callman-mcp 0.1.0 → 0.2.0

package/dist/lib/pagination.d.ts

@@ -1,11 +1,12 @@
 export interface PageCursor {
     page: number;
     limit: number;
+    q?: string;
 }
 export declare const encodeCursor: (cursor: PageCursor) => string;
 export declare const decodeCursor: (raw: string | undefined | null) => PageCursor | null;
 export declare const clampLimit: (limit: number | undefined) => number;
-export declare const pageFromCursor: (cursor: string | undefined, limit: number | undefined) => PageCursor;
+export declare const pageFromCursor: (cursor: string | undefined, limit: number | undefined, q?: string) => PageCursor;
 export interface BackendPagination {
     page: number;
     limit: number;
@@ -13,7 +14,7 @@ export interface BackendPagination {
     totalPages: number;
 }
 export declare const nextCursorFor: (pagination: BackendPagination) => string | null;
-export declare const sliceWithCursor: <T>(items: T[], cursor: string | undefined, limit: number | undefined) => {
+export declare const sliceWithCursor: <T>(items: T[], cursor: string | undefined, limit: number | undefined, q?: string) => {
     items: T[];
     total: number;
     nextCursor: string | null;

package/dist/lib/pagination.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pagination.d.ts","sourceRoot":"","sources":["../../src/lib/pagination.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,eAAO,MAAM,YAAY,GAAI,QAAQ,UAAU,KAAG,MACiB,CAAC;AAEpE,eAAO,MAAM,YAAY,GAAI,KAAK,MAAM,GAAG,SAAS,GAAG,IAAI,KAAG,UAAU,GAAG,IAU1E,CAAC;AAEF,eAAO,MAAM,UAAU,GAAI,OAAO,MAAM,GAAG,SAAS,KAAG,MAC2B,CAAC;AAEnF,eAAO,MAAM,cAAc,GAAI,QAAQ,MAAM,GAAG,SAAS,EAAE,OAAO,MAAM,GAAG,SAAS,KAAG,UAItF,CAAC;AAEF,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,aAAa,GAAI,YAAY,iBAAiB,KAAG,MAAM,GAAG,IAG7D,CAAC;AAGX,eAAO,MAAM,eAAe,GAAI,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,MAAM,GAAG,SAAS,EAAE,OAAO,MAAM,GAAG,SAAS;;;;CAUnG,CAAC"}
+{"version":3,"file":"pagination.d.ts","sourceRoot":"","sources":["../../src/lib/pagination.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IAGd,CAAC,CAAC,EAAE,MAAM,CAAC;CACZ;AAED,eAAO,MAAM,YAAY,GAAI,QAAQ,UAAU,KAAG,MACiB,CAAC;AAEpE,eAAO,MAAM,YAAY,GAAI,KAAK,MAAM,GAAG,SAAS,GAAG,IAAI,KAAG,UAAU,GAAG,IAU1E,CAAC;AAEF,eAAO,MAAM,UAAU,GAAI,OAAO,MAAM,GAAG,SAAS,KAAG,MAC2B,CAAC;AAEnF,eAAO,MAAM,cAAc,GAAI,QAAQ,MAAM,GAAG,SAAS,EAAE,OAAO,MAAM,GAAG,SAAS,EAAE,UAAM,KAAG,UAM9F,CAAC;AAEF,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,aAAa,GAAI,YAAY,iBAAiB,KAAG,MAAM,GAAG,IAG7D,CAAC;AAGX,eAAO,MAAM,eAAe,GAAI,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,MAAM,GAAG,SAAS,EAAE,OAAO,MAAM,GAAG,SAAS,EAAE,UAAM;;;;CAU3G,CAAC"}

package/dist/lib/pagination.js

@@ -1,3 +1,4 @@
+import { ToolInputError } from "../client/errors.js";
 import { LIMITS } from "./truncate.js";
 export const encodeCursor = (cursor) => Buffer.from(JSON.stringify(cursor), "utf8").toString("base64url");
 export const decodeCursor = (raw) => {
@@ -9,32 +10,36 @@ export const decodeCursor = (raw) => {
             return null;
         if (!Number.isInteger(parsed.page) || parsed.page < 1)
             return null;
-        return { page: parsed.page, limit: clampLimit(parsed.limit) };
+        return { page: parsed.page, limit: clampLimit(parsed.limit), ...(typeof parsed.q === "string" ? { q: parsed.q } : {}) };
     }
     catch {
         return null;
     }
 };
 export const clampLimit = (limit) => Math.min(LIMITS.LIST_MAX, Math.max(1, Math.floor(limit ?? LIMITS.LIST_DEFAULT)));
-export const pageFromCursor = (cursor, limit) => {
+export const pageFromCursor = (cursor, limit, q = "") => {
+    if (!cursor)
+        return { page: 1, limit: clampLimit(limit) };
     const decoded = decodeCursor(cursor);
-    if (decoded)
-        return decoded;
-    return { page: 1, limit: clampLimit(limit) };
+    if (!decoded)
+        throw new ToolInputError("CURSOR_INVALID", "That cursor is not one this server issued — pass the nextCursor from the previous result verbatim, or omit it for the first page.");
+    if ((decoded.q ?? "") !== q)
+        throw new ToolInputError("CURSOR_QUERY_MISMATCH", "That cursor belongs to a different query — omit it to start this query from the first page.");
+    return decoded;
 };
 export const nextCursorFor = (pagination) => pagination.page < pagination.totalPages
     ? encodeCursor({ page: pagination.page + 1, limit: pagination.limit })
     : null;
 // Client-side slice for list endpoints that are not paginated server-side.
-export const sliceWithCursor = (items, cursor, limit) => {
-    const { page, limit: size } = pageFromCursor(cursor, limit);
+export const sliceWithCursor = (items, cursor, limit, q = "") => {
+    const { page, limit: size } = pageFromCursor(cursor, limit, q);
     const start = (page - 1) * size;
     const slice = items.slice(start, start + size);
     const totalPages = Math.max(1, Math.ceil(items.length / size));
     return {
         items: slice,
         total: items.length,
-        nextCursor: page < totalPages ? encodeCursor({ page: page + 1, limit: size }) : null,
+        nextCursor: page < totalPages ? encodeCursor({ page: page + 1, limit: size, ...(q ? { q } : {}) }) : null,
     };
 };
 //# sourceMappingURL=pagination.js.map

package/dist/lib/pagination.js.map

@@ -1 +1 @@
-{"version":3,"file":"pagination.js","sourceRoot":"","sources":["../../src/lib/pagination.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAUvC,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAkB,EAAU,EAAE,CACzD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAEpE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAA8B,EAAqB,EAAE;IAChF,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAwB,CAAC;QACjG,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACrF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACnE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAAyB,EAAU,EAAE,CAC9D,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;AAEnF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAA0B,EAAE,KAAyB,EAAc,EAAE;IAClG,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;AAC/C,CAAC,CAAC;AASF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,UAA6B,EAAiB,EAAE,CAC5E,UAAU,CAAC,IAAI,GAAG,UAAU,CAAC,UAAU;IACrC,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,GAAG,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC;IACtE,CAAC,CAAC,IAAI,CAAC;AAEX,2EAA2E;AAC3E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAI,KAAU,EAAE,MAA0B,EAAE,KAAyB,EAAE,EAAE;IACtG,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;IAChC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;IAC/D,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,KAAK,CAAC,MAAM;QACnB,UAAU,EAAE,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;KACrF,CAAC;AACJ,CAAC,CAAC"}
+{"version":3,"file":"pagination.js","sourceRoot":"","sources":["../../src/lib/pagination.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAavC,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAkB,EAAU,EAAE,CACzD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAEpE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAA8B,EAAqB,EAAE;IAChF,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAwB,CAAC;QACjG,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACrF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACnE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,OAAO,MAAM,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC1H,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAAyB,EAAU,EAAE,CAC9D,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;AAEnF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAA0B,EAAE,KAAyB,EAAE,CAAC,GAAG,EAAE,EAAc,EAAE;IAC1G,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;IAC1D,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,cAAc,CAAC,gBAAgB,EAAE,mIAAmI,CAAC,CAAC;IAC9L,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,uBAAuB,EAAE,6FAA6F,CAAC,CAAC;IAC9K,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AASF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,UAA6B,EAAiB,EAAE,CAC5E,UAAU,CAAC,IAAI,GAAG,UAAU,CAAC,UAAU;IACrC,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,GAAG,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC;IACtE,CAAC,CAAC,IAAI,CAAC;AAEX,2EAA2E;AAC3E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAI,KAAU,EAAE,MAA0B,EAAE,KAAyB,EAAE,CAAC,GAAG,EAAE,EAAE,EAAE;IAC9G,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;IAChC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;IAC/D,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,KAAK,CAAC,MAAM;QACnB,UAAU,EAAE,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;KAC1G,CAAC;AACJ,CAAC,CAAC"}

