@postman-cse/onboarding-repo-sync 2.1.0 → 2.1.2

package/dist/action.cjs

@@ -122063,7 +122063,7 @@ function getIDToken(aud) {
 }
 
 // src/index.ts
-var import_node_fs2 = require("node:fs");
+var import_node_fs3 = require("node:fs");
 var path8 = __toESM(require("node:path"), 1);
 
 // node_modules/js-yaml/dist/js-yaml.mjs
@@ -125366,6 +125366,7 @@ function getCiWorkflowTemplate(provider, options = {}) {
 }
 
 // src/lib/github/repo-mutation.ts
+var import_node_fs = require("node:fs");
 var import_node_path = __toESM(require("node:path"), 1);
 
 // src/lib/secrets.ts
@@ -125607,17 +125608,21 @@ function normalizeStagePaths(stagePaths) {
     if (hasControlCharacter(rawPath) || import_node_path.default.isAbsolute(stagePath) || import_node_path.default.win32.isAbsolute(stagePath) || segments.includes("..") || stagePath.startsWith(":") || hasControlCharacter(stagePath)) {
       throw new Error(`Unsafe git stage path: ${stagePath}`);
     }
-    normalized.push(stagePath);
+    if (!normalized.includes(stagePath)) {
+      normalized.push(stagePath);
+    }
   }
   return normalized;
 }
 var RepoMutationService = class {
+  cwd;
   execute;
   provider;
   repository;
   repoUrl;
   secretMasker;
   constructor(options) {
+    this.cwd = options.cwd ?? process.cwd();
     this.execute = options.execute;
     this.provider = options.provider ?? "github";
     this.repository = options.repository;
@@ -125626,7 +125631,8 @@ var RepoMutationService = class {
   }
   async commitAndPush(options) {
     const resolvedCurrentRef = resolveCurrentRef(options);
-    const stagePaths = normalizeStagePaths(options.stagePaths);
+    const removePaths = normalizeStagePaths(options.removePaths ?? []);
+    const stagePaths = normalizeStagePaths([...options.stagePaths, ...removePaths]);
     const tokens = this.provider === "azure-devops" ? buildPushTokenOrder({ adoToken: options.adoToken }) : buildPushTokenOrder({
       fallbackToken: options.fallbackToken,
       githubToken: options.githubToken
@@ -125639,8 +125645,43 @@ var RepoMutationService = class {
         resolvedCurrentRef
       };
     }
+    const changed = await this.execute("git", [
+      "status",
+      "--porcelain=v1",
+      "--untracked-files=all",
+      "--",
+      ...stagePaths
+    ]);
+    if (changed.exitCode !== 0) {
+      throw new Error(this.secretMasker(changed.stderr || changed.stdout || "Failed to inspect generated changes"));
+    }
+    const hasPlannedRemoval = removePaths.some(
+      (removePath) => (0, import_node_fs.existsSync)(import_node_path.default.resolve(this.cwd, removePath))
+    );
+    if (!changed.stdout.trim() && !hasPlannedRemoval) {
+      return {
+        commitSha: "",
+        pushed: false,
+        resolvedCurrentRef
+      };
+    }
+    const usePersistedCredentials = tokens.length === 0 && this.provider === "azure-devops";
+    if (options.repoWriteMode === "commit-and-push") {
+      if (!supportsTokenRemote(this.provider)) {
+        throw new Error(`repo-write-mode=commit-and-push is not supported for git provider "${this.provider}"`);
+      }
+      if (!resolvedCurrentRef) {
+        throw new Error("No current ref could be resolved for repo-write-mode=commit-and-push");
+      }
+      if (tokens.length === 0 && !usePersistedCredentials) {
+        throw new Error("No push token configured for repo-write-mode=commit-and-push");
+      }
+    }
     await this.execute("git", ["config", "user.name", options.committerName]);
     await this.execute("git", ["config", "user.email", options.committerEmail]);
+    for (const removePath of removePaths) {
+      (0, import_node_fs.rmSync)(import_node_path.default.resolve(this.cwd, removePath), { force: true });
+    }
     await this.execute("git", ["add", "-A", "--", ...stagePaths]);
     const staged = await this.execute("git", ["diff", "--cached", "--quiet"]);
     if (staged.exitCode === 0) {
@@ -125663,16 +125704,6 @@ var RepoMutationService = class {
         resolvedCurrentRef
       };
     }
-    if (!resolvedCurrentRef) {
-      throw new Error("No current ref could be resolved for repo-write-mode=commit-and-push");
-    }
-    const usePersistedCredentials = tokens.length === 0 && this.provider === "azure-devops";
-    if (tokens.length === 0 && !usePersistedCredentials) {
-      throw new Error("No push token configured for repo-write-mode=commit-and-push");
-    }
-    if (tokens.length > 0 && !supportsTokenRemote(this.provider)) {
-      throw new Error(`repo-write-mode=commit-and-push is not supported for git provider "${this.provider}"`);
-    }
