@postman-cse/onboarding-bootstrap 2.1.2 → 2.3.0

package/dist/action.cjs

@@ -55569,7 +55569,7 @@ var require_lodash = __commonJS({
           }
           return mapped.length && mapped[0] === arrays[0] ? baseIntersection(mapped, undefined2, comparator) : [];
         });
-        function join3(array, separator) {
+        function join4(array, separator) {
           return array == null ? "" : nativeJoin.call(array, separator);
         }
         function last(array) {
@@ -57488,7 +57488,7 @@ var require_lodash = __commonJS({
         lodash.isUndefined = isUndefined;
         lodash.isWeakMap = isWeakMap;
         lodash.isWeakSet = isWeakSet;
-        lodash.join = join3;
+        lodash.join = join4;
         lodash.kebabCase = kebabCase;
         lodash.last = last;
         lodash.lastIndexOf = lastIndexOf;
@@ -127435,16 +127435,16 @@ var require_printer = __commonJS({
       },
       // Document
       Document: {
-        leave: (node) => join3(node.definitions, "\n\n")
+        leave: (node) => join4(node.definitions, "\n\n")
       },
       OperationDefinition: {
         leave(node) {
-          const varDefs = hasMultilineItems(node.variableDefinitions) ? wrap("(\n", join3(node.variableDefinitions, "\n"), "\n)") : wrap("(", join3(node.variableDefinitions, ", "), ")");
-          const prefix = wrap("", node.description, "\n") + join3(
+          const varDefs = hasMultilineItems(node.variableDefinitions) ? wrap("(\n", join4(node.variableDefinitions, "\n"), "\n)") : wrap("(", join4(node.variableDefinitions, ", "), ")");
+          const prefix = wrap("", node.description, "\n") + join4(
             [
               node.operation,
-              join3([node.name, varDefs]),
-              join3(node.directives, " ")
+              join4([node.name, varDefs]),
+              join4(node.directives, " ")
             ],
             " "
           );
@@ -127452,7 +127452,7 @@ var require_printer = __commonJS({
         }
       },
       VariableDefinition: {
-        leave: ({ variable, type, defaultValue, directives, description }) => wrap("", description, "\n") + variable + ": " + type + wrap(" = ", defaultValue) + wrap(" ", join3(directives, " "))
+        leave: ({ variable, type, defaultValue, directives, description }) => wrap("", description, "\n") + variable + ": " + type + wrap(" = ", defaultValue) + wrap(" ", join4(directives, " "))
       },
       SelectionSet: {
         leave: ({ selections }) => block(selections)
@@ -127460,11 +127460,11 @@ var require_printer = __commonJS({
       Field: {
         leave({ alias, name, arguments: args, directives, selectionSet }) {
           const prefix = wrap("", alias, ": ") + name;
-          let argsLine = prefix + wrap("(", join3(args, ", "), ")");
+          let argsLine = prefix + wrap("(", join4(args, ", "), ")");
           if (argsLine.length > MAX_LINE_LENGTH) {
-            argsLine = prefix + wrap("(\n", indent2(join3(args, "\n")), "\n)");
+            argsLine = prefix + wrap("(\n", indent2(join4(args, "\n")), "\n)");
           }
-          return join3([argsLine, join3(directives, " "), selectionSet], " ");
+          return join4([argsLine, join4(directives, " "), selectionSet], " ");
         }
       },
       Argument: {
@@ -127472,14 +127472,14 @@ var require_printer = __commonJS({
       },
       // Fragments
       FragmentSpread: {
-        leave: ({ name, directives }) => "..." + name + wrap(" ", join3(directives, " "))
+        leave: ({ name, directives }) => "..." + name + wrap(" ", join4(directives, " "))
       },
       InlineFragment: {
-        leave: ({ typeCondition, directives, selectionSet }) => join3(
+        leave: ({ typeCondition, directives, selectionSet }) => join4(
           [
             "...",
             wrap("on ", typeCondition),
-            join3(directives, " "),
+            join4(directives, " "),
             selectionSet
           ],
           " "
@@ -127495,7 +127495,7 @@ var require_printer = __commonJS({
           description
         }) => wrap("", description, "\n") + // Note: fragment variable definitions are experimental and may be changed
         // or removed in the future.
-        `fragment ${name}${wrap("(", join3(variableDefinitions, ", "), ")")} on ${typeCondition} ${wrap("", join3(directives, " "), " ")}` + selectionSet
+        `fragment ${name}${wrap("(", join4(variableDefinitions, ", "), ")")} on ${typeCondition} ${wrap("", join4(directives, " "), " ")}` + selectionSet
       },
       // Value
       IntValue: {
@@ -127517,17 +127517,17 @@ var require_printer = __commonJS({
         leave: ({ value }) => value
       },
       ListValue: {
-        leave: ({ values }) => "[" + join3(values, ", ") + "]"
+        leave: ({ values }) => "[" + join4(values, ", ") + "]"
       },
       ObjectValue: {
-        leave: ({ fields }) => "{" + join3(fields, ", ") + "}"
+        leave: ({ fields }) => "{" + join4(fields, ", ") + "}"
       },
       ObjectField: {
         leave: ({ name, value }) => name + ": " + value
       },
       // Directive
       Directive: {
-        leave: ({ name, arguments: args }) => "@" + name + wrap("(", join3(args, ", "), ")")
+        leave: ({ name, arguments: args }) => "@" + name + wrap("(", join4(args, ", "), ")")
       },
       // Type
       NamedType: {
@@ -127541,61 +127541,61 @@ var require_printer = __commonJS({
       },
       // Type System Definitions
       SchemaDefinition: {
-        leave: ({ description, directives, operationTypes }) => wrap("", description, "\n") + join3(["schema", join3(directives, " "), block(operationTypes)], " ")
+        leave: ({ description, directives, operationTypes }) => wrap("", description, "\n") + join4(["schema", join4(directives, " "), block(operationTypes)], " ")
       },
       OperationTypeDefinition: {
         leave: ({ operation, type }) => operation + ": " + type
       },
       ScalarTypeDefinition: {
-        leave: ({ description, name, directives }) => wrap("", description, "\n") + join3(["scalar", name, join3(directives, " ")], " ")
+        leave: ({ description, name, directives }) => wrap("", description, "\n") + join4(["scalar", name, join4(directives, " ")], " ")
       },
       ObjectTypeDefinition: {
-        leave: ({ description, name, interfaces, directives, fields }) => wrap("", description, "\n") + join3(
+        leave: ({ description, name, interfaces, directives, fields }) => wrap("", description, "\n") + join4(
           [
             "type",
             name,
-            wrap("implements ", join3(interfaces, " & ")),
-            join3(directives, " "),
+            wrap("implements ", join4(interfaces, " & ")),
+            join4(directives, " "),
             block(fields)
           ],
           " "
         )
       },
       FieldDefinition: {
-        leave: ({ description, name, arguments: args, type, directives }) => wrap("", description, "\n") + name + (hasMultilineItems(args) ? wrap("(\n", indent2(join3(args, "\n")), "\n)") : wrap("(", join3(args, ", "), ")")) + ": " + type + wrap(" ", join3(directives, " "))
+        leave: ({ description, name, arguments: args, type, directives }) => wrap("", description, "\n") + name + (hasMultilineItems(args) ? wrap("(\n", indent2(join4(args, "\n")), "\n)") : wrap("(", join4(args, ", "), ")")) + ": " + type + wrap(" ", join4(directives, " "))
       },
       InputValueDefinition: {
-        leave: ({ description, name, type, defaultValue, directives }) => wrap("", description, "\n") + join3(
-          [name + ": " + type, wrap("= ", defaultValue), join3(directives, " ")],
+        leave: ({ description, name, type, defaultValue, directives }) => wrap("", description, "\n") + join4(
+          [name + ": " + type, wrap("= ", defaultValue), join4(directives, " ")],
           " "
         )
       },
       InterfaceTypeDefinition: {
-        leave: ({ description, name, interfaces, directives, fields }) => wrap("", description, "\n") + join3(
+        leave: ({ description, name, interfaces, directives, fields }) => wrap("", description, "\n") + join4(
           [
             "interface",
             name,
-            wrap("implements ", join3(interfaces, " & ")),
-            join3(directives, " "),
+            wrap("implements ", join4(interfaces, " & ")),
+            join4(directives, " "),
             block(fields)
           ],
           " "
         )
       },
       UnionTypeDefinition: {
-        leave: ({ description, name, directives, types: types2 }) => wrap("", description, "\n") + join3(
-          ["union", name, join3(directives, " "), wrap("= ", join3(types2, " | "))],
+        leave: ({ description, name, directives, types: types2 }) => wrap("", description, "\n") + join4(
+          ["union", name, join4(directives, " "), wrap("= ", join4(types2, " | "))],
           " "
         )
       },
       EnumTypeDefinition: {
-        leave: ({ description, name, directives, values }) => wrap("", description, "\n") + join3(["enum", name, join3(directives, " "), block(values)], " ")
+        leave: ({ description, name, directives, values }) => wrap("", description, "\n") + join4(["enum", name, join4(directives, " "), block(values)], " ")
       },
       EnumValueDefinition: {
-        leave: ({ description, name, directives }) => wrap("", description, "\n") + join3([name, join3(directives, " ")], " ")
+        leave: ({ description, name, directives }) => wrap("", description, "\n") + join4([name, join4(directives, " ")], " ")
       },
       InputObjectTypeDefinition: {
-        leave: ({ description, name, directives, fields }) => wrap("", description, "\n") + join3(["input", name, join3(directives, " "), block(fields)], " ")
+        leave: ({ description, name, directives, fields }) => wrap("", description, "\n") + join4(["input", name, join4(directives, " "), block(fields)], " ")
       },
       DirectiveDefinition: {
         leave: ({
@@ -127605,84 +127605,84 @@ var require_printer = __commonJS({
           directives,
           repeatable,
           locations
-        }) => wrap("", description, "\n") + "directive @" + name + (hasMultilineItems(args) ? wrap("(\n", indent2(join3(args, "\n")), "\n)") : wrap("(", join3(args, ", "), ")")) + wrap(" ", join3(directives, " ")) + (repeatable ? " repeatable" : "") + " on " + join3(locations, " | ")
+        }) => wrap("", description, "\n") + "directive @" + name + (hasMultilineItems(args) ? wrap("(\n", indent2(join4(args, "\n")), "\n)") : wrap("(", join4(args, ", "), ")")) + wrap(" ", join4(directives, " ")) + (repeatable ? " repeatable" : "") + " on " + join4(locations, " | ")
       },
       SchemaExtension: {
-        leave: ({ directives, operationTypes }) => join3(
-          ["extend schema", join3(directives, " "), block(operationTypes)],
+        leave: ({ directives, operationTypes }) => join4(
+          ["extend schema", join4(directives, " "), block(operationTypes)],
           " "
         )
       },
       ScalarTypeExtension: {
-        leave: ({ name, directives }) => join3(["extend scalar", name, join3(directives, " ")], " ")
+        leave: ({ name, directives }) => join4(["extend scalar", name, join4(directives, " ")], " ")
       },
       ObjectTypeExtension: {
-        leave: ({ name, interfaces, directives, fields }) => join3(
+        leave: ({ name, interfaces, directives, fields }) => join4(
           [
             "extend type",
             name,
-            wrap("implements ", join3(interfaces, " & ")),
-            join3(directives, " "),
+            wrap("implements ", join4(interfaces, " & ")),
+            join4(directives, " "),
             block(fields)
           ],
           " "
         )
       },
       InterfaceTypeExtension: {
-        leave: ({ name, interfaces, directives, fields }) => join3(
+        leave: ({ name, interfaces, directives, fields }) => join4(
           [
             "extend interface",
             name,
-            wrap("implements ", join3(interfaces, " & ")),
-            join3(directives, " "),
+            wrap("implements ", join4(interfaces, " & ")),
+            join4(directives, " "),
             block(fields)
           ],
           " "
         )
       },
       UnionTypeExtension: {
-        leave: ({ name, directives, types: types2 }) => join3(
+        leave: ({ name, directives, types: types2 }) => join4(
           [
             "extend union",
             name,
-            join3(directives, " "),
-            wrap("= ", join3(types2, " | "))
+            join4(directives, " "),
+            wrap("= ", join4(types2, " | "))
           ],
           " "
         )
       },
       EnumTypeExtension: {
-        leave: ({ name, directives, values }) => join3(["extend enum", name, join3(directives, " "), block(values)], " ")
+        leave: ({ name, directives, values }) => join4(["extend enum", name, join4(directives, " "), block(values)], " ")
       },
       InputObjectTypeExtension: {
-        leave: ({ name, directives, fields }) => join3(["extend input", name, join3(directives, " "), block(fields)], " ")
+        leave: ({ name, directives, fields }) => join4(["extend input", name, join4(directives, " "), block(fields)], " ")
