@postman-cse/onboarding-azure-spec-discovery 1.1.0 → 1.2.0

package/README.md

@@ -11,7 +11,7 @@ The action resolves the best specification source for the current repository in
 3. **App Service API definition** — a site whose `apiDefinition.url` points at a reachable OpenAPI document.
 4. **Local Azure IaC** — OpenAPI content embedded in ARM/Bicep templates or referenced by `azure.yaml` in the repository.
 
-When several Azure candidates match, a four-tier narrowing pipeline (IaC fingerprint, resource-group correlation, `postman:*` tag prefilter, naming heuristic) orders them, and genuinely ambiguous results surface as a ranked GitHub Step Summary table instead of a guess.
+When several Azure candidates match, a four-tier narrowing pipeline (IaC fingerprint, resource-group correlation, repo-tag prefilter, naming heuristic) orders them, and genuinely ambiguous results surface as a ranked GitHub Step Summary table instead of a guess. The tag prefilter selects outright when exactly one candidate carries a select-grade repo tag for the calling repository: canonical `postman:repo=<org>/<repo>`, the Fox-style `GithubOrg`/`GithubRepo` pair, or any extra keys supplied via the CLI-only `--repo-tag-keys-json` flag. Tag names and values compare case-insensitively (a trailing `.git` is tolerated), and when enumerated candidates carry no matching tags a single targeted Resource Graph tag lookup runs as a fallback — so a gateway tagged with its owning repo resolves automatically, per service repo, with zero further configuration.
 
