@atlasauth/cli 0.1.0 → 0.3.0

package/dist/help.js

@@ -17,8 +17,14 @@ Commands:
   users list|get|create|delete
   orgs list|get|members
   api-keys list|create|revoke
-  webhooks list
+  webhooks list|create
   sessions revoke
+  config export|import       Config-as-code: round-trip the instance's config
+  actions list|deploy|test|logs
+  init                       Create or complete an app's setup (idempotent); secrets to 0600 files
+  preflight                  Check an instance's setup; non-zero exit on errors (for CI)
+  env                        Print deploy variables: public values + secret file paths
+  client rotate              Rotate an OAuth client secret straight into its file
 
 Global options:
   --profile <name>           Use a named profile (default: active, else "default")
@@ -31,6 +37,10 @@ Global options:
 Environment overrides:
   ATLAS_SECRET_KEY           Secret key to use instead of the stored one
   ATLAS_API_URL              API URL to use instead of the stored one
+  ATLAS_PLATFORM_KEY         Platform key (psk_) for atlas init
+
+Secrets: a command that receives a secret writes it to a 0600 file under
+~/.config/<product>/ and prints only the path. --print-secret prints it instead.
 
 Run 'atlas <command> --help' for command-specific help.`;
 /** Per-command help, keyed by the resource word. */
@@ -65,15 +75,105 @@ Usage:
 
 Usage:
   atlas api-keys list [--subject-type <user|organization>] [--subject-id <id>] [--json]
-  atlas api-keys create --subject-type <user|organization> --subject-id <id> [--name <n>] [--json]
+  atlas api-keys create --subject-type <user|organization> --subject-id <id> [--name <n>]
+                        [--product <name>] [--force] [--print-secret] [--json]
   atlas api-keys revoke <api-key-id> [--json]`,
-    webhooks: `atlas webhooks — inspect webhook endpoints
+    webhooks: `atlas webhooks — manage webhook endpoints
+
+Usage:
+  atlas webhooks list [--json]
+  atlas webhooks create --url <https-url> [--events a,b] [--product <name>] [--print-secret] [--json]
+
+create writes the signing secret to a 0600 file and prints only its path.`,
+    init: `atlas init — create or complete an app's setup, idempotently
 
 Usage:
-  atlas webhooks list [--json]`,
+  atlas init --product <name> [--domain <domain>] [--auth-host <host>]
+             [--instance-env development|production] [--name <app-name>]
+             [--strategies password,email_code,...]
+             [--email managed|development|none] [--email-from <address>]
+             [--email-provider resend|brevo --email-key-file <path|->]
+             [--client-redirect <url>]... [--webhook-url <url>]
+             [--yes] [--force] [--rotate-secret] [--json]
+
+Needs a platform key (ATLAS_PLATFORM_KEY, or a psk_ profile from atlas login).
+Finds the app by name and environment, or creates it, then sets strategies, the
+email sender, the custom domain (auth.<domain> unless --auth-host; prints the
+CNAME), a first-party OAuth client and a webhook. Re-running only fills what is
+missing.
+
+Email always goes through YOUR provider account (Atlas lends none):
+  managed      Atlas sets your domain up on your Resend or Brevo account and
+               prints the DNS records.
+  development  development instances only: your provider without a verified
+               domain (Resend's onboarding@resend.dev by default), capped.
+The key is read from --email-key-file (a file holding the key or KEY=value; '-'
+reads stdin). It is never taken from argv and never printed.
+
+Every secret goes to ~/.config/<product>/<env>*.env (dir 0700, files 0600) and
+is never printed. An existing file is never overwritten without --force.
+--rotate-secret mints a new secret key when the app exists but its file is gone.
+Public values and file paths are kept in ~/.config/<product>/atlas.json.`,
+    preflight: `atlas preflight — check an instance's setup (a CI / deploy gate)
+
+Usage: atlas preflight [--instance <id> | --product <name> [--instance-env <env>]]
+                       [--fail-on error|warning] [--json]
+
+Prints every finding (severity, code, message, fix). Exits 1 when there is an
+error, or with --fail-on warning also on a warning.`,
+    env: `atlas env — print deploy variables without secrets
+
+Usage: atlas env --product <name> [--instance-env <env>] [--format dotenv|coolify|vercel] [--json]
+
+Public values (publishable key, Frontend API, issuer, discovery and JWKS URLs,
+OAuth client id) are printed as-is. Secrets are printed as references to their
+0600 files: *_FILE=<path> (dotenv), KEY=@<path> (coolify), or a vercel env add
+command that pipes the value from the file (vercel).`,
+    client: `atlas client — OAuth clients
+
+Usage: atlas client rotate <client-id> [--now | --overlap <seconds>]
+                           [--instance <id> | --product <name> [--instance-env <env>]]
+                           [--print-secret]
+
+Rotates the client secret and writes the new one straight to its 0600 file.
+--now revokes the old secret immediately; --overlap keeps it working for that
+many seconds. Prints when the old secret stops working.`,
     sessions: `atlas sessions — manage sessions
 
