@postman-cse/onboarding-repo-sync 2.1.10 → 2.1.14

package/dist/cli.cjs

@@ -19747,7 +19747,7 @@ var require_response = __commonJS({
     var assert = require("node:assert");
     var { isomorphicEncode, serializeJavascriptValueToJSONString } = require_infra();
     var textEncoder = new TextEncoder("utf-8");
-    var Response = class _Response {
+    var Response2 = class _Response {
       /** @type {Headers} */
       #headers;
       #state;
@@ -19917,13 +19917,13 @@ var require_response = __commonJS({
         response.#state = newState;
       }
     };
-    var { getResponseHeaders, setResponseHeaders, getResponseState, setResponseState } = Response;
-    Reflect.deleteProperty(Response, "getResponseHeaders");
-    Reflect.deleteProperty(Response, "setResponseHeaders");
-    Reflect.deleteProperty(Response, "getResponseState");
-    Reflect.deleteProperty(Response, "setResponseState");
-    mixinBody(Response, getResponseState);
-    Object.defineProperties(Response.prototype, {
+    var { getResponseHeaders, setResponseHeaders, getResponseState, setResponseState } = Response2;
+    Reflect.deleteProperty(Response2, "getResponseHeaders");
+    Reflect.deleteProperty(Response2, "setResponseHeaders");
+    Reflect.deleteProperty(Response2, "getResponseState");
+    Reflect.deleteProperty(Response2, "setResponseState");
+    mixinBody(Response2, getResponseState);
+    Object.defineProperties(Response2.prototype, {
       type: kEnumerableProperty,
       url: kEnumerableProperty,
       status: kEnumerableProperty,
@@ -19939,7 +19939,7 @@ var require_response = __commonJS({
         configurable: true
       }
     });
-    Object.defineProperties(Response, {
+    Object.defineProperties(Response2, {
       json: kEnumerableProperty,
       redirect: kEnumerableProperty,
       error: kEnumerableProperty
@@ -20072,7 +20072,7 @@ var require_response = __commonJS({
       }
     }
     function fromInnerResponse(innerResponse, guard) {
-      const response = new Response(kConstruct);
+      const response = new Response2(kConstruct);
       setResponseState(response, innerResponse);
       const headers = new Headers3(kConstruct);
       setResponseHeaders(response, headers);
@@ -20126,14 +20126,14 @@ var require_response = __commonJS({
         converter: webidl.converters.HeadersInit
       }
     ]);
-    webidl.is.Response = webidl.util.MakeTypeAssertion(Response);
+    webidl.is.Response = webidl.util.MakeTypeAssertion(Response2);
     module2.exports = {
       isNetworkError,
       makeNetworkError,
       makeResponse,
       makeAppropriateNetworkError,
       filterResponse,
-      Response,
+      Response: Response2,
       cloneResponse,
       fromInnerResponse,
       getResponseState
@@ -26571,7 +26571,7 @@ var require_util7 = __commonJS({
     exports2.esc = esc;
     exports2.slugify = slugify;
     exports2.isObject = isObject;
-    exports2.isPlainObject = isPlainObject2;
+    exports2.isPlainObject = isPlainObject3;
     exports2.shallowClone = shallowClone;
     exports2.numKeys = numKeys;
     exports2.escapeRegex = escapeRegex;
@@ -26754,7 +26754,7 @@ var require_util7 = __commonJS({
         return false;
       }
     });
-    function isPlainObject2(o) {
+    function isPlainObject3(o) {
       if (isObject(o) === false)
         return false;
       const ctor = o.constructor;
@@ -26771,7 +26771,7 @@ var require_util7 = __commonJS({
       return true;
     }
     function shallowClone(o) {
-      if (isPlainObject2(o))
+      if (isPlainObject3(o))
         return { ...o };
       if (Array.isArray(o))
         return [...o];
@@ -26976,7 +26976,7 @@ var require_util7 = __commonJS({
       return clone(schema, def);
     }
     function extend(schema, shape) {
-      if (!isPlainObject2(shape)) {
+      if (!isPlainObject3(shape)) {
         throw new Error("Invalid input to extend: expected a plain object");
       }
       const checks = schema._zod.def.checks;
@@ -26999,7 +26999,7 @@ var require_util7 = __commonJS({
       return clone(schema, def);
     }
     function safeExtend(schema, shape) {
-      if (!isPlainObject2(shape)) {
+      if (!isPlainObject3(shape)) {
         throw new Error("Invalid input to safeExtend: expected a plain object");
       }
       const def = mergeDefs(schema._zod.def, {
@@ -54818,7 +54818,7 @@ var require_lodash = __commonJS({
               } else {
                 newValue = [];
               }
-            } else if (isPlainObject2(srcValue) || isArguments(srcValue)) {
+            } else if (isPlainObject3(srcValue) || isArguments(srcValue)) {
               newValue = objValue;
               if (isArguments(objValue)) {
                 newValue = toPlainObject(objValue);
@@ -55782,7 +55782,7 @@ var require_lodash = __commonJS({
           return objValue;
         }
         function customOmitClone(value) {
-          return isPlainObject2(value) ? undefined2 : value;
+          return isPlainObject3(value) ? undefined2 : value;
         }
         function equalArrays(array, other, bitmask, customizer, equalFunc, stack) {
           var isPartial = bitmask & COMPARE_PARTIAL_FLAG, arrLength = array.length, othLength = other.length;
@@ -57283,7 +57283,7 @@ var require_lodash = __commonJS({
         var isBuffer = nativeIsBuffer || stubFalse;
         var isDate = nodeIsDate ? baseUnary(nodeIsDate) : baseIsDate;
         function isElement(value) {
-          return isObjectLike(value) && value.nodeType === 1 && !isPlainObject2(value);
+          return isObjectLike(value) && value.nodeType === 1 && !isPlainObject3(value);
         }
         function isEmpty(value) {
           if (value == null) {
@@ -57319,7 +57319,7 @@ var require_lodash = __commonJS({
             return false;
           }
           var tag = baseGetTag(value);
-          return tag == errorTag || tag == domExcTag || typeof value.message == "string" && typeof value.name == "string" && !isPlainObject2(value);
+          return tag == errorTag || tag == domExcTag || typeof value.message == "string" && typeof value.name == "string" && !isPlainObject3(value);
         }
         function isFinite2(value) {
           return typeof value == "number" && nativeIsFinite(value);
@@ -57370,7 +57370,7 @@ var require_lodash = __commonJS({
         function isNumber(value) {
           return typeof value == "number" || isObjectLike(value) && baseGetTag(value) == numberTag;
         }
-        function isPlainObject2(value) {
+        function isPlainObject3(value) {
           if (!isObjectLike(value) || baseGetTag(value) != objectTag) {
             return false;
           }
@@ -58441,7 +58441,7 @@ var require_lodash = __commonJS({
         lodash.isNumber = isNumber;
         lodash.isObject = isObject;
         lodash.isObjectLike = isObjectLike;
-        lodash.isPlainObject = isPlainObject2;
+        lodash.isPlainObject = isPlainObject3;
         lodash.isRegExp = isRegExp;
         lodash.isSafeInteger = isSafeInteger;
         lodash.isSet = isSet;
@@ -99441,7 +99441,7 @@ var require_response2 = __commonJS({
       }
       return stream;
     };
-    var Response;
+    var Response2;
     _.inherit(
       /**
        * Response holds data related to the request body. By default, it provides a nice wrapper for url-encoded,
@@ -99452,14 +99452,14 @@ var require_response2 = __commonJS({
        *
        * @param {Response.definition} options -
        */
-      Response = function PostmanResponse(options) {
-        Response.super_.apply(this, arguments);
+      Response2 = function PostmanResponse(options) {
+        Response2.super_.apply(this, arguments);
         this.update(options || {});
       },
       Property
     );
     _.assign(
-      Response.prototype,
+      Response2.prototype,
       /** @lends Response.prototype */
       {
         update(options) {
@@ -99525,7 +99525,7 @@ var require_response2 = __commonJS({
       }
     );
     _.assign(
-      Response.prototype,
+      Response2.prototype,
       /** @lends Response.prototype */
       {
         /**
@@ -99703,7 +99703,7 @@ var require_response2 = __commonJS({
       }
     );
     _.assign(
-      Response,
+      Response2,
       /** @lends Response */
       {
         /**
@@ -99721,7 +99721,7 @@ var require_response2 = __commonJS({
          * @returns {Boolean}
          */
         isResponse: function(obj) {
-          return Boolean(obj) && (obj instanceof Response || _.inSuperChain(obj.constructor, "_postman_propertyName", Response._postman_propertyName));
+          return Boolean(obj) && (obj instanceof Response2 || _.inSuperChain(obj.constructor, "_postman_propertyName", Response2._postman_propertyName));
         },
         /**
          * Converts the response object from the request module to the postman responseBody format
@@ -99732,7 +99732,7 @@ var require_response2 = __commonJS({
          * @todo Add a key: `originalRequest` to the returned object as well, referring to response.request
          */
         createFromNode: function(response, cookies) {
-          return new Response({
+          return new Response2({
             cookie: cookies,
             body: response.body.toString(),
             stream: response.body,
@@ -99811,7 +99811,7 @@ var require_response2 = __commonJS({
       }
     );
     module2.exports = {
-      Response
+      Response: Response2
     };
   }
 });
@@ -99825,7 +99825,7 @@ var require_item = __commonJS({
     var EventList = require_event_list().EventList;
     var Request = require_request13().Request;
     var RequestAuth = require_request_auth().RequestAuth;
-    var Response = require_response2().Response;
+    var Response2 = require_response2().Response;
     var Item;
     var OBJECT = "object";
     var STRING = "string";
@@ -99892,7 +99892,7 @@ var require_item = __commonJS({
              *
              * @type {PropertyList<Response>}
              */
-            responses: new PropertyList(Response, this, definition && definition.response),
+            responses: new PropertyList(Response2, this, definition && definition.response),
             /**
              * Events are a set of of {@link Script}s that are executed when certain activities are triggered on an
              * Item. For example, on defining an event that listens to the "test" event, would cause the associated
@@ -128814,11 +128814,12 @@ __export(cli_exports, {
   normalizeCliFlag: () => normalizeCliFlag,
   parseCliArgs: () => parseCliArgs,
   runCli: () => runCli,
-  toDotenv: () => toDotenv
+  toDotenv: () => toDotenv,
+  writeOptionalFileAtomic: () => writeOptionalFileAtomic
 });
 module.exports = __toCommonJS(cli_exports);
 var import_node_child_process = require("node:child_process");
-var import_node_fs5 = require("node:fs");
+var import_node_fs6 = require("node:fs");
 var import_promises = require("node:fs/promises");
 var import_node_path3 = __toESM(require("node:path"), 1);
 var import_node_util = require("node:util");
@@ -129186,7 +129187,8 @@ var ExitCode;
 })(ExitCode || (ExitCode = {}));
 
 // src/index.ts
-var import_node_fs4 = require("node:fs");
+var import_node_crypto3 = require("node:crypto");
+var import_node_fs5 = require("node:fs");
 var path3 = __toESM(require("node:path"), 1);
 
 // node_modules/js-yaml/dist/js-yaml.mjs
@@ -132102,6 +132104,7 @@ function dump(input, options = {}) {
 }
 
 // src/postman-v3/converter.ts
+var import_node_fs = require("node:fs");
 var fs2 = __toESM(require("node:fs/promises"), 1);
 var path = __toESM(require("node:path"), 1);
 var V2 = __toESM(require_v2(), 1);
@@ -132172,6 +132175,72 @@ function structuredCloneSafe(value) {
   if (typeof structuredClone === "function") return structuredClone(value);
   return JSON.parse(JSON.stringify(value));
 }
