@apicircle/mcp-server 1.0.5 → 1.0.7

package/dist/index.cjs

@@ -41,10 +41,34 @@ var import_zod = require("zod");
 // package.json
 var package_default = {
   name: "@apicircle/mcp-server",
-  version: "1.0.5",
+  version: "1.0.7",
   private: false,
   type: "module",
   description: "Model Context Protocol server exposing API Circle Studio's workspace as a tool catalog. Used by Claude Desktop, ChatGPT, Cursor, GitHub Copilot, and any other MCP-compatible AI client.",
+  keywords: [
+    "apicircle",
+    "api",
+    "api-circle",
+    "mcp",
+    "mcp-server",
+    "model-context-protocol",
+    "ai",
+    "llm",
+    "agent",
+    "tool-catalog",
+    "claude",
+    "claude-desktop",
+    "chatgpt",
+    "cursor",
+    "copilot",
+    "continue",
+    "cline",
+    "zed",
+    "windsurf",
+    "openapi",
+    "postman",
+    "api-tools"
+  ],
   license: "SEE LICENSE IN LICENSE",
   repository: {
     type: "git",
@@ -565,6 +589,7 @@ var workspaceListTool = {
 // src/tools/crud.ts
 var import_zod5 = require("zod");
 var import_shared2 = require("@apicircle/shared");
+var import_core2 = require("@apicircle/core");
 var HTTP_METHOD = import_zod5.z.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]);
 var requestCreateTool = {
   name: "request.create",
@@ -809,55 +834,136 @@ var environmentSetPriorityTool = {
 };
 var environmentExportTool = {
   name: "environment.export",
-  description: "Serialize an environment to a portable JSON string. Encrypted variables drop their value (only `secretKeyId` survives) so the export can be safely pasted elsewhere \u2014 re-attach secrets locally on the receiving side.",
+  description: "Serialize an environment to a portable JSON string (envelope v2). Encrypted variables now carry their ciphertext, slot label, and per-slot salt \u2014 the destination decrypts with its local slot value at request-execute time, matching the Git push/pull contract. The plaintext slot value never leaves the device, but the ciphertext does. v1 envelopes (no ciphertext) still parse on import for back-compat.",
   inputSchema: import_zod5.z.object({ name: import_zod5.z.string() }),
   async handler(input, ctx) {
     const state = await ctx.workspace.read();
     const env = state.synced.environments.items[input.name];
     if (!env) return { ok: false, error: "environment not found" };
     const payload = {
-      apicircleEnvironment: 1,
+      apicircleEnvironment: 2,
       name: env.name,
-      variables: env.variables.map(
-        (v) => v.encrypted && v.secretKeyId ? { key: v.key, encrypted: true, secretKeyId: v.secretKeyId } : { key: v.key, value: v.value, encrypted: false }
-      )
+      variables: env.variables.map((v) => {
+        if (v.encrypted && v.secretKeyId) {
+          const slot = state.synced.secretKeys?.[v.secretKeyId];
+          const label = slot?.label ?? v.key;
+          const value = typeof v.value === "string" && v.value.startsWith("enc:") ? v.value : "";
+          return {
+            key: v.key,
+            encrypted: true,
+            value,
+            secretKeyId: v.secretKeyId,
+            secret: { label, salt: slot?.salt ?? null }
+          };
+        }
+        return { key: v.key, value: v.value, encrypted: false };
+      })
     };
     return { ok: true, json: JSON.stringify(payload, null, 2) };
   }
 };
 var environmentImportTool = {
   name: "environment.import",
-  description: "Import an environment from the JSON shape produced by `environment.export`. When a target with the same name exists, pass `overwrite: true` to replace it, otherwise the import is rejected.",
+  description: "Import an environment from the JSON shape produced by `environment.export`. v2 envelopes carry the row ciphertext + per-slot salt, so the destination decrypts at request-execute time with its local slot value (same model as Git push/pull); when no destination slot matches the source's salt, a new slot is minted via `secretKey.upsert` and surfaced in `mintedSlots` so the caller can provide values via `secret.addLocal`. v1 envelopes carry only metadata, so unmatched rows come back as `pendingBindings` for the caller to prompt-and-bind via `secret.addLocal` + `environment.bindSecret`. Pass `overwrite: true` to replace a same-name destination env.",
   inputSchema: import_zod5.z.object({
     json: import_zod5.z.string().min(1),
     overwrite: import_zod5.z.boolean().default(false)
   }),
   async handler(input, ctx) {
-    let parsed;
+    let raw;
     try {
-      parsed = JSON.parse(input.json);
+      raw = JSON.parse(input.json);
     } catch {
       return { ok: false, error: "invalid JSON" };
     }
-    const obj = parsed;
-    if (obj.apicircleEnvironment !== 1 || typeof obj.name !== "string" || !Array.isArray(obj.variables)) {
-      return { ok: false, error: "unsupported export shape" };
+    let parsed;
+    try {
+      parsed = (0, import_core2.parseApicircleEnvironmentDoc)(raw);
+    } catch (err) {
+      return {
+        ok: false,
+        error: err instanceof Error ? err.message : "unsupported export shape"
+      };
     }
     const state = await ctx.workspace.read();
-    if (state.synced.environments.items[obj.name] && !input.overwrite) {
+    if (state.synced.environments.items[parsed.name] && !input.overwrite) {
       return {
         ok: false,
         error: "environment already exists; pass overwrite:true"
       };
     }
-    const env = {
-      name: obj.name,
-      variables: obj.variables.map(
-        (v) => v.encrypted ? { key: v.key, value: "", encrypted: true, secretKeyId: v.secretKeyId } : { key: v.key, value: v.value, encrypted: false }
-      )
-    };
+    const destSlots = state.synced.secretKeys ?? {};
+    const labelToSlotId = /* @__PURE__ */ new Map();
+    for (const slot of Object.values(destSlots)) {
+      if (!labelToSlotId.has(slot.label)) labelToSlotId.set(slot.label, slot.id);
+    }
+    const resolvedVariables = [];
+    const pendingBindings = [];
+    const mintedSlots = [];
+    const knownDestIds = new Set(Object.keys(destSlots));
+    let hintCursor = 0;
+    for (const v of parsed.variables) {
+      if (!v.encrypted) {
+        resolvedVariables.push(v);
+        continue;
+      }
+      const hint = parsed.encryptedBindingHints[hintCursor];
+      hintCursor += 1;
+      if (hint && hint.ciphertext && hint.salt) {
+        if (hint.originSecretKeyId && destSlots[hint.originSecretKeyId]?.salt === hint.salt) {
+          resolvedVariables.push({ ...v, secretKeyId: hint.originSecretKeyId });
+          continue;
+        }
+        const labelMatch = labelToSlotId.get(hint.label);
+        if (labelMatch && destSlots[labelMatch]?.salt === hint.salt) {
+          resolvedVariables.push({ ...v, secretKeyId: labelMatch });
+          continue;
+        }
+        const mintedId = hint.originSecretKeyId && !knownDestIds.has(hint.originSecretKeyId) ? hint.originSecretKeyId : (0, import_shared2.generateId)();
