callman-mcp 0.1.0 → 0.2.0

package/dist-cjs/tools/lookups.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.sameName = exports.resolveDiagram = exports.loadDiagrams = exports.resolveScenarioFolder = exports.resolveScenario = exports.loadScenarioCatalog = exports.resolveEnvironment = exports.loadEnvironments = exports.resolveRequest = exports.searchRequests = exports.requestIdsInFolder = exports.resolveFolder = exports.loadTree = exports.resolveCollection = exports.loadCollections = void 0;
+exports.sameName = exports.connectionResolverFor = exports.loadConnections = exports.resolveDiagram = exports.loadDiagrams = exports.resolveScenarioFolder = exports.resolveScenario = exports.loadScenarioCatalog = exports.resolveEnvironment = exports.loadEnvironments = exports.resolveRequest = exports.searchRequests = exports.requestIdsInFolder = exports.resolveFolder = exports.loadTree = exports.resolveCollection = exports.findEnvironment = exports.findRequest = exports.findCollection = exports.findInWorkspaces = exports.workspaceTag = exports.workspacesForListing = exports.isAllWorkspaces = exports.loadCollections = void 0;
+const errors_js_1 = require("../client/errors.js");
+const requestIntegrations_js_1 = require("../domain/requestIntegrations.js");
 const resolve_js_1 = require("../domain/resolve.js");
 const ids_js_1 = require("../lib/ids.js");
 const truncate_js_1 = require("../lib/truncate.js");
@@ -9,7 +11,106 @@ const truncate_js_1 = require("../lib/truncate.js");
 // prefixes it touches so the next read is fresh.
 const loadCollections = (ctx, ws) => ctx.cache.getOrSet(`collections:${ws}`, () => ctx.api.listAllCollections(ws));
 exports.loadCollections = loadCollections;
-const resolveCollection = async (ctx, ws, ref) => {
+// ── across workspaces ──────────────────────────────────────────────────
+// A personal token acts in EVERY workspace the user belongs to. Reads span
+// all of them; the session default only orders them and wins ties.
+// `workspace: "all"` (or "*") asks a listing for every workspace explicitly.
+const isAllWorkspaces = (ref) => Boolean(ref && ["all", "*", "any"].includes(ref.trim().toLowerCase()));
+exports.isAllWorkspaces = isAllWorkspaces;
+const workspacesForListing = async (ctx, explicit) => {
+    if (explicit && explicit.trim() && !(0, exports.isAllWorkspaces)(explicit))
+        return [await ctx.resolveWorkspace(explicit)];
+    const workspaces = await ctx.listWorkspaces();
+    const preferred = ctx.getDefaultWorkspaceId();
+    return [...workspaces].sort((a, b) => Number(b.id === preferred) - Number(a.id === preferred));
+};
+exports.workspacesForListing = workspacesForListing;
+const workspaceTag = (ws) => ({ id: ws.id, name: ws.name });
+exports.workspaceTag = workspaceTag;
+// Find something the model named (a collection, request, environment…).
+// `workspace` given → only there. Otherwise the default workspace first — an
+// exact or id match there wins at once; then every other workspace: a unique
+// match anywhere is used, the same name in several workspaces comes back as
+// candidates tagged with their workspace. A workspace where the thing is
+// missing (404 / REF_NOT_FOUND) is simply skipped.
+const findInWorkspaces = async (ctx, explicit, kind, ref, find, options = {}) => {
+    if (explicit && explicit.trim() && !(0, exports.isAllWorkspaces)(explicit)) {
+        const ws = await ctx.resolveWorkspace(explicit);
+        return { ws, value: await find(ws) };
+    }
+    const order = await (0, exports.workspacesForListing)(ctx, null);
+    if (order.length === 0)
+        throw new errors_js_1.ToolInputError("WORKSPACE_NONE", "You are not a member of any workspace.");
+    const preferred = ctx.getDefaultWorkspaceId();
+    const hits = [];
+    const ambiguous = [];
+    for (const ws of order) {
+        let value;
+        try {
+            value = await find(ws);
+        }
+        catch (error) {
+            if (error instanceof errors_js_1.ToolInputError && error.code === "REF_NOT_FOUND")
+                continue;
+            if (error instanceof errors_js_1.ToolInputError && error.code === "REF_AMBIGUOUS") {
+                ambiguous.push({ ws, error });
+                continue;
+            }
+            if (error instanceof errors_js_1.CallmanApiError && (error.status === 404 || error.status === 403))
+                continue;
+            throw error;
+        }
+        const matched = options.matchOf?.(value);
+        if (matched === "id" || (ws.id === preferred && matched !== "partial")) {
+            return { ws, value, ...(ws.id !== preferred && order.length > 1 ? { note: `found in workspace "${ws.name}"` } : {}) };
+        }
+        hits.push({ ws, value, matched });
+    }
+    const exact = hits.filter((hit) => hit.matched !== "partial");
+    const pool = exact.length > 0 ? exact : hits;
+    // Ambiguous inside ONE workspace and nothing elsewhere: that workspace's
+    // own candidate list, tagged with where it is.
