@apicircle/core 1.0.6 → 1.0.8

package/dist/index.js

@@ -3973,6 +3973,699 @@ function parseAuth2(auth, warnings, name) {
   }
 }
 
+// src/import/apicircleFolder.ts
+import { generateId } from "@apicircle/shared";
+
+// src/export/folderExportCredentials.ts
+function collectFolderExportCredentials(envelope) {
+  const out = [];
+  if (envelope.folder.auth) {
+    out.push(
+      ...authCredentialFields(envelope.folder.auth).map(
+        (f) => buildCredential(
+          "root-folder",
+          envelope.source.folderId,
+          envelope.folder.name,
+          envelope.folder.auth,
+          f
+        )
+      )
+    );
+  }
+  for (const sub of envelope.folder.subfolders) {
+    if (!sub.auth) continue;
+    out.push(
+      ...authCredentialFields(sub.auth).map(
+        (f) => buildCredential("subfolder", sub.id, sub.name, sub.auth, f)
+      )
+    );
+  }
+  for (const req of envelope.folder.requests) {
+    out.push(
+      ...authCredentialFields(req.auth).map(
+        (f) => buildCredential("request", req.id, req.name, req.auth, f)
+      )
+    );
+  }
+  return out.sort(credentialCompare);
+}
+function redactFolderExportCredentials(envelope, includeIds = /* @__PURE__ */ new Set()) {
+  const next = {
+    ...envelope,
+    folder: {
+      ...envelope.folder,
+      auth: envelope.folder.auth ? redactAuthForScope(
+        envelope.folder.auth,
+        credentialIdsFor("root-folder", envelope.source.folderId, envelope.folder.auth),
+        includeIds
+      ) : envelope.folder.auth,
+      subfolders: envelope.folder.subfolders.map((sub) => {
+        if (!sub.auth) return sub;
+        const ids = credentialIdsFor("subfolder", sub.id, sub.auth);
+        return {
+          ...sub,
+          auth: redactAuthForScope(sub.auth, ids, includeIds)
+        };
+      }),
+      requests: envelope.folder.requests.map((req) => ({
+        ...req,
+        auth: redactAuthForScope(
+          req.auth,
+          credentialIdsFor("request", req.id, req.auth),
+          includeIds
+        )
+      }))
+    }
+  };
+  return next;
+}
+function authCredentialFields(auth) {
+  switch (auth.type) {
+    case "none":
+    case "inherit":
+    case "custom-header":
+      return [];
+    case "basic":
+      return [{ field: "password", label: "Basic \xB7 password" }];
+    case "bearer":
+      return auth.token ? [{ field: "token", label: "Bearer \xB7 token" }] : [];
+    case "api-key":
+      return auth.value ? [{ field: "value", label: "API key \xB7 value" }] : [];
+    case "digest":
+      return [{ field: "password", label: "Digest \xB7 password" }];
+    case "ntlm":
+      return [{ field: "password", label: "NTLM \xB7 password" }];
+    case "hawk":
+      return auth.hawkKey ? [{ field: "hawkKey", label: "Hawk \xB7 hawkKey" }] : [];
+    case "jwt-bearer":
+      return [
+        ...auth.secretOrKey ? [{ field: "secretOrKey", label: "JWT \xB7 secretOrKey" }] : [],
+        ...auth.token ? [{ field: "token", label: "JWT \xB7 token" }] : []
+      ];
+    case "aws-sigv4":
+      return [
+        ...auth.secretAccessKey ? [{ field: "secretAccessKey", label: "AWS SigV4 \xB7 secretAccessKey" }] : [],
+        ...auth.sessionToken ? [{ field: "sessionToken", label: "AWS SigV4 \xB7 sessionToken" }] : []
+      ];
+    case "oauth2-client-credentials":
+    case "oauth2-auth-code":
+    case "oauth2-pkce":
+      return [
+        ...auth.clientSecret ? [{ field: "clientSecret", label: `${auth.type} \xB7 clientSecret` }] : [],
+        ...auth.accessToken ? [{ field: "accessToken", label: `${auth.type} \xB7 accessToken` }] : [],
+        ...auth.refreshToken ? [{ field: "refreshToken", label: `${auth.type} \xB7 refreshToken` }] : []
+      ];
+    case "oauth2-password":
+      return [
+        ...auth.clientSecret ? [{ field: "clientSecret", label: "oauth2-password \xB7 clientSecret" }] : [],
+        ...auth.password ? [{ field: "password", label: "oauth2-password \xB7 password" }] : [],
+        ...auth.accessToken ? [{ field: "accessToken", label: "oauth2-password \xB7 accessToken" }] : [],
+        ...auth.refreshToken ? [{ field: "refreshToken", label: "oauth2-password \xB7 refreshToken" }] : []
+      ];
+    case "oauth2-implicit":
+      return auth.accessToken ? [{ field: "accessToken", label: "oauth2-implicit \xB7 accessToken" }] : [];
+    case "oauth2-device":
+      return [
+        ...auth.accessToken ? [{ field: "accessToken", label: "oauth2-device \xB7 accessToken" }] : [],
+        ...auth.refreshToken ? [{ field: "refreshToken", label: "oauth2-device \xB7 refreshToken" }] : []
+      ];
+    default:
+      return [];
+  }
+}
+function buildCredential(scope, ownerId, ownerName, auth, desc) {
