@postman-cse/onboarding-bootstrap 2.9.8 → 2.9.10

package/dist/action.cjs

@@ -258936,6 +258936,87 @@ var BifrostInternalIntegrationAdapter = class _BifrostInternalIntegrationAdapter
     const advised = adviseFromHttpError(httpErr, this.adviceContext("workspace repository linking"));
     throw advised ?? httpErr;
   }
+  async findWorkspaceForRepo(repoUrl, path10 = "/") {
+    const encodedRepo = encodeURIComponent(repoUrl);
+    const encodedPath = encodeURIComponent(path10);
+    const requestPath2 = `/workspaces/filesystem?repo=${encodedRepo}&path=${encodedPath}`;
+    let response;
+    try {
+      response = await this.proxyRequest("workspaces", "GET", requestPath2);
+    } catch (error2) {
+      return {
+        state: "unknown",
+        reason: error2 instanceof Error ? error2.message : String(error2)
+      };
+    }
+    let bodyText;
+    try {
+      bodyText = await response.text();
+    } catch (error2) {
+      return {
+        state: "unknown",
+        reason: error2 instanceof Error ? error2.message : String(error2)
+      };
+    }
+    let parsed = null;
+    if (bodyText.trim()) {
+      try {
+        parsed = JSON.parse(bodyText);
+      } catch (error2) {
+        return {
+          state: "unknown",
+          reason: error2 instanceof Error ? error2.message : String(error2)
+        };
+      }
+    }
+    const wrappedInvisibleWorkspaceIdRaw = parsed?.error?.meta?.workspaceId;
+    const wrappedInvisibleWorkspaceId = typeof wrappedInvisibleWorkspaceIdRaw === "string" ? wrappedInvisibleWorkspaceIdRaw.trim() : "";
+    if (wrappedInvisibleWorkspaceId) {
+      return { state: "linked-invisible", workspaceId: wrappedInvisibleWorkspaceId };
+    }
+    if (response.status === 200) {
+      if (!parsed || !Object.prototype.hasOwnProperty.call(parsed, "data")) {
+        return {
+          state: "unknown",
+          reason: "Filesystem probe returned 200 without a data payload"
+        };
+      }
+      const data = parsed?.data ?? null;
+      if (data == null) {
+        return { state: "free" };
+      }
+      if (typeof data === "object" && !Array.isArray(data)) {
+        const workspace = data;
+        const id = typeof workspace.id === "string" ? workspace.id.trim() : "";
+        if (id) {
+          const name = typeof workspace.name === "string" ? workspace.name : "";
+          return {
+            state: "linked-visible",
+            workspace: { ...workspace, id, name }
+          };
+        }
+      }
+      return {
+        state: "unknown",
+        reason: "Filesystem probe returned 200 with unrecognized workspace payload"
+      };
+    }
+    if (response.status === 403) {
+      const workspaceIdRaw = parsed?.error?.meta?.workspaceId ?? parsed?.meta?.workspaceId;
+      const workspaceId = typeof workspaceIdRaw === "string" ? workspaceIdRaw.trim() : "";
+      if (workspaceId) {
+        return { state: "linked-invisible", workspaceId };
+      }
+      return {
+        state: "unknown",
+        reason: "Filesystem probe returned 403 without error.meta.workspaceId"
+      };
+    }
+    return {
+      state: "unknown",
+      reason: `Filesystem probe returned HTTP ${response.status}`
+    };
+  }
   async linkCollectionsToSpecification(specificationId, collections) {
     if (collections.length === 0) {
       return;
@@ -261017,6 +261098,13 @@ function normalizeResponseKey(status) {
   const raw = String(status);
   return /^[1-5]xx$/i.test(raw) ? raw.toUpperCase() : raw;
 }
+function responseBodyExpectation(method, status, content) {
+  const normalizedStatus = normalizeResponseKey(status);
+  if (method === "head" || normalizedStatus === "1XX" || /^1[0-9][0-9]$/.test(normalizedStatus) || normalizedStatus === "204" || normalizedStatus === "205" || normalizedStatus === "304") {
+    return "forbidden";
+  }
+  return Object.keys(content).length > 0 ? "declared" : "unknown";
+}
 function collectSecurityApiKeys(root, operation) {
   const securitySchemes = asRecord5(asRecord5(root.components)?.securitySchemes);
   const requirements = operation.security === void 0 ? asArray2(root.security) : asArray2(operation.security);
@@ -261447,6 +261535,13 @@ function collectRequestBody(root, operation, version, operationId, warnings) {
   const body2 = resolveInternalRef(root, operation.requestBody);
   if (!body2) return void 0;
   const content = asRecord5(body2.content);
+  for (const [contentType2, mediaObject] of Object.entries(content ?? {})) {
+    if (asRecord5(mediaObject)?.schema === void 0) {
+      warnings.push(
+        `CONTRACT_REQUEST_SCHEMA_UNDOCUMENTED: request body ${contentType2} on ${operationId} declares no schema; generated request payload shape is not validated`
+      );
+    }
+  }
   const fieldRules = content ? requestBodyFieldRules(root, content, version, operationId, warnings) : void 0;
   if (fieldRules) {
