@atlasauth/cli 0.1.0 → 0.3.0

package/dist/commands/project-commands.js

@@ -0,0 +1,236 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.preflight = preflight;
+exports.envCommand = envCommand;
+exports.client = client;
+const backend_1 = require("@atlasauth/backend");
+const args_1 = require("../args");
+const errors_1 = require("../errors");
+const output_1 = require("../output");
+const project_1 = require("../project");
+const secrets_1 = require("../secrets");
+const shared_1 = require("./shared");
+/**
+ * The project commands that sit beside `atlas init`: `preflight` (a CI gate),
+ * `env` (deploy variables without secrets) and `client rotate` (a new OAuth
+ * client secret, written straight to its file).
+ */
+/**
+ * The instance credential a project command runs with:
+ *  - `--instance <id>`: the instance's secret file from a project manifest;
+ *  - `--product <name>` [`--instance-env`]: that project's instance;
+ *  - otherwise the profile / ATLAS_SECRET_KEY, as every other command.
+ */
+function instanceCredential(ctx, args) {
+    const v = args.values;
+    const instanceId = (0, args_1.str)(v, 'instance');
+    const product = (0, args_1.str)(v, 'product');
+    if (instanceId) {
+        const found = (0, project_1.findInstance)(ctx.env, instanceId, product);
+        if (!found) {
+            throw new errors_1.CliError(`No project manifest knows instance ${instanceId}${product ? ` (product '${product}')` : ''}. Run 'atlas init' for it, or use ATLAS_SECRET_KEY.`);
+        }
+        return {
+            secretKey: (0, project_1.instanceSecretFromFile)(found.instance),
+            apiUrl: ctx.env.ATLAS_API_URL?.trim() || found.manifest.api_url,
+            manifest: found.manifest,
+            instance: found.instance,
+        };
+    }
+    if (product) {
+        const { manifest, instance } = projectInstance(ctx, args, product);
+        return {
+            secretKey: (0, project_1.instanceSecretFromFile)(instance),
+            apiUrl: ctx.env.ATLAS_API_URL?.trim() || manifest.api_url,
+            manifest,
+            instance,
+        };
+    }
+    const auth = (0, shared_1.resolveAuth)(ctx, v);
+    return { secretKey: auth.secretKey, apiUrl: auth.apiUrl };
+}
+/** The manifest instance for `--product` + `--instance-env` (default: production, else the only one). */
+function projectInstance(ctx, args, product) {
+    const manifest = (0, project_1.readManifest)(ctx.env, product);
+    if (!manifest) {
+        throw new errors_1.CliError(`No project '${product}' at ${(0, secrets_1.productDir)(ctx.env, product)}. Run 'atlas init --product ${product}' first.`);
+    }
+    const requested = (0, args_1.str)(args.values, 'instance-env');
+    const envs = Object.keys(manifest.instances);
+    const env = requested
+        ? (0, project_1.parseInstanceEnv)(requested, 'production')
+        : manifest.instances.production
+            ? 'production'
+            : envs.length === 1
+                ? envs[0]
+                : 'production';
+    const instance = manifest.instances[env];
+    if (!instance)
+        throw new errors_1.CliError(`Project '${product}' has no ${env} instance. Run 'atlas init --product ${product} --instance-env ${env}'.`);
+    return { manifest, instance };
+}
+const FINDING_COLUMNS = [
+    { header: 'SEVERITY', get: (f) => f.severity },
+    { header: 'CODE', get: (f) => f.code },
+    { header: 'MESSAGE', get: (f) => f.message },
+];
+/** `atlas preflight` — run the instance's setup checks; exit 1 on errors (or warnings with --fail-on warning). */
+async function preflight(ctx, args) {
+    const failOn = (0, args_1.str)(args.values, 'fail-on') ?? 'error';
+    if (failOn !== 'error' && failOn !== 'warning') {
+        throw new errors_1.CliError(`--fail-on must be error or warning, got '${failOn}'.`);
+    }
+    const cred = instanceCredential(ctx, args);
+    const report = await (0, project_1.httpFor)(ctx, cred).get('/v1/instance/preflight');
+    const findings = report.findings ?? [];
+    const errors = findings.filter((f) => f.severity === 'error').length;
+    const warnings = findings.filter((f) => f.severity === 'warning').length;
+    const failed = errors > 0 || (failOn === 'warning' && warnings > 0);
+    if ((0, shared_1.wantsJson)(args.values)) {
+        (0, output_1.printJson)(ctx.io, report);
+    }
+    else if (findings.length === 0) {
+        ctx.io.out('Preflight passed: no findings.');
+    }
+    else {
+        ctx.io.out((0, output_1.renderTable)(FINDING_COLUMNS, findings));
+        ctx.io.out('');
+        for (const f of findings.filter((x) => x.severity !== 'info')) {
+            ctx.io.out(`${f.code}: ${f.fix}`);
+        }
+        ctx.io.out('');
+        ctx.io.out(`${errors} error(s), ${warnings} warning(s), ${findings.length - errors - warnings} info.`);
+    }
+    if (failed) {
+        ctx.io.err(`atlas: preflight failed (${errors} error(s)${failOn === 'warning' ? `, ${warnings} warning(s)` : ''}).`);
+        return 1;
+    }
+    return 0;
+}
+// ---- atlas env ----------------------------------------------------------------
+const FORMATS = ['dotenv', 'coolify', 'vercel'];
+/** Public values, then each secret as a reference to its file — never the value. */
+async function envCommand(ctx, args) {
+    const format = ((0, args_1.str)(args.values, 'format') ?? 'dotenv');
+    if (!FORMATS.includes(format))
+        throw new errors_1.CliError(`--format must be one of: ${FORMATS.join(', ')} (got '${format}').`);
+    const product = (0, args_1.str)(args.values, 'product');
+    if (!product)
+        throw new errors_1.CliError('atlas env needs --product <name> (the name you passed to atlas init).');
+    const { manifest, instance } = projectInstance(ctx, args, product);
+    const pub = {
+        ATLAS_PUBLISHABLE_KEY: instance.publishable_key,
+        ATLAS_API_URL: manifest.api_url,
+    };
