@postman-cse/onboarding-bootstrap 0.12.0 → 0.13.0

package/README.md

@@ -222,7 +222,7 @@ Install globally:
 npm install -g @postman-cse/onboarding-bootstrap
 ```
 
-The CLI package supports Node.js 20+. The examples below use Node.js 24 to match the GitHub Action runtime.
+The CLI package supports Node.js 24+ to match the GitHub Action runtime.
 
 Basic usage:
 

package/action.yml

@@ -86,6 +86,10 @@ inputs:
     description: Determines how requests are named in generated collections (Fallback or URL)
     required: false
     default: Fallback
+  postman-stack:
+    description: Postman stack profile
+    required: false
+    default: prod
 outputs:
   workspace-id:
     description: Postman workspace ID

package/dist/cli.cjs

@@ -46951,6 +46951,12 @@ var openAlphaActionContract = {
       required: false,
       default: "Fallback",
       allowedValues: ["Fallback", "URL"]
+    },
+    "postman-stack": {
+      description: "Postman stack profile.",
+      required: false,
+      default: "prod",
+      allowedValues: ["prod", "beta"]
     }
   },
   outputs: {
@@ -47141,6 +47147,32 @@ var HttpError = class _HttpError extends Error {
   }
 };
 
+// src/lib/postman/base-urls.ts
+var POSTMAN_ENDPOINT_PROFILES = {
+  prod: {
+    apiBaseUrl: "https://api.getpostman.com",
+    bifrostBaseUrl: "https://bifrost-premium-https-v4.gw.postman.com",
+    cliInstallUrl: "https://dl-cli.pstmn.io/install/unix.sh",
+    gatewayBaseUrl: "https://gateway.postman.com"
+  },
+  beta: {
+    apiBaseUrl: "https://api.getpostman-beta.com",
+    bifrostBaseUrl: "https://bifrost-https-v4.gw.postman-beta.com",
+    cliInstallUrl: "https://dl-cli.pstmn-beta.io/install/unix.sh",
+    gatewayBaseUrl: "https://gateway.postman-beta.com"
+  }
+};
+function parsePostmanStack(value) {
+  const normalized = String(value || "prod").trim().toLowerCase();
+  if (normalized === "prod" || normalized === "beta") {
+    return normalized;
+  }
+  throw new Error(`Unsupported postman-stack "${value}". Supported values: prod, beta`);
+}
+function resolvePostmanEndpointProfile(stack) {
+  return POSTMAN_ENDPOINT_PROFILES[stack];
+}
+
 // src/lib/retry.ts
 function sleep(delayMs) {
   return new Promise((resolve3) => {
@@ -47195,6 +47227,15 @@ function asRecord(value) {
   }
   return value;
 }
+function extractWorkspacesPage(data) {
+  const workspaces = Array.isArray(data?.workspaces) ? data.workspaces : [];
+  const meta = asRecord(data?.meta);
+  const pagination = asRecord(data?.pagination);
+  const nextCursor = String(
+    data?.nextCursor ?? data?.next_cursor ?? meta?.nextCursor ?? meta?.next_cursor ?? pagination?.nextCursor ?? pagination?.next_cursor ?? ""
+  ).trim() || void 0;
+  return { nextCursor, workspaces };
+}
 function normalizeGitRepoUrl(url) {
   const raw = String(url || "").trim();
   if (!raw) return "";
@@ -47243,20 +47284,27 @@ function extractGitRepoUrl(value) {
 var PostmanAssetsClient = class {
   apiKey;
   baseUrl;
+  bifrostBaseUrl;
   fetchImpl;
   secretMasker;
   constructor(options) {
     this.apiKey = String(options.apiKey || "").trim();
-    this.baseUrl = String(options.baseUrl || "https://api.getpostman.com").replace(
+    this.baseUrl = String(options.baseUrl || POSTMAN_ENDPOINT_PROFILES.prod.apiBaseUrl).replace(
       /\/+$/,
       ""
     );
+    this.bifrostBaseUrl = String(
+      options.bifrostBaseUrl || POSTMAN_ENDPOINT_PROFILES.prod.bifrostBaseUrl
+    ).replace(/\/+$/, "");
     this.fetchImpl = options.fetchImpl ?? fetch;
     this.secretMasker = options.secretMasker ?? createSecretMasker([this.apiKey]);
   }
   getBaseUrl() {
     return this.baseUrl;
   }
+  getBifrostBaseUrl() {
+    return this.bifrostBaseUrl;
+  }
   async getMe() {
     return this.request("/me", { method: "GET" });
   }
@@ -47357,20 +47405,33 @@ var PostmanAssetsClient = class {
     });
   }
   async listWorkspaces() {
-    const data = await this.request("/workspaces");
-    const workspaces = data?.workspaces ?? [];
-    return Array.isArray(workspaces) ? workspaces.map((entry) => asRecord(entry)).filter((workspace) => Boolean(workspace?.id && workspace?.name)).map((workspace) => ({
+    const allWorkspaces = [];
+    const seenCursors = /* @__PURE__ */ new Set();
+    let nextCursor;
+    do {
+      const query = nextCursor ? `?cursor=${encodeURIComponent(nextCursor)}` : "";
+      const data = await this.request(`/workspaces${query}`);
+      const page = extractWorkspacesPage(data);
+      allWorkspaces.push(...page.workspaces);
+      if (!page.nextCursor || seenCursors.has(page.nextCursor)) {
+        nextCursor = void 0;
+      } else {
+        seenCursors.add(page.nextCursor);
+        nextCursor = page.nextCursor;
+      }
+    } while (nextCursor);
+    return allWorkspaces.map((entry) => asRecord(entry)).filter((workspace) => Boolean(workspace?.id && workspace?.name)).map((workspace) => ({
       id: String(workspace.id),
       name: String(workspace.name),
       type: String(workspace.type ?? "team")
-    })) : [];
+    }));
   }
   async findWorkspacesByName(name) {
     const workspaces = await this.listWorkspaces();
     return workspaces.filter((w) => w.name === name).sort((a, b) => a.id.localeCompare(b.id)).map((w) => ({ id: w.id, name: w.name }));
   }
   async getWorkspaceGitRepoUrl(workspaceId, teamId, accessToken) {
-    const url = "https://bifrost-premium-https-v4.gw.postman.com/ws/proxy";
+    const url = `${this.bifrostBaseUrl}/ws/proxy`;
     const headers = {
       "x-access-token": accessToken,
       "Content-Type": "application/json"
@@ -47389,8 +47450,12 @@ var PostmanAssetsClient = class {