     for (const [base, rule] of Object.entries(fieldRules)) {
@@ -262293,9 +262388,22 @@ function buildContractIndex(root) {
           const linkExpressions = collectLinkExpressions(root, response, `${lowerMethod.toUpperCase()} ${path10}`, responseWarnings, version, linkTargetSchemas);
           const responseContext = `${lowerMethod.toUpperCase()} ${path10} status ${status}`;
           const content = responseContent(root, version, response, responseContext, responseWarnings);
-          if ((status === "204" || status === "205" || status === "304") && Object.keys(content).length > 0) {
+          const bodyExpectation = responseBodyExpectation(lowerMethod, status, content);
+          if (bodyExpectation === "forbidden" && Object.keys(content).length > 0) {
             responseWarnings.add(`CONTRACT_BODYLESS_STATUS_WITH_CONTENT: ${lowerMethod.toUpperCase()} ${path10} declares content for status ${status}, which RFC 9110 forbids on the wire`);
           }
+          if (bodyExpectation === "unknown") {
+            responseWarnings.add(
+              `CONTRACT_RESPONSE_BODY_UNDOCUMENTED: ${responseContext} declares no response content; body presence, media type, and shape are not validated`
+            );
+          }
+          for (const [contentType2, mediaObject] of Object.entries(asRecord5(response.content) ?? {})) {
+            if (asRecord5(mediaObject)?.schema === void 0) {
+              responseWarnings.add(
+                `CONTRACT_RESPONSE_SCHEMA_UNDOCUMENTED: response ${contentType2} on ${responseContext} declares no schema; body shape is not validated`
+              );
+            }
+          }
           for (const [contentType2, media] of Object.entries(content)) {
             const base = contentType2.toLowerCase().split(";")[0]?.trim() ?? "";
             const schemaType = asRecord5(media.schema)?.type;
@@ -262307,7 +262415,7 @@ function buildContractIndex(root) {
           const writeOnlyProperties = collectResponseWriteOnlyNames(root, response);
           contractResponses[normalizeResponseKey(status)] = {
             content,
-            hasBody: Object.keys(content).length > 0,
+            bodyExpectation,
             headers,
             ...linkExpressions.length > 0 ? { links: linkExpressions } : {},
             ...writeOnlyProperties.length > 0 ? { writeOnlyProperties } : {}
@@ -262583,7 +262691,12 @@ function createContractScript(operation, warnings = []) {
     "  return null;",
     "}",
     'function responseText() { return pm.response.text() || ""; }',
-    'function isBodyless() { return pm.response.code === 204 || pm.response.code === 205 || pm.response.code === 304 || contract.method === "HEAD"; }',
+    'function isBodyless() { return pm.response.code < 200 || pm.response.code === 204 || pm.response.code === 205 || pm.response.code === 304 || contract.method === "HEAD"; }',
+    "function selectedBodyExpectation() {",
+    '  if (isBodyless()) return "forbidden";',
+    '  if (!selected) return "unknown";',
+    '  return selected.value.bodyExpectation || "unknown";',
+    "}",
     'function mediaBase(value) { return String(value || "").toLowerCase().split(";")[0].trim(); }',
     'function mediaParts(value) { var base = mediaBase(value); var parts = base.split("/"); return { raw: base, type: parts[0] || "", subtype: parts[1] || "" }; }',
     'function isJsonSubtype(subtype) { return subtype === "json" || /\\+json$/.test(subtype); }',
@@ -262623,6 +262736,7 @@ function createContractScript(operation, warnings = []) {
     "  return matches[0];",
     "}",
     "var selected = selectedResponseContract();",
+    "var bodyExpectation = selectedBodyExpectation();",
     ...skipped.length > 0 ? [
       // A schema schemasafe could not compile is NOT silently ignored: it is
       // surfaced here (and as a CONTRACT_SCHEMA_NOT_COMPILED warning at generation
@@ -262654,10 +262768,8 @@ function createContractScript(operation, warnings = []) {
     "});",
     "pm.test('Response body matches OpenAPI body contract', function () {",
     "  if (!selected) return;",
-    "  if (isBodyless()) { pm.expect(responseText().trim().length).to.equal(0); return; }",
-    "  var content = selected.value.content || {};",
-    '  if (Object.keys(content).length === 0) { pm.expect(responseText().trim().length, "OpenAPI response defines no body but response body was not empty").to.equal(0); }',
-    '  else { pm.expect(responseText().trim().length, "OpenAPI response defines a body but response body was empty").to.be.above(0); }',
+    '  if (bodyExpectation === "forbidden") { pm.expect(responseText().length, "HTTP semantics forbid a response body for " + contract.method + " " + contract.path + " status " + pm.response.code).to.equal(0); return; }',
+    '  if (bodyExpectation === "declared") { pm.expect(responseText().length, "OpenAPI response declares content but response body was empty").to.be.above(0); }',