       },
       DirectiveExtension: {
-        leave: ({ name, directives }) => join3(["extend directive @" + name, join3(directives, " ")], " ")
+        leave: ({ name, directives }) => join4(["extend directive @" + name, join4(directives, " ")], " ")
       },
       // Schema Coordinates
       TypeCoordinate: {
         leave: ({ name }) => name
       },
       MemberCoordinate: {
-        leave: ({ name, memberName }) => join3([name, wrap(".", memberName)])
+        leave: ({ name, memberName }) => join4([name, wrap(".", memberName)])
       },
       ArgumentCoordinate: {
-        leave: ({ name, fieldName, argumentName }) => join3([name, wrap(".", fieldName), wrap("(", argumentName, ":)")])
+        leave: ({ name, fieldName, argumentName }) => join4([name, wrap(".", fieldName), wrap("(", argumentName, ":)")])
       },
       DirectiveCoordinate: {
-        leave: ({ name }) => join3(["@", name])
+        leave: ({ name }) => join4(["@", name])
       },
       DirectiveArgumentCoordinate: {
-        leave: ({ name, argumentName }) => join3(["@", name, wrap("(", argumentName, ":)")])
+        leave: ({ name, argumentName }) => join4(["@", name, wrap("(", argumentName, ":)")])
       }
     };
-    function join3(maybeArray, separator = "") {
+    function join4(maybeArray, separator = "") {
       var _maybeArray$filter$jo;
       return (_maybeArray$filter$jo = maybeArray === null || maybeArray === void 0 ? void 0 : maybeArray.filter((x) => x).join(separator)) !== null && _maybeArray$filter$jo !== void 0 ? _maybeArray$filter$jo : "";
     }
     function block(array) {
-      return wrap("{\n", indent2(join3(array, "\n")), "\n}");
+      return wrap("{\n", indent2(join4(array, "\n")), "\n}");
     }
     function wrap(start, maybeString, end = "") {
       return maybeString != null && maybeString !== "" ? start + maybeString + end : "";
@@ -152316,7 +152316,7 @@ var require_index_cjs = __commonJS({
       const t = parse10(r);
       return "http" === t.protocol || "https" === t.protocol;
     }
-    var join3 = (...r) => {
+    var join4 = (...r) => {
       if (0 === r.length) return ".";
       const t = r.map(parse10), e = Object.assign({}, t[0]);
       for (let n = 1; n < t.length; n++) {
@@ -152340,7 +152340,7 @@ var require_index_cjs = __commonJS({
     function resolve5(...r) {
       if (0 === r.length) return ".";
       const t = normalizeParsed(parse10(r[r.length - 1]));
-      return t.absolute ? format3(t) : join3(...r);
+      return t.absolute ? format3(t) : join4(...r);
     }
     var startsWithWindowsDrive = (r) => {
       return null !== parse10(r).drive;
@@ -152354,7 +152354,7 @@ var require_index_cjs = __commonJS({
     function serializeSrn({ shortcode: r, orgSlug: t, projectSlug: e, uri: n = "" }) {
       return [r, t, e, n.replace(/^\//, "")].filter(Boolean).join("/");
     }
-    exports2.basename = basename3, exports2.deserializeSrn = deserializeSrn, exports2.dirname = dirname3, exports2.extname = extname2, exports2.format = format3, exports2.isAbsolute = isAbsolute, exports2.isURL = isURL, exports2.join = join3, exports2.normalize = normalize3, exports2.parse = parse10, exports2.relative = relative2, exports2.resolve = resolve5, exports2.sep = "/", exports2.serializeSrn = serializeSrn, exports2.startsWithWindowsDrive = startsWithWindowsDrive, exports2.stripRoot = stripRoot, exports2.toFSPath = normalize3;
+    exports2.basename = basename3, exports2.deserializeSrn = deserializeSrn, exports2.dirname = dirname3, exports2.extname = extname2, exports2.format = format3, exports2.isAbsolute = isAbsolute, exports2.isURL = isURL, exports2.join = join4, exports2.normalize = normalize3, exports2.parse = parse10, exports2.relative = relative2, exports2.resolve = resolve5, exports2.sep = "/", exports2.serializeSrn = serializeSrn, exports2.startsWithWindowsDrive = startsWithWindowsDrive, exports2.stripRoot = stripRoot, exports2.toFSPath = normalize3;
   }
 });
 
@@ -154097,7 +154097,7 @@ var require_stable = __commonJS({
       return result;
     }
     function stringifyFullFn(key, parent, stack, replacer, indent2) {
-      var i, res, join3;
+      var i, res, join4;
       const originalIndentation = indentation;
       var value = parent[key];
       if (typeof value === "object" && value !== null && typeof value.toJSON === "function") {
@@ -154123,12 +154123,12 @@ var require_stable = __commonJS({
             indentation += indent2;
             res += `
 ${indentation}`;
-            join3 = `,
+            join4 = `,
 ${indentation}`;
             for (i = 0; i < value.length - 1; i++) {
               const tmp2 = stringifyFullFn(i, value, stack, replacer, indent2);
               res += tmp2 !== void 0 ? tmp2 : "null";
-              res += join3;
+              res += join4;
             }
             const tmp = stringifyFullFn(i, value, stack, replacer, indent2);
             res += tmp !== void 0 ? tmp : "null";
@@ -154150,7 +154150,7 @@ ${originalIndentation}`;
           indentation += indent2;
           res += `
 ${indentation}`;
-          join3 = `,
+          join4 = `,
 ${indentation}`;
           var separator = "";
           for (i = 0; i < keys.length; i++) {
@@ -154158,7 +154158,7 @@ ${indentation}`;
             const tmp = stringifyFullFn(key, value, stack, replacer, indent2);
             if (tmp !== void 0) {
               res += `${separator}"${strEscape(key)}": ${tmp}`;
-              separator = join3;
+              separator = join4;
             }
           }
           if (separator !== "") {
@@ -154180,7 +154180,7 @@ ${originalIndentation}`;
       }
     }
     function stringifyFullArr(key, value, stack, replacer, indent2) {
-      var i, res, join3;
+      var i, res, join4;
       const originalIndentation = indentation;
       if (typeof value === "object" && value !== null && typeof value.toJSON === "function") {
         value = value.toJSON(key);
@@ -154204,12 +154204,12 @@ ${originalIndentation}`;
             indentation += indent2;
             res += `
 ${indentation}`;
-            join3 = `,
+            join4 = `,
 ${indentation}`;
             for (i = 0; i < value.length - 1; i++) {
               const tmp2 = stringifyFullArr(i, value[i], stack, replacer, indent2);
               res += tmp2 !== void 0 ? tmp2 : "null";
-              res += join3;
+              res += join4;
             }
             const tmp = stringifyFullArr(i, value[i], stack, replacer, indent2);
             res += tmp !== void 0 ? tmp : "null";
@@ -154230,7 +154230,7 @@ ${originalIndentation}`;
           indentation += indent2;
           res += `
 ${indentation}`;
-          join3 = `,
+          join4 = `,
 ${indentation}`;
           var separator = "";
           for (i = 0; i < replacer.length; i++) {
@@ -154239,7 +154239,7 @@ ${indentation}`;
               const tmp = stringifyFullArr(key, value[key], stack, replacer, indent2);
               if (tmp !== void 0) {
                 res += `${separator}"${strEscape(key)}": ${tmp}`;
-                separator = join3;
+                separator = join4;
               }
             }
           }
@@ -154262,7 +154262,7 @@ ${originalIndentation}`;
       }
     }
     function stringifyIndent(key, value, stack, indent2) {
-      var i, res, join3;
+      var i, res, join4;
       const originalIndentation = indentation;
       switch (typeof value) {
         case "object":
@@ -154292,12 +154292,12 @@ ${originalIndentation}`;
             indentation += indent2;
             res += `
 ${indentation}`;
-            join3 = `,
+            join4 = `,
 ${indentation}`;
             for (i = 0; i < value.length - 1; i++) {
               const tmp2 = stringifyIndent(i, value[i], stack, indent2);
               res += tmp2 !== void 0 ? tmp2 : "null";
-              res += join3;
+              res += join4;
             }
             const tmp = stringifyIndent(i, value[i], stack, indent2);
             res += tmp !== void 0 ? tmp : "null";
@@ -154319,7 +154319,7 @@ ${originalIndentation}`;
           indentation += indent2;
           res += `
 ${indentation}`;
-          join3 = `,
+          join4 = `,
 ${indentation}`;
           var separator = "";
           for (i = 0; i < keys.length; i++) {
@@ -154327,7 +154327,7 @@ ${indentation}`;
             const tmp = stringifyIndent(key, value[key], stack, indent2);
             if (tmp !== void 0) {
               res += `${separator}"${strEscape(key)}": ${tmp}`;
-              separator = join3;
+              separator = join4;
             }
           }
           if (separator !== "") {
@@ -172660,7 +172660,7 @@ var require_lodash2 = __commonJS({
           }
           return mapped.length && mapped[0] === arrays[0] ? baseIntersection(mapped, undefined2, comparator) : [];
         });
-        function join3(array, separator) {
+        function join4(array, separator) {
           return array == null ? "" : nativeJoin.call(array, separator);
         }
         function last(array) {
@@ -174584,7 +174584,7 @@ var require_lodash2 = __commonJS({
         lodash.isUndefined = isUndefined;
         lodash.isWeakMap = isWeakMap;
         lodash.isWeakSet = isWeakSet;
-        lodash.join = join3;
+        lodash.join = join4;
         lodash.kebabCase = kebabCase;
         lodash.last = last;
         lodash.lastIndexOf = lastIndexOf;
@@ -179718,7 +179718,7 @@ var require_lodash3 = __commonJS({
           }
           return mapped.length && mapped[0] === arrays[0] ? baseIntersection(mapped, undefined2, comparator) : [];
         });
-        function join3(array, separator) {
+        function join4(array, separator) {
           return array == null ? "" : nativeJoin.call(array, separator);
         }
         function last(array) {
@@ -181642,7 +181642,7 @@ var require_lodash3 = __commonJS({
         lodash.isUndefined = isUndefined;
         lodash.isWeakMap = isWeakMap;
         lodash.isWeakSet = isWeakSet;
-        lodash.join = join3;
+        lodash.join = join4;
         lodash.kebabCase = kebabCase;
         lodash.last = last;
         lodash.lastIndexOf = lastIndexOf;
@@ -283137,7 +283137,7 @@ var require_lodash5 = __commonJS({
           }
           return mapped.length && mapped[0] === arrays[0] ? baseIntersection(mapped, undefined2, comparator) : [];
         });
-        function join3(array, separator) {
+        function join4(array, separator) {
           return array == null ? "" : nativeJoin.call(array, separator);
         }
         function last(array) {
@@ -285061,7 +285061,7 @@ var require_lodash5 = __commonJS({
         lodash.isUndefined = isUndefined;
         lodash.isWeakMap = isWeakMap;
         lodash.isWeakSet = isWeakSet;
-        lodash.join = join3;
+        lodash.join = join4;
         lodash.kebabCase = kebabCase;
         lodash.last = last;
         lodash.lastIndexOf = lastIndexOf;
@@ -294670,7 +294670,7 @@ function getIDToken(aud) {
 
 // src/index.ts
 var import_node_crypto4 = require("node:crypto");
-var import_node_fs4 = require("node:fs");
+var import_node_fs5 = require("node:fs");
 var path9 = __toESM(require("node:path"), 1);
 var import_yaml4 = __toESM(require_dist(), 1);
 
@@ -296224,12 +296224,62 @@ function resolvePostmanEndpointProfile(stack, region = "us") {
 
 // src/lib/postman/credential-identity.ts
 var sessionPath = "/api/sessions/current";
+var SESSION_MAX_ATTEMPTS = 3;
+var SESSION_RETRY_BASE_DELAY_MS = 500;
+var SESSION_RETRY_MAX_DELAY_MS = 8e3;
 var pmakMemo = /* @__PURE__ */ new Map();
 var sessionMemo = /* @__PURE__ */ new Map();
 var memoizedSessionIdentity;
+var memoizedSessionFailure;
+function defaultSessionSleep(ms) {
+  return new Promise((resolve5) => setTimeout(resolve5, ms));
+}
+function defaultRandom() {
+  return Math.random();
+}
+function parseRetryAfterMs(value) {
+  const trimmed = value?.trim();
+  if (!trimmed) {
+    return void 0;
+  }
+  if (/^\d+$/.test(trimmed)) {
+    return Number(trimmed) * 1e3;
+  }
+  const dateMs = Date.parse(trimmed);
+  if (!Number.isNaN(dateMs)) {
+    return Math.max(0, dateMs - Date.now());
+  }
+  return void 0;
+}
+function parseRateLimitResetMs(value) {
+  const trimmed = value?.trim();
+  if (!trimmed || !/^\d+$/.test(trimmed)) {
+    return void 0;
+  }
+  const seconds = Number(trimmed);
+  const nowSeconds = Date.now() / 1e3;
+  if (seconds > nowSeconds) {
+    return Math.max(0, (seconds - nowSeconds) * 1e3);
+  }
+  return seconds * 1e3;
+}
+function computeSessionRetryDelayMs(response, attempt, random) {
+  const headers = response?.headers;
+  const signal = parseRetryAfterMs(headers?.get("retry-after") ?? null) ?? parseRateLimitResetMs(
+    headers?.get("ratelimit-reset") ?? headers?.get("x-ratelimit-reset") ?? null
+  );
+  if (signal !== void 0) {
+    return Math.min(Math.max(0, signal), SESSION_RETRY_MAX_DELAY_MS);
+  }
+  const ceiling = Math.min(SESSION_RETRY_MAX_DELAY_MS, SESSION_RETRY_BASE_DELAY_MS * 2 ** (attempt - 1));
+  return Math.round(random() * ceiling);
+}
 function getMemoizedSessionIdentity() {
   return memoizedSessionIdentity;
 }
+function getSessionResolutionFailure() {