+    if (instance.frontend_api_host)
+        pub.ATLAS_FRONTEND_API = `https://${instance.frontend_api_host}`;
+    if (instance.issuer)
+        pub.ATLAS_ISSUER = instance.issuer;
+    if (instance.discovery_url)
+        pub.ATLAS_DISCOVERY_URL = instance.discovery_url;
+    if (instance.jwks_uri)
+        pub.ATLAS_JWKS_URI = instance.jwks_uri;
+    if (instance.oauth_client)
+        pub.ATLAS_CLIENT_ID = instance.oauth_client.client_id;
+    const secrets = [{ key: 'ATLAS_SECRET_KEY', file: instance.secret_file }];
+    if (instance.oauth_client?.secret_file)
+        secrets.push({ key: 'ATLAS_CLIENT_SECRET', file: instance.oauth_client.secret_file });
+    if (instance.webhook?.secret_file)
+        secrets.push({ key: 'ATLAS_WEBHOOK_SECRET', file: instance.webhook.secret_file });
+    if ((0, shared_1.wantsJson)(args.values)) {
+        (0, output_1.printJson)(ctx.io, { product, environment: instance.environment, public: pub, secret_files: Object.fromEntries(secrets.map((s) => [s.key, s.file])) });
+        return 0;
+    }
+    const out = (l) => ctx.io.out(l);
+    if (format === 'dotenv') {
+        out(`# ${product} (${instance.environment}): public values`);
+        for (const [k, v] of Object.entries(pub))
+            out(`${k}=${v}`);
+        out('# Secrets are not printed. Each *_FILE variable names the 0600 file that holds it.');
+        for (const s of secrets)
+            out(`${s.key}_FILE=${s.file}`);
+    }
+    else if (format === 'coolify') {
+        out(`# ${product} (${instance.environment}): paste into Coolify → Environment Variables (Developer view).`);
+        for (const [k, v] of Object.entries(pub))
+            out(`${k}=${v}`);
+        out('# Secrets: copy each value from its file (mark them as secret in Coolify):');
+        for (const s of secrets)
+            out(`${s.key}=@${s.file}`);
+    }
+    else {
+        out(`# ${product} (${instance.environment}): Vercel CLI commands. Secrets are piped from their files, never echoed.`);
+        const target = instance.environment === 'production' ? 'production' : 'preview';
+        for (const [k, v] of Object.entries(pub))
+            out(`printf '%s' '${v.replace(/'/g, "'\\''")}' | vercel env add ${k} ${target}`);
+        for (const s of secrets)
+            out(`sed -n 's/^${s.key}=//p' '${s.file}' | tr -d '\\n' | vercel env add ${s.key} ${target}`);
+    }
+    return 0;
+}
+// ---- atlas client rotate ----------------------------------------------------------
+/** `atlas client rotate <id> [--now | --overlap <seconds>]` — the new secret goes straight to its file. */
+async function client(ctx, args) {
+    const sub = args.positionals[1];
+    if (sub !== 'rotate') {
+        throw new errors_1.CliError(sub ? `Unknown subcommand 'client ${sub}'. Try: rotate.` : 'client needs a subcommand: rotate.');
+    }
+    const ref = (0, shared_1.requireArg)(args.positionals, 2, 'client-id');
+    const v = args.values;
+    const overlapRaw = (0, args_1.str)(v, 'overlap');
+    if (v.now === true && overlapRaw !== undefined)
+        throw new errors_1.CliError('Pass --now or --overlap, not both.');
+    let overlapSeconds;
+    if (v.now === true)
+        overlapSeconds = 0;
+    else if (overlapRaw !== undefined) {
+        const n = Number(overlapRaw);
+        if (!Number.isInteger(n) || n < 0)
+            throw new errors_1.CliError(`--overlap must be a whole number of seconds, got '${overlapRaw}'.`);
+        overlapSeconds = n;
+    }
+    const cred = instanceCredential(ctx, args);
+    const api = (0, project_1.httpFor)(ctx, cred);
+    // Accept the internal id or the public client_id.
+    let id = ref;
+    if (ref.startsWith('client_')) {
+        const rows = (await api.get('/v1/oauth_clients')).data ?? [];
+        const match = rows.find((c) => c.client_id === ref);
+        if (!match)
+            throw new errors_1.CliError(`No OAuth client with client_id ${ref} on this instance.`);
+        id = match.id;
+    }
+    let res;
+    try {
+        res = await api.post(`/v1/oauth_clients/${id}/rotate_secret`, overlapSeconds === undefined ? {} : { overlap_seconds: overlapSeconds });
+    }
+    catch (err) {
+        if (err instanceof backend_1.AtlasApiError && err.status === 404)
+            throw new errors_1.CliError(`No OAuth client ${ref} on this instance.`);
+        throw err;
+    }
+    const product = (0, args_1.str)(v, 'product') ?? cred.manifest?.product;
+    const env = cred.instance?.environment;
+    const fileName = product && env && cred.instance?.oauth_client?.id === res.id ? `${env}-oauth-client.env` : `oauth-client-${res.id}.env`;
+    const entries = { ATLAS_CLIENT_ID: res.client_id, ATLAS_CLIENT_SECRET: res.client_secret };
+    if (v['print-secret'] === true) {
+        (0, secrets_1.deliverSecret)({ io: ctx.io, env: ctx.env, product: product ?? 'atlasauth', fileName, entries, label: 'The new client secret', printSecret: true });
+    }
+    else {
+        // A rotation replaces the file by design: the old secret is the one being retired.
+        const { path } = (0, secrets_1.writeSecretFile)((0, secrets_1.productDir)(ctx.env, product ?? 'atlasauth'), fileName, entries, {
+            force: true,
+            comment: `OAuth client ${res.id}. Server-side only.`,
+        });
+        ctx.io.out(`New client secret for ${res.client_id} written to ${path} (mode 0600).`);
+    }
+    const expires = res.previous_secret_expires_at;
+    if (overlapSeconds === 0 || expires === null)
+        ctx.io.out('The previous secret stopped working immediately.');
+    else if (typeof expires === 'number')
+        ctx.io.out(`The previous secret keeps working until ${new Date(expires).toISOString()}.`);
+    else
+        ctx.io.out('The API did not say when the previous secret stops working; assume immediately and deploy the new one now.');
+    return 0;
+}
+//# sourceMappingURL=project-commands.js.map

