api-documentation-mcp 0.1.1 → 0.2.0

package/dist/index.js

@@ -86,23 +86,23 @@ var require_code = __commonJS({
     };
     exports._Code = _Code;
     exports.nil = new _Code("");
-    function _(strs, ...args) {
+    function _(strs, ...args2) {
       const code = [strs[0]];
       let i = 0;
-      while (i < args.length) {
-        addCodeArg(code, args[i]);
+      while (i < args2.length) {
+        addCodeArg(code, args2[i]);
         code.push(strs[++i]);
       }
       return new _Code(code);
     }
     exports._ = _;
     var plus = new _Code("+");
-    function str(strs, ...args) {
+    function str(strs, ...args2) {
       const expr = [safeStringify(strs[0])];
       let i = 0;
-      while (i < args.length) {
+      while (i < args2.length) {
         expr.push(plus);
-        addCodeArg(expr, args[i]);
+        addCodeArg(expr, args2[i]);
         expr.push(plus, safeStringify(strs[++i]));
       }
       optimize(expr);
@@ -657,10 +657,10 @@ var require_codegen = __commonJS({
       }
     };
     var Func = class extends BlockNode {
-      constructor(name, args, async) {
+      constructor(name, args2, async) {
         super();
         this.name = name;
-        this.args = args;
+        this.args = args2;
         this.async = async;
       }
       render(opts) {
@@ -935,8 +935,8 @@ var require_codegen = __commonJS({
         return this;
       }
       // `function` heading (or definition if funcBody is passed)
-      func(name, args = code_1.nil, async, funcBody) {
-        this._blockNode(new Func(name, args, async));
+      func(name, args2 = code_1.nil, async, funcBody) {
+        this._blockNode(new Func(name, args2, async));
         if (funcBody)
           this.code(funcBody).endFunc();
         return this;
@@ -1030,13 +1030,13 @@ var require_codegen = __commonJS({
     }
     exports.not = not;
     var andCode = mappend(exports.operators.AND);
-    function and(...args) {
-      return args.reduce(andCode);
+    function and(...args2) {
+      return args2.reduce(andCode);
     }
     exports.and = and;
     var orCode = mappend(exports.operators.OR);
-    function or(...args) {
-      return args.reduce(orCode);
+    function or(...args2) {
+      return args2.reduce(orCode);
     }
     exports.or = or;
     function mappend(op) {
@@ -1769,8 +1769,8 @@ var require_code2 = __commonJS({
       ];
       if (it.opts.dynamicRef)
         valCxt.push([names_1.default.dynamicAnchors, names_1.default.dynamicAnchors]);
-      const args = (0, codegen_1._)`${dataAndSchema}, ${gen.object(...valCxt)}`;
-      return context !== codegen_1.nil ? (0, codegen_1._)`${func}.call(${context}, ${args})` : (0, codegen_1._)`${func}(${args})`;
+      const args2 = (0, codegen_1._)`${dataAndSchema}, ${gen.object(...valCxt)}`;
+      return context !== codegen_1.nil ? (0, codegen_1._)`${func}.call(${context}, ${args2})` : (0, codegen_1._)`${func}(${args2})`;
     }
     exports.callValidateCode = callValidateCode;
     var newRegExp = (0, codegen_1._)`new RegExp`;
@@ -3333,6 +3333,37 @@ var require_utils = __commonJS({
       }
       return output.join("");
     }
+    function removeDotSegmentsRelative(path) {
+      if (path === "" || path[0] === "/") {
+        return removeDotSegments(path);
+      }
+      const segments = path.split("/");
+      const last = segments.length - 1;
+      const output = [];
+      let trailingDirectory = false;
+      for (let i = 0; i <= last; i++) {
+        const segment = segments[i];
+        if (segment === "." || segment === "..") {
+          if (segment === "..") {
+            if (output.length !== 0 && output[output.length - 1] !== "..") {
+              output.pop();
+            } else {
+              output.push("..");
+            }
+          }
+          trailingDirectory = i === last;
+        } else {
+          output.push(segment);
+        }
+      }
+      if (trailingDirectory && output[output.length - 1] !== "..") {
+        output.push("");
+      }
+      if (output.length === 0 || output[0] === "" || output[0].includes(":")) {
+        output.unshift(".");
+      }
+      return output.join("/");
+    }
     var HOST_DELIMS = { "@": "%40", "/": "%2F", "?": "%3F", "#": "%23", ":": "%3A" };
     var HOST_DELIM_RE = /[@/?#:]/g;
     var HOST_DELIM_NO_COLON_RE = /[@/?#]/g;
@@ -3593,6 +3624,7 @@ var require_utils = __commonJS({
       encodeFragment,
       escapePreservingEscapes,
       removeDotSegments,
+      removeDotSegmentsRelative,
       isIPv4,
       isUUID,
       normalizeIPv6,
@@ -3816,16 +3848,18 @@ var require_schemes = __commonJS({
 var require_fast_uri = __commonJS({
   "node_modules/fast-uri/index.js"(exports, module) {
     "use strict";
-    var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
+    var { normalizeIPv6, removeDotSegments, removeDotSegmentsRelative, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
     var { SCHEMES, getSchemeHandler } = require_schemes();
     var VALID_SCHEME = /^[A-Za-z][A-Za-z0-9+.-]*$/u;
     var MALFORMED_SCHEME_ERROR = "URI scheme is malformed.";
-    function decodeValidScheme(scheme) {
-      const decodedScheme = unescape(String(scheme));
-      if (!VALID_SCHEME.test(decodedScheme)) {
+    var MALFORMED_HOST_ERROR = "URI host is malformed.";
+    var FORBIDDEN_DOMAIN_HOST_CHARACTER = /[\0-\x20"#/:<>?@[\\\]^`{|}\x7F]/u;
+    function validateScheme(scheme) {
+      const stringScheme = String(scheme);
+      if (!VALID_SCHEME.test(stringScheme)) {
         throw new TypeError(MALFORMED_SCHEME_ERROR);
       }
-      return decodedScheme;
+      return stringScheme;
     }
     function normalize(uri, options) {
       if (typeof uri === "string") {
@@ -3862,6 +3896,9 @@ var require_fast_uri = __commonJS({
       const resolvedSchemeHandler = getSchemeHandler(options && options.scheme || resolved.scheme);
       const resolvedHost = resolved.host;
       const resolvedHostIsIP = resolvedHost !== void 0 && resolvedHost !== "" && (isIPv4(resolvedHost) || normalizeIPv6(resolvedHost).isIPV6);
+      if (hasForbiddenDomainHost(resolved, options || {}, resolvedSchemeHandler, resolvedHostIsIP)) {
+        throw new Error(MALFORMED_HOST_ERROR);
+      }
       canonicalizeHost(resolved, options || {}, resolvedSchemeHandler, resolvedHostIsIP);
       const encodedASCIIHost = resolvedHost && resolvedHost.indexOf("%") !== -1 && !new RegExp("\\P{ASCII}", "u").test(resolvedHost);
       if (resolved.error && !encodedASCIIHost) {
@@ -3903,14 +3940,15 @@ var require_fast_uri = __commonJS({
             if (relative.path[0] === "/") {
               target.path = removeDotSegments(relative.path);
             } else {
-              if ((base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0) && !base.path) {
+              const baseHasAuthority = base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0;
+              if (baseHasAuthority && !base.path) {
                 target.path = "/" + relative.path;
               } else if (!base.path) {
                 target.path = relative.path;
               } else {
                 target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative.path;
               }
-              target.path = removeDotSegments(target.path);
+              target.path = base.scheme === void 0 && !baseHasAuthority && target.path[0] !== "/" ? removeDotSegmentsRelative(target.path) : removeDotSegments(target.path);
             }
             target.query = relative.query;
           }
@@ -3948,12 +3986,13 @@ var require_fast_uri = __commonJS({
       const options = Object.assign({}, opts);
       const uriTokens = [];
       if (component.scheme) {
-        component.scheme = decodeValidScheme(component.scheme);
+        component.scheme = validateScheme(component.scheme);
       }
       const schemeHandler = getSchemeHandler(options.scheme || component.scheme);
       if (schemeHandler && schemeHandler.serialize) schemeHandler.serialize(component, options);
       const hasAuthority = component.userinfo !== void 0 || component.host !== void 0 || component.port !== void 0;
-      const pathNoScheme = !options.skipEscape && component.scheme === void 0 && !hasAuthority;
+      const schemelessReference = (component.scheme === void 0 || options.reference === "suffix") && !hasAuthority;
+      const pathNoScheme = !options.skipEscape && schemelessReference;
       if (component.path !== void 0) {
         if (!options.skipEscape) {
           component.path = serializePathEncoding(component.path, pathNoScheme);
@@ -3962,7 +4001,7 @@ var require_fast_uri = __commonJS({
         }
       }
       if (options.reference !== "suffix" && component.scheme) {
-        component.scheme = decodeValidScheme(component.scheme);
+        component.scheme = validateScheme(component.scheme);
         uriTokens.push(component.scheme, ":");
       }
       const authority = recomposeAuthority(component);
@@ -3978,9 +4017,9 @@ var require_fast_uri = __commonJS({
       if (component.path !== void 0) {
         let s = component.path;
         if (!options.absolutePath && (!schemeHandler || !schemeHandler.absolutePath)) {
-          s = removeDotSegments(s);
+          s = schemelessReference && s[0] !== "/" ? removeDotSegmentsRelative(s) : removeDotSegments(s);
         }
-        if (pathNoScheme) {
+        if (schemelessReference) {
           s = serializePathEncoding(s, true);
         }
         if (authority === void 0 && s[0] === "/" && s[1] === "/") {
@@ -4027,16 +4066,34 @@ var require_fast_uri = __commonJS({
       return hasMalformedPercentEncoding(matches[3]) || host !== void 0 && !isIPLiteral(host) && hasMalformedPercentEncoding(host) || hasMalformedPercentEncoding(matches[6]) || hasMalformedPercentEncoding(matches[7]) || hasMalformedPercentEncoding(matches[8]);
     }
     function canonicalizeHost(parsed, options, schemeHandler, isIP) {
+      if (hasForbiddenDomainHost(parsed, options, schemeHandler, isIP)) {
+        parsed.error = parsed.error || MALFORMED_HOST_ERROR;
+        return true;
+      }
       if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport) && parsed.host && !isIPLiteral(parsed.host) && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
+        let url;
         try {
-          parsed.host = new URL("http://" + parsed.host).hostname;
+          url = new URL("http://" + parsed.host);
         } catch (e) {
           parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
           return true;
         }
+        if (!isHostOnlyURL(url)) {
+          parsed.error = parsed.error || MALFORMED_HOST_ERROR;
+          return true;
+        }
+        parsed.host = url.hostname;
       }
       return false;
     }
+    function hasForbiddenDomainHost(parsed, options, schemeHandler, isIP) {
+      return Boolean(
+        parsed.host && isIP === false && !isIPLiteral(parsed.host) && (options.domainHost || schemeHandler && schemeHandler.domainHost) && FORBIDDEN_DOMAIN_HOST_CHARACTER.test(parsed.host)
+      );
+    }
+    function isHostOnlyURL(url) {
+      return url.username === "" && url.password === "" && url.port === "" && url.pathname === "/" && url.search === "" && url.hash === "" && url.hostname !== "";
+    }
     function parseWithStatus(uri, opts) {
       const options = Object.assign({}, opts);
       const parsed = {
@@ -4091,9 +4148,8 @@ var require_fast_uri = __commonJS({
         parsed.query = matches[7];
         parsed.fragment = matches[8];
         if (parsed.scheme !== void 0) {
-          const decodedScheme = unescape(parsed.scheme);
-          if (VALID_SCHEME.test(decodedScheme)) {
-            parsed.scheme = decodedScheme.toLowerCase();
+          if (VALID_SCHEME.test(parsed.scheme)) {
+            parsed.scheme = parsed.scheme.toLowerCase();
           } else {
             parsed.error = parsed.error || MALFORMED_SCHEME_ERROR;
             malformedScheme = true;
@@ -4121,7 +4177,7 @@ var require_fast_uri = __commonJS({
             malformedIPLiteral = hasIPLiteralBracket && (!bracketedIPLiteral || ipv6result.error === true);
             parsed.host = isIP ? ipv6result.host : ipv6result.host.toLowerCase();
             if (malformedIPLiteral) {
-              parsed.error = parsed.error || "URI host is malformed.";
+              parsed.error = parsed.error || MALFORMED_HOST_ERROR;
               malformedAuthorityOrPort = true;
             }
           } else {
@@ -4149,7 +4205,7 @@ var require_fast_uri = __commonJS({
           if (!isIP) {
             host = normalizePercentEncoding(host.toLowerCase());
           }
-          parsed.host = reescapeHostDelimiters(host, isIP);
+          parsed.host = isIP || options.scheme !== "null" ? reescapeHostDelimiters(host, isIP) : host;
         }
         if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
           if (parsed.path) {
@@ -7195,12 +7251,65 @@ var require_dist = __commonJS({
   }
 });
 
-// src/mcp/server.ts
-import { createHash, randomUUID } from "node:crypto";
-import { DatabaseSync } from "node:sqlite";
-import { existsSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
+// src/cli.ts
+import { readFileSync } from "node:fs";
+
+// src/registry.ts
+function parseInput(schema, rawInput) {
+  const result = schema.safeParse(rawInput ?? {});
+  if (result.success) return result.data;
+  const lines = result.error.issues.map((issue2) => `${issue2.path.join(".") || "params"}: ${issue2.message}`);
+  throw new Error(`Invalid parameters: ${lines.join("; ")}`);
+}
+function defineCommand(definition) {
+  return {
+    id: definition.id,
+    group: definition.group,
+    title: definition.title,
+    description: definition.description,
+    params: definition.params,
+    readOnly: definition.readOnly,
+    destructive: definition.destructive === true,
+    run: (rawInput) => definition.run(parseInput(definition.params, rawInput))
+  };
+}
+function unwrap(schema) {
+  let current = schema;
+  for (let depth = 0; depth < 10; depth += 1) {
+    const def = current._def;
+    if (def.innerType) current = def.innerType;
+    else if (def.schema) current = def.schema;
+    else break;
+  }
+  return current;
+}
+function typeName(schema) {
+  const inner = unwrap(schema);
+  const kind = inner._def.typeName ?? "unknown";
+  return kind.replace(/^Zod/, "").toLowerCase();
+}
+function describeParams(schema) {
+  return Object.entries(schema.shape).map(([name, field]) => {
+    const field_ = field;
+    return {
+      name,
+      type: typeName(field_),
+      required: !field_.isOptional(),
+      ...field_.description ? { description: field_.description } : {}
+    };
+  });
+}
+function describeCommand(command) {
+  return {
+    id: command.id,
+    group: command.group,
+    title: command.title,
+    description: command.description,
+    readOnly: command.readOnly,
+    destructive: command.destructive,
+    params: describeParams(command.params)
+  };
+}
 
 // node_modules/zod/v3/external.js
 var external_exports = {};
@@ -8158,24 +8267,24 @@ var base64Regex = /^([0-9a-zA-Z+/]{4})*(([0-9a-zA-Z+/]{2}==)|([0-9a-zA-Z+/]{3}=)
 var base64urlRegex = /^([0-9a-zA-Z-_]{4})*(([0-9a-zA-Z-_]{2}(==)?)|([0-9a-zA-Z-_]{3}(=)?))?$/;
 var dateRegexSource = `((\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-((0[13578]|1[02])-(0[1-9]|[12]\\d|3[01])|(0[469]|11)-(0[1-9]|[12]\\d|30)|(02)-(0[1-9]|1\\d|2[0-8])))`;
 var dateRegex = new RegExp(`^${dateRegexSource}$`);
-function timeRegexSource(args) {
+function timeRegexSource(args2) {
   let secondsRegexSource = `[0-5]\\d`;
-  if (args.precision) {
-    secondsRegexSource = `${secondsRegexSource}\\.\\d{${args.precision}}`;
-  } else if (args.precision == null) {
+  if (args2.precision) {
+    secondsRegexSource = `${secondsRegexSource}\\.\\d{${args2.precision}}`;
+  } else if (args2.precision == null) {
     secondsRegexSource = `${secondsRegexSource}(\\.\\d+)?`;
   }
-  const secondsQuantifier = args.precision ? "+" : "?";
+  const secondsQuantifier = args2.precision ? "+" : "?";
   return `([01]\\d|2[0-3]):[0-5]\\d(:${secondsRegexSource})${secondsQuantifier}`;
 }
-function timeRegex(args) {
-  return new RegExp(`^${timeRegexSource(args)}$`);
+function timeRegex(args2) {
+  return new RegExp(`^${timeRegexSource(args2)}$`);
 }
-function datetimeRegex(args) {
-  let regex = `${dateRegexSource}T${timeRegexSource(args)}`;
+function datetimeRegex(args2) {
+  let regex = `${dateRegexSource}T${timeRegexSource(args2)}`;
   const opts = [];
-  opts.push(args.local ? `Z?` : `Z`);
-  if (args.offset)
+  opts.push(args2.local ? `Z?` : `Z`);
+  if (args2.offset)
     opts.push(`([+-]\\d{2}:?\\d{2})`);
   regex = `${regex}(${opts.join("|")})`;
   return new RegExp(`^${regex}$`);
@@ -10483,9 +10592,9 @@ var ZodFunction = class _ZodFunction extends ZodType {
       });
       return INVALID;
     }
-    function makeArgsIssue(args, error2) {
+    function makeArgsIssue(args2, error2) {
       return makeIssue({
-        data: args,
+        data: args2,
         path: ctx.path,
         errorMaps: [ctx.common.contextualErrorMap, ctx.schemaErrorMap, getErrorMap(), en_default].filter((x) => !!x),
         issueData: {
@@ -10509,10 +10618,10 @@ var ZodFunction = class _ZodFunction extends ZodType {
     const fn = ctx.data;
     if (this._def.returns instanceof ZodPromise) {
       const me = this;
-      return OK(async function(...args) {
+      return OK(async function(...args2) {
         const error2 = new ZodError([]);
-        const parsedArgs = await me._def.args.parseAsync(args, params).catch((e) => {
-          error2.addIssue(makeArgsIssue(args, e));
+        const parsedArgs = await me._def.args.parseAsync(args2, params).catch((e) => {
+          error2.addIssue(makeArgsIssue(args2, e));
           throw error2;
         });
         const result = await Reflect.apply(fn, this, parsedArgs);
@@ -10524,10 +10633,10 @@ var ZodFunction = class _ZodFunction extends ZodType {
       });
     } else {
       const me = this;
-      return OK(function(...args) {
-        const parsedArgs = me._def.args.safeParse(args, params);
+      return OK(function(...args2) {
+        const parsedArgs = me._def.args.safeParse(args2, params);
         if (!parsedArgs.success) {
-          throw new ZodError([makeArgsIssue(args, parsedArgs.error)]);
+          throw new ZodError([makeArgsIssue(args2, parsedArgs.error)]);
         }
         const result = Reflect.apply(fn, this, parsedArgs.data);
         const parsedReturns = me._def.returns.safeParse(result, params);
@@ -10564,9 +10673,9 @@ var ZodFunction = class _ZodFunction extends ZodType {
     const validatedFunc = this.parse(func);
     return validatedFunc;
   }
-  static create(args, returns, params) {
+  static create(args2, returns, params) {
     return new _ZodFunction({
-      args: args ? args : ZodTuple.create([]).rest(ZodUnknown.create()),
+      args: args2 ? args2 : ZodTuple.create([]).rest(ZodUnknown.create()),
       returns: returns || ZodUnknown.create(),
       typeName: ZodFirstPartyTypeKind.ZodFunction,
       ...processCreateParams(params)
@@ -11243,163 +11352,1460 @@ var coerce = {
 };
 var NEVER = INVALID;
 
-// node_modules/zod/v4/core/core.js
-var NEVER2 = Object.freeze({
-  status: "aborted"
-});
-// @__NO_SIDE_EFFECTS__
-function $constructor(name, initializer3, params) {
-  function init(inst, def) {
-    var _a;
-    Object.defineProperty(inst, "_zod", {
-      value: inst._zod ?? {},
-      enumerable: false
-    });
-    (_a = inst._zod).traits ?? (_a.traits = /* @__PURE__ */ new Set());
-    inst._zod.traits.add(name);
-    initializer3(inst, def);
-    for (const k in _.prototype) {
-      if (!(k in inst))
-        Object.defineProperty(inst, k, { value: _.prototype[k].bind(inst) });
+// src/commands/changes.ts
+import { randomUUID as randomUUID4 } from "node:crypto";
+
+// src/operations.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+
+// src/tree.ts
+import { randomUUID } from "node:crypto";
+function isFolder(node) {
+  return node.kind === "folder";
+}
+function findNode(nodes, id) {
+  for (const node of nodes) {
+    if (node.id === id) return node;
+    if (isFolder(node)) {
+      const nested = findNode(node.children, id);
+      if (nested) return nested;
     }
-    inst._zod.constr = _;
-    inst._zod.def = def;
-  }
-  const Parent = params?.Parent ?? Object;
-  class Definition extends Parent {
   }
-  Object.defineProperty(Definition, "name", { value: name });
-  function _(def) {
-    var _a;
-    const inst = params?.Parent ? new Definition() : this;
-    init(inst, def);
-    (_a = inst._zod).deferred ?? (_a.deferred = []);
-    for (const fn of inst._zod.deferred) {
-      fn();
+  return void 0;
+}
+function findRequest(nodes, id) {
+  const node = findNode(nodes, id);