     const originalRemote = (await this.execute("git", ["remote", "get-url", "origin"])).stdout.trim();
     let pushed = false;
     let lastError = "";
@@ -126192,11 +126223,11 @@ function createTelemetryContext(options) {
 }
 
 // src/action-version.ts
-var import_node_fs = require("node:fs");
+var import_node_fs2 = require("node:fs");
 var import_node_path2 = require("node:path");
 function resolveActionVersion2() {
   try {
-    const raw = (0, import_node_fs.readFileSync)((0, import_node_path2.join)(__dirname, "..", "package.json"), "utf8");
+    const raw = (0, import_node_fs2.readFileSync)((0, import_node_path2.join)(__dirname, "..", "package.json"), "utf8");
     return JSON.parse(raw).version ?? "unknown";
   } catch {
     return "unknown";
@@ -127260,12 +127291,20 @@ async function retry(operation, options = {}) {
 }
 
 // src/lib/postman/postman-gateway-assets-client.ts
+var MAX_CREATE_FLIGHTS = 256;
+var createFlights = /* @__PURE__ */ new Map();
 var PostmanGatewayAssetsClient = class {
   gateway;
   workspaceId;
+  sleep;
+  reconcileAttempts;
+  reconcileDelayMs;
   constructor(options) {
     this.gateway = options.gateway;
     this.workspaceId = String(options.workspaceId || "").trim();
+    this.sleep = options.sleep ?? sleep;
+    this.reconcileAttempts = Math.max(1, options.reconcileAttempts ?? 3);
+    this.reconcileDelayMs = Math.max(0, options.reconcileDelayMs ?? 500);
   }
   asRecord(value) {
     if (!value || typeof value !== "object" || Array.isArray(value)) return null;
@@ -127295,8 +127334,64 @@ var PostmanGatewayAssetsClient = class {
     const parts = trimmed.split("-");
     return parts.length >= 6 ? parts.slice(1).join("-") : trimmed;
   }
-  isTransient(error2) {
-    return error2 instanceof HttpError && (error2.status === 429 || error2.status >= 500);
+  isAmbiguousCreateOutcome(error2) {
+    if (error2 instanceof HttpError) {
+      return error2.status === 408 || error2.status === 429 || error2.status >= 500;
+    }
+    return error2 instanceof Error;
+  }
+  isRetryableIdempotentWriteOutcome(error2) {
+    if (error2 instanceof HttpError) {
+      return error2.status === 408 || error2.status === 429 || error2.status >= 500;
+    }
+    return error2 instanceof Error;
+  }
+  selectExactMatch(kind, identity, matches) {
+    if (matches.length > 1) {
+      const ids = matches.map((match) => match.uid).join(", ");
+      throw new Error(
+        `Multiple ${kind}s match ${identity}: ${ids}. Refusing to choose one; remove duplicates or pass an explicit asset ID.`
+      );
+    }
+    return matches[0] ?? null;
+  }
+  async singleFlight(key, fingerprint, kind, operation) {
+    const existing = createFlights.get(key);
+    if (existing) {
+      if (existing.fingerprint !== fingerprint) {
+        throw new Error(`Incompatible concurrent ${kind} create for ${key}`);
+      }
+      return existing.promise;
+    }
+    if (createFlights.size >= MAX_CREATE_FLIGHTS) {
+      throw new Error(`Too many concurrent Postman asset creates (limit ${MAX_CREATE_FLIGHTS})`);
+    }
+    const pending = operation().finally(() => {
+      if (createFlights.get(key)?.promise === pending) {
+        createFlights.delete(key);
+      }
+    });
+    createFlights.set(key, { fingerprint, promise: pending });
+    return pending;
+  }
+  async discoverAfterAmbiguousCreate(discover, error2) {
+    if (!this.isAmbiguousCreateOutcome(error2)) {
+      return null;
+    }
+    for (let attempt = 0; attempt < this.reconcileAttempts; attempt += 1) {
+      if (attempt > 0) {
+        await this.sleep(this.reconcileDelayMs);
+      }
+      const found = await discover();
+      if (found) {
+        return found;
+      }
+    }
+    return null;
+  }
+  publicEnvironmentUid(data, bareId) {
+    const owner = String(data?.owner ?? "").trim();
+    return owner && !bareId.startsWith(`${owner}-`) ? `${owner}-${bareId}` : bareId;
   }
   // --- environments (service: sync) ---
   //
@@ -127307,9 +127402,10 @@ var PostmanGatewayAssetsClient = class {
   /**
    * Create/upsert an environment through the sync service.
    * POST /environment/import?workspace=:ws { id:<uuid>, name, values } ->
-   * { data:{ id:<bare uuid>, owner } }. The id is generated once and reused
-   * across retries so the import is idempotent (a retry upserts the same
-   * environment instead of duplicating it).
+   * { data:{ id:<bare uuid>, owner } }. The id is generated once for the
+   * operation. Unsafe creates submit once (no blind retry); on an ambiguous
+   * response the client discovers by exact workspace-scoped name before
+   * failing.