package/dist/lib/redact.d.ts

@@ -0,0 +1,12 @@
+export interface Redactor {
+    text(value: string): string;
+    value(value: unknown): unknown;
+    headers(headers: Record<string, unknown> | undefined): Record<string, string>;
+    query(query: Record<string, unknown> | undefined): Record<string, string>;
+}
+export interface RedactorOptions {
+    secretHeaders?: Iterable<string>;
+    secretQuery?: Iterable<string>;
+}
+export declare const createRedactor: (knownValues: Array<[string, string]>, options?: RedactorOptions) => Redactor;
+//# sourceMappingURL=redact.d.ts.map

package/dist/lib/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../src/lib/redact.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,QAAQ;IACvB,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,KAAK,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;IAC/B,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9E,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3E;AAED,MAAM,WAAW,eAAe;IAE9B,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;CAChC;AAED,eAAO,MAAM,cAAc,GAAI,aAAa,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,UAAS,eAAoB,KAAG,QAsCpG,CAAC"}

package/dist/lib/redact.js

@@ -0,0 +1,50 @@
+import { isSensitiveHeader, maskSecret } from "./mask.js";
+// Run output never carries variable VALUES: every value the run held is
+// turned back into its `{{key}}` wherever it shows up (the URL, headers, query
+// and body as sent, the response). The model still sees WHICH variable went
+// where — "{{baseUrl}}/users/{{userId}}" — which is what it needs to debug,
+// and a token a login script stored is as hidden as one from the environment.
+// Credentials that are not variables (a literal bearer token, an API key
+// header named by the request's auth) are masked by name.
+// Short values ("1", "yes", "GET") would shred ordinary text.
+const MIN_VALUE_LENGTH = 4;
+export const createRedactor = (knownValues, options = {}) => {
+    const pairs = knownValues
+        .filter(([, value]) => value.length >= MIN_VALUE_LENGTH)
+        .sort((a, b) => b[1].length - a[1].length);
+    const secretHeaders = new Set([...(options.secretHeaders ?? [])].map((name) => name.toLowerCase()));
+    const secretQuery = new Set([...(options.secretQuery ?? [])].map((name) => name.toLowerCase()));
+    const text = (input) => {
+        let out = input;
+        for (const [key, value] of pairs)
+            if (out.includes(value))
+                out = out.split(value).join(`{{${key}}}`);
+        for (const name of secretQuery) {
+            out = out.replace(new RegExp(`([?&]${name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}=)([^&#]*)`, "gi"), (_match, prefix, secret) => `${prefix}${secret.startsWith("{{") ? secret : maskSecret(secret)}`);
+        }
+        return out;
+    };
+    const value = (input) => {
+        if (typeof input === "string")
+            return text(input);
+        if (Array.isArray(input))
+            return input.map(value);
+        if (input && typeof input === "object") {
+            return Object.fromEntries(Object.entries(input).map(([key, child]) => [key, value(child)]));
+        }
+        return input;
+    };
+    const masked = (name, raw, secretNames) => {
+        const redacted = text(raw);
+        if (redacted !== raw)
+            return redacted; // (part of) it came from a variable
+        return (secretNames.has(name.toLowerCase()) || (secretNames === secretHeaders && isSensitiveHeader(name))) && raw ? maskSecret(raw) : redacted;
+    };
+    return {
+        text,
+        value,
+        headers: (headers) => Object.fromEntries(Object.entries(headers ?? {}).map(([name, raw]) => [name, masked(name, Array.isArray(raw) ? raw.join(", ") : String(raw), secretHeaders)])),
+        query: (query) => Object.fromEntries(Object.entries(query ?? {}).map(([name, raw]) => [name, masked(name, String(raw), secretQuery)])),
+    };
+};
+//# sourceMappingURL=redact.js.map

package/dist/lib/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../src/lib/redact.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE1D,wEAAwE;AACxE,+EAA+E;AAC/E,4EAA4E;AAC5E,4EAA4E;AAC5E,8EAA8E;AAC9E,yEAAyE;AACzE,0DAA0D;AAE1D,8DAA8D;AAC9D,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAe3B,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,WAAoC,EAAE,UAA2B,EAAE,EAAY,EAAE;IAC9G,MAAM,KAAK,GAAG,WAAW;SACtB,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,gBAAgB,CAAC;SACvD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACpG,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAEhG,MAAM,IAAI,GAAG,CAAC,KAAa,EAAU,EAAE;QACrC,IAAI,GAAG,GAAG,KAAK,CAAC;QAChB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,KAAK;YAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;QACrG,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,MAAc,EAAE,MAAc,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxN,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,KAAc,EAAW,EAAE;QACxC,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvC,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACzH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,GAAW,EAAE,WAAwB,EAAU,EAAE;QAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,QAAQ,KAAK,GAAG;YAAE,OAAO,QAAQ,CAAC,CAAC,oCAAoC;QAC3E,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,aAAa,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACjJ,CAAC,CAAC;IAEF,OAAO;QACL,IAAI;QACJ,KAAK;QACL,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CACnB,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;QAChK,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;KACvI,CAAC;AACJ,CAAC,CAAC"}

package/dist/lib/strict.d.ts

@@ -0,0 +1,4 @@
+import { z } from "zod";
+export declare const unknownKeysErrorMap: (noun: string, validKeys: string[], where?: string) => z.ZodErrorMap;
+export declare const strictObject: <T extends z.ZodRawShape>(shape: T, noun: string, where?: string) => z.ZodObject<T, "strict", z.ZodTypeAny, z.objectUtil.addQuestionMarks<z.baseObjectOutputType<T>, any> extends infer T_1 ? { [k in keyof T_1]: T_1[k]; } : never, z.baseObjectInputType<T> extends infer T_2 ? { [k_1 in keyof T_2]: T_2[k_1]; } : never>;
+//# sourceMappingURL=strict.d.ts.map

package/dist/lib/strict.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"strict.d.ts","sourceRoot":"","sources":["../../src/lib/strict.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AASxB,eAAO,MAAM,mBAAmB,GAC7B,MAAM,MAAM,EAAE,WAAW,MAAM,EAAE,EAAE,QAAQ,MAAM,KAAG,CAAC,CAAC,WAMpB,CAAC;AAEtC,eAAO,MAAM,YAAY,GAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,MAAM,EAAE,QAAQ,MAAM,4PACE,CAAC"}

package/dist/lib/strict.js

@@ -0,0 +1,14 @@
+import { z } from "zod";
+// Strict objects: an unknown or misspelled key is an ERROR naming the valid
+// keys — never silently stripped (zod's default), because a stripped key
+// means the tool quietly does something other than what was asked
+// (`workspaceId` instead of `workspace` → the default workspace; `strokeColor`
+// instead of `stroke` → an unstyled node, reported as success).
+// `noun` names one key ("style key", "argument"); `where` says whose.
+export const unknownKeysErrorMap = (noun, validKeys, where) => (issue, ctx) => issue.code === z.ZodIssueCode.unrecognized_keys
+    ? {
+        message: `Unknown ${noun}${issue.keys.length === 1 ? "" : "s"} ${issue.keys.map((key) => `"${key}"`).join(", ")}${where ? ` for ${where}` : ""}. Valid ${noun}s: ${validKeys.join(", ")}`,
+    }
+    : { message: ctx.defaultError };
+export const strictObject = (shape, noun, where) => z.object(shape, { errorMap: unknownKeysErrorMap(noun, Object.keys(shape), where) }).strict();
+//# sourceMappingURL=strict.js.map

