@postman-cse/onboarding-repo-sync 2.1.13 → 2.1.15

package/dist/cli.cjs

@@ -26571,7 +26571,7 @@ var require_util7 = __commonJS({
     exports2.esc = esc;
     exports2.slugify = slugify;
     exports2.isObject = isObject;
-    exports2.isPlainObject = isPlainObject2;
+    exports2.isPlainObject = isPlainObject3;
     exports2.shallowClone = shallowClone;
     exports2.numKeys = numKeys;
     exports2.escapeRegex = escapeRegex;
@@ -26754,7 +26754,7 @@ var require_util7 = __commonJS({
         return false;
       }
     });
-    function isPlainObject2(o) {
+    function isPlainObject3(o) {
       if (isObject(o) === false)
         return false;
       const ctor = o.constructor;
@@ -26771,7 +26771,7 @@ var require_util7 = __commonJS({
       return true;
     }
     function shallowClone(o) {
-      if (isPlainObject2(o))
+      if (isPlainObject3(o))
         return { ...o };
       if (Array.isArray(o))
         return [...o];
@@ -26976,7 +26976,7 @@ var require_util7 = __commonJS({
       return clone(schema, def);
     }
     function extend(schema, shape) {
-      if (!isPlainObject2(shape)) {
+      if (!isPlainObject3(shape)) {
         throw new Error("Invalid input to extend: expected a plain object");
       }
       const checks = schema._zod.def.checks;
@@ -26999,7 +26999,7 @@ var require_util7 = __commonJS({
       return clone(schema, def);
     }
     function safeExtend(schema, shape) {
-      if (!isPlainObject2(shape)) {
+      if (!isPlainObject3(shape)) {
         throw new Error("Invalid input to safeExtend: expected a plain object");
       }
       const def = mergeDefs(schema._zod.def, {
@@ -54818,7 +54818,7 @@ var require_lodash = __commonJS({
               } else {
                 newValue = [];
               }
-            } else if (isPlainObject2(srcValue) || isArguments(srcValue)) {
+            } else if (isPlainObject3(srcValue) || isArguments(srcValue)) {
               newValue = objValue;
               if (isArguments(objValue)) {
                 newValue = toPlainObject(objValue);
@@ -55782,7 +55782,7 @@ var require_lodash = __commonJS({
           return objValue;
         }
         function customOmitClone(value) {
-          return isPlainObject2(value) ? undefined2 : value;
+          return isPlainObject3(value) ? undefined2 : value;
         }
         function equalArrays(array, other, bitmask, customizer, equalFunc, stack) {
           var isPartial = bitmask & COMPARE_PARTIAL_FLAG, arrLength = array.length, othLength = other.length;
@@ -57283,7 +57283,7 @@ var require_lodash = __commonJS({
         var isBuffer = nativeIsBuffer || stubFalse;
         var isDate = nodeIsDate ? baseUnary(nodeIsDate) : baseIsDate;
         function isElement(value) {
-          return isObjectLike(value) && value.nodeType === 1 && !isPlainObject2(value);
+          return isObjectLike(value) && value.nodeType === 1 && !isPlainObject3(value);
         }
         function isEmpty(value) {
           if (value == null) {
@@ -57319,7 +57319,7 @@ var require_lodash = __commonJS({
             return false;
           }
           var tag = baseGetTag(value);
-          return tag == errorTag || tag == domExcTag || typeof value.message == "string" && typeof value.name == "string" && !isPlainObject2(value);
+          return tag == errorTag || tag == domExcTag || typeof value.message == "string" && typeof value.name == "string" && !isPlainObject3(value);
         }
         function isFinite2(value) {
           return typeof value == "number" && nativeIsFinite(value);
@@ -57370,7 +57370,7 @@ var require_lodash = __commonJS({
         function isNumber(value) {
           return typeof value == "number" || isObjectLike(value) && baseGetTag(value) == numberTag;
         }
-        function isPlainObject2(value) {
+        function isPlainObject3(value) {
           if (!isObjectLike(value) || baseGetTag(value) != objectTag) {
             return false;
           }
@@ -58441,7 +58441,7 @@ var require_lodash = __commonJS({
         lodash.isNumber = isNumber;
         lodash.isObject = isObject;
         lodash.isObjectLike = isObjectLike;
-        lodash.isPlainObject = isPlainObject2;
+        lodash.isPlainObject = isPlainObject3;
         lodash.isRegExp = isRegExp;
         lodash.isSafeInteger = isSafeInteger;
         lodash.isSet = isSet;
@@ -128814,11 +128814,12 @@ __export(cli_exports, {
   normalizeCliFlag: () => normalizeCliFlag,
   parseCliArgs: () => parseCliArgs,
   runCli: () => runCli,
-  toDotenv: () => toDotenv
+  toDotenv: () => toDotenv,
+  writeOptionalFileAtomic: () => writeOptionalFileAtomic
 });
 module.exports = __toCommonJS(cli_exports);
 var import_node_child_process = require("node:child_process");
-var import_node_fs5 = require("node:fs");
+var import_node_fs6 = require("node:fs");
 var import_promises = require("node:fs/promises");
 var import_node_path3 = __toESM(require("node:path"), 1);
 var import_node_util = require("node:util");
@@ -129186,7 +129187,8 @@ var ExitCode;
 })(ExitCode || (ExitCode = {}));
 
 // src/index.ts
-var import_node_fs4 = require("node:fs");
+var import_node_crypto3 = require("node:crypto");
+var import_node_fs5 = require("node:fs");
 var path3 = __toESM(require("node:path"), 1);
 
 // node_modules/js-yaml/dist/js-yaml.mjs
@@ -132102,6 +132104,7 @@ function dump(input, options = {}) {
 }
 
 // src/postman-v3/converter.ts
+var import_node_fs = require("node:fs");
 var fs2 = __toESM(require("node:fs/promises"), 1);
 var path = __toESM(require("node:path"), 1);
 var V2 = __toESM(require_v2(), 1);
@@ -132172,6 +132175,72 @@ function structuredCloneSafe(value) {
   if (typeof structuredClone === "function") return structuredClone(value);
   return JSON.parse(JSON.stringify(value));
 }
+var ArtifactDigestStreamError = class extends Error {
+  code = "ARTIFACT_DIGEST_STREAM";
+  constructor(message, options) {
+    super(message, options);
+    this.name = "ArtifactDigestStreamError";
+  }
+};
+function sameFileIdentity(left, right) {
+  return left.dev === right.dev && left.ino === right.ino && left.size === right.size;
+}
+async function appendArtifactDigestFileStreaming(hash, relative3, absolute, expected) {
+  const flags = typeof import_node_fs.constants.O_NOFOLLOW === "number" ? import_node_fs.constants.O_RDONLY | import_node_fs.constants.O_NOFOLLOW : import_node_fs.constants.O_RDONLY;
+  let handle;
+  try {
+    handle = await fs2.open(absolute, flags);
+  } catch (error) {
+    const code = error?.code;
+    if (code === "ELOOP" || code === "EMLINK" || code === "EINVAL") {
+      throw new ArtifactDigestStreamError(
+        `prebuilt collection tree file became a symlink or unsupported node at ${relative3}`,
+        { cause: error }
+      );
+    }
+    throw new ArtifactDigestStreamError(
+      `prebuilt collection tree file changed or became unsupported at ${relative3}`,
+      { cause: error }
+    );
+  }
+  try {
+    const before = await handle.stat();
+    if (!before.isFile() || !sameFileIdentity(before, expected)) {
+      throw new ArtifactDigestStreamError(
+        `prebuilt collection tree file changed or became unsupported at ${relative3}`
+      );
+    }
+    hash.update(relative3);
+    hash.update("\0");
+    const content = Buffer.allocUnsafe(expected.size);
+    let total = 0;
+    const buffer = Buffer.alloc(64 * 1024);
+    for (; ; ) {
+      const { bytesRead } = await handle.read(buffer, 0, buffer.length, null);
+      if (bytesRead === 0) {
+        break;
+      }
+      if (total + bytesRead > expected.size) {
+        throw new ArtifactDigestStreamError(