+  const prefix = scope === "request" ? "request" : "folder";
+  return {
+    id: `${prefix}:${ownerId}.${auth.type}.${desc.field}`,
+    scope,
+    authType: auth.type,
+    field: desc.field,
+    label: desc.label,
+    ownerName,
+    ownerId
+  };
+}
+function credentialIdsFor(scope, ownerId, auth) {
+  const ids = /* @__PURE__ */ new Map();
+  const prefix = scope === "request" ? "request" : "folder";
+  for (const desc of authCredentialFields(auth)) {
+    ids.set(desc.field, `${prefix}:${ownerId}.${auth.type}.${desc.field}`);
+  }
+  return ids;
+}
+function redactAuthForScope(auth, ids, includeIds) {
+  const shouldBlank = (field) => {
+    const id = ids.get(field);
+    return !!id && !includeIds.has(id);
+  };
+  switch (auth.type) {
+    case "none":
+    case "inherit":
+    case "custom-header":
+      return auth;
+    case "basic":
+      return shouldBlank("password") ? { ...auth, password: "" } : auth;
+    case "bearer":
+      return shouldBlank("token") ? { ...auth, token: "" } : auth;
+    case "api-key":
+      return shouldBlank("value") ? { ...auth, value: "" } : auth;
+    case "digest":
+      return shouldBlank("password") ? { ...auth, password: "" } : auth;
+    case "ntlm":
+      return shouldBlank("password") ? { ...auth, password: "" } : auth;
+    case "hawk":
+      return shouldBlank("hawkKey") ? { ...auth, hawkKey: "" } : auth;
+    case "jwt-bearer":
+      return {
+        ...auth,
+        secretOrKey: shouldBlank("secretOrKey") ? "" : auth.secretOrKey,
+        token: shouldBlank("token") ? "" : auth.token
+      };
+    case "aws-sigv4":
+      return {
+        ...auth,
+        secretAccessKey: shouldBlank("secretAccessKey") ? "" : auth.secretAccessKey,
+        sessionToken: shouldBlank("sessionToken") ? "" : auth.sessionToken
+      };
+    case "oauth2-client-credentials":
+    case "oauth2-auth-code":
+    case "oauth2-pkce":
+      return {
+        ...auth,
+        clientSecret: shouldBlank("clientSecret") ? "" : auth.clientSecret,
+        accessToken: shouldBlank("accessToken") ? "" : auth.accessToken,
+        refreshToken: shouldBlank("refreshToken") ? "" : auth.refreshToken
+      };
+    case "oauth2-password":
+      return {
+        ...auth,
+        clientSecret: shouldBlank("clientSecret") ? "" : auth.clientSecret,
+        password: shouldBlank("password") ? "" : auth.password,
+        accessToken: shouldBlank("accessToken") ? "" : auth.accessToken,
+        refreshToken: shouldBlank("refreshToken") ? "" : auth.refreshToken
+      };
+    case "oauth2-implicit":
+      return {
+        ...auth,
+        accessToken: shouldBlank("accessToken") ? "" : auth.accessToken
+      };
+    case "oauth2-device":
+      return {
+        ...auth,
+        accessToken: shouldBlank("accessToken") ? "" : auth.accessToken,
+        refreshToken: shouldBlank("refreshToken") ? "" : auth.refreshToken
+      };
+    default:
+      return auth;
+  }
+}
+function scopeRank(scope) {
+  if (scope === "root-folder") return 0;
+  if (scope === "subfolder") return 1;
+  return 2;
+}
+function credentialCompare(a, b) {
+  const r = scopeRank(a.scope) - scopeRank(b.scope);
+  if (r !== 0) return r;
+  return a.ownerName.localeCompare(b.ownerName, void 0, { sensitivity: "base" });
+}
+
+// src/export/folderExport.ts
+var APICIRCLE_FOLDER_EXPORT_FORMAT = "apicircle.folder/v1";
+function collectFolderExport(args) {
+  const { synced, folderId } = args;
+  const root = synced.collections.folders[folderId];
+  if (!root) return null;
+  const now = args.now ?? (/* @__PURE__ */ new Date()).toISOString();
+  const appVersion = args.appVersion ?? "apicircle-studio";
+  const folderIds = /* @__PURE__ */ new Set([folderId]);
+  let grew = true;
+  while (grew) {
+    grew = false;
+    for (const f of Object.values(synced.collections.folders)) {
+      if (folderIds.has(f.id)) continue;
+      if (f.parentId && folderIds.has(f.parentId)) {
+        folderIds.add(f.id);
+        grew = true;
+      }
+    }
+  }
+  const subfolders = [];
+  for (const f of Object.values(synced.collections.folders)) {
+    if (f.id !== folderId && folderIds.has(f.id)) subfolders.push(cloneFolder(f));
+  }
+  const requests = [];
+  for (const r of Object.values(synced.collections.requests)) {
+    if (r.folderId && folderIds.has(r.folderId)) requests.push(cloneRequest(r));
+  }
+  const dependencies = collectDependencies(synced, requests);
+  const envelope = {
+    format: APICIRCLE_FOLDER_EXPORT_FORMAT,
+    exportedAt: now,
+    appVersion,
+    source: {
+      workspaceId: synced.workspaceId,
+      folderId,
+      folderName: root.name
+    },
+    folder: {
+      name: root.name,
+      auth: root.auth,
+      subfolders,
+      requests