     });
     if (response.status === 404) return null;
     if (!response.ok) {
-      const body2 = await response.text();
-      throw new Error(`Bifrost workspace lookup failed: ${response.status} - ${body2}`);
+      throw await HttpError.fromResponse(response, {
+        method: "POST",
+        requestHeaders: headers,
+        secretValues: [this.apiKey, accessToken],
+        url
+      });
     }
     const body = await response.text();
     if (!body.trim()) return null;
@@ -47790,26 +47855,32 @@ var PostmanAssetsClient = class {
 // src/lib/postman/internal-integration-adapter.ts
 var BifrostInternalIntegrationAdapter = class {
   accessToken;
+  bifrostBaseUrl;
   fetchImpl;
+  gatewayBaseUrl;
+  orgMode;
   secretMasker;
   teamId;
-  workerBaseUrl;
   constructor(options) {
     this.accessToken = String(options.accessToken || "").trim();
+    this.bifrostBaseUrl = String(
+      options.bifrostBaseUrl || POSTMAN_ENDPOINT_PROFILES.prod.bifrostBaseUrl
+    ).replace(/\/+$/, "");
     this.fetchImpl = options.fetchImpl ?? fetch;
+    this.gatewayBaseUrl = String(
+      options.gatewayBaseUrl || POSTMAN_ENDPOINT_PROFILES.prod.gatewayBaseUrl
+    ).replace(/\/+$/, "");
+    this.orgMode = options.orgMode ?? false;
     this.secretMasker = options.secretMasker ?? createSecretMasker([this.accessToken]);
     this.teamId = String(options.teamId || "").trim();
-    this.workerBaseUrl = String(
-      options.workerBaseUrl || "https://catalog-admin.postman-account2009.workers.dev"
-    ).replace(/\/+$/, "");
   }
   async proxyRequest(service, method, requestPath2, body) {
-    const url = "https://bifrost-premium-https-v4.gw.postman.com/ws/proxy";
+    const url = `${this.bifrostBaseUrl}/ws/proxy`;
     const headers = {
       "Content-Type": "application/json",
       "x-access-token": this.accessToken
     };
-    if (this.teamId) {
+    if (this.teamId && this.orgMode) {
       headers["x-entity-team-id"] = this.teamId;
     }
     return this.fetchImpl(url, {
@@ -47834,14 +47905,12 @@ var BifrostInternalIntegrationAdapter = class {
     if (!groupName) {
       return;
     }
-    const listResponse = await this.fetchImpl(
-      "https://gateway.postman.com/configure/workspace-groups",
-      {
-        headers: {
-          "x-access-token": this.accessToken
-        }
+    const listUrl = `${this.gatewayBaseUrl}/configure/workspace-groups`;
+    const listResponse = await this.fetchImpl(listUrl, {
+      headers: {
+        "x-access-token": this.accessToken
       }
-    );
+    });
     if (!listResponse.ok) {
       throw await HttpError.fromResponse(listResponse, {
         method: "GET",
@@ -47849,7 +47918,7 @@ var BifrostInternalIntegrationAdapter = class {
           "x-access-token": this.accessToken
         },
         secretValues: [this.accessToken],
-        url: "https://gateway.postman.com/configure/workspace-groups"
+        url: listUrl
       });
     }
     const groups = await listResponse.json();
@@ -47857,19 +47926,17 @@ var BifrostInternalIntegrationAdapter = class {
     if (!group?.id) {
       return;
     }
-    const patchResponse = await this.fetchImpl(
-      `https://gateway.postman.com/configure/workspace-groups/${group.id}`,
-      {
-        method: "PATCH",
-        headers: {
-          "Content-Type": "application/json",
-          "x-access-token": this.accessToken
-        },
-        body: JSON.stringify({
-          workspaces: [workspaceId]
-        })
-      }
-    );
+    const patchUrl = `${this.gatewayBaseUrl}/configure/workspace-groups/${group.id}`;
+    const patchResponse = await this.fetchImpl(patchUrl, {
+      method: "PATCH",
+      headers: {
+        "Content-Type": "application/json",
+        "x-access-token": this.accessToken
+      },
+      body: JSON.stringify({
+        workspaces: [workspaceId]
+      })
+    });
     if (!patchResponse.ok) {
       throw await HttpError.fromResponse(patchResponse, {
         method: "PATCH",
@@ -47878,40 +47945,7 @@ var BifrostInternalIntegrationAdapter = class {
           "x-access-token": this.accessToken
         },
         secretValues: [this.accessToken],
-        url: `https://gateway.postman.com/configure/workspace-groups/${group.id}`
-      });
-    }
-  }
-  async associateSystemEnvironments(workspaceId, associations) {
-    if (associations.length === 0) {
-      return;
-    }
-    const response = await this.fetchImpl(
-      `${this.workerBaseUrl}/api/internal/system-envs/associate`,
-      {
-        method: "POST",
-        headers: {
-          Authorization: `Bearer ${this.accessToken}`,
-          "Content-Type": "application/json"
-        },
-        body: JSON.stringify({
-          workspace_id: workspaceId,
-          associations: associations.map((entry) => ({
-            env_uid: entry.envUid,
-            system_env_id: entry.systemEnvId
-          }))
-        })
-      }
-    );
-    if (!response.ok) {
-      throw await HttpError.fromResponse(response, {
-        method: "POST",
-        requestHeaders: {
-          Authorization: `Bearer ${this.accessToken}`,
-          "Content-Type": "application/json"
-        },
-        secretValues: [this.accessToken],
-        url: `${this.workerBaseUrl}/api/internal/system-envs/associate`
+        url: patchUrl
       });
     }
   }
@@ -47951,10 +47985,10 @@ var BifrostInternalIntegrationAdapter = class {
       requestHeaders: {
         "Content-Type": "application/json",
         "x-access-token": this.accessToken,
-        ...this.teamId ? { "x-entity-team-id": this.teamId } : {}
