@postman-cse/onboarding-repo-sync 2.1.6 → 2.1.7

package/dist/action.cjs

@@ -125114,12 +125114,14 @@ var POSTMAN_ENDPOINT_PROFILES = {
   prod: {
     apiBaseUrl: "https://api.getpostman.com",
     bifrostBaseUrl: "https://bifrost-premium-https-v4.gw.postman.com",
+    fallbackBaseUrl: "https://go.postman.co/_api",
     cliInstallUrl: "https://dl-cli.pstmn.io/install/unix.sh",
     iapubBaseUrl: "https://iapub.postman.co"
   },
   beta: {
     apiBaseUrl: "https://api.getpostman-beta.com",
     bifrostBaseUrl: "https://bifrost-https-v4.gw.postman-beta.com",
+    fallbackBaseUrl: "https://go.postman-beta.co/_api",
     cliInstallUrl: "https://dl-cli.pstmn-beta.io/install/unix.sh",
     iapubBaseUrl: "https://iapub.postman.co"
   }
@@ -127587,6 +127589,14 @@ var PostmanGatewayAssetsClient = class {
     createFlights.set(key, { fingerprint, promise: pending });
     return pending;
   }
+  /**
+   * Reconcile an ambiguous create. Returns the adopted match, `undefined`
+   * when every discovery read succeeded and found nothing (the create is
+   * conclusively absent, so a fallback resend cannot duplicate), or `null`
+   * when the outcome is inconclusive (non-ambiguous error, or a discovery
+   * read itself failed — in that case a resend could duplicate a committed
+   * twin and must not fire).
+   */
   async discoverAfterAmbiguousCreate(discover, error2) {
     if (!this.isAmbiguousCreateOutcome(error2)) {
       return null;
@@ -127595,12 +127605,31 @@ var PostmanGatewayAssetsClient = class {
       if (attempt > 0) {
         await this.sleep(this.reconcileDelayMs);
       }
-      const found = await discover();
+      let found;
+      try {
+        found = await discover();
+      } catch {
+        return null;
+      }
       if (found) {
         return found;
       }
     }
-    return null;
+    return void 0;
+  }
+  /**
+   * After an ambiguous create failed AND discovery proved the asset absent,
+   * re-attempt the create once with the cold `/_api` fallback enabled: the
+   * reconcile above guarantees no committed twin, so the resend cannot
+   * duplicate. Returns null when the resend also fails (caller rethrows the
+   * original error).
+   */
+  async resendAbsentCreate(operation) {
+    try {
+      return await operation();
+    } catch {
+      return null;
+    }
   }
   publicEnvironmentUid(data, bareId) {
     const owner = String(data?.owner ?? "").trim();
@@ -127648,17 +127677,18 @@ var PostmanGatewayAssetsClient = class {
         name: envName,
         values: normalizedValues
       };
+      const send2 = (fallback) => this.gateway.requestJson(
+        {
+          service: "sync",
+          method: "post",
+          path: `/environment/import?workspace=${ws}`,
+          body,
+          ...fallback ? { fallback } : {}
+        },
+        { retryTransient: false }
+      );
       try {
-        const response = await this.gateway.requestJson(
-          {
-            service: "sync",
-            method: "post",
-            path: `/environment/import?workspace=${ws}`,
-            body
-          },
-          { retryTransient: false }
-        );
-        const data = this.dataOf(response);
+        const data = this.dataOf(await send2());
         const bareId = this.idOf(data);
         if (!bareId) {
           throw new Error("Environment import did not return a UID");
@@ -127673,6 +127703,15 @@ var PostmanGatewayAssetsClient = class {
           await this.updateEnvironment(adopted, envName, values);
           return adopted;
         }
+        if (adopted === void 0) {
+          const retried = await this.resendAbsentCreate(async () => {
+            const data = this.dataOf(await send2("auto"));
+            const bareId = this.idOf(data);
+            if (!bareId) throw new Error("Environment import did not return a UID");
+            return this.publicEnvironmentUid(data, bareId);
+          });
+          if (retried) return retried;
+        }
         throw error2;
       }
     });
@@ -127804,19 +127843,20 @@ var PostmanGatewayAssetsClient = class {
         private: false,
         ...environment ? { environment } : {}
       };
-      try {
-        const response = await this.gateway.requestJson(
-          {
-            service: "mock",
-            method: "post",
-            path: `/mocks?workspace=${ws}`,
-            body
-          },
-          // Unsafe create: never blind re-POST. An ESOCKETTIMEDOUT after accept
-          // may still have created the mock; reconcile via discovery below and
-          // let the orchestrator retry the whole create-or-adopt cycle.
