@postman-cse/onboarding-repo-sync 2.6.3 → 2.6.5

package/dist/index.cjs

@@ -138442,8 +138442,8 @@ var PostmanGatewayAssetsClient = class {
     return { candidates, nameOnlyMatchCount: nameOnly.length, nameOnlyEnvironments };
   }
   /**
-   * Rebind the sole same-name monitor in this workspace onto the current
-   * collection UID.
+   * Replace the sole same-name monitor in this workspace when its collection
+   * UID changed.
    *
    * The canonical Smoke collection can legitimately change UID (a bootstrap
    * re-import after a marker/stranger miss, or an operator rebuild). The
@@ -138451,13 +138451,18 @@ var PostmanGatewayAssetsClient = class {
    * (which requires the full collection+environment+name triple) misses and a
    * second monitor with the same name would be created on every run, orphaning
    * the old one. Name plus environment is the stable identity across a
-   * collection re-import, so recover it here instead.
+   * collection re-import, so recover it here instead. Monitoring API does not
+   * allow `collection` in a jobTemplate update body, so replacement is the
+   * supported mutation: create or adopt the desired monitor first, then delete
+   * the stale monitor. This order preserves the existing monitor if creation
+   * fails and never deletes the only usable monitor before its replacement
+   * exists.
    *
    * Returns null when nothing needs rebinding (no same-name monitor, or it is
    * already bound to this collection). Refuses to guess when several same-name
    * monitors match, matching `selectExactMatch` semantics elsewhere.
    */
-  async rebindMonitorByName(name, collectionUid, environmentUid) {
+  async rebindMonitorByName(name, collectionUid, environmentUid, cronSchedule) {
     const monitorName = String(name ?? "").trim();
     const collection = String(collectionUid ?? "").trim();
     const environment = String(environmentUid ?? "").trim();
@@ -138489,16 +138494,19 @@ var PostmanGatewayAssetsClient = class {
     if (match.collectionUid === collection) {
       return null;
     }
-    await this.gateway.requestJson(
-      {
-        service: "monitors",
-        method: "put",
-        path: `/jobTemplates/${this.toModelId(match.uid)}?_etc=true`,
-        body: { collection }
-      },
-      { retryTransient: false }
+    const replacementUid = await this.createMonitor(
+      this.workspaceId,
+      monitorName,
+      collection,
+      environment,
+      cronSchedule
     );
-    return { uid: match.uid, previousCollectionUid: match.collectionUid };
+    await this.deleteMonitor(match.uid);
+    return {
+      uid: replacementUid,
+      previousUid: match.uid,
+      previousCollectionUid: match.collectionUid
+    };
   }
   async runMonitor(uid) {
     await this.gateway.requestJson(
@@ -140570,6 +140578,10 @@ var PREBUILT_COLLECTION_ROLES = /* @__PURE__ */ new Set([
 ]);
 var SHA256_HEX = /^[a-f0-9]{64}$/;
 var PREBUILT_CLOUD_ID = /^[A-Za-z0-9][A-Za-z0-9._:-]*$/;
+var PREBUILT_COLLECTION_MAX_DEPTH = 128;
+var PREBUILT_COLLECTION_MAX_TRAVERSAL_ENTRIES = LOCAL_SPEC_DISCOVERY_MAX_TRAVERSAL_ENTRIES;
+var PREBUILT_COLLECTION_MAX_FILE_BYTES = 32 * 1024 * 1024;
+var PREBUILT_COLLECTION_MAX_TOTAL_BYTES = 100 * 1024 * 1024;
 function failPrebuiltCollections(detail) {
   throw new Error(`CONTRACT_PREBUILT_COLLECTIONS_INVALID: ${detail}`);
 }
@@ -140681,8 +140693,9 @@ function assertPathWithinArtifactRoot(targetPath, artifactDir, fieldName) {
     existingPath = parent;
   }
   const realExisting = (0, import_node_fs5.realpathSync)(existingPath);