+    if (pool.length === 0 && ambiguous.length === 1) {
+        const [{ ws, error }] = ambiguous;
+        throw new errors_js_1.ToolInputError(error.code, order.length > 1 ? `${error.message} (in workspace "${ws.name}")` : error.message, { ...(error.data ?? {}), workspace: (0, exports.workspaceTag)(ws) });
+    }
+    if (pool.length === 1 && ambiguous.length === 0) {
+        const [hit] = pool;
+        return { ws: hit.ws, value: hit.value, ...(hit.ws.id !== preferred && order.length > 1 ? { note: `found in workspace "${hit.ws.name}"` } : {}) };
+    }
+    if (pool.length > 1 || ambiguous.length > 0) {
+        throw new errors_js_1.ToolInputError("REF_AMBIGUOUS", `"${ref}" matches ${kind}s in several places — pass \`workspace\` (name or id), or use the id.`, {
+            kind,
+            ref,
+            candidates: [
+                ...pool.map((hit) => ({ workspace: (0, exports.workspaceTag)(hit.ws), ...(options.describe?.(hit.value) ?? {}) })),
+                ...ambiguous.map((entry) => ({ workspace: (0, exports.workspaceTag)(entry.ws), candidates: entry.error.data?.candidates })),
+            ],
+        });
+    }
+    throw new errors_js_1.ToolInputError("REF_NOT_FOUND", `No ${kind} matches "${ref}" in ${order.length === 1 ? "your workspace" : `any of your ${order.length} workspaces`}.`, {
+        kind,
+        ref,
+        searchedWorkspaces: order.map(exports.workspaceTag),
+    });
+};
+exports.findInWorkspaces = findInWorkspaces;
+const findCollection = (ctx, workspace, ref, options = {}) => (0, exports.findInWorkspaces)(ctx, workspace, "collection", ref, (ws) => (0, exports.resolveCollection)(ctx, ws.id, ref, options), {
+    matchOf: (resolved) => resolved.matched,
+    describe: (resolved) => ({ id: resolved.item.id, name: resolved.item.name }),
+});
+exports.findCollection = findCollection;
+const findRequest = (ctx, workspace, ref, collectionRef, options = {}) => (0, exports.findInWorkspaces)(ctx, workspace, "request", ref, (ws) => (0, exports.resolveRequest)(ctx, ws.id, ref, collectionRef, options), {
+    matchOf: (resolved) => resolved.matched,
+    describe: (resolved) => ({ id: resolved.request.id, name: resolved.request.name, method: resolved.request.method, url: resolved.request.url }),
+});
+exports.findRequest = findRequest;
+const findEnvironment = (ctx, workspace, ref, options = {}) => (0, exports.findInWorkspaces)(ctx, workspace, "environment", ref, (ws) => (0, exports.resolveEnvironment)(ctx, ws.id, ref, options), {
+    matchOf: (resolved) => resolved.matched,
+    describe: (resolved) => ({ id: resolved.item.id, name: resolved.item.name }),
+});
+exports.findEnvironment = findEnvironment;
+const resolveCollection = async (ctx, ws, ref, options = {}) => {
     const collections = await (0, exports.loadCollections)(ctx, ws);
     if ((0, ids_js_1.isObjectId)(ref) && !collections.some((collection) => collection.id === ref)) {
         // Not in the cached list (just created?) — let the server decide.
@@ -23,6 +124,7 @@ const resolveCollection = async (ctx, ws, ref) => {
     }
     return (0, resolve_js_1.resolveRef)("collection", ref, collections, {
         describe: (collection) => ({ requestCount: collection.requestCount ?? null }),
+        exact: options.exact,
     });
 };
 exports.resolveCollection = resolveCollection;
@@ -31,11 +133,11 @@ const loadTree = (ctx, ws, collectionId) => ctx.cache.getOrSet(`tree:${ws}:${col
     return { folders: (0, resolve_js_1.flattenFolderTree)(folderTree.tree ?? []), requests };
 });
 exports.loadTree = loadTree;
-const resolveFolder = async (ctx, ws, collectionId, ref) => {
+const resolveFolder = async (ctx, ws, collectionId, ref, options = {}) => {
     if (!ref || !ref.trim())
         return null;
     const tree = await (0, exports.loadTree)(ctx, ws, collectionId);
-    return (0, resolve_js_1.resolveFolderRef)(ref, tree.folders);
+    return (0, resolve_js_1.resolveFolderRef)(ref, tree.folders, options.exact);
 };
 exports.resolveFolder = resolveFolder;
 // Request ids inside a folder, subfolders included.
@@ -85,9 +187,9 @@ const searchRequests = async (ctx, ws, query, collectionId, limit = truncate_js_
 exports.searchRequests = searchRequests;
 // A request reference: an id (fetched directly) or a name — unique across the
 // given collection, or across the workspace when no collection is given.
