callman-mcp 0.10.2 → 0.12.0

package/dist/resources/docs/overview.js

@@ -54,6 +54,26 @@ The token works in EVERY workspace the user belongs to (with their role in each)
 - \`run_request\` / \`run_collection\` execute on the user's machine with real variable values;
   you only get results and the names of variables scripts changed.
 
+## Pipeline collections (on-prem)
+On Callman on-prem a collection can be a **pipeline collection** (\`kind: "pipeline"\`, owned by a
+review group): changes go through review like scenarios, approved versions are kept, and CI
+(\`callme run\`, \`run_collection\`) runs only the active APPROVED version with its approved pass
+criteria (\`pipelineConfig\`: threshold %, critical requests, bail, folder runs).
+- \`get_collection\` / \`list_collections\` show \`kind\` and \`review\` (status, active version,
+  pending submission). Edits change the draft; nothing reaches CI until it is approved.
+- Create one with \`create_collection { kind: "pipeline", group }\`, or turn a standard one into it
+  with \`update_collection { kind: "pipeline", group }\`; set the criteria with \`pipelineConfig\`
+  (omitted keys keep their value; critical requests by id or name).
+- \`submit_collection\` sends the draft for review; \`request_collection_deletion\` asks to delete
+  it (\`delete_collection\` refuses pipeline collections). Approving is a person's decision in the
+  Callman app — there is no approve tool, and tokens are denied it.
+- \`run_collection\` returns a \`verdict\` (\`Payments CI v4 · 17/20 passed (85.0%) · threshold 80% ·
+  critical 2/2 ✓ → PASS\`). For a pipeline collection the approved criteria decide (the
+  \`passThreshold\` / \`criticalRequests\` / \`bail\` inputs are ignored) and \`version\` says what ran;
+  for a standard collection those inputs set the criteria (default: every request must pass).
+- A pipeline collection without an approved version cannot run (\`COLLECTION_NOT_APPROVED\`); an
+  administrator may allow CI on pipeline collections only (\`PIPELINE_COLLECTION_REQUIRED\`).
+
 ## Secrets
 Environment and collection-variable values come back masked (\`••••ab\`) unless the token holds
 \`environments:reveal\` and you ask for \`reveal: true\`. Never write a masked environment value back —

package/dist/resources/docs/overview.js.map

@@ -1 +1 @@
-{"version":3,"file":"overview.js","sourceRoot":"","sources":["../../../src/resources/docs/overview.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+F3B,CAAC"}
+{"version":3,"file":"overview.js","sourceRoot":"","sources":["../../../src/resources/docs/overview.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmH3B,CAAC"}

package/dist/resources/generated/aiPacks.d.ts

@@ -1,3 +1,3 @@
-export declare const AI_PACKS_CORE_VERSION = "1.42.0";
+export declare const AI_PACKS_CORE_VERSION = "1.45.1";
 export declare const AI_PACKS: Record<string, string>;
 //# sourceMappingURL=aiPacks.d.ts.map

package/dist/resources/generated/aiPacks.js

@@ -1,12 +1,12 @@
-// GENERATED by scripts/build-static-resources.mjs from callman-core@1.42.0 ai-packs — do not edit.
-export const AI_PACKS_CORE_VERSION = "1.42.0";
+// GENERATED by scripts/build-static-resources.mjs from callman-core@1.45.1 ai-packs — do not edit.
+export const AI_PACKS_CORE_VERSION = "1.45.1";
 export const AI_PACKS = {
-    "db-queries": "<!-- GENERATED FILE — do not edit by hand. Source: callman_core (npm run ai:packs). -->\n\n# Callman data access from scripts (`pm.db.query` / `pm.redis.command`)\n\n`pm.db.query({ connectionId, query })` — ALWAYS `await`. `query` is coerced to a string, `{{tokens}}` are resolved, then dispatched by the connection's type. `connectionId` may be omitted to use the request's configured DB connection. IMPORTANT: `pm.db.query` does NOT accept a `params`/bind array — inline values (quote strings) or use `{{env.X}}` tokens; SQL placeholders like `$1` or `?` are NOT bound.\n\n## MongoDB\n`query` MUST be a JSON STRING of a command object (use `JSON.stringify`), NOT a `db.coll.find(...)` shell string. The match key is `filter` (a top-level `query` key is rejected).\n\n```js\nconst body = pm.response.json();\nconst res = await pm.db.query({\n  connectionId: \"…\",\n  query: JSON.stringify({\n    collection: \"users\",\n    operation: \"findOne\",        // find | findOne | aggregate | countDocuments | insertOne | insertMany | updateOne | updateMany | deleteOne | deleteMany | findOneAndUpdate | findOneAndReplace | findOneAndDelete\n    filter: { email: body.data.user.email },\n  }),\n});\npm.expect(res.rowCount).to.be.above(0);   // existence check\n```\n\nPer-operation fields: `find`/`findOne` use `filter` (+ optional `projection`,`sort`,`limit`,`skip`); `aggregate` uses `pipeline` (array); `insertOne` uses `document`, `insertMany` uses `documents`; `updateOne`/`updateMany`/`findOneAndUpdate` use `filter`+`update` (Mongo update operators, e.g. `{ $set: { … } }`); `deleteOne`/`deleteMany` use `filter`; `findOneAndUpdate`/`findOneAndReplace` accept `returnDocument: \"before\"|\"after\"`. The command text is MongoDB Extended JSON (relaxed): `{ \"$oid\": \"…\" }`, `{ \"$date\": \"2026-01-01T00:00:00Z\" }`, `{ \"$numberDecimal\": \"9.99\" }` and `{ \"$numberLong\": \"…\" }` become real BSON values anywhere in the command; a 24-hex string in a filter is also coerced to ObjectId. Rows are in `res.rows`; write ops surface counts in `res.rowCount`.\n\n## PostgreSQL / MySQL / Oracle (SQL)\n`query` is plain SQL text. Because `pm.db.query` binds no params, inline the value and quote strings yourself (or use a `{{token}}`):\n\n```js\nconst email = pm.response.json().data.user.email;\nconst res = await pm.db.query({\n  connectionId: \"…\",\n  query: `SELECT id FROM users WHERE email = '${email}'`,\n});\npm.expect(res.rowCount).to.be.above(0);\n```\n\nNotes: a trailing `;` is stripped (except Oracle PL/SQL blocks, which keep it). **Oracle** returns column names UPPERCASE — read `res.rows[0].EMAIL`, not `.email`. `res.rowCount` is the row count for SELECT and the affected-row count for INSERT/UPDATE/DELETE.\n\n## SQL Server (mssql)\nSingle statement per query; a trailing `;` is stripped; `GO` batch separators are REJECTED (client-tool syntax, not T-SQL). Positional params bind as named inputs: `params[0]` → `@p1`, `params[1]` → `@p2`… (scenario db node only — `pm.db.query` has no params).\n\n```sql\nSELECT TOP 1 id, amount FROM dbo.orders WHERE customer_id = @p1 ORDER BY created_at DESC\n```\n\n## Redis (`pm.redis.command`)\n`command` is a single string. Supported commands: **GET, SET, DEL, EXISTS, TTL, HGET, HSET, HGETALL, HDEL, LPUSH, RPUSH, LRANGE, LLEN, SADD, SMEMBERS, SISMEMBER, INCR, DECR, INCRBY, EXPIRE, PERSIST, TYPE, ZADD, ZRANGE, ZSCORE, SCAN**. Quote a value that contains spaces.\n\nStructured replies land in `res.result` as real values: `HGETALL` → object, `LRANGE`/`SMEMBERS`/`ZRANGE` → array, `EXISTS`/`SISMEMBER`/`EXPIRE`/`PERSIST` → boolean; `res.resultText` is the stringified form. `SCAN pattern [count]` is Callman-managed: the cursor loop runs internally (capped at 1000 keys / 100 iterations) and returns `{ keys, count, truncated }` — no raw cursors.\n\n```js\nconst res = await pm.redis.command({ connectionId: \"…\", command: `GET session:${id}` });\npm.expect(res.success).to.be.true;\n// res.result / res.resultText hold the value; res.commandName, res.key are set.\n```\n",
+    "db-queries": "<!-- GENERATED FILE — do not edit by hand. Source: callman_core (npm run ai:packs). -->\n\n# Callman data access from scripts (`pm.db.query` / `pm.redis.command`)\n\n`pm.db.query({ connectionId, query, params?, binds?, captureOutput?, timeoutMs? })` — ALWAYS `await`. `query` is coerced to a string, `{{tokens}}` are resolved, then dispatched by the connection's type. `connectionId` may be omitted to use the request's configured DB connection. SQL placeholders are bound from `params` (positional) or `binds` (named, typed, with directions); see below.\n\n## MongoDB\n`query` MUST be a JSON STRING of a command object (use `JSON.stringify`), NOT a `db.coll.find(...)` shell string. The match key is `filter` (a top-level `query` key is rejected).\n\n```js\nconst body = pm.response.json();\nconst res = await pm.db.query({\n  connectionId: \"…\",\n  query: JSON.stringify({\n    collection: \"users\",\n    operation: \"findOne\",        // find | findOne | aggregate | countDocuments | insertOne | insertMany | updateOne | updateMany | deleteOne | deleteMany | findOneAndUpdate | findOneAndReplace | findOneAndDelete\n    filter: { email: body.data.user.email },\n  }),\n});\npm.expect(res.rowCount).to.be.above(0);   // existence check\n```\n\nPer-operation fields: `find`/`findOne` use `filter` (+ optional `projection`,`sort`,`limit`,`skip`); `aggregate` uses `pipeline` (array); `insertOne` uses `document`, `insertMany` uses `documents`; `updateOne`/`updateMany`/`findOneAndUpdate` use `filter`+`update` (Mongo update operators, e.g. `{ $set: { … } }`); `deleteOne`/`deleteMany` use `filter`; `findOneAndUpdate`/`findOneAndReplace` accept `returnDocument: \"before\"|\"after\"`. The command text is MongoDB Extended JSON (relaxed): `{ \"$oid\": \"…\" }`, `{ \"$date\": \"2026-01-01T00:00:00Z\" }`, `{ \"$numberDecimal\": \"9.99\" }` and `{ \"$numberLong\": \"…\" }` become real BSON values anywhere in the command; a 24-hex string in a filter is also coerced to ObjectId. Rows are in `res.rows`; write ops surface counts in `res.rowCount`.\n\n## PostgreSQL / MySQL / Oracle (SQL)\n`query` is plain SQL text. Pass values as `params` (`$1` on Postgres, `?` on MySQL, `:1` on Oracle) instead of writing them into the SQL:\n\n```js\nconst email = pm.response.json().data.user.email;\nconst res = await pm.db.query({\n  connectionId: \"…\",\n  query: `SELECT id FROM users WHERE email = :1`,\n  params: [email],\n});\npm.expect(res.rowCount).to.be.above(0);\n```\n\nTo call a procedure, use `binds` with names, types and directions. OUT values come back in `res.out`, and a cursor is its array of rows:\n\n```js\nconst res = await pm.db.query({\n  connectionId: \"…\",\n  query: `BEGIN pkg.calc(p_id => :p_id, p_total => :p_total, p_rows => :p_rows); END;`,\n  binds: [\n    { name: \"p_id\", value: \"42\", type: \"numeric\" },\n    { name: \"p_total\", type: \"numeric\", direction: \"out\" },\n    { name: \"p_rows\", type: \"cursor\", direction: \"out\" },\n  ],\n  captureOutput: true, // res.output holds DBMS_OUTPUT / RAISE NOTICE / PRINT lines\n});\npm.expect(res.out.p_total).to.equal(12.5);\n```\n\nNotes: a trailing `;` is stripped (except Oracle PL/SQL blocks, which keep it). **Oracle** returns column names UPPERCASE — read `res.rows[0].EMAIL`, not `.email`. `res.rowCount` is the row count for SELECT and the affected-row count for INSERT/UPDATE/DELETE.\n\n## SQL Server (mssql)\nSingle statement per query; a trailing `;` is stripped; `GO` batch separators are REJECTED (client-tool syntax, not T-SQL). Positional params bind as named inputs: `params[0]` → `@p1`, `params[1]` → `@p2`…; named binds use `@name`.\n\n```sql\nSELECT TOP 1 id, amount FROM dbo.orders WHERE customer_id = @p1 ORDER BY created_at DESC\n```\n\n## Redis (`pm.redis.command`)\n`command` is a single string. Supported commands: **GET, SET, DEL, EXISTS, TTL, HGET, HSET, HGETALL, HDEL, LPUSH, RPUSH, LRANGE, LLEN, SADD, SMEMBERS, SISMEMBER, INCR, DECR, INCRBY, EXPIRE, PERSIST, TYPE, ZADD, ZRANGE, ZSCORE, SCAN**. Quote a value that contains spaces.\n\nStructured replies land in `res.result` as real values: `HGETALL` → object, `LRANGE`/`SMEMBERS`/`ZRANGE` → array, `EXISTS`/`SISMEMBER`/`EXPIRE`/`PERSIST` → boolean; `res.resultText` is the stringified form. `SCAN pattern [count]` is Callman-managed: the cursor loop runs internally (capped at 1000 keys / 100 iterations) and returns `{ keys, count, truncated }` — no raw cursors.\n\n```js\nconst res = await pm.redis.command({ connectionId: \"…\", command: `GET session:${id}` });\npm.expect(res.success).to.be.true;\n// res.result / res.resultText hold the value; res.commandName, res.key are set.\n```\n",
     "diagram-components": "<!-- GENERATED FILE — do not edit by hand. Source: callman_core (npm run ai:packs). -->\n\n# Diagram components and edge notation\n\nA diagram node's `type` MUST be one of the keys below (`callman-core` `DIAGRAM_COMPONENT_CATALOG`). Sizes are the defaults the studio uses; `container` types hold children via `parentId`.\n\n## Edge notation\n\n| Semantic | Meaning | Style tuple |\n| --- | --- | --- |\n| `sync` | Request / response call | dashed=false, strokeWidth=1.5 |\n| `async` | Fire-and-forget, event or callback | dashed=true, dashPattern=\"6 4\", strokeWidth=1.5 |\n| `fallback` | Retry, fallback or optional path | dashed=true, dashPattern=\"1 3\", strokeWidth=1.25 |\n| `bus` | Message bus or stream | dashed=false, strokeWidth=3 |\n\n## Generic (`generic`)\n\n| Type | Label | Default size | Aliases |\n| --- | --- | --- | --- |\n| `line` | Line | 160×0 | connector, edge, link |\n| `arrow` | Arrow | 160×0 | connector, directed, link |\n| `line.dashed` | Dashed Line | 160×0 | dotted, connector |\n| `rect` | Rectangle | 140×64 | box, card |\n| `square` | Square | 90×90 |  |\n| `ellipse` | Ellipse | 140×64 | oval |\n| `circle` | Circle | 90×90 |  |\n| `diamond` | Diamond | 140×64 | rhombus |\n| `triangle` | Triangle | 140×64 |  |\n| `hexagon` | Hexagon | 140×64 |  |\n| `pentagon` | Pentagon | 140×64 |  |\n| `octagon` | Octagon | 140×64 |  |\n| `parallelogram` | Parallelogram | 140×64 |  |\n| `trapezoid` | Trapezoid | 140×64 |  |\n| `cylinder` | Cylinder | 140×64 | can, tube |\n| `cloud-shape` | Cloud | 140×64 |  |\n| `callout` | Callout | 140×64 | speech, bubble |\n| `text` | Text | 120×36 |  |\n| `sticky` | Sticky note | 140×100 | postit, comment |\n| `card` | Card | 140×64 |  |\n| `frame` | Frame / Container (container) | 220×160 | group, container, boundary |\n| `pool.horizontal` | Pool (horizontal) (swimlane) | 360×220 | swimlane, lane, container, subsystem |\n| `pool.vertical` | Pool (vertical) (swimlane) | 220×360 | swimlane, lane, container, subsystem |\n| `image` | Image | 140×64 | picture |\n\n## Flowchart (`flowchart`)\n\n| Type | Label | Default size | Aliases |\n| --- | --- | --- | --- |\n| `flow.process` | Process | 140×64 | step, action |\n| `flow.alt-process` | Alternate Process | 140×64 |  |\n| `flow.decision` | Decision | 140×100 | if, branch |\n| `flow.terminator` | Start / End | 130×56 | terminator, begin, stop |\n| `flow.data` | Data (I/O) | 140×64 | input, output, io |\n| `flow.document` | Document | 140×64 |  |\n| `flow.multi-document` | Multi-Document | 140×64 |  |\n| `flow.predefined` | Predefined Process | 140×64 | subroutine |\n| `flow.manual-input` | Manual Input | 140×64 |  |\n| `flow.manual-op` | Manual Operation | 140×64 |  |\n| `flow.preparation` | Preparation | 140×64 |  |\n| `flow.stored-data` | Stored Data | 140×64 |  |\n| `flow.database` | Database | 140×64 | db, store |\n| `flow.display` | Display | 140×64 |  |\n| `flow.delay` | Delay | 140×64 |  |\n| `flow.merge` | Merge | 140×64 |  |\n| `flow.or` | Or | 140×64 |  |\n| `flow.connector` | On-page Connector | 48×48 |  |\n| `flow.off-page` | Off-page Connector | 140×64 |  |\n| `flow.annotation` | Annotation | 140×64 |  |\n\n## UML (`uml`)\n\n| Type | Label | Default size | Aliases |\n| --- | --- | --- | --- |\n| `uml.class` | Class | 140×64 | entity |\n| `uml.abstract` | Abstract Class | 140×64 |  |\n| `uml.interface` | Interface | 140×64 |  |\n| `uml.enum` | Enum | 140×64 |  |\n| `uml.object` | Object | 140×64 |  |\n| `uml.package` | Package | 140×64 |  |\n| `uml.component` | Component | 140×64 |  |\n| `uml.node` | Node / Deployment | 140×64 |  |\n| `uml.actor` | Actor | 60×100 | user, role |\n| `uml.usecase` | Use Case | 140×64 |  |\n| `uml.boundary` | Boundary | 140×64 |  |\n| `uml.control` | Control | 140×64 |  |\n| `uml.entity` | Entity | 140×64 |  |\n| `uml.state` | State | 140×64 |  |\n| `uml.initial` | Initial State | 36×36 |  |\n| `uml.final` | Final State | 40×40 |  |\n| `uml.decision` | Decision | 60×60 |  |\n| `uml.note` | Note / Comment | 140×64 | comment |\n\n## ERD (`erd`)\n\n| Type | Label | Default size | Aliases |\n| --- | --- | --- | --- |\n| `erd.entity` | Entity | 140×64 | table |\n| `erd.weak-entity` | Weak Entity | 140×64 |  |\n| `erd.attribute` | Attribute | 140×64 |  |\n| `erd.key-attribute` | Key Attribute | 140×64 | pk, primary key |\n| `erd.multivalued` | Multivalued Attribute | 140×64 |  |\n| `erd.derived` | Derived Attribute | 140×64 |  |\n| `erd.relationship` | Relationship | 140×64 |  |\n| `erd.identifying` | Identifying Relationship | 140×64 |  |\n\n## Architecture (`networking`)\n\n| Type | Label | Default size | Aliases |\n| --- | --- | --- | --- |\n| `net.user` | User / Client | 60×100 | client, person |\n| `net.admin` | Admin | 60×100 |  |\n| `net.browser` | Browser | 140×64 |  |\n| `net.mobile` | Mobile Device | 90×130 | phone |\n| `net.desktop` | Desktop | 140×64 |  |\n| `net.iot` | IoT Device | 140×64 |  |\n| `net.server` | Server | 140×64 |  |\n| `net.service` | Service | 140×64 | microservice |\n| `net.monolith` | Monolith | 140×64 |  |\n| `net.api-gateway` | API Gateway | 140×64 | api, gateway |\n| `net.load-balancer` | Load Balancer | 140×64 | lb |\n| `net.reverse-proxy` | Reverse Proxy | 140×64 | proxy |\n| `net.firewall` | Firewall | 140×64 | waf |\n| `net.router` | Router | 140×64 |  |\n| `net.switch` | Switch | 140×64 |  |\n| `net.dns` | DNS | 140×64 |  |\n| `net.cdn` | CDN | 140×64 | edge |\n| `net.cache` | Cache | 140×64 |  |\n| `net.queue` | Queue | 140×64 | mq |\n| `net.websocket` | Web Socket | 140×64 | ws |\n| `net.rest` | REST endpoint | 140×64 | http, api |\n| `net.internet` | Internet / Cloud | 140×64 | wan |\n| `net.datacenter` | Datacenter | 140×64 |  |\n| `net.container` | Container | 140×64 |  |\n| `net.pod` | Pod | 140×64 |  |\n| `net.vm` | Virtual Machine | 140×64 | vm |\n\n## Databases (`database`)\n\n| Type | Label | Default size | Aliases |\n| --- | --- | --- | --- |\n| `db.postgres` | PostgreSQL | 176×56 | postgres, pg |\n| `db.mysql` | MySQL | 176×56 |  |\n| `db.mariadb` | MariaDB | 176×56 |  |\n| `db.mongodb` | MongoDB | 176×56 | mongo |\n| `db.redis` | Redis | 176×56 |  |\n| `db.sqlite` | SQLite | 176×56 |  |\n| `db.mssql` | MS SQL Server | 176×56 | sqlserver, mssql |\n| `db.oracle` | Oracle | 176×56 |  |\n| `db.cassandra` | Cassandra | 176×56 |  |\n| `db.elasticsearch` | Elasticsearch | 176×56 | elastic, es |\n| `db.neo4j` | Neo4j | 176×56 | graph |\n| `db.couchdb` | CouchDB | 176×56 | couch |\n| `db.couchbase` | Couchbase | 176×56 |  |\n| `db.clickhouse` | ClickHouse | 176×56 |  |\n| `db.cockroachdb` | CockroachDB | 176×56 | cockroach |\n| `db.influxdb` | InfluxDB | 176×56 | influx, tsdb |\n| `db.snowflake` | Snowflake | 176×56 |  |\n| `db.supabase` | Supabase | 176×56 |  |\n\n## Messaging (`messaging`)\n\n| Type | Label | Default size | Aliases |\n| --- | --- | --- | --- |\n| `mq.kafka` | Apache Kafka | 176×56 | kafka |\n| `mq.rabbitmq` | RabbitMQ | 176×56 | rabbit, amqp |\n| `mq.nats` | NATS | 176×56 |  |\n| `mq.pulsar` | Apache Pulsar | 176×56 | pulsar |\n| `mq.mqtt` | MQTT | 176×56 |  |\n| `mq.pubsub` | Pub/Sub | 176×56 | pubsub |\n| `mq.activemq` | ActiveMQ | 176×56 | jms |\n\n## Languages (`language`)\n\n| Type | Label | Default size | Aliases |\n| --- | --- | --- | --- |\n| `lang.node` | Node.js | 176×56 | node, js runtime |\n| `lang.python` | Python | 176×56 | py |\n| `lang.java` | Java | 176×56 | jvm |\n| `lang.go` | Go | 176×56 | golang |\n| `lang.rust` | Rust | 176×56 |  |\n| `lang.dotnet` | C# / .NET | 176×56 | csharp, c# |\n| `lang.typescript` | TypeScript | 176×56 | ts |\n| `lang.javascript` | JavaScript | 176×56 | js |\n| `lang.ruby` | Ruby | 176×56 |  |\n| `lang.php` | PHP | 176×56 |  |\n| `lang.kotlin` | Kotlin | 176×56 |  |\n| `lang.swift` | Swift | 176×56 |  |\n| `lang.scala` | Scala | 176×56 |  |\n| `lang.elixir` | Elixir | 176×56 |  |\n| `lang.cpp` | C++ | 176×56 | cpp |\n\n## Frameworks (`framework`)\n\n| Type | Label | Default size | Aliases |\n| --- | --- | --- | --- |\n| `fw.express` | Express | 176×56 |  |\n| `fw.nestjs` | NestJS | 176×56 | nest |\n| `fw.spring` | Spring Boot | 176×56 | spring |\n| `fw.django` | Django | 176×56 |  |\n| `fw.flask` | Flask | 176×56 |  |\n| `fw.fastapi` | FastAPI | 176×56 |  |\n| `fw.rails` | Rails | 176×56 | ruby on rails |\n| `fw.laravel` | Laravel | 176×56 |  |\n| `fw.dotnet` | .NET | 176×56 |  |\n| `fw.react` | React | 176×56 |  |\n| `fw.vue` | Vue | 176×56 | vuejs |\n| `fw.angular` | Angular | 176×56 |  |\n| `fw.next` | Next.js | 176×56 | nextjs |\n| `fw.nuxt` | Nuxt | 176×56 | nuxtjs |\n| `fw.svelte` | Svelte | 176×56 | sveltekit |\n| `fw.electron` | Electron | 176×56 |  |\n| `fw.tailwind` | Tailwind | 176×56 | tailwindcss |\n| `fw.graphql` | GraphQL | 176×56 |  |\n\n## DevOps / CI-CD (`devops`)\n\n| Type | Label | Default size | Aliases |\n| --- | --- | --- | --- |\n| `ops.docker` | Docker | 176×56 |  |\n| `ops.k8s` | Kubernetes | 176×56 | k8s |\n| `ops.nginx` | Nginx | 176×56 |  |\n| `ops.haproxy` | HAProxy | 176×56 | lb |\n| `ops.traefik` | Traefik | 176×56 | traefik |\n| `ops.terraform` | Terraform | 176×56 | iac |\n| `ops.ansible` | Ansible | 176×56 |  |\n| `ops.jenkins` | Jenkins | 176×56 | ci |\n| `ops.gha` | GitHub Actions | 176×56 | ci, actions |\n| `ops.gitlab` | GitLab CI | 176×56 | ci |\n| `ops.argocd` | ArgoCD | 176×56 | gitops |\n| `ops.helm` | Helm | 176×56 |  |\n| `ops.istio` | Istio | 176×56 | service mesh |\n| `ops.envoy` | Envoy | 176×56 | proxy |\n| `ops.consul` | Consul | 176×56 |  |\n| `ops.vault` | Vault | 176×56 | secrets |\n| `ops.pm2` | PM2 | 176×56 |  |\n| `ops.maven` | Maven | 176×56 | build |\n\n## Auth / Identity (`auth`)\n\n| Type | Label | Default size | Aliases |\n| --- | --- | --- | --- |\n| `auth.oidc` | OpenID Connect | 176×56 | oidc |\n| `auth.jwt` | JWT | 176×56 | token |\n| `auth.keycloak` | Keycloak | 176×56 |  |\n| `auth.auth0` | Auth0 | 176×56 |  |\n| `auth.okta` | Okta | 176×56 |  |\n| `auth.firebase` | Firebase Auth | 176×56 | firebase |\n| `auth.oauth` | OAuth 2.0 | 176×56 | oauth |\n| `auth.saml` | SAML | 176×56 |  |\n| `auth.ldap` | LDAP | 176×56 |  |\n\n## Observability (`observability`)\n\n| Type | Label | Default size | Aliases |\n| --- | --- | --- | --- |\n| `obs.prometheus` | Prometheus | 176×56 | metrics |\n| `obs.grafana` | Grafana | 176×56 | dashboard |\n| `obs.datadog` | Datadog | 176×56 |  |\n| `obs.sentry` | Sentry | 176×56 | errors |\n| `obs.elasticsearch` | Elasticsearch | 176×56 | elk |\n| `obs.logstash` | Logstash | 176×56 | elk |\n| `obs.kibana` | Kibana | 176×56 | elk |\n| `obs.jaeger` | Jaeger | 176×56 | tracing |\n| `obs.otel` | OpenTelemetry | 176×56 | otel, tracing |\n| `obs.newrelic` | New Relic | 176×56 |  |\n\n## AWS (`aws`)\n\n| Type | Label | Default size | Aliases |\n| --- | --- | --- | --- |\n| `aws.ec2` | EC2 | 176×56 | aws |\n| `aws.lambda` | Lambda | 176×56 | aws |\n| `aws.s3` | S3 | 176×56 | aws |\n| `aws.ebs` | EBS | 176×56 | aws |\n| `aws.efs` | EFS | 176×56 | aws |\n| `aws.rds` | RDS | 176×56 | aws |\n| `aws.aurora` | Aurora | 176×56 | aws |\n| `aws.dynamodb` | DynamoDB | 176×56 | aws |\n| `aws.elasticache` | ElastiCache | 176×56 | aws |\n| `aws.redshift` | Redshift | 176×56 | aws |\n| `aws.vpc` | VPC | 176×56 | aws |\n| `aws.subnet` | Subnet | 176×56 | aws |\n| `aws.internet-gateway` | Internet Gateway | 176×56 | aws |\n| `aws.nat-gateway` | NAT Gateway | 176×56 | aws |\n| `aws.elb` | ELB | 176×56 | aws |\n| `aws.alb` | ALB | 176×56 | aws |\n| `aws.nlb` | NLB | 176×56 | aws |\n| `aws.api-gateway` | API Gateway | 176×56 | aws |\n| `aws.cloudfront` | CloudFront | 176×56 | aws |\n| `aws.route-53` | Route 53 | 176×56 | aws |\n| `aws.sqs` | SQS | 176×56 | aws |\n| `aws.sns` | SNS | 176×56 | aws |\n| `aws.eventbridge` | EventBridge | 176×56 | aws |\n| `aws.kinesis` | Kinesis | 176×56 | aws |\n| `aws.step-functions` | Step Functions | 176×56 | aws |\n| `aws.ecs` | ECS | 176×56 | aws |\n| `aws.eks` | EKS | 176×56 | aws |\n| `aws.fargate` | Fargate | 176×56 | aws |\n| `aws.ecr` | ECR | 176×56 | aws |\n| `aws.iam` | IAM | 176×56 | aws |\n| `aws.cognito` | Cognito | 176×56 | aws |\n| `aws.secrets-manager` | Secrets Manager | 176×56 | aws |\n| `aws.kms` | KMS | 176×56 | aws |\n| `aws.cloudwatch` | CloudWatch | 176×56 | aws |\n| `aws.cloudtrail` | CloudTrail | 176×56 | aws |\n| `aws.glue` | Glue | 176×56 | aws |\n| `aws.athena` | Athena | 176×56 | aws |\n| `aws.sagemaker` | SageMaker | 176×56 | aws |\n| `aws.appsync` | AppSync | 176×56 | aws |\n| `aws.amplify` | Amplify | 176×56 | aws |\n\n## Azure (`azure`)\n\n| Type | Label | Default size | Aliases |\n| --- | --- | --- | --- |\n| `azure.virtual-machine` | Virtual Machine | 176×56 | azure |\n| `azure.vm-scale-set` | VM Scale Set | 176×56 | azure |\n| `azure.app-service` | App Service | 176×56 | azure |\n| `azure.functions` | Functions | 176×56 | azure |\n| `azure.container-instances` | Container Instances | 176×56 | azure |\n| `azure.aks` | AKS | 176×56 | azure |\n| `azure.container-registry` | Container Registry | 176×56 | azure |\n| `azure.blob-storage` | Blob Storage | 176×56 | azure |\n| `azure.files` | Files | 176×56 | azure |\n| `azure.disk` | Disk | 176×56 | azure |\n| `azure.sql-database` | SQL Database | 176×56 | azure |\n| `azure.cosmos-db` | Cosmos DB | 176×56 | azure |\n| `azure.cache-for-redis` | Cache for Redis | 176×56 | azure |\n| `azure.synapse` | Synapse | 176×56 | azure |\n| `azure.virtual-network` | Virtual Network | 176×56 | azure |\n| `azure.load-balancer` | Load Balancer | 176×56 | azure |\n| `azure.application-gateway` | Application Gateway | 176×56 | azure |\n| `azure.front-door` | Front Door | 176×56 | azure |\n| `azure.service-bus` | Service Bus | 176×56 | azure |\n| `azure.event-hub` | Event Hub | 176×56 | azure |\n| `azure.event-grid` | Event Grid | 176×56 | azure |\n| `azure.key-vault` | Key Vault | 176×56 | azure |\n| `azure.entra-id` | Entra ID | 176×56 | azure |\n| `azure.monitor` | Monitor | 176×56 | azure |\n| `azure.application-insights` | Application Insights | 176×56 | azure |\n| `azure.logic-apps` | Logic Apps | 176×56 | azure |\n| `azure.api-management` | API Management | 176×56 | azure |\n\n## GCP (`gcp`)\n\n| Type | Label | Default size | Aliases |\n| --- | --- | --- | --- |\n| `gcp.compute-engine` | Compute Engine | 176×56 | gcp, google |\n| `gcp.app-engine` | App Engine | 176×56 | gcp, google |\n| `gcp.cloud-functions` | Cloud Functions | 176×56 | gcp, google |\n| `gcp.cloud-run` | Cloud Run | 176×56 | gcp, google |\n| `gcp.gke` | GKE | 176×56 | gcp, google |\n| `gcp.artifact-registry` | Artifact Registry | 176×56 | gcp, google |\n| `gcp.cloud-storage` | Cloud Storage | 176×56 | gcp, google |\n| `gcp.persistent-disk` | Persistent Disk | 176×56 | gcp, google |\n| `gcp.cloud-sql` | Cloud SQL | 176×56 | gcp, google |\n| `gcp.cloud-spanner` | Cloud Spanner | 176×56 | gcp, google |\n| `gcp.firestore` | Firestore | 176×56 | gcp, google |\n| `gcp.bigtable` | Bigtable | 176×56 | gcp, google |\n| `gcp.bigquery` | BigQuery | 176×56 | gcp, google |\n| `gcp.memorystore` | Memorystore | 176×56 | gcp, google |\n| `gcp.vpc` | VPC | 176×56 | gcp, google |\n| `gcp.cloud-load-balancing` | Cloud Load Balancing | 176×56 | gcp, google |\n| `gcp.cloud-cdn` | Cloud CDN | 176×56 | gcp, google |\n| `gcp.cloud-dns` | Cloud DNS | 176×56 | gcp, google |\n| `gcp.pub-sub` | Pub/Sub | 176×56 | gcp, google |\n| `gcp.dataflow` | Dataflow | 176×56 | gcp, google |\n| `gcp.cloud-tasks` | Cloud Tasks | 176×56 | gcp, google |\n| `gcp.iam` | IAM | 176×56 | gcp, google |\n| `gcp.secret-manager` | Secret Manager | 176×56 | gcp, google |\n| `gcp.cloud-kms` | Cloud KMS | 176×56 | gcp, google |\n| `gcp.cloud-monitoring` | Cloud Monitoring | 176×56 | gcp, google |\n| `gcp.vertex-ai` | Vertex AI | 176×56 | gcp, google |\n",
