@postman-cse/onboarding-repo-sync 2.1.10 → 2.1.14

package/dist/index.cjs

@@ -19746,7 +19746,7 @@ var require_response = __commonJS({
     var assert = require("node:assert");
     var { isomorphicEncode, serializeJavascriptValueToJSONString } = require_infra();
     var textEncoder = new TextEncoder("utf-8");
-    var Response = class _Response {
+    var Response2 = class _Response {
       /** @type {Headers} */
       #headers;
       #state;
@@ -19916,13 +19916,13 @@ var require_response = __commonJS({
         response.#state = newState;
       }
     };
-    var { getResponseHeaders, setResponseHeaders, getResponseState, setResponseState } = Response;
-    Reflect.deleteProperty(Response, "getResponseHeaders");
-    Reflect.deleteProperty(Response, "setResponseHeaders");
-    Reflect.deleteProperty(Response, "getResponseState");
-    Reflect.deleteProperty(Response, "setResponseState");
-    mixinBody(Response, getResponseState);
-    Object.defineProperties(Response.prototype, {
+    var { getResponseHeaders, setResponseHeaders, getResponseState, setResponseState } = Response2;
+    Reflect.deleteProperty(Response2, "getResponseHeaders");
+    Reflect.deleteProperty(Response2, "setResponseHeaders");
+    Reflect.deleteProperty(Response2, "getResponseState");
+    Reflect.deleteProperty(Response2, "setResponseState");
+    mixinBody(Response2, getResponseState);
+    Object.defineProperties(Response2.prototype, {
       type: kEnumerableProperty,
       url: kEnumerableProperty,
       status: kEnumerableProperty,
@@ -19938,7 +19938,7 @@ var require_response = __commonJS({
         configurable: true
       }
     });
-    Object.defineProperties(Response, {
+    Object.defineProperties(Response2, {
       json: kEnumerableProperty,
       redirect: kEnumerableProperty,
       error: kEnumerableProperty
@@ -20071,7 +20071,7 @@ var require_response = __commonJS({
       }
     }
     function fromInnerResponse(innerResponse, guard) {
-      const response = new Response(kConstruct);
+      const response = new Response2(kConstruct);
       setResponseState(response, innerResponse);
       const headers = new Headers3(kConstruct);
       setResponseHeaders(response, headers);
@@ -20125,14 +20125,14 @@ var require_response = __commonJS({
         converter: webidl.converters.HeadersInit
       }
     ]);
-    webidl.is.Response = webidl.util.MakeTypeAssertion(Response);
+    webidl.is.Response = webidl.util.MakeTypeAssertion(Response2);
     module2.exports = {
       isNetworkError,
       makeNetworkError,
       makeResponse,
       makeAppropriateNetworkError,
       filterResponse,
-      Response,
+      Response: Response2,
       cloneResponse,
       fromInnerResponse,
       getResponseState
@@ -26570,7 +26570,7 @@ var require_util7 = __commonJS({
     exports2.esc = esc;
     exports2.slugify = slugify;
     exports2.isObject = isObject;
-    exports2.isPlainObject = isPlainObject2;
+    exports2.isPlainObject = isPlainObject3;
     exports2.shallowClone = shallowClone;
     exports2.numKeys = numKeys;
     exports2.escapeRegex = escapeRegex;
@@ -26753,7 +26753,7 @@ var require_util7 = __commonJS({
         return false;
       }
     });
-    function isPlainObject2(o) {
+    function isPlainObject3(o) {
       if (isObject(o) === false)
         return false;
       const ctor = o.constructor;
@@ -26770,7 +26770,7 @@ var require_util7 = __commonJS({
       return true;
     }
     function shallowClone(o) {
-      if (isPlainObject2(o))
+      if (isPlainObject3(o))
         return { ...o };
       if (Array.isArray(o))
         return [...o];
@@ -26975,7 +26975,7 @@ var require_util7 = __commonJS({
       return clone(schema, def);
     }
     function extend(schema, shape) {
-      if (!isPlainObject2(shape)) {
+      if (!isPlainObject3(shape)) {
         throw new Error("Invalid input to extend: expected a plain object");
       }
       const checks = schema._zod.def.checks;
@@ -26998,7 +26998,7 @@ var require_util7 = __commonJS({
       return clone(schema, def);
     }
     function safeExtend(schema, shape) {
-      if (!isPlainObject2(shape)) {
+      if (!isPlainObject3(shape)) {
         throw new Error("Invalid input to safeExtend: expected a plain object");
       }
       const def = mergeDefs(schema._zod.def, {
@@ -54817,7 +54817,7 @@ var require_lodash = __commonJS({
               } else {
                 newValue = [];
               }
-            } else if (isPlainObject2(srcValue) || isArguments(srcValue)) {
+            } else if (isPlainObject3(srcValue) || isArguments(srcValue)) {
               newValue = objValue;
               if (isArguments(objValue)) {
                 newValue = toPlainObject(objValue);
@@ -55781,7 +55781,7 @@ var require_lodash = __commonJS({
           return objValue;
         }
         function customOmitClone(value) {
-          return isPlainObject2(value) ? undefined2 : value;
+          return isPlainObject3(value) ? undefined2 : value;
         }
         function equalArrays(array, other, bitmask, customizer, equalFunc, stack) {
           var isPartial = bitmask & COMPARE_PARTIAL_FLAG, arrLength = array.length, othLength = other.length;
@@ -57282,7 +57282,7 @@ var require_lodash = __commonJS({
         var isBuffer = nativeIsBuffer || stubFalse;
         var isDate = nodeIsDate ? baseUnary(nodeIsDate) : baseIsDate;
         function isElement(value) {
-          return isObjectLike(value) && value.nodeType === 1 && !isPlainObject2(value);
+          return isObjectLike(value) && value.nodeType === 1 && !isPlainObject3(value);
         }
         function isEmpty(value) {
           if (value == null) {
@@ -57318,7 +57318,7 @@ var require_lodash = __commonJS({
             return false;
           }
           var tag = baseGetTag(value);
-          return tag == errorTag || tag == domExcTag || typeof value.message == "string" && typeof value.name == "string" && !isPlainObject2(value);
+          return tag == errorTag || tag == domExcTag || typeof value.message == "string" && typeof value.name == "string" && !isPlainObject3(value);
         }
         function isFinite2(value) {
           return typeof value == "number" && nativeIsFinite(value);
@@ -57369,7 +57369,7 @@ var require_lodash = __commonJS({
         function isNumber(value) {
           return typeof value == "number" || isObjectLike(value) && baseGetTag(value) == numberTag;
         }
-        function isPlainObject2(value) {
+        function isPlainObject3(value) {
           if (!isObjectLike(value) || baseGetTag(value) != objectTag) {
             return false;
           }
@@ -58440,7 +58440,7 @@ var require_lodash = __commonJS({
         lodash.isNumber = isNumber;
         lodash.isObject = isObject;
         lodash.isObjectLike = isObjectLike;
-        lodash.isPlainObject = isPlainObject2;
+        lodash.isPlainObject = isPlainObject3;
         lodash.isRegExp = isRegExp;
         lodash.isSafeInteger = isSafeInteger;
         lodash.isSet = isSet;
@@ -99440,7 +99440,7 @@ var require_response2 = __commonJS({
       }
       return stream;
     };
-    var Response;
+    var Response2;
     _.inherit(
       /**
        * Response holds data related to the request body. By default, it provides a nice wrapper for url-encoded,
@@ -99451,14 +99451,14 @@ var require_response2 = __commonJS({
        *
        * @param {Response.definition} options -
        */
-      Response = function PostmanResponse(options) {
-        Response.super_.apply(this, arguments);
+      Response2 = function PostmanResponse(options) {
+        Response2.super_.apply(this, arguments);
         this.update(options || {});
       },
       Property
     );
     _.assign(
-      Response.prototype,
+      Response2.prototype,
       /** @lends Response.prototype */
       {
         update(options) {
@@ -99524,7 +99524,7 @@ var require_response2 = __commonJS({
       }
     );
     _.assign(
-      Response.prototype,
+      Response2.prototype,
       /** @lends Response.prototype */
       {
         /**
@@ -99702,7 +99702,7 @@ var require_response2 = __commonJS({
       }
     );
     _.assign(
-      Response,
+      Response2,
       /** @lends Response */
       {
         /**
@@ -99720,7 +99720,7 @@ var require_response2 = __commonJS({
          * @returns {Boolean}
          */
         isResponse: function(obj) {
-          return Boolean(obj) && (obj instanceof Response || _.inSuperChain(obj.constructor, "_postman_propertyName", Response._postman_propertyName));
+          return Boolean(obj) && (obj instanceof Response2 || _.inSuperChain(obj.constructor, "_postman_propertyName", Response2._postman_propertyName));
         },
         /**
          * Converts the response object from the request module to the postman responseBody format
@@ -99731,7 +99731,7 @@ var require_response2 = __commonJS({
          * @todo Add a key: `originalRequest` to the returned object as well, referring to response.request
          */
         createFromNode: function(response, cookies) {
-          return new Response({
+          return new Response2({
             cookie: cookies,
             body: response.body.toString(),
             stream: response.body,
@@ -99810,7 +99810,7 @@ var require_response2 = __commonJS({
       }
     );
     module2.exports = {
-      Response
+      Response: Response2
     };
   }
 });
@@ -99824,7 +99824,7 @@ var require_item = __commonJS({
     var EventList = require_event_list().EventList;
     var Request = require_request13().Request;
     var RequestAuth = require_request_auth().RequestAuth;
-    var Response = require_response2().Response;
+    var Response2 = require_response2().Response;
     var Item;
     var OBJECT = "object";
     var STRING = "string";
@@ -99891,7 +99891,7 @@ var require_item = __commonJS({
              *
              * @type {PropertyList<Response>}
              */
-            responses: new PropertyList(Response, this, definition && definition.response),
+            responses: new PropertyList(Response2, this, definition && definition.response),
             /**
              * Events are a set of of {@link Script}s that are executed when certain activities are triggered on an
              * Item. For example, on defining an event that listens to the "test" event, would cause the associated
@@ -128815,6 +128815,7 @@ __export(index_exports, {
   decideBranchTier: () => decideBranchTier,
   getInput: () => getInput2,
   hasInput: () => hasInput,
+  prebuiltDirectoryTraversalIdentity: () => prebuiltDirectoryTraversalIdentity,
   readActionInputs: () => readActionInputs,
   resolveInputs: () => resolveInputs,