-const resolveRequest = async (ctx, ws, ref, collectionRef) => {
+const resolveRequest = async (ctx, ws, ref, collectionRef, options = {}) => {
     if ((0, ids_js_1.isObjectId)(ref)) {
-        return { request: await ctx.api.getRequest(ws, ref) };
+        return { request: await ctx.api.getRequest(ws, ref), matched: "id" };
     }
     const collectionId = collectionRef ? (await (0, exports.resolveCollection)(ctx, ws, collectionRef)).item.id : null;
     const collections = await (0, exports.loadCollections)(ctx, ws);
@@ -101,14 +203,16 @@ const resolveRequest = async (ctx, ws, ref, collectionRef) => {
     const resolved = (0, resolve_js_1.resolveRef)("request", ref, candidates, {
         describe: (request) => ({ method: request.method, url: request.url, collection: request.collectionName }),
         aliases: (request) => [`${request.method} ${request.url}`, request.url],
+        exact: options.exact,
     });
-    return { request: await ctx.api.getRequest(ws, resolved.item.id), annotation: resolved.annotation };
+    return { request: await ctx.api.getRequest(ws, resolved.item.id), annotation: resolved.annotation, matched: resolved.matched };
 };
 exports.resolveRequest = resolveRequest;
-const loadEnvironments = (ctx, ws) => ctx.cache.getOrSet(`environments:${ws}`, async () => (await ctx.api.listEnvironments(ws)).items);
+const loadEnvironments = (ctx, ws) => ctx.cache.getOrSet(`environments:${ws}`, () => ctx.api.listAllEnvironments(ws));
 exports.loadEnvironments = loadEnvironments;
-const resolveEnvironment = async (ctx, ws, ref) => (0, resolve_js_1.resolveRef)("environment", ref, await (0, exports.loadEnvironments)(ctx, ws), {
+const resolveEnvironment = async (ctx, ws, ref, options = {}) => (0, resolve_js_1.resolveRef)("environment", ref, await (0, exports.loadEnvironments)(ctx, ws), {
     describe: (environment) => ({ variables: environment.variables.length }),
+    exact: options.exact,
 });
 exports.resolveEnvironment = resolveEnvironment;
 const loadScenarioCatalog = (ctx, ws) => ctx.cache.getOrSet(`scenarios:${ws ?? "-"}`, async () => {
@@ -120,7 +224,7 @@ const loadScenarioCatalog = (ctx, ws) => ctx.cache.getOrSet(`scenarios:${ws ?? "
     return { scenarios, folders };
 });
 exports.loadScenarioCatalog = loadScenarioCatalog;
-const resolveScenario = async (ctx, ws, ref) => {
+const resolveScenario = async (ctx, ws, ref, options = {}) => {
     if ((0, ids_js_1.isObjectId)(ref)) {
         return { item: await ctx.api.getScenario(ws, ref), matched: "id" };
     }
@@ -128,6 +232,7 @@ const resolveScenario = async (ctx, ws, ref) => {
     const folderName = new Map(folders.map((folder) => [folder.id, folder.name]));
     return (0, resolve_js_1.resolveRef)("scenario", ref, scenarios, {
         describe: (scenario) => ({ folder: scenario.folderId ? (folderName.get(scenario.folderId) ?? null) : null, reviewStatus: scenario.reviewStatus }),
+        exact: options.exact,
     });
 };
 exports.resolveScenario = resolveScenario;
@@ -135,15 +240,22 @@ const resolveScenarioFolder = async (ctx, ws, ref) => (0, resolve_js_1.resolveRe
 exports.resolveScenarioFolder = resolveScenarioFolder;
 const loadDiagrams = (ctx) => ctx.cache.getOrSet("diagrams", () => ctx.api.listDiagrams());
 exports.loadDiagrams = loadDiagrams;
-const resolveDiagram = async (ctx, ref) => {
+const resolveDiagram = async (ctx, ref, options = {}) => {
     if ((0, ids_js_1.isObjectId)(ref))
         return { item: await ctx.api.getDiagram(ref), matched: "id" };
     const resolved = (0, resolve_js_1.resolveRef)("diagram", ref, await (0, exports.loadDiagrams)(ctx), {
         describe: (diagram) => ({ canEdit: diagram.canEdit }),
+        exact: options.exact,
     });
     // The list carries the document too, but fetch by id for the freshest copy.
     return { ...resolved, item: await ctx.api.getDiagram(resolved.item.id) };
 };
 exports.resolveDiagram = resolveDiagram;
+const loadConnections = (ctx, ws) => ctx.cache.getOrSet(`connections:${ws}`, () => ctx.api.listConnections(ws));
+exports.loadConnections = loadConnections;
+// Connection resolver for request integration steps — loaded only when a
+// request actually names a connection.
+const connectionResolverFor = async (ctx, ws, needed) => needed ? (0, requestIntegrations_js_1.connectionResolver)(await (0, exports.loadConnections)(ctx, ws)) : undefined;
+exports.connectionResolverFor = connectionResolverFor;
 const sameName = (a, b) => (0, ids_js_1.normalizeName)(a) === (0, ids_js_1.normalizeName)(b);
 exports.sameName = sameName;

package/dist-cjs/tools/meta.js

@@ -46,8 +46,9 @@ const registerMetaTools = (server, ctx) => {
         const me = meResult.value;
         const workspaces = workspacesResult.status === "fulfilled" ? workspacesResult.value : [];
         const features = featuresResult.status === "fulfilled" ? featuresResult.value.features : {};
-        const defaultWorkspace = ctx.config.defaultWorkspaceId
-            ? (workspaces.find((workspace) => workspace.id === ctx.config.defaultWorkspaceId) ?? null)
+        const preferred = ctx.getDefaultWorkspaceId();
+        const defaultWorkspace = preferred
+            ? (workspaces.find((workspace) => workspace.id === preferred) ?? null)
             : workspaces.length === 1
                 ? workspaces[0]
                 : null;
@@ -69,8 +70,12 @@ const registerMetaTools = (server, ctx) => {
                 isDefault: workspace.id === defaultWorkspace?.id,
             })),
             defaultWorkspaceId: defaultWorkspace?.id ?? null,
-            ...(workspaces.length > 1 && !defaultWorkspace
-                ? { note: "Several workspaces and no default: pass `workspace` to tools or set CALLMAN_WORKSPACE_ID." }
+            ...(workspaces.length > 1
+                ? {
+                    workspaceScope: `This token works in all ${workspaces.length} of your workspaces. Lists and searches cover every workspace unless you pass \`workspace\`; a name is looked up in the default workspace first, then in all others. ${defaultWorkspace
