@postman-cse/onboarding-bootstrap 2.4.0 → 2.6.0

package/README.md

@@ -6,7 +6,7 @@ Provisions a [Postman workspace](https://learning.postman.com/docs/collaborating
 
 Part of the [Postman API Onboarding suite](https://github.com/postman-cs/postman-api-onboarding-action).
 
-> **Standards-grounded assertion generation.** Every collection this action generates ships with executable contract tests compiled from your spec. For OpenAPI: operation mapping, status-code, `Content-Type`, response-header, request/response body, parameter, security-credential, and `Content-Length` checks, with JSON Schema (draft-07 / 2020-12) body validation, dialect-exclusive keyword rejection, and RFC-checked formats (RFC 3339 timestamps, RFC 4122 UUIDs, RFC 3986 URIs, and more). Layered on top: RFC 9110 status-code, framing, and field-syntax requirements, RFC 9457 `application/problem+json` error bodies with RFC 8259 encoding and RFC 8288 `Link` checks, RFC 6265 `Set-Cookie`, RFC 6797 HSTS and security headers, WHATWG Fetch CORS, RFC 9651 structured fields, RFC 9209 typed `Proxy-Status`, RFC 9421 message signatures, RFC 9530 body digests, `Accept` negotiation, media-type conventions (NDJSON, multipart boundaries, HAL, JSON:API), authentication-scheme credential grammar, preconditions and RFC 6902 / RFC 7386 patch bodies, `Deprecation`/`Sunset` advisories, and OpenAPI links/servers resolution. Beyond REST: canonical proto3 JSON well-known-type validation for gRPC, version-aware SOAP 1.1/1.2 media-type and Fault-status checks, GraphQL-over-HTTP media-type/status discipline, static AsyncAPI WebSocket / Socket.IO / MQTT message validation, and static MCP server-manifest contract checks. The full test inventory and the standard behind each check: [Generated assertions](docs/generated-assertions.md) and [Multi-Protocol Contract Assertions](docs/MULTIPROTOCOL-ASSERTIONS.md).
+> **Standards-grounded assertion generation.** Every collection this action generates ships with executable contract tests compiled from your spec. For OpenAPI: operation mapping, status-code, `Content-Type`, response-header, request/response body, parameter, security-credential, and `Content-Length` checks, with JSON Schema (draft-07 / 2020-12) body validation, dialect-exclusive keyword rejection, and RFC-checked formats (RFC 3339 timestamps, RFC 4122 UUIDs, RFC 3986 URIs, and more). Layered on top: RFC 9110 status-code, framing, and field-syntax requirements, RFC 9457 `application/problem+json` error bodies with RFC 8259 encoding and RFC 8288 `Link` checks, RFC 6265 `Set-Cookie`, RFC 6797 HSTS and security headers, WHATWG Fetch CORS, RFC 9651 structured fields, RFC 9209 typed `Proxy-Status`, RFC 9421 message signatures, RFC 9530 body digests, `Accept` negotiation, media-type conventions (NDJSON, multipart boundaries, HAL, JSON:API), authentication-scheme credential grammar, preconditions and RFC 6902 / RFC 7386 patch bodies, `Deprecation`/`Sunset` advisories, and OpenAPI links/servers resolution. Beyond REST: canonical proto3 JSON well-known-type validation for gRPC with per-streamed-message shape checks and metadata/trailer wire-conformance, version-aware SOAP 1.1/1.2 media-type and Fault-status checks, GraphQL-over-HTTP media-type/status discipline, static AsyncAPI WebSocket / Socket.IO / MQTT message validation, and static MCP server-manifest contract checks. The full test inventory and the standard behind each check: [Generated assertions](docs/generated-assertions.md) and [Multi-Protocol Contract Assertions](docs/MULTIPROTOCOL-ASSERTIONS.md).
 