+    },
+    dependencies
+  };
+  const report = buildReport(envelope);
+  return { envelope, report };
+}
+function serializeFolderExport(envelope) {
+  return JSON.stringify(envelope, null, 2);
+}
+function suggestFolderExportFilename(envelope) {
+  const slug = envelope.folder.name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  const base = slug || "folder";
+  return `${base}.apicircle.json`;
+}
+function cloneFolder(f) {
+  return {
+    ...f,
+    auth: f.auth ? { ...f.auth } : void 0
+  };
+}
+function cloneRequest(r) {
+  return {
+    ...r,
+    headers: r.headers.map((h) => ({ ...h })),
+    query: r.query.map((q) => ({ ...q })),
+    pathParams: r.pathParams ? { ...r.pathParams } : void 0,
+    cookies: r.cookies ? r.cookies.map((c) => ({ ...c })) : void 0,
+    body: cloneBody(r.body),
+    auth: { ...r.auth },
+    contextVars: r.contextVars.map((v) => ({ ...v })),
+    extractions: r.extractions.map((e) => ({ ...e })),
+    assertions: r.assertions.map((a) => ({ ...a }))
+  };
+}
+function cloneBody(body) {
+  if (body.type === "form-data") {
+    return {
+      ...body,
+      formRows: body.formRows?.map((row) => ({ ...row })) ?? body.formRows
+    };
+  }
+  if (body.type === "binary") {
+    return {
+      ...body,
+      attachment: body.attachment ? { ...body.attachment } : void 0
+    };
+  }
+  return { ...body };
+}
+function collectDependencies(synced, requests) {
+  const schemaIds = /* @__PURE__ */ new Set();
+  const graphqlIds = /* @__PURE__ */ new Set();
+  const fileIds = /* @__PURE__ */ new Set();
+  for (const r of requests) {
+    if (r.bodySchemaId) schemaIds.add(r.bodySchemaId);
+    if (r.graphqlSchemaId) graphqlIds.add(r.graphqlSchemaId);
+    if (r.body.type === "binary" && r.body.attachment?.globalFileAssetId) {
+      fileIds.add(r.body.attachment.globalFileAssetId);
+    }
+    if (r.body.type === "form-data" && r.body.formRows) {
+      for (const row of r.body.formRows) {
+        if (row.kind === "file" && row.globalFileAssetId) fileIds.add(row.globalFileAssetId);
+      }
+    }
+  }
+  const assets = synced.globalAssets;
+  const schemas = [];
+  for (const id of schemaIds) {
+    const s = assets.schemas[id];
+    if (s) schemas.push({ ...s });
+  }
+  const graphql = [];
+  for (const id of graphqlIds) {
+    const g = assets.graphql[id];
+    if (g) graphql.push({ ...g });
+  }
+  const files = [];
+  for (const id of fileIds) {
+    const f = assets.files?.[id];
+    if (f) files.push({ ...f });
+  }
+  schemas.sort(byNameThenId);
+  graphql.sort(byNameThenId);
+  files.sort(byNameThenId);
+  return { schemas, graphql, files };
+}
+function byNameThenId(a, b) {
+  const c = a.name.localeCompare(b.name, void 0, { sensitivity: "base" });
+  return c !== 0 ? c : a.id.localeCompare(b.id);
+}
+function buildReport(envelope) {
+  const subfolderCount = envelope.folder.subfolders.length;
+  const requestCount = envelope.folder.requests.length;
+  const totalFolderCount = subfolderCount + 1;
+  const credentials = collectFolderExportCredentials(envelope);
+  return {
+    folderName: envelope.folder.name,
+    requestCount,
+    subfolderCount,
+    totalFolderCount,
+    dependencies: {
+      schemas: envelope.dependencies.schemas.map((s) => ({ id: s.id, name: s.name })),
+      graphql: envelope.dependencies.graphql.map((g) => ({
+        id: g.id,
+        name: g.name,
+        kind: g.kind
+      })),
+      files: envelope.dependencies.files.map((f) => ({
+        id: f.id,
+        name: f.name,
+        filename: f.filename,
+        size: f.size,
+        mimeType: f.mimeType
+      }))
+    },
+    hasDependencies: envelope.dependencies.schemas.length > 0 || envelope.dependencies.graphql.length > 0 || envelope.dependencies.files.length > 0,
+    credentials,
+    hasCredentials: credentials.length > 0
+  };
+}
+
+// src/import/apicircleFolder.ts
+function isApicircleFolderExport(doc) {
+  if (!doc || typeof doc !== "object") return false;
+  const d = doc;
+  return d.format === APICIRCLE_FOLDER_EXPORT_FORMAT;
+}
+function parseApicircleFolderExport(input, options = {}) {
+  let doc;
+  try {
+    doc = JSON.parse(input);
+  } catch (err) {
+    throw new Error(`Couldn't parse JSON: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  return parseApicircleFolderExportDoc(doc, options);
+}
+function parseApicircleFolderExportDoc(doc, options = {}) {
+  const id = options.idGenerator ?? generateId;
+  if (!isApicircleFolderExport(doc)) {
+    throw new Error(
+      `Unsupported format. Expected an API Circle folder export ("format": "${APICIRCLE_FOLDER_EXPORT_FORMAT}").`
+    );
+  }
+  const envelope = doc;
+  validateEnvelopeShape(envelope);
+  const warnings = [];
