@postman-cse/onboarding-bootstrap 0.9.1 → 0.10.0

package/dist/cli.cjs

@@ -22777,6 +22777,7 @@ var require_stringify = __commonJS({
         nullStr: "null",
         simpleKeys: false,
         singleQuote: null,
+        trailingComma: false,
         trueStr: "true",
         verifyAliasOrder: true
       }, doc.schema.toStringOptions, options);
@@ -23294,12 +23295,19 @@ ${indent}${line}` : "\n";
         if (comment)
           reqNewline = true;
         let str = stringify2.stringify(item, itemCtx, () => comment = null);
-        if (i < items.length - 1)
+        reqNewline || (reqNewline = lines.length > linesAtValue || str.includes("\n"));
+        if (i < items.length - 1) {
           str += ",";
+        } else if (ctx.options.trailingComma) {
+          if (ctx.options.lineWidth > 0) {
+            reqNewline || (reqNewline = lines.reduce((sum, line) => sum + line.length + 2, 2) + (str.length + 2) > ctx.options.lineWidth);
+          }
+          if (reqNewline) {
+            str += ",";
+          }
+        }
         if (comment)
           str += stringifyComment.lineComment(str, itemIndent, commentString(comment));
-        if (!reqNewline && (lines.length > linesAtValue || str.includes("\n")))
-          reqNewline = true;
         lines.push(str);
         linesAtValue = lines.length;
       }
@@ -26313,17 +26321,22 @@ var require_compose_node = __commonJS({
         case "block-map":
         case "block-seq":
         case "flow-collection":
-          node = composeCollection.composeCollection(CN, ctx, token, props, onError);
-          if (anchor)
-            node.anchor = anchor.source.substring(1);
+          try {
+            node = composeCollection.composeCollection(CN, ctx, token, props, onError);
+            if (anchor)
+              node.anchor = anchor.source.substring(1);
+          } catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            onError(token, "RESOURCE_EXHAUSTION", message);
+          }
           break;
         default: {
           const message = token.type === "error" ? token.message : `Unsupported token (type: ${token.type})`;
           onError(token, "UNEXPECTED_TOKEN", message);
-          node = composeEmptyNode(ctx, token.offset, void 0, null, props, onError);
           isSrcToken = false;
         }
       }
+      node ?? (node = composeEmptyNode(ctx, token.offset, void 0, null, props, onError));
       if (anchor && node.anchor === "")
         onError(anchor, "BAD_ALIAS", "Anchor cannot be an empty string");
       if (atKey && ctx.options.stringKeys && (!identity.isScalar(node) || typeof node.value !== "string" || node.tag && node.tag !== "tag:yaml.org,2002:str")) {
@@ -28687,6 +28700,7 @@ var io2 = __toESM(require_io(), 1);
 var core = __toESM(require_core(), 1);
 var exec = __toESM(require_exec(), 1);
 var io = __toESM(require_io(), 1);
+var import_node_fs = require("node:fs");
 var import_yaml = __toESM(require_dist(), 1);
 
 // src/contracts.ts
@@ -28714,6 +28728,22 @@ var openAlphaActionContract = {
       description: "Existing contract collection ID.",
       required: false
     },
+    "collection-sync-mode": {
+      description: "Collection lifecycle policy: reuse existing collections, refresh them from the latest spec, or version them by release label.",
+      required: false,
+      default: "refresh",
+      allowedValues: ["reuse", "refresh", "version"]
+    },
+    "spec-sync-mode": {
+      description: "Spec lifecycle policy: update the canonical spec or create/reuse a versioned spec for the resolved release label.",
+      required: false,
+      default: "update",
+      allowedValues: ["update", "version"]
+    },
+    "release-label": {
+      description: "Optional release label. When omitted for versioned sync, the action derives one from GitHub ref metadata.",
+      required: false
+    },
     "project-name": {
       description: "Service project name.",
       required: true
@@ -28734,20 +28764,14 @@ var openAlphaActionContract = {
       description: "Comma-separated workspace admin user ids.",
       required: false
     },
+    "workspace-team-id": {
+      description: "Numeric sub-team ID for org-mode workspace creation.",
+      required: false
+    },
     "spec-url": {
       description: "HTTPS URL to the OpenAPI document.",
       required: true
     },
-    "environments-json": {
-      description: "JSON array of environment slugs to preserve in bootstrap outputs.",
-      required: false,
-      default: '["prod"]'
-    },
-    "system-env-map-json": {
-      description: "JSON map of environment slug to system environment id.",
-      required: false,
-      default: "{}"
-    },
     "governance-mapping-json": {
       description: "JSON map of business domain to governance group name.",
       required: false,
@@ -28761,19 +28785,6 @@ var openAlphaActionContract = {
       description: "Postman access token used for governance and workspace mutations.",
       required: false
     },
-    "github-token": {
