@apicircle/mcp-server 1.0.6 → 1.0.8

package/dist/bin/mcp-server.cjs

@@ -36,10 +36,34 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@apicircle/mcp-server",
-      version: "1.0.6",
+      version: "1.0.8",
       private: false,
       type: "module",
       description: "Model Context Protocol server exposing API Circle Studio's workspace as a tool catalog. Used by Claude Desktop, ChatGPT, Cursor, GitHub Copilot, and any other MCP-compatible AI client.",
+      keywords: [
+        "apicircle",
+        "api",
+        "api-circle",
+        "mcp",
+        "mcp-server",
+        "model-context-protocol",
+        "ai",
+        "llm",
+        "agent",
+        "tool-catalog",
+        "claude",
+        "claude-desktop",
+        "chatgpt",
+        "cursor",
+        "copilot",
+        "continue",
+        "cline",
+        "zed",
+        "windsurf",
+        "openapi",
+        "postman",
+        "api-tools"
+      ],
       license: "SEE LICENSE IN LICENSE",
       repository: {
         type: "git",
@@ -595,12 +619,13 @@ var init_workspaceList = __esm({
 });
 
 // src/tools/crud.ts
-var import_zod5, import_shared2, HTTP_METHOD, requestCreateTool, requestReadTool, requestUpdateTool, requestDeleteTool, folderCreateTool, folderReadTool, folderUpdateTool, folderDeleteTool, VARIABLE, environmentCreateTool, environmentReadTool, environmentUpdateTool, environmentDeleteTool, environmentSetActiveTool, environmentSetPriorityTool, environmentExportTool, environmentImportTool, PLAN_STEP, planCreateTool, planReadTool, planUpdateTool, planDeleteTool, planAddStepTool, planRemoveStepTool, planReorderStepsTool, PLAN_VARIABLE, planSetVariablesTool, planRunTool, ASSERTION, assertionCreateTool, assertionReadTool, assertionUpdateTool, assertionDeleteTool, workspaceReadTool, workspaceWriteTool;
+var import_zod5, import_shared2, import_core2, HTTP_METHOD, requestCreateTool, requestReadTool, requestUpdateTool, requestDeleteTool, folderCreateTool, folderReadTool, folderUpdateTool, folderDeleteTool, VARIABLE, environmentCreateTool, environmentReadTool, environmentUpdateTool, environmentDeleteTool, environmentSetActiveTool, environmentSetPriorityTool, environmentExportTool, environmentImportTool, PLAN_STEP, planCreateTool, planReadTool, planUpdateTool, planDeleteTool, planAddStepTool, planRemoveStepTool, planReorderStepsTool, PLAN_VARIABLE, planSetVariablesTool, planRunTool, ASSERTION, assertionCreateTool, assertionReadTool, assertionUpdateTool, assertionDeleteTool, workspaceReadTool, workspaceWriteTool;
 var init_crud = __esm({
   "src/tools/crud.ts"() {
     "use strict";
     import_zod5 = require("zod");
     import_shared2 = require("@apicircle/shared");
+    import_core2 = require("@apicircle/core");
     HTTP_METHOD = import_zod5.z.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]);
     requestCreateTool = {
       name: "request.create",
@@ -845,55 +870,136 @@ var init_crud = __esm({
     };
     environmentExportTool = {
       name: "environment.export",
-      description: "Serialize an environment to a portable JSON string. Encrypted variables drop their value (only `secretKeyId` survives) so the export can be safely pasted elsewhere \u2014 re-attach secrets locally on the receiving side.",
+      description: "Serialize an environment to a portable JSON string (envelope v2). Encrypted variables now carry their ciphertext, slot label, and per-slot salt \u2014 the destination decrypts with its local slot value at request-execute time, matching the Git push/pull contract. The plaintext slot value never leaves the device, but the ciphertext does. v1 envelopes (no ciphertext) still parse on import for back-compat.",
       inputSchema: import_zod5.z.object({ name: import_zod5.z.string() }),
       async handler(input, ctx) {
         const state = await ctx.workspace.read();
         const env = state.synced.environments.items[input.name];
         if (!env) return { ok: false, error: "environment not found" };
         const payload = {
-          apicircleEnvironment: 1,
+          apicircleEnvironment: 2,
           name: env.name,
-          variables: env.variables.map(
-            (v) => v.encrypted && v.secretKeyId ? { key: v.key, encrypted: true, secretKeyId: v.secretKeyId } : { key: v.key, value: v.value, encrypted: false }
-          )
+          variables: env.variables.map((v) => {
+            if (v.encrypted && v.secretKeyId) {
+              const slot = state.synced.secretKeys?.[v.secretKeyId];
+              const label = slot?.label ?? v.key;
+              const value = typeof v.value === "string" && v.value.startsWith("enc:") ? v.value : "";
+              return {
+                key: v.key,
+                encrypted: true,
+                value,
+                secretKeyId: v.secretKeyId,
+                secret: { label, salt: slot?.salt ?? null }
+              };
+            }
+            return { key: v.key, value: v.value, encrypted: false };
+          })
         };
         return { ok: true, json: JSON.stringify(payload, null, 2) };
       }
     };
     environmentImportTool = {
       name: "environment.import",
-      description: "Import an environment from the JSON shape produced by `environment.export`. When a target with the same name exists, pass `overwrite: true` to replace it, otherwise the import is rejected.",
+      description: "Import an environment from the JSON shape produced by `environment.export`. v2 envelopes carry the row ciphertext + per-slot salt, so the destination decrypts at request-execute time with its local slot value (same model as Git push/pull); when no destination slot matches the source's salt, a new slot is minted via `secretKey.upsert` and surfaced in `mintedSlots` so the caller can provide values via `secret.addLocal`. v1 envelopes carry only metadata, so unmatched rows come back as `pendingBindings` for the caller to prompt-and-bind via `secret.addLocal` + `environment.bindSecret`. Pass `overwrite: true` to replace a same-name destination env.",
       inputSchema: import_zod5.z.object({
         json: import_zod5.z.string().min(1),
         overwrite: import_zod5.z.boolean().default(false)
       }),
       async handler(input, ctx) {
-        let parsed;
+        let raw;
         try {
-          parsed = JSON.parse(input.json);
+          raw = JSON.parse(input.json);
         } catch {
           return { ok: false, error: "invalid JSON" };
         }
-        const obj = parsed;
-        if (obj.apicircleEnvironment !== 1 || typeof obj.name !== "string" || !Array.isArray(obj.variables)) {
-          return { ok: false, error: "unsupported export shape" };
+        let parsed;
+        try {
+          parsed = (0, import_core2.parseApicircleEnvironmentDoc)(raw);
+        } catch (err) {
+          return {
+            ok: false,
+            error: err instanceof Error ? err.message : "unsupported export shape"
+          };
         }
         const state = await ctx.workspace.read();
-        if (state.synced.environments.items[obj.name] && !input.overwrite) {
+        if (state.synced.environments.items[parsed.name] && !input.overwrite) {
           return {
             ok: false,
             error: "environment already exists; pass overwrite:true"
           };
         }
-        const env = {
-          name: obj.name,
-          variables: obj.variables.map(
-            (v) => v.encrypted ? { key: v.key, value: "", encrypted: true, secretKeyId: v.secretKeyId } : { key: v.key, value: v.value, encrypted: false }
-          )
-        };
+        const destSlots = state.synced.secretKeys ?? {};
+        const labelToSlotId = /* @__PURE__ */ new Map();
+        for (const slot of Object.values(destSlots)) {
+          if (!labelToSlotId.has(slot.label)) labelToSlotId.set(slot.label, slot.id);
+        }
+        const resolvedVariables = [];
+        const pendingBindings = [];
+        const mintedSlots = [];
+        const knownDestIds = new Set(Object.keys(destSlots));
+        let hintCursor = 0;
+        for (const v of parsed.variables) {
+          if (!v.encrypted) {
+            resolvedVariables.push(v);
+            continue;
+          }
+          const hint = parsed.encryptedBindingHints[hintCursor];
+          hintCursor += 1;
+          if (hint && hint.ciphertext && hint.salt) {
+            if (hint.originSecretKeyId && destSlots[hint.originSecretKeyId]?.salt === hint.salt) {
+              resolvedVariables.push({ ...v, secretKeyId: hint.originSecretKeyId });
+              continue;
+            }
+            const labelMatch = labelToSlotId.get(hint.label);
+            if (labelMatch && destSlots[labelMatch]?.salt === hint.salt) {