    *
    * Returns the PUBLIC uid (`<owner>-<uuid>`), not the bare model id the sync
    * import echoes: mock/monitor create reference the environment by its public
@@ -127319,33 +127415,54 @@ var PostmanGatewayAssetsClient = class {
    */
   async createEnvironment(workspaceId, name, values) {
     const ws = workspaceId || this.workspaceId;
-    const id = crypto.randomUUID();
-    const body = {
-      id,
-      name,
-      values: values.map((v) => ({
-        key: v.key,
-        value: v.value,
-        type: v.type ?? "default",
-        enabled: v.enabled ?? true
-      }))
-    };
-    const response = await retry(
-      () => this.gateway.requestJson({
-        service: "sync",
-        method: "post",
-        path: `/environment/import?workspace=${ws}`,
-        body
-      }),
-      { maxAttempts: 5, delayMs: 2e3, backoffMultiplier: 2, maxDelayMs: 15e3, shouldRetry: (e) => this.isTransient(e) }
-    );
-    const data = this.dataOf(response);
-    const bareId = this.idOf(data);
-    if (!bareId) {
-      throw new Error("Environment import did not return a UID");
-    }
-    const owner = String(data?.owner ?? "").trim();
-    return owner && !bareId.startsWith(`${owner}-`) ? `${owner}-${bareId}` : bareId;
+    const envName = String(name ?? "").trim();
+    const flightKey = `environment:${ws}:${envName}`;
+    const normalizedValues = values.map((v) => ({
+      key: v.key,
+      value: v.value,
+      type: v.type ?? "default",
+      enabled: v.enabled ?? true
+    }));
+    return this.singleFlight(flightKey, JSON.stringify(normalizedValues), "environment", async () => {
+      const existing = await this.findEnvironmentByName(ws, envName);
+      if (existing?.uid) {
+        await this.updateEnvironment(existing.uid, envName, values);
+        return existing.uid;
+      }
+      const id = crypto.randomUUID();
+      const body = {
+        id,
+        name: envName,
+        values: normalizedValues
+      };
+      try {
+        const response = await this.gateway.requestJson(
+          {
+            service: "sync",
+            method: "post",
+            path: `/environment/import?workspace=${ws}`,
+            body
+          },
+          { retryTransient: false }
+        );
+        const data = this.dataOf(response);
+        const bareId = this.idOf(data);
+        if (!bareId) {
+          throw new Error("Environment import did not return a UID");
+        }
+        return this.publicEnvironmentUid(data, bareId);
+      } catch (error2) {
+        const adopted = await this.discoverAfterAmbiguousCreate(async () => {
+          const match = await this.findEnvironmentByName(ws, envName);
+          return match?.uid ?? null;
+        }, error2);
+        if (adopted) {
+          await this.updateEnvironment(adopted, envName, values);
+          return adopted;
+        }
+        throw error2;
+      }
+    });
   }
   /**
    * Update an existing environment through the sync service.
@@ -127375,7 +127492,7 @@ var PostmanGatewayAssetsClient = class {
         path: `/environment/${id}`,
         body
       }),
-      { maxAttempts: 5, delayMs: 2e3, backoffMultiplier: 2, maxDelayMs: 15e3, shouldRetry: (e) => this.isTransient(e) }
+      { maxAttempts: 5, delayMs: 2e3, backoffMultiplier: 2, maxDelayMs: 15e3, shouldRetry: (e) => this.isRetryableIdempotentWriteOutcome(e) }
     );
   }
   /**
@@ -127399,13 +127516,37 @@ var PostmanGatewayAssetsClient = class {
    */
   async listEnvironments(workspaceId) {
     const ws = workspaceId || this.workspaceId;
-    const response = await this.gateway.requestJson({
-      service: "sync",
-      method: "post",
-      path: `/list/environment?workspace=${ws}`
-    });
+    const response = await this.gateway.requestJson(
+      {
+        service: "sync",
+        method: "post",
+        path: `/list/environment?workspace=${ws}`
+      },
+      { retryTransient: true }
+    );
     const items = Array.isArray(response?.data) ? response.data : [];
-    return items.map((raw) => this.asRecord(raw)).filter((e) => e !== null).map((e) => ({ name: String(e.name ?? ""), uid: this.idOf(e) }));
+    return items.map((raw) => this.asRecord(raw)).filter((e) => e !== null).map((e) => {
+      const bareOrPublic = this.idOf(e);
+      return {
+        name: String(e.name ?? ""),
+        uid: this.publicEnvironmentUid(e, bareOrPublic)
+      };
+    });
+  }
+  /** Exact name match within a workspace. Prefer tracked UIDs before calling. */
+  async findEnvironmentByName(workspaceId, name) {
+    const want = String(name ?? "").trim();
+    if (!want) {
+      return null;
+    }
+    const environments = await this.listEnvironments(workspaceId);
+    const matches = environments.filter((entry) => entry.name === want);
+    const match = this.selectExactMatch(
+      "environment",
+      `workspace ${workspaceId} and name "${want}"`,
+      matches
+    );
+    return match?.uid ? { uid: match.uid, name: match.name } : null;
   }
   // --- collection read (service: collection, v3 export) ---
   //
@@ -127435,32 +127576,51 @@ var PostmanGatewayAssetsClient = class {
   // --- mocks (service: mock) ---
   async createMock(workspaceId, name, collectionUid, environmentUid) {
     const ws = workspaceId || this.workspaceId;