+var ArtifactDigestStreamError = class extends Error {
+  code = "ARTIFACT_DIGEST_STREAM";
+  constructor(message, options) {
+    super(message, options);
+    this.name = "ArtifactDigestStreamError";
+  }
+};
+function sameFileIdentity(left, right) {
+  return left.dev === right.dev && left.ino === right.ino && left.size === right.size;
+}
+async function appendArtifactDigestFileStreaming(hash, relative3, absolute, expected) {
+  const flags = typeof import_node_fs.constants.O_NOFOLLOW === "number" ? import_node_fs.constants.O_RDONLY | import_node_fs.constants.O_NOFOLLOW : import_node_fs.constants.O_RDONLY;
+  let handle;
+  try {
+    handle = await fs2.open(absolute, flags);
+  } catch (error) {
+    const code = error?.code;
+    if (code === "ELOOP" || code === "EMLINK" || code === "EINVAL") {
+      throw new ArtifactDigestStreamError(
+        `prebuilt collection tree file became a symlink or unsupported node at ${relative3}`,
+        { cause: error }
+      );
+    }
+    throw new ArtifactDigestStreamError(
+      `prebuilt collection tree file changed or became unsupported at ${relative3}`,
+      { cause: error }
+    );
+  }
+  try {
+    const before = await handle.stat();
+    if (!before.isFile() || !sameFileIdentity(before, expected)) {
+      throw new ArtifactDigestStreamError(
+        `prebuilt collection tree file changed or became unsupported at ${relative3}`
+      );
+    }
+    hash.update(relative3);
+    hash.update("\0");
+    const content = Buffer.allocUnsafe(expected.size);
+    let total = 0;
+    const buffer = Buffer.alloc(64 * 1024);
+    for (; ; ) {
+      const { bytesRead } = await handle.read(buffer, 0, buffer.length, null);
+      if (bytesRead === 0) {
+        break;
+      }
+      if (total + bytesRead > expected.size) {
+        throw new ArtifactDigestStreamError(
+          `prebuilt collection tree file changed while reading at ${relative3}`
+        );
+      }
+      buffer.copy(content, total, 0, bytesRead);
+      hash.update(buffer.subarray(0, bytesRead));
+      total += bytesRead;
+    }
+    hash.update("\0");
+    const after = await handle.stat();
+    if (!after.isFile() || !sameFileIdentity(after, expected) || total !== expected.size) {
+      throw new ArtifactDigestStreamError(
+        `prebuilt collection tree file changed while reading at ${relative3}`
+      );
+    }
+    return total === expected.size ? content : content.subarray(0, total);
+  } finally {
+    await handle.close();
+  }
+}
 async function listFilesRelative(dir, base) {
   let entries;
   try {
@@ -132732,7 +132801,7 @@ function getCiWorkflowTemplate(provider, options = {}) {
 }
 
 // src/lib/github/repo-mutation.ts
-var import_node_fs = require("node:fs");
+var import_node_fs2 = require("node:fs");
 var import_node_path = __toESM(require("node:path"), 1);
 
 // src/lib/secrets.ts
@@ -133022,7 +133091,7 @@ var RepoMutationService = class {
       throw new Error(this.secretMasker(changed.stderr || changed.stdout || "Failed to inspect generated changes"));
     }
     const hasPlannedRemoval = removePaths.some(
-      (removePath) => (0, import_node_fs.existsSync)(import_node_path.default.resolve(this.cwd, removePath))
+      (removePath) => (0, import_node_fs2.existsSync)(import_node_path.default.resolve(this.cwd, removePath))
     );
     if (!changed.stdout.trim() && !hasPlannedRemoval) {
       return {
@@ -133046,7 +133115,7 @@ var RepoMutationService = class {
     await this.execute("git", ["config", "user.name", options.committerName]);
     await this.execute("git", ["config", "user.email", options.committerEmail]);
     for (const removePath of removePaths) {
-      (0, import_node_fs.rmSync)(import_node_path.default.resolve(this.cwd, removePath), { force: true });
+      (0, import_node_fs2.rmSync)(import_node_path.default.resolve(this.cwd, removePath), { force: true });
     }
     await this.execute("git", ["add", "-A", "--", ...stagePaths]);
     const staged = await this.execute("git", ["diff", "--cached", "--quiet"]);
@@ -133589,14 +133658,14 @@ function createTelemetryContext(options) {
 }
 
 // src/action-version.ts
-var import_node_fs2 = require("node:fs");
+var import_node_fs3 = require("node:fs");
 var import_node_path2 = require("node:path");
 function resolveActionVersion2() {
   if (false) {
     return void 0;
   }
   try {
-    const raw = (0, import_node_fs2.readFileSync)((0, import_node_path2.join)(__dirname, "..", "package.json"), "utf8");
+    const raw = (0, import_node_fs3.readFileSync)((0, import_node_path2.join)(__dirname, "..", "package.json"), "utf8");
     return JSON.parse(raw).version ?? "unknown";
   } catch {
     return "unknown";
@@ -133661,6 +133730,54 @@ var HttpError = class _HttpError extends Error {
   }
 };
 
+// src/lib/postman/pmak-diagnostics.ts
+var memo = /* @__PURE__ */ new Map();
+var normalize3 = (value) => new URL(value.trim()).toString().replace(/\/+$/, "");
+function maskPmakDiagnostic(message, secrets) {
+  let masked = String(message);
+  for (const secret of secrets) if (secret) masked = masked.split(secret).join("***");
+  return Array.from(masked, (character) => {
+    const code = character.codePointAt(0) ?? 0;
+    return code <= 31 || code >= 127 && code <= 159 ? " " : character;
+  }).join("").replace(/\s+/g, " ").trim();
+}
+function formatRejectedMint(original, result) {
+  const teamId = typeof result.payload?.user?.teamId === "number" ? ` (team ${(result.payload?.user).teamId})` : "";
+  if (result.kind === "personal") return `Personal API key detected, cannot mint a service-account access token${teamId}.`;
+  if (result.kind === "service-account") return `The postman-api-key authenticates (GET /me OK) but was rejected by POST /service-account-tokens${teamId} and lacks permission to mint access tokens.`;
+  if (result.kind === "invalid") return "The postman-api-key is invalid, disabled, or expired.";
+  return original;
+}
+async function inspectPmakIdentity(options) {
+  const apiBaseUrl = normalize3(options.apiBaseUrl);
+  const key = `${apiBaseUrl}\0${options.apiKey}`;
+  let pending = memo.get(key);
+  if (!pending) {
+    pending = (async () => {
+      try {
+        const timeout = AbortSignal.timeout(options.timeoutMs ?? 2e3);
+        const signal = options.signal ? AbortSignal.any([options.signal, timeout]) : timeout;
+        const response = await (options.fetchImpl ?? fetch)(`${apiBaseUrl}/me`, { method: "GET", headers: { "X-Api-Key": options.apiKey }, signal });
+        if (response.status === 401 || response.status === 403) return { kind: "invalid", status: response.status };
+        if (!response.ok) return { kind: "inconclusive", status: response.status };
+        const payload = await response.json().catch(() => void 0);
+        const user = payload?.user;
+        if (!user || typeof user !== "object" || Array.isArray(user)) return { kind: "inconclusive", payload };
+        const record = user;
+        if (typeof record.username === "string" && record.username || typeof record.email === "string" && record.email) return { kind: "personal", status: response.status, payload };
+        if ("username" in record && "email" in record && (record.username == null || record.username === "") && (record.email == null || record.email === "")) return { kind: "service-account", status: response.status, payload };
+        return { kind: "inconclusive", payload };
+      } catch {
+        return { kind: "inconclusive" };
+      }
+    })();
+    memo.set(key, pending);
+  }
+  const result = await pending;
+  if (options.mode === "preflight" && result.kind === "inconclusive") memo.delete(key);
+  return result;
+}
+
 // src/lib/postman/credential-identity.ts
 var sessionPath = "/api/sessions/current";
 var SESSION_MAX_ATTEMPTS = 3;
@@ -133754,14 +133871,8 @@ async function resolvePmakIdentity(opts) {
 }
 async function probePmakIdentity(baseUrl, apiKey, fetchImpl) {
   try {
-    const response = await fetchImpl(`${baseUrl}/me`, {
-      method: "GET",
-      headers: { "X-Api-Key": apiKey }
-    });
-    if (!response.ok) {
-      return void 0;
-    }
-    const payload = asRecord(await response.json());
+    const diagnostic = await inspectPmakIdentity({ apiBaseUrl: baseUrl, apiKey, fetchImpl });
+    const payload = asRecord(diagnostic.payload);
     const user = asRecord(payload?.user);
     if (!user) {
       return void 0;
@@ -133793,7 +133904,8 @@ async function resolveSessionIdentity(opts) {
       opts.fetchImpl ?? fetch,
       Math.max(1, opts.maxAttempts ?? SESSION_MAX_ATTEMPTS),
       opts.sleepImpl ?? defaultSessionSleep,
-      opts.randomImpl ?? defaultRandom
+      opts.randomImpl ?? defaultRandom,
+      opts.onRetryEvent
     );
     sessionMemo.set(memoKey, pending);
   }
@@ -133827,7 +133939,7 @@ async function parseSessionResponse(response) {
     consumerType: coerceText(root.consumerType) ?? coerceText(data?.consumerType) ?? coerceText(user?.consumerType)
   };
 }
-async function probeSessionIdentity(baseUrl, accessToken, fetchImpl, maxAttempts, sleepImpl, random) {
+async function probeSessionIdentity(baseUrl, accessToken, fetchImpl, maxAttempts, sleepImpl, random, onRetryEvent) {
   let failure = "unavailable";
   for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
     let response;
@@ -133839,7 +133951,9 @@ async function probeSessionIdentity(baseUrl, accessToken, fetchImpl, maxAttempts
     } catch {
       failure = "unavailable";
       if (attempt < maxAttempts) {
-        await sleepImpl(computeSessionRetryDelayMs(void 0, attempt, random));
+        const delay = computeSessionRetryDelayMs(void 0, attempt, random);
+        onRetryEvent?.({ class: "transport", attempt, delay });
+        await sleepImpl(delay);
         continue;
       }
       break;
@@ -133861,7 +133975,9 @@ async function probeSessionIdentity(baseUrl, accessToken, fetchImpl, maxAttempts
     if (response.status === 429 || response.status >= 500) {
       failure = "unavailable";
       if (attempt < maxAttempts) {
-        await sleepImpl(computeSessionRetryDelayMs(response, attempt, random));
+        const delay = computeSessionRetryDelayMs(response, attempt, random);
+        onRetryEvent?.({ class: "http", status: response.status, attempt, delay });
+        await sleepImpl(delay);
         continue;
       }
       break;
@@ -133963,7 +134079,8 @@ async function runCredentialPreflight(args) {
       accessToken,
       fetchImpl: args.fetchImpl,
       ...args.sleepImpl ? { sleepImpl: args.sleepImpl } : {},
-      ...args.randomImpl ? { randomImpl: args.randomImpl } : {}
+      ...args.randomImpl ? { randomImpl: args.randomImpl } : {},
+      onRetryEvent: args.retryEvent ?? args.log.retryEvent
     });
   } catch (error) {
     args.log.warning(
@@ -134063,6 +134180,39 @@ function adviseFromHttpError(err, ctx) {
   return new Error(ctx.mask(advice), { cause: err });
 }
 
+// src/lib/postman/app-version.ts
+var UPDATE_URL = "https://dl.pstmn.io/update/status?currentVersion=12.0.0&platform=osx_arm64";
+var FLOOR_VERSION = "12.0.0";
+var VERSION_PATTERN = /^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+var PostmanAppVersionProvider = class {
+  fetchImpl;
+  requestTimeoutMs;
+  pending;
+  constructor(options = {}) {
+    this.fetchImpl = options.fetchImpl ?? fetch;
+    this.requestTimeoutMs = options.requestTimeoutMs ?? 2e3;
+  }
+  async get() {
+    if (process.env.POSTMAN_GATEWAY_APP_VERSION === "off") return void 0;
+    this.pending ??= this.resolve();
+    return this.pending;
+  }
+  async resolve() {
+    try {
+      const response = await this.fetchImpl(UPDATE_URL, {
+        signal: AbortSignal.timeout(this.requestTimeoutMs)
+      });
+      if (!response.ok) return FLOOR_VERSION;
+      const payload = await response.json();