-    "feature-policy": "<!-- GENERATED FILE — do not edit by hand. Source: callman_core (npm run ai:packs). -->\n\n# Script feature policy\n\nSome `pm.*` features can be disabled per execution context (ScriptFeaturePolicy). A disabled feature evaluates to `undefined` at top level; inside `pm.test` callbacks it throws so the test reports SKIPPED instead of failing.\n\nCapability-gated members:\n\n## database\n\n- `pm.db.query({ connectionId, query })`\n- `pm.db.pre`\n- `pm.db.post`\n\n## redis\n\n- `pm.redis.command({ connectionId, command })`\n- `pm.redis.get(key)`\n- `pm.redis.results.pre`\n- `pm.redis.results.post`\n\nGeneration guidance: prefer declared pre/post queries and `pm.db.query` only when the user explicitly asks for database work; never assume redis capabilities exist unless the task mentions them.\n",
-    "pm-api": "<!-- GENERATED FILE — do not edit by hand. Source: callman_core (npm run ai:packs). -->\n\n# Callman `pm.*` scripting API\n\nScripts are plain JavaScript (top-level `await` allowed). `pm`, `cm` and `callman` are the SAME object: a script can use `cm.` exactly like `pm.` (cm.environment.get(...), cm.test(...), cm.expect(...)), and Postman scripts run unchanged. Use ONLY the API below — fetch, XMLHttpRequest, process, eval, import() and the filesystem are blocked by the sandbox (use `pm.sendRequest` for HTTP and `require()` for the built-in libraries).\n\n## pm\n\nThe script API. `cm` and `callman` are the SAME object as `pm` — a script can use `cm.` exactly like `pm.` (cm === pm), so Postman scripts run unchanged and Callman-branded scripts behave identically.\n\n- `cm.environment.set(key, value)` — `cm.x` and `callman.x` are aliases of `pm.x` for every member below. Example: `cm.test(\"ok\", () => cm.expect(1).to.equal(1))`\n\n## pm.test\n\nRegister a named test. The callback runs synchronously; a failing assertion (or a throw) marks the test failed without aborting the script. Works in pre-request, post-response and tests scripts.\n\n- `pm.test(name, fn)` — Runs fn immediately; pass/fail lands in the run's test results. An async fn / returned Promise is awaited before the script is reported. Example: `pm.test(\"sum is 4\", () => pm.expect(2 + 2).to.equal(4))`\n- `pm.test(name, done => { done(); })` — Callback-style async test: the test completes when done() is called (done(error) fails it). Example: `pm.test(\"later\", done => { setTimeout(done, 10); })`\n- `pm.test.skip(name)` — Record a skipped test (shown as SKIP); the callback, if any, is never run. Example: `pm.test.skip(\"not ready yet\")`\n- `pm.test.index()` — Number of tests recorded so far in this script. Example: `pm.test.index()`\n\n## pm.expect\n\npm.expect is chai 4.4.1 with the full BDD API (expect-style), the chai-postman helpers and a few jest-style aliases. Chain words (to, be, been, is, that, which, and, has, have, with, at, of, same, but, does, still, also) read like English; flags (not, deep, nested, own, ordered, any, all, itself) change the assertion that follows. Equality is strict: .equal / .eq use ===, so NaN does not equal NaN and 1 does not equal \"1\"; use .eql / .deep.equal for structural comparison. Failure messages are chai's own.\n\n- `pm.expect(value, message?)` — Start an assertion. Equality: .to.equal(x) (===), .to.eql(x) / .to.deep.equal(x) (deep), .toBe(x) / .toEqual(x) (jest-style). Existence/type: .to.exist, .to.be.null, .to.be.undefined, .to.be.true, .to.be.a('string'|'number'|'array'|'object'|...). Strings/arrays: .to.include(x) / .to.contain(x) / .toContain(x), .to.have.lengthOf(n), .to.be.empty, .to.match(/re/), .to.have.members([...]), .to.be.oneOf([...]). Numbers: .to.be.above(n) / .below(n) / .within(a, b) / .closeTo(n, delta) / .toBeGreaterThan(n) / .toBeLessThan(n). Objects: .to.have.property('a.b', value?) (dot paths work by default), .to.have.all.keys('a', 'b'), .to.have.jsonSchema(schema). Negation: .to.not.<assertion>. Example: `pm.expect(user.id).to.be.a(\"number\")`\n- `pm.expect.fail(message?)` — Throws an AssertionError (fails the surrounding test) immediately. Example: `pm.expect.fail(\"unexpected branch\")`\n- `pm.expect(value).to.have.jsonSchema(schema, ajvOptions?)` — Validate any value against a JSON Schema (ajv). Also available on the response as pm.response.to.have.jsonSchema(schema) in post-response scripts. Example: `pm.expect(user).to.have.jsonSchema({ type: \"object\", required: [\"id\"] })`\n\n## pm.environment\n\nActive environment variables (alias: pm.env). get() returns the value as it was set within the run (numbers and objects stay native); stored values are strings, objects/arrays are saved as JSON. Writes surface as variable mutations.\n\n- `pm.environment.get(key)` — Read a variable (undefined when missing). Example: `pm.environment.get(\"baseUrl\")`\n- `pm.environment.set(key, value, type?)` — Write a variable for subsequent steps. type is one of string, number, boolean, json, any. Example: `pm.environment.set(\"token\", token)`\n- `pm.environment.unset(key)` — Remove a variable.\n- `pm.environment.has(key)` — true when the key exists.\n- `pm.environment.clear()` — Remove every variable in the scope.\n- `pm.environment.toObject()` — Plain { key: value } snapshot.\n- `pm.environment.replaceIn(template)` — Resolve {{tokens}} against THIS scope only. Unresolved {{x}} stay as written (literal); objects and arrays are walked. Example: `pm.environment.replaceIn(\"{{baseUrl}}/users\")`\n- `pm.environment.name` — Active environment's name.\n- `pm.environment.values` — The raw string values record (read-only view).\n\n## pm.globals\n\nWorkspace-level global variables. Same surface as pm.environment.\n\n- `pm.globals.get(key)` — Read a global.\n- `pm.globals.set(key, value, type?)` — Write a global for the run.\n- `pm.globals.unset(key)` — Remove a global.\n- `pm.globals.has(key)` — true when the key exists.\n- `pm.globals.clear()` — Remove every global in the scope.\n- `pm.globals.toObject()` — Plain snapshot.\n- `pm.globals.replaceIn(template)` — Resolve {{tokens}} against the globals; unresolved tokens stay literal.\n- `pm.globals.name` — Scope name.\n- `pm.globals.values` — The raw string values record (read-only view).\n\n## pm.collectionVariables\n\nCollection-scoped variables that survive across requests within one collection run. `{{name}}` resolves them after the environment and before globals.\n\n- `pm.collectionVariables.get(key)` — Read a collection variable.\n- `pm.collectionVariables.set(key, value, type?)` — Write; persists across the iteration.\n- `pm.collectionVariables.unset(key)` — Remove a collection variable.\n- `pm.collectionVariables.has(key)` — true when the key exists.\n- `pm.collectionVariables.clear()` — Remove all collection variables.\n- `pm.collectionVariables.toObject()` — Plain snapshot.\n- `pm.collectionVariables.replaceIn(template)` — Resolve {{tokens}}; unresolved tokens stay literal.\n- `pm.collectionVariables.name` — Scope name.\n- `pm.collectionVariables.values` — The raw string values record (read-only view).\n\n## pm.variables\n\nLayered read across all scopes — local > iteration data > environment > collection > globals. `set` writes the local scope, shared by every script of the same request (collection → folder → request) and gone afterwards.\n\n- `pm.variables.get(key)` — Read through the precedence chain. Example: `pm.variables.get(\"userId\")`\n- `pm.variables.set(key, value, type?)` — Write to the run-local layer.\n- `pm.variables.unset(key)` — Remove from the run-local layer.\n- `pm.variables.has(key)` — true when any layer has the key.\n- `pm.variables.clear()` — Clear the run-local layer.\n- `pm.variables.toObject()` — Merged snapshot.\n- `pm.variables.replaceIn(template)` — Postman semantics: resolve {{tokens}} (and dynamic variables like {{$guid}}); an unresolved {{x}} stays as written; objects and arrays are walked. Example: `pm.variables.replaceIn(\"{{baseUrl}}/users/{{userId}}\")`\n- `pm.variables.resolve(template)` — Callman's older resolver: like replaceIn on a string, but an unresolved {{x}} becomes an empty string. Does NOT read scenario node outputs — use pm.node(label) for those. Example: `pm.variables.resolve(\"{{missing}}\")`\n\n## pm.iterationData\n\nThe data-file / dataset row of the current iteration of a data-driven run (empty outside one). Also a layer of pm.variables.\n\n- `pm.iterationData.get(key)` — Read a column of the current row. Example: `pm.iterationData.get(\"email\")`\n- `pm.iterationData.has(key)` — true when the row has the column.\n- `pm.iterationData.toObject()` — The whole row as a plain object.\n- `pm.iterationData.toJSON()` — Same as toObject(); used by JSON.stringify.\n- `pm.iterationData.set(key, value)` — Change this run's copy of the row (not written back to the data file).\n- `pm.iterationData.unset(key)` — Remove a column from this run's copy of the row.\n- `pm.iterationData.clear()` — Remove every column from this run's copy of the row.\n- `pm.iterationData.replaceIn(template)` — Resolve {{tokens}} against the row only.\n\n## pm.request\n\nThe request. Its url is a postman-collection Url object that ALSO behaves like a string (url.includes('/v1'), url + '?x=1'); headers is a HeaderList (case-insensitive get/has/add/upsert/remove, bracket access headers['X-Id']). Mutations only have effect in pre-request scripts (the call has not fired yet).\n\n- `pm.request.url` — Url object: .getHost() .getPath() .getPathWithQuery() .getQueryString() .getRaw() .protocol .host[] .port .path[] .hash .query (list of params) .variables .addQueryParams() .removeQueryParams() .update(); also usable as a string. Assign a string to replace it.\n- `pm.request.url.query.get(key)` — Value of a query param. Example: `pm.request.url.query.get(\"page\")`\n- `pm.request.url.query.add(param)` — Add a query param ({ key, value }). _(stages: pre-request)_ Example: `pm.request.url.query.add({ key: \"debug\", value: \"1\" })`\n- `pm.request.method` — HTTP method string; assignable in pre-request.\n- `pm.request.body` — RequestBody: .mode ('raw'|'urlencoded'|'formdata'|'file'|'graphql') .raw .urlencoded .formdata .graphql .isEmpty() .toString() .update({ mode, raw }). Example: `pm.request.body.update({ mode: \"raw\", raw: JSON.stringify({ a: 1 }) })`\n- `pm.request.headers` — HeaderList: .get(name) .has(name) .add({key,value}) .upsert({key,value}) .remove(name) .each(fn) .map(fn) .filter(fn) .find(fn) .count() .toObject(); bracket access reads/writes by name. Example: `pm.request.headers.upsert({ key: \"X-Trace\", value: pm.variables.replaceIn(\"{{$guid}}\") })`\n- `pm.request.query` — Callman alias of pm.request.url.query (the query params list).\n- `pm.request.getHeader(name)` — Read one header value (case-insensitive).\n- `pm.request.setHeader(name, value)` — Set/replace a header. _(stages: pre-request)_\n- `pm.request.unsetHeader(name)` — Remove a header. _(stages: pre-request)_\n- `pm.request.getQueryParam(name)` — Read one query param.\n- `pm.request.setQueryParam(name, value)` — Set/replace a query param. _(stages: pre-request)_\n- `pm.request.unsetQueryParam(name)` — Remove a query param. _(stages: pre-request)_\n- `pm.request.setUrl(url)` — Replace the URL. _(stages: pre-request)_\n- `pm.request.setMethod(method)` — Replace the method. _(stages: pre-request)_\n- `pm.request.setRawBody(value)` — Replace the body with raw text (objects are NOT auto-stringified; pass JSON.stringify(obj)). _(stages: pre-request)_\n- `pm.request.to.have.header(name)` — chai-postman assertions work on the request too (pm.request.to.have.header, .to.have.body, ...).\n\n## pm.response\n\nThe received response — a postman-collection Response. Not available in pre-request scripts. pm.response.code is the NUMBER (200); pm.response.status is the reason PHRASE ('OK', 'Not Found') exactly like Postman, so `pm.response.status === 200` is false.\n\n- `pm.response.code` — Status code (number). _(stages: post-response, tests)_ Example: `pm.expect(pm.response.code).to.equal(200)`\n- `pm.response.status` — Status reason phrase (string), e.g. \"OK\". Use pm.response.code for the number. _(stages: post-response, tests)_\n- `pm.response.reason()` — Reason phrase (method form of status). _(stages: post-response, tests)_\n- `pm.response.statusText` — Callman alias of pm.response.reason(). _(stages: post-response, tests)_\n- `pm.response.json()` — Parse the body as JSON — call it once into a const. THROWS when the body is empty or not valid JSON (guard with try/catch, or assert pm.response.to.be.json first). Optional reviver as in JSON.parse. _(stages: post-response, tests)_ Example: `const body = pm.response.json()`\n- `pm.response.text()` — Raw body as a string. _(stages: post-response, tests)_\n- `pm.response.jsonp(callbackName?)` — Parse a JSONP body; throws when it is not valid. _(stages: post-response, tests)_\n- `pm.response.rawBody` — Raw body string (Callman alias of text()). _(stages: post-response, tests)_\n- `pm.response.body` — Callman: the parsed body (JSON value, or the text). Prefer json() / text(). _(stages: post-response, tests)_\n- `pm.response.headers` — Response HeaderList (read-only): .get(name) .has(name) .each(fn) .toObject(); bracket access headers['content-type']. _(stages: post-response, tests)_ Example: `pm.response.headers.get(\"Content-Type\")`\n- `pm.response.cookies` — CookieList of the response's Set-Cookie headers: .get(name) .has(name) .toObject() .each(fn). _(stages: post-response, tests)_\n- `pm.response.responseTime` — Duration in ms. _(stages: post-response, tests)_\n- `pm.response.responseSize` — Body size in bytes. _(stages: post-response, tests)_\n- `pm.response.size()` — { body, header, total } sizes in bytes. _(stages: post-response, tests)_\n- `pm.response.dataURI()` — The body as a data: URI. _(stages: post-response, tests)_\n- `pm.response.details()` — { code, name, detail } of the status code. _(stages: post-response, tests)_\n- `pm.response.contentInfo()` — { mimeType, mimeFormat, charset, fileExtension, contentType } of the body. _(stages: post-response, tests)_\n- `pm.response.stream` — Body bytes as a Buffer. _(stages: post-response, tests)_\n- `pm.response.to.have.status(codeOrReason)` — chai-postman assertions on the response: .to.have.status(200 | \"OK\"), .to.have.header(name, value?), .to.have.body(text?), .to.have.jsonBody(path?, value?), .to.have.jsonSchema(schema), .to.have.responseTime.below(ms), .to.be.ok / .success / .info / .redirection / .clientError / .serverError / .error / .json / .html / .xml / .withBody / .accepted / .badRequest / .unauthorized / .forbidden / .notFound / .rateLimited, plus .to.not.<predicate>. _(stages: post-response, tests)_ Example: `pm.response.to.have.status(200)`\n\n## pm.sendRequest\n\nFire an ad-hoc HTTP request from inside a script. It returns a Promise that resolves to a Response with the same API as pm.response (code, status, json(), text(), headers, cookies, responseTime, ...). The callback form (err, res) also works; hosts that keep a cookie jar send and store cookies.\n\n- `pm.sendRequest(url)` — GET a URL string. Prefer `const res = await pm.sendRequest(...)`. Example: `const res = await pm.sendRequest(\"https://api.example.com/health\")`\n- `pm.sendRequest({ url, method, header, body })` — Request options. header: object, array of { key, value } or a header string. body: a string, or { mode: 'raw', raw }, { mode: 'urlencoded', urlencoded: [{key,value}] }, { mode: 'formdata', formdata: [{key,value}] } (text parts only), { mode: 'graphql', graphql: { query, variables } }. {{variables}} in all fields are resolved. Example: `await pm.sendRequest({ url: \"https://x.test/login\", method: \"POST\", header: { \"Content-Type\": \"application/json\" }, body: { mode: \"raw\", raw: JSON.stringify({ user: \"a\" }) } })`\n- `pm.sendRequest(request, (err, res, history) => {})` — Callback form; request may also be a postman-collection Request (new (require('postman-collection').Request)({...})). Example: `pm.sendRequest(\"https://x.test\", (err, res) => { pm.environment.set(\"code\", res.code) })`\n\n## pm.cookies\n\nCookies of the current request's domain (a CookieList: .get(name) .has(name) .toObject() .each(fn)), plus the cookie jar of ANY domain via pm.cookies.jar().\n\n- `pm.cookies.get(name)` — Value of a cookie of the request's domain. Example: `pm.cookies.get(\"session\")`\n- `pm.cookies.has(name)` — true when the cookie exists.\n- `pm.cookies.toObject()` — { name: value } of the request's domain.\n- `pm.cookies.jar()` — The cookie jar. Every jar method takes a callback (error, result) OR returns a Promise. Example: `const jar = pm.cookies.jar()`\n- `pm.cookies.jar().set(url, name, value)` — Set a cookie (or pass a { name, value, domain, path, expires, httpOnly, secure } object instead of name, value). Example: `await pm.cookies.jar().set(\"https://x.test\", \"theme\", \"dark\")`\n- `pm.cookies.jar().get(url, name)` — Value of one cookie, or null. Example: `await pm.cookies.jar().get(\"https://x.test\", \"theme\")`\n- `pm.cookies.jar().getAll(url)` — All cookies matching the url (Cookie objects). Example: `await pm.cookies.jar().getAll(\"https://x.test\")`\n- `pm.cookies.jar().unset(url, name)` — Delete one cookie.\n- `pm.cookies.jar().clear(url)` — Delete every cookie of the url's domain.\n\n## pm.visualizer\n\nRender a custom view of the response: pass a Handlebars HTML template and its data; the host shows it in the Visualize tab (the last call wins). Data must be JSON-serializable.\n\n- `pm.visualizer.set(template, data, options?)` — template: Handlebars HTML string; data: object available as {{...}} in the template; options: Handlebars compile options. _(stages: post-response, tests)_ Example: `pm.visualizer.set(\"<ul>{{#each items}}<li>{{name}}</li>{{/each}}</ul>\", { items: pm.response.json() })`\n- `pm.visualizer.clear()` — Remove the visualization set earlier in the run. _(stages: post-response, tests)_\n- `pm.getData(callback)` — Inside a visualizer template script: receive the data passed to pm.visualizer.set as callback(error, data). _(stages: post-response, tests)_ Example: `pm.getData((error, data) => { console.log(data) })`\n\n## require\n\nrequire(name) and pm.require(name) load one of the built-in libraries (Postman's list). There is no filesystem or package access: `npm:`, `jsr:` and `@team/` specifiers and any other name throw \"Cannot find module\". The `node:` prefix is accepted.\n\n- `require(name)` — Built-in modules: lodash, moment, chai, ajv (v6), cheerio (0.22), xml2js, uuid, csv-parse/lib/sync, postman-collection, crypto-js, tv4, atob, btoa, path, assert, buffer, util, url, querystring, string_decoder, stream, events, punycode, timers. Example: `const moment = require(\"moment\")`\n- `pm.require(name)` — Same as require(name). Example: `const _lodash = pm.require(\"lodash\")`\n- `require('uuid').v4()` — Random UUID v4 string. Example: `const id = require(\"uuid\").v4()`\n- `require('csv-parse/lib/sync')(input, options?)` — Parse CSV text into an array of rows. Example: `require(\"csv-parse/lib/sync\")(csv, { columns: true })`\n- `require('xml2js').parseString(xml, callback)` — Parse XML into a JS object (also parseStringPromise). Example: `require(\"xml2js\").parseString(xmlText, (err, result) => {})`\n- `require('cheerio').load(html)` — Parse HTML and query it with jQuery-style selectors (cheerio 0.22). Example: `const $ = require(\"cheerio\").load(htmlText)`\n\n## console\n\nThe full console API. Output appears in the run's Console and is streamed while the script runs (kept even when the script times out). Format strings %s %d %i %f %j %o %O %c are supported; objects, Errors, Maps and Sets print readably.\n\n- `console.log(...args)` — Print to the console (also console.info / warn / error / debug, which set the level). Example: `console.log(\"token:\", pm.environment.get(\"token\"))`\n- `console.info(...args)` — Info level.\n- `console.warn(...args)` — Warning level.\n- `console.error(...args)` — Error level.\n- `console.debug(...args)` — Debug level.\n- `console.trace(...args)` — Log with a stack trace.\n- `console.assert(condition, ...args)` — Log an error when the condition is falsy (never throws).\n- `console.count(label?)` — Count calls per label. Example: `console.count(\"retry\")`\n- `console.countReset(label?)` — Reset a counter.\n- `console.time(label?)` — Start a timer.\n- `console.timeLog(label?, ...args)` — Log the elapsed time without stopping the timer.\n- `console.timeEnd(label?)` — Log the elapsed time and stop the timer.\n- `console.group(...label)` — Indent following output until console.groupEnd() (console.groupCollapsed is the same).\n- `console.groupCollapsed(...label)` — Like console.group().\n- `console.groupEnd()` — End the current group.\n- `console.table(data, columns?)` — Print an array of objects/arrays as a table. Example: `console.table(rows)`\n- `console.dir(value, options?)` — Print an object with Node's inspect (depth/colors options).\n- `console.dirxml(...args)` — Same as console.log().\n- `console.clear()` — Clear the console buffer of the host.\n\n## pm.db\n\nDatabase access (Oracle / MongoDB / PostgreSQL / MySQL). Disabled by feature policy in some contexts — tests then report SKIP.\n\n- `pm.db.query({ connectionId, query })` — Run an ad-hoc query — ALWAYS await it. Rejects when the query fails. SQL connections (Oracle/Postgres/MySQL): `query` is the SQL text. MongoDB: `query` is a JSON STRING of a command object, e.g. `JSON.stringify({ collection: 'users', operation: 'findOne', filter: { email } })` — operation is find|findOne|aggregate|countDocuments|insertOne|updateOne|deleteOne|…, the match key is `filter` (NOT a `db.coll.find(...)