callman-core 1.6.0 → 1.7.0

package/dist/script/features/cryptojs.js

@@ -9,6 +9,7 @@
 //   CryptoJS.enc.Utf8.parse(string) → Uint8Array
 //   CryptoJS.enc.Utf8.stringify(Uint8Array | ArrayBufferLike) → string
 //   CryptoJS.enc.Base64.stringify(Uint8Array | ArrayBufferLike) → string
+//   CryptoJS.enc.Base64.parse(base64String) → Uint8Array  (decoder)
 //
 // HMAC / SHA / AES are intentionally out of scope.
 const BASE64_CHARS = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
@@ -46,6 +47,38 @@ const encodeBase64 = (bytes) => {
     }
     return output;
 };
+// Inverse of encodeBase64. Accepts both standard base64 (`+`/`/`, padded)
+// and base64url (`-`/`_`, unpadded) input — useful because callers
+// frequently pass JWT payload segments which use the url-safe alphabet
+// without padding. Throws on characters outside both alphabets so the
+// caller fails fast on garbage input rather than silently producing junk
+// bytes.
+const decodeBase64 = (input) => {
+    // Normalize url-safe → standard and re-pad to a multiple of 4.
+    const normalized = input.replace(/-/g, "+").replace(/_/g, "/");
+    const padding = (4 - (normalized.length % 4)) % 4;
+    const padded = normalized + "=".repeat(padding);
+    // Reject anything outside the standard alphabet (post-normalization).
+    if (!/^[A-Za-z0-9+/]*={0,2}$/.test(padded)) {
+        throw new Error("CryptoJS.enc.Base64.parse: invalid base64 input");
+    }
+    const cleanLength = padded.replace(/=+$/g, "").length;
+    const byteLength = Math.floor((cleanLength * 3) / 4);
+    const out = new Uint8Array(byteLength);
+    let outIndex = 0;
+    for (let i = 0; i < padded.length; i += 4) {
+        const c1 = BASE64_CHARS.indexOf(padded[i]);
+        const c2 = BASE64_CHARS.indexOf(padded[i + 1]);
+        const c3 = padded[i + 2] === "=" ? -1 : BASE64_CHARS.indexOf(padded[i + 2]);
+        const c4 = padded[i + 3] === "=" ? -1 : BASE64_CHARS.indexOf(padded[i + 3]);
+        out[outIndex++] = (c1 << 2) | (c2 >> 4);
+        if (c3 >= 0)
+            out[outIndex++] = ((c2 & 0x0f) << 4) | (c3 >> 2);
+        if (c4 >= 0)
+            out[outIndex++] = ((c3 & 0x03) << 6) | c4;
+    }
+    return out;
+};
 export const createCryptoJsApi = () => {
     const decoder = new TextDecoder();
     return {
@@ -56,6 +89,12 @@ export const createCryptoJsApi = () => {
             },
             Base64: {
                 stringify: (input) => encodeBase64(toUint8Array(input)),
+                parse: (input) => {
+                    if (typeof input !== "string") {
+                        throw new Error("CryptoJS.enc.Base64.parse: expected a string");
+                    }
+                    return decodeBase64(input);
+                },
             },
         },
     };

package/dist/script/features/cryptojs.js.map

@@ -1 +1 @@
-{"version":3,"file":"cryptojs.js","sourceRoot":"","sources":["../../../src/script/features/cryptojs.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,EAAE;AACF,sEAAsE;AACtE,yEAAyE;AACzE,qEAAqE;AACrE,qEAAqE;AACrE,EAAE;AACF,sEAAsE;AACtE,iDAAiD;AACjD,uEAAuE;AACvE,yEAAyE;AACzE,EAAE;AACF,mDAAmD;AAEnD,MAAM,YAAY,GAChB,kEAAkE,CAAC;AAErE,MAAM,YAAY,GAAG,CAAC,KAAc,EAAc,EAAE;IAClD,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;QACjC,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,KAAwB,CAAC;QACtC,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC,CAAC;AAEF,2EAA2E;AAC3E,yEAAyE;AACzE,uDAAuD;AACvD,MAAM,YAAY,GAAG,CAAC,KAAiB,EAAU,EAAE;IACjD,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QACxB,MAAM,EAAE,GAAG,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,MAAM,EAAE,GAAG,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;QAC5C,MAAM,IAAI,YAAY,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QAC/C,MAAM,IAAI,YAAY,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QAC/C,MAAM,IAAI,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACzE,MAAM,IAAI,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACpE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAcF,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAgB,EAAE;IACjD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,OAAO;QACL,GAAG,EAAE;YACH,IAAI,EAAE;gBACJ,KAAK,EAAE,CAAC,KAAc,EAAc,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC;gBAC1D,SAAS,EAAE,CAAC,KAAc,EAAU,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;aAC3E;YACD,MAAM,EAAE;gBACN,SAAS,EAAE,CAAC,KAAc,EAAU,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;aACzE;SACF;KACF,CAAC;AACJ,CAAC,CAAC"}
