callman-mcp 0.1.0 → 0.2.0

package/dist/domain/requestShape.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"requestShape.d.ts","sourceRoot":"","sources":["../../src/domain/requestShape.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,oBAAoB,EAE1B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAWlE,eAAO,MAAM,YAAY,gFAAiF,CAAC;AAE3G,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;EAKnB,CAAC;AAEH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAY1B,CAAC;AAEH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAuB1B,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuB7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAC/C,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,MAAM,GAAI,SAAS,OAAO,EAAE,GAAG,SAAS,KAAG,WAAW,EAIjD,CAAC;AAYnB,eAAO,MAAM,aAAa,GAAI,MAAM,SAAS,GAAG,SAAS,KAAG,WAgB3D,CAAC;AASF,eAAO,MAAM,aAAa,GAAI,MAAM,OAAO,EAAE,SAAS,WAAW,EAAE,KAAG,oBAAoB,GAAG,IAuB5F,CAAC;AAEF,eAAO,MAAM,sBAAsB,GACjC,MAAM,YAAY,EAClB,QAAQ;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,KACxD,MAAM,CAAC,MAAM,EAAE,OAAO,CAmBxB,CAAC;AAIF,eAAO,MAAM,mBAAmB,GAAI,MAAM,YAAY,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAG9E,CAAC;AAEF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAGoB,CAAC;AAE1D,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,sBAAsB,GACjC,MAAM,kBAAkB,EACxB,QAAQ;IAAE,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,KAC1D,MAAM,CAAC,MAAM,EAAE,OAAO,CAqBxB,CAAC;AAWF,eAAO,MAAM,kBAAkB,GAC7B,SAAS,UAAU,EACnB,UAAS;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,KACjD,MAAM,CAAC,MAAM,EAAE,OAAO,CA0BxB,CAAC;AAOF,eAAO,MAAM,kBAAkB,GAAI,SAAS;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE;;;;;;;CAOnJ,CAAC"}
+{"version":3,"file":"requestShape.d.ts","sourceRoot":"","sources":["../../src/domain/requestShape.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,WAAW,EAChB,KAAK,oBAAoB,EAE1B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAIlE,OAAO,EAA0F,KAAK,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAS3J,eAAO,MAAM,YAAY,gFAAiF,CAAC;AAI3G,eAAO,MAAM,QAAQ;;;;;;;;;;;;EAOpB,CAAC;AAEF,eAAO,MAAM,kBAAkB;;;;;;;;;;;;EAO9B,CAAC;AAgCF,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yKAwBzB,CAAC;AAIJ,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA6B1B,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0B9B,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAC/C,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AACxD,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,MAAM,GAAI,SAAS,OAAO,EAAE,GAAG,SAAS,KAAG,WAAW,EAGuC,CAAC;AAgB3G,eAAO,MAAM,qBAAqB,GAAI,KAAK,MAAM,EAAE,MAAM,WAAW,EAAE,KAAG,MAKxE,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,KAAK,MAAM,EAAE,OAAO,OAAO,EAAE,GAAG,SAAS,KAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,WAAW,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAUlI,CAAC;AAWF,eAAO,MAAM,aAAa,GAAI,MAAM,SAAS,GAAG,SAAS,GAAG,IAAI,EAAE,SAAS,WAAW,EAAE,KAAG,oBAAoB,GAAG,IA8BjH,CAAC;AASF,eAAO,MAAM,oBAAoB,GAAI,MAAM,OAAO,KAAG,MAAM,EAiB1D,CAAC;AAcF,eAAO,MAAM,aAAa,GAAI,MAAM,SAAS,GAAG,SAAS,KAAG,WAgB3D,CAAC;AAIF,eAAO,MAAM,aAAa,GAAI,MAAM,WAAW,GAAG,IAAI,GAAG,SAAS,EAAE,gBAAc,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CA4B1G,CAAC;AAOF,eAAO,MAAM,mBAAmB,GAAI,MAAM,OAAO,CAAC,YAAY,CAAC,EAAE,UAAU,UAAU,KAAG,OAAO,CAAC,YAAY,CAkC3G,CAAC;AAIF,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAMD,eAAO,MAAM,sBAAsB,GACjC,MAAM,YAAY,EAClB,QAAQ;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EACzD,UAAS,kBAAkC,KAC1C,aAuBF,CAAC;AAKF,eAAO,MAAM,mBAAmB,GAAI,MAAM,YAAY,EAAE,UAAS,kBAAkC,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAG3H,CAAC;AAEF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBAI8G,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAE5K,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAK1E,eAAO,MAAM,sBAAsB,GACjC,MAAM,kBAAkB,EACxB,SAAS,UAAU,EACnB,QAAQ;IAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EACpC,UAAS,kBAAkC,KAC1C,aAwBF,CAAC;AAaF,eAAO,MAAM,aAAa,GAAI,MAAM,OAAO,KAAG,OAmB7C,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAAI,SAAS,UAAU,EAAE,UAAS;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAoClI,CAAC;AAOF,eAAO,MAAM,kBAAkB,GAAI,SAAS;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE;;;;;;;CAOnJ,CAAC"}

