callman-core 1.35.0 → 1.37.0

package/ai-packs/feature-policy.md

@@ -12,11 +12,6 @@ Capability-gated members:
 - `pm.db.pre`
 - `pm.db.post`
 
-## kafka
-
-- `pm.kafka.event()`
-- `pm.kafka.messages()`
-
 ## redis
 
 - `pm.redis.command({ connectionId, command })`
@@ -24,4 +19,4 @@ Capability-gated members:
 - `pm.redis.results.pre`
 - `pm.redis.results.post`
 
-Generation guidance: prefer declared pre/post queries and `pm.db.query` only when the user explicitly asks for database work; never assume kafka/redis capabilities exist unless the task mentions them.
+Generation guidance: prefer declared pre/post queries and `pm.db.query` only when the user explicitly asks for database work; never assume redis capabilities exist unless the task mentions them.

package/ai-packs/pm-api.md

@@ -2,179 +2,274 @@
 
 # Callman `pm.*` scripting API
 
-Scripts are plain JavaScript (top-level `await` allowed). Use ONLY the API below — anything else (fetch, require, process, Buffer, ...) is blocked by the sandbox.
+Scripts are plain JavaScript (top-level `await` allowed). `pm`, `cm` and `callman` are the SAME object: a script can use `cm.` exactly like `pm.` (cm.environment.get(...), cm.test(...), cm.expect(...)), and Postman scripts run unchanged. Use ONLY the API below — fetch, XMLHttpRequest, process, eval, import() and the filesystem are blocked by the sandbox (use `pm.sendRequest` for HTTP and `require()` for the built-in libraries).
+
+## pm
+
+The script API. `cm` and `callman` are the SAME object as `pm` — a script can use `cm.` exactly like `pm.` (cm === pm), so Postman scripts run unchanged and Callman-branded scripts behave identically.
+
+- `cm.environment.set(key, value)` — `cm.x` and `callman.x` are aliases of `pm.x` for every member below. Example: `cm.test("ok", () => cm.expect(1).to.equal(1))`
 
 ## pm.test
 
-Register a named test. The callback's assertion failures mark the test failed without aborting the script.
+Register a named test. The callback runs synchronously; a failing assertion (or a throw) marks the test failed without aborting the script. Works in pre-request, post-response and tests scripts.
 
-- `pm.test(name, fn)` — Runs fn (sync or async); pass/fail lands in the run's test results.
+- `pm.test(name, fn)` — Runs fn immediately; pass/fail lands in the run's test results. An async fn / returned Promise is awaited before the script is reported. Example: `pm.test("sum is 4", () => pm.expect(2 + 2).to.equal(4))`
+- `pm.test(name, done => { done(); })` — Callback-style async test: the test completes when done() is called (done(error) fails it). Example: `pm.test("later", done => { setTimeout(done, 10); })`
+- `pm.test.skip(name)` — Record a skipped test (shown as SKIP); the callback, if any, is never run. Example: `pm.test.skip("not ready yet")`
+- `pm.test.index()` — Number of tests recorded so far in this script. Example: `pm.test.index()`
 
 ## pm.expect
 
-Chai-style assertions plus Jest-style matchers.
+pm.expect is chai 4.4.1 with the full BDD API (expect-style), the chai-postman helpers and a few jest-style aliases. Chain words (to, be, been, is, that, which, and, has, have, with, at, of, same, but, does, still, also) read like English; flags (not, deep, nested, own, ordered, any, all, itself) change the assertion that follows. Equality is strict: .equal / .eq use ===, so NaN does not equal NaN and 1 does not equal "1"; use .eql / .deep.equal for structural comparison. Failure messages are chai's own.
 
-- `pm.expect(value)` — Assertion chain. Equality: .to.equal(x) (identity), .to.eql(x) / .to.deep.equal(x) / .toEqual(x) (deep). Existence: .to.exist, .toBeDefined(), .toBeNull(). Strings/arrays: .to.include(x) / .toContain(x), .oneOf([..]). Numbers: .toBeGreaterThan / .toBeLessThan / .to.be.above(n) / .to.be.below(n). Types: .to.be.a('string'|'number'|...). Negation: .to.not.<...> / .not.<matcher>. Properties: .to.have.property('name', value?).
-- `pm.expect.fail(message?)` — Fails the surrounding test immediately.
+- `pm.expect(value, message?)` — Start an assertion. Equality: .to.equal(x) (===), .to.eql(x) / .to.deep.equal(x) (deep), .toBe(x) / .toEqual(x) (jest-style). Existence/type: .to.exist, .to.be.null, .to.be.undefined, .to.be.true, .to.be.a('string'|'number'|'array'|'object'|...). Strings/arrays: .to.include(x) / .to.contain(x) / .toContain(x), .to.have.lengthOf(n), .to.be.empty, .to.match(/re/), .to.have.members([...]), .to.be.oneOf([...]). Numbers: .to.be.above(n) / .below(n) / .within(a, b) / .closeTo(n, delta) / .toBeGreaterThan(n) / .toBeLessThan(n). Objects: .to.have.property('a.b', value?) (dot paths work by default), .to.have.all.keys('a', 'b'), .to.have.jsonSchema(schema). Negation: .to.not.<assertion>. Example: `pm.expect(user.id).to.be.a("number")`
+- `pm.expect.fail(message?)` — Throws an AssertionError (fails the surrounding test) immediately. Example: `pm.expect.fail("unexpected branch")`
+- `pm.expect(value).to.have.jsonSchema(schema, ajvOptions?)` — Validate any value against a JSON Schema (ajv). Also available on the response as pm.response.to.have.jsonSchema(schema) in post-response scripts. Example: `pm.expect(user).to.have.jsonSchema({ type: "object", required: ["id"] })`
 
 ## pm.environment
 
-Active environment variables (alias: pm.env). Writes are scoped to the run and surface as variable mutations.
+Active environment variables (alias: pm.env). get() returns the value as it was set within the run (numbers and objects stay native); stored values are strings, objects/arrays are saved as JSON. Writes surface as variable mutations.
 
-- `pm.environment.get(key)` — Read a variable (string or undefined).
-- `pm.environment.set(key, value)` — Write a variable for subsequent steps.
+- `pm.environment.get(key)` — Read a variable (undefined when missing). Example: `pm.environment.get("baseUrl")`
+- `pm.environment.set(key, value, type?)` — Write a variable for subsequent steps. type is one of string, number, boolean, json, any. Example: `pm.environment.set("token", token)`
 - `pm.environment.unset(key)` — Remove a variable.
 - `pm.environment.has(key)` — true when the key exists.
 - `pm.environment.clear()` — Remove every variable in the scope.
 - `pm.environment.toObject()` — Plain { key: value } snapshot.
-- `pm.environment.replaceIn(template)` — Resolve {{tokens}} inside a string.
+- `pm.environment.replaceIn(template)` — Resolve {{tokens}} against THIS scope only. Unresolved {{x}} stay as written (literal); objects and arrays are walked. Example: `pm.environment.replaceIn("{{baseUrl}}/users")`
 - `pm.environment.name` — Active environment's name.
+- `pm.environment.values` — The raw string values record (read-only view).
 
 ## pm.globals
 
 Workspace-level global variables. Same surface as pm.environment.
 
 - `pm.globals.get(key)` — Read a global.
-- `pm.globals.set(key, value)` — Write a global for the run.
+- `pm.globals.set(key, value, type?)` — Write a global for the run.
 - `pm.globals.unset(key)` — Remove a global.
 - `pm.globals.has(key)` — true when the key exists.
 - `pm.globals.clear()` — Remove every global in the scope.
 - `pm.globals.toObject()` — Plain snapshot.
-- `pm.globals.replaceIn(template)` — Resolve {{tokens}} inside a string.
+- `pm.globals.replaceIn(template)` — Resolve {{tokens}} against the globals; unresolved tokens stay literal.
+- `pm.globals.name` — Scope name.
+- `pm.globals.values` — The raw string values record (read-only view).
 
 ## pm.collectionVariables
 
-Collection-scoped variables that survive across requests within one collection run (and, in the desktop app, while the app is open). `{{name}}` resolves them after the environment and before globals.
+Collection-scoped variables that survive across requests within one collection run. `{{name}}` resolves them after the environment and before globals.
 