` shell string and NOT `query`), and aggregate uses `pipeline`. Resolves to { success, error, rowCount, rows, firstRow(), connectionId, connectionName, connectionType, durationMs, executedAt }. firstRow is a FUNCTION: res.firstRow()?.STATUS (Oracle columns are UPPERCASE); for a Mongo existence check assert rowCount > 0. _(requires the database capability — may be disabled by feature policy)_ Example: `const res = await pm.db.query({ connectionId: \"orders-db\", query: \"select status from orders where id = 1\" })`\n- `pm.db.pre` — Result object of the declared pre-request DB query: { success, error, rowCount, rows, firstRow() }. Not a promise — read directly. _(stages: pre-request, post-response, tests)_ _(requires the database capability — may be disabled by feature policy)_\n- `pm.db.post` — Result object of the declared post-response DB query (same shape as pm.db.pre). Populated ONLY in the `tests` script; in a post-response script it is an empty result. _(stages: tests)_ _(requires the database capability — may be disabled by feature policy)_\n\n## pm.redis\n\nRun ad-hoc Redis commands and read results of declared pre/post commands.\n\n- `pm.redis.command({ connectionId, command })` — Run an ad-hoc Redis command (strings, hashes, lists, sets, sorted sets, counters, key expiry, SCAN) — ALWAYS await it. Resolves to { success, error, result, resultText, commandName, key, connectionId, connectionName, command, resolvedCommand, durationMs, executedAt }. Omit connectionId to use the request's configured Redis connection. _(requires the redis capability — may be disabled by feature policy)_ Example: `const res = await pm.redis.command({ command: \"GET session:1\" })`\n- `pm.redis.get(key)` — Read a value already captured by a declared GET. _(requires the redis capability — may be disabled by feature policy)_\n- `pm.redis.results.pre` — Array of pre-stage command results (by line index). _(requires the redis capability — may be disabled by feature policy)_\n- `pm.redis.results.post` — Array of post-stage command results. _(stages: post-response, tests)_ _(requires the redis capability — may be disabled by feature policy)_\n\n## pm.random\n\nRandom data generators. EVERY generator returns a string (pm.random.int() returns \"42\", pm.random.boolean() returns \"true\"/\"false\") — wrap with Number() when you need a number.\n\n- `pm.random.uuid()` — UUID v4 string. Example: `pm.random.uuid()`\n- `pm.random.email()` — Random email address string.\n- `pm.random.string(length?)` — Alphanumeric string (default 12, max 128).\n- `pm.random.int(min?, max?)` — Integer in range, as a STRING (default 0..999999). Example: `Number(pm.random.int(1, 100))`\n- `pm.random.bigdecimal(min?, max?, scale?)` — Decimal string with `scale` fraction digits (default 6).\n- `pm.random.boolean()` — The string \"true\" or \"false\".\n- `pm.random.phone()` — Phone number string.\n- `pm.random.name()` — Person name string.\n- `pm.random.date(format?)` — Date string within ±1 year (default format YYYY-MM-DD; tokens YYYY MM DD HH mm ss SSS Z).\n\n## pm.counter\n\nCounter that survives across the requests of a run.\n\n- `pm.counter.next()` — Next value (number, starts at 1).\n- `pm.counter.start(startAt?)` — Counter starting at a custom value (number, default 1); each call increments.\n\n## pm.info\n\nExecution metadata snapshot (read-only).\n\n- `pm.info.eventName` — \"prerequest\" in pre-request scripts, \"test\" in post-response / tests scripts, \"scenario-script\" in scenario script nodes.\n- `pm.info.iteration` — 0-BASED index of the current iteration of a data-driven run (0 outside one, like Postman).\n- `pm.info.iterationCount` — Total iterations of the run (1 outside a data-driven run). Never use it to gate token/cache logic in single sends.\n- `pm.info.requestName` — Current request's name.\n- `pm.info.requestId` — Current request's id.\n\n## pm.execution\n\nCollection-run flow control (Postman's pm.execution). Honoured by the collection runner; a single Send ignores it.\n\n- `pm.execution.setNextRequest(nameOrId)` — Run the request with this name or id next; pass null to stop the run after the current request. Postman's postman.setNextRequest is the same. Example: `pm.execution.setNextRequest(\"Get order\")`\n- `pm.execution.skipRequest()` — Skip the current request: it is not sent and its post-response/tests scripts do not run (counted as skipped). _(stages: pre-request)_\n- `pm.execution.location` — Folder path of the current request as an array of names; pm.execution.location.current is the request's own name. Example: `pm.execution.location.current`\n- `pm.execution.runRequest(requestIdOrName)` — Not supported in Callman yet — always throws a clear error.\n\n## pm.node\n\nScenario workflow context (scenario script and request nodes only). pm.node is a FUNCTION — pm.node(label) — not an object. The same data is also available as a global named after the node label when the label is a valid identifier (Login.token).\n\n- `pm.node(label)` — Output of a previous node by label (null when it has not run). The value carries __meta { status, success, failed, skipped, attempts, startedAt, endedAt, durationMs, error }. _(stages: scenario-script)_ Example: `const token = pm.node(\"Login\").token`\n- `workflow.__meta` — Run-level metadata: status, totalNodes, successfulNodes, failedNodes, skippedNodes, totalRetries, durationMs, currentNode, lastNode, failedNode. _(stages: scenario-script)_\n- `env.NAME` — The active environment's variables as a plain object (also available in request scripts). Example: `env.BASE_URL`\n\n## pm.log\n\nStructured logging into the run report.\n\n- `pm.log(...args)` — Like console.log; entries land in the run's log panel.\n\n## CryptoJS\n\ncrypto-js global (NOT under pm.*; also require('crypto-js')). Results are WordArrays: call .toString() for hex or .toString(CryptoJS.enc.Base64).\n\n- `CryptoJS.SHA256(message)` — Hash (also SHA1, SHA224, SHA384, SHA512, SHA3, MD5, RIPEMD160); .toString() is hex. Example: `CryptoJS.SHA256(body).toString()`\n- `CryptoJS.HmacSHA256(message, key)` — HMAC (also HmacSHA1/224/384/512, HmacMD5). Example: `CryptoJS.HmacSHA256(msg, secret).toString(CryptoJS.enc.Hex)`\n- `CryptoJS.AES.encrypt(message, key)` — AES encryption; CryptoJS.AES.decrypt(cipher, key) returns a WordArray — call .toString(CryptoJS.enc.Utf8). Example: `CryptoJS.AES.encrypt(text, key).toString()`\n- `CryptoJS.PBKDF2(password, salt, options)` — Key derivation ({ keySize, iterations }).\n- `CryptoJS.enc.Base64` — Encoders for .toString(...) / .parse(...): Utf8, Base64, Base64url, Hex, Latin1, Utf16. Example: `CryptoJS.enc.Base64.stringify(CryptoJS.enc.Utf8.parse(text))`\n- `CryptoJS.lib.WordArray.random(nBytes)` — Raw random word array (e.g. IVs); WordArray.create(words, sigBytes) builds one.\n\n## _\n\nlodash global (NOT under pm.*; also require('lodash')).\n\n- `_.get(object, path, defaultValue?)` — Safe nested read; the full lodash surface (pick, omit, groupBy, sortBy, uniq, merge, cloneDeep, isEqual, chunk, ...) is available. Example: `_.get(payload, \"data.items[0].id\")`\n- `_.groupBy(collection, iteratee)` — Group items by a key or function. Example: `_.groupBy(items, \"status\")`\n\n## timers\n\nSafe per-run timer wrappers (callbacks never outlive the run; delays are capped at 60 s). They return numeric ids.\n\n- `setTimeout(handler, delayMs)` — Run later; use with await new Promise(r => setTimeout(r, ms)) for polling loops. clearTimeout(id) cancels. Example: `await new Promise(r => setTimeout(r, 500))`\n- `clearTimeout(id)` — Cancel a setTimeout.\n- `setInterval(handler, delayMs)` — Repeat; clearInterval(id) cancels.\n- `clearInterval(id)` — Cancel a setInterval.\n- `setImmediate(handler)` — Run on the next turn (clearImmediate(id) cancels).\n\n## globals\n\nOther globals available in every script (no import): Buffer, Intl, Reflect, Proxy, WeakRef, URL, URLSearchParams, TextEncoder/TextDecoder, atob/btoa, structuredClone, queueMicrotask, AbortController, Blob, crypto (Web Crypto), encodeURI/decodeURI, escape/unescape and the usual JSON/Math/Date/Promise/Map/Set/typed arrays. fetch, XMLHttpRequest, WebSocket, process, window, eval and Function are blocked — use pm.sendRequest for HTTP.\n\n- `Buffer.from(data, encoding?)` — Node Buffer (utf8, hex, base64, base64url, latin1, ...). Example: `Buffer.from(\"hello\").toString(\"base64\")`\n- `crypto.randomUUID()` — Web Crypto: also crypto.getRandomValues(typedArray) and crypto.subtle.digest/sign/verify/encrypt/decrypt. Example: `crypto.randomUUID()`\n- `structuredClone(value)` — Deep clone (Date, Map, Set, RegExp, ...).\n- `atob(base64)` — Decode base64 to a binary string (btoa(text) encodes).\n\n## postman\n\nPostman's LEGACY scripting API, kept so old exported collections run unchanged. Enabled in request scripts unless the script starts with \"use sandbox2\"; prefer pm.* in new scripts.\n\n- `postman.setEnvironmentVariable(key, value)` — Same as pm.environment.set (also getEnvironmentVariable, clearEnvironmentVariable, clearEnvironmentVariables). Example: `postman.setEnvironmentVariable(\"token\", \"abc\")`\n- `postman.setGlobalVariable(key, value)` — Same as pm.globals.set (also getGlobalVariable, clearGlobalVariable, clearGlobalVariables).\n- `postman.setNextRequest(name)` — Same as pm.execution.setNextRequest.\n- `postman.getResponseHeader(name)` — Header value of the response. _(stages: post-response, tests)_\n- `postman.getResponseCookie(name)` — Cookie of the response. _(stages: post-response, tests)_\n- `tests['name'] = boolean` — Legacy test: records a test named `name` that passes when the value is truthy. Example: `tests[\"status is 200\"] = responseCode.code === 200`\n- `responseBody` — Legacy: raw response body text. _(stages: post-response, tests)_\n- `responseCode.code` — Legacy: { code, name, detail } of the status. _(stages: post-response, tests)_\n- `responseTime` — Legacy: response time in ms. _(stages: post-response, tests)_\n- `responseHeaders` — Legacy: response headers as a plain object. _(stages: post-response, tests)_\n- `responseCookies` — Legacy: response cookies as { name: value }. _(stages: post-response, tests)_\n- `environment['name']` — Legacy: `environment` and `globals` also read variables by bracket (environment['token']); environment.get('token') keeps working. `data` is the iteration row, `iteration` the 0-based index; tv4, cheerio and xml2Json(xml) are globals.\n\n## unsupported\n\nPostman APIs Callman does not implement. Accessing them throws a clear \"is not supported in Callman yet\" error (never `undefined`), so a copied script fails loudly instead of misbehaving: pm.vault, pm.datasets, pm.mock, pm.state, pm.message, pm.execution.runRequest, and pm.require('npm:...' / 'jsr:...' / '@team/...') package specifiers. Postman Flows, Postbot, gRPC/WebSocket/MQTT hooks are out of scope.\n\n\n## Stage rules\n\n- `pre-request`: runs BEFORE the HTTP call. `pm.response` does not exist; `pm.request` mutations take effect.\n- `post-response` / `tests`: run AFTER the call. `pm.response` is available; `pm.request` mutations have no effect.\n- `scenario-script`: a scenario Script node. There is no `pm.request` / `pm.response`. Prior node outputs are readable via `pm.node(\"NodeLabel\")` or the label as a global (`NodeLabel.path`); `env` is the environment as a plain object; the script's return value becomes the node output.\n- Members without a stage note are available in every stage.\n\n## Collection and folder scripts\n\n- A collection and each of its folders can carry their own pre-request, post-response and tests scripts. They run for EVERY request inside them, in addition to the request's own scripts — never instead of them.\n- Order, for each stage: collection → folders (outermost first) → the request.\n- Every script of one request shares the same `pm.variables` (local) scope; environment, globals and collection-variable writes are visible to the next script in the chain.\n- A failing pre-request script stops the chain and the request is not sent. Post-response / tests scripts of every level still run and report.\n- `pm.info.requestName` / `pm.info.requestId` tell a collection script which request it is running for (e.g. skip a token fetch for the Login request).\n\n## Postman compatibility notes\n\n- `pm.response.code` is the number (200); `pm.response.status` is the reason phrase (\"OK\") — `pm.response.status === 200` is false.\n- `pm.response.json()` throws when the body is empty or not valid JSON.\n- `pm.test` runs its callback synchronously; `pm.test(name, done => ...)`, `pm.test.skip(name)` and `pm.test.index()` exist.\n- `pm.info.iteration` is 0-based; `pm.info.eventName` is \"prerequest\" or \"test\".\n- `replaceIn` keeps an unresolved `{{x}}` as written; environment / globals values keep the type they were set with inside the run and are stored as strings (objects as JSON).\n- `pm.random.*` generators return strings (including `int()` and `boolean()`).\n- Postman's legacy API (`postman.*`, `tests[\"name\"] = bool`, `responseBody`, `responseCode`, ...) works unless the script starts with \"use sandbox2\".\n- Unsupported Postman APIs (`pm.vault`, `pm.datasets`, `pm.mock`, `pm.state`, `pm.message`, `pm.execution.runRequest`, `npm:` / `jsr:` packages) throw a clear \"not supported in Callman yet\" error.\n",
+    "feature-policy": "<!-- GENERATED FILE — do not edit by hand. Source: callman_core (npm run ai:packs). -->\n\n# Script feature policy\n\nSome `pm.*` features can be disabled per execution context (ScriptFeaturePolicy). A disabled feature evaluates to `undefined` at top level; inside `pm.test` callbacks it throws so the test reports SKIPPED instead of failing.\n\nCapability-gated members:\n\n## database\n\n- `pm.db.query({ connectionId, query, params?, binds?, captureOutput?, timeoutMs? })`\n- `pm.db.pre`\n- `pm.db.post`\n\n## redis\n\n- `pm.redis.command({ connectionId, command })`\n- `pm.redis.get(key)`\n- `pm.redis.results.pre`\n- `pm.redis.results.post`\n\nGeneration guidance: prefer declared pre/post queries and `pm.db.query` only when the user explicitly asks for database work; never assume redis capabilities exist unless the task mentions them.\n",
+    "pm-api": "<!-- GENERATED FILE — do not edit by hand. Source: callman_core (npm run ai:packs). -->\n\n# Callman `pm.*` scripting API\n\nScripts are plain JavaScript (top-level `await` allowed). `pm`, `cm` and `callman` are the SAME object: a script can use `cm.` exactly like `pm.` (cm.environment.get(...), cm.test(...), cm.expect(...)), and Postman scripts run unchanged. Use ONLY the API below — fetch, XMLHttpRequest, process, eval, import() and the filesystem are blocked by the sandbox (use `pm.sendRequest` for HTTP and `require()` for the built-in libraries).\n\n## pm\n\nThe script API. `cm` and `callman` are the SAME object as `pm` — a script can use `cm.` exactly like `pm.` (cm === pm), so Postman scripts run unchanged and Callman-branded scripts behave identically.\n\n- `cm.environment.set(key, value)` — `cm.x` and `callman.x` are aliases of `pm.x` for every member below. Example: `cm.test(\"ok\", () => cm.expect(1).to.equal(1))`\n\n## pm.test\n\nRegister a named test. The callback runs synchronously; a failing assertion (or a throw) marks the test failed without aborting the script. Works in pre-request, post-response and tests scripts.\n\n- `pm.test(name, fn)` — Runs fn immediately; pass/fail lands in the run's test results. An async fn / returned Promise is awaited before the script is reported. Example: `pm.test(\"sum is 4\", () => pm.expect(2 + 2).to.equal(4))`\n- `pm.test(name, done => { done(); })` — Callback-style async test: the test completes when done() is called (done(error) fails it). Example: `pm.test(\"later\", done => { setTimeout(done, 10); })`\n- `pm.test.skip(name)` — Record a skipped test (shown as SKIP); the callback, if any, is never run. Example: `pm.test.skip(\"not ready yet\")`\n- `pm.test.index()` — Number of tests recorded so far in this script. Example: `pm.test.index()`\n\n## pm.expect\n\npm.expect is chai 4.4.1 with the full BDD API (expect-style), the chai-postman helpers and a few jest-style aliases. Chain words (to, be, been, is, that, which, and, has, have, with, at, of, same, but, does, still, also) read like English; flags (not, deep, nested, own, ordered, any, all, itself) change the assertion that follows. Equality is strict: .equal / .eq use ===, so NaN does not equal NaN and 1 does not equal \"1\"; use .eql / .deep.equal for structural comparison. Failure messages are chai's own.\n\n- `pm.expect(value, message?)` — Start an assertion. Equality: .to.equal(x) (===), .to.eql(x) / .to.deep.equal(x) (deep), .toBe(x) / .toEqual(x) (jest-style). Existence/type: .to.exist, .to.be.null, .to.be.undefined, .to.be.true, .to.be.a('string'|'number'|'array'|'object'|...). Strings/arrays: .to.include(x) / .to.contain(x) / .toContain(x), .to.have.lengthOf(n), .to.be.empty, .to.match(/re/), .to.have.members([...]), .to.be.oneOf([...]). Numbers: .to.be.above(n) / .below(n) / .within(a, b) / .closeTo(n, delta) / .toBeGreaterThan(n) / .toBeLessThan(n). Objects: .to.have.property('a.b', value?) (dot paths work by default), .to.have.all.keys('a', 'b'), .to.have.jsonSchema(schema). Negation: .to.not.<assertion>. Example: `pm.expect(user.id).to.be.a(\"number\")`\n- `pm.expect.fail(message?)` — Throws an AssertionError (fails the surrounding test) immediately. Example: `pm.expect.fail(\"unexpected branch\")`\n- `pm.expect(value).to.have.jsonSchema(schema, ajvOptions?)` — Validate any value against a JSON Schema (ajv). Also available on the response as pm.response.to.have.jsonSchema(schema) in post-response scripts. Example: `pm.expect(user).to.have.jsonSchema({ type: \"object\", required: [\"id\"] })`\n\n## pm.environment\n\nActive environment variables (alias: pm.env). get() returns the value as it was set within the run (numbers and objects stay native); stored values are strings, objects/arrays are saved as JSON. Writes surface as variable mutations.\n\n- `pm.environment.get(key)` — Read a variable (undefined when missing). Example: `pm.environment.get(\"baseUrl\")`\n- `pm.environment.set(key, value, type?)` — Write a variable for subsequent steps. type is one of string, number, boolean, json, any. Example: `pm.environment.set(\"token\", token)`\n- `pm.environment.unset(key)` — Remove a variable.\n- `pm.environment.has(key)` — true when the key exists.\n- `pm.environment.clear()` — Remove every variable in the scope.\n- `pm.environment.toObject()` — Plain { key: value } snapshot.\n- `pm.environment.replaceIn(template)` — Resolve {{tokens}} against THIS scope only. Unresolved {{x}} stay as written (literal); objects and arrays are walked. Example: `pm.environment.replaceIn(\"{{baseUrl}}/users\")`\n- `pm.environment.name` — Active environment's name.\n- `pm.environment.values` — The raw string values record (read-only view).\n\n## pm.globals\n\nWorkspace-level global variables. Same surface as pm.environment.\n\n- `pm.globals.get(key)` — Read a global.\n- `pm.globals.set(key, value, type?)` — Write a global for the run.\n- `pm.globals.unset(key)` — Remove a global.\n- `pm.globals.has(key)` — true when the key exists.\n- `pm.globals.clear()` — Remove every global in the scope.\n- `pm.globals.toObject()` — Plain snapshot.\n- `pm.globals.replaceIn(template)` — Resolve {{tokens}} against the globals; unresolved tokens stay literal.\n- `pm.globals.name` — Scope name.\n- `pm.globals.values` — The raw string values record (read-only view).\n\n## pm.collectionVariables\n\nCollection-scoped variables that survive across requests within one collection run. `{{name}}` resolves them after the environment and before globals.\n\n- `pm.collectionVariables.get(key)` — Read a collection variable.\n- `pm.collectionVariables.set(key, value, type?)` — Write; persists across the iteration.\n- `pm.collectionVariables.unset(key)` — Remove a collection variable.\n- `pm.collectionVariables.has(key)` — true when the key exists.\n- `pm.collectionVariables.clear()` — Remove all collection variables.\n- `pm.collectionVariables.toObject()` — Plain snapshot.\n- `pm.collectionVariables.replaceIn(template)` — Resolve {{tokens}}; unresolved tokens stay literal.\n- `pm.collectionVariables.name` — Scope name.\n- `pm.collectionVariables.values` — The raw string values record (read-only view).\n\n## pm.variables\n\nLayered read across all scopes — local > iteration data > environment > collection > globals. `set` writes the local scope, shared by every script of the same request (collection → folder → request) and gone afterwards.\n\n- `pm.variables.get(key)` — Read through the precedence chain. Example: `pm.variables.get(\"userId\")`\n- `pm.variables.set(key, value, type?)` — Write to the run-local layer.\n- `pm.variables.unset(key)` — Remove from the run-local layer.\n- `pm.variables.has(key)` — true when any layer has the key.\n- `pm.variables.clear()` — Clear the run-local layer.\n- `pm.variables.toObject()` — Merged snapshot.\n- `pm.variables.replaceIn(template)` — Postman semantics: resolve {{tokens}} (and dynamic variables like {{$guid}}); an unresolved {{x}} stays as written; objects and arrays are walked. Example: `pm.variables.replaceIn(\"{{baseUrl}}/users/{{userId}}\")`\n- `pm.variables.resolve(template)` — Callman's older resolver: like replaceIn on a string, but an unresolved {{x}} becomes an empty string. Does NOT read scenario node outputs — use pm.node(label) for those. Example: `pm.variables.resolve(\"{{missing}}\")`\n\n## pm.iterationData\n\nThe data-file / dataset row of the current iteration of a data-driven run (empty outside one). Also a layer of pm.variables.\n\n- `pm.iterationData.get(key)` — Read a column of the current row. Example: `pm.iterationData.get(\"email\")`\n- `pm.iterationData.has(key)` — true when the row has the column.\n- `pm.iterationData.toObject()` — The whole row as a plain object.\n- `pm.iterationData.toJSON()` — Same as toObject(); used by JSON.stringify.\n- `pm.iterationData.set(key, value)` — Change this run's copy of the row (not written back to the data file).\n- `pm.iterationData.unset(key)` — Remove a column from this run's copy of the row.\n- `pm.iterationData.clear()` — Remove every column from this run's copy of the row.\n- `pm.iterationData.replaceIn(template)` — Resolve {{tokens}} against the row only.\n\n## pm.request\n\nThe request. Its url is a postman-collection Url object that ALSO behaves like a string (url.includes('/v1'), url + '?x=1'); headers is a HeaderList (case-insensitive get/has/add/upsert/remove, bracket access headers['X-Id']). Mutations only have effect in pre-request scripts (the call has not fired yet).\n\n- `pm.request.url` — Url object: .getHost() .getPath() .getPathWithQuery() .getQueryString() .getRaw() .protocol .host[] .port .path[] .hash .query (list of params) .variables .addQueryParams() .removeQueryParams() .update(); also usable as a string. Assign a string to replace it.\n- `pm.request.url.query.get(key)` — Value of a query param. Example: `pm.request.url.query.get(\"page\")`\n- `pm.request.url.query.add(param)` — Add a query param ({ key, value }). _(stages: pre-request)_ Example: `pm.request.url.query.add({ key: \"debug\", value: \"1\" })`\n- `pm.request.method` — HTTP method string; assignable in pre-request.\n- `pm.request.body` — RequestBody: .mode ('raw'|'urlencoded'|'formdata'|'file'|'graphql') .raw .urlencoded .formdata .graphql .isEmpty() .toString() .update({ mode, raw }). Example: `pm.request.body.update({ mode: \"raw\", raw: JSON.stringify({ a: 1 }) })`\n- `pm.request.headers` — HeaderList: .get(name) .has(name) .add({key,value}) .upsert({key,value}) .remove(name) .each(fn) .map(fn) .filter(fn) .find(fn) .count() .toObject(); bracket access reads/writes by name. Example: `pm.request.headers.upsert({ key: \"X-Trace\", value: pm.variables.replaceIn(\"{{$guid}}\") })`\n- `pm.request.query` — Callman alias of pm.request.url.query (the query params list).\n- `pm.request.getHeader(name)` — Read one header value (case-insensitive).\n- `pm.request.setHeader(name, value)` — Set/replace a header. _(stages: pre-request)_\n- `pm.request.unsetHeader(name)` — Remove a header. _(stages: pre-request)_\n- `pm.request.getQueryParam(name)` — Read one query param.\n- `pm.request.setQueryParam(name, value)` — Set/replace a query param. _(stages: pre-request)_\n- `pm.request.unsetQueryParam(name)` — Remove a query param. _(stages: pre-request)_\n- `pm.request.setUrl(url)` — Replace the URL. _(stages: pre-request)_\n- `pm.request.setMethod(method)` — Replace the method. _(stages: pre-request)_\n- `pm.request.setRawBody(value)` — Replace the body with raw text (objects are NOT auto-stringified; pass JSON.stringify(obj)). _(stages: pre-request)_\n- `pm.request.to.have.header(name)` — chai-postman assertions work on the request too (pm.request.to.have.header, .to.have.body, ...).\n\n## pm.response\n\nThe received response — a postman-collection Response. Not available in pre-request scripts. pm.response.code is the NUMBER (200); pm.response.status is the reason PHRASE ('OK', 'Not Found') exactly like Postman, so `pm.response.status === 200` is false.