+      const version = typeof payload.version === "string" ? payload.version : "";
+      return VERSION_PATTERN.test(version) ? version : FLOOR_VERSION;
+    } catch {
+      return FLOOR_VERSION;
+    }
+  }
+};
+var defaultPostmanAppVersionProvider = new PostmanAppVersionProvider();
+
 // src/lib/postman/internal-integration-adapter.ts
 function extractDuplicateWorkspaceId(body) {
   try {
@@ -134082,6 +134232,8 @@ var BifrostInternalIntegrationAdapter = class {
   secretMasker;
   teamId;
   workerBaseUrl;
+  gateway;
+  appVersionProvider;
   constructor(options) {
     this.accessToken = String(options.accessToken || "").trim();
     this.getAccessToken = options.getAccessToken;
@@ -134094,6 +134246,8 @@ var BifrostInternalIntegrationAdapter = class {
     this.workerBaseUrl = String(
       options.workerBaseUrl || "https://catalog-admin.postman-account2009.workers.dev"
     ).replace(/\/+$/, "");
+    this.gateway = options.gateway;
+    this.appVersionProvider = options.appVersionProvider ?? defaultPostmanAppVersionProvider;
     this.secretMasker = options.secretMasker ?? createSecretMasker([this.accessToken]);
   }
   /** Live access token: re-minted value when a provider accessor is wired, else the captured one. */
@@ -134101,7 +134255,7 @@ var BifrostInternalIntegrationAdapter = class {
     return this.getAccessToken ? String(this.getAccessToken() || "").trim() : this.accessToken;
   }
   /** Build Bifrost proxy headers. Only includes x-entity-team-id for org-mode teams. */
-  bifrostHeaders() {
+  async bifrostHeaders() {
     const headers = {
       "Content-Type": "application/json",
       "x-access-token": this.currentToken()
@@ -134109,6 +134263,8 @@ var BifrostInternalIntegrationAdapter = class {
     if (this.teamId && this.orgMode) {
       headers["x-entity-team-id"] = this.teamId;
     }
+    const appVersion = await this.appVersionProvider.get();
+    if (appVersion) headers["x-app-version"] = appVersion;
     return headers;
   }
   /** Reactive error-advice context, enriched with the preflight session memo when present. */
@@ -134139,6 +134295,58 @@ var BifrostInternalIntegrationAdapter = class {
     if (associations.length === 0) {
       return;
     }
+    const mode = process.env.POSTMAN_SYSTEM_ENV_ASSOCIATION_MODE ?? "direct";
+    if (mode !== "direct" && mode !== "worker") {
+      throw new Error("POSTMAN_SYSTEM_ENV_ASSOCIATION_MODE must be direct or worker");
+    }
+    if (mode === "direct") {
+      if (!this.gateway) {
+        throw new Error("Direct system-environment association requires the access-token gateway");
+      }
+      const groups = /* @__PURE__ */ new Map();
+      for (const association of associations) {
+        const systemEnvId = String(association.systemEnvId || "").trim();
+        const uid = String(association.envUid || "").trim();
+        if (!systemEnvId || !uid) continue;
+        const key = `${systemEnvId}\0${workspaceId}`;
+        const uids = groups.get(key) ?? /* @__PURE__ */ new Set();
+        uids.add(uid);
+        groups.set(key, uids);
+      }
+      for (const [key, uids] of [...groups.entries()].sort(([a], [b]) => a.localeCompare(b))) {
+        const [systemEnvironmentId, groupedWorkspaceId] = key.split("\0");
+        const postmanEnvironmentIds = [...uids].sort();
+        let response2;
+        try {
+          response2 = await this.gateway.requestJson({
+            service: "api-catalog",
+            method: "post",
+            path: "/api/system-envs/associations",
+            body: {
+              systemEnvironmentId,
+              workspaceEntries: [{ workspaceId: groupedWorkspaceId, postmanEnvironmentIds }]
+            },
+            fallback: "none"
+          }, { retryTransient: true });
+        } catch (error) {
+          if (error instanceof HttpError) {
+            throw adviseFromHttpError(error, this.adviceContext("system environment association")) ?? error;
+          }
+          throw error;
+        }
+        if (!response2 || response2.success !== true) {
+          throw new Error("SYSTEM_ENV_ASSOCIATION_INCOMPLETE");
+        }
+        if (response2.data !== void 0) {
+          if (!Array.isArray(response2.data)) throw new Error("SYSTEM_ENV_ASSOCIATION_INCOMPLETE");
+          const seen = new Set(response2.data.filter((row) => !!row && typeof row === "object").map((row) => `${row.systemEnvironmentId}\0${row.workspaceId}\0${row.postmanEnvironmentId}`));
+          if (!postmanEnvironmentIds.every((uid) => seen.has(`${systemEnvironmentId}\0${groupedWorkspaceId}\0${uid}`))) {
+            throw new Error("SYSTEM_ENV_ASSOCIATION_INCOMPLETE");
+          }
+        }
+      }
+      return;
+    }
     const token = this.currentToken();
     const response = await this.fetchImpl(
       `${this.workerBaseUrl}/api/internal/system-envs/associate`,
@@ -134196,7 +134404,7 @@ var BifrostInternalIntegrationAdapter = class {
     try {
       const response = await this.fetchImpl(url, {
         method: "POST",
-        headers: this.bifrostHeaders(),
+        headers: await this.bifrostHeaders(),
         body: JSON.stringify(payload)
       });
       let parsed = {};
@@ -134285,7 +134493,7 @@ var BifrostInternalIntegrationAdapter = class {
         versionControl: true
       }
     };
-    const headers = this.bifrostHeaders();
+    const headers = await this.bifrostHeaders();
     const response = await this.fetchImpl(url, {
       method: "POST",
       headers,
@@ -134340,7 +134548,7 @@ var BifrostInternalIntegrationAdapter = class {
     try {
       const response = await this.fetchImpl(`${this.bifrostBaseUrl}/ws/proxy`, {
         method: "POST",
-        headers: this.bifrostHeaders(),
+        headers: await this.bifrostHeaders(),
         body: JSON.stringify({
           service: "workspaces",
           method: "GET",
@@ -134371,7 +134579,7 @@ var BifrostInternalIntegrationAdapter = class {
   }
   async createApiKey(name) {
     const url = `${this.bifrostBaseUrl}/ws/proxy`;
-    const headers = this.bifrostHeaders();
+    const headers = await this.bifrostHeaders();
     const payload = {
       service: "identity",
       method: "POST",
@@ -134456,6 +134664,16 @@ async function retry(operation, options = {}) {
   }
   throw new Error("Retry exhausted without returning or throwing");
 }
+function fullJitterDelayMs(attempt, baseMs, capMs, random = Math.random) {
+  return Math.floor(random() * Math.max(0, Math.min(capMs, baseMs * 2 ** Math.max(0, attempt))));
+}
+function parseRetryAfterMs2(value) {
+  const trimmed = value?.trim();
+  if (!trimmed) return void 0;
+  if (/^\d+$/.test(trimmed)) return Number(trimmed) * 1e3;
+  const time = Date.parse(trimmed);
+  return Number.isNaN(time) ? void 0 : Math.max(0, time - Date.now());
+}
 
 // src/contracts.ts
 var postmanRepoSyncActionContract = {
@@ -134514,6 +134732,11 @@ var postmanRepoSyncActionContract = {
       description: "Contract collection ID used for exported artifacts.",
       required: false
     },
+    "prebuilt-collections-json": {
+      description: "Optional digest-bound JSON manifest of unique baseline, smoke, or contract roles with confined repo-relative path, SHA-256 artifact digest of the on-disk v3 collection tree (sorted relative-path + NUL + bytes + NUL), and canonical cloud ID. The optional payloadDigest field is the semantic v2 payload digest carried for provenance (format-validated only, not the reuse gate). Exact role, path, cloudId, and artifactDigest matches reuse the on-disk tree without cloud export.",
+      required: false,
+      default: ""
+    },
     "collection-sync-mode": {
       description: "Collection sync lifecycle mode (refresh or version).",
       required: false,
@@ -134756,7 +134979,7 @@ var postmanRepoSyncActionContract = {
       "Create or update Postman environments from runtime URLs.",
       "Associate Postman environments to system environments through Postman integration APIs.",
       "Create mock servers and smoke monitors from generated collections.",
-      "Export Postman collections in the Collection v3 multi-file YAML directory structure under `postman/collections/` (e.g., `<name>/collection.yaml`, nested folder and request YAML files), and export environments plus `.postman/resources.yaml` into the repository.",
+      "Export Postman collections in the Collection v3 multi-file YAML directory structure under `postman/collections/` (canonical `.resources/definition.yaml` plus request/resource YAML files), and export environments plus `.postman/resources.yaml` into the repository.",
       "Link the Postman workspace to the repository (GitHub or GitLab) through Postman integration APIs.",
       "Commit synced artifacts and push them back to the current checked out ref."
     ],
@@ -134885,6 +135108,17 @@ var PostmanGatewayAssetsClient = class {
     return data.map((entry) => this.asRecord(entry)).filter((entry) => entry !== null).map((entry) => ({ uid: String(entry.id ?? entry.uid ?? "").trim(), name: String(entry.name ?? "").trim() })).filter((entry) => entry.uid && entry.name);
   }
   async getSpecContent(specId) {
+    if (process.env.POSTMAN_SPEC_TREE_FAST_PATH !== "off") {
+      try {
+        const treeContent = await this.getSpecContentFromTree(specId);
+        if (treeContent !== void 0) return treeContent;
+      } catch (error) {
+        if (!(error instanceof HttpError) || ![403, 404, 405, 501].includes(error.status)) throw error;
+      }
+    }
+    return this.getSpecContentLegacy(specId);
+  }
+  async getSpecContentLegacy(specId) {
     const files = await this.gateway.requestJson({
       service: "specification",
       method: "get",
@@ -134903,6 +135137,46 @@ var PostmanGatewayAssetsClient = class {
     const record = this.dataOf(file);
     return typeof record?.content === "string" ? record.content : void 0;
   }
+  /** Minimal `/tree` reader: validate the entire returned inventory before selecting ROOT. */
+  async getSpecContentFromTree(specId) {
+    const rows = [];
+    const cursors = /* @__PURE__ */ new Set();
+    let cursor;
+    for (let page = 0; page < 100; page += 1) {
+      const response = await this.gateway.requestJson({
+        service: "specification",
+        method: "get",
+        path: `/specifications/${specId}/tree`,
+        query: { fields: "id,name,type,path,parentId,fileType,content", limit: 100, ...cursor ? { cursor } : {} }
+      });
+      if (!Array.isArray(response?.data)) return void 0;
+      for (const value of response.data) {
+        const row = this.asRecord(value);
+        if (!row || row.type === "FOLDER") continue;
+        if (row.type !== "FILE" || typeof row.id !== "string" || !row.id.trim() || typeof row.path !== "string" || !row.path.trim() || typeof row.content !== "string" || typeof row.fileType !== "string" || !row.fileType.trim()) return void 0;
+        const path5 = row.path.replace(/\\/g, "/").normalize("NFC");
+        if (path5.startsWith("/") || path5.split("/").some((part) => part === ".." || !part)) throw new Error("CONTRACT_DEFINITION_PATH_INVALID");
+        rows.push({ ...row, path: path5 });
+      }
+      const meta = this.asRecord(response?.meta);
+      const cursorValue = this.asRecord(meta?.cursor)?.next;
+      const next = typeof cursorValue === "string" && cursorValue.trim() ? cursorValue.trim() : void 0;
+      if (!next) break;
+      if (cursors.has(next)) throw new Error("SPEC_TREE_CURSOR_REPEATED");
+      cursors.add(next);
+      if (page === 99) throw new Error("SPEC_TREE_PAGE_LIMIT_EXCEEDED");
+      cursor = next;
+    }
+    const paths = /* @__PURE__ */ new Set();
+    for (const row of rows) {
+      const path5 = String(row.path).toLocaleLowerCase();
+      if (paths.has(path5)) throw new Error("CONTRACT_DEFINITION_DUPLICATE_PATH");