+        ...this.teamId && this.orgMode ? { "x-entity-team-id": this.teamId } : {}
       },
       secretValues: [this.accessToken],
-      url: "https://bifrost-premium-https-v4.gw.postman.com/ws/proxy"
+      url: `${this.bifrostBaseUrl}/ws/proxy`
     });
   }
   async linkCollectionsToSpecification(specificationId, collections) {
@@ -47978,10 +48012,10 @@ var BifrostInternalIntegrationAdapter = class {
       requestHeaders: {
         "Content-Type": "application/json",
         "x-access-token": this.accessToken,
-        ...this.teamId ? { "x-entity-team-id": this.teamId } : {}
+        ...this.teamId && this.orgMode ? { "x-entity-team-id": this.teamId } : {}
       },
       secretValues: [this.accessToken],
-      url: "https://bifrost-premium-https-v4.gw.postman.com/ws/proxy"
+      url: `${this.bifrostBaseUrl}/ws/proxy`
     });
   }
   async syncCollection(specificationId, collectionId) {
@@ -47998,10 +48032,10 @@ var BifrostInternalIntegrationAdapter = class {
       requestHeaders: {
         "Content-Type": "application/json",
         "x-access-token": this.accessToken,
-        ...this.teamId ? { "x-entity-team-id": this.teamId } : {}
+        ...this.teamId && this.orgMode ? { "x-entity-team-id": this.teamId } : {}
       },
       secretValues: [this.accessToken],
-      url: "https://bifrost-premium-https-v4.gw.postman.com/ws/proxy"
+      url: `${this.bifrostBaseUrl}/ws/proxy`
     });
   }
   async getWorkspaceGitRepoUrl(workspaceId) {
@@ -48422,10 +48456,18 @@ async function resolveCanonicalWorkspaceSelection(args) {
     args.warn?.(`Workspace duplicate check failed; falling back to repo workspace ${args.repoWorkspaceId}: ${error}`);
   }
   if (matchingWorkspaces.length > 0) {
-    matchingWorkspaces = await Promise.all(matchingWorkspaces.map(async (workspace) => ({
+    const lookupResults = await Promise.allSettled(matchingWorkspaces.map(async (workspace) => ({
       ...workspace,
       linkedRepoUrl: await args.postman.getWorkspaceGitRepoUrl(workspace.id, args.teamId, args.accessToken)
     })));
+    matchingWorkspaces = lookupResults.map((result, index) => {
+      if (result.status === "fulfilled") {
+        return result.value;
+      }
+      const workspace = matchingWorkspaces[index];
+      args.warn?.(`Workspace Git repo lookup failed for ${workspace?.id ?? "unknown workspace"}; ignoring linked-repo metadata for that candidate: ${result.reason}`);
+      return workspace ? { ...workspace, linkedRepoUrl: null } : void 0;
+    }).filter((workspace) => Boolean(workspace));
   }
   return chooseCanonicalWorkspace({
     repoWorkspaceId: args.repoWorkspaceId,
@@ -61754,6 +61796,8 @@ function resolveInputs(env = process.env) {
       throw new Error(`spec-url must be a valid HTTPS URL, got: ${sanitizeUrlForLog(specUrl)}`, { cause: error });
     }
   }
+  const postmanStack = parsePostmanStack(getInput("postman-stack", env));
+  const endpointProfile = resolvePostmanEndpointProfile(postmanStack);
   return {
     projectName: getInput("project-name", env) ?? env.GITHUB_REPOSITORY?.split("/").pop() ?? env.CI_PROJECT_NAME ?? "",
     workspaceId: getInput("workspace-id", env),
@@ -61781,6 +61825,11 @@ function resolveInputs(env = process.env) {
     folderStrategy: parseEnumInput("folder-strategy", getInput("folder-strategy", env), "Paths"),
     nestedFolderHierarchy: parseBooleanInput("nested-folder-hierarchy", getInput("nested-folder-hierarchy", env), false),
     requestNameSource: parseEnumInput("request-name-source", getInput("request-name-source", env), "Fallback"),
+    postmanStack,
+    postmanApiBase: endpointProfile.apiBaseUrl,
+    postmanBifrostBase: endpointProfile.bifrostBaseUrl,
+    postmanGatewayBase: endpointProfile.gatewayBaseUrl,
+    postmanCliInstallUrl: endpointProfile.cliInstallUrl,
     githubRefName: env.GITHUB_REF_NAME,
     githubHeadRef: env.GITHUB_HEAD_REF,
     githubRef: env.GITHUB_REF,
@@ -61847,7 +61896,8 @@ function readActionInputs(actionCore) {
     INPUT_FOLDER_STRATEGY: optionalInput(actionCore, "folder-strategy") ?? openAlphaActionContract.inputs["folder-strategy"].default,
     INPUT_NESTED_FOLDER_HIERARCHY: optionalInput(actionCore, "nested-folder-hierarchy") ?? openAlphaActionContract.inputs["nested-folder-hierarchy"].default,
     INPUT_REQUEST_NAME_SOURCE: optionalInput(actionCore, "request-name-source") ?? openAlphaActionContract.inputs["request-name-source"].default,
-    INPUT_OPENAPI_VERSION: optionalInput(actionCore, "openapi-version") ?? ""
+    INPUT_OPENAPI_VERSION: optionalInput(actionCore, "openapi-version") ?? "",
+    INPUT_POSTMAN_STACK: optionalInput(actionCore, "postman-stack") ?? openAlphaActionContract.inputs["postman-stack"].default
   });
   return inputs;
 }
@@ -61857,13 +61907,29 @@ function createWorkspaceName(inputs) {
 async function runGroup(actionCore, name, fn) {
   return actionCore.group(name, fn);
 }
-async function ensurePostmanCli(dependencies, postmanApiKey) {
+function validateHttpsInstallUrl(url) {
+  const safeUrlPattern = /^https:\/\/[A-Za-z0-9.-]+\/[A-Za-z0-9._~/?=&%-]+$/;
+  if (!safeUrlPattern.test(url)) {
+    throw new Error(
+      `postman-cli-install-url must be an https URL with safe characters; got: ${url}`
+    );
+  }
+  return url;
+}
+async function ensurePostmanCli(dependencies, postmanApiKey, installUrl = "https://dl-cli.pstmn.io/install/unix.sh") {
+  const validatedUrl = validateHttpsInstallUrl(installUrl);
   const existing = await dependencies.io.which("postman", false).catch(() => "");
   if (!existing) {
-    await dependencies.exec.exec("sh", [
-      "-c",
-      'curl -o- "https://dl-cli.pstmn.io/install/unix.sh" | sh'
