callman-core 1.34.0 → 1.36.0

package/dist/script/executor.js

@@ -4,7 +4,7 @@
 // Composes:
 //   - sandbox (vm.createContext + scope Proxy + reserved globals)
 //   - pm API (assertions + tests + env/globals + request/response + node + log)
-//   - sandbox-D extensions (db, kafka, redis, random, counter, cryptojs, variables)
+//   - sandbox-D extensions (db, redis, random, counter, cryptojs, variables)
 //   - timeout (vm-level + outer Promise race)
 //   - error serialization (line/column attribution)
 //
@@ -13,13 +13,19 @@
 // distinguish "the sandbox itself blew up" should check `success === false`.
 import { executeRequest } from "../request/executeRequest.js";
 import { buildEnvironmentApi } from "./features/environment.js";
-import { createExpectApi } from "./features/assertions.js";
+import { splitSetCookieHeader } from "./legacy.js";
+import { buildLegacyGlobals, scriptOptsOutOfLegacy } from "./features/legacyPostman.js";
+import { createSandboxRequire, preloadScriptModules } from "./postman/modules.js";
+import { buildPmCookies, createMemoryCookieJar, parseSetCookieLine } from "./postman/cookies.js";
+import { buildVisualizerFeature } from "./features/visualizer.js";
+import { buildSdkRequestApi } from "./postman/requestAdapter.js";
+import { attachRequestAssertions, buildSdkResponseApi } from "./postman/responseAdapter.js";
+import { loadPostmanRuntime, scriptNeedsSdk } from "./postman/runtime.js";
 import { buildLabelGlobals, buildNodeApi } from "./features/node.js";
 import { buildRequestApi } from "./features/request.js";
 import { buildResponseApi } from "./features/response.js";
 import { buildTestCollector } from "./features/tests.js";
 import { createLogCollector, createSilentLogCollector, } from "./features/log.js";
-import { buildKafkaApi } from "./features/kafka.js";
 import { buildRedisApi } from "./features/redis.js";
 import { buildRandomApi } from "./features/random.js";
 import { buildCounterFeature } from "./features/counter.js";
@@ -28,6 +34,7 @@ import { buildVariablesApi } from "./features/variables.js";
 import { buildDbApi } from "./features/db.js";
 import { buildTimerFeature } from "./features/timers.js";
 import { buildCollectionVariablesApi } from "./features/collectionVariables.js";
+import { buildIterationDataApi } from "./features/iterationData.js";
 import { buildInfoApi } from "./features/info.js";
 import { buildExecutionFeature } from "./features/execution.js";
 // Lodash is exposed unconditionally as the `_` global — Postman
@@ -40,26 +47,13 @@ import { toHostPromise, withAsyncTimeout } from "./timeout.js";
 const DEFAULT_TIMEOUT_MS = 15_000;
 const DEFAULT_FILENAME = "callman-script.js";
 const DEFAULT_STAGE = "script";
-const buildSandboxDFeatures = (capabilities, isInsideTestCallback, envValues, globalValues, responseTemplateRoot) => {
+const buildSandboxDFeatures = (capabilities, isInsideTestCallback, envValues, globalValues, responseTemplateRoot, collectionValues, live) => {
     const extensions = capabilities.extensions ?? {};
     const featurePolicy = capabilities.featurePolicy;
     const pm = {};
     const scopeShortcuts = {};
     let counterSnapshotFn = null;
-    if (extensions.kafka) {
-        const kafkaEnabled = featurePolicy ? featurePolicy.kafka : true;
-        if (kafkaEnabled) {
-            const api = buildKafkaApi(extensions.kafka, capabilities.allowDeferredKafkaTests ?? false);
-            pm.kafka = api;
-            scopeShortcuts.kafka = api;
-        }
-        else {
-            // Disabled kafka — replace with feature-policy guarded value
-            // (handled at the test-collector level via DisabledFeatureDependencyError).
-            // We still expose the binding so user scripts don't crash at scope lookup.
