@postman-cse/onboarding-bootstrap 0.15.0 → 0.15.3

package/README.md

@@ -1,5 +1,10 @@
 # postman-bootstrap-action
 
+[![CI](https://github.com/postman-cs/postman-bootstrap-action/actions/workflows/ci.yml/badge.svg)](https://github.com/postman-cs/postman-bootstrap-action/actions/workflows/ci.yml)
+[![Release](https://img.shields.io/github/v/release/postman-cs/postman-bootstrap-action?sort=semver)](https://github.com/postman-cs/postman-bootstrap-action/releases)
+[![npm](https://img.shields.io/npm/v/%40postman-cse%2Fonboarding-bootstrap)](https://www.npmjs.com/package/@postman-cse/onboarding-bootstrap)
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
+
 Public customer preview GitHub Action for Postman workspace bootstrap from a registry-backed OpenAPI spec.
 
 ## Scope

package/action.yml

@@ -1,5 +1,9 @@
 name: postman-bootstrap-action
-description: Public customer preview action contract for Postman workspace, spec, and collection bootstrap.
+description: Create or reuse a Postman workspace, upload an OpenAPI spec, and generate baseline, smoke, and contract collections.
+author: Postman
+branding:
+  icon: box
+  color: orange
 inputs:
 
   workspace-id:

package/dist/action.cjs

@@ -47921,20 +47921,22 @@ async function probeSessionIdentity(baseUrl, accessToken, fetchImpl) {
     if (!payload) {
       return void 0;
     }
-    const identity = asRecord(payload.identity);
-    const data = asRecord(payload.data);
+    const root = asRecord(payload.session) ?? payload;
+    const identity = asRecord(root.identity);
+    const data = asRecord(root.data);
     const user = asRecord(data?.user);
     const roleEntries = Array.isArray(user?.roles) ? user.roles.map((entry) => coerceText(entry) ?? coerceId(entry)).filter((entry) => Boolean(entry)) : [];
     const singleRole = coerceText(user?.role);
     const roles = roleEntries.length > 0 ? roleEntries : singleRole ? [singleRole] : void 0;
     const resolved = {
       source: "iapub/sessions",
-      userId: coerceId(user?.id),
+      userId: coerceId(identity?.user) ?? coerceId(user?.id),
       fullName: coerceText(user?.fullName) ?? coerceText(user?.name) ?? coerceText(user?.username),
       teamId: coerceId(identity?.team),
+      teamName: coerceText(user?.teamName),
       teamDomain: coerceText(identity?.domain),
       ...roles ? { roles } : {},
-      consumerType: coerceText(payload.consumerType) ?? coerceText(data?.consumerType) ?? coerceText(user?.consumerType)
+      consumerType: coerceText(root.consumerType) ?? coerceText(data?.consumerType) ?? coerceText(user?.consumerType)
     };
     memoizedSessionIdentity = resolved;
     return resolved;