 - `pm.collectionVariables.get(key)` — Read a collection variable.
-- `pm.collectionVariables.set(key, value)` — Write; persists across the iteration.
+- `pm.collectionVariables.set(key, value, type?)` — Write; persists across the iteration.
 - `pm.collectionVariables.unset(key)` — Remove a collection variable.
 - `pm.collectionVariables.has(key)` — true when the key exists.
 - `pm.collectionVariables.clear()` — Remove all collection variables.
 - `pm.collectionVariables.toObject()` — Plain snapshot.
-- `pm.collectionVariables.replaceIn(template)` — Resolve {{tokens}}.
+- `pm.collectionVariables.replaceIn(template)` — Resolve {{tokens}}; unresolved tokens stay literal.
+- `pm.collectionVariables.name` — Scope name.
+- `pm.collectionVariables.values` — The raw string values record (read-only view).
 
 ## pm.variables
 
-Layered read across all scopes (local > environment > collection > globals) plus template resolution. `set` writes the local scope, shared by every script of the same request (collection → folder → request).
+Layered read across all scopes — local > iteration data > environment > collection > globals. `set` writes the local scope, shared by every script of the same request (collection → folder → request) and gone afterwards.
 
-- `pm.variables.get(key)` — Read through the precedence chain.
-- `pm.variables.set(key, value)` — Write to the run-local layer.
+- `pm.variables.get(key)` — Read through the precedence chain. Example: `pm.variables.get("userId")`
+- `pm.variables.set(key, value, type?)` — Write to the run-local layer.
 - `pm.variables.unset(key)` — Remove from the run-local layer.
 - `pm.variables.has(key)` — true when any layer has the key.
+- `pm.variables.clear()` — Clear the run-local layer.
 - `pm.variables.toObject()` — Merged snapshot.
-- `pm.variables.replaceIn(template)` — Resolve {{tokens}} in a string.
-- `pm.variables.resolve(template)` — Like replaceIn, but also resolves scenario node-output references.
+- `pm.variables.replaceIn(template)` — Postman semantics: resolve {{tokens}} (and dynamic variables like {{$guid}}); an unresolved {{x}} stays as written; objects and arrays are walked. Example: `pm.variables.replaceIn("{{baseUrl}}/users/{{userId}}")`
+- `pm.variables.resolve(template)` — Callman's older resolver: like replaceIn on a string, but an unresolved {{x}} becomes an empty string. Does NOT read scenario node outputs — use pm.node(label) for those. Example: `pm.variables.resolve("{{missing}}")`
 
-## pm.request
+## pm.iterationData
+
+The data-file / dataset row of the current iteration of a data-driven run (empty outside one). Also a layer of pm.variables.
+
+- `pm.iterationData.get(key)` — Read a column of the current row. Example: `pm.iterationData.get("email")`
+- `pm.iterationData.has(key)` — true when the row has the column.
+- `pm.iterationData.toObject()` — The whole row as a plain object.
+- `pm.iterationData.toJSON()` — Same as toObject(); used by JSON.stringify.
+- `pm.iterationData.set(key, value)` — Change this run's copy of the row (not written back to the data file).
+- `pm.iterationData.unset(key)` — Remove a column from this run's copy of the row.
+- `pm.iterationData.clear()` — Remove every column from this run's copy of the row.
+- `pm.iterationData.replaceIn(template)` — Resolve {{tokens}} against the row only.
 
-The outgoing request. Mutations only have effect in pre-request scripts (the call has not fired yet).
+## pm.request
 
-- `pm.request.url` — Resolved URL string.
-- `pm.request.method` — HTTP method.
-- `pm.request.body` — Body snapshot (mode + content).
-- `pm.request.headers` — HeaderList: .all() .get(name) .has(name) .add({key,value}) .upsert({key,value}) .remove(name) .idx(i).
-- `pm.request.query` — Query params as a HeaderList.
-- `pm.request.getHeader(name)` — Read one header value.
-- `pm.request.setHeader(name, value)` — Set/replace a header. _(stages: pre-request, scenario-script)_
-- `pm.request.unsetHeader(name)` — Remove a header. _(stages: pre-request, scenario-script)_
+The request. Its url is a postman-collection Url object that ALSO behaves like a string (url.includes('/v1'), url + '?x=1'); headers is a HeaderList (case-insensitive get/has/add/upsert/remove, bracket access headers['X-Id']). Mutations only have effect in pre-request scripts (the call has not fired yet).
+
+- `pm.request.url` — Url object: .getHost() .getPath() .getPathWithQuery() .getQueryString() .getRaw() .protocol .host[] .port .path[] .hash .query (list of params) .variables .addQueryParams() .removeQueryParams() .update(); also usable as a string. Assign a string to replace it.
+- `pm.request.url.query.get(key)` — Value of a query param. Example: `pm.request.url.query.get("page")`
+- `pm.request.url.query.add(param)` — Add a query param ({ key, value }). _(stages: pre-request)_ Example: `pm.request.url.query.add({ key: "debug", value: "1" })`
+- `pm.request.method` — HTTP method string; assignable in pre-request.
+- `pm.request.body` — RequestBody: .mode ('raw'|'urlencoded'|'formdata'|'file'|'graphql') .raw .urlencoded .formdata .graphql .isEmpty() .toString() .update({ mode, raw }). Example: `pm.request.body.update({ mode: "raw", raw: JSON.stringify({ a: 1 }) })`
+- `pm.request.headers` — HeaderList: .get(name) .has(name) .add({key,value}) .upsert({key,value}) .remove(name) .each(fn) .map(fn) .filter(fn) .find(fn) .count() .toObject(); bracket access reads/writes by name. Example: `pm.request.headers.upsert({ key: "X-Trace", value: pm.variables.replaceIn("{{$guid}}") })`
+- `pm.request.query` — Callman alias of pm.request.url.query (the query params list).
+- `pm.request.getHeader(name)` — Read one header value (case-insensitive).
+- `pm.request.setHeader(name, value)` — Set/replace a header. _(stages: pre-request)_
+- `pm.request.unsetHeader(name)` — Remove a header. _(stages: pre-request)_
 - `pm.request.getQueryParam(name)` — Read one query param.
-- `pm.request.setQueryParam(name, value)` — Set/replace a query param. _(stages: pre-request, scenario-script)_
-- `pm.request.unsetQueryParam(name)` — Remove a query param. _(stages: pre-request, scenario-script)_
-- `pm.request.setUrl(url)` — Replace the URL. _(stages: pre-request, scenario-script)_
-- `pm.request.setMethod(method)` — Replace the method. _(stages: pre-request, scenario-script)_
-- `pm.request.setRawBody(value)` — Replace the raw body (string or object → JSON). _(stages: pre-request, scenario-script)_
+- `pm.request.setQueryParam(name, value)` — Set/replace a query param. _(stages: pre-request)_
+- `pm.request.unsetQueryParam(name)` — Remove a query param. _(stages: pre-request)_
+- `pm.request.setUrl(url)` — Replace the URL. _(stages: pre-request)_
+- `pm.request.setMethod(method)` — Replace the method. _(stages: pre-request)_
+- `pm.request.setRawBody(value)` — Replace the body with raw text (objects are NOT auto-stringified; pass JSON.stringify(obj)). _(stages: pre-request)_
+- `pm.request.to.have.header(name)` — chai-postman assertions work on the request too (pm.request.to.have.header, .to.have.body, ...).
 