+{"version":3,"file":"cryptojs.js","sourceRoot":"","sources":["../../../src/script/features/cryptojs.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,EAAE;AACF,sEAAsE;AACtE,yEAAyE;AACzE,qEAAqE;AACrE,qEAAqE;AACrE,EAAE;AACF,sEAAsE;AACtE,iDAAiD;AACjD,uEAAuE;AACvE,yEAAyE;AACzE,oEAAoE;AACpE,EAAE;AACF,mDAAmD;AAEnD,MAAM,YAAY,GAChB,kEAAkE,CAAC;AAErE,MAAM,YAAY,GAAG,CAAC,KAAc,EAAc,EAAE;IAClD,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;QACjC,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,KAAwB,CAAC;QACtC,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC,CAAC;AAEF,2EAA2E;AAC3E,yEAAyE;AACzE,uDAAuD;AACvD,MAAM,YAAY,GAAG,CAAC,KAAiB,EAAU,EAAE;IACjD,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QACxB,MAAM,EAAE,GAAG,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,MAAM,EAAE,GAAG,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;QAC5C,MAAM,IAAI,YAAY,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QAC/C,MAAM,IAAI,YAAY,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QAC/C,MAAM,IAAI,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACzE,MAAM,IAAI,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACpE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,0EAA0E;AAC1E,mEAAmE;AACnE,uEAAuE;AACvE,sEAAsE;AACtE,yEAAyE;AACzE,SAAS;AACT,MAAM,YAAY,GAAG,CAAC,KAAa,EAAc,EAAE;IACjD,+DAA+D;IAC/D,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAEhD,sEAAsE;IACtE,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IACvC,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC/C,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5E,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAE5E,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QACxC,IAAI,EAAE,IAAI,CAAC;YAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9D,IAAI,EAAE,IAAI,CAAC;YAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;IACzD,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAeF,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAgB,EAAE;IACjD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,OAAO;QACL,GAAG,EAAE;YACH,IAAI,EAAE;gBACJ,KAAK,EAAE,CAAC,KAAc,EAAc,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC;gBAC1D,SAAS,EAAE,CAAC,KAAc,EAAU,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;aAC3E;YACD,MAAM,EAAE;gBACN,SAAS,EAAE,CAAC,KAAc,EAAU,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;gBACxE,KAAK,EAAE,CAAC,KAAa,EAAc,EAAE;oBACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;wBAC9B,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;oBAClE,CAAC;oBACD,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;gBAC7B,CAAC;aACF;SACF;KACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/script/scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../src/script/scope.ts"],"names":[],"mappings":"AAiFA,eAAO,MAAM,oBAAoB,aAgB/B,CAAC;AAEH,eAAO,MAAM,8BAA8B,QAAuB,CAAC;AAEnE,MAAM,WAAW,aAAa;IAE5B,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAM5B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC,CAAC;IAIvD,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;IAGnB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAED,eAAO,MAAM,gBAAgB,GAAI,UAAU,aAAa,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CA4DhF,CAAC;AAEF,eAAO,MAAM,gBAAgB,GAAI,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAiBrF,CAAC"}
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../src/script/scope.ts"],"names":[],"mappings":"AAmHA,eAAO,MAAM,oBAAoB,aAgB/B,CAAC;AAEH,eAAO,MAAM,8BAA8B,QAAuB,CAAC;AAEnE,MAAM,WAAW,aAAa;IAE5B,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAM5B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC,CAAC;IAIvD,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;IAGnB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAED,eAAO,MAAM,gBAAgB,GAAI,UAAU,aAAa,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CA4DhF,CAAC;AAEF,eAAO,MAAM,gBAAgB,GAAI,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAiBrF,CAAC"}

package/dist/script/scope.js

@@ -8,6 +8,15 @@
 //
 // The "blocked" set is the safety floor: these names are always undefined
 // in user scripts, regardless of what the caller passes in `bindings`.
+// Resolve a host-global lazily and only if it's actually a function. This
+// lets us bind Node 18+ web-compat APIs (`atob`, `btoa`, `structuredClone`)
+// without crashing on older runtimes that don't ship them. A missing API
+// simply doesn't get added to ALLOWED_GLOBALS, mirroring the legacy
+// "not exposed" behavior for that host.
+const hostFn = (name) => {
+    const value = globalThis[name];
+    return typeof value === "function" ? value : undefined;
+};
 const ALLOWED_GLOBALS = {
     JSON,
     Math,
@@ -37,6 +46,30 @@ const ALLOWED_GLOBALS = {
     URLSearchParams,
     TextEncoder,
     TextDecoder,
+    // Binary / typed-array surface — pure JS built-ins, no FS access. Lets
+    // scripts decode `new Uint8Array([...])` style payloads (JWT bodies,
+    // protobuf blobs, raw bytes from kafka) without falling back to Node-
+    // specific Buffer.