package/dist/lib/strict.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"strict.js","sourceRoot":"","sources":["../../src/lib/strict.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,4EAA4E;AAC5E,yEAAyE;AACzE,kEAAkE;AAClE,+EAA+E;AAC/E,gEAAgE;AAEhE,sEAAsE;AACtE,MAAM,CAAC,MAAM,mBAAmB,GAC9B,CAAC,IAAY,EAAE,SAAmB,EAAE,KAAc,EAAiB,EAAE,CACrE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CACb,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,YAAY,CAAC,iBAAiB;IAC7C,CAAC,CAAC;QACE,OAAO,EAAE,WAAW,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,IAAI,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;KAC1L;IACH,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC;AAEtC,MAAM,CAAC,MAAM,YAAY,GAAG,CAA0B,KAAQ,EAAE,IAAY,EAAE,KAAc,EAAE,EAAE,CAC9F,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC"}

package/dist/prompts/index.js

@@ -35,7 +35,7 @@ Steps:
 Steps:
 1. Read \`callman://diagram/components\` — use ONLY those \`type\` values.
 2. From the code and configuration (docker-compose, Kubernetes manifests, terraform, env files, package manifests) identify: services/apps, databases and caches, message brokers/queues, external APIs, auth providers, observability, cloud resources, and the boundaries they live in (VPC, cluster, namespace).
-3. Model 8–25 nodes with 1–3 word labels. Put components inside boundaries with \`parent\` (declare the container node). Give each edge a meaning: \`sync\` for request/response calls, \`async\` for events/callbacks, \`bus\` for streams/queues, \`fallback\` for retries or optional paths. Short edge labels (protocol or event name) only where they add information.
+3. Model 8–25 nodes with 1–3 word labels. Put components inside boundaries with \`parent\` — the boundary is a \`frame\` (or \`pool.horizontal\` / \`pool.vertical\`) node. Give each boundary its own color so zones read at a glance: \`style: { stroke: "#8B5CF6", fill: "rgba(139,92,246,0.07)", textColor: "#8B5CF6", strokeWidth: 2, bold: true }\` (see \`callman://docs/diagram-schema\` → Styling). Give each edge a meaning: \`sync\` for request/response calls, \`async\` for events/callbacks, \`bus\` for streams/queues, \`fallback\` for retries or optional paths. Short edge labels (protocol or event name) only where they add information.
 4. Call \`create_diagram\` with \`name: "${name ?? "<system name>"}"\`, no positions (automatic layout). If it reports unknown types, fix them with the suggestions and retry.
 5. Describe the diagram in a few sentences and tell me it is in the Callman Diagrams library (Refresh to see it). For corrections use \`patch_diagram\`, not a full rebuild.`));
     server.registerPrompt("create_scenario_from_flow", {
@@ -49,17 +49,17 @@ Steps:
     }, ({ flow, collection, workspace }) => user(`Create a Callman scenario that tests this flow${where(workspace)}: ${flow}
 
 Steps:
-1. Read \`callman://docs/scenario-nodes\` for the node types and their config fields.
-2. Find the requests to reuse with \`search_requests\`${collection ? ` in the collection "${collection}"` : ""} and read the ones you need with \`get_request\` (method, url, body, auth). Request nodes carry their own config — copy method/url/headers/body from the saved request and use \`{{variables}}\` for values produced by earlier steps.
-3. Build the graph: one \`request\` node per call; an \`assertion\` node after each important response (status code, key fields); \`set-vars\` to capture ids/tokens from responses for later steps; a \`condition\` with \`yes\`/\`no\` edges where the flow branches; \`poll\` for eventually-consistent checks; an \`end\` node last. Add a scenario environment with the variables the flow needs.
-4. Call \`create_scenario\` with \`dryRun: true\`, review the resolved graph, then create it for real.
-5. Offer to run it with \`run_scenario\` and to explain the report. On-prem: mention that the scenario is a draft until approved in the desktop app.`));
+1. Read \`callman://docs/scenario-nodes\` for the node types, their config fields, what is required, labels and graph rules.
+2. Find the requests to reuse with \`search_requests\`${collection ? ` in the collection "${collection}"` : ""} and read the ones you need with \`get_request\` (reveal: true if you need the real credentials — a masked value cannot be saved). Request nodes carry their own config — copy method/url/headers/query/body/auth from the saved request (the request tools' shapes are accepted and converted) and use \`{{Label.body.path}}\` / \`{{env.KEY}}\` for values produced by earlier steps.
+3. Build the graph: one \`request\` node per call with a unique identifier label (\`Login\`, \`CreateOrder\`); an \`assertion\` node after each important response (checks with left/operator/right); \`set-vars\` to capture ids/tokens; a \`condition\` with \`yes\`/\`no\` edges where the flow branches; \`poll\` for eventually-consistent checks; an \`end\` node last. db/redis/kafka nodes need a \`connectionId\` from \`list_connections\`. Add a scenario environment with the variables the flow needs.
+4. Call \`create_scenario\` with \`dryRun: true\`, review the resolved nodes, then create it for real. Fix anything listed under \`warnings\` (config keys the server ignored) with \`patch_scenario\`.
+5. Offer to run it with \`run_scenario\` and to explain the report (\`failedNodes\` has the failing checks with expected vs actual). On-prem: a personal token runs the APPROVED version — use \`submit_scenario\` and have it approved first.`));
     server.registerPrompt("document_collection", {
         title: "Document an API collection",
         description: "Read a Callman collection and write API documentation (Markdown or an OpenAPI skeleton) from its requests.",
         argsSchema: {
             collection: z.string().describe("Collection id or name"),
-            format: z.string().optional().describe("markdown (default) or openapi"),
+            format: z.enum(["markdown", "openapi"]).optional().describe("markdown (default) or openapi"),
             workspace: z.string().optional(),
         },
     }, ({ collection, format, workspace }) => user(`Document the Callman collection "${collection}"${where(workspace)} as ${format === "openapi" ? "an OpenAPI 3.1 skeleton" : "Markdown"}.