 ## pm.response
 
-The received response. Not available in pre-request scripts.
-
-- `pm.response.code` — Status code (number). _(stages: post-response, tests, scenario-script)_
-- `pm.response.status` — Status code (number, alias). _(stages: post-response, tests, scenario-script)_
-- `pm.response.statusText` — Status text. _(stages: post-response, tests, scenario-script)_
-- `pm.response.json()` — Parsed JSON body — call once into a const (`const body = pm.response.json()`); throws on non-JSON, so guard with try/catch or pm.response.to.be.json when the content type is uncertain. _(stages: post-response, tests, scenario-script)_
-- `pm.response.text()` — Raw body as string. _(stages: post-response, tests, scenario-script)_
-- `pm.response.rawBody` — Raw body string. _(stages: post-response, tests, scenario-script)_
-- `pm.response.headers` — Response HeaderList. _(stages: post-response, tests, scenario-script)_
-- `pm.response.responseTime` — Duration in ms. _(stages: post-response, tests, scenario-script)_
-- `pm.response.responseSize` — Body size in bytes. _(stages: post-response, tests, scenario-script)_
-- `pm.response.to.have.status(code)` — Assertion shortcuts; also .to.have.header/.jsonBody/.body and .to.be.ok/.json/.success/.clientError/... plus .to.not.<predicate>. _(stages: post-response, tests, scenario-script)_
+The received response — a postman-collection Response. Not available in pre-request scripts. pm.response.code is the NUMBER (200); pm.response.status is the reason PHRASE ('OK', 'Not Found') exactly like Postman, so `pm.response.status === 200` is false.
+
+- `pm.response.code` — Status code (number). _(stages: post-response, tests)_ Example: `pm.expect(pm.response.code).to.equal(200)`
+- `pm.response.status` — Status reason phrase (string), e.g. "OK". Use pm.response.code for the number. _(stages: post-response, tests)_
+- `pm.response.reason()` — Reason phrase (method form of status). _(stages: post-response, tests)_
+- `pm.response.statusText` — Callman alias of pm.response.reason(). _(stages: post-response, tests)_
+- `pm.response.json()` — Parse the body as JSON — call it once into a const. THROWS when the body is empty or not valid JSON (guard with try/catch, or assert pm.response.to.be.json first). Optional reviver as in JSON.parse. _(stages: post-response, tests)_ Example: `const body = pm.response.json()`
+- `pm.response.text()` — Raw body as a string. _(stages: post-response, tests)_
+- `pm.response.jsonp(callbackName?)` — Parse a JSONP body; throws when it is not valid. _(stages: post-response, tests)_
+- `pm.response.rawBody` — Raw body string (Callman alias of text()). _(stages: post-response, tests)_
+- `pm.response.body` — Callman: the parsed body (JSON value, or the text). Prefer json() / text(). _(stages: post-response, tests)_
+- `pm.response.headers` — Response HeaderList (read-only): .get(name) .has(name) .each(fn) .toObject(); bracket access headers['content-type']. _(stages: post-response, tests)_ Example: `pm.response.headers.get("Content-Type")`
+- `pm.response.cookies` — CookieList of the response's Set-Cookie headers: .get(name) .has(name) .toObject() .each(fn). _(stages: post-response, tests)_
+- `pm.response.responseTime` — Duration in ms. _(stages: post-response, tests)_
+- `pm.response.responseSize` — Body size in bytes. _(stages: post-response, tests)_
+- `pm.response.size()` — { body, header, total } sizes in bytes. _(stages: post-response, tests)_
+- `pm.response.dataURI()` — The body as a data: URI. _(stages: post-response, tests)_
+- `pm.response.details()` — { code, name, detail } of the status code. _(stages: post-response, tests)_
+- `pm.response.contentInfo()` — { mimeType, mimeFormat, charset, fileExtension, contentType } of the body. _(stages: post-response, tests)_
+- `pm.response.stream` — Body bytes as a Buffer. _(stages: post-response, tests)_
+- `pm.response.to.have.status(codeOrReason)` — chai-postman assertions on the response: .to.have.status(200 | "OK"), .to.have.header(name, value?), .to.have.body(text?), .to.have.jsonBody(path?, value?), .to.have.jsonSchema(schema), .to.have.responseTime.below(ms), .to.be.ok / .success / .info / .redirection / .clientError / .serverError / .error / .json / .html / .xml / .withBody / .accepted / .badRequest / .unauthorized / .forbidden / .notFound / .rateLimited, plus .to.not.<predicate>. _(stages: post-response, tests)_ Example: `pm.response.to.have.status(200)`
 
 ## pm.sendRequest
 
-Fire an ad-hoc HTTP request from inside a script.
-
-- `pm.sendRequest(urlOrOptions, callback?)` — Options: { url, method, header: {name: value}, body }. Body accepts a plain object (auto-JSON) OR Postman style { mode: 'raw', raw: JSON.stringify({...}) } / { mode: 'urlencoded', urlencoded: [{key, value}] }. Prefer `const res = await pm.sendRequest({...})`; callback form gets (err, res). The response object is { code, status, statusText, headers, body, responseTime, json(), text() } — note it is NOT pm.response.
+Fire an ad-hoc HTTP request from inside a script. It returns a Promise that resolves to a Response with the same API as pm.response (code, status, json(), text(), headers, cookies, responseTime, ...). The callback form (err, res) also works; hosts that keep a cookie jar send and store cookies.
+
+- `pm.sendRequest(url)` — GET a URL string. Prefer `const res = await pm.sendRequest(...)`. Example: `const res = await pm.sendRequest("https://api.example.com/health")`
+- `pm.sendRequest({ url, method, header, body })` — Request options. header: object, array of { key, value } or a header string. body: a string, or { mode: 'raw', raw }, { mode: 'urlencoded', urlencoded: [{key,value}] }, { mode: 'formdata', formdata: [{key,value}] } (text parts only), { mode: 'graphql', graphql: { query, variables } }. {{variables}} in all fields are resolved. Example: `await pm.sendRequest({ url: "https://x.test/login", method: "POST", header: { "Content-Type": "application/json" }, body: { mode: "raw", raw: JSON.stringify({ user: "a" }) } })`
+- `pm.sendRequest(request, (err, res, history) => {})` — Callback form; request may also be a postman-collection Request (new (require('postman-collection').Request)({...})). Example: `pm.sendRequest("https://x.test", (err, res) => { pm.environment.set("code", res.code) })`
+
+## pm.cookies
+
+Cookies of the current request's domain (a CookieList: .get(name) .has(name) .toObject() .each(fn)), plus the cookie jar of ANY domain via pm.cookies.jar().
+
+- `pm.cookies.get(name)` — Value of a cookie of the request's domain. Example: `pm.cookies.get("session")`
+- `pm.cookies.has(name)` — true when the cookie exists.
+- `pm.cookies.toObject()` — { name: value } of the request's domain.
+- `pm.cookies.jar()` — The cookie jar. Every jar method takes a callback (error, result) OR returns a Promise. Example: `const jar = pm.cookies.jar()`
+- `pm.cookies.jar().set(url, name, value)` — Set a cookie (or pass a { name, value, domain, path, expires, httpOnly, secure } object instead of name, value). Example: `await pm.cookies.jar().set("https://x.test", "theme", "dark")`
+- `pm.cookies.jar().get(url, name)` — Value of one cookie, or null. Example: `await pm.cookies.jar().get("https://x.test", "theme")`
+- `pm.cookies.jar().getAll(url)` — All cookies matching the url (Cookie objects). Example: `await pm.cookies.jar().getAll("https://x.test")`
+- `pm.cookies.jar().unset(url, name)` — Delete one cookie.
+- `pm.cookies.jar().clear(url)` — Delete every cookie of the url's domain.
+
+## pm.visualizer
+
+Render a custom view of the response: pass a Handlebars HTML template and its data; the host shows it in the Visualize tab (the last call wins). Data must be JSON-serializable.
+
+- `pm.visualizer.set(template, data, options?)` — template: Handlebars HTML string; data: object available as {{...}} in the template; options: Handlebars compile options. _(stages: post-response, tests)_ Example: `pm.visualizer.set("<ul>{{#each items}}<li>{{name}}</li>{{/each}}</ul>", { items: pm.response.json() })`
+- `pm.visualizer.clear()` — Remove the visualization set earlier in the run. _(stages: post-response, tests)_
+- `pm.getData(callback)` — Inside a visualizer template script: receive the data passed to pm.visualizer.set as callback(error, data). _(stages: post-response, tests)_ Example: `pm.getData((error, data) => { console.log(data) })`
+
+## require
+
+require(name) and pm.require(name) load one of the built-in libraries (Postman's list). There is no filesystem or package access: `npm:`, `jsr:` and `@team/` specifiers and any other name throw "Cannot find module". The `node:` prefix is accepted.
+
+- `require(name)` — Built-in modules: lodash, moment, chai, ajv (v6), cheerio (0.22), xml2js, uuid, csv-parse/lib/sync, postman-collection, crypto-js, tv4, atob, btoa, path, assert, buffer, util, url, querystring, string_decoder, stream, events, punycode, timers. Example: `const moment = require("moment")`
+- `pm.require(name)` — Same as require(name). Example: `const _lodash = pm.require("lodash")`
+- `require('uuid').v4()` — Random UUID v4 string. Example: `const id = require("uuid").v4()`
+- `require('csv-parse/lib/sync')(input, options?)` — Parse CSV text into an array of rows. Example: `require("csv-parse/lib/sync")(csv, { columns: true })`
+- `require('xml2js').parseString(xml, callback)` — Parse XML into a JS object (also parseStringPromise). Example: `require("xml2js").parseString(xmlText, (err, result) => {})`
+- `require('cheerio').load(html)` — Parse HTML and query it with jQuery-style selectors (cheerio 0.22). Example: `const $ = require("cheerio").load(htmlText)`
+
+## console
+
+The full console API. Output appears in the run's Console and is streamed while the script runs (kept even when the script times out). Format strings %s %d %i %f %j %o %O %c are supported; objects, Errors, Maps and Sets print readably.
+
+- `console.log(...args)` — Print to the console (also console.info / warn / error / debug, which set the level). Example: `console.log("token:", pm.environment.get("token"))`
+- `console.info(...args)` — Info level.
+- `console.warn(...args)` — Warning level.
+- `console.error(...args)` — Error level.
+- `console.debug(...args)` — Debug level.
+- `console.trace(...args)` — Log with a stack trace.
+- `console.assert(condition, ...args)` — Log an error when the condition is falsy (never throws).
+- `console.count(label?)` — Count calls per label. Example: `console.count("retry")`
+- `console.countReset(label?)` — Reset a counter.
+- `console.time(label?)` — Start a timer.
+- `console.timeLog(label?, ...args)` — Log the elapsed time without stopping the timer.
+- `console.timeEnd(label?)` — Log the elapsed time and stop the timer.
+- `console.group(...label)` — Indent following output until console.groupEnd() (console.groupCollapsed is the same).
+- `console.groupCollapsed(...label)` — Like console.group().
+- `console.groupEnd()` — End the current group.
+- `console.table(data, columns?)` — Print an array of objects/arrays as a table. Example: `console.table(rows)`
+- `console.dir(value, options?)` — Print an object with Node's inspect (depth/colors options).
+- `console.dirxml(...args)` — Same as console.log().
+- `console.clear()` — Clear the console buffer of the host.
 