+        knownDestIds.add(mintedId);
+        if (!labelToSlotId.has(hint.label)) labelToSlotId.set(hint.label, mintedId);
+        mintedSlots.push({
+          id: mintedId,
+          label: hint.label,
+          salt: hint.salt,
+          createdAt: (/* @__PURE__ */ new Date()).toISOString()
+        });
+        resolvedVariables.push({ ...v, secretKeyId: mintedId });
+        continue;
+      }
+      if (hint?.originSecretKeyId && destSlots[hint.originSecretKeyId]) {
+        resolvedVariables.push({ ...v, secretKeyId: hint.originSecretKeyId });
+        continue;
+      }
+      if (hint?.label) {
+        const matchId = labelToSlotId.get(hint.label);
+        if (matchId) {
+          resolvedVariables.push({ ...v, secretKeyId: matchId });
+          continue;
+        }
+      }
+      resolvedVariables.push(v);
+      if (hint) {
+        pendingBindings.push({
+          varKey: hint.varKey,
+          label: hint.label,
+          labelFromFallback: hint.labelFromFallback
+        });
+      }
+    }
+    for (const meta of mintedSlots) {
+      await ctx.workspace.apply({ kind: "secretKey.upsert", meta });
+    }
+    const env = { name: parsed.name, variables: resolvedVariables };
     const out = await ctx.workspace.apply({ kind: "environment.upsert", environment: env });
-    return { ok: true, name: env.name, changedIds: out.changedIds };
+    return {
+      ok: true,
+      name: env.name,
+      changedIds: out.changedIds,
+      pendingBindings,
+      mintedSlots: mintedSlots.map((s) => ({ id: s.id, label: s.label })),
+      warnings: parsed.warnings
+    };
   }
 };
 var PLAN_STEP = import_zod5.z.object({
@@ -1188,17 +1294,100 @@ var workspaceWriteTool = {
   }
 };
 
-// src/tools/history.ts
+// src/tools/folderExchange.ts
 var import_zod6 = require("zod");
+var import_core3 = require("@apicircle/core");
+var folderExportJsonTool = {
+  name: "folder.export_json",
+  description: "Export an existing folder (and its subtree) to the API Circle exchange JSON format. Embeds JSON Schema + GraphQL dependencies inline. Auth credentials are redacted by default \u2014 pass `includeCredentialIds` to keep specific fields verbatim (the report from `collectFolderExport` enumerates the available ids).",
+  inputSchema: import_zod6.z.object({
+    folderId: import_zod6.z.string().min(1, "folderId is required"),
+    /**
+     * Subset of credential ids to KEEP in the output. Anything not in
+     * this list (and every detected credential when this is empty)
+     * gets blanked. Use the report-side ids surfaced by the export
+     * report (`<scope>:<ownerId>.<authType>.<field>`).
+     */
+    includeCredentialIds: import_zod6.z.array(import_zod6.z.string()).optional()
+  }),
+  async handler(input, ctx) {
+    const state = await ctx.workspace.read();
+    const collected = (0, import_core3.collectFolderExport)({
+      synced: state.synced,
+      folderId: input.folderId
+    });
+    if (!collected) {
+      return {
+        error: "folder_not_found",
+        message: `No folder with id "${input.folderId}" exists in the active workspace.`
+      };
+    }
+    const includeIds = new Set(input.includeCredentialIds ?? []);
+    const redacted = (0, import_core3.redactFolderExportCredentials)(collected.envelope, includeIds);
+    return {
+      envelope: redacted,
+      json: (0, import_core3.serializeFolderExport)(redacted),
+      filename: (0, import_core3.suggestFolderExportFilename)(redacted),
+      report: collected.report
+    };
+  }
+};
+var folderImportJsonTool = {
+  name: "folder.import_json",
+  description: "Import an `apicircle.folder/v1` envelope into the active workspace. Folder + request ids are reminted, dependency references are remapped, and JSON Schema / GraphQL definitions that match an existing global asset (by name + content) are reused.",
+  inputSchema: import_zod6.z.object({
+    /** Either a JSON string or the already-parsed envelope object. */
+    json: import_zod6.z.string().min(1).optional(),
+    envelope: import_zod6.z.record(import_zod6.z.unknown()).optional(),
+    parentFolderId: import_zod6.z.string().nullable().optional()
+  }),
+  async handler(input, ctx) {
+    if (!input.json && !input.envelope) {
+      return {
+        error: "invalid_input",
+        message: "Pass either `json` (string) or `envelope` (object)."
+      };
+    }
+    const text = input.json !== void 0 ? input.json : JSON.stringify(input.envelope);
+    let parsed;
+    try {
+      parsed = (0, import_core3.parseApicircleFolderExport)(text);
+    } catch (err) {
+      return {
+        error: "invalid_envelope",
+        message: err instanceof Error ? err.message : String(err)
+      };
+    }
+    const out = await ctx.workspace.apply({
+      kind: "folder.import_apicircle",
+      parsed,
+      parentFolderId: input.parentFolderId ?? null
+    });
+    return {
+      rootFolderId: parsed.rootFolder.id,
+      rootFolderName: parsed.rootFolder.name,
+      counts: {
+        folders: parsed.subfolders.length + 1,
+        requests: parsed.requests.length
+      },
+      filesRequiringReattachment: parsed.dependencies.files.map((f) => f.id),
+      warnings: parsed.warnings,
+      changedIds: out.changedIds
+    };
+  }
+};
+
+// src/tools/history.ts
+var import_zod7 = require("zod");
 var historyListRunsTool = {
   name: "history.list_runs",
   description: "List request-run history rows in reverse-chronological order. Filter by `requestId`, `ok` (success/failure), or `since`/`until` ISO timestamps. `limit` caps the result set; default 100.",
-  inputSchema: import_zod6.z.object({
-    requestId: import_zod6.z.string().optional(),
-    ok: import_zod6.z.boolean().optional(),
-    since: import_zod6.z.string().optional(),
-    until: import_zod6.z.string().optional(),
-    limit: import_zod6.z.number().int().positive().max(500).default(100)
+  inputSchema: import_zod7.z.object({
+    requestId: import_zod7.z.string().optional(),
+    ok: import_zod7.z.boolean().optional(),
+    since: import_zod7.z.string().optional(),
+    until: import_zod7.z.string().optional(),
+    limit: import_zod7.z.number().int().positive().max(500).default(100)
   }),
   async handler(input, ctx) {
     const state = await ctx.workspace.read();
@@ -1232,7 +1421,7 @@ var historyListRunsTool = {
 var historyGetRunTool = {
   name: "history.get_run",
   description: "Fetch a single history row in full (headers, body preview, assertion results).",
-  inputSchema: import_zod6.z.object({ id: import_zod6.z.string() }),
+  inputSchema: import_zod7.z.object({ id: import_zod7.z.string() }),
   async handler(input, ctx) {
     const state = await ctx.workspace.read();
     const run = state.local.history.requestRuns.find((r) => r.id === input.id);
@@ -1243,7 +1432,7 @@ var historyGetRunTool = {
 var historyDeleteRunTool = {
   name: "history.delete_run",