-      description: "GitHub token for repository variable persistence.",
-      required: false
-    },
-    "gh-fallback-token": {
-      description: "Fallback token for repository variable APIs.",
-      required: false
-    },
-    "github-auth-mode": {
-      description: "GitHub auth mode for repository variable APIs.",
-      required: false,
-      default: "github_token_first"
-    },
     "integration-backend": {
       description: "Integration backend for downstream workspace connectivity.",
       required: false,
@@ -28819,8 +28830,8 @@ var openAlphaActionContract = {
     "OpenAPI operation summary normalization before upload (missing or oversized summaries)",
     "spec linting by UID",
     "baseline, smoke, and contract collection generation",
+    "collection refresh and versioning policies",
     "collection tagging",
-    "GitHub repository variable persistence for downstream sync steps",
     "workspace, spec, and collection outputs"
   ],
   removedBehavior: [
@@ -28911,189 +28922,6 @@ function sanitizeHeaders(headers, secretValues) {
   return sanitized;
 }
 
-// src/lib/github/github-api-client.ts
-function buildErrorMessage(method, path2, response, body, masker) {
-  const status = `${response.status}${response.statusText ? ` ${response.statusText}` : ""}`;
-  const sanitizedBody = masker(body || "");
-  return sanitizedBody ? masker(`${method} ${path2} failed with ${status} - ${sanitizedBody}`) : masker(`${method} ${path2} failed with ${status} - [REDACTED]`);
-}
-var GitHubApiClient = class {
-  apiBase;
-  authMode;
-  appToken;
-  fallbackToken;
-  fetchImpl;
-  owner;
-  repo;
-  repository;
-  secretMasker;
-  token;
-  constructor(options) {
-    this.apiBase = String(options.apiBase || "https://api.github.com").replace(
-      /\/+$/,
-      ""
-    );
-    this.appToken = String(options.appToken || "").trim();
-    this.authMode = options.authMode || "github_token_first";
-    this.fallbackToken = String(options.fallbackToken || "").trim();
-    this.fetchImpl = options.fetch ?? fetch;
-    this.repository = options.repository;
-    const [owner, repo] = options.repository.split("/");
-    this.owner = owner;
-    this.repo = repo;
-    this.token = String(options.token || "").trim();
-    this.secretMasker = options.secretMasker ?? createSecretMasker([this.token, this.fallbackToken, this.appToken]);
-  }
-  getTokenOrder() {
-    const ordered = [];
-    if (this.authMode === "app_token") {
-      if (this.appToken) ordered.push(this.appToken);
-      if (this.token && this.token !== this.appToken) ordered.push(this.token);
-      if (this.fallbackToken && this.fallbackToken !== this.appToken && this.fallbackToken !== this.token) {
-        ordered.push(this.fallbackToken);
-      }
-      return ordered;
-    }
-    if (this.authMode === "fallback_pat_first") {
-      if (this.fallbackToken) ordered.push(this.fallbackToken);
-      if (this.token && this.token !== this.fallbackToken) ordered.push(this.token);
-      return ordered;
-    }
-    if (this.token) ordered.push(this.token);
-    if (this.fallbackToken && this.fallbackToken !== this.token) {
-      ordered.push(this.fallbackToken);
-    }
-    return ordered;
-  }
-  isVariablesEndpoint(path2) {
-    return path2.startsWith(`/repos/${this.owner}/${this.repo}/actions/variables`);
-  }
-  canUseFallback(path2) {
-    return this.isVariablesEndpoint(path2) || path2.includes(`/repos/${this.owner}/${this.repo}/contents`) || path2.includes("/dispatches");
-  }
-  rateLimitDelayMs(response, attempt) {
-    const retryAfter = Number(response.headers.get("retry-after") || "");
-    if (Number.isFinite(retryAfter) && retryAfter > 0) {
-      return Math.min(retryAfter * 1e3, 12e4);
-    }
-    const resetAtSeconds = Number(response.headers.get("x-ratelimit-reset") || "");
-    if (Number.isFinite(resetAtSeconds) && resetAtSeconds > 0) {
-      const delta = resetAtSeconds * 1e3 - Date.now();
-      if (delta > 0) {
-        return Math.min(delta + 250, 12e4);
-      }
-    }
-    const base = Math.min(5e3 * Math.pow(2, attempt), 12e4);
-    const jitter = Math.floor(Math.random() * 250);
-    return Math.min(base + jitter, 12e4);
-  }
-  async requestWithToken(path2, init, token) {
-    const MAX_RETRIES = 5;
-    const normalizedToken = String(token || "").trim();
-    if (!normalizedToken) {
-      throw new Error(`Missing GitHub auth token for request ${path2}`);
-    }
-    for (let attempt = 0; ; attempt++) {
-      const response = await this.fetchImpl(`${this.apiBase}${path2}`, {
-        ...init,
-        headers: {
-          Accept: "application/vnd.github+json",
-          Authorization: `Bearer ${normalizedToken}`,
-          "Content-Type": "application/json",
-          ...init.headers || {}
-        }
-      });
-      if (attempt < MAX_RETRIES && (response.status === 403 || response.status === 429)) {
-        const body = await response.clone().text().catch(() => "");
-        if (isRateLimitedResponse(response, body)) {
-          const delay = this.rateLimitDelayMs(response, attempt);