 ## Auth and Postman handoff
 

package/dist/cli.cjs

@@ -188459,6 +188459,78 @@ function toAmbiguousViews(ranked) {
   }));
 }
 
+// src/lib/resolve/resource-graph-query.ts
+function escapeKqlString(value) {
+  return value.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+}
+var CANDIDATE_TYPES = [
+  "microsoft.apimanagement/service/apis",
+  "microsoft.apimanagement/service/workspaces/apis",
+  "microsoft.web/sites",
+  "microsoft.web/customapis",
+  "microsoft.logic/workflows",
+  "microsoft.resources/templatespecs/versions",
+  "microsoft.eventgrid/topics",
+  "microsoft.eventgrid/domains",
+  "microsoft.eventgrid/systemtopics",
+  "microsoft.servicebus/namespaces/topics"
+];
+function buildCandidateQuery(resourceGroup) {
+  const typeFilter = CANDIDATE_TYPES.map((type) => `'${type}'`).join(", ");
+  const lines = [
+    "Resources",
+    `| where type in~ (${typeFilter})`
+  ];
+  const trimmedGroup = (resourceGroup ?? "").trim();
+  if (trimmedGroup) {
+    lines.push(`| where resourceGroup =~ '${escapeKqlString(trimmedGroup)}'`);
+  }
+  lines.push(
+    "| extend apiType=tostring(properties.apiType), isCurrent=tobool(properties.isCurrent), apiRevision=tostring(properties.apiRevision), apiVersionSetId=tostring(properties.apiVersionSetId), apiDefinitionUrl=tostring(properties.siteConfig.apiDefinition.url)",
+    "| project id, name, type, resourceGroup, tags, apiType, isCurrent, apiRevision, apiVersionSetId, apiDefinitionUrl"
+  );
+  return lines.join("\n");
+}
+function tagKeyCaseVariants(key) {
+  const lower = key.toLowerCase();
+  const upperFirst = lower.charAt(0).toUpperCase() + lower.slice(1);
+  const pascalized = lower.split(/[:_-]/).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join("");
+  return [.../* @__PURE__ */ new Set([key, lower, upperFirst, pascalized])];
+}
+var FOX_ORG_KEY_VARIANTS = ["GithubOrg", "githuborg", "Githuborg", "GitHubOrg"];
+var FOX_REPO_KEY_VARIANTS = ["GithubRepo", "githubrepo", "Githubrepo", "GitHubRepo"];
+function buildRepoTagLookupQuery(repoSlug, repoTagKeys = [], resourceGroup) {
+  const slug = repoSlug.trim().replace(/\.git$/i, "");
+  const slugEscaped = escapeKqlString(slug);
+  const clauses = [];
+  for (const key of ["postman:repo", ...repoTagKeys]) {
+    for (const variant of tagKeyCaseVariants(key)) {
+      clauses.push(`tostring(tags['${escapeKqlString(variant)}']) =~ '${slugEscaped}'`);
+      clauses.push(`tostring(tags['${escapeKqlString(variant)}']) =~ '${slugEscaped}.git'`);
+    }
+  }
+  const [org, ...repoParts] = slug.split("/");
+  const repoName = repoParts.join("/");
+  if (org && repoName) {
+    const orgEscaped = escapeKqlString(org);
+    const repoEscaped = escapeKqlString(repoName);
+    for (const orgVariant of FOX_ORG_KEY_VARIANTS) {
+      for (const repoVariant of FOX_REPO_KEY_VARIANTS) {
+        clauses.push(
+          `(tostring(tags['${orgVariant}']) =~ '${orgEscaped}' and tostring(tags['${repoVariant}']) =~ '${repoEscaped}')`
+        );
+      }
+    }
+  }
+  const lines = ["Resources", `| where ${clauses.join(" or ")}`];
+  const trimmedGroup = (resourceGroup ?? "").trim();
+  if (trimmedGroup) {
+    lines.push(`| where resourceGroup =~ '${escapeKqlString(trimmedGroup)}'`);
+  }
+  lines.push("| project id, name, type, resourceGroup, tags");
+  return lines.join("\n");
+}
+
 // src/lib/resolve/narrowing-pipeline.ts
 function slugifyRepoName(repoSlug) {
   if (!repoSlug) return [];
@@ -188494,30 +188566,54 @@ function tierResourceGroupCorrelation(candidates, ctx) {
   };
 }
 var CANONICAL_REPO_TAG = "postman:repo";
+var FOX_ORG_TAG = "githuborg";
+var FOX_REPO_TAG = "githubrepo";
 var GENERIC_TAG_KEYS = ["repo", "repository", "service", "github:repository"];
+function normalizeTagBag(tags2) {
+  const normalized = {};
+  for (const [key, value] of Object.entries(tags2 ?? {})) {
+    normalized[key.toLowerCase()] = (value ?? "").trim();
+  }
+  return normalized;
