining.len());
                let key = &remaining[..end];
                // Only plain object keys are supported. Reject anything that
                // signals unsupported jq syntax (pipes, functions, `?`,
                // whitespace, …) instead of silently matching nothing.
                if key.is_empty()
                    || !key
                        .chars()
                        .all(|c| c.is_ascii_alphanumeric() || c == '_' || c == '-')
                {
                    return None;
                }
                steps.push(Step::Key(key.to_string()));
                remaining = &remaining[end..];
                if remaining.starts_with('.') {
                    remaining = &remaining[1..];
                }
            }
        }
        Some(steps)
    }

    fn apply_steps(values: Vec<serde_json::Value>, steps: &[Step]) -> Vec<serde_json::Value> {
        if steps.is_empty() {
            return values;
        }
        let mut current = values;
        for step in steps {
            current = match step {
                Step::Key(k) => current
                    .into_iter()
                    .filter_map(|v| v.get(k).cloned())
                    .collect(),
                Step::Index(i) => current
                    .into_iter()
                    .filter_map(|v| v.get(i).cloned())
                    .collect(),
                Step::Iter => current
                    .into_iter()
                    .flat_map(|v| match v {
                        serde_json::Value::Array(arr) => arr,
                        serde_json::Value::Object(map) => map.into_values().collect(),
                        other => vec![other],
                    })
                    .collect(),
            };
        }
        current
    }

    let steps = tokenize(normalized).ok_or_else(|| {
        format!("unsupported --jq filter '{filter}' (supported: .a.b, .[0], .[])")
    })?;
    let results = apply_steps(vec![root], &steps);

    if results.len() == 1 {
        serde_json::to_string_pretty(&results[0])
            .map_err(|e| format!("failed to format --jq result: {e}"))
    } else {
        Ok(results
            .iter()
            .filter_map(|v| serde_json::to_string_pretty(v).ok())
            .collect::<Vec<_>>()
            .join("\n"))
    }
}

impl HttpStat {
    /// Returns a semantic exit code based on the error type:
    /// - 0: Success
    /// - 1: General/unknown error
    /// - 2: DNS resolution failure
    /// - 3: TCP connection failure
    /// - 4: TLS/SSL error
    /// - 5: Timeout
    /// - 6: HTTP 4xx client error
    /// - 7: HTTP 5xx server error
    pub fn exit_code(&self) -> i32 {
        if self.is_success() {
            return 0;
        }
        // HTTP status errors (no connection error, but bad status)
        if self.error.is_none() {
            if let Some(status) = &self.status {
                let code = status.as_u16();
                if code >= 500 {
                    return 7;
                }
                if code >= 400 {
                    return 6;
                }
            }
            return 1;
        }
        let err = self.error.as_deref().unwrap_or_default().to_lowercase();
        // Timeout (check before phase-based detection since timeout can happen in any phase)
        if err.contains("timeout") || err.contains("elapsed") {
            return 5;
        }
        // DNS failure: resolution was attempted but never completed. The
        // `dns_attempted` guard keeps IP-literal / --resolve / proxied
        // requests (which legitimately skip DNS) from being misreported
        // as DNS failures when their TCP connect fails.
        if self.dns_attempted && self.dns_lookup.is_none() {
            return 2;
        }
        // TCP failure: tcp/quic connection phase never completed
        if self.tcp_connect.is_none() && self.quic_connect.is_none() {
            return 3;
        }
        // TLS failure
        if err.contains("rustls")
            || err.contains("tls")
            || err.contains("certificate")
            || err.contains("invalid dns name")
        {
            return 4;
        }
        1
    }

    /// Derived "DNS Query" phase: the portion of `dns_lookup` not spent on
    /// `dns_connect`. Returns `None` when no DoH/DoT probe was performed.
    /// Clamped to ≥ 0 because the parallel probe can race slightly ahead of
    /// the real resolver in rare cases.
    pub fn dns_query(&self) -> Option<Duration> {
        match (self.dns_lookup, self.dns_connect) {
            (Some(total), Some(connect)) => Some(total.saturating_sub(connect)),
            _ => None,
        }
    }

    /// Overall download throughput in bytes/sec, based on wire bytes received
    /// over the content_transfer window. Returns `None` when either input is
    /// unavailable or content_transfer is zero (instant local response).
    pub fn throughput_bps(&self) -> Option<f64> {
        let bytes = self.wire_body_size? as f64;
        let secs = self.content_transfer?.as_secs_f64();
        if secs <= 0.0 {
            return None;
        }
        Some(bytes / secs)
    }

    /// Throughput across the first 100 KiB of body bytes — dominated by TCP
    /// slow-start on a cold connection. Compare with [`tail_throughput_bps`]
    /// to tell "slow start" from "server streams slowly".
    pub fn first_chunk_throughput_bps(&self) -> Option<f64> {
        let dur = self.time_to_first_100k?.as_secs_f64();
        if dur <= 0.0 {
            return None;
        }
        Some(FIRST_CHUNK_BYTES as f64 / dur)
    }

    /// Throughput of the remaining body after the first 100 KiB — the
    /// steady-state rate the server actually sustains.
    pub fn tail_throughput_bps(&self) -> Option<f64> {
        let total = self.content_transfer?;
        let head = self.time_to_first_100k?;
        let bytes = self.wire_body_size?;
        if bytes <= FIRST_CHUNK_BYTES || total <= head {
            return None;
        }
        let tail_bytes = (bytes - FIRST_CHUNK_BYTES) as f64;
        let tail_secs = (total - head).as_secs_f64();
        if tail_secs <= 0.0 {
            return None;
        }
        Some(tail_bytes / tail_secs)
    }

    pub fn is_success(&self) -> bool {
        if self.error.is_some() {
            return false;
        }
        if self.is_grpc {
            if let Some(grpc_status) = &self.grpc_status {
                return grpc_status == "0";
            }
            return false;
        }
        let Some(status) = &self.status else {
            return false;
        };
        if status.as_u16() >= 400 {
            return false;
        }
        true
    }

