@postman-cse/onboarding-repo-sync 2.1.10 → 2.1.13

package/dist/cli.cjs

@@ -19747,7 +19747,7 @@ var require_response = __commonJS({
     var assert = require("node:assert");
     var { isomorphicEncode, serializeJavascriptValueToJSONString } = require_infra();
     var textEncoder = new TextEncoder("utf-8");
-    var Response = class _Response {
+    var Response2 = class _Response {
       /** @type {Headers} */
       #headers;
       #state;
@@ -19917,13 +19917,13 @@ var require_response = __commonJS({
         response.#state = newState;
       }
     };
-    var { getResponseHeaders, setResponseHeaders, getResponseState, setResponseState } = Response;
-    Reflect.deleteProperty(Response, "getResponseHeaders");
-    Reflect.deleteProperty(Response, "setResponseHeaders");
-    Reflect.deleteProperty(Response, "getResponseState");
-    Reflect.deleteProperty(Response, "setResponseState");
-    mixinBody(Response, getResponseState);
-    Object.defineProperties(Response.prototype, {
+    var { getResponseHeaders, setResponseHeaders, getResponseState, setResponseState } = Response2;
+    Reflect.deleteProperty(Response2, "getResponseHeaders");
+    Reflect.deleteProperty(Response2, "setResponseHeaders");
+    Reflect.deleteProperty(Response2, "getResponseState");
+    Reflect.deleteProperty(Response2, "setResponseState");
+    mixinBody(Response2, getResponseState);
+    Object.defineProperties(Response2.prototype, {
       type: kEnumerableProperty,
       url: kEnumerableProperty,
       status: kEnumerableProperty,
@@ -19939,7 +19939,7 @@ var require_response = __commonJS({
         configurable: true
       }
     });
-    Object.defineProperties(Response, {
+    Object.defineProperties(Response2, {
       json: kEnumerableProperty,
       redirect: kEnumerableProperty,
       error: kEnumerableProperty
@@ -20072,7 +20072,7 @@ var require_response = __commonJS({
       }
     }
     function fromInnerResponse(innerResponse, guard) {
-      const response = new Response(kConstruct);
+      const response = new Response2(kConstruct);
       setResponseState(response, innerResponse);
       const headers = new Headers3(kConstruct);
       setResponseHeaders(response, headers);
@@ -20126,14 +20126,14 @@ var require_response = __commonJS({
         converter: webidl.converters.HeadersInit
       }
     ]);
-    webidl.is.Response = webidl.util.MakeTypeAssertion(Response);
+    webidl.is.Response = webidl.util.MakeTypeAssertion(Response2);
     module2.exports = {
       isNetworkError,
       makeNetworkError,
       makeResponse,
       makeAppropriateNetworkError,
       filterResponse,
-      Response,
+      Response: Response2,
       cloneResponse,
       fromInnerResponse,
       getResponseState
@@ -99441,7 +99441,7 @@ var require_response2 = __commonJS({
       }
       return stream;
     };
-    var Response;
+    var Response2;
     _.inherit(
       /**
        * Response holds data related to the request body. By default, it provides a nice wrapper for url-encoded,
@@ -99452,14 +99452,14 @@ var require_response2 = __commonJS({
        *
        * @param {Response.definition} options -
        */
-      Response = function PostmanResponse(options) {
-        Response.super_.apply(this, arguments);
+      Response2 = function PostmanResponse(options) {
+        Response2.super_.apply(this, arguments);
         this.update(options || {});
       },
       Property
     );
     _.assign(
-      Response.prototype,
+      Response2.prototype,
       /** @lends Response.prototype */
       {
         update(options) {
@@ -99525,7 +99525,7 @@ var require_response2 = __commonJS({
       }
     );
     _.assign(
-      Response.prototype,
+      Response2.prototype,
       /** @lends Response.prototype */
       {
         /**
@@ -99703,7 +99703,7 @@ var require_response2 = __commonJS({