-          console.log(
-            `GitHub API rate limited, retrying in ${Math.ceil(delay / 1e3)}s (attempt ${attempt + 1}/${MAX_RETRIES})...`
-          );
-          await new Promise((r) => setTimeout(r, delay));
-          continue;
-        }
-      }
-      return response;
-    }
-  }
-  async request(path2, init = {}) {
-    const orderedTokens = this.getTokenOrder();
-    if (orderedTokens.length === 0) {
-      throw new Error("No GitHub auth token configured");
-    }
-    const first = await this.requestWithToken(path2, init, orderedTokens[0]);
-    if (orderedTokens.length < 2 || !this.canUseFallback(path2)) {
-      return first;
-    }
-    const isVariableGet404 = first.status === 404 && (!init.method || init.method === "GET") && this.isVariablesEndpoint(path2);
-    if (first.status !== 403 && !isVariableGet404) {
-      return first;
-    }
-    return this.requestWithToken(path2, init, orderedTokens[1]);
-  }
-  async setRepositoryVariable(name, value) {
-    if (!value) {
-      throw new Error(`Repo variable ${name} is empty`);
-    }
-    const path2 = `/repos/${this.repository}/actions/variables`;
-    const body = JSON.stringify({ name, value: String(value) });
-    const createResponse = await this.request(path2, {
-      method: "POST",
-      body
-    });
-    if (createResponse.ok || createResponse.status === 201) {
-      return;
-    }
-    if (createResponse.status === 409 || createResponse.status === 422) {
-      const updatePath = `/repos/${this.repository}/actions/variables/${name}`;
-      const updateResponse = await this.request(updatePath, {
-        method: "PATCH",
-        body
-      });
-      if (updateResponse.ok) {
-        return;
-      }
-      const text2 = await updateResponse.text().catch(() => "");
-      throw new Error(
-        buildErrorMessage("PATCH", updatePath, updateResponse, text2, this.secretMasker)
-      );
-    }
-    const text = await createResponse.text().catch(() => "");
-    throw new Error(
-      buildErrorMessage("POST", path2, createResponse, text, this.secretMasker)
-    );
-  }
-  async getRepositoryVariable(name) {
-    const path2 = `/repos/${this.repository}/actions/variables/${name}`;
-    const response = await this.request(path2, {
-      method: "GET"
-    });
-    if (response.status === 404) {
-      return "";
-    }
-    if (!response.ok) {
-      const text = await response.text().catch(() => "");
-      throw new Error(
-        buildErrorMessage("GET", path2, response, text, this.secretMasker)
-      );
-    }
-    const data = await response.json();
-    return String(data.value || "");
-  }
-};
-function isRateLimitedResponse(response, body) {
-  if (response.status !== 403 && response.status !== 429) return false;
-  const remaining = response.headers.get("x-ratelimit-remaining");
-  const retryAfter = response.headers.get("retry-after");
-  if (remaining === "0") return true;
-  if (retryAfter) return true;
-  const message = body.toLowerCase();
-  if (message.includes("secondary rate limit")) return true;
-  if (message.includes("api rate limit exceeded")) return true;
-  return response.status === 429;
-}
-
 // src/lib/http-error.ts
 function truncate(value, limit) {
   if (value.length <= limit) {
@@ -29276,6 +29104,16 @@ var PostmanAssetsClient = class {
     }
     return void 0;
   }
+  async getTeams() {
+    const data = await this.request("/teams");
+    const teams = data?.data ?? [];
+    return Array.isArray(teams) ? teams.filter((t) => t?.id && t?.name).map((t) => ({
+      id: Number(t.id),
+      name: String(t.name),
+      handle: String(t.handle || ""),
+      ...t.organizationId != null ? { organizationId: Number(t.organizationId) } : {}
+    })) : [];
+  }
   async request(path2, init = {}) {
     const url = path2.startsWith("http") ? path2 : `${this.baseUrl}${path2}`;
     const response = await this.fetchImpl(url, {
@@ -29304,13 +29142,14 @@ var PostmanAssetsClient = class {
       return null;
     }
   }
-  async createWorkspace(name, about) {
+  async createWorkspace(name, about, targetTeamId) {
     return retry(async () => {
       const payload = {
         workspace: {
           about,
           name,
-          type: "team"
+          type: "team",
+          ...targetTeamId != null && !Number.isNaN(targetTeamId) ? { teamId: targetTeamId } : {}
         }
       };
       let created;
@@ -29322,7 +29161,7 @@ var PostmanAssetsClient = class {
       } catch (err) {
         if (err instanceof Error && err.message.includes("Only personal workspaces")) {
           throw new Error(
-            "Workspace creation failed: Your team may have Org Mode enabled. Org-level workspaces require a different API request schema which is currently unsupported in this alpha version."
+            "Workspace creation failed: This may be an Org-mode account that requires a workspace-team-id input. The Postman API does not allow creating team workspaces at the organization level. Use the workspace-team-id input to specify which sub-team should own this workspace."
