callman-core 1.7.0 → 1.8.0

package/dist/script/features/cryptojs.js

@@ -1,102 +1,18 @@
-// CryptoJS — minimal collection-runner crypto helpers.
+// CryptoJS — the real `crypto-js` package, surfaced unmodified so
+// Postman scripts that lean on it ("CryptoJS.HmacSHA256(message, key)",
+// "CryptoJS.AES.encrypt", "CryptoJS.SHA256", "CryptoJS.MD5",
+// "CryptoJS.PBKDF2", "CryptoJS.enc.Hex/Base64/Utf8", "CryptoJS.lib.WordArray")
+// run unmodified.
 //
-// Migrated from pmanfrontend/electron/script/runtime.ts. The original
-// implementation used Node's `Buffer` for base64 encoding; the canonical
-// sandbox blocks `Buffer` (security policy), so this rewrite uses an
-// in-process btoa-equivalent that produces RFC 4648 standard output.
+// Why we kept a hand-written stub for so long: the original Callman
+// sandbox blocked `Buffer`, and the team wanted to control bundle
+// size. The trade-off failed in practice — every other request-signing
+// pattern in real Postman scripts uses HMAC-SHA256, which the stub
+// could not provide, leading to "CryptoJS.HmacSHA256 is not a function"
+// errors. Bundling the real ~150 KB library is the right call.
 //
-// Only the surface that user scripts actually consume is implemented:
-//   CryptoJS.enc.Utf8.parse(string) → Uint8Array
-//   CryptoJS.enc.Utf8.stringify(Uint8Array | ArrayBufferLike) → string
-//   CryptoJS.enc.Base64.stringify(Uint8Array | ArrayBufferLike) → string
-//   CryptoJS.enc.Base64.parse(base64String) → Uint8Array  (decoder)
-//
-// HMAC / SHA / AES are intentionally out of scope.
-const BASE64_CHARS = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
-const toUint8Array = (input) => {
-    if (input instanceof Uint8Array) {
-        return input;
-    }
-    if (input instanceof ArrayBuffer) {
-        return new Uint8Array(input);
-    }
-    if (ArrayBuffer.isView(input)) {
-        const view = input;
-        return new Uint8Array(view.buffer, view.byteOffset, view.byteLength);
-    }
-    if (typeof input === "string") {
-        return new TextEncoder().encode(input);
-    }
-    return new Uint8Array(0);
-};
-// Portable base64 encoder: walks the Uint8Array in 3-byte chunks and emits
-// four characters per chunk per RFC 4648. No reliance on Buffer or btoa,
-// so it works in vm contexts where neither is exposed.
-const encodeBase64 = (bytes) => {
-    let output = "";
-    const length = bytes.length;
-    for (let index = 0; index < length; index += 3) {
-        const b0 = bytes[index];
-        const b1 = index + 1 < length ? bytes[index + 1] : 0;
-        const b2 = index + 2 < length ? bytes[index + 2] : 0;
-        const triplet = (b0 << 16) | (b1 << 8) | b2;
-        output += BASE64_CHARS[(triplet >> 18) & 0x3f];
-        output += BASE64_CHARS[(triplet >> 12) & 0x3f];
-        output += index + 1 < length ? BASE64_CHARS[(triplet >> 6) & 0x3f] : "=";
-        output += index + 2 < length ? BASE64_CHARS[triplet & 0x3f] : "=";
-    }
-    return output;
-};
-// Inverse of encodeBase64. Accepts both standard base64 (`+`/`/`, padded)
-// and base64url (`-`/`_`, unpadded) input — useful because callers
-// frequently pass JWT payload segments which use the url-safe alphabet
-// without padding. Throws on characters outside both alphabets so the
-// caller fails fast on garbage input rather than silently producing junk
-// bytes.
-const decodeBase64 = (input) => {
-    // Normalize url-safe → standard and re-pad to a multiple of 4.
-    const normalized = input.replace(/-/g, "+").replace(/_/g, "/");
-    const padding = (4 - (normalized.length % 4)) % 4;
-    const padded = normalized + "=".repeat(padding);
-    // Reject anything outside the standard alphabet (post-normalization).
-    if (!/^[A-Za-z0-9+/]*={0,2}$/.test(padded)) {
-        throw new Error("CryptoJS.enc.Base64.parse: invalid base64 input");
-    }
-    const cleanLength = padded.replace(/=+$/g, "").length;
-    const byteLength = Math.floor((cleanLength * 3) / 4);
-    const out = new Uint8Array(byteLength);
-    let outIndex = 0;
-    for (let i = 0; i < padded.length; i += 4) {
-        const c1 = BASE64_CHARS.indexOf(padded[i]);
-        const c2 = BASE64_CHARS.indexOf(padded[i + 1]);
-        const c3 = padded[i + 2] === "=" ? -1 : BASE64_CHARS.indexOf(padded[i + 2]);
-        const c4 = padded[i + 3] === "=" ? -1 : BASE64_CHARS.indexOf(padded[i + 3]);
-        out[outIndex++] = (c1 << 2) | (c2 >> 4);
-        if (c3 >= 0)
-            out[outIndex++] = ((c2 & 0x0f) << 4) | (c3 >> 2);
-        if (c4 >= 0)
-            out[outIndex++] = ((c3 & 0x03) << 6) | c4;
-    }
-    return out;
-};
-export const createCryptoJsApi = () => {
-    const decoder = new TextDecoder();
-    return {
-        enc: {
-            Utf8: {
-                parse: (input) => toUint8Array(input),
-                stringify: (input) => decoder.decode(toUint8Array(input)),
-            },
-            Base64: {
-                stringify: (input) => encodeBase64(toUint8Array(input)),
-                parse: (input) => {
-                    if (typeof input !== "string") {
-                        throw new Error("CryptoJS.enc.Base64.parse: expected a string");
-                    }
-                    return decodeBase64(input);
-                },
-            },
-        },
-    };
-};
+// The pure-JS implementation does not touch Node's `Buffer`, so it
+// runs inside the vm sandbox without any host shims.
+import CryptoJS from "crypto-js";
+export const createCryptoJsApi = () => CryptoJS;
 //# sourceMappingURL=cryptojs.js.map

