@postman-cse/onboarding-repo-sync 2.1.13 → 2.1.15

package/dist/index.cjs

@@ -26570,7 +26570,7 @@ var require_util7 = __commonJS({
     exports2.esc = esc;
     exports2.slugify = slugify;
     exports2.isObject = isObject;
-    exports2.isPlainObject = isPlainObject2;
+    exports2.isPlainObject = isPlainObject3;
     exports2.shallowClone = shallowClone;
     exports2.numKeys = numKeys;
     exports2.escapeRegex = escapeRegex;
@@ -26753,7 +26753,7 @@ var require_util7 = __commonJS({
         return false;
       }
     });
-    function isPlainObject2(o) {
+    function isPlainObject3(o) {
       if (isObject(o) === false)
         return false;
       const ctor = o.constructor;
@@ -26770,7 +26770,7 @@ var require_util7 = __commonJS({
       return true;
     }
     function shallowClone(o) {
-      if (isPlainObject2(o))
+      if (isPlainObject3(o))
         return { ...o };
       if (Array.isArray(o))
         return [...o];
@@ -26975,7 +26975,7 @@ var require_util7 = __commonJS({
       return clone(schema, def);
     }
     function extend(schema, shape) {
-      if (!isPlainObject2(shape)) {
+      if (!isPlainObject3(shape)) {
         throw new Error("Invalid input to extend: expected a plain object");
       }
       const checks = schema._zod.def.checks;
@@ -26998,7 +26998,7 @@ var require_util7 = __commonJS({
       return clone(schema, def);
     }
     function safeExtend(schema, shape) {
-      if (!isPlainObject2(shape)) {
+      if (!isPlainObject3(shape)) {
         throw new Error("Invalid input to safeExtend: expected a plain object");
       }
       const def = mergeDefs(schema._zod.def, {
@@ -54817,7 +54817,7 @@ var require_lodash = __commonJS({
               } else {
                 newValue = [];
               }
-            } else if (isPlainObject2(srcValue) || isArguments(srcValue)) {
+            } else if (isPlainObject3(srcValue) || isArguments(srcValue)) {
               newValue = objValue;
               if (isArguments(objValue)) {
                 newValue = toPlainObject(objValue);
@@ -55781,7 +55781,7 @@ var require_lodash = __commonJS({
           return objValue;
         }
         function customOmitClone(value) {
-          return isPlainObject2(value) ? undefined2 : value;
+          return isPlainObject3(value) ? undefined2 : value;
         }
         function equalArrays(array, other, bitmask, customizer, equalFunc, stack) {
           var isPartial = bitmask & COMPARE_PARTIAL_FLAG, arrLength = array.length, othLength = other.length;
@@ -57282,7 +57282,7 @@ var require_lodash = __commonJS({
         var isBuffer = nativeIsBuffer || stubFalse;
         var isDate = nodeIsDate ? baseUnary(nodeIsDate) : baseIsDate;
         function isElement(value) {
-          return isObjectLike(value) && value.nodeType === 1 && !isPlainObject2(value);
+          return isObjectLike(value) && value.nodeType === 1 && !isPlainObject3(value);
         }
         function isEmpty(value) {
           if (value == null) {
@@ -57318,7 +57318,7 @@ var require_lodash = __commonJS({
             return false;
           }
           var tag = baseGetTag(value);
-          return tag == errorTag || tag == domExcTag || typeof value.message == "string" && typeof value.name == "string" && !isPlainObject2(value);
+          return tag == errorTag || tag == domExcTag || typeof value.message == "string" && typeof value.name == "string" && !isPlainObject3(value);
         }
         function isFinite2(value) {
           return typeof value == "number" && nativeIsFinite(value);
@@ -57369,7 +57369,7 @@ var require_lodash = __commonJS({
         function isNumber(value) {
           return typeof value == "number" || isObjectLike(value) && baseGetTag(value) == numberTag;
         }
-        function isPlainObject2(value) {
+        function isPlainObject3(value) {
           if (!isObjectLike(value) || baseGetTag(value) != objectTag) {
             return false;
           }
@@ -58440,7 +58440,7 @@ var require_lodash = __commonJS({
         lodash.isNumber = isNumber;
         lodash.isObject = isObject;
         lodash.isObjectLike = isObjectLike;
-        lodash.isPlainObject = isPlainObject2;
+        lodash.isPlainObject = isPlainObject3;
         lodash.isRegExp = isRegExp;
         lodash.isSafeInteger = isSafeInteger;
         lodash.isSet = isSet;
@@ -128815,6 +128815,7 @@ __export(index_exports, {
   decideBranchTier: () => decideBranchTier,
   getInput: () => getInput2,
   hasInput: () => hasInput,
+  prebuiltDirectoryTraversalIdentity: () => prebuiltDirectoryTraversalIdentity,
   readActionInputs: () => readActionInputs,
   resolveInputs: () => resolveInputs,
   resolvePostmanApiKeyAndTeamId: () => resolvePostmanApiKeyAndTeamId,
@@ -131103,7 +131104,8 @@ function getIDToken(aud) {
 }
 
 // src/index.ts
-var import_node_fs4 = require("node:fs");
+var import_node_crypto4 = require("node:crypto");
+var import_node_fs5 = require("node:fs");
 var path8 = __toESM(require("node:path"), 1);
 
 // node_modules/js-yaml/dist/js-yaml.mjs
@@ -134019,6 +134021,7 @@ function dump(input, options = {}) {
 }
 
 // src/postman-v3/converter.ts
+var import_node_fs = require("node:fs");
 var fs3 = __toESM(require("node:fs/promises"), 1);
 var path6 = __toESM(require("node:path"), 1);
 var V2 = __toESM(require_v2(), 1);
@@ -134089,6 +134092,72 @@ function structuredCloneSafe(value) {
   if (typeof structuredClone === "function") return structuredClone(value);
   return JSON.parse(JSON.stringify(value));
 }
+var ArtifactDigestStreamError = class extends Error {
+  code = "ARTIFACT_DIGEST_STREAM";
+  constructor(message, options) {
+    super(message, options);
+    this.name = "ArtifactDigestStreamError";
+  }
+};
+function sameFileIdentity(left, right) {
+  return left.dev === right.dev && left.ino === right.ino && left.size === right.size;
+}
+async function appendArtifactDigestFileStreaming(hash, relative4, absolute, expected) {
+  const flags = typeof import_node_fs.constants.O_NOFOLLOW === "number" ? import_node_fs.constants.O_RDONLY | import_node_fs.constants.O_NOFOLLOW : import_node_fs.constants.O_RDONLY;
+  let handle;
+  try {
+    handle = await fs3.open(absolute, flags);
+  } catch (error2) {
+    const code = error2?.code;
+    if (code === "ELOOP" || code === "EMLINK" || code === "EINVAL") {
+      throw new ArtifactDigestStreamError(
+        `prebuilt collection tree file became a symlink or unsupported node at ${relative4}`,
+        { cause: error2 }
+      );
+    }
+    throw new ArtifactDigestStreamError(
+      `prebuilt collection tree file changed or became unsupported at ${relative4}`,
+      { cause: error2 }
+    );
+  }
+  try {
+    const before = await handle.stat();
+    if (!before.isFile() || !sameFileIdentity(before, expected)) {
+      throw new ArtifactDigestStreamError(
+        `prebuilt collection tree file changed or became unsupported at ${relative4}`
+      );
+    }
+    hash.update(relative4);
+    hash.update("\0");
+    const content = Buffer.allocUnsafe(expected.size);
+    let total = 0;
+    const buffer = Buffer.alloc(64 * 1024);
+    for (; ; ) {
+      const { bytesRead } = await handle.read(buffer, 0, buffer.length, null);
+      if (bytesRead === 0) {
+        break;
+      }
+      if (total + bytesRead > expected.size) {
+        throw new ArtifactDigestStreamError(
+          `prebuilt collection tree file changed while reading at ${relative4}`
+        );
+      }
