@apicircle/mcp-server 1.0.6 → 1.0.8

package/dist/index.js

@@ -6,10 +6,34 @@ import { z } from "zod";
 // package.json
 var package_default = {
   name: "@apicircle/mcp-server",
-  version: "1.0.6",
+  version: "1.0.8",
   private: false,
   type: "module",
   description: "Model Context Protocol server exposing API Circle Studio's workspace as a tool catalog. Used by Claude Desktop, ChatGPT, Cursor, GitHub Copilot, and any other MCP-compatible AI client.",
+  keywords: [
+    "apicircle",
+    "api",
+    "api-circle",
+    "mcp",
+    "mcp-server",
+    "model-context-protocol",
+    "ai",
+    "llm",
+    "agent",
+    "tool-catalog",
+    "claude",
+    "claude-desktop",
+    "chatgpt",
+    "cursor",
+    "copilot",
+    "continue",
+    "cline",
+    "zed",
+    "windsurf",
+    "openapi",
+    "postman",
+    "api-tools"
+  ],
   license: "SEE LICENSE IN LICENSE",
   repository: {
     type: "git",
@@ -534,6 +558,7 @@ var workspaceListTool = {
 // src/tools/crud.ts
 import { z as z5 } from "zod";
 import { generateId as generateId2 } from "@apicircle/shared";
+import { parseApicircleEnvironmentDoc } from "@apicircle/core";
 var HTTP_METHOD = z5.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]);
 var requestCreateTool = {
   name: "request.create",
@@ -778,55 +803,136 @@ var environmentSetPriorityTool = {
 };
 var environmentExportTool = {
   name: "environment.export",
-  description: "Serialize an environment to a portable JSON string. Encrypted variables drop their value (only `secretKeyId` survives) so the export can be safely pasted elsewhere \u2014 re-attach secrets locally on the receiving side.",
+  description: "Serialize an environment to a portable JSON string (envelope v2). Encrypted variables now carry their ciphertext, slot label, and per-slot salt \u2014 the destination decrypts with its local slot value at request-execute time, matching the Git push/pull contract. The plaintext slot value never leaves the device, but the ciphertext does. v1 envelopes (no ciphertext) still parse on import for back-compat.",
   inputSchema: z5.object({ name: z5.string() }),
   async handler(input, ctx) {
     const state = await ctx.workspace.read();
     const env = state.synced.environments.items[input.name];
     if (!env) return { ok: false, error: "environment not found" };
     const payload = {
-      apicircleEnvironment: 1,
+      apicircleEnvironment: 2,
       name: env.name,
-      variables: env.variables.map(
-        (v) => v.encrypted && v.secretKeyId ? { key: v.key, encrypted: true, secretKeyId: v.secretKeyId } : { key: v.key, value: v.value, encrypted: false }
-      )
+      variables: env.variables.map((v) => {
+        if (v.encrypted && v.secretKeyId) {
+          const slot = state.synced.secretKeys?.[v.secretKeyId];
+          const label = slot?.label ?? v.key;
+          const value = typeof v.value === "string" && v.value.startsWith("enc:") ? v.value : "";
+          return {
+            key: v.key,
+            encrypted: true,
+            value,
+            secretKeyId: v.secretKeyId,
+            secret: { label, salt: slot?.salt ?? null }
+          };
+        }
+        return { key: v.key, value: v.value, encrypted: false };
+      })
     };
     return { ok: true, json: JSON.stringify(payload, null, 2) };
   }
 };
 var environmentImportTool = {
   name: "environment.import",
-  description: "Import an environment from the JSON shape produced by `environment.export`. When a target with the same name exists, pass `overwrite: true` to replace it, otherwise the import is rejected.",
+  description: "Import an environment from the JSON shape produced by `environment.export`. v2 envelopes carry the row ciphertext + per-slot salt, so the destination decrypts at request-execute time with its local slot value (same model as Git push/pull); when no destination slot matches the source's salt, a new slot is minted via `secretKey.upsert` and surfaced in `mintedSlots` so the caller can provide values via `secret.addLocal`. v1 envelopes carry only metadata, so unmatched rows come back as `pendingBindings` for the caller to prompt-and-bind via `secret.addLocal` + `environment.bindSecret`. Pass `overwrite: true` to replace a same-name destination env.",
   inputSchema: z5.object({
     json: z5.string().min(1),
     overwrite: z5.boolean().default(false)
   }),
   async handler(input, ctx) {
-    let parsed;
+    let raw;
     try {
-      parsed = JSON.parse(input.json);
+      raw = JSON.parse(input.json);
     } catch {
       return { ok: false, error: "invalid JSON" };
     }
-    const obj = parsed;
-    if (obj.apicircleEnvironment !== 1 || typeof obj.name !== "string" || !Array.isArray(obj.variables)) {
-      return { ok: false, error: "unsupported export shape" };
+    let parsed;
+    try {
+      parsed = parseApicircleEnvironmentDoc(raw);
+    } catch (err) {
+      return {
+        ok: false,
+        error: err instanceof Error ? err.message : "unsupported export shape"
+      };
     }
     const state = await ctx.workspace.read();
-    if (state.synced.environments.items[obj.name] && !input.overwrite) {
+    if (state.synced.environments.items[parsed.name] && !input.overwrite) {
       return {
         ok: false,
         error: "environment already exists; pass overwrite:true"
       };
     }
-    const env = {
-      name: obj.name,
-      variables: obj.variables.map(
-        (v) => v.encrypted ? { key: v.key, value: "", encrypted: true, secretKeyId: v.secretKeyId } : { key: v.key, value: v.value, encrypted: false }
-      )
-    };
+    const destSlots = state.synced.secretKeys ?? {};
+    const labelToSlotId = /* @__PURE__ */ new Map();
+    for (const slot of Object.values(destSlots)) {
+      if (!labelToSlotId.has(slot.label)) labelToSlotId.set(slot.label, slot.id);
+    }
+    const resolvedVariables = [];
+    const pendingBindings = [];
+    const mintedSlots = [];
+    const knownDestIds = new Set(Object.keys(destSlots));
+    let hintCursor = 0;
+    for (const v of parsed.variables) {
+      if (!v.encrypted) {
+        resolvedVariables.push(v);
+        continue;
+      }
+      const hint = parsed.encryptedBindingHints[hintCursor];
+      hintCursor += 1;
+      if (hint && hint.ciphertext && hint.salt) {
+        if (hint.originSecretKeyId && destSlots[hint.originSecretKeyId]?.salt === hint.salt) {
+          resolvedVariables.push({ ...v, secretKeyId: hint.originSecretKeyId });
+          continue;
+        }
+        const labelMatch = labelToSlotId.get(hint.label);
+        if (labelMatch && destSlots[labelMatch]?.salt === hint.salt) {