package/dist/script/features/cryptojs.js.map

@@ -1 +1 @@
-{"version":3,"file":"cryptojs.js","sourceRoot":"","sources":["../../../src/script/features/cryptojs.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,EAAE;AACF,sEAAsE;AACtE,yEAAyE;AACzE,qEAAqE;AACrE,qEAAqE;AACrE,EAAE;AACF,sEAAsE;AACtE,iDAAiD;AACjD,uEAAuE;AACvE,yEAAyE;AACzE,oEAAoE;AACpE,EAAE;AACF,mDAAmD;AAEnD,MAAM,YAAY,GAChB,kEAAkE,CAAC;AAErE,MAAM,YAAY,GAAG,CAAC,KAAc,EAAc,EAAE;IAClD,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;QACjC,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,KAAwB,CAAC;QACtC,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC,CAAC;AAEF,2EAA2E;AAC3E,yEAAyE;AACzE,uDAAuD;AACvD,MAAM,YAAY,GAAG,CAAC,KAAiB,EAAU,EAAE;IACjD,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QACxB,MAAM,EAAE,GAAG,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,MAAM,EAAE,GAAG,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;QAC5C,MAAM,IAAI,YAAY,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QAC/C,MAAM,IAAI,YAAY,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QAC/C,MAAM,IAAI,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACzE,MAAM,IAAI,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACpE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,0EAA0E;AAC1E,mEAAmE;AACnE,uEAAuE;AACvE,sEAAsE;AACtE,yEAAyE;AACzE,SAAS;AACT,MAAM,YAAY,GAAG,CAAC,KAAa,EAAc,EAAE;IACjD,+DAA+D;IAC/D,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAEhD,sEAAsE;IACtE,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IACvC,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC/C,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5E,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAE5E,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QACxC,IAAI,EAAE,IAAI,CAAC;YAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9D,IAAI,EAAE,IAAI,CAAC;YAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;IACzD,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAeF,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAgB,EAAE;IACjD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,OAAO;QACL,GAAG,EAAE;YACH,IAAI,EAAE;gBACJ,KAAK,EAAE,CAAC,KAAc,EAAc,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC;gBAC1D,SAAS,EAAE,CAAC,KAAc,EAAU,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;aAC3E;YACD,MAAM,EAAE;gBACN,SAAS,EAAE,CAAC,KAAc,EAAU,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;gBACxE,KAAK,EAAE,CAAC,KAAa,EAAc,EAAE;oBACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;wBAC9B,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;oBAClE,CAAC;oBACD,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;gBAC7B,CAAC;aACF;SACF;KACF,CAAC;AACJ,CAAC,CAAC"}
+{"version":3,"file":"cryptojs.js","sourceRoot":"","sources":["../../../src/script/features/cryptojs.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,wEAAwE;AACxE,6DAA6D;AAC7D,+EAA+E;AAC/E,kBAAkB;AAClB,EAAE;AACF,oEAAoE;AACpE,kEAAkE;AAClE,uEAAuE;AACvE,mEAAmE;AACnE,wEAAwE;AACxE,+DAA+D;AAC/D,EAAE;AACF,mEAAmE;AACnE,qDAAqD;AAErD,OAAO,QAAQ,MAAM,WAAW,CAAC;AAUjC,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAgB,EAAE,CAAC,QAAQ,CAAC"}

