@postman-cse/onboarding-bootstrap 2.9.1 → 2.9.3

package/dist/action.cjs

@@ -264257,7 +264257,8 @@ var PostmanGatewayAssetsClient = class _PostmanGatewayAssetsClient {
       service: "collection",
       method: "patch",
       path: `/v3/collections/${this.bareModelId(collectionId)}`,
-      retry: "none",
+      // Replacing a generated collection's name with the same value is idempotent.
+      retry: "safe",
       body: [{ op: "replace", path: "/name", value: name }]
     });
   }
@@ -264456,15 +264457,25 @@ var PostmanGatewayAssetsClient = class _PostmanGatewayAssetsClient {
   }
   // --- collection v3 mutation + tagging (live-proven 2026-06-30; see docs/REST-to-gateway.md) ---
   //
-  // These retire bootstrap's last asset-op PMAK dependencies. The gateway keys
-  // the v3 collection-items surface on the BARE model id (strip the `<owner>-`
-  // prefix) with a trailing slash; the tagging service is distinct from the
-  // collection service and takes the FULL uid.
-  /** `<owner>-<uuid>` public uid -> bare `<uuid>` model id (the v3 items surface keys on it). */
+  // These retire bootstrap's last asset-op PMAK dependencies. Collection ROOT
+  // routes (GET/PATCH/DELETE `/v3/collections/:id`) accept the bare model id.
+  // Collection ITEMS routes (`/v3/collections/:id/items/...`) must use the FULL
+  // public uid (`<owner>-<uuid>`): bare model ids are flaky on org-mode squads
+  // (live-proven 2026-07-14 on team 172912 / Northwind — immediate post-generation
+  // `GET .../items/` returns 403 FORBIDDEN with bare id, 200 with full uid).
+  // The tagging service is distinct and takes the FULL uid.
+  /** `<owner>-<uuid>` public uid -> bare `<uuid>` model id (collection ROOT routes only). */
   bareModelId(uid) {
     const u = String(uid ?? "").trim();
     return u.includes("-") ? u.slice(u.indexOf("-") + 1) : u;
   }
+  /**
+   * Collection id for ITEMS routes. Prefer the full public uid; fall back to the
+   * trimmed input when the caller already has a bare/model id.
+   */
+  collectionItemsId(uid) {
+    return String(uid ?? "").trim();
+  }
   /**
    * PATCH a freshly-created item's `/scripts`, tolerating the two transient
    * failures this immediate-after-create write is prone to on the shared gateway:
@@ -264523,9 +264534,9 @@ var PostmanGatewayAssetsClient = class _PostmanGatewayAssetsClient {
   /**
    * Inject smoke-test assertions into every leaf request of a spec-generated
    * collection, over the v3 collection-items surface (no PMAK):
-   *   1. `GET /v3/collections/:cid/items/` (bare model id, trailing slash) — flat list.
+   *   1. `GET /v3/collections/:cid/items/` (FULL public uid, trailing slash) — flat list.
    *   2. for each `http-request` leaf, `PATCH /v3/collections/:cid/items/:itemId`
-   *      (full uid for `:itemId`, `X-Entity-Type: http-request` header) with a
+   *      (full uid for `:cid` and `:itemId`, `X-Entity-Type: http-request` header) with a
    *      JSON-Patch that sets `/scripts` to the canonical v3 shape
    *      (`[{type:'afterResponse', code, language}]`). The v3 surface persists test
    *      scripts under `scripts`, NOT `events`: a `/events` patch returns 200 but is
@@ -264538,7 +264549,7 @@ var PostmanGatewayAssetsClient = class _PostmanGatewayAssetsClient {
    */
   async injectTests(collectionUid, type) {
     void type;
-    const cid = this.bareModelId(collectionUid);
+    const cid = this.collectionItemsId(collectionUid);
     const listed = await this.gateway.requestJson({
       service: "collection",
       method: "get",
@@ -264709,7 +264720,7 @@ var PostmanGatewayAssetsClient = class _PostmanGatewayAssetsClient {
    * Inject the deterministic OpenAPI contract assertions into every generated
    * request of a spec-generated collection, entirely over the v3 collection
    * surface (no PMAK, no v2.1.0 read/PUT):
-   *   1. `GET /v3/collections/:cid/items/` — flat item list (ids as full uids).