\n\n- `pm.response.code` — Status code (number). _(stages: post-response, tests)_ Example: `pm.expect(pm.response.code).to.equal(200)`\n- `pm.response.status` — Status reason phrase (string), e.g. \"OK\". Use pm.response.code for the number. _(stages: post-response, tests)_\n- `pm.response.reason()` — Reason phrase (method form of status). _(stages: post-response, tests)_\n- `pm.response.statusText` — Callman alias of pm.response.reason(). _(stages: post-response, tests)_\n- `pm.response.json()` — Parse the body as JSON — call it once into a const. THROWS when the body is empty or not valid JSON (guard with try/catch, or assert pm.response.to.be.json first). Optional reviver as in JSON.parse. _(stages: post-response, tests)_ Example: `const body = pm.response.json()`\n- `pm.response.text()` — Raw body as a string. _(stages: post-response, tests)_\n- `pm.response.jsonp(callbackName?)` — Parse a JSONP body; throws when it is not valid. _(stages: post-response, tests)_\n- `pm.response.rawBody` — Raw body string (Callman alias of text()). _(stages: post-response, tests)_\n- `pm.response.body` — Callman: the parsed body (JSON value, or the text). Prefer json() / text(). _(stages: post-response, tests)_\n- `pm.response.headers` — Response HeaderList (read-only): .get(name) .has(name) .each(fn) .toObject(); bracket access headers['content-type']. _(stages: post-response, tests)_ Example: `pm.response.headers.get(\"Content-Type\")`\n- `pm.response.cookies` — CookieList of the response's Set-Cookie headers: .get(name) .has(name) .toObject() .each(fn). _(stages: post-response, tests)_\n- `pm.response.responseTime` — Duration in ms. _(stages: post-response, tests)_\n- `pm.response.responseSize` — Body size in bytes. _(stages: post-response, tests)_\n- `pm.response.size()` — { body, header, total } sizes in bytes. _(stages: post-response, tests)_\n- `pm.response.dataURI()` — The body as a data: URI. _(stages: post-response, tests)_\n- `pm.response.details()` — { code, name, detail } of the status code. _(stages: post-response, tests)_\n- `pm.response.contentInfo()` — { mimeType, mimeFormat, charset, fileExtension, contentType } of the body. _(stages: post-response, tests)_\n- `pm.response.stream` — Body bytes as a Buffer. _(stages: post-response, tests)_\n- `pm.response.to.have.status(codeOrReason)` — chai-postman assertions on the response: .to.have.status(200 | \"OK\"), .to.have.header(name, value?), .to.have.body(text?), .to.have.jsonBody(path?, value?), .to.have.jsonSchema(schema), .to.have.responseTime.below(ms), .to.be.ok / .success / .info / .redirection / .clientError / .serverError / .error / .json / .html / .xml / .withBody / .accepted / .badRequest / .unauthorized / .forbidden / .notFound / .rateLimited, plus .to.not.<predicate>. _(stages: post-response, tests)_ Example: `pm.response.to.have.status(200)`\n\n## pm.sendRequest\n\nFire an ad-hoc HTTP request from inside a script. It returns a Promise that resolves to a Response with the same API as pm.response (code, status, json(), text(), headers, cookies, responseTime, ...). The callback form (err, res) also works; hosts that keep a cookie jar send and store cookies.\n\n- `pm.sendRequest(url)` — GET a URL string. Prefer `const res = await pm.sendRequest(...)`. Example: `const res = await pm.sendRequest(\"https://api.example.com/health\")`\n- `pm.sendRequest({ url, method, header, body })` — Request options. header: object, array of { key, value } or a header string. body: a string, or { mode: 'raw', raw }, { mode: 'urlencoded', urlencoded: [{key,value}] }, { mode: 'formdata', formdata: [{key,value}] } (text parts only), { mode: 'graphql', graphql: { query, variables } }. {{variables}} in all fields are resolved. Example: `await pm.sendRequest({ url: \"https://x.test/login\", method: \"POST\", header: { \"Content-Type\": \"application/json\" }, body: { mode: \"raw\", raw: JSON.stringify({ user: \"a\" }) } })`\n- `pm.sendRequest(request, (err, res, history) => {})` — Callback form; request may also be a postman-collection Request (new (require('postman-collection').Request)({...})). Example: `pm.sendRequest(\"https://x.test\", (err, res) => { pm.environment.set(\"code\", res.code) })`\n\n## pm.cookies\n\nCookies of the current request's domain (a CookieList: .get(name) .has(name) .toObject() .each(fn)), plus the cookie jar of ANY domain via pm.cookies.jar().\n\n- `pm.cookies.get(name)` — Value of a cookie of the request's domain. Example: `pm.cookies.get(\"session\")`\n- `pm.cookies.has(name)` — true when the cookie exists.\n- `pm.cookies.toObject()` — { name: value } of the request's domain.\n- `pm.cookies.jar()` — The cookie jar. Every jar method takes a callback (error, result) OR returns a Promise. Example: `const jar = pm.cookies.jar()`\n- `pm.cookies.jar().set(url, name, value)` — Set a cookie (or pass a { name, value, domain, path, expires, httpOnly, secure } object instead of name, value). Example: `await pm.cookies.jar().set(\"https://x.test\", \"theme\", \"dark\")`\n- `pm.cookies.jar().get(url, name)` — Value of one cookie, or null. Example: `await pm.cookies.jar().get(\"https://x.test\", \"theme\")`\n- `pm.cookies.jar().getAll(url)` — All cookies matching the url (Cookie objects). Example: `await pm.cookies.jar().getAll(\"https://x.test\")`\n- `pm.cookies.jar().unset(url, name)` — Delete one cookie.\n- `pm.cookies.jar().clear(url)` — Delete every cookie of the url's domain.\n\n## pm.visualizer\n\nRender a custom view of the response: pass a Handlebars HTML template and its data; the host shows it in the Visualize tab (the last call wins). Data must be JSON-serializable.\n\n- `pm.visualizer.set(template, data, options?)` — template: Handlebars HTML string; data: object available as {{...}} in the template; options: Handlebars compile options. _(stages: post-response, tests)_ Example: `pm.visualizer.set(\"<ul>{{#each items}}<li>{{name}}</li>{{/each}}</ul>\", { items: pm.response.json() })`\n- `pm.visualizer.clear()` — Remove the visualization set earlier in the run. _(stages: post-response, tests)_\n- `pm.getData(callback)` — Inside a visualizer template script: receive the data passed to pm.visualizer.set as callback(error, data). _(stages: post-response, tests)_ Example: `pm.getData((error, data) => { console.log(data) })`\n\n## require\n\nrequire(name) and pm.require(name) load one of the built-in libraries (Postman's list). There is no filesystem or package access: `npm:`, `jsr:` and `@team/` specifiers and any other name throw \"Cannot find module\". The `node:` prefix is accepted.\n\n- `require(name)` — Built-in modules: lodash, moment, chai, ajv (v6), cheerio (0.22), xml2js, uuid, csv-parse/lib/sync, postman-collection, crypto-js, tv4, atob, btoa, path, assert, buffer, util, url, querystring, string_decoder, stream, events, punycode, timers. Example: `const moment = require(\"moment\")`\n- `pm.require(name)` — Same as require(name). Example: `const _lodash = pm.require(\"lodash\")`\n- `require('uuid').v4()` — Random UUID v4 string. Example: `const id = require(\"uuid\").v4()`\n- `require('csv-parse/lib/sync')(input, options?)` — Parse CSV text into an array of rows. Example: `require(\"csv-parse/lib/sync\")(csv, { columns: true })`\n- `require('xml2js').parseString(xml, callback)` — Parse XML into a JS object (also parseStringPromise). Example: `require(\"xml2js\").parseString(xmlText, (err, result) => {})`\n- `require('cheerio').load(html)` — Parse HTML and query it with jQuery-style selectors (cheerio 0.22). Example: `const $ = require(\"cheerio\").load(htmlText)`\n\n## console\n\nThe full console API. Output appears in the run's Console and is streamed while the script runs (kept even when the script times out). Format strings %s %d %i %f %j %o %O %c are supported; objects, Errors, Maps and Sets print readably.\n\n- `console.log(...args)` — Print to the console (also console.info / warn / error / debug, which set the level). Example: `console.log(\"token:\", pm.environment.get(\"token\"))`\n- `console.info(...args)` — Info level.\n- `console.warn(...args)` — Warning level.\n- `console.error(...args)` — Error level.\n- `console.debug(...args)` — Debug level.\n- `console.trace(...args)` — Log with a stack trace.\n- `console.assert(condition, ...args)` — Log an error when the condition is falsy (never throws).\n- `console.count(label?)` — Count calls per label. Example: `console.count(\"retry\")`\n- `console.countReset(label?)` — Reset a counter.\n- `console.time(label?)` — Start a timer.\n- `console.timeLog(label?, ...args)` — Log the elapsed time without stopping the timer.\n- `console.timeEnd(label?)` — Log the elapsed time and stop the timer.\n- `console.group(...label)` — Indent following output until console.groupEnd() (console.groupCollapsed is the same).\n- `console.groupCollapsed(...label)` — Like console.group().\n- `console.groupEnd()` — End the current group.\n- `console.table(data, columns?)` — Print an array of objects/arrays as a table. Example: `console.table(rows)`\n- `console.dir(value, options?)` — Print an object with Node's inspect (depth/colors options).\n- `console.dirxml(...args)` — Same as console.log().\n- `console.clear()` — Clear the console buffer of the host.\n\n## pm.db\n\nDatabase access (Oracle / MongoDB / PostgreSQL / MySQL). Disabled by feature policy in some contexts — tests then report SKIP.\n\n- `pm.db.query({ connectionId, query, params?, binds?, captureOutput?, timeoutMs? })` — Run an ad-hoc query — ALWAYS await it. Rejects when the query fails. SQL connections (Oracle/Postgres/MySQL): `query` is the SQL text. MongoDB: `query` is a JSON STRING of a command object, e.g. `JSON.stringify({ collection: 'users', operation: 'findOne', filter: { email } })` — operation is find|findOne|aggregate|countDocuments|insertOne|updateOne|deleteOne|…, the match key is `filter` (NOT a `db.coll.find(...)` shell string and NOT `query`), and aggregate uses `pipeline`. Resolves to { success, error, rowCount, rows, firstRow(), connectionId, connectionName, connectionType, durationMs, executedAt }. firstRow is a FUNCTION: res.firstRow()?.STATUS (Oracle columns are UPPERCASE); for a Mongo existence check assert rowCount > 0. _(requires the database capability — may be disabled by feature policy)_ Example: `const res = await pm.db.query({ connectionId: \"orders-db\", query: \"select status from orders where id = 1\" })`\n- `pm.db.pre` — Result object of the declared pre-request DB query: { success, error, rowCount, rows, firstRow() }. Not a promise — read directly. _(stages: pre-request, post-response, tests)_ _(requires the database capability — may be disabled by feature policy)_\n- `pm.db.post` — Result object of the declared post-response DB query (same shape as pm.db.pre). Populated ONLY in the `tests` script; in a post-response script it is an empty result. _(stages: tests)_ _(requires the database capability — may be disabled by feature policy)_\n\n## pm.redis\n\nRun ad-hoc Redis commands and read results of declared pre/post commands.\n\n- `pm.redis.command({ connectionId, command })` — Run an ad-hoc Redis command (strings, hashes, lists, sets, sorted sets, counters, key expiry, SCAN) — ALWAYS await it. Resolves to { success, error, result, resultText, commandName, key, connectionId, connectionName, command, resolvedCommand, durationMs, executedAt }. Omit connectionId to use the request's configured Redis connection. _(requires the redis capability — may be disabled by feature policy)_ Example: `const res = await pm.redis.command({ command: \"GET session:1\" })`\n- `pm.redis.get(key)` — Read a value already captured by a declared GET. _(requires the redis capability — may be disabled by feature policy)_\n- `pm.redis.results.pre` — Array of pre-stage command results (by line index). _(requires the redis capability — may be disabled by feature policy)_\n- `pm.redis.results.post` — Array of post-stage command results. _(stages: post-response, tests)_ _(requires the redis capability — may be disabled by feature policy)_\n\n## pm.random\n\nRandom data generators. EVERY generator returns a string (pm.random.int() returns \"42\", pm.random.boolean() returns \"true\"/\"false\") — wrap with Number() when you need a number.\n\n- `pm.random.uuid()` — UUID v4 string. Example: `pm.random.uuid()`\n- `pm.random.email()` — Random email address string.\n- `pm.random.string(length?)` — Alphanumeric string (default 12, max 128).\n- `pm.random.int(min?, max?)` — Integer in range, as a STRING (default 0..999999). Example: `Number(pm.random.int(1, 100))`\n- `pm.random.bigdecimal(min?, max?, scale?)` — Decimal string with `scale` fraction digits (default 6).\n- `pm.random.boolean()` — The string \"true\" or \"false\".\n- `pm.random.phone()` — Phone number string.\n- `pm.random.name()` — Person name string.\n- `pm.random.date(format?)` — Date string within ±1 year (default format YYYY-MM-DD; tokens YYYY MM DD HH mm ss SSS Z).\n\n## pm.counter\n\nCounter that survives across the requests of a run.\n\n- `pm.counter.next()` — Next value (number, starts at 1).\n- `pm.counter.start(startAt?)` — Counter starting at a custom value (number, default 1); each call increments.\n\n## pm.info\n\nExecution metadata snapshot (read-only).\n\n- `pm.info.eventName` — \"prerequest\" in pre-request scripts, \"test\" in post-response / tests scripts, \"scenario-script\" in scenario script nodes.\n- `pm.info.iteration` — 0-BASED index of the current iteration of a data-driven run (0 outside one, like Postman).\n- `pm.info.iterationCount` — Total iterations of the run (1 outside a data-driven run). Never use it to gate token/cache logic in single sends.\n- `pm.info.requestName` — Current request's name.\n- `pm.info.requestId` — Current request's id.\n\n## pm.execution\n\nCollection-run flow control (Postman's pm.execution). Honoured by the collection runner; a single Send ignores it.\n\n- `pm.execution.setNextRequest(nameOrId)` — Run the request with this name or id next; pass null to stop the run after the current request. Postman's postman.setNextRequest is the same. Example: `pm.execution.setNextRequest(\"Get order\")`\n- `pm.execution.skipRequest()` — Skip the current request: it is not sent and its post-response/tests scripts do not run (counted as skipped). _(stages: pre-request)_\n- `pm.execution.location` — Folder path of the current request as an array of names; pm.execution.location.current is the request's own name. Example: `pm.execution.location.current`\n- `pm.execution.runRequest(requestIdOrName)` — Not supported in Callman yet — always throws a clear error.\n\n## pm.node\n\nScenario workflow context (scenario script and request nodes only). pm.node is a FUNCTION — pm.node(label) — not an object. The same data is also available as a global named after the node label when the label is a valid identifier (Login.token).\n\n- `pm.node(label)` — Output of a previous node by label (null when it has not run). The value carries __meta { status, success, failed, skipped, attempts, startedAt, endedAt, durationMs, error }. _(stages: scenario-script)_ Example: `const token = pm.node(\"Login\").token`\n- `workflow.__meta` — Run-level metadata: status, totalNodes, successfulNodes, failedNodes, skippedNodes, totalRetries, durationMs, currentNode, lastNode, failedNode. _(stages: scenario-script)_\n- `env.NAME` — The active environment's variables as a plain object (also available in request scripts). Example: `env.BASE_URL`\n\n## pm.log\n\nStructured logging into the run report.\n\n- `pm.log(...args)` — Like console.log; entries land in the run's log panel.\n\n## CryptoJS\n\ncrypto-js global (NOT under pm.*; also require('crypto-js')). Results are WordArrays: call .toString() for hex or .toString(CryptoJS.enc.Base64).\n\n- `CryptoJS.SHA256(message)` — Hash (also SHA1, SHA224, SHA384, SHA512, SHA3, MD5, RIPEMD160); .toString() is hex. Example: `CryptoJS.SHA256(body).toString()`\n- `CryptoJS.HmacSHA256(message, key)` — HMAC (also HmacSHA1/224/384/512, HmacMD5). Example: `CryptoJS.HmacSHA256(msg, secret).toString(CryptoJS.enc.Hex)`\n- `CryptoJS.AES.encrypt(message, key)` — AES encryption; CryptoJS.AES.decrypt(cipher, key) returns a WordArray — call .toString(CryptoJS.enc.Utf8). Example: `CryptoJS.AES.encrypt(text, key).toString()`\n- `CryptoJS.PBKDF2(password, salt, options)` — Key derivation ({ keySize, iterations }).\n- `CryptoJS.enc.Base64` — Encoders for .toString(...) / .parse(...): Utf8, Base64, Base64url, Hex, Latin1, Utf16. Example: `CryptoJS.enc.Base64.stringify(CryptoJS.enc.Utf8.parse(text))`\n- `CryptoJS.lib.WordArray.random(nBytes)` — Raw random word array (e.g. IVs); WordArray.create(words, sigBytes) builds one.\n\n## _\n\nlodash global (NOT under pm.*; also require('lodash')).\n\n- `_.get(object, path, defaultValue?)` — Safe nested read; the full lodash surface (pick, omit, groupBy, sortBy, uniq, merge, cloneDeep, isEqual, chunk, ...) is available. Example: `_.get(payload, \"data.items[0].id\")`\n- `_.groupBy(collection, iteratee)` — Group items by a key or function. Example: `_.groupBy(items, \"status\")`\n\n## timers\n\nSafe per-run timer wrappers (callbacks never outlive the run; delays are capped at 60 s). They return numeric ids.\n\n- `setTimeout(handler, delayMs)` — Run later; use with await new Promise(r => setTimeout(r, ms)) for polling loops. clearTimeout(id) cancels. Example: `await new Promise(r => setTimeout(r, 500))`\n- `clearTimeout(id)` — Cancel a setTimeout.\n- `setInterval(handler, delayMs)` — Repeat; clearInterval(id) cancels.\n- `clearInterval(id)` — Cancel a setInterval.\n- `setImmediate(handler)` — Run on the next turn (clearImmediate(id) cancels).\n\n## globals\n\nOther globals available in every script (no import): Buffer, Intl, Reflect, Proxy, WeakRef, URL, URLSearchParams, TextEncoder/TextDecoder, atob/btoa, structuredClone, queueMicrotask, AbortController, Blob, crypto (Web Crypto), encodeURI/decodeURI, escape/unescape and the usual JSON/Math/Date/Promise/Map/Set/typed arrays. fetch, XMLHttpRequest, WebSocket, process, window, eval and Function are blocked — use pm.sendRequest for HTTP.\n\n- `Buffer.from(data, encoding?)` — Node Buffer (utf8, hex, base64, base64url, latin1, ...). Example: `Buffer.from(\"hello\").toString(\"base64\")`\n- `crypto.randomUUID()` — Web Crypto: also crypto.getRandomValues(typedArray) and crypto.subtle.digest/sign/verify/encrypt/decrypt. Example: `crypto.randomUUID()`\n- `structuredClone(value)` — Deep clone (Date, Map, Set, RegExp, ...).\n- `atob(base64)` — Decode base64 to a binary string (btoa(text) encodes).\n\n## postman\n\nPostman's LEGACY scripting API, kept so old exported collections run unchanged. Enabled in request scripts unless the script starts with \"use sandbox2\"; prefer pm.* in new scripts.\n\n- `postman.setEnvironmentVariable(key, value)` — Same as pm.environment.set (also getEnvironmentVariable, clearEnvironmentVariable, clearEnvironmentVariables). Example: `postman.setEnvironmentVariable(\"token\", \"abc\")`\n- `postman.setGlobalVariable(key, value)` — Same as pm.globals.set (also getGlobalVariable, clearGlobalVariable, clearGlobalVariables).\n- `postman.setNextRequest(name)` — Same as pm.execution.setNextRequest.\n- `postman.getResponseHeader(name)` — Header value of the response. _(stages: post-response, tests)_\n- `postman.getResponseCookie(name)` — Cookie of the response. _(stages: post-response, tests)_\n- `tests['name'] = boolean` — Legacy test: records a test named `name` that passes when the value is truthy. Example: `tests[\"status is 200\"] = responseCode.code === 200`\n- `responseBody` — Legacy: raw response body text. _(stages: post-response, tests)_\n- `responseCode.code` — Legacy: { code, name, detail } of the status. _(stages: post-response, tests)_\n- `responseTime` — Legacy: response time in ms. _(stages: post-response, tests)_\n- `responseHeaders` — Legacy: response headers as a plain object. _(stages: post-response, tests)_\n- `responseCookies` — Legacy: response cookies as { name: value }. _(stages: post-response, tests)_\n- `environment['name']` — Legacy: `environment` and `globals` also read variables by bracket (environment['token']); environment.get('token') keeps working. `data` is the iteration row, `iteration` the 0-based index; tv4, cheerio and xml2Json(xml) are globals.\n\n## unsupported\n\nPostman APIs Callman does not implement. Accessing them throws a clear \"is not supported in Callman yet\" error (never `undefined`), so a copied script fails loudly instead of misbehaving: pm.vault, pm.datasets, pm.mock, pm.state, pm.message, pm.execution.runRequest, and pm.require('npm:...' / 'jsr:...' / '@team/...') package specifiers. Postman Flows, Postbot, gRPC/WebSocket/MQTT hooks are out of scope.\n\n\n## Stage rules\n\n- `pre-request`: runs BEFORE the HTTP call. `pm.response` does not exist; `pm.request` mutations take effect.\n- `post-response` / `tests`: run AFTER the call. `pm.response` is available; `pm.request` mutations have no effect.\n- `scenario-script`: a scenario Script node. There is no `pm.request` / `pm.response`. Prior node outputs are readable via `pm.node(\"NodeLabel\")` or the label as a global (`NodeLabel.path`); `env` is the environment as a plain object; the script's return value becomes the node output.\n- Members without a stage note are available in every stage.\n\n## Collection and folder scripts\n\n- A collection and each of its folders can carry their own pre-request, post-response and tests scripts. They run for EVERY request inside them, in addition to the request's own scripts — never instead of them.\n- Order, for each stage: collection → folders (outermost first) → the request.\n- Every script of one request shares the same `pm.variables` (local) scope; environment, globals and collection-variable writes are visible to the next script in the chain.\n- A failing pre-request script stops the chain and the request is not sent. Post-response / tests scripts of every level still run and report.\n- `pm.info.requestName` / `pm.info.requestId` tell a collection script which request it is running for (e.g. skip a token fetch for the Login request).\n\n## Postman compatibility notes\n\n- `pm.response.code` is the number (200); `pm.response.status` is the reason phrase (\"OK\") — `pm.response.status === 200` is false.\n- `pm.response.json()` throws when the body is empty or not valid JSON.\n- `pm.test` runs its callback synchronously; `pm.test(name, done => ...)`, `pm.test.skip(name)` and `pm.test.index()` exist.\n- `pm.info.iteration` is 0-based; `pm.info.eventName` is \"prerequest\" or \"test\".\n- `replaceIn` keeps an unresolved `{{x}}` as written; environment / globals values keep the type they were set with inside the run and are stored as strings (objects as JSON).\n- `pm.random.*` generators return strings (including `int()` and `boolean()`).\n- Postman's legacy API (`postman.*`, `tests[\"name\"] = bool`, `responseBody`, `responseCode`, ...) works unless the script starts with \"use sandbox2\".\n- Unsupported Postman APIs (`pm.vault`, `pm.datasets`, `pm.mock`, `pm.state`, `pm.message`, `pm.execution.runRequest`, `npm:` / `jsr:` packages) throw a clear \"not supported in Callman yet\" error.\n",
     "sandbox-globals": "<!-- GENERATED FILE — do not edit by hand. Source: callman_core (npm run ai:packs). -->\n\n# Script sandbox — available and blocked globals\n\nThe sandbox is a Node `vm` context. Generated code must never reference a blocked global — the script fails at runtime.\n\n## Available built-ins\n\n`AbortController`, `AbortSignal`, `AggregateError`, `Array`, `ArrayBuffer`, `BigInt`, `BigInt64Array`, `BigUint64Array`, `Blob`, `Boolean`, `Buffer`, `DOMException`, `DataView`, `Date`, `Error`, `EvalError`, `Event`, `EventTarget`, `File`, `FinalizationRegistry`, `Float32Array`, `Float64Array`, `Infinity`, `Int16Array`, `Int32Array`, `Int8Array`, `Intl`, `JSON`, `Map`, `Math`, `NaN`, `Number`, `Object`, `Promise`, `Proxy`, `RangeError`, `ReadableStream`, `ReferenceError`, `Reflect`, `RegExp`, `Set`, `String`, `Symbol`, `SyntaxError`, `TextDecoder`, `TextDecoderStream`, `TextEncoder`, `TextEncoderStream`, `TransformStream`, `TypeError`, `URIError`, `URL`, `URLSearchParams`, `Uint16Array`, `Uint32Array`, `Uint8Array`, `Uint8ClampedArray`, `WeakMap`, `WeakRef`, `WeakSet`, `WritableStream`, `atob`, `btoa`, `crypto`, `decodeURI`, `decodeURIComponent`, `encodeURI`, `encodeURIComponent`, `escape`, `isFinite`, `isNaN`, `parseFloat`, `parseInt`, `queueMicrotask`, `structuredClone`, `undefined`, `unescape`\n\nPlus the injected helpers: `pm` (also `cm` and `callman` — the same object), `console` (the full console API), `require` / `pm.require`, `CryptoJS`, `_` (lodash), `setTimeout`/`clearTimeout`/`setInterval`/`clearInterval`/`setImmediate`/`clearImmediate` (safe per-run wrappers) and, in request scripts, Postman's legacy globals (`postman`, `tests`, `responseBody`, `responseCode`, `responseTime`, `responseHeaders`, `responseCookies`, `environment`, `globals`, `data`, `iteration`, `tv4`, `cheerio`, `xml2Json`).\n\n## Blocked (never use)\n\n`Function`, `WebSocket`, `Worker`, `XMLHttpRequest`, `document`, `eval`, `exports`, `fetch`, `global`, `globalThis`, `importScripts`, `module`, `navigator`, `process`, `self`, `window`\n\nNotes:\n- No `fetch` — use `pm.sendRequest` for HTTP.\n- `Buffer`, `crypto` (Web Crypto), `atob`/`btoa`, `TextEncoder`/`TextDecoder`, `URL`, `structuredClone`, `AbortController` and `Blob` are available.\n- `require(name)` / `pm.require(name)` serve only these built-in libraries: `lodash`, `moment`, `chai`, `ajv`, `cheerio`, `xml2js`, `tv4`, `uuid`, `csv-parse/lib/sync`, `postman-collection`, `crypto-js`, `atob`, `btoa`, `path`, `assert`, `buffer`, `util`, `url`, `querystring`, `string_decoder`, `stream`, `events`, `punycode`, `timers`. `import`, `npm:`/`jsr:` packages and the filesystem are not available. `CryptoJS` and `_` are already in scope.\n- `pm.vault`, `pm.datasets`, `pm.mock`, `pm.state`, `pm.message` and `pm.execution.runRequest` throw a clear \"not supported in Callman yet\" error.\n",