+          resolvedVariables.push({ ...v, secretKeyId: labelMatch });
+          continue;
+        }
+        const mintedId = hint.originSecretKeyId && !knownDestIds.has(hint.originSecretKeyId) ? hint.originSecretKeyId : generateId2();
+        knownDestIds.add(mintedId);
+        if (!labelToSlotId.has(hint.label)) labelToSlotId.set(hint.label, mintedId);
+        mintedSlots.push({
+          id: mintedId,
+          label: hint.label,
+          salt: hint.salt,
+          createdAt: (/* @__PURE__ */ new Date()).toISOString()
+        });
+        resolvedVariables.push({ ...v, secretKeyId: mintedId });
+        continue;
+      }
+      if (hint?.originSecretKeyId && destSlots[hint.originSecretKeyId]) {
+        resolvedVariables.push({ ...v, secretKeyId: hint.originSecretKeyId });
+        continue;
+      }
+      if (hint?.label) {
+        const matchId = labelToSlotId.get(hint.label);
+        if (matchId) {
+          resolvedVariables.push({ ...v, secretKeyId: matchId });
+          continue;
+        }
+      }
+      resolvedVariables.push(v);
+      if (hint) {
+        pendingBindings.push({
+          varKey: hint.varKey,
+          label: hint.label,
+          labelFromFallback: hint.labelFromFallback
+        });
+      }
+    }
+    for (const meta of mintedSlots) {
+      await ctx.workspace.apply({ kind: "secretKey.upsert", meta });
+    }
+    const env = { name: parsed.name, variables: resolvedVariables };
     const out = await ctx.workspace.apply({ kind: "environment.upsert", environment: env });
-    return { ok: true, name: env.name, changedIds: out.changedIds };
+    return {
+      ok: true,
+      name: env.name,
+      changedIds: out.changedIds,
+      pendingBindings,
+      mintedSlots: mintedSlots.map((s) => ({ id: s.id, label: s.label })),
+      warnings: parsed.warnings
+    };
   }
 };
 var PLAN_STEP = z5.object({
@@ -1157,17 +1263,106 @@ var workspaceWriteTool = {
   }
 };
 
-// src/tools/history.ts
+// src/tools/folderExchange.ts
 import { z as z6 } from "zod";
+import {
+  collectFolderExport,
+  parseApicircleFolderExport,
+  redactFolderExportCredentials,
+  serializeFolderExport,
+  suggestFolderExportFilename
+} from "@apicircle/core";
+var folderExportJsonTool = {
+  name: "folder.export_json",
+  description: "Export an existing folder (and its subtree) to the API Circle exchange JSON format. Embeds JSON Schema + GraphQL dependencies inline. Auth credentials are redacted by default \u2014 pass `includeCredentialIds` to keep specific fields verbatim (the report from `collectFolderExport` enumerates the available ids).",
+  inputSchema: z6.object({
+    folderId: z6.string().min(1, "folderId is required"),
+    /**
+     * Subset of credential ids to KEEP in the output. Anything not in
+     * this list (and every detected credential when this is empty)
+     * gets blanked. Use the report-side ids surfaced by the export
+     * report (`<scope>:<ownerId>.<authType>.<field>`).
+     */
+    includeCredentialIds: z6.array(z6.string()).optional()
+  }),
+  async handler(input, ctx) {
+    const state = await ctx.workspace.read();
+    const collected = collectFolderExport({
+      synced: state.synced,
+      folderId: input.folderId
+    });
+    if (!collected) {
+      return {
+        error: "folder_not_found",
+        message: `No folder with id "${input.folderId}" exists in the active workspace.`
+      };
+    }
+    const includeIds = new Set(input.includeCredentialIds ?? []);
+    const redacted = redactFolderExportCredentials(collected.envelope, includeIds);
+    return {
+      envelope: redacted,
+      json: serializeFolderExport(redacted),
+      filename: suggestFolderExportFilename(redacted),
+      report: collected.report
+    };
+  }
+};
+var folderImportJsonTool = {
+  name: "folder.import_json",
+  description: "Import an `apicircle.folder/v1` envelope into the active workspace. Folder + request ids are reminted, dependency references are remapped, and JSON Schema / GraphQL definitions that match an existing global asset (by name + content) are reused.",
+  inputSchema: z6.object({
+    /** Either a JSON string or the already-parsed envelope object. */
+    json: z6.string().min(1).optional(),
+    envelope: z6.record(z6.unknown()).optional(),
+    parentFolderId: z6.string().nullable().optional()
+  }),
+  async handler(input, ctx) {
+    if (!input.json && !input.envelope) {
+      return {
+        error: "invalid_input",
+        message: "Pass either `json` (string) or `envelope` (object)."
+      };
+    }
+    const text = input.json !== void 0 ? input.json : JSON.stringify(input.envelope);
+    let parsed;
+    try {
+      parsed = parseApicircleFolderExport(text);
+    } catch (err) {
+      return {
+        error: "invalid_envelope",
+        message: err instanceof Error ? err.message : String(err)
+      };
+    }
+    const out = await ctx.workspace.apply({
+      kind: "folder.import_apicircle",
+      parsed,
+      parentFolderId: input.parentFolderId ?? null
+    });
+    return {
+      rootFolderId: parsed.rootFolder.id,
+      rootFolderName: parsed.rootFolder.name,
+      counts: {
+        folders: parsed.subfolders.length + 1,
+        requests: parsed.requests.length
+      },
+      filesRequiringReattachment: parsed.dependencies.files.map((f) => f.id),
+      warnings: parsed.warnings,
+      changedIds: out.changedIds
+    };
+  }
+};
+
+// src/tools/history.ts
+import { z as z7 } from "zod";
 var historyListRunsTool = {
   name: "history.list_runs",
   description: "List request-run history rows in reverse-chronological order. Filter by `requestId`, `ok` (success/failure), or `since`/`until` ISO timestamps. `limit` caps the result set; default 100.",
-  inputSchema: z6.object({
-    requestId: z6.string().optional(),
-    ok: z6.boolean().optional(),
-    since: z6.string().optional(),
-    until: z6.string().optional(),
-    limit: z6.number().int().positive().max(500).default(100)
+  inputSchema: z7.object({
+    requestId: z7.string().optional(),
+    ok: z7.boolean().optional(),
+    since: z7.string().optional(),
+    until: z7.string().optional(),
+    limit: z7.number().int().positive().max(500).default(100)
   }),
   async handler(input, ctx) {
     const state = await ctx.workspace.read();
@@ -1201,7 +1396,7 @@ var historyListRunsTool = {
 var historyGetRunTool = {
   name: "history.get_run",
   description: "Fetch a single history row in full (headers, body preview, assertion results).",
-  inputSchema: z6.object({ id: z6.string() }),