-            void isInsideTestCallback;
-        }
-    }
+    let variablesApi = null;
     if (extensions.redis) {
         const api = buildRedisApi({
             capability: extensions.redis,
@@ -99,8 +93,16 @@ const buildSandboxDFeatures = (capabilities, isInsideTestCallback, envValues, gl
     // (top-level `variables` identifier) is only registered when the
     // extension was explicitly requested, to preserve the prior surface.
     {
-        const api = buildVariablesApi(envValues, globalValues);
+        const api = buildVariablesApi(envValues, globalValues, {
+            collectionVariables: collectionValues,
+            ...(live ? { live } : {}),
+            ...(capabilities.iterationData ? { iterationData: capabilities.iterationData.values } : {}),
+            ...(capabilities.localVariables ? { local: capabilities.localVariables.values } : {}),
+        });
         pm.variables = api;
+        // Postman exposes pm.iterationData in every script (empty outside a data run).
+        pm.iterationData = buildIterationDataApi(capabilities.iterationData?.values);
+        variablesApi = api;
         if (extensions.variables) {
             scopeShortcuts.variables = api;
         }
@@ -118,7 +120,7 @@ const buildSandboxDFeatures = (capabilities, isInsideTestCallback, envValues, gl
         pm.db = api;
         scopeShortcuts.db = api;
     }
-    return { pm, scopeShortcuts, counterSnapshotFn };
+    return { pm, scopeShortcuts, counterSnapshotFn, variablesApi: variablesApi };
 };
 const buildSendRequestPendingTracker = () => {
     const pending = [];
@@ -192,7 +194,16 @@ const normalizeSendBody = (body) => {
     if (isPlainRecord(body)) {
         const mode = body.mode;
         if (mode === "raw") {
-            return { data: body.raw ?? "", impliedContentType: null };
+            // Postman picks the Content-Type from the raw language (Text → text/plain);
+            // without one axios would label a string body as form-urlencoded.
+            const language = String(body.options?.raw?.language ?? "text").toLowerCase();
+            const byLanguage = {
+                json: "application/json",
+                xml: "application/xml",
+                html: "text/html",
+                javascript: "application/javascript",
+            };
+            return { data: body.raw ?? "", impliedContentType: byLanguage[language] ?? "text/plain" };
         }
         if (mode === "urlencoded" && Array.isArray(body.urlencoded)) {
             const params = new URLSearchParams();
@@ -249,7 +260,33 @@ const resolveSendTemplates = (value, resolve) => {
     }
     return value;
 };
-const createPmSendRequest = (tracker, executor, resolveTemplate) => {
+const MULTIPART_BOUNDARY_PREFIX = "----CallmanFormBoundary";
+// Multipart is built as a STRING body so every host executor (axios, the
+// desktop's engine over worker RPC) sends it the same way. Text parts only —
+// a file part has no bytes to read inside the sandbox.
+const buildMultipartBody = (entries) => {
+    const boundary = `${MULTIPART_BOUNDARY_PREFIX}${Math.random().toString(16).slice(2)}${Date.now().toString(16)}`;
+    const parts = [];
+    for (const entry of entries) {
+        if (entry.disabled === true)
+            continue;
+        const key = String(entry.key ?? "").trim();
+        if (!key)
+            continue;
+        if (entry.type === "file") {
+            throw new Error(`pm.sendRequest: file part "${key}" is not supported (the sandbox cannot read files).`);
+        }
+        parts.push(`--${boundary}\r\nContent-Disposition: form-data; name="${key.replace(/"/g, "%22")}"\r\n\r\n${String(entry.value ?? "")}\r\n`);
+    }
+    return { data: `${parts.join("")}--${boundary}--\r\n`, contentType: `multipart/form-data; boundary=${boundary}` };
+};
+const setCookieLines = (headers) => {
+    const raw = Object.entries(headers).find(([key]) => key.toLowerCase() === "set-cookie")?.[1];
+    if (raw === undefined || raw === null)
+        return [];
+    return Array.isArray(raw) ? raw.map(String) : String(raw).split(/\r?\n/);
+};
+const createPmSendRequest = (tracker, executor, resolveTemplate, context = { sdk: null, chai: null }) => {
     // Host-injected executor (desktop's real engine) takes precedence; backend
     // and CLI omit it and fall back to the built-in bare-axios client.