-          { retryTransient: false }
-        );
+      const send2 = (fallback) => this.gateway.requestJson(
+        {
+          service: "mock",
+          method: "post",
+          path: `/mocks?workspace=${ws}`,
+          body,
+          ...fallback ? { fallback } : {}
+        },
+        // Unsafe create: never blind re-POST. An ESOCKETTIMEDOUT after accept
+        // may still have created the mock; reconcile via discovery below and
+        // let the orchestrator retry the whole create-or-adopt cycle.
+        { retryTransient: false }
+      );
+      const parseMock = (response) => {
         const record = this.dataOf(response);
         const uid = this.idOf(record);
         if (!uid) {
@@ -127826,6 +127866,9 @@ var PostmanGatewayAssetsClient = class {
           uid,
           url: String(record?.url ?? record?.mockUrl ?? "").trim()
         };
+      };
+      try {
+        return parseMock(await send2());
       } catch (error2) {
         const adopted = await this.discoverAfterAmbiguousCreate(
           () => this.findMockByCollection(collection, environment, mockName),
@@ -127834,6 +127877,10 @@ var PostmanGatewayAssetsClient = class {
         if (adopted) {
           return { uid: adopted.uid, url: adopted.mockUrl };
         }
+        if (adopted === void 0) {
+          const retried = await this.resendAbsentCreate(async () => parseMock(await send2("auto")));
+          if (retried) return retried;
+        }
         throw error2;
       }
     });
@@ -127940,21 +127987,25 @@ var PostmanGatewayAssetsClient = class {
         distribution: null,
         ...environment ? { environment } : {}
       };
-      try {
-        const response = await this.gateway.requestJson(
-          {
-            service: "monitors",
-            method: "post",
-            path: `/jobTemplates?workspace=${ws}`,
-            body
-          },
-          { retryTransient: false }
-        );
+      const send2 = (fallback) => this.gateway.requestJson(
+        {
+          service: "monitors",
+          method: "post",
+          path: `/jobTemplates?workspace=${ws}`,
+          body,
+          ...fallback ? { fallback } : {}
+        },
+        { retryTransient: false }
+      );
+      const parseMonitor = (response) => {
         const uid = this.idOf(this.dataOf(response));
         if (!uid) {
           throw new Error("Monitor create did not return a UID");
         }
         return uid;
+      };
+      try {
+        return parseMonitor(await send2());
       } catch (error2) {
         const adopted = await this.discoverAfterAmbiguousCreate(
           () => this.findMonitorByCollection(collection, environment, monitorName),
@@ -127963,6 +128014,10 @@ var PostmanGatewayAssetsClient = class {
         if (adopted?.uid) {
           return adopted.uid;
         }
+        if (adopted === void 0) {
+          const retried = await this.resendAbsentCreate(async () => parseMonitor(await send2("auto")));
+          if (retried) return retried;
+        }
         throw error2;
       }
     });
@@ -128191,6 +128246,7 @@ var AccessTokenGatewayClient = class {
   fetchImpl;
   secretMasker;
   maxRetries;
+  fallbackBaseUrl;
   retryBaseDelayMs;
   sleepImpl;
   constructor(options) {
@@ -128203,6 +128259,8 @@ var AccessTokenGatewayClient = class {
     this.fetchImpl = options.fetchImpl ?? fetch;
     this.secretMasker = options.secretMasker ?? createSecretMasker([this.tokenProvider.current()]);
     this.maxRetries = options.maxRetries ?? 3;
+    const fallbackEnv = typeof process !== "undefined" ? process.env?.POSTMAN_ITEM_CREATE_FALLBACK : void 0;
+    this.fallbackBaseUrl = fallbackEnv === "off" ? void 0 : options.fallbackBaseUrl?.replace(/\/+$/, "");
     this.retryBaseDelayMs = options.retryBaseDelayMs ?? 400;
     this.sleepImpl = options.sleepImpl ?? defaultSleep;
   }
@@ -128221,8 +128279,8 @@ var AccessTokenGatewayClient = class {
     }
     return headers;
   }
-  async send(request) {
-    const url = `${this.bifrostBaseUrl}/ws/proxy`;
+  async send(request, baseUrl) {
+    const url = `${baseUrl ?? this.bifrostBaseUrl}/ws/proxy`;
     return this.fetchImpl(url, {
       method: "POST",
       headers: this.buildHeaders(request.headers),
@@ -128235,6 +128293,43 @@ var AccessTokenGatewayClient = class {
       })
     });
   }
+  /**
+   * One cold, serial attempt against the fallback base URL after the primary
+   * budget is exhausted on a transient failure. Never hedged in parallel with
+   * the primary; only fires when the request would otherwise throw. Callers
+   * with `retryTransient: false` still reconcile first — the fallback attempt
+   * here is the resend, so it is only used for requests whose mutation is
+   * known idempotent or already reconciled by the caller's adopt-on-ambiguous
+   * loop.