package/dist/prompts/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/prompts/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,2EAA2E;AAC3E,4EAA4E;AAC5E,yEAAyE;AAEzE,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;AAErH,MAAM,KAAK,GAAG,CAAC,SAA6B,EAAU,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,8BAA8B,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAEvH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAAiB,EAAE,IAAiB,EAAQ,EAAE;IAC5E,MAAM,CAAC,cAAc,CACnB,4BAA4B,EAC5B;QACE,KAAK,EAAE,oDAAoD;QAC3D,WAAW,EAAE,mMAAmM;QAChN,UAAU,EAAE;YACV,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wDAAwD,CAAC;YAC9F,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4EAA4E,CAAC;YACxH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SACjC;KACF,EACD,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,CAClC,IAAI,CAAC,wCAAwC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,cAAc,gBAAgB,KAAK,CAAC,SAAS,CAAC;;;8CAG1E,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB;;;uDAG5B,UAAU,IAAI,gBAAgB;;;sFAGC,CAAC,CACpF,CAAC;IAEF,MAAM,CAAC,cAAc,CACnB,uBAAuB,EACvB;QACE,KAAK,EAAE,+CAA+C;QACtD,WAAW,EAAE,uJAAuJ;QACpK,UAAU,EAAE;YACV,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wEAAwE,CAAC;YAC/G,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC;SACrD;KACF,EACD,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAClB,IAAI,CAAC,mCAAmC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa;;;;;;2CAMhC,IAAI,IAAI,eAAe;6KAC2G,CAAC,CAC3K,CAAC;IAEF,MAAM,CAAC,cAAc,CACnB,2BAA2B,EAC3B;QACE,KAAK,EAAE,wCAAwC;QAC/C,WAAW,EAAE,8IAA8I;QAC3J,UAAU,EAAE;YACV,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;YAC7D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;YAC9E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SACjC;KACF,EACD,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,CAClC,IAAI,CAAC,iDAAiD,KAAK,CAAC,SAAS,CAAC,KAAK,IAAI;;;;wDAI7B,UAAU,CAAC,CAAC,CAAC,uBAAuB,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE;;;qJAGuC,CAAC,CACnJ,CAAC;IAEF,MAAM,CAAC,cAAc,CACnB,qBAAqB,EACrB;QACE,KAAK,EAAE,4BAA4B;QACnC,WAAW,EAAE,4GAA4G;QACzH,UAAU,EAAE;YACV,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;YACxD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;YACvE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SACjC;KACF,EACD,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CACpC,IAAI,CAAC,oCAAoC,UAAU,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,UAAU;;;;;kEAK/E,UAAU,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,IAAI,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,wDAAwD,CAAC,CACrN,CAAC;AACJ,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/prompts/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,2EAA2E;AAC3E,4EAA4E;AAC5E,yEAAyE;AAEzE,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;AAErH,MAAM,KAAK,GAAG,CAAC,SAA6B,EAAU,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,8BAA8B,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAEvH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAAiB,EAAE,IAAiB,EAAQ,EAAE;IAC5E,MAAM,CAAC,cAAc,CACnB,4BAA4B,EAC5B;QACE,KAAK,EAAE,oDAAoD;QAC3D,WAAW,EAAE,mMAAmM;QAChN,UAAU,EAAE;YACV,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wDAAwD,CAAC;YAC9F,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4EAA4E,CAAC;YACxH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SACjC;KACF,EACD,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,CAClC,IAAI,CAAC,wCAAwC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,cAAc,gBAAgB,KAAK,CAAC,SAAS,CAAC;;;8CAG1E,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB;;;uDAG5B,UAAU,IAAI,gBAAgB;;;sFAGC,CAAC,CACpF,CAAC;IAEF,MAAM,CAAC,cAAc,CACnB,uBAAuB,EACvB;QACE,KAAK,EAAE,+CAA+C;QACtD,WAAW,EAAE,uJAAuJ;QACpK,UAAU,EAAE;YACV,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wEAAwE,CAAC;YAC/G,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC;SACrD;KACF,EACD,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAClB,IAAI,CAAC,mCAAmC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa;;;;;;2CAMhC,IAAI,IAAI,eAAe;6KAC2G,CAAC,CAC3K,CAAC;IAEF,MAAM,CAAC,cAAc,CACnB,2BAA2B,EAC3B;QACE,KAAK,EAAE,wCAAwC;QAC/C,WAAW,EAAE,8IAA8I;QAC3J,UAAU,EAAE;YACV,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;YAC7D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;YAC9E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SACjC;KACF,EACD,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,CAClC,IAAI,CAAC,iDAAiD,KAAK,CAAC,SAAS,CAAC,KAAK,IAAI;;;;wDAI7B,UAAU,CAAC,CAAC,CAAC,uBAAuB,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE;;;+OAGiI,CAAC,CAC7O,CAAC;IAEF,MAAM,CAAC,cAAc,CACnB,qBAAqB,EACrB;QACE,KAAK,EAAE,4BAA4B;QACnC,WAAW,EAAE,4GAA4G;QACzH,UAAU,EAAE;YACV,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;YACxD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;YAC5F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SACjC;KACF,EACD,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CACpC,IAAI,CAAC,oCAAoC,UAAU,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,UAAU;;;;;kEAK/E,UAAU,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,IAAI,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,wDAAwD,CAAC,CACrN,CAAC;AACJ,CAAC,CAAC"}

package/dist/resources/docs/contracts.d.ts

@@ -0,0 +1,2 @@
+export declare const CONTRACTS_DOC: string;
+//# sourceMappingURL=contracts.d.ts.map

package/dist/resources/docs/contracts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.d.ts","sourceRoot":"","sources":["../../../src/resources/docs/contracts.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,aAAa,QAsEzB,CAAC"}

package/dist/resources/docs/contracts.js

@@ -0,0 +1,74 @@
+import { SCENARIO_CONTRACT_FORMATS } from "callman-core";
+import { DATA_CONTRACT_LIMITS } from "../../domain/contracts.js";
+export const CONTRACTS_DOC = `# Contract checks on a request
+
+Two documents attached to a saved request — the desktop's Contracts tab. Every runner
+(desktop, CLI, \`run_request\`, \`run_collection\`) evaluates them after the response and
+reports them next to the \`pm.test\` results.
+
+| Tool | Does |
+|---|---|
+| \`get_contract_checks\` | read the rules (with ids) and the data contract |
+| \`add_contract_rules\` | add up to 200 rules at once (\`replace: true\` swaps the whole set) |
+| \`update_contract_rule\` | change one rule's path, rules or enabled |
+| \`delete_contract_rules\` | delete some or all rules |
+| \`test_contract_rules\` | evaluate the enabled rules against a sample body — nothing is sent or saved |
+| \`set_data_contract\` / \`delete_data_contract\` | replace / remove the data-driven contract |
+
+## Field rules
+\`{ "path": "<field path>", "rules": { … }, "enabled": true }\`
+\`\`\`jsonc
+{ "path": "users[].id",       "rules": { "required": true, "type": "string", "format": "uuid" } }
+{ "path": "users",            "rules": { "type": "array", "minItems": 1, "unique": { "mode": "byField", "fields": ["id"] } } }
+{ "path": "total",            "rules": { "type": "number", "integer": true, "min": 0 } }
+{ "path": "status",           "rules": { "enumValues": ["NEW", "PAID", "SHIPPED"] } }
+{ "path": "email",            "rules": { "format": "email", "notEmpty": true } }
+{ "path": "response.status",  "rules": { "equals": 200 } }
+{ "path": "response.headers.content-type", "rules": { "startsWith": "application/json" } }
+\`\`\`
+
+### Paths
+- Body fields with dots: \`user.address.city\`.
+- \`[]\` checks EVERY element: \`users[].id\`, \`[].name\` (top-level array) — one result per element.
+- \`[n]\` checks one element: \`items[0].price\`.
+- \`response.status\`, \`response.headers.<lower-case name>\`, \`response.duration\` (ms) check the
+  HTTP envelope instead of the body.
+
+### Rules (combine freely; at least one per rule)
+| Applies to | Rules |
+|---|---|
+| any | \`required\`, \`type\` (string · number · boolean · object · array · null), \`equals\`, \`notEmpty\`, \`enumValues\` |
+| numbers | \`min\`, \`max\`, \`greaterThan\`, \`lessThan\`, \`integer\`, \`positive\`, \`negative\`, \`nonZero\` |
+| strings | \`minLength\`, \`maxLength\`, \`pattern\` (JS regex), \`contains\`, \`notContains\`, \`startsWith\`, \`endsWith\`, \`caseSensitive\` (default true), \`format\` |
+| arrays | \`minItems\`, \`maxItems\`, \`sorted: { order: asc|desc, field? }\`, \`unique: { mode: whole|byField, fields? }\` |
+| objects | \`requiredKeys\`, \`forbiddenKeys\`, \`minProperties\`, \`maxProperties\`, \`strictSchema\` (no keys beyond requiredKeys) |
+
+\`format\`: ${SCENARIO_CONTRACT_FORMATS.join(", ")}.
+
+The server also refuses contradictions: min > max, minLength > maxLength, minItems > maxItems,
+greaterThan ≥ lessThan, a key both required and forbidden, \`unique.mode: "byField"\` without
+fields, an invalid regex.
+
+## Data-driven contract
+The request runs ONCE PER ROW; the row's values are \`{{data.<column>}}\` and each row checks its
+own expected status and field assertions (same rules as above).
+\`\`\`jsonc
+{
+  "columns": ["userId", "expected"],
+  "rows": [
+    { "data": { "userId": "1",   "expected": "Ann" }, "expectedStatus": 200,
+      "assertions": [{ "path": "name", "rules": { "equals": "Ann" } }] },
+    { "data": { "userId": "404", "expected": "" },    "expectedStatus": 404 }
+  ]
+}
+\`\`\`
+Put the \`{{data.<column>}}\` tokens into the request (url, query, headers, body) with
+\`update_request\` — \`set_data_contract\` warns about columns the request does not use yet.
+Limits: ${DATA_CONTRACT_LIMITS.columns} columns, ${DATA_CONTRACT_LIMITS.rows} rows, ${DATA_CONTRACT_LIMITS.assertions} assertions per row, ${DATA_CONTRACT_LIMITS.cell} characters per cell.
+
+## Contract checks vs pm.test
+Use contract rules for the SHAPE of a response (types, formats, required fields, ranges) —
+declarative, shown per field in reports. Use \`pm.test\` in \`postResponseScript\` for logic that
+needs code (cross-field checks, saving values with \`pm.environment.set\`).
+`;
+//# sourceMappingURL=contracts.js.map