   resolvePostmanApiKeyAndTeamId: () => resolvePostmanApiKeyAndTeamId,
@@ -131103,7 +131104,8 @@ function getIDToken(aud) {
 }
 
 // src/index.ts
-var import_node_fs4 = require("node:fs");
+var import_node_crypto4 = require("node:crypto");
+var import_node_fs5 = require("node:fs");
 var path8 = __toESM(require("node:path"), 1);
 
 // node_modules/js-yaml/dist/js-yaml.mjs
@@ -134019,6 +134021,7 @@ function dump(input, options = {}) {
 }
 
 // src/postman-v3/converter.ts
+var import_node_fs = require("node:fs");
 var fs3 = __toESM(require("node:fs/promises"), 1);
 var path6 = __toESM(require("node:path"), 1);
 var V2 = __toESM(require_v2(), 1);
@@ -134089,6 +134092,72 @@ function structuredCloneSafe(value) {
   if (typeof structuredClone === "function") return structuredClone(value);
   return JSON.parse(JSON.stringify(value));
 }
+var ArtifactDigestStreamError = class extends Error {
+  code = "ARTIFACT_DIGEST_STREAM";
+  constructor(message, options) {
+    super(message, options);
+    this.name = "ArtifactDigestStreamError";
+  }
+};
+function sameFileIdentity(left, right) {
+  return left.dev === right.dev && left.ino === right.ino && left.size === right.size;
+}
+async function appendArtifactDigestFileStreaming(hash, relative4, absolute, expected) {
+  const flags = typeof import_node_fs.constants.O_NOFOLLOW === "number" ? import_node_fs.constants.O_RDONLY | import_node_fs.constants.O_NOFOLLOW : import_node_fs.constants.O_RDONLY;
+  let handle;
+  try {
+    handle = await fs3.open(absolute, flags);
+  } catch (error2) {
+    const code = error2?.code;
+    if (code === "ELOOP" || code === "EMLINK" || code === "EINVAL") {
+      throw new ArtifactDigestStreamError(
+        `prebuilt collection tree file became a symlink or unsupported node at ${relative4}`,
+        { cause: error2 }
+      );
+    }
+    throw new ArtifactDigestStreamError(
+      `prebuilt collection tree file changed or became unsupported at ${relative4}`,
+      { cause: error2 }
+    );
+  }
+  try {
+    const before = await handle.stat();
+    if (!before.isFile() || !sameFileIdentity(before, expected)) {
+      throw new ArtifactDigestStreamError(
+        `prebuilt collection tree file changed or became unsupported at ${relative4}`
+      );
+    }
+    hash.update(relative4);
+    hash.update("\0");
+    const content = Buffer.allocUnsafe(expected.size);
+    let total = 0;
+    const buffer = Buffer.alloc(64 * 1024);
+    for (; ; ) {
+      const { bytesRead } = await handle.read(buffer, 0, buffer.length, null);
+      if (bytesRead === 0) {
+        break;
+      }
+      if (total + bytesRead > expected.size) {
+        throw new ArtifactDigestStreamError(
+          `prebuilt collection tree file changed while reading at ${relative4}`
+        );
+      }
+      buffer.copy(content, total, 0, bytesRead);
+      hash.update(buffer.subarray(0, bytesRead));
+      total += bytesRead;
+    }
+    hash.update("\0");
+    const after = await handle.stat();
+    if (!after.isFile() || !sameFileIdentity(after, expected) || total !== expected.size) {
+      throw new ArtifactDigestStreamError(
+        `prebuilt collection tree file changed while reading at ${relative4}`
+      );
+    }
+    return total === expected.size ? content : content.subarray(0, total);
+  } finally {
+    await handle.close();
+  }
+}
 async function listFilesRelative(dir, base) {
   let entries;
   try {
@@ -134649,7 +134718,7 @@ function getCiWorkflowTemplate(provider, options = {}) {
 }
 
 // src/lib/github/repo-mutation.ts
-var import_node_fs = require("node:fs");
+var import_node_fs2 = require("node:fs");
 var import_node_path = __toESM(require("node:path"), 1);
 
 // src/lib/secrets.ts
@@ -134939,7 +135008,7 @@ var RepoMutationService = class {
       throw new Error(this.secretMasker(changed.stderr || changed.stdout || "Failed to inspect generated changes"));
     }
     const hasPlannedRemoval = removePaths.some(
-      (removePath) => (0, import_node_fs.existsSync)(import_node_path.default.resolve(this.cwd, removePath))
+      (removePath) => (0, import_node_fs2.existsSync)(import_node_path.default.resolve(this.cwd, removePath))
     );
     if (!changed.stdout.trim() && !hasPlannedRemoval) {
       return {
@@ -134963,7 +135032,7 @@ var RepoMutationService = class {
     await this.execute("git", ["config", "user.name", options.committerName]);
     await this.execute("git", ["config", "user.email", options.committerEmail]);
     for (const removePath of removePaths) {
-      (0, import_node_fs.rmSync)(import_node_path.default.resolve(this.cwd, removePath), { force: true });
+      (0, import_node_fs2.rmSync)(import_node_path.default.resolve(this.cwd, removePath), { force: true });
     }
     await this.execute("git", ["add", "-A", "--", ...stagePaths]);
     const staged = await this.execute("git", ["diff", "--cached", "--quiet"]);
@@ -135506,14 +135575,14 @@ function createTelemetryContext(options) {
 }
 
 // src/action-version.ts
-var import_node_fs2 = require("node:fs");
+var import_node_fs3 = require("node:fs");
 var import_node_path2 = require("node:path");
 function resolveActionVersion2() {
   if (false) {
     return void 0;
   }
   try {
-    const raw = (0, import_node_fs2.readFileSync)((0, import_node_path2.join)(__dirname, "..", "package.json"), "utf8");
+    const raw = (0, import_node_fs3.readFileSync)((0, import_node_path2.join)(__dirname, "..", "package.json"), "utf8");
     return JSON.parse(raw).version ?? "unknown";
   } catch {
     return "unknown";
@@ -135578,6 +135647,54 @@ var HttpError = class _HttpError extends Error {
   }
 };
 
+// src/lib/postman/pmak-diagnostics.ts
+var memo = /* @__PURE__ */ new Map();
+var normalize3 = (value) => new URL(value.trim()).toString().replace(/\/+$/, "");
+function maskPmakDiagnostic(message, secrets) {
+  let masked = String(message);
+  for (const secret of secrets) if (secret) masked = masked.split(secret).join("***");
+  return Array.from(masked, (character) => {
+    const code = character.codePointAt(0) ?? 0;
+    return code <= 31 || code >= 127 && code <= 159 ? " " : character;
+  }).join("").replace(/\s+/g, " ").trim();
+}
+function formatRejectedMint(original, result) {
+  const teamId = typeof result.payload?.user?.teamId === "number" ? ` (team ${(result.payload?.user).teamId})` : "";
+  if (result.kind === "personal") return `Personal API key detected, cannot mint a service-account access token${teamId}.`;
+  if (result.kind === "service-account") return `The postman-api-key authenticates (GET /me OK) but was rejected by POST /service-account-tokens${teamId} and lacks permission to mint access tokens.`;
+  if (result.kind === "invalid") return "The postman-api-key is invalid, disabled, or expired.";
+  return original;
+}
+async function inspectPmakIdentity(options) {
+  const apiBaseUrl = normalize3(options.apiBaseUrl);
+  const key = `${apiBaseUrl}\0${options.apiKey}`;
+  let pending = memo.get(key);
+  if (!pending) {
+    pending = (async () => {
+      try {
+        const timeout = AbortSignal.timeout(options.timeoutMs ?? 2e3);
+        const signal = options.signal ? AbortSignal.any([options.signal, timeout]) : timeout;
+        const response = await (options.fetchImpl ?? fetch)(`${apiBaseUrl}/me`, { method: "GET", headers: { "X-Api-Key": options.apiKey }, signal });
+        if (response.status === 401 || response.status === 403) return { kind: "invalid", status: response.status };
+        if (!response.ok) return { kind: "inconclusive", status: response.status };
+        const payload = await response.json().catch(() => void 0);
+        const user = payload?.user;
+        if (!user || typeof user !== "object" || Array.isArray(user)) return { kind: "inconclusive", payload };
+        const record = user;
+        if (typeof record.username === "string" && record.username || typeof record.email === "string" && record.email) return { kind: "personal", status: response.status, payload };
+        if ("username" in record && "email" in record && (record.username == null || record.username === "") && (record.email == null || record.email === "")) return { kind: "service-account", status: response.status, payload };
+        return { kind: "inconclusive", payload };
+      } catch {
+        return { kind: "inconclusive" };
+      }
+    })();
+    memo.set(key, pending);
+  }
+  const result = await pending;
+  if (options.mode === "preflight" && result.kind === "inconclusive") memo.delete(key);
+  return result;
+}
+
 // src/lib/postman/credential-identity.ts
 var sessionPath = "/api/sessions/current";
 var SESSION_MAX_ATTEMPTS = 3;
@@ -135671,14 +135788,8 @@ async function resolvePmakIdentity(opts) {
 }
 async function probePmakIdentity(baseUrl, apiKey, fetchImpl) {
   try {
-    const response = await fetchImpl(`${baseUrl}/me`, {
-      method: "GET",
-      headers: { "X-Api-Key": apiKey }
-    });
-    if (!response.ok) {
-      return void 0;
-    }
-    const payload = asRecord(await response.json());
+    const diagnostic = await inspectPmakIdentity({ apiBaseUrl: baseUrl, apiKey, fetchImpl });
+    const payload = asRecord(diagnostic.payload);
     const user = asRecord(payload?.user);
     if (!user) {
       return void 0;
@@ -135710,7 +135821,8 @@ async function resolveSessionIdentity(opts) {
       opts.fetchImpl ?? fetch,
       Math.max(1, opts.maxAttempts ?? SESSION_MAX_ATTEMPTS),
       opts.sleepImpl ?? defaultSessionSleep,
-      opts.randomImpl ?? defaultRandom
+      opts.randomImpl ?? defaultRandom,
+      opts.onRetryEvent
     );
     sessionMemo.set(memoKey, pending);
   }
@@ -135744,7 +135856,7 @@ async function parseSessionResponse(response) {
     consumerType: coerceText(root.consumerType) ?? coerceText(data?.consumerType) ?? coerceText(user?.consumerType)
   };
 }
-async function probeSessionIdentity(baseUrl, accessToken, fetchImpl, maxAttempts, sleepImpl, random) {
+async function probeSessionIdentity(baseUrl, accessToken, fetchImpl, maxAttempts, sleepImpl, random, onRetryEvent) {
   let failure = "unavailable";
   for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
     let response;
@@ -135756,7 +135868,9 @@ async function probeSessionIdentity(baseUrl, accessToken, fetchImpl, maxAttempts
     } catch {
       failure = "unavailable";
       if (attempt < maxAttempts) {
-        await sleepImpl(computeSessionRetryDelayMs(void 0, attempt, random));
+        const delay = computeSessionRetryDelayMs(void 0, attempt, random);
+        onRetryEvent?.({ class: "transport", attempt, delay });
+        await sleepImpl(delay);
         continue;
       }
       break;
@@ -135778,7 +135892,9 @@ async function probeSessionIdentity(baseUrl, accessToken, fetchImpl, maxAttempts
