@postman-cse/onboarding-bootstrap 2.2.0 → 2.3.0

package/dist/action.cjs

@@ -298324,7 +298324,11 @@ function securityCheckFor(schemeName, scheme) {
   if (scheme?.type === "http") {
     const httpScheme = String(scheme.scheme || "").toLowerCase();
     if (httpScheme === "basic") return { scheme: schemeName, kind, checkable: true, prefix: "Basic " };
-    if (httpScheme === "bearer") return { scheme: schemeName, kind, checkable: true, prefix: "Bearer " };
+    if (httpScheme === "bearer") {
+      const check = { scheme: schemeName, kind, checkable: true, prefix: "Bearer " };
+      if (typeof scheme.bearerFormat === "string" && scheme.bearerFormat) check.bearerFormat = scheme.bearerFormat;
+      return check;
+    }
     if (httpScheme) return { scheme: schemeName, kind, checkable: true, prefix: `${httpScheme.charAt(0).toUpperCase()}${httpScheme.slice(1)} ` };
     return { scheme: schemeName, kind, checkable: true, in: "header", name: "Authorization" };
   }
@@ -298463,6 +298467,7 @@ function collectParameterChecks(root, pathItem, operation, version2, operationId
       if (defaultSerialization) warnings.push(`CONTRACT_SCHEMA_NOT_COMPILED: parameter ${location2}:${name} schema on ${operationId} skipped (${packed.unsupported})`);
       continue;
     }
+    validateParameterExamples(root, param, packed, `${location2}:${name} of ${operationId}`, warnings);
     if (location2 === "path") {
       const containingSegment = pathTemplate.split("/").find((segment) => segment.includes(`{${name}}`));
       if (containingSegment !== void 0 && containingSegment !== `{${name}}`) {
@@ -298479,12 +298484,32 @@ function collectParameterChecks(root, pathItem, operation, version2, operationId
     }
     const scalarSchema = packedScalarSchema(packed);
     if (scalarSchema !== void 0) {
-      if (!defaultSerialization) continue;
+      const decodablePathStyle = location2 === "path" && (style === "label" || style === "matrix") && !explode ? style : void 0;
+      if (!defaultSerialization && !decodablePathStyle) continue;
+      if (!defaultSerialization) warnings.push(...noteWarnings);
       const check2 = { in: location2, name, required: param.required === true, schema: scalarSchema };
+      if (decodablePathStyle) check2.pathStyle = decodablePathStyle;
       if (location2 === "query" && param.allowEmptyValue === true) check2.allowEmptyValue = true;
       checks.push(check2);
       continue;
     }
+    if (location2 === "query" && style === "deepObject" && explode) {
+      const objectSchema = asRecord5(packed.schema);
+      const properties = objectSchema ? asRecord5(objectSchema.properties) : null;
+      const allScalar = properties !== null && Object.keys(properties).length > 0 && Object.values(properties).every((prop) => {
+        const record = asRecord5(prop);
+        if (!record) return false;
+        const types2 = Array.isArray(record.type) ? record.type : [record.type];
+        return types2.every((entry) => typeof entry === "string" && SCALAR_SCHEMA_TYPES.has(entry));
+      });
+      if (allScalar) {
+        warnings.push(...noteWarnings);
+        const check2 = { in: "query", name, required: param.required === true, schema: packed.schema, decode: "deepObject" };
+        if (param.allowEmptyValue === true) check2.allowEmptyValue = true;
+        checks.push(check2);
+        continue;
+      }
+    }
     if (location2 !== "query" && location2 !== "header") continue;
     const items = packedArrayItemsSchema(packed);
     if (items === void 0) continue;
@@ -298795,6 +298820,185 @@ function responseHeaders(root, version2, response, context, warnings) {
   }
   return entries;
 }
+var IANA_HTTP_AUTH_SCHEMES = /* @__PURE__ */ new Set([
+  "basic",
+  "bearer",
+  "concealed",
+  "digest",
+  "dpop",
+  "gnap",
+  "hoba",
+  "mutual",
+  "negotiate",
+  "oauth",
+  "privatetoken",
+  "scram-sha-1",
+  "scram-sha-256",
+  "vapid"
+]);
+function httpsUrlLint(value, label, schemeName) {
+  if (typeof value !== "string" || !value) return void 0;
+  try {
+    const parsed = new URL(value);
+    if (parsed.protocol !== "https:") return `CONTRACT_SECURITY_SCHEME_URL: security scheme ${schemeName} ${label} ${value} is not an HTTPS URL`;
+  } catch {
+    return `CONTRACT_SECURITY_SCHEME_URL: security scheme ${schemeName} ${label} ${value} is not a valid URL`;
+  }
+  return void 0;
+}
+function collectSecurityStaticLints(root, operation) {
+  const securitySchemes = asRecord5(asRecord5(root.components)?.securitySchemes);
+  const requirements = operation.security === void 0 ? asArray3(root.security) : asArray3(operation.security);
+  const warnings = /* @__PURE__ */ new Set();
+  for (const requirement of requirements.map((entry) => asRecord5(entry)).filter((entry) => Boolean(entry))) {
+    for (const [schemeName, requiredScopes] of Object.entries(requirement)) {
+      let scheme;
+      try {
+        scheme = resolveInternalRef(root, securitySchemes?.[schemeName]);
+      } catch {
+        scheme = null;
+      }
+      if (!scheme) continue;
+      if (scheme.type === "http") {
+        const httpScheme = String(scheme.scheme || "").toLowerCase();
+        if (httpScheme && !IANA_HTTP_AUTH_SCHEMES.has(httpScheme)) {
+          warnings.add(`CONTRACT_UNKNOWN_HTTP_AUTH_SCHEME: security scheme ${schemeName} uses "${httpScheme}", which is not in the IANA HTTP Authentication Scheme registry`);
+        }
+      }
+      if (scheme.type === "apiKey" && String(scheme.in) === "query") {
+        warnings.add(`CONTRACT_CREDENTIALS_IN_QUERY: security scheme ${schemeName} sends credentials in the query string, which leaks into logs and referrers`);
+      }
+      if (scheme.type === "openIdConnect") {
+        const urlWarning = httpsUrlLint(scheme.openIdConnectUrl, "openIdConnectUrl", schemeName);
+        if (urlWarning) warnings.add(urlWarning);
+        else if (typeof scheme.openIdConnectUrl === "string" && !scheme.openIdConnectUrl.endsWith("/.well-known/openid-configuration")) {
+          warnings.add(`CONTRACT_SECURITY_SCHEME_URL: security scheme ${schemeName} openIdConnectUrl does not end in /.well-known/openid-configuration`);
+        }
+      }
+      if (scheme.type === "oauth2") {
+        const flows = asRecord5(scheme.flows) ?? {};
+        const declaredScopes = /* @__PURE__ */ new Set();
+        for (const [flowName, rawFlow] of Object.entries(flows)) {
+          const flow = asRecord5(rawFlow);
+          if (!flow) continue;
+          for (const scope of Object.keys(asRecord5(flow.scopes) ?? {})) declaredScopes.add(scope);
+          const urlFields = [["refreshUrl", flow.refreshUrl]];
+          if (flowName === "implicit" || flowName === "authorizationCode") urlFields.push(["authorizationUrl", flow.authorizationUrl]);
+          if (flowName === "password" || flowName === "clientCredentials" || flowName === "authorizationCode") urlFields.push(["tokenUrl", flow.tokenUrl]);
+          for (const [label, value] of urlFields) {
+            const urlWarning = httpsUrlLint(value, `${flowName} ${label}`, schemeName);
+            if (urlWarning) warnings.add(urlWarning);
+          }
+        }
+        for (const scope of asArray3(requiredScopes).filter((entry) => typeof entry === "string")) {
+          if (!declaredScopes.has(scope)) {
+            warnings.add(`CONTRACT_OAUTH2_UNDECLARED_SCOPE: operation requires scope "${scope}" of ${schemeName}, which no flow of the scheme declares`);
+          }
+        }
+      }
+    }
+  }