+  const folderIdMap = /* @__PURE__ */ new Map();
+  folderIdMap.set(envelope.source.folderId, id());
+  for (const f of envelope.folder.subfolders) folderIdMap.set(f.id, id());
+  const requestIdMap = /* @__PURE__ */ new Map();
+  for (const r of envelope.folder.requests) requestIdMap.set(r.id, id());
+  const schemaIdMap = /* @__PURE__ */ new Map();
+  for (const s of envelope.dependencies.schemas) schemaIdMap.set(s.id, id());
+  const graphqlIdMap = /* @__PURE__ */ new Map();
+  for (const g of envelope.dependencies.graphql) graphqlIdMap.set(g.id, id());
+  const fileIdMap = /* @__PURE__ */ new Map();
+  for (const f of envelope.dependencies.files) fileIdMap.set(f.id, id());
+  const rootFolderId = folderIdMap.get(envelope.source.folderId);
+  const subfolders = envelope.folder.subfolders.map((f) => {
+    const newId = folderIdMap.get(f.id);
+    let newParentId;
+    if (f.parentId === null) {
+      newParentId = rootFolderId;
+    } else {
+      const mapped = folderIdMap.get(f.parentId);
+      if (!mapped) {
+        warnings.push(
+          `Subfolder "${f.name}" referenced parentId "${f.parentId}" that wasn't present in the export \u2014 reattached under "${envelope.folder.name}".`
+        );
+        newParentId = rootFolderId;
+      } else {
+        newParentId = mapped;
+      }
+    }
+    return {
+      ...f,
+      id: newId,
+      parentId: newParentId,
+      auth: f.auth ? { ...f.auth } : void 0
+    };
+  });
+  const schemas = envelope.dependencies.schemas.map((s) => ({
+    ...s,
+    id: schemaIdMap.get(s.id)
+  }));
+  const graphql = envelope.dependencies.graphql.map((g) => ({
+    ...g,
+    id: graphqlIdMap.get(g.id)
+  }));
+  const files = envelope.dependencies.files.map((f) => ({
+    ...f,
+    id: fileIdMap.get(f.id)
+  }));
+  const requests = envelope.folder.requests.map((r) => {
+    const newId = requestIdMap.get(r.id);
+    let newFolderId;
+    if (r.folderId === null) {
+      newFolderId = rootFolderId;
+    } else {
+      const mapped = folderIdMap.get(r.folderId);
+      if (!mapped) {
+        warnings.push(
+          `Request "${r.name}" referenced folderId "${r.folderId}" that wasn't present in the export \u2014 reattached under "${envelope.folder.name}".`
+        );
+        newFolderId = rootFolderId;
+      } else {
+        newFolderId = mapped;
+      }
+    }
+    const bodySchemaId = remapDependencyRef(
+      r.bodySchemaId,
+      schemaIdMap,
+      `Request "${r.name}".bodySchemaId`,
+      warnings
+    );
+    const graphqlSchemaId = remapDependencyRef(
+      r.graphqlSchemaId,
+      graphqlIdMap,
+      `Request "${r.name}".graphqlSchemaId`,
+      warnings
+    );
+    return {
+      ...r,
+      id: newId,
+      folderId: newFolderId,
+      bodySchemaId,
+      graphqlSchemaId,
+      headers: r.headers.map((h) => ({ ...h })),
+      query: r.query.map((q) => ({ ...q })),
+      pathParams: r.pathParams ? { ...r.pathParams } : void 0,
+      cookies: r.cookies ? r.cookies.map((c) => ({ ...c })) : void 0,
+      body: remapBodyFileRefs(r.body, fileIdMap, r.name, warnings),
+      auth: { ...r.auth },
+      contextVars: r.contextVars.map((v) => ({ ...v })),
+      extractions: r.extractions.map((e) => ({ ...e })),
+      assertions: r.assertions.map((a) => ({ ...a }))
+    };
+  });
+  return {
+    rootFolder: {
+      id: rootFolderId,
+      name: envelope.folder.name,
+      auth: envelope.folder.auth ? { ...envelope.folder.auth } : void 0
+    },
+    subfolders,
+    requests,
+    dependencies: { schemas, graphql, files },
+    sourceFolderName: envelope.source.folderName,
+    warnings
+  };
+}
+function validateEnvelopeShape(envelope) {
+  if (!envelope.folder || typeof envelope.folder !== "object") {
+    throw new Error('API Circle folder export is missing the "folder" section.');
+  }
+  if (typeof envelope.folder.name !== "string" || envelope.folder.name.length === 0) {
+    throw new Error('API Circle folder export must have a non-empty "folder.name".');
+  }
+  if (!Array.isArray(envelope.folder.subfolders)) {
+    throw new Error('API Circle folder export must have a "folder.subfolders" array.');
+  }
+  if (!Array.isArray(envelope.folder.requests)) {
+    throw new Error('API Circle folder export must have a "folder.requests" array.');
+  }
+  if (!envelope.dependencies || typeof envelope.dependencies !== "object") {
+    throw new Error('API Circle folder export is missing the "dependencies" section.');
+  }
+  if (!Array.isArray(envelope.dependencies.schemas) || !Array.isArray(envelope.dependencies.graphql) || !Array.isArray(envelope.dependencies.files)) {
+    throw new Error(
+      'API Circle folder export "dependencies" must have schemas / graphql / files arrays.'