 ## Which action should I use?
 

package/dist/action.cjs

@@ -296954,12 +296954,36 @@ function buildOperationScript(operation, index, warnings) {
     '    if (mediaType === "application/json" && gqlBody.data !== undefined && gqlBody.data !== null && pm.response.code !== 200) { pm.expect.fail("a GraphQL response carrying data over application/json must be HTTP 200; got " + pm.response.code); }',
     "});"
   );
+  lines.push(
+    `pm.test(${JSON.stringify(`[${label}] GraphQL response map follows the spec response format`)}, function () {`,
+    '    var extraKeys = Object.keys(gqlBody).filter(function (key) { return key !== "data" && key !== "errors" && key !== "extensions"; });',
+    '    if (extraKeys.length > 0) pm.expect.fail("the GraphQL response map must not contain entries other than data, errors, and extensions (GraphQL spec 7.1): " + extraKeys.join(", "));',
+    '    if (Object.prototype.hasOwnProperty.call(gqlBody, "extensions") && (typeof gqlBody.extensions !== "object" || gqlBody.extensions === null || Array.isArray(gqlBody.extensions))) pm.expect.fail("the GraphQL extensions entry must be a map (GraphQL spec 7.1)");',
+    '    if (!Object.prototype.hasOwnProperty.call(gqlBody, "data") && (!Array.isArray(gqlBody.errors) || gqlBody.errors.length === 0)) pm.expect.fail("a GraphQL request-error result (no data entry) must carry a non-empty errors list (GraphQL spec 7.1)");',
+    "});"
+  );
   lines.push(
     `pm.test(${JSON.stringify(`[${label}] GraphQL errors are well-formed and not a total failure`)}, function () {`,
     "    var errors = gqlBody.errors;",
     "    if (errors === undefined || errors === null) return;",
     `    pm.expect(errors, "GraphQL 'errors' must be an array when present").to.be.an("array");`,
-    '    errors.forEach(function (err) { pm.expect(err, "each GraphQL error must carry a message").to.be.an("object").that.has.property("message"); });',
+    "    errors.forEach(function (err, errIndex) {",
+    '      pm.expect(err, "each GraphQL error must carry a message").to.be.an("object").that.has.property("message");',
+    '      if (typeof err.message !== "string") pm.expect.fail("errors[" + errIndex + "].message must be a string (GraphQL spec 7.1.2)");',
+    "      if (err.locations !== undefined && err.locations !== null) {",
+    '        if (!Array.isArray(err.locations)) { pm.expect.fail("errors[" + errIndex + "].locations must be a list (GraphQL spec 7.1.2)"); return; }',
+    "        err.locations.forEach(function (loc, locIndex) {",
+    '          var locLabel = "errors[" + errIndex + "].locations[" + locIndex + "]";',
+    '          if (!loc || typeof loc !== "object" || Array.isArray(loc)) { pm.expect.fail(locLabel + " must be a map with line and column (GraphQL spec 7.1.2)"); return; }',
+    '          if (!Number.isInteger(loc.line) || loc.line < 1 || !Number.isInteger(loc.column) || loc.column < 1) pm.expect.fail(locLabel + " line and column must be positive integers starting from 1 (GraphQL spec 7.1.2)");',
+    "        });",
+    "      }",
+    "      if (err.path !== undefined && err.path !== null) {",
+    '        if (!Array.isArray(err.path)) { pm.expect.fail("errors[" + errIndex + "].path must be a list of path segments (GraphQL spec 7.1.2)"); return; }',
+    '        err.path.forEach(function (segment, segIndex) { if (typeof segment !== "string" && !Number.isInteger(segment)) pm.expect.fail("errors[" + errIndex + "].path[" + segIndex + "] must be a string field name or an integer list index (GraphQL spec 7.1.2)"); });',
+    "      }",
+    '      if (err.extensions !== undefined && err.extensions !== null && (typeof err.extensions !== "object" || Array.isArray(err.extensions))) pm.expect.fail("errors[" + errIndex + "].extensions must be a map (GraphQL spec 7.1.2)");',
+    "    });",
     "    var hasData = gqlBody.data !== undefined && gqlBody.data !== null;",
     '    if (!hasData && errors.length > 0) { pm.expect.fail("GraphQL request returned errors and no data: " + JSON.stringify(errors)); }',
     "});"
@@ -297618,7 +297642,17 @@ function createGrpcScript(spec) {
     // reporters/cli/modules/grpc.ts:15-21.
     'var GRPC_STATUS = { 0: "OK", 1: "CANCELLED", 2: "UNKNOWN", 3: "INVALID_ARGUMENT", 4: "DEADLINE_EXCEEDED", 5: "NOT_FOUND", 6: "ALREADY_EXISTS", 7: "PERMISSION_DENIED", 8: "RESOURCE_EXHAUSTED", 9: "FAILED_PRECONDITION", 10: "ABORTED", 11: "OUT_OF_RANGE", 12: "UNIMPLEMENTED", 13: "INTERNAL", 14: "UNAVAILABLE", 15: "DATA_LOSS", 16: "UNAUTHENTICATED" };',
     'function grpcStatusName() { if (typeof pm.response.status === "string" && pm.response.status) return pm.response.status; return GRPC_STATUS[pm.response.code] || ("UNKNOWN(" + pm.response.code + ")"); }',
-    "function grpcMessage() { try { return pm.response.json(); } catch (error) { return undefined; } }",
+    // Terminal message: pm.response.json() where the sandbox provides it,
+    // falling back to the last received message in pm.response.messages (the
+    // unified runtime's GRPCResponse exposes messages but no json()).
