callman-core 1.7.1 → 1.8.0

package/dist/script/features/responseAssertions.d.ts

@@ -0,0 +1,50 @@
+import { PmAssertion, type AssertionFlags } from "./assertions.js";
+export declare class ResponseAssertion extends PmAssertion {
+    constructor(actual: unknown, flags?: AssertionFlags);
+    get not(): ResponseAssertion;
+    get deep(): ResponseAssertion;
+    get nested(): ResponseAssertion;
+    private decide;
+    private readStatus;
+    private readContentType;
+    private readRawBody;
+    private readJsonBody;
+    private statusInRange;
+    private statusExactly;
+    get ok(): ResponseAssertion;
+    get success(): ResponseAssertion;
+    get info(): ResponseAssertion;
+    get redirection(): ResponseAssertion;
+    get clientError(): ResponseAssertion;
+    get serverError(): ResponseAssertion;
+    get error(): ResponseAssertion;
+    get notFound(): ResponseAssertion;
+    get unauthorized(): ResponseAssertion;
+    get forbidden(): ResponseAssertion;
+    get badRequest(): ResponseAssertion;
+    get rateLimited(): ResponseAssertion;
+    get accepted(): ResponseAssertion;
+    get withBody(): ResponseAssertion;
+    get json(): ResponseAssertion;
+    get xml(): ResponseAssertion;
+    get html(): ResponseAssertion;
+    /**
+     * `.have.body()` — non-empty body.
+     * `.have.body("substring")` — body string contains substring.
+     */
+    body(expected?: unknown): ResponseAssertion;
+    /**
+     * `.have.jsonBody()` — body parses as JSON (non-undefined).
+     * `.have.jsonBody("path.to.field")` — dot-path lookup must exist.
+     * `.have.jsonBody("path.to.field", expected)` — dot-path lookup must
+     * deep-equal `expected`.
+     */
+    jsonBody(path?: unknown, expected?: unknown): ResponseAssertion;
+    /**
+     * `.have.jsonSchema(schema)` — placeholder. Real implementation arrives
+     * in the Phase 2.4 work that bundles ajv. Throws a clear error today so
+     * scripts fail fast rather than silently passing.
+     */
+    jsonSchema(_schema: unknown): ResponseAssertion;
+}
+//# sourceMappingURL=responseAssertions.d.ts.map

package/dist/script/features/responseAssertions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"responseAssertions.d.ts","sourceRoot":"","sources":["../../../src/script/features/responseAssertions.ts"],"names":[],"mappings":"AAkCA,OAAO,EAAE,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAgBnE,qBAAa,iBAAkB,SAAQ,WAAW;gBACpC,MAAM,EAAE,OAAO,EAAE,KAAK,GAAE,cAAmB;IAMvD,IAAa,GAAG,IAAI,iBAAiB,CAKpC;IACD,IAAa,IAAI,IAAI,iBAAiB,CAErC;IACD,IAAa,MAAM,IAAI,iBAAiB,CAKvC;IAGD,OAAO,CAAC,MAAM;IAgBd,OAAO,CAAC,UAAU;IAYlB,OAAO,CAAC,eAAe;IA6BvB,OAAO,CAAC,WAAW;IAgBnB,OAAO,CAAC,YAAY;IAiBpB,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,aAAa;IAUrB,IAAa,EAAE,IAAI,iBAAiB,CAEnC;IAED,IAAI,OAAO,IAAI,iBAAiB,CAE/B;IAED,IAAI,IAAI,IAAI,iBAAiB,CAE5B;IAED,IAAI,WAAW,IAAI,iBAAiB,CAEnC;IAED,IAAI,WAAW,IAAI,iBAAiB,CAEnC;IAED,IAAI,WAAW,IAAI,iBAAiB,CAEnC;IAED,IAAI,KAAK,IAAI,iBAAiB,CAQ7B;IAGD,IAAI,QAAQ,IAAI,iBAAiB,CAEhC;IAED,IAAI,YAAY,IAAI,iBAAiB,CAEpC;IAED,IAAI,SAAS,IAAI,iBAAiB,CAEjC;IAED,IAAI,UAAU,IAAI,iBAAiB,CAElC;IAED,IAAI,WAAW,IAAI,iBAAiB,CAEnC;IAED,IAAI,QAAQ,IAAI,iBAAiB,CAEhC;IAED,IAAI,QAAQ,IAAI,iBAAiB,CAQhC;IAGD,IAAI,IAAI,IAAI,iBAAiB,CAW5B;IAED,IAAI,GAAG,IAAI,iBAAiB,CAW3B;IAED,IAAI,IAAI,IAAI,iBAAiB,CAQ5B;IAGD;;;OAGG;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,iBAAiB;IAiB3C;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,OAAO,GAAG,iBAAiB;IAmC/D;;;;OAIG;IACH,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,iBAAiB;CAKhD"}