-  const realRelative = path8.relative(artifactRoot, realExisting);
-  if (realRelative.startsWith("..") || path8.isAbsolute(realRelative)) {
+  const realArtifactRoot = (0, import_node_fs5.existsSync)(artifactRoot) ? (0, import_node_fs5.realpathSync)(artifactRoot) : void 0;
+  const realRelative = realArtifactRoot ? path8.relative(realArtifactRoot, realExisting) : "";
+  if (realArtifactRoot && (realRelative.startsWith("..") || path8.isAbsolute(realRelative))) {
     failPrebuiltCollections(
       `${fieldName} resolves outside artifact-dir via symlink; received ${targetPath}`
     );
@@ -140724,13 +140737,16 @@ function listPrebuiltCollectionTreeFiles(collectionPath, artifactDir) {
     return [];
   }
   const files = [];
-  const pendingDirectories = [absRoot];
+  const pendingDirectories = [{ absolute: absRoot, depth: 0 }];
   const seenDirectories = /* @__PURE__ */ new Set();
+  let traversalEntries = 1;
+  let totalBytes = 0;
   while (pendingDirectories.length > 0) {
-    const currentAbsolute = pendingDirectories.pop();
-    if (!currentAbsolute) {
+    const current = pendingDirectories.pop();
+    if (!current) {
       break;
     }
+    const { absolute: currentAbsolute, depth: currentDepth } = current;
     const currentStat = (0, import_node_fs5.lstatSync)(currentAbsolute);
     if (currentStat.isSymbolicLink() || !currentStat.isDirectory()) {
       failPrebuiltCollections(
@@ -140744,8 +140760,16 @@ function listPrebuiltCollectionTreeFiles(collectionPath, artifactDir) {
       );
     }
     seenDirectories.add(currentKey);
-    const entries = (0, import_node_fs5.readdirSync)(currentAbsolute, { withFileTypes: true });
+    const entries = (0, import_node_fs5.readdirSync)(currentAbsolute, { withFileTypes: true }).sort(
+      (left, right) => left.name.localeCompare(right.name)
+    );
     for (const entry of entries) {
+      traversalEntries += 1;
+      if (traversalEntries > PREBUILT_COLLECTION_MAX_TRAVERSAL_ENTRIES) {
+        failPrebuiltCollections(
+          `prebuilt collection tree exceeded the ${PREBUILT_COLLECTION_MAX_TRAVERSAL_ENTRIES} traversal-entry budget`
+        );
+      }
       const abs = path8.join(currentAbsolute, entry.name);
       if (entry.isSymbolicLink()) {
         failPrebuiltCollections(
@@ -140753,7 +140777,13 @@ function listPrebuiltCollectionTreeFiles(collectionPath, artifactDir) {
         );
       }
       if (entry.isDirectory()) {
-        pendingDirectories.push(abs);
+        const nextDepth = currentDepth + 1;
+        if (nextDepth > PREBUILT_COLLECTION_MAX_DEPTH) {
+          failPrebuiltCollections(
+            `prebuilt collection tree exceeded the ${PREBUILT_COLLECTION_MAX_DEPTH} directory-depth budget`
+          );
+        }
+        pendingDirectories.push({ absolute: abs, depth: nextDepth });
         continue;
       }
       if (!entry.isFile()) {
@@ -140767,6 +140797,17 @@ function listPrebuiltCollectionTreeFiles(collectionPath, artifactDir) {
           `prebuilt collection tree file changed or became unsupported at ${normalizeToPosix(path8.relative(absRoot, abs))}`
         );
       }
+      if (fileLstat.size > PREBUILT_COLLECTION_MAX_FILE_BYTES) {
+        failPrebuiltCollections(
+          `prebuilt collection tree file ${normalizeToPosix(path8.relative(absRoot, abs))} exceeds the ${PREBUILT_COLLECTION_MAX_FILE_BYTES / (1024 * 1024)} MiB individual-file budget`
+        );
+      }
+      totalBytes += fileLstat.size;
+      if (totalBytes > PREBUILT_COLLECTION_MAX_TOTAL_BYTES) {
+        failPrebuiltCollections(