+   */
+  async tryFallback(request) {
+    if (!this.fallbackBaseUrl) return null;
+    try {
+      return await this.send(request, this.fallbackBaseUrl);
+    } catch {
+      return null;
+    }
+  }
+  /**
+   * Run the fallback attempt and classify its response the same way the
+   * primary path would. Returns the success response, or null when the
+   * fallback also failed transiently (caller then throws the original error).
+   * Non-transient fallback failures (4xx) surface as their own HttpError since
+   * they are the freshest authoritative answer.
+   */
+  fallbackEligible(request, retryTransient) {
+    if (!this.fallbackBaseUrl) return false;
+    return retryTransient || request.fallback === "auto";
+  }
+  async attemptFallback(request, retryTransient) {
+    if (!this.fallbackEligible(request, retryTransient)) return null;
+    const response = await this.tryFallback(request);
+    if (!response) return null;
+    if (response.ok) return response;
+    const body = await response.text().catch(() => "");
+    if (isRetryableSafeReadResponse(response.status)) return null;
+    throw this.toHttpError(request, response, body);
+  }
   /**
    * Send a gateway request, refreshing the token once on an auth failure and
    * optionally retrying transient downstream failures (5xx / Bifrost read
@@ -128257,6 +128352,8 @@ var AccessTokenGatewayClient = class {
           await this.sleepImpl(delay);
           continue;
         }
+        const fallbackResponse2 = await this.attemptFallback(request, retryTransient);
+        if (fallbackResponse2) return fallbackResponse2;
         throw error2;
       }
       if (response.ok) {
@@ -128278,6 +128375,8 @@ var AccessTokenGatewayClient = class {
         await this.sleepImpl(delay);
         continue;
       }
+      const fallbackResponse = await this.attemptFallback(request, retryTransient);
+      if (fallbackResponse) return fallbackResponse;
       throw this.toHttpError(request, response, body);
     }
   }
@@ -128904,6 +129003,7 @@ function resolveInputs(env = process.env) {
     postmanStack,
     postmanApiBase: endpointProfile.apiBaseUrl,
     postmanBifrostBase: endpointProfile.bifrostBaseUrl,
+    postmanFallbackBase: endpointProfile.fallbackBaseUrl,
     postmanCliInstallUrl: endpointProfile.cliInstallUrl,
     postmanIapubBase: endpointProfile.iapubBaseUrl
   };
@@ -130045,6 +130145,8 @@ async function resolvePostmanApiKeyAndTeamId(inputs, actionCore, actionExec, mas
       const gateway = new AccessTokenGatewayClient({
         tokenProvider,
         bifrostBaseUrl: inputs.postmanBifrostBase,
+        // No fallback on the org-mode probe: the expected non-org 400 must
+        // surface verbatim, not be re-fired against the /_api alias.
         secretMasker: masker
       });
       const squads = await gateway.getSquads(teamId);
@@ -130100,6 +130202,7 @@ function createRepoSyncDependencies(inputs, resolved, factories, options = {}) {
   const gateway = new AccessTokenGatewayClient({
     tokenProvider,
     bifrostBaseUrl: inputs.postmanBifrostBase,
+    fallbackBaseUrl: inputs.postmanFallbackBase,
     teamId: resolved.teamId,
     orgMode: inputs.orgMode,
     secretMasker: masker

package/dist/cli.cjs

@@ -123217,12 +123217,14 @@ var POSTMAN_ENDPOINT_PROFILES = {
   prod: {
     apiBaseUrl: "https://api.getpostman.com",
     bifrostBaseUrl: "https://bifrost-premium-https-v4.gw.postman.com",
+    fallbackBaseUrl: "https://go.postman.co/_api",
     cliInstallUrl: "https://dl-cli.pstmn.io/install/unix.sh",
     iapubBaseUrl: "https://iapub.postman.co"
   },
   beta: {
     apiBaseUrl: "https://api.getpostman-beta.com",
     bifrostBaseUrl: "https://bifrost-https-v4.gw.postman-beta.com",
+    fallbackBaseUrl: "https://go.postman-beta.co/_api",
     cliInstallUrl: "https://dl-cli.pstmn-beta.io/install/unix.sh",
     iapubBaseUrl: "https://iapub.postman.co"
   }
@@ -125690,6 +125692,14 @@ var PostmanGatewayAssetsClient = class {
     createFlights.set(key, { fingerprint, promise: pending });
     return pending;
   }
+  /**
+   * Reconcile an ambiguous create. Returns the adopted match, `undefined`
+   * when every discovery read succeeded and found nothing (the create is
+   * conclusively absent, so a fallback resend cannot duplicate), or `null`
+   * when the outcome is inconclusive (non-ambiguous error, or a discovery
+   * read itself failed — in that case a resend could duplicate a committed
+   * twin and must not fire).