       }
     );
     _.assign(
-      Response,
+      Response2,
       /** @lends Response */
       {
         /**
@@ -99721,7 +99721,7 @@ var require_response2 = __commonJS({
          * @returns {Boolean}
          */
         isResponse: function(obj) {
-          return Boolean(obj) && (obj instanceof Response || _.inSuperChain(obj.constructor, "_postman_propertyName", Response._postman_propertyName));
+          return Boolean(obj) && (obj instanceof Response2 || _.inSuperChain(obj.constructor, "_postman_propertyName", Response2._postman_propertyName));
         },
         /**
          * Converts the response object from the request module to the postman responseBody format
@@ -99732,7 +99732,7 @@ var require_response2 = __commonJS({
          * @todo Add a key: `originalRequest` to the returned object as well, referring to response.request
          */
         createFromNode: function(response, cookies) {
-          return new Response({
+          return new Response2({
             cookie: cookies,
             body: response.body.toString(),
             stream: response.body,
@@ -99811,7 +99811,7 @@ var require_response2 = __commonJS({
       }
     );
     module2.exports = {
-      Response
+      Response: Response2
     };
   }
 });
@@ -99825,7 +99825,7 @@ var require_item = __commonJS({
     var EventList = require_event_list().EventList;
     var Request = require_request13().Request;
     var RequestAuth = require_request_auth().RequestAuth;
-    var Response = require_response2().Response;
+    var Response2 = require_response2().Response;
     var Item;
     var OBJECT = "object";
     var STRING = "string";
@@ -99892,7 +99892,7 @@ var require_item = __commonJS({
              *
              * @type {PropertyList<Response>}
              */
-            responses: new PropertyList(Response, this, definition && definition.response),
+            responses: new PropertyList(Response2, this, definition && definition.response),
             /**
              * Events are a set of of {@link Script}s that are executed when certain activities are triggered on an
              * Item. For example, on defining an event that listens to the "test" event, would cause the associated
@@ -133661,6 +133661,54 @@ var HttpError = class _HttpError extends Error {
   }
 };
 
+// src/lib/postman/pmak-diagnostics.ts
+var memo = /* @__PURE__ */ new Map();
+var normalize3 = (value) => new URL(value.trim()).toString().replace(/\/+$/, "");
+function maskPmakDiagnostic(message, secrets) {
+  let masked = String(message);
+  for (const secret of secrets) if (secret) masked = masked.split(secret).join("***");
+  return Array.from(masked, (character) => {
+    const code = character.codePointAt(0) ?? 0;
+    return code <= 31 || code >= 127 && code <= 159 ? " " : character;
+  }).join("").replace(/\s+/g, " ").trim();
+}
+function formatRejectedMint(original, result) {
+  const teamId = typeof result.payload?.user?.teamId === "number" ? ` (team ${(result.payload?.user).teamId})` : "";
+  if (result.kind === "personal") return `Personal API key detected, cannot mint a service-account access token${teamId}.`;
+  if (result.kind === "service-account") return `The postman-api-key authenticates (GET /me OK) but was rejected by POST /service-account-tokens${teamId} and lacks permission to mint access tokens.`;
+  if (result.kind === "invalid") return "The postman-api-key is invalid, disabled, or expired.";
+  return original;
+}
+async function inspectPmakIdentity(options) {
+  const apiBaseUrl = normalize3(options.apiBaseUrl);
+  const key = `${apiBaseUrl}\0${options.apiKey}`;
+  let pending = memo.get(key);
+  if (!pending) {
+    pending = (async () => {
+      try {
+        const timeout = AbortSignal.timeout(options.timeoutMs ?? 2e3);
