@harborclient/team-hub 0.4.5 → 0.4.6

package/dist/cli.js

@@ -404,6 +404,7 @@ var ENVIRONMENTS_COLLECTION = "environments";
 var SNIPPETS_COLLECTION = "snippets";
 var FOLDERS_COLLECTION = "folders";
 var REQUESTS_COLLECTION = "requests";
+var DOCUMENTS_COLLECTION = "documents";
 var AUDIT_LOG_COLLECTION = "auditLog";
 var LLM_USAGE_COLLECTION = "llmUsage";
 var LLM_USAGE_LOG_COLLECTION = "llmUsageLog";
@@ -442,9 +443,25 @@ var firestoreConfigSchema = z2.object({
   keyFilename: z2.string().trim().min(1).optional()
 });
 
+// src/db/sidebarMarker.ts
+function serializeSidebarMarker(marker) {
+  if (marker == null) {
+    return null;
+  }
+  const trimmed = marker.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+function readSidebarMarker(value) {
+  if (typeof value !== "string") {
+    return null;
+  }
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+
 // src/db/firestore/utils.ts
 function parseAuditEntityType(value) {
-  if (value === "user" || value === "api_token" || value === "invitation" || value === "collection" || value === "environment" || value === "snippet" || value === "folder" || value === "request" || value === "run_result") {
+  if (value === "user" || value === "api_token" || value === "invitation" || value === "collection" || value === "environment" || value === "snippet" || value === "folder" || value === "request" || value === "document" || value === "run_result") {
     return value;
   }
   throw new Error(`Invalid audit entity type: ${value}`);
@@ -538,7 +555,8 @@ function mapFirestoreCollection(id, data) {
     updatedAt: data.updatedAt ?? data.createdAt,
     createdByUserId: data.createdByUserId ?? null,
     updatedByUserId: data.updatedByUserId ?? null,
-    deletionLocked: data.deletionLocked ?? false
+    deletionLocked: data.deletionLocked ?? false,
+    marker: readSidebarMarker(data.marker)
   };
 }
 function mapFirestoreEnvironment(id, data) {
@@ -550,7 +568,8 @@ function mapFirestoreEnvironment(id, data) {
     updatedAt: data.updatedAt ?? data.createdAt,
     createdByUserId: data.createdByUserId ?? null,
     updatedByUserId: data.updatedByUserId ?? null,
-    deletionLocked: data.deletionLocked ?? false
+    deletionLocked: data.deletionLocked ?? false,
+    marker: readSidebarMarker(data.marker)
   };
 }
 function mapFirestoreSnippet(id, data) {
@@ -571,12 +590,14 @@ function mapFirestoreFolder(id, data) {
   return {
     id,
     collectionId: data.collectionId,
+    parentFolderId: data.parentFolderId ?? null,
     name: data.name,
     sortOrder: data.sortOrder,
     createdAt: data.createdAt,
     updatedAt: data.updatedAt ?? data.createdAt,
     createdByUserId: data.createdByUserId ?? null,
-    updatedByUserId: data.updatedByUserId ?? null
+    updatedByUserId: data.updatedByUserId ?? null,
+    marker: readSidebarMarker(data.marker)
   };
 }
 function mapFirestoreRequest(id, data) {
@@ -599,7 +620,23 @@ function mapFirestoreRequest(id, data) {
     createdAt: data.createdAt,
     updatedAt: data.updatedAt,
     createdByUserId: data.createdByUserId ?? null,
-    updatedByUserId: data.updatedByUserId ?? null
+    updatedByUserId: data.updatedByUserId ?? null,
+    marker: readSidebarMarker(data.marker)
+  };
+}
+function mapFirestoreDocument(id, data) {
+  return {
+    id,
+    collectionId: data.collectionId,
+    folderId: data.folderId,
+    name: data.name,
+    content: data.content,
+    sortOrder: data.sortOrder,
+    createdAt: data.createdAt,
+    updatedAt: data.updatedAt,
+    createdByUserId: data.createdByUserId ?? null,
+    updatedByUserId: data.updatedByUserId ?? null,
+    marker: readSidebarMarker(data.marker)
   };
 }
 function mapFirestoreRunResult(id, data) {
@@ -1450,7 +1487,7 @@ var FirestoreDatabase = class _FirestoreDatabase {
    *
    * @param actingUserId - User performing the update action.
    */
-  async updateCollection(id, name, variables, headers, preRequestScript, postRequestScript, auth, actingUserId) {
+  async updateCollection(id, name, variables, headers, preRequestScript, postRequestScript, auth, actingUserId, marker) {
     const trimmedName = trimRequiredName(name, "Collection name");
     const updatedAt = /* @__PURE__ */ new Date();
     const docRef = this.requireClient().collection(COLLECTIONS_COLLECTION).doc(id);
@@ -1459,6 +1496,7 @@ var FirestoreDatabase = class _FirestoreDatabase {
       throw new Error("Collection not found");
     }
     const existing = snapshot.data();
+    const serializedMarker = marker !== void 0 ? serializeSidebarMarker(marker) : existing.marker;
     const updated = {
       ...existing,
       name: trimmedName,
@@ -1468,7 +1506,8 @@ var FirestoreDatabase = class _FirestoreDatabase {
       preRequestScript,
       postRequestScript,
       updatedAt,
-      updatedByUserId: actingUserId
+      updatedByUserId: actingUserId,
+      ...marker !== void 0 ? { marker: serializedMarker } : {}
     };
     await docRef.update({
       name: trimmedName,
@@ -1478,7 +1517,8 @@ var FirestoreDatabase = class _FirestoreDatabase {
       preRequestScript,
       postRequestScript,
       updatedAt,
-      updatedByUserId: actingUserId
+      updatedByUserId: actingUserId,
+      ...marker !== void 0 ? { marker: serializedMarker } : {}
     });
     await this.recordAuditEntry(actingUserId, "update", "collection", id);
     return mapFirestoreCollection(id, updated);
@@ -1493,9 +1533,11 @@ var FirestoreDatabase = class _FirestoreDatabase {
     await this.recordAuditEntry(actingUserId, "delete", "collection", id);
     const client = this.requireClient();
     const requestsSnap = await client.collection(REQUESTS_COLLECTION).where("collectionId", "==", id).get();
+    const documentsSnap = await client.collection(DOCUMENTS_COLLECTION).where("collectionId", "==", id).get();
     const foldersSnap = await client.collection(FOLDERS_COLLECTION).where("collectionId", "==", id).get();
     const refs = [
       ...requestsSnap.docs.map((requestDoc) => requestDoc.ref),
+      ...documentsSnap.docs.map((documentDoc) => documentDoc.ref),
       ...foldersSnap.docs.map((folderDoc) => folderDoc.ref),
       client.collection(COLLECTIONS_COLLECTION).doc(id)
     ];
@@ -1578,7 +1620,7 @@ var FirestoreDatabase = class _FirestoreDatabase {
    *
    * @param actingUserId - User performing the update action.
    */
-  async updateEnvironment(id, name, variables, actingUserId) {
+  async updateEnvironment(id, name, variables, actingUserId, marker) {
     const trimmedName = trimRequiredName(name, "Environment name");
     const updatedAt = /* @__PURE__ */ new Date();
     const docRef = this.requireClient().collection(ENVIRONMENTS_COLLECTION).doc(id);
@@ -1587,18 +1629,21 @@ var FirestoreDatabase = class _FirestoreDatabase {
       throw new Error("Environment not found");
     }
     const existing = snapshot.data();
+    const serializedMarker = marker !== void 0 ? serializeSidebarMarker(marker) : existing.marker;
     const updated = {
       ...existing,
       name: trimmedName,
       variables,
       updatedAt,
-      updatedByUserId: actingUserId
+      updatedByUserId: actingUserId,
+      ...marker !== void 0 ? { marker: serializedMarker } : {}
     };
     await docRef.update({
       name: trimmedName,
       variables,
       updatedAt,
-      updatedByUserId: actingUserId
+      updatedByUserId: actingUserId,
+      ...marker !== void 0 ? { marker: serializedMarker } : {}
     });
     await this.recordAuditEntry(actingUserId, "update", "environment", id);
     return mapFirestoreEnvironment(id, updated);
@@ -1811,6 +1856,7 @@ var FirestoreDatabase = class _FirestoreDatabase {
   async saveRequest(input, actingUserId) {
     const trimmedName = trimRequiredName(input.name, "Request name");
     const folderId = input.folderId ?? null;
+    const serializedMarker = serializeSidebarMarker(input.marker ?? null);
     const now = /* @__PURE__ */ new Date();
     const client = this.requireClient();
     if (folderId != null) {
@@ -1843,6 +1889,7 @@ var FirestoreDatabase = class _FirestoreDatabase {
           preRequestScript: input.preRequestScript,
           postRequestScript: input.postRequestScript,
           comment: input.comment,
+          marker: serializedMarker,
           updatedAt: now,
           updatedByUserId: actingUserId
         };
@@ -1860,6 +1907,7 @@ var FirestoreDatabase = class _FirestoreDatabase {
           preRequestScript: input.preRequestScript,
           postRequestScript: input.postRequestScript,
           comment: input.comment,
+          marker: serializedMarker,
           updatedAt: now,
           updatedByUserId: actingUserId
         });
@@ -1884,6 +1932,7 @@ var FirestoreDatabase = class _FirestoreDatabase {
       preRequestScript: input.preRequestScript,
       postRequestScript: input.postRequestScript,
       comment: input.comment,
+      marker: serializedMarker,
       sortOrder: maxOrder + 1,
       createdAt: now,
       updatedAt: now,
@@ -1937,14 +1986,21 @@ var FirestoreDatabase = class _FirestoreDatabase {
    * @param name - Display name for the folder.
    * @param actingUserId - User performing the create action.
    */
-  async createFolder(collectionId, name, actingUserId) {
+  async createFolder(collectionId, name, actingUserId, parentFolderId = null) {
     const trimmedName = trimRequiredName(name, "Folder name");
+    if (parentFolderId != null) {
+      const parent = await this.findFolderById(parentFolderId);
+      if (!parent || parent.collectionId !== collectionId) {
+        throw new Error("Parent folder not found in collection");
+      }
+    }
     const id = randomUUID3();
     const now = /* @__PURE__ */ new Date();
     const existingFolders = await this.listFolders(collectionId);
-    const maxOrder = existingFolders.reduce((max, folder) => Math.max(max, folder.sortOrder), -1);
+    const maxOrder = existingFolders.filter((folder) => folder.parentFolderId === parentFolderId).reduce((max, folder) => Math.max(max, folder.sortOrder), -1);
     const data = {
       collectionId,
+      parentFolderId,
       name: trimmedName,
       sortOrder: maxOrder + 1,
       createdAt: now,
@@ -1963,7 +2019,7 @@ var FirestoreDatabase = class _FirestoreDatabase {
    * @param name - New display name.
    * @param actingUserId - User performing the rename action.
    */
-  async renameFolder(id, name, actingUserId) {
+  async renameFolder(id, name, actingUserId, marker) {
     const trimmedName = trimRequiredName(name, "Folder name");
     const updatedAt = /* @__PURE__ */ new Date();
     const docRef = this.requireClient().collection(FOLDERS_COLLECTION).doc(id);
@@ -1972,17 +2028,24 @@ var FirestoreDatabase = class _FirestoreDatabase {
       throw new Error("Folder not found");
     }
     const existing = snapshot.data();
-    await docRef.update({ name: trimmedName, updatedAt, updatedByUserId: actingUserId });
+    const serializedMarker = marker !== void 0 ? serializeSidebarMarker(marker) : existing.marker;
+    await docRef.update({
+      name: trimmedName,
+      updatedAt,
+      updatedByUserId: actingUserId,
+      ...marker !== void 0 ? { marker: serializedMarker } : {}
+    });
     await this.recordAuditEntry(actingUserId, "update", "folder", id);
     return mapFirestoreFolder(id, {
       ...existing,
       name: trimmedName,
       updatedAt,
-      updatedByUserId: actingUserId
+      updatedByUserId: actingUserId,
+      ...marker !== void 0 ? { marker: serializedMarker } : {}
     });
   }
   /**
-   * Deletes a folder and all requests inside it.
+   * Deletes a folder, its descendants, and their contents.
    *
    * @param id - Folder ID to delete.
    * @param actingUserId - User performing the delete action.
@@ -1990,21 +2053,101 @@ var FirestoreDatabase = class _FirestoreDatabase {
   async deleteFolder(id, actingUserId) {
     await this.recordAuditEntry(actingUserId, "delete", "folder", id);
     const client = this.requireClient();
-    const requestsSnap = await client.collection(REQUESTS_COLLECTION).where("folderId", "==", id).get();
+    const root = await this.findFolderById(id);
+    if (!root) {
+      return;
+    }
+    const folders = await this.listFolders(root.collectionId);
+    const descendantIds = /* @__PURE__ */ new Set([id]);
+    let changed = true;
+    while (changed) {
+      changed = false;
+      for (const folder of folders) {
+        if (folder.parentFolderId != null && descendantIds.has(folder.parentFolderId) && !descendantIds.has(folder.id)) {
+          descendantIds.add(folder.id);
+          changed = true;
+        }
+      }
+    }
+    const ids = [...descendantIds];
+    const requestSnapshots = await Promise.all(
+      ids.map(
+        (folderId) => client.collection(REQUESTS_COLLECTION).where("folderId", "==", folderId).get()
+      )
+    );
+    const documentSnapshots = await Promise.all(
+      ids.map(
+        (folderId) => client.collection(DOCUMENTS_COLLECTION).where("folderId", "==", folderId).get()
+      )
+    );
     const refs = [
-      ...requestsSnap.docs.map((requestDoc) => requestDoc.ref),
-      client.collection(FOLDERS_COLLECTION).doc(id)
+      ...requestSnapshots.flatMap((snapshot) => snapshot.docs.map((requestDoc) => requestDoc.ref)),
+      ...documentSnapshots.flatMap(
+        (snapshot) => snapshot.docs.map((documentDoc) => documentDoc.ref)
+      ),
+      ...ids.map((folderId) => client.collection(FOLDERS_COLLECTION).doc(folderId))
     ];
     await this.commitBatchedDeletes(refs);
   }
   /**
-   * Reorders folders within a collection.
+   * Moves a folder to a new parent and optional sibling position.
+   *
+   * @param id - Folder ID to move.
+   * @param parentFolderId - Destination parent, or null for collection root.
+   * @param sortOrder - Optional zero-based destination sibling index.
+   * @param actingUserId - User performing the move action.
