@atlasauth/cli 0.0.0-stage → 0.2.0

package/dist/config.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MemoryConfigStore = exports.FileConfigStore = void 0;
+exports.defaultConfigPath = defaultConfigPath;
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const errors_1 = require("./errors");
+const EMPTY = { profiles: {} };
+/**
+ * Resolve the default config path: `$XDG_CONFIG_HOME/atlasauth/config.json`,
+ * falling back to `~/.config/atlasauth/config.json`. Honoring XDG keeps the CLI
+ * a good citizen on Linux while still working on macOS, where `~/.config` is
+ * the de-facto convention CLIs use.
+ */
+function defaultConfigPath(env = process.env) {
+    const base = env.XDG_CONFIG_HOME?.trim() || (0, node_path_1.join)((0, node_os_1.homedir)(), '.config');
+    return (0, node_path_1.join)(base, 'atlasauth', 'config.json');
+}
+/** The real store: a JSON file written with 0600 perms and a 0700 parent dir. */
+class FileConfigStore {
+    path;
+    constructor(path) {
+        this.path = path;
+    }
+    load() {
+        let text;
+        try {
+            text = (0, node_fs_1.readFileSync)(this.path, 'utf8');
+        }
+        catch {
+            // Missing file is the first-run state, not an error.
+            return { profiles: {} };
+        }
+        try {
+            const parsed = JSON.parse(text);
+            // Guard against a hand-corrupted file so every later `.profiles[...]` is safe.
+            return { active_profile: parsed.active_profile, profiles: parsed.profiles ?? {} };
+        }
+        catch {
+            throw new errors_1.CliError(`Config file at ${this.path} is not valid JSON. Fix or remove it, then run 'atlas login' again.`);
+        }
+    }
+    save(config) {
+        (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(this.path), { recursive: true, mode: 0o700 });
+        // Write THEN chmod: `mode` on writeFile is masked by umask and skipped
+        // entirely if the file already exists, so an explicit chmod is the only
+        // way to guarantee 0600 on every save.
+        (0, node_fs_1.writeFileSync)(this.path, JSON.stringify(config, null, 2) + '\n', { mode: 0o600 });
+        (0, node_fs_1.chmodSync)(this.path, 0o600);
+    }
+}
+exports.FileConfigStore = FileConfigStore;
+/** An in-memory store for tests that still want to exercise the resolve logic. */
+class MemoryConfigStore {
+    path = '<memory>';
+    data;
+    constructor(initial = EMPTY) {
+        this.data = structuredClone(initial);
+    }
+    load() {
+        return structuredClone(this.data);
+    }
+    save(config) {
+        this.data = structuredClone(config);
+    }
+}
+exports.MemoryConfigStore = MemoryConfigStore;
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":";;;AA0CA,8CAGC;AA7CD,qCAA4E;AAC5E,qCAAkC;AAClC,yCAA0C;AAC1C,qCAAoC;AA+BpC,MAAM,KAAK,GAAe,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAE3C;;;;;GAKG;AACH,SAAgB,iBAAiB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACpE,MAAM,IAAI,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,SAAS,CAAC,CAAC;IACvE,OAAO,IAAA,gBAAI,EAAC,IAAI,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;AAChD,CAAC;AAED,iFAAiF;AACjF,MAAa,eAAe;IACL;IAArB,YAAqB,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;IAErC,IAAI;QACF,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,IAAA,sBAAY,EAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,qDAAqD;YACrD,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;YAC9C,+EAA+E;YAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QACpF,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,iBAAQ,CAChB,kBAAkB,IAAI,CAAC,IAAI,qEAAqE,CACjG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAkB;QACrB,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAChE,uEAAuE;QACvE,wEAAwE;QACxE,uCAAuC;QACvC,IAAA,uBAAa,EAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,IAAA,mBAAS,EAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;CACF;AA9BD,0CA8BC;AAED,kFAAkF;AAClF,MAAa,iBAAiB;IACnB,IAAI,GAAG,UAAU,CAAC;IACnB,IAAI,CAAa;IACzB,YAAY,UAAsB,KAAK;QACrC,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IACD,IAAI;QACF,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,MAAkB;QACrB,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;CACF;AAZD,8CAYC"}