+  return memoizedSessionFailure;
+}
 function asRecord2(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     return void 0;
@@ -296298,46 +296348,90 @@ async function resolveSessionIdentity(opts) {
   const memoKey = `${baseUrl}::${accessToken}`;
   let pending = sessionMemo.get(memoKey);
   if (!pending) {
-    pending = probeSessionIdentity(baseUrl, accessToken, opts.fetchImpl ?? fetch);
+    pending = probeSessionIdentity(
+      baseUrl,
+      accessToken,
+      opts.fetchImpl ?? fetch,
+      Math.max(1, opts.maxAttempts ?? SESSION_MAX_ATTEMPTS),
+      opts.sleepImpl ?? defaultSessionSleep,
+      opts.randomImpl ?? defaultRandom
+    );
     sessionMemo.set(memoKey, pending);
   }
   return pending;
 }
-async function probeSessionIdentity(baseUrl, accessToken, fetchImpl) {
+async function parseSessionResponse(response) {
+  let payload;
   try {
-    const response = await fetchImpl(`${baseUrl}${sessionPath}`, {
-      method: "GET",
-      headers: { "x-access-token": accessToken }
-    });
-    if (!response.ok) {
-      return void 0;
-    }
-    const payload = asRecord2(await response.json());
-    if (!payload) {
-      return void 0;
-    }
-    const root = asRecord2(payload.session) ?? payload;
-    const identity = asRecord2(root.identity);
-    const data = asRecord2(root.data);
-    const user = asRecord2(data?.user);
-    const roleEntries = Array.isArray(user?.roles) ? user.roles.map((entry) => coerceText(entry) ?? coerceId(entry)).filter((entry) => Boolean(entry)) : [];
-    const singleRole = coerceText(user?.role);
-    const roles = roleEntries.length > 0 ? roleEntries : singleRole ? [singleRole] : void 0;
-    const resolved = {
-      source: "iapub/sessions",
-      userId: coerceId(identity?.user) ?? coerceId(user?.id),
-      fullName: coerceText(user?.fullName) ?? coerceText(user?.name) ?? coerceText(user?.username),
-      teamId: coerceId(identity?.team),
-      teamName: coerceText(user?.teamName),
-      teamDomain: coerceText(identity?.domain),
-      ...roles ? { roles } : {},
-      consumerType: coerceText(root.consumerType) ?? coerceText(data?.consumerType) ?? coerceText(user?.consumerType)
-    };
-    memoizedSessionIdentity = resolved;
-    return resolved;
+    payload = asRecord2(await response.json());
   } catch {
     return void 0;
   }
+  if (!payload) {
+    return void 0;
+  }
+  const root = asRecord2(payload.session) ?? payload;
+  const identity = asRecord2(root.identity);
+  const data = asRecord2(root.data);
+  const user = asRecord2(data?.user);
+  const roleEntries = Array.isArray(user?.roles) ? user.roles.map((entry) => coerceText(entry) ?? coerceId(entry)).filter((entry) => Boolean(entry)) : [];
+  const singleRole = coerceText(user?.role);
+  const roles = roleEntries.length > 0 ? roleEntries : singleRole ? [singleRole] : void 0;
+  return {
+    source: "iapub/sessions",
+    userId: coerceId(identity?.user) ?? coerceId(user?.id),
+    fullName: coerceText(user?.fullName) ?? coerceText(user?.name) ?? coerceText(user?.username),
+    teamId: coerceId(identity?.team),
+    teamName: coerceText(user?.teamName),
+    teamDomain: coerceText(identity?.domain),
+    ...roles ? { roles } : {},
+    consumerType: coerceText(root.consumerType) ?? coerceText(data?.consumerType) ?? coerceText(user?.consumerType)
+  };
+}
+async function probeSessionIdentity(baseUrl, accessToken, fetchImpl, maxAttempts, sleepImpl, random) {
+  let failure = "unavailable";
+  for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+    let response;
+    try {
+      response = await fetchImpl(`${baseUrl}${sessionPath}`, {
+        method: "GET",
+        headers: { "x-access-token": accessToken }
+      });
+    } catch {
+      failure = "unavailable";
+      if (attempt < maxAttempts) {
+        await sleepImpl(computeSessionRetryDelayMs(void 0, attempt, random));
+        continue;
+      }
+      break;
+    }
+    if (response.ok) {
+      const resolved = await parseSessionResponse(response);
+      if (resolved) {
+        memoizedSessionIdentity = resolved;
+        memoizedSessionFailure = void 0;
+        return resolved;
+      }
+      failure = "unavailable";
+      break;
+    }
+    if (response.status === 401 || response.status === 403) {
+      failure = "auth";
+      break;
+    }
+    if (response.status === 429 || response.status >= 500) {
+      failure = "unavailable";
+      if (attempt < maxAttempts) {
+        await sleepImpl(computeSessionRetryDelayMs(response, attempt, random));
+        continue;
+      }
+      break;
+    }
+    failure = "unavailable";
+    break;
+  }
+  memoizedSessionFailure = failure;
+  return void 0;
 }
 function describeTeam(id) {
   const label = id?.teamName ?? id?.teamDomain;
@@ -296428,7 +296522,9 @@ async function runCredentialPreflight(args) {
     session = await resolveSessionIdentity({
       iapubBaseUrl: args.iapubBaseUrl,
       accessToken,
-      fetchImpl: args.fetchImpl
+      fetchImpl: args.fetchImpl,
+      ...args.sleepImpl ? { sleepImpl: args.sleepImpl } : {},
+      ...args.randomImpl ? { randomImpl: args.randomImpl } : {}
     });
   } catch (error2) {
     args.log.warning(
@@ -296448,11 +296544,20 @@ async function runCredentialPreflight(args) {
       );
     }
   } else {
+    const failure = getSessionResolutionFailure();
+    const detail = failure === "auth" ? "the access token was rejected by iapub (401/403), so it is invalid or expired. Re-mint it with postman-resolve-service-token-action (or POST https://api.getpostman.com/service-account-tokens) and re-run." : "iapub was unreachable after retries (network or 5xx). This is usually transient; re-run the job.";
+    const base = "postman: credential preflight could not resolve the access-token session identity from iapub: " + detail;
+    if (args.mode === "enforce") {
+      throw new Error(
+        mask(
+          `${base} (credential-preflight: enforce requires a resolvable session identity; use credential-preflight: warn to continue with reactive error guidance only.)`
+        )
+      );
+    }
     args.log.warning(
-      mask(
-        "postman: credential preflight could not resolve the access-token session identity from iapub; continuing with reactive error guidance only"
-      )
+      mask(`${base} Continuing with reactive error guidance only (credential-preflight: warn).`)
     );
+    return;
   }
   const result = crossCheckIdentities({
     pmak,
@@ -298219,7 +298324,11 @@ function securityCheckFor(schemeName, scheme) {
   if (scheme?.type === "http") {
     const httpScheme = String(scheme.scheme || "").toLowerCase();
     if (httpScheme === "basic") return { scheme: schemeName, kind, checkable: true, prefix: "Basic " };
-    if (httpScheme === "bearer") return { scheme: schemeName, kind, checkable: true, prefix: "Bearer " };
+    if (httpScheme === "bearer") {
+      const check = { scheme: schemeName, kind, checkable: true, prefix: "Bearer " };
+      if (typeof scheme.bearerFormat === "string" && scheme.bearerFormat) check.bearerFormat = scheme.bearerFormat;
+      return check;
+    }
     if (httpScheme) return { scheme: schemeName, kind, checkable: true, prefix: `${httpScheme.charAt(0).toUpperCase()}${httpScheme.slice(1)} ` };
     return { scheme: schemeName, kind, checkable: true, in: "header", name: "Authorization" };
   }
@@ -298358,6 +298467,7 @@ function collectParameterChecks(root, pathItem, operation, version2, operationId
       if (defaultSerialization) warnings.push(`CONTRACT_SCHEMA_NOT_COMPILED: parameter ${location2}:${name} schema on ${operationId} skipped (${packed.unsupported})`);
       continue;
     }
+    validateParameterExamples(root, param, packed, `${location2}:${name} of ${operationId}`, warnings);
     if (location2 === "path") {
       const containingSegment = pathTemplate.split("/").find((segment) => segment.includes(`{${name}}`));
       if (containingSegment !== void 0 && containingSegment !== `{${name}}`) {
@@ -298374,12 +298484,32 @@ function collectParameterChecks(root, pathItem, operation, version2, operationId
     }
     const scalarSchema = packedScalarSchema(packed);
     if (scalarSchema !== void 0) {
-      if (!defaultSerialization) continue;
+      const decodablePathStyle = location2 === "path" && (style === "label" || style === "matrix") && !explode ? style : void 0;
+      if (!defaultSerialization && !decodablePathStyle) continue;
+      if (!defaultSerialization) warnings.push(...noteWarnings);
       const check2 = { in: location2, name, required: param.required === true, schema: scalarSchema };
+      if (decodablePathStyle) check2.pathStyle = decodablePathStyle;
       if (location2 === "query" && param.allowEmptyValue === true) check2.allowEmptyValue = true;
       checks.push(check2);
       continue;
     }
+    if (location2 === "query" && style === "deepObject" && explode) {
+      const objectSchema = asRecord5(packed.schema);
+      const properties = objectSchema ? asRecord5(objectSchema.properties) : null;
+      const allScalar = properties !== null && Object.keys(properties).length > 0 && Object.values(properties).every((prop) => {
+        const record = asRecord5(prop);
+        if (!record) return false;
+        const types2 = Array.isArray(record.type) ? record.type : [record.type];
+        return types2.every((entry) => typeof entry === "string" && SCALAR_SCHEMA_TYPES.has(entry));
+      });
+      if (allScalar) {
+        warnings.push(...noteWarnings);
+        const check2 = { in: "query", name, required: param.required === true, schema: packed.schema, decode: "deepObject" };
+        if (param.allowEmptyValue === true) check2.allowEmptyValue = true;
+        checks.push(check2);
+        continue;
+      }
+    }
     if (location2 !== "query" && location2 !== "header") continue;
     const items = packedArrayItemsSchema(packed);
     if (items === void 0) continue;
@@ -298690,6 +298820,185 @@ function responseHeaders(root, version2, response, context, warnings) {
   }
   return entries;
 }
+var IANA_HTTP_AUTH_SCHEMES = /* @__PURE__ */ new Set([
+  "basic",
+  "bearer",
+  "concealed",
+  "digest",
+  "dpop",
+  "gnap",
+  "hoba",
+  "mutual",
+  "negotiate",
+  "oauth",
+  "privatetoken",
+  "scram-sha-1",
+  "scram-sha-256",
+  "vapid"
+]);
+function httpsUrlLint(value, label, schemeName) {
+  if (typeof value !== "string" || !value) return void 0;
+  try {
+    const parsed = new URL(value);
+    if (parsed.protocol !== "https:") return `CONTRACT_SECURITY_SCHEME_URL: security scheme ${schemeName} ${label} ${value} is not an HTTPS URL`;
+  } catch {
+    return `CONTRACT_SECURITY_SCHEME_URL: security scheme ${schemeName} ${label} ${value} is not a valid URL`;
+  }
+  return void 0;
+}
+function collectSecurityStaticLints(root, operation) {
+  const securitySchemes = asRecord5(asRecord5(root.components)?.securitySchemes);
+  const requirements = operation.security === void 0 ? asArray3(root.security) : asArray3(operation.security);
+  const warnings = /* @__PURE__ */ new Set();
+  for (const requirement of requirements.map((entry) => asRecord5(entry)).filter((entry) => Boolean(entry))) {
+    for (const [schemeName, requiredScopes] of Object.entries(requirement)) {
+      let scheme;
+      try {
+        scheme = resolveInternalRef(root, securitySchemes?.[schemeName]);
+      } catch {
+        scheme = null;
+      }
+      if (!scheme) continue;
+      if (scheme.type === "http") {
+        const httpScheme = String(scheme.scheme || "").toLowerCase();
+        if (httpScheme && !IANA_HTTP_AUTH_SCHEMES.has(httpScheme)) {
+          warnings.add(`CONTRACT_UNKNOWN_HTTP_AUTH_SCHEME: security scheme ${schemeName} uses "${httpScheme}", which is not in the IANA HTTP Authentication Scheme registry`);
+        }
+      }
+      if (scheme.type === "apiKey" && String(scheme.in) === "query") {
+        warnings.add(`CONTRACT_CREDENTIALS_IN_QUERY: security scheme ${schemeName} sends credentials in the query string, which leaks into logs and referrers`);
+      }
+      if (scheme.type === "openIdConnect") {
+        const urlWarning = httpsUrlLint(scheme.openIdConnectUrl, "openIdConnectUrl", schemeName);
+        if (urlWarning) warnings.add(urlWarning);
+        else if (typeof scheme.openIdConnectUrl === "string" && !scheme.openIdConnectUrl.endsWith("/.well-known/openid-configuration")) {
+          warnings.add(`CONTRACT_SECURITY_SCHEME_URL: security scheme ${schemeName} openIdConnectUrl does not end in /.well-known/openid-configuration`);
+        }
+      }
+      if (scheme.type === "oauth2") {
+        const flows = asRecord5(scheme.flows) ?? {};
+        const declaredScopes = /* @__PURE__ */ new Set();
+        for (const [flowName, rawFlow] of Object.entries(flows)) {
+          const flow = asRecord5(rawFlow);
+          if (!flow) continue;
+          for (const scope of Object.keys(asRecord5(flow.scopes) ?? {})) declaredScopes.add(scope);
+          const urlFields = [["refreshUrl", flow.refreshUrl]];
+          if (flowName === "implicit" || flowName === "authorizationCode") urlFields.push(["authorizationUrl", flow.authorizationUrl]);