-    ]);
+    await dependencies.exec.exec(
+      "sh",
+      ["-c", 'curl -fsSL "$POSTMAN_CLI_INSTALL_URL" | sh'],
+      {
+        env: {
+          ...process.env,
+          POSTMAN_CLI_INSTALL_URL: validatedUrl
+        }
+      }
+    );
   }
   await dependencies.exec.exec("postman", ["login", "--with-api-key", postmanApiKey]);
 }
@@ -62081,7 +62147,7 @@ async function runBootstrap(inputs, dependencies) {
   const workspaceName = createWorkspaceName(inputs);
   const aboutText = `Auto-provisioned by Postman CS open-alpha for ${inputs.projectName}`;
   await runGroup(dependencies.core, "Install Postman CLI", async () => {
-    await ensurePostmanCli(dependencies, inputs.postmanApiKey);
+    await ensurePostmanCli(dependencies, inputs.postmanApiKey, inputs.postmanCliInstallUrl);
   });
   const resourcesState = readResourcesState();
   let specId = inputs.specId;
@@ -62197,13 +62263,17 @@ async function runBootstrap(inputs, dependencies) {
           "GET /teams returned multiple teams but none include organizationId. Org-mode detection may be degraded due to an upstream API change. If workspace creation fails, set workspace-team-id explicitly."
         );
       }
-      const orgIds = new Set(teams.filter((t) => t.organizationId != null).map((t) => t.organizationId));
-      const meTeamId = parseInt(teamId, 10);
-      const isOrgMode = teams.length > 1 && orgIds.size === 1 && orgIds.has(meTeamId);
+      const isOrgMode = teams.some((t) => t.organizationId != null);
       if (isOrgMode) {
-        const teamList = teams.map((t) => `  ${t.id}  ${t.name}`).join("\n");
-        throw new Error(
-          `Org-mode account detected. Workspace creation requires a specific sub-team ID.
+        if (teams.length === 1) {
+          workspaceTeamId = teams[0].id;
+          dependencies.core.info(
+            `Org-mode account detected. Using sub-team ${teams[0].id} (${teams[0].name}) for workspace creation.`
+          );
+        } else {
+          const teamList = teams.map((t) => `  ${t.id}  ${t.name}`).join("\n");
+          throw new Error(
+            `Org-mode account detected. Workspace creation requires a specific sub-team ID.
 
 Available sub-teams:
 ${teamList}
@@ -62215,7 +62285,8 @@ Or for reuse across runs, create a repository variable and reference it:
   workspace-team-id: \${{ vars.POSTMAN_WORKSPACE_TEAM_ID }}
 
 For CLI usage, pass --workspace-team-id <id> or export POSTMAN_WORKSPACE_TEAM_ID=<id>.`
-        );
+          );
+        }
       } else if (teams.length > 1) {
         dependencies.core.warning(
           `API key has access to ${teams.length} teams but org-mode could not be confirmed. Proceeding without teamId. If workspace creation fails, set workspace-team-id explicitly.`
@@ -62840,12 +62911,26 @@ For CLI usage, pass --workspace-team-id <id> or export POSTMAN_WORKSPACE_TEAM_ID
 }
 async function runAction(actionCore = core2, actionExec = exec, actionIo = io) {
   const inputs = readActionInputs(actionCore);
+  let orgMode = false;
+  if (inputs.postmanAccessToken && inputs.teamId) {
+    try {
+      const tempPostman = new PostmanAssetsClient({
+        apiKey: inputs.postmanApiKey,
+        baseUrl: inputs.postmanApiBase,
+        bifrostBaseUrl: inputs.postmanBifrostBase,
+        secretMasker: createSecretMasker([inputs.postmanApiKey, inputs.postmanAccessToken])
+      });
+      const teams = await tempPostman.getTeams();
+      orgMode = teams.some((t) => t.organizationId != null);
+    } catch {
+    }
+  }
   const dependencies = createBootstrapDependencies(inputs, {
     core: actionCore,
     exec: actionExec,
     io: actionIo,
     specFetcher: fetch
-  });
+  }, orgMode);
   if (inputs.domain && !dependencies.internalIntegration) {
     actionCore.warning(
       "Skipping governance assignment because postman-access-token is not configured"
@@ -62853,18 +62938,23 @@ async function runAction(actionCore = core2, actionExec = exec, actionIo = io) {
   }
   return runBootstrap(inputs, dependencies);
 }
-function createBootstrapDependencies(inputs, factories) {
+function createBootstrapDependencies(inputs, factories, orgMode = false) {
   const secretMasker = createSecretMasker([
     inputs.postmanApiKey,
     inputs.postmanAccessToken
   ]);
   const postman = new PostmanAssetsClient({
     apiKey: inputs.postmanApiKey,
+    baseUrl: inputs.postmanApiBase,
+    bifrostBaseUrl: inputs.postmanBifrostBase,
     secretMasker
   });
   const internalIntegration = inputs.postmanAccessToken ? createInternalIntegrationAdapter({
     accessToken: inputs.postmanAccessToken,
     backend: inputs.integrationBackend,
+    bifrostBaseUrl: inputs.postmanBifrostBase,
+    gatewayBaseUrl: inputs.postmanGatewayBase,
+    orgMode,
     secretMasker,
     teamId: inputs.teamId || ""
   }) : void 0;
@@ -62948,7 +63038,8 @@ var cliInputNames = [
   "request-name-source",
   "workspace-team-id",
   "repo-url",
-  "openapi-version"
+  "openapi-version",
+  "postman-stack"
 ];
 var execFileAsync = (0, import_node_util.promisify)(import_node_child_process.execFile);
 function toCommandLabel(commandLine, args, secretMasker) {

package/dist/index.cjs

@@ -46945,6 +46945,12 @@ var openAlphaActionContract = {
       required: false,
       default: "Fallback",
       allowedValues: ["Fallback", "URL"]
+    },
+    "postman-stack": {
+      description: "Postman stack profile.",
+      required: false,
+      default: "prod",
+      allowedValues: ["prod", "beta"]
     }
   },
   outputs: {
@@ -47135,6 +47141,32 @@ var HttpError = class _HttpError extends Error {
   }
 };
 