    /// Render a waterfall bar chart to `f`.
    /// Each phase is one row; bars are horizontally positioned by cumulative offset.
    fn fmt_waterfall(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        let total = match self.total {
            Some(t) if t.as_nanos() > 0 => t,
            _ => return Ok(()),
        };

        const BAR_WIDTH: usize = 50;
        const LABEL_W: usize = 15;

        let s = self.lang.strings();
        // When a DoH/DoT probe ran, split the DNS column into Connect + Query.
        let (dns_a, dns_b) = if self.dns_connect.is_some() {
            (
                (s.dns_connect, self.dns_connect),
                (s.dns_query, self.dns_query()),
            )
        } else {
            ((s.dns_lookup, self.dns_lookup), ("", None))
        };
        let phases_vec: Vec<(&str, Option<Duration>)> = vec![
            dns_a,
            dns_b,
            (s.tcp_connect, self.tcp_connect),
            (s.tls_handshake, self.tls_handshake),
            (s.quic_connect, self.quic_connect),
            (s.request_send, self.request_send),
            (s.server_processing_short, self.server_processing),
            (s.content_transfer_short, self.content_transfer),
        ];
        let phases: &[(&str, Option<Duration>)] = &phases_vec;

        let total_ns = total.as_nanos() as f64;
        let mut elapsed = Duration::ZERO;
        let mut col_cursor: usize = 0;

        for (name, dur_opt) in phases {
            let Some(dur) = dur_opt else { continue };

            let start_col = col_cursor;
            elapsed += *dur;
            let ideal_end = ((elapsed.as_nanos() as f64 / total_ns * BAR_WIDTH as f64).round()
                as usize)
                .min(BAR_WIDTH);
            let end_col = ideal_end.min(BAR_WIDTH);
            if end_col > start_col {
                col_cursor = end_col;
            }

            let bar: String = (0..BAR_WIDTH)
                .map(|i| {
                    if i >= start_col && i < end_col {
                        '█'
                    } else {
                        '░'
                    }
                })
                .collect();

            writeln!(
                f,
                " {:<LABEL_W$} [{}]  {}",
                name,
                LightCyan.paint(bar),
                LightCyan.paint(format_duration(*dur))
            )?;
        }

        writeln!(f)?;
        writeln!(
            f,
            " {:LABEL_W$}  {:BAR_WIDTH$}  {}: {}",
            "",
            "",
            s.total,
            LightCyan.paint(format_duration(total))
        )?;
        writeln!(f)
    }

    pub fn to_json(&self) -> Value {
        let dur_us = |d: Option<Duration>| -> Value {
            d.map_or(Value::Null, |d| json!(d.as_micros() as u64))
        };

        let mut obj = Map::new();

        // Timing (microseconds)
        let mut timing = Map::new();
        timing.insert("dns_lookup_us".into(), dur_us(self.dns_lookup));
        timing.insert("dns_connect_us".into(), dur_us(self.dns_connect));
        timing.insert("dns_query_us".into(), dur_us(self.dns_query()));
        timing.insert("tcp_connect_us".into(), dur_us(self.tcp_connect));
        timing.insert("tls_handshake_us".into(), dur_us(self.tls_handshake));
        timing.insert("quic_connect_us".into(), dur_us(self.quic_connect));
        timing.insert("request_send_us".into(), dur_us(self.request_send));
        timing.insert(
            "server_processing_us".into(),
            dur_us(self.server_processing),
        );
        timing.insert("content_transfer_us".into(), dur_us(self.content_transfer));
        timing.insert(
            "time_to_first_100k_us".into(),
            dur_us(self.time_to_first_100k),
        );
        timing.insert("total_us".into(), dur_us(self.total));
        obj.insert("timing".into(), Value::Object(timing));

        // Throughput block — populated whenever a body was received with a
        // measurable content_transfer. Numerator is wire bytes (pre-decompress).
        if self.wire_body_size.is_some() && self.content_transfer.is_some() {
            let mut t = Map::new();
            t.insert(
                "wire_body_size".into(),
                self.wire_body_size.map_or(Value::Null, |v| json!(v)),
            );
            let opt_f = |v: Option<f64>| -> Value { v.map_or(Value::Null, |x| json!(x)) };
            t.insert("bps_total".into(), opt_f(self.throughput_bps()));
            t.insert(
                "bps_first_100k".into(),
                opt_f(self.first_chunk_throughput_bps()),
            );
            t.insert("bps_tail".into(), opt_f(self.tail_throughput_bps()));
            obj.insert("throughput".into(), Value::Object(t));
        }

        // Kernel TCP statistics (Linux + macOS): both samples plus a derived
        // delta highlighting what changed during the request.
        let tcp_info_json = |info: Option<&TcpInfo>| -> Value {
            let Some(info) = info else { return Value::Null };
            let mut m = Map::new();
            m.insert("rtt_us".into(), dur_us(info.rtt));
            m.insert("rttvar_us".into(), dur_us(info.rttvar));
            m.insert(
                "retransmits".into(),
                info.retransmits.map_or(Value::Null, |v| json!(v)),
            );
            m.insert("cwnd".into(), info.cwnd.map_or(Value::Null, |v| json!(v)));
            m.insert(
                "snd_mss".into(),
                info.snd_mss.map_or(Value::Null, |v| json!(v)),
            );
            Value::Object(m)
        };
        if self.tcp_info_post_connect.is_some() || self.tcp_info_final.is_some() {
            let mut block = Map::new();
            block.insert(
                "post_connect".into(),
                tcp_info_json(self.tcp_info_post_connect.as_ref()),
            );
            block.insert("final".into(), tcp_info_json(self.tcp_info_final.as_ref()));
            if let Some(delta) = TcpInfoDelta::compute(
                self.tcp_info_post_connect.as_ref(),
                self.tcp_info_final.as_ref(),
            ) {
                let mut d = Map::new();
                d.insert(
                    "retransmits_during".into(),
                    delta.retransmits_during.map_or(Value::Null, |v| json!(v)),
                );
                d.insert("rtt_final_us".into(), dur_us(delta.rtt_final));
                d.insert(
                    "cwnd_final".into(),
                    delta.cwnd_final.map_or(Value::Null, |v| json!(v)),
                );
                block.insert("delta".into(), Value::Object(d));
            }
            obj.insert("tcp_info".into(), Value::Object(block));
        }

        // Server-Timing entries (RFC 8673)
        if let Some(entries) = &self.server_timing {
            let arr: Vec<Value> = entries
                .iter()
                .map(|e| {
                    let mut m = Map::new();
                    m.insert("name".into(), json!(e.name));
                    m.insert(
                        "duration_us".into(),
                        e.duration
                            .map_or(Value::Null, |d| json!(d.as_micros() as u64)),
                    );
                    m.insert(
                        "description".into(),
                        e.description.as_deref().map_or(Value::Null, |s| json!(s)),
                    );
                    Value::Object(m)
                })
                .collect();
            obj.insert("server_timing".into(), Value::Array(arr));
        }

        // Alt-Svc advertisements (RFC 7838)
        if let Some(entries) = &self.alt_svc {
            let arr: Vec<Value> = entries
                .iter()
                .map(|e| {
                    let mut m = Map::new();
                    m.insert("protocol".into(), json!(e.protocol));
                    m.insert("authority".into(), json!(e.authority));
                    m.insert(
                        "max_age_seconds".into(),
                        e.max_age.map_or(Value::Null, |v| json!(v)),
                    );
                    Value::Object(m)
                })
                .collect();
            obj.insert("alt_svc".into(), Value::Array(arr));
        }

        // HSTS policy (RFC 6797)
        if let Some(h) = &self.hsts {
            let mut m = Map::new();
            m.insert("max_age_seconds".into(), json!(h.max_age));
            m.insert("include_subdomains".into(), json!(h.include_subdomains));
            m.insert("preload".into(), json!(h.preload));
            obj.insert("hsts".into(), Value::Object(m));
        }