     if (response.status === 429 || response.status >= 500) {
       failure = "unavailable";
       if (attempt < maxAttempts) {
-        await sleepImpl(computeSessionRetryDelayMs(response, attempt, random));
+        const delay = computeSessionRetryDelayMs(response, attempt, random);
+        onRetryEvent?.({ class: "http", status: response.status, attempt, delay });
+        await sleepImpl(delay);
         continue;
       }
       break;
@@ -135880,7 +135996,8 @@ async function runCredentialPreflight(args) {
       accessToken,
       fetchImpl: args.fetchImpl,
       ...args.sleepImpl ? { sleepImpl: args.sleepImpl } : {},
-      ...args.randomImpl ? { randomImpl: args.randomImpl } : {}
+      ...args.randomImpl ? { randomImpl: args.randomImpl } : {},
+      onRetryEvent: args.retryEvent ?? args.log.retryEvent
     });
   } catch (error2) {
     args.log.warning(
@@ -135980,6 +136097,39 @@ function adviseFromHttpError(err, ctx) {
   return new Error(ctx.mask(advice), { cause: err });
 }
 
+// src/lib/postman/app-version.ts
+var UPDATE_URL = "https://dl.pstmn.io/update/status?currentVersion=12.0.0&platform=osx_arm64";
+var FLOOR_VERSION = "12.0.0";
+var VERSION_PATTERN = /^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+var PostmanAppVersionProvider = class {
+  fetchImpl;
+  requestTimeoutMs;
+  pending;
+  constructor(options = {}) {
+    this.fetchImpl = options.fetchImpl ?? fetch;
+    this.requestTimeoutMs = options.requestTimeoutMs ?? 2e3;
+  }
+  async get() {
+    if (process.env.POSTMAN_GATEWAY_APP_VERSION === "off") return void 0;
+    this.pending ??= this.resolve();
+    return this.pending;
+  }
+  async resolve() {
+    try {
+      const response = await this.fetchImpl(UPDATE_URL, {
+        signal: AbortSignal.timeout(this.requestTimeoutMs)
+      });
+      if (!response.ok) return FLOOR_VERSION;
+      const payload = await response.json();
+      const version = typeof payload.version === "string" ? payload.version : "";
+      return VERSION_PATTERN.test(version) ? version : FLOOR_VERSION;
+    } catch {
+      return FLOOR_VERSION;
+    }
+  }
+};
+var defaultPostmanAppVersionProvider = new PostmanAppVersionProvider();
+
 // src/lib/postman/internal-integration-adapter.ts
 function extractDuplicateWorkspaceId(body) {
   try {
@@ -135999,6 +136149,8 @@ var BifrostInternalIntegrationAdapter = class {
   secretMasker;
   teamId;
   workerBaseUrl;
+  gateway;
+  appVersionProvider;
   constructor(options) {
     this.accessToken = String(options.accessToken || "").trim();
     this.getAccessToken = options.getAccessToken;
@@ -136011,6 +136163,8 @@ var BifrostInternalIntegrationAdapter = class {
     this.workerBaseUrl = String(
       options.workerBaseUrl || "https://catalog-admin.postman-account2009.workers.dev"
     ).replace(/\/+$/, "");
+    this.gateway = options.gateway;
+    this.appVersionProvider = options.appVersionProvider ?? defaultPostmanAppVersionProvider;
     this.secretMasker = options.secretMasker ?? createSecretMasker([this.accessToken]);
   }
   /** Live access token: re-minted value when a provider accessor is wired, else the captured one. */
@@ -136018,7 +136172,7 @@ var BifrostInternalIntegrationAdapter = class {
     return this.getAccessToken ? String(this.getAccessToken() || "").trim() : this.accessToken;
   }
   /** Build Bifrost proxy headers. Only includes x-entity-team-id for org-mode teams. */
-  bifrostHeaders() {
+  async bifrostHeaders() {
     const headers = {
       "Content-Type": "application/json",
       "x-access-token": this.currentToken()
@@ -136026,6 +136180,8 @@ var BifrostInternalIntegrationAdapter = class {
     if (this.teamId && this.orgMode) {
       headers["x-entity-team-id"] = this.teamId;
     }
+    const appVersion = await this.appVersionProvider.get();
+    if (appVersion) headers["x-app-version"] = appVersion;
     return headers;
   }
   /** Reactive error-advice context, enriched with the preflight session memo when present. */
@@ -136056,6 +136212,58 @@ var BifrostInternalIntegrationAdapter = class {
     if (associations.length === 0) {
       return;
     }
+    const mode = process.env.POSTMAN_SYSTEM_ENV_ASSOCIATION_MODE ?? "direct";
+    if (mode !== "direct" && mode !== "worker") {
+      throw new Error("POSTMAN_SYSTEM_ENV_ASSOCIATION_MODE must be direct or worker");
+    }
+    if (mode === "direct") {
+      if (!this.gateway) {
+        throw new Error("Direct system-environment association requires the access-token gateway");
+      }
+      const groups = /* @__PURE__ */ new Map();
+      for (const association of associations) {
+        const systemEnvId = String(association.systemEnvId || "").trim();
+        const uid = String(association.envUid || "").trim();
+        if (!systemEnvId || !uid) continue;
+        const key = `${systemEnvId}\0${workspaceId}`;
+        const uids = groups.get(key) ?? /* @__PURE__ */ new Set();
+        uids.add(uid);
+        groups.set(key, uids);
+      }
+      for (const [key, uids] of [...groups.entries()].sort(([a], [b]) => a.localeCompare(b))) {
+        const [systemEnvironmentId, groupedWorkspaceId] = key.split("\0");
+        const postmanEnvironmentIds = [...uids].sort();
+        let response2;
+        try {
+          response2 = await this.gateway.requestJson({
+            service: "api-catalog",
+            method: "post",
+            path: "/api/system-envs/associations",
+            body: {
+              systemEnvironmentId,
+              workspaceEntries: [{ workspaceId: groupedWorkspaceId, postmanEnvironmentIds }]
+            },
+            fallback: "none"
+          }, { retryTransient: true });
+        } catch (error2) {
+          if (error2 instanceof HttpError) {
+            throw adviseFromHttpError(error2, this.adviceContext("system environment association")) ?? error2;
+          }
+          throw error2;
+        }
+        if (!response2 || response2.success !== true) {
+          throw new Error("SYSTEM_ENV_ASSOCIATION_INCOMPLETE");
+        }
+        if (response2.data !== void 0) {
+          if (!Array.isArray(response2.data)) throw new Error("SYSTEM_ENV_ASSOCIATION_INCOMPLETE");
+          const seen = new Set(response2.data.filter((row) => !!row && typeof row === "object").map((row) => `${row.systemEnvironmentId}\0${row.workspaceId}\0${row.postmanEnvironmentId}`));
+          if (!postmanEnvironmentIds.every((uid) => seen.has(`${systemEnvironmentId}\0${groupedWorkspaceId}\0${uid}`))) {
+            throw new Error("SYSTEM_ENV_ASSOCIATION_INCOMPLETE");
+          }
+        }
+      }
+      return;
+    }
     const token = this.currentToken();
     const response = await this.fetchImpl(
       `${this.workerBaseUrl}/api/internal/system-envs/associate`,
@@ -136113,7 +136321,7 @@ var BifrostInternalIntegrationAdapter = class {
     try {
       const response = await this.fetchImpl(url, {
         method: "POST",
-        headers: this.bifrostHeaders(),
+        headers: await this.bifrostHeaders(),
         body: JSON.stringify(payload)
       });
       let parsed = {};
@@ -136202,7 +136410,7 @@ var BifrostInternalIntegrationAdapter = class {
         versionControl: true
       }
     };
-    const headers = this.bifrostHeaders();
+    const headers = await this.bifrostHeaders();
     const response = await this.fetchImpl(url, {
       method: "POST",
       headers,
@@ -136257,7 +136465,7 @@ var BifrostInternalIntegrationAdapter = class {
     try {
       const response = await this.fetchImpl(`${this.bifrostBaseUrl}/ws/proxy`, {
         method: "POST",
-        headers: this.bifrostHeaders(),
+        headers: await this.bifrostHeaders(),
         body: JSON.stringify({
           service: "workspaces",
           method: "GET",
@@ -136288,7 +136496,7 @@ var BifrostInternalIntegrationAdapter = class {
   }
   async createApiKey(name) {
     const url = `${this.bifrostBaseUrl}/ws/proxy`;
-    const headers = this.bifrostHeaders();
+    const headers = await this.bifrostHeaders();
     const payload = {
       service: "identity",
       method: "POST",
@@ -136373,6 +136581,16 @@ async function retry(operation, options = {}) {
   }
   throw new Error("Retry exhausted without returning or throwing");
 }
+function fullJitterDelayMs(attempt, baseMs, capMs, random = Math.random) {
+  return Math.floor(random() * Math.max(0, Math.min(capMs, baseMs * 2 ** Math.max(0, attempt))));
+}
+function parseRetryAfterMs2(value) {
+  const trimmed = value?.trim();
+  if (!trimmed) return void 0;
+  if (/^\d+$/.test(trimmed)) return Number(trimmed) * 1e3;
+  const time = Date.parse(trimmed);
+  return Number.isNaN(time) ? void 0 : Math.max(0, time - Date.now());
+}
 
 // src/contracts.ts
 var postmanRepoSyncActionContract = {
@@ -136431,6 +136649,11 @@ var postmanRepoSyncActionContract = {
       description: "Contract collection ID used for exported artifacts.",
       required: false
     },
+    "prebuilt-collections-json": {
+      description: "Optional digest-bound JSON manifest of unique baseline, smoke, or contract roles with confined repo-relative path, SHA-256 artifact digest of the on-disk v3 collection tree (sorted relative-path + NUL + bytes + NUL), and canonical cloud ID. The optional payloadDigest field is the semantic v2 payload digest carried for provenance (format-validated only, not the reuse gate). Exact role, path, cloudId, and artifactDigest matches reuse the on-disk tree without cloud export.",
+      required: false,
+      default: ""
+    },
     "collection-sync-mode": {
       description: "Collection sync lifecycle mode (refresh or version).",
       required: false,
@@ -136673,7 +136896,7 @@ var postmanRepoSyncActionContract = {
       "Create or update Postman environments from runtime URLs.",
       "Associate Postman environments to system environments through Postman integration APIs.",
       "Create mock servers and smoke monitors from generated collections.",
-      "Export Postman collections in the Collection v3 multi-file YAML directory structure under `postman/collections/` (e.g., `<name>/collection.yaml`, nested folder and request YAML files), and export environments plus `.postman/resources.yaml` into the repository.",
+      "Export Postman collections in the Collection v3 multi-file YAML directory structure under `postman/collections/` (canonical `.resources/definition.yaml` plus request/resource YAML files), and export environments plus `.postman/resources.yaml` into the repository.",
       "Link the Postman workspace to the repository (GitHub or GitLab) through Postman integration APIs.",
       "Commit synced artifacts and push them back to the current checked out ref."