+// src/lib/postman/base-urls.ts
+var POSTMAN_ENDPOINT_PROFILES = {
+  prod: {
+    apiBaseUrl: "https://api.getpostman.com",
+    bifrostBaseUrl: "https://bifrost-premium-https-v4.gw.postman.com",
+    cliInstallUrl: "https://dl-cli.pstmn.io/install/unix.sh",
+    gatewayBaseUrl: "https://gateway.postman.com"
+  },
+  beta: {
+    apiBaseUrl: "https://api.getpostman-beta.com",
+    bifrostBaseUrl: "https://bifrost-https-v4.gw.postman-beta.com",
+    cliInstallUrl: "https://dl-cli.pstmn-beta.io/install/unix.sh",
+    gatewayBaseUrl: "https://gateway.postman-beta.com"
+  }
+};
+function parsePostmanStack(value) {
+  const normalized = String(value || "prod").trim().toLowerCase();
+  if (normalized === "prod" || normalized === "beta") {
+    return normalized;
+  }
+  throw new Error(`Unsupported postman-stack "${value}". Supported values: prod, beta`);
+}
+function resolvePostmanEndpointProfile(stack) {
+  return POSTMAN_ENDPOINT_PROFILES[stack];
+}
+
 // src/lib/retry.ts
 function sleep(delayMs) {
   return new Promise((resolve3) => {
@@ -47189,6 +47221,15 @@ function asRecord(value) {
   }
   return value;
 }
+function extractWorkspacesPage(data) {
+  const workspaces = Array.isArray(data?.workspaces) ? data.workspaces : [];
+  const meta = asRecord(data?.meta);
+  const pagination = asRecord(data?.pagination);
+  const nextCursor = String(
+    data?.nextCursor ?? data?.next_cursor ?? meta?.nextCursor ?? meta?.next_cursor ?? pagination?.nextCursor ?? pagination?.next_cursor ?? ""
+  ).trim() || void 0;
+  return { nextCursor, workspaces };
+}
 function normalizeGitRepoUrl(url) {
   const raw = String(url || "").trim();
   if (!raw) return "";
@@ -47237,20 +47278,27 @@ function extractGitRepoUrl(value) {
 var PostmanAssetsClient = class {
   apiKey;
   baseUrl;
+  bifrostBaseUrl;
   fetchImpl;
   secretMasker;
   constructor(options) {
     this.apiKey = String(options.apiKey || "").trim();
-    this.baseUrl = String(options.baseUrl || "https://api.getpostman.com").replace(
+    this.baseUrl = String(options.baseUrl || POSTMAN_ENDPOINT_PROFILES.prod.apiBaseUrl).replace(
       /\/+$/,
       ""
     );
+    this.bifrostBaseUrl = String(
+      options.bifrostBaseUrl || POSTMAN_ENDPOINT_PROFILES.prod.bifrostBaseUrl
+    ).replace(/\/+$/, "");
     this.fetchImpl = options.fetchImpl ?? fetch;
     this.secretMasker = options.secretMasker ?? createSecretMasker([this.apiKey]);
   }
   getBaseUrl() {
     return this.baseUrl;
   }
+  getBifrostBaseUrl() {
+    return this.bifrostBaseUrl;
+  }
   async getMe() {
     return this.request("/me", { method: "GET" });
   }
@@ -47351,20 +47399,33 @@ var PostmanAssetsClient = class {
     });
   }
   async listWorkspaces() {
-    const data = await this.request("/workspaces");
-    const workspaces = data?.workspaces ?? [];
-    return Array.isArray(workspaces) ? workspaces.map((entry) => asRecord(entry)).filter((workspace) => Boolean(workspace?.id && workspace?.name)).map((workspace) => ({
+    const allWorkspaces = [];
+    const seenCursors = /* @__PURE__ */ new Set();
+    let nextCursor;
+    do {
+      const query = nextCursor ? `?cursor=${encodeURIComponent(nextCursor)}` : "";
+      const data = await this.request(`/workspaces${query}`);
+      const page = extractWorkspacesPage(data);
+      allWorkspaces.push(...page.workspaces);
+      if (!page.nextCursor || seenCursors.has(page.nextCursor)) {
+        nextCursor = void 0;
+      } else {
+        seenCursors.add(page.nextCursor);
+        nextCursor = page.nextCursor;
+      }
+    } while (nextCursor);
+    return allWorkspaces.map((entry) => asRecord(entry)).filter((workspace) => Boolean(workspace?.id && workspace?.name)).map((workspace) => ({
       id: String(workspace.id),
       name: String(workspace.name),
       type: String(workspace.type ?? "team")
-    })) : [];
+    }));
   }
   async findWorkspacesByName(name) {
     const workspaces = await this.listWorkspaces();
     return workspaces.filter((w) => w.name === name).sort((a, b) => a.id.localeCompare(b.id)).map((w) => ({ id: w.id, name: w.name }));
   }
   async getWorkspaceGitRepoUrl(workspaceId, teamId, accessToken) {
-    const url = "https://bifrost-premium-https-v4.gw.postman.com/ws/proxy";
+    const url = `${this.bifrostBaseUrl}/ws/proxy`;
     const headers = {
       "x-access-token": accessToken,
       "Content-Type": "application/json"
@@ -47383,8 +47444,12 @@ var PostmanAssetsClient = class {
     });
     if (response.status === 404) return null;
     if (!response.ok) {
-      const body2 = await response.text();
-      throw new Error(`Bifrost workspace lookup failed: ${response.status} - ${body2}`);
+      throw await HttpError.fromResponse(response, {
+        method: "POST",
+        requestHeaders: headers,
+        secretValues: [this.apiKey, accessToken],
+        url
+      });
     }
     const body = await response.text();
     if (!body.trim()) return null;
@@ -47784,26 +47849,32 @@ var PostmanAssetsClient = class {
 // src/lib/postman/internal-integration-adapter.ts
 var BifrostInternalIntegrationAdapter = class {
   accessToken;
+  bifrostBaseUrl;
   fetchImpl;
+  gatewayBaseUrl;
+  orgMode;
   secretMasker;
   teamId;
-  workerBaseUrl;
   constructor(options) {
     this.accessToken = String(options.accessToken || "").trim();
+    this.bifrostBaseUrl = String(
+      options.bifrostBaseUrl || POSTMAN_ENDPOINT_PROFILES.prod.bifrostBaseUrl
+    ).replace(/\/+$/, "");
     this.fetchImpl = options.fetchImpl ?? fetch;
+    this.gatewayBaseUrl = String(
+      options.gatewayBaseUrl || POSTMAN_ENDPOINT_PROFILES.prod.gatewayBaseUrl