+          if (flowName === "password" || flowName === "clientCredentials" || flowName === "authorizationCode") urlFields.push(["tokenUrl", flow.tokenUrl]);
+          for (const [label, value] of urlFields) {
+            const urlWarning = httpsUrlLint(value, `${flowName} ${label}`, schemeName);
+            if (urlWarning) warnings.add(urlWarning);
+          }
+        }
+        for (const scope of asArray3(requiredScopes).filter((entry) => typeof entry === "string")) {
+          if (!declaredScopes.has(scope)) {
+            warnings.add(`CONTRACT_OAUTH2_UNDECLARED_SCOPE: operation requires scope "${scope}" of ${schemeName}, which no flow of the scheme declares`);
+          }
+        }
+      }
+    }
+  }
+  return [...warnings];
+}
+function collectSecurityResponseLints(root, operation, responses, operationId) {
+  const warnings = [];
+  const requirements = operation.security === void 0 ? asArray3(root.security) : asArray3(operation.security);
+  const requirementRecords = requirements.map((entry) => asRecord5(entry)).filter((entry) => Boolean(entry));
+  const secured = requirementRecords.length > 0 && requirementRecords.every((entry) => Object.keys(entry).length > 0);
+  const statusKeys = new Set(Object.keys(responses));
+  const hasCatchAll = statusKeys.has("default") || statusKeys.has("4XX");
+  if (secured && !statusKeys.has("401") && !hasCatchAll) {
+    warnings.push(`CONTRACT_SECURITY_RESPONSES_INCOMPLETE: ${operationId} requires authentication but documents no 401 (or 4XX/default) response`);
+  }
+  const usesScopes = requirementRecords.some((entry) => Object.values(entry).some((scopes) => Array.isArray(scopes) && scopes.length > 0));
+  if (secured && usesScopes && !statusKeys.has("403") && !hasCatchAll) {
+    warnings.push(`CONTRACT_SECURITY_RESPONSES_INCOMPLETE: ${operationId} requires scopes but documents no 403 (or 4XX/default) response`);
+  }
+  if (requirementRecords.length === 0) {
+    for (const status of ["401", "403"]) {
+      if (statusKeys.has(status)) warnings.push(`CONTRACT_UNSECURED_AUTH_RESPONSES: ${operationId} documents a ${status} response but declares no security requirement`);
+    }
+  }
+  return warnings;
+}
+function collectLinkExpressions(root, response, operationId, warnings) {
+  const links = asRecord5(response.links);
+  if (!links) return [];
+  const expressions = [];
+  let unevaluated = false;
+  for (const [linkName, rawLink] of Object.entries(links)) {
+    let link;
+    try {
+      link = resolveInternalRef(root, rawLink);
+    } catch {
+      link = null;
+    }
+    if (!link) {
+      unevaluated = true;
+      continue;
+    }
+    const values = Object.values(asRecord5(link.parameters) ?? {});
+    if (link.requestBody !== void 0) values.push(link.requestBody);
+    if (values.length === 0) unevaluated = true;
+    for (const value of values) {
+      if (typeof value !== "string" || !value.startsWith("$")) continue;
+      const bodyMatch = value.match(/^\$response\.body#(\/.*)$/);
+      if (bodyMatch) {
+        expressions.push({ link: linkName, kind: "body", pointer: bodyMatch[1] });
+        continue;
+      }
+      const headerMatch = value.match(/^\$response\.header\.([!#$%&'*+.^_`|~0-9A-Za-z-]+)$/);
+      if (headerMatch) {
+        expressions.push({ link: linkName, kind: "header", header: headerMatch[1] });
+        continue;
+      }
+      unevaluated = true;
+    }
+  }
+  if (expressions.length === 0) {
+    if (unevaluated) warnings.add(`CONTRACT_LINKS_NOT_VALIDATED: response links are not validated for ${operationId}`);
+  } else if (unevaluated) {
+    warnings.add(`CONTRACT_LINKS_PARTIALLY_VALIDATED: some link expressions for ${operationId} are not runtime-evaluable and are skipped`);
+  }
+  return expressions;
+}
+function escapeRegExpLiteral(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function serverAdvisoryPatterns(root, pathItem, operation) {
+  const serverLists = [asArray3(operation.servers), asArray3(pathItem.servers), asArray3(root.servers)];
+  const servers = serverLists.find((list) => list.length > 0) ?? [];
+  const patterns = [];
+  for (const rawServer of servers) {
+    const server = asRecord5(rawServer);
+    if (!server) continue;
+    const url = typeof server.url === "string" ? server.url.trim() : "";
+    if (!url || url === "/") continue;
+    const variables = asRecord5(server.variables);
+    const pattern = url.split(/(\{[^}]+\})/).map((part) => {
+      const varMatch = part.match(/^\{([^}]+)\}$/);
+      if (!varMatch) return escapeRegExpLiteral(part);
+      const variable = asRecord5(variables?.[varMatch[1]]);
+      const enumValues = asArray3(variable?.enum).filter((entry) => typeof entry === "string");
+      if (enumValues.length > 0) return `(${enumValues.map(escapeRegExpLiteral).join("|")})`;
+      return "[^/]*";
+    }).join("");
+    patterns.push(`^${pattern}`);
+  }
+  return patterns.length > 0 ? patterns : void 0;
+}
+function validateParameterExamples(root, param, packed, context, warnings) {
+  if (packed.schema === void 0 || packed.unsupported) return;
+  const candidates = exampleCandidates(root, param);
+  if (candidates.length === 0) return;
+  const validate3 = compileSchemaValidator(packed.schema);
+  if (!validate3) return;
+  for (const candidate of candidates) {
+    if (!validate3(candidate.value)) {
+      warnings.push(`CONTRACT_EXAMPLE_SCHEMA_MISMATCH: ${candidate.label} for parameter ${context} does not match its schema`);
+    }
+  }
+}
 function buildContractIndex(root) {
   if (root.swagger === "2.0") throw new Error("CONTRACT_UNSUPPORTED_OPENAPI_VERSION: Dynamic contract tests require OpenAPI 3.0 or 3.1 (found swagger 2.0)");
   if (!("openapi" in root)) throw new Error("CONTRACT_UNSUPPORTED_OPENAPI_VERSION: Dynamic contract tests require OpenAPI 3.0 or 3.1 (missing openapi)");
@@ -298708,6 +299017,9 @@ function buildContractIndex(root) {
         const operation = resolveInternalRef(root, rawOperation);
         if (!operation) continue;
         if (operation.callbacks) warnings.push(`CONTRACT_CALLBACKS_NOT_VALIDATED: callbacks are not validated for ${lowerMethod.toUpperCase()} ${path10}`);
+        if (operation.requestBody !== void 0 && ["get", "head", "delete"].includes(lowerMethod)) {
+          warnings.push(`CONTRACT_METHOD_BODY_SEMANTICS: ${lowerMethod.toUpperCase()} ${path10} declares a request body; RFC 9110 defines no request-body semantics for ${lowerMethod.toUpperCase()}`);
+        }
         const responses = asRecord5(operation.responses);
         if (!responses || Object.keys(responses).length === 0) {
           throw new Error(`CONTRACT_OPERATION_NO_RESPONSES: ${lowerMethod.toUpperCase()} ${path10} must define at least one response`);
@@ -298717,11 +299029,15 @@ function buildContractIndex(root) {
         for (const [status, rawResponse] of Object.entries(responses)) {
           const response = resolveInternalRef(root, rawResponse);
           if (!response) continue;
-          if (asRecord5(response.links)) {
-            responseWarnings.add(`CONTRACT_LINKS_NOT_VALIDATED: response links are not validated for ${lowerMethod.toUpperCase()} ${path10}`);
+          if (status !== "default" && !/^[1-5]XX$/.test(status) && !/^[1-5][0-9][0-9]$/.test(status)) {
+            responseWarnings.add(`CONTRACT_INVALID_STATUS_CODE: ${lowerMethod.toUpperCase()} ${path10} declares response status "${status}" outside RFC 9110's 100-599, 1XX-5XX, or default forms`);
           }
+          const linkExpressions = collectLinkExpressions(root, response, `${lowerMethod.toUpperCase()} ${path10}`, responseWarnings);
           const responseContext = `${lowerMethod.toUpperCase()} ${path10} status ${status}`;
           const content = responseContent(root, version2, response, responseContext, responseWarnings);
+          if ((status === "204" || status === "205" || status === "304") && Object.keys(content).length > 0) {
+            responseWarnings.add(`CONTRACT_BODYLESS_STATUS_WITH_CONTENT: ${lowerMethod.toUpperCase()} ${path10} declares content for status ${status}, which RFC 9110 forbids on the wire`);
+          }
           for (const [contentType2, media] of Object.entries(content)) {
             const base = contentType2.toLowerCase().split(";")[0]?.trim() ?? "";
             const schemaType = asRecord5(media.schema)?.type;
@@ -298733,7 +299049,8 @@ function buildContractIndex(root) {
           contractResponses[normalizeResponseKey(status)] = {
             content,
             hasBody: Object.keys(content).length > 0,
-            headers
+            headers,
+            ...linkExpressions.length > 0 ? { links: linkExpressions } : {}
           };
         }
         const candidates = [...new Set([
@@ -298746,11 +299063,13 @@ function buildContractIndex(root) {
         opWarnings.push(...collectSecuritySchemeWarnings(root, operation));
         const parameterChecks = collectParameterChecks(root, pathItem, operation, version2, operationId, path10, opWarnings);
         const checkedKeys = new Set((parameterChecks ?? []).map((check) => `${check.in}:${check.name.toLowerCase()}`));
-        const decodedKeys = new Set((parameterChecks ?? []).filter((check) => check.decode).map((check) => `${check.in}:${check.name.toLowerCase()}`));
+        const decodedKeys = new Set((parameterChecks ?? []).filter((check) => check.decode || check.pathStyle).map((check) => `${check.in}:${check.name.toLowerCase()}`));
         opWarnings.push(...collectSerializationWarnings(root, pathItem, operation, decodedKeys));
         if (operation.deprecated === true) {
           opWarnings.push(`CONTRACT_OPERATION_DEPRECATED: ${lowerMethod.toUpperCase()} ${path10} is marked deprecated in the OpenAPI document`);
         }
+        opWarnings.push(...collectSecurityStaticLints(root, operation));
+        opWarnings.push(...collectSecurityResponseLints(root, operation, responses, operationId));
         const requiredParameters = collectParameters(root, pathItem, operation);
         for (const parameter of requiredParameters.filter((entry) => entry.securityDerived)) {
           opWarnings.push(`CONTRACT_SECURITY_NOT_VALIDATED: security parameter ${parameter.in}:${parameter.name} is not statically required in generated requests`);
@@ -298779,6 +299098,9 @@ function buildContractIndex(root) {
           parameterChecks,
           requestBody: collectRequestBody(root, operation, version2, operationId, opWarnings),
           security: collectSecurityRuntimeChecks(root, operation),
+          pathMethods: Object.keys(pathItem).filter((key) => HTTP_METHODS.has(key)).map((key) => key.toUpperCase()),
+          deprecated: operation.deprecated === true || void 0,
+          servers: serverAdvisoryPatterns(root, pathItem, operation),
           warnings: opWarnings
         });
       }
@@ -298955,7 +299277,7 @@ function buildValidatorAssignments(operation, warnings, skipped) {
   return lines;
 }
 function createContractScript(operation, warnings = []) {
-  const contract = { method: operation.method, path: operation.path, responses: operation.responses, security: operation.security, parameters: operation.parameterChecks };
+  const contract = { method: operation.method, path: operation.path, responses: operation.responses, security: operation.security, parameters: operation.parameterChecks, pathMethods: operation.pathMethods, deprecated: operation.deprecated, servers: operation.servers };
   const skipped = [];
   const validatorLines = buildValidatorAssignments(operation, warnings, skipped);
   return [
@@ -299066,6 +299388,417 @@ function createContractScript(operation, warnings = []) {
     '  if (!isJsonSubtype(actual.subtype) && media.media.schema && media.media.schema.type !== "string") { return; }',
     '  if (!validate(value)) pm.expect.fail("OpenAPI schema validation failed for " + contract.method + " " + contract.path + " status " + pm.response.code + ": " + JSON.stringify(validate.errors || []));',
     "});",
+    "pm.test('Response satisfies RFC 9110 status-code requirements', function () {",
+    "  var code = pm.response.code;",
+    '  function respHeader(name) { return pm.response.headers.get(name) || ""; }',
+    "  if (code === 401) {",
+    '    var challenge = respHeader("WWW-Authenticate");',
+    '    if (!challenge) pm.expect.fail("RFC 9110 requires WWW-Authenticate on 401 responses");',
+    '    var wantsBearer = (contract.security || []).some(function (alternative) { return alternative.some(function (check) { return check.prefix && check.prefix.toLowerCase().indexOf("bearer") === 0; }); });',
+    '    if (wantsBearer && challenge && challenge.toLowerCase().indexOf("bearer") === -1) pm.expect.fail("RFC 6750 expects a Bearer challenge on 401 for bearer-secured operations; got: " + challenge);',
+    '    if (challenge && /\\bbasic\\b/i.test(challenge) && !/realm\\s*=/i.test(challenge)) pm.expect.fail("RFC 7617 requires a realm parameter on Basic challenges: " + challenge);',
+    '    if (challenge && /\\bdigest\\b/i.test(challenge) && (!/realm\\s*=/i.test(challenge) || !/nonce\\s*=/i.test(challenge))) pm.expect.fail("RFC 7616 requires realm and nonce on Digest challenges: " + challenge);',
+    "  }",