-    "scenario-nodes": "<!-- GENERATED FILE — do not edit by hand. Source: callman_core (npm run ai:packs). -->\n\n# Scenario node reference\n\nA scenario is a directed graph: nodes do the work, edges decide what runs next. This reference is for clients that write scenarios through the API or an MCP tool; every rule below is what the server enforces on save or what the run engine does.\n\n## Scenario shape\n\nCompact form (what the MCP scenario tools take):\n\n```json\n{\n  \"name\": \"Order flow\",\n  \"description\": \"optional\",\n  \"priority\": \"high\",\n  \"nodes\": [\n    {\n      \"id\": \"login\",\n      \"type\": \"request\",\n      \"label\": \"Login\",\n      \"config\": {\n        \"method\": \"POST\",\n        \"url\": \"{{env.baseUrl}}/login\"\n      }\n    },\n    {\n      \"id\": \"done\",\n      \"type\": \"end\",\n      \"label\": \"Done\"\n    }\n  ],\n  \"edges\": [\n    {\n      \"source\": \"login\",\n      \"target\": \"done\"\n    }\n  ],\n  \"environments\": [\n    {\n      \"name\": \"Default\",\n      \"variables\": [\n        {\n          \"key\": \"baseUrl\",\n          \"value\": \"https://api.example.com\"\n        }\n      ]\n    }\n  ]\n}\n```\n\n- Node `{ id?, type, label?, config?, position? }`. `id` defaults to n1, n2, …; when `position` is omitted the node is placed after the node it is connected from, clear of every existing node.\n- `config` is deep-merged over the type's defaults (the Default column): objects merge key by key, arrays and scalars replace the default whole. Send only what you change — but an array you send (headers, checks, steps, rules, assignments) must be complete.\n- Edge `{ id?, source, target, type? }`, `type` = `default` (or omitted) | `yes` | `no` | `error`. Edges have no label.\n- `priority`: critical | high | medium | low. `environments[].variables`: `{ key, value, enabled? }[]`.\n- Stored form (the REST API, and the body of `foreach` / `subscenario` / `scenario-ref`): node `{ id, type, position: { x, y }, data: { label, config } }` with the COMPLETE config — nothing is merged — and edge `{ id, source, target, type? }` with a required `id`.\n\nReq column: **yes** = rejected on save without a real value; **run** = saved, but the run fails without it. Default \"(engine)\" = applied at run time when the field is absent.\n\n## Connections\n\ndb, redis, kafka, notification, ai and temporal nodes run on a workspace connection: `config.connectionId` is the id of a connection of type `database`, `redis`, `kafka`, `notification` (Slack), `ai` (managed) or `temporal` (a Temporal.io cluster / Temporal Cloud namespace). Use a real connection id from the workspace — never invent one. Only the ai node rejects an empty id on save; the others save with `\"\"` and fail when run.\n\n## Labels\n\n- `label` names a node's output: later nodes read `{{Label.path}}`. It is optional on save, but an unlabelled node's output cannot be referenced.\n- Labels must be unique across the whole scenario, including foreach / subscenario bodies: a repeated label is overwritten by whichever node ran last.\n- Reserved labels — the engine drops the output of a node labelled `workflow`, `__meta`, `loop`, `loops`, `item`, `each`, `eaches`, `ws`, so references to it resolve to empty without any error.\n- Avoid labels that are built-in roots — `response`, `lastResponse`, `data`, `env`, `global`, `globals`, `db`, `redis`, `kafkaEvent`, `kafkaevent` — the node and the root shadow each other.\n- Prefer identifier labels (`Login`, `CreateOrder`, `check_db`). Script nodes get a label as a global variable only when it is an identifier and not a sandbox name (`pm`, `env`, `console`, `request`, `response`, `test`, `expect`, `workflow`, `db`, `kafka`, `redis`, …).\n\n## Templates and outputs\n\n- `{{env.KEY}}` / `{{global.KEY}}` read one scope; a bare `{{KEY}}` reads both (in scenario runs a global wins when both define KEY). `{{data.column}}` is the current dataset row.\n- `{{Label.path}}` (or `{Label.path}`) reads an earlier node's output; arrays by index (`items[0].id`), no wildcards. `{{response.*}}` is the most recent request's response. Generators: `{{$randomUUID}}`, `{{$timestamp}}`, `{{random.email}}`, `{{counter}}`.\n- Substitution is plain text — quote SQL strings yourself (`WHERE id = '{{userId}}'`). A missing value resolves to an empty string.\n- A request's output: `<Label>.status` is the HTTP status (number). Read body fields through `<Label>.body.<path>`: top-level body keys are also spread onto the output, but `status`, `statusText`, `data`, `body`, `rawBody`, `text`, `headers`, `cookies`, `durationMs` are HTTP metadata and win over same-named body keys. `<Label>.data.<path>` reads a body's top-level `data`.\n- Operand paths (rules, `foreach.itemsPath`, set-vars `source`) are BARE dotted paths without braces: `CreateOrder.body.total`, `CheckOrder.rows[0].status`.\n\n## Rules and operands\n\nShared by condition, assertion, poll, websocket expect steps and `end.loopExitRule`.\n\n- Rule `{ id, type: \"rule\", left, operator, right? }` — `id` and `type: \"rule\"` are required; `right` is required unless the operator is unary.\n- Group `{ id, type: \"group\", operator: \"AND\" | \"OR\", children: [Rule | Group, …] }` with at least one child.\n- Operand `{ mode: \"runtime\" | \"literal\", valueType: \"string\" | \"number\" | \"boolean\" | \"null\" | \"array\", value, extract? }`. runtime: `value` is a bare path. literal: a JSON number for number, true/false for boolean, null for null, a JSON array for array.\n- Binary operators: equals, not_equals, strict_equals, strict_not_equals, greater_than, less_than, greater_or_equal, less_or_equal, between, contains, not_contains, starts_with, ends_with, regex, in, not_in, contains_row, set_equals_unordered. `between` takes [min, max]; `in` / `not_in` an array; `regex` a JS regex source; `contains_row` checks that an array of rows has one matching every key of an object (a JSON-object string literal or a runtime path); `set_equals_unordered` compares two arrays as multisets.\n- Unary operators (no `right`): exists, not_exists, is_empty, not_empty, is_null, not_null.\n- `extract` `{ type: \"jsonpath\" | \"regex\", expression, flags?, group?, select?: \"first\" | \"all\" }` is applied to the resolved value first; a failed extraction behaves as not-exists. JSONPath runs without script evaluation: `$.a.b`, `$['x-id']`, `$.items[*].id`, `$..id` and slices work; filter expressions (`[?(@.x == 1)]`) are rejected — filter in a script node.\n\nExample: `{ \"id\": \"r1\", \"type\": \"rule\", \"left\": { \"mode\": \"runtime\", \"valueType\": \"number\", \"value\": \"CreateOrder.status\" }, \"operator\": \"equals\", \"right\": { \"mode\": \"literal\", \"valueType\": \"number\", \"value\": 201 } }`\n\n## Contract rules\n\nEach rule's `rules` object may use ONLY these keys (omit the rest):\n- common: required(bool), type(string|number|boolean|object|array|null), equals(string|number|bool), notEmpty(bool)\n- number: min,max,greaterThan,lessThan(number); integer,positive,negative,nonZero(bool)\n- string: minLength,maxLength(int); pattern,contains,notContains,startsWith,endsWith(string); caseSensitive(bool); enumValues(array); format(enum)\n- array: minItems,maxItems(int); sorted({order:asc|desc,field?}); unique({mode:whole|byField,fields?})\n- object: requiredKeys,forbiddenKeys(string[]); minProperties,maxProperties(int); strictSchema(bool)\n- format values: email, url, uuid, uuidV1, uuidV4, uuidV7, jwt, base64, base64url, base64Pdf, base64Png, base64Jpeg, base64Gif, base64Webp, base64Image, base64Zip, base64Office, datetime, date, time, ipv4, ipv6, hostname, json, numeric, integer, alpha, alphanumeric, hex, hexColor, slug, semver, objectId, creditCard, phone\n\n## Execution policy\n\nEvery node except condition takes `executionPolicy: { onFailure: \"stop\" | \"continue\", retry: { enabled, maxAttempts (0..100), delayMs (0..3600000), backoffMultiplier? (1..10), maxDelayMs? (0..3600000) }, expectFailure?: { messagePattern? } }` — onFailure and retry.enabled / maxAttempts / delayMs are required when you send the stored form.\n- `maxAttempts` counts every attempt (an enabled retry makes at least 2). Delay before retry n = min(maxDelayMs, delayMs × backoffMultiplier^(n−1)). No policy = stop, no retry.\n- stop: a failure ends the run; continue: the run goes on along the normal edges.\n- `error` edges from the failing node win over both: the run follows them instead of the normal edges (after the retries).\n- How the run ends: `success` only when no node failed. A failure that continued or was routed through an `error` edge marks that node `failed_continued` and the run ends `completed_with_failures` — never `success`. A stop failure ends it `failed`.\n- `expectFailure: { messagePattern? }` turns the node into a negative test (`request`, `db`, `redis`, `kafka`, `websocket`, `script`, `assertion`, `poll`, `ai`, `temporal`, `notification`): an attempt that FAILS with a message matching `messagePattern` (a JS regex, ≤500 chars; omitted = any failure) makes the node succeed — normal edges run, the run can end `success`, and the output is `<Label>.expectedFailure.message`. An attempt that succeeds, or fails with another message, is a failure (retry and onFailure apply as usual, so retry can wait for something to start failing). Use it for absence checks (a Kafka event that must not appear, a poll that must time out, a request that must be refused). On a db node a non-empty `expectError` wins.\n- Example: `\"executionPolicy\": { \"onFailure\": \"stop\", \"retry\": { \"enabled\": false, \"maxAttempts\": 0, \"delayMs\": 0 }, \"expectFailure\": { \"messagePattern\": \"timed out\" } }`.\n\n## Node types\n\n### request\nOne HTTP call.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `method` | string | `\"GET\"` |  | HTTP verb. |\n| `url` | string (≤10000) | `\"\"` | run | Absolute URL; `{{…}}` allowed. Its own `?query` is used only when `query` has no enabled rows. |\n| `headers` | {key, value, enabled?}[] | `[]` |  | Disabled rows are not sent. A Content-Type row beats the automatic one (formdata always uses the driver's multipart type). |\n| `query` | {key, value, enabled?}[] | `[]` |  |  |\n| `body.mode` | none \\| raw \\| formdata \\| urlencoded | `\"none\"` |  |  |\n| `body.raw` | string | `\"\"` |  | mode raw. JSON text that still parses after templating is sent as JSON. |\n| `body.rawLanguage` | json \\| xml \\| text \\| html | — |  | With no Content-Type header, sets application/json, application/xml, text/plain or text/html (json when absent). |\n| `body.formEntries` | {key, value, enabled?, type?, fixtureId?, fileName?}[] | `[]` |  | formdata / urlencoded rows. A `type:\"file\"` row needs `fixtureId` (an uploaded workspace fixture file) — server runs fail it otherwise. |\n| `auth.type` | none \\| bearer \\| basic \\| apikey \\| oauth2 | `\"none\"` |  |  |\n| `auth.bearerToken` | string | `\"\"` |  | bearer → `Authorization: Bearer <token>`. |\n| `auth.basicUsername / auth.basicPassword` | string | `\"\"` |  | basic → base64 `user:password`. |\n| `auth.apiKeyKey / auth.apiKeyValue` | string | `\"\"` |  | apikey → sends `key: value`; skipped when the key is blank. |\n| `auth.apiKeyLocation` | header \\| query | `\"header\"` |  |  |\n| `auth.oauth2` | {grantType, tokenUrl, clientId, clientSecret, scope, username, password, refreshToken, clientAuth, audience} | — |  | oauth2: when present ALL ten keys are required (send \"\" for unused ones); grantType client_credentials \\| password \\| refresh_token; clientAuth basic \\| body. The token is fetched (and cached) before the call and sent as a Bearer header. Without it, type oauth2 sends no Authorization. |\n| `preRequestScript / postResponseScript / testsScript` | string | `\"\"` |  | `pm.*` scripts: before the call / after the response / assertions (`pm.test`). |\n| `contractAssertions` | {id, path, enabled, rules, engine?, namespaces?}[] (≤200) | `[]` |  | id, path, enabled and rules are required; `rules` needs ≥1 key (see Contract rules). `path` is a dot-path over the parsed body (`data.items[0].id`, `items[].id` = every element); with engine \"xpath\" it is an XPath over the raw XML and every prefix must be in `namespaces` {prefix: uri}. |\n| `expectedStatus` | string (≤200) | — |  | Negative testing: `\"201\"`, `\"4xx\"`, `\"200-299\"`, `\"200,204\"`, templates allowed. When set the node passes iff the status matches (instead of 2xx/3xx); contract assertions and test scripts can still fail it. |\n| `responseSchema` | JSON Schema object | — |  | Validated against the response body; a mismatch fails the node. |\n| `clientCertificate` | {enabled, format, pfxBase64?, certPem?, keyPem?, passphrase?, caPem?, rejectUnauthorized?} | — |  | mTLS. enabled and format (\"pfx\" \\| \"pem\") are required; pfx uses pfxBase64, pem uses certPem + keyPem. Server runs present the certificate whenever this object is set — omit it to send none. |\n| `soap` | {enabled, version, action?, wsSecurity?} | — |  | version \"1.1\" \\| \"1.2\". Keep the full envelope in body.raw (rawLanguage \"xml\"); Content-Type/SOAPAction come from the version (a Content-Type header wins). wsSecurity {enabled, username, password, passwordType: text \\| digest} injects a UsernameToken at send time. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: `<Label>.status` (number), `<Label>.body.<path>`, `<Label>.headers`, `<Label>.text`, `<Label>.durationMs`. The most recent request is also `response.*`.\n\n```json\n{\"id\":\"login\",\"type\":\"request\",\"label\":\"Login\",\"config\":{\"method\":\"POST\",\"url\":\"{{env.baseUrl}}/login\",\"body\":{\"mode\":\"raw\",\"raw\":\"{\\\"user\\\":\\\"{{env.user}}\\\",\\\"password\\\":\\\"{{env.password}}\\\"}\",\"rawLanguage\":\"json\"},\"expectedStatus\":\"200\"}}\n```\n\n### db\nOne query on a workspace connection of type `database`.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `connectionId` | string | `\"\"` | run | `\"\"` = not chosen yet: saved, but the run fails. |\n| `query` | string (1..100000) | `\"SELECT *\\nFROM users\\nWHERE id = {{env.userId}}\"` | yes | Mongo: a command object as MongoDB Extended JSON (relaxed) text (`{\"collection\":\"orders\",\"operation\":\"findOne\",\"filter\":{…}}`) — `{\"$date\":\"2026-01-01T00:00:00Z\"}`, `{\"$oid\":\"…\"}`, `{\"$numberDecimal\":\"9.99\"}` and `{\"$numberLong\":\"…\"}` become real BSON values; plain whole numbers are sent as int32/double (a `$numberLong` beyond 2^53 loses precision). A 24-hex string in `filter` is also matched as an ObjectId. SQL: plain SQL. Per-engine details: the DB query reference. The default is a placeholder — always send your own. |\n| `params` | string[] (≤200) | — |  | Positional binds, template-resolved: `$1` (Postgres), `?` (MySQL), `@p1…` (SQL Server). |\n| `typedParams` | {value, type?}[] (≤200) | — |  | Wins over params. type auto \\| text \\| int \\| numeric \\| boolean \\| date \\| timestamp \\| json \\| null: null binds SQL NULL, boolean a real boolean, the rest stay strings (cast in SQL). |\n| `useSession` | boolean | — |  | Postgres only: join the run's shared session (scenario-level `dbSettings.transactionMode`: none \\| rollback \\| commit). |\n| `expectError` | {sqlState?, messagePattern?} | — |  | Negative test: the node passes only if the query FAILS with that SQLSTATE and/or a message matching the regex. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: `<Label>.rows`, `<Label>.rowCount`; the rows are also `db.result`. With `expectError` met: `<Label>.expectedError` {sqlState, message}, rows empty.\n\n```json\n{\"id\":\"check\",\"type\":\"db\",\"label\":\"CheckOrder\",\"config\":{\"connectionId\":\"<database connection id>\",\"query\":\"SELECT status FROM orders WHERE id = $1\",\"params\":[\"{{CreateOrder.body.id}}\"]}}\n```\n\n### redis\nRedis commands on a workspace connection of type `redis`.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `connectionId` | string | `\"\"` | run |  |\n| `commands` | string[] (≤1000, each non-empty) | `[]` | run | One command per entry, template-resolved. Supported: GET, SET, DEL, EXISTS, TTL, HGET, HSET, HGETALL, HDEL, LPUSH, RPUSH, LRANGE, LLEN, SADD, SMEMBERS, SISMEMBER, INCR, DECR, INCRBY, EXPIRE, PERSIST, TYPE, ZADD, ZRANGE, ZSCORE, SCAN. `SCAN pattern [count]` returns {keys, count, truncated}. An empty list fails the run. |\n| `executionPolicy` | ExecutionPolicy | continue, retry ×2 every 1000 ms |  | See Execution policy. |\n\nOutput: The reply (one command) or an array of replies, as `<Label>` and `redis.result`.\n\n```json\n{\"id\":\"cache\",\"type\":\"redis\",\"label\":\"Cache\",\"config\":{\"connectionId\":\"<redis connection id>\",\"commands\":[\"GET order:{{CreateOrder.body.id}}\"]}}\n```\n\n### kafka\nConsume (wait for a matching message) or publish, on a connection of type `kafka`.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `connectionId` | string | `\"\"` | run |  |\n| `topic` | string (1..500) | `\"\"` | yes |  |\n| `mode` | consume \\| publish | `\"consume\"` |  |  |\n| `matchMode` | regex \\| rules | `\"regex\"` |  | consume. The default is regex — when you write comparisons, set `\"rules\"` or rules[0] is read as a regex. |\n| `rules` | string[] | `[]` |  | consume. regex: rules[0] is a regex tested against the whole message. rules: every entry is ONE comparison `left op right` (op ==, !=, ===, !==, >, <, >=, <=, contains) and all must hold, e.g. `kafkaEvent.orderId == '{{CreateOrder.body.id}}'`. Empty = the first message captured (the node stops listening at that message). |\n| `captureTimeoutMs` | integer 1000..120000 | 5000 (engine) |  | consume. How long ONE attempt listens; capped by the host's per-node timeout (60 s on a default server). Retry multiplies it. |\n| `publishValueFormat` | json \\| raw | `\"json\"` |  | publish. json fails the node when messageValue is not valid JSON after templating. |\n| `messageKey` | string | `\"\"` |  | publish. |\n| `messageValue` | string (≤1000000) | `\"\"` |  | publish payload, template-resolved. |\n| `messageHeaders` | {key, value, enabled?}[] | `[]` |  | publish. |\n| `executionPolicy` | ExecutionPolicy | continue, retry ×3 every 2000 ms |  | See Execution policy. |\n\nOutput: consume: the matched message — a JSON-object message's keys at the top level plus `meta` {value, text, key, topic, partition, offset, timestamp, headers}; any other message (array, number, text) has those fields at the top level instead, without `meta`. Also `kafkaEvent.*`. publish: {topic, partition, offset, timestamp}.\n\n**Where consuming starts.** A consume node sees records whose Kafka timestamp is at or after the scenario run's start — messages produced before the run are never seen, messages produced earlier in the same run (by a publish node or by the system under test) are. Timestamps are the producer's clock, so allow for skew. Messages from earlier loop iterations or foreach items of the same run can match too — make the rules specific (an id from this iteration).\n\n**How long it waits.** One attempt listens for `captureTimeoutMs` (default 5000 ms) and stops early at the first matching message. The default executionPolicy is continue with retry ×3 every 2000 ms, so a node waits about 3 × 5 s + 2 × 2 s ≈ 19 s in total before failing. For a slow consumer raise `captureTimeoutMs` (and/or retry) rather than adding wait nodes.\n\n**How rules read the message.** Rules are evaluated against the event shape above, NOT with JSONPath: each side is a plain dotted path (`kafkaEvent.orderId`, `kafkaEvent.meta.headers.traceparent`, `kafkaEvent.items[0].sku`) or a template. Header and key names with dashes work as plain dotted paths: `kafkaEvent.meta.headers.x-correlation-id == '{{CorrId}}'`. Brackets (`headers['x-id']`) and `$.` paths are not resolved — they compare as literal text and never match. A path segment that contains an operator word (`x-contains-id`) splits the rule at that word; avoid it or read it in a script node. Headers are UTF-8 strings; a header repeated on one record is joined with `, `. A topic, partition or offset is under `meta` (`kafkaEvent.meta.offset` is a string).\n\n**Expecting no message.** A consume node FAILS when nothing matches in time. To assert that an event is NOT published, give the node `executionPolicy.expectFailure: {}` (see Execution policy) — the timeout then counts as success.\n\n```json\n{\"id\":\"event\",\"type\":\"kafka\",\"label\":\"OrderCreated\",\"config\":{\"connectionId\":\"<kafka connection id>\",\"topic\":\"orders\",\"mode\":\"consume\",\"matchMode\":\"rules\",\"rules\":[\"kafkaEvent.orderId == '{{CreateOrder.body.id}}'\"]}}\n```\n\n### condition\nThe only branching node and the only node without `executionPolicy`. Needs exactly two outgoing edges: one `yes`, one `no`.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `mode` | builder \\| expert | `\"builder\"` |  |  |\n| `rootGroup` | Group | one rule: `response.status` equals `200` |  | Evaluated in builder mode (see Rules and operands). Stored in both modes. |\n| `expertExpression` | string \\| null | `\"{{response.status}} == 200\"` |  | Used ONLY with `mode: \"expert\"` (ignored otherwise). Syntax below. |\n\nOutput: Takes the `yes` or `no` edge.\n\nExpert syntax: operands are `{{path}}` tokens (a bare path is a parse error), 'single'- or \"double\"-quoted strings, numbers, true / false / null and [arrays]; operators ==, !=, ===, !==, >, <, >=, <=, contains, not contains, starts with, ends with, regex, in, not in, between, exists, not exists, is empty, not empty, is null, not null, contains row, set equals; combine with && / AND, || / OR and parentheses. Example: `{{Login.status}} == 200 && {{Login.body.token}} != ''`.\n\n```json\n{\"id\":\"ok\",\"type\":\"condition\",\"label\":\"LoggedIn\",\"config\":{\"mode\":\"builder\",\"rootGroup\":{\"id\":\"g1\",\"type\":\"group\",\"operator\":\"AND\",\"children\":[{\"id\":\"r1\",\"type\":\"rule\",\"left\":{\"mode\":\"runtime\",\"valueType\":\"number\",\"value\":\"Login.status\"},\"operator\":\"equals\",\"right\":{\"mode\":\"literal\",\"valueType\":\"number\",\"value\":200}}]}}}\n```\n\n### assertion\nPass/fail checkpoint; does not branch (on failure the execution policy decides).\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `matchMode` | all \\| any | `\"all\"` |  |  |\n| `checks` | {id, name, enabled, rule}[] (≤1000) | one blank check | run | id, name (may be \"\"), enabled and rule are required; `rule` is a full Rule. With no enabled check the node passes without testing anything — send at least one. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: `<Label>.passed`, `.passedCount`, `.failedCount`, `.checks[i]` {name, passed, message}.\n\n```json\n{\"id\":\"verify\",\"type\":\"assertion\",\"label\":\"VerifyOrder\",\"config\":{\"checks\":[{\"id\":\"c1\",\"name\":\"total is 40\",\"enabled\":true,\"rule\":{\"id\":\"c1r\",\"type\":\"rule\",\"left\":{\"mode\":\"runtime\",\"valueType\":\"number\",\"value\":\"CreateOrder.body.total\"},\"operator\":\"equals\",\"right\":{\"mode\":\"literal\",\"valueType\":\"number\",\"value\":40}}}]}}\n```\n\n### script\nJavaScript in the `pm.*` sandbox.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `script` | string (≤1000000) | `\"return {\\n  ok: true,\\n};\"` | run | Its `return` value is the node's output. Can `pm.environment.set`, `pm.test`, `await pm.db.query(…)` / `pm.redis.command(…)`. Empty or invalid code fails the run. |\n| `timeoutMs` | integer 1..60000 | `3000` |  | Also capped by the host's per-node timeout. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: The returned value (`<Label>.<key>` for an object).\n\n```json\n{\"id\":\"calc\",\"type\":\"script\",\"label\":\"Totals\",\"config\":{\"script\":\"const body = CreateOrder.body;\\nreturn { total: body.total * 2 };\"}}\n```\n\n### set-vars\nWrite environment/global variables without a script. Rows apply top to bottom (a row sees earlier rows' writes).