package/dist/script/features/responseAssertions.js

@@ -0,0 +1,293 @@
+// ResponseAssertion — Postman-compatible response-shape shortcuts.
+//
+// Extends PmAssertion with the family of getters and methods that scripts
+// reach for on `pm.response.to.*`:
+//
+//   pm.response.to.be.ok               // 2xx
+//   pm.response.to.be.success          // 2xx (alias)
+//   pm.response.to.be.info             // 1xx
+//   pm.response.to.be.redirection      // 3xx
+//   pm.response.to.be.clientError      // 4xx
+//   pm.response.to.be.serverError      // 5xx
+//   pm.response.to.be.notFound         // 404
+//   pm.response.to.be.unauthorized     // 401
+//   pm.response.to.be.forbidden        // 403
+//   pm.response.to.be.badRequest       // 400
+//   pm.response.to.be.rateLimited      // 429
+//
+//   pm.response.to.be.json             // content-type includes application/json
+//   pm.response.to.be.xml              // includes xml
+//   pm.response.to.be.html             // includes html
+//
+//   pm.response.to.have.body(text?)            // substring or non-empty
+//   pm.response.to.have.jsonBody(path?, val?)  // dot-path JSON lookup
+//
+// Each predicate honours `.not` for negation, and returns the assertion so
+// chains keep going: `pm.response.to.be.success.and.have.body("ok")`.
+//
+// Back-compat note: PmAssertion already exposes a `.ok` getter that checks
+// truthiness. We override it here to the 2xx range semantic Postman uses.
+// Existing Callman scripts that called `pm.response.to.be.ok` previously
+// always passed (a ResponseApi object is truthy by construction), so the
+// new behaviour is strictly more useful — failing responses now fail the
+// assertion as they should.
+import { PmAssertion } from "./assertions.js";
+import { safeGet } from "../../utils/get.js";
+const isObject = (value) => typeof value === "object" && value !== null;
+const formatValue = (value) => {
+    if (typeof value === "string")
+        return `"${value}"`;
+    if (value === undefined)
+        return "undefined";
+    try {
+        return JSON.stringify(value);
+    }
+    catch {
+        return String(value);
+    }
+};
+export class ResponseAssertion extends PmAssertion {
+    constructor(actual, flags = {}) {
+        super(actual, flags);
+    }
+    // ── Modifier getters preserve the subclass so the response-specific
+    // predicates stay available after .not / .deep / .nested ───────────────
+    get not() {
+        return new ResponseAssertion(this.actual, {
+            ...this.flags,
+            negated: !this.flags.negated,
+        });
+    }
+    get deep() {
+        return new ResponseAssertion(this.actual, { ...this.flags, deep: true });
+    }
+    get nested() {
+        return new ResponseAssertion(this.actual, {
+            ...this.flags,
+            nested: true,
+        });
+    }
+    // ── Internal assertion + status helpers ────────────────────────────────
+    decide(pass, positiveMessage, negativeMessage) {
+        const finalPass = this.flags.negated ? !pass : pass;
+        if (!finalPass) {
+            throw new Error(this.flags.negated
+                ? negativeMessage ?? `Expected NOT: ${positiveMessage}`
+                : positiveMessage);
+        }
+        return this;
+    }
+    readStatus() {
+        if (isObject(this.actual)) {
+            const raw = this.actual.status;
+            if (typeof raw === "number" && Number.isFinite(raw)) {
+                return raw;
+            }
+        }
+        throw new Error("Response shortcut requires a response object (missing numeric `status`)");
+    }
+    readContentType() {
+        if (!isObject(this.actual))
+            return "";
+        const direct = this.actual.contentType;
+        if (typeof direct === "string" && direct.length > 0) {
+            return direct.toLowerCase();
+        }
+        // Fall back to looking it up in the headers HeaderList / record.
+        const headers = this.actual.headers;
+        if (isObject(headers)) {
+            // HeaderList exposes a case-insensitive .get() — prefer it.
+            const headerGetter = headers.get;
+            if (typeof headerGetter === "function") {
+                const got = headerGetter.call(headers, "content-type");
+                if (typeof got === "string")
+                    return got.toLowerCase();
+            }
+            else {
+                const lookup = Object.entries(headers).find(([key]) => key.toLowerCase() === "content-type");
+                if (lookup && typeof lookup[1] === "string") {
+                    return lookup[1].toLowerCase();
+                }
+            }
+        }
+        return "";
+    }
+    readRawBody() {
+        if (!isObject(this.actual))
+            return "";
+        const raw = this.actual.rawBody;
+        if (typeof raw === "string")
+            return raw;
+        const body = this.actual.body;
+        if (typeof body === "string")
+            return body;
+        if (body !== null && body !== undefined) {
+            try {
+                return JSON.stringify(body);
+            }
+            catch {
+                return String(body);
+            }
+        }
+        return "";
+    }
+    readJsonBody() {
+        if (!isObject(this.actual))
+            return undefined;
+        const jsonFn = this.actual.json;
+        if (typeof jsonFn === "function") {
+            try {
+                return jsonFn.call(this.actual);
+            }
+            catch {
+                // fall through to other shapes
+            }
+        }
+        const direct = this.actual.jsonBody;
+        if (direct !== undefined)
+            return direct;
+        const body = this.actual.body;
+        if (body !== undefined)
+            return body;
+        return this.actual.data;
+    }
+    statusInRange(min, max, label) {
+        const status = this.readStatus();
+        return this.decide(status >= min && status <= max, `Expected status ${status} to be ${label} (${min}-${max})`, `Expected status ${status} NOT to be ${label} (${min}-${max})`);
+    }
+    statusExactly(expected, label) {
+        const status = this.readStatus();
+        return this.decide(status === expected, `Expected status ${status} to be ${expected} (${label})`, `Expected status ${status} NOT to be ${expected} (${label})`);