 Usage:
   atlas sessions revoke <session-id> [--json]`,
+    config: `atlas config — config-as-code for an Atlas instance (the Auth0 deploy-cli peer)
+
+Usage:
+  atlas config export [--dir <path>] [--format json|yaml]
+  atlas config import [--dir <path>] [--format json|yaml] [--dry-run] [--prune]
+
+export  Read the instance's current config (instance/auth config, OAuth clients
+        and providers, SSO connections, resource servers, JWT templates, roles,
+        webhook endpoints, billing plans, redirect URLs, org settings schema,
+        notification and email templates, org policies) and write a deterministic
+        directory tree — one file per resource type, keys sorted, SECRETS OMITTED.
+
+import  Diff the directory against live config and apply creates/updates
+        idempotently. A resource type with no file is left untouched.
+          --dry-run   print the plan and apply nothing
+          --prune     also delete live resources absent from the config
+          --dir       config directory (default: ./atlas-config)
+          --format    json (default) or yaml
+
+Secrets never live on disk. Inject a credential at import with a \${ENV_VAR}
+placeholder in a file (e.g. a provider "client_secret": "\${GOOGLE_SECRET}").`,
+    actions: `atlas actions — manage Actions (tenant code run in the auth pipeline)
+
+Usage:
+  atlas actions list [--json]
+  atlas actions deploy <file> --trigger <post_login|pre_user_registration|post_user_registration> [--name <n>] [--json]
+  atlas actions test <file> [--trigger <t>] [--json]
+  atlas actions logs <action-id> [--json]
+
+deploy uploads the file's code verbatim as a new action (created, not yet bound).
+test runs the file OFFLINE through the @atlasauth/actions harness — no network,
+no real users — and exits non-zero if the action throws. logs explains where an
+action's execution history is recorded (Atlas has no live log-stream endpoint).`,
 };
 //# sourceMappingURL=help.js.map

package/dist/help.js.map

@@ -1 +1 @@
-{"version":3,"file":"help.js","sourceRoot":"","sources":["../src/help.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEU,QAAA,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;wDA0BgC,CAAC;AAEzD,oDAAoD;AACvC,QAAA,YAAY,GAA2B;IAClD,KAAK,EAAE;;;;;;mCAM0B;IAEjC,MAAM,EAAE;;uCAE6B;IAErC,MAAM,EAAE;;gDAEsC;IAE9C,KAAK,EAAE;;;;;;wCAM+B;IAEtC,IAAI,EAAE;;;;;uCAK+B;IAErC,UAAU,EAAE;;;;;8CAKgC;IAE5C,QAAQ,EAAE;;;+BAGmB;IAE7B,QAAQ,EAAE;;;8CAGkC;CAC7C,CAAC"}
+{"version":3,"file":"help.js","sourceRoot":"","sources":["../src/help.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEU,QAAA,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wDAoCgC,CAAC;AAEzD,oDAAoD;AACvC,QAAA,YAAY,GAA2B;IAClD,KAAK,EAAE;;;;;;mCAM0B;IAEjC,MAAM,EAAE;;uCAE6B;IAErC,MAAM,EAAE;;gDAEsC;IAE9C,KAAK,EAAE;;;;;;wCAM+B;IAEtC,IAAI,EAAE;;;;;uCAK+B;IAErC,UAAU,EAAE;;;;;;8CAMgC;IAE5C,QAAQ,EAAE;;;;;;0EAM8D;IAExE,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;yEA4BiE;IAEvE,SAAS,EAAE;;;;;;oDAMuC;IAElD,GAAG,EAAE;;;;;;;qDAO8C;IAEnD,MAAM,EAAE;;;;;;;;wDAQ8C;IAEtD,QAAQ,EAAE;;;8CAGkC;IAE5C,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;8EAoBoE;IAC5E,OAAO,EAAE;;;;;;;;;;;gFAWqE;CAC/E,CAAC"}

package/dist/index.d.ts

@@ -6,6 +6,7 @@
  */
 export { run, type Handler } from './run';
 export { defaultContext, type RunContext, type ManagementClient } from './context';
+export { createConfigHttp, isNotFound, type ConfigHttp } from './config-http';
 export { CliError } from './errors';
 export { defaultIO, captureIO, type IO, type CaptureIO } from './io';
 export { FileConfigStore, MemoryConfigStore, defaultConfigPath, type ConfigStore, type ConfigFile, type Profile, } from './config';
@@ -17,3 +18,9 @@ export { orgs } from './commands/orgs';
 export { apiKeys } from './commands/api-keys';
 export { webhooks } from './commands/webhooks';
 export { sessions } from './commands/sessions';
+export { config } from './commands/config';
+export { actions } from './commands/actions';
+export { init } from './commands/init';
+export { preflight, envCommand, client } from './commands/project-commands';
+export { writeSecretFile, readEnvFile, parseDotenv, renderDotenv, productDir, deliverSecret, } from './secrets';
+export { readManifest, writeManifest, manifestPath, type ProjectManifest, type ProjectInstance, type InstanceEnv, } from './project';