     ],
@@ -136802,6 +137025,17 @@ var PostmanGatewayAssetsClient = class {
     return data.map((entry) => this.asRecord(entry)).filter((entry) => entry !== null).map((entry) => ({ uid: String(entry.id ?? entry.uid ?? "").trim(), name: String(entry.name ?? "").trim() })).filter((entry) => entry.uid && entry.name);
   }
   async getSpecContent(specId) {
+    if (process.env.POSTMAN_SPEC_TREE_FAST_PATH !== "off") {
+      try {
+        const treeContent = await this.getSpecContentFromTree(specId);
+        if (treeContent !== void 0) return treeContent;
+      } catch (error2) {
+        if (!(error2 instanceof HttpError) || ![403, 404, 405, 501].includes(error2.status)) throw error2;
+      }
+    }
+    return this.getSpecContentLegacy(specId);
+  }
+  async getSpecContentLegacy(specId) {
     const files = await this.gateway.requestJson({
       service: "specification",
       method: "get",
@@ -136820,6 +137054,46 @@ var PostmanGatewayAssetsClient = class {
     const record = this.dataOf(file);
     return typeof record?.content === "string" ? record.content : void 0;
   }
+  /** Minimal `/tree` reader: validate the entire returned inventory before selecting ROOT. */
+  async getSpecContentFromTree(specId) {
+    const rows = [];
+    const cursors = /* @__PURE__ */ new Set();
+    let cursor;
+    for (let page = 0; page < 100; page += 1) {
+      const response = await this.gateway.requestJson({
+        service: "specification",
+        method: "get",
+        path: `/specifications/${specId}/tree`,
+        query: { fields: "id,name,type,path,parentId,fileType,content", limit: 100, ...cursor ? { cursor } : {} }
+      });
+      if (!Array.isArray(response?.data)) return void 0;
+      for (const value of response.data) {
+        const row = this.asRecord(value);
+        if (!row || row.type === "FOLDER") continue;
+        if (row.type !== "FILE" || typeof row.id !== "string" || !row.id.trim() || typeof row.path !== "string" || !row.path.trim() || typeof row.content !== "string" || typeof row.fileType !== "string" || !row.fileType.trim()) return void 0;
+        const path9 = row.path.replace(/\\/g, "/").normalize("NFC");
+        if (path9.startsWith("/") || path9.split("/").some((part) => part === ".." || !part)) throw new Error("CONTRACT_DEFINITION_PATH_INVALID");
+        rows.push({ ...row, path: path9 });
+      }
+      const meta = this.asRecord(response?.meta);
+      const cursorValue = this.asRecord(meta?.cursor)?.next;
+      const next = typeof cursorValue === "string" && cursorValue.trim() ? cursorValue.trim() : void 0;
+      if (!next) break;
+      if (cursors.has(next)) throw new Error("SPEC_TREE_CURSOR_REPEATED");
+      cursors.add(next);
+      if (page === 99) throw new Error("SPEC_TREE_PAGE_LIMIT_EXCEEDED");
+      cursor = next;
+    }
+    const paths = /* @__PURE__ */ new Set();
+    for (const row of rows) {
+      const path9 = String(row.path).toLocaleLowerCase();
+      if (paths.has(path9)) throw new Error("CONTRACT_DEFINITION_DUPLICATE_PATH");
+      paths.add(path9);
+    }
+    const roots = rows.filter((row) => row.fileType === "ROOT");
+    if (roots.length !== 1) throw new Error("CONTRACT_DEFINITION_INVENTORY_INVALID");
+    return String(roots[0]?.content);
+  }
   async listSpecCollections(specId) {
     const response = await this.gateway.requestJson({
       service: "specification",
@@ -137379,10 +137653,12 @@ var PostmanGatewayAssetsClient = class {
 // src/lib/postman/token-provider.ts
 var MintError = class extends Error {
   permanent;
-  constructor(message, permanent) {
+  status;
+  constructor(message, permanent, status) {
     super(message);
     this.name = "MintError";
     this.permanent = permanent;
+    this.status = status;
   }
 };
 function extractAccessToken(payload) {
@@ -137405,6 +137681,7 @@ var AccessTokenProvider = class {
   maxAttempts;
   onToken;
   sleep;
+  onRetryEvent;
   inflight;
   constructor(options) {
     this.token = String(options.accessToken || "").trim();
@@ -137416,6 +137693,7 @@ var AccessTokenProvider = class {
     this.maxAttempts = Math.max(1, options.maxAttempts ?? 2);
     this.onToken = options.onToken;
     this.sleep = options.sleep;
+    this.onRetryEvent = options.onRetryEvent;
   }
   current() {
     return this.token;
@@ -137441,7 +137719,12 @@ var AccessTokenProvider = class {
       delayMs: 1e3,
       backoffMultiplier: 2,
       ...this.sleep ? { sleep: this.sleep } : {},
-      shouldRetry: (error2) => !(error2 instanceof MintError && error2.permanent)
+      shouldRetry: (error2) => !(error2 instanceof MintError && error2.permanent),
+      onRetry: ({ attempt, delayMs, error: error2 }) => {
+        const status = error2 instanceof MintError ? error2.status : void 0;
+        const retryClass = status === void 0 ? "transport" : "http";
+        this.onRetryEvent?.({ class: retryClass, ...status === void 0 ? {} : { status }, attempt, delay: Math.max(0, delayMs) });
+      }
     });
     this.token = token;
     this.onToken?.(token);
@@ -137462,7 +137745,8 @@ var AccessTokenProvider = class {
       if (status === 401 || status === 403) {
         throw new MintError(
           `postman: re-mint failed because the postman-api-key was rejected (PMAK rejected, HTTP ${status}); confirm it is a valid, enabled service-account PMAK for the intended team.`,
-          true
+          true,
+          status
         );
       }
       if (status === 400 && body.toLowerCase().includes("service accounts not enabled")) {
@@ -137471,7 +137755,7 @@ var AccessTokenProvider = class {
           true
         );
       }
-      throw new MintError(`postman: re-mint failed (service-account-tokens HTTP ${status}).`, false);
+      throw new MintError(`postman: re-mint failed (service-account-tokens HTTP ${status}).`, false, status);
     }
     let parsed;
     try {
@@ -137487,26 +137771,9 @@ var AccessTokenProvider = class {
   }
 };
 async function describeMintFailure(mintError, apiKey, apiBaseUrl, fetchImpl) {
-  const raw = mintError instanceof Error ? mintError.message : String(mintError);
-  const rejected = /HTTP 40[13]|PMAK rejected/.test(raw);
-  if (!rejected) {
-    return raw;
-  }
-  try {
-    const me = await fetchImpl(`${apiBaseUrl}/me`, { headers: { "x-api-key": apiKey } });
-    if (me.ok) {
-      const body = await me.json().catch(() => void 0);
-      const user = body?.user;
-      const looksPersonal = Boolean(user && (user.username || user.email));
-      if (looksPersonal) {
-        return "Personal API key detected, cannot mint a service-account access token. POST /service-account-tokens only accepts a SERVICE-ACCOUNT API key; this postman-api-key belongs to a user account" + (user?.teamId ? ` (team ${user.teamId})` : "") + ". Create a service account in Team Settings and use its PMAK, or mint the token elsewhere and pass postman-access-token.";
-      }
-      return "The postman-api-key authenticates (GET /me OK) but was rejected by POST /service-account-tokens" + (user?.teamId ? ` (team ${user.teamId})` : "") + ". The service account likely lacks permission to mint access tokens, or service accounts are restricted for this team. Check the service account role in Team Settings, or pass a pre-minted postman-access-token.";
-    }
-    return "The postman-api-key is invalid, disabled, or expired (rejected by both POST /service-account-tokens and GET /me). Generate a fresh service-account PMAK in Team Settings and update the secret.";
-  } catch {
-    return raw;
-  }
+  const raw = maskPmakDiagnostic(mintError instanceof Error ? mintError.message : String(mintError), [apiKey]);
+  if (!(mintError instanceof MintError) || mintError.status !== 401 && mintError.status !== 403) return raw;
+  return formatRejectedMint(raw, await inspectPmakIdentity({ apiBaseUrl, apiKey, fetchImpl }));
 }
 async function mintAccessTokenIfNeeded(inputs, log, setSecret2, fetchImpl = fetch) {
   if (inputs.postmanAccessToken || !inputs.postmanApiKey) {
@@ -137519,7 +137786,8 @@ async function mintAccessTokenIfNeeded(inputs, log, setSecret2, fetchImpl = fetc
     apiKey: inputs.postmanApiKey,
     apiBaseUrl,
     fetchImpl,
-    onToken: (token) => setSecret2?.(token)
+    onToken: (token) => setSecret2?.(token),
+    onRetryEvent: (event) => log.retryEvent?.(event)
   });
   try {
     inputs.postmanAccessToken = await provider.refresh();
@@ -137555,6 +137823,11 @@ var AccessTokenGatewayClient = class {
   fallbackBaseUrl;
   retryBaseDelayMs;
   sleepImpl;
+  appVersionProvider;
+  requestTimeoutMs;
+  retryMaxDelayMs;
+  randomImpl;
+  onRetryEvent;
   constructor(options) {
     this.tokenProvider = options.tokenProvider;
     this.bifrostBaseUrl = String(
@@ -137569,16 +137842,23 @@ var AccessTokenGatewayClient = class {
     this.fallbackBaseUrl = fallbackEnv === "off" ? void 0 : options.fallbackBaseUrl?.replace(/\/+$/, "");
     this.retryBaseDelayMs = options.retryBaseDelayMs ?? 400;
     this.sleepImpl = options.sleepImpl ?? defaultSleep;
+    this.appVersionProvider = options.appVersionProvider ?? defaultPostmanAppVersionProvider;
+    this.requestTimeoutMs = options.requestTimeoutMs ?? 3e4;
+    this.retryMaxDelayMs = options.retryMaxDelayMs ?? 5e3;
+    this.randomImpl = options.randomImpl ?? Math.random;
+    this.onRetryEvent = options.onRetryEvent;
   }
   configureTeamContext(teamId, orgMode) {
     this.teamId = String(teamId || "").trim();
     this.orgMode = orgMode;
   }
-  buildHeaders(extra) {
+  async buildHeaders(extra) {
+    const appVersion = await this.appVersionProvider.get();
     const headers = {
       "Content-Type": "application/json",
       "x-access-token": this.tokenProvider.current(),
-      ...extra || {}
+      ...extra || {},
+      ...appVersion ? { "x-app-version": appVersion } : {}
     };
     if (this.teamId && this.orgMode) {
       headers["x-entity-team-id"] = this.teamId;
@@ -137587,17 +137867,24 @@ var AccessTokenGatewayClient = class {
   }
   async send(request, baseUrl) {
     const url = `${baseUrl ?? this.bifrostBaseUrl}/ws/proxy`;
-    return this.fetchImpl(url, {
-      method: "POST",
-      headers: this.buildHeaders(request.headers),
-      body: JSON.stringify({
-        service: request.service,
-        method: request.method,
-        path: request.path,
-        ...request.query !== void 0 ? { query: request.query } : {},
-        ...request.body !== void 0 ? { body: request.body } : {}
-      })
-    });
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.requestTimeoutMs);
+    try {
+      return await this.fetchImpl(url, {
+        method: "POST",
+        headers: await this.buildHeaders(request.headers),
+        signal: controller.signal,
+        body: JSON.stringify({
+          service: request.service,
+          method: request.method,
+          path: request.path,
+          ...request.query !== void 0 ? { query: request.query } : {},
+          ...request.body !== void 0 ? { body: request.body } : {}
+        })
+      });
+    } finally {
+      clearTimeout(timer);
+    }
   }
   /**
    * One cold, serial attempt against the fallback base URL after the primary
@@ -137624,11 +137911,13 @@ var AccessTokenGatewayClient = class {
    * they are the freshest authoritative answer.
    */
   fallbackEligible(request, retryTransient) {
+    if (request.fallback === "none") return false;
     if (!this.fallbackBaseUrl) return false;
     return retryTransient || request.fallback === "auto";
   }
-  async attemptFallback(request, retryTransient) {
+  async attemptFallback(request, retryTransient, status) {
     if (!this.fallbackEligible(request, retryTransient)) return null;
+    this.emitRetryEvent("fallback", status, 1, 0);
     const response = await this.tryFallback(request);
     if (!response) return null;
     if (response.ok) return response;
@@ -137653,7 +137942,8 @@ var AccessTokenGatewayClient = class {
         response = await this.send(request);
       } catch (error2) {
         if (retryTransient && attempt < this.maxRetries) {
-          const delay = this.retryBaseDelayMs * 2 ** attempt;
+          const delay = this.retryDelayMs(attempt);
+          this.emitRetryEvent("transport", void 0, attempt + 1, delay);
           attempt += 1;
           await this.sleepImpl(delay);
           continue;
@@ -137663,10 +137953,23 @@ var AccessTokenGatewayClient = class {
         throw error2;
       }
       if (response.ok) {
-        return response;
+        const okBody = await response.text().catch(() => "");
+        const inner = this.innerStatus(okBody);
+        if (inner !== void 0) {
+          if (retryTransient && this.isTransient(inner, okBody) && attempt < this.maxRetries) {
+            const delay = this.retryDelayMs(attempt);
+            this.emitRetryEvent("inner", inner, attempt + 1, delay);
+            await this.sleepImpl(delay);
+            attempt += 1;
+            continue;
+          }
+          throw this.toInnerHttpError(request, inner, okBody);
+        }
+        return this.rebuildResponse(response, okBody);
       }
       const body = await response.text().catch(() => "");
       if (isExpiredAuthError(response.status, body) && this.tokenProvider.canRefresh()) {
+        this.emitRetryEvent("auth", response.status, 1, 0);
         await this.tokenProvider.refresh();
         response = await this.send(request);
         if (response.ok) {
@@ -137675,17 +137978,44 @@ var AccessTokenGatewayClient = class {
         const retryBody = await response.text().catch(() => "");
         throw this.toHttpError(request, response, retryBody);
       }
-      if (retryTransient && isRetryableSafeReadResponse(response.status) && attempt < this.maxRetries) {
-        const delay = this.retryBaseDelayMs * 2 ** attempt;
+      if (retryTransient && this.isTransient(response.status, body) && attempt < this.maxRetries) {
+        const delay = this.retryDelayMs(attempt, parseRetryAfterMs2(response.headers.get("retry-after")));
+        this.emitRetryEvent("http", response.status, attempt + 1, delay);
         attempt += 1;
         await this.sleepImpl(delay);
         continue;
       }
-      const fallbackResponse = await this.attemptFallback(request, retryTransient);
+      const fallbackResponse = await this.attemptFallback(request, retryTransient, response.status);
       if (fallbackResponse) return fallbackResponse;
       throw this.toHttpError(request, response, body);
     }
   }
+  retryDelayMs(attempt, retryAfter) {
+    return retryAfter === void 0 ? fullJitterDelayMs(attempt, this.retryBaseDelayMs, this.retryMaxDelayMs, this.randomImpl) : Math.min(this.retryMaxDelayMs, retryAfter);
+  }
+  emitRetryEvent(retryClass, status, attempt, delay) {
+    this.onRetryEvent?.({
+      class: retryClass,
+      ...status === void 0 ? {} : { status },
+      attempt: Math.max(1, attempt),
+      delay: Math.max(0, delay)
+    });
+  }
+  isTransient(status, body) {
+    return status === 408 || status === 429 || status >= 500 || /ESOCKETTIMEDOUT|ETIMEDOUT|ECONNRESET|serverError|downstream/.test(body);
+  }
+  innerStatus(body) {
+    try {
+      const value = JSON.parse(body);
+      const status = Number(value.status ?? value.statusCode);
+      return value.error || value.success === false || status >= 400 ? status >= 400 ? status : 502 : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+  rebuildResponse(response, body) {
+    return new Response([204, 205, 304].includes(response.status) ? null : body, { status: response.status, statusText: response.statusText, headers: response.headers });
+  }
   /** Send a gateway request and parse the JSON body, or null when empty. */
   async requestJson(request, options = {}) {
     const response = await this.request(request, options);
@@ -137732,11 +138062,19 @@ var AccessTokenGatewayClient = class {
       url: `${this.bifrostBaseUrl}/ws/proxy (${request.service}: ${request.method} ${request.path})`,
       status: response.status,
       statusText: response.statusText,
-      requestHeaders: this.buildHeaders(request.headers),
+      requestHeaders: {
+        "Content-Type": "application/json",
+        "x-access-token": this.tokenProvider.current(),
+        ...request.headers || {},
+        ...this.teamId && this.orgMode ? { "x-entity-team-id": this.teamId } : {}
+      },
       responseBody: this.secretMasker(body),
       secretValues: [this.tokenProvider.current()]
     });
   }
+  toInnerHttpError(request, status, body) {
+    return new HttpError({ method: request.method.toUpperCase(), url: `${this.bifrostBaseUrl}/ws/proxy (${request.service}: ${request.method} ${request.path}) [inner]`, status, statusText: "Inner Error", requestHeaders: { "x-access-token": this.tokenProvider.current() }, responseBody: this.secretMasker(body), secretValues: [this.tokenProvider.current()] });
+  }
 };
 
 // src/lib/ssl-validation.ts
@@ -137792,7 +138130,7 @@ function validateCertMaterial(certBase64, keyBase64, passphrase) {
 }
 
 // src/lib/repo/branch-decision.ts
-var import_node_fs3 = require("node:fs");
+var import_node_fs4 = require("node:fs");
 var import_node_crypto3 = require("node:crypto");
 var ContractError = class extends Error {
   code;
@@ -137833,7 +138171,7 @@ function readGithubEvent(env) {
   const path9 = clean(env.GITHUB_EVENT_PATH);
   if (!path9) return void 0;
   try {
-    return JSON.parse((0, import_node_fs3.readFileSync)(path9, "utf8"));
+    return JSON.parse((0, import_node_fs4.readFileSync)(path9, "utf8"));
   } catch {
     return void 0;
   }
@@ -138289,6 +138627,7 @@ function resolveInputs(env = process.env) {
     baselineCollectionId: getInput2("baseline-collection-id", env),
     smokeCollectionId: getInput2("smoke-collection-id", env),
     contractCollectionId: getInput2("contract-collection-id", env),
+    prebuiltCollectionsJson: getInput2("prebuilt-collections-json", env),
     specId: getInput2("spec-id", env),
     specContentChanged: parseBooleanInput(getInput2("spec-content-changed", env), true),
     specPath: getInput2("spec-path", env),
@@ -138404,7 +138743,7 @@ var StateUnreadableError = class extends Error {
 function readResourcesState() {
   let raw;
   try {
-    raw = (0, import_node_fs4.readFileSync)(".postman/resources.yaml", "utf8");
+    raw = (0, import_node_fs5.readFileSync)(".postman/resources.yaml", "utf8");
   } catch {
     return null;
   }
@@ -138463,12 +138802,15 @@ function getEnvironmentUidsFromResources(resourcesState) {
 function normalizeToPosix(filePath) {
   return filePath.split(path8.sep).join("/").replace(/\\/g, "/");
 }
+function canonicalizeRelativePath(value) {
+  return normalizeToPosix(String(value ?? "").trim()).replace(/^\.\/+/, "").replace(/\/{2,}/g, "/").replace(/\/+$/g, "");
+}
 function isOpenApiSpecFile(filePath) {
   if (!(filePath.endsWith(".json") || filePath.endsWith(".yaml") || filePath.endsWith(".yml"))) {
     return false;
   }
   try {
-    const raw = (0, import_node_fs4.readFileSync)(filePath, "utf8");
+    const raw = (0, import_node_fs5.readFileSync)(filePath, "utf8");
     const parsed = filePath.endsWith(".json") ? JSON.parse(raw) : load(raw);
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
       return false;
@@ -138497,7 +138839,7 @@ function scanLocalSpecReferences(baseDir = ".") {
   const found = /* @__PURE__ */ new Set();
   const refs = [];
   const visit2 = (currentDir) => {
-    for (const entry of (0, import_node_fs4.readdirSync)(currentDir, { withFileTypes: true })) {
+    for (const entry of (0, import_node_fs5.readdirSync)(currentDir, { withFileTypes: true })) {
       if (ignoredDirs.has(entry.name)) {
         continue;
       }
@@ -138527,7 +138869,7 @@ function resolveMappedSpecReference(explicitSpecPath, discoveredSpecs) {
   const normalizedExplicitPath = normalizeToPosix(explicitSpecPath.trim());
   if (normalizedExplicitPath) {
     const explicitFullPath = path8.resolve(normalizedExplicitPath);
-    if ((0, import_node_fs4.existsSync)(explicitFullPath) && (0, import_node_fs4.statSync)(explicitFullPath).isFile()) {
+    if ((0, import_node_fs5.existsSync)(explicitFullPath) && (0, import_node_fs5.statSync)(explicitFullPath).isFile()) {
       return {
         repoRelativePath: normalizedExplicitPath,
         configRelativePath: normalizeToPosix(path8.join("..", normalizedExplicitPath))
@@ -138579,6 +138921,7 @@ function readActionInputs(actionCore) {
     INPUT_BASELINE_COLLECTION_ID: readInput(actionCore, "baseline-collection-id"),
     INPUT_SMOKE_COLLECTION_ID: readInput(actionCore, "smoke-collection-id"),
     INPUT_CONTRACT_COLLECTION_ID: readInput(actionCore, "contract-collection-id"),
+    INPUT_PREBUILT_COLLECTIONS_JSON: readInput(actionCore, "prebuilt-collections-json"),
     INPUT_SPEC_ID: readInput(actionCore, "spec-id"),
     INPUT_SPEC_PATH: readInput(actionCore, "spec-path"),
     INPUT_COLLECTION_SYNC_MODE: readInput(actionCore, "collection-sync-mode") || "refresh",
@@ -138792,6 +139135,7 @@ async function upsertEnvironments(inputs, dependencies, resourcesState, assetMar
         );
       }
       envUids[envName] = existingUid;
+      dependencies.core.setOutput("environment-uids-json", JSON.stringify(envUids));
       continue;
     }
     const values = buildEnvironmentValues(envName, runtimeUrl);
@@ -138802,6 +139146,7 @@ async function upsertEnvironments(inputs, dependencies, resourcesState, assetMar
         displayName,
         values
       );
+      dependencies.core.setOutput("environment-uids-json", JSON.stringify(envUids));
     } catch (error2) {
       throw new Error(
         formatOrchestrationIssue({
@@ -138818,7 +139163,7 @@ async function upsertEnvironments(inputs, dependencies, resourcesState, assetMar
   return envUids;
 }
 function ensureDir(path9) {
-  (0, import_node_fs4.mkdirSync)(path9, { recursive: true });
+  (0, import_node_fs5.mkdirSync)(path9, { recursive: true });
 }
 function getCollectionDirectoryName(kind, projectName) {
   if (kind === "Baseline") {
@@ -138853,9 +139198,9 @@ function stripVolatileFields(obj) {
   }
   return obj;
 }
-function writeJsonFile(path9, content, normalize3 = false) {
-  const data = normalize3 ? stripVolatileFields(content) : content;
-  (0, import_node_fs4.writeFileSync)(path9, JSON.stringify(data, null, 2));
+function writeJsonFile(path9, content, normalize4 = false) {
+  const data = normalize4 ? stripVolatileFields(content) : content;
+  (0, import_node_fs5.writeFileSync)(path9, JSON.stringify(data, null, 2));
 }
 function buildMappedSpecCloudKey(mappedSource, specSyncMode, releaseLabel) {
   if (specSyncMode !== "version") {
@@ -138919,22 +139264,422 @@ function buildResourcesManifest(workspaceId, collectionMap, envMap, artifactDir,
     sortKeys: false
   });
 }
-function buildSpecCollectionWorkflowManifest(specRef, collectionRefs) {
-  return dump(
-    {
-      workflows: {
-        syncSpecToCollection: collectionRefs.map((collectionRef) => ({
-          spec: specRef,
-          collection: collectionRef
-        }))
+function isPlainObject2(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function buildSpecCollectionWorkflowManifest(specRef, collectionRefs, existingRaw) {
+  const pairs = collectionRefs.map((collectionRef) => ({
+    spec: specRef,
+    collection: collectionRef
+  }));
+  let root = {};
+  if (typeof existingRaw === "string" && existingRaw.trim()) {
+    let parsed;
+    try {
+      parsed = load(existingRaw);
+    } catch (error2) {
+      throw new Error(
+        `CONTRACT_WORKFLOWS_UNREADABLE: .postman/workflows.yaml exists but is not parseable YAML (${error2 instanceof Error ? error2.message : String(error2)}). Fix or delete the file; refusing to overwrite unrelated workflow data.`,
+        { cause: error2 }
+      );
+    }
+    if (parsed === null || parsed === void 0) {
+      root = {};
+    } else if (!isPlainObject2(parsed)) {
+      throw new Error(
+        "CONTRACT_WORKFLOWS_UNREADABLE: .postman/workflows.yaml exists but does not contain a YAML mapping. Fix or delete the file; refusing to overwrite unrelated workflow data."