+    );
+  }
+  if (!envelope.source || typeof envelope.source !== "object") {
+    throw new Error('API Circle folder export is missing the "source" section.');
+  }
+  if (typeof envelope.source.folderId !== "string" || typeof envelope.source.folderName !== "string") {
+    throw new Error('API Circle folder export "source" must include "folderId" and "folderName".');
+  }
+}
+function remapDependencyRef(value, map, label, warnings) {
+  if (value === null || value === void 0) return value;
+  const mapped = map.get(value);
+  if (mapped) return mapped;
+  warnings.push(
+    `${label} referenced a dependency ("${value}") that wasn't embedded in the export \u2014 reference dropped on import.`
+  );
+  return null;
+}
+function remapBodyFileRefs(body, fileIdMap, requestName, warnings) {
+  if (body.type === "binary") {
+    if (!body.attachment) return { ...body };
+    const oldId = body.attachment.globalFileAssetId;
+    let nextGlobalFileAssetId = oldId;
+    if (oldId) {
+      const mapped = fileIdMap.get(oldId);
+      if (mapped) {
+        nextGlobalFileAssetId = mapped;
+      } else {
+        warnings.push(
+          `Request "${requestName}".body.attachment referenced file asset "${oldId}" that wasn't embedded in the export \u2014 re-attach the file after import.`
+        );
+        nextGlobalFileAssetId = null;
+      }
+    }
+    return {
+      ...body,
+      attachment: {
+        ...body.attachment,
+        // Reset slotId — the destination workspace owns its own slots.
+        slotId: null,
+        globalFileAssetId: nextGlobalFileAssetId
+      }
+    };
+  }
+  if (body.type === "form-data") {
+    const formRows = body.formRows?.map((row) => {
+      if (row.kind !== "file") return { ...row };
+      const oldId = row.globalFileAssetId;
+      let nextGlobalFileAssetId = oldId;
+      if (oldId) {
+        const mapped = fileIdMap.get(oldId);
+        if (mapped) {
+          nextGlobalFileAssetId = mapped;
+        } else {
+          warnings.push(
+            `Request "${requestName}" form-data row "${row.key}" referenced file asset "${oldId}" that wasn't embedded in the export \u2014 re-attach the file after import.`
+          );
+          nextGlobalFileAssetId = null;
+        }
+      }
+      return {
+        ...row,
+        slotId: null,
+        globalFileAssetId: nextGlobalFileAssetId
+      };
+    });
+    return { ...body, formRows };
+  }
+  return { ...body };
+}
+
+// src/import/apicircleEnvironment.ts
+function isApicircleEnvironment(doc) {
+  if (!doc || typeof doc !== "object") return false;
+  const d = doc;
+  return (d.apicircleEnvironment === 1 || d.apicircleEnvironment === 2) && typeof d.name === "string" && Array.isArray(d.variables);
+}
+function parseApicircleEnvironment(input) {
+  let doc;
+  try {
+    doc = JSON.parse(input);
+  } catch (err) {
+    throw new Error(`Couldn't parse JSON: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  return parseApicircleEnvironmentDoc(doc);
+}
+function parseApicircleEnvironmentDoc(doc) {
+  if (!isApicircleEnvironment(doc)) {
+    throw new Error(
+      'Unsupported format. Expected an API Circle environment export ("apicircleEnvironment": 1 or 2).'
+    );
+  }
+  const name = doc.name.trim();
+  if (!name) {
+    throw new Error('API Circle environment export must have a non-empty "name".');
+  }
+  const payloadVersion = doc.apicircleEnvironment;
+  const warnings = [];
+  const variables = [];
+  const encryptedBindingHints = [];
+  for (let i = 0; i < doc.variables.length; i += 1) {
+    const raw = doc.variables[i];
+    if (!raw || typeof raw !== "object") {
+      warnings.push(`Row #${i + 1} was not an object \u2014 dropped.`);
+      continue;
+    }
+    const key = typeof raw.key === "string" ? raw.key.trim() : "";
+    if (!key) {
+      warnings.push(`Row #${i + 1} had no key \u2014 dropped.`);
+      continue;
+    }
+    if (raw.encrypted === true) {
+      const secretKeyId = typeof raw.secretKeyId === "string" ? raw.secretKeyId : "";
+      const labelFromSecret = readLabelFromSecretField(raw.secret);
+      const ciphertext = payloadVersion === 2 && typeof raw.value === "string" && raw.value.startsWith("enc:") ? raw.value : null;
+      const salt = payloadVersion === 2 ? readSaltFromSecretField(raw.secret) : null;
+      if (!secretKeyId && !labelFromSecret) {
+        warnings.push(
+          `"${key}" was marked encrypted but carried no secretKeyId and no secret label \u2014 imported as an empty plain variable. Re-bind it under Environments after import.`
+        );
+        variables.push({ key, value: "", encrypted: false });
+        continue;
+      }
+      variables.push({
+        key,
+        value: ciphertext ?? "",
+        encrypted: true,
+        secretKeyId: secretKeyId || void 0
+      });
+      const labelFromFallback = !labelFromSecret;