 ## pm.db
 
 Database access (Oracle / MongoDB / PostgreSQL / MySQL). Disabled by feature policy in some contexts — tests then report SKIP.
 
-- `pm.db.query({ connectionId, query })` — Run an ad-hoc query — ALWAYS await it. SQL connections (Oracle/Postgres/MySQL): `query` is the SQL text. MongoDB: `query` is a JSON STRING of a command object, e.g. `JSON.stringify({ collection: 'users', operation: 'findOne', filter: { email } })` — operation is find|findOne|aggregate|countDocuments|insertOne|updateOne|deleteOne|…, the match key is `filter` (NOT a `db.coll.find(...)` shell string and NOT `query`), and aggregate uses `pipeline`. Resolves to { success, error, rowCount, rows, firstRow(), connectionId, connectionName, connectionType, durationMs, executedAt }. firstRow is a FUNCTION: res.firstRow()?.STATUS (Oracle columns are UPPERCASE); for a Mongo existence check assert rowCount > 0. _(requires the database capability — may be disabled by feature policy)_
-- `pm.db.pre` — Result object of the declared pre-request DB query: { success, error, rowCount, rows, firstRow() }. Not a promise — read directly. _(requires the database capability — may be disabled by feature policy)_
-- `pm.db.post` — Result object of the declared post-response DB query (same shape as pm.db.pre). _(stages: post-response, tests)_ _(requires the database capability — may be disabled by feature policy)_
-
-## pm.kafka
-
-Captured Kafka events from the request's Kafka tab listener.
-
-- `pm.kafka.event()` — The matched event's parsed payload (or null). _(stages: post-response, tests)_ _(requires the kafka capability — may be disabled by feature policy)_
-- `pm.kafka.messages()` — Every captured message in the listen window. _(stages: post-response, tests)_ _(requires the kafka capability — may be disabled by feature policy)_
+- `pm.db.query({ connectionId, query })` — Run an ad-hoc query — ALWAYS await it. Rejects when the query fails. SQL connections (Oracle/Postgres/MySQL): `query` is the SQL text. MongoDB: `query` is a JSON STRING of a command object, e.g. `JSON.stringify({ collection: 'users', operation: 'findOne', filter: { email } })` — operation is find|findOne|aggregate|countDocuments|insertOne|updateOne|deleteOne|…, the match key is `filter` (NOT a `db.coll.find(...)` shell string and NOT `query`), and aggregate uses `pipeline`. Resolves to { success, error, rowCount, rows, firstRow(), connectionId, connectionName, connectionType, durationMs, executedAt }. firstRow is a FUNCTION: res.firstRow()?.STATUS (Oracle columns are UPPERCASE); for a Mongo existence check assert rowCount > 0. _(requires the database capability — may be disabled by feature policy)_ Example: `const res = await pm.db.query({ connectionId: "orders-db", query: "select status from orders where id = 1" })`
+- `pm.db.pre` — Result object of the declared pre-request DB query: { success, error, rowCount, rows, firstRow() }. Not a promise — read directly. _(stages: pre-request, post-response, tests)_ _(requires the database capability — may be disabled by feature policy)_
+- `pm.db.post` — Result object of the declared post-response DB query (same shape as pm.db.pre). Populated ONLY in the `tests` script; in a post-response script it is an empty result. _(stages: tests)_ _(requires the database capability — may be disabled by feature policy)_
 
 ## pm.redis
 
 Run ad-hoc Redis commands and read results of declared pre/post commands.
 
-- `pm.redis.command({ connectionId, command })` — Run an ad-hoc Redis command (GET/SET/DEL/EXISTS/TTL) — ALWAYS await it. Resolves to { success, error, result, resultText, commandName, key, connectionId, connectionName, command, resolvedCommand, durationMs, executedAt }. Omit connectionId to use the request's configured Redis connection. _(requires the redis capability — may be disabled by feature policy)_
+- `pm.redis.command({ connectionId, command })` — Run an ad-hoc Redis command (strings, hashes, lists, sets, sorted sets, counters, key expiry, SCAN) — ALWAYS await it. Resolves to { success, error, result, resultText, commandName, key, connectionId, connectionName, command, resolvedCommand, durationMs, executedAt }. Omit connectionId to use the request's configured Redis connection. _(requires the redis capability — may be disabled by feature policy)_ Example: `const res = await pm.redis.command({ command: "GET session:1" })`
 - `pm.redis.get(key)` — Read a value already captured by a declared GET. _(requires the redis capability — may be disabled by feature policy)_
 - `pm.redis.results.pre` — Array of pre-stage command results (by line index). _(requires the redis capability — may be disabled by feature policy)_
 - `pm.redis.results.post` — Array of post-stage command results. _(stages: post-response, tests)_ _(requires the redis capability — may be disabled by feature policy)_
 
 ## pm.random
 
-Deterministic-format random data generators.
+Random data generators. EVERY generator returns a string (pm.random.int() returns "42", pm.random.boolean() returns "true"/"false") — wrap with Number() when you need a number.
 
