@postman-cse/onboarding-insights 2.0.0 → 2.1.1

package/dist/index.cjs

@@ -18685,6 +18685,7 @@ __export(index_exports, {
   createInsightsBifrostClient: () => createInsightsBifrostClient,
   createInsightsTokenProvider: () => createInsightsTokenProvider,
   createPlannedOutputs: () => createPlannedOutputs,
+  getInput: () => getInput2,
   getTeams: () => getTeams,
   parsePreflightMode: () => parsePreflightMode,
   resolveApiKeyAndTeamId: () => resolveApiKeyAndTeamId,
@@ -20971,12 +20972,62 @@ function getIDToken(aud) {
 
 // src/lib/credential-identity.ts
 var sessionPath = "/api/sessions/current";
+var SESSION_MAX_ATTEMPTS = 3;
+var SESSION_RETRY_BASE_DELAY_MS = 500;
+var SESSION_RETRY_MAX_DELAY_MS = 8e3;
 var pmakMemo = /* @__PURE__ */ new Map();
 var sessionMemo = /* @__PURE__ */ new Map();
 var memoizedSessionIdentity;
+var memoizedSessionFailure;
+function defaultSessionSleep(ms) {
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
+}
+function defaultRandom() {
+  return Math.random();
+}
+function parseRetryAfterMs(value) {
+  const trimmed = value?.trim();
+  if (!trimmed) {
+    return void 0;
+  }
+  if (/^\d+$/.test(trimmed)) {
+    return Number(trimmed) * 1e3;
+  }
+  const dateMs = Date.parse(trimmed);
+  if (!Number.isNaN(dateMs)) {
+    return Math.max(0, dateMs - Date.now());
+  }
+  return void 0;
+}
+function parseRateLimitResetMs(value) {
+  const trimmed = value?.trim();
+  if (!trimmed || !/^\d+$/.test(trimmed)) {
+    return void 0;
+  }
+  const seconds = Number(trimmed);
+  const nowSeconds = Date.now() / 1e3;
+  if (seconds > nowSeconds) {
+    return Math.max(0, (seconds - nowSeconds) * 1e3);
+  }
+  return seconds * 1e3;
+}
+function computeSessionRetryDelayMs(response, attempt, random) {
+  const headers = response?.headers;
+  const signal = parseRetryAfterMs(headers?.get("retry-after") ?? null) ?? parseRateLimitResetMs(
+    headers?.get("ratelimit-reset") ?? headers?.get("x-ratelimit-reset") ?? null
+  );
+  if (signal !== void 0) {
+    return Math.min(Math.max(0, signal), SESSION_RETRY_MAX_DELAY_MS);
+  }
+  const ceiling = Math.min(SESSION_RETRY_MAX_DELAY_MS, SESSION_RETRY_BASE_DELAY_MS * 2 ** (attempt - 1));
+  return Math.round(random() * ceiling);
+}
 function getMemoizedSessionIdentity() {
   return memoizedSessionIdentity;
 }
+function getSessionResolutionFailure() {
+  return memoizedSessionFailure;
+}
 function asRecord(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     return void 0;
@@ -21045,46 +21096,90 @@ async function resolveSessionIdentity(opts) {
   const memoKey = `${baseUrl}::${accessToken}`;
   let pending = sessionMemo.get(memoKey);
   if (!pending) {
-    pending = probeSessionIdentity(baseUrl, accessToken, opts.fetchImpl ?? fetch);
+    pending = probeSessionIdentity(
+      baseUrl,
+      accessToken,
+      opts.fetchImpl ?? fetch,
+      Math.max(1, opts.maxAttempts ?? SESSION_MAX_ATTEMPTS),
+      opts.sleepImpl ?? defaultSessionSleep,
+      opts.randomImpl ?? defaultRandom
+    );
     sessionMemo.set(memoKey, pending);
   }
   return pending;
 }
-async function probeSessionIdentity(baseUrl, accessToken, fetchImpl) {
+async function parseSessionResponse(response) {
+  let payload;
   try {
-    const response = await fetchImpl(`${baseUrl}${sessionPath}`, {
-      method: "GET",
-      headers: { "x-access-token": accessToken }
-    });
-    if (!response.ok) {
-      return void 0;
-    }
-    const payload = asRecord(await response.json());
-    if (!payload) {
-      return void 0;
-    }
-    const root = asRecord(payload.session) ?? payload;
-    const identity = asRecord(root.identity);
-    const data = asRecord(root.data);
-    const user = asRecord(data?.user);
-    const roleEntries = Array.isArray(user?.roles) ? user.roles.map((entry) => coerceText(entry) ?? coerceId(entry)).filter((entry) => Boolean(entry)) : [];
-    const singleRole = coerceText(user?.role);
-    const roles = roleEntries.length > 0 ? roleEntries : singleRole ? [singleRole] : void 0;
-    const resolved = {
-      source: "iapub/sessions",
-      userId: coerceId(identity?.user) ?? coerceId(user?.id),
-      fullName: coerceText(user?.fullName) ?? coerceText(user?.name) ?? coerceText(user?.username),
-      teamId: coerceId(identity?.team),
-      teamName: coerceText(user?.teamName),
-      teamDomain: coerceText(identity?.domain),
-      ...roles ? { roles } : {},
-      consumerType: coerceText(root.consumerType) ?? coerceText(data?.consumerType) ?? coerceText(user?.consumerType)
-    };
-    memoizedSessionIdentity = resolved;
-    return resolved;
+    payload = asRecord(await response.json());
   } catch {
     return void 0;
   }
+  if (!payload) {
+    return void 0;
+  }
+  const root = asRecord(payload.session) ?? payload;
+  const identity = asRecord(root.identity);
+  const data = asRecord(root.data);
+  const user = asRecord(data?.user);
+  const roleEntries = Array.isArray(user?.roles) ? user.roles.map((entry) => coerceText(entry) ?? coerceId(entry)).filter((entry) => Boolean(entry)) : [];
+  const singleRole = coerceText(user?.role);
+  const roles = roleEntries.length > 0 ? roleEntries : singleRole ? [singleRole] : void 0;
+  return {
+    source: "iapub/sessions",
+    userId: coerceId(identity?.user) ?? coerceId(user?.id),
+    fullName: coerceText(user?.fullName) ?? coerceText(user?.name) ?? coerceText(user?.username),
+    teamId: coerceId(identity?.team),
+    teamName: coerceText(user?.teamName),
+    teamDomain: coerceText(identity?.domain),
+    ...roles ? { roles } : {},
+    consumerType: coerceText(root.consumerType) ?? coerceText(data?.consumerType) ?? coerceText(user?.consumerType)
+  };
+}
+async function probeSessionIdentity(baseUrl, accessToken, fetchImpl, maxAttempts, sleepImpl, random) {
+  let failure = "unavailable";
+  for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+    let response;
+    try {
+      response = await fetchImpl(`${baseUrl}${sessionPath}`, {
+        method: "GET",
+        headers: { "x-access-token": accessToken }
+      });
+    } catch {
+      failure = "unavailable";
+      if (attempt < maxAttempts) {
+        await sleepImpl(computeSessionRetryDelayMs(void 0, attempt, random));
+        continue;
+      }
+      break;
+    }
+    if (response.ok) {
+      const resolved = await parseSessionResponse(response);
+      if (resolved) {
+        memoizedSessionIdentity = resolved;
+        memoizedSessionFailure = void 0;
+        return resolved;
+      }
+      failure = "unavailable";
+      break;
+    }
+    if (response.status === 401 || response.status === 403) {
+      failure = "auth";
+      break;
+    }
+    if (response.status === 429 || response.status >= 500) {
+      failure = "unavailable";
+      if (attempt < maxAttempts) {
+        await sleepImpl(computeSessionRetryDelayMs(response, attempt, random));
+        continue;
+      }
+      break;
+    }
+    failure = "unavailable";
+    break;
+  }
+  memoizedSessionFailure = failure;
+  return void 0;
 }
 function describeTeam(id) {
   const label = id?.teamName ?? id?.teamDomain;
@@ -21177,7 +21272,9 @@ async function runCredentialPreflight(args) {
     session = await resolveSessionIdentity({
       iapubBaseUrl: args.iapubBaseUrl,
       accessToken,
-      fetchImpl: args.fetchImpl
+      fetchImpl: args.fetchImpl,
+      ...args.sleepImpl ? { sleepImpl: args.sleepImpl } : {},
+      ...args.randomImpl ? { randomImpl: args.randomImpl } : {}
     });
   } catch (error2) {
     args.log.warning(
@@ -21197,11 +21294,20 @@ async function runCredentialPreflight(args) {
       );
     }
   } else {
+    const failure = getSessionResolutionFailure();
+    const detail = failure === "auth" ? "the access token was rejected by iapub (401/403), so it is invalid or expired. Re-mint it with postman-resolve-service-token-action (or POST https://api.getpostman.com/service-account-tokens) and re-run." : "iapub was unreachable after retries (network or 5xx). This is usually transient; re-run the job.";
+    const base = "postman: credential preflight could not resolve the access-token session identity from iapub: " + detail;
+    if (args.mode === "enforce") {
+      throw new Error(
+        mask(
+          `${base} (credential-preflight: enforce requires a resolvable session identity; use credential-preflight: warn to continue with reactive error guidance only.)`
+        )
+      );
+    }
     args.log.warning(
-      mask(
-        "postman: credential preflight could not resolve the access-token session identity from iapub; continuing with reactive error guidance only"
-      )
+      mask(`${base} Continuing with reactive error guidance only (credential-preflight: warn).`)
     );
+    return;
   }
   const result = crossCheckIdentities({
     pmak,
@@ -21613,6 +21719,53 @@ var AccessTokenProvider = class {
     return token;
   }
 };
+async function describeMintFailure(mintError, apiKey, apiBaseUrl, fetchImpl) {
+  const raw = mintError instanceof Error ? mintError.message : String(mintError);
+  const rejected = /HTTP 40[13]|PMAK rejected/.test(raw);
+  if (!rejected) {
+    return raw;
+  }
+  try {
+    const me = await fetchImpl(`${apiBaseUrl}/me`, { headers: { "x-api-key": apiKey } });
+    if (me.ok) {
+      const body = await me.json().catch(() => void 0);
+      const user = body?.user;
+      const looksPersonal = Boolean(user && (user.username || user.email));
+      if (looksPersonal) {
+        return "Personal API key detected, cannot mint a service-account access token. POST /service-account-tokens only accepts a SERVICE-ACCOUNT API key; this postman-api-key belongs to a user account" + (user?.teamId ? ` (team ${user.teamId})` : "") + ". Create a service account in Team Settings and use its PMAK, or mint the token elsewhere and pass postman-access-token.";
+      }
+      return "The postman-api-key authenticates (GET /me OK) but was rejected by POST /service-account-tokens" + (user?.teamId ? ` (team ${user.teamId})` : "") + ". The service account likely lacks permission to mint access tokens, or service accounts are restricted for this team. Check the service account role in Team Settings, or pass a pre-minted postman-access-token.";
+    }
+    return "The postman-api-key is invalid, disabled, or expired (rejected by both POST /service-account-tokens and GET /me). Generate a fresh service-account PMAK in Team Settings and update the secret.";
+  } catch {
+    return raw;
+  }
+}
+async function mintAccessTokenIfNeeded(inputs, log, setSecret2, fetchImpl = fetch) {
+  if (inputs.postmanAccessToken || !inputs.postmanApiKey) {
+    return;
+  }
+  const apiBaseUrl = String(
+    inputs.postmanApiBase || POSTMAN_ENDPOINT_PROFILES.prod.apiBaseUrl
+  ).replace(/\/+$/, "");
+  const provider = new AccessTokenProvider({
+    apiKey: inputs.postmanApiKey,
+    apiBaseUrl,
+    fetchImpl,
+    onToken: (token) => setSecret2?.(token)
+  });
+  try {
+    inputs.postmanAccessToken = await provider.refresh();
+    log.info(
+      "postman: no postman-access-token configured - minted a short-lived service-account access token from the postman-api-key."
+    );
+  } catch (error2) {
+    const diagnosis = await describeMintFailure(error2, inputs.postmanApiKey, apiBaseUrl, fetchImpl);
+    log.warning(
+      "postman: could not mint an access token from the postman-api-key. " + diagnosis + " Continuing without an access token - access-token-only functionality will be unavailable unless postman-access-token is provided."
+    );
+  }
+}
 
 // src/lib/bifrost-client.ts
 var DEFAULT_BIFROST_BASE_URL = POSTMAN_ENDPOINT_PROFILES.prod.bifrostBaseUrl;
@@ -22017,6 +22170,35 @@ function getFinalServiceSegment(serviceName) {
   return lastSlash === -1 ? serviceName : serviceName.slice(lastSlash + 1);
 }
 
+// src/lib/input.ts
+function normalizeInputValue(value) {
+  return String(value ?? "").trim();
+}
+function runnerInputEnvName(name) {
+  return `INPUT_${name.replace(/ /g, "_").toUpperCase()}`;
+}
+function normalizedInputEnvName(name) {
+  return `INPUT_${name.replace(/-/g, "_").toUpperCase()}`;
+}
+function getInput2(name, env = process.env) {
+  const normalizedName = normalizedInputEnvName(name);
+  const runnerName = runnerInputEnvName(name);
+  const normalizedRaw = env[normalizedName];
+  const runnerRaw = runnerName === normalizedName ? void 0 : env[runnerName];
+  const hasNormalized = normalizedRaw !== void 0;
+  const hasRunner = runnerRaw !== void 0;
+  if (hasNormalized && hasRunner) {
+    const normalizedValue = normalizeInputValue(normalizedRaw);
+    const runnerValue = normalizeInputValue(runnerRaw);
+    if (normalizedValue !== runnerValue) {
+      throw new Error(
+        `Conflicting values for ${name}: ${normalizedName}=${JSON.stringify(normalizedValue)} vs ${runnerName}=${JSON.stringify(runnerValue)}`
+      );
+    }
+  }
+  return normalizeInputValue(hasNormalized ? normalizedRaw : runnerRaw);
+}
+
 // node_modules/@postman-cse/automation-telemetry-core/dist/ci-context.js
 function norm(value) {
   const trimmed = (value ?? "").trim();
@@ -22271,7 +22453,7 @@ function resolveActionVersion(explicit) {
   if (explicit) {
     return explicit;
   }
-  return "2.0.0" ? "2.0.0" : "unknown";
+  return typeof __ACTION_VERSION__ !== "undefined" && __ACTION_VERSION__ ? __ACTION_VERSION__ : "unknown";
 }
 function telemetryDisabled(env) {
   const flag = String(env.POSTMAN_ACTIONS_TELEMETRY ?? "").trim().toLowerCase();
@@ -22393,6 +22575,18 @@ function createTelemetryContext(options) {
   };
 }
 
+// src/action-version.ts
+var import_node_fs = require("node:fs");
+var import_node_path = require("node:path");
+function resolveActionVersion2() {
+  try {
+    const raw = (0, import_node_fs.readFileSync)((0, import_node_path.join)(__dirname, "..", "package.json"), "utf8");
+    return JSON.parse(raw).version ?? "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+
 // src/index.ts
 var POLL_TIMEOUT_MIN = 10;
 var POLL_TIMEOUT_MAX = 600;
@@ -22454,12 +22648,16 @@ function clamp(value, min, max, fallback) {
   return Math.min(max, Math.max(min, parsed));
 }
 function resolveInputs(env = process.env) {
-  const get = (name, fallback = "") => env[`INPUT_${name.toUpperCase().replace(/-/g, "_")}`]?.trim() || fallback;
+  const get = (name, fallback = "") => getInput2(name, env) || fallback;
   const projectName = get("project-name");
   if (!projectName) throw new Error("project-name is required");
   const postmanAccessToken = get("postman-access-token");
-  if (!postmanAccessToken) throw new Error("postman-access-token is required");
   const postmanApiKey = get("postman-api-key");
+  if (!postmanAccessToken && !postmanApiKey) {
+    throw new Error(
+      "postman-access-token is required (or provide a service-account postman-api-key so the action can mint one)."
+    );
+  }
   const postmanTeamId = get("postman-team-id") || env.POSTMAN_TEAM_ID?.trim() || "";
   const workspaceId = get("workspace-id") || env.POSTMAN_WORKSPACE_ID?.trim() || "";
   if (!workspaceId) {
@@ -22699,7 +22897,14 @@ async function runAction() {
   for (const [key, value] of Object.entries(planned)) {
     setOutput(key, value);
   }
-  setSecret(inputs.postmanAccessToken);
+  const mintHolder = {
+    postmanAccessToken: inputs.postmanAccessToken,
+    postmanApiKey: inputs.postmanApiKey,
+    postmanApiBase: inputs.postmanApiBase
+  };
+  await mintAccessTokenIfNeeded(mintHolder, core_exports, (secret) => setSecret(secret));
+  inputs.postmanAccessToken = mintHolder.postmanAccessToken;
+  if (inputs.postmanAccessToken) setSecret(inputs.postmanAccessToken);
   if (inputs.postmanApiKey) setSecret(inputs.postmanApiKey);
   if (inputs.githubToken) setSecret(inputs.githubToken);
   const tokenProvider = createInsightsTokenProvider(inputs, core_exports);
@@ -22716,7 +22921,7 @@ async function runAction() {
     apiBaseUrl: inputs.postmanApiBase || DEFAULT_POSTMAN_API_BASE,
     onToken: (token) => setSecret(token)
   }) : tokenProvider;
-  const telemetry = createTelemetryContext({ action: "postman-insights-onboarding-action", logger: core_exports });
+  const telemetry = createTelemetryContext({ action: "postman-insights-onboarding-action", actionVersion: resolveActionVersion2(), logger: core_exports });
   telemetry.setTeamId(inputs.postmanTeamId || pmakIdentity?.teamId);
   let result;
   try {
@@ -22761,6 +22966,7 @@ async function runAction() {
   createInsightsBifrostClient,
   createInsightsTokenProvider,
   createPlannedOutputs,
+  getInput,
   getTeams,
   parsePreflightMode,
   resolveApiKeyAndTeamId,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@postman-cse/onboarding-insights",
-  "version": "2.0.0",
+  "version": "2.1.1",
   "description": "GitHub Action to onboard Postman Insights discovered services to API Catalog workspaces.",
   "type": "module",
   "main": "dist/index.cjs",
@@ -15,8 +15,9 @@
     "node": ">=24"
   },
   "scripts": {
-    "build": "npm run typecheck && rm -rf dist && esbuild src/index.ts --bundle --platform=node --target=node24 --format=cjs --define:__ACTION_VERSION__=\\\"$npm_package_version\\\" --outfile=dist/index.cjs && esbuild src/main.ts --bundle --platform=node --target=node24 --format=cjs --define:__ACTION_VERSION__=\\\"$npm_package_version\\\" --outfile=dist/action.cjs && esbuild src/cli.ts --bundle --platform=node --target=node24 --format=cjs --define:__ACTION_VERSION__=\\\"$npm_package_version\\\" --outfile=dist/cli.cjs",
-    "check:dist": "npm run build && git diff --exit-code -- dist",
+    "prepare": "git config core.hooksPath .githooks",
+    "build": "npm run typecheck && rm -rf dist && esbuild src/index.ts --bundle --platform=node --target=node24 --format=cjs --outfile=dist/index.cjs && esbuild src/main.ts --bundle --platform=node --target=node24 --format=cjs --outfile=dist/action.cjs && esbuild src/cli.ts --bundle --platform=node --target=node24 --format=cjs --banner:js='#!/usr/bin/env node' --outfile=dist/cli.cjs && chmod +x dist/cli.cjs",
+    "verify:dist": "npm run build && git diff --ignore-space-at-eol --text --exit-code -- dist",
     "docs:tables": "node scripts/render-action-tables.mjs --write",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
@@ -46,8 +47,8 @@
     "@commitlint/cli": "^21.0.2",
     "@commitlint/config-conventional": "^21.0.2",
     "@eslint/js": "^10.0.1",
-    "@types/node": "^24.12.4",
-    "esbuild": "^0.28.0",
+    "@types/node": "^26.1.0",
+    "esbuild": "0.28.1",
     "eslint": "^10.4.1",
     "typescript": "^6.0.3",
     "typescript-eslint": "^8.60.0",