     const run = executor ?? executeRequest;
@@ -258,20 +295,60 @@ const createPmSendRequest = (tracker, executor, resolveTemplate) => {
     // pm.environment.set writes made earlier in this script). No resolver
     // wired → identity passthrough so behaviour is unchanged.
     const resolve = resolveTemplate ?? ((template) => template);
+    const { sdk, chai, jar } = context;
+    // Request objects (sdk.Request) and the Url/HeaderList inside them become the
+    // plain definition the rest of this function understands.
+    const toDefinition = (options) => {
+        if (typeof options === "string")
+            return { url: options, method: "GET" };
+        if (sdk && options && typeof options === "object" && sdk.Request.isRequest(options)) {
+            return options.toJSON();
+        }
+        return isPlainRecord(options) ? options : {};
+    };
+    const urlFrom = (input) => {
+        if (sdk && input && typeof input === "object" && !Array.isArray(input) && !("raw" in input) && "host" in input) {
+            return new sdk.Url(input).toString();
+        }
+        return normalizeSendUrl(input);
+    };
     return (options, callback) => {
         const promise = (async () => {
-            const rawOptions = typeof options === "string"
-                ? { url: options, method: "GET" }
-                : isPlainRecord(options)
-                    ? options
-                    : {};
+            const rawOptions = toDefinition(options);
             // Resolve templates up-front against the live scope, then normalize.
             const normalized = resolveSendTemplates(rawOptions, resolve);
-            const url = normalizeSendUrl(normalized.url);
+            const url = urlFrom(normalized.url);
             const method = String(normalized.method ?? "GET").toUpperCase();
             const headerInput = normalized.header ?? normalized.headers;
             const headers = normalizeSendHeaderInput(headerInput);
-            const { data, impliedContentType } = normalizeSendBody(normalized.body);
+            const body = normalized.body;
+            let data;
+            let impliedContentType = null;
+            if (isPlainRecord(body) && body.mode === "formdata" && Array.isArray(body.formdata)) {
+                const multipart = buildMultipartBody(body.formdata);
+                data = multipart.data;
+                impliedContentType = multipart.contentType;
+            }
+            else if (isPlainRecord(body) && body.mode === "graphql" && isPlainRecord(body.graphql)) {
+                const graphql = body.graphql;
+                let variables = graphql.variables;
+                if (typeof variables === "string" && variables.trim()) {
+                    try {
+                        variables = JSON.parse(variables);
+                    }
+                    catch {
+                        // leave the text as the user wrote it
+                    }
+                }
+                data = JSON.stringify({ query: graphql.query, ...(variables ? { variables } : {}) });
+                impliedContentType = "application/json";
+            }
+            else if (isPlainRecord(body) && body.mode === "file") {
+                throw new Error("pm.sendRequest: body mode \"file\" is not supported (the sandbox cannot read files).");
+            }
+            else {
+                ({ data, impliedContentType } = normalizeSendBody(body));
+            }
             if (impliedContentType &&
                 !Object.keys(headers).some((k) => k.toLowerCase() === "content-type")) {
                 headers["Content-Type"] = impliedContentType;
@@ -279,6 +356,14 @@ const createPmSendRequest = (tracker, executor, resolveTemplate) => {
             const timeoutMs = typeof normalized.timeout === "number" && normalized.timeout > 0
                 ? Number(normalized.timeout)
                 : undefined;
+            // Hosts that provide a persistent cookie jar get Postman's behaviour:
+            // matching cookies are sent, Set-Cookie responses are stored.