+              resolvedVariables.push({ ...v, secretKeyId: labelMatch });
+              continue;
+            }
+            const mintedId = hint.originSecretKeyId && !knownDestIds.has(hint.originSecretKeyId) ? hint.originSecretKeyId : (0, import_shared2.generateId)();
+            knownDestIds.add(mintedId);
+            if (!labelToSlotId.has(hint.label)) labelToSlotId.set(hint.label, mintedId);
+            mintedSlots.push({
+              id: mintedId,
+              label: hint.label,
+              salt: hint.salt,
+              createdAt: (/* @__PURE__ */ new Date()).toISOString()
+            });
+            resolvedVariables.push({ ...v, secretKeyId: mintedId });
+            continue;
+          }
+          if (hint?.originSecretKeyId && destSlots[hint.originSecretKeyId]) {
+            resolvedVariables.push({ ...v, secretKeyId: hint.originSecretKeyId });
+            continue;
+          }
+          if (hint?.label) {
+            const matchId = labelToSlotId.get(hint.label);
+            if (matchId) {
+              resolvedVariables.push({ ...v, secretKeyId: matchId });
+              continue;
+            }
+          }
+          resolvedVariables.push(v);
+          if (hint) {
+            pendingBindings.push({
+              varKey: hint.varKey,
+              label: hint.label,
+              labelFromFallback: hint.labelFromFallback
+            });
+          }
+        }
+        for (const meta of mintedSlots) {
+          await ctx.workspace.apply({ kind: "secretKey.upsert", meta });
+        }
+        const env = { name: parsed.name, variables: resolvedVariables };
         const out = await ctx.workspace.apply({ kind: "environment.upsert", environment: env });
-        return { ok: true, name: env.name, changedIds: out.changedIds };
+        return {
+          ok: true,
+          name: env.name,
+          changedIds: out.changedIds,
+          pendingBindings,
+          mintedSlots: mintedSlots.map((s) => ({ id: s.id, label: s.label })),
+          warnings: parsed.warnings
+        };
       }
     };
     PLAN_STEP = import_zod5.z.object({
@@ -1226,21 +1332,110 @@ var init_crud = __esm({
   }
 });
 
+// src/tools/folderExchange.ts
+var import_zod6, import_core3, folderExportJsonTool, folderImportJsonTool;
+var init_folderExchange = __esm({
+  "src/tools/folderExchange.ts"() {
+    "use strict";
+    import_zod6 = require("zod");
+    import_core3 = require("@apicircle/core");
+    folderExportJsonTool = {
+      name: "folder.export_json",
+      description: "Export an existing folder (and its subtree) to the API Circle exchange JSON format. Embeds JSON Schema + GraphQL dependencies inline. Auth credentials are redacted by default \u2014 pass `includeCredentialIds` to keep specific fields verbatim (the report from `collectFolderExport` enumerates the available ids).",
+      inputSchema: import_zod6.z.object({
+        folderId: import_zod6.z.string().min(1, "folderId is required"),
+        /**
+         * Subset of credential ids to KEEP in the output. Anything not in
+         * this list (and every detected credential when this is empty)
+         * gets blanked. Use the report-side ids surfaced by the export
+         * report (`<scope>:<ownerId>.<authType>.<field>`).
+         */
+        includeCredentialIds: import_zod6.z.array(import_zod6.z.string()).optional()
+      }),
+      async handler(input, ctx) {
+        const state = await ctx.workspace.read();
+        const collected = (0, import_core3.collectFolderExport)({
+          synced: state.synced,
+          folderId: input.folderId
+        });
+        if (!collected) {
+          return {
+            error: "folder_not_found",
+            message: `No folder with id "${input.folderId}" exists in the active workspace.`
+          };
+        }
+        const includeIds = new Set(input.includeCredentialIds ?? []);
+        const redacted = (0, import_core3.redactFolderExportCredentials)(collected.envelope, includeIds);
+        return {
+          envelope: redacted,
+          json: (0, import_core3.serializeFolderExport)(redacted),
+          filename: (0, import_core3.suggestFolderExportFilename)(redacted),
+          report: collected.report
+        };
+      }
+    };
+    folderImportJsonTool = {
+      name: "folder.import_json",
+      description: "Import an `apicircle.folder/v1` envelope into the active workspace. Folder + request ids are reminted, dependency references are remapped, and JSON Schema / GraphQL definitions that match an existing global asset (by name + content) are reused.",
+      inputSchema: import_zod6.z.object({
+        /** Either a JSON string or the already-parsed envelope object. */
+        json: import_zod6.z.string().min(1).optional(),
+        envelope: import_zod6.z.record(import_zod6.z.unknown()).optional(),
+        parentFolderId: import_zod6.z.string().nullable().optional()
+      }),
+      async handler(input, ctx) {
+        if (!input.json && !input.envelope) {
+          return {
+            error: "invalid_input",
+            message: "Pass either `json` (string) or `envelope` (object)."
+          };
+        }
+        const text = input.json !== void 0 ? input.json : JSON.stringify(input.envelope);
+        let parsed;
+        try {
+          parsed = (0, import_core3.parseApicircleFolderExport)(text);
+        } catch (err) {
+          return {
+            error: "invalid_envelope",
+            message: err instanceof Error ? err.message : String(err)
+          };
+        }
+        const out = await ctx.workspace.apply({
+          kind: "folder.import_apicircle",
+          parsed,
+          parentFolderId: input.parentFolderId ?? null
+        });
+        return {
+          rootFolderId: parsed.rootFolder.id,
+          rootFolderName: parsed.rootFolder.name,
+          counts: {
+            folders: parsed.subfolders.length + 1,
+            requests: parsed.requests.length
+          },
+          filesRequiringReattachment: parsed.dependencies.files.map((f) => f.id),
+          warnings: parsed.warnings,
+          changedIds: out.changedIds
+        };
+      }
+    };
+  }
+});
+
 // src/tools/history.ts
-var import_zod6, historyListRunsTool, historyGetRunTool, historyDeleteRunTool, historyPurgeTool;
+var import_zod7, historyListRunsTool, historyGetRunTool, historyDeleteRunTool, historyPurgeTool;
 var init_history = __esm({
   "src/tools/history.ts"() {
     "use strict";
-    import_zod6 = require("zod");
+    import_zod7 = require("zod");
     historyListRunsTool = {
       name: "history.list_runs",
       description: "List request-run history rows in reverse-chronological order. Filter by `requestId`, `ok` (success/failure), or `since`/`until` ISO timestamps. `limit` caps the result set; default 100.",
-      inputSchema: import_zod6.z.object({
-        requestId: import_zod6.z.string().optional(),
-        ok: import_zod6.z.boolean().optional(),
-        since: import_zod6.z.string().optional(),
-        until: import_zod6.z.string().optional(),
-        limit: import_zod6.z.number().int().positive().max(500).default(100)
+      inputSchema: import_zod7.z.object({
+        requestId: import_zod7.z.string().optional(),
+        ok: import_zod7.z.boolean().optional(),
+        since: import_zod7.z.string().optional(),
+        until: import_zod7.z.string().optional(),
+        limit: import_zod7.z.number().int().positive().max(500).default(100)
       }),
       async handler(input, ctx) {
         const state = await ctx.workspace.read();
@@ -1274,7 +1469,7 @@ var init_history = __esm({
     historyGetRunTool = {
       name: "history.get_run",
       description: "Fetch a single history row in full (headers, body preview, assertion results).",
-      inputSchema: import_zod6.z.object({ id: import_zod6.z.string() }),
+      inputSchema: import_zod7.z.object({ id: import_zod7.z.string() }),
       async handler(input, ctx) {
         const state = await ctx.workspace.read();
         const run = state.local.history.requestRuns.find((r) => r.id === input.id);
@@ -1285,7 +1480,7 @@ var init_history = __esm({
     historyDeleteRunTool = {
       name: "history.delete_run",
       description: "Delete a single request-run row by id.",
-      inputSchema: import_zod6.z.object({ id: import_zod6.z.string() }),
+      inputSchema: import_zod7.z.object({ id: import_zod7.z.string() }),
       async handler(input, ctx) {
         const out = await ctx.workspace.apply({ kind: "history.delete_run", runId: input.id });
         return { deleted: out.changedIds.length, changedIds: out.changedIds };
@@ -1294,8 +1489,8 @@ var init_history = __esm({
     historyPurgeTool = {
       name: "history.purge_by_age",