        // Connection
        obj.insert(
            "addr".into(),
            self.addr.as_deref().map_or(Value::Null, |s| json!(s)),
        );
        obj.insert(
            "status".into(),
            self.status.map_or(Value::Null, |s| json!(s.as_u16())),
        );
        obj.insert(
            "alpn".into(),
            self.alpn.as_deref().map_or(Value::Null, |s| json!(s)),
        );

        // TLS
        if self.tls.is_some() {
            let mut tls = Map::new();
            tls.insert(
                "version".into(),
                self.tls.as_deref().map_or(Value::Null, |s| json!(s)),
            );
            tls.insert(
                "cipher".into(),
                self.cert_cipher
                    .as_deref()
                    .map_or(Value::Null, |s| json!(s)),
            );
            tls.insert(
                "resumed".into(),
                self.tls_resumed.map_or(Value::Null, |b| json!(b)),
            );
            tls.insert(
                "early_data_accepted".into(),
                self.tls_early_data_accepted
                    .map_or(Value::Null, |b| json!(b)),
            );
            tls.insert(
                "ocsp_stapled".into(),
                self.tls_ocsp_stapled.map_or(Value::Null, |b| json!(b)),
            );
            tls.insert(
                "subject".into(),
                self.subject.as_deref().map_or(Value::Null, |s| json!(s)),
            );
            tls.insert(
                "issuer".into(),
                self.issuer.as_deref().map_or(Value::Null, |s| json!(s)),
            );
            tls.insert(
                "not_before".into(),
                self.cert_not_before
                    .as_deref()
                    .map_or(Value::Null, |s| json!(s)),
            );
            tls.insert(
                "not_after".into(),
                self.cert_not_after
                    .as_deref()
                    .map_or(Value::Null, |s| json!(s)),
            );
            tls.insert(
                "domains".into(),
                self.cert_domains.as_ref().map_or(Value::Null, |d| json!(d)),
            );
            obj.insert("tls".into(), Value::Object(tls));
        }

        // Headers. A name can repeat (e.g. multiple Set-Cookie); emit a
        // string for the common single-value case and an array when the
        // header appeared more than once, so no value is silently dropped.
        if let Some(headers) = &self.headers {
            let mut hdr_map = Map::new();
            for key in headers.keys() {
                let mut values: Vec<Value> = headers
                    .get_all(key)
                    .iter()
                    .map(|value| json!(value.to_str().unwrap_or_default()))
                    .collect();
                let v = if values.len() == 1 {
                    values.remove(0)
                } else {
                    Value::Array(values)
                };
                hdr_map.insert(key.to_string(), v);
            }
            obj.insert("headers".into(), Value::Object(hdr_map));
        }

        // Body
        obj.insert(
            "body_size".into(),
            self.body_size.map_or(Value::Null, |s| json!(s)),
        );

        // Error
        obj.insert(
            "error".into(),
            self.error.as_deref().map_or(Value::Null, |e| json!(e)),
        );
        obj.insert("exit_code".into(), json!(self.exit_code()));

        Value::Object(obj)
    }
}

impl fmt::Display for HttpStat {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        let s = self.lang.strings();
        if let Some(addr) = &self.addr {
            let label = if self.tcp_connect.is_some() || self.quic_connect.is_some() {
                LightGreen.paint(s.connected_to)
            } else {
                LightYellow.paint(s.resolved_to)
            };
            let mut text = format!("{} {}", label, LightCyan.paint(addr));
            if self.silent {
                if let Some(status) = &self.status {
                    let alpn = self.alpn.as_deref().unwrap_or(ALPN_HTTP1);
                    let status_code = status.as_u16();
                    let status = if status_code < 400 {
                        LightGreen.paint(status.to_string())
                    } else {
                        LightRed.paint(status.to_string())
                    };
                    text = format!(
                        "{text} --> {} {}",
                        LightCyan.paint(alpn.to_uppercase()),
                        status
                    );
                } else {
                    text = format!("{text} --> {}", LightRed.paint(s.fail));
                }
                text = format!("{text} {}", format_duration(self.total.unwrap_or_default()));
                // Surface TLS resumption / 0-RTT inline — most useful in
                // benchmark (-n) output where iterations 2+ may resume.
                // "0-RTT" stays as a technical token across locales.
                if let Some(true) = self.tls_resumed {
                    let tag = if matches!(self.tls_early_data_accepted, Some(true)) {
                        "0-RTT"
                    } else {
                        s.handshake_resumed
                    };
                    text = format!("{text} [{}]", LightYellow.paint(tag));
                }
            }
            writeln!(f, "{text}")?;
        }
        if let Some(error) = &self.error {
            writeln!(f, "{}: {}", s.error_label, LightRed.paint(error))?;
        }
        if self.silent {
            return Ok(());
        }
        if self.verbose {
            for (key, value) in self.request_headers.iter() {
                writeln!(
                    f,
                    "{}: {}",
                    key.to_string().to_train_case(),
                    LightCyan.paint(value.to_str().unwrap_or_default())
                )?;
            }
            writeln!(f)?;
        }

        if let Some(status) = &self.status {
            let alpn = self.alpn.as_deref().unwrap_or(ALPN_HTTP1);
            let status_code = status.as_u16();
            let status = if status_code < 400 {
                LightGreen.paint(status.to_string())
            } else {
                LightRed.paint(status.to_string())
            };
            writeln!(f, "{} {}", LightCyan.paint(alpn.to_uppercase()), status)?;
        }
        if self.is_grpc {
            if self.is_success() {
                writeln!(f, "{}", LightGreen.paint(s.grpc_ok))?;
            }
            writeln!(f)?;
        }

        if let Some(tls) = &self.tls {
            writeln!(f)?;
            writeln!(f, "{}: {}", s.tls_label, LightCyan.paint(tls))?;
            // Unknown for HTTP/3: quinn doesn't expose the negotiated suite.
            if let Some(cipher) = self.cert_cipher.as_deref() {
                writeln!(f, "{}: {}", s.cipher, LightCyan.paint(cipher))?;
            }
            if let Some(resumed) = self.tls_resumed {
                let label = if resumed {
                    s.handshake_resumed
                } else {
                    s.handshake_full
                };
                writeln!(f, "{}: {}", s.handshake, LightCyan.paint(label))?;
            }
            if let Some(accepted) = self.tls_early_data_accepted {
                let label = if accepted {
                    s.early_data_accepted
                } else {
                    s.early_data_not_accepted
                };
                writeln!(f, "{}: {}", s.early_data, LightCyan.paint(label))?;
            }
            if let Some(stapled) = self.tls_ocsp_stapled {
                let label = if stapled {
                    s.ocsp_stapled
                } else {
                    s.ocsp_not_stapled
                };
                writeln!(f, "{}: {}", s.ocsp, LightCyan.paint(label))?;
            }
            writeln!(
                f,
                "{}: {}",
                s.not_before,
                LightCyan.paint(self.cert_not_before.as_deref().unwrap_or_default())
            )?;
            writeln!(
                f,
                "{}: {}",
                s.not_after,
                LightCyan.paint(self.cert_not_after.as_deref().unwrap_or_default())
            )?;
            if self.verbose {
                writeln!(
                    f,
                    "{}: {}",
                    s.subject,
                    LightCyan.paint(self.subject.as_deref().unwrap_or_default())
                )?;
                writeln!(
                    f,
                    "{}: {}",
                    s.issuer,
                    LightCyan.paint(self.issuer.as_deref().unwrap_or_default())
                )?;
                writeln!(
                    f,
                    "{}: {}",
                    s.cert_domains,
                    LightCyan.paint(self.cert_domains.as_deref().unwrap_or_default().join(", "))
                )?;
            }
            writeln!(f)?;