+        const signal = options.signal ? AbortSignal.any([options.signal, timeout]) : timeout;
+        const response = await (options.fetchImpl ?? fetch)(`${apiBaseUrl}/me`, { method: "GET", headers: { "X-Api-Key": options.apiKey }, signal });
+        if (response.status === 401 || response.status === 403) return { kind: "invalid", status: response.status };
+        if (!response.ok) return { kind: "inconclusive", status: response.status };
+        const payload = await response.json().catch(() => void 0);
+        const user = payload?.user;
+        if (!user || typeof user !== "object" || Array.isArray(user)) return { kind: "inconclusive", payload };
+        const record = user;
+        if (typeof record.username === "string" && record.username || typeof record.email === "string" && record.email) return { kind: "personal", status: response.status, payload };
+        if ("username" in record && "email" in record && (record.username == null || record.username === "") && (record.email == null || record.email === "")) return { kind: "service-account", status: response.status, payload };
+        return { kind: "inconclusive", payload };
+      } catch {
+        return { kind: "inconclusive" };
+      }
+    })();
+    memo.set(key, pending);
+  }
+  const result = await pending;
+  if (options.mode === "preflight" && result.kind === "inconclusive") memo.delete(key);
+  return result;
+}
+
 // src/lib/postman/credential-identity.ts
 var sessionPath = "/api/sessions/current";
 var SESSION_MAX_ATTEMPTS = 3;
@@ -133754,14 +133802,8 @@ async function resolvePmakIdentity(opts) {
 }
 async function probePmakIdentity(baseUrl, apiKey, fetchImpl) {
   try {
-    const response = await fetchImpl(`${baseUrl}/me`, {
-      method: "GET",
-      headers: { "X-Api-Key": apiKey }
-    });
-    if (!response.ok) {
-      return void 0;
-    }
-    const payload = asRecord(await response.json());
+    const diagnostic = await inspectPmakIdentity({ apiBaseUrl: baseUrl, apiKey, fetchImpl });
+    const payload = asRecord(diagnostic.payload);
     const user = asRecord(payload?.user);
     if (!user) {
       return void 0;
@@ -134063,6 +134105,39 @@ function adviseFromHttpError(err, ctx) {
   return new Error(ctx.mask(advice), { cause: err });
 }
 
+// src/lib/postman/app-version.ts
+var UPDATE_URL = "https://dl.pstmn.io/update/status?currentVersion=12.0.0&platform=osx_arm64";
+var FLOOR_VERSION = "12.0.0";
+var VERSION_PATTERN = /^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+var PostmanAppVersionProvider = class {
+  fetchImpl;
+  requestTimeoutMs;
+  pending;
+  constructor(options = {}) {
+    this.fetchImpl = options.fetchImpl ?? fetch;
+    this.requestTimeoutMs = options.requestTimeoutMs ?? 2e3;
+  }
+  async get() {
+    if (process.env.POSTMAN_GATEWAY_APP_VERSION === "off") return void 0;
+    this.pending ??= this.resolve();
+    return this.pending;
+  }
+  async resolve() {
+    try {
+      const response = await this.fetchImpl(UPDATE_URL, {
+        signal: AbortSignal.timeout(this.requestTimeoutMs)
+      });
+      if (!response.ok) return FLOOR_VERSION;
+      const payload = await response.json();
+      const version = typeof payload.version === "string" ? payload.version : "";
+      return VERSION_PATTERN.test(version) ? version : FLOOR_VERSION;
+    } catch {
+      return FLOOR_VERSION;
+    }
+  }
+};
+var defaultPostmanAppVersionProvider = new PostmanAppVersionProvider();
+
 // src/lib/postman/internal-integration-adapter.ts
 function extractDuplicateWorkspaceId(body) {
   try {
@@ -134082,6 +134157,8 @@ var BifrostInternalIntegrationAdapter = class {
   secretMasker;
   teamId;
   workerBaseUrl;
+  gateway;
+  appVersionProvider;
   constructor(options) {
     this.accessToken = String(options.accessToken || "").trim();
     this.getAccessToken = options.getAccessToken;