+  inputSchema: z7.object({ id: z7.string() }),
   async handler(input, ctx) {
     const state = await ctx.workspace.read();
     const run = state.local.history.requestRuns.find((r) => r.id === input.id);
@@ -1212,7 +1407,7 @@ var historyGetRunTool = {
 var historyDeleteRunTool = {
   name: "history.delete_run",
   description: "Delete a single request-run row by id.",
-  inputSchema: z6.object({ id: z6.string() }),
+  inputSchema: z7.object({ id: z7.string() }),
   async handler(input, ctx) {
     const out = await ctx.workspace.apply({ kind: "history.delete_run", runId: input.id });
     return { deleted: out.changedIds.length, changedIds: out.changedIds };
@@ -1221,8 +1416,8 @@ var historyDeleteRunTool = {
 var historyPurgeTool = {
   name: "history.purge_by_age",
   description: "Drop every request-run + plan-run older than `olderThanDays` days. Pass 0 to clear all history.",
-  inputSchema: z6.object({
-    olderThanDays: z6.number().nonnegative()
+  inputSchema: z7.object({
+    olderThanDays: z7.number().nonnegative()
   }),
   async handler(input, ctx) {
     const olderThanMs = input.olderThanDays * 24 * 60 * 60 * 1e3;
@@ -1232,15 +1427,15 @@ var historyPurgeTool = {
 };
 
 // src/tools/codebase.ts
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 var HTTP_METHODS = ["get", "post", "put", "patch", "delete", "options", "head"];
 var codebaseExtractCollectionTool = {
   name: "codebase.extract_collection",
   description: "Scan source code for HTTP route definitions (Express, FastAPI, NestJS, Spring) and return candidate requests for the user to confirm before import.",
-  inputSchema: z7.object({
-    source: z7.string().min(1),
+  inputSchema: z8.object({
+    source: z8.string().min(1),
     /** Hint to limit which framework patterns to apply. Empty = try all. */
-    frameworks: z7.array(z7.enum(["express", "fastapi", "nest", "spring"])).default([])
+    frameworks: z8.array(z8.enum(["express", "fastapi", "nest", "spring"])).default([])
   }),
   async handler(input) {
     const enabled = new Set(
@@ -1321,18 +1516,18 @@ var codebaseExtractCollectionTool = {
 };
 
 // src/tools/prompt.ts
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 import { generateId as generateId3, makeDefaultMockResponse, makeDefaultRequestSchema } from "@apicircle/shared";
 var promptCreateEnvironmentTool = {
   name: "prompt.create_environment",
   description: "Create a new environment from an LLM-shaped JSON envelope. The model produces { name, variables: [{ key, value, encrypted }] }; this tool validates and persists it.",
-  inputSchema: z8.object({
-    name: z8.string(),
-    variables: z8.array(
-      z8.object({
-        key: z8.string(),
-        value: z8.string(),
-        encrypted: z8.boolean().default(false)
+  inputSchema: z9.object({
+    name: z9.string(),
+    variables: z9.array(
+      z9.object({
+        key: z9.string(),
+        value: z9.string(),
+        encrypted: z9.boolean().default(false)
       })
     )
   }),
@@ -1345,13 +1540,13 @@ var promptCreateEnvironmentTool = {
 var promptCreateAssertionTool = {
   name: "prompt.create_assertion",
   description: 'Add an assertion to a request from an LLM-shaped JSON envelope. Useful when the user asks "assert that the response status is 200 and body.id matches".',
-  inputSchema: z8.object({
-    requestId: z8.string(),
-    assertion: z8.object({
-      kind: z8.enum(["status", "header", "json-path", "duration"]),
-      op: z8.enum(["equals", "not-equals", "contains", "lt", "gt", "matches"]),
-      target: z8.string().optional(),
-      expected: z8.union([z8.string(), z8.number()])
+  inputSchema: z9.object({
+    requestId: z9.string(),
+    assertion: z9.object({
+      kind: z9.enum(["status", "header", "json-path", "duration"]),
+      op: z9.enum(["equals", "not-equals", "contains", "lt", "gt", "matches"]),
+      target: z9.string().optional(),
+      expected: z9.union([z9.string(), z9.number()])
     })
   }),
   async handler(input, ctx) {
@@ -1370,10 +1565,10 @@ var promptCreateAssertionTool = {
 var promptCreatePlanTool = {
   name: "prompt.create_plan",
   description: "Create an execution plan from an LLM-shaped JSON envelope. The model produces { name, stepRequestIds: [...] } and the tool validates that each id exists in the workspace before persisting.",
-  inputSchema: z8.object({
-    name: z8.string(),
-    stepRequestIds: z8.array(z8.string()).default([]),
-    envPriorityOrder: z8.array(z8.string()).default([])
+  inputSchema: z9.object({
+    name: z9.string(),
+    stepRequestIds: z9.array(z9.string()).default([]),
+    envPriorityOrder: z9.array(z9.string()).default([])
   }),
   async handler(input, ctx) {
     const state = await ctx.workspace.read();
@@ -1402,51 +1597,51 @@ var promptCreatePlanTool = {
     return { ok: true, id, changedIds: out.changedIds };
   }
 };
-var HTTP_METHOD2 = z8.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]);
-var HEADER_OR_QUERY = z8.object({
-  key: z8.string(),
-  value: z8.string(),
-  enabled: z8.boolean().default(true)
+var HTTP_METHOD2 = z9.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]);
+var HEADER_OR_QUERY = z9.object({
+  key: z9.string(),
+  value: z9.string(),
+  enabled: z9.boolean().default(true)
 });
-var REQUEST_BODY = z8.object({
-  type: z8.enum(["none", "json", "text", "xml", "graphql", "urlencoded"]).default("none"),
-  content: z8.string().default(""),
-  variables: z8.string().optional()
+var REQUEST_BODY = z9.object({
+  type: z9.enum(["none", "json", "text", "xml", "graphql", "urlencoded"]).default("none"),
+  content: z9.string().default(""),
+  variables: z9.string().optional()
 });
-var PROMPT_AUTH = z8.discriminatedUnion("type", [
-  z8.object({ type: z8.literal("none") }),
-  z8.object({ type: z8.literal("inherit") }),
-  z8.object({ type: z8.literal("bearer"), token: z8.string().default("") }),
-  z8.object({
-    type: z8.literal("basic"),
-    username: z8.string().default(""),
-    password: z8.string().default("")
+var PROMPT_AUTH = z9.discriminatedUnion("type", [
+  z9.object({ type: z9.literal("none") }),
+  z9.object({ type: z9.literal("inherit") }),
+  z9.object({ type: z9.literal("bearer"), token: z9.string().default("") }),
+  z9.object({
+    type: z9.literal("basic"),
+    username: z9.string().default(""),
+    password: z9.string().default("")
   }),
-  z8.object({
-    type: z8.literal("api-key"),
-    key: z8.string().default(""),
-    value: z8.string().default(""),
-    addTo: z8.enum(["header", "query", "cookie"]).default("header")
+  z9.object({
+    type: z9.literal("api-key"),
+    key: z9.string().default(""),