   description: "Delete a single request-run row by id.",
-  inputSchema: import_zod6.z.object({ id: import_zod6.z.string() }),
+  inputSchema: import_zod7.z.object({ id: import_zod7.z.string() }),
   async handler(input, ctx) {
     const out = await ctx.workspace.apply({ kind: "history.delete_run", runId: input.id });
     return { deleted: out.changedIds.length, changedIds: out.changedIds };
@@ -1252,8 +1441,8 @@ var historyDeleteRunTool = {
 var historyPurgeTool = {
   name: "history.purge_by_age",
   description: "Drop every request-run + plan-run older than `olderThanDays` days. Pass 0 to clear all history.",
-  inputSchema: import_zod6.z.object({
-    olderThanDays: import_zod6.z.number().nonnegative()
+  inputSchema: import_zod7.z.object({
+    olderThanDays: import_zod7.z.number().nonnegative()
   }),
   async handler(input, ctx) {
     const olderThanMs = input.olderThanDays * 24 * 60 * 60 * 1e3;
@@ -1263,15 +1452,15 @@ var historyPurgeTool = {
 };
 
 // src/tools/codebase.ts
-var import_zod7 = require("zod");
+var import_zod8 = require("zod");
 var HTTP_METHODS = ["get", "post", "put", "patch", "delete", "options", "head"];
 var codebaseExtractCollectionTool = {
   name: "codebase.extract_collection",
   description: "Scan source code for HTTP route definitions (Express, FastAPI, NestJS, Spring) and return candidate requests for the user to confirm before import.",
-  inputSchema: import_zod7.z.object({
-    source: import_zod7.z.string().min(1),
+  inputSchema: import_zod8.z.object({
+    source: import_zod8.z.string().min(1),
     /** Hint to limit which framework patterns to apply. Empty = try all. */
-    frameworks: import_zod7.z.array(import_zod7.z.enum(["express", "fastapi", "nest", "spring"])).default([])
+    frameworks: import_zod8.z.array(import_zod8.z.enum(["express", "fastapi", "nest", "spring"])).default([])
   }),
   async handler(input) {
     const enabled = new Set(
@@ -1352,18 +1541,18 @@ var codebaseExtractCollectionTool = {
 };
 
 // src/tools/prompt.ts
-var import_zod8 = require("zod");
+var import_zod9 = require("zod");
 var import_shared3 = require("@apicircle/shared");
 var promptCreateEnvironmentTool = {
   name: "prompt.create_environment",
   description: "Create a new environment from an LLM-shaped JSON envelope. The model produces { name, variables: [{ key, value, encrypted }] }; this tool validates and persists it.",
-  inputSchema: import_zod8.z.object({
-    name: import_zod8.z.string(),
-    variables: import_zod8.z.array(
-      import_zod8.z.object({
-        key: import_zod8.z.string(),
-        value: import_zod8.z.string(),
-        encrypted: import_zod8.z.boolean().default(false)
+  inputSchema: import_zod9.z.object({
+    name: import_zod9.z.string(),
+    variables: import_zod9.z.array(
+      import_zod9.z.object({
+        key: import_zod9.z.string(),
+        value: import_zod9.z.string(),
+        encrypted: import_zod9.z.boolean().default(false)
       })
     )
   }),
@@ -1376,13 +1565,13 @@ var promptCreateEnvironmentTool = {
 var promptCreateAssertionTool = {
   name: "prompt.create_assertion",
   description: 'Add an assertion to a request from an LLM-shaped JSON envelope. Useful when the user asks "assert that the response status is 200 and body.id matches".',
-  inputSchema: import_zod8.z.object({
-    requestId: import_zod8.z.string(),
-    assertion: import_zod8.z.object({
-      kind: import_zod8.z.enum(["status", "header", "json-path", "duration"]),
-      op: import_zod8.z.enum(["equals", "not-equals", "contains", "lt", "gt", "matches"]),
-      target: import_zod8.z.string().optional(),
-      expected: import_zod8.z.union([import_zod8.z.string(), import_zod8.z.number()])
+  inputSchema: import_zod9.z.object({
+    requestId: import_zod9.z.string(),
+    assertion: import_zod9.z.object({
+      kind: import_zod9.z.enum(["status", "header", "json-path", "duration"]),
+      op: import_zod9.z.enum(["equals", "not-equals", "contains", "lt", "gt", "matches"]),
+      target: import_zod9.z.string().optional(),
+      expected: import_zod9.z.union([import_zod9.z.string(), import_zod9.z.number()])
     })
   }),
   async handler(input, ctx) {
@@ -1401,10 +1590,10 @@ var promptCreateAssertionTool = {
 var promptCreatePlanTool = {
   name: "prompt.create_plan",
   description: "Create an execution plan from an LLM-shaped JSON envelope. The model produces { name, stepRequestIds: [...] } and the tool validates that each id exists in the workspace before persisting.",
-  inputSchema: import_zod8.z.object({
-    name: import_zod8.z.string(),
-    stepRequestIds: import_zod8.z.array(import_zod8.z.string()).default([]),
-    envPriorityOrder: import_zod8.z.array(import_zod8.z.string()).default([])
+  inputSchema: import_zod9.z.object({
+    name: import_zod9.z.string(),
+    stepRequestIds: import_zod9.z.array(import_zod9.z.string()).default([]),
+    envPriorityOrder: import_zod9.z.array(import_zod9.z.string()).default([])
   }),
   async handler(input, ctx) {
     const state = await ctx.workspace.read();
@@ -1433,51 +1622,51 @@ var promptCreatePlanTool = {
     return { ok: true, id, changedIds: out.changedIds };
   }
 };
-var HTTP_METHOD2 = import_zod8.z.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]);
-var HEADER_OR_QUERY = import_zod8.z.object({
-  key: import_zod8.z.string(),
-  value: import_zod8.z.string(),
-  enabled: import_zod8.z.boolean().default(true)
+var HTTP_METHOD2 = import_zod9.z.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]);
+var HEADER_OR_QUERY = import_zod9.z.object({
+  key: import_zod9.z.string(),
+  value: import_zod9.z.string(),
+  enabled: import_zod9.z.boolean().default(true)
 });
-var REQUEST_BODY = import_zod8.z.object({
-  type: import_zod8.z.enum(["none", "json", "text", "xml", "graphql", "urlencoded"]).default("none"),
-  content: import_zod8.z.string().default(""),
-  variables: import_zod8.z.string().optional()
+var REQUEST_BODY = import_zod9.z.object({
+  type: import_zod9.z.enum(["none", "json", "text", "xml", "graphql", "urlencoded"]).default("none"),
+  content: import_zod9.z.string().default(""),
+  variables: import_zod9.z.string().optional()
 });
-var PROMPT_AUTH = import_zod8.z.discriminatedUnion("type", [
-  import_zod8.z.object({ type: import_zod8.z.literal("none") }),
-  import_zod8.z.object({ type: import_zod8.z.literal("inherit") }),
-  import_zod8.z.object({ type: import_zod8.z.literal("bearer"), token: import_zod8.z.string().default("") }),
-  import_zod8.z.object({
-    type: import_zod8.z.literal("basic"),
-    username: import_zod8.z.string().default(""),
-    password: import_zod8.z.string().default("")
+var PROMPT_AUTH = import_zod9.z.discriminatedUnion("type", [
+  import_zod9.z.object({ type: import_zod9.z.literal("none") }),
+  import_zod9.z.object({ type: import_zod9.z.literal("inherit") }),
+  import_zod9.z.object({ type: import_zod9.z.literal("bearer"), token: import_zod9.z.string().default("") }),