+    ArrayBuffer,
+    DataView,
+    Uint8Array,
+    Uint8ClampedArray,
+    Uint16Array,
+    Uint32Array,
+    Int8Array,
+    Int16Array,
+    Int32Array,
+    Float32Array,
+    Float64Array,
+    BigInt64Array,
+    BigUint64Array,
+    // Web-compat encoders. `atob`/`btoa` are standard in Node 18+; we bind
+    // the host implementation when available so scripts can decode base64url
+    // JWT payloads with no third-party shim. `structuredClone` mirrors the
+    // Node 17+ helper for deep-cloning Date/Map/Set/RegExp etc.
+    atob: hostFn("atob"),
+    btoa: hostFn("btoa"),
+    structuredClone: hostFn("structuredClone"),
     parseInt,
     parseFloat,
     encodeURIComponent,

package/dist/script/scope.js.map

@@ -1 +1 @@
-{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../src/script/scope.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,EAAE;AACF,wEAAwE;AACxE,4EAA4E;AAC5E,yEAAyE;AACzE,wEAAwE;AACxE,yBAAyB;AACzB,EAAE;AACF,0EAA0E;AAC1E,uEAAuE;AAEvE,MAAM,eAAe,GAA4B;IAC/C,IAAI;IACJ,IAAI;IACJ,MAAM;IACN,MAAM;IACN,OAAO;IACP,KAAK;IACL,MAAM;IACN,IAAI;IACJ,MAAM;IACN,OAAO;IACP,KAAK;IACL,SAAS;IACT,cAAc;IACd,WAAW;IACX,UAAU;IACV,SAAS;IACT,QAAQ;IACR,cAAc;IACd,GAAG;IACH,GAAG;IACH,OAAO;IACP,OAAO;IACP,MAAM;IACN,MAAM;IACN,GAAG;IACH,eAAe;IACf,WAAW;IACX,WAAW;IACX,QAAQ;IACR,UAAU;IACV,kBAAkB;IAClB,kBAAkB;IAClB,QAAQ;IACR,KAAK;IACL,sEAAsE;IACtE,SAAS;IACT,GAAG;IACH,QAAQ;CACT,CAAC;AAEF,MAAM,eAAe,GAAG;IACtB,MAAM;IACN,UAAU;IACV,QAAQ;IACR,YAAY;IACZ,cAAc;IACd,aAAa;IACb,eAAe;IACf,OAAO;IACP,gBAAgB;IAChB,WAAW;IACX,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,MAAM;IACN,YAAY;IACZ,QAAQ;IACR,SAAS;IACT,SAAS;IACT,QAAQ;IACR,SAAS;IACT,WAAW;IACX,eAAe;CACP,CAAC;AAEX,wEAAwE;AACxE,0EAA0E;AAC1E,uEAAuE;AACvE,+BAA+B;AAC/B,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAS;IAClD,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC;IAC/B,GAAG,eAAe;IAClB,IAAI;IACJ,KAAK;IACL,SAAS;IACT,SAAS;IACT,UAAU;IACV,MAAM;IACN,QAAQ;IACR,UAAU;IACV,0EAA0E;IAC1E,iEAAiE;IACjE,IAAI;IACJ,OAAO;IACP,OAAO;CACR,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,8BAA8B,GAAG,oBAAoB,CAAC;AAgCnE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,QAAuB,EAA2B,EAAE;IACnF,MAAM,MAAM,GAA4B;QACtC,GAAG,eAAe;QAClB,EAAE,EAAE,QAAQ,CAAC,EAAE;KAChB,CAAC;IAEF,IAAI,QAAQ,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC;IAC5B,CAAC;IACD,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACvC,MAAM,CAAC,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;IAC5C,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACpC,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;IACtC,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC9B,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAClC,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACpC,CAAC;IACD,IAAI,QAAQ,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,CAAC,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;IAC1B,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,CAAC,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IAChC,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,CAAC,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IAChC,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAClC,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACpC,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;IACxC,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;IACtC,CAAC;IACD,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YAClE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;IAC3B,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAA+B,EAA2B,EAAE,CAC3F,IAAI,KAAK,CAAC,MAAM,EAAE;IAChB,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI;IACf,GAAG,CAAC,WAAW,EAAE,QAAQ;QACvB,IAAI,QAAQ,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;YACpC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,WAAW,CAAC,QAAoC,CAAC,CAAC;IAC3D,CAAC;IACD,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK;QAC9B,WAAW,CAAC,QAAoC,CAAC,GAAG,KAAK,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,cAAc,CAAC,WAAW,EAAE,QAAQ;QAClC,OAAO,WAAW,CAAC,QAAoC,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAC,CAAC"}
