callman-core 1.9.1 → 1.10.0

package/ai-packs/feature-policy.md

@@ -0,0 +1,26 @@
+<!-- GENERATED FILE — do not edit by hand. Source: callman_core (npm run ai:packs). -->
+
+# Script feature policy
+
+Some `pm.*` features can be disabled per execution context (ScriptFeaturePolicy). A disabled feature evaluates to `undefined` at top level; inside `pm.test` callbacks it throws so the test reports SKIPPED instead of failing.
+
+Capability-gated members:
+
+## database
+
+- `pm.db.query({ connectionId, query })`
+- `pm.db.pre`
+- `pm.db.post`
+
+## kafka
+
+- `pm.kafka.event()`
+- `pm.kafka.messages()`
+
+## redis
+
+- `pm.redis.get(key)`
+- `pm.redis.results.pre`
+- `pm.redis.results.post`
+
+Generation guidance: prefer declared pre/post queries and `pm.db.query` only when the user explicitly asks for database work; never assume kafka/redis capabilities exist unless the task mentions them.

package/ai-packs/pm-api.md

@@ -0,0 +1,213 @@
+<!-- GENERATED FILE — do not edit by hand. Source: callman_core (npm run ai:packs). -->
+
+# Callman `pm.*` scripting API
+
+Scripts are plain JavaScript (top-level `await` allowed). Use ONLY the API below — anything else (fetch, require, process, Buffer, ...) is blocked by the sandbox.
+
+## pm.test
+
+Register a named test. The callback's assertion failures mark the test failed without aborting the script.
+
+- `pm.test(name, fn)` — Runs fn (sync or async); pass/fail lands in the run's test results.
+
+## pm.expect
+
+Chai-style assertions plus Jest-style matchers.
+
+- `pm.expect(value)` — Assertion chain. Equality: .to.equal(x) (identity), .to.eql(x) / .to.deep.equal(x) / .toEqual(x) (deep). Existence: .to.exist, .toBeDefined(), .toBeNull(). Strings/arrays: .to.include(x) / .toContain(x), .oneOf([..]). Numbers: .toBeGreaterThan / .toBeLessThan / .to.be.above(n) / .to.be.below(n). Types: .to.be.a('string'|'number'|...). Negation: .to.not.<...> / .not.<matcher>. Properties: .to.have.property('name', value?).
+- `pm.expect.fail(message?)` — Fails the surrounding test immediately.
+
+## pm.environment
+
+Active environment variables (alias: pm.env). Writes are scoped to the run and surface as variable mutations.
+
+- `pm.environment.get(key)` — Read a variable (string or undefined).
+- `pm.environment.set(key, value)` — Write a variable for subsequent steps.
+- `pm.environment.unset(key)` — Remove a variable.
+- `pm.environment.has(key)` — true when the key exists.
+- `pm.environment.clear()` — Remove every variable in the scope.
+- `pm.environment.toObject()` — Plain { key: value } snapshot.
+- `pm.environment.replaceIn(template)` — Resolve {{tokens}} inside a string.
+- `pm.environment.name` — Active environment's name.
+
+## pm.globals
+
+Workspace-level global variables. Same surface as pm.environment.
+
+- `pm.globals.get(key)` — Read a global.
+- `pm.globals.set(key, value)` — Write a global for the run.
+- `pm.globals.unset(key)` — Remove a global.
+- `pm.globals.has(key)` — true when the key exists.
+- `pm.globals.clear()` — Remove every global in the scope.
+- `pm.globals.toObject()` — Plain snapshot.
+- `pm.globals.replaceIn(template)` — Resolve {{tokens}} inside a string.
+
+## pm.collectionVariables
+
+Collection-scoped variables that survive across requests within one collection run iteration.
+
+- `pm.collectionVariables.get(key)` — Read a collection variable.
+- `pm.collectionVariables.set(key, value)` — Write; persists across the iteration.
+- `pm.collectionVariables.unset(key)` — Remove a collection variable.
+- `pm.collectionVariables.has(key)` — true when the key exists.
+- `pm.collectionVariables.clear()` — Remove all collection variables.
+- `pm.collectionVariables.toObject()` — Plain snapshot.
+- `pm.collectionVariables.replaceIn(template)` — Resolve {{tokens}}.
+
+## pm.variables
+
+Layered read across all scopes (per-iteration > environment > globals) plus template resolution.
+
+- `pm.variables.get(key)` — Read through the precedence chain.
+- `pm.variables.set(key, value)` — Write to the run-local layer.
+- `pm.variables.unset(key)` — Remove from the run-local layer.
+- `pm.variables.has(key)` — true when any layer has the key.
+- `pm.variables.toObject()` — Merged snapshot.
+- `pm.variables.replaceIn(template)` — Resolve {{tokens}} in a string.
+- `pm.variables.resolve(template)` — Like replaceIn, but also resolves scenario node-output references.
+
+## pm.request
+
+The outgoing request. Mutations only have effect in pre-request scripts (the call has not fired yet).
+
+- `pm.request.url` — Resolved URL string.
+- `pm.request.method` — HTTP method.
+- `pm.request.body` — Body snapshot (mode + content).
+- `pm.request.headers` — HeaderList: .all() .get(name) .has(name) .add({key,value}) .upsert({key,value}) .remove(name) .idx(i).
+- `pm.request.query` — Query params as a HeaderList.
+- `pm.request.getHeader(name)` — Read one header value.
+- `pm.request.setHeader(name, value)` — Set/replace a header. _(stages: pre-request, scenario-script)_
+- `pm.request.unsetHeader(name)` — Remove a header. _(stages: pre-request, scenario-script)_
+- `pm.request.getQueryParam(name)` — Read one query param.
+- `pm.request.setQueryParam(name, value)` — Set/replace a query param. _(stages: pre-request, scenario-script)_
+- `pm.request.unsetQueryParam(name)` — Remove a query param. _(stages: pre-request, scenario-script)_
+- `pm.request.setUrl(url)` — Replace the URL. _(stages: pre-request, scenario-script)_
+- `pm.request.setMethod(method)` — Replace the method. _(stages: pre-request, scenario-script)_
+- `pm.request.setRawBody(value)` — Replace the raw body (string or object → JSON). _(stages: pre-request, scenario-script)_
+
+## pm.response
+
+The received response. Not available in pre-request scripts.
+
+- `pm.response.code` — Status code (number). _(stages: post-response, tests, scenario-script)_
+- `pm.response.status` — Status code (number, alias). _(stages: post-response, tests, scenario-script)_
+- `pm.response.statusText` — Status text. _(stages: post-response, tests, scenario-script)_
+- `pm.response.json()` — Parsed JSON body — call once into a const (`const body = pm.response.json()`); throws on non-JSON, so guard with try/catch or pm.response.to.be.json when the content type is uncertain. _(stages: post-response, tests, scenario-script)_
+- `pm.response.text()` — Raw body as string. _(stages: post-response, tests, scenario-script)_