       description: "Drop every request-run + plan-run older than `olderThanDays` days. Pass 0 to clear all history.",
-      inputSchema: import_zod6.z.object({
-        olderThanDays: import_zod6.z.number().nonnegative()
+      inputSchema: import_zod7.z.object({
+        olderThanDays: import_zod7.z.number().nonnegative()
       }),
       async handler(input, ctx) {
         const olderThanMs = input.olderThanDays * 24 * 60 * 60 * 1e3;
@@ -1307,19 +1502,19 @@ var init_history = __esm({
 });
 
 // src/tools/codebase.ts
-var import_zod7, HTTP_METHODS, codebaseExtractCollectionTool;
+var import_zod8, HTTP_METHODS, codebaseExtractCollectionTool;
 var init_codebase = __esm({
   "src/tools/codebase.ts"() {
     "use strict";
-    import_zod7 = require("zod");
+    import_zod8 = require("zod");
     HTTP_METHODS = ["get", "post", "put", "patch", "delete", "options", "head"];
     codebaseExtractCollectionTool = {
       name: "codebase.extract_collection",
       description: "Scan source code for HTTP route definitions (Express, FastAPI, NestJS, Spring) and return candidate requests for the user to confirm before import.",
-      inputSchema: import_zod7.z.object({
-        source: import_zod7.z.string().min(1),
+      inputSchema: import_zod8.z.object({
+        source: import_zod8.z.string().min(1),
         /** Hint to limit which framework patterns to apply. Empty = try all. */
-        frameworks: import_zod7.z.array(import_zod7.z.enum(["express", "fastapi", "nest", "spring"])).default([])
+        frameworks: import_zod8.z.array(import_zod8.z.enum(["express", "fastapi", "nest", "spring"])).default([])
       }),
       async handler(input) {
         const enabled = new Set(
@@ -1490,22 +1685,22 @@ function patchEndpoint(mock, endpointId, patcher) {
     updatedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
 }
-var import_zod8, import_shared3, promptCreateEnvironmentTool, promptCreateAssertionTool, promptCreatePlanTool, HTTP_METHOD2, HEADER_OR_QUERY, REQUEST_BODY, PROMPT_AUTH, PROMPT_ASSERTION, ENDPOINT_RESPONSE, VALIDATION_RULE_NL, CONDITION_CLAUSE_NL, RESPONSE_RULE_NL, MULTIPLIER_NL, ENDPOINT_INPUT, promptCreateRequestTool, promptUpdateRequestTool, FOLDER_TREE_NODE, promptCreateFolderTreeTool, promptAddPlanStepsTool, promptSetPlanVariablesTool, promptCreateMockServerTool, promptAddMockEndpointTool, promptSetEndpointValidationRulesTool, promptSetEndpointResponseRulesTool, promptSetEndpointMultipliersTool;
+var import_zod9, import_shared3, promptCreateEnvironmentTool, promptCreateAssertionTool, promptCreatePlanTool, HTTP_METHOD2, HEADER_OR_QUERY, REQUEST_BODY, PROMPT_AUTH, PROMPT_ASSERTION, ENDPOINT_RESPONSE, VALIDATION_RULE_NL, CONDITION_CLAUSE_NL, RESPONSE_RULE_NL, MULTIPLIER_NL, ENDPOINT_INPUT, promptCreateRequestTool, promptUpdateRequestTool, FOLDER_TREE_NODE, promptCreateFolderTreeTool, promptAddPlanStepsTool, promptSetPlanVariablesTool, promptCreateMockServerTool, promptAddMockEndpointTool, promptSetEndpointValidationRulesTool, promptSetEndpointResponseRulesTool, promptSetEndpointMultipliersTool;
 var init_prompt = __esm({
   "src/tools/prompt.ts"() {
     "use strict";
-    import_zod8 = require("zod");
+    import_zod9 = require("zod");
     import_shared3 = require("@apicircle/shared");
     promptCreateEnvironmentTool = {
       name: "prompt.create_environment",
       description: "Create a new environment from an LLM-shaped JSON envelope. The model produces { name, variables: [{ key, value, encrypted }] }; this tool validates and persists it.",
-      inputSchema: import_zod8.z.object({
-        name: import_zod8.z.string(),
-        variables: import_zod8.z.array(
-          import_zod8.z.object({
-            key: import_zod8.z.string(),
-            value: import_zod8.z.string(),
-            encrypted: import_zod8.z.boolean().default(false)
+      inputSchema: import_zod9.z.object({
+        name: import_zod9.z.string(),
+        variables: import_zod9.z.array(
+          import_zod9.z.object({
+            key: import_zod9.z.string(),
+            value: import_zod9.z.string(),
+            encrypted: import_zod9.z.boolean().default(false)
           })
         )
       }),
@@ -1518,13 +1713,13 @@ var init_prompt = __esm({
     promptCreateAssertionTool = {
       name: "prompt.create_assertion",
       description: 'Add an assertion to a request from an LLM-shaped JSON envelope. Useful when the user asks "assert that the response status is 200 and body.id matches".',
-      inputSchema: import_zod8.z.object({
-        requestId: import_zod8.z.string(),
-        assertion: import_zod8.z.object({
-          kind: import_zod8.z.enum(["status", "header", "json-path", "duration"]),
-          op: import_zod8.z.enum(["equals", "not-equals", "contains", "lt", "gt", "matches"]),
-          target: import_zod8.z.string().optional(),
-          expected: import_zod8.z.union([import_zod8.z.string(), import_zod8.z.number()])
+      inputSchema: import_zod9.z.object({
+        requestId: import_zod9.z.string(),
+        assertion: import_zod9.z.object({
+          kind: import_zod9.z.enum(["status", "header", "json-path", "duration"]),
+          op: import_zod9.z.enum(["equals", "not-equals", "contains", "lt", "gt", "matches"]),
+          target: import_zod9.z.string().optional(),
+          expected: import_zod9.z.union([import_zod9.z.string(), import_zod9.z.number()])
         })
       }),
       async handler(input, ctx) {
@@ -1543,10 +1738,10 @@ var init_prompt = __esm({
     promptCreatePlanTool = {
       name: "prompt.create_plan",
       description: "Create an execution plan from an LLM-shaped JSON envelope. The model produces { name, stepRequestIds: [...] } and the tool validates that each id exists in the workspace before persisting.",
-      inputSchema: import_zod8.z.object({
-        name: import_zod8.z.string(),
-        stepRequestIds: import_zod8.z.array(import_zod8.z.string()).default([]),
-        envPriorityOrder: import_zod8.z.array(import_zod8.z.string()).default([])
+      inputSchema: import_zod9.z.object({
+        name: import_zod9.z.string(),
+        stepRequestIds: import_zod9.z.array(import_zod9.z.string()).default([]),
+        envPriorityOrder: import_zod9.z.array(import_zod9.z.string()).default([])
       }),
       async handler(input, ctx) {
         const state = await ctx.workspace.read();
@@ -1575,51 +1770,51 @@ var init_prompt = __esm({
         return { ok: true, id, changedIds: out.changedIds };
       }
     };
-    HTTP_METHOD2 = import_zod8.z.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]);
-    HEADER_OR_QUERY = import_zod8.z.object({
-      key: import_zod8.z.string(),
-      value: import_zod8.z.string(),
-      enabled: import_zod8.z.boolean().default(true)
+    HTTP_METHOD2 = import_zod9.z.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]);
+    HEADER_OR_QUERY = import_zod9.z.object({
+      key: import_zod9.z.string(),
+      value: import_zod9.z.string(),
+      enabled: import_zod9.z.boolean().default(true)
     });
-    REQUEST_BODY = import_zod8.z.object({
-      type: import_zod8.z.enum(["none", "json", "text", "xml", "graphql", "urlencoded"]).default("none"),
-      content: import_zod8.z.string().default(""),
-      variables: import_zod8.z.string().optional()
+    REQUEST_BODY = import_zod9.z.object({
+      type: import_zod9.z.enum(["none", "json", "text", "xml", "graphql", "urlencoded"]).default("none"),
+      content: import_zod9.z.string().default(""),
+      variables: import_zod9.z.string().optional()
     });
-    PROMPT_AUTH = import_zod8.z.discriminatedUnion("type", [
-      import_zod8.z.object({ type: import_zod8.z.literal("none") }),
-      import_zod8.z.object({ type: import_zod8.z.literal("inherit") }),
-      import_zod8.z.object({ type: import_zod8.z.literal("bearer"), token: import_zod8.z.string().default("") }),
-      import_zod8.z.object({
-        type: import_zod8.z.literal("basic"),
-        username: import_zod8.z.string().default(""),
-        password: import_zod8.z.string().default("")
+    PROMPT_AUTH = import_zod9.z.discriminatedUnion("type", [
+      import_zod9.z.object({ type: import_zod9.z.literal("none") }),
+      import_zod9.z.object({ type: import_zod9.z.literal("inherit") }),
+      import_zod9.z.object({ type: import_zod9.z.literal("bearer"), token: import_zod9.z.string().default("") }),
+      import_zod9.z.object({
+        type: import_zod9.z.literal("basic"),
+        username: import_zod9.z.string().default(""),
+        password: import_zod9.z.string().default("")
       }),
-      import_zod8.z.object({
-        type: import_zod8.z.literal("api-key"),
-        key: import_zod8.z.string().default(""),