package/dist/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.sessions = exports.webhooks = exports.apiKeys = exports.orgs = exports.users = exports.whoami = exports.logout = exports.login = exports.getVersion = exports.defaultPrompter = exports.defaultConfigPath = exports.MemoryConfigStore = exports.FileConfigStore = exports.captureIO = exports.defaultIO = exports.CliError = exports.defaultContext = exports.run = void 0;
+exports.manifestPath = exports.writeManifest = exports.readManifest = exports.deliverSecret = exports.productDir = exports.renderDotenv = exports.parseDotenv = exports.readEnvFile = exports.writeSecretFile = exports.client = exports.envCommand = exports.preflight = exports.init = exports.actions = exports.config = exports.sessions = exports.webhooks = exports.apiKeys = exports.orgs = exports.users = exports.whoami = exports.logout = exports.login = exports.getVersion = exports.defaultPrompter = exports.defaultConfigPath = exports.MemoryConfigStore = exports.FileConfigStore = exports.captureIO = exports.defaultIO = exports.CliError = exports.isNotFound = exports.createConfigHttp = exports.defaultContext = exports.run = void 0;
 /**
  * Library surface of `@atlasauth/cli`. The package ships a bin (`atlas`), but
  * exporting the pieces lets the handlers be unit-tested with injected deps and
@@ -11,6 +11,9 @@ var run_1 = require("./run");
 Object.defineProperty(exports, "run", { enumerable: true, get: function () { return run_1.run; } });
 var context_1 = require("./context");
 Object.defineProperty(exports, "defaultContext", { enumerable: true, get: function () { return context_1.defaultContext; } });
+var config_http_1 = require("./config-http");
+Object.defineProperty(exports, "createConfigHttp", { enumerable: true, get: function () { return config_http_1.createConfigHttp; } });
+Object.defineProperty(exports, "isNotFound", { enumerable: true, get: function () { return config_http_1.isNotFound; } });
 var errors_1 = require("./errors");
 Object.defineProperty(exports, "CliError", { enumerable: true, get: function () { return errors_1.CliError; } });
 var io_1 = require("./io");
@@ -39,4 +42,25 @@ var webhooks_1 = require("./commands/webhooks");
 Object.defineProperty(exports, "webhooks", { enumerable: true, get: function () { return webhooks_1.webhooks; } });
 var sessions_1 = require("./commands/sessions");
 Object.defineProperty(exports, "sessions", { enumerable: true, get: function () { return sessions_1.sessions; } });
+var config_2 = require("./commands/config");
+Object.defineProperty(exports, "config", { enumerable: true, get: function () { return config_2.config; } });
+var actions_1 = require("./commands/actions");
+Object.defineProperty(exports, "actions", { enumerable: true, get: function () { return actions_1.actions; } });
+var init_1 = require("./commands/init");
+Object.defineProperty(exports, "init", { enumerable: true, get: function () { return init_1.init; } });
+var project_commands_1 = require("./commands/project-commands");
+Object.defineProperty(exports, "preflight", { enumerable: true, get: function () { return project_commands_1.preflight; } });
+Object.defineProperty(exports, "envCommand", { enumerable: true, get: function () { return project_commands_1.envCommand; } });
+Object.defineProperty(exports, "client", { enumerable: true, get: function () { return project_commands_1.client; } });
+var secrets_1 = require("./secrets");
+Object.defineProperty(exports, "writeSecretFile", { enumerable: true, get: function () { return secrets_1.writeSecretFile; } });
+Object.defineProperty(exports, "readEnvFile", { enumerable: true, get: function () { return secrets_1.readEnvFile; } });
+Object.defineProperty(exports, "parseDotenv", { enumerable: true, get: function () { return secrets_1.parseDotenv; } });
+Object.defineProperty(exports, "renderDotenv", { enumerable: true, get: function () { return secrets_1.renderDotenv; } });
+Object.defineProperty(exports, "productDir", { enumerable: true, get: function () { return secrets_1.productDir; } });
+Object.defineProperty(exports, "deliverSecret", { enumerable: true, get: function () { return secrets_1.deliverSecret; } });
+var project_1 = require("./project");
+Object.defineProperty(exports, "readManifest", { enumerable: true, get: function () { return project_1.readManifest; } });
+Object.defineProperty(exports, "writeManifest", { enumerable: true, get: function () { return project_1.writeManifest; } });
+Object.defineProperty(exports, "manifestPath", { enumerable: true, get: function () { return project_1.manifestPath; } });
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA;;;;;GAKG;AACH,6BAA0C;AAAjC,0FAAA,GAAG,OAAA;AACZ,qCAAmF;AAA1E,yGAAA,cAAc,OAAA;AACvB,mCAAoC;AAA3B,kGAAA,QAAQ,OAAA;AACjB,2BAAqE;AAA5D,+FAAA,SAAS,OAAA;AAAE,+FAAA,SAAS,OAAA;AAC7B,mCAOkB;AANhB,yGAAA,eAAe,OAAA;AACf,2GAAA,iBAAiB,OAAA;AACjB,2GAAA,iBAAiB,OAAA;AAKnB,mCAA0D;AAAjD,yGAAA,eAAe,OAAA;AACxB,qCAAuC;AAA9B,qGAAA,UAAU,OAAA;AAEnB,0EAA0E;AAC1E,wCAAwD;AAA/C,6FAAA,KAAK,OAAA;AAAE,8FAAA,MAAM,OAAA;AAAE,8FAAA,MAAM,OAAA;AAC9B,0CAAyC;AAAhC,8FAAA,KAAK,OAAA;AACd,wCAAuC;AAA9B,4FAAA,IAAI,OAAA;AACb,gDAA8C;AAArC,mGAAA,OAAO,OAAA;AAChB,gDAA+C;AAAtC,oGAAA,QAAQ,OAAA;AACjB,gDAA+C;AAAtC,oGAAA,QAAQ,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA;;;;;GAKG;AACH,6BAA0C;AAAjC,0FAAA,GAAG,OAAA;AACZ,qCAAmF;AAA1E,yGAAA,cAAc,OAAA;AACvB,6CAA8E;AAArE,+GAAA,gBAAgB,OAAA;AAAE,yGAAA,UAAU,OAAA;AACrC,mCAAoC;AAA3B,kGAAA,QAAQ,OAAA;AACjB,2BAAqE;AAA5D,+FAAA,SAAS,OAAA;AAAE,+FAAA,SAAS,OAAA;AAC7B,mCAOkB;AANhB,yGAAA,eAAe,OAAA;AACf,2GAAA,iBAAiB,OAAA;AACjB,2GAAA,iBAAiB,OAAA;AAKnB,mCAA0D;AAAjD,yGAAA,eAAe,OAAA;AACxB,qCAAuC;AAA9B,qGAAA,UAAU,OAAA;AAEnB,0EAA0E;AAC1E,wCAAwD;AAA/C,6FAAA,KAAK,OAAA;AAAE,8FAAA,MAAM,OAAA;AAAE,8FAAA,MAAM,OAAA;AAC9B,0CAAyC;AAAhC,8FAAA,KAAK,OAAA;AACd,wCAAuC;AAA9B,4FAAA,IAAI,OAAA;AACb,gDAA8C;AAArC,mGAAA,OAAO,OAAA;AAChB,gDAA+C;AAAtC,oGAAA,QAAQ,OAAA;AACjB,gDAA+C;AAAtC,oGAAA,QAAQ,OAAA;AACjB,4CAA2C;AAAlC,gGAAA,MAAM,OAAA;AACf,8CAA6C;AAApC,kGAAA,OAAO,OAAA;AAChB,wCAAuC;AAA9B,4FAAA,IAAI,OAAA;AACb,gEAA4E;AAAnE,6GAAA,SAAS,OAAA;AAAE,8GAAA,UAAU,OAAA;AAAE,0GAAA,MAAM,OAAA;AACtC,qCAOmB;AANjB,0GAAA,eAAe,OAAA;AACf,sGAAA,WAAW,OAAA;AACX,sGAAA,WAAW,OAAA;AACX,uGAAA,YAAY,OAAA;AACZ,qGAAA,UAAU,OAAA;AACV,wGAAA,aAAa,OAAA;AAEf,qCAOmB;AANjB,uGAAA,YAAY,OAAA;AACZ,wGAAA,aAAa,OAAA;AACb,uGAAA,YAAY,OAAA"}