package/dist/resources/docs/contracts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.js","sourceRoot":"","sources":["../../../src/resources/docs/contracts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAEzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA2Cf,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;UAqBxC,oBAAoB,CAAC,OAAO,aAAa,oBAAoB,CAAC,IAAI,UAAU,oBAAoB,CAAC,UAAU,wBAAwB,oBAAoB,CAAC,IAAI;;;;;;CAMrK,CAAC"}

package/dist/resources/docs/diagramSchema.d.ts

@@ -1,2 +1,2 @@
-export declare const DIAGRAM_SCHEMA_DOC = "# Diagrams (create_diagram, update_diagram, patch_diagram)\n\nA diagram is a **DiagramDocument** (schemaVersion 1): typed nodes with positions and sizes,\nedges between nodes, a title. You write the compact form below; the server assigns ids,\nsizes from the component catalog, edge styles from the semantic, and lays the nodes out.\n\n## Compact input\n```jsonc\n{\n  \"name\": \"Order platform\",             // library entry name\n  \"title\": \"Order platform \u2014 runtime view\",\n  \"nodes\": [\n    { \"id\": \"gw\",    \"type\": \"net.gateway\",   \"label\": \"API Gateway\" },\n    { \"id\": \"orders\",\"type\": \"net.service\",   \"label\": \"Orders service\", \"parent\": \"k8s\" },\n    { \"id\": \"k8s\",   \"type\": \"net.zone\",      \"label\": \"Kubernetes\" },      // a container\n    { \"id\": \"db\",    \"type\": \"db.postgres\",   \"label\": \"orders db\" },\n    { \"id\": \"bus\",   \"type\": \"mq.kafka\",      \"label\": \"events\" }\n  ],\n  \"edges\": [\n    { \"source\": \"gw\",     \"target\": \"orders\", \"label\": \"REST\",  \"semantic\": \"sync\" },\n    { \"source\": \"orders\", \"target\": \"db\",     \"semantic\": \"sync\" },\n    { \"source\": \"orders\", \"target\": \"bus\",    \"label\": \"OrderCreated\" }   // \u2192 bus automatically\n  ]\n}\n```\n\n- `type` MUST be a catalog type \u2014 read `callman://diagram/components` (or one category:\n  `callman://diagram/components/aws`). Unknown types are rejected with suggestions; pass\n  `strictTypes: false` to draw them as plain rectangles instead.\n- `parent` puts a node inside a container node (zones, frames, pools). Declare the\n  container as a node too.\n- Edge `semantic`: `sync` (solid \u2014 request/response, default), `async` (dashed \u2014 event,\n  callback), `fallback` (dotted \u2014 retry / optional path), `bus` (heavy \u2014 message bus /\n  stream; automatic when an endpoint is a messaging component).\n- Positions are optional; when any node lacks one the whole diagram is laid out\n  (`direction`: DOWN, RIGHT, UP, LEFT). Give explicit `position: {x,y}` only when the user\n  asks for a specific arrangement.\n- Keep diagrams readable: 8\u201325 nodes, labels of 1\u20133 words, one edge per relationship.\n\n## Editing: patch_diagram ops\n```jsonc\n{ \"op\": \"addNode\",    \"node\": { \"type\": \"db.redis\", \"label\": \"cache\" } }\n{ \"op\": \"updateNode\", \"id\": \"orders\", \"changes\": { \"label\": \"Orders API\" } }\n{ \"op\": \"removeNode\", \"id\": \"bus\" }                 // its edges are removed too\n{ \"op\": \"addEdge\",    \"edge\": { \"source\": \"orders\", \"target\": \"n6\", \"semantic\": \"async\" } }\n{ \"op\": \"updateEdge\", \"id\": \"e2\", \"changes\": { \"label\": \"gRPC\" } }\n{ \"op\": \"removeEdge\", \"id\": \"e3\" }\n{ \"op\": \"setTitle\",   \"title\": \"New title\" }\n```\n`relayout`: `new` (default \u2014 only new nodes get a place), `all` (re-run layout), `none`.\n\n## Stored document (get_diagram view: \"full\")\n```ts\ninterface DiagramDocument {\n  schemaVersion: 1; id: string;\n  meta: { title: string; createdAt: string; updatedAt: string };\n  canvas?: { background?: \"grid\" | \"dots\" | \"blank\"; gridSize?: number };\n  nodes: { id; type; position: {x,y}; size: {width,height}; label?; parentId?; style?; data? }[];\n  edges: { id; source?; target?; label?; routing?; style?; markerEnd?; waypoints? }[];\n}\n```\nEdge meaning is derived from `style` (dashed + dashPattern + strokeWidth) \u2014 you never set\nstyle directly; use `semantic`.\n";
+export declare const DIAGRAM_SCHEMA_DOC = "# Diagrams (create_diagram, update_diagram, patch_diagram)\n\nA diagram is a **DiagramDocument** (schemaVersion 1): typed nodes with positions and sizes,\nedges between nodes, a title. You write the compact form below; the server assigns ids,\nsizes from the component catalog, edge styles from the semantic, and lays the nodes out.\nEvery object is strict: a misspelled or unknown key is an error that names the valid keys,\nnever silently dropped.\n\n## Compact input\n```jsonc\n{\n  \"name\": \"Order platform\",             // library entry name\n  \"title\": \"Order platform \u2014 runtime view\",\n  \"nodes\": [\n    { \"id\": \"k8s\",   \"type\": \"frame\",           \"label\": \"Kubernetes\",      // a container\n      \"style\": { \"stroke\": \"#8B5CF6\", \"fill\": \"rgba(139,92,246,0.07)\", \"textColor\": \"#8B5CF6\", \"strokeWidth\": 2, \"bold\": true } },\n    { \"id\": \"gw\",    \"type\": \"net.api-gateway\", \"label\": \"API Gateway\" },\n    { \"id\": \"orders\",\"type\": \"net.service\",     \"label\": \"Orders service\", \"parent\": \"k8s\" },\n    { \"id\": \"db\",    \"type\": \"db.postgres\",     \"label\": \"orders db\" },\n    { \"id\": \"bus\",   \"type\": \"mq.kafka\",        \"label\": \"events\" }\n  ],\n  \"edges\": [\n    { \"source\": \"gw\",     \"target\": \"orders\", \"label\": \"REST\",  \"semantic\": \"sync\" },\n    { \"source\": \"orders\", \"target\": \"db\",     \"semantic\": \"sync\", \"color\": \"#10B981\" },\n    { \"source\": \"orders\", \"target\": \"bus\",    \"label\": \"OrderCreated\" }   // \u2192 bus automatically\n  ]\n}\n```\n\n## Nodes\n| Field | Type | Notes |\n| --- | --- | --- |\n| `id` | string | Stable id you reference from `parent` and edges; generated (n1, n2\u2026) when omitted |\n| `type` | string | MUST be a catalog type \u2014 `callman://diagram/components` (or one category: `callman://diagram/components/aws`). Unknown types are rejected with suggestions; `strictTypes: false` draws them as rectangles |\n| `label` | string | 1\u20133 words reads best |\n| `parent` | node id | Puts the node inside a container: `frame`, `pool.horizontal` or `pool.vertical` |\n| `position` | {x, y} | Top-left, relative to the parent container. Omit to auto-layout |\n| `size` | {width, height} | Defaults to the catalog size |\n| `style` | object | See **Styling** |\n| `rotation` | number | Degrees, clockwise |\n| `locked` / `hidden` | boolean | Locked nodes cannot be moved in the studio |\n| `data` | object | Free-form metadata kept with the node; not rendered |\n\n`line`, `arrow` and `line.dashed` are connectors in the studio's palette, not nodes \u2014 draw\nconnections as edges.\n\n## Edges\n| Field | Type | Notes |\n| --- | --- | --- |\n| `source`, `target` | node id | A container id is allowed |\n| `label` | string | |\n| `semantic` | sync \u00B7 async \u00B7 fallback \u00B7 bus | `sync` solid (request/response, default), `async` dashed (event, callback), `fallback` dotted (retry / optional path), `bus` heavy (message bus / stream \u2014 automatic when an end is a messaging component) |\n| `color` | CSS color | Line color, independent of the semantic |\n| `routing` | orthogonal \u00B7 straight \u00B7 curved | Default orthogonal (auto-routed right angles) |\n| `markerEnd` / `markerStart` | none \u00B7 classic \u00B7 classicThin \u00B7 open \u00B7 block \u00B7 diamond \u00B7 oval | Default: classicThin at the target, none at the source. Set `markerStart` for a two-way line |\n\nThe semantic owns the line pattern and width; there is no separate dash or width field on edges.\n\n## Styling (node `style`)\n| Key | Type | Notes |\n| --- | --- | --- |\n| `fill` | CSS color | Background. A translucent `rgba(r,g,b,0.07)` tints a container without hiding its children |\n| `stroke` | CSS color | Border |\n| `textColor` | CSS color | Label |\n| `strokeWidth` | number (px) | Border width |\n| `dashed` | boolean | Containers (frame) are dashed by default |\n| `dashPattern` | string | SVG dash array when dashed: `\"6 4\"` dashed, `\"1 3\"` dotted |\n| `radius` | number (px) | Corner radius (`rounded: true` for the default radius) |\n| `fontSize` | number (px) | |\n| `fontFamily` | string | |\n| `bold`, `italic`, `underline` | boolean | |\n| `align` | left \u00B7 center \u00B7 right | |\n| `verticalAlign` | top \u00B7 middle \u00B7 bottom | |\n| `shadow` | boolean | |\n| `opacity` | 0\u2013100 | |\n\nColors are CSS strings \u2014 `\"#3B82F6\"`, `\"rgb(59,130,246)\"`, `\"rgba(59,130,246,0.08)\"`, `\"tomato\"`.\nPick mid-tone colors: the studio has light and dark themes.\n\nColor-coding containers is the quickest way to make zones read at a glance:\n```jsonc\n{ \"op\": \"updateNode\", \"id\": \"k8s\", \"changes\": { \"style\": { \"stroke\": \"#8B5CF6\", \"fill\": \"rgba(139,92,246,0.07)\", \"textColor\": \"#8B5CF6\", \"strokeWidth\": 2, \"bold\": true } } }\n```\n\n## Layout\nPositions are optional; when any node lacks one the whole diagram is laid out\n(`direction`: DOWN, RIGHT, UP, LEFT). Give explicit `position: {x,y}` only when the user\nasks for a specific arrangement. Keep diagrams readable: 8\u201325 nodes, short labels, one edge\nper relationship.\n\n## Editing: patch_diagram ops\n```jsonc\n{ \"op\": \"addNode\",    \"node\": { \"type\": \"db.redis\", \"label\": \"cache\", \"parent\": \"k8s\" } }\n{ \"op\": \"updateNode\", \"id\": \"orders\", \"changes\": { \"label\": \"Orders API\", \"style\": { \"fill\": \"#EFF6FF\" } } }\n{ \"op\": \"updateNode\", \"id\": \"orders\", \"changes\": { \"style\": { \"fill\": null } } }   // remove one style key\n{ \"op\": \"updateNode\", \"id\": \"orders\", \"changes\": { \"style\": null } }                // clear the style\n{ \"op\": \"removeNode\", \"id\": \"bus\" }                 // its edges are removed, its children move to the top level\n{ \"op\": \"addEdge\",    \"edge\": { \"source\": \"orders\", \"target\": \"n6\", \"semantic\": \"async\", \"color\": \"#F59E0B\" } }\n{ \"op\": \"updateEdge\", \"id\": \"e2\", \"changes\": { \"label\": \"gRPC\", \"semantic\": \"fallback\" } }  // color is kept\n{ \"op\": \"updateEdge\", \"id\": \"e2\", \"changes\": { \"color\": null } }                  // back to the default color\n{ \"op\": \"removeEdge\", \"id\": \"e3\" }\n{ \"op\": \"setTitle\",   \"title\": \"New title\" }\n```\n- updateNode `changes` accepts: type, label, parent (null/\"\" = top level), position, size,\n  style, rotation, locked, hidden, data. `style` and `data` MERGE into what the node has;\n  a key set to null is removed.\n- updateEdge `changes` accepts: source, target, label (\"\" removes it), semantic, color,\n  routing, markerEnd, markerStart.\n- Moving a node (position, size or parent) or re-pointing an edge drops the saved route of\n  the edges involved; the studio re-routes them (`reroutedEdges` in the result).\n- `relayout`: `new` (default \u2014 only new nodes get a place), `all` (re-run layout), `none`.\n- `get_diagram` (view `graph`) returns nodes and edges in this same shape \u2014 ids, parents,\n  styles, colors \u2014 so read it before a patch.\n\n## Stored document (get_diagram view: \"full\")\n```ts\ninterface DiagramDocument {\n  schemaVersion: 1; id: string;\n  meta: { title: string; createdAt: string; updatedAt: string };\n  canvas?: { background?: \"grid\" | \"dots\" | \"blank\"; gridSize?: number };\n  nodes: { id; type; position: {x,y}; size: {width,height}; label?; parentId?; rotation?;\n           locked?; hidden?; style?: DiagramStyle; data? }[];\n  edges: { id; source?; target?; label?; routing?; style?: DiagramStyle; markerStart?; markerEnd?;\n           waypoints?; sourceAnchor?; targetAnchor? }[];\n}\n// Stored colors are { raw: \"#3B82F6\" } (or a theme { token }); bold/italic/underline are\n// the bitmask fontStyle (1 | 2 | 4). The tools convert both ways \u2014 write plain colors.\n```\nEdge meaning is derived from `style` (dashed + dashPattern + strokeWidth) \u2014 set it with\n`semantic`, never directly.\n";
 //# sourceMappingURL=diagramSchema.d.ts.map