+   */
+  async moveFolder(id, parentFolderId, sortOrder, actingUserId) {
+    const folder = await this.findFolderById(id);
+    if (!folder) {
+      throw new Error("Folder not found");
+    }
+    const folders = await this.listFolders(folder.collectionId);
+    if (parentFolderId != null) {
+      let ancestor = folders.find((entry) => entry.id === parentFolderId);
+      if (!ancestor) {
+        throw new Error("Parent folder not found in collection");
+      }
+      while (ancestor) {
+        if (ancestor.id === id) {
+          throw new Error("Cannot move a folder inside itself or its descendants");
+        }
+        ancestor = ancestor.parentFolderId == null ? void 0 : folders.find((entry) => entry.id === ancestor?.parentFolderId);
+      }
+    }
+    const siblings = folders.filter((entry) => entry.id !== id && entry.parentFolderId === parentFolderId).sort(
+      (left, right) => left.sortOrder - right.sortOrder || left.name.localeCompare(right.name)
+    );
+    const index = Math.max(0, Math.min(sortOrder ?? siblings.length, siblings.length));
+    siblings.splice(index, 0, { ...folder, parentFolderId });
+    const updatedAt = /* @__PURE__ */ new Date();
+    await this.requireClient().collection(FOLDERS_COLLECTION).doc(id).update({
+      parentFolderId,
+      updatedAt,
+      updatedByUserId: actingUserId
+    });
+    await this.reorderFolders(
+      folder.collectionId,
+      parentFolderId,
+      siblings.map((entry) => entry.id),
+      actingUserId
+    );
+    return {
+      ...folder,
+      parentFolderId,
+      sortOrder: index,
+      updatedAt,
+      updatedByUserId: actingUserId
+    };
+  }
+  /**
+   * Reorders sibling folders within a collection.
    *
    * @param collectionId - Collection containing the folders.
    * @param orderedFolderIds - Folder IDs in desired order.
    * @param actingUserId - User performing the reorder action.
    */
-  async reorderFolders(collectionId, orderedFolderIds, actingUserId) {
+  async reorderFolders(collectionId, parentFolderId, orderedFolderIds, actingUserId) {
     const client = this.requireClient();
     const updatedAt = /* @__PURE__ */ new Date();
     const batch = client.batch();
@@ -2019,6 +2162,7 @@ var FirestoreDatabase = class _FirestoreDatabase {
     }
     await batch.commit();
     await this.recordAuditEntry(actingUserId, "reorder", "folder", collectionId, {
+      parentFolderId,
       orderedFolderIds
     });
   }
@@ -2117,6 +2261,206 @@ var FirestoreDatabase = class _FirestoreDatabase {
       index
     });
   }
+  /**
+   * Lists all documents in a collection.
+   *
+   * @param collectionId - Collection to query.
+   */
+  async listDocuments(collectionId) {
+    const snapshot = await this.requireClient().collection(DOCUMENTS_COLLECTION).where("collectionId", "==", collectionId).get();
+    return snapshot.docs.map((doc) => mapFirestoreDocument(doc.id, doc.data())).sort((left, right) => {
+      if (left.sortOrder !== right.sortOrder) {
+        return left.sortOrder - right.sortOrder;
+      }
+      return left.name.localeCompare(right.name);
+    });
+  }
+  /**
+   * Finds a document by id.
+   *
+   * @param id - Document identifier to look up.
+   */
+  async findDocumentById(id) {
+    const snapshot = await this.requireClient().collection(DOCUMENTS_COLLECTION).doc(id).get();
+    if (!snapshot.exists) {
+      return null;
+    }
+    return mapFirestoreDocument(id, snapshot.data());
+  }
+  /**
+   * Inserts a new document or updates an existing one.
+   *
+   * @param input - Document fields to persist.
+   * @param actingUserId - User performing the save action.
+   */
+  async saveDocument(input, actingUserId) {
+    const trimmedName = trimRequiredName(input.name, "Document name");
+    const folderId = input.folderId ?? null;
+    const serializedMarker = serializeSidebarMarker(input.marker ?? null);
+    const now = /* @__PURE__ */ new Date();
+    const client = this.requireClient();
+    if (folderId != null) {
+      const folderSnap = await client.collection(FOLDERS_COLLECTION).doc(folderId).get();
+      if (!folderSnap.exists) {
+        throw new Error("Folder not found");
+      }
+      const folder = folderSnap.data();
+      if (folder.collectionId !== input.collectionId) {
+        throw new Error("Folder not found");
+      }
+    }
+    if (input.id) {
+      const docRef = client.collection(DOCUMENTS_COLLECTION).doc(input.id);
+      const snapshot = await docRef.get();
+      if (snapshot.exists) {
+        const existing = snapshot.data();
+        const updated = {
+          ...existing,
+          collectionId: input.collectionId,
+          folderId,
+          name: trimmedName,
+          content: input.content,
+          marker: serializedMarker,
+          updatedAt: now,
+          updatedByUserId: actingUserId
+        };
+        await docRef.update({
+          collectionId: input.collectionId,
+          folderId,
+          name: trimmedName,
+          content: input.content,
+          marker: serializedMarker,
+          updatedAt: now,
+          updatedByUserId: actingUserId
+        });
+        await this.recordAuditEntry(actingUserId, "update", "document", input.id);
+        return mapFirestoreDocument(input.id, updated);
+      }
+    }
+    const existingDocuments = await this.listDocuments(input.collectionId);
+    const maxOrder = existingDocuments.filter((document) => document.folderId === folderId).reduce((max, document) => Math.max(max, document.sortOrder), -1);
+    const id = randomUUID3();
+    const data = {
+      collectionId: input.collectionId,
+      folderId,
+      name: trimmedName,
+      content: input.content,
+      marker: serializedMarker,
+      sortOrder: maxOrder + 1,
+      createdAt: now,
+      updatedAt: now,
+      createdByUserId: actingUserId,
+      updatedByUserId: actingUserId
+    };
+    await client.collection(DOCUMENTS_COLLECTION).doc(id).set(data);
+    await this.recordAuditEntry(actingUserId, "create", "document", id);
+    return mapFirestoreDocument(id, data);
+  }
+  /**
+   * Deletes a document by ID.
+   *
+   * @param id - Document ID to delete.
+   * @param actingUserId - User performing the delete action.
+   */
+  async deleteDocument(id, actingUserId) {
+    await this.recordAuditEntry(actingUserId, "delete", "document", id);
+    await this.requireClient().collection(DOCUMENTS_COLLECTION).doc(id).delete();
+  }
+  /**
+   * Reorders documents within a folder or at collection root.
+   *
+   * @param actingUserId - User performing the reorder action.
+   */
+  async reorderDocuments(collectionId, folderId, orderedDocumentIds, actingUserId) {
+    const client = this.requireClient();
+    const updatedAt = /* @__PURE__ */ new Date();
+    const batch = client.batch();
+    for (let index = 0; index < orderedDocumentIds.length; index++) {
+      const docRef = client.collection(DOCUMENTS_COLLECTION).doc(orderedDocumentIds[index]);
+      batch.update(docRef, {
+        sortOrder: index,
+        folderId,
+        collectionId,
+        updatedAt,
+        updatedByUserId: actingUserId
+      });
+    }
+    await batch.commit();
+    await this.recordAuditEntry(actingUserId, "reorder", "document", collectionId, {
+      folderId,
+      orderedDocumentIds
+    });
+  }
+  /**
+   * Moves a document to another folder or collection root at a given index.
+   *
+   * @param actingUserId - User performing the move action.
+   */
+  async moveDocument(documentId, folderId, index, actingUserId) {
+    const client = this.requireClient();
+    const updatedAt = /* @__PURE__ */ new Date();
+    const documentSnap = await client.collection(DOCUMENTS_COLLECTION).doc(documentId).get();
+    if (!documentSnap.exists) {
+      throw new Error("Document not found");
+    }
+    const document = mapFirestoreDocument(
+      documentSnap.id,
+      documentSnap.data()
+    );
+    const collectionId = document.collectionId;
+    const oldFolderId = document.folderId;
+    if (folderId != null) {
+      const folderSnap = await client.collection(FOLDERS_COLLECTION).doc(folderId).get();
+      if (!folderSnap.exists) {
+        throw new Error("Folder not found");
+      }
+      const folder = folderSnap.data();
+      if (folder.collectionId !== collectionId) {
+        throw new Error("Folder not found");
+      }
+    }
+    const listInContainer = async (targetFolderId) => {
+      const documents = await this.listDocuments(collectionId);
+      return documents.filter((item) => item.folderId === targetFolderId).sort((left, right) => {
+        if (left.sortOrder !== right.sortOrder) {
+          return left.sortOrder - right.sortOrder;
+        }
+        return left.name.localeCompare(right.name);
+      }).map((item) => item.id);
+    };
+    const reindexContainer = async (targetFolderId, orderedIds) => {
+      const batch = client.batch();
+      for (let sortIndex = 0; sortIndex < orderedIds.length; sortIndex++) {
+        const docRef = client.collection(DOCUMENTS_COLLECTION).doc(orderedIds[sortIndex]);
+        batch.update(docRef, {
+          sortOrder: sortIndex,
+          folderId: targetFolderId,
+          updatedAt,
+          updatedByUserId: actingUserId
+        });
+      }
+      await batch.commit();
+    };
+    if (oldFolderId === folderId) {
+      const siblings = (await listInContainer(folderId)).filter((id) => id !== documentId);
+      siblings.splice(index, 0, documentId);
+      await reindexContainer(folderId, siblings);
+      await this.recordAuditEntry(actingUserId, "move", "document", documentId, {
+        folderId,
+        index
+      });
+      return;
+    }
+    const oldIds = (await listInContainer(oldFolderId)).filter((id) => id !== documentId);
+    await reindexContainer(oldFolderId, oldIds);
+    const newIds = (await listInContainer(folderId)).filter((id) => id !== documentId);
+    newIds.splice(index, 0, documentId);
+    await reindexContainer(folderId, newIds);
+    await this.recordAuditEntry(actingUserId, "move", "document", documentId, {
+      folderId,
+      index
+    });
+  }
   /**
    * Returns monthly LLM usage for a user, or null when no usage has been recorded.
    *
@@ -2441,7 +2785,7 @@ function parseAuditAction(value) {
   throw new Error(`Invalid audit action: ${value}`);
 }
 function parseAuditEntityType2(value) {
-  if (value === "user" || value === "api_token" || value === "invitation" || value === "collection" || value === "environment" || value === "snippet" || value === "folder" || value === "request" || value === "run_result") {
+  if (value === "user" || value === "api_token" || value === "invitation" || value === "collection" || value === "environment" || value === "snippet" || value === "folder" || value === "request" || value === "document" || value === "run_result") {
     return value;
   }
   throw new Error(`Invalid audit entity type: ${value}`);
@@ -2503,7 +2847,8 @@ function mapCollectionSqlRow(row) {
     updatedAt: row.updated_at ?? row.created_at,
     createdByUserId: row.created_by_user_id ?? null,
     updatedByUserId: row.updated_by_user_id ?? null,
-    deletionLocked: Boolean(row.deletion_locked)
+    deletionLocked: Boolean(row.deletion_locked),
+    marker: readSidebarMarker(row.marker)
   };
 }
 function mapEnvironmentSqlRow(row) {
@@ -2515,7 +2860,8 @@ function mapEnvironmentSqlRow(row) {
     updatedAt: row.updated_at ?? row.created_at,
     createdByUserId: row.created_by_user_id ?? null,
     updatedByUserId: row.updated_by_user_id ?? null,
-    deletionLocked: Boolean(row.deletion_locked)
+    deletionLocked: Boolean(row.deletion_locked),
+    marker: readSidebarMarker(row.marker)
   };
 }
 function parseSnippetScope(value) {
@@ -2559,12 +2905,14 @@ function mapFolderSqlRow(row) {
   return {
     id: row.id,
     collectionId: row.collection_id,
+    parentFolderId: row.parent_folder_id,
     name: row.name,
     sortOrder: row.sort_order,
     createdAt: row.created_at,
     updatedAt: row.updated_at ?? row.created_at,
     createdByUserId: row.created_by_user_id ?? null,
-    updatedByUserId: row.updated_by_user_id ?? null
+    updatedByUserId: row.updated_by_user_id ?? null,
+    marker: readSidebarMarker(row.marker)
   };
 }
 function mapRequestSqlRow(row) {
@@ -2587,7 +2935,23 @@ function mapRequestSqlRow(row) {
     createdAt: row.created_at,
     updatedAt: row.updated_at,
     createdByUserId: row.created_by_user_id ?? null,
-    updatedByUserId: row.updated_by_user_id ?? null
+    updatedByUserId: row.updated_by_user_id ?? null,
+    marker: readSidebarMarker(row.marker)
+  };
+}
+function mapDocumentSqlRow(row) {
+  return {
+    id: row.id,
+    collectionId: row.collection_id,
+    folderId: row.folder_id,
+    name: row.name,
+    content: row.content,
+    sortOrder: row.sort_order,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at,
+    createdByUserId: row.created_by_user_id ?? null,
+    updatedByUserId: row.updated_by_user_id ?? null,
+    marker: readSidebarMarker(row.marker)
   };
 }
 
@@ -2659,6 +3023,7 @@ var FOLDERS_MIGRATION_SQL = `
 CREATE TABLE IF NOT EXISTS folders (
   id VARCHAR(36) PRIMARY KEY,
   collection_id VARCHAR(36) NOT NULL,
+  parent_folder_id VARCHAR(36) NULL,
   name VARCHAR(255) NOT NULL,
   sort_order INT NOT NULL DEFAULT 0,
   created_at DATETIME NOT NULL,
@@ -2666,6 +3031,7 @@ CREATE TABLE IF NOT EXISTS folders (
   created_by_user_id VARCHAR(36) NULL,
   updated_by_user_id VARCHAR(36) NULL,
   FOREIGN KEY (collection_id) REFERENCES collections(id) ON DELETE CASCADE,
+  FOREIGN KEY (parent_folder_id) REFERENCES folders(id) ON DELETE CASCADE,
   FOREIGN KEY (created_by_user_id) REFERENCES users(id) ON DELETE SET NULL,
   FOREIGN KEY (updated_by_user_id) REFERENCES users(id) ON DELETE SET NULL
 )
@@ -2697,6 +3063,24 @@ CREATE TABLE IF NOT EXISTS requests (
   FOREIGN KEY (updated_by_user_id) REFERENCES users(id) ON DELETE SET NULL
 )
 `.trim();
+var DOCUMENTS_MIGRATION_SQL = `
+CREATE TABLE IF NOT EXISTS documents (
+  id VARCHAR(36) PRIMARY KEY,
+  collection_id VARCHAR(36) NOT NULL,
+  folder_id VARCHAR(36) NULL,
+  name VARCHAR(255) NOT NULL,
+  content LONGTEXT NOT NULL,
+  sort_order INT NOT NULL DEFAULT 0,
+  created_at DATETIME NOT NULL,
+  updated_at DATETIME NOT NULL,
+  created_by_user_id VARCHAR(36) NULL,
+  updated_by_user_id VARCHAR(36) NULL,