package/dist/project.d.ts

@@ -0,0 +1,63 @@
+import { type ConfigHttp } from './config-http';
+import type { RunContext } from './context';
+/**
+ * The project manifest `atlas init` keeps at `~/.config/<product>/atlas.json`:
+ * PUBLIC values only (ids, publishable key, hosts, redirect URIs) plus the path
+ * of each secret file. `atlas env`, `atlas preflight --instance` and
+ * `atlas client rotate` read it, so they know where a secret lives without
+ * ever holding it in the manifest.
+ */
+export type InstanceEnv = 'development' | 'production';
+export interface ProjectInstance {
+    instance_id: string;
+    environment: InstanceEnv;
+    publishable_key: string;
+    frontend_api_host: string | null;
+    issuer: string | null;
+    discovery_url: string | null;
+    jwks_uri: string | null;
+    /** The file holding ATLAS_SECRET_KEY. */
+    secret_file: string;
+    oauth_client?: {
+        id: string;
+        client_id: string;
+        redirect_uris: string[];
+        secret_file: string | null;
+    };
+    webhook?: {
+        id: string;
+        url: string;
+        secret_file: string | null;
+    };
+    custom_domain?: {
+        host: string;
+        cname_target: string | null;
+        status: string;
+    };
+    email?: {
+        mode: 'managed' | 'development' | 'none';
+        from_address?: string | null;
+    };
+}
+export interface ProjectManifest {
+    product: string;
+    api_url: string;
+    instances: Partial<Record<InstanceEnv, ProjectInstance>>;
+}
+export declare const MANIFEST_FILE = "atlas.json";
+export declare function manifestPath(env: NodeJS.ProcessEnv, product: string): string;
+export declare function readManifest(env: NodeJS.ProcessEnv, product: string): ProjectManifest | undefined;
+export declare function writeManifest(env: NodeJS.ProcessEnv, manifest: ProjectManifest): string;
+/** Find the project + instance an instance id belongs to, scanning every product directory. */
+export declare function findInstance(env: NodeJS.ProcessEnv, instanceId: string, product?: string): {
+    manifest: ProjectManifest;
+    instance: ProjectInstance;
+} | undefined;
+export declare function parseInstanceEnv(raw: string | undefined, fallback: InstanceEnv): InstanceEnv;
+/** The raw HTTP client for a credential (the context's, or the real one). */
+export declare function httpFor(ctx: RunContext, opts: {
+    secretKey: string;
+    apiUrl: string;
+}): ConfigHttp;
+/** Read the instance secret key from the project's secret file. */
+export declare function instanceSecretFromFile(instance: ProjectInstance): string;