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../src/script/scope.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,EAAE;AACF,wEAAwE;AACxE,4EAA4E;AAC5E,yEAAyE;AACzE,wEAAwE;AACxE,yBAAyB;AACzB,EAAE;AACF,0EAA0E;AAC1E,uEAAuE;AAEvE,0EAA0E;AAC1E,4EAA4E;AAC5E,yEAAyE;AACzE,oEAAoE;AACpE,wCAAwC;AACxC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAW,EAAE;IACvC,MAAM,KAAK,GAAI,UAAsC,CAAC,IAAI,CAAC,CAAC;IAC5D,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC,CAAC;AAEF,MAAM,eAAe,GAA4B;IAC/C,IAAI;IACJ,IAAI;IACJ,MAAM;IACN,MAAM;IACN,OAAO;IACP,KAAK;IACL,MAAM;IACN,IAAI;IACJ,MAAM;IACN,OAAO;IACP,KAAK;IACL,SAAS;IACT,cAAc;IACd,WAAW;IACX,UAAU;IACV,SAAS;IACT,QAAQ;IACR,cAAc;IACd,GAAG;IACH,GAAG;IACH,OAAO;IACP,OAAO;IACP,MAAM;IACN,MAAM;IACN,GAAG;IACH,eAAe;IACf,WAAW;IACX,WAAW;IACX,uEAAuE;IACvE,qEAAqE;IACrE,sEAAsE;IACtE,mBAAmB;IACnB,WAAW;IACX,QAAQ;IACR,UAAU;IACV,iBAAiB;IACjB,WAAW;IACX,WAAW;IACX,SAAS;IACT,UAAU;IACV,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,aAAa;IACb,cAAc;IACd,uEAAuE;IACvE,yEAAyE;IACzE,uEAAuE;IACvE,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC,iBAAiB,CAAC;IAC1C,QAAQ;IACR,UAAU;IACV,kBAAkB;IAClB,kBAAkB;IAClB,QAAQ;IACR,KAAK;IACL,sEAAsE;IACtE,SAAS;IACT,GAAG;IACH,QAAQ;CACT,CAAC;AAEF,MAAM,eAAe,GAAG;IACtB,MAAM;IACN,UAAU;IACV,QAAQ;IACR,YAAY;IACZ,cAAc;IACd,aAAa;IACb,eAAe;IACf,OAAO;IACP,gBAAgB;IAChB,WAAW;IACX,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,MAAM;IACN,YAAY;IACZ,QAAQ;IACR,SAAS;IACT,SAAS;IACT,QAAQ;IACR,SAAS;IACT,WAAW;IACX,eAAe;CACP,CAAC;AAEX,wEAAwE;AACxE,0EAA0E;AAC1E,uEAAuE;AACvE,+BAA+B;AAC/B,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAS;IAClD,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC;IAC/B,GAAG,eAAe;IAClB,IAAI;IACJ,KAAK;IACL,SAAS;IACT,SAAS;IACT,UAAU;IACV,MAAM;IACN,QAAQ;IACR,UAAU;IACV,0EAA0E;IAC1E,iEAAiE;IACjE,IAAI;IACJ,OAAO;IACP,OAAO;CACR,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,8BAA8B,GAAG,oBAAoB,CAAC;AAgCnE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,QAAuB,EAA2B,EAAE;IACnF,MAAM,MAAM,GAA4B;QACtC,GAAG,eAAe;QAClB,EAAE,EAAE,QAAQ,CAAC,EAAE;KAChB,CAAC;IAEF,IAAI,QAAQ,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC;IAC5B,CAAC;IACD,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACvC,MAAM,CAAC,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;IAC5C,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACpC,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;IACtC,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC9B,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAClC,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACpC,CAAC;IACD,IAAI,QAAQ,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,CAAC,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;IAC1B,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,CAAC,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IAChC,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,CAAC,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IAChC,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAClC,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACpC,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;IACxC,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;IACtC,CAAC;IACD,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YAClE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;IAC3B,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAA+B,EAA2B,EAAE,CAC3F,IAAI,KAAK,CAAC,MAAM,EAAE;IAChB,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI;IACf,GAAG,CAAC,WAAW,EAAE,QAAQ;QACvB,IAAI,QAAQ,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;YACpC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,WAAW,CAAC,QAAoC,CAAC,CAAC;IAC3D,CAAC;IACD,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK;QAC9B,WAAW,CAAC,QAAoC,CAAC,GAAG,KAAK,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,cAAc,CAAC,WAAW,EAAE,QAAQ;QAClC,OAAO,WAAW,CAAC,QAAoC,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAC,CAAC"}

package/dist-cjs/script/features/assertions.js

@@ -1,13 +1,20 @@
 "use strict";
 // pm.expect / PmAssertion — Postman/Chai-flavored fluent assertion vocabulary.
 //
-// Lifted as-is from the legacy callman_core/src/script/pmApi.ts (which is
-// also identical to the backend's PostmanAssertion class). This is the one
-// part of the sandbox that all three implementations agreed on, so we keep
-// the behavior bit-identical to avoid breaking user scripts.
+// Public surface stays bit-identical with the legacy implementation: every
+// previously-shipped method/getter behaves the same when called without
+// `.not`/`.deep`/`.nested` modifiers. Three flags layered on top give us
+// chai-style affordances:
 //
-// Chain getters (.to / .be / .have / ...) return `this` and exist purely
-// for English-grammar fluency (`pm.expect(x).to.have.status(200)`).