+                        ? `The default ("${defaultWorkspace.name}") only decides where NEW things go and wins a name that exists in several workspaces`
+                        : "There is no default, so creating something needs `workspace`"} — change it for this session with use_workspace.`,
+                }
                 : {}),
             features,
             localRun: ctx.config.allowLocalRun,

package/dist-cjs/tools/requests.js

@@ -4,8 +4,10 @@ exports.registerRequestTools = void 0;
 const zod_1 = require("zod");
 const errors_js_1 = require("../client/errors.js");
 const requestShape_js_1 = require("../domain/requestShape.js");
+const strict_js_1 = require("../lib/strict.js");
 const resolve_js_1 = require("../domain/resolve.js");
 const truncate_js_1 = require("../lib/truncate.js");
+const requestIntegrations_js_1 = require("../domain/requestIntegrations.js");
 const lookups_js_1 = require("./lookups.js");
 const shared_js_1 = require("./shared.js");
 const BULK_MAX = 5000;
@@ -13,7 +15,7 @@ const MOVE_MAX = 200;
 const registerRequestTools = (server, ctx) => {
     server.registerTool("search_requests", {
         title: "Search requests",
-        description: "Find saved requests by words in their name, method or URL (all words must match), across the workspace or inside one collection. Returns up to 50 matches with ids you can pass to get_request / run_request.",
+        description: "Find saved requests by words in their name, method or URL (all words must match) — across ALL your workspaces, one `workspace`, or inside one collection. Returns up to 50 matches (each with its collection and workspace) with ids you can pass to get_request / run_request.",
         inputSchema: {
             workspace: shared_js_1.workspaceArg,
             query: zod_1.z.string().min(1).max(200).describe("e.g. \"POST login\", \"users\", \"GET /orders\""),
@@ -22,19 +24,28 @@ const registerRequestTools = (server, ctx) => {
         },
         annotations: shared_js_1.READ,
     }, (0, shared_js_1.guarded)(async ({ workspace, query, collection, limit }) => {
-        const ws = await ctx.resolveWorkspace(workspace);
-        const scope = collection ? await (0, lookups_js_1.resolveCollection)(ctx, ws.id, collection) : null;
-        const matches = await (0, lookups_js_1.searchRequests)(ctx, ws.id, query, scope?.item.id ?? null, limit ?? truncate_js_1.LIMITS.SEARCH_RESULTS);
+        const max = limit ?? truncate_js_1.LIMITS.SEARCH_RESULTS;
+        const scoped = collection ? await (0, lookups_js_1.findCollection)(ctx, workspace, collection) : null;
+        const workspaces = scoped ? [scoped.ws] : await (0, lookups_js_1.workspacesForListing)(ctx, workspace);
+        const matches = [];
+        for (const ws of workspaces) {
+            if (matches.length >= max)
+                break;
+            for (const match of await (0, lookups_js_1.searchRequests)(ctx, ws.id, query, scoped?.value.item.id ?? null, max - matches.length))
+                matches.push({ ...match, ws });
+        }
+        const scope = scoped?.value ?? null;
         return (0, shared_js_1.ok)({
             query,
             ...(scope ? { collection: { id: scope.item.id, name: scope.item.name } } : {}),
-            matches: matches.map((request) => ({ ...(0, requestShape_js_1.requestSummaryView)(request), collection: request.collectionName })),
-            ...(matches.length >= (limit ?? truncate_js_1.LIMITS.SEARCH_RESULTS) ? { truncated: true } : {}),
+            ...(workspaces.length > 1 ? { searchedWorkspaces: workspaces.length } : { workspace: (0, lookups_js_1.workspaceTag)(workspaces[0]) }),
+            matches: matches.map((request) => ({ ...(0, requestShape_js_1.requestSummaryView)(request), collection: request.collectionName, ...(workspaces.length > 1 ? { workspace: (0, lookups_js_1.workspaceTag)(request.ws) } : {}) })),
+            ...(matches.length >= max ? { truncated: true } : {}),
         });
     }));
     server.registerTool("get_request", {
         title: "Get a request",
-        description: "Read one saved request: url, headers, query, body, auth (secrets masked unless reveal:true and the token holds requests:read + the request's own permissions), scripts. `full: true` returns untruncated body and scripts.",
+        description: "Read one saved request in the SAME shape create_request / update_request accept: url, headers, query, pathVariables, body (a JSON value or { mode, … }), auth ({ type, token | username/password | key/value/location | oauth2 fields }), scripts, isEnabledInRunner, plus which database / Kafka / Redis steps it has. Secrets in auth and sensitive headers are masked (••••ab) unless reveal: true — sending a masked value back unchanged keeps the stored secret. A long body comes back as bodyPreview (body: null) unless full: true.",
         inputSchema: {
             workspace: shared_js_1.workspaceArg,
             request: (0, shared_js_1.refArg)("Request", "(name, \"METHOD url\" or id)"),
@@ -44,38 +55,52 @@ const registerRequestTools = (server, ctx) => {
         },
         annotations: shared_js_1.READ,
     }, (0, shared_js_1.guarded)(async ({ workspace, request, collection, full, reveal }) => {
-        const ws = await ctx.resolveWorkspace(workspace);
-        const { request: found, annotation } = await (0, lookups_js_1.resolveRequest)(ctx, ws.id, request, collection);
-        return (0, shared_js_1.ok)({ request: (0, requestShape_js_1.compactRequestView)(found, { full, reveal }), ...(annotation ? { resolved: [{ input: request, matched: found.name, id: found.id, note: annotation }] } : {}) });
+        const { ws, value, note } = await (0, lookups_js_1.findRequest)(ctx, workspace, request, collection);
+        const { request: found, annotation } = value;
+        return (0, shared_js_1.ok)({
+            request: (0, requestShape_js_1.compactRequestView)(found, { full, reveal }),
+            workspace: (0, lookups_js_1.workspaceTag)(ws),
+            ...(annotation || note ? { resolved: [{ input: request, matched: found.name, id: found.id, note: [annotation, note].filter(Boolean).join("; ") }] } : {}),
+        });
     }));