+    }
+    // ── Status-range predicates ───────────────────────────────────────────
+    get ok() {
+        return this.statusInRange(200, 299, "OK / 2xx");
+    }
+    get success() {
+        return this.statusInRange(200, 299, "success / 2xx");
+    }
+    get info() {
+        return this.statusInRange(100, 199, "informational / 1xx");
+    }
+    get redirection() {
+        return this.statusInRange(300, 399, "redirection / 3xx");
+    }
+    get clientError() {
+        return this.statusInRange(400, 499, "client error / 4xx");
+    }
+    get serverError() {
+        return this.statusInRange(500, 599, "server error / 5xx");
+    }
+    get error() {
+        // Postman's `.error` matches any 4xx OR 5xx response.
+        const status = this.readStatus();
+        return this.decide(status >= 400 && status <= 599, `Expected status ${status} to be an error (4xx-5xx)`, `Expected status ${status} NOT to be an error (4xx-5xx)`);
+    }
+    // ── Status-exact predicates ───────────────────────────────────────────
+    get notFound() {
+        return this.statusExactly(404, "Not Found");
+    }
+    get unauthorized() {
+        return this.statusExactly(401, "Unauthorized");
+    }
+    get forbidden() {
+        return this.statusExactly(403, "Forbidden");
+    }
+    get badRequest() {
+        return this.statusExactly(400, "Bad Request");
+    }
+    get rateLimited() {
+        return this.statusExactly(429, "Too Many Requests / rate limited");
+    }
+    get accepted() {
+        return this.statusExactly(202, "Accepted");
+    }
+    get withBody() {
+        // Postman shorthand — non-empty body.
+        const body = this.readRawBody();
+        return this.decide(body.length > 0, "Expected response to have a body", "Expected response NOT to have a body");
+    }
+    // ── Content-type predicates ───────────────────────────────────────────
+    get json() {
+        const ct = this.readContentType();
+        const isJson = ct.includes("application/json") ||
+            ct.includes("+json") ||
+            ct.includes("text/json");
+        return this.decide(isJson, `Expected response Content-Type to be JSON, got "${ct || "(none)"}"`, `Expected response Content-Type NOT to be JSON, got "${ct || "(none)"}"`);
+    }
+    get xml() {
+        const ct = this.readContentType();
+        const isXml = ct.includes("application/xml") ||
+            ct.includes("text/xml") ||
+            ct.includes("+xml");
+        return this.decide(isXml, `Expected response Content-Type to be XML, got "${ct || "(none)"}"`, `Expected response Content-Type NOT to be XML, got "${ct || "(none)"}"`);
+    }
+    get html() {
+        const ct = this.readContentType();
+        const isHtml = ct.includes("text/html");
+        return this.decide(isHtml, `Expected response Content-Type to be HTML, got "${ct || "(none)"}"`, `Expected response Content-Type NOT to be HTML, got "${ct || "(none)"}"`);
+    }
+    // ── Body / payload assertions ─────────────────────────────────────────
+    /**
+     * `.have.body()` — non-empty body.
+     * `.have.body("substring")` — body string contains substring.
+     */
+    body(expected) {
+        const raw = this.readRawBody();
+        if (expected === undefined) {
+            return this.decide(raw.length > 0, "Expected response to have a body", "Expected response NOT to have a body");
+        }
+        const needle = String(expected);
+        return this.decide(raw.includes(needle), `Expected response body to include ${formatValue(needle)}`, `Expected response body NOT to include ${formatValue(needle)}`);
+    }
+    /**
+     * `.have.jsonBody()` — body parses as JSON (non-undefined).
+     * `.have.jsonBody("path.to.field")` — dot-path lookup must exist.
+     * `.have.jsonBody("path.to.field", expected)` — dot-path lookup must
+     * deep-equal `expected`.
+     */
+    jsonBody(path, expected) {
+        const json = this.readJsonBody();
+        if (path === undefined) {
+            return this.decide(json !== undefined && json !== null, "Expected response body to be valid JSON", "Expected response body NOT to be valid JSON");
+        }
+        if (typeof path !== "string") {
+            throw new TypeError("jsonBody(path) — path must be a string");
+        }
+        const lookup = safeGet(json, path);
+        if (arguments.length < 2) {
+            return this.decide(lookup.exists, `Expected response body to have JSON path "${path}"`, `Expected response body NOT to have JSON path "${path}"`);
+        }
+        // Two-arg form: assert existence + deep equality.
+        if (!lookup.exists) {
+            return this.decide(false, `Expected response body to have JSON path "${path}"`, `Expected response body NOT to have JSON path "${path}"`);
+        }
+        return this.decide(deepEqual(lookup.value, expected), `Expected JSON path "${path}" to equal ${formatValue(expected)}, got ${formatValue(lookup.value)}`, `Expected JSON path "${path}" NOT to equal ${formatValue(expected)}`);
+    }
+    /**
+     * `.have.jsonSchema(schema)` — placeholder. Real implementation arrives
+     * in the Phase 2.4 work that bundles ajv. Throws a clear error today so
+     * scripts fail fast rather than silently passing.
+     */
+    jsonSchema(_schema) {
+        throw new Error("pm.response.to.have.jsonSchema is not yet supported — Phase 2.4 will land ajv-backed schema validation. Use pm.expect with manual checks for now.");
+    }
+}
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const deepEqual = (left, right) => {
+    if (Object.is(left, right))
+        return true;
+    if (Array.isArray(left) && Array.isArray(right)) {
+        return (left.length === right.length &&
+            left.every((value, index) => deepEqual(value, right[index])));
+    }
+    if (isRecord(left) && isRecord(right)) {
+        const leftKeys = Object.keys(left);
+        const rightKeys = Object.keys(right);
+        return (leftKeys.length === rightKeys.length &&
+            leftKeys.every((key) => Object.prototype.hasOwnProperty.call(right, key) &&
+                deepEqual(left[key], right[key])));
+    }
+    return false;
+};
+//# sourceMappingURL=responseAssertions.js.map