+  import_zod9.z.object({
+    type: import_zod9.z.literal("basic"),
+    username: import_zod9.z.string().default(""),
+    password: import_zod9.z.string().default("")
   }),
-  import_zod8.z.object({
-    type: import_zod8.z.literal("api-key"),
-    key: import_zod8.z.string().default(""),
-    value: import_zod8.z.string().default(""),
-    addTo: import_zod8.z.enum(["header", "query", "cookie"]).default("header")
+  import_zod9.z.object({
+    type: import_zod9.z.literal("api-key"),
+    key: import_zod9.z.string().default(""),
+    value: import_zod9.z.string().default(""),
+    addTo: import_zod9.z.enum(["header", "query", "cookie"]).default("header")
   }),
-  import_zod8.z.object({
-    type: import_zod8.z.literal("custom-header"),
-    key: import_zod8.z.string().default(""),
-    value: import_zod8.z.string().default("")
+  import_zod9.z.object({
+    type: import_zod9.z.literal("custom-header"),
+    key: import_zod9.z.string().default(""),
+    value: import_zod9.z.string().default("")
   })
 ]);
-var PROMPT_ASSERTION = import_zod8.z.object({
-  kind: import_zod8.z.enum(["status", "header", "json-path", "duration"]),
-  op: import_zod8.z.enum(["equals", "not-equals", "contains", "lt", "gt", "matches"]),
-  target: import_zod8.z.string().optional(),
-  expected: import_zod8.z.union([import_zod8.z.string(), import_zod8.z.number()])
+var PROMPT_ASSERTION = import_zod9.z.object({
+  kind: import_zod9.z.enum(["status", "header", "json-path", "duration"]),
+  op: import_zod9.z.enum(["equals", "not-equals", "contains", "lt", "gt", "matches"]),
+  target: import_zod9.z.string().optional(),
+  expected: import_zod9.z.union([import_zod9.z.string(), import_zod9.z.number()])
 });
-var ENDPOINT_RESPONSE = import_zod8.z.object({
-  status: import_zod8.z.number().int().min(100).max(599).default(200),
-  jsonBody: import_zod8.z.string().default("{}"),
-  contentType: import_zod8.z.string().default("application/json")
+var ENDPOINT_RESPONSE = import_zod9.z.object({
+  status: import_zod9.z.number().int().min(100).max(599).default(200),
+  jsonBody: import_zod9.z.string().default("{}"),
+  contentType: import_zod9.z.string().default("application/json")
 });
-var VALIDATION_RULE_NL = import_zod8.z.object({
-  kind: import_zod8.z.enum([
+var VALIDATION_RULE_NL = import_zod9.z.object({
+  kind: import_zod9.z.enum([
     "header-required",
     "header-equals",
     "header-matches",
@@ -1488,50 +1677,50 @@ var VALIDATION_RULE_NL = import_zod8.z.object({
     "body-required",
     "content-type-equals"
   ]),
-  target: import_zod8.z.string().default(""),
-  expected: import_zod8.z.string().optional(),
-  message: import_zod8.z.string().optional(),
-  enabled: import_zod8.z.boolean().default(true),
-  failResponse: import_zod8.z.object({
-    status: import_zod8.z.number().int().min(100).max(599).default(400),
-    jsonBody: import_zod8.z.string().default('{"error":"validation failed"}')
+  target: import_zod9.z.string().default(""),
+  expected: import_zod9.z.string().optional(),
+  message: import_zod9.z.string().optional(),
+  enabled: import_zod9.z.boolean().default(true),
+  failResponse: import_zod9.z.object({
+    status: import_zod9.z.number().int().min(100).max(599).default(400),
+    jsonBody: import_zod9.z.string().default('{"error":"validation failed"}')
   }).default({})
 });
-var CONDITION_CLAUSE_NL = import_zod8.z.object({
-  scope: import_zod8.z.enum(["query", "pathParam", "header", "cookie", "body-json-path"]),
-  target: import_zod8.z.string(),
-  op: import_zod8.z.enum(["equals", "not-equals", "matches", "gt", "lt", "gte", "lte", "present", "absent"]),
-  value: import_zod8.z.string().optional()
+var CONDITION_CLAUSE_NL = import_zod9.z.object({
+  scope: import_zod9.z.enum(["query", "pathParam", "header", "cookie", "body-json-path"]),
+  target: import_zod9.z.string(),
+  op: import_zod9.z.enum(["equals", "not-equals", "matches", "gt", "lt", "gte", "lte", "present", "absent"]),
+  value: import_zod9.z.string().optional()
 });
-var RESPONSE_RULE_NL = import_zod8.z.object({
-  name: import_zod8.z.string(),
-  enabled: import_zod8.z.boolean().default(true),
-  when: import_zod8.z.array(CONDITION_CLAUSE_NL).default([]),
-  response: import_zod8.z.object({
-    status: import_zod8.z.number().int().min(100).max(599).default(200),
-    jsonBody: import_zod8.z.string().default("{}")
+var RESPONSE_RULE_NL = import_zod9.z.object({
+  name: import_zod9.z.string(),
+  enabled: import_zod9.z.boolean().default(true),
+  when: import_zod9.z.array(CONDITION_CLAUSE_NL).default([]),
+  response: import_zod9.z.object({
+    status: import_zod9.z.number().int().min(100).max(599).default(200),
+    jsonBody: import_zod9.z.string().default("{}")
   }).default({})
 });
-var MULTIPLIER_NL = import_zod8.z.object({
-  name: import_zod8.z.string().optional(),
-  source: import_zod8.z.object({
-    kind: import_zod8.z.enum(["query", "pathParam", "header", "body-json-path"]),
-    key: import_zod8.z.string()
+var MULTIPLIER_NL = import_zod9.z.object({
+  name: import_zod9.z.string().optional(),
+  source: import_zod9.z.object({
+    kind: import_zod9.z.enum(["query", "pathParam", "header", "body-json-path"]),
+    key: import_zod9.z.string()
   }),
-  targetJsonPath: import_zod8.z.string(),
-  defaultCount: import_zod8.z.number().int().nonnegative().default(0),
-  min: import_zod8.z.number().int().nonnegative().optional(),
-  max: import_zod8.z.number().int().nonnegative().optional()
+  targetJsonPath: import_zod9.z.string(),
+  defaultCount: import_zod9.z.number().int().nonnegative().default(0),
+  min: import_zod9.z.number().int().nonnegative().optional(),
+  max: import_zod9.z.number().int().nonnegative().optional()
 });
-var ENDPOINT_INPUT = import_zod8.z.object({
+var ENDPOINT_INPUT = import_zod9.z.object({
   method: HTTP_METHOD2,
-  pathPattern: import_zod8.z.string().min(1),
-  name: import_zod8.z.string().optional(),
-  description: import_zod8.z.string().optional(),
+  pathPattern: import_zod9.z.string().min(1),
+  name: import_zod9.z.string().optional(),
+  description: import_zod9.z.string().optional(),
   response: ENDPOINT_RESPONSE.optional(),
-  validationRules: import_zod8.z.array(VALIDATION_RULE_NL).default([]),
-  responseRules: import_zod8.z.array(RESPONSE_RULE_NL).default([]),
-  multipliers: import_zod8.z.array(MULTIPLIER_NL).default([])
+  validationRules: import_zod9.z.array(VALIDATION_RULE_NL).default([]),
+  responseRules: import_zod9.z.array(RESPONSE_RULE_NL).default([]),
+  multipliers: import_zod9.z.array(MULTIPLIER_NL).default([])
 });
 function buildRequestBody(input) {
   if (!input) return { type: "none", content: "" };
@@ -1624,17 +1813,17 @@ function patchEndpoint(mock, endpointId, patcher) {
 var promptCreateRequestTool = {
   name: "prompt.create_request",