     "});",
     "pm.test('Content-Type matches OpenAPI response content', function () {",
     "  if (!selected || isBodyless()) return;",
@@ -263700,8 +263812,7 @@ function createContractScript(operation, warnings = []) {
     '  if (contract.method === "HEAD" || pm.response.code === 304) return;',
     "  var actualBytes = unescape(encodeURIComponent(responseText())).length;",
     '  if (Number(String(raw).trim()) !== actualBytes) pm.expect.fail("Content-Length must equal the response body byte length when Content-Encoding and Transfer-Encoding are absent (RFC 9110 8.6): " + raw + " !== " + actualBytes);',
-    "  var mustBeEmpty = isBodyless() || (selected && Object.keys(selected.value.content || {}).length === 0);",
-    '  if (mustBeEmpty && Number(String(raw).trim()) !== 0) pm.expect.fail("OpenAPI defines no response body for " + contract.method + " " + contract.path + " status " + pm.response.code + " but Content-Length was " + raw);',
+    '  if (bodyExpectation === "forbidden" && Number(String(raw).trim()) !== 0) pm.expect.fail("HTTP semantics forbid a carried response body for " + contract.method + " " + contract.path + " status " + pm.response.code + " but Content-Length was " + raw);',
     "});",
     "pm.test('RFC SHOULD-level advisories are documented', function () {",
     '  pm.expect(rfcAdvisories, "SHOULD-level findings (advisory, non-failing): " + rfcAdvisories.join("; ")).to.be.an("array");',
@@ -312623,7 +312734,28 @@ async function provisionWorkspace(inputs, dependencies, telemetry, outputs, reso
   }
   telemetry.setTeamId(teamId);
   const repoUrl = inputs.repoUrl || "";
-  if (!explicitWorkspaceId && repoUrl && inputs.postmanAccessToken && teamId) {
+  if (repoUrl && dependencies.internalIntegration?.findWorkspaceForRepo) {
+    const probe = await dependencies.internalIntegration.findWorkspaceForRepo(repoUrl);
+    if (probe.state === "linked-invisible") {
+      const orgTail = inputs.workspaceTeamId ? " Verify workspace-team-id; if the owner is in another sub-team, ask that sub-team's admin to disconnect it." : "";
+      throw new Error(
+        `REPOSITORY_LINK_CONFLICT_INVISIBLE: Repository ${repoUrl} at path / is linked to workspace ${probe.workspaceId}, but these credentials cannot view it. No Postman assets were changed. Ask its owner or a team admin to disconnect it.${orgTail}`
+      );
+    }
+    if (probe.state === "linked-visible") {
+      workspaceId = probe.workspace.id;
+      workspaceMutationOwned = true;
+      const nameSuffix = probe.workspace.name ? ` ("${probe.workspace.name}")` : "";
+      dependencies.core.info(
+        `Repository ${repoUrl} at path / is already linked to workspace ${probe.workspace.id}${nameSuffix}; adopting it as the canonical workspace.`
+      );
+    } else if (probe.state === "unknown") {
+      dependencies.core.warning(
+        `Repository link preflight could not determine ownership for ${repoUrl}: ${probe.reason}. Continuing with normal workspace selection.`
+      );
+    }
+  }
+  if (!workspaceId && repoUrl && inputs.postmanAccessToken && teamId) {
     const selection = await runGroup(
       dependencies.core,
       "Resolve Canonical Workspace",

package/dist/cli.cjs

@@ -257254,6 +257254,87 @@ var BifrostInternalIntegrationAdapter = class _BifrostInternalIntegrationAdapter
     const advised = adviseFromHttpError(httpErr, this.adviceContext("workspace repository linking"));
     throw advised ?? httpErr;
   }
+  async findWorkspaceForRepo(repoUrl, path8 = "/") {
+    const encodedRepo = encodeURIComponent(repoUrl);
+    const encodedPath = encodeURIComponent(path8);
+    const requestPath2 = `/workspaces/filesystem?repo=${encodedRepo}&path=${encodedPath}`;
+    let response;
+    try {
+      response = await this.proxyRequest("workspaces", "GET", requestPath2);
+    } catch (error) {
+      return {
+        state: "unknown",
+        reason: error instanceof Error ? error.message : String(error)
+      };
+    }
+    let bodyText;
+    try {
+      bodyText = await response.text();
+    } catch (error) {
+      return {
+        state: "unknown",
+        reason: error instanceof Error ? error.message : String(error)
+      };
+    }
+    let parsed = null;
+    if (bodyText.trim()) {
+      try {
+        parsed = JSON.parse(bodyText);
+      } catch (error) {
+        return {
+          state: "unknown",
+          reason: error instanceof Error ? error.message : String(error)
+        };
+      }
+    }
+    const wrappedInvisibleWorkspaceIdRaw = parsed?.error?.meta?.workspaceId;
+    const wrappedInvisibleWorkspaceId = typeof wrappedInvisibleWorkspaceIdRaw === "string" ? wrappedInvisibleWorkspaceIdRaw.trim() : "";
+    if (wrappedInvisibleWorkspaceId) {
+      return { state: "linked-invisible", workspaceId: wrappedInvisibleWorkspaceId };
+    }
+    if (response.status === 200) {