+  FOREIGN KEY (collection_id) REFERENCES collections(id) ON DELETE CASCADE,
+  FOREIGN KEY (folder_id) REFERENCES folders(id) ON DELETE CASCADE,
+  FOREIGN KEY (created_by_user_id) REFERENCES users(id) ON DELETE SET NULL,
+  FOREIGN KEY (updated_by_user_id) REFERENCES users(id) ON DELETE SET NULL
+)
+`.trim();
 var USERS_MIGRATION_SQL = `
 CREATE TABLE IF NOT EXISTS users (
   id VARCHAR(36) PRIMARY KEY,
@@ -2752,6 +3136,10 @@ ALTER TABLE folders
   ADD COLUMN IF NOT EXISTS created_by_user_id VARCHAR(36) NULL,
   ADD COLUMN IF NOT EXISTS updated_by_user_id VARCHAR(36) NULL
 `.trim();
+var FOLDERS_PARENT_MIGRATION_SQL = `
+ALTER TABLE folders
+  ADD COLUMN IF NOT EXISTS parent_folder_id VARCHAR(36) NULL
+`.trim();
 var REQUESTS_ATTRIBUTION_MIGRATION_SQL = `
 ALTER TABLE requests
   ADD COLUMN IF NOT EXISTS created_by_user_id VARCHAR(36) NULL,
@@ -2866,6 +3254,17 @@ CREATE TABLE IF NOT EXISTS user_invitations (
   CONSTRAINT user_invitations_updated_by_fk FOREIGN KEY (updated_by_user_id) REFERENCES users(id) ON DELETE SET NULL
 )
 `.trim();
+var MARKER_TABLES = ["collections", "folders", "requests", "documents", "environments"];
+function buildMarkerRenameSql(table) {
+  return `ALTER TABLE ${table} RENAME COLUMN IF EXISTS color TO marker`;
+}
+function buildMarkerAddSql(table) {
+  return `ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS marker TEXT`;
+}
+var MARKER_MIGRATIONS_SQL = [
+  ...MARKER_TABLES.map(buildMarkerRenameSql),
+  ...MARKER_TABLES.map(buildMarkerAddSql)
+];
 var MYSQL_MIGRATIONS = [
   USERS_MIGRATION_SQL,
   API_TOKENS_MIGRATION_SQL,
@@ -2874,12 +3273,14 @@ var MYSQL_MIGRATIONS = [
   SNIPPETS_MIGRATION_SQL,
   FOLDERS_MIGRATION_SQL,
   REQUESTS_MIGRATION_SQL,
+  DOCUMENTS_MIGRATION_SQL,
   AUDIT_LOG_MIGRATION_SQL,
   API_TOKENS_USER_ID_MIGRATION_SQL,
   API_TOKENS_ATTRIBUTION_MIGRATION_SQL,
   COLLECTIONS_ATTRIBUTION_MIGRATION_SQL,
   ENVIRONMENTS_ATTRIBUTION_MIGRATION_SQL,
   FOLDERS_ATTRIBUTION_MIGRATION_SQL,
+  FOLDERS_PARENT_MIGRATION_SQL,
   REQUESTS_ATTRIBUTION_MIGRATION_SQL,
   USERS_ATTRIBUTION_MIGRATION_SQL,
   COLLECTIONS_BACKFILL_UPDATED_AT_SQL,
@@ -2893,7 +3294,8 @@ var MYSQL_MIGRATIONS = [
   USERS_SNIPPET_ACCESS_MIGRATION_SQL,
   USERS_SNIPPET_ACCESS_BACKFILL_SQL,
   RUN_RESULTS_MIGRATION_SQL,
-  USER_INVITATIONS_MIGRATION_SQL
+  USER_INVITATIONS_MIGRATION_SQL,
+  ...MARKER_MIGRATIONS_SQL
 ];
 
 // src/db/mysql/schemas.ts
@@ -2951,11 +3353,12 @@ function serializeAccessList(access) {
   return JSON.stringify(access);
 }
 var USER_SELECT_COLUMNS = `id, name, role, collection_access, environment_access, snippet_access, llm_access, llm_models, llm_monthly_token_limit, created_at, updated_at, created_by_user_id, updated_by_user_id`;
-var COLLECTION_SELECT_COLUMNS = `id, name, variables, headers, auth, pre_request_script, post_request_script, created_at, updated_at, created_by_user_id, updated_by_user_id, deletion_locked`;
-var ENVIRONMENT_SELECT_COLUMNS = `id, name, variables, created_at, updated_at, created_by_user_id, updated_by_user_id, deletion_locked`;
+var COLLECTION_SELECT_COLUMNS = `id, name, variables, headers, auth, pre_request_script, post_request_script, created_at, updated_at, created_by_user_id, updated_by_user_id, deletion_locked, marker`;
+var ENVIRONMENT_SELECT_COLUMNS = `id, name, variables, created_at, updated_at, created_by_user_id, updated_by_user_id, deletion_locked, marker`;
 var SNIPPET_SELECT_COLUMNS = `id, name, code, scope, sort_order, created_at, updated_at, created_by_user_id, updated_by_user_id, deletion_locked`;
-var FOLDER_SELECT_COLUMNS = `id, collection_id, name, sort_order, created_at, updated_at, created_by_user_id, updated_by_user_id`;
-var REQUEST_SELECT_COLUMNS = `id, collection_id, folder_id, name, method, url, headers, params, auth, body, body_type, pre_request_script, post_request_script, comment, sort_order, created_at, updated_at, created_by_user_id, updated_by_user_id`;
+var FOLDER_SELECT_COLUMNS = `id, collection_id, parent_folder_id, name, sort_order, created_at, updated_at, created_by_user_id, updated_by_user_id, marker`;
+var REQUEST_SELECT_COLUMNS = `id, collection_id, folder_id, name, method, url, headers, params, auth, body, body_type, pre_request_script, post_request_script, comment, sort_order, created_at, updated_at, created_by_user_id, updated_by_user_id, marker`;
+var DOCUMENT_SELECT_COLUMNS = `id, collection_id, folder_id, name, content, sort_order, created_at, updated_at, created_by_user_id, updated_by_user_id, marker`;
 var API_TOKEN_SELECT_COLUMNS = `id, user_id, name, token_hash, token_prefix, created_at, last_used_at, revoked_at, created_by_user_id, updated_by_user_id`;
 var AUDIT_LOG_SELECT_COLUMNS = `id, user_id, user_name, action, entity_type, entity_id, created_at, metadata`;
 
@@ -3003,6 +3406,7 @@ var USER_SELECT = `SELECT ${USER_SELECT_COLUMNS} FROM users`;
 var API_TOKEN_SELECT = `SELECT ${API_TOKEN_SELECT_COLUMNS} FROM api_tokens`;
 var FOLDER_SELECT = `SELECT ${FOLDER_SELECT_COLUMNS} FROM folders`;
 var REQUEST_SELECT = `SELECT ${REQUEST_SELECT_COLUMNS} FROM requests`;
+var DOCUMENT_SELECT = `SELECT ${DOCUMENT_SELECT_COLUMNS} FROM documents`;
 var AUDIT_LOG_SELECT = `SELECT ${AUDIT_LOG_SELECT_COLUMNS} FROM audit_log`;
 var LLM_USAGE_SELECT = `SELECT ${LLM_USAGE_SELECT_COLUMNS} FROM llm_usage`;
 var LLM_USAGE_LOG_SELECT = `SELECT ${LLM_USAGE_LOG_SELECT_COLUMNS} FROM llm_usage_log`;
@@ -3794,10 +4198,10 @@ var MysqlDatabase = class _MysqlDatabase {
    *
    * @param actingUserId - User performing the update action.
    */
-  async updateCollection(id, name, variables, headers, preRequestScript, postRequestScript, auth, actingUserId) {
+  async updateCollection(id, name, variables, headers, preRequestScript, postRequestScript, auth, actingUserId, marker) {
     const trimmedName = trimRequiredName(name, "Collection name");
     const updatedAt = /* @__PURE__ */ new Date();
-    const result = await this.executeStatement(
+    const result = marker !== void 0 ? await this.executeStatement(
       `UPDATE collections
       SET name = ?,
         variables = ?,
@@ -3806,7 +4210,8 @@ var MysqlDatabase = class _MysqlDatabase {
         pre_request_script = ?,
         post_request_script = ?,
         updated_at = ?,
-        updated_by_user_id = ?
+        updated_by_user_id = ?,
+        marker = ?
       WHERE id = ?`,
       [
         trimmedName,
@@ -3817,9 +4222,32 @@ var MysqlDatabase = class _MysqlDatabase {
         postRequestScript,
         updatedAt,
         actingUserId,
+        serializeSidebarMarker(marker),
         id
       ]
-    );
+    ) : await this.executeStatement(
+      `UPDATE collections
+      SET name = ?,
+        variables = ?,
+        headers = ?,
+        auth = ?,
+        pre_request_script = ?,
+        post_request_script = ?,
+        updated_at = ?,
+        updated_by_user_id = ?
+      WHERE id = ?`,
+      [
+        trimmedName,
+        JSON.stringify(variables),
+        JSON.stringify(headers),
+        JSON.stringify(auth),
+        preRequestScript,
+        postRequestScript,
+        updatedAt,
+        actingUserId,
+        id
+      ]
+    );
     if ((result.affectedRows ?? 0) === 0) {
       throw new Error("Collection not found");
     }
@@ -3935,10 +4363,26 @@ var MysqlDatabase = class _MysqlDatabase {
    *
    * @param actingUserId - User performing the update action.
    */
-  async updateEnvironment(id, name, variables, actingUserId) {
+  async updateEnvironment(id, name, variables, actingUserId, marker) {
     const trimmedName = trimRequiredName(name, "Environment name");
     const updatedAt = /* @__PURE__ */ new Date();
-    const result = await this.executeStatement(
+    const result = marker !== void 0 ? await this.executeStatement(
+      `UPDATE environments
+      SET name = ?,
+        variables = ?,
+        updated_at = ?,
+        updated_by_user_id = ?,
+        marker = ?
+      WHERE id = ?`,
+      [
+        trimmedName,
+        JSON.stringify(variables),
+        updatedAt,
+        actingUserId,
+        serializeSidebarMarker(marker),
+        id
+      ]
+    ) : await this.executeStatement(
       `UPDATE environments
       SET name = ?,
         variables = ?,
@@ -4189,6 +4633,7 @@ var MysqlDatabase = class _MysqlDatabase {
     const params = JSON.stringify(input.params);
     const auth = JSON.stringify(input.auth);
     const folderId = input.folderId ?? null;
+    const serializedMarker = serializeSidebarMarker(input.marker ?? null);
     const now = /* @__PURE__ */ new Date();
     if (folderId != null) {
       const folderRows = await this.queryRows(
@@ -4216,6 +4661,7 @@ var MysqlDatabase = class _MysqlDatabase {
           pre_request_script = ?,
           post_request_script = ?,
           comment = ?,
+          marker = ?,
           updated_at = ?,
           updated_by_user_id = ?
         WHERE id = ?`,
@@ -4233,6 +4679,7 @@ var MysqlDatabase = class _MysqlDatabase {
           input.preRequestScript,
           input.postRequestScript,
           input.comment,
+          serializedMarker,
           now,
           actingUserId,
           input.id
@@ -4274,12 +4721,13 @@ var MysqlDatabase = class _MysqlDatabase {
         pre_request_script,
         post_request_script,
         comment,
+        marker,
         sort_order,
         created_at,
         updated_at,
         created_by_user_id,
         updated_by_user_id
-      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
       [
         id,
         input.collectionId,
@@ -4295,6 +4743,7 @@ var MysqlDatabase = class _MysqlDatabase {
         input.preRequestScript,
         input.postRequestScript,
         input.comment,
+        serializedMarker,
         maxOrder + 1,
         now,
         now,
@@ -4355,27 +4804,46 @@ var MysqlDatabase = class _MysqlDatabase {
    * @param name - Display name for the folder.
    * @param actingUserId - User performing the create action.
    */
-  async createFolder(collectionId, name, actingUserId) {
+  async createFolder(collectionId, name, actingUserId, parentFolderId = null) {
     const trimmedName = trimRequiredName(name, "Folder name");
+    if (parentFolderId != null) {
+      const parent = await this.findFolderById(parentFolderId);
+      if (!parent || parent.collectionId !== collectionId) {
+        throw new Error("Parent folder not found in collection");
+      }
+    }
     const id = randomUUID4();
     const now = /* @__PURE__ */ new Date();
     const maxRows = await this.queryRows(
-      "SELECT COALESCE(MAX(sort_order), -1) AS max_order FROM folders WHERE collection_id = ?",
-      [collectionId]
+      `SELECT COALESCE(MAX(sort_order), -1) AS max_order
+       FROM folders
+       WHERE collection_id = ? AND parent_folder_id <=> ?`,
+      [collectionId, parentFolderId]
     );
     const maxOrder = maxRows[0]?.max_order ?? -1;
     await this.executeStatement(
       `INSERT INTO folders (
         id,
         collection_id,
+        parent_folder_id,
         name,
         sort_order,
         created_at,
         updated_at,
         created_by_user_id,
         updated_by_user_id
-      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
-      [id, collectionId, trimmedName, maxOrder + 1, now, now, actingUserId, actingUserId]
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      [
+        id,
+        collectionId,
+        parentFolderId,
+        trimmedName,
+        maxOrder + 1,
+        now,
+        now,
+        actingUserId,
+        actingUserId
+      ]
     );
     await this.recordAuditEntry(actingUserId, "create", "folder", id);
     const rows = await this.queryRows(
@@ -4395,10 +4863,18 @@ var MysqlDatabase = class _MysqlDatabase {
    * @param name - New display name.
    * @param actingUserId - User performing the rename action.
    */
-  async renameFolder(id, name, actingUserId) {
+  async renameFolder(id, name, actingUserId, marker) {
     const trimmedName = trimRequiredName(name, "Folder name");
     const updatedAt = /* @__PURE__ */ new Date();
-    const result = await this.executeStatement(
+    const result = marker !== void 0 ? await this.executeStatement(
+      `UPDATE folders
+      SET name = ?,
+        updated_at = ?,
+        updated_by_user_id = ?,
+        marker = ?
+      WHERE id = ?`,
+      [trimmedName, updatedAt, actingUserId, serializeSidebarMarker(marker), id]
+    ) : await this.executeStatement(
       `UPDATE folders
       SET name = ?,
         updated_at = ?,
@@ -4421,18 +4897,39 @@ var MysqlDatabase = class _MysqlDatabase {
     return mapFolderSqlRow(row);
   }
   /**
-   * Deletes a folder and all requests inside it.
+   * Deletes a folder, its descendants, and their contents.
    *
    * @param id - Folder ID to delete.
    * @param actingUserId - User performing the delete action.
    */
   async deleteFolder(id, actingUserId) {
     await this.recordAuditEntry(actingUserId, "delete", "folder", id);
+    const root = await this.findFolderById(id);
+    if (!root) {
+      return;
+    }
+    const folders = await this.listFolders(root.collectionId);
+    const descendantIds = /* @__PURE__ */ new Set([id]);
+    let changed = true;
+    while (changed) {
+      changed = false;
+      for (const folder of folders) {
+        if (folder.parentFolderId != null && descendantIds.has(folder.parentFolderId) && !descendantIds.has(folder.id)) {
+          descendantIds.add(folder.id);
+          changed = true;
+        }
+      }
+    }
+    const ids = [...descendantIds];
+    const placeholders = ids.map(() => "?").join(", ");
     const connection = await this.requirePool().getConnection();
     try {
       await connection.beginTransaction();
-      await connection.execute("DELETE FROM requests WHERE folder_id = ?", [id]);
-      await connection.execute("DELETE FROM folders WHERE id = ?", [id]);
+      await connection.execute(`DELETE FROM documents WHERE folder_id IN (${placeholders})`, ids);
+      await connection.execute(`DELETE FROM requests WHERE folder_id IN (${placeholders})`, ids);
+      for (const folderId of ids.reverse()) {
+        await connection.execute("DELETE FROM folders WHERE id = ?", [folderId]);
+      }
       await connection.commit();
     } catch (err) {
       await connection.rollback();
@@ -4442,13 +4939,62 @@ var MysqlDatabase = class _MysqlDatabase {
     }
   }
   /**
-   * Reorders folders within a collection.