+}
+function slugEquals(a, b) {
+  const strip = (value) => value.trim().replace(/\.git$/i, "").toLowerCase();
+  const left = strip(a);
+  return left.length > 0 && left === strip(b);
+}
 async function tierTagPreFilter(candidates, ctx) {
   if (!ctx.repoSlug) return void 0;
-  const exactMatches = candidates.filter((candidate) => (candidate.tags?.[CANONICAL_REPO_TAG] ?? "") === ctx.repoSlug);
-  const uniqueExact = [...new Set(exactMatches.map((candidate) => candidate.id))];
+  const repoSlug = ctx.repoSlug;
+  const selectKeys = [CANONICAL_REPO_TAG, ...(ctx.repoTagKeys ?? []).map((key) => key.toLowerCase())];
+  const selectMatches = candidates.filter((candidate) => {
+    const tags2 = normalizeTagBag(candidate.tags);
+    if (selectKeys.some((key) => slugEquals(tags2[key] ?? "", repoSlug))) return true;
+    const org = tags2[FOX_ORG_TAG] ?? "";
+    const repo = tags2[FOX_REPO_TAG] ?? "";
+    return org.length > 0 && repo.length > 0 && slugEquals(`${org}/${repo}`, repoSlug);
+  });
+  const uniqueExact = [...new Set(selectMatches.map((candidate) => candidate.id))];
   if (uniqueExact.length === 1) {
     return {
       ids: uniqueExact,
       selectId: uniqueExact[0],
-      evidence: [`Exactly one API tagged ${CANONICAL_REPO_TAG}=${ctx.repoSlug}`]
+      evidence: [`Exactly one API carries a select-grade repo tag matching ${repoSlug}`]
     };
   }
   if (uniqueExact.length > 1) {
     return {
       ids: uniqueExact,
-      evidence: [`Found ${uniqueExact.length} APIs tagged ${CANONICAL_REPO_TAG}=${ctx.repoSlug}`]
+      evidence: [`Found ${uniqueExact.length} APIs with select-grade repo tags matching ${repoSlug}`]
     };
   }
-  const repoName = ctx.repoSlug.split("/").pop()?.trim();
+  const graphHit = await tierTagGraphFallback(candidates, ctx);
+  if (graphHit) return graphHit;
+  const repoName = repoSlug.split("/").pop()?.trim();
   const genericMatches = candidates.filter((candidate) => {
-    const tags2 = candidate.tags ?? {};
+    const tags2 = normalizeTagBag(candidate.tags);
     return GENERIC_TAG_KEYS.some((key) => {
       const value = tags2[key] ?? "";
-      return value === ctx.repoSlug || repoName !== void 0 && value === repoName;
+      return slugEquals(value, repoSlug) || repoName !== void 0 && slugEquals(value, repoName);
     });
   });
   if (genericMatches.length > 0) {
@@ -188528,6 +188624,41 @@ async function tierTagPreFilter(candidates, ctx) {
   }
   return void 0;
 }
+async function tierTagGraphFallback(candidates, ctx) {
+  if (!ctx.resourceGraphClient || !ctx.subscriptionId || !ctx.repoSlug) return void 0;
+  let rows;
+  try {
+    rows = await ctx.resourceGraphClient.queryResources(
+      ctx.subscriptionId,
+      buildRepoTagLookupQuery(ctx.repoSlug, ctx.repoTagKeys ?? [], ctx.resourceGroup)
+    );
+  } catch {
+    return void 0;
+  }
+  if (rows.length === 0) return void 0;
+  const byLowerId = new Map(candidates.map((candidate) => [candidate.id.toLowerCase(), candidate.id]));
+  const matched = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const row of rows) {
+    const canonical = byLowerId.get(row.id.toLowerCase());
+    if (canonical !== void 0 && !seen.has(canonical)) {
+      seen.add(canonical);
+      matched.push(canonical);
+    }
+  }
+  if (matched.length === 0) return void 0;
+  if (matched.length === 1) {
+    return {
+      ids: matched,
+      selectId: matched[0],
+      evidence: [`Resource Graph tag lookup matched exactly one enumerated candidate for ${ctx.repoSlug}`]
+    };
+  }
+  return {
+    ids: matched,
+    evidence: [`Resource Graph tag lookup matched ${matched.length} enumerated candidate(s) for ${ctx.repoSlug}`]
+  };
+}
 function tierNamingHeuristic(candidates, ctx) {
   const slugs = slugifyRepoName(ctx.repoSlug);
   if (slugs.length === 0) return void 0;
@@ -188577,39 +188708,6 @@ async function runNarrowingPipeline(ctx, allCandidates) {
   return void 0;
 }
 
