@postman-cse/onboarding-bootstrap 2.9.8 → 2.9.9

package/dist/action.cjs

@@ -261017,6 +261017,13 @@ function normalizeResponseKey(status) {
   const raw = String(status);
   return /^[1-5]xx$/i.test(raw) ? raw.toUpperCase() : raw;
 }
+function responseBodyExpectation(method, status, content) {
+  const normalizedStatus = normalizeResponseKey(status);
+  if (method === "head" || normalizedStatus === "1XX" || /^1[0-9][0-9]$/.test(normalizedStatus) || normalizedStatus === "204" || normalizedStatus === "205" || normalizedStatus === "304") {
+    return "forbidden";
+  }
+  return Object.keys(content).length > 0 ? "declared" : "unknown";
+}
 function collectSecurityApiKeys(root, operation) {
   const securitySchemes = asRecord5(asRecord5(root.components)?.securitySchemes);
   const requirements = operation.security === void 0 ? asArray2(root.security) : asArray2(operation.security);
@@ -261447,6 +261454,13 @@ function collectRequestBody(root, operation, version, operationId, warnings) {
   const body2 = resolveInternalRef(root, operation.requestBody);
   if (!body2) return void 0;
   const content = asRecord5(body2.content);
+  for (const [contentType2, mediaObject] of Object.entries(content ?? {})) {
+    if (asRecord5(mediaObject)?.schema === void 0) {
+      warnings.push(
+        `CONTRACT_REQUEST_SCHEMA_UNDOCUMENTED: request body ${contentType2} on ${operationId} declares no schema; generated request payload shape is not validated`
+      );
+    }
+  }
   const fieldRules = content ? requestBodyFieldRules(root, content, version, operationId, warnings) : void 0;
   if (fieldRules) {
     for (const [base, rule] of Object.entries(fieldRules)) {
@@ -262293,9 +262307,22 @@ function buildContractIndex(root) {
           const linkExpressions = collectLinkExpressions(root, response, `${lowerMethod.toUpperCase()} ${path10}`, responseWarnings, version, linkTargetSchemas);
           const responseContext = `${lowerMethod.toUpperCase()} ${path10} status ${status}`;
           const content = responseContent(root, version, response, responseContext, responseWarnings);
-          if ((status === "204" || status === "205" || status === "304") && Object.keys(content).length > 0) {
+          const bodyExpectation = responseBodyExpectation(lowerMethod, status, content);
+          if (bodyExpectation === "forbidden" && Object.keys(content).length > 0) {
             responseWarnings.add(`CONTRACT_BODYLESS_STATUS_WITH_CONTENT: ${lowerMethod.toUpperCase()} ${path10} declares content for status ${status}, which RFC 9110 forbids on the wire`);
           }
+          if (bodyExpectation === "unknown") {
+            responseWarnings.add(
+              `CONTRACT_RESPONSE_BODY_UNDOCUMENTED: ${responseContext} declares no response content; body presence, media type, and shape are not validated`
+            );
+          }
+          for (const [contentType2, mediaObject] of Object.entries(asRecord5(response.content) ?? {})) {
+            if (asRecord5(mediaObject)?.schema === void 0) {
+              responseWarnings.add(
+                `CONTRACT_RESPONSE_SCHEMA_UNDOCUMENTED: response ${contentType2} on ${responseContext} declares no schema; body shape is not validated`
+              );
+            }
+          }
           for (const [contentType2, media] of Object.entries(content)) {
             const base = contentType2.toLowerCase().split(";")[0]?.trim() ?? "";
             const schemaType = asRecord5(media.schema)?.type;
@@ -262307,7 +262334,7 @@ function buildContractIndex(root) {
           const writeOnlyProperties = collectResponseWriteOnlyNames(root, response);
           contractResponses[normalizeResponseKey(status)] = {
             content,
-            hasBody: Object.keys(content).length > 0,
+            bodyExpectation,
             headers,
             ...linkExpressions.length > 0 ? { links: linkExpressions } : {},
             ...writeOnlyProperties.length > 0 ? { writeOnlyProperties } : {}
@@ -262583,7 +262610,12 @@ function createContractScript(operation, warnings = []) {