+   * Moves a folder to a new parent and optional sibling position.
+   *
+   * @param id - Folder ID to move.
+   * @param parentFolderId - Destination parent, or null for collection root.
+   * @param sortOrder - Optional zero-based destination sibling index.
+   * @param actingUserId - User performing the move action.
+   */
+  async moveFolder(id, parentFolderId, sortOrder, actingUserId) {
+    const folder = await this.findFolderById(id);
+    if (!folder) {
+      throw new Error("Folder not found");
+    }
+    const folders = await this.listFolders(folder.collectionId);
+    if (parentFolderId != null) {
+      let ancestor = folders.find((entry) => entry.id === parentFolderId);
+      if (!ancestor) {
+        throw new Error("Parent folder not found in collection");
+      }
+      while (ancestor) {
+        if (ancestor.id === id) {
+          throw new Error("Cannot move a folder inside itself or its descendants");
+        }
+        ancestor = ancestor.parentFolderId == null ? void 0 : folders.find((entry) => entry.id === ancestor?.parentFolderId);
+      }
+    }
+    const siblings = folders.filter((entry) => entry.id !== id && entry.parentFolderId === parentFolderId).sort(
+      (left, right) => left.sortOrder - right.sortOrder || left.name.localeCompare(right.name)
+    );
+    const index = Math.max(0, Math.min(sortOrder ?? siblings.length, siblings.length));
+    siblings.splice(index, 0, { ...folder, parentFolderId });
+    await this.executeStatement(
+      `UPDATE folders
+       SET parent_folder_id = ?, updated_at = ?, updated_by_user_id = ?
+       WHERE id = ?`,
+      [parentFolderId, /* @__PURE__ */ new Date(), actingUserId, id]
+    );
+    await this.reorderFolders(
+      folder.collectionId,
+      parentFolderId,
+      siblings.map((entry) => entry.id),
+      actingUserId
+    );
+    const moved = await this.findFolderById(id);
+    if (!moved) {
+      throw new Error("Folder not found after move");
+    }
+    return moved;
+  }
+  /**
+   * Reorders sibling folders within a collection.
    *
    * @param collectionId - Collection containing the folders.
    * @param orderedFolderIds - Folder IDs in desired order.
    * @param actingUserId - User performing the reorder action.
    */
-  async reorderFolders(collectionId, orderedFolderIds, actingUserId) {
+  async reorderFolders(collectionId, parentFolderId, orderedFolderIds, actingUserId) {
     const connection = await this.requirePool().getConnection();
     const updatedAt = /* @__PURE__ */ new Date();
     try {
@@ -4459,8 +5005,8 @@ var MysqlDatabase = class _MysqlDatabase {
           SET sort_order = ?,
             updated_at = ?,
             updated_by_user_id = ?
-          WHERE id = ? AND collection_id = ?`,
-          [index, updatedAt, actingUserId, orderedFolderIds[index], collectionId]
+          WHERE id = ? AND collection_id = ? AND parent_folder_id <=> ?`,
+          [index, updatedAt, actingUserId, orderedFolderIds[index], collectionId, parentFolderId]
         );
       }
       await connection.commit();
@@ -4471,6 +5017,7 @@ var MysqlDatabase = class _MysqlDatabase {
       connection.release();
     }
     await this.recordAuditEntry(actingUserId, "reorder", "collection", collectionId, {
+      parentFolderId,
       orderedFolderIds
     });
   }
@@ -4587,122 +5134,374 @@ var MysqlDatabase = class _MysqlDatabase {
     });
   }
   /**
-   * Returns monthly LLM usage for a user, or null when no usage has been recorded.
+   * Lists all documents in a collection.
    *
-   * @param userId - Owning user identifier.
-   * @param period - UTC calendar month key (`YYYY-MM`).
+   * @param collectionId - Collection to query.
    */
-  async getLlmUsage(userId, period) {
-    const [rows] = await this.requirePool().execute(
-      `${LLM_USAGE_SELECT} WHERE user_id = ? AND period = ? LIMIT 1`,
-      [userId, period]
+  async listDocuments(collectionId) {
+    const rows = await this.queryRows(
+      `${DOCUMENT_SELECT} WHERE collection_id = ? ORDER BY sort_order ASC, name ASC`,
+      [collectionId]
     );
-    const row = rows[0];
-    return row ? mapLlmUsageSqlRow(row) : null;
+    return rows.map(mapDocumentSqlRow);
   }
   /**
-   * Atomically increments monthly LLM token usage for a user.
+   * Finds a document by id.
    *
-   * @param userId - Owning user identifier.
-   * @param period - UTC calendar month key (`YYYY-MM`).
-   * @param promptTokens - Prompt tokens to add.
-   * @param completionTokens - Completion tokens to add.
+   * @param id - Document identifier to look up.
    */
-  async addLlmUsage(userId, period, promptTokens, completionTokens) {
-    const totalDelta = promptTokens + completionTokens;
-    const now = /* @__PURE__ */ new Date();
-    const id = randomUUID4();
-    await this.executeStatement(
-      `INSERT INTO llm_usage (
-        id,
-        user_id,
-        period,
-        prompt_tokens,
-        completion_tokens,
-        total_tokens,
-        updated_at
-      ) VALUES (?, ?, ?, ?, ?, ?, ?)
-      ON DUPLICATE KEY UPDATE
-        prompt_tokens = prompt_tokens + VALUES(prompt_tokens),
-        completion_tokens = completion_tokens + VALUES(completion_tokens),
-        total_tokens = total_tokens + VALUES(total_tokens),
-        updated_at = VALUES(updated_at)`,
-      [id, userId, period, promptTokens, completionTokens, totalDelta, now]
+  async findDocumentById(id) {
+    const rows = await this.queryRows(
+      `${DOCUMENT_SELECT} WHERE id = ? LIMIT 1`,
+      [id]
     );
-    const usage = await this.getLlmUsage(userId, period);
-    if (!usage) {
-      throw new Error("LLM usage not found after upsert");
-    }
-    return usage;
+    const row = rows[0];
+    return row ? mapDocumentSqlRow(row) : null;
   }
   /**
-   * Inserts a per-request LLM usage log entry.
+   * Inserts a new document or updates an existing one.
    *
-   * @param input - Usage details for one successful completion step.
+   * @param input - Document fields to persist.
+   * @param actingUserId - User performing the save action.
    */
-  async createLlmUsageLog(input) {
-    const id = randomUUID4();
+  async saveDocument(input, actingUserId) {
+    const trimmedName = trimRequiredName(input.name, "Document name");
+    const folderId = input.folderId ?? null;
+    const serializedMarker = serializeSidebarMarker(input.marker ?? null);
     const now = /* @__PURE__ */ new Date();
+    if (folderId != null) {
+      const folderRows = await this.queryRows(
+        "SELECT collection_id FROM folders WHERE id = ?",
+        [folderId]
+      );
+      const folderRow = folderRows[0];
+      if (!folderRow || folderRow.collection_id !== input.collectionId) {
+        throw new Error("Folder not found");
+      }
+    }
+    if (input.id) {
+      const result = await this.executeStatement(
+        `UPDATE documents SET
+          collection_id = ?,
+          folder_id = ?,
+          name = ?,
+          content = ?,
+          marker = ?,
+          updated_at = ?,
+          updated_by_user_id = ?
+        WHERE id = ?`,
+        [
+          input.collectionId,
+          folderId,
+          trimmedName,
+          input.content,
+          serializedMarker,
+          now,
+          actingUserId,
+          input.id
+        ]
+      );
+      if ((result.affectedRows ?? 0) > 0) {
+        await this.recordAuditEntry(actingUserId, "update", "document", input.id);
+        const rows2 = await this.queryRows(
+          `${DOCUMENT_SELECT} WHERE id = ?`,
+          [input.id]
+        );
+        const row2 = rows2[0];
+        if (row2) {
+          return mapDocumentSqlRow(row2);
+        }
+      }
+    }
+    const maxRows = await this.queryRows(
+      `SELECT COALESCE(MAX(sort_order), -1) AS max_order FROM documents
+       WHERE collection_id = ?
+         AND ((? IS NULL AND folder_id IS NULL) OR folder_id = ?)`,
+      [input.collectionId, folderId, folderId]
+    );
+    const maxOrder = maxRows[0]?.max_order ?? -1;
+    const id = randomUUID4();
     await this.executeStatement(
-      `INSERT INTO llm_usage_log (
+      `INSERT INTO documents (
         id,
-        user_id,
-        api_token_id,
-        period,
-        model,
-        provider,
-        prompt_tokens,
-        completion_tokens,
-        total_tokens,
-        is_new_turn,
-        had_tool_calls,
-        message_count,
-        created_at
-      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+        collection_id,
+        folder_id,
+        name,
+        content,
+        marker,
+        sort_order,
+        created_at,
+        updated_at,
+        created_by_user_id,
+        updated_by_user_id
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
       [
         id,
-        input.userId,
-        input.apiTokenId,
-        input.period,
-        input.model,
-        input.provider,
-        input.promptTokens,
-        input.completionTokens,
-        input.totalTokens,
-        input.isNewTurn ? 1 : 0,
-        input.hadToolCalls ? 1 : 0,
-        input.messageCount,
-        now
+        input.collectionId,
+        folderId,
+        trimmedName,
+        input.content,
+        serializedMarker,
+        maxOrder + 1,
+        now,
+        now,
+        actingUserId,
+        actingUserId
       ]
     );
+    await this.recordAuditEntry(actingUserId, "create", "document", id);
     const rows = await this.queryRows(
-      `${LLM_USAGE_LOG_SELECT} WHERE id = ?`,
+      `${DOCUMENT_SELECT} WHERE id = ?`,
       [id]
     );
     const row = rows[0];
     if (!row) {
-      throw new Error("LLM usage log not found after insert");
+      throw new Error("Document not found after insert");
     }
-    return mapLlmUsageLogSqlRow(row);
+    return mapDocumentSqlRow(row);
   }
   /**
-   * Lists all per-request LLM usage log entries, newest first.
+   * Deletes a document by ID.
+   *
+   * @param id - Document ID to delete.
+   * @param actingUserId - User performing the delete action.
    */
-  async listLlmUsageLogs() {
-    const rows = await this.queryRows(
-      `${LLM_USAGE_LOG_SELECT} ORDER BY created_at DESC`
-    );
-    return rows.map(mapLlmUsageLogSqlRow);
+  async deleteDocument(id, actingUserId) {
+    await this.recordAuditEntry(actingUserId, "delete", "document", id);
+    await this.executeStatement("DELETE FROM documents WHERE id = ?", [id]);
   }
   /**
-   * Lists run results saved by the given user, newest first.
+   * Reorders documents within a folder or at collection root.
+   *
+   * @param actingUserId - User performing the reorder action.
    */
-  async listRunResultsForUser(userId) {
-    const rows = await this.queryRows(
-      `${RUN_RESULT_SELECT} WHERE created_by_user_id = ? ORDER BY created_at DESC`,
-      [userId]
-    );
-    return rows.map(mapRunResultSqlRow);
+  async reorderDocuments(collectionId, folderId, orderedDocumentIds, actingUserId) {
+    const connection = await this.requirePool().getConnection();
+    const updatedAt = /* @__PURE__ */ new Date();
+    try {
+      await connection.beginTransaction();
+      for (let index = 0; index < orderedDocumentIds.length; index++) {
+        await connection.execute(
+          `UPDATE documents
+          SET sort_order = ?,
+            folder_id = ?,
+            updated_at = ?,
+            updated_by_user_id = ?
+          WHERE id = ? AND collection_id = ?`,
+          [index, folderId, updatedAt, actingUserId, orderedDocumentIds[index], collectionId]
+        );
+      }
+      await connection.commit();
+    } catch (err) {
+      await connection.rollback();
+      throw err;
+    } finally {
+      connection.release();
+    }
+    await this.recordAuditEntry(actingUserId, "reorder", "document", collectionId, {
+      folderId,
+      orderedDocumentIds
+    });
+  }
+  /**
+   * Moves a document to another folder or collection root at a given index.
+   *
+   * @param actingUserId - User performing the move action.
+   */
+  async moveDocument(documentId, folderId, index, actingUserId) {
+    const connection = await this.requirePool().getConnection();
+    const updatedAt = /* @__PURE__ */ new Date();
+    const listInContainer = async (collectionId, targetFolderId) => {
+      const rows = await this.queryRows(
+        `SELECT id FROM documents WHERE collection_id = ?
+         AND ((? IS NULL AND folder_id IS NULL) OR folder_id = ?)
+         ORDER BY sort_order ASC, name ASC`,
+        [collectionId, targetFolderId, targetFolderId]
+      );
+      return rows.map((row) => row.id);
+    };
+    const reindexContainer = async (targetFolderId, orderedIds) => {
+      for (let sortIndex = 0; sortIndex < orderedIds.length; sortIndex++) {
+        await connection.execute(
+          `UPDATE documents
+          SET sort_order = ?,
+            folder_id = ?,
+            updated_at = ?,
+            updated_by_user_id = ?
+          WHERE id = ?`,
+          [sortIndex, targetFolderId, updatedAt, actingUserId, orderedIds[sortIndex]]
+        );
+      }
+    };
+    try {
+      await connection.beginTransaction();
+      const documentRows = await this.queryRows(
+        `${DOCUMENT_SELECT} WHERE id = ?`,
+        [documentId]
+      );
+      const documentRow = documentRows[0];
+      if (!documentRow) {
+        throw new Error("Document not found");
+      }
+      const document = mapDocumentSqlRow(documentRow);
+      const collectionId = document.collectionId;
+      const oldFolderId = document.folderId;
+      if (folderId != null) {
+        const folderRows = await this.queryRows(
+          "SELECT collection_id FROM folders WHERE id = ?",
+          [folderId]
+        );
+        const folderRow = folderRows[0];
+        if (!folderRow || folderRow.collection_id !== collectionId) {
+          throw new Error("Folder not found");
+        }
+      }
+      if (oldFolderId === folderId) {
+        const siblings = (await listInContainer(collectionId, folderId)).filter(
+          (id) => id !== documentId
+        );
+        siblings.splice(index, 0, documentId);
+        await reindexContainer(folderId, siblings);
+      } else {
+        const oldIds = (await listInContainer(collectionId, oldFolderId)).filter(
+          (id) => id !== documentId
+        );
+        await reindexContainer(oldFolderId, oldIds);
+        const newIds = (await listInContainer(collectionId, folderId)).filter(
+          (id) => id !== documentId
+        );
+        newIds.splice(index, 0, documentId);
+        await reindexContainer(folderId, newIds);
+      }
+      await connection.commit();
+    } catch (err) {
+      await connection.rollback();
+      throw err;
+    } finally {
+      connection.release();
+    }
+    await this.recordAuditEntry(actingUserId, "move", "document", documentId, {
+      folderId,
+      index
+    });
+  }
+  /**
+   * Returns monthly LLM usage for a user, or null when no usage has been recorded.
+   *
+   * @param userId - Owning user identifier.