+    "function grpcMessage() {",
+    '  try { if (pm.response && typeof pm.response.json === "function") { var viaJson = pm.response.json(); if (viaJson !== undefined && viaJson !== null) return viaJson; } } catch (error) { /* fall back to messages */ }',
+    "  try {",
+    "    var list = pm.response && pm.response.messages;",
+    '    if (list && typeof list.each === "function") { var last; list.each(function (member) { last = member && member.data !== undefined ? member.data : member; }); return last; }',
+    "  } catch (error) { return undefined; }",
+    "  return undefined;",
+    "}",
     "function jsonTypeOf(value) {",
     '  if (value === null || value === undefined) return "null";',
     '  if (Array.isArray(value)) return "array";',
@@ -297769,9 +297803,104 @@ function createGrpcScript(spec) {
     '    if (set.length > 1) pm.expect.fail("gRPC response at " + path + " sets multiple members of a oneof: " + set.join(", "));',
     "  });",
     "}",
+    // Wire-conformance helpers for response metadata/trailers ({ key, value }
+    // PropertyLists; each/has/one guarded so the script stays inert on runtimes
+    // or harnesses that do not surface them).
+    'function grpcEachMeta(list, cb) { if (list && typeof list.each === "function") list.each(cb); }',
+    'function grpcMetaOne(list, key) { try { if (list && typeof list.has === "function" && list.has(key) && typeof list.one === "function") return list.one(key); } catch (error) { /* absent */ } return null; }',
+    "function grpcCheckMetaPairs(list, label) {",
+    "  grpcEachMeta(list, function (entry) {",
+    "    if (!entry || entry.disabled) return;",
+    '    var key = entry.key === undefined || entry.key === null ? "" : String(entry.key);',
+    '    var value = entry.value === undefined || entry.value === null ? "" : String(entry.value);',
+    '    if (!/^[0-9a-z_.-]+$/.test(key)) pm.expect.fail(label + " key " + JSON.stringify(key) + " must be a lowercase gRPC metadata key ([0-9a-z_.-])");',
+    '    if (/-bin$/.test(key)) { if (!/^[A-Za-z0-9+/=]*\\s*$/.test(value)) pm.expect.fail(label + " " + key + " must carry base64 data but was " + JSON.stringify(value)); }',
+    '    else if (!/^[\\x20-\\x7e]*$/.test(value)) pm.expect.fail(label + " " + key + " value must be printable ASCII (gRPC ASCII-Value)");',
+    "  });",
+    "}",
+    // grpc-status-details-bin carries a base64-encoded google.rpc.Status protobuf
+    // (the gRPC richer-error model). The sandbox has no protobuf runtime, so the
+    // script walks the protobuf wire format directly: base64 -> bytes -> tagged
+    // fields (varint / 64-bit / length-delimited / 32-bit). Groups (wire types
+    // 3/4) are proto2-deprecated and never emitted by google.rpc.Status.
+    "function grpcB64Bytes(value) {",
+    '  var clean = String(value).replace(/\\s+/g, "").replace(/-/g, "+").replace(/_/g, "/");',
+    "  if (clean.length % 4 === 1 || !/^[A-Za-z0-9+/]*={0,2}$/.test(clean)) return null;",
+    '  var alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";',
+    '  var unpadded = clean.replace(/=+$/, ""); var bytes = []; var buffer = 0; var bits = 0;',
+    "  for (var i = 0; i < unpadded.length; i++) {",
+    "    var idx = alphabet.indexOf(unpadded.charAt(i));",
+    "    if (idx === -1) return null;",
+    "    buffer = (buffer << 6) | idx; bits += 6;",
+    "    if (bits >= 8) { bits -= 8; bytes.push((buffer >> bits) & 0xff); }",
+    "  }",
+    "  return bytes;",
+    "}",
+    "function grpcPbVarint(bytes, pos) {",
+    "  var value = 0; var shift = 0;",
+    "  while (pos < bytes.length) {",
+    "    var b = bytes[pos]; pos += 1;",
+    "    value += (b & 0x7f) * Math.pow(2, shift); shift += 7;",
+    "    if ((b & 0x80) === 0) return value > 9007199254740991 ? null : { value: value, pos: pos };",
+    "    if (shift > 63) return null;",