+    "  if (code === 401 || code === 403) {",
+    '    var authChallenge = respHeader("WWW-Authenticate");',
+    '    var bearerError = authChallenge && /\\bbearer\\b/i.test(authChallenge) ? authChallenge.match(/\\berror\\s*=\\s*"?([A-Za-z0-9_]+)"?/i) : null;',
+    '    if (bearerError && ["invalid_request", "invalid_token", "insufficient_scope"].indexOf(bearerError[1]) === -1) pm.expect.fail("RFC 6750 Bearer error code must be invalid_request, invalid_token, or insufficient_scope; got " + bearerError[1]);',
+    "  }",
+    "  if (code === 405) {",
+    '    var allow = respHeader("Allow");',
+    '    if (!allow) pm.expect.fail("RFC 9110 requires Allow on 405 responses");',
+    '    var allowed = allow.split(",").map(function (entry) { return entry.trim().toUpperCase(); });',
+    '    (contract.pathMethods || []).forEach(function (method) { if (allowed.indexOf(method) === -1) pm.expect.fail("Allow on 405 must list every method the OpenAPI path declares (RFC 9110); missing " + method + " in: " + allow); });',
+    "  }",
+    '  if (code === 304 && responseText().trim().length > 0) pm.expect.fail("RFC 9110 forbids content in a 304 response");',
+    '  var retryAfter = respHeader("Retry-After");',
+    "  if (retryAfter && (code === 429 || code === 503 || (code >= 300 && code < 400))) {",
+    '    if (!/^\\d+$/.test(retryAfter.trim()) && isNaN(Date.parse(retryAfter))) pm.expect.fail("Retry-After must be delay-seconds or an HTTP-date (RFC 9110): " + retryAfter);',
+    "  }",
+    '  var location = respHeader("Location");',
+    "  if (location && (code === 201 || (code >= 300 && code < 400))) {",
+    '    if (/\\s/.test(location.trim()) || location.trim().length === 0) pm.expect.fail("Location must be a valid URI-reference (RFC 9110 / RFC 3986): " + location);',
+    "  }",
+    "});",
+    "pm.test('Error and encoding conventions match RFC 9457 / RFC 8259 / RFC 8288', function () {",
+    '  var contentTypeRaw = pm.response.headers.get("Content-Type") || "";',
+    "  var ct = mediaParts(contentTypeRaw);",
+    '  if (ct.type === "application" && ct.subtype === "problem+json") {',
+    "    var problem;",
+    '    try { problem = pm.response.json(); } catch (error) { pm.expect.fail("application/problem+json body is not valid JSON (RFC 9457): " + error); }',
+    '    if (!problem || typeof problem !== "object" || Array.isArray(problem)) pm.expect.fail("problem details must be a JSON object (RFC 9457)");',
+    '    ["type", "title", "detail", "instance"].forEach(function (member) { if (problem[member] !== undefined && typeof problem[member] !== "string") pm.expect.fail("RFC 9457 " + member + " member must be a string; got " + typeof problem[member]); });',
+    '    ["type", "instance"].forEach(function (member) { if (typeof problem[member] === "string" && /\\s/.test(problem[member].trim())) pm.expect.fail("RFC 9457 " + member + " member must be a URI-reference (RFC 3986): " + problem[member]); });',
+    "    if (problem.status !== undefined) {",
+    '      if (typeof problem.status !== "number") pm.expect.fail("RFC 9457 status member must be a number; got " + typeof problem.status);',
+    '      else if (problem.status !== pm.response.code) pm.expect.fail("RFC 9457 status member (" + problem.status + ") must match the HTTP status code (" + pm.response.code + ")");',
+    "    }",
+    "  }",
+    "  if (isJsonSubtype(ct.subtype)) {",
+    '    var charsetMatch = contentTypeRaw.match(/charset\\s*=\\s*"?([^";\\s]+)"?/i);',
+    '    if (charsetMatch && charsetMatch[1].toLowerCase() !== "utf-8") pm.expect.fail("JSON interchange must be UTF-8 (RFC 8259); got charset=" + charsetMatch[1]);',
+    "  }",
+    '  var link = pm.response.headers.get("Link");',
+    "  if (link) {",
+    "    link.split(/,(?=\\s*<)/).forEach(function (value) {",
+    '      if (!/^\\s*<[^>]*>/.test(value)) pm.expect.fail("RFC 8288 link-value must start with a <URI-Reference>: " + value);',
+    '      if (!/;\\s*rel\\s*=/i.test(value)) pm.expect.fail("RFC 8288 link-value must carry a rel parameter: " + value);',
+    "    });",
+    "  }",
+    "});",
+    "var rfcAdvisories = [];",
+    "function rfcAdvise(message) { if (rfcAdvisories.indexOf(message) === -1) rfcAdvisories.push(message); }",
+    'function rfcRespHeader(name) { return pm.response.headers.get(name) || ""; }',
+    "function rfcHeaderAll(name) { var out = []; pm.response.headers.each(function (header) { if (header && String(header.key).toLowerCase() === String(name).toLowerCase()) out.push(String(header.value)); }); return out; }",
+    "function rfcIsHttpDate(value) { return /^(Mon|Tue|Wed|Thu|Fri|Sat|Sun), [0-3][0-9] (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) [0-9]{4} [0-2][0-9]:[0-5][0-9]:[0-5][0-9] GMT$/.test(String(value).trim()) && !isNaN(Date.parse(value)); }",
+    "function rfcIsToken(value) { return /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(String(value)); }",
+    'function rfcIsEntityTag(value) { return /^(W\\/)?"[\\x21\\x23-\\x7e\\x80-\\xff]*"$/.test(String(value).trim()); }',
+    "function rfcIsFieldContent(value) { return /^[\\t \\x21-\\x7e\\x80-\\xff]*$/.test(String(value)); }",
+    'function rfcTokenList(value) { var parts = String(value).split(","); for (var i = 0; i < parts.length; i += 1) { if (!rfcIsToken(parts[i].trim())) return false; } return true; }',
+    `function rfcSplitList(value) { var out = []; var current = ""; var inQuote = false; for (var i = 0; i < value.length; i += 1) { var ch = value.charAt(i); if (ch === "\\\\" && inQuote) { current += ch + (value.charAt(i + 1) || ""); i += 1; continue; } if (ch === '"') inQuote = !inQuote; if (ch === "," && !inQuote) { out.push(current); current = ""; continue; } current += ch; } out.push(current); return out; }`,
+    'function rfcBase64Decode(value) { var alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; var clean = String(value).replace(/=+$/, ""); if (clean.length === 0 || /[^A-Za-z0-9+\\/]/.test(clean)) return null; var bits = 0, buffer = 0, out = ""; for (var i = 0; i < clean.length; i += 1) { buffer = (buffer << 6) | alphabet.indexOf(clean.charAt(i)); bits += 6; if (bits >= 8) { bits -= 8; out += String.fromCharCode((buffer >> bits) & 255); } } return out; }',
+    "function rfcSfParse(input, kind) {",
+    "  var s = String(input), i = 0;",
+    '  function ws() { while (i < s.length && (s.charAt(i) === " " || s.charAt(i) === "\\t")) i += 1; }',
+    "  function key() { if (!/[a-z*]/.test(s.charAt(i))) return null; var start = i; i += 1; while (i < s.length && /[a-z0-9_.*-]/.test(s.charAt(i))) i += 1; return s.slice(start, i); }",
+    "  function bareItem() {",
+    "    var ch = s.charAt(i);",
+    `    if (ch === '"') { i += 1; while (i < s.length) { var c = s.charAt(i); if (c === "\\\\") { if (!/["\\\\]/.test(s.charAt(i + 1))) return null; i += 2; continue; } if (c === '"') { i += 1; return true; } if (c < " " || c > "~") return null; i += 1; } return null; }`,
+    '    if (ch === ":") { i += 1; var start = i; while (i < s.length && s.charAt(i) !== ":") i += 1; if (s.charAt(i) !== ":") return null; var body = s.slice(start, i); i += 1; return /^[A-Za-z0-9+\\/=]*$/.test(body) ? true : null; }',
+    '    if (ch === "?") { i += 1; if (s.charAt(i) !== "0" && s.charAt(i) !== "1") return null; i += 1; return true; }',
+    '    if (ch === "@") { i += 1; if (s.charAt(i) === "-") i += 1; if (!/[0-9]/.test(s.charAt(i))) return null; while (i < s.length && /[0-9]/.test(s.charAt(i))) i += 1; return true; }',
+    '    if (/[-0-9]/.test(ch)) { if (ch === "-") i += 1; if (!/[0-9]/.test(s.charAt(i))) return null; while (i < s.length && /[0-9]/.test(s.charAt(i))) i += 1; if (s.charAt(i) === ".") { i += 1; if (!/[0-9]/.test(s.charAt(i))) return null; while (i < s.length && /[0-9]/.test(s.charAt(i))) i += 1; } return true; }',
+    "    if (/[A-Za-z*]/.test(ch)) { i += 1; while (i < s.length && /[!#$%&'*+.^_`|~:\\/0-9A-Za-z-]/.test(s.charAt(i))) i += 1; return true; }",
+    "    return null;",
+    "  }",
+    '  function params() { while (s.charAt(i) === ";") { i += 1; ws(); if (key() === null) return null; if (s.charAt(i) === "=") { i += 1; if (bareItem() === null) return null; } } return true; }',
+    '  function item() { if (s.charAt(i) === "(") { i += 1; ws(); while (s.charAt(i) !== ")") { if (i >= s.length) return null; if (bareItem() === null || params() === null) return null; ws(); } i += 1; return params(); } if (bareItem() === null) return null; return params(); }',
+    "  ws();",
+    '  if (kind === "item") { if (item() === null) return false; ws(); return i === s.length; }',
+    "  if (i === s.length) return true;",
+    "  while (i < s.length) {",
+    '    if (kind === "dict") { if (key() === null) return false; if (s.charAt(i) === "=") { i += 1; if (item() === null) return false; } else if (params() === null) return false; }',
+    "    else if (item() === null) return false;",
+    "    ws();",
+    "    if (i === s.length) return true;",
+    '    if (s.charAt(i) !== ",") return false;',
+    "    i += 1; ws();",
+    "    if (i === s.length) return false;",
+    "  }",
+    "  return true;",
+    "}",
+    "pm.test('Response header fields satisfy RFC 9110 field syntax', function () {",
+    "  pm.response.headers.each(function (header) {",
+    "    if (!header) return;",
+    '    if (!rfcIsToken(String(header.key))) pm.expect.fail("Response header name is not a valid RFC 9110 token: " + header.key);',
+    '    if (!rfcIsFieldContent(String(header.value))) pm.expect.fail("Response header value contains characters forbidden by RFC 9110 field-content: " + header.key);',
+    "  });",
+    '  ["content-type", "content-length", "etag", "location", "date", "age", "expires", "last-modified", "retry-after"].forEach(function (name) {',
+    "    var values = rfcHeaderAll(name);",
+    '    for (var i = 1; i < values.length; i += 1) { if (values[i] !== values[0]) pm.expect.fail("Singleton response header " + name + " appears " + values.length + " times with differing values (RFC 9110)"); }',
+    "  });",
+    "});",
+    "pm.test('Response header values satisfy their RFC grammars', function () {",
+    '  var date = rfcRespHeader("Date");',
+    '  if (date && !rfcIsHttpDate(date)) pm.expect.fail("Date must be an IMF-fixdate (RFC 9110): " + date);',
+    '  if (!date) rfcAdvise("RFC 9110: origin servers SHOULD send a Date header");',
+    '  var etag = rfcRespHeader("ETag");',
+    '  if (etag && !rfcIsEntityTag(etag)) pm.expect.fail("ETag is not a valid entity-tag (RFC 9110): " + etag);',
+    '  var lastModified = rfcRespHeader("Last-Modified");',
+    "  if (lastModified) {",
+    '    if (!rfcIsHttpDate(lastModified)) pm.expect.fail("Last-Modified must be a valid HTTP-date (RFC 9110): " + lastModified);',
+    '    else if (date && rfcIsHttpDate(date) && Date.parse(lastModified) > Date.parse(date)) pm.expect.fail("Last-Modified must not be later than Date (RFC 9110): " + lastModified + " > " + date);',
+    "  }",
+    '  var vary = rfcRespHeader("Vary");',
+    "  if (vary) {",
+    '    var varyMembers = vary.split(",").map(function (entry) { return entry.trim(); });',
+    '    if (varyMembers.indexOf("*") !== -1 && varyMembers.length > 1) pm.expect.fail("Vary: * must not be combined with other members (RFC 9110): " + vary);',
+    '    varyMembers.forEach(function (member) { if (member !== "*" && !rfcIsToken(member)) pm.expect.fail("Vary member is not a field-name token (RFC 9110): " + member); });',
+    "  }",
+    '  var contentLocation = rfcRespHeader("Content-Location");',
+    '  if (contentLocation && (/\\s/.test(contentLocation.trim()) || contentLocation.trim().length === 0)) pm.expect.fail("Content-Location must be a valid URI-reference (RFC 9110): " + contentLocation);',
+    '  var acceptRanges = rfcRespHeader("Accept-Ranges");',
+    '  if (acceptRanges && !rfcTokenList(acceptRanges)) pm.expect.fail("Accept-Ranges must be a list of range-unit tokens (RFC 9110): " + acceptRanges);',
+    '  var contentLanguage = rfcRespHeader("Content-Language");',
+    '  if (contentLanguage) contentLanguage.split(",").forEach(function (tag) { if (!/^[A-Za-z]{1,8}(-[A-Za-z0-9]{1,8})*$/.test(tag.trim())) pm.expect.fail("Content-Language carries a malformed BCP 47 language-tag (RFC 5646): " + tag.trim()); });',
+    '  var allow = rfcRespHeader("Allow");',
+    '  if (allow && allow.trim() && !rfcTokenList(allow)) pm.expect.fail("Allow must be a comma-separated list of method tokens (RFC 9110): " + allow);',
+    '  if (allow && contract.method === "OPTIONS" && pm.response.code >= 200 && pm.response.code < 300) {',
+    '    var optionsAllowed = allow.split(",").map(function (entry) { return entry.trim().toUpperCase(); });',
+    '    (contract.pathMethods || []).forEach(function (method) { if (optionsAllowed.indexOf(method) === -1) pm.expect.fail("Allow on an OPTIONS response must list every method the OpenAPI path declares (RFC 9110); missing " + method + " in: " + allow); });',
+    "  }",
+    '  var age = rfcRespHeader("Age");',
+    '  if (age && !/^[0-9]+$/.test(age.trim())) pm.expect.fail("Age must be a non-negative integer of delta-seconds (RFC 9111): " + age);',