     "  return null;",
     "}",
     'function responseText() { return pm.response.text() || ""; }',
-    'function isBodyless() { return pm.response.code === 204 || pm.response.code === 205 || pm.response.code === 304 || contract.method === "HEAD"; }',
+    'function isBodyless() { return pm.response.code < 200 || pm.response.code === 204 || pm.response.code === 205 || pm.response.code === 304 || contract.method === "HEAD"; }',
+    "function selectedBodyExpectation() {",
+    '  if (isBodyless()) return "forbidden";',
+    '  if (!selected) return "unknown";',
+    '  return selected.value.bodyExpectation || "unknown";',
+    "}",
     'function mediaBase(value) { return String(value || "").toLowerCase().split(";")[0].trim(); }',
     'function mediaParts(value) { var base = mediaBase(value); var parts = base.split("/"); return { raw: base, type: parts[0] || "", subtype: parts[1] || "" }; }',
     'function isJsonSubtype(subtype) { return subtype === "json" || /\\+json$/.test(subtype); }',
@@ -262623,6 +262655,7 @@ function createContractScript(operation, warnings = []) {
     "  return matches[0];",
     "}",
     "var selected = selectedResponseContract();",
+    "var bodyExpectation = selectedBodyExpectation();",
     ...skipped.length > 0 ? [
       // A schema schemasafe could not compile is NOT silently ignored: it is
       // surfaced here (and as a CONTRACT_SCHEMA_NOT_COMPILED warning at generation
@@ -262654,10 +262687,8 @@ function createContractScript(operation, warnings = []) {
     "});",
     "pm.test('Response body matches OpenAPI body contract', function () {",
     "  if (!selected) return;",
-    "  if (isBodyless()) { pm.expect(responseText().trim().length).to.equal(0); return; }",
-    "  var content = selected.value.content || {};",
-    '  if (Object.keys(content).length === 0) { pm.expect(responseText().trim().length, "OpenAPI response defines no body but response body was not empty").to.equal(0); }',
-    '  else { pm.expect(responseText().trim().length, "OpenAPI response defines a body but response body was empty").to.be.above(0); }',
+    '  if (bodyExpectation === "forbidden") { pm.expect(responseText().length, "HTTP semantics forbid a response body for " + contract.method + " " + contract.path + " status " + pm.response.code).to.equal(0); return; }',
+    '  if (bodyExpectation === "declared") { pm.expect(responseText().length, "OpenAPI response declares content but response body was empty").to.be.above(0); }',
     "});",
     "pm.test('Content-Type matches OpenAPI response content', function () {",
     "  if (!selected || isBodyless()) return;",
@@ -263700,8 +263731,7 @@ function createContractScript(operation, warnings = []) {
     '  if (contract.method === "HEAD" || pm.response.code === 304) return;',
     "  var actualBytes = unescape(encodeURIComponent(responseText())).length;",
     '  if (Number(String(raw).trim()) !== actualBytes) pm.expect.fail("Content-Length must equal the response body byte length when Content-Encoding and Transfer-Encoding are absent (RFC 9110 8.6): " + raw + " !== " + actualBytes);',
-    "  var mustBeEmpty = isBodyless() || (selected && Object.keys(selected.value.content || {}).length === 0);",
-    '  if (mustBeEmpty && Number(String(raw).trim()) !== 0) pm.expect.fail("OpenAPI defines no response body for " + contract.method + " " + contract.path + " status " + pm.response.code + " but Content-Length was " + raw);',
+    '  if (bodyExpectation === "forbidden" && Number(String(raw).trim()) !== 0) pm.expect.fail("HTTP semantics forbid a carried response body for " + contract.method + " " + contract.path + " status " + pm.response.code + " but Content-Length was " + raw);',
     "});",
     "pm.test('RFC SHOULD-level advisories are documented', function () {",
     '  pm.expect(rfcAdvisories, "SHOULD-level findings (advisory, non-failing): " + rfcAdvisories.join("; ")).to.be.an("array");',

package/dist/cli.cjs