+   */
   async discoverAfterAmbiguousCreate(discover, error) {
     if (!this.isAmbiguousCreateOutcome(error)) {
       return null;
@@ -125698,12 +125708,31 @@ var PostmanGatewayAssetsClient = class {
       if (attempt > 0) {
         await this.sleep(this.reconcileDelayMs);
       }
-      const found = await discover();
+      let found;
+      try {
+        found = await discover();
+      } catch {
+        return null;
+      }
       if (found) {
         return found;
       }
     }
-    return null;
+    return void 0;
+  }
+  /**
+   * After an ambiguous create failed AND discovery proved the asset absent,
+   * re-attempt the create once with the cold `/_api` fallback enabled: the
+   * reconcile above guarantees no committed twin, so the resend cannot
+   * duplicate. Returns null when the resend also fails (caller rethrows the
+   * original error).
+   */
+  async resendAbsentCreate(operation) {
+    try {
+      return await operation();
+    } catch {
+      return null;
+    }
   }
   publicEnvironmentUid(data, bareId) {
     const owner = String(data?.owner ?? "").trim();
@@ -125751,17 +125780,18 @@ var PostmanGatewayAssetsClient = class {
         name: envName,
         values: normalizedValues
       };
+      const send2 = (fallback) => this.gateway.requestJson(
+        {
+          service: "sync",
+          method: "post",
+          path: `/environment/import?workspace=${ws}`,
+          body,
+          ...fallback ? { fallback } : {}
+        },
+        { retryTransient: false }
+      );
       try {
-        const response = await this.gateway.requestJson(
-          {
-            service: "sync",
-            method: "post",
-            path: `/environment/import?workspace=${ws}`,
-            body
-          },
-          { retryTransient: false }
-        );
-        const data = this.dataOf(response);
+        const data = this.dataOf(await send2());
         const bareId = this.idOf(data);
         if (!bareId) {
           throw new Error("Environment import did not return a UID");
@@ -125776,6 +125806,15 @@ var PostmanGatewayAssetsClient = class {
           await this.updateEnvironment(adopted, envName, values);
           return adopted;
         }
+        if (adopted === void 0) {
+          const retried = await this.resendAbsentCreate(async () => {
+            const data = this.dataOf(await send2("auto"));
+            const bareId = this.idOf(data);
+            if (!bareId) throw new Error("Environment import did not return a UID");
+            return this.publicEnvironmentUid(data, bareId);
+          });
+          if (retried) return retried;
+        }
         throw error;
       }
     });
@@ -125907,19 +125946,20 @@ var PostmanGatewayAssetsClient = class {
         private: false,
         ...environment ? { environment } : {}
       };
-      try {
-        const response = await this.gateway.requestJson(
-          {
-            service: "mock",
-            method: "post",
-            path: `/mocks?workspace=${ws}`,
-            body
-          },
-          // Unsafe create: never blind re-POST. An ESOCKETTIMEDOUT after accept
-          // may still have created the mock; reconcile via discovery below and
-          // let the orchestrator retry the whole create-or-adopt cycle.
-          { retryTransient: false }
-        );
+      const send2 = (fallback) => this.gateway.requestJson(
+        {
+          service: "mock",
+          method: "post",
+          path: `/mocks?workspace=${ws}`,
+          body,
+          ...fallback ? { fallback } : {}
+        },
+        // Unsafe create: never blind re-POST. An ESOCKETTIMEDOUT after accept
+        // may still have created the mock; reconcile via discovery below and
+        // let the orchestrator retry the whole create-or-adopt cycle.