-- `pm.random.uuid()` — UUID v4.
-- `pm.random.email()` — Random email address.
-- `pm.random.string(length?)` — Alphanumeric string.
-- `pm.random.int(min, max)` — Integer in range.
-- `pm.random.bigdecimal(min, max, scale)` — Decimal with given scale.
-- `pm.random.boolean()` — true/false.
+- `pm.random.uuid()` — UUID v4 string. Example: `pm.random.uuid()`
+- `pm.random.email()` — Random email address string.
+- `pm.random.string(length?)` — Alphanumeric string (default 12, max 128).
+- `pm.random.int(min?, max?)` — Integer in range, as a STRING (default 0..999999). Example: `Number(pm.random.int(1, 100))`
+- `pm.random.bigdecimal(min?, max?, scale?)` — Decimal string with `scale` fraction digits (default 6).
+- `pm.random.boolean()` — The string "true" or "false".
 - `pm.random.phone()` — Phone number string.
-- `pm.random.name()` — Person name.
-- `pm.random.date(format?)` — Date string.
+- `pm.random.name()` — Person name string.
+- `pm.random.date(format?)` — Date string within ±1 year (default format YYYY-MM-DD; tokens YYYY MM DD HH mm ss SSS Z).
 
 ## pm.counter
 
-Monotonic counter scoped to the run.
+Counter that survives across the requests of a run.
 
-- `pm.counter.next()` — Next value (starts at 1).
-- `pm.counter.start(startAt?)` — Counter starting at a custom value.
+- `pm.counter.next()` — Next value (number, starts at 1).
+- `pm.counter.start(startAt?)` — Counter starting at a custom value (number, default 1); each call increments.
 
 ## pm.info
 
-Execution metadata snapshot.
+Execution metadata snapshot (read-only).
 
-- `pm.info.eventName` — "prerequest" | "post-response" | "test".
-- `pm.info.iteration` — 1-based data-driven iteration index (1 outside a data-driven run).
-- `pm.info.iterationCount` — Total iterations — only meaningful in collection/data-driven runs. Never use it to gate token/cache logic in single sends.
+- `pm.info.eventName` — "prerequest" in pre-request scripts, "test" in post-response / tests scripts, "scenario-script" in scenario script nodes.
+- `pm.info.iteration` — 0-BASED index of the current iteration of a data-driven run (0 outside one, like Postman).
+- `pm.info.iterationCount` — Total iterations of the run (1 outside a data-driven run). Never use it to gate token/cache logic in single sends.
 - `pm.info.requestName` — Current request's name.
 - `pm.info.requestId` — Current request's id.
 
 ## pm.execution
 
-Collection-run flow control.
+Collection-run flow control (Postman's pm.execution). Honoured by the collection runner; a single Send ignores it.
 
-- `pm.execution.setNextRequest(name)` — Jump to a named request next (collection runs).
-- `pm.execution.skipRequest()` — Skip the current request. _(stages: pre-request)_
-- `pm.execution.location` — Folder path of the current request.
+- `pm.execution.setNextRequest(nameOrId)` — Run the request with this name or id next; pass null to stop the run after the current request. Postman's postman.setNextRequest is the same. Example: `pm.execution.setNextRequest("Get order")`
+- `pm.execution.skipRequest()` — Skip the current request: it is not sent and its post-response/tests scripts do not run (counted as skipped). _(stages: pre-request)_
+- `pm.execution.location` — Folder path of the current request as an array of names; pm.execution.location.current is the request's own name. Example: `pm.execution.location.current`
+- `pm.execution.runRequest(requestIdOrName)` — Not supported in Callman yet — always throws a clear error.
 
 ## pm.node
 
-Scenario workflow context (only meaningful inside scenario script nodes).
+Scenario workflow context (scenario script and request nodes only). pm.node is a FUNCTION — pm.node(label) — not an object. The same data is also available as a global named after the node label when the label is a valid identifier (Login.token).
 
-- `pm.node.nodeLabel` — Current node's label. _(stages: scenario-script)_
-- `pm.node.setNextRequest(name)` — Route the workflow to a named node. _(stages: scenario-script)_
+- `pm.node(label)` — Output of a previous node by label (null when it has not run). The value carries __meta { status, success, failed, skipped, attempts, startedAt, endedAt, durationMs, error }. _(stages: scenario-script)_ Example: `const token = pm.node("Login").token`
+- `workflow.__meta` — Run-level metadata: status, totalNodes, successfulNodes, failedNodes, skippedNodes, totalRetries, durationMs, currentNode, lastNode, failedNode. _(stages: scenario-script)_
+- `env.NAME` — The active environment's variables as a plain object (also available in request scripts). Example: `env.BASE_URL`
 
 ## pm.log
 
@@ -184,33 +279,68 @@ Structured logging into the run report.
 
 ## CryptoJS
 
-crypto-js global (NOT under pm.*).
+crypto-js global (NOT under pm.*; also require('crypto-js')). Results are WordArrays: call .toString() for hex or .toString(CryptoJS.enc.Base64).
 
-- `CryptoJS.SHA256(msg) / SHA1 / SHA512 / MD5` — Hashes; .toString() or .toString(CryptoJS.enc.Hex).
-- `CryptoJS.HmacSHA256(msg, key)` — HMAC family (SHA1/224/384/512, MD5 variants).
-- `CryptoJS.AES.encrypt(msg, key) / .decrypt(cipher, key)` — AES; decrypt result needs .toString(CryptoJS.enc.Utf8).
-- `CryptoJS.PBKDF2(password, salt, options)` — Key derivation.
-- `CryptoJS.enc.Utf8 / Base64 / Hex / Latin1` — Encoders for .toString(...).
-- `CryptoJS.lib.WordArray.create / random(n)` — Raw word arrays (e.g. random IVs).
+- `CryptoJS.SHA256(message)` — Hash (also SHA1, SHA224, SHA384, SHA512, SHA3, MD5, RIPEMD160); .toString() is hex. Example: `CryptoJS.SHA256(body).toString()`
+- `CryptoJS.HmacSHA256(message, key)` — HMAC (also HmacSHA1/224/384/512, HmacMD5). Example: `CryptoJS.HmacSHA256(msg, secret).toString(CryptoJS.enc.Hex)`
+- `CryptoJS.AES.encrypt(message, key)` — AES encryption; CryptoJS.AES.decrypt(cipher, key) returns a WordArray — call .toString(CryptoJS.enc.Utf8). Example: `CryptoJS.AES.encrypt(text, key).toString()`
+- `CryptoJS.PBKDF2(password, salt, options)` — Key derivation ({ keySize, iterations }).
+- `CryptoJS.enc.Base64` — Encoders for .toString(...) / .parse(...): Utf8, Base64, Base64url, Hex, Latin1, Utf16. Example: `CryptoJS.enc.Base64.stringify(CryptoJS.enc.Utf8.parse(text))`
+- `CryptoJS.lib.WordArray.random(nBytes)` — Raw random word array (e.g. IVs); WordArray.create(words, sigBytes) builds one.
 
 ## _
 
-lodash global (NOT under pm.*).
+lodash global (NOT under pm.*; also require('lodash')).
 
-- `_.get(obj, path, default?) / _.pick / _.groupBy / _.sortBy / _.uniq / ...` — Full lodash surface for data wrangling.
+- `_.get(object, path, defaultValue?)` — Safe nested read; the full lodash surface (pick, omit, groupBy, sortBy, uniq, merge, cloneDeep, isEqual, chunk, ...) is available. Example: `_.get(payload, "data.items[0].id")`
+- `_.groupBy(collection, iteratee)` — Group items by a key or function. Example: `_.groupBy(items, "status")`
 