package/dist/domain/requestShape.js

@@ -1,7 +1,10 @@
-import { inferBodyStateFromRaw, toPersistedRequestBody, } from "callman-core";
+import { extractUrlQueryPairs, inferBodyStateFromRaw, stripUrlQuery, toPersistedRequestBody, } from "callman-core";
 import { z } from "zod";
-import { maskAuth, maskHeaderValue } from "../lib/mask.js";
+import { ToolInputError } from "../client/errors.js";
+import { isMasked, maskHeaderValue, maskSecret } from "../lib/mask.js";
+import { strictObject } from "../lib/strict.js";
 import { clip, jsonPreview, LIMITS, safeStringify } from "../lib/truncate.js";
+import { hasIntegrations, integrationsInputView, requestIntegrationFields, toIntegrationPayload } from "./requestIntegrations.js";
 // The COMPACT request form a model writes (name/method/url, key-value lists,
 // a body that may be a JSON value, a string or a mode object, a small auth
 // object) and its translation into the backend's `POST /requests` payload —
@@ -9,75 +12,200 @@ import { clip, jsonPreview, LIMITS, safeStringify } from "../lib/truncate.js";
 // serialisation (`toPersistedRequestBody`) so an imported request opens in
 // the editor exactly like a hand-made one.
 export const HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS", "TRACE"];
-export const kvSchema = z.object({
-    key: z.string().max(100),
+// Key/value rows — the backend's own limits (key 1–100 chars, value ≤ 5000),
+// strict so a stray `description` or `type` is an error, not a silent drop.
+export const kvSchema = strictObject({
+    key: z.string().trim().min(1).max(100),
     value: z.string().max(5000).default(""),
-    enabled: z.boolean().optional(),
-    description: z.string().max(500).optional(),
-});
-export const bodyInputSchema = z.union([
-    z.object({
-        mode: z.literal("raw"),
-        raw: z.string().max(2_000_000),
-        language: z.enum(["json", "xml", "text", "html"]).optional(),
-    }),
-    z.object({
-        mode: z.enum(["formdata", "urlencoded"]),
-        entries: z.array(kvSchema).max(200),
-    }),
-    z.object({ mode: z.literal("none") }),
-    z.unknown(),
-]);
+    enabled: z.boolean().optional().describe("false keeps the row but does not send it (default true)"),
+}, "row field");
+export const pathVariableSchema = strictObject({
+    key: z.string().trim().min(1).max(100).describe("The name after ':' in the URL, without the colon"),
+    value: z.string().max(5000).default(""),
+    description: z.string().max(5000).optional(),
+}, "path variable field");
+const RAW_LANGUAGES = ["json", "xml", "text", "html"];
+const rawBodySchema = strictObject({
+    mode: z.literal("raw"),
+    raw: z.string().max(2_000_000).describe("The body text; {{variables}} are resolved when it runs"),
+    language: z.enum(RAW_LANGUAGES).optional().describe("Editor language and default Content-Type; sniffed from the text when omitted"),
+    rawLanguage: z.enum(RAW_LANGUAGES).optional().describe("Same as language (the stored name)"),
+}, "raw body field");
+const formBodySchema = strictObject({
+    mode: z.enum(["formdata", "urlencoded"]),
+    entries: z.array(kvSchema).max(200).optional().describe("Text fields; file parts cannot be set through the API"),
+    formEntries: z.array(z.object({ key: z.string(), value: z.string().default(""), enabled: z.boolean().optional() }).passthrough()).max(200).optional().describe("Same as entries (the stored name)"),
+}, "form body field");
+const jsonBodySchema = strictObject({ mode: z.literal("json"), json: z.unknown().describe("Any JSON value — use this form when the payload itself has a top-level `mode` key") }, "json body field");
+const noneBodySchema = strictObject({ mode: z.literal("none") }, "body field");
+const BODY_MODES = ["raw", "formdata", "urlencoded", "json", "none"];
+export const bodyInputSchema = z
+    .union([
+    z.string().max(2_000_000),
+    rawBodySchema,
+    formBodySchema,
+    jsonBodySchema,
+    noneBodySchema,
+    z.array(z.unknown()),
+    z.number(),
+    z.boolean(),
+    z.record(z.unknown()).refine((value) => !("mode" in value), { message: `A body object with a "mode" key must be one of the modes ${BODY_MODES.join(", ")}` }),
+], {
+    errorMap: (issue, ctx) => issue.code === z.ZodIssueCode.invalid_union