+        { retryTransient: false }
+      );
+      const parseMock = (response) => {
         const record = this.dataOf(response);
         const uid = this.idOf(record);
         if (!uid) {
@@ -125929,6 +125969,9 @@ var PostmanGatewayAssetsClient = class {
           uid,
           url: String(record?.url ?? record?.mockUrl ?? "").trim()
         };
+      };
+      try {
+        return parseMock(await send2());
       } catch (error) {
         const adopted = await this.discoverAfterAmbiguousCreate(
           () => this.findMockByCollection(collection, environment, mockName),
@@ -125937,6 +125980,10 @@ var PostmanGatewayAssetsClient = class {
         if (adopted) {
           return { uid: adopted.uid, url: adopted.mockUrl };
         }
+        if (adopted === void 0) {
+          const retried = await this.resendAbsentCreate(async () => parseMock(await send2("auto")));
+          if (retried) return retried;
+        }
         throw error;
       }
     });
@@ -126043,21 +126090,25 @@ var PostmanGatewayAssetsClient = class {
         distribution: null,
         ...environment ? { environment } : {}
       };
-      try {
-        const response = await this.gateway.requestJson(
-          {
-            service: "monitors",
-            method: "post",
-            path: `/jobTemplates?workspace=${ws}`,
-            body
-          },
-          { retryTransient: false }
-        );
+      const send2 = (fallback) => this.gateway.requestJson(
+        {
+          service: "monitors",
+          method: "post",
+          path: `/jobTemplates?workspace=${ws}`,
+          body,
+          ...fallback ? { fallback } : {}
+        },
+        { retryTransient: false }
+      );
+      const parseMonitor = (response) => {
         const uid = this.idOf(this.dataOf(response));
         if (!uid) {
           throw new Error("Monitor create did not return a UID");
         }
         return uid;
+      };
+      try {
+        return parseMonitor(await send2());
       } catch (error) {
         const adopted = await this.discoverAfterAmbiguousCreate(
           () => this.findMonitorByCollection(collection, environment, monitorName),
@@ -126066,6 +126117,10 @@ var PostmanGatewayAssetsClient = class {
         if (adopted?.uid) {
           return adopted.uid;
         }
+        if (adopted === void 0) {
+          const retried = await this.resendAbsentCreate(async () => parseMonitor(await send2("auto")));
+          if (retried) return retried;
+        }
         throw error;
       }
     });
@@ -126294,6 +126349,7 @@ var AccessTokenGatewayClient = class {
   fetchImpl;
   secretMasker;
   maxRetries;
+  fallbackBaseUrl;
   retryBaseDelayMs;
   sleepImpl;
   constructor(options) {
@@ -126306,6 +126362,8 @@ var AccessTokenGatewayClient = class {
     this.fetchImpl = options.fetchImpl ?? fetch;
     this.secretMasker = options.secretMasker ?? createSecretMasker([this.tokenProvider.current()]);
     this.maxRetries = options.maxRetries ?? 3;
+    const fallbackEnv = typeof process !== "undefined" ? process.env?.POSTMAN_ITEM_CREATE_FALLBACK : void 0;
+    this.fallbackBaseUrl = fallbackEnv === "off" ? void 0 : options.fallbackBaseUrl?.replace(/\/+$/, "");
     this.retryBaseDelayMs = options.retryBaseDelayMs ?? 400;
     this.sleepImpl = options.sleepImpl ?? defaultSleep;
   }
@@ -126324,8 +126382,8 @@ var AccessTokenGatewayClient = class {
     }
     return headers;
   }
-  async send(request) {
-    const url = `${this.bifrostBaseUrl}/ws/proxy`;
+  async send(request, baseUrl) {
+    const url = `${baseUrl ?? this.bifrostBaseUrl}/ws/proxy`;
     return this.fetchImpl(url, {
       method: "POST",
       headers: this.buildHeaders(request.headers),
@@ -126338,6 +126396,43 @@ var AccessTokenGatewayClient = class {
       })
     });
   }
+  /**
+   * One cold, serial attempt against the fallback base URL after the primary
+   * budget is exhausted on a transient failure. Never hedged in parallel with
+   * the primary; only fires when the request would otherwise throw. Callers
+   * with `retryTransient: false` still reconcile first — the fallback attempt
+   * here is the resend, so it is only used for requests whose mutation is
+   * known idempotent or already reconciled by the caller's adopt-on-ambiguous
+   * loop.
+   */
+  async tryFallback(request) {
+    if (!this.fallbackBaseUrl) return null;
+    try {
+      return await this.send(request, this.fallbackBaseUrl);
+    } catch {
+      return null;
+    }
+  }
+  /**
+   * Run the fallback attempt and classify its response the same way the
+   * primary path would. Returns the success response, or null when the
+   * fallback also failed transiently (caller then throws the original error).
+   * Non-transient fallback failures (4xx) surface as their own HttpError since
+   * they are the freshest authoritative answer.
+   */
+  fallbackEligible(request, retryTransient) {
+    if (!this.fallbackBaseUrl) return false;
+    return retryTransient || request.fallback === "auto";
+  }
+  async attemptFallback(request, retryTransient) {
+    if (!this.fallbackEligible(request, retryTransient)) return null;
+    const response = await this.tryFallback(request);
+    if (!response) return null;
+    if (response.ok) return response;
+    const body = await response.text().catch(() => "");
+    if (isRetryableSafeReadResponse(response.status)) return null;
+    throw this.toHttpError(request, response, body);
+  }
   /**
    * Send a gateway request, refreshing the token once on an auth failure and
    * optionally retrying transient downstream failures (5xx / Bifrost read
@@ -126360,6 +126455,8 @@ var AccessTokenGatewayClient = class {
           await this.sleepImpl(delay);
           continue;
         }
+        const fallbackResponse2 = await this.attemptFallback(request, retryTransient);
+        if (fallbackResponse2) return fallbackResponse2;
         throw error;
       }
       if (response.ok) {
@@ -126381,6 +126478,8 @@ var AccessTokenGatewayClient = class {
         await this.sleepImpl(delay);
         continue;
       }
+      const fallbackResponse = await this.attemptFallback(request, retryTransient);
+      if (fallbackResponse) return fallbackResponse;
       throw this.toHttpError(request, response, body);
     }
   }
@@ -126952,6 +127051,7 @@ function resolveInputs(env = process.env) {
     postmanStack,
     postmanApiBase: endpointProfile.apiBaseUrl,
     postmanBifrostBase: endpointProfile.bifrostBaseUrl,
+    postmanFallbackBase: endpointProfile.fallbackBaseUrl,
     postmanCliInstallUrl: endpointProfile.cliInstallUrl,
     postmanIapubBase: endpointProfile.iapubBaseUrl
   };
@@ -127955,6 +128055,8 @@ async function resolvePostmanApiKeyAndTeamId(inputs, actionCore, actionExec, mas
       const gateway = new AccessTokenGatewayClient({
         tokenProvider,
         bifrostBaseUrl: inputs.postmanBifrostBase,
+        // No fallback on the org-mode probe: the expected non-org 400 must
+        // surface verbatim, not be re-fired against the /_api alias.