@@ -134094,6 +134171,8 @@ var BifrostInternalIntegrationAdapter = class {
     this.workerBaseUrl = String(
       options.workerBaseUrl || "https://catalog-admin.postman-account2009.workers.dev"
     ).replace(/\/+$/, "");
+    this.gateway = options.gateway;
+    this.appVersionProvider = options.appVersionProvider ?? defaultPostmanAppVersionProvider;
     this.secretMasker = options.secretMasker ?? createSecretMasker([this.accessToken]);
   }
   /** Live access token: re-minted value when a provider accessor is wired, else the captured one. */
@@ -134101,7 +134180,7 @@ var BifrostInternalIntegrationAdapter = class {
     return this.getAccessToken ? String(this.getAccessToken() || "").trim() : this.accessToken;
   }
   /** Build Bifrost proxy headers. Only includes x-entity-team-id for org-mode teams. */
-  bifrostHeaders() {
+  async bifrostHeaders() {
     const headers = {
       "Content-Type": "application/json",
       "x-access-token": this.currentToken()
@@ -134109,6 +134188,8 @@ var BifrostInternalIntegrationAdapter = class {
     if (this.teamId && this.orgMode) {
       headers["x-entity-team-id"] = this.teamId;
     }
+    const appVersion = await this.appVersionProvider.get();
+    if (appVersion) headers["x-app-version"] = appVersion;
     return headers;
   }
   /** Reactive error-advice context, enriched with the preflight session memo when present. */
@@ -134139,6 +134220,58 @@ var BifrostInternalIntegrationAdapter = class {
     if (associations.length === 0) {
       return;
     }
+    const mode = process.env.POSTMAN_SYSTEM_ENV_ASSOCIATION_MODE ?? "direct";
+    if (mode !== "direct" && mode !== "worker") {
+      throw new Error("POSTMAN_SYSTEM_ENV_ASSOCIATION_MODE must be direct or worker");
+    }
+    if (mode === "direct") {
+      if (!this.gateway) {
+        throw new Error("Direct system-environment association requires the access-token gateway");
+      }
+      const groups = /* @__PURE__ */ new Map();
+      for (const association of associations) {
+        const systemEnvId = String(association.systemEnvId || "").trim();
+        const uid = String(association.envUid || "").trim();
+        if (!systemEnvId || !uid) continue;
+        const key = `${systemEnvId}\0${workspaceId}`;
+        const uids = groups.get(key) ?? /* @__PURE__ */ new Set();
+        uids.add(uid);
+        groups.set(key, uids);
+      }
+      for (const [key, uids] of [...groups.entries()].sort(([a], [b]) => a.localeCompare(b))) {
+        const [systemEnvironmentId, groupedWorkspaceId] = key.split("\0");
+        const postmanEnvironmentIds = [...uids].sort();
+        let response2;
+        try {
+          response2 = await this.gateway.requestJson({
+            service: "api-catalog",
+            method: "post",
+            path: "/api/system-envs/associations",
+            body: {
+              systemEnvironmentId,
+              workspaceEntries: [{ workspaceId: groupedWorkspaceId, postmanEnvironmentIds }]
+            },
+            fallback: "none"
+          }, { retryTransient: true });
+        } catch (error) {
+          if (error instanceof HttpError) {
+            throw adviseFromHttpError(error, this.adviceContext("system environment association")) ?? error;
+          }
+          throw error;
+        }
+        if (!response2 || response2.success !== true) {
+          throw new Error("SYSTEM_ENV_ASSOCIATION_INCOMPLETE");
+        }
+        if (response2.data !== void 0) {
+          if (!Array.isArray(response2.data)) throw new Error("SYSTEM_ENV_ASSOCIATION_INCOMPLETE");
+          const seen = new Set(response2.data.filter((row) => !!row && typeof row === "object").map((row) => `${row.systemEnvironmentId}\0${row.workspaceId}\0${row.postmanEnvironmentId}`));
+          if (!postmanEnvironmentIds.every((uid) => seen.has(`${systemEnvironmentId}\0${groupedWorkspaceId}\0${uid}`))) {