-        value: import_zod8.z.string().default(""),
-        addTo: import_zod8.z.enum(["header", "query", "cookie"]).default("header")
+      import_zod9.z.object({
+        type: import_zod9.z.literal("api-key"),
+        key: import_zod9.z.string().default(""),
+        value: import_zod9.z.string().default(""),
+        addTo: import_zod9.z.enum(["header", "query", "cookie"]).default("header")
       }),
-      import_zod8.z.object({
-        type: import_zod8.z.literal("custom-header"),
-        key: import_zod8.z.string().default(""),
-        value: import_zod8.z.string().default("")
+      import_zod9.z.object({
+        type: import_zod9.z.literal("custom-header"),
+        key: import_zod9.z.string().default(""),
+        value: import_zod9.z.string().default("")
       })
     ]);
-    PROMPT_ASSERTION = import_zod8.z.object({
-      kind: import_zod8.z.enum(["status", "header", "json-path", "duration"]),
-      op: import_zod8.z.enum(["equals", "not-equals", "contains", "lt", "gt", "matches"]),
-      target: import_zod8.z.string().optional(),
-      expected: import_zod8.z.union([import_zod8.z.string(), import_zod8.z.number()])
+    PROMPT_ASSERTION = import_zod9.z.object({
+      kind: import_zod9.z.enum(["status", "header", "json-path", "duration"]),
+      op: import_zod9.z.enum(["equals", "not-equals", "contains", "lt", "gt", "matches"]),
+      target: import_zod9.z.string().optional(),
+      expected: import_zod9.z.union([import_zod9.z.string(), import_zod9.z.number()])
     });
-    ENDPOINT_RESPONSE = import_zod8.z.object({
-      status: import_zod8.z.number().int().min(100).max(599).default(200),
-      jsonBody: import_zod8.z.string().default("{}"),
-      contentType: import_zod8.z.string().default("application/json")
+    ENDPOINT_RESPONSE = import_zod9.z.object({
+      status: import_zod9.z.number().int().min(100).max(599).default(200),
+      jsonBody: import_zod9.z.string().default("{}"),
+      contentType: import_zod9.z.string().default("application/json")
     });
-    VALIDATION_RULE_NL = import_zod8.z.object({
-      kind: import_zod8.z.enum([
+    VALIDATION_RULE_NL = import_zod9.z.object({
+      kind: import_zod9.z.enum([
         "header-required",
         "header-equals",
         "header-matches",
@@ -1630,65 +1825,65 @@ var init_prompt = __esm({
         "body-required",
         "content-type-equals"
       ]),
-      target: import_zod8.z.string().default(""),
-      expected: import_zod8.z.string().optional(),
-      message: import_zod8.z.string().optional(),
-      enabled: import_zod8.z.boolean().default(true),
-      failResponse: import_zod8.z.object({
-        status: import_zod8.z.number().int().min(100).max(599).default(400),
-        jsonBody: import_zod8.z.string().default('{"error":"validation failed"}')
+      target: import_zod9.z.string().default(""),
+      expected: import_zod9.z.string().optional(),
+      message: import_zod9.z.string().optional(),
+      enabled: import_zod9.z.boolean().default(true),
+      failResponse: import_zod9.z.object({
+        status: import_zod9.z.number().int().min(100).max(599).default(400),
+        jsonBody: import_zod9.z.string().default('{"error":"validation failed"}')
       }).default({})
     });
-    CONDITION_CLAUSE_NL = import_zod8.z.object({
-      scope: import_zod8.z.enum(["query", "pathParam", "header", "cookie", "body-json-path"]),
-      target: import_zod8.z.string(),
-      op: import_zod8.z.enum(["equals", "not-equals", "matches", "gt", "lt", "gte", "lte", "present", "absent"]),
-      value: import_zod8.z.string().optional()
+    CONDITION_CLAUSE_NL = import_zod9.z.object({
+      scope: import_zod9.z.enum(["query", "pathParam", "header", "cookie", "body-json-path"]),
+      target: import_zod9.z.string(),
+      op: import_zod9.z.enum(["equals", "not-equals", "matches", "gt", "lt", "gte", "lte", "present", "absent"]),
+      value: import_zod9.z.string().optional()
     });
-    RESPONSE_RULE_NL = import_zod8.z.object({
-      name: import_zod8.z.string(),
-      enabled: import_zod8.z.boolean().default(true),
-      when: import_zod8.z.array(CONDITION_CLAUSE_NL).default([]),
-      response: import_zod8.z.object({
-        status: import_zod8.z.number().int().min(100).max(599).default(200),
-        jsonBody: import_zod8.z.string().default("{}")
+    RESPONSE_RULE_NL = import_zod9.z.object({
+      name: import_zod9.z.string(),
+      enabled: import_zod9.z.boolean().default(true),
+      when: import_zod9.z.array(CONDITION_CLAUSE_NL).default([]),
+      response: import_zod9.z.object({
+        status: import_zod9.z.number().int().min(100).max(599).default(200),
+        jsonBody: import_zod9.z.string().default("{}")
       }).default({})
     });
-    MULTIPLIER_NL = import_zod8.z.object({
-      name: import_zod8.z.string().optional(),
-      source: import_zod8.z.object({
-        kind: import_zod8.z.enum(["query", "pathParam", "header", "body-json-path"]),
-        key: import_zod8.z.string()
+    MULTIPLIER_NL = import_zod9.z.object({
+      name: import_zod9.z.string().optional(),
+      source: import_zod9.z.object({
+        kind: import_zod9.z.enum(["query", "pathParam", "header", "body-json-path"]),
+        key: import_zod9.z.string()
       }),
-      targetJsonPath: import_zod8.z.string(),
-      defaultCount: import_zod8.z.number().int().nonnegative().default(0),
-      min: import_zod8.z.number().int().nonnegative().optional(),
-      max: import_zod8.z.number().int().nonnegative().optional()
+      targetJsonPath: import_zod9.z.string(),
+      defaultCount: import_zod9.z.number().int().nonnegative().default(0),
+      min: import_zod9.z.number().int().nonnegative().optional(),
+      max: import_zod9.z.number().int().nonnegative().optional()
     });
-    ENDPOINT_INPUT = import_zod8.z.object({
+    ENDPOINT_INPUT = import_zod9.z.object({
       method: HTTP_METHOD2,
-      pathPattern: import_zod8.z.string().min(1),
-      name: import_zod8.z.string().optional(),
-      description: import_zod8.z.string().optional(),
+      pathPattern: import_zod9.z.string().min(1),
+      name: import_zod9.z.string().optional(),
+      description: import_zod9.z.string().optional(),
       response: ENDPOINT_RESPONSE.optional(),
-      validationRules: import_zod8.z.array(VALIDATION_RULE_NL).default([]),
-      responseRules: import_zod8.z.array(RESPONSE_RULE_NL).default([]),
-      multipliers: import_zod8.z.array(MULTIPLIER_NL).default([])
+      validationRules: import_zod9.z.array(VALIDATION_RULE_NL).default([]),
+      responseRules: import_zod9.z.array(RESPONSE_RULE_NL).default([]),
+      multipliers: import_zod9.z.array(MULTIPLIER_NL).default([])
     });
     promptCreateRequestTool = {
       name: "prompt.create_request",
       description: "Create a fully-shaped request from an LLM-shaped JSON envelope: method, url, headers, query params, body, auth, and inline assertions. The model produces a flat object; this tool generates the request id, normalizes auth (defaults to `inherit` so folder auth wins), and persists.",
-      inputSchema: import_zod8.z.object({
-        name: import_zod8.z.string().default("New request"),
+      inputSchema: import_zod9.z.object({
+        name: import_zod9.z.string().default("New request"),
         method: HTTP_METHOD2.default("GET"),
-        url: import_zod8.z.string().default(""),
-        folderId: import_zod8.z.string().nullable().optional(),
-        headers: import_zod8.z.array(HEADER_OR_QUERY).default([]),
-        queryParams: import_zod8.z.array(HEADER_OR_QUERY).default([]),
-        pathParams: import_zod8.z.record(import_zod8.z.string(), import_zod8.z.string()).optional(),
+        url: import_zod9.z.string().default(""),
+        folderId: import_zod9.z.string().nullable().optional(),
+        headers: import_zod9.z.array(HEADER_OR_QUERY).default([]),
+        queryParams: import_zod9.z.array(HEADER_OR_QUERY).default([]),
+        pathParams: import_zod9.z.record(import_zod9.z.string(), import_zod9.z.string()).optional(),
         body: REQUEST_BODY.optional(),
         auth: PROMPT_AUTH.optional(),
-        assertions: import_zod8.z.array(PROMPT_ASSERTION).default([])
+        assertions: import_zod9.z.array(PROMPT_ASSERTION).default([])
       }),
       async handler(input, ctx) {
         const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -1718,19 +1913,19 @@ var init_prompt = __esm({
     promptUpdateRequestTool = {
       name: "prompt.update_request",
       description: "Patch an existing request from an LLM-shaped JSON envelope. Provided fields replace the existing values; omitted fields are left untouched. Arrays (headers, queryParams, assertions) are full replacements when supplied. Returns `{ ok: false, error }` when the id does not resolve.",
