callman-mcp 0.5.0 → 0.6.0

package/dist/resources/docs/diagramSchema.js

@@ -1,5 +1,14 @@
+import { renderBpmnVocabulary, renderDatabaseOps, renderDatabaseVocabulary } from "callman-core";
 export const DIAGRAM_SCHEMA_DOC = `# Diagrams (create_diagram, update_diagram, patch_diagram)
 
+The desktop has four kinds of diagram, and every tool here works on all of them:
+| Kind | Create with | Node types | Section |
+|---|---|---|---|
+| System design (canvas) | \`nodes\` + \`edges\` (default) | callman://diagram/components | Compact input |
+| BPMN process | \`kind: "bpmn"\`, bpmn.* nodes, or \`source: { format: "bpmn" }\` | bpmn.* (end of this doc) | BPMN |
+| Mermaid | \`source: { format: "mermaid", text }\` | — (a flowchart becomes nodes) | Mermaid |
+| Database / ERD | \`kind: "database"\` + \`tables\` / \`relationships\`, or \`fromConnection\` | db.table / db.view / db.collection | Database diagrams |
+
 A diagram is a **DiagramDocument** (schemaVersion 1): typed nodes with positions and sizes,
 edges between nodes, a title. You write the compact form below; the server assigns ids,
 sizes from the component catalog, edge styles from the semantic, and lays the nodes out.
@@ -142,9 +151,10 @@ same vocabulary the desktop's AI assistant uses — one implementation (callman-
 - A BPMN diagram keeps its truth in BPMN 2.0 XML: \`create_diagram\` with \`kind: "bpmn"\` (or nodes
   typed bpmn.*) writes the XML from your nodes and edges; \`source: { format: "bpmn", text }\` stores a
   file you already have (from Camunda Modeler, for example). The desktop opens it in its BPMN editor.
-- Node \`type\` is one of the bpmn.* types listed under DIAGRAM OPS above (bpmn.start-event,
-  bpmn.user-task, bpmn.service-task, bpmn.exclusive-gateway, bpmn.parallel-gateway, bpmn.subprocess,
-  bpmn.pool, bpmn.lane, bpmn.boundary-event …). \`data.bpmn\` carries the BPMN facts:
+- Node \`type\` is one of the bpmn.* types — the full list is under "Reference: BPMN vocabulary" at
+  the end of this document (bpmn.start-event, bpmn.user-task, bpmn.service-task,
+  bpmn.exclusive-gateway, bpmn.parallel-gateway, bpmn.subprocess, bpmn.pool, bpmn.lane,
+  bpmn.boundary-event …). They are not in callman://diagram/components. \`data.bpmn\` carries the BPMN facts:
   \`eventDefinition\` (message | timer | error | signal | …), \`attachedTo\` (boundary events),
   \`cancelActivity\`, \`isExpanded\`. Edges are sequence flows; \`data.bpmn\` may set
   \`flow: "message"\` (between pools), \`conditionExpression\` and \`isDefault\`.
@@ -154,6 +164,38 @@ same vocabulary the desktop's AI assistant uses — one implementation (callman-
   elements, annotations and the modeler's formatting stay untouched. \`get_diagram\` view \`source\`
   returns the XML; view \`graph\` shows the derived nodes/edges with their \`bpmn\` facts.
 
+## Database diagrams (ERD)
+- A database diagram keeps its truth in a JSON database model (\`source.format: "database"\`):
+  tables (\`entities\`) with columns, keys, indexes and comments, and relationships between them;
+  the nodes on the canvas hold only positions and visibility. The desktop opens it on an ERD
+  canvas; \`get_diagram\` view \`schema\` shows tables with their columns and the relationships as
+  \`table.column\` pairs — read it before editing.
+- Create one with \`create_diagram\`: \`tables\` + \`relationships\` (\`{ name, schema?, columns:
+  [{ name, dataType, primaryKey?, nullable?, unique?, defaultValue?, comment? }] }\` and
+  \`{ source: "orders.user_id", target: "users.id", cardinality: "N:1" }\` — source is the child /
+  foreign-key side), or nodes typed db.table / db.view / db.collection with the columns in
+  \`data.db.columns\`, or \`fromConnection\` to read a real database through one of the
+  workspace's connections (\`introspect_database\` reads the same schema without drawing it).
+- Edit with the schema ops of \`patch_diagram\`:
+\`\`\`jsonc
+{ "op": "addTable", "table": { "name": "payments", "columns": [{ "name": "id", "dataType": "uuid", "primaryKey": true }, { "name": "order_id", "dataType": "bigint" }, { "name": "amount", "dataType": "numeric(12,2)" }] } }
+{ "op": "addColumn", "table": "users", "column": { "name": "profile_id", "dataType": "uuid", "nullable": true }, "after": "id" }
+{ "op": "alterColumn", "table": "users", "column": "email", "changes": { "unique": true, "nullable": false } }
+{ "op": "removeColumn", "table": "users", "column": "nickname" }
+{ "op": "setPrimaryKey", "table": "order_items", "columns": ["order_id", "line"] }
+{ "op": "renameTable", "table": "users", "name": "accounts", "schema": "auth" }
+{ "op": "setTableComment", "table": "users", "comment": "People who can sign in" }
+{ "op": "addRelationship", "source": "payments.order_id", "target": "orders.id", "cardinality": "N:1" }
+{ "op": "updateRelationship", "relationship": "fk-payments-orders", "changes": { "cardinality": "1:1", "label": "settles" } }
+{ "op": "removeRelationship", "relationship": "fk-payments-orders" }
+{ "op": "removeTable", "table": "audit_log" }                                   // its relationships go with it
+{ "op": "hideTable", "table": "migrations" }                                    // canvas only; showTable brings it back
+\`\`\`
+  Tables are named (\`users\`, \`public.users\`), columns as \`table.column\`; ids stay stable
+  across renames. New tables are placed to the right of the existing ones (or laid out with
+  \`relayout: "all"\`). moveNode, hideTable/showTable and setCanvas change the canvas only;
+  group / ungroup / reparent do not apply.
+
 ## Stored document (get_diagram view: "full")
 \`\`\`ts
 interface DiagramDocument {
@@ -166,7 +208,7 @@ interface DiagramDocument {
            locked?; hidden?; collapsed?; collapsedSize?; style?: DiagramStyle; data? }[];
   edges: { id; source?; target?; label?; labelPosition?; routing?; sourceHandle?; targetHandle?;
            style?: DiagramStyle; markerStart?; markerEnd?; waypoints? }[];
-  source?: { format: "mermaid"; text; diagramType; grammar?; valid? };
+  source?: { format: "mermaid" | "bpmn" | "database"; text; diagramType; grammar?; valid? };
 }
 // Stored colors are { raw: "#3B82F6" } (or a theme { token }); bold/italic/underline are
 // the bitmask fontStyle (1 | 2 | 4). The tools convert both ways — write plain colors.
@@ -174,4 +216,21 @@ interface DiagramDocument {
 Edge meaning is derived from \`style\` (dashed + dashPattern + strokeWidth) — set it with
 \`semantic\`, never directly.
 `;
+// The BPMN and database vocabularies come from callman-core — the same text the
+// desktop's AI reads — so the type lists and op shapes can never drift.
+export const diagramSchemaDoc = () => [
+    DIAGRAM_SCHEMA_DOC,
+    "## Reference: BPMN vocabulary",
+    "```text",
+    renderBpmnVocabulary(),
+    "```",
+    "",
+    "## Reference: database model and schema ops",
+    "```text",
+    renderDatabaseVocabulary(),
+    "",
+    renderDatabaseOps(),
+    "```",
+    "",
+].join("\n");
 //# sourceMappingURL=diagramSchema.js.map

package/dist/resources/docs/diagramSchema.js.map

@@ -1 +1 @@
-{"version":3,"file":"diagramSchema.js","sourceRoot":"","sources":["../../../src/resources/docs/diagramSchema.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+KjC,CAAC"}
+{"version":3,"file":"diagramSchema.js","sourceRoot":"","sources":["../../../src/resources/docs/diagramSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAEjG,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwNjC,CAAC;AAEF,gFAAgF;AAChF,wEAAwE;AACxE,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAW,EAAE,CAC3C;IACE,kBAAkB;IAClB,+BAA+B;IAC/B,SAAS;IACT,oBAAoB,EAAE;IACtB,KAAK;IACL,EAAE;IACF,6CAA6C;IAC7C,SAAS;IACT,wBAAwB,EAAE;IAC1B,EAAE;IACF,iBAAiB,EAAE;IACnB,KAAK;IACL,EAAE;CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC"}

package/dist/resources/docs/overview.d.ts

@@ -1,2 +1,2 @@
-export declare const OVERVIEW_DOC = "# Working with Callman through MCP\n\nCallman is an API client and test platform (collections of HTTP requests, environments,\nmulti-step API test scenarios, UI tests for web / Android / iOS, system-design diagrams). This\nserver exposes it to you through tools; everything you do goes to the same server the Callman desktop app uses, as the user\nwhose token is configured, limited to that token's permissions and the user's workspace role.\n\n## Start here\n1. `whoami` \u2014 proves the connection and tells you the workspaces, features and which tools\n   this token can use.\n2. Look before you create: `list_collections` / `get_collection_tree` / `search_requests`.\n   Creating a collection whose name exists is refused on purpose.\n3. Arguments are strict: a misspelled or unknown argument is an error that lists the valid\n   ones \u2014 read it and retry; nothing is silently ignored.\n4. Names work as references everywhere an id does (collection, folder, request, environment,\n   scenario, UI test, diagram, workspace). Ambiguous names come back as a candidate list \u2014 pick one.\n5. Preview big writes with `dryRun: true` (bulk create, imports, scenarios, diagrams).\n6. Deletions need `confirm: true` and an exact name or id. Ask the user unless they explicitly\n   requested the deletion.\n\n## Workspaces\nThe token works in EVERY workspace the user belongs to (with their role in each):\n- Lists and searches (`list_collections`, `search_requests`, `list_environments`,\n  `list_connections`, `list_scenarios`) cover all workspaces unless you pass `workspace`;\n  every row says which workspace it is in.\n- A name (collection, request, environment) is looked up in the default workspace first, then\n  in all others; a unique match anywhere is used and the result says where it was found. The\n  same name in several workspaces comes back as candidates tagged with their workspace \u2014 pass\n  `workspace` or the id.\n- Creating needs one target: `workspace`, or the collection it goes into, or the session\n  default. `use_workspace` changes the default for the session (it never hides the others).\n- Environments, connections and global variables belong to one workspace: a request uses the\n  ones of its own workspace.\n\n## Requests\n- Use `{{variable}}` for hosts and secrets (`{{baseUrl}}/users`) and put the values in an\n  environment (`create_environment` / `set_environment_variables`). Use `:id` for path\n  variables. See `callman://docs/request-schema`.\n- get_request returns a request in the same shape create/update take \u2014 read, change, send back.\n- Bodies: a JSON value, a raw string, or `{ mode: raw|formdata|urlencoded|json }`.\n- Database / Kafka / Redis steps and DB assertions are request fields; connections are\n  referenced by id or name (`list_connections`).\n- Contract checks (field rules, data-driven rows) \u2014 `callman://docs/contracts`.\n- Scripts run in a sandbox with the `pm.*` API \u2014 `callman://docs/scripting/pm-api`.\n- `run_request` / `run_collection` execute on the user's machine with real variable values;\n  you only get results and the names of variables scripts changed.\n\n## Secrets\nEnvironment values come back masked (`\u2022\u2022\u2022\u2022ab`) unless the token holds `environments:reveal`\nand you ask for `reveal: true`. Never write a masked environment value back \u2014 it is refused.\nRequest auth secrets and sensitive headers are masked the same way; sending a masked request\nsecret back UNCHANGED keeps the stored one, anything else masked is refused.\n\n## Scenarios\nMulti-step flows as a graph of typed nodes (request, condition, assertion, set-vars, poll,\ndb, kafka, script, wait, end \u2026). Read `callman://docs/scenario-nodes` before building one;\npartial node configs are merged over defaults. Runs happen on the server (`run_scenario`).\n\n## UI tests\nBrowser and mobile-app flows (YAML: header, `---`, steps) \u2014 the desktop app's UI Testing area.\nRead `callman://docs/ui-tests` first and `callman://docs/ui-test-steps` for every step. Flows are\nlinted before they are saved (`validate_ui_test`); edit steps by number with\n`patch_ui_test_steps`. Web flows run on the server runner when there is one; Android, iOS (and\nweb without a runner) run on the user's own Callman desktop app, which must be open with\n\"Let AI tools run UI tests on this computer\" on \u2014 `list_ui_test_devices` shows what is\navailable. Runs return per-step results; screenshots come back as images on request.\n\n## Diagrams\nSystem-design diagrams use a fixed component catalog \u2014 `callman://diagram/components`.\nBuild with `create_diagram` (auto layout), edit with `patch_diagram`, share with\n`share_diagram`. See `callman://docs/diagram-schema`.\n\n## After writing\nThe desktop app refreshes when the user switches back to it. Tell the user what you created\nand where (collection / folder names).\n";
+export declare const OVERVIEW_DOC = "# Working with Callman through MCP\n\nCallman is an API client and test platform (collections of HTTP requests, environments,\nmulti-step API test scenarios, UI tests for web / Android / iOS, and diagrams). This\nserver exposes it to you through tools; everything you do goes to the same server the Callman desktop app uses, as the user\nwhose token is configured, limited to that token's permissions and the user's workspace role.\n\n## Start here\n1. `whoami` \u2014 proves the connection and tells you the workspaces, features and which tools\n   this token can use.\n2. Look before you create: `list_collections` / `get_collection_tree` / `search_requests`.\n   Creating a collection whose name exists is refused on purpose.\n3. Arguments are strict: a misspelled or unknown argument is an error that lists the valid\n   ones \u2014 read it and retry; nothing is silently ignored.\n4. Names work as references everywhere an id does (collection, folder, request, environment,\n   scenario, UI test, diagram, workspace). Ambiguous names come back as a candidate list \u2014 pick one.\n5. Preview big writes with `dryRun: true` (bulk create, imports, scenarios, diagrams).\n6. Deletions need `confirm: true` and an exact name or id. Ask the user unless they explicitly\n   requested the deletion.\n\n## Workspaces\nThe token works in EVERY workspace the user belongs to (with their role in each):\n- Lists and searches (`list_collections`, `search_requests`, `list_environments`,\n  `list_connections`, `list_scenarios`) cover all workspaces unless you pass `workspace`;\n  every row says which workspace it is in.\n- A name (collection, request, environment) is looked up in the default workspace first, then\n  in all others; a unique match anywhere is used and the result says where it was found. The\n  same name in several workspaces comes back as candidates tagged with their workspace \u2014 pass\n  `workspace` or the id.\n- Creating needs one target: `workspace`, or the collection it goes into, or the session\n  default. `use_workspace` changes the default for the session (it never hides the others).\n- Environments, connections and global variables belong to one workspace: a request uses the\n  ones of its own workspace.\n\n## Requests\n- Use `{{variable}}` for hosts and secrets (`{{baseUrl}}/users`) and put the values in an\n  environment (`create_environment` / `set_environment_variables`). Use `:id` for path\n  variables. See `callman://docs/request-schema`.\n- get_request returns a request in the same shape create/update take \u2014 read, change, send back.\n- Bodies: a JSON value, a raw string, or `{ mode: raw|formdata|urlencoded|json }`.\n- Database / Kafka / Redis steps and DB assertions are request fields; connections are\n  referenced by id or name (`list_connections`).\n- Contract checks (field rules, data-driven rows) \u2014 `callman://docs/contracts`.\n- Scripts run in a sandbox with the `pm.*` API \u2014 `callman://docs/scripting/pm-api`.\n- `run_request` / `run_collection` execute on the user's machine with real variable values;\n  you only get results and the names of variables scripts changed.\n\n## Secrets\nEnvironment values come back masked (`\u2022\u2022\u2022\u2022ab`) unless the token holds `environments:reveal`\nand you ask for `reveal: true`. Never write a masked environment value back \u2014 it is refused.\nRequest auth secrets and sensitive headers are masked the same way; sending a masked request\nsecret back UNCHANGED keeps the stored one, anything else masked is refused.\n\n## Scenarios\nMulti-step flows as a graph of typed nodes (request, condition, assertion, set-vars, poll,\ndb, kafka, script, wait, end \u2026). Read `callman://docs/scenario-nodes` before building one;\npartial node configs are merged over defaults. Link a shared setup / teardown with a\nscenario-ref node: `config: { scenario: \"<name or id>\" }` \u2014 the server copies it in. Nodes\nwithout a position are placed next to the node they follow, clear of the others.\n- **Where runs happen.** `run_scenario` runs on the Callman server by default, which only\n  reaches what the server's network reaches. For the user's localhost, port-forwards, VPN-only\n  hosts or internal databases use `target: \"desktop\"`: the user's own Callman desktop app runs\n  it (open, signed in, Settings \u2192 AI tools \u2192 \"Let AI tools run scenarios on this computer\").\n- **Reports.** `get_scenario_report` shows server, scheduled, CLI and desktop runs\n  (`triggerType` / `executor`).\n- **Negative checks** (\"this event must NOT be published\", \"this call must be refused\"): give the\n  node `executionPolicy.expectFailure` \u2014 an error edge always ends the run\n  completed_with_failures.\n- **Editing.** `update_scenario` (whole graph) is checked against the version you last read; if\n  the user saved in the desktop meanwhile you get a conflict \u2014 re-read, then retry. Folders:\n  `create_scenario_folder` / `update_scenario_folder` / `delete_scenario_folder`. On-prem\n  review: `submit_scenario`, `review_scenario`, `list_scenario_versions`,\n  `restore_scenario_version`.\n\n## UI tests\nBrowser and mobile-app flows (YAML: header, `---`, steps) \u2014 the desktop app's UI Testing area.\nRead `callman://docs/ui-tests` first and `callman://docs/ui-test-steps` for every step. Flows are\nlinted before they are saved (`validate_ui_test`); edit steps by number with\n`patch_ui_test_steps`. Web flows run on the server runner when there is one; Android, iOS (and\nweb without a runner) run on the user's own Callman desktop app, which must be open with\n\"Let AI tools run UI tests on this computer\" on \u2014 `list_ui_test_devices` shows what is\navailable. Runs return per-step results; screenshots come back as images on request.\n\n## Diagrams\nFour kinds, all built with `create_diagram` (auto layout), edited with `patch_diagram` and\nshared with `share_diagram` \u2014 read `callman://docs/diagram-schema` first:\n- **System design**: nodes from the fixed component catalog `callman://diagram/components`.\n- **BPMN process**: `kind: \"bpmn\"` with bpmn.* nodes, stored as BPMN 2.0 XML.\n- **Mermaid**: `source: { format: \"mermaid\", text }` \u2014 a flowchart becomes nodes, other\n  Mermaid types are kept as source.\n- **Database / ERD**: `kind: \"database\"` with `tables` + `relationships`, or `fromConnection`\n  to read a real database's schema (`introspect_database` reads it without drawing). Edit it\n  with the schema ops (addTable, addColumn, addRelationship \u2026) and read it with view `schema`.\n\nThe user's library has private\nfolders: `list_diagrams` shows the tree as paths (\"Architecture/Payments\"); file a\ndiagram with `folder` on `create_diagram` / `update_diagram`; manage folders with\n`create_diagram_folder`, `update_diagram_folder`, `delete_diagram_folder`.\n\n## After writing\nThe desktop app refreshes when the user switches back to it. Tell the user what you created\nand where (collection / folder names).\n";
 //# sourceMappingURL=overview.d.ts.map

package/dist/resources/docs/overview.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"overview.d.ts","sourceRoot":"","sources":["../../../src/resources/docs/overview.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,YAAY,izJA2ExB,CAAC"}
+{"version":3,"file":"overview.d.ts","sourceRoot":"","sources":["../../../src/resources/docs/overview.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,YAAY,m2NAsGxB,CAAC"}

package/dist/resources/docs/overview.js

@@ -1,7 +1,7 @@
 export const OVERVIEW_DOC = `# Working with Callman through MCP
 
 Callman is an API client and test platform (collections of HTTP requests, environments,
-multi-step API test scenarios, UI tests for web / Android / iOS, system-design diagrams). This
+multi-step API test scenarios, UI tests for web / Android / iOS, and diagrams). This
 server exposes it to you through tools; everything you do goes to the same server the Callman desktop app uses, as the user
 whose token is configured, limited to that token's permissions and the user's workspace role.
 