+    ).replace(/\/+$/, "");
+    this.orgMode = options.orgMode ?? false;
     this.secretMasker = options.secretMasker ?? createSecretMasker([this.accessToken]);
     this.teamId = String(options.teamId || "").trim();
-    this.workerBaseUrl = String(
-      options.workerBaseUrl || "https://catalog-admin.postman-account2009.workers.dev"
-    ).replace(/\/+$/, "");
   }
   async proxyRequest(service, method, requestPath2, body) {
-    const url = "https://bifrost-premium-https-v4.gw.postman.com/ws/proxy";
+    const url = `${this.bifrostBaseUrl}/ws/proxy`;
     const headers = {
       "Content-Type": "application/json",
       "x-access-token": this.accessToken
     };
-    if (this.teamId) {
+    if (this.teamId && this.orgMode) {
       headers["x-entity-team-id"] = this.teamId;
     }
     return this.fetchImpl(url, {
@@ -47828,14 +47899,12 @@ var BifrostInternalIntegrationAdapter = class {
     if (!groupName) {
       return;
     }
-    const listResponse = await this.fetchImpl(
-      "https://gateway.postman.com/configure/workspace-groups",
-      {
-        headers: {
-          "x-access-token": this.accessToken
-        }
+    const listUrl = `${this.gatewayBaseUrl}/configure/workspace-groups`;
+    const listResponse = await this.fetchImpl(listUrl, {
+      headers: {
+        "x-access-token": this.accessToken
       }
-    );
+    });
     if (!listResponse.ok) {
       throw await HttpError.fromResponse(listResponse, {
         method: "GET",
@@ -47843,7 +47912,7 @@ var BifrostInternalIntegrationAdapter = class {
           "x-access-token": this.accessToken
         },
         secretValues: [this.accessToken],
-        url: "https://gateway.postman.com/configure/workspace-groups"
+        url: listUrl
       });
     }
     const groups = await listResponse.json();
@@ -47851,19 +47920,17 @@ var BifrostInternalIntegrationAdapter = class {
     if (!group?.id) {
       return;
     }
-    const patchResponse = await this.fetchImpl(
-      `https://gateway.postman.com/configure/workspace-groups/${group.id}`,
-      {
-        method: "PATCH",
-        headers: {
-          "Content-Type": "application/json",
-          "x-access-token": this.accessToken
-        },
-        body: JSON.stringify({
-          workspaces: [workspaceId]
-        })
-      }
-    );
+    const patchUrl = `${this.gatewayBaseUrl}/configure/workspace-groups/${group.id}`;
+    const patchResponse = await this.fetchImpl(patchUrl, {
+      method: "PATCH",
+      headers: {
+        "Content-Type": "application/json",
+        "x-access-token": this.accessToken
+      },
+      body: JSON.stringify({
+        workspaces: [workspaceId]
+      })
+    });
     if (!patchResponse.ok) {
       throw await HttpError.fromResponse(patchResponse, {
         method: "PATCH",
@@ -47872,40 +47939,7 @@ var BifrostInternalIntegrationAdapter = class {
           "x-access-token": this.accessToken
         },
         secretValues: [this.accessToken],
-        url: `https://gateway.postman.com/configure/workspace-groups/${group.id}`
-      });
-    }
-  }
-  async associateSystemEnvironments(workspaceId, associations) {
-    if (associations.length === 0) {
-      return;
-    }
-    const response = await this.fetchImpl(
-      `${this.workerBaseUrl}/api/internal/system-envs/associate`,
-      {
-        method: "POST",
-        headers: {
-          Authorization: `Bearer ${this.accessToken}`,
-          "Content-Type": "application/json"
-        },
-        body: JSON.stringify({
-          workspace_id: workspaceId,
-          associations: associations.map((entry) => ({
-            env_uid: entry.envUid,
-            system_env_id: entry.systemEnvId
-          }))
-        })
-      }
-    );
-    if (!response.ok) {
-      throw await HttpError.fromResponse(response, {
-        method: "POST",
-        requestHeaders: {
-          Authorization: `Bearer ${this.accessToken}`,
-          "Content-Type": "application/json"
-        },
-        secretValues: [this.accessToken],
-        url: `${this.workerBaseUrl}/api/internal/system-envs/associate`
+        url: patchUrl
       });
     }
   }
@@ -47945,10 +47979,10 @@ var BifrostInternalIntegrationAdapter = class {
       requestHeaders: {
         "Content-Type": "application/json",
         "x-access-token": this.accessToken,
-        ...this.teamId ? { "x-entity-team-id": this.teamId } : {}
+        ...this.teamId && this.orgMode ? { "x-entity-team-id": this.teamId } : {}
       },
       secretValues: [this.accessToken],
-      url: "https://bifrost-premium-https-v4.gw.postman.com/ws/proxy"
+      url: `${this.bifrostBaseUrl}/ws/proxy`
     });
   }
   async linkCollectionsToSpecification(specificationId, collections) {
@@ -47972,10 +48006,10 @@ var BifrostInternalIntegrationAdapter = class {
       requestHeaders: {
         "Content-Type": "application/json",
         "x-access-token": this.accessToken,
-        ...this.teamId ? { "x-entity-team-id": this.teamId } : {}
+        ...this.teamId && this.orgMode ? { "x-entity-team-id": this.teamId } : {}
       },
       secretValues: [this.accessToken],
-      url: "https://bifrost-premium-https-v4.gw.postman.com/ws/proxy"
+      url: `${this.bifrostBaseUrl}/ws/proxy`
     });
   }
   async syncCollection(specificationId, collectionId) {
@@ -47992,10 +48026,10 @@ var BifrostInternalIntegrationAdapter = class {
       requestHeaders: {
         "Content-Type": "application/json",
         "x-access-token": this.accessToken,
-        ...this.teamId ? { "x-entity-team-id": this.teamId } : {}
+        ...this.teamId && this.orgMode ? { "x-entity-team-id": this.teamId } : {}
