@postman-cse/onboarding-insights 1.0.4 → 2.1.0

package/dist/cli.cjs

@@ -12167,7 +12167,7 @@ var require_response = __commonJS({
     var assert = require("node:assert");
     var { types } = require("node:util");
     var textEncoder = new TextEncoder("utf-8");
-    var Response = class _Response {
+    var Response2 = class _Response {
       // Creates network error Response.
       static error() {
         const responseObject = fromInnerResponse(makeNetworkError(), "immutable");
@@ -12310,8 +12310,8 @@ var require_response = __commonJS({
         return `Response ${nodeUtil.formatWithOptions(options, properties)}`;
       }
     };
-    mixinBody(Response);
-    Object.defineProperties(Response.prototype, {
+    mixinBody(Response2);
+    Object.defineProperties(Response2.prototype, {
       type: kEnumerableProperty,
       url: kEnumerableProperty,
       status: kEnumerableProperty,
@@ -12327,7 +12327,7 @@ var require_response = __commonJS({
         configurable: true
       }
     });
-    Object.defineProperties(Response, {
+    Object.defineProperties(Response2, {
       json: kEnumerableProperty,
       redirect: kEnumerableProperty,
       error: kEnumerableProperty
@@ -12460,7 +12460,7 @@ var require_response = __commonJS({
       }
     }
     function fromInnerResponse(innerResponse, guard) {
-      const response = new Response(kConstruct);
+      const response = new Response2(kConstruct);
       response[kState] = innerResponse;
       response[kHeaders] = new Headers3(kConstruct);
       setHeadersList(response[kHeaders], innerResponse.headersList);
@@ -12528,7 +12528,7 @@ var require_response = __commonJS({
       makeResponse,
       makeAppropriateNetworkError,
       filterResponse,
-      Response,
+      Response: Response2,
       cloneResponse,
       fromInnerResponse
     };
@@ -15200,7 +15200,7 @@ var require_cache = __commonJS({
     var { urlEquals, getFieldValues } = require_util5();
     var { kEnumerableProperty, isDisturbed } = require_util();
     var { webidl } = require_webidl();
-    var { Response, cloneResponse, fromInnerResponse } = require_response();
+    var { Response: Response2, cloneResponse, fromInnerResponse } = require_response();
     var { Request, fromInnerRequest } = require_request2();
     var { kState } = require_symbols2();
     var { fetching } = require_fetch();
@@ -15727,7 +15727,7 @@ var require_cache = __commonJS({
         converter: webidl.converters.DOMString
       }
     ]);
-    webidl.converters.Response = webidl.interfaceConverter(Response);
+    webidl.converters.Response = webidl.interfaceConverter(Response2);
     webidl.converters["sequence<RequestInfo>"] = webidl.sequenceConverter(
       webidl.converters.RequestInfo
     );
@@ -18685,9 +18685,259 @@ __export(cli_exports, {
   toDotenv: () => toDotenv
 });
 module.exports = __toCommonJS(cli_exports);
-var import_node_fs = require("node:fs");
+var import_node_fs2 = require("node:fs");
 var import_promises = require("node:fs/promises");
-var import_node_path = __toESM(require("node:path"), 1);
+var import_node_path2 = __toESM(require("node:path"), 1);
+
+// src/lib/retry.ts
+function sleep(delayMs) {
+  return new Promise((resolve2) => {
+    setTimeout(resolve2, delayMs);
+  });
+}
+function normalizeRetryOptions(options) {
+  return {
+    maxAttempts: Math.max(1, options.maxAttempts ?? 3),
+    delayMs: Math.max(0, options.delayMs ?? 2e3),
+    backoffMultiplier: Math.max(1, options.backoffMultiplier ?? 1),
+    maxDelayMs: options.maxDelayMs === void 0 ? Number.POSITIVE_INFINITY : Math.max(0, options.maxDelayMs),
+    onRetry: options.onRetry ?? (async () => void 0),
+    shouldRetry: options.shouldRetry ?? (() => true),
+    sleep: options.sleep ?? sleep
+  };
+}
+async function retry(operation, options = {}) {
+  const normalized = normalizeRetryOptions(options);
+  let nextDelayMs = normalized.delayMs;
+  for (let attempt = 1; attempt <= normalized.maxAttempts; attempt += 1) {
+    try {
+      return await operation();
+    } catch (error2) {
+      const shouldRetry = attempt < normalized.maxAttempts && normalized.shouldRetry(error2, {
+        attempt,
+        maxAttempts: normalized.maxAttempts
+      });
+      if (!shouldRetry) {
+        throw error2;
+      }
+      await normalized.onRetry({
+        attempt,
+        maxAttempts: normalized.maxAttempts,
+        delayMs: nextDelayMs,
+        error: error2
+      });
+      await normalized.sleep(nextDelayMs);
+      nextDelayMs = Math.min(
+        normalized.maxDelayMs,
+        Math.round(nextDelayMs * normalized.backoffMultiplier)
+      );
+    }
+  }
+  throw new Error("Retry exhausted without returning or throwing");
+}
+
+// src/lib/postman/base-urls.ts
+var POSTMAN_ENDPOINT_PROFILES = {
+  prod: {
+    apiBaseUrl: "https://api.getpostman.com",
+    bifrostBaseUrl: "https://bifrost-premium-https-v4.gw.postman.com",
+    iapubBaseUrl: "https://iapub.postman.co",
+    observabilityBaseUrl: "https://api.observability.postman.com",
+    observabilityEnv: "production"
+  },
+  beta: {
+    apiBaseUrl: "https://api.getpostman-beta.com",
+    bifrostBaseUrl: "https://bifrost-https-v4.gw.postman-beta.com",
+    iapubBaseUrl: "https://iapub.postman.co",
+    observabilityBaseUrl: "https://api.observability.postman-beta.com",
+    observabilityEnv: "beta"
+  }
+};
+function parsePostmanRegion(value) {
+  const normalized = String(value || "us").trim().toLowerCase();
+  if (normalized === "us" || normalized === "eu") {
+    return normalized;
+  }
+  throw new Error(`Unsupported postman-region "${value}". Supported values: us, eu`);
+}
+function parsePostmanStack(value) {
+  const normalized = String(value || "prod").trim().toLowerCase();
+  if (normalized === "prod" || normalized === "beta") {
+    return normalized;
+  }
+  throw new Error(`Unsupported postman-stack "${value}". Supported values: prod, beta`);
+}
+function resolvePostmanEndpointProfile(stack, region = "us") {
+  if (stack === "beta" && region !== "us") {
+    throw new Error("postman-region=eu is only supported with postman-stack=prod");
+  }
