@postman-cse/onboarding-bootstrap 2.8.0 → 2.9.0

package/dist/action.cjs

@@ -264612,6 +264612,53 @@ var AccessTokenProvider = class {
     return token;
   }
 };
+async function describeMintFailure(mintError, apiKey, apiBaseUrl, fetchImpl) {
+  const raw = mintError instanceof Error ? mintError.message : String(mintError);
+  const rejected = /HTTP 40[13]|PMAK rejected/.test(raw);
+  if (!rejected) {
+    return raw;
+  }
+  try {
+    const me = await fetchImpl(`${apiBaseUrl}/me`, { headers: { "x-api-key": apiKey } });
+    if (me.ok) {
+      const body2 = await me.json().catch(() => void 0);
+      const user = body2?.user;
+      const looksPersonal = Boolean(user && (user.username || user.email));
+      if (looksPersonal) {
+        return "Personal API key detected, cannot mint a service-account access token. POST /service-account-tokens only accepts a SERVICE-ACCOUNT API key; this postman-api-key belongs to a user account" + (user?.teamId ? ` (team ${user.teamId})` : "") + ". Create a service account in Team Settings and use its PMAK, or mint the token elsewhere and pass postman-access-token.";
+      }
+      return "The postman-api-key authenticates (GET /me OK) but was rejected by POST /service-account-tokens" + (user?.teamId ? ` (team ${user.teamId})` : "") + ". The service account likely lacks permission to mint access tokens, or service accounts are restricted for this team. Check the service account role in Team Settings, or pass a pre-minted postman-access-token.";
+    }
+    return "The postman-api-key is invalid, disabled, or expired (rejected by both POST /service-account-tokens and GET /me). Generate a fresh service-account PMAK in Team Settings and update the secret.";
+  } catch {
+    return raw;
+  }
+}
+async function mintAccessTokenIfNeeded(inputs, log, setSecret2, fetchImpl = fetch) {
+  if (inputs.postmanAccessToken || !inputs.postmanApiKey) {
+    return;
+  }
+  const apiBaseUrl = String(
+    inputs.postmanApiBase || POSTMAN_ENDPOINT_PROFILES.prod.apiBaseUrl
+  ).replace(/\/+$/, "");
+  const provider = new AccessTokenProvider({
+    apiKey: inputs.postmanApiKey,
+    apiBaseUrl,
+    fetchImpl,
+    onToken: (token) => setSecret2?.(token)
+  });
+  try {
+    inputs.postmanAccessToken = await provider.refresh();
+    log.info(
+      "postman: no postman-access-token configured - minted a short-lived service-account access token from the postman-api-key."
+    );
+  } catch (error2) {
+    const diagnosis = await describeMintFailure(error2, inputs.postmanApiKey, apiBaseUrl, fetchImpl);
+    log.warning(
+      "postman: could not mint an access token from the postman-api-key. " + diagnosis + " Continuing without an access token - access-token-only functionality will be unavailable unless postman-access-token is provided."
+    );
+  }
+}
 