package/dist/script/features/environment.d.ts

@@ -1,11 +1,18 @@
 import type { ScriptVariableMutation } from "../types.js";
 export interface EnvironmentApi {
     values: Record<string, string>;
+    /** Read-only label of the scope (e.g. "Staging" for an env, or
+     * "Globals"). Defaults to the scope kind. */
+    name: string;
     get: (key: string) => string | undefined;
     set: (key: string, value: unknown) => void;
     unset: (key: string) => void;
     has: (key: string) => boolean;
+    clear: () => void;
     toObject: () => Record<string, string>;
+    replaceIn: (template: unknown) => string;
 }
-export declare const buildEnvironmentApi: (initial: Record<string, string>, mutations: ScriptVariableMutation[] | null, scope: ScriptVariableMutation["scope"]) => EnvironmentApi;
+export declare const buildEnvironmentApi: (initial: Record<string, string>, mutations: ScriptVariableMutation[] | null, scope: ScriptVariableMutation["scope"], options?: {
+    nameOverride?: string;
+}) => EnvironmentApi;
 //# sourceMappingURL=environment.d.ts.map

package/dist/script/features/environment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"environment.d.ts","sourceRoot":"","sources":["../../../src/script/features/environment.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAE1D,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IACzC,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IAC3C,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAC9B,QAAQ,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC;AASD,eAAO,MAAM,mBAAmB,GAC9B,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,WAAW,sBAAsB,EAAE,GAAG,IAAI,EAC1C,OAAO,sBAAsB,CAAC,OAAO,CAAC,KACrC,cA8CF,CAAC"}
+{"version":3,"file":"environment.d.ts","sourceRoot":"","sources":["../../../src/script/features/environment.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAE1D,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B;iDAC6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IACzC,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IAC3C,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAC9B,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,QAAQ,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,SAAS,EAAE,CAAC,QAAQ,EAAE,OAAO,KAAK,MAAM,CAAC;CAC1C;AASD,eAAO,MAAM,mBAAmB,GAC9B,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,WAAW,sBAAsB,EAAE,GAAG,IAAI,EAC1C,OAAO,sBAAsB,CAAC,OAAO,CAAC,EACtC,UAAS;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAO,KACtC,cA+DF,CAAC"}

package/dist/script/features/environment.js

@@ -7,16 +7,25 @@
 //   - emitMutations=false: the API mutates the in-memory `values` record
 //     directly without producing a log. Used by callman-core's legacy
 //     `runScript` shim where EnvStore is the source of truth.
+//
+// Postman compatibility additions (Phase 1.3):
+//   - `.replaceIn(template)` — resolve `{{var}}` against THIS scope only.
+//   - `.clear()` — wipe all keys (emits one unset mutation per key when
+//     mutations are tracked, so the host can mirror the deletion).
+//   - `.name` — read-only string label of the active scope ("environment"
+//     or "global" by default; backend can override via `nameOverride`).
+import { resolveTemplate } from "../../variables/resolver.js";
 const coerceToString = (value) => {
     if (value === undefined || value === null) {
         return "";
     }
     return String(value);
 };
-export const buildEnvironmentApi = (initial, mutations, scope) => {
+export const buildEnvironmentApi = (initial, mutations, scope, options = {}) => {
     // Copy so the caller's record is never mutated in-place when the
     // sandbox is configured to emit mutations.
     const values = { ...initial };
+    const name = options.nameOverride ?? (scope === "global" ? "Globals" : "Environment");
     const recordMutation = (mutation) => {
         if (mutations) {
             mutations.push(mutation);
@@ -24,6 +33,7 @@ export const buildEnvironmentApi = (initial, mutations, scope) => {
     };
     return {
         values,
+        name,
         get: (key) => values[String(key ?? "").trim()],
         set: (key, value) => {
             const normalizedKey = String(key ?? "").trim();
@@ -55,7 +65,21 @@ export const buildEnvironmentApi = (initial, mutations, scope) => {
             const normalizedKey = String(key ?? "").trim();
             return Boolean(normalizedKey) && normalizedKey in values;
         },
+        clear: () => {
+            // Snapshot keys first so we emit one unset mutation per entry and
+            // don't fight the iteration order while deleting.
+            const keys = Object.keys(values);
+            for (const key of keys) {
+                delete values[key];
+                recordMutation({
+                    scope,
+                    type: "unset",
+                    key,
+                });
+            }
+        },
         toObject: () => ({ ...values }),
+        replaceIn: (template) => resolveTemplate(coerceToString(template), { env: values }),
     };
 };
 //# sourceMappingURL=environment.js.map