+          `prebuilt collection tree file changed while reading at ${relative3}`
+        );
+      }
+      buffer.copy(content, total, 0, bytesRead);
+      hash.update(buffer.subarray(0, bytesRead));
+      total += bytesRead;
+    }
+    hash.update("\0");
+    const after = await handle.stat();
+    if (!after.isFile() || !sameFileIdentity(after, expected) || total !== expected.size) {
+      throw new ArtifactDigestStreamError(
+        `prebuilt collection tree file changed while reading at ${relative3}`
+      );
+    }
+    return total === expected.size ? content : content.subarray(0, total);
+  } finally {
+    await handle.close();
+  }
+}
 async function listFilesRelative(dir, base) {
   let entries;
   try {
@@ -132732,7 +132801,7 @@ function getCiWorkflowTemplate(provider, options = {}) {
 }
 
 // src/lib/github/repo-mutation.ts
-var import_node_fs = require("node:fs");
+var import_node_fs2 = require("node:fs");
 var import_node_path = __toESM(require("node:path"), 1);
 
 // src/lib/secrets.ts
@@ -133022,7 +133091,7 @@ var RepoMutationService = class {
       throw new Error(this.secretMasker(changed.stderr || changed.stdout || "Failed to inspect generated changes"));
     }
     const hasPlannedRemoval = removePaths.some(
-      (removePath) => (0, import_node_fs.existsSync)(import_node_path.default.resolve(this.cwd, removePath))
+      (removePath) => (0, import_node_fs2.existsSync)(import_node_path.default.resolve(this.cwd, removePath))
     );
     if (!changed.stdout.trim() && !hasPlannedRemoval) {
       return {
@@ -133046,7 +133115,7 @@ var RepoMutationService = class {
     await this.execute("git", ["config", "user.name", options.committerName]);
     await this.execute("git", ["config", "user.email", options.committerEmail]);
     for (const removePath of removePaths) {
-      (0, import_node_fs.rmSync)(import_node_path.default.resolve(this.cwd, removePath), { force: true });
+      (0, import_node_fs2.rmSync)(import_node_path.default.resolve(this.cwd, removePath), { force: true });
     }
     await this.execute("git", ["add", "-A", "--", ...stagePaths]);
     const staged = await this.execute("git", ["diff", "--cached", "--quiet"]);
@@ -133589,14 +133658,14 @@ function createTelemetryContext(options) {
 }
 
 // src/action-version.ts
-var import_node_fs2 = require("node:fs");
+var import_node_fs3 = require("node:fs");
 var import_node_path2 = require("node:path");
 function resolveActionVersion2() {
   if (false) {
     return void 0;
   }
   try {
-    const raw = (0, import_node_fs2.readFileSync)((0, import_node_path2.join)(__dirname, "..", "package.json"), "utf8");
+    const raw = (0, import_node_fs3.readFileSync)((0, import_node_path2.join)(__dirname, "..", "package.json"), "utf8");
     return JSON.parse(raw).version ?? "unknown";
   } catch {
     return "unknown";
@@ -133835,7 +133904,8 @@ async function resolveSessionIdentity(opts) {
       opts.fetchImpl ?? fetch,
       Math.max(1, opts.maxAttempts ?? SESSION_MAX_ATTEMPTS),
       opts.sleepImpl ?? defaultSessionSleep,
-      opts.randomImpl ?? defaultRandom
+      opts.randomImpl ?? defaultRandom,
+      opts.onRetryEvent
     );
     sessionMemo.set(memoKey, pending);
   }
@@ -133869,7 +133939,7 @@ async function parseSessionResponse(response) {
     consumerType: coerceText(root.consumerType) ?? coerceText(data?.consumerType) ?? coerceText(user?.consumerType)
   };
 }
-async function probeSessionIdentity(baseUrl, accessToken, fetchImpl, maxAttempts, sleepImpl, random) {
+async function probeSessionIdentity(baseUrl, accessToken, fetchImpl, maxAttempts, sleepImpl, random, onRetryEvent) {
   let failure = "unavailable";
   for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
     let response;
@@ -133881,7 +133951,9 @@ async function probeSessionIdentity(baseUrl, accessToken, fetchImpl, maxAttempts
     } catch {
       failure = "unavailable";
       if (attempt < maxAttempts) {
-        await sleepImpl(computeSessionRetryDelayMs(void 0, attempt, random));
+        const delay = computeSessionRetryDelayMs(void 0, attempt, random);
+        onRetryEvent?.({ class: "transport", attempt, delay });
+        await sleepImpl(delay);
         continue;
       }
       break;
@@ -133903,7 +133975,9 @@ async function probeSessionIdentity(baseUrl, accessToken, fetchImpl, maxAttempts
     if (response.status === 429 || response.status >= 500) {
       failure = "unavailable";
       if (attempt < maxAttempts) {
-        await sleepImpl(computeSessionRetryDelayMs(response, attempt, random));
+        const delay = computeSessionRetryDelayMs(response, attempt, random);
+        onRetryEvent?.({ class: "http", status: response.status, attempt, delay });
+        await sleepImpl(delay);
         continue;
       }
       break;
@@ -134005,7 +134079,8 @@ async function runCredentialPreflight(args) {
       accessToken,
       fetchImpl: args.fetchImpl,
       ...args.sleepImpl ? { sleepImpl: args.sleepImpl } : {},
-      ...args.randomImpl ? { randomImpl: args.randomImpl } : {}
+      ...args.randomImpl ? { randomImpl: args.randomImpl } : {},
+      onRetryEvent: args.retryEvent ?? args.log.retryEvent
     });
   } catch (error) {
     args.log.warning(
@@ -134657,6 +134732,11 @@ var postmanRepoSyncActionContract = {
       description: "Contract collection ID used for exported artifacts.",
       required: false
     },
+    "prebuilt-collections-json": {
+      description: "Optional digest-bound JSON manifest of unique baseline, smoke, or contract roles with confined repo-relative path, SHA-256 artifact digest of the on-disk v3 collection tree (sorted relative-path + NUL + bytes + NUL), and canonical cloud ID. The optional payloadDigest field is the semantic v2 payload digest carried for provenance (format-validated only, not the reuse gate). Exact role, path, cloudId, and artifactDigest matches reuse the on-disk tree without cloud export.",
+      required: false,
+      default: ""
+    },
     "collection-sync-mode": {
       description: "Collection sync lifecycle mode (refresh or version).",
       required: false,
@@ -134899,7 +134979,7 @@ var postmanRepoSyncActionContract = {
       "Create or update Postman environments from runtime URLs.",
       "Associate Postman environments to system environments through Postman integration APIs.",
       "Create mock servers and smoke monitors from generated collections.",
-      "Export Postman collections in the Collection v3 multi-file YAML directory structure under `postman/collections/` (e.g., `<name>/collection.yaml`, nested folder and request YAML files), and export environments plus `.postman/resources.yaml` into the repository.",
+      "Export Postman collections in the Collection v3 multi-file YAML directory structure under `postman/collections/` (canonical `.resources/definition.yaml` plus request/resource YAML files), and export environments plus `.postman/resources.yaml` into the repository.",
       "Link the Postman workspace to the repository (GitHub or GitLab) through Postman integration APIs.",
       "Commit synced artifacts and push them back to the current checked out ref."
     ],
@@ -135010,13 +135090,36 @@ var PostmanGatewayAssetsClient = class {
       name: String(entry.name ?? entry.message ?? "").trim()
     })).filter((entry) => entry.id || entry.name);
   }
+  /**
+   * Delete a collection (GC path). DELETE is idempotent: transient 408/429/5xx
+   * (including Bifrost ESOCKETTIMEDOUT envelopes) are retried with the same
+   * bounded budget as other idempotent writes; 404 is success (already gone).
+   * Ordinary 4xx are not retried.