package/dist/context.d.ts

@@ -0,0 +1,51 @@
+import { type AtlasClient } from '@atlasauth/backend';
+import { type ConfigStore } from './config';
+import { type ConfigHttp } from './config-http';
+import { type IO } from './io';
+import { type Prompter } from './prompt';
+/**
+ * The exact slice of the Backend API client this CLI drives. Narrowed from the
+ * full {@link AtlasClient} on purpose: it documents — and the typechecker
+ * enforces — that the command set maps only onto namespaces that really exist,
+ * and it keeps the fake a test injects small (five namespaces, not forty).
+ */
+export type ManagementClient = Pick<AtlasClient, 'users' | 'organizations' | 'apiKeys' | 'webhooks' | 'sessions' | 'actions'>;
+/**
+ * Everything a command touches the outside world through, in one injectable
+ * bag. Production wires the real IO/config/prompt/client; every test builds
+ * this with fakes so a handler runs with no network, no TTY and no real
+ * `~/.config` file.
+ */
+export interface RunContext {
+    io: IO;
+    /** Process environment — read for `ATLAS_SECRET_KEY` / `ATLAS_API_URL`. */
+    env: NodeJS.ProcessEnv;
+    config: ConfigStore;
+    prompt: Prompter;
+    /** Builds the Backend API client from a resolved credential. */
+    makeClient: (opts: {
+        secretKey: string;
+        apiUrl: string;
+    }) => ManagementClient;
+    /**
+     * Builds the raw management-API HTTP client used by `atlas config` (the
+     * config-only `/v1` endpoints the typed client omits). Optional so existing
+     * contexts stay valid; the config command falls back to the real one.
+     */
+    makeHttp?: (opts: {
+        secretKey: string;
+        apiUrl: string;
+    }) => ConfigHttp;
+    /**
+     * Read a file's text, for commands that take a path (`atlas actions deploy`
+     * / `test`). Injectable so a test drives them with an in-memory file instead
+     * of touching the disk. Defaults to reading UTF-8 off the real filesystem.
+     */
+    readFile: (path: string) => string;
+}
+/**
+ * The production context, with any piece overridable. Tests call this with a
+ * `config` pointed at a temp path and a `makeClient` returning a stub, so the
+ * same `run()` path is exercised end to end without side effects.
+ */
+export declare function defaultContext(overrides?: Partial<RunContext>): RunContext;

package/dist/context.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultContext = defaultContext;
+const node_fs_1 = require("node:fs");
+const backend_1 = require("@atlasauth/backend");
+const config_1 = require("./config");
+const config_http_1 = require("./config-http");
+const io_1 = require("./io");
+const prompt_1 = require("./prompt");
+/**
+ * The production context, with any piece overridable. Tests call this with a
+ * `config` pointed at a temp path and a `makeClient` returning a stub, so the
+ * same `run()` path is exercised end to end without side effects.
+ */
+function defaultContext(overrides = {}) {
+    return {
+        io: (0, io_1.defaultIO)(),
+        env: process.env,
+        config: new config_1.FileConfigStore((0, config_1.defaultConfigPath)()),
+        prompt: (0, prompt_1.defaultPrompter)(),
+        makeClient: ({ secretKey, apiUrl }) => (0, backend_1.createAtlasClient)({ secretKey, apiUrl }),
+        makeHttp: ({ secretKey, apiUrl }) => (0, config_http_1.createConfigHttp)({ secretKey, apiUrl }),
+        readFile: (path) => (0, node_fs_1.readFileSync)(path, 'utf8'),
+        ...overrides,
+    };
+}
+//# sourceMappingURL=context.js.map

package/dist/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":";;AAmDA,wCAWC;AA9DD,qCAAuC;AACvC,gDAAyE;AACzE,qCAAgF;AAChF,+CAAkE;AAClE,6BAA0C;AAC1C,qCAA0D;AAyC1D;;;;GAIG;AACH,SAAgB,cAAc,CAAC,YAAiC,EAAE;IAChE,OAAO;QACL,EAAE,EAAE,IAAA,cAAS,GAAE;QACf,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,MAAM,EAAE,IAAI,wBAAe,CAAC,IAAA,0BAAiB,GAAE,CAAC;QAChD,MAAM,EAAE,IAAA,wBAAe,GAAE;QACzB,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,IAAA,2BAAiB,EAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAC/E,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,IAAA,8BAAgB,EAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAC5E,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC;QAC9C,GAAG,SAAS;KACb,CAAC;AACJ,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The one error a command handler throws to abort with a clean, user-facing
+ * message and a chosen exit code. {@link run} catches it, prints `message` to
+ * stderr (no stack), and returns `exitCode` — so a bad flag or a missing key
+ * never dumps a stack trace at the terminal the way an uncaught throw would.
+ *
+ * API failures are NOT CliErrors: they arrive as `AtlasApiError` from
+ * `@atlasauth/backend` and {@link run} formats those separately so the stable
+ * error `code` and HTTP status survive to the user.
+ */
+export declare class CliError extends Error {
+    readonly name = "CliError";
+    readonly exitCode: number;
+    constructor(message: string, exitCode?: number);
+}