+   * @param period - UTC calendar month key (`YYYY-MM`).
+   */
+  async getLlmUsage(userId, period) {
+    const [rows] = await this.requirePool().execute(
+      `${LLM_USAGE_SELECT} WHERE user_id = ? AND period = ? LIMIT 1`,
+      [userId, period]
+    );
+    const row = rows[0];
+    return row ? mapLlmUsageSqlRow(row) : null;
+  }
+  /**
+   * Atomically increments monthly LLM token usage for a user.
+   *
+   * @param userId - Owning user identifier.
+   * @param period - UTC calendar month key (`YYYY-MM`).
+   * @param promptTokens - Prompt tokens to add.
+   * @param completionTokens - Completion tokens to add.
+   */
+  async addLlmUsage(userId, period, promptTokens, completionTokens) {
+    const totalDelta = promptTokens + completionTokens;
+    const now = /* @__PURE__ */ new Date();
+    const id = randomUUID4();
+    await this.executeStatement(
+      `INSERT INTO llm_usage (
+        id,
+        user_id,
+        period,
+        prompt_tokens,
+        completion_tokens,
+        total_tokens,
+        updated_at
+      ) VALUES (?, ?, ?, ?, ?, ?, ?)
+      ON DUPLICATE KEY UPDATE
+        prompt_tokens = prompt_tokens + VALUES(prompt_tokens),
+        completion_tokens = completion_tokens + VALUES(completion_tokens),
+        total_tokens = total_tokens + VALUES(total_tokens),
+        updated_at = VALUES(updated_at)`,
+      [id, userId, period, promptTokens, completionTokens, totalDelta, now]
+    );
+    const usage = await this.getLlmUsage(userId, period);
+    if (!usage) {
+      throw new Error("LLM usage not found after upsert");
+    }
+    return usage;
+  }
+  /**
+   * Inserts a per-request LLM usage log entry.
+   *
+   * @param input - Usage details for one successful completion step.
+   */
+  async createLlmUsageLog(input) {
+    const id = randomUUID4();
+    const now = /* @__PURE__ */ new Date();
+    await this.executeStatement(
+      `INSERT INTO llm_usage_log (
+        id,
+        user_id,
+        api_token_id,
+        period,
+        model,
+        provider,
+        prompt_tokens,
+        completion_tokens,
+        total_tokens,
+        is_new_turn,
+        had_tool_calls,
+        message_count,
+        created_at
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      [
+        id,
+        input.userId,
+        input.apiTokenId,
+        input.period,
+        input.model,
+        input.provider,
+        input.promptTokens,
+        input.completionTokens,
+        input.totalTokens,
+        input.isNewTurn ? 1 : 0,
+        input.hadToolCalls ? 1 : 0,
+        input.messageCount,
+        now
+      ]
+    );
+    const rows = await this.queryRows(
+      `${LLM_USAGE_LOG_SELECT} WHERE id = ?`,
+      [id]
+    );
+    const row = rows[0];
+    if (!row) {
+      throw new Error("LLM usage log not found after insert");
+    }
+    return mapLlmUsageLogSqlRow(row);
+  }
+  /**
+   * Lists all per-request LLM usage log entries, newest first.
+   */
+  async listLlmUsageLogs() {
+    const rows = await this.queryRows(
+      `${LLM_USAGE_LOG_SELECT} ORDER BY created_at DESC`
+    );
+    return rows.map(mapLlmUsageLogSqlRow);
+  }
+  /**
+   * Lists run results saved by the given user, newest first.
+   */
+  async listRunResultsForUser(userId) {
+    const rows = await this.queryRows(
+      `${RUN_RESULT_SELECT} WHERE created_by_user_id = ? ORDER BY created_at DESC`,
+      [userId]
+    );
+    return rows.map(mapRunResultSqlRow);
   }
   /**
    * Lists all run results for admin inspection, newest first.
@@ -4978,6 +5777,7 @@ var FOLDERS_MIGRATION_SQL2 = `
 CREATE TABLE IF NOT EXISTS folders (
   id TEXT PRIMARY KEY,
   collection_id TEXT NOT NULL,
+  parent_folder_id TEXT REFERENCES folders(id) ON DELETE CASCADE,
   name TEXT NOT NULL,
   sort_order INT NOT NULL DEFAULT 0,
   created_at TIMESTAMPTZ NOT NULL,
@@ -5012,6 +5812,22 @@ CREATE TABLE IF NOT EXISTS requests (
   FOREIGN KEY (folder_id) REFERENCES folders(id) ON DELETE CASCADE
 );
 `.trim();
+var DOCUMENTS_MIGRATION_SQL2 = `
+CREATE TABLE IF NOT EXISTS documents (
+  id TEXT PRIMARY KEY,
+  collection_id TEXT NOT NULL,
+  folder_id TEXT,
+  name TEXT NOT NULL,
+  content TEXT NOT NULL DEFAULT '',
+  sort_order INT NOT NULL DEFAULT 0,
+  created_at TIMESTAMPTZ NOT NULL,
+  updated_at TIMESTAMPTZ NOT NULL,
+  created_by_user_id TEXT REFERENCES users(id) ON DELETE SET NULL,
+  updated_by_user_id TEXT REFERENCES users(id) ON DELETE SET NULL,
+  FOREIGN KEY (collection_id) REFERENCES collections(id) ON DELETE CASCADE,
+  FOREIGN KEY (folder_id) REFERENCES folders(id) ON DELETE CASCADE
+);
+`.trim();
 var USERS_MIGRATION_SQL2 = `
 CREATE TABLE IF NOT EXISTS users (
   id TEXT PRIMARY KEY,
@@ -5065,6 +5881,10 @@ ALTER TABLE folders
   ADD COLUMN IF NOT EXISTS created_by_user_id TEXT REFERENCES users(id) ON DELETE SET NULL,
   ADD COLUMN IF NOT EXISTS updated_by_user_id TEXT REFERENCES users(id) ON DELETE SET NULL;
 `.trim();
+var FOLDERS_PARENT_MIGRATION_SQL2 = `
+ALTER TABLE folders
+  ADD COLUMN IF NOT EXISTS parent_folder_id TEXT REFERENCES folders(id) ON DELETE CASCADE;
+`.trim();
 var REQUESTS_ATTRIBUTION_MIGRATION_SQL2 = `
 ALTER TABLE requests
   ADD COLUMN IF NOT EXISTS created_by_user_id TEXT REFERENCES users(id) ON DELETE SET NULL,
@@ -5174,6 +5994,34 @@ CREATE TABLE IF NOT EXISTS user_invitations (
 CREATE INDEX IF NOT EXISTS user_invitations_user_id_idx ON user_invitations (user_id);
 CREATE INDEX IF NOT EXISTS user_invitations_expires_at_idx ON user_invitations (expires_at);
 `.trim();
+function buildMarkerMigrationSql(table) {
+  return `
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1 FROM information_schema.columns
+    WHERE table_schema = current_schema() AND table_name = '${table}' AND column_name = 'color'
+  ) AND NOT EXISTS (
+    SELECT 1 FROM information_schema.columns
+    WHERE table_schema = current_schema() AND table_name = '${table}' AND column_name = 'marker'
+  ) THEN
+    ALTER TABLE ${table} RENAME COLUMN color TO marker;
+  END IF;
+
+  IF NOT EXISTS (
+    SELECT 1 FROM information_schema.columns
+    WHERE table_schema = current_schema() AND table_name = '${table}' AND column_name = 'marker'
+  ) THEN
+    ALTER TABLE ${table} ADD COLUMN marker TEXT;
+  END IF;
+END $$;
+`.trim();
+}
+var COLLECTIONS_MARKER_MIGRATION_SQL = buildMarkerMigrationSql("collections");
+var FOLDERS_MARKER_MIGRATION_SQL = buildMarkerMigrationSql("folders");
+var REQUESTS_MARKER_MIGRATION_SQL = buildMarkerMigrationSql("requests");
+var DOCUMENTS_MARKER_MIGRATION_SQL = buildMarkerMigrationSql("documents");
+var ENVIRONMENTS_MARKER_MIGRATION_SQL = buildMarkerMigrationSql("environments");
 var POSTGRES_MIGRATIONS = [
   USERS_MIGRATION_SQL2,
   API_TOKENS_MIGRATION_SQL2,
@@ -5182,12 +6030,14 @@ var POSTGRES_MIGRATIONS = [
   SNIPPETS_MIGRATION_SQL2,
   FOLDERS_MIGRATION_SQL2,
   REQUESTS_MIGRATION_SQL2,
+  DOCUMENTS_MIGRATION_SQL2,
   AUDIT_LOG_MIGRATION_SQL2,
   API_TOKENS_USER_ID_MIGRATION_SQL2,
   API_TOKENS_ATTRIBUTION_MIGRATION_SQL2,
   COLLECTIONS_ATTRIBUTION_MIGRATION_SQL2,
   ENVIRONMENTS_ATTRIBUTION_MIGRATION_SQL2,
   FOLDERS_ATTRIBUTION_MIGRATION_SQL2,
+  FOLDERS_PARENT_MIGRATION_SQL2,
   REQUESTS_ATTRIBUTION_MIGRATION_SQL2,
   USERS_ATTRIBUTION_MIGRATION_SQL2,
   COLLECTIONS_BACKFILL_UPDATED_AT_SQL2,
@@ -5201,7 +6051,12 @@ var POSTGRES_MIGRATIONS = [
   USERS_SNIPPET_ACCESS_MIGRATION_SQL2,
   USERS_SNIPPET_ACCESS_BACKFILL_SQL2,
   RUN_RESULTS_MIGRATION_SQL2,
-  USER_INVITATIONS_MIGRATION_SQL2
+  USER_INVITATIONS_MIGRATION_SQL2,
+  COLLECTIONS_MARKER_MIGRATION_SQL,
+  FOLDERS_MARKER_MIGRATION_SQL,
+  REQUESTS_MARKER_MIGRATION_SQL,
+  DOCUMENTS_MARKER_MIGRATION_SQL,
+  ENVIRONMENTS_MARKER_MIGRATION_SQL
 ];
 
 // src/db/postgres/schemas.ts
@@ -5232,6 +6087,7 @@ var USER_SELECT2 = `SELECT ${USER_SELECT_COLUMNS} FROM users`;
 var API_TOKEN_SELECT2 = `SELECT ${API_TOKEN_SELECT_COLUMNS} FROM api_tokens`;
 var FOLDER_SELECT2 = `SELECT ${FOLDER_SELECT_COLUMNS} FROM folders`;
 var REQUEST_SELECT2 = `SELECT ${REQUEST_SELECT_COLUMNS} FROM requests`;
+var DOCUMENT_SELECT2 = `SELECT ${DOCUMENT_SELECT_COLUMNS} FROM documents`;
 var LLM_USAGE_SELECT2 = `SELECT ${LLM_USAGE_SELECT_COLUMNS} FROM llm_usage`;
 var LLM_USAGE_LOG_SELECT2 = `SELECT ${LLM_USAGE_LOG_SELECT_COLUMNS} FROM llm_usage_log`;
 var PostgresDatabase = class _PostgresDatabase {
@@ -6003,10 +6859,34 @@ var PostgresDatabase = class _PostgresDatabase {
    *
    * @param actingUserId - User performing the update action.
    */
-  async updateCollection(id, name, variables, headers, preRequestScript, postRequestScript, auth, actingUserId) {
+  async updateCollection(id, name, variables, headers, preRequestScript, postRequestScript, auth, actingUserId, marker) {
     const trimmedName = trimRequiredName(name, "Collection name");
     const updatedAt = /* @__PURE__ */ new Date();
-    const result = await this.query(
+    const result = marker !== void 0 ? await this.query(
+      `UPDATE collections
+      SET name = $1,
+        variables = $2,
+        headers = $3,
+        auth = $4,
+        pre_request_script = $5,
+        post_request_script = $6,
+        updated_at = $7,
+        updated_by_user_id = $8,
+        marker = $9
+      WHERE id = $10`,
+      [
+        trimmedName,
+        JSON.stringify(variables),
+        JSON.stringify(headers),
+        JSON.stringify(auth),
+        preRequestScript,
+        postRequestScript,
+        updatedAt,
+        actingUserId,
+        serializeSidebarMarker(marker),
+        id
+      ]
+    ) : await this.query(
       `UPDATE collections
       SET name = $1,
         variables = $2,
@@ -6134,10 +7014,26 @@ var PostgresDatabase = class _PostgresDatabase {
    *
    * @param actingUserId - User performing the update action.
    */
-  async updateEnvironment(id, name, variables, actingUserId) {
+  async updateEnvironment(id, name, variables, actingUserId, marker) {
     const trimmedName = trimRequiredName(name, "Environment name");
     const updatedAt = /* @__PURE__ */ new Date();
-    const result = await this.query(
+    const result = marker !== void 0 ? await this.query(
+      `UPDATE environments
+      SET name = $1,
+        variables = $2,
+        updated_at = $3,
+        updated_by_user_id = $4,
+        marker = $5
+      WHERE id = $6`,
+      [
+        trimmedName,
+        JSON.stringify(variables),
+        updatedAt,
+        actingUserId,
+        serializeSidebarMarker(marker),
+        id
+      ]
+    ) : await this.query(
       `UPDATE environments
       SET name = $1,
         variables = $2,
@@ -6369,6 +7265,7 @@ var PostgresDatabase = class _PostgresDatabase {
     const params = JSON.stringify(input.params);
     const auth = JSON.stringify(input.auth);
     const folderId = input.folderId ?? null;
+    const serializedMarker = serializeSidebarMarker(input.marker ?? null);
     const now = /* @__PURE__ */ new Date();
     if (folderId != null) {
       const folderResult = await this.query(
@@ -6396,9 +7293,10 @@ var PostgresDatabase = class _PostgresDatabase {
           pre_request_script = $11,
           post_request_script = $12,
           comment = $13,
-          updated_at = $14,
-          updated_by_user_id = $15
-        WHERE id = $16`,
+          marker = $14,
+          updated_at = $15,
+          updated_by_user_id = $16
+        WHERE id = $17`,
         [
           input.collectionId,
           folderId,
@@ -6413,6 +7311,7 @@ var PostgresDatabase = class _PostgresDatabase {
           input.preRequestScript,
           input.postRequestScript,
           input.comment,
+          serializedMarker,
           now,
           actingUserId,
           input.id
@@ -6453,12 +7352,13 @@ var PostgresDatabase = class _PostgresDatabase {
         pre_request_script,
         post_request_script,
         comment,
+        marker,
         sort_order,
         created_at,
         updated_at,
         created_by_user_id,
         updated_by_user_id
-      ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19)
+      ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20)
       RETURNING ${REQUEST_SELECT_COLUMNS}`,
       [
         id,
@@ -6475,6 +7375,7 @@ var PostgresDatabase = class _PostgresDatabase {
         input.preRequestScript,
         input.postRequestScript,
         input.comment,
+        serializedMarker,
         maxOrder + 1,
         now,
         now,
@@ -6500,163 +7401,479 @@ var PostgresDatabase = class _PostgresDatabase {
     await this.query("DELETE FROM requests WHERE id = $1", [id]);
   }
   /**
-   * Lists all folders in a collection.
+   * Lists all folders in a collection.
+   *
+   * @param collectionId - Collection to query.
