@postman-cse/onboarding-insights 2.0.0 → 2.1.1

package/dist/cli.cjs

@@ -1,3 +1,4 @@
+#!/usr/bin/env node
 "use strict";
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -18685,9 +18686,10 @@ __export(cli_exports, {
   toDotenv: () => toDotenv
 });
 module.exports = __toCommonJS(cli_exports);
-var import_node_fs = require("node:fs");
+var import_node_crypto2 = require("node:crypto");
+var import_node_fs2 = require("node:fs");
 var import_promises = require("node:fs/promises");
-var import_node_path = __toESM(require("node:path"), 1);
+var import_node_path2 = __toESM(require("node:path"), 1);
 
 // src/lib/retry.ts
 function sleep(delayMs) {
@@ -18891,6 +18893,53 @@ var AccessTokenProvider = class {
     return token;
   }
 };
+async function describeMintFailure(mintError, apiKey, apiBaseUrl, fetchImpl) {
+  const raw = mintError instanceof Error ? mintError.message : String(mintError);
+  const rejected = /HTTP 40[13]|PMAK rejected/.test(raw);
+  if (!rejected) {
+    return raw;
+  }
+  try {
+    const me = await fetchImpl(`${apiBaseUrl}/me`, { headers: { "x-api-key": apiKey } });
+    if (me.ok) {
+      const body = await me.json().catch(() => void 0);
+      const user = body?.user;
+      const looksPersonal = Boolean(user && (user.username || user.email));
+      if (looksPersonal) {
+        return "Personal API key detected, cannot mint a service-account access token. POST /service-account-tokens only accepts a SERVICE-ACCOUNT API key; this postman-api-key belongs to a user account" + (user?.teamId ? ` (team ${user.teamId})` : "") + ". Create a service account in Team Settings and use its PMAK, or mint the token elsewhere and pass postman-access-token.";
+      }
+      return "The postman-api-key authenticates (GET /me OK) but was rejected by POST /service-account-tokens" + (user?.teamId ? ` (team ${user.teamId})` : "") + ". The service account likely lacks permission to mint access tokens, or service accounts are restricted for this team. Check the service account role in Team Settings, or pass a pre-minted postman-access-token.";
+    }
+    return "The postman-api-key is invalid, disabled, or expired (rejected by both POST /service-account-tokens and GET /me). Generate a fresh service-account PMAK in Team Settings and update the secret.";
+  } catch {
+    return raw;
+  }
+}
+async function mintAccessTokenIfNeeded(inputs, log, setSecret2, fetchImpl = fetch) {
+  if (inputs.postmanAccessToken || !inputs.postmanApiKey) {
+    return;
+  }
+  const apiBaseUrl = String(
+    inputs.postmanApiBase || POSTMAN_ENDPOINT_PROFILES.prod.apiBaseUrl
+  ).replace(/\/+$/, "");
+  const provider = new AccessTokenProvider({
+    apiKey: inputs.postmanApiKey,
+    apiBaseUrl,
+    fetchImpl,
+    onToken: (token) => setSecret2?.(token)
+  });
+  try {
+    inputs.postmanAccessToken = await provider.refresh();
+    log.info(
+      "postman: no postman-access-token configured - minted a short-lived service-account access token from the postman-api-key."
+    );
+  } catch (error2) {
+    const diagnosis = await describeMintFailure(error2, inputs.postmanApiKey, apiBaseUrl, fetchImpl);
+    log.warning(
+      "postman: could not mint an access token from the postman-api-key. " + diagnosis + " Continuing without an access token - access-token-only functionality will be unavailable unless postman-access-token is provided."
+    );
+  }
+}
 
 // node_modules/@actions/core/lib/core.js
 var core_exports = {};
@@ -21167,12 +21216,62 @@ function getIDToken(aud) {
 
 // src/lib/credential-identity.ts
 var sessionPath = "/api/sessions/current";
+var SESSION_MAX_ATTEMPTS = 3;
+var SESSION_RETRY_BASE_DELAY_MS = 500;
+var SESSION_RETRY_MAX_DELAY_MS = 8e3;
 var pmakMemo = /* @__PURE__ */ new Map();
 var sessionMemo = /* @__PURE__ */ new Map();
 var memoizedSessionIdentity;
+var memoizedSessionFailure;
+function defaultSessionSleep(ms) {
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
+}
+function defaultRandom() {
+  return Math.random();
+}
+function parseRetryAfterMs(value) {
+  const trimmed = value?.trim();
+  if (!trimmed) {
+    return void 0;
+  }
+  if (/^\d+$/.test(trimmed)) {
+    return Number(trimmed) * 1e3;
+  }
+  const dateMs = Date.parse(trimmed);
+  if (!Number.isNaN(dateMs)) {
+    return Math.max(0, dateMs - Date.now());
+  }
+  return void 0;
+}
+function parseRateLimitResetMs(value) {
+  const trimmed = value?.trim();
+  if (!trimmed || !/^\d+$/.test(trimmed)) {
+    return void 0;
+  }
+  const seconds = Number(trimmed);
+  const nowSeconds = Date.now() / 1e3;
+  if (seconds > nowSeconds) {
+    return Math.max(0, (seconds - nowSeconds) * 1e3);
+  }
+  return seconds * 1e3;
+}
+function computeSessionRetryDelayMs(response, attempt, random) {
+  const headers = response?.headers;
+  const signal = parseRetryAfterMs(headers?.get("retry-after") ?? null) ?? parseRateLimitResetMs(
+    headers?.get("ratelimit-reset") ?? headers?.get("x-ratelimit-reset") ?? null
+  );
+  if (signal !== void 0) {
+    return Math.min(Math.max(0, signal), SESSION_RETRY_MAX_DELAY_MS);
+  }
+  const ceiling = Math.min(SESSION_RETRY_MAX_DELAY_MS, SESSION_RETRY_BASE_DELAY_MS * 2 ** (attempt - 1));
+  return Math.round(random() * ceiling);
+}
 function getMemoizedSessionIdentity() {
   return memoizedSessionIdentity;
 }
+function getSessionResolutionFailure() {
+  return memoizedSessionFailure;
+}
 function asRecord(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     return void 0;
@@ -21241,46 +21340,90 @@ async function resolveSessionIdentity(opts) {
   const memoKey = `${baseUrl}::${accessToken}`;
   let pending = sessionMemo.get(memoKey);
   if (!pending) {
-    pending = probeSessionIdentity(baseUrl, accessToken, opts.fetchImpl ?? fetch);
+    pending = probeSessionIdentity(
+      baseUrl,
+      accessToken,
+      opts.fetchImpl ?? fetch,
+      Math.max(1, opts.maxAttempts ?? SESSION_MAX_ATTEMPTS),
+      opts.sleepImpl ?? defaultSessionSleep,
+      opts.randomImpl ?? defaultRandom
+    );
     sessionMemo.set(memoKey, pending);
   }
   return pending;
 }
-async function probeSessionIdentity(baseUrl, accessToken, fetchImpl) {
+async function parseSessionResponse(response) {
+  let payload;
   try {
-    const response = await fetchImpl(`${baseUrl}${sessionPath}`, {
-      method: "GET",
-      headers: { "x-access-token": accessToken }
-    });
-    if (!response.ok) {
-      return void 0;
-    }
-    const payload = asRecord(await response.json());
-    if (!payload) {
-      return void 0;
-    }
-    const root = asRecord(payload.session) ?? payload;
-    const identity = asRecord(root.identity);
-    const data = asRecord(root.data);
-    const user = asRecord(data?.user);
-    const roleEntries = Array.isArray(user?.roles) ? user.roles.map((entry) => coerceText(entry) ?? coerceId(entry)).filter((entry) => Boolean(entry)) : [];
-    const singleRole = coerceText(user?.role);
-    const roles = roleEntries.length > 0 ? roleEntries : singleRole ? [singleRole] : void 0;
-    const resolved = {
-      source: "iapub/sessions",
-      userId: coerceId(identity?.user) ?? coerceId(user?.id),
-      fullName: coerceText(user?.fullName) ?? coerceText(user?.name) ?? coerceText(user?.username),
-      teamId: coerceId(identity?.team),
-      teamName: coerceText(user?.teamName),
-      teamDomain: coerceText(identity?.domain),
-      ...roles ? { roles } : {},
-      consumerType: coerceText(root.consumerType) ?? coerceText(data?.consumerType) ?? coerceText(user?.consumerType)
-    };
-    memoizedSessionIdentity = resolved;
-    return resolved;
+    payload = asRecord(await response.json());
   } catch {
     return void 0;
   }
+  if (!payload) {
+    return void 0;
+  }
+  const root = asRecord(payload.session) ?? payload;
+  const identity = asRecord(root.identity);
+  const data = asRecord(root.data);
+  const user = asRecord(data?.user);
+  const roleEntries = Array.isArray(user?.roles) ? user.roles.map((entry) => coerceText(entry) ?? coerceId(entry)).filter((entry) => Boolean(entry)) : [];
+  const singleRole = coerceText(user?.role);
+  const roles = roleEntries.length > 0 ? roleEntries : singleRole ? [singleRole] : void 0;
+  return {
+    source: "iapub/sessions",
+    userId: coerceId(identity?.user) ?? coerceId(user?.id),
+    fullName: coerceText(user?.fullName) ?? coerceText(user?.name) ?? coerceText(user?.username),
+    teamId: coerceId(identity?.team),
+    teamName: coerceText(user?.teamName),
+    teamDomain: coerceText(identity?.domain),
+    ...roles ? { roles } : {},
+    consumerType: coerceText(root.consumerType) ?? coerceText(data?.consumerType) ?? coerceText(user?.consumerType)
+  };
+}
+async function probeSessionIdentity(baseUrl, accessToken, fetchImpl, maxAttempts, sleepImpl, random) {
+  let failure = "unavailable";
+  for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+    let response;
+    try {
+      response = await fetchImpl(`${baseUrl}${sessionPath}`, {
+        method: "GET",
+        headers: { "x-access-token": accessToken }
+      });
+    } catch {
+      failure = "unavailable";
+      if (attempt < maxAttempts) {
+        await sleepImpl(computeSessionRetryDelayMs(void 0, attempt, random));
+        continue;
+      }
+      break;
+    }
+    if (response.ok) {
+      const resolved = await parseSessionResponse(response);
+      if (resolved) {
+        memoizedSessionIdentity = resolved;
+        memoizedSessionFailure = void 0;
+        return resolved;
+      }
+      failure = "unavailable";
+      break;
+    }
+    if (response.status === 401 || response.status === 403) {
+      failure = "auth";
+      break;
+    }
+    if (response.status === 429 || response.status >= 500) {
+      failure = "unavailable";
+      if (attempt < maxAttempts) {
+        await sleepImpl(computeSessionRetryDelayMs(response, attempt, random));
+        continue;
+      }
+      break;
+    }
+    failure = "unavailable";
+    break;
+  }
+  memoizedSessionFailure = failure;
+  return void 0;
 }
 function describeTeam(id) {
   const label = id?.teamName ?? id?.teamDomain;
@@ -21373,7 +21516,9 @@ async function runCredentialPreflight(args) {
     session = await resolveSessionIdentity({
       iapubBaseUrl: args.iapubBaseUrl,
       accessToken,
-      fetchImpl: args.fetchImpl
+      fetchImpl: args.fetchImpl,
+      ...args.sleepImpl ? { sleepImpl: args.sleepImpl } : {},
+      ...args.randomImpl ? { randomImpl: args.randomImpl } : {}
     });
   } catch (error2) {
     args.log.warning(
@@ -21393,11 +21538,20 @@ async function runCredentialPreflight(args) {
       );
     }
   } else {
+    const failure = getSessionResolutionFailure();
+    const detail = failure === "auth" ? "the access token was rejected by iapub (401/403), so it is invalid or expired. Re-mint it with postman-resolve-service-token-action (or POST https://api.getpostman.com/service-account-tokens) and re-run." : "iapub was unreachable after retries (network or 5xx). This is usually transient; re-run the job.";
+    const base = "postman: credential preflight could not resolve the access-token session identity from iapub: " + detail;
+    if (args.mode === "enforce") {
+      throw new Error(
+        mask(
+          `${base} (credential-preflight: enforce requires a resolvable session identity; use credential-preflight: warn to continue with reactive error guidance only.)`
+        )
+      );
+    }
     args.log.warning(
-      mask(
-        "postman: credential preflight could not resolve the access-token session identity from iapub; continuing with reactive error guidance only"
-      )
+      mask(`${base} Continuing with reactive error guidance only (credential-preflight: warn).`)
     );
+    return;
   }
   const result = crossCheckIdentities({
     pmak,
@@ -22010,6 +22164,35 @@ function getFinalServiceSegment(serviceName) {
   return lastSlash === -1 ? serviceName : serviceName.slice(lastSlash + 1);
 }
 
+// src/lib/input.ts
+function normalizeInputValue(value) {
+  return String(value ?? "").trim();
+}
+function runnerInputEnvName(name) {
+  return `INPUT_${name.replace(/ /g, "_").toUpperCase()}`;
+}
+function normalizedInputEnvName(name) {
+  return `INPUT_${name.replace(/-/g, "_").toUpperCase()}`;
+}
+function getInput2(name, env = process.env) {
+  const normalizedName = normalizedInputEnvName(name);
+  const runnerName = runnerInputEnvName(name);
+  const normalizedRaw = env[normalizedName];
+  const runnerRaw = runnerName === normalizedName ? void 0 : env[runnerName];
+  const hasNormalized = normalizedRaw !== void 0;
+  const hasRunner = runnerRaw !== void 0;
+  if (hasNormalized && hasRunner) {
+    const normalizedValue = normalizeInputValue(normalizedRaw);
+    const runnerValue = normalizeInputValue(runnerRaw);
+    if (normalizedValue !== runnerValue) {
+      throw new Error(
+        `Conflicting values for ${name}: ${normalizedName}=${JSON.stringify(normalizedValue)} vs ${runnerName}=${JSON.stringify(runnerValue)}`
+      );
+    }
+  }
+  return normalizeInputValue(hasNormalized ? normalizedRaw : runnerRaw);
+}
+
 // node_modules/@postman-cse/automation-telemetry-core/dist/ci-context.js
 function norm(value) {
   const trimmed = (value ?? "").trim();
@@ -22264,7 +22447,7 @@ function resolveActionVersion(explicit) {
   if (explicit) {
     return explicit;
   }
-  return "2.0.0" ? "2.0.0" : "unknown";
+  return typeof __ACTION_VERSION__ !== "undefined" && __ACTION_VERSION__ ? __ACTION_VERSION__ : "unknown";
 }
 function telemetryDisabled(env) {
   const flag = String(env.POSTMAN_ACTIONS_TELEMETRY ?? "").trim().toLowerCase();
@@ -22386,6 +22569,18 @@ function createTelemetryContext(options) {
   };
 }
 
+// src/action-version.ts
+var import_node_fs = require("node:fs");
+var import_node_path = require("node:path");
+function resolveActionVersion2() {
+  try {
+    const raw = (0, import_node_fs.readFileSync)((0, import_node_path.join)(__dirname, "..", "package.json"), "utf8");
+    return JSON.parse(raw).version ?? "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+
 // src/index.ts
 var POLL_TIMEOUT_MIN = 10;
 var POLL_TIMEOUT_MAX = 600;
@@ -22447,12 +22642,16 @@ function clamp(value, min, max, fallback) {
   return Math.min(max, Math.max(min, parsed));
 }
 function resolveInputs(env = process.env) {
-  const get = (name, fallback = "") => env[`INPUT_${name.toUpperCase().replace(/-/g, "_")}`]?.trim() || fallback;
+  const get = (name, fallback = "") => getInput2(name, env) || fallback;
   const projectName = get("project-name");
   if (!projectName) throw new Error("project-name is required");
   const postmanAccessToken = get("postman-access-token");
-  if (!postmanAccessToken) throw new Error("postman-access-token is required");
   const postmanApiKey = get("postman-api-key");
+  if (!postmanAccessToken && !postmanApiKey) {
+    throw new Error(
+      "postman-access-token is required (or provide a service-account postman-api-key so the action can mint one)."
+    );
+  }
   const postmanTeamId = get("postman-team-id") || env.POSTMAN_TEAM_ID?.trim() || "";
   const workspaceId = get("workspace-id") || env.POSTMAN_WORKSPACE_ID?.trim() || "";
   if (!workspaceId) {
@@ -22678,6 +22877,24 @@ function createInsightsBifrostClient(inputs, tokenProvider, teamId, apiKey) {
 }
 
 // src/cli.ts
+var INPUT_NAMES = [
+  "project-name",
+  "workspace-id",
+  "environment-id",
+  "system-environment-id",
+  "cluster-name",
+  "repo-url",
+  "postman-access-token",
+  "postman-api-key",
+  "credential-preflight",
+  "postman-team-id",
+  "github-token",
+  "poll-timeout-seconds",
+  "poll-interval-seconds",
+  "postman-region",
+  "postman-stack"
+];
+var OUTPUT_OPTION_NAMES = ["result-json", "dotenv-path"];
 var ConsoleReporter = class {
   secretValues = [];
   info(message) {
@@ -22699,51 +22916,101 @@ var ConsoleReporter = class {
     return masked;
   }
 };
-function readFlag(argv, name) {
-  const prefix = `--${name}=`;
-  for (let index = 0; index < argv.length; index += 1) {
-    const arg = argv[index];
-    if (arg === `--${name}`) {
-      return argv[index + 1];
-    }
-    if (arg?.startsWith(prefix)) {
-      return arg.slice(prefix.length);
+function normalizeCliFlag(name) {
+  return normalizedInputEnvName(name);
+}
+function resolvePackageVersion() {
+  const candidates = [];
+  if (typeof __filename === "string") {
+    candidates.push(import_node_path2.default.join(import_node_path2.default.dirname(__filename), "..", "package.json"));
+  }
+  candidates.push(import_node_path2.default.join(process.cwd(), "package.json"));
+  for (const candidate of candidates) {
+    try {
+      const packageJson = JSON.parse((0, import_node_fs2.readFileSync)(candidate, "utf8"));
+      if (packageJson.name === "@postman-cse/onboarding-insights" && packageJson.version) {
+        return String(packageJson.version).trim();
+      }
+    } catch {
     }
   }
-  return void 0;
+  return resolveActionVersion2();
 }
-function normalizeCliFlag(name) {
-  return `INPUT_${name.replace(/-/g, "_").toUpperCase()}`;
+function renderHelp() {
+  const inputFlags = INPUT_NAMES.map((name) => `  --${name} <value>`).join("\n");
+  return [
+    "Usage: postman-insights-onboard [options]",
+    "",
+    "Options:",
+    inputFlags,
+    "  --result-json <path>   Optional JSON output file (opt-in)",
+    "  --dotenv-path <path>   Optional dotenv output file",
+    "  --help                 Show this help and exit",
+    "  --version              Print version and exit",
+    ""
+  ].join("\n");
 }
 function parseCliArgs(argv, env = process.env) {
-  const inputNames = [
-    "project-name",
-    "workspace-id",
-    "environment-id",
-    "system-environment-id",
-    "cluster-name",
-    "repo-url",
-    "postman-access-token",
-    "postman-api-key",
-    "credential-preflight",
-    "postman-team-id",
-    "github-token",
-    "poll-timeout-seconds",
-    "poll-interval-seconds",
-    "postman-region",
-    "postman-stack"
-  ];
+  if (argv.includes("--help") || argv.includes("-h")) {
+    return { kind: "help" };
+  }
+  if (argv.includes("--version") || argv.includes("-V")) {
+    return { kind: "version" };
+  }
+  const allowed = /* @__PURE__ */ new Set([...INPUT_NAMES, ...OUTPUT_OPTION_NAMES]);
+  const seen = /* @__PURE__ */ new Set();
   const inputEnv = { ...env };
-  for (const name of inputNames) {
-    const value = readFlag(argv, name);
-    if (value !== void 0) {
-      inputEnv[normalizeCliFlag(name)] = value;
+  let resultJsonPath;
+  let dotenvPath;
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (!arg) {
+      continue;
     }
+    if (!arg.startsWith("--")) {
+      throw new Error(`Unexpected positional argument: ${arg}`);
+    }
+    const equalsIndex = arg.indexOf("=");
+    const name = equalsIndex >= 0 ? arg.slice(2, equalsIndex) : arg.slice(2);
+    if (!allowed.has(name)) {
+      throw new Error(`Unknown option: --${name}`);
+    }
+    if (seen.has(name)) {
+      throw new Error(`Duplicate option: --${name}`);
+    }
+    let value;
+    if (equalsIndex >= 0) {
+      value = arg.slice(equalsIndex + 1);
+    } else {
+      const next = argv[index + 1];
+      if (next === void 0 || next.startsWith("--")) {
+        throw new Error(`Missing value for --${name}`);
+      }
+      value = next;
+      index += 1;
+    }
+    if (value.length === 0) {
+      throw new Error(`Missing value for --${name}`);
+    }
+    seen.add(name);
+    if (name === "result-json") {
+      resultJsonPath = value;
+      continue;
+    }
+    if (name === "dotenv-path") {
+      dotenvPath = value;
+      continue;
+    }
+    const normalizedName = normalizedInputEnvName(name);
+    delete inputEnv[runnerInputEnvName(name)];
+    delete inputEnv[normalizedName];
+    inputEnv[normalizedName] = value;
   }
   return {
+    kind: "run",
     inputEnv,
-    resultJsonPath: readFlag(argv, "result-json") ?? "postman-insights-onboarding-result.json",
-    dotenvPath: readFlag(argv, "dotenv-path")
+    resultJsonPath,
+    dotenvPath
   };
 }
 function toDotenv(outputs) {
@@ -22752,18 +23019,63 @@ function toDotenv(outputs) {
     value
   ]).map(([key, value]) => `${key}=${JSON.stringify(value)}`).join("\n");
 }
-async function writeOptionalFile(filePath, content) {
+function assertWithinWorkspace(workspaceRoot, resolved, filePath) {
+  const relative2 = import_node_path2.default.relative(workspaceRoot, resolved);
+  if (relative2 === ".." || relative2.startsWith(`..${import_node_path2.default.sep}`) || import_node_path2.default.isAbsolute(relative2)) {
+    throw new Error(`Output path must stay within workspace: ${filePath}`);
+  }
+}
+async function findExistingAncestor(candidate) {
+  let current = candidate;
+  while (true) {
+    try {
+      return await (0, import_promises.realpath)(current);
+    } catch (error2) {
+      if (error2.code !== "ENOENT") {
+        throw error2;
+      }
+      const parent = import_node_path2.default.dirname(current);
+      if (parent === current) {
+        throw error2;
+      }
+      current = parent;
+    }
+  }
+}
+async function validateOutputPath(filePath) {
   if (!filePath) {
     return;
   }
-  const workspaceRoot = import_node_path.default.resolve(process.cwd());
-  const resolved = import_node_path.default.resolve(workspaceRoot, filePath);
-  const relative2 = import_node_path.default.relative(workspaceRoot, resolved);
-  if (relative2.startsWith("..") || import_node_path.default.isAbsolute(relative2)) {
-    throw new Error(`Output path must stay within workspace: ${filePath}`);
+  const workspaceRoot = await (0, import_promises.realpath)(process.cwd());
+  const resolved = import_node_path2.default.resolve(workspaceRoot, filePath);
+  assertWithinWorkspace(workspaceRoot, resolved, filePath);
+  const existingParent = await findExistingAncestor(import_node_path2.default.dirname(resolved));
+  assertWithinWorkspace(workspaceRoot, existingParent, filePath);
+}
+async function writeAtomicFile(filePath, content) {
+  const workspaceRoot = await (0, import_promises.realpath)(process.cwd());
+  const resolved = import_node_path2.default.resolve(workspaceRoot, filePath);
+  assertWithinWorkspace(workspaceRoot, resolved, filePath);
+  await (0, import_promises.mkdir)(import_node_path2.default.dirname(resolved), { recursive: true });
+  const resolvedParent = await (0, import_promises.realpath)(import_node_path2.default.dirname(resolved));
+  assertWithinWorkspace(workspaceRoot, resolvedParent, filePath);
+  const safeTarget = import_node_path2.default.join(resolvedParent, import_node_path2.default.basename(resolved));
+  const tempPath = import_node_path2.default.join(
+    resolvedParent,
+    `.${import_node_path2.default.basename(resolved)}.${process.pid}.${(0, import_node_crypto2.randomUUID)()}.tmp`
+  );
+  try {
+    await (0, import_promises.writeFile)(tempPath, content, { encoding: "utf8", flag: "wx", mode: 384 });
+    await (0, import_promises.rename)(tempPath, safeTarget);
+  } finally {
+    await (0, import_promises.rm)(tempPath, { force: true });
   }
-  await (0, import_promises.mkdir)(import_node_path.default.dirname(resolved), { recursive: true });
-  await (0, import_promises.writeFile)(resolved, content, "utf8");
+}
+async function writeOptionalFile(filePath, content) {
+  if (!filePath) {
+    return;
+  }
+  await writeAtomicFile(filePath, content);
 }
 function toOutputs(result) {
   return {
@@ -22777,10 +23089,30 @@ function toOutputs(result) {
 }
 async function runCli(argv = process.argv.slice(2), runtime = {}) {
   const env = runtime.env ?? process.env;
-  const config = parseCliArgs(argv, env);
+  const writeStdout = runtime.writeStdout ?? ((chunk) => process.stdout.write(chunk));
+  const parsed = parseCliArgs(argv, env);
+  if (parsed.kind === "help") {
+    writeStdout(renderHelp());
+    return;
+  }
+  if (parsed.kind === "version") {
+    writeStdout(`${resolvePackageVersion()}
+`);
+    return;
+  }
+  const config = parsed;
+  await validateOutputPath(config.resultJsonPath);
+  await validateOutputPath(config.dotenvPath);
   const inputs = resolveInputs(config.inputEnv);
   const reporter = new ConsoleReporter();
-  reporter.setSecret(inputs.postmanAccessToken);
+  const mintHolder = {
+    postmanAccessToken: inputs.postmanAccessToken,
+    postmanApiKey: inputs.postmanApiKey,
+    postmanApiBase: inputs.postmanApiBase
+  };
+  await mintAccessTokenIfNeeded(mintHolder, reporter, (secret) => reporter.setSecret(secret));
+  inputs.postmanAccessToken = mintHolder.postmanAccessToken;
+  if (inputs.postmanAccessToken) reporter.setSecret(inputs.postmanAccessToken);
   if (inputs.postmanApiKey) {
     reporter.setSecret(inputs.postmanApiKey);
   }
@@ -22805,7 +23137,7 @@ async function runCli(argv = process.argv.slice(2), runtime = {}) {
     apiBaseUrl: inputs.postmanApiBase || DEFAULT_POSTMAN_API_BASE,
     onToken: (token) => reporter.setSecret(token)
   }) : tokenProvider;
-  const telemetry = createTelemetryContext({ action: "postman-insights-onboarding-action", logger: reporter });
+  const telemetry = createTelemetryContext({ action: "postman-insights-onboarding-action", actionVersion: resolveActionVersion2(), logger: reporter });
   telemetry.setTeamId(inputs.postmanTeamId || pmakIdentity?.teamId);
   if (apiKey) {
     reporter.setSecret(apiKey);
@@ -22839,7 +23171,6 @@ async function runCli(argv = process.argv.slice(2), runtime = {}) {
   const jsonOutput = JSON.stringify(outputs, null, 2);
   await writeOptionalFile(config.resultJsonPath, jsonOutput);
   await writeOptionalFile(config.dotenvPath, toDotenv(outputs));
-  const writeStdout = runtime.writeStdout ?? ((chunk) => process.stdout.write(chunk));
   writeStdout(`${jsonOutput}
 `);
 }
@@ -22850,9 +23181,9 @@ function isEntrypoint(currentPath, entrypointPath) {
     return false;
   }
   try {
-    return (0, import_node_fs.realpathSync)(currentPath) === (0, import_node_fs.realpathSync)(entrypointPath);
+    return (0, import_node_fs2.realpathSync)(currentPath) === (0, import_node_fs2.realpathSync)(entrypointPath);
   } catch {
-    return import_node_path.default.resolve(currentPath) === import_node_path.default.resolve(entrypointPath);
+    return import_node_path2.default.resolve(currentPath) === import_node_path2.default.resolve(entrypointPath);
   }
 }
 if (isEntrypoint(currentModulePath, entrypoint)) {