\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `assignments` | Assignment[] (≤200) | one blank row |  |  |\n| `assignments[].id / .key / .value` | string | — | yes | key and value are template-resolved; value may be \"\". |\n| `assignments[].scope` | environment \\| global | — | yes |  |\n| `assignments[].enabled` | boolean | — | yes |  |\n| `assignments[].extractorType` | template \\| jsonpath \\| regex | — |  | jsonpath / regex: resolve `source` (a bare runtime path such as `CreateOrder.body`), then apply `expression` (JSONPath like `$.items[0].id`, or a JS regex source); `value` is ignored. Regex rows take `flags` (subset of gimsuy) and `group`; `select` first \\| all (all writes a JSON array). A failed extraction skips that write. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: `<Label>.environment` / `<Label>.globals` (what was written), `<Label>.extraction` for extractor rows.\n\n```json\n{\"id\":\"save\",\"type\":\"set-vars\",\"label\":\"SaveOrderId\",\"config\":{\"assignments\":[{\"id\":\"a1\",\"scope\":\"environment\",\"key\":\"orderId\",\"value\":\"{{CreateOrder.body.id}}\",\"enabled\":true}]}}\n```\n\n### poll\nRepeat ONE embedded action until a condition passes or the budget runs out. Retry is forced off (the loop is the retry); a failing tick is retried, not fatal.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `actionType` | request \\| db \\| redis \\| script | `\"request\"` |  |  |\n| `request / db / redis / script` | that node type's config | request: the request defaults | run | The one matching actionType. Same fields as the standalone node. |\n| `successCondition` | {mode, rootGroup, expertExpression?} | `response.status` equals `200` |  | Evaluated after every successful tick. A tick publishes like the real node: request → `response.*`, db → `db.result` (rows), redis → `redis.result`; a script tick exposes only its variable writes (`env.*`, `global.*`). |\n| `intervalMs` | integer 0..3600000 | `2000` |  |  |\n| `maxAttempts` | integer 1..1000 | `30` |  |  |\n| `timeoutMs` | integer 1..86400000 | — |  | Wall-clock cap. |\n| `backoffMultiplier` | number 1..10 | — |  | Exponential backoff on the interval. |\n| `maxDelayMs` | integer 0..3600000 | — |  | Backoff cap. |\n| `onTimeout` | fail \\| continue | `\"fail\"` |  | continue marks the node degraded and goes on. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: `<Label>.attempts`, `.elapsedMs`, `.timedOut`, `.conditionResult`, `.lastTickError`; the last tick's result as listed above.\n\n```json\n{\"id\":\"wait-ready\",\"type\":\"poll\",\"label\":\"WaitReady\",\"config\":{\"actionType\":\"request\",\"request\":{\"url\":\"{{env.baseUrl}}/orders/{{CreateOrder.body.id}}\"},\"successCondition\":{\"mode\":\"expert\",\"expertExpression\":\"{{response.body.status}} == 'READY'\"},\"intervalMs\":2000,\"maxAttempts\":15}}\n```\n\n### foreach\nRun an embedded body graph once per item of an array.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `nodes / edges` | stored node[] / stored edge[] | `[]` |  | The body graph in the STORED form with complete configs (see Scenario shape) — no defaults are merged inside. Same graph rules; labels unique across the whole scenario. |\n| `sourceMode` | path \\| inline | `\"path\"` |  |  |\n| `itemsPath` | string (≤2000) | — | run | path mode: a bare runtime path to an array, e.g. `Users.body.items`. |\n| `itemsInline` | string | — | run | inline mode: JSON array text; templates resolve first. |\n| `itemAlias` | string (≤100) | — |  | Extra root mirroring `{{item}}` (e.g. `user` → `{{user.id}}`). Not a reserved label. |\n| `maxIterations` | integer 1..1000 | 100 (engine) |  |  |\n| `delayMs` | integer 0..3600000 | — |  | Pause between items. |\n| `onItemFailure` | stop \\| continue | `\"stop\"` |  | continue: failed items degrade the run, the loop goes on. |\n| `collectResults` | boolean | `true` |  |  |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: `<Label>.results[i].<ChildLabel>…`, `.itemCount`, `.processedCount`, `.truncated`, `.failedItems`. Inside the body: `{{item}}`, `{{each.index}}` (0-based), `{{each.iteration}}` (1-based), `{{each.total}}`, `{{each.remaining}}`, `{{eaches.<ForeachLabel>.iteration}}` for an outer loop.\n\n```json\n{\"id\":\"each-user\",\"type\":\"foreach\",\"label\":\"EachUser\",\"config\":{\"sourceMode\":\"path\",\"itemsPath\":\"Users.body.items\",\"itemAlias\":\"user\",\"nodes\":[{\"id\":\"get-user\",\"type\":\"request\",\"position\":{\"x\":0,\"y\":0},\"data\":{\"label\":\"GetUser\",\"config\":{\"method\":\"GET\",\"url\":\"{{env.baseUrl}}/users/{{user.id}}\",\"headers\":[],\"query\":[],\"body\":{\"mode\":\"none\",\"raw\":\"\",\"formEntries\":[]}}}}],\"edges\":[]}}\n```\n\n### websocket\nOne WebSocket conversation: connect, run the steps in order, close. Retry re-runs the whole conversation.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `url` | string (≤2000) | `\"\"` | run | ws:// or wss://, template-resolved. |\n| `headers` | {key, value, enabled?}[] (≤100) | `[]` |  |  |\n| `subprotocols` | string[] (≤20) | `[]` |  |  |\n| `connectTimeoutMs` | integer 100..120000 | 10000 (engine) |  |  |\n| `steps` | Step[] (≤200) | `[]` |  | {id, kind:\"send\", payload} sends one text frame; {id, kind:\"expect\", rules (1..50 Rules), timeoutMs? (100..300000, default 10000), matchMode? all \\| any} waits for a matching frame — rule paths use `ws.text`, `ws.json.<path>`, `ws.direction`, `ws.index`; {id, kind:\"wait\", durationMs (0..300000)}. A timed-out expect fails the node. |\n| `closeCode` | integer 1000..4999 | 1000 (engine) |  |  |\n| `rejectUnauthorized` | boolean | — |  | false accepts self-signed certificates. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: `<Label>.connected`, `.messages[i].text`, `.messageCount`, `.failedSteps`, `.closeCode`.\n\n```json\n{\"id\":\"ws\",\"type\":\"websocket\",\"label\":\"Subscribe\",\"config\":{\"url\":\"wss://stream.example.com/orders\",\"steps\":[{\"id\":\"s1\",\"kind\":\"send\",\"payload\":\"{\\\"subscribe\\\":\\\"orders\\\"}\"},{\"id\":\"s2\",\"kind\":\"expect\",\"rules\":[{\"id\":\"s2r\",\"type\":\"rule\",\"left\":{\"mode\":\"runtime\",\"valueType\":\"string\",\"value\":\"ws.json.event\"},\"operator\":\"equals\",\"right\":{\"mode\":\"literal\",\"valueType\":\"string\",\"value\":\"subscribed\"}}]}]}}\n```\n\n### ai\nOne LLM call on a managed workspace connection of type `ai`.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `connectionId` | string (1..200) | `\"\"` | yes | The default `\"\"` is rejected on save. |\n| `prompt` | string (≤200000) | `\"\"` | run | Template-resolved; empty fails the run. |\n| `responseExample` | string (≤20000) | `\"\"` | run | A JSON OBJECT as text; its top-level keys are required in the reply (extra keys allowed). |\n| `maxTokens` | integer 1..32000 | 2000 (engine) |  |  |\n| `timeoutMs` | integer 1000..300000 | 60000 (engine) |  |  |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: The parsed JSON reply: `<Label>.<exampleKey>`.\n\n```json\n{\"id\":\"classify\",\"type\":\"ai\",\"label\":\"Classify\",\"config\":{\"connectionId\":\"<ai connection id>\",\"prompt\":\"Classify the sentiment of: {{GetReview.body.text}}\",\"responseExample\":\"{\\\"sentiment\\\":\\\"positive\\\",\\\"score\\\":0.9}\"}}\n```\n\n### temporal\nOne Temporal.io client operation (start / signal / query / update / await / describe / history / cancel / terminate / list / count / describeTaskQueue) on a workspace connection of type `temporal`.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `connectionId` | string | `\"\"` | run | A connection of type `temporal`. |\n| `operation` | \"startWorkflow\" \\| \"signal\" \\| \"signalWithStart\" \\| \"query\" \\| \"update\" \\| \"awaitResult\" \\| \"describe\" \\| \"history\" \\| \"cancel\" \\| \"terminate\" \\| \"list\" \\| \"count\" \\| \"describeTaskQueue\" | `\"describe\"` | yes | Required fields per operation: startWorkflow → workflowType + taskQueue; signal → workflowId + signalName; signalWithStart → workflowId + workflowType + taskQueue + signalName; query → workflowId + queryName; update → workflowId + updateName; awaitResult → workflowId; describe → workflowId; history → workflowId; cancel → workflowId; terminate → workflowId; list → query; count → query; describeTaskQueue → taskQueue. |\n| `namespace` | string | — |  | Overrides the connection's namespace. Template-resolved. |\n| `workflowId` | string | `\"\"` |  | Template-resolved. On startWorkflow an empty id is generated (`callman-<label>-<uuid>`). |\n| `runId` | string | — |  | Optional everywhere; empty = the latest run. |\n| `workflowType` | string | — |  | startWorkflow / signalWithStart. |\n| `taskQueue` | string | — |  | startWorkflow / signalWithStart / describeTaskQueue. |\n| `args` | string (JSON array) | `\"\"` |  | Workflow / signal / query / update arguments as a JSON ARRAY template string, e.g. `\"[{\\\"orderId\\\":\\\"{{CreateOrder.body.id}}\\\"}]\"`. A bare value is wrapped as one argument. |\n| `waitForResult` | boolean | — |  | startWorkflow: block until the workflow closes; `result` / `status` / `failure` are filled. |\n| `idReusePolicy` | \"ALLOW_DUPLICATE\" \\| \"ALLOW_DUPLICATE_FAILED_ONLY\" \\| \"REJECT_DUPLICATE\" \\| \"TERMINATE_IF_RUNNING\" | — |  |  |\n| `idConflictPolicy` | \"FAIL\" \\| \"USE_EXISTING\" \\| \"TERMINATE_EXISTING\" | — |  | `USE_EXISTING` makes startWorkflow attach to an already-running workflow instead of failing. |\n| `memo` | string (JSON object) | — |  |  |\n| `searchAttributes` | string (JSON object) | — |  |  |\n| `workflowExecutionTimeoutMs` | integer | — |  |  |\n| `workflowRunTimeoutMs` | integer | — |  |  |\n| `workflowTaskTimeoutMs` | integer | — |  |  |\n| `startDelayMs` | integer | — |  |  |\n| `retryPolicy` | {maximumAttempts?, initialIntervalMs?, backoffCoefficient?, maximumIntervalMs?} | — |  |  |\n| `signalName` | string | — |  | signal / signalWithStart. |\n| `signalArgs` | string (JSON array) | — |  | signalWithStart: the signal's arguments (`args` are the start arguments). |\n| `queryName` | string | — |  |  |\n| `updateName` | string | — |  |  |\n| `waitForStage` | \"COMPLETED\" \\| \"ACCEPTED\" | \"COMPLETED\" (engine) |  | update: ACCEPTED returns as soon as the update is admitted (`updateId`). |\n| `followRuns` | boolean | true (engine) |  | awaitResult: follow continue-as-new / retried runs to the final result. |\n| `eventTypes` | string[] | — |  | history: keep only these event types in `events[]` (names like \"ActivityTaskCompleted\"); counts cover the whole history. |\n| `historyLimit` | integer 1..2000 | 500 (engine) |  | history: max events kept (the LAST N); `truncatedHistory` says when it cut. |\n| `reason` | string | — |  | cancel / terminate. |\n| `query` | string | — |  | list / count: a Temporal visibility list filter, e.g. `WorkflowType = 'OrderWorkflow' AND ExecutionStatus = 'Running'` (`GROUP BY ExecutionStatus` allowed on count). |\n| `pageSize` | integer 1..500 | 50 (engine) |  |  |\n| `taskQueueType` | \"workflow\" \\| \"activity\" | \"workflow\" (engine) |  |  |\n| `timeoutMs` | integer 1000..600000 | 60000 (engine) |  | Still capped by the host's per-node budget. A long awaitResult needs a raised node timeout or a poll node (actionType `temporal`). |\n| `onTimeout` | \"fail\" \\| \"continue\" | \"fail\" (engine) |  | awaitResult / startWorkflow+waitForResult: `continue` marks the step partial_success with `timedOut: true` instead of failing. |\n| `expect` | ConditionRule[] | `[]` |  | Checks against the node's OWN output (operand paths `<Label>.status`, `<Label>.result.x`, `<Label>.eventCounts.ActivityTaskFailed`; `temporal.<path>` also works). A failed check fails the node. |\n| `expectMatchMode` | \"all\" \\| \"any\" | `\"all\"` |  |  |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: Always the same keys (null / [] when not applicable): `<Label>.workflowId`, `.runId`, `.status` (RUNNING | COMPLETED | FAILED | CANCELED | TERMINATED | TIMED_OUT | CONTINUED_AS_NEW), `.result` (awaitResult / query / update / start+wait), `.failure` `{message, type, cause[]}`, `.workflowType`, `.taskQueue`, `.startTime`, `.closeTime`, `.historyLength`, `.memo`, `.searchAttributes`, `.activities[]` `{activityType, status, attempt, durationMs, failure}`, `.pendingChildren[]`, `.events[]` `{eventId, eventType, eventTime, attributes}`, `.eventCounts` `{ActivityTaskCompleted: 3, …}`, `.signals[]`, `.timers[]`, `.truncatedHistory`, `.executions[]` `{workflowId, runId, type, status}`, `.count`, `.groups[]`, `.pollers[]`, `.hasPollers`, `.updateId`, `.requested`, `.timedOut`, `.durationMs`.\n\nA workflow that FAILED / was CANCELED is a result, not a node failure: `status` and `failure` are filled and the run goes on. Fail the node with an `expect` rule (`<Label>.status equals COMPLETED`) or `executionPolicy.expectFailure` for infrastructure errors.\n\nInfrastructure errors fail the node: unreachable server (UNAVAILABLE), rejected credentials (UNAUTHENTICATED), unknown workflow (`Workflow not found: <id>`), rejected update, `WorkflowExecutionAlreadyStartedError` (unless `idConflictPolicy: USE_EXISTING`).\n\nTypical chain: request → temporal describe `{{Req.body.workflowId}}` → signal → awaitResult (expect status COMPLETED) → history (expect eventCounts.ActivityTaskFailed equals 0).\n\nPayloads use Temporal's default data converter (JSON). A payload it cannot decode is kept as `{encoding, data}` (base64).\n\n```json\n{\"id\":\"await-order\",\"type\":\"temporal\",\"label\":\"AwaitOrder\",\"config\":{\"connectionId\":\"<temporal connection id>\",\"operation\":\"awaitResult\",\"workflowId\":\"order-{{CreateOrder.body.id}}\",\"timeoutMs\":60000,\"expect\":[{\"id\":\"r1\",\"type\":\"rule\",\"left\":{\"mode\":\"runtime\",\"valueType\":\"string\",\"value\":\"AwaitOrder.status\"},\"operator\":\"equals\",\"right\":{\"mode\":\"literal\",\"valueType\":\"string\",\"value\":\"COMPLETED\"}}]}}\n```\n\n### wait\nFixed delay.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `durationMs` | integer 1..2147483647 | `5000` |  |  |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: `<Label>.configuredDurationMs`, `.actualDurationMs`, `.status`.\n\n```json\n{\"id\":\"pause\",\"type\":\"wait\",\"label\":\"Pause\",\"config\":{\"durationMs\":1000}}\n```\n\n### notification\nSlack message through a workspace connection of type `notification`.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `provider` | \"slack\" | `\"slack\"` |  |  |\n| `connectionId` | string | `\"\"` | run |  |\n| `severity` | info \\| success \\| warning \\| error | `\"info\"` |  |  |\n| `messageTemplate` | string (≤100000) | a run-status line |  | Template-resolved (node outputs, `{{workflow.name}}`, `{{workflow.__meta.status}}` …). |\n| `channelOverride` | string (≤500) | `\"\"` |  |  |\n| `continueOnFailure` | boolean | `true` |  | Overrides executionPolicy.onFailure (true = continue). |\n| `advanced.useRichBlocks` | boolean | `true` |  |  |\n| `executionPolicy` | ExecutionPolicy | continue, no retry |  | See Execution policy. |\n\nOutput: The delivery result.\n\n```json\n{\"id\":\"notify\",\"type\":\"notification\",\"label\":\"Notify\",\"config\":{\"connectionId\":\"<notification connection id>\",\"severity\":\"warning\",\"messageTemplate\":\"Order {{CreateOrder.body.id}} is not ready\"}}\n```\n\n### aggregator\nBuild one JSON object from earlier outputs.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `template` | string (≤1000000) | `\"{\\n  \\\"key\\\": \\\"{Label.field}\\\"\\n}\"` | run | Must be valid JSON after templating (`{{Label.path}}` or `{Label.path}` tokens), else the run fails. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: The parsed object: `<Label>.<key>`.\n\n```json\n{\"id\":\"summary\",\"type\":\"aggregator\",\"label\":\"Summary\",\"config\":{\"template\":\"{\\\"orderId\\\":\\\"{{CreateOrder.body.id}}\\\",\\\"status\\\":\\\"{{CheckOrder.rows[0].status}}\\\"}\"}}\n```\n\n### end\nTerminates a path; optionally loops back to an earlier node.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `loop` | boolean | `false` |  |  |\n| `loopTargetNodeId` | string \\| null | `null` | run | loop: the id of an earlier node to jump back to. |\n| `loopIterations` | integer 1..1000 | `1` |  | Re-entries: the looped section runs loopIterations + 1 times. |\n| `loopDelayMs` | integer 0..600000 | `1000` |  |  |\n| `loopExitRule` | Rule \\| null | — |  | Checked after each pass; TRUE stops the loop early and continues along the end node's outgoing edges. Loop roots: `loop.iteration` (1-based), `loop.index`, `loop.total`, `loop.remaining`. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: A snapshot of the run's outputs so far.\n\n```json\n{\"id\":\"again\",\"type\":\"end\",\"label\":\"Repeat\",\"config\":{\"loop\":true,\"loopTargetNodeId\":\"login\",\"loopIterations\":2,\"loopDelayMs\":500}}\n```\n\n### subscenario\nA group of nodes collapsed into one node (the builder's Group).\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `nodes / edges` | stored node[] / stored edge[] | none | yes | Stored form, complete configs; no defaults are merged for this type. Same graph rules. |\n| `reusableGroupId / reusableSourceScenarioId / reusableSourceNodeId / ungroupSnapshot` | app-managed | — |  | Written by the builder; omit them. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry (engine) |  | See Execution policy. |\n\nOutput: Its inner nodes publish under their own labels.\n\n```json\n{\"id\":\"setup\",\"type\":\"subscenario\",\"label\":\"Setup\",\"config\":{\"nodes\":[{\"id\":\"seed\",\"type\":\"wait\",\"position\":{\"x\":0,\"y\":0},\"data\":{\"label\":\"Settle\",\"config\":{\"durationMs\":500}}}],\"edges\":[]}}\n```\n\n### scenario-ref\nLinks another scenario (shared setup / teardown) without copying it by hand: the node embeds a snapshot of the linked scenario's graph, and the run executes that snapshot.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `scenario` | string (compact form only) | — | yes | The scenario to link, by name or id. The server copies its current graph in (fresh ids) and adds its environments' missing variables to this scenario. Re-send it to re-sync. |\n| `referencedScenarioId` | string | — | yes | Stored form. With `nodes: []` the server fills the snapshot (and the fields below) from that scenario. |\n| `referencedScenarioVersion` | integer \\| null | — |  | Stored form; filled by the server. |\n| `referencedScenarioName / lastSyncedAt` | string | — |  | Stored form; filled by the server. |\n| `nodes / edges` | stored node[] / stored edge[] | — |  | The snapshot. Send `[]` to have it filled; a non-empty snapshot (as read) is kept as is. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry (engine) |  | See Execution policy. |\n\nOutput: Its inner nodes publish under their own labels — mind label clashes with this scenario's own nodes.\n\nThe linked scenario must be in the same workspace and readable by you. A scenario cannot link itself, nor a scenario whose graph links it back.\n\n```json\n{\"id\":\"setup\",\"type\":\"scenario-ref\",\"label\":\"Setup\",\"config\":{\"scenario\":\"Shared login setup\"}}\n```\n\n## Graph rules\n\nRejected on save:\n- Node ids unique; edge ids unique; every edge's source and target is an existing node id.\n- `yes` / `no` edges only leave a condition node; `error` edges only leave a non-condition node; omit `type` (or `default`) for normal flow.\n- A condition node has exactly two outgoing edges: one `yes`, one `no`.\n- At least one start node (a node with no incoming edge) and no cycles — loop with an end node's `loop` settings, never with a back edge.\n- foreach / subscenario / scenario-ref bodies are checked with the same rules.\n\nSaved with a warning: more than one start node; nodes no start node reaches.\n",
+    "scenario-nodes": "<!-- GENERATED FILE — do not edit by hand. Source: callman_core (npm run ai:packs). -->\n\n# Scenario node reference\n\nA scenario is a directed graph: nodes do the work, edges decide what runs next. This reference is for clients that write scenarios through the API or an MCP tool; every rule below is what the server enforces on save or what the run engine does.\n\n## Scenario shape\n\nCompact form (what the MCP scenario tools take):\n\n```json\n{\n  \"name\": \"Order flow\",\n  \"description\": \"optional\",\n  \"priority\": \"high\",\n  \"nodes\": [\n    {\n      \"id\": \"login\",\n      \"type\": \"request\",\n      \"label\": \"Login\",\n      \"config\": {\n        \"method\": \"POST\",\n        \"url\": \"{{env.baseUrl}}/login\"\n      }\n    },\n    {\n      \"id\": \"done\",\n      \"type\": \"end\",\n      \"label\": \"Done\"\n    }\n  ],\n  \"edges\": [\n    {\n      \"source\": \"login\",\n      \"target\": \"done\"\n    }\n  ],\n  \"environments\": [\n    {\n      \"name\": \"Default\",\n      \"variables\": [\n        {\n          \"key\": \"baseUrl\",\n          \"value\": \"https://api.example.com\"\n        }\n      ]\n    }\n  ]\n}\n```\n\n- Node `{ id?, type, label?, config?, position? }`. `id` defaults to n1, n2, …; when `position` is omitted the node is placed after the node it is connected from, clear of every existing node.\n- `config` is deep-merged over the type's defaults (the Default column): objects merge key by key, arrays and scalars replace the default whole. Send only what you change — but an array you send (headers, checks, steps, rules, assignments) must be complete.\n- Edge `{ id?, source, target, type? }`, `type` = `default` (or omitted) | `yes` | `no` | `error`. Edges have no label.\n- `priority`: critical | high | medium | low. `environments[].variables`: `{ key, value, enabled? }[]`.\n- Stored form (the REST API, and the body of `foreach` / `subscenario` / `scenario-ref`): node `{ id, type, position: { x, y }, data: { label, config } }` with the COMPLETE config — nothing is merged — and edge `{ id, source, target, type? }` with a required `id`.\n\nReq column: **yes** = rejected on save without a real value; **run** = saved, but the run fails without it. Default \"(engine)\" = applied at run time when the field is absent.\n\n## Connections\n\ndb, redis, kafka, notification, ai and temporal nodes run on a workspace connection: `config.connectionId` is the id of a connection of type `database`, `redis`, `kafka`, `notification` (Slack), `ai` (managed) or `temporal` (a Temporal.io cluster / Temporal Cloud namespace). Use a real connection id from the workspace — never invent one. Only the ai node rejects an empty id on save; the others save with `\"\"` and fail when run.\n\n## Labels\n\n- `label` names a node's output: later nodes read `{{Label.path}}`. It is optional on save, but an unlabelled node's output cannot be referenced.\n- Labels must be unique across the whole scenario, including foreach / subscenario bodies: a repeated label is overwritten by whichever node ran last.\n- Reserved labels — the engine drops the output of a node labelled `workflow`, `__meta`, `loop`, `loops`, `item`, `each`, `eaches`, `ws`, so references to it resolve to empty without any error.\n- Avoid labels that are built-in roots — `response`, `lastResponse`, `data`, `env`, `global`, `globals`, `db`, `redis`, `kafkaEvent`, `kafkaevent` — the node and the root shadow each other.\n- Prefer identifier labels (`Login`, `CreateOrder`, `check_db`). Script nodes get a label as a global variable only when it is an identifier and not a sandbox name (`pm`, `env`, `console`, `request`, `response`, `test`, `expect`, `workflow`, `db`, `kafka`, `redis`, …).\n\n## Templates and outputs\n\n- `{{env.KEY}}` / `{{global.KEY}}` read one scope; a bare `{{KEY}}` reads both (in scenario runs a global wins when both define KEY). `{{data.column}}` is the current dataset row.\n- `{{Label.path}}` (or `{Label.path}`) reads an earlier node's output; arrays by index (`items[0].id`), no wildcards. `{{response.*}}` is the most recent request's response. Generators: `{{$randomUUID}}`, `{{$timestamp}}`, `{{random.email}}`, `{{counter}}`.\n- Substitution is plain text — quote SQL strings yourself (`WHERE id = '{{userId}}'`). A missing value resolves to an empty string.\n- A request's output: `<Label>.status` is the HTTP status (number). Read body fields through `<Label>.body.<path>`: top-level body keys are also spread onto the output, but `status`, `statusText`, `data`, `body`, `rawBody`, `text`, `headers`, `cookies`, `durationMs` are HTTP metadata and win over same-named body keys. `<Label>.data.<path>` reads a body's top-level `data`.\n- Operand paths (rules, `foreach.itemsPath`, set-vars `source`) are BARE dotted paths without braces: `CreateOrder.body.total`, `CheckOrder.rows[0].status`.\n\n## Rules and operands\n\nShared by condition, assertion, poll, websocket expect steps and `end.loopExitRule`.\n\n- Rule `{ id, type: \"rule\", left, operator, right? }` — `id` and `type: \"rule\"` are required; `right` is required unless the operator is unary.\n- Group `{ id, type: \"group\", operator: \"AND\" | \"OR\", children: [Rule | Group, …] }` with at least one child.\n- Operand `{ mode: \"runtime\" | \"literal\", valueType: \"string\" | \"number\" | \"boolean\" | \"null\" | \"array\", value, extract? }`. runtime: `value` is a bare path. literal: a JSON number for number, true/false for boolean, null for null, a JSON array for array.