+    "  }",
+    "  return null;",
+    "}",
+    "function grpcPbFields(bytes) {",
+    "  var pos = 0; var fields = [];",
+    "  while (pos < bytes.length) {",
+    "    var tag = grpcPbVarint(bytes, pos); if (!tag) return null;",
+    "    pos = tag.pos;",
+    "    var fieldNumber = Math.floor(tag.value / 8); var wire = tag.value % 8;",
+    "    if (fieldNumber < 1) return null;",
+    "    if (wire === 0) { var varint = grpcPbVarint(bytes, pos); if (!varint) return null; fields.push({ field: fieldNumber, wire: 0, value: varint.value }); pos = varint.pos; }",
+    "    else if (wire === 1) { if (pos + 8 > bytes.length) return null; fields.push({ field: fieldNumber, wire: 1 }); pos += 8; }",
+    "    else if (wire === 2) { var len = grpcPbVarint(bytes, pos); if (!len) return null; pos = len.pos; if (pos + len.value > bytes.length) return null; fields.push({ field: fieldNumber, wire: 2, bytes: bytes.slice(pos, pos + len.value) }); pos += len.value; }",
+    "    else if (wire === 5) { if (pos + 4 > bytes.length) return null; fields.push({ field: fieldNumber, wire: 5 }); pos += 4; }",
+    "    else return null;",
+    "  }",
+    "  return fields;",
+    "}",
+    "function grpcCheckStatusDetailsBin(entry) {",
+    '  if (!entry || entry.value === undefined || entry.value === null || String(entry.value) === "") return;',
+    "  var detailBytes = grpcB64Bytes(entry.value);",
+    '  if (!detailBytes) { pm.expect.fail("grpc-status-details-bin trailer must carry base64-encoded bytes but was " + JSON.stringify(String(entry.value))); return; }',
+    "  var statusFields = grpcPbFields(detailBytes);",
+    '  if (!statusFields) { pm.expect.fail("grpc-status-details-bin does not decode as a protobuf wire message (google.rpc.Status)"); return; }',
+    "  statusFields.forEach(function (statusField) {",
+    "    if (statusField.field === 1) {",
+    '      if (statusField.wire !== 0) { pm.expect.fail("google.rpc.Status.code (field 1) in grpc-status-details-bin must be varint-encoded"); return; }',
+    '      if (statusField.value < 0 || statusField.value > 16) pm.expect.fail("google.rpc.Status.code in grpc-status-details-bin must be a canonical gRPC code 0-16 but was " + statusField.value);',
+    '      else if (statusField.value !== pm.response.code) pm.expect.fail("google.rpc.Status.code in grpc-status-details-bin (" + statusField.value + ") disagrees with the reported status code (" + pm.response.code + ")");',
+    "    } else if (statusField.field === 2) {",
+    '      if (statusField.wire !== 2) pm.expect.fail("google.rpc.Status.message (field 2) in grpc-status-details-bin must be length-delimited");',
+    "    } else if (statusField.field === 3) {",
+    '      if (statusField.wire !== 2) { pm.expect.fail("google.rpc.Status.details (field 3) in grpc-status-details-bin must be length-delimited google.protobuf.Any messages"); return; }',
+    "      var anyFields = grpcPbFields(statusField.bytes);",
+    '      if (!anyFields) { pm.expect.fail("google.rpc.Status.details entry in grpc-status-details-bin is not a decodable google.protobuf.Any message"); return; }',
+    "      var hasTypeUrl = anyFields.some(function (anyField) { return anyField.field === 1 && anyField.wire === 2 && anyField.bytes.length > 0; });",
+    '      if (!hasTypeUrl) pm.expect.fail("google.protobuf.Any in grpc-status-details-bin details must carry a non-empty type_url (field 1)");',
+    "    }",
+    "  });",
+    "}",
     `pm.test('gRPC status is OK for ' + grpcSpec.methodPath, function () {`,
     '  pm.expect(pm.response.code, "gRPC call for " + grpcSpec.methodPath + " returned " + grpcStatusName() + " (" + pm.response.code + ")").to.eql(0);',
     "});",
+    // Metadata/trailer wire conformance runs on every terminal status (error
+    // statuses carry trailers too, so this is not gated on code === 0).