+- `pm.response.rawBody` — Raw body string. _(stages: post-response, tests, scenario-script)_
+- `pm.response.headers` — Response HeaderList. _(stages: post-response, tests, scenario-script)_
+- `pm.response.responseTime` — Duration in ms. _(stages: post-response, tests, scenario-script)_
+- `pm.response.responseSize` — Body size in bytes. _(stages: post-response, tests, scenario-script)_
+- `pm.response.to.have.status(code)` — Assertion shortcuts; also .to.have.header/.jsonBody/.body and .to.be.ok/.json/.success/.clientError/... plus .to.not.<predicate>. _(stages: post-response, tests, scenario-script)_
+
+## pm.sendRequest
+
+Fire an ad-hoc HTTP request from inside a script.
+
+- `pm.sendRequest(urlOrOptions, callback?)` — Options: { url, method, header: {name: value}, body }. Body accepts a plain object (auto-JSON) OR Postman style { mode: 'raw', raw: JSON.stringify({...}) } / { mode: 'urlencoded', urlencoded: [{key, value}] }. Prefer `const res = await pm.sendRequest({...})`; callback form gets (err, res). The response object is { code, status, statusText, headers, body, responseTime, json(), text() } — note it is NOT pm.response.
+
+## pm.db
+
+Database access (Oracle / MongoDB / PostgreSQL / MySQL). Disabled by feature policy in some contexts — tests then report SKIP.
+
+- `pm.db.query({ connectionId, query })` — Run an ad-hoc query — ALWAYS await it. Resolves to { success, error, rowCount, rows, firstRow(), connectionId, connectionName, connectionType, durationMs, executedAt }. firstRow is a FUNCTION: res.firstRow()?.STATUS (Oracle columns are UPPERCASE). _(requires the database capability — may be disabled by feature policy)_
+- `pm.db.pre` — Result object of the declared pre-request DB query: { success, error, rowCount, rows, firstRow() }. Not a promise — read directly. _(requires the database capability — may be disabled by feature policy)_
+- `pm.db.post` — Result object of the declared post-response DB query (same shape as pm.db.pre). _(stages: post-response, tests)_ _(requires the database capability — may be disabled by feature policy)_
+
+## pm.kafka
+
+Captured Kafka events from the request's Kafka tab listener.
+
+- `pm.kafka.event()` — The matched event's parsed payload (or null). _(stages: post-response, tests)_ _(requires the kafka capability — may be disabled by feature policy)_
+- `pm.kafka.messages()` — Every captured message in the listen window. _(stages: post-response, tests)_ _(requires the kafka capability — may be disabled by feature policy)_
+
+## pm.redis
+
+Results of the declared pre/post Redis commands.
+
+- `pm.redis.get(key)` — Read a value already captured by a declared GET. _(requires the redis capability — may be disabled by feature policy)_
+- `pm.redis.results.pre` — Array of pre-stage command results (by line index). _(requires the redis capability — may be disabled by feature policy)_
+- `pm.redis.results.post` — Array of post-stage command results. _(stages: post-response, tests)_ _(requires the redis capability — may be disabled by feature policy)_
+
+## pm.random
+
+Deterministic-format random data generators.
+
+- `pm.random.uuid()` — UUID v4.
+- `pm.random.email()` — Random email address.
+- `pm.random.string(length?)` — Alphanumeric string.
+- `pm.random.int(min, max)` — Integer in range.
+- `pm.random.bigdecimal(min, max, scale)` — Decimal with given scale.
+- `pm.random.boolean()` — true/false.
+- `pm.random.phone()` — Phone number string.
+- `pm.random.name()` — Person name.
+- `pm.random.date(format?)` — Date string.
+
+## pm.counter
+
+Monotonic counter scoped to the run.
+
+- `pm.counter.next()` — Next value (starts at 1).
+- `pm.counter.start(startAt?)` — Counter starting at a custom value.
+
+## pm.info
+
+Execution metadata snapshot.
+
+- `pm.info.eventName` — "prerequest" | "test".
+- `pm.info.iteration` — Zero-based data-driven iteration index.
+- `pm.info.iterationCount` — Total iterations — only meaningful in collection/data-driven runs. Never use it to gate token/cache logic in single sends.
+- `pm.info.requestName` — Current request's name.
+- `pm.info.requestId` — Current request's id.
+
+## pm.execution
+
+Collection-run flow control.
+
+- `pm.execution.setNextRequest(name)` — Jump to a named request next (collection runs).
+- `pm.execution.skipRequest()` — Skip the current request. _(stages: pre-request)_
+- `pm.execution.location` — Folder path of the current request.
+
+## pm.node
+
+Scenario workflow context (only meaningful inside scenario script nodes).
+
+- `pm.node.nodeLabel` — Current node's label. _(stages: scenario-script)_
+- `pm.node.setNextRequest(name)` — Route the workflow to a named node. _(stages: scenario-script)_
+
+## pm.log
+
+Structured logging into the run report.
+
+- `pm.log(...args)` — Like console.log; entries land in the run's log panel.
+
+## CryptoJS
+
+crypto-js global (NOT under pm.*).
+
+- `CryptoJS.SHA256(msg) / SHA1 / SHA512 / MD5` — Hashes; .toString() or .toString(CryptoJS.enc.Hex).
+- `CryptoJS.HmacSHA256(msg, key)` — HMAC family (SHA1/224/384/512, MD5 variants).
+- `CryptoJS.AES.encrypt(msg, key) / .decrypt(cipher, key)` — AES; decrypt result needs .toString(CryptoJS.enc.Utf8).
+- `CryptoJS.PBKDF2(password, salt, options)` — Key derivation.
+- `CryptoJS.enc.Utf8 / Base64 / Hex / Latin1` — Encoders for .toString(...).
+- `CryptoJS.lib.WordArray.create / random(n)` — Raw word arrays (e.g. random IVs).
+
+## _
+
+lodash global (NOT under pm.*).
+
+- `_.get(obj, path, default?) / _.pick / _.groupBy / _.sortBy / _.uniq / ...` — Full lodash surface for data wrangling.
+
+## timers
+
+Safe per-execution timer wrappers (callbacks never outlive the run).
+
+- `setTimeout(fn, ms) / clearTimeout(id)` — Use with await new Promise(r => setTimeout(r, ms)) for polling loops.
+- `setInterval(fn, ms) / clearInterval(id)` — Interval variant.
+
+## Stage rules
+
+- `pre-request`: runs BEFORE the HTTP call. `pm.response` does not exist; `pm.request` mutations take effect.
+- `post-response` / `tests`: run AFTER the call. `pm.response` is available; `pm.request` mutations have no effect.
+- `scenario-script`: a scenario Script node. Prior node outputs are readable via `pm.variables.resolve("{{NodeLabel.path}}")`; the script's return value becomes the node output.
+- Members without a stage note are available in every stage.

