callman-mcp 0.1.0 → 0.2.0

package/dist-cjs/domain/requestShape.js

@@ -1,10 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.requestSummaryView = exports.compactRequestView = exports.toUpdateRequestPayload = exports.updateRequestInputSchema = exports.toFlatImportRequest = exports.toCreateRequestPayload = exports.toBodyPayload = exports.toAuthPayload = exports.toRows = exports.requestInputSchema = exports.authInputSchema = exports.bodyInputSchema = exports.kvSchema = exports.HTTP_METHODS = void 0;
+exports.requestSummaryView = exports.compactRequestView = exports.bodyInputView = exports.toUpdateRequestPayload = exports.updateRequestInputSchema = exports.toFlatImportRequest = exports.toCreateRequestPayload = exports.resolveMaskedValues = exports.authInputView = exports.toAuthPayload = exports.sanitizedKeyWarnings = exports.toBodyPayload = exports.syncUrlAndQuery = exports.buildUrlWithQueryRows = exports.toRows = exports.requestInputSchema = exports.authInputSchema = exports.bodyInputSchema = exports.pathVariableSchema = exports.kvSchema = exports.HTTP_METHODS = void 0;
 const callman_core_1 = require("callman-core");
 const zod_1 = require("zod");
+const errors_js_1 = require("../client/errors.js");
 const mask_js_1 = require("../lib/mask.js");
+const strict_js_1 = require("../lib/strict.js");
 const truncate_js_1 = require("../lib/truncate.js");
+const requestIntegrations_js_1 = require("./requestIntegrations.js");
 // The COMPACT request form a model writes (name/method/url, key-value lists,
 // a body that may be a JSON value, a string or a mode object, a small auth
 // object) and its translation into the backend's `POST /requests` payload —
@@ -12,76 +15,205 @@ const truncate_js_1 = require("../lib/truncate.js");
 // serialisation (`toPersistedRequestBody`) so an imported request opens in
 // the editor exactly like a hand-made one.
 exports.HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS", "TRACE"];
-exports.kvSchema = zod_1.z.object({
-    key: zod_1.z.string().max(100),
+// Key/value rows — the backend's own limits (key 1–100 chars, value ≤ 5000),
+// strict so a stray `description` or `type` is an error, not a silent drop.
+exports.kvSchema = (0, strict_js_1.strictObject)({
+    key: zod_1.z.string().trim().min(1).max(100),
     value: zod_1.z.string().max(5000).default(""),
-    enabled: zod_1.z.boolean().optional(),
-    description: zod_1.z.string().max(500).optional(),
-});
-exports.bodyInputSchema = zod_1.z.union([
-    zod_1.z.object({
-        mode: zod_1.z.literal("raw"),
-        raw: zod_1.z.string().max(2_000_000),
-        language: zod_1.z.enum(["json", "xml", "text", "html"]).optional(),
-    }),
-    zod_1.z.object({
-        mode: zod_1.z.enum(["formdata", "urlencoded"]),
-        entries: zod_1.z.array(exports.kvSchema).max(200),
-    }),
-    zod_1.z.object({ mode: zod_1.z.literal("none") }),
-    zod_1.z.unknown(),
-]);
+    enabled: zod_1.z.boolean().optional().describe("false keeps the row but does not send it (default true)"),
+}, "row field");
+exports.pathVariableSchema = (0, strict_js_1.strictObject)({
+    key: zod_1.z.string().trim().min(1).max(100).describe("The name after ':' in the URL, without the colon"),
+    value: zod_1.z.string().max(5000).default(""),
+    description: zod_1.z.string().max(5000).optional(),
+}, "path variable field");
+const RAW_LANGUAGES = ["json", "xml", "text", "html"];
+const rawBodySchema = (0, strict_js_1.strictObject)({
+    mode: zod_1.z.literal("raw"),
+    raw: zod_1.z.string().max(2_000_000).describe("The body text; {{variables}} are resolved when it runs"),
+    language: zod_1.z.enum(RAW_LANGUAGES).optional().describe("Editor language and default Content-Type; sniffed from the text when omitted"),
+    rawLanguage: zod_1.z.enum(RAW_LANGUAGES).optional().describe("Same as language (the stored name)"),
+}, "raw body field");
+const formBodySchema = (0, strict_js_1.strictObject)({
+    mode: zod_1.z.enum(["formdata", "urlencoded"]),
+    entries: zod_1.z.array(exports.kvSchema).max(200).optional().describe("Text fields; file parts cannot be set through the API"),