package/dist/errors.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CliError = void 0;
+/**
+ * The one error a command handler throws to abort with a clean, user-facing
+ * message and a chosen exit code. {@link run} catches it, prints `message` to
+ * stderr (no stack), and returns `exitCode` — so a bad flag or a missing key
+ * never dumps a stack trace at the terminal the way an uncaught throw would.
+ *
+ * API failures are NOT CliErrors: they arrive as `AtlasApiError` from
+ * `@atlasauth/backend` and {@link run} formats those separately so the stable
+ * error `code` and HTTP status survive to the user.
+ */
+class CliError extends Error {
+    name = 'CliError';
+    exitCode;
+    constructor(message, exitCode = 1) {
+        super(message);
+        this.exitCode = exitCode;
+        // Keep `instanceof CliError` working under down-level compile targets.
+        Object.setPrototypeOf(this, CliError.prototype);
+    }
+}
+exports.CliError = CliError;
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;GASG;AACH,MAAa,QAAS,SAAQ,KAAK;IACf,IAAI,GAAG,UAAU,CAAC;IAC3B,QAAQ,CAAS;IAE1B,YAAY,OAAe,EAAE,QAAQ,GAAG,CAAC;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,uEAAuE;QACvE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;IAClD,CAAC;CACF;AAVD,4BAUC"}

package/dist/help.d.ts

@@ -0,0 +1,8 @@
+/**
+ * All help text lives here as plain strings — the CLI's "docs" surface. Kept
+ * out of the handlers so the dispatch code stays about control flow and the
+ * copy can be read (and kept consistent) in one place.
+ */
+export declare const TOP_HELP = "atlas \u2014 manage an Atlas instance from the terminal\n\nUsage: atlas <command> [subcommand] [arguments] [options]\n\nCommands:\n  login                      Authenticate and store a profile credential\n  logout                     Remove a stored profile credential\n  whoami                     Show the active profile and instance\n  users list|get|create|delete\n  orgs list|get|members\n  api-keys list|create|revoke\n  webhooks list\n  sessions revoke\n  config export|import       Config-as-code: round-trip the instance's config\n  actions list|deploy|test|logs\n\nGlobal options:\n  --profile <name>           Use a named profile (default: active, else \"default\")\n  --json                     Emit raw JSON instead of a human table\n  --limit <n>                Page size for list commands that paginate\n  --starting-after <cursor>  Pagination cursor (from a prior page's hint)\n  -h, --help                 Show this help, or help for a command\n  -v, --version              Print the version\n\nEnvironment overrides:\n  ATLAS_SECRET_KEY           Secret key to use instead of the stored one\n  ATLAS_API_URL              API URL to use instead of the stored one\n\nRun 'atlas <command> --help' for command-specific help.";
+/** Per-command help, keyed by the resource word. */
+export declare const COMMAND_HELP: Record<string, string>;