            if self.verbose {
                if let Some(certificates) = &self.certificates {
                    writeln!(f, "{}", s.cert_chain)?;
                    for (index, cert) in certificates.iter().enumerate() {
                        writeln!(
                            f,
                            " {index} {}: {}",
                            s.subject,
                            LightCyan.paint(cert.subject.as_str())
                        )?;
                        writeln!(
                            f,
                            "   {}: {}",
                            s.issuer,
                            LightCyan.paint(cert.issuer.as_str())
                        )?;
                        writeln!(
                            f,
                            "   {}: {}",
                            s.not_before,
                            LightCyan.paint(cert.not_before.as_str())
                        )?;
                        writeln!(
                            f,
                            "   {}: {}",
                            s.not_after,
                            LightCyan.paint(cert.not_after.as_str())
                        )?;
                        writeln!(f)?;
                    }
                }
            }
        }

        // Kernel TCP stats — shown under `-v` or whenever `--tcp-info` is set
        // via `self.show_tcp_info`. The "during" retransmit count is the
        // diagnostic gold: it isolates packet loss to *this* request's window
        // rather than the connection's lifetime.
        if (self.verbose || self.show_tcp_info)
            && (self.tcp_info_post_connect.is_some() || self.tcp_info_final.is_some())
        {
            writeln!(f, "{}", LightGreen.paint(s.kernel_tcp_heading))?;
            // Technical field names (rtt/retrans/cwnd/mss) stay English —
            // they're the standard `getsockopt(TCP_INFO)` field names.
            let render = |label: &str, info: &TcpInfo| -> String {
                let rtt = info.rtt.map(format_duration).unwrap_or_else(|| "-".into());
                let rttvar = info
                    .rttvar
                    .map(format_duration)
                    .unwrap_or_else(|| "-".into());
                let retrans = info
                    .retransmits
                    .map(|v| v.to_string())
                    .unwrap_or_else(|| "-".into());
                let cwnd = info
                    .cwnd
                    .map(|v| v.to_string())
                    .unwrap_or_else(|| "-".into());
                let mss = info
                    .snd_mss
                    .map(|v| v.to_string())
                    .unwrap_or_else(|| "-".into());
                format!(
                    "  {:<14} rtt {} \u{00B1} {}  retrans {}  cwnd {}  mss {}",
                    label, rtt, rttvar, retrans, cwnd, mss,
                )
            };
            if let Some(info) = &self.tcp_info_post_connect {
                writeln!(
                    f,
                    "{}",
                    LightCyan.paint(render(s.tcp_post_connect_row, info))
                )?;
            }
            if let Some(info) = &self.tcp_info_final {
                writeln!(f, "{}", LightCyan.paint(render(s.tcp_final_row, info)))?;
            }
            if let Some(delta) = TcpInfoDelta::compute(
                self.tcp_info_post_connect.as_ref(),
                self.tcp_info_final.as_ref(),
            ) {
                if let Some(n) = delta.retransmits_during {
                    let label = format!("  {} {n} {}", s.tcp_during, s.tcp_retransmit_word);
                    let painted = if n == 0 {
                        LightCyan.paint(label)
                    } else {
                        LightYellow.paint(label)
                    };
                    writeln!(f, "{painted}")?;
                }
            }
            writeln!(f)?;
        }

        let mut is_text = false;
        let mut is_json = false;
        if let Some(headers) = &self.headers {
            for (key, value) in headers.iter() {
                let value = value.to_str().unwrap_or_default();
                if key == http::header::CONTENT_TYPE {
                    if value.contains("text/") || value.contains("application/json") {
                        is_text = true;
                    }
                    if value.contains("application/json") {
                        is_json = true;
                    }
                }
                let key_lower = key.as_str();
                let show = if let Some(includes) = &self.include_headers {
                    includes.iter().any(|h| h == key_lower)
                } else if let Some(excludes) = &self.exclude_headers {
                    !excludes.iter().any(|h| h == key_lower)
                } else {
                    true
                };
                if show {
                    writeln!(
                        f,
                        "{}: {}",
                        key.to_string().to_train_case(),
                        LightCyan.paint(value)
                    )?;
                }
            }
            writeln!(f)?;
        }

        // Server-Timing breakdown (what the server says happened inside Server Processing).
        // Each row shows: name, a sparkline-style bar sized by share of the reported total,
        // duration, and percent. The header line reconciles the reported sum against the
        // measured Server Processing time so the unaccounted gap (network/queueing) is visible.
        if let Some(entries) = &self.server_timing {
            if !entries.is_empty() {
                const BAR_W: usize = 34;
                let name_w = entries
                    .iter()
                    .map(|e| e.name.chars().count())
                    .max()
                    .unwrap_or(0)
                    .max(4);

                let sum: Duration = entries.iter().filter_map(|e| e.duration).sum();
                let total_ns = (sum.as_nanos() as f64).max(1.0);
                let largest_idx: Option<usize> = entries
                    .iter()
                    .enumerate()
                    .filter_map(|(i, e)| e.duration.filter(|d| !d.is_zero()).map(|d| (i, d)))
                    .max_by_key(|(_, d)| *d)
                    .map(|(i, _)| i);

                let summary = match self.server_processing {
                    Some(sp) if sp > sum => format!(
                        "(\u{03A3} {} {} {} {} \u{00B7} {} {})",
                        format_duration(sum),
                        s.st_sum_of,
                        format_duration(sp),
                        s.server_processing,
                        format_duration(sp - sum),
                        s.st_unaccounted,
                    ),
                    Some(sp) => format!(
                        "(\u{03A3} {} {} {} {})",
                        format_duration(sum),
                        s.st_sum_of,
                        format_duration(sp),
                        s.server_processing,
                    ),
                    None => format!("(\u{03A3} {})", format_duration(sum)),
                };
                writeln!(
                    f,
                    "{} {}",
                    LightGreen.paint(s.server_timing_heading),
                    LightCyan.paint(&summary),
                )?;