-// src/lib/resolve/resource-graph-query.ts
-function escapeKqlString(value) {
-  return value.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
-}
-var CANDIDATE_TYPES = [
-  "microsoft.apimanagement/service/apis",
-  "microsoft.apimanagement/service/workspaces/apis",
-  "microsoft.web/sites",
-  "microsoft.web/customapis",
-  "microsoft.logic/workflows",
-  "microsoft.resources/templatespecs/versions",
-  "microsoft.eventgrid/topics",
-  "microsoft.eventgrid/domains",
-  "microsoft.eventgrid/systemtopics",
-  "microsoft.servicebus/namespaces/topics"
-];
-function buildCandidateQuery(resourceGroup) {
-  const typeFilter = CANDIDATE_TYPES.map((type) => `'${type}'`).join(", ");
-  const lines = [
-    "Resources",
-    `| where type in~ (${typeFilter})`
-  ];
-  const trimmedGroup = (resourceGroup ?? "").trim();
-  if (trimmedGroup) {
-    lines.push(`| where resourceGroup =~ '${escapeKqlString(trimmedGroup)}'`);
-  }
-  lines.push(
-    "| extend apiType=tostring(properties.apiType), isCurrent=tobool(properties.isCurrent), apiRevision=tostring(properties.apiRevision), apiVersionSetId=tostring(properties.apiVersionSetId), apiDefinitionUrl=tostring(properties.siteConfig.apiDefinition.url)",
-    "| project id, name, type, resourceGroup, tags, apiType, isCurrent, apiRevision, apiVersionSetId, apiDefinitionUrl"
-  );
-  return lines.join("\n");
-}
-
 // src/lib/estate/enumerate.ts
 var SLUG_TAG_KEYS = ["postman:repo", "github:repository", "repo", "repository"];
 var ORG_TAG_KEY = "githuborg";
@@ -190022,6 +190120,7 @@ function resolveInputs(env = process.env) {
   const expectedApiIds = [apiId2, ...parseStringArrayJson(expectedApiIdsRaw, "expected-api-ids-json")].filter(
     (value) => Boolean(value)
   );
+  const repoTagKeysRaw = getInput("repo-tag-keys-json", env) ?? "[]";
   return {
     mode,
     subscriptionId: subscriptionId3,
@@ -190033,6 +190132,7 @@ function resolveInputs(env = process.env) {
     expectedApiIds: [...new Set(expectedApiIds)],
     apiFilter,
     serviceMapping: parseServiceMapping(serviceMappingRaw),
+    repoTagKeys: [...new Set(parseStringArrayJson(repoTagKeysRaw, "repo-tag-keys-json").map((key) => key.toLowerCase()))],
     outputDir,
     maxCandidates: parseBoundedInteger(getInput("max-candidates", env), "max-candidates", 50, 1, 1e4),
     dryRun: parseBoolean(getInput("dry-run", env), "dry-run", false),
@@ -190438,8 +190538,11 @@ async function runResolveOne(inputs, dependencies) {
     {
       repoSlug: inputs.repoContext.repoSlug,
       subscriptionId: subscriptionId3,
+      resourceGroup: inputs.resourceGroup,
+      repoTagKeys: inputs.repoTagKeys,
       serviceHints: signals.serviceHints,
-      signals
+      signals,
+      resourceGraphClient: dependencies.createResourceGraphClient?.()
     },
     enumerated.map((candidate) => ({
       id: candidate.id,
@@ -190551,8 +190654,11 @@ async function runDiscoverMany(inputs, dependencies) {
     {
       repoSlug: inputs.repoContext.repoSlug,
       subscriptionId: subscriptionId3,
+      resourceGroup: inputs.resourceGroup,
+      repoTagKeys: inputs.repoTagKeys,
       serviceHints: signals.serviceHints,
-      signals
+      signals,
+      resourceGraphClient: dependencies.createResourceGraphClient?.()
     },
     enumerated.map((candidate) => ({
       id: candidate.id,
@@ -190787,6 +190893,7 @@ var CLI_INPUT_NAMES = [
   "expected-api-ids-json",
   "api-filter",
   "service-mapping-json",
+  "repo-tag-keys-json",
   "output-dir",
   "max-candidates",
   "dry-run",