+            if (jar && !Object.keys(headers).some((key) => key.toLowerCase() === "cookie")) {
+                const stored = await jar.getAll(url);
+                if (stored.length > 0) {
+                    headers.Cookie = stored.map((cookie) => `${cookie.name}=${cookie.value}`).join("; ");
+                }
+            }
             const result = await run({
                 method,
                 url,
@@ -287,21 +372,47 @@ const createPmSendRequest = (tracker, executor, resolveTemplate) => {
                 body: data,
                 timeoutMs,
             });
-            const bodyText = typeof result.data === "string"
-                ? result.data
-                : (() => {
-                    try {
-                        return JSON.stringify(result.data ?? null);
-                    }
-                    catch {
-                        return String(result.data ?? "");
-                    }
-                })();
+            const bodyText = typeof result.rawText === "string"
+                ? result.rawText
+                : typeof result.data === "string"
+                    ? result.data
+                    : (() => {
+                        try {
+                            return JSON.stringify(result.data ?? null);
+                        }
+                        catch {
+                            return String(result.data ?? "");
+                        }
+                    })();
+            const responseHeaders = (result.headers ?? {});
+            const cookieLines = setCookieLines(responseHeaders);
+            if (jar) {
+                for (const line of cookieLines) {
+                    const cookie = parseSetCookieLine(line);
+                    if (cookie)
+                        await jar.set(url, cookie);
+                }
+            }
+            if (sdk && chai) {
+                return buildSdkResponseApi(sdk, chai, {
+                    ok: result.status >= 200 && result.status < 400,
+                    status: result.status,
+                    statusText: "",
+                    headers: responseHeaders,
+                    body: result.data,
+                    jsonBody: result.data !== null && typeof result.data === "object" ? result.data : null,
+                    rawBody: bodyText,
+                    contentType: Object.entries(responseHeaders).find(([key]) => key.toLowerCase() === "content-type")?.[1] ?? "",
+                    durationMs: result.duration ?? 0,
+                    sizeBytes: bodyText.length,
+                    cookies: cookieLines,
+                });
+            }
             return {
                 code: result.status,
                 status: result.status,
                 statusText: "",
-                headers: result.headers ?? {},
+                headers: responseHeaders,
                 body: result.data,
                 responseTime: result.duration,
                 duration: result.duration,
@@ -318,7 +429,7 @@ const createPmSendRequest = (tracker, executor, resolveTemplate) => {
         if (typeof callback === "function") {
             promise.then((response) => {
                 try {
-                    callback(null, response);
+                    callback(null, response, undefined);
                 }
                 catch (callbackError) {
                     // Surface callback throws to the host log; suppressing
@@ -328,7 +439,7 @@ const createPmSendRequest = (tracker, executor, resolveTemplate) => {
                 }
             }, (error) => {
                 try {
-                    callback(error instanceof Error ? error : new Error(String(error)), null);
+                    callback(error instanceof Error ? error : new Error(String(error)), null, undefined);
                 }
                 catch (callbackError) {
                     // eslint-disable-next-line no-console
@@ -373,8 +484,12 @@ const buildPm = (capabilities, logs, collectors, sandboxDPm) => {
         // interpolates {{var}} exactly like pm.variables.replaceIn(...).