+   *   1. `GET /v3/collections/:cid/items/` — flat item list (FULL public uid for `:cid`).
    *   2. `GET /v3/collections/:cid/items/:itemId` (`X-Entity-Type: http-request`)
    *      — the full v3 IR record (method/url/headers/body) the matcher needs.
    *   3. `planContractItemScripts` matches each request to its OpenAPI operation
@@ -264720,7 +264731,7 @@ var PostmanGatewayAssetsClient = class _PostmanGatewayAssetsClient {
    * Returns the non-fatal instrumentation warnings for the caller to surface.
    */
   async injectContractTests(collectionUid, index) {
-    const cid = this.bareModelId(collectionUid);
+    const cid = this.collectionItemsId(collectionUid);
     const listed = await this.gateway.requestJson({
       service: "collection",
       method: "get",
@@ -265120,11 +265131,12 @@ var PostmanGatewayAssetsClient = class _PostmanGatewayAssetsClient {
     if (!rawId) {
       throw new Error("Collection create did not return an id");
     }
-    const cid = this.bareModelId(rawId);
+    const itemsCid = this.collectionItemsId(rawId);
+    const rootCid = this.bareModelId(rawId);
     await options.onRootCreated?.(rawId);
     try {
-      await this.createItemTree(cid, asItemArray(v3.items), cid);
-      await this.applyCollectionLevelSettings(cid, v3, { rename: true });
+      await this.createItemTree(itemsCid, asItemArray(v3.items), itemsCid);
+      await this.applyCollectionLevelSettings(rootCid, v3, { rename: true });
     } catch (error2) {
       if (options.onRootCreated) throw error2;
       let cleanupError;
@@ -265151,22 +265163,23 @@ var PostmanGatewayAssetsClient = class _PostmanGatewayAssetsClient {
    * from the converted v3 IR and reapply name/auth/variables.
    */
   async updateCollection(collectionUid, collection) {
-    const cid = this.bareModelId(collectionUid);
+    const itemsCid = this.collectionItemsId(collectionUid);
+    const rootCid = this.bareModelId(collectionUid);
     const v3 = this.normalizeCollectionForWrite(collection);
-    const existingItems = await this.listCollectionItems(cid);
+    const existingItems = await this.listCollectionItems(itemsCid);
     for (const item of existingItems) {
       const itemId = String(item.id).trim();
       try {
         await this.gateway.requestJson({
           service: "collection",
           method: "delete",
-          path: `/v3/collections/${cid}/items/${itemId}`,
+          path: `/v3/collections/${itemsCid}/items/${itemId}`,
           retry: "none",
           headers: { "X-Entity-Type": String(item.$kind ?? "http-request") }
         });
       } catch (error2) {
         if (isAmbiguousTransportError(error2)) {
-          const stillPresent = (await this.listCollectionItems(cid)).some(
+          const stillPresent = (await this.listCollectionItems(itemsCid)).some(
             (candidate) => String(candidate.id ?? "").trim() === itemId
           );
           if (!stillPresent) continue;
@@ -265177,14 +265190,14 @@ var PostmanGatewayAssetsClient = class _PostmanGatewayAssetsClient {
         }
       }
     }
-    const remainingItems = await this.listCollectionItems(cid);
+    const remainingItems = await this.listCollectionItems(itemsCid);
     if (remainingItems.length > 0) {
       throw new Error(
         `Collection delete verification failed: ${remainingItems.length} old items remain`
       );
     }
-    await this.createItemTree(cid, asItemArray(v3.items), cid);
-    await this.applyCollectionLevelSettings(cid, v3, { rename: true, reconcileRemovals: true });
+    await this.createItemTree(itemsCid, asItemArray(v3.items), itemsCid);
+    await this.applyCollectionLevelSettings(rootCid, v3, { rename: true, reconcileRemovals: true });
   }
 };
 

package/dist/cli.cjs

@@ -262575,7 +262575,8 @@ var PostmanGatewayAssetsClient = class _PostmanGatewayAssetsClient {
       service: "collection",
       method: "patch",
       path: `/v3/collections/${this.bareModelId(collectionId)}`,
-      retry: "none",
+      // Replacing a generated collection's name with the same value is idempotent.
