@atlasauth/cli 0.0.0-stage → 0.1.0

package/README.md

@@ -1,3 +1,58 @@
-# Temporary Holding Version
+# @atlasauth/cli
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+`atlas` — manage an Atlas instance from the terminal, over the secret-key
+Backend API. The peer of `auth0-cli` and Clerk's `cli`, built directly on
+[`@atlasauth/backend`](../backend).
+
+## Install
+
+```sh
+npm i -g @atlasauth/cli
+# or run without installing:
+npx @atlasauth/cli --help
+```
+
+## Authentication
+
+The CLI is config-file + secret-key based, like `auth0-cli`'s token model — no
+dashboard OAuth app to register against.
+
+```sh
+atlas login                 # prompts for an API URL + an sk_ key, validates it
+atlas login --profile prod  # store a second, named credential
+atlas whoami                # show the active profile + instance (key masked)
+atlas logout                # forget a stored credential
+```
+
+`login` validates the key with one cheap Backend call before saving it to
+`~/.config/atlasauth/config.json` (mode `0600`). `--url` / `--secret-key` skip
+the prompts for CI.
+
+Env overrides (win over the stored profile, like most cloud CLIs):
+
+```sh
+ATLAS_SECRET_KEY=sk_live_... ATLAS_API_URL=https://api.atlasauth.net atlas users list
+```
+
+## Commands
+
+```
+atlas users    list | get <id> | create --email <e> | delete <id>
+atlas orgs     list | get <id> | members <id>
+atlas api-keys list | create --subject-type <t> --subject-id <id> | revoke <id>
+atlas webhooks list
+atlas sessions revoke <id>
+```
+
+Every command takes `--json` for raw JSON (otherwise a human table). Paginated
+lists (`users list`, `orgs list`) take `--limit <n>` and `--starting-after
+<cursor>`; the table footer prints the exact cursor flag for the next page.
+
+```sh
+atlas users list --limit 20
+atlas users list --json | jq '.data[].id'
+atlas api-keys create --subject-type user --subject-id user_123 --name ci
+```
+
+Run `atlas --help` or `atlas <command> --help` for details, `atlas --version`
+for the version.

package/dist/args.d.ts

@@ -0,0 +1,69 @@
+/**
+ * The single option schema for the whole CLI. parseArgs in `strict` mode rejects
+ * an unknown flag for us (turned into a clean {@link CliError} below), so every
+ * flag any command accepts must appear here once. Per-command validation of
+ * which flags actually apply happens in the handler.
+ */
+declare const OPTIONS: {
+    readonly json: {
+        readonly type: "boolean";
+    };
+    readonly profile: {
+        readonly type: "string";
+    };
+    readonly limit: {
+        readonly type: "string";
+    };
+    readonly 'starting-after': {
+        readonly type: "string";
+    };
+    readonly help: {
+        readonly type: "boolean";
+        readonly short: "h";
+    };
+    readonly version: {
+        readonly type: "boolean";
+        readonly short: "v";
+    };
+    readonly url: {
+        readonly type: "string";
+    };
+    readonly 'secret-key': {
+        readonly type: "string";
+    };
+    readonly email: {
+        readonly type: "string";
+    };
+    readonly 'first-name': {
+        readonly type: "string";
+    };
+    readonly 'last-name': {
+        readonly type: "string";
+    };
+    readonly password: {
+        readonly type: "string";
+    };
+    readonly 'subject-type': {
+        readonly type: "string";
+    };
+    readonly 'subject-id': {
+        readonly type: "string";
+    };
+    readonly name: {
+        readonly type: "string";
+    };
+};
+export type Values = {
+    [K in keyof typeof OPTIONS]?: (typeof OPTIONS)[K]['type'] extends 'boolean' ? boolean : string;
+};
+export interface ParsedArgs {
+    positionals: string[];
+    values: Values;
+}
+/** Parse argv, turning parseArgs' own errors (unknown/invalid flag) into clean CliErrors. */
+export declare function parse(argv: string[]): ParsedArgs;
+/** A string flag's value, or undefined. */
+export declare function str(values: Values, key: keyof Values): string | undefined;
+/** `--limit` as a positive integer, or undefined. Rejects garbage with a clean error. */
+export declare function limit(values: Values): number | undefined;
+export {};

package/dist/args.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parse = parse;
+exports.str = str;
+exports.limit = limit;
+const node_util_1 = require("node:util");
+const errors_1 = require("./errors");
+/**
+ * The single option schema for the whole CLI. parseArgs in `strict` mode rejects
+ * an unknown flag for us (turned into a clean {@link CliError} below), so every
+ * flag any command accepts must appear here once. Per-command validation of
+ * which flags actually apply happens in the handler.
+ */
+const OPTIONS = {
+    // Global.
+    json: { type: 'boolean' },
+    profile: { type: 'string' },
+    limit: { type: 'string' },
+    'starting-after': { type: 'string' },
+    help: { type: 'boolean', short: 'h' },
+    version: { type: 'boolean', short: 'v' },
+    // login (non-interactive overrides for the prompts).
+    url: { type: 'string' },
+    'secret-key': { type: 'string' },
+    // users create.
+    email: { type: 'string' },
+    'first-name': { type: 'string' },
+    'last-name': { type: 'string' },
+    password: { type: 'string' },
+    // api-keys.
+    'subject-type': { type: 'string' },
+    'subject-id': { type: 'string' },
+    name: { type: 'string' },
+};
+/** Parse argv, turning parseArgs' own errors (unknown/invalid flag) into clean CliErrors. */
+function parse(argv) {
+    try {
+        const { values, positionals } = (0, node_util_1.parseArgs)({
+            args: argv,
+            options: OPTIONS,
+            allowPositionals: true,
+            strict: true,
+        });
+        return { values: values, positionals };
+    }
+    catch (err) {
+        // parseArgs throws a TypeError with an ERR_PARSE_ARGS_* code; surface its
+        // message (e.g. "Unknown option '--frob'") without the stack.
+        const message = err instanceof Error ? err.message : String(err);
+        throw new errors_1.CliError(message);
+    }
+}
+/** A string flag's value, or undefined. */
+function str(values, key) {
+    const v = values[key];
+    return typeof v === 'string' ? v : undefined;
+}
+/** `--limit` as a positive integer, or undefined. Rejects garbage with a clean error. */
+function limit(values) {
+    const raw = str(values, 'limit');
+    if (raw === undefined)
+        return undefined;
+    const n = Number(raw);
+    if (!Number.isInteger(n) || n < 1) {
+        throw new errors_1.CliError(`--limit must be a positive integer, got '${raw}'.`);
+    }
+    return n;
+}
+//# sourceMappingURL=args.js.map

package/dist/args.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"args.js","sourceRoot":"","sources":["../src/args.ts"],"names":[],"mappings":";;AAyCA,sBAeC;AAGD,kBAGC;AAGD,sBAQC;AAzED,yCAAsC;AACtC,qCAAoC;AAEpC;;;;;GAKG;AACH,MAAM,OAAO,GAAG;IACd,UAAU;IACV,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACzB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACpC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;IACrC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;IACxC,qDAAqD;IACrD,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACvB,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,gBAAgB;IAChB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC/B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,YAAY;IACZ,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAClC,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;CAChB,CAAC;AAWX,6FAA6F;AAC7F,SAAgB,KAAK,CAAC,IAAc;IAClC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,IAAA,qBAAS,EAAC;YACxC,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,OAAO;YAChB,gBAAgB,EAAE,IAAI;YACtB,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,MAAgB,EAAE,WAAW,EAAE,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0EAA0E;QAC1E,8DAA8D;QAC9D,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,iBAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,2CAA2C;AAC3C,SAAgB,GAAG,CAAC,MAAc,EAAE,GAAiB;IACnD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED,yFAAyF;AACzF,SAAgB,KAAK,CAAC,MAAc;IAClC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,iBAAQ,CAAC,4CAA4C,GAAG,IAAI,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const context_1 = require("./context");
+const run_1 = require("./run");
+/**
+ * The bin entry — the ONLY place that touches `process` for lifecycle. It wires
+ * the production context, runs, and exits with the returned code. `run` is
+ * designed to catch its own errors, so the `.catch` here is a last-resort guard
+ * against a genuine bug; even then it prints a line, never a raw stack.
+ */
+(0, run_1.run)(process.argv.slice(2), (0, context_1.defaultContext)())
+    .then((code) => process.exit(code))
+    .catch((err) => {
+    const message = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`atlas: unexpected error: ${message}\n`);
+    process.exit(1);
+});
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";;;AACA,uCAA2C;AAC3C,+BAA4B;AAE5B;;;;;GAKG;AACH,IAAA,SAAG,EAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAA,wBAAc,GAAE,CAAC;KACzC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;KAClC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IACtB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,OAAO,IAAI,CAAC,CAAC;IAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/commands/api-keys.d.ts

@@ -0,0 +1,4 @@
+import { type ParsedArgs } from '../args';
+import type { RunContext } from '../context';
+/** `atlas api-keys <list|create|revoke>` — maps onto `client.apiKeys.*`. */
+export declare function apiKeys(ctx: RunContext, args: ParsedArgs): Promise<number>;

package/dist/commands/api-keys.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.apiKeys = apiKeys;
+const args_1 = require("../args");
+const errors_1 = require("../errors");
+const output_1 = require("../output");
+const shared_1 = require("./shared");
+const COLUMNS = [
+    { header: 'ID', get: (k) => k.id },
+    { header: 'SUBJECT_TYPE', get: (k) => k.subject_type },
+    { header: 'SUBJECT_ID', get: (k) => k.subject_id },
+    { header: 'NAME', get: (k) => k.name },
+    { header: 'PREFIX', get: (k) => k.prefix },
+    { header: 'CREATED', get: (k) => (0, output_1.fmtTime)(k.created_at) },
+];
+const SUBJECT_TYPES = ['user', 'organization'];
+function parseSubjectType(value, flag) {
+    if (!value)
+        throw new errors_1.CliError(`api-keys create requires ${flag} <user|organization>.`);
+    if (!SUBJECT_TYPES.includes(value)) {
+        throw new errors_1.CliError(`${flag} must be one of: ${SUBJECT_TYPES.join(', ')} (got '${value}').`);
+    }
+    return value;
+}
+/** `atlas api-keys <list|create|revoke>` — maps onto `client.apiKeys.*`. */
+async function apiKeys(ctx, args) {
+    const sub = args.positionals[1];
+    const json = (0, shared_1.wantsJson)(args.values);
+    switch (sub) {
+        case 'list': {
+            const { client } = (0, shared_1.requireClient)(ctx, args.values);
+            // Optional narrowing to one subject; the route itself is not cursor-paged.
+            const subjectType = (0, args_1.str)(args.values, 'subject-type');
+            const page = await client.apiKeys.list({
+                subject_type: subjectType ? parseSubjectType(subjectType, '--subject-type') : undefined,
+                subject_id: (0, args_1.str)(args.values, 'subject-id'),
+            });
+            if (json)
+                (0, output_1.printJson)(ctx.io, page);
+            else
+                ctx.io.out((0, output_1.renderTable)(COLUMNS, page.data));
+            return 0;
+        }
+        case 'create': {
+            const subjectType = parseSubjectType((0, args_1.str)(args.values, 'subject-type'), '--subject-type');
+            const subjectId = (0, args_1.str)(args.values, 'subject-id');
+            if (!subjectId)
+                throw new errors_1.CliError('api-keys create requires --subject-id <id>.');
+            const { client } = (0, shared_1.requireClient)(ctx, args.values);
+            const key = await client.apiKeys.create({
+                subject_type: subjectType,
+                subject_id: subjectId,
+                name: (0, args_1.str)(args.values, 'name'),
+            });
+            if (json) {
+                (0, output_1.printJson)(ctx.io, key);
+            }
+            else {
+                // The secret is revealed exactly once — make that unmissable.
+                ctx.io.out(`Created API key ${key.id}.`);
+                ctx.io.out(`Secret (shown once): ${key.secret}`);
+            }
+            return 0;
+        }
+        case 'revoke': {
+            const id = (0, shared_1.requireArg)(args.positionals, 2, 'api-key-id');
+            const { client } = (0, shared_1.requireClient)(ctx, args.values);
+            const result = await client.apiKeys.delete(id);
+            if (json)
+                (0, output_1.printJson)(ctx.io, result);
+            else
+                ctx.io.out(`Revoked API key ${result.id}.`);
+            return 0;
+        }
+        default:
+            throw new errors_1.CliError(sub
+                ? `Unknown subcommand 'api-keys ${sub}'. Try: list, create, revoke.`
+                : 'api-keys needs a subcommand: list, create, revoke.');
+    }
+}
+//# sourceMappingURL=api-keys.js.map

package/dist/commands/api-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../../src/commands/api-keys.ts"],"names":[],"mappings":";;AA2BA,0BAsDC;AAhFD,kCAA+C;AAE/C,sCAAqC;AACrC,sCAAyE;AACzE,qCAAgE;AAEhE,MAAM,OAAO,GAAqB;IAChC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;IAClC,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE;IACtD,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE;IAClD,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;IACtC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE;IAC1C,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAO,EAAC,CAAC,CAAC,UAAU,CAAC,EAAE;CACzD,CAAC;AAEF,MAAM,aAAa,GAAiC,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;AAE7E,SAAS,gBAAgB,CAAC,KAAyB,EAAE,IAAY;IAC/D,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,iBAAQ,CAAC,4BAA4B,IAAI,uBAAuB,CAAC,CAAC;IACxF,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,KAA0B,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,iBAAQ,CAAC,GAAG,IAAI,oBAAoB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,KAA0B,CAAC;AACpC,CAAC;AAED,4EAA4E;AACrE,KAAK,UAAU,OAAO,CAAC,GAAe,EAAE,IAAgB;IAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,IAAA,kBAAS,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEpC,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,sBAAa,EAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACnD,2EAA2E;YAC3E,MAAM,WAAW,GAAG,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;YACrD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;gBACrC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,gBAAgB,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS;gBACvF,UAAU,EAAE,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC;aAC3C,CAAC,CAAC;YACH,IAAI,IAAI;gBAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;;gBAC7B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAA,oBAAW,EAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACjD,OAAO,CAAC,CAAC;QACX,CAAC;QAED,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,gBAAgB,CAAC,CAAC;YACzF,MAAM,SAAS,GAAG,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YACjD,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,iBAAQ,CAAC,6CAA6C,CAAC,CAAC;YAClF,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,sBAAa,EAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACnD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;gBACtC,YAAY,EAAE,WAAW;gBACzB,UAAU,EAAE,SAAS;gBACrB,IAAI,EAAE,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;aAC/B,CAAC,CAAC;YACH,IAAI,IAAI,EAAE,CAAC;gBACT,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,8DAA8D;gBAC9D,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,mBAAmB,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;gBACzC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,wBAAwB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACnD,CAAC;YACD,OAAO,CAAC,CAAC;QACX,CAAC;QAED,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,EAAE,GAAG,IAAA,mBAAU,EAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,YAAY,CAAC,CAAC;YACzD,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,sBAAa,EAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC/C,IAAI,IAAI;gBAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;;gBAC/B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;YACjD,OAAO,CAAC,CAAC;QACX,CAAC;QAED;YACE,MAAM,IAAI,iBAAQ,CAChB,GAAG;gBACD,CAAC,CAAC,gCAAgC,GAAG,+BAA+B;gBACpE,CAAC,CAAC,oDAAoD,CACzD,CAAC;IACN,CAAC;AACH,CAAC"}

package/dist/commands/auth.d.ts

@@ -0,0 +1,25 @@
+import { type ParsedArgs } from '../args';
+import type { RunContext } from '../context';
+/**
+ * `atlas login` — prompt for an API URL + a secret key, PROVE the key works
+ * with one cheap Backend call, then store it under a named profile (0600).
+ *
+ * Validating before saving is the point: a login that silently stored a typo'd
+ * key would surface only later as a baffling 401 on an unrelated command. We
+ * spend one `users.list({ limit: 1 })` round-trip here so every later command
+ * can trust the stored credential. `--url` / `--secret-key` skip the prompts
+ * for non-interactive setup (CI), mirroring the `ATLAS_*` env overrides.
+ */
+export declare function login(ctx: RunContext, args: ParsedArgs): Promise<number>;
+/**
+ * `atlas logout` — forget one profile's stored credential. If it was the active
+ * profile, the active pointer falls back to any remaining profile so the CLI
+ * isn't left pointing at nothing.
+ */
+export declare function logout(ctx: RunContext, args: ParsedArgs): Promise<number>;
+/**
+ * `atlas whoami` — report the active profile and instance without any network
+ * call. The secret is always masked; the per-field source tells a user whether
+ * an `ATLAS_*` env var is shadowing the stored profile.
+ */
+export declare function whoami(ctx: RunContext, args: ParsedArgs): Promise<number>;

package/dist/commands/auth.js

@@ -0,0 +1,94 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.login = login;
+exports.logout = logout;
+exports.whoami = whoami;
+const backend_1 = require("@atlasauth/backend");
+const args_1 = require("../args");
+const errors_1 = require("../errors");
+const output_1 = require("../output");
+const shared_1 = require("./shared");
+/**
+ * `atlas login` — prompt for an API URL + a secret key, PROVE the key works
+ * with one cheap Backend call, then store it under a named profile (0600).
+ *
+ * Validating before saving is the point: a login that silently stored a typo'd
+ * key would surface only later as a baffling 401 on an unrelated command. We
+ * spend one `users.list({ limit: 1 })` round-trip here so every later command
+ * can trust the stored credential. `--url` / `--secret-key` skip the prompts
+ * for non-interactive setup (CI), mirroring the `ATLAS_*` env overrides.
+ */
+async function login(ctx, args) {
+    const { values } = args;
+    const profile = (0, args_1.str)(values, 'profile') || 'default';
+    const apiUrl = (0, args_1.str)(values, 'url') ||
+        (await ctx.prompt.text('Atlas API URL', { default: backend_1.DEFAULT_API_URL })) ||
+        backend_1.DEFAULT_API_URL;
+    const secretKey = (0, args_1.str)(values, 'secret-key') || (await ctx.prompt.secret('Atlas secret key (sk_...)'));
+    if (!secretKey)
+        throw new errors_1.CliError('A secret key is required to log in.');
+    // Prove the credential before persisting it.
+    const client = ctx.makeClient({ secretKey, apiUrl });
+    try {
+        await client.users.list({ limit: 1 });
+    }
+    catch (err) {
+        if (err instanceof backend_1.AtlasApiError) {
+            throw new errors_1.CliError(`Secret key rejected by ${apiUrl} (HTTP ${err.status}${err.code ? `, ${err.code}` : ''}). Nothing was saved.`);
+        }
+        // A network/DNS failure, not a bad key — say so distinctly.
+        const detail = err instanceof Error ? err.message : String(err);
+        throw new errors_1.CliError(`Could not reach ${apiUrl}: ${detail}. Nothing was saved.`);
+    }
+    const file = ctx.config.load();
+    file.profiles[profile] = { api_url: apiUrl, secret_key: secretKey };
+    file.active_profile = profile;
+    ctx.config.save(file);
+    ctx.io.out(`Logged in to ${apiUrl} as profile '${profile}'.`);
+    ctx.io.out(`Credential stored at ${ctx.config.path} (mode 0600).`);
+    return 0;
+}
+/**
+ * `atlas logout` — forget one profile's stored credential. If it was the active
+ * profile, the active pointer falls back to any remaining profile so the CLI
+ * isn't left pointing at nothing.
+ */
+async function logout(ctx, args) {
+    const { values } = args;
+    const file = ctx.config.load();
+    const profile = (0, args_1.str)(values, 'profile') || file.active_profile || 'default';
+    if (!file.profiles[profile]) {
+        ctx.io.out(`No stored credential for profile '${profile}'.`);
+        return 0;
+    }
+    delete file.profiles[profile];
+    if (file.active_profile === profile) {
+        file.active_profile = Object.keys(file.profiles)[0];
+    }
+    ctx.config.save(file);
+    ctx.io.out(`Logged out of profile '${profile}'.`);
+    return 0;
+}
+/**
+ * `atlas whoami` — report the active profile and instance without any network
+ * call. The secret is always masked; the per-field source tells a user whether
+ * an `ATLAS_*` env var is shadowing the stored profile.
+ */
+async function whoami(ctx, args) {
+    const auth = (0, shared_1.resolveAuth)(ctx, args.values);
+    if ((0, shared_1.wantsJson)(args.values)) {
+        (0, output_1.printJson)(ctx.io, {
+            profile: auth.profile,
+            api_url: auth.apiUrl,
+            secret_key: (0, shared_1.maskSecret)(auth.secretKey),
+            key_source: auth.keySource,
+            url_source: auth.urlSource,
+        });
+        return 0;
+    }
+    ctx.io.out(`Profile:    ${auth.profile}`);
+    ctx.io.out(`API URL:    ${auth.apiUrl} (${auth.urlSource})`);
+    ctx.io.out(`Secret key: ${(0, shared_1.maskSecret)(auth.secretKey)} (${auth.keySource})`);
+    return 0;
+}
+//# sourceMappingURL=auth.js.map

package/dist/commands/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":";;AAiBA,sBAmCC;AAOD,wBAkBC;AAOD,wBAkBC;AAtGD,gDAAoE;AACpE,kCAA+C;AAE/C,sCAAqC;AACrC,sCAAsC;AACtC,qCAA8D;AAE9D;;;;;;;;;GASG;AACI,KAAK,UAAU,KAAK,CAAC,GAAe,EAAE,IAAgB;IAC3D,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,MAAM,OAAO,GAAG,IAAA,UAAG,EAAC,MAAM,EAAE,SAAS,CAAC,IAAI,SAAS,CAAC;IAEpD,MAAM,MAAM,GACV,IAAA,UAAG,EAAC,MAAM,EAAE,KAAK,CAAC;QAClB,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,OAAO,EAAE,yBAAe,EAAE,CAAC,CAAC;QACtE,yBAAe,CAAC;IAClB,MAAM,SAAS,GAAG,IAAA,UAAG,EAAC,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAEtG,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,iBAAQ,CAAC,qCAAqC,CAAC,CAAC;IAE1E,6CAA6C;IAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IACrD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,uBAAa,EAAE,CAAC;YACjC,MAAM,IAAI,iBAAQ,CAChB,0BAA0B,MAAM,UAAU,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,uBAAuB,CAC9G,CAAC;QACJ,CAAC;QACD,4DAA4D;QAC5D,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,iBAAQ,CAAC,mBAAmB,MAAM,KAAK,MAAM,sBAAsB,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IACpE,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC;IAC9B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEtB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,gBAAgB,MAAM,gBAAgB,OAAO,IAAI,CAAC,CAAC;IAC9D,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,wBAAwB,GAAG,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,CAAC;IACnE,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,MAAM,CAAC,GAAe,EAAE,IAAgB;IAC5D,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAG,IAAA,UAAG,EAAC,MAAM,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,cAAc,IAAI,SAAS,CAAC;IAE3E,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,qCAAqC,OAAO,IAAI,CAAC,CAAC;QAC7D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,cAAc,KAAK,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEtB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,0BAA0B,OAAO,IAAI,CAAC,CAAC;IAClD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,MAAM,CAAC,GAAe,EAAE,IAAgB;IAC5D,MAAM,IAAI,GAAG,IAAA,oBAAW,EAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAE3C,IAAI,IAAA,kBAAS,EAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE;YAChB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,IAAI,CAAC,MAAM;YACpB,UAAU,EAAE,IAAA,mBAAU,EAAC,IAAI,CAAC,SAAS,CAAC;YACtC,UAAU,EAAE,IAAI,CAAC,SAAS;YAC1B,UAAU,EAAE,IAAI,CAAC,SAAS;SAC3B,CAAC,CAAC;QACH,OAAO,CAAC,CAAC;IACX,CAAC;IAED,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1C,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;IAC7D,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,eAAe,IAAA,mBAAU,EAAC,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;IAC5E,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/commands/orgs.d.ts

@@ -0,0 +1,4 @@
+import { type ParsedArgs } from '../args';
+import type { RunContext } from '../context';
+/** `atlas orgs <list|get|members>` — maps onto `client.organizations.*`. */
+export declare function orgs(ctx: RunContext, args: ParsedArgs): Promise<number>;

package/dist/commands/orgs.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.orgs = orgs;
+const args_1 = require("../args");
+const errors_1 = require("../errors");
+const output_1 = require("../output");
+const shared_1 = require("./shared");
+const ORG_COLUMNS = [
+    { header: 'ID', get: (o) => o.id },
+    { header: 'NAME', get: (o) => o.name },
+    { header: 'SLUG', get: (o) => o.slug },
+    { header: 'MEMBERS_MAX', get: (o) => o.max_allowed_memberships },
+    { header: 'CREATED', get: (o) => (0, output_1.fmtTime)(o.created_at) },
+];
+const MEMBER_COLUMNS = [
+    { header: 'ID', get: (m) => m.id },
+    { header: 'USER_ID', get: (m) => m.user_id },
+    { header: 'ROLE', get: (m) => m.role },
+    { header: 'CREATED', get: (m) => (0, output_1.fmtTime)(m.created_at) },
+];
+/** `atlas orgs <list|get|members>` — maps onto `client.organizations.*`. */
+async function orgs(ctx, args) {
+    const sub = args.positionals[1];
+    const json = (0, shared_1.wantsJson)(args.values);
+    switch (sub) {
+        case 'list': {
+            const { client } = (0, shared_1.requireClient)(ctx, args.values);
+            const page = await client.organizations.list({
+                limit: (0, args_1.limit)(args.values),
+                starting_after: (0, args_1.str)(args.values, 'starting-after'),
+            });
+            (0, output_1.printList)(ctx.io, { json, columns: ORG_COLUMNS }, page);
+            return 0;
+        }
+        case 'get': {
+            const id = (0, shared_1.requireArg)(args.positionals, 2, 'org-id');
+            const { client } = (0, shared_1.requireClient)(ctx, args.values);
+            const org = await client.organizations.get(id);
+            if (json)
+                (0, output_1.printJson)(ctx.io, org);
+            else
+                ctx.io.out(renderOrg(org));
+            return 0;
+        }
+        case 'members': {
+            const id = (0, shared_1.requireArg)(args.positionals, 2, 'org-id');
+            const { client } = (0, shared_1.requireClient)(ctx, args.values);
+            // memberships.list returns { data, has_more } — no cursor on this route.
+            const page = await client.organizations.memberships.list(id);
+            if (json)
+                (0, output_1.printJson)(ctx.io, page);
+            else
+                ctx.io.out((0, output_1.renderTable)(MEMBER_COLUMNS, page.data));
+            return 0;
+        }
+        default:
+            throw new errors_1.CliError(sub
+                ? `Unknown subcommand 'orgs ${sub}'. Try: list, get, members.`
+                : 'orgs needs a subcommand: list, get, members.');
+    }
+}
+function renderOrg(o) {
+    return [
+        `ID:       ${o.id}`,
+        `Name:     ${o.name}`,
+        `Slug:     ${o.slug}`,
+        `Max members: ${o.max_allowed_memberships}`,
+        `Created by:  ${o.created_by}`,
+        `Created:  ${(0, output_1.fmtTime)(o.created_at)}`,
+    ].join('\n');
+}
+//# sourceMappingURL=orgs.js.map

package/dist/commands/orgs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orgs.js","sourceRoot":"","sources":["../../src/commands/orgs.ts"],"names":[],"mappings":";;AAuBA,oBAyCC;AA/DD,kCAAsD;AAEtD,sCAAqC;AACrC,sCAAoF;AACpF,qCAAgE;AAEhE,MAAM,WAAW,GAA2B;IAC1C,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;IAClC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;IACtC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;IACtC,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,uBAAuB,EAAE;IAChE,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAO,EAAC,CAAC,CAAC,UAAU,CAAC,EAAE;CACzD,CAAC;AAEF,MAAM,cAAc,GAAqC;IACvD,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;IAClC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE;IAC5C,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;IACtC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAO,EAAC,CAAC,CAAC,UAAU,CAAC,EAAE;CACzD,CAAC;AAEF,4EAA4E;AACrE,KAAK,UAAU,IAAI,CAAC,GAAe,EAAE,IAAgB;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,IAAA,kBAAS,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEpC,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,sBAAa,EAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC;gBAC3C,KAAK,EAAE,IAAA,YAAK,EAAC,IAAI,CAAC,MAAM,CAAC;gBACzB,cAAc,EAAE,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC;aACnD,CAAC,CAAC;YACH,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC;YACxD,OAAO,CAAC,CAAC;QACX,CAAC;QAED,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,EAAE,GAAG,IAAA,mBAAU,EAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;YACrD,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,sBAAa,EAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACnD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/C,IAAI,IAAI;gBAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;;gBAC5B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;YAChC,OAAO,CAAC,CAAC;QACX,CAAC;QAED,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,EAAE,GAAG,IAAA,mBAAU,EAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;YACrD,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,sBAAa,EAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACnD,yEAAyE;YACzE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC7D,IAAI,IAAI;gBAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;;gBAC7B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAA,oBAAW,EAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACxD,OAAO,CAAC,CAAC;QACX,CAAC;QAED;YACE,MAAM,IAAI,iBAAQ,CAChB,GAAG;gBACD,CAAC,CAAC,4BAA4B,GAAG,6BAA6B;gBAC9D,CAAC,CAAC,8CAA8C,CACnD,CAAC;IACN,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,CAAe;IAChC,OAAO;QACL,aAAa,CAAC,CAAC,EAAE,EAAE;QACnB,aAAa,CAAC,CAAC,IAAI,EAAE;QACrB,aAAa,CAAC,CAAC,IAAI,EAAE;QACrB,gBAAgB,CAAC,CAAC,uBAAuB,EAAE;QAC3C,gBAAgB,CAAC,CAAC,UAAU,EAAE;QAC9B,aAAa,IAAA,gBAAO,EAAC,CAAC,CAAC,UAAU,CAAC,EAAE;KACrC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/commands/sessions.d.ts

@@ -0,0 +1,4 @@
+import type { ParsedArgs } from '../args';
+import type { RunContext } from '../context';
+/** `atlas sessions revoke <id>` — the one mutation `client.sessions` exposes by id. */
+export declare function sessions(ctx: RunContext, args: ParsedArgs): Promise<number>;

package/dist/commands/sessions.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sessions = sessions;
+const errors_1 = require("../errors");
+const output_1 = require("../output");
+const shared_1 = require("./shared");
+/** `atlas sessions revoke <id>` — the one mutation `client.sessions` exposes by id. */
+async function sessions(ctx, args) {
+    const sub = args.positionals[1];
+    const json = (0, shared_1.wantsJson)(args.values);
+    switch (sub) {
+        case 'revoke': {
+            const id = (0, shared_1.requireArg)(args.positionals, 2, 'session-id');
+            const { client } = (0, shared_1.requireClient)(ctx, args.values);
+            const result = await client.sessions.revoke(id);
+            if (json)
+                (0, output_1.printJson)(ctx.io, result);
+            else
+                ctx.io.out(`Revoked session ${result.id} (status: ${result.status}).`);
+            return 0;
+        }
+        default:
+            throw new errors_1.CliError(sub
+                ? `Unknown subcommand 'sessions ${sub}'. Try: revoke.`
+                : 'sessions needs a subcommand: revoke.');
+    }
+}
+//# sourceMappingURL=sessions.js.map

package/dist/commands/sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/commands/sessions.ts"],"names":[],"mappings":";;AAOA,4BAqBC;AA1BD,sCAAqC;AACrC,sCAAsC;AACtC,qCAAgE;AAEhE,uFAAuF;AAChF,KAAK,UAAU,QAAQ,CAAC,GAAe,EAAE,IAAgB;IAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,IAAA,kBAAS,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEpC,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,EAAE,GAAG,IAAA,mBAAU,EAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,YAAY,CAAC,CAAC;YACzD,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,sBAAa,EAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAChD,IAAI,IAAI;gBAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;;gBAC/B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,EAAE,aAAa,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;YAC5E,OAAO,CAAC,CAAC;QACX,CAAC;QAED;YACE,MAAM,IAAI,iBAAQ,CAChB,GAAG;gBACD,CAAC,CAAC,gCAAgC,GAAG,iBAAiB;gBACtD,CAAC,CAAC,sCAAsC,CAC3C,CAAC;IACN,CAAC;AACH,CAAC"}

package/dist/commands/shared.d.ts

@@ -0,0 +1,32 @@
+import { type Values } from '../args';
+import type { ManagementClient, RunContext } from '../context';
+/**
+ * A credential resolved for one invocation, plus where each half came from —
+ * the source is what `whoami` reports so a user can tell a stored key from an
+ * env override.
+ */
+export interface ResolvedAuth {
+    profile: string;
+    apiUrl: string;
+    secretKey: string;
+    keySource: 'env' | 'config';
+    urlSource: 'env' | 'config' | 'default';
+}
+/**
+ * Resolve which credential to use, with env overrides winning over the stored
+ * profile — the same precedence `auth0-cli` and most cloud CLIs use, so a CI
+ * job can set `ATLAS_SECRET_KEY` without a `login` step. Throws a clean error
+ * (not a stack) when nothing supplies a key.
+ */
+export declare function resolveAuth(ctx: RunContext, values: Values): ResolvedAuth;
+/** Resolve the credential and build the Backend API client bound to it. */
+export declare function requireClient(ctx: RunContext, values: Values): {
+    client: ManagementClient;
+    auth: ResolvedAuth;
+};
+/** True when `--json` was passed. */
+export declare function wantsJson(values: Values): boolean;
+/** The first positional after the resource word — e.g. an id for `users get <id>`. */
+export declare function requireArg(positionals: string[], index: number, name: string): string;
+/** Mask a secret for display: keep the `sk_live_`-style prefix and the last 4. */
+export declare function maskSecret(key: string): string;