+    formEntries: zod_1.z.array(zod_1.z.object({ key: zod_1.z.string(), value: zod_1.z.string().default(""), enabled: zod_1.z.boolean().optional() }).passthrough()).max(200).optional().describe("Same as entries (the stored name)"),
+}, "form body field");
+const jsonBodySchema = (0, strict_js_1.strictObject)({ mode: zod_1.z.literal("json"), json: zod_1.z.unknown().describe("Any JSON value — use this form when the payload itself has a top-level `mode` key") }, "json body field");
+const noneBodySchema = (0, strict_js_1.strictObject)({ mode: zod_1.z.literal("none") }, "body field");
+const BODY_MODES = ["raw", "formdata", "urlencoded", "json", "none"];
+exports.bodyInputSchema = zod_1.z
+    .union([
+    zod_1.z.string().max(2_000_000),
+    rawBodySchema,
+    formBodySchema,
+    jsonBodySchema,
+    noneBodySchema,
+    zod_1.z.array(zod_1.z.unknown()),
+    zod_1.z.number(),
+    zod_1.z.boolean(),
+    zod_1.z.record(zod_1.z.unknown()).refine((value) => !("mode" in value), { message: `A body object with a "mode" key must be one of the modes ${BODY_MODES.join(", ")}` }),
+], {
+    errorMap: (issue, ctx) => issue.code === zod_1.z.ZodIssueCode.invalid_union
+        ? {
+            message: `Invalid body. Send a JSON value (object/array), a string, or { mode: "raw", raw, language? } | { mode: "formdata"|"urlencoded", entries: [{ key, value }] } | { mode: "json", json } | { mode: "none" }.`,
+        }
+        : { message: ctx.defaultError },
+})
+    .describe('A JSON object/array (sent as JSON); a string (JSON is parsed, <xml>/<html> sniffed, otherwise text); { mode: "raw", raw, language: json|xml|text|html }; { mode: "formdata"|"urlencoded", entries: [{ key, value }] }; { mode: "json", json } when the payload itself has a top-level "mode" key; { mode: "none" }.');
+const secret = (what) => zod_1.z.string().max(10_000).describe(`${what}. {{variable}} references are fine`);
 exports.authInputSchema = zod_1.z.discriminatedUnion("type", [
-    zod_1.z.object({ type: zod_1.z.literal("none") }),
-    zod_1.z.object({ type: zod_1.z.literal("bearer"), token: zod_1.z.string().max(10_000) }),
-    zod_1.z.object({ type: zod_1.z.literal("basic"), username: zod_1.z.string().max(5000), password: zod_1.z.string().max(5000).default("") }),
-    zod_1.z.object({
+    (0, strict_js_1.strictObject)({ type: zod_1.z.literal("none") }, "auth field"),
+    (0, strict_js_1.strictObject)({ type: zod_1.z.literal("bearer"), token: secret("Bearer token") }, "bearer auth field"),
+    (0, strict_js_1.strictObject)({ type: zod_1.z.literal("basic"), username: zod_1.z.string().max(5000), password: zod_1.z.string().max(5000).default("") }, "basic auth field"),
+    (0, strict_js_1.strictObject)({
         type: zod_1.z.literal("apiKey"),
-        key: zod_1.z.string().max(5000),
-        value: zod_1.z.string().max(10_000),
+        key: zod_1.z.string().max(5000).describe("Header or query parameter name, e.g. X-API-Key"),
+        value: secret("API key"),
         location: zod_1.z.enum(["header", "query"]).default("header"),
-    }),
-    zod_1.z.object({
+    }, "apiKey auth field"),
+    (0, strict_js_1.strictObject)({
         type: zod_1.z.literal("oauth2"),
         grantType: zod_1.z.enum(["client_credentials", "password", "refresh_token"]).default("client_credentials"),
         tokenUrl: zod_1.z.string().max(4096),
         clientId: zod_1.z.string().max(5000).default(""),
         clientSecret: zod_1.z.string().max(10_000).default(""),
         scope: zod_1.z.string().max(5000).default(""),
-        username: zod_1.z.string().max(5000).default(""),
-        password: zod_1.z.string().max(5000).default(""),
-        refreshToken: zod_1.z.string().max(10_000).default(""),
-        clientAuth: zod_1.z.enum(["basic", "body"]).default("body"),
+        username: zod_1.z.string().max(5000).default("").describe("password grant"),
+        password: zod_1.z.string().max(5000).default("").describe("password grant"),
+        refreshToken: zod_1.z.string().max(10_000).default("").describe("refresh_token grant"),
+        clientAuth: zod_1.z.enum(["basic", "body"]).default("body").describe("Send client credentials as a Basic header or in the form body"),
         audience: zod_1.z.string().max(4096).default(""),