+        ? {
+            message: `Invalid body. Send a JSON value (object/array), a string, or { mode: "raw", raw, language? } | { mode: "formdata"|"urlencoded", entries: [{ key, value }] } | { mode: "json", json } | { mode: "none" }.`,
+        }
+        : { message: ctx.defaultError },
+})
+    .describe('A JSON object/array (sent as JSON); a string (JSON is parsed, <xml>/<html> sniffed, otherwise text); { mode: "raw", raw, language: json|xml|text|html }; { mode: "formdata"|"urlencoded", entries: [{ key, value }] }; { mode: "json", json } when the payload itself has a top-level "mode" key; { mode: "none" }.');
+const secret = (what) => z.string().max(10_000).describe(`${what}. {{variable}} references are fine`);
 export const authInputSchema = z.discriminatedUnion("type", [
-    z.object({ type: z.literal("none") }),
-    z.object({ type: z.literal("bearer"), token: z.string().max(10_000) }),
-    z.object({ type: z.literal("basic"), username: z.string().max(5000), password: z.string().max(5000).default("") }),
-    z.object({
+    strictObject({ type: z.literal("none") }, "auth field"),
+    strictObject({ type: z.literal("bearer"), token: secret("Bearer token") }, "bearer auth field"),
+    strictObject({ type: z.literal("basic"), username: z.string().max(5000), password: z.string().max(5000).default("") }, "basic auth field"),
+    strictObject({
         type: z.literal("apiKey"),
-        key: z.string().max(5000),
-        value: z.string().max(10_000),
+        key: z.string().max(5000).describe("Header or query parameter name, e.g. X-API-Key"),
+        value: secret("API key"),
         location: z.enum(["header", "query"]).default("header"),
-    }),
-    z.object({
+    }, "apiKey auth field"),
+    strictObject({
         type: z.literal("oauth2"),
         grantType: z.enum(["client_credentials", "password", "refresh_token"]).default("client_credentials"),
         tokenUrl: z.string().max(4096),
         clientId: z.string().max(5000).default(""),
         clientSecret: z.string().max(10_000).default(""),
         scope: z.string().max(5000).default(""),
-        username: z.string().max(5000).default(""),
-        password: z.string().max(5000).default(""),
-        refreshToken: z.string().max(10_000).default(""),
-        clientAuth: z.enum(["basic", "body"]).default("body"),
+        username: z.string().max(5000).default("").describe("password grant"),
+        password: z.string().max(5000).default("").describe("password grant"),
+        refreshToken: z.string().max(10_000).default("").describe("refresh_token grant"),
+        clientAuth: z.enum(["basic", "body"]).default("body").describe("Send client credentials as a Basic header or in the form body"),
         audience: z.string().max(4096).default(""),
-    }),
+    }, "oauth2 auth field"),
 ]);
-export const requestInputSchema = z.object({
-    name: z.string().min(1).max(LIMITS.NAME).describe("Display name, e.g. \"GET /users\" or \"Login\""),
+export const requestInputSchema = strictObject({
+    name: z.string().trim().min(1).max(LIMITS.NAME).describe("Display name, e.g. \"GET /users\" or \"Login\""),
     method: z.enum(HTTP_METHODS),
     url: z
         .string()
+        .trim()
         .min(1)
         .max(4096)
-        .describe("Full URL; use {{variable}} for hosts/tokens (e.g. {{baseUrl}}/users/:id) and :name for path variables"),
+        .describe("Full URL; use {{variable}} for hosts/tokens (e.g. {{baseUrl}}/users/:id) and :name for path variables. A ?query in the URL becomes `query` rows (they are the same thing — runs send the rows)"),
     headers: z.array(kvSchema).max(200).optional(),
-    query: z.array(kvSchema).max(200).optional(),
-    pathVariables: z.array(kvSchema).max(200).optional().describe("Values for :name segments in the URL"),
-    body: bodyInputSchema
-        .optional()
-        .describe("A JSON value (stored as JSON), a string (JSON is parsed, otherwise raw text/xml/html by sniffing), or { mode: \"raw\" | \"formdata\" | \"urlencoded\" | \"none\", … }"),
+    query: z.array(kvSchema).max(200).optional().describe("Query parameters; when omitted they are taken from the URL's ?query"),