+  if (!node || isFolder(node)) throw new Error(`Request "${id}" was not found.`);
+  return node;
+}
+function findParentId(nodes, id, parentId3 = null) {
+  for (const node of nodes) {
+    if (node.id === id) return parentId3;
+    if (isFolder(node)) {
+      const nested = findParentId(node.children, id, node.id);
+      if (nested !== void 0) return nested;
     }
-    return inst;
   }
-  Object.defineProperty(_, "init", { value: init });
-  Object.defineProperty(_, Symbol.hasInstance, {
-    value: (inst) => {
-      if (params?.Parent && inst instanceof params.Parent)
-        return true;
-      return inst?._zod?.traits?.has(name);
-    }
-  });
-  Object.defineProperty(_, "name", { value: name });
-  return _;
+  return void 0;
 }
-var $brand = Symbol("zod_brand");
-var $ZodAsyncError = class extends Error {
-  constructor() {
-    super(`Encountered Promise during synchronous parse. Use .parseAsync() instead.`);
+function insertNode(nodes, parentId3, node, index) {
+  if (parentId3 === null) {
+    const next = [...nodes];
+    next.splice(index === void 0 ? next.length : Math.min(index, next.length), 0, node);
+    return next;
   }
-};
-var globalConfig = {};
-function config(newConfig) {
-  if (newConfig)
-    Object.assign(globalConfig, newConfig);
-  return globalConfig;
-}
-
-// node_modules/zod/v4/core/util.js
-var util_exports = {};
-__export(util_exports, {
-  BIGINT_FORMAT_RANGES: () => BIGINT_FORMAT_RANGES,
-  Class: () => Class,
-  NUMBER_FORMAT_RANGES: () => NUMBER_FORMAT_RANGES,
-  aborted: () => aborted,
-  allowsEval: () => allowsEval,
-  assert: () => assert,
-  assertEqual: () => assertEqual,
-  assertIs: () => assertIs,
-  assertNever: () => assertNever,
-  assertNotEqual: () => assertNotEqual,
-  assignProp: () => assignProp,
-  cached: () => cached,
-  captureStackTrace: () => captureStackTrace,
-  cleanEnum: () => cleanEnum,
-  cleanRegex: () => cleanRegex,
-  clone: () => clone,
-  createTransparentProxy: () => createTransparentProxy,
-  defineLazy: () => defineLazy,
-  esc: () => esc,
-  escapeRegex: () => escapeRegex,
-  extend: () => extend,
-  finalizeIssue: () => finalizeIssue,
-  floatSafeRemainder: () => floatSafeRemainder2,
-  getElementAtPath: () => getElementAtPath,
-  getEnumValues: () => getEnumValues,
-  getLengthableOrigin: () => getLengthableOrigin,
-  getParsedType: () => getParsedType2,
-  getSizableOrigin: () => getSizableOrigin,
-  isObject: () => isObject,
-  isPlainObject: () => isPlainObject,
-  issue: () => issue,
-  joinValues: () => joinValues,
-  jsonStringifyReplacer: () => jsonStringifyReplacer,
-  merge: () => merge,
-  normalizeParams: () => normalizeParams,
-  nullish: () => nullish,
-  numKeys: () => numKeys,
-  omit: () => omit,
-  optionalKeys: () => optionalKeys,
-  partial: () => partial,
-  pick: () => pick,
-  prefixIssues: () => prefixIssues,
-  primitiveTypes: () => primitiveTypes,
-  promiseAllObject: () => promiseAllObject,
-  propertyKeyTypes: () => propertyKeyTypes,
-  randomString: () => randomString,
-  required: () => required,
-  stringifyPrimitive: () => stringifyPrimitive,
-  unwrapMessage: () => unwrapMessage
-});
-function assertEqual(val) {
-  return val;
-}
-function assertNotEqual(val) {
-  return val;
-}
-function assertIs(_arg) {
-}
-function assertNever(_x) {
-  throw new Error();
-}
-function assert(_) {
+  const insertInto = (siblings) => {
+    for (let position = 0; position < siblings.length; position += 1) {
+      const child = siblings[position];
+      if (!isFolder(child)) continue;
+      if (child.id === parentId3) {
+        const children = [...child.children];
+        children.splice(index === void 0 ? children.length : Math.min(index, children.length), 0, node);
+        const next = [...siblings];
+        next[position] = { ...child, children };
+        return { nodes: next, found: true };
+      }
+      const nested = insertInto(child.children);
+      if (nested.found) {
+        const next = [...siblings];
+        next[position] = { ...child, children: nested.nodes };
+        return { nodes: next, found: true };
+      }
+    }
+    return { nodes: siblings, found: false };
+  };
+  const result = insertInto(nodes);
+  if (!result.found) throw new Error(`Parent folder "${parentId3}" was not found.`);
+  return result.nodes;
 }
-function getEnumValues(entries) {
-  const numericValues = Object.values(entries).filter((v) => typeof v === "number");
-  const values = Object.entries(entries).filter(([k, _]) => numericValues.indexOf(+k) === -1).map(([_, v]) => v);
-  return values;
+function removeNode(nodes, id) {
+  const directIndex = nodes.findIndex((node) => node.id === id);
+  if (directIndex >= 0) {
+    const next = [...nodes];
+    const [removed] = next.splice(directIndex, 1);
+    return { tree: next, removed };
+  }
+  for (let index = 0; index < nodes.length; index += 1) {
+    const node = nodes[index];
+    if (!isFolder(node)) continue;
+    const result = removeNode(node.children, id);
+    if (!result.removed) continue;
+    const next = [...nodes];
+    next[index] = { ...node, children: result.tree };
+    return { tree: next, removed: result.removed };
+  }
+  return { tree: nodes };
 }
-function joinValues(array2, separator = "|") {
-  return array2.map((val) => stringifyPrimitive(val)).join(separator);
+function updateNode(nodes, id, update) {
+  let found = false;
+  const tree = nodes.map((node) => {
+    if (node.id === id) {
+      found = true;
+      return update(node);
+    }
+    if (!isFolder(node)) return node;
+    const nested = updateNode(node.children, id, update);
+    if (!nested.found) return node;
+    found = true;
+    return { ...node, children: nested.tree };
+  });
+  return { tree, found };
 }
-function jsonStringifyReplacer(_, value) {
-  if (typeof value === "bigint")
-    return value.toString();
-  return value;
+function requestList(nodes) {
+  return nodes.flatMap((node) => isFolder(node) ? requestList(node.children) : [node]);
 }
-function cached(getter) {
-  const set = false;
+function cloneWithNewIds(node) {
+  if (isFolder(node)) return { ...node, id: randomUUID(), children: node.children.map(cloneWithNewIds) };
   return {
-    get value() {
-      if (!set) {
-        const value = getter();
-        Object.defineProperty(this, "value", { value });
-        return value;
-      }
-      throw new Error("cached value already set");
-    }
+    ...node,
+    id: randomUUID(),
+    headers: node.headers?.map((item) => ({ ...item, id: randomUUID() })),
+    params: node.params?.map((item) => ({ ...item, id: randomUUID() })),
+    pathParams: node.pathParams?.map((item) => ({ ...item, id: randomUUID() })),
+    bodyFields: node.bodyFields?.map((item) => ({ ...item, id: randomUUID() }))
   };
 }
-function nullish(input) {
-  return input === null || input === void 0;
-}
-function cleanRegex(source) {
-  const start = source.startsWith("^") ? 1 : 0;
+function normalizeRequest(input, existing) {
+  const headers = input.headers ?? existing?.headers ?? [];
+  const params = input.params ?? existing?.params ?? [];
+  const pathParams = input.pathParams ?? existing?.pathParams ?? [];
+  const bodyFields = input.bodyFields ?? existing?.bodyFields ?? [];
+  const responses = input.responses ?? existing?.responses ?? [];
+  return {
+    ...existing,
+    ...input,
+    id: existing?.id ?? input.id ?? randomUUID(),
+    kind: "request",
+    name: input.name,
+    method: input.method.toUpperCase(),
+    url: input.url,
+    body: input.body ?? existing?.body ?? "",
+    headers: headers.map((item) => ({ ...item, id: item.id || randomUUID() })),
+    params: params.map((item) => ({ ...item, id: item.id || randomUUID() })),
+    pathParams: pathParams.map((item) => ({ ...item, id: item.id || randomUUID() })),
+    bodyFields: bodyFields.map((item) => ({ ...item, id: item.id || randomUUID() })),
+    responses: responses.map((response) => ({
+      ...response,
+      id: response.id || randomUUID(),
+      content: response.content.map((content) => ({ ...content, id: content.id || randomUUID() }))
+    }))
+  };
+}
+
+// src/redact.ts
+var referencePattern = /^\s*\{\{[^{}]+\}\}\s*$/;
+function maskSecret(value) {
+  return referencePattern.test(value) ? value : "<redacted>";
+}
+function sanitizeUrl(value) {
+  try {
+    const url = new URL(value);
+    if (url.username) url.username = "<redacted>";
+    if (url.password) url.password = "<redacted>";
+    for (const key of [...url.searchParams.keys()]) {
+      if (isSensitiveName(key)) url.searchParams.set(key, maskSecret(url.searchParams.get(key) ?? ""));
+    }
+    return url.toString();
+  } catch {
+    return value;
+  }
+}
+function isSensitiveName(value) {
+  return /authorization|cookie|token|secret|password|\bkey\b|api[-_]?key|client[-_]?secret/i.test(value);
+}
+function redactBody(value) {
+  try {
+    const parsed = JSON.parse(value);
+    const redact = (item) => {
+      if (Array.isArray(item)) return item.map(redact);
+      if (!item || typeof item !== "object") return item;
+      return Object.fromEntries(Object.entries(item).map(([key, entry]) => [key, isSensitiveName(key) ? "<redacted>" : redact(entry)]));
+    };
+    return JSON.stringify(redact(parsed), null, 2);
+  } catch {
+    return value.replace(
+      /\b(authorization|cookie|token|secret|password|api[-_]?key|client[-_]?secret|key)\b\s*[:=]\s*(?:Bearer\s+)?(?:"[^"]*"|'[^']*'|[^,\r\n;}]+)/gi,
+      "$1: <redacted>"
+    );
+  }
+}
+function safeRequest(request) {
+  return {
+    ...request,
+    url: sanitizeUrl(request.url),
+    body: redactBody(request.body),
+    ...request.documentation ? { documentation: redactBody(request.documentation) } : {},
+    ...request.responses ? {
+      responses: request.responses.map((response) => ({
+        ...response,
+        content: response.content.map((content) => ({ ...content, example: redactBody(content.example) }))
+      }))
+    } : {},
+    ...request.openApiSchemas ? { openApiSchemas: JSON.parse(redactBody(JSON.stringify(request.openApiSchemas))) } : {},
+    ...request.headers ? { headers: request.headers.map((header) => ({ ...header, value: isSensitiveName(header.name) ? maskSecret(header.value) : header.value })) } : {},
+    ...request.params ? { params: request.params.map((param) => ({ ...param, value: isSensitiveName(param.name) ? maskSecret(param.value) : param.value })) } : {},
+    ...request.pathParams ? { pathParams: request.pathParams.map((param) => ({ ...param, value: isSensitiveName(param.name) ? maskSecret(param.value) : param.value })) } : {},
+    ...request.bodyFields ? { bodyFields: request.bodyFields.map((field) => ({ ...field, value: isSensitiveName(field.name) ? maskSecret(field.value) : field.value, filePath: void 0 })) } : {},
+    ...request.auth?.type === "bearer" ? { auth: { type: "bearer", token: maskSecret(request.auth.token) } } : {},
+    ...request.auth?.type === "basic" ? { auth: { type: "basic", username: maskSecret(request.auth.username), password: maskSecret(request.auth.password) } } : {},
+    ...request.auth?.type === "api-key" ? { auth: { ...request.auth, value: maskSecret(request.auth.value) } } : {},
+    bodyPath: void 0
+  };
+}
+function safeTree(nodes) {
+  return nodes.map(
+    (node) => isFolder(node) ? { id: node.id, kind: node.kind, name: node.name, children: safeTree(node.children) } : { id: node.id, kind: node.kind, name: node.name, method: node.method, url: sanitizeUrl(node.url), deprecated: node.deprecated === true }
+  );
+}
+function summarize(node) {
+  if (!node) return void 0;
+  return isFolder(node) ? { id: node.id, kind: node.kind, name: node.name, childCount: node.children.length } : safeRequest(node);
+}
+
+// src/operations.ts
+function applyOperation(tree, operation) {
+  if (operation.action === "create_folder") {
+    const parent = operation.parentId ? findNode(tree, operation.parentId) : void 0;
+    if (operation.parentId && (!parent || !isFolder(parent))) throw new Error(`Parent folder "${operation.parentId}" was not found.`);
+    const folder = { id: randomUUID2(), kind: "folder", name: operation.name.trim(), children: [] };
+    return { tree: insertNode(tree, operation.parentId, folder), summary: { action: operation.action, target: folder.name, after: summarize(folder) } };
+  }
+  if (operation.action === "create_request") {
+    const parent = operation.parentId ? findNode(tree, operation.parentId) : void 0;
+    if (operation.parentId && (!parent || !isFolder(parent))) throw new Error(`Parent folder "${operation.parentId}" was not found.`);
+    const request = normalizeRequest(operation.request);
+    return { tree: insertNode(tree, operation.parentId, request), summary: { action: operation.action, target: request.name, after: summarize(request) } };
+  }
+  if (operation.action === "update_request") {
+    const before2 = findNode(tree, operation.requestId);
+    if (!before2 || isFolder(before2)) throw new Error(`Request "${operation.requestId}" was not found.`);
+    const updated = normalizeRequest(
+      { ...before2, ...operation.patch, name: operation.patch.name ?? before2.name, method: operation.patch.method ?? before2.method, url: operation.patch.url ?? before2.url },
+      before2
+    );
+    const result = updateNode(tree, operation.requestId, () => updated);
+    return { tree: result.tree, summary: { action: operation.action, target: updated.name, before: summarize(before2), after: summarize(updated) } };
+  }
+  if (operation.action === "rename_folder") {
+    const before2 = findNode(tree, operation.folderId);
+    if (!before2 || !isFolder(before2)) throw new Error(`Folder "${operation.folderId}" was not found.`);
+    const result = updateNode(tree, operation.folderId, (node) => isFolder(node) ? { ...node, name: operation.name.trim() } : node);
+    return {
+      tree: result.tree,
+      summary: { action: operation.action, target: operation.name.trim(), before: summarize(before2), after: { ...summarize(before2), name: operation.name.trim() } }
+    };
+  }
+  if (operation.action === "move_node") {
+    const before2 = findNode(tree, operation.nodeId);
+    if (!before2) throw new Error(`Collection item "${operation.nodeId}" was not found.`);
+    const parent = operation.parentId ? findNode(tree, operation.parentId) : void 0;
+    if (operation.parentId && (!parent || !isFolder(parent))) throw new Error(`Parent folder "${operation.parentId}" was not found.`);
+    if (isFolder(before2) && (before2.id === operation.parentId || findNode(before2.children, operation.parentId ?? "")?.kind === "folder"))
+      throw new Error("A folder cannot be moved inside itself or one of its descendants.");
+    const oldParentId = findParentId(tree, before2.id);
+    const removed2 = removeNode(tree, before2.id);
+    if (!removed2.removed) throw new Error(`Collection item "${operation.nodeId}" could not be moved.`);
+    const next = insertNode(removed2.tree, operation.parentId, removed2.removed, operation.index);
+    return { tree: next, summary: { action: operation.action, target: before2.name, before: { parentId: oldParentId }, after: { parentId: operation.parentId, index: operation.index } } };
+  }
+  if (operation.action === "deprecate_request") {
+    const before2 = findNode(tree, operation.requestId);
+    if (!before2 || isFolder(before2)) throw new Error(`Request "${operation.requestId}" was not found.`);
+    const updated = {
+      ...before2,
+      deprecated: operation.deprecated,
+      ...operation.deprecated && operation.reason?.trim() ? { deprecationReason: operation.reason.trim() } : {},
+      ...!operation.deprecated ? { deprecationReason: void 0 } : {}
+    };
+    const result = updateNode(tree, operation.requestId, () => updated);
+    return {
+      tree: result.tree,
+      summary: {
+        action: operation.action,
+        target: updated.name,
+        before: { deprecated: before2.deprecated === true, deprecationReason: before2.deprecationReason },
+        after: { deprecated: updated.deprecated, deprecationReason: updated.deprecationReason }
+      }
+    };
+  }
+  const before = findNode(tree, operation.nodeId);
+  if (!before) throw new Error(`Collection item "${operation.nodeId}" was not found.`);
+  const removed = removeNode(tree, operation.nodeId);
+  return { tree: removed.tree, summary: { action: operation.action, target: before.name, before: summarize(before) } };
+}
+function applyOperations(tree, operations) {
+  let next = tree;
+  const summary = [];
+  for (const operation of operations) {
+    const result = applyOperation(next, operation);
+    next = result.tree;
+    summary.push(result.summary);
+  }
+  return { tree: next, summary };
+}
+
+// src/store.ts
+import { createHash, randomUUID as randomUUID3 } from "node:crypto";
+import { existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+function dataDirectory() {
+  const appName = "api-documentation-bit";
+  if (process.env.API_DOCS_USER_DATA_DIR) return process.env.API_DOCS_USER_DATA_DIR;
+  const base = process.platform === "win32" ? process.env.APPDATA || join(homedir(), "AppData", "Roaming") : process.platform === "darwin" ? join(homedir(), "Library", "Application Support") : process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
+  return join(base, appName);
+}
+var localDatabase;
+var openedPath;
+function database() {
+  const path = join(dataDirectory(), "workspace.sqlite");
+  if (!existsSync(path)) {
+    throw new Error(`Workspace database was not found at ${path}. Open API Documentation once to create the local workspace.`);
+  }
+  if (!localDatabase || openedPath !== path) {
+    localDatabase?.close();
+    localDatabase = new DatabaseSync(path);
+    localDatabase.exec("PRAGMA busy_timeout = 5000;");
+    openedPath = path;
+  }
+  return localDatabase;
+}
+function hashRaw(raw) {
+  return createHash("sha256").update(raw).digest("hex");
+}
+function secretFingerprint(workspaceId5, variableId) {
+  try {
+    const row = database().prepare("SELECT value FROM secrets WHERE key = ?").get(`workspace-variable:${workspaceId5}:${variableId}`);
+    return row ? createHash("sha256").update(row.value).digest("hex") : "";
+  } catch (error2) {
+    if (error2 instanceof Error && /no such table/.test(error2.message)) return "";
+    throw error2;
+  }
+}
+var activeAccountKey = "active-account";
+function activeAccountId() {
+  try {
+    const row = database().prepare("SELECT value FROM app_settings WHERE key = ?").get(activeAccountKey);
+    return row?.value ?? null;
+  } catch (error2) {
+    if (error2 instanceof Error && /no such table/.test(error2.message)) return null;
+    throw error2;
+  }
+}
+function visibleTo(workspace, accountId) {
+  if (!workspace.cloudId || !accountId) return true;
+  return !workspace.accountId || workspace.accountId === accountId;
+}
+function listWorkspaces() {
+  const accountId = activeAccountId();
+  const rows = database().prepare("SELECT data FROM workspaces ORDER BY rowid").all();
+  return rows.map(({ data }) => JSON.parse(data)).filter((workspace) => visibleTo(workspace, accountId)).map((workspace) => ({ id: workspace.id, name: workspace.name, cloudId: workspace.cloudId ?? null, role: workspace.role ?? null }));
+}
+function readWorkspace(workspaceId5) {
+  const row = database().prepare("SELECT data FROM workspaces WHERE id = ?").get(workspaceId5);
+  if (!row) throw new Error(`Workspace "${workspaceId5}" was not found.`);
+  const workspace = JSON.parse(row.data);
+  if (!visibleTo(workspace, activeAccountId())) throw new Error(`Workspace "${workspaceId5}" was not found.`);
+  if (!Array.isArray(workspace.tree)) throw new Error("Workspace collection data is invalid.");
+  return { raw: row.data, workspace };
+}
+function assertCanEdit(workspace) {
+  if (workspace.role === "viewer") throw new Error("This workspace is read-only for the current account.");
+}
+function updateWorkspace(workspaceId5, change) {
+  const db = database();
+  db.exec("BEGIN IMMEDIATE;");
+  try {
+    const { raw, workspace } = readWorkspace(workspaceId5);
+    assertCanEdit(workspace);
+    const next = change(workspace, raw);
+    db.prepare("UPDATE workspaces SET data = ? WHERE id = ?").run(JSON.stringify(next), workspaceId5);
+    db.exec("COMMIT;");
+    return next;
+  } catch (error2) {
+    db.exec("ROLLBACK;");
+    throw error2;
+  }
+}
+function insertWorkspace(workspace) {
+  database().prepare("INSERT INTO workspaces (id, data) VALUES (?, ?)").run(workspace.id, JSON.stringify(workspace));
+}
+function deleteWorkspace(workspaceId5) {
+  const db = database();
+  db.exec("BEGIN IMMEDIATE;");
+  try {
+    const { workspace } = readWorkspace(workspaceId5);