package/dist/cli.cjs

@@ -46147,10 +46147,255 @@ function resolvePostmanEndpointProfile(stack) {
 }
 
 // src/lib/postman/credential-identity.ts
+var sessionPath = "/api/sessions/current";
+var pmakMemo = /* @__PURE__ */ new Map();
+var sessionMemo = /* @__PURE__ */ new Map();
 var memoizedSessionIdentity;
 function getMemoizedSessionIdentity() {
   return memoizedSessionIdentity;
 }
+function asRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return void 0;
+  }
+  return value;
+}
+function coerceId(raw) {
+  return raw ? String(raw) : void 0;
+}
+function coerceText(raw) {
+  if (typeof raw !== "string") {
+    return void 0;
+  }
+  const trimmed = raw.trim();
+  return trimmed ? trimmed : void 0;
+}
+function normalizeBaseUrl(raw) {
+  return String(raw || "").replace(/\/+$/, "");
+}
+async function resolvePmakIdentity(opts) {
+  const apiKey = String(opts.apiKey || "").trim();
+  if (!apiKey) {
+    return void 0;
+  }
+  const baseUrl = normalizeBaseUrl(opts.apiBaseUrl);
+  const memoKey = `${baseUrl}::${apiKey}`;
+  let pending = pmakMemo.get(memoKey);
+  if (!pending) {
+    pending = probePmakIdentity(baseUrl, apiKey, opts.fetchImpl ?? fetch);
+    pmakMemo.set(memoKey, pending);
+  }
+  return pending;
+}
+async function probePmakIdentity(baseUrl, apiKey, fetchImpl) {
+  try {
+    const response = await fetchImpl(`${baseUrl}/me`, {
+      method: "GET",
+      headers: { "X-Api-Key": apiKey }
+    });
+    if (!response.ok) {
+      return void 0;
+    }
+    const payload = asRecord(await response.json());
+    const user = asRecord(payload?.user);
+    if (!user) {
+      return void 0;
+    }
+    return {
+      source: "pmak/me",
+      userId: coerceId(user.id),
+      fullName: coerceText(user.fullName) ?? coerceText(user.username),
+      teamId: coerceId(user.teamId),
+      teamName: coerceText(user.teamName),
+      teamDomain: coerceText(user.teamDomain)
+    };
+  } catch {
+    return void 0;
+  }
+}
+async function resolveSessionIdentity(opts) {
+  const accessToken = String(opts.accessToken || "").trim();
+  if (!accessToken) {
+    return void 0;
+  }
+  const baseUrl = normalizeBaseUrl(opts.iapubBaseUrl);
+  const memoKey = `${baseUrl}::${accessToken}`;
+  let pending = sessionMemo.get(memoKey);
+  if (!pending) {
+    pending = probeSessionIdentity(baseUrl, accessToken, opts.fetchImpl ?? fetch);
+    sessionMemo.set(memoKey, pending);
+  }
+  return pending;
+}
+async function probeSessionIdentity(baseUrl, accessToken, fetchImpl) {
+  try {
+    const response = await fetchImpl(`${baseUrl}${sessionPath}`, {
+      method: "GET",
+      headers: { "x-access-token": accessToken }
+    });
+    if (!response.ok) {
+      return void 0;
+    }
+    const payload = asRecord(await response.json());
+    if (!payload) {
+      return void 0;
+    }
+    const root = asRecord(payload.session) ?? payload;
+    const identity = asRecord(root.identity);
+    const data = asRecord(root.data);
+    const user = asRecord(data?.user);
+    const roleEntries = Array.isArray(user?.roles) ? user.roles.map((entry) => coerceText(entry) ?? coerceId(entry)).filter((entry) => Boolean(entry)) : [];
+    const singleRole = coerceText(user?.role);
+    const roles = roleEntries.length > 0 ? roleEntries : singleRole ? [singleRole] : void 0;
+    const resolved = {
+      source: "iapub/sessions",
+      userId: coerceId(identity?.user) ?? coerceId(user?.id),
+      fullName: coerceText(user?.fullName) ?? coerceText(user?.name) ?? coerceText(user?.username),
+      teamId: coerceId(identity?.team),
+      teamName: coerceText(user?.teamName),
+      teamDomain: coerceText(identity?.domain),
+      ...roles ? { roles } : {},
+      consumerType: coerceText(root.consumerType) ?? coerceText(data?.consumerType) ?? coerceText(user?.consumerType)
+    };
+    memoizedSessionIdentity = resolved;
+    return resolved;
+  } catch {
+    return void 0;
+  }
+}
+function describeTeam(id) {
+  const label = id?.teamName ?? id?.teamDomain;
+  return `team ${id?.teamId ?? "unresolved"}${label ? ` (${label})` : ""}`;
+}
+function formatIdentityLine(id, mask) {
+  const teamPart = id.teamId ? describeTeam(id) : "team unresolved";
+  const domainPart = id.teamDomain ? `, domain ${id.teamDomain}` : "";
+  if (id.source === "pmak/me") {
+    const userPart = id.userId ? `user ${id.userId}${id.fullName ? ` (${id.fullName})` : ""}, ` : "";
+    return mask(`postman: PMAK identity - ${userPart}${teamPart}${domainPart}`);
+  }
+  return mask(
+    `postman: access-token session identity - ${teamPart}${domainPart} [source: iapub/sessions]`
+  );
+}
+function crossCheckIdentities(args) {
+  if (args.mode === "off") {
+    return { ok: true, level: "ok", message: "" };
+  }
+  const pmakTeamId = args.pmak?.teamId;
+  const sessionTeamId = args.session?.teamId;
+  if (pmakTeamId && sessionTeamId && pmakTeamId !== sessionTeamId) {
+    const level = args.mode === "enforce" ? "fail" : "note";
+    const lead = level === "fail" ? "credential preflight FAILED" : "credential preflight note";
+    const fix = level === "fail" ? "Use one credential pair from a single parent org: re-mint the access token from the same parent org as postman-api-key (postman-resolve-service-token-action, or POST https://api.getpostman.com/service-account-tokens with that team's PMAK), or set postman-api-key to the matching parent org." : "Use one credential pair from a single parent org. Set credential-preflight: enforce to fail the run on this condition.";
+    return {
+      ok: false,
+      level,
+      message: args.mask(
+        `postman: ${lead} - PMAK belongs to ${describeTeam(args.pmak)} but the access token's session belongs to a different parent org, ${describeTeam(args.session)}. Assets would be created against one team while Bifrost linking and governance act under the other, producing duplicate-link 400s and workspaces not visible to the other credential. ` + fix
+      )
+    };
+  }
+  if (pmakTeamId && sessionTeamId) {
+    const scope = args.workspaceTeamId || args.explicitTeamId ? "parent org team" : "team";
+    const label = args.pmak?.teamName ?? args.pmak?.teamDomain ?? args.session?.teamName ?? args.session?.teamDomain;
+    return {
+      ok: true,
+      level: "ok",
+      message: args.mask(
+        `postman: credential preflight OK - PMAK and access token both resolve to ${scope} ${pmakTeamId}${label ? ` (${label})` : ""}`
+      )
+    };
+  }
+  const missing = [
+    !pmakTeamId ? "PMAK identity" : void 0,
+    !sessionTeamId ? "access-token session identity" : void 0
+  ].filter(Boolean).join(" and ");
+  return {
+    ok: false,
+    level: "note",
+    message: args.mask(
+      `postman: credential preflight note - cross-check skipped because the ${missing} did not resolve a team id; continuing with reactive error guidance only`
+    )
+  };
+}
+async function runCredentialPreflight(args) {
+  if (args.mode === "off") {
+    return;
+  }
+  const mask = args.mask;
+  const apiKey = String(args.postmanApiKey || "").trim();
+  const accessToken = String(args.postmanAccessToken || "").trim();
+  let pmak;
+  if (apiKey) {
+    try {
+      pmak = await resolvePmakIdentity({
+        apiBaseUrl: args.apiBaseUrl,
+        apiKey,
+        fetchImpl: args.fetchImpl
+      });
+    } catch (error) {
+      args.log.warning(
+        mask(
+          `postman: credential preflight could not resolve PMAK identity: ${error instanceof Error ? error.message : String(error)}`
+        )
+      );
+    }
+    if (pmak) {
+      args.log.info(formatIdentityLine(pmak, mask));
+    } else {
+      args.log.warning(
+        mask("postman: credential preflight could not resolve PMAK identity from GET /me; continuing")
+      );
+    }
+  }
+  if (!accessToken) {
+    args.log.info(mask("postman: Bifrost diagnostics limited: no access token"));
+    return;
+  }
+  let session;
+  try {
+    session = await resolveSessionIdentity({
+      iapubBaseUrl: args.iapubBaseUrl,
+      accessToken,
+      fetchImpl: args.fetchImpl
+    });
+  } catch (error) {
+    args.log.warning(
+      mask(
+        `postman: credential preflight could not resolve access-token session identity: ${error instanceof Error ? error.message : String(error)}`
+      )
+    );
+  }
+  if (session) {
+    args.log.info(formatIdentityLine(session, mask));
+  } else {
+    args.log.warning(
+      mask(
+        "postman: credential preflight could not resolve the access-token session identity from iapub; continuing with reactive error guidance only"
+      )
+    );
+  }
+  const result = crossCheckIdentities({
+    pmak,
+    session,
+    workspaceTeamId: args.workspaceTeamId,
+    explicitTeamId: args.explicitTeamId,
+    mode: args.mode,
+    mask
+  });
+  if (!result.message) {
+    return;
+  }
+  if (result.level === "fail") {
+    throw new Error(result.message);
+  }
+  if (result.level === "note") {
+    args.log.warning(result.message);
+    return;
+  }
+  args.log.info(result.message);
+}
 