package/ai-packs/sandbox-globals.md

@@ -0,0 +1,20 @@
+<!-- GENERATED FILE — do not edit by hand. Source: callman_core (npm run ai:packs). -->
+
+# Script sandbox — available and blocked globals
+
+The sandbox is a Node `vm` context. Generated code must never reference a blocked global — the script fails at runtime.
+
+## Available built-ins
+
+`AggregateError`, `Array`, `ArrayBuffer`, `BigInt`, `BigInt64Array`, `BigUint64Array`, `Boolean`, `DataView`, `Date`, `Error`, `EvalError`, `Float32Array`, `Float64Array`, `Infinity`, `Int16Array`, `Int32Array`, `Int8Array`, `JSON`, `Map`, `Math`, `NaN`, `Number`, `Object`, `Promise`, `RangeError`, `ReferenceError`, `RegExp`, `Set`, `String`, `Symbol`, `SyntaxError`, `TextDecoder`, `TextEncoder`, `TypeError`, `URIError`, `URL`, `URLSearchParams`, `Uint16Array`, `Uint32Array`, `Uint8Array`, `Uint8ClampedArray`, `WeakMap`, `WeakSet`, `atob`, `btoa`, `decodeURIComponent`, `encodeURIComponent`, `isFinite`, `isNaN`, `parseFloat`, `parseInt`, `structuredClone`, `undefined`
+
+Plus the injected helpers: `pm`, `console`, `CryptoJS`, `_` (lodash), `setTimeout`/`clearTimeout`/`setInterval`/`clearInterval` (safe per-run wrappers).
+
+## Blocked (never use)
+
+`Buffer`, `Function`, `WebSocket`, `Worker`, `XMLHttpRequest`, `document`, `eval`, `exports`, `fetch`, `global`, `globalThis`, `importScripts`, `module`, `navigator`, `process`, `require`, `self`, `window`
+
+Notes:
+- No `fetch` — use `pm.sendRequest` for HTTP.
+- No `Buffer` — use `atob`/`btoa`/`TextEncoder`/`Uint8Array`.
+- No `require`/`import` — `CryptoJS` and `_` are already in scope.

