callman-mcp 0.1.0 → 0.2.0

package/dist-cjs/resources/index.js

@@ -8,6 +8,7 @@ const requestShape_js_1 = require("../domain/requestShape.js");
 const summarize_js_2 = require("../domain/scenario/summarize.js");
 const truncate_js_1 = require("../lib/truncate.js");
 const lookups_js_1 = require("../tools/lookups.js");
+const contracts_js_1 = require("./docs/contracts.js");
 const diagramSchema_js_1 = require("./docs/diagramSchema.js");
 const overview_js_1 = require("./docs/overview.js");
 const requestSchema_js_1 = require("./docs/requestSchema.js");
@@ -35,13 +36,14 @@ const registerResources = (server, ctx) => {
     // ── static docs ──────────────────────────────────────────────────────
     const staticDocs = [
         { name: "docs-overview", uri: "callman://docs/overview", title: "How to work with Callman", description: "Conventions: whoami first, names as references, dryRun, confirm, secrets, scenarios, diagrams.", body: () => overview_js_1.OVERVIEW_DOC },
-        { name: "docs-request-schema", uri: "callman://docs/request-schema", title: "Request input schema", description: "The compact request form (body variants, auth, variables, scripts, folder skeleton).", body: () => requestSchema_js_1.REQUEST_SCHEMA_DOC },
-        { name: "docs-scenario-nodes", uri: "callman://docs/scenario-nodes", title: "Scenario node reference", description: "Every scenario node type with its config fields and defaults, graph rules and examples (from callman-core).", body: () => (0, callman_core_1.buildScenarioSystemPrompt)() },
+        { name: "docs-request-schema", uri: "callman://docs/request-schema", title: "Request schema", description: "Every request field as create/update/get use it: url ⇄ query, body modes, auth (incl. oauth2), masked secrets, database / Kafka / Redis steps, DB assertions, scripts, folder skeleton.", body: () => requestSchema_js_1.REQUEST_SCHEMA_DOC },
+        { name: "docs-contracts", uri: "callman://docs/contracts", title: "Contract checks", description: "Field rules (path grammar, every rule and format) and data-driven contracts on a request, and how runs evaluate them.", body: () => contracts_js_1.CONTRACTS_DOC },
+        { name: "docs-scenario-nodes", uri: "callman://docs/scenario-nodes", title: "Scenario node reference", description: "Every scenario node type: config fields, defaults, what is required, outputs, connections, labels, graph rules, rules/operands, templates and examples (from callman-core, checked against the server's schema).", body: () => (0, callman_core_1.renderScenarioNodeReference)() },
         { name: "docs-scripting-pm-api", uri: "callman://docs/scripting/pm-api", title: "Scripting: pm.* API", description: "The pm.* API available in pre-request / post-response / test scripts, per stage.", body: () => (0, callman_core_1.renderPmApiReference)() },
         { name: "docs-scripting-db-queries", uri: "callman://docs/scripting/db-queries", title: "Scripting: database queries", description: "How pm.db.* queries work per database provider.", body: () => (0, callman_core_1.renderDbQueryReference)() },
         { name: "docs-scripting-templating", uri: "callman://docs/scripting/templating", title: "Templating: {{variables}} and generators", description: "Variable resolution order and dynamic generators ({{$uuid}}, {{$randomInt}} …).", body: () => aiPacks_js_1.AI_PACKS.templating ?? "" },
         { name: "docs-scripting-sandbox", uri: "callman://docs/scripting/sandbox", title: "Scripting: sandbox and feature policy", description: "Globals available in the script sandbox and the feature policy for DB/Kafka capabilities.", body: () => `${aiPacks_js_1.AI_PACKS["sandbox-globals"] ?? ""}\n\n${aiPacks_js_1.AI_PACKS["feature-policy"] ?? ""}` },
-        { name: "docs-diagram-schema", uri: "callman://docs/diagram-schema", title: "Diagram schema", description: "The compact diagram input, edge semantics, patch operations and the stored DiagramDocument.", body: () => diagramSchema_js_1.DIAGRAM_SCHEMA_DOC },
+        { name: "docs-diagram-schema", uri: "callman://docs/diagram-schema", title: "Diagram schema", description: "Every node and edge field, styling (colors, borders, fonts), containers, edge semantics and colors, patch operations and merge rules, and the stored DiagramDocument.", body: () => diagramSchema_js_1.DIAGRAM_SCHEMA_DOC },
     ];
     for (const doc of staticDocs) {
         server.registerResource(doc.name, doc.uri, { title: doc.title, description: doc.description, mimeType: "text/markdown" }, async (uri) => text(uri, doc.body()));
@@ -56,11 +58,12 @@ const registerResources = (server, ctx) => {
                 type: component.type,
                 label: component.label,
                 ...(component.aliases?.length ? { aliases: component.aliases } : {}),
-                ...(component.container ? { container: true } : {}),
+                ...(component.container || component.swimlane ? { container: true } : {}),
+                ...(component.variant === "line" ? { connector: true } : {}),
             })),
         }));
     };
-    server.registerResource("diagram-components", "callman://diagram/components", { title: "Diagram component catalog", description: "Every component type usable in create_diagram / patch_diagram, grouped by category. Use the `type` values verbatim.", mimeType: "application/json" }, async (uri) => json(uri, { categories: catalog(), note: "Use `type` verbatim as a node's type. Container components take children via `parent`." }));
+    server.registerResource("diagram-components", "callman://diagram/components", { title: "Diagram component catalog", description: "Every component type usable in create_diagram / patch_diagram, grouped by category. Use the `type` values verbatim.", mimeType: "application/json" }, async (uri) => json(uri, { categories: catalog(), note: "Use `type` verbatim as a node's type. `container` types (frame, pools) take children via `parent`. `connector` entries are palette lines, not nodes — draw them as edges. Styling and every node/edge field: callman://docs/diagram-schema." }));
     server.registerResource("diagram-components-category", new mcp_js_1.ResourceTemplate("callman://diagram/components/{category}", {
         list: undefined,
         complete: { category: () => [...callman_core_1.DIAGRAM_CATEGORY_ORDER] },
@@ -83,22 +86,19 @@ const registerResources = (server, ctx) => {
         const { items } = await ctx.api.listEnvironments(ws.id);
         return json(uri, { workspace: { id: ws.id, name: ws.name }, environments: items.map((environment) => ({ id: environment.id, name: environment.name, variableKeys: environment.variables.map((entry) => entry.key) })) });
     });
-    server.registerResource("collection-tree", new mcp_js_1.ResourceTemplate("callman://collection/{collection}/tree", { list: undefined }), { title: "A collection's folders and requests", description: "Folders and requests of a collection (id or name) in the default workspace.", mimeType: "application/json" }, async (uri, variables) => {
-        const ws = await ctx.resolveWorkspace();
-        const resolved = await (0, lookups_js_1.resolveCollection)(ctx, ws.id, variable(variables.collection));
+    server.registerResource("collection-tree", new mcp_js_1.ResourceTemplate("callman://collection/{collection}/tree", { list: undefined }), { title: "A collection's folders and requests", description: "Folders and requests of a collection (id or name) in any of your workspaces.", mimeType: "application/json" }, async (uri, variables) => {
+        const { ws, value: resolved } = await (0, lookups_js_1.findCollection)(ctx, null, variable(variables.collection));
         const tree = await (0, lookups_js_1.loadTree)(ctx, ws.id, resolved.item.id);
-        return json(uri, { collection: { id: resolved.item.id, name: resolved.item.name }, folders: tree.folders, requests: tree.requests.map(requestShape_js_1.requestSummaryView) });
+        return json(uri, { collection: { id: resolved.item.id, name: resolved.item.name }, workspace: (0, lookups_js_1.workspaceTag)(ws), folders: tree.folders, requests: tree.requests.map(requestShape_js_1.requestSummaryView) });
     });
-    server.registerResource("request", new mcp_js_1.ResourceTemplate("callman://request/{request}", { list: undefined }), { title: "A saved request", description: "One request (id or unique name) in the default workspace, secrets masked.", mimeType: "application/json" }, async (uri, variables) => {
-        const ws = await ctx.resolveWorkspace();
-        const { request } = await (0, lookups_js_1.resolveRequest)(ctx, ws.id, variable(variables.request));
-        return json(uri, { request: (0, requestShape_js_1.compactRequestView)(request, { full: true }) });
+    server.registerResource("request", new mcp_js_1.ResourceTemplate("callman://request/{request}", { list: undefined }), { title: "A saved request", description: "One request (id or unique name) in any of your workspaces, secrets masked.", mimeType: "application/json" }, async (uri, variables) => {
+        const { ws, value } = await (0, lookups_js_1.findRequest)(ctx, null, variable(variables.request));
+        return json(uri, { request: (0, requestShape_js_1.compactRequestView)(value.request, { full: true }), workspace: (0, lookups_js_1.workspaceTag)(ws) });
     });
-    server.registerResource("environment", new mcp_js_1.ResourceTemplate("callman://environment/{environment}", { list: undefined }), { title: "An environment", description: "One environment (id or name) in the default workspace, values masked by the server.", mimeType: "application/json" }, async (uri, variables) => {
-        const ws = await ctx.resolveWorkspace();
-        const resolved = await (0, lookups_js_1.resolveEnvironment)(ctx, ws.id, variable(variables.environment));
+    server.registerResource("environment", new mcp_js_1.ResourceTemplate("callman://environment/{environment}", { list: undefined }), { title: "An environment", description: "One environment (id or name) in any of your workspaces, values masked by the server.", mimeType: "application/json" }, async (uri, variables) => {
+        const { ws, value: resolved } = await (0, lookups_js_1.findEnvironment)(ctx, null, variable(variables.environment));
         const fresh = await ctx.api.getEnvironment(ws.id, resolved.item.id);
-        return json(uri, { environment: { id: fresh.id, name: fresh.name, variables: fresh.variables } });
+        return json(uri, { environment: { id: fresh.id, name: fresh.name, variables: fresh.variables }, workspace: (0, lookups_js_1.workspaceTag)(ws) });
     });
     server.registerResource("scenario", new mcp_js_1.ResourceTemplate("callman://scenario/{scenario}", { list: undefined }), { title: "A scenario", description: "One scenario (id or name): nodes with configs (clipped, secrets masked) and edges.", mimeType: "application/json" }, async (uri, variables) => {
         const ws = await ctx.resolveWorkspaceOrNull();

package/dist-cjs/run/executeCollection.js

@@ -21,8 +21,17 @@ const diffEnv = (before, after, set, unset) => {
         if (!(key in after))
             unset.add(key);
 };
-const executeCollection = async ({ collection, env, connections = {}, bail = false, only = null, deadlineMs, onProgress, }) => {
+const executeCollection = async ({ collection, env, globals = {}, connections = {}, bail = false, only = null, includeDisabled = false, deadlineMs, onProgress, }) => {
     const envStore = new callman_core_1.EnvStore(env);
+    const globalStore = new callman_core_1.EnvStore(globals);
+    const seen = new Map();
+    const remember = (values) => {
+        for (const [key, value] of Object.entries(values))
+            if (typeof value === "string" && value)
+                seen.set(`${key}\u0000${value}`, key);
+    };
+    remember(globals);
+    remember(env);
     const results = [];
     const setKeys = new Set();
     const unsetKeys = new Set();
@@ -34,7 +43,7 @@ const executeCollection = async ({ collection, env, connections = {}, bail = fal
         kafka: false,
     };
     const wanted = only ? new Set(only) : null;
-    const runnable = collection.requests.filter((request) => request.isEnabledInRunner !== false && (!wanted || wanted.has(request.id)));
+    const runnable = collection.requests.filter((request) => (includeDisabled || request.isEnabledInRunner !== false) && (!wanted || wanted.has(request.id)));
     for (const [index, request] of runnable.entries()) {
         if (deadlineMs && Date.now() - startedAt > deadlineMs) {
             bailed = true;
@@ -43,7 +52,7 @@ const executeCollection = async ({ collection, env, connections = {}, bail = fal
         const before = envStore.all();
         const rows = request.dataContract?.rows ?? [];
         if (rows.length > 0) {
-            const { iterations } = await (0, callman_core_1.runRequestWithDataset)({ request, env: envStore, previousResponse, connections, featurePolicy }, { requestId: request.id, columns: request.dataContract?.columns ?? [], rows });
+            const { iterations } = await (0, callman_core_1.runRequestWithDataset)({ request, env: envStore, globals: globalStore, previousResponse, connections, featurePolicy }, { requestId: request.id, columns: request.dataContract?.columns ?? [], rows });
             let rowBailed = false;
             for (const iteration of iterations) {
                 const result = {
@@ -65,6 +74,7 @@ const executeCollection = async ({ collection, env, connections = {}, bail = fal
                 }
             }
             diffEnv(before, envStore.all(), setKeys, unsetKeys);
+            remember(envStore.all());
             previousResponse = null;
             if (rowBailed) {
                 bailed = true;
@@ -72,8 +82,9 @@ const executeCollection = async ({ collection, env, connections = {}, bail = fal
             }
             continue;
         }
-        const outcome = await (0, callman_core_1.runRequest)({ request, env: envStore, previousResponse, connections, featurePolicy });
+        const outcome = await (0, callman_core_1.runRequest)({ request, env: envStore, globals: globalStore, previousResponse, connections, featurePolicy });
         diffEnv(before, envStore.all(), setKeys, unsetKeys);
+        remember(envStore.all());
         previousResponse = outcome.response;
         results.push(outcome.result);
         onProgress?.({ index, total: runnable.length, request, result: outcome.result });
@@ -88,6 +99,7 @@ const executeCollection = async ({ collection, env, connections = {}, bail = fal
         summary: { total: results.length, passed, failed: results.length - passed },
         envChanges: { set: [...setKeys].sort(), unset: [...unsetKeys].sort() },
         bailed,
+        knownValues: [...seen].map(([entry, key]) => [key, entry.slice(entry.indexOf("\u0000") + 1)]),
     };
 };
 exports.executeCollection = executeCollection;

package/dist-cjs/run/summarize.js

@@ -1,44 +1,41 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.summarizeRun = exports.summarizeResult = void 0;
-const mask_js_1 = require("../lib/mask.js");
+const redact_js_1 = require("../lib/redact.js");
 const truncate_js_1 = require("../lib/truncate.js");
 const executeCollection_js_1 = require("./executeCollection.js");
 // What a local run reports back to the model: enough to judge and debug
-// (status, timing, tests, a bounded body preview, the request as SENT with
-// sensitive headers masked) and nothing that leaks credentials — variable
-// VALUES never appear, only the keys scripts changed.
-const KEEP_RESPONSE_HEADERS = new Set([
-    "content-type",
-    "content-length",
-    "location",
-    "cache-control",
-    "x-request-id",
-    "x-correlation-id",
-    "retry-after",
-    "www-authenticate",
-]);
-const responseHeadersOf = (response) => {
+// (status, timing, tests and contracts, the request as SENT, response headers
+// and a bounded body) and no variable VALUES — every value the run held is
+// shown as its {{key}} (lib/redact), credentials that are not variables are
+// masked by name.
+const RESPONSE_HEADERS_MAX = 40;
+const responseHeadersOf = (response, redactor) => {
     const headers = response?.headers;
     if (!headers || typeof headers !== "object")
-        return {};
-    const out = {};
-    for (const [key, value] of Object.entries(headers)) {
-        if (KEEP_RESPONSE_HEADERS.has(key.toLowerCase()))
-            out[key] = Array.isArray(value) ? value.join(", ") : String(value);
-    }
-    return out;
+        return { headers: {} };
+    const entries = Object.entries(headers);
+    return {
+        headers: redactor.headers(Object.fromEntries(entries.slice(0, RESPONSE_HEADERS_MAX))),
+        ...(entries.length > RESPONSE_HEADERS_MAX ? { headersTruncated: true, headerCount: entries.length } : {}),
+    };
 };
-const bodyOf = (response) => {
+// XML (and other parsed) bodies keep their original text in `rawText` —
+// report what the server actually sent.
+const bodyTextOf = (response) => {
     if (!response || typeof response !== "object")
-        return null;
+        return "";
     const record = response;
-    return record.data !== undefined ? record.data : record.body !== undefined ? record.body : null;
+    if (typeof record.rawText === "string" && record.rawText)
+        return record.rawText;
+    const body = record.data !== undefined ? record.data : record.body;
+    if (body === null || body === undefined)
+        return "";
+    return typeof body === "string" ? body : (0, truncate_js_1.safeStringify)(body);
 };
-const summarizeResult = (result, maxBodyBytes) => {
-    const body = bodyOf(result.response);
-    const bodyText = body === null || body === undefined ? "" : typeof body === "string" ? body : (0, truncate_js_1.safeStringify)(body);
-    const clipped = (0, truncate_js_1.clipBytes)(bodyText, maxBodyBytes);
+const testsView = (tests) => tests.map((test) => ({ name: test.name, status: test.status, ...(test.message ? { message: (0, truncate_js_1.clip)(test.message, 300) } : {}) }));
+const summarizeResult = (result, maxBodyBytes, redactor) => {
+    const clipped = (0, truncate_js_1.clipBytes)(redactor.text(bodyTextOf(result.response)), maxBodyBytes);
     const sent = result.request;
     return {
         requestId: result.requestId,
@@ -49,25 +46,35 @@ const summarizeResult = (result, maxBodyBytes) => {
         request: sent
             ? {
                 method: sent.method,
-                url: (0, truncate_js_1.clip)(sent.url, 2048),
-                headers: (0, mask_js_1.maskHeaderRecord)(sent.headers),
-                ...(sent.body !== undefined && sent.body !== null ? { body: (0, truncate_js_1.clip)(typeof sent.body === "string" ? sent.body : (0, truncate_js_1.safeStringify)(sent.body), truncate_js_1.LIMITS.BODY_PREVIEW) } : {}),
+                url: (0, truncate_js_1.clip)(redactor.text(sent.url), 2048),
+                ...(sent.query && Object.keys(sent.query).length > 0 ? { query: redactor.query(sent.query) } : {}),
+                headers: redactor.headers(sent.headers),
+                ...(sent.body !== undefined && sent.body !== null
+                    ? { body: (0, truncate_js_1.clip)(redactor.text(typeof sent.body === "string" ? sent.body : (0, truncate_js_1.safeStringify)(sent.body)), truncate_js_1.LIMITS.BODY_PREVIEW) }
+                    : {}),
             }
             : null,
         response: {
-            headers: responseHeadersOf(result.response),
+            ...responseHeadersOf(result.response, redactor),
             body: clipped.text || null,
             ...(clipped.truncated ? { bodyTruncated: true, bodyBytes: clipped.totalBytes } : {}),
         },
-        tests: result.scriptResults.map((test) => ({ name: test.name, status: test.status, ...(test.message ? { message: (0, truncate_js_1.clip)(test.message, 300) } : {}) })),
-        contracts: result.contractResults.map((test) => ({ name: test.name, status: test.status, ...(test.message ? { message: (0, truncate_js_1.clip)(test.message, 300) } : {}) })),
+        tests: testsView(result.scriptResults),
+        contracts: testsView(result.contractResults),
+        ...(result.unresolvedVariables && result.unresolvedVariables.length > 0 ? { unresolvedVariables: result.unresolvedVariables } : {}),
+        ...(result.logs && result.logs.length > 0
+            ? { logs: result.logs.slice(0, 50).map((entry) => (0, truncate_js_1.clip)(redactor.text(`[${entry.stage}${entry.level === "log" ? "" : ` ${entry.level}`}] ${entry.message}`), 500)) }
+            : {}),
     };
 };
 exports.summarizeResult = summarizeResult;
-const summarizeRun = (outcome, maxBodyBytes, extra = {}) => ({
-    ...extra,
-    summary: { ...outcome.summary, bailed: outcome.bailed },
-    results: outcome.results.map((result) => (0, exports.summarizeResult)(result, maxBodyBytes)),
-    env: outcome.envChanges,
-});
+const summarizeRun = (outcome, maxBodyBytes, extra = {}, redaction = {}) => {
+    const redactor = (0, redact_js_1.createRedactor)(outcome.knownValues, redaction);
+    return {
+        ...extra,
+        summary: { ...outcome.summary, bailed: outcome.bailed },
+        results: outcome.results.map((result) => (0, exports.summarizeResult)(result, maxBodyBytes, redactor)),
+        env: outcome.envChanges,
+    };
+};
 exports.summarizeRun = summarizeRun;

package/dist-cjs/server.js

@@ -8,7 +8,7 @@ const index_js_2 = require("./resources/index.js");
 const index_js_3 = require("./tools/index.js");
 exports.SERVER_NAME = "callman";
 exports.SERVER_INSTRUCTIONS = `Callman is an API client and test platform: collections of HTTP requests, environments with variables, multi-step test scenarios, and system-design diagrams. You act as the user whose token is configured, within that token's permissions and the user's workspace role.
-Start with whoami. Names work as references (collection, folder, request, environment, scenario, diagram, workspace); ambiguous names return candidates. List before creating — duplicate collection names are refused. Preview large writes with dryRun: true; deletions need confirm: true and the user's agreement. Environment values are masked unless the token holds environments:reveal and you pass reveal: true; never write a masked value back. Read callman://docs/overview for the conventions, callman://docs/request-schema before creating requests, callman://docs/scenario-nodes before scenarios, and callman://diagram/components before diagrams.`;
+Start with whoami. The token works in every workspace the user belongs to: lists and searches cover all of them unless you pass \`workspace\`, names are looked up in the default workspace first and then everywhere, and results say which workspace they come from; creating something needs a target (\`workspace\`, the collection it goes into, or the session default — use_workspace). Names work as references (collection, folder, request, environment, scenario, diagram, workspace); ambiguous names return candidates. List before creating — duplicate collection names are refused. Preview large writes with dryRun: true; deletions need confirm: true and the user's agreement. Environment values are masked unless the token holds environments:reveal and you pass reveal: true; never write a masked value back. Arguments are strict — an unknown key is an error listing the valid ones. Read callman://docs/overview for the conventions, callman://docs/request-schema before creating or editing requests, callman://docs/contracts before contract checks, callman://docs/scenario-nodes before scenarios, and callman://docs/diagram-schema + callman://diagram/components before diagrams.`;
 const createCallmanMcpServer = (options) => {
     const version = options.version ?? "0.0.0";
     const context = (0, context_js_1.createToolContext)({

package/dist-cjs/tools/catalog.js

@@ -8,8 +8,10 @@ exports.toolAvailability = exports.TOOL_CATALOG = void 0;
 exports.TOOL_CATALOG = [
     { name: "whoami", group: "meta", scopes: [] },
     { name: "list_workspaces", group: "workspaces", scopes: ["workspaces:read"] },
+    { name: "use_workspace", group: "workspaces", scopes: ["workspaces:read"] },
     { name: "list_workspace_members", group: "workspaces", scopes: ["workspaces:read"] },
     { name: "add_workspace_member", group: "workspaces", scopes: ["members:manage"] },
+    { name: "update_workspace_member", group: "workspaces", scopes: ["members:manage"] },
     { name: "remove_workspace_member", group: "workspaces", scopes: ["members:manage"], destructive: true },
     { name: "list_collections", group: "collections", scopes: ["collections:read"] },
     { name: "get_collection_tree", group: "collections", scopes: ["collections:read", "requests:read"] },
@@ -31,6 +33,17 @@ exports.TOOL_CATALOG = [
     { name: "delete_requests", group: "requests", scopes: ["requests:delete"], destructive: true },
     { name: "run_request", group: "run", scopes: ["requests:run"], localRun: true },
     { name: "run_collection", group: "run", scopes: ["requests:run"], localRun: true },
+    // Contract checks belong to their request (the backend maps them onto the
+    // requests:* scopes). add_contract_rules with replace: true also deletes.
+    { name: "get_contract_checks", group: "contracts", scopes: ["requests:read"] },
+    { name: "add_contract_rules", group: "contracts", scopes: ["requests:write"] },
+    { name: "update_contract_rule", group: "contracts", scopes: ["requests:write"] },
+    { name: "delete_contract_rules", group: "contracts", scopes: ["requests:delete"], destructive: true },
+    { name: "test_contract_rules", group: "contracts", scopes: ["requests:read"] },
+    { name: "set_data_contract", group: "contracts", scopes: ["requests:write"] },
+    { name: "delete_data_contract", group: "contracts", scopes: ["requests:delete"], destructive: true },
+    // The safe connection record (no credentials) — readable with either family.
+    { name: "list_connections", group: "connections", scopes: ["requests:read", "scenarios:read"], anyOf: true },
     // Documents and new collections → import:write; cURL/.http into an existing
     // collection → requests:write.
     { name: "import_content", group: "import", scopes: ["import:write", "requests:write"], anyOf: true },
@@ -38,13 +51,18 @@ exports.TOOL_CATALOG = [
     { name: "list_environments", group: "environments", scopes: ["environments:read"] },
     { name: "get_environment", group: "environments", scopes: ["environments:read"] },
     { name: "create_environment", group: "environments", scopes: ["environments:write"] },
+    { name: "update_environment", group: "environments", scopes: ["environments:write"] },
+    // `unset` additionally needs environments:delete (DELETE …/variables/:key).
     { name: "set_environment_variables", group: "environments", scopes: ["environments:write"] },
+    { name: "set_global_variables", group: "environments", scopes: ["environments:write"] },
     { name: "delete_environment", group: "environments", scopes: ["environments:delete"], destructive: true },
     { name: "list_scenarios", group: "scenarios", scopes: ["scenarios:read"] },
     { name: "get_scenario", group: "scenarios", scopes: ["scenarios:read"] },
     { name: "get_scenario_report", group: "scenarios", scopes: ["scenarios:read"] },
     { name: "create_scenario", group: "scenarios", scopes: ["scenarios:write"] },
     { name: "update_scenario", group: "scenarios", scopes: ["scenarios:write"] },
+    { name: "patch_scenario", group: "scenarios", scopes: ["scenarios:write"] },
+    { name: "submit_scenario", group: "scenarios", scopes: ["scenarios:write"] },
     { name: "delete_scenario", group: "scenarios", scopes: ["scenarios:delete"], destructive: true },
     { name: "run_scenario", group: "scenarios", scopes: ["scenarios:run"] },
     { name: "list_diagrams", group: "diagrams", scopes: ["diagrams:read"] },

package/dist-cjs/tools/collections.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerCollectionTools = void 0;
 const zod_1 = require("zod");
 const errors_js_1 = require("../client/errors.js");
+const strict_js_1 = require("../lib/strict.js");
 const requestShape_js_1 = require("../domain/requestShape.js");
 const resolve_js_1 = require("../domain/resolve.js");
 const pagination_js_1 = require("../lib/pagination.js");
@@ -10,23 +11,31 @@ const truncate_js_1 = require("../lib/truncate.js");
 const lookups_js_1 = require("./lookups.js");
 const shared_js_1 = require("./shared.js");
 const EXPORT_MAX_BYTES = 1024 * 1024;
+const runnerSettingsArg = (0, strict_js_1.strictObject)({
+    database: zod_1.z.boolean().optional().describe("Run each request's database pre/post steps during collection runs"),
+    kafka: zod_1.z.boolean().optional().describe("Run each request's Kafka publish/consume steps during collection runs"),
+}, "runner setting")
+    .optional()
+    .describe("Collection runner switches (both default to on)");
 const registerCollectionTools = (server, ctx) => {
     server.registerTool("list_collections", {
         title: "List collections",
-        description: "List the collections in a workspace with request/folder counts. Optional `query` filters by name (substring). Use get_collection_tree to see what is inside one.",
+        description: "List collections with request/folder counts — across ALL your workspaces unless `workspace` narrows it (the default workspace comes first; every row says its workspace). Optional `query` filters by name (substring). Use get_collection_tree to see what is inside one.",
         inputSchema: { workspace: shared_js_1.workspaceArg, query: zod_1.z.string().max(200).optional(), ...shared_js_1.cursorArgs },
         annotations: shared_js_1.READ,
     }, (0, shared_js_1.guarded)(async ({ workspace, query, cursor, limit }) => {
-        const ws = await ctx.resolveWorkspace(workspace);
-        const all = await (0, lookups_js_1.loadCollections)(ctx, ws.id);
+        const workspaces = await (0, lookups_js_1.workspacesForListing)(ctx, workspace);
         const needle = query?.trim().toLowerCase();
-        const filtered = needle ? all.filter((collection) => collection.name.toLowerCase().includes(needle)) : all;
-        const page = (0, pagination_js_1.sliceWithCursor)(filtered, cursor, limit);
+        const rows = (await Promise.all(workspaces.map(async (ws) => (await (0, lookups_js_1.loadCollections)(ctx, ws.id)).map((collection) => ({ ws, collection })))))
+            .flat()
+            .filter(({ collection }) => !needle || collection.name.toLowerCase().includes(needle));
+        const page = (0, pagination_js_1.sliceWithCursor)(rows, cursor, limit, `${workspaces.map((ws) => ws.id).join(",")}|${needle ?? ""}`);
         return (0, shared_js_1.ok)({
-            workspace: { id: ws.id, name: ws.name },
-            collections: page.items.map((collection) => ({
+            ...(workspaces.length === 1 ? { workspace: (0, lookups_js_1.workspaceTag)(workspaces[0]) } : { workspaces: workspaces.map(lookups_js_1.workspaceTag) }),
+            collections: page.items.map(({ ws, collection }) => ({
                 id: collection.id,
                 name: collection.name,
+                ...(workspaces.length > 1 ? { workspace: (0, lookups_js_1.workspaceTag)(ws) } : {}),
                 requestCount: collection.requestCount ?? null,
                 folderCount: collection.folderCount ?? null,
                 updatedAt: collection.updatedAt ?? null,
@@ -37,17 +46,17 @@ const registerCollectionTools = (server, ctx) => {
     }));
     server.registerTool("get_collection_tree", {
         title: "Get a collection's folders and requests",
-        description: "The folders (with paths like \"Auth/Login\") and requests (id, name, method, url, folder) of one collection — the map you need before creating, moving or running requests.",
+        description: "The folders (with paths like \"Auth/Login\") and requests (id, name, method, url, folder) of one collection, in whichever workspace it lives — the map you need before creating, moving or running requests.",
         inputSchema: { workspace: shared_js_1.workspaceArg, collection: (0, shared_js_1.refArg)("Collection") },
         annotations: shared_js_1.READ,
     }, (0, shared_js_1.guarded)(async ({ workspace, collection }) => {
-        const ws = await ctx.resolveWorkspace(workspace);
-        const resolved = await (0, lookups_js_1.resolveCollection)(ctx, ws.id, collection);
+        const { ws, value: resolved, note } = await (0, lookups_js_1.findCollection)(ctx, workspace, collection);
         const tree = await (0, lookups_js_1.loadTree)(ctx, ws.id, resolved.item.id);
         const truncated = tree.requests.length > truncate_js_1.LIMITS.TREE_ITEMS;
         return (0, shared_js_1.ok)({
             collection: { id: resolved.item.id, name: resolved.item.name },
-            resolved: [(0, resolve_js_1.resolvedSummary)(collection, resolved)],
+            workspace: (0, lookups_js_1.workspaceTag)(ws),
+            resolved: [(0, resolve_js_1.resolvedSummary)(collection, resolved), ...(note ? [{ input: collection, note }] : [])],
             folders: tree.folders.map((folder) => ({ id: folder.id, name: folder.name, parentId: folder.parentId, path: folder.path })),
             requests: tree.requests.slice(0, truncate_js_1.LIMITS.TREE_ITEMS).map(requestShape_js_1.requestSummaryView),
             ...(truncated ? { truncated: true, totalRequests: tree.requests.length } : {}),
@@ -59,23 +68,22 @@ const registerCollectionTools = (server, ctx) => {
         inputSchema: { workspace: shared_js_1.workspaceArg, collection: (0, shared_js_1.refArg)("Collection"), format: zod_1.z.enum(["internal", "postman"]).default("internal") },
         annotations: shared_js_1.READ,
     }, (0, shared_js_1.guarded)(async ({ workspace, collection, format }) => {
-        const ws = await ctx.resolveWorkspace(workspace);
-        const resolved = await (0, lookups_js_1.resolveCollection)(ctx, ws.id, collection);
+        const { ws, value: resolved } = await (0, lookups_js_1.findCollection)(ctx, workspace, collection);
         const document = await ctx.api.exportCollection(ws.id, resolved.item.id, format);
         const bytes = (0, truncate_js_1.byteLength)(document);
         if (bytes > EXPORT_MAX_BYTES) {
             throw new errors_js_1.ToolInputError("EXPORT_TOO_LARGE", `The export is ${bytes} bytes (limit ${EXPORT_MAX_BYTES}). Export it from the desktop app instead.`, { bytes });
         }
-        return (0, shared_js_1.ok)({ collection: { id: resolved.item.id, name: resolved.item.name }, format, bytes, document: document });
+        return (0, shared_js_1.ok)({ collection: { id: resolved.item.id, name: resolved.item.name }, workspace: (0, lookups_js_1.workspaceTag)(ws), format, bytes, document: document });
     }));
     server.registerTool("create_collection", {
         title: "Create a collection",
-        description: "Create an empty collection. Refuses a name that already exists in the workspace unless allowDuplicateName is true — list_collections first and reuse an existing one when it fits.",
+        description: "Create an empty collection in `workspace` (or the session default — use_workspace; with one workspace, that one). Refuses a name that already exists in that workspace unless allowDuplicateName is true — list_collections first and reuse an existing one when it fits.",
         inputSchema: {
             workspace: shared_js_1.workspaceArg,
             name: zod_1.z.string().min(1).max(truncate_js_1.LIMITS.NAME),
             allowDuplicateName: zod_1.z.boolean().optional(),
-            runnerSettings: zod_1.z.object({ database: zod_1.z.boolean().optional(), kafka: zod_1.z.boolean().optional(), redis: zod_1.z.boolean().optional() }).optional(),
+            runnerSettings: runnerSettingsArg,
         },
         annotations: shared_js_1.WRITE,
     }, (0, shared_js_1.guarded)(async ({ workspace, name, allowDuplicateName, runnerSettings }) => {
@@ -88,29 +96,28 @@ const registerCollectionTools = (server, ctx) => {
         }
         const created = await ctx.api.createCollection(ws.id, { name: name.trim(), ...(runnerSettings ? { runnerSettings: compactSettings(runnerSettings) } : {}) });
         ctx.invalidate(`collections:${ws.id}`);
-        return (0, shared_js_1.ok)({ collection: { id: created.id, name: created.name }, note: "Created. Add requests with create_request / create_requests_bulk / import_content." });
+        return (0, shared_js_1.ok)({ collection: { id: created.id, name: created.name }, workspace: (0, lookups_js_1.workspaceTag)(ws), note: "Created. Add requests with create_request / create_requests_bulk / import_content." });
     }));
     server.registerTool("update_collection", {
         title: "Rename a collection / change runner settings",
-        description: "Rename a collection or toggle its runner settings (database / kafka / redis steps during runs).",
+        description: "Rename a collection or toggle its runner settings: whether collection runs execute the requests' database steps and Kafka steps.",
         inputSchema: {
             workspace: shared_js_1.workspaceArg,
             collection: (0, shared_js_1.refArg)("Collection"),
             name: zod_1.z.string().min(1).max(truncate_js_1.LIMITS.NAME).optional(),
-            runnerSettings: zod_1.z.object({ database: zod_1.z.boolean().optional(), kafka: zod_1.z.boolean().optional(), redis: zod_1.z.boolean().optional() }).optional(),
+            runnerSettings: runnerSettingsArg,
         },
         annotations: shared_js_1.IDEMPOTENT_WRITE,
     }, (0, shared_js_1.guarded)(async ({ workspace, collection, name, runnerSettings }) => {
         if (name === undefined && runnerSettings === undefined)
             throw new errors_js_1.ToolInputError("NOTHING_TO_UPDATE", "Pass name and/or runnerSettings.");
-        const ws = await ctx.resolveWorkspace(workspace);
-        const resolved = await (0, lookups_js_1.resolveCollection)(ctx, ws.id, collection);
+        const { ws, value: resolved, note } = await (0, lookups_js_1.findCollection)(ctx, workspace, collection);
         const updated = await ctx.api.updateCollection(ws.id, resolved.item.id, {
             ...(name !== undefined ? { name: name.trim() } : {}),
             ...(runnerSettings ? { runnerSettings: compactSettings(runnerSettings) } : {}),
         });
         ctx.invalidate(`collections:${ws.id}`);
-        return (0, shared_js_1.ok)({ collection: { id: updated.id, name: updated.name, runnerSettings: updated.runnerSettings ?? null }, resolved: [(0, resolve_js_1.resolvedSummary)(collection, resolved)] });
+        return (0, shared_js_1.ok)({ collection: { id: updated.id, name: updated.name, runnerSettings: updated.runnerSettings ?? null }, workspace: (0, lookups_js_1.workspaceTag)(ws), resolved: [(0, resolve_js_1.resolvedSummary)(collection, resolved), ...(note ? [{ input: collection, note }] : [])] });
     }));
     server.registerTool("create_folder", {
         title: "Create a folder",
@@ -123,8 +130,7 @@ const registerCollectionTools = (server, ctx) => {
         },
         annotations: shared_js_1.WRITE,
     }, (0, shared_js_1.guarded)(async ({ workspace, collection, name, parent }) => {
-        const ws = await ctx.resolveWorkspace(workspace);
-        const resolved = await (0, lookups_js_1.resolveCollection)(ctx, ws.id, collection);
+        const { ws, value: resolved } = await (0, lookups_js_1.findCollection)(ctx, workspace, collection);
         const parentFolder = await (0, lookups_js_1.resolveFolder)(ctx, ws.id, resolved.item.id, parent);
         const tree = await (0, lookups_js_1.loadTree)(ctx, ws.id, resolved.item.id);
         const sibling = tree.folders.find((folder) => folder.parentId === (parentFolder?.item.id ?? null) && (0, lookups_js_1.sameName)(folder.name, name));
@@ -136,36 +142,44 @@ const registerCollectionTools = (server, ctx) => {
         ctx.invalidate(`collections:${ws.id}`);
         return (0, shared_js_1.ok)({
             folder: { id: folder.id, name: folder.name, parentId: folder.parentId, path: parentFolder ? `${parentFolder.item.path}/${folder.name}` : folder.name },
+            workspace: (0, lookups_js_1.workspaceTag)(ws),
             resolved: [(0, resolve_js_1.resolvedSummary)(collection, resolved), ...(parentFolder ? [(0, resolve_js_1.resolvedSummary)(parent, parentFolder)] : [])],
         });
     }));
     server.registerTool("update_folder", {
         title: "Rename or move a folder",
-        description: "Rename a folder and/or move it under another parent (pass parent: null for top level).",
+        description: "Rename a folder and/or move it — under another parent in the same collection (parent: null = top level) or into another collection (targetCollection, with its subfolders and requests).",
         inputSchema: {
             workspace: shared_js_1.workspaceArg,
             collection: (0, shared_js_1.refArg)("Collection"),
             folder: (0, shared_js_1.refArg)("Folder", "(or path)"),
             name: zod_1.z.string().min(1).max(truncate_js_1.LIMITS.NAME).optional(),
-            parent: zod_1.z.string().max(300).nullable().optional().describe("New parent folder (id, name or path); null = top level"),
+            parent: zod_1.z.string().max(300).nullable().optional().describe("New parent folder (id, name or path) in the target collection; null = top level"),
+            targetCollection: zod_1.z.string().max(200).optional().describe("Move the folder into this collection (id or name)"),
         },