package/dist/project.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MANIFEST_FILE = void 0;
+exports.manifestPath = manifestPath;
+exports.readManifest = readManifest;
+exports.writeManifest = writeManifest;
+exports.findInstance = findInstance;
+exports.parseInstanceEnv = parseInstanceEnv;
+exports.httpFor = httpFor;
+exports.instanceSecretFromFile = instanceSecretFromFile;
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const config_http_1 = require("./config-http");
+const errors_1 = require("./errors");
+const secrets_1 = require("./secrets");
+exports.MANIFEST_FILE = 'atlas.json';
+function manifestPath(env, product) {
+    return (0, node_path_1.join)((0, secrets_1.productDir)(env, product), exports.MANIFEST_FILE);
+}
+function readManifest(env, product) {
+    try {
+        return JSON.parse((0, node_fs_1.readFileSync)(manifestPath(env, product), 'utf8'));
+    }
+    catch {
+        return undefined;
+    }
+}
+function writeManifest(env, manifest) {
+    const dir = (0, secrets_1.productDir)(env, manifest.product);
+    (0, node_fs_1.mkdirSync)(dir, { recursive: true, mode: 0o700 });
+    const path = (0, node_path_1.join)(dir, exports.MANIFEST_FILE);
+    (0, node_fs_1.writeFileSync)(path, JSON.stringify(manifest, null, 2) + '\n', { mode: 0o600 });
+    (0, node_fs_1.chmodSync)(path, 0o600);
+    return path;
+}
+/** Find the project + instance an instance id belongs to, scanning every product directory. */
+function findInstance(env, instanceId, product) {
+    const products = product ? [product] : listProducts(env);
+    for (const p of products) {
+        const m = readManifest(env, p);
+        for (const inst of Object.values(m?.instances ?? {})) {
+            if (inst && inst.instance_id === instanceId)
+                return { manifest: m, instance: inst };
+        }
+    }
+    return undefined;
+}
+function listProducts(env) {
+    const base = env.XDG_CONFIG_HOME?.trim() || (0, node_path_1.join)(env.HOME?.trim() || (0, node_os_1.homedir)(), '.config');
+    try {
+        return (0, node_fs_1.readdirSync)(base).filter((d) => {
+            try {
+                (0, node_fs_1.readFileSync)((0, node_path_1.join)(base, d, exports.MANIFEST_FILE));
+                return true;
+            }
+            catch {
+                return false;
+            }
+        });
+    }
+    catch {
+        return [];
+    }
+}
+function parseInstanceEnv(raw, fallback) {
+    if (raw === undefined)
+        return fallback;
+    if (raw !== 'development' && raw !== 'production') {
+        throw new errors_1.CliError(`--instance-env must be development or production, got '${raw}'.`);
+    }
+    return raw;
+}
+/** The raw HTTP client for a credential (the context's, or the real one). */
+function httpFor(ctx, opts) {
+    return (ctx.makeHttp ?? config_http_1.createConfigHttp)(opts);
+}
+/** Read the instance secret key from the project's secret file. */
+function instanceSecretFromFile(instance) {
+    const key = (0, secrets_1.readEnvFile)(instance.secret_file)?.ATLAS_SECRET_KEY;
+    if (!key) {
+        throw new errors_1.CliError(`No ATLAS_SECRET_KEY in ${instance.secret_file}. Re-run 'atlas init' with --rotate-secret to mint a new one.`);
+    }
+    return key;
+}
+//# sourceMappingURL=project.js.map

package/dist/project.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project.js","sourceRoot":"","sources":["../src/project.ts"],"names":[],"mappings":";;;AA0CA,oCAEC;AAED,oCAMC;AAED,sCAOC;AAGD,oCAaC;AAkBD,4CAMC;AAGD,0BAEC;AAGD,wDAQC;AArHD,qCAAyF;AACzF,qCAAkC;AAClC,yCAAiC;AACjC,+CAAkE;AAElE,qCAAoC;AACpC,uCAAoD;AAkCvC,QAAA,aAAa,GAAG,YAAY,CAAC;AAE1C,SAAgB,YAAY,CAAC,GAAsB,EAAE,OAAe;IAClE,OAAO,IAAA,gBAAI,EAAC,IAAA,oBAAU,EAAC,GAAG,EAAE,OAAO,CAAC,EAAE,qBAAa,CAAC,CAAC;AACvD,CAAC;AAED,SAAgB,YAAY,CAAC,GAAsB,EAAE,OAAe;IAClE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAoB,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAgB,aAAa,CAAC,GAAsB,EAAE,QAAyB;IAC7E,MAAM,GAAG,GAAG,IAAA,oBAAU,EAAC,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAA,mBAAS,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,qBAAa,CAAC,CAAC;IACtC,IAAA,uBAAa,EAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,IAAA,mBAAS,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+FAA+F;AAC/F,SAAgB,YAAY,CAC1B,GAAsB,EACtB,UAAkB,EAClB,OAAgB;IAEhB,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACzD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;YACrD,IAAI,IAAI,IAAI,IAAI,CAAC,WAAW,KAAK,UAAU;gBAAE,OAAO,EAAE,QAAQ,EAAE,CAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACvF,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,GAAsB;IAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,IAAA,gBAAI,EAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,IAAA,iBAAO,GAAE,EAAE,SAAS,CAAC,CAAC;IAC3F,IAAI,CAAC;QACH,OAAO,IAAA,qBAAW,EAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACpC,IAAI,CAAC;gBACH,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,CAAC,EAAE,qBAAa,CAAC,CAAC,CAAC;gBAC3C,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAgB,gBAAgB,CAAC,GAAuB,EAAE,QAAqB;IAC7E,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACvC,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;QAClD,MAAM,IAAI,iBAAQ,CAAC,0DAA0D,GAAG,IAAI,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6EAA6E;AAC7E,SAAgB,OAAO,CAAC,GAAe,EAAE,IAA2C;IAClF,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,8BAAgB,CAAC,CAAC,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,mEAAmE;AACnE,SAAgB,sBAAsB,CAAC,QAAyB;IAC9D,MAAM,GAAG,GAAG,IAAA,qBAAW,EAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAChE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,iBAAQ,CAChB,0BAA0B,QAAQ,CAAC,WAAW,+DAA+D,CAC9G,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/run.js

@@ -3,8 +3,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.run = run;
 const backend_1 = require("@atlasauth/backend");
 const args_1 = require("./args");
+const actions_1 = require("./commands/actions");
 const api_keys_1 = require("./commands/api-keys");
 const auth_1 = require("./commands/auth");
+const config_1 = require("./commands/config");
+const init_1 = require("./commands/init");
+const project_commands_1 = require("./commands/project-commands");
 const orgs_1 = require("./commands/orgs");
 const sessions_1 = require("./commands/sessions");
 const users_1 = require("./commands/users");
@@ -22,6 +26,12 @@ const COMMANDS = {
     'api-keys': api_keys_1.apiKeys,
     webhooks: webhooks_1.webhooks,
     sessions: sessions_1.sessions,
+    config: config_1.config,
+    actions: actions_1.actions,
+    init: init_1.init,
+    preflight: project_commands_1.preflight,
+    env: project_commands_1.envCommand,
+    client: project_commands_1.client,
 };
 /**
  * The CLI's whole control flow, as a pure function of (argv, context) → exit