     server.registerTool("create_request", {
         title: "Create a request",
-        description: "Create one saved request in a collection (optionally inside a folder by id, name or path). Body may be a JSON value, a raw string, or { mode: raw|formdata|urlencoded }. Use {{variable}} for hosts and secrets and put the values in an environment. For many requests use create_requests_bulk (one call, atomic).",
+        description: "Create one saved request in a collection (optionally inside a folder by id, name or path): method, url, headers, query, path variables, body (a JSON value, a raw string, or { mode: raw|formdata|urlencoded|json }), auth (bearer, basic, apiKey, oauth2), pre-request / post-response / tests scripts, and optional database / Kafka / Redis steps and DB assertions (connections by id or name — list_connections). Use {{variable}} for hosts and secrets and put the values in an environment. Contract checks are added with add_contract_rules / set_data_contract. For many requests use create_requests_bulk (one call, atomic). Reference: callman://docs/request-schema.",
         inputSchema: { workspace: shared_js_1.workspaceArg, collection: (0, shared_js_1.refArg)("Collection"), ...requestShape_js_1.requestInputSchema.omit({ folderKey: true }).shape },
         annotations: shared_js_1.WRITE,
     }, (0, shared_js_1.guarded)(async ({ workspace, collection, ...item }) => {
-        const ws = await ctx.resolveWorkspace(workspace);
-        const resolved = await (0, lookups_js_1.resolveCollection)(ctx, ws.id, collection);
+        const { ws, value: resolved, note } = await (0, lookups_js_1.findCollection)(ctx, workspace, collection);
         const folder = await (0, lookups_js_1.resolveFolder)(ctx, ws.id, resolved.item.id, item.folder);
-        const created = await ctx.api.createRequest(ws.id, (0, requestShape_js_1.toCreateRequestPayload)(item, { collectionId: resolved.item.id, folderId: folder?.item.id ?? null }));
+        const input = (0, requestShape_js_1.resolveMaskedValues)(item);
+        const resolve = await (0, lookups_js_1.connectionResolverFor)(ctx, ws.id, (0, requestIntegrations_js_1.hasIntegrations)(input));
+        const { payload, warnings } = (0, requestShape_js_1.toCreateRequestPayload)(input, { collectionId: resolved.item.id, folderId: folder?.item.id ?? null }, resolve);
+        let created = await ctx.api.createRequest(ws.id, payload);
+        if (input.isEnabledInRunner === false)
+            created = await ctx.api.setRequestRunState(ws.id, created.id, false);
         ctx.invalidate(`tree:${ws.id}:${resolved.item.id}`);
         ctx.invalidate(`collections:${ws.id}`);
         return (0, shared_js_1.ok)({
-            request: (0, requestShape_js_1.requestSummaryView)(created),
+            request: { ...(0, requestShape_js_1.requestSummaryView)(created), isEnabledInRunner: created.isEnabledInRunner !== false },
             collection: { id: resolved.item.id, name: resolved.item.name },
+            workspace: (0, lookups_js_1.workspaceTag)(ws),
             ...(folder ? { folder: { id: folder.item.id, path: folder.item.path } } : {}),
-            resolved: [(0, resolve_js_1.resolvedSummary)(collection, resolved), ...(folder && item.folder ? [(0, resolve_js_1.resolvedSummary)(item.folder, folder)] : [])],
+            ...(warnings.length > 0 ? { warnings } : {}),
+            resolved: [(0, resolve_js_1.resolvedSummary)(collection, resolved), ...(note ? [{ input: collection, note }] : []), ...(folder && item.folder ? [(0, resolve_js_1.resolvedSummary)(item.folder, folder)] : [])],
         });
     }));
     server.registerTool("create_requests_bulk", {
         title: "Create many requests",
-        description: "Create many requests at once. Either `collectionName` (creates a NEW collection with an optional folder skeleton — atomic: all or nothing) or `collection` (adds to an EXISTING one; each request may name a `folder`). Requests reference folders by `folderKey` (new collection) or `folder` (existing). Use dryRun: true first for large sets.",
+        description: "Create many requests at once. Either `collectionName` (creates a NEW collection with an optional `folders` skeleton — atomic: all or nothing; requests pick a folder with `folderKey`) or `collection` (adds to an EXISTING one, one request at a time; requests pick a folder with `folder`). Mixing the two folder styles is an error. Each request takes the same fields as create_request. Use dryRun: true first for large sets.",
         inputSchema: {
             workspace: shared_js_1.workspaceArg,
             collectionName: zod_1.z.string().min(1).max(truncate_js_1.LIMITS.NAME).optional().describe("Create a new collection with this name"),
             collection: zod_1.z.string().max(200).optional().describe("Add to this existing collection (id or name)"),
             folders: zod_1.z
-                .array(zod_1.z.object({ key: zod_1.z.string().min(1).max(120), name: zod_1.z.string().min(1).max(truncate_js_1.LIMITS.NAME), parentKey: zod_1.z.string().max(120).optional() }))
+                .array((0, strict_js_1.strictObject)({
+                key: zod_1.z.string().min(1).max(120).describe("Your own key, referenced by requests[].folderKey and folders[].parentKey"),
+                name: zod_1.z.string().min(1).max(truncate_js_1.LIMITS.NAME),
+                parentKey: zod_1.z.string().max(120).optional().describe("key of the parent folder (declared in this list)"),
+            }, "folder field"))
                 .max(200)
                 .optional()
                 .describe("New-collection mode only: folder skeleton; requests use folderKey"),
@@ -87,13 +112,32 @@ const registerRequestTools = (server, ctx) => {
         if ((collectionName ? 1 : 0) + (collection ? 1 : 0) !== 1) {
             throw new errors_js_1.ToolInputError("TARGET_REQUIRED", "Pass exactly one of collectionName (new collection) or collection (existing).");
         }
-        const ws = await ctx.resolveWorkspace(workspace);
+        // An existing collection decides the workspace; a new one needs a target.