+    if (workspace.cloudId) throw new Error("Cloud workspaces are managed in the desktop app, not from the CLI.");
+    db.prepare("DELETE FROM commits WHERE workspace_id = ?").run(workspaceId5);
+    db.prepare("DELETE FROM workspaces WHERE id = ?").run(workspaceId5);
+    db.exec("COMMIT;");
+  } catch (error2) {
+    db.exec("ROLLBACK;");
+    throw error2;
+  }
+}
+
+// src/schemas.ts
+var bodyModes = ["form-data", "urlencoded", "graphql", "json", "xml", "yaml", "edn", "text", "other", "file", "none"];
+var authSchema = external_exports.discriminatedUnion("type", [
+  external_exports.object({ type: external_exports.literal("none") }),
+  external_exports.object({ type: external_exports.literal("bearer"), token: external_exports.string().max(65536) }),
+  external_exports.object({ type: external_exports.literal("basic"), username: external_exports.string().max(8192), password: external_exports.string().max(65536) }),
+  external_exports.object({ type: external_exports.literal("api-key"), name: external_exports.string().max(8192), value: external_exports.string().max(65536), location: external_exports.enum(["header", "query"]) })
+]);
+var fieldSchema = external_exports.object({
+  id: external_exports.string().optional(),
+  name: external_exports.string().max(8192),
+  value: external_exports.string().max(65536),
+  enabled: external_exports.boolean().default(true),
+  description: external_exports.string().max(4096).optional()
+});
+var bodyFieldSchema = external_exports.object({
+  id: external_exports.string().optional(),
+  name: external_exports.string().max(8192),
+  value: external_exports.string().max(65536),
+  enabled: external_exports.boolean().default(true),
+  type: external_exports.enum(["text", "file"]).default("text"),
+  fileName: external_exports.string().max(1024).optional()
+});
+var responseContentSchema = external_exports.object({
+  id: external_exports.string().optional(),
+  mediaType: external_exports.string().max(160),
+  schema: external_exports.string().max(1e6),
+  example: external_exports.string().max(1e6)
+});
+var responseDefinitionSchema = external_exports.object({
+  id: external_exports.string().optional(),
+  statusCode: external_exports.string().trim().min(1).max(12),
+  description: external_exports.string().max(500),
+  content: external_exports.array(responseContentSchema).max(20)
+});
+var method = external_exports.string().trim().min(1).max(32).transform((value) => value.toUpperCase());
+var requestFields = {
+  name: external_exports.string().trim().min(1).max(160),
+  method,
+  url: external_exports.string().max(8192),
+  body: external_exports.string().max(1e6).optional(),
+  bodyMode: external_exports.enum(bodyModes).optional(),
+  bodyFields: external_exports.array(bodyFieldSchema).max(100).optional(),
+  bodyVariables: external_exports.string().max(1e6).optional(),
+  bodyMimeType: external_exports.string().max(1024).optional(),
+  bodyFileName: external_exports.string().max(1024).optional(),
+  headers: external_exports.array(fieldSchema).max(100).optional(),
+  params: external_exports.array(fieldSchema).max(100).optional(),
+  pathParams: external_exports.array(fieldSchema).max(100).optional(),
+  auth: authSchema.optional(),
+  documentation: external_exports.string().max(1e5).optional(),
+  responses: external_exports.array(responseDefinitionSchema).max(100).optional(),
+  deprecated: external_exports.boolean().optional(),
+  deprecationReason: external_exports.string().max(4096).optional()
+};
+var requestSchema = external_exports.object(requestFields);
+var requestPatchSchema = external_exports.object(requestFields).partial();
+var operationSchema = external_exports.discriminatedUnion("action", [
+  external_exports.object({ action: external_exports.literal("create_folder"), parentId: external_exports.string().nullable().default(null), name: external_exports.string().trim().min(1).max(160) }),
+  external_exports.object({ action: external_exports.literal("create_request"), parentId: external_exports.string().nullable().default(null), request: requestSchema }),
+  external_exports.object({ action: external_exports.literal("update_request"), requestId: external_exports.string().min(1), patch: requestPatchSchema }),
+  external_exports.object({ action: external_exports.literal("rename_folder"), folderId: external_exports.string().min(1), name: external_exports.string().trim().min(1).max(160) }),
+  external_exports.object({ action: external_exports.literal("move_node"), nodeId: external_exports.string().min(1), parentId: external_exports.string().nullable().default(null), index: external_exports.number().int().min(0).optional() }),
+  external_exports.object({ action: external_exports.literal("deprecate_request"), requestId: external_exports.string().min(1), deprecated: external_exports.boolean().default(true), reason: external_exports.string().max(4096).optional() }),
+  external_exports.object({ action: external_exports.literal("delete_node"), nodeId: external_exports.string().min(1) })
+]);
+var variableNameSchema = external_exports.string().trim().min(1).max(160);
+var variableValueSchema = external_exports.string().max(65536);
+
+// src/commands/changes.ts
+var plans = /* @__PURE__ */ new Map();
+var planLifetimeMs = 10 * 60 * 1e3;
+var changeCommands = [
+  defineCommand({
+    id: "changes.preview",
+    group: "changes",
+    title: "Preview collection changes",
+    description: "Validate a batch of collection operations and return sanitized before/after data without changing anything. Show the preview to the user, then call changes.apply only after they approve it.",
+    params: external_exports.object({ workspaceId: external_exports.string().min(1), operations: external_exports.array(operationSchema).min(1).max(100) }),
+    readOnly: true,
+    run: ({ workspaceId: id, operations }) => {
+      const { raw, workspace } = readWorkspace(id);
+      if (workspace.role === "viewer") throw new Error("This workspace is read-only for the current account.");
+      const result = applyOperations(structuredClone(workspace.tree), operations);
+      const previewId = randomUUID4();
+      const plan = {
+        id: previewId,
+        workspaceId: id,
+        sourceHash: hashRaw(raw),
+        operations,
+        nextTree: result.tree,
+        summary: result.summary,
+        includesDelete: operations.some((operation) => operation.action === "delete_node"),
+        expiresAt: Date.now() + planLifetimeMs
+      };
+      plans.set(previewId, plan);
+      return {
+        previewId,
+        workspaceId: id,
+        workspaceName: workspace.name,
+        changes: result.summary,
+        deletesItems: plan.includesDelete,
+        expiresInSeconds: planLifetimeMs / 1e3
+      };
+    }
+  }),
+  defineCommand({
+    id: "changes.apply",
+    group: "changes",
+    title: "Apply previewed changes",
+    description: "Apply a batch returned by changes.preview. Only call after the user approved that exact preview. Requires confirmDelete=true when the batch deletes anything.",
+    params: external_exports.object({ previewId: external_exports.string().min(1), confirmDelete: external_exports.boolean().default(false) }),
+    readOnly: false,
+    destructive: true,
+    run: ({ previewId, confirmDelete }) => {
+      const plan = plans.get(previewId);
+      if (!plan || plan.expiresAt < Date.now()) {
+        plans.delete(previewId);
+        throw new Error("This preview expired or was not found. Run changes.preview again.");
+      }
+      if (plan.includesDelete && !confirmDelete) {
+        throw new Error("This batch includes deletion. Ask the user to confirm the listed deletions, then retry with confirmDelete=true.");
+      }
+      const updated = updateWorkspace(plan.workspaceId, (workspace, raw) => {
+        if (hashRaw(raw) !== plan.sourceHash) {
+          throw new Error("The workspace changed after this preview. Run changes.preview again to avoid overwriting newer edits.");
+        }
+        return { ...workspace, tree: structuredClone(plan.nextTree) };
+      });
+      plans.delete(previewId);
+      return { applied: true, workspaceId: plan.workspaceId, workspaceName: updated.name, changes: plan.summary };
+    }
+  })
+];
+
+// src/commands/collection.ts
+var workspaceId = external_exports.string().min(1).describe("Workspace id from workspace.list");
+var folderId = external_exports.string().min(1).describe("Folder id from tree.get");
+var nodeId = external_exports.string().min(1).describe("Folder or request id from tree.get");
+var parentId = external_exports.string().nullable().default(null).describe("Parent folder id, or null for the root");
+var confirm = external_exports.literal(true).describe("Must be true; ask the user first");
+var collectionCommands = [
+  defineCommand({
+    id: "folder.create",
+    group: "collection",
+    title: "Create folder",
+    description: "Create a folder under a parent folder, or at the root when parentId is null.",
+    params: external_exports.object({ workspaceId, parentId, name: external_exports.string().trim().min(1).max(160) }),
+    readOnly: false,
+    run: ({ workspaceId: id, parentId: parent, name }) => {
+      let created;
+      updateWorkspace(id, (workspace) => {
+        const result = applyOperation(workspace.tree, { action: "create_folder", parentId: parent, name });
+        created = result.summary.after;
+        return { ...workspace, tree: result.tree };
+      });
+      return created;
+    }
+  }),
+  defineCommand({
+    id: "folder.rename",
+    group: "collection",
+    title: "Rename folder",
+    description: "Rename a folder.",
+    params: external_exports.object({ workspaceId, folderId, name: external_exports.string().trim().min(1).max(160) }),
+    readOnly: false,
+    run: ({ workspaceId: id, folderId: folder, name }) => {
+      updateWorkspace(id, (workspace) => ({ ...workspace, tree: applyOperation(workspace.tree, { action: "rename_folder", folderId: folder, name }).tree }));
+      return { renamed: true, folderId: folder, name };
+    }
+  }),
+  defineCommand({
+    id: "folder.delete",
+    group: "collection",
+    title: "Delete folder",
+    description: "Delete a folder and everything in it. Requires confirm=true after the user confirms the listed deletions.",
+    params: external_exports.object({ workspaceId, folderId, confirm }),
+    readOnly: false,
+    destructive: true,
+    run: ({ workspaceId: id, folderId: folder }) => {
+      updateWorkspace(id, (workspace) => ({ ...workspace, tree: applyOperation(workspace.tree, { action: "delete_node", nodeId: folder }).tree }));
+      return { deleted: true, folderId: folder };
+    }
+  }),
+  defineCommand({
+    id: "node.move",
+    group: "collection",
+    title: "Move folder or request",
+    description: "Move a folder or request under another folder (or the root), optionally at a position.",
+    params: external_exports.object({ workspaceId, nodeId, parentId, index: external_exports.number().int().min(0).optional() }),
+    readOnly: false,
+    run: ({ workspaceId: id, nodeId: node, parentId: parent, index }) => {
+      updateWorkspace(id, (workspace) => ({
+        ...workspace,
+        tree: applyOperation(workspace.tree, { action: "move_node", nodeId: node, parentId: parent, index }).tree
+      }));
+      return { moved: true, nodeId: node, parentId: parent, index: index ?? null };
+    }
+  })
+];
+
+// src/commands/environments.ts
+import { randomUUID as randomUUID5 } from "node:crypto";
+var workspaceId2 = external_exports.string().min(1).describe("Workspace id from workspace.list");
+var environmentId = external_exports.string().min(1).describe("Environment id from environment.list");
+var confirm2 = external_exports.literal(true).describe("Must be true; ask the user first");
+var maxEnvironments = 100;
+function variablesOf(workspace) {
+  return workspace.variables ?? { globals: [], environments: [] };
+}
+function withVariables(workspace, variables) {
+  return { ...workspace, variables };
+}
+function masked(row) {
+  return { id: row.id, name: row.name, secret: row.secret, value: row.secret ? "<secret>" : row.value };
+}
+function findEnvironment(variables, id) {
+  const environment = variables.environments.find((item) => item.id === id);
+  if (!environment) throw new Error(`Environment "${id}" was not found.`);
+  return environment;
+}
+var scopeSchema = external_exports.enum(["global", "environment"]).describe("global for workspace-wide values, environment for one environment");
+function rowsFor(variables, scope, env) {
+  if (scope === "global") return variables.globals;
+  if (!env) throw new Error("environmentId is required for an environment variable.");
+  return findEnvironment(variables, env).variables;
+}
+function variableRevision(workspaceId5, row) {
+  if (!row) return null;
+  const sealed = row.secret ? secretFingerprint(workspaceId5, row.id) : "";
+  return hashRaw(JSON.stringify({ id: row.id, name: row.name, secret: row.secret, value: row.secret ? "" : row.value, sealed }));
+}
+function changedSinceRead(name) {
+  return new Error(`"${name}" changed since you read it. Read it again with variable.get and review the change before writing.`);
+}
+var environmentCommands = [
+  defineCommand({
+    id: "environment.list",
+    group: "environment",
+    title: "List environments and variables",
+    description: "List globals and environments with their variables. Secret values are shown as <secret>.",
+    params: external_exports.object({ workspaceId: workspaceId2 }),
+    readOnly: true,
+    run: ({ workspaceId: id }) => {
+      const { workspace } = readWorkspace(id);
+      const variables = variablesOf(workspace);
+      return {
+        activeEnvironmentId: workspace.activeEnvironmentId ?? null,
+        globals: variables.globals.map(masked),
+        environments: variables.environments.map((environment) => ({
+          id: environment.id,
+          name: environment.name,
+          variables: environment.variables.map(masked)
+        }))
+      };
+    }
+  }),
+  defineCommand({
+    id: "environment.create",
+    group: "environment",
+    title: "Create environment",
+    description: "Create an empty environment. It is not activated until environment.activate.",
+    params: external_exports.object({ workspaceId: workspaceId2, name: external_exports.string().trim().min(1).max(160) }),
+    readOnly: false,
+    run: ({ workspaceId: id, name }) => {
+      let created;
+      updateWorkspace(id, (workspace) => {
+        const variables = variablesOf(workspace);
+        if (variables.environments.length >= maxEnvironments) throw new Error(`A workspace can have at most ${maxEnvironments} environments.`);
+        created = { id: randomUUID5(), name, variables: [] };
+        return withVariables(workspace, { ...variables, environments: [...variables.environments, created] });
+      });
+      return { id: created?.id, name };
+    }
+  }),
+  defineCommand({
+    id: "environment.rename",
+    group: "environment",
+    title: "Rename environment",
+    description: "Rename an environment.",
+    params: external_exports.object({ workspaceId: workspaceId2, environmentId, name: external_exports.string().trim().min(1).max(160) }),
+    readOnly: false,
+    run: ({ workspaceId: id, environmentId: env, name }) => {
+      updateWorkspace(id, (workspace) => {
+        const variables = variablesOf(workspace);
+        findEnvironment(variables, env);
+        return withVariables(workspace, {
+          ...variables,
+          environments: variables.environments.map((item) => item.id === env ? { ...item, name } : item)
+        });
+      });
+      return { id: env, name };
+    }
+  }),
+  defineCommand({
+    id: "environment.duplicate",
+    group: "environment",
+    title: "Duplicate environment",
+    description: 'Copy an environment as "<name>_copy" with new variable ids. Secret values are copied as empty and must be set in the app.',
+    params: external_exports.object({ workspaceId: workspaceId2, environmentId }),
+    readOnly: false,
+    run: ({ workspaceId: id, environmentId: env }) => {
+      let copy;
+      updateWorkspace(id, (workspace) => {
+        const variables = variablesOf(workspace);
+        const source = findEnvironment(variables, env);
+        if (variables.environments.length >= maxEnvironments) throw new Error(`A workspace can have at most ${maxEnvironments} environments.`);
+        copy = {
+          id: randomUUID5(),
+          name: `${source.name}_copy`,
+          variables: source.variables.map((row) => ({ ...row, id: randomUUID5(), value: row.secret ? "" : row.value }))
+        };
+        return withVariables(workspace, { ...variables, environments: [...variables.environments, copy] });
+      });
+      return { id: copy?.id, name: copy?.name };
+    }
+  }),
+  defineCommand({
+    id: "environment.delete",
+    group: "environment",
+    title: "Delete environment",
+    description: "Delete an environment and its variables. Requires confirm=true after the user confirms.",
+    params: external_exports.object({ workspaceId: workspaceId2, environmentId, confirm: confirm2 }),
+    readOnly: false,
+    destructive: true,
+    run: ({ workspaceId: id, environmentId: env }) => {
+      updateWorkspace(id, (workspace) => {
+        const variables = variablesOf(workspace);
+        findEnvironment(variables, env);
+        return {
+          ...withVariables(workspace, { ...variables, environments: variables.environments.filter((item) => item.id !== env) }),
+          activeEnvironmentId: workspace.activeEnvironmentId === env ? null : workspace.activeEnvironmentId
+        };
+      });
+      return { deleted: true, environmentId: env };
+    }
+  }),
+  defineCommand({
+    id: "environment.activate",
+    group: "environment",
+    title: "Set active environment",
+    description: "Make an environment the active one that requests use, or pass null to use none.",
+    params: external_exports.object({ workspaceId: workspaceId2, environmentId: external_exports.string().min(1).nullable() }),
+    readOnly: false,
+    run: ({ workspaceId: id, environmentId: env }) => {
+      updateWorkspace(id, (workspace) => {
+        if (env !== null) findEnvironment(variablesOf(workspace), env);
+        return { ...workspace, activeEnvironmentId: env };
+      });
+      return { activeEnvironmentId: env };
+    }
+  }),
+  defineCommand({
+    id: "variable.get",
+    group: "environment",
+    title: "Get variable",
+    description: "Read one variable and its revision. Secret values are never returned. Pass the revision to variable.set or variable.delete, so a change made since this read is refused.",
+    params: external_exports.object({
+      workspaceId: workspaceId2,
+      scope: scopeSchema,
+      environmentId: external_exports.string().min(1).optional().describe("Required when scope is environment"),
+      name: variableNameSchema
+    }),
+    readOnly: true,
+    run: ({ workspaceId: id, scope, environmentId: env, name }) => {
+      const { workspace } = readWorkspace(id);
+      const existing = rowsFor(variablesOf(workspace), scope, env).find((row) => row.name === name);
+      if (!existing) return { exists: false, name, scope, environmentId: env ?? null, revision: null };
+      return { exists: true, ...masked(existing), scope, environmentId: env ?? null, revision: variableRevision(id, existing) };
+    }
+  }),
+  defineCommand({
+    id: "variable.set",
+    group: "environment",
+    title: "Set variable",
+    description: "Create or update a variable in globals or one environment. Read the variable with variable.get first and pass its revision as expectedRevision (null when it does not exist yet). A secret variable is created with an empty value; its value must be entered in the desktop app, and an existing secret cannot be changed here.",
+    params: external_exports.object({
+      workspaceId: workspaceId2,
+      scope: scopeSchema,
+      environmentId: external_exports.string().min(1).optional().describe("Required when scope is environment"),
+      name: variableNameSchema,
+      value: variableValueSchema.optional(),
+      secret: external_exports.boolean().optional().describe("Secret variables keep their value in the app only"),
+      expectedRevision: external_exports.string().min(1).nullable().optional().describe("Revision from variable.get; null when the variable does not exist yet")
+    }),
+    readOnly: false,
+    run: ({ workspaceId: id, scope, environmentId: env, name, value, secret, expectedRevision }) => {
+      const updated = updateWorkspace(id, (workspace) => {
+        const variables = variablesOf(workspace);