+      if (!parsed || !Object.prototype.hasOwnProperty.call(parsed, "data")) {
+        return {
+          state: "unknown",
+          reason: "Filesystem probe returned 200 without a data payload"
+        };
+      }
+      const data = parsed?.data ?? null;
+      if (data == null) {
+        return { state: "free" };
+      }
+      if (typeof data === "object" && !Array.isArray(data)) {
+        const workspace = data;
+        const id = typeof workspace.id === "string" ? workspace.id.trim() : "";
+        if (id) {
+          const name = typeof workspace.name === "string" ? workspace.name : "";
+          return {
+            state: "linked-visible",
+            workspace: { ...workspace, id, name }
+          };
+        }
+      }
+      return {
+        state: "unknown",
+        reason: "Filesystem probe returned 200 with unrecognized workspace payload"
+      };
+    }
+    if (response.status === 403) {
+      const workspaceIdRaw = parsed?.error?.meta?.workspaceId ?? parsed?.meta?.workspaceId;
+      const workspaceId = typeof workspaceIdRaw === "string" ? workspaceIdRaw.trim() : "";
+      if (workspaceId) {
+        return { state: "linked-invisible", workspaceId };
+      }
+      return {
+        state: "unknown",
+        reason: "Filesystem probe returned 403 without error.meta.workspaceId"
+      };
+    }
+    return {
+      state: "unknown",
+      reason: `Filesystem probe returned HTTP ${response.status}`
+    };
+  }
   async linkCollectionsToSpecification(specificationId, collections) {
     if (collections.length === 0) {
       return;
@@ -259335,6 +259416,13 @@ function normalizeResponseKey(status) {
   const raw = String(status);
   return /^[1-5]xx$/i.test(raw) ? raw.toUpperCase() : raw;
 }
+function responseBodyExpectation(method, status, content) {
+  const normalizedStatus = normalizeResponseKey(status);
+  if (method === "head" || normalizedStatus === "1XX" || /^1[0-9][0-9]$/.test(normalizedStatus) || normalizedStatus === "204" || normalizedStatus === "205" || normalizedStatus === "304") {
+    return "forbidden";
+  }
+  return Object.keys(content).length > 0 ? "declared" : "unknown";
+}
 function collectSecurityApiKeys(root, operation) {
   const securitySchemes = asRecord5(asRecord5(root.components)?.securitySchemes);
   const requirements = operation.security === void 0 ? asArray2(root.security) : asArray2(operation.security);
@@ -259765,6 +259853,13 @@ function collectRequestBody(root, operation, version, operationId, warnings) {
   const body2 = resolveInternalRef(root, operation.requestBody);
   if (!body2) return void 0;
   const content = asRecord5(body2.content);
+  for (const [contentType2, mediaObject] of Object.entries(content ?? {})) {
+    if (asRecord5(mediaObject)?.schema === void 0) {
+      warnings.push(
+        `CONTRACT_REQUEST_SCHEMA_UNDOCUMENTED: request body ${contentType2} on ${operationId} declares no schema; generated request payload shape is not validated`
+      );
+    }
+  }
   const fieldRules = content ? requestBodyFieldRules(root, content, version, operationId, warnings) : void 0;
   if (fieldRules) {
     for (const [base, rule] of Object.entries(fieldRules)) {
@@ -260611,9 +260706,22 @@ function buildContractIndex(root) {
           const linkExpressions = collectLinkExpressions(root, response, `${lowerMethod.toUpperCase()} ${path8}`, responseWarnings, version, linkTargetSchemas);
           const responseContext = `${lowerMethod.toUpperCase()} ${path8} status ${status}`;
           const content = responseContent(root, version, response, responseContext, responseWarnings);
-          if ((status === "204" || status === "205" || status === "304") && Object.keys(content).length > 0) {
+          const bodyExpectation = responseBodyExpectation(lowerMethod, status, content);
+          if (bodyExpectation === "forbidden" && Object.keys(content).length > 0) {
             responseWarnings.add(`CONTRACT_BODYLESS_STATUS_WITH_CONTENT: ${lowerMethod.toUpperCase()} ${path8} declares content for status ${status}, which RFC 9110 forbids on the wire`);
           }
+          if (bodyExpectation === "unknown") {
+            responseWarnings.add(
+              `CONTRACT_RESPONSE_BODY_UNDOCUMENTED: ${responseContext} declares no response content; body presence, media type, and shape are not validated`
+            );
+          }
+          for (const [contentType2, mediaObject] of Object.entries(asRecord5(response.content) ?? {})) {
+            if (asRecord5(mediaObject)?.schema === void 0) {
+              responseWarnings.add(
+                `CONTRACT_RESPONSE_SCHEMA_UNDOCUMENTED: response ${contentType2} on ${responseContext} declares no schema; body shape is not validated`
+              );
+            }
+          }
           for (const [contentType2, media] of Object.entries(content)) {
             const base = contentType2.toLowerCase().split(";")[0]?.trim() ?? "";