   description: "Create a fully-shaped request from an LLM-shaped JSON envelope: method, url, headers, query params, body, auth, and inline assertions. The model produces a flat object; this tool generates the request id, normalizes auth (defaults to `inherit` so folder auth wins), and persists.",
-  inputSchema: import_zod8.z.object({
-    name: import_zod8.z.string().default("New request"),
+  inputSchema: import_zod9.z.object({
+    name: import_zod9.z.string().default("New request"),
     method: HTTP_METHOD2.default("GET"),
-    url: import_zod8.z.string().default(""),
-    folderId: import_zod8.z.string().nullable().optional(),
-    headers: import_zod8.z.array(HEADER_OR_QUERY).default([]),
-    queryParams: import_zod8.z.array(HEADER_OR_QUERY).default([]),
-    pathParams: import_zod8.z.record(import_zod8.z.string(), import_zod8.z.string()).optional(),
+    url: import_zod9.z.string().default(""),
+    folderId: import_zod9.z.string().nullable().optional(),
+    headers: import_zod9.z.array(HEADER_OR_QUERY).default([]),
+    queryParams: import_zod9.z.array(HEADER_OR_QUERY).default([]),
+    pathParams: import_zod9.z.record(import_zod9.z.string(), import_zod9.z.string()).optional(),
     body: REQUEST_BODY.optional(),
     auth: PROMPT_AUTH.optional(),
-    assertions: import_zod8.z.array(PROMPT_ASSERTION).default([])
+    assertions: import_zod9.z.array(PROMPT_ASSERTION).default([])
   }),
   async handler(input, ctx) {
     const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -1664,19 +1853,19 @@ var promptCreateRequestTool = {
 var promptUpdateRequestTool = {
   name: "prompt.update_request",
   description: "Patch an existing request from an LLM-shaped JSON envelope. Provided fields replace the existing values; omitted fields are left untouched. Arrays (headers, queryParams, assertions) are full replacements when supplied. Returns `{ ok: false, error }` when the id does not resolve.",
-  inputSchema: import_zod8.z.object({
-    id: import_zod8.z.string(),
-    patch: import_zod8.z.object({
-      name: import_zod8.z.string().optional(),
+  inputSchema: import_zod9.z.object({
+    id: import_zod9.z.string(),
+    patch: import_zod9.z.object({
+      name: import_zod9.z.string().optional(),
       method: HTTP_METHOD2.optional(),
-      url: import_zod8.z.string().optional(),
-      folderId: import_zod8.z.string().nullable().optional(),
-      headers: import_zod8.z.array(HEADER_OR_QUERY).optional(),
-      queryParams: import_zod8.z.array(HEADER_OR_QUERY).optional(),
-      pathParams: import_zod8.z.record(import_zod8.z.string(), import_zod8.z.string()).optional(),
+      url: import_zod9.z.string().optional(),
+      folderId: import_zod9.z.string().nullable().optional(),
+      headers: import_zod9.z.array(HEADER_OR_QUERY).optional(),
+      queryParams: import_zod9.z.array(HEADER_OR_QUERY).optional(),
+      pathParams: import_zod9.z.record(import_zod9.z.string(), import_zod9.z.string()).optional(),
       body: REQUEST_BODY.optional(),
       auth: PROMPT_AUTH.optional(),
-      assertions: import_zod8.z.array(PROMPT_ASSERTION).optional()
+      assertions: import_zod9.z.array(PROMPT_ASSERTION).optional()
     }).strict()
   }),
   async handler(input, ctx) {
@@ -1704,17 +1893,17 @@ var promptUpdateRequestTool = {
     return { ok: true, changedIds: out.changedIds };
   }
 };
-var FOLDER_TREE_NODE = import_zod8.z.lazy(
-  () => import_zod8.z.object({
-    name: import_zod8.z.string(),
-    children: import_zod8.z.array(FOLDER_TREE_NODE).optional()
+var FOLDER_TREE_NODE = import_zod9.z.lazy(
+  () => import_zod9.z.object({
+    name: import_zod9.z.string(),
+    children: import_zod9.z.array(FOLDER_TREE_NODE).optional()
   })
 );
 var promptCreateFolderTreeTool = {
   name: "prompt.create_folder_tree",
   description: "Create a recursive folder hierarchy from an LLM-shaped JSON envelope. The model produces `{ parentId?, tree: { name, children?: [...] } }` and this tool walks the tree, generating ids and persisting one folder per node. Returns the list of created ids in pre-order.",
-  inputSchema: import_zod8.z.object({
-    parentId: import_zod8.z.string().nullable().optional(),
+  inputSchema: import_zod9.z.object({
+    parentId: import_zod9.z.string().nullable().optional(),
     tree: FOLDER_TREE_NODE
   }),
   async handler(input, ctx) {
@@ -1740,9 +1929,9 @@ var promptCreateFolderTreeTool = {
 var promptAddPlanStepsTool = {
   name: "prompt.add_plan_steps",
   description: "Append one or more steps to an existing execution plan from an LLM-shaped JSON envelope. The model produces `{ planId, requestIds: [...] }`; each id is validated against the workspace before any step is appended. Order in the input list is preserved.",
-  inputSchema: import_zod8.z.object({
-    planId: import_zod8.z.string(),
-    requestIds: import_zod8.z.array(import_zod8.z.string()).min(1)
+  inputSchema: import_zod9.z.object({
+    planId: import_zod9.z.string(),
+    requestIds: import_zod9.z.array(import_zod9.z.string()).min(1)
   }),
   async handler(input, ctx) {
     const state = await ctx.workspace.read();
@@ -1772,9 +1961,9 @@ var promptAddPlanStepsTool = {
 var promptSetPlanVariablesTool = {
   name: "prompt.set_plan_variables",
   description: "Replace the plan-scoped variables on an execution plan from an LLM-shaped JSON envelope. The model produces `{ planId, variables: [{ key, value }] }`. Empty array clears all plan variables.",
-  inputSchema: import_zod8.z.object({
-    planId: import_zod8.z.string(),
-    variables: import_zod8.z.array(import_zod8.z.object({ key: import_zod8.z.string(), value: import_zod8.z.string() }))
+  inputSchema: import_zod9.z.object({
+    planId: import_zod9.z.string(),
+    variables: import_zod9.z.array(import_zod9.z.object({ key: import_zod9.z.string(), value: import_zod9.z.string() }))
   }),
   async handler(input, ctx) {
     const state = await ctx.workspace.read();
@@ -1790,10 +1979,10 @@ var promptSetPlanVariablesTool = {
 var promptCreateMockServerTool = {
   name: "prompt.create_mock_server",
   description: "Create a manual-mode mock server with optional inline endpoints from an LLM-shaped JSON envelope. The model produces `{ name, defaultPort?, endpoints: [{ method, pathPattern, name?, response?, validationRules?, responseRules?, multipliers? }] }`; this tool generates ids for the server and every endpoint / rule, then persists in one shot.",
-  inputSchema: import_zod8.z.object({
-    name: import_zod8.z.string().min(1),
-    defaultPort: import_zod8.z.number().int().positive().nullable().optional(),
-    endpoints: import_zod8.z.array(ENDPOINT_INPUT).default([])
+  inputSchema: import_zod9.z.object({
+    name: import_zod9.z.string().min(1),
+    defaultPort: import_zod9.z.number().int().positive().nullable().optional(),
+    endpoints: import_zod9.z.array(ENDPOINT_INPUT).default([])
   }),
   async handler(input, ctx) {
     const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -1820,16 +2009,16 @@ var promptCreateMockServerTool = {
 var promptAddMockEndpointTool = {