+    const mockName = String(name ?? "").trim();
     const collection = String(collectionUid ?? "").trim();
     const environment = String(environmentUid ?? "").trim();
-    const body = {
-      name,
-      collection,
-      private: false,
-      ...environment ? { environment } : {}
-    };
-    const response = await retry(
-      () => this.gateway.requestJson({
-        service: "mock",
-        method: "post",
-        path: `/mocks?workspace=${ws}`,
-        body
-      }),
-      { maxAttempts: 5, delayMs: 2e3, backoffMultiplier: 2, maxDelayMs: 15e3, shouldRetry: (e) => this.isTransient(e) }
-    );
-    const record = this.dataOf(response);
-    const uid = this.idOf(record);
-    if (!uid) {
-      throw new Error("Mock create did not return a UID");
-    }
-    return {
-      uid,
-      url: String(record?.url ?? record?.mockUrl ?? "").trim()
-    };
+    const flightKey = `mock:${ws}:${collection}:${environment}:${mockName}`;
+    return this.singleFlight(flightKey, flightKey, "mock", async () => {
+      const existing = await this.findMockByCollection(collection, environment, mockName);
+      if (existing) {
+        return { uid: existing.uid, url: existing.mockUrl };
+      }
+      const body = {
+        name: mockName,
+        collection,
+        private: false,
+        ...environment ? { environment } : {}
+      };
+      try {
+        const response = await this.gateway.requestJson(
+          {
+            service: "mock",
+            method: "post",
+            path: `/mocks?workspace=${ws}`,
+            body
+          },
+          { retryTransient: false }
+        );
+        const record = this.dataOf(response);
+        const uid = this.idOf(record);
+        if (!uid) {
+          throw new Error("Mock create did not return a UID");
+        }
+        return {
+          uid,
+          url: String(record?.url ?? record?.mockUrl ?? "").trim()
+        };
+      } catch (error2) {
+        const adopted = await this.discoverAfterAmbiguousCreate(
+          () => this.findMockByCollection(collection, environment, mockName),
+          error2
+        );
+        if (adopted) {
+          return { uid: adopted.uid, url: adopted.mockUrl };
+        }
+        throw error2;
+      }
+    });
   }
   async listMocks() {
     const response = await this.gateway.requestJson({
@@ -127489,10 +127649,19 @@ var PostmanGatewayAssetsClient = class {
       return false;
     }
   }
-  async findMockByCollection(collectionUid) {
+  async findMockByCollection(collectionUid, environmentUid, name) {
     const mocks = await this.listMocks();
     const want = String(collectionUid ?? "").trim();
-    const match = mocks.find((m) => m.collection === want);
+    const environment = String(environmentUid ?? "").trim();
+    const mockName = String(name ?? "").trim();
+    const matches = mocks.filter(
+      (mock) => mock.collection === want && mock.environment === environment && mock.name === mockName
+    );
+    const match = this.selectExactMatch(
+      "mock",
+      `workspace ${this.workspaceId}, name "${mockName}", collection ${want}, and environment ${environment || "(none)"}`,
+      matches
+    );
     return match ? { uid: match.uid, mockUrl: match.mockUrl } : null;
   }
   // --- monitors (service: monitors; collection-based = jobTemplates) ---
@@ -127509,32 +127678,51 @@ var PostmanGatewayAssetsClient = class {
   async createMonitor(workspaceId, name, collectionUid, environmentUid, cronSchedule) {
     const ws = workspaceId || this.workspaceId;
     const effectiveCron = cronSchedule && cronSchedule.trim() ? cronSchedule.trim() : "0 0 * * 0";
+    const monitorName = String(name ?? "").trim();
     const collection = String(collectionUid ?? "").trim();
     const environment = String(environmentUid ?? "").trim();
-    const body = {
-      name,
-      collection,
-      options: { strictSSL: false, followRedirects: true, requestTimeout: null, requestDelay: 0 },
-      notifications: { onFailure: [], onError: [] },
-      retry: {},
-      schedule: { cronPattern: effectiveCron, timeZone: "UTC" },
-      distribution: null,
-      ...environment ? { environment } : {}
-    };
-    const response = await retry(
-      () => this.gateway.requestJson({
-        service: "monitors",
-        method: "post",
-        path: `/jobTemplates?workspace=${ws}`,
-        body
-      }),
-      { maxAttempts: 5, delayMs: 2e3, backoffMultiplier: 2, maxDelayMs: 15e3, shouldRetry: (e) => this.isTransient(e) }
-    );
-    const uid = this.idOf(this.dataOf(response));
-    if (!uid) {
-      throw new Error("Monitor create did not return a UID");
-    }
-    return uid;
+    const flightKey = `monitor:${ws}:${collection}:${environment}:${monitorName}`;
+    return this.singleFlight(flightKey, effectiveCron, "monitor", async () => {
+      const existing = await this.findMonitorByCollection(collection, environment, monitorName);
+      if (existing?.uid) {
+        return existing.uid;
+      }
+      const body = {
+        name: monitorName,
+        collection,
+        options: { strictSSL: false, followRedirects: true, requestTimeout: null, requestDelay: 0 },
+        notifications: { onFailure: [], onError: [] },
+        retry: {},
+        schedule: { cronPattern: effectiveCron, timeZone: "UTC" },