+    value: z9.string().default(""),
+    addTo: z9.enum(["header", "query", "cookie"]).default("header")
   }),
-  z8.object({
-    type: z8.literal("custom-header"),
-    key: z8.string().default(""),
-    value: z8.string().default("")
+  z9.object({
+    type: z9.literal("custom-header"),
+    key: z9.string().default(""),
+    value: z9.string().default("")
   })
 ]);
-var PROMPT_ASSERTION = z8.object({
-  kind: z8.enum(["status", "header", "json-path", "duration"]),
-  op: z8.enum(["equals", "not-equals", "contains", "lt", "gt", "matches"]),
-  target: z8.string().optional(),
-  expected: z8.union([z8.string(), z8.number()])
+var PROMPT_ASSERTION = z9.object({
+  kind: z9.enum(["status", "header", "json-path", "duration"]),
+  op: z9.enum(["equals", "not-equals", "contains", "lt", "gt", "matches"]),
+  target: z9.string().optional(),
+  expected: z9.union([z9.string(), z9.number()])
 });
-var ENDPOINT_RESPONSE = z8.object({
-  status: z8.number().int().min(100).max(599).default(200),
-  jsonBody: z8.string().default("{}"),
-  contentType: z8.string().default("application/json")
+var ENDPOINT_RESPONSE = z9.object({
+  status: z9.number().int().min(100).max(599).default(200),
+  jsonBody: z9.string().default("{}"),
+  contentType: z9.string().default("application/json")
 });
-var VALIDATION_RULE_NL = z8.object({
-  kind: z8.enum([
+var VALIDATION_RULE_NL = z9.object({
+  kind: z9.enum([
     "header-required",
     "header-equals",
     "header-matches",
@@ -1457,50 +1652,50 @@ var VALIDATION_RULE_NL = z8.object({
     "body-required",
     "content-type-equals"
   ]),
-  target: z8.string().default(""),
-  expected: z8.string().optional(),
-  message: z8.string().optional(),
-  enabled: z8.boolean().default(true),
-  failResponse: z8.object({
-    status: z8.number().int().min(100).max(599).default(400),
-    jsonBody: z8.string().default('{"error":"validation failed"}')
+  target: z9.string().default(""),
+  expected: z9.string().optional(),
+  message: z9.string().optional(),
+  enabled: z9.boolean().default(true),
+  failResponse: z9.object({
+    status: z9.number().int().min(100).max(599).default(400),
+    jsonBody: z9.string().default('{"error":"validation failed"}')
   }).default({})
 });
-var CONDITION_CLAUSE_NL = z8.object({
-  scope: z8.enum(["query", "pathParam", "header", "cookie", "body-json-path"]),
-  target: z8.string(),
-  op: z8.enum(["equals", "not-equals", "matches", "gt", "lt", "gte", "lte", "present", "absent"]),
-  value: z8.string().optional()
+var CONDITION_CLAUSE_NL = z9.object({
+  scope: z9.enum(["query", "pathParam", "header", "cookie", "body-json-path"]),
+  target: z9.string(),
+  op: z9.enum(["equals", "not-equals", "matches", "gt", "lt", "gte", "lte", "present", "absent"]),
+  value: z9.string().optional()
 });
-var RESPONSE_RULE_NL = z8.object({
-  name: z8.string(),
-  enabled: z8.boolean().default(true),
-  when: z8.array(CONDITION_CLAUSE_NL).default([]),
-  response: z8.object({
-    status: z8.number().int().min(100).max(599).default(200),
-    jsonBody: z8.string().default("{}")
+var RESPONSE_RULE_NL = z9.object({
+  name: z9.string(),
+  enabled: z9.boolean().default(true),
+  when: z9.array(CONDITION_CLAUSE_NL).default([]),
+  response: z9.object({
+    status: z9.number().int().min(100).max(599).default(200),
+    jsonBody: z9.string().default("{}")
   }).default({})
 });
-var MULTIPLIER_NL = z8.object({
-  name: z8.string().optional(),
-  source: z8.object({
-    kind: z8.enum(["query", "pathParam", "header", "body-json-path"]),
-    key: z8.string()
+var MULTIPLIER_NL = z9.object({
+  name: z9.string().optional(),
+  source: z9.object({
+    kind: z9.enum(["query", "pathParam", "header", "body-json-path"]),
+    key: z9.string()
   }),
-  targetJsonPath: z8.string(),
-  defaultCount: z8.number().int().nonnegative().default(0),
-  min: z8.number().int().nonnegative().optional(),
-  max: z8.number().int().nonnegative().optional()
+  targetJsonPath: z9.string(),
+  defaultCount: z9.number().int().nonnegative().default(0),
+  min: z9.number().int().nonnegative().optional(),
+  max: z9.number().int().nonnegative().optional()
 });
-var ENDPOINT_INPUT = z8.object({
+var ENDPOINT_INPUT = z9.object({
   method: HTTP_METHOD2,
-  pathPattern: z8.string().min(1),
-  name: z8.string().optional(),
-  description: z8.string().optional(),
+  pathPattern: z9.string().min(1),
+  name: z9.string().optional(),
+  description: z9.string().optional(),
   response: ENDPOINT_RESPONSE.optional(),
-  validationRules: z8.array(VALIDATION_RULE_NL).default([]),
-  responseRules: z8.array(RESPONSE_RULE_NL).default([]),
-  multipliers: z8.array(MULTIPLIER_NL).default([])
+  validationRules: z9.array(VALIDATION_RULE_NL).default([]),
+  responseRules: z9.array(RESPONSE_RULE_NL).default([]),
+  multipliers: z9.array(MULTIPLIER_NL).default([])
 });
 function buildRequestBody(input) {
   if (!input) return { type: "none", content: "" };
@@ -1593,17 +1788,17 @@ function patchEndpoint(mock, endpointId, patcher) {
 var promptCreateRequestTool = {
   name: "prompt.create_request",
   description: "Create a fully-shaped request from an LLM-shaped JSON envelope: method, url, headers, query params, body, auth, and inline assertions. The model produces a flat object; this tool generates the request id, normalizes auth (defaults to `inherit` so folder auth wins), and persists.",
-  inputSchema: z8.object({
-    name: z8.string().default("New request"),
+  inputSchema: z9.object({
+    name: z9.string().default("New request"),
     method: HTTP_METHOD2.default("GET"),
-    url: z8.string().default(""),
-    folderId: z8.string().nullable().optional(),
-    headers: z8.array(HEADER_OR_QUERY).default([]),
-    queryParams: z8.array(HEADER_OR_QUERY).default([]),
-    pathParams: z8.record(z8.string(), z8.string()).optional(),
+    url: z9.string().default(""),
+    folderId: z9.string().nullable().optional(),
+    headers: z9.array(HEADER_OR_QUERY).default([]),
+    queryParams: z9.array(HEADER_OR_QUERY).default([]),
+    pathParams: z9.record(z9.string(), z9.string()).optional(),
     body: REQUEST_BODY.optional(),
     auth: PROMPT_AUTH.optional(),
-    assertions: z8.array(PROMPT_ASSERTION).default([])
+    assertions: z9.array(PROMPT_ASSERTION).default([])
   }),
   async handler(input, ctx) {
     const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -1633,19 +1828,19 @@ var promptCreateRequestTool = {
 var promptUpdateRequestTool = {
   name: "prompt.update_request",