   name: "prompt.add_mock_endpoint",
   description: "Append a new endpoint (with optional inline validation rules, response rules, and multipliers) to an existing mock server from an LLM-shaped JSON envelope. All ids are auto-generated; the existing endpoints stay in place.",
-  inputSchema: import_zod8.z.object({
-    mockId: import_zod8.z.string(),
+  inputSchema: import_zod9.z.object({
+    mockId: import_zod9.z.string(),
     method: HTTP_METHOD2,
-    pathPattern: import_zod8.z.string().min(1),
-    name: import_zod8.z.string().optional(),
-    description: import_zod8.z.string().optional(),
+    pathPattern: import_zod9.z.string().min(1),
+    name: import_zod9.z.string().optional(),
+    description: import_zod9.z.string().optional(),
     response: ENDPOINT_RESPONSE.optional(),
-    validationRules: import_zod8.z.array(VALIDATION_RULE_NL).default([]),
-    responseRules: import_zod8.z.array(RESPONSE_RULE_NL).default([]),
-    multipliers: import_zod8.z.array(MULTIPLIER_NL).default([])
+    validationRules: import_zod9.z.array(VALIDATION_RULE_NL).default([]),
+    responseRules: import_zod9.z.array(RESPONSE_RULE_NL).default([]),
+    multipliers: import_zod9.z.array(MULTIPLIER_NL).default([])
   }),
   async handler(input, ctx) {
     const state = await ctx.workspace.read();
@@ -1851,10 +2040,10 @@ var promptAddMockEndpointTool = {
 var promptSetEndpointValidationRulesTool = {
   name: "prompt.set_endpoint_validation_rules",
   description: "Replace an endpoint's validation rules with an LLM-shaped list. Every rule gets a fresh id; the existing rules are dropped. Empty array clears all validation rules.",
-  inputSchema: import_zod8.z.object({
-    mockId: import_zod8.z.string(),
-    endpointId: import_zod8.z.string(),
-    rules: import_zod8.z.array(VALIDATION_RULE_NL)
+  inputSchema: import_zod9.z.object({
+    mockId: import_zod9.z.string(),
+    endpointId: import_zod9.z.string(),
+    rules: import_zod9.z.array(VALIDATION_RULE_NL)
   }),
   async handler(input, ctx) {
     const state = await ctx.workspace.read();
@@ -1885,10 +2074,10 @@ var promptSetEndpointValidationRulesTool = {
 var promptSetEndpointResponseRulesTool = {
   name: "prompt.set_endpoint_response_rules",
   description: "Replace an endpoint's conditional response rules with an LLM-shaped list. Rules fire in order, first match wins. Every rule + clause gets a fresh id. Empty array falls back to defaultResponse.",
-  inputSchema: import_zod8.z.object({
-    mockId: import_zod8.z.string(),
-    endpointId: import_zod8.z.string(),
-    rules: import_zod8.z.array(RESPONSE_RULE_NL)
+  inputSchema: import_zod9.z.object({
+    mockId: import_zod9.z.string(),
+    endpointId: import_zod9.z.string(),
+    rules: import_zod9.z.array(RESPONSE_RULE_NL)
   }),
   async handler(input, ctx) {
     const state = await ctx.workspace.read();
@@ -1923,10 +2112,10 @@ var promptSetEndpointResponseRulesTool = {
 var promptSetEndpointMultipliersTool = {
   name: "prompt.set_endpoint_multipliers",
   description: "Replace the response multipliers on an endpoint's defaultResponse with an LLM-shaped list. Multipliers expand an array at `targetJsonPath` to a count derived from a request value. Every multiplier gets a fresh id. Empty array clears all multipliers.",
-  inputSchema: import_zod8.z.object({
-    mockId: import_zod8.z.string(),
-    endpointId: import_zod8.z.string(),
-    multipliers: import_zod8.z.array(MULTIPLIER_NL)
+  inputSchema: import_zod9.z.object({
+    mockId: import_zod9.z.string(),
+    endpointId: import_zod9.z.string(),
+    multipliers: import_zod9.z.array(MULTIPLIER_NL)
   }),
   async handler(input, ctx) {
     const state = await ctx.workspace.read();
@@ -1955,7 +2144,7 @@ var promptSetEndpointMultipliersTool = {
 };
 
 // src/tools/mocks.ts
-var import_zod9 = require("zod");
+var import_zod10 = require("zod");
 var import_shared4 = require("@apicircle/shared");
 var import_mock_server_core2 = require("@apicircle/mock-server-core");
 async function ingestSource(source, name) {
@@ -1978,10 +2167,10 @@ async function ingestSource(source, name) {
 var mockCreateFromOpenApiTool = {
   name: "mock.create_from_openapi",
   description: "Create a mock server from an OpenAPI / Swagger spec (YAML or JSON).",
-  inputSchema: import_zod9.z.object({
-    name: import_zod9.z.string(),
-    spec: import_zod9.z.string().min(1),
-    format: import_zod9.z.enum(["json", "yaml"]).default("json")
+  inputSchema: import_zod10.z.object({
+    name: import_zod10.z.string(),
+    spec: import_zod10.z.string().min(1),
+    format: import_zod10.z.enum(["json", "yaml"]).default("json")
   }),
   async handler(input, ctx) {
     const { mock, warnings } = await ingestSource(
@@ -2000,7 +2189,7 @@ var mockCreateFromOpenApiTool = {
 var mockCreateFromPostmanTool = {
   name: "mock.create_from_postman",
   description: "Create a mock server from a Postman v2/v2.1 collection.",
-  inputSchema: import_zod9.z.object({ name: import_zod9.z.string(), collection: import_zod9.z.string().min(1) }),
+  inputSchema: import_zod10.z.object({ name: import_zod10.z.string(), collection: import_zod10.z.string().min(1) }),
   async handler(input, ctx) {
     const { mock, warnings } = await ingestSource(
       { kind: "postman", collection: input.collection },
@@ -2018,7 +2207,7 @@ var mockCreateFromPostmanTool = {
 var mockCreateFromInsomniaTool = {
   name: "mock.create_from_insomnia",
   description: "Create a mock server from an Insomnia v4 export.",
-  inputSchema: import_zod9.z.object({ name: import_zod9.z.string(), export: import_zod9.z.string().min(1) }),
+  inputSchema: import_zod10.z.object({ name: import_zod10.z.string(), export: import_zod10.z.string().min(1) }),
   async handler(input, ctx) {
     const { mock, warnings } = await ingestSource(
       { kind: "insomnia", export: input.export },
@@ -2036,7 +2225,7 @@ var mockCreateFromInsomniaTool = {
 var mockImportPostmanMockCollectionTool = {
   name: "mock.import_postman_mock_collection",
   description: "Import a Postman Mock Collection (collections previously hosted on Postman's mock service). Same parser as a regular Postman collection but marked as a mock import.",
-  inputSchema: import_zod9.z.object({ name: import_zod9.z.string(), collection: import_zod9.z.string().min(1) }),
+  inputSchema: import_zod10.z.object({ name: import_zod10.z.string(), collection: import_zod10.z.string().min(1) }),
   async handler(input, ctx) {
     const { mock, warnings } = await ingestSource(
       { kind: "postman", collection: input.collection },
@@ -2054,7 +2243,7 @@ var mockImportPostmanMockCollectionTool = {
 var mockListTool = {
   name: "mock.list",
   description: "List all mock servers in the workspace plus their runtime status (running / stopped, port).",
-  inputSchema: import_zod9.z.object({}),
+  inputSchema: import_zod10.z.object({}),
   async handler(_input, ctx) {
     const state = await ctx.workspace.read();