+        distribution: null,
+        ...environment ? { environment } : {}
+      };
+      try {
+        const response = await this.gateway.requestJson(
+          {
+            service: "monitors",
+            method: "post",
+            path: `/jobTemplates?workspace=${ws}`,
+            body
+          },
+          { retryTransient: false }
+        );
+        const uid = this.idOf(this.dataOf(response));
+        if (!uid) {
+          throw new Error("Monitor create did not return a UID");
+        }
+        return uid;
+      } catch (error2) {
+        const adopted = await this.discoverAfterAmbiguousCreate(
+          () => this.findMonitorByCollection(collection, environment, monitorName),
+          error2
+        );
+        if (adopted?.uid) {
+          return adopted.uid;
+        }
+        throw error2;
+      }
+    });
   }
   async listMonitors() {
     const response = await this.gateway.requestJson({
@@ -127557,24 +127745,30 @@ var PostmanGatewayAssetsClient = class {
       return false;
     }
   }
-  async findMonitorByCollection(collectionUid) {
+  async findMonitorByCollection(collectionUid, environmentUid, name) {
     const want = String(collectionUid ?? "").trim();
-    const response = await this.gateway.requestJson({
-      service: "monitors",
-      method: "get",
-      path: `/collections/${want}/jobTemplates?_etc=true`
-    });
-    const data = response?.data;
-    const monitors = this.mapJobTemplates(Array.isArray(data) ? data : []);
-    const match = monitors.find((m) => m.collectionUid === want) ?? monitors[0];
+    const environment = String(environmentUid ?? "").trim();
+    const monitorName = String(name ?? "").trim();
+    const monitors = await this.listMonitors();
+    const matches = monitors.filter(
+      (monitor) => monitor.collectionUid === want && monitor.environmentUid === environment && monitor.name === monitorName
+    );
+    const match = this.selectExactMatch(
+      "monitor",
+      `workspace ${this.workspaceId}, name "${monitorName}", collection ${want}, and environment ${environment || "(none)"}`,
+      matches
+    );
     return match?.uid ? { uid: match.uid, name: match.name } : null;
   }
   async runMonitor(uid) {
-    await this.gateway.requestJson({
-      service: "monitors",
-      method: "post",
-      path: `/jobTemplates/${uid}/jobs`
-    });
+    await this.gateway.requestJson(
+      {
+        service: "monitors",
+        method: "post",
+        path: `/jobTemplates/${uid}/jobs`
+      },
+      { retryTransient: false }
+    );
   }
 };
 
@@ -127740,12 +127934,8 @@ async function mintAccessTokenIfNeeded(inputs, log, setSecret2, fetchImpl = fetc
 function isExpiredAuthError(status, body) {
   return status === 401 || body.includes("UNAUTHENTICATED") || body.includes("authenticationError");
 }
-function isTransientGatewayError(status, body) {
-  if (status === 502 || status === 503 || status === 504) return true;
-  if (status >= 500 && (body.includes("ESOCKETTIMEDOUT") || body.includes("ETIMEDOUT") || body.includes("ECONNRESET") || body.includes("serverError") || body.includes("downstream"))) {
-    return true;
-  }
-  return false;
+function isRetryableSafeReadResponse(status) {
+  return status === 408 || status === 429 || status >= 500;
 }
 function defaultSleep(ms) {
   return new Promise((resolve3) => setTimeout(resolve3, ms));
@@ -127804,14 +127994,28 @@ var AccessTokenGatewayClient = class {
   }
   /**
    * Send a gateway request, refreshing the token once on an auth failure and
-   * retrying transient downstream failures (5xx / Bifrost read timeouts) with
-   * exponential backoff. The auth-refresh-once path is independent of the
-   * transient-retry budget.
+   * optionally retrying transient downstream failures (5xx / Bifrost read
+   * timeouts) with exponential backoff. Safe reads keep transient retries;
+   * unsafe creates pass `{ retryTransient: false }` and reconcile after an
+   * ambiguous response instead of re-POSTing. Auth refresh remains independent
+   * of the transient-retry budget.
    */
-  async request(request) {
+  async request(request, options = {}) {
+    const retryTransient = options.retryTransient ?? request.method === "get";
     let attempt = 0;
     for (; ; ) {
-      let response = await this.send(request);
+      let response;
+      try {
+        response = await this.send(request);
+      } catch (error2) {
+        if (retryTransient && attempt < this.maxRetries) {
+          const delay = this.retryBaseDelayMs * 2 ** attempt;
+          attempt += 1;
+          await this.sleepImpl(delay);
+          continue;
+        }
+        throw error2;
+      }
       if (response.ok) {
         return response;
       }
@@ -127825,7 +128029,7 @@ var AccessTokenGatewayClient = class {
         const retryBody = await response.text().catch(() => "");
         throw this.toHttpError(request, response, retryBody);
       }
-      if (isTransientGatewayError(response.status, body) && attempt < this.maxRetries) {
+      if (retryTransient && isRetryableSafeReadResponse(response.status) && attempt < this.maxRetries) {
         const delay = this.retryBaseDelayMs * 2 ** attempt;
         attempt += 1;
         await this.sleepImpl(delay);