+  return [...warnings];
+}
+function collectSecurityResponseLints(root, operation, responses, operationId) {
+  const warnings = [];
+  const requirements = operation.security === void 0 ? asArray3(root.security) : asArray3(operation.security);
+  const requirementRecords = requirements.map((entry) => asRecord5(entry)).filter((entry) => Boolean(entry));
+  const secured = requirementRecords.length > 0 && requirementRecords.every((entry) => Object.keys(entry).length > 0);
+  const statusKeys = new Set(Object.keys(responses));
+  const hasCatchAll = statusKeys.has("default") || statusKeys.has("4XX");
+  if (secured && !statusKeys.has("401") && !hasCatchAll) {
+    warnings.push(`CONTRACT_SECURITY_RESPONSES_INCOMPLETE: ${operationId} requires authentication but documents no 401 (or 4XX/default) response`);
+  }
+  const usesScopes = requirementRecords.some((entry) => Object.values(entry).some((scopes) => Array.isArray(scopes) && scopes.length > 0));
+  if (secured && usesScopes && !statusKeys.has("403") && !hasCatchAll) {
+    warnings.push(`CONTRACT_SECURITY_RESPONSES_INCOMPLETE: ${operationId} requires scopes but documents no 403 (or 4XX/default) response`);
+  }
+  if (requirementRecords.length === 0) {
+    for (const status of ["401", "403"]) {
+      if (statusKeys.has(status)) warnings.push(`CONTRACT_UNSECURED_AUTH_RESPONSES: ${operationId} documents a ${status} response but declares no security requirement`);
+    }
+  }
+  return warnings;
+}
+function collectLinkExpressions(root, response, operationId, warnings) {
+  const links = asRecord5(response.links);
+  if (!links) return [];
+  const expressions = [];
+  let unevaluated = false;
+  for (const [linkName, rawLink] of Object.entries(links)) {
+    let link;
+    try {
+      link = resolveInternalRef(root, rawLink);
+    } catch {
+      link = null;
+    }
+    if (!link) {
+      unevaluated = true;
+      continue;
+    }
+    const values = Object.values(asRecord5(link.parameters) ?? {});
+    if (link.requestBody !== void 0) values.push(link.requestBody);
+    if (values.length === 0) unevaluated = true;
+    for (const value of values) {
+      if (typeof value !== "string" || !value.startsWith("$")) continue;
+      const bodyMatch = value.match(/^\$response\.body#(\/.*)$/);
+      if (bodyMatch) {
+        expressions.push({ link: linkName, kind: "body", pointer: bodyMatch[1] });
+        continue;
+      }
+      const headerMatch = value.match(/^\$response\.header\.([!#$%&'*+.^_`|~0-9A-Za-z-]+)$/);
+      if (headerMatch) {
+        expressions.push({ link: linkName, kind: "header", header: headerMatch[1] });
+        continue;
+      }
+      unevaluated = true;
+    }
+  }
+  if (expressions.length === 0) {
+    if (unevaluated) warnings.add(`CONTRACT_LINKS_NOT_VALIDATED: response links are not validated for ${operationId}`);
+  } else if (unevaluated) {
+    warnings.add(`CONTRACT_LINKS_PARTIALLY_VALIDATED: some link expressions for ${operationId} are not runtime-evaluable and are skipped`);
+  }
+  return expressions;
+}
+function escapeRegExpLiteral(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function serverAdvisoryPatterns(root, pathItem, operation) {
+  const serverLists = [asArray3(operation.servers), asArray3(pathItem.servers), asArray3(root.servers)];
+  const servers = serverLists.find((list) => list.length > 0) ?? [];
+  const patterns = [];
+  for (const rawServer of servers) {
+    const server = asRecord5(rawServer);
+    if (!server) continue;
+    const url = typeof server.url === "string" ? server.url.trim() : "";
+    if (!url || url === "/") continue;
+    const variables = asRecord5(server.variables);
+    const pattern = url.split(/(\{[^}]+\})/).map((part) => {
+      const varMatch = part.match(/^\{([^}]+)\}$/);
+      if (!varMatch) return escapeRegExpLiteral(part);
+      const variable = asRecord5(variables?.[varMatch[1]]);
+      const enumValues = asArray3(variable?.enum).filter((entry) => typeof entry === "string");
+      if (enumValues.length > 0) return `(${enumValues.map(escapeRegExpLiteral).join("|")})`;
+      return "[^/]*";
+    }).join("");
+    patterns.push(`^${pattern}`);
+  }
+  return patterns.length > 0 ? patterns : void 0;
+}
+function validateParameterExamples(root, param, packed, context, warnings) {
+  if (packed.schema === void 0 || packed.unsupported) return;
+  const candidates = exampleCandidates(root, param);
+  if (candidates.length === 0) return;
+  const validate3 = compileSchemaValidator(packed.schema);
+  if (!validate3) return;
+  for (const candidate of candidates) {
+    if (!validate3(candidate.value)) {
+      warnings.push(`CONTRACT_EXAMPLE_SCHEMA_MISMATCH: ${candidate.label} for parameter ${context} does not match its schema`);
+    }
+  }
+}
 function buildContractIndex(root) {
   if (root.swagger === "2.0") throw new Error("CONTRACT_UNSUPPORTED_OPENAPI_VERSION: Dynamic contract tests require OpenAPI 3.0 or 3.1 (found swagger 2.0)");
   if (!("openapi" in root)) throw new Error("CONTRACT_UNSUPPORTED_OPENAPI_VERSION: Dynamic contract tests require OpenAPI 3.0 or 3.1 (missing openapi)");
@@ -298813,6 +299017,9 @@ function buildContractIndex(root) {
         const operation = resolveInternalRef(root, rawOperation);
         if (!operation) continue;
         if (operation.callbacks) warnings.push(`CONTRACT_CALLBACKS_NOT_VALIDATED: callbacks are not validated for ${lowerMethod.toUpperCase()} ${path10}`);
+        if (operation.requestBody !== void 0 && ["get", "head", "delete"].includes(lowerMethod)) {
+          warnings.push(`CONTRACT_METHOD_BODY_SEMANTICS: ${lowerMethod.toUpperCase()} ${path10} declares a request body; RFC 9110 defines no request-body semantics for ${lowerMethod.toUpperCase()}`);
+        }
         const responses = asRecord5(operation.responses);
         if (!responses || Object.keys(responses).length === 0) {
           throw new Error(`CONTRACT_OPERATION_NO_RESPONSES: ${lowerMethod.toUpperCase()} ${path10} must define at least one response`);
@@ -298822,11 +299029,15 @@ function buildContractIndex(root) {
         for (const [status, rawResponse] of Object.entries(responses)) {
           const response = resolveInternalRef(root, rawResponse);
           if (!response) continue;
-          if (asRecord5(response.links)) {
-            responseWarnings.add(`CONTRACT_LINKS_NOT_VALIDATED: response links are not validated for ${lowerMethod.toUpperCase()} ${path10}`);
+          if (status !== "default" && !/^[1-5]XX$/.test(status) && !/^[1-5][0-9][0-9]$/.test(status)) {
+            responseWarnings.add(`CONTRACT_INVALID_STATUS_CODE: ${lowerMethod.toUpperCase()} ${path10} declares response status "${status}" outside RFC 9110's 100-599, 1XX-5XX, or default forms`);
           }
+          const linkExpressions = collectLinkExpressions(root, response, `${lowerMethod.toUpperCase()} ${path10}`, responseWarnings);
           const responseContext = `${lowerMethod.toUpperCase()} ${path10} status ${status}`;
           const content = responseContent(root, version2, response, responseContext, responseWarnings);
+          if ((status === "204" || status === "205" || status === "304") && Object.keys(content).length > 0) {
+            responseWarnings.add(`CONTRACT_BODYLESS_STATUS_WITH_CONTENT: ${lowerMethod.toUpperCase()} ${path10} declares content for status ${status}, which RFC 9110 forbids on the wire`);
+          }
           for (const [contentType2, media] of Object.entries(content)) {