package/dist/script/features/environment.js.map

@@ -1 +1 @@
-{"version":3,"file":"environment.js","sourceRoot":"","sources":["../../../src/script/features/environment.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,EAAE;AACF,uBAAuB;AACvB,sEAAsE;AACtE,2EAA2E;AAC3E,qDAAqD;AACrD,yEAAyE;AACzE,sEAAsE;AACtE,8DAA8D;AAa9D,MAAM,cAAc,GAAG,CAAC,KAAc,EAAU,EAAE;IAChD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,OAA+B,EAC/B,SAA0C,EAC1C,KAAsC,EACtB,EAAE;IAClB,iEAAiE;IACjE,2CAA2C;IAC3C,MAAM,MAAM,GAA2B,EAAE,GAAG,OAAO,EAAE,CAAC;IAEtD,MAAM,cAAc,GAAG,CAAC,QAAgC,EAAQ,EAAE;QAChE,IAAI,SAAS,EAAE,CAAC;YACd,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,MAAM;QACN,GAAG,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,GAAG,EAAE,CAAC,GAAW,EAAE,KAAc,EAAE,EAAE;YACnC,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/C,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,OAAO;YACT,CAAC;YACD,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YAC9C,MAAM,CAAC,aAAa,CAAC,GAAG,eAAe,CAAC;YACxC,cAAc,CAAC;gBACb,KAAK;gBACL,IAAI,EAAE,KAAK;gBACX,GAAG,EAAE,aAAa;gBAClB,KAAK,EAAE,eAAe;aACvB,CAAC,CAAC;QACL,CAAC;QACD,KAAK,EAAE,CAAC,GAAW,EAAE,EAAE;YACrB,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/C,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC,aAAa,IAAI,MAAM,CAAC,EAAE,CAAC;gBACjD,OAAO;YACT,CAAC;YACD,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC;YAC7B,cAAc,CAAC;gBACb,KAAK;gBACL,IAAI,EAAE,OAAO;gBACb,GAAG,EAAE,aAAa;aACnB,CAAC,CAAC;QACL,CAAC;QACD,GAAG,EAAE,CAAC,GAAW,EAAE,EAAE;YACnB,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/C,OAAO,OAAO,CAAC,aAAa,CAAC,IAAI,aAAa,IAAI,MAAM,CAAC;QAC3D,CAAC;QACD,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC;KAChC,CAAC;AACJ,CAAC,CAAC"}
+{"version":3,"file":"environment.js","sourceRoot":"","sources":["../../../src/script/features/environment.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,EAAE;AACF,uBAAuB;AACvB,sEAAsE;AACtE,2EAA2E;AAC3E,qDAAqD;AACrD,yEAAyE;AACzE,sEAAsE;AACtE,8DAA8D;AAC9D,EAAE;AACF,+CAA+C;AAC/C,0EAA0E;AAC1E,wEAAwE;AACxE,mEAAmE;AACnE,0EAA0E;AAC1E,wEAAwE;AAExE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAiB9D,MAAM,cAAc,GAAG,CAAC,KAAc,EAAU,EAAE;IAChD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,OAA+B,EAC/B,SAA0C,EAC1C,KAAsC,EACtC,UAAqC,EAAE,EACvB,EAAE;IAClB,iEAAiE;IACjE,2CAA2C;IAC3C,MAAM,MAAM,GAA2B,EAAE,GAAG,OAAO,EAAE,CAAC;IACtD,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;IAEtF,MAAM,cAAc,GAAG,CAAC,QAAgC,EAAQ,EAAE;QAChE,IAAI,SAAS,EAAE,CAAC;YACd,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,MAAM;QACN,IAAI;QACJ,GAAG,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,GAAG,EAAE,CAAC,GAAW,EAAE,KAAc,EAAE,EAAE;YACnC,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/C,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,OAAO;YACT,CAAC;YACD,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YAC9C,MAAM,CAAC,aAAa,CAAC,GAAG,eAAe,CAAC;YACxC,cAAc,CAAC;gBACb,KAAK;gBACL,IAAI,EAAE,KAAK;gBACX,GAAG,EAAE,aAAa;gBAClB,KAAK,EAAE,eAAe;aACvB,CAAC,CAAC;QACL,CAAC;QACD,KAAK,EAAE,CAAC,GAAW,EAAE,EAAE;YACrB,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/C,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC,aAAa,IAAI,MAAM,CAAC,EAAE,CAAC;gBACjD,OAAO;YACT,CAAC;YACD,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC;YAC7B,cAAc,CAAC;gBACb,KAAK;gBACL,IAAI,EAAE,OAAO;gBACb,GAAG,EAAE,aAAa;aACnB,CAAC,CAAC;QACL,CAAC;QACD,GAAG,EAAE,CAAC,GAAW,EAAE,EAAE;YACnB,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/C,OAAO,OAAO,CAAC,aAAa,CAAC,IAAI,aAAa,IAAI,MAAM,CAAC;QAC3D,CAAC;QACD,KAAK,EAAE,GAAG,EAAE;YACV,kEAAkE;YAClE,kDAAkD;YAClD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACjC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;gBACnB,cAAc,CAAC;oBACb,KAAK;oBACL,IAAI,EAAE,OAAO;oBACb,GAAG;iBACJ,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC;QAC/B,SAAS,EAAE,CAAC,QAAiB,EAAE,EAAE,CAC/B,eAAe,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;KAC7D,CAAC;AACJ,CAAC,CAAC"}