package/ai-packs/templating.md

@@ -0,0 +1,104 @@
+<!-- GENERATED FILE — do not edit by hand. Source: callman_core (npm run ai:packs). -->
+
+# Template tokens (`{{...}}`)
+
+Anywhere a `{{...}}` is accepted (URLs, headers, bodies, DB queries, Kafka payloads, scenario node configs), substitution is PLAIN TEXT replacement — no quoting, no escaping. Quote SQL strings yourself (`WHERE id = '{{userId}}'`). A missing variable resolves to an empty string.
+
+## Variable lookups
+
+- `{{name}}` — environment → globals lookup.
+- `{{env.name}}` / `{{global.name}}` — forced scope.
+- `{{response.body.<path>}}` — current request's response (request context only; dot-indexed arrays: `items.0.id`).
+- `{{<NodeLabel>.<path>}}` — a prior scenario node's output (scenario context only; bracket-indexed arrays: `rows[0].id`).
+
+## Random generators
+
+| Token | Meaning | Example output |
+| --- | --- | --- |
+| `{{random.email}}` | Random email address | `sam.user42@example.com` |
+| `{{random.string}}` | Random alphanumeric string | `aZ19xPq20LmN` |
+| `{{random.uuid}}` | Random UUID v4 | `1d7fe6b6-6f47-4fa9-b57a-d2e1d285be51` |
+| `{{random.int}}` | Random integer | `48291` |
+| `{{random.bigdecimal}}` | Random decimal number | `1842.552190` |
+| `{{random.boolean}}` | Random boolean | `true` |
+| `{{random.phone}}` | Random phone number | `+15558675309` |
+| `{{random.date("YYYY-MM-DD")}}` | Random date | `2026-04-06` |
+| `{{random.name}}` | Random human name | `Aylin Karimli` |
+
+## Counters
+
+| Token | Meaning | Example output |
+| --- | --- | --- |
+| `{{counter}}` | Incrementing counter per request | `1, 2, 3...` |
+| `{{counter.start(100)}}` | Counter starting at 100 | `100, 101, 102...` |
+
+## Postman-compatible `$` tokens
+
+| Token | Meaning | Example output |
+| --- | --- | --- |
+| `{{$guid}}` | Postman compat — UUID v4 | `1d7fe6b6-6f47-4fa9-b57a-d2e1d285be51` |
+| `{{$randomUUID}}` | Postman compat — UUID v4 | `1d7fe6b6-6f47-4fa9-b57a-d2e1d285be51` |
+| `{{$timestamp}}` | Postman compat — unix seconds | `1718793600` |
+| `{{$isoTimestamp}}` | Postman compat — ISO 8601 | `2026-05-18T10:24:00.123Z` |
+| `{{$randomInt}}` | Postman compat — 0-1000 | `482` |
+| `{{$randomBoolean}}` | Postman compat | `true` |
+| `{{$randomAlphaNumeric}}` | Postman compat — 8 chars | `aZ19xPq2` |
+| `{{$randomHexaDecimal}}` | Postman compat — 0xNNNNNNNN | `0x4f3a1c2d` |
+| `{{$randomString}}` | Postman compat — 12 chars | `aZ19xPq20LmN` |
+| `{{$randomFirstName}}` | Postman compat | `Aylin` |
+| `{{$randomLastName}}` | Postman compat | `Karimov` |
+| `{{$randomFullName}}` | Postman compat | `Aylin Karimov` |
+| `{{$randomUserName}}` | Postman compat | `aylin.karimov42` |
+| `{{$randomNamePrefix}}` | Postman compat | `Dr.` |
+| `{{$randomNameSuffix}}` | Postman compat | `Jr.` |
+| `{{$randomEmail}}` | Postman compat | `sam.user42@example.com` |
+| `{{$randomUrl}}` | Postman compat | `https://acme.io/q1w2e3` |
+| `{{$randomDomainName}}` | Postman compat | `acme.io` |
+| `{{$randomDomainSuffix}}` | Postman compat | `io` |
+| `{{$randomUserAgent}}` | Postman compat | `Mozilla/5.0 (...)` |
+| `{{$randomIP}}` | Postman compat — IPv4 | `192.168.1.42` |
+| `{{$randomIPV4}}` | Postman compat | `192.168.1.42` |
+| `{{$randomIPV6}}` | Postman compat | `fe80::1ff:fe23:4567:890a` |
+| `{{$randomMACAddress}}` | Postman compat | `1A:2B:3C:4D:5E:6F` |
+| `{{$randomPassword}}` | Postman compat | `x4Z9p2Aq!` |
+| `{{$randomSemver}}` | Postman compat | `3.7.42` |
+| `{{$randomPhoneNumber}}` | Postman compat | `+15558675309` |
+| `{{$randomCity}}` | Postman compat | `Baku` |
+| `{{$randomCountry}}` | Postman compat | `Azerbaijan` |
+| `{{$randomCountryCode}}` | Postman compat | `AZ` |
+| `{{$randomStreetAddress}}` | Postman compat | `742 Maple St` |
+| `{{$randomZipCode}}` | Postman compat | `10042` |
+| `{{$randomLatitude}}` | Postman compat | `40.412345` |
+| `{{$randomLongitude}}` | Postman compat | `-74.012345` |
+| `{{$randomCompanyName}}` | Postman compat | `Acme Labs Inc.` |
+| `{{$randomJobTitle}}` | Postman compat | `Senior Software Engineer` |
+| `{{$randomJobArea}}` | Postman compat | `Engineering` |
+| `{{$randomDepartment}}` | Postman compat | `Engineering` |
+| `{{$randomProduct}}` | Postman compat | `Acme Cloud` |
+| `{{$randomCatchPhrase}}` | Postman compat | `Scalable mesh` |
+| `{{$randomCreditCardMask}}` | Postman compat | `****-****-****-4242` |
+| `{{$randomCreditCardNumber}}` | Postman compat | `4242424242424242` |
+| `{{$randomBankAccount}}` | Postman compat | `0123456789` |
+| `{{$randomBankRoutingNumber}}` | Postman compat | `021000089` |
+| `{{$randomCurrencyCode}}` | Postman compat | `USD` |
+| `{{$randomPrice}}` | Postman compat | `42.99` |
+| `{{$randomTransactionType}}` | Postman compat | `payment` |
+| `{{$randomDatetime}}` | Postman compat | `2026-04-06T10:24:00.000Z` |
+| `{{$randomDatePast}}` | Postman compat | `2025-10-12T...` |
+| `{{$randomDateFuture}}` | Postman compat | `2026-11-04T...` |
+| `{{$randomDateRecent}}` | Postman compat — last 7 days | `2026-05-15T...` |
+| `{{$randomDateSoon}}` | Postman compat — next 7 days | `2026-05-22T...` |
+| `{{$randomTime}}` | Postman compat | `14:23:07` |
+| `{{$randomWeekday}}` | Postman compat | `Wednesday` |
+| `{{$randomMonth}}` | Postman compat | `April` |
+| `{{$randomColor}}` | Postman compat | `purple` |
+| `{{$randomHexColor}}` | Postman compat | `#A78BFA` |
+| `{{$randomWord}}` | Postman compat — lorem | `ipsum` |
+| `{{$randomWords}}` | Postman compat — lorem phrase | `lorem ipsum dolor` |
+| `{{$randomSentence}}` | Postman compat | `Lorem ipsum dolor sit amet.` |
+| `{{$randomParagraph}}` | Postman compat | `Lorem ipsum dolor sit amet...` |
+| `{{$randomFileName}}` | Postman compat | `q1w2e3r4.pdf` |
+| `{{$randomFileExt}}` | Postman compat | `json` |
+| `{{$randomFileType}}` | Postman compat | `image` |
+| `{{$randomMimeType}}` | Postman compat | `application/json` |
+| `{{$randomImageUrl}}` | Postman compat | `https://picsum.photos/400/300` |