package/dist/commands/project-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-commands.js","sourceRoot":"","sources":["../../src/commands/project-commands.ts"],"names":[],"mappings":";;AAuGA,8BAgCC;AAQD,gCA4CC;AAKD,wBAyDC;AAzPD,gDAAmD;AACnD,kCAA+C;AAE/C,sCAAqC;AACrC,sCAAgE;AAChE,wCAQoB;AACpB,wCAAwE;AACxE,qCAA8D;AAE9D;;;;GAIG;AAEH;;;;;GAKG;AACH,SAAS,kBAAkB,CACzB,GAAe,EACf,IAAgB;IAEhB,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IACtB,MAAM,UAAU,GAAG,IAAA,UAAG,EAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAA,UAAG,EAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAClC,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,IAAA,sBAAY,EAAC,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,iBAAQ,CAChB,sCAAsC,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,cAAc,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,qDAAqD,CACjJ,CAAC;QACJ,CAAC;QACD,OAAO;YACL,SAAS,EAAE,IAAA,gCAAsB,EAAC,KAAK,CAAC,QAAQ,CAAC;YACjD,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO;YAC/D,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACnE,OAAO;YACL,SAAS,EAAE,IAAA,gCAAsB,EAAC,QAAQ,CAAC;YAC3C,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,OAAO;YACzD,QAAQ;YACR,QAAQ;SACT,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAA,oBAAW,EAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACjC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;AAC5D,CAAC;AAED,yGAAyG;AACzG,SAAS,eAAe,CACtB,GAAe,EACf,IAAgB,EAChB,OAAe;IAEf,MAAM,QAAQ,GAAG,IAAA,sBAAY,EAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,iBAAQ,CAAC,eAAe,OAAO,QAAQ,IAAA,oBAAU,EAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,+BAA+B,OAAO,UAAU,CAAC,CAAC;IACjI,CAAC;IACD,MAAM,SAAS,GAAG,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAA8C,CAAC;IAC1F,MAAM,GAAG,GAAG,SAAS;QACnB,CAAC,CAAC,IAAA,0BAAgB,EAAC,SAAS,EAAE,YAAY,CAAC;QAC3C,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU;YAC7B,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;gBACjB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE;gBACV,CAAC,CAAC,YAAY,CAAC;IACrB,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,iBAAQ,CAAC,YAAY,OAAO,YAAY,GAAG,wCAAwC,OAAO,mBAAmB,GAAG,IAAI,CAAC,CAAC;IAC/I,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAWD,MAAM,eAAe,GAA+B;IAClD,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC9C,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;IACtC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE;CAC7C,CAAC;AAEF,kHAAkH;AAC3G,KAAK,UAAU,SAAS,CAAC,GAAe,EAAE,IAAgB;IAC/D,MAAM,MAAM,GAAG,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,OAAO,CAAC;IACtD,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/C,MAAM,IAAI,iBAAQ,CAAC,4CAA4C,MAAM,IAAI,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,IAAA,iBAAO,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC,GAAG,CAAgD,wBAAwB,CAAC,CAAC;IACrH,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;IACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM,CAAC;IACrE,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;IACzE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC;IAEpE,IAAI,IAAA,kBAAS,EAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAC5B,CAAC;SAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAA,oBAAW,EAAC,eAAe,EAAE,QAAQ,CAAC,CAAC,CAAC;QACnD,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACf,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,MAAM,cAAc,QAAQ,gBAAgB,QAAQ,CAAC,MAAM,GAAG,MAAM,GAAG,QAAQ,QAAQ,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,GAAG,CAAC,EAAE,CAAC,GAAG,CACR,4BAA4B,MAAM,YAAY,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,QAAQ,aAAa,CAAC,CAAC,CAAC,EAAE,IAAI,CACzG,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,kFAAkF;AAElF,MAAM,OAAO,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAU,CAAC;AAGzD,oFAAoF;AAC7E,KAAK,UAAU,UAAU,CAAC,GAAe,EAAE,IAAgB;IAChE,MAAM,MAAM,GAAG,CAAC,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,QAAQ,CAAc,CAAC;IACrE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,iBAAQ,CAAC,4BAA4B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,CAAC;IACvH,MAAM,OAAO,GAAG,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,iBAAQ,CAAC,uEAAuE,CAAC,CAAC;IAC1G,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAEnE,MAAM,GAAG,GAA2B;QAClC,qBAAqB,EAAE,QAAQ,CAAC,eAAe;QAC/C,aAAa,EAAE,QAAQ,CAAC,OAAO;KAChC,CAAC;IACF,IAAI,QAAQ,CAAC,iBAAiB;QAAE,GAAG,CAAC,kBAAkB,GAAG,WAAW,QAAQ,CAAC,iBAAiB,EAAE,CAAC;IACjG,IAAI,QAAQ,CAAC,MAAM;QAAE,GAAG,CAAC,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC;IACxD,IAAI,QAAQ,CAAC,aAAa;QAAE,GAAG,CAAC,mBAAmB,GAAG,QAAQ,CAAC,aAAa,CAAC;IAC7E,IAAI,QAAQ,CAAC,QAAQ;QAAE,GAAG,CAAC,cAAc,GAAG,QAAQ,CAAC,QAAQ,CAAC;IAC9D,IAAI,QAAQ,CAAC,YAAY;QAAE,GAAG,CAAC,eAAe,GAAG,QAAQ,CAAC,YAAY,CAAC,SAAS,CAAC;IAEjF,MAAM,OAAO,GAAyC,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAChH,IAAI,QAAQ,CAAC,YAAY,EAAE,WAAW;QAAE,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9H,IAAI,QAAQ,CAAC,OAAO,EAAE,WAAW;QAAE,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,sBAAsB,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAErH,IAAI,IAAA,kBAAS,EAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACtJ,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACzC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,GAAG,CAAC,KAAK,OAAO,KAAK,QAAQ,CAAC,WAAW,kBAAkB,CAAC,CAAC;QAC7D,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,oFAAoF,CAAC,CAAC;QAC1F,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;SAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,GAAG,CAAC,KAAK,OAAO,KAAK,QAAQ,CAAC,WAAW,iEAAiE,CAAC,CAAC;QAC5G,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,4EAA4E,CAAC,CAAC;QAClF,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,KAAK,OAAO,KAAK,QAAQ,CAAC,WAAW,2EAA2E,CAAC,CAAC;QACtH,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QAChF,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,sBAAsB,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;QAC3H,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,GAAG,CAAC,cAAc,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,oCAAoC,CAAC,CAAC,GAAG,IAAI,MAAM,EAAE,CAAC,CAAC;IACzH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,sFAAsF;AAEtF,2GAA2G;AACpG,KAAK,UAAU,MAAM,CAAC,GAAe,EAAE,IAAgB;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrB,MAAM,IAAI,iBAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,8BAA8B,GAAG,iBAAiB,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC;IACtH,CAAC;IACD,MAAM,GAAG,GAAG,IAAA,mBAAU,EAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;IACzD,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IACtB,MAAM,UAAU,GAAG,IAAA,UAAG,EAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACrC,IAAI,CAAC,CAAC,GAAG,KAAK,IAAI,IAAI,UAAU,KAAK,SAAS;QAAE,MAAM,IAAI,iBAAQ,CAAC,oCAAoC,CAAC,CAAC;IACzG,IAAI,cAAkC,CAAC;IACvC,IAAI,CAAC,CAAC,GAAG,KAAK,IAAI;QAAE,cAAc,GAAG,CAAC,CAAC;SAClC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,iBAAQ,CAAC,qDAAqD,UAAU,IAAI,CAAC,CAAC;QAC3H,cAAc,GAAG,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAA,iBAAO,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAE/B,kDAAkD;IAClD,IAAI,EAAE,GAAG,GAAG,CAAC;IACb,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,CAAsD,mBAAmB,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QAClH,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,GAAG,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,iBAAQ,CAAC,kCAAkC,GAAG,oBAAoB,CAAC,CAAC;QAC1F,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;IAChB,CAAC;IAED,IAAI,GAAyG,CAAC;IAC9G,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,gBAAgB,EAAE,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC;IACzI,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,uBAAa,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,MAAM,IAAI,iBAAQ,CAAC,mBAAmB,GAAG,oBAAoB,CAAC,CAAC;QACvH,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAG,IAAA,UAAG,EAAC,CAAC,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC;IACvC,MAAM,QAAQ,GAAG,OAAO,IAAI,GAAG,IAAI,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,mBAAmB,CAAC,CAAC,CAAC,gBAAgB,GAAG,CAAC,EAAE,MAAM,CAAC;IACzI,MAAM,OAAO,GAAG,EAAE,eAAe,EAAE,GAAG,CAAC,SAAS,EAAE,mBAAmB,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC;IAC3F,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC;QAC/B,IAAA,uBAAa,EAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,uBAAuB,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACrJ,CAAC;SAAM,CAAC;QACN,mFAAmF;QACnF,MAAM,EAAE,IAAI,EAAE,GAAG,IAAA,yBAAe,EAAC,IAAA,oBAAU,EAAC,GAAG,CAAC,GAAG,EAAE,OAAO,IAAI,WAAW,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE;YAC/F,KAAK,EAAE,IAAI;YACX,OAAO,EAAE,gBAAgB,GAAG,CAAC,EAAE,qBAAqB;SACrD,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,yBAAyB,GAAG,CAAC,SAAS,eAAe,IAAI,eAAe,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,0BAA0B,CAAC;IAC/C,IAAI,cAAc,KAAK,CAAC,IAAI,OAAO,KAAK,IAAI;QAAE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;SACxG,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,2CAA2C,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;;QAC3H,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,4GAA4G,CAAC,CAAC;IAC9H,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/commands/webhooks.d.ts