             const base = contentType2.toLowerCase().split(";")[0]?.trim() ?? "";
             const schemaType = asRecord5(media.schema)?.type;
@@ -298838,7 +299049,8 @@ function buildContractIndex(root) {
           contractResponses[normalizeResponseKey(status)] = {
             content,
             hasBody: Object.keys(content).length > 0,
-            headers
+            headers,
+            ...linkExpressions.length > 0 ? { links: linkExpressions } : {}
           };
         }
         const candidates = [...new Set([
@@ -298851,11 +299063,13 @@ function buildContractIndex(root) {
         opWarnings.push(...collectSecuritySchemeWarnings(root, operation));
         const parameterChecks = collectParameterChecks(root, pathItem, operation, version2, operationId, path10, opWarnings);
         const checkedKeys = new Set((parameterChecks ?? []).map((check) => `${check.in}:${check.name.toLowerCase()}`));
-        const decodedKeys = new Set((parameterChecks ?? []).filter((check) => check.decode).map((check) => `${check.in}:${check.name.toLowerCase()}`));
+        const decodedKeys = new Set((parameterChecks ?? []).filter((check) => check.decode || check.pathStyle).map((check) => `${check.in}:${check.name.toLowerCase()}`));
         opWarnings.push(...collectSerializationWarnings(root, pathItem, operation, decodedKeys));
         if (operation.deprecated === true) {
           opWarnings.push(`CONTRACT_OPERATION_DEPRECATED: ${lowerMethod.toUpperCase()} ${path10} is marked deprecated in the OpenAPI document`);
         }
+        opWarnings.push(...collectSecurityStaticLints(root, operation));
+        opWarnings.push(...collectSecurityResponseLints(root, operation, responses, operationId));
         const requiredParameters = collectParameters(root, pathItem, operation);
         for (const parameter of requiredParameters.filter((entry) => entry.securityDerived)) {
           opWarnings.push(`CONTRACT_SECURITY_NOT_VALIDATED: security parameter ${parameter.in}:${parameter.name} is not statically required in generated requests`);
@@ -298885,6 +299099,8 @@ function buildContractIndex(root) {
           requestBody: collectRequestBody(root, operation, version2, operationId, opWarnings),
           security: collectSecurityRuntimeChecks(root, operation),
           pathMethods: Object.keys(pathItem).filter((key) => HTTP_METHODS.has(key)).map((key) => key.toUpperCase()),
+          deprecated: operation.deprecated === true || void 0,
+          servers: serverAdvisoryPatterns(root, pathItem, operation),
           warnings: opWarnings
         });
       }
@@ -299061,7 +299277,7 @@ function buildValidatorAssignments(operation, warnings, skipped) {
   return lines;
 }
 function createContractScript(operation, warnings = []) {
-  const contract = { method: operation.method, path: operation.path, responses: operation.responses, security: operation.security, parameters: operation.parameterChecks, pathMethods: operation.pathMethods };
+  const contract = { method: operation.method, path: operation.path, responses: operation.responses, security: operation.security, parameters: operation.parameterChecks, pathMethods: operation.pathMethods, deprecated: operation.deprecated, servers: operation.servers };
   const skipped = [];
   const validatorLines = buildValidatorAssignments(operation, warnings, skipped);
   return [
@@ -299180,6 +299396,13 @@ function createContractScript(operation, warnings = []) {
     '    if (!challenge) pm.expect.fail("RFC 9110 requires WWW-Authenticate on 401 responses");',
     '    var wantsBearer = (contract.security || []).some(function (alternative) { return alternative.some(function (check) { return check.prefix && check.prefix.toLowerCase().indexOf("bearer") === 0; }); });',
     '    if (wantsBearer && challenge && challenge.toLowerCase().indexOf("bearer") === -1) pm.expect.fail("RFC 6750 expects a Bearer challenge on 401 for bearer-secured operations; got: " + challenge);',
+    '    if (challenge && /\\bbasic\\b/i.test(challenge) && !/realm\\s*=/i.test(challenge)) pm.expect.fail("RFC 7617 requires a realm parameter on Basic challenges: " + challenge);',
+    '    if (challenge && /\\bdigest\\b/i.test(challenge) && (!/realm\\s*=/i.test(challenge) || !/nonce\\s*=/i.test(challenge))) pm.expect.fail("RFC 7616 requires realm and nonce on Digest challenges: " + challenge);',
+    "  }",
+    "  if (code === 401 || code === 403) {",
+    '    var authChallenge = respHeader("WWW-Authenticate");',
+    '    var bearerError = authChallenge && /\\bbearer\\b/i.test(authChallenge) ? authChallenge.match(/\\berror\\s*=\\s*"?([A-Za-z0-9_]+)"?/i) : null;',
+    '    if (bearerError && ["invalid_request", "invalid_token", "insufficient_scope"].indexOf(bearerError[1]) === -1) pm.expect.fail("RFC 6750 Bearer error code must be invalid_request, invalid_token, or insufficient_scope; got " + bearerError[1]);',
     "  }",
     "  if (code === 405) {",
     '    var allow = respHeader("Allow");',
@@ -299188,11 +299411,6 @@ function createContractScript(operation, warnings = []) {
     '    (contract.pathMethods || []).forEach(function (method) { if (allowed.indexOf(method) === -1) pm.expect.fail("Allow on 405 must list every method the OpenAPI path declares (RFC 9110); missing " + method + " in: " + allow); });',
     "  }",
     '  if (code === 304 && responseText().trim().length > 0) pm.expect.fail("RFC 9110 forbids content in a 304 response");',
-    "  if (code === 206) {",
-    '    var range = respHeader("Content-Range");',
-    '    if (!range) pm.expect.fail("RFC 9110 requires Content-Range on a single-part 206 response");',
-    '    if (range && !/^\\S+ (\\d+-\\d+|\\*)\\/(\\d+|\\*)$/.test(range)) pm.expect.fail("Content-Range is not a valid RFC 9110 range: " + range);',
-    "  }",
     '  var retryAfter = respHeader("Retry-After");',
     "  if (retryAfter && (code === 429 || code === 503 || (code >= 300 && code < 400))) {",
     '    if (!/^\\d+$/.test(retryAfter.trim()) && isNaN(Date.parse(retryAfter))) pm.expect.fail("Retry-After must be delay-seconds or an HTTP-date (RFC 9110): " + retryAfter);',
@@ -299210,6 +299428,7 @@ function createContractScript(operation, warnings = []) {
     '    try { problem = pm.response.json(); } catch (error) { pm.expect.fail("application/problem+json body is not valid JSON (RFC 9457): " + error); }',
     '    if (!problem || typeof problem !== "object" || Array.isArray(problem)) pm.expect.fail("problem details must be a JSON object (RFC 9457)");',
     '    ["type", "title", "detail", "instance"].forEach(function (member) { if (problem[member] !== undefined && typeof problem[member] !== "string") pm.expect.fail("RFC 9457 " + member + " member must be a string; got " + typeof problem[member]); });',
+    '    ["type", "instance"].forEach(function (member) { if (typeof problem[member] === "string" && /\\s/.test(problem[member].trim())) pm.expect.fail("RFC 9457 " + member + " member must be a URI-reference (RFC 3986): " + problem[member]); });',
     "    if (problem.status !== undefined) {",
     '      if (typeof problem.status !== "number") pm.expect.fail("RFC 9457 status member must be a number; got " + typeof problem.status);',
     '      else if (problem.status !== pm.response.code) pm.expect.fail("RFC 9457 status member (" + problem.status + ") must match the HTTP status code (" + pm.response.code + ")");',
@@ -299227,6 +299446,359 @@ function createContractScript(operation, warnings = []) {
     "    });",
     "  }",
     "});",
+    "var rfcAdvisories = [];",