+        const target = collection ? await (0, lookups_js_1.findCollection)(ctx, workspace, collection) : null;
+        const ws = target ? target.ws : await ctx.resolveWorkspace(workspace);
         const folderKeys = new Set((folders ?? []).map((folder) => folder.key));
+        for (const folder of folders ?? []) {
+            if (folder.parentKey && !folderKeys.has(folder.parentKey)) {
+                throw new errors_js_1.ToolInputError("FOLDER_KEY_UNKNOWN", `Folder "${folder.name}" has parentKey "${folder.parentKey}", which is not a key in folders.`);
+            }
+        }
+        if (collection && folders && folders.length > 0) {
+            throw new errors_js_1.ToolInputError("FOLDERS_NEED_NEW_COLLECTION", "`folders` only applies with collectionName (a new collection). To file requests into an existing collection's folders, give each request a `folder` (id, name or path); create missing folders with create_folder first.");
+        }
         for (const [index, request] of requests.entries()) {
+            if (collectionName && request.folder) {
+                throw new errors_js_1.ToolInputError("FOLDER_NEEDS_EXISTING_COLLECTION", `requests[${index}].folder only applies with \`collection\` (an existing collection). In a new collection declare \`folders\` and use folderKey.`);
+            }
+            if (collection && request.folderKey) {
+                throw new errors_js_1.ToolInputError("FOLDER_KEY_NEEDS_NEW_COLLECTION", `requests[${index}].folderKey only applies with collectionName. For an existing collection use \`folder\` (id, name or path).`);
+            }
             if (request.folderKey && !folderKeys.has(request.folderKey)) {
                 throw new errors_js_1.ToolInputError("FOLDER_KEY_UNKNOWN", `requests[${index}] references folderKey "${request.folderKey}" which is not declared in folders.`);
             }
         }
+        const inputs = requests.map((request) => (0, requestShape_js_1.resolveMaskedValues)(request));
+        const disabled = inputs.filter((request) => request.isEnabledInRunner === false);
+        const resolve = await (0, lookups_js_1.connectionResolverFor)(ctx, ws.id, inputs.some(requestIntegrations_js_1.hasIntegrations));
         if (collectionName) {
             const existing = (await (0, lookups_js_1.loadCollections)(ctx, ws.id)).find((entry) => (0, lookups_js_1.sameName)(entry.name, collectionName));
             if (existing) {
@@ -104,20 +148,44 @@ const registerRequestTools = (server, ctx) => {
             const payload = {
                 collectionName: collectionName.trim(),
                 ...(folders && folders.length > 0 ? { folders } : {}),
-                requests: requests.map(requestShape_js_1.toFlatImportRequest),
+                requests: inputs.map((request) => (0, requestShape_js_1.toFlatImportRequest)(request, resolve)),
             };
             if (dryRun) {
                 return (0, shared_js_1.ok)({ dryRun: true, mode: "new-collection", collectionName, folderCount: folders?.length ?? 0, requestCount: requests.length, sample: requests.slice(0, 5).map((request) => `${request.method} ${request.name}`) });
             }
             const result = await ctx.api.importJson(ws.id, { format: "requests", payload });
             ctx.invalidate(`collections:${ws.id}`);
+            // The import route always stores isEnabledInRunner: true — apply the
+            // requested "off" switches afterwards, matched by name + folder.
+            const runnerOff = [];
+            const runnerWarnings = [];
+            if (disabled.length > 0) {
+                ctx.invalidate(`tree:${ws.id}:${result.collection.id}`);
+                const tree = await (0, lookups_js_1.loadTree)(ctx, ws.id, result.collection.id);
+                const folderIdByKey = new Map();
+                for (const folder of folders ?? [])
+                    folderIdByKey.set(folder.key, tree.folders.find((entry) => (0, lookups_js_1.sameName)(entry.name, folder.name))?.id ?? null);
+                for (const request of disabled) {
+                    const folderId = request.folderKey ? (folderIdByKey.get(request.folderKey) ?? null) : null;
+                    const row = tree.requests.find((entry) => (0, lookups_js_1.sameName)(entry.name, request.name) && (entry.folderId ?? null) === folderId);
+                    if (!row) {
+                        runnerWarnings.push(`Could not find "${request.name}" after import to turn it off in the runner — use update_request isEnabledInRunner: false.`);
+                        continue;
+                    }
+                    await ctx.api.setRequestRunState(ws.id, row.id, false);
+                    runnerOff.push(request.name);
+                }
+            }
             return (0, shared_js_1.ok)({
                 collection: { id: result.collection.id, name: result.collection.name },
+                workspace: (0, lookups_js_1.workspaceTag)(ws),
                 created: result.importedCounts,
+                ...(runnerOff.length > 0 ? { disabledInRunner: runnerOff } : {}),
+                ...(runnerWarnings.length > 0 ? { warnings: runnerWarnings } : {}),
                 note: "Created atomically. Open the collection in the desktop app (it refreshes when it regains focus).",
             });
         }
-        const resolved = await (0, lookups_js_1.resolveCollection)(ctx, ws.id, collection);
+        const resolved = target.value;
         const tree = await (0, lookups_js_1.loadTree)(ctx, ws.id, resolved.item.id);
         // Resolve every folder reference up front so a typo fails before any write.