+    `pm.test('gRPC response metadata and trailers conform to gRPC wire rules for ' + grpcSpec.methodPath, function () {`,
+    '  grpcCheckMetaPairs(pm.response.metadata, "gRPC response metadata");',
+    '  grpcCheckMetaPairs(pm.response.trailers, "gRPC response trailer");',
+    '  var contentType = grpcMetaOne(pm.response.metadata, "content-type");',
+    '  if (contentType && contentType.value !== undefined && contentType.value !== null && !/^application\\/grpc/.test(String(contentType.value))) pm.expect.fail("gRPC response content-type metadata must be application/grpc[+proto|+json] but was " + contentType.value);',
+    '  var echoedStatus = grpcMetaOne(pm.response.trailers, "grpc-status");',
+    "  if (echoedStatus) {",
+    "    var echoedCode = Number(echoedStatus.value);",
+    '    if (!Number.isInteger(echoedCode) || echoedCode < 0 || echoedCode > 16) pm.expect.fail("grpc-status trailer must be a canonical gRPC code 0-16 but was " + JSON.stringify(echoedStatus.value));',
+    '    else if (echoedCode !== pm.response.code) pm.expect.fail("grpc-status trailer (" + echoedCode + ") disagrees with the reported status code (" + pm.response.code + ")");',
+    "  }",
+    '  grpcCheckStatusDetailsBin(grpcMetaOne(pm.response.trailers, "grpc-status-details-bin"));',
+    "});",
     // Terminal-response-message expectation. unary and client-streaming RPCs
     // return exactly one terminal response message; server/bidi streaming may
     // legitimately return ZERO messages on an OK stream, so no minimum is
@@ -297793,6 +297922,26 @@ function createGrpcScript(spec) {
       '  if (grpcSpec.responseShape) grpcCheckShape(message, grpcSpec.responseShape, grpcSpec.responseType + ".");',
       "  if (grpcSpec.responseIsRpcStatus) grpcCheckRpcStatus(message, grpcSpec.responseType);",
       "});"
+    ] : [],
+    // Every streamed message is validated, not only the terminal one that
+    // pm.response.json() returns; pm.response.messages is the full received
+    // stream. Server/bidi only: for unary/client the single terminal message
+    // is already covered above.
+    ...(spec.stream === "server" || spec.stream === "bidi") && (spec.hasResponseShape || spec.responseIsRpcStatus) ? [
+      `pm.test('gRPC streamed response messages each match ' + grpcSpec.responseType, function () {`,
+      "  if (pm.response.code !== 0) return;",
+      "  var list = pm.response.messages;",
+      '  if (!list || typeof list.each !== "function") return;',
+      "  var messageIndex = 0;",
+      "  list.each(function (member) {",
+      "    var data = member && member.data !== undefined ? member.data : member;",
+      '    var label = grpcSpec.responseType + "[message " + messageIndex + "]";',
+      "    messageIndex += 1;",
+      '    if (jsonTypeOf(data) !== "object") { pm.expect.fail("gRPC streamed response " + label + " is not a decodable message object but " + jsonTypeOf(data)); return; }',
+      '    if (grpcSpec.responseShape) grpcCheckShape(data, grpcSpec.responseShape, label + ".");',
+      "    if (grpcSpec.responseIsRpcStatus) grpcCheckRpcStatus(data, label);",
+      "  });",
+      "});"
     ] : []
   ];
 }
@@ -303589,6 +303738,7 @@ function createSoapScript(operation, warnings = []) {
   };
   const responseRegex = operation.expectedResponseElement ? elementPresenceRegex(operation.expectedResponseElement) : "";
   const mediaType = operation.soapVersion === "1.2" ? "application/soap+xml" : "text/xml";
+  const envelopeNs = operation.soapVersion === "1.2" ? "http://www.w3.org/2003/05/soap-envelope" : "http://schemas.xmlsoap.org/soap/envelope/";
   const faultStatusLine = operation.soapVersion === "1.2" ? '  if (faulted && code !== 500 && code !== 400) pm.expect.fail("SOAP 1.2 Faults ride HTTP 500, or 400 for env:Sender faults (SOAP 1.2 Part 2 HTTP binding); got HTTP " + code);' : '  if (faulted && code !== 500) pm.expect.fail("SOAP 1.1 Faults must ride HTTP 500 (WS-I Basic Profile R1126); got HTTP " + code);';
   const lines = [
     `var soap = JSON.parse(${JSON.stringify(JSON.stringify(meta))});`,
@@ -303611,6 +303761,11 @@ function createSoapScript(operation, warnings = []) {
     '  pm.expect(bodyText, "response body is not a SOAP envelope").to.match(matchTag("Envelope"));',
     "});",
     "",
+    `pm.test('SOAP Envelope namespace matches SOAP ${operation.soapVersion}', function () {`,
+    '  if (!matchTag("Envelope").test(bodyText)) return;',
+    `  pm.expect(bodyText.indexOf(${JSON.stringify(envelopeNs)}) !== -1, "SOAP ${operation.soapVersion} envelopes must declare the ${envelopeNs} namespace").to.equal(true);`,
+    "});",
+    "",
     "pm.test('SOAP Body element is present', function () {",
     '  pm.expect(bodyText, "SOAP envelope has no Body element").to.match(matchTag("Body"));',
     "});",
@@ -303628,7 +303783,33 @@ function createSoapScript(operation, warnings = []) {
     "  var code = pm.response.code;",
     faultStatusLine,
     '  if (!faulted && code === 500) pm.expect.fail("HTTP 500 from a SOAP endpoint must carry a SOAP Fault in the body");',
-    "});"
+    "});",
+    // Fault well-formedness (diagnostic companion to the Fault-absence test: a
+    // faulted run already fails, this pinpoints a malformed Fault). SOAP 1.1
+    // section 4.4 requires faultcode + faultstring children; SOAP 1.2 Part 1
+    // section 5.4 requires Code/Value + Reason/Text and pins the top-level
+    // Value QName to the five defined fault codes.