+      retry: "safe",
       body: [{ op: "replace", path: "/name", value: name }]
     });
   }
@@ -262774,15 +262775,25 @@ var PostmanGatewayAssetsClient = class _PostmanGatewayAssetsClient {
   }
   // --- collection v3 mutation + tagging (live-proven 2026-06-30; see docs/REST-to-gateway.md) ---
   //
-  // These retire bootstrap's last asset-op PMAK dependencies. The gateway keys
-  // the v3 collection-items surface on the BARE model id (strip the `<owner>-`
-  // prefix) with a trailing slash; the tagging service is distinct from the
-  // collection service and takes the FULL uid.
-  /** `<owner>-<uuid>` public uid -> bare `<uuid>` model id (the v3 items surface keys on it). */
+  // These retire bootstrap's last asset-op PMAK dependencies. Collection ROOT
+  // routes (GET/PATCH/DELETE `/v3/collections/:id`) accept the bare model id.
+  // Collection ITEMS routes (`/v3/collections/:id/items/...`) must use the FULL
+  // public uid (`<owner>-<uuid>`): bare model ids are flaky on org-mode squads
+  // (live-proven 2026-07-14 on team 172912 / Northwind — immediate post-generation
+  // `GET .../items/` returns 403 FORBIDDEN with bare id, 200 with full uid).
+  // The tagging service is distinct and takes the FULL uid.
+  /** `<owner>-<uuid>` public uid -> bare `<uuid>` model id (collection ROOT routes only). */
   bareModelId(uid) {
     const u = String(uid ?? "").trim();
     return u.includes("-") ? u.slice(u.indexOf("-") + 1) : u;
   }
+  /**
+   * Collection id for ITEMS routes. Prefer the full public uid; fall back to the
+   * trimmed input when the caller already has a bare/model id.
+   */
+  collectionItemsId(uid) {
+    return String(uid ?? "").trim();
+  }
   /**
    * PATCH a freshly-created item's `/scripts`, tolerating the two transient
    * failures this immediate-after-create write is prone to on the shared gateway:
@@ -262841,9 +262852,9 @@ var PostmanGatewayAssetsClient = class _PostmanGatewayAssetsClient {
   /**
    * Inject smoke-test assertions into every leaf request of a spec-generated
    * collection, over the v3 collection-items surface (no PMAK):
-   *   1. `GET /v3/collections/:cid/items/` (bare model id, trailing slash) — flat list.
+   *   1. `GET /v3/collections/:cid/items/` (FULL public uid, trailing slash) — flat list.
    *   2. for each `http-request` leaf, `PATCH /v3/collections/:cid/items/:itemId`
-   *      (full uid for `:itemId`, `X-Entity-Type: http-request` header) with a
+   *      (full uid for `:cid` and `:itemId`, `X-Entity-Type: http-request` header) with a
    *      JSON-Patch that sets `/scripts` to the canonical v3 shape
    *      (`[{type:'afterResponse', code, language}]`). The v3 surface persists test
    *      scripts under `scripts`, NOT `events`: a `/events` patch returns 200 but is
@@ -262856,7 +262867,7 @@ var PostmanGatewayAssetsClient = class _PostmanGatewayAssetsClient {
    */
   async injectTests(collectionUid, type) {
     void type;
-    const cid = this.bareModelId(collectionUid);
+    const cid = this.collectionItemsId(collectionUid);
     const listed = await this.gateway.requestJson({
       service: "collection",
       method: "get",
@@ -263027,7 +263038,7 @@ var PostmanGatewayAssetsClient = class _PostmanGatewayAssetsClient {
    * Inject the deterministic OpenAPI contract assertions into every generated
    * request of a spec-generated collection, entirely over the v3 collection
    * surface (no PMAK, no v2.1.0 read/PUT):
-   *   1. `GET /v3/collections/:cid/items/` — flat item list (ids as full uids).
+   *   1. `GET /v3/collections/:cid/items/` — flat item list (FULL public uid for `:cid`).
    *   2. `GET /v3/collections/:cid/items/:itemId` (`X-Entity-Type: http-request`)
    *      — the full v3 IR record (method/url/headers/body) the matcher needs.