-      inputSchema: import_zod8.z.object({
-        id: import_zod8.z.string(),
-        patch: import_zod8.z.object({
-          name: import_zod8.z.string().optional(),
+      inputSchema: import_zod9.z.object({
+        id: import_zod9.z.string(),
+        patch: import_zod9.z.object({
+          name: import_zod9.z.string().optional(),
           method: HTTP_METHOD2.optional(),
-          url: import_zod8.z.string().optional(),
-          folderId: import_zod8.z.string().nullable().optional(),
-          headers: import_zod8.z.array(HEADER_OR_QUERY).optional(),
-          queryParams: import_zod8.z.array(HEADER_OR_QUERY).optional(),
-          pathParams: import_zod8.z.record(import_zod8.z.string(), import_zod8.z.string()).optional(),
+          url: import_zod9.z.string().optional(),
+          folderId: import_zod9.z.string().nullable().optional(),
+          headers: import_zod9.z.array(HEADER_OR_QUERY).optional(),
+          queryParams: import_zod9.z.array(HEADER_OR_QUERY).optional(),
+          pathParams: import_zod9.z.record(import_zod9.z.string(), import_zod9.z.string()).optional(),
           body: REQUEST_BODY.optional(),
           auth: PROMPT_AUTH.optional(),
-          assertions: import_zod8.z.array(PROMPT_ASSERTION).optional()
+          assertions: import_zod9.z.array(PROMPT_ASSERTION).optional()
         }).strict()
       }),
       async handler(input, ctx) {
@@ -1758,17 +1953,17 @@ var init_prompt = __esm({
         return { ok: true, changedIds: out.changedIds };
       }
     };
-    FOLDER_TREE_NODE = import_zod8.z.lazy(
-      () => import_zod8.z.object({
-        name: import_zod8.z.string(),
-        children: import_zod8.z.array(FOLDER_TREE_NODE).optional()
+    FOLDER_TREE_NODE = import_zod9.z.lazy(
+      () => import_zod9.z.object({
+        name: import_zod9.z.string(),
+        children: import_zod9.z.array(FOLDER_TREE_NODE).optional()
       })
     );
     promptCreateFolderTreeTool = {
       name: "prompt.create_folder_tree",
       description: "Create a recursive folder hierarchy from an LLM-shaped JSON envelope. The model produces `{ parentId?, tree: { name, children?: [...] } }` and this tool walks the tree, generating ids and persisting one folder per node. Returns the list of created ids in pre-order.",
-      inputSchema: import_zod8.z.object({
-        parentId: import_zod8.z.string().nullable().optional(),
+      inputSchema: import_zod9.z.object({
+        parentId: import_zod9.z.string().nullable().optional(),
         tree: FOLDER_TREE_NODE
       }),
       async handler(input, ctx) {
@@ -1794,9 +1989,9 @@ var init_prompt = __esm({
     promptAddPlanStepsTool = {
       name: "prompt.add_plan_steps",
       description: "Append one or more steps to an existing execution plan from an LLM-shaped JSON envelope. The model produces `{ planId, requestIds: [...] }`; each id is validated against the workspace before any step is appended. Order in the input list is preserved.",
-      inputSchema: import_zod8.z.object({
-        planId: import_zod8.z.string(),
-        requestIds: import_zod8.z.array(import_zod8.z.string()).min(1)
+      inputSchema: import_zod9.z.object({
+        planId: import_zod9.z.string(),
+        requestIds: import_zod9.z.array(import_zod9.z.string()).min(1)
       }),
       async handler(input, ctx) {
         const state = await ctx.workspace.read();
@@ -1826,9 +2021,9 @@ var init_prompt = __esm({
     promptSetPlanVariablesTool = {
       name: "prompt.set_plan_variables",
       description: "Replace the plan-scoped variables on an execution plan from an LLM-shaped JSON envelope. The model produces `{ planId, variables: [{ key, value }] }`. Empty array clears all plan variables.",
-      inputSchema: import_zod8.z.object({
-        planId: import_zod8.z.string(),
-        variables: import_zod8.z.array(import_zod8.z.object({ key: import_zod8.z.string(), value: import_zod8.z.string() }))
+      inputSchema: import_zod9.z.object({
+        planId: import_zod9.z.string(),
+        variables: import_zod9.z.array(import_zod9.z.object({ key: import_zod9.z.string(), value: import_zod9.z.string() }))
       }),
       async handler(input, ctx) {
         const state = await ctx.workspace.read();
@@ -1844,10 +2039,10 @@ var init_prompt = __esm({
     promptCreateMockServerTool = {
       name: "prompt.create_mock_server",
       description: "Create a manual-mode mock server with optional inline endpoints from an LLM-shaped JSON envelope. The model produces `{ name, defaultPort?, endpoints: [{ method, pathPattern, name?, response?, validationRules?, responseRules?, multipliers? }] }`; this tool generates ids for the server and every endpoint / rule, then persists in one shot.",
-      inputSchema: import_zod8.z.object({
-        name: import_zod8.z.string().min(1),
-        defaultPort: import_zod8.z.number().int().positive().nullable().optional(),
-        endpoints: import_zod8.z.array(ENDPOINT_INPUT).default([])
+      inputSchema: import_zod9.z.object({
+        name: import_zod9.z.string().min(1),
+        defaultPort: import_zod9.z.number().int().positive().nullable().optional(),
+        endpoints: import_zod9.z.array(ENDPOINT_INPUT).default([])
       }),
       async handler(input, ctx) {
         const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -1874,16 +2069,16 @@ var init_prompt = __esm({
     promptAddMockEndpointTool = {
       name: "prompt.add_mock_endpoint",
       description: "Append a new endpoint (with optional inline validation rules, response rules, and multipliers) to an existing mock server from an LLM-shaped JSON envelope. All ids are auto-generated; the existing endpoints stay in place.",
-      inputSchema: import_zod8.z.object({
-        mockId: import_zod8.z.string(),
+      inputSchema: import_zod9.z.object({
+        mockId: import_zod9.z.string(),
         method: HTTP_METHOD2,
-        pathPattern: import_zod8.z.string().min(1),
-        name: import_zod8.z.string().optional(),
-        description: import_zod8.z.string().optional(),
+        pathPattern: import_zod9.z.string().min(1),
+        name: import_zod9.z.string().optional(),
+        description: import_zod9.z.string().optional(),
         response: ENDPOINT_RESPONSE.optional(),
-        validationRules: import_zod8.z.array(VALIDATION_RULE_NL).default([]),
-        responseRules: import_zod8.z.array(RESPONSE_RULE_NL).default([]),
-        multipliers: import_zod8.z.array(MULTIPLIER_NL).default([])
+        validationRules: import_zod9.z.array(VALIDATION_RULE_NL).default([]),
+        responseRules: import_zod9.z.array(RESPONSE_RULE_NL).default([]),
+        multipliers: import_zod9.z.array(MULTIPLIER_NL).default([])
       }),
       async handler(input, ctx) {
         const state = await ctx.workspace.read();
@@ -1905,10 +2100,10 @@ var init_prompt = __esm({
     promptSetEndpointValidationRulesTool = {
       name: "prompt.set_endpoint_validation_rules",
       description: "Replace an endpoint's validation rules with an LLM-shaped list. Every rule gets a fresh id; the existing rules are dropped. Empty array clears all validation rules.",
-      inputSchema: import_zod8.z.object({
-        mockId: import_zod8.z.string(),
-        endpointId: import_zod8.z.string(),
-        rules: import_zod8.z.array(VALIDATION_RULE_NL)
+      inputSchema: import_zod9.z.object({
+        mockId: import_zod9.z.string(),
+        endpointId: import_zod9.z.string(),
+        rules: import_zod9.z.array(VALIDATION_RULE_NL)
       }),
       async handler(input, ctx) {
         const state = await ctx.workspace.read();
@@ -1939,10 +2134,10 @@ var init_prompt = __esm({
     promptSetEndpointResponseRulesTool = {
       name: "prompt.set_endpoint_response_rules",
       description: "Replace an endpoint's conditional response rules with an LLM-shaped list. Rules fire in order, first match wins. Every rule + clause gets a fresh id. Empty array falls back to defaultResponse.",
-      inputSchema: import_zod8.z.object({
-        mockId: import_zod8.z.string(),
-        endpointId: import_zod8.z.string(),
-        rules: import_zod8.z.array(RESPONSE_RULE_NL)
+      inputSchema: import_zod9.z.object({
+        mockId: import_zod9.z.string(),
+        endpointId: import_zod9.z.string(),
+        rules: import_zod9.z.array(RESPONSE_RULE_NL)
       }),
       async handler(input, ctx) {
         const state = await ctx.workspace.read();
@@ -1977,10 +2172,10 @@ var init_prompt = __esm({
     promptSetEndpointMultipliersTool = {
       name: "prompt.set_endpoint_multipliers",