+      paths.add(path5);
+    }
+    const roots = rows.filter((row) => row.fileType === "ROOT");
+    if (roots.length !== 1) throw new Error("CONTRACT_DEFINITION_INVENTORY_INVALID");
+    return String(roots[0]?.content);
+  }
   async listSpecCollections(specId) {
     const response = await this.gateway.requestJson({
       service: "specification",
@@ -135462,10 +135736,12 @@ var PostmanGatewayAssetsClient = class {
 // src/lib/postman/token-provider.ts
 var MintError = class extends Error {
   permanent;
-  constructor(message, permanent) {
+  status;
+  constructor(message, permanent, status) {
     super(message);
     this.name = "MintError";
     this.permanent = permanent;
+    this.status = status;
   }
 };
 function extractAccessToken(payload) {
@@ -135488,6 +135764,7 @@ var AccessTokenProvider = class {
   maxAttempts;
   onToken;
   sleep;
+  onRetryEvent;
   inflight;
   constructor(options) {
     this.token = String(options.accessToken || "").trim();
@@ -135499,6 +135776,7 @@ var AccessTokenProvider = class {
     this.maxAttempts = Math.max(1, options.maxAttempts ?? 2);
     this.onToken = options.onToken;
     this.sleep = options.sleep;
+    this.onRetryEvent = options.onRetryEvent;
   }
   current() {
     return this.token;
@@ -135524,7 +135802,12 @@ var AccessTokenProvider = class {
       delayMs: 1e3,
       backoffMultiplier: 2,
       ...this.sleep ? { sleep: this.sleep } : {},
-      shouldRetry: (error) => !(error instanceof MintError && error.permanent)
+      shouldRetry: (error) => !(error instanceof MintError && error.permanent),
+      onRetry: ({ attempt, delayMs, error }) => {
+        const status = error instanceof MintError ? error.status : void 0;
+        const retryClass = status === void 0 ? "transport" : "http";
+        this.onRetryEvent?.({ class: retryClass, ...status === void 0 ? {} : { status }, attempt, delay: Math.max(0, delayMs) });
+      }
     });
     this.token = token;
     this.onToken?.(token);
@@ -135545,7 +135828,8 @@ var AccessTokenProvider = class {
       if (status === 401 || status === 403) {
         throw new MintError(
           `postman: re-mint failed because the postman-api-key was rejected (PMAK rejected, HTTP ${status}); confirm it is a valid, enabled service-account PMAK for the intended team.`,
-          true
+          true,
+          status
         );
       }
       if (status === 400 && body.toLowerCase().includes("service accounts not enabled")) {
@@ -135554,7 +135838,7 @@ var AccessTokenProvider = class {
           true
         );
       }
-      throw new MintError(`postman: re-mint failed (service-account-tokens HTTP ${status}).`, false);
+      throw new MintError(`postman: re-mint failed (service-account-tokens HTTP ${status}).`, false, status);
     }
     let parsed;
     try {
@@ -135570,26 +135854,9 @@ var AccessTokenProvider = class {
   }
 };
 async function describeMintFailure(mintError, apiKey, apiBaseUrl, fetchImpl) {
-  const raw = mintError instanceof Error ? mintError.message : String(mintError);
-  const rejected = /HTTP 40[13]|PMAK rejected/.test(raw);
-  if (!rejected) {
-    return raw;
-  }
-  try {
-    const me = await fetchImpl(`${apiBaseUrl}/me`, { headers: { "x-api-key": apiKey } });
-    if (me.ok) {
-      const body = await me.json().catch(() => void 0);
-      const user = body?.user;
-      const looksPersonal = Boolean(user && (user.username || user.email));
-      if (looksPersonal) {
-        return "Personal API key detected, cannot mint a service-account access token. POST /service-account-tokens only accepts a SERVICE-ACCOUNT API key; this postman-api-key belongs to a user account" + (user?.teamId ? ` (team ${user.teamId})` : "") + ". Create a service account in Team Settings and use its PMAK, or mint the token elsewhere and pass postman-access-token.";
-      }
-      return "The postman-api-key authenticates (GET /me OK) but was rejected by POST /service-account-tokens" + (user?.teamId ? ` (team ${user.teamId})` : "") + ". The service account likely lacks permission to mint access tokens, or service accounts are restricted for this team. Check the service account role in Team Settings, or pass a pre-minted postman-access-token.";
-    }
-    return "The postman-api-key is invalid, disabled, or expired (rejected by both POST /service-account-tokens and GET /me). Generate a fresh service-account PMAK in Team Settings and update the secret.";
-  } catch {
-    return raw;
-  }
+  const raw = maskPmakDiagnostic(mintError instanceof Error ? mintError.message : String(mintError), [apiKey]);
+  if (!(mintError instanceof MintError) || mintError.status !== 401 && mintError.status !== 403) return raw;
+  return formatRejectedMint(raw, await inspectPmakIdentity({ apiBaseUrl, apiKey, fetchImpl }));
 }
 async function mintAccessTokenIfNeeded(inputs, log, setSecret2, fetchImpl = fetch) {
   if (inputs.postmanAccessToken || !inputs.postmanApiKey) {
@@ -135602,7 +135869,8 @@ async function mintAccessTokenIfNeeded(inputs, log, setSecret2, fetchImpl = fetc
     apiKey: inputs.postmanApiKey,
     apiBaseUrl,
     fetchImpl,
-    onToken: (token) => setSecret2?.(token)
+    onToken: (token) => setSecret2?.(token),
+    onRetryEvent: (event) => log.retryEvent?.(event)
   });
   try {
     inputs.postmanAccessToken = await provider.refresh();
@@ -135638,6 +135906,11 @@ var AccessTokenGatewayClient = class {
   fallbackBaseUrl;
   retryBaseDelayMs;
   sleepImpl;
+  appVersionProvider;
+  requestTimeoutMs;
+  retryMaxDelayMs;
+  randomImpl;
+  onRetryEvent;
   constructor(options) {
     this.tokenProvider = options.tokenProvider;
     this.bifrostBaseUrl = String(
@@ -135652,16 +135925,23 @@ var AccessTokenGatewayClient = class {
     this.fallbackBaseUrl = fallbackEnv === "off" ? void 0 : options.fallbackBaseUrl?.replace(/\/+$/, "");
     this.retryBaseDelayMs = options.retryBaseDelayMs ?? 400;
     this.sleepImpl = options.sleepImpl ?? defaultSleep;
+    this.appVersionProvider = options.appVersionProvider ?? defaultPostmanAppVersionProvider;
+    this.requestTimeoutMs = options.requestTimeoutMs ?? 3e4;
+    this.retryMaxDelayMs = options.retryMaxDelayMs ?? 5e3;
+    this.randomImpl = options.randomImpl ?? Math.random;
+    this.onRetryEvent = options.onRetryEvent;
   }
   configureTeamContext(teamId, orgMode) {
     this.teamId = String(teamId || "").trim();
     this.orgMode = orgMode;
   }
-  buildHeaders(extra) {
+  async buildHeaders(extra) {
+    const appVersion = await this.appVersionProvider.get();
     const headers = {
       "Content-Type": "application/json",
       "x-access-token": this.tokenProvider.current(),
-      ...extra || {}
+      ...extra || {},
+      ...appVersion ? { "x-app-version": appVersion } : {}
     };
     if (this.teamId && this.orgMode) {
       headers["x-entity-team-id"] = this.teamId;
@@ -135670,17 +135950,24 @@ var AccessTokenGatewayClient = class {
   }
   async send(request, baseUrl) {
     const url = `${baseUrl ?? this.bifrostBaseUrl}/ws/proxy`;
-    return this.fetchImpl(url, {
-      method: "POST",
-      headers: this.buildHeaders(request.headers),
-      body: JSON.stringify({
-        service: request.service,
-        method: request.method,
-        path: request.path,
-        ...request.query !== void 0 ? { query: request.query } : {},
-        ...request.body !== void 0 ? { body: request.body } : {}
-      })
-    });
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.requestTimeoutMs);
+    try {
+      return await this.fetchImpl(url, {
+        method: "POST",
+        headers: await this.buildHeaders(request.headers),
+        signal: controller.signal,
+        body: JSON.stringify({
+          service: request.service,
+          method: request.method,
+          path: request.path,
+          ...request.query !== void 0 ? { query: request.query } : {},
+          ...request.body !== void 0 ? { body: request.body } : {}
+        })
+      });
+    } finally {
+      clearTimeout(timer);
+    }
   }
   /**
    * One cold, serial attempt against the fallback base URL after the primary
@@ -135707,11 +135994,13 @@ var AccessTokenGatewayClient = class {
    * they are the freshest authoritative answer.
    */
   fallbackEligible(request, retryTransient) {
+    if (request.fallback === "none") return false;
     if (!this.fallbackBaseUrl) return false;
     return retryTransient || request.fallback === "auto";
   }
-  async attemptFallback(request, retryTransient) {
+  async attemptFallback(request, retryTransient, status) {
     if (!this.fallbackEligible(request, retryTransient)) return null;
+    this.emitRetryEvent("fallback", status, 1, 0);
     const response = await this.tryFallback(request);
     if (!response) return null;
     if (response.ok) return response;
@@ -135736,7 +136025,8 @@ var AccessTokenGatewayClient = class {
         response = await this.send(request);
       } catch (error) {
         if (retryTransient && attempt < this.maxRetries) {
-          const delay = this.retryBaseDelayMs * 2 ** attempt;
+          const delay = this.retryDelayMs(attempt);
+          this.emitRetryEvent("transport", void 0, attempt + 1, delay);
           attempt += 1;
           await this.sleepImpl(delay);
           continue;
@@ -135746,10 +136036,23 @@ var AccessTokenGatewayClient = class {
         throw error;
       }
       if (response.ok) {
-        return response;
+        const okBody = await response.text().catch(() => "");
+        const inner = this.innerStatus(okBody);
+        if (inner !== void 0) {
+          if (retryTransient && this.isTransient(inner, okBody) && attempt < this.maxRetries) {
+            const delay = this.retryDelayMs(attempt);
+            this.emitRetryEvent("inner", inner, attempt + 1, delay);
+            await this.sleepImpl(delay);
+            attempt += 1;
+            continue;
+          }
+          throw this.toInnerHttpError(request, inner, okBody);
+        }
+        return this.rebuildResponse(response, okBody);
       }
       const body = await response.text().catch(() => "");
       if (isExpiredAuthError(response.status, body) && this.tokenProvider.canRefresh()) {
+        this.emitRetryEvent("auth", response.status, 1, 0);
         await this.tokenProvider.refresh();
         response = await this.send(request);
         if (response.ok) {
@@ -135758,17 +136061,44 @@ var AccessTokenGatewayClient = class {
         const retryBody = await response.text().catch(() => "");
         throw this.toHttpError(request, response, retryBody);
       }
-      if (retryTransient && isRetryableSafeReadResponse(response.status) && attempt < this.maxRetries) {
-        const delay = this.retryBaseDelayMs * 2 ** attempt;
+      if (retryTransient && this.isTransient(response.status, body) && attempt < this.maxRetries) {
+        const delay = this.retryDelayMs(attempt, parseRetryAfterMs2(response.headers.get("retry-after")));
+        this.emitRetryEvent("http", response.status, attempt + 1, delay);
         attempt += 1;
         await this.sleepImpl(delay);
         continue;
       }
-      const fallbackResponse = await this.attemptFallback(request, retryTransient);
+      const fallbackResponse = await this.attemptFallback(request, retryTransient, response.status);
       if (fallbackResponse) return fallbackResponse;
       throw this.toHttpError(request, response, body);
     }
   }
+  retryDelayMs(attempt, retryAfter) {
+    return retryAfter === void 0 ? fullJitterDelayMs(attempt, this.retryBaseDelayMs, this.retryMaxDelayMs, this.randomImpl) : Math.min(this.retryMaxDelayMs, retryAfter);
+  }
+  emitRetryEvent(retryClass, status, attempt, delay) {
+    this.onRetryEvent?.({
+      class: retryClass,
+      ...status === void 0 ? {} : { status },