package/dist/help.js

@@ -0,0 +1,114 @@
+"use strict";
+/**
+ * All help text lives here as plain strings — the CLI's "docs" surface. Kept
+ * out of the handlers so the dispatch code stays about control flow and the
+ * copy can be read (and kept consistent) in one place.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.COMMAND_HELP = exports.TOP_HELP = void 0;
+exports.TOP_HELP = `atlas — manage an Atlas instance from the terminal
+
+Usage: atlas <command> [subcommand] [arguments] [options]
+
+Commands:
+  login                      Authenticate and store a profile credential
+  logout                     Remove a stored profile credential
+  whoami                     Show the active profile and instance
+  users list|get|create|delete
+  orgs list|get|members
+  api-keys list|create|revoke
+  webhooks list
+  sessions revoke
+  config export|import       Config-as-code: round-trip the instance's config
+  actions list|deploy|test|logs
+
+Global options:
+  --profile <name>           Use a named profile (default: active, else "default")
+  --json                     Emit raw JSON instead of a human table
+  --limit <n>                Page size for list commands that paginate
+  --starting-after <cursor>  Pagination cursor (from a prior page's hint)
+  -h, --help                 Show this help, or help for a command
+  -v, --version              Print the version
+
+Environment overrides:
+  ATLAS_SECRET_KEY           Secret key to use instead of the stored one
+  ATLAS_API_URL              API URL to use instead of the stored one
+
+Run 'atlas <command> --help' for command-specific help.`;
+/** Per-command help, keyed by the resource word. */
+exports.COMMAND_HELP = {
+    login: `atlas login — authenticate and store a profile credential
+
+Usage: atlas login [--profile <name>] [--url <api-url>] [--secret-key <sk_...>]
+
+Prompts for an API URL and a secret key, validates the key with one Backend
+call, then stores it (0600) under the profile. --url / --secret-key skip the
+prompts for non-interactive setup.`,
+    logout: `atlas logout — remove a stored profile credential
+
+Usage: atlas logout [--profile <name>]`,
+    whoami: `atlas whoami — show the active profile and instance
+
+Usage: atlas whoami [--profile <name>] [--json]`,
+    users: `atlas users — manage users
+
+Usage:
+  atlas users list [--limit <n>] [--starting-after <cursor>] [--json]
+  atlas users get <user-id> [--json]
+  atlas users create --email <address> [--first-name <n>] [--last-name <n>] [--password <p>] [--json]
+  atlas users delete <user-id> [--json]`,
+    orgs: `atlas orgs — manage organizations
+
+Usage:
+  atlas orgs list [--limit <n>] [--starting-after <cursor>] [--json]
+  atlas orgs get <org-id> [--json]
+  atlas orgs members <org-id> [--json]`,
+    'api-keys': `atlas api-keys — manage end-user API keys
+
+Usage:
+  atlas api-keys list [--subject-type <user|organization>] [--subject-id <id>] [--json]
+  atlas api-keys create --subject-type <user|organization> --subject-id <id> [--name <n>] [--json]
+  atlas api-keys revoke <api-key-id> [--json]`,
+    webhooks: `atlas webhooks — inspect webhook endpoints
+
+Usage:
+  atlas webhooks list [--json]`,
+    sessions: `atlas sessions — manage sessions
+
+Usage:
+  atlas sessions revoke <session-id> [--json]`,
+    config: `atlas config — config-as-code for an Atlas instance (the Auth0 deploy-cli peer)
+
+Usage:
+  atlas config export [--dir <path>] [--format json|yaml]
+  atlas config import [--dir <path>] [--format json|yaml] [--dry-run] [--prune]
+
+export  Read the instance's current config (instance/auth config, OAuth clients
+        and providers, SSO connections, resource servers, JWT templates, roles,
+        webhook endpoints, billing plans, redirect URLs, org settings schema,
+        notification and email templates, org policies) and write a deterministic
+        directory tree — one file per resource type, keys sorted, SECRETS OMITTED.
+
+import  Diff the directory against live config and apply creates/updates
+        idempotently. A resource type with no file is left untouched.
+          --dry-run   print the plan and apply nothing
+          --prune     also delete live resources absent from the config
+          --dir       config directory (default: ./atlas-config)
+          --format    json (default) or yaml
+
+Secrets never live on disk. Inject a credential at import with a \${ENV_VAR}
+placeholder in a file (e.g. a provider "client_secret": "\${GOOGLE_SECRET}").`,
+    actions: `atlas actions — manage Actions (tenant code run in the auth pipeline)
+
+Usage:
+  atlas actions list [--json]
+  atlas actions deploy <file> --trigger <post_login|pre_user_registration|post_user_registration> [--name <n>] [--json]
+  atlas actions test <file> [--trigger <t>] [--json]
+  atlas actions logs <action-id> [--json]
+
+deploy uploads the file's code verbatim as a new action (created, not yet bound).
+test runs the file OFFLINE through the @atlasauth/actions harness — no network,
+no real users — and exits non-zero if the action throws. logs explains where an
+action's execution history is recorded (Atlas has no live log-stream endpoint).`,
+};
+//# sourceMappingURL=help.js.map

package/dist/help.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"help.js","sourceRoot":"","sources":["../src/help.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEU,QAAA,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;wDA4BgC,CAAC;AAEzD,oDAAoD;AACvC,QAAA,YAAY,GAA2B;IAClD,KAAK,EAAE;;;;;;mCAM0B;IAEjC,MAAM,EAAE;;uCAE6B;IAErC,MAAM,EAAE;;gDAEsC;IAE9C,KAAK,EAAE;;;;;;wCAM+B;IAEtC,IAAI,EAAE;;;;;uCAK+B;IAErC,UAAU,EAAE;;;;;8CAKgC;IAE5C,QAAQ,EAAE;;;+BAGmB;IAE7B,QAAQ,EAAE;;;8CAGkC;IAE5C,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;8EAoBoE;IAC5E,OAAO,EAAE;;;;;;;;;;;gFAWqE;CAC/E,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Library surface of `@atlasauth/cli`. The package ships a bin (`atlas`), but
+ * exporting the pieces lets the handlers be unit-tested with injected deps and
+ * lets another tool embed the CLI (e.g. `create-atlas-app`) without spawning a
+ * child process.
+ */
+export { run, type Handler } from './run';
+export { defaultContext, type RunContext, type ManagementClient } from './context';
+export { createConfigHttp, isNotFound, type ConfigHttp } from './config-http';
+export { CliError } from './errors';
+export { defaultIO, captureIO, type IO, type CaptureIO } from './io';
+export { FileConfigStore, MemoryConfigStore, defaultConfigPath, type ConfigStore, type ConfigFile, type Profile, } from './config';
+export { defaultPrompter, type Prompter } from './prompt';
+export { getVersion } from './version';
+export { login, logout, whoami } from './commands/auth';
+export { users } from './commands/users';
+export { orgs } from './commands/orgs';
+export { apiKeys } from './commands/api-keys';
+export { webhooks } from './commands/webhooks';
+export { sessions } from './commands/sessions';
+export { config } from './commands/config';
+export { actions } from './commands/actions';