+    "function rfcAdvise(message) { if (rfcAdvisories.indexOf(message) === -1) rfcAdvisories.push(message); }",
+    'function rfcRespHeader(name) { return pm.response.headers.get(name) || ""; }',
+    "function rfcHeaderAll(name) { var out = []; pm.response.headers.each(function (header) { if (header && String(header.key).toLowerCase() === String(name).toLowerCase()) out.push(String(header.value)); }); return out; }",
+    "function rfcIsHttpDate(value) { return /^(Mon|Tue|Wed|Thu|Fri|Sat|Sun), [0-3][0-9] (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) [0-9]{4} [0-2][0-9]:[0-5][0-9]:[0-5][0-9] GMT$/.test(String(value).trim()) && !isNaN(Date.parse(value)); }",
+    "function rfcIsToken(value) { return /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(String(value)); }",
+    'function rfcIsEntityTag(value) { return /^(W\\/)?"[\\x21\\x23-\\x7e\\x80-\\xff]*"$/.test(String(value).trim()); }',
+    "function rfcIsFieldContent(value) { return /^[\\t \\x21-\\x7e\\x80-\\xff]*$/.test(String(value)); }",
+    'function rfcTokenList(value) { var parts = String(value).split(","); for (var i = 0; i < parts.length; i += 1) { if (!rfcIsToken(parts[i].trim())) return false; } return true; }',
+    `function rfcSplitList(value) { var out = []; var current = ""; var inQuote = false; for (var i = 0; i < value.length; i += 1) { var ch = value.charAt(i); if (ch === "\\\\" && inQuote) { current += ch + (value.charAt(i + 1) || ""); i += 1; continue; } if (ch === '"') inQuote = !inQuote; if (ch === "," && !inQuote) { out.push(current); current = ""; continue; } current += ch; } out.push(current); return out; }`,
+    'function rfcBase64Decode(value) { var alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; var clean = String(value).replace(/=+$/, ""); if (clean.length === 0 || /[^A-Za-z0-9+\\/]/.test(clean)) return null; var bits = 0, buffer = 0, out = ""; for (var i = 0; i < clean.length; i += 1) { buffer = (buffer << 6) | alphabet.indexOf(clean.charAt(i)); bits += 6; if (bits >= 8) { bits -= 8; out += String.fromCharCode((buffer >> bits) & 255); } } return out; }',
+    "function rfcSfParse(input, kind) {",
+    "  var s = String(input), i = 0;",
+    '  function ws() { while (i < s.length && (s.charAt(i) === " " || s.charAt(i) === "\\t")) i += 1; }',
+    "  function key() { if (!/[a-z*]/.test(s.charAt(i))) return null; var start = i; i += 1; while (i < s.length && /[a-z0-9_.*-]/.test(s.charAt(i))) i += 1; return s.slice(start, i); }",
+    "  function bareItem() {",
+    "    var ch = s.charAt(i);",
+    `    if (ch === '"') { i += 1; while (i < s.length) { var c = s.charAt(i); if (c === "\\\\") { if (!/["\\\\]/.test(s.charAt(i + 1))) return null; i += 2; continue; } if (c === '"') { i += 1; return true; } if (c < " " || c > "~") return null; i += 1; } return null; }`,
+    '    if (ch === ":") { i += 1; var start = i; while (i < s.length && s.charAt(i) !== ":") i += 1; if (s.charAt(i) !== ":") return null; var body = s.slice(start, i); i += 1; return /^[A-Za-z0-9+\\/=]*$/.test(body) ? true : null; }',
+    '    if (ch === "?") { i += 1; if (s.charAt(i) !== "0" && s.charAt(i) !== "1") return null; i += 1; return true; }',
+    '    if (ch === "@") { i += 1; if (s.charAt(i) === "-") i += 1; if (!/[0-9]/.test(s.charAt(i))) return null; while (i < s.length && /[0-9]/.test(s.charAt(i))) i += 1; return true; }',
+    '    if (/[-0-9]/.test(ch)) { if (ch === "-") i += 1; if (!/[0-9]/.test(s.charAt(i))) return null; while (i < s.length && /[0-9]/.test(s.charAt(i))) i += 1; if (s.charAt(i) === ".") { i += 1; if (!/[0-9]/.test(s.charAt(i))) return null; while (i < s.length && /[0-9]/.test(s.charAt(i))) i += 1; } return true; }',
+    "    if (/[A-Za-z*]/.test(ch)) { i += 1; while (i < s.length && /[!#$%&'*+.^_`|~:\\/0-9A-Za-z-]/.test(s.charAt(i))) i += 1; return true; }",
+    "    return null;",
+    "  }",
+    '  function params() { while (s.charAt(i) === ";") { i += 1; ws(); if (key() === null) return null; if (s.charAt(i) === "=") { i += 1; if (bareItem() === null) return null; } } return true; }',
+    '  function item() { if (s.charAt(i) === "(") { i += 1; ws(); while (s.charAt(i) !== ")") { if (i >= s.length) return null; if (bareItem() === null || params() === null) return null; ws(); } i += 1; return params(); } if (bareItem() === null) return null; return params(); }',
+    "  ws();",
+    '  if (kind === "item") { if (item() === null) return false; ws(); return i === s.length; }',
+    "  if (i === s.length) return true;",
+    "  while (i < s.length) {",
+    '    if (kind === "dict") { if (key() === null) return false; if (s.charAt(i) === "=") { i += 1; if (item() === null) return false; } else if (params() === null) return false; }',
+    "    else if (item() === null) return false;",
+    "    ws();",
+    "    if (i === s.length) return true;",
+    '    if (s.charAt(i) !== ",") return false;',
+    "    i += 1; ws();",
+    "    if (i === s.length) return false;",
+    "  }",
+    "  return true;",
+    "}",
+    "pm.test('Response header fields satisfy RFC 9110 field syntax', function () {",
+    "  pm.response.headers.each(function (header) {",
+    "    if (!header) return;",
+    '    if (!rfcIsToken(String(header.key))) pm.expect.fail("Response header name is not a valid RFC 9110 token: " + header.key);',
+    '    if (!rfcIsFieldContent(String(header.value))) pm.expect.fail("Response header value contains characters forbidden by RFC 9110 field-content: " + header.key);',
+    "  });",
+    '  ["content-type", "content-length", "etag", "location", "date", "age", "expires", "last-modified", "retry-after"].forEach(function (name) {',
+    "    var values = rfcHeaderAll(name);",
+    '    for (var i = 1; i < values.length; i += 1) { if (values[i] !== values[0]) pm.expect.fail("Singleton response header " + name + " appears " + values.length + " times with differing values (RFC 9110)"); }',
+    "  });",
+    "});",
+    "pm.test('Response header values satisfy their RFC grammars', function () {",
+    '  var date = rfcRespHeader("Date");',
+    '  if (date && !rfcIsHttpDate(date)) pm.expect.fail("Date must be an IMF-fixdate (RFC 9110): " + date);',
+    '  if (!date) rfcAdvise("RFC 9110: origin servers SHOULD send a Date header");',
+    '  var etag = rfcRespHeader("ETag");',
+    '  if (etag && !rfcIsEntityTag(etag)) pm.expect.fail("ETag is not a valid entity-tag (RFC 9110): " + etag);',
+    '  var lastModified = rfcRespHeader("Last-Modified");',
+    "  if (lastModified) {",
+    '    if (!rfcIsHttpDate(lastModified)) pm.expect.fail("Last-Modified must be a valid HTTP-date (RFC 9110): " + lastModified);',
+    '    else if (date && rfcIsHttpDate(date) && Date.parse(lastModified) > Date.parse(date)) pm.expect.fail("Last-Modified must not be later than Date (RFC 9110): " + lastModified + " > " + date);',
+    "  }",
+    '  var vary = rfcRespHeader("Vary");',
+    "  if (vary) {",
+    '    var varyMembers = vary.split(",").map(function (entry) { return entry.trim(); });',
+    '    if (varyMembers.indexOf("*") !== -1 && varyMembers.length > 1) pm.expect.fail("Vary: * must not be combined with other members (RFC 9110): " + vary);',
+    '    varyMembers.forEach(function (member) { if (member !== "*" && !rfcIsToken(member)) pm.expect.fail("Vary member is not a field-name token (RFC 9110): " + member); });',
+    "  }",
+    '  var contentLocation = rfcRespHeader("Content-Location");',