 // src/lib/postman/error-advice.ts
 var WORKSPACE_PERSONAL_ONLY_ADVICE = "Workspace creation failed: This may be an Org-mode account that requires a workspace-team-id input. The Postman API does not allow creating team workspaces at the organization level. Use the workspace-team-id input to specify which sub-team should own this workspace.";
@@ -46256,7 +46501,7 @@ async function retry(operation, options = {}) {
 }
 
 // src/lib/postman/postman-assets-client.ts
-function asRecord(value) {
+function asRecord2(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     return null;
   }
@@ -46264,8 +46509,8 @@ function asRecord(value) {
 }
 function extractWorkspacesPage(data) {
   const workspaces = Array.isArray(data?.workspaces) ? data.workspaces : [];
-  const meta = asRecord(data?.meta);
-  const pagination = asRecord(data?.pagination);
+  const meta = asRecord2(data?.meta);
+  const pagination = asRecord2(data?.pagination);
   const nextCursor = String(
     data?.nextCursor ?? data?.next_cursor ?? meta?.nextCursor ?? meta?.next_cursor ?? pagination?.nextCursor ?? pagination?.next_cursor ?? ""
   ).trim() || void 0;
@@ -46357,7 +46602,7 @@ var PostmanAssetsClient = class {
   async getTeams() {
     const data = await this.request("/teams");
     const teams = data?.data ?? [];
-    return Array.isArray(teams) ? teams.map((entry) => asRecord(entry)).filter((team) => Boolean(team?.id && team?.name)).map((team) => ({
+    return Array.isArray(teams) ? teams.map((entry) => asRecord2(entry)).filter((team) => Boolean(team?.id && team?.name)).map((team) => ({
       id: Number(team.id),
       name: String(team.name),
       handle: String(team.handle || ""),
@@ -46417,20 +46662,20 @@ var PostmanAssetsClient = class {
         }
         throw err;
       }
-      const createdWorkspace = asRecord(created?.workspace);
+      const createdWorkspace = asRecord2(created?.workspace);
       const workspaceId = String(createdWorkspace?.id || "").trim();
       if (!workspaceId) {
         throw new Error("Workspace create did not return an id");
       }
       const workspace = await this.request(`/workspaces/${workspaceId}`);
-      let visibility = asRecord(workspace?.workspace)?.visibility;
+      let visibility = asRecord2(workspace?.workspace)?.visibility;
       if (visibility !== "team") {
         await this.request(`/workspaces/${workspaceId}`, {
           method: "PUT",
           body: JSON.stringify(payload)
         });
         const reread = await this.request(`/workspaces/${workspaceId}`);
-        visibility = asRecord(reread?.workspace)?.visibility;
+        visibility = asRecord2(reread?.workspace)?.visibility;
       }
       if (typeof visibility === "string" && visibility !== "team") {
         let cleanedUp = false;
@@ -46459,7 +46704,7 @@ var PostmanAssetsClient = class {
   async getWorkspaceVisibility(workspaceId) {
     try {
       const workspace = await this.request(`/workspaces/${workspaceId}`);
-      const visibility = asRecord(workspace?.workspace)?.visibility;
+      const visibility = asRecord2(workspace?.workspace)?.visibility;
       return typeof visibility === "string" ? visibility : null;
     } catch {
       return null;
@@ -46481,7 +46726,7 @@ var PostmanAssetsClient = class {
         nextCursor = page.nextCursor;
       }
     } while (nextCursor);
-    return allWorkspaces.map((entry) => asRecord(entry)).filter((workspace) => Boolean(workspace?.id && workspace?.name)).map((workspace) => ({
+    return allWorkspaces.map((entry) => asRecord2(entry)).filter((workspace) => Boolean(workspace?.id && workspace?.name)).map((workspace) => ({
       id: String(workspace.id),
       name: String(workspace.name),
       type: String(workspace.type ?? "team")
@@ -46529,7 +46774,7 @@ var PostmanAssetsClient = class {
   async inviteRequesterToWorkspace(workspaceId, email) {
     const users = await this.request("/users");
     const userList = Array.isArray(users?.data) ? users.data : [];
-    const user = userList.map((entry) => asRecord(entry)).find((entry) => entry?.email === email);
+    const user = userList.map((entry) => asRecord2(entry)).find((entry) => entry?.email === email);
     if (!user?.id) {
       return;
     }
@@ -46617,12 +46862,12 @@ var PostmanAssetsClient = class {
       }
     };
     const extractUid = (data) => {
-      const root = asRecord(data);
-      const details = asRecord(root?.details);
+      const root = asRecord2(data);
+      const details = asRecord2(root?.details);
       const resources = Array.isArray(details?.resources) ? details.resources : [];
-      const firstResource = asRecord(resources[0]);
-      const collection = asRecord(root?.collection);
-      const resource = asRecord(root?.resource);
+      const firstResource = asRecord2(resources[0]);
+      const collection = asRecord2(root?.collection);
+      const resource = asRecord2(root?.resource);
       return String(
         firstResource?.id ?? collection?.id ?? collection?.uid ?? resource?.uid ?? resource?.id ?? ""
       ).trim() || void 0;
@@ -46656,9 +46901,9 @@ var PostmanAssetsClient = class {
     if (directUid) {
       return directUid;
     }
-    let taskUrl = String(generationResponse?.url ?? "") || String(generationResponse?.task_url ?? "") || String(generationResponse?.taskUrl ?? "") || String(asRecord(generationResponse?.links)?.task ?? "");
+    let taskUrl = String(generationResponse?.url ?? "") || String(generationResponse?.task_url ?? "") || String(generationResponse?.taskUrl ?? "") || String(asRecord2(generationResponse?.links)?.task ?? "");
     if (!taskUrl) {
-      const task = asRecord(generationResponse?.task);
+      const task = asRecord2(generationResponse?.task);