package/dist/script/features/execution.d.ts

@@ -0,0 +1,17 @@
+import type { ScriptExecutionCapability, ScriptExecutionControl } from "../types.js";
+export interface ExecutionLocation extends Array<string> {
+    /** The last segment in the location array (the current request). */
+    current: string;
+}
+export interface ExecutionApi {
+    setNextRequest: (name: string | null | undefined) => void;
+    skipRequest: () => void;
+    location: ExecutionLocation;
+}
+export interface ExecutionFeature {
+    api: ExecutionApi;
+    /** Snapshot of any control flags the script set. */
+    getControl: () => ScriptExecutionControl;
+}
+export declare const buildExecutionFeature: (capability: ScriptExecutionCapability | undefined) => ExecutionFeature;
+//# sourceMappingURL=execution.d.ts.map

package/dist/script/features/execution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution.d.ts","sourceRoot":"","sources":["../../../src/script/features/execution.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EACV,yBAAyB,EACzB,sBAAsB,EACvB,MAAM,aAAa,CAAC;AAErB,MAAM,WAAW,iBAAkB,SAAQ,KAAK,CAAC,MAAM,CAAC;IACtD,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,KAAK,IAAI,CAAC;IAC1D,WAAW,EAAE,MAAM,IAAI,CAAC;IACxB,QAAQ,EAAE,iBAAiB,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,YAAY,CAAC;IAClB,oDAAoD;IACpD,UAAU,EAAE,MAAM,sBAAsB,CAAC;CAC1C;AAkBD,eAAO,MAAM,qBAAqB,GAChC,YAAY,yBAAyB,GAAG,SAAS,KAChD,gBA2BF,CAAC"}

package/dist/script/features/execution.js

@@ -0,0 +1,60 @@
+// pm.execution — Postman's collection-runner control surface.
+//
+//   pm.execution.setNextRequest(name | null)
+//     Tell the runner to jump to a named request after this one (or
+//     `null` to stop the branch). Has no effect outside a runner — the
+//     host is free to ignore the flag for ad-hoc Send.
+//
+//   pm.execution.skipRequest()
+//     Only meaningful in a pre-request script. Sets a flag that causes
+//     the runner to skip the HTTP call entirely. The Tests script then
+//     does NOT run either.
+//
+//   pm.execution.location / .location.current
+//     A path-like array of segment strings (e.g. ["Smoke",
+//     "Authentication", "Login"]) and the last segment as `.current`,
+//     so users can pivot behaviour by location.
+//
+// Why this lives separately from `pm.node`:
+//   pm.node was a Callman-specific scenario-flow accessor. pm.execution
+//   is the Postman-named surface. We expose both — pm.node stays for
+//   back-compat, pm.execution is preferred going forward.
+const buildLocation = (segments) => {
+    const arr = Array.isArray(segments) ? [...segments] : [];
+    const current = arr.length > 0 ? arr[arr.length - 1] : "";
+    // Augment the array with a `.current` getter. Using
+    // Object.defineProperty keeps it non-enumerable so JSON.stringify
+    // still produces a plain array.
+    Object.defineProperty(arr, "current", {
+        configurable: true,
+        enumerable: false,
+        get: () => current,
+    });
+    return arr;
+};
+export const buildExecutionFeature = (capability) => {
+    const state = {
+        nextRequest: undefined,
+        skipRequested: false,
+    };
+    const location = buildLocation(capability?.location);
+    const api = {
+        setNextRequest: (name) => {
+            if (name === null || name === undefined) {
+                state.nextRequest = null;
+                return;
+            }
+            const trimmed = String(name).trim();
+            state.nextRequest = trimmed.length > 0 ? trimmed : null;
+        },
+        skipRequest: () => {
+            state.skipRequested = true;
+        },
+        location,
+    };
+    return {
+        api,
+        getControl: () => ({ ...state }),
+    };
+};
+//# sourceMappingURL=execution.js.map