         secretMasker: masker
       });
       const squads = await gateway.getSquads(teamId);
@@ -128010,6 +128112,7 @@ function createRepoSyncDependencies(inputs, resolved, factories, options = {}) {
   const gateway = new AccessTokenGatewayClient({
     tokenProvider,
     bifrostBaseUrl: inputs.postmanBifrostBase,
+    fallbackBaseUrl: inputs.postmanFallbackBase,
     teamId: resolved.teamId,
     orgMode: inputs.orgMode,
     secretMasker: masker

package/dist/index.cjs

@@ -125134,12 +125134,14 @@ var POSTMAN_ENDPOINT_PROFILES = {
   prod: {
     apiBaseUrl: "https://api.getpostman.com",
     bifrostBaseUrl: "https://bifrost-premium-https-v4.gw.postman.com",
+    fallbackBaseUrl: "https://go.postman.co/_api",
     cliInstallUrl: "https://dl-cli.pstmn.io/install/unix.sh",
     iapubBaseUrl: "https://iapub.postman.co"
   },
   beta: {
     apiBaseUrl: "https://api.getpostman-beta.com",
     bifrostBaseUrl: "https://bifrost-https-v4.gw.postman-beta.com",
+    fallbackBaseUrl: "https://go.postman-beta.co/_api",
     cliInstallUrl: "https://dl-cli.pstmn-beta.io/install/unix.sh",
     iapubBaseUrl: "https://iapub.postman.co"
   }
@@ -127607,6 +127609,14 @@ var PostmanGatewayAssetsClient = class {
     createFlights.set(key, { fingerprint, promise: pending });
     return pending;
   }
+  /**
+   * Reconcile an ambiguous create. Returns the adopted match, `undefined`
+   * when every discovery read succeeded and found nothing (the create is
+   * conclusively absent, so a fallback resend cannot duplicate), or `null`
+   * when the outcome is inconclusive (non-ambiguous error, or a discovery
+   * read itself failed — in that case a resend could duplicate a committed
+   * twin and must not fire).
+   */
   async discoverAfterAmbiguousCreate(discover, error2) {
     if (!this.isAmbiguousCreateOutcome(error2)) {
       return null;
@@ -127615,12 +127625,31 @@ var PostmanGatewayAssetsClient = class {
       if (attempt > 0) {
         await this.sleep(this.reconcileDelayMs);
       }
-      const found = await discover();
+      let found;
+      try {
+        found = await discover();
+      } catch {
+        return null;
+      }
       if (found) {
         return found;
       }
     }
-    return null;
+    return void 0;
+  }
+  /**
+   * After an ambiguous create failed AND discovery proved the asset absent,
+   * re-attempt the create once with the cold `/_api` fallback enabled: the
+   * reconcile above guarantees no committed twin, so the resend cannot
+   * duplicate. Returns null when the resend also fails (caller rethrows the
+   * original error).