+        if (scope === "environment" && !env) throw new Error("environmentId is required for an environment variable.");
+        const rows = rowsFor(variables, scope, env);
+        const existing = rows.find((row2) => row2.name === name);
+        if (expectedRevision !== void 0) {
+          if (existing && expectedRevision === null) throw new Error(`"${name}" already exists. Read it with variable.get and pass its revision.`);
+          if (variableRevision(id, existing) !== expectedRevision) throw changedSinceRead(name);
+        }
+        if (existing?.secret && value !== void 0 && value !== "") {
+          throw new Error(`"${name}" is a secret. Change its value in the desktop app.`);
+        }
+        if (secret === true && value) throw new Error(`"${name}" is a secret. Enter its value in the desktop app.`);
+        const row = {
+          id: existing?.id ?? randomUUID5(),
+          name,
+          value: secret ? "" : value ?? existing?.value ?? "",
+          secret: secret ?? existing?.secret ?? false
+        };
+        const nextRows = existing ? rows.map((item) => item.id === existing.id ? row : item) : [...rows, row];
+        if (scope === "global") return withVariables(workspace, { ...variables, globals: nextRows });
+        return withVariables(workspace, {
+          ...variables,
+          environments: variables.environments.map((item) => item.id === env ? { ...item, variables: nextRows } : item)
+        });
+      });
+      const written = rowsFor(variablesOf(updated), scope, env).find((row) => row.name === name);
+      return { name, scope, environmentId: env ?? null, secret: secret ?? null, revision: variableRevision(id, written) };
+    }
+  }),
+  defineCommand({
+    id: "variable.delete",
+    group: "environment",
+    title: "Delete variable",
+    description: "Delete a variable from globals or one environment. Read it with variable.get first and pass its revision as expectedRevision. Requires confirm=true after the user confirms.",
+    params: external_exports.object({
+      workspaceId: workspaceId2,
+      scope: scopeSchema,
+      environmentId: external_exports.string().min(1).optional(),
+      name: variableNameSchema,
+      expectedRevision: external_exports.string().min(1).nullable().optional().describe("Revision from variable.get"),
+      confirm: confirm2
+    }),
+    readOnly: false,
+    destructive: true,
+    run: ({ workspaceId: id, scope, environmentId: env, name, expectedRevision }) => {
+      updateWorkspace(id, (workspace) => {
+        const variables = variablesOf(workspace);
+        if (expectedRevision !== void 0) {
+          const existing = rowsFor(variables, scope, env).find((row) => row.name === name);
+          if (variableRevision(id, existing) !== expectedRevision) throw changedSinceRead(name);
+        }
+        if (scope === "global") {
+          return withVariables(workspace, { ...variables, globals: variables.globals.filter((row) => row.name !== name) });
+        }
+        if (!env) throw new Error("environmentId is required for an environment variable.");
+        return withVariables(workspace, {
+          ...variables,
+          environments: variables.environments.map(
+            (item) => item.id === env ? { ...item, variables: item.variables.filter((row) => row.name !== name) } : item
+          )
+        });
+      });
+      return { deleted: true, name, scope };
+    }
+  })
+];
+
+// src/send.ts
+import { readFile } from "node:fs/promises";
+import { basename } from "node:path";
+var timeoutMs = 3e4;
+var maxBodyChars = 1e6;
+var variablePattern = /\{\{\s*([^{}]+?)\s*\}\}/g;
+function resolveVariables(workspace, environmentId2) {
+  const variables = workspace.variables ?? { globals: [], environments: [] };
+  const environment = variables.environments.find((item) => item.id === (environmentId2 ?? workspace.activeEnvironmentId ?? ""));
+  const rows = [...variables.globals, ...environment?.variables ?? []];
+  const values = /* @__PURE__ */ new Map();
+  const blocked = /* @__PURE__ */ new Set();
+  for (const row of rows) {
+    if (row.secret || row.value === "") {
+      blocked.add(row.name);
+      values.delete(row.name);
+    } else {
+      values.set(row.name, row.value);
+      blocked.delete(row.name);
+    }
+  }
+  return { values, blocked };
+}
+function fill(text, values, missing) {
+  return text.replace(variablePattern, (match, name) => {
+    const value = values.get(name);
+    if (value === void 0) {
+      missing.add(name);
+      return match;
+    }
+    return value;
+  });
+}
+var defaultMime = {
+  json: "application/json",
+  graphql: "application/json",
+  xml: "application/xml",
+  yaml: "application/yaml",
+  edn: "application/edn",
+  text: "text/plain",
+  other: "text/plain"
+};
+async function sendRequest(request, workspace, environmentId2, options = {}) {
+  const { values, blocked } = resolveVariables(workspace, environmentId2);
+  const missing = /* @__PURE__ */ new Set();
+  const f = (text2) => fill(text2, values, missing);
+  const headers = new Headers({ Accept: "*/*", "User-Agent": "API-Documentation-CLI/0.2.0" });
+  for (const header of request.headers ?? []) {
+    if (header.enabled && header.name.trim()) headers.set(f(header.name.trim()), f(header.value));
+  }
+  const url = new URL(f(request.url));
+  url.pathname = url.pathname.split("/").map((segment) => {
+    if (!segment.startsWith(":")) return segment;
+    const name = segment.slice(1);
+    const param = (request.pathParams ?? []).find((item) => item.enabled && item.name.trim() === name);
+    if (!param) {
+      missing.add(name);
+      return segment;
+    }
+    return encodeURIComponent(f(param.value));
+  }).join("/");
+  for (const param of request.params ?? []) {
+    if (param.enabled && param.name.trim()) url.searchParams.append(f(param.name.trim()), f(param.value));
+  }
+  const auth = request.auth ?? { type: "none" };
+  if (auth.type === "bearer") headers.set("Authorization", `Bearer ${f(auth.token)}`);
+  if (auth.type === "basic") headers.set("Authorization", `Basic ${Buffer.from(`${f(auth.username)}:${f(auth.password)}`).toString("base64")}`);
+  if (auth.type === "api-key") {
+    if (auth.location === "query") url.searchParams.set(f(auth.name), f(auth.value));
+    else headers.set(f(auth.name), f(auth.value));
+  }
+  let body;
+  const mode = request.bodyMode ?? "none";
+  if (mode === "urlencoded") {
+    const form = new URLSearchParams();
+    for (const field of request.bodyFields ?? []) if (field.enabled && field.type === "text") form.append(f(field.name), f(field.value));
+    body = form.toString();
+    headers.set("Content-Type", "application/x-www-form-urlencoded;charset=UTF-8");
+  } else if (mode === "form-data") {
+    const form = new FormData();
+    for (const field of request.bodyFields ?? []) {
+      if (!field.enabled) continue;
+      if (field.type === "text") form.append(f(field.name), f(field.value));
+      else if (field.filePath) form.append(f(field.name), new Blob([await readFile(field.filePath)]), field.fileName || basename(field.filePath));
+    }
+    body = form;
+  } else if (mode === "file") {
+    if (!request.bodyPath) throw new Error("This request has no file to send as its body.");
+    body = new Blob([await readFile(request.bodyPath)]);
+    if (!headers.has("Content-Type")) headers.set("Content-Type", request.bodyMimeType || "application/octet-stream");
+  } else if (mode !== "none" && request.body) {
+    body = f(request.body);
+    if (!headers.has("Content-Type")) headers.set("Content-Type", request.bodyMimeType || defaultMime[mode] || "text/plain");
+  }
+  if (missing.size) {
+    const names = [...missing];
+    const secretNames = names.filter((name) => blocked.has(name));
+    const hint = secretNames.length ? ` Enter the secret values (${secretNames.join(", ")}) in the desktop app.` : "";
+    throw new Error(`Variables need a value before sending: ${names.join(", ")}.${hint} Set other values with variable.set.`);
+  }
+  const method2 = request.method.toUpperCase();
+  const target = sanitizeUrl(url.toString());
+  if (options.dryRun) return { dryRun: true, method: method2, url: target };
+  if (options.confirmUrl !== void 0 && options.confirmUrl !== target) {
+    throw new Error(`The target changed. This request now goes to ${target}. Confirm that URL with a dry run before sending.`);
+  }
+  const started = Date.now();
+  const response = await fetch(url, {
+    method: method2,
+    headers,
+    body: method2 === "GET" || method2 === "HEAD" ? void 0 : body,
+    signal: AbortSignal.timeout(timeoutMs)
+  });
+  const text = await response.text();
+  return {
+    status: response.status,
+    statusText: response.statusText,
+    url: sanitizeUrl(response.url || url.toString()),
+    durationMs: Date.now() - started,
+    headers: Object.fromEntries(response.headers.entries()),
+    body: text.length > maxBodyChars ? text.slice(0, maxBodyChars) : text,
+    bodyTruncated: text.length > maxBodyChars
+  };
+}
+
+// src/commands/requests.ts
+var workspaceId3 = external_exports.string().min(1).describe("Workspace id from workspace.list");
+var requestId = external_exports.string().min(1).describe("Request id from tree.get or request.search");
+var parentId2 = external_exports.string().nullable().default(null).describe("Folder id, or null for the root");
+var confirm3 = external_exports.literal(true).describe("Must be true; ask the user first");
+var requestCommands = [
+  defineCommand({
+    id: "request.search",
+    group: "request",
+    title: "Search requests",
+    description: "Search request names, methods, URLs, documentation, and response descriptions. Sensitive URL values are masked.",
+    params: external_exports.object({ workspaceId: workspaceId3, query: external_exports.string().trim().min(1).max(200) }),
+    readOnly: true,
+    run: ({ workspaceId: id, query }) => {
+      const { workspace } = readWorkspace(id);
+      const needle = query.toLocaleLowerCase();
+      return requestList(workspace.tree).filter((request) => {
+        const haystack = [request.name, request.method, request.url, request.documentation ?? "", ...(request.responses ?? []).map((item) => item.description)];
+        return haystack.join("\n").toLocaleLowerCase().includes(needle);
+      }).map((request) => safeRequest(request));
+    }
+  }),
+  defineCommand({
+    id: "request.get",
+    group: "request",
+    title: "Read request",
+    description: "Read one request definition: params, body, auth, headers, documented responses, and documentation. Literal secrets are redacted; {{variable}} references are shown as written.",
+    params: external_exports.object({ workspaceId: workspaceId3, requestId }),
+    readOnly: true,
+    run: ({ workspaceId: id, requestId: request }) => safeRequest(findRequest(readWorkspace(id).workspace.tree, request))
+  }),
+  defineCommand({
+    id: "request.create",
+    group: "request",
+    title: "Create request",
+    description: "Create a request under a folder, or at the root when parentId is null. Use {{variableName}} for environment-specific values.",
+    params: external_exports.object({ workspaceId: workspaceId3, parentId: parentId2, request: external_exports.object(requestFields) }),
+    readOnly: false,
+    run: ({ workspaceId: id, parentId: parent, request }) => {
+      let created;
+      updateWorkspace(id, (workspace) => {
+        const result = applyOperation(workspace.tree, { action: "create_request", parentId: parent, request });
+        created = result.summary.after;
+        return { ...workspace, tree: result.tree };
+      });
+      return created;
+    }
+  }),
+  defineCommand({
+    id: "request.update",
+    group: "request",
+    title: "Update request",
+    description: "Change fields of a request. Only the fields you send are changed; existing auth is kept unless you send auth.",
+    params: external_exports.object({ workspaceId: workspaceId3, requestId, patch: external_exports.object(requestFields).partial() }),
+    readOnly: false,
+    run: ({ workspaceId: id, requestId: request, patch }) => {
+      updateWorkspace(id, (workspace) => ({
+        ...workspace,
+        tree: applyOperation(workspace.tree, { action: "update_request", requestId: request, patch }).tree
+      }));
+      return { updated: true, requestId: request };
+    }
+  }),
+  defineCommand({
+    id: "request.duplicate",
+    group: "request",
+    title: "Duplicate request",
+    description: 'Copy a request into the same folder as "<name>_copy", with new ids, and return the copy.',
+    params: external_exports.object({ workspaceId: workspaceId3, requestId }),
+    readOnly: false,
+    run: ({ workspaceId: id, requestId: request }) => {
+      let copyResult;
+      updateWorkspace(id, (workspace) => {
+        const original = findRequest(workspace.tree, request);
+        const parent = findParentId(workspace.tree, original.id) ?? null;
+        const copy = { ...cloneWithNewIds(original), name: `${original.name}_copy` };
+        copyResult = safeRequest(copy);
+        return { ...workspace, tree: insertNode(workspace.tree, parent, copy) };
+      });
+      return copyResult;
+    }
+  }),
+  defineCommand({
+    id: "request.deprecate",
+    group: "request",
+    title: "Mark request deprecated",
+    description: "Mark a request as deprecated (or clear it) with an optional reason.",
+    params: external_exports.object({ workspaceId: workspaceId3, requestId, deprecated: external_exports.boolean(), reason: external_exports.string().max(4096).optional() }),
+    readOnly: false,
+    run: ({ workspaceId: id, requestId: request, deprecated, reason }) => {
+      updateWorkspace(id, (workspace) => ({
+        ...workspace,
+        tree: applyOperation(workspace.tree, { action: "deprecate_request", requestId: request, deprecated, reason }).tree
+      }));
+      return { requestId: request, deprecated };
+    }
+  }),
+  defineCommand({
+    id: "request.delete",
+    group: "request",
+    title: "Delete request",
+    description: "Delete a request. Requires confirm=true after the user confirms.",
+    params: external_exports.object({ workspaceId: workspaceId3, requestId, confirm: confirm3 }),
+    readOnly: false,
+    destructive: true,
+    run: ({ workspaceId: id, requestId: request }) => {
+      updateWorkspace(id, (workspace) => ({ ...workspace, tree: applyOperation(workspace.tree, { action: "delete_node", nodeId: request }).tree }));
+      return { deleted: true, requestId: request };
+    }
+  }),
+  defineCommand({
+    id: "request.send",
+    group: "request",
+    title: "Send request",
+    description: "Send a request over HTTP and return status, headers, and body. {{variables}} are filled from the active or given environment and globals. Secret variables must be set in the desktop app first.",
+    params: external_exports.object({
+      workspaceId: workspaceId3,
+      requestId,
+      environmentId: external_exports.string().min(1).nullable().optional().describe("Environment id; defaults to the active one, or null for none"),
+      dryRun: external_exports.boolean().optional().describe("Return the URL the request would call, without sending it"),
+      confirmUrl: external_exports.string().min(1).optional().describe("Send only if the request still goes to this URL, as shown by a dry run")
+    }),
+    readOnly: false,
+    run: async ({ workspaceId: id, requestId: request, environmentId: environmentId2, dryRun, confirmUrl }) => {
+      const { workspace } = readWorkspace(id);
+      return sendRequest(findRequest(workspace.tree, request), workspace, environmentId2 ?? null, { dryRun, confirmUrl });
+    }
+  })
+];
+
+// src/commands/workspace.ts
+import { randomUUID as randomUUID6 } from "node:crypto";
+var workspaceId4 = external_exports.string().min(1).describe("Workspace id from workspace.list");
+var emptyVariables = () => ({ globals: [], environments: [] });
+var workspaceCommands = [
+  defineCommand({
+    id: "workspace.list",
+    group: "workspace",
+    title: "List workspaces",
+    description: "List the workspaces in the desktop app. Use the returned id for every other command.",
+    params: external_exports.object({}),
+    readOnly: true,
+    run: () => listWorkspaces()
+  }),
+  defineCommand({
+    id: "workspace.create",
+    group: "workspace",
+    title: "Create local workspace",
+    description: "Create an empty local workspace. Cloud workspaces are created in the desktop app.",
+    params: external_exports.object({ name: external_exports.string().trim().min(1).max(160).describe("Workspace name") }),
+    readOnly: false,
+    run: ({ name }) => {
+      const workspace = {
+        id: randomUUID6(),
+        cloudId: null,
+        name,
+        tree: [],
+        baseTree: [],
+        variables: emptyVariables(),
+        baseVariables: emptyVariables(),
+        activeEnvironmentId: null,
+        baseCommitId: null,
+        localHeadId: null
+      };
+      insertWorkspace(workspace);
+      return { id: workspace.id, name: workspace.name };
+    }
+  }),
+  defineCommand({
+    id: "workspace.rename",
+    group: "workspace",
+    title: "Rename workspace",
+    description: "Change the name of a local workspace.",
+    params: external_exports.object({ workspaceId: workspaceId4, name: external_exports.string().trim().min(1).max(160) }),
+    readOnly: false,
+    run: ({ workspaceId: id, name }) => {
+      const workspace = updateWorkspace(id, (current) => ({ ...current, name }));
+      return { id, name: workspace.name };
+    }
+  }),
+  defineCommand({
+    id: "workspace.delete",
+    group: "workspace",
+    title: "Delete local workspace",
+    description: "Delete a local workspace and its commit history. Requires confirm=true after the user confirms. Cloud workspaces are refused.",
+    params: external_exports.object({ workspaceId: workspaceId4, confirm: external_exports.literal(true).describe("Must be true; ask the user first") }),
+    readOnly: false,
+    destructive: true,
+    run: ({ workspaceId: id }) => {
+      const { workspace } = readWorkspace(id);
+      deleteWorkspace(id);
+      return { deleted: true, id, name: workspace.name };
+    }
+  }),
+  defineCommand({
+    id: "tree.get",
+    group: "workspace",
+    title: "Read collection tree",
+    description: "Read the folder hierarchy and request summaries of a workspace. Credentials and secret-like values are redacted.",
+    params: external_exports.object({ workspaceId: workspaceId4 }),
+    readOnly: true,
+    run: ({ workspaceId: id }) => {
+      const { workspace } = readWorkspace(id);
+      return { workspaceId: id, workspaceName: workspace.name, tree: safeTree(workspace.tree) };
+    }
+  })
+];
+
+// src/commands/index.ts
+var listCommand = defineCommand({
+  id: "commands.list",
+  group: "meta",
+  title: "List commands",
+  description: "List every command with its parameters, so an agent can discover what the desktop app can do. Filter with a text query.",
+  params: external_exports.object({ filter: external_exports.string().trim().max(200).optional().describe("Text to match in id, title, or description") }),
+  readOnly: true,
+  run: ({ filter }) => {
+    const needle = filter?.toLocaleLowerCase();
+    return allCommands.filter((command) => !needle || `${command.id} ${command.title} ${command.description}`.toLocaleLowerCase().includes(needle)).map(describeCommand);
+  }
+});
+var allCommands = [
+  listCommand,
+  ...workspaceCommands,
+  ...collectionCommands,
+  ...requestCommands,
+  ...environmentCommands,
+  ...changeCommands
+];
+function findCommand(id) {
+  const command = allCommands.find((item) => item.id === id);
+  if (!command) throw new Error(`Unknown command "${id}". Run "api-documentation-mcp commands" to list them.`);
+  return command;
+}
+async function executeCommand(id, params) {
+  return findCommand(id).run(params);
+}
+
+// src/cli.ts
+var usage = `api-documentation-mcp: drive the API Documentation desktop app from the command line or an AI agent
+
+USAGE:
+  api-documentation-mcp commands [--json] [--filter TEXT]   list every command and its parameters
+  api-documentation-mcp call <command> [json-params]        run one command, print its JSON result
+  api-documentation-mcp run <script.json|-> [--json]        run a JSON array or JSON lines of {"command", "params"}
+  api-documentation-mcp mcp                                 start the MCP server (stdio); also the default with no arguments
+  api-documentation-mcp help
+
+Commands read and write the app's local workspace database. Keep the desktop app open to see changes live.