@@ -259335,6 +259335,13 @@ function normalizeResponseKey(status) {
   const raw = String(status);
   return /^[1-5]xx$/i.test(raw) ? raw.toUpperCase() : raw;
 }
+function responseBodyExpectation(method, status, content) {
+  const normalizedStatus = normalizeResponseKey(status);
+  if (method === "head" || normalizedStatus === "1XX" || /^1[0-9][0-9]$/.test(normalizedStatus) || normalizedStatus === "204" || normalizedStatus === "205" || normalizedStatus === "304") {
+    return "forbidden";
+  }
+  return Object.keys(content).length > 0 ? "declared" : "unknown";
+}
 function collectSecurityApiKeys(root, operation) {
   const securitySchemes = asRecord5(asRecord5(root.components)?.securitySchemes);
   const requirements = operation.security === void 0 ? asArray2(root.security) : asArray2(operation.security);
@@ -259765,6 +259772,13 @@ function collectRequestBody(root, operation, version, operationId, warnings) {
   const body2 = resolveInternalRef(root, operation.requestBody);
   if (!body2) return void 0;
   const content = asRecord5(body2.content);
+  for (const [contentType2, mediaObject] of Object.entries(content ?? {})) {
+    if (asRecord5(mediaObject)?.schema === void 0) {
+      warnings.push(
+        `CONTRACT_REQUEST_SCHEMA_UNDOCUMENTED: request body ${contentType2} on ${operationId} declares no schema; generated request payload shape is not validated`
+      );
+    }
+  }
   const fieldRules = content ? requestBodyFieldRules(root, content, version, operationId, warnings) : void 0;
   if (fieldRules) {
     for (const [base, rule] of Object.entries(fieldRules)) {
@@ -260611,9 +260625,22 @@ function buildContractIndex(root) {
           const linkExpressions = collectLinkExpressions(root, response, `${lowerMethod.toUpperCase()} ${path8}`, responseWarnings, version, linkTargetSchemas);
           const responseContext = `${lowerMethod.toUpperCase()} ${path8} status ${status}`;
           const content = responseContent(root, version, response, responseContext, responseWarnings);
-          if ((status === "204" || status === "205" || status === "304") && Object.keys(content).length > 0) {
+          const bodyExpectation = responseBodyExpectation(lowerMethod, status, content);
+          if (bodyExpectation === "forbidden" && Object.keys(content).length > 0) {
             responseWarnings.add(`CONTRACT_BODYLESS_STATUS_WITH_CONTENT: ${lowerMethod.toUpperCase()} ${path8} declares content for status ${status}, which RFC 9110 forbids on the wire`);
           }
+          if (bodyExpectation === "unknown") {
+            responseWarnings.add(
+              `CONTRACT_RESPONSE_BODY_UNDOCUMENTED: ${responseContext} declares no response content; body presence, media type, and shape are not validated`
+            );
+          }
+          for (const [contentType2, mediaObject] of Object.entries(asRecord5(response.content) ?? {})) {
+            if (asRecord5(mediaObject)?.schema === void 0) {
+              responseWarnings.add(
+                `CONTRACT_RESPONSE_SCHEMA_UNDOCUMENTED: response ${contentType2} on ${responseContext} declares no schema; body shape is not validated`
+              );
+            }
+          }
           for (const [contentType2, media] of Object.entries(content)) {
             const base = contentType2.toLowerCase().split(";")[0]?.trim() ?? "";
             const schemaType = asRecord5(media.schema)?.type;
@@ -260625,7 +260652,7 @@ function buildContractIndex(root) {
           const writeOnlyProperties = collectResponseWriteOnlyNames(root, response);
           contractResponses[normalizeResponseKey(status)] = {
             content,
-            hasBody: Object.keys(content).length > 0,
+            bodyExpectation,
             headers,
             ...linkExpressions.length > 0 ? { links: linkExpressions } : {},
             ...writeOnlyProperties.length > 0 ? { writeOnlyProperties } : {}
@@ -260901,7 +260928,12 @@ function createContractScript(operation, warnings = []) {
     "  return null;",
     "}",
     'function responseText() { return pm.response.text() || ""; }',