@@ -54,7 +54,23 @@ secret back UNCHANGED keeps the stored one, anything else masked is refused.
 ## Scenarios
 Multi-step flows as a graph of typed nodes (request, condition, assertion, set-vars, poll,
 db, kafka, script, wait, end …). Read \`callman://docs/scenario-nodes\` before building one;
-partial node configs are merged over defaults. Runs happen on the server (\`run_scenario\`).
+partial node configs are merged over defaults. Link a shared setup / teardown with a
+scenario-ref node: \`config: { scenario: "<name or id>" }\` — the server copies it in. Nodes
+without a position are placed next to the node they follow, clear of the others.
+- **Where runs happen.** \`run_scenario\` runs on the Callman server by default, which only
+  reaches what the server's network reaches. For the user's localhost, port-forwards, VPN-only
+  hosts or internal databases use \`target: "desktop"\`: the user's own Callman desktop app runs
+  it (open, signed in, Settings → AI tools → "Let AI tools run scenarios on this computer").
+- **Reports.** \`get_scenario_report\` shows server, scheduled, CLI and desktop runs
+  (\`triggerType\` / \`executor\`).
+- **Negative checks** ("this event must NOT be published", "this call must be refused"): give the
+  node \`executionPolicy.expectFailure\` — an error edge always ends the run
+  completed_with_failures.
+- **Editing.** \`update_scenario\` (whole graph) is checked against the version you last read; if
+  the user saved in the desktop meanwhile you get a conflict — re-read, then retry. Folders:
+  \`create_scenario_folder\` / \`update_scenario_folder\` / \`delete_scenario_folder\`. On-prem
+  review: \`submit_scenario\`, \`review_scenario\`, \`list_scenario_versions\`,
+  \`restore_scenario_version\`.
 
 ## UI tests
 Browser and mobile-app flows (YAML: header, \`---\`, steps) — the desktop app's UI Testing area.
@@ -66,9 +82,20 @@ web without a runner) run on the user's own Callman desktop app, which must be o
 available. Runs return per-step results; screenshots come back as images on request.
 
 ## Diagrams
-System-design diagrams use a fixed component catalog — \`callman://diagram/components\`.
-Build with \`create_diagram\` (auto layout), edit with \`patch_diagram\`, share with
-\`share_diagram\`. See \`callman://docs/diagram-schema\`.
+Four kinds, all built with \`create_diagram\` (auto layout), edited with \`patch_diagram\` and
+shared with \`share_diagram\` — read \`callman://docs/diagram-schema\` first:
+- **System design**: nodes from the fixed component catalog \`callman://diagram/components\`.
+- **BPMN process**: \`kind: "bpmn"\` with bpmn.* nodes, stored as BPMN 2.0 XML.
+- **Mermaid**: \`source: { format: "mermaid", text }\` — a flowchart becomes nodes, other
+  Mermaid types are kept as source.
+- **Database / ERD**: \`kind: "database"\` with \`tables\` + \`relationships\`, or \`fromConnection\`
+  to read a real database's schema (\`introspect_database\` reads it without drawing). Edit it
+  with the schema ops (addTable, addColumn, addRelationship …) and read it with view \`schema\`.
+
+The user's library has private
+folders: \`list_diagrams\` shows the tree as paths ("Architecture/Payments"); file a
+diagram with \`folder\` on \`create_diagram\` / \`update_diagram\`; manage folders with
+\`create_diagram_folder\`, \`update_diagram_folder\`, \`delete_diagram_folder\`.
 
 ## After writing
 The desktop app refreshes when the user switches back to it. Tell the user what you created

package/dist/resources/docs/overview.js.map

@@ -1 +1 @@
-{"version":3,"file":"overview.js","sourceRoot":"","sources":["../../../src/resources/docs/overview.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2E3B,CAAC"}
+{"version":3,"file":"overview.js","sourceRoot":"","sources":["../../../src/resources/docs/overview.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsG3B,CAAC"}

package/dist/resources/generated/aiPacks.d.ts

@@ -1,3 +1,3 @@
-export declare const AI_PACKS_CORE_VERSION = "1.31.0";
+export declare const AI_PACKS_CORE_VERSION = "1.32.0";
 export declare const AI_PACKS: Record<string, string>;
 //# sourceMappingURL=aiPacks.d.ts.map