+      buffer.copy(content, total, 0, bytesRead);
+      hash.update(buffer.subarray(0, bytesRead));
+      total += bytesRead;
+    }
+    hash.update("\0");
+    const after = await handle.stat();
+    if (!after.isFile() || !sameFileIdentity(after, expected) || total !== expected.size) {
+      throw new ArtifactDigestStreamError(
+        `prebuilt collection tree file changed while reading at ${relative4}`
+      );
+    }
+    return total === expected.size ? content : content.subarray(0, total);
+  } finally {
+    await handle.close();
+  }
+}
 async function listFilesRelative(dir, base) {
   let entries;
   try {
@@ -134649,7 +134718,7 @@ function getCiWorkflowTemplate(provider, options = {}) {
 }
 
 // src/lib/github/repo-mutation.ts
-var import_node_fs = require("node:fs");
+var import_node_fs2 = require("node:fs");
 var import_node_path = __toESM(require("node:path"), 1);
 
 // src/lib/secrets.ts
@@ -134939,7 +135008,7 @@ var RepoMutationService = class {
       throw new Error(this.secretMasker(changed.stderr || changed.stdout || "Failed to inspect generated changes"));
     }
     const hasPlannedRemoval = removePaths.some(
-      (removePath) => (0, import_node_fs.existsSync)(import_node_path.default.resolve(this.cwd, removePath))
+      (removePath) => (0, import_node_fs2.existsSync)(import_node_path.default.resolve(this.cwd, removePath))
     );
     if (!changed.stdout.trim() && !hasPlannedRemoval) {
       return {
@@ -134963,7 +135032,7 @@ var RepoMutationService = class {
     await this.execute("git", ["config", "user.name", options.committerName]);
     await this.execute("git", ["config", "user.email", options.committerEmail]);
     for (const removePath of removePaths) {
-      (0, import_node_fs.rmSync)(import_node_path.default.resolve(this.cwd, removePath), { force: true });
+      (0, import_node_fs2.rmSync)(import_node_path.default.resolve(this.cwd, removePath), { force: true });
     }
     await this.execute("git", ["add", "-A", "--", ...stagePaths]);
     const staged = await this.execute("git", ["diff", "--cached", "--quiet"]);
@@ -135506,14 +135575,14 @@ function createTelemetryContext(options) {
 }
 
 // src/action-version.ts
-var import_node_fs2 = require("node:fs");
+var import_node_fs3 = require("node:fs");
 var import_node_path2 = require("node:path");
 function resolveActionVersion2() {
   if (false) {
     return void 0;
   }
   try {
-    const raw = (0, import_node_fs2.readFileSync)((0, import_node_path2.join)(__dirname, "..", "package.json"), "utf8");
+    const raw = (0, import_node_fs3.readFileSync)((0, import_node_path2.join)(__dirname, "..", "package.json"), "utf8");
     return JSON.parse(raw).version ?? "unknown";
   } catch {
     return "unknown";
@@ -135752,7 +135821,8 @@ async function resolveSessionIdentity(opts) {
       opts.fetchImpl ?? fetch,
       Math.max(1, opts.maxAttempts ?? SESSION_MAX_ATTEMPTS),
       opts.sleepImpl ?? defaultSessionSleep,
-      opts.randomImpl ?? defaultRandom
+      opts.randomImpl ?? defaultRandom,
+      opts.onRetryEvent
     );
     sessionMemo.set(memoKey, pending);
   }
@@ -135786,7 +135856,7 @@ async function parseSessionResponse(response) {
     consumerType: coerceText(root.consumerType) ?? coerceText(data?.consumerType) ?? coerceText(user?.consumerType)
   };
 }
-async function probeSessionIdentity(baseUrl, accessToken, fetchImpl, maxAttempts, sleepImpl, random) {
+async function probeSessionIdentity(baseUrl, accessToken, fetchImpl, maxAttempts, sleepImpl, random, onRetryEvent) {
   let failure = "unavailable";
   for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
     let response;
@@ -135798,7 +135868,9 @@ async function probeSessionIdentity(baseUrl, accessToken, fetchImpl, maxAttempts
     } catch {
       failure = "unavailable";
       if (attempt < maxAttempts) {
-        await sleepImpl(computeSessionRetryDelayMs(void 0, attempt, random));
+        const delay = computeSessionRetryDelayMs(void 0, attempt, random);
+        onRetryEvent?.({ class: "transport", attempt, delay });
+        await sleepImpl(delay);
         continue;
       }
       break;
@@ -135820,7 +135892,9 @@ async function probeSessionIdentity(baseUrl, accessToken, fetchImpl, maxAttempts
     if (response.status === 429 || response.status >= 500) {
       failure = "unavailable";
       if (attempt < maxAttempts) {
-        await sleepImpl(computeSessionRetryDelayMs(response, attempt, random));
+        const delay = computeSessionRetryDelayMs(response, attempt, random);
+        onRetryEvent?.({ class: "http", status: response.status, attempt, delay });
+        await sleepImpl(delay);
         continue;
       }
       break;
@@ -135922,7 +135996,8 @@ async function runCredentialPreflight(args) {
       accessToken,
       fetchImpl: args.fetchImpl,
       ...args.sleepImpl ? { sleepImpl: args.sleepImpl } : {},
-      ...args.randomImpl ? { randomImpl: args.randomImpl } : {}
+      ...args.randomImpl ? { randomImpl: args.randomImpl } : {},
+      onRetryEvent: args.retryEvent ?? args.log.retryEvent
     });
   } catch (error2) {
     args.log.warning(
@@ -136574,6 +136649,11 @@ var postmanRepoSyncActionContract = {
       description: "Contract collection ID used for exported artifacts.",
       required: false
     },
+    "prebuilt-collections-json": {
+      description: "Optional digest-bound JSON manifest of unique baseline, smoke, or contract roles with confined repo-relative path, SHA-256 artifact digest of the on-disk v3 collection tree (sorted relative-path + NUL + bytes + NUL), and canonical cloud ID. The optional payloadDigest field is the semantic v2 payload digest carried for provenance (format-validated only, not the reuse gate). Exact role, path, cloudId, and artifactDigest matches reuse the on-disk tree without cloud export.",
+      required: false,
+      default: ""
+    },
     "collection-sync-mode": {
       description: "Collection sync lifecycle mode (refresh or version).",
       required: false,
@@ -136816,7 +136896,7 @@ var postmanRepoSyncActionContract = {
       "Create or update Postman environments from runtime URLs.",
       "Associate Postman environments to system environments through Postman integration APIs.",
       "Create mock servers and smoke monitors from generated collections.",
-      "Export Postman collections in the Collection v3 multi-file YAML directory structure under `postman/collections/` (e.g., `<name>/collection.yaml`, nested folder and request YAML files), and export environments plus `.postman/resources.yaml` into the repository.",
+      "Export Postman collections in the Collection v3 multi-file YAML directory structure under `postman/collections/` (canonical `.resources/definition.yaml` plus request/resource YAML files), and export environments plus `.postman/resources.yaml` into the repository.",
       "Link the Postman workspace to the repository (GitHub or GitLab) through Postman integration APIs.",
       "Commit synced artifacts and push them back to the current checked out ref."
     ],
@@ -136927,13 +137007,36 @@ var PostmanGatewayAssetsClient = class {
       name: String(entry.name ?? entry.message ?? "").trim()
     })).filter((entry) => entry.id || entry.name);
   }
+  /**
+   * Delete a collection (GC path). DELETE is idempotent: transient 408/429/5xx
+   * (including Bifrost ESOCKETTIMEDOUT envelopes) are retried with the same
+   * bounded budget as other idempotent writes; 404 is success (already gone).