-    'function isBodyless() { return pm.response.code === 204 || pm.response.code === 205 || pm.response.code === 304 || contract.method === "HEAD"; }',
+    'function isBodyless() { return pm.response.code < 200 || pm.response.code === 204 || pm.response.code === 205 || pm.response.code === 304 || contract.method === "HEAD"; }',
+    "function selectedBodyExpectation() {",
+    '  if (isBodyless()) return "forbidden";',
+    '  if (!selected) return "unknown";',
+    '  return selected.value.bodyExpectation || "unknown";',
+    "}",
     'function mediaBase(value) { return String(value || "").toLowerCase().split(";")[0].trim(); }',
     'function mediaParts(value) { var base = mediaBase(value); var parts = base.split("/"); return { raw: base, type: parts[0] || "", subtype: parts[1] || "" }; }',
     'function isJsonSubtype(subtype) { return subtype === "json" || /\\+json$/.test(subtype); }',
@@ -260941,6 +260973,7 @@ function createContractScript(operation, warnings = []) {
     "  return matches[0];",
     "}",
     "var selected = selectedResponseContract();",
+    "var bodyExpectation = selectedBodyExpectation();",
     ...skipped.length > 0 ? [
       // A schema schemasafe could not compile is NOT silently ignored: it is
       // surfaced here (and as a CONTRACT_SCHEMA_NOT_COMPILED warning at generation
@@ -260972,10 +261005,8 @@ function createContractScript(operation, warnings = []) {
     "});",
     "pm.test('Response body matches OpenAPI body contract', function () {",
     "  if (!selected) return;",
-    "  if (isBodyless()) { pm.expect(responseText().trim().length).to.equal(0); return; }",
-    "  var content = selected.value.content || {};",
-    '  if (Object.keys(content).length === 0) { pm.expect(responseText().trim().length, "OpenAPI response defines no body but response body was not empty").to.equal(0); }',
-    '  else { pm.expect(responseText().trim().length, "OpenAPI response defines a body but response body was empty").to.be.above(0); }',
+    '  if (bodyExpectation === "forbidden") { pm.expect(responseText().length, "HTTP semantics forbid a response body for " + contract.method + " " + contract.path + " status " + pm.response.code).to.equal(0); return; }',
+    '  if (bodyExpectation === "declared") { pm.expect(responseText().length, "OpenAPI response declares content but response body was empty").to.be.above(0); }',
     "});",
     "pm.test('Content-Type matches OpenAPI response content', function () {",
     "  if (!selected || isBodyless()) return;",
@@ -262018,8 +262049,7 @@ function createContractScript(operation, warnings = []) {
     '  if (contract.method === "HEAD" || pm.response.code === 304) return;',
     "  var actualBytes = unescape(encodeURIComponent(responseText())).length;",
     '  if (Number(String(raw).trim()) !== actualBytes) pm.expect.fail("Content-Length must equal the response body byte length when Content-Encoding and Transfer-Encoding are absent (RFC 9110 8.6): " + raw + " !== " + actualBytes);',
-    "  var mustBeEmpty = isBodyless() || (selected && Object.keys(selected.value.content || {}).length === 0);",
-    '  if (mustBeEmpty && Number(String(raw).trim()) !== 0) pm.expect.fail("OpenAPI defines no response body for " + contract.method + " " + contract.path + " status " + pm.response.code + " but Content-Length was " + raw);',
+    '  if (bodyExpectation === "forbidden" && Number(String(raw).trim()) !== 0) pm.expect.fail("HTTP semantics forbid a carried response body for " + contract.method + " " + contract.path + " status " + pm.response.code + " but Content-Length was " + raw);',
     "});",
     "pm.test('RFC SHOULD-level advisories are documented', function () {",
     '  pm.expect(rfcAdvisories, "SHOULD-level findings (advisory, non-failing): " + rfcAdvisories.join("; ")).to.be.an("array");',

package/dist/index.cjs

@@ -261042,6 +261042,13 @@ function normalizeResponseKey(status) {
   const raw = String(status);
   return /^[1-5]xx$/i.test(raw) ? raw.toUpperCase() : raw;