+Destructive commands need "confirm": true, and collection writes that go through changes.preview need changes.apply.`;
+function printJson(value) {
+  process.stdout.write(`${JSON.stringify(value, null, 2)}
+`);
+}
+function parseParams(text) {
+  if (!text) return {};
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new Error(`Parameters must be JSON, for example '{"workspaceId":"..."}'.`);
+  }
+}
+function listCommands(args2) {
+  const filterAt = args2.indexOf("--filter");
+  const filter = filterAt >= 0 ? args2[filterAt + 1]?.toLocaleLowerCase() : void 0;
+  const commands = allCommands.map(describeCommand).filter((command) => !filter || `${command.id} ${command.title} ${command.description}`.toLocaleLowerCase().includes(filter));
+  if (args2.includes("--json")) return printJson(commands);
+  for (const command of commands) {
+    const flags = [command.readOnly ? "read-only" : "write", command.destructive ? "destructive" : null].filter(Boolean).join(", ");
+    const params = command.params.map((param) => `${param.name}${param.required ? "" : "?"}`).join(" ");
+    process.stdout.write(`${command.id.padEnd(24)} ${command.title} [${flags}]
+  ${params}
+`);
+  }
+}
+function readScript(path) {
+  const text = path === "-" ? readFileSync(0, "utf8") : readFileSync(path, "utf8");
+  const trimmed = text.trim();
+  if (!trimmed) return [];
+  if (trimmed.startsWith("[")) return JSON.parse(trimmed);
+  return trimmed.split("\n").filter((line) => line.trim()).map((line) => JSON.parse(line));
+}
+async function runScript(path) {
+  if (!path) throw new Error("run needs a script path, or - for stdin.");
+  const steps = readScript(path);
+  let failures = 0;
+  for (const [index, step] of steps.entries()) {
+    const { command, params } = step ?? {};
+    if (typeof command !== "string") {
+      failures += 1;
+      process.stdout.write(`${JSON.stringify({ step: index + 1, ok: false, error: 'Each step needs a "command" string.' })}
+`);
+      continue;
+    }
+    try {
+      const result = await executeCommand(command, params ?? {});
+      process.stdout.write(`${JSON.stringify({ step: index + 1, command, ok: true, result })}
+`);
+    } catch (error2) {
+      failures += 1;
+      const message = error2 instanceof Error ? error2.message : String(error2);
+      process.stdout.write(`${JSON.stringify({ step: index + 1, command, ok: false, error: message })}
+`);
+    }
+  }
+  if (failures) process.exitCode = 1;
+}
+async function runCli(args2) {
+  const [name, ...rest] = args2;
+  if (name === "help" || name === "--help" || name === "-h") return void process.stdout.write(`${usage}
+`);
+  if (name === "commands") return listCommands(rest);
+  if (name === "call") {
+    const [command, params] = rest;
+    if (!command) throw new Error('call needs a command id. Run "api-documentation-mcp commands" to list them.');
+    return printJson(await executeCommand(command, parseParams(params)));
+  }
+  if (name === "run") return runScript(rest.find((item) => !item.startsWith("--")));
+  throw new Error(`Unknown subcommand "${name}".
+
+${usage}`);
+}
+
+// node_modules/zod/v4/core/core.js
+var NEVER2 = Object.freeze({
+  status: "aborted"
+});
+// @__NO_SIDE_EFFECTS__
+function $constructor(name, initializer3, params) {
+  function init(inst, def) {
+    var _a;
+    Object.defineProperty(inst, "_zod", {
+      value: inst._zod ?? {},
+      enumerable: false
+    });
+    (_a = inst._zod).traits ?? (_a.traits = /* @__PURE__ */ new Set());
+    inst._zod.traits.add(name);
+    initializer3(inst, def);
+    for (const k in _.prototype) {
+      if (!(k in inst))
+        Object.defineProperty(inst, k, { value: _.prototype[k].bind(inst) });
+    }
+    inst._zod.constr = _;
+    inst._zod.def = def;
+  }
+  const Parent = params?.Parent ?? Object;
+  class Definition extends Parent {
+  }
+  Object.defineProperty(Definition, "name", { value: name });
+  function _(def) {
+    var _a;
+    const inst = params?.Parent ? new Definition() : this;
+    init(inst, def);
+    (_a = inst._zod).deferred ?? (_a.deferred = []);
+    for (const fn of inst._zod.deferred) {
+      fn();
+    }
+    return inst;
+  }
+  Object.defineProperty(_, "init", { value: init });
+  Object.defineProperty(_, Symbol.hasInstance, {
+    value: (inst) => {
+      if (params?.Parent && inst instanceof params.Parent)
+        return true;
+      return inst?._zod?.traits?.has(name);
+    }
+  });
+  Object.defineProperty(_, "name", { value: name });
+  return _;
+}
+var $brand = Symbol("zod_brand");
+var $ZodAsyncError = class extends Error {
+  constructor() {
+    super(`Encountered Promise during synchronous parse. Use .parseAsync() instead.`);
+  }
+};
+var globalConfig = {};
+function config(newConfig) {
+  if (newConfig)
+    Object.assign(globalConfig, newConfig);
+  return globalConfig;
+}
+
+// node_modules/zod/v4/core/util.js
+var util_exports = {};
+__export(util_exports, {
+  BIGINT_FORMAT_RANGES: () => BIGINT_FORMAT_RANGES,
+  Class: () => Class,
+  NUMBER_FORMAT_RANGES: () => NUMBER_FORMAT_RANGES,
+  aborted: () => aborted,
+  allowsEval: () => allowsEval,
+  assert: () => assert,
+  assertEqual: () => assertEqual,
+  assertIs: () => assertIs,
+  assertNever: () => assertNever,
+  assertNotEqual: () => assertNotEqual,
+  assignProp: () => assignProp,
+  cached: () => cached,
+  captureStackTrace: () => captureStackTrace,
+  cleanEnum: () => cleanEnum,
+  cleanRegex: () => cleanRegex,
+  clone: () => clone,
+  createTransparentProxy: () => createTransparentProxy,
+  defineLazy: () => defineLazy,
+  esc: () => esc,
+  escapeRegex: () => escapeRegex,
+  extend: () => extend,
+  finalizeIssue: () => finalizeIssue,
+  floatSafeRemainder: () => floatSafeRemainder2,
+  getElementAtPath: () => getElementAtPath,
+  getEnumValues: () => getEnumValues,
+  getLengthableOrigin: () => getLengthableOrigin,
+  getParsedType: () => getParsedType2,
+  getSizableOrigin: () => getSizableOrigin,
+  isObject: () => isObject,
+  isPlainObject: () => isPlainObject,
+  issue: () => issue,
+  joinValues: () => joinValues,
+  jsonStringifyReplacer: () => jsonStringifyReplacer,
+  merge: () => merge,
+  normalizeParams: () => normalizeParams,
+  nullish: () => nullish,
+  numKeys: () => numKeys,
+  omit: () => omit,
+  optionalKeys: () => optionalKeys,
+  partial: () => partial,
+  pick: () => pick,
+  prefixIssues: () => prefixIssues,
+  primitiveTypes: () => primitiveTypes,
+  promiseAllObject: () => promiseAllObject,
+  propertyKeyTypes: () => propertyKeyTypes,
+  randomString: () => randomString,
+  required: () => required,
+  stringifyPrimitive: () => stringifyPrimitive,
+  unwrapMessage: () => unwrapMessage
+});
+function assertEqual(val) {
+  return val;
+}
+function assertNotEqual(val) {
+  return val;
+}
+function assertIs(_arg) {
+}
+function assertNever(_x) {
+  throw new Error();
+}
+function assert(_) {
+}
+function getEnumValues(entries) {
+  const numericValues = Object.values(entries).filter((v) => typeof v === "number");
+  const values = Object.entries(entries).filter(([k, _]) => numericValues.indexOf(+k) === -1).map(([_, v]) => v);
+  return values;
+}
+function joinValues(array2, separator = "|") {
+  return array2.map((val) => stringifyPrimitive(val)).join(separator);
+}
+function jsonStringifyReplacer(_, value) {
+  if (typeof value === "bigint")
+    return value.toString();
+  return value;
+}
+function cached(getter) {
+  const set = false;
+  return {
+    get value() {
+      if (!set) {
+        const value = getter();
+        Object.defineProperty(this, "value", { value });
+        return value;
+      }
+      throw new Error("cached value already set");
+    }
+  };
+}
+function nullish(input) {
+  return input === null || input === void 0;
+}
+function cleanRegex(source) {
+  const start = source.startsWith("^") ? 1 : 0;
   const end = source.endsWith("$") ? source.length - 1 : source.length;
   return source.slice(start, end);
 }
@@ -11802,8 +13208,8 @@ function getLengthableOrigin(input) {
     return "string";
   return "unknown";
 }
-function issue(...args) {
-  const [iss, input, inst] = args;
+function issue(...args2) {
+  const [iss, input, inst] = args2;
   if (typeof iss === "string") {
     return {
       message: iss,
@@ -11980,20 +13386,20 @@ var hostname = /^([a-zA-Z0-9-]+\.)*[a-zA-Z0-9-]+$/;
 var e164 = /^\+(?:[0-9]){6,14}[0-9]$/;
 var dateSource = `(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))`;
 var date = /* @__PURE__ */ new RegExp(`^${dateSource}$`);
-function timeSource(args) {
+function timeSource(args2) {
   const hhmm = `(?:[01]\\d|2[0-3]):[0-5]\\d`;
-  const regex = typeof args.precision === "number" ? args.precision === -1 ? `${hhmm}` : args.precision === 0 ? `${hhmm}:[0-5]\\d` : `${hhmm}:[0-5]\\d\\.\\d{${args.precision}}` : `${hhmm}(?::[0-5]\\d(?:\\.\\d+)?)?`;
+  const regex = typeof args2.precision === "number" ? args2.precision === -1 ? `${hhmm}` : args2.precision === 0 ? `${hhmm}:[0-5]\\d` : `${hhmm}:[0-5]\\d\\.\\d{${args2.precision}}` : `${hhmm}(?::[0-5]\\d(?:\\.\\d+)?)?`;
   return regex;
 }
-function time(args) {
-  return new RegExp(`^${timeSource(args)}$`);
+function time(args2) {
+  return new RegExp(`^${timeSource(args2)}$`);
 }
-function datetime(args) {
-  const time3 = timeSource({ precision: args.precision });
+function datetime(args2) {
+  const time3 = timeSource({ precision: args2.precision });
   const opts = ["Z"];
-  if (args.local)
+  if (args2.local)
     opts.push("");
-  if (args.offset)
+  if (args2.offset)
     opts.push(`([+-]\\d{2}:\\d{2})`);
   const timeRegex2 = `${time3}(?:${opts.join("|")})`;
   return new RegExp(`^${dateSource}T(?:${timeRegex2})$`);
@@ -12396,11 +13802,11 @@ var $ZodCheckOverwrite = /* @__PURE__ */ $constructor("$ZodCheckOverwrite", (ins
 
 // node_modules/zod/v4/core/doc.js
 var Doc = class {
-  constructor(args = []) {
+  constructor(args2 = []) {
     this.content = [];
     this.indent = 0;
     if (this)
-      this.args = args;
+      this.args = args2;
   }
   indented(fn) {
     this.indent += 1;
@@ -12423,10 +13829,10 @@ var Doc = class {
   }
   compile() {
     const F = Function;
-    const args = this?.args;
+    const args2 = this?.args;
     const content = this?.content ?? [``];
     const lines = [...content.map((x) => `  ${x}`)];
-    return new F(...args, lines.join("\n"));
+    return new F(...args2, lines.join("\n"));
   }
 };
 
@@ -15391,12 +16797,12 @@ var ZodType2 = /* @__PURE__ */ $constructor("ZodType", (inst, def) => {
     },
     configurable: true
   });
-  inst.meta = (...args) => {
-    if (args.length === 0) {
+  inst.meta = (...args2) => {
+    if (args2.length === 0) {
       return globalRegistry.get(inst);
     }
     const cl = inst.clone();
-    globalRegistry.add(cl, args[0]);
+    globalRegistry.add(cl, args2[0]);
     return cl;
   };
   inst.isOptional = () => inst.safeParse(void 0).success;
@@ -15410,18 +16816,18 @@ var _ZodString = /* @__PURE__ */ $constructor("_ZodString", (inst, def) => {
   inst.format = bag.format ?? null;
   inst.minLength = bag.minimum ?? null;
   inst.maxLength = bag.maximum ?? null;
-  inst.regex = (...args) => inst.check(_regex(...args));
-  inst.includes = (...args) => inst.check(_includes(...args));
-  inst.startsWith = (...args) => inst.check(_startsWith(...args));
-  inst.endsWith = (...args) => inst.check(_endsWith(...args));
-  inst.min = (...args) => inst.check(_minLength(...args));
-  inst.max = (...args) => inst.check(_maxLength(...args));
-  inst.length = (...args) => inst.check(_length(...args));
-  inst.nonempty = (...args) => inst.check(_minLength(1, ...args));
+  inst.regex = (...args2) => inst.check(_regex(...args2));
+  inst.includes = (...args2) => inst.check(_includes(...args2));
+  inst.startsWith = (...args2) => inst.check(_startsWith(...args2));
+  inst.endsWith = (...args2) => inst.check(_endsWith(...args2));
+  inst.min = (...args2) => inst.check(_minLength(...args2));
+  inst.max = (...args2) => inst.check(_maxLength(...args2));
+  inst.length = (...args2) => inst.check(_length(...args2));
+  inst.nonempty = (...args2) => inst.check(_minLength(1, ...args2));
   inst.lowercase = (params) => inst.check(_lowercase(params));
   inst.uppercase = (params) => inst.check(_uppercase(params));
   inst.trim = () => inst.check(_trim());
-  inst.normalize = (...args) => inst.check(_normalize(...args));
+  inst.normalize = (...args2) => inst.check(_normalize(...args2));
   inst.toLowerCase = () => inst.check(_toLowerCase());
   inst.toUpperCase = () => inst.check(_toUpperCase());
 });
@@ -15631,8 +17037,8 @@ var ZodObject2 = /* @__PURE__ */ $constructor("ZodObject", (inst, def) => {
   inst.merge = (other) => util_exports.merge(inst, other);
   inst.pick = (mask) => util_exports.pick(inst, mask);
   inst.omit = (mask) => util_exports.omit(inst, mask);
-  inst.partial = (...args) => util_exports.partial(ZodOptional2, inst, args[0]);
-  inst.required = (...args) => util_exports.required(ZodNonOptional, inst, args[0]);
+  inst.partial = (...args2) => util_exports.partial(ZodOptional2, inst, args2[0]);
+  inst.required = (...args2) => util_exports.required(ZodNonOptional, inst, args2[0]);
 });
 function object2(shape, params) {
   const def = {
@@ -18577,8 +19983,8 @@ var parseReadonlyDef = (def, refs) => {
 };
 
 // node_modules/zod-to-json-schema/dist/esm/selectParser.js
-var selectParser = (def, typeName, refs) => {
-  switch (typeName) {
+var selectParser = (def, typeName2, refs) => {
+  switch (typeName2) {
     case ZodFirstPartyTypeKind.ZodString:
       return parseStringDef(def, refs);
     case ZodFirstPartyTypeKind.ZodNumber:
@@ -18648,7 +20054,7 @@ var selectParser = (def, typeName, refs) => {
     case ZodFirstPartyTypeKind.ZodSymbol:
       return void 0;
     default:
-      return /* @__PURE__ */ ((_) => void 0)(typeName);
+      return /* @__PURE__ */ ((_) => void 0)(typeName2);
   }
 };
 
@@ -18861,10 +20267,10 @@ var Protocol = class {
             while (queuedMessage = await this._taskMessageQueue.dequeue(taskId, extra.sessionId)) {
               if (queuedMessage.type === "response" || queuedMessage.type === "error") {
                 const message = queuedMessage.message;
-                const requestId = message.id;
-                const resolver = this._requestResolvers.get(requestId);
+                const requestId2 = message.id;
+                const resolver = this._requestResolvers.get(requestId2);
                 if (resolver) {
-                  this._requestResolvers.delete(requestId);
+                  this._requestResolvers.delete(requestId2);
                   if (queuedMessage.type === "response") {
                     resolver(message);
                   } else {
@@ -18874,7 +20280,7 @@ var Protocol = class {
                   }
                 } else {
                   const messageType = queuedMessage.type === "response" ? "Response" : "Error";
-                  this._onerror(new Error(`${messageType} handler missing for request ${requestId}`));
+                  this._onerror(new Error(`${messageType} handler missing for request ${requestId2}`));
                 }
                 continue;
               }
@@ -19583,26 +20989,26 @@ var Protocol = class {
    *
    * Note that this will replace any previous request handler for the same method.
    */
-  setRequestHandler(requestSchema, handler) {
-    const method = getMethodLiteral(requestSchema);
-    this.assertRequestHandlerCapability(method);
-    this._requestHandlers.set(method, (request, extra) => {
-      const parsed = parseWithCompat(requestSchema, request);
+  setRequestHandler(requestSchema2, handler) {
+    const method2 = getMethodLiteral(requestSchema2);
+    this.assertRequestHandlerCapability(method2);
+    this._requestHandlers.set(method2, (request, extra) => {
+      const parsed = parseWithCompat(requestSchema2, request);
       return Promise.resolve(handler(parsed, extra));
     });
   }
   /**
    * Removes the request handler for the given method.
    */
-  removeRequestHandler(method) {
-    this._requestHandlers.delete(method);
+  removeRequestHandler(method2) {
+    this._requestHandlers.delete(method2);
   }
   /**
    * Asserts that a request handler has not already been set for the given method, in preparation for a new one being automatically installed.
    */
-  assertCanSetRequestHandler(method) {
-    if (this._requestHandlers.has(method)) {
-      throw new Error(`A request handler for ${method} already exists, which would be overridden`);
+  assertCanSetRequestHandler(method2) {
+    if (this._requestHandlers.has(method2)) {
+      throw new Error(`A request handler for ${method2} already exists, which would be overridden`);
     }
   }
   /**
@@ -19611,8 +21017,8 @@ var Protocol = class {
    * Note that this will replace any previous notification handler for the same method.
    */
   setNotificationHandler(notificationSchema, handler) {
-    const method = getMethodLiteral(notificationSchema);
-    this._notificationHandlers.set(method, (notification) => {
+    const method2 = getMethodLiteral(notificationSchema);
+    this._notificationHandlers.set(method2, (notification) => {
       const parsed = parseWithCompat(notificationSchema, notification);
       return Promise.resolve(handler(parsed));
     });
@@ -19620,8 +21026,8 @@ var Protocol = class {
   /**
    * Removes the notification handler for the given method.
    */
-  removeNotificationHandler(method) {
-    this._notificationHandlers.delete(method);
+  removeNotificationHandler(method2) {
+    this._notificationHandlers.delete(method2);
   }
   /**
    * Cleans up the progress handler associated with a task.
@@ -19662,13 +21068,13 @@ var Protocol = class {
       const messages = await this._taskMessageQueue.dequeueAll(taskId, sessionId);
       for (const message of messages) {
         if (message.type === "request" && isJSONRPCRequest(message.message)) {
-          const requestId = message.message.id;
-          const resolver = this._requestResolvers.get(requestId);
+          const requestId2 = message.message.id;
+          const resolver = this._requestResolvers.get(requestId2);
           if (resolver) {
             resolver(new McpError(ErrorCode.InternalError, "Task cancelled or completed"));
-            this._requestResolvers.delete(requestId);
+            this._requestResolvers.delete(requestId2);
           } else {
-            this._onerror(new Error(`Resolver missing for request ${requestId} during task ${taskId} cleanup`));
+            this._onerror(new Error(`Resolver missing for request ${requestId2} during task ${taskId} cleanup`));
           }
         }
       }
@@ -20071,33 +21477,33 @@ var ExperimentalServerTasks = class {
 };
 
 // node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/helpers.js
-function assertToolsCallTaskCapability(requests, method, entityName) {
+function assertToolsCallTaskCapability(requests, method2, entityName) {
   if (!requests) {
-    throw new Error(`${entityName} does not support task creation (required for ${method})`);
+    throw new Error(`${entityName} does not support task creation (required for ${method2})`);
   }
-  switch (method) {
+  switch (method2) {
     case "tools/call":
       if (!requests.tools?.call) {
-        throw new Error(`${entityName} does not support task creation for tools/call (required for ${method})`);
+        throw new Error(`${entityName} does not support task creation for tools/call (required for ${method2})`);
       }
       break;
     default:
       break;
   }
 }
-function assertClientRequestTaskCapability(requests, method, entityName) {
+function assertClientRequestTaskCapability(requests, method2, entityName) {
   if (!requests) {
-    throw new Error(`${entityName} does not support task creation (required for ${method})`);
+    throw new Error(`${entityName} does not support task creation (required for ${method2})`);
   }
-  switch (method) {
+  switch (method2) {
     case "sampling/createMessage":
       if (!requests.sampling?.createMessage) {
-        throw new Error(`${entityName} does not support task creation for sampling/createMessage (required for ${method})`);
+        throw new Error(`${entityName} does not support task creation for sampling/createMessage (required for ${method2})`);
       }
       break;
     case "elicitation/create":
       if (!requests.elicitation?.create) {
-        throw new Error(`${entityName} does not support task creation for elicitation/create (required for ${method})`);
+        throw new Error(`${entityName} does not support task creation for elicitation/create (required for ${method2})`);
       }
       break;
     default:
@@ -20165,8 +21571,8 @@ var Server = class extends Protocol {
   /**
    * Override request handler registration to enforce server-side validation for tools/call.