+      encryptedBindingHints.push({
+        varKey: key,
+        label: labelFromSecret ?? key,
+        originSecretKeyId: secretKeyId || void 0,
+        labelFromFallback,
+        ciphertext,
+        salt
+      });
+      continue;
+    }
+    variables.push({
+      key,
+      value: typeof raw.value === "string" ? raw.value : "",
+      encrypted: false
+    });
+  }
+  return { name, variables, encryptedBindingHints, payloadVersion, warnings };
+}
+function readLabelFromSecretField(field) {
+  if (!field || typeof field !== "object") return null;
+  const f = field;
+  if (typeof f.label !== "string") return null;
+  const trimmed = f.label.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+function readSaltFromSecretField(field) {
+  if (!field || typeof field !== "object") return null;
+  const f = field;
+  if (typeof f.salt !== "string") return null;
+  const trimmed = f.salt.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+
 // src/assertions/runAssertions.ts
 function runAssertions(assertions, exec) {
   return assertions.map((a) => runOne(a, exec));
@@ -5720,7 +6413,232 @@ function structurallyEqual2(a, b) {
 }
 
 // src/workspace/applyMutation.ts
-import { envPriorityKey, generateId } from "@apicircle/shared";
+import { envPriorityKey, generateId as generateId2 } from "@apicircle/shared";
+
+// src/workspace/apicircleFolderImport.ts
+function importApicircleFolderInto(synced, parsed, parentFolderId) {
+  let cur = synced;
+  const schemaRemap = /* @__PURE__ */ new Map();
+  const graphqlRemap = /* @__PURE__ */ new Map();
+  const fileRemap = /* @__PURE__ */ new Map();
+  let schemasAdded = 0;
+  let schemasReused = 0;
+  let graphqlAdded = 0;
+  let graphqlReused = 0;
+  let filesAdded = 0;
+  let filesReused = 0;
+  const filesRequiringReattachment = [];
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  for (const incoming of parsed.dependencies.schemas) {
+    const existing = findMatchingSchema(cur, incoming);
+    if (existing) {
+      schemaRemap.set(incoming.id, existing.id);
+      schemasReused += 1;
+      continue;
+    }
+    cur = mergeGlobalSchema(cur, incoming, now);
+    schemaRemap.set(incoming.id, incoming.id);
+    schemasAdded += 1;
+  }
+  for (const incoming of parsed.dependencies.graphql) {
+    const existing = findMatchingGraphQL(cur, incoming);
+    if (existing) {
+      graphqlRemap.set(incoming.id, existing.id);
+      graphqlReused += 1;
+      continue;
+    }
+    cur = mergeGlobalGraphQL(cur, incoming, now);
+    graphqlRemap.set(incoming.id, incoming.id);
+    graphqlAdded += 1;
+  }
+  for (const incoming of parsed.dependencies.files) {
+    const existing = findMatchingFile(cur, incoming);
+    if (existing) {
+      fileRemap.set(incoming.id, existing.id);
+      filesReused += 1;
+      continue;
+    }
+    cur = mergeGlobalFile(cur, incoming, now);
+    fileRemap.set(incoming.id, incoming.id);
+    filesAdded += 1;
+    filesRequiringReattachment.push(incoming.id);
+  }
+  const rootName = uniquifyFolderName(cur, parentFolderId, parsed.rootFolder.name);
+  const root = {
+    id: parsed.rootFolder.id,
+    name: rootName,
+    parentId: parentFolderId,
+    auth: parsed.rootFolder.auth ? { ...parsed.rootFolder.auth } : void 0
+  };
+  cur = insertFolder(
+    cur,
+    root,
+    /* attachToTree */
+    parentFolderId === null
+  );
+  for (const f of parsed.subfolders) {
+    cur = insertFolder(
+      cur,
+      f,
+      /* attachToTree */
+      false
+    );
+  }
+  for (const r of parsed.requests) {
+    const rewritten = {
+      ...r,
+      bodySchemaId: rewriteRef(r.bodySchemaId, schemaRemap),
+      graphqlSchemaId: rewriteRef(r.graphqlSchemaId, graphqlRemap),
+      body: rewriteBodyFileRefs(r.body, fileRemap)
+    };
+    cur = insertRequest(cur, rewritten);
+  }
+  return {
+    synced: { ...cur, meta: { ...cur.meta, updatedAt: now } },
+    rootFolderId: root.id,
+    rootFolderName: rootName,
+    counts: {
+      folders: parsed.subfolders.length + 1,
+      requests: parsed.requests.length,
+      schemasAdded,
+      schemasReused,
+      graphqlAdded,
+      graphqlReused,
+      filesAdded,
+      filesReused
+    },
+    filesRequiringReattachment
+  };
+}
+function isFolderNameAvailable(synced, parentFolderId, name) {
+  const trimmed = name.trim().toLowerCase();
+  if (!trimmed) return false;
+  for (const node of Object.values(synced.collections.folders)) {
+    if (node.parentId !== parentFolderId) continue;
+    if (node.name.trim().toLowerCase() === trimmed) return false;
+  }
+  return true;
+}
+function uniquifyFolderName(synced, parentFolderId, desired) {
+  if (isFolderNameAvailable(synced, parentFolderId, desired)) return desired;
+  let n = 2;
+  while (!isFolderNameAvailable(synced, parentFolderId, `${desired} (${n})`)) {
+    n += 1;