+   */
+  async listFolders(collectionId) {
+    const result = await this.query(
+      `${FOLDER_SELECT2} WHERE collection_id = $1 ORDER BY sort_order ASC, name ASC`,
+      [collectionId]
+    );
+    return result.rows.map(mapFolderSqlRow);
+  }
+  /**
+   * Finds a folder by id.
+   *
+   * @param id - Folder identifier to look up.
+   */
+  async findFolderById(id) {
+    const result = await this.query(`${FOLDER_SELECT2} WHERE id = $1 LIMIT 1`, [id]);
+    const row = result.rows[0];
+    return row ? mapFolderSqlRow(row) : null;
+  }
+  /**
+   * Creates a new folder in a collection.
+   *
+   * @param collectionId - Collection to add the folder to.
+   * @param name - Display name for the folder.
+   * @param actingUserId - User performing the create action.
+   */
+  async createFolder(collectionId, name, actingUserId, parentFolderId = null) {
+    const trimmedName = trimRequiredName(name, "Folder name");
+    if (parentFolderId != null) {
+      const parent = await this.findFolderById(parentFolderId);
+      if (!parent || parent.collectionId !== collectionId) {
+        throw new Error("Parent folder not found in collection");
+      }
+    }
+    const id = randomUUID5();
+    const now = /* @__PURE__ */ new Date();
+    const maxResult = await this.query(
+      `SELECT COALESCE(MAX(sort_order), -1) AS max_order
+       FROM folders
+       WHERE collection_id = $1 AND parent_folder_id IS NOT DISTINCT FROM $2`,
+      [collectionId, parentFolderId]
+    );
+    const maxOrder = maxResult.rows[0]?.max_order ?? -1;
+    const result = await this.query(
+      `INSERT INTO folders (
+        id,
+        collection_id,
+        parent_folder_id,
+        name,
+        sort_order,
+        created_at,
+        updated_at,
+        created_by_user_id,
+        updated_by_user_id
+      ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)
+      RETURNING ${FOLDER_SELECT_COLUMNS}`,
+      [
+        id,
+        collectionId,
+        parentFolderId,
+        trimmedName,
+        maxOrder + 1,
+        now,
+        now,
+        actingUserId,
+        actingUserId
+      ]
+    );
+    const row = result.rows[0];
+    if (!row) {
+      throw new Error("Folder not found after insert");
+    }
+    await this.recordAuditEntry(actingUserId, "create", "folder", id);
+    return mapFolderSqlRow(row);
+  }
+  /**
+   * Renames a folder.
+   *
+   * @param id - Folder ID to rename.
+   * @param name - New display name.
+   * @param actingUserId - User performing the rename action.
+   */
+  async renameFolder(id, name, actingUserId, marker) {
+    const trimmedName = trimRequiredName(name, "Folder name");
+    const updatedAt = /* @__PURE__ */ new Date();
+    const result = marker !== void 0 ? await this.query(
+      `UPDATE folders
+      SET name = $1,
+        updated_at = $2,
+        updated_by_user_id = $3,
+        marker = $4
+      WHERE id = $5
+      RETURNING ${FOLDER_SELECT_COLUMNS}`,
+      [trimmedName, updatedAt, actingUserId, serializeSidebarMarker(marker), id]
+    ) : await this.query(
+      `UPDATE folders
+      SET name = $1,
+        updated_at = $2,
+        updated_by_user_id = $3
+      WHERE id = $4
+      RETURNING ${FOLDER_SELECT_COLUMNS}`,
+      [trimmedName, updatedAt, actingUserId, id]
+    );
+    const row = result.rows[0];
+    if (!row) {
+      throw new Error("Folder not found");
+    }
+    await this.recordAuditEntry(actingUserId, "update", "folder", id);
+    return mapFolderSqlRow(row);
+  }
+  /**
+   * Deletes a folder and its descendants.
+   *
+   * @param id - Folder ID to delete.
+   * @param actingUserId - User performing the delete action.
+   */
+  async deleteFolder(id, actingUserId) {
+    await this.recordAuditEntry(actingUserId, "delete", "folder", id);
+    await this.query("DELETE FROM folders WHERE id = $1", [id]);
+  }
+  /**
+   * Moves a folder to a new parent and optional sibling position.
+   *
+   * @param id - Folder ID to move.
+   * @param parentFolderId - Destination parent, or null for collection root.
+   * @param sortOrder - Optional zero-based destination sibling index.
+   * @param actingUserId - User performing the move action.
+   */
+  async moveFolder(id, parentFolderId, sortOrder, actingUserId) {
+    const folder = await this.findFolderById(id);
+    if (!folder) {
+      throw new Error("Folder not found");
+    }
+    const folders = await this.listFolders(folder.collectionId);
+    if (parentFolderId != null) {
+      const parent = folders.find((entry) => entry.id === parentFolderId);
+      if (!parent) {
+        throw new Error("Parent folder not found in collection");
+      }
+      let ancestor = parent;
+      while (ancestor) {
+        if (ancestor.id === id) {
+          throw new Error("Cannot move a folder inside itself or its descendants");
+        }
+        ancestor = ancestor.parentFolderId == null ? void 0 : folders.find((entry) => entry.id === ancestor?.parentFolderId);
+      }
+    }
+    const siblings = folders.filter((entry) => entry.id !== id && entry.parentFolderId === parentFolderId).sort(
+      (left, right) => left.sortOrder - right.sortOrder || left.name.localeCompare(right.name)
+    );
+    const index = Math.max(0, Math.min(sortOrder ?? siblings.length, siblings.length));
+    siblings.splice(index, 0, { ...folder, parentFolderId });
+    const updatedAt = /* @__PURE__ */ new Date();
+    await this.query(
+      `UPDATE folders SET parent_folder_id = $1, updated_at = $2, updated_by_user_id = $3
+       WHERE id = $4`,
+      [parentFolderId, updatedAt, actingUserId, id]
+    );
+    await this.reorderFolders(
+      folder.collectionId,
+      parentFolderId,
+      siblings.map((entry) => entry.id),
+      actingUserId
+    );
+    const moved = await this.findFolderById(id);
+    if (!moved) {
+      throw new Error("Folder not found after move");
+    }
+    return moved;
+  }
+  /**
+   * Reorders sibling folders within a collection.
+   *
+   * @param collectionId - Collection containing the folders.
+   * @param orderedFolderIds - Folder IDs in desired order.
+   * @param actingUserId - User performing the reorder action.
+   */
+  async reorderFolders(collectionId, parentFolderId, orderedFolderIds, actingUserId) {
+    const client = await this.requirePool().connect();
+    const updatedAt = /* @__PURE__ */ new Date();
+    try {
+      await client.query("BEGIN");
+      for (let index = 0; index < orderedFolderIds.length; index++) {
+        await client.query(
+          `UPDATE folders
+          SET sort_order = $1,
+            updated_at = $2,
+            updated_by_user_id = $3
+          WHERE id = $4
+            AND collection_id = $5
+            AND parent_folder_id IS NOT DISTINCT FROM $6`,
+          [index, updatedAt, actingUserId, orderedFolderIds[index], collectionId, parentFolderId]
+        );
+      }
+      await client.query("COMMIT");
+    } catch (err) {
+      await client.query("ROLLBACK");
+      throw err;
+    } finally {
+      client.release();
+    }
+    await this.recordAuditEntry(actingUserId, "reorder", "folder", collectionId, {
+      parentFolderId,
+      orderedFolderIds
+    });
+  }
+  /**
+   * Reorders requests within a folder or at collection root.
+   *
+   * @param actingUserId - User performing the reorder action.
+   */
+  async reorderRequests(collectionId, folderId, orderedRequestIds, actingUserId) {
+    const client = await this.requirePool().connect();
+    const updatedAt = /* @__PURE__ */ new Date();
+    try {
+      await client.query("BEGIN");
+      for (let index = 0; index < orderedRequestIds.length; index++) {
+        await client.query(
+          `UPDATE requests
+          SET sort_order = $1,
+            folder_id = $2,
+            updated_at = $3,
+            updated_by_user_id = $4
+          WHERE id = $5 AND collection_id = $6`,
+          [index, folderId, updatedAt, actingUserId, orderedRequestIds[index], collectionId]
+        );
+      }
+      await client.query("COMMIT");
+    } catch (err) {
+      await client.query("ROLLBACK");
+      throw err;
+    } finally {
+      client.release();
+    }
+    await this.recordAuditEntry(actingUserId, "reorder", "request", collectionId, {
+      folderId,
+      orderedRequestIds
+    });
+  }
+  /**
+   * Moves a request to another folder or collection root at a given index.
+   *
+   * @param actingUserId - User performing the move action.
+   */
+  async moveRequest(requestId, folderId, index, actingUserId) {
+    const client = await this.requirePool().connect();
+    const updatedAt = /* @__PURE__ */ new Date();
+    const listInContainer = async (collectionId, targetFolderId) => {
+      const result = await client.query(
+        `SELECT id FROM requests WHERE collection_id = $1
+         AND (($2::text IS NULL AND folder_id IS NULL) OR folder_id = $2)
+         ORDER BY sort_order ASC, name ASC`,
+        [collectionId, targetFolderId]
+      );
+      return result.rows.map((row) => row.id);
+    };
+    const reindexContainer = async (targetFolderId, orderedIds) => {
+      for (let sortIndex = 0; sortIndex < orderedIds.length; sortIndex++) {
+        await client.query(
+          `UPDATE requests
+          SET sort_order = $1,
+            folder_id = $2,
+            updated_at = $3,
+            updated_by_user_id = $4
+          WHERE id = $5`,
+          [sortIndex, targetFolderId, updatedAt, actingUserId, orderedIds[sortIndex]]
+        );
+      }
+    };
+    try {
+      await client.query("BEGIN");
+      const requestResult = await client.query(`${REQUEST_SELECT2} WHERE id = $1`, [
+        requestId
+      ]);
+      const requestRow = requestResult.rows[0];
+      if (!requestRow) {
+        throw new Error("Request not found");
+      }
+      const request = mapRequestSqlRow(requestRow);
+      const collectionId = request.collectionId;
+      const oldFolderId = request.folderId;
+      if (folderId != null) {
+        const folderResult = await client.query(
+          "SELECT collection_id FROM folders WHERE id = $1",
+          [folderId]
+        );
+        const folderRow = folderResult.rows[0];
+        if (!folderRow || folderRow.collection_id !== collectionId) {
+          throw new Error("Folder not found");
+        }
+      }
+      if (oldFolderId === folderId) {
+        const siblings = (await listInContainer(collectionId, folderId)).filter(
+          (id) => id !== requestId
+        );
+        siblings.splice(index, 0, requestId);
+        await reindexContainer(folderId, siblings);
+      } else {
+        const oldIds = (await listInContainer(collectionId, oldFolderId)).filter(
+          (id) => id !== requestId
+        );
+        await reindexContainer(oldFolderId, oldIds);
+        const newIds = (await listInContainer(collectionId, folderId)).filter(
+          (id) => id !== requestId
+        );
+        newIds.splice(index, 0, requestId);
+        await reindexContainer(folderId, newIds);
+      }
+      await client.query("COMMIT");
+    } catch (err) {
+      await client.query("ROLLBACK");
+      throw err;
+    } finally {
+      client.release();
+    }
+    await this.recordAuditEntry(actingUserId, "move", "request", requestId, {
+      folderId,
+      index
+    });
+  }
+  /**
+   * Lists all documents in a collection.
    *
    * @param collectionId - Collection to query.
    */
-  async listFolders(collectionId) {
+  async listDocuments(collectionId) {
     const result = await this.query(
-      `${FOLDER_SELECT2} WHERE collection_id = $1 ORDER BY sort_order ASC, name ASC`,
+      `${DOCUMENT_SELECT2} WHERE collection_id = $1 ORDER BY sort_order ASC, name ASC`,
       [collectionId]
     );
-    return result.rows.map(mapFolderSqlRow);
+    return result.rows.map(mapDocumentSqlRow);
   }
   /**
-   * Finds a folder by id.
+   * Finds a document by id.
    *
-   * @param id - Folder identifier to look up.
+   * @param id - Document identifier to look up.
    */
-  async findFolderById(id) {
-    const result = await this.query(`${FOLDER_SELECT2} WHERE id = $1 LIMIT 1`, [id]);
+  async findDocumentById(id) {
+    const result = await this.query(`${DOCUMENT_SELECT2} WHERE id = $1 LIMIT 1`, [
+      id
+    ]);
     const row = result.rows[0];
-    return row ? mapFolderSqlRow(row) : null;
+    return row ? mapDocumentSqlRow(row) : null;
   }
   /**
-   * Creates a new folder in a collection.
+   * Inserts a new document or updates an existing one.
    *
-   * @param collectionId - Collection to add the folder to.
-   * @param name - Display name for the folder.
-   * @param actingUserId - User performing the create action.
+   * @param input - Document fields to persist.
+   * @param actingUserId - User performing the save action.
    */
-  async createFolder(collectionId, name, actingUserId) {
-    const trimmedName = trimRequiredName(name, "Folder name");
-    const id = randomUUID5();
+  async saveDocument(input, actingUserId) {
+    const trimmedName = trimRequiredName(input.name, "Document name");
+    const folderId = input.folderId ?? null;
+    const serializedMarker = serializeSidebarMarker(input.marker ?? null);
     const now = /* @__PURE__ */ new Date();
+    if (folderId != null) {
+      const folderResult = await this.query(
+        "SELECT collection_id FROM folders WHERE id = $1",
+        [folderId]
+      );
+      const folderRow = folderResult.rows[0];
+      if (!folderRow || folderRow.collection_id !== input.collectionId) {
+        throw new Error("Folder not found");
+      }
+    }
+    if (input.id) {
+      const result2 = await this.query(
+        `UPDATE documents SET
+          collection_id = $1,
+          folder_id = $2,
+          name = $3,
+          content = $4,
+          marker = $5,
+          updated_at = $6,
+          updated_by_user_id = $7
+        WHERE id = $8`,
+        [
+          input.collectionId,
+          folderId,
+          trimmedName,
+          input.content,
+          serializedMarker,
+          now,
+          actingUserId,
+          input.id
+        ]
+      );
+      if ((result2.rowCount ?? 0) > 0) {
+        await this.recordAuditEntry(actingUserId, "update", "document", input.id);
+        const selectResult = await this.query(`${DOCUMENT_SELECT2} WHERE id = $1`, [
+          input.id
+        ]);
+        const row2 = selectResult.rows[0];
+        if (row2) {
+          return mapDocumentSqlRow(row2);
+        }
+      }
+    }
     const maxResult = await this.query(
-      "SELECT COALESCE(MAX(sort_order), -1) AS max_order FROM folders WHERE collection_id = $1",
-      [collectionId]
+      `SELECT COALESCE(MAX(sort_order), -1) AS max_order FROM documents
+       WHERE collection_id = $1
+         AND (($2::text IS NULL AND folder_id IS NULL) OR folder_id = $2)`,
+      [input.collectionId, folderId]
     );
     const maxOrder = maxResult.rows[0]?.max_order ?? -1;
+    const id = randomUUID5();
     const result = await this.query(
-      `INSERT INTO folders (
+      `INSERT INTO documents (
         id,
         collection_id,
+        folder_id,
         name,
+        content,
+        marker,
         sort_order,
         created_at,
         updated_at,
         created_by_user_id,
         updated_by_user_id
-      ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
-      RETURNING ${FOLDER_SELECT_COLUMNS}`,
-      [id, collectionId, trimmedName, maxOrder + 1, now, now, actingUserId, actingUserId]
-    );
-    const row = result.rows[0];
-    if (!row) {
-      throw new Error("Folder not found after insert");
-    }
-    await this.recordAuditEntry(actingUserId, "create", "folder", id);
-    return mapFolderSqlRow(row);
-  }
-  /**
-   * Renames a folder.