+    pathVariables: z.array(pathVariableSchema).max(200).optional().describe("Values for :name segments in the URL"),
+    body: bodyInputSchema.optional(),
     auth: authInputSchema.optional(),
-    preRequestScript: z.string().max(100_000).optional(),
-    postResponseScript: z.string().max(100_000).optional().describe("pm.* script run after the response (tests, pm.environment.set …)"),
-    testsScript: z.string().max(100_000).optional(),
-    folder: z.string().max(200).optional().describe("Folder id, name or path (\"Auth/Login\") inside the collection"),
-    folderKey: z.string().max(120).optional().describe("Bulk create only: key of a folder declared in `folders`"),
-    isEnabledInRunner: z.boolean().optional(),
-});
+    preRequestScript: z.string().max(100_000).optional().describe("pm.* script run before the request (callman://docs/scripting/pm-api)"),
+    postResponseScript: z.string().max(100_000).optional().describe("pm.* script run after the response (pm.test, pm.environment.set …)"),
+    testsScript: z.string().max(100_000).optional().describe("pm.test(...) assertions run after the response"),
+    folder: z.string().max(300).optional().describe("Folder id, name or path (\"Auth/Login\") inside the collection"),
+    folderKey: z.string().max(120).optional().describe("create_requests_bulk with collectionName only: key of a folder declared in `folders`"),
+    isEnabledInRunner: z.boolean().optional().describe("false = skipped by collection runs (run_collection, the desktop runner, the CLI); default true"),
+    ...requestIntegrationFields,
+}, "request field");
 export const toRows = (entries) => (entries ?? [])
     .filter((entry) => entry.key.trim().length > 0)
-    .map((entry) => ({ key: entry.key.trim(), value: entry.value ?? "", enabled: entry.enabled ?? true }))
-    .slice(0, 200);
+    .map((entry) => ({ key: entry.key.trim(), value: entry.value ?? "", enabled: entry.enabled ?? true }));
+const toPathVariables = (entries) => entries.map((entry) => ({ key: entry.key.trim().replace(/^:/, ""), value: entry.value ?? "", description: entry.description ?? "" }));
+// ── URL ⇄ query rows ───────────────────────────────────────────────────
+// The desktop keeps the URL's ?query and the query rows in sync
+// (request-editor/lib/urlSync.ts), and every runner sends the ROWS — the run
+// bundle strips the URL query. So a query typed into `url` becomes rows, and
+// the stored URL mirrors the enabled rows exactly like the editor does.
+const splitHash = (url) => {
+    const index = url.indexOf("#");
+    return index === -1 ? { withoutHash: url, hash: "" } : { withoutHash: url.slice(0, index), hash: url.slice(index) };
+};
+export const buildUrlWithQueryRows = (url, rows) => {
+    const { withoutHash, hash } = splitHash(url);
+    const base = stripUrlQuery(withoutHash);
+    const enabled = rows.filter((row) => row.enabled !== false && row.key.trim());
+    return enabled.length === 0 ? `${base}${hash}` : `${base}?${enabled.map((row) => `${row.key}=${row.value}`).join("&")}${hash}`;
+};
+export const syncUrlAndQuery = (url, query) => {
+    const fromUrl = extractUrlQueryPairs(url).map((pair) => ({ key: pair.key, value: pair.value, enabled: true }));
+    if (query === undefined)
+        return { url: buildUrlWithQueryRows(url, fromUrl), query: fromUrl, warnings: [] };
+    const rows = toRows(query);
+    const dropped = fromUrl.filter((pair) => !rows.some((row) => row.key === pair.key));
+    return {
+        url: buildUrlWithQueryRows(url, rows),
+        query: rows,
+        warnings: dropped.length > 0 ? [`The URL's query parameter(s) ${dropped.map((pair) => pair.key).join(", ")} were replaced by the \`query\` rows you passed — add them to \`query\` to keep them.`] : [],
+    };
+};
+// ── body ───────────────────────────────────────────────────────────────
+const isModeObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && typeof value.mode === "string";
+// Persisted body — the exact rules of the desktop editor's serializeBodyState
+// (guarded in the desktop by persistedBody.drift.test.ts): JSON stays a bare
+// JSON value; raw xml/text/html persists as { mode, raw, rawLanguage };
+// form bodies keep their entries; empty → null.