+    if (n > 999) return `${desired} (${n})`;
+  }
+  return `${desired} (${n})`;
+}
+function insertFolder(synced, folder, attachToTree) {
+  const folders = { ...synced.collections.folders, [folder.id]: folder };
+  const tree = attachToTree ? {
+    ...synced.collections.tree,
+    children: [...synced.collections.tree.children, { kind: "folder", id: folder.id }]
+  } : synced.collections.tree;
+  return {
+    ...synced,
+    collections: { ...synced.collections, folders, tree }
+  };
+}
+function insertRequest(synced, request) {
+  return {
+    ...synced,
+    collections: {
+      ...synced.collections,
+      requests: { ...synced.collections.requests, [request.id]: request }
+    }
+  };
+}
+function withGlobalAssets(synced) {
+  return synced.globalAssets ?? { schemas: {}, graphql: {}, files: {} };
+}
+function findMatchingSchema(synced, candidate) {
+  const ga = withGlobalAssets(synced);
+  for (const existing of Object.values(ga.schemas)) {
+    if (existing.name === candidate.name && existing.schema === candidate.schema) {
+      return existing;
+    }
+  }
+  return null;
+}
+function findMatchingGraphQL(synced, candidate) {
+  const ga = withGlobalAssets(synced);
+  for (const existing of Object.values(ga.graphql)) {
+    if (existing.name === candidate.name && existing.kind === candidate.kind && existing.source === candidate.source) {
+      return existing;
+    }
+  }
+  return null;
+}
+function findMatchingFile(synced, candidate) {
+  const ga = withGlobalAssets(synced);
+  const files = ga.files ?? {};
+  for (const existing of Object.values(files)) {
+    if (existing.name === candidate.name && existing.filename === candidate.filename && existing.size === candidate.size) {
+      return existing;
+    }
+  }
+  return null;
+}
+function mergeGlobalSchema(synced, schema, now) {
+  const ga = withGlobalAssets(synced);
+  return {
+    ...synced,
+    globalAssets: {
+      ...ga,
+      schemas: { ...ga.schemas, [schema.id]: { ...schema, updatedAt: now } }
+    }
+  };
+}
+function mergeGlobalGraphQL(synced, graphql, now) {
+  const ga = withGlobalAssets(synced);
+  return {
+    ...synced,
+    globalAssets: {
+      ...ga,
+      graphql: { ...ga.graphql, [graphql.id]: { ...graphql, updatedAt: now } }
+    }
+  };
+}
+function mergeGlobalFile(synced, file, now) {
+  const ga = withGlobalAssets(synced);
+  const files = ga.files ?? {};
+  return {
+    ...synced,
+    globalAssets: {
+      ...ga,
+      files: { ...files, [file.id]: { ...file, updatedAt: now } }
+    }
+  };
+}
+function rewriteRef(value, remap) {
+  if (value === null || value === void 0) return value;
+  return remap.get(value) ?? value;
+}
+function rewriteBodyFileRefs(body, remap) {
+  if (body.type === "binary") {
+    if (!body.attachment) return body;
+    const rewritten = rewriteRef(body.attachment.globalFileAssetId, remap);
+    if (rewritten === body.attachment.globalFileAssetId) return body;
+    return {
+      ...body,
+      attachment: { ...body.attachment, globalFileAssetId: rewritten }
+    };
+  }
+  if (body.type === "form-data" && body.formRows) {
+    let mutated = false;
+    const next = body.formRows.map((row) => {
+      if (row.kind !== "file") return row;
+      const rewritten = rewriteRef(row.globalFileAssetId, remap);
+      if (rewritten === row.globalFileAssetId) return row;
+      mutated = true;
+      return { ...row, globalFileAssetId: rewritten };
+    });
+    return mutated ? { ...body, formRows: next } : body;
+  }
+  return body;
+}
+
+// src/workspace/applyMutation.ts
 function applyMutation(state, patch, options = {}) {
   const now = options.now ?? (/* @__PURE__ */ new Date()).toISOString();
   switch (patch.kind) {
@@ -5736,6 +6654,8 @@ function applyMutation(state, patch, options = {}) {
       return applyFolderDelete(state, patch.id, now);
     case "folder.move":
       return applyFolderMove(state, patch.id, patch.newParentId, now);
+    case "folder.import_apicircle":
+      return applyFolderImportApicircle(state, patch.parsed, patch.parentFolderId, now);
     case "environment.upsert":
       return applyEnvUpsert(state, patch.environment, now);
     case "environment.delete":
@@ -5744,6 +6664,8 @@ function applyMutation(state, patch, options = {}) {
       return applyEnvSetActive(state, patch.name, now);
     case "environment.setPriority":
       return applyEnvSetPriority(state, patch.order, now);
+    case "secretKey.upsert":
+      return applySecretKeyUpsert(state, patch.meta, now);
     case "assertion.upsert":
       return applyAssertionUpsert(state, patch.requestId, patch.assertion, now);
     case "assertion.delete":
@@ -5904,6 +6826,23 @@ function applyFolderMove(state, id, newParentId, now) {
   };
   return { next: { ...state, synced }, changedIds: [id] };
 }
+function applyFolderImportApicircle(state, parsed, parentFolderId, now) {