    *   3. `planContractItemScripts` matches each request to its OpenAPI operation
@@ -263038,7 +263049,7 @@ var PostmanGatewayAssetsClient = class _PostmanGatewayAssetsClient {
    * Returns the non-fatal instrumentation warnings for the caller to surface.
    */
   async injectContractTests(collectionUid, index) {
-    const cid = this.bareModelId(collectionUid);
+    const cid = this.collectionItemsId(collectionUid);
     const listed = await this.gateway.requestJson({
       service: "collection",
       method: "get",
@@ -263438,11 +263449,12 @@ var PostmanGatewayAssetsClient = class _PostmanGatewayAssetsClient {
     if (!rawId) {
       throw new Error("Collection create did not return an id");
     }
-    const cid = this.bareModelId(rawId);
+    const itemsCid = this.collectionItemsId(rawId);
+    const rootCid = this.bareModelId(rawId);
     await options.onRootCreated?.(rawId);
     try {
-      await this.createItemTree(cid, asItemArray(v3.items), cid);
-      await this.applyCollectionLevelSettings(cid, v3, { rename: true });
+      await this.createItemTree(itemsCid, asItemArray(v3.items), itemsCid);
+      await this.applyCollectionLevelSettings(rootCid, v3, { rename: true });
     } catch (error) {
       if (options.onRootCreated) throw error;
       let cleanupError;
@@ -263469,22 +263481,23 @@ var PostmanGatewayAssetsClient = class _PostmanGatewayAssetsClient {
    * from the converted v3 IR and reapply name/auth/variables.
    */
   async updateCollection(collectionUid, collection) {
-    const cid = this.bareModelId(collectionUid);
+    const itemsCid = this.collectionItemsId(collectionUid);
+    const rootCid = this.bareModelId(collectionUid);
     const v3 = this.normalizeCollectionForWrite(collection);
-    const existingItems = await this.listCollectionItems(cid);
+    const existingItems = await this.listCollectionItems(itemsCid);
     for (const item of existingItems) {
       const itemId = String(item.id).trim();
       try {
         await this.gateway.requestJson({
           service: "collection",
           method: "delete",
-          path: `/v3/collections/${cid}/items/${itemId}`,
+          path: `/v3/collections/${itemsCid}/items/${itemId}`,
           retry: "none",
           headers: { "X-Entity-Type": String(item.$kind ?? "http-request") }
         });
       } catch (error) {
         if (isAmbiguousTransportError(error)) {
-          const stillPresent = (await this.listCollectionItems(cid)).some(
+          const stillPresent = (await this.listCollectionItems(itemsCid)).some(
             (candidate) => String(candidate.id ?? "").trim() === itemId
           );
           if (!stillPresent) continue;
@@ -263495,14 +263508,14 @@ var PostmanGatewayAssetsClient = class _PostmanGatewayAssetsClient {
         }
       }
     }
-    const remainingItems = await this.listCollectionItems(cid);
+    const remainingItems = await this.listCollectionItems(itemsCid);
     if (remainingItems.length > 0) {
       throw new Error(
         `Collection delete verification failed: ${remainingItems.length} old items remain`
       );
     }
-    await this.createItemTree(cid, asItemArray(v3.items), cid);
-    await this.applyCollectionLevelSettings(cid, v3, { rename: true, reconcileRemovals: true });
+    await this.createItemTree(itemsCid, asItemArray(v3.items), itemsCid);
+    await this.applyCollectionLevelSettings(rootCid, v3, { rename: true, reconcileRemovals: true });
   }
 };
 
@@ -311847,6 +311860,44 @@ function createBootstrapDependencies(inputs, factories, orgMode = false) {
 }
 
 // src/cli.ts
+var HELP_TEXT = `Usage: postman-bootstrap [options]
+
+Bootstrap Postman workspaces, specs, and collections from OpenAPI.
+
+Options:
+  --help                         Show this help and exit
+  --version                      Show version and exit
+  --result-json <path>           Write JSON result (default: postman-bootstrap-result.json)
+  --dotenv-path <path>           Optional dotenv output path
+  --<input-name> <value>         Action input as kebab-case flag (same names as action.yml)
+
+Examples:
+  postman-bootstrap --help
+  postman-bootstrap --project-name demo --spec-path ./openapi.yaml ...