       description: "Replace the response multipliers on an endpoint's defaultResponse with an LLM-shaped list. Multipliers expand an array at `targetJsonPath` to a count derived from a request value. Every multiplier gets a fresh id. Empty array clears all multipliers.",
-      inputSchema: import_zod8.z.object({
-        mockId: import_zod8.z.string(),
-        endpointId: import_zod8.z.string(),
-        multipliers: import_zod8.z.array(MULTIPLIER_NL)
+      inputSchema: import_zod9.z.object({
+        mockId: import_zod9.z.string(),
+        endpointId: import_zod9.z.string(),
+        multipliers: import_zod9.z.array(MULTIPLIER_NL)
       }),
       async handler(input, ctx) {
         const state = await ctx.workspace.read();
@@ -2072,20 +2267,20 @@ function patchEndpoint2(mock, endpointId, patcher) {
     updatedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
 }
-var import_zod9, import_shared4, import_mock_server_core2, mockCreateFromOpenApiTool, mockCreateFromPostmanTool, mockCreateFromInsomniaTool, mockImportPostmanMockCollectionTool, mockListTool, mockStartTool, mockStopTool, mockDeleteTool, HTTP_METHOD3, mockCreateManualTool, mockListEndpointsTool, ENDPOINT_RESPONSE2, mockAddEndpointTool, mockUpdateEndpointTool, mockDeleteEndpointTool, VALIDATION_RULE, CONDITION_CLAUSE, RESPONSE_RULE, MULTIPLIER, mockSetValidationRulesTool, mockSetResponseRulesTool, mockSetMultipliersTool;
+var import_zod10, import_shared4, import_mock_server_core2, mockCreateFromOpenApiTool, mockCreateFromPostmanTool, mockCreateFromInsomniaTool, mockImportPostmanMockCollectionTool, mockListTool, mockStartTool, mockStopTool, mockDeleteTool, HTTP_METHOD3, mockCreateManualTool, mockListEndpointsTool, ENDPOINT_RESPONSE2, mockAddEndpointTool, mockUpdateEndpointTool, mockDeleteEndpointTool, VALIDATION_RULE, CONDITION_CLAUSE, RESPONSE_RULE, MULTIPLIER, mockSetValidationRulesTool, mockSetResponseRulesTool, mockSetMultipliersTool;
 var init_mocks = __esm({
   "src/tools/mocks.ts"() {
     "use strict";
-    import_zod9 = require("zod");
+    import_zod10 = require("zod");
     import_shared4 = require("@apicircle/shared");
     import_mock_server_core2 = require("@apicircle/mock-server-core");
     mockCreateFromOpenApiTool = {
       name: "mock.create_from_openapi",
       description: "Create a mock server from an OpenAPI / Swagger spec (YAML or JSON).",
-      inputSchema: import_zod9.z.object({
-        name: import_zod9.z.string(),
-        spec: import_zod9.z.string().min(1),
-        format: import_zod9.z.enum(["json", "yaml"]).default("json")
+      inputSchema: import_zod10.z.object({
+        name: import_zod10.z.string(),
+        spec: import_zod10.z.string().min(1),
+        format: import_zod10.z.enum(["json", "yaml"]).default("json")
       }),
       async handler(input, ctx) {
         const { mock, warnings } = await ingestSource(
@@ -2104,7 +2299,7 @@ var init_mocks = __esm({
     mockCreateFromPostmanTool = {
       name: "mock.create_from_postman",
       description: "Create a mock server from a Postman v2/v2.1 collection.",
-      inputSchema: import_zod9.z.object({ name: import_zod9.z.string(), collection: import_zod9.z.string().min(1) }),
+      inputSchema: import_zod10.z.object({ name: import_zod10.z.string(), collection: import_zod10.z.string().min(1) }),
       async handler(input, ctx) {
         const { mock, warnings } = await ingestSource(
           { kind: "postman", collection: input.collection },
@@ -2122,7 +2317,7 @@ var init_mocks = __esm({
     mockCreateFromInsomniaTool = {
       name: "mock.create_from_insomnia",
       description: "Create a mock server from an Insomnia v4 export.",
-      inputSchema: import_zod9.z.object({ name: import_zod9.z.string(), export: import_zod9.z.string().min(1) }),
+      inputSchema: import_zod10.z.object({ name: import_zod10.z.string(), export: import_zod10.z.string().min(1) }),
       async handler(input, ctx) {
         const { mock, warnings } = await ingestSource(
           { kind: "insomnia", export: input.export },
@@ -2140,7 +2335,7 @@ var init_mocks = __esm({
     mockImportPostmanMockCollectionTool = {
       name: "mock.import_postman_mock_collection",
       description: "Import a Postman Mock Collection (collections previously hosted on Postman's mock service). Same parser as a regular Postman collection but marked as a mock import.",
-      inputSchema: import_zod9.z.object({ name: import_zod9.z.string(), collection: import_zod9.z.string().min(1) }),
+      inputSchema: import_zod10.z.object({ name: import_zod10.z.string(), collection: import_zod10.z.string().min(1) }),
       async handler(input, ctx) {
         const { mock, warnings } = await ingestSource(
           { kind: "postman", collection: input.collection },
@@ -2158,7 +2353,7 @@ var init_mocks = __esm({
     mockListTool = {
       name: "mock.list",
       description: "List all mock servers in the workspace plus their runtime status (running / stopped, port).",
-      inputSchema: import_zod9.z.object({}),
+      inputSchema: import_zod10.z.object({}),
       async handler(_input, ctx) {
         const state = await ctx.workspace.read();
         const running = await ctx.mock.list();
@@ -2180,9 +2375,9 @@ var init_mocks = __esm({
     mockStartTool = {
       name: "mock.start",
       description: "Start a mock server by id. Returns the bound port. Errors if the mock is already running or the requested port is in use.",
-      inputSchema: import_zod9.z.object({
-        id: import_zod9.z.string(),
-        port: import_zod9.z.number().int().positive().optional()
+      inputSchema: import_zod10.z.object({
+        id: import_zod10.z.string(),
+        port: import_zod10.z.number().int().positive().optional()
       }),
       async handler(input, ctx) {
         const state = await ctx.workspace.read();
@@ -2199,7 +2394,7 @@ var init_mocks = __esm({
     mockStopTool = {
       name: "mock.stop",
       description: "Stop a running mock server by id (no-op if not running).",
-      inputSchema: import_zod9.z.object({ id: import_zod9.z.string() }),
+      inputSchema: import_zod10.z.object({ id: import_zod10.z.string() }),
       async handler(input, ctx) {
         try {
           await ctx.mock.stop(input.id);
@@ -2212,7 +2407,7 @@ var init_mocks = __esm({
     mockDeleteTool = {
       name: "mock.delete",
       description: "Delete a mock server definition. Stops it first if it's running.",
-      inputSchema: import_zod9.z.object({ id: import_zod9.z.string() }),
+      inputSchema: import_zod10.z.object({ id: import_zod10.z.string() }),
       async handler(input, ctx) {
         try {
           await ctx.mock.stop(input.id);
@@ -2222,13 +2417,13 @@ var init_mocks = __esm({
         return { ok: true, changedIds: out.changedIds };
       }
     };
-    HTTP_METHOD3 = import_zod9.z.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]);
+    HTTP_METHOD3 = import_zod10.z.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]);
     mockCreateManualTool = {
       name: "mock.create_manual",
       description: "Create an empty manual-mode mock server. Use `mock.add_endpoint` afterward to populate it. CORS defaults to off (same-origin only); enable + list explicit origins via `mock.update_cors` if cross-origin access is needed.",
-      inputSchema: import_zod9.z.object({
-        name: import_zod9.z.string().min(1),
-        defaultPort: import_zod9.z.number().int().positive().nullable().optional()
+      inputSchema: import_zod10.z.object({
+        name: import_zod10.z.string().min(1),
+        defaultPort: import_zod10.z.number().int().positive().nullable().optional()
       }),
       async handler(input, ctx) {
         const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -2251,7 +2446,7 @@ var init_mocks = __esm({
     mockListEndpointsTool = {
       name: "mock.list_endpoints",
       description: "List endpoints for a mock server (id, method, path, name).",
-      inputSchema: import_zod9.z.object({ mockId: import_zod9.z.string() }),
+      inputSchema: import_zod10.z.object({ mockId: import_zod10.z.string() }),
       async handler(input, ctx) {
         const state = await ctx.workspace.read();
         const mock = state.synced.mockServers[input.mockId];
@@ -2270,20 +2465,20 @@ var init_mocks = __esm({
         };
       }
     };
-    ENDPOINT_RESPONSE2 = import_zod9.z.object({
-      status: import_zod9.z.number().int().min(100).max(599).default(200),
-      jsonBody: import_zod9.z.string().default("{}"),
-      contentType: import_zod9.z.string().default("application/json")
+    ENDPOINT_RESPONSE2 = import_zod10.z.object({
+      status: import_zod10.z.number().int().min(100).max(599).default(200),
+      jsonBody: import_zod10.z.string().default("{}"),