+          `prebuilt collection tree exceeded the ${PREBUILT_COLLECTION_MAX_TOTAL_BYTES / (1024 * 1024)} MiB total-byte budget`
+        );
+      }
       files.push({
         absolute: abs,
         relative: normalizeToPosix(path8.relative(absRoot, abs)),
@@ -140901,63 +140942,69 @@ async function preparePrivateMockCloudCollection(role, collectionId, postman) {
   }
   return collection;
 }
+var ARTIFACT_ACQUISITION_WIDTH = 2;
+async function runBoundedInOrder(items, width, worker) {
+  const results = new Array(items.length);
+  let nextIndex = 0;
+  const failures = /* @__PURE__ */ new Map();
+  const runWorker = async () => {
+    while (failures.size === 0 && nextIndex < items.length) {
+      const index = nextIndex;
+      nextIndex += 1;
+      try {
+        results[index] = await worker(items[index], index);
+      } catch (error2) {
+        failures.set(index, error2);
+        return;
+      }
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(width, items.length) }, () => runWorker()));
+  const failedIndex = Math.min(...failures.keys());
+  if (Number.isFinite(failedIndex)) {
+    throw failures.get(failedIndex);
+  }
+  return results;
+}
+async function acquireCollectionArtifact(options) {
+  const { role, collectionId, dirName, collectionsDir, prebuiltByRole, postman, core, privateMockAuth = false } = options;
+  const expectedPath = `${collectionsDir}/${dirName}`;
+  const forceCloudExport = privateMockAuth && (role === "smoke" || role === "contract");
+  const entry = prebuiltByRole.get(role);
+  if (entry && !forceCloudExport && tryReusePrebuiltCollection({
+    prepared: entry,
+    expectedPath,
+    expectedCloudId: collectionId
+  })) {
+    core.info(`Reusing prebuilt ${role} collection tree at ${expectedPath} (artifactDigest match)`);
+    return { reusePrebuilt: true };
+  }
+  if (entry) {
+    core.info(forceCloudExport ? `Private mock requires cloud export for ${role} collection to reconcile managed root hook; exporting from cloud` : `Prebuilt ${role} collection entry present but did not exactly match; exporting from cloud`);
+  }
+  const cloud = forceCloudExport ? await preparePrivateMockCloudCollection(role, collectionId, postman) : await postman.getCollection(collectionId);
+  return { reusePrebuilt: false, cloudCollection: cloud };
+}
 async function exportCollectionArtifact(options) {
   const {
-    role,
     collectionId,
     dirName,
     collectionsDir,
-    prebuiltByRole,
-    postman,
-    core,
-    privateMockAuth = false,
-    preparedCloudCollection
+    artifactDir,
+    acquisition
   } = options;
   if (!collectionId) {
     return void 0;
   }
   const expectedPath = `${collectionsDir}/${dirName}`;
-  const forceCloudExport = privateMockAuth && (role === "smoke" || role === "contract");
-  const entry = prebuiltByRole.get(role);
-  if (entry && !forceCloudExport) {
-    const reused = tryReusePrebuiltCollection({
-      prepared: entry,
-      expectedPath,
-      expectedCloudId: collectionId
-    });
-    if (reused) {
-      core.info(
-        `Reusing prebuilt ${role} collection tree at ${expectedPath} (artifactDigest match)`
-      );
-      return `../${expectedPath}`;
-    }
-    core.info(
-      `Prebuilt ${role} collection entry present but did not exactly match; exporting from cloud`
-    );
-  } else if (entry && forceCloudExport) {
-    core.info(
-      `Private mock requires cloud export for ${role} collection to reconcile managed root hook; exporting from cloud`
-    );
+  if (acquisition.reusePrebuilt) {