+`;
+function wantsHelp(argv) {
+  return argv.includes("--help") || argv.includes("-h");
+}
+function wantsVersion(argv) {
+  return argv.includes("--version") || argv.includes("-V");
+}
+function resolvePackageVersion() {
+  const candidates = [];
+  if (typeof __filename === "string" && __filename) {
+    candidates.push(import_node_path5.default.join(import_node_path5.default.dirname(__filename), "..", "package.json"));
+  }
+  candidates.push(import_node_path5.default.join(process.cwd(), "package.json"));
+  for (const packageJsonPath of candidates) {
+    try {
+      const packageJson = JSON.parse((0, import_node_fs6.readFileSync)(packageJsonPath, "utf8"));
+      if (packageJson.name === "@postman-cse/onboarding-bootstrap" && packageJson.version) {
+        return String(packageJson.version).trim();
+      }
+    } catch {
+    }
+  }
+  return "0.0.0";
+}
 var ConsoleReporter = class {
   error(message) {
     console.error(message);
@@ -312110,6 +312161,19 @@ function validateCliInputs(inputs) {
   }
 }
 async function runCli(argv = process.argv.slice(2), runtime = {}) {
+  const writeStdout = runtime.writeStdout ?? ((chunk) => process.stdout.write(chunk));
+  if (wantsHelp(argv) && wantsVersion(argv)) {
+    throw new Error("Cannot use --help and --version together");
+  }
+  if (wantsHelp(argv)) {
+    writeStdout(HELP_TEXT);
+    return;
+  }
+  if (wantsVersion(argv)) {
+    writeStdout(`${resolvePackageVersion()}
+`);
+    return;
+  }
   const env = runtime.env ?? process.env;
   const config = parseCliArgs(argv, env);
   const inputs = resolveInputs(config.inputEnv);
@@ -312138,7 +312202,6 @@ async function runCli(argv = process.argv.slice(2), runtime = {}) {
   const result = await (runtime.executeBootstrap ?? runBootstrap)(inputs, dependencies);
   await writeOptionalFile(config.resultJsonPath, JSON.stringify(result, null, 2));
   await writeOptionalFile(config.dotenvPath, toDotenv(result));
-  const writeStdout = runtime.writeStdout ?? ((chunk) => process.stdout.write(chunk));
   writeStdout(`${JSON.stringify(result, null, 2)}
 `);
 }

package/dist/index.cjs

@@ -264276,7 +264276,8 @@ var PostmanGatewayAssetsClient = class _PostmanGatewayAssetsClient {
       service: "collection",
       method: "patch",
       path: `/v3/collections/${this.bareModelId(collectionId)}`,
-      retry: "none",
+      // Replacing a generated collection's name with the same value is idempotent.
+      retry: "safe",
       body: [{ op: "replace", path: "/name", value: name }]
     });
   }
@@ -264475,15 +264476,25 @@ var PostmanGatewayAssetsClient = class _PostmanGatewayAssetsClient {
   }
   // --- collection v3 mutation + tagging (live-proven 2026-06-30; see docs/REST-to-gateway.md) ---
   //
-  // These retire bootstrap's last asset-op PMAK dependencies. The gateway keys
-  // the v3 collection-items surface on the BARE model id (strip the `<owner>-`
-  // prefix) with a trailing slash; the tagging service is distinct from the
-  // collection service and takes the FULL uid.
-  /** `<owner>-<uuid>` public uid -> bare `<uuid>` model id (the v3 items surface keys on it). */
+  // These retire bootstrap's last asset-op PMAK dependencies. Collection ROOT
+  // routes (GET/PATCH/DELETE `/v3/collections/:id`) accept the bare model id.
+  // Collection ITEMS routes (`/v3/collections/:id/items/...`) must use the FULL
+  // public uid (`<owner>-<uuid>`): bare model ids are flaky on org-mode squads
+  // (live-proven 2026-07-14 on team 172912 / Northwind — immediate post-generation
+  // `GET .../items/` returns 403 FORBIDDEN with bare id, 200 with full uid).
+  // The tagging service is distinct and takes the FULL uid.