-    }),
+    }, "oauth2 auth field"),
 ]);
-exports.requestInputSchema = zod_1.z.object({
-    name: zod_1.z.string().min(1).max(truncate_js_1.LIMITS.NAME).describe("Display name, e.g. \"GET /users\" or \"Login\""),
+exports.requestInputSchema = (0, strict_js_1.strictObject)({
+    name: zod_1.z.string().trim().min(1).max(truncate_js_1.LIMITS.NAME).describe("Display name, e.g. \"GET /users\" or \"Login\""),
     method: zod_1.z.enum(exports.HTTP_METHODS),
     url: zod_1.z
         .string()
+        .trim()
         .min(1)
         .max(4096)
-        .describe("Full URL; use {{variable}} for hosts/tokens (e.g. {{baseUrl}}/users/:id) and :name for path variables"),
+        .describe("Full URL; use {{variable}} for hosts/tokens (e.g. {{baseUrl}}/users/:id) and :name for path variables. A ?query in the URL becomes `query` rows (they are the same thing — runs send the rows)"),
     headers: zod_1.z.array(exports.kvSchema).max(200).optional(),
-    query: zod_1.z.array(exports.kvSchema).max(200).optional(),
-    pathVariables: zod_1.z.array(exports.kvSchema).max(200).optional().describe("Values for :name segments in the URL"),
-    body: exports.bodyInputSchema
-        .optional()
-        .describe("A JSON value (stored as JSON), a string (JSON is parsed, otherwise raw text/xml/html by sniffing), or { mode: \"raw\" | \"formdata\" | \"urlencoded\" | \"none\", … }"),
+    query: zod_1.z.array(exports.kvSchema).max(200).optional().describe("Query parameters; when omitted they are taken from the URL's ?query"),
+    pathVariables: zod_1.z.array(exports.pathVariableSchema).max(200).optional().describe("Values for :name segments in the URL"),
+    body: exports.bodyInputSchema.optional(),
     auth: exports.authInputSchema.optional(),
-    preRequestScript: zod_1.z.string().max(100_000).optional(),
-    postResponseScript: zod_1.z.string().max(100_000).optional().describe("pm.* script run after the response (tests, pm.environment.set …)"),
-    testsScript: zod_1.z.string().max(100_000).optional(),
-    folder: zod_1.z.string().max(200).optional().describe("Folder id, name or path (\"Auth/Login\") inside the collection"),
-    folderKey: zod_1.z.string().max(120).optional().describe("Bulk create only: key of a folder declared in `folders`"),
-    isEnabledInRunner: zod_1.z.boolean().optional(),
-});
+    preRequestScript: zod_1.z.string().max(100_000).optional().describe("pm.* script run before the request (callman://docs/scripting/pm-api)"),
+    postResponseScript: zod_1.z.string().max(100_000).optional().describe("pm.* script run after the response (pm.test, pm.environment.set …)"),
+    testsScript: zod_1.z.string().max(100_000).optional().describe("pm.test(...) assertions run after the response"),
+    folder: zod_1.z.string().max(300).optional().describe("Folder id, name or path (\"Auth/Login\") inside the collection"),
+    folderKey: zod_1.z.string().max(120).optional().describe("create_requests_bulk with collectionName only: key of a folder declared in `folders`"),
+    isEnabledInRunner: zod_1.z.boolean().optional().describe("false = skipped by collection runs (run_collection, the desktop runner, the CLI); default true"),
+    ...requestIntegrations_js_1.requestIntegrationFields,
+}, "request field");
 const toRows = (entries) => (entries ?? [])
     .filter((entry) => entry.key.trim().length > 0)
-    .map((entry) => ({ key: entry.key.trim(), value: entry.value ?? "", enabled: entry.enabled ?? true }))
-    .slice(0, 200);
+    .map((entry) => ({ key: entry.key.trim(), value: entry.value ?? "", enabled: entry.enabled ?? true }));
 exports.toRows = toRows;
+const toPathVariables = (entries) => entries.map((entry) => ({ key: entry.key.trim().replace(/^:/, ""), value: entry.value ?? "", description: entry.description ?? "" }));
+// ── URL ⇄ query rows ───────────────────────────────────────────────────
+// The desktop keeps the URL's ?query and the query rows in sync
+// (request-editor/lib/urlSync.ts), and every runner sends the ROWS — the run
+// bundle strips the URL query. So a query typed into `url` becomes rows, and
+// the stored URL mirrors the enabled rows exactly like the editor does.