@@ -127835,8 +128039,8 @@ var AccessTokenGatewayClient = class {
     }
   }
   /** Send a gateway request and parse the JSON body, or null when empty. */
-  async requestJson(request) {
-    const response = await this.request(request);
+  async requestJson(request, options = {}) {
+    const response = await this.request(request, options);
     const text = await response.text().catch(() => "");
     if (!text.trim()) {
       return null;
@@ -127951,8 +128155,27 @@ function normalizeInputValue(value) {
   return String(value ?? "").trim();
 }
 function getInput2(name, env = process.env) {
-  const envName = `INPUT_${name.replace(/-/g, "_").toUpperCase()}`;
-  return normalizeInputValue(env[envName]);
+  const normalizedName = `INPUT_${name.replace(/-/g, "_").toUpperCase()}`;
+  const runnerName = `INPUT_${name.replace(/ /g, "_").toUpperCase()}`;
+  const normalizedRaw = env[normalizedName];
+  const runnerRaw = runnerName === normalizedName ? void 0 : env[runnerName];
+  const hasNormalized = normalizedRaw !== void 0;
+  const hasRunner = runnerRaw !== void 0;
+  if (hasNormalized && hasRunner) {
+    const normalizedValue = normalizeInputValue(normalizedRaw);
+    const runnerValue = normalizeInputValue(runnerRaw);
+    if (normalizedValue !== runnerValue) {
+      throw new Error(
+        `Conflicting values for ${name}: ${normalizedName}=${JSON.stringify(normalizedValue)} vs ${runnerName}=${JSON.stringify(runnerValue)}`
+      );
+    }
+  }
+  return normalizeInputValue(hasNormalized ? normalizedRaw : runnerRaw);
+}
+function hasInput(name, env = process.env) {
+  const normalizedName = `INPUT_${name.replace(/-/g, "_").toUpperCase()}`;
+  const runnerName = `INPUT_${name.replace(/ /g, "_").toUpperCase()}`;
+  return env[normalizedName] !== void 0 || runnerName !== normalizedName && env[runnerName] !== void 0;
 }
 function parseJsonMap(raw) {
   if (!raw.trim()) return {};
@@ -127982,7 +128205,9 @@ function normalizeRepoWriteMode(value) {
   if (value === "none" || value === "commit-only" || value === "commit-and-push") {
     return value;
   }
-  return "commit-and-push";
+  throw new Error(
+    `Unsupported repo-write-mode "${value}". Allowed values: none, commit-only, commit-and-push`
+  );
 }
 function normalizeCollectionSyncMode(value) {
   if (value === "refresh" || value === "version") {
@@ -128064,7 +128289,7 @@ function resolveInputs(env = process.env) {
     environmentUids,
     envRuntimeUrls,
     artifactDir: getInput2("artifact-dir", env) || "postman",
-    repoWriteMode: normalizeRepoWriteMode(getInput2("repo-write-mode", env) || "commit-and-push"),
+    repoWriteMode: hasInput("repo-write-mode", env) ? normalizeRepoWriteMode(getInput2("repo-write-mode", env)) : "commit-and-push",
     currentRef: getInput2("current-ref", env) || normalizeInputValue(env.GITHUB_REF) || normalizeInputValue(env.BUILD_SOURCEBRANCH),
     githubHeadRef: getInput2("github-head-ref", env) || normalizeInputValue(env.GITHUB_HEAD_REF) || normalizeInputValue(env.SYSTEM_PULLREQUEST_SOURCEBRANCH),
     githubRefName: getInput2("github-ref-name", env) || normalizeInputValue(env.GITHUB_REF_NAME) || normalizeInputValue(repoContext.ref),
@@ -128113,7 +128338,7 @@ function buildEnvironmentValues(envName, baseUrl) {
 var LEGACY_BASELINE_COLLECTION_PREFIX = "[Baseline]";
 function readResourcesState() {
   try {
-    return load((0, import_node_fs2.readFileSync)(".postman/resources.yaml", "utf8"));
+    return load((0, import_node_fs3.readFileSync)(".postman/resources.yaml", "utf8"));
   } catch {
     return null;
   }
@@ -128151,7 +128376,7 @@ function isOpenApiSpecFile(filePath) {
     return false;
   }
   try {
-    const raw = (0, import_node_fs2.readFileSync)(filePath, "utf8");
+    const raw = (0, import_node_fs3.readFileSync)(filePath, "utf8");
     const parsed = filePath.endsWith(".json") ? JSON.parse(raw) : load(raw);
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
       return false;
@@ -128180,7 +128405,7 @@ function scanLocalSpecReferences(baseDir = ".") {
   const found = /* @__PURE__ */ new Set();
   const refs = [];
   const visit2 = (currentDir) => {
-    for (const entry of (0, import_node_fs2.readdirSync)(currentDir, { withFileTypes: true })) {
+    for (const entry of (0, import_node_fs3.readdirSync)(currentDir, { withFileTypes: true })) {
       if (ignoredDirs.has(entry.name)) {
         continue;
       }
@@ -128210,7 +128435,7 @@ function resolveMappedSpecReference(explicitSpecPath, discoveredSpecs) {
   const normalizedExplicitPath = normalizeToPosix(explicitSpecPath.trim());
   if (normalizedExplicitPath) {
     const explicitFullPath = path8.resolve(normalizedExplicitPath);
-    if ((0, import_node_fs2.existsSync)(explicitFullPath) && (0, import_node_fs2.statSync)(explicitFullPath).isFile()) {
+    if ((0, import_node_fs3.existsSync)(explicitFullPath) && (0, import_node_fs3.statSync)(explicitFullPath).isFile()) {
       return {
         repoRelativePath: normalizedExplicitPath,
         configRelativePath: normalizeToPosix(path8.join("..", normalizedExplicitPath))
@@ -128407,25 +128632,35 @@ async function upsertEnvironments(inputs, dependencies, resourcesState) {
   for (const envName of inputs.environments) {
     const runtimeUrl = String(inputs.envRuntimeUrls[envName] || "").trim();