+   * Ordinary 4xx are not retried.
+   */
   async deleteCollection(collectionUid) {
     const bareId = String(collectionUid).split("-").slice(-5).join("-") || collectionUid;
-    await this.gateway.requestJson({
-      service: "collection",
-      method: "delete",
-      path: `/v3/collections/${bareId}`
-    });
+    try {
+      await retry(
+        () => this.gateway.requestJson({
+          service: "collection",
+          method: "delete",
+          path: `/v3/collections/${bareId}`
+        }),
+        {
+          maxAttempts: 5,
+          delayMs: 2e3,
+          backoffMultiplier: 2,
+          maxDelayMs: 15e3,
+          sleep: this.sleep,
+          shouldRetry: (e) => this.isRetryableIdempotentWriteOutcome(e)
+        }
+      );
+    } catch (error2) {
+      if (error2 instanceof HttpError && error2.status === 404) {
+        return;
+      }
+      throw error2;
+    }
   }
   async listSpecifications(workspaceId) {
     const response = await this.gateway.requestJson({
@@ -137601,6 +137704,7 @@ var AccessTokenProvider = class {
   maxAttempts;
   onToken;
   sleep;
+  onRetryEvent;
   inflight;
   constructor(options) {
     this.token = String(options.accessToken || "").trim();
@@ -137612,6 +137716,7 @@ var AccessTokenProvider = class {
     this.maxAttempts = Math.max(1, options.maxAttempts ?? 2);
     this.onToken = options.onToken;
     this.sleep = options.sleep;
+    this.onRetryEvent = options.onRetryEvent;
   }
   current() {
     return this.token;
@@ -137637,7 +137742,12 @@ var AccessTokenProvider = class {
       delayMs: 1e3,
       backoffMultiplier: 2,
       ...this.sleep ? { sleep: this.sleep } : {},
-      shouldRetry: (error2) => !(error2 instanceof MintError && error2.permanent)
+      shouldRetry: (error2) => !(error2 instanceof MintError && error2.permanent),
+      onRetry: ({ attempt, delayMs, error: error2 }) => {
+        const status = error2 instanceof MintError ? error2.status : void 0;
+        const retryClass = status === void 0 ? "transport" : "http";
+        this.onRetryEvent?.({ class: retryClass, ...status === void 0 ? {} : { status }, attempt, delay: Math.max(0, delayMs) });
+      }
     });
     this.token = token;
     this.onToken?.(token);
@@ -137668,7 +137778,7 @@ var AccessTokenProvider = class {
           true
         );
       }
-      throw new MintError(`postman: re-mint failed (service-account-tokens HTTP ${status}).`, false);
+      throw new MintError(`postman: re-mint failed (service-account-tokens HTTP ${status}).`, false, status);
     }
     let parsed;
     try {
@@ -137699,7 +137809,8 @@ async function mintAccessTokenIfNeeded(inputs, log, setSecret2, fetchImpl = fetc
     apiKey: inputs.postmanApiKey,
     apiBaseUrl,
     fetchImpl,
-    onToken: (token) => setSecret2?.(token)
+    onToken: (token) => setSecret2?.(token),
+    onRetryEvent: (event) => log.retryEvent?.(event)
   });
   try {
     inputs.postmanAccessToken = await provider.refresh();
@@ -137739,6 +137850,7 @@ var AccessTokenGatewayClient = class {
   requestTimeoutMs;
   retryMaxDelayMs;
   randomImpl;
+  onRetryEvent;
   constructor(options) {
     this.tokenProvider = options.tokenProvider;
     this.bifrostBaseUrl = String(
@@ -137757,6 +137869,7 @@ var AccessTokenGatewayClient = class {
     this.requestTimeoutMs = options.requestTimeoutMs ?? 3e4;
     this.retryMaxDelayMs = options.retryMaxDelayMs ?? 5e3;
     this.randomImpl = options.randomImpl ?? Math.random;
+    this.onRetryEvent = options.onRetryEvent;
   }
   configureTeamContext(teamId, orgMode) {
     this.teamId = String(teamId || "").trim();
@@ -137825,8 +137938,9 @@ var AccessTokenGatewayClient = class {
     if (!this.fallbackBaseUrl) return false;
     return retryTransient || request.fallback === "auto";
   }
-  async attemptFallback(request, retryTransient) {
+  async attemptFallback(request, retryTransient, status) {
     if (!this.fallbackEligible(request, retryTransient)) return null;
+    this.emitRetryEvent("fallback", status, 1, 0);
     const response = await this.tryFallback(request);
     if (!response) return null;
     if (response.ok) return response;
@@ -137852,6 +137966,7 @@ var AccessTokenGatewayClient = class {
       } catch (error2) {
         if (retryTransient && attempt < this.maxRetries) {
           const delay = this.retryDelayMs(attempt);
+          this.emitRetryEvent("transport", void 0, attempt + 1, delay);
           attempt += 1;
           await this.sleepImpl(delay);
           continue;
@@ -137865,7 +137980,9 @@ var AccessTokenGatewayClient = class {
         const inner = this.innerStatus(okBody);
         if (inner !== void 0) {
           if (retryTransient && this.isTransient(inner, okBody) && attempt < this.maxRetries) {
-            await this.sleepImpl(this.retryDelayMs(attempt));
+            const delay = this.retryDelayMs(attempt);
+            this.emitRetryEvent("inner", inner, attempt + 1, delay);
+            await this.sleepImpl(delay);
             attempt += 1;
             continue;
           }
@@ -137875,6 +137992,7 @@ var AccessTokenGatewayClient = class {
       }
       const body = await response.text().catch(() => "");
       if (isExpiredAuthError(response.status, body) && this.tokenProvider.canRefresh()) {
+        this.emitRetryEvent("auth", response.status, 1, 0);
         await this.tokenProvider.refresh();
         response = await this.send(request);
         if (response.ok) {
@@ -137885,11 +138003,12 @@ var AccessTokenGatewayClient = class {
       }
       if (retryTransient && this.isTransient(response.status, body) && attempt < this.maxRetries) {
         const delay = this.retryDelayMs(attempt, parseRetryAfterMs2(response.headers.get("retry-after")));
+        this.emitRetryEvent("http", response.status, attempt + 1, delay);
         attempt += 1;
         await this.sleepImpl(delay);
         continue;
       }
-      const fallbackResponse = await this.attemptFallback(request, retryTransient);
+      const fallbackResponse = await this.attemptFallback(request, retryTransient, response.status);
       if (fallbackResponse) return fallbackResponse;
       throw this.toHttpError(request, response, body);
     }
@@ -137897,6 +138016,14 @@ var AccessTokenGatewayClient = class {
   retryDelayMs(attempt, retryAfter) {
     return retryAfter === void 0 ? fullJitterDelayMs(attempt, this.retryBaseDelayMs, this.retryMaxDelayMs, this.randomImpl) : Math.min(this.retryMaxDelayMs, retryAfter);
   }
+  emitRetryEvent(retryClass, status, attempt, delay) {
+    this.onRetryEvent?.({
+      class: retryClass,
+      ...status === void 0 ? {} : { status },
+      attempt: Math.max(1, attempt),
+      delay: Math.max(0, delay)
+    });
+  }
   isTransient(status, body) {
     return status === 408 || status === 429 || status >= 500 || /ESOCKETTIMEDOUT|ETIMEDOUT|ECONNRESET|serverError|downstream/.test(body);
   }
@@ -138026,7 +138153,7 @@ function validateCertMaterial(certBase64, keyBase64, passphrase) {