package/dist/resources/docs/diagramSchema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"diagramSchema.d.ts","sourceRoot":"","sources":["../../../src/resources/docs/diagramSchema.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,kBAAkB,08GA+D9B,CAAC"}
+{"version":3,"file":"diagramSchema.d.ts","sourceRoot":"","sources":["../../../src/resources/docs/diagramSchema.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,kBAAkB,oyPAkI9B,CAAC"}

package/dist/resources/docs/diagramSchema.js

@@ -3,6 +3,8 @@ export const DIAGRAM_SCHEMA_DOC = `# Diagrams (create_diagram, update_diagram, p
 A diagram is a **DiagramDocument** (schemaVersion 1): typed nodes with positions and sizes,
 edges between nodes, a title. You write the compact form below; the server assigns ids,
 sizes from the component catalog, edge styles from the semantic, and lays the nodes out.
+Every object is strict: a misspelled or unknown key is an error that names the valid keys,
+never silently dropped.
 
 ## Compact input
 \`\`\`jsonc
@@ -10,44 +12,105 @@ sizes from the component catalog, edge styles from the semantic, and lays the no
   "name": "Order platform",             // library entry name
   "title": "Order platform — runtime view",
   "nodes": [
-    { "id": "gw",    "type": "net.gateway",   "label": "API Gateway" },
-    { "id": "orders","type": "net.service",   "label": "Orders service", "parent": "k8s" },
-    { "id": "k8s",   "type": "net.zone",      "label": "Kubernetes" },      // a container
-    { "id": "db",    "type": "db.postgres",   "label": "orders db" },
-    { "id": "bus",   "type": "mq.kafka",      "label": "events" }
+    { "id": "k8s",   "type": "frame",           "label": "Kubernetes",      // a container
+      "style": { "stroke": "#8B5CF6", "fill": "rgba(139,92,246,0.07)", "textColor": "#8B5CF6", "strokeWidth": 2, "bold": true } },
+    { "id": "gw",    "type": "net.api-gateway", "label": "API Gateway" },
+    { "id": "orders","type": "net.service",     "label": "Orders service", "parent": "k8s" },
+    { "id": "db",    "type": "db.postgres",     "label": "orders db" },
+    { "id": "bus",   "type": "mq.kafka",        "label": "events" }
   ],
   "edges": [
     { "source": "gw",     "target": "orders", "label": "REST",  "semantic": "sync" },
-    { "source": "orders", "target": "db",     "semantic": "sync" },
+    { "source": "orders", "target": "db",     "semantic": "sync", "color": "#10B981" },
     { "source": "orders", "target": "bus",    "label": "OrderCreated" }   // → bus automatically
   ]
 }
 \`\`\`
 
