@atlasauth/cli 0.2.0 → 0.3.0

package/dist/project.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MANIFEST_FILE = void 0;
+exports.manifestPath = manifestPath;
+exports.readManifest = readManifest;
+exports.writeManifest = writeManifest;
+exports.findInstance = findInstance;
+exports.parseInstanceEnv = parseInstanceEnv;
+exports.httpFor = httpFor;
+exports.instanceSecretFromFile = instanceSecretFromFile;
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const config_http_1 = require("./config-http");
+const errors_1 = require("./errors");
+const secrets_1 = require("./secrets");
+exports.MANIFEST_FILE = 'atlas.json';
+function manifestPath(env, product) {
+    return (0, node_path_1.join)((0, secrets_1.productDir)(env, product), exports.MANIFEST_FILE);
+}
+function readManifest(env, product) {
+    try {
+        return JSON.parse((0, node_fs_1.readFileSync)(manifestPath(env, product), 'utf8'));
+    }
+    catch {
+        return undefined;
+    }
+}
+function writeManifest(env, manifest) {
+    const dir = (0, secrets_1.productDir)(env, manifest.product);
+    (0, node_fs_1.mkdirSync)(dir, { recursive: true, mode: 0o700 });
+    const path = (0, node_path_1.join)(dir, exports.MANIFEST_FILE);
+    (0, node_fs_1.writeFileSync)(path, JSON.stringify(manifest, null, 2) + '\n', { mode: 0o600 });
+    (0, node_fs_1.chmodSync)(path, 0o600);
+    return path;
+}
+/** Find the project + instance an instance id belongs to, scanning every product directory. */
+function findInstance(env, instanceId, product) {
+    const products = product ? [product] : listProducts(env);
+    for (const p of products) {
+        const m = readManifest(env, p);
+        for (const inst of Object.values(m?.instances ?? {})) {
+            if (inst && inst.instance_id === instanceId)
+                return { manifest: m, instance: inst };
+        }
+    }
+    return undefined;
+}
+function listProducts(env) {
+    const base = env.XDG_CONFIG_HOME?.trim() || (0, node_path_1.join)(env.HOME?.trim() || (0, node_os_1.homedir)(), '.config');
+    try {
+        return (0, node_fs_1.readdirSync)(base).filter((d) => {
+            try {
+                (0, node_fs_1.readFileSync)((0, node_path_1.join)(base, d, exports.MANIFEST_FILE));
+                return true;
+            }
+            catch {
+                return false;
+            }
+        });
+    }
+    catch {
+        return [];
+    }
+}
+function parseInstanceEnv(raw, fallback) {
+    if (raw === undefined)
+        return fallback;
+    if (raw !== 'development' && raw !== 'production') {
+        throw new errors_1.CliError(`--instance-env must be development or production, got '${raw}'.`);
+    }
+    return raw;
+}
+/** The raw HTTP client for a credential (the context's, or the real one). */
+function httpFor(ctx, opts) {
+    return (ctx.makeHttp ?? config_http_1.createConfigHttp)(opts);
+}
+/** Read the instance secret key from the project's secret file. */
+function instanceSecretFromFile(instance) {
+    const key = (0, secrets_1.readEnvFile)(instance.secret_file)?.ATLAS_SECRET_KEY;
+    if (!key) {
+        throw new errors_1.CliError(`No ATLAS_SECRET_KEY in ${instance.secret_file}. Re-run 'atlas init' with --rotate-secret to mint a new one.`);
+    }
+    return key;
+}
+//# sourceMappingURL=project.js.map

package/dist/project.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project.js","sourceRoot":"","sources":["../src/project.ts"],"names":[],"mappings":";;;AA0CA,oCAEC;AAED,oCAMC;AAED,sCAOC;AAGD,oCAaC;AAkBD,4CAMC;AAGD,0BAEC;AAGD,wDAQC;AArHD,qCAAyF;AACzF,qCAAkC;AAClC,yCAAiC;AACjC,+CAAkE;AAElE,qCAAoC;AACpC,uCAAoD;AAkCvC,QAAA,aAAa,GAAG,YAAY,CAAC;AAE1C,SAAgB,YAAY,CAAC,GAAsB,EAAE,OAAe;IAClE,OAAO,IAAA,gBAAI,EAAC,IAAA,oBAAU,EAAC,GAAG,EAAE,OAAO,CAAC,EAAE,qBAAa,CAAC,CAAC;AACvD,CAAC;AAED,SAAgB,YAAY,CAAC,GAAsB,EAAE,OAAe;IAClE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAoB,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAgB,aAAa,CAAC,GAAsB,EAAE,QAAyB;IAC7E,MAAM,GAAG,GAAG,IAAA,oBAAU,EAAC,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAA,mBAAS,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,qBAAa,CAAC,CAAC;IACtC,IAAA,uBAAa,EAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,IAAA,mBAAS,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+FAA+F;AAC/F,SAAgB,YAAY,CAC1B,GAAsB,EACtB,UAAkB,EAClB,OAAgB;IAEhB,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACzD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;YACrD,IAAI,IAAI,IAAI,IAAI,CAAC,WAAW,KAAK,UAAU;gBAAE,OAAO,EAAE,QAAQ,EAAE,CAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACvF,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,GAAsB;IAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,IAAA,gBAAI,EAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,IAAA,iBAAO,GAAE,EAAE,SAAS,CAAC,CAAC;IAC3F,IAAI,CAAC;QACH,OAAO,IAAA,qBAAW,EAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACpC,IAAI,CAAC;gBACH,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,CAAC,EAAE,qBAAa,CAAC,CAAC,CAAC;gBAC3C,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAgB,gBAAgB,CAAC,GAAuB,EAAE,QAAqB;IAC7E,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACvC,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;QAClD,MAAM,IAAI,iBAAQ,CAAC,0DAA0D,GAAG,IAAI,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6EAA6E;AAC7E,SAAgB,OAAO,CAAC,GAAe,EAAE,IAA2C;IAClF,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,8BAAgB,CAAC,CAAC,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,mEAAmE;AACnE,SAAgB,sBAAsB,CAAC,QAAyB;IAC9D,MAAM,GAAG,GAAG,IAAA,qBAAW,EAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAChE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,iBAAQ,CAChB,0BAA0B,QAAQ,CAAC,WAAW,+DAA+D,CAC9G,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/run.js