         const variablesApi = sandboxDPm.variables;
         pm.sendRequest = createPmSendRequest(collectors.sendRequestTracker, capabilities.extensions?.sendRequest?.execute, variablesApi
-            ? (template) => variablesApi.replaceIn(template)
-            : undefined);
+            ? (template) => String(variablesApi.replaceIn(template))
+            : undefined, {
+            sdk: collectors.runtime?.sdk ?? null,
+            chai: collectors.runtime?.chai ?? null,
+            jar: capabilities.cookies?.jar,
+        });
     }
     const extensions = capabilities.extensions ?? {};
     if (extensions.log) {
@@ -388,7 +503,7 @@ const buildPm = (capabilities, logs, collectors, sandboxDPm) => {
     }
     return pm;
 };
-const buildScopeBindings = ({ pm, capabilities, consoleApi, envValues, environmentApi, request, response, expect, test, sandboxDShortcuts, timers, }) => {
+const buildScopeBindings = ({ pm, capabilities, consoleApi, envValues, environmentApi, request, response, expect, test, sandboxDShortcuts, timers, extraGlobals, }) => {
     const exposeLabels = capabilities.workflowContext &&
         capabilities.exposeLabelsAsGlobals !== false;
     const labelGlobals = exposeLabels
@@ -407,7 +522,6 @@ const buildScopeBindings = ({ pm, capabilities, consoleApi, envValues, environme
         expect,
         console: consoleApi,
         db: sandboxDShortcuts.db,
-        kafka: sandboxDShortcuts.kafka,
         redis: sandboxDShortcuts.redis,
         random: sandboxDShortcuts.random,
         counter: sandboxDShortcuts.counter,
@@ -415,14 +529,26 @@ const buildScopeBindings = ({ pm, capabilities, consoleApi, envValues, environme
         CryptoJS: sandboxDShortcuts.CryptoJS,
         lodash,
         timers,
+        extraGlobals,
         labelGlobals,
     };
 };
+const NUMERIC_STATUS_COMPARISON = /(?:\b(?:pm|cm|callman)\.response\.status\s*(?:===?|!==?|<=?|>=?)\s*\d{3}\b)|(?:\b\d{3}\s*(?:===?|!==?|<=?|>=?)\s*(?:pm|cm|callman)\.response\.status\b)|(?:expect\(\s*(?:pm|cm|callman)\.response\.status\s*\)[^;\n]*\b\d{3}\b)/;
 export const executeScript = async (input) => {
     const timeoutMs = input.timeoutMs ?? DEFAULT_TIMEOUT_MS;
     const filename = input.filename ?? DEFAULT_FILENAME;
     const stage = input.stage ?? DEFAULT_STAGE;
-    const capabilities = input.capabilities;
+    // A host may hand over several Set-Cookie headers joined into one string
+    // ("a=1; Path=/, b=2; …"); split them so each cookie is its own entry.
+    const capabilities = input.capabilities.response?.cookies?.some((line) => /,\s*[^;,=\s]+=/.test(line))
+        ? {
+            ...input.capabilities,
+            response: {
+                ...input.capabilities.response,
+                cookies: input.capabilities.response.cookies.flatMap(splitSetCookieHeader),
+            },
+        }
+        : input.capabilities;
     const extensions = capabilities.extensions ?? {};
     // Empty / whitespace-only scripts short-circuit with an empty success.
     if (!input.script.trim()) {
@@ -437,8 +563,8 @@ export const executeScript = async (input) => {
         if (extensions.counter) {
             passthrough.counterSnapshot = extensions.counter.snapshot;
         }
-        if (capabilities.allowDeferredKafkaTests) {
-            passthrough.deferredTestNames = [];
+        if (capabilities.localVariables) {
+            passthrough.localVariables = { ...capabilities.localVariables.values };
         }
         return passthrough;
     }
@@ -462,23 +588,46 @@ export const executeScript = async (input) => {
         : buildCollectionVariablesApi({}, null);
     const infoApi = buildInfoApi(capabilities.info, stage);
     const executionFeature = buildExecutionFeature(capabilities.execution);
+    // pm.request / pm.response are real `postman-collection` objects and pm.expect
+    // is chai: load them before the (synchronous) sandbox is assembled.
+    const runtime = await loadPostmanRuntime({
+        sdk: scriptNeedsSdk(input.script, Boolean(capabilities.request || capabilities.response)),
+    });
     const requestBundle = capabilities.request
-        ? buildRequestApi(capabilities.request)
+        ? runtime.sdk
+            ? buildSdkRequestApi(runtime.sdk, capabilities.request)
+            : buildRequestApi(capabilities.request)
         : undefined;
-    const responseApi = buildResponseApi(capabilities.response ?? null) ?? undefined;
-    const expect = createExpectApi();
-    const tests = buildTestCollector(stage, {
-        allowDeferredKafkaTests: capabilities.allowDeferredKafkaTests,
-        selectedTestNames: capabilities.deferredTestNames,
-    });
+    if (requestBundle && runtime.sdk) {
+        attachRequestAssertions(runtime.chai, requestBundle.api);
+    }
+    const responseApi = capabilities.response
+        ? runtime.sdk
+            ? buildSdkResponseApi(runtime.sdk, runtime.chai, capabilities.response)
+            : (buildResponseApi(capabilities.response) ?? undefined)
+        : undefined;
+    const expect = runtime.chai.expect;
+    const tests = buildTestCollector(stage);
     const logCollector = extensions.log
-        ? createLogCollector()
+        ? createLogCollector(typeof extensions.log === "object" ? { onEntry: extensions.log.onEntry } : {})
         : createSilentLogCollector();
+    // `pm.response.status` is Postman's reason phrase ("OK"); scripts written
+    // against Callman's old numeric status silently stop matching. Say so once.