+            throw new Error("SYSTEM_ENV_ASSOCIATION_INCOMPLETE");
+          }
+        }
+      }
+      return;
+    }
     const token = this.currentToken();
     const response = await this.fetchImpl(
       `${this.workerBaseUrl}/api/internal/system-envs/associate`,
@@ -134196,7 +134329,7 @@ var BifrostInternalIntegrationAdapter = class {
     try {
       const response = await this.fetchImpl(url, {
         method: "POST",
-        headers: this.bifrostHeaders(),
+        headers: await this.bifrostHeaders(),
         body: JSON.stringify(payload)
       });
       let parsed = {};
@@ -134285,7 +134418,7 @@ var BifrostInternalIntegrationAdapter = class {
         versionControl: true
       }
     };
-    const headers = this.bifrostHeaders();
+    const headers = await this.bifrostHeaders();
     const response = await this.fetchImpl(url, {
       method: "POST",
       headers,
@@ -134340,7 +134473,7 @@ var BifrostInternalIntegrationAdapter = class {
     try {
       const response = await this.fetchImpl(`${this.bifrostBaseUrl}/ws/proxy`, {
         method: "POST",
-        headers: this.bifrostHeaders(),
+        headers: await this.bifrostHeaders(),
         body: JSON.stringify({
           service: "workspaces",
           method: "GET",
@@ -134371,7 +134504,7 @@ var BifrostInternalIntegrationAdapter = class {
   }
   async createApiKey(name) {
     const url = `${this.bifrostBaseUrl}/ws/proxy`;
-    const headers = this.bifrostHeaders();
+    const headers = await this.bifrostHeaders();
     const payload = {
       service: "identity",
       method: "POST",
@@ -134456,6 +134589,16 @@ async function retry(operation, options = {}) {
   }
   throw new Error("Retry exhausted without returning or throwing");
 }
+function fullJitterDelayMs(attempt, baseMs, capMs, random = Math.random) {
+  return Math.floor(random() * Math.max(0, Math.min(capMs, baseMs * 2 ** Math.max(0, attempt))));
+}
+function parseRetryAfterMs2(value) {
+  const trimmed = value?.trim();
+  if (!trimmed) return void 0;
+  if (/^\d+$/.test(trimmed)) return Number(trimmed) * 1e3;
+  const time = Date.parse(trimmed);
+  return Number.isNaN(time) ? void 0 : Math.max(0, time - Date.now());
+}
 
 // src/contracts.ts
 var postmanRepoSyncActionContract = {
@@ -134885,6 +135028,17 @@ var PostmanGatewayAssetsClient = class {
     return data.map((entry) => this.asRecord(entry)).filter((entry) => entry !== null).map((entry) => ({ uid: String(entry.id ?? entry.uid ?? "").trim(), name: String(entry.name ?? "").trim() })).filter((entry) => entry.uid && entry.name);
   }
   async getSpecContent(specId) {
+    if (process.env.POSTMAN_SPEC_TREE_FAST_PATH !== "off") {
+      try {
+        const treeContent = await this.getSpecContentFromTree(specId);
+        if (treeContent !== void 0) return treeContent;
+      } catch (error) {
+        if (!(error instanceof HttpError) || ![403, 404, 405, 501].includes(error.status)) throw error;
+      }
+    }
+    return this.getSpecContentLegacy(specId);
+  }
+  async getSpecContentLegacy(specId) {
     const files = await this.gateway.requestJson({
       service: "specification",
       method: "get",
@@ -134903,6 +135057,46 @@ var PostmanGatewayAssetsClient = class {
     const record = this.dataOf(file);
     return typeof record?.content === "string" ? record.content : void 0;
   }
+  /** Minimal `/tree` reader: validate the entire returned inventory before selecting ROOT. */
+  async getSpecContentFromTree(specId) {
+    const rows = [];
+    const cursors = /* @__PURE__ */ new Set();
+    let cursor;
+    for (let page = 0; page < 100; page += 1) {
+      const response = await this.gateway.requestJson({
+        service: "specification",
+        method: "get",
+        path: `/specifications/${specId}/tree`,