       },
       secretValues: [this.accessToken],
-      url: "https://bifrost-premium-https-v4.gw.postman.com/ws/proxy"
+      url: `${this.bifrostBaseUrl}/ws/proxy`
     });
   }
   async getWorkspaceGitRepoUrl(workspaceId) {
@@ -48416,10 +48450,18 @@ async function resolveCanonicalWorkspaceSelection(args) {
     args.warn?.(`Workspace duplicate check failed; falling back to repo workspace ${args.repoWorkspaceId}: ${error}`);
   }
   if (matchingWorkspaces.length > 0) {
-    matchingWorkspaces = await Promise.all(matchingWorkspaces.map(async (workspace) => ({
+    const lookupResults = await Promise.allSettled(matchingWorkspaces.map(async (workspace) => ({
       ...workspace,
       linkedRepoUrl: await args.postman.getWorkspaceGitRepoUrl(workspace.id, args.teamId, args.accessToken)
     })));
+    matchingWorkspaces = lookupResults.map((result, index) => {
+      if (result.status === "fulfilled") {
+        return result.value;
+      }
+      const workspace = matchingWorkspaces[index];
+      args.warn?.(`Workspace Git repo lookup failed for ${workspace?.id ?? "unknown workspace"}; ignoring linked-repo metadata for that candidate: ${result.reason}`);
+      return workspace ? { ...workspace, linkedRepoUrl: null } : void 0;
+    }).filter((workspace) => Boolean(workspace));
   }
   return chooseCanonicalWorkspace({
     repoWorkspaceId: args.repoWorkspaceId,
@@ -61748,6 +61790,8 @@ function resolveInputs(env = process.env) {
       throw new Error(`spec-url must be a valid HTTPS URL, got: ${sanitizeUrlForLog(specUrl)}`, { cause: error });
     }
   }
+  const postmanStack = parsePostmanStack(getInput("postman-stack", env));
+  const endpointProfile = resolvePostmanEndpointProfile(postmanStack);
   return {
     projectName: getInput("project-name", env) ?? env.GITHUB_REPOSITORY?.split("/").pop() ?? env.CI_PROJECT_NAME ?? "",
     workspaceId: getInput("workspace-id", env),
@@ -61775,6 +61819,11 @@ function resolveInputs(env = process.env) {
     folderStrategy: parseEnumInput("folder-strategy", getInput("folder-strategy", env), "Paths"),
     nestedFolderHierarchy: parseBooleanInput("nested-folder-hierarchy", getInput("nested-folder-hierarchy", env), false),
     requestNameSource: parseEnumInput("request-name-source", getInput("request-name-source", env), "Fallback"),
+    postmanStack,
+    postmanApiBase: endpointProfile.apiBaseUrl,
+    postmanBifrostBase: endpointProfile.bifrostBaseUrl,
+    postmanGatewayBase: endpointProfile.gatewayBaseUrl,
+    postmanCliInstallUrl: endpointProfile.cliInstallUrl,
     githubRefName: env.GITHUB_REF_NAME,
     githubHeadRef: env.GITHUB_HEAD_REF,
     githubRef: env.GITHUB_REF,
@@ -61841,7 +61890,8 @@ function readActionInputs(actionCore) {
     INPUT_FOLDER_STRATEGY: optionalInput(actionCore, "folder-strategy") ?? openAlphaActionContract.inputs["folder-strategy"].default,
     INPUT_NESTED_FOLDER_HIERARCHY: optionalInput(actionCore, "nested-folder-hierarchy") ?? openAlphaActionContract.inputs["nested-folder-hierarchy"].default,
     INPUT_REQUEST_NAME_SOURCE: optionalInput(actionCore, "request-name-source") ?? openAlphaActionContract.inputs["request-name-source"].default,
-    INPUT_OPENAPI_VERSION: optionalInput(actionCore, "openapi-version") ?? ""
+    INPUT_OPENAPI_VERSION: optionalInput(actionCore, "openapi-version") ?? "",
+    INPUT_POSTMAN_STACK: optionalInput(actionCore, "postman-stack") ?? openAlphaActionContract.inputs["postman-stack"].default
   });
   return inputs;
 }
@@ -61851,13 +61901,29 @@ function createWorkspaceName(inputs) {
 async function runGroup(actionCore, name, fn) {
   return actionCore.group(name, fn);
 }
-async function ensurePostmanCli(dependencies, postmanApiKey) {
+function validateHttpsInstallUrl(url) {
+  const safeUrlPattern = /^https:\/\/[A-Za-z0-9.-]+\/[A-Za-z0-9._~/?=&%-]+$/;
+  if (!safeUrlPattern.test(url)) {
+    throw new Error(
+      `postman-cli-install-url must be an https URL with safe characters; got: ${url}`
+    );
+  }
+  return url;
+}
+async function ensurePostmanCli(dependencies, postmanApiKey, installUrl = "https://dl-cli.pstmn.io/install/unix.sh") {
+  const validatedUrl = validateHttpsInstallUrl(installUrl);
   const existing = await dependencies.io.which("postman", false).catch(() => "");
   if (!existing) {
-    await dependencies.exec.exec("sh", [
-      "-c",
-      'curl -o- "https://dl-cli.pstmn.io/install/unix.sh" | sh'
-    ]);
+    await dependencies.exec.exec(
+      "sh",
+      ["-c", 'curl -fsSL "$POSTMAN_CLI_INSTALL_URL" | sh'],
+      {
+        env: {
+          ...process.env,
+          POSTMAN_CLI_INSTALL_URL: validatedUrl
+        }
+      }
+    );
   }
   await dependencies.exec.exec("postman", ["login", "--with-api-key", postmanApiKey]);
 }
@@ -62075,7 +62141,7 @@ async function runBootstrap(inputs, dependencies) {
   const workspaceName = createWorkspaceName(inputs);
   const aboutText = `Auto-provisioned by Postman CS open-alpha for ${inputs.projectName}`;
   await runGroup(dependencies.core, "Install Postman CLI", async () => {
-    await ensurePostmanCli(dependencies, inputs.postmanApiKey);
+    await ensurePostmanCli(dependencies, inputs.postmanApiKey, inputs.postmanCliInstallUrl);
   });
   const resourcesState = readResourcesState();
   let specId = inputs.specId;
@@ -62191,13 +62257,17 @@ async function runBootstrap(inputs, dependencies) {
           "GET /teams returned multiple teams but none include organizationId. Org-mode detection may be degraded due to an upstream API change. If workspace creation fails, set workspace-team-id explicitly."