-   *
-   * @param id - Folder ID to rename.
-   * @param name - New display name.
-   * @param actingUserId - User performing the rename action.
-   */
-  async renameFolder(id, name, actingUserId) {
-    const trimmedName = trimRequiredName(name, "Folder name");
-    const updatedAt = /* @__PURE__ */ new Date();
-    const result = await this.query(
-      `UPDATE folders
-      SET name = $1,
-        updated_at = $2,
-        updated_by_user_id = $3
-      WHERE id = $4
-      RETURNING ${FOLDER_SELECT_COLUMNS}`,
-      [trimmedName, updatedAt, actingUserId, id]
+      ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)
+      RETURNING ${DOCUMENT_SELECT_COLUMNS}`,
+      [
+        id,
+        input.collectionId,
+        folderId,
+        trimmedName,
+        input.content,
+        serializedMarker,
+        maxOrder + 1,
+        now,
+        now,
+        actingUserId,
+        actingUserId
+      ]
     );
     const row = result.rows[0];
     if (!row) {
-      throw new Error("Folder not found");
+      throw new Error("Document not found after insert");
     }
-    await this.recordAuditEntry(actingUserId, "update", "folder", id);
-    return mapFolderSqlRow(row);
+    await this.recordAuditEntry(actingUserId, "create", "document", id);
+    return mapDocumentSqlRow(row);
   }
   /**
-   * Deletes a folder and all requests inside it.
+   * Deletes a document by ID.
    *
-   * @param id - Folder ID to delete.
+   * @param id - Document ID to delete.
    * @param actingUserId - User performing the delete action.
    */
-  async deleteFolder(id, actingUserId) {
-    await this.recordAuditEntry(actingUserId, "delete", "folder", id);
-    const client = await this.requirePool().connect();
-    try {
-      await client.query("BEGIN");
-      await client.query("DELETE FROM requests WHERE folder_id = $1", [id]);
-      await client.query("DELETE FROM folders WHERE id = $1", [id]);
-      await client.query("COMMIT");
-    } catch (err) {
-      await client.query("ROLLBACK");
-      throw err;
-    } finally {
-      client.release();
-    }
-  }
-  /**
-   * Reorders folders within a collection.
-   *
-   * @param collectionId - Collection containing the folders.
-   * @param orderedFolderIds - Folder IDs in desired order.
-   * @param actingUserId - User performing the reorder action.
-   */
-  async reorderFolders(collectionId, orderedFolderIds, actingUserId) {
-    const client = await this.requirePool().connect();
-    const updatedAt = /* @__PURE__ */ new Date();
-    try {
-      await client.query("BEGIN");
-      for (let index = 0; index < orderedFolderIds.length; index++) {
-        await client.query(
-          `UPDATE folders
-          SET sort_order = $1,
-            updated_at = $2,
-            updated_by_user_id = $3
-          WHERE id = $4 AND collection_id = $5`,
-          [index, updatedAt, actingUserId, orderedFolderIds[index], collectionId]
-        );
-      }
-      await client.query("COMMIT");
-    } catch (err) {
-      await client.query("ROLLBACK");
-      throw err;
-    } finally {
-      client.release();
-    }
-    await this.recordAuditEntry(actingUserId, "reorder", "folder", collectionId, {
-      orderedFolderIds
-    });
+  async deleteDocument(id, actingUserId) {
+    await this.recordAuditEntry(actingUserId, "delete", "document", id);
+    await this.query("DELETE FROM documents WHERE id = $1", [id]);
   }
   /**
-   * Reorders requests within a folder or at collection root.
+   * Reorders documents within a folder or at collection root.
    *
    * @param actingUserId - User performing the reorder action.
    */
-  async reorderRequests(collectionId, folderId, orderedRequestIds, actingUserId) {
+  async reorderDocuments(collectionId, folderId, orderedDocumentIds, actingUserId) {
     const client = await this.requirePool().connect();
     const updatedAt = /* @__PURE__ */ new Date();
     try {
       await client.query("BEGIN");
-      for (let index = 0; index < orderedRequestIds.length; index++) {
+      for (let index = 0; index < orderedDocumentIds.length; index++) {
         await client.query(
-          `UPDATE requests
+          `UPDATE documents
           SET sort_order = $1,
             folder_id = $2,
             updated_at = $3,
             updated_by_user_id = $4
           WHERE id = $5 AND collection_id = $6`,
-          [index, folderId, updatedAt, actingUserId, orderedRequestIds[index], collectionId]
+          [index, folderId, updatedAt, actingUserId, orderedDocumentIds[index], collectionId]
         );
       }
       await client.query("COMMIT");
@@ -6666,22 +7883,22 @@ var PostgresDatabase = class _PostgresDatabase {
     } finally {
       client.release();
     }
-    await this.recordAuditEntry(actingUserId, "reorder", "request", collectionId, {
+    await this.recordAuditEntry(actingUserId, "reorder", "document", collectionId, {
       folderId,
-      orderedRequestIds
+      orderedDocumentIds
     });
   }
   /**
-   * Moves a request to another folder or collection root at a given index.
+   * Moves a document to another folder or collection root at a given index.
    *
    * @param actingUserId - User performing the move action.
    */
-  async moveRequest(requestId, folderId, index, actingUserId) {
+  async moveDocument(documentId, folderId, index, actingUserId) {
     const client = await this.requirePool().connect();
     const updatedAt = /* @__PURE__ */ new Date();
     const listInContainer = async (collectionId, targetFolderId) => {
       const result = await client.query(
-        `SELECT id FROM requests WHERE collection_id = $1
+        `SELECT id FROM documents WHERE collection_id = $1
          AND (($2::text IS NULL AND folder_id IS NULL) OR folder_id = $2)
          ORDER BY sort_order ASC, name ASC`,
         [collectionId, targetFolderId]
@@ -6691,7 +7908,7 @@ var PostgresDatabase = class _PostgresDatabase {
     const reindexContainer = async (targetFolderId, orderedIds) => {
       for (let sortIndex = 0; sortIndex < orderedIds.length; sortIndex++) {
         await client.query(
-          `UPDATE requests
+          `UPDATE documents
           SET sort_order = $1,
             folder_id = $2,
             updated_at = $3,
@@ -6703,16 +7920,17 @@ var PostgresDatabase = class _PostgresDatabase {
     };
     try {
       await client.query("BEGIN");
-      const requestResult = await client.query(`${REQUEST_SELECT2} WHERE id = $1`, [
-        requestId
-      ]);
-      const requestRow = requestResult.rows[0];
-      if (!requestRow) {
-        throw new Error("Request not found");
+      const documentResult = await client.query(
+        `${DOCUMENT_SELECT2} WHERE id = $1`,
+        [documentId]
+      );
+      const documentRow = documentResult.rows[0];
+      if (!documentRow) {
+        throw new Error("Document not found");
       }
-      const request = mapRequestSqlRow(requestRow);
-      const collectionId = request.collectionId;
-      const oldFolderId = request.folderId;
+      const document = mapDocumentSqlRow(documentRow);
+      const collectionId = document.collectionId;
+      const oldFolderId = document.folderId;
       if (folderId != null) {
         const folderResult = await client.query(
           "SELECT collection_id FROM folders WHERE id = $1",
@@ -6725,19 +7943,19 @@ var PostgresDatabase = class _PostgresDatabase {
       }
       if (oldFolderId === folderId) {
         const siblings = (await listInContainer(collectionId, folderId)).filter(
-          (id) => id !== requestId
+          (id) => id !== documentId
         );
-        siblings.splice(index, 0, requestId);
+        siblings.splice(index, 0, documentId);
         await reindexContainer(folderId, siblings);
       } else {
         const oldIds = (await listInContainer(collectionId, oldFolderId)).filter(
-          (id) => id !== requestId
+          (id) => id !== documentId
         );
         await reindexContainer(oldFolderId, oldIds);
         const newIds = (await listInContainer(collectionId, folderId)).filter(
-          (id) => id !== requestId
+          (id) => id !== documentId
         );
-        newIds.splice(index, 0, requestId);
+        newIds.splice(index, 0, documentId);
         await reindexContainer(folderId, newIds);
       }
       await client.query("COMMIT");
@@ -6747,7 +7965,7 @@ var PostgresDatabase = class _PostgresDatabase {
     } finally {
       client.release();
     }
-    await this.recordAuditEntry(actingUserId, "move", "request", requestId, {
+    await this.recordAuditEntry(actingUserId, "move", "document", documentId, {
       folderId,
       index
     });
@@ -8160,6 +9378,9 @@ function canDeleteCollection(user, collection) {
 function canDeleteRequest(user, request) {
   return canUseDataApi(user) && canAccessCollection(user, request.collectionId) && request.createdByUserId === user.id;
 }
+function canDeleteDocument(user, document) {
+  return canUseDataApi(user) && canAccessCollection(user, document.collectionId) && document.createdByUserId === user.id;
+}
 function canDeleteRunResult(user, runResult) {
   return canUseDataApi(user) && runResult.createdByUserId === user.id;
 }
@@ -8418,6 +9639,7 @@ var llmUsageSummaryResponseSchema = z7.object({
 
 // src/server/routes/schemas/entities.ts
 import { z as z8 } from "zod/v4";
+var sidebarMarkerBodySchema = z8.union([z8.string().trim().min(1), z8.null()]).optional();
 var collectionRecordSchema = z8.object({
   id: z8.string(),
   name: z8.string(),
@@ -8430,7 +9652,8 @@ var collectionRecordSchema = z8.object({
   updatedAt: timestampSchema,
   createdByUserId: z8.string().nullable(),
   updatedByUserId: z8.string().nullable(),
-  deletionLocked: z8.boolean()
+  deletionLocked: z8.boolean(),
+  marker: z8.string().nullable()
 });
 var environmentRecordSchema = z8.object({
   id: z8.string(),
@@ -8440,7 +9663,8 @@ var environmentRecordSchema = z8.object({
   updatedAt: timestampSchema,
   createdByUserId: z8.string().nullable(),
   updatedByUserId: z8.string().nullable(),
-  deletionLocked: z8.boolean()
+  deletionLocked: z8.boolean(),
+  marker: z8.string().nullable()
 });
 var snippetScopeSchema = z8.enum(["pre-request", "post-request", "any"]);
 var snippetRecordSchema = z8.object({
@@ -8458,12 +9682,14 @@ var snippetRecordSchema = z8.object({
 var folderRecordSchema = z8.object({
   id: z8.string(),
   collectionId: z8.string(),
+  parentFolderId: z8.string().nullable(),
   name: z8.string(),
   sortOrder: z8.number().int(),
   createdAt: timestampSchema,
   updatedAt: timestampSchema,
   createdByUserId: z8.string().nullable(),
-  updatedByUserId: z8.string().nullable()
+  updatedByUserId: z8.string().nullable(),
+  marker: z8.string().nullable()
 });
 var savedRequestRecordSchema = z8.object({
   id: z8.string(),
@@ -8484,10 +9710,12 @@ var savedRequestRecordSchema = z8.object({
   createdAt: timestampSchema,
   updatedAt: timestampSchema,
   createdByUserId: z8.string().nullable(),
-  updatedByUserId: z8.string().nullable()
+  updatedByUserId: z8.string().nullable(),
+  marker: z8.string().nullable()
 });
 var createCollectionBodySchema = z8.object({
-  name: z8.string().trim().min(1)
+  name: z8.string().trim().min(1),
+  marker: sidebarMarkerBodySchema
 });
 var updateCollectionBodySchema = z8.object({
   name: z8.string().trim().min(1),
@@ -8495,14 +9723,17 @@ var updateCollectionBodySchema = z8.object({
   headers: z8.array(keyValueSchema),
   preRequestScript: z8.string(),
   postRequestScript: z8.string(),
-  auth: authConfigSchema
+  auth: authConfigSchema,
+  marker: sidebarMarkerBodySchema
 });
 var createEnvironmentBodySchema = z8.object({
-  name: z8.string().trim().min(1)
+  name: z8.string().trim().min(1),
+  marker: sidebarMarkerBodySchema
 });
 var updateEnvironmentBodySchema = z8.object({
   name: z8.string().trim().min(1),
-  variables: z8.array(variableSchema)
+  variables: z8.array(variableSchema),
+  marker: sidebarMarkerBodySchema
 });
 var createSnippetBodySchema = z8.object({
   name: z8.string().trim().min(1),
@@ -8515,14 +9746,22 @@ var updateSnippetBodySchema = z8.object({
   scope: snippetScopeSchema
 });
 var createFolderBodySchema = z8.object({
-  name: z8.string().trim().min(1)
+  name: z8.string().trim().min(1),
+  parentFolderId: z8.string().nullable().optional(),
+  marker: sidebarMarkerBodySchema
 });
 var renameFolderBodySchema = z8.object({
-  name: z8.string().trim().min(1)
+  name: z8.string().trim().min(1),
+  marker: sidebarMarkerBodySchema
 });
 var reorderFoldersBodySchema = z8.object({
+  parentFolderId: z8.string().nullable(),
   orderedFolderIds: z8.array(z8.string().trim().min(1))
 });
+var moveFolderBodySchema = z8.object({
+  parentFolderId: z8.string().nullable(),
+  sortOrder: z8.number().int().min(0).optional()
+});
 var saveRequestBodySchema = z8.object({
   name: z8.string().trim().min(1),
   method: httpMethodSchema,
@@ -8535,7 +9774,8 @@ var saveRequestBodySchema = z8.object({
   preRequestScript: z8.string(),
   postRequestScript: z8.string(),
   comment: z8.string(),
-  folderId: z8.string().nullable().optional()
+  folderId: z8.string().nullable().optional(),
+  marker: sidebarMarkerBodySchema
 });
 var updateSaveRequestBodySchema = saveRequestBodySchema.extend({
   collectionId: z8.string().trim().min(1)
@@ -8563,6 +9803,39 @@ var listFoldersResponseSchema = z8.object({
 var listRequestsResponseSchema = z8.object({
   requests: z8.array(savedRequestRecordSchema)
 });
+var documentRecordSchema = z8.object({
+  id: z8.string(),
+  collectionId: z8.string(),
+  name: z8.string(),
+  content: z8.string(),
+  folderId: z8.string().nullable(),
+  sortOrder: z8.number().int(),
+  createdAt: timestampSchema,
+  updatedAt: timestampSchema,
+  createdByUserId: z8.string().nullable(),
+  updatedByUserId: z8.string().nullable(),
+  marker: z8.string().nullable()
+});
+var saveDocumentBodySchema = z8.object({
+  name: z8.string().trim().min(1),
+  content: z8.string(),
+  folderId: z8.string().nullable().optional(),
+  marker: sidebarMarkerBodySchema
+});
+var updateSaveDocumentBodySchema = saveDocumentBodySchema.extend({
+  collectionId: z8.string().trim().min(1)
+});
+var reorderDocumentsBodySchema = z8.object({
+  folderId: z8.string().nullable(),
+  orderedDocumentIds: z8.array(z8.string().trim().min(1))
+});
+var moveDocumentBodySchema = z8.object({
+  folderId: z8.string().nullable(),
+  index: z8.number().int().min(0)
+});
+var listDocumentsResponseSchema = z8.object({
+  documents: z8.array(documentRecordSchema)
+});
 var emptyResponseSchema = z8.null();
 function serializeCollection(record) {
   return {
@@ -8599,6 +9872,13 @@ function serializeSavedRequest(record) {
     updatedAt: record.updatedAt.toISOString()
   };
 }
+function serializeDocument(record) {
+  return {
+    ...record,
+    createdAt: record.createdAt.toISOString(),
+    updatedAt: record.updatedAt.toISOString()
+  };
+}
 var runResultRecordSchema = z8.object({
   id: z8.string(),
   kind: z8.enum(["collection-run-results", "request-run-results"]),
@@ -9193,13 +10473,50 @@ async function registerAdminRoutes(app, options) {
         if (denyUnlessAllowed(reply, canUseManagementApi(user))) {
           return;
         }
-        const collections = await db.listCollections();
+        const collections = await db.listCollections();
+        return reply.send({
+          collections: collections.map((collection) => ({
+            id: collection.id,
+            name: collection.name,
+            deletionLocked: collection.deletionLocked
+          }))
+        });
+      } catch (error) {
+        if (handleDbError(reply, error)) {
+          return;
+        }
+        throw error;
+      }
+    }
+  });
+  routes.route({
+    method: "GET",
+    url: "/admin/collections/:collectionId/folders",
+    schema: {
+      params: collectionIdParamSchema,
+      response: {
+        200: listFoldersResponseSchema,
+        403: errorResponseSchema,
+        404: errorResponseSchema
+      }
+    },
+    /**
+     * Lists folders in a collection for operator inspection.