+    ...operation.soapVersion === "1.2" ? [
+      "",
+      "pm.test('SOAP Fault is well-formed for SOAP 1.2', function () {",
+      '  if (!matchTag("Fault").test(bodyText)) return;',
+      '  if (!matchTag("Code").test(bodyText)) { pm.expect.fail("a SOAP 1.2 Fault must carry an env:Code child (SOAP 1.2 Part 1 section 5.4)"); return; }',
+      '  if (!matchTag("Value").test(bodyText)) { pm.expect.fail("a SOAP 1.2 Fault Code must carry an env:Value child (SOAP 1.2 Part 1 section 5.4.1)"); return; }',
+      '  if (!matchTag("Reason").test(bodyText)) pm.expect.fail("a SOAP 1.2 Fault must carry an env:Reason child (SOAP 1.2 Part 1 section 5.4)");',
+      '  else if (!matchTag("Text").test(bodyText)) pm.expect.fail("a SOAP 1.2 Fault Reason must carry an env:Text child (SOAP 1.2 Part 1 section 5.4.2)");',
+      '  var faultValue = (bodyText.match(/<(?:[A-Za-z_][\\w.-]*:)?Value[^>]*>([\\s\\S]*?)<\\//) || [])[1] || "";',
+      '  var faultLocal = faultValue.trim().split(":").pop();',
+      '  var faultCodes = ["VersionMismatch", "MustUnderstand", "DataEncodingUnknown", "Sender", "Receiver"];',
+      '  if (faultLocal && faultCodes.indexOf(faultLocal) === -1) pm.expect.fail("the SOAP 1.2 Fault Code Value must be one of " + faultCodes.join(", ") + " (SOAP 1.2 Part 1 table 4); got " + faultValue.trim());',
+      "});"
+    ] : [
+      "",
+      "pm.test('SOAP Fault is well-formed for SOAP 1.1', function () {",
+      '  if (!matchTag("Fault").test(bodyText)) return;',
+      '  if (!matchTag("faultcode").test(bodyText)) pm.expect.fail("a SOAP 1.1 Fault must carry a faultcode child (SOAP 1.1 section 4.4)");',
+      '  if (!matchTag("faultstring").test(bodyText)) pm.expect.fail("a SOAP 1.1 Fault must carry a faultstring child (SOAP 1.1 section 4.4)");',
+      "});"
+    ]
   ];
   if (responseRegex) {
     lines.push(
@@ -303805,7 +303986,8 @@ function wsBindingKeyValues(channel) {
   const value = asRecord15(wsBinding.value()) ?? {};
   return {
     headers: bindingKeyValues(value.headers),
-    queryParams: bindingKeyValues(value.query)
+    queryParams: bindingKeyValues(value.query),
+    binding: value
   };
 }
 function collectMqttInfo(channel, servers, messagesRaw, documentJson) {
@@ -303879,6 +304061,8 @@ function messageDescriptor2(message, warnings, channelId, defaultContentType, re
   const replySchema = replyByMessageId.get(message.id());
   const ackSchema = xAckSchema ?? replySchema;
   const ackSource = xAckSchema ? "x-ack" : replySchema ? "reply" : void 0;
+  const correlationRaw = asRecord15(rawMessage.correlationId)?.location;
+  const correlationLocation = typeof correlationRaw === "string" ? correlationRaw : void 0;
   const examples = message.examples().all().filter((example) => example.hasPayload());
   const hasExample = examples.length > 0;
   let sample;
@@ -303900,6 +304084,7 @@ function messageDescriptor2(message, warnings, channelId, defaultContentType, re
     payloadSchema,
     ackSchema,
     ackSource,
+    correlationLocation,
     sample,
     hasExample,
     contentKind,
@@ -303912,6 +304097,7 @@ function channelDescriptor(channel, document2, documentJson, defaultContentType,
   const servers = resolveServers(channel, document2);
   const messagesRaw = channel.messages().all();
   const transport = detectTransport(channel, servers, messagesRaw, documentJson, warnings);
+  const parameterNames = Object.keys(asRecord15(channel.json().parameters) ?? {}).sort();
   const serverUrl = servers.find((server) => server.url())?.url() || options.endpointUrl?.trim() || "";
   if (!serverUrl) {
     warnings.push(`ASYNCAPI_NO_SERVER_URL: channel ${channel.id()} has no resolvable server url; the generated request url is derived from the channel address only and must be completed before use`);