 }
 
 // src/lib/repo/branch-decision.ts
-var import_node_fs3 = require("node:fs");
+var import_node_fs4 = require("node:fs");
 var import_node_crypto3 = require("node:crypto");
 var ContractError = class extends Error {
   code;
@@ -138067,7 +138194,7 @@ function readGithubEvent(env) {
   const path9 = clean(env.GITHUB_EVENT_PATH);
   if (!path9) return void 0;
   try {
-    return JSON.parse((0, import_node_fs3.readFileSync)(path9, "utf8"));
+    return JSON.parse((0, import_node_fs4.readFileSync)(path9, "utf8"));
   } catch {
     return void 0;
   }
@@ -138523,6 +138650,7 @@ function resolveInputs(env = process.env) {
     baselineCollectionId: getInput2("baseline-collection-id", env),
     smokeCollectionId: getInput2("smoke-collection-id", env),
     contractCollectionId: getInput2("contract-collection-id", env),
+    prebuiltCollectionsJson: getInput2("prebuilt-collections-json", env),
     specId: getInput2("spec-id", env),
     specContentChanged: parseBooleanInput(getInput2("spec-content-changed", env), true),
     specPath: getInput2("spec-path", env),
@@ -138638,7 +138766,7 @@ var StateUnreadableError = class extends Error {
 function readResourcesState() {
   let raw;
   try {
-    raw = (0, import_node_fs4.readFileSync)(".postman/resources.yaml", "utf8");
+    raw = (0, import_node_fs5.readFileSync)(".postman/resources.yaml", "utf8");
   } catch {
     return null;
   }
@@ -138697,12 +138825,15 @@ function getEnvironmentUidsFromResources(resourcesState) {
 function normalizeToPosix(filePath) {
   return filePath.split(path8.sep).join("/").replace(/\\/g, "/");
 }
+function canonicalizeRelativePath(value) {
+  return normalizeToPosix(String(value ?? "").trim()).replace(/^\.\/+/, "").replace(/\/{2,}/g, "/").replace(/\/+$/g, "");
+}
 function isOpenApiSpecFile(filePath) {
   if (!(filePath.endsWith(".json") || filePath.endsWith(".yaml") || filePath.endsWith(".yml"))) {
     return false;
   }
   try {
-    const raw = (0, import_node_fs4.readFileSync)(filePath, "utf8");
+    const raw = (0, import_node_fs5.readFileSync)(filePath, "utf8");
     const parsed = filePath.endsWith(".json") ? JSON.parse(raw) : load(raw);
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
       return false;
@@ -138731,7 +138862,7 @@ function scanLocalSpecReferences(baseDir = ".") {
   const found = /* @__PURE__ */ new Set();
   const refs = [];
   const visit2 = (currentDir) => {
-    for (const entry of (0, import_node_fs4.readdirSync)(currentDir, { withFileTypes: true })) {
+    for (const entry of (0, import_node_fs5.readdirSync)(currentDir, { withFileTypes: true })) {
       if (ignoredDirs.has(entry.name)) {
         continue;
       }
@@ -138761,7 +138892,7 @@ function resolveMappedSpecReference(explicitSpecPath, discoveredSpecs) {
   const normalizedExplicitPath = normalizeToPosix(explicitSpecPath.trim());
   if (normalizedExplicitPath) {
     const explicitFullPath = path8.resolve(normalizedExplicitPath);
-    if ((0, import_node_fs4.existsSync)(explicitFullPath) && (0, import_node_fs4.statSync)(explicitFullPath).isFile()) {
+    if ((0, import_node_fs5.existsSync)(explicitFullPath) && (0, import_node_fs5.statSync)(explicitFullPath).isFile()) {
       return {
         repoRelativePath: normalizedExplicitPath,
         configRelativePath: normalizeToPosix(path8.join("..", normalizedExplicitPath))
@@ -138813,6 +138944,7 @@ function readActionInputs(actionCore) {
     INPUT_BASELINE_COLLECTION_ID: readInput(actionCore, "baseline-collection-id"),
     INPUT_SMOKE_COLLECTION_ID: readInput(actionCore, "smoke-collection-id"),
     INPUT_CONTRACT_COLLECTION_ID: readInput(actionCore, "contract-collection-id"),
+    INPUT_PREBUILT_COLLECTIONS_JSON: readInput(actionCore, "prebuilt-collections-json"),
     INPUT_SPEC_ID: readInput(actionCore, "spec-id"),
     INPUT_SPEC_PATH: readInput(actionCore, "spec-path"),
     INPUT_COLLECTION_SYNC_MODE: readInput(actionCore, "collection-sync-mode") || "refresh",
@@ -139026,6 +139158,7 @@ async function upsertEnvironments(inputs, dependencies, resourcesState, assetMar
         );
       }
       envUids[envName] = existingUid;
+      dependencies.core.setOutput("environment-uids-json", JSON.stringify(envUids));
       continue;
     }
     const values = buildEnvironmentValues(envName, runtimeUrl);
@@ -139036,6 +139169,7 @@ async function upsertEnvironments(inputs, dependencies, resourcesState, assetMar
         displayName,
         values
       );
+      dependencies.core.setOutput("environment-uids-json", JSON.stringify(envUids));
     } catch (error2) {
       throw new Error(
         formatOrchestrationIssue({
@@ -139052,7 +139186,7 @@ async function upsertEnvironments(inputs, dependencies, resourcesState, assetMar
   return envUids;
 }
 function ensureDir(path9) {
-  (0, import_node_fs4.mkdirSync)(path9, { recursive: true });
+  (0, import_node_fs5.mkdirSync)(path9, { recursive: true });
 }
 function getCollectionDirectoryName(kind, projectName) {
   if (kind === "Baseline") {
@@ -139089,7 +139223,7 @@ function stripVolatileFields(obj) {
 }
 function writeJsonFile(path9, content, normalize4 = false) {
   const data = normalize4 ? stripVolatileFields(content) : content;
-  (0, import_node_fs4.writeFileSync)(path9, JSON.stringify(data, null, 2));
+  (0, import_node_fs5.writeFileSync)(path9, JSON.stringify(data, null, 2));
 }
 function buildMappedSpecCloudKey(mappedSource, specSyncMode, releaseLabel) {
   if (specSyncMode !== "version") {
@@ -139153,22 +139287,422 @@ function buildResourcesManifest(workspaceId, collectionMap, envMap, artifactDir,
     sortKeys: false
   });
 }
-function buildSpecCollectionWorkflowManifest(specRef, collectionRefs) {
-  return dump(
-    {
-      workflows: {
-        syncSpecToCollection: collectionRefs.map((collectionRef) => ({
-          spec: specRef,
-          collection: collectionRef
-        }))
+function isPlainObject2(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function buildSpecCollectionWorkflowManifest(specRef, collectionRefs, existingRaw) {
+  const pairs = collectionRefs.map((collectionRef) => ({
+    spec: specRef,
+    collection: collectionRef
+  }));
+  let root = {};
+  if (typeof existingRaw === "string" && existingRaw.trim()) {
+    let parsed;
+    try {
+      parsed = load(existingRaw);
+    } catch (error2) {
+      throw new Error(
+        `CONTRACT_WORKFLOWS_UNREADABLE: .postman/workflows.yaml exists but is not parseable YAML (${error2 instanceof Error ? error2.message : String(error2)}). Fix or delete the file; refusing to overwrite unrelated workflow data.`,
+        { cause: error2 }
+      );
+    }
+    if (parsed === null || parsed === void 0) {
+      root = {};
+    } else if (!isPlainObject2(parsed)) {
+      throw new Error(
+        "CONTRACT_WORKFLOWS_UNREADABLE: .postman/workflows.yaml exists but does not contain a YAML mapping. Fix or delete the file; refusing to overwrite unrelated workflow data."