package/dist/resources/generated/aiPacks.js

@@ -1,12 +1,12 @@
-// GENERATED by scripts/build-static-resources.mjs from callman-core@1.31.0 ai-packs — do not edit.
-export const AI_PACKS_CORE_VERSION = "1.31.0";
+// GENERATED by scripts/build-static-resources.mjs from callman-core@1.32.0 ai-packs — do not edit.
+export const AI_PACKS_CORE_VERSION = "1.32.0";
 export const AI_PACKS = {
-    "db-queries": "<!-- GENERATED FILE — do not edit by hand. Source: callman_core (npm run ai:packs). -->\n\n# Callman data access from scripts (`pm.db.query` / `pm.redis.command`)\n\n`pm.db.query({ connectionId, query })` — ALWAYS `await`. `query` is coerced to a string, `{{tokens}}` are resolved, then dispatched by the connection's type. `connectionId` may be omitted to use the request's configured DB connection. IMPORTANT: `pm.db.query` does NOT accept a `params`/bind array — inline values (quote strings) or use `{{env.X}}` tokens; SQL placeholders like `$1` or `?` are NOT bound.\n\n## MongoDB\n`query` MUST be a JSON STRING of a command object (use `JSON.stringify`), NOT a `db.coll.find(...)` shell string. The match key is `filter` (a top-level `query` key is rejected).\n\n```js\nconst body = pm.response.json();\nconst res = await pm.db.query({\n  connectionId: \"…\",\n  query: JSON.stringify({\n    collection: \"users\",\n    operation: \"findOne\",        // find | findOne | aggregate | countDocuments | insertOne | insertMany | updateOne | updateMany | deleteOne | deleteMany | findOneAndUpdate | findOneAndReplace | findOneAndDelete\n    filter: { email: body.data.user.email },\n  }),\n});\npm.expect(res.rowCount).to.be.above(0);   // existence check\n```\n\nPer-operation fields: `find`/`findOne` use `filter` (+ optional `projection`,`sort`,`limit`,`skip`); `aggregate` uses `pipeline` (array); `insertOne` uses `document`, `insertMany` uses `documents`; `updateOne`/`updateMany`/`findOneAndUpdate` use `filter`+`update` (Mongo update operators, e.g. `{ $set: { … } }`); `deleteOne`/`deleteMany` use `filter`; `findOneAndUpdate`/`findOneAndReplace` accept `returnDocument: \"before\"|\"after\"`. A 24-hex string in a filter is auto-coerced to ObjectId (or use `{ \"$oid\": \"…\" }`). Rows are in `res.rows`; write ops surface counts in `res.rowCount`.\n\n## PostgreSQL / MySQL / Oracle (SQL)\n`query` is plain SQL text. Because `pm.db.query` binds no params, inline the value and quote strings yourself (or use a `{{token}}`):\n\n```js\nconst email = pm.response.json().data.user.email;\nconst res = await pm.db.query({\n  connectionId: \"…\",\n  query: `SELECT id FROM users WHERE email = '${email}'`,\n});\npm.expect(res.rowCount).to.be.above(0);\n```\n\nNotes: a trailing `;` is stripped (except Oracle PL/SQL blocks, which keep it). **Oracle** returns column names UPPERCASE — read `res.rows[0].EMAIL`, not `.email`. `res.rowCount` is the row count for SELECT and the affected-row count for INSERT/UPDATE/DELETE.\n\n## SQL Server (mssql)\nSingle statement per query; a trailing `;` is stripped; `GO` batch separators are REJECTED (client-tool syntax, not T-SQL). Positional params bind as named inputs: `params[0]` → `@p1`, `params[1]` → `@p2`… (scenario db node only — `pm.db.query` has no params).\n\n```sql\nSELECT TOP 1 id, amount FROM dbo.orders WHERE customer_id = @p1 ORDER BY created_at DESC\n```\n\n## Redis (`pm.redis.command`)\n`command` is a single string. Supported commands: **GET, SET, DEL, EXISTS, TTL, HGET, HSET, HGETALL, HDEL, LPUSH, RPUSH, LRANGE, LLEN, SADD, SMEMBERS, SISMEMBER, INCR, DECR, INCRBY, EXPIRE, PERSIST, TYPE, ZADD, ZRANGE, ZSCORE, SCAN**. Quote a value that contains spaces.\n\nStructured replies land in `res.result` as real values: `HGETALL` → object, `LRANGE`/`SMEMBERS`/`ZRANGE` → array, `EXISTS`/`SISMEMBER`/`EXPIRE`/`PERSIST` → boolean; `res.resultText` is the stringified form. `SCAN pattern [count]` is Callman-managed: the cursor loop runs internally (capped at 1000 keys / 100 iterations) and returns `{ keys, count, truncated }` — no raw cursors.\n\n```js\nconst res = await pm.redis.command({ connectionId: \"…\", command: `GET session:${id}` });\npm.expect(res.success).to.be.true;\n// res.result / res.resultText hold the value; res.commandName, res.key are set.\n```\n",
+    "db-queries": "<!-- GENERATED FILE — do not edit by hand. Source: callman_core (npm run ai:packs). -->\n\n# Callman data access from scripts (`pm.db.query` / `pm.redis.command`)\n\n`pm.db.query({ connectionId, query })` — ALWAYS `await`. `query` is coerced to a string, `{{tokens}}` are resolved, then dispatched by the connection's type. `connectionId` may be omitted to use the request's configured DB connection. IMPORTANT: `pm.db.query` does NOT accept a `params`/bind array — inline values (quote strings) or use `{{env.X}}` tokens; SQL placeholders like `$1` or `?` are NOT bound.\n\n## MongoDB\n`query` MUST be a JSON STRING of a command object (use `JSON.stringify`), NOT a `db.coll.find(...)` shell string. The match key is `filter` (a top-level `query` key is rejected).\n\n```js\nconst body = pm.response.json();\nconst res = await pm.db.query({\n  connectionId: \"…\",\n  query: JSON.stringify({\n    collection: \"users\",\n    operation: \"findOne\",        // find | findOne | aggregate | countDocuments | insertOne | insertMany | updateOne | updateMany | deleteOne | deleteMany | findOneAndUpdate | findOneAndReplace | findOneAndDelete\n    filter: { email: body.data.user.email },\n  }),\n});\npm.expect(res.rowCount).to.be.above(0);   // existence check\n```\n\nPer-operation fields: `find`/`findOne` use `filter` (+ optional `projection`,`sort`,`limit`,`skip`); `aggregate` uses `pipeline` (array); `insertOne` uses `document`, `insertMany` uses `documents`; `updateOne`/`updateMany`/`findOneAndUpdate` use `filter`+`update` (Mongo update operators, e.g. `{ $set: { … } }`); `deleteOne`/`deleteMany` use `filter`; `findOneAndUpdate`/`findOneAndReplace` accept `returnDocument: \"before\"|\"after\"`. The command text is MongoDB Extended JSON (relaxed): `{ \"$oid\": \"…\" }`, `{ \"$date\": \"2026-01-01T00:00:00Z\" }`, `{ \"$numberDecimal\": \"9.99\" }` and `{ \"$numberLong\": \"…\" }` become real BSON values anywhere in the command; a 24-hex string in a filter is also coerced to ObjectId. Rows are in `res.rows`; write ops surface counts in `res.rowCount`.\n\n## PostgreSQL / MySQL / Oracle (SQL)\n`query` is plain SQL text. Because `pm.db.query` binds no params, inline the value and quote strings yourself (or use a `{{token}}`):\n\n```js\nconst email = pm.response.json().data.user.email;\nconst res = await pm.db.query({\n  connectionId: \"…\",\n  query: `SELECT id FROM users WHERE email = '${email}'`,\n});\npm.expect(res.rowCount).to.be.above(0);\n```\n\nNotes: a trailing `;` is stripped (except Oracle PL/SQL blocks, which keep it). **Oracle** returns column names UPPERCASE — read `res.rows[0].EMAIL`, not `.email`. `res.rowCount` is the row count for SELECT and the affected-row count for INSERT/UPDATE/DELETE.\n\n## SQL Server (mssql)\nSingle statement per query; a trailing `;` is stripped; `GO` batch separators are REJECTED (client-tool syntax, not T-SQL). Positional params bind as named inputs: `params[0]` → `@p1`, `params[1]` → `@p2`… (scenario db node only — `pm.db.query` has no params).\n\n```sql\nSELECT TOP 1 id, amount FROM dbo.orders WHERE customer_id = @p1 ORDER BY created_at DESC\n```\n\n## Redis (`pm.redis.command`)\n`command` is a single string. Supported commands: **GET, SET, DEL, EXISTS, TTL, HGET, HSET, HGETALL, HDEL, LPUSH, RPUSH, LRANGE, LLEN, SADD, SMEMBERS, SISMEMBER, INCR, DECR, INCRBY, EXPIRE, PERSIST, TYPE, ZADD, ZRANGE, ZSCORE, SCAN**. Quote a value that contains spaces.\n\nStructured replies land in `res.result` as real values: `HGETALL` → object, `LRANGE`/`SMEMBERS`/`ZRANGE` → array, `EXISTS`/`SISMEMBER`/`EXPIRE`/`PERSIST` → boolean; `res.resultText` is the stringified form. `SCAN pattern [count]` is Callman-managed: the cursor loop runs internally (capped at 1000 keys / 100 iterations) and returns `{ keys, count, truncated }` — no raw cursors.\n\n```js\nconst res = await pm.redis.command({ connectionId: \"…\", command: `GET session:${id}` });\npm.expect(res.success).to.be.true;\n// res.result / res.resultText hold the value; res.commandName, res.key are set.\n```\n",
     "diagram-components": "<!-- GENERATED FILE — do not edit by hand. Source: callman_core (npm run ai:packs). -->\n\n# Diagram components and edge notation\n\nA diagram node's `type` MUST be one of the keys below (`callman-core` `DIAGRAM_COMPONENT_CATALOG`). Sizes are the defaults the studio uses; `container` types hold children via `parentId`.\n\n## Edge notation\n\n| Semantic | Meaning | Style tuple |\n| --- | --- | --- |\n| `sync` | Request / response call | dashed=false, strokeWidth=1.5 |\n| `async` | Fire-and-forget, event or callback | dashed=true, dashPattern=\"6 4\", strokeWidth=1.5 |\n| `fallback` | Retry, fallback or optional path | dashed=true, dashPattern=\"1 3\", strokeWidth=1.25 |\n| `bus` | Message bus or stream | dashed=false, strokeWidth=3 |\n\n## Generic (`generic`)\n\n| Type | Label | Default size | Aliases |\n| --- | --- | --- | --- |\n| `line` | Line | 160×0 | connector, edge, link |\n| `arrow` | Arrow | 160×0 | connector, directed, link |\n| `line.dashed` | Dashed Line | 160×0 | dotted, connector |\n| `rect` | Rectangle | 140×64 | box, card |\n| `square` | Square | 90×90 |  |\n| `ellipse` | Ellipse | 140×64 | oval |\n| `circle` | Circle | 90×90 |  |\n| `diamond` | Diamond | 140×64 | rhombus |\n| `triangle` | Triangle | 140×64 |  |\n| `hexagon` | Hexagon | 140×64 |  |\n| `pentagon` | Pentagon | 140×64 |  |\n| `octagon` | Octagon | 140×64 |  |\n| `parallelogram` | Parallelogram | 140×64 |  |\n| `trapezoid` | Trapezoid | 140×64 |  |\n| `cylinder` | Cylinder | 140×64 | can, tube |\n| `cloud-shape` | Cloud | 140×64 |  |\n| `callout` | Callout | 140×64 | speech, bubble |\n| `text` | Text | 120×36 |  |\n| `sticky` | Sticky note | 140×100 | postit, comment |\n| `card` | Card | 140×64 |  |\n| `frame` | Frame / Container (container) | 220×160 | group, container, boundary |\n| `pool.horizontal` | Pool (horizontal) (swimlane) | 360×220 | swimlane, lane, container, subsystem |\n| `pool.vertical` | Pool (vertical) (swimlane) | 220×360 | swimlane, lane, container, subsystem |\n| `image` | Image | 140×64 | picture |\n\n## Flowchart (`flowchart`)\n\n| Type | Label | Default size | Aliases |\n| --- | --- | --- | --- |\n| `flow.process` | Process | 140×64 | step, action |\n| `flow.alt-process` | Alternate Process | 140×64 |  |\n| `flow.decision` | Decision | 140×100 | if, branch |\n| `flow.terminator` | Start / End | 130×56 | terminator, begin, stop |\n| `flow.data` | Data (I/O) | 140×64 | input, output, io |\n| `flow.document` | Document | 140×64 |  |\n| `flow.multi-document` | Multi-Document | 140×64 |  |\n| `flow.predefined` | Predefined Process | 140×64 | subroutine |\n| `flow.manual-input` | Manual Input | 140×64 |  |\n| `flow.manual-op` | Manual Operation | 140×64 |  |\n| `flow.preparation` | Preparation | 140×64 |  |\n| `flow.stored-data` | Stored Data | 140×64 |  |\n| `flow.database` | Database | 140×64 | db, store |\n| `flow.display` | Display | 140×64 |  |\n| `flow.delay` | Delay | 140×64 |  |\n| `flow.merge` | Merge | 140×64 |  |\n| `flow.or` | Or | 140×64 |  |\n| `flow.connector` | On-page Connector | 48×48 |  |\n| `flow.off-page` | Off-page Connector | 140×64 |  |\n| `flow.annotation` | Annotation | 140×64 |  |\n\n## UML (`uml`)\n\n| Type | Label | Default size | Aliases |\n| --- | --- | --- | --- |\n| `uml.class` | Class | 140×64 | entity |\n| `uml.abstract` | Abstract Class | 140×64 |  |\n| `uml.interface` | Interface | 140×64 |  |\n| `uml.enum` | Enum | 140×64 |  |\n| `uml.object` | Object | 140×64 |  |\n| `uml.package` | Package | 140×64 |  |\n| `uml.component` | Component | 140×64 |  |\n| `uml.node` | Node / Deployment | 140×64 |  |\n| `uml.actor` | Actor | 60×100 | user, role |\n| `uml.usecase` | Use Case | 140×64 |  |\n| `uml.boundary` | Boundary | 140×64 |  |\n| `uml.control` | Control | 140×64 |  |\n| `uml.entity` | Entity | 140×64 |  |\n| `uml.state` | State | 140×64 |  |\n| `uml.initial` | Initial State | 36×36 |  |\n| `uml.final` | Final State | 40×40 |  |\n| `uml.decision` | Decision | 60×60 |  |\n| `uml.note` | Note / Comment | 140×64 | comment |\n\n## ERD (`erd`)\n\n| Type | Label | Default size | Aliases |\n| --- | --- | --- | --- |\n| `erd.entity` | Entity | 140×64 | table |\n| `erd.weak-entity` | Weak Entity | 140×64 |  |\n| `erd.attribute` | Attribute | 140×64 |  |\n| `erd.key-attribute` | Key Attribute | 140×64 | pk, primary key |\n| `erd.multivalued` | Multivalued Attribute | 140×64 |  |\n| `erd.derived` | Derived Attribute | 140×64 |  |\n| `erd.relationship` | Relationship | 140×64 |  |\n| `erd.identifying` | Identifying Relationship | 140×64 |  |\n\n## Architecture (`networking`)\n\n| Type | Label | Default size | Aliases |\n| --- | --- | --- | --- |\n| `net.user` | User / Client | 60×100 | client, person |\n| `net.admin` | Admin | 60×100 |  |\n| `net.browser` | Browser | 140×64 |  |\n| `net.mobile` | Mobile Device | 90×130 | phone |\n| `net.desktop` | Desktop | 140×64 |  |\n| `net.iot` | IoT Device | 140×64 |  |\n| `net.server` | Server | 140×64 |  |\n| `net.service` | Service | 140×64 | microservice |\n| `net.monolith` | Monolith | 140×64 |  |\n| `net.api-gateway` | API Gateway | 140×64 | api, gateway |\n| `net.load-balancer` | Load Balancer | 140×64 | lb |\n| `net.reverse-proxy` | Reverse Proxy | 140×64 | proxy |\n| `net.firewall` | Firewall | 140×64 | waf |\n| `net.router` | Router | 140×64 |  |\n| `net.switch` | Switch | 140×64 |  |\n| `net.dns` | DNS | 140×64 |  |\n| `net.cdn` | CDN | 140×64 | edge |\n| `net.cache` | Cache | 140×64 |  |\n| `net.queue` | Queue | 140×64 | mq |\n| `net.websocket` | Web Socket | 140×64 | ws |\n| `net.rest` | REST endpoint | 140×64 | http, api |\n| `net.internet` | Internet / Cloud | 140×64 | wan |\n| `net.datacenter` | Datacenter | 140×64 |  |\n| `net.container` | Container | 140×64 |  |\n| `net.pod` | Pod | 140×64 |  |\n| `net.vm` | Virtual Machine | 140×64 | vm |\n\n## Databases (`database`)\n\n| Type | Label | Default size | Aliases |\n| --- | --- | --- | --- |\n| `db.postgres` | PostgreSQL | 176×56 | postgres, pg |\n| `db.mysql` | MySQL | 176×56 |  |\n| `db.mariadb` | MariaDB | 176×56 |  |\n| `db.mongodb` | MongoDB | 176×56 | mongo |\n| `db.redis` | Redis | 176×56 |  |\n| `db.sqlite` | SQLite | 176×56 |  |\n| `db.mssql` | MS SQL Server | 176×56 | sqlserver, mssql |\n| `db.oracle` | Oracle | 176×56 |  |\n| `db.cassandra` | Cassandra | 176×56 |  |\n| `db.elasticsearch` | Elasticsearch | 176×56 | elastic, es |\n| `db.neo4j` | Neo4j | 176×56 | graph |\n| `db.couchdb` | CouchDB | 176×56 | couch |\n| `db.couchbase` | Couchbase | 176×56 |  |\n| `db.clickhouse` | ClickHouse | 176×56 |  |\n| `db.cockroachdb` | CockroachDB | 176×56 | cockroach |\n| `db.influxdb` | InfluxDB | 176×56 | influx, tsdb |\n| `db.snowflake` | Snowflake | 176×56 |  |\n| `db.supabase` | Supabase | 176×56 |  |\n\n## Messaging (`messaging`)\n\n| Type | Label | Default size | Aliases |\n| --- | --- | --- | --- |\n| `mq.kafka` | Apache Kafka | 176×56 | kafka |\n| `mq.rabbitmq` | RabbitMQ | 176×56 | rabbit, amqp |\n| `mq.nats` | NATS | 176×56 |  |\n| `mq.pulsar` | Apache Pulsar | 176×56 | pulsar |\n| `mq.mqtt` | MQTT | 176×56 |  |\n| `mq.pubsub` | Pub/Sub | 176×56 | pubsub |\n| `mq.activemq` | ActiveMQ | 176×56 | jms |\n\n## Languages (`language`)\n\n| Type | Label | Default size | Aliases |\n| --- | --- | --- | --- |\n| `lang.node` | Node.js | 176×56 | node, js runtime |\n| `lang.python` | Python | 176×56 | py |\n| `lang.java` | Java | 176×56 | jvm |\n| `lang.go` | Go | 176×56 | golang |\n| `lang.rust` | Rust | 176×56 |  |\n| `lang.dotnet` | C# / .NET | 176×56 | csharp, c# |\n| `lang.typescript` | TypeScript | 176×56 | ts |\n| `lang.javascript` | JavaScript | 176×56 | js |\n| `lang.ruby` | Ruby | 176×56 |  |\n| `lang.php` | PHP | 176×56 |  |\n| `lang.kotlin` | Kotlin | 176×56 |  |\n| `lang.swift` | Swift | 176×56 |  |\n| `lang.scala` | Scala | 176×56 |  |\n| `lang.elixir` | Elixir | 176×56 |  |\n| `lang.cpp` | C++ | 176×56 | cpp |\n\n## Frameworks (`framework`)\n\n| Type | Label | Default size | Aliases |\n| --- | --- | --- | --- |\n| `fw.express` | Express | 176×56 |  |\n| `fw.nestjs` | NestJS | 176×56 | nest |\n| `fw.spring` | Spring Boot | 176×56 | spring |\n| `fw.django` | Django | 176×56 |  |\n| `fw.flask` | Flask | 176×56 |  |\n| `fw.fastapi` | FastAPI | 176×56 |  |\n| `fw.rails` | Rails | 176×56 | ruby on rails |\n| `fw.laravel` | Laravel | 176×56 |  |\n| `fw.dotnet` | .NET | 176×56 |  |\n| `fw.react` | React | 176×56 |  |\n| `fw.vue` | Vue | 176×56 | vuejs |\n| `fw.angular` | Angular | 176×56 |  |\n| `fw.next` | Next.js | 176×56 | nextjs |\n| `fw.nuxt` | Nuxt | 176×56 | nuxtjs |\n| `fw.svelte` | Svelte | 176×56 | sveltekit |\n| `fw.electron` | Electron | 176×56 |  |\n| `fw.tailwind` | Tailwind | 176×56 | tailwindcss |\n| `fw.graphql` | GraphQL | 176×56 |  |\n\n## DevOps / CI-CD (`devops`)\n\n| Type | Label | Default size | Aliases |\n| --- | --- | --- | --- |\n| `ops.docker` | Docker | 176×56 |  |\n| `ops.k8s` | Kubernetes | 176×56 | k8s |\n| `ops.nginx` | Nginx | 176×56 |  |\n| `ops.haproxy` | HAProxy | 176×56 | lb |\n| `ops.traefik` | Traefik | 176×56 | traefik |\n| `ops.terraform` | Terraform | 176×56 | iac |\n| `ops.ansible` | Ansible | 176×56 |  |\n| `ops.jenkins` | Jenkins | 176×56 | ci |\n| `ops.gha` | GitHub Actions | 176×56 | ci, actions |\n| `ops.gitlab` | GitLab CI | 176×56 | ci |\n| `ops.argocd` | ArgoCD | 176×56 | gitops |\n| `ops.helm` | Helm | 176×56 |  |\n| `ops.istio` | Istio | 176×56 | service mesh |\n| `ops.envoy` | Envoy | 176×56 | proxy |\n| `ops.consul` | Consul | 176×56 |  |\n| `ops.vault` | Vault | 176×56 | secrets |\n| `ops.pm2` | PM2 | 176×56 |  |\n| `ops.maven` | Maven | 176×56 | build |\n\n## Auth / Identity (`auth`)\n\n| Type | Label | Default size | Aliases |\n| --- | --- | --- | --- |\n| `auth.oidc` | OpenID Connect | 176×56 | oidc |\n| `auth.jwt` | JWT | 176×56 | token |\n| `auth.keycloak` | Keycloak | 176×56 |  |\n| `auth.auth0` | Auth0 | 176×56 |  |\n| `auth.okta` | Okta | 176×56 |  |\n| `auth.firebase` | Firebase Auth | 176×56 | firebase |\n| `auth.oauth` | OAuth 2.0 | 176×56 | oauth |\n| `auth.saml` | SAML | 176×56 |  |\n| `auth.ldap` | LDAP | 176×56 |  |\n\n## Observability (`observability`)\n\n| Type | Label | Default size | Aliases |\n| --- | --- | --- | --- |\n| `obs.prometheus` | Prometheus | 176×56 | metrics |\n| `obs.grafana` | Grafana | 176×56 | dashboard |\n| `obs.datadog` | Datadog | 176×56 |  |\n| `obs.sentry` | Sentry | 176×56 | errors |\n| `obs.elasticsearch` | Elasticsearch | 176×56 | elk |\n| `obs.logstash` | Logstash | 176×56 | elk |\n| `obs.kibana` | Kibana | 176×56 | elk |\n| `obs.jaeger` | Jaeger | 176×56 | tracing |\n| `obs.otel` | OpenTelemetry | 176×56 | otel, tracing |\n| `obs.newrelic` | New Relic | 176×56 |  |\n\n## AWS (`aws`)\n\n| Type | Label | Default size | Aliases |\n| --- | --- | --- | --- |\n| `aws.ec2` | EC2 | 176×56 | aws |\n| `aws.lambda` | Lambda | 176×56 | aws |\n| `aws.s3` | S3 | 176×56 | aws |\n| `aws.ebs` | EBS | 176×56 | aws |\n| `aws.efs` | EFS | 176×56 | aws |\n| `aws.rds` | RDS | 176×56 | aws |\n| `aws.aurora` | Aurora | 176×56 | aws |\n| `aws.dynamodb` | DynamoDB | 176×56 | aws |\n| `aws.elasticache` | ElastiCache | 176×56 | aws |\n| `aws.redshift` | Redshift | 176×56 | aws |\n| `aws.vpc` | VPC | 176×56 | aws |\n| `aws.subnet` | Subnet | 176×56 | aws |\n| `aws.internet-gateway` | Internet Gateway | 176×56 | aws |\n| `aws.nat-gateway` | NAT Gateway | 176×56 | aws |\n| `aws.elb` | ELB | 176×56 | aws |\n| `aws.alb` | ALB | 176×56 | aws |\n| `aws.nlb` | NLB | 176×56 | aws |\n| `aws.api-gateway` | API Gateway | 176×56 | aws |\n| `aws.cloudfront` | CloudFront | 176×56 | aws |\n| `aws.route-53` | Route 53 | 176×56 | aws |\n| `aws.sqs` | SQS | 176×56 | aws |\n| `aws.sns` | SNS | 176×56 | aws |\n| `aws.eventbridge` | EventBridge | 176×56 | aws |\n| `aws.kinesis` | Kinesis | 176×56 | aws |\n| `aws.step-functions` | Step Functions | 176×56 | aws |\n| `aws.ecs` | ECS | 176×56 | aws |\n| `aws.eks` | EKS | 176×56 | aws |\n| `aws.fargate` | Fargate | 176×56 | aws |\n| `aws.ecr` | ECR | 176×56 | aws |\n| `aws.iam` | IAM | 176×56 | aws |\n| `aws.cognito` | Cognito | 176×56 | aws |\n| `aws.secrets-manager` | Secrets Manager | 176×56 | aws |\n| `aws.kms` | KMS | 176×56 | aws |\n| `aws.cloudwatch` | CloudWatch | 176×56 | aws |\n| `aws.cloudtrail` | CloudTrail | 176×56 | aws |\n| `aws.glue` | Glue | 176×56 | aws |\n| `aws.athena` | Athena | 176×56 | aws |\n| `aws.sagemaker` | SageMaker | 176×56 | aws |\n| `aws.appsync` | AppSync | 176×56 | aws |\n| `aws.amplify` | Amplify | 176×56 | aws |\n\n## Azure (`azure`)\n\n| Type | Label | Default size | Aliases |\n| --- | --- | --- | --- |\n| `azure.virtual-machine` | Virtual Machine | 176×56 | azure |\n| `azure.vm-scale-set` | VM Scale Set | 176×56 | azure |\n| `azure.app-service` | App Service | 176×56 | azure |\n| `azure.functions` | Functions | 176×56 | azure |\n| `azure.container-instances` | Container Instances | 176×56 | azure |\n| `azure.aks` | AKS | 176×56 | azure |\n| `azure.container-registry` | Container Registry | 176×56 | azure |\n| `azure.blob-storage` | Blob Storage | 176×56 | azure |\n| `azure.files` | Files | 176×56 | azure |\n| `azure.disk` | Disk | 176×56 | azure |\n| `azure.sql-database` | SQL Database | 176×56 | azure |\n| `azure.cosmos-db` | Cosmos DB | 176×56 | azure |\n| `azure.cache-for-redis` | Cache for Redis | 176×56 | azure |\n| `azure.synapse` | Synapse | 176×56 | azure |\n| `azure.virtual-network` | Virtual Network | 176×56 | azure |\n| `azure.load-balancer` | Load Balancer | 176×56 | azure |\n| `azure.application-gateway` | Application Gateway | 176×56 | azure |\n| `azure.front-door` | Front Door | 176×56 | azure |\n| `azure.service-bus` | Service Bus | 176×56 | azure |\n| `azure.event-hub` | Event Hub | 176×56 | azure |\n| `azure.event-grid` | Event Grid | 176×56 | azure |\n| `azure.key-vault` | Key Vault | 176×56 | azure |\n| `azure.entra-id` | Entra ID | 176×56 | azure |\n| `azure.monitor` | Monitor | 176×56 | azure |\n| `azure.application-insights` | Application Insights | 176×56 | azure |\n| `azure.logic-apps` | Logic Apps | 176×56 | azure |\n| `azure.api-management` | API Management | 176×56 | azure |\n\n## GCP (`gcp`)\n\n| Type | Label | Default size | Aliases |\n| --- | --- | --- | --- |\n| `gcp.compute-engine` | Compute Engine | 176×56 | gcp, google |\n| `gcp.app-engine` | App Engine | 176×56 | gcp, google |\n| `gcp.cloud-functions` | Cloud Functions | 176×56 | gcp, google |\n| `gcp.cloud-run` | Cloud Run | 176×56 | gcp, google |\n| `gcp.gke` | GKE | 176×56 | gcp, google |\n| `gcp.artifact-registry` | Artifact Registry | 176×56 | gcp, google |\n| `gcp.cloud-storage` | Cloud Storage | 176×56 | gcp, google |\n| `gcp.persistent-disk` | Persistent Disk | 176×56 | gcp, google |\n| `gcp.cloud-sql` | Cloud SQL | 176×56 | gcp, google |\n| `gcp.cloud-spanner` | Cloud Spanner | 176×56 | gcp, google |\n| `gcp.firestore` | Firestore | 176×56 | gcp, google |\n| `gcp.bigtable` | Bigtable | 176×56 | gcp, google |\n| `gcp.bigquery` | BigQuery | 176×56 | gcp, google |\n| `gcp.memorystore` | Memorystore | 176×56 | gcp, google |\n| `gcp.vpc` | VPC | 176×56 | gcp, google |\n| `gcp.cloud-load-balancing` | Cloud Load Balancing | 176×56 | gcp, google |\n| `gcp.cloud-cdn` | Cloud CDN | 176×56 | gcp, google |\n| `gcp.cloud-dns` | Cloud DNS | 176×56 | gcp, google |\n| `gcp.pub-sub` | Pub/Sub | 176×56 | gcp, google |\n| `gcp.dataflow` | Dataflow | 176×56 | gcp, google |\n| `gcp.cloud-tasks` | Cloud Tasks | 176×56 | gcp, google |\n| `gcp.iam` | IAM | 176×56 | gcp, google |\n| `gcp.secret-manager` | Secret Manager | 176×56 | gcp, google |\n| `gcp.cloud-kms` | Cloud KMS | 176×56 | gcp, google |\n| `gcp.cloud-monitoring` | Cloud Monitoring | 176×56 | gcp, google |\n| `gcp.vertex-ai` | Vertex AI | 176×56 | gcp, google |\n",