+    '  var expires = rfcRespHeader("Expires");',
+    '  if (expires && !rfcIsHttpDate(expires)) rfcAdvise("RFC 9111: Expires is not a valid HTTP-date and will be treated as already expired: " + expires);',
+    '  if (rfcHeaderAll("warning").length > 0) rfcAdvise("RFC 9111 obsoleted the Warning header; the server still emits it");',
+    '  var cacheControl = rfcRespHeader("Cache-Control");',
+    "  if (cacheControl) {",
+    "    var seenDirectives = {};",
+    "    rfcSplitList(cacheControl).forEach(function (entry) {",
+    "      var directive = entry.trim();",
+    '      if (!directive) { pm.expect.fail("Cache-Control contains an empty directive (RFC 9111): " + cacheControl); return; }',
+    '      var eq = directive.indexOf("=");',
+    "      var name = (eq === -1 ? directive : directive.slice(0, eq)).trim().toLowerCase();",
+    "      var argument = eq === -1 ? undefined : directive.slice(eq + 1).trim();",
+    '      if (!rfcIsToken(name)) pm.expect.fail("Cache-Control directive name is not a token (RFC 9111): " + directive);',
+    "      seenDirectives[name] = argument === undefined ? true : argument;",
+    '      if (["max-age", "s-maxage", "stale-while-revalidate", "stale-if-error"].indexOf(name) !== -1 && (argument === undefined || !/^"?[0-9]+"?$/.test(argument))) pm.expect.fail("Cache-Control " + name + " requires a delta-seconds argument (RFC 9111): " + directive);',
+    "    });",
+    '    if (seenDirectives["no-store"] && seenDirectives["max-age"] !== undefined) pm.expect.fail("Cache-Control combines no-store with max-age; the directives contradict (RFC 9111): " + cacheControl);',
+    "  }",
+    '  var acceptPatch = rfcRespHeader("Accept-Patch");',
+    '  if (acceptPatch) acceptPatch.split(",").forEach(function (entry) { var parts = mediaParts(entry); if (!parts.type || !parts.subtype) pm.expect.fail("Accept-Patch must be a list of media types (RFC 5789): " + entry.trim()); });',
+    '  var deprecation = rfcRespHeader("Deprecation");',
+    '  if (deprecation && !/^@-?[0-9]+$/.test(deprecation.trim())) pm.expect.fail("Deprecation must be an RFC 9745 Date structured field (@unix-timestamp): " + deprecation);',
+    '  var sunset = rfcRespHeader("Sunset");',
+    "  if (sunset) {",
+    '    if (!rfcIsHttpDate(sunset)) pm.expect.fail("Sunset must be a valid HTTP-date (RFC 8594): " + sunset);',
+    '    else if (Date.parse(sunset) < Date.now()) rfcAdvise("RFC 8594: Sunset date is already in the past: " + sunset);',
+    "  }",
+    '  var preferenceApplied = rfcRespHeader("Preference-Applied");',
+    "  if (preferenceApplied) {",
+    '    var requestPrefer = requestHeader("Prefer").toLowerCase();',
+    "    rfcSplitList(preferenceApplied).forEach(function (entry) {",
+    '      var token = entry.split("=")[0].trim().toLowerCase();',
+    '      if (token && requestPrefer.indexOf(token) === -1) pm.expect.fail("Preference-Applied echoes a preference the request never sent (RFC 7240): " + entry.trim());',
+    "    });",
+    "  }",
+    "});",
+    "pm.test('Response satisfies RFC 9110 message framing requirements', function () {",
+    "  var code = pm.response.code;",
+    '  if ((code === 204 || code < 200) && rfcRespHeader("Content-Length")) pm.expect.fail("RFC 9110 forbids Content-Length on 1xx and 204 responses");',
+    '  if ([301, 302, 303, 307, 308].indexOf(code) !== -1 && !rfcRespHeader("Location")) pm.expect.fail("RFC 9110 expects Location on a " + code + " redirect response");',
+    "  if (code === 416) {",
+    '    var unsatisfiedRange = rfcRespHeader("Content-Range");',
+    '    if (!unsatisfiedRange) pm.expect.fail("RFC 9110 requires Content-Range (unsatisfied-range form) on 416 responses");',
+    '    else if (!/^\\S+ \\*\\/[0-9]+$/.test(unsatisfiedRange.trim())) pm.expect.fail("Content-Range on 416 must use the unsatisfied-range form <unit> */<complete-length> (RFC 9110): " + unsatisfiedRange);',
+    "  }",
+    "  if (code === 206) {",
+    '    var contentRange = rfcRespHeader("Content-Range");',
+    '    var responseMedia = mediaParts(rfcRespHeader("Content-Type"));',
+    '    var isByteranges = responseMedia.type === "multipart" && responseMedia.subtype === "byteranges";',
+    '    if (!contentRange && !isByteranges) pm.expect.fail("RFC 9110 requires Content-Range on a single-part 206 response (or multipart/byteranges for multi-range)");',
+    '    if (contentRange && isByteranges) pm.expect.fail("RFC 9110 forbids Content-Range on a multipart/byteranges 206 response");',
+    "    if (contentRange) {",
+    "      var rangeParts = contentRange.trim().match(/^(\\S+) (?:([0-9]+)-([0-9]+)|\\*)\\/([0-9]+|\\*)$/);",
+    '      if (!rangeParts) pm.expect.fail("Content-Range is not a valid RFC 9110 range: " + contentRange);',
+    "      else {",
+    '        if (rangeParts[1] !== "bytes") rfcAdvise("RFC 9110: 206 Content-Range uses a non-bytes range unit: " + rangeParts[1]);',
+    "        if (rangeParts[2] !== undefined) {",
+    '          if (Number(rangeParts[2]) > Number(rangeParts[3])) pm.expect.fail("Content-Range first-byte-pos must be <= last-byte-pos (RFC 9110): " + contentRange);',
+    '          if (rangeParts[4] !== "*" && Number(rangeParts[3]) >= Number(rangeParts[4])) pm.expect.fail("Content-Range last-byte-pos must be < complete-length (RFC 9110): " + contentRange);',
+    "        }",
+    "      }",
+    "    }",
+    "  }",
+    '  if (code === 407 && !rfcRespHeader("Proxy-Authenticate")) pm.expect.fail("RFC 9110 requires Proxy-Authenticate on 407 responses");',
+    '  if (code === 415 && contract.method === "PATCH" && !rfcRespHeader("Accept-Patch")) rfcAdvise("RFC 5789: a 415 response to PATCH SHOULD carry Accept-Patch");',
+    "});",
+    "pm.test('Response media type is acceptable under the request Accept header', function () {",
+    "  if (pm.response.code < 200 || pm.response.code >= 300 || isBodyless()) return;",
+    '  var accept = requestHeader("Accept");',
+    '  if (!accept || accept.indexOf("{{") !== -1) return;',
+    '  var actual = mediaParts(rfcRespHeader("Content-Type"));',
+    "  if (!actual.type) return;",
+    "  var acceptable = false;",
+    "  var jsonSoftened = false;",
+    "  rfcSplitList(accept).forEach(function (entry) {",
+    "    var range = mediaParts(entry);",
+    '    var qMatch = entry.match(/;\\s*q\\s*=\\s*"?([0-9.]+)"?/i);',
+    "    if (qMatch && Number(qMatch[1]) <= 0) return;",
+    '    if ((range.type === "*" && range.subtype === "*") || (range.type === actual.type && (range.subtype === "*" || range.subtype === actual.subtype))) acceptable = true;',
+    '    if (range.type === actual.type && range.subtype === "json" && isJsonSubtype(actual.subtype)) jsonSoftened = true;',
+    "  });",
+    '  if (!acceptable && jsonSoftened) { rfcAdvise("Content negotiation: response " + actual.raw + " is a +json type while the request only accepted application/json"); return; }',
+    '  if (!acceptable) pm.expect.fail("Response Content-Type " + actual.raw + " is not acceptable under the request Accept header (RFC 9110): " + accept);',
+    "});",
+    "pm.test('Response body satisfies its media type RFC conventions', function () {",
+    '  var contentTypeValue = rfcRespHeader("Content-Type");',
+    "  var media = mediaParts(contentTypeValue);",
+    "  var text = responseText();",
+    '  if (pm.response.code === 406 && !text.trim()) rfcAdvise("RFC 9110: a 406 response SHOULD include a list of available representations");',
+    "  if (!text) return;",
+    "  if (isJsonSubtype(media.subtype)) {",
+    '    if (text.charCodeAt(0) === 65279) pm.expect.fail("RFC 8259 forbids a byte order mark at the start of JSON text");',
+    '    var charsetParam = contentTypeValue.match(/charset\\s*=\\s*"?([^";\\s]+)"?/i);',
+    '    if (charsetParam) rfcAdvise("RFC 8259 defines no charset parameter for JSON media types; got charset=" + charsetParam[1]);',
+    "  }",
+    '  if (media.raw === "application/x-ndjson" || media.raw === "application/jsonl" || media.raw === "application/x-jsonlines") {',
+    '    text.split(/\\r?\\n/).forEach(function (line, lineNumber) { if (!line.trim()) return; try { JSON.parse(line); } catch (error) { pm.expect.fail("NDJSON line " + (lineNumber + 1) + " is not valid JSON: " + error); } });',
+    "  }",
+    '  if (media.raw === "text/event-stream") {',
+    '    text.split(/\\r?\\n/).forEach(function (line) { if (!line || line.charAt(0) === ":") return; var field = line.split(":")[0]; if (["data", "event", "id", "retry"].indexOf(field) === -1) pm.expect.fail("SSE line does not start with a known field or comment: " + line); if (field === "retry" && !/^retry:\\s*[0-9]+\\s*$/.test(line)) pm.expect.fail("SSE retry field must be an integer: " + line); });',
+    "  }",
+    '  if (media.type === "multipart") {',
+    '    var boundary = contentTypeValue.match(/;\\s*boundary=(?:"([^"]*)"|([^;]*))/i);',
+    '    var boundaryValue = boundary ? (boundary[1] !== undefined ? boundary[1] : boundary[2].trim()) : "";',
+    '    if (!boundaryValue) pm.expect.fail("multipart responses must carry a boundary parameter (RFC 2046): " + contentTypeValue);',
+    "    else {",
+    '      if (boundaryValue.length > 70) pm.expect.fail("multipart boundary must be 1-70 characters (RFC 2046): " + boundaryValue);',
+    `      if (!/^[0-9A-Za-z'()+_,\\-.\\/:=? ]*[0-9A-Za-z'()+_,\\-.\\/:=?]$/.test(boundaryValue)) pm.expect.fail("multipart boundary contains characters outside RFC 2046 bchars or ends with a space: " + boundaryValue);`,
+    "    }",
+    "  }",
+    '  if (media.raw === "application/hal+json") {',
+    "    var hal; try { hal = JSON.parse(text); } catch (error) { hal = null; }",
+    '    if (hal && typeof hal === "object" && !Array.isArray(hal)) {',
+    "      var halLinks = hal._links;",
+    '      if (halLinks !== undefined && (typeof halLinks !== "object" || Array.isArray(halLinks) || halLinks === null)) pm.expect.fail("HAL _links must be an object of link relations");',
+    '      if (halLinks) Object.keys(halLinks).forEach(function (rel) { var linkValue = halLinks[rel]; (Array.isArray(linkValue) ? linkValue : [linkValue]).forEach(function (linkObject) { if (!linkObject || typeof linkObject !== "object" || typeof linkObject.href !== "string") pm.expect.fail("HAL link relation " + rel + " must be a Link Object (or array of them) with a string href"); }); });',
+    "      var halEmbedded = hal._embedded;",
+    '      if (halEmbedded !== undefined && (typeof halEmbedded !== "object" || Array.isArray(halEmbedded) || halEmbedded === null)) pm.expect.fail("HAL _embedded must be an object of resource names");',
+    "    }",
+    "  }",
+    '  if (media.raw === "application/vnd.api+json") {',
+    "    var jsonApi; try { jsonApi = JSON.parse(text); } catch (error) { jsonApi = null; }",
+    '    if (jsonApi && typeof jsonApi === "object" && !Array.isArray(jsonApi)) {',
+    '      if (jsonApi.data === undefined && jsonApi.errors === undefined && jsonApi.meta === undefined) pm.expect.fail("JSON:API documents must contain at least one of data, errors, meta");',
+    '      if (jsonApi.data !== undefined && jsonApi.errors !== undefined) pm.expect.fail("JSON:API forbids data and errors in the same document");',
+    "    }",
+    "  }",
+    '  if (media.subtype === "problem+xml") {',
+    '    if (text.indexOf("urn:ietf:rfc:7807") === -1) rfcAdvise("application/problem+xml body does not reference the urn:ietf:rfc:7807 namespace");',
+    "    var xmlStatus = text.match(/<status[^>]*>\\s*([0-9]+)\\s*<\\/status>/);",
+    '    if (xmlStatus && Number(xmlStatus[1]) !== pm.response.code) pm.expect.fail("RFC 9457 status member (" + xmlStatus[1] + ") must match the HTTP status code (" + pm.response.code + ")");',
+    "  }",
+    "});",
+    "pm.test('Structured field response headers parse per RFC 8941', function () {",
+    '  [["Cache-Status", "list"], ["Proxy-Status", "list"], ["Priority", "dict"], ["RateLimit", "dict"], ["RateLimit-Policy", "dict"], ["Signature", "dict"], ["Signature-Input", "dict"]].forEach(function (pair) {',
+    '    var value = rfcHeaderAll(pair[0]).join(", ");',
+    "    if (!value) return;",
+    '    if (!rfcSfParse(value, pair[1])) pm.expect.fail(pair[0] + " is not a valid RFC 8941 structured field (" + pair[1] + "): " + value);',
+    "  });",
+    "});",
+    "pm.test('Content-Digest and Repr-Digest match the response body (RFC 9530)', function () {",
+    "  var cryptoLib = null;",
+    '  try { cryptoLib = require("crypto-js"); } catch (error) { cryptoLib = null; }',
+    '  ["Content-Digest", "Repr-Digest"].forEach(function (name) {',
+    "    var value = rfcRespHeader(name);",
+    "    if (!value) return;",
+    '    if (!rfcSfParse(value, "dict")) { pm.expect.fail(name + " is not a valid RFC 8941 dictionary (RFC 9530): " + value); return; }',
+    '    if (!cryptoLib || rfcRespHeader("Content-Encoding")) return;',
+    '    var media = mediaParts(rfcRespHeader("Content-Type"));',
+    '    if (media.type !== "text" && !isJsonSubtype(media.subtype) && !/xml$/.test(media.subtype)) return;',
+    "    rfcSplitList(value).forEach(function (entry) {",
+    "      var match = entry.trim().match(/^(sha-256|sha-512)=:([A-Za-z0-9+\\/=]+):$/);",