 // src/lib/postman/workspace-selection.ts
 function chooseCanonicalWorkspace(args) {
@@ -307782,29 +307829,8 @@ function warnIfDeprecatedAccessToken(actionCore, inputs) {
     )
   );
 }
-async function mintAccessTokenIfNeeded(inputs, log, setSecret2) {
-  if (inputs.postmanAccessToken || !inputs.postmanApiKey) {
-    return;
-  }
-  const provider = new AccessTokenProvider({
-    apiKey: inputs.postmanApiKey,
-    apiBaseUrl: inputs.postmanApiBase,
-    onToken: (token) => setSecret2?.(token)
-  });
-  try {
-    inputs.postmanAccessToken = await provider.refresh();
-    log.info(
-      "postman: no postman-access-token configured - minted a short-lived service-account access token from the postman-api-key."
-    );
-  } catch (error2) {
-    const mask = createSecretMasker([inputs.postmanApiKey]);
-    const message = error2 instanceof Error ? error2.message : String(error2);
-    log.warning(
-      mask(
-        "postman: could not mint an access token from the postman-api-key (" + message + "). Continuing with PMAK only - governance assignment and org-mode detection are disabled. Configure postman-access-token (postman-cs/postman-resolve-service-token-action) for full functionality."
-      )
-    );
-  }
+async function mintAccessTokenIfNeeded2(inputs, log, setSecret2) {
+  await mintAccessTokenIfNeeded(inputs, log, setSecret2);
 }
 function isLegacyAccessTokenDeprecationWarning(message) {
   return message.includes("Postman CLI credential store populated by `postman login` is a legacy fallback");
@@ -309092,7 +309118,7 @@ async function runBootstrapInner(inputs, dependencies, telemetry) {
 }
 async function runAction(actionCore = core_exports, actionExec = exec_exports, actionIo = io_exports) {
   const inputs = readActionInputs(actionCore);
-  await mintAccessTokenIfNeeded(inputs, {
+  await mintAccessTokenIfNeeded2(inputs, {
     info: (message) => actionCore.info(message),
     warning: (message) => actionCore.warning(message)
   }, (secret) => actionCore.setSecret(secret));

package/dist/cli.cjs

@@ -262930,6 +262930,53 @@ var AccessTokenProvider = class {
     return token;
   }
 };
+async function describeMintFailure(mintError, apiKey, apiBaseUrl, fetchImpl) {
+  const raw = mintError instanceof Error ? mintError.message : String(mintError);
+  const rejected = /HTTP 40[13]|PMAK rejected/.test(raw);
+  if (!rejected) {
+    return raw;
+  }
+  try {
+    const me = await fetchImpl(`${apiBaseUrl}/me`, { headers: { "x-api-key": apiKey } });
+    if (me.ok) {
+      const body2 = await me.json().catch(() => void 0);
+      const user = body2?.user;
+      const looksPersonal = Boolean(user && (user.username || user.email));
+      if (looksPersonal) {
+        return "Personal API key detected, cannot mint a service-account access token. POST /service-account-tokens only accepts a SERVICE-ACCOUNT API key; this postman-api-key belongs to a user account" + (user?.teamId ? ` (team ${user.teamId})` : "") + ". Create a service account in Team Settings and use its PMAK, or mint the token elsewhere and pass postman-access-token.";
+      }
+      return "The postman-api-key authenticates (GET /me OK) but was rejected by POST /service-account-tokens" + (user?.teamId ? ` (team ${user.teamId})` : "") + ". The service account likely lacks permission to mint access tokens, or service accounts are restricted for this team. Check the service account role in Team Settings, or pass a pre-minted postman-access-token.";
+    }
+    return "The postman-api-key is invalid, disabled, or expired (rejected by both POST /service-account-tokens and GET /me). Generate a fresh service-account PMAK in Team Settings and update the secret.";
+  } catch {
+    return raw;
+  }
+}
+async function mintAccessTokenIfNeeded(inputs, log, setSecret2, fetchImpl = fetch) {
+  if (inputs.postmanAccessToken || !inputs.postmanApiKey) {
+    return;
+  }
+  const apiBaseUrl = String(
+    inputs.postmanApiBase || POSTMAN_ENDPOINT_PROFILES.prod.apiBaseUrl
+  ).replace(/\/+$/, "");
+  const provider = new AccessTokenProvider({
+    apiKey: inputs.postmanApiKey,
+    apiBaseUrl,
+    fetchImpl,
+    onToken: (token) => setSecret2?.(token)
+  });
+  try {
+    inputs.postmanAccessToken = await provider.refresh();
+    log.info(
+      "postman: no postman-access-token configured - minted a short-lived service-account access token from the postman-api-key."
+    );
+  } catch (error) {
+    const diagnosis = await describeMintFailure(error, inputs.postmanApiKey, apiBaseUrl, fetchImpl);
+    log.warning(
+      "postman: could not mint an access token from the postman-api-key. " + diagnosis + " Continuing without an access token - access-token-only functionality will be unavailable unless postman-access-token is provided."
+    );
+  }
+}
 