+export const toBodyPayload = (body, headers) => {
+    if (body === undefined || body === null)
+        return null;
+    if (typeof body === "string") {
+        if (isClipped(body))
+            throw clippedError("body");
+        return toPersistedRequestBody(inferBodyStateFromRaw(body, headers));
+    }
+    if (isModeObject(body)) {
+        const record = body;
+        if (record.mode === "none")
+            return null;
+        if (record.mode === "json")
+            return (record.json ?? null);
+        if (record.mode === "raw") {
+            const raw = typeof record.raw === "string" ? record.raw : "";
+            if (isClipped(raw))
+                throw clippedError("body.raw");
+            const language = (record.language ?? record.rawLanguage);
+            if (language)
+                return toPersistedRequestBody({ mode: "raw", raw, rawLanguage: language, formEntries: [] });
+            return toPersistedRequestBody(inferBodyStateFromRaw(raw, headers));
+        }
+        if (record.mode === "formdata" || record.mode === "urlencoded") {
+            const persisted = Array.isArray(record.formEntries) ? record.formEntries : null;
+            if (persisted?.some((entry) => entry.type === "file")) {
+                throw new ToolInputError("FORM_FILE_UNSUPPORTED", "File parts of a form body cannot be set through the API — keep them in the desktop app, or send text fields only.");
+            }
+            const entries = persisted
+                ? persisted.map((entry) => ({ key: String(entry.key ?? ""), value: String(entry.value ?? ""), enabled: entry.enabled !== false }))
+                : (record.entries ?? []);
+            return toPersistedRequestBody({ mode: record.mode, raw: "", formEntries: toRows(entries) });
+        }
+    }
+    // Any other JSON value is stored as-is (the editor shows it on the JSON tab).
+    return body;
+};
+// Previews end in "…" (lib/truncate) — writing one back would store the cut.
+const isClipped = (text) => text.endsWith("…") && text.length >= LIMITS.BODY_PREVIEW;
+const clippedError = (field) => new ToolInputError("CLIPPED_VALUE", `${field} looks like a clipped preview (ends with "…"). Read it with get_request full: true, or pass the complete value.`);
+// The backend (express-mongo-sanitize) rewrites JSON keys that start with "$"
+// or contain "." on ordinary writes — { "$schema": … } is stored as "_schema".
+export const sanitizedKeyWarnings = (body) => {
+    const found = new Set();
+    const walk = (value, depth) => {
+        if (depth > 20 || found.size >= 10 || value === null || typeof value !== "object")
+            return;
+        if (Array.isArray(value)) {
+            for (const item of value)
+                walk(item, depth + 1);
+            return;
+        }
+        for (const [key, child] of Object.entries(value)) {
+            if (key.startsWith("$") || key.includes("."))
+                found.add(key);
+            walk(child, depth + 1);
+        }
+    };
+    walk(body, 0);
+    return found.size > 0
+        ? [`The server rewrites JSON keys that start with "$" or contain "." (${[...found].join(", ")} → "_"). Keep such payloads as a raw string body ({ mode: "raw", raw: "…", language: "json" }).`]
+        : [];
+};
+// ── auth ───────────────────────────────────────────────────────────────
 const EMPTY_AUTH = {
     type: "none",
     bearerToken: "",
@@ -105,86 +233,141 @@ export const toAuthPayload = (auth) => {
             return { ...EMPTY_AUTH };
     }
 };
-const isModeObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && typeof value.mode === "string";
-// Persisted body — the exact rules of the desktop editor's serializeBodyState
-// (guarded in the desktop by persistedBody.drift.test.ts): JSON stays a bare
-// JSON value; raw xml/text/html persists as { mode, raw, rawLanguage };
-// form bodies keep their entries; empty → null.