+      );
+    } else {
+      root = { ...parsed };
+    }
+  }
+  const workflows = isPlainObject2(root.workflows) ? { ...root.workflows } : {};
+  const desiredCollections = new Set(collectionRefs);
+  const currentPairs = (Array.isArray(workflows.syncSpecToCollection) ? workflows.syncSpecToCollection : []).map((entry) => isPlainObject2(entry) ? { ...entry } : null).filter((entry) => Boolean(entry)).filter(
+    (entry) => String(entry.spec ?? "") !== specRef || desiredCollections.has(String(entry.collection ?? ""))
+  );
+  for (const pair of pairs) {
+    const index = currentPairs.findIndex(
+      (entry) => String(entry.spec ?? "") === pair.spec && String(entry.collection ?? "") === pair.collection
+    );
+    if (index >= 0) {
+      const previous = currentPairs[index];
+      currentPairs[index] = { ...previous, spec: pair.spec, collection: pair.collection };
+    } else {
+      currentPairs.push({ spec: pair.spec, collection: pair.collection });
+    }
+  }
+  workflows.syncSpecToCollection = currentPairs;
+  root.workflows = workflows;
+  return dump(root, {
+    lineWidth: -1,
+    noRefs: true,
+    sortKeys: false
+  });
+}
+var PREBUILT_COLLECTION_ROLES = /* @__PURE__ */ new Set([
+  "baseline",
+  "smoke",
+  "contract"
+]);
+var SHA256_HEX = /^[a-f0-9]{64}$/;
+var PREBUILT_CLOUD_ID = /^[A-Za-z0-9][A-Za-z0-9._:-]*$/;
+function failPrebuiltCollections(detail) {
+  throw new Error(`CONTRACT_PREBUILT_COLLECTIONS_INVALID: ${detail}`);
+}
+function parsePrebuiltCollectionsJson(raw) {
+  const trimmed = String(raw ?? "").trim();
+  if (!trimmed) {
+    return [];
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(trimmed);
+  } catch (error2) {
+    throw new Error(
+      `CONTRACT_PREBUILT_COLLECTIONS_INVALID: malformed JSON (${error2 instanceof Error ? error2.message : String(error2)})`,
+      { cause: error2 }
+    );
+  }
+  let entriesRaw;
+  if (Array.isArray(parsed)) {
+    entriesRaw = parsed;
+  } else if (isPlainObject2(parsed)) {
+    if (parsed.schemaVersion !== 1) {
+      failPrebuiltCollections("schemaVersion must be 1");
+    }
+    if (!Array.isArray(parsed.collections)) {
+      failPrebuiltCollections("collections must be an array when schemaVersion is set");
+    }
+    entriesRaw = parsed.collections;
+  } else {
+    failPrebuiltCollections("expected a JSON array or {schemaVersion:1,collections:[]}");
+  }
+  const seenRoles = /* @__PURE__ */ new Set();
+  const entries = [];
+  for (const [index, value] of entriesRaw.entries()) {
+    if (!isPlainObject2(value)) {
+      failPrebuiltCollections(`collections[${index}] must be an object`);
+    }
+    const roleRaw = String(value.role ?? "").trim();
+    if (!PREBUILT_COLLECTION_ROLES.has(roleRaw)) {
+      failPrebuiltCollections(
+        `collections[${index}].role must be one of baseline|smoke|contract`
+      );
+    }
+    const role = roleRaw;
+    if (seenRoles.has(role)) {
+      failPrebuiltCollections(`duplicate role ${role}`);
+    }
+    seenRoles.add(role);
+    const collectionPath = String(
+      value.collectionPath ?? value.path ?? ""
+    ).trim();
+    if (!collectionPath || hasControlCharacter2(collectionPath)) {
+      failPrebuiltCollections(
+        `collections[${index}].collectionPath must be a non-empty confined relative path`
+      );
+    }
+    const cloudId = String(value.cloudId ?? "").trim();
+    if (!cloudId || !PREBUILT_CLOUD_ID.test(cloudId)) {
+      failPrebuiltCollections(
+        `collections[${index}].cloudId must be a non-empty Postman collection id`
+      );
+    }
+    let payloadDigest;
+    if (Object.prototype.hasOwnProperty.call(value, "payloadDigest")) {
+      const payloadDigestRaw = value.payloadDigest;
+      if (payloadDigestRaw !== void 0 && payloadDigestRaw !== null) {
+        payloadDigest = String(payloadDigestRaw).trim();
+        if (!SHA256_HEX.test(payloadDigest)) {
+          failPrebuiltCollections(
+            `collections[${index}].payloadDigest must be lowercase 64-hex`
+          );
+        }
       }
-    },
-    {
-      lineWidth: -1,
-      noRefs: true,
-      sortKeys: false
     }
+    const artifactDigest = String(value.artifactDigest ?? "").trim();
+    if (!SHA256_HEX.test(artifactDigest)) {
+      failPrebuiltCollections(
+        `collections[${index}].artifactDigest must be lowercase 64-hex`
+      );
+    }
+    entries.push({
+      role,
+      collectionPath,
+      cloudId,
+      ...payloadDigest !== void 0 ? { payloadDigest } : {},
+      artifactDigest
+    });
+  }
+  return entries;
+}
+function assertPathWithinArtifactRoot(targetPath, artifactDir, fieldName) {
+  assertPathWithinCwd(targetPath, fieldName);
+  assertPathWithinCwd(artifactDir, "artifact-dir");
+  const cwd = (0, import_node_fs5.realpathSync)(process.cwd());
+  const artifactRoot = path8.resolve(cwd, artifactDir.trim());
+  const resolved = path8.resolve(cwd, targetPath.trim());
+  const relativeToArtifact = path8.relative(artifactRoot, resolved);
+  if (!relativeToArtifact || relativeToArtifact.startsWith("..") || path8.isAbsolute(relativeToArtifact)) {
+    failPrebuiltCollections(
+      `${fieldName} must stay under artifact-dir (${artifactDir}); received ${targetPath}`
+    );
+  }
+  let existingPath = resolved;
+  while (!(0, import_node_fs5.existsSync)(existingPath)) {
+    const parent = path8.dirname(existingPath);
+    if (parent === existingPath) {
+      break;
+    }
+    existingPath = parent;
+  }
+  const realExisting = (0, import_node_fs5.realpathSync)(existingPath);
+  const realRelative = path8.relative(artifactRoot, realExisting);
+  if (realRelative.startsWith("..") || path8.isAbsolute(realRelative)) {
+    failPrebuiltCollections(
+      `${fieldName} resolves outside artifact-dir via symlink; received ${targetPath}`
+    );
+  }
+  return normalizeToPosix(path8.relative(cwd, resolved));
+}
+function prebuiltDirectoryTraversalIdentity(absolutePath, stats, options = {}) {
+  const platform2 = options.platform ?? process.platform;
+  const inodeIsZero = stats.ino === 0 || stats.ino === 0n;
+  if (platform2 !== "win32" && !inodeIsZero) {
+    return `${stats.dev}:${stats.ino}`;
+  }
+  const resolveCanonicalPath = options.resolveCanonicalPath ?? ((candidate) => import_node_fs5.realpathSync.native(candidate));
+  const canonical = resolveCanonicalPath(absolutePath);
+  return platform2 === "win32" ? canonical.toLowerCase() : canonical;
+}
+function listPrebuiltCollectionTreeFiles(collectionPath, artifactDir) {
+  const confined = assertPathWithinArtifactRoot(
+    collectionPath,
+    artifactDir,
+    "prebuilt collection path"
+  );
+  const absRoot = path8.resolve(process.cwd(), confined);
+  if (!(0, import_node_fs5.existsSync)(absRoot)) {
+    return [];
+  }
+  let rootStat;
+  try {
+    rootStat = (0, import_node_fs5.lstatSync)(absRoot);
+  } catch {
+    return [];
+  }
+  if (rootStat.isSymbolicLink()) {