       const taskId = generationResponse?.taskId || task?.id || generationResponse?.id;
       if (!taskId) {
         throw new Error(
@@ -46672,8 +46917,8 @@ var PostmanAssetsClient = class {
         setTimeout(resolve3, 2e3);
       });
       const task = await this.request(taskUrl);
-      const taskRecord = asRecord(task);
-      const taskNested = asRecord(taskRecord?.task);
+      const taskRecord = asRecord2(task);
+      const taskNested = asRecord2(taskRecord?.task);
       const status = String(taskRecord?.status || taskNested?.status || "").toLowerCase();
       if (status === "completed") {
         const taskUid = extractUid(task);
@@ -46704,7 +46949,7 @@ var PostmanAssetsClient = class {
   }
   async injectTests(collectionUid, type2) {
     const collectionResponse = await this.request(`/collections/${collectionUid}`);
-    const collection = asRecord(collectionResponse?.collection);
+    const collection = asRecord2(collectionResponse?.collection);
     if (!collection) {
       throw new Error(`Failed to fetch collection ${collectionUid}`);
     }
@@ -46790,7 +47035,7 @@ var PostmanAssetsClient = class {
         });
       }
       if (Array.isArray(itemNode.item)) {
-        itemNode.item.map((entry) => asRecord(entry)).filter((entry) => Boolean(entry)).forEach(injectScripts);
+        itemNode.item.map((entry) => asRecord2(entry)).filter((entry) => Boolean(entry)).forEach(injectScripts);
       }
     };
     if (Array.isArray(collection.item)) {
@@ -46818,7 +47063,7 @@ var PostmanAssetsClient = class {
         }
       })
     });
-    const environment = asRecord(response?.environment);
+    const environment = asRecord2(response?.environment);
     const uid = String(environment?.uid || "").trim();
     if (!uid) {
       throw new Error("Environment create did not return a UID");
@@ -46851,7 +47096,7 @@ var PostmanAssetsClient = class {
         }
       })
     });
-    const monitor = asRecord(response?.monitor);
+    const monitor = asRecord2(response?.monitor);
     const uid = String(monitor?.uid || "").trim();
     if (!uid) {
       throw new Error("Monitor create did not return a UID");
@@ -46870,8 +47115,8 @@ var PostmanAssetsClient = class {
         }
       })
     });
-    const mock = asRecord(response?.mock);
-    const mockConfig = asRecord(mock?.config);
+    const mock = asRecord2(response?.mock);
+    const mockConfig = asRecord2(mock?.config);
     const uid = String(mock?.uid || "").trim();
     if (!uid) {
       throw new Error("Mock create did not return a UID");
@@ -47743,7 +47988,7 @@ var STRIP_KEYS = /* @__PURE__ */ new Set([
   "discriminator",
   "format"
 ]);
-function asRecord2(value) {
+function asRecord3(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return null;
   return value;
 }
@@ -47755,7 +48000,7 @@ function decodePointerSegment(segment) {
 }
 function resolvePointer(root, ref) {
   if (!ref.startsWith("#/")) return void 0;
-  return ref.slice(2).split("/").map(decodePointerSegment).reduce((node, segment) => asRecord2(node)?.[segment], root);
+  return ref.slice(2).split("/").map(decodePointerSegment).reduce((node, segment) => asRecord3(node)?.[segment], root);
 }
 function unsupported(message) {
   return { unsupported: message };
@@ -47765,7 +48010,7 @@ function mergeRequiredWithoutWriteOnly(required, writeOnlyProperties) {
   return values.length > 0 ? values : void 0;
 }
 function hasUnsupported(child) {
-  return asRecord2(child)?.unsupported;
+  return asRecord3(child)?.unsupported;
 }
 function rootDialect(root, version, schemaRecord) {
   if (version === "3.0") return DRAFT_07_SCHEMA_URI;
@@ -47785,7 +48030,7 @@ function normalizeSchema(root, schema2, options) {
     const bad = normalized2.map(hasUnsupported).find(Boolean);
     return bad ? unsupported(bad) : normalized2;
   }
-  const record = asRecord2(schema2);
+  const record = asRecord3(schema2);
   if (!record) return schema2;
   const ref = typeof record.$ref === "string" ? record.$ref : "";
   if (ref) {
@@ -47820,10 +48065,10 @@ function normalizeSchema(root, schema2, options) {
   const nullable = sourceSchema.nullable === true && options.version === "3.0";
   delete sourceSchema.nullable;
   const writeOnlyProperties = /* @__PURE__ */ new Set();
-  const rawProperties = asRecord2(sourceSchema.properties);
+  const rawProperties = asRecord3(sourceSchema.properties);
   if (rawProperties) {
     for (const [propertyName, propertySchema] of Object.entries(rawProperties)) {
-      if (asRecord2(propertySchema)?.writeOnly === true) writeOnlyProperties.add(propertyName);
+      if (asRecord3(propertySchema)?.writeOnly === true) writeOnlyProperties.add(propertyName);
     }
   }
   const normalized = {};
@@ -47855,7 +48100,7 @@ function normalizeSchema(root, schema2, options) {
       return unsupported("Tuple array items are unsupported in OpenAPI 3.0");
     }
     if (key === "properties") {
-      const properties = asRecord2(value);
+      const properties = asRecord3(value);
       if (!properties) continue;
       const nextProperties = {};
       for (const [propertyName, propertySchema] of Object.entries(properties)) {
@@ -47898,7 +48143,7 @@ function normalizeSchema(root, schema2, options) {
 }
 function packSchema(root, schema2, version) {
   try {
-    const dialect = rootDialect(root, version, asRecord2(schema2) ?? void 0);
+    const dialect = rootDialect(root, version, asRecord3(schema2) ?? void 0);
     const normalized = normalizeSchema(root, schema2, { version, rootSchema: true, dialect });
     const message = hasUnsupported(normalized);
     return message ? unsupported(message) : { schema: normalized };
@@ -47909,7 +48154,7 @@ function packSchema(root, schema2, version) {
 