   description: "Patch an existing request from an LLM-shaped JSON envelope. Provided fields replace the existing values; omitted fields are left untouched. Arrays (headers, queryParams, assertions) are full replacements when supplied. Returns `{ ok: false, error }` when the id does not resolve.",
-  inputSchema: z8.object({
-    id: z8.string(),
-    patch: z8.object({
-      name: z8.string().optional(),
+  inputSchema: z9.object({
+    id: z9.string(),
+    patch: z9.object({
+      name: z9.string().optional(),
       method: HTTP_METHOD2.optional(),
-      url: z8.string().optional(),
-      folderId: z8.string().nullable().optional(),
-      headers: z8.array(HEADER_OR_QUERY).optional(),
-      queryParams: z8.array(HEADER_OR_QUERY).optional(),
-      pathParams: z8.record(z8.string(), z8.string()).optional(),
+      url: z9.string().optional(),
+      folderId: z9.string().nullable().optional(),
+      headers: z9.array(HEADER_OR_QUERY).optional(),
+      queryParams: z9.array(HEADER_OR_QUERY).optional(),
+      pathParams: z9.record(z9.string(), z9.string()).optional(),
       body: REQUEST_BODY.optional(),
       auth: PROMPT_AUTH.optional(),
-      assertions: z8.array(PROMPT_ASSERTION).optional()
+      assertions: z9.array(PROMPT_ASSERTION).optional()
     }).strict()
   }),
   async handler(input, ctx) {
@@ -1673,17 +1868,17 @@ var promptUpdateRequestTool = {
     return { ok: true, changedIds: out.changedIds };
   }
 };
-var FOLDER_TREE_NODE = z8.lazy(
-  () => z8.object({
-    name: z8.string(),
-    children: z8.array(FOLDER_TREE_NODE).optional()
+var FOLDER_TREE_NODE = z9.lazy(
+  () => z9.object({
+    name: z9.string(),
+    children: z9.array(FOLDER_TREE_NODE).optional()
   })
 );
 var promptCreateFolderTreeTool = {
   name: "prompt.create_folder_tree",
   description: "Create a recursive folder hierarchy from an LLM-shaped JSON envelope. The model produces `{ parentId?, tree: { name, children?: [...] } }` and this tool walks the tree, generating ids and persisting one folder per node. Returns the list of created ids in pre-order.",
-  inputSchema: z8.object({
-    parentId: z8.string().nullable().optional(),
+  inputSchema: z9.object({
+    parentId: z9.string().nullable().optional(),
     tree: FOLDER_TREE_NODE
   }),
   async handler(input, ctx) {
@@ -1709,9 +1904,9 @@ var promptCreateFolderTreeTool = {
 var promptAddPlanStepsTool = {
   name: "prompt.add_plan_steps",
   description: "Append one or more steps to an existing execution plan from an LLM-shaped JSON envelope. The model produces `{ planId, requestIds: [...] }`; each id is validated against the workspace before any step is appended. Order in the input list is preserved.",
-  inputSchema: z8.object({
-    planId: z8.string(),
-    requestIds: z8.array(z8.string()).min(1)
+  inputSchema: z9.object({
+    planId: z9.string(),
+    requestIds: z9.array(z9.string()).min(1)
   }),
   async handler(input, ctx) {
     const state = await ctx.workspace.read();
@@ -1741,9 +1936,9 @@ var promptAddPlanStepsTool = {
 var promptSetPlanVariablesTool = {
   name: "prompt.set_plan_variables",
   description: "Replace the plan-scoped variables on an execution plan from an LLM-shaped JSON envelope. The model produces `{ planId, variables: [{ key, value }] }`. Empty array clears all plan variables.",
-  inputSchema: z8.object({
-    planId: z8.string(),
-    variables: z8.array(z8.object({ key: z8.string(), value: z8.string() }))
+  inputSchema: z9.object({
+    planId: z9.string(),
+    variables: z9.array(z9.object({ key: z9.string(), value: z9.string() }))
   }),
   async handler(input, ctx) {
     const state = await ctx.workspace.read();
@@ -1759,10 +1954,10 @@ var promptSetPlanVariablesTool = {
 var promptCreateMockServerTool = {
   name: "prompt.create_mock_server",
   description: "Create a manual-mode mock server with optional inline endpoints from an LLM-shaped JSON envelope. The model produces `{ name, defaultPort?, endpoints: [{ method, pathPattern, name?, response?, validationRules?, responseRules?, multipliers? }] }`; this tool generates ids for the server and every endpoint / rule, then persists in one shot.",
-  inputSchema: z8.object({
-    name: z8.string().min(1),
-    defaultPort: z8.number().int().positive().nullable().optional(),
-    endpoints: z8.array(ENDPOINT_INPUT).default([])
+  inputSchema: z9.object({
+    name: z9.string().min(1),
+    defaultPort: z9.number().int().positive().nullable().optional(),
+    endpoints: z9.array(ENDPOINT_INPUT).default([])
   }),
   async handler(input, ctx) {
     const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -1789,16 +1984,16 @@ var promptCreateMockServerTool = {
 var promptAddMockEndpointTool = {
   name: "prompt.add_mock_endpoint",
   description: "Append a new endpoint (with optional inline validation rules, response rules, and multipliers) to an existing mock server from an LLM-shaped JSON envelope. All ids are auto-generated; the existing endpoints stay in place.",
-  inputSchema: z8.object({
-    mockId: z8.string(),
+  inputSchema: z9.object({
+    mockId: z9.string(),
     method: HTTP_METHOD2,
-    pathPattern: z8.string().min(1),
-    name: z8.string().optional(),
-    description: z8.string().optional(),
+    pathPattern: z9.string().min(1),
+    name: z9.string().optional(),
+    description: z9.string().optional(),
     response: ENDPOINT_RESPONSE.optional(),
-    validationRules: z8.array(VALIDATION_RULE_NL).default([]),
-    responseRules: z8.array(RESPONSE_RULE_NL).default([]),
-    multipliers: z8.array(MULTIPLIER_NL).default([])
+    validationRules: z9.array(VALIDATION_RULE_NL).default([]),
+    responseRules: z9.array(RESPONSE_RULE_NL).default([]),
+    multipliers: z9.array(MULTIPLIER_NL).default([])
   }),
   async handler(input, ctx) {
     const state = await ctx.workspace.read();
@@ -1820,10 +2015,10 @@ var promptAddMockEndpointTool = {
 var promptSetEndpointValidationRulesTool = {
   name: "prompt.set_endpoint_validation_rules",
   description: "Replace an endpoint's validation rules with an LLM-shaped list. Every rule gets a fresh id; the existing rules are dropped. Empty array clears all validation rules.",
-  inputSchema: z8.object({
-    mockId: z8.string(),
-    endpointId: z8.string(),
-    rules: z8.array(VALIDATION_RULE_NL)
+  inputSchema: z9.object({
+    mockId: z9.string(),
+    endpointId: z9.string(),
+    rules: z9.array(VALIDATION_RULE_NL)
   }),
   async handler(input, ctx) {
     const state = await ctx.workspace.read();
@@ -1854,10 +2049,10 @@ var promptSetEndpointValidationRulesTool = {
 var promptSetEndpointResponseRulesTool = {
   name: "prompt.set_endpoint_response_rules",