             const schemaType = asRecord5(media.schema)?.type;
@@ -260625,7 +260733,7 @@ function buildContractIndex(root) {
           const writeOnlyProperties = collectResponseWriteOnlyNames(root, response);
           contractResponses[normalizeResponseKey(status)] = {
             content,
-            hasBody: Object.keys(content).length > 0,
+            bodyExpectation,
             headers,
             ...linkExpressions.length > 0 ? { links: linkExpressions } : {},
             ...writeOnlyProperties.length > 0 ? { writeOnlyProperties } : {}
@@ -260901,7 +261009,12 @@ function createContractScript(operation, warnings = []) {
     "  return null;",
     "}",
     'function responseText() { return pm.response.text() || ""; }',
-    'function isBodyless() { return pm.response.code === 204 || pm.response.code === 205 || pm.response.code === 304 || contract.method === "HEAD"; }',
+    'function isBodyless() { return pm.response.code < 200 || pm.response.code === 204 || pm.response.code === 205 || pm.response.code === 304 || contract.method === "HEAD"; }',
+    "function selectedBodyExpectation() {",
+    '  if (isBodyless()) return "forbidden";',
+    '  if (!selected) return "unknown";',
+    '  return selected.value.bodyExpectation || "unknown";',
+    "}",
     'function mediaBase(value) { return String(value || "").toLowerCase().split(";")[0].trim(); }',
     'function mediaParts(value) { var base = mediaBase(value); var parts = base.split("/"); return { raw: base, type: parts[0] || "", subtype: parts[1] || "" }; }',
     'function isJsonSubtype(subtype) { return subtype === "json" || /\\+json$/.test(subtype); }',
@@ -260941,6 +261054,7 @@ function createContractScript(operation, warnings = []) {
     "  return matches[0];",
     "}",
     "var selected = selectedResponseContract();",
+    "var bodyExpectation = selectedBodyExpectation();",
     ...skipped.length > 0 ? [
       // A schema schemasafe could not compile is NOT silently ignored: it is
       // surfaced here (and as a CONTRACT_SCHEMA_NOT_COMPILED warning at generation
@@ -260972,10 +261086,8 @@ function createContractScript(operation, warnings = []) {
     "});",
     "pm.test('Response body matches OpenAPI body contract', function () {",
     "  if (!selected) return;",
-    "  if (isBodyless()) { pm.expect(responseText().trim().length).to.equal(0); return; }",
-    "  var content = selected.value.content || {};",
-    '  if (Object.keys(content).length === 0) { pm.expect(responseText().trim().length, "OpenAPI response defines no body but response body was not empty").to.equal(0); }',
-    '  else { pm.expect(responseText().trim().length, "OpenAPI response defines a body but response body was empty").to.be.above(0); }',
+    '  if (bodyExpectation === "forbidden") { pm.expect(responseText().length, "HTTP semantics forbid a response body for " + contract.method + " " + contract.path + " status " + pm.response.code).to.equal(0); return; }',
+    '  if (bodyExpectation === "declared") { pm.expect(responseText().length, "OpenAPI response declares content but response body was empty").to.be.above(0); }',
     "});",
     "pm.test('Content-Type matches OpenAPI response content', function () {",
     "  if (!selected || isBodyless()) return;",
@@ -262018,8 +262130,7 @@ function createContractScript(operation, warnings = []) {
     '  if (contract.method === "HEAD" || pm.response.code === 304) return;',
     "  var actualBytes = unescape(encodeURIComponent(responseText())).length;",
     '  if (Number(String(raw).trim()) !== actualBytes) pm.expect.fail("Content-Length must equal the response body byte length when Content-Encoding and Transfer-Encoding are absent (RFC 9110 8.6): " + raw + " !== " + actualBytes);',
-    "  var mustBeEmpty = isBodyless() || (selected && Object.keys(selected.value.content || {}).length === 0);",
-    '  if (mustBeEmpty && Number(String(raw).trim()) !== 0) pm.expect.fail("OpenAPI defines no response body for " + contract.method + " " + contract.path + " status " + pm.response.code + " but Content-Length was " + raw);',
+    '  if (bodyExpectation === "forbidden" && Number(String(raw).trim()) !== 0) pm.expect.fail("HTTP semantics forbid a carried response body for " + contract.method + " " + contract.path + " status " + pm.response.code + " but Content-Length was " + raw);',
     "});",
     "pm.test('RFC SHOULD-level advisories are documented', function () {",
     '  pm.expect(rfcAdvisories, "SHOULD-level findings (advisory, non-failing): " + rfcAdvisories.join("; ")).to.be.an("array");',
@@ -310849,7 +310960,28 @@ async function provisionWorkspace(inputs, dependencies, telemetry, outputs, reso
   }
   telemetry.setTeamId(teamId);
   const repoUrl = inputs.repoUrl || "";
-  if (!explicitWorkspaceId && repoUrl && inputs.postmanAccessToken && teamId) {