+   */
+  async resendAbsentCreate(operation) {
+    try {
+      return await operation();
+    } catch {
+      return null;
+    }
   }
   publicEnvironmentUid(data, bareId) {
     const owner = String(data?.owner ?? "").trim();
@@ -127668,17 +127697,18 @@ var PostmanGatewayAssetsClient = class {
         name: envName,
         values: normalizedValues
       };
+      const send2 = (fallback) => this.gateway.requestJson(
+        {
+          service: "sync",
+          method: "post",
+          path: `/environment/import?workspace=${ws}`,
+          body,
+          ...fallback ? { fallback } : {}
+        },
+        { retryTransient: false }
+      );
       try {
-        const response = await this.gateway.requestJson(
-          {
-            service: "sync",
-            method: "post",
-            path: `/environment/import?workspace=${ws}`,
-            body
-          },
-          { retryTransient: false }
-        );
-        const data = this.dataOf(response);
+        const data = this.dataOf(await send2());
         const bareId = this.idOf(data);
         if (!bareId) {
           throw new Error("Environment import did not return a UID");
@@ -127693,6 +127723,15 @@ var PostmanGatewayAssetsClient = class {
           await this.updateEnvironment(adopted, envName, values);
           return adopted;
         }
+        if (adopted === void 0) {
+          const retried = await this.resendAbsentCreate(async () => {
+            const data = this.dataOf(await send2("auto"));
+            const bareId = this.idOf(data);
+            if (!bareId) throw new Error("Environment import did not return a UID");
+            return this.publicEnvironmentUid(data, bareId);
+          });
+          if (retried) return retried;
+        }
         throw error2;
       }
     });
@@ -127824,19 +127863,20 @@ var PostmanGatewayAssetsClient = class {
         private: false,
         ...environment ? { environment } : {}
       };
-      try {
-        const response = await this.gateway.requestJson(
-          {
-            service: "mock",
-            method: "post",
-            path: `/mocks?workspace=${ws}`,
-            body
-          },
-          // Unsafe create: never blind re-POST. An ESOCKETTIMEDOUT after accept
-          // may still have created the mock; reconcile via discovery below and
-          // let the orchestrator retry the whole create-or-adopt cycle.
-          { retryTransient: false }
-        );
+      const send2 = (fallback) => this.gateway.requestJson(
+        {
+          service: "mock",
+          method: "post",
+          path: `/mocks?workspace=${ws}`,
+          body,
+          ...fallback ? { fallback } : {}
+        },
+        // Unsafe create: never blind re-POST. An ESOCKETTIMEDOUT after accept
+        // may still have created the mock; reconcile via discovery below and
+        // let the orchestrator retry the whole create-or-adopt cycle.
+        { retryTransient: false }
+      );
+      const parseMock = (response) => {
         const record = this.dataOf(response);
         const uid = this.idOf(record);
         if (!uid) {
@@ -127846,6 +127886,9 @@ var PostmanGatewayAssetsClient = class {
           uid,
           url: String(record?.url ?? record?.mockUrl ?? "").trim()
         };
+      };
+      try {
+        return parseMock(await send2());
       } catch (error2) {
         const adopted = await this.discoverAfterAmbiguousCreate(
           () => this.findMockByCollection(collection, environment, mockName),
@@ -127854,6 +127897,10 @@ var PostmanGatewayAssetsClient = class {
         if (adopted) {
           return { uid: adopted.uid, url: adopted.mockUrl };
         }
+        if (adopted === void 0) {
+          const retried = await this.resendAbsentCreate(async () => parseMock(await send2("auto")));
+          if (retried) return retried;
+        }
         throw error2;
       }
     });
@@ -127960,21 +128007,25 @@ var PostmanGatewayAssetsClient = class {
         distribution: null,
         ...environment ? { environment } : {}
       };
-      try {
-        const response = await this.gateway.requestJson(
-          {
-            service: "monitors",
-            method: "post",
-            path: `/jobTemplates?workspace=${ws}`,
-            body
-          },
-          { retryTransient: false }
-        );
+      const send2 = (fallback) => this.gateway.requestJson(
+        {
+          service: "monitors",
+          method: "post",
+          path: `/jobTemplates?workspace=${ws}`,
+          body,
+          ...fallback ? { fallback } : {}
+        },
+        { retryTransient: false }
+      );
+      const parseMonitor = (response) => {
         const uid = this.idOf(this.dataOf(response));
         if (!uid) {
           throw new Error("Monitor create did not return a UID");
         }
         return uid;
+      };
+      try {
+        return parseMonitor(await send2());
       } catch (error2) {
         const adopted = await this.discoverAfterAmbiguousCreate(
           () => this.findMonitorByCollection(collection, environment, monitorName),
@@ -127983,6 +128034,10 @@ var PostmanGatewayAssetsClient = class {
         if (adopted?.uid) {
           return adopted.uid;
         }
+        if (adopted === void 0) {
+          const retried = await this.resendAbsentCreate(async () => parseMonitor(await send2("auto")));
+          if (retried) return retried;
+        }
         throw error2;
       }
     });
@@ -128211,6 +128266,7 @@ var AccessTokenGatewayClient = class {
   fetchImpl;
   secretMasker;
   maxRetries;
+  fallbackBaseUrl;
   retryBaseDelayMs;
   sleepImpl;
   constructor(options) {
@@ -128223,6 +128279,8 @@ var AccessTokenGatewayClient = class {
     this.fetchImpl = options.fetchImpl ?? fetch;
     this.secretMasker = options.secretMasker ?? createSecretMasker([this.tokenProvider.current()]);
     this.maxRetries = options.maxRetries ?? 3;
+    const fallbackEnv = typeof process !== "undefined" ? process.env?.POSTMAN_ITEM_CREATE_FALLBACK : void 0;
+    this.fallbackBaseUrl = fallbackEnv === "off" ? void 0 : options.fallbackBaseUrl?.replace(/\/+$/, "");
     this.retryBaseDelayMs = options.retryBaseDelayMs ?? 400;
     this.sleepImpl = options.sleepImpl ?? defaultSleep;
   }
@@ -128241,8 +128299,8 @@ var AccessTokenGatewayClient = class {
     }
     return headers;
   }
-  async send(request) {
-    const url = `${this.bifrostBaseUrl}/ws/proxy`;
+  async send(request, baseUrl) {
+    const url = `${baseUrl ?? this.bifrostBaseUrl}/ws/proxy`;
     return this.fetchImpl(url, {
       method: "POST",
       headers: this.buildHeaders(request.headers),
@@ -128255,6 +128313,43 @@ var AccessTokenGatewayClient = class {
       })
     });
   }
+  /**
+   * One cold, serial attempt against the fallback base URL after the primary
+   * budget is exhausted on a transient failure. Never hedged in parallel with
+   * the primary; only fires when the request would otherwise throw. Callers
+   * with `retryTransient: false` still reconcile first — the fallback attempt
+   * here is the resend, so it is only used for requests whose mutation is
+   * known idempotent or already reconciled by the caller's adopt-on-ambiguous
+   * loop.