@@ -1,4 +1,7 @@
-import type { ParsedArgs } from '../args';
+import { type ParsedArgs } from '../args';
 import type { RunContext } from '../context';
-/** `atlas webhooks list` — the one read `client.webhooks` exposes for endpoints. */
+/**
+ * `atlas webhooks list | create`. `create` writes the endpoint's signing secret
+ * to a 0600 file (never printed unless --print-secret).
+ */
 export declare function webhooks(ctx: RunContext, args: ParsedArgs): Promise<number>;

package/dist/commands/webhooks.js

@@ -1,8 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.webhooks = webhooks;
+const args_1 = require("../args");
 const errors_1 = require("../errors");
 const output_1 = require("../output");
+const project_1 = require("../project");
+const secrets_1 = require("../secrets");
 const shared_1 = require("./shared");
 const COLUMNS = [
     { header: 'ID', get: (w) => w.id },
@@ -11,7 +14,10 @@ const COLUMNS = [
     { header: 'EVENTS', get: (w) => w.enabled_events },
     { header: 'CREATED', get: (w) => (0, output_1.fmtTime)(w.created_at) },
 ];
-/** `atlas webhooks list` — the one read `client.webhooks` exposes for endpoints. */
+/**
+ * `atlas webhooks list | create`. `create` writes the endpoint's signing secret
+ * to a 0600 file (never printed unless --print-secret).
+ */
 async function webhooks(ctx, args) {
     const sub = args.positionals[1];
     const json = (0, shared_1.wantsJson)(args.values);
@@ -25,10 +31,38 @@ async function webhooks(ctx, args) {
                 ctx.io.out((0, output_1.renderTable)(COLUMNS, page.data));
             return 0;
         }
+        case 'create': {
+            const url = (0, args_1.str)(args.values, 'url');
+            if (!url)
+                throw new errors_1.CliError('webhooks create requires --url <https-url>.');
+            const events = (0, args_1.list)(args.values, 'events');
+            const auth = (0, shared_1.resolveAuth)(ctx, args.values);
+            const endpoint = await (0, project_1.httpFor)(ctx, { secretKey: auth.secretKey, apiUrl: auth.apiUrl }).post('/v1/webhook_endpoints', { url, ...(events.length ? { enabled_events: events } : {}) });
+            const { secret, ...rest } = endpoint;
+            let secretFile;
+            if (secret) {
+                secretFile = (0, secrets_1.deliverSecret)({
+                    io: json ? { out: () => undefined, err: ctx.io.err } : ctx.io,
+                    env: ctx.env,
+                    product: (0, args_1.str)(args.values, 'product') ?? 'atlasauth',
+                    fileName: `webhook-${endpoint.id}.env`,
+                    entries: { ATLAS_WEBHOOK_SECRET: secret },
+                    label: 'The signing secret',
+                    printSecret: args.values['print-secret'] === true,
+                    force: args.values.force === true,
+                    comment: `Signing secret for webhook endpoint ${endpoint.id} (${url}).`,
+                }).path;
+            }
+            if (json)
+                (0, output_1.printJson)(ctx.io, args.values['print-secret'] === true ? endpoint : { ...rest, secret_file: secretFile ?? null });
+            else
+                ctx.io.out(`Created webhook endpoint ${endpoint.id} → ${endpoint.url}.`);
+            return 0;
+        }
         default:
             throw new errors_1.CliError(sub
-                ? `Unknown subcommand 'webhooks ${sub}'. Try: list.`
-                : 'webhooks needs a subcommand: list.');
+                ? `Unknown subcommand 'webhooks ${sub}'. Try: list, create.`
+                : 'webhooks needs a subcommand: list, create.');
     }
 }
 //# sourceMappingURL=webhooks.js.map