+    '  if (contentLocation && (/\\s/.test(contentLocation.trim()) || contentLocation.trim().length === 0)) pm.expect.fail("Content-Location must be a valid URI-reference (RFC 9110): " + contentLocation);',
+    '  var acceptRanges = rfcRespHeader("Accept-Ranges");',
+    '  if (acceptRanges && !rfcTokenList(acceptRanges)) pm.expect.fail("Accept-Ranges must be a list of range-unit tokens (RFC 9110): " + acceptRanges);',
+    '  var contentLanguage = rfcRespHeader("Content-Language");',
+    '  if (contentLanguage) contentLanguage.split(",").forEach(function (tag) { if (!/^[A-Za-z]{1,8}(-[A-Za-z0-9]{1,8})*$/.test(tag.trim())) pm.expect.fail("Content-Language carries a malformed BCP 47 language-tag (RFC 5646): " + tag.trim()); });',
+    '  var allow = rfcRespHeader("Allow");',
+    '  if (allow && allow.trim() && !rfcTokenList(allow)) pm.expect.fail("Allow must be a comma-separated list of method tokens (RFC 9110): " + allow);',
+    '  if (allow && contract.method === "OPTIONS" && pm.response.code >= 200 && pm.response.code < 300) {',
+    '    var optionsAllowed = allow.split(",").map(function (entry) { return entry.trim().toUpperCase(); });',
+    '    (contract.pathMethods || []).forEach(function (method) { if (optionsAllowed.indexOf(method) === -1) pm.expect.fail("Allow on an OPTIONS response must list every method the OpenAPI path declares (RFC 9110); missing " + method + " in: " + allow); });',
+    "  }",
+    '  var age = rfcRespHeader("Age");',
+    '  if (age && !/^[0-9]+$/.test(age.trim())) pm.expect.fail("Age must be a non-negative integer of delta-seconds (RFC 9111): " + age);',
+    '  var expires = rfcRespHeader("Expires");',
+    '  if (expires && !rfcIsHttpDate(expires)) rfcAdvise("RFC 9111: Expires is not a valid HTTP-date and will be treated as already expired: " + expires);',
+    '  if (rfcHeaderAll("warning").length > 0) rfcAdvise("RFC 9111 obsoleted the Warning header; the server still emits it");',
+    '  var cacheControl = rfcRespHeader("Cache-Control");',
+    "  if (cacheControl) {",
+    "    var seenDirectives = {};",
+    "    rfcSplitList(cacheControl).forEach(function (entry) {",
+    "      var directive = entry.trim();",
+    '      if (!directive) { pm.expect.fail("Cache-Control contains an empty directive (RFC 9111): " + cacheControl); return; }',
+    '      var eq = directive.indexOf("=");',
+    "      var name = (eq === -1 ? directive : directive.slice(0, eq)).trim().toLowerCase();",
+    "      var argument = eq === -1 ? undefined : directive.slice(eq + 1).trim();",
+    '      if (!rfcIsToken(name)) pm.expect.fail("Cache-Control directive name is not a token (RFC 9111): " + directive);',
+    "      seenDirectives[name] = argument === undefined ? true : argument;",
+    '      if (["max-age", "s-maxage", "stale-while-revalidate", "stale-if-error"].indexOf(name) !== -1 && (argument === undefined || !/^"?[0-9]+"?$/.test(argument))) pm.expect.fail("Cache-Control " + name + " requires a delta-seconds argument (RFC 9111): " + directive);',
+    "    });",
+    '    if (seenDirectives["no-store"] && seenDirectives["max-age"] !== undefined) pm.expect.fail("Cache-Control combines no-store with max-age; the directives contradict (RFC 9111): " + cacheControl);',
+    "  }",
+    '  var acceptPatch = rfcRespHeader("Accept-Patch");',
+    '  if (acceptPatch) acceptPatch.split(",").forEach(function (entry) { var parts = mediaParts(entry); if (!parts.type || !parts.subtype) pm.expect.fail("Accept-Patch must be a list of media types (RFC 5789): " + entry.trim()); });',
+    '  var deprecation = rfcRespHeader("Deprecation");',
+    '  if (deprecation && !/^@-?[0-9]+$/.test(deprecation.trim())) pm.expect.fail("Deprecation must be an RFC 9745 Date structured field (@unix-timestamp): " + deprecation);',
+    '  var sunset = rfcRespHeader("Sunset");',
+    "  if (sunset) {",
+    '    if (!rfcIsHttpDate(sunset)) pm.expect.fail("Sunset must be a valid HTTP-date (RFC 8594): " + sunset);',
+    '    else if (Date.parse(sunset) < Date.now()) rfcAdvise("RFC 8594: Sunset date is already in the past: " + sunset);',
+    "  }",
+    '  var preferenceApplied = rfcRespHeader("Preference-Applied");',
+    "  if (preferenceApplied) {",
+    '    var requestPrefer = requestHeader("Prefer").toLowerCase();',
+    "    rfcSplitList(preferenceApplied).forEach(function (entry) {",
+    '      var token = entry.split("=")[0].trim().toLowerCase();',
+    '      if (token && requestPrefer.indexOf(token) === -1) pm.expect.fail("Preference-Applied echoes a preference the request never sent (RFC 7240): " + entry.trim());',
+    "    });",
+    "  }",
+    "});",
+    "pm.test('Response satisfies RFC 9110 message framing requirements', function () {",
+    "  var code = pm.response.code;",
+    '  if ((code === 204 || code < 200) && rfcRespHeader("Content-Length")) pm.expect.fail("RFC 9110 forbids Content-Length on 1xx and 204 responses");',
+    '  if ([301, 302, 303, 307, 308].indexOf(code) !== -1 && !rfcRespHeader("Location")) pm.expect.fail("RFC 9110 expects Location on a " + code + " redirect response");',
+    "  if (code === 416) {",
+    '    var unsatisfiedRange = rfcRespHeader("Content-Range");',
+    '    if (!unsatisfiedRange) pm.expect.fail("RFC 9110 requires Content-Range (unsatisfied-range form) on 416 responses");',
+    '    else if (!/^\\S+ \\*\\/[0-9]+$/.test(unsatisfiedRange.trim())) pm.expect.fail("Content-Range on 416 must use the unsatisfied-range form <unit> */<complete-length> (RFC 9110): " + unsatisfiedRange);',
+    "  }",
+    "  if (code === 206) {",
+    '    var contentRange = rfcRespHeader("Content-Range");',
+    '    var responseMedia = mediaParts(rfcRespHeader("Content-Type"));',
+    '    var isByteranges = responseMedia.type === "multipart" && responseMedia.subtype === "byteranges";',
+    '    if (!contentRange && !isByteranges) pm.expect.fail("RFC 9110 requires Content-Range on a single-part 206 response (or multipart/byteranges for multi-range)");',
+    '    if (contentRange && isByteranges) pm.expect.fail("RFC 9110 forbids Content-Range on a multipart/byteranges 206 response");',
+    "    if (contentRange) {",
+    "      var rangeParts = contentRange.trim().match(/^(\\S+) (?:([0-9]+)-([0-9]+)|\\*)\\/([0-9]+|\\*)$/);",
+    '      if (!rangeParts) pm.expect.fail("Content-Range is not a valid RFC 9110 range: " + contentRange);',
+    "      else {",
+    '        if (rangeParts[1] !== "bytes") rfcAdvise("RFC 9110: 206 Content-Range uses a non-bytes range unit: " + rangeParts[1]);',
+    "        if (rangeParts[2] !== undefined) {",
+    '          if (Number(rangeParts[2]) > Number(rangeParts[3])) pm.expect.fail("Content-Range first-byte-pos must be <= last-byte-pos (RFC 9110): " + contentRange);',
+    '          if (rangeParts[4] !== "*" && Number(rangeParts[3]) >= Number(rangeParts[4])) pm.expect.fail("Content-Range last-byte-pos must be < complete-length (RFC 9110): " + contentRange);',
+    "        }",
+    "      }",
+    "    }",
+    "  }",
+    '  if (code === 407 && !rfcRespHeader("Proxy-Authenticate")) pm.expect.fail("RFC 9110 requires Proxy-Authenticate on 407 responses");',
+    '  if (code === 415 && contract.method === "PATCH" && !rfcRespHeader("Accept-Patch")) rfcAdvise("RFC 5789: a 415 response to PATCH SHOULD carry Accept-Patch");',
+    "});",
+    "pm.test('Response media type is acceptable under the request Accept header', function () {",
+    "  if (pm.response.code < 200 || pm.response.code >= 300 || isBodyless()) return;",
+    '  var accept = requestHeader("Accept");',