package/dist/script/features/execution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution.js","sourceRoot":"","sources":["../../../src/script/features/execution.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,EAAE;AACF,6CAA6C;AAC7C,oEAAoE;AACpE,uEAAuE;AACvE,uDAAuD;AACvD,EAAE;AACF,+BAA+B;AAC/B,uEAAuE;AACvE,uEAAuE;AACvE,2BAA2B;AAC3B,EAAE;AACF,8CAA8C;AAC9C,2DAA2D;AAC3D,sEAAsE;AACtE,gDAAgD;AAChD,EAAE;AACF,4CAA4C;AAC5C,wEAAwE;AACxE,qEAAqE;AACrE,0DAA0D;AAwB1D,MAAM,aAAa,GAAG,CACpB,QAA8B,EACX,EAAE;IACrB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,oDAAoD;IACpD,kEAAkE;IAClE,gCAAgC;IAChC,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,SAAS,EAAE;QACpC,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,KAAK;QACjB,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO;KACnB,CAAC,CAAC;IACH,OAAO,GAAwB,CAAC;AAClC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,UAAiD,EAC/B,EAAE;IACpB,MAAM,KAAK,GAA2B;QACpC,WAAW,EAAE,SAAS;QACtB,aAAa,EAAE,KAAK;KACrB,CAAC;IAEF,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAErD,MAAM,GAAG,GAAiB;QACxB,cAAc,EAAE,CAAC,IAAI,EAAE,EAAE;YACvB,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACxC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC;gBACzB,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YACpC,KAAK,CAAC,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1D,CAAC;QACD,WAAW,EAAE,GAAG,EAAE;YAChB,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC;QAC7B,CAAC;QACD,QAAQ;KACT,CAAC;IAEF,OAAO;QACL,GAAG;QACH,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC;KACjC,CAAC;AACJ,CAAC,CAAC"}

package/dist/script/features/headerList.d.ts

@@ -0,0 +1,44 @@
+export interface HeaderEntry {
+    key: string;
+    value: string;
+    description?: string;
+}
+export interface HeaderListMethods {
+    /** Case-insensitive value lookup. Returns the first matching value, or
+     * `undefined` if no header with that name exists. */
+    get(name: string): string | undefined;
+    /** Case-insensitive presence check. */
+    has(name: string): boolean;
+    /** Entry at numeric index, or undefined if out of range. */
+    idx(index: number): HeaderEntry | undefined;
+    /** Append an entry (allows duplicate names — same as Postman). */
+    add(spec: HeaderEntry | Record<string, unknown>): void;
+    /** Replace entries with the same name (case-insensitive), or append if
+     * absent. Always leaves at most one entry with that name. */
+    upsert(spec: HeaderEntry | Record<string, unknown>): void;
+    /** Remove every entry whose name matches (case-insensitive). */
+    remove(name: string): void;
+    /** Snapshot of all entries as a fresh array. */
+    all(): HeaderEntry[];
+    /** Postman-compat alias for `all()`. */
+    toJSON(): HeaderEntry[];
+    /** Iterator over entries (Postman HeaderList is iterable). */
+    [Symbol.iterator](): IterableIterator<HeaderEntry>;
+}
+export type HeaderList = HeaderListMethods & Record<string, string>;
+/**
+ * Build a Proxy-wrapped HeaderList. Bracket access reads / writes as if the
+ * value were a plain `Record<string, string>` (case-sensitive, exact key
+ * match). The HeaderList methods (`get`, `has`, `add`, ...) are exposed
+ * directly on the wrapper.
+ */
+export declare const createHeaderList: (initial?: HeaderEntry[] | Record<string, string>, options?: {
+    readOnly?: boolean;
+}) => HeaderList;
+/**
+ * Best-effort extraction of the underlying entry list, used by the
+ * request-state serialiser. Falls back to `Object.entries` for back-compat
+ * with any external callers that still pass a plain record.
+ */
+export declare const headerListEntries: (value: HeaderList | Record<string, string>) => HeaderEntry[];
+//# sourceMappingURL=headerList.d.ts.map

package/dist/script/features/headerList.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"headerList.d.ts","sourceRoot":"","sources":["../../../src/script/features/headerList.ts"],"names":[],"mappings":"AAkCA,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC;yDACqD;IACrD,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACtC,uCAAuC;IACvC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3B,4DAA4D;IAC5D,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAAC;IAC5C,kEAAkE;IAClE,GAAG,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACvD;iEAC6D;IAC7D,MAAM,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1D,gEAAgE;IAChE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,gDAAgD;IAChD,GAAG,IAAI,WAAW,EAAE,CAAC;IACrB,wCAAwC;IACxC,MAAM,IAAI,WAAW,EAAE,CAAC;IACxB,8DAA8D;IAC9D,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;CACpD;AAED,MAAM,MAAM,UAAU,GAAG,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AA8KpE;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,GAC3B,UAAS,WAAW,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,EACpD,UAAS;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAO,KACnC,UAwFF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAC5B,OAAO,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KACzC,WAAW,EAab,CAAC"}