                // Lay each bar out at its cumulative offset, so the sequence reads
                // left-to-right like a waterfall inside Server Processing.
                let sum_ns_u = sum.as_nanos();
                let mut cum_ns: u128 = 0;
                for (i, entry) in entries.iter().enumerate() {
                    let name_pad = " ".repeat(name_w.saturating_sub(entry.name.chars().count()));
                    let dur_ns = entry.duration.map(|d| d.as_nanos()).unwrap_or(0);

                    let start_col = ((cum_ns as f64 / total_ns) * BAR_W as f64).round() as usize;
                    let start_col = start_col.min(BAR_W);
                    let mut end_col =
                        (((cum_ns + dur_ns) as f64 / total_ns) * BAR_W as f64).round() as usize;
                    end_col = end_col.min(BAR_W);
                    // Non-zero entries should always paint at least one cell so they
                    // don't disappear into rounding.
                    if dur_ns > 0 && end_col <= start_col {
                        end_col = (start_col + 1).min(BAR_W);
                    }

                    let bar: String = (0..BAR_W)
                        .map(|col| {
                            if dur_ns == 0 {
                                let marker = start_col.min(BAR_W - 1);
                                if col == marker {
                                    '\u{00B7}'
                                } else {
                                    '\u{2591}'
                                }
                            } else if col >= start_col && col < end_col {
                                '\u{2588}'
                            } else {
                                '\u{2591}'
                            }
                        })
                        .collect();

                    let (dur_str, pct_str) = if dur_ns > 0 {
                        let pct = if sum_ns_u > 0 {
                            (dur_ns as f64 / sum_ns_u as f64) * 100.0
                        } else {
                            0.0
                        };
                        (
                            format_duration(entry.duration.unwrap_or_default()),
                            format!("{pct:>5.1}%"),
                        )
                    } else {
                        ("\u{2014}".to_string(), "\u{2013}".to_string())
                    };

                    let is_largest = Some(i) == largest_idx;
                    let bar_painted = if is_largest {
                        LightYellow.paint(&bar).to_string()
                    } else {
                        LightCyan.paint(&bar).to_string()
                    };
                    let dur_painted = if is_largest {
                        LightYellow.paint(format!("{dur_str:>8}")).to_string()
                    } else {
                        LightCyan.paint(format!("{dur_str:>8}")).to_string()
                    };
                    let pct_painted = LightCyan.paint(format!("{pct_str:>6}")).to_string();
                    let desc = entry
                        .description
                        .as_deref()
                        .map(|d| format!("  ({d})"))
                        .unwrap_or_default();

                    writeln!(
                        f,
                        "  {}{}  {}  {}  {}{}",
                        LightCyan.paint(&entry.name),
                        name_pad,
                        bar_painted,
                        dur_painted,
                        pct_painted,
                        desc,
                    )?;

                    cum_ns += dur_ns;
                }
                writeln!(f)?;
            }
        }

        // Protocol advertisements (Alt-Svc / HSTS).
        // These are facts the server told us about itself — no extra
        // network calls, just headers we already parsed.
        if self.alt_svc.is_some() || self.hsts.is_some() {
            writeln!(f, "{}", LightGreen.paint(s.protocol_adv_heading))?;
            if let Some(entries) = &self.alt_svc {
                for entry in entries {
                    let ma = match entry.max_age {
                        Some(ma) => format!("  ma={ma}s"),
                        None => String::new(),
                    };
                    writeln!(
                        f,
                        "  {}  {}={}{}",
                        s.alt_svc_label,
                        LightCyan.paint(&entry.protocol),
                        LightCyan.paint(&entry.authority),
                        LightCyan.paint(ma),
                    )?;
                }
            }
            if let Some(h) = &self.hsts {
                let mut flags = String::new();
                if h.include_subdomains {
                    flags.push_str("; includeSubDomains");
                }
                if h.preload {
                    flags.push_str("; preload");
                }
                writeln!(
                    f,
                    "  {}  {}{}",
                    s.hsts_label,
                    LightCyan.paint(format!("max-age={}s", h.max_age)),
                    LightCyan.paint(flags),
                )?;
            }
            writeln!(f)?;
        }

        if self.waterfall {
            self.fmt_waterfall(f)?;
        } else {
            let width = 20;

            let mut timelines = vec![];
            // When a DoH/DoT probe ran, render DNS as two columns so the user
            // can see whether the cost was the TLS handshake or the query.
            if let Some(connect) = self.dns_connect {
                timelines.push(Timeline {
                    name: s.dns_connect.to_string(),
                    duration: connect,
                });
                if let Some(query) = self.dns_query() {
                    timelines.push(Timeline {
                        name: s.dns_query.to_string(),
                        duration: query,
                    });
                }
            } else if let Some(value) = self.dns_lookup {
                timelines.push(Timeline {
                    name: s.dns_lookup.to_string(),
                    duration: value,
                });
            }
            if let Some(value) = self.tcp_connect {
                timelines.push(Timeline {
                    name: s.tcp_connect.to_string(),
                    duration: value,
                });
            }
            if let Some(value) = self.tls_handshake {
                timelines.push(Timeline {
                    name: s.tls_handshake.to_string(),
                    duration: value,
                });
            }
            if let Some(value) = self.quic_connect {
                timelines.push(Timeline {
                    name: s.quic_connect.to_string(),
                    duration: value,
                });
            }
            if let Some(value) = self.request_send {
                timelines.push(Timeline {
                    name: s.request_send.to_string(),
                    duration: value,
                });
            }
            if let Some(value) = self.server_processing {
                timelines.push(Timeline {
                    name: s.server_processing.to_string(),
                    duration: value,
                });
            }
            if let Some(value) = self.content_transfer {
                timelines.push(Timeline {
                    name: s.content_transfer.to_string(),
                    duration: value,
                });
            }

            if !timelines.is_empty() {
                write!(f, " ")?;
                for (i, timeline) in timelines.iter().enumerate() {
                    write!(
                        f,
                        "{}",
                        timeline.name.unicode_pad(width, Alignment::Center, true)
                    )?;
                    if i < timelines.len() - 1 {
                        write!(f, " ")?;
                    }
                }
                writeln!(f)?;

                write!(f, "[")?;
                for (i, timeline) in timelines.iter().enumerate() {
                    write!(
                        f,
                        "{}",
                        LightCyan.paint(
                            format_duration(timeline.duration)
                                .unicode_pad(width, Alignment::Center, true)
                                .to_string(),
                        )
                    )?;
                    if i < timelines.len() - 1 {
                        write!(f, "|")?;
                    }
                }
                writeln!(f, "]")?;
            }

            write!(f, " ")?;
            for _ in 0..timelines.len() {
                write!(f, "{}", " ".repeat(width))?;
                write!(f, "|")?;
            }
            writeln!(f)?;
            write!(f, "{}", " ".repeat(width * timelines.len()))?;
            write!(
                f,
                "{}:{}\n\n",
                s.total,
                LightCyan.paint(format_duration(self.total.unwrap_or_default()))
            )?;
        }