+  /** `<owner>-<uuid>` public uid -> bare `<uuid>` model id (collection ROOT routes only). */
   bareModelId(uid) {
     const u = String(uid ?? "").trim();
     return u.includes("-") ? u.slice(u.indexOf("-") + 1) : u;
   }
+  /**
+   * Collection id for ITEMS routes. Prefer the full public uid; fall back to the
+   * trimmed input when the caller already has a bare/model id.
+   */
+  collectionItemsId(uid) {
+    return String(uid ?? "").trim();
+  }
   /**
    * PATCH a freshly-created item's `/scripts`, tolerating the two transient
    * failures this immediate-after-create write is prone to on the shared gateway:
@@ -264542,9 +264553,9 @@ var PostmanGatewayAssetsClient = class _PostmanGatewayAssetsClient {
   /**
    * Inject smoke-test assertions into every leaf request of a spec-generated
    * collection, over the v3 collection-items surface (no PMAK):
-   *   1. `GET /v3/collections/:cid/items/` (bare model id, trailing slash) — flat list.
+   *   1. `GET /v3/collections/:cid/items/` (FULL public uid, trailing slash) — flat list.
    *   2. for each `http-request` leaf, `PATCH /v3/collections/:cid/items/:itemId`
-   *      (full uid for `:itemId`, `X-Entity-Type: http-request` header) with a
+   *      (full uid for `:cid` and `:itemId`, `X-Entity-Type: http-request` header) with a
    *      JSON-Patch that sets `/scripts` to the canonical v3 shape
    *      (`[{type:'afterResponse', code, language}]`). The v3 surface persists test
    *      scripts under `scripts`, NOT `events`: a `/events` patch returns 200 but is
@@ -264557,7 +264568,7 @@ var PostmanGatewayAssetsClient = class _PostmanGatewayAssetsClient {
    */
   async injectTests(collectionUid, type) {
     void type;
-    const cid = this.bareModelId(collectionUid);
+    const cid = this.collectionItemsId(collectionUid);
     const listed = await this.gateway.requestJson({
       service: "collection",
       method: "get",
@@ -264728,7 +264739,7 @@ var PostmanGatewayAssetsClient = class _PostmanGatewayAssetsClient {
    * Inject the deterministic OpenAPI contract assertions into every generated
    * request of a spec-generated collection, entirely over the v3 collection
    * surface (no PMAK, no v2.1.0 read/PUT):
-   *   1. `GET /v3/collections/:cid/items/` — flat item list (ids as full uids).
+   *   1. `GET /v3/collections/:cid/items/` — flat item list (FULL public uid for `:cid`).
    *   2. `GET /v3/collections/:cid/items/:itemId` (`X-Entity-Type: http-request`)
    *      — the full v3 IR record (method/url/headers/body) the matcher needs.
    *   3. `planContractItemScripts` matches each request to its OpenAPI operation
@@ -264739,7 +264750,7 @@ var PostmanGatewayAssetsClient = class _PostmanGatewayAssetsClient {
    * Returns the non-fatal instrumentation warnings for the caller to surface.
    */
   async injectContractTests(collectionUid, index) {
-    const cid = this.bareModelId(collectionUid);
+    const cid = this.collectionItemsId(collectionUid);
     const listed = await this.gateway.requestJson({
       service: "collection",
       method: "get",
@@ -265139,11 +265150,12 @@ var PostmanGatewayAssetsClient = class _PostmanGatewayAssetsClient {
     if (!rawId) {
       throw new Error("Collection create did not return an id");
     }
-    const cid = this.bareModelId(rawId);
+    const itemsCid = this.collectionItemsId(rawId);
+    const rootCid = this.bareModelId(rawId);
     await options.onRootCreated?.(rawId);
     try {
-      await this.createItemTree(cid, asItemArray(v3.items), cid);
-      await this.applyCollectionLevelSettings(cid, v3, { rename: true });
+      await this.createItemTree(itemsCid, asItemArray(v3.items), itemsCid);
+      await this.applyCollectionLevelSettings(rootCid, v3, { rename: true });
     } catch (error2) {
       if (options.onRootCreated) throw error2;
       let cleanupError;
@@ -265170,22 +265182,23 @@ var PostmanGatewayAssetsClient = class _PostmanGatewayAssetsClient {
    * from the converted v3 IR and reapply name/auth/variables.