+        query: { fields: "id,name,type,path,parentId,fileType,content", limit: 100, ...cursor ? { cursor } : {} }
+      });
+      if (!Array.isArray(response?.data)) return void 0;
+      for (const value of response.data) {
+        const row = this.asRecord(value);
+        if (!row || row.type === "FOLDER") continue;
+        if (row.type !== "FILE" || typeof row.id !== "string" || !row.id.trim() || typeof row.path !== "string" || !row.path.trim() || typeof row.content !== "string" || typeof row.fileType !== "string" || !row.fileType.trim()) return void 0;
+        const path5 = row.path.replace(/\\/g, "/").normalize("NFC");
+        if (path5.startsWith("/") || path5.split("/").some((part) => part === ".." || !part)) throw new Error("CONTRACT_DEFINITION_PATH_INVALID");
+        rows.push({ ...row, path: path5 });
+      }
+      const meta = this.asRecord(response?.meta);
+      const cursorValue = this.asRecord(meta?.cursor)?.next;
+      const next = typeof cursorValue === "string" && cursorValue.trim() ? cursorValue.trim() : void 0;
+      if (!next) break;
+      if (cursors.has(next)) throw new Error("SPEC_TREE_CURSOR_REPEATED");
+      cursors.add(next);
+      if (page === 99) throw new Error("SPEC_TREE_PAGE_LIMIT_EXCEEDED");
+      cursor = next;
+    }
+    const paths = /* @__PURE__ */ new Set();
+    for (const row of rows) {
+      const path5 = String(row.path).toLocaleLowerCase();
+      if (paths.has(path5)) throw new Error("CONTRACT_DEFINITION_DUPLICATE_PATH");
+      paths.add(path5);
+    }
+    const roots = rows.filter((row) => row.fileType === "ROOT");
+    if (roots.length !== 1) throw new Error("CONTRACT_DEFINITION_INVENTORY_INVALID");
+    return String(roots[0]?.content);
+  }
   async listSpecCollections(specId) {
     const response = await this.gateway.requestJson({
       service: "specification",
@@ -135462,10 +135656,12 @@ var PostmanGatewayAssetsClient = class {
 // src/lib/postman/token-provider.ts
 var MintError = class extends Error {
   permanent;
-  constructor(message, permanent) {
+  status;
+  constructor(message, permanent, status) {
     super(message);
     this.name = "MintError";
     this.permanent = permanent;
+    this.status = status;
   }
 };
 function extractAccessToken(payload) {
@@ -135545,7 +135741,8 @@ var AccessTokenProvider = class {
       if (status === 401 || status === 403) {
         throw new MintError(
           `postman: re-mint failed because the postman-api-key was rejected (PMAK rejected, HTTP ${status}); confirm it is a valid, enabled service-account PMAK for the intended team.`,
-          true
+          true,
+          status
         );
       }
       if (status === 400 && body.toLowerCase().includes("service accounts not enabled")) {
@@ -135570,26 +135767,9 @@ var AccessTokenProvider = class {
   }
 };
 async function describeMintFailure(mintError, apiKey, apiBaseUrl, fetchImpl) {
-  const raw = mintError instanceof Error ? mintError.message : String(mintError);
-  const rejected = /HTTP 40[13]|PMAK rejected/.test(raw);
-  if (!rejected) {
-    return raw;
-  }
-  try {
-    const me = await fetchImpl(`${apiBaseUrl}/me`, { headers: { "x-api-key": apiKey } });
-    if (me.ok) {
-      const body = await me.json().catch(() => void 0);
-      const user = body?.user;
-      const looksPersonal = Boolean(user && (user.username || user.email));
-      if (looksPersonal) {
-        return "Personal API key detected, cannot mint a service-account access token. POST /service-account-tokens only accepts a SERVICE-ACCOUNT API key; this postman-api-key belongs to a user account" + (user?.teamId ? ` (team ${user.teamId})` : "") + ". Create a service account in Team Settings and use its PMAK, or mint the token elsewhere and pass postman-access-token.";
-      }