        if let Some(body) = &self.body {
            let status = self.status.unwrap_or(StatusCode::OK).as_u16();
            let mut body = std::str::from_utf8(body.as_ref())
                .unwrap_or_default()
                .to_string();
            if let Some(filter) = &self.jq_filter {
                // On an unsupported filter or non-JSON body, show the reason in
                // place of the body rather than silently dumping the full body.
                body = match apply_jq_filter(&body, filter) {
                    Ok(filtered) => filtered,
                    Err(reason) => LightRed.paint(format!("jq: {reason}")).to_string(),
                };
            } else if self.pretty && is_json {
                if let Ok(json_body) = serde_json::from_str::<serde_json::Value>(&body) {
                    if let Ok(value) = serde_json::to_string_pretty(&json_body) {
                        body = value;
                    }
                }
            }
            if self.verbose || self.jq_filter.is_some() || (is_text && body.len() < 4096) {
                let text = format!(
                    "{}: {}",
                    s.body_size,
                    ByteSize(self.body_size.unwrap_or(0) as u64)
                );
                writeln!(f, "{}", LightCyan.paint(text))?;
                self.fmt_throughput(f)?;
                writeln!(f)?;
                if status >= 400 {
                    writeln!(f, "{}", LightRed.paint(body))?;
                } else {
                    writeln!(f, "{body}")?;
                }
            } else {
                let mut save_tips = "".to_string();
                if let Ok(mut file) = NamedTempFile::new() {
                    if let Ok(()) = file.write_all(body.as_bytes()) {
                        save_tips = format!("{}: {}", s.saved_to, file.path().display());
                        let _ = file.keep();
                    }
                }
                let text = format!(
                    "{} {}",
                    s.body_discarded,
                    ByteSize(self.body_size.unwrap_or(0) as u64)
                );
                writeln!(f, "{} {}", LightCyan.paint(text), save_tips)?;
                self.fmt_throughput(f)?;
            }
        }

        Ok(())
    }
}

impl HttpStat {
    /// Render the throughput line(s) under the body summary. Always shown
    /// when the body exceeds `THROUGHPUT_DISPLAY_THRESHOLD` (1 MiB);
    /// verbose mode additionally splits "first 100 KB" vs "tail" so the
    /// user can tell TCP slow-start from steady-state server-side slowness.
    fn fmt_throughput(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        let Some(wire) = self.wire_body_size else {
            return Ok(());
        };
        if wire < THROUGHPUT_DISPLAY_THRESHOLD {
            return Ok(());
        }
        let Some(total) = self.throughput_bps() else {
            return Ok(());
        };
        let s = self.lang.strings();
        writeln!(
            f,
            "{} {}",
            LightCyan.paint(s.throughput),
            LightCyan.paint(format_throughput(total)),
        )?;
        if self.verbose {
            if let (Some(first), Some(tail)) = (
                self.first_chunk_throughput_bps(),
                self.tail_throughput_bps(),
            ) {
                writeln!(
                    f,
                    "  {} {}  {}  {} {}",
                    LightCyan.paint(s.throughput_first_100k),
                    LightCyan.paint(format_throughput(first)),
                    LightCyan.paint("·"),
                    LightCyan.paint(s.throughput_then),
                    LightCyan.paint(format_throughput(tail)),
                )?;
            }
        }
        Ok(())
    }
}

pub struct BenchmarkSummary {
    pub stats: Vec<HttpStat>,
    pub lang: Lang,
}

impl BenchmarkSummary {
    fn collect_sorted(&self, f: impl Fn(&HttpStat) -> Option<Duration>) -> Vec<Duration> {
        let mut v: Vec<Duration> = self.stats.iter().filter_map(f).collect();
        v.sort();
        v
    }

    fn percentile(sorted: &[Duration], p: f64) -> Option<Duration> {
        if sorted.is_empty() {
            return None;
        }
        let idx = ((p * sorted.len() as f64).ceil() as usize).saturating_sub(1);
        Some(sorted[idx.min(sorted.len() - 1)])
    }
}

impl fmt::Display for BenchmarkSummary {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        let total = self.stats.len();
        if total == 0 {
            return Ok(());
        }

        let strs = self.lang.strings();
        // When any run used DoH/DoT, render DNS as two columns; otherwise keep
        // the single DNS Lookup column for the existing plain-UDP path.
        let has_dns_connect = self.stats.iter().any(|s| s.dns_connect.is_some());
        let dns_cols: Vec<(&str, Vec<Duration>)> = if has_dns_connect {
            vec![
                (strs.dns_connect, self.collect_sorted(|s| s.dns_connect)),
                (strs.dns_query, self.collect_sorted(|s| s.dns_query())),
            ]
        } else {
            vec![(strs.dns_lookup, self.collect_sorted(|s| s.dns_lookup))]
        };
        let phases: Vec<(&str, Vec<Duration>)> = dns_cols
            .into_iter()
            .chain([
                (strs.tcp_connect, self.collect_sorted(|s| s.tcp_connect)),
                (strs.tls_handshake, self.collect_sorted(|s| s.tls_handshake)),
                (strs.quic_connect, self.collect_sorted(|s| s.quic_connect)),
                (strs.request_send, self.collect_sorted(|s| s.request_send)),
                (
                    strs.server_processing_short,
                    self.collect_sorted(|s| s.server_processing),
                ),
                (
                    strs.content_transfer_short,
                    self.collect_sorted(|s| s.content_transfer),
                ),
                (strs.total, self.collect_sorted(|s| s.total)),
            ])
            .filter(|(_, v)| !v.is_empty())
            .collect();

        if phases.is_empty() {
            return Ok(());
        }

        writeln!(f)?;
        writeln!(
            f,
            "{}",
            LightGreen.paint(format!(
                "{} ({total} {}) ---",
                strs.benchmark_results_prefix, strs.benchmark_results_requests,
            ))
        )?;
        writeln!(f)?;

        let col_w = 18;
        let label_w = 6;

        // Header row
        write!(f, "{:>label_w$} ", "")?;
        for (name, _) in &phases {
            write!(f, "{}", name.unicode_pad(col_w, Alignment::Center, true))?;
        }
        writeln!(f)?;