+//   .not       — flips pass/fail of the next assertion
+//   .deep      — promotes `.equal`/`.toBe` to deep-equality (alias for .eql)
+//   .nested    — `.property("a.b.c")` walks dot-paths (already the default;
+//                kept as a chain word so chai-style code reads naturally)
+//
+// All chain getters return a NEW PmAssertion instance carrying the updated
+// flags. This keeps each `pm.expect(x)` call independent — flag state can't
+// leak across assertions on the same value, and `.not.not.equal(x)` cleanly
+// double-toggles back to the positive form.
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createExpectApi = exports.PmAssertion = void 0;
 const get_js_1 = require("../../utils/get.js");
@@ -52,12 +59,36 @@ const isDeepEqual = (left, right) => {
     }
     return false;
 };
+// Type-of helpers used by `.empty` so we treat Map/Set/object correctly.
+const hasLengthProperty = (value) => value !== null &&
+    typeof value.length === "number";
+const hasSizeProperty = (value) => value !== null &&
+    typeof value.size === "number";
 class PmAssertion {
     actual;
-    constructor(actual) {
+    flags;
+    constructor(actual, flags = {}) {
         this.actual = actual;
+        this.flags = flags;
+    }
+    // Internal: wrap an outcome with negation, throwing the right message.
+    check(pass, positiveMessage, negativeMessage) {
+        const finalPass = this.flags.negated ? !pass : pass;
+        if (!finalPass) {
+            throw new Error(this.flags.negated
+                ? negativeMessage ?? `Expected NOT: ${positiveMessage}`
+                : positiveMessage);
+        }
+    }
+    // Internal: build a child assertion preserving negation but stripping the
+    // `.deep`/`.nested` flags that were consumed by the current call. Used by
+    // `.property()` so chained calls like
+    //   pm.expect(obj).to.have.property("a", 1).and.to.equal({a:1})
+    // start a fresh chain on the property value.
+    child(value) {
+        return new PmAssertion(value, { negated: this.flags.negated });
     }
-    // English chain getters — return `this` for fluent grammar
+    // ── English chain getters — pure grammar, no behavior ────────────────
     get to() {
         return this;
     }
@@ -91,43 +122,77 @@ class PmAssertion {
     get same() {
         return this;
     }
+    // ── Modifier chain words — return a NEW instance with the flag set ──
+    get not() {
+        return new PmAssertion(this.actual, {
+            ...this.flags,
+            negated: !this.flags.negated,
+        });
+    }
     get deep() {
-        return this;
+        return new PmAssertion(this.actual, { ...this.flags, deep: true });
     }
+    get nested() {
+        return new PmAssertion(this.actual, { ...this.flags, nested: true });
+    }
+    // ── Assertion getters ────────────────────────────────────────────────
     get ok() {
         return this.toBeTruthy();
     }
     get true() {
-        if (this.actual !== true) {
-            throw new Error(`Expected ${formatValue(this.actual)} to be true`);
-        }
+        this.check(this.actual === true, `Expected ${formatValue(this.actual)} to be true`, `Expected ${formatValue(this.actual)} NOT to be true`);
         return this;
     }
     get false() {
-        if (this.actual !== false) {
-            throw new Error(`Expected ${formatValue(this.actual)} to be false`);
-        }
+        this.check(this.actual === false, `Expected ${formatValue(this.actual)} to be false`, `Expected ${formatValue(this.actual)} NOT to be false`);
+        return this;
+    }
+    get null() {
+        this.check(this.actual === null, `Expected ${formatValue(this.actual)} to be null`, `Expected ${formatValue(this.actual)} NOT to be null`);
+        return this;
+    }
+    get undefined() {
+        this.check(this.actual === undefined, `Expected ${formatValue(this.actual)} to be undefined`, `Expected ${formatValue(this.actual)} NOT to be undefined`);
         return this;
     }
     get exist() {
-        if (this.actual === null || this.actual === undefined) {
-            throw new Error(`Expected ${formatValue(this.actual)} to exist`);
+        this.check(this.actual !== null && this.actual !== undefined, `Expected ${formatValue(this.actual)} to exist`, `Expected ${formatValue(this.actual)} NOT to exist`);
+        return this;
+    }
+    // `.empty` — works for strings, arrays, Maps, Sets, and plain objects.