         const folderIdByRef = new Map();
@@ -140,13 +208,18 @@ const registerRequestTools = (server, ctx) => {
         }
         const created = [];
         const failed = [];
-        for (const request of requests) {
+        const warnings = [];
+        for (const request of inputs) {
             try {
-                const row = await ctx.api.createRequest(ws.id, (0, requestShape_js_1.toCreateRequestPayload)(request, { collectionId: resolved.item.id, folderId: folderIdByRef.get(request.folder ?? "") ?? null }));
+                const built = (0, requestShape_js_1.toCreateRequestPayload)(request, { collectionId: resolved.item.id, folderId: folderIdByRef.get(request.folder ?? "") ?? null }, resolve);
+                const row = await ctx.api.createRequest(ws.id, built.payload);
+                if (request.isEnabledInRunner === false)
+                    await ctx.api.setRequestRunState(ws.id, row.id, false);
                 created.push({ id: row.id, name: row.name, method: row.method });
+                warnings.push(...built.warnings.map((warning) => `${request.name}: ${warning}`));
             }
             catch (error) {
-                failed.push({ name: request.name, error: error instanceof errors_js_1.CallmanApiError ? `${error.code}: ${error.message}` : error instanceof Error ? error.message : String(error) });
+                failed.push({ name: request.name, error: (0, shared_js_1.failureOf)(error) });
             }
         }
         ctx.invalidate(`tree:${ws.id}:${resolved.item.id}`);
@@ -156,13 +229,15 @@ const registerRequestTools = (server, ctx) => {
             created: created.length,
             failed,
             requests: created,
+            ...(warnings.length > 0 ? { warnings } : {}),
             ...(duplicates.length > 0 ? { note: `${duplicates.length} request name(s) already existed in the same folder and were created again: ${duplicates.map((request) => request.name).join(", ")}` } : {}),
-            resolved: [(0, resolve_js_1.resolvedSummary)(collection, resolved)],
+            workspace: (0, lookups_js_1.workspaceTag)(ws),
+            resolved: [(0, resolve_js_1.resolvedSummary)(collection, resolved), ...(target?.note ? [{ input: collection, note: target.note }] : [])],
         });
     }));
     server.registerTool("update_request", {
         title: "Update a request",
-        description: "Change fields of a saved request (only the fields you pass change). To move it, use move_requests. Sending `headers`/`query` replaces the whole list.",
+        description: "Change fields of a saved request — only the fields you pass change, in the same shape as create_request. `headers` / `query` / `pathVariables` / `dbAssertions` replace the whole list; `url` and `query` are kept in sync (a ?query in the url becomes rows). `database` / `kafka` merge: a phase or field you leave out is kept, null turns it off. A masked secret sent back unchanged keeps the stored value. isEnabledInRunner toggles the runner switch. To move it, use move_requests; contract checks: add_contract_rules / set_data_contract.",
         inputSchema: {
             workspace: shared_js_1.workspaceArg,
             request: (0, shared_js_1.refArg)("Request", "(name, \"METHOD url\" or id)"),
@@ -170,19 +245,30 @@ const registerRequestTools = (server, ctx) => {
         },
         annotations: shared_js_1.IDEMPOTENT_WRITE,
     }, (0, shared_js_1.guarded)(async ({ workspace, request, collection, ...changes }) => {
-        const ws = await ctx.resolveWorkspace(workspace);
-        const { request: found, annotation } = await (0, lookups_js_1.resolveRequest)(ctx, ws.id, request, collection);
-        const folder = changes.folder !== undefined ? await (0, lookups_js_1.resolveFolder)(ctx, ws.id, found.collectionId, changes.folder) : undefined;
-        const payload = (0, requestShape_js_1.toUpdateRequestPayload)(changes, { ...(folder !== undefined ? { folderId: folder?.item.id ?? null } : {}) });
-        if (Object.keys(payload).length === 0)
+        const { ws, value, note } = await (0, lookups_js_1.findRequest)(ctx, workspace, request, collection);
+        const { request: found, annotation } = value;
+        const input = (0, requestShape_js_1.resolveMaskedValues)(changes, found);
+        const folder = input.folder !== undefined ? await (0, lookups_js_1.resolveFolder)(ctx, ws.id, found.collectionId, input.folder) : undefined;
+        const resolve = await (0, lookups_js_1.connectionResolverFor)(ctx, ws.id, (0, requestIntegrations_js_1.hasIntegrations)(input));
+        const { payload, warnings } = (0, requestShape_js_1.toUpdateRequestPayload)(input, found, { ...(folder !== undefined ? { folderId: folder?.item.id ?? null } : {}) }, resolve);
+        const toggle = input.isEnabledInRunner !== undefined && input.isEnabledInRunner !== (found.isEnabledInRunner !== false);
+        if (Object.keys(payload).length === 0 && input.isEnabledInRunner === undefined)
             throw new errors_js_1.ToolInputError("NOTHING_TO_UPDATE", "Pass at least one field to change.");
-        const updated = await ctx.api.updateRequest(ws.id, found.id, payload);