+  if (repoUrl && dependencies.internalIntegration?.findWorkspaceForRepo) {
+    const probe = await dependencies.internalIntegration.findWorkspaceForRepo(repoUrl);
+    if (probe.state === "linked-invisible") {
+      const orgTail = inputs.workspaceTeamId ? " Verify workspace-team-id; if the owner is in another sub-team, ask that sub-team's admin to disconnect it." : "";
+      throw new Error(
+        `REPOSITORY_LINK_CONFLICT_INVISIBLE: Repository ${repoUrl} at path / is linked to workspace ${probe.workspaceId}, but these credentials cannot view it. No Postman assets were changed. Ask its owner or a team admin to disconnect it.${orgTail}`
+      );
+    }
+    if (probe.state === "linked-visible") {
+      workspaceId = probe.workspace.id;
+      workspaceMutationOwned = true;
+      const nameSuffix = probe.workspace.name ? ` ("${probe.workspace.name}")` : "";
+      dependencies.core.info(
+        `Repository ${repoUrl} at path / is already linked to workspace ${probe.workspace.id}${nameSuffix}; adopting it as the canonical workspace.`
+      );
+    } else if (probe.state === "unknown") {
+      dependencies.core.warning(
+        `Repository link preflight could not determine ownership for ${repoUrl}: ${probe.reason}. Continuing with normal workspace selection.`
+      );
+    }
+  }
+  if (!workspaceId && repoUrl && inputs.postmanAccessToken && teamId) {
     const selection = await runGroup(
       dependencies.core,
       "Resolve Canonical Workspace",

package/dist/index.cjs

@@ -258961,6 +258961,87 @@ var BifrostInternalIntegrationAdapter = class _BifrostInternalIntegrationAdapter
     const advised = adviseFromHttpError(httpErr, this.adviceContext("workspace repository linking"));
     throw advised ?? httpErr;
   }
+  async findWorkspaceForRepo(repoUrl, path10 = "/") {
+    const encodedRepo = encodeURIComponent(repoUrl);
+    const encodedPath = encodeURIComponent(path10);
+    const requestPath2 = `/workspaces/filesystem?repo=${encodedRepo}&path=${encodedPath}`;
+    let response;
+    try {
+      response = await this.proxyRequest("workspaces", "GET", requestPath2);
+    } catch (error2) {
+      return {
+        state: "unknown",
+        reason: error2 instanceof Error ? error2.message : String(error2)
+      };
+    }
+    let bodyText;
+    try {
+      bodyText = await response.text();
+    } catch (error2) {
+      return {
+        state: "unknown",
+        reason: error2 instanceof Error ? error2.message : String(error2)
+      };
+    }
+    let parsed = null;
+    if (bodyText.trim()) {
+      try {
+        parsed = JSON.parse(bodyText);
+      } catch (error2) {
+        return {
+          state: "unknown",
+          reason: error2 instanceof Error ? error2.message : String(error2)
+        };
+      }
+    }
+    const wrappedInvisibleWorkspaceIdRaw = parsed?.error?.meta?.workspaceId;
+    const wrappedInvisibleWorkspaceId = typeof wrappedInvisibleWorkspaceIdRaw === "string" ? wrappedInvisibleWorkspaceIdRaw.trim() : "";
+    if (wrappedInvisibleWorkspaceId) {
+      return { state: "linked-invisible", workspaceId: wrappedInvisibleWorkspaceId };
+    }
+    if (response.status === 200) {
+      if (!parsed || !Object.prototype.hasOwnProperty.call(parsed, "data")) {
+        return {
+          state: "unknown",
+          reason: "Filesystem probe returned 200 without a data payload"
+        };
+      }
+      const data = parsed?.data ?? null;
+      if (data == null) {
+        return { state: "free" };
+      }
+      if (typeof data === "object" && !Array.isArray(data)) {
+        const workspace = data;
+        const id = typeof workspace.id === "string" ? workspace.id.trim() : "";
+        if (id) {
+          const name = typeof workspace.name === "string" ? workspace.name : "";
+          return {
+            state: "linked-visible",
+            workspace: { ...workspace, id, name }
+          };
+        }
+      }
+      return {
+        state: "unknown",
+        reason: "Filesystem probe returned 200 with unrecognized workspace payload"
+      };
+    }
+    if (response.status === 403) {
+      const workspaceIdRaw = parsed?.error?.meta?.workspaceId ?? parsed?.meta?.workspaceId;
+      const workspaceId = typeof workspaceIdRaw === "string" ? workspaceIdRaw.trim() : "";
+      if (workspaceId) {
+        return { state: "linked-invisible", workspaceId };
+      }
+      return {
+        state: "unknown",
+        reason: "Filesystem probe returned 403 without error.meta.workspaceId"
+      };
+    }
+    return {
+      state: "unknown",
+      reason: `Filesystem probe returned HTTP ${response.status}`
+    };
+  }
   async linkCollectionsToSpecification(specificationId, collections) {
     if (collections.length === 0) {
       return;
@@ -261042,6 +261123,13 @@ function normalizeResponseKey(status) {
   const raw = String(status);
   return /^[1-5]xx$/i.test(raw) ? raw.toUpperCase() : raw;