         annotations: shared_js_1.IDEMPOTENT_WRITE,
-    }, (0, shared_js_1.guarded)(async ({ workspace, collection, folder, name, parent }) => {
-        if (name === undefined && parent === undefined)
-            throw new errors_js_1.ToolInputError("NOTHING_TO_UPDATE", "Pass name and/or parent.");
-        const ws = await ctx.resolveWorkspace(workspace);
-        const resolved = await (0, lookups_js_1.resolveCollection)(ctx, ws.id, collection);
+    }, (0, shared_js_1.guarded)(async ({ workspace, collection, folder, name, parent, targetCollection }) => {
+        if (name === undefined && parent === undefined && targetCollection === undefined)
+            throw new errors_js_1.ToolInputError("NOTHING_TO_UPDATE", "Pass name, parent and/or targetCollection.");
+        const { ws, value: resolved } = await (0, lookups_js_1.findCollection)(ctx, workspace, collection);
         const target = await (0, lookups_js_1.resolveFolder)(ctx, ws.id, resolved.item.id, folder);
         if (!target)
             throw new errors_js_1.ToolInputError("REF_REQUIRED", "folder is required.");
-        const parentFolder = parent ? await (0, lookups_js_1.resolveFolder)(ctx, ws.id, resolved.item.id, parent) : null;
+        const destination = targetCollection ? await (0, lookups_js_1.resolveCollection)(ctx, ws.id, targetCollection) : resolved;
+        const moving = destination.item.id !== resolved.item.id;
+        const parentFolder = parent ? await (0, lookups_js_1.resolveFolder)(ctx, ws.id, destination.item.id, parent) : null;
         if (parentFolder && parentFolder.item.id === target.item.id)
             throw new errors_js_1.ToolInputError("FOLDER_CYCLE", "A folder cannot be its own parent.");
         const updated = await ctx.api.updateFolder(ws.id, target.item.id, {
             ...(name !== undefined ? { name: name.trim() } : {}),
-            ...(parent !== undefined ? { parentId: parentFolder?.item.id ?? null } : {}),
+            ...(parent !== undefined || moving ? { parentId: parentFolder?.item.id ?? null } : {}),
+            ...(moving ? { collectionId: destination.item.id } : {}),
         });
         ctx.invalidate(`tree:${ws.id}:${resolved.item.id}`);
+        if (moving) {
+            ctx.invalidate(`tree:${ws.id}:${destination.item.id}`);
+            ctx.invalidate(`collections:${ws.id}`);
+        }
         return (0, shared_js_1.ok)({ folder: { id: updated.id, name: updated.name, parentId: updated.parentId }, resolved: [(0, resolve_js_1.resolvedSummary)(collection, resolved), (0, resolve_js_1.resolvedSummary)(folder, target)] });
     }));
     server.registerTool("delete_collection", {
@@ -175,12 +189,11 @@ const registerCollectionTools = (server, ctx) => {
         annotations: shared_js_1.DESTRUCTIVE,
     }, (0, shared_js_1.guarded)(async ({ workspace, collection, confirm }) => {
         (0, shared_js_1.requireConfirm)(confirm, "a collection");
-        const ws = await ctx.resolveWorkspace(workspace);
-        const resolved = await (0, lookups_js_1.resolveCollection)(ctx, ws.id, collection);
+        const { ws, value: resolved } = await (0, lookups_js_1.findCollection)(ctx, workspace, collection, { exact: true });
         await ctx.api.deleteCollection(ws.id, resolved.item.id);
         ctx.invalidate(`collections:${ws.id}`);
         ctx.invalidate(`tree:${ws.id}:${resolved.item.id}`);
-        return (0, shared_js_1.ok)({ deleted: { id: resolved.item.id, name: resolved.item.name }, resolved: [(0, resolve_js_1.resolvedSummary)(collection, resolved)] });
+        return (0, shared_js_1.ok)({ deleted: { id: resolved.item.id, name: resolved.item.name }, workspace: (0, lookups_js_1.workspaceTag)(ws), resolved: [(0, resolve_js_1.resolvedSummary)(collection, resolved)] });
     }));
     server.registerTool("delete_folder", {
         title: "Delete a folder",
@@ -189,15 +202,14 @@ const registerCollectionTools = (server, ctx) => {
         annotations: shared_js_1.DESTRUCTIVE,
     }, (0, shared_js_1.guarded)(async ({ workspace, collection, folder, confirm }) => {
         (0, shared_js_1.requireConfirm)(confirm, "a folder");
-        const ws = await ctx.resolveWorkspace(workspace);
-        const resolved = await (0, lookups_js_1.resolveCollection)(ctx, ws.id, collection);
-        const target = await (0, lookups_js_1.resolveFolder)(ctx, ws.id, resolved.item.id, folder);
+        const { ws, value: resolved } = await (0, lookups_js_1.findCollection)(ctx, workspace, collection);
+        const target = await (0, lookups_js_1.resolveFolder)(ctx, ws.id, resolved.item.id, folder, { exact: true });
         if (!target)
             throw new errors_js_1.ToolInputError("REF_REQUIRED", "folder is required.");
         await ctx.api.deleteFolder(ws.id, target.item.id);
         ctx.invalidate(`tree:${ws.id}:${resolved.item.id}`);
         ctx.invalidate(`collections:${ws.id}`);
-        return (0, shared_js_1.ok)({ deleted: { id: target.item.id, name: target.item.name, path: target.item.path }, resolved: [(0, resolve_js_1.resolvedSummary)(collection, resolved), (0, resolve_js_1.resolvedSummary)(folder, target)] });
+        return (0, shared_js_1.ok)({ deleted: { id: target.item.id, name: target.item.name, path: target.item.path }, workspace: (0, lookups_js_1.workspaceTag)(ws), resolved: [(0, resolve_js_1.resolvedSummary)(collection, resolved), (0, resolve_js_1.resolvedSummary)(folder, target)] });
     }));
 };
 exports.registerCollectionTools = registerCollectionTools;