           );
         }
         throw err;
@@ -29341,7 +29180,11 @@ var PostmanAssetsClient = class {
       return {
         id: workspaceId
       };
-    }, { maxAttempts: 3, delayMs: 2e3 });
+    }, {
+      maxAttempts: 3,
+      delayMs: 2e3,
+      shouldRetry: (err) => !(err instanceof Error && err.message.includes("workspace-team-id"))
+    });
   }
   async listWorkspaces() {
     const data = await this.request("/workspaces");
@@ -30153,31 +29996,17 @@ function requireInput(actionCore, name) {
 function optionalInput(actionCore, name) {
   return normalizeInputValue(actionCore.getInput(name));
 }
-function parseJsonValue(raw, fallback, inputName) {
-  try {
-    return JSON.parse(raw || JSON.stringify(fallback)) ?? fallback;
-  } catch (error) {
-    throw new Error(
-      `Invalid JSON for ${inputName}: ${error instanceof Error ? error.message : String(error)}`
-    );
+function parseCollectionSyncMode(value) {
+  if (value === "reuse" || value === "version") {
+    return value;
   }
+  return "refresh";
 }
-function asStringArray(value, inputName) {
-  if (!Array.isArray(value)) {
-    throw new Error(`${inputName} must be a JSON array`);
+function parseSpecSyncMode(value) {
+  if (value === "version") {
+    return value;
   }
-  return value.map((entry) => String(entry));
-}
-function asStringMap(value, inputName) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new Error(`${inputName} must be a JSON object`);
-  }
-  return Object.fromEntries(
-    Object.entries(value).map(([key, entry]) => [
-      key,
-      String(entry)
-    ])
-  );
+  return "update";
 }
 function resolveInputs(env = process.env) {
   const repoContext = detectRepoContext(
@@ -30205,28 +30034,31 @@ function resolveInputs(env = process.env) {
     }
   }
   return {
-    projectName: getInput("project-name", env) ?? "",
+    projectName: getInput("project-name", env) ?? env.GITHUB_REPOSITORY?.split("/").pop() ?? env.CI_PROJECT_NAME ?? "",
     workspaceId: getInput("workspace-id", env),
     specId: getInput("spec-id", env),
     baselineCollectionId: getInput("baseline-collection-id", env),
     smokeCollectionId: getInput("smoke-collection-id", env),
     contractCollectionId: getInput("contract-collection-id", env),
+    collectionSyncMode: parseCollectionSyncMode(getInput("collection-sync-mode", env)),
+    specSyncMode: parseSpecSyncMode(getInput("spec-sync-mode", env)),
+    releaseLabel: getInput("release-label", env),
     domain: getInput("domain", env),
     domainCode: getInput("domain-code", env),
     requesterEmail: getInput("requester-email", env),
     workspaceAdminUserIds: getInput("workspace-admin-user-ids", env) || env.WORKSPACE_ADMIN_USER_IDS || "",
+    workspaceTeamId: getInput("workspace-team-id", env) || env.POSTMAN_WORKSPACE_TEAM_ID,
     teamId: getInput("team-id", env) || env.POSTMAN_TEAM_ID || "",
     repoUrl: repoContext.repoUrl || "",
     specUrl,
-    environmentsJson: getInput("environments-json", env) ?? openAlphaActionContract.inputs["environments-json"].default ?? '["prod"]',
-    systemEnvMapJson: getInput("system-env-map-json", env) ?? openAlphaActionContract.inputs["system-env-map-json"].default ?? "{}",
     governanceMappingJson: getInput("governance-mapping-json", env) ?? openAlphaActionContract.inputs["governance-mapping-json"].default ?? "{}",
     postmanApiKey: getInput("postman-api-key", env) ?? "",
     postmanAccessToken: getInput("postman-access-token", env),
-    githubToken: getInput("github-token", env),
-    ghFallbackToken: getInput("gh-fallback-token", env),
-    githubAuthMode: getInput("github-auth-mode", env) ?? openAlphaActionContract.inputs["github-auth-mode"].default ?? "github_token_first",
-    integrationBackend
+    integrationBackend,
+    githubRefName: env.GITHUB_REF_NAME,
+    githubHeadRef: env.GITHUB_HEAD_REF,
+    githubRef: env.GITHUB_REF,
+    githubSha: env.GITHUB_SHA
   };
 }
 function createPlannedOutputs(inputs) {
@@ -30257,12 +30089,8 @@ function readActionInputs(actionCore) {
   const specUrl = requireInput(actionCore, "spec-url");
   const postmanApiKey = requireInput(actionCore, "postman-api-key");
   const postmanAccessToken = optionalInput(actionCore, "postman-access-token");
-  const githubToken = optionalInput(actionCore, "github-token");
-  const ghFallbackToken = optionalInput(actionCore, "gh-fallback-token");
   actionCore.setSecret(postmanApiKey);
   if (postmanAccessToken) actionCore.setSecret(postmanAccessToken);
-  if (githubToken) actionCore.setSecret(githubToken);
-  if (ghFallbackToken) actionCore.setSecret(ghFallbackToken);
   const inputs = resolveInputs({
     ...process.env,
     INPUT_PROJECT_NAME: projectName,
@@ -30271,6 +30099,9 @@ function readActionInputs(actionCore) {
     INPUT_BASELINE_COLLECTION_ID: optionalInput(actionCore, "baseline-collection-id"),
     INPUT_SMOKE_COLLECTION_ID: optionalInput(actionCore, "smoke-collection-id"),
     INPUT_CONTRACT_COLLECTION_ID: optionalInput(actionCore, "contract-collection-id"),
+    INPUT_COLLECTION_SYNC_MODE: optionalInput(actionCore, "collection-sync-mode") ?? openAlphaActionContract.inputs["collection-sync-mode"].default,
+    INPUT_SPEC_SYNC_MODE: optionalInput(actionCore, "spec-sync-mode") ?? openAlphaActionContract.inputs["spec-sync-mode"].default,
+    INPUT_RELEASE_LABEL: optionalInput(actionCore, "release-label"),