     const running = await ctx.mock.list();
@@ -2076,9 +2265,9 @@ var mockListTool = {
 var mockStartTool = {
   name: "mock.start",
   description: "Start a mock server by id. Returns the bound port. Errors if the mock is already running or the requested port is in use.",
-  inputSchema: import_zod9.z.object({
-    id: import_zod9.z.string(),
-    port: import_zod9.z.number().int().positive().optional()
+  inputSchema: import_zod10.z.object({
+    id: import_zod10.z.string(),
+    port: import_zod10.z.number().int().positive().optional()
   }),
   async handler(input, ctx) {
     const state = await ctx.workspace.read();
@@ -2095,7 +2284,7 @@ var mockStartTool = {
 var mockStopTool = {
   name: "mock.stop",
   description: "Stop a running mock server by id (no-op if not running).",
-  inputSchema: import_zod9.z.object({ id: import_zod9.z.string() }),
+  inputSchema: import_zod10.z.object({ id: import_zod10.z.string() }),
   async handler(input, ctx) {
     try {
       await ctx.mock.stop(input.id);
@@ -2108,7 +2297,7 @@ var mockStopTool = {
 var mockDeleteTool = {
   name: "mock.delete",
   description: "Delete a mock server definition. Stops it first if it's running.",
-  inputSchema: import_zod9.z.object({ id: import_zod9.z.string() }),
+  inputSchema: import_zod10.z.object({ id: import_zod10.z.string() }),
   async handler(input, ctx) {
     try {
       await ctx.mock.stop(input.id);
@@ -2118,13 +2307,13 @@ var mockDeleteTool = {
     return { ok: true, changedIds: out.changedIds };
   }
 };
-var HTTP_METHOD3 = import_zod9.z.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]);
+var HTTP_METHOD3 = import_zod10.z.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]);
 var mockCreateManualTool = {
   name: "mock.create_manual",
   description: "Create an empty manual-mode mock server. Use `mock.add_endpoint` afterward to populate it. CORS defaults to off (same-origin only); enable + list explicit origins via `mock.update_cors` if cross-origin access is needed.",
-  inputSchema: import_zod9.z.object({
-    name: import_zod9.z.string().min(1),
-    defaultPort: import_zod9.z.number().int().positive().nullable().optional()
+  inputSchema: import_zod10.z.object({
+    name: import_zod10.z.string().min(1),
+    defaultPort: import_zod10.z.number().int().positive().nullable().optional()
   }),
   async handler(input, ctx) {
     const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -2147,7 +2336,7 @@ var mockCreateManualTool = {
 var mockListEndpointsTool = {
   name: "mock.list_endpoints",
   description: "List endpoints for a mock server (id, method, path, name).",
-  inputSchema: import_zod9.z.object({ mockId: import_zod9.z.string() }),
+  inputSchema: import_zod10.z.object({ mockId: import_zod10.z.string() }),
   async handler(input, ctx) {
     const state = await ctx.workspace.read();
     const mock = state.synced.mockServers[input.mockId];
@@ -2166,10 +2355,10 @@ var mockListEndpointsTool = {
     };
   }
 };
-var ENDPOINT_RESPONSE2 = import_zod9.z.object({
-  status: import_zod9.z.number().int().min(100).max(599).default(200),
-  jsonBody: import_zod9.z.string().default("{}"),
-  contentType: import_zod9.z.string().default("application/json")
+var ENDPOINT_RESPONSE2 = import_zod10.z.object({
+  status: import_zod10.z.number().int().min(100).max(599).default(200),
+  jsonBody: import_zod10.z.string().default("{}"),
+  contentType: import_zod10.z.string().default("application/json")
 });
 function buildDefaultEndpoint(args) {
   const response = args.response ?? {
@@ -2198,12 +2387,12 @@ function buildDefaultEndpoint(args) {
 var mockAddEndpointTool = {
   name: "mock.add_endpoint",
   description: "Append a new endpoint to a mock server. Defaults to a 200 JSON response of `{}`. Returns the new endpoint id.",
-  inputSchema: import_zod9.z.object({
-    mockId: import_zod9.z.string(),
+  inputSchema: import_zod10.z.object({
+    mockId: import_zod10.z.string(),
     method: HTTP_METHOD3,
-    pathPattern: import_zod9.z.string().min(1),
-    name: import_zod9.z.string().optional(),
-    description: import_zod9.z.string().optional(),
+    pathPattern: import_zod10.z.string().min(1),
+    name: import_zod10.z.string().optional(),
+    description: import_zod10.z.string().optional(),
     response: ENDPOINT_RESPONSE2.optional()
   }),
   async handler(input, ctx) {
@@ -2226,13 +2415,13 @@ var mockAddEndpointTool = {
 var mockUpdateEndpointTool = {
   name: "mock.update_endpoint",
   description: "Patch fields on a single mock endpoint (method, pathPattern, name, description, defaultResponse status / contentType / json body). Pass only the fields you want to change.",
-  inputSchema: import_zod9.z.object({
-    mockId: import_zod9.z.string(),
-    endpointId: import_zod9.z.string(),
+  inputSchema: import_zod10.z.object({
+    mockId: import_zod10.z.string(),
+    endpointId: import_zod10.z.string(),
     method: HTTP_METHOD3.optional(),
-    pathPattern: import_zod9.z.string().optional(),
-    name: import_zod9.z.string().optional(),
-    description: import_zod9.z.string().optional(),
+    pathPattern: import_zod10.z.string().optional(),
+    name: import_zod10.z.string().optional(),
+    description: import_zod10.z.string().optional(),
     response: ENDPOINT_RESPONSE2.partial().optional()
   }),
   async handler(input, ctx) {
@@ -2273,7 +2462,7 @@ var mockUpdateEndpointTool = {
 var mockDeleteEndpointTool = {
   name: "mock.delete_endpoint",
   description: "Remove an endpoint from a mock server.",
-  inputSchema: import_zod9.z.object({ mockId: import_zod9.z.string(), endpointId: import_zod9.z.string() }),
+  inputSchema: import_zod10.z.object({ mockId: import_zod10.z.string(), endpointId: import_zod10.z.string() }),
   async handler(input, ctx) {
     const state = await ctx.workspace.read();
     const mock = state.synced.mockServers[input.mockId];
@@ -2293,9 +2482,9 @@ var mockDeleteEndpointTool = {
     return { ok: true, changedIds: out.changedIds };
   }
 };
-var VALIDATION_RULE = import_zod9.z.object({
-  id: import_zod9.z.string().optional(),
-  kind: import_zod9.z.enum([
+var VALIDATION_RULE = import_zod10.z.object({
+  id: import_zod10.z.string().optional(),
+  kind: import_zod10.z.enum([
     "header-required",
     "header-equals",
     "header-matches",
@@ -2306,43 +2495,43 @@ var VALIDATION_RULE = import_zod9.z.object({
     "body-required",
     "content-type-equals"
   ]),
-  target: import_zod9.z.string().default(""),
-  expected: import_zod9.z.string().optional(),
-  message: import_zod9.z.string().optional(),
-  enabled: import_zod9.z.boolean().default(true),
-  failResponse: import_zod9.z.object({
-    status: import_zod9.z.number().int().min(100).max(599).default(400),
-    jsonBody: import_zod9.z.string().default('{"error":"validation failed"}')
+  target: import_zod10.z.string().default(""),
+  expected: import_zod10.z.string().optional(),