 ## timers
 
-Safe per-execution timer wrappers (callbacks never outlive the run).
+Safe per-run timer wrappers (callbacks never outlive the run; delays are capped at 60 s). They return numeric ids.
+
+- `setTimeout(handler, delayMs)` — Run later; use with await new Promise(r => setTimeout(r, ms)) for polling loops. clearTimeout(id) cancels. Example: `await new Promise(r => setTimeout(r, 500))`
+- `clearTimeout(id)` — Cancel a setTimeout.
+- `setInterval(handler, delayMs)` — Repeat; clearInterval(id) cancels.
+- `clearInterval(id)` — Cancel a setInterval.
+- `setImmediate(handler)` — Run on the next turn (clearImmediate(id) cancels).
+
+## globals
+
+Other globals available in every script (no import): Buffer, Intl, Reflect, Proxy, WeakRef, URL, URLSearchParams, TextEncoder/TextDecoder, atob/btoa, structuredClone, queueMicrotask, AbortController, Blob, crypto (Web Crypto), encodeURI/decodeURI, escape/unescape and the usual JSON/Math/Date/Promise/Map/Set/typed arrays. fetch, XMLHttpRequest, WebSocket, process, window, eval and Function are blocked — use pm.sendRequest for HTTP.
+
+- `Buffer.from(data, encoding?)` — Node Buffer (utf8, hex, base64, base64url, latin1, ...). Example: `Buffer.from("hello").toString("base64")`
+- `crypto.randomUUID()` — Web Crypto: also crypto.getRandomValues(typedArray) and crypto.subtle.digest/sign/verify/encrypt/decrypt. Example: `crypto.randomUUID()`
+- `structuredClone(value)` — Deep clone (Date, Map, Set, RegExp, ...).
+- `atob(base64)` — Decode base64 to a binary string (btoa(text) encodes).
+
+## postman
+
+Postman's LEGACY scripting API, kept so old exported collections run unchanged. Enabled in request scripts unless the script starts with "use sandbox2"; prefer pm.* in new scripts.
+
+- `postman.setEnvironmentVariable(key, value)` — Same as pm.environment.set (also getEnvironmentVariable, clearEnvironmentVariable, clearEnvironmentVariables). Example: `postman.setEnvironmentVariable("token", "abc")`
+- `postman.setGlobalVariable(key, value)` — Same as pm.globals.set (also getGlobalVariable, clearGlobalVariable, clearGlobalVariables).
+- `postman.setNextRequest(name)` — Same as pm.execution.setNextRequest.
+- `postman.getResponseHeader(name)` — Header value of the response. _(stages: post-response, tests)_
+- `postman.getResponseCookie(name)` — Cookie of the response. _(stages: post-response, tests)_
+- `tests['name'] = boolean` — Legacy test: records a test named `name` that passes when the value is truthy. Example: `tests["status is 200"] = responseCode.code === 200`
+- `responseBody` — Legacy: raw response body text. _(stages: post-response, tests)_
+- `responseCode.code` — Legacy: { code, name, detail } of the status. _(stages: post-response, tests)_
+- `responseTime` — Legacy: response time in ms. _(stages: post-response, tests)_
+- `responseHeaders` — Legacy: response headers as a plain object. _(stages: post-response, tests)_
+- `responseCookies` — Legacy: response cookies as { name: value }. _(stages: post-response, tests)_
+- `environment['name']` — Legacy: `environment` and `globals` also read variables by bracket (environment['token']); environment.get('token') keeps working. `data` is the iteration row, `iteration` the 0-based index; tv4, cheerio and xml2Json(xml) are globals.
+
+## unsupported
+
+Postman APIs Callman does not implement. Accessing them throws a clear "is not supported in Callman yet" error (never `undefined`), so a copied script fails loudly instead of misbehaving: pm.vault, pm.datasets, pm.mock, pm.state, pm.message, pm.execution.runRequest, and pm.require('npm:...' / 'jsr:...' / '@team/...') package specifiers. Postman Flows, Postbot, gRPC/WebSocket/MQTT hooks are out of scope.
 
-- `setTimeout(fn, ms) / clearTimeout(id)` — Use with await new Promise(r => setTimeout(r, ms)) for polling loops.
-- `setInterval(fn, ms) / clearInterval(id)` — Interval variant.
 
 ## Stage rules
 
 - `pre-request`: runs BEFORE the HTTP call. `pm.response` does not exist; `pm.request` mutations take effect.
 - `post-response` / `tests`: run AFTER the call. `pm.response` is available; `pm.request` mutations have no effect.
-- `scenario-script`: a scenario Script node. Prior node outputs are readable via `pm.variables.resolve("{{NodeLabel.path}}")`; the script's return value becomes the node output.
+- `scenario-script`: a scenario Script node. There is no `pm.request` / `pm.response`. Prior node outputs are readable via `pm.node("NodeLabel")` or the label as a global (`NodeLabel.path`); `env` is the environment as a plain object; the script's return value becomes the node output.
 - Members without a stage note are available in every stage.
 
 ## Collection and folder scripts
@@ -220,4 +350,14 @@ Safe per-execution timer wrappers (callbacks never outlive the run).
 - Every script of one request shares the same `pm.variables` (local) scope; environment, globals and collection-variable writes are visible to the next script in the chain.
 - A failing pre-request script stops the chain and the request is not sent. Post-response / tests scripts of every level still run and report.
 - `pm.info.requestName` / `pm.info.requestId` tell a collection script which request it is running for (e.g. skip a token fetch for the Login request).
-- `pm.kafka` is only available to the request's own scripts.
+
+## Postman compatibility notes
+
+- `pm.response.code` is the number (200); `pm.response.status` is the reason phrase ("OK") — `pm.response.status === 200` is false.
+- `pm.response.json()` throws when the body is empty or not valid JSON.
+- `pm.test` runs its callback synchronously; `pm.test(name, done => ...)`, `pm.test.skip(name)` and `pm.test.index()` exist.
+- `pm.info.iteration` is 0-based; `pm.info.eventName` is "prerequest" or "test".
+- `replaceIn` keeps an unresolved `{{x}}` as written; environment / globals values keep the type they were set with inside the run and are stored as strings (objects as JSON).
+- `pm.random.*` generators return strings (including `int()` and `boolean()`).
+- Postman's legacy API (`postman.*`, `tests["name"] = bool`, `responseBody`, `responseCode`, ...) works unless the script starts with "use sandbox2".
+- Unsupported Postman APIs (`pm.vault`, `pm.datasets`, `pm.mock`, `pm.state`, `pm.message`, `pm.execution.runRequest`, `npm:` / `jsr:` packages) throw a clear "not supported in Callman yet" error.

package/ai-packs/sandbox-globals.md

@@ -6,15 +6,16 @@ The sandbox is a Node `vm` context. Generated code must never reference a blocke
 
 ## Available built-ins
 
-`AggregateError`, `Array`, `ArrayBuffer`, `BigInt`, `BigInt64Array`, `BigUint64Array`, `Boolean`, `DataView`, `Date`, `Error`, `EvalError`, `Float32Array`, `Float64Array`, `Infinity`, `Int16Array`, `Int32Array`, `Int8Array`, `JSON`, `Map`, `Math`, `NaN`, `Number`, `Object`, `Promise`, `RangeError`, `ReferenceError`, `RegExp`, `Set`, `String`, `Symbol`, `SyntaxError`, `TextDecoder`, `TextEncoder`, `TypeError`, `URIError`, `URL`, `URLSearchParams`, `Uint16Array`, `Uint32Array`, `Uint8Array`, `Uint8ClampedArray`, `WeakMap`, `WeakSet`, `atob`, `btoa`, `decodeURIComponent`, `encodeURIComponent`, `isFinite`, `isNaN`, `parseFloat`, `parseInt`, `structuredClone`, `undefined`
+`AbortController`, `AbortSignal`, `AggregateError`, `Array`, `ArrayBuffer`, `BigInt`, `BigInt64Array`, `BigUint64Array`, `Blob`, `Boolean`, `Buffer`, `DOMException`, `DataView`, `Date`, `Error`, `EvalError`, `Event`, `EventTarget`, `File`, `FinalizationRegistry`, `Float32Array`, `Float64Array`, `Infinity`, `Int16Array`, `Int32Array`, `Int8Array`, `Intl`, `JSON`, `Map`, `Math`, `NaN`, `Number`, `Object`, `Promise`, `Proxy`, `RangeError`, `ReadableStream`, `ReferenceError`, `Reflect`, `RegExp`, `Set`, `String`, `Symbol`, `SyntaxError`, `TextDecoder`, `TextDecoderStream`, `TextEncoder`, `TextEncoderStream`, `TransformStream`, `TypeError`, `URIError`, `URL`, `URLSearchParams`, `Uint16Array`, `Uint32Array`, `Uint8Array`, `Uint8ClampedArray`, `WeakMap`, `WeakRef`, `WeakSet`, `WritableStream`, `atob`, `btoa`, `crypto`, `decodeURI`, `decodeURIComponent`, `encodeURI`, `encodeURIComponent`, `escape`, `isFinite`, `isNaN`, `parseFloat`, `parseInt`, `queueMicrotask`, `structuredClone`, `undefined`, `unescape`
 
-Plus the injected helpers: `pm`, `console`, `CryptoJS`, `_` (lodash), `setTimeout`/`clearTimeout`/`setInterval`/`clearInterval` (safe per-run wrappers).
+Plus the injected helpers: `pm` (also `cm` and `callman` — the same object), `console` (the full console API), `require` / `pm.require`, `CryptoJS`, `_` (lodash), `setTimeout`/`clearTimeout`/`setInterval`/`clearInterval`/`setImmediate`/`clearImmediate` (safe per-run wrappers) and, in request scripts, Postman's legacy globals (`postman`, `tests`, `responseBody`, `responseCode`, `responseTime`, `responseHeaders`, `responseCookies`, `environment`, `globals`, `data`, `iteration`, `tv4`, `cheerio`, `xml2Json`).
 