@@ -303931,6 +304117,7 @@ function channelDescriptor(channel, document2, documentJson, defaultContentType,
       headers: [],
       queryParams: [],
       mqtt: collectMqttInfo(channel, servers, messagesRaw, documentJson),
+      parameterNames,
       messages,
       warnings
     };
@@ -303945,11 +304132,12 @@ function channelDescriptor(channel, document2, documentJson, defaultContentType,
       queryParams: [],
       socketioNamespace: address.startsWith("/") ? address : `/${address}`,
       socketioPath: DEFAULT_SOCKETIO_PATH,
+      parameterNames,
       messages,
       warnings
     };
   }
-  const { headers, queryParams } = wsBindingKeyValues(channel);
+  const { headers, queryParams, binding } = wsBindingKeyValues(channel);
   return {
     id: channel.id(),
     address,
@@ -303957,6 +304145,8 @@ function channelDescriptor(channel, document2, documentJson, defaultContentType,
     url: joinUrl(serverUrl, address),
     headers,
     queryParams,
+    parameterNames,
+    wsBinding: binding,
     messages,
     warnings
   };
@@ -304394,14 +304584,68 @@ function collectMessageNodeIds(node, ids, path10) {
     if (record) collectMessageNodeIds(record, ids, `${path10}/${i}`);
   });
 }
+function validateChannelParameters(channel, warnings) {
+  const declared = new Set(channel.parameterNames ?? []);
+  const used = /* @__PURE__ */ new Set();
+  for (const match of channel.address.matchAll(/\{([^{}]*)\}/g)) {
+    const name = match[1] ?? "";
+    if (!name) {
+      warnings.push(`ASYNCAPI_CHANNEL_PARAMETER_INVALID: channel ${channel.id} address ${channel.address} contains an empty {} parameter expression`);
+      continue;
+    }
+    used.add(name);
+    if (!declared.has(name)) {
+      warnings.push(`ASYNCAPI_CHANNEL_PARAMETER_UNDECLARED: channel ${channel.id} address parameter {${name}} has no entry in the channel parameters object; AsyncAPI requires every address parameter to be declared`);
+    }
+  }
+  for (const name of declared) {
+    if (!used.has(name)) {
+      warnings.push(`ASYNCAPI_CHANNEL_PARAMETER_UNUSED: channel ${channel.id} declares parameter ${name} that never appears in the channel address ${channel.address}`);
+    }
+  }
+}
+var CORRELATION_LOCATION_GRAMMAR = /^\$message\.(header|payload)#(\/(?:[^~/]|~[01])*)+$/;
+function validateCorrelationLocation(channelId, message, warnings) {
+  if (message.correlationLocation === void 0) return;
+  if (!CORRELATION_LOCATION_GRAMMAR.test(message.correlationLocation)) {
+    warnings.push(
+      `ASYNCAPI_CORRELATION_LOCATION_INVALID: message ${message.id} on channel ${channelId} correlationId location ${JSON.stringify(message.correlationLocation)} is not a valid AsyncAPI runtime expression ($message.header#/<pointer> or $message.payload#/<pointer>)`
+    );
+  }
+}
+var SOCKETIO_RESERVED_EVENTS = /* @__PURE__ */ new Set(["connect", "connect_error", "disconnect", "disconnecting", "newListener", "removeListener"]);
+function validateWsBinding(channel, warnings) {
+  const binding = channel.wsBinding;
+  if (!binding) return;
+  const method = binding.method;
+  if (method !== void 0 && (typeof method !== "string" || method !== "GET" && method !== "POST")) {
+    warnings.push(`ASYNCAPI_WS_BINDING_INVALID: channel ${channel.id} ws binding method must be "GET" or "POST" but was ${JSON.stringify(method)}`);
+  }
+  for (const key of ["query", "headers"]) {
+    const schema = binding[key];
+    if (schema === void 0) continue;
+    const record = asRecord16(schema);
+    if (!record || record.type !== void 0 && record.type !== "object") {
+      warnings.push(`ASYNCAPI_WS_BINDING_INVALID: channel ${channel.id} ws binding ${key} must be a Schema Object of type object`);