 // src/lib/spec/contract-index.ts
 var HTTP_METHODS = /* @__PURE__ */ new Set(["get", "put", "post", "delete", "options", "head", "patch", "trace"]);
-function asRecord3(value) {
+function asRecord4(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return null;
   return value;
 }
@@ -47926,12 +48171,12 @@ function detectOpenApiVersion(root) {
   return match[1] === "1" ? "3.1" : "3.0";
 }
 function resolveInternalRef(root, value) {
-  const record = asRecord3(value);
+  const record = asRecord4(value);
   if (!record) return null;
   const ref = typeof record.$ref === "string" ? record.$ref : "";
   if (!ref) return record;
   if (!ref.startsWith("#/")) throw new Error(`CONTRACT_UNRESOLVED_REF: External ref remained after bundling: ${ref}`);
-  const resolved = asRecord3(resolvePointer(root, ref));
+  const resolved = asRecord4(resolvePointer(root, ref));
   if (!resolved) throw new Error(`CONTRACT_UNRESOLVED_REF: Unresolved OpenAPI $ref: ${ref}`);
   return resolved;
 }
@@ -47951,11 +48196,11 @@ function normalizePath(path6) {
   return trimmed.split("/").map((segment, index) => index === 0 ? "" : safeDecodeSegment(segment)).join("/") || "/";
 }
 function pathItemServers(pathItem) {
-  return asArray2(pathItem.servers).map((entry) => asRecord3(entry)).map((entry) => typeof entry?.url === "string" ? entry.url : "").filter(Boolean);
+  return asArray2(pathItem.servers).map((entry) => asRecord4(entry)).map((entry) => typeof entry?.url === "string" ? entry.url : "").filter(Boolean);
 }
 function operationServers(root, pathItem, operation) {
   const rawServers = asArray2(operation.servers).length > 0 ? asArray2(operation.servers) : pathItemServers(pathItem).length > 0 ? asArray2(pathItem.servers) : asArray2(root.servers);
-  const values = rawServers.map((entry) => asRecord3(entry)).map((entry) => typeof entry?.url === "string" ? entry.url : "").filter(Boolean);
+  const values = rawServers.map((entry) => asRecord4(entry)).map((entry) => typeof entry?.url === "string" ? entry.url : "").filter(Boolean);
   return values.length > 0 ? values : [""];
 }
 function serverPathPrefix(url) {
@@ -47976,10 +48221,10 @@ function normalizeResponseKey(status) {
   return /^[1-5]xx$/i.test(raw) ? raw.toUpperCase() : raw;
 }
 function collectSecurityApiKeys(root, operation) {
-  const securitySchemes = asRecord3(asRecord3(root.components)?.securitySchemes);
+  const securitySchemes = asRecord4(asRecord4(root.components)?.securitySchemes);
   const requirements = operation.security === void 0 ? asArray2(root.security) : asArray2(operation.security);
   const names = /* @__PURE__ */ new Set();
-  for (const requirement of requirements.map((entry) => asRecord3(entry)).filter(Boolean)) {
+  for (const requirement of requirements.map((entry) => asRecord4(entry)).filter(Boolean)) {
     for (const schemeName of Object.keys(requirement)) {
       const scheme = resolveInternalRef(root, securitySchemes?.[schemeName]);
       if (scheme?.type === "apiKey" && typeof scheme.name === "string" && ["query", "header"].includes(String(scheme.in))) {
@@ -47997,10 +48242,10 @@ function securitySchemeKind(scheme) {
   return type2;
 }
 function collectSecuritySchemeWarnings(root, operation) {
-  const securitySchemes = asRecord3(asRecord3(root.components)?.securitySchemes);
+  const securitySchemes = asRecord4(asRecord4(root.components)?.securitySchemes);
   const requirements = operation.security === void 0 ? asArray2(root.security) : asArray2(operation.security);
   const warnings = /* @__PURE__ */ new Set();
-  for (const requirement of requirements.map((entry) => asRecord3(entry)).filter(Boolean)) {
+  for (const requirement of requirements.map((entry) => asRecord4(entry)).filter(Boolean)) {
     for (const schemeName of Object.keys(requirement)) {
       const scheme = resolveInternalRef(root, securitySchemes?.[schemeName]);
       warnings.add(
@@ -48036,24 +48281,24 @@ function collectParameters(root, pathItem, operation) {
 function collectRequestBody(root, operation) {
   const body = resolveInternalRef(root, operation.requestBody);
   if (!body || body.required !== true) return void 0;
-  const content = asRecord3(body.content);
+  const content = asRecord4(body.content);
   return {
     required: true,
     contentTypes: content ? Object.keys(content) : []
   };
 }
 function responseContent(root, version, response) {
-  const content = asRecord3(response.content);
+  const content = asRecord4(response.content);
   if (!content) return {};
   const media = {};
   for (const [contentType, mediaObject] of Object.entries(content)) {
-    const schema2 = asRecord3(mediaObject)?.schema;
+    const schema2 = asRecord4(mediaObject)?.schema;
     media[contentType] = schema2 === void 0 ? {} : packSchema(root, schema2, version);
   }
   return media;
 }
 function responseHeaders(root, version, response) {
-  const headers = asRecord3(response.headers);
+  const headers = asRecord4(response.headers);
   if (!headers) return [];
   return Object.entries(headers).map(([name, rawHeader]) => {
     const header = resolveInternalRef(root, rawHeader);
@@ -48068,10 +48313,10 @@ function buildContractIndex(root) {
   if (root.swagger === "2.0") throw new Error("CONTRACT_UNSUPPORTED_OPENAPI_VERSION: Dynamic contract tests require OpenAPI 3.0 or 3.1 (found swagger 2.0)");
   if (!("openapi" in root)) throw new Error("CONTRACT_UNSUPPORTED_OPENAPI_VERSION: Dynamic contract tests require OpenAPI 3.0 or 3.1 (missing openapi)");
   const version = detectOpenApiVersion(root);
-  const paths = asRecord3(root.paths);
+  const paths = asRecord4(root.paths);
   const operations = [];
   const warnings = [];
-  if (asRecord3(root.webhooks)) warnings.push("CONTRACT_WEBHOOKS_NOT_VALIDATED: OpenAPI webhooks are not validated by dynamic contract tests");
+  if (asRecord4(root.webhooks)) warnings.push("CONTRACT_WEBHOOKS_NOT_VALIDATED: OpenAPI webhooks are not validated by dynamic contract tests");
   if (paths) {
     for (const [path6, rawPathItem] of Object.entries(paths)) {
       const pathItem = resolveInternalRef(root, rawPathItem);
@@ -48082,7 +48327,7 @@ function buildContractIndex(root) {
         const operation = resolveInternalRef(root, rawOperation);
         if (!operation) continue;
         if (operation.callbacks) warnings.push(`CONTRACT_CALLBACKS_NOT_VALIDATED: callbacks are not validated for ${lowerMethod.toUpperCase()} ${path6}`);
-        const responses = asRecord3(operation.responses);
+        const responses = asRecord4(operation.responses);
         if (!responses || Object.keys(responses).length === 0) {
           throw new Error(`CONTRACT_OPERATION_NO_RESPONSES: ${lowerMethod.toUpperCase()} ${path6} must define at least one response`);
         }
@@ -48172,7 +48417,7 @@ var CONTRACT_SIZE_LIMITS = {
   maxTestScriptBytes: 9e5,
   maxCollectionUpdateBytes: 4e6
 };
-function asRecord4(value) {
+function asRecord5(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return null;