+      attempt: Math.max(1, attempt),
+      delay: Math.max(0, delay)
+    });
+  }
+  isTransient(status, body) {
+    return status === 408 || status === 429 || status >= 500 || /ESOCKETTIMEDOUT|ETIMEDOUT|ECONNRESET|serverError|downstream/.test(body);
+  }
+  innerStatus(body) {
+    try {
+      const value = JSON.parse(body);
+      const status = Number(value.status ?? value.statusCode);
+      return value.error || value.success === false || status >= 400 ? status >= 400 ? status : 502 : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+  rebuildResponse(response, body) {
+    return new Response([204, 205, 304].includes(response.status) ? null : body, { status: response.status, statusText: response.statusText, headers: response.headers });
+  }
   /** Send a gateway request and parse the JSON body, or null when empty. */
   async requestJson(request, options = {}) {
     const response = await this.request(request, options);
@@ -135815,15 +136145,23 @@ var AccessTokenGatewayClient = class {
       url: `${this.bifrostBaseUrl}/ws/proxy (${request.service}: ${request.method} ${request.path})`,
       status: response.status,
       statusText: response.statusText,
-      requestHeaders: this.buildHeaders(request.headers),
+      requestHeaders: {
+        "Content-Type": "application/json",
+        "x-access-token": this.tokenProvider.current(),
+        ...request.headers || {},
+        ...this.teamId && this.orgMode ? { "x-entity-team-id": this.teamId } : {}
+      },
       responseBody: this.secretMasker(body),
       secretValues: [this.tokenProvider.current()]
     });
   }
+  toInnerHttpError(request, status, body) {
+    return new HttpError({ method: request.method.toUpperCase(), url: `${this.bifrostBaseUrl}/ws/proxy (${request.service}: ${request.method} ${request.path}) [inner]`, status, statusText: "Inner Error", requestHeaders: { "x-access-token": this.tokenProvider.current() }, responseBody: this.secretMasker(body), secretValues: [this.tokenProvider.current()] });
+  }
 };
 
 // src/lib/repo/branch-decision.ts
-var import_node_fs3 = require("node:fs");
+var import_node_fs4 = require("node:fs");
 var import_node_crypto2 = require("node:crypto");
 var ContractError = class extends Error {
   code;
@@ -135864,7 +136202,7 @@ function readGithubEvent(env) {
   const path5 = clean(env.GITHUB_EVENT_PATH);
   if (!path5) return void 0;
   try {
-    return JSON.parse((0, import_node_fs3.readFileSync)(path5, "utf8"));
+    return JSON.parse((0, import_node_fs4.readFileSync)(path5, "utf8"));
   } catch {
     return void 0;
   }
@@ -136317,6 +136655,7 @@ function resolveInputs(env = process.env) {
     baselineCollectionId: getInput("baseline-collection-id", env),
     smokeCollectionId: getInput("smoke-collection-id", env),
     contractCollectionId: getInput("contract-collection-id", env),
+    prebuiltCollectionsJson: getInput("prebuilt-collections-json", env),
     specId: getInput("spec-id", env),
     specContentChanged: parseBooleanInput(getInput("spec-content-changed", env), true),
     specPath: getInput("spec-path", env),
@@ -136432,7 +136771,7 @@ var StateUnreadableError = class extends Error {
 function readResourcesState() {
   let raw;
   try {
-    raw = (0, import_node_fs4.readFileSync)(".postman/resources.yaml", "utf8");
+    raw = (0, import_node_fs5.readFileSync)(".postman/resources.yaml", "utf8");
   } catch {
     return null;
   }
@@ -136491,12 +136830,15 @@ function getEnvironmentUidsFromResources(resourcesState) {
 function normalizeToPosix(filePath) {
   return filePath.split(path3.sep).join("/").replace(/\\/g, "/");
 }
+function canonicalizeRelativePath(value) {
+  return normalizeToPosix(String(value ?? "").trim()).replace(/^\.\/+/, "").replace(/\/{2,}/g, "/").replace(/\/+$/g, "");
+}
 function isOpenApiSpecFile(filePath) {
   if (!(filePath.endsWith(".json") || filePath.endsWith(".yaml") || filePath.endsWith(".yml"))) {
     return false;
   }
   try {
-    const raw = (0, import_node_fs4.readFileSync)(filePath, "utf8");
+    const raw = (0, import_node_fs5.readFileSync)(filePath, "utf8");
     const parsed = filePath.endsWith(".json") ? JSON.parse(raw) : load(raw);
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
       return false;
@@ -136525,7 +136867,7 @@ function scanLocalSpecReferences(baseDir = ".") {
   const found = /* @__PURE__ */ new Set();
   const refs = [];
   const visit2 = (currentDir) => {
-    for (const entry of (0, import_node_fs4.readdirSync)(currentDir, { withFileTypes: true })) {
+    for (const entry of (0, import_node_fs5.readdirSync)(currentDir, { withFileTypes: true })) {
       if (ignoredDirs.has(entry.name)) {
         continue;
       }
@@ -136555,7 +136897,7 @@ function resolveMappedSpecReference(explicitSpecPath, discoveredSpecs) {
   const normalizedExplicitPath = normalizeToPosix(explicitSpecPath.trim());
   if (normalizedExplicitPath) {
     const explicitFullPath = path3.resolve(normalizedExplicitPath);
-    if ((0, import_node_fs4.existsSync)(explicitFullPath) && (0, import_node_fs4.statSync)(explicitFullPath).isFile()) {
+    if ((0, import_node_fs5.existsSync)(explicitFullPath) && (0, import_node_fs5.statSync)(explicitFullPath).isFile()) {
       return {
         repoRelativePath: normalizedExplicitPath,
         configRelativePath: normalizeToPosix(path3.join("..", normalizedExplicitPath))
@@ -136681,6 +137023,7 @@ async function upsertEnvironments(inputs, dependencies, resourcesState, assetMar
         );
       }
       envUids[envName] = existingUid;
+      dependencies.core.setOutput("environment-uids-json", JSON.stringify(envUids));
       continue;
     }
     const values = buildEnvironmentValues(envName, runtimeUrl);
@@ -136691,6 +137034,7 @@ async function upsertEnvironments(inputs, dependencies, resourcesState, assetMar
         displayName,
         values
       );
+      dependencies.core.setOutput("environment-uids-json", JSON.stringify(envUids));
     } catch (error) {
       throw new Error(
         formatOrchestrationIssue({
@@ -136707,7 +137051,7 @@ async function upsertEnvironments(inputs, dependencies, resourcesState, assetMar
   return envUids;
 }
 function ensureDir(path5) {
-  (0, import_node_fs4.mkdirSync)(path5, { recursive: true });
+  (0, import_node_fs5.mkdirSync)(path5, { recursive: true });
 }
 function getCollectionDirectoryName(kind, projectName) {
   if (kind === "Baseline") {
@@ -136742,9 +137086,9 @@ function stripVolatileFields(obj) {
   }
   return obj;
 }
-function writeJsonFile(path5, content, normalize3 = false) {
-  const data = normalize3 ? stripVolatileFields(content) : content;
-  (0, import_node_fs4.writeFileSync)(path5, JSON.stringify(data, null, 2));
+function writeJsonFile(path5, content, normalize4 = false) {
+  const data = normalize4 ? stripVolatileFields(content) : content;
+  (0, import_node_fs5.writeFileSync)(path5, JSON.stringify(data, null, 2));
 }
 function buildMappedSpecCloudKey(mappedSource, specSyncMode, releaseLabel) {
   if (specSyncMode !== "version") {
@@ -136808,22 +137152,422 @@ function buildResourcesManifest(workspaceId, collectionMap, envMap, artifactDir,
     sortKeys: false
   });
 }
-function buildSpecCollectionWorkflowManifest(specRef, collectionRefs) {
-  return dump(
-    {
-      workflows: {
-        syncSpecToCollection: collectionRefs.map((collectionRef) => ({
-          spec: specRef,
-          collection: collectionRef
-        }))
+function isPlainObject2(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function buildSpecCollectionWorkflowManifest(specRef, collectionRefs, existingRaw) {
+  const pairs = collectionRefs.map((collectionRef) => ({
+    spec: specRef,
+    collection: collectionRef
+  }));
+  let root = {};
+  if (typeof existingRaw === "string" && existingRaw.trim()) {
+    let parsed;
+    try {
+      parsed = load(existingRaw);
+    } catch (error) {
+      throw new Error(
+        `CONTRACT_WORKFLOWS_UNREADABLE: .postman/workflows.yaml exists but is not parseable YAML (${error instanceof Error ? error.message : String(error)}). Fix or delete the file; refusing to overwrite unrelated workflow data.`,
+        { cause: error }
+      );
+    }
+    if (parsed === null || parsed === void 0) {
+      root = {};
+    } else if (!isPlainObject2(parsed)) {
+      throw new Error(
+        "CONTRACT_WORKFLOWS_UNREADABLE: .postman/workflows.yaml exists but does not contain a YAML mapping. Fix or delete the file; refusing to overwrite unrelated workflow data."
+      );
+    } else {
+      root = { ...parsed };
+    }
+  }
+  const workflows = isPlainObject2(root.workflows) ? { ...root.workflows } : {};
+  const desiredCollections = new Set(collectionRefs);
+  const currentPairs = (Array.isArray(workflows.syncSpecToCollection) ? workflows.syncSpecToCollection : []).map((entry) => isPlainObject2(entry) ? { ...entry } : null).filter((entry) => Boolean(entry)).filter(
+    (entry) => String(entry.spec ?? "") !== specRef || desiredCollections.has(String(entry.collection ?? ""))
+  );
+  for (const pair of pairs) {
+    const index = currentPairs.findIndex(
+      (entry) => String(entry.spec ?? "") === pair.spec && String(entry.collection ?? "") === pair.collection
+    );
+    if (index >= 0) {
+      const previous = currentPairs[index];
+      currentPairs[index] = { ...previous, spec: pair.spec, collection: pair.collection };
+    } else {
+      currentPairs.push({ spec: pair.spec, collection: pair.collection });
+    }
+  }
+  workflows.syncSpecToCollection = currentPairs;
+  root.workflows = workflows;
+  return dump(root, {
+    lineWidth: -1,
+    noRefs: true,
+    sortKeys: false
+  });
+}
+var PREBUILT_COLLECTION_ROLES = /* @__PURE__ */ new Set([
+  "baseline",
+  "smoke",
+  "contract"
+]);
+var SHA256_HEX = /^[a-f0-9]{64}$/;
+var PREBUILT_CLOUD_ID = /^[A-Za-z0-9][A-Za-z0-9._:-]*$/;
+function failPrebuiltCollections(detail) {
+  throw new Error(`CONTRACT_PREBUILT_COLLECTIONS_INVALID: ${detail}`);
+}
+function parsePrebuiltCollectionsJson(raw) {
+  const trimmed = String(raw ?? "").trim();
+  if (!trimmed) {
+    return [];
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(trimmed);
+  } catch (error) {
+    throw new Error(
+      `CONTRACT_PREBUILT_COLLECTIONS_INVALID: malformed JSON (${error instanceof Error ? error.message : String(error)})`,
+      { cause: error }
+    );
+  }
+  let entriesRaw;
+  if (Array.isArray(parsed)) {
+    entriesRaw = parsed;
+  } else if (isPlainObject2(parsed)) {
+    if (parsed.schemaVersion !== 1) {
+      failPrebuiltCollections("schemaVersion must be 1");
+    }
+    if (!Array.isArray(parsed.collections)) {
+      failPrebuiltCollections("collections must be an array when schemaVersion is set");
+    }
+    entriesRaw = parsed.collections;
+  } else {
+    failPrebuiltCollections("expected a JSON array or {schemaVersion:1,collections:[]}");
+  }
+  const seenRoles = /* @__PURE__ */ new Set();
+  const entries = [];
+  for (const [index, value] of entriesRaw.entries()) {
+    if (!isPlainObject2(value)) {
+      failPrebuiltCollections(`collections[${index}] must be an object`);
+    }
+    const roleRaw = String(value.role ?? "").trim();
+    if (!PREBUILT_COLLECTION_ROLES.has(roleRaw)) {
+      failPrebuiltCollections(
+        `collections[${index}].role must be one of baseline|smoke|contract`
+      );
+    }
+    const role = roleRaw;
+    if (seenRoles.has(role)) {
+      failPrebuiltCollections(`duplicate role ${role}`);
+    }
+    seenRoles.add(role);
+    const collectionPath = String(
+      value.collectionPath ?? value.path ?? ""
+    ).trim();
+    if (!collectionPath || hasControlCharacter2(collectionPath)) {
+      failPrebuiltCollections(
+        `collections[${index}].collectionPath must be a non-empty confined relative path`