 // src/lib/postman/workspace-selection.ts
 function chooseCanonicalWorkspace(args) {
@@ -306078,29 +306125,8 @@ function createPlannedOutputs(inputs) {
     })
   };
 }
-async function mintAccessTokenIfNeeded(inputs, log, setSecret2) {
-  if (inputs.postmanAccessToken || !inputs.postmanApiKey) {
-    return;
-  }
-  const provider = new AccessTokenProvider({
-    apiKey: inputs.postmanApiKey,
-    apiBaseUrl: inputs.postmanApiBase,
-    onToken: (token) => setSecret2?.(token)
-  });
-  try {
-    inputs.postmanAccessToken = await provider.refresh();
-    log.info(
-      "postman: no postman-access-token configured - minted a short-lived service-account access token from the postman-api-key."
-    );
-  } catch (error) {
-    const mask = createSecretMasker([inputs.postmanApiKey]);
-    const message = error instanceof Error ? error.message : String(error);
-    log.warning(
-      mask(
-        "postman: could not mint an access token from the postman-api-key (" + message + "). Continuing with PMAK only - governance assignment and org-mode detection are disabled. Configure postman-access-token (postman-cs/postman-resolve-service-token-action) for full functionality."
-      )
-    );
-  }
+async function mintAccessTokenIfNeeded2(inputs, log, setSecret2) {
+  await mintAccessTokenIfNeeded(inputs, log, setSecret2);
 }
 function createWorkspaceName(inputs) {
   return inputs.domainCode ? `[${inputs.domainCode}] ${inputs.projectName}` : inputs.projectName;
@@ -307718,7 +307744,7 @@ async function runCli(argv = process.argv.slice(2), runtime = {}) {
   assertOutputFileAllowed2(config.resultJsonPath);
   assertOutputFileAllowed2(config.dotenvPath);
   const mintReporter = new ConsoleReporter();
-  await mintAccessTokenIfNeeded(inputs, mintReporter);
+  await mintAccessTokenIfNeeded2(inputs, mintReporter);
   const dependencies = createCliDependencies(inputs);
   await runCredentialPreflight({
     apiBaseUrl: inputs.postmanApiBase,

package/dist/index.cjs

@@ -253786,7 +253786,7 @@ __export(index_exports, {
   ensurePostmanCli: () => ensurePostmanCli,
   getInput: () => getInput2,
   lintSpecViaCli: () => lintSpecViaCli,
-  mintAccessTokenIfNeeded: () => mintAccessTokenIfNeeded,
+  mintAccessTokenIfNeeded: () => mintAccessTokenIfNeeded2,
   normalizeSpecDocument: () => normalizeSpecDocument,
   readActionInputs: () => readActionInputs,
   resolveInputs: () => resolveInputs,
@@ -264630,6 +264630,53 @@ var AccessTokenProvider = class {
     return token;
   }
 };
+async function describeMintFailure(mintError, apiKey, apiBaseUrl, fetchImpl) {
+  const raw = mintError instanceof Error ? mintError.message : String(mintError);
+  const rejected = /HTTP 40[13]|PMAK rejected/.test(raw);
+  if (!rejected) {
+    return raw;
+  }
+  try {
+    const me = await fetchImpl(`${apiBaseUrl}/me`, { headers: { "x-api-key": apiKey } });
+    if (me.ok) {
+      const body2 = await me.json().catch(() => void 0);
+      const user = body2?.user;
+      const looksPersonal = Boolean(user && (user.username || user.email));
+      if (looksPersonal) {
+        return "Personal API key detected, cannot mint a service-account access token. POST /service-account-tokens only accepts a SERVICE-ACCOUNT API key; this postman-api-key belongs to a user account" + (user?.teamId ? ` (team ${user.teamId})` : "") + ". Create a service account in Team Settings and use its PMAK, or mint the token elsewhere and pass postman-access-token.";
+      }
+      return "The postman-api-key authenticates (GET /me OK) but was rejected by POST /service-account-tokens" + (user?.teamId ? ` (team ${user.teamId})` : "") + ". The service account likely lacks permission to mint access tokens, or service accounts are restricted for this team. Check the service account role in Team Settings, or pass a pre-minted postman-access-token.";
+    }
+    return "The postman-api-key is invalid, disabled, or expired (rejected by both POST /service-account-tokens and GET /me). Generate a fresh service-account PMAK in Team Settings and update the secret.";
+  } catch {
+    return raw;
+  }
+}
+async function mintAccessTokenIfNeeded(inputs, log, setSecret2, fetchImpl = fetch) {
+  if (inputs.postmanAccessToken || !inputs.postmanApiKey) {
+    return;
+  }
+  const apiBaseUrl = String(
+    inputs.postmanApiBase || POSTMAN_ENDPOINT_PROFILES.prod.apiBaseUrl
+  ).replace(/\/+$/, "");
+  const provider = new AccessTokenProvider({
+    apiKey: inputs.postmanApiKey,
+    apiBaseUrl,
+    fetchImpl,
+    onToken: (token) => setSecret2?.(token)
+  });
+  try {
+    inputs.postmanAccessToken = await provider.refresh();
+    log.info(
+      "postman: no postman-access-token configured - minted a short-lived service-account access token from the postman-api-key."
+    );
+  } catch (error2) {
+    const diagnosis = await describeMintFailure(error2, inputs.postmanApiKey, apiBaseUrl, fetchImpl);
+    log.warning(
+      "postman: could not mint an access token from the postman-api-key. " + diagnosis + " Continuing without an access token - access-token-only functionality will be unavailable unless postman-access-token is provided."
+    );
+  }
+}
 