package/dist/index.d.ts

@@ -7,7 +7,11 @@ export { EnvStore } from "./variables/envStore.js";
 export { runScript } from "./script/legacy.js";
 export * from "./templating/index.js";
 export { executeScript, validateScript } from "./script/executor.js";
+export { runScriptIsolated } from "./script/isolated-runner.js";
+export type { RunScriptIsolatedOptions } from "./script/isolated-runner.js";
 export type { CounterSnapshotEntry, ExecuteScriptInput, ExecuteScriptResult, ScriptCapabilities, ScriptCounterCapability, ScriptDbCapability, ScriptDbExecutionInput, ScriptDbExecutionResult, ScriptError, ScriptFeaturePolicy, ScriptKafkaCapability, ScriptKeyValuePair, ScriptLogEntry, ScriptRedisCapability, ScriptRequestBodyState, ScriptRequestState, ScriptResponseState, ScriptStage, ScriptTestResult, ScriptVariableMutation, SendRequestExecutor, } from "./script/types.js";
+export { PM_API_METADATA, type PmApiMember, type PmApiNamespace, type PmApiStage, } from "./script/pm-api-metadata.js";
+export { ALLOWED_GLOBAL_NAMES, BLOCKED_GLOBAL_NAMES, RESERVED_LABEL_NAMES, } from "./script/scope.js";
 export { PmAssertion, createExpectApi } from "./script/features/assertions.js";
 export { PendingKafkaDependencyError, isPendingKafkaValue, } from "./script/features/kafka.js";
 export { DisabledFeatureDependencyError, isDisabledFeatureValue, } from "./script/features/feature-policy.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EACL,gBAAgB,EAChB,QAAQ,EACR,YAAY,EACZ,kBAAkB,EAClB,KAAK,cAAc,GACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,cAAc,uBAAuB,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACrE,YAAY,EACV,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,uBAAuB,EACvB,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,EACvB,WAAW,EACX,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,cAAc,EACd,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,8BAA8B,EAC9B,sBAAsB,GACvB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,qBAAqB,EACrB,KAAK,wBAAwB,GAC9B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,EACxB,KAAK,iBAAiB,GACvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,cAAc,GACpB,MAAM,uBAAuB,CAAC;AAC/B,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EACL,gBAAgB,EAChB,QAAQ,EACR,YAAY,EACZ,kBAAkB,EAClB,KAAK,cAAc,GACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,cAAc,uBAAuB,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,YAAY,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAC5E,YAAY,EACV,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,uBAAuB,EACvB,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,EACvB,WAAW,EACX,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,cAAc,EACd,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,eAAe,EACf,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,UAAU,GAChB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,8BAA8B,EAC9B,sBAAsB,GACvB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,qBAAqB,EACrB,KAAK,wBAAwB,GAC9B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,EACxB,KAAK,iBAAiB,GACvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,cAAc,GACpB,MAAM,uBAAuB,CAAC;AAC/B,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kBAAkB,CAAC"}

package/dist/index.js

@@ -7,6 +7,9 @@ export { EnvStore } from "./variables/envStore.js";
 export { runScript } from "./script/legacy.js";
 export * from "./templating/index.js";
 export { executeScript, validateScript } from "./script/executor.js";
+export { runScriptIsolated } from "./script/isolated-runner.js";
+export { PM_API_METADATA, } from "./script/pm-api-metadata.js";
+export { ALLOWED_GLOBAL_NAMES, BLOCKED_GLOBAL_NAMES, RESERVED_LABEL_NAMES, } from "./script/scope.js";
 export { PmAssertion, createExpectApi } from "./script/features/assertions.js";
 export { PendingKafkaDependencyError, isPendingKafkaValue, } from "./script/features/kafka.js";
 export { DisabledFeatureDependencyError, isDisabledFeatureValue, } from "./script/features/feature-policy.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EACL,gBAAgB,EAChB,QAAQ,EACR,YAAY,EACZ,kBAAkB,GAEnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,cAAc,uBAAuB,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAwBrE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,8BAA8B,EAC9B,sBAAsB,GACvB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,qBAAqB,GAEtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,GAEzB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,gBAAgB,GAEjB,MAAM,uBAAuB,CAAC;AAC/B,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EACL,gBAAgB,EAChB,QAAQ,EACR,YAAY,EACZ,kBAAkB,GAEnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,cAAc,uBAAuB,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAyBhE,OAAO,EACL,eAAe,GAIhB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,8BAA8B,EAC9B,sBAAsB,GACvB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,qBAAqB,GAEtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,GAEzB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,gBAAgB,GAEjB,MAAM,uBAAuB,CAAC;AAC/B,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kBAAkB,CAAC"}

package/dist/scenario-runner/adapters/script-executor.js

@@ -8,7 +8,7 @@
 //   - return value gets deep template-resolved
 //   - failed pm.test entries surface in `failureMessage` for the runner
 import { buildScenarioTemplateValues, resolveScenarioTemplateString } from "../templateResolver.js";
-import { executeScript } from "../../script/executor.js";
+import { runScriptIsolated } from "../../script/isolated-runner.js";
 import { withAbortAndTimeout } from "./helpers/abort.js";
 import { resolveScenarioScriptTemplatesDeep } from "./helpers/templates.js";
 const toScenarioMutation = (mutation) => mutation.type === "set"
@@ -46,7 +46,7 @@ export const buildScriptExecutor = (options) => async (input) => {
             failureMessage: "Script node is empty.",
         };
     }
-    const scriptResult = await withAbortAndTimeout(executeScript({
+    const scriptResult = await withAbortAndTimeout(runScriptIsolated({
         script,
         timeoutMs: baseTimeoutMs,
         filename: "callman-scenario.script.js",
@@ -74,7 +74,7 @@ export const buildScriptExecutor = (options) => async (input) => {
                 variables: true,
             },
         },
-    }), baseTimeoutMs, `Script node ${input.stepId}`, input.signal);
+    }, { signal: input.signal }), baseTimeoutMs, `Script node ${input.stepId}`, input.signal);
     // Templates may contain `{{...}}` tokens that reference live runtime
     // values not available inside the sandbox (response.body, db.result,
     // etc.). Resolve them against the current scenario runtime scope