+    failPrebuiltCollections(
+      `prebuilt collection path must not be a symlink; received ${collectionPath}`
+    );
+  }
+  if (!rootStat.isDirectory()) {
+    return [];
+  }
+  const files = [];
+  const pendingDirectories = [absRoot];
+  const seenDirectories = /* @__PURE__ */ new Set();
+  while (pendingDirectories.length > 0) {
+    const currentAbsolute = pendingDirectories.pop();
+    if (!currentAbsolute) {
+      break;
+    }
+    const currentStat = (0, import_node_fs5.lstatSync)(currentAbsolute);
+    if (currentStat.isSymbolicLink() || !currentStat.isDirectory()) {
+      failPrebuiltCollections(
+        `prebuilt collection tree directory changed or became unsupported at ${normalizeToPosix(path8.relative(absRoot, currentAbsolute)) || "."}`
+      );
+    }
+    const currentKey = prebuiltDirectoryTraversalIdentity(currentAbsolute, currentStat);
+    if (seenDirectories.has(currentKey)) {
+      failPrebuiltCollections(
+        `prebuilt collection tree directory cycle detected at ${normalizeToPosix(path8.relative(absRoot, currentAbsolute)) || "."}`
+      );
+    }
+    seenDirectories.add(currentKey);
+    const entries = (0, import_node_fs5.readdirSync)(currentAbsolute, { withFileTypes: true });
+    for (const entry of entries) {
+      const abs = path8.join(currentAbsolute, entry.name);
+      if (entry.isSymbolicLink()) {
+        failPrebuiltCollections(
+          `prebuilt collection tree must not contain symlinks; received ${normalizeToPosix(path8.relative(absRoot, abs))}`
+        );
+      }
+      if (entry.isDirectory()) {
+        pendingDirectories.push(abs);
+        continue;
+      }
+      if (!entry.isFile()) {
+        failPrebuiltCollections(
+          `prebuilt collection tree contains unsupported entry type at ${normalizeToPosix(path8.relative(absRoot, abs))}`
+        );
+      }
+      const fileLstat = (0, import_node_fs5.lstatSync)(abs);
+      if (fileLstat.isSymbolicLink() || !fileLstat.isFile()) {
+        failPrebuiltCollections(
+          `prebuilt collection tree file changed or became unsupported at ${normalizeToPosix(path8.relative(absRoot, abs))}`
+        );
+      }
+      files.push({
+        absolute: abs,
+        relative: normalizeToPosix(path8.relative(absRoot, abs)),
+        dev: fileLstat.dev,
+        ino: fileLstat.ino,
+        size: fileLstat.size
+      });
+    }
+  }
+  files.sort((a, b) => a.relative.localeCompare(b.relative));
+  return files;
+}
+function validateCanonicalV3CollectionFile(relative4, bytes) {
+  let expectedKind;
+  if (/(^|\/)\.resources\/definition\.yaml$/.test(relative4)) {
+    expectedKind = "collection";
+  } else if (relative4.endsWith(".request.yaml")) {
+    expectedKind = "request";
+  } else if (relative4.endsWith(".example.yaml")) {
+    expectedKind = "example";
+  } else if (relative4.endsWith(".message.yaml")) {
+    expectedKind = "message";
+  } else {
+    failPrebuiltCollections(`prebuilt collection tree contains unexpected file ${relative4}`);
+  }
+  let parsed;
+  try {
+    parsed = load(bytes.toString("utf8"));
+  } catch (error2) {
+    failPrebuiltCollections(
+      `prebuilt collection tree contains malformed YAML at ${relative4} (${error2 instanceof Error ? error2.message : String(error2)})`
+    );
+  }
+  if (!isPlainObject2(parsed)) {
+    failPrebuiltCollections(`prebuilt collection tree file ${relative4} must contain a YAML mapping`);
+  }
+  const kind = typeof parsed.$kind === "string" ? parsed.$kind.trim() : "";
+  if (!kind) {
+    failPrebuiltCollections(`prebuilt collection tree file ${relative4} must contain a nonempty $kind`);
+  }
+  const agrees = expectedKind === "collection" ? kind === "collection" : kind.endsWith(`-${expectedKind}`);
+  if (!agrees) {
+    failPrebuiltCollections(
+      `prebuilt collection tree file ${relative4} has $kind ${kind} inconsistent with its filename`
+    );
+  }
+}
+async function digestAndValidatePrebuiltCollectionTree(files) {
+  if (!files.some((file) => file.relative === ".resources/definition.yaml")) {
+    failPrebuiltCollections("prebuilt collection tree is missing .resources/definition.yaml");
+  }
+  const hash = (0, import_node_crypto4.createHash)("sha256");
+  for (const file of files) {
+    let bytes;
+    try {
+      bytes = await appendArtifactDigestFileStreaming(hash, file.relative, file.absolute, {
+        dev: file.dev,
+        ino: file.ino,
+        size: file.size
+      });
+    } catch (error2) {
+      if (error2 instanceof ArtifactDigestStreamError) {
+        failPrebuiltCollections(error2.message);
+      }
+      const code = error2?.code;
+      if (code === "ELOOP" || code === "EPERM") {
+        failPrebuiltCollections(
+          `prebuilt collection tree file became a symlink or unsupported node at ${file.relative}`
+        );
+      }
+      failPrebuiltCollections(
+        `prebuilt collection tree file changed or became unsupported at ${file.relative}`
+      );
+    }
+    validateCanonicalV3CollectionFile(file.relative, bytes);
+  }
+  return hash.digest("hex");
+}
+async function preparePrebuiltCollections(inputs) {
+  const prepared = /* @__PURE__ */ new Map();
+  for (const entry of parsePrebuiltCollectionsJson(inputs.prebuiltCollectionsJson ?? "")) {
+    const confinedPath = assertPathWithinArtifactRoot(
+      entry.collectionPath,
+      inputs.artifactDir,
+      `prebuilt ${entry.role} collection path`
+    );
+    const absolute = path8.resolve(process.cwd(), confinedPath);
+    if (!(0, import_node_fs5.existsSync)(absolute)) {
+      prepared.set(entry.role, { entry, confinedPath });
+      continue;
+    }
+    const files = listPrebuiltCollectionTreeFiles(confinedPath, inputs.artifactDir);
+    const artifactDigest = await digestAndValidatePrebuiltCollectionTree(files);
+    prepared.set(entry.role, {
+      entry,
+      confinedPath,
+      artifactDigest
+    });
+  }
+  return prepared;
+}
+function tryReusePrebuiltCollection(options) {
+  const { prepared, expectedPath, expectedCloudId } = options;
+  const { entry } = prepared;
+  if (!expectedCloudId || entry.cloudId !== expectedCloudId) {
+    return false;
+  }
+  const expectedNormalized = canonicalizeRelativePath(expectedPath);
+  const entryNormalized = canonicalizeRelativePath(entry.collectionPath);
+  if (entryNormalized !== expectedNormalized) {
+    return false;
+  }
+  const confined = canonicalizeRelativePath(prepared.confinedPath);
+  if (confined !== expectedNormalized) {
+    return false;
+  }
+  const expectedName = path8.posix.basename(expectedNormalized);
+  if (path8.posix.basename(confined) !== expectedName) {
+    return false;
+  }
+  return prepared.artifactDigest === entry.artifactDigest;
+}
+async function exportCollectionArtifact(options) {
+  const {
+    role,
+    collectionId,
+    dirName,
+    collectionsDir,
+    prebuiltByRole,
+    postman,
+    core
+  } = options;
+  if (!collectionId) {