 }
+function responseBodyExpectation(method, status, content) {
+  const normalizedStatus = normalizeResponseKey(status);
+  if (method === "head" || normalizedStatus === "1XX" || /^1[0-9][0-9]$/.test(normalizedStatus) || normalizedStatus === "204" || normalizedStatus === "205" || normalizedStatus === "304") {
+    return "forbidden";
+  }
+  return Object.keys(content).length > 0 ? "declared" : "unknown";
+}
 function collectSecurityApiKeys(root, operation) {
   const securitySchemes = asRecord5(asRecord5(root.components)?.securitySchemes);
   const requirements = operation.security === void 0 ? asArray2(root.security) : asArray2(operation.security);
@@ -261472,6 +261560,13 @@ function collectRequestBody(root, operation, version, operationId, warnings) {
   const body2 = resolveInternalRef(root, operation.requestBody);
   if (!body2) return void 0;
   const content = asRecord5(body2.content);
+  for (const [contentType2, mediaObject] of Object.entries(content ?? {})) {
+    if (asRecord5(mediaObject)?.schema === void 0) {
+      warnings.push(
+        `CONTRACT_REQUEST_SCHEMA_UNDOCUMENTED: request body ${contentType2} on ${operationId} declares no schema; generated request payload shape is not validated`
+      );
+    }
+  }
   const fieldRules = content ? requestBodyFieldRules(root, content, version, operationId, warnings) : void 0;
   if (fieldRules) {
     for (const [base, rule] of Object.entries(fieldRules)) {
@@ -262318,9 +262413,22 @@ function buildContractIndex(root) {
           const linkExpressions = collectLinkExpressions(root, response, `${lowerMethod.toUpperCase()} ${path10}`, responseWarnings, version, linkTargetSchemas);
           const responseContext = `${lowerMethod.toUpperCase()} ${path10} status ${status}`;
           const content = responseContent(root, version, response, responseContext, responseWarnings);
-          if ((status === "204" || status === "205" || status === "304") && Object.keys(content).length > 0) {
+          const bodyExpectation = responseBodyExpectation(lowerMethod, status, content);
+          if (bodyExpectation === "forbidden" && Object.keys(content).length > 0) {
             responseWarnings.add(`CONTRACT_BODYLESS_STATUS_WITH_CONTENT: ${lowerMethod.toUpperCase()} ${path10} declares content for status ${status}, which RFC 9110 forbids on the wire`);
           }
+          if (bodyExpectation === "unknown") {
+            responseWarnings.add(
+              `CONTRACT_RESPONSE_BODY_UNDOCUMENTED: ${responseContext} declares no response content; body presence, media type, and shape are not validated`
+            );
+          }
+          for (const [contentType2, mediaObject] of Object.entries(asRecord5(response.content) ?? {})) {
+            if (asRecord5(mediaObject)?.schema === void 0) {
+              responseWarnings.add(
+                `CONTRACT_RESPONSE_SCHEMA_UNDOCUMENTED: response ${contentType2} on ${responseContext} declares no schema; body shape is not validated`
+              );
+            }
+          }
           for (const [contentType2, media] of Object.entries(content)) {
             const base = contentType2.toLowerCase().split(";")[0]?.trim() ?? "";
             const schemaType = asRecord5(media.schema)?.type;
@@ -262332,7 +262440,7 @@ function buildContractIndex(root) {
           const writeOnlyProperties = collectResponseWriteOnlyNames(root, response);
           contractResponses[normalizeResponseKey(status)] = {
             content,
-            hasBody: Object.keys(content).length > 0,
+            bodyExpectation,
             headers,
             ...linkExpressions.length > 0 ? { links: linkExpressions } : {},
             ...writeOnlyProperties.length > 0 ? { writeOnlyProperties } : {}
@@ -262608,7 +262716,12 @@ function createContractScript(operation, warnings = []) {
     "  return null;",
     "}",
     'function responseText() { return pm.response.text() || ""; }',
-    'function isBodyless() { return pm.response.code === 204 || pm.response.code === 205 || pm.response.code === 304 || contract.method === "HEAD"; }',
+    'function isBodyless() { return pm.response.code < 200 || pm.response.code === 204 || pm.response.code === 205 || pm.response.code === 304 || contract.method === "HEAD"; }',
+    "function selectedBodyExpectation() {",
+    '  if (isBodyless()) return "forbidden";',
+    '  if (!selected) return "unknown";',
+    '  return selected.value.bodyExpectation || "unknown";',
+    "}",
     'function mediaBase(value) { return String(value || "").toLowerCase().split(";")[0].trim(); }',
     'function mediaParts(value) { var base = mediaBase(value); var parts = base.split("/"); return { raw: base, type: parts[0] || "", subtype: parts[1] || "" }; }',
     'function isJsonSubtype(subtype) { return subtype === "json" || /\\+json$/.test(subtype); }',
@@ -262648,6 +262761,7 @@ function createContractScript(operation, warnings = []) {