+   */
+  async tryFallback(request) {
+    if (!this.fallbackBaseUrl) return null;
+    try {
+      return await this.send(request, this.fallbackBaseUrl);
+    } catch {
+      return null;
+    }
+  }
+  /**
+   * Run the fallback attempt and classify its response the same way the
+   * primary path would. Returns the success response, or null when the
+   * fallback also failed transiently (caller then throws the original error).
+   * Non-transient fallback failures (4xx) surface as their own HttpError since
+   * they are the freshest authoritative answer.
+   */
+  fallbackEligible(request, retryTransient) {
+    if (!this.fallbackBaseUrl) return false;
+    return retryTransient || request.fallback === "auto";
+  }
+  async attemptFallback(request, retryTransient) {
+    if (!this.fallbackEligible(request, retryTransient)) return null;
+    const response = await this.tryFallback(request);
+    if (!response) return null;
+    if (response.ok) return response;
+    const body = await response.text().catch(() => "");
+    if (isRetryableSafeReadResponse(response.status)) return null;
+    throw this.toHttpError(request, response, body);
+  }
   /**
    * Send a gateway request, refreshing the token once on an auth failure and
    * optionally retrying transient downstream failures (5xx / Bifrost read
@@ -128277,6 +128372,8 @@ var AccessTokenGatewayClient = class {
           await this.sleepImpl(delay);
           continue;
         }
+        const fallbackResponse2 = await this.attemptFallback(request, retryTransient);
+        if (fallbackResponse2) return fallbackResponse2;
         throw error2;
       }
       if (response.ok) {
@@ -128298,6 +128395,8 @@ var AccessTokenGatewayClient = class {
         await this.sleepImpl(delay);
         continue;
       }
+      const fallbackResponse = await this.attemptFallback(request, retryTransient);
+      if (fallbackResponse) return fallbackResponse;
       throw this.toHttpError(request, response, body);
     }
   }
@@ -128924,6 +129023,7 @@ function resolveInputs(env = process.env) {
     postmanStack,
     postmanApiBase: endpointProfile.apiBaseUrl,
     postmanBifrostBase: endpointProfile.bifrostBaseUrl,
+    postmanFallbackBase: endpointProfile.fallbackBaseUrl,
     postmanCliInstallUrl: endpointProfile.cliInstallUrl,
     postmanIapubBase: endpointProfile.iapubBaseUrl
   };
@@ -130065,6 +130165,8 @@ async function resolvePostmanApiKeyAndTeamId(inputs, actionCore, actionExec, mas
       const gateway = new AccessTokenGatewayClient({
         tokenProvider,
         bifrostBaseUrl: inputs.postmanBifrostBase,
+        // No fallback on the org-mode probe: the expected non-org 400 must
+        // surface verbatim, not be re-fired against the /_api alias.
         secretMasker: masker
       });
       const squads = await gateway.getSquads(teamId);
@@ -130120,6 +130222,7 @@ function createRepoSyncDependencies(inputs, resolved, factories, options = {}) {
   const gateway = new AccessTokenGatewayClient({
     tokenProvider,
     bifrostBaseUrl: inputs.postmanBifrostBase,
+    fallbackBaseUrl: inputs.postmanFallbackBase,
     teamId: resolved.teamId,
     orgMode: inputs.orgMode,
     secretMasker: masker

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@postman-cse/onboarding-repo-sync",
-  "version": "2.1.6",
+  "version": "2.1.7",
   "description": "Postman repo sync GitHub Action.",
   "type": "module",
   "main": "dist/index.cjs",