     INPUT_DOMAIN: optionalInput(actionCore, "domain"),
     INPUT_DOMAIN_CODE: optionalInput(actionCore, "domain-code"),
     INPUT_REQUESTER_EMAIL: optionalInput(actionCore, "requester-email"),
@@ -30278,17 +30109,13 @@ function readActionInputs(actionCore) {
       actionCore,
       "workspace-admin-user-ids"
     ),
+    INPUT_WORKSPACE_TEAM_ID: optionalInput(actionCore, "workspace-team-id") || process.env.POSTMAN_WORKSPACE_TEAM_ID,
     INPUT_TEAM_ID: optionalInput(actionCore, "postman-team-id") || process.env.POSTMAN_TEAM_ID,
     INPUT_REPO_URL: optionalInput(actionCore, "repo-url"),
     INPUT_SPEC_URL: specUrl,
-    INPUT_ENVIRONMENTS_JSON: optionalInput(actionCore, "environments-json") ?? openAlphaActionContract.inputs["environments-json"].default,
-    INPUT_SYSTEM_ENV_MAP_JSON: optionalInput(actionCore, "system-env-map-json") ?? openAlphaActionContract.inputs["system-env-map-json"].default,
     INPUT_GOVERNANCE_MAPPING_JSON: optionalInput(actionCore, "governance-mapping-json") ?? openAlphaActionContract.inputs["governance-mapping-json"].default,
     INPUT_POSTMAN_API_KEY: postmanApiKey,
     INPUT_POSTMAN_ACCESS_TOKEN: postmanAccessToken,
-    INPUT_GITHUB_TOKEN: githubToken,
-    INPUT_GH_FALLBACK_TOKEN: ghFallbackToken,
-    INPUT_GITHUB_AUTH_MODE: optionalInput(actionCore, "github-auth-mode") ?? openAlphaActionContract.inputs["github-auth-mode"].default,
     INPUT_INTEGRATION_BACKEND: optionalInput(actionCore, "integration-backend") ?? openAlphaActionContract.inputs["integration-backend"].default
   });
   return inputs;
@@ -30365,6 +30192,45 @@ async function fetchSpecDocument(specUrl, specFetcher) {
     }
   );
 }
+function normalizeReleaseLabel(value) {
+  const trimmed = String(value || "").trim();
+  if (!trimmed) {
+    return void 0;
+  }
+  return trimmed.replace(/^refs\/heads\//, "").replace(/^refs\/tags\//, "").replace(/^refs\/pull\//, "pull-").replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "") || void 0;
+}
+function deriveReleaseLabel(inputs) {
+  if (inputs.releaseLabel) {
+    return normalizeReleaseLabel(inputs.releaseLabel);
+  }
+  return normalizeReleaseLabel(inputs.githubRefName) ?? normalizeReleaseLabel(inputs.githubHeadRef) ?? normalizeReleaseLabel(inputs.githubRef);
+}
+function createAssetProjectName(inputs, releaseLabel) {
+  if (!releaseLabel) {
+    return inputs.projectName;
+  }
+  return `${inputs.projectName} ${releaseLabel}`;
+}
+function readResourcesState() {
+  try {
+    return (0, import_yaml.parse)((0, import_node_fs.readFileSync)(".postman/resources.yaml", "utf8"));
+  } catch {
+    return null;
+  }
+}
+function getFirstCloudResourceId(map) {
+  if (!map) {
+    return void 0;
+  }
+  return Object.values(map)[0];
+}
+function findCloudResourceId(map, matcher) {
+  if (!map) {
+    return void 0;
+  }
+  const match = Object.entries(map).find(([filePath]) => matcher(filePath));
+  return match?.[1];
+}
 var SPEC_SUMMARY_MAX_LEN = 200;
 var SPEC_HTTP_METHODS = /* @__PURE__ */ new Set([
   "get",
@@ -30453,122 +30319,28 @@ function validateSpecStructure(content) {
     throw new Error('Spec is missing "openapi" or "swagger" version field');
   }
 }
-function varName(projectName, baseName) {
-  const slug = projectName.toUpperCase().replace(/[^A-Z0-9]/g, "_");
-  return `POSTMAN_${slug}_${baseName}`;
-}
-async function readVariable(github, projectName, baseName) {
-  if (!github) {
-    return void 0;
-  }
-  const namespaced = await github.getRepositoryVariable(varName(projectName, baseName)).catch(() => void 0);
-  if (namespaced) {
-    return namespaced;
-  }
-  const legacy = await github.getRepositoryVariable(`POSTMAN_${baseName}`).catch(() => void 0);
-  return legacy || void 0;
-}
-async function persistVariable(github, name, value, actionCore) {
-  if (!github || !value) {
-    return;
-  }
-  try {
-    await github.setRepositoryVariable(name, value);
-  } catch (err) {
-    actionCore.warning(
-      `Failed to persist ${name}: ${err instanceof Error ? err.message : String(err)}`
-    );
-  }
-}
-async function writeVariable(github, projectName, baseName, value, actionCore) {
-  if (!github || !value) {
-    return;
-  }
-  await persistVariable(github, varName(projectName, baseName), value, actionCore);
-  await persistVariable(github, `POSTMAN_${baseName}`, value, actionCore);
-}
-async function persistBootstrapRepositoryVariables(github, projectName, outputs, systemEnvMap, environments, lintSummary, actionCore) {
-  await persistVariable(
-    github,
-    "LINT_WARNINGS",
-    String(lintSummary.lintWarnings),
-    actionCore
-  );
-  await persistVariable(
-    github,
-    "LINT_ERRORS",
-    String(lintSummary.lintErrors),
-    actionCore
-  );
-  await writeVariable(
-    github,
-    projectName,
-    "WORKSPACE_ID",
-    outputs["workspace-id"],
-    actionCore
-  );
-  await writeVariable(github, projectName, "SPEC_UID", outputs["spec-id"], actionCore);
-  await writeVariable(
-    github,
-    projectName,
-    "BASELINE_COLLECTION_UID",
-    outputs["baseline-collection-id"],
-    actionCore
-  );
-  await writeVariable(
-    github,
-    projectName,
-    "SMOKE_COLLECTION_UID",
-    outputs["smoke-collection-id"],
-    actionCore
-  );
-  await writeVariable(
-    github,
-    projectName,
-    "CONTRACT_COLLECTION_UID",
-    outputs["contract-collection-id"],
-    actionCore
-  );
-  for (const envName of environments) {