    */
-  setRequestHandler(requestSchema, handler) {
-    const shape = getObjectShape(requestSchema);
+  setRequestHandler(requestSchema2, handler) {
+    const shape = getObjectShape(requestSchema2);
     const methodSchema = shape?.method;
     if (!methodSchema) {
       throw new Error("Schema is missing a method literal");
@@ -20175,8 +21581,8 @@ var Server = class extends Protocol {
     if (typeof methodValue !== "string") {
       throw new Error("Schema method literal must be a string");
     }
-    const method = methodValue;
-    if (method === "tools/call") {
+    const method2 = methodValue;
+    if (method2 === "tools/call") {
       const wrappedHandler = async (request, extra) => {
         const validatedRequest = safeParse2(CallToolRequestSchema, request);
         if (!validatedRequest.success) {
@@ -20200,57 +21606,57 @@ var Server = class extends Protocol {
         }
         return validationResult.data;
       };
-      return super.setRequestHandler(requestSchema, wrappedHandler);
+      return super.setRequestHandler(requestSchema2, wrappedHandler);
     }
-    return super.setRequestHandler(requestSchema, handler);
+    return super.setRequestHandler(requestSchema2, handler);
   }
-  assertCapabilityForMethod(method) {
-    switch (method) {
+  assertCapabilityForMethod(method2) {
+    switch (method2) {
       case "sampling/createMessage":
         if (!this._clientCapabilities?.sampling) {
-          throw new Error(`Client does not support sampling (required for ${method})`);
+          throw new Error(`Client does not support sampling (required for ${method2})`);
         }
         break;
       case "elicitation/create":
         if (!this._clientCapabilities?.elicitation) {
-          throw new Error(`Client does not support elicitation (required for ${method})`);
+          throw new Error(`Client does not support elicitation (required for ${method2})`);
         }
         break;
       case "roots/list":
         if (!this._clientCapabilities?.roots) {
-          throw new Error(`Client does not support listing roots (required for ${method})`);
+          throw new Error(`Client does not support listing roots (required for ${method2})`);
         }
         break;
       case "ping":
         break;
     }
   }
-  assertNotificationCapability(method) {
-    switch (method) {
+  assertNotificationCapability(method2) {
+    switch (method2) {
       case "notifications/message":
         if (!this._capabilities.logging) {
-          throw new Error(`Server does not support logging (required for ${method})`);
+          throw new Error(`Server does not support logging (required for ${method2})`);
         }
         break;
       case "notifications/resources/updated":
       case "notifications/resources/list_changed":
         if (!this._capabilities.resources) {
-          throw new Error(`Server does not support notifying about resources (required for ${method})`);
+          throw new Error(`Server does not support notifying about resources (required for ${method2})`);
         }
         break;
       case "notifications/tools/list_changed":
         if (!this._capabilities.tools) {
-          throw new Error(`Server does not support notifying of tool list changes (required for ${method})`);
+          throw new Error(`Server does not support notifying of tool list changes (required for ${method2})`);
         }
         break;
       case "notifications/prompts/list_changed":
         if (!this._capabilities.prompts) {
-          throw new Error(`Server does not support notifying of prompt list changes (required for ${method})`);
+          throw new Error(`Server does not support notifying of prompt list changes (required for ${method2})`);
         }
         break;
       case "notifications/elicitation/complete":
         if (!this._clientCapabilities?.elicitation?.url) {
-          throw new Error(`Client does not support URL elicitation (required for ${method})`);
+          throw new Error(`Client does not support URL elicitation (required for ${method2})`);
         }
         break;
       case "notifications/cancelled":
@@ -20259,38 +21665,38 @@ var Server = class extends Protocol {
         break;
     }
   }
-  assertRequestHandlerCapability(method) {
+  assertRequestHandlerCapability(method2) {
     if (!this._capabilities) {
       return;
     }
-    switch (method) {
+    switch (method2) {
       case "completion/complete":
         if (!this._capabilities.completions) {
-          throw new Error(`Server does not support completions (required for ${method})`);
+          throw new Error(`Server does not support completions (required for ${method2})`);
         }
         break;
       case "logging/setLevel":
         if (!this._capabilities.logging) {
-          throw new Error(`Server does not support logging (required for ${method})`);
+          throw new Error(`Server does not support logging (required for ${method2})`);
         }
         break;
       case "prompts/get":
       case "prompts/list":
         if (!this._capabilities.prompts) {
-          throw new Error(`Server does not support prompts (required for ${method})`);
+          throw new Error(`Server does not support prompts (required for ${method2})`);
         }
         break;
       case "resources/list":
       case "resources/templates/list":
       case "resources/read":
         if (!this._capabilities.resources) {
-          throw new Error(`Server does not support resources (required for ${method})`);
+          throw new Error(`Server does not support resources (required for ${method2})`);
         }
         break;
       case "tools/call":
       case "tools/list":
         if (!this._capabilities.tools) {
-          throw new Error(`Server does not support tools (required for ${method})`);
+          throw new Error(`Server does not support tools (required for ${method2})`);
         }
         break;
       case "tasks/get":
@@ -20298,7 +21704,7 @@ var Server = class extends Protocol {
       case "tasks/result":
       case "tasks/cancel":
         if (!this._capabilities.tasks) {
-          throw new Error(`Server does not support tasks capability (required for ${method})`);
+          throw new Error(`Server does not support tasks capability (required for ${method2})`);
         }
         break;
       case "ping":
@@ -20306,14 +21712,14 @@ var Server = class extends Protocol {
         break;
     }
   }
-  assertTaskCapability(method) {
-    assertClientRequestTaskCapability(this._clientCapabilities?.tasks?.requests, method, "Client");
+  assertTaskCapability(method2) {
+    assertClientRequestTaskCapability(this._clientCapabilities?.tasks?.requests, method2, "Client");
   }
-  assertTaskHandlerCapability(method) {
+  assertTaskHandlerCapability(method2) {
     if (!this._capabilities) {
       return;
     }
-    assertToolsCallTaskCapability(this._capabilities.tasks?.requests, method, "Server");
+    assertToolsCallTaskCapability(this._capabilities.tasks?.requests, method2, "Server");
   }
   async _oninitialize(request) {
     const requestedVersion = request.params.protocolVersion;
@@ -20612,6 +22018,15 @@ var McpServer = class {
     this._promptHandlersInitialized = false;
     this.server = new Server(serverInfo, options);
     this._maxToolInputElements = resolveMaxToolInputElements(options?.maxToolInputElements);
+    if (options?.capabilities?.tools) {
+      this.setToolRequestHandlers();
+    }
+    if (options?.capabilities?.resources) {
+      this.setResourceRequestHandlers();
+    }
+    if (options?.capabilities?.prompts) {
+      this.setPromptRequestHandlers();
+    }
   }
   /**
    * Access experimental features.
@@ -20703,8 +22118,8 @@ var McpServer = class {
         if (taskSupport === "optional" && !isTaskRequest && isTaskHandler) {
           return await this.handleAutomaticTaskPolling(tool, request, extra);
         }
-        const args = await this.validateToolInput(tool, request.params.arguments, request.params.name);
-        const result = await this.executeToolHandler(tool, args, extra);
+        const args2 = await this.validateToolInput(tool, request.params.arguments, request.params.name);
+        const result = await this.executeToolHandler(tool, args2, extra);
         if (isTaskRequest) {
           return result;
         }
@@ -20741,27 +22156,27 @@ var McpServer = class {
   /**
    * Validates tool input arguments against the tool's input schema.
    */
-  async validateToolInput(tool, args, toolName) {
-    if (this._maxToolInputElements !== void 0 && toolInputElementCount(args, this._maxToolInputElements) > this._maxToolInputElements) {
-      throw new McpError(ErrorCode.InvalidParams, `Invalid arguments for tool ${toolName}: arguments contain more than the maximum of ${this._maxToolInputElements} elements`);
+  async validateToolInput(tool, args2, toolName2) {
+    if (this._maxToolInputElements !== void 0 && toolInputElementCount(args2, this._maxToolInputElements) > this._maxToolInputElements) {
+      throw new McpError(ErrorCode.InvalidParams, `Invalid arguments for tool ${toolName2}: arguments contain more than the maximum of ${this._maxToolInputElements} elements`);
     }
     if (!tool.inputSchema) {
       return void 0;
     }
     const inputObj = normalizeObjectSchema(tool.inputSchema);
     const schemaToParse = inputObj ?? tool.inputSchema;
-    const parseResult = await safeParseAsync2(schemaToParse, args ?? {});
+    const parseResult = await safeParseAsync2(schemaToParse, args2 ?? {});
     if (!parseResult.success) {
       const error2 = "error" in parseResult ? parseResult.error : "Unknown error";
       const errorMessage = getParseErrorMessage(error2);
-      throw new McpError(ErrorCode.InvalidParams, `Input validation error: Invalid arguments for tool ${toolName}: ${errorMessage}`);
+      throw new McpError(ErrorCode.InvalidParams, `Input validation error: Invalid arguments for tool ${toolName2}: ${errorMessage}`);
     }
     return parseResult.data;
   }
   /**
    * Validates tool output against the tool's output schema.
    */
-  async validateToolOutput(tool, result, toolName) {
+  async validateToolOutput(tool, result, toolName2) {
     if (!tool.outputSchema) {
       return;
     }
@@ -20772,20 +22187,20 @@ var McpServer = class {
       return;
     }
     if (!result.structuredContent) {
-      throw new McpError(ErrorCode.InvalidParams, `Output validation error: Tool ${toolName} has an output schema but no structured content was provided`);
+      throw new McpError(ErrorCode.InvalidParams, `Output validation error: Tool ${toolName2} has an output schema but no structured content was provided`);
     }
     const outputObj = normalizeObjectSchema(tool.outputSchema);
     const parseResult = await safeParseAsync2(outputObj, result.structuredContent);
     if (!parseResult.success) {
       const error2 = "error" in parseResult ? parseResult.error : "Unknown error";
       const errorMessage = getParseErrorMessage(error2);
-      throw new McpError(ErrorCode.InvalidParams, `Output validation error: Invalid structured content for tool ${toolName}: ${errorMessage}`);
+      throw new McpError(ErrorCode.InvalidParams, `Output validation error: Invalid structured content for tool ${toolName2}: ${errorMessage}`);
     }
   }
   /**
    * Executes a tool handler (either regular or task-based).
    */
-  async executeToolHandler(tool, args, extra) {
+  async executeToolHandler(tool, args2, extra) {
     const handler = tool.handler;
     const isTaskHandler = "createTask" in handler;
     if (isTaskHandler) {
@@ -20795,7 +22210,7 @@ var McpServer = class {
       const taskExtra = { ...extra, taskStore: extra.taskStore };
       if (tool.inputSchema) {
         const typedHandler = handler;
-        return await Promise.resolve(typedHandler.createTask(args, taskExtra));
+        return await Promise.resolve(typedHandler.createTask(args2, taskExtra));
       } else {
         const typedHandler = handler;
         return await Promise.resolve(typedHandler.createTask(taskExtra));
@@ -20803,7 +22218,7 @@ var McpServer = class {
     }
     if (tool.inputSchema) {
       const typedHandler = handler;
-      return await Promise.resolve(typedHandler(args, extra));
+      return await Promise.resolve(typedHandler(args2, extra));
     } else {
       const typedHandler = handler;
       return await Promise.resolve(typedHandler(extra));
@@ -20816,10 +22231,10 @@ var McpServer = class {
     if (!extra.taskStore) {
       throw new Error("No task store provided for task-capable tool.");
     }
-    const args = await this.validateToolInput(tool, request.params.arguments, request.params.name);
+    const args2 = await this.validateToolInput(tool, request.params.arguments, request.params.name);
     const handler = tool.handler;
     const taskExtra = { ...extra, taskStore: extra.taskStore };
-    const createTaskResult = args ? await Promise.resolve(handler.createTask(args, taskExtra)) : (
+    const createTaskResult = args2 ? await Promise.resolve(handler.createTask(args2, taskExtra)) : (
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       await Promise.resolve(handler.createTask(taskExtra))
     );
@@ -20994,9 +22409,9 @@ var McpServer = class {
           const errorMessage = getParseErrorMessage(error2);
           throw new McpError(ErrorCode.InvalidParams, `Invalid arguments for prompt ${request.params.name}: ${errorMessage}`);
         }
-        const args = parseResult.data;
+        const args2 = parseResult.data;
         const cb = prompt.callback;
-        return await Promise.resolve(cb(args, extra));
+        return await Promise.resolve(cb(args2, extra));
       } else {
         const cb = prompt.callback;
         return await Promise.resolve(cb(extra));
@@ -21286,654 +22701,408 @@ var McpServer = class {
   }
   /**
    * Sends a logging message to the client, if connected.
-   * Note: You only need to send the parameters object, not the entire JSON RPC message
-   * @see LoggingMessageNotification
-   * @param params
-   * @param sessionId optional for stateless and backward compatibility
-   */
-  async sendLoggingMessage(params, sessionId) {
-    return this.server.sendLoggingMessage(params, sessionId);
-  }
-  /**
-   * Sends a resource list changed event to the client, if connected.
-   */
-  sendResourceListChanged() {
-    if (this.isConnected()) {
-      this.server.sendResourceListChanged();
-    }
-  }
-  /**
-   * Sends a tool list changed event to the client, if connected.
-   */
-  sendToolListChanged() {
-    if (this.isConnected()) {
-      this.server.sendToolListChanged();
-    }
-  }
-  /**
-   * Sends a prompt list changed event to the client, if connected.
-   */
-  sendPromptListChanged() {
-    if (this.isConnected()) {
-      this.server.sendPromptListChanged();
-    }
-  }
-};
-var EMPTY_OBJECT_JSON_SCHEMA = {
-  type: "object",
-  properties: {}
-};
-function isZodTypeLike(value) {
-  return value !== null && typeof value === "object" && "parse" in value && typeof value.parse === "function" && "safeParse" in value && typeof value.safeParse === "function";
-}
-function isZodSchemaInstance(obj) {
-  return "_def" in obj || "_zod" in obj || isZodTypeLike(obj);
-}
-function isZodRawShapeCompat(obj) {
-  if (typeof obj !== "object" || obj === null) {
-    return false;
-  }
-  if (isZodSchemaInstance(obj)) {
-    return false;
-  }
-  if (Object.keys(obj).length === 0) {
-    return true;
-  }
-  return Object.values(obj).some(isZodTypeLike);
-}
-function getZodSchemaObject(schema) {
-  if (!schema) {
-    return void 0;
-  }
-  if (isZodRawShapeCompat(schema)) {
-    return objectFromShape(schema);
-  }
-  if (!isZodSchemaInstance(schema)) {
-    throw new Error("inputSchema must be a Zod schema or raw shape, received an unrecognized object");
-  }
-  return schema;
-}
-function promptArgumentsFromSchema(schema) {
-  const shape = getObjectShape(schema);
-  if (!shape)
-    return [];
-  return Object.entries(shape).map(([name, field]) => {
-    const description = getSchemaDescription(field);
-    const isOptional = isSchemaOptional(field);
-    return {
-      name,
-      description,
-      required: !isOptional
-    };
-  });
-}
-function getMethodValue(schema) {
-  const shape = getObjectShape(schema);
-  const methodSchema = shape?.method;
-  if (!methodSchema) {
-    throw new Error("Schema is missing a method literal");
-  }
-  const value = getLiteralValue(methodSchema);
-  if (typeof value === "string") {
-    return value;
-  }
-  throw new Error("Schema method literal must be a string");
-}
-function createCompletionResult(suggestions) {
-  return {
-    completion: {
-      values: suggestions.slice(0, 100),
-      total: suggestions.length,
-      hasMore: suggestions.length > 100
-    }
-  };
-}
-var EMPTY_COMPLETION_RESULT = {
-  completion: {
-    values: [],
-    hasMore: false
-  }
-};
-
-// node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
-import process2 from "node:process";
-
-// node_modules/@modelcontextprotocol/sdk/dist/esm/shared/stdio.js
-var STDIO_DEFAULT_MAX_BUFFER_SIZE = 10 * 1024 * 1024;
-var ReadBuffer = class {
-  constructor(options) {
-    this._maxBufferSize = options?.maxBufferSize ?? STDIO_DEFAULT_MAX_BUFFER_SIZE;
-  }
-  append(chunk) {
-    const newSize = (this._buffer?.length ?? 0) + chunk.length;
-    if (newSize > this._maxBufferSize) {
-      this.clear();
-      throw new Error(`ReadBuffer exceeded maximum size of ${this._maxBufferSize} bytes`);
-    }
-    this._buffer = this._buffer ? Buffer.concat([this._buffer, chunk]) : chunk;
-  }
-  readMessage() {
-    if (!this._buffer) {
-      return null;
-    }
-    const index = this._buffer.indexOf("\n");
-    if (index === -1) {
-      return null;
-    }
-    const line = this._buffer.toString("utf8", 0, index).replace(/\r$/, "");
-    this._buffer = this._buffer.subarray(index + 1);
-    return deserializeMessage(line);
-  }
-  clear() {
-    this._buffer = void 0;
-  }
-};
-function deserializeMessage(line) {
-  return JSONRPCMessageSchema.parse(JSON.parse(line));
-}
-function serializeMessage(message) {
-  return JSON.stringify(message) + "\n";
-}
-
-// node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
-var StdioServerTransport = class {
-  constructor(_stdin = process2.stdin, _stdout = process2.stdout, options) {
-    this._stdin = _stdin;
-    this._stdout = _stdout;
-    this._started = false;
-    this._ondata = (chunk) => {
-      try {
-        this._readBuffer.append(chunk);
-        this.processReadBuffer();
-      } catch (error2) {
-        this.onerror?.(error2);
-        this.close().catch(() => {
-        });
-      }
-    };
-    this._onerror = (error2) => {
-      this.onerror?.(error2);
-    };
-    this._readBuffer = new ReadBuffer({ maxBufferSize: options?.maxBufferSize });
+   * Note: You only need to send the parameters object, not the entire JSON RPC message
+   * @see LoggingMessageNotification
+   * @param params
+   * @param sessionId optional for stateless and backward compatibility
+   */
+  async sendLoggingMessage(params, sessionId) {
+    return this.server.sendLoggingMessage(params, sessionId);
   }
   /**
-   * Starts listening for messages on stdin.
+   * Sends a resource list changed event to the client, if connected.
    */
-  async start() {
-    if (this._started) {
-      throw new Error("StdioServerTransport already started! If using Server class, note that connect() calls start() automatically.");
+  sendResourceListChanged() {
+    if (this.isConnected()) {
+      this.server.sendResourceListChanged();
     }
-    this._started = true;
-    this._stdin.on("data", this._ondata);
-    this._stdin.on("error", this._onerror);
   }
-  processReadBuffer() {
-    while (true) {
-      try {
-        const message = this._readBuffer.readMessage();
-        if (message === null) {
-          break;
-        }
-        this.onmessage?.(message);
-      } catch (error2) {
-        this.onerror?.(error2);
-      }
+  /**
+   * Sends a tool list changed event to the client, if connected.