+      );
+    }
+    const cloudId = String(value.cloudId ?? "").trim();
+    if (!cloudId || !PREBUILT_CLOUD_ID.test(cloudId)) {
+      failPrebuiltCollections(
+        `collections[${index}].cloudId must be a non-empty Postman collection id`
+      );
+    }
+    let payloadDigest;
+    if (Object.prototype.hasOwnProperty.call(value, "payloadDigest")) {
+      const payloadDigestRaw = value.payloadDigest;
+      if (payloadDigestRaw !== void 0 && payloadDigestRaw !== null) {
+        payloadDigest = String(payloadDigestRaw).trim();
+        if (!SHA256_HEX.test(payloadDigest)) {
+          failPrebuiltCollections(
+            `collections[${index}].payloadDigest must be lowercase 64-hex`
+          );
+        }
       }
-    },
-    {
-      lineWidth: -1,
-      noRefs: true,
-      sortKeys: false
     }
+    const artifactDigest = String(value.artifactDigest ?? "").trim();
+    if (!SHA256_HEX.test(artifactDigest)) {
+      failPrebuiltCollections(
+        `collections[${index}].artifactDigest must be lowercase 64-hex`
+      );
+    }
+    entries.push({
+      role,
+      collectionPath,
+      cloudId,
+      ...payloadDigest !== void 0 ? { payloadDigest } : {},
+      artifactDigest
+    });
+  }
+  return entries;
+}
+function assertPathWithinArtifactRoot(targetPath, artifactDir, fieldName) {
+  assertPathWithinCwd(targetPath, fieldName);
+  assertPathWithinCwd(artifactDir, "artifact-dir");
+  const cwd = (0, import_node_fs5.realpathSync)(process.cwd());
+  const artifactRoot = path3.resolve(cwd, artifactDir.trim());
+  const resolved = path3.resolve(cwd, targetPath.trim());
+  const relativeToArtifact = path3.relative(artifactRoot, resolved);
+  if (!relativeToArtifact || relativeToArtifact.startsWith("..") || path3.isAbsolute(relativeToArtifact)) {
+    failPrebuiltCollections(
+      `${fieldName} must stay under artifact-dir (${artifactDir}); received ${targetPath}`
+    );
+  }
+  let existingPath = resolved;
+  while (!(0, import_node_fs5.existsSync)(existingPath)) {
+    const parent = path3.dirname(existingPath);
+    if (parent === existingPath) {
+      break;
+    }
+    existingPath = parent;
+  }
+  const realExisting = (0, import_node_fs5.realpathSync)(existingPath);
+  const realRelative = path3.relative(artifactRoot, realExisting);
+  if (realRelative.startsWith("..") || path3.isAbsolute(realRelative)) {
+    failPrebuiltCollections(
+      `${fieldName} resolves outside artifact-dir via symlink; received ${targetPath}`
+    );
+  }
+  return normalizeToPosix(path3.relative(cwd, resolved));
+}
+function prebuiltDirectoryTraversalIdentity(absolutePath, stats, options = {}) {
+  const platform2 = options.platform ?? process.platform;
+  const inodeIsZero = stats.ino === 0 || stats.ino === 0n;
+  if (platform2 !== "win32" && !inodeIsZero) {
+    return `${stats.dev}:${stats.ino}`;
+  }
+  const resolveCanonicalPath = options.resolveCanonicalPath ?? ((candidate) => import_node_fs5.realpathSync.native(candidate));
+  const canonical = resolveCanonicalPath(absolutePath);
+  return platform2 === "win32" ? canonical.toLowerCase() : canonical;
+}
+function listPrebuiltCollectionTreeFiles(collectionPath, artifactDir) {
+  const confined = assertPathWithinArtifactRoot(
+    collectionPath,
+    artifactDir,
+    "prebuilt collection path"
   );
+  const absRoot = path3.resolve(process.cwd(), confined);
+  if (!(0, import_node_fs5.existsSync)(absRoot)) {
+    return [];
+  }
+  let rootStat;
+  try {
+    rootStat = (0, import_node_fs5.lstatSync)(absRoot);
+  } catch {
+    return [];
+  }
+  if (rootStat.isSymbolicLink()) {
+    failPrebuiltCollections(
+      `prebuilt collection path must not be a symlink; received ${collectionPath}`
+    );
+  }
+  if (!rootStat.isDirectory()) {
+    return [];
+  }
+  const files = [];
+  const pendingDirectories = [absRoot];
+  const seenDirectories = /* @__PURE__ */ new Set();
+  while (pendingDirectories.length > 0) {
+    const currentAbsolute = pendingDirectories.pop();
+    if (!currentAbsolute) {
+      break;
+    }
+    const currentStat = (0, import_node_fs5.lstatSync)(currentAbsolute);
+    if (currentStat.isSymbolicLink() || !currentStat.isDirectory()) {
+      failPrebuiltCollections(
+        `prebuilt collection tree directory changed or became unsupported at ${normalizeToPosix(path3.relative(absRoot, currentAbsolute)) || "."}`
+      );
+    }
+    const currentKey = prebuiltDirectoryTraversalIdentity(currentAbsolute, currentStat);
+    if (seenDirectories.has(currentKey)) {
+      failPrebuiltCollections(
+        `prebuilt collection tree directory cycle detected at ${normalizeToPosix(path3.relative(absRoot, currentAbsolute)) || "."}`
+      );
+    }
+    seenDirectories.add(currentKey);
+    const entries = (0, import_node_fs5.readdirSync)(currentAbsolute, { withFileTypes: true });
+    for (const entry of entries) {
+      const abs = path3.join(currentAbsolute, entry.name);
+      if (entry.isSymbolicLink()) {
+        failPrebuiltCollections(
+          `prebuilt collection tree must not contain symlinks; received ${normalizeToPosix(path3.relative(absRoot, abs))}`
+        );
+      }
+      if (entry.isDirectory()) {
+        pendingDirectories.push(abs);
+        continue;
+      }
+      if (!entry.isFile()) {
+        failPrebuiltCollections(
+          `prebuilt collection tree contains unsupported entry type at ${normalizeToPosix(path3.relative(absRoot, abs))}`
+        );
+      }
+      const fileLstat = (0, import_node_fs5.lstatSync)(abs);
+      if (fileLstat.isSymbolicLink() || !fileLstat.isFile()) {
+        failPrebuiltCollections(
+          `prebuilt collection tree file changed or became unsupported at ${normalizeToPosix(path3.relative(absRoot, abs))}`
+        );
+      }
+      files.push({
+        absolute: abs,
+        relative: normalizeToPosix(path3.relative(absRoot, abs)),
+        dev: fileLstat.dev,
+        ino: fileLstat.ino,
+        size: fileLstat.size
+      });
+    }
+  }
+  files.sort((a, b) => a.relative.localeCompare(b.relative));
+  return files;
+}
+function validateCanonicalV3CollectionFile(relative3, bytes) {
+  let expectedKind;
+  if (/(^|\/)\.resources\/definition\.yaml$/.test(relative3)) {
+    expectedKind = "collection";
+  } else if (relative3.endsWith(".request.yaml")) {
+    expectedKind = "request";
+  } else if (relative3.endsWith(".example.yaml")) {
+    expectedKind = "example";
+  } else if (relative3.endsWith(".message.yaml")) {
+    expectedKind = "message";
+  } else {
+    failPrebuiltCollections(`prebuilt collection tree contains unexpected file ${relative3}`);
+  }
+  let parsed;
+  try {
+    parsed = load(bytes.toString("utf8"));
+  } catch (error) {
+    failPrebuiltCollections(
+      `prebuilt collection tree contains malformed YAML at ${relative3} (${error instanceof Error ? error.message : String(error)})`
+    );
+  }
+  if (!isPlainObject2(parsed)) {
+    failPrebuiltCollections(`prebuilt collection tree file ${relative3} must contain a YAML mapping`);
+  }
+  const kind = typeof parsed.$kind === "string" ? parsed.$kind.trim() : "";
+  if (!kind) {
+    failPrebuiltCollections(`prebuilt collection tree file ${relative3} must contain a nonempty $kind`);
+  }
+  const agrees = expectedKind === "collection" ? kind === "collection" : kind.endsWith(`-${expectedKind}`);
+  if (!agrees) {
+    failPrebuiltCollections(
+      `prebuilt collection tree file ${relative3} has $kind ${kind} inconsistent with its filename`
+    );
+  }
+}
+async function digestAndValidatePrebuiltCollectionTree(files) {
+  if (!files.some((file) => file.relative === ".resources/definition.yaml")) {
+    failPrebuiltCollections("prebuilt collection tree is missing .resources/definition.yaml");
+  }
+  const hash = (0, import_node_crypto3.createHash)("sha256");
+  for (const file of files) {
+    let bytes;
+    try {
+      bytes = await appendArtifactDigestFileStreaming(hash, file.relative, file.absolute, {
+        dev: file.dev,
+        ino: file.ino,
+        size: file.size
+      });
+    } catch (error) {
+      if (error instanceof ArtifactDigestStreamError) {
+        failPrebuiltCollections(error.message);
+      }
+      const code = error?.code;
+      if (code === "ELOOP" || code === "EPERM") {
+        failPrebuiltCollections(
+          `prebuilt collection tree file became a symlink or unsupported node at ${file.relative}`
+        );
+      }
+      failPrebuiltCollections(
+        `prebuilt collection tree file changed or became unsupported at ${file.relative}`
+      );
+    }
+    validateCanonicalV3CollectionFile(file.relative, bytes);
+  }
+  return hash.digest("hex");
+}
+async function preparePrebuiltCollections(inputs) {
+  const prepared = /* @__PURE__ */ new Map();
+  for (const entry of parsePrebuiltCollectionsJson(inputs.prebuiltCollectionsJson ?? "")) {
+    const confinedPath = assertPathWithinArtifactRoot(
+      entry.collectionPath,
+      inputs.artifactDir,
+      `prebuilt ${entry.role} collection path`
+    );
+    const absolute = path3.resolve(process.cwd(), confinedPath);
+    if (!(0, import_node_fs5.existsSync)(absolute)) {
+      prepared.set(entry.role, { entry, confinedPath });
+      continue;
+    }
+    const files = listPrebuiltCollectionTreeFiles(confinedPath, inputs.artifactDir);
+    const artifactDigest = await digestAndValidatePrebuiltCollectionTree(files);
+    prepared.set(entry.role, {
+      entry,
+      confinedPath,
+      artifactDigest
+    });
+  }
+  return prepared;
+}
+function tryReusePrebuiltCollection(options) {
+  const { prepared, expectedPath, expectedCloudId } = options;
+  const { entry } = prepared;
+  if (!expectedCloudId || entry.cloudId !== expectedCloudId) {
+    return false;
+  }
+  const expectedNormalized = canonicalizeRelativePath(expectedPath);
+  const entryNormalized = canonicalizeRelativePath(entry.collectionPath);
+  if (entryNormalized !== expectedNormalized) {
+    return false;
+  }
+  const confined = canonicalizeRelativePath(prepared.confinedPath);
+  if (confined !== expectedNormalized) {
+    return false;
+  }
+  const expectedName = path3.posix.basename(expectedNormalized);
+  if (path3.posix.basename(confined) !== expectedName) {
+    return false;
+  }
+  return prepared.artifactDigest === entry.artifactDigest;
+}
+async function exportCollectionArtifact(options) {
+  const {
+    role,
+    collectionId,
+    dirName,
+    collectionsDir,
+    prebuiltByRole,
+    postman,
+    core
+  } = options;
+  if (!collectionId) {
+    return void 0;
+  }
+  const expectedPath = `${collectionsDir}/${dirName}`;
+  const entry = prebuiltByRole.get(role);
+  if (entry) {
+    const reused = tryReusePrebuiltCollection({
+      prepared: entry,
+      expectedPath,
+      expectedCloudId: collectionId
+    });
+    if (reused) {
+      core.info(
+        `Reusing prebuilt ${role} collection tree at ${expectedPath} (artifactDigest match)`
+      );
+      return `../${expectedPath}`;
+    }
+    core.info(
+      `Prebuilt ${role} collection entry present but did not exactly match; exporting from cloud`
+    );
+  }
+  const col = await postman.getCollection(collectionId);
+  await convertAndSplitAnyCollection(
+    col,
+    expectedPath
+  );
+  return `../${expectedPath}`;
 }
 function hasControlCharacter2(value) {
   for (let index = 0; index < value.length; index += 1) {
@@ -136841,21 +137585,21 @@ function assertPathWithinCwd(targetPath, fieldName) {
   if (!rawPath || hasControlCharacter2(originalPath) || path3.isAbsolute(rawPath) || path3.win32.isAbsolute(rawPath) || segments.includes("..") || rawPath.startsWith(":") || hasControlCharacter2(rawPath)) {
     throw new Error(`${fieldName} must stay within the repository root; received ${targetPath}`);