 }
+function responseBodyExpectation(method, status, content) {
+  const normalizedStatus = normalizeResponseKey(status);
+  if (method === "head" || normalizedStatus === "1XX" || /^1[0-9][0-9]$/.test(normalizedStatus) || normalizedStatus === "204" || normalizedStatus === "205" || normalizedStatus === "304") {
+    return "forbidden";
+  }
+  return Object.keys(content).length > 0 ? "declared" : "unknown";
+}
 function collectSecurityApiKeys(root, operation) {
   const securitySchemes = asRecord5(asRecord5(root.components)?.securitySchemes);
   const requirements = operation.security === void 0 ? asArray2(root.security) : asArray2(operation.security);
@@ -261472,6 +261479,13 @@ function collectRequestBody(root, operation, version, operationId, warnings) {
   const body2 = resolveInternalRef(root, operation.requestBody);
   if (!body2) return void 0;
   const content = asRecord5(body2.content);
+  for (const [contentType2, mediaObject] of Object.entries(content ?? {})) {
+    if (asRecord5(mediaObject)?.schema === void 0) {
+      warnings.push(
+        `CONTRACT_REQUEST_SCHEMA_UNDOCUMENTED: request body ${contentType2} on ${operationId} declares no schema; generated request payload shape is not validated`
+      );
+    }
+  }
   const fieldRules = content ? requestBodyFieldRules(root, content, version, operationId, warnings) : void 0;
   if (fieldRules) {
     for (const [base, rule] of Object.entries(fieldRules)) {
@@ -262318,9 +262332,22 @@ function buildContractIndex(root) {
           const linkExpressions = collectLinkExpressions(root, response, `${lowerMethod.toUpperCase()} ${path10}`, responseWarnings, version, linkTargetSchemas);
           const responseContext = `${lowerMethod.toUpperCase()} ${path10} status ${status}`;
           const content = responseContent(root, version, response, responseContext, responseWarnings);
-          if ((status === "204" || status === "205" || status === "304") && Object.keys(content).length > 0) {
+          const bodyExpectation = responseBodyExpectation(lowerMethod, status, content);
+          if (bodyExpectation === "forbidden" && Object.keys(content).length > 0) {
             responseWarnings.add(`CONTRACT_BODYLESS_STATUS_WITH_CONTENT: ${lowerMethod.toUpperCase()} ${path10} declares content for status ${status}, which RFC 9110 forbids on the wire`);
           }
+          if (bodyExpectation === "unknown") {
+            responseWarnings.add(
+              `CONTRACT_RESPONSE_BODY_UNDOCUMENTED: ${responseContext} declares no response content; body presence, media type, and shape are not validated`
+            );
+          }
+          for (const [contentType2, mediaObject] of Object.entries(asRecord5(response.content) ?? {})) {
+            if (asRecord5(mediaObject)?.schema === void 0) {
+              responseWarnings.add(
+                `CONTRACT_RESPONSE_SCHEMA_UNDOCUMENTED: response ${contentType2} on ${responseContext} declares no schema; body shape is not validated`
+              );
+            }
+          }
           for (const [contentType2, media] of Object.entries(content)) {
             const base = contentType2.toLowerCase().split(";")[0]?.trim() ?? "";
             const schemaType = asRecord5(media.schema)?.type;
@@ -262332,7 +262359,7 @@ function buildContractIndex(root) {
           const writeOnlyProperties = collectResponseWriteOnlyNames(root, response);
           contractResponses[normalizeResponseKey(status)] = {
             content,
-            hasBody: Object.keys(content).length > 0,
+            bodyExpectation,
             headers,
             ...linkExpressions.length > 0 ? { links: linkExpressions } : {},
             ...writeOnlyProperties.length > 0 ? { writeOnlyProperties } : {}
@@ -262608,7 +262635,12 @@ function createContractScript(operation, warnings = []) {
     "  return null;",
     "}",
     'function responseText() { return pm.response.text() || ""; }',