package/dist/scenario-runner/adapters/script-executor.js.map

@@ -1 +1 @@
-{"version":3,"file":"script-executor.js","sourceRoot":"","sources":["../../../src/scenario-runner/adapters/script-executor.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,oEAAoE;AACpE,mCAAmC;AACnC,qEAAqE;AACrE,yEAAyE;AACzE,mEAAmE;AACnE,sBAAsB;AACtB,+CAA+C;AAC/C,wEAAwE;AAOxE,OAAO,EAAE,2BAA2B,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAC;AACpG,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAGzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,kCAAkC,EAAE,MAAM,wBAAwB,CAAC;AAG5E,MAAM,kBAAkB,GAAG,CACzB,QAAgC,EACN,EAAE,CAC5B,QAAQ,CAAC,IAAI,KAAK,KAAK;IACrB,CAAC,CAAC;QACE,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,IAAI,EAAE,KAAK;QACX,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,KAAK,EAAE,QAAQ,CAAC,KAAK;KACtB;IACH,CAAC,CAAC;QACE,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,IAAI,EAAE,OAAO;QACb,GAAG,EAAE,QAAQ,CAAC,GAAG;KAClB,CAAC;AAER,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,OAA6C,EAC7C,EAAE,CACF,KAAK,EAAE,KAAmC,EAA0C,EAAE;IACpF,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;IAC7C,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAC5B,OAAO,CAAC,aAAa,EACrB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,eAAe,CAC5D,CAAC;IAEF,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACnB,OAAO;YACL,iBAAiB,EAAE,EAAE;YACrB,WAAW,EAAE,EAAE;YACf,IAAI,EAAE,EAAE;YACR,KAAK,EAAE;gBACL,KAAK,EAAE,QAAQ;gBACf,OAAO,EAAE,uBAAuB;gBAChC,UAAU,EAAE,IAAI;gBAChB,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,IAAI;aACZ;YACD,cAAc,EAAE,KAAK;YACrB,WAAW,EAAE,IAAI;YACjB,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,MAAM;YACpB,SAAS,EAAE,aAAa;YACxB,cAAc,EAAE,uBAAuB;SACxC,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAC5C,aAAa,CAAC;QACZ,MAAM;QACN,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,4BAA4B;QACtC,KAAK,EAAE,QAAQ;QACf,YAAY,EAAE;YACZ,WAAW,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,EAAE,IAAI,EAAE;YACvE,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE;YAC/D,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,eAAe;YAC9C,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,eAAe;YAC9C,qBAAqB,EAAE,IAAI;YAC3B,6DAA6D;YAC7D,2DAA2D;YAC3D,uDAAuD;YACvD,2DAA2D;YAC3D,wDAAwD;YACxD,sDAAsD;YACtD,yDAAyD;YACzD,kCAAkC;YAClC,UAAU,EAAE;gBACV,GAAG,EAAE,IAAI;gBACT,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE,IAAI;gBACZ,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;gBACzB,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,IAAI;aAChB;SACF;KACF,CAAC,EACF,aAAa,EACb,eAAe,KAAK,CAAC,MAAM,EAAE,EAC7B,KAAK,CAAC,MAAM,CACb,CAAC;IAEF,qEAAqE;IACrE,qEAAqE;IACrE,iEAAiE;IACjE,qEAAqE;IACrE,MAAM,cAAc,GAAG,2BAA2B,CAAC;QACjD,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW;QACtC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO;QAC9B,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,eAAe;QAC9C,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,eAAe;QAC9C,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;QACxC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;QAChC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU;QACpC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW;KACvC,CAAC,CAAC;IAEH,MAAM,iBAAiB,GAAG,YAAY,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CACxE,QAAQ,CAAC,IAAI,KAAK,KAAK,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ;QAC3D,CAAC,CAAC;YACE,GAAG,QAAQ;YACX,KAAK,EAAE,6BAA6B,CAAC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;SACrE;QACH,CAAC,CAAC,QAAQ,CACb,CAAC;IACF,MAAM,mBAAmB,GAAG,YAAY,CAAC,cAAc;QACrD,CAAC,CAAC,kCAAkC,CAChC,YAAY,CAAC,WAAW,EACxB,cAAc,EACd,6BAA6B,CAC9B;QACH,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,gBAAgB,GAAG,YAAY,CAAC,WAAW,CAAC,IAAI,CACpD,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CACnC,CAAC;IACF,MAAM,cAAc,GAAG,YAAY,CAAC,KAAK;QACvC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO;QAC5B,CAAC,CAAC,gBAAgB;YAChB,CAAC,CAAC,gBAAgB,CAAC,KAAK;gBACtB,CAAC,CAAC,uBAAuB,gBAAgB,CAAC,IAAI,KAAK,gBAAgB,CAAC,KAAK,GAAG;gBAC5E,CAAC,CAAC,uBAAuB,gBAAgB,CAAC,IAAI,EAAE;YAClD,CAAC,CAAC,IAAI,CAAC;IAEX,OAAO;QACL,iBAAiB,EAAE,iBAAiB,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAC5D,WAAW,EAAE,YAAY,CAAC,WAAW;QACrC,IAAI,EAAE,YAAY,CAAC,IAAI;QACvB,KAAK,EAAE,YAAY,CAAC,KAAK;QACzB,cAAc,EAAE,YAAY,CAAC,cAAc;QAC3C,WAAW,EAAE,mBAAmB;QAChC,UAAU,EAAE;YACV,GAAG,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,WAAW,EAAE,YAAY,CAAC,WAAW;YACrC,IAAI,EAAE,YAAY,CAAC,IAAI;YACvB,iBAAiB,EAAE,iBAAiB,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAC5D,KAAK,EAAE,YAAY,CAAC,KAAK;SAC1B;QACD,YAAY,EAAE,MAAM;QACpB,SAAS,EAAE,aAAa;QACxB,cAAc;KACf,CAAC;AACJ,CAAC,CAAC"}
+{"version":3,"file":"script-executor.js","sourceRoot":"","sources":["../../../src/scenario-runner/adapters/script-executor.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,oEAAoE;AACpE,mCAAmC;AACnC,qEAAqE;AACrE,yEAAyE;AACzE,mEAAmE;AACnE,sBAAsB;AACtB,+CAA+C;AAC/C,wEAAwE;AAOxE,OAAO,EAAE,2BAA2B,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAC;AACpG,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAGpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,kCAAkC,EAAE,MAAM,wBAAwB,CAAC;AAG5E,MAAM,kBAAkB,GAAG,CACzB,QAAgC,EACN,EAAE,CAC5B,QAAQ,CAAC,IAAI,KAAK,KAAK;IACrB,CAAC,CAAC;QACE,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,IAAI,EAAE,KAAK;QACX,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,KAAK,EAAE,QAAQ,CAAC,KAAK;KACtB;IACH,CAAC,CAAC;QACE,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,IAAI,EAAE,OAAO;QACb,GAAG,EAAE,QAAQ,CAAC,GAAG;KAClB,CAAC;AAER,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,OAA6C,EAC7C,EAAE,CACF,KAAK,EAAE,KAAmC,EAA0C,EAAE;IACpF,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;IAC7C,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAC5B,OAAO,CAAC,aAAa,EACrB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,eAAe,CAC5D,CAAC;IAEF,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACnB,OAAO;YACL,iBAAiB,EAAE,EAAE;YACrB,WAAW,EAAE,EAAE;YACf,IAAI,EAAE,EAAE;YACR,KAAK,EAAE;gBACL,KAAK,EAAE,QAAQ;gBACf,OAAO,EAAE,uBAAuB;gBAChC,UAAU,EAAE,IAAI;gBAChB,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,IAAI;aACZ;YACD,cAAc,EAAE,KAAK;YACrB,WAAW,EAAE,IAAI;YACjB,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,MAAM;YACpB,SAAS,EAAE,aAAa;YACxB,cAAc,EAAE,uBAAuB;SACxC,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAC5C,iBAAiB,CAAC;QAChB,MAAM;QACN,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,4BAA4B;QACtC,KAAK,EAAE,QAAQ;QACf,YAAY,EAAE;YACZ,WAAW,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,EAAE,IAAI,EAAE;YACvE,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE;YAC/D,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,eAAe;YAC9C,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,eAAe;YAC9C,qBAAqB,EAAE,IAAI;YAC3B,6DAA6D;YAC7D,2DAA2D;YAC3D,uDAAuD;YACvD,2DAA2D;YAC3D,wDAAwD;YACxD,sDAAsD;YACtD,yDAAyD;YACzD,kCAAkC;YAClC,UAAU,EAAE;gBACV,GAAG,EAAE,IAAI;gBACT,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE,IAAI;gBACZ,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;gBACzB,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,IAAI;aAChB;SACF;KACF,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,EAC5B,aAAa,EACb,eAAe,KAAK,CAAC,MAAM,EAAE,EAC7B,KAAK,CAAC,MAAM,CACb,CAAC;IAEF,qEAAqE;IACrE,qEAAqE;IACrE,iEAAiE;IACjE,qEAAqE;IACrE,MAAM,cAAc,GAAG,2BAA2B,CAAC;QACjD,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW;QACtC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO;QAC9B,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,eAAe;QAC9C,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,eAAe;QAC9C,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY;QACxC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;QAChC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,UAAU;QACpC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW;KACvC,CAAC,CAAC;IAEH,MAAM,iBAAiB,GAAG,YAAY,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CACxE,QAAQ,CAAC,IAAI,KAAK,KAAK,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ;QAC3D,CAAC,CAAC;YACE,GAAG,QAAQ;YACX,KAAK,EAAE,6BAA6B,CAAC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;SACrE;QACH,CAAC,CAAC,QAAQ,CACb,CAAC;IACF,MAAM,mBAAmB,GAAG,YAAY,CAAC,cAAc;QACrD,CAAC,CAAC,kCAAkC,CAChC,YAAY,CAAC,WAAW,EACxB,cAAc,EACd,6BAA6B,CAC9B;QACH,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,gBAAgB,GAAG,YAAY,CAAC,WAAW,CAAC,IAAI,CACpD,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CACnC,CAAC;IACF,MAAM,cAAc,GAAG,YAAY,CAAC,KAAK;QACvC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO;QAC5B,CAAC,CAAC,gBAAgB;YAChB,CAAC,CAAC,gBAAgB,CAAC,KAAK;gBACtB,CAAC,CAAC,uBAAuB,gBAAgB,CAAC,IAAI,KAAK,gBAAgB,CAAC,KAAK,GAAG;gBAC5E,CAAC,CAAC,uBAAuB,gBAAgB,CAAC,IAAI,EAAE;YAClD,CAAC,CAAC,IAAI,CAAC;IAEX,OAAO;QACL,iBAAiB,EAAE,iBAAiB,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAC5D,WAAW,EAAE,YAAY,CAAC,WAAW;QACrC,IAAI,EAAE,YAAY,CAAC,IAAI;QACvB,KAAK,EAAE,YAAY,CAAC,KAAK;QACzB,cAAc,EAAE,YAAY,CAAC,cAAc;QAC3C,WAAW,EAAE,mBAAmB;QAChC,UAAU,EAAE;YACV,GAAG,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,WAAW,EAAE,YAAY,CAAC,WAAW;YACrC,IAAI,EAAE,YAAY,CAAC,IAAI;YACvB,iBAAiB,EAAE,iBAAiB,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAC5D,KAAK,EAAE,YAAY,CAAC,KAAK;SAC1B;QACD,YAAY,EAAE,MAAM;QACpB,SAAS,EAAE,aAAa;QACxB,cAAc;KACf,CAAC;AACJ,CAAC,CAAC"}

package/dist/script/features/log.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"log.d.ts","sourceRoot":"","sources":["../../../src/script/features/log.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAsBlD,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IACpC,UAAU,EAAE;QACV,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;QAClC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;QACnC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;QACnC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;QACpC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;KACrC,CAAC;IACF,IAAI,EAAE,cAAc,EAAE,CAAC;CACxB;AAED,eAAO,MAAM,kBAAkB,QAAO,YAqBrC,CAAC;AAKF,eAAO,MAAM,wBAAwB,QAAO,YAU1C,CAAC"}
+{"version":3,"file":"log.d.ts","sourceRoot":"","sources":["../../../src/script/features/log.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAsBlD,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;IACpC,UAAU,EAAE;QACV,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;QAClC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;QACnC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;QACnC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;QACpC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;KACrC,CAAC;IACF,IAAI,EAAE,cAAc,EAAE,CAAC;CACxB;AAUD,eAAO,MAAM,kBAAkB,QAAO,YAkCrC,CAAC;AAKF,eAAO,MAAM,wBAAwB,QAAO,YAU1C,CAAC"}

package/dist/script/features/log.js

@@ -22,13 +22,32 @@ const stringifyArgument = (value) => {
         return String(value);
     }
 };
+// Hard caps so a runaway script (e.g. `while (true) { console.log("x") }`)
+// cannot exhaust host memory or produce a multi-gigabyte result payload.
+// Once the entry cap is hit, append becomes a cheap no-op — which also lets
+// the vm-level `timeout` actually interrupt the now CPU-bound loop instead of
+// the host drowning in allocations first.
+const MAX_LOG_ENTRIES = 1000;
+const MAX_MESSAGE_LENGTH = 8192;
 export const createLogCollector = () => {
     const logs = [];
+    let truncated = false;
     const append = (level, args) => {
-        logs.push({
-            level,
-            message: args.map((entry) => stringifyArgument(entry)).join(" "),
-        });
+        if (logs.length >= MAX_LOG_ENTRIES) {
+            if (!truncated) {
+                truncated = true;
+                logs.push({
+                    level: "warn",
+                    message: `… log output truncated (limit of ${MAX_LOG_ENTRIES} entries reached)`,
+                });
+            }
+            return;
+        }
+        let message = args.map((entry) => stringifyArgument(entry)).join(" ");
+        if (message.length > MAX_MESSAGE_LENGTH) {
+            message = `${message.slice(0, MAX_MESSAGE_LENGTH)}… (truncated)`;
+        }
+        logs.push({ level, message });
     };
     return {
         pmLog: (...args) => append("log", args),

package/dist/script/features/log.js.map

@@ -1 +1 @@
-{"version":3,"file":"log.js","sourceRoot":"","sources":["../../../src/script/features/log.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,0EAA0E;AAC1E,sEAAsE;AACtE,8BAA8B;AAI9B,MAAM,iBAAiB,GAAG,CAAC,KAAc,EAAU,EAAE;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC9E,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,WAAW,EAAE,CAAC;QACjC,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC;IACtC,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC;AAcF,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAiB,EAAE;IACnD,MAAM,IAAI,GAAqB,EAAE,CAAC;IAElC,MAAM,MAAM,GAAG,CAAC,KAA8B,EAAE,IAAe,EAAQ,EAAE;QACvE,IAAI,CAAC,IAAI,CAAC;YACR,KAAK;YACL,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;SACjE,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC;QAClD,UAAU,EAAE;YACV,GAAG,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC;YAChD,IAAI,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;YAClD,IAAI,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;YAClD,KAAK,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC;YACpD,KAAK,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC;SACrD;QACD,IAAI;KACL,CAAC;AACJ,CAAC,CAAC;AAEF,8EAA8E;AAC9E,yEAAyE;AACzE,uEAAuE;AACvE,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAiB,EAAE,CAAC,CAAC;IAC3D,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS;IACtB,UAAU,EAAE;QACV,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS;QACpB,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS;QACrB,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS;QACrB,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS;QACtB,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS;KACvB;IACD,IAAI,EAAE,EAAE;CACT,CAAC,CAAC"}
+{"version":3,"file":"log.js","sourceRoot":"","sources":["../../../src/script/features/log.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,0EAA0E;AAC1E,sEAAsE;AACtE,8BAA8B;AAI9B,MAAM,iBAAiB,GAAG,CAAC,KAAc,EAAU,EAAE;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC9E,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,WAAW,EAAE,CAAC;QACjC,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC;IACtC,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;AACH,CAAC,CAAC;AAcF,2EAA2E;AAC3E,yEAAyE;AACzE,4EAA4E;AAC5E,8EAA8E;AAC9E,0CAA0C;AAC1C,MAAM,eAAe,GAAG,IAAI,CAAC;AAC7B,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAiB,EAAE;IACnD,MAAM,IAAI,GAAqB,EAAE,CAAC;IAClC,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,MAAM,MAAM,GAAG,CAAC,KAA8B,EAAE,IAAe,EAAQ,EAAE;QACvE,IAAI,IAAI,CAAC,MAAM,IAAI,eAAe,EAAE,CAAC;YACnC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,SAAS,GAAG,IAAI,CAAC;gBACjB,IAAI,CAAC,IAAI,CAAC;oBACR,KAAK,EAAE,MAAM;oBACb,OAAO,EAAE,oCAAoC,eAAe,mBAAmB;iBAChF,CAAC,CAAC;YACL,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtE,IAAI,OAAO,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;YACxC,OAAO,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,eAAe,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAChC,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC;QAClD,UAAU,EAAE;YACV,GAAG,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC;YAChD,IAAI,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;YAClD,IAAI,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;YAClD,KAAK,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC;YACpD,KAAK,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC;SACrD;QACD,IAAI;KACL,CAAC;AACJ,CAAC,CAAC;AAEF,8EAA8E;AAC9E,yEAAyE;AACzE,uEAAuE;AACvE,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAiB,EAAE,CAAC,CAAC;IAC3D,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS;IACtB,UAAU,EAAE;QACV,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS;QACpB,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS;QACrB,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS;QACrB,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS;QACtB,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS;KACvB;IACD,IAAI,EAAE,EAAE;CACT,CAAC,CAAC"}

package/dist/script/isolated-runner.d.ts

@@ -0,0 +1,11 @@
+import type { AbortLikeSignal } from "../scenario-runner/types.js";
+import type { ExecuteScriptInput, ExecuteScriptResult, SendRequestExecutor } from "./types.js";
+export interface RunScriptIsolatedOptions {
+    /** Host HTTP executor for pm.sendRequest. When provided, the worker routes
+     *  pm.sendRequest(...) back to it over the MessagePort. */
+    onSendRequest?: SendRequestExecutor;
+    /** External cancellation (e.g. scenario run aborted / node timeout). */
+    signal?: AbortLikeSignal;
+}
+export declare const runScriptIsolated: (input: ExecuteScriptInput, options?: RunScriptIsolatedOptions) => Promise<ExecuteScriptResult>;
+//# sourceMappingURL=isolated-runner.d.ts.map

package/dist/script/isolated-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"isolated-runner.d.ts","sourceRoot":"","sources":["../../src/script/isolated-runner.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EAEnB,mBAAmB,EACpB,MAAM,YAAY,CAAC;AAQpB,MAAM,WAAW,wBAAwB;IACvC;+DAC2D;IAC3D,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,wEAAwE;IACxE,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B;AAqCD,eAAO,MAAM,iBAAiB,GAC5B,OAAO,kBAAkB,EACzB,UAAS,wBAA6B,KACrC,OAAO,CAAC,mBAAmB,CA6H7B,CAAC"}