+   */
+  sendToolListChanged() {
+    if (this.isConnected()) {
+      this.server.sendToolListChanged();
     }
   }
-  async close() {
-    this._stdin.off("data", this._ondata);
-    this._stdin.off("error", this._onerror);
-    const remainingDataListeners = this._stdin.listenerCount("data");
-    if (remainingDataListeners === 0) {
-      this._stdin.pause();
+  /**
+   * Sends a prompt list changed event to the client, if connected.
+   */
+  sendPromptListChanged() {
+    if (this.isConnected()) {
+      this.server.sendPromptListChanged();
     }
-    this._readBuffer.clear();
-    this.onclose?.();
-  }
-  send(message) {
-    return new Promise((resolve) => {
-      const json = serializeMessage(message);
-      if (this._stdout.write(json)) {
-        resolve();
-      } else {
-        this._stdout.once("drain", resolve);
-      }
-    });
   }
 };
-
-// src/mcp/server.ts
-var appName = "api-documentation-bit";
-var defaultAppData = process.platform === "win32" ? process.env.APPDATA || join(homedir(), "AppData", "Roaming") : process.platform === "darwin" ? join(homedir(), "Library", "Application Support") : process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
-var dataDirectory = process.env.API_DOCS_USER_DATA_DIR || join(defaultAppData, appName);
-var databasePath = join(dataDirectory, "workspace.sqlite");
-var plans = /* @__PURE__ */ new Map();
-var localDatabase;
-var bodyModes = ["form-data", "urlencoded", "graphql", "json", "xml", "yaml", "edn", "text", "other", "file", "none"];
-var authSchema = external_exports.discriminatedUnion("type", [
-  external_exports.object({ type: external_exports.literal("none") }),
-  external_exports.object({ type: external_exports.literal("bearer"), token: external_exports.string().max(65536) }),
-  external_exports.object({ type: external_exports.literal("basic"), username: external_exports.string().max(8192), password: external_exports.string().max(65536) }),
-  external_exports.object({ type: external_exports.literal("api-key"), name: external_exports.string().max(8192), value: external_exports.string().max(65536), location: external_exports.enum(["header", "query"]) })
-]);
-var fieldSchema = external_exports.object({
-  id: external_exports.string().optional(),
-  name: external_exports.string().max(8192),
-  value: external_exports.string().max(65536),
-  enabled: external_exports.boolean().default(true),
-  description: external_exports.string().max(4096).optional()
-});
-var bodyFieldSchema = external_exports.object({
-  id: external_exports.string().optional(),
-  name: external_exports.string().max(8192),
-  value: external_exports.string().max(65536),
-  enabled: external_exports.boolean().default(true),
-  type: external_exports.enum(["text", "file"]).default("text"),
-  fileName: external_exports.string().max(1024).optional()
-});
-var responseContentSchema = external_exports.object({
-  id: external_exports.string().optional(),
-  mediaType: external_exports.string().max(160),
-  schema: external_exports.string().max(1e6),
-  example: external_exports.string().max(1e6)
-});
-var responseDefinitionSchema = external_exports.object({
-  id: external_exports.string().optional(),
-  statusCode: external_exports.string().trim().min(1).max(12),
-  description: external_exports.string().max(500),
-  content: external_exports.array(responseContentSchema).max(20)
-});
-var requestShape = {
-  name: external_exports.string().trim().min(1).max(160),
-  method: external_exports.string().trim().min(1).max(32),
-  url: external_exports.string().max(8192),
-  body: external_exports.string().max(1e6).optional(),
-  bodyMode: external_exports.enum(bodyModes).optional(),
-  bodyFields: external_exports.array(bodyFieldSchema).max(100).optional(),
-  bodyVariables: external_exports.string().max(1e6).optional(),
-  bodyMimeType: external_exports.string().max(1024).optional(),
-  bodyFileName: external_exports.string().max(1024).optional(),
-  headers: external_exports.array(fieldSchema).max(100).optional(),
-  params: external_exports.array(fieldSchema).max(100).optional(),
-  pathParams: external_exports.array(fieldSchema).max(100).optional(),
-  auth: authSchema.optional(),
-  documentation: external_exports.string().max(1e5).optional(),
-  responses: external_exports.array(responseDefinitionSchema).max(100).optional(),
-  deprecated: external_exports.boolean().optional(),
-  deprecationReason: external_exports.string().max(4096).optional()
+var EMPTY_OBJECT_JSON_SCHEMA = {
+  type: "object",
+  properties: {}
 };
-var operationSchema = external_exports.discriminatedUnion("action", [
-  external_exports.object({ action: external_exports.literal("create_folder"), parentId: external_exports.string().nullable().default(null), name: external_exports.string().trim().min(1).max(160) }),
-  external_exports.object({ action: external_exports.literal("create_request"), parentId: external_exports.string().nullable().default(null), request: external_exports.object(requestShape).extend({ method: requestShape.method.transform((method) => method.toUpperCase()) }) }),
-  external_exports.object({ action: external_exports.literal("update_request"), requestId: external_exports.string().min(1), patch: external_exports.object({
-    ...requestShape,
-    name: requestShape.name.optional(),
-    method: requestShape.method.transform((method) => method.toUpperCase()).optional(),
-    url: requestShape.url.optional()
-  }).partial() }),
-  external_exports.object({ action: external_exports.literal("rename_folder"), folderId: external_exports.string().min(1), name: external_exports.string().trim().min(1).max(160) }),
-  external_exports.object({ action: external_exports.literal("move_node"), nodeId: external_exports.string().min(1), parentId: external_exports.string().nullable().default(null), index: external_exports.number().int().min(0).optional() }),
-  external_exports.object({ action: external_exports.literal("deprecate_request"), requestId: external_exports.string().min(1), deprecated: external_exports.boolean().default(true), reason: external_exports.string().max(4096).optional() }),
-  external_exports.object({ action: external_exports.literal("delete_node"), nodeId: external_exports.string().min(1) })
-]);
-function database() {
-  if (!existsSync(databasePath)) {
-    throw new Error(`Workspace database was not found at ${databasePath}. Open API Documentation once to create the local workspace.`);
-  }
-  if (!localDatabase) {
-    localDatabase = new DatabaseSync(databasePath);
-    localDatabase.exec("PRAGMA busy_timeout = 5000;");
-  }
-  return localDatabase;
-}
-function jsonResult(value) {
-  return { content: [{ type: "text", text: JSON.stringify(value, null, 2) }] };
-}
-function loadRawWorkspace(workspaceId) {
-  const row = database().prepare("SELECT data FROM workspaces WHERE id = ?").get(workspaceId);
-  if (!row) throw new Error(`Workspace "${workspaceId}" was not found.`);
-  const workspace = JSON.parse(row.data);
-  if (!Array.isArray(workspace.tree)) throw new Error("Workspace collection data is invalid.");
-  return { raw: row.data, workspace };
-}
-function assertCanEdit(workspace) {
-  if (workspace.role === "viewer") throw new Error("This workspace is read-only for the current account.");
+function isZodTypeLike(value) {
+  return value !== null && typeof value === "object" && "parse" in value && typeof value.parse === "function" && "safeParse" in value && typeof value.safeParse === "function";
 }
-function isFolder(node) {
-  return node.kind === "folder";
+function isZodSchemaInstance(obj) {
+  return "_def" in obj || "_zod" in obj || isZodTypeLike(obj);
 }
-function findNode(nodes, id) {
-  for (const node of nodes) {
-    if (node.id === id) return node;
-    if (isFolder(node)) {
-      const nested = findNode(node.children, id);
-      if (nested) return nested;
-    }
+function isZodRawShapeCompat(obj) {
+  if (typeof obj !== "object" || obj === null) {
+    return false;
   }
-  return void 0;
-}
-function findParentId(nodes, id, parentId = null) {
-  for (const node of nodes) {
-    if (node.id === id) return parentId;
-    if (isFolder(node)) {
-      const nested = findParentId(node.children, id, node.id);
-      if (nested !== void 0) return nested;
-    }
+  if (isZodSchemaInstance(obj)) {
+    return false;
   }
-  return void 0;
-}
-function insertNode(nodes, parentId, node, index) {
-  if (parentId === null) {
-    const next = [...nodes];
-    next.splice(index === void 0 ? next.length : Math.min(index, next.length), 0, node);
-    return next;
+  if (Object.keys(obj).length === 0) {
+    return true;
   }
-  const insertInto = (siblings) => {
-    for (let position = 0; position < siblings.length; position += 1) {
-      const child = siblings[position];
-      if (!isFolder(child)) continue;
-      if (child.id === parentId) {
-        const children = [...child.children];
-        children.splice(index === void 0 ? children.length : Math.min(index, children.length), 0, node);
-        const next = [...siblings];
-        next[position] = { ...child, children };
-        return { nodes: next, found: true };
-      }
-      const nested = insertInto(child.children);
-      if (nested.found) {
-        const next = [...siblings];
-        next[position] = { ...child, children: nested.nodes };
-        return { nodes: next, found: true };
-      }
-    }
-    return { nodes: siblings, found: false };
-  };
-  const result = insertInto(nodes);
-  if (!result.found) throw new Error(`Parent folder "${parentId}" was not found.`);
-  return result.nodes;
+  return Object.values(obj).some(isZodTypeLike);
 }
-function removeNode(nodes, id) {
-  const directIndex = nodes.findIndex((node) => node.id === id);
-  if (directIndex >= 0) {
-    const next = [...nodes];
-    const [removed] = next.splice(directIndex, 1);
-    return { tree: next, removed };
+function getZodSchemaObject(schema) {
+  if (!schema) {
+    return void 0;
   }
-  for (let index = 0; index < nodes.length; index += 1) {
-    const node = nodes[index];
-    if (!isFolder(node)) continue;
-    const result = removeNode(node.children, id);
-    if (!result.removed) continue;
-    const next = [...nodes];
-    next[index] = { ...node, children: result.tree };
-    return { tree: next, removed: result.removed };
+  if (isZodRawShapeCompat(schema)) {
+    return objectFromShape(schema);
   }
-  return { tree: nodes };
-}
-function updateNode(nodes, id, update) {
-  let found = false;
-  const tree = nodes.map((node) => {
-    if (node.id === id) {
-      found = true;
-      return update(node);
-    }
-    if (!isFolder(node)) return node;
-    const nested = updateNode(node.children, id, update);
-    if (!nested.found) return node;
-    found = true;
-    return { ...node, children: nested.tree };
-  });
-  return { tree, found };
-}
-function sanitizeUrl(value) {
-  try {
-    const url = new URL(value);
-    if (url.username) url.username = "<redacted>";
-    if (url.password) url.password = "<redacted>";
-    for (const key of [...url.searchParams.keys()]) {
-      if (isSensitiveName(key)) url.searchParams.set(key, "<redacted>");
-    }
-    return url.toString();
-  } catch {
-    return value;
+  if (!isZodSchemaInstance(schema)) {
+    throw new Error("inputSchema must be a Zod schema or raw shape, received an unrecognized object");
   }
+  return schema;
 }
-function isSensitiveName(value) {
-  return /authorization|cookie|token|secret|password|\bkey\b|api[-_]?key|client[-_]?secret/i.test(value);
-}
-function redactBody(value) {
-  try {
-    const parsed = JSON.parse(value);
-    const redact = (item) => {
-      if (Array.isArray(item)) return item.map(redact);
-      if (!item || typeof item !== "object") return item;
-      return Object.fromEntries(Object.entries(item).map(([key, entry]) => [key, isSensitiveName(key) ? "<redacted>" : redact(entry)]));
+function promptArgumentsFromSchema(schema) {
+  const shape = getObjectShape(schema);
+  if (!shape)
+    return [];
+  return Object.entries(shape).map(([name, field]) => {
+    const description = getSchemaDescription(field);
+    const isOptional = isSchemaOptional(field);
+    return {
+      name,
+      description,
+      required: !isOptional
     };
-    return JSON.stringify(redact(parsed), null, 2);
-  } catch {
-    return value.replace(/\b(authorization|cookie|token|secret|password|api[-_]?key|client[-_]?secret|key)\b\s*[:=]\s*(?:Bearer\s+)?(?:"[^"]*"|'[^']*'|[^,\r\n;}]+)/gi, "$1: <redacted>");
+  });
+}
+function getMethodValue(schema) {
+  const shape = getObjectShape(schema);
+  const methodSchema = shape?.method;
+  if (!methodSchema) {
+    throw new Error("Schema is missing a method literal");
+  }
+  const value = getLiteralValue(methodSchema);
+  if (typeof value === "string") {
+    return value;
   }
+  throw new Error("Schema method literal must be a string");
 }
-function safeRequest(request) {
+function createCompletionResult(suggestions) {
   return {
-    ...request,
-    url: sanitizeUrl(request.url),
-    body: redactBody(request.body),
-    ...request.documentation ? { documentation: redactBody(request.documentation) } : {},
-    ...request.responses ? { responses: request.responses.map((response) => ({ ...response, content: response.content.map((content) => ({ ...content, example: redactBody(content.example) })) })) } : {},
-    ...request.openApiSchemas ? { openApiSchemas: JSON.parse(redactBody(JSON.stringify(request.openApiSchemas))) } : {},
-    ...request.headers ? { headers: request.headers.map((header) => ({ ...header, value: isSensitiveName(header.name) ? "<redacted>" : header.value })) } : {},
-    ...request.params ? { params: request.params.map((param) => ({ ...param, value: isSensitiveName(param.name) ? "<redacted>" : param.value })) } : {},
-    ...request.pathParams ? { pathParams: request.pathParams.map((param) => ({ ...param, value: isSensitiveName(param.name) ? "<redacted>" : param.value })) } : {},
-    ...request.bodyFields ? { bodyFields: request.bodyFields.map((field) => ({ ...field, value: isSensitiveName(field.name) ? "<redacted>" : field.value, filePath: void 0 })) } : {},
-    ...request.auth?.type === "bearer" ? { auth: { type: "bearer", token: "<redacted>" } } : {},
-    ...request.auth?.type === "basic" ? { auth: { type: "basic", username: "<redacted>", password: "<redacted>" } } : {},
-    ...request.auth?.type === "api-key" ? { auth: { ...request.auth, value: "<redacted>" } } : {},
-    bodyPath: void 0
+    completion: {
+      values: suggestions.slice(0, 100),
+      total: suggestions.length,
+      hasMore: suggestions.length > 100
+    }
   };
 }
-function safeTree(nodes) {
-  return nodes.map((node) => isFolder(node) ? { id: node.id, kind: node.kind, name: node.name, children: safeTree(node.children) } : { id: node.id, kind: node.kind, name: node.name, method: node.method, url: sanitizeUrl(node.url), deprecated: node.deprecated === true });
-}
-function summarize(node) {
-  if (!node) return void 0;
-  return isFolder(node) ? { id: node.id, kind: node.kind, name: node.name, childCount: node.children.length } : safeRequest(node);
+var EMPTY_COMPLETION_RESULT = {
+  completion: {
+    values: [],
+    hasMore: false
+  }
+};
+
+// node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
+import process2 from "node:process";
+
+// node_modules/@modelcontextprotocol/sdk/dist/esm/shared/stdio.js
+var STDIO_DEFAULT_MAX_BUFFER_SIZE = 10 * 1024 * 1024;
+var ReadBuffer = class {
+  constructor(options) {
+    this._maxBufferSize = options?.maxBufferSize ?? STDIO_DEFAULT_MAX_BUFFER_SIZE;
+  }
+  append(chunk) {
+    const newSize = (this._buffer?.length ?? 0) + chunk.length;
+    if (newSize > this._maxBufferSize) {
+      this.clear();
+      throw new Error(`ReadBuffer exceeded maximum size of ${this._maxBufferSize} bytes`);
+    }
+    this._buffer = this._buffer ? Buffer.concat([this._buffer, chunk]) : chunk;
+  }
+  readMessage() {
+    if (!this._buffer) {
+      return null;
+    }
+    const index = this._buffer.indexOf("\n");
+    if (index === -1) {
+      return null;
+    }
+    const line = this._buffer.toString("utf8", 0, index).replace(/\r$/, "");
+    this._buffer = this._buffer.subarray(index + 1);
+    return deserializeMessage(line);
+  }
+  clear() {
+    this._buffer = void 0;
+  }
+};
+function deserializeMessage(line) {
+  return JSONRPCMessageSchema.parse(JSON.parse(line));
 }
-function normalizeRequest(input, existing) {
-  const headers = input.headers ?? existing?.headers ?? [];
-  const params = input.params ?? existing?.params ?? [];
-  const pathParams = input.pathParams ?? existing?.pathParams ?? [];
-  const bodyFields = input.bodyFields ?? existing?.bodyFields ?? [];
-  const responses = input.responses ?? existing?.responses ?? [];
-  return {
-    ...existing,
-    ...input,
-    id: existing?.id ?? input.id ?? randomUUID(),
-    kind: "request",
-    name: input.name,
-    method: input.method.toUpperCase(),
-    url: input.url,
-    body: input.body ?? existing?.body ?? "",
-    headers: headers.map((item) => ({ ...item, id: item.id || randomUUID() })),
-    params: params.map((item) => ({ ...item, id: item.id || randomUUID() })),
-    pathParams: pathParams.map((item) => ({ ...item, id: item.id || randomUUID() })),
-    bodyFields: bodyFields.map((item) => ({ ...item, id: item.id || randomUUID() })),
-    responses: responses.map((response) => ({ ...response, id: response.id || randomUUID(), content: response.content.map((content) => ({ ...content, id: content.id || randomUUID() })) }))
-  };
+function serializeMessage(message) {
+  return JSON.stringify(message) + "\n";
 }
-function collectSummary(tree, operation) {
-  if (operation.action === "create_folder") {
-    const parent = operation.parentId ? findNode(tree, operation.parentId) : void 0;
-    if (operation.parentId && (!parent || !isFolder(parent))) throw new Error(`Parent folder "${operation.parentId}" was not found.`);
-    const folder = { id: randomUUID(), kind: "folder", name: operation.name.trim(), children: [] };
-    return { tree: insertNode(tree, operation.parentId, folder), summary: { action: operation.action, target: folder.name, after: summarize(folder) } };
-  }
-  if (operation.action === "create_request") {
-    const parent = operation.parentId ? findNode(tree, operation.parentId) : void 0;
-    if (operation.parentId && (!parent || !isFolder(parent))) throw new Error(`Parent folder "${operation.parentId}" was not found.`);
-    const request = normalizeRequest(operation.request);
-    return { tree: insertNode(tree, operation.parentId, request), summary: { action: operation.action, target: request.name, after: summarize(request) } };
+
+// node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
+var StdioServerTransport = class {
+  constructor(_stdin = process2.stdin, _stdout = process2.stdout, options) {
+    this._stdin = _stdin;
+    this._stdout = _stdout;
+    this._started = false;
+    this._ondata = (chunk) => {
+      try {
+        this._readBuffer.append(chunk);
+        this.processReadBuffer();
+      } catch (error2) {
+        this.onerror?.(error2);
+        this.close().catch(() => {
+        });
+      }
+    };
+    this._onerror = (error2) => {
+      this.onerror?.(error2);
+    };
+    this._readBuffer = new ReadBuffer({ maxBufferSize: options?.maxBufferSize });
   }
-  if (operation.action === "update_request") {
-    const before2 = findNode(tree, operation.requestId);
-    if (!before2 || isFolder(before2)) throw new Error(`Request "${operation.requestId}" was not found.`);
-    const updated = normalizeRequest({ ...before2, ...operation.patch, name: operation.patch.name ?? before2.name, method: operation.patch.method ?? before2.method, url: operation.patch.url ?? before2.url }, before2);
-    const result = updateNode(tree, operation.requestId, () => updated);
-    return { tree: result.tree, summary: { action: operation.action, target: updated.name, before: summarize(before2), after: summarize(updated) } };
+  /**
+   * Starts listening for messages on stdin.