-    'function isBodyless() { return pm.response.code === 204 || pm.response.code === 205 || pm.response.code === 304 || contract.method === "HEAD"; }',
+    'function isBodyless() { return pm.response.code < 200 || pm.response.code === 204 || pm.response.code === 205 || pm.response.code === 304 || contract.method === "HEAD"; }',
+    "function selectedBodyExpectation() {",
+    '  if (isBodyless()) return "forbidden";',
+    '  if (!selected) return "unknown";',
+    '  return selected.value.bodyExpectation || "unknown";',
+    "}",
     'function mediaBase(value) { return String(value || "").toLowerCase().split(";")[0].trim(); }',
     'function mediaParts(value) { var base = mediaBase(value); var parts = base.split("/"); return { raw: base, type: parts[0] || "", subtype: parts[1] || "" }; }',
     'function isJsonSubtype(subtype) { return subtype === "json" || /\\+json$/.test(subtype); }',
@@ -262648,6 +262680,7 @@ function createContractScript(operation, warnings = []) {
     "  return matches[0];",
     "}",
     "var selected = selectedResponseContract();",
+    "var bodyExpectation = selectedBodyExpectation();",
     ...skipped.length > 0 ? [
       // A schema schemasafe could not compile is NOT silently ignored: it is
       // surfaced here (and as a CONTRACT_SCHEMA_NOT_COMPILED warning at generation
@@ -262679,10 +262712,8 @@ function createContractScript(operation, warnings = []) {
     "});",
     "pm.test('Response body matches OpenAPI body contract', function () {",
     "  if (!selected) return;",
-    "  if (isBodyless()) { pm.expect(responseText().trim().length).to.equal(0); return; }",
-    "  var content = selected.value.content || {};",
-    '  if (Object.keys(content).length === 0) { pm.expect(responseText().trim().length, "OpenAPI response defines no body but response body was not empty").to.equal(0); }',
-    '  else { pm.expect(responseText().trim().length, "OpenAPI response defines a body but response body was empty").to.be.above(0); }',
+    '  if (bodyExpectation === "forbidden") { pm.expect(responseText().length, "HTTP semantics forbid a response body for " + contract.method + " " + contract.path + " status " + pm.response.code).to.equal(0); return; }',
+    '  if (bodyExpectation === "declared") { pm.expect(responseText().length, "OpenAPI response declares content but response body was empty").to.be.above(0); }',
     "});",
     "pm.test('Content-Type matches OpenAPI response content', function () {",
     "  if (!selected || isBodyless()) return;",
@@ -263725,8 +263756,7 @@ function createContractScript(operation, warnings = []) {
     '  if (contract.method === "HEAD" || pm.response.code === 304) return;',
     "  var actualBytes = unescape(encodeURIComponent(responseText())).length;",
     '  if (Number(String(raw).trim()) !== actualBytes) pm.expect.fail("Content-Length must equal the response body byte length when Content-Encoding and Transfer-Encoding are absent (RFC 9110 8.6): " + raw + " !== " + actualBytes);',
-    "  var mustBeEmpty = isBodyless() || (selected && Object.keys(selected.value.content || {}).length === 0);",
-    '  if (mustBeEmpty && Number(String(raw).trim()) !== 0) pm.expect.fail("OpenAPI defines no response body for " + contract.method + " " + contract.path + " status " + pm.response.code + " but Content-Length was " + raw);',
+    '  if (bodyExpectation === "forbidden" && Number(String(raw).trim()) !== 0) pm.expect.fail("HTTP semantics forbid a carried response body for " + contract.method + " " + contract.path + " status " + pm.response.code + " but Content-Length was " + raw);',
     "});",
     "pm.test('RFC SHOULD-level advisories are documented', function () {",
     '  pm.expect(rfcAdvisories, "SHOULD-level findings (advisory, non-failing): " + rfcAdvisories.join("; ")).to.be.an("array");',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@postman-cse/onboarding-bootstrap",
-  "version": "2.9.8",
+  "version": "2.9.9",
   "description": "Bootstrap Postman workspaces, specs, and collections from OpenAPI.",
   "type": "module",
   "main": "dist/index.cjs",