+   */
   async deleteCollection(collectionUid) {
     const bareId = String(collectionUid).split("-").slice(-5).join("-") || collectionUid;
-    await this.gateway.requestJson({
-      service: "collection",
-      method: "delete",
-      path: `/v3/collections/${bareId}`
-    });
+    try {
+      await retry(
+        () => this.gateway.requestJson({
+          service: "collection",
+          method: "delete",
+          path: `/v3/collections/${bareId}`
+        }),
+        {
+          maxAttempts: 5,
+          delayMs: 2e3,
+          backoffMultiplier: 2,
+          maxDelayMs: 15e3,
+          sleep: this.sleep,
+          shouldRetry: (e) => this.isRetryableIdempotentWriteOutcome(e)
+        }
+      );
+    } catch (error) {
+      if (error instanceof HttpError && error.status === 404) {
+        return;
+      }
+      throw error;
+    }
   }
   async listSpecifications(workspaceId) {
     const response = await this.gateway.requestJson({
@@ -135684,6 +135787,7 @@ var AccessTokenProvider = class {
   maxAttempts;
   onToken;
   sleep;
+  onRetryEvent;
   inflight;
   constructor(options) {
     this.token = String(options.accessToken || "").trim();
@@ -135695,6 +135799,7 @@ var AccessTokenProvider = class {
     this.maxAttempts = Math.max(1, options.maxAttempts ?? 2);
     this.onToken = options.onToken;
     this.sleep = options.sleep;
+    this.onRetryEvent = options.onRetryEvent;
   }
   current() {
     return this.token;
@@ -135720,7 +135825,12 @@ var AccessTokenProvider = class {
       delayMs: 1e3,
       backoffMultiplier: 2,
       ...this.sleep ? { sleep: this.sleep } : {},
-      shouldRetry: (error) => !(error instanceof MintError && error.permanent)
+      shouldRetry: (error) => !(error instanceof MintError && error.permanent),
+      onRetry: ({ attempt, delayMs, error }) => {
+        const status = error instanceof MintError ? error.status : void 0;
+        const retryClass = status === void 0 ? "transport" : "http";
+        this.onRetryEvent?.({ class: retryClass, ...status === void 0 ? {} : { status }, attempt, delay: Math.max(0, delayMs) });
+      }
     });
     this.token = token;
     this.onToken?.(token);
@@ -135751,7 +135861,7 @@ var AccessTokenProvider = class {
           true
         );
       }
-      throw new MintError(`postman: re-mint failed (service-account-tokens HTTP ${status}).`, false);
+      throw new MintError(`postman: re-mint failed (service-account-tokens HTTP ${status}).`, false, status);
     }
     let parsed;
     try {
@@ -135782,7 +135892,8 @@ async function mintAccessTokenIfNeeded(inputs, log, setSecret2, fetchImpl = fetc
     apiKey: inputs.postmanApiKey,
     apiBaseUrl,
     fetchImpl,
-    onToken: (token) => setSecret2?.(token)
+    onToken: (token) => setSecret2?.(token),
+    onRetryEvent: (event) => log.retryEvent?.(event)
   });
   try {
     inputs.postmanAccessToken = await provider.refresh();
@@ -135822,6 +135933,7 @@ var AccessTokenGatewayClient = class {
   requestTimeoutMs;
   retryMaxDelayMs;
   randomImpl;
+  onRetryEvent;
   constructor(options) {
     this.tokenProvider = options.tokenProvider;
     this.bifrostBaseUrl = String(
@@ -135840,6 +135952,7 @@ var AccessTokenGatewayClient = class {
     this.requestTimeoutMs = options.requestTimeoutMs ?? 3e4;
     this.retryMaxDelayMs = options.retryMaxDelayMs ?? 5e3;
     this.randomImpl = options.randomImpl ?? Math.random;
+    this.onRetryEvent = options.onRetryEvent;
   }
   configureTeamContext(teamId, orgMode) {
     this.teamId = String(teamId || "").trim();
@@ -135908,8 +136021,9 @@ var AccessTokenGatewayClient = class {
     if (!this.fallbackBaseUrl) return false;
     return retryTransient || request.fallback === "auto";
   }
-  async attemptFallback(request, retryTransient) {
+  async attemptFallback(request, retryTransient, status) {
     if (!this.fallbackEligible(request, retryTransient)) return null;
+    this.emitRetryEvent("fallback", status, 1, 0);
     const response = await this.tryFallback(request);
     if (!response) return null;
     if (response.ok) return response;
@@ -135935,6 +136049,7 @@ var AccessTokenGatewayClient = class {
       } catch (error) {
         if (retryTransient && attempt < this.maxRetries) {
           const delay = this.retryDelayMs(attempt);
+          this.emitRetryEvent("transport", void 0, attempt + 1, delay);
           attempt += 1;
           await this.sleepImpl(delay);
           continue;
@@ -135948,7 +136063,9 @@ var AccessTokenGatewayClient = class {
         const inner = this.innerStatus(okBody);
         if (inner !== void 0) {
           if (retryTransient && this.isTransient(inner, okBody) && attempt < this.maxRetries) {
-            await this.sleepImpl(this.retryDelayMs(attempt));
+            const delay = this.retryDelayMs(attempt);
+            this.emitRetryEvent("inner", inner, attempt + 1, delay);
+            await this.sleepImpl(delay);
             attempt += 1;
             continue;
           }
@@ -135958,6 +136075,7 @@ var AccessTokenGatewayClient = class {
       }
       const body = await response.text().catch(() => "");
       if (isExpiredAuthError(response.status, body) && this.tokenProvider.canRefresh()) {
+        this.emitRetryEvent("auth", response.status, 1, 0);
         await this.tokenProvider.refresh();
         response = await this.send(request);
         if (response.ok) {
@@ -135968,11 +136086,12 @@ var AccessTokenGatewayClient = class {
       }
       if (retryTransient && this.isTransient(response.status, body) && attempt < this.maxRetries) {
         const delay = this.retryDelayMs(attempt, parseRetryAfterMs2(response.headers.get("retry-after")));
+        this.emitRetryEvent("http", response.status, attempt + 1, delay);
         attempt += 1;
         await this.sleepImpl(delay);
         continue;
       }
-      const fallbackResponse = await this.attemptFallback(request, retryTransient);
+      const fallbackResponse = await this.attemptFallback(request, retryTransient, response.status);
       if (fallbackResponse) return fallbackResponse;
       throw this.toHttpError(request, response, body);
     }
@@ -135980,6 +136099,14 @@ var AccessTokenGatewayClient = class {
   retryDelayMs(attempt, retryAfter) {
     return retryAfter === void 0 ? fullJitterDelayMs(attempt, this.retryBaseDelayMs, this.retryMaxDelayMs, this.randomImpl) : Math.min(this.retryMaxDelayMs, retryAfter);
   }
+  emitRetryEvent(retryClass, status, attempt, delay) {
+    this.onRetryEvent?.({
+      class: retryClass,
+      ...status === void 0 ? {} : { status },
+      attempt: Math.max(1, attempt),
+      delay: Math.max(0, delay)
+    });
+  }
   isTransient(status, body) {
     return status === 408 || status === 429 || status >= 500 || /ESOCKETTIMEDOUT|ETIMEDOUT|ECONNRESET|serverError|downstream/.test(body);
   }
@@ -136057,7 +136184,7 @@ var AccessTokenGatewayClient = class {
 };
 
 // src/lib/repo/branch-decision.ts
-var import_node_fs3 = require("node:fs");
+var import_node_fs4 = require("node:fs");
 var import_node_crypto2 = require("node:crypto");
 var ContractError = class extends Error {
   code;
@@ -136098,7 +136225,7 @@ function readGithubEvent(env) {
   const path5 = clean(env.GITHUB_EVENT_PATH);
   if (!path5) return void 0;
   try {
-    return JSON.parse((0, import_node_fs3.readFileSync)(path5, "utf8"));
+    return JSON.parse((0, import_node_fs4.readFileSync)(path5, "utf8"));
   } catch {
     return void 0;
   }
@@ -136551,6 +136678,7 @@ function resolveInputs(env = process.env) {
     baselineCollectionId: getInput("baseline-collection-id", env),
     smokeCollectionId: getInput("smoke-collection-id", env),
     contractCollectionId: getInput("contract-collection-id", env),
+    prebuiltCollectionsJson: getInput("prebuilt-collections-json", env),
     specId: getInput("spec-id", env),
     specContentChanged: parseBooleanInput(getInput("spec-content-changed", env), true),
     specPath: getInput("spec-path", env),
@@ -136666,7 +136794,7 @@ var StateUnreadableError = class extends Error {
 function readResourcesState() {
   let raw;
   try {
-    raw = (0, import_node_fs4.readFileSync)(".postman/resources.yaml", "utf8");
+    raw = (0, import_node_fs5.readFileSync)(".postman/resources.yaml", "utf8");
   } catch {
     return null;
   }
@@ -136725,12 +136853,15 @@ function getEnvironmentUidsFromResources(resourcesState) {
 function normalizeToPosix(filePath) {
   return filePath.split(path3.sep).join("/").replace(/\\/g, "/");
 }
+function canonicalizeRelativePath(value) {
