@postman-cse/onboarding-insights 1.0.3 → 2.0.0

package/dist/action.cjs

@@ -12166,7 +12166,7 @@ var require_response = __commonJS({
     var assert = require("node:assert");
     var { types } = require("node:util");
     var textEncoder = new TextEncoder("utf-8");
-    var Response = class _Response {
+    var Response2 = class _Response {
       // Creates network error Response.
       static error() {
         const responseObject = fromInnerResponse(makeNetworkError(), "immutable");
@@ -12309,8 +12309,8 @@ var require_response = __commonJS({
         return `Response ${nodeUtil.formatWithOptions(options, properties)}`;
       }
     };
-    mixinBody(Response);
-    Object.defineProperties(Response.prototype, {
+    mixinBody(Response2);
+    Object.defineProperties(Response2.prototype, {
       type: kEnumerableProperty,
       url: kEnumerableProperty,
       status: kEnumerableProperty,
@@ -12326,7 +12326,7 @@ var require_response = __commonJS({
         configurable: true
       }
     });
-    Object.defineProperties(Response, {
+    Object.defineProperties(Response2, {
       json: kEnumerableProperty,
       redirect: kEnumerableProperty,
       error: kEnumerableProperty
@@ -12459,7 +12459,7 @@ var require_response = __commonJS({
       }
     }
     function fromInnerResponse(innerResponse, guard) {
-      const response = new Response(kConstruct);
+      const response = new Response2(kConstruct);
       response[kState] = innerResponse;
       response[kHeaders] = new Headers3(kConstruct);
       setHeadersList(response[kHeaders], innerResponse.headersList);
@@ -12527,7 +12527,7 @@ var require_response = __commonJS({
       makeResponse,
       makeAppropriateNetworkError,
       filterResponse,
-      Response,
+      Response: Response2,
       cloneResponse,
       fromInnerResponse
     };
@@ -15199,7 +15199,7 @@ var require_cache = __commonJS({
     var { urlEquals, getFieldValues } = require_util5();
     var { kEnumerableProperty, isDisturbed } = require_util();
     var { webidl } = require_webidl();
-    var { Response, cloneResponse, fromInnerResponse } = require_response();
+    var { Response: Response2, cloneResponse, fromInnerResponse } = require_response();
     var { Request, fromInnerRequest } = require_request2();
     var { kState } = require_symbols2();
     var { fetching } = require_fetch();
@@ -15726,7 +15726,7 @@ var require_cache = __commonJS({
         converter: webidl.converters.DOMString
       }
     ]);
-    webidl.converters.Response = webidl.interfaceConverter(Response);
+    webidl.converters.Response = webidl.interfaceConverter(Response2);
     webidl.converters["sequence<RequestInfo>"] = webidl.sequenceConverter(
       webidl.converters.RequestInfo
     );
@@ -21481,6 +21481,117 @@ function resolvePostmanEndpointProfile(stack, region = "us") {
   return profile;
 }
 
+// src/lib/postman/token-provider.ts
+var MintError = class extends Error {
+  permanent;
+  constructor(message, permanent) {
+    super(message);
+    this.name = "MintError";
+    this.permanent = permanent;
+  }
+};
+function extractAccessToken(payload) {
+  if (!payload || typeof payload !== "object") return void 0;
+  const record = payload;
+  const direct = record.access_token;
+  if (typeof direct === "string" && direct.trim()) return direct.trim();
+  const session = record.session;
+  if (session && typeof session === "object") {
+    const token = session.token;
+    if (typeof token === "string" && token.trim()) return token.trim();
+  }
+  return void 0;
+}
+var AccessTokenProvider = class {
+  token;
+  apiKey;
+  apiBaseUrl;
+  fetchImpl;
+  maxAttempts;
+  onToken;
+  sleep;
+  inflight;
+  constructor(options) {
+    this.token = String(options.accessToken || "").trim();
+    this.apiKey = String(options.apiKey || "").trim();
+    this.apiBaseUrl = String(
+      options.apiBaseUrl || POSTMAN_ENDPOINT_PROFILES.prod.apiBaseUrl
+    ).replace(/\/+$/, "");
+    this.fetchImpl = options.fetchImpl ?? fetch;
+    this.maxAttempts = Math.max(1, options.maxAttempts ?? 2);
+    this.onToken = options.onToken;
+    this.sleep = options.sleep;
+  }
+  current() {
+    return this.token;
+  }
+  /** True when a PMAK is present, so an expired token can be re-minted. */
+  canRefresh() {
+    return Boolean(this.apiKey);
+  }
+  refresh() {
+    this.inflight ??= this.mintWithRetry().finally(() => {
+      this.inflight = void 0;
+    });
+    return this.inflight;
+  }
+  async mintWithRetry() {
+    if (!this.apiKey) {
+      throw new Error(
+        "postman: the access token expired and cannot be refreshed because no postman-api-key is present. Service-account access tokens expire after about 1 to 1.5 hours. Re-mint a fresh token (postman-resolve-service-token-action) and re-run."
+      );
+    }
+    const token = await retry(() => this.mintOnce(), {
+      maxAttempts: this.maxAttempts,
+      delayMs: 1e3,
+      backoffMultiplier: 2,
+      ...this.sleep ? { sleep: this.sleep } : {},
+      shouldRetry: (error2) => !(error2 instanceof MintError && error2.permanent)
+    });
+    this.token = token;
+    this.onToken?.(token);
+    return token;
+  }
+  async mintOnce() {
+    const response = await this.fetchImpl(`${this.apiBaseUrl}/service-account-tokens`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "x-api-key": this.apiKey
+      },
+      body: JSON.stringify({ apiKey: this.apiKey })
+    });
+    const body = await response.text().catch(() => "");
+    if (!response.ok) {
+      const status = response.status;
+      if (status === 401 || status === 403) {
+        throw new MintError(
+          `postman: re-mint failed because the postman-api-key was rejected (PMAK rejected, HTTP ${status}); confirm it is a valid, enabled service-account PMAK for the intended team.`,
+          true
+        );
+      }
+      if (status === 400 && body.toLowerCase().includes("service accounts not enabled")) {
+        throw new MintError(
+          "postman: re-mint failed because service accounts are not enabled for this team; enable them in Team Settings or use a team where they are.",
+          true
+        );
+      }
+      throw new MintError(`postman: re-mint failed (service-account-tokens HTTP ${status}).`, false);
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(body);
+    } catch {
+      parsed = void 0;
+    }
+    const token = extractAccessToken(parsed);
+    if (!token) {
+      throw new MintError("postman: re-mint succeeded but no access token was returned.", false);
+    }
+    return token;
+  }
+};
+
 // src/lib/bifrost-client.ts
 var DEFAULT_BIFROST_BASE_URL = POSTMAN_ENDPOINT_PROFILES.prod.bifrostBaseUrl;
 var BIFROST_PROXY_PATH = "/ws/proxy";
@@ -21488,8 +21599,11 @@ var DEFAULT_OBSERVABILITY_BASE_URL = POSTMAN_ENDPOINT_PROFILES.prod.observabilit
 var DEFAULT_OBSERVABILITY_ENV = POSTMAN_ENDPOINT_PROFILES.prod.observabilityEnv;
 var MAX_DISCOVERED_SERVICE_PAGES = 100;
 var MAX_PROVIDER_SERVICE_PAGES = 100;
+function isExpiredAuthError(status, body) {
+  return status === 401 || body.includes("UNAUTHENTICATED") || body.includes("authenticationError");
+}
 var BifrostCatalogClient = class {
-  accessToken;
+  tokenProvider;
   teamId;
   apiKey;
   fetchFn;
@@ -21498,11 +21612,14 @@ var BifrostCatalogClient = class {
   observabilityBaseUrl;
   observabilityEnv;
   constructor(options) {
-    this.accessToken = options.accessToken;
+    this.tokenProvider = options.tokenProvider ?? new AccessTokenProvider({
+      accessToken: options.accessToken,
+      apiKey: options.apiKey
+    });
     this.teamId = options.teamId;
     this.apiKey = options.apiKey;
     this.fetchFn = options.fetchFn ?? globalThis.fetch;
-    this.secretValues = [options.accessToken, options.apiKey].filter(Boolean);
+    this.secretValues = [this.tokenProvider.current(), options.apiKey].filter(Boolean);
     const base = (options.bifrostBaseUrl || DEFAULT_BIFROST_BASE_URL).replace(/\/+$/, "");
     this.bifrostProxyUrl = `${base}${BIFROST_PROXY_PATH}`;
     this.observabilityBaseUrl = (options.observabilityBaseUrl || DEFAULT_OBSERVABILITY_BASE_URL).replace(/\/+$/, "");
@@ -21514,6 +21631,11 @@ var BifrostCatalogClient = class {
       this.secretValues.push(apiKey);
     }
   }
+  registerAccessToken(token) {
+    if (token && !this.secretValues.includes(token)) {
+      this.secretValues.push(token);
+    }
+  }
   /**
    * Build Bifrost proxy headers.
    * x-entity-team-id is ONLY included when teamId is present (org-mode tokens).
@@ -21521,7 +21643,7 @@ var BifrostCatalogClient = class {
    */
   headers() {
     const h = {
-      "x-access-token": this.accessToken,
+      "x-access-token": this.tokenProvider.current(),
       "Content-Type": "application/json"
     };
     if (this.teamId) {
@@ -21537,7 +21659,7 @@ var BifrostCatalogClient = class {
     const session = getMemoizedSessionIdentity();
     return {
       operation,
-      hasAccessToken: Boolean(this.accessToken),
+      hasAccessToken: Boolean(this.tokenProvider.current()),
       sessionTeamId: session?.teamId,
       sessionRoles: session?.roles,
       sessionConsumerType: session?.consumerType,
@@ -21546,7 +21668,7 @@ var BifrostCatalogClient = class {
     };
   }
   async proxyRequest(method, path6, body = {}, operation = "api-catalog request") {
-    const response = await this.fetchFn(this.bifrostProxyUrl, {
+    const send2 = async () => this.fetchFn(this.bifrostProxyUrl, {
       method: "POST",
       headers: this.headers(),
       body: JSON.stringify({
@@ -21556,6 +21678,39 @@ var BifrostCatalogClient = class {
         body
       })
     });
+    let response = await send2();
+    if (!response.ok) {
+      const bodyText = await response.text().catch(() => "");
+      if (isExpiredAuthError(response.status, bodyText) && this.tokenProvider.canRefresh()) {
+        try {
+          const refreshed = await this.tokenProvider.refresh();
+          this.registerAccessToken(refreshed);
+          response = await send2();
+        } catch {
+          const httpErr = await HttpError.fromResponse(
+            new Response(bodyText, { status: response.status, headers: response.headers }),
+            {
+              method: "POST",
+              url: `bifrost:api-catalog:${method} ${path6}`,
+              secretValues: this.secretValues
+            }
+          );
+          const advised = adviseFromHttpError(httpErr, this.adviceContext(operation));
+          throw advised ?? httpErr;
+        }
+      } else {
+        const httpErr = await HttpError.fromResponse(
+          new Response(bodyText, { status: response.status, headers: response.headers }),
+          {
+            method: "POST",
+            url: `bifrost:api-catalog:${method} ${path6}`,
+            secretValues: this.secretValues
+          }
+        );
+        const advised = adviseFromHttpError(httpErr, this.adviceContext(operation));
+        throw advised ?? httpErr;
+      }
+    }
     if (!response.ok) {
       const httpErr = await HttpError.fromResponse(response, {
         method: "POST",
@@ -21578,7 +21733,7 @@ var BifrostCatalogClient = class {
     return data;
   }
   async akitaProxyRequest(method, path6, body = {}, operation = "Insights request") {
-    const response = await this.fetchFn(this.bifrostProxyUrl, {
+    const send2 = async () => this.fetchFn(this.bifrostProxyUrl, {
       method: "POST",
       headers: this.headers(),
       body: JSON.stringify({
@@ -21588,8 +21743,30 @@ var BifrostCatalogClient = class {
         body
       })
     });
+    let response = await send2();
     if (!response.ok) {
       const text = await response.text().catch(() => "");
+      if (isExpiredAuthError(response.status, text) && this.tokenProvider.canRefresh()) {
+        try {
+          const refreshed = await this.tokenProvider.refresh();
+          this.registerAccessToken(refreshed);
+          response = await send2();
+          if (response.ok) {
+            const data2 = await response.json();
+            return { ok: true, status: response.status, data: data2, errorText: "" };
+          }
+          const retryText = await response.text().catch(() => "");
+          const advised2 = adviseFromBifrostBody(response.status, retryText, this.adviceContext(operation));
+          const errorText2 = advised2 ? retryText ? `${retryText}
+${advised2.message}` : advised2.message : retryText;
+          return { ok: false, status: response.status, data: null, errorText: errorText2 };
+        } catch {
+          const advised2 = adviseFromBifrostBody(response.status, text, this.adviceContext(operation));
+          const errorText2 = advised2 ? text ? `${text}
+${advised2.message}` : advised2.message : text;
+          return { ok: false, status: response.status, data: null, errorText: errorText2 };
+        }
+      }
       const advised = adviseFromBifrostBody(response.status, text, this.adviceContext(operation));
       const errorText = advised ? text ? `${text}
 ${advised.message}` : advised.message : text;
@@ -21688,12 +21865,19 @@ ${advised.message}` : advised.message : text;
       }
       page++;
     }
-    const fullName = clusterName ? `${clusterName}/${projectName}` : projectName;
-    const exactMatch = allServices.find((s) => s.name === fullName);
-    if (exactMatch) return exactMatch.id;
-    if (clusterName) return null;
-    const suffixMatch = allServices.find((s) => s.name.endsWith(`/${projectName}`));
-    return suffixMatch?.id || null;
+    if (clusterName) {
+      const fullName = `${clusterName}/${projectName}`;
+      const exactMatch = allServices.find((s) => s.name === fullName);
+      return exactMatch?.id || null;
+    }
+    const finalSegmentMatch = allServices.find(
+      (s) => getFinalServiceSegment(s.name) === projectName
+    );
+    if (finalSegmentMatch) return finalSegmentMatch.id;
+    const bracketedMatch = allServices.find(
+      (s) => getFinalServiceSegment(s.name).includes(`[${projectName}]`)
+    );
+    return bracketedMatch?.id || null;
   }
   async acknowledgeOnboarding(providerServiceId, workspaceId, systemEnvironmentId) {
     const result = await this.akitaProxyRequest(
@@ -21723,6 +21907,14 @@ ${advised.message}` : advised.message : text;
       throw new Error(`Workspace acknowledge failed: ${result.status} ${result.errorText}`);
     }
   }
+  // PMAK-only by proven exception. A live probe against the observability
+  // application-binding endpoint (POST /v2/agent/api-catalog/workspaces/:id/
+  // applications) showed x-access-token is rejected identically to the x-api-key
+  // control: both return 401 {"message":"Postman User not found"} for a
+  // service-account credential, because the observability service has no
+  // "Postman User" for a service account. The access token offers no improvement
+  // over the API key here, so this route is not migrated to access-token-primary
+  // (the suite-wide migration explicitly leaves probe-failed routes on PMAK).
   async createApplication(workspaceId, systemEnv) {
     const response = await this.fetchFn(
       `${this.observabilityBaseUrl}/v2/agent/api-catalog/workspaces/${workspaceId}/applications`,
@@ -21790,7 +21982,17 @@ function findDiscoveredService(services, projectName, clusterName) {
     const fullName = `${clusterName}/${projectName}`;
     return services.find((s) => s.name === fullName);
   }
-  return services.find((s) => s.name.endsWith(`/${projectName}`));
+  const finalSegmentMatch = services.find(
+    (service) => getFinalServiceSegment(service.name) === projectName
+  );
+  if (finalSegmentMatch) return finalSegmentMatch;
+  return services.find(
+    (service) => getFinalServiceSegment(service.name).includes(`[${projectName}]`)
+  );
+}
+function getFinalServiceSegment(serviceName) {
+  const lastSlash = serviceName.lastIndexOf("/");
+  return lastSlash === -1 ? serviceName : serviceName.slice(lastSlash + 1);
 }
 
 // node_modules/@postman-cse/automation-telemetry-core/dist/ci-context.js
@@ -21798,7 +22000,65 @@ function norm(value) {
   const trimmed = (value ?? "").trim();
   return trimmed.length > 0 ? trimmed : void 0;
 }
+function detectEventTrigger(env = process.env) {
+  const ghEvent = norm(env.GITHUB_EVENT_NAME)?.toLowerCase();
+  if (ghEvent) {
+    if (ghEvent === "push")
+      return "push";
+    if (ghEvent === "pull_request" || ghEvent === "pull_request_target")
+      return "pull_request";
+    if (ghEvent === "schedule")
+      return "schedule";
+    if (ghEvent === "workflow_dispatch" || ghEvent === "repository_dispatch")
+      return "manual";
+    return "other";
+  }
+  const glSource = norm(env.CI_PIPELINE_SOURCE)?.toLowerCase();
+  if (glSource) {
+    if (glSource === "push")
+      return "push";
+    if (glSource === "merge_request_event")
+      return "pull_request";
+    if (glSource === "schedule")
+      return "schedule";
+    if (glSource === "web" || glSource === "api" || glSource === "trigger" || glSource === "pipeline") {
+      return "manual";
+    }
+    return "other";
+  }
+  if (norm(env.BITBUCKET_PR_ID))
+    return "pull_request";
+  if (norm(env.CI) || norm(env.BUILD_BUILDID) || norm(env.JENKINS_URL) || norm(env.TEAMCITY_VERSION)) {
+    return "other";
+  }
+  return "unknown";
+}
+function detectRunnerOs(env = process.env) {
+  const runnerOs = norm(env.RUNNER_OS)?.toLowerCase();
+  if (runnerOs === "linux")
+    return "linux";
+  if (runnerOs === "macos")
+    return "macos";
+  if (runnerOs === "windows")
+    return "windows";
+  const platform2 = typeof process !== "undefined" ? process.platform : void 0;
+  if (platform2 === "linux")
+    return "linux";
+  if (platform2 === "darwin")
+    return "macos";
+  if (platform2 === "win32")
+    return "windows";
+  return "unknown";
+}
 function detectCiContext(env = process.env) {
+  const provider = detectCiProviderContext(env);
+  return {
+    ...provider,
+    eventTrigger: detectEventTrigger(env),
+    runnerOs: detectRunnerOs(env)
+  };
+}
+function detectCiProviderContext(env = process.env) {
   if (norm(env.GITHUB_ACTIONS)) {
     const runnerEnv = norm(env.RUNNER_ENVIRONMENT);
     const runnerKind = runnerEnv === "github-hosted" ? "hosted" : runnerEnv === "self-hosted" ? "self-hosted" : "unknown";
@@ -21936,25 +22196,49 @@ function parseProvider(explicitProvider, repoUrl, env) {
   }
   return "unknown";
 }
+function classifyRefKind(env = process.env) {
+  const githubRefType = normalize(env.GITHUB_REF_TYPE)?.toLowerCase();
+  const githubRef = normalize(env.GITHUB_REF);
+  const azureRef = normalize(env.BUILD_SOURCEBRANCH);
+  if (githubRefType === "tag" || githubRef?.startsWith("refs/tags/") || normalize(env.CI_COMMIT_TAG) || normalize(env.BITBUCKET_TAG) || azureRef?.startsWith("refs/tags/")) {
+    return "tag";
+  }
+  const githubRefName = normalize(env.GITHUB_REF_NAME);
+  const githubDefault = normalize(env.GITHUB_DEFAULT_BRANCH);
+  if (githubRefName && githubDefault) {
+    return githubRefName === githubDefault ? "default-branch" : "branch";
+  }
+  const gitlabRef = normalize(env.CI_COMMIT_REF_NAME);
+  const gitlabDefault = normalize(env.CI_DEFAULT_BRANCH);
+  if (gitlabRef && gitlabDefault) {
+    return gitlabRef === gitlabDefault ? "default-branch" : "branch";
+  }
+  if (githubRefName || githubRef?.startsWith("refs/heads/") || gitlabRef || normalize(env.BITBUCKET_BRANCH) || normalize(env.BUILD_SOURCEBRANCHNAME) || azureRef?.startsWith("refs/heads/")) {
+    return "branch";
+  }
+  return "unknown";
+}
 function detectRepoContext(input, env = process.env) {
   const repoUrl = normalizeRepoUrl(input.repoUrl) ?? normalizeRepoUrl(env.GITHUB_SERVER_URL && env.GITHUB_REPOSITORY ? `${env.GITHUB_SERVER_URL}/${env.GITHUB_REPOSITORY}` : void 0) ?? normalizeRepoUrl(env.CI_PROJECT_URL) ?? normalizeRepoUrl(env.BITBUCKET_GIT_HTTP_ORIGIN) ?? normalizeRepoUrl(env.BUILD_REPOSITORY_URI);
   const repoSlug = normalize(input.repoSlug) ?? normalize(env.GITHUB_REPOSITORY) ?? normalize(env.CI_PROJECT_PATH) ?? (env.BITBUCKET_WORKSPACE && env.BITBUCKET_REPO_SLUG ? normalize(`${env.BITBUCKET_WORKSPACE}/${env.BITBUCKET_REPO_SLUG}`) : void 0) ?? normalize(env.BUILD_REPOSITORY_NAME);
   const ref = normalize(input.ref) ?? normalize(env.GITHUB_REF_NAME) ?? normalize(env.CI_COMMIT_REF_NAME) ?? normalize(env.BITBUCKET_BRANCH) ?? normalize(env.BUILD_SOURCEBRANCHNAME);
   const sha = normalize(input.sha) ?? normalize(env.GITHUB_SHA) ?? normalize(env.CI_COMMIT_SHA) ?? normalize(env.BITBUCKET_COMMIT) ?? normalize(env.BUILD_SOURCEVERSION);
   const provider = parseProvider(input.gitProvider, repoUrl, env);
+  const refKind = classifyRefKind(env);
   return {
     provider,
     repoUrl,
     repoSlug,
     ref,
-    sha
+    sha,
+    refKind
   };
 }
 
 // node_modules/@postman-cse/automation-telemetry-core/dist/telemetry.js
 var import_node_crypto = require("node:crypto");
 var import_undici2 = __toESM(require_undici(), 1);
-var SCHEMA_VERSION = 2;
+var SCHEMA_VERSION = 3;
 var DEFAULT_TIMEOUT_MS = 1500;
 var DEFAULT_ENDPOINT = "https://events.pm-cse.dev/v1/events";
 var proxyDispatcher;
@@ -21965,7 +22249,7 @@ function resolveActionVersion(explicit) {
   if (explicit) {
     return explicit;
   }
-  return "1.0.3" ? "1.0.3" : "unknown";
+  return "2.0.0" ? "2.0.0" : "unknown";
 }
 function telemetryDisabled(env) {
   const flag = String(env.POSTMAN_ACTIONS_TELEMETRY ?? "").trim().toLowerCase();
@@ -21994,7 +22278,7 @@ function maybeNotice(logger) {
     return;
   }
   noticeShown = true;
-  logger.info("note: postman-actions sends anonymous usage data (team id, action, CI provider, account type). Disable with POSTMAN_ACTIONS_TELEMETRY=off or DO_NOT_TRACK=1.");
+  logger.info("note: postman-actions sends anonymous usage data (team id, action, CI provider, account type, run trigger, runner OS). Disable with POSTMAN_ACTIONS_TELEMETRY=off or DO_NOT_TRACK=1.");
 }
 function buildTelemetryEvent(params) {
   const { action, actionVersion, teamId, accountType, outcome, env, now } = params;
@@ -22016,6 +22300,9 @@ function buildTelemetryEvent(params) {
     repo_id: repoSource ? sha256(repoSource) : void 0,
     org_id: owner ? sha256(owner) : void 0,
     account_type: accountType,
+    event_trigger: ci.eventTrigger,
+    runner_os: ci.runnerOs,
+    ref_kind: repo.refKind,
     outcome,
     ts: now()
   };
@@ -22351,19 +22638,39 @@ async function resolveApiKeyAndTeamId(inputs, client, reporter = core_exports) {
   }
   return { apiKey, teamId: resolvedTeamId, pmakIdentity };
 }
-async function runCredentialPreflightForInputs(inputs, pmak, reporter, fetchImpl) {
+async function runCredentialPreflightForInputs(inputs, pmak, reporter, fetchImpl, liveAccessToken) {
+  const accessToken = liveAccessToken ?? inputs.postmanAccessToken;
   await runCredentialPreflight({
     apiBaseUrl: inputs.postmanApiBase || DEFAULT_POSTMAN_API_BASE,
     iapubBaseUrl: inputs.postmanIapubBase || DEFAULT_POSTMAN_IAPUB_BASE,
     pmak,
-    postmanAccessToken: inputs.postmanAccessToken,
+    postmanAccessToken: accessToken,
     explicitTeamId: inputs.postmanTeamId || void 0,
     mode: inputs.credentialPreflight,
-    mask: createSecretMasker([inputs.postmanApiKey, inputs.postmanAccessToken]),
+    mask: createSecretMasker([inputs.postmanApiKey, accessToken]),
     log: reporter,
     fetchImpl
   });
 }
+function createInsightsTokenProvider(inputs, reporter, apiKey = inputs.postmanApiKey) {
+  return new AccessTokenProvider({
+    accessToken: inputs.postmanAccessToken,
+    apiKey,
+    apiBaseUrl: inputs.postmanApiBase || DEFAULT_POSTMAN_API_BASE,
+    onToken: (token) => reporter.setSecret(token)
+  });
+}
+function createInsightsBifrostClient(inputs, tokenProvider, teamId, apiKey) {
+  return new BifrostCatalogClient({
+    tokenProvider,
+    accessToken: tokenProvider.current(),
+    teamId,
+    apiKey,
+    bifrostBaseUrl: inputs.postmanBifrostBase,
+    observabilityBaseUrl: inputs.postmanObservabilityBase,
+    observabilityEnv: inputs.postmanObservabilityEnv
+  });
+}
 async function runAction() {
   const inputs = resolveInputs();
   const planned = createPlannedOutputs(inputs);
@@ -22373,28 +22680,32 @@ async function runAction() {
   setSecret(inputs.postmanAccessToken);
   if (inputs.postmanApiKey) setSecret(inputs.postmanApiKey);
   if (inputs.githubToken) setSecret(inputs.githubToken);
-  const preliminaryClient = new BifrostCatalogClient({
-    accessToken: inputs.postmanAccessToken,
-    teamId: inputs.postmanTeamId,
-    apiKey: inputs.postmanApiKey,
-    bifrostBaseUrl: inputs.postmanBifrostBase,
-    observabilityBaseUrl: inputs.postmanObservabilityBase,
-    observabilityEnv: inputs.postmanObservabilityEnv
-  });
+  const tokenProvider = createInsightsTokenProvider(inputs, core_exports);
+  const preliminaryClient = createInsightsBifrostClient(
+    inputs,
+    tokenProvider,
+    inputs.postmanTeamId,
+    inputs.postmanApiKey
+  );
   const { apiKey, teamId, pmakIdentity } = await resolveApiKeyAndTeamId(inputs, preliminaryClient, core_exports);
+  const activeTokenProvider = apiKey !== inputs.postmanApiKey ? new AccessTokenProvider({
+    accessToken: tokenProvider.current(),
+    apiKey,
+    apiBaseUrl: inputs.postmanApiBase || DEFAULT_POSTMAN_API_BASE,
+    onToken: (token) => setSecret(token)
+  }) : tokenProvider;
   const telemetry = createTelemetryContext({ action: "postman-insights-onboarding-action", logger: core_exports });
   telemetry.setTeamId(inputs.postmanTeamId || pmakIdentity?.teamId);
   let result;
   try {
-    await runCredentialPreflightForInputs(inputs, pmakIdentity, core_exports);
-    const client = new BifrostCatalogClient({
-      accessToken: inputs.postmanAccessToken,
-      teamId,
-      apiKey,
-      bifrostBaseUrl: inputs.postmanBifrostBase,
-      observabilityBaseUrl: inputs.postmanObservabilityBase,
-      observabilityEnv: inputs.postmanObservabilityEnv
-    });
+    await runCredentialPreflightForInputs(
+      inputs,
+      pmakIdentity,
+      core_exports,
+      void 0,
+      activeTokenProvider.current()
+    );
+    const client = createInsightsBifrostClient(inputs, activeTokenProvider, teamId, apiKey);
     result = await runOnboarding(inputs, client, sleep, core_exports);
   } catch (error2) {
     const message = error2 instanceof Error ? error2.message : String(error2);