        // Stats rows — p50/p95/p99 are standard percentile notation, kept
        // as-is across locales. Only min/max/avg get translated.
        let rows: [(&str, f64); 6] = [
            (strs.min, 0.0),
            (strs.max, f64::INFINITY),
            (strs.avg, f64::NAN),
            ("p50", 0.5),
            ("p95", 0.95),
            ("p99", 0.99),
        ];

        for (label, p) in &rows {
            write!(f, "{} ", LightGreen.paint(format!("{label:>label_w$}")))?;
            for (_, sorted) in &phases {
                let val = if p.is_nan() {
                    // avg
                    if sorted.is_empty() {
                        None
                    } else {
                        let sum: Duration = sorted.iter().sum();
                        Some(sum / sorted.len() as u32)
                    }
                } else if *p == 0.0 {
                    sorted.first().copied()
                } else if p.is_infinite() {
                    sorted.last().copied()
                } else {
                    Self::percentile(sorted, *p)
                };
                let text = match val {
                    Some(d) => format_duration(d),
                    None => "-".to_string(),
                };
                write!(
                    f,
                    "{}",
                    LightCyan.paint(text.unicode_pad(col_w, Alignment::Center, true).to_string())
                )?;
            }
            writeln!(f)?;
        }

        writeln!(f)?;
        let success = self.stats.iter().filter(|s| s.is_success()).count();
        let pct = (success as f64 / total as f64) * 100.0;
        let success_text = format!("{}: {success}/{total} ({pct:.1}%)", strs.success);
        if success == total {
            writeln!(f, "  {}", LightGreen.paint(success_text))?;
        } else {
            writeln!(f, "  {}", LightRed.paint(success_text))?;
        }

        Ok(())
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    // ---- format_duration ----
    #[test]
    fn format_duration_units() {
        assert_eq!(format_duration(Duration::from_micros(999)), "999µs");
        assert_eq!(format_duration(Duration::from_millis(500)), "500ms");
        assert_eq!(format_duration(Duration::from_secs_f64(1.5)), "1.50s");
    }

    #[test]
    fn format_duration_boundaries() {
        // exactly 1ms is NOT strictly greater than 1ms, so it renders as µs
        assert_eq!(format_duration(Duration::from_millis(1)), "1000µs");
        // exactly 1s is NOT strictly greater than 1s, so it renders as ms
        assert_eq!(format_duration(Duration::from_secs(1)), "1000ms");
    }

    // ---- format_throughput ----
    #[test]
    fn format_throughput_units() {
        assert_eq!(format_throughput(1_500_000.0), "1.5 MB/s");
        assert_eq!(format_throughput(1_000_000.0), "1.0 MB/s");
        assert_eq!(format_throughput(2_048.0), "2.0 KB/s");
        assert_eq!(format_throughput(500.0), "500 B/s");
    }

    #[test]
    fn format_throughput_invalid_inputs_render_dash() {
        assert_eq!(format_throughput(0.0), "-");
        assert_eq!(format_throughput(-5.0), "-");
        assert_eq!(format_throughput(f64::NAN), "-");
        assert_eq!(format_throughput(f64::INFINITY), "-");
    }

    // ---- format_time ----
    #[test]
    fn format_time_invalid_falls_back_to_number() {
        // out-of-range timestamp can't be represented; we echo the raw number
        assert_eq!(format_time(i64::MAX), i64::MAX.to_string());
    }

    #[test]
    fn format_time_shape() {
        // "YYYY-MM-DD HH:MM:SS ±HH:MM" — 26 chars regardless of the local offset.
        let s = format_time(0);
        assert_eq!(s.len(), 26, "unexpected format: {s}");
        let sign = s.as_bytes()[20] as char;
        assert!(sign == '+' || sign == '-', "no offset sign in: {s}");
    }

    // ---- parse_server_timing ----
    #[test]
    fn parse_server_timing_basic() {
        let st = parse_server_timing(["db;dur=53.2, app;dur=47.1;desc=\"App Server\""]).unwrap();
        assert_eq!(st.len(), 2);
        assert_eq!(st[0].name, "db");
        assert_eq!(st[0].duration, Some(Duration::from_secs_f64(53.2 / 1000.0)));
        assert_eq!(st[1].name, "app");
        assert_eq!(st[1].description.as_deref(), Some("App Server"));
    }

    #[test]
    fn parse_server_timing_name_only_and_empty() {
        let st = parse_server_timing(["cache"]).unwrap();
        assert_eq!(st[0].name, "cache");
        assert_eq!(st[0].duration, None);
        assert!(parse_server_timing(Vec::<&str>::new()).is_none());
        assert!(parse_server_timing([""]).is_none());
    }

    // ---- parse_alt_svc ----
    #[test]
    fn parse_alt_svc_basic() {
        let v = parse_alt_svc(["h3=\":443\"; ma=86400, h2=\"alt.example:443\""]).unwrap();
        assert_eq!(v.len(), 2);
        assert_eq!(v[0].protocol, "h3");
        assert_eq!(v[0].authority, ":443");
        assert_eq!(v[0].max_age, Some(86400));
        assert_eq!(v[1].protocol, "h2");
        assert_eq!(v[1].authority, "alt.example:443");
        assert_eq!(v[1].max_age, None);
    }

    #[test]
    fn parse_alt_svc_clear_resets() {
        assert!(parse_alt_svc(["clear"]).is_none());
        let v = parse_alt_svc(["h3=\":443\", clear, h2=\":8443\""]).unwrap();
        assert_eq!(v.len(), 1);
        assert_eq!(v[0].protocol, "h2");
    }

    // ---- parse_hsts ----
    #[test]
    fn parse_hsts_full() {
        let h = parse_hsts("max-age=31536000; includeSubDomains; preload").unwrap();
        assert_eq!(h.max_age, 31536000);
        assert!(h.include_subdomains);
        assert!(h.preload);
    }

    #[test]
    fn parse_hsts_minimal_and_invalid() {
        let h = parse_hsts("max-age=0").unwrap();
        assert_eq!(h.max_age, 0);
        assert!(!h.include_subdomains);
        assert!(!h.preload);
        // a policy without max-age is not valid per RFC 6797
        assert!(parse_hsts("includeSubDomains; preload").is_none());
        // quoted value is accepted
        assert_eq!(parse_hsts("max-age=\"100\"").unwrap().max_age, 100);
    }

    // ---- apply_jq_filter ----
    const JQ_BODY: &str = r#"{"name":"x","items":[{"name":"a"},{"name":"b"}]}"#;

    #[test]
    fn jq_identity_and_key() {
        assert!(apply_jq_filter(JQ_BODY, ".").unwrap().contains("\"name\""));
        assert_eq!(apply_jq_filter(JQ_BODY, ".name"), Ok("\"x\"".to_string()));
        // the leading dot is optional
        assert_eq!(apply_jq_filter(JQ_BODY, "name"), Ok("\"x\"".to_string()));
    }

    #[test]
    fn jq_iterate_and_index() {
        assert_eq!(
            apply_jq_filter(JQ_BODY, ".items[].name"),
            Ok("\"a\"\n\"b\"".to_string())
        );
        assert_eq!(
            apply_jq_filter(JQ_BODY, ".items[0].name"),
            Ok("\"a\"".to_string())
        );
    }

    #[test]
    fn jq_missing_key_and_bad_json() {
        // a path that matches nothing yields an empty result (not an error)
        assert_eq!(apply_jq_filter(JQ_BODY, ".nope"), Ok(String::new()));
        // non-JSON input is now a clear error instead of a silent fallback
        assert!(apply_jq_filter("{not json", ".x").is_err());
    }