+    return void 0;
+  }
+  const expectedPath = `${collectionsDir}/${dirName}`;
+  const entry = prebuiltByRole.get(role);
+  if (entry) {
+    const reused = tryReusePrebuiltCollection({
+      prepared: entry,
+      expectedPath,
+      expectedCloudId: collectionId
+    });
+    if (reused) {
+      core.info(
+        `Reusing prebuilt ${role} collection tree at ${expectedPath} (artifactDigest match)`
+      );
+      return `../${expectedPath}`;
+    }
+    core.info(
+      `Prebuilt ${role} collection entry present but did not exactly match; exporting from cloud`
+    );
+  }
+  const col = await postman.getCollection(collectionId);
+  await convertAndSplitAnyCollection(
+    col,
+    expectedPath
   );
+  return `../${expectedPath}`;
 }
 function hasControlCharacter2(value) {
   for (let index = 0; index < value.length; index += 1) {
@@ -139186,21 +139720,21 @@ function assertPathWithinCwd(targetPath, fieldName) {
   if (!rawPath || hasControlCharacter2(originalPath) || path8.isAbsolute(rawPath) || path8.win32.isAbsolute(rawPath) || segments.includes("..") || rawPath.startsWith(":") || hasControlCharacter2(rawPath)) {
     throw new Error(`${fieldName} must stay within the repository root; received ${targetPath}`);
   }
-  const base = (0, import_node_fs4.realpathSync)(process.cwd());
+  const base = (0, import_node_fs5.realpathSync)(process.cwd());
   const resolved = path8.resolve(base, rawPath);
   const relative4 = path8.relative(base, resolved);
   if (relative4.startsWith("..") || path8.isAbsolute(relative4)) {
     throw new Error(`${fieldName} must stay within the repository root; received ${targetPath}`);
   }
   let existingPath = resolved;
-  while (!(0, import_node_fs4.existsSync)(existingPath)) {
+  while (!(0, import_node_fs5.existsSync)(existingPath)) {
     const parent = path8.dirname(existingPath);
     if (parent === existingPath) {
       break;
     }
     existingPath = parent;
   }
-  const realExistingPath = (0, import_node_fs4.realpathSync)(existingPath);
+  const realExistingPath = (0, import_node_fs5.realpathSync)(existingPath);
   const realRelative = path8.relative(base, realExistingPath);
   if (realRelative.startsWith("..") || path8.isAbsolute(realRelative)) {
     throw new Error(`${fieldName} must stay within the repository root; received ${targetPath}`);
@@ -139228,8 +139762,8 @@ async function exportArtifacts(inputs, dependencies, envUids, assetProjectName,
   ensureDir(specsDir);
   ensureDir(".postman");
   const globalsFilePath = `${globalsDir}/workspace.globals.yaml`;
-  if (!(0, import_node_fs4.existsSync)(globalsFilePath)) {
-    (0, import_node_fs4.writeFileSync)(globalsFilePath, "name: Globals\nvalues: []\n");
+  if (!(0, import_node_fs5.existsSync)(globalsFilePath)) {
+    (0, import_node_fs5.writeFileSync)(globalsFilePath, "name: Globals\nvalues: []\n");
   }
   if (inputs.generateCiWorkflow) {
     const ciDir = inputs.ciWorkflowPath.split("/").slice(0, -1).join("/");
@@ -139245,23 +139779,42 @@ async function exportArtifacts(inputs, dependencies, envUids, assetProjectName,
     inputs.specSyncMode,
     options.releaseLabel
   ) : void 0;
-  if (inputs.baselineCollectionId) {
-    const col = await dependencies.postman.getCollection(inputs.baselineCollectionId);
-    const dirName = getCollectionDirectoryName("Baseline", assetProjectName);
-    await convertAndSplitAnyCollection(col, `${collectionsDir}/${dirName}`);
-    manifestCollections[`../${collectionsDir}/${dirName}`] = inputs.baselineCollectionId;
-  }
-  if (inputs.smokeCollectionId) {
-    const col = await dependencies.postman.getCollection(inputs.smokeCollectionId);
-    const dirName = getCollectionDirectoryName("Smoke", assetProjectName);
-    await convertAndSplitAnyCollection(col, `${collectionsDir}/${dirName}`);
-    manifestCollections[`../${collectionsDir}/${dirName}`] = inputs.smokeCollectionId;
-  }
-  if (inputs.contractCollectionId) {
-    const col = await dependencies.postman.getCollection(inputs.contractCollectionId);
-    const dirName = getCollectionDirectoryName("Contract", assetProjectName);
-    await convertAndSplitAnyCollection(col, `${collectionsDir}/${dirName}`);
-    manifestCollections[`../${collectionsDir}/${dirName}`] = inputs.contractCollectionId;
+  const prebuiltByRole = options.preparedPrebuiltCollections;
+  const baselineRef = await exportCollectionArtifact({
+    role: "baseline",
+    collectionId: inputs.baselineCollectionId,
+    dirName: getCollectionDirectoryName("Baseline", assetProjectName),
+    collectionsDir,
+    prebuiltByRole,
+    postman: dependencies.postman,
+    core: dependencies.core
+  });
+  if (baselineRef) {
+    manifestCollections[baselineRef] = inputs.baselineCollectionId;
+  }
+  const smokeRef = await exportCollectionArtifact({
+    role: "smoke",
+    collectionId: inputs.smokeCollectionId,
+    dirName: getCollectionDirectoryName("Smoke", assetProjectName),
+    collectionsDir,
+    prebuiltByRole,
+    postman: dependencies.postman,
+    core: dependencies.core
+  });
+  if (smokeRef) {
+    manifestCollections[smokeRef] = inputs.smokeCollectionId;
+  }
+  const contractRef = await exportCollectionArtifact({
+    role: "contract",
+    collectionId: inputs.contractCollectionId,
+    dirName: getCollectionDirectoryName("Contract", assetProjectName),
+    collectionsDir,
+    prebuiltByRole,
+    postman: dependencies.postman,
+    core: dependencies.core
+  });
+  if (contractRef) {
+    manifestCollections[contractRef] = inputs.contractCollectionId;
   }
   for (const [envName, envUid] of Object.entries(envUids)) {
     writeJsonFile(
@@ -139276,7 +139829,7 @@ async function exportArtifacts(inputs, dependencies, envUids, assetProjectName,
     workspaceLinkEnabled: inputs.workspaceLinkEnabled,
     workspaceLinkStatus: options.workspaceLinkStatus
   });
-  (0, import_node_fs4.writeFileSync)(".postman/resources.yaml", buildResourcesManifest(
+  (0, import_node_fs5.writeFileSync)(".postman/resources.yaml", buildResourcesManifest(
     durableWorkspaceId,
     manifestCollections,
     envUids,
@@ -139288,11 +139841,18 @@ async function exportArtifacts(inputs, dependencies, envUids, assetProjectName,
     options.priorState
   ));
   if (mappedSpec && Object.keys(manifestCollections).length > 0) {
-    (0, import_node_fs4.writeFileSync)(
+    let existingWorkflows;
+    try {
+      existingWorkflows = (0, import_node_fs5.readFileSync)(".postman/workflows.yaml", "utf8");
+    } catch {
+      existingWorkflows = void 0;
+    }
+    (0, import_node_fs5.writeFileSync)(
       ".postman/workflows.yaml",
       buildSpecCollectionWorkflowManifest(
         mappedSpec.configRelativePath,
-        Object.keys(manifestCollections)
+        Object.keys(manifestCollections),
+        existingWorkflows
       )
     );
   }
@@ -139337,12 +139897,12 @@ async function commitAndPushGeneratedFiles(inputs, dependencies) {