+  return normalizeToPosix(String(value ?? "").trim()).replace(/^\.\/+/, "").replace(/\/{2,}/g, "/").replace(/\/+$/g, "");
+}
 function isOpenApiSpecFile(filePath) {
   if (!(filePath.endsWith(".json") || filePath.endsWith(".yaml") || filePath.endsWith(".yml"))) {
     return false;
   }
   try {
-    const raw = (0, import_node_fs4.readFileSync)(filePath, "utf8");
+    const raw = (0, import_node_fs5.readFileSync)(filePath, "utf8");
     const parsed = filePath.endsWith(".json") ? JSON.parse(raw) : load(raw);
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
       return false;
@@ -136759,7 +136890,7 @@ function scanLocalSpecReferences(baseDir = ".") {
   const found = /* @__PURE__ */ new Set();
   const refs = [];
   const visit2 = (currentDir) => {
-    for (const entry of (0, import_node_fs4.readdirSync)(currentDir, { withFileTypes: true })) {
+    for (const entry of (0, import_node_fs5.readdirSync)(currentDir, { withFileTypes: true })) {
       if (ignoredDirs.has(entry.name)) {
         continue;
       }
@@ -136789,7 +136920,7 @@ function resolveMappedSpecReference(explicitSpecPath, discoveredSpecs) {
   const normalizedExplicitPath = normalizeToPosix(explicitSpecPath.trim());
   if (normalizedExplicitPath) {
     const explicitFullPath = path3.resolve(normalizedExplicitPath);
-    if ((0, import_node_fs4.existsSync)(explicitFullPath) && (0, import_node_fs4.statSync)(explicitFullPath).isFile()) {
+    if ((0, import_node_fs5.existsSync)(explicitFullPath) && (0, import_node_fs5.statSync)(explicitFullPath).isFile()) {
       return {
         repoRelativePath: normalizedExplicitPath,
         configRelativePath: normalizeToPosix(path3.join("..", normalizedExplicitPath))
@@ -136915,6 +137046,7 @@ async function upsertEnvironments(inputs, dependencies, resourcesState, assetMar
         );
       }
       envUids[envName] = existingUid;
+      dependencies.core.setOutput("environment-uids-json", JSON.stringify(envUids));
       continue;
     }
     const values = buildEnvironmentValues(envName, runtimeUrl);
@@ -136925,6 +137057,7 @@ async function upsertEnvironments(inputs, dependencies, resourcesState, assetMar
         displayName,
         values
       );
+      dependencies.core.setOutput("environment-uids-json", JSON.stringify(envUids));
     } catch (error) {
       throw new Error(
         formatOrchestrationIssue({
@@ -136941,7 +137074,7 @@ async function upsertEnvironments(inputs, dependencies, resourcesState, assetMar
   return envUids;
 }
 function ensureDir(path5) {
-  (0, import_node_fs4.mkdirSync)(path5, { recursive: true });
+  (0, import_node_fs5.mkdirSync)(path5, { recursive: true });
 }
 function getCollectionDirectoryName(kind, projectName) {
   if (kind === "Baseline") {
@@ -136978,7 +137111,7 @@ function stripVolatileFields(obj) {
 }
 function writeJsonFile(path5, content, normalize4 = false) {
   const data = normalize4 ? stripVolatileFields(content) : content;
-  (0, import_node_fs4.writeFileSync)(path5, JSON.stringify(data, null, 2));
+  (0, import_node_fs5.writeFileSync)(path5, JSON.stringify(data, null, 2));
 }
 function buildMappedSpecCloudKey(mappedSource, specSyncMode, releaseLabel) {
   if (specSyncMode !== "version") {
@@ -137042,22 +137175,422 @@ function buildResourcesManifest(workspaceId, collectionMap, envMap, artifactDir,
     sortKeys: false
   });
 }
-function buildSpecCollectionWorkflowManifest(specRef, collectionRefs) {
-  return dump(
-    {
-      workflows: {
-        syncSpecToCollection: collectionRefs.map((collectionRef) => ({
-          spec: specRef,
-          collection: collectionRef
-        }))
+function isPlainObject2(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function buildSpecCollectionWorkflowManifest(specRef, collectionRefs, existingRaw) {
+  const pairs = collectionRefs.map((collectionRef) => ({
+    spec: specRef,
+    collection: collectionRef
+  }));
+  let root = {};
+  if (typeof existingRaw === "string" && existingRaw.trim()) {
+    let parsed;
+    try {
+      parsed = load(existingRaw);
+    } catch (error) {
+      throw new Error(
+        `CONTRACT_WORKFLOWS_UNREADABLE: .postman/workflows.yaml exists but is not parseable YAML (${error instanceof Error ? error.message : String(error)}). Fix or delete the file; refusing to overwrite unrelated workflow data.`,
+        { cause: error }
+      );
+    }
+    if (parsed === null || parsed === void 0) {
+      root = {};
+    } else if (!isPlainObject2(parsed)) {
+      throw new Error(
+        "CONTRACT_WORKFLOWS_UNREADABLE: .postman/workflows.yaml exists but does not contain a YAML mapping. Fix or delete the file; refusing to overwrite unrelated workflow data."
+      );
+    } else {
+      root = { ...parsed };
+    }
+  }
+  const workflows = isPlainObject2(root.workflows) ? { ...root.workflows } : {};
+  const desiredCollections = new Set(collectionRefs);
+  const currentPairs = (Array.isArray(workflows.syncSpecToCollection) ? workflows.syncSpecToCollection : []).map((entry) => isPlainObject2(entry) ? { ...entry } : null).filter((entry) => Boolean(entry)).filter(
+    (entry) => String(entry.spec ?? "") !== specRef || desiredCollections.has(String(entry.collection ?? ""))
+  );
+  for (const pair of pairs) {
+    const index = currentPairs.findIndex(
+      (entry) => String(entry.spec ?? "") === pair.spec && String(entry.collection ?? "") === pair.collection
+    );
+    if (index >= 0) {
+      const previous = currentPairs[index];
+      currentPairs[index] = { ...previous, spec: pair.spec, collection: pair.collection };
+    } else {
+      currentPairs.push({ spec: pair.spec, collection: pair.collection });
+    }
+  }
+  workflows.syncSpecToCollection = currentPairs;
+  root.workflows = workflows;
+  return dump(root, {
+    lineWidth: -1,
+    noRefs: true,
+    sortKeys: false
+  });
+}
+var PREBUILT_COLLECTION_ROLES = /* @__PURE__ */ new Set([
+  "baseline",
+  "smoke",
+  "contract"
+]);
+var SHA256_HEX = /^[a-f0-9]{64}$/;
+var PREBUILT_CLOUD_ID = /^[A-Za-z0-9][A-Za-z0-9._:-]*$/;
+function failPrebuiltCollections(detail) {
+  throw new Error(`CONTRACT_PREBUILT_COLLECTIONS_INVALID: ${detail}`);
+}
+function parsePrebuiltCollectionsJson(raw) {
+  const trimmed = String(raw ?? "").trim();
+  if (!trimmed) {
+    return [];
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(trimmed);
+  } catch (error) {
+    throw new Error(
+      `CONTRACT_PREBUILT_COLLECTIONS_INVALID: malformed JSON (${error instanceof Error ? error.message : String(error)})`,
+      { cause: error }
+    );
+  }
+  let entriesRaw;
+  if (Array.isArray(parsed)) {
+    entriesRaw = parsed;
+  } else if (isPlainObject2(parsed)) {
+    if (parsed.schemaVersion !== 1) {
+      failPrebuiltCollections("schemaVersion must be 1");
+    }
+    if (!Array.isArray(parsed.collections)) {
+      failPrebuiltCollections("collections must be an array when schemaVersion is set");
+    }
+    entriesRaw = parsed.collections;
+  } else {
+    failPrebuiltCollections("expected a JSON array or {schemaVersion:1,collections:[]}");
+  }
+  const seenRoles = /* @__PURE__ */ new Set();
+  const entries = [];
+  for (const [index, value] of entriesRaw.entries()) {
+    if (!isPlainObject2(value)) {
+      failPrebuiltCollections(`collections[${index}] must be an object`);
+    }
+    const roleRaw = String(value.role ?? "").trim();
+    if (!PREBUILT_COLLECTION_ROLES.has(roleRaw)) {
+      failPrebuiltCollections(
+        `collections[${index}].role must be one of baseline|smoke|contract`
+      );
+    }
+    const role = roleRaw;
+    if (seenRoles.has(role)) {
+      failPrebuiltCollections(`duplicate role ${role}`);
+    }
+    seenRoles.add(role);
+    const collectionPath = String(
+      value.collectionPath ?? value.path ?? ""
+    ).trim();
+    if (!collectionPath || hasControlCharacter2(collectionPath)) {
+      failPrebuiltCollections(
+        `collections[${index}].collectionPath must be a non-empty confined relative path`
+      );
+    }
+    const cloudId = String(value.cloudId ?? "").trim();
+    if (!cloudId || !PREBUILT_CLOUD_ID.test(cloudId)) {
+      failPrebuiltCollections(
+        `collections[${index}].cloudId must be a non-empty Postman collection id`
+      );
+    }
+    let payloadDigest;
+    if (Object.prototype.hasOwnProperty.call(value, "payloadDigest")) {
+      const payloadDigestRaw = value.payloadDigest;
+      if (payloadDigestRaw !== void 0 && payloadDigestRaw !== null) {
+        payloadDigest = String(payloadDigestRaw).trim();
+        if (!SHA256_HEX.test(payloadDigest)) {
+          failPrebuiltCollections(