+const splitHash = (url) => {
+    const index = url.indexOf("#");
+    return index === -1 ? { withoutHash: url, hash: "" } : { withoutHash: url.slice(0, index), hash: url.slice(index) };
+};
+const buildUrlWithQueryRows = (url, rows) => {
+    const { withoutHash, hash } = splitHash(url);
+    const base = (0, callman_core_1.stripUrlQuery)(withoutHash);
+    const enabled = rows.filter((row) => row.enabled !== false && row.key.trim());
+    return enabled.length === 0 ? `${base}${hash}` : `${base}?${enabled.map((row) => `${row.key}=${row.value}`).join("&")}${hash}`;
+};
+exports.buildUrlWithQueryRows = buildUrlWithQueryRows;
+const syncUrlAndQuery = (url, query) => {
+    const fromUrl = (0, callman_core_1.extractUrlQueryPairs)(url).map((pair) => ({ key: pair.key, value: pair.value, enabled: true }));
+    if (query === undefined)
+        return { url: (0, exports.buildUrlWithQueryRows)(url, fromUrl), query: fromUrl, warnings: [] };
+    const rows = (0, exports.toRows)(query);
+    const dropped = fromUrl.filter((pair) => !rows.some((row) => row.key === pair.key));
+    return {
+        url: (0, exports.buildUrlWithQueryRows)(url, rows),
+        query: rows,
+        warnings: dropped.length > 0 ? [`The URL's query parameter(s) ${dropped.map((pair) => pair.key).join(", ")} were replaced by the \`query\` rows you passed — add them to \`query\` to keep them.`] : [],
+    };
+};
+exports.syncUrlAndQuery = syncUrlAndQuery;
+// ── body ───────────────────────────────────────────────────────────────
+const isModeObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && typeof value.mode === "string";
+// Persisted body — the exact rules of the desktop editor's serializeBodyState
+// (guarded in the desktop by persistedBody.drift.test.ts): JSON stays a bare
+// JSON value; raw xml/text/html persists as { mode, raw, rawLanguage };
+// form bodies keep their entries; empty → null.
+const toBodyPayload = (body, headers) => {
+    if (body === undefined || body === null)
+        return null;
+    if (typeof body === "string") {
+        if (isClipped(body))
+            throw clippedError("body");
+        return (0, callman_core_1.toPersistedRequestBody)((0, callman_core_1.inferBodyStateFromRaw)(body, headers));
+    }
+    if (isModeObject(body)) {
+        const record = body;
+        if (record.mode === "none")
+            return null;
+        if (record.mode === "json")
+            return (record.json ?? null);
+        if (record.mode === "raw") {
+            const raw = typeof record.raw === "string" ? record.raw : "";
+            if (isClipped(raw))
+                throw clippedError("body.raw");
+            const language = (record.language ?? record.rawLanguage);
+            if (language)
+                return (0, callman_core_1.toPersistedRequestBody)({ mode: "raw", raw, rawLanguage: language, formEntries: [] });
+            return (0, callman_core_1.toPersistedRequestBody)((0, callman_core_1.inferBodyStateFromRaw)(raw, headers));
+        }
+        if (record.mode === "formdata" || record.mode === "urlencoded") {
+            const persisted = Array.isArray(record.formEntries) ? record.formEntries : null;
+            if (persisted?.some((entry) => entry.type === "file")) {
+                throw new errors_js_1.ToolInputError("FORM_FILE_UNSUPPORTED", "File parts of a form body cannot be set through the API — keep them in the desktop app, or send text fields only.");
+            }
+            const entries = persisted
+                ? persisted.map((entry) => ({ key: String(entry.key ?? ""), value: String(entry.value ?? ""), enabled: entry.enabled !== false }))
+                : (record.entries ?? []);
+            return (0, callman_core_1.toPersistedRequestBody)({ mode: record.mode, raw: "", formEntries: (0, exports.toRows)(entries) });
+        }
+    }
+    // Any other JSON value is stored as-is (the editor shows it on the JSON tab).
+    return body;
+};
+exports.toBodyPayload = toBodyPayload;
+// Previews end in "…" (lib/truncate) — writing one back would store the cut.
+const isClipped = (text) => text.endsWith("…") && text.length >= truncate_js_1.LIMITS.BODY_PREVIEW;
+const clippedError = (field) => new errors_js_1.ToolInputError("CLIPPED_VALUE", `${field} looks like a clipped preview (ends with "…"). Read it with get_request full: true, or pass the complete value.`);
+// The backend (express-mongo-sanitize) rewrites JSON keys that start with "$"
+// or contain "." on ordinary writes — { "$schema": … } is stored as "_schema".