package/dist/script/features/responseAssertions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"responseAssertions.js","sourceRoot":"","sources":["../../../src/script/features/responseAssertions.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,EAAE;AACF,0EAA0E;AAC1E,mCAAmC;AACnC,EAAE;AACF,8CAA8C;AAC9C,sDAAsD;AACtD,8CAA8C;AAC9C,8CAA8C;AAC9C,8CAA8C;AAC9C,8CAA8C;AAC9C,8CAA8C;AAC9C,8CAA8C;AAC9C,8CAA8C;AAC9C,8CAA8C;AAC9C,8CAA8C;AAC9C,EAAE;AACF,iFAAiF;AACjF,uDAAuD;AACvD,wDAAwD;AACxD,EAAE;AACF,yEAAyE;AACzE,uEAAuE;AACvE,EAAE;AACF,2EAA2E;AAC3E,sEAAsE;AACtE,EAAE;AACF,2EAA2E;AAC3E,0EAA0E;AAC1E,yEAAyE;AACzE,yEAAyE;AACzE,yEAAyE;AACzE,4BAA4B;AAE5B,OAAO,EAAE,WAAW,EAAuB,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CACpE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AAE9C,MAAM,WAAW,GAAG,CAAC,KAAc,EAAU,EAAE;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,KAAK,GAAG,CAAC;IACnD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,WAAW,CAAC;IAC5C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,OAAO,iBAAkB,SAAQ,WAAW;IAChD,YAAY,MAAe,EAAE,QAAwB,EAAE;QACrD,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACvB,CAAC;IAED,qEAAqE;IACrE,yEAAyE;IACzE,IAAa,GAAG;QACd,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE;YACxC,GAAG,IAAI,CAAC,KAAK;YACb,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO;SAC7B,CAAC,CAAC;IACL,CAAC;IACD,IAAa,IAAI;QACf,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,IAAa,MAAM;QACjB,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE;YACxC,GAAG,IAAI,CAAC,KAAK;YACb,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;IACL,CAAC;IAED,0EAA0E;IAClE,MAAM,CACZ,IAAa,EACb,eAAuB,EACvB,eAAwB;QAExB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QACpD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,IAAI,CAAC,KAAK,CAAC,OAAO;gBAChB,CAAC,CAAC,eAAe,IAAI,iBAAiB,eAAe,EAAE;gBACvD,CAAC,CAAC,eAAe,CACpB,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,UAAU;QAChB,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAI,IAAI,CAAC,MAA+B,CAAC,MAAM,CAAC;YACzD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpD,OAAO,GAAG,CAAC;YACb,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IAEO,eAAe;QACrB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QACtC,MAAM,MAAM,GAAI,IAAI,CAAC,MAAoC,CAAC,WAAW,CAAC;QACtE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,OAAO,MAAM,CAAC,WAAW,EAAE,CAAC;QAC9B,CAAC;QACD,iEAAiE;QACjE,MAAM,OAAO,GAAI,IAAI,CAAC,MAAgC,CAAC,OAAO,CAAC;QAC/D,IAAI,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACtB,4DAA4D;YAC5D,MAAM,YAAY,GAAI,OAA6B,CAAC,GAAG,CAAC;YACxD,IAAI,OAAO,YAAY,KAAK,UAAU,EAAE,CAAC;gBACvC,MAAM,GAAG,GAAI,YAA0C,CAAC,IAAI,CAC1D,OAAO,EACP,cAAc,CACf,CAAC;gBACF,IAAI,OAAO,GAAG,KAAK,QAAQ;oBAAE,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC;YACxD,CAAC;iBAAM,CAAC;gBACN,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAkC,CAAC,CAAC,IAAI,CACpE,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,cAAc,CAChD,CAAC;gBACF,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;oBAC5C,OAAQ,MAAM,CAAC,CAAC,CAAY,CAAC,WAAW,EAAE,CAAC;gBAC7C,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAEO,WAAW;QACjB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QACtC,MAAM,GAAG,GAAI,IAAI,CAAC,MAAgD,CAAC,OAAO,CAAC;QAC3E,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,GAAG,CAAC;QACxC,MAAM,IAAI,GAAI,IAAI,CAAC,MAA6B,CAAC,IAAI,CAAC;QACtD,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC1C,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACxC,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAEO,YAAY;QAClB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;QAC7C,MAAM,MAAM,GAAI,IAAI,CAAC,MAA6B,CAAC,IAAI,CAAC;QACxD,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,OAAQ,MAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC;gBACP,+BAA+B;YACjC,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAI,IAAI,CAAC,MAAiC,CAAC,QAAQ,CAAC;QAChE,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;QACxC,MAAM,IAAI,GAAI,IAAI,CAAC,MAA6C,CAAC,IAAI,CAAC;QACtE,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACpC,OAAQ,IAAI,CAAC,MAA6B,CAAC,IAAI,CAAC;IAClD,CAAC;IAEO,aAAa,CAAC,GAAW,EAAE,GAAW,EAAE,KAAa;