package/dist/run.js.map

@@ -1 +1 @@
-{"version":3,"file":"run.js","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":";;AAmCA,kBAwCC;AA3ED,gDAAmD;AACnD,iCAAgD;AAChD,kDAA8C;AAC9C,0CAAwD;AACxD,0CAAuC;AACvC,kDAA+C;AAC/C,4CAAyC;AACzC,kDAA+C;AAE/C,qCAAoC;AACpC,iCAAgD;AAChD,uCAAuC;AAKvC,kFAAkF;AAClF,MAAM,QAAQ,GAA4B;IACxC,KAAK,EAAL,YAAK;IACL,MAAM,EAAN,aAAM;IACN,MAAM,EAAN,aAAM;IACN,KAAK,EAAL,aAAK;IACL,IAAI,EAAJ,WAAI;IACJ,UAAU,EAAE,kBAAO;IACnB,QAAQ,EAAR,mBAAQ;IACR,QAAQ,EAAR,mBAAQ;CACT,CAAC;AAEF;;;;;;GAMG;AACI,KAAK,UAAU,GAAG,CAAC,IAAc,EAAE,GAAe;IACvD,IAAI,IAAgB,CAAC;IACrB,IAAI,CAAC;QACH,IAAI,GAAG,IAAA,YAAK,EAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,kDAAkD;IAClD,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACxB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAA,oBAAU,GAAE,CAAC,CAAC;QACzB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAEpC,qEAAqE;IACrE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,eAAQ,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,oBAAoB,OAAO,IAAI,CAAC,CAAC;QAC5C,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC5D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,sEAAsE;IACtE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACrB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,mBAAY,CAAC,OAAO,CAAC,IAAI,eAAQ,CAAC,CAAC;QAC9C,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,MAAM,CAAC,GAAe,EAAE,GAAY;IAC3C,IAAI,GAAG,YAAY,uBAAa,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,0BAA0B,GAAG,CAAC,MAAM,IAAI,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3E,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,GAAG,YAAY,iBAAQ,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACpC,OAAO,GAAG,CAAC,QAAQ,CAAC;IACtB,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC;IAChC,OAAO,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":";;AA6CA,kBAwCC;AArFD,gDAAmD;AACnD,iCAAgD;AAChD,gDAA6C;AAC7C,kDAA8C;AAC9C,0CAAwD;AACxD,8CAA2C;AAC3C,0CAAuC;AACvC,kEAA4E;AAC5E,0CAAuC;AACvC,kDAA+C;AAC/C,4CAAyC;AACzC,kDAA+C;AAE/C,qCAAoC;AACpC,iCAAgD;AAChD,uCAAuC;AAKvC,kFAAkF;AAClF,MAAM,QAAQ,GAA4B;IACxC,KAAK,EAAL,YAAK;IACL,MAAM,EAAN,aAAM;IACN,MAAM,EAAN,aAAM;IACN,KAAK,EAAL,aAAK;IACL,IAAI,EAAJ,WAAI;IACJ,UAAU,EAAE,kBAAO;IACnB,QAAQ,EAAR,mBAAQ;IACR,QAAQ,EAAR,mBAAQ;IACR,MAAM,EAAN,eAAM;IACN,OAAO,EAAP,iBAAO;IACP,IAAI,EAAJ,WAAI;IACJ,SAAS,EAAT,4BAAS;IACT,GAAG,EAAE,6BAAU;IACf,MAAM,EAAN,yBAAM;CACP,CAAC;AAEF;;;;;;GAMG;AACI,KAAK,UAAU,GAAG,CAAC,IAAc,EAAE,GAAe;IACvD,IAAI,IAAgB,CAAC;IACrB,IAAI,CAAC;QACH,IAAI,GAAG,IAAA,YAAK,EAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,kDAAkD;IAClD,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACxB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAA,oBAAU,GAAE,CAAC,CAAC;QACzB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAEpC,qEAAqE;IACrE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,eAAQ,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,oBAAoB,OAAO,IAAI,CAAC,CAAC;QAC5C,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC5D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,sEAAsE;IACtE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACrB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,mBAAY,CAAC,OAAO,CAAC,IAAI,eAAQ,CAAC,CAAC;QAC9C,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,MAAM,CAAC,GAAe,EAAE,GAAY;IAC3C,IAAI,GAAG,YAAY,uBAAa,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,0BAA0B,GAAG,CAAC,MAAM,IAAI,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3E,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,GAAG,YAAY,iBAAQ,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACpC,OAAO,GAAG,CAAC,QAAQ,CAAC;IACtB,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC;IAChC,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/secrets.d.ts

@@ -0,0 +1,41 @@
+import type { IO } from './io';
+export declare function assertProductName(product: string): string;
+/** `$XDG_CONFIG_HOME/<product>` (default `~/.config/<product>`). */
+export declare function productDir(env: NodeJS.ProcessEnv, product: string): string;
+export declare function renderDotenv(entries: Record<string, string>, comment?: string): string;
+/** Parse a dotenv file this CLI wrote (KEY=value lines, `#` comments). */
+export declare function parseDotenv(text: string): Record<string, string>;
+/**
+ * Write a 0600 dotenv file inside a 0700 directory. Refuses an existing file
+ * unless `force` (the same content is not a conflict: a re-run is a no-op).
+ * Returns the path.
+ */
+export declare function writeSecretFile(dir: string, fileName: string, entries: Record<string, string>, opts?: {
+    force?: boolean;
+    comment?: string;
+}): {
+    path: string;
+    written: boolean;
+};
+/** Read one of the CLI's env files, or undefined when it does not exist. */
+export declare function readEnvFile(path: string): Record<string, string> | undefined;
+/** The env files in a product directory (for `atlas env`). */
+export declare function listEnvFiles(dir: string): string[];
+/**
+ * The common "a secret arrived" path for single-secret commands: write it to
+ * `<dir>/<fileName>` (0600) and print the path, or — only with
+ * `--print-secret` — print it after a warning on stderr.
+ */
+export declare function deliverSecret(input: {
+    io: IO;
+    env: NodeJS.ProcessEnv;
+    product: string;
+    fileName: string;
+    entries: Record<string, string>;
+    label: string;
+    printSecret?: boolean;
+    force?: boolean;
+    comment?: string;
+}): {
+    path?: string;
+};