-      return "The postman-api-key authenticates (GET /me OK) but was rejected by POST /service-account-tokens" + (user?.teamId ? ` (team ${user.teamId})` : "") + ". The service account likely lacks permission to mint access tokens, or service accounts are restricted for this team. Check the service account role in Team Settings, or pass a pre-minted postman-access-token.";
-    }
-    return "The postman-api-key is invalid, disabled, or expired (rejected by both POST /service-account-tokens and GET /me). Generate a fresh service-account PMAK in Team Settings and update the secret.";
-  } catch {
-    return raw;
-  }
+  const raw = maskPmakDiagnostic(mintError instanceof Error ? mintError.message : String(mintError), [apiKey]);
+  if (!(mintError instanceof MintError) || mintError.status !== 401 && mintError.status !== 403) return raw;
+  return formatRejectedMint(raw, await inspectPmakIdentity({ apiBaseUrl, apiKey, fetchImpl }));
 }
 async function mintAccessTokenIfNeeded(inputs, log, setSecret2, fetchImpl = fetch) {
   if (inputs.postmanAccessToken || !inputs.postmanApiKey) {
@@ -135638,6 +135818,10 @@ var AccessTokenGatewayClient = class {
   fallbackBaseUrl;
   retryBaseDelayMs;
   sleepImpl;
+  appVersionProvider;
+  requestTimeoutMs;
+  retryMaxDelayMs;
+  randomImpl;
   constructor(options) {
     this.tokenProvider = options.tokenProvider;
     this.bifrostBaseUrl = String(
@@ -135652,16 +135836,22 @@ var AccessTokenGatewayClient = class {
     this.fallbackBaseUrl = fallbackEnv === "off" ? void 0 : options.fallbackBaseUrl?.replace(/\/+$/, "");
     this.retryBaseDelayMs = options.retryBaseDelayMs ?? 400;
     this.sleepImpl = options.sleepImpl ?? defaultSleep;
+    this.appVersionProvider = options.appVersionProvider ?? defaultPostmanAppVersionProvider;
+    this.requestTimeoutMs = options.requestTimeoutMs ?? 3e4;
+    this.retryMaxDelayMs = options.retryMaxDelayMs ?? 5e3;
+    this.randomImpl = options.randomImpl ?? Math.random;
   }
   configureTeamContext(teamId, orgMode) {
     this.teamId = String(teamId || "").trim();
     this.orgMode = orgMode;
   }
-  buildHeaders(extra) {
+  async buildHeaders(extra) {
+    const appVersion = await this.appVersionProvider.get();
     const headers = {
       "Content-Type": "application/json",
       "x-access-token": this.tokenProvider.current(),
-      ...extra || {}
+      ...extra || {},
+      ...appVersion ? { "x-app-version": appVersion } : {}
     };
     if (this.teamId && this.orgMode) {
       headers["x-entity-team-id"] = this.teamId;
@@ -135670,17 +135860,24 @@ var AccessTokenGatewayClient = class {
   }
   async send(request, baseUrl) {
     const url = `${baseUrl ?? this.bifrostBaseUrl}/ws/proxy`;
-    return this.fetchImpl(url, {
-      method: "POST",
-      headers: this.buildHeaders(request.headers),
-      body: JSON.stringify({
-        service: request.service,
-        method: request.method,
-        path: request.path,
-        ...request.query !== void 0 ? { query: request.query } : {},
-        ...request.body !== void 0 ? { body: request.body } : {}
-      })
-    });
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.requestTimeoutMs);
+    try {
+      return await this.fetchImpl(url, {
+        method: "POST",
+        headers: await this.buildHeaders(request.headers),
+        signal: controller.signal,
+        body: JSON.stringify({
+          service: request.service,
+          method: request.method,
+          path: request.path,
+          ...request.query !== void 0 ? { query: request.query } : {},
+          ...request.body !== void 0 ? { body: request.body } : {}
+        })
+      });
+    } finally {
+      clearTimeout(timer);
+    }
   }
   /**
    * One cold, serial attempt against the fallback base URL after the primary
@@ -135707,6 +135904,7 @@ var AccessTokenGatewayClient = class {
    * they are the freshest authoritative answer.