-- \`type\` MUST be a catalog type — read \`callman://diagram/components\` (or one category:
-  \`callman://diagram/components/aws\`). Unknown types are rejected with suggestions; pass
-  \`strictTypes: false\` to draw them as plain rectangles instead.
-- \`parent\` puts a node inside a container node (zones, frames, pools). Declare the
-  container as a node too.
-- Edge \`semantic\`: \`sync\` (solid — request/response, default), \`async\` (dashed — event,
-  callback), \`fallback\` (dotted — retry / optional path), \`bus\` (heavy — message bus /
-  stream; automatic when an endpoint is a messaging component).
-- Positions are optional; when any node lacks one the whole diagram is laid out
-  (\`direction\`: DOWN, RIGHT, UP, LEFT). Give explicit \`position: {x,y}\` only when the user
-  asks for a specific arrangement.
-- Keep diagrams readable: 8–25 nodes, labels of 1–3 words, one edge per relationship.
+## Nodes
+| Field | Type | Notes |
+| --- | --- | --- |
+| \`id\` | string | Stable id you reference from \`parent\` and edges; generated (n1, n2…) when omitted |
+| \`type\` | string | MUST be a catalog type — \`callman://diagram/components\` (or one category: \`callman://diagram/components/aws\`). Unknown types are rejected with suggestions; \`strictTypes: false\` draws them as rectangles |
+| \`label\` | string | 1–3 words reads best |
+| \`parent\` | node id | Puts the node inside a container: \`frame\`, \`pool.horizontal\` or \`pool.vertical\` |
+| \`position\` | {x, y} | Top-left, relative to the parent container. Omit to auto-layout |
+| \`size\` | {width, height} | Defaults to the catalog size |
+| \`style\` | object | See **Styling** |
+| \`rotation\` | number | Degrees, clockwise |
+| \`locked\` / \`hidden\` | boolean | Locked nodes cannot be moved in the studio |
+| \`data\` | object | Free-form metadata kept with the node; not rendered |
+
+\`line\`, \`arrow\` and \`line.dashed\` are connectors in the studio's palette, not nodes — draw
+connections as edges.
+
+## Edges
+| Field | Type | Notes |
+| --- | --- | --- |
+| \`source\`, \`target\` | node id | A container id is allowed |
+| \`label\` | string | |
+| \`semantic\` | sync · async · fallback · bus | \`sync\` solid (request/response, default), \`async\` dashed (event, callback), \`fallback\` dotted (retry / optional path), \`bus\` heavy (message bus / stream — automatic when an end is a messaging component) |
+| \`color\` | CSS color | Line color, independent of the semantic |
+| \`routing\` | orthogonal · straight · curved | Default orthogonal (auto-routed right angles) |
+| \`markerEnd\` / \`markerStart\` | none · classic · classicThin · open · block · diamond · oval | Default: classicThin at the target, none at the source. Set \`markerStart\` for a two-way line |
+
+The semantic owns the line pattern and width; there is no separate dash or width field on edges.
+
+## Styling (node \`style\`)
+| Key | Type | Notes |
+| --- | --- | --- |
+| \`fill\` | CSS color | Background. A translucent \`rgba(r,g,b,0.07)\` tints a container without hiding its children |
+| \`stroke\` | CSS color | Border |
+| \`textColor\` | CSS color | Label |
+| \`strokeWidth\` | number (px) | Border width |
+| \`dashed\` | boolean | Containers (frame) are dashed by default |
+| \`dashPattern\` | string | SVG dash array when dashed: \`"6 4"\` dashed, \`"1 3"\` dotted |
+| \`radius\` | number (px) | Corner radius (\`rounded: true\` for the default radius) |
+| \`fontSize\` | number (px) | |
+| \`fontFamily\` | string | |
+| \`bold\`, \`italic\`, \`underline\` | boolean | |
+| \`align\` | left · center · right | |
+| \`verticalAlign\` | top · middle · bottom | |
+| \`shadow\` | boolean | |
+| \`opacity\` | 0–100 | |
+
+Colors are CSS strings — \`"#3B82F6"\`, \`"rgb(59,130,246)"\`, \`"rgba(59,130,246,0.08)"\`, \`"tomato"\`.
+Pick mid-tone colors: the studio has light and dark themes.
+
+Color-coding containers is the quickest way to make zones read at a glance:
+\`\`\`jsonc
+{ "op": "updateNode", "id": "k8s", "changes": { "style": { "stroke": "#8B5CF6", "fill": "rgba(139,92,246,0.07)", "textColor": "#8B5CF6", "strokeWidth": 2, "bold": true } } }
+\`\`\`
+
+## Layout
+Positions are optional; when any node lacks one the whole diagram is laid out
+(\`direction\`: DOWN, RIGHT, UP, LEFT). Give explicit \`position: {x,y}\` only when the user
+asks for a specific arrangement. Keep diagrams readable: 8–25 nodes, short labels, one edge
+per relationship.
 
 ## Editing: patch_diagram ops
 \`\`\`jsonc
-{ "op": "addNode",    "node": { "type": "db.redis", "label": "cache" } }
-{ "op": "updateNode", "id": "orders", "changes": { "label": "Orders API" } }
-{ "op": "removeNode", "id": "bus" }                 // its edges are removed too
-{ "op": "addEdge",    "edge": { "source": "orders", "target": "n6", "semantic": "async" } }
-{ "op": "updateEdge", "id": "e2", "changes": { "label": "gRPC" } }
+{ "op": "addNode",    "node": { "type": "db.redis", "label": "cache", "parent": "k8s" } }
+{ "op": "updateNode", "id": "orders", "changes": { "label": "Orders API", "style": { "fill": "#EFF6FF" } } }
+{ "op": "updateNode", "id": "orders", "changes": { "style": { "fill": null } } }   // remove one style key
+{ "op": "updateNode", "id": "orders", "changes": { "style": null } }                // clear the style
+{ "op": "removeNode", "id": "bus" }                 // its edges are removed, its children move to the top level
+{ "op": "addEdge",    "edge": { "source": "orders", "target": "n6", "semantic": "async", "color": "#F59E0B" } }
+{ "op": "updateEdge", "id": "e2", "changes": { "label": "gRPC", "semantic": "fallback" } }  // color is kept
+{ "op": "updateEdge", "id": "e2", "changes": { "color": null } }                  // back to the default color
 { "op": "removeEdge", "id": "e3" }
 { "op": "setTitle",   "title": "New title" }
 \`\`\`
-\`relayout\`: \`new\` (default — only new nodes get a place), \`all\` (re-run layout), \`none\`.
+- updateNode \`changes\` accepts: type, label, parent (null/"" = top level), position, size,
+  style, rotation, locked, hidden, data. \`style\` and \`data\` MERGE into what the node has;
+  a key set to null is removed.
+- updateEdge \`changes\` accepts: source, target, label ("" removes it), semantic, color,
+  routing, markerEnd, markerStart.
+- Moving a node (position, size or parent) or re-pointing an edge drops the saved route of
+  the edges involved; the studio re-routes them (\`reroutedEdges\` in the result).
+- \`relayout\`: \`new\` (default — only new nodes get a place), \`all\` (re-run layout), \`none\`.
+- \`get_diagram\` (view \`graph\`) returns nodes and edges in this same shape — ids, parents,
+  styles, colors — so read it before a patch.
 