-    const systemEnvId = systemEnvMap[envName];
-    if (!systemEnvId) {
-      continue;
-    }
-    await writeVariable(
-      github,
-      projectName,
-      `SYSTEM_ENV_${envName.toUpperCase()}`,
-      systemEnvId,
-      actionCore
-    );
-  }
-}
 async function runBootstrap(inputs, dependencies) {
   const outputs = createPlannedOutputs(inputs);
-  const environments = asStringArray(
-    parseJsonValue(inputs.environmentsJson, ["prod"], "environments-json"),
-    "environments-json"
-  );
-  const systemEnvMap = asStringMap(
-    parseJsonValue(inputs.systemEnvMapJson, {}, "system-env-map-json"),
-    "system-env-map-json"
-  );
+  const requiresReleaseLabel = inputs.collectionSyncMode === "version" || inputs.specSyncMode === "version";
+  const releaseLabel = requiresReleaseLabel ? deriveReleaseLabel(inputs) : void 0;
+  if (requiresReleaseLabel && !releaseLabel) {
+    throw new Error(
+      "Versioned spec or collection sync requires a release-label or derivable GitHub ref metadata"
+    );
+  }
   const workspaceName = createWorkspaceName(inputs);
   const aboutText = `Auto-provisioned by Postman CS open-alpha for ${inputs.projectName}`;
   await runGroup(dependencies.core, "Install Postman CLI", async () => {
     await ensurePostmanCli(dependencies, inputs.postmanApiKey);
   });
-  const explicitWorkspaceId = inputs.workspaceId;
-  let repoWorkspaceId;
-  let workspaceId = explicitWorkspaceId;
-  if (!workspaceId && dependencies.github) {
-    repoWorkspaceId = await readVariable(
-      dependencies.github,
-      inputs.projectName,
-      "WORKSPACE_ID"
-    );
-    workspaceId = repoWorkspaceId;
+  const resourcesState = readResourcesState();
+  let explicitWorkspaceId = inputs.workspaceId;
+  if (!explicitWorkspaceId && resourcesState?.workspace?.id) {
+    explicitWorkspaceId = resourcesState.workspace.id;
+    dependencies.core.info("Resolved workspace-id from .postman/resources.yaml");
   }
+  const repoWorkspaceId = explicitWorkspaceId;
+  let workspaceId = explicitWorkspaceId;
   let teamId = inputs.teamId || "";
   if (!teamId) {
     teamId = await dependencies.postman.getAutoDerivedTeamId() || "";
@@ -30602,24 +30374,65 @@ async function runBootstrap(inputs, dependencies) {
   } else if (workspaceId) {
     dependencies.core.info(`Using existing workspace: ${workspaceId}`);
   }
+  let workspaceTeamId;
+  if (inputs.workspaceTeamId) {
+    workspaceTeamId = parseInt(inputs.workspaceTeamId, 10);
+    if (Number.isNaN(workspaceTeamId)) {
+      throw new Error(`workspace-team-id must be a numeric sub-team ID, got: ${inputs.workspaceTeamId}`);
+    }
+  }
+  if (!workspaceId && !workspaceTeamId) {
+    try {
+      const teams = await dependencies.postman.getTeams();
+      if (teams.length > 1 && teams.every((t) => t.organizationId == null)) {
+        dependencies.core.warning(
+          "GET /teams returned multiple teams but none include organizationId. Org-mode detection may be degraded due to an upstream API change. If workspace creation fails, set workspace-team-id explicitly."
+        );
+      }
+      const orgIds = new Set(teams.filter((t) => t.organizationId != null).map((t) => t.organizationId));
+      const meTeamId = parseInt(teamId, 10);
+      const isOrgMode = teams.length > 1 && orgIds.size === 1 && orgIds.has(meTeamId);
+      if (isOrgMode) {
+        const teamList = teams.map((t) => `  ${t.id}  ${t.name}`).join("\n");
+        throw new Error(
+          `Org-mode account detected. Workspace creation requires a specific sub-team ID.
+
+Available sub-teams:
+${teamList}
+
+To fix this, set the workspace-team-id input in your workflow:
+  workspace-team-id: '<id>'
+
+Or for reuse across runs, create a repository variable and reference it:
+  workspace-team-id: \${{ vars.POSTMAN_WORKSPACE_TEAM_ID }}
+
+For CLI usage, pass --workspace-team-id <id> or export POSTMAN_WORKSPACE_TEAM_ID=<id>.`
+        );
+      } else if (teams.length > 1) {
+        dependencies.core.warning(
+          `API key has access to ${teams.length} teams but org-mode could not be confirmed. Proceeding without teamId. If workspace creation fails, set workspace-team-id explicitly.`
+        );
+      }
+    } catch (err) {
+      if (err instanceof Error && err.message.includes("Org-mode account detected")) {
+        throw err;
+      }
+      dependencies.core.warning(
+        `Could not check for org-mode sub-teams: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  }
   if (!workspaceId) {
     const workspace = await runGroup(
       dependencies.core,
       "Create Postman Workspace",
-      async () => dependencies.postman.createWorkspace(workspaceName, aboutText)
+      async () => dependencies.postman.createWorkspace(workspaceName, aboutText, workspaceTeamId)
     );
     workspaceId = workspace.id;
   }
   outputs["workspace-id"] = workspaceId || "";
   outputs["workspace-url"] = `https://go.postman.co/workspace/${workspaceId}`;
   outputs["workspace-name"] = workspaceName;
-  await writeVariable(
-    dependencies.github,
-    inputs.projectName,
-    "WORKSPACE_ID",
-    outputs["workspace-id"],
-    dependencies.core
-  );
   if (inputs.domain && dependencies.internalIntegration) {
     await runGroup(
       dependencies.core,
@@ -30674,33 +30487,43 @@ async function runBootstrap(inputs, dependencies) {
     );
   }