+    '  if (!accept || accept.indexOf("{{") !== -1) return;',
+    '  var actual = mediaParts(rfcRespHeader("Content-Type"));',
+    "  if (!actual.type) return;",
+    "  var acceptable = false;",
+    "  var jsonSoftened = false;",
+    "  rfcSplitList(accept).forEach(function (entry) {",
+    "    var range = mediaParts(entry);",
+    '    var qMatch = entry.match(/;\\s*q\\s*=\\s*"?([0-9.]+)"?/i);',
+    "    if (qMatch && Number(qMatch[1]) <= 0) return;",
+    '    if ((range.type === "*" && range.subtype === "*") || (range.type === actual.type && (range.subtype === "*" || range.subtype === actual.subtype))) acceptable = true;',
+    '    if (range.type === actual.type && range.subtype === "json" && isJsonSubtype(actual.subtype)) jsonSoftened = true;',
+    "  });",
+    '  if (!acceptable && jsonSoftened) { rfcAdvise("Content negotiation: response " + actual.raw + " is a +json type while the request only accepted application/json"); return; }',
+    '  if (!acceptable) pm.expect.fail("Response Content-Type " + actual.raw + " is not acceptable under the request Accept header (RFC 9110): " + accept);',
+    "});",
+    "pm.test('Response body satisfies its media type RFC conventions', function () {",
+    '  var contentTypeValue = rfcRespHeader("Content-Type");',
+    "  var media = mediaParts(contentTypeValue);",
+    "  var text = responseText();",
+    '  if (pm.response.code === 406 && !text.trim()) rfcAdvise("RFC 9110: a 406 response SHOULD include a list of available representations");',
+    "  if (!text) return;",
+    "  if (isJsonSubtype(media.subtype)) {",
+    '    if (text.charCodeAt(0) === 65279) pm.expect.fail("RFC 8259 forbids a byte order mark at the start of JSON text");',
+    '    var charsetParam = contentTypeValue.match(/charset\\s*=\\s*"?([^";\\s]+)"?/i);',
+    '    if (charsetParam) rfcAdvise("RFC 8259 defines no charset parameter for JSON media types; got charset=" + charsetParam[1]);',
+    "  }",
+    '  if (media.raw === "application/x-ndjson" || media.raw === "application/jsonl" || media.raw === "application/x-jsonlines") {',
+    '    text.split(/\\r?\\n/).forEach(function (line, lineNumber) { if (!line.trim()) return; try { JSON.parse(line); } catch (error) { pm.expect.fail("NDJSON line " + (lineNumber + 1) + " is not valid JSON: " + error); } });',
+    "  }",
+    '  if (media.raw === "text/event-stream") {',
+    '    text.split(/\\r?\\n/).forEach(function (line) { if (!line || line.charAt(0) === ":") return; var field = line.split(":")[0]; if (["data", "event", "id", "retry"].indexOf(field) === -1) pm.expect.fail("SSE line does not start with a known field or comment: " + line); if (field === "retry" && !/^retry:\\s*[0-9]+\\s*$/.test(line)) pm.expect.fail("SSE retry field must be an integer: " + line); });',
+    "  }",
+    '  if (media.type === "multipart") {',
+    '    var boundary = contentTypeValue.match(/;\\s*boundary=(?:"([^"]*)"|([^;]*))/i);',
+    '    var boundaryValue = boundary ? (boundary[1] !== undefined ? boundary[1] : boundary[2].trim()) : "";',
+    '    if (!boundaryValue) pm.expect.fail("multipart responses must carry a boundary parameter (RFC 2046): " + contentTypeValue);',
+    "    else {",
+    '      if (boundaryValue.length > 70) pm.expect.fail("multipart boundary must be 1-70 characters (RFC 2046): " + boundaryValue);',
+    `      if (!/^[0-9A-Za-z'()+_,\\-.\\/:=? ]*[0-9A-Za-z'()+_,\\-.\\/:=?]$/.test(boundaryValue)) pm.expect.fail("multipart boundary contains characters outside RFC 2046 bchars or ends with a space: " + boundaryValue);`,
+    "    }",
+    "  }",
+    '  if (media.raw === "application/hal+json") {',
+    "    var hal; try { hal = JSON.parse(text); } catch (error) { hal = null; }",
+    '    if (hal && typeof hal === "object" && !Array.isArray(hal)) {',
+    "      var halLinks = hal._links;",
+    '      if (halLinks !== undefined && (typeof halLinks !== "object" || Array.isArray(halLinks) || halLinks === null)) pm.expect.fail("HAL _links must be an object of link relations");',
+    '      if (halLinks) Object.keys(halLinks).forEach(function (rel) { var linkValue = halLinks[rel]; (Array.isArray(linkValue) ? linkValue : [linkValue]).forEach(function (linkObject) { if (!linkObject || typeof linkObject !== "object" || typeof linkObject.href !== "string") pm.expect.fail("HAL link relation " + rel + " must be a Link Object (or array of them) with a string href"); }); });',
+    "      var halEmbedded = hal._embedded;",
+    '      if (halEmbedded !== undefined && (typeof halEmbedded !== "object" || Array.isArray(halEmbedded) || halEmbedded === null)) pm.expect.fail("HAL _embedded must be an object of resource names");',
+    "    }",
+    "  }",
+    '  if (media.raw === "application/vnd.api+json") {',
+    "    var jsonApi; try { jsonApi = JSON.parse(text); } catch (error) { jsonApi = null; }",
+    '    if (jsonApi && typeof jsonApi === "object" && !Array.isArray(jsonApi)) {',
+    '      if (jsonApi.data === undefined && jsonApi.errors === undefined && jsonApi.meta === undefined) pm.expect.fail("JSON:API documents must contain at least one of data, errors, meta");',
+    '      if (jsonApi.data !== undefined && jsonApi.errors !== undefined) pm.expect.fail("JSON:API forbids data and errors in the same document");',
+    "    }",
+    "  }",
+    '  if (media.subtype === "problem+xml") {',
+    '    if (text.indexOf("urn:ietf:rfc:7807") === -1) rfcAdvise("application/problem+xml body does not reference the urn:ietf:rfc:7807 namespace");',
+    "    var xmlStatus = text.match(/<status[^>]*>\\s*([0-9]+)\\s*<\\/status>/);",
+    '    if (xmlStatus && Number(xmlStatus[1]) !== pm.response.code) pm.expect.fail("RFC 9457 status member (" + xmlStatus[1] + ") must match the HTTP status code (" + pm.response.code + ")");',
+    "  }",
+    "});",
+    "pm.test('Structured field response headers parse per RFC 8941', function () {",
+    '  [["Cache-Status", "list"], ["Proxy-Status", "list"], ["Priority", "dict"], ["RateLimit", "dict"], ["RateLimit-Policy", "dict"], ["Signature", "dict"], ["Signature-Input", "dict"]].forEach(function (pair) {',
+    '    var value = rfcHeaderAll(pair[0]).join(", ");',
+    "    if (!value) return;",
+    '    if (!rfcSfParse(value, pair[1])) pm.expect.fail(pair[0] + " is not a valid RFC 8941 structured field (" + pair[1] + "): " + value);',
+    "  });",
+    "});",
+    "pm.test('Content-Digest and Repr-Digest match the response body (RFC 9530)', function () {",
+    "  var cryptoLib = null;",
+    '  try { cryptoLib = require("crypto-js"); } catch (error) { cryptoLib = null; }',
+    '  ["Content-Digest", "Repr-Digest"].forEach(function (name) {',
+    "    var value = rfcRespHeader(name);",
+    "    if (!value) return;",
+    '    if (!rfcSfParse(value, "dict")) { pm.expect.fail(name + " is not a valid RFC 8941 dictionary (RFC 9530): " + value); return; }',
+    '    if (!cryptoLib || rfcRespHeader("Content-Encoding")) return;',
+    '    var media = mediaParts(rfcRespHeader("Content-Type"));',
+    '    if (media.type !== "text" && !isJsonSubtype(media.subtype) && !/xml$/.test(media.subtype)) return;',
+    "    rfcSplitList(value).forEach(function (entry) {",
+    "      var match = entry.trim().match(/^(sha-256|sha-512)=:([A-Za-z0-9+\\/=]+):$/);",
+    "      if (!match) return;",
+    '      var computed = match[1] === "sha-256" ? cryptoLib.SHA256(responseText()) : cryptoLib.SHA512(responseText());',
+    "      var encoded = cryptoLib.enc.Base64.stringify(computed);",