       const dir = parts.slice(0, -1).join("/");
       ensureDir(dir);
     }
-    (0, import_node_fs4.writeFileSync)(inputs.ciWorkflowPath, ciWorkflow);
+    (0, import_node_fs5.writeFileSync)(inputs.ciWorkflowPath, ciWorkflow);
     if (inputs.provider === "github" || inputs.provider === "unknown") {
       const gcPath = ".github/workflows/postman-preview-gc.yml";
       if (inputs.ciWorkflowPath.endsWith(".github/workflows/ci.yml") || inputs.ciWorkflowPath === ".github/workflows/ci.yml") {
         ensureDir(".github/workflows");
-        (0, import_node_fs4.writeFileSync)(gcPath, renderGcWorkflowTemplate());
+        (0, import_node_fs5.writeFileSync)(gcPath, renderGcWorkflowTemplate());
       }
     }
   }
@@ -139350,16 +139910,16 @@ async function commitAndPushGeneratedFiles(inputs, dependencies) {
     return { commitSha: "", resolvedCurrentRef: "", pushed: false };
   }
   const provisionPath = ".github/workflows/provision.yml";
-  const provisionExists = inputs.provider === "github" && (0, import_node_fs4.existsSync)(provisionPath);
+  const provisionExists = inputs.provider === "github" && (0, import_node_fs5.existsSync)(provisionPath);
   const gcWorkflowPath = ".github/workflows/postman-preview-gc.yml";
-  const gcExists = inputs.generateCiWorkflow && (0, import_node_fs4.existsSync)(gcWorkflowPath);
+  const gcExists = inputs.generateCiWorkflow && (0, import_node_fs5.existsSync)(gcWorkflowPath);
   const stagePaths = [
     inputs.artifactDir,
     ".postman",
     inputs.generateCiWorkflow ? inputs.ciWorkflowPath : null,
     gcExists ? gcWorkflowPath : null,
     provisionExists ? provisionPath : null
-  ].filter((entry) => typeof entry === "string" && ((0, import_node_fs4.existsSync)(entry) || entry === provisionPath));
+  ].filter((entry) => typeof entry === "string" && ((0, import_node_fs5.existsSync)(entry) || entry === provisionPath));
   if (stagePaths.length === 0) {
     dependencies.core.info("No generated repository paths were found; skipping repo mutation.");
     return {
@@ -139467,6 +140027,7 @@ async function runRepoSyncInner(inputs, dependencies) {
       }
     }
   }
+  const preparedPrebuiltCollections = await preparePrebuiltCollections(inputs);
   let skipRepositoryLinkPost = false;
   let repositoryLinkPreflightWasFree = false;
   if (inputs.workspaceLinkEnabled && inputs.workspaceId && inputs.repoUrl && dependencies.internalIntegration?.findWorkspaceForRepo) {
@@ -139503,6 +140064,7 @@ async function runRepoSyncInner(inputs, dependencies) {
   const branchAssetMarker = buildBranchAssetMarker(branchDecision, inputs);
   const envUids = await upsertEnvironments(inputs, dependencies, resourcesState, branchAssetMarker);
   outputs["environment-uids-json"] = JSON.stringify(envUids);
+  dependencies.core.setOutput("environment-uids-json", outputs["environment-uids-json"]);
   if (inputs.environmentSyncEnabled && inputs.workspaceId && dependencies.internalIntegration) {
     const associations = Object.entries(envUids).map(([envName, envUid]) => ({
       envUid,
@@ -139621,6 +140183,7 @@ async function runRepoSyncInner(inputs, dependencies) {
         }
       }
       outputs["mock-url"] = resolvedMockUrl;
+      dependencies.core.setOutput("mock-url", resolvedMockUrl);
     }
   }
   if (inputs.workspaceId && inputs.smokeCollectionId && Object.keys(envUids).length > 0) {
@@ -139696,6 +140259,7 @@ async function runRepoSyncInner(inputs, dependencies) {
         }
       }
       outputs["monitor-id"] = resolvedMonitorId;
+      dependencies.core.setOutput("monitor-id", resolvedMonitorId);
       if (!effectiveCron && resolvedMonitorId) {
         try {
           await dependencies.postman.runMonitor(resolvedMonitorId);
@@ -139753,7 +140317,8 @@ async function runRepoSyncInner(inputs, dependencies) {
     priorWorkspaceId: resourcesState?.workspace?.id,
     existingSpecs: resourcesState?.cloudResources?.specs,
     releaseLabel,
-    priorState: resourcesState
+    priorState: resourcesState,
+    preparedPrebuiltCollections
   });
   const commit = await commitAndPushGeneratedFiles(inputs, dependencies);
   outputs["commit-sha"] = commit.commitSha;
@@ -139979,7 +140544,12 @@ async function resolvePostmanApiKeyAndTeamId(inputs, actionCore, actionExec, mas
         bifrostBaseUrl: inputs.postmanBifrostBase,
         // No fallback on the org-mode probe: the expected non-org 400 must
         // surface verbatim, not be re-fired against the /_api alias.
-        secretMasker: masker
+        secretMasker: masker,
+        onRetryEvent: (event) => {
+          actionCore.info(
+            `[postman retry] action=repo-sync class=${event.class} status=${event.status ?? "none"} attempt=${event.attempt} delayMs=${event.delay}`
+          );
+        }
       });
       const squads = await gateway.getSquads(teamId);
       if (squads.length > 0) {
@@ -140043,7 +140613,12 @@ function createRepoSyncDependencies(inputs, resolved, factories, options = {}) {
     fallbackBaseUrl: inputs.postmanFallbackBase,
     teamId: resolved.teamId,
     orgMode: inputs.orgMode,
-    secretMasker: masker
+    secretMasker: masker,
+    onRetryEvent: (event) => {
+      factories.core.info(
+        `[postman retry] action=repo-sync class=${event.class} status=${event.status ?? "none"} attempt=${event.attempt} delayMs=${event.delay}`
+      );
+    }
   });
   const gatewayAssets = new PostmanGatewayAssetsClient({
     gateway,
@@ -140162,7 +140737,10 @@ async function runAction(actionCore = core_exports, actionExec = exec_exports) {
   }
   await mintAccessTokenIfNeeded(inputs, {
     info: (message) => actionCore.info(message),
-    warning: (message) => actionCore.warning(message)
+    warning: (message) => actionCore.warning(message),
+    retryEvent: (event) => actionCore.info(
+      `[postman retry] action=repo-sync class=${event.class} status=${event.status ?? "none"} attempt=${event.attempt} delayMs=${event.delay}`
+    )
   }, (secret) => actionCore.setSecret(secret));
   const masker = createSecretMasker([
     inputs.postmanApiKey,
@@ -140183,7 +140761,12 @@ async function runAction(actionCore = core_exports, actionExec = exec_exports) {
     explicitTeamId: inputs.teamId || void 0,
     mode: inputs.credentialPreflight,
     mask: masker,
-    log: actionCore
+    log: {
+      ...actionCore,
+      retryEvent: (event) => actionCore.info(
+        `[postman retry] action=repo-sync class=${event.class} status=${event.status ?? "none"} attempt=${event.attempt} delayMs=${event.delay}`
+      )
+    }
   });
   const resolved = await resolvePostmanApiKeyAndTeamId(inputs, actionCore, actionExec, masker, {
     env: process.env
@@ -140224,6 +140807,7 @@ async function runAction(actionCore = core_exports, actionExec = exec_exports) {
   decideBranchTier,
   getInput,
   hasInput,
+  prebuiltDirectoryTraversalIdentity,
   readActionInputs,
   resolveInputs,
   resolvePostmanApiKeyAndTeamId,