   return value;
 }
@@ -48181,7 +48426,7 @@ function asArray3(value) {
 }
 function stringifyPathSegment(segment) {
   if (typeof segment === "string") return segment;
-  const record = asRecord4(segment);
+  const record = asRecord5(segment);
   if (!record) return String(segment ?? "");
   for (const key of ["value", "key", "name"]) {
     if (typeof record[key] === "string" && record[key]) return String(record[key]);
@@ -48199,10 +48444,10 @@ function pathFromRaw(raw) {
   }
 }
 function requestPath(request) {
-  const record = asRecord4(request);
+  const record = asRecord5(request);
   const url = record?.url ?? request;
   if (typeof url === "string") return pathFromRaw(url);
-  const urlRecord = asRecord4(url);
+  const urlRecord = asRecord5(url);
   if (!urlRecord) return "/";
   if (Array.isArray(urlRecord.path)) return normalizePath(`/${urlRecord.path.map(stringifyPathSegment).filter(Boolean).join("/")}`);
   if (typeof urlRecord.path === "string") return normalizePath(urlRecord.path);
@@ -48234,7 +48479,7 @@ function matchCandidate(candidate, request) {
   return { matched: true, staticCount, templateCount };
 }
 function matchOperation(index, request) {
-  const record = asRecord4(request);
+  const record = asRecord5(request);
   const method = String(record?.method || "").toUpperCase();
   const path6 = requestPath(request);
   const candidates = index.operations.filter((operation) => operation.method === method).flatMap((operation) => operation.candidates.map((candidate) => ({ operation, score: matchCandidate(candidate, path6), serverFull: candidate !== normalizePath(operation.path) }))).filter((entry) => entry.score.matched).map((entry) => ({ operation: entry.operation, score: [entry.score.staticCount, entry.serverFull ? 2 : 1, -entry.score.templateCount] })).sort((a, b) => {
@@ -48385,17 +48630,17 @@ function createSecretsResolverItem() {
 }
 function isResolverItem(item) {
   if (item.name !== "00 - Resolve Secrets") return false;
-  const request = asRecord4(item.request);
+  const request = asRecord5(item.request);
   if (String(request?.method || "").toUpperCase() !== "POST") return false;
-  const headers = asArray3(request?.header).map((entry) => asRecord4(entry));
+  const headers = asArray3(request?.header).map((entry) => asRecord5(entry));
   const target = headers.find((entry) => entry?.key === "X-Amz-Target");
   return String(target?.value || "") === "secretsmanager.GetSecretValue" && !requestPath(request).includes("secretsmanager");
 }
 function requestQueryNames(request) {
-  const url = asRecord4(request.url);
+  const url = asRecord5(request.url);
   const names = /* @__PURE__ */ new Set();
   if (Array.isArray(url?.query)) {
-    for (const entry of url.query.map((item) => asRecord4(item)).filter(Boolean)) {
+    for (const entry of url.query.map((item) => asRecord5(item)).filter(Boolean)) {
       if (entry.disabled !== true && typeof entry.key === "string") names.add(entry.key.toLowerCase());
     }
   }
@@ -48410,17 +48655,17 @@ function requestQueryNames(request) {
 }
 function requestHeaderNames(request) {
   const names = /* @__PURE__ */ new Set();
-  for (const entry of asArray3(request.header).map((item) => asRecord4(item)).filter(Boolean)) {
+  for (const entry of asArray3(request.header).map((item) => asRecord5(item)).filter(Boolean)) {
     if (entry.disabled !== true && typeof entry.key === "string") names.add(entry.key.toLowerCase());
   }
   return names;
 }
 function requestHeaderValue(request, name) {
-  const match = asArray3(request.header).map((item) => asRecord4(item)).filter(Boolean).find((entry) => String(entry.key || "").toLowerCase() === name.toLowerCase() && entry.disabled !== true);
+  const match = asArray3(request.header).map((item) => asRecord5(item)).filter(Boolean).find((entry) => String(entry.key || "").toLowerCase() === name.toLowerCase() && entry.disabled !== true);
   return typeof match?.value === "string" ? match.value : void 0;
 }
 function hasRequestBody(request) {
-  const body = asRecord4(request.body);
+  const body = asRecord5(request.body);
   if (!body) return false;
   if (typeof body.raw === "string" && body.raw.trim()) return true;
   return ["urlencoded", "formdata", "graphql"].some((key) => Array.isArray(body[key]) ? body[key].length > 0 : Boolean(body[key]));
@@ -48471,21 +48716,21 @@ function validateScript(script) {
   return void 0;
 }
 function scriptExecLines(script) {
-  const record = asRecord4(script);
+  const record = asRecord5(script);
   if (!record) return [];
   if (Array.isArray(record.exec)) return record.exec.map((line) => String(line));
   if (typeof record.exec === "string") return [record.exec];
   return [];
 }
 function scanExecutableScripts(node, warnings) {
-  for (const event of asArray3(node.event).map((entry) => asRecord4(entry)).filter(Boolean)) {
+  for (const event of asArray3(node.event).map((entry) => asRecord5(entry)).filter(Boolean)) {
     const lines = scriptExecLines(event.script);
     if (lines.length === 0) continue;
     const warning = validateScript(lines);
     if (warning) warnings.push(warning);
   }
   for (const child of asArray3(node.item)) {
-    const childRecord = asRecord4(child);
+    const childRecord = asRecord5(child);
     if (childRecord) scanExecutableScripts(childRecord, warnings);
   }
 }
@@ -48495,7 +48740,7 @@ function instrumentContractCollection(collection, index) {
   const inject = (item) => {
     if (isResolverItem(item)) return;
     if (item.request) {
-      const request = asRecord4(item.request) ?? {};
+      const request = asRecord5(item.request) ?? {};
       const result = matchOperation(index, request);
       let script;
       if (result.operation) {
@@ -48509,15 +48754,15 @@ function instrumentContractCollection(collection, index) {
       } else {
         script = createMappingFailureScript(`No OpenAPI operation matched request ${result.method} ${result.path}`);
       }
-      const events = asArray3(item.event).filter((entry) => asRecord4(entry)?.listen !== "test");
+      const events = asArray3(item.event).filter((entry) => asRecord5(entry)?.listen !== "test");
       item.event = [...events, { listen: "test", script: { type: "text/javascript", exec: script } }];
     }
     for (const child of asArray3(item.item)) {
-      const childRecord = asRecord4(child);
+      const childRecord = asRecord5(child);
       if (childRecord) inject(childRecord);
     }
   };
-  const items = asArray3(collection.item).map((entry) => asRecord4(entry)).filter((entry) => Boolean(entry)).filter((entry) => !isResolverItem(entry));
+  const items = asArray3(collection.item).map((entry) => asRecord5(entry)).filter((entry) => Boolean(entry)).filter((entry) => !isResolverItem(entry));
   collection.item = items;
   for (const item of items) inject(item);
   const missing = index.operations.filter((operation) => !covered.has(operation.id));
@@ -60881,7 +61126,7 @@ function compileErrors(result) {
 