+    '      if (encoded !== match[2]) pm.expect.fail(name + " " + match[1] + " does not match the response body (RFC 9530): computed " + encoded + " but header carries " + match[2]);',
+    "    });",
+    "  });",
+    "});",
+    "pm.test('Request credentials are well-formed per their authentication scheme RFCs', function () {",
+    '  var authorization = requestHeader("Authorization");',
+    '  if (authorization && authorization.indexOf("{{") === -1) {',
+    "    var schemeMatch = authorization.match(/^(\\S+)(?:\\s+([\\s\\S]*))?$/);",
+    '    var authScheme = schemeMatch ? schemeMatch[1].toLowerCase() : "";',
+    '    var authParams = schemeMatch && schemeMatch[2] !== undefined ? schemeMatch[2].trim() : "";',
+    '    if (authScheme === "basic") {',
+    "      var decoded = rfcBase64Decode(authParams);",
+    '      if (decoded === null) pm.expect.fail("Basic credentials must be base64 (RFC 7617)");',
+    '      else if (decoded.indexOf(":") === -1) pm.expect.fail("Basic credentials must decode to user-id:password (RFC 7617)");',
+    "    }",
+    '    if (authScheme === "bearer" && !/^[A-Za-z0-9\\-._~+\\/]+=*$/.test(authParams)) pm.expect.fail("Bearer token does not match the b64token grammar (RFC 6750)");',
+    '    if (authScheme === "digest") {',
+    '      rfcSplitList(authParams).forEach(function (entry) { var param = entry.trim(); if (param && !/^[!#$%&\'*+.^_`|~0-9A-Za-z-]+\\s*=\\s*("([^"\\\\]|\\\\.)*"|[!#$%&\'*+.^_`|~0-9A-Za-z-]+)$/.test(param)) pm.expect.fail("Digest auth-param is malformed (RFC 7616): " + param); });',
+    '      var digestResponse = authParams.match(/\\bresponse\\s*=\\s*"?([^",\\s]+)"?/i);',
+    '      if (digestResponse && !/^[0-9a-fA-F]+$/.test(digestResponse[1])) pm.expect.fail("Digest response parameter must be hex (RFC 7616): " + digestResponse[1]);',
+    "    }",
+    "  }",
+    '  var wantsJwt = (contract.security || []).some(function (alternative) { return alternative.some(function (check) { return check.prefix === "Bearer " && String(check.bearerFormat || "").toUpperCase() === "JWT"; }); });',
+    '  if (wantsJwt && authorization && authorization.indexOf("{{") === -1 && authorization.toLowerCase().indexOf("bearer ") === 0) {',
+    "    var jwtToken = authorization.slice(7).trim();",
+    '    var jwtSegments = jwtToken.split(".");',
+    '    if (jwtSegments.length !== 3) pm.expect.fail("bearerFormat JWT tokens must have three base64url segments (RFC 7519); got " + jwtSegments.length);',
+    '    else if (!jwtSegments.every(function (segment) { return /^[A-Za-z0-9_-]+$/.test(segment); })) pm.expect.fail("JWT segments must be base64url (RFC 7515)");',
+    "    else {",
+    '      var jwtDecode = function (segment) { var padded = segment.replace(/-/g, "+").replace(/_/g, "/"); while (padded.length % 4 !== 0) padded += "="; return rfcBase64Decode(padded); };',
+    "      var jwtHeader = null; var jwtPayload = null;",
+    '      try { jwtHeader = JSON.parse(jwtDecode(jwtSegments[0])); } catch (error) { pm.expect.fail("JWT header segment does not decode to JSON (RFC 7515)"); }',
+    '      try { jwtPayload = JSON.parse(jwtDecode(jwtSegments[1])); } catch (error) { pm.expect.fail("JWT payload segment does not decode to JSON (RFC 7519)"); }',
+    '      if (jwtHeader && typeof jwtHeader.alg !== "string") pm.expect.fail("JWT header must carry a string alg member (RFC 7515)");',
+    "      if (jwtPayload) {",
+    '        ["exp", "nbf", "iat"].forEach(function (claim) { if (jwtPayload[claim] !== undefined && typeof jwtPayload[claim] !== "number") pm.expect.fail("JWT " + claim + " claim must be numeric (RFC 7519)"); });',
+    '        if (typeof jwtPayload.exp === "number" && jwtPayload.exp * 1000 < Date.now()) rfcAdvise("RFC 7519: the outgoing JWT exp claim is already in the past");',
+    "      }",
+    "    }",
+    "  }",
+    '  if (hasQueryParam("access_token")) rfcAdvise("RFC 6750: bearer tokens SHOULD NOT travel in the query string");',
+    "  (contract.security || []).forEach(function (alternative) {",
+    "    alternative.forEach(function (check) {",
+    "      if (!check.checkable || !check.name) return;",
+    '      if (check.in === "query") { if (hasQueryParam(check.name)) rfcAdvise("Security scheme " + check.scheme + " sends credentials in the query string"); return; }',
+    '      if (check.in !== "header" || String(check.name).toLowerCase() === "authorization") return;',
+    "      var apiKeyValue = requestHeader(check.name);",
+    '      if (!apiKeyValue || apiKeyValue.indexOf("{{") !== -1) return;',
+    '      if (apiKeyValue !== apiKeyValue.trim()) pm.expect.fail("API key header " + check.name + " carries leading or trailing whitespace");',
+    '      if (!rfcIsFieldContent(apiKeyValue)) pm.expect.fail("API key header " + check.name + " contains characters forbidden by RFC 9110 field-content");',
+    "    });",
+    "  });",
+    "});",
+    "pm.test('Request preconditions, preferences, and patch bodies follow their RFCs', function () {",
+    '  ["If-Match", "If-None-Match"].forEach(function (name) {',
+    "    var value = requestHeader(name);",
+    '    if (!value || value.indexOf("{{") !== -1 || value.trim() === "*") return;',
+    '    rfcSplitList(value).forEach(function (entry) { if (entry.trim() && !rfcIsEntityTag(entry.trim())) pm.expect.fail(name + " must be * or a list of entity-tags (RFC 9110): " + entry.trim()); });',
+    "  });",
+    '  var prefer = requestHeader("Prefer");',
+    '  if (prefer && prefer.indexOf("{{") === -1) {',
+    '    rfcSplitList(prefer).forEach(function (entry) { var token = entry.split("=")[0].split(";")[0].trim(); if (token && !rfcIsToken(token)) pm.expect.fail("Prefer preference name must be a token (RFC 7240): " + entry.trim()); });',
+    "  }",
+    '  var requestContentType = mediaBase(requestHeader("Content-Type"));',
+    "  var body = pm.request.body;",
+    '  var raw = body && body.mode === "raw" && typeof body.raw === "string" ? body.raw : "";',
+    '  if (!raw.trim() || raw.indexOf("{{") !== -1 || /"<[^"<>]*>"/.test(raw)) return;',
+    '  if (requestContentType === "application/json-patch+json") {',
+    '    var patch; try { patch = JSON.parse(raw); } catch (error) { if (/<[A-Za-z][A-Za-z0-9_ -]*>/.test(raw)) return; pm.expect.fail("application/json-patch+json request body is not valid JSON (RFC 6902): " + error); return; }',
+    '    if (!Array.isArray(patch)) { pm.expect.fail("A JSON Patch document must be an array of operations (RFC 6902)"); return; }',
+    "    patch.forEach(function (operation, operationIndex) {",
+    '      if (!operation || typeof operation !== "object" || Array.isArray(operation)) { pm.expect.fail("JSON Patch operation " + operationIndex + " must be an object (RFC 6902)"); return; }',
+    '      if (["add", "remove", "replace", "move", "copy", "test"].indexOf(operation.op) === -1) pm.expect.fail("JSON Patch operation " + operationIndex + " has an invalid op (RFC 6902): " + operation.op);',
+    "      var pointerPattern = /^(\\/([^\\/~]|~[01])*)*$/;",
+    '      if (typeof operation.path !== "string" || !pointerPattern.test(operation.path)) pm.expect.fail("JSON Patch operation " + operationIndex + " path must be an RFC 6901 JSON Pointer");',
+    '      if (["add", "replace", "test"].indexOf(operation.op) !== -1 && operation.value === undefined) pm.expect.fail("JSON Patch " + operation.op + " operation " + operationIndex + " requires a value member (RFC 6902)");',
+    '      if (["move", "copy"].indexOf(operation.op) !== -1 && (typeof operation.from !== "string" || !pointerPattern.test(operation.from))) pm.expect.fail("JSON Patch " + operation.op + " operation " + operationIndex + " requires an RFC 6901 from pointer (RFC 6902)");',
+    "    });",
+    "  }",
+    '  if (requestContentType === "application/merge-patch+json") {',
+    '    try { JSON.parse(raw); } catch (error) { if (/<[A-Za-z][A-Za-z0-9_ -]*>/.test(raw)) return; pm.expect.fail("application/merge-patch+json request body must be valid JSON (RFC 7386): " + error); }',
+    "  }",
+    "});",
+    "pm.test('Deprecated operation signals deprecation in the response', function () {",
+    "  if (!contract.deprecated) return;",
+    '  if (!rfcRespHeader("Deprecation") && !rfcRespHeader("Sunset")) rfcAdvise("RFC 9745: the OpenAPI document deprecates this operation but the response carries neither Deprecation nor Sunset");',
+    "});",
+    "pm.test('OpenAPI link expressions resolve against the response', function () {",
+    "  if (!selected || !selected.value.links || selected.value.links.length === 0) return;",
+    "  var linkBody = null; var linkBodyParsed = false;",
+    "  selected.value.links.forEach(function (expression) {",
+    '    if (expression.kind === "header") {',
+    '      if (!pm.response.headers.get(expression.header)) pm.expect.fail("OpenAPI link " + expression.link + " references response header " + expression.header + " which is absent");',
+    "      return;",
+    "    }",
+    "    if (!linkBodyParsed) { linkBodyParsed = true; try { linkBody = JSON.parse(responseText()); } catch (error) { linkBody = null; } }",
+    '    if (linkBody === null) { pm.expect.fail("OpenAPI link " + expression.link + " references the response body but the body is not JSON"); return; }',
+    "    var target = linkBody;",
+    '    var tokens = String(expression.pointer).split("/").slice(1).map(function (token) { return token.replace(/~1/g, "/").replace(/~0/g, "~"); });',
+    "    for (var t = 0; t < tokens.length; t += 1) {",
+    '      if (target !== null && typeof target === "object") target = Array.isArray(target) ? target[Number(tokens[t])] : target[tokens[t]];',
+    "      else { target = undefined; break; }",
+    "    }",
+    '    if (target === undefined) pm.expect.fail("OpenAPI link " + expression.link + " expression $response.body#" + expression.pointer + " does not resolve in the response body");',
+    "  });",
+    "});",
+    "pm.test('Request URL conforms to an OpenAPI servers entry', function () {",
+    "  if (!contract.servers || contract.servers.length === 0) return;",
+    '  var requestUrl = "";',
+    '  try { requestUrl = String(pm.request.url.toString()); } catch (ignored) { requestUrl = ""; }',
+    '  if (!requestUrl || requestUrl.indexOf("{{") !== -1) return;',
+    '  var pathOnly = requestUrl.replace(/^[a-z][a-z0-9+.-]*:\\/\\/[^\\/]+/i, "");',
+    '  var matched = contract.servers.some(function (pattern) { try { var serverPattern = new RegExp(pattern, "i"); return serverPattern.test(requestUrl) || serverPattern.test(pathOnly); } catch (ignored) { return true; } });',
+    '  if (!matched) rfcAdvise("Request URL does not match any OpenAPI servers entry: " + requestUrl);',
+    "});",
     ...operation.security ? [
       "pm.test('Request carries credentials required by OpenAPI security', function () {",
       "  function satisfied(check) {",
@@ -299266,6 +299838,12 @@ function createContractScript(operation, warnings = []) {
       '      if (param.allowEmptyValue && entries.length === 1 && entries[0] === "") return;',
       "      if (entries.some(isPlaceholder)) return;",
       "      value = entries.map(function (entry) { return coerceBySchema(decodeComponent(entry), param.items); });",
+      '    } else if (param.decode === "deepObject") {',
+      "      var deepValue = {}; var deepFound = false; var deepPlaceholder = false;",
+      '      pm.request.url.query.each(function (queryParam) { if (!queryParam || queryParam.disabled === true) return; var deepMatch = String(queryParam.key).match(/^([^\\[]+)\\[([^\\]]+)\\]$/); if (!deepMatch || deepMatch[1].toLowerCase() !== String(param.name).toLowerCase()) return; deepFound = true; var deepRaw = queryParam.value === null || queryParam.value === undefined ? "" : String(queryParam.value); if (isPlaceholder(deepRaw)) { deepPlaceholder = true; return; } deepValue[deepMatch[2]] = coerceBySchema(decodeComponent(deepRaw), (param.schema && param.schema.properties && param.schema.properties[deepMatch[2]]) || {}); });',
+      '      if (!deepFound) { if (param.required) pm.expect.fail("Required parameter " + param.in + ":" + param.name + " was not sent for " + contract.method + " " + contract.path); return; }',
+      "      if (deepPlaceholder) return;",
+      "      value = deepValue;",
       "    } else if (param.decode) {",
       '      var joined = param.in === "query" ? queryValue(String(param.name).toLowerCase()) : headerValue(param.name);',
       '      if (joined === undefined) { if (param.required) pm.expect.fail("Required parameter " + param.in + ":" + param.name + " was not sent for " + contract.method + " " + contract.path); return; }',
@@ -299282,6 +299860,8 @@ function createContractScript(operation, warnings = []) {
       '    } else if (param.in === "path") {',
       "      value = pathParamValue(param.name);",
       "      if (value === undefined) return;",
+      '      if (param.pathStyle === "label") { if (String(value).charAt(0) !== ".") return; value = String(value).slice(1); }',
+      '      if (param.pathStyle === "matrix") { var matrixPrefix = ";" + param.name + "="; if (String(value).indexOf(matrixPrefix) !== 0) return; value = String(value).slice(matrixPrefix.length); }',
       '      if (isPlaceholder(value) || value.charAt(0) === ":" || value.charAt(0) === "{") return;',
       "      value = coerceBySchema(value, param.schema);",
       '    } else if (param.in === "cookie") {',
@@ -299333,6 +299913,9 @@ function createContractScript(operation, warnings = []) {
     '  if (pm.response.headers.get("Content-Encoding")) return;',
     "  var mustBeEmpty = isBodyless() || (selected && Object.keys(selected.value.content || {}).length === 0);",
     '  if (mustBeEmpty && Number(String(raw).trim()) !== 0) pm.expect.fail("OpenAPI defines no response body for " + contract.method + " " + contract.path + " status " + pm.response.code + " but Content-Length was " + raw);',
+    "});",
+    "pm.test('RFC SHOULD-level advisories are documented', function () {",
+    '  pm.expect(rfcAdvisories, "SHOULD-level findings (advisory, non-failing): " + rfcAdvisories.join("; ")).to.be.an("array");',
     "});"
   ];
 }
@@ -299402,6 +299985,9 @@ function assertStaticRequestShape(operation, request) {
     }
   }
   const warnings = collectStaticBodyWarnings(operation, request, contentType2);
+  if (["GET", "HEAD", "DELETE"].includes(operation.method) && hasRequestBody(request)) {
+    warnings.push(`CONTRACT_METHOD_BODY_SEMANTICS: ${operation.id} sends a request body with ${operation.method}; RFC 9110 defines no request-body semantics for this method`);
+  }
   if (operation.requestBody && !operation.requestBody.required && operation.requestBody.contentTypes.length > 0 && hasRequestBody(request) && contentType2) {
     const actual = contentType2.toLowerCase().split(";")[0]?.trim() ?? "";
     const matches = operation.requestBody.contentTypes.some((expected) => mediaTypeMatchesPattern(expected.toLowerCase(), actual));