     "feature-policy": "<!-- GENERATED FILE — do not edit by hand. Source: callman_core (npm run ai:packs). -->\n\n# Script feature policy\n\nSome `pm.*` features can be disabled per execution context (ScriptFeaturePolicy). A disabled feature evaluates to `undefined` at top level; inside `pm.test` callbacks it throws so the test reports SKIPPED instead of failing.\n\nCapability-gated members:\n\n## database\n\n- `pm.db.query({ connectionId, query })`\n- `pm.db.pre`\n- `pm.db.post`\n\n## kafka\n\n- `pm.kafka.event()`\n- `pm.kafka.messages()`\n\n## redis\n\n- `pm.redis.command({ connectionId, command })`\n- `pm.redis.get(key)`\n- `pm.redis.results.pre`\n- `pm.redis.results.post`\n\nGeneration guidance: prefer declared pre/post queries and `pm.db.query` only when the user explicitly asks for database work; never assume kafka/redis capabilities exist unless the task mentions them.\n",
     "pm-api": "<!-- GENERATED FILE — do not edit by hand. Source: callman_core (npm run ai:packs). -->\n\n# Callman `pm.*` scripting API\n\nScripts are plain JavaScript (top-level `await` allowed). Use ONLY the API below — anything else (fetch, require, process, Buffer, ...) is blocked by the sandbox.\n\n## pm.test\n\nRegister a named test. The callback's assertion failures mark the test failed without aborting the script.\n\n- `pm.test(name, fn)` — Runs fn (sync or async); pass/fail lands in the run's test results.\n\n## pm.expect\n\nChai-style assertions plus Jest-style matchers.\n\n- `pm.expect(value)` — Assertion chain. Equality: .to.equal(x) (identity), .to.eql(x) / .to.deep.equal(x) / .toEqual(x) (deep). Existence: .to.exist, .toBeDefined(), .toBeNull(). Strings/arrays: .to.include(x) / .toContain(x), .oneOf([..]). Numbers: .toBeGreaterThan / .toBeLessThan / .to.be.above(n) / .to.be.below(n). Types: .to.be.a('string'|'number'|...). Negation: .to.not.<...> / .not.<matcher>. Properties: .to.have.property('name', value?).\n- `pm.expect.fail(message?)` — Fails the surrounding test immediately.\n\n## pm.environment\n\nActive environment variables (alias: pm.env). Writes are scoped to the run and surface as variable mutations.\n\n- `pm.environment.get(key)` — Read a variable (string or undefined).\n- `pm.environment.set(key, value)` — Write a variable for subsequent steps.\n- `pm.environment.unset(key)` — Remove a variable.\n- `pm.environment.has(key)` — true when the key exists.\n- `pm.environment.clear()` — Remove every variable in the scope.\n- `pm.environment.toObject()` — Plain { key: value } snapshot.\n- `pm.environment.replaceIn(template)` — Resolve {{tokens}} inside a string.\n- `pm.environment.name` — Active environment's name.\n\n## pm.globals\n\nWorkspace-level global variables. Same surface as pm.environment.\n\n- `pm.globals.get(key)` — Read a global.\n- `pm.globals.set(key, value)` — Write a global for the run.\n- `pm.globals.unset(key)` — Remove a global.\n- `pm.globals.has(key)` — true when the key exists.\n- `pm.globals.clear()` — Remove every global in the scope.\n- `pm.globals.toObject()` — Plain snapshot.\n- `pm.globals.replaceIn(template)` — Resolve {{tokens}} inside a string.\n\n## pm.collectionVariables\n\nCollection-scoped variables that survive across requests within one collection run iteration.\n\n- `pm.collectionVariables.get(key)` — Read a collection variable.\n- `pm.collectionVariables.set(key, value)` — Write; persists across the iteration.\n- `pm.collectionVariables.unset(key)` — Remove a collection variable.\n- `pm.collectionVariables.has(key)` — true when the key exists.\n- `pm.collectionVariables.clear()` — Remove all collection variables.\n- `pm.collectionVariables.toObject()` — Plain snapshot.\n- `pm.collectionVariables.replaceIn(template)` — Resolve {{tokens}}.\n\n## pm.variables\n\nLayered read across all scopes (per-iteration > environment > globals) plus template resolution.\n\n- `pm.variables.get(key)` — Read through the precedence chain.\n- `pm.variables.set(key, value)` — Write to the run-local layer.\n- `pm.variables.unset(key)` — Remove from the run-local layer.\n- `pm.variables.has(key)` — true when any layer has the key.\n- `pm.variables.toObject()` — Merged snapshot.\n- `pm.variables.replaceIn(template)` — Resolve {{tokens}} in a string.\n- `pm.variables.resolve(template)` — Like replaceIn, but also resolves scenario node-output references.\n\n## pm.request\n\nThe outgoing request. Mutations only have effect in pre-request scripts (the call has not fired yet).\n\n- `pm.request.url` — Resolved URL string.\n- `pm.request.method` — HTTP method.\n- `pm.request.body` — Body snapshot (mode + content).\n- `pm.request.headers` — HeaderList: .all() .get(name) .has(name) .add({key,value}) .upsert({key,value}) .remove(name) .idx(i).\n- `pm.request.query` — Query params as a HeaderList.\n- `pm.request.getHeader(name)` — Read one header value.\n- `pm.request.setHeader(name, value)` — Set/replace a header. _(stages: pre-request, scenario-script)_\n- `pm.request.unsetHeader(name)` — Remove a header. _(stages: pre-request, scenario-script)_\n- `pm.request.getQueryParam(name)` — Read one query param.\n- `pm.request.setQueryParam(name, value)` — Set/replace a query param. _(stages: pre-request, scenario-script)_\n- `pm.request.unsetQueryParam(name)` — Remove a query param. _(stages: pre-request, scenario-script)_\n- `pm.request.setUrl(url)` — Replace the URL. _(stages: pre-request, scenario-script)_\n- `pm.request.setMethod(method)` — Replace the method. _(stages: pre-request, scenario-script)_\n- `pm.request.setRawBody(value)` — Replace the raw body (string or object → JSON). _(stages: pre-request, scenario-script)_\n\n## pm.response\n\nThe received response. Not available in pre-request scripts.\n\n- `pm.response.code` — Status code (number). _(stages: post-response, tests, scenario-script)_\n- `pm.response.status` — Status code (number, alias). _(stages: post-response, tests, scenario-script)_\n- `pm.response.statusText` — Status text. _(stages: post-response, tests, scenario-script)_\n- `pm.response.json()` — Parsed JSON body — call once into a const (`const body = pm.response.json()`); throws on non-JSON, so guard with try/catch or pm.response.to.be.json when the content type is uncertain. _(stages: post-response, tests, scenario-script)_\n- `pm.response.text()` — Raw body as string. _(stages: post-response, tests, scenario-script)_\n- `pm.response.rawBody` — Raw body string. _(stages: post-response, tests, scenario-script)_\n- `pm.response.headers` — Response HeaderList. _(stages: post-response, tests, scenario-script)_\n- `pm.response.responseTime` — Duration in ms. _(stages: post-response, tests, scenario-script)_\n- `pm.response.responseSize` — Body size in bytes. _(stages: post-response, tests, scenario-script)_\n- `pm.response.to.have.status(code)` — Assertion shortcuts; also .to.have.header/.jsonBody/.body and .to.be.ok/.json/.success/.clientError/... plus .to.not.<predicate>. _(stages: post-response, tests, scenario-script)_\n\n## pm.sendRequest\n\nFire an ad-hoc HTTP request from inside a script.\n\n- `pm.sendRequest(urlOrOptions, callback?)` — Options: { url, method, header: {name: value}, body }. Body accepts a plain object (auto-JSON) OR Postman style { mode: 'raw', raw: JSON.stringify({...}) } / { mode: 'urlencoded', urlencoded: [{key, value}] }. Prefer `const res = await pm.sendRequest({...})`; callback form gets (err, res). The response object is { code, status, statusText, headers, body, responseTime, json(), text() } — note it is NOT pm.response.\n\n## pm.db\n\nDatabase access (Oracle / MongoDB / PostgreSQL / MySQL). Disabled by feature policy in some contexts — tests then report SKIP.\n\n- `pm.db.query({ connectionId, query })` — Run an ad-hoc query — ALWAYS await it. SQL connections (Oracle/Postgres/MySQL): `query` is the SQL text. MongoDB: `query` is a JSON STRING of a command object, e.g. `JSON.stringify({ collection: 'users', operation: 'findOne', filter: { email } })` — operation is find|findOne|aggregate|countDocuments|insertOne|updateOne|deleteOne|…, the match key is `filter` (NOT a `db.coll.find(...)` shell string and NOT `query`), and aggregate uses `pipeline`. Resolves to { success, error, rowCount, rows, firstRow(), connectionId, connectionName, connectionType, durationMs, executedAt }. firstRow is a FUNCTION: res.firstRow()?.STATUS (Oracle columns are UPPERCASE); for a Mongo existence check assert rowCount > 0. _(requires the database capability — may be disabled by feature policy)_\n- `pm.db.pre` — Result object of the declared pre-request DB query: { success, error, rowCount, rows, firstRow() }. Not a promise — read directly. _(requires the database capability — may be disabled by feature policy)_\n- `pm.db.post` — Result object of the declared post-response DB query (same shape as pm.db.pre). _(stages: post-response, tests)_ _(requires the database capability — may be disabled by feature policy)_\n\n## pm.kafka\n\nCaptured Kafka events from the request's Kafka tab listener.\n\n- `pm.kafka.event()` — The matched event's parsed payload (or null). _(stages: post-response, tests)_ _(requires the kafka capability — may be disabled by feature policy)_\n- `pm.kafka.messages()` — Every captured message in the listen window. _(stages: post-response, tests)_ _(requires the kafka capability — may be disabled by feature policy)_\n\n## pm.redis\n\nRun ad-hoc Redis commands and read results of declared pre/post commands.\n\n- `pm.redis.command({ connectionId, command })` — Run an ad-hoc Redis command (GET/SET/DEL/EXISTS/TTL) — ALWAYS await it. Resolves to { success, error, result, resultText, commandName, key, connectionId, connectionName, command, resolvedCommand, durationMs, executedAt }. Omit connectionId to use the request's configured Redis connection. _(requires the redis capability — may be disabled by feature policy)_\n- `pm.redis.get(key)` — Read a value already captured by a declared GET. _(requires the redis capability — may be disabled by feature policy)_\n- `pm.redis.results.pre` — Array of pre-stage command results (by line index). _(requires the redis capability — may be disabled by feature policy)_\n- `pm.redis.results.post` — Array of post-stage command results. _(stages: post-response, tests)_ _(requires the redis capability — may be disabled by feature policy)_\n\n## pm.random\n\nDeterministic-format random data generators.\n\n- `pm.random.uuid()` — UUID v4.\n- `pm.random.email()` — Random email address.\n- `pm.random.string(length?)` — Alphanumeric string.\n- `pm.random.int(min, max)` — Integer in range.\n- `pm.random.bigdecimal(min, max, scale)` — Decimal with given scale.\n- `pm.random.boolean()` — true/false.\n- `pm.random.phone()` — Phone number string.\n- `pm.random.name()` — Person name.\n- `pm.random.date(format?)` — Date string.\n\n## pm.counter\n\nMonotonic counter scoped to the run.\n\n- `pm.counter.next()` — Next value (starts at 1).\n- `pm.counter.start(startAt?)` — Counter starting at a custom value.\n\n## pm.info\n\nExecution metadata snapshot.\n\n- `pm.info.eventName` — \"prerequest\" | \"test\".\n- `pm.info.iteration` — Zero-based data-driven iteration index.\n- `pm.info.iterationCount` — Total iterations — only meaningful in collection/data-driven runs. Never use it to gate token/cache logic in single sends.\n- `pm.info.requestName` — Current request's name.\n- `pm.info.requestId` — Current request's id.\n\n## pm.execution\n\nCollection-run flow control.\n\n- `pm.execution.setNextRequest(name)` — Jump to a named request next (collection runs).\n- `pm.execution.skipRequest()` — Skip the current request. _(stages: pre-request)_\n- `pm.execution.location` — Folder path of the current request.\n\n## pm.node\n\nScenario workflow context (only meaningful inside scenario script nodes).\n\n- `pm.node.nodeLabel` — Current node's label. _(stages: scenario-script)_\n- `pm.node.setNextRequest(name)` — Route the workflow to a named node. _(stages: scenario-script)_\n\n## pm.log\n\nStructured logging into the run report.\n\n- `pm.log(...args)` — Like console.log; entries land in the run's log panel.\n\n## CryptoJS\n\ncrypto-js global (NOT under pm.*).\n\n- `CryptoJS.SHA256(msg) / SHA1 / SHA512 / MD5` — Hashes; .toString() or .toString(CryptoJS.enc.Hex).\n- `CryptoJS.HmacSHA256(msg, key)` — HMAC family (SHA1/224/384/512, MD5 variants).\n- `CryptoJS.AES.encrypt(msg, key) / .decrypt(cipher, key)` — AES; decrypt result needs .toString(CryptoJS.enc.Utf8).\n- `CryptoJS.PBKDF2(password, salt, options)` — Key derivation.\n- `CryptoJS.enc.Utf8 / Base64 / Hex / Latin1` — Encoders for .toString(...).\n- `CryptoJS.lib.WordArray.create / random(n)` — Raw word arrays (e.g. random IVs).\n\n## _\n\nlodash global (NOT under pm.*).\n\n- `_.get(obj, path, default?) / _.pick / _.groupBy / _.sortBy / _.uniq / ...` — Full lodash surface for data wrangling.\n\n## timers\n\nSafe per-execution timer wrappers (callbacks never outlive the run).\n\n- `setTimeout(fn, ms) / clearTimeout(id)` — Use with await new Promise(r => setTimeout(r, ms)) for polling loops.\n- `setInterval(fn, ms) / clearInterval(id)` — Interval variant.\n\n## Stage rules\n\n- `pre-request`: runs BEFORE the HTTP call. `pm.response` does not exist; `pm.request` mutations take effect.\n- `post-response` / `tests`: run AFTER the call. `pm.response` is available; `pm.request` mutations have no effect.\n- `scenario-script`: a scenario Script node. Prior node outputs are readable via `pm.variables.resolve(\"{{NodeLabel.path}}\")`; the script's return value becomes the node output.\n- Members without a stage note are available in every stage.\n",
     "sandbox-globals": "<!-- GENERATED FILE — do not edit by hand. Source: callman_core (npm run ai:packs). -->\n\n# Script sandbox — available and blocked globals\n\nThe sandbox is a Node `vm` context. Generated code must never reference a blocked global — the script fails at runtime.\n\n## Available built-ins\n\n`AggregateError`, `Array`, `ArrayBuffer`, `BigInt`, `BigInt64Array`, `BigUint64Array`, `Boolean`, `DataView`, `Date`, `Error`, `EvalError`, `Float32Array`, `Float64Array`, `Infinity`, `Int16Array`, `Int32Array`, `Int8Array`, `JSON`, `Map`, `Math`, `NaN`, `Number`, `Object`, `Promise`, `RangeError`, `ReferenceError`, `RegExp`, `Set`, `String`, `Symbol`, `SyntaxError`, `TextDecoder`, `TextEncoder`, `TypeError`, `URIError`, `URL`, `URLSearchParams`, `Uint16Array`, `Uint32Array`, `Uint8Array`, `Uint8ClampedArray`, `WeakMap`, `WeakSet`, `atob`, `btoa`, `decodeURIComponent`, `encodeURIComponent`, `isFinite`, `isNaN`, `parseFloat`, `parseInt`, `structuredClone`, `undefined`\n\nPlus the injected helpers: `pm`, `console`, `CryptoJS`, `_` (lodash), `setTimeout`/`clearTimeout`/`setInterval`/`clearInterval` (safe per-run wrappers).\n\n## Blocked (never use)\n\n`Buffer`, `Function`, `WebSocket`, `Worker`, `XMLHttpRequest`, `document`, `eval`, `exports`, `fetch`, `global`, `globalThis`, `importScripts`, `module`, `navigator`, `process`, `require`, `self`, `window`\n\nNotes:\n- No `fetch` — use `pm.sendRequest` for HTTP.\n- No `Buffer` — use `atob`/`btoa`/`TextEncoder`/`Uint8Array`.\n- No `require`/`import` — `CryptoJS` and `_` are already in scope.\n",
-    "scenario-nodes": "<!-- GENERATED FILE — do not edit by hand. Source: callman_core (npm run ai:packs). -->\n\n# Scenario node reference\n\nA scenario is a directed graph: nodes do the work, edges decide what runs next. This reference is for clients that write scenarios through the API or an MCP tool; every rule below is what the server enforces on save or what the run engine does.\n\n## Scenario shape\n\nCompact form (what the MCP scenario tools take):\n\n```json\n{\n  \"name\": \"Order flow\",\n  \"description\": \"optional\",\n  \"priority\": \"high\",\n  \"nodes\": [\n    {\n      \"id\": \"login\",\n      \"type\": \"request\",\n      \"label\": \"Login\",\n      \"config\": {\n        \"method\": \"POST\",\n        \"url\": \"{{env.baseUrl}}/login\"\n      }\n    },\n    {\n      \"id\": \"done\",\n      \"type\": \"end\",\n      \"label\": \"Done\"\n    }\n  ],\n  \"edges\": [\n    {\n      \"source\": \"login\",\n      \"target\": \"done\"\n    }\n  ],\n  \"environments\": [\n    {\n      \"name\": \"Default\",\n      \"variables\": [\n        {\n          \"key\": \"baseUrl\",\n          \"value\": \"https://api.example.com\"\n        }\n      ]\n    }\n  ]\n}\n```\n\n- Node `{ id?, type, label?, config?, position? }`. `id` defaults to n1, n2, …; `position` is laid out when omitted.\n- `config` is deep-merged over the type's defaults (the Default column): objects merge key by key, arrays and scalars replace the default whole. Send only what you change — but an array you send (headers, checks, steps, rules, assignments) must be complete.\n- Edge `{ id?, source, target, type? }`, `type` = `default` (or omitted) | `yes` | `no` | `error`. Edges have no label.\n- `priority`: critical | high | medium | low. `environments[].variables`: `{ key, value, enabled? }[]`.\n- Stored form (the REST API, and the body of `foreach` / `subscenario` / `scenario-ref`): node `{ id, type, position: { x, y }, data: { label, config } }` with the COMPLETE config — nothing is merged — and edge `{ id, source, target, type? }` with a required `id`.\n\nReq column: **yes** = rejected on save without a real value; **run** = saved, but the run fails without it. Default \"(engine)\" = applied at run time when the field is absent.\n\n## Connections\n\ndb, redis, kafka, notification and ai nodes run on a workspace connection: `config.connectionId` is the id of a connection of type `database`, `redis`, `kafka`, `notification` (Slack) or `ai` (managed). Use a real connection id from the workspace — never invent one. Only the ai node rejects an empty id on save; the others save with `\"\"` and fail when run.\n\n## Labels\n\n- `label` names a node's output: later nodes read `{{Label.path}}`. It is optional on save, but an unlabelled node's output cannot be referenced.\n- Labels must be unique across the whole scenario, including foreach / subscenario bodies: a repeated label is overwritten by whichever node ran last.\n- Reserved labels — the engine drops the output of a node labelled `workflow`, `__meta`, `loop`, `loops`, `item`, `each`, `eaches`, `ws`, so references to it resolve to empty without any error.\n- Avoid labels that are built-in roots — `response`, `lastResponse`, `data`, `env`, `global`, `globals`, `db`, `redis`, `kafkaEvent`, `kafkaevent` — the node and the root shadow each other.\n- Prefer identifier labels (`Login`, `CreateOrder`, `check_db`). Script nodes get a label as a global variable only when it is an identifier and not a sandbox name (`pm`, `env`, `console`, `request`, `response`, `test`, `expect`, `workflow`, `db`, `kafka`, `redis`, …).\n\n## Templates and outputs\n\n- `{{env.KEY}}` / `{{global.KEY}}` read one scope; a bare `{{KEY}}` reads both (in scenario runs a global wins when both define KEY). `{{data.column}}` is the current dataset row.\n- `{{Label.path}}` (or `{Label.path}`) reads an earlier node's output; arrays by index (`items[0].id`), no wildcards. `{{response.*}}` is the most recent request's response. Generators: `{{$randomUUID}}`, `{{$timestamp}}`, `{{random.email}}`, `{{counter}}`.\n- Substitution is plain text — quote SQL strings yourself (`WHERE id = '{{userId}}'`). A missing value resolves to an empty string.\n- A request's output: `<Label>.status` is the HTTP status (number). Read body fields through `<Label>.body.<path>`: top-level body keys are also spread onto the output, but `status`, `statusText`, `data`, `body`, `rawBody`, `text`, `headers`, `cookies`, `durationMs` are HTTP metadata and win over same-named body keys. `<Label>.data.<path>` reads a body's top-level `data`.\n- Operand paths (rules, `foreach.itemsPath`, set-vars `source`) are BARE dotted paths without braces: `CreateOrder.body.total`, `CheckOrder.rows[0].status`.\n\n## Rules and operands\n\nShared by condition, assertion, poll, websocket expect steps and `end.loopExitRule`.\n\n- Rule `{ id, type: \"rule\", left, operator, right? }` — `id` and `type: \"rule\"` are required; `right` is required unless the operator is unary.\n- Group `{ id, type: \"group\", operator: \"AND\" | \"OR\", children: [Rule | Group, …] }` with at least one child.\n- Operand `{ mode: \"runtime\" | \"literal\", valueType: \"string\" | \"number\" | \"boolean\" | \"null\" | \"array\", value, extract? }`. runtime: `value` is a bare path. literal: a JSON number for number, true/false for boolean, null for null, a JSON array for array.\n- Binary operators: equals, not_equals, strict_equals, strict_not_equals, greater_than, less_than, greater_or_equal, less_or_equal, between, contains, not_contains, starts_with, ends_with, regex, in, not_in, contains_row, set_equals_unordered. `between` takes [min, max]; `in` / `not_in` an array; `regex` a JS regex source; `contains_row` checks that an array of rows has one matching every key of an object (a JSON-object string literal or a runtime path); `set_equals_unordered` compares two arrays as multisets.\n- Unary operators (no `right`): exists, not_exists, is_empty, not_empty, is_null, not_null.\n- `extract` `{ type: \"jsonpath\" | \"regex\", expression, flags?, group?, select?: \"first\" | \"all\" }` is applied to the resolved value first; a failed extraction behaves as not-exists.