+const sanitizedKeyWarnings = (body) => {
+    const found = new Set();
+    const walk = (value, depth) => {
+        if (depth > 20 || found.size >= 10 || value === null || typeof value !== "object")
+            return;
+        if (Array.isArray(value)) {
+            for (const item of value)
+                walk(item, depth + 1);
+            return;
+        }
+        for (const [key, child] of Object.entries(value)) {
+            if (key.startsWith("$") || key.includes("."))
+                found.add(key);
+            walk(child, depth + 1);
+        }
+    };
+    walk(body, 0);
+    return found.size > 0
+        ? [`The server rewrites JSON keys that start with "$" or contain "." (${[...found].join(", ")} → "_"). Keep such payloads as a raw string body ({ mode: "raw", raw: "…", language: "json" }).`]
+        : [];
+};
+exports.sanitizedKeyWarnings = sanitizedKeyWarnings;
+// ── auth ───────────────────────────────────────────────────────────────
 const EMPTY_AUTH = {
     type: "none",
     bearerToken: "",
@@ -110,89 +242,145 @@ const toAuthPayload = (auth) => {
     }
 };
 exports.toAuthPayload = toAuthPayload;
-const isModeObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && typeof value.mode === "string";
-// Persisted body — the exact rules of the desktop editor's serializeBodyState
-// (guarded in the desktop by persistedBody.drift.test.ts): JSON stays a bare
-// JSON value; raw xml/text/html persists as { mode, raw, rawLanguage };
-// form bodies keep their entries; empty → null.
-const toBodyPayload = (body, headers) => {
-    if (body === undefined || body === null)
-        return null;
-    if (typeof body === "string") {
-        return (0, callman_core_1.toPersistedRequestBody)((0, callman_core_1.inferBodyStateFromRaw)(body, headers));
-    }
-    if (isModeObject(body)) {
-        const record = body;
-        if (record.mode === "none")
-            return null;
-        if (record.mode === "raw") {
-            const raw = typeof record.raw === "string" ? record.raw : "";
-            const language = record.language;
-            if (language) {
-                return (0, callman_core_1.toPersistedRequestBody)({ mode: "raw", raw, rawLanguage: language, formEntries: [] });
-            }
-            return (0, callman_core_1.toPersistedRequestBody)((0, callman_core_1.inferBodyStateFromRaw)(raw, headers));
+// Stored auth → the SAME shape authInputSchema accepts, so a read can be
+// written straight back. Secrets are masked unless `reveal`.
+const authInputView = (auth, reveal = false) => {
+    const hide = (value) => (value ? (reveal ? value : (0, mask_js_1.maskSecret)(value)) : "");
+    switch (auth?.type) {
+        case "bearer":
+            return { type: "bearer", token: hide(auth.bearerToken) };
+        case "basic":
+            return { type: "basic", username: auth.basicUsername ?? "", password: hide(auth.basicPassword) };
+        case "apikey":
+            return { type: "apiKey", key: auth.apiKeyKey ?? "", value: hide(auth.apiKeyValue), location: auth.apiKeyLocation ?? "header" };
+        case "oauth2": {
+            const oauth2 = (auth.oauth2 ?? {});
+            return {
+                type: "oauth2",
+                grantType: oauth2.grantType ?? "client_credentials",
+                tokenUrl: oauth2.tokenUrl ?? "",
+                clientId: oauth2.clientId ?? "",
+                clientSecret: hide(oauth2.clientSecret),
+                scope: oauth2.scope ?? "",
+                username: oauth2.username ?? "",
+                password: hide(oauth2.password),
+                refreshToken: hide(oauth2.refreshToken),
+                clientAuth: oauth2.clientAuth ?? "body",
+                audience: oauth2.audience ?? "",
+            };
         }
-        if (record.mode === "formdata" || record.mode === "urlencoded") {
-            const entries = Array.isArray(record.entries) ? record.entries : [];
-            return (0, callman_core_1.toPersistedRequestBody)({ mode: record.mode, raw: "", formEntries: (0, exports.toRows)(entries) });
+        default:
+            return { type: "none" };
+    }
+};
+exports.authInputView = authInputView;
+// ── masked values ──────────────────────────────────────────────────────
+// get_request shows secrets as ••••ab. Writing that back would store the
+// dots as the credential. On update a masked value that matches the stored
+// secret's mask means "keep the stored value"; anything else masked is refused.