   }
-  const base = (0, import_node_fs4.realpathSync)(process.cwd());
+  const base = (0, import_node_fs5.realpathSync)(process.cwd());
   const resolved = path3.resolve(base, rawPath);
   const relative3 = path3.relative(base, resolved);
   if (relative3.startsWith("..") || path3.isAbsolute(relative3)) {
     throw new Error(`${fieldName} must stay within the repository root; received ${targetPath}`);
   }
   let existingPath = resolved;
-  while (!(0, import_node_fs4.existsSync)(existingPath)) {
+  while (!(0, import_node_fs5.existsSync)(existingPath)) {
     const parent = path3.dirname(existingPath);
     if (parent === existingPath) {
       break;
     }
     existingPath = parent;
   }
-  const realExistingPath = (0, import_node_fs4.realpathSync)(existingPath);
+  const realExistingPath = (0, import_node_fs5.realpathSync)(existingPath);
   const realRelative = path3.relative(base, realExistingPath);
   if (realRelative.startsWith("..") || path3.isAbsolute(realRelative)) {
     throw new Error(`${fieldName} must stay within the repository root; received ${targetPath}`);
@@ -136883,8 +137627,8 @@ async function exportArtifacts(inputs, dependencies, envUids, assetProjectName,
   ensureDir(specsDir);
   ensureDir(".postman");
   const globalsFilePath = `${globalsDir}/workspace.globals.yaml`;
-  if (!(0, import_node_fs4.existsSync)(globalsFilePath)) {
-    (0, import_node_fs4.writeFileSync)(globalsFilePath, "name: Globals\nvalues: []\n");
+  if (!(0, import_node_fs5.existsSync)(globalsFilePath)) {
+    (0, import_node_fs5.writeFileSync)(globalsFilePath, "name: Globals\nvalues: []\n");
   }
   if (inputs.generateCiWorkflow) {
     const ciDir = inputs.ciWorkflowPath.split("/").slice(0, -1).join("/");
@@ -136900,23 +137644,42 @@ async function exportArtifacts(inputs, dependencies, envUids, assetProjectName,
     inputs.specSyncMode,
     options.releaseLabel
   ) : void 0;
-  if (inputs.baselineCollectionId) {
-    const col = await dependencies.postman.getCollection(inputs.baselineCollectionId);
-    const dirName = getCollectionDirectoryName("Baseline", assetProjectName);
-    await convertAndSplitAnyCollection(col, `${collectionsDir}/${dirName}`);
-    manifestCollections[`../${collectionsDir}/${dirName}`] = inputs.baselineCollectionId;
-  }
-  if (inputs.smokeCollectionId) {
-    const col = await dependencies.postman.getCollection(inputs.smokeCollectionId);
-    const dirName = getCollectionDirectoryName("Smoke", assetProjectName);
-    await convertAndSplitAnyCollection(col, `${collectionsDir}/${dirName}`);
-    manifestCollections[`../${collectionsDir}/${dirName}`] = inputs.smokeCollectionId;
-  }
-  if (inputs.contractCollectionId) {
-    const col = await dependencies.postman.getCollection(inputs.contractCollectionId);
-    const dirName = getCollectionDirectoryName("Contract", assetProjectName);
-    await convertAndSplitAnyCollection(col, `${collectionsDir}/${dirName}`);
-    manifestCollections[`../${collectionsDir}/${dirName}`] = inputs.contractCollectionId;
+  const prebuiltByRole = options.preparedPrebuiltCollections;
+  const baselineRef = await exportCollectionArtifact({
+    role: "baseline",
+    collectionId: inputs.baselineCollectionId,
+    dirName: getCollectionDirectoryName("Baseline", assetProjectName),
+    collectionsDir,
+    prebuiltByRole,
+    postman: dependencies.postman,
+    core: dependencies.core
+  });
+  if (baselineRef) {
+    manifestCollections[baselineRef] = inputs.baselineCollectionId;
+  }
+  const smokeRef = await exportCollectionArtifact({
+    role: "smoke",
+    collectionId: inputs.smokeCollectionId,
+    dirName: getCollectionDirectoryName("Smoke", assetProjectName),
+    collectionsDir,
+    prebuiltByRole,
+    postman: dependencies.postman,
+    core: dependencies.core
+  });
+  if (smokeRef) {
+    manifestCollections[smokeRef] = inputs.smokeCollectionId;
+  }
+  const contractRef = await exportCollectionArtifact({
+    role: "contract",
+    collectionId: inputs.contractCollectionId,
+    dirName: getCollectionDirectoryName("Contract", assetProjectName),
+    collectionsDir,
+    prebuiltByRole,
+    postman: dependencies.postman,
+    core: dependencies.core
+  });
+  if (contractRef) {
+    manifestCollections[contractRef] = inputs.contractCollectionId;
   }
   for (const [envName, envUid] of Object.entries(envUids)) {
     writeJsonFile(
@@ -136931,7 +137694,7 @@ async function exportArtifacts(inputs, dependencies, envUids, assetProjectName,
     workspaceLinkEnabled: inputs.workspaceLinkEnabled,
     workspaceLinkStatus: options.workspaceLinkStatus
   });
-  (0, import_node_fs4.writeFileSync)(".postman/resources.yaml", buildResourcesManifest(
+  (0, import_node_fs5.writeFileSync)(".postman/resources.yaml", buildResourcesManifest(
     durableWorkspaceId,
     manifestCollections,
     envUids,
@@ -136943,11 +137706,18 @@ async function exportArtifacts(inputs, dependencies, envUids, assetProjectName,
     options.priorState
   ));
   if (mappedSpec && Object.keys(manifestCollections).length > 0) {
-    (0, import_node_fs4.writeFileSync)(
+    let existingWorkflows;
+    try {
+      existingWorkflows = (0, import_node_fs5.readFileSync)(".postman/workflows.yaml", "utf8");
+    } catch {
+      existingWorkflows = void 0;
+    }
+    (0, import_node_fs5.writeFileSync)(
       ".postman/workflows.yaml",
       buildSpecCollectionWorkflowManifest(
         mappedSpec.configRelativePath,
-        Object.keys(manifestCollections)
+        Object.keys(manifestCollections),
+        existingWorkflows
       )
     );
   }
@@ -136992,12 +137762,12 @@ async function commitAndPushGeneratedFiles(inputs, dependencies) {
       const dir = parts.slice(0, -1).join("/");
       ensureDir(dir);
     }
-    (0, import_node_fs4.writeFileSync)(inputs.ciWorkflowPath, ciWorkflow);
+    (0, import_node_fs5.writeFileSync)(inputs.ciWorkflowPath, ciWorkflow);
     if (inputs.provider === "github" || inputs.provider === "unknown") {
       const gcPath = ".github/workflows/postman-preview-gc.yml";
       if (inputs.ciWorkflowPath.endsWith(".github/workflows/ci.yml") || inputs.ciWorkflowPath === ".github/workflows/ci.yml") {
         ensureDir(".github/workflows");
-        (0, import_node_fs4.writeFileSync)(gcPath, renderGcWorkflowTemplate());
+        (0, import_node_fs5.writeFileSync)(gcPath, renderGcWorkflowTemplate());
       }
     }
   }
@@ -137005,16 +137775,16 @@ async function commitAndPushGeneratedFiles(inputs, dependencies) {
     return { commitSha: "", resolvedCurrentRef: "", pushed: false };
   }
   const provisionPath = ".github/workflows/provision.yml";
-  const provisionExists = inputs.provider === "github" && (0, import_node_fs4.existsSync)(provisionPath);
+  const provisionExists = inputs.provider === "github" && (0, import_node_fs5.existsSync)(provisionPath);
   const gcWorkflowPath = ".github/workflows/postman-preview-gc.yml";
-  const gcExists = inputs.generateCiWorkflow && (0, import_node_fs4.existsSync)(gcWorkflowPath);
+  const gcExists = inputs.generateCiWorkflow && (0, import_node_fs5.existsSync)(gcWorkflowPath);
   const stagePaths = [
     inputs.artifactDir,
     ".postman",
     inputs.generateCiWorkflow ? inputs.ciWorkflowPath : null,
     gcExists ? gcWorkflowPath : null,
     provisionExists ? provisionPath : null
-  ].filter((entry) => typeof entry === "string" && ((0, import_node_fs4.existsSync)(entry) || entry === provisionPath));
+  ].filter((entry) => typeof entry === "string" && ((0, import_node_fs5.existsSync)(entry) || entry === provisionPath));
   if (stagePaths.length === 0) {
     dependencies.core.info("No generated repository paths were found; skipping repo mutation.");
     return {
@@ -137122,6 +137892,7 @@ async function runRepoSyncInner(inputs, dependencies) {
       }
     }
   }
+  const preparedPrebuiltCollections = await preparePrebuiltCollections(inputs);
   let skipRepositoryLinkPost = false;
   let repositoryLinkPreflightWasFree = false;
   if (inputs.workspaceLinkEnabled && inputs.workspaceId && inputs.repoUrl && dependencies.internalIntegration?.findWorkspaceForRepo) {
@@ -137158,6 +137929,7 @@ async function runRepoSyncInner(inputs, dependencies) {
   const branchAssetMarker = buildBranchAssetMarker(branchDecision, inputs);
   const envUids = await upsertEnvironments(inputs, dependencies, resourcesState, branchAssetMarker);
   outputs["environment-uids-json"] = JSON.stringify(envUids);
+  dependencies.core.setOutput("environment-uids-json", outputs["environment-uids-json"]);
   if (inputs.environmentSyncEnabled && inputs.workspaceId && dependencies.internalIntegration) {
     const associations = Object.entries(envUids).map(([envName, envUid]) => ({
       envUid,
@@ -137276,6 +138048,7 @@ async function runRepoSyncInner(inputs, dependencies) {
         }
       }
       outputs["mock-url"] = resolvedMockUrl;
+      dependencies.core.setOutput("mock-url", resolvedMockUrl);
     }
   }
   if (inputs.workspaceId && inputs.smokeCollectionId && Object.keys(envUids).length > 0) {
@@ -137351,6 +138124,7 @@ async function runRepoSyncInner(inputs, dependencies) {
         }
       }
       outputs["monitor-id"] = resolvedMonitorId;
+      dependencies.core.setOutput("monitor-id", resolvedMonitorId);
       if (!effectiveCron && resolvedMonitorId) {
         try {
           await dependencies.postman.runMonitor(resolvedMonitorId);
@@ -137408,7 +138182,8 @@ async function runRepoSyncInner(inputs, dependencies) {
     priorWorkspaceId: resourcesState?.workspace?.id,
     existingSpecs: resourcesState?.cloudResources?.specs,
     releaseLabel,
-    priorState: resourcesState
+    priorState: resourcesState,
+    preparedPrebuiltCollections
   });
   const commit = await commitAndPushGeneratedFiles(inputs, dependencies);
   outputs["commit-sha"] = commit.commitSha;
@@ -137634,7 +138409,12 @@ async function resolvePostmanApiKeyAndTeamId(inputs, actionCore, actionExec, mas
         bifrostBaseUrl: inputs.postmanBifrostBase,
         // No fallback on the org-mode probe: the expected non-org 400 must
         // surface verbatim, not be re-fired against the /_api alias.
-        secretMasker: masker
+        secretMasker: masker,
+        onRetryEvent: (event) => {
+          actionCore.info(
+            `[postman retry] action=repo-sync class=${event.class} status=${event.status ?? "none"} attempt=${event.attempt} delayMs=${event.delay}`
+          );
+        }
       });
       const squads = await gateway.getSquads(teamId);
       if (squads.length > 0) {
@@ -137698,7 +138478,12 @@ function createRepoSyncDependencies(inputs, resolved, factories, options = {}) {
     fallbackBaseUrl: inputs.postmanFallbackBase,
     teamId: resolved.teamId,
     orgMode: inputs.orgMode,
-    secretMasker: masker
+    secretMasker: masker,
+    onRetryEvent: (event) => {
+      factories.core.info(
+        `[postman retry] action=repo-sync class=${event.class} status=${event.status ?? "none"} attempt=${event.attempt} delayMs=${event.delay}`
+      );
+    }
   });
   const gatewayAssets = new PostmanGatewayAssetsClient({
     gateway,
@@ -137766,7 +138551,8 @@ function createRepoSyncDependencies(inputs, resolved, factories, options = {}) {
     bifrostBaseUrl: inputs.postmanBifrostBase,
     orgMode: inputs.orgMode,
     teamId: resolved.teamId,
-    secretMasker: masker
+    secretMasker: masker,
+    gateway
   });
   return {
     teamId: resolved.teamId,
@@ -138180,6 +138966,7 @@ var CLI_INPUT_NAMES = [
   "baseline-collection-id",
   "smoke-collection-id",
   "contract-collection-id",
+  "prebuilt-collections-json",
   "collection-sync-mode",
   "spec-sync-mode",
   "release-label",
@@ -138251,17 +139038,38 @@ Examples:
   postman-repo-sync --repo-write-mode none --workspace-id <id> ...