+            `collections[${index}].payloadDigest must be lowercase 64-hex`
+          );
+        }
       }
-    },
-    {
-      lineWidth: -1,
-      noRefs: true,
-      sortKeys: false
     }
+    const artifactDigest = String(value.artifactDigest ?? "").trim();
+    if (!SHA256_HEX.test(artifactDigest)) {
+      failPrebuiltCollections(
+        `collections[${index}].artifactDigest must be lowercase 64-hex`
+      );
+    }
+    entries.push({
+      role,
+      collectionPath,
+      cloudId,
+      ...payloadDigest !== void 0 ? { payloadDigest } : {},
+      artifactDigest
+    });
+  }
+  return entries;
+}
+function assertPathWithinArtifactRoot(targetPath, artifactDir, fieldName) {
+  assertPathWithinCwd(targetPath, fieldName);
+  assertPathWithinCwd(artifactDir, "artifact-dir");
+  const cwd = (0, import_node_fs5.realpathSync)(process.cwd());
+  const artifactRoot = path3.resolve(cwd, artifactDir.trim());
+  const resolved = path3.resolve(cwd, targetPath.trim());
+  const relativeToArtifact = path3.relative(artifactRoot, resolved);
+  if (!relativeToArtifact || relativeToArtifact.startsWith("..") || path3.isAbsolute(relativeToArtifact)) {
+    failPrebuiltCollections(
+      `${fieldName} must stay under artifact-dir (${artifactDir}); received ${targetPath}`
+    );
+  }
+  let existingPath = resolved;
+  while (!(0, import_node_fs5.existsSync)(existingPath)) {
+    const parent = path3.dirname(existingPath);
+    if (parent === existingPath) {
+      break;
+    }
+    existingPath = parent;
+  }
+  const realExisting = (0, import_node_fs5.realpathSync)(existingPath);
+  const realRelative = path3.relative(artifactRoot, realExisting);
+  if (realRelative.startsWith("..") || path3.isAbsolute(realRelative)) {
+    failPrebuiltCollections(
+      `${fieldName} resolves outside artifact-dir via symlink; received ${targetPath}`
+    );
+  }
+  return normalizeToPosix(path3.relative(cwd, resolved));
+}
+function prebuiltDirectoryTraversalIdentity(absolutePath, stats, options = {}) {
+  const platform2 = options.platform ?? process.platform;
+  const inodeIsZero = stats.ino === 0 || stats.ino === 0n;
+  if (platform2 !== "win32" && !inodeIsZero) {
+    return `${stats.dev}:${stats.ino}`;
+  }
+  const resolveCanonicalPath = options.resolveCanonicalPath ?? ((candidate) => import_node_fs5.realpathSync.native(candidate));
+  const canonical = resolveCanonicalPath(absolutePath);
+  return platform2 === "win32" ? canonical.toLowerCase() : canonical;
+}
+function listPrebuiltCollectionTreeFiles(collectionPath, artifactDir) {
+  const confined = assertPathWithinArtifactRoot(
+    collectionPath,
+    artifactDir,
+    "prebuilt collection path"
+  );
+  const absRoot = path3.resolve(process.cwd(), confined);
+  if (!(0, import_node_fs5.existsSync)(absRoot)) {
+    return [];
+  }
+  let rootStat;
+  try {
+    rootStat = (0, import_node_fs5.lstatSync)(absRoot);
+  } catch {
+    return [];
+  }
+  if (rootStat.isSymbolicLink()) {
+    failPrebuiltCollections(
+      `prebuilt collection path must not be a symlink; received ${collectionPath}`
+    );
+  }
+  if (!rootStat.isDirectory()) {
+    return [];
+  }
+  const files = [];
+  const pendingDirectories = [absRoot];
+  const seenDirectories = /* @__PURE__ */ new Set();
+  while (pendingDirectories.length > 0) {
+    const currentAbsolute = pendingDirectories.pop();
+    if (!currentAbsolute) {
+      break;
+    }
+    const currentStat = (0, import_node_fs5.lstatSync)(currentAbsolute);
+    if (currentStat.isSymbolicLink() || !currentStat.isDirectory()) {
+      failPrebuiltCollections(
+        `prebuilt collection tree directory changed or became unsupported at ${normalizeToPosix(path3.relative(absRoot, currentAbsolute)) || "."}`
+      );
+    }
+    const currentKey = prebuiltDirectoryTraversalIdentity(currentAbsolute, currentStat);
+    if (seenDirectories.has(currentKey)) {
+      failPrebuiltCollections(
+        `prebuilt collection tree directory cycle detected at ${normalizeToPosix(path3.relative(absRoot, currentAbsolute)) || "."}`
+      );
+    }
+    seenDirectories.add(currentKey);
+    const entries = (0, import_node_fs5.readdirSync)(currentAbsolute, { withFileTypes: true });
+    for (const entry of entries) {
+      const abs = path3.join(currentAbsolute, entry.name);
+      if (entry.isSymbolicLink()) {
+        failPrebuiltCollections(
+          `prebuilt collection tree must not contain symlinks; received ${normalizeToPosix(path3.relative(absRoot, abs))}`
+        );
+      }
+      if (entry.isDirectory()) {
+        pendingDirectories.push(abs);
+        continue;
+      }
+      if (!entry.isFile()) {
+        failPrebuiltCollections(
+          `prebuilt collection tree contains unsupported entry type at ${normalizeToPosix(path3.relative(absRoot, abs))}`
+        );
+      }
+      const fileLstat = (0, import_node_fs5.lstatSync)(abs);
+      if (fileLstat.isSymbolicLink() || !fileLstat.isFile()) {
+        failPrebuiltCollections(
+          `prebuilt collection tree file changed or became unsupported at ${normalizeToPosix(path3.relative(absRoot, abs))}`
+        );
+      }
+      files.push({
+        absolute: abs,
+        relative: normalizeToPosix(path3.relative(absRoot, abs)),
+        dev: fileLstat.dev,
+        ino: fileLstat.ino,
+        size: fileLstat.size
+      });
+    }
+  }
+  files.sort((a, b) => a.relative.localeCompare(b.relative));
+  return files;
+}
+function validateCanonicalV3CollectionFile(relative3, bytes) {
+  let expectedKind;
+  if (/(^|\/)\.resources\/definition\.yaml$/.test(relative3)) {
+    expectedKind = "collection";
+  } else if (relative3.endsWith(".request.yaml")) {
+    expectedKind = "request";
+  } else if (relative3.endsWith(".example.yaml")) {
+    expectedKind = "example";
+  } else if (relative3.endsWith(".message.yaml")) {
+    expectedKind = "message";
+  } else {
+    failPrebuiltCollections(`prebuilt collection tree contains unexpected file ${relative3}`);
+  }
+  let parsed;
+  try {
+    parsed = load(bytes.toString("utf8"));
+  } catch (error) {
+    failPrebuiltCollections(
+      `prebuilt collection tree contains malformed YAML at ${relative3} (${error instanceof Error ? error.message : String(error)})`
+    );
+  }
+  if (!isPlainObject2(parsed)) {
+    failPrebuiltCollections(`prebuilt collection tree file ${relative3} must contain a YAML mapping`);
+  }
+  const kind = typeof parsed.$kind === "string" ? parsed.$kind.trim() : "";
+  if (!kind) {
+    failPrebuiltCollections(`prebuilt collection tree file ${relative3} must contain a nonempty $kind`);
+  }
+  const agrees = expectedKind === "collection" ? kind === "collection" : kind.endsWith(`-${expectedKind}`);
+  if (!agrees) {
+    failPrebuiltCollections(
+      `prebuilt collection tree file ${relative3} has $kind ${kind} inconsistent with its filename`
+    );
+  }
+}
+async function digestAndValidatePrebuiltCollectionTree(files) {
+  if (!files.some((file) => file.relative === ".resources/definition.yaml")) {
+    failPrebuiltCollections("prebuilt collection tree is missing .resources/definition.yaml");
+  }
+  const hash = (0, import_node_crypto3.createHash)("sha256");
+  for (const file of files) {
+    let bytes;
+    try {
+      bytes = await appendArtifactDigestFileStreaming(hash, file.relative, file.absolute, {
+        dev: file.dev,
+        ino: file.ino,
+        size: file.size
+      });
+    } catch (error) {
+      if (error instanceof ArtifactDigestStreamError) {
+        failPrebuiltCollections(error.message);
+      }
+      const code = error?.code;
+      if (code === "ELOOP" || code === "EPERM") {
+        failPrebuiltCollections(
+          `prebuilt collection tree file became a symlink or unsupported node at ${file.relative}`
+        );
+      }
+      failPrebuiltCollections(
+        `prebuilt collection tree file changed or became unsupported at ${file.relative}`
+      );
+    }
+    validateCanonicalV3CollectionFile(file.relative, bytes);
+  }
+  return hash.digest("hex");
+}
+async function preparePrebuiltCollections(inputs) {
+  const prepared = /* @__PURE__ */ new Map();
+  for (const entry of parsePrebuiltCollectionsJson(inputs.prebuiltCollectionsJson ?? "")) {
+    const confinedPath = assertPathWithinArtifactRoot(
+      entry.collectionPath,
+      inputs.artifactDir,
+      `prebuilt ${entry.role} collection path`
+    );
+    const absolute = path3.resolve(process.cwd(), confinedPath);
+    if (!(0, import_node_fs5.existsSync)(absolute)) {
+      prepared.set(entry.role, { entry, confinedPath });
+      continue;
+    }