-export const toBodyPayload = (body, headers) => {
-    if (body === undefined || body === null)
-        return null;
-    if (typeof body === "string") {
-        return toPersistedRequestBody(inferBodyStateFromRaw(body, headers));
-    }
-    if (isModeObject(body)) {
-        const record = body;
-        if (record.mode === "none")
-            return null;
-        if (record.mode === "raw") {
-            const raw = typeof record.raw === "string" ? record.raw : "";
-            const language = record.language;
-            if (language) {
-                return toPersistedRequestBody({ mode: "raw", raw, rawLanguage: language, formEntries: [] });
-            }
-            return toPersistedRequestBody(inferBodyStateFromRaw(raw, headers));
+// Stored auth → the SAME shape authInputSchema accepts, so a read can be
+// written straight back. Secrets are masked unless `reveal`.
+export const authInputView = (auth, reveal = false) => {
+    const hide = (value) => (value ? (reveal ? value : maskSecret(value)) : "");
+    switch (auth?.type) {
+        case "bearer":
+            return { type: "bearer", token: hide(auth.bearerToken) };
+        case "basic":
+            return { type: "basic", username: auth.basicUsername ?? "", password: hide(auth.basicPassword) };
+        case "apikey":
+            return { type: "apiKey", key: auth.apiKeyKey ?? "", value: hide(auth.apiKeyValue), location: auth.apiKeyLocation ?? "header" };
+        case "oauth2": {
+            const oauth2 = (auth.oauth2 ?? {});
+            return {
+                type: "oauth2",
+                grantType: oauth2.grantType ?? "client_credentials",
+                tokenUrl: oauth2.tokenUrl ?? "",
+                clientId: oauth2.clientId ?? "",
+                clientSecret: hide(oauth2.clientSecret),
+                scope: oauth2.scope ?? "",
+                username: oauth2.username ?? "",
+                password: hide(oauth2.password),
+                refreshToken: hide(oauth2.refreshToken),
+                clientAuth: oauth2.clientAuth ?? "body",
+                audience: oauth2.audience ?? "",
+            };
         }
-        if (record.mode === "formdata" || record.mode === "urlencoded") {
-            const entries = Array.isArray(record.entries) ? record.entries : [];
-            return toPersistedRequestBody({ mode: record.mode, raw: "", formEntries: toRows(entries) });
+        default:
+            return { type: "none" };
+    }
+};
+// ── masked values ──────────────────────────────────────────────────────
+// get_request shows secrets as ••••ab. Writing that back would store the
+// dots as the credential. On update a masked value that matches the stored
+// secret's mask means "keep the stored value"; anything else masked is refused.
+export const resolveMaskedValues = (item, current) => {
+    const problems = [];
+    const restoreRows = (field, rows) => rows?.map((row) => {
+        if (!isMasked(row.value))
+            return row;
+        const stored = current?.[field]?.find((entry) => entry.key.toLowerCase() === row.key.toLowerCase());
+        if (stored && field === "headers" && maskHeaderValue(stored.key, stored.value) === row.value)
+            return { ...row, value: stored.value };
+        problems.push(`${field}.${row.key}`);
+        return row;
+    });
+    const out = { ...item, headers: restoreRows("headers", item.headers), query: restoreRows("query", item.query) };
+    if (item.headers === undefined)
+        delete out.headers;
+    if (item.query === undefined)
+        delete out.query;
+    for (const entry of item.pathVariables ?? [])
+        if (isMasked(entry.value))
+            problems.push(`pathVariables.${entry.key}`);
+    if (item.auth) {
+        const storedView = authInputView(current?.auth, true);
+        const auth = { ...item.auth };
+        for (const [key, value] of Object.entries(auth)) {
+            if (!isMasked(value))
+                continue;
+            const stored = storedView.type === auth.type ? storedView[key] : undefined;
+            if (typeof stored === "string" && stored && maskSecret(stored) === value)
+                auth[key] = stored;
+            else
+                problems.push(`auth.${key}`);
         }
+        out.auth = auth;
     }
-    // Any other JSON value is stored as-is (the editor shows it on the JSON tab).