   let specId = inputs.specId;
-  if (!specId && dependencies.github) {
-    specId = await readVariable(dependencies.github, inputs.projectName, "SPEC_UID");
+  if (!specId) {
+    specId = getFirstCloudResourceId(resourcesState?.cloudResources?.specs);
+    if (specId) {
+      dependencies.core.info("Resolved spec-id from .postman/resources.yaml");
+    }
   }
-  let baselineCollectionId = inputs.baselineCollectionId;
-  let smokeCollectionId = inputs.smokeCollectionId;
-  let contractCollectionId = inputs.contractCollectionId;
-  if (dependencies.github) {
+  let baselineCollectionId = inputs.collectionSyncMode === "refresh" ? void 0 : inputs.baselineCollectionId;
+  let smokeCollectionId = inputs.collectionSyncMode === "refresh" ? void 0 : inputs.smokeCollectionId;
+  let contractCollectionId = inputs.collectionSyncMode === "refresh" ? void 0 : inputs.contractCollectionId;
+  if (inputs.collectionSyncMode !== "refresh") {
+    const cloudCollections = resourcesState?.cloudResources?.collections;
     if (!baselineCollectionId) {
-      baselineCollectionId = await readVariable(
-        dependencies.github,
-        inputs.projectName,
-        "BASELINE_COLLECTION_UID"
+      baselineCollectionId = findCloudResourceId(
+        cloudCollections,
+        (filePath) => filePath.includes("[Baseline]")
       );
+      if (baselineCollectionId) {
+        dependencies.core.info("Resolved baseline-collection-id from .postman/resources.yaml");
+      }
     }
     if (!smokeCollectionId) {
-      smokeCollectionId = await readVariable(
-        dependencies.github,
-        inputs.projectName,
-        "SMOKE_COLLECTION_UID"
+      smokeCollectionId = findCloudResourceId(
+        cloudCollections,
+        (filePath) => filePath.includes("[Smoke]")
       );
+      if (smokeCollectionId) {
+        dependencies.core.info("Resolved smoke-collection-id from .postman/resources.yaml");
+      }
     }
     if (!contractCollectionId) {
-      contractCollectionId = await readVariable(
-        dependencies.github,
-        inputs.projectName,
-        "CONTRACT_COLLECTION_UID"
+      contractCollectionId = findCloudResourceId(
+        cloudCollections,
+        (filePath) => filePath.includes("[Contract]")
       );
+      if (contractCollectionId) {
+        dependencies.core.info("Resolved contract-collection-id from .postman/resources.yaml");
+      }
     }
   }
   if (specId) {
@@ -30724,7 +30547,10 @@ async function runBootstrap(inputs, dependencies) {
       } else {
         specId = await dependencies.postman.uploadSpec(
           workspaceId || "",
-          inputs.projectName,
+          createAssetProjectName(
+            inputs,
+            inputs.specSyncMode === "version" ? releaseLabel : void 0
+          ),
           document
         );
       }
@@ -30733,13 +30559,6 @@ async function runBootstrap(inputs, dependencies) {
     }
   );
   void specContent;
-  await writeVariable(
-    dependencies.github,
-    inputs.projectName,
-    "SPEC_UID",
-    outputs["spec-id"],
-    dependencies.core
-  );
   const lintSummary = await runGroup(
     dependencies.core,
     "Lint Spec via Postman CLI",
@@ -30777,13 +30596,15 @@ async function runBootstrap(inputs, dependencies) {
     dependencies.core,
     "Generate Collections from Spec",
     async () => {
-      outputs["baseline-collection-id"] = baselineCollectionId || "";
-      outputs["smoke-collection-id"] = smokeCollectionId || "";
-      outputs["contract-collection-id"] = contractCollectionId || "";
+      const shouldReuseCollections = inputs.collectionSyncMode !== "refresh";
+      const assetProjectName = inputs.collectionSyncMode === "version" ? createAssetProjectName(inputs, releaseLabel) : inputs.projectName;
+      outputs["baseline-collection-id"] = shouldReuseCollections ? baselineCollectionId || "" : "";
+      outputs["smoke-collection-id"] = shouldReuseCollections ? smokeCollectionId || "" : "";
+      outputs["contract-collection-id"] = shouldReuseCollections ? contractCollectionId || "" : "";
       if (!outputs["baseline-collection-id"]) {
         outputs["baseline-collection-id"] = await dependencies.postman.generateCollection(
           outputs["spec-id"],
-          inputs.projectName,
+          assetProjectName,
           "[Baseline]"
         );
       } else {
@@ -30791,17 +30612,10 @@ async function runBootstrap(inputs, dependencies) {
           `Using existing baseline collection: ${outputs["baseline-collection-id"]}`
         );
       }
-      await writeVariable(
-        dependencies.github,
-        inputs.projectName,
-        "BASELINE_COLLECTION_UID",
-        outputs["baseline-collection-id"],
-        dependencies.core
-      );
       if (!outputs["smoke-collection-id"]) {
         outputs["smoke-collection-id"] = await dependencies.postman.generateCollection(
           outputs["spec-id"],
-          inputs.projectName,
+          assetProjectName,
           "[Smoke]"
         );
       } else {
@@ -30809,17 +30623,10 @@ async function runBootstrap(inputs, dependencies) {
           `Using existing smoke collection: ${outputs["smoke-collection-id"]}`
         );
       }
-      await writeVariable(
-        dependencies.github,
-        inputs.projectName,
-        "SMOKE_COLLECTION_UID",
-        outputs["smoke-collection-id"],
-        dependencies.core
-      );