+    const files = listPrebuiltCollectionTreeFiles(confinedPath, inputs.artifactDir);
+    const artifactDigest = await digestAndValidatePrebuiltCollectionTree(files);
+    prepared.set(entry.role, {
+      entry,
+      confinedPath,
+      artifactDigest
+    });
+  }
+  return prepared;
+}
+function tryReusePrebuiltCollection(options) {
+  const { prepared, expectedPath, expectedCloudId } = options;
+  const { entry } = prepared;
+  if (!expectedCloudId || entry.cloudId !== expectedCloudId) {
+    return false;
+  }
+  const expectedNormalized = canonicalizeRelativePath(expectedPath);
+  const entryNormalized = canonicalizeRelativePath(entry.collectionPath);
+  if (entryNormalized !== expectedNormalized) {
+    return false;
+  }
+  const confined = canonicalizeRelativePath(prepared.confinedPath);
+  if (confined !== expectedNormalized) {
+    return false;
+  }
+  const expectedName = path3.posix.basename(expectedNormalized);
+  if (path3.posix.basename(confined) !== expectedName) {
+    return false;
+  }
+  return prepared.artifactDigest === entry.artifactDigest;
+}
+async function exportCollectionArtifact(options) {
+  const {
+    role,
+    collectionId,
+    dirName,
+    collectionsDir,
+    prebuiltByRole,
+    postman,
+    core
+  } = options;
+  if (!collectionId) {
+    return void 0;
+  }
+  const expectedPath = `${collectionsDir}/${dirName}`;
+  const entry = prebuiltByRole.get(role);
+  if (entry) {
+    const reused = tryReusePrebuiltCollection({
+      prepared: entry,
+      expectedPath,
+      expectedCloudId: collectionId
+    });
+    if (reused) {
+      core.info(
+        `Reusing prebuilt ${role} collection tree at ${expectedPath} (artifactDigest match)`
+      );
+      return `../${expectedPath}`;
+    }
+    core.info(
+      `Prebuilt ${role} collection entry present but did not exactly match; exporting from cloud`
+    );
+  }
+  const col = await postman.getCollection(collectionId);
+  await convertAndSplitAnyCollection(
+    col,
+    expectedPath
   );
+  return `../${expectedPath}`;
 }
 function hasControlCharacter2(value) {
   for (let index = 0; index < value.length; index += 1) {
@@ -137075,21 +137608,21 @@ function assertPathWithinCwd(targetPath, fieldName) {
   if (!rawPath || hasControlCharacter2(originalPath) || path3.isAbsolute(rawPath) || path3.win32.isAbsolute(rawPath) || segments.includes("..") || rawPath.startsWith(":") || hasControlCharacter2(rawPath)) {
     throw new Error(`${fieldName} must stay within the repository root; received ${targetPath}`);
   }
-  const base = (0, import_node_fs4.realpathSync)(process.cwd());
+  const base = (0, import_node_fs5.realpathSync)(process.cwd());
   const resolved = path3.resolve(base, rawPath);
   const relative3 = path3.relative(base, resolved);
   if (relative3.startsWith("..") || path3.isAbsolute(relative3)) {
     throw new Error(`${fieldName} must stay within the repository root; received ${targetPath}`);
   }
   let existingPath = resolved;
-  while (!(0, import_node_fs4.existsSync)(existingPath)) {
+  while (!(0, import_node_fs5.existsSync)(existingPath)) {
     const parent = path3.dirname(existingPath);
     if (parent === existingPath) {
       break;
     }
     existingPath = parent;
   }
-  const realExistingPath = (0, import_node_fs4.realpathSync)(existingPath);
+  const realExistingPath = (0, import_node_fs5.realpathSync)(existingPath);
   const realRelative = path3.relative(base, realExistingPath);
   if (realRelative.startsWith("..") || path3.isAbsolute(realRelative)) {
     throw new Error(`${fieldName} must stay within the repository root; received ${targetPath}`);
@@ -137117,8 +137650,8 @@ async function exportArtifacts(inputs, dependencies, envUids, assetProjectName,
   ensureDir(specsDir);
   ensureDir(".postman");
   const globalsFilePath = `${globalsDir}/workspace.globals.yaml`;
-  if (!(0, import_node_fs4.existsSync)(globalsFilePath)) {
-    (0, import_node_fs4.writeFileSync)(globalsFilePath, "name: Globals\nvalues: []\n");
+  if (!(0, import_node_fs5.existsSync)(globalsFilePath)) {
+    (0, import_node_fs5.writeFileSync)(globalsFilePath, "name: Globals\nvalues: []\n");
   }
   if (inputs.generateCiWorkflow) {
     const ciDir = inputs.ciWorkflowPath.split("/").slice(0, -1).join("/");
@@ -137134,23 +137667,42 @@ async function exportArtifacts(inputs, dependencies, envUids, assetProjectName,
     inputs.specSyncMode,
     options.releaseLabel
   ) : void 0;
-  if (inputs.baselineCollectionId) {
-    const col = await dependencies.postman.getCollection(inputs.baselineCollectionId);
-    const dirName = getCollectionDirectoryName("Baseline", assetProjectName);
-    await convertAndSplitAnyCollection(col, `${collectionsDir}/${dirName}`);
-    manifestCollections[`../${collectionsDir}/${dirName}`] = inputs.baselineCollectionId;
-  }
-  if (inputs.smokeCollectionId) {
-    const col = await dependencies.postman.getCollection(inputs.smokeCollectionId);
-    const dirName = getCollectionDirectoryName("Smoke", assetProjectName);
-    await convertAndSplitAnyCollection(col, `${collectionsDir}/${dirName}`);
-    manifestCollections[`../${collectionsDir}/${dirName}`] = inputs.smokeCollectionId;
-  }
-  if (inputs.contractCollectionId) {
-    const col = await dependencies.postman.getCollection(inputs.contractCollectionId);
-    const dirName = getCollectionDirectoryName("Contract", assetProjectName);
-    await convertAndSplitAnyCollection(col, `${collectionsDir}/${dirName}`);
-    manifestCollections[`../${collectionsDir}/${dirName}`] = inputs.contractCollectionId;
+  const prebuiltByRole = options.preparedPrebuiltCollections;
+  const baselineRef = await exportCollectionArtifact({
+    role: "baseline",
+    collectionId: inputs.baselineCollectionId,
+    dirName: getCollectionDirectoryName("Baseline", assetProjectName),
+    collectionsDir,
+    prebuiltByRole,
+    postman: dependencies.postman,
+    core: dependencies.core
+  });
+  if (baselineRef) {
+    manifestCollections[baselineRef] = inputs.baselineCollectionId;
+  }
+  const smokeRef = await exportCollectionArtifact({
+    role: "smoke",
+    collectionId: inputs.smokeCollectionId,
+    dirName: getCollectionDirectoryName("Smoke", assetProjectName),
+    collectionsDir,
+    prebuiltByRole,
+    postman: dependencies.postman,
+    core: dependencies.core
+  });
+  if (smokeRef) {
+    manifestCollections[smokeRef] = inputs.smokeCollectionId;
+  }
+  const contractRef = await exportCollectionArtifact({
+    role: "contract",
+    collectionId: inputs.contractCollectionId,
+    dirName: getCollectionDirectoryName("Contract", assetProjectName),
+    collectionsDir,
+    prebuiltByRole,
+    postman: dependencies.postman,
+    core: dependencies.core
+  });
+  if (contractRef) {
+    manifestCollections[contractRef] = inputs.contractCollectionId;
   }
   for (const [envName, envUid] of Object.entries(envUids)) {
     writeJsonFile(
@@ -137165,7 +137717,7 @@ async function exportArtifacts(inputs, dependencies, envUids, assetProjectName,
     workspaceLinkEnabled: inputs.workspaceLinkEnabled,
     workspaceLinkStatus: options.workspaceLinkStatus
   });
-  (0, import_node_fs4.writeFileSync)(".postman/resources.yaml", buildResourcesManifest(
+  (0, import_node_fs5.writeFileSync)(".postman/resources.yaml", buildResourcesManifest(
     durableWorkspaceId,
     manifestCollections,
     envUids,
@@ -137177,11 +137729,18 @@ async function exportArtifacts(inputs, dependencies, envUids, assetProjectName,
     options.priorState
   ));
   if (mappedSpec && Object.keys(manifestCollections).length > 0) {
-    (0, import_node_fs4.writeFileSync)(
+    let existingWorkflows;
+    try {
+      existingWorkflows = (0, import_node_fs5.readFileSync)(".postman/workflows.yaml", "utf8");
+    } catch {
+      existingWorkflows = void 0;
+    }
+    (0, import_node_fs5.writeFileSync)(
       ".postman/workflows.yaml",
       buildSpecCollectionWorkflowManifest(
         mappedSpec.configRelativePath,
-        Object.keys(manifestCollections)
+        Object.keys(manifestCollections),
+        existingWorkflows
       )
     );
   }
@@ -137226,12 +137785,12 @@ async function commitAndPushGeneratedFiles(inputs, dependencies) {
       const dir = parts.slice(0, -1).join("/");
       ensureDir(dir);
     }
-    (0, import_node_fs4.writeFileSync)(inputs.ciWorkflowPath, ciWorkflow);
+    (0, import_node_fs5.writeFileSync)(inputs.ciWorkflowPath, ciWorkflow);
     if (inputs.provider === "github" || inputs.provider === "unknown") {
       const gcPath = ".github/workflows/postman-preview-gc.yml";