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,MAAM,CAChB,MAAM,IAAI,GAAG,IAAI,MAAM,IAAI,GAAG,EAC9B,mBAAmB,MAAM,UAAU,KAAK,KAAK,GAAG,IAAI,GAAG,GAAG,EAC1D,mBAAmB,MAAM,cAAc,KAAK,KAAK,GAAG,IAAI,GAAG,GAAG,CAC/D,CAAC;IACJ,CAAC;IAEO,aAAa,CAAC,QAAgB,EAAE,KAAa;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,MAAM,CAChB,MAAM,KAAK,QAAQ,EACnB,mBAAmB,MAAM,UAAU,QAAQ,KAAK,KAAK,GAAG,EACxD,mBAAmB,MAAM,cAAc,QAAQ,KAAK,KAAK,GAAG,CAC7D,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,IAAa,EAAE;QACb,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,KAAK;QACP,sDAAsD;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,MAAM,CAChB,MAAM,IAAI,GAAG,IAAI,MAAM,IAAI,GAAG,EAC9B,mBAAmB,MAAM,2BAA2B,EACpD,mBAAmB,MAAM,+BAA+B,CACzD,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IACjD,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,kCAAkC,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC7C,CAAC;IAED,IAAI,QAAQ;QACV,sCAAsC;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC,MAAM,CAChB,IAAI,CAAC,MAAM,GAAG,CAAC,EACf,kCAAkC,EAClC,sCAAsC,CACvC,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,IAAI,IAAI;QACN,MAAM,EAAE,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAClC,MAAM,MAAM,GACV,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YAC/B,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC;YACpB,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC3B,OAAO,IAAI,CAAC,MAAM,CAChB,MAAM,EACN,mDAAmD,EAAE,IAAI,QAAQ,GAAG,EACpE,uDAAuD,EAAE,IAAI,QAAQ,GAAG,CACzE,CAAC;IACJ,CAAC;IAED,IAAI,GAAG;QACL,MAAM,EAAE,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAClC,MAAM,KAAK,GACT,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YAC9B,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC;YACvB,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtB,OAAO,IAAI,CAAC,MAAM,CAChB,KAAK,EACL,kDAAkD,EAAE,IAAI,QAAQ,GAAG,EACnE,sDAAsD,EAAE,IAAI,QAAQ,GAAG,CACxE,CAAC;IACJ,CAAC;IAED,IAAI,IAAI;QACN,MAAM,EAAE,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC,MAAM,CAChB,MAAM,EACN,mDAAmD,EAAE,IAAI,QAAQ,GAAG,EACpE,uDAAuD,EAAE,IAAI,QAAQ,GAAG,CACzE,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE;;;OAGG;IACH,IAAI,CAAC,QAAkB;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,MAAM,CAChB,GAAG,CAAC,MAAM,GAAG,CAAC,EACd,kCAAkC,EAClC,sCAAsC,CACvC,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC,MAAM,CAChB,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EACpB,qCAAqC,WAAW,CAAC,MAAM,CAAC,EAAE,EAC1D,yCAAyC,WAAW,CAAC,MAAM,CAAC,EAAE,CAC/D,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,IAAc,EAAE,QAAkB;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACjC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,MAAM,CAChB,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,EACnC,yCAAyC,EACzC,6CAA6C,CAC9C,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,MAAM,CAChB,MAAM,CAAC,MAAM,EACb,6CAA6C,IAAI,GAAG,EACpD,iDAAiD,IAAI,GAAG,CACzD,CAAC;QACJ,CAAC;QACD,kDAAkD;QAClD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,MAAM,CAChB,KAAK,EACL,6CAA6C,IAAI,GAAG,EACpD,iDAAiD,IAAI,GAAG,CACzD,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAChB,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,EACjC,uBAAuB,IAAI,cAAc,WAAW,CAAC,QAAQ,CAAC,SAAS,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAClG,uBAAuB,IAAI,kBAAkB,WAAW,CAAC,QAAQ,CAAC,EAAE,CACrE,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,UAAU,CAAC,OAAgB;QACzB,MAAM,IAAI,KAAK,CACb,mJAAmJ,CACpJ,CAAC;IACJ,CAAC;CACF;AAED,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CACpE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAEvE,MAAM,SAAS,GAAG,CAAC,IAAa,EAAE,KAAc,EAAW,EAAE;IAC3D,IAAI,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,CACL,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;YAC5B,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAC7D,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,OAAO,CACL,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;YACpC,QAAQ,CAAC,KAAK,CACZ,CAAC,GAAG,EAAE,EAAE,CACN,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC;gBAChD,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CACnC,CACF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC"}