package/dist/secrets.js

@@ -0,0 +1,142 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertProductName = assertProductName;
+exports.productDir = productDir;
+exports.renderDotenv = renderDotenv;
+exports.parseDotenv = parseDotenv;
+exports.writeSecretFile = writeSecretFile;
+exports.readEnvFile = readEnvFile;
+exports.listEnvFiles = listEnvFiles;
+exports.deliverSecret = deliverSecret;
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const errors_1 = require("./errors");
+/**
+ * Secrets the CLI receives are written to disk, never printed.
+ *
+ * Every command that gets a secret back from the API (an instance secret key,
+ * an OAuth client secret, a webhook signing secret, an end-user API key) writes
+ * it to a dotenv file under `~/.config/<product>/` — directory 0700, file 0600 —
+ * and prints only the file path. `--print-secret` is the one explicit opt-out,
+ * and it prints a warning first. An existing file is never overwritten unless
+ * the command was given `--force`, so a re-run cannot silently destroy the only
+ * copy of a working secret.
+ *
+ * The product name doubles as the directory name, so it is restricted to a safe
+ * slug (no path separators, no dot-dot).
+ */
+const PRODUCT_RE = /^[a-z0-9][a-z0-9_-]{0,62}$/i;
+function assertProductName(product) {
+    if (!PRODUCT_RE.test(product)) {
+        throw new errors_1.CliError(`--product must be letters, digits, '-' or '_' (up to 63 characters), got '${product}'.`);
+    }
+    return product;
+}
+/** `$XDG_CONFIG_HOME/<product>` (default `~/.config/<product>`). */
+function productDir(env, product) {
+    const base = env.XDG_CONFIG_HOME?.trim() || (0, node_path_1.join)(env.HOME?.trim() || (0, node_os_1.homedir)(), '.config');
+    return (0, node_path_1.join)(base, assertProductName(product));
+}
+/** Quote a dotenv value when it needs it. Secrets are token-shaped, so this is rarely used. */
+function dotenvValue(v) {
+    return /^[A-Za-z0-9_./:@+=,-]*$/.test(v) ? v : JSON.stringify(v);
+}
+function renderDotenv(entries, comment) {
+    const lines = comment ? comment.split('\n').map((l) => `# ${l}`) : [];
+    for (const [k, v] of Object.entries(entries))
+        lines.push(`${k}=${dotenvValue(v)}`);
+    return lines.join('\n') + '\n';
+}
+/** Parse a dotenv file this CLI wrote (KEY=value lines, `#` comments). */
+function parseDotenv(text) {
+    const out = {};
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        const i = line.indexOf('=');
+        if (i < 1)
+            continue;
+        const key = line.slice(0, i).trim();
+        let value = line.slice(i + 1).trim();
+        if (value.startsWith('"') && value.endsWith('"')) {
+            try {
+                value = JSON.parse(value);
+            }
+            catch {
+                /* keep raw */
+            }
+        }
+        out[key] = value;
+    }
+    return out;
+}
+/**
+ * Write a 0600 dotenv file inside a 0700 directory. Refuses an existing file
+ * unless `force` (the same content is not a conflict: a re-run is a no-op).
+ * Returns the path.
+ */
+function writeSecretFile(dir, fileName, entries, opts = {}) {
+    if (fileName.includes('/') || fileName.includes('\\') || fileName.startsWith('.')) {
+        throw new errors_1.CliError(`Refusing to write a secret file named '${fileName}'.`);
+    }
+    const path = (0, node_path_1.join)(dir, fileName);
+    const content = renderDotenv(entries, opts.comment);
+    (0, node_fs_1.mkdirSync)(dir, { recursive: true, mode: 0o700 });
+    (0, node_fs_1.chmodSync)(dir, 0o700);
+    if ((0, node_fs_1.existsSync)(path)) {
+        const current = (0, node_fs_1.readFileSync)(path, 'utf8');
+        if (current === content) {
+            (0, node_fs_1.chmodSync)(path, 0o600);
+            return { path, written: false };
+        }
+        if (!opts.force) {
+            throw new errors_1.CliError(`${path} already exists and holds a different secret. Nothing was overwritten. Move it aside, or re-run with --force to replace it.`);
+        }
+    }
+    // Write THEN chmod: `mode` is masked by umask and ignored for an existing file.
+    (0, node_fs_1.writeFileSync)(path, content, { mode: 0o600 });
+    (0, node_fs_1.chmodSync)(path, 0o600);
+    return { path, written: true };
+}
+/** Read one of the CLI's env files, or undefined when it does not exist. */
+function readEnvFile(path) {
+    try {
+        return parseDotenv((0, node_fs_1.readFileSync)(path, 'utf8'));
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The env files in a product directory (for `atlas env`). */
+function listEnvFiles(dir) {
+    try {
+        return (0, node_fs_1.readdirSync)(dir)
+            .filter((f) => f.endsWith('.env'))
+            .sort();
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * The common "a secret arrived" path for single-secret commands: write it to
+ * `<dir>/<fileName>` (0600) and print the path, or — only with
+ * `--print-secret` — print it after a warning on stderr.
+ */
+function deliverSecret(input) {
+    if (input.printSecret) {
+        input.io.err(`atlas: warning: printing ${input.label} because --print-secret was given. It may end up in your shell history, terminal scrollback or CI logs.`);
+        for (const [k, v] of Object.entries(input.entries))
+            input.io.out(`${k}=${v}`);
+        return {};
+    }
+    const { path } = writeSecretFile(productDir(input.env, input.product), input.fileName, input.entries, {
+        force: input.force,
+        comment: input.comment,
+    });
+    input.io.out(`${input.label} written to ${path} (mode 0600).`);
+    return { path };
+}
+//# sourceMappingURL=secrets.js.map