 ## Blocked (never use)
 
-`Buffer`, `Function`, `WebSocket`, `Worker`, `XMLHttpRequest`, `document`, `eval`, `exports`, `fetch`, `global`, `globalThis`, `importScripts`, `module`, `navigator`, `process`, `require`, `self`, `window`
+`Function`, `WebSocket`, `Worker`, `XMLHttpRequest`, `document`, `eval`, `exports`, `fetch`, `global`, `globalThis`, `importScripts`, `module`, `navigator`, `process`, `self`, `window`
 
 Notes:
 - No `fetch` — use `pm.sendRequest` for HTTP.
-- No `Buffer` — use `atob`/`btoa`/`TextEncoder`/`Uint8Array`.
-- No `require`/`import` — `CryptoJS` and `_` are already in scope.
+- `Buffer`, `crypto` (Web Crypto), `atob`/`btoa`, `TextEncoder`/`TextDecoder`, `URL`, `structuredClone`, `AbortController` and `Blob` are available.
+- `require(name)` / `pm.require(name)` serve only these built-in libraries: `lodash`, `moment`, `chai`, `ajv`, `cheerio`, `xml2js`, `tv4`, `uuid`, `csv-parse/lib/sync`, `postman-collection`, `crypto-js`, `atob`, `btoa`, `path`, `assert`, `buffer`, `util`, `url`, `querystring`, `string_decoder`, `stream`, `events`, `punycode`, `timers`. `import`, `npm:`/`jsr:` packages and the filesystem are not available. `CryptoJS` and `_` are already in scope.
+- `pm.vault`, `pm.datasets`, `pm.mock`, `pm.state`, `pm.message` and `pm.execution.runRequest` throw a clear "not supported in Callman yet" error.

package/dist/ai/prompts/fragments.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fragments.d.ts","sourceRoot":"","sources":["../../../src/ai/prompts/fragments.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAKjD,eAAO,MAAM,mBAAmB,QAQpB,CAAC;AAIb,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAS5D,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,OAAO,MAAM,EAAE,YAAQ,KAAG,MACJ,CAAC"}
+{"version":3,"file":"fragments.d.ts","sourceRoot":"","sources":["../../../src/ai/prompts/fragments.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAKjD,eAAO,MAAM,mBAAmB,QAQpB,CAAC;AAIb,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAO5D,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,OAAO,MAAM,EAAE,YAAQ,KAAG,MACJ,CAAC"}

package/dist/ai/prompts/fragments.js

@@ -21,7 +21,6 @@ export const STAGE_DESCRIPTIONS = {
     "pre-request": "Runs BEFORE the HTTP call. `pm.response` does NOT exist. `pm.request` mutations (setHeader/setQueryParam/setRawBody/setUrl) take effect. Use for setup: auth tokens, computed headers/body, seeding env/DB/Redis.",
     "post-response": "Runs immediately AFTER the response. `pm.response` is available; `pm.request` mutations have no effect. Use to capture values from the response into variables.",
     tests: "Runs after the response and any declared DB/Redis steps. `pm.response`, `pm.db.post`, `pm.redis.results.post` are available. Put assertions inside `pm.test(...)`.",
-    kafka: "Runs when a Kafka event is matched (post-response/tests context). `pm.response` and `pm.kafka.event()` / `pm.kafka.messages()` are available. Put assertions inside `pm.test(...)`.",
 };
 export const truncateForPrompt = (value, max = 80) => value.length > max ? `${value.slice(0, max)}…` : value;
 //# sourceMappingURL=fragments.js.map

package/dist/ai/prompts/fragments.js.map

@@ -1 +1 @@
-{"version":3,"file":"fragments.js","sourceRoot":"","sources":["../../../src/ai/prompts/fragments.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,yBAAyB;AAEzB,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAGtE,+EAA+E;AAC/E,+EAA+E;AAC/E,wDAAwD;AACxD,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,qEAAqE;IACrE,qHAAqH;IACrH,yFAAyF;IACzF,oJAAoJ;IACpJ,wGAAwG;IACxG,sGAAsG;IACtG,oBAAoB,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;CAC3D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,8EAA8E;AAC9E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,kBAAkB,GAAkC;IAC/D,aAAa,EACX,mNAAmN;IACrN,eAAe,EACb,iKAAiK;IACnK,KAAK,EACH,oKAAoK;IACtK,KAAK,EACH,qLAAqL;CACxL,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAAa,EAAE,GAAG,GAAG,EAAE,EAAU,EAAE,CACnE,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC"}
+{"version":3,"file":"fragments.js","sourceRoot":"","sources":["../../../src/ai/prompts/fragments.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,yBAAyB;AAEzB,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAGtE,+EAA+E;AAC/E,+EAA+E;AAC/E,wDAAwD;AACxD,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,qEAAqE;IACrE,qHAAqH;IACrH,yFAAyF;IACzF,oJAAoJ;IACpJ,wGAAwG;IACxG,sGAAsG;IACtG,oBAAoB,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;CAC3D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,8EAA8E;AAC9E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,kBAAkB,GAAkC;IAC/D,aAAa,EACX,mNAAmN;IACrN,eAAe,EACb,iKAAiK;IACnK,KAAK,EACH,oKAAoK;CACvK,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAAa,EAAE,GAAG,GAAG,EAAE,EAAU,EAAE,CACnE,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC"}

package/dist/ai/prompts/unified.js

@@ -22,7 +22,7 @@ export const buildUnifiedSystemPrompt = () => {
         "what is needed — the user does NOT pick a mode or a target. Respond with ONE JSON",
         "object ONLY (no markdown, no prose outside JSON), shaped:",
         "",
-        '{"reply": string, "contract": {"add": [{"path": string, "rules": {…}}], "remove": [string]} | null, "scripts": [{"stage": "pre-request|post-response|tests|kafka", "code": string}]}',
+        '{"reply": string, "contract": {"add": [{"path": string, "rules": {…}}], "remove": [string]} | null, "scripts": [{"stage": "pre-request|post-response|tests", "code": string}]}',
         "",
         "How to decide (classify intent yourself):",
         "- Assertions about the LAST RESPONSE's shape (a field's type/format/required/value/",

