@postman-cse/onboarding-bootstrap 0.10.0 → 0.12.0

package/package.json

@@ -1,15 +1,26 @@
 {
   "name": "@postman-cse/onboarding-bootstrap",
-  "version": "0.10.0",
+  "version": "0.12.0",
   "description": "Public open-alpha Postman bootstrap GitHub Action.",
   "type": "module",
   "main": "dist/index.cjs",
   "bin": {
     "postman-bootstrap": "dist/cli.cjs"
   },
+  "files": [
+    "action.yml",
+    "dist/",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
   "scripts": {
     "build": "npm run typecheck && rm -rf dist && esbuild src/index.ts --bundle --platform=node --target=node20 --format=cjs --outfile=dist/index.cjs && esbuild src/cli.ts --bundle --platform=node --target=node20 --format=cjs --outfile=dist/cli.cjs",
     "check:dist": "npm run build && git diff --exit-code -- dist",
+    "lint": "eslint .",
+    "lint:fix": "eslint . --fix",
     "test": "vitest run",
     "typecheck": "tsc --noEmit -p tsconfig.json"
   },
@@ -24,16 +35,24 @@
   "dependencies": {
     "@actions/core": "^1.11.1",
     "@actions/exec": "^1.1.1",
-    "@actions/io": "^1.1.3"
+    "@actions/io": "^1.1.3",
+    "@apidevtools/json-schema-ref-parser": "15.3.5",
+    "@exodus/schemasafe": "1.3.0",
+    "@readme/openapi-parser": "6.0.1"
   },
   "overrides": {
     "undici": "^6.24.0",
     "picomatch": ">=4.0.4"
   },
   "devDependencies": {
-    "esbuild": "^0.27.3",
+    "@commitlint/cli": "^20.5.0",
+    "@commitlint/config-conventional": "^20.5.0",
+    "@eslint/js": "^10.0.1",
     "@types/node": "^25.3.5",
+    "esbuild": "^0.27.3",
+    "eslint": "^10.1.0",
     "typescript": "^5.9.3",
+    "typescript-eslint": "^8.57.2",
     "vitest": "^4.0.18",
     "yaml": "^2.8.2"
   },

package/.github/actionlint.yaml

@@ -1,2 +0,0 @@
-self-hosted-runner:
-  labels: []

package/.github/workflows/ci.yml

@@ -1,36 +0,0 @@
-name: CI
-
-on:
-  pull_request:
-  push:
-    branches:
-      - main
-      - cs-beta-actions_20260305
-
-jobs:
-  validate:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-          cache: npm
-      - run: npm ci
-      - run: npm test
-      - run: npm run typecheck
-      - run: npm run check:dist
-
-  actionlint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version: '1.23'
-      - name: Install actionlint
-        run: go install github.com/rhysd/actionlint/cmd/actionlint@v1.7.11
-      - name: Run actionlint
-        run: |
-          ACTIONLINT_BIN="$(go env GOPATH)/bin/actionlint"
-          "$ACTIONLINT_BIN"

package/.github/workflows/contract-smoke.yml

@@ -1,155 +0,0 @@
-name: Contract Smoke Tests
-on:
-  schedule:
-    - cron: '0 8 * * *'   # daily at 8 AM UTC
-  workflow_dispatch: {}
-
-jobs:
-  bootstrap-smoke:
-    name: Bootstrap API Contract
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-      - name: Verify GET /me (org-mode key)
-        env:
-          PMAK: ${{ secrets.SMOKE_ORG_API_KEY }}
-        run: |
-          set -euo pipefail
-          response=$(curl -sf -H "X-Api-Key: $PMAK" https://api.getpostman.com/me)
-          echo "$response" | jq -e '.user.teamId' > /dev/null || { echo "CONTRACT DRIFT: GET /me missing user.teamId"; exit 1; }
-          echo "GET /me: user.teamId=$(echo "$response" | jq -r '.user.teamId')"
-
-      - name: Verify GET /me (non-org key)
-        env:
-          PMAK: ${{ secrets.SMOKE_NON_ORG_API_KEY }}
-        run: |
-          set -euo pipefail
-          response=$(curl -sf -H "X-Api-Key: $PMAK" https://api.getpostman.com/me)
-          echo "$response" | jq -e '.user.teamId' > /dev/null || { echo "CONTRACT DRIFT: GET /me missing user.teamId"; exit 1; }
-          echo "GET /me: user.teamId=$(echo "$response" | jq -r '.user.teamId')"
-
-      - name: Verify GET /teams (org-mode key)
-        env:
-          PMAK: ${{ secrets.SMOKE_ORG_API_KEY }}
-        run: |
-          set -euo pipefail
-          response=$(curl -sf -H "X-Api-Key: $PMAK" https://api.getpostman.com/teams)
-          echo "$response" | jq -e '.data | type == "array"' > /dev/null || { echo "CONTRACT DRIFT: GET /teams .data is not an array"; exit 1; }
-          count=$(echo "$response" | jq '.data | length')
-          echo "GET /teams: $count teams returned"
-          if [ "$count" -gt 1 ]; then
-            # Org-mode: verify organizationId is present on at least one team
-            org_count=$(echo "$response" | jq '[.data[] | select(.organizationId != null)] | length')
-            if [ "$org_count" -eq 0 ]; then
-              echo "CONTRACT DRIFT: GET /teams returned $count teams but none have organizationId"
-              exit 1
-            fi
-            echo "GET /teams: $org_count teams have organizationId"
-            # Verify required fields
-            echo "$response" | jq -e '.data[] | select(.id and .name)' > /dev/null || { echo "CONTRACT DRIFT: team items missing id or name"; exit 1; }
-          fi
-
-      - name: Verify GET /teams (non-org key)
-        env:
-          PMAK: ${{ secrets.SMOKE_NON_ORG_API_KEY }}
-        run: |
-          set -euo pipefail
-          response=$(curl -sf -H "X-Api-Key: $PMAK" https://api.getpostman.com/teams)
-          echo "$response" | jq -e '.data | type == "array"' > /dev/null || { echo "CONTRACT DRIFT: GET /teams .data is not an array"; exit 1; }
-          count=$(echo "$response" | jq '.data | length')
-          echo "GET /teams: $count teams (non-org, expecting 0 or 1)"
-
-      - name: Verify POST /workspaces with teamId (org-mode)
-        env:
-          PMAK: ${{ secrets.SMOKE_ORG_API_KEY }}
-          WORKSPACE_TEAM_ID: ${{ vars.SMOKE_WORKSPACE_TEAM_ID }}
-        run: |
-          set -euo pipefail
-          ts=$(date +%s)
-          response=$(curl -sf -X POST \
-            -H "X-Api-Key: $PMAK" \
-            -H "Content-Type: application/json" \
-            -d "{\"workspace\":{\"name\":\"__smoke_test_${ts}\",\"type\":\"team\",\"description\":\"Contract smoke test - safe to delete\",\"teamId\":${WORKSPACE_TEAM_ID}}}" \
-            https://api.getpostman.com/workspaces)
-          ws_id=$(echo "$response" | jq -r '.workspace.id')
-          if [ -z "$ws_id" ] || [ "$ws_id" = "null" ]; then
-            echo "CONTRACT DRIFT: POST /workspaces did not return workspace.id"
-            echo "Response: $response"
-            exit 1
-          fi
-          echo "POST /workspaces: created workspace $ws_id"
-
-          # Cleanup
-          curl -sf -X DELETE -H "X-Api-Key: $PMAK" "https://api.getpostman.com/workspaces/$ws_id" > /dev/null
-          echo "Cleanup: deleted workspace $ws_id"
-
-      - name: Verify POST /workspaces without teamId (non-org)
-        env:
-          PMAK: ${{ secrets.SMOKE_NON_ORG_API_KEY }}
-        run: |
-          set -euo pipefail
-          ts=$(date +%s)
-          response=$(curl -sf -X POST \
-            -H "X-Api-Key: $PMAK" \
-            -H "Content-Type: application/json" \
-            -d "{\"workspace\":{\"name\":\"__smoke_test_${ts}\",\"type\":\"team\",\"description\":\"Contract smoke test - safe to delete\"}}" \
-            https://api.getpostman.com/workspaces)
-          ws_id=$(echo "$response" | jq -r '.workspace.id')
-          if [ -z "$ws_id" ] || [ "$ws_id" = "null" ]; then
-            echo "CONTRACT DRIFT: POST /workspaces (no teamId) did not return workspace.id"
-            echo "Response: $response"
-            exit 1
-          fi
-          echo "POST /workspaces (no teamId): created workspace $ws_id"
-
-          # Cleanup
-          curl -sf -X DELETE -H "X-Api-Key: $PMAK" "https://api.getpostman.com/workspaces/$ws_id" > /dev/null
-          echo "Cleanup: deleted workspace $ws_id"
-
-  bifrost-smoke:
-    name: Bifrost API Contract
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Verify Bifrost API key creation
-        env:
-          ACCESS_TOKEN: ${{ secrets.SMOKE_ORG_ACCESS_TOKEN }}
-        run: |
-          set -euo pipefail
-          ts=$(date +%s)
-          response=$(curl -sf -X POST \
-            -H "x-access-token: $ACCESS_TOKEN" \
-            -H "Content-Type: application/json" \
-            -d "{\"method\":\"POST\",\"path\":\"/scim/v2/keys\",\"body\":{\"name\":\"smoke-test-${ts}\",\"description\":\"Contract smoke - safe to delete\"}}" \
-            https://bifrost-premium-https-v4.gw.postman.com)
-          # Verify PMAK-shaped key returned
-          key=$(echo "$response" | jq -r '.apikey.key // .key // empty')
-          if [ -z "$key" ]; then
-            echo "CONTRACT DRIFT: Bifrost API key creation did not return apikey.key"
-            echo "Response: $(echo "$response" | head -c 500)"
-            exit 1
-          fi
-          echo "Bifrost key creation: key starts with $(echo "$key" | head -c 10)..."
-
-  session-smoke:
-    name: Session Validation Contract
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Verify iapub session endpoint
-        env:
-          ACCESS_TOKEN: ${{ secrets.SMOKE_ORG_ACCESS_TOKEN }}
-        run: |
-          set -euo pipefail
-          response=$(curl -sf \
-            -H "x-access-token: $ACCESS_TOKEN" \
-            https://iapub.postman.co/api/sessions/current)
-          echo "$response" | jq -e '.session.identity.team' > /dev/null || {
-            echo "CONTRACT DRIFT: iapub session endpoint missing session.identity.team"
-            echo "Response shape: $(echo "$response" | jq 'keys')"
-            exit 1
-          }
-          echo "Session validation: team=$(echo "$response" | jq -r '.session.identity.team')"

package/.github/workflows/release.yml

@@ -1,62 +0,0 @@
-name: Release
-
-on:
-  push:
-    tags:
-      - 'v*'
-  workflow_dispatch:
-
-permissions:
-  contents: write
-  id-token: write
-
-jobs:
-  release:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-          cache: npm
-      - uses: actions/setup-go@v5
-        with:
-          go-version: '1.23'
-      - run: npm ci
-      - run: npm test
-      - run: npm run typecheck
-      - run: npm run check:dist
-      - name: Install actionlint
-        run: go install github.com/rhysd/actionlint/cmd/actionlint@v1.7.11
-      - name: Run actionlint
-        run: |
-          ACTIONLINT_BIN="$(go env GOPATH)/bin/actionlint"
-          "$ACTIONLINT_BIN"
-      - name: Publish GitHub release
-        uses: softprops/action-gh-release@v2
-        with:
-          generate_release_notes: true
-      - name: Verify version matches tag
-        run: |
-          TAG="${GITHUB_REF#refs/tags/v}"
-          PKG_VERSION=$(node -p "require('./package.json').version")
-          if [ "$TAG" != "$PKG_VERSION" ]; then
-            echo "::error::Tag v$TAG does not match package.json version $PKG_VERSION"
-            exit 1
-          fi
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-          registry-url: 'https://registry.npmjs.org'
-      - name: Publish to npm
-        run: npm publish --provenance --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-      - name: Attach npm tarball to release
-        run: |
-          npm pack
-          mv ./*.tgz release.tgz
-      - name: Upload tarball
-        uses: softprops/action-gh-release@v2
-        with:
-          files: release.tgz

package/.omc/sessions/b36ac16d-ce26-4e94-ae7e-dd817f2430a3.json

@@ -1,8 +0,0 @@
-{
-  "session_id": "b36ac16d-ce26-4e94-ae7e-dd817f2430a3",
-  "ended_at": "2026-03-26T17:52:36.726Z",
-  "reason": "prompt_input_exit",
-  "agents_spawned": 0,
-  "agents_completed": 0,
-  "modes_used": []
-}

package/CLAUDE.md

@@ -1,57 +0,0 @@
-# postman-bootstrap-action
-
-Creates or reuses a Postman workspace, uploads/updates an OpenAPI spec to Spec Hub, generates baseline/smoke/contract collections, assigns governance, and persists repo variables. Dual entry: GitHub Action (`dist/index.cjs`) and CLI (`dist/cli.cjs`).
-
-## Structure
-
-```
-src/
-  index.ts                  # Main orchestration: inputs -> workspace -> spec -> collections -> lint -> outputs
-  cli.ts                    # CLI adapter: reads flags/env, wraps runBootstrap(), writes JSON/dotenv
-  contracts.ts              # Input/output type definitions
-  lib/
-    postman/
-      postman-assets-client.ts    # Custom Postman API client (workspaces, specs, collections, envs, users)
-      internal-integration-adapter.ts  # Bifrost proxy adapter (governance, workspace linking, system envs)
-      workspace-selection.ts      # Canonical workspace resolution (new vs existing, fallback to repo vars)
-    github/
-      github-api-client.ts       # GitHub repo variable read/write, workflow file APIs
-    repo/
-      context.ts                  # Auto-detect repo URL, provider, branch from CI env vars
-    retry.ts                      # Exponential backoff
-    secrets.ts                    # Secret masking utility
-    http-error.ts                 # Typed HTTP error class
-tests/                      # vitest unit tests
-```
-
-## Commands
-
-```bash
-npm ci && npm test && npm run typecheck && npm run build
-npm run check:dist   # build + git diff --exit-code (CI integrity)
-```
-
-## Key Behaviors
-
-- **Workspace selection**: Checks input `workspace-id` -> repo variable `POSTMAN_WORKSPACE_ID` -> creates new. Canonical workspace validation uses access-token via Bifrost.
-- **Spec normalization**: Before upload, fixes missing/long `summary` fields in OpenAPI operations to prevent downstream collection generation failures.
-- **Collection generation**: Calls `POST /specs/{id}/generations/collection` to create baseline/smoke/contract collections. Injects generated tests and applies tags.
-- **Lint**: Installs Postman CLI, runs `postman spec lint` against uploaded spec UID, parses JSON output for errors/warnings.
-- **Team ID**: Auto-derived from `GET /me` using the API key. `POSTMAN_TEAM_ID` env var overrides.
-- **Repo variables**: Persists `POSTMAN_WORKSPACE_ID`, `POSTMAN_SPEC_UID`, collection UIDs, lint counts as GitHub repo variables for rerun idempotency.
-
-## Postman API Endpoints Used
-
-- `POST /workspaces`, `GET /workspaces` -- workspace CRUD
-- `POST /specs`, `PATCH /specs/{id}/files/{path}` -- spec upload/update
-- `POST /specs/{id}/generations/collection` -- collection generation
-- `GET /collections/{id}`, `PUT /collections/{id}` -- collection update/test injection
-- `PUT /collections/{id}/tags` -- collection tagging
-- `GET /me` -- team ID derivation
-- Bifrost: governance assignment, workspace-to-repo linking
-
-## Gotchas
-
-- `postman-assets-client.ts` has a DEPRECATED URL normalization alias -- do not extend it
-- Spec upload re-serializes JSON/YAML; original bytes are preserved only when no normalization is needed
-- `@actions/core` is used directly for GitHub Actions; CLI mode uses `ConsoleReporter` (logs to stderr, JSON to stdout)

package/src/cli.ts

@@ -1,280 +0,0 @@
-import { mkdir, writeFile } from 'node:fs/promises';
-import { execFile } from 'node:child_process';
-import path from 'node:path';
-import { promisify } from 'node:util';
-
-import * as io from '@actions/io';
-
-import {
-  createBootstrapDependencies,
-  resolveInputs,
-  type ResolvedInputs,
-  runBootstrap,
-  type BootstrapExecutionDependencies,
-  type ExecLike,
-  type PlannedOutputs
-} from './index.js';
-import { createSecretMasker } from './lib/secrets.js';
-
-interface CliConfig {
-  inputEnv: NodeJS.ProcessEnv;
-  resultJsonPath: string;
-  dotenvPath?: string;
-}
-
-export interface CliRuntime {
-  env?: NodeJS.ProcessEnv;
-  executeBootstrap?: typeof runBootstrap;
-  writeStdout?: (chunk: string) => void;
-}
-
-type ReporterCore = BootstrapExecutionDependencies['core'];
-
-export class ConsoleReporter implements ReporterCore {
-  public error(message: string): void {
-    console.error(message);
-  }
-
-  public async group<T>(name: string, fn: () => Promise<T>): Promise<T> {
-    console.error(`[group] ${name}`);
-    return await fn();
-  }
-
-  public info(message: string): void {
-    console.error(message);
-  }
-
-  public setOutput(_name: string, _value: string): void {
-  }
-
-  public warning(message: string): void {
-    console.error(`warning: ${message}`);
-  }
-}
-
-function readFlag(argv: string[], name: string): string | undefined {
-  const prefix = `--${name}=`;
-  for (let index = 0; index < argv.length; index += 1) {
-    const arg = argv[index];
-    if (arg === `--${name}`) {
-      return argv[index + 1];
-    }
-    if (arg?.startsWith(prefix)) {
-      return arg.slice(prefix.length);
-    }
-  }
-  return undefined;
-}
-
-function normalizeCliFlag(name: string): string {
-  return `INPUT_${name.replace(/-/g, '_').toUpperCase()}`;
-}
-
-const execFileAsync = promisify(execFile);
-
-function toCommandLabel(commandLine: string, args: string[], secretMasker: (value: string) => string): string {
-  const rendered = [commandLine, ...args].join(' ');
-  return secretMasker(rendered);
-}
-
-export function createCliExec(secretMasker: (value: string) => string): ExecLike {
-  const execCommand = async (
-    commandLine: string,
-    args: string[] = [],
-    options?: Parameters<ExecLike['exec']>[2]
-  ): Promise<number> => {
-    const output = await getExecOutput(commandLine, args, {
-      ...options,
-      ignoreReturnCode: true
-    });
-    if (output.exitCode !== 0 && !options?.ignoreReturnCode) {
-      throw new Error(`Command failed with exit code ${output.exitCode}: ${toCommandLabel(commandLine, args, secretMasker)}`);
-    }
-    return output.exitCode;
-  };
-
-  const getExecOutput = async (
-    commandLine: string,
-    args: string[] = [],
-    options?: Parameters<ExecLike['getExecOutput']>[2]
-  ): Promise<{ exitCode: number; stdout: string; stderr: string }> => {
-    const cwd = options?.cwd;
-    const env = options?.env ? { ...process.env, ...options.env } : process.env;
-    const commandLabel = toCommandLabel(commandLine, args, secretMasker);
-    process.stderr.write(`[command] ${commandLabel}\n`);
-
-    try {
-      const result = await execFileAsync(commandLine, args, {
-        cwd,
-        env,
-        encoding: 'utf8',
-        maxBuffer: 20 * 1024 * 1024,
-        windowsHide: true
-      });
-      const stdout = String(result.stdout ?? '');
-      const stderr = String(result.stderr ?? '');
-      if (stdout) {
-        process.stderr.write(secretMasker(stdout));
-      }
-      if (stderr) {
-        process.stderr.write(secretMasker(stderr));
-      }
-      return {
-        exitCode: 0,
-        stdout,
-        stderr
-      };
-    } catch (error) {
-      const execError = error as {
-        code?: number | string;
-        stdout?: string | Buffer;
-        stderr?: string | Buffer;
-        message?: string;
-      };
-      const stdout = String(execError.stdout ?? '');
-      const stderr = String(execError.stderr ?? '');
-      const fallbackMessage = execError.message ? `${execError.message}\n` : '';
-      if (stdout) {
-        process.stderr.write(secretMasker(stdout));
-      }
-      if (stderr) {
-        process.stderr.write(secretMasker(stderr));
-      } else if (fallbackMessage) {
-        process.stderr.write(secretMasker(fallbackMessage));
-      }
-      const numericCode =
-        typeof execError.code === 'number'
-          ? execError.code
-          : Number.parseInt(String(execError.code ?? '1'), 10) || 1;
-      if (!options?.ignoreReturnCode) {
-        throw new Error(`Command failed with exit code ${numericCode}: ${commandLabel}`);
-      }
-      return {
-        exitCode: numericCode,
-        stdout,
-        stderr
-      };
-    }
-  };
-
-  return {
-    exec: execCommand,
-    getExecOutput
-  };
-}
-
-export function createCliDependencies(
-  inputs: ResolvedInputs
-): BootstrapExecutionDependencies {
-  const secretMasker = createSecretMasker([
-    inputs.postmanApiKey,
-    inputs.postmanAccessToken
-  ]);
-  const cliExec = createCliExec(secretMasker);
-
-  return createBootstrapDependencies(inputs, {
-    core: new ConsoleReporter(),
-    exec: cliExec,
-    io,
-    specFetcher: fetch
-  });
-}
-
-export function parseCliArgs(argv: string[], env: NodeJS.ProcessEnv = process.env): CliConfig {
-  const inputNames = [
-    'project-name',
-    'spec-url',
-    'postman-api-key',
-    'postman-access-token',
-    'workspace-id',
-    'spec-id',
-    'baseline-collection-id',
-    'smoke-collection-id',
-    'contract-collection-id',
-    'collection-sync-mode',
-    'spec-sync-mode',
-    'release-label',
-    'domain',
-    'domain-code',
-    'requester-email',
-    'workspace-admin-user-ids',
-    'governance-mapping-json',
-    'integration-backend',
-    'team-id',
-    'workspace-team-id',
-    'repo-url'
-  ];
-
-  const inputEnv: NodeJS.ProcessEnv = { ...env };
-  for (const name of inputNames) {
-    const value = readFlag(argv, name);
-    if (value !== undefined) {
-      inputEnv[normalizeCliFlag(name)] = value;
-    }
-  }
-
-  return {
-    inputEnv,
-    resultJsonPath: readFlag(argv, 'result-json') ?? 'postman-bootstrap-result.json',
-    dotenvPath: readFlag(argv, 'dotenv-path')
-  };
-}
-
-export function toDotenv(outputs: PlannedOutputs): string {
-  return Object.entries(outputs)
-    .map(([key, value]) => [
-      `POSTMAN_BOOTSTRAP_${key.replace(/-/g, '_').toUpperCase()}`,
-      value
-    ] as const)
-    .map(([key, value]) => `${key}=${JSON.stringify(value)}`)
-    .join('\n');
-}
-
-async function writeOptionalFile(filePath: string | undefined, content: string): Promise<void> {
-  if (!filePath) {
-    return;
-  }
-  const workspaceRoot = path.resolve(process.cwd());
-  const resolved = path.resolve(workspaceRoot, filePath);
-  const relative = path.relative(workspaceRoot, resolved);
-  if (relative.startsWith('..') || path.isAbsolute(relative)) {
-    throw new Error(`Output path must stay within workspace: ${filePath}`);
-  }
-  await mkdir(path.dirname(resolved), { recursive: true });
-  await writeFile(resolved, content, 'utf8');
-}
-
-export async function runCli(
-  argv: string[] = process.argv.slice(2),
-  runtime: CliRuntime = {}
-): Promise<void> {
-  const env = runtime.env ?? process.env;
-  const config = parseCliArgs(argv, env);
-  const inputs = resolveInputs(config.inputEnv);
-  const dependencies = createCliDependencies(inputs);
-
-  if (inputs.domain && !dependencies.internalIntegration) {
-    dependencies.core.warning(
-      'Skipping governance assignment because postman-access-token is not configured'
-    );
-  }
-
-  const result = await (runtime.executeBootstrap ?? runBootstrap)(inputs, dependencies);
-
-  await writeOptionalFile(config.resultJsonPath, JSON.stringify(result, null, 2));
-  await writeOptionalFile(config.dotenvPath, toDotenv(result));
-
-  const writeStdout = runtime.writeStdout ?? ((chunk: string) => process.stdout.write(chunk));
-  writeStdout(`${JSON.stringify(result, null, 2)}\n`);
-}
-
-const currentModulePath = typeof __filename === 'string' ? __filename : '';
-const entrypoint = process.argv[1];
-
-if (entrypoint && currentModulePath === entrypoint) {
-  runCli().catch((error) => {
-    const message = error instanceof Error ? error.message : String(error);
-    process.stderr.write(`${message}\n`);
-    process.exitCode = 1;
-  });
-}