package/dist/index.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.actions = exports.config = exports.sessions = exports.webhooks = exports.apiKeys = exports.orgs = exports.users = exports.whoami = exports.logout = exports.login = exports.getVersion = exports.defaultPrompter = exports.defaultConfigPath = exports.MemoryConfigStore = exports.FileConfigStore = exports.captureIO = exports.defaultIO = exports.CliError = exports.isNotFound = exports.createConfigHttp = exports.defaultContext = exports.run = void 0;
+/**
+ * Library surface of `@atlasauth/cli`. The package ships a bin (`atlas`), but
+ * exporting the pieces lets the handlers be unit-tested with injected deps and
+ * lets another tool embed the CLI (e.g. `create-atlas-app`) without spawning a
+ * child process.
+ */
+var run_1 = require("./run");
+Object.defineProperty(exports, "run", { enumerable: true, get: function () { return run_1.run; } });
+var context_1 = require("./context");
+Object.defineProperty(exports, "defaultContext", { enumerable: true, get: function () { return context_1.defaultContext; } });
+var config_http_1 = require("./config-http");
+Object.defineProperty(exports, "createConfigHttp", { enumerable: true, get: function () { return config_http_1.createConfigHttp; } });
+Object.defineProperty(exports, "isNotFound", { enumerable: true, get: function () { return config_http_1.isNotFound; } });
+var errors_1 = require("./errors");
+Object.defineProperty(exports, "CliError", { enumerable: true, get: function () { return errors_1.CliError; } });
+var io_1 = require("./io");
+Object.defineProperty(exports, "defaultIO", { enumerable: true, get: function () { return io_1.defaultIO; } });
+Object.defineProperty(exports, "captureIO", { enumerable: true, get: function () { return io_1.captureIO; } });
+var config_1 = require("./config");
+Object.defineProperty(exports, "FileConfigStore", { enumerable: true, get: function () { return config_1.FileConfigStore; } });
+Object.defineProperty(exports, "MemoryConfigStore", { enumerable: true, get: function () { return config_1.MemoryConfigStore; } });
+Object.defineProperty(exports, "defaultConfigPath", { enumerable: true, get: function () { return config_1.defaultConfigPath; } });
+var prompt_1 = require("./prompt");
+Object.defineProperty(exports, "defaultPrompter", { enumerable: true, get: function () { return prompt_1.defaultPrompter; } });
+var version_1 = require("./version");
+Object.defineProperty(exports, "getVersion", { enumerable: true, get: function () { return version_1.getVersion; } });
+// The individual command handlers, exported for direct testing/embedding.
+var auth_1 = require("./commands/auth");
+Object.defineProperty(exports, "login", { enumerable: true, get: function () { return auth_1.login; } });
+Object.defineProperty(exports, "logout", { enumerable: true, get: function () { return auth_1.logout; } });
+Object.defineProperty(exports, "whoami", { enumerable: true, get: function () { return auth_1.whoami; } });
+var users_1 = require("./commands/users");
+Object.defineProperty(exports, "users", { enumerable: true, get: function () { return users_1.users; } });
+var orgs_1 = require("./commands/orgs");
+Object.defineProperty(exports, "orgs", { enumerable: true, get: function () { return orgs_1.orgs; } });
+var api_keys_1 = require("./commands/api-keys");
+Object.defineProperty(exports, "apiKeys", { enumerable: true, get: function () { return api_keys_1.apiKeys; } });
+var webhooks_1 = require("./commands/webhooks");
+Object.defineProperty(exports, "webhooks", { enumerable: true, get: function () { return webhooks_1.webhooks; } });
+var sessions_1 = require("./commands/sessions");
+Object.defineProperty(exports, "sessions", { enumerable: true, get: function () { return sessions_1.sessions; } });
+var config_2 = require("./commands/config");
+Object.defineProperty(exports, "config", { enumerable: true, get: function () { return config_2.config; } });
+var actions_1 = require("./commands/actions");
+Object.defineProperty(exports, "actions", { enumerable: true, get: function () { return actions_1.actions; } });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA;;;;;GAKG;AACH,6BAA0C;AAAjC,0FAAA,GAAG,OAAA;AACZ,qCAAmF;AAA1E,yGAAA,cAAc,OAAA;AACvB,6CAA8E;AAArE,+GAAA,gBAAgB,OAAA;AAAE,yGAAA,UAAU,OAAA;AACrC,mCAAoC;AAA3B,kGAAA,QAAQ,OAAA;AACjB,2BAAqE;AAA5D,+FAAA,SAAS,OAAA;AAAE,+FAAA,SAAS,OAAA;AAC7B,mCAOkB;AANhB,yGAAA,eAAe,OAAA;AACf,2GAAA,iBAAiB,OAAA;AACjB,2GAAA,iBAAiB,OAAA;AAKnB,mCAA0D;AAAjD,yGAAA,eAAe,OAAA;AACxB,qCAAuC;AAA9B,qGAAA,UAAU,OAAA;AAEnB,0EAA0E;AAC1E,wCAAwD;AAA/C,6FAAA,KAAK,OAAA;AAAE,8FAAA,MAAM,OAAA;AAAE,8FAAA,MAAM,OAAA;AAC9B,0CAAyC;AAAhC,8FAAA,KAAK,OAAA;AACd,wCAAuC;AAA9B,4FAAA,IAAI,OAAA;AACb,gDAA8C;AAArC,mGAAA,OAAO,OAAA;AAChB,gDAA+C;AAAtC,oGAAA,QAAQ,OAAA;AACjB,gDAA+C;AAAtC,oGAAA,QAAQ,OAAA;AACjB,4CAA2C;AAAlC,gGAAA,MAAM,OAAA;AACf,8CAA6C;AAApC,kGAAA,OAAO,OAAA"}

package/dist/io.d.ts

@@ -0,0 +1,21 @@
+/**
+ * The two sinks every command writes through, named so tests can capture
+ * output instead of spying on `console`. `out` is the data channel (tables,
+ * JSON, the answer a script would pipe); `err` is for diagnostics, prompts'
+ * echoes and error messages — exactly the stdout/stderr split a `--json`
+ * consumer relies on to parse stdout cleanly.
+ */
+export interface IO {
+    out(text: string): void;
+    err(text: string): void;
+}
+/** The real IO: a trailing newline is added so callers pass bare lines. */
+export declare function defaultIO(stdout?: NodeJS.WriteStream, stderr?: NodeJS.WriteStream): IO;
+/** An in-memory IO for tests, exposing the captured lines plus joined views. */
+export interface CaptureIO extends IO {
+    readonly outLines: string[];
+    readonly errLines: string[];
+    stdout(): string;
+    stderr(): string;
+}
+export declare function captureIO(): CaptureIO;