+  const profile = POSTMAN_ENDPOINT_PROFILES[stack];
+  if (region === "eu") {
+    return {
+      ...profile,
+      apiBaseUrl: "https://api.eu.postman.com"
+    };
+  }
+  return profile;
+}
+
+// src/lib/postman/token-provider.ts
+var MintError = class extends Error {
+  permanent;
+  constructor(message, permanent) {
+    super(message);
+    this.name = "MintError";
+    this.permanent = permanent;
+  }
+};
+function extractAccessToken(payload) {
+  if (!payload || typeof payload !== "object") return void 0;
+  const record = payload;
+  const direct = record.access_token;
+  if (typeof direct === "string" && direct.trim()) return direct.trim();
+  const session = record.session;
+  if (session && typeof session === "object") {
+    const token = session.token;
+    if (typeof token === "string" && token.trim()) return token.trim();
+  }
+  return void 0;
+}
+var AccessTokenProvider = class {
+  token;
+  apiKey;
+  apiBaseUrl;
+  fetchImpl;
+  maxAttempts;
+  onToken;
+  sleep;
+  inflight;
+  constructor(options) {
+    this.token = String(options.accessToken || "").trim();
+    this.apiKey = String(options.apiKey || "").trim();
+    this.apiBaseUrl = String(
+      options.apiBaseUrl || POSTMAN_ENDPOINT_PROFILES.prod.apiBaseUrl
+    ).replace(/\/+$/, "");
+    this.fetchImpl = options.fetchImpl ?? fetch;
+    this.maxAttempts = Math.max(1, options.maxAttempts ?? 2);
+    this.onToken = options.onToken;
+    this.sleep = options.sleep;
+  }
+  current() {
+    return this.token;
+  }
+  /** True when a PMAK is present, so an expired token can be re-minted. */
+  canRefresh() {
+    return Boolean(this.apiKey);
+  }
+  refresh() {
+    this.inflight ??= this.mintWithRetry().finally(() => {
+      this.inflight = void 0;
+    });
+    return this.inflight;
+  }
+  async mintWithRetry() {
+    if (!this.apiKey) {
+      throw new Error(
+        "postman: the access token expired and cannot be refreshed because no postman-api-key is present. Service-account access tokens expire after about 1 to 1.5 hours. Re-mint a fresh token (postman-resolve-service-token-action) and re-run."
+      );
+    }
+    const token = await retry(() => this.mintOnce(), {
+      maxAttempts: this.maxAttempts,
+      delayMs: 1e3,
+      backoffMultiplier: 2,
+      ...this.sleep ? { sleep: this.sleep } : {},
+      shouldRetry: (error2) => !(error2 instanceof MintError && error2.permanent)
+    });
+    this.token = token;
+    this.onToken?.(token);
+    return token;
+  }
+  async mintOnce() {
+    const response = await this.fetchImpl(`${this.apiBaseUrl}/service-account-tokens`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "x-api-key": this.apiKey
+      },
+      body: JSON.stringify({ apiKey: this.apiKey })
+    });
+    const body = await response.text().catch(() => "");
+    if (!response.ok) {
+      const status = response.status;
+      if (status === 401 || status === 403) {
+        throw new MintError(
+          `postman: re-mint failed because the postman-api-key was rejected (PMAK rejected, HTTP ${status}); confirm it is a valid, enabled service-account PMAK for the intended team.`,
+          true
+        );
+      }
+      if (status === 400 && body.toLowerCase().includes("service accounts not enabled")) {
+        throw new MintError(
+          "postman: re-mint failed because service accounts are not enabled for this team; enable them in Team Settings or use a team where they are.",
+          true
+        );
+      }
+      throw new MintError(`postman: re-mint failed (service-account-tokens HTTP ${status}).`, false);
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(body);
+    } catch {
+      parsed = void 0;
+    }
+    const token = extractAccessToken(parsed);
+    if (!token) {
+      throw new MintError("postman: re-mint succeeded but no access token was returned.", false);
+    }
+    return token;
+  }
+};
+async function describeMintFailure(mintError, apiKey, apiBaseUrl, fetchImpl) {
+  const raw = mintError instanceof Error ? mintError.message : String(mintError);
+  const rejected = /HTTP 40[13]|PMAK rejected/.test(raw);
+  if (!rejected) {
+    return raw;
+  }
+  try {
+    const me = await fetchImpl(`${apiBaseUrl}/me`, { headers: { "x-api-key": apiKey } });
+    if (me.ok) {
+      const body = await me.json().catch(() => void 0);
+      const user = body?.user;
+      const looksPersonal = Boolean(user && (user.username || user.email));
+      if (looksPersonal) {
+        return "Personal API key detected, cannot mint a service-account access token. POST /service-account-tokens only accepts a SERVICE-ACCOUNT API key; this postman-api-key belongs to a user account" + (user?.teamId ? ` (team ${user.teamId})` : "") + ". Create a service account in Team Settings and use its PMAK, or mint the token elsewhere and pass postman-access-token.";
+      }
+      return "The postman-api-key authenticates (GET /me OK) but was rejected by POST /service-account-tokens" + (user?.teamId ? ` (team ${user.teamId})` : "") + ". The service account likely lacks permission to mint access tokens, or service accounts are restricted for this team. Check the service account role in Team Settings, or pass a pre-minted postman-access-token.";
+    }
+    return "The postman-api-key is invalid, disabled, or expired (rejected by both POST /service-account-tokens and GET /me). Generate a fresh service-account PMAK in Team Settings and update the secret.";
+  } catch {
+    return raw;
+  }
+}
+async function mintAccessTokenIfNeeded(inputs, log, setSecret2, fetchImpl = fetch) {
+  if (inputs.postmanAccessToken || !inputs.postmanApiKey) {
+    return;
+  }
+  const apiBaseUrl = String(
+    inputs.postmanApiBase || POSTMAN_ENDPOINT_PROFILES.prod.apiBaseUrl
+  ).replace(/\/+$/, "");
+  const provider = new AccessTokenProvider({
+    apiKey: inputs.postmanApiKey,
+    apiBaseUrl,
+    fetchImpl,
+    onToken: (token) => setSecret2?.(token)
+  });
+  try {
+    inputs.postmanAccessToken = await provider.refresh();
+    log.info(
+      "postman: no postman-access-token configured - minted a short-lived service-account access token from the postman-api-key."
+    );
+  } catch (error2) {
+    const diagnosis = await describeMintFailure(error2, inputs.postmanApiKey, apiBaseUrl, fetchImpl);
+    log.warning(
+      "postman: could not mint an access token from the postman-api-key. " + diagnosis + " Continuing without an access token - access-token-only functionality will be unavailable unless postman-access-token is provided."
+    );
+  }
+}
 
 // node_modules/@actions/core/lib/core.js
 var core_exports = {};
@@ -20964,12 +21214,62 @@ function getIDToken(aud) {
 
 // src/lib/credential-identity.ts
 var sessionPath = "/api/sessions/current";
+var SESSION_MAX_ATTEMPTS = 3;
+var SESSION_RETRY_BASE_DELAY_MS = 500;
+var SESSION_RETRY_MAX_DELAY_MS = 8e3;
 var pmakMemo = /* @__PURE__ */ new Map();
 var sessionMemo = /* @__PURE__ */ new Map();
 var memoizedSessionIdentity;
+var memoizedSessionFailure;
+function defaultSessionSleep(ms) {
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
+}
+function defaultRandom() {
+  return Math.random();
+}
+function parseRetryAfterMs(value) {
+  const trimmed = value?.trim();
+  if (!trimmed) {
+    return void 0;
+  }
+  if (/^\d+$/.test(trimmed)) {
+    return Number(trimmed) * 1e3;
+  }
+  const dateMs = Date.parse(trimmed);
+  if (!Number.isNaN(dateMs)) {
+    return Math.max(0, dateMs - Date.now());
+  }
+  return void 0;
+}
+function parseRateLimitResetMs(value) {
+  const trimmed = value?.trim();
+  if (!trimmed || !/^\d+$/.test(trimmed)) {
+    return void 0;
+  }
+  const seconds = Number(trimmed);
+  const nowSeconds = Date.now() / 1e3;
+  if (seconds > nowSeconds) {
+    return Math.max(0, (seconds - nowSeconds) * 1e3);
+  }
+  return seconds * 1e3;
+}
+function computeSessionRetryDelayMs(response, attempt, random) {
+  const headers = response?.headers;
+  const signal = parseRetryAfterMs(headers?.get("retry-after") ?? null) ?? parseRateLimitResetMs(
+    headers?.get("ratelimit-reset") ?? headers?.get("x-ratelimit-reset") ?? null
+  );
+  if (signal !== void 0) {
+    return Math.min(Math.max(0, signal), SESSION_RETRY_MAX_DELAY_MS);
+  }
+  const ceiling = Math.min(SESSION_RETRY_MAX_DELAY_MS, SESSION_RETRY_BASE_DELAY_MS * 2 ** (attempt - 1));
+  return Math.round(random() * ceiling);
+}
 function getMemoizedSessionIdentity() {
   return memoizedSessionIdentity;
 }
+function getSessionResolutionFailure() {
+  return memoizedSessionFailure;
+}
 function asRecord(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     return void 0;
@@ -21038,46 +21338,90 @@ async function resolveSessionIdentity(opts) {
   const memoKey = `${baseUrl}::${accessToken}`;
   let pending = sessionMemo.get(memoKey);
   if (!pending) {
-    pending = probeSessionIdentity(baseUrl, accessToken, opts.fetchImpl ?? fetch);
+    pending = probeSessionIdentity(
+      baseUrl,
+      accessToken,
+      opts.fetchImpl ?? fetch,
+      Math.max(1, opts.maxAttempts ?? SESSION_MAX_ATTEMPTS),
+      opts.sleepImpl ?? defaultSessionSleep,
+      opts.randomImpl ?? defaultRandom
+    );
     sessionMemo.set(memoKey, pending);
   }
   return pending;
 }
-async function probeSessionIdentity(baseUrl, accessToken, fetchImpl) {
+async function parseSessionResponse(response) {
+  let payload;
   try {
-    const response = await fetchImpl(`${baseUrl}${sessionPath}`, {
-      method: "GET",
-      headers: { "x-access-token": accessToken }
-    });
-    if (!response.ok) {
-      return void 0;
-    }
-    const payload = asRecord(await response.json());
-    if (!payload) {
-      return void 0;
-    }
-    const root = asRecord(payload.session) ?? payload;
-    const identity = asRecord(root.identity);
-    const data = asRecord(root.data);
-    const user = asRecord(data?.user);
-    const roleEntries = Array.isArray(user?.roles) ? user.roles.map((entry) => coerceText(entry) ?? coerceId(entry)).filter((entry) => Boolean(entry)) : [];
-    const singleRole = coerceText(user?.role);
-    const roles = roleEntries.length > 0 ? roleEntries : singleRole ? [singleRole] : void 0;
-    const resolved = {
-      source: "iapub/sessions",
-      userId: coerceId(identity?.user) ?? coerceId(user?.id),
-      fullName: coerceText(user?.fullName) ?? coerceText(user?.name) ?? coerceText(user?.username),
-      teamId: coerceId(identity?.team),
-      teamName: coerceText(user?.teamName),
-      teamDomain: coerceText(identity?.domain),
-      ...roles ? { roles } : {},
-      consumerType: coerceText(root.consumerType) ?? coerceText(data?.consumerType) ?? coerceText(user?.consumerType)
-    };
-    memoizedSessionIdentity = resolved;
-    return resolved;
+    payload = asRecord(await response.json());
   } catch {
     return void 0;
   }
+  if (!payload) {
+    return void 0;
+  }
+  const root = asRecord(payload.session) ?? payload;
+  const identity = asRecord(root.identity);
+  const data = asRecord(root.data);
+  const user = asRecord(data?.user);
+  const roleEntries = Array.isArray(user?.roles) ? user.roles.map((entry) => coerceText(entry) ?? coerceId(entry)).filter((entry) => Boolean(entry)) : [];
+  const singleRole = coerceText(user?.role);
+  const roles = roleEntries.length > 0 ? roleEntries : singleRole ? [singleRole] : void 0;
+  return {
+    source: "iapub/sessions",
+    userId: coerceId(identity?.user) ?? coerceId(user?.id),
+    fullName: coerceText(user?.fullName) ?? coerceText(user?.name) ?? coerceText(user?.username),
+    teamId: coerceId(identity?.team),
+    teamName: coerceText(user?.teamName),
+    teamDomain: coerceText(identity?.domain),
+    ...roles ? { roles } : {},
+    consumerType: coerceText(root.consumerType) ?? coerceText(data?.consumerType) ?? coerceText(user?.consumerType)
+  };
+}
+async function probeSessionIdentity(baseUrl, accessToken, fetchImpl, maxAttempts, sleepImpl, random) {
+  let failure = "unavailable";
+  for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+    let response;
+    try {
+      response = await fetchImpl(`${baseUrl}${sessionPath}`, {
+        method: "GET",
+        headers: { "x-access-token": accessToken }
+      });
+    } catch {
+      failure = "unavailable";
+      if (attempt < maxAttempts) {
+        await sleepImpl(computeSessionRetryDelayMs(void 0, attempt, random));
+        continue;
+      }
+      break;
+    }
+    if (response.ok) {
+      const resolved = await parseSessionResponse(response);
+      if (resolved) {
+        memoizedSessionIdentity = resolved;
+        memoizedSessionFailure = void 0;
+        return resolved;
+      }
+      failure = "unavailable";
+      break;
+    }
+    if (response.status === 401 || response.status === 403) {
+      failure = "auth";
+      break;
+    }
+    if (response.status === 429 || response.status >= 500) {
+      failure = "unavailable";
+      if (attempt < maxAttempts) {
+        await sleepImpl(computeSessionRetryDelayMs(response, attempt, random));
+        continue;
+      }
+      break;
+    }
+    failure = "unavailable";
+    break;
+  }
+  memoizedSessionFailure = failure;
+  return void 0;
 }
 function describeTeam(id) {
   const label = id?.teamName ?? id?.teamDomain;
@@ -21170,7 +21514,9 @@ async function runCredentialPreflight(args) {
     session = await resolveSessionIdentity({
       iapubBaseUrl: args.iapubBaseUrl,
       accessToken,
-      fetchImpl: args.fetchImpl
+      fetchImpl: args.fetchImpl,
+      ...args.sleepImpl ? { sleepImpl: args.sleepImpl } : {},
+      ...args.randomImpl ? { randomImpl: args.randomImpl } : {}
     });
   } catch (error2) {
     args.log.warning(
@@ -21190,11 +21536,20 @@ async function runCredentialPreflight(args) {
       );
     }
   } else {
+    const failure = getSessionResolutionFailure();
+    const detail = failure === "auth" ? "the access token was rejected by iapub (401/403), so it is invalid or expired. Re-mint it with postman-resolve-service-token-action (or POST https://api.getpostman.com/service-account-tokens) and re-run." : "iapub was unreachable after retries (network or 5xx). This is usually transient; re-run the job.";
+    const base = "postman: credential preflight could not resolve the access-token session identity from iapub: " + detail;
+    if (args.mode === "enforce") {
+      throw new Error(
+        mask(
+          `${base} (credential-preflight: enforce requires a resolvable session identity; use credential-preflight: warn to continue with reactive error guidance only.)`
+        )
+      );
+    }
     args.log.warning(
-      mask(
-        "postman: credential preflight could not resolve the access-token session identity from iapub; continuing with reactive error guidance only"
-      )
+      mask(`${base} Continuing with reactive error guidance only (credential-preflight: warn).`)
     );
+    return;
   }
   const result = crossCheckIdentities({
     pmak,
@@ -21404,98 +21759,6 @@ var HttpError = class _HttpError extends Error {
   }
 };
 
-// src/lib/retry.ts
-function sleep(delayMs) {
-  return new Promise((resolve2) => {
-    setTimeout(resolve2, delayMs);
-  });
-}
-function normalizeRetryOptions(options) {
-  return {
-    maxAttempts: Math.max(1, options.maxAttempts ?? 3),
-    delayMs: Math.max(0, options.delayMs ?? 2e3),
-    backoffMultiplier: Math.max(1, options.backoffMultiplier ?? 1),
-    maxDelayMs: options.maxDelayMs === void 0 ? Number.POSITIVE_INFINITY : Math.max(0, options.maxDelayMs),
-    onRetry: options.onRetry ?? (async () => void 0),
-    shouldRetry: options.shouldRetry ?? (() => true),
-    sleep: options.sleep ?? sleep
-  };
-}
-async function retry(operation, options = {}) {
-  const normalized = normalizeRetryOptions(options);
-  let nextDelayMs = normalized.delayMs;
-  for (let attempt = 1; attempt <= normalized.maxAttempts; attempt += 1) {
-    try {
-      return await operation();
-    } catch (error2) {
-      const shouldRetry = attempt < normalized.maxAttempts && normalized.shouldRetry(error2, {
-        attempt,
-        maxAttempts: normalized.maxAttempts
-      });
-      if (!shouldRetry) {
-        throw error2;
-      }
-      await normalized.onRetry({
-        attempt,
-        maxAttempts: normalized.maxAttempts,
-        delayMs: nextDelayMs,
-        error: error2
-      });
-      await normalized.sleep(nextDelayMs);
-      nextDelayMs = Math.min(
-        normalized.maxDelayMs,
-        Math.round(nextDelayMs * normalized.backoffMultiplier)
-      );
-    }
-  }
-  throw new Error("Retry exhausted without returning or throwing");
-}
-
-// src/lib/postman/base-urls.ts
-var POSTMAN_ENDPOINT_PROFILES = {
-  prod: {
-    apiBaseUrl: "https://api.getpostman.com",
-    bifrostBaseUrl: "https://bifrost-premium-https-v4.gw.postman.com",
-    iapubBaseUrl: "https://iapub.postman.co",
-    observabilityBaseUrl: "https://api.observability.postman.com",
-    observabilityEnv: "production"
-  },
-  beta: {
-    apiBaseUrl: "https://api.getpostman-beta.com",
-    bifrostBaseUrl: "https://bifrost-https-v4.gw.postman-beta.com",
-    iapubBaseUrl: "https://iapub.postman.co",
-    observabilityBaseUrl: "https://api.observability.postman-beta.com",
-    observabilityEnv: "beta"
-  }
-};
-function parsePostmanRegion(value) {
-  const normalized = String(value || "us").trim().toLowerCase();
-  if (normalized === "us" || normalized === "eu") {
-    return normalized;
-  }
-  throw new Error(`Unsupported postman-region "${value}". Supported values: us, eu`);
-}
-function parsePostmanStack(value) {
-  const normalized = String(value || "prod").trim().toLowerCase();
-  if (normalized === "prod" || normalized === "beta") {
-    return normalized;
-  }
-  throw new Error(`Unsupported postman-stack "${value}". Supported values: prod, beta`);
-}
-function resolvePostmanEndpointProfile(stack, region = "us") {
-  if (stack === "beta" && region !== "us") {
-    throw new Error("postman-region=eu is only supported with postman-stack=prod");
-  }
-  const profile = POSTMAN_ENDPOINT_PROFILES[stack];
-  if (region === "eu") {
-    return {
-      ...profile,
-      apiBaseUrl: "https://api.eu.postman.com"
-    };
-  }
-  return profile;
-}
-
 // src/lib/bifrost-client.ts
 var DEFAULT_BIFROST_BASE_URL = POSTMAN_ENDPOINT_PROFILES.prod.bifrostBaseUrl;
 var BIFROST_PROXY_PATH = "/ws/proxy";
@@ -21503,8 +21766,11 @@ var DEFAULT_OBSERVABILITY_BASE_URL = POSTMAN_ENDPOINT_PROFILES.prod.observabilit
 var DEFAULT_OBSERVABILITY_ENV = POSTMAN_ENDPOINT_PROFILES.prod.observabilityEnv;
 var MAX_DISCOVERED_SERVICE_PAGES = 100;
 var MAX_PROVIDER_SERVICE_PAGES = 100;
+function isExpiredAuthError(status, body) {
+  return status === 401 || body.includes("UNAUTHENTICATED") || body.includes("authenticationError");
+}
 var BifrostCatalogClient = class {
-  accessToken;
+  tokenProvider;
   teamId;
   apiKey;
   fetchFn;
@@ -21513,11 +21779,14 @@ var BifrostCatalogClient = class {
   observabilityBaseUrl;
   observabilityEnv;
   constructor(options) {
-    this.accessToken = options.accessToken;
+    this.tokenProvider = options.tokenProvider ?? new AccessTokenProvider({
+      accessToken: options.accessToken,
+      apiKey: options.apiKey
+    });
     this.teamId = options.teamId;
     this.apiKey = options.apiKey;
     this.fetchFn = options.fetchFn ?? globalThis.fetch;
-    this.secretValues = [options.accessToken, options.apiKey].filter(Boolean);
+    this.secretValues = [this.tokenProvider.current(), options.apiKey].filter(Boolean);
     const base = (options.bifrostBaseUrl || DEFAULT_BIFROST_BASE_URL).replace(/\/+$/, "");
     this.bifrostProxyUrl = `${base}${BIFROST_PROXY_PATH}`;
     this.observabilityBaseUrl = (options.observabilityBaseUrl || DEFAULT_OBSERVABILITY_BASE_URL).replace(/\/+$/, "");
@@ -21529,6 +21798,11 @@ var BifrostCatalogClient = class {
       this.secretValues.push(apiKey);
     }
   }
+  registerAccessToken(token) {
+    if (token && !this.secretValues.includes(token)) {
+      this.secretValues.push(token);
+    }
+  }
   /**
    * Build Bifrost proxy headers.
    * x-entity-team-id is ONLY included when teamId is present (org-mode tokens).
@@ -21536,7 +21810,7 @@ var BifrostCatalogClient = class {
    */
   headers() {
     const h = {
-      "x-access-token": this.accessToken,
+      "x-access-token": this.tokenProvider.current(),
       "Content-Type": "application/json"
     };
     if (this.teamId) {
@@ -21552,7 +21826,7 @@ var BifrostCatalogClient = class {
     const session = getMemoizedSessionIdentity();
     return {
       operation,
-      hasAccessToken: Boolean(this.accessToken),
+      hasAccessToken: Boolean(this.tokenProvider.current()),
       sessionTeamId: session?.teamId,
       sessionRoles: session?.roles,
       sessionConsumerType: session?.consumerType,
@@ -21561,7 +21835,7 @@ var BifrostCatalogClient = class {
     };
   }
   async proxyRequest(method, path7, body = {}, operation = "api-catalog request") {
-    const response = await this.fetchFn(this.bifrostProxyUrl, {
+    const send2 = async () => this.fetchFn(this.bifrostProxyUrl, {
       method: "POST",
       headers: this.headers(),
       body: JSON.stringify({
@@ -21571,6 +21845,39 @@ var BifrostCatalogClient = class {
         body
       })
     });
+    let response = await send2();
+    if (!response.ok) {
+      const bodyText = await response.text().catch(() => "");
+      if (isExpiredAuthError(response.status, bodyText) && this.tokenProvider.canRefresh()) {
+        try {
+          const refreshed = await this.tokenProvider.refresh();
+          this.registerAccessToken(refreshed);
+          response = await send2();
+        } catch {
+          const httpErr = await HttpError.fromResponse(
+            new Response(bodyText, { status: response.status, headers: response.headers }),
+            {
+              method: "POST",
+              url: `bifrost:api-catalog:${method} ${path7}`,
+              secretValues: this.secretValues
+            }
+          );
+          const advised = adviseFromHttpError(httpErr, this.adviceContext(operation));
+          throw advised ?? httpErr;
+        }
+      } else {
+        const httpErr = await HttpError.fromResponse(
+          new Response(bodyText, { status: response.status, headers: response.headers }),
+          {
+            method: "POST",
+            url: `bifrost:api-catalog:${method} ${path7}`,
+            secretValues: this.secretValues
+          }
+        );
+        const advised = adviseFromHttpError(httpErr, this.adviceContext(operation));
+        throw advised ?? httpErr;
+      }
+    }
     if (!response.ok) {
       const httpErr = await HttpError.fromResponse(response, {
         method: "POST",
@@ -21593,7 +21900,7 @@ var BifrostCatalogClient = class {
     return data;
   }
   async akitaProxyRequest(method, path7, body = {}, operation = "Insights request") {
-    const response = await this.fetchFn(this.bifrostProxyUrl, {
+    const send2 = async () => this.fetchFn(this.bifrostProxyUrl, {
       method: "POST",
       headers: this.headers(),
       body: JSON.stringify({
@@ -21603,8 +21910,30 @@ var BifrostCatalogClient = class {
         body
       })
     });
+    let response = await send2();
     if (!response.ok) {
       const text = await response.text().catch(() => "");
+      if (isExpiredAuthError(response.status, text) && this.tokenProvider.canRefresh()) {
+        try {
+          const refreshed = await this.tokenProvider.refresh();
+          this.registerAccessToken(refreshed);
+          response = await send2();
+          if (response.ok) {
+            const data2 = await response.json();
+            return { ok: true, status: response.status, data: data2, errorText: "" };
+          }
+          const retryText = await response.text().catch(() => "");
+          const advised2 = adviseFromBifrostBody(response.status, retryText, this.adviceContext(operation));
+          const errorText2 = advised2 ? retryText ? `${retryText}
+${advised2.message}` : advised2.message : retryText;
+          return { ok: false, status: response.status, data: null, errorText: errorText2 };
+        } catch {
+          const advised2 = adviseFromBifrostBody(response.status, text, this.adviceContext(operation));
+          const errorText2 = advised2 ? text ? `${text}
+${advised2.message}` : advised2.message : text;
+          return { ok: false, status: response.status, data: null, errorText: errorText2 };
+        }
+      }
       const advised = adviseFromBifrostBody(response.status, text, this.adviceContext(operation));
       const errorText = advised ? text ? `${text}
 ${advised.message}` : advised.message : text;
@@ -21703,12 +22032,19 @@ ${advised.message}` : advised.message : text;
       }
       page++;
     }
-    const fullName = clusterName ? `${clusterName}/${projectName}` : projectName;
-    const exactMatch = allServices.find((s) => s.name === fullName);
-    if (exactMatch) return exactMatch.id;
-    if (clusterName) return null;
-    const suffixMatch = allServices.find((s) => s.name.endsWith(`/${projectName}`));
-    return suffixMatch?.id || null;
+    if (clusterName) {
+      const fullName = `${clusterName}/${projectName}`;
+      const exactMatch = allServices.find((s) => s.name === fullName);
+      return exactMatch?.id || null;
+    }
+    const finalSegmentMatch = allServices.find(
+      (s) => getFinalServiceSegment(s.name) === projectName
+    );
+    if (finalSegmentMatch) return finalSegmentMatch.id;
+    const bracketedMatch = allServices.find(
+      (s) => getFinalServiceSegment(s.name).includes(`[${projectName}]`)
+    );
+    return bracketedMatch?.id || null;
   }
   async acknowledgeOnboarding(providerServiceId, workspaceId, systemEnvironmentId) {
     const result = await this.akitaProxyRequest(
@@ -21738,6 +22074,14 @@ ${advised.message}` : advised.message : text;
       throw new Error(`Workspace acknowledge failed: ${result.status} ${result.errorText}`);
     }
   }
+  // PMAK-only by proven exception. A live probe against the observability
+  // application-binding endpoint (POST /v2/agent/api-catalog/workspaces/:id/
+  // applications) showed x-access-token is rejected identically to the x-api-key
+  // control: both return 401 {"message":"Postman User not found"} for a
+  // service-account credential, because the observability service has no
+  // "Postman User" for a service account. The access token offers no improvement
+  // over the API key here, so this route is not migrated to access-token-primary
+  // (the suite-wide migration explicitly leaves probe-failed routes on PMAK).
   async createApplication(workspaceId, systemEnv) {
     const response = await this.fetchFn(
       `${this.observabilityBaseUrl}/v2/agent/api-catalog/workspaces/${workspaceId}/applications`,
@@ -21805,7 +22149,17 @@ function findDiscoveredService(services, projectName, clusterName) {
     const fullName = `${clusterName}/${projectName}`;
     return services.find((s) => s.name === fullName);
   }
-  return services.find((s) => s.name.endsWith(`/${projectName}`));
+  const finalSegmentMatch = services.find(
+    (service) => getFinalServiceSegment(service.name) === projectName
+  );
+  if (finalSegmentMatch) return finalSegmentMatch;
+  return services.find(
+    (service) => getFinalServiceSegment(service.name).includes(`[${projectName}]`)
+  );
+}
+function getFinalServiceSegment(serviceName) {
+  const lastSlash = serviceName.lastIndexOf("/");
+  return lastSlash === -1 ? serviceName : serviceName.slice(lastSlash + 1);
 }
 
 // node_modules/@postman-cse/automation-telemetry-core/dist/ci-context.js
@@ -22062,7 +22416,7 @@ function resolveActionVersion(explicit) {
   if (explicit) {
     return explicit;
   }
-  return "1.0.4" ? "1.0.4" : "unknown";
+  return typeof __ACTION_VERSION__ !== "undefined" && __ACTION_VERSION__ ? __ACTION_VERSION__ : "unknown";
 }
 function telemetryDisabled(env) {
   const flag = String(env.POSTMAN_ACTIONS_TELEMETRY ?? "").trim().toLowerCase();
@@ -22184,6 +22538,18 @@ function createTelemetryContext(options) {
   };
 }
 
+// src/action-version.ts
+var import_node_fs = require("node:fs");
+var import_node_path = require("node:path");
+function resolveActionVersion2() {
+  try {
+    const raw = (0, import_node_fs.readFileSync)((0, import_node_path.join)(__dirname, "..", "package.json"), "utf8");
+    return JSON.parse(raw).version ?? "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+
 // src/index.ts
 var POLL_TIMEOUT_MIN = 10;
 var POLL_TIMEOUT_MAX = 600;
@@ -22249,8 +22615,12 @@ function resolveInputs(env = process.env) {
   const projectName = get("project-name");
   if (!projectName) throw new Error("project-name is required");
   const postmanAccessToken = get("postman-access-token");
-  if (!postmanAccessToken) throw new Error("postman-access-token is required");
   const postmanApiKey = get("postman-api-key");
+  if (!postmanAccessToken && !postmanApiKey) {
+    throw new Error(
+      "postman-access-token is required (or provide a service-account postman-api-key so the action can mint one)."
+    );
+  }
   const postmanTeamId = get("postman-team-id") || env.POSTMAN_TEAM_ID?.trim() || "";
   const workspaceId = get("workspace-id") || env.POSTMAN_WORKSPACE_ID?.trim() || "";
   if (!workspaceId) {
@@ -22441,19 +22811,39 @@ async function resolveApiKeyAndTeamId(inputs, client, reporter = core_exports) {
   }
   return { apiKey, teamId: resolvedTeamId, pmakIdentity };
 }
-async function runCredentialPreflightForInputs(inputs, pmak, reporter, fetchImpl) {
+async function runCredentialPreflightForInputs(inputs, pmak, reporter, fetchImpl, liveAccessToken) {
+  const accessToken = liveAccessToken ?? inputs.postmanAccessToken;
   await runCredentialPreflight({
     apiBaseUrl: inputs.postmanApiBase || DEFAULT_POSTMAN_API_BASE,
     iapubBaseUrl: inputs.postmanIapubBase || DEFAULT_POSTMAN_IAPUB_BASE,
     pmak,
-    postmanAccessToken: inputs.postmanAccessToken,
+    postmanAccessToken: accessToken,
     explicitTeamId: inputs.postmanTeamId || void 0,
     mode: inputs.credentialPreflight,
-    mask: createSecretMasker([inputs.postmanApiKey, inputs.postmanAccessToken]),
+    mask: createSecretMasker([inputs.postmanApiKey, accessToken]),
     log: reporter,
     fetchImpl
   });
 }
+function createInsightsTokenProvider(inputs, reporter, apiKey = inputs.postmanApiKey) {
+  return new AccessTokenProvider({
+    accessToken: inputs.postmanAccessToken,
+    apiKey,
+    apiBaseUrl: inputs.postmanApiBase || DEFAULT_POSTMAN_API_BASE,
+    onToken: (token) => reporter.setSecret(token)
+  });
+}
+function createInsightsBifrostClient(inputs, tokenProvider, teamId, apiKey) {
+  return new BifrostCatalogClient({
+    tokenProvider,
+    accessToken: tokenProvider.current(),
+    teamId,
+    apiKey,
+    bifrostBaseUrl: inputs.postmanBifrostBase,
+    observabilityBaseUrl: inputs.postmanObservabilityBase,
+    observabilityEnv: inputs.postmanObservabilityEnv
+  });
+}
 
 // src/cli.ts
 var ConsoleReporter = class {
@@ -22534,13 +22924,13 @@ async function writeOptionalFile(filePath, content) {
   if (!filePath) {
     return;
   }
-  const workspaceRoot = import_node_path.default.resolve(process.cwd());
-  const resolved = import_node_path.default.resolve(workspaceRoot, filePath);
-  const relative2 = import_node_path.default.relative(workspaceRoot, resolved);
-  if (relative2.startsWith("..") || import_node_path.default.isAbsolute(relative2)) {
+  const workspaceRoot = import_node_path2.default.resolve(process.cwd());
+  const resolved = import_node_path2.default.resolve(workspaceRoot, filePath);
+  const relative2 = import_node_path2.default.relative(workspaceRoot, resolved);
+  if (relative2.startsWith("..") || import_node_path2.default.isAbsolute(relative2)) {
     throw new Error(`Output path must stay within workspace: ${filePath}`);
   }
-  await (0, import_promises.mkdir)(import_node_path.default.dirname(resolved), { recursive: true });
+  await (0, import_promises.mkdir)(import_node_path2.default.dirname(resolved), { recursive: true });
   await (0, import_promises.writeFile)(resolved, content, "utf8");
 }
 function toOutputs(result) {
@@ -22558,42 +22948,53 @@ async function runCli(argv = process.argv.slice(2), runtime = {}) {
   const config = parseCliArgs(argv, env);
   const inputs = resolveInputs(config.inputEnv);
   const reporter = new ConsoleReporter();
-  reporter.setSecret(inputs.postmanAccessToken);
+  const mintHolder = {
+    postmanAccessToken: inputs.postmanAccessToken,
+    postmanApiKey: inputs.postmanApiKey,
+    postmanApiBase: inputs.postmanApiBase
+  };
+  await mintAccessTokenIfNeeded(mintHolder, reporter, (secret) => reporter.setSecret(secret));
+  inputs.postmanAccessToken = mintHolder.postmanAccessToken;
+  if (inputs.postmanAccessToken) reporter.setSecret(inputs.postmanAccessToken);
   if (inputs.postmanApiKey) {
     reporter.setSecret(inputs.postmanApiKey);
   }
   if (inputs.githubToken) {
     reporter.setSecret(inputs.githubToken);
   }
-  const preliminaryClient = new BifrostCatalogClient({
-    accessToken: inputs.postmanAccessToken,
-    teamId: inputs.postmanTeamId,
-    apiKey: inputs.postmanApiKey,
-    bifrostBaseUrl: inputs.postmanBifrostBase,
-    observabilityBaseUrl: inputs.postmanObservabilityBase,
-    observabilityEnv: inputs.postmanObservabilityEnv
-  });
+  const tokenProvider = createInsightsTokenProvider(inputs, reporter);
+  const preliminaryClient = createInsightsBifrostClient(
+    inputs,
+    tokenProvider,
+    inputs.postmanTeamId,
+    inputs.postmanApiKey
+  );
   const { apiKey, teamId, pmakIdentity } = await resolveApiKeyAndTeamId(
     inputs,
     preliminaryClient,
     reporter
   );
-  const telemetry = createTelemetryContext({ action: "postman-insights-onboarding-action", logger: reporter });
+  const activeTokenProvider = apiKey !== inputs.postmanApiKey ? new AccessTokenProvider({
+    accessToken: tokenProvider.current(),
+    apiKey,
+    apiBaseUrl: inputs.postmanApiBase || DEFAULT_POSTMAN_API_BASE,
+    onToken: (token) => reporter.setSecret(token)
+  }) : tokenProvider;
+  const telemetry = createTelemetryContext({ action: "postman-insights-onboarding-action", actionVersion: resolveActionVersion2(), logger: reporter });
   telemetry.setTeamId(inputs.postmanTeamId || pmakIdentity?.teamId);
   if (apiKey) {
     reporter.setSecret(apiKey);
   }
   let result;
   try {
-    await runCredentialPreflightForInputs(inputs, pmakIdentity, reporter);
-    const client = new BifrostCatalogClient({
-      accessToken: inputs.postmanAccessToken,
-      teamId,
-      apiKey,
-      bifrostBaseUrl: inputs.postmanBifrostBase,
-      observabilityBaseUrl: inputs.postmanObservabilityBase,
-      observabilityEnv: inputs.postmanObservabilityEnv
-    });
+    await runCredentialPreflightForInputs(
+      inputs,
+      pmakIdentity,
+      reporter,
+      void 0,
+      activeTokenProvider.current()
+    );
+    const client = createInsightsBifrostClient(inputs, activeTokenProvider, teamId, apiKey);
     result = await (runtime.executeOnboarding ?? runOnboarding)(
       inputs,
       client,
@@ -22624,9 +23025,9 @@ function isEntrypoint(currentPath, entrypointPath) {
     return false;
   }
   try {
-    return (0, import_node_fs.realpathSync)(currentPath) === (0, import_node_fs.realpathSync)(entrypointPath);
+    return (0, import_node_fs2.realpathSync)(currentPath) === (0, import_node_fs2.realpathSync)(entrypointPath);
   } catch {
-    return import_node_path.default.resolve(currentPath) === import_node_path.default.resolve(entrypointPath);
+    return import_node_path2.default.resolve(currentPath) === import_node_path2.default.resolve(entrypointPath);
   }
 }
 if (isEntrypoint(currentModulePath, entrypoint)) {