package/dist/script/features/headerList.js

@@ -0,0 +1,284 @@
+// HeaderList — Postman-compatible header / query parameter wrapper.
+//
+// Background. Older callman-core releases exposed `pm.request.headers` and
+// `pm.response.headers` as plain `Record<string, string>` objects. Many real
+// Postman scripts assume a richer `HeaderList` shape:
+//
+//   pm.request.headers.add({ key, value, description? })
+//   pm.request.headers.upsert({ key, value, description? })
+//   pm.request.headers.remove(name)
+//   pm.request.headers.has(name)             // case-insensitive
+//   pm.request.headers.get(name)             // case-insensitive
+//   pm.request.headers.idx(i)                // entry at index
+//   pm.request.headers.all()                 // [{ key, value, description }]
+//   for (const h of pm.request.headers) ...  // iterable
+//
+// The class below provides both shapes through a Proxy: existing scripts that
+// rely on bracket access (`headers["X-Custom"]`, `Object.keys(headers)`,
+// `Object.entries(headers)`) keep working bit-for-bit, while new scripts can
+// call the Postman methods on the same object.
+//
+// Mutability:
+//   - Request headers are writable. `setHeader` / `add` / `upsert` mutate the
+//     internal list and the changes are observed by `toRequestState()` when
+//     the script completes.
+//   - Response headers are constructed read-only — `add` / `upsert` / `remove`
+//     throw to preserve the immutability of an already-received response.
+//
+// Case sensitivity rules:
+//   - Lookups via `.get()`, `.has()`, `.remove()`, `.upsert()` are
+//     case-INSENSITIVE. This matches Postman and is the HTTP semantic.
+//   - Bracket access (`headers["X-Custom"]`) is case-SENSITIVE for
+//     back-compat with older Callman scripts that depended on exact-case
+//     keys derived from the previous Record<string, string> shape.
+const METHOD_KEYS = new Set([
+    "get",
+    "has",
+    "idx",
+    "add",
+    "upsert",
+    "remove",
+    "all",
+    "toJSON",
+    "isReadOnly",
+]);
+const normaliseSpec = (spec) => {
+    if (spec === null || typeof spec !== "object") {
+        throw new TypeError("HeaderList: expected { key, value, description? } object");
+    }
+    const key = String(spec.key ?? "").trim();
+    if (!key) {
+        throw new TypeError("HeaderList: header key must be a non-empty string");
+    }
+    const value = spec.value;
+    const description = spec.description;
+    return {
+        key,
+        value: value === undefined || value === null ? "" : String(value),
+        description: typeof description === "string" ? description : undefined,
+    };
+};
+const stringifyValue = (value) => value === undefined || value === null ? "" : String(value);
+class HeaderListImpl {
+    entries = [];
+    readOnly;
+    constructor(initial, readOnly = false) {
+        for (const entry of initial) {
+            this.entries.push({ ...entry });
+        }
+        this.readOnly = readOnly;
+    }
+    guardWritable() {
+        if (this.readOnly) {
+            throw new Error("Cannot mutate response headers — they are read-only after the response is captured.");
+        }
+    }
+    get(name) {
+        const target = String(name ?? "")
+            .trim()
+            .toLowerCase();
+        if (!target)
+            return undefined;
+        for (const entry of this.entries) {
+            if (entry.key.toLowerCase() === target) {
+                return entry.value;
+            }
+        }
+        return undefined;
+    }
+    has(name) {
+        return this.get(name) !== undefined;
+    }
+    idx(index) {
+        if (!Number.isInteger(index) || index < 0 || index >= this.entries.length) {
+            return undefined;
+        }
+        return { ...this.entries[index] };
+    }
+    add(spec) {
+        this.guardWritable();
+        this.entries.push(normaliseSpec(spec));
+    }
+    upsert(spec) {
+        this.guardWritable();
+        const next = normaliseSpec(spec);
+        const target = next.key.toLowerCase();
+        const replaceIndex = this.entries.findIndex((entry) => entry.key.toLowerCase() === target);
+        if (replaceIndex >= 0) {
+            this.entries[replaceIndex] = next;
+            // Drop any further duplicates so upsert leaves a single entry.
+            for (let i = this.entries.length - 1; i > replaceIndex; i -= 1) {
+                if (this.entries[i].key.toLowerCase() === target) {
+                    this.entries.splice(i, 1);
+                }
+            }
+            return;
+        }
+        this.entries.push(next);
+    }
+    remove(name) {
+        this.guardWritable();
+        const target = String(name ?? "")
+            .trim()
+            .toLowerCase();
+        if (!target)
+            return;
+        for (let i = this.entries.length - 1; i >= 0; i -= 1) {
+            if (this.entries[i].key.toLowerCase() === target) {
+                this.entries.splice(i, 1);
+            }
+        }
+    }
+    all() {
+        return this.entries.map((entry) => ({ ...entry }));
+    }
+    toJSON() {
+        return this.all();
+    }
+    *[Symbol.iterator]() {
+        for (const entry of this.entries) {
+            yield { ...entry };
+        }
+    }
+    // ── Internal hooks used by the Proxy wrapper ──────────────────────────
+    __rawEntries() {