package/dist/io.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultIO = defaultIO;
+exports.captureIO = captureIO;
+/** The real IO: a trailing newline is added so callers pass bare lines. */
+function defaultIO(stdout = process.stdout, stderr = process.stderr) {
+    return {
+        out(text) {
+            stdout.write(text + '\n');
+        },
+        err(text) {
+            stderr.write(text + '\n');
+        },
+    };
+}
+function captureIO() {
+    const outLines = [];
+    const errLines = [];
+    return {
+        outLines,
+        errLines,
+        out: (text) => void outLines.push(text),
+        err: (text) => void errLines.push(text),
+        stdout: () => outLines.join('\n'),
+        stderr: () => errLines.join('\n'),
+    };
+}
+//# sourceMappingURL=io.js.map

package/dist/io.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"io.js","sourceRoot":"","sources":["../src/io.ts"],"names":[],"mappings":";;AAaA,8BAYC;AAUD,8BAWC;AAlCD,2EAA2E;AAC3E,SAAgB,SAAS,CACvB,SAA6B,OAAO,CAAC,MAAM,EAC3C,SAA6B,OAAO,CAAC,MAAM;IAE3C,OAAO;QACL,GAAG,CAAC,IAAI;YACN,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,GAAG,CAAC,IAAI;YACN,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QAC5B,CAAC;KACF,CAAC;AACJ,CAAC;AAUD,SAAgB,SAAS;IACvB,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,OAAO;QACL,QAAQ;QACR,QAAQ;QACR,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QACvC,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QACvC,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QACjC,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;KAClC,CAAC;AACJ,CAAC"}

package/dist/output.d.ts

@@ -0,0 +1,41 @@
+import type { IO } from './io';
+/**
+ * A single rendered column: a header plus a getter that pulls the raw value off
+ * a row. Getters (not keys) because a few columns are derived — a user's name
+ * joins first + last, a webhook's events join an array — and a getter keeps that
+ * shaping next to the column instead of forcing a pre-massaged row.
+ */
+export interface Column<T> {
+    header: string;
+    get: (row: T) => unknown;
+}
+/**
+ * Epoch-millisecond timestamp → ISO-8601, the form every Atlas `*_at` field
+ * takes on the wire. Blank for null (e.g. a user who never signed in) so the
+ * column stays readable rather than printing `1970-...`.
+ */
+export declare function fmtTime(value: unknown): string;
+/**
+ * Hand-rolled fixed-width table — the only "formatting library" this CLI has.
+ * Columns are padded to the widest cell (header included); a dashed rule sits
+ * under the header; trailing padding on the last column is trimmed so lines
+ * don't carry invisible whitespace. Empty input prints a friendly placeholder
+ * rather than a bare header with no rows.
+ */
+export declare function renderTable<T>(columns: Column<T>[], rows: T[]): string;
+/** Pretty-print any value as the `--json` output on stdout. */
+export declare function printJson(io: IO, value: unknown): void;
+/**
+ * Print a cursor-paginated list as either raw JSON or a table, and — in table
+ * mode, when there is another page — a footer naming the exact flag to fetch
+ * it. Keeping the hint next to the data is what makes `--starting-after`
+ * discoverable without the user reading `--help`.
+ */
+export declare function printList<T>(io: IO, opts: {
+    json: boolean;
+    columns: Column<T>[];
+}, page: {
+    data: T[];
+    has_more?: boolean;
+    next_cursor?: string | null;
+}, raw?: unknown): void;

package/dist/output.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fmtTime = fmtTime;
+exports.renderTable = renderTable;
+exports.printJson = printJson;
+exports.printList = printList;
+/** Render a value as a table cell: null/undefined blank, arrays joined, objects JSON. */
+function cell(value) {
+    if (value === null || value === undefined)
+        return '';
+    if (Array.isArray(value))
+        return value.map((v) => cell(v)).join(', ');
+    if (typeof value === 'object')
+        return JSON.stringify(value);
+    return String(value);
+}
+/**
+ * Epoch-millisecond timestamp → ISO-8601, the form every Atlas `*_at` field
+ * takes on the wire. Blank for null (e.g. a user who never signed in) so the
+ * column stays readable rather than printing `1970-...`.
+ */
+function fmtTime(value) {
+    if (value === null || value === undefined)
+        return '';
+    const n = Number(value);
+    if (!Number.isFinite(n))
+        return '';
+    return new Date(n).toISOString();
+}
+/**
+ * Hand-rolled fixed-width table — the only "formatting library" this CLI has.
+ * Columns are padded to the widest cell (header included); a dashed rule sits
+ * under the header; trailing padding on the last column is trimmed so lines
+ * don't carry invisible whitespace. Empty input prints a friendly placeholder
+ * rather than a bare header with no rows.
+ */
+function renderTable(columns, rows) {
+    if (rows.length === 0)
+        return '(no results)';
+    const matrix = rows.map((row) => columns.map((col) => cell(col.get(row))));
+    const widths = columns.map((col, i) => Math.max(col.header.length, ...matrix.map((r) => r[i].length)));
+    const pad = (text, width) => text.padEnd(width);
+    const line = (fields) => fields.map((f, i) => pad(f, widths[i])).join('  ').replace(/\s+$/, '');
+    const lines = [
+        line(columns.map((c) => c.header)),
+        line(widths.map((w) => '-'.repeat(w))),
+        ...matrix.map((r) => line(r)),
+    ];
+    return lines.join('\n');
+}
+/** Pretty-print any value as the `--json` output on stdout. */
+function printJson(io, value) {
+    io.out(JSON.stringify(value, null, 2));
+}
+/**
+ * Print a cursor-paginated list as either raw JSON or a table, and — in table
+ * mode, when there is another page — a footer naming the exact flag to fetch
+ * it. Keeping the hint next to the data is what makes `--starting-after`
+ * discoverable without the user reading `--help`.
+ */
+function printList(io, opts, page, raw = page) {
+    if (opts.json) {
+        printJson(io, raw);
+        return;
+    }
+    io.out(renderTable(opts.columns, page.data));
+    if (page.has_more && page.next_cursor) {
+        io.out('');
+        io.out(`More results — fetch the next page with: --starting-after ${page.next_cursor}`);
+    }
+}
+//# sourceMappingURL=output.js.map

package/dist/output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.js","sourceRoot":"","sources":["../src/output.ts"],"names":[],"mappings":";;AA0BA,0BAKC;AASD,kCAkBC;AAGD,8BAEC;AAQD,8BAeC;AAzED,yFAAyF;AACzF,SAAS,IAAI,CAAC,KAAc;IAC1B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,SAAgB,OAAO,CAAC,KAAc;IACpC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrD,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACxB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,WAAW,CAAI,OAAoB,EAAE,IAAS;IAC5D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,cAAc,CAAC;IAE7C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CACpC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC,CAAC,CAChE,CAAC;IAEF,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,CAAC,MAAgB,EAAE,EAAE,CAChC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAE1E,MAAM,KAAK,GAAG;QACZ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACtC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;KAC9B,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,+DAA+D;AAC/D,SAAgB,SAAS,CAAC,EAAM,EAAE,KAAc;IAC9C,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACzC,CAAC;AAED;;;;;GAKG;AACH,SAAgB,SAAS,CACvB,EAAM,EACN,IAA6C,EAC7C,IAAoE,EACpE,MAAe,IAAI;IAEnB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACnB,OAAO;IACT,CAAC;IACD,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7C,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACtC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACX,EAAE,CAAC,GAAG,CAAC,6DAA6D,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC"}

package/dist/prompt.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The interactive input seam for `atlas login`. An interface (not a direct
+ * `readline` call) so tests script answers without a TTY, and so `secret()`
+ * can hide the key no matter where it's wired.
+ */
+export interface Prompter {
+    /** A visible line of input, with an optional default shown in brackets. */
+    text(query: string, opts?: {
+        default?: string;
+    }): Promise<string>;
+    /** A hidden line of input — the terminal never echoes what's typed. */
+    secret(query: string): Promise<string>;
+}
+/** The real prompter, reading the TTY. Not exercised by unit tests (they inject). */
+export declare function defaultPrompter(input?: NodeJS.ReadableStream, output?: NodeJS.WritableStream): Prompter;