package/dist/commands/webhooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../src/commands/webhooks.ts"],"names":[],"mappings":";;AAgBA,4BAoBC;AAjCD,sCAAqC;AACrC,sCAAyE;AACzE,qCAAoD;AAEpD,MAAM,OAAO,GAA8B;IACzC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;IAClC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE;IACpC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE;IAC1C,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE;IAClD,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAO,EAAC,CAAC,CAAC,UAAU,CAAC,EAAE;CACzD,CAAC;AAEF,oFAAoF;AAC7E,KAAK,UAAU,QAAQ,CAAC,GAAe,EAAE,IAAgB;IAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,IAAA,kBAAS,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEpC,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,sBAAa,EAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YACpD,IAAI,IAAI;gBAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;;gBAC7B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAA,oBAAW,EAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACjD,OAAO,CAAC,CAAC;QACX,CAAC;QAED;YACE,MAAM,IAAI,iBAAQ,CAChB,GAAG;gBACD,CAAC,CAAC,gCAAgC,GAAG,eAAe;gBACpD,CAAC,CAAC,oCAAoC,CACzC,CAAC;IACN,CAAC;AACH,CAAC"}
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../src/commands/webhooks.ts"],"names":[],"mappings":";;AAqBA,4BAgDC;AApED,kCAAqD;AAErD,sCAAqC;AACrC,sCAAyE;AACzE,wCAAqC;AACrC,wCAA2C;AAC3C,qCAAiE;AAEjE,MAAM,OAAO,GAA8B;IACzC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;IAClC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE;IACpC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE;IAC1C,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE;IAClD,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAO,EAAC,CAAC,CAAC,UAAU,CAAC,EAAE;CACzD,CAAC;AAEF;;;GAGG;AACI,KAAK,UAAU,QAAQ,CAAC,GAAe,EAAE,IAAgB;IAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,IAAA,kBAAS,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEpC,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,sBAAa,EAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YACpD,IAAI,IAAI;gBAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;;gBAC7B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAA,oBAAW,EAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACjD,OAAO,CAAC,CAAC;QACX,CAAC;QAED,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,GAAG,GAAG,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACpC,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,iBAAQ,CAAC,6CAA6C,CAAC,CAAC;YAC5E,MAAM,MAAM,GAAG,IAAA,WAAI,EAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC3C,MAAM,IAAI,GAAG,IAAA,oBAAW,EAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,QAAQ,GAAG,MAAM,IAAA,iBAAO,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAE1F,uBAAuB,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAC1F,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,QAAQ,CAAC;YACrC,IAAI,UAA8B,CAAC;YACnC,IAAI,MAAM,EAAE,CAAC;gBACX,UAAU,GAAG,IAAA,uBAAa,EAAC;oBACzB,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE;oBAC7D,GAAG,EAAE,GAAG,CAAC,GAAG;oBACZ,OAAO,EAAE,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,WAAW;oBACnD,QAAQ,EAAE,WAAW,QAAQ,CAAC,EAAE,MAAM;oBACtC,OAAO,EAAE,EAAE,oBAAoB,EAAE,MAAM,EAAE;oBACzC,KAAK,EAAE,oBAAoB;oBAC3B,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,IAAI;oBACjD,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI;oBACjC,OAAO,EAAE,uCAAuC,QAAQ,CAAC,EAAE,KAAK,GAAG,IAAI;iBACxE,CAAC,CAAC,IAAI,CAAC;YACV,CAAC;YACD,IAAI,IAAI;gBAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,UAAU,IAAI,IAAI,EAAE,CAAC,CAAC;;gBACvH,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,4BAA4B,QAAQ,CAAC,EAAE,MAAM,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC;YAC9E,OAAO,CAAC,CAAC;QACX,CAAC;QAED;YACE,MAAM,IAAI,iBAAQ,CAChB,GAAG;gBACD,CAAC,CAAC,gCAAgC,GAAG,uBAAuB;gBAC5D,CAAC,CAAC,4CAA4C,CACjD,CAAC;IACN,CAAC;AACH,CAAC"}

package/dist/config-http.d.ts

@@ -0,0 +1,27 @@
+/**
+ * A tiny, management-API HTTP seam used only by `atlas config`. The typed
+ * `@atlasauth/backend` client deliberately exposes a NARROW, hand-curated
+ * surface (and omits several config-only endpoints — redirect URLs, the org
+ * settings schema, notification templates, webhook PATCH, …). The deploy tool
+ * instead speaks to the raw `/v1/...` endpoints the Terraform provider already
+ * drives, so it needs a thin verb-per-method client over the same credential.
+ *
+ * It reuses the backend's {@link AtlasApiError} so a failure is formatted by the
+ * CLI's one error reporter exactly like any other API error, and it is a plain
+ * interface so tests inject an in-memory fake with no network.
+ */
+export interface ConfigHttp {
+    get<T>(path: string): Promise<T>;
+    post<T>(path: string, body: unknown): Promise<T>;
+    put<T>(path: string, body: unknown): Promise<T>;
+    patch<T>(path: string, body: unknown): Promise<T>;
+    delete(path: string): Promise<void>;
+}
+/** The production {@link ConfigHttp}: Bearer-authed `fetch`, mirroring the backend client. */
+export declare function createConfigHttp(opts: {
+    secretKey: string;
+    apiUrl: string;
+    fetch?: typeof fetch;
+}): ConfigHttp;
+/** True when an error is an Atlas 404 — a resource that does not (yet) exist. */
+export declare function isNotFound(err: unknown): boolean;