+    if (extensions.log && NUMERIC_STATUS_COMPARISON.test(input.script)) {
+        logCollector.consoleApi.warn('pm.response.status is the reason phrase (e.g. "OK") like in Postman — compare pm.response.code for the numeric status.');
+    }
     // Sandbox D feature bundle — depends on env/globals being constructed first
     // (cryptojs/random/counter don't, but variables/db do).
-    const sandboxD = buildSandboxDFeatures(capabilities, () => tests.isInsideCallback(), environmentApi?.values ?? capabilities.environment?.values ?? {}, globalsApi?.values ?? capabilities.globals?.values ?? {}, capabilities.response ?? null);
+    const sandboxD = buildSandboxDFeatures(capabilities, () => tests.isInsideCallback(), environmentApi?.values ?? capabilities.environment?.values ?? {}, globalsApi?.values ?? capabilities.globals?.values ?? {}, capabilities.response ?? null, collectionVariablesApi.values, {
+        ...(environmentApi ? { environment: () => environmentApi.toObject() } : {}),
+        ...(globalsApi ? { globals: () => globalsApi.toObject() } : {}),
+        collection: () => collectionVariablesApi.toObject(),
+    });
     const sendRequestTracker = buildSendRequestPendingTracker();
-    const timerFeature = buildTimerFeature();
+    const timerFeature = buildTimerFeature((kind, error) => {
+        const detail = error instanceof Error ? (error.stack ?? error.message) : String(error);
+        logCollector.consoleApi.error(`Uncaught error in ${kind === "timeout" ? "setTimeout" : "setInterval"} callback: ${detail}`);
+    });
     const pm = buildPm(capabilities, { pmLog: logCollector.pmLog }, {
         test: tests,
         expect,
@@ -490,9 +639,88 @@ export const executeScript = async (input) => {
         request: requestBundle,
         response: responseApi ?? undefined,
         sendRequestTracker,
+        runtime,
     }, sandboxD.pm);
+    // Postman APIs Callman does not implement: fail with an explanation instead
+    // of "Cannot read properties of undefined".
+    const unsupportedApi = (name) => new Proxy(function unsupported() {
+        return undefined;
+    }, {
+        get: (_target, property) => {
+            if (property === Symbol.toPrimitive || property === "then" || property === "toJSON")
+                return undefined;
+            throw new Error(`${name} is not supported in Callman yet.`);
+        },
+        apply: () => {
+            throw new Error(`${name} is not supported in Callman yet.`);
+        },
+    });
+    for (const name of ["vault", "datasets", "mock", "state", "message"]) {
+        if (!(name in pm))
+            pm[name] = unsupportedApi(`pm.${name}`);
+    }
+    if (pm.execution && typeof pm.execution === "object" && !("runRequest" in pm.execution)) {
+        pm.execution.runRequest = async () => {
+            throw new Error("pm.execution.runRequest is not supported in Callman yet.");
+        };
+    }
+    const visualizerFeature = buildVisualizerFeature();
+    pm.visualizer = visualizerFeature.api;
+    pm.getData = visualizerFeature.getData;
+    // pm.cookies (CookieList of the request's domain) + pm.cookies.jar().