   description: "Replace an endpoint's conditional response rules with an LLM-shaped list. Rules fire in order, first match wins. Every rule + clause gets a fresh id. Empty array falls back to defaultResponse.",
-  inputSchema: z8.object({
-    mockId: z8.string(),
-    endpointId: z8.string(),
-    rules: z8.array(RESPONSE_RULE_NL)
+  inputSchema: z9.object({
+    mockId: z9.string(),
+    endpointId: z9.string(),
+    rules: z9.array(RESPONSE_RULE_NL)
   }),
   async handler(input, ctx) {
     const state = await ctx.workspace.read();
@@ -1892,10 +2087,10 @@ var promptSetEndpointResponseRulesTool = {
 var promptSetEndpointMultipliersTool = {
   name: "prompt.set_endpoint_multipliers",
   description: "Replace the response multipliers on an endpoint's defaultResponse with an LLM-shaped list. Multipliers expand an array at `targetJsonPath` to a count derived from a request value. Every multiplier gets a fresh id. Empty array clears all multipliers.",
-  inputSchema: z8.object({
-    mockId: z8.string(),
-    endpointId: z8.string(),
-    multipliers: z8.array(MULTIPLIER_NL)
+  inputSchema: z9.object({
+    mockId: z9.string(),
+    endpointId: z9.string(),
+    multipliers: z9.array(MULTIPLIER_NL)
   }),
   async handler(input, ctx) {
     const state = await ctx.workspace.read();
@@ -1924,7 +2119,7 @@ var promptSetEndpointMultipliersTool = {
 };
 
 // src/tools/mocks.ts
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 import { generateId as generateId4, makeDefaultMockResponse as makeDefaultMockResponse2, makeDefaultRequestSchema as makeDefaultRequestSchema2 } from "@apicircle/shared";
 import { parseSourceToEndpoints } from "@apicircle/mock-server-core";
 async function ingestSource(source, name) {
@@ -1947,10 +2142,10 @@ async function ingestSource(source, name) {
 var mockCreateFromOpenApiTool = {
   name: "mock.create_from_openapi",
   description: "Create a mock server from an OpenAPI / Swagger spec (YAML or JSON).",
-  inputSchema: z9.object({
-    name: z9.string(),
-    spec: z9.string().min(1),
-    format: z9.enum(["json", "yaml"]).default("json")
+  inputSchema: z10.object({
+    name: z10.string(),
+    spec: z10.string().min(1),
+    format: z10.enum(["json", "yaml"]).default("json")
   }),
   async handler(input, ctx) {
     const { mock, warnings } = await ingestSource(
@@ -1969,7 +2164,7 @@ var mockCreateFromOpenApiTool = {
 var mockCreateFromPostmanTool = {
   name: "mock.create_from_postman",
   description: "Create a mock server from a Postman v2/v2.1 collection.",
-  inputSchema: z9.object({ name: z9.string(), collection: z9.string().min(1) }),
+  inputSchema: z10.object({ name: z10.string(), collection: z10.string().min(1) }),
   async handler(input, ctx) {
     const { mock, warnings } = await ingestSource(
       { kind: "postman", collection: input.collection },
@@ -1987,7 +2182,7 @@ var mockCreateFromPostmanTool = {
 var mockCreateFromInsomniaTool = {
   name: "mock.create_from_insomnia",
   description: "Create a mock server from an Insomnia v4 export.",
-  inputSchema: z9.object({ name: z9.string(), export: z9.string().min(1) }),
+  inputSchema: z10.object({ name: z10.string(), export: z10.string().min(1) }),
   async handler(input, ctx) {
     const { mock, warnings } = await ingestSource(
       { kind: "insomnia", export: input.export },
@@ -2005,7 +2200,7 @@ var mockCreateFromInsomniaTool = {
 var mockImportPostmanMockCollectionTool = {
   name: "mock.import_postman_mock_collection",
   description: "Import a Postman Mock Collection (collections previously hosted on Postman's mock service). Same parser as a regular Postman collection but marked as a mock import.",
-  inputSchema: z9.object({ name: z9.string(), collection: z9.string().min(1) }),
+  inputSchema: z10.object({ name: z10.string(), collection: z10.string().min(1) }),
   async handler(input, ctx) {
     const { mock, warnings } = await ingestSource(
       { kind: "postman", collection: input.collection },
@@ -2023,7 +2218,7 @@ var mockImportPostmanMockCollectionTool = {
 var mockListTool = {
   name: "mock.list",
   description: "List all mock servers in the workspace plus their runtime status (running / stopped, port).",
-  inputSchema: z9.object({}),
+  inputSchema: z10.object({}),
   async handler(_input, ctx) {
     const state = await ctx.workspace.read();
     const running = await ctx.mock.list();
@@ -2045,9 +2240,9 @@ var mockListTool = {
 var mockStartTool = {
   name: "mock.start",
   description: "Start a mock server by id. Returns the bound port. Errors if the mock is already running or the requested port is in use.",
-  inputSchema: z9.object({
-    id: z9.string(),
-    port: z9.number().int().positive().optional()
+  inputSchema: z10.object({
+    id: z10.string(),
+    port: z10.number().int().positive().optional()
   }),
   async handler(input, ctx) {
     const state = await ctx.workspace.read();
@@ -2064,7 +2259,7 @@ var mockStartTool = {
 var mockStopTool = {
   name: "mock.stop",
   description: "Stop a running mock server by id (no-op if not running).",
-  inputSchema: z9.object({ id: z9.string() }),
+  inputSchema: z10.object({ id: z10.string() }),
   async handler(input, ctx) {
     try {
       await ctx.mock.stop(input.id);
@@ -2077,7 +2272,7 @@ var mockStopTool = {
 var mockDeleteTool = {
   name: "mock.delete",
   description: "Delete a mock server definition. Stops it first if it's running.",
-  inputSchema: z9.object({ id: z9.string() }),
+  inputSchema: z10.object({ id: z10.string() }),
   async handler(input, ctx) {
     try {
       await ctx.mock.stop(input.id);
@@ -2087,13 +2282,13 @@ var mockDeleteTool = {
     return { ok: true, changedIds: out.changedIds };
   }
 };
-var HTTP_METHOD3 = z9.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]);
+var HTTP_METHOD3 = z10.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]);
 var mockCreateManualTool = {
   name: "mock.create_manual",
   description: "Create an empty manual-mode mock server. Use `mock.add_endpoint` afterward to populate it. CORS defaults to off (same-origin only); enable + list explicit origins via `mock.update_cors` if cross-origin access is needed.",
-  inputSchema: z9.object({
-    name: z9.string().min(1),
-    defaultPort: z9.number().int().positive().nullable().optional()
+  inputSchema: z10.object({
+    name: z10.string().min(1),
+    defaultPort: z10.number().int().positive().nullable().optional()
   }),
   async handler(input, ctx) {
     const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -2116,7 +2311,7 @@ var mockCreateManualTool = {
 var mockListEndpointsTool = {