    */
   async updateCollection(collectionUid, collection) {
-    const cid = this.bareModelId(collectionUid);
+    const itemsCid = this.collectionItemsId(collectionUid);
+    const rootCid = this.bareModelId(collectionUid);
     const v3 = this.normalizeCollectionForWrite(collection);
-    const existingItems = await this.listCollectionItems(cid);
+    const existingItems = await this.listCollectionItems(itemsCid);
     for (const item of existingItems) {
       const itemId = String(item.id).trim();
       try {
         await this.gateway.requestJson({
           service: "collection",
           method: "delete",
-          path: `/v3/collections/${cid}/items/${itemId}`,
+          path: `/v3/collections/${itemsCid}/items/${itemId}`,
           retry: "none",
           headers: { "X-Entity-Type": String(item.$kind ?? "http-request") }
         });
       } catch (error2) {
         if (isAmbiguousTransportError(error2)) {
-          const stillPresent = (await this.listCollectionItems(cid)).some(
+          const stillPresent = (await this.listCollectionItems(itemsCid)).some(
             (candidate) => String(candidate.id ?? "").trim() === itemId
           );
           if (!stillPresent) continue;
@@ -265196,14 +265209,14 @@ var PostmanGatewayAssetsClient = class _PostmanGatewayAssetsClient {
         }
       }
     }
-    const remainingItems = await this.listCollectionItems(cid);
+    const remainingItems = await this.listCollectionItems(itemsCid);
     if (remainingItems.length > 0) {
       throw new Error(
         `Collection delete verification failed: ${remainingItems.length} old items remain`
       );
     }
-    await this.createItemTree(cid, asItemArray(v3.items), cid);
-    await this.applyCollectionLevelSettings(cid, v3, { rename: true, reconcileRemovals: true });
+    await this.createItemTree(itemsCid, asItemArray(v3.items), itemsCid);
+    await this.applyCollectionLevelSettings(rootCid, v3, { rename: true, reconcileRemovals: true });
   }
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@postman-cse/onboarding-bootstrap",
-  "version": "2.9.1",
+  "version": "2.9.3",
   "description": "Bootstrap Postman workspaces, specs, and collections from OpenAPI.",
   "type": "module",
   "main": "dist/index.cjs",
@@ -18,8 +18,10 @@
   },
   "scripts": {
     "prepare": "git config core.hooksPath .githooks",
-    "build": "npm run typecheck && rm -rf dist && esbuild src/index.ts --bundle --platform=node --target=node24 --format=cjs --alias:jsonc-parser=jsonc-parser/lib/esm/main.js --outfile=dist/index.cjs && esbuild src/main.ts --bundle --platform=node --target=node24 --format=cjs --alias:jsonc-parser=jsonc-parser/lib/esm/main.js --outfile=dist/action.cjs && esbuild src/cli.ts --bundle --platform=node --target=node24 --format=cjs --alias:jsonc-parser=jsonc-parser/lib/esm/main.js --outfile=dist/cli.cjs",
-    "verify:dist": "npm run build && git diff --ignore-space-at-eol --text --exit-code -- dist",
+    "bundle": "rm -rf dist && esbuild src/index.ts --bundle --platform=node --target=node24 --format=cjs --alias:jsonc-parser=jsonc-parser/lib/esm/main.js --outfile=dist/index.cjs && esbuild src/main.ts --bundle --platform=node --target=node24 --format=cjs --alias:jsonc-parser=jsonc-parser/lib/esm/main.js --outfile=dist/action.cjs && esbuild src/cli.ts --bundle --platform=node --target=node24 --format=cjs --alias:jsonc-parser=jsonc-parser/lib/esm/main.js --banner:js='#!/usr/bin/env node' --outfile=dist/cli.cjs && chmod 755 dist/cli.cjs",
+    "build": "npm run typecheck && npm run bundle",
+    "verify:dist:assert": "git diff --ignore-space-at-eol --text --exit-code -- dist && node scripts/verify-dist-artifact.mjs",
+    "verify:dist": "npm run build && npm run verify:dist:assert",
     "docs:tables": "node scripts/render-action-tables.mjs",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",