\n\nExample: `{ \"id\": \"r1\", \"type\": \"rule\", \"left\": { \"mode\": \"runtime\", \"valueType\": \"number\", \"value\": \"CreateOrder.status\" }, \"operator\": \"equals\", \"right\": { \"mode\": \"literal\", \"valueType\": \"number\", \"value\": 201 } }`\n\n## Contract rules\n\nEach rule's `rules` object may use ONLY these keys (omit the rest):\n- common: required(bool), type(string|number|boolean|object|array|null), equals(string|number|bool), notEmpty(bool)\n- number: min,max,greaterThan,lessThan(number); integer,positive,negative,nonZero(bool)\n- string: minLength,maxLength(int); pattern,contains,notContains,startsWith,endsWith(string); caseSensitive(bool); enumValues(array); format(enum)\n- array: minItems,maxItems(int); sorted({order:asc|desc,field?}); unique({mode:whole|byField,fields?})\n- object: requiredKeys,forbiddenKeys(string[]); minProperties,maxProperties(int); strictSchema(bool)\n- format values: email, url, uuid, uuidV1, uuidV4, uuidV7, jwt, base64, base64url, base64Pdf, base64Png, base64Jpeg, base64Gif, base64Webp, base64Image, base64Zip, base64Office, datetime, date, time, ipv4, ipv6, hostname, json, numeric, integer, alpha, alphanumeric, hex, hexColor, slug, semver, objectId, creditCard, phone\n\n## Execution policy\n\nEvery node except condition takes `executionPolicy: { onFailure: \"stop\" | \"continue\", retry: { enabled, maxAttempts (0..100), delayMs (0..3600000), backoffMultiplier? (1..10), maxDelayMs? (0..3600000) } }` — onFailure and retry.enabled / maxAttempts / delayMs are required when you send the stored form.\n- `maxAttempts` counts every attempt (an enabled retry makes at least 2). Delay before retry n = min(maxDelayMs, delayMs × backoffMultiplier^(n−1)). No policy = stop, no retry.\n- stop: a failure ends the run; continue: the run goes on along the normal edges.\n- `error` edges from the failing node win over both: the run follows them instead of the normal edges (after the retries).\n\n## Node types\n\n### request\nOne HTTP call.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `method` | string | `\"GET\"` |  | HTTP verb. |\n| `url` | string (≤10000) | `\"\"` | run | Absolute URL; `{{…}}` allowed. Its own `?query` is used only when `query` has no enabled rows. |\n| `headers` | {key, value, enabled?}[] | `[]` |  | Disabled rows are not sent. A Content-Type row beats the automatic one (formdata always uses the driver's multipart type). |\n| `query` | {key, value, enabled?}[] | `[]` |  |  |\n| `body.mode` | none \\| raw \\| formdata \\| urlencoded | `\"none\"` |  |  |\n| `body.raw` | string | `\"\"` |  | mode raw. JSON text that still parses after templating is sent as JSON. |\n| `body.rawLanguage` | json \\| xml \\| text \\| html | — |  | With no Content-Type header, sets application/json, application/xml, text/plain or text/html (json when absent). |\n| `body.formEntries` | {key, value, enabled?, type?, fixtureId?, fileName?}[] | `[]` |  | formdata / urlencoded rows. A `type:\"file\"` row needs `fixtureId` (an uploaded workspace fixture file) — server runs fail it otherwise. |\n| `auth.type` | none \\| bearer \\| basic \\| apikey \\| oauth2 | `\"none\"` |  |  |\n| `auth.bearerToken` | string | `\"\"` |  | bearer → `Authorization: Bearer <token>`. |\n| `auth.basicUsername / auth.basicPassword` | string | `\"\"` |  | basic → base64 `user:password`. |\n| `auth.apiKeyKey / auth.apiKeyValue` | string | `\"\"` |  | apikey → sends `key: value`; skipped when the key is blank. |\n| `auth.apiKeyLocation` | header \\| query | `\"header\"` |  |  |\n| `auth.oauth2` | {grantType, tokenUrl, clientId, clientSecret, scope, username, password, refreshToken, clientAuth, audience} | — |  | oauth2: when present ALL ten keys are required (send \"\" for unused ones); grantType client_credentials \\| password \\| refresh_token; clientAuth basic \\| body. The token is fetched (and cached) before the call and sent as a Bearer header. Without it, type oauth2 sends no Authorization. |\n| `preRequestScript / postResponseScript / testsScript` | string | `\"\"` |  | `pm.*` scripts: before the call / after the response / assertions (`pm.test`). |\n| `contractAssertions` | {id, path, enabled, rules, engine?, namespaces?}[] (≤200) | `[]` |  | id, path, enabled and rules are required; `rules` needs ≥1 key (see Contract rules). `path` is a dot-path over the parsed body (`data.items[0].id`, `items[].id` = every element); with engine \"xpath\" it is an XPath over the raw XML and every prefix must be in `namespaces` {prefix: uri}. |\n| `expectedStatus` | string (≤200) | — |  | Negative testing: `\"201\"`, `\"4xx\"`, `\"200-299\"`, `\"200,204\"`, templates allowed. When set the node passes iff the status matches (instead of 2xx/3xx); contract assertions and test scripts can still fail it. |\n| `responseSchema` | JSON Schema object | — |  | Validated against the response body; a mismatch fails the node. |\n| `clientCertificate` | {enabled, format, pfxBase64?, certPem?, keyPem?, passphrase?, caPem?, rejectUnauthorized?} | — |  | mTLS. enabled and format (\"pfx\" \\| \"pem\") are required; pfx uses pfxBase64, pem uses certPem + keyPem. Server runs present the certificate whenever this object is set — omit it to send none. |\n| `soap` | {enabled, version, action?, wsSecurity?} | — |  | version \"1.1\" \\| \"1.2\". Keep the full envelope in body.raw (rawLanguage \"xml\"); Content-Type/SOAPAction come from the version (a Content-Type header wins). wsSecurity {enabled, username, password, passwordType: text \\| digest} injects a UsernameToken at send time. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: `<Label>.status` (number), `<Label>.body.<path>`, `<Label>.headers`, `<Label>.text`, `<Label>.durationMs`. The most recent request is also `response.*`.\n\n```json\n{\"id\":\"login\",\"type\":\"request\",\"label\":\"Login\",\"config\":{\"method\":\"POST\",\"url\":\"{{env.baseUrl}}/login\",\"body\":{\"mode\":\"raw\",\"raw\":\"{\\\"user\\\":\\\"{{env.user}}\\\",\\\"password\\\":\\\"{{env.password}}\\\"}\",\"rawLanguage\":\"json\"},\"expectedStatus\":\"200\"}}\n```\n\n### db\nOne query on a workspace connection of type `database`.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `connectionId` | string | `\"\"` | run | `\"\"` = not chosen yet: saved, but the run fails. |\n| `query` | string (1..100000) | `\"SELECT *\\nFROM users\\nWHERE id = {{env.userId}}\"` | yes | Mongo: a JSON command-object string (`{\"collection\":\"orders\",\"operation\":\"findOne\",\"filter\":{…}}`); SQL: plain SQL. Per-engine details: the DB query reference. The default is a placeholder — always send your own. |\n| `params` | string[] (≤200) | — |  | Positional binds, template-resolved: `$1` (Postgres), `?` (MySQL), `@p1…` (SQL Server). |\n| `typedParams` | {value, type?}[] (≤200) | — |  | Wins over params. type auto \\| text \\| int \\| numeric \\| boolean \\| date \\| timestamp \\| json \\| null: null binds SQL NULL, boolean a real boolean, the rest stay strings (cast in SQL). |\n| `useSession` | boolean | — |  | Postgres only: join the run's shared session (scenario-level `dbSettings.transactionMode`: none \\| rollback \\| commit). |\n| `expectError` | {sqlState?, messagePattern?} | — |  | Negative test: the node passes only if the query FAILS with that SQLSTATE and/or a message matching the regex. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: `<Label>.rows`, `<Label>.rowCount`; the rows are also `db.result`.\n\n```json\n{\"id\":\"check\",\"type\":\"db\",\"label\":\"CheckOrder\",\"config\":{\"connectionId\":\"<database connection id>\",\"query\":\"SELECT status FROM orders WHERE id = $1\",\"params\":[\"{{CreateOrder.body.id}}\"]}}\n```\n\n### redis\nRedis commands on a workspace connection of type `redis`.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `connectionId` | string | `\"\"` | run |  |\n| `commands` | string[] (≤1000, each non-empty) | `[]` | run | One command per entry, template-resolved. Supported: GET, SET, DEL, EXISTS, TTL, HGET, HSET, HGETALL, HDEL, LPUSH, RPUSH, LRANGE, LLEN, SADD, SMEMBERS, SISMEMBER, INCR, DECR, INCRBY, EXPIRE, PERSIST, TYPE, ZADD, ZRANGE, ZSCORE, SCAN. `SCAN pattern [count]` returns {keys, count, truncated}. An empty list fails the run. |\n| `executionPolicy` | ExecutionPolicy | continue, retry ×2 every 1000 ms |  | See Execution policy. |\n\nOutput: The reply (one command) or an array of replies, as `<Label>` and `redis.result`.\n\n```json\n{\"id\":\"cache\",\"type\":\"redis\",\"label\":\"Cache\",\"config\":{\"connectionId\":\"<redis connection id>\",\"commands\":[\"GET order:{{CreateOrder.body.id}}\"]}}\n```\n\n### kafka\nConsume (wait for a matching message) or publish, on a connection of type `kafka`.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `connectionId` | string | `\"\"` | run |  |\n| `topic` | string (1..500) | `\"\"` | yes |  |\n| `mode` | consume \\| publish | `\"consume\"` |  |  |\n| `matchMode` | regex \\| rules | `\"regex\"` |  | consume. |\n| `rules` | string[] | `[]` |  | consume. regex: rules[0] is a regex tested against the whole message. rules: every entry is ONE comparison `left op right` (op ==, !=, ===, !==, >, <, >=, <=, contains) and all must hold, e.g. `kafkaEvent.orderId == '{{CreateOrder.body.id}}'`. Empty = the first message captured. |\n| `publishValueFormat` | json \\| raw | `\"json\"` |  | publish. json fails the node when messageValue is not valid JSON after templating. |\n| `messageKey` | string | `\"\"` |  | publish. |\n| `messageValue` | string (≤1000000) | `\"\"` |  | publish payload, template-resolved. |\n| `messageHeaders` | {key, value, enabled?}[] | `[]` |  | publish. |\n| `executionPolicy` | ExecutionPolicy | continue, retry ×3 every 2000 ms |  | See Execution policy. |\n\nOutput: consume: the matched message — a JSON message's keys at the top level plus `meta` {value, text, key, partition, offset, timestamp, headers}; also `kafkaEvent.*`.\n\n```json\n{\"id\":\"event\",\"type\":\"kafka\",\"label\":\"OrderCreated\",\"config\":{\"connectionId\":\"<kafka connection id>\",\"topic\":\"orders\",\"mode\":\"consume\",\"matchMode\":\"rules\",\"rules\":[\"kafkaEvent.orderId == '{{CreateOrder.body.id}}'\"]}}\n```\n\n### condition\nThe only branching node and the only node without `executionPolicy`. Needs exactly two outgoing edges: one `yes`, one `no`.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `mode` | builder \\| expert | `\"builder\"` |  |  |\n| `rootGroup` | Group | one rule: `response.status` equals `200` |  | Evaluated in builder mode (see Rules and operands). Stored in both modes. |\n| `expertExpression` | string \\| null | `\"{{response.status}} == 200\"` |  | Used ONLY with `mode: \"expert\"` (ignored otherwise). Syntax below. |\n\nOutput: Takes the `yes` or `no` edge.\n\nExpert syntax: operands are `{{path}}` tokens (a bare path is a parse error), 'single'- or \"double\"-quoted strings, numbers, true / false / null and [arrays]; operators ==, !=, ===, !==, >, <, >=, <=, contains, not contains, starts with, ends with, regex, in, not in, between, exists, not exists, is empty, not empty, is null, not null, contains row, set equals; combine with && / AND, || / OR and parentheses. Example: `{{Login.status}} == 200 && {{Login.body.token}} != ''`.\n\n```json\n{\"id\":\"ok\",\"type\":\"condition\",\"label\":\"LoggedIn\",\"config\":{\"mode\":\"builder\",\"rootGroup\":{\"id\":\"g1\",\"type\":\"group\",\"operator\":\"AND\",\"children\":[{\"id\":\"r1\",\"type\":\"rule\",\"left\":{\"mode\":\"runtime\",\"valueType\":\"number\",\"value\":\"Login.status\"},\"operator\":\"equals\",\"right\":{\"mode\":\"literal\",\"valueType\":\"number\",\"value\":200}}]}}}\n```\n\n### assertion\nPass/fail checkpoint; does not branch (on failure the execution policy decides).\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `matchMode` | all \\| any | `\"all\"` |  |  |\n| `checks` | {id, name, enabled, rule}[] (≤1000) | one blank check | run | id, name (may be \"\"), enabled and rule are required; `rule` is a full Rule. With no enabled check the node passes without testing anything — send at least one. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: `<Label>.passed`, `.passedCount`, `.failedCount`, `.checks[i]` {name, passed, message}.\n\n```json\n{\"id\":\"verify\",\"type\":\"assertion\",\"label\":\"VerifyOrder\",\"config\":{\"checks\":[{\"id\":\"c1\",\"name\":\"total is 40\",\"enabled\":true,\"rule\":{\"id\":\"c1r\",\"type\":\"rule\",\"left\":{\"mode\":\"runtime\",\"valueType\":\"number\",\"value\":\"CreateOrder.body.total\"},\"operator\":\"equals\",\"right\":{\"mode\":\"literal\",\"valueType\":\"number\",\"value\":40}}}]}}\n```\n\n### script\nJavaScript in the `pm.*` sandbox.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `script` | string (≤1000000) | `\"return {\\n  ok: true,\\n};\"` | run | Its `return` value is the node's output. Can `pm.environment.set`, `pm.test`, `await pm.db.query(…)` / `pm.redis.command(…)`. Empty or invalid code fails the run. |\n| `timeoutMs` | integer 1..60000 | `3000` |  | Also capped by the host's per-node timeout. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: The returned value (`<Label>.<key>` for an object).\n\n```json\n{\"id\":\"calc\",\"type\":\"script\",\"label\":\"Totals\",\"config\":{\"script\":\"const body = CreateOrder.body;\\nreturn { total: body.total * 2 };\"}}\n```\n\n### set-vars\nWrite environment/global variables without a script. Rows apply top to bottom (a row sees earlier rows' writes).\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `assignments` | Assignment[] (≤200) | one blank row |  |  |\n| `assignments[].id / .key / .value` | string | — | yes | key and value are template-resolved; value may be \"\". |\n| `assignments[].scope` | environment \\| global | — | yes |  |\n| `assignments[].enabled` | boolean | — | yes |  |\n| `assignments[].extractorType` | template \\| jsonpath \\| regex | — |  | jsonpath / regex: resolve `source` (a bare runtime path such as `CreateOrder.body`), then apply `expression` (JSONPath like `$.items[0].id`, or a JS regex source); `value` is ignored. Regex rows take `flags` (subset of gimsuy) and `group`; `select` first \\| all (all writes a JSON array). A failed extraction skips that write. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: `<Label>.environment` / `<Label>.globals` (what was written), `<Label>.extraction` for extractor rows.\n\n```json\n{\"id\":\"save\",\"type\":\"set-vars\",\"label\":\"SaveOrderId\",\"config\":{\"assignments\":[{\"id\":\"a1\",\"scope\":\"environment\",\"key\":\"orderId\",\"value\":\"{{CreateOrder.body.id}}\",\"enabled\":true}]}}\n```\n\n### poll\nRepeat ONE embedded action until a condition passes or the budget runs out. Retry is forced off (the loop is the retry); a failing tick is retried, not fatal.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `actionType` | request \\| db \\| redis \\| script | `\"request\"` |  |  |\n| `request / db / redis / script` | that node type's config | request: the request defaults | run | The one matching actionType. Same fields as the standalone node. |\n| `successCondition` | {mode, rootGroup, expertExpression?} | `response.status` equals `200` |  | Evaluated after every successful tick. A tick publishes like the real node: request → `response.*`, db → `db.result` (rows), redis → `redis.result`; a script tick exposes only its variable writes (`env.*`, `global.*`). |\n| `intervalMs` | integer 0..3600000 | `2000` |  |  |\n| `maxAttempts` | integer 1..1000 | `30` |  |  |\n| `timeoutMs` | integer 1..86400000 | — |  | Wall-clock cap. |\n| `backoffMultiplier` | number 1..10 | — |  | Exponential backoff on the interval. |\n| `maxDelayMs` | integer 0..3600000 | — |  | Backoff cap. |\n| `onTimeout` | fail \\| continue | `\"fail\"` |  | continue marks the node degraded and goes on. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: `<Label>.attempts`, `.elapsedMs`, `.timedOut`, `.conditionResult`, `.lastTickError`; the last tick's result as listed above.\n\n```json\n{\"id\":\"wait-ready\",\"type\":\"poll\",\"label\":\"WaitReady\",\"config\":{\"actionType\":\"request\",\"request\":{\"url\":\"{{env.baseUrl}}/orders/{{CreateOrder.body.id}}\"},\"successCondition\":{\"mode\":\"expert\",\"expertExpression\":\"{{response.body.status}} == 'READY'\"},\"intervalMs\":2000,\"maxAttempts\":15}}\n```\n\n### foreach\nRun an embedded body graph once per item of an array.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `nodes / edges` | stored node[] / stored edge[] | `[]` |  | The body graph in the STORED form with complete configs (see Scenario shape) — no defaults are merged inside. Same graph rules; labels unique across the whole scenario. |\n| `sourceMode` | path \\| inline | `\"path\"` |  |  |\n| `itemsPath` | string (≤2000) | — | run | path mode: a bare runtime path to an array, e.g. `Users.body.items`. |\n| `itemsInline` | string | — | run | inline mode: JSON array text; templates resolve first. |\n| `itemAlias` | string (≤100) | — |  | Extra root mirroring `{{item}}` (e.g. `user` → `{{user.id}}`). Not a reserved label. |\n| `maxIterations` | integer 1..1000 | 100 (engine) |  |  |\n| `delayMs` | integer 0..3600000 | — |  | Pause between items. |\n| `onItemFailure` | stop \\| continue | `\"stop\"` |  | continue: failed items degrade the run, the loop goes on. |\n| `collectResults` | boolean | `true` |  |  |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: `<Label>.results[i].<ChildLabel>…`, `.itemCount`, `.processedCount`, `.truncated`, `.failedItems`. Inside the body: `{{item}}`, `{{each.index}}` (0-based), `{{each.iteration}}` (1-based), `{{each.total}}`, `{{each.remaining}}`, `{{eaches.<ForeachLabel>.iteration}}` for an outer loop.\n\n```json\n{\"id\":\"each-user\",\"type\":\"foreach\",\"label\":\"EachUser\",\"config\":{\"sourceMode\":\"path\",\"itemsPath\":\"Users.body.items\",\"itemAlias\":\"user\",\"nodes\":[{\"id\":\"get-user\",\"type\":\"request\",\"position\":{\"x\":0,\"y\":0},\"data\":{\"label\":\"GetUser\",\"config\":{\"method\":\"GET\",\"url\":\"{{env.baseUrl}}/users/{{user.id}}\",\"headers\":[],\"query\":[],\"body\":{\"mode\":\"none\",\"raw\":\"\",\"formEntries\":[]}}}}],\"edges\":[]}}\n```\n\n### websocket\nOne WebSocket conversation: connect, run the steps in order, close. Retry re-runs the whole conversation.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `url` | string (≤2000) | `\"\"` | run | ws:// or wss://, template-resolved. |\n| `headers` | {key, value, enabled?}[] (≤100) | `[]` |  |  |\n| `subprotocols` | string[] (≤20) | `[]` |  |  |\n| `connectTimeoutMs` | integer 100..120000 | 10000 (engine) |  |  |\n| `steps` | Step[] (≤200) | `[]` |  | {id, kind:\"send\", payload} sends one text frame; {id, kind:\"expect\", rules (1..50 Rules), timeoutMs? (100..300000, default 10000), matchMode? all \\| any} waits for a matching frame — rule paths use `ws.text`, `ws.json.<path>`, `ws.direction`, `ws.index`; {id, kind:\"wait\", durationMs (0..300000)}. A timed-out expect fails the node. |\n| `closeCode` | integer 1000..4999 | 1000 (engine) |  |  |\n| `rejectUnauthorized` | boolean | — |  | false accepts self-signed certificates. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: `<Label>.connected`, `.messages[i].text`, `.messageCount`, `.failedSteps`, `.closeCode`.\n\n```json\n{\"id\":\"ws\",\"type\":\"websocket\",\"label\":\"Subscribe\",\"config\":{\"url\":\"wss://stream.example.com/orders\",\"steps\":[{\"id\":\"s1\",\"kind\":\"send\",\"payload\":\"{\\\"subscribe\\\":\\\"orders\\\"}\"},{\"id\":\"s2\",\"kind\":\"expect\",\"rules\":[{\"id\":\"s2r\",\"type\":\"rule\",\"left\":{\"mode\":\"runtime\",\"valueType\":\"string\",\"value\":\"ws.json.event\"},\"operator\":\"equals\",\"right\":{\"mode\":\"literal\",\"valueType\":\"string\",\"value\":\"subscribed\"}}]}]}}\n```\n\n### ai\nOne LLM call on a managed workspace connection of type `ai`.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `connectionId` | string (1..200) | `\"\"` | yes | The default `\"\"` is rejected on save. |\n| `prompt` | string (≤200000) | `\"\"` | run | Template-resolved; empty fails the run. |\n| `responseExample` | string (≤20000) | `\"\"` | run | A JSON OBJECT as text; its top-level keys are required in the reply (extra keys allowed). |\n| `maxTokens` | integer 1..32000 | 2000 (engine) |  |  |\n| `timeoutMs` | integer 1000..300000 | 60000 (engine) |  |  |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: The parsed JSON reply: `<Label>.<exampleKey>`.\n\n```json\n{\"id\":\"classify\",\"type\":\"ai\",\"label\":\"Classify\",\"config\":{\"connectionId\":\"<ai connection id>\",\"prompt\":\"Classify the sentiment of: {{GetReview.body.text}}\",\"responseExample\":\"{\\\"sentiment\\\":\\\"positive\\\",\\\"score\\\":0.9}\"}}\n```\n\n### wait\nFixed delay.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `durationMs` | integer 1..2147483647 | `5000` |  |  |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: `<Label>.configuredDurationMs`, `.actualDurationMs`, `.status`.\n\n```json\n{\"id\":\"pause\",\"type\":\"wait\",\"label\":\"Pause\",\"config\":{\"durationMs\":1000}}\n```\n\n### notification\nSlack message through a workspace connection of type `notification`.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `provider` | \"slack\" | `\"slack\"` |  |  |\n| `connectionId` | string | `\"\"` | run |  |\n| `severity` | info \\| success \\| warning \\| error | `\"info\"` |  |  |\n| `messageTemplate` | string (≤100000) | a run-status line |  | Template-resolved (node outputs, `{{workflow.name}}`, `{{workflow.__meta.status}}` …). |\n| `channelOverride` | string (≤500) | `\"\"` |  |  |\n| `continueOnFailure` | boolean | `true` |  | Overrides executionPolicy.onFailure (true = continue). |\n| `advanced.useRichBlocks` | boolean | `true` |  |  |\n| `executionPolicy` | ExecutionPolicy | continue, no retry |  | See Execution policy. |\n\nOutput: The delivery result.\n\n```json\n{\"id\":\"notify\",\"type\":\"notification\",\"label\":\"Notify\",\"config\":{\"connectionId\":\"<notification connection id>\",\"severity\":\"warning\",\"messageTemplate\":\"Order {{CreateOrder.body.id}} is not ready\"}}\n```\n\n### aggregator\nBuild one JSON object from earlier outputs.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `template` | string (≤1000000) | `\"{\\n  \\\"key\\\": \\\"{Label.field}\\\"\\n}\"` | run | Must be valid JSON after templating (`{{Label.path}}` or `{Label.path}` tokens), else the run fails. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: The parsed object: `<Label>.<key>`.\n\n```json\n{\"id\":\"summary\",\"type\":\"aggregator\",\"label\":\"Summary\",\"config\":{\"template\":\"{\\\"orderId\\\":\\\"{{CreateOrder.body.id}}\\\",\\\"status\\\":\\\"{{CheckOrder.rows[0].status}}\\\"}\"}}\n```\n\n### end\nTerminates a path; optionally loops back to an earlier node.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `loop` | boolean | `false` |  |  |\n| `loopTargetNodeId` | string \\| null | `null` | run | loop: the id of an earlier node to jump back to. |\n| `loopIterations` | integer 1..1000 | `1` |  | Re-entries: the looped section runs loopIterations + 1 times. |\n| `loopDelayMs` | integer 0..600000 | `1000` |  |  |\n| `loopExitRule` | Rule \\| null | — |  | Checked after each pass; TRUE stops the loop early and continues along the end node's outgoing edges. Loop roots: `loop.iteration` (1-based), `loop.index`, `loop.total`, `loop.remaining`. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: A snapshot of the run's outputs so far.\n\n```json\n{\"id\":\"again\",\"type\":\"end\",\"label\":\"Repeat\",\"config\":{\"loop\":true,\"loopTargetNodeId\":\"login\",\"loopIterations\":2,\"loopDelayMs\":500}}\n```\n\n### subscenario\nA group of nodes collapsed into one node (the builder's Group).\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `nodes / edges` | stored node[] / stored edge[] | none | yes | Stored form, complete configs; no defaults are merged for this type. Same graph rules. |\n| `reusableGroupId / reusableSourceScenarioId / reusableSourceNodeId / ungroupSnapshot` | app-managed | — |  | Written by the builder; omit them. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry (engine) |  | See Execution policy. |\n\nOutput: Its inner nodes publish under their own labels.\n\n```json\n{\"id\":\"setup\",\"type\":\"subscenario\",\"label\":\"Setup\",\"config\":{\"nodes\":[{\"id\":\"seed\",\"type\":\"wait\",\"position\":{\"x\":0,\"y\":0},\"data\":{\"label\":\"Settle\",\"config\":{\"durationMs\":500}}}],\"edges\":[]}}\n```\n\n### scenario-ref\nA reference to another scenario, embedded as a synced snapshot. Created by the app when a scenario is linked; the compact form cannot create or re-send one (in the stored form, send it back exactly as read).\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `referencedScenarioId` | string | — | yes |  |\n| `referencedScenarioVersion` | integer \\| null | — | yes |  |\n| `referencedScenarioName / lastSyncedAt` | string | — | yes |  |\n| `nodes / edges` | stored node[] / stored edge[] | — | yes | The referenced scenario's graph snapshot. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry (engine) |  | See Execution policy. |\n\nOutput: Its inner nodes publish under their own labels.\n\n## Graph rules\n\nRejected on save:\n- Node ids unique; edge ids unique; every edge's source and target is an existing node id.\n- `yes` / `no` edges only leave a condition node; `error` edges only leave a non-condition node; omit `type` (or `default`) for normal flow.\n- A condition node has exactly two outgoing edges: one `yes`, one `no`.\n- At least one start node (a node with no incoming edge) and no cycles — loop with an end node's `loop` settings, never with a back edge.\n- foreach / subscenario / scenario-ref bodies are checked with the same rules.\n\nSaved with a warning: more than one start node; nodes no start node reaches.\n",