+  const result = importApicircleFolderInto(
+    state.synced,
+    parsed,
+    parentFolderId
+  );
+  const synced = {
+    ...result.synced,
+    meta: { ...result.synced.meta, updatedAt: now }
+  };
+  const changedIds = [
+    result.rootFolderId,
+    ...parsed.subfolders.map((f) => f.id),
+    ...parsed.requests.map((r) => r.id)
+  ];
+  return { next: { ...state, synced }, changedIds };
+}
 function applyEnvUpsert(state, environment, now) {
   const trimmed = environment.name.trim();
   if (!trimmed) {
@@ -5979,6 +6918,20 @@ function applyEnvSetPriority(state, order, now) {
   };
   return { next: { ...state, synced }, changedIds: filtered.map(envPriorityKey) };
 }
+function applySecretKeyUpsert(state, meta, now) {
+  if (!meta.id || !meta.label.trim() || !meta.salt) {
+    return { next: state, changedIds: [] };
+  }
+  const synced = {
+    ...state.synced,
+    secretKeys: {
+      ...state.synced.secretKeys ?? {},
+      [meta.id]: { ...meta, label: meta.label.trim() }
+    },
+    meta: { ...state.synced.meta, updatedAt: now }
+  };
+  return { next: { ...state, synced }, changedIds: [meta.id] };
+}
 function applyAssertionUpsert(state, requestId, assertion, now) {
   const request = state.synced.collections.requests[requestId];
   if (!request) {
@@ -6121,7 +7074,7 @@ function evictSnapshotsToCap(entries, maxBytes) {
   };
 }
 function applySnapshotCapture(state, args, now) {
-  const id = args.id ?? generateId();
+  const id = args.id ?? generateId2();
   const snapshot2 = {
     id,
     createdAt: now,
@@ -6210,7 +7163,7 @@ function applyHistoryPurge(state, olderThanMs) {
 }
 
 // src/workspace/runPlan.ts
-import { envPriorityKey as envPriorityKey2, generateId as generateId2, RUN_BODY_PREVIEW_LIMIT } from "@apicircle/shared";
+import { envPriorityKey as envPriorityKey2, generateId as generateId3, RUN_BODY_PREVIEW_LIMIT } from "@apicircle/shared";
 var MAX_REQUEST_RUNS = 500;
 var MAX_PLAN_RUNS = 200;
 var ANONYMOUS_ACTOR = { kind: "unknown", name: "unknown" };
@@ -6357,7 +7310,7 @@ async function runPlan(state, planId, opts = {}) {
   const baseRefs = plan.envPriorityOrder.length > 0 ? plan.envPriorityOrder : state.synced.environments.priorityOrder;
   const envRefs = opts.env ? [{ kind: "local", name: opts.env }, ...baseRefs] : baseRefs;
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
-  const planRunId = generateId2();
+  const planRunId = generateId3();
   const t0 = Date.now();
   const stepRecords = [];
   const newRequestRuns = [];
@@ -6390,7 +7343,7 @@ async function runPlan(state, planId, opts = {}) {
     const lookup2 = lookupPlanStepRequest(step, state.synced, state.local);
     const baseRequest = lookup2.request;
     if (!baseRequest) {
-      const runId = generateId2();
+      const runId = generateId3();
       const error = lookup2.error ?? "Request no longer exists in workspace.";
       newRequestRuns.push(orphanRun(runId, step.requestId, error));
       stepRecords.push({ requestRunId: runId, passed: false });
@@ -6622,7 +7575,7 @@ function orphanRun(id, requestId, error) {
 function buildRequestRun(resolved, result, assertions) {
   const { preview, truncated } = clampPreview(result.body ?? "");
   return {
-    id: generateId2(),
+    id: generateId3(),
     requestId: resolved.id,
     startedAt: result.startedAt,
     durationMs: result.durationMs,
@@ -6928,6 +7881,7 @@ var TRANSFORM_FORMAT_LABELS = {
 };
 export {
   ANONYMOUS_ACTOR,
+  APICIRCLE_FOLDER_EXPORT_FORMAT,
   DESKTOP_APP_ORIGIN,
   EMPTY_UNPUSHED_SUMMARY,
   HTTP_HEADERS_MAP,
@@ -6952,6 +7906,8 @@ export {
   buildRequest,
   buildScope,
   collectAttachmentSlots,
+  collectFolderExport,
+  collectFolderExportCredentials,
   collectVariableSuggestions,
   compareSemver,
   composeBody,
@@ -6987,7 +7943,10 @@ export {
   getLanguageFromContentType,
   getVariableAutocomplete,
   hasUnpushedChanges,
+  importApicircleFolderInto,
   importKey,
+  isApicircleEnvironment,
+  isApicircleFolderExport,
   isDesktop,
   isInsomniaExport,
   isPostmanEnvironment,
@@ -6996,6 +7955,10 @@ export {
   lookup,
   mergeWithAutoHeaders,
   normalizeContentType,
+  parseApicircleEnvironment,
+  parseApicircleEnvironmentDoc,
+  parseApicircleFolderExport,
+  parseApicircleFolderExportDoc,
   parseCurl,
   parseDigestChallenge,
   parseGraphqlSchema,
@@ -7011,6 +7974,7 @@ export {
   previewLinkedUpdate,
   publishRelease,
   readJsonPath,
+  redactFolderExportCredentials,
   redactForGit,
   refreshToken,
   requestDeviceAuthorization,
@@ -7023,11 +7987,13 @@ export {
   runClientCredentials,
   runPlan,
   runRopc,
+  serializeFolderExport,
   serializePayload,
   serializeWorkspaceForGit,
   signJwt,
   slugify,
   sortVersionsDesc,
+  suggestFolderExportFilename,
   suggestHeaders,
   summarizeUnpushedChanges,
   supportedContentTypeLanguageMap,