+    return `../${expectedPath}`;
   }
-  let collectionForExport;
-  if (forceCloudExport && preparedCloudCollection) {
-    collectionForExport = preparedCloudCollection;
-  } else if (forceCloudExport) {
-    const col = await postman.getCollection(collectionId);
-    const { collection } = applyPrivateMockExportCleanup(col, {
-      stripManagedBlocks: isPrivateMockLegacyExportCleanupEnabled()
-    });
-    if (!verifyPrivateMockRootHook(collection)) {
-      throw new Error(
-        `PRIVATE_MOCK_AUTH_ROOT_UNVERIFIED: Managed root hook missing from exported ${role} collection ${collectionId}`
-      );
-    }
-    collectionForExport = collection;
-  } else {
-    const col = await postman.getCollection(collectionId);
-    collectionForExport = col;
-  }
-  await convertAndSplitAnyCollection(collectionForExport, expectedPath);
+  assertPathWithinArtifactRoot(expectedPath, artifactDir, "collection target");
+  await convertAndSplitAnyCollection(
+    acquisition.cloudCollection,
+    expectedPath
+  );
   return `../${expectedPath}`;
 }
 function hasControlCharacter2(value) {
@@ -141022,65 +141069,45 @@ async function exportArtifacts(inputs, dependencies, envUids, assetProjectName,
   ) : void 0;
   const prebuiltByRole = options.preparedPrebuiltCollections;
   const privateMockAuth = options.privateMockAuth === true;
-  const preparedPrivateMockCollections = /* @__PURE__ */ new Map();
-  if (privateMockAuth) {
-    for (const spec of [
-      { role: "smoke", collectionId: inputs.smokeCollectionId },
-      { role: "contract", collectionId: inputs.contractCollectionId }
-    ]) {
-      if (!spec.collectionId) {
-        continue;
-      }
-      preparedPrivateMockCollections.set(
-        spec.role,
-        await preparePrivateMockCloudCollection(
-          spec.role,
-          spec.collectionId,
-          dependencies.postman
-        )
-      );
-    }
-  }
-  const baselineRef = await exportCollectionArtifact({
-    role: "baseline",
-    collectionId: inputs.baselineCollectionId,
-    dirName: getCollectionDirectoryName("Baseline", assetProjectName),
-    collectionsDir,
-    prebuiltByRole,
-    postman: dependencies.postman,
-    core: dependencies.core,
-    privateMockAuth
-  });
-  if (baselineRef) {
-    manifestCollections[baselineRef] = inputs.baselineCollectionId;
-  }
-  const smokeRef = await exportCollectionArtifact({
-    role: "smoke",
-    collectionId: inputs.smokeCollectionId,
-    dirName: getCollectionDirectoryName("Smoke", assetProjectName),
-    collectionsDir,
-    prebuiltByRole,
-    postman: dependencies.postman,
-    core: dependencies.core,
-    privateMockAuth,
-    preparedCloudCollection: preparedPrivateMockCollections.get("smoke")
-  });
-  if (smokeRef) {
-    manifestCollections[smokeRef] = inputs.smokeCollectionId;
+  const collectionSpecs = [
+    { role: "baseline", collectionId: inputs.baselineCollectionId, dirName: getCollectionDirectoryName("Baseline", assetProjectName) },
+    { role: "smoke", collectionId: inputs.smokeCollectionId, dirName: getCollectionDirectoryName("Smoke", assetProjectName) },
+    { role: "contract", collectionId: inputs.contractCollectionId, dirName: getCollectionDirectoryName("Contract", assetProjectName) }
+  ].filter((spec) => Boolean(spec.collectionId));
+  const collectionStartedAt = Date.now();
+  let collectionStatus = "success";
+  let acquisitions;
+  try {
+    acquisitions = await runBoundedInOrder(
+      collectionSpecs,
+      ARTIFACT_ACQUISITION_WIDTH,
+      (spec) => acquireCollectionArtifact({
+        ...spec,