+    "scenario-nodes": "<!-- GENERATED FILE — do not edit by hand. Source: callman_core (npm run ai:packs). -->\n\n# Scenario node reference\n\nA scenario is a directed graph: nodes do the work, edges decide what runs next. This reference is for clients that write scenarios through the API or an MCP tool; every rule below is what the server enforces on save or what the run engine does.\n\n## Scenario shape\n\nCompact form (what the MCP scenario tools take):\n\n```json\n{\n  \"name\": \"Order flow\",\n  \"description\": \"optional\",\n  \"priority\": \"high\",\n  \"nodes\": [\n    {\n      \"id\": \"login\",\n      \"type\": \"request\",\n      \"label\": \"Login\",\n      \"config\": {\n        \"method\": \"POST\",\n        \"url\": \"{{env.baseUrl}}/login\"\n      }\n    },\n    {\n      \"id\": \"done\",\n      \"type\": \"end\",\n      \"label\": \"Done\"\n    }\n  ],\n  \"edges\": [\n    {\n      \"source\": \"login\",\n      \"target\": \"done\"\n    }\n  ],\n  \"environments\": [\n    {\n      \"name\": \"Default\",\n      \"variables\": [\n        {\n          \"key\": \"baseUrl\",\n          \"value\": \"https://api.example.com\"\n        }\n      ]\n    }\n  ]\n}\n```\n\n- Node `{ id?, type, label?, config?, position? }`. `id` defaults to n1, n2, …; when `position` is omitted the node is placed after the node it is connected from, clear of every existing node.\n- `config` is deep-merged over the type's defaults (the Default column): objects merge key by key, arrays and scalars replace the default whole. Send only what you change — but an array you send (headers, checks, steps, rules, assignments) must be complete.\n- Edge `{ id?, source, target, type? }`, `type` = `default` (or omitted) | `yes` | `no` | `error`. Edges have no label.\n- `priority`: critical | high | medium | low. `environments[].variables`: `{ key, value, enabled? }[]`.\n- Stored form (the REST API, and the body of `foreach` / `subscenario` / `scenario-ref`): node `{ id, type, position: { x, y }, data: { label, config } }` with the COMPLETE config — nothing is merged — and edge `{ id, source, target, type? }` with a required `id`.\n\nReq column: **yes** = rejected on save without a real value; **run** = saved, but the run fails without it. Default \"(engine)\" = applied at run time when the field is absent.\n\n## Connections\n\ndb, redis, kafka, notification and ai nodes run on a workspace connection: `config.connectionId` is the id of a connection of type `database`, `redis`, `kafka`, `notification` (Slack) or `ai` (managed). Use a real connection id from the workspace — never invent one. Only the ai node rejects an empty id on save; the others save with `\"\"` and fail when run.\n\n## Labels\n\n- `label` names a node's output: later nodes read `{{Label.path}}`. It is optional on save, but an unlabelled node's output cannot be referenced.\n- Labels must be unique across the whole scenario, including foreach / subscenario bodies: a repeated label is overwritten by whichever node ran last.\n- Reserved labels — the engine drops the output of a node labelled `workflow`, `__meta`, `loop`, `loops`, `item`, `each`, `eaches`, `ws`, so references to it resolve to empty without any error.\n- Avoid labels that are built-in roots — `response`, `lastResponse`, `data`, `env`, `global`, `globals`, `db`, `redis`, `kafkaEvent`, `kafkaevent` — the node and the root shadow each other.\n- Prefer identifier labels (`Login`, `CreateOrder`, `check_db`). Script nodes get a label as a global variable only when it is an identifier and not a sandbox name (`pm`, `env`, `console`, `request`, `response`, `test`, `expect`, `workflow`, `db`, `kafka`, `redis`, …).\n\n## Templates and outputs\n\n- `{{env.KEY}}` / `{{global.KEY}}` read one scope; a bare `{{KEY}}` reads both (in scenario runs a global wins when both define KEY). `{{data.column}}` is the current dataset row.\n- `{{Label.path}}` (or `{Label.path}`) reads an earlier node's output; arrays by index (`items[0].id`), no wildcards. `{{response.*}}` is the most recent request's response. Generators: `{{$randomUUID}}`, `{{$timestamp}}`, `{{random.email}}`, `{{counter}}`.\n- Substitution is plain text — quote SQL strings yourself (`WHERE id = '{{userId}}'`). A missing value resolves to an empty string.\n- A request's output: `<Label>.status` is the HTTP status (number). Read body fields through `<Label>.body.<path>`: top-level body keys are also spread onto the output, but `status`, `statusText`, `data`, `body`, `rawBody`, `text`, `headers`, `cookies`, `durationMs` are HTTP metadata and win over same-named body keys. `<Label>.data.<path>` reads a body's top-level `data`.\n- Operand paths (rules, `foreach.itemsPath`, set-vars `source`) are BARE dotted paths without braces: `CreateOrder.body.total`, `CheckOrder.rows[0].status`.\n\n## Rules and operands\n\nShared by condition, assertion, poll, websocket expect steps and `end.loopExitRule`.\n\n- Rule `{ id, type: \"rule\", left, operator, right? }` — `id` and `type: \"rule\"` are required; `right` is required unless the operator is unary.\n- Group `{ id, type: \"group\", operator: \"AND\" | \"OR\", children: [Rule | Group, …] }` with at least one child.\n- Operand `{ mode: \"runtime\" | \"literal\", valueType: \"string\" | \"number\" | \"boolean\" | \"null\" | \"array\", value, extract? }`. runtime: `value` is a bare path. literal: a JSON number for number, true/false for boolean, null for null, a JSON array for array.\n- Binary operators: equals, not_equals, strict_equals, strict_not_equals, greater_than, less_than, greater_or_equal, less_or_equal, between, contains, not_contains, starts_with, ends_with, regex, in, not_in, contains_row, set_equals_unordered. `between` takes [min, max]; `in` / `not_in` an array; `regex` a JS regex source; `contains_row` checks that an array of rows has one matching every key of an object (a JSON-object string literal or a runtime path); `set_equals_unordered` compares two arrays as multisets.\n- Unary operators (no `right`): exists, not_exists, is_empty, not_empty, is_null, not_null.\n- `extract` `{ type: \"jsonpath\" | \"regex\", expression, flags?, group?, select?: \"first\" | \"all\" }` is applied to the resolved value first; a failed extraction behaves as not-exists. JSONPath runs without script evaluation: `$.a.b`, `$['x-id']`, `$.items[*].id`, `$..id` and slices work; filter expressions (`[?(@.x == 1)]`) are rejected — filter in a script node.\n\nExample: `{ \"id\": \"r1\", \"type\": \"rule\", \"left\": { \"mode\": \"runtime\", \"valueType\": \"number\", \"value\": \"CreateOrder.status\" }, \"operator\": \"equals\", \"right\": { \"mode\": \"literal\", \"valueType\": \"number\", \"value\": 201 } }`\n\n## Contract rules\n\nEach rule's `rules` object may use ONLY these keys (omit the rest):\n- common: required(bool), type(string|number|boolean|object|array|null), equals(string|number|bool), notEmpty(bool)\n- number: min,max,greaterThan,lessThan(number); integer,positive,negative,nonZero(bool)\n- string: minLength,maxLength(int); pattern,contains,notContains,startsWith,endsWith(string); caseSensitive(bool); enumValues(array); format(enum)\n- array: minItems,maxItems(int); sorted({order:asc|desc,field?}); unique({mode:whole|byField,fields?})\n- object: requiredKeys,forbiddenKeys(string[]); minProperties,maxProperties(int); strictSchema(bool)\n- format values: email, url, uuid, uuidV1, uuidV4, uuidV7, jwt, base64, base64url, base64Pdf, base64Png, base64Jpeg, base64Gif, base64Webp, base64Image, base64Zip, base64Office, datetime, date, time, ipv4, ipv6, hostname, json, numeric, integer, alpha, alphanumeric, hex, hexColor, slug, semver, objectId, creditCard, phone\n\n## Execution policy\n\nEvery node except condition takes `executionPolicy: { onFailure: \"stop\" | \"continue\", retry: { enabled, maxAttempts (0..100), delayMs (0..3600000), backoffMultiplier? (1..10), maxDelayMs? (0..3600000) }, expectFailure?: { messagePattern? } }` — onFailure and retry.enabled / maxAttempts / delayMs are required when you send the stored form.\n- `maxAttempts` counts every attempt (an enabled retry makes at least 2). Delay before retry n = min(maxDelayMs, delayMs × backoffMultiplier^(n−1)). No policy = stop, no retry.\n- stop: a failure ends the run; continue: the run goes on along the normal edges.\n- `error` edges from the failing node win over both: the run follows them instead of the normal edges (after the retries).\n- How the run ends: `success` only when no node failed. A failure that continued or was routed through an `error` edge marks that node `failed_continued` and the run ends `completed_with_failures` — never `success`. A stop failure ends it `failed`.\n- `expectFailure: { messagePattern? }` turns the node into a negative test (`request`, `db`, `redis`, `kafka`, `websocket`, `script`, `assertion`, `poll`, `ai`, `notification`): an attempt that FAILS with a message matching `messagePattern` (a JS regex, ≤500 chars; omitted = any failure) makes the node succeed — normal edges run, the run can end `success`, and the output is `<Label>.expectedFailure.message`. An attempt that succeeds, or fails with another message, is a failure (retry and onFailure apply as usual, so retry can wait for something to start failing). Use it for absence checks (a Kafka event that must not appear, a poll that must time out, a request that must be refused). On a db node a non-empty `expectError` wins.\n- Example: `\"executionPolicy\": { \"onFailure\": \"stop\", \"retry\": { \"enabled\": false, \"maxAttempts\": 0, \"delayMs\": 0 }, \"expectFailure\": { \"messagePattern\": \"timed out\" } }`.\n\n## Node types\n\n### request\nOne HTTP call.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `method` | string | `\"GET\"` |  | HTTP verb. |\n| `url` | string (≤10000) | `\"\"` | run | Absolute URL; `{{…}}` allowed. Its own `?query` is used only when `query` has no enabled rows. |\n| `headers` | {key, value, enabled?}[] | `[]` |  | Disabled rows are not sent. A Content-Type row beats the automatic one (formdata always uses the driver's multipart type). |\n| `query` | {key, value, enabled?}[] | `[]` |  |  |\n| `body.mode` | none \\| raw \\| formdata \\| urlencoded | `\"none\"` |  |  |\n| `body.raw` | string | `\"\"` |  | mode raw. JSON text that still parses after templating is sent as JSON. |\n| `body.rawLanguage` | json \\| xml \\| text \\| html | — |  | With no Content-Type header, sets application/json, application/xml, text/plain or text/html (json when absent). |\n| `body.formEntries` | {key, value, enabled?, type?, fixtureId?, fileName?}[] | `[]` |  | formdata / urlencoded rows. A `type:\"file\"` row needs `fixtureId` (an uploaded workspace fixture file) — server runs fail it otherwise. |\n| `auth.type` | none \\| bearer \\| basic \\| apikey \\| oauth2 | `\"none\"` |  |  |\n| `auth.bearerToken` | string | `\"\"` |  | bearer → `Authorization: Bearer <token>`. |\n| `auth.basicUsername / auth.basicPassword` | string | `\"\"` |  | basic → base64 `user:password`. |\n| `auth.apiKeyKey / auth.apiKeyValue` | string | `\"\"` |  | apikey → sends `key: value`; skipped when the key is blank. |\n| `auth.apiKeyLocation` | header \\| query | `\"header\"` |  |  |\n| `auth.oauth2` | {grantType, tokenUrl, clientId, clientSecret, scope, username, password, refreshToken, clientAuth, audience} | — |  | oauth2: when present ALL ten keys are required (send \"\" for unused ones); grantType client_credentials \\| password \\| refresh_token; clientAuth basic \\| body. The token is fetched (and cached) before the call and sent as a Bearer header. Without it, type oauth2 sends no Authorization. |\n| `preRequestScript / postResponseScript / testsScript` | string | `\"\"` |  | `pm.*` scripts: before the call / after the response / assertions (`pm.test`). |\n| `contractAssertions` | {id, path, enabled, rules, engine?, namespaces?}[] (≤200) | `[]` |  | id, path, enabled and rules are required; `rules` needs ≥1 key (see Contract rules). `path` is a dot-path over the parsed body (`data.items[0].id`, `items[].id` = every element); with engine \"xpath\" it is an XPath over the raw XML and every prefix must be in `namespaces` {prefix: uri}. |\n| `expectedStatus` | string (≤200) | — |  | Negative testing: `\"201\"`, `\"4xx\"`, `\"200-299\"`, `\"200,204\"`, templates allowed. When set the node passes iff the status matches (instead of 2xx/3xx); contract assertions and test scripts can still fail it. |\n| `responseSchema` | JSON Schema object | — |  | Validated against the response body; a mismatch fails the node. |\n| `clientCertificate` | {enabled, format, pfxBase64?, certPem?, keyPem?, passphrase?, caPem?, rejectUnauthorized?} | — |  | mTLS. enabled and format (\"pfx\" \\| \"pem\") are required; pfx uses pfxBase64, pem uses certPem + keyPem. Server runs present the certificate whenever this object is set — omit it to send none. |\n| `soap` | {enabled, version, action?, wsSecurity?} | — |  | version \"1.1\" \\| \"1.2\". Keep the full envelope in body.raw (rawLanguage \"xml\"); Content-Type/SOAPAction come from the version (a Content-Type header wins). wsSecurity {enabled, username, password, passwordType: text \\| digest} injects a UsernameToken at send time. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: `<Label>.status` (number), `<Label>.body.<path>`, `<Label>.headers`, `<Label>.text`, `<Label>.durationMs`. The most recent request is also `response.*`.\n\n```json\n{\"id\":\"login\",\"type\":\"request\",\"label\":\"Login\",\"config\":{\"method\":\"POST\",\"url\":\"{{env.baseUrl}}/login\",\"body\":{\"mode\":\"raw\",\"raw\":\"{\\\"user\\\":\\\"{{env.user}}\\\",\\\"password\\\":\\\"{{env.password}}\\\"}\",\"rawLanguage\":\"json\"},\"expectedStatus\":\"200\"}}\n```\n\n### db\nOne query on a workspace connection of type `database`.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `connectionId` | string | `\"\"` | run | `\"\"` = not chosen yet: saved, but the run fails. |\n| `query` | string (1..100000) | `\"SELECT *\\nFROM users\\nWHERE id = {{env.userId}}\"` | yes | Mongo: a command object as MongoDB Extended JSON (relaxed) text (`{\"collection\":\"orders\",\"operation\":\"findOne\",\"filter\":{…}}`) — `{\"$date\":\"2026-01-01T00:00:00Z\"}`, `{\"$oid\":\"…\"}`, `{\"$numberDecimal\":\"9.99\"}` and `{\"$numberLong\":\"…\"}` become real BSON values; plain whole numbers are sent as int32/double (a `$numberLong` beyond 2^53 loses precision). A 24-hex string in `filter` is also matched as an ObjectId. SQL: plain SQL. Per-engine details: the DB query reference. The default is a placeholder — always send your own. |\n| `params` | string[] (≤200) | — |  | Positional binds, template-resolved: `$1` (Postgres), `?` (MySQL), `@p1…` (SQL Server). |\n| `typedParams` | {value, type?}[] (≤200) | — |  | Wins over params. type auto \\| text \\| int \\| numeric \\| boolean \\| date \\| timestamp \\| json \\| null: null binds SQL NULL, boolean a real boolean, the rest stay strings (cast in SQL). |\n| `useSession` | boolean | — |  | Postgres only: join the run's shared session (scenario-level `dbSettings.transactionMode`: none \\| rollback \\| commit). |\n| `expectError` | {sqlState?, messagePattern?} | — |  | Negative test: the node passes only if the query FAILS with that SQLSTATE and/or a message matching the regex. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: `<Label>.rows`, `<Label>.rowCount`; the rows are also `db.result`. With `expectError` met: `<Label>.expectedError` {sqlState, message}, rows empty.\n\n```json\n{\"id\":\"check\",\"type\":\"db\",\"label\":\"CheckOrder\",\"config\":{\"connectionId\":\"<database connection id>\",\"query\":\"SELECT status FROM orders WHERE id = $1\",\"params\":[\"{{CreateOrder.body.id}}\"]}}\n```\n\n### redis\nRedis commands on a workspace connection of type `redis`.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `connectionId` | string | `\"\"` | run |  |\n| `commands` | string[] (≤1000, each non-empty) | `[]` | run | One command per entry, template-resolved. Supported: GET, SET, DEL, EXISTS, TTL, HGET, HSET, HGETALL, HDEL, LPUSH, RPUSH, LRANGE, LLEN, SADD, SMEMBERS, SISMEMBER, INCR, DECR, INCRBY, EXPIRE, PERSIST, TYPE, ZADD, ZRANGE, ZSCORE, SCAN. `SCAN pattern [count]` returns {keys, count, truncated}. An empty list fails the run. |\n| `executionPolicy` | ExecutionPolicy | continue, retry ×2 every 1000 ms |  | See Execution policy. |\n\nOutput: The reply (one command) or an array of replies, as `<Label>` and `redis.result`.\n\n```json\n{\"id\":\"cache\",\"type\":\"redis\",\"label\":\"Cache\",\"config\":{\"connectionId\":\"<redis connection id>\",\"commands\":[\"GET order:{{CreateOrder.body.id}}\"]}}\n```\n\n### kafka\nConsume (wait for a matching message) or publish, on a connection of type `kafka`.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `connectionId` | string | `\"\"` | run |  |\n| `topic` | string (1..500) | `\"\"` | yes |  |\n| `mode` | consume \\| publish | `\"consume\"` |  |  |\n| `matchMode` | regex \\| rules | `\"regex\"` |  | consume. The default is regex — when you write comparisons, set `\"rules\"` or rules[0] is read as a regex. |\n| `rules` | string[] | `[]` |  | consume. regex: rules[0] is a regex tested against the whole message. rules: every entry is ONE comparison `left op right` (op ==, !=, ===, !==, >, <, >=, <=, contains) and all must hold, e.g. `kafkaEvent.orderId == '{{CreateOrder.body.id}}'`. Empty = the first message captured (the node stops listening at that message). |\n| `captureTimeoutMs` | integer 1000..120000 | 5000 (engine) |  | consume. How long ONE attempt listens; capped by the host's per-node timeout (60 s on a default server). Retry multiplies it. |\n| `publishValueFormat` | json \\| raw | `\"json\"` |  | publish. json fails the node when messageValue is not valid JSON after templating. |\n| `messageKey` | string | `\"\"` |  | publish. |\n| `messageValue` | string (≤1000000) | `\"\"` |  | publish payload, template-resolved. |\n| `messageHeaders` | {key, value, enabled?}[] | `[]` |  | publish. |\n| `executionPolicy` | ExecutionPolicy | continue, retry ×3 every 2000 ms |  | See Execution policy. |\n\nOutput: consume: the matched message — a JSON-object message's keys at the top level plus `meta` {value, text, key, topic, partition, offset, timestamp, headers}; any other message (array, number, text) has those fields at the top level instead, without `meta`. Also `kafkaEvent.*`. publish: {topic, partition, offset, timestamp}.\n\n**Where consuming starts.** A consume node sees records whose Kafka timestamp is at or after the scenario run's start — messages produced before the run are never seen, messages produced earlier in the same run (by a publish node or by the system under test) are. Timestamps are the producer's clock, so allow for skew. Messages from earlier loop iterations or foreach items of the same run can match too — make the rules specific (an id from this iteration).\n\n**How long it waits.** One attempt listens for `captureTimeoutMs` (default 5000 ms) and stops early at the first matching message. The default executionPolicy is continue with retry ×3 every 2000 ms, so a node waits about 3 × 5 s + 2 × 2 s ≈ 19 s in total before failing. For a slow consumer raise `captureTimeoutMs` (and/or retry) rather than adding wait nodes.\n\n**How rules read the message.** Rules are evaluated against the event shape above, NOT with JSONPath: each side is a plain dotted path (`kafkaEvent.orderId`, `kafkaEvent.meta.headers.traceparent`, `kafkaEvent.items[0].sku`) or a template. Header and key names with dashes work as plain dotted paths: `kafkaEvent.meta.headers.x-correlation-id == '{{CorrId}}'`. Brackets (`headers['x-id']`) and `$.` paths are not resolved — they compare as literal text and never match. A path segment that contains an operator word (`x-contains-id`) splits the rule at that word; avoid it or read it in a script node. Headers are UTF-8 strings; a header repeated on one record is joined with `, `. A topic, partition or offset is under `meta` (`kafkaEvent.meta.offset` is a string).\n\n**Expecting no message.** A consume node FAILS when nothing matches in time. To assert that an event is NOT published, give the node `executionPolicy.expectFailure: {}` (see Execution policy) — the timeout then counts as success.