package/dist/script/features/timers.d.ts

@@ -0,0 +1,17 @@
+export interface TimerApi {
+    setTimeout: (handler: unknown, delay?: unknown, ...args: unknown[]) => number;
+    clearTimeout: (id: unknown) => void;
+    setInterval: (handler: unknown, delay?: unknown, ...args: unknown[]) => number;
+    clearInterval: (id: unknown) => void;
+}
+export interface TimerFeature {
+    api: TimerApi;
+    /** Cancel every still-pending timer. Idempotent. */
+    dispose(): void;
+    /** Number of timers ever created — informational, for tests. */
+    totalCreated(): number;
+    /** Number of currently-active timers (not yet fired or cleared). */
+    activeCount(): number;
+}
+export declare const buildTimerFeature: () => TimerFeature;
+//# sourceMappingURL=timers.d.ts.map

package/dist/script/features/timers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"timers.d.ts","sourceRoot":"","sources":["../../../src/script/features/timers.ts"],"names":[],"mappings":"AA2BA,MAAM,WAAW,QAAQ;IACvB,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,MAAM,CAAC;IAC9E,YAAY,EAAE,CAAC,EAAE,EAAE,OAAO,KAAK,IAAI,CAAC;IACpC,WAAW,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,MAAM,CAAC;IAC/E,aAAa,EAAE,CAAC,EAAE,EAAE,OAAO,KAAK,IAAI,CAAC;CACtC;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,QAAQ,CAAC;IACd,oDAAoD;IACpD,OAAO,IAAI,IAAI,CAAC;IAChB,gEAAgE;IAChE,YAAY,IAAI,MAAM,CAAC;IACvB,oEAAoE;IACpE,WAAW,IAAI,MAAM,CAAC;CACvB;AAeD,eAAO,MAAM,iBAAiB,QAAO,YAsHpC,CAAC"}

package/dist/script/features/timers.js

@@ -0,0 +1,152 @@
+// Timer registry — exposes `setTimeout` / `clearTimeout` /
+// `setInterval` / `clearInterval` inside the sandbox without leaking
+// pending callbacks past the script's lifetime.
+//
+// Why this matters: Postman scripts routinely use
+//   await new Promise(r => setTimeout(r, 1000))
+// for retry / poll patterns. We had this BLOCKED, so any such script
+// died with `ReferenceError: setTimeout is not defined`. Re-enabling
+// the globals naively would let a runaway `setInterval(fn, 100)`
+// keep firing long after the script completed.
+//
+// The feature builds per-execution wrappers that:
+//   • register each timer id in a Map
+//   • cap each delay at MAX_TIMER_DELAY_MS (60 s) so a buggy script
+//     can't park work forever
+//   • cap the number of in-flight timers at MAX_TIMERS_PER_EXEC so a
+//     `for (;;) setTimeout(...)` loop can't drown the runtime
+//   • are torn down by `dispose()` once the script's outer Promise
+//     resolves/rejects (called from the executor's flush path)
+//
+// Each call returns a numeric id (1, 2, 3, ...) — opaque to the user
+// script but unique per execution so clearTimeout works correctly even
+// across nested feature builds.
+const MAX_TIMER_DELAY_MS = 60_000;
+const MAX_TIMERS_PER_EXEC = 1_000;
+const clampDelay = (raw) => {
+    const n = Number(raw);
+    if (!Number.isFinite(n) || n < 0)
+        return 0;
+    return Math.min(n, MAX_TIMER_DELAY_MS);
+};
+export const buildTimerFeature = () => {
+    const handles = new Map();
+    let nextId = 1;
+    let totalCreated = 0;
+    let disposed = false;
+    const allocId = () => {
+        const id = nextId;
+        nextId += 1;
+        return id;
+    };
+    const clear = (id, alsoActive = true) => {
+        const handle = handles.get(id);
+        if (!handle)
+            return;
+        if (alsoActive) {
+            if (handle.kind === "timeout") {
+                clearTimeout(handle.hostId);
+            }
+            else {
+                clearInterval(handle.hostId);
+            }
+        }
+        handles.delete(id);
+    };
+    const api = {
+        setTimeout: (handler, delay, ...args) => {
+            if (disposed) {
+                // Once the script has been disposed, any further timer
+                // requests are no-ops. Returning 0 (never a valid id) makes
+                // a stray `clearTimeout(...)` after disposal harmless too.
+                return 0;
+            }
+            if (typeof handler !== "function") {
+                throw new TypeError("setTimeout(handler) — handler must be a function");
+            }
+            if (handles.size >= MAX_TIMERS_PER_EXEC) {
+                throw new Error(`setTimeout: exceeded the per-script timer limit (${MAX_TIMERS_PER_EXEC}). ` +
+                    `Use a single retry loop instead of scheduling many timers.`);
+            }
+            const id = allocId();
+            totalCreated += 1;
+            const ms = clampDelay(delay);
+            const hostId = setTimeout(() => {
+                // Remove from registry BEFORE firing so the handler can call
+                // clearTimeout(id) on itself without throwing on a stale entry.
+                handles.delete(id);
+                try {
+                    handler(...args);
+                }
+                catch (error) {
+                    // The vm context already routes uncaught script errors back
+                    // to the executor's catch via Promise rejection. A timer
+                    // callback that throws after the script's main promise has
+                    // resolved is logged but doesn't blow up the host.
+                    // eslint-disable-next-line no-console
+                    console.error("Script timer callback threw:", error);
+                }
+            }, ms);
+            handles.set(id, { hostId, kind: "timeout" });
+            return id;
+        },
+        clearTimeout: (id) => {
+            if (disposed)
+                return;
+            const numeric = Number(id);
+            if (!Number.isInteger(numeric))
+                return;
+            clear(numeric);
+        },
+        setInterval: (handler, delay, ...args) => {
+            if (disposed)
+                return 0;
+            if (typeof handler !== "function") {
+                throw new TypeError("setInterval(handler) — handler must be a function");
+            }
+            if (handles.size >= MAX_TIMERS_PER_EXEC) {
+                throw new Error(`setInterval: exceeded the per-script timer limit (${MAX_TIMERS_PER_EXEC}).`);
+            }
+            const id = allocId();
+            totalCreated += 1;
+            // Intervals must have a positive delay — a 0 ms interval would
+            // spin a fire-hose. Clamp to at least 1 ms; the upper bound is
+            // the same MAX_TIMER_DELAY_MS cap.
+            const ms = Math.max(1, clampDelay(delay));
+            const hostId = setInterval(() => {
+                try {
+                    handler(...args);
+                }
+                catch (error) {
+                    // eslint-disable-next-line no-console
+                    console.error("Script interval callback threw:", error);
+                }
+            }, ms);
+            handles.set(id, { hostId, kind: "interval" });
+            return id;
+        },
+        clearInterval: (id) => {
+            if (disposed)
+                return;
+            const numeric = Number(id);
+            if (!Number.isInteger(numeric))
+                return;
+            clear(numeric);
+        },
+    };
+    const dispose = () => {
+        if (disposed)
+            return;
+        disposed = true;
+        for (const id of [...handles.keys()]) {
+            clear(id);
+        }
+    };
+    return {
+        api,
+        dispose,
+        totalCreated: () => totalCreated,
+        activeCount: () => handles.size,
+    };
+};
+//# sourceMappingURL=timers.js.map