package/dist/ai/prompts/unified.js.map

@@ -1 +1 @@
-{"version":3,"file":"unified.js","sourceRoot":"","sources":["../../../src/ai/prompts/unified.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,8EAA8E;AAC9E,2EAA2E;AAC3E,uDAAuD;AACvD,EAAE;AACF,yEAAyE;AACzE,+EAA+E;AAC/E,oBAAoB;AAEpB,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAQxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAE5F,+EAA+E;AAC/E,0EAA0E;AAC1E,+EAA+E;AAC/E,sBAAsB;AACtB,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAW,EAAE;IACnD,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CACrC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,OAAO,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAC1D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,OAAO;QACL,iFAAiF;QACjF,iFAAiF;QACjF,mFAAmF;QACnF,2DAA2D;QAC3D,EAAE;QACF,sLAAsL;QACtL,EAAE;QACF,2CAA2C;QAC3C,qFAAqF;QACrF,sFAAsF;QACtF,sFAAsF;QACtF,uFAAuF;QACvF,2DAA2D;QAC3D,wFAAwF;QACxF,wFAAwF;QACxF,gEAAgE;QAChE,0FAA0F;QAC1F,EAAE;QACF,sDAAsD;QACtD,UAAU;QACV,EAAE;QACF,iBAAiB;QACjB,sFAAsF;QACtF,yFAAyF;QACzF,uDAAuD;QACvD,uFAAuF;QACvF,sFAAsF;QACtF,4DAA4D;QAC5D,mBAAmB;QACnB,EAAE;QACF,wFAAwF;QACxF,yFAAyF;QACzF,yFAAyF;QACzF,yFAAyF;QACzF,oDAAoD;QACpD,EAAE;QACF,wFAAwF;QACxF,0FAA0F;QAC1F,yFAAyF;QACzF,wFAAwF;QACxF,yFAAyF;QACzF,kDAAkD;QAClD,6FAA6F;QAC7F,EAAE;QACF,0BAA0B;QAC1B,kFAAkF;QAClF,2FAA2F;QAC3F,kFAAkF;QAClF,2EAA2E;QAC3E,wCAAwC;QACxC,EAAE;QACF,yBAAyB;QACzB,oBAAoB,EAAE;QACtB,EAAE;QACF,gDAAgD;QAChD,sBAAsB,EAAE;KACzB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,EACrC,WAAW,EACX,MAAM,GAAG,EAAE,EACX,aAAa,GAAG,EAAE,EAClB,cAAc,GAAG,EAAE,EACnB,WAAW,GAAG,EAAE,EAChB,WAAW,EACX,UAAU,EACV,WAAW,GAUZ,EAAU,EAAE;IACX,MAAM,WAAW,GACf,WAAW,IAAI,CAAC,WAAW,CAAC,MAAM,IAAI,WAAW,CAAC,GAAG,CAAC;QACpD,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QAC/E,CAAC,CAAC,IAAI,CAAC;IAEX,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM;QAC/B,CAAC,CAAC,MAAM;aACH,GAAG,CACF,CAAC,KAAK,EAAE,EAAE,CACR,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAClG;aACA,IAAI,CAAC,IAAI,CAAC;QACf,CAAC,CAAC,wBAAwB,CAAC;IAE7B,MAAM,IAAI,GAAG;QACX,UAAU,CAAC,CAAC,CAAC,gBAAgB,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI;QAChD,WAAW,CAAC,CAAC,CAAC,iBAAiB,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;KACpD;SACE,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,MAAM,aAAa,GAAG,aAAa,CAAC,MAAM;QACxC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACvF,CAAC,CAAC,YAAY,CAAC;IAEjB,MAAM,aAAa,GACjB,cAAc;SACX,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;SACjD,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,MAAM,CAAC,KAAK,mBAAmB,MAAM,CAAC,IAAI,EAAE,CAAC;SACpE,IAAI,CAAC,MAAM,CAAC,IAAI,yBAAyB,CAAC;IAE/C,MAAM,eAAe,GAAG,WAAW,CAAC,MAAM;QACxC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,QAAQ,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC1E,CAAC,CAAC,QAAQ,CAAC;IAEb,OAAO;QACL,WAAW;QACX,kBAAkB;QAClB,WAAW;QACX,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;QACvB,EAAE;QACF,4CAA4C;QAC5C,aAAa;QACb,EAAE;QACF,yDAAyD;QACzD,eAAe;QACf,EAAE;QACF,kBAAkB;QAClB,aAAa;QACb,EAAE;QACF,gBAAgB,WAAW,EAAE;KAC9B;SACE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC;SAC/B,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC,CAAC"}
+{"version":3,"file":"unified.js","sourceRoot":"","sources":["../../../src/ai/prompts/unified.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,8EAA8E;AAC9E,2EAA2E;AAC3E,uDAAuD;AACvD,EAAE;AACF,yEAAyE;AACzE,+EAA+E;AAC/E,oBAAoB;AAEpB,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAQxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAE5F,+EAA+E;AAC/E,0EAA0E;AAC1E,+EAA+E;AAC/E,sBAAsB;AACtB,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAW,EAAE;IACnD,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CACrC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,OAAO,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAC1D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,OAAO;QACL,iFAAiF;QACjF,iFAAiF;QACjF,mFAAmF;QACnF,2DAA2D;QAC3D,EAAE;QACF,gLAAgL;QAChL,EAAE;QACF,2CAA2C;QAC3C,qFAAqF;QACrF,sFAAsF;QACtF,sFAAsF;QACtF,uFAAuF;QACvF,2DAA2D;QAC3D,wFAAwF;QACxF,wFAAwF;QACxF,gEAAgE;QAChE,0FAA0F;QAC1F,EAAE;QACF,sDAAsD;QACtD,UAAU;QACV,EAAE;QACF,iBAAiB;QACjB,sFAAsF;QACtF,yFAAyF;QACzF,uDAAuD;QACvD,uFAAuF;QACvF,sFAAsF;QACtF,4DAA4D;QAC5D,mBAAmB;QACnB,EAAE;QACF,wFAAwF;QACxF,yFAAyF;QACzF,yFAAyF;QACzF,yFAAyF;QACzF,oDAAoD;QACpD,EAAE;QACF,wFAAwF;QACxF,0FAA0F;QAC1F,yFAAyF;QACzF,wFAAwF;QACxF,yFAAyF;QACzF,kDAAkD;QAClD,6FAA6F;QAC7F,EAAE;QACF,0BAA0B;QAC1B,kFAAkF;QAClF,2FAA2F;QAC3F,kFAAkF;QAClF,2EAA2E;QAC3E,wCAAwC;QACxC,EAAE;QACF,yBAAyB;QACzB,oBAAoB,EAAE;QACtB,EAAE;QACF,gDAAgD;QAChD,sBAAsB,EAAE;KACzB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,EACrC,WAAW,EACX,MAAM,GAAG,EAAE,EACX,aAAa,GAAG,EAAE,EAClB,cAAc,GAAG,EAAE,EACnB,WAAW,GAAG,EAAE,EAChB,WAAW,EACX,UAAU,EACV,WAAW,GAUZ,EAAU,EAAE;IACX,MAAM,WAAW,GACf,WAAW,IAAI,CAAC,WAAW,CAAC,MAAM,IAAI,WAAW,CAAC,GAAG,CAAC;QACpD,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QAC/E,CAAC,CAAC,IAAI,CAAC;IAEX,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM;QAC/B,CAAC,CAAC,MAAM;aACH,GAAG,CACF,CAAC,KAAK,EAAE,EAAE,CACR,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAClG;aACA,IAAI,CAAC,IAAI,CAAC;QACf,CAAC,CAAC,wBAAwB,CAAC;IAE7B,MAAM,IAAI,GAAG;QACX,UAAU,CAAC,CAAC,CAAC,gBAAgB,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI;QAChD,WAAW,CAAC,CAAC,CAAC,iBAAiB,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;KACpD;SACE,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,MAAM,aAAa,GAAG,aAAa,CAAC,MAAM;QACxC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACvF,CAAC,CAAC,YAAY,CAAC;IAEjB,MAAM,aAAa,GACjB,cAAc;SACX,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;SACjD,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,MAAM,CAAC,KAAK,mBAAmB,MAAM,CAAC,IAAI,EAAE,CAAC;SACpE,IAAI,CAAC,MAAM,CAAC,IAAI,yBAAyB,CAAC;IAE/C,MAAM,eAAe,GAAG,WAAW,CAAC,MAAM;QACxC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,QAAQ,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC1E,CAAC,CAAC,QAAQ,CAAC;IAEb,OAAO;QACL,WAAW;QACX,kBAAkB;QAClB,WAAW;QACX,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;QACvB,EAAE;QACF,4CAA4C;QAC5C,aAAa;QACb,EAAE;QACF,yDAAyD;QACzD,eAAe;QACf,EAAE;QACF,kBAAkB;QAClB,aAAa;QACb,EAAE;QACF,gBAAgB,WAAW,EAAE;KAC9B;SACE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC;SAC/B,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC,CAAC"}

package/dist/ai/types.d.ts

@@ -1,4 +1,4 @@
-export declare const AI_SCRIPT_STAGES: readonly ["pre-request", "post-response", "tests", "kafka"];
+export declare const AI_SCRIPT_STAGES: readonly ["pre-request", "post-response", "tests"];
 export type AiScriptStage = (typeof AI_SCRIPT_STAGES)[number];
 export interface AiSchemaField {
     path: string;