 // src/lib/spec/openapi-loader.ts
 var import_yaml2 = __toESM(require_dist(), 1);
-function asRecord5(value) {
+function asRecord6(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return null;
   return value;
 }
@@ -60896,7 +61141,7 @@ function parseOpenApiDocument(content) {
       throw new Error("CONTRACT_SPEC_PARSE_FAILED: Spec content is not valid JSON or YAML");
     }
   }
-  const doc = asRecord5(parsed);
+  const doc = asRecord6(parsed);
   if (!doc) throw new Error("CONTRACT_SPEC_PARSE_FAILED: Spec content must be a JSON or YAML object");
   return doc;
 }
@@ -60924,7 +61169,7 @@ function collectExternalRefs(node, baseUrl, refs) {
     node.forEach((entry) => collectExternalRefs(entry, baseUrl, refs));
     return;
   }
-  const record = asRecord5(node);
+  const record = asRecord6(node);
   if (!record) return;
   const ref = typeof record.$ref === "string" ? record.$ref : "";
   if (ref && !ref.startsWith("#")) {
@@ -62707,6 +62952,17 @@ async function runCli(argv = process.argv.slice(2), runtime = {}) {
   assertOutputFileAllowed2(config.resultJsonPath);
   assertOutputFileAllowed2(config.dotenvPath);
   const dependencies = createCliDependencies(inputs);
+  await runCredentialPreflight({
+    apiBaseUrl: inputs.postmanApiBase,
+    iapubBaseUrl: inputs.postmanIapubBase,
+    postmanApiKey: inputs.postmanApiKey,
+    postmanAccessToken: inputs.postmanAccessToken,
+    workspaceTeamId: inputs.workspaceTeamId,
+    explicitTeamId: inputs.teamId || void 0,
+    mode: inputs.credentialPreflight,
+    mask: createSecretMasker([inputs.postmanApiKey, inputs.postmanAccessToken]),
+    log: dependencies.core
+  });
   if ((inputs.domain || inputs.governanceGroup) && !dependencies.internalIntegration) {
     dependencies.core.warning(
       "Skipping governance assignment because postman-access-token is not configured"