package/dist/script/features/timers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"timers.js","sourceRoot":"","sources":["../../../src/script/features/timers.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,qEAAqE;AACrE,gDAAgD;AAChD,EAAE;AACF,kDAAkD;AAClD,gDAAgD;AAChD,qEAAqE;AACrE,qEAAqE;AACrE,iEAAiE;AACjE,+CAA+C;AAC/C,EAAE;AACF,kDAAkD;AAClD,sCAAsC;AACtC,oEAAoE;AACpE,8BAA8B;AAC9B,qEAAqE;AACrE,8DAA8D;AAC9D,mEAAmE;AACnE,+DAA+D;AAC/D,EAAE;AACF,qEAAqE;AACrE,uEAAuE;AACvE,gCAAgC;AAEhC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,mBAAmB,GAAG,KAAK,CAAC;AA0BlC,MAAM,UAAU,GAAG,CAAC,GAAY,EAAU,EAAE;IAC1C,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IAC3C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;AACzC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAiB,EAAE;IAClD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC/C,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,MAAM,OAAO,GAAG,GAAW,EAAE;QAC3B,MAAM,EAAE,GAAG,MAAM,CAAC;QAClB,MAAM,IAAI,CAAC,CAAC;QACZ,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,UAAU,GAAG,IAAI,EAAQ,EAAE;QACpD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9B,YAAY,CAAC,MAAM,CAAC,MAAkD,CAAC,CAAC;YAC1E,CAAC;iBAAM,CAAC;gBACN,aAAa,CAAC,MAAM,CAAC,MAAmD,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACrB,CAAC,CAAC;IAEF,MAAM,GAAG,GAAa;QACpB,UAAU,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,EAAE;YACtC,IAAI,QAAQ,EAAE,CAAC;gBACb,uDAAuD;gBACvD,4DAA4D;gBAC5D,2DAA2D;gBAC3D,OAAO,CAAC,CAAC;YACX,CAAC;YACD,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;gBAClC,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC;YAC1E,CAAC;YACD,IAAI,OAAO,CAAC,IAAI,IAAI,mBAAmB,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CACb,oDAAoD,mBAAmB,KAAK;oBAC1E,4DAA4D,CAC/D,CAAC;YACJ,CAAC;YACD,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;YACrB,YAAY,IAAI,CAAC,CAAC;YAClB,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;YAC7B,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC7B,6DAA6D;gBAC7D,gEAAgE;gBAChE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACnB,IAAI,CAAC;oBACF,OAAwC,CAAC,GAAG,IAAI,CAAC,CAAC;gBACrD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,4DAA4D;oBAC5D,yDAAyD;oBACzD,2DAA2D;oBAC3D,mDAAmD;oBACnD,sCAAsC;oBACtC,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;gBACvD,CAAC;YACH,CAAC,EAAE,EAAE,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YAC7C,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,YAAY,EAAE,CAAC,EAAE,EAAE,EAAE;YACnB,IAAI,QAAQ;gBAAE,OAAO;YACrB,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;gBAAE,OAAO;YACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjB,CAAC;QACD,WAAW,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,EAAE;YACvC,IAAI,QAAQ;gBAAE,OAAO,CAAC,CAAC;YACvB,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;gBAClC,MAAM,IAAI,SAAS,CAAC,mDAAmD,CAAC,CAAC;YAC3E,CAAC;YACD,IAAI,OAAO,CAAC,IAAI,IAAI,mBAAmB,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CACb,qDAAqD,mBAAmB,IAAI,CAC7E,CAAC;YACJ,CAAC;YACD,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;YACrB,YAAY,IAAI,CAAC,CAAC;YAClB,+DAA+D;YAC/D,+DAA+D;YAC/D,mCAAmC;YACnC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE;gBAC9B,IAAI,CAAC;oBACF,OAAwC,CAAC,GAAG,IAAI,CAAC,CAAC;gBACrD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,sCAAsC;oBACtC,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAC;gBAC1D,CAAC;YACH,CAAC,EAAE,EAAE,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC9C,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE;YACpB,IAAI,QAAQ;gBAAE,OAAO;YACrB,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;gBAAE,OAAO;YACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjB,CAAC;KACF,CAAC;IAEF,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,IAAI,QAAQ;YAAE,OAAO;QACrB,QAAQ,GAAG,IAAI,CAAC;QAChB,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACrC,KAAK,CAAC,EAAE,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,GAAG;QACH,OAAO;QACP,YAAY,EAAE,GAAG,EAAE,CAAC,YAAY;QAChC,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI;KAChC,CAAC;AACJ,CAAC,CAAC"}