+const resolveMaskedValues = (item, current) => {
+    const problems = [];
+    const restoreRows = (field, rows) => rows?.map((row) => {
+        if (!(0, mask_js_1.isMasked)(row.value))
+            return row;
+        const stored = current?.[field]?.find((entry) => entry.key.toLowerCase() === row.key.toLowerCase());
+        if (stored && field === "headers" && (0, mask_js_1.maskHeaderValue)(stored.key, stored.value) === row.value)
+            return { ...row, value: stored.value };
+        problems.push(`${field}.${row.key}`);
+        return row;
+    });
+    const out = { ...item, headers: restoreRows("headers", item.headers), query: restoreRows("query", item.query) };
+    if (item.headers === undefined)
+        delete out.headers;
+    if (item.query === undefined)
+        delete out.query;
+    for (const entry of item.pathVariables ?? [])
+        if ((0, mask_js_1.isMasked)(entry.value))
+            problems.push(`pathVariables.${entry.key}`);
+    if (item.auth) {
+        const storedView = (0, exports.authInputView)(current?.auth, true);
+        const auth = { ...item.auth };
+        for (const [key, value] of Object.entries(auth)) {
+            if (!(0, mask_js_1.isMasked)(value))
+                continue;
+            const stored = storedView.type === auth.type ? storedView[key] : undefined;
+            if (typeof stored === "string" && stored && (0, mask_js_1.maskSecret)(stored) === value)
+                auth[key] = stored;
+            else
+                problems.push(`auth.${key}`);
         }
+        out.auth = auth;
     }
-    // Any other JSON value is stored as-is (the editor shows it on the JSON tab).
-    return body;
+    if (problems.length > 0) {
+        throw new errors_js_1.ToolInputError("MASKED_VALUE", `Masked values (••••) cannot be saved: ${problems.join(", ")}. Pass the real value or a {{variable}}, or leave the field out to keep what is stored (get_request reveal: true shows it).`, { fields: problems });
+    }
+    return out;
 };
-exports.toBodyPayload = toBodyPayload;
-const toCreateRequestPayload = (item, target) => {
+exports.resolveMaskedValues = resolveMaskedValues;
+const noConnections = (_ref, _type, where) => {
+    throw new errors_js_1.ToolInputError("CONNECTIONS_UNAVAILABLE", `${where}: connections were not loaded for this call.`);
+};
+const toCreateRequestPayload = (item, target, resolve = noConnections) => {
     const headers = (0, exports.toRows)(item.headers);
+    const { url, query, warnings } = (0, exports.syncUrlAndQuery)(item.url.trim(), item.query);
+    const body = (0, exports.toBodyPayload)(item.body, headers);
     return {
-        name: item.name.trim().slice(0, truncate_js_1.LIMITS.NAME),
-        method: item.method,
-        url: item.url.trim(),
-        headers,
-        query: (0, exports.toRows)(item.query),
-        pathVariables: (item.pathVariables ?? [])
-            .filter((entry) => entry.key.trim())
-            .map((entry) => ({ key: entry.key.trim(), value: entry.value ?? "", description: entry.description ?? "" })),
-        body: (0, exports.toBodyPayload)(item.body, headers),
-        auth: (0, exports.toAuthPayload)(item.auth),
-        preRequestScript: item.preRequestScript ?? "",
-        postResponseScript: item.postResponseScript ?? "",
-        testsScript: item.testsScript ?? "",
-        collectionId: target.collectionId,
-        folderId: target.folderId,
+        payload: {
+            name: item.name.trim().slice(0, truncate_js_1.LIMITS.NAME),
+            method: item.method,
+            url,
+            headers,
+            query,
+            pathVariables: toPathVariables(item.pathVariables ?? []),
+            body,
+            auth: (0, exports.toAuthPayload)(item.auth),
+            preRequestScript: item.preRequestScript ?? "",
+            postResponseScript: item.postResponseScript ?? "",
+            testsScript: item.testsScript ?? "",
+            ...((0, requestIntegrations_js_1.hasIntegrations)(item) ? (0, requestIntegrations_js_1.toIntegrationPayload)(item, resolve) : {}),
+            collectionId: target.collectionId,
+            folderId: target.folderId,
+        },
+        warnings: [...warnings, ...(0, exports.sanitizedKeyWarnings)(body)],
     };
 };
 exports.toCreateRequestPayload = toCreateRequestPayload;
 // `format: "requests"` bulk import row — same document minus the ids the
-// server assigns, plus the payload-local folderKey.
-const toFlatImportRequest = (item) => {
-    const { collectionId: _c, folderId: _f, ...payload } = (0, exports.toCreateRequestPayload)(item, { collectionId: "", folderId: null });
+// server assigns, plus the payload-local folderKey. The import route is not
+// key-sanitized, so no "$" warning here.