   name: "mock.list_endpoints",
   description: "List endpoints for a mock server (id, method, path, name).",
-  inputSchema: z9.object({ mockId: z9.string() }),
+  inputSchema: z10.object({ mockId: z10.string() }),
   async handler(input, ctx) {
     const state = await ctx.workspace.read();
     const mock = state.synced.mockServers[input.mockId];
@@ -2135,10 +2330,10 @@ var mockListEndpointsTool = {
     };
   }
 };
-var ENDPOINT_RESPONSE2 = z9.object({
-  status: z9.number().int().min(100).max(599).default(200),
-  jsonBody: z9.string().default("{}"),
-  contentType: z9.string().default("application/json")
+var ENDPOINT_RESPONSE2 = z10.object({
+  status: z10.number().int().min(100).max(599).default(200),
+  jsonBody: z10.string().default("{}"),
+  contentType: z10.string().default("application/json")
 });
 function buildDefaultEndpoint(args) {
   const response = args.response ?? {
@@ -2167,12 +2362,12 @@ function buildDefaultEndpoint(args) {
 var mockAddEndpointTool = {
   name: "mock.add_endpoint",
   description: "Append a new endpoint to a mock server. Defaults to a 200 JSON response of `{}`. Returns the new endpoint id.",
-  inputSchema: z9.object({
-    mockId: z9.string(),
+  inputSchema: z10.object({
+    mockId: z10.string(),
     method: HTTP_METHOD3,
-    pathPattern: z9.string().min(1),
-    name: z9.string().optional(),
-    description: z9.string().optional(),
+    pathPattern: z10.string().min(1),
+    name: z10.string().optional(),
+    description: z10.string().optional(),
     response: ENDPOINT_RESPONSE2.optional()
   }),
   async handler(input, ctx) {
@@ -2195,13 +2390,13 @@ var mockAddEndpointTool = {
 var mockUpdateEndpointTool = {
   name: "mock.update_endpoint",
   description: "Patch fields on a single mock endpoint (method, pathPattern, name, description, defaultResponse status / contentType / json body). Pass only the fields you want to change.",
-  inputSchema: z9.object({
-    mockId: z9.string(),
-    endpointId: z9.string(),
+  inputSchema: z10.object({
+    mockId: z10.string(),
+    endpointId: z10.string(),
     method: HTTP_METHOD3.optional(),
-    pathPattern: z9.string().optional(),
-    name: z9.string().optional(),
-    description: z9.string().optional(),
+    pathPattern: z10.string().optional(),
+    name: z10.string().optional(),
+    description: z10.string().optional(),
     response: ENDPOINT_RESPONSE2.partial().optional()
   }),
   async handler(input, ctx) {
@@ -2242,7 +2437,7 @@ var mockUpdateEndpointTool = {
 var mockDeleteEndpointTool = {
   name: "mock.delete_endpoint",
   description: "Remove an endpoint from a mock server.",
-  inputSchema: z9.object({ mockId: z9.string(), endpointId: z9.string() }),
+  inputSchema: z10.object({ mockId: z10.string(), endpointId: z10.string() }),
   async handler(input, ctx) {
     const state = await ctx.workspace.read();
     const mock = state.synced.mockServers[input.mockId];
@@ -2262,9 +2457,9 @@ var mockDeleteEndpointTool = {
     return { ok: true, changedIds: out.changedIds };
   }
 };
-var VALIDATION_RULE = z9.object({
-  id: z9.string().optional(),
-  kind: z9.enum([
+var VALIDATION_RULE = z10.object({
+  id: z10.string().optional(),
+  kind: z10.enum([
     "header-required",
     "header-equals",
     "header-matches",
@@ -2275,43 +2470,43 @@ var VALIDATION_RULE = z9.object({
     "body-required",
     "content-type-equals"
   ]),
-  target: z9.string().default(""),
-  expected: z9.string().optional(),
-  message: z9.string().optional(),
-  enabled: z9.boolean().default(true),
-  failResponse: z9.object({
-    status: z9.number().int().min(100).max(599).default(400),
-    jsonBody: z9.string().default('{"error":"validation failed"}')
+  target: z10.string().default(""),
+  expected: z10.string().optional(),
+  message: z10.string().optional(),
+  enabled: z10.boolean().default(true),
+  failResponse: z10.object({
+    status: z10.number().int().min(100).max(599).default(400),
+    jsonBody: z10.string().default('{"error":"validation failed"}')
   }).default({})
 });
-var CONDITION_CLAUSE = z9.object({
-  id: z9.string().optional(),
-  scope: z9.enum(["query", "pathParam", "header", "cookie", "body-json-path"]),
-  target: z9.string(),
-  op: z9.enum(["equals", "not-equals", "matches", "gt", "lt", "gte", "lte", "present", "absent"]),
-  value: z9.string().optional()
+var CONDITION_CLAUSE = z10.object({
+  id: z10.string().optional(),
+  scope: z10.enum(["query", "pathParam", "header", "cookie", "body-json-path"]),
+  target: z10.string(),
+  op: z10.enum(["equals", "not-equals", "matches", "gt", "lt", "gte", "lte", "present", "absent"]),
+  value: z10.string().optional()
 });
-var RESPONSE_RULE = z9.object({
-  id: z9.string().optional(),
-  name: z9.string(),
-  enabled: z9.boolean().default(true),
-  when: z9.array(CONDITION_CLAUSE).default([]),
-  response: z9.object({
-    status: z9.number().int().min(100).max(599).default(200),
-    jsonBody: z9.string().default("{}")
+var RESPONSE_RULE = z10.object({
+  id: z10.string().optional(),
+  name: z10.string(),
+  enabled: z10.boolean().default(true),
+  when: z10.array(CONDITION_CLAUSE).default([]),
+  response: z10.object({
+    status: z10.number().int().min(100).max(599).default(200),
+    jsonBody: z10.string().default("{}")
   }).default({})
 });
-var MULTIPLIER = z9.object({
-  id: z9.string().optional(),
-  name: z9.string().optional(),
-  source: z9.object({
-    kind: z9.enum(["query", "pathParam", "header", "body-json-path"]),
-    key: z9.string()
+var MULTIPLIER = z10.object({
+  id: z10.string().optional(),
+  name: z10.string().optional(),
+  source: z10.object({
+    kind: z10.enum(["query", "pathParam", "header", "body-json-path"]),
+    key: z10.string()
   }),
-  targetJsonPath: z9.string(),
-  defaultCount: z9.number().int().nonnegative().default(0),
-  min: z9.number().int().nonnegative().optional(),
-  max: z9.number().int().nonnegative().optional()
+  targetJsonPath: z10.string(),
+  defaultCount: z10.number().int().nonnegative().default(0),
+  min: z10.number().int().nonnegative().optional(),
+  max: z10.number().int().nonnegative().optional()
 });
 function defaultJsonResponseConfig(args) {
   return {
@@ -2336,10 +2531,10 @@ function patchEndpoint2(mock, endpointId, patcher) {
 var mockSetValidationRulesTool = {
   name: "mock.set_validation_rules",
   description: "Replace an endpoint's validation rules. Rules without an `id` get a fresh one; existing rules can keep theirs to preserve client-side selection state. Empty array clears all rules.",
-  inputSchema: z9.object({
-    mockId: z9.string(),
-    endpointId: z9.string(),
