Epic: runner, auth, selectors and CLI parity (cookies, TLS, proxy, digest, PKCE, JSONPath, Postman import, HTML report, fmt) #25

Why

Against Hurl, Bruno, httpyac and Postman/Newman, apic is missing a set of transport, auth, selector, import/export and reporting features that people expect from any request runner, regardless of file format. This epic tracks them. Each child is independently deliverable and keeps the two contracts from AGENTS.md: the --json shape and the exit codes only change with a README note, and every command works non-interactively.

What is in scope

• P1 cookie jar; --cacert and client certificates; Postman collection import; validate columns and GitHub annotations
• P2 --proxy; apikey and digest auth; OAuth2 authorization code with PKCE; JSONPath filters and multi-value headers; JSON Schema and type assertions; timing breakdown; curl import; HTML report; apic fmt; MCP over HTTP; generated CLI reference and man pages
• P3 JetBrains Security.Auth blocks; code snippets in other languages; data-driven runs; response history

Deliberately not planned

Scripting, custom step definitions, gRPC, WebSocket. See the format epic and docs/comparison.md.

Where

• internal/runner (transport at runner.go:749-792), internal/auth, internal/selector, internal/assert, internal/curlexport, internal/openapi, internal/cli, internal/mcp
• Docs: docs/cli.md, docs/auth.md, docs/format.md, docs/cheatsheet.md, README command table