\n- Binary operators: equals, not_equals, strict_equals, strict_not_equals, greater_than, less_than, greater_or_equal, less_or_equal, between, contains, not_contains, starts_with, ends_with, regex, in, not_in, contains_row, set_equals_unordered. `between` takes [min, max]; `in` / `not_in` an array; `regex` a JS regex source; `contains_row` checks that an array of rows has one matching every key of an object (a JSON-object string literal or a runtime path); `set_equals_unordered` compares two arrays as multisets.\n- Unary operators (no `right`): exists, not_exists, is_empty, not_empty, is_null, not_null.\n- `extract` `{ type: \"jsonpath\" | \"regex\", expression, flags?, group?, select?: \"first\" | \"all\" }` is applied to the resolved value first; a failed extraction behaves as not-exists. JSONPath runs without script evaluation: `$.a.b`, `$['x-id']`, `$.items[*].id`, `$..id` and slices work; filter expressions (`[?(@.x == 1)]`) are rejected — filter in a script node.\n\nExample: `{ \"id\": \"r1\", \"type\": \"rule\", \"left\": { \"mode\": \"runtime\", \"valueType\": \"number\", \"value\": \"CreateOrder.status\" }, \"operator\": \"equals\", \"right\": { \"mode\": \"literal\", \"valueType\": \"number\", \"value\": 201 } }`\n\n## Contract rules\n\nEach rule's `rules` object may use ONLY these keys (omit the rest):\n- common: required(bool), type(string|number|boolean|object|array|null), equals(string|number|bool), notEmpty(bool)\n- number: min,max,greaterThan,lessThan(number); integer,positive,negative,nonZero(bool)\n- string: minLength,maxLength(int); pattern,contains,notContains,startsWith,endsWith(string); caseSensitive(bool); enumValues(array); format(enum)\n- array: minItems,maxItems(int); sorted({order:asc|desc,field?}); unique({mode:whole|byField,fields?})\n- object: requiredKeys,forbiddenKeys(string[]); minProperties,maxProperties(int); strictSchema(bool)\n- format values: email, url, uuid, uuidV1, uuidV4, uuidV7, jwt, base64, base64url, base64Pdf, base64Png, base64Jpeg, base64Gif, base64Webp, base64Image, base64Zip, base64Office, datetime, date, time, ipv4, ipv6, hostname, json, numeric, integer, alpha, alphanumeric, hex, hexColor, slug, semver, objectId, creditCard, phone\n\n## Execution policy\n\nEvery node except condition takes `executionPolicy: { onFailure: \"stop\" | \"continue\", retry: { enabled, maxAttempts (0..100), delayMs (0..3600000), backoffMultiplier? (1..10), maxDelayMs? (0..3600000) }, expectFailure?: { messagePattern? } }` — onFailure and retry.enabled / maxAttempts / delayMs are required when you send the stored form.\n- `maxAttempts` counts every attempt (an enabled retry makes at least 2). Delay before retry n = min(maxDelayMs, delayMs × backoffMultiplier^(n−1)). No policy = stop, no retry.\n- stop: a failure ends the run; continue: the run goes on along the normal edges.\n- `error` edges from the failing node win over both: the run follows them instead of the normal edges (after the retries).\n- How the run ends: `success` only when no node failed. A failure that continued or was routed through an `error` edge marks that node `failed_continued` and the run ends `completed_with_failures` — never `success`. A stop failure ends it `failed`.\n- `expectFailure: { messagePattern? }` turns the node into a negative test (`request`, `db`, `redis`, `kafka`, `websocket`, `script`, `assertion`, `poll`, `ai`, `temporal`, `notification`): an attempt that FAILS with a message matching `messagePattern` (a JS regex, ≤500 chars; omitted = any failure) makes the node succeed — normal edges run, the run can end `success`, and the output is `<Label>.expectedFailure.message`. An attempt that succeeds, or fails with another message, is a failure (retry and onFailure apply as usual, so retry can wait for something to start failing). Use it for absence checks (a Kafka event that must not appear, a poll that must time out, a request that must be refused). On a db node a non-empty `expectError` wins.\n- Example: `\"executionPolicy\": { \"onFailure\": \"stop\", \"retry\": { \"enabled\": false, \"maxAttempts\": 0, \"delayMs\": 0 }, \"expectFailure\": { \"messagePattern\": \"timed out\" } }`.\n- `alwaysRun: true` makes a node a cleanup step: it runs at the end of the run even when an earlier node failed or the run was stopped, unless the run already reached it. With no incoming edge it runs only then, never first. A failing cleanup does not hide the original failure; on an otherwise passing run it ends the run `completed_with_failures`.\n\n## Node types\n\n### request\nOne HTTP call.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `method` | string | `\"GET\"` |  | HTTP verb. |\n| `url` | string (≤10000) | `\"\"` | run | Absolute URL; `{{…}}` allowed. Its own `?query` is used only when `query` has no enabled rows. |\n| `headers` | {key, value, enabled?}[] | `[]` |  | Disabled rows are not sent. A Content-Type row beats the automatic one (formdata always uses the driver's multipart type). |\n| `query` | {key, value, enabled?}[] | `[]` |  |  |\n| `body.mode` | none \\| raw \\| formdata \\| urlencoded | `\"none\"` |  |  |\n| `body.raw` | string | `\"\"` |  | mode raw. JSON text that still parses after templating is sent as JSON. |\n| `body.rawLanguage` | json \\| xml \\| text \\| html | — |  | With no Content-Type header, sets application/json, application/xml, text/plain or text/html (json when absent). |\n| `body.formEntries` | {key, value, enabled?, type?, fixtureId?, fileName?}[] | `[]` |  | formdata / urlencoded rows. A `type:\"file\"` row needs `fixtureId` (an uploaded workspace fixture file) — server runs fail it otherwise. |\n| `auth.type` | none \\| bearer \\| basic \\| apikey \\| oauth2 | `\"none\"` |  |  |\n| `auth.bearerToken` | string | `\"\"` |  | bearer → `Authorization: Bearer <token>`. |\n| `auth.basicUsername / auth.basicPassword` | string | `\"\"` |  | basic → base64 `user:password`. |\n| `auth.apiKeyKey / auth.apiKeyValue` | string | `\"\"` |  | apikey → sends `key: value`; skipped when the key is blank. |\n| `auth.apiKeyLocation` | header \\| query | `\"header\"` |  |  |\n| `auth.oauth2` | {grantType, tokenUrl, clientId, clientSecret, scope, username, password, refreshToken, clientAuth, audience} | — |  | oauth2: when present ALL ten keys are required (send \"\" for unused ones); grantType client_credentials \\| password \\| refresh_token; clientAuth basic \\| body. The token is fetched (and cached) before the call and sent as a Bearer header. Without it, type oauth2 sends no Authorization. |\n| `preRequestScript / postResponseScript / testsScript` | string | `\"\"` |  | `pm.*` scripts: before the call / after the response / assertions (`pm.test`). |\n| `contractAssertions` | {id, path, enabled, rules, engine?, namespaces?}[] (≤200) | `[]` |  | id, path, enabled and rules are required; `rules` needs ≥1 key (see Contract rules). `path` is a dot-path over the parsed body (`data.items[0].id`, `items[].id` = every element); with engine \"xpath\" it is an XPath over the raw XML and every prefix must be in `namespaces` {prefix: uri}. |\n| `expectedStatus` | string (≤200) | — |  | Negative testing: `\"201\"`, `\"4xx\"`, `\"200-299\"`, `\"200,204\"`, templates allowed. When set the node passes iff the status matches (instead of 2xx/3xx); contract assertions and test scripts can still fail it. |\n| `responseSchema` | JSON Schema object | — |  | Validated against the response body; a mismatch fails the node. |\n| `clientCertificate` | {enabled, format, pfxBase64?, certPem?, keyPem?, passphrase?, caPem?, rejectUnauthorized?} | — |  | mTLS. enabled and format (\"pfx\" \\| \"pem\") are required; pfx uses pfxBase64, pem uses certPem + keyPem. Server runs present the certificate whenever this object is set — omit it to send none. |\n| `soap` | {enabled, version, action?, wsSecurity?} | — |  | version \"1.1\" \\| \"1.2\". Keep the full envelope in body.raw (rawLanguage \"xml\"); Content-Type/SOAPAction come from the version (a Content-Type header wins). wsSecurity {enabled, username, password, passwordType: text \\| digest} injects a UsernameToken at send time. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: `<Label>.status` (number), `<Label>.body.<path>`, `<Label>.headers`, `<Label>.text`, `<Label>.durationMs`. The most recent request is also `response.*`.\n\n```json\n{\"id\":\"login\",\"type\":\"request\",\"label\":\"Login\",\"config\":{\"method\":\"POST\",\"url\":\"{{env.baseUrl}}/login\",\"body\":{\"mode\":\"raw\",\"raw\":\"{\\\"user\\\":\\\"{{env.user}}\\\",\\\"password\\\":\\\"{{env.password}}\\\"}\",\"rawLanguage\":\"json\"},\"expectedStatus\":\"200\"}}\n```\n\n### db\nOne query on a workspace connection of type `database`.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `connectionId` | string | `\"\"` | run | `\"\"` = not chosen yet: saved, but the run fails. |\n| `query` | string (1..100000) | `\"SELECT *\\nFROM users\\nWHERE id = {{env.userId}}\"` | yes | Mongo: a command object as MongoDB Extended JSON (relaxed) text (`{\"collection\":\"orders\",\"operation\":\"findOne\",\"filter\":{…}}`) — `{\"$date\":\"2026-01-01T00:00:00Z\"}`, `{\"$oid\":\"…\"}`, `{\"$numberDecimal\":\"9.99\"}` and `{\"$numberLong\":\"…\"}` become real BSON values; plain whole numbers are sent as int32/double (a `$numberLong` beyond 2^53 loses precision). A 24-hex string in `filter` is also matched as an ObjectId. SQL: plain SQL. Per-engine details: the DB query reference. The default is a placeholder — always send your own. |\n| `params` | string[] (≤200) | — |  | Positional binds, template-resolved: `$1` (Postgres), `?` (MySQL), `@p1…` (SQL Server), `:1` (Oracle). |\n| `typedParams` | {value, type?, name?, direction?, typeName?, maxSize?}[] (≤200) | — |  | Wins over params. type auto \\| text \\| int \\| numeric \\| boolean \\| date \\| timestamp \\| json \\| null \\| clob \\| blob \\| cursor \\| object: null binds SQL NULL, boolean a real boolean; on Postgres/MySQL/SQL Server the rest stay strings (cast in SQL), Oracle binds them natively. name: `:name` on Oracle, `@name` on SQL Server; on Postgres/MySQL values stay positional and the name labels the output. direction in \\| out \\| inout: OUT values come back in `<Label>.out.<name>`, a `cursor` as its array of rows. Postgres OUT reads the returned row's column; MySQL OUT is the session variable `@name` (`CALL p(?, @name)`). object: JSON value, `typeName` is the database type (\"HR.PKG.T_IDS\"). |\n| `useSession` | boolean | — |  | Any SQL engine: join the run's shared connection, so package state, temp tables and session variables survive between nodes (scenario-level `dbSettings.transactionMode`: none \\| rollback \\| commit). A procedure that COMMITs itself cannot be rolled back: pair it with an `executionPolicy.alwaysRun` cleanup node. |\n| `expectError` | {sqlState?, messagePattern?} | — |  | Negative test: the node passes only if the query FAILS with that code and/or a message matching the regex. `sqlState` takes a SQLSTATE (P0001) or the engine's own code (ORA-20001, MSSQL-50000, ER_SIGNAL_EXCEPTION). |\n| `captureOutput` | boolean | — |  | Collect the server's messages into `<Label>.output` (string[]): DBMS_OUTPUT on Oracle, RAISE NOTICE on Postgres, PRINT on SQL Server. |\n| `timeoutMs` | number (ms, ≤3600000) | — |  | Time limit of this statement, for long batch procedures; the statement is cancelled on the server. Absent = the host's node limit. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: `<Label>.rows`, `<Label>.rowCount`, `<Label>.out.<name>` (OUT / IN OUT / function results), `<Label>.output` (server messages), `<Label>.resultSets` (multi-result statements); the rows are also `db.result`. A procedure with no rows of its own and one cursor reads as `rows` too. With `expectError` met: `<Label>.expectedError` {sqlState, code, message}, rows empty.\n\n```json\n{\"id\":\"check\",\"type\":\"db\",\"label\":\"CheckOrder\",\"config\":{\"connectionId\":\"<database connection id>\",\"query\":\"SELECT status FROM orders WHERE id = $1\",\"params\":[\"{{CreateOrder.body.id}}\"]}}\n```\n\n### redis\nRedis commands on a workspace connection of type `redis`.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `connectionId` | string | `\"\"` | run |  |\n| `commands` | string[] (≤1000, each non-empty) | `[]` | run | One command per entry, template-resolved. Supported: GET, SET, DEL, EXISTS, TTL, HGET, HSET, HGETALL, HDEL, LPUSH, RPUSH, LRANGE, LLEN, SADD, SMEMBERS, SISMEMBER, INCR, DECR, INCRBY, EXPIRE, PERSIST, TYPE, ZADD, ZRANGE, ZSCORE, SCAN. `SCAN pattern [count]` returns {keys, count, truncated}. An empty list fails the run. |\n| `executionPolicy` | ExecutionPolicy | continue, retry ×2 every 1000 ms |  | See Execution policy. |\n\nOutput: The reply (one command) or an array of replies, as `<Label>` and `redis.result`.\n\n```json\n{\"id\":\"cache\",\"type\":\"redis\",\"label\":\"Cache\",\"config\":{\"connectionId\":\"<redis connection id>\",\"commands\":[\"GET order:{{CreateOrder.body.id}}\"]}}\n```\n\n### kafka\nConsume (wait for a matching message) or publish, on a connection of type `kafka`.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `connectionId` | string | `\"\"` | run |  |\n| `topic` | string (1..500) | `\"\"` | yes |  |\n| `mode` | consume \\| publish | `\"consume\"` |  |  |\n| `matchMode` | regex \\| rules | `\"regex\"` |  | consume. The default is regex — when you write comparisons, set `\"rules\"` or rules[0] is read as a regex. |\n| `rules` | string[] | `[]` |  | consume. regex: rules[0] is a regex tested against the whole message. rules: every entry is ONE comparison `left op right` (op ==, !=, ===, !==, >, <, >=, <=, contains) and all must hold, e.g. `kafkaEvent.orderId == '{{CreateOrder.body.id}}'`. Empty = the first message captured (the node stops listening at that message). |\n| `captureTimeoutMs` | integer 1000..120000 | 5000 (engine) |  | consume. How long ONE attempt listens; capped by the host's per-node timeout (60 s on a default server). Retry multiplies it. |\n| `publishValueFormat` | json \\| raw | `\"json\"` |  | publish. json fails the node when messageValue is not valid JSON after templating. |\n| `messageKey` | string | `\"\"` |  | publish. |\n| `messageValue` | string (≤1000000) | `\"\"` |  | publish payload, template-resolved. |\n| `messageHeaders` | {key, value, enabled?}[] | `[]` |  | publish. |\n| `executionPolicy` | ExecutionPolicy | continue, retry ×3 every 2000 ms |  | See Execution policy. |\n\nOutput: consume: the matched message — a JSON-object message's keys at the top level plus `meta` {value, text, key, topic, partition, offset, timestamp, headers}; any other message (array, number, text) has those fields at the top level instead, without `meta`. Also `kafkaEvent.*`. publish: {topic, partition, offset, timestamp}.\n\n**Where consuming starts.** A consume node sees records whose Kafka timestamp is at or after the scenario run's start — messages produced before the run are never seen, messages produced earlier in the same run (by a publish node or by the system under test) are. Timestamps are the producer's clock, so allow for skew. Messages from earlier loop iterations or foreach items of the same run can match too — make the rules specific (an id from this iteration).\n\n**How long it waits.** One attempt listens for `captureTimeoutMs` (default 5000 ms) and stops early at the first matching message. The default executionPolicy is continue with retry ×3 every 2000 ms, so a node waits about 3 × 5 s + 2 × 2 s ≈ 19 s in total before failing. For a slow consumer raise `captureTimeoutMs` (and/or retry) rather than adding wait nodes.\n\n**How rules read the message.** Rules are evaluated against the event shape above, NOT with JSONPath: each side is a plain dotted path (`kafkaEvent.orderId`, `kafkaEvent.meta.headers.traceparent`, `kafkaEvent.items[0].sku`) or a template. Header and key names with dashes work as plain dotted paths: `kafkaEvent.meta.headers.x-correlation-id == '{{CorrId}}'`. Brackets (`headers['x-id']`) and `$.` paths are not resolved — they compare as literal text and never match. A path segment that contains an operator word (`x-contains-id`) splits the rule at that word; avoid it or read it in a script node. Headers are UTF-8 strings; a header repeated on one record is joined with `, `. A topic, partition or offset is under `meta` (`kafkaEvent.meta.offset` is a string).\n\n**Expecting no message.** A consume node FAILS when nothing matches in time. To assert that an event is NOT published, give the node `executionPolicy.expectFailure: {}` (see Execution policy) — the timeout then counts as success.\n\n```json\n{\"id\":\"event\",\"type\":\"kafka\",\"label\":\"OrderCreated\",\"config\":{\"connectionId\":\"<kafka connection id>\",\"topic\":\"orders\",\"mode\":\"consume\",\"matchMode\":\"rules\",\"rules\":[\"kafkaEvent.orderId == '{{CreateOrder.body.id}}'\"]}}\n```\n\n### condition\nThe only branching node and the only node without `executionPolicy`. Needs exactly two outgoing edges: one `yes`, one `no`.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `mode` | builder \\| expert | `\"builder\"` |  |  |\n| `rootGroup` | Group | one rule: `response.status` equals `200` |  | Evaluated in builder mode (see Rules and operands). Stored in both modes. |\n| `expertExpression` | string \\| null | `\"{{response.status}} == 200\"` |  | Used ONLY with `mode: \"expert\"` (ignored otherwise). Syntax below. |\n\nOutput: Takes the `yes` or `no` edge.\n\nExpert syntax: operands are `{{path}}` tokens (a bare path is a parse error), 'single'- or \"double\"-quoted strings, numbers, true / false / null and [arrays]; operators ==, !=, ===, !==, >, <, >=, <=, contains, not contains, starts with, ends with, regex, in, not in, between, exists, not exists, is empty, not empty, is null, not null, contains row, set equals; combine with && / AND, || / OR and parentheses. Example: `{{Login.status}} == 200 && {{Login.body.token}} != ''`.\n\n```json\n{\"id\":\"ok\",\"type\":\"condition\",\"label\":\"LoggedIn\",\"config\":{\"mode\":\"builder\",\"rootGroup\":{\"id\":\"g1\",\"type\":\"group\",\"operator\":\"AND\",\"children\":[{\"id\":\"r1\",\"type\":\"rule\",\"left\":{\"mode\":\"runtime\",\"valueType\":\"number\",\"value\":\"Login.status\"},\"operator\":\"equals\",\"right\":{\"mode\":\"literal\",\"valueType\":\"number\",\"value\":200}}]}}}\n```\n\n### assertion\nPass/fail checkpoint; does not branch (on failure the execution policy decides).\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `matchMode` | all \\| any | `\"all\"` |  |  |\n| `checks` | {id, name, enabled, rule}[] (≤1000) | one blank check | run | id, name (may be \"\"), enabled and rule are required; `rule` is a full Rule. With no enabled check the node passes without testing anything — send at least one. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: `<Label>.passed`, `.passedCount`, `.failedCount`, `.checks[i]` {name, passed, message}.\n\n```json\n{\"id\":\"verify\",\"type\":\"assertion\",\"label\":\"VerifyOrder\",\"config\":{\"checks\":[{\"id\":\"c1\",\"name\":\"total is 40\",\"enabled\":true,\"rule\":{\"id\":\"c1r\",\"type\":\"rule\",\"left\":{\"mode\":\"runtime\",\"valueType\":\"number\",\"value\":\"CreateOrder.body.total\"},\"operator\":\"equals\",\"right\":{\"mode\":\"literal\",\"valueType\":\"number\",\"value\":40}}}]}}\n```\n\n### script\nJavaScript in the `pm.*` sandbox.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `script` | string (≤1000000) | `\"return {\\n  ok: true,\\n};\"` | run | Its `return` value is the node's output. Can `pm.environment.set`, `pm.test`, `await pm.db.query(…)` / `pm.redis.command(…)`. Empty or invalid code fails the run. |\n| `timeoutMs` | integer 1..60000 | `3000` |  | Also capped by the host's per-node timeout. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: The returned value (`<Label>.<key>` for an object).\n\n```json\n{\"id\":\"calc\",\"type\":\"script\",\"label\":\"Totals\",\"config\":{\"script\":\"const body = CreateOrder.body;\\nreturn { total: body.total * 2 };\"}}\n```\n\n### set-vars\nWrite environment/global variables without a script. Rows apply top to bottom (a row sees earlier rows' writes).\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `assignments` | Assignment[] (≤200) | one blank row |  |  |\n| `assignments[].id / .key / .value` | string | — | yes | key and value are template-resolved; value may be \"\". |\n| `assignments[].scope` | environment \\| global | — | yes |  |\n| `assignments[].enabled` | boolean | — | yes |  |\n| `assignments[].extractorType` | template \\| jsonpath \\| regex | — |  | jsonpath / regex: resolve `source` (a bare runtime path such as `CreateOrder.body`), then apply `expression` (JSONPath like `$.items[0].id`, or a JS regex source); `value` is ignored. Regex rows take `flags` (subset of gimsuy) and `group`; `select` first \\| all (all writes a JSON array). A failed extraction skips that write. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: `<Label>.environment` / `<Label>.globals` (what was written), `<Label>.extraction` for extractor rows.\n\n```json\n{\"id\":\"save\",\"type\":\"set-vars\",\"label\":\"SaveOrderId\",\"config\":{\"assignments\":[{\"id\":\"a1\",\"scope\":\"environment\",\"key\":\"orderId\",\"value\":\"{{CreateOrder.body.id}}\",\"enabled\":true}]}}\n```\n\n### poll\nRepeat ONE embedded action until a condition passes or the budget runs out. Retry is forced off (the loop is the retry); a failing tick is retried, not fatal.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `actionType` | request \\| db \\| redis \\| script | `\"request\"` |  |  |\n| `request / db / redis / script` | that node type's config | request: the request defaults | run | The one matching actionType. Same fields as the standalone node. |\n| `successCondition` | {mode, rootGroup, expertExpression?} | `response.status` equals `200` |  | Evaluated after every successful tick. A tick publishes like the real node: request → `response.*`, db → `db.result` (rows), redis → `redis.result`; a script tick exposes only its variable writes (`env.*`, `global.*`). |\n| `intervalMs` | integer 0..3600000 | `2000` |  |  |\n| `maxAttempts` | integer 1..1000 | `30` |  |  |\n| `timeoutMs` | integer 1..86400000 | — |  | Wall-clock cap. |\n| `backoffMultiplier` | number 1..10 | — |  | Exponential backoff on the interval. |\n| `maxDelayMs` | integer 0..3600000 | — |  | Backoff cap. |\n| `onTimeout` | fail \\| continue | `\"fail\"` |  | continue marks the node degraded and goes on. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: `<Label>.attempts`, `.elapsedMs`, `.timedOut`, `.conditionResult`, `.lastTickError`; the last tick's result as listed above.\n\n```json\n{\"id\":\"wait-ready\",\"type\":\"poll\",\"label\":\"WaitReady\",\"config\":{\"actionType\":\"request\",\"request\":{\"url\":\"{{env.baseUrl}}/orders/{{CreateOrder.body.id}}\"},\"successCondition\":{\"mode\":\"expert\",\"expertExpression\":\"{{response.body.status}} == 'READY'\"},\"intervalMs\":2000,\"maxAttempts\":15}}\n```\n\n### foreach\nRun an embedded body graph once per item of an array.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `nodes / edges` | stored node[] / stored edge[] | `[]` |  | The body graph in the STORED form with complete configs (see Scenario shape) — no defaults are merged inside. Same graph rules; labels unique across the whole scenario. |\n| `sourceMode` | path \\| inline | `\"path\"` |  |  |\n| `itemsPath` | string (≤2000) | — | run | path mode: a bare runtime path to an array, e.g. `Users.body.items`. |\n| `itemsInline` | string | — | run | inline mode: JSON array text; templates resolve first. |\n| `itemAlias` | string (≤100) | — |  | Extra root mirroring `{{item}}` (e.g. `user` → `{{user.id}}`). Not a reserved label. |\n| `maxIterations` | integer 1..1000 | 100 (engine) |  |  |\n| `delayMs` | integer 0..3600000 | — |  | Pause between items. |\n| `onItemFailure` | stop \\| continue | `\"stop\"` |  | continue: failed items degrade the run, the loop goes on. |\n| `collectResults` | boolean | `true` |  |  |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: `<Label>.results[i].<ChildLabel>…`, `.itemCount`, `.processedCount`, `.truncated`, `.failedItems`. Inside the body: `{{item}}`, `{{each.index}}` (0-based), `{{each.iteration}}` (1-based), `{{each.total}}`, `{{each.remaining}}`, `{{eaches.<ForeachLabel>.iteration}}` for an outer loop.\n\n```json\n{\"id\":\"each-user\",\"type\":\"foreach\",\"label\":\"EachUser\",\"config\":{\"sourceMode\":\"path\",\"itemsPath\":\"Users.body.items\",\"itemAlias\":\"user\",\"nodes\":[{\"id\":\"get-user\",\"type\":\"request\",\"position\":{\"x\":0,\"y\":0},\"data\":{\"label\":\"GetUser\",\"config\":{\"method\":\"GET\",\"url\":\"{{env.baseUrl}}/users/{{user.id}}\",\"headers\":[],\"query\":[],\"body\":{\"mode\":\"none\",\"raw\":\"\",\"formEntries\":[]}}}}],\"edges\":[]}}\n```\n\n### websocket\nOne WebSocket conversation: connect, run the steps in order, close. Retry re-runs the whole conversation.