+    get empty() {
+        let isEmpty;
+        if (typeof this.actual === "string" || Array.isArray(this.actual)) {
+            isEmpty = this.actual.length === 0;
         }
+        else if (this.actual instanceof Map ||
+            this.actual instanceof Set ||
+            hasSizeProperty(this.actual)) {
+            isEmpty = this.actual.size === 0;
+        }
+        else if (isRecord(this.actual)) {
+            isEmpty = Object.keys(this.actual).length === 0;
+        }
+        else {
+            throw new Error(`Expected ${formatValue(this.actual)} to be a string, array, Map, Set, or object`);
+        }
+        this.check(isEmpty, `Expected ${formatValue(this.actual)} to be empty`, `Expected ${formatValue(this.actual)} NOT to be empty`);
         return this;
     }
+    // ── Equality ─────────────────────────────────────────────────────────
+    // `.deep.equal(x)` upgrades to deep equality; `.equal(x)` is identity.
     equal(expected) {
-        if (!Object.is(this.actual, expected)) {
-            throw new Error(`Expected ${formatValue(this.actual)} to equal ${formatValue(expected)}`);
+        if (this.flags.deep) {
+            return this.toEqual(expected);
         }
+        this.check(Object.is(this.actual, expected), `Expected ${formatValue(this.actual)} to equal ${formatValue(expected)}`, `Expected ${formatValue(this.actual)} NOT to equal ${formatValue(expected)}`);
         return this;
     }
     toBe(expected) {
         return this.equal(expected);
     }
     toBeDefined() {
-        if (this.actual === undefined) {
-            throw new Error(`Expected ${formatValue(this.actual)} to be defined`);
-        }
+        this.check(this.actual !== undefined, `Expected ${formatValue(this.actual)} to be defined`, `Expected ${formatValue(this.actual)} NOT to be defined`);
         return this;
     }
     equals(expected) {
@@ -137,33 +202,69 @@ class PmAssertion {
         return this.toEqual(expected);
     }
     toEqual(expected) {
-        if (!isDeepEqual(this.actual, expected)) {
-            throw new Error(`Expected ${formatValue(this.actual)} to deeply equal ${formatValue(expected)}`);
-        }
+        this.check(isDeepEqual(this.actual, expected), `Expected ${formatValue(this.actual)} to deeply equal ${formatValue(expected)}`, `Expected ${formatValue(this.actual)} NOT to deeply equal ${formatValue(expected)}`);
         return this;
     }
+    // ── Type checks ──────────────────────────────────────────────────────
     a(expectedType) {
         const actualType = getValueType(this.actual);
         const normalizedExpectedType = expectedType.trim().toLowerCase();
-        if (actualType !== normalizedExpectedType) {
-            throw new Error(`Expected type ${normalizedExpectedType} but got ${actualType}`);
-        }
+        this.check(actualType === normalizedExpectedType, `Expected type ${normalizedExpectedType} but got ${actualType}`, `Expected type NOT to be ${normalizedExpectedType}`);
         return this;
     }
     an(expectedType) {
         return this.a(expectedType);
     }
+    instanceOf(constructor) {
+        if (typeof constructor !== "function") {
+            throw new Error("instanceOf expects a constructor function as its argument");
+        }
+        const ctorName = constructor.name || "<anonymous>";
+        let isInstance = false;
+        try {
+            isInstance = this.actual instanceof constructor;
+        }
+        catch {
+            // RHS isn't actually callable as a constructor — treat as failure.
+            isInstance = false;
+        }
+        this.check(isInstance, `Expected ${formatValue(this.actual)} to be an instance of ${ctorName}`, `Expected ${formatValue(this.actual)} NOT to be an instance of ${ctorName}`);
+        return this;
+    }
+    // ── Property access ──────────────────────────────────────────────────
+    // `safeGet` already supports dot-path notation (e.g. "a.b.c"). The
+    // `.nested` flag is therefore informational only — kept so chai-style
+    // code (`.nested.property("a.b")`) reads naturally. Existing call sites
+    // that pass plain keys continue to work because safeGet treats a key
+    // without "." as a single token.
     property(key, expectedValue) {
         const property = (0, get_js_1.safeGet)(this.actual, key);
-        if (!property.exists) {
-            throw new Error(`Expected ${formatValue(this.actual)} to have property "${key}"`);
+        this.check(property.exists, `Expected ${formatValue(this.actual)} to have property "${key}"`, `Expected ${formatValue(this.actual)} NOT to have property "${key}"`);
+        // Stop here if negated — the inner-value chain below would be a no-op
+        // in the negated case (we already asserted the property is absent).
+        if (this.flags.negated) {
+            return this;
         }
-        const nextAssertion = new PmAssertion(property.value);
+        const nextAssertion = this.child(property.value);
         if (arguments.length > 1) {
             nextAssertion.toEqual(expectedValue);
         }
         return nextAssertion;
     }
+    // chai-style: pm.expect(obj).to.have.keys("a", "b") — strict, all of them
+    // must be the object's own enumerable keys and nothing else.