package/dist/config-http.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createConfigHttp = createConfigHttp;
+exports.isNotFound = isNotFound;
+const backend_1 = require("@atlasauth/backend");
+/** The production {@link ConfigHttp}: Bearer-authed `fetch`, mirroring the backend client. */
+function createConfigHttp(opts) {
+    const base = opts.apiUrl.replace(/\/+$/, '');
+    const fetchImpl = opts.fetch ?? globalThis.fetch;
+    if (typeof fetchImpl !== 'function') {
+        throw new Error('No fetch implementation found for the Atlas config client.');
+    }
+    async function send(method, path, body) {
+        const headers = {
+            authorization: `Bearer ${opts.secretKey}`,
+            accept: 'application/json',
+        };
+        let payload;
+        if (body !== undefined) {
+            headers['content-type'] = 'application/json';
+            payload = JSON.stringify(body);
+        }
+        const res = await fetchImpl(`${base}${path}`, { method, headers, body: payload });
+        if (!res.ok)
+            throw await toApiError(res);
+        if (res.status === 204)
+            return undefined;
+        const text = await res.text();
+        return (text ? JSON.parse(text) : undefined);
+    }
+    return {
+        get: (path) => send('GET', path),
+        post: (path, body) => send('POST', path, body),
+        put: (path, body) => send('PUT', path, body),
+        patch: (path, body) => send('PATCH', path, body),
+        delete: async (path) => {
+            await send('DELETE', path);
+        },
+    };
+}
+async function toApiError(res) {
+    let errors = [];
+    const text = await res.text().catch(() => '');
+    if (text) {
+        try {
+            const parsed = JSON.parse(text);
+            if (Array.isArray(parsed.errors) && parsed.errors.length)
+                errors = parsed.errors;
+        }
+        catch {
+            /* non-JSON body */
+        }
+    }
+    if (!errors.length) {
+        errors = [{ code: 'UNKNOWN', message: `Atlas API request failed with status ${res.status}` }];
+    }
+    return new backend_1.AtlasApiError(res.status, errors);
+}
+/** True when an error is an Atlas 404 — a resource that does not (yet) exist. */
+function isNotFound(err) {
+    return err instanceof backend_1.AtlasApiError && err.status === 404;
+}
+//# sourceMappingURL=config-http.js.map

package/dist/config-http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-http.js","sourceRoot":"","sources":["../src/config-http.ts"],"names":[],"mappings":";;AAuBA,4CAqCC;AAoBD,gCAEC;AAlFD,gDAAwE;AAsBxE,8FAA8F;AAC9F,SAAgB,gBAAgB,CAAC,IAIhC;IACC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACjD,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IAED,KAAK,UAAU,IAAI,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACjE,MAAM,OAAO,GAA2B;YACtC,aAAa,EAAE,UAAU,IAAI,CAAC,SAAS,EAAE;YACzC,MAAM,EAAE,kBAAkB;SAC3B,CAAC;QACF,IAAI,OAA2B,CAAC;QAChC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YAC7C,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAc,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAO,CAAC,CAAC,CAAE,SAAe,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO;QACL,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC;QAChC,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC;QAC9C,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC;QAC5C,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;QAChD,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACrB,MAAM,IAAI,CAAO,QAAQ,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,GAAa;IACrC,IAAI,MAAM,GAAqB,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9C,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkC,CAAC;YACjE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM;gBAAE,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QACnF,CAAC;QAAC,MAAM,CAAC;YACP,mBAAmB;QACrB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,wCAAwC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,IAAI,uBAAa,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED,iFAAiF;AACjF,SAAgB,UAAU,CAAC,GAAY;IACrC,OAAO,GAAG,YAAY,uBAAa,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;AAC5D,CAAC"}

package/dist/context.d.ts

@@ -1,5 +1,6 @@
 import { type AtlasClient } from '@atlasauth/backend';
 import { type ConfigStore } from './config';
+import { type ConfigHttp } from './config-http';
 import { type IO } from './io';
 import { type Prompter } from './prompt';
 /**
@@ -8,7 +9,7 @@ import { type Prompter } from './prompt';
  * enforces — that the command set maps only onto namespaces that really exist,
  * and it keeps the fake a test injects small (five namespaces, not forty).
  */
-export type ManagementClient = Pick<AtlasClient, 'users' | 'organizations' | 'apiKeys' | 'webhooks' | 'sessions'>;
+export type ManagementClient = Pick<AtlasClient, 'users' | 'organizations' | 'apiKeys' | 'webhooks' | 'sessions' | 'actions'>;
 /**
  * Everything a command touches the outside world through, in one injectable
  * bag. Production wires the real IO/config/prompt/client; every test builds
@@ -26,6 +27,21 @@ export interface RunContext {
         secretKey: string;
         apiUrl: string;
     }) => ManagementClient;
+    /**
+     * Builds the raw management-API HTTP client used by `atlas config` (the
+     * config-only `/v1` endpoints the typed client omits). Optional so existing
+     * contexts stay valid; the config command falls back to the real one.
+     */
+    makeHttp?: (opts: {
+        secretKey: string;
+        apiUrl: string;
+    }) => ConfigHttp;
+    /**
+     * Read a file's text, for commands that take a path (`atlas actions deploy`
+     * / `test`). Injectable so a test drives them with an in-memory file instead
+     * of touching the disk. Defaults to reading UTF-8 off the real filesystem.
+     */
+    readFile: (path: string) => string;
 }
 /**
  * The production context, with any piece overridable. Tests call this with a