+        collectionsDir,
+        prebuiltByRole,
+        postman: dependencies.postman,
+        core: dependencies.core,
+        privateMockAuth
+      })
+    );
+  } catch (error2) {
+    collectionStatus = "failed";
+    throw error2;
+  } finally {
+    dependencies.core.info(
+      `collection-acquisition count=${collectionSpecs.length} width=${ARTIFACT_ACQUISITION_WIDTH} ms=${Date.now() - collectionStartedAt} status=${collectionStatus}`
+    );
   }
-  const contractRef = await exportCollectionArtifact({
-    role: "contract",
-    collectionId: inputs.contractCollectionId,
-    dirName: getCollectionDirectoryName("Contract", assetProjectName),
-    collectionsDir,
-    prebuiltByRole,
-    postman: dependencies.postman,
-    core: dependencies.core,
-    privateMockAuth,
-    preparedCloudCollection: preparedPrivateMockCollections.get("contract")
-  });
-  if (contractRef) {
-    manifestCollections[contractRef] = inputs.contractCollectionId;
+  for (const [index, spec] of collectionSpecs.entries()) {
+    const ref = await exportCollectionArtifact({
+      ...spec,
+      collectionsDir,
+      artifactDir: inputs.artifactDir,
+      acquisition: acquisitions[index]
+    });
+    if (ref) {
+      manifestCollections[ref] = spec.collectionId;
+    }
   }
   ensureDir(collectionsDir);
   ensureDir(environmentsDir);
@@ -141099,17 +141126,40 @@ async function exportArtifacts(inputs, dependencies, envUids, assetProjectName,
       ensureDir(ciDir);
     }
   }
-  for (const [envName, envUid] of Object.entries(envUids)) {
-    writeJsonFile(
-      `${environmentsDir}/${envName}.postman_environment.json`,
-      await dependencies.postman.getEnvironment(envUid),
-      true
+  const environmentSpecs = [
+    ...Object.entries(envUids).map(([envName, envUid]) => ({
+      envName,
+      envUid,
+      filePath: `${environmentsDir}/${envName}.postman_environment.json`
+    })),
+    ...options.mockEnvironmentUid ? [{
+      envName: "manual-validation",
+      envUid: options.mockEnvironmentUid,
+      filePath: `${mocksDir}/manual-validation.postman_environment.json`
+    }] : []
+  ];
+  const environmentStartedAt = Date.now();
+  let environmentStatus = "success";
+  let environmentPayloads;
+  try {
+    environmentPayloads = await runBoundedInOrder(
+      environmentSpecs,
+      ARTIFACT_ACQUISITION_WIDTH,
+      (spec) => dependencies.postman.getEnvironment(spec.envUid)
+    );
+  } catch (error2) {
+    environmentStatus = "failed";
+    throw error2;
+  } finally {
+    dependencies.core.info(
+      `environment-artifact-acquisition count=${environmentSpecs.length} width=${ARTIFACT_ACQUISITION_WIDTH} ms=${Date.now() - environmentStartedAt} status=${environmentStatus}`
     );
   }
-  if (options.mockEnvironmentUid) {
+  for (const [index, spec] of environmentSpecs.entries()) {
+    assertPathWithinCwd(spec.filePath, "environment target");
     writeJsonFile(
-      `${mocksDir}/manual-validation.postman_environment.json`,
-      await dependencies.postman.getEnvironment(options.mockEnvironmentUid),
+      spec.filePath,
+      environmentPayloads[index],
       true
     );
   }
@@ -141119,6 +141169,7 @@ async function exportArtifacts(inputs, dependencies, envUids, assetProjectName,
     workspaceLinkEnabled: inputs.workspaceLinkEnabled,
     workspaceLinkStatus: options.workspaceLinkStatus
   });
+  assertPathWithinCwd(".postman/resources.yaml", "resources state target");
   (0, import_node_fs5.writeFileSync)(".postman/resources.yaml", buildResourcesManifest(
     durableWorkspaceId,
     manifestCollections,
@@ -141137,6 +141188,7 @@ async function exportArtifacts(inputs, dependencies, envUids, assetProjectName,
     } catch {
       existingWorkflows = void 0;
     }
+    assertPathWithinCwd(".postman/workflows.yaml", "workflows state target");
     (0, import_node_fs5.writeFileSync)(
       ".postman/workflows.yaml",
       buildSpecCollectionWorkflowManifest(
@@ -141186,18 +141238,19 @@ function createRepoSummary(outputs, envUids, pushed) {
 }
 async function commitAndPushGeneratedFiles(inputs, dependencies) {
   if (inputs.generateCiWorkflow) {
-    assertPathWithinCwd(inputs.ciWorkflowPath, "ci-workflow-path");
     const ciWorkflow = renderCiWorkflow(inputs);
     const parts = inputs.ciWorkflowPath.split("/");
     if (parts.length > 1) {
       const dir = parts.slice(0, -1).join("/");
       ensureDir(dir);
     }
+    assertPathWithinCwd(inputs.ciWorkflowPath, "ci-workflow-path");
     (0, import_node_fs5.writeFileSync)(inputs.ciWorkflowPath, ciWorkflow);
     if (inputs.provider === "github" || inputs.provider === "unknown") {
       const gcPath = ".github/workflows/postman-preview-gc.yml";
       if (inputs.ciWorkflowPath.endsWith(".github/workflows/ci.yml") || inputs.ciWorkflowPath === ".github/workflows/ci.yml") {
         ensureDir(".github/workflows");
+        assertPathWithinCwd(gcPath, "preview GC workflow path");
         (0, import_node_fs5.writeFileSync)(gcPath, renderGcWorkflowTemplate());
       }
     }
@@ -141643,35 +141696,25 @@ async function runRepoSyncInner(inputs, dependencies) {
           const rebound = await dependencies.postman.rebindMonitorByName(
             monitorName,
             inputs.smokeCollectionId,
-            monitorEnvUid
+            monitorEnvUid,
+            effectiveCron || void 0
           );
           if (rebound) {
             resolvedMonitorId = rebound.uid;
             dependencies.core.info(
-              `Rebound existing monitor ${rebound.uid} ("${monitorName}") from collection ${rebound.previousCollectionUid} to ${inputs.smokeCollectionId}`
+              `Replaced stale monitor ${rebound.previousUid} ("${monitorName}") from collection ${rebound.previousCollectionUid} with ${rebound.uid} on ${inputs.smokeCollectionId}`
             );
           }
         } catch (error2) {
-          if (error2 instanceof AmbiguousMonitorRebindError) {
-            throw new Error(
-              formatOrchestrationIssue({
-                operation: "Monitor rebind",
-                entity: `monitor "${monitorName}" workspace ${inputs.workspaceId} collection ${inputs.smokeCollectionId} environment ${monitorEnvUid}`,
-                cause: error2,
-                remediation: monitorRemediation,
-                mask
-              }),
-              { cause: error2 }
-            );
-          }
-          dependencies.core.warning(
+          throw new Error(
             formatOrchestrationIssue({
               operation: "Monitor rebind",
               entity: `monitor "${monitorName}" workspace ${inputs.workspaceId} collection ${inputs.smokeCollectionId} environment ${monitorEnvUid}`,
               cause: error2,
               remediation: monitorRemediation,
               mask
-            })
+            }),
+            { cause: error2 }
           );
         }
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@postman-cse/onboarding-repo-sync",
-  "version": "2.6.3",
+  "version": "2.6.5",
   "description": "Postman repo sync GitHub Action.",
   "type": "module",
   "main": "dist/index.cjs",