-    return body;
+    if (problems.length > 0) {
+        throw new ToolInputError("MASKED_VALUE", `Masked values (••••) cannot be saved: ${problems.join(", ")}. Pass the real value or a {{variable}}, or leave the field out to keep what is stored (get_request reveal: true shows it).`, { fields: problems });
+    }
+    return out;
 };
-export const toCreateRequestPayload = (item, target) => {
+const noConnections = (_ref, _type, where) => {
+    throw new ToolInputError("CONNECTIONS_UNAVAILABLE", `${where}: connections were not loaded for this call.`);
+};
+export const toCreateRequestPayload = (item, target, resolve = noConnections) => {
     const headers = toRows(item.headers);
+    const { url, query, warnings } = syncUrlAndQuery(item.url.trim(), item.query);
+    const body = toBodyPayload(item.body, headers);
     return {
-        name: item.name.trim().slice(0, LIMITS.NAME),
-        method: item.method,
-        url: item.url.trim(),
-        headers,
-        query: toRows(item.query),
-        pathVariables: (item.pathVariables ?? [])
-            .filter((entry) => entry.key.trim())
-            .map((entry) => ({ key: entry.key.trim(), value: entry.value ?? "", description: entry.description ?? "" })),
-        body: toBodyPayload(item.body, headers),
-        auth: toAuthPayload(item.auth),
-        preRequestScript: item.preRequestScript ?? "",
-        postResponseScript: item.postResponseScript ?? "",
-        testsScript: item.testsScript ?? "",
-        collectionId: target.collectionId,
-        folderId: target.folderId,
+        payload: {
+            name: item.name.trim().slice(0, LIMITS.NAME),
+            method: item.method,
+            url,
+            headers,
+            query,
+            pathVariables: toPathVariables(item.pathVariables ?? []),
+            body,
+            auth: toAuthPayload(item.auth),
+            preRequestScript: item.preRequestScript ?? "",
+            postResponseScript: item.postResponseScript ?? "",
+            testsScript: item.testsScript ?? "",
+            ...(hasIntegrations(item) ? toIntegrationPayload(item, resolve) : {}),
+            collectionId: target.collectionId,
+            folderId: target.folderId,
+        },
+        warnings: [...warnings, ...sanitizedKeyWarnings(body)],
     };
 };
 // `format: "requests"` bulk import row — same document minus the ids the
-// server assigns, plus the payload-local folderKey.
-export const toFlatImportRequest = (item) => {
-    const { collectionId: _c, folderId: _f, ...payload } = toCreateRequestPayload(item, { collectionId: "", folderId: null });
+// server assigns, plus the payload-local folderKey. The import route is not
+// key-sanitized, so no "$" warning here.
+export const toFlatImportRequest = (item, resolve = noConnections) => {
+    const { collectionId: _c, folderId: _f, ...payload } = toCreateRequestPayload(item, { collectionId: "", folderId: null }, resolve).payload;
     return { ...payload, ...(item.folderKey ? { folderKey: item.folderKey } : {}) };
 };
-export const updateRequestInputSchema = requestInputSchema
-    .partial()
-    .omit({ folderKey: true })
-    .extend({ collection: z.string().max(200).optional() });
-export const toUpdateRequestPayload = (item, target) => {
+export const updateRequestInputSchema = strictObject({
+    ...Object.fromEntries(Object.entries(requestInputSchema.shape).filter(([key]) => key !== "folderKey").map(([key, schema]) => [key, schema.optional()])),
+    collection: z.string().max(200).optional().describe("Narrows a request NAME lookup to one collection (it does not move the request — use move_requests)"),
+}, "request field");
+// Only the fields passed change. isEnabledInRunner is NOT part of the PATCH
+// (the backend's update schema strips it) — the caller sends it to the
+// run-toggle endpoint.