+const toFlatImportRequest = (item, resolve = noConnections) => {
+    const { collectionId: _c, folderId: _f, ...payload } = (0, exports.toCreateRequestPayload)(item, { collectionId: "", folderId: null }, resolve).payload;
     return { ...payload, ...(item.folderKey ? { folderKey: item.folderKey } : {}) };
 };
 exports.toFlatImportRequest = toFlatImportRequest;
-exports.updateRequestInputSchema = exports.requestInputSchema
-    .partial()
-    .omit({ folderKey: true })
-    .extend({ collection: zod_1.z.string().max(200).optional() });
-const toUpdateRequestPayload = (item, target) => {
+exports.updateRequestInputSchema = (0, strict_js_1.strictObject)({
+    ...Object.fromEntries(Object.entries(exports.requestInputSchema.shape).filter(([key]) => key !== "folderKey").map(([key, schema]) => [key, schema.optional()])),
+    collection: zod_1.z.string().max(200).optional().describe("Narrows a request NAME lookup to one collection (it does not move the request — use move_requests)"),
+}, "request field");
+// Only the fields passed change. isEnabledInRunner is NOT part of the PATCH
+// (the backend's update schema strips it) — the caller sends it to the
+// run-toggle endpoint.
+const toUpdateRequestPayload = (item, current, target, resolve = noConnections) => {
     const out = {};
+    const warnings = [];
     if (item.name !== undefined)
         out.name = item.name.trim().slice(0, truncate_js_1.LIMITS.NAME);
     if (item.method !== undefined)
         out.method = item.method;
-    if (item.url !== undefined)
-        out.url = item.url.trim();
+    if (item.url !== undefined || item.query !== undefined) {
+        const synced = (0, exports.syncUrlAndQuery)((item.url ?? current.url).trim(), item.query ?? (item.url !== undefined ? undefined : current.query ?? []));
+        out.url = synced.url;
+        out.query = synced.query;
+        warnings.push(...synced.warnings);
+    }
     if (item.headers !== undefined)
         out.headers = (0, exports.toRows)(item.headers);
-    if (item.query !== undefined)
-        out.query = (0, exports.toRows)(item.query);
-    if (item.pathVariables !== undefined) {
-        out.pathVariables = item.pathVariables
-            .filter((entry) => entry.key.trim())
-            .map((entry) => ({ key: entry.key.trim(), value: entry.value ?? "", description: entry.description ?? "" }));
+    if (item.pathVariables !== undefined)
+        out.pathVariables = toPathVariables(item.pathVariables);
+    if (item.body !== undefined) {
+        out.body = (0, exports.toBodyPayload)(item.body, item.headers !== undefined ? (0, exports.toRows)(item.headers) : (current.headers ?? []));
+        warnings.push(...(0, exports.sanitizedKeyWarnings)(out.body));
     }
-    if (item.body !== undefined)
-        out.body = (0, exports.toBodyPayload)(item.body, (0, exports.toRows)(item.headers));
     if (item.auth !== undefined)
         out.auth = (0, exports.toAuthPayload)(item.auth);
     if (item.preRequestScript !== undefined)
@@ -201,13 +389,11 @@ const toUpdateRequestPayload = (item, target) => {
         out.postResponseScript = item.postResponseScript;
     if (item.testsScript !== undefined)
         out.testsScript = item.testsScript;
-    if (item.isEnabledInRunner !== undefined)
-        out.isEnabledInRunner = item.isEnabledInRunner;
-    if (target.collectionId !== undefined)
-        out.collectionId = target.collectionId;
+    if ((0, requestIntegrations_js_1.hasIntegrations)(item))
+        Object.assign(out, (0, requestIntegrations_js_1.toIntegrationPayload)(item, resolve, current));
     if (target.folderId !== undefined)
         out.folderId = target.folderId;
-    return out;
+    return { payload: out, warnings };
 };
 exports.toUpdateRequestPayload = toUpdateRequestPayload;
 // ── outbound views ─────────────────────────────────────────────────────
@@ -216,9 +402,36 @@ const kvView = (rows, maskHeaders) => (rows ?? []).map((row) => ({
     value: maskHeaders ? (0, mask_js_1.maskHeaderValue)(row.key, row.value) : row.value,
     ...(row.enabled === false ? { enabled: false } : {}),
 }));
+// Stored body → the input shape (a bare JSON value stays bare unless it has
+// a top-level "mode", which would read as a mode object).