+        let updated = Object.keys(payload).length > 0 ? await ctx.api.updateRequest(ws.id, found.id, payload) : found;
+        if (toggle)
+            updated = await ctx.api.setRequestRunState(ws.id, found.id, input.isEnabledInRunner);
         ctx.invalidate(`tree:${ws.id}:${found.collectionId}`);
-        return (0, shared_js_1.ok)({ request: (0, requestShape_js_1.compactRequestView)(updated), changed: Object.keys(payload), ...(annotation ? { resolved: [{ input: request, matched: found.name, id: found.id, note: annotation }] } : {}) });
+        return (0, shared_js_1.ok)({
+            request: (0, requestShape_js_1.compactRequestView)(updated),
+            changed: [...Object.keys(payload), ...(toggle ? ["isEnabledInRunner"] : [])],
+            ...(warnings.length > 0 ? { warnings } : {}),
+            workspace: (0, lookups_js_1.workspaceTag)(ws),
+            ...(annotation || note ? { resolved: [{ input: request, matched: found.name, id: found.id, note: [annotation, note].filter(Boolean).join("; ") }] } : {}),
+        });
     }));
     server.registerTool("move_requests", {
         title: "Move requests",
-        description: "Move up to 200 requests (ids or unique names) into a collection and optional folder.",
+        description: "Move up to 200 requests (ids or unique names) into a collection and optional folder of the same workspace (the target collection's).",
         inputSchema: {
             workspace: shared_js_1.workspaceArg,
             requests: zod_1.z.array(zod_1.z.string().min(1).max(500)).min(1).max(MOVE_MAX),
@@ -192,8 +278,8 @@ const registerRequestTools = (server, ctx) => {
         },
         annotations: shared_js_1.IDEMPOTENT_WRITE,
     }, (0, shared_js_1.guarded)(async ({ workspace, requests, targetCollection, targetFolder, sourceCollection }) => {
-        const ws = await ctx.resolveWorkspace(workspace);
-        const target = await (0, lookups_js_1.resolveCollection)(ctx, ws.id, targetCollection);
+        // Requests move within one workspace — the target collection's.
+        const { ws, value: target } = await (0, lookups_js_1.findCollection)(ctx, workspace, targetCollection);
         const folder = await (0, lookups_js_1.resolveFolder)(ctx, ws.id, target.item.id, targetFolder);
         const moved = [];
         const failed = [];
@@ -206,7 +292,7 @@ const registerRequestTools = (server, ctx) => {
                 moved.push({ id: updated.id, name: updated.name });
             }
             catch (error) {
-                failed.push({ request: ref, error: error instanceof Error ? error.message : String(error) });
+                failed.push({ request: ref, error: (0, shared_js_1.failureOf)(error) });
             }
         }
         for (const collectionId of touchedCollections)
@@ -216,7 +302,7 @@ const registerRequestTools = (server, ctx) => {
     }));
     server.registerTool("delete_requests", {
         title: "Delete requests",
-        description: "Delete up to 200 requests (ids or unique names). Permanent — confirm with the user first.",
+        description: "Delete up to 200 requests (ids or EXACT names — partial names are not accepted here). Permanent — confirm with the user first.",
         inputSchema: {
             workspace: shared_js_1.workspaceArg,
             requests: zod_1.z.array(zod_1.z.string().min(1).max(500)).min(1).max(MOVE_MAX),
@@ -226,24 +312,26 @@ const registerRequestTools = (server, ctx) => {
         annotations: shared_js_1.DESTRUCTIVE,
     }, (0, shared_js_1.guarded)(async ({ workspace, requests, collection, confirm }) => {
         (0, shared_js_1.requireConfirm)(confirm, "requests");
-        const ws = await ctx.resolveWorkspace(workspace);
         const deleted = [];
         const failed = [];
         const touched = new Set();
         for (const ref of requests) {
             try {
-                const { request } = await (0, lookups_js_1.resolveRequest)(ctx, ws.id, ref, collection);
+                const { ws, value } = await (0, lookups_js_1.findRequest)(ctx, workspace, ref, collection, { exact: true });
+                const { request } = value;
                 await ctx.api.deleteRequest(ws.id, request.id);
-                touched.add(request.collectionId);
-                deleted.push({ id: request.id, name: request.name });
+                touched.add(`${ws.id}:${request.collectionId}`);
+                deleted.push({ id: request.id, name: request.name, workspace: (0, lookups_js_1.workspaceTag)(ws) });
             }
             catch (error) {
-                failed.push({ request: ref, error: error instanceof Error ? error.message : String(error) });
+                failed.push({ request: ref, error: (0, shared_js_1.failureOf)(error) });
             }
         }
-        for (const collectionId of touched)
-            ctx.invalidate(`tree:${ws.id}:${collectionId}`);
-        ctx.invalidate(`collections:${ws.id}`);
+        for (const key of touched) {
+            const [wsId, collectionId] = key.split(":");
+            ctx.invalidate(`tree:${wsId}:${collectionId}`);
+            ctx.invalidate(`collections:${wsId}`);
+        }
         return (0, shared_js_1.ok)({ deleted, failed });
     }));
 };