package/dist/context.js

@@ -1,8 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.defaultContext = defaultContext;
+const node_fs_1 = require("node:fs");
 const backend_1 = require("@atlasauth/backend");
 const config_1 = require("./config");
+const config_http_1 = require("./config-http");
 const io_1 = require("./io");
 const prompt_1 = require("./prompt");
 /**
@@ -17,6 +19,8 @@ function defaultContext(overrides = {}) {
         config: new config_1.FileConfigStore((0, config_1.defaultConfigPath)()),
         prompt: (0, prompt_1.defaultPrompter)(),
         makeClient: ({ secretKey, apiUrl }) => (0, backend_1.createAtlasClient)({ secretKey, apiUrl }),
+        makeHttp: ({ secretKey, apiUrl }) => (0, config_http_1.createConfigHttp)({ secretKey, apiUrl }),
+        readFile: (path) => (0, node_fs_1.readFileSync)(path, 'utf8'),
         ...overrides,
     };
 }

package/dist/context.js.map

@@ -1 +1 @@
-{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":";;AAqCA,wCASC;AA9CD,gDAAyE;AACzE,qCAAgF;AAChF,6BAA0C;AAC1C,qCAA0D;AA6B1D;;;;GAIG;AACH,SAAgB,cAAc,CAAC,YAAiC,EAAE;IAChE,OAAO;QACL,EAAE,EAAE,IAAA,cAAS,GAAE;QACf,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,MAAM,EAAE,IAAI,wBAAe,CAAC,IAAA,0BAAiB,GAAE,CAAC;QAChD,MAAM,EAAE,IAAA,wBAAe,GAAE;QACzB,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,IAAA,2BAAiB,EAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAC/E,GAAG,SAAS;KACb,CAAC;AACJ,CAAC"}
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":";;AAmDA,wCAWC;AA9DD,qCAAuC;AACvC,gDAAyE;AACzE,qCAAgF;AAChF,+CAAkE;AAClE,6BAA0C;AAC1C,qCAA0D;AAyC1D;;;;GAIG;AACH,SAAgB,cAAc,CAAC,YAAiC,EAAE;IAChE,OAAO;QACL,EAAE,EAAE,IAAA,cAAS,GAAE;QACf,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,MAAM,EAAE,IAAI,wBAAe,CAAC,IAAA,0BAAiB,GAAE,CAAC;QAChD,MAAM,EAAE,IAAA,wBAAe,GAAE;QACzB,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,IAAA,2BAAiB,EAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAC/E,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,IAAA,8BAAgB,EAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAC5E,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC;QAC9C,GAAG,SAAS;KACb,CAAC;AACJ,CAAC"}

package/dist/help.d.ts

@@ -3,6 +3,6 @@
  * out of the handlers so the dispatch code stays about control flow and the
  * copy can be read (and kept consistent) in one place.
  */
-export declare const TOP_HELP = "atlas \u2014 manage an Atlas instance from the terminal\n\nUsage: atlas <command> [subcommand] [arguments] [options]\n\nCommands:\n  login                      Authenticate and store a profile credential\n  logout                     Remove a stored profile credential\n  whoami                     Show the active profile and instance\n  users list|get|create|delete\n  orgs list|get|members\n  api-keys list|create|revoke\n  webhooks list\n  sessions revoke\n\nGlobal options:\n  --profile <name>           Use a named profile (default: active, else \"default\")\n  --json                     Emit raw JSON instead of a human table\n  --limit <n>                Page size for list commands that paginate\n  --starting-after <cursor>  Pagination cursor (from a prior page's hint)\n  -h, --help                 Show this help, or help for a command\n  -v, --version              Print the version\n\nEnvironment overrides:\n  ATLAS_SECRET_KEY           Secret key to use instead of the stored one\n  ATLAS_API_URL              API URL to use instead of the stored one\n\nRun 'atlas <command> --help' for command-specific help.";
+export declare const TOP_HELP = "atlas \u2014 manage an Atlas instance from the terminal\n\nUsage: atlas <command> [subcommand] [arguments] [options]\n\nCommands:\n  login                      Authenticate and store a profile credential\n  logout                     Remove a stored profile credential\n  whoami                     Show the active profile and instance\n  users list|get|create|delete\n  orgs list|get|members\n  api-keys list|create|revoke\n  webhooks list|create\n  sessions revoke\n  config export|import       Config-as-code: round-trip the instance's config\n  actions list|deploy|test|logs\n  init                       Create or complete an app's setup (idempotent); secrets to 0600 files\n  preflight                  Check an instance's setup; non-zero exit on errors (for CI)\n  env                        Print deploy variables: public values + secret file paths\n  client rotate              Rotate an OAuth client secret straight into its file\n\nGlobal options:\n  --profile <name>           Use a named profile (default: active, else \"default\")\n  --json                     Emit raw JSON instead of a human table\n  --limit <n>                Page size for list commands that paginate\n  --starting-after <cursor>  Pagination cursor (from a prior page's hint)\n  -h, --help                 Show this help, or help for a command\n  -v, --version              Print the version\n\nEnvironment overrides:\n  ATLAS_SECRET_KEY           Secret key to use instead of the stored one\n  ATLAS_API_URL              API URL to use instead of the stored one\n  ATLAS_PLATFORM_KEY         Platform key (psk_) for atlas init\n\nSecrets: a command that receives a secret writes it to a 0600 file under\n~/.config/<product>/ and prints only the path. --print-secret prints it instead.\n\nRun 'atlas <command> --help' for command-specific help.";
 /** Per-command help, keyed by the resource word. */
 export declare const COMMAND_HELP: Record<string, string>;