package/dist/index.cjs

@@ -191045,6 +191045,78 @@ function toAmbiguousViews(ranked) {
   }));
 }
 
+// src/lib/resolve/resource-graph-query.ts
+function escapeKqlString(value) {
+  return value.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+}
+var CANDIDATE_TYPES = [
+  "microsoft.apimanagement/service/apis",
+  "microsoft.apimanagement/service/workspaces/apis",
+  "microsoft.web/sites",
+  "microsoft.web/customapis",
+  "microsoft.logic/workflows",
+  "microsoft.resources/templatespecs/versions",
+  "microsoft.eventgrid/topics",
+  "microsoft.eventgrid/domains",
+  "microsoft.eventgrid/systemtopics",
+  "microsoft.servicebus/namespaces/topics"
+];
+function buildCandidateQuery(resourceGroup) {
+  const typeFilter = CANDIDATE_TYPES.map((type) => `'${type}'`).join(", ");
+  const lines = [
+    "Resources",
+    `| where type in~ (${typeFilter})`
+  ];
+  const trimmedGroup = (resourceGroup ?? "").trim();
+  if (trimmedGroup) {
+    lines.push(`| where resourceGroup =~ '${escapeKqlString(trimmedGroup)}'`);
+  }
+  lines.push(
+    "| extend apiType=tostring(properties.apiType), isCurrent=tobool(properties.isCurrent), apiRevision=tostring(properties.apiRevision), apiVersionSetId=tostring(properties.apiVersionSetId), apiDefinitionUrl=tostring(properties.siteConfig.apiDefinition.url)",
+    "| project id, name, type, resourceGroup, tags, apiType, isCurrent, apiRevision, apiVersionSetId, apiDefinitionUrl"
+  );
+  return lines.join("\n");
+}
+function tagKeyCaseVariants(key) {
+  const lower = key.toLowerCase();
+  const upperFirst = lower.charAt(0).toUpperCase() + lower.slice(1);
+  const pascalized = lower.split(/[:_-]/).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join("");
+  return [.../* @__PURE__ */ new Set([key, lower, upperFirst, pascalized])];
+}
+var FOX_ORG_KEY_VARIANTS = ["GithubOrg", "githuborg", "Githuborg", "GitHubOrg"];
+var FOX_REPO_KEY_VARIANTS = ["GithubRepo", "githubrepo", "Githubrepo", "GitHubRepo"];
+function buildRepoTagLookupQuery(repoSlug, repoTagKeys = [], resourceGroup) {
+  const slug = repoSlug.trim().replace(/\.git$/i, "");
+  const slugEscaped = escapeKqlString(slug);
+  const clauses = [];
+  for (const key of ["postman:repo", ...repoTagKeys]) {
+    for (const variant of tagKeyCaseVariants(key)) {
+      clauses.push(`tostring(tags['${escapeKqlString(variant)}']) =~ '${slugEscaped}'`);
+      clauses.push(`tostring(tags['${escapeKqlString(variant)}']) =~ '${slugEscaped}.git'`);
+    }
+  }
+  const [org, ...repoParts] = slug.split("/");
+  const repoName = repoParts.join("/");
+  if (org && repoName) {
+    const orgEscaped = escapeKqlString(org);
+    const repoEscaped = escapeKqlString(repoName);
+    for (const orgVariant of FOX_ORG_KEY_VARIANTS) {
+      for (const repoVariant of FOX_REPO_KEY_VARIANTS) {
+        clauses.push(
+          `(tostring(tags['${orgVariant}']) =~ '${orgEscaped}' and tostring(tags['${repoVariant}']) =~ '${repoEscaped}')`
+        );
+      }
+    }
+  }
+  const lines = ["Resources", `| where ${clauses.join(" or ")}`];
+  const trimmedGroup = (resourceGroup ?? "").trim();
+  if (trimmedGroup) {
+    lines.push(`| where resourceGroup =~ '${escapeKqlString(trimmedGroup)}'`);
+  }
+  lines.push("| project id, name, type, resourceGroup, tags");
+  return lines.join("\n");
+}
+
 // src/lib/resolve/narrowing-pipeline.ts
 function slugifyRepoName(repoSlug) {
   if (!repoSlug) return [];
@@ -191080,30 +191152,54 @@ function tierResourceGroupCorrelation(candidates, ctx) {
   };
 }
 var CANONICAL_REPO_TAG = "postman:repo";
+var FOX_ORG_TAG = "githuborg";
+var FOX_REPO_TAG = "githubrepo";
 var GENERIC_TAG_KEYS = ["repo", "repository", "service", "github:repository"];
+function normalizeTagBag(tags2) {
+  const normalized = {};
+  for (const [key, value] of Object.entries(tags2 ?? {})) {
+    normalized[key.toLowerCase()] = (value ?? "").trim();
+  }
+  return normalized;
+}
+function slugEquals(a, b) {
+  const strip = (value) => value.trim().replace(/\.git$/i, "").toLowerCase();
+  const left = strip(a);
+  return left.length > 0 && left === strip(b);
+}
 async function tierTagPreFilter(candidates, ctx) {
   if (!ctx.repoSlug) return void 0;
-  const exactMatches = candidates.filter((candidate) => (candidate.tags?.[CANONICAL_REPO_TAG] ?? "") === ctx.repoSlug);
-  const uniqueExact = [...new Set(exactMatches.map((candidate) => candidate.id))];
+  const repoSlug = ctx.repoSlug;
+  const selectKeys = [CANONICAL_REPO_TAG, ...(ctx.repoTagKeys ?? []).map((key) => key.toLowerCase())];
+  const selectMatches = candidates.filter((candidate) => {
+    const tags2 = normalizeTagBag(candidate.tags);
+    if (selectKeys.some((key) => slugEquals(tags2[key] ?? "", repoSlug))) return true;
+    const org = tags2[FOX_ORG_TAG] ?? "";
+    const repo = tags2[FOX_REPO_TAG] ?? "";
+    return org.length > 0 && repo.length > 0 && slugEquals(`${org}/${repo}`, repoSlug);
+  });
+  const uniqueExact = [...new Set(selectMatches.map((candidate) => candidate.id))];
   if (uniqueExact.length === 1) {
     return {
       ids: uniqueExact,
       selectId: uniqueExact[0],
-      evidence: [`Exactly one API tagged ${CANONICAL_REPO_TAG}=${ctx.repoSlug}`]
+      evidence: [`Exactly one API carries a select-grade repo tag matching ${repoSlug}`]
     };
   }
   if (uniqueExact.length > 1) {
     return {
       ids: uniqueExact,
-      evidence: [`Found ${uniqueExact.length} APIs tagged ${CANONICAL_REPO_TAG}=${ctx.repoSlug}`]
+      evidence: [`Found ${uniqueExact.length} APIs with select-grade repo tags matching ${repoSlug}`]
     };
   }
-  const repoName = ctx.repoSlug.split("/").pop()?.trim();
+  const graphHit = await tierTagGraphFallback(candidates, ctx);
+  if (graphHit) return graphHit;
+  const repoName = repoSlug.split("/").pop()?.trim();
   const genericMatches = candidates.filter((candidate) => {
-    const tags2 = candidate.tags ?? {};
+    const tags2 = normalizeTagBag(candidate.tags);
     return GENERIC_TAG_KEYS.some((key) => {
       const value = tags2[key] ?? "";
-      return value === ctx.repoSlug || repoName !== void 0 && value === repoName;
+      return slugEquals(value, repoSlug) || repoName !== void 0 && slugEquals(value, repoName);
     });
   });
   if (genericMatches.length > 0) {
@@ -191114,6 +191210,41 @@ async function tierTagPreFilter(candidates, ctx) {
   }
   return void 0;
 }
+async function tierTagGraphFallback(candidates, ctx) {
+  if (!ctx.resourceGraphClient || !ctx.subscriptionId || !ctx.repoSlug) return void 0;
+  let rows;
+  try {
+    rows = await ctx.resourceGraphClient.queryResources(
+      ctx.subscriptionId,
+      buildRepoTagLookupQuery(ctx.repoSlug, ctx.repoTagKeys ?? [], ctx.resourceGroup)
+    );
+  } catch {
+    return void 0;
+  }
+  if (rows.length === 0) return void 0;
+  const byLowerId = new Map(candidates.map((candidate) => [candidate.id.toLowerCase(), candidate.id]));
+  const matched = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const row of rows) {
+    const canonical = byLowerId.get(row.id.toLowerCase());
+    if (canonical !== void 0 && !seen.has(canonical)) {
+      seen.add(canonical);
+      matched.push(canonical);
+    }
+  }
+  if (matched.length === 0) return void 0;
+  if (matched.length === 1) {
+    return {
+      ids: matched,
+      selectId: matched[0],
+      evidence: [`Resource Graph tag lookup matched exactly one enumerated candidate for ${ctx.repoSlug}`]
+    };
+  }
+  return {
+    ids: matched,
+    evidence: [`Resource Graph tag lookup matched ${matched.length} enumerated candidate(s) for ${ctx.repoSlug}`]
+  };
+}
 function tierNamingHeuristic(candidates, ctx) {
   const slugs = slugifyRepoName(ctx.repoSlug);
   if (slugs.length === 0) return void 0;
@@ -191163,39 +191294,6 @@ async function runNarrowingPipeline(ctx, allCandidates) {
   return void 0;
 }
 