    */
   fallbackEligible(request, retryTransient) {
+    if (request.fallback === "none") return false;
     if (!this.fallbackBaseUrl) return false;
     return retryTransient || request.fallback === "auto";
   }
@@ -135736,7 +135934,7 @@ var AccessTokenGatewayClient = class {
         response = await this.send(request);
       } catch (error) {
         if (retryTransient && attempt < this.maxRetries) {
-          const delay = this.retryBaseDelayMs * 2 ** attempt;
+          const delay = this.retryDelayMs(attempt);
           attempt += 1;
           await this.sleepImpl(delay);
           continue;
@@ -135746,7 +135944,17 @@ var AccessTokenGatewayClient = class {
         throw error;
       }
       if (response.ok) {
-        return response;
+        const okBody = await response.text().catch(() => "");
+        const inner = this.innerStatus(okBody);
+        if (inner !== void 0) {
+          if (retryTransient && this.isTransient(inner, okBody) && attempt < this.maxRetries) {
+            await this.sleepImpl(this.retryDelayMs(attempt));
+            attempt += 1;
+            continue;
+          }
+          throw this.toInnerHttpError(request, inner, okBody);
+        }
+        return this.rebuildResponse(response, okBody);
       }
       const body = await response.text().catch(() => "");
       if (isExpiredAuthError(response.status, body) && this.tokenProvider.canRefresh()) {
@@ -135758,8 +135966,8 @@ var AccessTokenGatewayClient = class {
         const retryBody = await response.text().catch(() => "");
         throw this.toHttpError(request, response, retryBody);
       }
-      if (retryTransient && isRetryableSafeReadResponse(response.status) && attempt < this.maxRetries) {
-        const delay = this.retryBaseDelayMs * 2 ** attempt;
+      if (retryTransient && this.isTransient(response.status, body) && attempt < this.maxRetries) {
+        const delay = this.retryDelayMs(attempt, parseRetryAfterMs2(response.headers.get("retry-after")));
         attempt += 1;
         await this.sleepImpl(delay);
         continue;
@@ -135769,6 +135977,24 @@ var AccessTokenGatewayClient = class {
       throw this.toHttpError(request, response, body);
     }
   }
+  retryDelayMs(attempt, retryAfter) {
+    return retryAfter === void 0 ? fullJitterDelayMs(attempt, this.retryBaseDelayMs, this.retryMaxDelayMs, this.randomImpl) : Math.min(this.retryMaxDelayMs, retryAfter);
+  }
+  isTransient(status, body) {
+    return status === 408 || status === 429 || status >= 500 || /ESOCKETTIMEDOUT|ETIMEDOUT|ECONNRESET|serverError|downstream/.test(body);
+  }
+  innerStatus(body) {
+    try {
+      const value = JSON.parse(body);
+      const status = Number(value.status ?? value.statusCode);
+      return value.error || value.success === false || status >= 400 ? status >= 400 ? status : 502 : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+  rebuildResponse(response, body) {
+    return new Response([204, 205, 304].includes(response.status) ? null : body, { status: response.status, statusText: response.statusText, headers: response.headers });
+  }
   /** Send a gateway request and parse the JSON body, or null when empty. */
   async requestJson(request, options = {}) {
     const response = await this.request(request, options);
@@ -135815,11 +136041,19 @@ var AccessTokenGatewayClient = class {
       url: `${this.bifrostBaseUrl}/ws/proxy (${request.service}: ${request.method} ${request.path})`,
       status: response.status,
       statusText: response.statusText,
-      requestHeaders: this.buildHeaders(request.headers),
+      requestHeaders: {
+        "Content-Type": "application/json",
+        "x-access-token": this.tokenProvider.current(),
+        ...request.headers || {},
+        ...this.teamId && this.orgMode ? { "x-entity-team-id": this.teamId } : {}
+      },
       responseBody: this.secretMasker(body),
       secretValues: [this.tokenProvider.current()]
     });
   }
+  toInnerHttpError(request, status, body) {
+    return new HttpError({ method: request.method.toUpperCase(), url: `${this.bifrostBaseUrl}/ws/proxy (${request.service}: ${request.method} ${request.path}) [inner]`, status, statusText: "Inner Error", requestHeaders: { "x-access-token": this.tokenProvider.current() }, responseBody: this.secretMasker(body), secretValues: [this.tokenProvider.current()] });
+  }
 };
 
 // src/lib/repo/branch-decision.ts
@@ -136742,8 +136976,8 @@ function stripVolatileFields(obj) {
   }
   return obj;
 }
-function writeJsonFile(path5, content, normalize3 = false) {
-  const data = normalize3 ? stripVolatileFields(content) : content;
+function writeJsonFile(path5, content, normalize4 = false) {
+  const data = normalize4 ? stripVolatileFields(content) : content;
   (0, import_node_fs4.writeFileSync)(path5, JSON.stringify(data, null, 2));
 }
 function buildMappedSpecCloudKey(mappedSource, specSyncMode, releaseLabel) {
@@ -137766,7 +138000,8 @@ function createRepoSyncDependencies(inputs, resolved, factories, options = {}) {
     bifrostBaseUrl: inputs.postmanBifrostBase,
     orgMode: inputs.orgMode,
     teamId: resolved.teamId,
-    secretMasker: masker
+    secretMasker: masker,
+    gateway
   });
   return {
     teamId: resolved.teamId,