       if (inputs.ciWorkflowPath.endsWith(".github/workflows/ci.yml") || inputs.ciWorkflowPath === ".github/workflows/ci.yml") {
         ensureDir(".github/workflows");
-        (0, import_node_fs4.writeFileSync)(gcPath, renderGcWorkflowTemplate());
+        (0, import_node_fs5.writeFileSync)(gcPath, renderGcWorkflowTemplate());
       }
     }
   }
@@ -137239,16 +137798,16 @@ async function commitAndPushGeneratedFiles(inputs, dependencies) {
     return { commitSha: "", resolvedCurrentRef: "", pushed: false };
   }
   const provisionPath = ".github/workflows/provision.yml";
-  const provisionExists = inputs.provider === "github" && (0, import_node_fs4.existsSync)(provisionPath);
+  const provisionExists = inputs.provider === "github" && (0, import_node_fs5.existsSync)(provisionPath);
   const gcWorkflowPath = ".github/workflows/postman-preview-gc.yml";
-  const gcExists = inputs.generateCiWorkflow && (0, import_node_fs4.existsSync)(gcWorkflowPath);
+  const gcExists = inputs.generateCiWorkflow && (0, import_node_fs5.existsSync)(gcWorkflowPath);
   const stagePaths = [
     inputs.artifactDir,
     ".postman",
     inputs.generateCiWorkflow ? inputs.ciWorkflowPath : null,
     gcExists ? gcWorkflowPath : null,
     provisionExists ? provisionPath : null
-  ].filter((entry) => typeof entry === "string" && ((0, import_node_fs4.existsSync)(entry) || entry === provisionPath));
+  ].filter((entry) => typeof entry === "string" && ((0, import_node_fs5.existsSync)(entry) || entry === provisionPath));
   if (stagePaths.length === 0) {
     dependencies.core.info("No generated repository paths were found; skipping repo mutation.");
     return {
@@ -137356,6 +137915,7 @@ async function runRepoSyncInner(inputs, dependencies) {
       }
     }
   }
+  const preparedPrebuiltCollections = await preparePrebuiltCollections(inputs);
   let skipRepositoryLinkPost = false;
   let repositoryLinkPreflightWasFree = false;
   if (inputs.workspaceLinkEnabled && inputs.workspaceId && inputs.repoUrl && dependencies.internalIntegration?.findWorkspaceForRepo) {
@@ -137392,6 +137952,7 @@ async function runRepoSyncInner(inputs, dependencies) {
   const branchAssetMarker = buildBranchAssetMarker(branchDecision, inputs);
   const envUids = await upsertEnvironments(inputs, dependencies, resourcesState, branchAssetMarker);
   outputs["environment-uids-json"] = JSON.stringify(envUids);
+  dependencies.core.setOutput("environment-uids-json", outputs["environment-uids-json"]);
   if (inputs.environmentSyncEnabled && inputs.workspaceId && dependencies.internalIntegration) {
     const associations = Object.entries(envUids).map(([envName, envUid]) => ({
       envUid,
@@ -137510,6 +138071,7 @@ async function runRepoSyncInner(inputs, dependencies) {
         }
       }
       outputs["mock-url"] = resolvedMockUrl;
+      dependencies.core.setOutput("mock-url", resolvedMockUrl);
     }
   }
   if (inputs.workspaceId && inputs.smokeCollectionId && Object.keys(envUids).length > 0) {
@@ -137585,6 +138147,7 @@ async function runRepoSyncInner(inputs, dependencies) {
         }
       }
       outputs["monitor-id"] = resolvedMonitorId;
+      dependencies.core.setOutput("monitor-id", resolvedMonitorId);
       if (!effectiveCron && resolvedMonitorId) {
         try {
           await dependencies.postman.runMonitor(resolvedMonitorId);
@@ -137642,7 +138205,8 @@ async function runRepoSyncInner(inputs, dependencies) {
     priorWorkspaceId: resourcesState?.workspace?.id,
     existingSpecs: resourcesState?.cloudResources?.specs,
     releaseLabel,
-    priorState: resourcesState
+    priorState: resourcesState,
+    preparedPrebuiltCollections
   });
   const commit = await commitAndPushGeneratedFiles(inputs, dependencies);
   outputs["commit-sha"] = commit.commitSha;
@@ -137868,7 +138432,12 @@ async function resolvePostmanApiKeyAndTeamId(inputs, actionCore, actionExec, mas
         bifrostBaseUrl: inputs.postmanBifrostBase,
         // No fallback on the org-mode probe: the expected non-org 400 must
         // surface verbatim, not be re-fired against the /_api alias.
-        secretMasker: masker
+        secretMasker: masker,
+        onRetryEvent: (event) => {
+          actionCore.info(
+            `[postman retry] action=repo-sync class=${event.class} status=${event.status ?? "none"} attempt=${event.attempt} delayMs=${event.delay}`
+          );
+        }
       });
       const squads = await gateway.getSquads(teamId);
       if (squads.length > 0) {
@@ -137932,7 +138501,12 @@ function createRepoSyncDependencies(inputs, resolved, factories, options = {}) {
     fallbackBaseUrl: inputs.postmanFallbackBase,
     teamId: resolved.teamId,
     orgMode: inputs.orgMode,
-    secretMasker: masker
+    secretMasker: masker,
+    onRetryEvent: (event) => {
+      factories.core.info(
+        `[postman retry] action=repo-sync class=${event.class} status=${event.status ?? "none"} attempt=${event.attempt} delayMs=${event.delay}`
+      );
+    }
   });
   const gatewayAssets = new PostmanGatewayAssetsClient({
     gateway,
@@ -138415,6 +138989,7 @@ var CLI_INPUT_NAMES = [
   "baseline-collection-id",
   "smoke-collection-id",
   "contract-collection-id",
+  "prebuilt-collections-json",
   "collection-sync-mode",
   "spec-sync-mode",
   "release-label",
@@ -138486,17 +139061,38 @@ Examples:
   postman-repo-sync --repo-write-mode none --workspace-id <id> ...
 `;
 var ConsoleReporter = class {
+  constructor(onOutput) {
+    this.onOutput = onOutput;
+  }
+  onOutput;
   info(message) {
     console.error(message);
   }
   warning(message) {
     console.error(`warning: ${message}`);
   }
-  setOutput() {
+  retryEvent(event) {
+    this.info(
+      `[postman retry] action=repo-sync class=${event.class} status=${event.status ?? "none"} attempt=${event.attempt} delayMs=${event.delay}`
+    );
+  }
+  setOutput(name, value) {
+    this.onOutput?.(name, value);
   }
   setSecret() {
   }
 };
+async function timedStage(reporter, stage, operation) {
+  const started = performance.now();
+  try {
+    const result = await operation();
+    reporter.info(`[repo-sync timing] ${JSON.stringify({ stage, ms: Math.max(0, performance.now() - started), status: "success" })}`);
+    return result;
+  } catch (error) {
+    reporter.info(`[repo-sync timing] ${JSON.stringify({ stage, ms: Math.max(0, performance.now() - started), status: "error" })}`);
+    throw error;
+  }
+}
 function normalizeCliFlag(name) {
   return `INPUT_${name.replace(/-/g, "_").toUpperCase()}`;
 }
@@ -138570,7 +139166,7 @@ function resolvePackageVersion() {
   candidates.push(import_node_path3.default.join(process.cwd(), "package.json"));
   for (const packageJsonPath of candidates) {
     try {
-      const packageJson = JSON.parse((0, import_node_fs5.readFileSync)(packageJsonPath, "utf8"));
+      const packageJson = JSON.parse((0, import_node_fs6.readFileSync)(packageJsonPath, "utf8"));
       if (packageJson.name === "@postman-cse/onboarding-repo-sync" && packageJson.version) {
         return String(packageJson.version).trim();
       }
@@ -138681,20 +139277,107 @@ function toDotenv(outputs) {
     String(value ?? "")
   ]).map(([key, value]) => `${key}=${JSON.stringify(value)}`).join("\n");
 }
-async function writeOptionalFile(filePath, content) {
-  if (!filePath) {
-    return;
-  }
-  const workspaceRoot = import_node_path3.default.resolve(process.cwd());
+function assertOutputFileAllowed(filePath) {
+  const workspaceRoot = (0, import_node_fs6.realpathSync)(import_node_path3.default.resolve(process.cwd()));
   const resolved = import_node_path3.default.resolve(workspaceRoot, filePath);
   const relative3 = import_node_path3.default.relative(workspaceRoot, resolved);
   if (relative3.startsWith("..") || import_node_path3.default.isAbsolute(relative3)) {
     throw new Error(`Output path must stay within workspace: ${filePath}`);
   }
-  await (0, import_promises.mkdir)(import_node_path3.default.dirname(resolved), { recursive: true });
+  let existingParent = import_node_path3.default.dirname(resolved);
+  while (!(0, import_node_fs6.existsSync)(existingParent)) {
+    const parent = import_node_path3.default.dirname(existingParent);
+    if (parent === existingParent) break;
+    existingParent = parent;
+  }
+  const parentReal = (0, import_node_fs6.realpathSync)(existingParent);
+  const parentRelative = import_node_path3.default.relative(workspaceRoot, parentReal);
+  if (parentRelative.startsWith("..") || import_node_path3.default.isAbsolute(parentRelative)) {
+    throw new Error(`Output path must stay within workspace: ${filePath}`);
+  }