-// src/lib/resolve/resource-graph-query.ts
-function escapeKqlString(value) {
-  return value.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
-}
-var CANDIDATE_TYPES = [
-  "microsoft.apimanagement/service/apis",
-  "microsoft.apimanagement/service/workspaces/apis",
-  "microsoft.web/sites",
-  "microsoft.web/customapis",
-  "microsoft.logic/workflows",
-  "microsoft.resources/templatespecs/versions",
-  "microsoft.eventgrid/topics",
-  "microsoft.eventgrid/domains",
-  "microsoft.eventgrid/systemtopics",
-  "microsoft.servicebus/namespaces/topics"
-];
-function buildCandidateQuery(resourceGroup) {
-  const typeFilter = CANDIDATE_TYPES.map((type) => `'${type}'`).join(", ");
-  const lines = [
-    "Resources",
-    `| where type in~ (${typeFilter})`
-  ];
-  const trimmedGroup = (resourceGroup ?? "").trim();
-  if (trimmedGroup) {
-    lines.push(`| where resourceGroup =~ '${escapeKqlString(trimmedGroup)}'`);
-  }
-  lines.push(
-    "| extend apiType=tostring(properties.apiType), isCurrent=tobool(properties.isCurrent), apiRevision=tostring(properties.apiRevision), apiVersionSetId=tostring(properties.apiVersionSetId), apiDefinitionUrl=tostring(properties.siteConfig.apiDefinition.url)",
-    "| project id, name, type, resourceGroup, tags, apiType, isCurrent, apiRevision, apiVersionSetId, apiDefinitionUrl"
-  );
-  return lines.join("\n");
-}
-
 // src/lib/estate/enumerate.ts
 var SLUG_TAG_KEYS = ["postman:repo", "github:repository", "repo", "repository"];
 var ORG_TAG_KEY = "githuborg";
@@ -192608,6 +192706,7 @@ function resolveInputs(env = process.env) {
   const expectedApiIds = [apiId2, ...parseStringArrayJson(expectedApiIdsRaw, "expected-api-ids-json")].filter(
     (value) => Boolean(value)
   );
+  const repoTagKeysRaw = getInput2("repo-tag-keys-json", env) ?? "[]";
   return {
     mode,
     subscriptionId: subscriptionId3,
@@ -192619,6 +192718,7 @@ function resolveInputs(env = process.env) {
     expectedApiIds: [...new Set(expectedApiIds)],
     apiFilter,
     serviceMapping: parseServiceMapping(serviceMappingRaw),
+    repoTagKeys: [...new Set(parseStringArrayJson(repoTagKeysRaw, "repo-tag-keys-json").map((key) => key.toLowerCase()))],
     outputDir,
     maxCandidates: parseBoundedInteger(getInput2("max-candidates", env), "max-candidates", 50, 1, 1e4),
     dryRun: parseBoolean(getInput2("dry-run", env), "dry-run", false),
@@ -193034,8 +193134,11 @@ async function runResolveOne(inputs, dependencies) {
     {
       repoSlug: inputs.repoContext.repoSlug,
       subscriptionId: subscriptionId3,
+      resourceGroup: inputs.resourceGroup,
+      repoTagKeys: inputs.repoTagKeys,
       serviceHints: signals.serviceHints,
-      signals
+      signals,
+      resourceGraphClient: dependencies.createResourceGraphClient?.()
     },
     enumerated.map((candidate) => ({
       id: candidate.id,
@@ -193147,8 +193250,11 @@ async function runDiscoverMany(inputs, dependencies) {
     {
       repoSlug: inputs.repoContext.repoSlug,
       subscriptionId: subscriptionId3,
+      resourceGroup: inputs.resourceGroup,
+      repoTagKeys: inputs.repoTagKeys,
       serviceHints: signals.serviceHints,
-      signals
+      signals,
+      resourceGraphClient: dependencies.createResourceGraphClient?.()
     },
     enumerated.map((candidate) => ({
       id: candidate.id,

package/docs/providers.md

@@ -71,3 +71,5 @@ Not a provider. `mode: discover-estate` runs a separate association-only enumera
 ## Ordering and narrowing
 
 Probe order is `apim`, `app-service`, `custom-apis`, `logic-apps`, `template-specs`, `event-grid`, `service-bus`, `function-bindings`, `iac-local`. Candidates from all available providers enter the same four-tier narrowing pipeline (`iac-fingerprint`, `rg-correlation`, `tag-prefilter`, `naming-heuristic`); the chosen tier is reported in the `narrowing-strategy` output. Tags in the `postman:*` namespace (`postman:repo`, `postman:project-name`) are the strongest ownership signals.
+
+The `tag-prefilter` tier treats three tag shapes as select-grade (exactly one match selects at confidence 100): canonical `postman:repo=<org>/<repo>`, the Fox-style `GithubOrg`/`GithubRepo` pair composed as `<org>/<repo>`, and any extra keys registered through the CLI-only `repo-tag-keys-json` input. Tag keys compare case-insensitively (Azure tag names are case-insensitive) and values ignore case plus a trailing `.git`. When no enumerated candidate carries a matching tag bag and a Resource Graph client is available, the tier issues one targeted tag-lookup query (`buildRepoTagLookupQuery`) and intersects the returned ARM IDs with the enumerated candidate set — exactly one intersecting hit is select-grade; query failures narrow nothing (fail-soft). Generic tags (`repo`, `repository`, `service`, `github:repository`) stay narrow-only.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@postman-cse/onboarding-azure-spec-discovery",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "Discover Azure-hosted API specs and hand the result to Postman API onboarding.",
   "type": "module",
   "main": "dist/index.cjs",