 // src/lib/postman/workspace-selection.ts
 function chooseCanonicalWorkspace(args) {
@@ -307800,29 +307847,8 @@ function warnIfDeprecatedAccessToken(actionCore, inputs) {
     )
   );
 }
-async function mintAccessTokenIfNeeded(inputs, log, setSecret2) {
-  if (inputs.postmanAccessToken || !inputs.postmanApiKey) {
-    return;
-  }
-  const provider = new AccessTokenProvider({
-    apiKey: inputs.postmanApiKey,
-    apiBaseUrl: inputs.postmanApiBase,
-    onToken: (token) => setSecret2?.(token)
-  });
-  try {
-    inputs.postmanAccessToken = await provider.refresh();
-    log.info(
-      "postman: no postman-access-token configured - minted a short-lived service-account access token from the postman-api-key."
-    );
-  } catch (error2) {
-    const mask = createSecretMasker([inputs.postmanApiKey]);
-    const message = error2 instanceof Error ? error2.message : String(error2);
-    log.warning(
-      mask(
-        "postman: could not mint an access token from the postman-api-key (" + message + "). Continuing with PMAK only - governance assignment and org-mode detection are disabled. Configure postman-access-token (postman-cs/postman-resolve-service-token-action) for full functionality."
-      )
-    );
-  }
+async function mintAccessTokenIfNeeded2(inputs, log, setSecret2) {
+  await mintAccessTokenIfNeeded(inputs, log, setSecret2);
 }
 function isLegacyAccessTokenDeprecationWarning(message) {
   return message.includes("Postman CLI credential store populated by `postman login` is a legacy fallback");
@@ -309110,7 +309136,7 @@ async function runBootstrapInner(inputs, dependencies, telemetry) {
 }
 async function runAction(actionCore = core_exports, actionExec = exec_exports, actionIo = io_exports) {
   const inputs = readActionInputs(actionCore);
-  await mintAccessTokenIfNeeded(inputs, {
+  await mintAccessTokenIfNeeded2(inputs, {
     info: (message) => actionCore.info(message),
     warning: (message) => actionCore.warning(message)
   }, (secret) => actionCore.setSecret(secret));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@postman-cse/onboarding-bootstrap",
-  "version": "2.8.0",
+  "version": "2.9.0",
   "description": "Bootstrap Postman workspaces, specs, and collections from OpenAPI.",
   "type": "module",
   "main": "dist/index.cjs",