+  if ((0, import_node_fs6.existsSync)(resolved) || (() => {
+    try {
+      (0, import_node_fs6.lstatSync)(resolved);
+      return true;
+    } catch {
+      return false;
+    }
+  })()) {
+    const targetReal = (0, import_node_fs6.realpathSync)(resolved);
+    const targetRelative = import_node_path3.default.relative(workspaceRoot, targetReal);
+    if (targetRelative.startsWith("..") || import_node_path3.default.isAbsolute(targetRelative)) {
+      throw new Error(`Output path must stay within workspace: ${filePath}`);
+    }
+  }
+  return { resolved, directory: import_node_path3.default.dirname(resolved) };
+}
+function resolveSymlinkAwarePath(filePath) {
+  const workspaceRoot = (0, import_node_fs6.realpathSync)(import_node_path3.default.resolve(process.cwd()));
+  const resolved = import_node_path3.default.resolve(workspaceRoot, filePath);
+  let existing = resolved;
+  while (!(0, import_node_fs6.existsSync)(existing)) {
+    const parent = import_node_path3.default.dirname(existing);
+    if (parent === existing) break;
+    existing = parent;
+  }
+  return import_node_path3.default.resolve((0, import_node_fs6.realpathSync)(existing), import_node_path3.default.relative(existing, resolved));
+}
+function assertResultPathOutsideGeneratedPaths(resultJsonPath, inputs) {
+  const result = assertOutputFileAllowed(resultJsonPath).resolved;
+  const resultReal = resolveSymlinkAwarePath(result);
+  for (const root of [inputs.artifactDir, ".postman"].map(resolveSymlinkAwarePath)) {
+    const relative3 = import_node_path3.default.relative(root, resultReal);
+    if (!relative3 || !relative3.startsWith("..") && !import_node_path3.default.isAbsolute(relative3)) {
+      throw new Error(
+        `--result-json must not overlap a generated or staged repository path: ${resultJsonPath}`
+      );
+    }
+  }
+  const generatedFiles = [];
+  if (inputs.generateCiWorkflow) {
+    generatedFiles.push(inputs.ciWorkflowPath);
+    if ((inputs.provider === "github" || inputs.provider === "unknown") && (inputs.ciWorkflowPath.endsWith(".github/workflows/ci.yml") || inputs.ciWorkflowPath === ".github/workflows/ci.yml")) {
+      generatedFiles.push(".github/workflows/postman-preview-gc.yml");
+    }
+  }
+  if (inputs.provider === "github" && (0, import_node_fs6.existsSync)(".github/workflows/provision.yml")) {
+    generatedFiles.push(".github/workflows/provision.yml");
+  }
+  for (const generatedFile of generatedFiles) {
+    if (resultReal === resolveSymlinkAwarePath(generatedFile)) {
+      throw new Error(
+        `--result-json must not overlap a generated or staged repository path: ${resultJsonPath}`
+      );
+    }
+  }
+}
+async function writeOptionalFile(filePath, content) {
+  if (!filePath) {
+    return;
+  }
+  const { resolved, directory } = assertOutputFileAllowed(filePath);
+  await (0, import_promises.mkdir)(directory, { recursive: true });
+  const validated = assertOutputFileAllowed(filePath);
+  if (validated.resolved !== resolved) throw new Error(`Output path changed during validation: ${filePath}`);
   await (0, import_promises.writeFile)(resolved, content, "utf8");
 }
-function createCliDependencies(inputs, resolved) {
+function writeOptionalFileAtomic(filePath, content) {
+  if (!filePath) return;
+  const { resolved, directory } = assertOutputFileAllowed(filePath);
+  (0, import_node_fs6.mkdirSync)(directory, { recursive: true });
+  const validated = assertOutputFileAllowed(filePath);
+  const temporaryDirectory = (0, import_node_fs6.mkdtempSync)(
+    import_node_path3.default.join((0, import_node_fs6.realpathSync)(validated.directory), `.${import_node_path3.default.basename(resolved)}.`)
+  );
+  const temporary = import_node_path3.default.join(temporaryDirectory, import_node_path3.default.basename(resolved));
+  try {
+    (0, import_node_fs6.writeFileSync)(temporary, content, "utf8");
+    (0, import_node_fs6.renameSync)(temporary, resolved);
+  } finally {
+    (0, import_node_fs6.rmSync)(temporaryDirectory, { recursive: true, force: true });
+  }
+}
+function createCliDependencies(inputs, resolved, reporter = new ConsoleReporter()) {
   const secretMasker = createSecretMasker([
     resolved.apiKey,
     inputs.postmanAccessToken,
@@ -138711,7 +139394,7 @@ function createCliDependencies(inputs, resolved) {
     inputs,
     resolved,
     {
-      core: new ConsoleReporter(),
+      core: reporter,
       exec: cliExec
     },
     {
@@ -138741,17 +139424,24 @@ async function runCli(argv = process.argv.slice(2), runtime = {}) {
   }
   const config = parseCliArgs(argv, env);
   const inputs = resolveInputs(config.inputEnv);
-  const reporter = new ConsoleReporter();
   const branchDecision = decideBranchTier(inputs, config.inputEnv);
+  if (branchDecision.tier !== "gated") {
+    assertResultPathOutsideGeneratedPaths(config.resultJsonPath, inputs);
+  }
+  const partialOutputs = {};
+  const reporter = new ConsoleReporter((name, value) => {
+    partialOutputs[name] = String(value ?? "");
+    writeOptionalFileAtomic(config.resultJsonPath, JSON.stringify(partialOutputs, null, 2));
+  });
   if (branchDecision.tier === "gated") {
     const result2 = runGatedSkip(inputs, branchDecision, reporter);
-    await writeOptionalFile(config.resultJsonPath, JSON.stringify(result2, null, 2));
+    writeOptionalFileAtomic(config.resultJsonPath, JSON.stringify(result2, null, 2));
     await writeOptionalFile(config.dotenvPath, toDotenv(result2));
     writeStdout(`${JSON.stringify(result2, null, 2)}
 `);
     return;
   }
-  await mintAccessTokenIfNeeded(inputs, reporter);
+  await timedStage(reporter, "access-token mint", () => mintAccessTokenIfNeeded(inputs, reporter));
   const initialMasker = createSecretMasker([
     inputs.postmanApiKey,
     inputs.postmanAccessToken,
@@ -138763,7 +139453,7 @@ async function runCli(argv = process.argv.slice(2), runtime = {}) {
     inputs.sslClientPassphrase,
     inputs.sslExtraCaCerts
   ]);
-  await runCredentialPreflight({
+  await timedStage(reporter, "credential preflight", () => runCredentialPreflight({
     apiBaseUrl: inputs.postmanApiBase,
     iapubBaseUrl: inputs.postmanIapubBase,
     postmanApiKey: inputs.postmanApiKey,
@@ -138772,9 +139462,9 @@ async function runCli(argv = process.argv.slice(2), runtime = {}) {
     mode: inputs.credentialPreflight,
     mask: initialMasker,
     log: reporter
-  });
+  }));
   const resolvingExec = createCliExec(initialMasker);
-  const resolved = await resolvePostmanApiKeyAndTeamId(
+  const resolved = await timedStage(reporter, "API-key/team resolution", () => resolvePostmanApiKeyAndTeamId(
     inputs,
     reporter,
     resolvingExec,
@@ -138783,8 +139473,8 @@ async function runCli(argv = process.argv.slice(2), runtime = {}) {
       persistGeneratedApiKeySecret: false,
       env
     }
-  );
-  const dependencies = createCliDependencies(inputs, resolved);
+  ));
+  const dependencies = createCliDependencies(inputs, resolved, reporter);
   if (inputs.environmentSyncEnabled && !dependencies.internalIntegration) {
     dependencies.core.warning(
       "Skipping system environment association because postman-access-token is not configured"
@@ -138795,8 +139485,12 @@ async function runCli(argv = process.argv.slice(2), runtime = {}) {
       "Skipping workspace linking because postman-access-token is not configured"
     );
   }
-  const result = await (runtime.executeRepoSync ?? runRepoSync)(inputs, dependencies);
-  await writeOptionalFile(config.resultJsonPath, JSON.stringify(result, null, 2));
+  const result = await timedStage(
+    reporter,
+    "runRepoSync finalize",
+    () => (runtime.executeRepoSync ?? runRepoSync)(inputs, dependencies)
+  );
+  writeOptionalFileAtomic(config.resultJsonPath, JSON.stringify(result, null, 2));
   await writeOptionalFile(config.dotenvPath, toDotenv(result));
   writeStdout(`${JSON.stringify(result, null, 2)}
 `);
@@ -138882,7 +139576,7 @@ function isEntrypoint(currentPath, entrypointPath) {
     return false;
   }
   try {
-    return (0, import_node_fs5.realpathSync)(currentPath) === (0, import_node_fs5.realpathSync)(entrypointPath);
+    return (0, import_node_fs6.realpathSync)(currentPath) === (0, import_node_fs6.realpathSync)(entrypointPath);
   } catch {
     return import_node_path3.default.resolve(currentPath) === import_node_path3.default.resolve(entrypointPath);
   }
@@ -138903,7 +139597,8 @@ if (isEntrypoint(currentModulePath, entrypoint)) {
   normalizeCliFlag,
   parseCliArgs,
   runCli,
-  toDotenv
+  toDotenv,
+  writeOptionalFileAtomic
 });
 /*! Bundled license information: