@postman-cse/onboarding-insights 0.7.2 → 0.9.0

package/README.md

@@ -122,7 +122,7 @@ Output is JSON to stdout. Use `--result-json` to write the same payload to a fil
 
 ```yaml
 onboarding:
-  image: node:20
+  image: node:24
   script:
     - npm install -g postman-insights-onboarding-action
     - postman-insights-onboard --project-name af-cards-activation --workspace-id "$WORKSPACE_ID" --environment-id "$ENVIRONMENT_ID" --postman-access-token "$POSTMAN_ACCESS_TOKEN" --postman-api-key "$POSTMAN_API_KEY" --cluster-name "$CLUSTER_NAME" --repo-url "$CI_PROJECT_URL" --poll-timeout-seconds 180 --result-json insights-result.json --dotenv-path insights.env
@@ -131,7 +131,7 @@ onboarding:
 ### Bitbucket Pipelines
 
 ```yaml
-image: node:20
+image: node:24
 
 pipelines:
   default:
@@ -166,8 +166,7 @@ steps:
 | `environment-id` | Yes | | Postman environment UID for the onboarding association. |
 | `system-environment-id` | No | | Postman system environment UUID for service-level Insights acknowledgment. Falls back to the value from the discovered service record. |
 | `cluster-name` | No | | Insights cluster name. When set, the action matches `{cluster-name}/{project-name}` exactly. When omitted, falls back to suffix matching. |
-| `git-owner` | No | `$GITHUB_REPOSITORY_OWNER` | GitHub organization or user for the repository URL. |
-| `git-repository-name` | No | `project-name` | GitHub repository name. Defaults to the project name. |
+| `repo-url` | No | Auto-detected from CI when available | Repository URL used for Git onboarding. |
 | `postman-access-token` | Yes | | Postman session token for Bifrost API calls. See [Obtaining postman-access-token](#obtaining-postman-access-token-open-alpha). |
 | `postman-team-id` | No | | Explicit Postman team ID for org-mode Bifrost requests. When omitted, the action leaves `x-entity-team-id` unset so Bifrost resolves team context from the access token. |
 | `github-token` | No | ambient `GITHUB_TOKEN` env when exported by the workflow | Optional GitHub token passed as `git_api_key` only when repository auth is required by the onboarding endpoint. |
@@ -238,6 +237,17 @@ The action calls the following API endpoints in order:
 7. **Workspace acknowledge** -- `POST /v2/workspaces/{id}/onboarding/acknowledge` (Bifrost akita) to activate the Insights project.
 8. **Team verification token** -- `GET /v2/workspaces/{id}/team-verification-token` (Bifrost akita) to retrieve the DaemonSet telemetry token.
 
+## Contract smoke monitoring
+
+This repo includes `.github/workflows/contract-smoke.yml`, a scheduled live contract check for the upstream APIs used by Insights onboarding.
+
+Configure these repository secrets before enabling the workflow:
+
+- `SMOKE_ORG_API_KEY`
+- `SMOKE_ORG_ACCESS_TOKEN`
+
+The smoke workflow verifies `/me`, `/teams`, `iapub.postman.co/api/sessions/current`, and Bifrost API key creation so auth or payload drift shows up in CI before it hits production onboarding runs.
+
 ## Local development
 
 ```bash

package/action.yml

@@ -16,11 +16,8 @@ inputs:
   cluster-name:
     description: 'Insights cluster name. Matches {cluster}/{project-name} in discovered services'
     required: false
-  git-owner:
-    description: 'GitHub organization or user that owns the repository'
-    required: false
-  git-repository-name:
-    description: 'GitHub repository name. Defaults to project-name'
+  repo-url:
+    description: 'Repository URL for Git onboarding. Auto-detected from CI context when omitted.'
     required: false
   postman-access-token:
     description: 'Postman access token for Bifrost API calls'
@@ -42,6 +39,10 @@ inputs:
     description: 'Seconds between discovery polling attempts'
     required: false
     default: '10'
+  postman-stack:
+    description: 'Postman stack profile.'
+    required: false
+    default: 'prod'
 outputs:
   discovered-service-id:
     description: 'Numeric ID from the API Catalog discovered-services list'
@@ -56,5 +57,5 @@ outputs:
   status:
     description: 'Onboarding result: success, not-found, or error'
 runs:
-  using: 'node20'
+  using: 'node24'
   main: 'dist/index.cjs'

package/dist/cli.cjs

@@ -27347,9 +27347,6 @@ function redactSecrets(input, secretValues, replacement = REDACTED) {
     return sanitized.split(secret).join(replacement);
   }, source);
 }
-function createSecretMasker(secretValues, replacement = REDACTED) {
-  return (input) => redactSecrets(input, secretValues, replacement);
-}
 function headerEntries(headers) {
   if (headers instanceof Headers) {
     return Array.from(headers.entries());
@@ -27476,20 +27473,58 @@ async function retry(operation, options = {}) {
   throw new Error("Retry exhausted without returning or throwing");
 }
 
+// src/lib/postman/base-urls.ts
+var POSTMAN_ENDPOINT_PROFILES = {
+  prod: {
+    apiBaseUrl: "https://api.getpostman.com",
+    bifrostBaseUrl: "https://bifrost-premium-https-v4.gw.postman.com",
+    observabilityBaseUrl: "https://api.observability.postman.com",
+    observabilityEnv: "production"
+  },
+  beta: {
+    apiBaseUrl: "https://api.getpostman-beta.com",
+    bifrostBaseUrl: "https://bifrost-https-v4.gw.postman-beta.com",
+    observabilityBaseUrl: "https://api.observability.postman-beta.com",
+    observabilityEnv: "beta"
+  }
+};
+function parsePostmanStack(value) {
+  const normalized = String(value || "prod").trim().toLowerCase();
+  if (normalized === "prod" || normalized === "beta") {
+    return normalized;
+  }
+  throw new Error(`Unsupported postman-stack "${value}". Supported values: prod, beta`);
+}
+function resolvePostmanEndpointProfile(stack) {
+  return POSTMAN_ENDPOINT_PROFILES[stack];
+}
+
 // src/lib/bifrost-client.ts
-var BIFROST_BASE = "https://bifrost-premium-https-v4.gw.postman.com/ws/proxy";
+var DEFAULT_BIFROST_BASE_URL = POSTMAN_ENDPOINT_PROFILES.prod.bifrostBaseUrl;
+var BIFROST_PROXY_PATH = "/ws/proxy";
+var DEFAULT_OBSERVABILITY_BASE_URL = POSTMAN_ENDPOINT_PROFILES.prod.observabilityBaseUrl;
+var DEFAULT_OBSERVABILITY_ENV = POSTMAN_ENDPOINT_PROFILES.prod.observabilityEnv;
+var MAX_DISCOVERED_SERVICE_PAGES = 100;
+var MAX_PROVIDER_SERVICE_PAGES = 100;
 var BifrostCatalogClient = class {
   accessToken;
   teamId;
   apiKey;
   fetchFn;
   secretValues;
+  bifrostProxyUrl;
+  observabilityBaseUrl;
+  observabilityEnv;
   constructor(options) {
     this.accessToken = options.accessToken;
     this.teamId = options.teamId;
     this.apiKey = options.apiKey;
     this.fetchFn = options.fetchFn ?? globalThis.fetch;
     this.secretValues = [options.accessToken, options.apiKey].filter(Boolean);
+    const base = (options.bifrostBaseUrl || DEFAULT_BIFROST_BASE_URL).replace(/\/+$/, "");
+    this.bifrostProxyUrl = `${base}${BIFROST_PROXY_PATH}`;
+    this.observabilityBaseUrl = (options.observabilityBaseUrl || DEFAULT_OBSERVABILITY_BASE_URL).replace(/\/+$/, "");
+    this.observabilityEnv = options.observabilityEnv || DEFAULT_OBSERVABILITY_ENV;
   }
   setApiKey(apiKey) {
     this.apiKey = apiKey;
@@ -27513,7 +27548,7 @@ var BifrostCatalogClient = class {
     return h;
   }
   async proxyRequest(method, path7, body = {}) {
-    const response = await this.fetchFn(BIFROST_BASE, {
+    const response = await this.fetchFn(this.bifrostProxyUrl, {
       method: "POST",
       headers: this.headers(),
       body: JSON.stringify({
@@ -27538,7 +27573,7 @@ var BifrostCatalogClient = class {
     return data;
   }
   async akitaProxyRequest(method, path7, body = {}) {
-    const response = await this.fetchFn(BIFROST_BASE, {
+    const response = await this.fetchFn(this.bifrostProxyUrl, {
       method: "POST",
       headers: this.headers(),
       body: JSON.stringify({
@@ -27560,16 +27595,23 @@ var BifrostCatalogClient = class {
       async () => {
         const allItems = [];
         let cursor = null;
-        let hasMore = true;
-        while (hasMore) {
+        const seenCursors = /* @__PURE__ */ new Set();
+        for (let page = 0; page < MAX_DISCOVERED_SERVICE_PAGES; page += 1) {
           const cursorParam = cursor ? `&cursor=${encodeURIComponent(cursor)}` : "";
           const data = await this.proxyRequest(
             "GET",
             `/api/v1/onboarding/discovered-services?status=discovered${cursorParam}`
           );
           allItems.push(...data.items || []);
-          cursor = data.nextCursor || null;
-          hasMore = cursor !== null;
+          if (data.total && allItems.length >= data.total) {
+            break;
+          }
+          const nextCursor = data.nextCursor || null;
+          if (!nextCursor || seenCursors.has(nextCursor)) {
+            break;
+          }
+          seenCursors.add(nextCursor);
+          cursor = nextCursor;
         }
         return allItems;
       },
@@ -27616,8 +27658,7 @@ var BifrostCatalogClient = class {
     const allServices = [];
     let page = 1;
     const pageSize = 100;
-    let hasMore = true;
-    while (hasMore) {
+    for (let pageCount = 0; pageCount < MAX_PROVIDER_SERVICE_PAGES; pageCount += 1) {
       const result = await this.akitaProxyRequest(
         "GET",
         `/v2/api-catalog/services?status=discovered&populate_endpoints=false&populate_discovery_metadata=true&page=${page}&page_size=${pageSize}`
@@ -27625,7 +27666,12 @@ var BifrostCatalogClient = class {
       if (!result.ok || !result.data) return null;
       const services = result.data.services || [];
       allServices.push(...services);
-      hasMore = services.length >= pageSize;
+      if (result.data.total && allServices.length >= result.data.total) {
+        break;
+      }
+      if (services.length < pageSize) {
+        break;
+      }
       page++;
     }
     const fullName = clusterName ? `${clusterName}/${projectName}` : projectName;
@@ -27662,12 +27708,12 @@ var BifrostCatalogClient = class {
   }
   async createApplication(workspaceId, systemEnv) {
     const response = await this.fetchFn(
-      `https://api.observability.postman.com/v2/agent/api-catalog/workspaces/${workspaceId}/applications`,
+      `${this.observabilityBaseUrl}/v2/agent/api-catalog/workspaces/${workspaceId}/applications`,
       {
         method: "POST",
         headers: {
           "x-api-key": this.apiKey,
-          "x-postman-env": "production",
+          "x-postman-env": this.observabilityEnv,
           "Content-Type": "application/json"
         },
         body: JSON.stringify({ system_env: systemEnv })
@@ -27691,7 +27737,7 @@ var BifrostCatalogClient = class {
     return result.data.team_verification_token || null;
   }
   async createApiKey(name) {
-    const response = await this.fetchFn(BIFROST_BASE, {
+    const response = await this.fetchFn(this.bifrostProxyUrl, {
       method: "POST",
       headers: this.headers(),
       body: JSON.stringify({
@@ -27731,8 +27777,15 @@ var POLL_TIMEOUT_DEFAULT = 120;
 var POLL_INTERVAL_MIN = 2;
 var POLL_INTERVAL_MAX = 60;
 var POLL_INTERVAL_DEFAULT = 10;
-async function validateApiKey(apiKey) {
-  const res = await fetch("https://api.getpostman.com/me", {
+var PROD_ENDPOINTS = resolvePostmanEndpointProfile("prod");
+var DEFAULT_POSTMAN_API_BASE = PROD_ENDPOINTS.apiBaseUrl;
+var DEFAULT_POSTMAN_BIFROST_BASE = PROD_ENDPOINTS.bifrostBaseUrl;
+var DEFAULT_POSTMAN_OBSERVABILITY_BASE = PROD_ENDPOINTS.observabilityBaseUrl;
+function trimTrailingSlash(value) {
+  return value.replace(/\/+$/, "");
+}
+async function validateApiKey(apiKey, apiBase = DEFAULT_POSTMAN_API_BASE) {
+  const res = await fetch(`${trimTrailingSlash(apiBase)}/me`, {
     method: "GET",
     headers: { "x-api-key": apiKey }
   });
@@ -27746,6 +27799,23 @@ async function validateApiKey(apiKey) {
   const teamId = data?.user?.teamId ? String(data.user.teamId) : void 0;
   return { valid: true, teamId };
 }
+async function getTeams(apiKey, apiBase = DEFAULT_POSTMAN_API_BASE) {
+  try {
+    const res = await fetch(`${trimTrailingSlash(apiBase)}/teams`, {
+      method: "GET",
+      headers: { "x-api-key": apiKey }
+    });
+    if (!res.ok) return [];
+    const data = await res.json();
+    return (data?.data ?? []).filter((t) => t?.id && t?.name).map((t) => ({
+      id: Number(t.id),
+      name: String(t.name),
+      ...t.organizationId != null ? { organizationId: Number(t.organizationId) } : {}
+    }));
+  } catch {
+    return [];
+  }
+}
 function clamp(value, min, max, fallback) {
   const parsed = Number.isFinite(value) ? value : fallback;
   return Math.min(max, Math.max(min, parsed));
@@ -27758,33 +27828,42 @@ function resolveInputs(env = process.env) {
   if (!postmanAccessToken) throw new Error("postman-access-token is required");
   const postmanApiKey = get("postman-api-key");
   const postmanTeamId = get("postman-team-id") || env.POSTMAN_TEAM_ID?.trim() || "";
-  const workspaceId = get("workspace-id");
-  if (!workspaceId) throw new Error("workspace-id is required");
-  const environmentId = get("environment-id");
-  if (!environmentId) throw new Error("environment-id is required");
-  const repoSlug = env.GITHUB_REPOSITORY || env.CI_PROJECT_PATH || (env.BITBUCKET_WORKSPACE && env.BITBUCKET_REPO_SLUG ? `${env.BITBUCKET_WORKSPACE}/${env.BITBUCKET_REPO_SLUG}` : "") || env.BUILD_REPOSITORY_NAME || "";
-  const repoOwner = repoSlug.split("/")[0] || "";
-  const gitOwner = get("git-owner", repoOwner);
-  const gitRepositoryName = get("git-repository-name", projectName);
+  const workspaceId = get("workspace-id") || env.POSTMAN_WORKSPACE_ID?.trim() || "";
+  if (!workspaceId) {
+    throw new Error(
+      "workspace-id is required. Provide it as an input, or set the POSTMAN_WORKSPACE_ID environment variable."
+    );
+  }
+  const environmentId = get("environment-id") || env.POSTMAN_ENVIRONMENT_ID?.trim() || "";
+  if (!environmentId) {
+    throw new Error(
+      "environment-id is required. Provide it as an input, or set the POSTMAN_ENVIRONMENT_ID environment variable."
+    );
+  }
   const detectedRepoUrl = (env.GITHUB_SERVER_URL && env.GITHUB_REPOSITORY ? `${env.GITHUB_SERVER_URL}/${env.GITHUB_REPOSITORY}` : "") || env.CI_PROJECT_URL || env.BITBUCKET_GIT_HTTP_ORIGIN || env.BUILD_REPOSITORY_URI || "";
-  const repoUrl = get("repo-url", detectedRepoUrl || `https://github.com/${gitOwner}/${gitRepositoryName}`);
+  const repoUrl = get("repo-url", detectedRepoUrl);
   const rawTimeout = parseInt(get("poll-timeout-seconds", String(POLL_TIMEOUT_DEFAULT)), 10);
   const rawInterval = parseInt(get("poll-interval-seconds", String(POLL_INTERVAL_DEFAULT)), 10);
+  const postmanStack = parsePostmanStack(get("postman-stack"));
+  const endpointProfile = resolvePostmanEndpointProfile(postmanStack);
   return {
     projectName,
     workspaceId,
     environmentId,
     systemEnvironmentId: get("system-environment-id", ""),
     clusterName: get("cluster-name", ""),
-    gitOwner,
-    gitRepositoryName,
     repoUrl,
     postmanAccessToken,
     postmanApiKey,
     postmanTeamId,
     githubToken: get("github-token", env.GITHUB_TOKEN || ""),
     pollTimeoutSeconds: clamp(rawTimeout, POLL_TIMEOUT_MIN, POLL_TIMEOUT_MAX, POLL_TIMEOUT_DEFAULT),
-    pollIntervalSeconds: clamp(rawInterval, POLL_INTERVAL_MIN, POLL_INTERVAL_MAX, POLL_INTERVAL_DEFAULT)
+    pollIntervalSeconds: clamp(rawInterval, POLL_INTERVAL_MIN, POLL_INTERVAL_MAX, POLL_INTERVAL_DEFAULT),
+    postmanStack,
+    postmanApiBase: endpointProfile.apiBaseUrl,
+    postmanBifrostBase: endpointProfile.bifrostBaseUrl,
+    postmanObservabilityBase: endpointProfile.observabilityBaseUrl,
+    postmanObservabilityEnv: endpointProfile.observabilityEnv
   };
 }
 function createPlannedOutputs(inputs) {
@@ -27888,15 +27967,12 @@ async function resolveApiKeyAndTeamId(inputs, client, reporter = core_exports) {
   let apiKey = inputs.postmanApiKey;
   const teamId = inputs.postmanTeamId;
   let keyValid = false;
+  const apiBase = inputs.postmanApiBase || DEFAULT_POSTMAN_API_BASE;
   if (apiKey) {
-    try {
-      const result = await validateApiKey(apiKey);
-      keyValid = result.valid;
-      if (!keyValid) {
-        reporter.warning("Provided postman-api-key is invalid or expired.");
-      }
-    } catch (error2) {
-      throw error2;
+    const result = await validateApiKey(apiKey, apiBase);
+    keyValid = result.valid;
+    if (!keyValid) {
+      reporter.warning("Provided postman-api-key is invalid or expired.");
     }
   }
   if (!keyValid) {
@@ -27907,12 +27983,42 @@ async function resolveApiKeyAndTeamId(inputs, client, reporter = core_exports) {
     client.setApiKey(apiKey);
     reporter.info("New API key created successfully.");
   }
-  if (teamId) {
-    reporter.info(`Using explicit postman-team-id for Bifrost headers: ${teamId}`);
+  let resolvedTeamId = teamId;
+  if (!resolvedTeamId && apiKey) {
+    try {
+      const teams = await getTeams(apiKey, apiBase);
+      if (teams.length > 1 && teams.every((t) => t.organizationId == null)) {
+        reporter.warning(
+          "GET /teams returned multiple teams but none include organizationId. Org-mode auto-detection may be degraded due to an upstream API change. Set postman-team-id explicitly if Bifrost calls fail."
+        );
+      }
+      const isOrgMode = teams.some((t) => t.organizationId != null);
+      if (isOrgMode) {
+        if (teams.length === 1) {
+          resolvedTeamId = String(teams[0].id);
+          reporter.info(
+            `Org-mode account detected. Using sub-team ${teams[0].id} (${teams[0].name ?? "unknown"}) for Bifrost calls.`
+          );
+        } else {
+          const meResult = await validateApiKey(apiKey, apiBase);
+          const meTeamId = meResult.teamId ? parseInt(meResult.teamId, 10) : NaN;
+          if (!Number.isNaN(meTeamId) && teams.some((t) => t.id === meTeamId)) {
+            resolvedTeamId = String(meTeamId);
+            reporter.info(
+              `Org-mode account detected. Using sub-team ${meTeamId} (from /me) for Bifrost calls.`
+            );
+          }
+        }
+      }
+    } catch {
+    }
+  }
+  if (resolvedTeamId) {
+    reporter.info(`Using postman-team-id for Bifrost headers: ${resolvedTeamId}`);
   } else {
-    reporter.info("No explicit postman-team-id provided; omitting x-entity-team-id so Bifrost resolves team from the access token.");
+    reporter.info("No postman-team-id resolved; omitting x-entity-team-id so Bifrost resolves team from the access token.");
   }
-  return { apiKey, teamId };
+  return { apiKey, teamId: resolvedTeamId };
 }
 async function runAction() {
   const inputs = resolveInputs();
@@ -27920,11 +28026,6 @@ async function runAction() {
   for (const [key, value] of Object.entries(planned)) {
     setOutput(key, value);
   }
-  const maskSecret = createSecretMasker([
-    inputs.postmanAccessToken,
-    inputs.postmanApiKey,
-    inputs.githubToken
-  ].filter(Boolean));
   setSecret(inputs.postmanAccessToken);
   if (inputs.postmanApiKey) setSecret(inputs.postmanApiKey);
   if (inputs.githubToken) setSecret(inputs.githubToken);
@@ -27932,14 +28033,18 @@ async function runAction() {
     accessToken: inputs.postmanAccessToken,
     teamId: inputs.postmanTeamId,
     apiKey: inputs.postmanApiKey,
-    maskSecret
+    bifrostBaseUrl: inputs.postmanBifrostBase,
+    observabilityBaseUrl: inputs.postmanObservabilityBase,
+    observabilityEnv: inputs.postmanObservabilityEnv
   });
   const { apiKey, teamId } = await resolveApiKeyAndTeamId(inputs, preliminaryClient, core_exports);
   const client = new BifrostCatalogClient({
     accessToken: inputs.postmanAccessToken,
     teamId,
     apiKey,
-    maskSecret
+    bifrostBaseUrl: inputs.postmanBifrostBase,
+    observabilityBaseUrl: inputs.postmanObservabilityBase,
+    observabilityEnv: inputs.postmanObservabilityEnv
   });
   let result;
   try {
@@ -28014,15 +28119,14 @@ function parseCliArgs(argv, env = process.env) {
     "environment-id",
     "system-environment-id",
     "cluster-name",
-    "git-owner",
-    "git-repository-name",
     "repo-url",
     "postman-access-token",
     "postman-api-key",
     "postman-team-id",
     "github-token",
     "poll-timeout-seconds",
-    "poll-interval-seconds"
+    "poll-interval-seconds",
+    "postman-stack"
   ];
   const inputEnv = { ...env };
   for (const name of inputNames) {
@@ -28078,31 +28182,25 @@ async function runCli(argv = process.argv.slice(2), runtime = {}) {
   if (inputs.githubToken) {
     reporter.setSecret(inputs.githubToken);
   }
-  const preliminaryMaskSecret = createSecretMasker([
-    inputs.postmanAccessToken,
-    inputs.postmanApiKey,
-    inputs.githubToken
-  ]);
   const preliminaryClient = new BifrostCatalogClient({
     accessToken: inputs.postmanAccessToken,
     teamId: inputs.postmanTeamId,
     apiKey: inputs.postmanApiKey,
-    maskSecret: preliminaryMaskSecret
+    bifrostBaseUrl: inputs.postmanBifrostBase,
+    observabilityBaseUrl: inputs.postmanObservabilityBase,
+    observabilityEnv: inputs.postmanObservabilityEnv
   });
   const { apiKey, teamId } = await resolveApiKeyAndTeamId(inputs, preliminaryClient, reporter);
   if (apiKey) {
     reporter.setSecret(apiKey);
   }
-  const maskSecret = createSecretMasker([
-    inputs.postmanAccessToken,
-    inputs.githubToken,
-    apiKey
-  ]);
   const client = new BifrostCatalogClient({
     accessToken: inputs.postmanAccessToken,
     teamId,
     apiKey,
-    maskSecret
+    bifrostBaseUrl: inputs.postmanBifrostBase,
+    observabilityBaseUrl: inputs.postmanObservabilityBase,
+    observabilityEnv: inputs.postmanObservabilityEnv
   });
   const result = await (runtime.executeOnboarding ?? runOnboarding)(
     inputs,

package/dist/index.cjs

@@ -25012,9 +25012,11 @@ ${captureLines}` : capture.stack;
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  DEFAULT_POSTMAN_API_BASE: () => DEFAULT_POSTMAN_API_BASE,
+  DEFAULT_POSTMAN_BIFROST_BASE: () => DEFAULT_POSTMAN_BIFROST_BASE,
+  DEFAULT_POSTMAN_OBSERVABILITY_BASE: () => DEFAULT_POSTMAN_OBSERVABILITY_BASE,
   createPlannedOutputs: () => createPlannedOutputs,
-  deriveTeamId: () => deriveTeamId,
-  deriveTeamIdFromSession: () => deriveTeamIdFromSession,
+  getTeams: () => getTeams,
   resolveApiKeyAndTeamId: () => resolveApiKeyAndTeamId,
   resolveInputs: () => resolveInputs,
   runOnboarding: () => runOnboarding,
@@ -27347,9 +27349,6 @@ function redactSecrets(input, secretValues, replacement = REDACTED) {
     return sanitized.split(secret).join(replacement);
   }, source);
 }
-function createSecretMasker(secretValues, replacement = REDACTED) {
-  return (input) => redactSecrets(input, secretValues, replacement);
-}
 function headerEntries(headers) {
   if (headers instanceof Headers) {
     return Array.from(headers.entries());
@@ -27476,20 +27475,58 @@ async function retry(operation, options = {}) {
   throw new Error("Retry exhausted without returning or throwing");
 }
 
+// src/lib/postman/base-urls.ts
+var POSTMAN_ENDPOINT_PROFILES = {
+  prod: {
+    apiBaseUrl: "https://api.getpostman.com",
+    bifrostBaseUrl: "https://bifrost-premium-https-v4.gw.postman.com",
+    observabilityBaseUrl: "https://api.observability.postman.com",
+    observabilityEnv: "production"
+  },
+  beta: {
+    apiBaseUrl: "https://api.getpostman-beta.com",
+    bifrostBaseUrl: "https://bifrost-https-v4.gw.postman-beta.com",
+    observabilityBaseUrl: "https://api.observability.postman-beta.com",
+    observabilityEnv: "beta"
+  }
+};
+function parsePostmanStack(value) {
+  const normalized = String(value || "prod").trim().toLowerCase();
+  if (normalized === "prod" || normalized === "beta") {
+    return normalized;
+  }
+  throw new Error(`Unsupported postman-stack "${value}". Supported values: prod, beta`);
+}
+function resolvePostmanEndpointProfile(stack) {
+  return POSTMAN_ENDPOINT_PROFILES[stack];
+}
+
 // src/lib/bifrost-client.ts
-var BIFROST_BASE = "https://bifrost-premium-https-v4.gw.postman.com/ws/proxy";
+var DEFAULT_BIFROST_BASE_URL = POSTMAN_ENDPOINT_PROFILES.prod.bifrostBaseUrl;
+var BIFROST_PROXY_PATH = "/ws/proxy";
+var DEFAULT_OBSERVABILITY_BASE_URL = POSTMAN_ENDPOINT_PROFILES.prod.observabilityBaseUrl;
+var DEFAULT_OBSERVABILITY_ENV = POSTMAN_ENDPOINT_PROFILES.prod.observabilityEnv;
+var MAX_DISCOVERED_SERVICE_PAGES = 100;
+var MAX_PROVIDER_SERVICE_PAGES = 100;
 var BifrostCatalogClient = class {
   accessToken;
   teamId;
   apiKey;
   fetchFn;
   secretValues;
+  bifrostProxyUrl;
+  observabilityBaseUrl;
+  observabilityEnv;
   constructor(options) {
     this.accessToken = options.accessToken;
     this.teamId = options.teamId;
     this.apiKey = options.apiKey;
     this.fetchFn = options.fetchFn ?? globalThis.fetch;
     this.secretValues = [options.accessToken, options.apiKey].filter(Boolean);
+    const base = (options.bifrostBaseUrl || DEFAULT_BIFROST_BASE_URL).replace(/\/+$/, "");
+    this.bifrostProxyUrl = `${base}${BIFROST_PROXY_PATH}`;
+    this.observabilityBaseUrl = (options.observabilityBaseUrl || DEFAULT_OBSERVABILITY_BASE_URL).replace(/\/+$/, "");
+    this.observabilityEnv = options.observabilityEnv || DEFAULT_OBSERVABILITY_ENV;
   }
   setApiKey(apiKey) {
     this.apiKey = apiKey;
@@ -27513,7 +27550,7 @@ var BifrostCatalogClient = class {
     return h;
   }
   async proxyRequest(method, path6, body = {}) {
-    const response = await this.fetchFn(BIFROST_BASE, {
+    const response = await this.fetchFn(this.bifrostProxyUrl, {
       method: "POST",
       headers: this.headers(),
       body: JSON.stringify({
@@ -27538,7 +27575,7 @@ var BifrostCatalogClient = class {
     return data;
   }
   async akitaProxyRequest(method, path6, body = {}) {
-    const response = await this.fetchFn(BIFROST_BASE, {
+    const response = await this.fetchFn(this.bifrostProxyUrl, {
       method: "POST",
       headers: this.headers(),
       body: JSON.stringify({
@@ -27560,16 +27597,23 @@ var BifrostCatalogClient = class {
       async () => {
         const allItems = [];
         let cursor = null;
-        let hasMore = true;
-        while (hasMore) {
+        const seenCursors = /* @__PURE__ */ new Set();
+        for (let page = 0; page < MAX_DISCOVERED_SERVICE_PAGES; page += 1) {
           const cursorParam = cursor ? `&cursor=${encodeURIComponent(cursor)}` : "";
           const data = await this.proxyRequest(
             "GET",
             `/api/v1/onboarding/discovered-services?status=discovered${cursorParam}`
           );
           allItems.push(...data.items || []);
-          cursor = data.nextCursor || null;
-          hasMore = cursor !== null;
+          if (data.total && allItems.length >= data.total) {
+            break;
+          }
+          const nextCursor = data.nextCursor || null;
+          if (!nextCursor || seenCursors.has(nextCursor)) {
+            break;
+          }
+          seenCursors.add(nextCursor);
+          cursor = nextCursor;
         }
         return allItems;
       },
@@ -27616,8 +27660,7 @@ var BifrostCatalogClient = class {
     const allServices = [];
     let page = 1;
     const pageSize = 100;
-    let hasMore = true;
-    while (hasMore) {
+    for (let pageCount = 0; pageCount < MAX_PROVIDER_SERVICE_PAGES; pageCount += 1) {
       const result = await this.akitaProxyRequest(
         "GET",
         `/v2/api-catalog/services?status=discovered&populate_endpoints=false&populate_discovery_metadata=true&page=${page}&page_size=${pageSize}`
@@ -27625,7 +27668,12 @@ var BifrostCatalogClient = class {
       if (!result.ok || !result.data) return null;
       const services = result.data.services || [];
       allServices.push(...services);
-      hasMore = services.length >= pageSize;
+      if (result.data.total && allServices.length >= result.data.total) {
+        break;
+      }
+      if (services.length < pageSize) {
+        break;
+      }
       page++;
     }
     const fullName = clusterName ? `${clusterName}/${projectName}` : projectName;
@@ -27662,12 +27710,12 @@ var BifrostCatalogClient = class {
   }
   async createApplication(workspaceId, systemEnv) {
     const response = await this.fetchFn(
-      `https://api.observability.postman.com/v2/agent/api-catalog/workspaces/${workspaceId}/applications`,
+      `${this.observabilityBaseUrl}/v2/agent/api-catalog/workspaces/${workspaceId}/applications`,
       {
         method: "POST",
         headers: {
           "x-api-key": this.apiKey,
-          "x-postman-env": "production",
+          "x-postman-env": this.observabilityEnv,
           "Content-Type": "application/json"
         },
         body: JSON.stringify({ system_env: systemEnv })
@@ -27691,7 +27739,7 @@ var BifrostCatalogClient = class {
     return result.data.team_verification_token || null;
   }
   async createApiKey(name) {
-    const response = await this.fetchFn(BIFROST_BASE, {
+    const response = await this.fetchFn(this.bifrostProxyUrl, {
       method: "POST",
       headers: this.headers(),
       body: JSON.stringify({
@@ -27731,21 +27779,15 @@ var POLL_TIMEOUT_DEFAULT = 120;
 var POLL_INTERVAL_MIN = 2;
 var POLL_INTERVAL_MAX = 60;
 var POLL_INTERVAL_DEFAULT = 10;
-async function deriveTeamId(apiKey) {
-  try {
-    const res = await fetch("https://api.getpostman.com/me", {
-      method: "GET",
-      headers: { "x-api-key": apiKey }
-    });
-    if (!res.ok) return void 0;
-    const data = await res.json();
-    if (data?.user?.teamId) return String(data.user.teamId);
-  } catch {
-  }
-  return void 0;
+var PROD_ENDPOINTS = resolvePostmanEndpointProfile("prod");
+var DEFAULT_POSTMAN_API_BASE = PROD_ENDPOINTS.apiBaseUrl;
+var DEFAULT_POSTMAN_BIFROST_BASE = PROD_ENDPOINTS.bifrostBaseUrl;
+var DEFAULT_POSTMAN_OBSERVABILITY_BASE = PROD_ENDPOINTS.observabilityBaseUrl;
+function trimTrailingSlash(value) {
+  return value.replace(/\/+$/, "");
 }
-async function validateApiKey(apiKey) {
-  const res = await fetch("https://api.getpostman.com/me", {
+async function validateApiKey(apiKey, apiBase = DEFAULT_POSTMAN_API_BASE) {
+  const res = await fetch(`${trimTrailingSlash(apiBase)}/me`, {
     method: "GET",
     headers: { "x-api-key": apiKey }
   });
@@ -27759,18 +27801,22 @@ async function validateApiKey(apiKey) {
   const teamId = data?.user?.teamId ? String(data.user.teamId) : void 0;
   return { valid: true, teamId };
 }
-async function deriveTeamIdFromSession(accessToken) {
+async function getTeams(apiKey, apiBase = DEFAULT_POSTMAN_API_BASE) {
   try {
-    const res = await fetch("https://iapub.postman.co/api/sessions/current", {
+    const res = await fetch(`${trimTrailingSlash(apiBase)}/teams`, {
       method: "GET",
-      headers: { "x-access-token": accessToken }
+      headers: { "x-api-key": apiKey }
     });
-    if (!res.ok) return void 0;
+    if (!res.ok) return [];
     const data = await res.json();
-    if (data?.session?.identity?.team) return String(data.session.identity.team);
+    return (data?.data ?? []).filter((t) => t?.id && t?.name).map((t) => ({
+      id: Number(t.id),
+      name: String(t.name),
+      ...t.organizationId != null ? { organizationId: Number(t.organizationId) } : {}
+    }));
   } catch {
+    return [];
   }
-  return void 0;
 }
 function clamp(value, min, max, fallback) {
   const parsed = Number.isFinite(value) ? value : fallback;
@@ -27784,33 +27830,42 @@ function resolveInputs(env = process.env) {
   if (!postmanAccessToken) throw new Error("postman-access-token is required");
   const postmanApiKey = get("postman-api-key");
   const postmanTeamId = get("postman-team-id") || env.POSTMAN_TEAM_ID?.trim() || "";
-  const workspaceId = get("workspace-id");
-  if (!workspaceId) throw new Error("workspace-id is required");
-  const environmentId = get("environment-id");
-  if (!environmentId) throw new Error("environment-id is required");
-  const repoSlug = env.GITHUB_REPOSITORY || env.CI_PROJECT_PATH || (env.BITBUCKET_WORKSPACE && env.BITBUCKET_REPO_SLUG ? `${env.BITBUCKET_WORKSPACE}/${env.BITBUCKET_REPO_SLUG}` : "") || env.BUILD_REPOSITORY_NAME || "";
-  const repoOwner = repoSlug.split("/")[0] || "";
-  const gitOwner = get("git-owner", repoOwner);
-  const gitRepositoryName = get("git-repository-name", projectName);
+  const workspaceId = get("workspace-id") || env.POSTMAN_WORKSPACE_ID?.trim() || "";
+  if (!workspaceId) {
+    throw new Error(
+      "workspace-id is required. Provide it as an input, or set the POSTMAN_WORKSPACE_ID environment variable."
+    );
+  }
+  const environmentId = get("environment-id") || env.POSTMAN_ENVIRONMENT_ID?.trim() || "";
+  if (!environmentId) {
+    throw new Error(
+      "environment-id is required. Provide it as an input, or set the POSTMAN_ENVIRONMENT_ID environment variable."
+    );
+  }
   const detectedRepoUrl = (env.GITHUB_SERVER_URL && env.GITHUB_REPOSITORY ? `${env.GITHUB_SERVER_URL}/${env.GITHUB_REPOSITORY}` : "") || env.CI_PROJECT_URL || env.BITBUCKET_GIT_HTTP_ORIGIN || env.BUILD_REPOSITORY_URI || "";
-  const repoUrl = get("repo-url", detectedRepoUrl || `https://github.com/${gitOwner}/${gitRepositoryName}`);
+  const repoUrl = get("repo-url", detectedRepoUrl);
   const rawTimeout = parseInt(get("poll-timeout-seconds", String(POLL_TIMEOUT_DEFAULT)), 10);
   const rawInterval = parseInt(get("poll-interval-seconds", String(POLL_INTERVAL_DEFAULT)), 10);
+  const postmanStack = parsePostmanStack(get("postman-stack"));
+  const endpointProfile = resolvePostmanEndpointProfile(postmanStack);
   return {
     projectName,
     workspaceId,
     environmentId,
     systemEnvironmentId: get("system-environment-id", ""),
     clusterName: get("cluster-name", ""),
-    gitOwner,
-    gitRepositoryName,
     repoUrl,
     postmanAccessToken,
     postmanApiKey,
     postmanTeamId,
     githubToken: get("github-token", env.GITHUB_TOKEN || ""),
     pollTimeoutSeconds: clamp(rawTimeout, POLL_TIMEOUT_MIN, POLL_TIMEOUT_MAX, POLL_TIMEOUT_DEFAULT),
-    pollIntervalSeconds: clamp(rawInterval, POLL_INTERVAL_MIN, POLL_INTERVAL_MAX, POLL_INTERVAL_DEFAULT)
+    pollIntervalSeconds: clamp(rawInterval, POLL_INTERVAL_MIN, POLL_INTERVAL_MAX, POLL_INTERVAL_DEFAULT),
+    postmanStack,
+    postmanApiBase: endpointProfile.apiBaseUrl,
+    postmanBifrostBase: endpointProfile.bifrostBaseUrl,
+    postmanObservabilityBase: endpointProfile.observabilityBaseUrl,
+    postmanObservabilityEnv: endpointProfile.observabilityEnv
   };
 }
 function createPlannedOutputs(inputs) {
@@ -27914,15 +27969,12 @@ async function resolveApiKeyAndTeamId(inputs, client, reporter = core_exports) {
   let apiKey = inputs.postmanApiKey;
   const teamId = inputs.postmanTeamId;
   let keyValid = false;
+  const apiBase = inputs.postmanApiBase || DEFAULT_POSTMAN_API_BASE;
   if (apiKey) {
-    try {
-      const result = await validateApiKey(apiKey);
-      keyValid = result.valid;
-      if (!keyValid) {
-        reporter.warning("Provided postman-api-key is invalid or expired.");
-      }
-    } catch (error2) {
-      throw error2;
+    const result = await validateApiKey(apiKey, apiBase);
+    keyValid = result.valid;
+    if (!keyValid) {
+      reporter.warning("Provided postman-api-key is invalid or expired.");
     }
   }
   if (!keyValid) {
@@ -27933,12 +27985,42 @@ async function resolveApiKeyAndTeamId(inputs, client, reporter = core_exports) {
     client.setApiKey(apiKey);
     reporter.info("New API key created successfully.");
   }
-  if (teamId) {
-    reporter.info(`Using explicit postman-team-id for Bifrost headers: ${teamId}`);
+  let resolvedTeamId = teamId;
+  if (!resolvedTeamId && apiKey) {
+    try {
+      const teams = await getTeams(apiKey, apiBase);
+      if (teams.length > 1 && teams.every((t) => t.organizationId == null)) {
+        reporter.warning(
+          "GET /teams returned multiple teams but none include organizationId. Org-mode auto-detection may be degraded due to an upstream API change. Set postman-team-id explicitly if Bifrost calls fail."
+        );
+      }
+      const isOrgMode = teams.some((t) => t.organizationId != null);
+      if (isOrgMode) {
+        if (teams.length === 1) {
+          resolvedTeamId = String(teams[0].id);
+          reporter.info(
+            `Org-mode account detected. Using sub-team ${teams[0].id} (${teams[0].name ?? "unknown"}) for Bifrost calls.`
+          );
+        } else {
+          const meResult = await validateApiKey(apiKey, apiBase);
+          const meTeamId = meResult.teamId ? parseInt(meResult.teamId, 10) : NaN;
+          if (!Number.isNaN(meTeamId) && teams.some((t) => t.id === meTeamId)) {
+            resolvedTeamId = String(meTeamId);
+            reporter.info(
+              `Org-mode account detected. Using sub-team ${meTeamId} (from /me) for Bifrost calls.`
+            );
+          }
+        }
+      }
+    } catch {
+    }
+  }
+  if (resolvedTeamId) {
+    reporter.info(`Using postman-team-id for Bifrost headers: ${resolvedTeamId}`);
   } else {
-    reporter.info("No explicit postman-team-id provided; omitting x-entity-team-id so Bifrost resolves team from the access token.");
+    reporter.info("No postman-team-id resolved; omitting x-entity-team-id so Bifrost resolves team from the access token.");
   }
-  return { apiKey, teamId };
+  return { apiKey, teamId: resolvedTeamId };
 }
 async function runAction() {
   const inputs = resolveInputs();
@@ -27946,11 +28028,6 @@ async function runAction() {
   for (const [key, value] of Object.entries(planned)) {
     setOutput(key, value);
   }
-  const maskSecret = createSecretMasker([
-    inputs.postmanAccessToken,
-    inputs.postmanApiKey,
-    inputs.githubToken
-  ].filter(Boolean));
   setSecret(inputs.postmanAccessToken);
   if (inputs.postmanApiKey) setSecret(inputs.postmanApiKey);
   if (inputs.githubToken) setSecret(inputs.githubToken);
@@ -27958,14 +28035,18 @@ async function runAction() {
     accessToken: inputs.postmanAccessToken,
     teamId: inputs.postmanTeamId,
     apiKey: inputs.postmanApiKey,
-    maskSecret
+    bifrostBaseUrl: inputs.postmanBifrostBase,
+    observabilityBaseUrl: inputs.postmanObservabilityBase,
+    observabilityEnv: inputs.postmanObservabilityEnv
   });
   const { apiKey, teamId } = await resolveApiKeyAndTeamId(inputs, preliminaryClient, core_exports);
   const client = new BifrostCatalogClient({
     accessToken: inputs.postmanAccessToken,
     teamId,
     apiKey,
-    maskSecret
+    bifrostBaseUrl: inputs.postmanBifrostBase,
+    observabilityBaseUrl: inputs.postmanObservabilityBase,
+    observabilityEnv: inputs.postmanObservabilityEnv
   });
   let result;
   try {
@@ -27996,9 +28077,11 @@ runAction().catch((error2) => {
 });
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  DEFAULT_POSTMAN_API_BASE,
+  DEFAULT_POSTMAN_BIFROST_BASE,
+  DEFAULT_POSTMAN_OBSERVABILITY_BASE,
   createPlannedOutputs,
-  deriveTeamId,
-  deriveTeamIdFromSession,
+  getTeams,
   resolveApiKeyAndTeamId,
   resolveInputs,
   runOnboarding,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@postman-cse/onboarding-insights",
-  "version": "0.7.2",
+  "version": "0.9.0",
   "description": "GitHub Action to onboard Postman Insights discovered services to API Catalog workspaces.",
   "type": "module",
   "main": "dist/index.cjs",
@@ -11,9 +11,14 @@
     "action.yml",
     "dist"
   ],
+  "engines": {
+    "node": ">=24"
+  },
   "scripts": {
-    "build": "rm -rf dist && esbuild src/index.ts --bundle --platform=node --target=node20 --format=cjs --outfile=dist/index.cjs && esbuild src/cli.ts --bundle --platform=node --target=node20 --format=cjs --outfile=dist/cli.cjs",
+    "build": "rm -rf dist && esbuild src/index.ts --bundle --platform=node --target=node24 --format=cjs --outfile=dist/index.cjs && esbuild src/cli.ts --bundle --platform=node --target=node24 --format=cjs --outfile=dist/cli.cjs",
     "check:dist": "npm run build && git diff --exit-code -- dist",
+    "lint": "eslint .",
+    "lint:fix": "eslint . --fix",
     "test": "vitest run",
     "typecheck": "tsc --noEmit -p tsconfig.json"
   },
@@ -31,12 +36,18 @@
     "@actions/core": "^3.0.0"
   },
   "overrides": {
-    "undici": ">=6.24.0"
+    "undici": ">=6.24.0",
+    "picomatch": ">=4.0.4"
   },
   "devDependencies": {
+    "@commitlint/cli": "^20.5.0",
+    "@commitlint/config-conventional": "^20.5.0",
+    "@eslint/js": "^10.0.1",
     "@types/node": "^25.3.5",
     "esbuild": "^0.27.3",
+    "eslint": "^10.1.0",
     "typescript": "^5.9.3",
+    "typescript-eslint": "^8.57.2",
     "vitest": "^4.0.18",
     "yaml": "^2.8.2"
   },