+    "      if (!match) return;",
+    '      var computed = match[1] === "sha-256" ? cryptoLib.SHA256(responseText()) : cryptoLib.SHA512(responseText());',
+    "      var encoded = cryptoLib.enc.Base64.stringify(computed);",
+    '      if (encoded !== match[2]) pm.expect.fail(name + " " + match[1] + " does not match the response body (RFC 9530): computed " + encoded + " but header carries " + match[2]);',
+    "    });",
+    "  });",
+    "});",
+    "pm.test('Request credentials are well-formed per their authentication scheme RFCs', function () {",
+    '  var authorization = requestHeader("Authorization");',
+    '  if (authorization && authorization.indexOf("{{") === -1) {',
+    "    var schemeMatch = authorization.match(/^(\\S+)(?:\\s+([\\s\\S]*))?$/);",
+    '    var authScheme = schemeMatch ? schemeMatch[1].toLowerCase() : "";',
+    '    var authParams = schemeMatch && schemeMatch[2] !== undefined ? schemeMatch[2].trim() : "";',
+    '    if (authScheme === "basic") {',
+    "      var decoded = rfcBase64Decode(authParams);",
+    '      if (decoded === null) pm.expect.fail("Basic credentials must be base64 (RFC 7617)");',
+    '      else if (decoded.indexOf(":") === -1) pm.expect.fail("Basic credentials must decode to user-id:password (RFC 7617)");',
+    "    }",
+    '    if (authScheme === "bearer" && !/^[A-Za-z0-9\\-._~+\\/]+=*$/.test(authParams)) pm.expect.fail("Bearer token does not match the b64token grammar (RFC 6750)");',
+    '    if (authScheme === "digest") {',
+    '      rfcSplitList(authParams).forEach(function (entry) { var param = entry.trim(); if (param && !/^[!#$%&\'*+.^_`|~0-9A-Za-z-]+\\s*=\\s*("([^"\\\\]|\\\\.)*"|[!#$%&\'*+.^_`|~0-9A-Za-z-]+)$/.test(param)) pm.expect.fail("Digest auth-param is malformed (RFC 7616): " + param); });',
+    '      var digestResponse = authParams.match(/\\bresponse\\s*=\\s*"?([^",\\s]+)"?/i);',
+    '      if (digestResponse && !/^[0-9a-fA-F]+$/.test(digestResponse[1])) pm.expect.fail("Digest response parameter must be hex (RFC 7616): " + digestResponse[1]);',
+    "    }",
+    "  }",
+    '  var wantsJwt = (contract.security || []).some(function (alternative) { return alternative.some(function (check) { return check.prefix === "Bearer " && String(check.bearerFormat || "").toUpperCase() === "JWT"; }); });',
+    '  if (wantsJwt && authorization && authorization.indexOf("{{") === -1 && authorization.toLowerCase().indexOf("bearer ") === 0) {',
+    "    var jwtToken = authorization.slice(7).trim();",
+    '    var jwtSegments = jwtToken.split(".");',
+    '    if (jwtSegments.length !== 3) pm.expect.fail("bearerFormat JWT tokens must have three base64url segments (RFC 7519); got " + jwtSegments.length);',
+    '    else if (!jwtSegments.every(function (segment) { return /^[A-Za-z0-9_-]+$/.test(segment); })) pm.expect.fail("JWT segments must be base64url (RFC 7515)");',
+    "    else {",
+    '      var jwtDecode = function (segment) { var padded = segment.replace(/-/g, "+").replace(/_/g, "/"); while (padded.length % 4 !== 0) padded += "="; return rfcBase64Decode(padded); };',
+    "      var jwtHeader = null; var jwtPayload = null;",
+    '      try { jwtHeader = JSON.parse(jwtDecode(jwtSegments[0])); } catch (error) { pm.expect.fail("JWT header segment does not decode to JSON (RFC 7515)"); }',
+    '      try { jwtPayload = JSON.parse(jwtDecode(jwtSegments[1])); } catch (error) { pm.expect.fail("JWT payload segment does not decode to JSON (RFC 7519)"); }',
+    '      if (jwtHeader && typeof jwtHeader.alg !== "string") pm.expect.fail("JWT header must carry a string alg member (RFC 7515)");',
+    "      if (jwtPayload) {",
+    '        ["exp", "nbf", "iat"].forEach(function (claim) { if (jwtPayload[claim] !== undefined && typeof jwtPayload[claim] !== "number") pm.expect.fail("JWT " + claim + " claim must be numeric (RFC 7519)"); });',
+    '        if (typeof jwtPayload.exp === "number" && jwtPayload.exp * 1000 < Date.now()) rfcAdvise("RFC 7519: the outgoing JWT exp claim is already in the past");',
+    "      }",
+    "    }",
+    "  }",
+    '  if (hasQueryParam("access_token")) rfcAdvise("RFC 6750: bearer tokens SHOULD NOT travel in the query string");',
+    "  (contract.security || []).forEach(function (alternative) {",
+    "    alternative.forEach(function (check) {",
+    "      if (!check.checkable || !check.name) return;",
+    '      if (check.in === "query") { if (hasQueryParam(check.name)) rfcAdvise("Security scheme " + check.scheme + " sends credentials in the query string"); return; }',
+    '      if (check.in !== "header" || String(check.name).toLowerCase() === "authorization") return;',
+    "      var apiKeyValue = requestHeader(check.name);",
+    '      if (!apiKeyValue || apiKeyValue.indexOf("{{") !== -1) return;',
+    '      if (apiKeyValue !== apiKeyValue.trim()) pm.expect.fail("API key header " + check.name + " carries leading or trailing whitespace");',
+    '      if (!rfcIsFieldContent(apiKeyValue)) pm.expect.fail("API key header " + check.name + " contains characters forbidden by RFC 9110 field-content");',
+    "    });",
+    "  });",
+    "});",
+    "pm.test('Request preconditions, preferences, and patch bodies follow their RFCs', function () {",
+    '  ["If-Match", "If-None-Match"].forEach(function (name) {',
+    "    var value = requestHeader(name);",
+    '    if (!value || value.indexOf("{{") !== -1 || value.trim() === "*") return;',
+    '    rfcSplitList(value).forEach(function (entry) { if (entry.trim() && !rfcIsEntityTag(entry.trim())) pm.expect.fail(name + " must be * or a list of entity-tags (RFC 9110): " + entry.trim()); });',
+    "  });",
+    '  var prefer = requestHeader("Prefer");',
+    '  if (prefer && prefer.indexOf("{{") === -1) {',
+    '    rfcSplitList(prefer).forEach(function (entry) { var token = entry.split("=")[0].split(";")[0].trim(); if (token && !rfcIsToken(token)) pm.expect.fail("Prefer preference name must be a token (RFC 7240): " + entry.trim()); });',
+    "  }",
+    '  var requestContentType = mediaBase(requestHeader("Content-Type"));',
+    "  var body = pm.request.body;",
+    '  var raw = body && body.mode === "raw" && typeof body.raw === "string" ? body.raw : "";',
+    '  if (!raw.trim() || raw.indexOf("{{") !== -1 || /"<[^"<>]*>"/.test(raw)) return;',
+    '  if (requestContentType === "application/json-patch+json") {',
+    '    var patch; try { patch = JSON.parse(raw); } catch (error) { if (/<[A-Za-z][A-Za-z0-9_ -]*>/.test(raw)) return; pm.expect.fail("application/json-patch+json request body is not valid JSON (RFC 6902): " + error); return; }',
+    '    if (!Array.isArray(patch)) { pm.expect.fail("A JSON Patch document must be an array of operations (RFC 6902)"); return; }',
+    "    patch.forEach(function (operation, operationIndex) {",
+    '      if (!operation || typeof operation !== "object" || Array.isArray(operation)) { pm.expect.fail("JSON Patch operation " + operationIndex + " must be an object (RFC 6902)"); return; }',
+    '      if (["add", "remove", "replace", "move", "copy", "test"].indexOf(operation.op) === -1) pm.expect.fail("JSON Patch operation " + operationIndex + " has an invalid op (RFC 6902): " + operation.op);',
+    "      var pointerPattern = /^(\\/([^\\/~]|~[01])*)*$/;",
+    '      if (typeof operation.path !== "string" || !pointerPattern.test(operation.path)) pm.expect.fail("JSON Patch operation " + operationIndex + " path must be an RFC 6901 JSON Pointer");',
+    '      if (["add", "replace", "test"].indexOf(operation.op) !== -1 && operation.value === undefined) pm.expect.fail("JSON Patch " + operation.op + " operation " + operationIndex + " requires a value member (RFC 6902)");',
+    '      if (["move", "copy"].indexOf(operation.op) !== -1 && (typeof operation.from !== "string" || !pointerPattern.test(operation.from))) pm.expect.fail("JSON Patch " + operation.op + " operation " + operationIndex + " requires an RFC 6901 from pointer (RFC 6902)");',
+    "    });",
+    "  }",
+    '  if (requestContentType === "application/merge-patch+json") {',
+    '    try { JSON.parse(raw); } catch (error) { if (/<[A-Za-z][A-Za-z0-9_ -]*>/.test(raw)) return; pm.expect.fail("application/merge-patch+json request body must be valid JSON (RFC 7386): " + error); }',
+    "  }",
+    "});",
+    "pm.test('Deprecated operation signals deprecation in the response', function () {",
+    "  if (!contract.deprecated) return;",
+    '  if (!rfcRespHeader("Deprecation") && !rfcRespHeader("Sunset")) rfcAdvise("RFC 9745: the OpenAPI document deprecates this operation but the response carries neither Deprecation nor Sunset");',
+    "});",
+    "pm.test('OpenAPI link expressions resolve against the response', function () {",
+    "  if (!selected || !selected.value.links || selected.value.links.length === 0) return;",
+    "  var linkBody = null; var linkBodyParsed = false;",
+    "  selected.value.links.forEach(function (expression) {",
+    '    if (expression.kind === "header") {',
+    '      if (!pm.response.headers.get(expression.header)) pm.expect.fail("OpenAPI link " + expression.link + " references response header " + expression.header + " which is absent");',
+    "      return;",
+    "    }",
+    "    if (!linkBodyParsed) { linkBodyParsed = true; try { linkBody = JSON.parse(responseText()); } catch (error) { linkBody = null; } }",
+    '    if (linkBody === null) { pm.expect.fail("OpenAPI link " + expression.link + " references the response body but the body is not JSON"); return; }',
+    "    var target = linkBody;",
+    '    var tokens = String(expression.pointer).split("/").slice(1).map(function (token) { return token.replace(/~1/g, "/").replace(/~0/g, "~"); });',
+    "    for (var t = 0; t < tokens.length; t += 1) {",
+    '      if (target !== null && typeof target === "object") target = Array.isArray(target) ? target[Number(tokens[t])] : target[tokens[t]];',
+    "      else { target = undefined; break; }",
+    "    }",
+    '    if (target === undefined) pm.expect.fail("OpenAPI link " + expression.link + " expression $response.body#" + expression.pointer + " does not resolve in the response body");',
+    "  });",
+    "});",
+    "pm.test('Request URL conforms to an OpenAPI servers entry', function () {",
+    "  if (!contract.servers || contract.servers.length === 0) return;",
+    '  var requestUrl = "";',
+    '  try { requestUrl = String(pm.request.url.toString()); } catch (ignored) { requestUrl = ""; }',
+    '  if (!requestUrl || requestUrl.indexOf("{{") !== -1) return;',
+    '  var pathOnly = requestUrl.replace(/^[a-z][a-z0-9+.-]*:\\/\\/[^\\/]+/i, "");',
+    '  var matched = contract.servers.some(function (pattern) { try { var serverPattern = new RegExp(pattern, "i"); return serverPattern.test(requestUrl) || serverPattern.test(pathOnly); } catch (ignored) { return true; } });',
+    '  if (!matched) rfcAdvise("Request URL does not match any OpenAPI servers entry: " + requestUrl);',
+    "});",
     ...operation.security ? [
       "pm.test('Request carries credentials required by OpenAPI security', function () {",
       "  function satisfied(check) {",
@@ -299105,6 +299838,12 @@ function createContractScript(operation, warnings = []) {
       '      if (param.allowEmptyValue && entries.length === 1 && entries[0] === "") return;',
       "      if (entries.some(isPlaceholder)) return;",
       "      value = entries.map(function (entry) { return coerceBySchema(decodeComponent(entry), param.items); });",
+      '    } else if (param.decode === "deepObject") {',
+      "      var deepValue = {}; var deepFound = false; var deepPlaceholder = false;",
+      '      pm.request.url.query.each(function (queryParam) { if (!queryParam || queryParam.disabled === true) return; var deepMatch = String(queryParam.key).match(/^([^\\[]+)\\[([^\\]]+)\\]$/); if (!deepMatch || deepMatch[1].toLowerCase() !== String(param.name).toLowerCase()) return; deepFound = true; var deepRaw = queryParam.value === null || queryParam.value === undefined ? "" : String(queryParam.value); if (isPlaceholder(deepRaw)) { deepPlaceholder = true; return; } deepValue[deepMatch[2]] = coerceBySchema(decodeComponent(deepRaw), (param.schema && param.schema.properties && param.schema.properties[deepMatch[2]]) || {}); });',
+      '      if (!deepFound) { if (param.required) pm.expect.fail("Required parameter " + param.in + ":" + param.name + " was not sent for " + contract.method + " " + contract.path); return; }',
+      "      if (deepPlaceholder) return;",
+      "      value = deepValue;",
       "    } else if (param.decode) {",
       '      var joined = param.in === "query" ? queryValue(String(param.name).toLowerCase()) : headerValue(param.name);',
       '      if (joined === undefined) { if (param.required) pm.expect.fail("Required parameter " + param.in + ":" + param.name + " was not sent for " + contract.method + " " + contract.path); return; }',
@@ -299121,6 +299860,8 @@ function createContractScript(operation, warnings = []) {
       '    } else if (param.in === "path") {',
       "      value = pathParamValue(param.name);",
       "      if (value === undefined) return;",