+const bodyInputView = (body) => {
+    if (body === null || body === undefined)
+        return null;
+    if (isModeObject(body)) {
+        const record = body;
+        if (record.mode === "raw" && typeof record.raw === "string")
+            return { mode: "raw", raw: record.raw, language: record.rawLanguage ?? "text" };
+        if ((record.mode === "formdata" || record.mode === "urlencoded") && Array.isArray(record.formEntries)) {
+            return {
+                mode: record.mode,
+                entries: record.formEntries.map((entry) => ({
+                    key: String(entry.key ?? ""),
+                    value: String(entry.value ?? ""),
+                    ...(entry.enabled === false ? { enabled: false } : {}),
+                    ...(entry.type === "file" ? { file: true } : {}),
+                })),
+            };
+        }
+        return { mode: "json", json: body };
+    }
+    return body;
+};
+exports.bodyInputView = bodyInputView;
 const compactRequestView = (request, options = {}) => {
-    const bodyText = request.body == null ? null : (0, truncate_js_1.safeStringify)(request.body);
+    const body = (0, exports.bodyInputView)(request.body);
+    const bodyText = body === null ? null : (0, truncate_js_1.safeStringify)(body);
     const bodyTruncated = bodyText !== null && !options.full && bodyText.length > truncate_js_1.LIMITS.BODY_PREVIEW;
+    const integrations = (0, requestIntegrations_js_1.integrationsInputView)(request);
     return {
         id: request.id,
         name: request.name,
@@ -229,17 +442,25 @@ const compactRequestView = (request, options = {}) => {
         headers: kvView(request.headers, !options.reveal),
         query: kvView(request.query, false),
         ...(request.pathVariables && request.pathVariables.length > 0
-            ? { pathVariables: request.pathVariables.map((entry) => ({ key: entry.key, value: entry.value ?? "" })) }
+            ? {
+                pathVariables: request.pathVariables.map((entry) => ({
+                    key: entry.key,
+                    value: entry.value ?? "",
+                    ...(entry.description ? { description: entry.description } : {}),
+                })),
+            }
             : {}),
-        body: options.full ? request.body : (0, truncate_js_1.jsonPreview)(request.body),
-        ...(bodyTruncated ? { bodyTruncated: true } : {}),
-        auth: options.reveal ? (request.auth ?? { type: "none" }) : (0, mask_js_1.maskAuth)(request.auth),
+        // A clipped body is never returned as `body` — it would validate as a
+        // (cut) body if written back.
+        ...(bodyTruncated ? { body: null, bodyPreview: (0, truncate_js_1.jsonPreview)(body), bodyTruncated: true } : { body }),
+        auth: (0, exports.authInputView)(request.auth, options.reveal),
         scripts: {
             preRequest: scriptView(request.preRequestScript, options.full),
             postResponse: scriptView(request.postResponseScript, options.full),
             tests: scriptView(request.testsScript, options.full),
         },
         isEnabledInRunner: request.isEnabledInRunner !== false,
+        ...(integrations ?? {}),
         updatedAt: request.updatedAt ?? null,
     };
 };

package/dist-cjs/domain/resolve.js

@@ -25,6 +25,9 @@ const resolveRef = (kind, ref, items, options) => {
         throw new errors_js_1.ToolInputError("REF_AMBIGUOUS", `${exact.length} ${kind}s are named "${reference}" — use the id.`, { kind, ref: reference, candidates: candidatesOf(exact, options) });
     }
     const partial = items.filter((item) => names(item).some((name) => name.includes(needle)));
+    if (options?.exact) {
+        throw new errors_js_1.ToolInputError("REF_NOT_FOUND", `No ${kind} is named exactly "${reference}". This tool needs the exact name or the id${partial.length > 0 ? " — see candidates" : ""}.`, { kind, ref: reference, candidates: candidatesOf(partial.length > 0 ? partial : items, options) });
+    }
     if (partial.length === 1) {
         return { item: partial[0], matched: "partial", annotation: `matched "${reference}" → ${partial[0].name}` };
     }
@@ -56,8 +59,9 @@ const flattenFolderTree = (tree) => {
     return out;
 };
 exports.flattenFolderTree = flattenFolderTree;
-const resolveFolderRef = (ref, folders) => (0, exports.resolveRef)("folder", ref, folders, {
+const resolveFolderRef = (ref, folders, exact = false) => (0, exports.resolveRef)("folder", ref, folders, {
     describe: (folder) => ({ path: folder.path }),
     aliases: (folder) => [folder.path],
+    exact,
 });
 exports.resolveFolderRef = resolveFolderRef;