-    rules: z9.array(VALIDATION_RULE)
+  inputSchema: z10.object({
+    mockId: z10.string(),
+    endpointId: z10.string(),
+    rules: z10.array(VALIDATION_RULE)
   }),
   async handler(input, ctx) {
     const state = await ctx.workspace.read();
@@ -2366,10 +2561,10 @@ var mockSetValidationRulesTool = {
 var mockSetResponseRulesTool = {
   name: "mock.set_response_rules",
   description: "Replace an endpoint's conditional response rules. Rules fire in order; the first whose every clause matches wins. Disabled rules are skipped. Empty array falls back to defaultResponse.",
-  inputSchema: z9.object({
-    mockId: z9.string(),
-    endpointId: z9.string(),
-    rules: z9.array(RESPONSE_RULE)
+  inputSchema: z10.object({
+    mockId: z10.string(),
+    endpointId: z10.string(),
+    rules: z10.array(RESPONSE_RULE)
   }),
   async handler(input, ctx) {
     const state = await ctx.workspace.read();
@@ -2400,10 +2595,10 @@ var mockSetResponseRulesTool = {
 var mockSetMultipliersTool = {
   name: "mock.set_multipliers",
   description: "Replace the response multipliers on an endpoint's defaultResponse. Multipliers expand an array at `targetJsonPath` to a count derived from a request value. Empty array clears all multipliers.",
-  inputSchema: z9.object({
-    mockId: z9.string(),
-    endpointId: z9.string(),
-    multipliers: z9.array(MULTIPLIER)
+  inputSchema: z10.object({
+    mockId: z10.string(),
+    endpointId: z10.string(),
+    multipliers: z10.array(MULTIPLIER)
   }),
   async handler(input, ctx) {
     const state = await ctx.workspace.read();
@@ -2450,6 +2645,8 @@ var TOOL_REGISTRY = [
   folderReadTool,
   folderUpdateTool,
   folderDeleteTool,
+  folderExportJsonTool,
+  folderImportJsonTool,
   environmentCreateTool,
   environmentReadTool,
   environmentUpdateTool,
@@ -2635,17 +2832,58 @@ import {
   setActiveWorkspace as setActiveWorkspaceOnDisk,
   workspaceDirFor
 } from "@apicircle/core/workspace/registry";
+var LazyActiveWorkspaceProvider = class {
+  constructor(registryRoot, onActiveResolved) {
+    this.registryRoot = registryRoot;
+    this.onActiveResolved = onActiveResolved;
+  }
+  registryRoot;
+  onActiveResolved;
+  async resolveActive() {
+    const registry = await loadRegistry(this.registryRoot);
+    const activeId = registry?.activeWorkspaceId ?? null;
+    if (!activeId) {
+      throw new Error(
+        "No active workspace. Open the desktop app at least once, or run `apicircle workspaces create <name>`."
+      );
+    }
+    this.onActiveResolved(activeId);
+    return new FileBackedWorkspaceProvider(workspaceDirFor(this.registryRoot, activeId));
+  }
+  async read() {
+    const provider = await this.resolveActive();
+    return provider.read();
+  }
+  async apply(patch) {
+    const provider = await this.resolveActive();
+    return provider.apply(patch);
+  }
+  async write(next) {
+    const provider = await this.resolveActive();
+    return provider.write(next);
+  }
+};
 var MultiWorkspaceProvider = class {
   constructor(registryRoot) {
     this.registryRoot = registryRoot;
+    this.lazyProvider = new LazyActiveWorkspaceProvider(this.registryRoot, (id) => {
+      this.activeWorkspaceId = id;
+    });
   }
   registryRoot;
-  active = null;
+  /** Last-known active workspace id. Refreshed every time the lazy
+   *  provider resolves; reflects what the most recent operation saw on
+   *  disk, not a stale boot-time snapshot. */
   activeWorkspaceId = null;
+  /** The lazy provider tool handlers consume as `ctx.workspace`. Holds a
+   *  reference back to this instance so each call updates
+   *  `activeWorkspaceId` for `activeId()` callers + diagnostic logs. */
+  lazyProvider;
   /**
-   * Hydrate the active provider from disk. Must be called once before the
-   * MCP host boots so `ctx.workspace.read()` doesn't race the first
-   * registry-load. Returns the registry the boot can log.
+   * Read the registry from disk so the host can log a boot banner. Does
+   * NOT cache a per-id provider — each `activeProvider()` call re-reads
+   * the registry, so a workspace switch in the desktop is picked up by
+   * the next tool call without restarting the MCP server.
    */
   async init() {
     const registry = await loadRegistry(this.registryRoot) ?? {
@@ -2653,22 +2891,18 @@ var MultiWorkspaceProvider = class {
       activeWorkspaceId: null,
       workspaces: []
     };
-    if (registry.activeWorkspaceId) {
-      this.activeWorkspaceId = registry.activeWorkspaceId;
-      this.active = new FileBackedWorkspaceProvider(
-        workspaceDirFor(this.registryRoot, registry.activeWorkspaceId)
-      );
-    }
+    this.activeWorkspaceId = registry.activeWorkspaceId;
     return registry;
   }
-  /** The provider tool handlers see as `ctx.workspace`. */
+  /**
+   * The provider tool handlers see as `ctx.workspace`. Returns a lazy
+   * provider whose `read` / `apply` / `write` calls re-read
+   * `registry.json` so the right active workspace is always targeted
+   * even if the desktop switched workspaces since this MCP process
+   * started.
+   */
   activeProvider() {
-    if (!this.active) {
-      throw new Error(
-        "No active workspace. Open the desktop app at least once, or run `apicircle workspaces create <name>`."
-      );
-    }
-    return this.active;
+    return this.lazyProvider;
   }
   // ─── Workspaces interface ──────────────────────────────────────────────────
   async list() {
@@ -2716,23 +2950,17 @@ var MultiWorkspaceProvider = class {
     if (!registry || !registry.workspaces.some((w) => w.id === workspaceId)) {
       throw new WorkspaceNotFoundError(workspaceId);
     }
-    const next = await setActiveWorkspaceOnDisk(this.registryRoot, workspaceId);
-    void next;
+    await setActiveWorkspaceOnDisk(this.registryRoot, workspaceId);
     this.activeWorkspaceId = workspaceId;
-    this.active = new FileBackedWorkspaceProvider(workspaceDirFor(this.registryRoot, workspaceId));
   }
   /**
    * Idempotent registry write — used by tests / tools that need to
-   * persist registry updates that didn't go through `setActive`.
+   * persist registry updates that didn't go through `setActive`. The
+   * lazy active provider picks the new id up on its next operation.
    */
   async writeRegistry(registry) {
     await saveRegistry(this.registryRoot, registry);
     this.activeWorkspaceId = registry.activeWorkspaceId;
-    if (registry.activeWorkspaceId) {
-      this.active = new FileBackedWorkspaceProvider(
-        workspaceDirFor(this.registryRoot, registry.activeWorkspaceId)
-      );
-    }
   }
 };