+  message: import_zod10.z.string().optional(),
+  enabled: import_zod10.z.boolean().default(true),
+  failResponse: import_zod10.z.object({
+    status: import_zod10.z.number().int().min(100).max(599).default(400),
+    jsonBody: import_zod10.z.string().default('{"error":"validation failed"}')
   }).default({})
 });
-var CONDITION_CLAUSE = import_zod9.z.object({
-  id: import_zod9.z.string().optional(),
-  scope: import_zod9.z.enum(["query", "pathParam", "header", "cookie", "body-json-path"]),
-  target: import_zod9.z.string(),
-  op: import_zod9.z.enum(["equals", "not-equals", "matches", "gt", "lt", "gte", "lte", "present", "absent"]),
-  value: import_zod9.z.string().optional()
+var CONDITION_CLAUSE = import_zod10.z.object({
+  id: import_zod10.z.string().optional(),
+  scope: import_zod10.z.enum(["query", "pathParam", "header", "cookie", "body-json-path"]),
+  target: import_zod10.z.string(),
+  op: import_zod10.z.enum(["equals", "not-equals", "matches", "gt", "lt", "gte", "lte", "present", "absent"]),
+  value: import_zod10.z.string().optional()
 });
-var RESPONSE_RULE = import_zod9.z.object({
-  id: import_zod9.z.string().optional(),
-  name: import_zod9.z.string(),
-  enabled: import_zod9.z.boolean().default(true),
-  when: import_zod9.z.array(CONDITION_CLAUSE).default([]),
-  response: import_zod9.z.object({
-    status: import_zod9.z.number().int().min(100).max(599).default(200),
-    jsonBody: import_zod9.z.string().default("{}")
+var RESPONSE_RULE = import_zod10.z.object({
+  id: import_zod10.z.string().optional(),
+  name: import_zod10.z.string(),
+  enabled: import_zod10.z.boolean().default(true),
+  when: import_zod10.z.array(CONDITION_CLAUSE).default([]),
+  response: import_zod10.z.object({
+    status: import_zod10.z.number().int().min(100).max(599).default(200),
+    jsonBody: import_zod10.z.string().default("{}")
   }).default({})
 });
-var MULTIPLIER = import_zod9.z.object({
-  id: import_zod9.z.string().optional(),
-  name: import_zod9.z.string().optional(),
-  source: import_zod9.z.object({
-    kind: import_zod9.z.enum(["query", "pathParam", "header", "body-json-path"]),
-    key: import_zod9.z.string()
+var MULTIPLIER = import_zod10.z.object({
+  id: import_zod10.z.string().optional(),
+  name: import_zod10.z.string().optional(),
+  source: import_zod10.z.object({
+    kind: import_zod10.z.enum(["query", "pathParam", "header", "body-json-path"]),
+    key: import_zod10.z.string()
   }),
-  targetJsonPath: import_zod9.z.string(),
-  defaultCount: import_zod9.z.number().int().nonnegative().default(0),
-  min: import_zod9.z.number().int().nonnegative().optional(),
-  max: import_zod9.z.number().int().nonnegative().optional()
+  targetJsonPath: import_zod10.z.string(),
+  defaultCount: import_zod10.z.number().int().nonnegative().default(0),
+  min: import_zod10.z.number().int().nonnegative().optional(),
+  max: import_zod10.z.number().int().nonnegative().optional()
 });
 function defaultJsonResponseConfig(args) {
   return {
@@ -2367,10 +2556,10 @@ function patchEndpoint2(mock, endpointId, patcher) {
 var mockSetValidationRulesTool = {
   name: "mock.set_validation_rules",
   description: "Replace an endpoint's validation rules. Rules without an `id` get a fresh one; existing rules can keep theirs to preserve client-side selection state. Empty array clears all rules.",
-  inputSchema: import_zod9.z.object({
-    mockId: import_zod9.z.string(),
-    endpointId: import_zod9.z.string(),
-    rules: import_zod9.z.array(VALIDATION_RULE)
+  inputSchema: import_zod10.z.object({
+    mockId: import_zod10.z.string(),
+    endpointId: import_zod10.z.string(),
+    rules: import_zod10.z.array(VALIDATION_RULE)
   }),
   async handler(input, ctx) {
     const state = await ctx.workspace.read();
@@ -2397,10 +2586,10 @@ var mockSetValidationRulesTool = {
 var mockSetResponseRulesTool = {
   name: "mock.set_response_rules",
   description: "Replace an endpoint's conditional response rules. Rules fire in order; the first whose every clause matches wins. Disabled rules are skipped. Empty array falls back to defaultResponse.",
-  inputSchema: import_zod9.z.object({
-    mockId: import_zod9.z.string(),
-    endpointId: import_zod9.z.string(),
-    rules: import_zod9.z.array(RESPONSE_RULE)
+  inputSchema: import_zod10.z.object({
+    mockId: import_zod10.z.string(),
+    endpointId: import_zod10.z.string(),
+    rules: import_zod10.z.array(RESPONSE_RULE)
   }),
   async handler(input, ctx) {
     const state = await ctx.workspace.read();
@@ -2431,10 +2620,10 @@ var mockSetResponseRulesTool = {
 var mockSetMultipliersTool = {
   name: "mock.set_multipliers",
   description: "Replace the response multipliers on an endpoint's defaultResponse. Multipliers expand an array at `targetJsonPath` to a count derived from a request value. Empty array clears all multipliers.",
-  inputSchema: import_zod9.z.object({
-    mockId: import_zod9.z.string(),
-    endpointId: import_zod9.z.string(),
-    multipliers: import_zod9.z.array(MULTIPLIER)
+  inputSchema: import_zod10.z.object({
+    mockId: import_zod10.z.string(),
+    endpointId: import_zod10.z.string(),
+    multipliers: import_zod10.z.array(MULTIPLIER)
   }),
   async handler(input, ctx) {
     const state = await ctx.workspace.read();
@@ -2481,6 +2670,8 @@ var TOOL_REGISTRY = [
   folderReadTool,
   folderUpdateTool,
   folderDeleteTool,
+  folderExportJsonTool,
+  folderImportJsonTool,
   environmentCreateTool,
   environmentReadTool,
   environmentUpdateTool,
@@ -2599,7 +2790,7 @@ var WorkspaceNotFoundError = class extends Error {
 };
 
 // src/providers/InMemoryWorkspaceProvider.ts
-var import_core2 = require("@apicircle/core");
+var import_core4 = require("@apicircle/core");
 var InMemoryWorkspaceProvider = class {
   state;
   constructor(initial) {
@@ -2609,7 +2800,7 @@ var InMemoryWorkspaceProvider = class {
     return this.state;
   }
   async apply(patch) {
-    const out = (0, import_core2.applyMutation)(this.state, patch);
+    const out = (0, import_core4.applyMutation)(this.state, patch);
     this.state = out.next;
     return { state: this.state, changedIds: out.changedIds };
   }
@@ -2623,7 +2814,7 @@ var InMemoryWorkspaceProvider = class {
 };
 
 // src/providers/FileBackedWorkspaceProvider.ts
-var import_core3 = require("@apicircle/core");
+var import_core5 = require("@apicircle/core");
 var import_file_backed = require("@apicircle/core/workspace/file-backed");
 var FileBackedWorkspaceProvider = class {
   constructor(dir) {
@@ -2640,7 +2831,7 @@ var FileBackedWorkspaceProvider = class {
   async apply(patch) {
     let captured = null;
     await (0, import_file_backed.withWorkspace)(this.dir, async (state) => {
-      const result = (0, import_core3.applyMutation)(state, patch);
+      const result = (0, import_core5.applyMutation)(state, patch);
       captured = { state: result.next, changedIds: result.changedIds };
       return { next: result.next };
     });