     "  return matches[0];",
     "}",
     "var selected = selectedResponseContract();",
+    "var bodyExpectation = selectedBodyExpectation();",
     ...skipped.length > 0 ? [
       // A schema schemasafe could not compile is NOT silently ignored: it is
       // surfaced here (and as a CONTRACT_SCHEMA_NOT_COMPILED warning at generation
@@ -262679,10 +262793,8 @@ function createContractScript(operation, warnings = []) {
     "});",
     "pm.test('Response body matches OpenAPI body contract', function () {",
     "  if (!selected) return;",
-    "  if (isBodyless()) { pm.expect(responseText().trim().length).to.equal(0); return; }",
-    "  var content = selected.value.content || {};",
-    '  if (Object.keys(content).length === 0) { pm.expect(responseText().trim().length, "OpenAPI response defines no body but response body was not empty").to.equal(0); }',
-    '  else { pm.expect(responseText().trim().length, "OpenAPI response defines a body but response body was empty").to.be.above(0); }',
+    '  if (bodyExpectation === "forbidden") { pm.expect(responseText().length, "HTTP semantics forbid a response body for " + contract.method + " " + contract.path + " status " + pm.response.code).to.equal(0); return; }',
+    '  if (bodyExpectation === "declared") { pm.expect(responseText().length, "OpenAPI response declares content but response body was empty").to.be.above(0); }',
     "});",
     "pm.test('Content-Type matches OpenAPI response content', function () {",
     "  if (!selected || isBodyless()) return;",
@@ -263725,8 +263837,7 @@ function createContractScript(operation, warnings = []) {
     '  if (contract.method === "HEAD" || pm.response.code === 304) return;',
     "  var actualBytes = unescape(encodeURIComponent(responseText())).length;",
     '  if (Number(String(raw).trim()) !== actualBytes) pm.expect.fail("Content-Length must equal the response body byte length when Content-Encoding and Transfer-Encoding are absent (RFC 9110 8.6): " + raw + " !== " + actualBytes);',
-    "  var mustBeEmpty = isBodyless() || (selected && Object.keys(selected.value.content || {}).length === 0);",
-    '  if (mustBeEmpty && Number(String(raw).trim()) !== 0) pm.expect.fail("OpenAPI defines no response body for " + contract.method + " " + contract.path + " status " + pm.response.code + " but Content-Length was " + raw);',
+    '  if (bodyExpectation === "forbidden" && Number(String(raw).trim()) !== 0) pm.expect.fail("HTTP semantics forbid a carried response body for " + contract.method + " " + contract.path + " status " + pm.response.code + " but Content-Length was " + raw);',
     "});",
     "pm.test('RFC SHOULD-level advisories are documented', function () {",
     '  pm.expect(rfcAdvisories, "SHOULD-level findings (advisory, non-failing): " + rfcAdvisories.join("; ")).to.be.an("array");',
@@ -312651,7 +312762,28 @@ async function provisionWorkspace(inputs, dependencies, telemetry, outputs, reso
   }
   telemetry.setTeamId(teamId);
   const repoUrl = inputs.repoUrl || "";
-  if (!explicitWorkspaceId && repoUrl && inputs.postmanAccessToken && teamId) {
+  if (repoUrl && dependencies.internalIntegration?.findWorkspaceForRepo) {
+    const probe = await dependencies.internalIntegration.findWorkspaceForRepo(repoUrl);
+    if (probe.state === "linked-invisible") {
+      const orgTail = inputs.workspaceTeamId ? " Verify workspace-team-id; if the owner is in another sub-team, ask that sub-team's admin to disconnect it." : "";
+      throw new Error(
+        `REPOSITORY_LINK_CONFLICT_INVISIBLE: Repository ${repoUrl} at path / is linked to workspace ${probe.workspaceId}, but these credentials cannot view it. No Postman assets were changed. Ask its owner or a team admin to disconnect it.${orgTail}`
+      );
+    }
+    if (probe.state === "linked-visible") {
+      workspaceId = probe.workspace.id;
+      workspaceMutationOwned = true;
+      const nameSuffix = probe.workspace.name ? ` ("${probe.workspace.name}")` : "";
+      dependencies.core.info(
+        `Repository ${repoUrl} at path / is already linked to workspace ${probe.workspace.id}${nameSuffix}; adopting it as the canonical workspace.`
+      );
+    } else if (probe.state === "unknown") {
+      dependencies.core.warning(
+        `Repository link preflight could not determine ownership for ${repoUrl}: ${probe.reason}. Continuing with normal workspace selection.`
+      );
+    }
+  }
+  if (!workspaceId && repoUrl && inputs.postmanAccessToken && teamId) {
     const selection = await runGroup(
       dependencies.core,
       "Resolve Canonical Workspace",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@postman-cse/onboarding-bootstrap",
-  "version": "2.9.8",
+  "version": "2.9.10",
   "description": "Bootstrap Postman workspaces, specs, and collections from OpenAPI.",
   "type": "module",
   "main": "dist/index.cjs",