+      '      if (param.pathStyle === "label") { if (String(value).charAt(0) !== ".") return; value = String(value).slice(1); }',
+      '      if (param.pathStyle === "matrix") { var matrixPrefix = ";" + param.name + "="; if (String(value).indexOf(matrixPrefix) !== 0) return; value = String(value).slice(matrixPrefix.length); }',
       '      if (isPlaceholder(value) || value.charAt(0) === ":" || value.charAt(0) === "{") return;',
       "      value = coerceBySchema(value, param.schema);",
       '    } else if (param.in === "cookie") {',
@@ -299172,6 +299913,9 @@ function createContractScript(operation, warnings = []) {
     '  if (pm.response.headers.get("Content-Encoding")) return;',
     "  var mustBeEmpty = isBodyless() || (selected && Object.keys(selected.value.content || {}).length === 0);",
     '  if (mustBeEmpty && Number(String(raw).trim()) !== 0) pm.expect.fail("OpenAPI defines no response body for " + contract.method + " " + contract.path + " status " + pm.response.code + " but Content-Length was " + raw);',
+    "});",
+    "pm.test('RFC SHOULD-level advisories are documented', function () {",
+    '  pm.expect(rfcAdvisories, "SHOULD-level findings (advisory, non-failing): " + rfcAdvisories.join("; ")).to.be.an("array");',
     "});"
   ];
 }
@@ -299241,6 +299985,9 @@ function assertStaticRequestShape(operation, request) {
     }
   }
   const warnings = collectStaticBodyWarnings(operation, request, contentType2);
+  if (["GET", "HEAD", "DELETE"].includes(operation.method) && hasRequestBody(request)) {
+    warnings.push(`CONTRACT_METHOD_BODY_SEMANTICS: ${operation.id} sends a request body with ${operation.method}; RFC 9110 defines no request-body semantics for this method`);
+  }
   if (operation.requestBody && !operation.requestBody.required && operation.requestBody.contentTypes.length > 0 && hasRequestBody(request) && contentType2) {
     const actual = contentType2.toLowerCase().split(";")[0]?.trim() ?? "";
     const matches = operation.requestBody.contentTypes.some((expected) => mediaTypeMatchesPattern(expected.toLowerCase(), actual));
@@ -299495,6 +300242,15 @@ function asRecord7(value) {
   }
   return value;
 }
+function adviseWorkspaceFlipForbidden(error2) {
+  if (error2 instanceof HttpError && error2.status === 403) {
+    const body = error2.responseBody || "";
+    if (/addWorkspaceLevelTeamRoles/i.test(body) || /You are not authorized to perform this action/i.test(body)) {
+      return new Error(WORKSPACE_PERSONAL_ONLY_ADVICE, { cause: error2 });
+    }
+  }
+  return error2;
+}
 function extractGitRepoUrl(value) {
   if (!value) return null;
   if (typeof value === "string") {
@@ -299800,7 +300556,7 @@ var PostmanGatewayAssetsClient = class _PostmanGatewayAssetsClient {
       }
     } catch (error2) {
       await this.deleteWorkspace(workspaceId).catch(() => void 0);
-      throw error2;
+      throw adviseWorkspaceFlipForbidden(error2);
     }
     return { id: workspaceId };
   }
@@ -301057,7 +301813,7 @@ function resolveActionVersion(explicit) {
   if (explicit) {
     return explicit;
   }
-  return "2.1.2" ? "2.1.2" : "unknown";
+  return typeof __ACTION_VERSION__ !== "undefined" && __ACTION_VERSION__ ? __ACTION_VERSION__ : "unknown";
 }
 function telemetryDisabled(env) {
   const flag = String(env.POSTMAN_ACTIONS_TELEMETRY ?? "").trim().toLowerCase();
@@ -301179,11 +301935,23 @@ function createTelemetryContext(options) {
   };
 }
 
-// src/lib/spec/openapi-loader.ts
+// src/action-version.ts
 var import_node_fs3 = require("node:fs");
+var import_node_path3 = require("node:path");
+function resolveActionVersion2() {
+  try {
+    const raw = (0, import_node_fs3.readFileSync)((0, import_node_path3.join)(__dirname, "..", "package.json"), "utf8");
+    return JSON.parse(raw).version ?? "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+
+// src/lib/spec/openapi-loader.ts
+var import_node_fs4 = require("node:fs");
 var import_promises3 = require("node:fs/promises");
 var import_node_url2 = require("node:url");
-var import_node_path3 = __toESM(require("node:path"), 1);
+var import_node_path4 = __toESM(require("node:path"), 1);
 
 // node_modules/@apidevtools/json-schema-ref-parser/dist/lib/util/convert-path-to-posix.js
 var win32Sep = "\\";
@@ -301524,14 +302292,14 @@ function fromFileSystemPath(path10) {
     const hasProjectUri = upperPath.includes(posixUpper);
     const isAbsolutePath = isAbsoluteWin32Path.test(path10) || path10.startsWith("http://") || path10.startsWith("https://") || path10.startsWith("file://");
     if (!(hasProjectDir || hasProjectUri || isAbsolutePath) && !projectDir.startsWith("http")) {
-      const join3 = (a, b) => {
+      const join4 = (a, b) => {
         if (a.endsWith("/") || a.endsWith("\\")) {
           return a + b;
         } else {
           return a + "/" + b;
         }
       };
-      path10 = join3(projectDir, path10);
+      path10 = join4(projectDir, path10);
     }
     path10 = convertPathToPosix(path10);
   }
@@ -305646,6 +306414,7 @@ function inventory$Ref($refParent, $refKey, path10, scopeBase, dynamicIdScope, p
   const file = stripHash(pointer.path);
   const hash = getHash(pointer.path);
   const external = file !== $refs._root$Ref.path && !$refs._aliases[file];
+  const nestedResource = Boolean($refs._aliases[file]) && pointer.$ref.value !== $refs._root$Ref.value;
   const extended = ref_default.isExtended$Ref($ref);
   indirections += pointer.indirections;
   const existingEntry = findInInventory(inventory, $refParent, $refKey);
@@ -305679,6 +306448,8 @@ function inventory$Ref($refParent, $refKey, path10, scopeBase, dynamicIdScope, p
     // Does this $ref extend its resolved value? (i.e. it has extra properties, in addition to "$ref")
     external,
     // Does this $ref pointer point to a file other than the main JSON Schema file?
+    nestedResource,
+    // Does this $ref resolve to an embedded schema resource with its own $id?
     indirections
     // The number of indirect references that were traversed to resolve the value
   });
@@ -305714,7 +306485,7 @@ function remap(inventory, options, rootId) {
   for (const entry of inventory) {
     const bundleOpts = options.bundle || {};
     if (!entry.external) {
-      if (bundleOpts.optimizeInternalRefs !== false) {
+      if (bundleOpts.optimizeInternalRefs !== false && !entry.nestedResource) {
         entry.$ref.$ref = entry.hash;
       }
     } else if (entry.file === file && entry.hash === hash) {
@@ -313518,22 +314289,22 @@ async function loadOpenApiContractSpec(specUrl, options = {}) {
 async function loadOpenApiContractSpecFromPath(specPath, options = {}) {
   if (!specPath) throw new Error("CONTRACT_SPEC_READ_FAILED: spec-path must not be empty");
   const workspaceRoot = (() => {
-    const root = import_node_path3.default.resolve(process.env.GITHUB_WORKSPACE ?? process.cwd());
+    const root = import_node_path4.default.resolve(process.env.GITHUB_WORKSPACE ?? process.cwd());
     try {
-      return (0, import_node_fs3.realpathSync)(root);
+      return (0, import_node_fs4.realpathSync)(root);
     } catch {
       return root;
     }
   })();
-  const resolved = import_node_path3.default.resolve(workspaceRoot, specPath);
+  const resolved = import_node_path4.default.resolve(workspaceRoot, specPath);
   let absolutePath;
   try {
-    absolutePath = (0, import_node_fs3.realpathSync)(resolved);
+    absolutePath = (0, import_node_fs4.realpathSync)(resolved);
   } catch (error2) {
     throw new Error(`CONTRACT_SPEC_READ_FAILED: Unable to read spec at ${specPath}`, { cause: error2 });
   }
-  const rel = import_node_path3.default.relative(workspaceRoot, absolutePath);
-  if (!rel || rel.startsWith("..") || import_node_path3.default.isAbsolute(rel)) {
+  const rel = import_node_path4.default.relative(workspaceRoot, absolutePath);
+  if (!rel || rel.startsWith("..") || import_node_path4.default.isAbsolute(rel)) {
     throw new Error(`CONTRACT_SPEC_READ_FAILED: spec-path must resolve inside ${workspaceRoot}, got: ${specPath}`);
   }
   const maxBytes = options.maxBytesPerResource ?? SAFE_FETCH_LIMITS.maxBytesPerResource;
@@ -313947,6 +314718,17 @@ function buildOperationScript(operation, index, warnings) {
     '    pm.expect(pm.response.code, "GraphQL responses are HTTP 200 even when the data field carries errors").to.be.below(500);',
     "});"
   );
+  lines.push(
+    "pm.test(" + JSON.stringify("[" + label + "] GraphQL-over-HTTP media type and status are consistent") + ", function () {",
+    '    var contentType = ((pm.response.headers && pm.response.headers.get && pm.response.headers.get("Content-Type")) || "").toLowerCase();',
+    '    var mediaType = contentType.split(";")[0].trim();',
+    "    if (!mediaType) return;",
+    '    if (mediaType !== "application/graphql-response+json" && mediaType !== "application/json") { pm.expect.fail("GraphQL-over-HTTP responses use application/graphql-response+json or application/json; got: " + (mediaType || "<missing>")); }',
+    "    var wellFormed = gqlBody.data !== undefined || Array.isArray(gqlBody.errors);",
+    '    if (mediaType === "application/graphql-response+json" && pm.response.code >= 200 && pm.response.code < 300 && !wellFormed) { pm.expect.fail("application/graphql-response+json forbids a 2xx status when the body is not a well-formed GraphQL response"); }',
+    '    if (mediaType === "application/json" && gqlBody.data !== undefined && gqlBody.data !== null && pm.response.code !== 200) { pm.expect.fail("a GraphQL response carrying data over application/json must be HTTP 200; got " + pm.response.code); }',
+    "});"
+  );
   lines.push(
     `pm.test(${JSON.stringify(`[${label}] GraphQL errors are well-formed and not a total failure`)}, function () {`,
     "    var errors = gqlBody.errors;",
@@ -315487,6 +316269,8 @@ function createSoapScript(operation, warnings = []) {
     hasOutput: Boolean(operation.output)
   };
   const responseRegex = operation.expectedResponseElement ? elementPresenceRegex(operation.expectedResponseElement) : "";
+  const mediaType = operation.soapVersion === "1.2" ? "application/soap+xml" : "text/xml";
+  const faultStatusLine = operation.soapVersion === "1.2" ? '  if (faulted && code !== 500 && code !== 400) pm.expect.fail("SOAP 1.2 Faults ride HTTP 500, or 400 for env:Sender faults (SOAP 1.2 Part 2 HTTP binding); got HTTP " + code);' : '  if (faulted && code !== 500) pm.expect.fail("SOAP 1.1 Faults must ride HTTP 500 (WS-I Basic Profile R1126); got HTTP " + code);';
   const lines = [
     `var soap = JSON.parse(${JSON.stringify(JSON.stringify(meta))});`,
     'var bodyText = (pm.response.text && pm.response.text()) || "";',
@@ -315497,9 +316281,11 @@ function createSoapScript(operation, warnings = []) {
     "  pm.response.to.have.status(200);",
     "});",
     "",
-    "pm.test('SOAP response Content-Type is XML', function () {",
+    // SOAP 1.1 responses bind to text/xml (SOAP 1.1 HTTP binding, WS-I Basic
+    // Profile); SOAP 1.2 responses bind to application/soap+xml (RFC 3902).
+    `pm.test('SOAP response Content-Type matches the SOAP ${operation.soapVersion} binding', function () {`,
     '  var ct = header("Content-Type").toLowerCase();',
-    '  pm.expect(ct, "expected an XML SOAP content-type, got: " + ct).to.match(/(?:text\\/xml|application\\/soap\\+xml|application\\/xml|\\+xml)/);',
+    `  pm.expect(ct, "SOAP ${operation.soapVersion} responses use ${mediaType} (got: " + (ct || "<missing>") + ")").to.include("${mediaType}");`,
     "});",
     "",
     "pm.test('SOAP Envelope element is present', function () {",
@@ -315516,6 +316302,13 @@ function createSoapScript(operation, warnings = []) {
     '    var detail = (bodyText.match(/<(?:[A-Za-z_][\\w.-]*:)?(?:faultstring|Reason|Text)[^>]*>([\\s\\S]*?)<\\//) || [])[1] || "";',
     '    pm.expect.fail("SOAP Fault returned for operation " + soap.name + (detail ? (": " + detail.trim()) : ""));',
     "  }",
+    "});",
+    "",
+    "pm.test('SOAP Fault and HTTP status are consistent', function () {",
+    '  var faulted = matchTag("Fault").test(bodyText);',
+    "  var code = pm.response.code;",
+    faultStatusLine,
+    '  if (!faulted && code === 500) pm.expect.fail("HTTP 500 from a SOAP endpoint must carry a SOAP Fault in the body");',
     "});"
   ];
   if (responseRegex) {
@@ -316767,6 +317560,7 @@ function normalizeSpecDocument(raw, warn) {
 async function runBootstrap(inputs, dependencies) {
   const telemetry = createTelemetryContext({
     action: "postman-bootstrap-action",
+    actionVersion: resolveActionVersion2(),
     logger: dependencies.core
   });
   try {
@@ -317173,7 +317967,7 @@ async function runBootstrapInner(inputs, dependencies, telemetry) {
     async () => {
       if (inputs.specPath) {
         const workspaceRoot = path9.resolve(process.env.GITHUB_WORKSPACE ?? process.cwd());
-        return (0, import_node_fs4.readFileSync)(path9.resolve(workspaceRoot, inputs.specPath), "utf8");
+        return (0, import_node_fs5.readFileSync)(path9.resolve(workspaceRoot, inputs.specPath), "utf8");
       }
       if (dependencies.specFetcher === fetch) {
         return safeFetchText(inputs.specUrl, { depth: 0 });