+      );
+    } else {
+      root = { ...parsed };
+    }
+  }
+  const workflows = isPlainObject2(root.workflows) ? { ...root.workflows } : {};
+  const desiredCollections = new Set(collectionRefs);
+  const currentPairs = (Array.isArray(workflows.syncSpecToCollection) ? workflows.syncSpecToCollection : []).map((entry) => isPlainObject2(entry) ? { ...entry } : null).filter((entry) => Boolean(entry)).filter(
+    (entry) => String(entry.spec ?? "") !== specRef || desiredCollections.has(String(entry.collection ?? ""))
+  );
+  for (const pair of pairs) {
+    const index = currentPairs.findIndex(
+      (entry) => String(entry.spec ?? "") === pair.spec && String(entry.collection ?? "") === pair.collection
+    );
+    if (index >= 0) {
+      const previous = currentPairs[index];
+      currentPairs[index] = { ...previous, spec: pair.spec, collection: pair.collection };
+    } else {
+      currentPairs.push({ spec: pair.spec, collection: pair.collection });
+    }
+  }
+  workflows.syncSpecToCollection = currentPairs;
+  root.workflows = workflows;
+  return dump(root, {
+    lineWidth: -1,
+    noRefs: true,
+    sortKeys: false
+  });
+}
+var PREBUILT_COLLECTION_ROLES = /* @__PURE__ */ new Set([
+  "baseline",
+  "smoke",
+  "contract"
+]);
+var SHA256_HEX = /^[a-f0-9]{64}$/;
+var PREBUILT_CLOUD_ID = /^[A-Za-z0-9][A-Za-z0-9._:-]*$/;
+function failPrebuiltCollections(detail) {
+  throw new Error(`CONTRACT_PREBUILT_COLLECTIONS_INVALID: ${detail}`);
+}
+function parsePrebuiltCollectionsJson(raw) {
+  const trimmed = String(raw ?? "").trim();
+  if (!trimmed) {
+    return [];
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(trimmed);
+  } catch (error2) {
+    throw new Error(
+      `CONTRACT_PREBUILT_COLLECTIONS_INVALID: malformed JSON (${error2 instanceof Error ? error2.message : String(error2)})`,
+      { cause: error2 }
+    );
+  }
+  let entriesRaw;
+  if (Array.isArray(parsed)) {
+    entriesRaw = parsed;
+  } else if (isPlainObject2(parsed)) {
+    if (parsed.schemaVersion !== 1) {
+      failPrebuiltCollections("schemaVersion must be 1");
+    }
+    if (!Array.isArray(parsed.collections)) {
+      failPrebuiltCollections("collections must be an array when schemaVersion is set");
+    }
+    entriesRaw = parsed.collections;
+  } else {
+    failPrebuiltCollections("expected a JSON array or {schemaVersion:1,collections:[]}");
+  }
+  const seenRoles = /* @__PURE__ */ new Set();
+  const entries = [];
+  for (const [index, value] of entriesRaw.entries()) {
+    if (!isPlainObject2(value)) {
+      failPrebuiltCollections(`collections[${index}] must be an object`);
+    }
+    const roleRaw = String(value.role ?? "").trim();
+    if (!PREBUILT_COLLECTION_ROLES.has(roleRaw)) {
+      failPrebuiltCollections(
+        `collections[${index}].role must be one of baseline|smoke|contract`
+      );
+    }
+    const role = roleRaw;
+    if (seenRoles.has(role)) {
+      failPrebuiltCollections(`duplicate role ${role}`);
+    }
+    seenRoles.add(role);
+    const collectionPath = String(
+      value.collectionPath ?? value.path ?? ""
+    ).trim();
+    if (!collectionPath || hasControlCharacter2(collectionPath)) {
+      failPrebuiltCollections(
+        `collections[${index}].collectionPath must be a non-empty confined relative path`
+      );
+    }
+    const cloudId = String(value.cloudId ?? "").trim();
+    if (!cloudId || !PREBUILT_CLOUD_ID.test(cloudId)) {
+      failPrebuiltCollections(
+        `collections[${index}].cloudId must be a non-empty Postman collection id`
+      );
+    }
+    let payloadDigest;
+    if (Object.prototype.hasOwnProperty.call(value, "payloadDigest")) {
+      const payloadDigestRaw = value.payloadDigest;
+      if (payloadDigestRaw !== void 0 && payloadDigestRaw !== null) {
+        payloadDigest = String(payloadDigestRaw).trim();
+        if (!SHA256_HEX.test(payloadDigest)) {
+          failPrebuiltCollections(
+            `collections[${index}].payloadDigest must be lowercase 64-hex`
+          );
+        }
       }
-    },
-    {
-      lineWidth: -1,
-      noRefs: true,
-      sortKeys: false
     }
+    const artifactDigest = String(value.artifactDigest ?? "").trim();
+    if (!SHA256_HEX.test(artifactDigest)) {
+      failPrebuiltCollections(
+        `collections[${index}].artifactDigest must be lowercase 64-hex`
+      );
+    }
+    entries.push({
+      role,
+      collectionPath,
+      cloudId,
+      ...payloadDigest !== void 0 ? { payloadDigest } : {},
+      artifactDigest
+    });
+  }
+  return entries;
+}
+function assertPathWithinArtifactRoot(targetPath, artifactDir, fieldName) {
+  assertPathWithinCwd(targetPath, fieldName);
+  assertPathWithinCwd(artifactDir, "artifact-dir");
+  const cwd = (0, import_node_fs5.realpathSync)(process.cwd());
+  const artifactRoot = path8.resolve(cwd, artifactDir.trim());
+  const resolved = path8.resolve(cwd, targetPath.trim());
+  const relativeToArtifact = path8.relative(artifactRoot, resolved);
+  if (!relativeToArtifact || relativeToArtifact.startsWith("..") || path8.isAbsolute(relativeToArtifact)) {
+    failPrebuiltCollections(
+      `${fieldName} must stay under artifact-dir (${artifactDir}); received ${targetPath}`
+    );
+  }
+  let existingPath = resolved;
+  while (!(0, import_node_fs5.existsSync)(existingPath)) {
+    const parent = path8.dirname(existingPath);
+    if (parent === existingPath) {
+      break;
+    }
+    existingPath = parent;
+  }
+  const realExisting = (0, import_node_fs5.realpathSync)(existingPath);
+  const realRelative = path8.relative(artifactRoot, realExisting);
+  if (realRelative.startsWith("..") || path8.isAbsolute(realRelative)) {
+    failPrebuiltCollections(
+      `${fieldName} resolves outside artifact-dir via symlink; received ${targetPath}`
+    );
+  }
+  return normalizeToPosix(path8.relative(cwd, resolved));
+}
+function prebuiltDirectoryTraversalIdentity(absolutePath, stats, options = {}) {
+  const platform2 = options.platform ?? process.platform;
+  const inodeIsZero = stats.ino === 0 || stats.ino === 0n;
+  if (platform2 !== "win32" && !inodeIsZero) {
+    return `${stats.dev}:${stats.ino}`;
+  }
+  const resolveCanonicalPath = options.resolveCanonicalPath ?? ((candidate) => import_node_fs5.realpathSync.native(candidate));
+  const canonical = resolveCanonicalPath(absolutePath);
+  return platform2 === "win32" ? canonical.toLowerCase() : canonical;
+}
+function listPrebuiltCollectionTreeFiles(collectionPath, artifactDir) {
+  const confined = assertPathWithinArtifactRoot(
+    collectionPath,
+    artifactDir,
+    "prebuilt collection path"
+  );
+  const absRoot = path8.resolve(process.cwd(), confined);
+  if (!(0, import_node_fs5.existsSync)(absRoot)) {
+    return [];
+  }
+  let rootStat;
+  try {
+    rootStat = (0, import_node_fs5.lstatSync)(absRoot);
+  } catch {
+    return [];
+  }
+  if (rootStat.isSymbolicLink()) {
+    failPrebuiltCollections(
+      `prebuilt collection path must not be a symlink; received ${collectionPath}`
+    );
+  }
+  if (!rootStat.isDirectory()) {
+    return [];
+  }
+  const files = [];
+  const pendingDirectories = [absRoot];
+  const seenDirectories = /* @__PURE__ */ new Set();
+  while (pendingDirectories.length > 0) {
+    const currentAbsolute = pendingDirectories.pop();
+    if (!currentAbsolute) {
+      break;
+    }
+    const currentStat = (0, import_node_fs5.lstatSync)(currentAbsolute);
+    if (currentStat.isSymbolicLink() || !currentStat.isDirectory()) {
+      failPrebuiltCollections(
+        `prebuilt collection tree directory changed or became unsupported at ${normalizeToPosix(path8.relative(absRoot, currentAbsolute)) || "."}`
+      );
+    }
+    const currentKey = prebuiltDirectoryTraversalIdentity(currentAbsolute, currentStat);
+    if (seenDirectories.has(currentKey)) {
+      failPrebuiltCollections(
+        `prebuilt collection tree directory cycle detected at ${normalizeToPosix(path8.relative(absRoot, currentAbsolute)) || "."}`
+      );
+    }
+    seenDirectories.add(currentKey);
+    const entries = (0, import_node_fs5.readdirSync)(currentAbsolute, { withFileTypes: true });
+    for (const entry of entries) {
+      const abs = path8.join(currentAbsolute, entry.name);
+      if (entry.isSymbolicLink()) {
+        failPrebuiltCollections(
+          `prebuilt collection tree must not contain symlinks; received ${normalizeToPosix(path8.relative(absRoot, abs))}`
+        );
+      }
+      if (entry.isDirectory()) {
+        pendingDirectories.push(abs);
+        continue;
+      }
+      if (!entry.isFile()) {
+        failPrebuiltCollections(
+          `prebuilt collection tree contains unsupported entry type at ${normalizeToPosix(path8.relative(absRoot, abs))}`
+        );
+      }
+      const fileLstat = (0, import_node_fs5.lstatSync)(abs);
+      if (fileLstat.isSymbolicLink() || !fileLstat.isFile()) {
+        failPrebuiltCollections(
+          `prebuilt collection tree file changed or became unsupported at ${normalizeToPosix(path8.relative(absRoot, abs))}`
+        );
+      }
+      files.push({
+        absolute: abs,
+        relative: normalizeToPosix(path8.relative(absRoot, abs)),
+        dev: fileLstat.dev,
+        ino: fileLstat.ino,
+        size: fileLstat.size
+      });
+    }
+  }
+  files.sort((a, b) => a.relative.localeCompare(b.relative));