 `;
 var ConsoleReporter = class {
+  constructor(onOutput) {
+    this.onOutput = onOutput;
+  }
+  onOutput;
   info(message) {
     console.error(message);
   }
   warning(message) {
     console.error(`warning: ${message}`);
   }
-  setOutput() {
+  retryEvent(event) {
+    this.info(
+      `[postman retry] action=repo-sync class=${event.class} status=${event.status ?? "none"} attempt=${event.attempt} delayMs=${event.delay}`
+    );
+  }
+  setOutput(name, value) {
+    this.onOutput?.(name, value);
   }
   setSecret() {
   }
 };
+async function timedStage(reporter, stage, operation) {
+  const started = performance.now();
+  try {
+    const result = await operation();
+    reporter.info(`[repo-sync timing] ${JSON.stringify({ stage, ms: Math.max(0, performance.now() - started), status: "success" })}`);
+    return result;
+  } catch (error) {
+    reporter.info(`[repo-sync timing] ${JSON.stringify({ stage, ms: Math.max(0, performance.now() - started), status: "error" })}`);
+    throw error;
+  }
+}
 function normalizeCliFlag(name) {
   return `INPUT_${name.replace(/-/g, "_").toUpperCase()}`;
 }
@@ -138335,7 +139143,7 @@ function resolvePackageVersion() {
   candidates.push(import_node_path3.default.join(process.cwd(), "package.json"));
   for (const packageJsonPath of candidates) {
     try {
-      const packageJson = JSON.parse((0, import_node_fs5.readFileSync)(packageJsonPath, "utf8"));
+      const packageJson = JSON.parse((0, import_node_fs6.readFileSync)(packageJsonPath, "utf8"));
       if (packageJson.name === "@postman-cse/onboarding-repo-sync" && packageJson.version) {
         return String(packageJson.version).trim();
       }
@@ -138446,20 +139254,107 @@ function toDotenv(outputs) {
     String(value ?? "")
   ]).map(([key, value]) => `${key}=${JSON.stringify(value)}`).join("\n");
 }
-async function writeOptionalFile(filePath, content) {
-  if (!filePath) {
-    return;
-  }
-  const workspaceRoot = import_node_path3.default.resolve(process.cwd());
+function assertOutputFileAllowed(filePath) {
+  const workspaceRoot = (0, import_node_fs6.realpathSync)(import_node_path3.default.resolve(process.cwd()));
   const resolved = import_node_path3.default.resolve(workspaceRoot, filePath);
   const relative3 = import_node_path3.default.relative(workspaceRoot, resolved);
   if (relative3.startsWith("..") || import_node_path3.default.isAbsolute(relative3)) {
     throw new Error(`Output path must stay within workspace: ${filePath}`);
   }
-  await (0, import_promises.mkdir)(import_node_path3.default.dirname(resolved), { recursive: true });
+  let existingParent = import_node_path3.default.dirname(resolved);
+  while (!(0, import_node_fs6.existsSync)(existingParent)) {
+    const parent = import_node_path3.default.dirname(existingParent);
+    if (parent === existingParent) break;
+    existingParent = parent;
+  }
+  const parentReal = (0, import_node_fs6.realpathSync)(existingParent);
+  const parentRelative = import_node_path3.default.relative(workspaceRoot, parentReal);
+  if (parentRelative.startsWith("..") || import_node_path3.default.isAbsolute(parentRelative)) {
+    throw new Error(`Output path must stay within workspace: ${filePath}`);
+  }
+  if ((0, import_node_fs6.existsSync)(resolved) || (() => {
+    try {
+      (0, import_node_fs6.lstatSync)(resolved);
+      return true;
+    } catch {
+      return false;
+    }
+  })()) {
+    const targetReal = (0, import_node_fs6.realpathSync)(resolved);
+    const targetRelative = import_node_path3.default.relative(workspaceRoot, targetReal);
+    if (targetRelative.startsWith("..") || import_node_path3.default.isAbsolute(targetRelative)) {
+      throw new Error(`Output path must stay within workspace: ${filePath}`);
+    }
+  }
+  return { resolved, directory: import_node_path3.default.dirname(resolved) };
+}
+function resolveSymlinkAwarePath(filePath) {
+  const workspaceRoot = (0, import_node_fs6.realpathSync)(import_node_path3.default.resolve(process.cwd()));
+  const resolved = import_node_path3.default.resolve(workspaceRoot, filePath);
+  let existing = resolved;
+  while (!(0, import_node_fs6.existsSync)(existing)) {
+    const parent = import_node_path3.default.dirname(existing);
+    if (parent === existing) break;
+    existing = parent;
+  }
+  return import_node_path3.default.resolve((0, import_node_fs6.realpathSync)(existing), import_node_path3.default.relative(existing, resolved));
+}
+function assertResultPathOutsideGeneratedPaths(resultJsonPath, inputs) {
+  const result = assertOutputFileAllowed(resultJsonPath).resolved;
+  const resultReal = resolveSymlinkAwarePath(result);
+  for (const root of [inputs.artifactDir, ".postman"].map(resolveSymlinkAwarePath)) {
+    const relative3 = import_node_path3.default.relative(root, resultReal);
+    if (!relative3 || !relative3.startsWith("..") && !import_node_path3.default.isAbsolute(relative3)) {
+      throw new Error(
+        `--result-json must not overlap a generated or staged repository path: ${resultJsonPath}`
+      );
+    }
+  }
+  const generatedFiles = [];
+  if (inputs.generateCiWorkflow) {
+    generatedFiles.push(inputs.ciWorkflowPath);
+    if ((inputs.provider === "github" || inputs.provider === "unknown") && (inputs.ciWorkflowPath.endsWith(".github/workflows/ci.yml") || inputs.ciWorkflowPath === ".github/workflows/ci.yml")) {
+      generatedFiles.push(".github/workflows/postman-preview-gc.yml");
+    }
+  }
+  if (inputs.provider === "github" && (0, import_node_fs6.existsSync)(".github/workflows/provision.yml")) {
+    generatedFiles.push(".github/workflows/provision.yml");
+  }
+  for (const generatedFile of generatedFiles) {
+    if (resultReal === resolveSymlinkAwarePath(generatedFile)) {
+      throw new Error(
+        `--result-json must not overlap a generated or staged repository path: ${resultJsonPath}`
+      );
+    }
+  }
+}
+async function writeOptionalFile(filePath, content) {
+  if (!filePath) {
+    return;
+  }
+  const { resolved, directory } = assertOutputFileAllowed(filePath);
+  await (0, import_promises.mkdir)(directory, { recursive: true });
+  const validated = assertOutputFileAllowed(filePath);
+  if (validated.resolved !== resolved) throw new Error(`Output path changed during validation: ${filePath}`);
   await (0, import_promises.writeFile)(resolved, content, "utf8");
 }
-function createCliDependencies(inputs, resolved) {
+function writeOptionalFileAtomic(filePath, content) {
+  if (!filePath) return;
+  const { resolved, directory } = assertOutputFileAllowed(filePath);
+  (0, import_node_fs6.mkdirSync)(directory, { recursive: true });
+  const validated = assertOutputFileAllowed(filePath);
+  const temporaryDirectory = (0, import_node_fs6.mkdtempSync)(
+    import_node_path3.default.join((0, import_node_fs6.realpathSync)(validated.directory), `.${import_node_path3.default.basename(resolved)}.`)
+  );
+  const temporary = import_node_path3.default.join(temporaryDirectory, import_node_path3.default.basename(resolved));
+  try {
+    (0, import_node_fs6.writeFileSync)(temporary, content, "utf8");
+    (0, import_node_fs6.renameSync)(temporary, resolved);
+  } finally {
+    (0, import_node_fs6.rmSync)(temporaryDirectory, { recursive: true, force: true });
+  }
+}
+function createCliDependencies(inputs, resolved, reporter = new ConsoleReporter()) {
   const secretMasker = createSecretMasker([
     resolved.apiKey,
     inputs.postmanAccessToken,
@@ -138476,7 +139371,7 @@ function createCliDependencies(inputs, resolved) {
     inputs,
     resolved,
     {
-      core: new ConsoleReporter(),
+      core: reporter,
       exec: cliExec
     },
     {
@@ -138506,17 +139401,24 @@ async function runCli(argv = process.argv.slice(2), runtime = {}) {
   }
   const config = parseCliArgs(argv, env);
   const inputs = resolveInputs(config.inputEnv);
-  const reporter = new ConsoleReporter();
   const branchDecision = decideBranchTier(inputs, config.inputEnv);
+  if (branchDecision.tier !== "gated") {
+    assertResultPathOutsideGeneratedPaths(config.resultJsonPath, inputs);
+  }
+  const partialOutputs = {};
+  const reporter = new ConsoleReporter((name, value) => {
+    partialOutputs[name] = String(value ?? "");
+    writeOptionalFileAtomic(config.resultJsonPath, JSON.stringify(partialOutputs, null, 2));
+  });
   if (branchDecision.tier === "gated") {
     const result2 = runGatedSkip(inputs, branchDecision, reporter);
-    await writeOptionalFile(config.resultJsonPath, JSON.stringify(result2, null, 2));
+    writeOptionalFileAtomic(config.resultJsonPath, JSON.stringify(result2, null, 2));
     await writeOptionalFile(config.dotenvPath, toDotenv(result2));
     writeStdout(`${JSON.stringify(result2, null, 2)}
 `);
     return;
   }
-  await mintAccessTokenIfNeeded(inputs, reporter);
+  await timedStage(reporter, "access-token mint", () => mintAccessTokenIfNeeded(inputs, reporter));
   const initialMasker = createSecretMasker([
     inputs.postmanApiKey,
     inputs.postmanAccessToken,
@@ -138528,7 +139430,7 @@ async function runCli(argv = process.argv.slice(2), runtime = {}) {
     inputs.sslClientPassphrase,
     inputs.sslExtraCaCerts
   ]);
-  await runCredentialPreflight({
+  await timedStage(reporter, "credential preflight", () => runCredentialPreflight({
     apiBaseUrl: inputs.postmanApiBase,
     iapubBaseUrl: inputs.postmanIapubBase,
     postmanApiKey: inputs.postmanApiKey,
@@ -138537,9 +139439,9 @@ async function runCli(argv = process.argv.slice(2), runtime = {}) {
     mode: inputs.credentialPreflight,
     mask: initialMasker,
     log: reporter
-  });
+  }));
   const resolvingExec = createCliExec(initialMasker);
-  const resolved = await resolvePostmanApiKeyAndTeamId(
+  const resolved = await timedStage(reporter, "API-key/team resolution", () => resolvePostmanApiKeyAndTeamId(
     inputs,
     reporter,
     resolvingExec,
@@ -138548,8 +139450,8 @@ async function runCli(argv = process.argv.slice(2), runtime = {}) {
       persistGeneratedApiKeySecret: false,
       env
     }
-  );
-  const dependencies = createCliDependencies(inputs, resolved);
+  ));
+  const dependencies = createCliDependencies(inputs, resolved, reporter);
   if (inputs.environmentSyncEnabled && !dependencies.internalIntegration) {
     dependencies.core.warning(
       "Skipping system environment association because postman-access-token is not configured"
@@ -138560,8 +139462,12 @@ async function runCli(argv = process.argv.slice(2), runtime = {}) {
       "Skipping workspace linking because postman-access-token is not configured"
     );
   }
-  const result = await (runtime.executeRepoSync ?? runRepoSync)(inputs, dependencies);
-  await writeOptionalFile(config.resultJsonPath, JSON.stringify(result, null, 2));
+  const result = await timedStage(
+    reporter,
+    "runRepoSync finalize",
+    () => (runtime.executeRepoSync ?? runRepoSync)(inputs, dependencies)
+  );
+  writeOptionalFileAtomic(config.resultJsonPath, JSON.stringify(result, null, 2));
   await writeOptionalFile(config.dotenvPath, toDotenv(result));
   writeStdout(`${JSON.stringify(result, null, 2)}
 `);
@@ -138647,7 +139553,7 @@ function isEntrypoint(currentPath, entrypointPath) {
     return false;
   }
   try {
-    return (0, import_node_fs5.realpathSync)(currentPath) === (0, import_node_fs5.realpathSync)(entrypointPath);
+    return (0, import_node_fs6.realpathSync)(currentPath) === (0, import_node_fs6.realpathSync)(entrypointPath);
   } catch {
     return import_node_path3.default.resolve(currentPath) === import_node_path3.default.resolve(entrypointPath);
   }
@@ -138668,7 +139574,8 @@ if (isEntrypoint(currentModulePath, entrypoint)) {
   normalizeCliFlag,
   parseCliArgs,
   runCli,
-  toDotenv
+  toDotenv,
+  writeOptionalFileAtomic
 });
 /*! Bundled license information: