@atlasauth/cli 0.2.0 → 0.3.0

package/dist/commands/project-commands.js

@@ -0,0 +1,236 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.preflight = preflight;
+exports.envCommand = envCommand;
+exports.client = client;
+const backend_1 = require("@atlasauth/backend");
+const args_1 = require("../args");
+const errors_1 = require("../errors");
+const output_1 = require("../output");
+const project_1 = require("../project");
+const secrets_1 = require("../secrets");
+const shared_1 = require("./shared");
+/**
+ * The project commands that sit beside `atlas init`: `preflight` (a CI gate),
+ * `env` (deploy variables without secrets) and `client rotate` (a new OAuth
+ * client secret, written straight to its file).
+ */
+/**
+ * The instance credential a project command runs with:
+ *  - `--instance <id>`: the instance's secret file from a project manifest;
+ *  - `--product <name>` [`--instance-env`]: that project's instance;
+ *  - otherwise the profile / ATLAS_SECRET_KEY, as every other command.
+ */
+function instanceCredential(ctx, args) {
+    const v = args.values;
+    const instanceId = (0, args_1.str)(v, 'instance');
+    const product = (0, args_1.str)(v, 'product');
+    if (instanceId) {
+        const found = (0, project_1.findInstance)(ctx.env, instanceId, product);
+        if (!found) {
+            throw new errors_1.CliError(`No project manifest knows instance ${instanceId}${product ? ` (product '${product}')` : ''}. Run 'atlas init' for it, or use ATLAS_SECRET_KEY.`);
+        }
+        return {
+            secretKey: (0, project_1.instanceSecretFromFile)(found.instance),
+            apiUrl: ctx.env.ATLAS_API_URL?.trim() || found.manifest.api_url,
+            manifest: found.manifest,
+            instance: found.instance,
+        };
+    }
+    if (product) {
+        const { manifest, instance } = projectInstance(ctx, args, product);
+        return {
+            secretKey: (0, project_1.instanceSecretFromFile)(instance),
+            apiUrl: ctx.env.ATLAS_API_URL?.trim() || manifest.api_url,
+            manifest,
+            instance,
+        };
+    }
+    const auth = (0, shared_1.resolveAuth)(ctx, v);
+    return { secretKey: auth.secretKey, apiUrl: auth.apiUrl };
+}
+/** The manifest instance for `--product` + `--instance-env` (default: production, else the only one). */
+function projectInstance(ctx, args, product) {
+    const manifest = (0, project_1.readManifest)(ctx.env, product);
+    if (!manifest) {
+        throw new errors_1.CliError(`No project '${product}' at ${(0, secrets_1.productDir)(ctx.env, product)}. Run 'atlas init --product ${product}' first.`);
+    }
+    const requested = (0, args_1.str)(args.values, 'instance-env');
+    const envs = Object.keys(manifest.instances);
+    const env = requested
+        ? (0, project_1.parseInstanceEnv)(requested, 'production')
+        : manifest.instances.production
+            ? 'production'
+            : envs.length === 1
+                ? envs[0]
+                : 'production';
+    const instance = manifest.instances[env];
+    if (!instance)
+        throw new errors_1.CliError(`Project '${product}' has no ${env} instance. Run 'atlas init --product ${product} --instance-env ${env}'.`);
+    return { manifest, instance };
+}
+const FINDING_COLUMNS = [
+    { header: 'SEVERITY', get: (f) => f.severity },
+    { header: 'CODE', get: (f) => f.code },
+    { header: 'MESSAGE', get: (f) => f.message },
+];
+/** `atlas preflight` — run the instance's setup checks; exit 1 on errors (or warnings with --fail-on warning). */
+async function preflight(ctx, args) {
+    const failOn = (0, args_1.str)(args.values, 'fail-on') ?? 'error';
+    if (failOn !== 'error' && failOn !== 'warning') {
+        throw new errors_1.CliError(`--fail-on must be error or warning, got '${failOn}'.`);
+    }
+    const cred = instanceCredential(ctx, args);
+    const report = await (0, project_1.httpFor)(ctx, cred).get('/v1/instance/preflight');
+    const findings = report.findings ?? [];
+    const errors = findings.filter((f) => f.severity === 'error').length;
+    const warnings = findings.filter((f) => f.severity === 'warning').length;
+    const failed = errors > 0 || (failOn === 'warning' && warnings > 0);
+    if ((0, shared_1.wantsJson)(args.values)) {
+        (0, output_1.printJson)(ctx.io, report);
+    }
+    else if (findings.length === 0) {
+        ctx.io.out('Preflight passed: no findings.');
+    }
+    else {
+        ctx.io.out((0, output_1.renderTable)(FINDING_COLUMNS, findings));
+        ctx.io.out('');
+        for (const f of findings.filter((x) => x.severity !== 'info')) {
+            ctx.io.out(`${f.code}: ${f.fix}`);
+        }
+        ctx.io.out('');
+        ctx.io.out(`${errors} error(s), ${warnings} warning(s), ${findings.length - errors - warnings} info.`);
+    }
+    if (failed) {
+        ctx.io.err(`atlas: preflight failed (${errors} error(s)${failOn === 'warning' ? `, ${warnings} warning(s)` : ''}).`);
+        return 1;
+    }
+    return 0;
+}
+// ---- atlas env ----------------------------------------------------------------
+const FORMATS = ['dotenv', 'coolify', 'vercel'];
+/** Public values, then each secret as a reference to its file — never the value. */
+async function envCommand(ctx, args) {
+    const format = ((0, args_1.str)(args.values, 'format') ?? 'dotenv');
+    if (!FORMATS.includes(format))
+        throw new errors_1.CliError(`--format must be one of: ${FORMATS.join(', ')} (got '${format}').`);
+    const product = (0, args_1.str)(args.values, 'product');
+    if (!product)
+        throw new errors_1.CliError('atlas env needs --product <name> (the name you passed to atlas init).');
+    const { manifest, instance } = projectInstance(ctx, args, product);
+    const pub = {
+        ATLAS_PUBLISHABLE_KEY: instance.publishable_key,
+        ATLAS_API_URL: manifest.api_url,
+    };
+    if (instance.frontend_api_host)
+        pub.ATLAS_FRONTEND_API = `https://${instance.frontend_api_host}`;
+    if (instance.issuer)
+        pub.ATLAS_ISSUER = instance.issuer;
+    if (instance.discovery_url)
+        pub.ATLAS_DISCOVERY_URL = instance.discovery_url;
+    if (instance.jwks_uri)
+        pub.ATLAS_JWKS_URI = instance.jwks_uri;
+    if (instance.oauth_client)
+        pub.ATLAS_CLIENT_ID = instance.oauth_client.client_id;
+    const secrets = [{ key: 'ATLAS_SECRET_KEY', file: instance.secret_file }];
+    if (instance.oauth_client?.secret_file)
+        secrets.push({ key: 'ATLAS_CLIENT_SECRET', file: instance.oauth_client.secret_file });
+    if (instance.webhook?.secret_file)
+        secrets.push({ key: 'ATLAS_WEBHOOK_SECRET', file: instance.webhook.secret_file });
+    if ((0, shared_1.wantsJson)(args.values)) {
+        (0, output_1.printJson)(ctx.io, { product, environment: instance.environment, public: pub, secret_files: Object.fromEntries(secrets.map((s) => [s.key, s.file])) });
+        return 0;
+    }
+    const out = (l) => ctx.io.out(l);
+    if (format === 'dotenv') {
+        out(`# ${product} (${instance.environment}): public values`);
+        for (const [k, v] of Object.entries(pub))
+            out(`${k}=${v}`);
+        out('# Secrets are not printed. Each *_FILE variable names the 0600 file that holds it.');
+        for (const s of secrets)
+            out(`${s.key}_FILE=${s.file}`);
+    }
+    else if (format === 'coolify') {
+        out(`# ${product} (${instance.environment}): paste into Coolify → Environment Variables (Developer view).`);
+        for (const [k, v] of Object.entries(pub))
+            out(`${k}=${v}`);
+        out('# Secrets: copy each value from its file (mark them as secret in Coolify):');
+        for (const s of secrets)
+            out(`${s.key}=@${s.file}`);
+    }
+    else {
+        out(`# ${product} (${instance.environment}): Vercel CLI commands. Secrets are piped from their files, never echoed.`);
+        const target = instance.environment === 'production' ? 'production' : 'preview';
+        for (const [k, v] of Object.entries(pub))
+            out(`printf '%s' '${v.replace(/'/g, "'\\''")}' | vercel env add ${k} ${target}`);
+        for (const s of secrets)
+            out(`sed -n 's/^${s.key}=//p' '${s.file}' | tr -d '\\n' | vercel env add ${s.key} ${target}`);
+    }
+    return 0;
+}
+// ---- atlas client rotate ----------------------------------------------------------
+/** `atlas client rotate <id> [--now | --overlap <seconds>]` — the new secret goes straight to its file. */
+async function client(ctx, args) {
+    const sub = args.positionals[1];
+    if (sub !== 'rotate') {
+        throw new errors_1.CliError(sub ? `Unknown subcommand 'client ${sub}'. Try: rotate.` : 'client needs a subcommand: rotate.');
+    }
+    const ref = (0, shared_1.requireArg)(args.positionals, 2, 'client-id');
+    const v = args.values;
+    const overlapRaw = (0, args_1.str)(v, 'overlap');
+    if (v.now === true && overlapRaw !== undefined)
+        throw new errors_1.CliError('Pass --now or --overlap, not both.');
+    let overlapSeconds;
+    if (v.now === true)
+        overlapSeconds = 0;
+    else if (overlapRaw !== undefined) {
+        const n = Number(overlapRaw);
+        if (!Number.isInteger(n) || n < 0)
+            throw new errors_1.CliError(`--overlap must be a whole number of seconds, got '${overlapRaw}'.`);
+        overlapSeconds = n;
+    }
+    const cred = instanceCredential(ctx, args);
+    const api = (0, project_1.httpFor)(ctx, cred);
+    // Accept the internal id or the public client_id.
+    let id = ref;
+    if (ref.startsWith('client_')) {
+        const rows = (await api.get('/v1/oauth_clients')).data ?? [];
+        const match = rows.find((c) => c.client_id === ref);
+        if (!match)
+            throw new errors_1.CliError(`No OAuth client with client_id ${ref} on this instance.`);
+        id = match.id;
+    }
+    let res;
+    try {
+        res = await api.post(`/v1/oauth_clients/${id}/rotate_secret`, overlapSeconds === undefined ? {} : { overlap_seconds: overlapSeconds });
+    }
+    catch (err) {
+        if (err instanceof backend_1.AtlasApiError && err.status === 404)
+            throw new errors_1.CliError(`No OAuth client ${ref} on this instance.`);
+        throw err;
+    }
+    const product = (0, args_1.str)(v, 'product') ?? cred.manifest?.product;
+    const env = cred.instance?.environment;
+    const fileName = product && env && cred.instance?.oauth_client?.id === res.id ? `${env}-oauth-client.env` : `oauth-client-${res.id}.env`;
+    const entries = { ATLAS_CLIENT_ID: res.client_id, ATLAS_CLIENT_SECRET: res.client_secret };
+    if (v['print-secret'] === true) {
+        (0, secrets_1.deliverSecret)({ io: ctx.io, env: ctx.env, product: product ?? 'atlasauth', fileName, entries, label: 'The new client secret', printSecret: true });
+    }
+    else {
+        // A rotation replaces the file by design: the old secret is the one being retired.
+        const { path } = (0, secrets_1.writeSecretFile)((0, secrets_1.productDir)(ctx.env, product ?? 'atlasauth'), fileName, entries, {
+            force: true,
+            comment: `OAuth client ${res.id}. Server-side only.`,
+        });
+        ctx.io.out(`New client secret for ${res.client_id} written to ${path} (mode 0600).`);
+    }
+    const expires = res.previous_secret_expires_at;
+    if (overlapSeconds === 0 || expires === null)
+        ctx.io.out('The previous secret stopped working immediately.');
+    else if (typeof expires === 'number')
+        ctx.io.out(`The previous secret keeps working until ${new Date(expires).toISOString()}.`);
+    else
+        ctx.io.out('The API did not say when the previous secret stops working; assume immediately and deploy the new one now.');
+    return 0;
+}
+//# sourceMappingURL=project-commands.js.map

package/dist/commands/project-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-commands.js","sourceRoot":"","sources":["../../src/commands/project-commands.ts"],"names":[],"mappings":";;AAuGA,8BAgCC;AAQD,gCA4CC;AAKD,wBAyDC;AAzPD,gDAAmD;AACnD,kCAA+C;AAE/C,sCAAqC;AACrC,sCAAgE;AAChE,wCAQoB;AACpB,wCAAwE;AACxE,qCAA8D;AAE9D;;;;GAIG;AAEH;;;;;GAKG;AACH,SAAS,kBAAkB,CACzB,GAAe,EACf,IAAgB;IAEhB,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IACtB,MAAM,UAAU,GAAG,IAAA,UAAG,EAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAA,UAAG,EAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAClC,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,IAAA,sBAAY,EAAC,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,iBAAQ,CAChB,sCAAsC,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,cAAc,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,qDAAqD,CACjJ,CAAC;QACJ,CAAC;QACD,OAAO;YACL,SAAS,EAAE,IAAA,gCAAsB,EAAC,KAAK,CAAC,QAAQ,CAAC;YACjD,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO;YAC/D,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACnE,OAAO;YACL,SAAS,EAAE,IAAA,gCAAsB,EAAC,QAAQ,CAAC;YAC3C,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,OAAO;YACzD,QAAQ;YACR,QAAQ;SACT,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAA,oBAAW,EAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACjC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;AAC5D,CAAC;AAED,yGAAyG;AACzG,SAAS,eAAe,CACtB,GAAe,EACf,IAAgB,EAChB,OAAe;IAEf,MAAM,QAAQ,GAAG,IAAA,sBAAY,EAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,iBAAQ,CAAC,eAAe,OAAO,QAAQ,IAAA,oBAAU,EAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,+BAA+B,OAAO,UAAU,CAAC,CAAC;IACjI,CAAC;IACD,MAAM,SAAS,GAAG,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAA8C,CAAC;IAC1F,MAAM,GAAG,GAAG,SAAS;QACnB,CAAC,CAAC,IAAA,0BAAgB,EAAC,SAAS,EAAE,YAAY,CAAC;QAC3C,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU;YAC7B,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;gBACjB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE;gBACV,CAAC,CAAC,YAAY,CAAC;IACrB,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,iBAAQ,CAAC,YAAY,OAAO,YAAY,GAAG,wCAAwC,OAAO,mBAAmB,GAAG,IAAI,CAAC,CAAC;IAC/I,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAWD,MAAM,eAAe,GAA+B;IAClD,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC9C,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;IACtC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE;CAC7C,CAAC;AAEF,kHAAkH;AAC3G,KAAK,UAAU,SAAS,CAAC,GAAe,EAAE,IAAgB;IAC/D,MAAM,MAAM,GAAG,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,OAAO,CAAC;IACtD,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/C,MAAM,IAAI,iBAAQ,CAAC,4CAA4C,MAAM,IAAI,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,IAAA,iBAAO,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC,GAAG,CAAgD,wBAAwB,CAAC,CAAC;IACrH,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;IACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM,CAAC;IACrE,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;IACzE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC;IAEpE,IAAI,IAAA,kBAAS,EAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAC5B,CAAC;SAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAA,oBAAW,EAAC,eAAe,EAAE,QAAQ,CAAC,CAAC,CAAC;QACnD,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACf,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,MAAM,cAAc,QAAQ,gBAAgB,QAAQ,CAAC,MAAM,GAAG,MAAM,GAAG,QAAQ,QAAQ,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,GAAG,CAAC,EAAE,CAAC,GAAG,CACR,4BAA4B,MAAM,YAAY,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,QAAQ,aAAa,CAAC,CAAC,CAAC,EAAE,IAAI,CACzG,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,kFAAkF;AAElF,MAAM,OAAO,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAU,CAAC;AAGzD,oFAAoF;AAC7E,KAAK,UAAU,UAAU,CAAC,GAAe,EAAE,IAAgB;IAChE,MAAM,MAAM,GAAG,CAAC,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,QAAQ,CAAc,CAAC;IACrE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,iBAAQ,CAAC,4BAA4B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,CAAC;IACvH,MAAM,OAAO,GAAG,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,iBAAQ,CAAC,uEAAuE,CAAC,CAAC;IAC1G,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAEnE,MAAM,GAAG,GAA2B;QAClC,qBAAqB,EAAE,QAAQ,CAAC,eAAe;QAC/C,aAAa,EAAE,QAAQ,CAAC,OAAO;KAChC,CAAC;IACF,IAAI,QAAQ,CAAC,iBAAiB;QAAE,GAAG,CAAC,kBAAkB,GAAG,WAAW,QAAQ,CAAC,iBAAiB,EAAE,CAAC;IACjG,IAAI,QAAQ,CAAC,MAAM;QAAE,GAAG,CAAC,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC;IACxD,IAAI,QAAQ,CAAC,aAAa;QAAE,GAAG,CAAC,mBAAmB,GAAG,QAAQ,CAAC,aAAa,CAAC;IAC7E,IAAI,QAAQ,CAAC,QAAQ;QAAE,GAAG,CAAC,cAAc,GAAG,QAAQ,CAAC,QAAQ,CAAC;IAC9D,IAAI,QAAQ,CAAC,YAAY;QAAE,GAAG,CAAC,eAAe,GAAG,QAAQ,CAAC,YAAY,CAAC,SAAS,CAAC;IAEjF,MAAM,OAAO,GAAyC,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAChH,IAAI,QAAQ,CAAC,YAAY,EAAE,WAAW;QAAE,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9H,IAAI,QAAQ,CAAC,OAAO,EAAE,WAAW;QAAE,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,sBAAsB,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAErH,IAAI,IAAA,kBAAS,EAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACtJ,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACzC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,GAAG,CAAC,KAAK,OAAO,KAAK,QAAQ,CAAC,WAAW,kBAAkB,CAAC,CAAC;QAC7D,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,oFAAoF,CAAC,CAAC;QAC1F,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;SAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,GAAG,CAAC,KAAK,OAAO,KAAK,QAAQ,CAAC,WAAW,iEAAiE,CAAC,CAAC;QAC5G,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,4EAA4E,CAAC,CAAC;QAClF,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,KAAK,OAAO,KAAK,QAAQ,CAAC,WAAW,2EAA2E,CAAC,CAAC;QACtH,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QAChF,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,sBAAsB,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;QAC3H,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,GAAG,CAAC,cAAc,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,oCAAoC,CAAC,CAAC,GAAG,IAAI,MAAM,EAAE,CAAC,CAAC;IACzH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,sFAAsF;AAEtF,2GAA2G;AACpG,KAAK,UAAU,MAAM,CAAC,GAAe,EAAE,IAAgB;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrB,MAAM,IAAI,iBAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,8BAA8B,GAAG,iBAAiB,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC;IACtH,CAAC;IACD,MAAM,GAAG,GAAG,IAAA,mBAAU,EAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;IACzD,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IACtB,MAAM,UAAU,GAAG,IAAA,UAAG,EAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACrC,IAAI,CAAC,CAAC,GAAG,KAAK,IAAI,IAAI,UAAU,KAAK,SAAS;QAAE,MAAM,IAAI,iBAAQ,CAAC,oCAAoC,CAAC,CAAC;IACzG,IAAI,cAAkC,CAAC;IACvC,IAAI,CAAC,CAAC,GAAG,KAAK,IAAI;QAAE,cAAc,GAAG,CAAC,CAAC;SAClC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,iBAAQ,CAAC,qDAAqD,UAAU,IAAI,CAAC,CAAC;QAC3H,cAAc,GAAG,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAA,iBAAO,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAE/B,kDAAkD;IAClD,IAAI,EAAE,GAAG,GAAG,CAAC;IACb,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,CAAsD,mBAAmB,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QAClH,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,GAAG,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,iBAAQ,CAAC,kCAAkC,GAAG,oBAAoB,CAAC,CAAC;QAC1F,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;IAChB,CAAC;IAED,IAAI,GAAyG,CAAC;IAC9G,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,gBAAgB,EAAE,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC;IACzI,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,uBAAa,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,MAAM,IAAI,iBAAQ,CAAC,mBAAmB,GAAG,oBAAoB,CAAC,CAAC;QACvH,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAG,IAAA,UAAG,EAAC,CAAC,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC;IACvC,MAAM,QAAQ,GAAG,OAAO,IAAI,GAAG,IAAI,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,mBAAmB,CAAC,CAAC,CAAC,gBAAgB,GAAG,CAAC,EAAE,MAAM,CAAC;IACzI,MAAM,OAAO,GAAG,EAAE,eAAe,EAAE,GAAG,CAAC,SAAS,EAAE,mBAAmB,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC;IAC3F,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC;QAC/B,IAAA,uBAAa,EAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,uBAAuB,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACrJ,CAAC;SAAM,CAAC;QACN,mFAAmF;QACnF,MAAM,EAAE,IAAI,EAAE,GAAG,IAAA,yBAAe,EAAC,IAAA,oBAAU,EAAC,GAAG,CAAC,GAAG,EAAE,OAAO,IAAI,WAAW,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE;YAC/F,KAAK,EAAE,IAAI;YACX,OAAO,EAAE,gBAAgB,GAAG,CAAC,EAAE,qBAAqB;SACrD,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,yBAAyB,GAAG,CAAC,SAAS,eAAe,IAAI,eAAe,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,0BAA0B,CAAC;IAC/C,IAAI,cAAc,KAAK,CAAC,IAAI,OAAO,KAAK,IAAI;QAAE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;SACxG,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,2CAA2C,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;;QAC3H,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,4GAA4G,CAAC,CAAC;IAC9H,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/commands/webhooks.d.ts

@@ -1,4 +1,7 @@
-import type { ParsedArgs } from '../args';
+import { type ParsedArgs } from '../args';
 import type { RunContext } from '../context';
-/** `atlas webhooks list` — the one read `client.webhooks` exposes for endpoints. */
+/**
+ * `atlas webhooks list | create`. `create` writes the endpoint's signing secret
+ * to a 0600 file (never printed unless --print-secret).
+ */
 export declare function webhooks(ctx: RunContext, args: ParsedArgs): Promise<number>;

package/dist/commands/webhooks.js

@@ -1,8 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.webhooks = webhooks;
+const args_1 = require("../args");
 const errors_1 = require("../errors");
 const output_1 = require("../output");
+const project_1 = require("../project");
+const secrets_1 = require("../secrets");
 const shared_1 = require("./shared");
 const COLUMNS = [
     { header: 'ID', get: (w) => w.id },
@@ -11,7 +14,10 @@ const COLUMNS = [
     { header: 'EVENTS', get: (w) => w.enabled_events },
     { header: 'CREATED', get: (w) => (0, output_1.fmtTime)(w.created_at) },
 ];
-/** `atlas webhooks list` — the one read `client.webhooks` exposes for endpoints. */
+/**
+ * `atlas webhooks list | create`. `create` writes the endpoint's signing secret
+ * to a 0600 file (never printed unless --print-secret).
+ */
 async function webhooks(ctx, args) {
     const sub = args.positionals[1];
     const json = (0, shared_1.wantsJson)(args.values);
@@ -25,10 +31,38 @@ async function webhooks(ctx, args) {
                 ctx.io.out((0, output_1.renderTable)(COLUMNS, page.data));
             return 0;
         }
+        case 'create': {
+            const url = (0, args_1.str)(args.values, 'url');
+            if (!url)
+                throw new errors_1.CliError('webhooks create requires --url <https-url>.');
+            const events = (0, args_1.list)(args.values, 'events');
+            const auth = (0, shared_1.resolveAuth)(ctx, args.values);
+            const endpoint = await (0, project_1.httpFor)(ctx, { secretKey: auth.secretKey, apiUrl: auth.apiUrl }).post('/v1/webhook_endpoints', { url, ...(events.length ? { enabled_events: events } : {}) });
+            const { secret, ...rest } = endpoint;
+            let secretFile;
+            if (secret) {
+                secretFile = (0, secrets_1.deliverSecret)({
+                    io: json ? { out: () => undefined, err: ctx.io.err } : ctx.io,
+                    env: ctx.env,
+                    product: (0, args_1.str)(args.values, 'product') ?? 'atlasauth',
+                    fileName: `webhook-${endpoint.id}.env`,
+                    entries: { ATLAS_WEBHOOK_SECRET: secret },
+                    label: 'The signing secret',
+                    printSecret: args.values['print-secret'] === true,
+                    force: args.values.force === true,
+                    comment: `Signing secret for webhook endpoint ${endpoint.id} (${url}).`,
+                }).path;
+            }
+            if (json)
+                (0, output_1.printJson)(ctx.io, args.values['print-secret'] === true ? endpoint : { ...rest, secret_file: secretFile ?? null });
+            else
+                ctx.io.out(`Created webhook endpoint ${endpoint.id} → ${endpoint.url}.`);
+            return 0;
+        }
         default:
             throw new errors_1.CliError(sub
-                ? `Unknown subcommand 'webhooks ${sub}'. Try: list.`
-                : 'webhooks needs a subcommand: list.');
+                ? `Unknown subcommand 'webhooks ${sub}'. Try: list, create.`
+                : 'webhooks needs a subcommand: list, create.');
     }
 }
 //# sourceMappingURL=webhooks.js.map

package/dist/commands/webhooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../src/commands/webhooks.ts"],"names":[],"mappings":";;AAgBA,4BAoBC;AAjCD,sCAAqC;AACrC,sCAAyE;AACzE,qCAAoD;AAEpD,MAAM,OAAO,GAA8B;IACzC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;IAClC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE;IACpC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE;IAC1C,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE;IAClD,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAO,EAAC,CAAC,CAAC,UAAU,CAAC,EAAE;CACzD,CAAC;AAEF,oFAAoF;AAC7E,KAAK,UAAU,QAAQ,CAAC,GAAe,EAAE,IAAgB;IAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,IAAA,kBAAS,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEpC,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,sBAAa,EAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YACpD,IAAI,IAAI;gBAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;;gBAC7B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAA,oBAAW,EAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACjD,OAAO,CAAC,CAAC;QACX,CAAC;QAED;YACE,MAAM,IAAI,iBAAQ,CAChB,GAAG;gBACD,CAAC,CAAC,gCAAgC,GAAG,eAAe;gBACpD,CAAC,CAAC,oCAAoC,CACzC,CAAC;IACN,CAAC;AACH,CAAC"}
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../src/commands/webhooks.ts"],"names":[],"mappings":";;AAqBA,4BAgDC;AApED,kCAAqD;AAErD,sCAAqC;AACrC,sCAAyE;AACzE,wCAAqC;AACrC,wCAA2C;AAC3C,qCAAiE;AAEjE,MAAM,OAAO,GAA8B;IACzC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;IAClC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE;IACpC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE;IAC1C,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE;IAClD,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAO,EAAC,CAAC,CAAC,UAAU,CAAC,EAAE;CACzD,CAAC;AAEF;;;GAGG;AACI,KAAK,UAAU,QAAQ,CAAC,GAAe,EAAE,IAAgB;IAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,IAAA,kBAAS,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEpC,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,sBAAa,EAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YACpD,IAAI,IAAI;gBAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;;gBAC7B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAA,oBAAW,EAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACjD,OAAO,CAAC,CAAC;QACX,CAAC;QAED,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,GAAG,GAAG,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACpC,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,iBAAQ,CAAC,6CAA6C,CAAC,CAAC;YAC5E,MAAM,MAAM,GAAG,IAAA,WAAI,EAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC3C,MAAM,IAAI,GAAG,IAAA,oBAAW,EAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,QAAQ,GAAG,MAAM,IAAA,iBAAO,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAE1F,uBAAuB,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAC1F,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,QAAQ,CAAC;YACrC,IAAI,UAA8B,CAAC;YACnC,IAAI,MAAM,EAAE,CAAC;gBACX,UAAU,GAAG,IAAA,uBAAa,EAAC;oBACzB,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE;oBAC7D,GAAG,EAAE,GAAG,CAAC,GAAG;oBACZ,OAAO,EAAE,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,WAAW;oBACnD,QAAQ,EAAE,WAAW,QAAQ,CAAC,EAAE,MAAM;oBACtC,OAAO,EAAE,EAAE,oBAAoB,EAAE,MAAM,EAAE;oBACzC,KAAK,EAAE,oBAAoB;oBAC3B,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,IAAI;oBACjD,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI;oBACjC,OAAO,EAAE,uCAAuC,QAAQ,CAAC,EAAE,KAAK,GAAG,IAAI;iBACxE,CAAC,CAAC,IAAI,CAAC;YACV,CAAC;YACD,IAAI,IAAI;gBAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,UAAU,IAAI,IAAI,EAAE,CAAC,CAAC;;gBACvH,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,4BAA4B,QAAQ,CAAC,EAAE,MAAM,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC;YAC9E,OAAO,CAAC,CAAC;QACX,CAAC;QAED;YACE,MAAM,IAAI,iBAAQ,CAChB,GAAG;gBACD,CAAC,CAAC,gCAAgC,GAAG,uBAAuB;gBAC5D,CAAC,CAAC,4CAA4C,CACjD,CAAC;IACN,CAAC;AACH,CAAC"}

package/dist/help.d.ts

@@ -3,6 +3,6 @@
  * out of the handlers so the dispatch code stays about control flow and the
  * copy can be read (and kept consistent) in one place.
  */
-export declare const TOP_HELP = "atlas \u2014 manage an Atlas instance from the terminal\n\nUsage: atlas <command> [subcommand] [arguments] [options]\n\nCommands:\n  login                      Authenticate and store a profile credential\n  logout                     Remove a stored profile credential\n  whoami                     Show the active profile and instance\n  users list|get|create|delete\n  orgs list|get|members\n  api-keys list|create|revoke\n  webhooks list\n  sessions revoke\n  config export|import       Config-as-code: round-trip the instance's config\n  actions list|deploy|test|logs\n\nGlobal options:\n  --profile <name>           Use a named profile (default: active, else \"default\")\n  --json                     Emit raw JSON instead of a human table\n  --limit <n>                Page size for list commands that paginate\n  --starting-after <cursor>  Pagination cursor (from a prior page's hint)\n  -h, --help                 Show this help, or help for a command\n  -v, --version              Print the version\n\nEnvironment overrides:\n  ATLAS_SECRET_KEY           Secret key to use instead of the stored one\n  ATLAS_API_URL              API URL to use instead of the stored one\n\nRun 'atlas <command> --help' for command-specific help.";
+export declare const TOP_HELP = "atlas \u2014 manage an Atlas instance from the terminal\n\nUsage: atlas <command> [subcommand] [arguments] [options]\n\nCommands:\n  login                      Authenticate and store a profile credential\n  logout                     Remove a stored profile credential\n  whoami                     Show the active profile and instance\n  users list|get|create|delete\n  orgs list|get|members\n  api-keys list|create|revoke\n  webhooks list|create\n  sessions revoke\n  config export|import       Config-as-code: round-trip the instance's config\n  actions list|deploy|test|logs\n  init                       Create or complete an app's setup (idempotent); secrets to 0600 files\n  preflight                  Check an instance's setup; non-zero exit on errors (for CI)\n  env                        Print deploy variables: public values + secret file paths\n  client rotate              Rotate an OAuth client secret straight into its file\n\nGlobal options:\n  --profile <name>           Use a named profile (default: active, else \"default\")\n  --json                     Emit raw JSON instead of a human table\n  --limit <n>                Page size for list commands that paginate\n  --starting-after <cursor>  Pagination cursor (from a prior page's hint)\n  -h, --help                 Show this help, or help for a command\n  -v, --version              Print the version\n\nEnvironment overrides:\n  ATLAS_SECRET_KEY           Secret key to use instead of the stored one\n  ATLAS_API_URL              API URL to use instead of the stored one\n  ATLAS_PLATFORM_KEY         Platform key (psk_) for atlas init\n\nSecrets: a command that receives a secret writes it to a 0600 file under\n~/.config/<product>/ and prints only the path. --print-secret prints it instead.\n\nRun 'atlas <command> --help' for command-specific help.";
 /** Per-command help, keyed by the resource word. */
 export declare const COMMAND_HELP: Record<string, string>;

package/dist/help.js

@@ -17,10 +17,14 @@ Commands:
   users list|get|create|delete
   orgs list|get|members
   api-keys list|create|revoke
-  webhooks list
+  webhooks list|create
   sessions revoke
   config export|import       Config-as-code: round-trip the instance's config
   actions list|deploy|test|logs
+  init                       Create or complete an app's setup (idempotent); secrets to 0600 files
+  preflight                  Check an instance's setup; non-zero exit on errors (for CI)
+  env                        Print deploy variables: public values + secret file paths
+  client rotate              Rotate an OAuth client secret straight into its file
 
 Global options:
   --profile <name>           Use a named profile (default: active, else "default")
@@ -33,6 +37,10 @@ Global options:
 Environment overrides:
   ATLAS_SECRET_KEY           Secret key to use instead of the stored one
   ATLAS_API_URL              API URL to use instead of the stored one
+  ATLAS_PLATFORM_KEY         Platform key (psk_) for atlas init
+
+Secrets: a command that receives a secret writes it to a 0600 file under
+~/.config/<product>/ and prints only the path. --print-secret prints it instead.
 
 Run 'atlas <command> --help' for command-specific help.`;
 /** Per-command help, keyed by the resource word. */
@@ -67,12 +75,69 @@ Usage:
 
 Usage:
   atlas api-keys list [--subject-type <user|organization>] [--subject-id <id>] [--json]
-  atlas api-keys create --subject-type <user|organization> --subject-id <id> [--name <n>] [--json]
+  atlas api-keys create --subject-type <user|organization> --subject-id <id> [--name <n>]
+                        [--product <name>] [--force] [--print-secret] [--json]
   atlas api-keys revoke <api-key-id> [--json]`,
-    webhooks: `atlas webhooks — inspect webhook endpoints
+    webhooks: `atlas webhooks — manage webhook endpoints
+
+Usage:
+  atlas webhooks list [--json]
+  atlas webhooks create --url <https-url> [--events a,b] [--product <name>] [--print-secret] [--json]
+
+create writes the signing secret to a 0600 file and prints only its path.`,
+    init: `atlas init — create or complete an app's setup, idempotently
 
 Usage:
-  atlas webhooks list [--json]`,
+  atlas init --product <name> [--domain <domain>] [--auth-host <host>]
+             [--instance-env development|production] [--name <app-name>]
+             [--strategies password,email_code,...]
+             [--email managed|development|none] [--email-from <address>]
+             [--email-provider resend|brevo --email-key-file <path|->]
+             [--client-redirect <url>]... [--webhook-url <url>]
+             [--yes] [--force] [--rotate-secret] [--json]
+
+Needs a platform key (ATLAS_PLATFORM_KEY, or a psk_ profile from atlas login).
+Finds the app by name and environment, or creates it, then sets strategies, the
+email sender, the custom domain (auth.<domain> unless --auth-host; prints the
+CNAME), a first-party OAuth client and a webhook. Re-running only fills what is
+missing.
+
+Email always goes through YOUR provider account (Atlas lends none):
+  managed      Atlas sets your domain up on your Resend or Brevo account and
+               prints the DNS records.
+  development  development instances only: your provider without a verified
+               domain (Resend's onboarding@resend.dev by default), capped.
+The key is read from --email-key-file (a file holding the key or KEY=value; '-'
+reads stdin). It is never taken from argv and never printed.
+
+Every secret goes to ~/.config/<product>/<env>*.env (dir 0700, files 0600) and
+is never printed. An existing file is never overwritten without --force.
+--rotate-secret mints a new secret key when the app exists but its file is gone.
+Public values and file paths are kept in ~/.config/<product>/atlas.json.`,
+    preflight: `atlas preflight — check an instance's setup (a CI / deploy gate)
+
+Usage: atlas preflight [--instance <id> | --product <name> [--instance-env <env>]]
+                       [--fail-on error|warning] [--json]
+
+Prints every finding (severity, code, message, fix). Exits 1 when there is an
+error, or with --fail-on warning also on a warning.`,
+    env: `atlas env — print deploy variables without secrets
+
+Usage: atlas env --product <name> [--instance-env <env>] [--format dotenv|coolify|vercel] [--json]
+
+Public values (publishable key, Frontend API, issuer, discovery and JWKS URLs,
+OAuth client id) are printed as-is. Secrets are printed as references to their
+0600 files: *_FILE=<path> (dotenv), KEY=@<path> (coolify), or a vercel env add
+command that pipes the value from the file (vercel).`,
+    client: `atlas client — OAuth clients
+
+Usage: atlas client rotate <client-id> [--now | --overlap <seconds>]
+                           [--instance <id> | --product <name> [--instance-env <env>]]
+                           [--print-secret]
+
+Rotates the client secret and writes the new one straight to its 0600 file.
+--now revokes the old secret immediately; --overlap keeps it working for that
+many seconds. Prints when the old secret stops working.`,
     sessions: `atlas sessions — manage sessions
 
 Usage:

package/dist/help.js.map

@@ -1 +1 @@
-{"version":3,"file":"help.js","sourceRoot":"","sources":["../src/help.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEU,QAAA,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;wDA4BgC,CAAC;AAEzD,oDAAoD;AACvC,QAAA,YAAY,GAA2B;IAClD,KAAK,EAAE;;;;;;mCAM0B;IAEjC,MAAM,EAAE;;uCAE6B;IAErC,MAAM,EAAE;;gDAEsC;IAE9C,KAAK,EAAE;;;;;;wCAM+B;IAEtC,IAAI,EAAE;;;;;uCAK+B;IAErC,UAAU,EAAE;;;;;8CAKgC;IAE5C,QAAQ,EAAE;;;+BAGmB;IAE7B,QAAQ,EAAE;;;8CAGkC;IAE5C,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;8EAoBoE;IAC5E,OAAO,EAAE;;;;;;;;;;;gFAWqE;CAC/E,CAAC"}
+{"version":3,"file":"help.js","sourceRoot":"","sources":["../src/help.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEU,QAAA,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wDAoCgC,CAAC;AAEzD,oDAAoD;AACvC,QAAA,YAAY,GAA2B;IAClD,KAAK,EAAE;;;;;;mCAM0B;IAEjC,MAAM,EAAE;;uCAE6B;IAErC,MAAM,EAAE;;gDAEsC;IAE9C,KAAK,EAAE;;;;;;wCAM+B;IAEtC,IAAI,EAAE;;;;;uCAK+B;IAErC,UAAU,EAAE;;;;;;8CAMgC;IAE5C,QAAQ,EAAE;;;;;;0EAM8D;IAExE,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;yEA4BiE;IAEvE,SAAS,EAAE;;;;;;oDAMuC;IAElD,GAAG,EAAE;;;;;;;qDAO8C;IAEnD,MAAM,EAAE;;;;;;;;wDAQ8C;IAEtD,QAAQ,EAAE;;;8CAGkC;IAE5C,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;8EAoBoE;IAC5E,OAAO,EAAE;;;;;;;;;;;gFAWqE;CAC/E,CAAC"}

package/dist/index.d.ts

@@ -20,3 +20,7 @@ export { webhooks } from './commands/webhooks';
 export { sessions } from './commands/sessions';
 export { config } from './commands/config';
 export { actions } from './commands/actions';
+export { init } from './commands/init';
+export { preflight, envCommand, client } from './commands/project-commands';
+export { writeSecretFile, readEnvFile, parseDotenv, renderDotenv, productDir, deliverSecret, } from './secrets';
+export { readManifest, writeManifest, manifestPath, type ProjectManifest, type ProjectInstance, type InstanceEnv, } from './project';

package/dist/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.actions = exports.config = exports.sessions = exports.webhooks = exports.apiKeys = exports.orgs = exports.users = exports.whoami = exports.logout = exports.login = exports.getVersion = exports.defaultPrompter = exports.defaultConfigPath = exports.MemoryConfigStore = exports.FileConfigStore = exports.captureIO = exports.defaultIO = exports.CliError = exports.isNotFound = exports.createConfigHttp = exports.defaultContext = exports.run = void 0;
+exports.manifestPath = exports.writeManifest = exports.readManifest = exports.deliverSecret = exports.productDir = exports.renderDotenv = exports.parseDotenv = exports.readEnvFile = exports.writeSecretFile = exports.client = exports.envCommand = exports.preflight = exports.init = exports.actions = exports.config = exports.sessions = exports.webhooks = exports.apiKeys = exports.orgs = exports.users = exports.whoami = exports.logout = exports.login = exports.getVersion = exports.defaultPrompter = exports.defaultConfigPath = exports.MemoryConfigStore = exports.FileConfigStore = exports.captureIO = exports.defaultIO = exports.CliError = exports.isNotFound = exports.createConfigHttp = exports.defaultContext = exports.run = void 0;
 /**
  * Library surface of `@atlasauth/cli`. The package ships a bin (`atlas`), but
  * exporting the pieces lets the handlers be unit-tested with injected deps and
@@ -46,4 +46,21 @@ var config_2 = require("./commands/config");
 Object.defineProperty(exports, "config", { enumerable: true, get: function () { return config_2.config; } });
 var actions_1 = require("./commands/actions");
 Object.defineProperty(exports, "actions", { enumerable: true, get: function () { return actions_1.actions; } });
+var init_1 = require("./commands/init");
+Object.defineProperty(exports, "init", { enumerable: true, get: function () { return init_1.init; } });
+var project_commands_1 = require("./commands/project-commands");
+Object.defineProperty(exports, "preflight", { enumerable: true, get: function () { return project_commands_1.preflight; } });
+Object.defineProperty(exports, "envCommand", { enumerable: true, get: function () { return project_commands_1.envCommand; } });
+Object.defineProperty(exports, "client", { enumerable: true, get: function () { return project_commands_1.client; } });
+var secrets_1 = require("./secrets");
+Object.defineProperty(exports, "writeSecretFile", { enumerable: true, get: function () { return secrets_1.writeSecretFile; } });
+Object.defineProperty(exports, "readEnvFile", { enumerable: true, get: function () { return secrets_1.readEnvFile; } });
+Object.defineProperty(exports, "parseDotenv", { enumerable: true, get: function () { return secrets_1.parseDotenv; } });
+Object.defineProperty(exports, "renderDotenv", { enumerable: true, get: function () { return secrets_1.renderDotenv; } });
+Object.defineProperty(exports, "productDir", { enumerable: true, get: function () { return secrets_1.productDir; } });
+Object.defineProperty(exports, "deliverSecret", { enumerable: true, get: function () { return secrets_1.deliverSecret; } });
+var project_1 = require("./project");
+Object.defineProperty(exports, "readManifest", { enumerable: true, get: function () { return project_1.readManifest; } });
+Object.defineProperty(exports, "writeManifest", { enumerable: true, get: function () { return project_1.writeManifest; } });
+Object.defineProperty(exports, "manifestPath", { enumerable: true, get: function () { return project_1.manifestPath; } });
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA;;;;;GAKG;AACH,6BAA0C;AAAjC,0FAAA,GAAG,OAAA;AACZ,qCAAmF;AAA1E,yGAAA,cAAc,OAAA;AACvB,6CAA8E;AAArE,+GAAA,gBAAgB,OAAA;AAAE,yGAAA,UAAU,OAAA;AACrC,mCAAoC;AAA3B,kGAAA,QAAQ,OAAA;AACjB,2BAAqE;AAA5D,+FAAA,SAAS,OAAA;AAAE,+FAAA,SAAS,OAAA;AAC7B,mCAOkB;AANhB,yGAAA,eAAe,OAAA;AACf,2GAAA,iBAAiB,OAAA;AACjB,2GAAA,iBAAiB,OAAA;AAKnB,mCAA0D;AAAjD,yGAAA,eAAe,OAAA;AACxB,qCAAuC;AAA9B,qGAAA,UAAU,OAAA;AAEnB,0EAA0E;AAC1E,wCAAwD;AAA/C,6FAAA,KAAK,OAAA;AAAE,8FAAA,MAAM,OAAA;AAAE,8FAAA,MAAM,OAAA;AAC9B,0CAAyC;AAAhC,8FAAA,KAAK,OAAA;AACd,wCAAuC;AAA9B,4FAAA,IAAI,OAAA;AACb,gDAA8C;AAArC,mGAAA,OAAO,OAAA;AAChB,gDAA+C;AAAtC,oGAAA,QAAQ,OAAA;AACjB,gDAA+C;AAAtC,oGAAA,QAAQ,OAAA;AACjB,4CAA2C;AAAlC,gGAAA,MAAM,OAAA;AACf,8CAA6C;AAApC,kGAAA,OAAO,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA;;;;;GAKG;AACH,6BAA0C;AAAjC,0FAAA,GAAG,OAAA;AACZ,qCAAmF;AAA1E,yGAAA,cAAc,OAAA;AACvB,6CAA8E;AAArE,+GAAA,gBAAgB,OAAA;AAAE,yGAAA,UAAU,OAAA;AACrC,mCAAoC;AAA3B,kGAAA,QAAQ,OAAA;AACjB,2BAAqE;AAA5D,+FAAA,SAAS,OAAA;AAAE,+FAAA,SAAS,OAAA;AAC7B,mCAOkB;AANhB,yGAAA,eAAe,OAAA;AACf,2GAAA,iBAAiB,OAAA;AACjB,2GAAA,iBAAiB,OAAA;AAKnB,mCAA0D;AAAjD,yGAAA,eAAe,OAAA;AACxB,qCAAuC;AAA9B,qGAAA,UAAU,OAAA;AAEnB,0EAA0E;AAC1E,wCAAwD;AAA/C,6FAAA,KAAK,OAAA;AAAE,8FAAA,MAAM,OAAA;AAAE,8FAAA,MAAM,OAAA;AAC9B,0CAAyC;AAAhC,8FAAA,KAAK,OAAA;AACd,wCAAuC;AAA9B,4FAAA,IAAI,OAAA;AACb,gDAA8C;AAArC,mGAAA,OAAO,OAAA;AAChB,gDAA+C;AAAtC,oGAAA,QAAQ,OAAA;AACjB,gDAA+C;AAAtC,oGAAA,QAAQ,OAAA;AACjB,4CAA2C;AAAlC,gGAAA,MAAM,OAAA;AACf,8CAA6C;AAApC,kGAAA,OAAO,OAAA;AAChB,wCAAuC;AAA9B,4FAAA,IAAI,OAAA;AACb,gEAA4E;AAAnE,6GAAA,SAAS,OAAA;AAAE,8GAAA,UAAU,OAAA;AAAE,0GAAA,MAAM,OAAA;AACtC,qCAOmB;AANjB,0GAAA,eAAe,OAAA;AACf,sGAAA,WAAW,OAAA;AACX,sGAAA,WAAW,OAAA;AACX,uGAAA,YAAY,OAAA;AACZ,qGAAA,UAAU,OAAA;AACV,wGAAA,aAAa,OAAA;AAEf,qCAOmB;AANjB,uGAAA,YAAY,OAAA;AACZ,wGAAA,aAAa,OAAA;AACb,uGAAA,YAAY,OAAA"}