package/dist/script/features/variables.d.ts

@@ -1,6 +1,13 @@
 export interface VariablesApi {
+    has: (key: string) => boolean;
+    get: (key: string) => string | undefined;
+    set: (key: string, value: unknown) => void;
+    unset: (key: string) => void;
+    toObject: () => Record<string, string>;
     resolve: (input: unknown) => string;
     replaceIn: (input: unknown) => string;
 }
-export declare const buildVariablesApi: (environment: Record<string, string>, globals: Record<string, string>) => VariablesApi;
+export declare const buildVariablesApi: (environment: Record<string, string>, globals: Record<string, string>, options?: {
+    collectionVariables?: Record<string, string>;
+}) => VariablesApi;
 //# sourceMappingURL=variables.d.ts.map

package/dist/script/features/variables.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"variables.d.ts","sourceRoot":"","sources":["../../../src/script/features/variables.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;IACpC,SAAS,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;CACvC;AASD,eAAO,MAAM,iBAAiB,GAC5B,aAAa,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC9B,YAYF,CAAC"}
+{"version":3,"file":"variables.d.ts","sourceRoot":"","sources":["../../../src/script/features/variables.ts"],"names":[],"mappings":"AAmBA,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAC9B,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IACzC,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IAC3C,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,QAAQ,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;IACpC,SAAS,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;CACvC;AASD,eAAO,MAAM,iBAAiB,GAC5B,aAAa,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,UAAS;IAAE,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAO,KAC7D,YA8CF,CAAC"}

package/dist/script/features/variables.js

@@ -1,10 +1,19 @@
-// pm.variables — collection-runner template resolver.
+// pm.variables — Postman-compatible variable scope.
 //
-// Bridges the script sandbox to callman-core's existing template resolver
-// (callman_core/src/variables/resolver.ts). Merges env + globals into a
-// single lookup table so user scripts can call:
-//   pm.variables.resolve("Hello {{name}}")
-// regardless of which scope `name` lives in.
+// Postman's `pm.variables` exposes:
+//   • `.has(key)` / `.get(key)` / `.set(key, value)` / `.unset(key)` /
+//     `.toObject()` — operate on the merged scope (iteration row >
+//     environment > globals). Writes go to a transient local store that
+//     survives the request's scripts but does NOT mutate the env / globals
+//     records visible to other requests in the same run.
+//   • `.resolve(template)` / `.replaceIn(template)` — both names supported
+//     for compatibility; substitutes `{{var}}` against the merged scope
+//     and ALL Postman dynamic tokens (`$randomUUID`, `$timestamp`, etc.).
+//
+// Earlier Callman releases only exposed `.resolve` / `.replaceIn`. The
+// has/get/set/unset/toObject methods are added now so scripts that use
+// `pm.variables.set(...)` and `pm.variables.get(...)` (a very common
+// Postman pattern) work without rewrites.
 import { resolveTemplate } from "../../variables/resolver.js";
 const stringifyInput = (value) => {
     if (value === undefined || value === null) {
@@ -12,12 +21,49 @@ const stringifyInput = (value) => {
     }
     return String(value);
 };
-export const buildVariablesApi = (environment, globals) => {
-    // Merge with environment taking precedence over globals (matches the
-    // electron runtime.ts behavior where env was spread after globals).
-    const mergedScope = { ...globals, ...environment };
-    const resolve = (input) => resolveTemplate(stringifyInput(input), { env: mergedScope });
+export const buildVariablesApi = (environment, globals, options = {}) => {
+    // Local (request-scoped) overlay. Writes via `pm.variables.set` land
+    // here so they take precedence over env / globals for subsequent reads
+    // in the same script execution, without polluting persistent state.
+    const local = {};
+    const collection = options.collectionVariables ?? {};
+    // Precedence on read: local > collection > environment > globals.
+    // This mirrors Postman's documented order.
+    const readMerged = () => ({
+        ...globals,
+        ...environment,
+        ...collection,
+        ...local,
+    });
+    const resolve = (input) => resolveTemplate(stringifyInput(input), { env: readMerged() });
     return {
+        has: (key) => {
+            const normalisedKey = String(key ?? "").trim();
+            if (!normalisedKey)
+                return false;
+            const merged = readMerged();
+            return Object.prototype.hasOwnProperty.call(merged, normalisedKey);
+        },
+        get: (key) => {
+            const normalisedKey = String(key ?? "").trim();
+            if (!normalisedKey)
+                return undefined;
+            const merged = readMerged();
+            return merged[normalisedKey];
+        },
+        set: (key, value) => {
+            const normalisedKey = String(key ?? "").trim();
+            if (!normalisedKey)
+                return;
+            local[normalisedKey] = stringifyInput(value);
+        },
+        unset: (key) => {
+            const normalisedKey = String(key ?? "").trim();
+            if (!normalisedKey)
+                return;
+            delete local[normalisedKey];
+        },
+        toObject: () => readMerged(),
         resolve,
         replaceIn: resolve,
     };