\n\n```json\n{\"id\":\"event\",\"type\":\"kafka\",\"label\":\"OrderCreated\",\"config\":{\"connectionId\":\"<kafka connection id>\",\"topic\":\"orders\",\"mode\":\"consume\",\"matchMode\":\"rules\",\"rules\":[\"kafkaEvent.orderId == '{{CreateOrder.body.id}}'\"]}}\n```\n\n### condition\nThe only branching node and the only node without `executionPolicy`. Needs exactly two outgoing edges: one `yes`, one `no`.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `mode` | builder \\| expert | `\"builder\"` |  |  |\n| `rootGroup` | Group | one rule: `response.status` equals `200` |  | Evaluated in builder mode (see Rules and operands). Stored in both modes. |\n| `expertExpression` | string \\| null | `\"{{response.status}} == 200\"` |  | Used ONLY with `mode: \"expert\"` (ignored otherwise). Syntax below. |\n\nOutput: Takes the `yes` or `no` edge.\n\nExpert syntax: operands are `{{path}}` tokens (a bare path is a parse error), 'single'- or \"double\"-quoted strings, numbers, true / false / null and [arrays]; operators ==, !=, ===, !==, >, <, >=, <=, contains, not contains, starts with, ends with, regex, in, not in, between, exists, not exists, is empty, not empty, is null, not null, contains row, set equals; combine with && / AND, || / OR and parentheses. Example: `{{Login.status}} == 200 && {{Login.body.token}} != ''`.\n\n```json\n{\"id\":\"ok\",\"type\":\"condition\",\"label\":\"LoggedIn\",\"config\":{\"mode\":\"builder\",\"rootGroup\":{\"id\":\"g1\",\"type\":\"group\",\"operator\":\"AND\",\"children\":[{\"id\":\"r1\",\"type\":\"rule\",\"left\":{\"mode\":\"runtime\",\"valueType\":\"number\",\"value\":\"Login.status\"},\"operator\":\"equals\",\"right\":{\"mode\":\"literal\",\"valueType\":\"number\",\"value\":200}}]}}}\n```\n\n### assertion\nPass/fail checkpoint; does not branch (on failure the execution policy decides).\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `matchMode` | all \\| any | `\"all\"` |  |  |\n| `checks` | {id, name, enabled, rule}[] (≤1000) | one blank check | run | id, name (may be \"\"), enabled and rule are required; `rule` is a full Rule. With no enabled check the node passes without testing anything — send at least one. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: `<Label>.passed`, `.passedCount`, `.failedCount`, `.checks[i]` {name, passed, message}.\n\n```json\n{\"id\":\"verify\",\"type\":\"assertion\",\"label\":\"VerifyOrder\",\"config\":{\"checks\":[{\"id\":\"c1\",\"name\":\"total is 40\",\"enabled\":true,\"rule\":{\"id\":\"c1r\",\"type\":\"rule\",\"left\":{\"mode\":\"runtime\",\"valueType\":\"number\",\"value\":\"CreateOrder.body.total\"},\"operator\":\"equals\",\"right\":{\"mode\":\"literal\",\"valueType\":\"number\",\"value\":40}}}]}}\n```\n\n### script\nJavaScript in the `pm.*` sandbox.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `script` | string (≤1000000) | `\"return {\\n  ok: true,\\n};\"` | run | Its `return` value is the node's output. Can `pm.environment.set`, `pm.test`, `await pm.db.query(…)` / `pm.redis.command(…)`. Empty or invalid code fails the run. |\n| `timeoutMs` | integer 1..60000 | `3000` |  | Also capped by the host's per-node timeout. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: The returned value (`<Label>.<key>` for an object).\n\n```json\n{\"id\":\"calc\",\"type\":\"script\",\"label\":\"Totals\",\"config\":{\"script\":\"const body = CreateOrder.body;\\nreturn { total: body.total * 2 };\"}}\n```\n\n### set-vars\nWrite environment/global variables without a script. Rows apply top to bottom (a row sees earlier rows' writes).\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `assignments` | Assignment[] (≤200) | one blank row |  |  |\n| `assignments[].id / .key / .value` | string | — | yes | key and value are template-resolved; value may be \"\". |\n| `assignments[].scope` | environment \\| global | — | yes |  |\n| `assignments[].enabled` | boolean | — | yes |  |\n| `assignments[].extractorType` | template \\| jsonpath \\| regex | — |  | jsonpath / regex: resolve `source` (a bare runtime path such as `CreateOrder.body`), then apply `expression` (JSONPath like `$.items[0].id`, or a JS regex source); `value` is ignored. Regex rows take `flags` (subset of gimsuy) and `group`; `select` first \\| all (all writes a JSON array). A failed extraction skips that write. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: `<Label>.environment` / `<Label>.globals` (what was written), `<Label>.extraction` for extractor rows.\n\n```json\n{\"id\":\"save\",\"type\":\"set-vars\",\"label\":\"SaveOrderId\",\"config\":{\"assignments\":[{\"id\":\"a1\",\"scope\":\"environment\",\"key\":\"orderId\",\"value\":\"{{CreateOrder.body.id}}\",\"enabled\":true}]}}\n```\n\n### poll\nRepeat ONE embedded action until a condition passes or the budget runs out. Retry is forced off (the loop is the retry); a failing tick is retried, not fatal.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `actionType` | request \\| db \\| redis \\| script | `\"request\"` |  |  |\n| `request / db / redis / script` | that node type's config | request: the request defaults | run | The one matching actionType. Same fields as the standalone node. |\n| `successCondition` | {mode, rootGroup, expertExpression?} | `response.status` equals `200` |  | Evaluated after every successful tick. A tick publishes like the real node: request → `response.*`, db → `db.result` (rows), redis → `redis.result`; a script tick exposes only its variable writes (`env.*`, `global.*`). |\n| `intervalMs` | integer 0..3600000 | `2000` |  |  |\n| `maxAttempts` | integer 1..1000 | `30` |  |  |\n| `timeoutMs` | integer 1..86400000 | — |  | Wall-clock cap. |\n| `backoffMultiplier` | number 1..10 | — |  | Exponential backoff on the interval. |\n| `maxDelayMs` | integer 0..3600000 | — |  | Backoff cap. |\n| `onTimeout` | fail \\| continue | `\"fail\"` |  | continue marks the node degraded and goes on. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: `<Label>.attempts`, `.elapsedMs`, `.timedOut`, `.conditionResult`, `.lastTickError`; the last tick's result as listed above.\n\n```json\n{\"id\":\"wait-ready\",\"type\":\"poll\",\"label\":\"WaitReady\",\"config\":{\"actionType\":\"request\",\"request\":{\"url\":\"{{env.baseUrl}}/orders/{{CreateOrder.body.id}}\"},\"successCondition\":{\"mode\":\"expert\",\"expertExpression\":\"{{response.body.status}} == 'READY'\"},\"intervalMs\":2000,\"maxAttempts\":15}}\n```\n\n### foreach\nRun an embedded body graph once per item of an array.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `nodes / edges` | stored node[] / stored edge[] | `[]` |  | The body graph in the STORED form with complete configs (see Scenario shape) — no defaults are merged inside. Same graph rules; labels unique across the whole scenario. |\n| `sourceMode` | path \\| inline | `\"path\"` |  |  |\n| `itemsPath` | string (≤2000) | — | run | path mode: a bare runtime path to an array, e.g. `Users.body.items`. |\n| `itemsInline` | string | — | run | inline mode: JSON array text; templates resolve first. |\n| `itemAlias` | string (≤100) | — |  | Extra root mirroring `{{item}}` (e.g. `user` → `{{user.id}}`). Not a reserved label. |\n| `maxIterations` | integer 1..1000 | 100 (engine) |  |  |\n| `delayMs` | integer 0..3600000 | — |  | Pause between items. |\n| `onItemFailure` | stop \\| continue | `\"stop\"` |  | continue: failed items degrade the run, the loop goes on. |\n| `collectResults` | boolean | `true` |  |  |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: `<Label>.results[i].<ChildLabel>…`, `.itemCount`, `.processedCount`, `.truncated`, `.failedItems`. Inside the body: `{{item}}`, `{{each.index}}` (0-based), `{{each.iteration}}` (1-based), `{{each.total}}`, `{{each.remaining}}`, `{{eaches.<ForeachLabel>.iteration}}` for an outer loop.\n\n```json\n{\"id\":\"each-user\",\"type\":\"foreach\",\"label\":\"EachUser\",\"config\":{\"sourceMode\":\"path\",\"itemsPath\":\"Users.body.items\",\"itemAlias\":\"user\",\"nodes\":[{\"id\":\"get-user\",\"type\":\"request\",\"position\":{\"x\":0,\"y\":0},\"data\":{\"label\":\"GetUser\",\"config\":{\"method\":\"GET\",\"url\":\"{{env.baseUrl}}/users/{{user.id}}\",\"headers\":[],\"query\":[],\"body\":{\"mode\":\"none\",\"raw\":\"\",\"formEntries\":[]}}}}],\"edges\":[]}}\n```\n\n### websocket\nOne WebSocket conversation: connect, run the steps in order, close. Retry re-runs the whole conversation.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `url` | string (≤2000) | `\"\"` | run | ws:// or wss://, template-resolved. |\n| `headers` | {key, value, enabled?}[] (≤100) | `[]` |  |  |\n| `subprotocols` | string[] (≤20) | `[]` |  |  |\n| `connectTimeoutMs` | integer 100..120000 | 10000 (engine) |  |  |\n| `steps` | Step[] (≤200) | `[]` |  | {id, kind:\"send\", payload} sends one text frame; {id, kind:\"expect\", rules (1..50 Rules), timeoutMs? (100..300000, default 10000), matchMode? all \\| any} waits for a matching frame — rule paths use `ws.text`, `ws.json.<path>`, `ws.direction`, `ws.index`; {id, kind:\"wait\", durationMs (0..300000)}. A timed-out expect fails the node. |\n| `closeCode` | integer 1000..4999 | 1000 (engine) |  |  |\n| `rejectUnauthorized` | boolean | — |  | false accepts self-signed certificates. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: `<Label>.connected`, `.messages[i].text`, `.messageCount`, `.failedSteps`, `.closeCode`.\n\n```json\n{\"id\":\"ws\",\"type\":\"websocket\",\"label\":\"Subscribe\",\"config\":{\"url\":\"wss://stream.example.com/orders\",\"steps\":[{\"id\":\"s1\",\"kind\":\"send\",\"payload\":\"{\\\"subscribe\\\":\\\"orders\\\"}\"},{\"id\":\"s2\",\"kind\":\"expect\",\"rules\":[{\"id\":\"s2r\",\"type\":\"rule\",\"left\":{\"mode\":\"runtime\",\"valueType\":\"string\",\"value\":\"ws.json.event\"},\"operator\":\"equals\",\"right\":{\"mode\":\"literal\",\"valueType\":\"string\",\"value\":\"subscribed\"}}]}]}}\n```\n\n### ai\nOne LLM call on a managed workspace connection of type `ai`.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `connectionId` | string (1..200) | `\"\"` | yes | The default `\"\"` is rejected on save. |\n| `prompt` | string (≤200000) | `\"\"` | run | Template-resolved; empty fails the run. |\n| `responseExample` | string (≤20000) | `\"\"` | run | A JSON OBJECT as text; its top-level keys are required in the reply (extra keys allowed). |\n| `maxTokens` | integer 1..32000 | 2000 (engine) |  |  |\n| `timeoutMs` | integer 1000..300000 | 60000 (engine) |  |  |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: The parsed JSON reply: `<Label>.<exampleKey>`.\n\n```json\n{\"id\":\"classify\",\"type\":\"ai\",\"label\":\"Classify\",\"config\":{\"connectionId\":\"<ai connection id>\",\"prompt\":\"Classify the sentiment of: {{GetReview.body.text}}\",\"responseExample\":\"{\\\"sentiment\\\":\\\"positive\\\",\\\"score\\\":0.9}\"}}\n```\n\n### wait\nFixed delay.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `durationMs` | integer 1..2147483647 | `5000` |  |  |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: `<Label>.configuredDurationMs`, `.actualDurationMs`, `.status`.\n\n```json\n{\"id\":\"pause\",\"type\":\"wait\",\"label\":\"Pause\",\"config\":{\"durationMs\":1000}}\n```\n\n### notification\nSlack message through a workspace connection of type `notification`.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `provider` | \"slack\" | `\"slack\"` |  |  |\n| `connectionId` | string | `\"\"` | run |  |\n| `severity` | info \\| success \\| warning \\| error | `\"info\"` |  |  |\n| `messageTemplate` | string (≤100000) | a run-status line |  | Template-resolved (node outputs, `{{workflow.name}}`, `{{workflow.__meta.status}}` …). |\n| `channelOverride` | string (≤500) | `\"\"` |  |  |\n| `continueOnFailure` | boolean | `true` |  | Overrides executionPolicy.onFailure (true = continue). |\n| `advanced.useRichBlocks` | boolean | `true` |  |  |\n| `executionPolicy` | ExecutionPolicy | continue, no retry |  | See Execution policy. |\n\nOutput: The delivery result.\n\n```json\n{\"id\":\"notify\",\"type\":\"notification\",\"label\":\"Notify\",\"config\":{\"connectionId\":\"<notification connection id>\",\"severity\":\"warning\",\"messageTemplate\":\"Order {{CreateOrder.body.id}} is not ready\"}}\n```\n\n### aggregator\nBuild one JSON object from earlier outputs.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `template` | string (≤1000000) | `\"{\\n  \\\"key\\\": \\\"{Label.field}\\\"\\n}\"` | run | Must be valid JSON after templating (`{{Label.path}}` or `{Label.path}` tokens), else the run fails. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: The parsed object: `<Label>.<key>`.\n\n```json\n{\"id\":\"summary\",\"type\":\"aggregator\",\"label\":\"Summary\",\"config\":{\"template\":\"{\\\"orderId\\\":\\\"{{CreateOrder.body.id}}\\\",\\\"status\\\":\\\"{{CheckOrder.rows[0].status}}\\\"}\"}}\n```\n\n### end\nTerminates a path; optionally loops back to an earlier node.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `loop` | boolean | `false` |  |  |\n| `loopTargetNodeId` | string \\| null | `null` | run | loop: the id of an earlier node to jump back to. |\n| `loopIterations` | integer 1..1000 | `1` |  | Re-entries: the looped section runs loopIterations + 1 times. |\n| `loopDelayMs` | integer 0..600000 | `1000` |  |  |\n| `loopExitRule` | Rule \\| null | — |  | Checked after each pass; TRUE stops the loop early and continues along the end node's outgoing edges. Loop roots: `loop.iteration` (1-based), `loop.index`, `loop.total`, `loop.remaining`. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry |  | See Execution policy. |\n\nOutput: A snapshot of the run's outputs so far.\n\n```json\n{\"id\":\"again\",\"type\":\"end\",\"label\":\"Repeat\",\"config\":{\"loop\":true,\"loopTargetNodeId\":\"login\",\"loopIterations\":2,\"loopDelayMs\":500}}\n```\n\n### subscenario\nA group of nodes collapsed into one node (the builder's Group).\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `nodes / edges` | stored node[] / stored edge[] | none | yes | Stored form, complete configs; no defaults are merged for this type. Same graph rules. |\n| `reusableGroupId / reusableSourceScenarioId / reusableSourceNodeId / ungroupSnapshot` | app-managed | — |  | Written by the builder; omit them. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry (engine) |  | See Execution policy. |\n\nOutput: Its inner nodes publish under their own labels.\n\n```json\n{\"id\":\"setup\",\"type\":\"subscenario\",\"label\":\"Setup\",\"config\":{\"nodes\":[{\"id\":\"seed\",\"type\":\"wait\",\"position\":{\"x\":0,\"y\":0},\"data\":{\"label\":\"Settle\",\"config\":{\"durationMs\":500}}}],\"edges\":[]}}\n```\n\n### scenario-ref\nLinks another scenario (shared setup / teardown) without copying it by hand: the node embeds a snapshot of the linked scenario's graph, and the run executes that snapshot.\n\n| Field | Type | Default | Req | Notes |\n| --- | --- | --- | --- | --- |\n| `scenario` | string (compact form only) | — | yes | The scenario to link, by name or id. The server copies its current graph in (fresh ids) and adds its environments' missing variables to this scenario. Re-send it to re-sync. |\n| `referencedScenarioId` | string | — | yes | Stored form. With `nodes: []` the server fills the snapshot (and the fields below) from that scenario. |\n| `referencedScenarioVersion` | integer \\| null | — |  | Stored form; filled by the server. |\n| `referencedScenarioName / lastSyncedAt` | string | — |  | Stored form; filled by the server. |\n| `nodes / edges` | stored node[] / stored edge[] | — |  | The snapshot. Send `[]` to have it filled; a non-empty snapshot (as read) is kept as is. |\n| `executionPolicy` | ExecutionPolicy | stop, no retry (engine) |  | See Execution policy. |\n\nOutput: Its inner nodes publish under their own labels — mind label clashes with this scenario's own nodes.\n\nThe linked scenario must be in the same workspace and readable by you. A scenario cannot link itself, nor a scenario whose graph links it back.\n\n```json\n{\"id\":\"setup\",\"type\":\"scenario-ref\",\"label\":\"Setup\",\"config\":{\"scenario\":\"Shared login setup\"}}\n```\n\n## Graph rules\n\nRejected on save:\n- Node ids unique; edge ids unique; every edge's source and target is an existing node id.\n- `yes` / `no` edges only leave a condition node; `error` edges only leave a non-condition node; omit `type` (or `default`) for normal flow.\n- A condition node has exactly two outgoing edges: one `yes`, one `no`.\n- At least one start node (a node with no incoming edge) and no cycles — loop with an end node's `loop` settings, never with a back edge.\n- foreach / subscenario / scenario-ref bodies are checked with the same rules.\n\nSaved with a warning: more than one start node; nodes no start node reaches.\n",
     "templating": "<!-- GENERATED FILE — do not edit by hand. Source: callman_core (npm run ai:packs). -->\n\n# Template tokens (`{{...}}`)\n\nAnywhere a `{{...}}` is accepted (URLs, headers, bodies, DB queries, Kafka payloads, scenario node configs), substitution is PLAIN TEXT replacement — no quoting, no escaping. Quote SQL strings yourself (`WHERE id = '{{userId}}'`). A missing variable resolves to an empty string.\n\n## Variable lookups\n\n- `{{name}}` — environment → globals lookup.\n- `{{env.name}}` / `{{global.name}}` — forced scope.\n- `{{response.body.<path>}}` — current request's response (request context only; dot-indexed arrays: `items.0.id`).\n- `{{<NodeLabel>.<path>}}` — a prior scenario node's output (scenario context only; bracket-indexed arrays: `rows[0].id`).\n\n## Random generators\n\n| Token | Meaning | Example output |\n| --- | --- | --- |\n| `{{random.email}}` | Random email address | `sam.user42@example.com` |\n| `{{random.string}}` | Random alphanumeric string | `aZ19xPq20LmN` |\n| `{{random.uuid}}` | Random UUID v4 | `1d7fe6b6-6f47-4fa9-b57a-d2e1d285be51` |\n| `{{random.int}}` | Random integer | `48291` |\n| `{{random.bigdecimal}}` | Random decimal number | `1842.552190` |\n| `{{random.boolean}}` | Random boolean | `true` |\n| `{{random.phone}}` | Random phone number | `+15558675309` |\n| `{{random.date(\"YYYY-MM-DD\")}}` | Random date | `2026-04-06` |\n| `{{random.name}}` | Random human name | `Aylin Karimli` |\n\n## Counters\n\n| Token | Meaning | Example output |\n| --- | --- | --- |\n| `{{counter}}` | Incrementing counter per request | `1, 2, 3...` |\n| `{{counter.start(100)}}` | Counter starting at 100 | `100, 101, 102...` |\n\n## Postman-compatible `$` tokens\n\n| Token | Meaning | Example output |\n| --- | --- | --- |\n| `{{$guid}}` | Postman compat — UUID v4 | `1d7fe6b6-6f47-4fa9-b57a-d2e1d285be51` |\n| `{{$randomUUID}}` | Postman compat — UUID v4 | `1d7fe6b6-6f47-4fa9-b57a-d2e1d285be51` |\n| `{{$timestamp}}` | Postman compat — unix seconds | `1718793600` |\n| `{{$isoTimestamp}}` | Postman compat — ISO 8601 | `2026-05-18T10:24:00.123Z` |\n| `{{$randomInt}}` | Postman compat — 0-1000 | `482` |\n| `{{$randomBoolean}}` | Postman compat | `true` |\n| `{{$randomAlphaNumeric}}` | Postman compat — 8 chars | `aZ19xPq2` |\n| `{{$randomHexaDecimal}}` | Postman compat — 0xNNNNNNNN | `0x4f3a1c2d` |\n| `{{$randomString}}` | Postman compat — 12 chars | `aZ19xPq20LmN` |\n| `{{$randomFirstName}}` | Postman compat | `Aylin` |\n| `{{$randomLastName}}` | Postman compat | `Karimov` |\n| `{{$randomFullName}}` | Postman compat | `Aylin Karimov` |\n| `{{$randomUserName}}` | Postman compat | `aylin.karimov42` |\n| `{{$randomNamePrefix}}` | Postman compat | `Dr.` |\n| `{{$randomNameSuffix}}` | Postman compat | `Jr.` |\n| `{{$randomEmail}}` | Postman compat | `sam.user42@example.com` |\n| `{{$randomUrl}}` | Postman compat | `https://acme.io/q1w2e3` |\n| `{{$randomDomainName}}` | Postman compat | `acme.io` |\n| `{{$randomDomainSuffix}}` | Postman compat | `io` |\n| `{{$randomUserAgent}}` | Postman compat | `Mozilla/5.0 (...)` |\n| `{{$randomIP}}` | Postman compat — IPv4 | `192.168.1.42` |\n| `{{$randomIPV4}}` | Postman compat | `192.168.1.42` |\n| `{{$randomIPV6}}` | Postman compat | `fe80::1ff:fe23:4567:890a` |\n| `{{$randomMACAddress}}` | Postman compat | `1A:2B:3C:4D:5E:6F` |\n| `{{$randomPassword}}` | Postman compat | `x4Z9p2Aq!` |\n| `{{$randomSemver}}` | Postman compat | `3.7.42` |\n| `{{$randomPhoneNumber}}` | Postman compat | `+15558675309` |\n| `{{$randomCity}}` | Postman compat | `Baku` |\n| `{{$randomCountry}}` | Postman compat | `Azerbaijan` |\n| `{{$randomCountryCode}}` | Postman compat | `AZ` |\n| `{{$randomStreetAddress}}` | Postman compat | `742 Maple St` |\n| `{{$randomZipCode}}` | Postman compat | `10042` |\n| `{{$randomLatitude}}` | Postman compat | `40.412345` |\n| `{{$randomLongitude}}` | Postman compat | `-74.012345` |\n| `{{$randomCompanyName}}` | Postman compat | `Acme Labs Inc.` |\n| `{{$randomJobTitle}}` | Postman compat | `Senior Software Engineer` |\n| `{{$randomJobArea}}` | Postman compat | `Engineering` |\n| `{{$randomDepartment}}` | Postman compat | `Engineering` |\n| `{{$randomProduct}}` | Postman compat | `Acme Cloud` |\n| `{{$randomCatchPhrase}}` | Postman compat | `Scalable mesh` |\n| `{{$randomCreditCardMask}}` | Postman compat | `****-****-****-4242` |\n| `{{$randomCreditCardNumber}}` | Postman compat | `4242424242424242` |\n| `{{$randomBankAccount}}` | Postman compat | `0123456789` |\n| `{{$randomBankRoutingNumber}}` | Postman compat | `021000089` |\n| `{{$randomCurrencyCode}}` | Postman compat | `USD` |\n| `{{$randomPrice}}` | Postman compat | `42.99` |\n| `{{$randomTransactionType}}` | Postman compat | `payment` |\n| `{{$randomDatetime}}` | Postman compat | `2026-04-06T10:24:00.000Z` |\n| `{{$randomDatePast}}` | Postman compat | `2025-10-12T...` |\n| `{{$randomDateFuture}}` | Postman compat | `2026-11-04T...` |\n| `{{$randomDateRecent}}` | Postman compat — last 7 days | `2026-05-15T...` |\n| `{{$randomDateSoon}}` | Postman compat — next 7 days | `2026-05-22T...` |\n| `{{$randomTime}}` | Postman compat | `14:23:07` |\n| `{{$randomWeekday}}` | Postman compat | `Wednesday` |\n| `{{$randomMonth}}` | Postman compat | `April` |\n| `{{$randomColor}}` | Postman compat | `purple` |\n| `{{$randomHexColor}}` | Postman compat | `#A78BFA` |\n| `{{$randomWord}}` | Postman compat — lorem | `ipsum` |\n| `{{$randomWords}}` | Postman compat — lorem phrase | `lorem ipsum dolor` |\n| `{{$randomSentence}}` | Postman compat | `Lorem ipsum dolor sit amet.` |\n| `{{$randomParagraph}}` | Postman compat | `Lorem ipsum dolor sit amet...` |\n| `{{$randomFileName}}` | Postman compat | `q1w2e3r4.pdf` |\n| `{{$randomFileExt}}` | Postman compat | `json` |\n| `{{$randomFileType}}` | Postman compat | `image` |\n| `{{$randomMimeType}}` | Postman compat | `application/json` |\n| `{{$randomImageUrl}}` | Postman compat | `https://picsum.photos/400/300` |\n"
 };
 //# sourceMappingURL=aiPacks.js.map