package/dist/project.d.ts

@@ -0,0 +1,63 @@
+import { type ConfigHttp } from './config-http';
+import type { RunContext } from './context';
+/**
+ * The project manifest `atlas init` keeps at `~/.config/<product>/atlas.json`:
+ * PUBLIC values only (ids, publishable key, hosts, redirect URIs) plus the path
+ * of each secret file. `atlas env`, `atlas preflight --instance` and
+ * `atlas client rotate` read it, so they know where a secret lives without
+ * ever holding it in the manifest.
+ */
+export type InstanceEnv = 'development' | 'production';
+export interface ProjectInstance {
+    instance_id: string;
+    environment: InstanceEnv;
+    publishable_key: string;
+    frontend_api_host: string | null;
+    issuer: string | null;
+    discovery_url: string | null;
+    jwks_uri: string | null;
+    /** The file holding ATLAS_SECRET_KEY. */
+    secret_file: string;
+    oauth_client?: {
+        id: string;
+        client_id: string;
+        redirect_uris: string[];
+        secret_file: string | null;
+    };
+    webhook?: {
+        id: string;
+        url: string;
+        secret_file: string | null;
+    };
+    custom_domain?: {
+        host: string;
+        cname_target: string | null;
+        status: string;
+    };
+    email?: {
+        mode: 'managed' | 'development' | 'none';
+        from_address?: string | null;
+    };
+}
+export interface ProjectManifest {
+    product: string;
+    api_url: string;
+    instances: Partial<Record<InstanceEnv, ProjectInstance>>;
+}
+export declare const MANIFEST_FILE = "atlas.json";
+export declare function manifestPath(env: NodeJS.ProcessEnv, product: string): string;
+export declare function readManifest(env: NodeJS.ProcessEnv, product: string): ProjectManifest | undefined;
+export declare function writeManifest(env: NodeJS.ProcessEnv, manifest: ProjectManifest): string;
+/** Find the project + instance an instance id belongs to, scanning every product directory. */
+export declare function findInstance(env: NodeJS.ProcessEnv, instanceId: string, product?: string): {
+    manifest: ProjectManifest;
+    instance: ProjectInstance;
+} | undefined;
+export declare function parseInstanceEnv(raw: string | undefined, fallback: InstanceEnv): InstanceEnv;
+/** The raw HTTP client for a credential (the context's, or the real one). */
+export declare function httpFor(ctx: RunContext, opts: {
+    secretKey: string;
+    apiUrl: string;
+}): ConfigHttp;
+/** Read the instance secret key from the project's secret file. */
+export declare function instanceSecretFromFile(instance: ProjectInstance): string;