+    keys(...names) {
+        if (!isRecord(this.actual)) {
+            throw new Error(`Expected ${formatValue(this.actual)} to be an object`);
+        }
+        const expected = new Set(names);
+        const actualKeys = new Set(Object.keys(this.actual));
+        const matches = expected.size === actualKeys.size &&
+            [...expected].every((key) => actualKeys.has(key));
+        this.check(matches, `Expected object to have exactly keys [${names.join(", ")}], got [${[...actualKeys].join(", ")}]`, `Expected object NOT to have exactly keys [${names.join(", ")}]`);
+        return this;
+    }
+    // ── Containment ──────────────────────────────────────────────────────
     contain(expected) {
         return this.toContain(expected);
     }
@@ -171,30 +272,36 @@ class PmAssertion {
         return this.toContain(expected);
     }
     toContain(expected) {
+        let isIncluded;
         if (typeof this.actual === "string") {
-            if (!this.actual.includes(String(expected))) {
-                throw new Error(`Expected ${formatValue(this.actual)} to contain ${formatValue(expected)}`);
-            }
-            return this;
+            isIncluded = this.actual.includes(String(expected));
         }
-        if (Array.isArray(this.actual)) {
-            if (!this.actual.some((entry) => isDeepEqual(entry, expected))) {
-                throw new Error(`Expected ${formatValue(this.actual)} to contain ${formatValue(expected)}`);
-            }
-            return this;
+        else if (Array.isArray(this.actual)) {
+            isIncluded = this.actual.some((entry) => isDeepEqual(entry, expected));
         }
-        throw new Error("toContain supports only strings and arrays");
+        else {
+            throw new Error("toContain supports only strings and arrays");
+        }
+        this.check(isIncluded, `Expected ${formatValue(this.actual)} to contain ${formatValue(expected)}`, `Expected ${formatValue(this.actual)} NOT to contain ${formatValue(expected)}`);
+        return this;
+    }
+    oneOf(values) {
+        if (!Array.isArray(values)) {
+            throw new Error("oneOf expects an array");
+        }
+        const isMember = values.some((entry) => isDeepEqual(entry, this.actual));
+        this.check(isMember, `Expected ${formatValue(this.actual)} to be one of ${formatValue(values)}`, `Expected ${formatValue(this.actual)} NOT to be one of ${formatValue(values)}`);
+        return this;
     }
     match(pattern) {
         if (typeof this.actual !== "string") {
             throw new Error(`Expected ${formatValue(this.actual)} to be a string`);
         }
         const matcher = typeof pattern === "string" ? new RegExp(pattern) : pattern;
-        if (!matcher.test(this.actual)) {
-            throw new Error(`Expected ${formatValue(this.actual)} to match ${String(matcher)}`);
-        }
+        this.check(matcher.test(this.actual), `Expected ${formatValue(this.actual)} to match ${String(matcher)}`, `Expected ${formatValue(this.actual)} NOT to match ${String(matcher)}`);
         return this;
     }
+    // ── Response-shape shortcuts ─────────────────────────────────────────
     status(expected) {
         return this.property("status", expected);
     }
@@ -205,30 +312,38 @@ class PmAssertion {
         }
         const normalizedName = name.toLowerCase();
         const entry = Object.entries(headers.value).find(([key]) => key.toLowerCase() === normalizedName);
-        if (!entry) {
-            throw new Error(`Expected response headers to contain "${name}"`);
+        this.check(Boolean(entry), `Expected response headers to contain "${name}"`, `Expected response headers NOT to contain "${name}"`);
+        if (this.flags.negated || !entry) {
+            return this;
         }
-        const nextAssertion = new PmAssertion(entry[1]);
+        const nextAssertion = this.child(entry[1]);
         if (arguments.length > 1) {
             nextAssertion.toEqual(expectedValue);
         }
         return nextAssertion;
     }
+    // ── Numeric comparison ──────────────────────────────────────────────
     greaterThan(expected) {
         return this.toBeGreaterThan(expected);
     }
     lessThan(expected) {
         return this.toBeLessThan(expected);
     }
+    // chai-style alias for the same predicate (no `.be.above` chain — call
+    // directly: `pm.expect(x).to.be.above(5)`).