+    pm.cookies = buildPmCookies({
+        sdk: runtime.sdk,
+        lines: capabilities.cookies?.snapshot ?? capabilities.response?.cookies ?? [],
+        jar: capabilities.cookies?.jar ?? createMemoryCookieJar(),
+    });
+    // require() / pm.require() and Postman's legacy globals (postman.*, tests[],
+    // responseBody…). Modules are loaded up front: the sandbox itself is sync.
+    const optsOutOfLegacy = scriptOptsOutOfLegacy(input.script);
+    const legacyEnabled = !optsOutOfLegacy && stage !== "script";
+    const legacyLibraries = legacyEnabled
+        ? ["tv4", "cheerio"].filter((name) => new RegExp(`\\b${name}\\b`).test(input.script))
+        : [];
+    const wantsXml2Json = legacyEnabled && /\bxml2Json\b/.test(input.script);
+    const loadedModules = await preloadScriptModules([
+        input.script,
+        ...legacyLibraries.map((name) => `require("${name}")`),
+        ...(wantsXml2Json ? [`require("xml2js")`] : []),
+    ].join("\n"), {
+        sdk: runtime.sdk,
+        chai: runtime.chai,
+        cryptoJs: sandboxD.scopeShortcuts.CryptoJS,
+        timers: timerFeature.api,
+    });
+    pm.require = createSandboxRequire(loadedModules, "pm.require");
+    const extraGlobals = {
+        require: createSandboxRequire(loadedModules),
+    };
+    if (legacyEnabled) {
+        Object.assign(extraGlobals, buildLegacyGlobals({
+            pm,
+            environmentApi,
+            globalsApi,
+            response: capabilities.response ?? null,
+            testFn: tests.test,
+            iterationDataValues: capabilities.iterationData?.values ?? {},
+        }));
+        for (const name of legacyLibraries) {
+            extraGlobals[name] = loadedModules.get(name);
+        }
+        if (wantsXml2Json) {
+            const xml2js = loadedModules.get("xml2js");
+            extraGlobals.xml2Json = (xml) => {
+                let out;
+                xml2js?.parseString(String(xml ?? ""), { explicitArray: false, async: false }, (_error, result) => {
+                    out = result;
+                });
+                return out;
+            };
+        }
+    }
     const bindings = buildScopeBindings({
         pm,
+        extraGlobals,
         capabilities,
         consoleApi: logCollector.consoleApi,
         envValues: environmentApi?.values,
@@ -507,6 +735,8 @@ export const executeScript = async (input) => {
             clearTimeout: timerFeature.api.clearTimeout,
             setInterval: timerFeature.api.setInterval,
             clearInterval: timerFeature.api.clearInterval,
+            setImmediate: timerFeature.api.setImmediate,
+            clearImmediate: timerFeature.api.clearImmediate,
         },
     });
     let compiled;
@@ -529,8 +759,8 @@ export const executeScript = async (input) => {
         if (sandboxD.counterSnapshotFn) {
             result.counterSnapshot = sandboxD.counterSnapshotFn();
         }
-        if (capabilities.allowDeferredKafkaTests) {
-            result.deferredTestNames = [];
+        if (capabilities.localVariables) {
+            result.localVariables = { ...capabilities.localVariables.values };
         }
         return result;
     }
@@ -574,15 +804,19 @@ export const executeScript = async (input) => {
     if (sandboxD.counterSnapshotFn) {
         result.counterSnapshot = sandboxD.counterSnapshotFn();
     }
-    if (capabilities.allowDeferredKafkaTests) {
-        result.deferredTestNames = [...tests.deferredTestNames];
-    }
     // Only surface executionControl when the host actually wired the
     // capability — keeps the result shape unchanged for callers that
     // don't know about pm.execution yet.
     if (capabilities.execution) {
         result.executionControl = executionFeature.getControl();
     }
+    if (capabilities.localVariables) {
+        result.localVariables = sandboxD.variablesApi.localSnapshot?.() ?? {};
+    }
+    const visualization = visualizerFeature.payload();
+    if (visualization) {
+        result.visualizer = visualization;
+    }
     return result;
 };
 // Standalone parse-only check — exposed so the desktop's