+export const toUpdateRequestPayload = (item, current, target, resolve = noConnections) => {
     const out = {};
+    const warnings = [];
     if (item.name !== undefined)
         out.name = item.name.trim().slice(0, LIMITS.NAME);
     if (item.method !== undefined)
         out.method = item.method;
-    if (item.url !== undefined)
-        out.url = item.url.trim();
+    if (item.url !== undefined || item.query !== undefined) {
+        const synced = syncUrlAndQuery((item.url ?? current.url).trim(), item.query ?? (item.url !== undefined ? undefined : current.query ?? []));
+        out.url = synced.url;
+        out.query = synced.query;
+        warnings.push(...synced.warnings);
+    }
     if (item.headers !== undefined)
         out.headers = toRows(item.headers);
-    if (item.query !== undefined)
-        out.query = toRows(item.query);
-    if (item.pathVariables !== undefined) {
-        out.pathVariables = item.pathVariables
-            .filter((entry) => entry.key.trim())
-            .map((entry) => ({ key: entry.key.trim(), value: entry.value ?? "", description: entry.description ?? "" }));
+    if (item.pathVariables !== undefined)
+        out.pathVariables = toPathVariables(item.pathVariables);
+    if (item.body !== undefined) {
+        out.body = toBodyPayload(item.body, item.headers !== undefined ? toRows(item.headers) : (current.headers ?? []));
+        warnings.push(...sanitizedKeyWarnings(out.body));
     }
-    if (item.body !== undefined)
-        out.body = toBodyPayload(item.body, toRows(item.headers));
     if (item.auth !== undefined)
         out.auth = toAuthPayload(item.auth);
     if (item.preRequestScript !== undefined)
@@ -193,13 +376,11 @@ export const toUpdateRequestPayload = (item, target) => {
         out.postResponseScript = item.postResponseScript;
     if (item.testsScript !== undefined)
         out.testsScript = item.testsScript;
-    if (item.isEnabledInRunner !== undefined)
-        out.isEnabledInRunner = item.isEnabledInRunner;
-    if (target.collectionId !== undefined)
-        out.collectionId = target.collectionId;
+    if (hasIntegrations(item))
+        Object.assign(out, toIntegrationPayload(item, resolve, current));
     if (target.folderId !== undefined)
         out.folderId = target.folderId;
-    return out;
+    return { payload: out, warnings };
 };
 // ── outbound views ─────────────────────────────────────────────────────
 const kvView = (rows, maskHeaders) => (rows ?? []).map((row) => ({
@@ -207,9 +388,35 @@ const kvView = (rows, maskHeaders) => (rows ?? []).map((row) => ({
     value: maskHeaders ? maskHeaderValue(row.key, row.value) : row.value,
     ...(row.enabled === false ? { enabled: false } : {}),
 }));
+// Stored body → the input shape (a bare JSON value stays bare unless it has
+// a top-level "mode", which would read as a mode object).
+export const bodyInputView = (body) => {
+    if (body === null || body === undefined)
+        return null;
+    if (isModeObject(body)) {
+        const record = body;
+        if (record.mode === "raw" && typeof record.raw === "string")
+            return { mode: "raw", raw: record.raw, language: record.rawLanguage ?? "text" };
+        if ((record.mode === "formdata" || record.mode === "urlencoded") && Array.isArray(record.formEntries)) {
+            return {
+                mode: record.mode,
+                entries: record.formEntries.map((entry) => ({
+                    key: String(entry.key ?? ""),
+                    value: String(entry.value ?? ""),
+                    ...(entry.enabled === false ? { enabled: false } : {}),
+                    ...(entry.type === "file" ? { file: true } : {}),
+                })),
+            };
+        }
+        return { mode: "json", json: body };
+    }
+    return body;
+};
 export const compactRequestView = (request, options = {}) => {
-    const bodyText = request.body == null ? null : safeStringify(request.body);
+    const body = bodyInputView(request.body);
+    const bodyText = body === null ? null : safeStringify(body);
     const bodyTruncated = bodyText !== null && !options.full && bodyText.length > LIMITS.BODY_PREVIEW;
+    const integrations = integrationsInputView(request);
     return {
         id: request.id,
         name: request.name,
@@ -220,17 +427,25 @@ export const compactRequestView = (request, options = {}) => {
         headers: kvView(request.headers, !options.reveal),
         query: kvView(request.query, false),
         ...(request.pathVariables && request.pathVariables.length > 0
-            ? { pathVariables: request.pathVariables.map((entry) => ({ key: entry.key, value: entry.value ?? "" })) }
+            ? {
+                pathVariables: request.pathVariables.map((entry) => ({
+                    key: entry.key,
+                    value: entry.value ?? "",
+                    ...(entry.description ? { description: entry.description } : {}),
+                })),
+            }
             : {}),
-        body: options.full ? request.body : jsonPreview(request.body),
-        ...(bodyTruncated ? { bodyTruncated: true } : {}),
-        auth: options.reveal ? (request.auth ?? { type: "none" }) : maskAuth(request.auth),
+        // A clipped body is never returned as `body` — it would validate as a
+        // (cut) body if written back.
+        ...(bodyTruncated ? { body: null, bodyPreview: jsonPreview(body), bodyTruncated: true } : { body }),
+        auth: authInputView(request.auth, options.reveal),
         scripts: {
             preRequest: scriptView(request.preRequestScript, options.full),
             postResponse: scriptView(request.postResponseScript, options.full),
             tests: scriptView(request.testsScript, options.full),
         },
         isEnabledInRunner: request.isEnabledInRunner !== false,
+        ...(integrations ?? {}),
         updatedAt: request.updatedAt ?? null,
     };
 };