package/dist/resources/generated/aiPacks.js.map

@@ -1 +1 @@
-{"version":3,"file":"aiPacks.js","sourceRoot":"","sources":["../../../src/resources/generated/aiPacks.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,MAAM,CAAC,MAAM,qBAAqB,GAAG,QAAQ,CAAC;AAE9C,MAAM,CAAC,MAAM,QAAQ,GAA2B;IAC9C,YAAY,EAAE,wvHAAwvH;IACtwH,oBAAoB,EAAE,84eAA84e;IACp6e,gBAAgB,EAAE,q2BAAq2B;IACv3B,QAAQ,EAAE,+4YAA+4Y;IACz5Y,iBAAiB,EAAE,8gDAA8gD;IACjiD,gBAAgB,EAAE,6zgCAA6zgC;IAC/0gC,YAAY,EAAE,u0LAAu0L;CACt1L,CAAC"}
+{"version":3,"file":"aiPacks.js","sourceRoot":"","sources":["../../../src/resources/generated/aiPacks.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,MAAM,CAAC,MAAM,qBAAqB,GAAG,QAAQ,CAAC;AAE9C,MAAM,CAAC,MAAM,QAAQ,GAA2B;IAC9C,YAAY,EAAE,q8HAAq8H;IACn9H,oBAAoB,EAAE,84eAA84e;IACp6e,gBAAgB,EAAE,q2BAAq2B;IACv3B,QAAQ,EAAE,+4YAA+4Y;IACz5Y,iBAAiB,EAAE,8gDAA8gD;IACjiD,gBAAgB,EAAE,gpqCAAgpqC;IAClqqC,YAAY,EAAE,u0LAAu0L;CACt1L,CAAC"}

package/dist/resources/index.js

@@ -7,7 +7,7 @@ import { safeStringify } from "../lib/truncate.js";
 import { findCollection, findEnvironment, findRequest, loadTree, resolveDiagram, resolveScenario, resolveUiTest, workspaceTag } from "../tools/lookups.js";
 import { flowDetailView, lintContext, lintFlow } from "../tools/uiTestShared.js";
 import { CONTRACTS_DOC } from "./docs/contracts.js";
-import { DIAGRAM_SCHEMA_DOC } from "./docs/diagramSchema.js";
+import { diagramSchemaDoc } from "./docs/diagramSchema.js";
 import { OVERVIEW_DOC } from "./docs/overview.js";
 import { REQUEST_SCHEMA_DOC } from "./docs/requestSchema.js";
 import { UI_TESTS_DOC } from "./docs/uiTests.js";
@@ -44,7 +44,7 @@ export const registerResources = (server, ctx) => {
         { name: "docs-scripting-sandbox", uri: "callman://docs/scripting/sandbox", title: "Scripting: sandbox and feature policy", description: "Globals available in the script sandbox and the feature policy for DB/Kafka capabilities.", body: () => `${AI_PACKS["sandbox-globals"] ?? ""}\n\n${AI_PACKS["feature-policy"] ?? ""}` },
         { name: "docs-ui-tests", uri: "callman://docs/ui-tests", title: "UI tests", description: "UI-test concepts: platforms, header, preconditions and sub-flows, datasets and DB sources, hybrid data steps, settings, where runs happen (server runner vs your desktop app), reports and screenshots, schedules, review, masked secrets, and the recommended workflow.", body: () => UI_TESTS_DOC },
         { name: "docs-ui-test-steps", uri: "callman://docs/ui-test-steps", title: "UI-test step reference", description: "Every UI-test step (web / Android / iOS / hybrid data steps): aliases, platforms, forms, arguments and an example — generated from callman-core, the same catalog the linter uses.", body: () => renderUiTestCommandReference() },
-        { name: "docs-diagram-schema", uri: "callman://docs/diagram-schema", title: "Diagram schema", description: "Every node and edge field, styling (colors, borders, fonts), containers, edge semantics and colors, patch operations and merge rules, and the stored DiagramDocument.", body: () => DIAGRAM_SCHEMA_DOC },
+        { name: "docs-diagram-schema", uri: "callman://docs/diagram-schema", title: "Diagram schema", description: "The four diagram kinds (system design, BPMN, Mermaid, database/ERD): every node and edge field, styling, containers, edge semantics, patch operations and merge rules, the BPMN vocabulary, the database model and its schema ops, and the stored DiagramDocument.", body: () => diagramSchemaDoc() },
     ];
     for (const doc of staticDocs) {
         server.registerResource(doc.name, doc.uri, { title: doc.title, description: doc.description, mimeType: "text/markdown" }, async (uri) => text(uri, doc.body()));