+  return files;
+}
+function validateCanonicalV3CollectionFile(relative4, bytes) {
+  let expectedKind;
+  if (/(^|\/)\.resources\/definition\.yaml$/.test(relative4)) {
+    expectedKind = "collection";
+  } else if (relative4.endsWith(".request.yaml")) {
+    expectedKind = "request";
+  } else if (relative4.endsWith(".example.yaml")) {
+    expectedKind = "example";
+  } else if (relative4.endsWith(".message.yaml")) {
+    expectedKind = "message";
+  } else {
+    failPrebuiltCollections(`prebuilt collection tree contains unexpected file ${relative4}`);
+  }
+  let parsed;
+  try {
+    parsed = load(bytes.toString("utf8"));
+  } catch (error2) {
+    failPrebuiltCollections(
+      `prebuilt collection tree contains malformed YAML at ${relative4} (${error2 instanceof Error ? error2.message : String(error2)})`
+    );
+  }
+  if (!isPlainObject2(parsed)) {
+    failPrebuiltCollections(`prebuilt collection tree file ${relative4} must contain a YAML mapping`);
+  }
+  const kind = typeof parsed.$kind === "string" ? parsed.$kind.trim() : "";
+  if (!kind) {
+    failPrebuiltCollections(`prebuilt collection tree file ${relative4} must contain a nonempty $kind`);
+  }
+  const agrees = expectedKind === "collection" ? kind === "collection" : kind.endsWith(`-${expectedKind}`);
+  if (!agrees) {
+    failPrebuiltCollections(
+      `prebuilt collection tree file ${relative4} has $kind ${kind} inconsistent with its filename`
+    );
+  }
+}
+async function digestAndValidatePrebuiltCollectionTree(files) {
+  if (!files.some((file) => file.relative === ".resources/definition.yaml")) {
+    failPrebuiltCollections("prebuilt collection tree is missing .resources/definition.yaml");
+  }
+  const hash = (0, import_node_crypto4.createHash)("sha256");
+  for (const file of files) {
+    let bytes;
+    try {
+      bytes = await appendArtifactDigestFileStreaming(hash, file.relative, file.absolute, {
+        dev: file.dev,
+        ino: file.ino,
+        size: file.size
+      });
+    } catch (error2) {
+      if (error2 instanceof ArtifactDigestStreamError) {
+        failPrebuiltCollections(error2.message);
+      }
+      const code = error2?.code;
+      if (code === "ELOOP" || code === "EPERM") {
+        failPrebuiltCollections(
+          `prebuilt collection tree file became a symlink or unsupported node at ${file.relative}`
+        );
+      }
+      failPrebuiltCollections(
+        `prebuilt collection tree file changed or became unsupported at ${file.relative}`
+      );
+    }
+    validateCanonicalV3CollectionFile(file.relative, bytes);
+  }
+  return hash.digest("hex");
+}
+async function preparePrebuiltCollections(inputs) {
+  const prepared = /* @__PURE__ */ new Map();
+  for (const entry of parsePrebuiltCollectionsJson(inputs.prebuiltCollectionsJson ?? "")) {
+    const confinedPath = assertPathWithinArtifactRoot(
+      entry.collectionPath,
+      inputs.artifactDir,
+      `prebuilt ${entry.role} collection path`
+    );
+    const absolute = path8.resolve(process.cwd(), confinedPath);
+    if (!(0, import_node_fs5.existsSync)(absolute)) {
+      prepared.set(entry.role, { entry, confinedPath });
+      continue;
+    }
+    const files = listPrebuiltCollectionTreeFiles(confinedPath, inputs.artifactDir);
+    const artifactDigest = await digestAndValidatePrebuiltCollectionTree(files);
+    prepared.set(entry.role, {
+      entry,
+      confinedPath,
+      artifactDigest
+    });
+  }
+  return prepared;
+}
+function tryReusePrebuiltCollection(options) {
+  const { prepared, expectedPath, expectedCloudId } = options;
+  const { entry } = prepared;
+  if (!expectedCloudId || entry.cloudId !== expectedCloudId) {
+    return false;
+  }
+  const expectedNormalized = canonicalizeRelativePath(expectedPath);
+  const entryNormalized = canonicalizeRelativePath(entry.collectionPath);
+  if (entryNormalized !== expectedNormalized) {
+    return false;
+  }
+  const confined = canonicalizeRelativePath(prepared.confinedPath);
+  if (confined !== expectedNormalized) {
+    return false;
+  }
+  const expectedName = path8.posix.basename(expectedNormalized);
+  if (path8.posix.basename(confined) !== expectedName) {
+    return false;
+  }
+  return prepared.artifactDigest === entry.artifactDigest;
+}
+async function exportCollectionArtifact(options) {
+  const {
+    role,
+    collectionId,
+    dirName,
+    collectionsDir,
+    prebuiltByRole,
+    postman,
+    core
+  } = options;
+  if (!collectionId) {
+    return void 0;
+  }
+  const expectedPath = `${collectionsDir}/${dirName}`;
+  const entry = prebuiltByRole.get(role);
+  if (entry) {
+    const reused = tryReusePrebuiltCollection({
+      prepared: entry,
+      expectedPath,
+      expectedCloudId: collectionId
+    });
+    if (reused) {
+      core.info(
+        `Reusing prebuilt ${role} collection tree at ${expectedPath} (artifactDigest match)`
+      );
+      return `../${expectedPath}`;
+    }
+    core.info(
+      `Prebuilt ${role} collection entry present but did not exactly match; exporting from cloud`
+    );
+  }
+  const col = await postman.getCollection(collectionId);
+  await convertAndSplitAnyCollection(
+    col,
+    expectedPath
   );
+  return `../${expectedPath}`;
 }
 function hasControlCharacter2(value) {
   for (let index = 0; index < value.length; index += 1) {
@@ -138952,21 +139697,21 @@ function assertPathWithinCwd(targetPath, fieldName) {
   if (!rawPath || hasControlCharacter2(originalPath) || path8.isAbsolute(rawPath) || path8.win32.isAbsolute(rawPath) || segments.includes("..") || rawPath.startsWith(":") || hasControlCharacter2(rawPath)) {
     throw new Error(`${fieldName} must stay within the repository root; received ${targetPath}`);
   }
-  const base = (0, import_node_fs4.realpathSync)(process.cwd());
+  const base = (0, import_node_fs5.realpathSync)(process.cwd());
   const resolved = path8.resolve(base, rawPath);
   const relative4 = path8.relative(base, resolved);
   if (relative4.startsWith("..") || path8.isAbsolute(relative4)) {
     throw new Error(`${fieldName} must stay within the repository root; received ${targetPath}`);
   }
   let existingPath = resolved;
-  while (!(0, import_node_fs4.existsSync)(existingPath)) {
+  while (!(0, import_node_fs5.existsSync)(existingPath)) {
     const parent = path8.dirname(existingPath);
     if (parent === existingPath) {
       break;
     }
     existingPath = parent;
   }
-  const realExistingPath = (0, import_node_fs4.realpathSync)(existingPath);
+  const realExistingPath = (0, import_node_fs5.realpathSync)(existingPath);
   const realRelative = path8.relative(base, realExistingPath);
   if (realRelative.startsWith("..") || path8.isAbsolute(realRelative)) {
     throw new Error(`${fieldName} must stay within the repository root; received ${targetPath}`);
@@ -138994,8 +139739,8 @@ async function exportArtifacts(inputs, dependencies, envUids, assetProjectName,
   ensureDir(specsDir);
   ensureDir(".postman");
   const globalsFilePath = `${globalsDir}/workspace.globals.yaml`;
-  if (!(0, import_node_fs4.existsSync)(globalsFilePath)) {
-    (0, import_node_fs4.writeFileSync)(globalsFilePath, "name: Globals\nvalues: []\n");
+  if (!(0, import_node_fs5.existsSync)(globalsFilePath)) {
+    (0, import_node_fs5.writeFileSync)(globalsFilePath, "name: Globals\nvalues: []\n");
   }
   if (inputs.generateCiWorkflow) {
     const ciDir = inputs.ciWorkflowPath.split("/").slice(0, -1).join("/");
@@ -139011,23 +139756,42 @@ async function exportArtifacts(inputs, dependencies, envUids, assetProjectName,
     inputs.specSyncMode,
     options.releaseLabel
   ) : void 0;
-  if (inputs.baselineCollectionId) {
-    const col = await dependencies.postman.getCollection(inputs.baselineCollectionId);
-    const dirName = getCollectionDirectoryName("Baseline", assetProjectName);
-    await convertAndSplitAnyCollection(col, `${collectionsDir}/${dirName}`);
-    manifestCollections[`../${collectionsDir}/${dirName}`] = inputs.baselineCollectionId;
-  }
-  if (inputs.smokeCollectionId) {
-    const col = await dependencies.postman.getCollection(inputs.smokeCollectionId);
-    const dirName = getCollectionDirectoryName("Smoke", assetProjectName);
-    await convertAndSplitAnyCollection(col, `${collectionsDir}/${dirName}`);
-    manifestCollections[`../${collectionsDir}/${dirName}`] = inputs.smokeCollectionId;
-  }
-  if (inputs.contractCollectionId) {
-    const col = await dependencies.postman.getCollection(inputs.contractCollectionId);
-    const dirName = getCollectionDirectoryName("Contract", assetProjectName);
-    await convertAndSplitAnyCollection(col, `${collectionsDir}/${dirName}`);
-    manifestCollections[`../${collectionsDir}/${dirName}`] = inputs.contractCollectionId;
+  const prebuiltByRole = options.preparedPrebuiltCollections;
+  const baselineRef = await exportCollectionArtifact({
+    role: "baseline",
+    collectionId: inputs.baselineCollectionId,
+    dirName: getCollectionDirectoryName("Baseline", assetProjectName),
+    collectionsDir,
+    prebuiltByRole,
+    postman: dependencies.postman,
+    core: dependencies.core
+  });
+  if (baselineRef) {
+    manifestCollections[baselineRef] = inputs.baselineCollectionId;
+  }
+  const smokeRef = await exportCollectionArtifact({
+    role: "smoke",