package/dist/index.cjs

@@ -47937,20 +47937,22 @@ async function probeSessionIdentity(baseUrl, accessToken, fetchImpl) {
     if (!payload) {
       return void 0;
     }
-    const identity = asRecord(payload.identity);
-    const data = asRecord(payload.data);
+    const root = asRecord(payload.session) ?? payload;
+    const identity = asRecord(root.identity);
+    const data = asRecord(root.data);
     const user = asRecord(data?.user);
     const roleEntries = Array.isArray(user?.roles) ? user.roles.map((entry) => coerceText(entry) ?? coerceId(entry)).filter((entry) => Boolean(entry)) : [];
     const singleRole = coerceText(user?.role);
     const roles = roleEntries.length > 0 ? roleEntries : singleRole ? [singleRole] : void 0;
     const resolved = {
       source: "iapub/sessions",
-      userId: coerceId(user?.id),
+      userId: coerceId(identity?.user) ?? coerceId(user?.id),
       fullName: coerceText(user?.fullName) ?? coerceText(user?.name) ?? coerceText(user?.username),
       teamId: coerceId(identity?.team),
+      teamName: coerceText(user?.teamName),
       teamDomain: coerceText(identity?.domain),
       ...roles ? { roles } : {},
-      consumerType: coerceText(payload.consumerType) ?? coerceText(data?.consumerType) ?? coerceText(user?.consumerType)
+      consumerType: coerceText(root.consumerType) ?? coerceText(data?.consumerType) ?? coerceText(user?.consumerType)
     };
     memoizedSessionIdentity = resolved;
     return resolved;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@postman-cse/onboarding-bootstrap",
-  "version": "0.15.0",
+  "version": "0.15.3",
   "description": "Public customer preview Postman bootstrap GitHub Action.",
   "type": "module",
   "main": "dist/index.cjs",