       if (!outputs["contract-collection-id"]) {
         outputs["contract-collection-id"] = await dependencies.postman.generateCollection(
           outputs["spec-id"],
-          inputs.projectName,
+          assetProjectName,
           "[Contract]"
         );
       } else {
@@ -30827,13 +30634,6 @@ async function runBootstrap(inputs, dependencies) {
           `Using existing contract collection: ${outputs["contract-collection-id"]}`
         );
       }
-      await writeVariable(
-        dependencies.github,
-        inputs.projectName,
-        "CONTRACT_COLLECTION_UID",
-        outputs["contract-collection-id"],
-        dependencies.core
-      );
     }
   );
   outputs["collections-json"] = JSON.stringify({
@@ -30871,27 +30671,6 @@ async function runBootstrap(inputs, dependencies) {
       ]);
     }
   );
-  if (dependencies.github) {
-    const github = dependencies.github;
-    await runGroup(
-      dependencies.core,
-      "Store Postman UIDs as Repo Variables",
-      async () => {
-        await persistBootstrapRepositoryVariables(
-          github,
-          inputs.projectName,
-          outputs,
-          systemEnvMap,
-          environments,
-          {
-            lintErrors: lintSummary.errors,
-            lintWarnings: lintSummary.warnings
-          },
-          dependencies.core
-        );
-      }
-    );
-  }
   for (const [name, value] of Object.entries(outputs)) {
     dependencies.core.setOutput(name, value);
   }
@@ -30905,9 +30684,6 @@ async function runAction(actionCore = core, actionExec = exec, actionIo = io) {
     io: actionIo,
     specFetcher: fetch
   });
-  if (!dependencies.github) {
-    actionCore.info("GitHub repository variable persistence disabled for this run");
-  }
   if (inputs.domain && !dependencies.internalIntegration) {
     actionCore.warning(
       "Skipping governance assignment because postman-access-token is not configured"
@@ -30918,22 +30694,12 @@ async function runAction(actionCore = core, actionExec = exec, actionIo = io) {
 function createBootstrapDependencies(inputs, factories) {
   const secretMasker = createSecretMasker([
     inputs.postmanApiKey,
-    inputs.postmanAccessToken,
-    inputs.githubToken,
-    inputs.ghFallbackToken
+    inputs.postmanAccessToken
   ]);
   const postman = new PostmanAssetsClient({
     apiKey: inputs.postmanApiKey,
     secretMasker
   });
-  const repository = extractRepositorySlug(inputs.repoUrl);
-  const github = inputs.githubToken && inputs.repoUrl && repository ? new GitHubApiClient({
-    authMode: inputs.githubAuthMode,
-    fallbackToken: inputs.ghFallbackToken,
-    repository,
-    secretMasker,
-    token: inputs.githubToken
-  }) : void 0;
   const internalIntegration = inputs.postmanAccessToken ? createInternalIntegrationAdapter({
     accessToken: inputs.postmanAccessToken,
     backend: inputs.integrationBackend,
@@ -30943,30 +30709,12 @@ function createBootstrapDependencies(inputs, factories) {
   return {
     core: factories.core,
     exec: factories.exec,
-    github,
     io: factories.io,
     internalIntegration,
     postman,
     specFetcher: factories.specFetcher ?? fetch
   };
 }
-function extractRepositorySlug(repoUrl) {
-  const normalized = normalizeInputValue(repoUrl);
-  if (!normalized) {
-    return void 0;
-  }
-  try {
-    const parsed = new URL(normalized);
-    const pathname = parsed.pathname.replace(/^\/+|\/+$/g, "").replace(/\.git$/, "");
-    const segments = pathname.split("/").filter(Boolean);
-    if (segments.length >= 2) {
-      return `${segments[0]}/${segments[1]}`;
-    }
-    return void 0;
-  } catch {
-    return void 0;
-  }
-}
 var currentModulePath = typeof __filename === "string" ? __filename : "";
 var entrypoint = process.argv[1];
 if (entrypoint && currentModulePath === entrypoint) {
@@ -31089,9 +30837,7 @@ function createCliExec(secretMasker) {
 function createCliDependencies(inputs) {
   const secretMasker = createSecretMasker([
     inputs.postmanApiKey,
-    inputs.postmanAccessToken,
-    inputs.githubToken,
-    inputs.ghFallbackToken
+    inputs.postmanAccessToken
   ]);
   const cliExec = createCliExec(secretMasker);
   return createBootstrapDependencies(inputs, {
@@ -31112,18 +30858,17 @@ function parseCliArgs(argv, env = process.env) {
     "baseline-collection-id",
     "smoke-collection-id",
     "contract-collection-id",
+    "collection-sync-mode",
+    "spec-sync-mode",
+    "release-label",
     "domain",
     "domain-code",
     "requester-email",
     "workspace-admin-user-ids",
-    "environments-json",
-    "system-env-map-json",
     "governance-mapping-json",
     "integration-backend",
-    "github-auth-mode",
-    "github-token",
-    "gh-fallback-token",
     "team-id",
+    "workspace-team-id",
     "repo-url"
   ];
   const inputEnv = { ...env };
@@ -31163,9 +30908,6 @@ async function runCli(argv = process.argv.slice(2), runtime = {}) {
   const config = parseCliArgs(argv, env);
   const inputs = resolveInputs(config.inputEnv);
   const dependencies = createCliDependencies(inputs);
-  if (!dependencies.github) {
-    dependencies.core.info("GitHub repository variable persistence disabled for this run");
-  }
   if (inputs.domain && !dependencies.internalIntegration) {
     dependencies.core.warning(
       "Skipping governance assignment because postman-access-token is not configured"