+    collectionId: inputs.smokeCollectionId,
+    dirName: getCollectionDirectoryName("Smoke", assetProjectName),
+    collectionsDir,
+    prebuiltByRole,
+    postman: dependencies.postman,
+    core: dependencies.core
+  });
+  if (smokeRef) {
+    manifestCollections[smokeRef] = inputs.smokeCollectionId;
+  }
+  const contractRef = await exportCollectionArtifact({
+    role: "contract",
+    collectionId: inputs.contractCollectionId,
+    dirName: getCollectionDirectoryName("Contract", assetProjectName),
+    collectionsDir,
+    prebuiltByRole,
+    postman: dependencies.postman,
+    core: dependencies.core
+  });
+  if (contractRef) {
+    manifestCollections[contractRef] = inputs.contractCollectionId;
   }
   for (const [envName, envUid] of Object.entries(envUids)) {
     writeJsonFile(
@@ -139042,7 +139806,7 @@ async function exportArtifacts(inputs, dependencies, envUids, assetProjectName,
     workspaceLinkEnabled: inputs.workspaceLinkEnabled,
     workspaceLinkStatus: options.workspaceLinkStatus
   });
-  (0, import_node_fs4.writeFileSync)(".postman/resources.yaml", buildResourcesManifest(
+  (0, import_node_fs5.writeFileSync)(".postman/resources.yaml", buildResourcesManifest(
     durableWorkspaceId,
     manifestCollections,
     envUids,
@@ -139054,11 +139818,18 @@ async function exportArtifacts(inputs, dependencies, envUids, assetProjectName,
     options.priorState
   ));
   if (mappedSpec && Object.keys(manifestCollections).length > 0) {
-    (0, import_node_fs4.writeFileSync)(
+    let existingWorkflows;
+    try {
+      existingWorkflows = (0, import_node_fs5.readFileSync)(".postman/workflows.yaml", "utf8");
+    } catch {
+      existingWorkflows = void 0;
+    }
+    (0, import_node_fs5.writeFileSync)(
       ".postman/workflows.yaml",
       buildSpecCollectionWorkflowManifest(
         mappedSpec.configRelativePath,
-        Object.keys(manifestCollections)
+        Object.keys(manifestCollections),
+        existingWorkflows
       )
     );
   }
@@ -139103,12 +139874,12 @@ async function commitAndPushGeneratedFiles(inputs, dependencies) {
       const dir = parts.slice(0, -1).join("/");
       ensureDir(dir);
     }
-    (0, import_node_fs4.writeFileSync)(inputs.ciWorkflowPath, ciWorkflow);
+    (0, import_node_fs5.writeFileSync)(inputs.ciWorkflowPath, ciWorkflow);
     if (inputs.provider === "github" || inputs.provider === "unknown") {
       const gcPath = ".github/workflows/postman-preview-gc.yml";
       if (inputs.ciWorkflowPath.endsWith(".github/workflows/ci.yml") || inputs.ciWorkflowPath === ".github/workflows/ci.yml") {
         ensureDir(".github/workflows");
-        (0, import_node_fs4.writeFileSync)(gcPath, renderGcWorkflowTemplate());
+        (0, import_node_fs5.writeFileSync)(gcPath, renderGcWorkflowTemplate());
       }
     }
   }
@@ -139116,16 +139887,16 @@ async function commitAndPushGeneratedFiles(inputs, dependencies) {
     return { commitSha: "", resolvedCurrentRef: "", pushed: false };
   }
   const provisionPath = ".github/workflows/provision.yml";
-  const provisionExists = inputs.provider === "github" && (0, import_node_fs4.existsSync)(provisionPath);
+  const provisionExists = inputs.provider === "github" && (0, import_node_fs5.existsSync)(provisionPath);
   const gcWorkflowPath = ".github/workflows/postman-preview-gc.yml";
-  const gcExists = inputs.generateCiWorkflow && (0, import_node_fs4.existsSync)(gcWorkflowPath);
+  const gcExists = inputs.generateCiWorkflow && (0, import_node_fs5.existsSync)(gcWorkflowPath);
   const stagePaths = [
     inputs.artifactDir,
     ".postman",
     inputs.generateCiWorkflow ? inputs.ciWorkflowPath : null,
     gcExists ? gcWorkflowPath : null,
     provisionExists ? provisionPath : null
-  ].filter((entry) => typeof entry === "string" && ((0, import_node_fs4.existsSync)(entry) || entry === provisionPath));
+  ].filter((entry) => typeof entry === "string" && ((0, import_node_fs5.existsSync)(entry) || entry === provisionPath));
   if (stagePaths.length === 0) {
     dependencies.core.info("No generated repository paths were found; skipping repo mutation.");
     return {
@@ -139233,6 +140004,7 @@ async function runRepoSyncInner(inputs, dependencies) {
       }
     }
   }
+  const preparedPrebuiltCollections = await preparePrebuiltCollections(inputs);
   let skipRepositoryLinkPost = false;
   let repositoryLinkPreflightWasFree = false;
   if (inputs.workspaceLinkEnabled && inputs.workspaceId && inputs.repoUrl && dependencies.internalIntegration?.findWorkspaceForRepo) {
@@ -139269,6 +140041,7 @@ async function runRepoSyncInner(inputs, dependencies) {
   const branchAssetMarker = buildBranchAssetMarker(branchDecision, inputs);
   const envUids = await upsertEnvironments(inputs, dependencies, resourcesState, branchAssetMarker);
   outputs["environment-uids-json"] = JSON.stringify(envUids);
+  dependencies.core.setOutput("environment-uids-json", outputs["environment-uids-json"]);
   if (inputs.environmentSyncEnabled && inputs.workspaceId && dependencies.internalIntegration) {
     const associations = Object.entries(envUids).map(([envName, envUid]) => ({
       envUid,
@@ -139387,6 +140160,7 @@ async function runRepoSyncInner(inputs, dependencies) {
         }
       }
       outputs["mock-url"] = resolvedMockUrl;
+      dependencies.core.setOutput("mock-url", resolvedMockUrl);
     }
   }
   if (inputs.workspaceId && inputs.smokeCollectionId && Object.keys(envUids).length > 0) {
@@ -139462,6 +140236,7 @@ async function runRepoSyncInner(inputs, dependencies) {
         }
       }
       outputs["monitor-id"] = resolvedMonitorId;
+      dependencies.core.setOutput("monitor-id", resolvedMonitorId);
       if (!effectiveCron && resolvedMonitorId) {
         try {
           await dependencies.postman.runMonitor(resolvedMonitorId);
@@ -139519,7 +140294,8 @@ async function runRepoSyncInner(inputs, dependencies) {
     priorWorkspaceId: resourcesState?.workspace?.id,
     existingSpecs: resourcesState?.cloudResources?.specs,
     releaseLabel,
-    priorState: resourcesState
+    priorState: resourcesState,
+    preparedPrebuiltCollections
   });
   const commit = await commitAndPushGeneratedFiles(inputs, dependencies);
   outputs["commit-sha"] = commit.commitSha;
@@ -139745,7 +140521,12 @@ async function resolvePostmanApiKeyAndTeamId(inputs, actionCore, actionExec, mas
         bifrostBaseUrl: inputs.postmanBifrostBase,
         // No fallback on the org-mode probe: the expected non-org 400 must
         // surface verbatim, not be re-fired against the /_api alias.
-        secretMasker: masker
+        secretMasker: masker,
+        onRetryEvent: (event) => {
+          actionCore.info(
+            `[postman retry] action=repo-sync class=${event.class} status=${event.status ?? "none"} attempt=${event.attempt} delayMs=${event.delay}`
+          );
+        }
       });
       const squads = await gateway.getSquads(teamId);
       if (squads.length > 0) {
@@ -139809,7 +140590,12 @@ function createRepoSyncDependencies(inputs, resolved, factories, options = {}) {
     fallbackBaseUrl: inputs.postmanFallbackBase,
     teamId: resolved.teamId,
     orgMode: inputs.orgMode,
-    secretMasker: masker
+    secretMasker: masker,
+    onRetryEvent: (event) => {
+      factories.core.info(
+        `[postman retry] action=repo-sync class=${event.class} status=${event.status ?? "none"} attempt=${event.attempt} delayMs=${event.delay}`
+      );
+    }
   });
   const gatewayAssets = new PostmanGatewayAssetsClient({
     gateway,
@@ -139877,7 +140663,8 @@ function createRepoSyncDependencies(inputs, resolved, factories, options = {}) {
     bifrostBaseUrl: inputs.postmanBifrostBase,
     orgMode: inputs.orgMode,
     teamId: resolved.teamId,
-    secretMasker: masker
+    secretMasker: masker,
+    gateway
   });
   return {
     teamId: resolved.teamId,
@@ -139927,7 +140714,10 @@ async function runAction(actionCore = core_exports, actionExec = exec_exports) {
   }
   await mintAccessTokenIfNeeded(inputs, {
     info: (message) => actionCore.info(message),
-    warning: (message) => actionCore.warning(message)
+    warning: (message) => actionCore.warning(message),
+    retryEvent: (event) => actionCore.info(
+      `[postman retry] action=repo-sync class=${event.class} status=${event.status ?? "none"} attempt=${event.attempt} delayMs=${event.delay}`
+    )
   }, (secret) => actionCore.setSecret(secret));
   const masker = createSecretMasker([
     inputs.postmanApiKey,
@@ -139948,7 +140738,12 @@ async function runAction(actionCore = core_exports, actionExec = exec_exports) {
     explicitTeamId: inputs.teamId || void 0,
     mode: inputs.credentialPreflight,
     mask: masker,
-    log: actionCore
+    log: {
+      ...actionCore,
+      retryEvent: (event) => actionCore.info(
+        `[postman retry] action=repo-sync class=${event.class} status=${event.status ?? "none"} attempt=${event.attempt} delayMs=${event.delay}`
+      )
+    }
   });
   const resolved = await resolvePostmanApiKeyAndTeamId(inputs, actionCore, actionExec, masker, {
     env: process.env
@@ -139989,6 +140784,7 @@ async function runAction(actionCore = core_exports, actionExec = exec_exports) {
   decideBranchTier,
   getInput,
   hasInput,
+  prebuiltDirectoryTraversalIdentity,
   readActionInputs,
   resolveInputs,
   resolvePostmanApiKeyAndTeamId,