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `url` | string (≤2000) | `\"\"` | run | ws:// or wss://, template-resolved. |\n| `headers` | {key, value, enabled?}[] (≤100) | `[]` |  |  |\n| `subprotocols` | string[] (≤20) | `[]` |  |  |\n| `connectTimeoutMs` | integer 100..120000 | 10000 (engine) |  |  |\n| `steps` | Step[] (≤200) | `[]` |  | {id, kind:\"send\", payload} sends one text frame; {id, kind:\"expect\", rules (1..50 Rules), timeoutMs? (100..300000, default 10000), matchMode? all \\| any} waits for a matching frame — rule paths use `ws.text`, `ws.json.<path>`, `ws.direction`, `ws.index`; {id, kind:\"wait\", durationMs (0..300000)}. A timed-out expect fails the node. |\n| `closeCode` | integer 1000..4999 | 1000 (engine) |  |  |\n| `rejectUnauthorized` | boolean | — |  | false accepts self-signed certificates. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: `<Label>.connected`, `.messages[i].text`, `.messageCount`, `.failedSteps`, `.closeCode`.\n\n```json\n{\"id\":\"ws\",\"type\":\"websocket\",\"label\":\"Subscribe\",\"config\":{\"url\":\"wss://stream.example.com/orders\",\"steps\":[{\"id\":\"s1\",\"kind\":\"send\",\"payload\":\"{\\\"subscribe\\\":\\\"orders\\\"}\"},{\"id\":\"s2\",\"kind\":\"expect\",\"rules\":[{\"id\":\"s2r\",\"type\":\"rule\",\"left\":{\"mode\":\"runtime\",\"valueType\":\"string\",\"value\":\"ws.json.event\"},\"operator\":\"equals\",\"right\":{\"mode\":\"literal\",\"valueType\":\"string\",\"value\":\"subscribed\"}}]}]}}\n```\n\n### ai\nOne LLM call on a managed workspace connection of type `ai`.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `connectionId` | string (1..200) | `\"\"` | yes | The default `\"\"` is rejected on save. |\n| `prompt` | string (≤200000) | `\"\"` | run | Template-resolved; empty fails the run. |\n| `responseExample` | string (≤20000) | `\"\"` | run | A JSON OBJECT as text; its top-level keys are required in the reply (extra keys allowed). |\n| `maxTokens` | integer 1..32000 | 2000 (engine) |  |  |\n| `timeoutMs` | integer 1000..300000 | 60000 (engine) |  |  |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: The parsed JSON reply: `<Label>.<exampleKey>`.\n\n```json\n{\"id\":\"classify\",\"type\":\"ai\",\"label\":\"Classify\",\"config\":{\"connectionId\":\"<ai connection id>\",\"prompt\":\"Classify the sentiment of: {{GetReview.body.text}}\",\"responseExample\":\"{\\\"sentiment\\\":\\\"positive\\\",\\\"score\\\":0.9}\"}}\n```\n\n### temporal\nOne Temporal.io client operation (start / signal / query / update / await / describe / history / cancel / terminate / list / count / describeTaskQueue) on a workspace connection of type `temporal`.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `connectionId` | string | `\"\"` | run | A connection of type `temporal`. |\n| `operation` | \"startWorkflow\" \\| \"signal\" \\| \"signalWithStart\" \\| \"query\" \\| \"update\" \\| \"awaitResult\" \\| \"describe\" \\| \"history\" \\| \"cancel\" \\| \"terminate\" \\| \"list\" \\| \"count\" \\| \"describeTaskQueue\" | `\"describe\"` | yes | Required fields per operation: startWorkflow → workflowType + taskQueue; signal → workflowId + signalName; signalWithStart → workflowId + workflowType + taskQueue + signalName; query → workflowId + queryName; update → workflowId + updateName; awaitResult → workflowId; describe → workflowId; history → workflowId; cancel → workflowId; terminate → workflowId; list → query; count → query; describeTaskQueue → taskQueue. |\n| `namespace` | string | — |  | Overrides the connection's namespace. Template-resolved. |\n| `workflowId` | string | `\"\"` |  | Template-resolved. On startWorkflow an empty id is generated (`callman-<label>-<uuid>`). |\n| `runId` | string | — |  | Optional everywhere; empty = the latest run. |\n| `workflowType` | string | — |  | startWorkflow / signalWithStart. |\n| `taskQueue` | string | — |  | startWorkflow / signalWithStart / describeTaskQueue. |\n| `args` | string (JSON array) | `\"\"` |  | Workflow / signal / query / update arguments as a JSON ARRAY template string, e.g. `\"[{\\\"orderId\\\":\\\"{{CreateOrder.body.id}}\\\"}]\"`. A bare value is wrapped as one argument. |\n| `waitForResult` | boolean | — |  | startWorkflow: block until the workflow closes; `result` / `status` / `failure` are filled. |\n| `idReusePolicy` | \"ALLOW_DUPLICATE\" \\| \"ALLOW_DUPLICATE_FAILED_ONLY\" \\| \"REJECT_DUPLICATE\" \\| \"TERMINATE_IF_RUNNING\" | — |  |  |\n| `idConflictPolicy` | \"FAIL\" \\| \"USE_EXISTING\" \\| \"TERMINATE_EXISTING\" | — |  | `USE_EXISTING` makes startWorkflow attach to an already-running workflow instead of failing. |\n| `memo` | string (JSON object) | — |  |  |\n| `searchAttributes` | string (JSON object) | — |  |  |\n| `workflowExecutionTimeoutMs` | integer | — |  |  |\n| `workflowRunTimeoutMs` | integer | — |  |  |\n| `workflowTaskTimeoutMs` | integer | — |  |  |\n| `startDelayMs` | integer | — |  |  |\n| `retryPolicy` | {maximumAttempts?, initialIntervalMs?, backoffCoefficient?, maximumIntervalMs?} | — |  |  |\n| `signalName` | string | — |  | signal / signalWithStart. |\n| `signalArgs` | string (JSON array) | — |  | signalWithStart: the signal's arguments (`args` are the start arguments). |\n| `queryName` | string | — |  |  |\n| `updateName` | string | — |  |  |\n| `waitForStage` | \"COMPLETED\" \\| \"ACCEPTED\" | \"COMPLETED\" (engine) |  | update: ACCEPTED returns as soon as the update is admitted (`updateId`). |\n| `followRuns` | boolean | true (engine) |  | awaitResult: follow continue-as-new / retried runs to the final result. |\n| `eventTypes` | string[] | — |  | history: keep only these event types in `events[]` (names like \"ActivityTaskCompleted\"); counts cover the whole history. |\n| `historyLimit` | integer 1..2000 | 500 (engine) |  | history: max events kept (the LAST N); `truncatedHistory` says when it cut. |\n| `reason` | string | — |  | cancel / terminate. |\n| `query` | string | — |  | list / count: a Temporal visibility list filter, e.g. `WorkflowType = 'OrderWorkflow' AND ExecutionStatus = 'Running'` (`GROUP BY ExecutionStatus` allowed on count). |\n| `pageSize` | integer 1..500 | 50 (engine) |  |  |\n| `taskQueueType` | \"workflow\" \\| \"activity\" | \"workflow\" (engine) |  |  |\n| `timeoutMs` | integer 1000..600000 | 60000 (engine) |  | Still capped by the host's per-node budget. A long awaitResult needs a raised node timeout or a poll node (actionType `temporal`). |\n| `onTimeout` | \"fail\" \\| \"continue\" | \"fail\" (engine) |  | awaitResult / startWorkflow+waitForResult: `continue` marks the step partial_success with `timedOut: true` instead of failing. |\n| `expect` | ConditionRule[] | `[]` |  | Checks against the node's OWN output (operand paths `<Label>.status`, `<Label>.result.x`, `<Label>.eventCounts.ActivityTaskFailed`; `temporal.<path>` also works). A failed check fails the node. |\n| `expectMatchMode` | \"all\" \\| \"any\" | `\"all\"` |  |  |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: Always the same keys (null / [] when not applicable): `<Label>.workflowId`, `.runId`, `.status` (RUNNING | COMPLETED | FAILED | CANCELED | TERMINATED | TIMED_OUT | CONTINUED_AS_NEW), `.result` (awaitResult / query / update / start+wait), `.failure` `{message, type, cause[]}`, `.workflowType`, `.taskQueue`, `.startTime`, `.closeTime`, `.historyLength`, `.memo`, `.searchAttributes`, `.activities[]` `{activityType, status, attempt, durationMs, failure}`, `.pendingChildren[]`, `.events[]` `{eventId, eventType, eventTime, attributes}`, `.eventCounts` `{ActivityTaskCompleted: 3, …}`, `.signals[]`, `.timers[]`, `.truncatedHistory`, `.executions[]` `{workflowId, runId, type, status}`, `.count`, `.groups[]`, `.pollers[]`, `.hasPollers`, `.updateId`, `.requested`, `.timedOut`, `.durationMs`.\n\nA workflow that FAILED / was CANCELED is a result, not a node failure: `status` and `failure` are filled and the run goes on. Fail the node with an `expect` rule (`<Label>.status equals COMPLETED`) or `executionPolicy.expectFailure` for infrastructure errors.\n\nInfrastructure errors fail the node: unreachable server (UNAVAILABLE), rejected credentials (UNAUTHENTICATED), unknown workflow (`Workflow not found: <id>`), rejected update, `WorkflowExecutionAlreadyStartedError` (unless `idConflictPolicy: USE_EXISTING`).\n\nTypical chain: request → temporal describe `{{Req.body.workflowId}}` → signal → awaitResult (expect status COMPLETED) → history (expect eventCounts.ActivityTaskFailed equals 0).\n\nPayloads use Temporal's default data converter (JSON). A payload it cannot decode is kept as `{encoding, data}` (base64).\n\n```json\n{\"id\":\"await-order\",\"type\":\"temporal\",\"label\":\"AwaitOrder\",\"config\":{\"connectionId\":\"<temporal connection id>\",\"operation\":\"awaitResult\",\"workflowId\":\"order-{{CreateOrder.body.id}}\",\"timeoutMs\":60000,\"expect\":[{\"id\":\"r1\",\"type\":\"rule\",\"left\":{\"mode\":\"runtime\",\"valueType\":\"string\",\"value\":\"AwaitOrder.status\"},\"operator\":\"equals\",\"right\":{\"mode\":\"literal\",\"valueType\":\"string\",\"value\":\"COMPLETED\"}}]}}\n```\n\n### wait\nFixed delay.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `durationMs` | integer 1..2147483647 | `5000` |  |  |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: `<Label>.configuredDurationMs`, `.actualDurationMs`, `.status`.\n\n```json\n{\"id\":\"pause\",\"type\":\"wait\",\"label\":\"Pause\",\"config\":{\"durationMs\":1000}}\n```\n\n### notification\nSlack message through a workspace connection of type `notification`.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `provider` | \"slack\" | `\"slack\"` |  |  |\n| `connectionId` | string | `\"\"` | run |  |\n| `severity` | info \\| success \\| warning \\| error | `\"info\"` |  |  |\n| `messageTemplate` | string (≤100000) | a run-status line |  | Template-resolved (node outputs, `{{workflow.name}}`, `{{workflow.__meta.status}}` …). |\n| `channelOverride` | string (≤500) | `\"\"` |  |  |\n| `continueOnFailure` | boolean | `true` |  | Overrides executionPolicy.onFailure (true = continue). |\n| `advanced.useRichBlocks` | boolean | `true` |  |  |\n| `executionPolicy` | ExecutionPolicy | continue, no retry |  | See Execution policy. |\n\nOutput: The delivery result.\n\n```json\n{\"id\":\"notify\",\"type\":\"notification\",\"label\":\"Notify\",\"config\":{\"connectionId\":\"<notification connection id>\",\"severity\":\"warning\",\"messageTemplate\":\"Order {{CreateOrder.body.id}} is not ready\"}}\n```\n\n### aggregator\nBuild one JSON object from earlier outputs.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `template` | string (≤1000000) | `\"{\\n  \\\"key\\\": \\\"{Label.field}\\\"\\n}\"` | run | Must be valid JSON after templating (`{{Label.path}}` or `{Label.path}` tokens), else the run fails. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: The parsed object: `<Label>.<key>`.\n\n```json\n{\"id\":\"summary\",\"type\":\"aggregator\",\"label\":\"Summary\",\"config\":{\"template\":\"{\\\"orderId\\\":\\\"{{CreateOrder.body.id}}\\\",\\\"status\\\":\\\"{{CheckOrder.rows[0].status}}\\\"}\"}}\n```\n\n### end\nTerminates a path; optionally loops back to an earlier node.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `loop` | boolean | `false` |  |  |\n| `loopTargetNodeId` | string \\| null | `null` | run | loop: the id of an earlier node to jump back to. |\n| `loopIterations` | integer 1..1000 | `1` |  | Re-entries: the looped section runs loopIterations + 1 times. |\n| `loopDelayMs` | integer 0..600000 | `1000` |  |  |\n| `loopExitRule` | Rule \\| null | — |  | Checked after each pass; TRUE stops the loop early and continues along the end node's outgoing edges. Loop roots: `loop.iteration` (1-based), `loop.index`, `loop.total`, `loop.remaining`. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: A snapshot of the run's outputs so far.\n\n```json\n{\"id\":\"again\",\"type\":\"end\",\"label\":\"Repeat\",\"config\":{\"loop\":true,\"loopTargetNodeId\":\"login\",\"loopIterations\":2,\"loopDelayMs\":500}}\n```\n\n### subscenario\nA group of nodes collapsed into one node (the builder's Group).\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `nodes / edges` | stored node[] / stored edge[] | none | yes | Stored form, complete configs; no defaults are merged for this type. Same graph rules. |\n| `reusableGroupId / reusableSourceScenarioId / reusableSourceNodeId / ungroupSnapshot` | app-managed | — |  | Written by the builder; omit them. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry (engine) |  | See Execution policy. |\n\nOutput: Its inner nodes publish under their own labels.\n\n```json\n{\"id\":\"setup\",\"type\":\"subscenario\",\"label\":\"Setup\",\"config\":{\"nodes\":[{\"id\":\"seed\",\"type\":\"wait\",\"position\":{\"x\":0,\"y\":0},\"data\":{\"label\":\"Settle\",\"config\":{\"durationMs\":500}}}],\"edges\":[]}}\n```\n\n### scenario-ref\nLinks another scenario (shared setup / teardown) without copying it by hand: the node embeds a snapshot of the linked scenario's graph, and the run executes that snapshot.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `scenario` | string (compact form only) | — | yes | The scenario to link, by name or id. The server copies its current graph in (fresh ids) and adds its environments' missing variables to this scenario. Re-send it to re-sync. |\n| `referencedScenarioId` | string | — | yes | Stored form. With `nodes: []` the server fills the snapshot (and the fields below) from that scenario. |\n| `referencedScenarioVersion` | integer \\| null | — |  | Stored form; filled by the server. |\n| `referencedScenarioName / lastSyncedAt` | string | — |  | Stored form; filled by the server. |\n| `nodes / edges` | stored node[] / stored edge[] | — |  | The snapshot. Send `[]` to have it filled; a non-empty snapshot (as read) is kept as is. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry (engine) |  | See Execution policy. |\n\nOutput: Its inner nodes publish under their own labels — mind label clashes with this scenario's own nodes.\n\nThe linked scenario must be in the same workspace and readable by you. A scenario cannot link itself, nor a scenario whose graph links it back.\n\n```json\n{\"id\":\"setup\",\"type\":\"scenario-ref\",\"label\":\"Setup\",\"config\":{\"scenario\":\"Shared login setup\"}}\n```\n\n## Graph rules\n\nRejected on save:\n- Node ids unique; edge ids unique; every edge's source and target is an existing node id.\n- `yes` / `no` edges only leave a condition node; `error` edges only leave a non-condition node; omit `type` (or `default`) for normal flow.\n- A condition node has exactly two outgoing edges: one `yes`, one `no`.\n- At least one start node (a node with no incoming edge) and no cycles — loop with an end node's `loop` settings, never with a back edge.\n- foreach / subscenario / scenario-ref bodies are checked with the same rules.\n\nSaved with a warning: more than one start node; nodes no start node reaches.\n",
     "templating": "<!-- GENERATED FILE — do not edit by hand. Source: callman_core (npm run ai:packs). -->\n\n# Template tokens (`{{...}}`)\n\nAnywhere a `{{...}}` is accepted (URLs, headers, bodies, DB queries, Kafka payloads, scenario node configs), substitution is PLAIN TEXT replacement — no quoting, no escaping. Quote SQL strings yourself (`WHERE id = '{{userId}}'`). A missing variable resolves to an empty string.\n\n## Variable lookups\n\n- `{{name}}` — environment → globals lookup.\n- `{{env.name}}` / `{{global.name}}` — forced scope.\n- `{{response.body.<path>}}` — current request's response (request context only; dot-indexed arrays: `items.0.id`).\n- `{{<NodeLabel>.<path>}}` — a prior scenario node's output (scenario context only; bracket-indexed arrays: `rows[0].id`).\n\n## Random generators\n\n| Token | Meaning | Example output |\n| --- | --- | --- |\n| `{{random.email}}` | Random email address | `sam.user42@example.com` |\n| `{{random.string}}` | Random alphanumeric string | `aZ19xPq20LmN` |\n| `{{random.uuid}}` | Random UUID v4 | `1d7fe6b6-6f47-4fa9-b57a-d2e1d285be51` |\n| `{{random.int}}` | Random integer | `48291` |\n| `{{random.bigdecimal}}` | Random decimal number | `1842.552190` |\n| `{{random.boolean}}` | Random boolean | `true` |\n| `{{random.phone}}` | Random phone number | `+15558675309` |\n| `{{random.date(\"YYYY-MM-DD\")}}` | Random date | `2026-04-06` |\n| `{{random.name}}` | Random human name | `Aylin Karimli` |\n\n## Counters\n\n| Token | Meaning | Example output |\n| --- | --- | --- |\n| `{{counter}}` | Incrementing counter per request | `1, 2, 3...` |\n| `{{counter.start(100)}}` | Counter starting at 100 | `100, 101, 102...` |\n\n## Postman-compatible `$` tokens\n\n| Token | Meaning | Example output |\n| --- | --- | --- |\n| `{{$guid}}` | Postman compat — UUID v4 | `1d7fe6b6-6f47-4fa9-b57a-d2e1d285be51` |\n| `{{$randomUUID}}` | Postman compat — UUID v4 | `1d7fe6b6-6f47-4fa9-b57a-d2e1d285be51` |\n| `{{$timestamp}}` | Postman compat — unix seconds | `1718793600` |\n| `{{$isoTimestamp}}` | Postman compat — ISO 8601 | `2026-05-18T10:24:00.123Z` |\n| `{{$randomInt}}` | Postman compat — 0-1000 | `482` |\n| `{{$randomBoolean}}` | Postman compat | `true` |\n| `{{$randomAlphaNumeric}}` | Postman compat — 8 chars | `aZ19xPq2` |\n| `{{$randomHexaDecimal}}` | Postman compat — 0xNNNNNNNN | `0x4f3a1c2d` |\n| `{{$randomString}}` | Postman compat — 12 chars | `aZ19xPq20LmN` |\n| `{{$randomFirstName}}` | Postman compat | `Aylin` |\n| `{{$randomLastName}}` | Postman compat | `Karimov` |\n| `{{$randomFullName}}` | Postman compat | `Aylin Karimov` |\n| `{{$randomUserName}}` | Postman compat | `aylin.karimov42` |\n| `{{$randomNamePrefix}}` | Postman compat | `Dr.` |\n| `{{$randomNameSuffix}}` | Postman compat | `Jr.` |\n| `{{$randomEmail}}` | Postman compat | `sam.user42@example.com` |\n| `{{$randomUrl}}` | Postman compat | `https://acme.io/q1w2e3` |\n| `{{$randomDomainName}}` | Postman compat | `acme.io` |\n| `{{$randomDomainSuffix}}` | Postman compat | `io` |\n| `{{$randomUserAgent}}` | Postman compat | `Mozilla/5.0 (...)` |\n| `{{$randomIP}}` | Postman compat — IPv4 | `192.168.1.42` |\n| `{{$randomIPV4}}` | Postman compat | `192.168.1.42` |\n| `{{$randomIPV6}}` | Postman compat | `fe80::1ff:fe23:4567:890a` |\n| `{{$randomMACAddress}}` | Postman compat | `1A:2B:3C:4D:5E:6F` |\n| `{{$randomPassword}}` | Postman compat | `x4Z9p2Aq!` |\n| `{{$randomSemver}}` | Postman compat | `3.7.42` |\n| `{{$randomPhoneNumber}}` | Postman compat | `+15558675309` |\n| `{{$randomCity}}` | Postman compat | `Baku` |\n| `{{$randomCountry}}` | Postman compat | `Azerbaijan` |\n| `{{$randomCountryCode}}` | Postman compat | `AZ` |\n| `{{$randomStreetAddress}}` | Postman compat | `742 Maple St` |\n| `{{$randomZipCode}}` | Postman compat | `10042` |\n| `{{$randomLatitude}}` | Postman compat | `40.412345` |\n| `{{$randomLongitude}}` | Postman compat | `-74.012345` |\n| `{{$randomCompanyName}}` | Postman compat | `Acme Labs Inc.` |\n| `{{$randomJobTitle}}` | Postman compat | `Senior Software Engineer` |\n| `{{$randomJobArea}}` | Postman compat | `Engineering` |\n| `{{$randomDepartment}}` | Postman compat | `Engineering` |\n| `{{$randomProduct}}` | Postman compat | `Acme Cloud` |\n| `{{$randomCatchPhrase}}` | Postman compat | `Scalable mesh` |\n| `{{$randomCreditCardMask}}` | Postman compat | `****-****-****-4242` |\n| `{{$randomCreditCardNumber}}` | Postman compat | `4242424242424242` |\n| `{{$randomBankAccount}}` | Postman compat | `0123456789` |\n| `{{$randomBankRoutingNumber}}` | Postman compat | `021000089` |\n| `{{$randomCurrencyCode}}` | Postman compat | `USD` |\n| `{{$randomPrice}}` | Postman compat | `42.99` |\n| `{{$randomTransactionType}}` | Postman compat | `payment` |\n| `{{$randomDatetime}}` | Postman compat | `2026-04-06T10:24:00.000Z` |\n| `{{$randomDatePast}}` | Postman compat | `2025-10-12T...` |\n| `{{$randomDateFuture}}` | Postman compat | `2026-11-04T...` |\n| `{{$randomDateRecent}}` | Postman compat — last 7 days | `2026-05-15T...` |\n| `{{$randomDateSoon}}` | Postman compat — next 7 days | `2026-05-22T...` |\n| `{{$randomTime}}` | Postman compat | `14:23:07` |\n| `{{$randomWeekday}}` | Postman compat | `Wednesday` |\n| `{{$randomMonth}}` | Postman compat | `April` |\n| `{{$randomColor}}` | Postman compat | `purple` |\n| `{{$randomHexColor}}` | Postman compat | `#A78BFA` |\n| `{{$randomWord}}` | Postman compat — lorem | `ipsum` |\n| `{{$randomWords}}` | Postman compat — lorem phrase | `lorem ipsum dolor` |\n| `{{$randomSentence}}` | Postman compat | `Lorem ipsum dolor sit amet.` |\n| `{{$randomParagraph}}` | Postman compat | `Lorem ipsum dolor sit amet...` |\n| `{{$randomFileName}}` | Postman compat | `q1w2e3r4.pdf` |\n| `{{$randomFileExt}}` | Postman compat | `json` |\n| `{{$randomFileType}}` | Postman compat | `image` |\n| `{{$randomMimeType}}` | Postman compat | `application/json` |\n| `{{$randomImageUrl}}` | Postman compat | `https://picsum.photos/400/300` |\n"
 };
 //# sourceMappingURL=aiPacks.js.map

package/dist/resources/generated/aiPacks.js.map

@@ -1 +1 @@
-{"version":3,"file":"aiPacks.js","sourceRoot":"","sources":["../../../src/resources/generated/aiPacks.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,MAAM,CAAC,MAAM,qBAAqB,GAAG,QAAQ,CAAC;AAE9C,MAAM,CAAC,MAAM,QAAQ,GAA2B;IAC9C,YAAY,EAAE,q8HAAq8H;IACn9H,oBAAoB,EAAE,84eAA84e;IACp6e,gBAAgB,EAAE,kyBAAkyB;IACpzB,QAAQ,EAAE,g4iCAAg4iC;IAC14iC,iBAAiB,EAAE,4xFAA4xF;IAC/yF,gBAAgB,EAAE,yy3CAAyy3C;IAC3z3C,YAAY,EAAE,u0LAAu0L;CACt1L,CAAC"}
+{"version":3,"file":"aiPacks.js","sourceRoot":"","sources":["../../../src/resources/generated/aiPacks.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,MAAM,CAAC,MAAM,qBAAqB,GAAG,QAAQ,CAAC;AAE9C,MAAM,CAAC,MAAM,QAAQ,GAA2B;IAC9C,YAAY,EAAE,0iJAA0iJ;IACxjJ,oBAAoB,EAAE,84eAA84e;IACp6e,gBAAgB,EAAE,+0BAA+0B;IACj2B,QAAQ,EAAE,66iCAA66iC;IACv7iC,iBAAiB,EAAE,4xFAA4xF;IAC/yF,gBAAgB,EAAE,mi7CAAmi7C;IACrj7C,YAAY,EAAE,u0LAAu0L;CACt1L,CAAC"}

package/dist/tools/catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../src/tools/catalog.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,YAAY,GAAG,aAAa,GAAG,UAAU,GAAG,WAAW,GAAG,aAAa,GAAG,QAAQ,GAAG,cAAc,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,GAAG,UAAU,GAAG,KAAK,CAAC;AAE9L,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,SAAS,CAAC;IAEjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,eAAO,MAAM,YAAY,EAAE,gBAAgB,EAkJ1C,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,CAAC;IACnB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,eAAO,MAAM,gBAAgB,GAAI,aAAa,MAAM,EAAE,EAAE,eAAe,OAAO,KAAG,gBAAgB,EAUhG,CAAC"}
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../src/tools/catalog.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,YAAY,GAAG,aAAa,GAAG,UAAU,GAAG,WAAW,GAAG,aAAa,GAAG,QAAQ,GAAG,cAAc,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,GAAG,UAAU,GAAG,KAAK,CAAC;AAE9L,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,SAAS,CAAC;IAEjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,eAAO,MAAM,YAAY,EAAE,gBAAgB,EAuJ1C,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,CAAC;IACnB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,eAAO,MAAM,gBAAgB,GAAI,aAAa,MAAM,EAAE,EAAE,eAAe,OAAO,KAAG,gBAAgB,EAUhG,CAAC"}

package/dist/tools/catalog.js

@@ -20,6 +20,10 @@ export const TOOL_CATALOG = [
     { name: "create_folder", group: "collections", scopes: ["collections:write"] },
     { name: "update_folder", group: "collections", scopes: ["collections:write"] },
     { name: "delete_collection", group: "collections", scopes: ["collections:delete"], destructive: true },
+    // On-prem pipeline collections: submit a draft for review / ask to delete
+    // one (an approver decides in the app; tokens cannot approve).
+    { name: "submit_collection", group: "collections", scopes: ["collections:write"] },
+    { name: "request_collection_deletion", group: "collections", scopes: ["collections:delete"], destructive: true },
     { name: "delete_folder", group: "collections", scopes: ["collections:delete"], destructive: true },
     { name: "search_knowledge", group: "collections", scopes: ["collections:read"] },
     { name: "search_requests", group: "requests", scopes: ["requests:read"] },
@@ -45,6 +49,7 @@ export const TOOL_CATALOG = [
     { name: "delete_data_contract", group: "contracts", scopes: ["requests:delete"], destructive: true },
     // The safe connection record (no credentials) — readable with either family.
     { name: "list_connections", group: "connections", scopes: ["requests:read", "scenarios:read"], anyOf: true },
+    { name: "list_db_routines", group: "connections", scopes: ["requests:read", "scenarios:read"], anyOf: true },
     // Documents and new collections → import:write; cURL/.http into an existing
     // collection → requests:write.
     { name: "import_content", group: "import", scopes: ["import:write", "requests:write"], anyOf: true },