 ## Stored document (get_diagram view: "full")
 \`\`\`ts
@@ -55,11 +118,15 @@ interface DiagramDocument {
   schemaVersion: 1; id: string;
   meta: { title: string; createdAt: string; updatedAt: string };
   canvas?: { background?: "grid" | "dots" | "blank"; gridSize?: number };
-  nodes: { id; type; position: {x,y}; size: {width,height}; label?; parentId?; style?; data? }[];
-  edges: { id; source?; target?; label?; routing?; style?; markerEnd?; waypoints? }[];
+  nodes: { id; type; position: {x,y}; size: {width,height}; label?; parentId?; rotation?;
+           locked?; hidden?; style?: DiagramStyle; data? }[];
+  edges: { id; source?; target?; label?; routing?; style?: DiagramStyle; markerStart?; markerEnd?;
+           waypoints?; sourceAnchor?; targetAnchor? }[];
 }
+// Stored colors are { raw: "#3B82F6" } (or a theme { token }); bold/italic/underline are
+// the bitmask fontStyle (1 | 2 | 4). The tools convert both ways — write plain colors.
 \`\`\`
-Edge meaning is derived from \`style\` (dashed + dashPattern + strokeWidth) — you never set
-style directly; use \`semantic\`.
+Edge meaning is derived from \`style\` (dashed + dashPattern + strokeWidth) — set it with
+\`semantic\`, never directly.
 `;
 //# sourceMappingURL=diagramSchema.js.map

package/dist/resources/docs/diagramSchema.js.map

@@ -1 +1 @@
-{"version":3,"file":"diagramSchema.js","sourceRoot":"","sources":["../../../src/resources/docs/diagramSchema.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+DjC,CAAC"}
+{"version":3,"file":"diagramSchema.js","sourceRoot":"","sources":["../../../src/resources/docs/diagramSchema.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkIjC,CAAC"}

package/dist/resources/docs/overview.d.ts

@@ -1,2 +1,2 @@
-export declare const OVERVIEW_DOC = "# Working with Callman through MCP\n\nCallman is an API client and test platform (collections of HTTP requests, environments,\nmulti-step test scenarios, system-design diagrams). This server exposes it to you through\ntools; everything you do goes to the same server the Callman desktop app uses, as the user\nwhose token is configured, limited to that token's permissions and the user's workspace role.\n\n## Start here\n1. `whoami` \u2014 proves the connection and tells you the workspaces, features and which tools\n   this token can use. If several workspaces exist and none is default, pass `workspace`\n   to workspace-scoped tools (or ask the user which one).\n2. Look before you create: `list_collections` / `get_collection_tree` / `search_requests`.\n   Creating a collection whose name exists is refused on purpose.\n3. Names work as references everywhere an id does (collection, folder, request, environment,\n   scenario, diagram, workspace). Ambiguous names come back as a candidate list \u2014 pick one.\n4. Preview big writes with `dryRun: true` (bulk create, imports, scenarios, diagrams).\n5. Deletions need `confirm: true`. Ask the user unless they explicitly requested the deletion.\n\n## Requests\n- Use `{{variable}}` for hosts and secrets (`{{baseUrl}}/users`) and put the values in an\n  environment (`create_environment` / `set_environment_variables`). Use `:id` for path\n  variables. See `callman://docs/request-schema`.\n- Bodies: a JSON value, a raw string, or `{ mode: raw|formdata|urlencoded }`.\n- Scripts run in a sandbox with the `pm.*` API \u2014 `callman://docs/scripting/pm-api`.\n- `run_request` / `run_collection` execute on the user's machine with real variable values;\n  you only get results and the names of variables scripts changed.\n\n## Secrets\nEnvironment values come back masked (`\u2022\u2022\u2022\u2022ab`) unless the token holds `environments:reveal`\nand you ask for `reveal: true`. Never write a masked value back \u2014 the server refuses it.\n\n## Scenarios\nMulti-step flows as a graph of typed nodes (request, condition, assertion, set-vars, poll,\ndb, kafka, script, wait, end \u2026). Read `callman://docs/scenario-nodes` before building one;\npartial node configs are merged over defaults. Runs happen on the server (`run_scenario`).\n\n## Diagrams\nSystem-design diagrams use a fixed component catalog \u2014 `callman://diagram/components`.\nBuild with `create_diagram` (auto layout), edit with `patch_diagram`, share with\n`share_diagram`. See `callman://docs/diagram-schema`.\n\n## After writing\nThe desktop app refreshes when the user switches back to it. Tell the user what you created\nand where (collection / folder names).\n";
+export declare const OVERVIEW_DOC = "# Working with Callman through MCP\n\nCallman is an API client and test platform (collections of HTTP requests, environments,\nmulti-step test scenarios, system-design diagrams). This server exposes it to you through\ntools; everything you do goes to the same server the Callman desktop app uses, as the user\nwhose token is configured, limited to that token's permissions and the user's workspace role.\n\n## Start here\n1. `whoami` \u2014 proves the connection and tells you the workspaces, features and which tools\n   this token can use.\n2. Look before you create: `list_collections` / `get_collection_tree` / `search_requests`.\n   Creating a collection whose name exists is refused on purpose.\n3. Arguments are strict: a misspelled or unknown argument is an error that lists the valid\n   ones \u2014 read it and retry; nothing is silently ignored.\n4. Names work as references everywhere an id does (collection, folder, request, environment,\n   scenario, diagram, workspace). Ambiguous names come back as a candidate list \u2014 pick one.\n5. Preview big writes with `dryRun: true` (bulk create, imports, scenarios, diagrams).\n6. Deletions need `confirm: true` and an exact name or id. Ask the user unless they explicitly\n   requested the deletion.\n\n## Workspaces\nThe token works in EVERY workspace the user belongs to (with their role in each):\n- Lists and searches (`list_collections`, `search_requests`, `list_environments`,\n  `list_connections`, `list_scenarios`) cover all workspaces unless you pass `workspace`;\n  every row says which workspace it is in.\n- A name (collection, request, environment) is looked up in the default workspace first, then\n  in all others; a unique match anywhere is used and the result says where it was found. The\n  same name in several workspaces comes back as candidates tagged with their workspace \u2014 pass\n  `workspace` or the id.\n- Creating needs one target: `workspace`, or the collection it goes into, or the session\n  default. `use_workspace` changes the default for the session (it never hides the others).\n- Environments, connections and global variables belong to one workspace: a request uses the\n  ones of its own workspace.\n\n## Requests\n- Use `{{variable}}` for hosts and secrets (`{{baseUrl}}/users`) and put the values in an\n  environment (`create_environment` / `set_environment_variables`). Use `:id` for path\n  variables. See `callman://docs/request-schema`.\n- get_request returns a request in the same shape create/update take \u2014 read, change, send back.\n- Bodies: a JSON value, a raw string, or `{ mode: raw|formdata|urlencoded|json }`.\n- Database / Kafka / Redis steps and DB assertions are request fields; connections are\n  referenced by id or name (`list_connections`).\n- Contract checks (field rules, data-driven rows) \u2014 `callman://docs/contracts`.\n- Scripts run in a sandbox with the `pm.*` API \u2014 `callman://docs/scripting/pm-api`.\n- `run_request` / `run_collection` execute on the user's machine with real variable values;\n  you only get results and the names of variables scripts changed.\n\n## Secrets\nEnvironment values come back masked (`\u2022\u2022\u2022\u2022ab`) unless the token holds `environments:reveal`\nand you ask for `reveal: true`. Never write a masked environment value back \u2014 it is refused.\nRequest auth secrets and sensitive headers are masked the same way; sending a masked request\nsecret back UNCHANGED keeps the stored one, anything else masked is refused.\n\n## Scenarios\nMulti-step flows as a graph of typed nodes (request, condition, assertion, set-vars, poll,\ndb, kafka, script, wait, end \u2026). Read `callman://docs/scenario-nodes` before building one;\npartial node configs are merged over defaults. Runs happen on the server (`run_scenario`).\n\n## Diagrams\nSystem-design diagrams use a fixed component catalog \u2014 `callman://diagram/components`.\nBuild with `create_diagram` (auto layout), edit with `patch_diagram`, share with\n`share_diagram`. See `callman://docs/diagram-schema`.\n\n## After writing\nThe desktop app refreshes when the user switches back to it. Tell the user what you created\nand where (collection / folder names).\n";
 //# sourceMappingURL=overview.d.ts.map

package/dist/resources/docs/overview.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"overview.d.ts","sourceRoot":"","sources":["../../../src/resources/docs/overview.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,YAAY,4oFA4CxB,CAAC"}
+{"version":3,"file":"overview.d.ts","sourceRoot":"","sources":["../../../src/resources/docs/overview.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,YAAY,8mIAkExB,CAAC"}