+     */
+    handler: async (request, reply) => {
+      try {
+        const user = requireAuthenticatedUser(request);
+        if (denyUnlessAllowed(reply, canUseManagementApi(user))) {
+          return;
+        }
+        const collection = await db.findCollectionById(request.params.collectionId);
+        if (!collection) {
+          void reply.code(404).send({ error: "Collection not found" });
+          return;
+        }
+        const folders = await db.listFolders(request.params.collectionId);
         return reply.send({
-          collections: collections.map((collection) => ({
-            id: collection.id,
-            name: collection.name,
-            deletionLocked: collection.deletionLocked
-          }))
+          folders: folders.map((folder) => serializeFolder(folder))
         });
       } catch (error) {
         if (handleDbError(reply, error)) {
@@ -9211,17 +10528,17 @@ async function registerAdminRoutes(app, options) {
   });
   routes.route({
     method: "GET",
-    url: "/admin/collections/:collectionId/folders",
+    url: "/admin/collections/:collectionId/requests",
     schema: {
       params: collectionIdParamSchema,
       response: {
-        200: listFoldersResponseSchema,
+        200: listRequestsResponseSchema,
         403: errorResponseSchema,
         404: errorResponseSchema
       }
     },
     /**
-     * Lists folders in a collection for operator inspection.
+     * Lists saved requests in a collection for operator inspection.
      */
     handler: async (request, reply) => {
       try {
@@ -9234,9 +10551,9 @@ async function registerAdminRoutes(app, options) {
           void reply.code(404).send({ error: "Collection not found" });
           return;
         }
-        const folders = await db.listFolders(request.params.collectionId);
+        const requests = await db.listRequests(request.params.collectionId);
         return reply.send({
-          folders: folders.map((folder) => serializeFolder(folder))
+          requests: requests.map((savedRequest) => serializeSavedRequest(savedRequest))
         });
       } catch (error) {
         if (handleDbError(reply, error)) {
@@ -9248,17 +10565,17 @@ async function registerAdminRoutes(app, options) {
   });
   routes.route({
     method: "GET",
-    url: "/admin/collections/:collectionId/requests",
+    url: "/admin/collections/:collectionId/documents",
     schema: {
       params: collectionIdParamSchema,
       response: {
-        200: listRequestsResponseSchema,
+        200: listDocumentsResponseSchema,
         403: errorResponseSchema,
         404: errorResponseSchema
       }
     },
     /**
-     * Lists saved requests in a collection for operator inspection.
+     * Lists collection documents in a collection for operator inspection.
      */
     handler: async (request, reply) => {
       try {
@@ -9271,9 +10588,9 @@ async function registerAdminRoutes(app, options) {
           void reply.code(404).send({ error: "Collection not found" });
           return;
         }
-        const requests = await db.listRequests(request.params.collectionId);
+        const documents = await db.listDocuments(request.params.collectionId);
         return reply.send({
-          requests: requests.map((savedRequest) => serializeSavedRequest(savedRequest))
+          documents: documents.map((document) => serializeDocument(document))
         });
       } catch (error) {
         if (handleDbError(reply, error)) {
@@ -10316,7 +11633,8 @@ async function registerCollectionRoutes(app, db) {
           request.body.preRequestScript,
           request.body.postRequestScript,
           request.body.auth,
-          user.id
+          user.id,
+          request.body.marker
         );
         return reply.send(serializeCollection(collection));
       } catch (error) {
@@ -10457,7 +11775,8 @@ async function registerEnvironmentRoutes(app, db) {
           request.params.id,
           request.body.name,
           request.body.variables,
-          user.id
+          user.id,
+          request.body.marker
         );
         return reply.send(serializeEnvironment(environment));
       } catch (error) {
@@ -10716,6 +12035,50 @@ async function registerFolderRoutes(app, db) {
         const folder = await db.createFolder(
           request.params.collectionId,
           request.body.name,
+          user.id,
+          request.body.parentFolderId
+        );
+        return reply.send(serializeFolder(folder));
+      } catch (error) {
+        if (handleDbError(reply, error)) {
+          return;
+        }
+        throw error;
+      }
+    }
+  });
+  routes.route({
+    method: "PUT",
+    url: "/folders/:id/move",
+    schema: {
+      params: idParamSchema,
+      body: moveFolderBodySchema,
+      response: {
+        200: folderRecordSchema,
+        400: errorResponseSchema,
+        404: errorResponseSchema
+      }
+    },
+    /**
+     * Moves a folder to another parent or collection root.
+     */
+    handler: async (request, reply) => {
+      try {
+        const user = requireAuthenticatedUser(request);
+        const existingFolder = await db.findFolderById(request.params.id);
+        if (!existingFolder) {
+          return reply.code(404).send({ error: "Folder not found" });
+        }
+        if (denyUnlessAllowed(
+          reply,
+          canUseDataApi(user) && canAccessCollection(user, existingFolder.collectionId)
+        )) {
+          return;
+        }
+        const folder = await db.moveFolder(
+          request.params.id,
+          request.body.parentFolderId,
+          request.body.sortOrder,
           user.id
         );
         return reply.send(serializeFolder(folder));
@@ -10755,7 +12118,12 @@ async function registerFolderRoutes(app, db) {
         )) {
           return;
         }
-        const folder = await db.renameFolder(request.params.id, request.body.name, user.id);
+        const folder = await db.renameFolder(
+          request.params.id,
+          request.body.name,
+          user.id,
+          request.body.marker
+        );
         return reply.send(serializeFolder(folder));
       } catch (error) {
         if (handleDbError(reply, error)) {
@@ -10826,6 +12194,7 @@ async function registerFolderRoutes(app, db) {
         }
         await db.reorderFolders(
           request.params.collectionId,
+          request.body.parentFolderId,
           request.body.orderedFolderIds,
           user.id
         );
@@ -10840,6 +12209,244 @@ async function registerFolderRoutes(app, db) {
   });
 }
 
+// src/server/routes/documents.ts
+async function registerDocumentRoutes(app, db) {
+  const routes = app.withTypeProvider();
+  routes.route({
+    method: "GET",
+    url: "/collections/:collectionId/documents",
+    schema: {
+      params: collectionIdParamSchema,
+      response: {
+        200: listDocumentsResponseSchema
+      }
+    },
+    /**
+     * Lists collection documents in a collection.
+     */
+    handler: async (request, reply) => {
+      try {
+        const user = requireAuthenticatedUser(request);
+        if (denyUnlessAllowed(
+          reply,
+          canUseDataApi(user) && canAccessCollection(user, request.params.collectionId)
+        )) {
+          return;
+        }
+        const documents = await db.listDocuments(request.params.collectionId);
+        return reply.send({
+          documents: documents.map((document) => serializeDocument(document))
+        });
+      } catch (error) {
+        if (handleDbError(reply, error)) {
+          return;
+        }
+        throw error;
+      }
+    }
+  });
+  routes.route({
+    method: "POST",
+    url: "/collections/:collectionId/documents",
+    schema: {
+      params: collectionIdParamSchema,
+      body: saveDocumentBodySchema,
+      response: {
+        200: documentRecordSchema,
+        400: errorResponseSchema,
+        404: errorResponseSchema
+      }
+    },
+    /**
+     * Creates a new collection document in a collection.
+     */
+    handler: async (request, reply) => {
+      try {
+        const user = requireAuthenticatedUser(request);
+        if (denyUnlessAllowed(
+          reply,
+          canUseDataApi(user) && canAccessCollection(user, request.params.collectionId)
+        )) {
+          return;
+        }
+        const document = await db.saveDocument(
+          {
+            collectionId: request.params.collectionId,
+            name: request.body.name,
+            content: request.body.content,
+            folderId: request.body.folderId ?? null,
+            marker: request.body.marker
+          },
+          user.id
+        );
+        return reply.send(serializeDocument(document));
+      } catch (error) {
+        if (handleDbError(reply, error)) {
+          return;
+        }
+        throw error;
+      }
+    }
+  });
+  routes.route({
+    method: "PUT",
+    url: "/documents/:id",
+    schema: {
+      params: idParamSchema,
+      body: updateSaveDocumentBodySchema,
+      response: {
+        200: documentRecordSchema,
+        400: errorResponseSchema,
+        404: errorResponseSchema
+      }
+    },
+    /**
+     * Updates an existing collection document by id.
+     */
+    handler: async (request, reply) => {
+      try {
+        const user = requireAuthenticatedUser(request);
+        if (denyUnlessAllowed(
+          reply,
+          canUseDataApi(user) && canAccessCollection(user, request.body.collectionId)
+        )) {
+          return;
+        }
+        const document = await db.saveDocument(
+          {
+            id: request.params.id,
+            collectionId: request.body.collectionId,
+            name: request.body.name,
+            content: request.body.content,
+            folderId: request.body.folderId ?? null,
+            marker: request.body.marker
+          },
+          user.id
+        );
+        return reply.send(serializeDocument(document));
+      } catch (error) {
+        if (handleDbError(reply, error)) {
+          return;
+        }
+        throw error;
+      }
+    }
+  });
+  routes.route({
+    method: "DELETE",
+    url: "/documents/:id",
+    schema: {
+      params: idParamSchema,
+      response: {
+        204: emptyResponseSchema,
+        404: errorResponseSchema
+      }
+    },
+    /**
+     * Deletes a collection document by id.
+     */
+    handler: async (request, reply) => {
+      try {
+        const user = requireAuthenticatedUser(request);
+        const existingDocument = await db.findDocumentById(request.params.id);
+        if (!existingDocument) {
+          return reply.code(404).send({ error: "Document not found" });
+        }
+        if (denyUnlessAllowed(reply, canDeleteDocument(user, existingDocument))) {
+          return;
+        }
+        await db.deleteDocument(request.params.id, user.id);
+        return reply.code(204).send(null);
+      } catch (error) {
+        if (handleDbError(reply, error)) {
+          return;
+        }
+        throw error;
+      }
+    }
+  });
+  routes.route({
+    method: "PUT",
+    url: "/collections/:collectionId/documents/reorder",
+    schema: {
+      params: collectionIdParamSchema,
+      body: reorderDocumentsBodySchema,
+      response: {
+        204: emptyResponseSchema,
+        404: errorResponseSchema
+      }
+    },
+    /**
+     * Reorders collection documents within a folder or collection root.
+     */
+    handler: async (request, reply) => {
+      try {
+        const user = requireAuthenticatedUser(request);
+        if (denyUnlessAllowed(
+          reply,
+          canUseDataApi(user) && canAccessCollection(user, request.params.collectionId)
+        )) {
+          return;
+        }
+        await db.reorderDocuments(
+          request.params.collectionId,
+          request.body.folderId,
+          request.body.orderedDocumentIds,
+          user.id
+        );
+        return reply.code(204).send(null);
+      } catch (error) {
+        if (handleDbError(reply, error)) {
+          return;
+        }
+        throw error;
+      }
+    }
+  });
+  routes.route({
+    method: "PUT",
+    url: "/documents/:id/move",
+    schema: {
+      params: idParamSchema,
+      body: moveDocumentBodySchema,
+      response: {
+        204: emptyResponseSchema,
+        404: errorResponseSchema
+      }
+    },
+    /**
+     * Moves a collection document to another folder or collection root index.
+     */
+    handler: async (request, reply) => {
+      try {
+        const user = requireAuthenticatedUser(request);
+        const existingDocument = await db.findDocumentById(request.params.id);
+        if (!existingDocument) {
+          return reply.code(404).send({ error: "Document not found" });
+        }
+        if (denyUnlessAllowed(
+          reply,
+          canUseDataApi(user) && canAccessCollection(user, existingDocument.collectionId)
+        )) {
+          return;
+        }
+        await db.moveDocument(
+          request.params.id,
+          request.body.folderId,
+          request.body.index,
+          user.id
+        );
+        return reply.code(204).send(null);
+      } catch (error) {
+        if (handleDbError(reply, error)) {
+          return;
+        }
+        throw error;
+      }
+    }
+  });
+}
+
 // src/server/routes/health.ts
 import { z as z11 } from "zod/v4";
 var healthResponseSchema = z11.object({
@@ -11286,7 +12893,8 @@ async function registerRequestRoutes(app, db) {
             preRequestScript: request.body.preRequestScript,
             postRequestScript: request.body.postRequestScript,
             comment: request.body.comment,
-            folderId: request.body.folderId ?? null
+            folderId: request.body.folderId ?? null,
+            marker: request.body.marker
           },
           user.id
         );
@@ -11338,7 +12946,8 @@ async function registerRequestRoutes(app, db) {
             preRequestScript: request.body.preRequestScript,
             postRequestScript: request.body.postRequestScript,
             comment: request.body.comment,
-            folderId: request.body.folderId ?? null
+            folderId: request.body.folderId ?? null,
+            marker: request.body.marker
           },
           user.id
         );
@@ -12426,6 +14035,7 @@ async function registerProtectedRoutes(app, options) {
   await registerSnippetRoutes(app, options.db);
   await registerFolderRoutes(app, options.db);
   await registerRequestRoutes(app, options.db);
+  await registerDocumentRoutes(app, options.db);
   await registerRunResultRoutes(app, options.db);
   await registerLlmRoutes(app, {
     db: options.db,