+    above(expected) {
+        return this.toBeGreaterThan(expected);
+    }
+    below(expected) {
+        return this.toBeLessThan(expected);
+    }
     toBeGreaterThan(expected) {
         const actualNumber = Number(this.actual);
         const expectedNumber = Number(expected);
         if (!Number.isFinite(actualNumber) || !Number.isFinite(expectedNumber)) {
             throw new Error("toBeGreaterThan supports only finite numbers");
         }
-        if (actualNumber <= expectedNumber) {
-            throw new Error(`Expected ${formatValue(this.actual)} to be greater than ${formatValue(expected)}`);
-        }
+        this.check(actualNumber > expectedNumber, `Expected ${formatValue(this.actual)} to be greater than ${formatValue(expected)}`, `Expected ${formatValue(this.actual)} NOT to be greater than ${formatValue(expected)}`);
         return this;
     }
     toBeLessThan(expected) {
@@ -237,21 +352,104 @@ class PmAssertion {
         if (!Number.isFinite(actualNumber) || !Number.isFinite(expectedNumber)) {
             throw new Error("toBeLessThan supports only finite numbers");
         }
-        if (actualNumber >= expectedNumber) {
-            throw new Error(`Expected ${formatValue(this.actual)} to be less than ${formatValue(expected)}`);
+        this.check(actualNumber < expectedNumber, `Expected ${formatValue(this.actual)} to be less than ${formatValue(expected)}`, `Expected ${formatValue(this.actual)} NOT to be less than ${formatValue(expected)}`);
+        return this;
+    }
+    within(min, max) {
+        const actualNumber = Number(this.actual);
+        const minNumber = Number(min);
+        const maxNumber = Number(max);
+        if (!Number.isFinite(actualNumber) ||
+            !Number.isFinite(minNumber) ||
+            !Number.isFinite(maxNumber)) {
+            throw new Error("within supports only finite numbers");
         }
+        this.check(actualNumber >= minNumber && actualNumber <= maxNumber, `Expected ${formatValue(this.actual)} to be within ${formatValue(min)}..${formatValue(max)}`, `Expected ${formatValue(this.actual)} NOT to be within ${formatValue(min)}..${formatValue(max)}`);
         return this;
     }
-    toBeTruthy() {
-        if (!this.actual) {
-            throw new Error(`Expected ${formatValue(this.actual)} to be truthy`);
+    closeTo(expected, delta) {
+        const actualNumber = Number(this.actual);
+        const expectedNumber = Number(expected);
+        const deltaNumber = Number(delta);
+        if (!Number.isFinite(actualNumber) ||
+            !Number.isFinite(expectedNumber) ||
+            !Number.isFinite(deltaNumber)) {
+            throw new Error("closeTo supports only finite numbers");
+        }
+        this.check(Math.abs(actualNumber - expectedNumber) <= deltaNumber, `Expected ${formatValue(this.actual)} to be within ${deltaNumber} of ${formatValue(expected)}`, `Expected ${formatValue(this.actual)} NOT to be within ${deltaNumber} of ${formatValue(expected)}`);
+        return this;
+    }
+    // ── Length / size ────────────────────────────────────────────────────
+    lengthOf(expected) {
+        if (!hasLengthProperty(this.actual) &&
+            !hasSizeProperty(this.actual)) {
+            throw new Error(`Expected ${formatValue(this.actual)} to have a length or size`);
         }
+        const actualLength = hasLengthProperty(this.actual)
+            ? this.actual.length
+            : this.actual.size;
+        this.check(actualLength === expected, `Expected ${formatValue(this.actual)} to have length ${expected}, got ${actualLength}`, `Expected ${formatValue(this.actual)} NOT to have length ${expected}`);
+        return this;
+    }
+    length(expected) {
+        return this.lengthOf(expected);
+    }
+    // ── Truthiness ──────────────────────────────────────────────────────
+    toBeTruthy() {
+        this.check(Boolean(this.actual), `Expected ${formatValue(this.actual)} to be truthy`, `Expected ${formatValue(this.actual)} NOT to be truthy`);
         return this;
     }
     toBeFalsy() {
-        if (this.actual) {
-            throw new Error(`Expected ${formatValue(this.actual)} to be falsy`);
+        this.check(!this.actual, `Expected ${formatValue(this.actual)} to be falsy`, `Expected ${formatValue(this.actual)} NOT to be falsy`);
+        return this;
+    }
+    // ── Function-shape predicates ────────────────────────────────────────
+    // `pm.expect(fn).to.throw()` — runs the function and asserts it throws.
+    // Optional matcher narrows by message substring (string), regex test,
+    // or `instanceof <Constructor>` (function).
+    throw(matcher) {
+        if (typeof this.actual !== "function") {
+            throw new Error(`Expected ${formatValue(this.actual)} to be a function`);
+        }
+        let thrown = null;
+        let didThrow = false;
+        try {
+            this.actual();
+        }
+        catch (error) {
+            didThrow = true;
+            thrown = error;
+        }
+        let pass = didThrow;
+        let detail = "";
+        if (didThrow && matcher !== undefined) {
+            const errorMessage = thrown instanceof Error ? thrown.message : String(thrown);
+            if (typeof matcher === "string") {
+                pass = errorMessage.includes(matcher);
+                detail = ` matching ${formatValue(matcher)}`;
+            }
+            else if (matcher instanceof RegExp) {
+                pass = matcher.test(errorMessage);
+                detail = ` matching ${String(matcher)}`;
+            }
+            else if (typeof matcher === "function") {
+                pass = thrown instanceof matcher;
+                detail = ` of type ${matcher.name ?? "<anonymous>"}`;
+            }
+        }
+        this.check(pass, `Expected function to throw${detail}`, `Expected function NOT to throw${detail}`);
+        return this;
+    }
+    // chai-style: `pm.expect(obj).to.respondTo("methodName")` — actual has
+    // a callable property by that name. Accepts any non-null object
+    // (plain objects, arrays, Maps, Sets, class instances) — method lookup
+    // falls through the prototype chain like a normal `obj.method` access.
+    respondTo(methodName) {
+        let fn = undefined;
+        if (this.actual !== null && this.actual !== undefined) {
+            fn = this.actual[methodName];
         }
+        this.check(typeof fn === "function", `Expected ${formatValue(this.actual)} to respond to method "${methodName}"`, `Expected ${formatValue(this.actual)} NOT to respond to method "${methodName}"`);
         return this;
     }
 }