+      contentType: import_zod10.z.string().default("application/json")
     });
     mockAddEndpointTool = {
       name: "mock.add_endpoint",
       description: "Append a new endpoint to a mock server. Defaults to a 200 JSON response of `{}`. Returns the new endpoint id.",
-      inputSchema: import_zod9.z.object({
-        mockId: import_zod9.z.string(),
+      inputSchema: import_zod10.z.object({
+        mockId: import_zod10.z.string(),
         method: HTTP_METHOD3,
-        pathPattern: import_zod9.z.string().min(1),
-        name: import_zod9.z.string().optional(),
-        description: import_zod9.z.string().optional(),
+        pathPattern: import_zod10.z.string().min(1),
+        name: import_zod10.z.string().optional(),
+        description: import_zod10.z.string().optional(),
         response: ENDPOINT_RESPONSE2.optional()
       }),
       async handler(input, ctx) {
@@ -2306,13 +2501,13 @@ var init_mocks = __esm({
     mockUpdateEndpointTool = {
       name: "mock.update_endpoint",
       description: "Patch fields on a single mock endpoint (method, pathPattern, name, description, defaultResponse status / contentType / json body). Pass only the fields you want to change.",
-      inputSchema: import_zod9.z.object({
-        mockId: import_zod9.z.string(),
-        endpointId: import_zod9.z.string(),
+      inputSchema: import_zod10.z.object({
+        mockId: import_zod10.z.string(),
+        endpointId: import_zod10.z.string(),
         method: HTTP_METHOD3.optional(),
-        pathPattern: import_zod9.z.string().optional(),
-        name: import_zod9.z.string().optional(),
-        description: import_zod9.z.string().optional(),
+        pathPattern: import_zod10.z.string().optional(),
+        name: import_zod10.z.string().optional(),
+        description: import_zod10.z.string().optional(),
         response: ENDPOINT_RESPONSE2.partial().optional()
       }),
       async handler(input, ctx) {
@@ -2353,7 +2548,7 @@ var init_mocks = __esm({
     mockDeleteEndpointTool = {
       name: "mock.delete_endpoint",
       description: "Remove an endpoint from a mock server.",
-      inputSchema: import_zod9.z.object({ mockId: import_zod9.z.string(), endpointId: import_zod9.z.string() }),
+      inputSchema: import_zod10.z.object({ mockId: import_zod10.z.string(), endpointId: import_zod10.z.string() }),
       async handler(input, ctx) {
         const state = await ctx.workspace.read();
         const mock = state.synced.mockServers[input.mockId];
@@ -2373,9 +2568,9 @@ var init_mocks = __esm({
         return { ok: true, changedIds: out.changedIds };
       }
     };
-    VALIDATION_RULE = import_zod9.z.object({
-      id: import_zod9.z.string().optional(),
-      kind: import_zod9.z.enum([
+    VALIDATION_RULE = import_zod10.z.object({
+      id: import_zod10.z.string().optional(),
+      kind: import_zod10.z.enum([
         "header-required",
         "header-equals",
         "header-matches",
@@ -2386,51 +2581,51 @@ var init_mocks = __esm({
         "body-required",
         "content-type-equals"
       ]),
-      target: import_zod9.z.string().default(""),
-      expected: import_zod9.z.string().optional(),
-      message: import_zod9.z.string().optional(),
-      enabled: import_zod9.z.boolean().default(true),
-      failResponse: import_zod9.z.object({
-        status: import_zod9.z.number().int().min(100).max(599).default(400),
-        jsonBody: import_zod9.z.string().default('{"error":"validation failed"}')
+      target: import_zod10.z.string().default(""),
+      expected: import_zod10.z.string().optional(),
+      message: import_zod10.z.string().optional(),
+      enabled: import_zod10.z.boolean().default(true),
+      failResponse: import_zod10.z.object({
+        status: import_zod10.z.number().int().min(100).max(599).default(400),
+        jsonBody: import_zod10.z.string().default('{"error":"validation failed"}')
       }).default({})
     });
-    CONDITION_CLAUSE = import_zod9.z.object({
-      id: import_zod9.z.string().optional(),
-      scope: import_zod9.z.enum(["query", "pathParam", "header", "cookie", "body-json-path"]),
-      target: import_zod9.z.string(),
-      op: import_zod9.z.enum(["equals", "not-equals", "matches", "gt", "lt", "gte", "lte", "present", "absent"]),
-      value: import_zod9.z.string().optional()
+    CONDITION_CLAUSE = import_zod10.z.object({
+      id: import_zod10.z.string().optional(),
+      scope: import_zod10.z.enum(["query", "pathParam", "header", "cookie", "body-json-path"]),
+      target: import_zod10.z.string(),
+      op: import_zod10.z.enum(["equals", "not-equals", "matches", "gt", "lt", "gte", "lte", "present", "absent"]),
+      value: import_zod10.z.string().optional()
     });
-    RESPONSE_RULE = import_zod9.z.object({
-      id: import_zod9.z.string().optional(),
-      name: import_zod9.z.string(),
-      enabled: import_zod9.z.boolean().default(true),
-      when: import_zod9.z.array(CONDITION_CLAUSE).default([]),
-      response: import_zod9.z.object({
-        status: import_zod9.z.number().int().min(100).max(599).default(200),
-        jsonBody: import_zod9.z.string().default("{}")
+    RESPONSE_RULE = import_zod10.z.object({
+      id: import_zod10.z.string().optional(),
+      name: import_zod10.z.string(),
+      enabled: import_zod10.z.boolean().default(true),
+      when: import_zod10.z.array(CONDITION_CLAUSE).default([]),
+      response: import_zod10.z.object({
+        status: import_zod10.z.number().int().min(100).max(599).default(200),
+        jsonBody: import_zod10.z.string().default("{}")
       }).default({})
     });
-    MULTIPLIER = import_zod9.z.object({
-      id: import_zod9.z.string().optional(),
-      name: import_zod9.z.string().optional(),
-      source: import_zod9.z.object({
-        kind: import_zod9.z.enum(["query", "pathParam", "header", "body-json-path"]),
-        key: import_zod9.z.string()
+    MULTIPLIER = import_zod10.z.object({
+      id: import_zod10.z.string().optional(),
+      name: import_zod10.z.string().optional(),
+      source: import_zod10.z.object({
+        kind: import_zod10.z.enum(["query", "pathParam", "header", "body-json-path"]),
+        key: import_zod10.z.string()
       }),
-      targetJsonPath: import_zod9.z.string(),
-      defaultCount: import_zod9.z.number().int().nonnegative().default(0),
-      min: import_zod9.z.number().int().nonnegative().optional(),
-      max: import_zod9.z.number().int().nonnegative().optional()
+      targetJsonPath: import_zod10.z.string(),
+      defaultCount: import_zod10.z.number().int().nonnegative().default(0),
+      min: import_zod10.z.number().int().nonnegative().optional(),
+      max: import_zod10.z.number().int().nonnegative().optional()
     });
     mockSetValidationRulesTool = {
       name: "mock.set_validation_rules",
       description: "Replace an endpoint's validation rules. Rules without an `id` get a fresh one; existing rules can keep theirs to preserve client-side selection state. Empty array clears all rules.",
-      inputSchema: import_zod9.z.object({
-        mockId: import_zod9.z.string(),
-        endpointId: import_zod9.z.string(),
-        rules: import_zod9.z.array(VALIDATION_RULE)
+      inputSchema: import_zod10.z.object({
+        mockId: import_zod10.z.string(),
+        endpointId: import_zod10.z.string(),
+        rules: import_zod10.z.array(VALIDATION_RULE)
       }),
       async handler(input, ctx) {
         const state = await ctx.workspace.read();
@@ -2457,10 +2652,10 @@ var init_mocks = __esm({
     mockSetResponseRulesTool = {
       name: "mock.set_response_rules",
       description: "Replace an endpoint's conditional response rules. Rules fire in order; the first whose every clause matches wins. Disabled rules are skipped. Empty array falls back to defaultResponse.",
-      inputSchema: import_zod9.z.object({
-        mockId: import_zod9.z.string(),
-        endpointId: import_zod9.z.string(),
-        rules: import_zod9.z.array(RESPONSE_RULE)
+      inputSchema: import_zod10.z.object({
+        mockId: import_zod10.z.string(),
+        endpointId: import_zod10.z.string(),
+        rules: import_zod10.z.array(RESPONSE_RULE)
       }),
       async handler(input, ctx) {
         const state = await ctx.workspace.read();
@@ -2491,10 +2686,10 @@ var init_mocks = __esm({
     mockSetMultipliersTool = {
       name: "mock.set_multipliers",
       description: "Replace the response multipliers on an endpoint's defaultResponse. Multipliers expand an array at `targetJsonPath` to a count derived from a request value. Empty array clears all multipliers.",
-      inputSchema: import_zod9.z.object({
-        mockId: import_zod9.z.string(),