    #[test]
    fn jq_unsupported_syntax_is_rejected() {
        // pipes, functions, select(), and `?` are outside the supported subset
        for f in [
            ".items | length",
            ".items[] | select(.name)",
            ".name?",
            "keys | length",
        ] {
            assert!(
                apply_jq_filter(JQ_BODY, f).is_err(),
                "expected '{f}' to be rejected"
            );
        }
    }

    // ---- to_json ----
    #[test]
    fn to_json_keeps_duplicate_headers() {
        let mut headers = HeaderMap::new();
        headers.append("set-cookie", "a=1".parse().unwrap());
        headers.append("set-cookie", "b=2".parse().unwrap());
        headers.insert("content-type", "text/html".parse().unwrap());
        let stat = HttpStat {
            headers: Some(headers),
            ..Default::default()
        };
        let json = stat.to_json();
        let hdrs = json.get("headers").unwrap();
        assert_eq!(
            hdrs.get("set-cookie").unwrap(),
            &serde_json::json!(["a=1", "b=2"])
        );
        assert_eq!(
            hdrs.get("content-type").unwrap(),
            &serde_json::json!("text/html")
        );
    }

    // ---- is_success / exit_code ----
    #[test]
    fn success_and_status_exit_codes() {
        assert!(!HttpStat::default().is_success());
        assert_eq!(HttpStat::default().exit_code(), 1);

        let ok = HttpStat {
            status: Some(StatusCode::OK),
            ..Default::default()
        };
        assert!(ok.is_success());
        assert_eq!(ok.exit_code(), 0);

        let c404 = HttpStat {
            status: Some(StatusCode::NOT_FOUND),
            ..Default::default()
        };
        assert!(!c404.is_success());
        assert_eq!(c404.exit_code(), 6);

        let c500 = HttpStat {
            status: Some(StatusCode::INTERNAL_SERVER_ERROR),
            ..Default::default()
        };
        assert_eq!(c500.exit_code(), 7);
    }

    #[test]
    fn error_exit_codes_by_phase() {
        let timeout = HttpStat {
            error: Some("operation timeout".into()),
            ..Default::default()
        };
        assert_eq!(timeout.exit_code(), 5);

        let dns = HttpStat {
            error: Some("no such host".into()),
            dns_attempted: true,
            ..Default::default()
        };
        assert_eq!(dns.exit_code(), 2);

        let tcp = HttpStat {
            error: Some("connection refused".into()),
            dns_attempted: true,
            dns_lookup: Some(Duration::from_millis(1)),
            ..Default::default()
        };
        assert_eq!(tcp.exit_code(), 3);

        // IP-literal / --resolve / proxy targets skip DNS entirely: a refused
        // connection must map to the TCP code, not the DNS one.
        let refused_no_dns = HttpStat {
            error: Some("connection refused".into()),
            ..Default::default()
        };
        assert_eq!(refused_no_dns.exit_code(), 3);

        let tls = HttpStat {
            error: Some("rustls: bad certificate".into()),
            dns_lookup: Some(Duration::from_millis(1)),
            tcp_connect: Some(Duration::from_millis(1)),
            ..Default::default()
        };
        assert_eq!(tls.exit_code(), 4);
    }

    #[test]
    fn grpc_success_and_failure() {
        let ok = HttpStat {
            is_grpc: true,
            grpc_status: Some("0".into()),
            ..Default::default()
        };
        assert!(ok.is_success());
        assert_eq!(ok.exit_code(), 0);

        let bad = HttpStat {
            is_grpc: true,
            grpc_status: Some("5".into()),
            ..Default::default()
        };
        assert!(!bad.is_success());
        assert_eq!(bad.exit_code(), 1);
    }

    // ---- throughput / dns_query ----
    #[test]
    fn throughput_overall() {
        let s = HttpStat {
            wire_body_size: Some(1_000_000),
            content_transfer: Some(Duration::from_secs(1)),
            ..Default::default()
        };
        assert!((s.throughput_bps().unwrap() - 1_000_000.0).abs() < 1.0);

        // zero transfer time → undefined
        let z = HttpStat {
            wire_body_size: Some(100),
            content_transfer: Some(Duration::ZERO),
            ..Default::default()
        };
        assert!(z.throughput_bps().is_none());
        assert!(HttpStat::default().throughput_bps().is_none());
    }

    #[test]
    fn throughput_split_first_chunk_and_tail() {
        let s = HttpStat {
            wire_body_size: Some(200 * 1024),
            content_transfer: Some(Duration::from_secs(2)),
            time_to_first_100k: Some(Duration::from_secs(1)),
            ..Default::default()
        };
        // first 100 KiB in 1s
        assert!((s.first_chunk_throughput_bps().unwrap() - FIRST_CHUNK_BYTES as f64).abs() < 1.0);
        // remaining 100 KiB over the remaining 1s
        assert!((s.tail_throughput_bps().unwrap() - 100.0 * 1024.0).abs() < 1.0);

        // a body that never crosses the first-chunk threshold has no tail
        let small = HttpStat {
            wire_body_size: Some(50_000),
            content_transfer: Some(Duration::from_secs(2)),
            time_to_first_100k: Some(Duration::from_secs(1)),
            ..Default::default()
        };
        assert!(small.tail_throughput_bps().is_none());
    }

    #[test]
    fn dns_query_derivation() {
        let s = HttpStat {
            dns_lookup: Some(Duration::from_millis(50)),
            dns_connect: Some(Duration::from_millis(20)),
            ..Default::default()
        };
        assert_eq!(s.dns_query(), Some(Duration::from_millis(30)));

        // probe racing ahead clamps to zero rather than underflowing
        let racy = HttpStat {
            dns_lookup: Some(Duration::from_millis(10)),
            dns_connect: Some(Duration::from_millis(20)),
            ..Default::default()
        };
        assert_eq!(racy.dns_query(), Some(Duration::ZERO));

        // no probe → no derived query phase
        let plain = HttpStat {
            dns_lookup: Some(Duration::from_millis(5)),
            ..Default::default()
        };
        assert!(plain.dns_query().is_none());
    }

    // ---- to_json ----
    #[test]
    fn to_json_blocks_are_conditional() {
        let with_body = HttpStat {
            status: Some(StatusCode::OK),
            wire_body_size: Some(1_000_000),
            content_transfer: Some(Duration::from_secs(1)),
            ..Default::default()
        };
        let v = with_body.to_json();
        assert!(v.is_object());
        assert!(v.get("timing").is_some());
        assert!(v.get("throughput").is_some());

        // no body → throughput block omitted
        let no_body = HttpStat {
            status: Some(StatusCode::OK),
            ..Default::default()
        };
        assert!(no_body.to_json().get("throughput").is_none());
    }
}