     const values = buildEnvironmentValues(envName, runtimeUrl);
-    const existingUid = envUids[envName];
-    if (existingUid) {
-      await dependencies.postman.updateEnvironment(
-        existingUid,
-        `${inputs.projectName} - ${envName}`,
-        values
+    const displayName = `${inputs.projectName} - ${envName}`;
+    let existingUid = String(envUids[envName] || "").trim();
+    if (!existingUid) {
+      const discovered = await dependencies.postman.findEnvironmentByName(
+        inputs.workspaceId,
+        displayName
       );
+      if (discovered?.uid) {
+        existingUid = discovered.uid;
+        dependencies.core.info(
+          `Discovered existing environment for ${displayName}: ${existingUid}`
+        );
+      }
+    }
+    if (existingUid) {
+      await dependencies.postman.updateEnvironment(existingUid, displayName, values);
+      envUids[envName] = existingUid;
       continue;
     }
     envUids[envName] = await dependencies.postman.createEnvironment(
       inputs.workspaceId,
-      `${inputs.projectName} - ${envName}`,
+      displayName,
       values
     );
   }
   return envUids;
 }
 function ensureDir(path9) {
-  (0, import_node_fs2.mkdirSync)(path9, { recursive: true });
+  (0, import_node_fs3.mkdirSync)(path9, { recursive: true });
 }
 function getCollectionDirectoryName(kind, projectName) {
   if (kind === "Baseline") {
@@ -128462,7 +128697,7 @@ function stripVolatileFields(obj) {
 }
 function writeJsonFile(path9, content, normalize3 = false) {
   const data = normalize3 ? stripVolatileFields(content) : content;
-  (0, import_node_fs2.writeFileSync)(path9, JSON.stringify(data, null, 2));
+  (0, import_node_fs3.writeFileSync)(path9, JSON.stringify(data, null, 2));
 }
 function buildResourcesManifest(workspaceId, collectionMap, envMap, artifactDir, localSpecRefs, mappedSpecRef, specId) {
   const manifest = {
@@ -128536,21 +128771,21 @@ function assertPathWithinCwd(targetPath, fieldName) {
   if (!rawPath || hasControlCharacter2(originalPath) || path8.isAbsolute(rawPath) || path8.win32.isAbsolute(rawPath) || segments.includes("..") || rawPath.startsWith(":") || hasControlCharacter2(rawPath)) {
     throw new Error(`${fieldName} must stay within the repository root; received ${targetPath}`);
   }
-  const base = (0, import_node_fs2.realpathSync)(process.cwd());
+  const base = (0, import_node_fs3.realpathSync)(process.cwd());
   const resolved = path8.resolve(base, rawPath);
   const relative3 = path8.relative(base, resolved);
   if (relative3.startsWith("..") || path8.isAbsolute(relative3)) {
     throw new Error(`${fieldName} must stay within the repository root; received ${targetPath}`);
   }
   let existingPath = resolved;
-  while (!(0, import_node_fs2.existsSync)(existingPath)) {
+  while (!(0, import_node_fs3.existsSync)(existingPath)) {
     const parent = path8.dirname(existingPath);
     if (parent === existingPath) {
       break;
     }
     existingPath = parent;
   }
-  const realExistingPath = (0, import_node_fs2.realpathSync)(existingPath);
+  const realExistingPath = (0, import_node_fs3.realpathSync)(existingPath);
   const realRelative = path8.relative(base, realExistingPath);
   if (realRelative.startsWith("..") || path8.isAbsolute(realRelative)) {
     throw new Error(`${fieldName} must stay within the repository root; received ${targetPath}`);
@@ -128578,8 +128813,8 @@ async function exportArtifacts(inputs, dependencies, envUids, assetProjectName)
   ensureDir(specsDir);
   ensureDir(".postman");
   const globalsFilePath = `${globalsDir}/workspace.globals.yaml`;
-  if (!(0, import_node_fs2.existsSync)(globalsFilePath)) {
-    (0, import_node_fs2.writeFileSync)(globalsFilePath, "name: Globals\nvalues: []\n");
+  if (!(0, import_node_fs3.existsSync)(globalsFilePath)) {
+    (0, import_node_fs3.writeFileSync)(globalsFilePath, "name: Globals\nvalues: []\n");
   }
   if (inputs.generateCiWorkflow) {
     const ciDir = inputs.ciWorkflowPath.split("/").slice(0, -1).join("/");
@@ -128615,7 +128850,7 @@ async function exportArtifacts(inputs, dependencies, envUids, assetProjectName)
       true
     );
   }
-  (0, import_node_fs2.writeFileSync)(".postman/resources.yaml", buildResourcesManifest(
+  (0, import_node_fs3.writeFileSync)(".postman/resources.yaml", buildResourcesManifest(
     inputs.workspaceId,
     manifestCollections,
     envUids,
@@ -128625,7 +128860,7 @@ async function exportArtifacts(inputs, dependencies, envUids, assetProjectName)
     inputs.specId || void 0
   ));
   if (mappedSpec && Object.keys(manifestCollections).length > 0) {
-    (0, import_node_fs2.writeFileSync)(
+    (0, import_node_fs3.writeFileSync)(
       ".postman/workflows.yaml",
       buildSpecCollectionWorkflowManifest(
         mappedSpec.configRelativePath,
@@ -128662,29 +128897,27 @@ function createRepoSummary(outputs, envUids, pushed) {
   });
 }
 async function commitAndPushGeneratedFiles(inputs, dependencies) {
-  if (!dependencies.repoMutation || inputs.repoWriteMode === "none") {
-    return { commitSha: "", resolvedCurrentRef: "", pushed: false };
-  }
   if (inputs.generateCiWorkflow) {
+    assertPathWithinCwd(inputs.ciWorkflowPath, "ci-workflow-path");
     const ciWorkflow = renderCiWorkflow(inputs);
     const parts = inputs.ciWorkflowPath.split("/");