-        endpointId: import_zod9.z.string(),
-        multipliers: import_zod9.z.array(MULTIPLIER)
+      inputSchema: import_zod10.z.object({
+        mockId: import_zod10.z.string(),
+        endpointId: import_zod10.z.string(),
+        multipliers: import_zod10.z.array(MULTIPLIER)
       }),
       async handler(input, ctx) {
         const state = await ctx.workspace.read();
@@ -2536,6 +2731,7 @@ var init_registry = __esm({
     init_codegen();
     init_workspaceList();
     init_crud();
+    init_folderExchange();
     init_history();
     init_codebase();
     init_prompt();
@@ -2558,6 +2754,8 @@ var init_registry = __esm({
       folderReadTool,
       folderUpdateTool,
       folderDeleteTool,
+      folderExportJsonTool,
+      folderImportJsonTool,
       environmentCreateTool,
       environmentReadTool,
       environmentUpdateTool,
@@ -2686,11 +2884,11 @@ var init_Workspaces = __esm({
 });
 
 // src/providers/InMemoryWorkspaceProvider.ts
-var import_core2, InMemoryWorkspaceProvider;
+var import_core4, InMemoryWorkspaceProvider;
 var init_InMemoryWorkspaceProvider = __esm({
   "src/providers/InMemoryWorkspaceProvider.ts"() {
     "use strict";
-    import_core2 = require("@apicircle/core");
+    import_core4 = require("@apicircle/core");
     InMemoryWorkspaceProvider = class {
       state;
       constructor(initial) {
@@ -2700,7 +2898,7 @@ var init_InMemoryWorkspaceProvider = __esm({
         return this.state;
       }
       async apply(patch) {
-        const out = (0, import_core2.applyMutation)(this.state, patch);
+        const out = (0, import_core4.applyMutation)(this.state, patch);
         this.state = out.next;
         return { state: this.state, changedIds: out.changedIds };
       }
@@ -2720,11 +2918,11 @@ var FileBackedWorkspaceProvider_exports = {};
 __export(FileBackedWorkspaceProvider_exports, {
   FileBackedWorkspaceProvider: () => FileBackedWorkspaceProvider
 });
-var import_core3, import_file_backed, FileBackedWorkspaceProvider;
+var import_core5, import_file_backed, FileBackedWorkspaceProvider;
 var init_FileBackedWorkspaceProvider = __esm({
   "src/providers/FileBackedWorkspaceProvider.ts"() {
     "use strict";
-    import_core3 = require("@apicircle/core");
+    import_core5 = require("@apicircle/core");
     import_file_backed = require("@apicircle/core/workspace/file-backed");
     FileBackedWorkspaceProvider = class {
       constructor(dir) {
@@ -2741,7 +2939,7 @@ var init_FileBackedWorkspaceProvider = __esm({
       async apply(patch) {
         let captured = null;
         await (0, import_file_backed.withWorkspace)(this.dir, async (state) => {
-          const result = (0, import_core3.applyMutation)(state, patch);
+          const result = (0, import_core5.applyMutation)(state, patch);
           captured = { state: result.next, changedIds: result.changedIds };
           return { next: result.next };
         });
@@ -2766,24 +2964,65 @@ var MultiWorkspaceProvider_exports = {};
 __export(MultiWorkspaceProvider_exports, {
   MultiWorkspaceProvider: () => MultiWorkspaceProvider
 });
-var import_registry, MultiWorkspaceProvider;
+var import_registry, LazyActiveWorkspaceProvider, MultiWorkspaceProvider;
 var init_MultiWorkspaceProvider = __esm({
   "src/providers/MultiWorkspaceProvider.ts"() {
     "use strict";
     import_registry = require("@apicircle/core/workspace/registry");
     init_FileBackedWorkspaceProvider();
     init_Workspaces();
+    LazyActiveWorkspaceProvider = class {
+      constructor(registryRoot, onActiveResolved) {
+        this.registryRoot = registryRoot;
+        this.onActiveResolved = onActiveResolved;
+      }
+      registryRoot;
+      onActiveResolved;
+      async resolveActive() {
+        const registry = await (0, import_registry.loadRegistry)(this.registryRoot);
+        const activeId = registry?.activeWorkspaceId ?? null;
+        if (!activeId) {
+          throw new Error(
+            "No active workspace. Open the desktop app at least once, or run `apicircle workspaces create <name>`."
+          );
+        }
+        this.onActiveResolved(activeId);
+        return new FileBackedWorkspaceProvider((0, import_registry.workspaceDirFor)(this.registryRoot, activeId));
+      }
+      async read() {
+        const provider = await this.resolveActive();
+        return provider.read();
+      }
+      async apply(patch) {
+        const provider = await this.resolveActive();
+        return provider.apply(patch);
+      }
+      async write(next) {
+        const provider = await this.resolveActive();
+        return provider.write(next);
+      }
+    };
     MultiWorkspaceProvider = class {
       constructor(registryRoot) {
         this.registryRoot = registryRoot;
+        this.lazyProvider = new LazyActiveWorkspaceProvider(this.registryRoot, (id) => {
+          this.activeWorkspaceId = id;
+        });
       }
       registryRoot;
-      active = null;
+      /** Last-known active workspace id. Refreshed every time the lazy
+       *  provider resolves; reflects what the most recent operation saw on
+       *  disk, not a stale boot-time snapshot. */
       activeWorkspaceId = null;
+      /** The lazy provider tool handlers consume as `ctx.workspace`. Holds a
+       *  reference back to this instance so each call updates
+       *  `activeWorkspaceId` for `activeId()` callers + diagnostic logs. */
+      lazyProvider;
       /**
-       * Hydrate the active provider from disk. Must be called once before the
-       * MCP host boots so `ctx.workspace.read()` doesn't race the first
-       * registry-load. Returns the registry the boot can log.
+       * Read the registry from disk so the host can log a boot banner. Does
+       * NOT cache a per-id provider — each `activeProvider()` call re-reads
+       * the registry, so a workspace switch in the desktop is picked up by
+       * the next tool call without restarting the MCP server.
        */
       async init() {
         const registry = await (0, import_registry.loadRegistry)(this.registryRoot) ?? {
@@ -2791,22 +3030,18 @@ var init_MultiWorkspaceProvider = __esm({
           activeWorkspaceId: null,
           workspaces: []
         };
-        if (registry.activeWorkspaceId) {
-          this.activeWorkspaceId = registry.activeWorkspaceId;
-          this.active = new FileBackedWorkspaceProvider(
-            (0, import_registry.workspaceDirFor)(this.registryRoot, registry.activeWorkspaceId)
-          );
-        }
+        this.activeWorkspaceId = registry.activeWorkspaceId;
         return registry;
       }
-      /** The provider tool handlers see as `ctx.workspace`. */
+      /**
+       * The provider tool handlers see as `ctx.workspace`. Returns a lazy
+       * provider whose `read` / `apply` / `write` calls re-read
+       * `registry.json` so the right active workspace is always targeted
+       * even if the desktop switched workspaces since this MCP process
+       * started.
+       */
       activeProvider() {
-        if (!this.active) {
-          throw new Error(
-            "No active workspace. Open the desktop app at least once, or run `apicircle workspaces create <name>`."
-          );
-        }
-        return this.active;
+        return this.lazyProvider;
       }
       // ─── Workspaces interface ──────────────────────────────────────────────────
       async list() {
@@ -2854,23 +3089,17 @@ var init_MultiWorkspaceProvider = __esm({
         if (!registry || !registry.workspaces.some((w) => w.id === workspaceId)) {
           throw new WorkspaceNotFoundError(workspaceId);
         }
-        const next = await (0, import_registry.setActiveWorkspace)(this.registryRoot, workspaceId);
-        void next;
+        await (0, import_registry.setActiveWorkspace)(this.registryRoot, workspaceId);
         this.activeWorkspaceId = workspaceId;
-        this.active = new FileBackedWorkspaceProvider((0, import_registry.workspaceDirFor)(this.registryRoot, workspaceId));
       }
       /**
        * Idempotent registry write — used by tests / tools that need to
-       * persist registry updates that didn't go through `setActive`.
+       * persist registry updates that didn't go through `setActive`. The
+       * lazy active provider picks the new id up on its next operation.
        */
       async writeRegistry(registry) {
         await (0, import_registry.saveRegistry)(this.registryRoot, registry);
         this.activeWorkspaceId = registry.activeWorkspaceId;
-        if (registry.activeWorkspaceId) {
-          this.active = new FileBackedWorkspaceProvider(
-            (0, import_registry.workspaceDirFor)(this.registryRoot, registry.activeWorkspaceId)
-          );
-        }
       }
     };
   }