+        return this.entries;
+    }
+    __setRaw(key, value) {
+        this.guardWritable();
+        const normalisedKey = String(key ?? "").trim();
+        if (!normalisedKey)
+            return;
+        // Bracket-assignment is treated as upsert with EXACT case so that
+        // Object.keys(headers) and headers[k] readbacks see the user's chosen
+        // case — matches the legacy Record<string, string> behaviour.
+        const stringValue = stringifyValue(value);
+        const existing = this.entries.findIndex((entry) => entry.key === normalisedKey);
+        if (existing >= 0) {
+            this.entries[existing].value = stringValue;
+            return;
+        }
+        this.entries.push({ key: normalisedKey, value: stringValue });
+    }
+    __deleteRaw(key) {
+        this.guardWritable();
+        const normalisedKey = String(key ?? "").trim();
+        if (!normalisedKey)
+            return false;
+        const idx = this.entries.findIndex((entry) => entry.key === normalisedKey);
+        if (idx >= 0) {
+            this.entries.splice(idx, 1);
+            return true;
+        }
+        return false;
+    }
+}
+/**
+ * Build a Proxy-wrapped HeaderList. Bracket access reads / writes as if the
+ * value were a plain `Record<string, string>` (case-sensitive, exact key
+ * match). The HeaderList methods (`get`, `has`, `add`, ...) are exposed
+ * directly on the wrapper.
+ */
+export const createHeaderList = (initial = [], options = {}) => {
+    const entries = Array.isArray(initial)
+        ? initial.map((entry) => ({ ...entry }))
+        : Object.entries(initial).map(([key, value]) => ({
+            key,
+            value: stringifyValue(value),
+        }));
+    const impl = new HeaderListImpl(entries, options.readOnly ?? false);
+    return new Proxy(impl, {
+        get(target, prop, receiver) {
+            // Hand back methods / iterator unchanged.
+            if (typeof prop === "symbol") {
+                return Reflect.get(target, prop, receiver);
+            }
+            if (METHOD_KEYS.has(prop) || prop in target) {
+                const value = Reflect.get(target, prop, receiver);
+                if (typeof value === "function") {
+                    return value.bind(target);
+                }
+                return value;
+            }
+            // String prop → look up as a header name (case-sensitive bracket
+            // access for back-compat with the previous Record shape).
+            const raw = target.__rawEntries();
+            for (const entry of raw) {
+                if (entry.key === prop) {
+                    return entry.value;
+                }
+            }
+            return undefined;
+        },
+        set(target, prop, value, receiver) {
+            if (typeof prop === "symbol" || METHOD_KEYS.has(prop)) {
+                return Reflect.set(target, prop, value, receiver);
+            }
+            target.__setRaw(prop, value);
+            return true;
+        },
+        has(target, prop) {
+            if (typeof prop === "symbol" || METHOD_KEYS.has(prop) || prop in target) {
+                return Reflect.has(target, prop);
+            }
+            const raw = target.__rawEntries();
+            return raw.some((entry) => entry.key === prop);
+        },
+        deleteProperty(target, prop) {
+            if (typeof prop === "symbol" || METHOD_KEYS.has(prop)) {
+                return Reflect.deleteProperty(target, prop);
+            }
+            return target.__deleteRaw(String(prop));
+        },
+        ownKeys(target) {
+            // Object.keys / Object.entries / for-in see only the header names.
+            // The HeaderList methods stay non-enumerable so they don't pollute
+            // serialisation.
+            const raw = target.__rawEntries();
+            const seen = new Set();
+            const keys = [];
+            for (const entry of raw) {
+                if (!seen.has(entry.key)) {
+                    seen.add(entry.key);
+                    keys.push(entry.key);
+                }
+            }
+            return keys;
+        },
+        getOwnPropertyDescriptor(target, prop) {
+            if (typeof prop === "symbol") {
+                return Reflect.getOwnPropertyDescriptor(target, prop);
+            }
+            if (METHOD_KEYS.has(prop)) {
+                return undefined;
+            }
+            const raw = target.__rawEntries();
+            const found = raw.find((entry) => entry.key === prop);
+            if (found) {
+                return {
+                    configurable: true,
+                    enumerable: true,
+                    writable: true,
+                    value: found.value,
+                };
+            }
+            return undefined;
+        },
+    });
+};
+/**
+ * Best-effort extraction of the underlying entry list, used by the
+ * request-state serialiser. Falls back to `Object.entries` for back-compat
+ * with any external callers that still pass a plain record.
+ */
+export const headerListEntries = (value) => {
+    if (value &&
+        typeof value.all === "function") {
+        return value.all();
+    }
+    return Object.entries(value).map(([key, raw]) => ({
+        key,
+        value: stringifyValue(raw),
+    }));
+};
+//# sourceMappingURL=headerList.js.map