+    }
+  }
+}
 function instrumentAsyncApiCollection(collection, index) {
   const warnings = [
     ...index.warnings,
     ...index.channels.flatMap((channel) => channel.warnings)
   ];
   for (const channel of index.channels) {
+    validateChannelParameters(channel, warnings);
     if (channel.transport === "mqtt") validateMqttChannel(channel, warnings);
+    if (channel.transport === "ws-raw") validateWsBinding(channel, warnings);
     for (const message of channel.messages) {
+      if (channel.transport === "socketio" && SOCKETIO_RESERVED_EVENTS.has(message.eventName)) {
+        warnings.push(
+          `ASYNCAPI_SOCKETIO_RESERVED_EVENT: message ${message.id} on channel ${channel.id} uses the reserved Socket.IO event name "${message.eventName}"; reserved lifecycle events cannot be emitted or received as application events`
+        );
+      }
+      validateCorrelationLocation(channel.id, message, warnings);
       validateMessage(index, channel.id, message, warnings);
     }
   }
@@ -304579,6 +304823,7 @@ function toolDescriptor(tool, warnings) {
     description: typeof tool.description === "string" ? tool.description : void 0,
     inputSchema,
     outputSchema: asRecord17(tool.outputSchema) ?? void 0,
+    annotations: asRecord17(tool.annotations) ?? void 0,
     sampleArguments: inputSchema ? sampleFromSchema2(inputSchema, 0) : {},
     warnings: toolWarnings
   };
@@ -304779,10 +305024,41 @@ function validateServer(server, warnings) {
     }
   }
 }
+var TOOL_ANNOTATION_BOOLEAN_HINTS = ["readOnlyHint", "destructiveHint", "idempotentHint", "openWorldHint"];
+function validateToolAnnotations(tool, warnings) {
+  if (!tool.annotations) return;
+  for (const hint of TOOL_ANNOTATION_BOOLEAN_HINTS) {
+    const value = tool.annotations[hint];
+    if (value !== void 0 && typeof value !== "boolean") {
+      warnings.push(`MCP_TOOL_ANNOTATION_INVALID: tool ${tool.name} annotations.${hint} must be a boolean (MCP ToolAnnotations); got ${JSON.stringify(value)}`);
+    }
+  }
+  if (tool.annotations.title !== void 0 && typeof tool.annotations.title !== "string") {
+    warnings.push(`MCP_TOOL_ANNOTATION_INVALID: tool ${tool.name} annotations.title must be a string (MCP ToolAnnotations); got ${JSON.stringify(tool.annotations.title)}`);
+  }
+}
+function validateToolOutputSchema(index, tool, warnings) {
+  if (!tool.outputSchema) return;
+  const declaredType = tool.outputSchema.type;
+  if (declaredType !== void 0 && declaredType !== "object") {
+    warnings.push(`MCP_TOOL_OUTPUT_SCHEMA_INVALID: tool ${tool.name} outputSchema type is ${JSON.stringify(declaredType)}; the MCP specification requires tool output schemas to describe the structuredContent object`);
+  }
+  const packed = packSchema(index.documentJson, tool.outputSchema, "3.0", "response");
+  if (packed.unsupported) {
+    const code = isSchemaGraphOverflow(packed) ? "MCP_SCHEMA_NOT_COMPILED" : "MCP_TOOL_OUTPUT_SCHEMA_NOT_VALIDATED";
+    warnings.push(`${code}: tool ${tool.name} outputSchema is not validated (${packed.unsupported})`);
+    return;
+  }
+  if (!compileSchemaValidator(packed.schema)) {
+    warnings.push(`MCP_TOOL_OUTPUT_SCHEMA_NOT_VALIDATED: tool ${tool.name} outputSchema could not be compiled to a validator`);
+  }
+}
 function validateTool(index, tool, warnings) {
   if (!TOOL_NAME_RE.test(tool.name)) {
     warnings.push(`MCP_TOOL_NAME_UNCONVENTIONAL: tool name "${tool.name}" is outside the conventional [A-Za-z0-9_./-]{1,128} identifier set`);
   }
+  validateToolAnnotations(tool, warnings);
+  validateToolOutputSchema(index, tool, warnings);
   if (!tool.inputSchema) return;
   const declaredType = tool.inputSchema.type;
   if (declaredType !== void 0 && declaredType !== "object") {