     if (parts.length > 1) {
       const dir = parts.slice(0, -1).join("/");
       ensureDir(dir);
     }
-    (0, import_node_fs2.writeFileSync)(inputs.ciWorkflowPath, ciWorkflow);
+    (0, import_node_fs3.writeFileSync)(inputs.ciWorkflowPath, ciWorkflow);
   }
-  const provisionPath = ".github/workflows/provision.yml";
-  const provisionExists = inputs.provider === "github" && (0, import_node_fs2.existsSync)(provisionPath);
-  if (provisionExists) {
-    (0, import_node_fs2.rmSync)(provisionPath);
+  if (!dependencies.repoMutation || inputs.repoWriteMode === "none") {
+    return { commitSha: "", resolvedCurrentRef: "", pushed: false };
   }
+  const provisionPath = ".github/workflows/provision.yml";
+  const provisionExists = inputs.provider === "github" && (0, import_node_fs3.existsSync)(provisionPath);
   const stagePaths = [
     inputs.artifactDir,
     ".postman",
     inputs.generateCiWorkflow ? inputs.ciWorkflowPath : null,
     provisionExists ? provisionPath : null
-  ].filter((entry) => typeof entry === "string" && ((0, import_node_fs2.existsSync)(entry) || entry === provisionPath));
+  ].filter((entry) => typeof entry === "string" && ((0, import_node_fs3.existsSync)(entry) || entry === provisionPath));
   if (stagePaths.length === 0) {
     dependencies.core.info("No generated repository paths were found; skipping repo mutation.");
     return {
@@ -128708,6 +128941,7 @@ async function commitAndPushGeneratedFiles(inputs, dependencies) {
     adoToken: inputs.provider === "azure-devops" ? inputs.adoToken : void 0,
     githubToken: inputs.provider === "azure-devops" ? void 0 : inputs.githubToken,
     fallbackToken: inputs.provider === "azure-devops" ? void 0 : inputs.ghFallbackToken,
+    removePaths: provisionExists ? [provisionPath] : [],
     stagePaths
   });
   return {
@@ -128790,12 +129024,17 @@ async function runRepoSyncInner(inputs, dependencies) {
     const mockEnvUid = envUids.dev || envUids.prod || Object.values(envUids)[0];
     if (mockEnvUid) {
       let resolvedMockUrl = "";
+      const mockName = `${assetProjectName} Mock`;
       if (inputs.mockUrl) {
         resolvedMockUrl = inputs.mockUrl;
         dependencies.core.info(`Reusing mock from explicit input: ${resolvedMockUrl}`);
       }
       if (!resolvedMockUrl && inputs.baselineCollectionId) {
-        const discovered = await dependencies.postman.findMockByCollection(inputs.baselineCollectionId);
+        const discovered = await dependencies.postman.findMockByCollection(
+          inputs.baselineCollectionId,
+          mockEnvUid,
+          mockName
+        );
         if (discovered) {
           resolvedMockUrl = discovered.mockUrl;
           dependencies.core.info(`Discovered existing mock for collection ${inputs.baselineCollectionId}: ${resolvedMockUrl}`);
@@ -128804,7 +129043,7 @@ async function runRepoSyncInner(inputs, dependencies) {
       if (!resolvedMockUrl) {
         const mock = await dependencies.postman.createMock(
           inputs.workspaceId,
-          `${assetProjectName} Mock`,
+          mockName,
           inputs.baselineCollectionId,
           mockEnvUid
         );
@@ -128819,6 +129058,7 @@ async function runRepoSyncInner(inputs, dependencies) {
     const effectiveCron = inputs.monitorCron && inputs.monitorCron.trim() ? inputs.monitorCron.trim() : "";
     if (monitorEnvUid && inputs.monitorType !== "cli") {
       let resolvedMonitorId = "";
+      const monitorName = `${assetProjectName} - Smoke Monitor`;
       if (inputs.monitorId) {
         const valid = await dependencies.postman.monitorExists(inputs.monitorId);
         if (valid) {
@@ -128829,7 +129069,11 @@ async function runRepoSyncInner(inputs, dependencies) {
         }
       }
       if (!resolvedMonitorId && inputs.smokeCollectionId) {
-        const discovered = await dependencies.postman.findMonitorByCollection(inputs.smokeCollectionId);
+        const discovered = await dependencies.postman.findMonitorByCollection(
+          inputs.smokeCollectionId,
+          monitorEnvUid,
+          monitorName
+        );
         if (discovered) {
           resolvedMonitorId = discovered.uid;
           dependencies.core.info(`Discovered existing monitor for collection ${inputs.smokeCollectionId}: ${resolvedMonitorId}`);
@@ -128838,7 +129082,7 @@ async function runRepoSyncInner(inputs, dependencies) {
       if (!resolvedMonitorId) {
         resolvedMonitorId = await dependencies.postman.createMonitor(
           inputs.workspaceId,
-          `${assetProjectName} - Smoke Monitor`,
+          monitorName,
           inputs.smokeCollectionId,
           monitorEnvUid,
           effectiveCron || void 0
@@ -129051,6 +129295,7 @@ function createRepoSyncDependencies(inputs, resolved, factories, options = {}) {
     createEnvironment: gatewayAssets.createEnvironment.bind(gatewayAssets),
     getEnvironment: gatewayAssets.getEnvironment.bind(gatewayAssets),
     updateEnvironment: gatewayAssets.updateEnvironment.bind(gatewayAssets),
+    findEnvironmentByName: gatewayAssets.findEnvironmentByName.bind(gatewayAssets),
     // Collection read via the v3 export endpoint — returns canonical v3 IR,
     // written to disk by `convertAndSplitAnyCollection`. PMAK is never used for
     // collection reads.