+   */
+  async start() {
+    if (this._started) {
+      throw new Error("StdioServerTransport already started! If using Server class, note that connect() calls start() automatically.");
+    }
+    this._started = true;
+    this._stdin.on("data", this._ondata);
+    this._stdin.on("error", this._onerror);
   }
-  if (operation.action === "rename_folder") {
-    const before2 = findNode(tree, operation.folderId);
-    if (!before2 || !isFolder(before2)) throw new Error(`Folder "${operation.folderId}" was not found.`);
-    const result = updateNode(tree, operation.folderId, (node) => isFolder(node) ? { ...node, name: operation.name.trim() } : node);
-    return { tree: result.tree, summary: { action: operation.action, target: operation.name.trim(), before: summarize(before2), after: { ...summarize(before2), name: operation.name.trim() } } };
+  processReadBuffer() {
+    while (true) {
+      try {
+        const message = this._readBuffer.readMessage();
+        if (message === null) {
+          break;
+        }
+        this.onmessage?.(message);
+      } catch (error2) {
+        this.onerror?.(error2);
+      }
+    }
   }
-  if (operation.action === "move_node") {
-    const before2 = findNode(tree, operation.nodeId);
-    if (!before2) throw new Error(`Collection item "${operation.nodeId}" was not found.`);
-    const parent = operation.parentId ? findNode(tree, operation.parentId) : void 0;
-    if (operation.parentId && (!parent || !isFolder(parent))) throw new Error(`Parent folder "${operation.parentId}" was not found.`);
-    if (isFolder(before2) && (before2.id === operation.parentId || findNode(before2.children, operation.parentId ?? "")?.kind === "folder")) throw new Error("A folder cannot be moved inside itself or one of its descendants.");
-    const oldParentId = findParentId(tree, before2.id);
-    const removed2 = removeNode(tree, before2.id);
-    if (!removed2.removed) throw new Error(`Collection item "${operation.nodeId}" could not be moved.`);
-    const next = insertNode(removed2.tree, operation.parentId, removed2.removed, operation.index);
-    return { tree: next, summary: { action: operation.action, target: before2.name, before: { parentId: oldParentId }, after: { parentId: operation.parentId, index: operation.index } } };
+  async close() {
+    this._stdin.off("data", this._ondata);
+    this._stdin.off("error", this._onerror);
+    const remainingDataListeners = this._stdin.listenerCount("data");
+    if (remainingDataListeners === 0) {
+      this._stdin.pause();
+    }
+    this._readBuffer.clear();
+    this.onclose?.();
   }
-  if (operation.action === "deprecate_request") {
-    const before2 = findNode(tree, operation.requestId);
-    if (!before2 || isFolder(before2)) throw new Error(`Request "${operation.requestId}" was not found.`);
-    const updated = { ...before2, deprecated: operation.deprecated, ...operation.deprecated && operation.reason?.trim() ? { deprecationReason: operation.reason.trim() } : {}, ...!operation.deprecated ? { deprecationReason: void 0 } : {} };
-    const result = updateNode(tree, operation.requestId, () => updated);
-    return { tree: result.tree, summary: { action: operation.action, target: updated.name, before: { deprecated: before2.deprecated === true, deprecationReason: before2.deprecationReason }, after: { deprecated: updated.deprecated, deprecationReason: updated.deprecationReason } } };
+  send(message) {
+    return new Promise((resolve) => {
+      const json = serializeMessage(message);
+      if (this._stdout.write(json)) {
+        resolve();
+      } else {
+        this._stdout.once("drain", resolve);
+      }
+    });
   }
-  const before = findNode(tree, operation.nodeId);
-  if (!before) throw new Error(`Collection item "${operation.nodeId}" was not found.`);
-  const removed = removeNode(tree, operation.nodeId);
-  return { tree: removed.tree, summary: { action: operation.action, target: before.name, before: summarize(before) } };
+};
+
+// src/mcp-surface.ts
+var directCollectionWrites = /* @__PURE__ */ new Set([
+  "folder.create",
+  "folder.rename",
+  "folder.delete",
+  "node.move",
+  "request.create",
+  "request.update",
+  "request.duplicate",
+  "request.deprecate",
+  "request.delete"
+]);
+function mcpCommands() {
+  return allCommands.filter((command) => !directCollectionWrites.has(command.id));
 }
-function requestMap(nodes) {
-  return nodes.flatMap((node) => isFolder(node) ? requestMap(node.children) : [node]);
+function missingVariableRevision(commandId, params) {
+  if (commandId !== "variable.set" && commandId !== "variable.delete") return null;
+  if (params.expectedRevision !== void 0) return null;
+  return "Read the variable with variable.get first, then pass its revision as expectedRevision. Pass null when the variable does not exist yet.";
 }
-function findWorkspaceIds() {
-  const rows = database().prepare("SELECT data FROM workspaces ORDER BY rowid").all();
-  return rows.map(({ data }) => {
-    const workspace = JSON.parse(data);
-    return { id: workspace.id, name: workspace.name, cloudId: workspace.cloudId, role: workspace.role ?? null };
-  });
+function missingTargetConfirmation(commandId, params) {
+  if (commandId !== "request.send") return null;
+  if (params.dryRun === true || typeof params.confirmUrl === "string") return null;
+  return "Run request.send with dryRun set to true first, show the URL to the user, then send with confirmUrl set to that URL.";
 }
-function registerTools(server) {
-  server.registerTool("list_workspaces", {
-    title: "List workspaces",
-    description: "List local workspaces available in the desktop app. Use the returned workspace id for other tools.",
-    annotations: { readOnlyHint: true, openWorldHint: false }
-  }, async () => jsonResult(findWorkspaceIds()));
-  server.registerTool("get_collection_tree", {
-    title: "Read collection tree",
-    description: "Read folder hierarchy and request summaries for a workspace. Request names, methods, URLs, and deprecated status are included; credentials and environment values are not.",
-    inputSchema: { workspaceId: external_exports.string().min(1) },
-    annotations: { readOnlyHint: true, openWorldHint: false }
-  }, async ({ workspaceId }) => {
-    const { workspace } = loadRawWorkspace(workspaceId);
-    return jsonResult({ workspaceId, workspaceName: workspace.name, tree: safeTree(workspace.tree) });
-  });
-  server.registerTool("search_requests", {
-    title: "Search requests",
-    description: "Search request names, methods, and URLs in a workspace. Sensitive URL query values are masked.",
-    inputSchema: { workspaceId: external_exports.string().min(1), query: external_exports.string().trim().min(1).max(200) },
-    annotations: { readOnlyHint: true, openWorldHint: false }
-  }, async ({ workspaceId, query }) => {
-    const { workspace } = loadRawWorkspace(workspaceId);
-    const needle = query.toLocaleLowerCase();
-    const matches = requestMap(workspace.tree).filter((request) => `${request.name}
-${request.method}
-${request.url}
-${request.documentation ?? ""}
-${(request.responses ?? []).map((response) => `${response.statusCode} ${response.description} ${response.content.map((content) => `${content.schema} ${content.example}`).join(" ")}`).join("\n")}`.toLocaleLowerCase().includes(needle));
-    return jsonResult(matches.map((request) => safeRequest(request)));
-  });
-  server.registerTool("get_request", {
-    title: "Read request",
-    description: "Read one request definition. Auth credentials, secret-like header/parameter/body values, and local file paths are redacted.",
-    inputSchema: { workspaceId: external_exports.string().min(1), requestId: external_exports.string().min(1) },
-    annotations: { readOnlyHint: true, openWorldHint: false }
-  }, async ({ workspaceId, requestId }) => {
-    const { workspace } = loadRawWorkspace(workspaceId);
-    const request = findNode(workspace.tree, requestId);
-    if (!request || isFolder(request)) throw new Error(`Request "${requestId}" was not found.`);
-    return jsonResult(safeRequest(request));
-  });
-  server.registerTool("preview_changes", {
-    title: "Preview collection changes",
-    description: "Validate a proposed batch and return sanitized before/after request data. The agent must render a readable diff in chat, including workspace and collection paths, changed request fields, and nested deletion impact, then wait for explicit user approval before apply_changes. Deletions also require confirmDelete=true when applying.",
-    inputSchema: { workspaceId: external_exports.string().min(1), operations: external_exports.array(operationSchema).min(1).max(100) },
-    annotations: { readOnlyHint: true, openWorldHint: false }
-  }, async ({ workspaceId, operations }) => {
-    const { raw, workspace } = loadRawWorkspace(workspaceId);
-    assertCanEdit(workspace);
-    let tree = structuredClone(workspace.tree);
-    const summary = [];
-    for (const operation of operations) {
-      const result = collectSummary(tree, operation);
-      tree = result.tree;
-      summary.push(result.summary);
-    }
-    const id = randomUUID();
-    const plan = {
-      id,
-      workspaceId,
-      sourceHash: createHash("sha256").update(raw).digest("hex"),
-      operations,
-      nextTree: tree,
-      summary,
-      includesDelete: operations.some((operation) => operation.action === "delete_node"),
-      expiresAt: Date.now() + 10 * 60 * 1e3
-    };
-    plans.set(id, plan);
-    return jsonResult({ previewId: id, workspaceId, workspaceName: workspace.name, changes: summary, deletesItems: plan.includesDelete, expiresInSeconds: 600 });
-  });
-  server.registerTool("apply_changes", {
-    title: "Apply collection changes",
-    description: "Apply a previously previewed batch to the local workspace only after the user explicitly approved the readable preview shown in chat. Requires the workspace to be unchanged since preview. Set confirmDelete=true only when the user explicitly approved deleting the listed items.",
-    inputSchema: { previewId: external_exports.string().min(1), confirmDelete: external_exports.boolean().default(false) },
-    annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: false }
-  }, async ({ previewId, confirmDelete }) => {
-    const plan = plans.get(previewId);
-    if (!plan || plan.expiresAt < Date.now()) {
-      plans.delete(previewId);
-      throw new Error("This preview expired or was not found. Run preview_changes again.");
-    }
-    if (plan.includesDelete && !confirmDelete) throw new Error("This batch includes deletion. Ask the user to confirm the listed deletions, then retry with confirmDelete=true.");
-    const db = database();
-    db.exec("BEGIN IMMEDIATE;");
-    let updated;
-    try {
-      const { raw, workspace } = loadRawWorkspace(plan.workspaceId);
-      assertCanEdit(workspace);
-      const currentHash = createHash("sha256").update(raw).digest("hex");
-      if (currentHash !== plan.sourceHash) throw new Error("The workspace changed after this preview. Run preview_changes again to avoid overwriting newer edits.");
-      updated = { ...workspace, tree: structuredClone(plan.nextTree) };
-      db.prepare("UPDATE workspaces SET data = ? WHERE id = ?").run(JSON.stringify(updated), plan.workspaceId);
-      db.exec("COMMIT;");
-    } catch (error2) {
-      db.exec("ROLLBACK;");
-      throw error2;
+
+// src/guide.ts
+var guideText = `# API Documentation: how to build and change the workspace
+
+Read this before any change. It sets how requests, variables, folders, and docs are made, so the result matches the API's real flows.
+
+## 0. Start every task the same way
+1. Call list_commands for the parameters and whether a command is read-only or destructive.
+2. Read what exists first: workspace_list, tree_get, request_search, and request_get. Never create something that already exists under another name.
+3. Read the variables that are already there with variable_get before you add one. Reuse a name that exists.
+4. If the API contract is unknown, say what is unknown and ask. Do not guess a route, a field, or a status code.
+
+## 1. Folders: one top-level folder per service
+- Top level: one folder per service or segment of the API, named in Title Case: Auth, Users, Billing, Orders. Create it with folder_create and parentId null.
+- Second level: one folder per business flow (for example "Checkout") or per resource (for example "Invoices"). Use a flow folder when several requests happen in order. Use a resource folder for standalone CRUD.
+- Put requests that every service needs (health check, token refresh) in a "Shared" folder at the top level.
+- Keep the tree at most three levels deep. Deeper nesting is hard to scan.
+- Move an existing item with node_move. Rename a folder with folder_rename. Do not delete and recreate a folder to move it, because its requests lose their place.
+
+## 2. Requests: name and order
+- Name a request "METHOD resource action", for example "POST /invoices create". Keep the method visible in the name.
+- In a flow folder, prefix each request with its step: "1 Create cart", "2 Add item", "3 Checkout". The order must match the real order of calls.
+
+## 3. Auth: set it for every request that needs it
+- Look at the endpoint's contract before you create the request.
+- JWT or any Authorization header: auth type bearer, token {{accessToken}}. Never a literal token.
+- API key: auth type api-key, with name, location (header or query), and value {{apiKey}}.
+- Username and password: auth type basic, with {{username}} and {{password}}.
+- Public endpoint: auth type none, and only when the contract says it is public.
+- request_update keeps the existing auth unless you send auth again. When you change how a request is called, send auth again so it is set on purpose.
+- Never write a real token, password, or key into a request. The variable holds it, and the value is entered in the app.
+
+## 4. Variables: when a value becomes one
+Make a variable when a value does at least one of these:
+- It differs between environments, such as baseUrl, host, or tenantId. Use scope environment.
+- It is the same in every request, such as apiVersion or a tenant header name. Use scope global.
+- It is a credential, such as accessToken, apiKey, or password. Use secret true, with no value. The value is entered in the app.
+
+Keep a literal value in the request when it is used once, does not change between environments, and is not a credential.
+
+Naming: lowerCamelCase, specific, and the same name everywhere. Do not create baseUrl and base_url for the same thing.
+
+Where a variable works: {{name}} resolves in the URL, params, headers, body, and auth when a request is sent. Globals apply everywhere. An active environment overrides a global of the same name. Set the active environment with environment_activate, and tell the user which one it is.
+
+Writes: variable_set and variable_delete take the revision from variable_get as expectedRevision. Use null for a variable that does not exist yet. A stale revision is refused, so read again and retry.
+
+## 5. Documentation: complete, and per business flow
+Every request gets:
+- Purpose: what the endpoint does, in one or two sentences.
+- Place in the flow: "Step 2 of Checkout. Before: Create cart. After: Confirm order." Name the requests.
+- Preconditions: what must be true first, and which variables must be set.
+- Auth: which variable provides it.
+- Request: each param, header, and body field, with its type, whether it is required, what it means, and a realistic example. Use {{variables}} in examples, never a real value.
+- Responses: one entry per status code the contract lists, with an example body. Include the error responses: which code, which error body, and when it happens.
+- Side effects: what changes on the server or in other requests.
+
+Write it in the request's documentation field and its responses. Put the flow overview in the flow folder's first request. If a part is unknown, write "Unknown: ..." and ask the user. Do not fill it with a guess.
+
+## 6. Changing collections: preview, ask, then apply
+- Every change to folders, requests, or moves goes through changes_preview. Apply it with changes_apply only after the user approves that exact preview.
+- Show the preview in chat: the workspace, the full path of each item, the before and after of each changed field, and what a deletion removes.
+- Ask the user to approve it, then stop. Do not call changes_apply in the same turn as the preview.
+- changes_apply refuses a preview when the workspace changed after it. Preview again.
+- Direct write commands (request_create, request_update, folder_create, node_move) are for the user's explicit request, and still need the approval above.
+
+## 7. Deleting and deprecating
+- Prefer request_deprecate with a reason over deleting a request that other people may use.
+- Delete only when the user asks, and set confirm=true only after the user has confirmed that exact deletion.
+
+## 8. Sending requests
+- Send only when the user asks. Say which environment is active first.
+- A variable with no value stops the send, and the error names it. Fill it in the app, or ask.
+- Do not send a request that changes data on a production server without asking.
+
+## 9. Limits
+- Cloud workspaces are read-only over MCP. Changes to a cloud copy are made in the desktop app.
+- Viewer workspaces refuse writes.
+- Secret values are never returned. environment_list shows them as <secret>.
+`;
+function createGuideGate() {
+  let read = false;
+  return {
+    markRead() {
+      read = true;
+    },
+    refusal(command) {
+      if (command.readOnly || read) return null;
+      return "Read the guide first: call the guide tool, then retry this command.";
     }
-    plans.delete(previewId);
-    process.stderr.write(`Applied MCP changes to workspace ${plan.workspaceId}.
-`);
-    return jsonResult({ applied: true, workspaceId: plan.workspaceId, workspaceName: updated.name, changes: plan.summary });
-  });
+  };
 }
-async function main() {
-  const server = new McpServer({ name: "api-documentation-local", version: "1.0.0" }, {
-    instructions: "Use this server to maintain API endpoint documentation in local desktop workspaces. Search and read requests first. Record all known applicable route, params, headers, body, auth, response contracts, and documentation; do not invent missing details. Use {{baseUrl}} or other descriptive {{variableName}} references for reusable or environment-specific values, and {{accessToken}} for credentials; never write a real secret. Global variables are workspace-wide defaults, environment values can override them, and credentials should be marked Secret in the desktop Variables UI. This MCP can write request references but cannot read or manage variable definitions or values; tell the user when a referenced variable must be configured in the UI. Always call preview_changes, then render a readable diff directly in chat showing the workspace, full collection paths, each changed field before and after, response/body details, variable-definition gaps, and nested deletion impact. Redact secret values. Ask the user to approve that exact preview and stop; never call apply_changes in the same turn as the preview. Preserve existing auth and variable references unless asked to change them. Delete only when the user explicitly asks and confirms."
-  });
-  registerTools(server);
-  const transport = new StdioServerTransport();
-  await server.connect(transport);
+
+// src/mcp.ts
+var toolName = (commandId) => commandId.replace(/\./g, "_");
+var legacyTools = {
+  list_workspaces: "workspace.list",
+  get_collection_tree: "tree.get",
+  search_requests: "request.search",
+  get_request: "request.get",
+  preview_changes: "changes.preview",
+  apply_changes: "changes.apply"
+};
+var instructions = "Drive the API Documentation desktop app: list workspaces, read and change collections, requests, environments, and variables, and send requests. Call list_commands first to see every command and its parameters. Search and read requests before changing them. Record known route, parameters, headers, body, auth, and response contracts, and do not invent missing details. Use {{baseUrl}} or other descriptive {{variableName}} references for environment-specific values, and {{accessToken}} for credentials. Never write a real secret: secret variables are created empty, and their values are entered in the desktop app. Changes to collections go through changes.preview; render the diff in chat (workspace, full collection paths, before and after for each field, nested deletion impact), ask the user to approve that exact preview, and stop. Never call changes.apply in the same turn as the preview. Destructive commands require confirm=true, which is only set after the user explicitly confirms. Call guide before the first change: write commands are refused until it has been read in this session.";
+async function startMcpServer() {
+  const server = new McpServer({ name: "api-documentation-local", version: "0.2.0" }, { instructions });
+  const guide = createGuideGate();
+  const register = (name, commandId, title, description) => {
+    const command = allCommands.find((item) => item.id === commandId);
+    if (!command) throw new Error(`Command ${commandId} is not registered.`);
+    server.registerTool(
+      name,
+      {
+        title,
+        description,
+        inputSchema: command.params.shape,
+        annotations: { readOnlyHint: command.readOnly, destructiveHint: command.destructive, openWorldHint: command.id === "request.send" }
+      },
+      async (params) => {
+        const input = params ?? {};
+        const refusal = guide.refusal(command) ?? missingTargetConfirmation(commandId, input) ?? missingVariableRevision(commandId, input);
+        if (refusal) throw new Error(refusal);
+        return { content: [{ type: "text", text: JSON.stringify(await executeCommand(commandId, params), null, 2) }] };
+      }
+    );
+  };
+  for (const command of mcpCommands()) {
+    register(toolName(command.id), command.id, command.title, command.description);
+  }
+  for (const [name, commandId] of Object.entries(legacyTools)) {
+    const command = allCommands.find((item) => item.id === commandId);
+    if (command) register(name, commandId, command.title, `${command.description} (Same as ${toolName(commandId)}.)`);
+  }
+  server.registerTool(
+    "guide",
+    {
+      title: "Guide",
+      description: "The rules for changing the app safely: read first, preview before apply, confirm deletes, and never write a secret. Read it before any write.",
+      annotations: { readOnlyHint: true, openWorldHint: false }
+    },
+    async () => {
+      guide.markRead();
+      return { content: [{ type: "text", text: guideText }] };
+    }
+  );
+  server.registerTool(
+    "list_commands",
+    {
+      title: "List commands",
+      description: "List every desktop app command with its parameters and whether it is read-only or destructive.",
+      annotations: { readOnlyHint: true, openWorldHint: false }
+    },
+    async () => ({ content: [{ type: "text", text: JSON.stringify(mcpCommands().map(describeCommand), null, 2) }] })
+  );
+  await server.connect(new StdioServerTransport());
 }
-main().catch((error2) => {
-  const message = error2 instanceof Error ? error2.stack || error2.message : String(error2);
+
+// src/index.ts
+var args = process.argv.slice(2);
+var main = args.length === 0 || args[0] === "mcp" ? startMcpServer() : runCli(args);
+main.catch((error2) => {
+  const message = error2 instanceof Error ? error2.message : String(error2);
   process.stderr.write(`${message}
 `);
   process.exitCode = 1;