package/dist/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":";;AAuBA,8CAOC;AAGD,gCAGC;AAOD,oCAIC;AAGD,kCAmBC;AAOD,0CA6BC;AAGD,kCAMC;AAGD,oCAQC;AAOD,sCAwBC;AA5JD,qCAAqG;AACrG,qCAAkC;AAClC,yCAAiC;AACjC,qCAAoC;AAGpC;;;;;;;;;;;;;GAaG;AAEH,MAAM,UAAU,GAAG,6BAA6B,CAAC;AAEjD,SAAgB,iBAAiB,CAAC,OAAe;IAC/C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,iBAAQ,CAChB,6EAA6E,OAAO,IAAI,CACzF,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,oEAAoE;AACpE,SAAgB,UAAU,CAAC,GAAsB,EAAE,OAAe;IAChE,MAAM,IAAI,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,IAAA,gBAAI,EAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,IAAA,iBAAO,GAAE,EAAE,SAAS,CAAC,CAAC;IAC3F,OAAO,IAAA,gBAAI,EAAC,IAAI,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,+FAA+F;AAC/F,SAAS,WAAW,CAAC,CAAS;IAC5B,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,SAAgB,YAAY,CAAC,OAA+B,EAAE,OAAgB;IAC5E,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC;AAED,0EAA0E;AAC1E,SAAgB,WAAW,CAAC,IAAY;IACtC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACpC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC;gBACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAW,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc;YAChB,CAAC;QACH,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAgB,eAAe,CAC7B,GAAW,EACX,QAAgB,EAChB,OAA+B,EAC/B,OAA8C,EAAE;IAEhD,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,iBAAQ,CAAC,0CAA0C,QAAQ,IAAI,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,IAAI,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACpD,IAAA,mBAAS,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,IAAA,mBAAS,EAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtB,IAAI,IAAA,oBAAU,EAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3C,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACxB,IAAA,mBAAS,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACvB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAClC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,iBAAQ,CAChB,GAAG,IAAI,6HAA6H,CACrI,CAAC;QACJ,CAAC;IACH,CAAC;IACD,gFAAgF;IAChF,IAAA,uBAAa,EAAC,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9C,IAAA,mBAAS,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,4EAA4E;AAC5E,SAAgB,WAAW,CAAC,IAAY;IACtC,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,8DAA8D;AAC9D,SAAgB,YAAY,CAAC,GAAW;IACtC,IAAI,CAAC;QACH,OAAO,IAAA,qBAAW,EAAC,GAAG,CAAC;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;aACjC,IAAI,EAAE,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAAC,KAU7B;IACC,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,KAAK,CAAC,EAAE,CAAC,GAAG,CACV,4BAA4B,KAAK,CAAC,KAAK,yGAAyG,CACjJ,CAAC;QACF,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;YAAE,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9E,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,GAAG,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE;QACpG,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IACH,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,eAAe,IAAI,eAAe,CAAC,CAAC;IAC/D,OAAO,EAAE,IAAI,EAAE,CAAC;AAClB,CAAC"}

package/dist/serialize.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The on-disk format for `atlas config` — the config-as-code layer. Two
+ * concerns live here, kept away from the command logic:
+ *
+ *  1. CANONICALIZATION. A value is normalised before it is written or compared
+ *     so an export is byte-for-byte deterministic and a round-trip is a no-op
+ *     diff. We sort object keys (the same rule Go's `json.Marshal` and the
+ *     Terraform provider's `canonicalJSON` use) and PRESERVE array order — so a
+ *     field whose order is meaningful (a claim mapping, an auth_config list) is
+ *     never silently reordered.
+ *
+ *  2. THE CODEC. JSON is the robust default. YAML is offered for readable diffs
+ *     in a repo; our YAML is a deliberately small, fully-specified subset where
+ *     every map key and every scalar is JSON-encoded, so it is unambiguous to
+ *     parse, round-trips exactly (newlines, URL-shaped keys, unicode and all),
+ *     and is still valid YAML (JSON is a YAML subset).
+ */
+export type Json = string | number | boolean | null | Json[] | {
+    [k: string]: Json;
+};
+export type Format = 'json' | 'yaml';
+/** A plain JSON value with all object keys recursively sorted; arrays untouched. */
+export declare function canonicalize(value: unknown): Json;
+/** Canonical JSON string — the equality oracle for the diff engine. */
+export declare function canonicalString(value: unknown): string;
+/** True when two config values are equal after canonicalization. */
+export declare function deepEqual(a: unknown, b: unknown): boolean;
+/** Serialize a canonicalizable value to the chosen format, with a trailing newline. */
+export declare function serialize(value: unknown, format: Format): string;
+/** Parse a document written by {@link serialize}. */
+export declare function deserialize(text: string, format: Format): Json;