         );
       }
-      const orgIds = new Set(teams.filter((t) => t.organizationId != null).map((t) => t.organizationId));
-      const meTeamId = parseInt(teamId, 10);
-      const isOrgMode = teams.length > 1 && orgIds.size === 1 && orgIds.has(meTeamId);
+      const isOrgMode = teams.some((t) => t.organizationId != null);
       if (isOrgMode) {
-        const teamList = teams.map((t) => `  ${t.id}  ${t.name}`).join("\n");
-        throw new Error(
-          `Org-mode account detected. Workspace creation requires a specific sub-team ID.
+        if (teams.length === 1) {
+          workspaceTeamId = teams[0].id;
+          dependencies.core.info(
+            `Org-mode account detected. Using sub-team ${teams[0].id} (${teams[0].name}) for workspace creation.`
+          );
+        } else {
+          const teamList = teams.map((t) => `  ${t.id}  ${t.name}`).join("\n");
+          throw new Error(
+            `Org-mode account detected. Workspace creation requires a specific sub-team ID.
 
 Available sub-teams:
 ${teamList}
@@ -62209,7 +62279,8 @@ Or for reuse across runs, create a repository variable and reference it:
   workspace-team-id: \${{ vars.POSTMAN_WORKSPACE_TEAM_ID }}
 
 For CLI usage, pass --workspace-team-id <id> or export POSTMAN_WORKSPACE_TEAM_ID=<id>.`
-        );
+          );
+        }
       } else if (teams.length > 1) {
         dependencies.core.warning(
           `API key has access to ${teams.length} teams but org-mode could not be confirmed. Proceeding without teamId. If workspace creation fails, set workspace-team-id explicitly.`
@@ -62834,12 +62905,26 @@ For CLI usage, pass --workspace-team-id <id> or export POSTMAN_WORKSPACE_TEAM_ID
 }
 async function runAction(actionCore = core2, actionExec = exec, actionIo = io) {
   const inputs = readActionInputs(actionCore);
+  let orgMode = false;
+  if (inputs.postmanAccessToken && inputs.teamId) {
+    try {
+      const tempPostman = new PostmanAssetsClient({
+        apiKey: inputs.postmanApiKey,
+        baseUrl: inputs.postmanApiBase,
+        bifrostBaseUrl: inputs.postmanBifrostBase,
+        secretMasker: createSecretMasker([inputs.postmanApiKey, inputs.postmanAccessToken])
+      });
+      const teams = await tempPostman.getTeams();
+      orgMode = teams.some((t) => t.organizationId != null);
+    } catch {
+    }
+  }
   const dependencies = createBootstrapDependencies(inputs, {
     core: actionCore,
     exec: actionExec,
     io: actionIo,
     specFetcher: fetch
-  });
+  }, orgMode);
   if (inputs.domain && !dependencies.internalIntegration) {
     actionCore.warning(
       "Skipping governance assignment because postman-access-token is not configured"
@@ -62847,18 +62932,23 @@ async function runAction(actionCore = core2, actionExec = exec, actionIo = io) {
   }
   return runBootstrap(inputs, dependencies);
 }
-function createBootstrapDependencies(inputs, factories) {
+function createBootstrapDependencies(inputs, factories, orgMode = false) {
   const secretMasker = createSecretMasker([
     inputs.postmanApiKey,
     inputs.postmanAccessToken
   ]);
   const postman = new PostmanAssetsClient({
     apiKey: inputs.postmanApiKey,
+    baseUrl: inputs.postmanApiBase,
+    bifrostBaseUrl: inputs.postmanBifrostBase,
     secretMasker
   });
   const internalIntegration = inputs.postmanAccessToken ? createInternalIntegrationAdapter({
     accessToken: inputs.postmanAccessToken,
     backend: inputs.integrationBackend,
+    bifrostBaseUrl: inputs.postmanBifrostBase,
+    gatewayBaseUrl: inputs.postmanGatewayBase,
+    orgMode,
     secretMasker,
     teamId: inputs.teamId || ""
   }) : void 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@postman-cse/onboarding-bootstrap",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "Public open-alpha Postman bootstrap GitHub Action.",
   "type": "module",
   "main": "dist/index.cjs",
@@ -14,10 +14,10 @@
     "LICENSE"
   ],
   "engines": {
-    "node": ">=20"
+    "node": ">=24"
   },
   "scripts": {
-    "build": "npm run typecheck && rm -rf dist && esbuild src/index.ts --bundle --platform=node --target=node20 --format=cjs --outfile=dist/index.cjs && esbuild src/cli.ts --bundle --platform=node --target=node20 --format=cjs --outfile=dist/cli.cjs",
+    "build": "npm run typecheck && rm -rf dist && esbuild src/index.ts --bundle --platform=node --target=node24 --format=cjs --outfile=dist/index.cjs && esbuild src/cli.ts --bundle --platform=node --target=node24 --format=cjs --outfile=dist/cli.cjs",
     "check:dist": "npm run build && git diff --exit-code -- dist",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",