@@ -7,6 +7,8 @@ const actions_1 = require("./commands/actions");
 const api_keys_1 = require("./commands/api-keys");
 const auth_1 = require("./commands/auth");
 const config_1 = require("./commands/config");
+const init_1 = require("./commands/init");
+const project_commands_1 = require("./commands/project-commands");
 const orgs_1 = require("./commands/orgs");
 const sessions_1 = require("./commands/sessions");
 const users_1 = require("./commands/users");
@@ -26,6 +28,10 @@ const COMMANDS = {
     sessions: sessions_1.sessions,
     config: config_1.config,
     actions: actions_1.actions,
+    init: init_1.init,
+    preflight: project_commands_1.preflight,
+    env: project_commands_1.envCommand,
+    client: project_commands_1.client,
 };
 /**
  * The CLI's whole control flow, as a pure function of (argv, context) → exit

package/dist/run.js.map

@@ -1 +1 @@
-{"version":3,"file":"run.js","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":";;AAuCA,kBAwCC;AA/ED,gDAAmD;AACnD,iCAAgD;AAChD,gDAA6C;AAC7C,kDAA8C;AAC9C,0CAAwD;AACxD,8CAA2C;AAC3C,0CAAuC;AACvC,kDAA+C;AAC/C,4CAAyC;AACzC,kDAA+C;AAE/C,qCAAoC;AACpC,iCAAgD;AAChD,uCAAuC;AAKvC,kFAAkF;AAClF,MAAM,QAAQ,GAA4B;IACxC,KAAK,EAAL,YAAK;IACL,MAAM,EAAN,aAAM;IACN,MAAM,EAAN,aAAM;IACN,KAAK,EAAL,aAAK;IACL,IAAI,EAAJ,WAAI;IACJ,UAAU,EAAE,kBAAO;IACnB,QAAQ,EAAR,mBAAQ;IACR,QAAQ,EAAR,mBAAQ;IACR,MAAM,EAAN,eAAM;IACN,OAAO,EAAP,iBAAO;CACR,CAAC;AAEF;;;;;;GAMG;AACI,KAAK,UAAU,GAAG,CAAC,IAAc,EAAE,GAAe;IACvD,IAAI,IAAgB,CAAC;IACrB,IAAI,CAAC;QACH,IAAI,GAAG,IAAA,YAAK,EAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,kDAAkD;IAClD,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACxB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAA,oBAAU,GAAE,CAAC,CAAC;QACzB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAEpC,qEAAqE;IACrE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,eAAQ,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,oBAAoB,OAAO,IAAI,CAAC,CAAC;QAC5C,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC5D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,sEAAsE;IACtE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACrB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,mBAAY,CAAC,OAAO,CAAC,IAAI,eAAQ,CAAC,CAAC;QAC9C,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,MAAM,CAAC,GAAe,EAAE,GAAY;IAC3C,IAAI,GAAG,YAAY,uBAAa,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,0BAA0B,GAAG,CAAC,MAAM,IAAI,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3E,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,GAAG,YAAY,iBAAQ,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACpC,OAAO,GAAG,CAAC,QAAQ,CAAC;IACtB,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC;IAChC,OAAO,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":";;AA6CA,kBAwCC;AArFD,gDAAmD;AACnD,iCAAgD;AAChD,gDAA6C;AAC7C,kDAA8C;AAC9C,0CAAwD;AACxD,8CAA2C;AAC3C,0CAAuC;AACvC,kEAA4E;AAC5E,0CAAuC;AACvC,kDAA+C;AAC/C,4CAAyC;AACzC,kDAA+C;AAE/C,qCAAoC;AACpC,iCAAgD;AAChD,uCAAuC;AAKvC,kFAAkF;AAClF,MAAM,QAAQ,GAA4B;IACxC,KAAK,EAAL,YAAK;IACL,MAAM,EAAN,aAAM;IACN,MAAM,EAAN,aAAM;IACN,KAAK,EAAL,aAAK;IACL,IAAI,EAAJ,WAAI;IACJ,UAAU,EAAE,kBAAO;IACnB,QAAQ,EAAR,mBAAQ;IACR,QAAQ,EAAR,mBAAQ;IACR,MAAM,EAAN,eAAM;IACN,OAAO,EAAP,iBAAO;IACP,IAAI,EAAJ,WAAI;IACJ,SAAS,EAAT,4BAAS;IACT,GAAG,EAAE,6BAAU;IACf,MAAM,EAAN,yBAAM;CACP,CAAC;AAEF;;;;;;GAMG;AACI,KAAK,UAAU,GAAG,CAAC,IAAc,EAAE,GAAe;IACvD,IAAI,IAAgB,CAAC;IACrB,IAAI,CAAC;QACH,IAAI,GAAG,IAAA,YAAK,EAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,kDAAkD;IAClD,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACxB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAA,oBAAU,GAAE,CAAC,CAAC;QACzB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAEpC,qEAAqE;IACrE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,eAAQ,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,oBAAoB,OAAO,IAAI,CAAC,CAAC;QAC5C,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC5D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,sEAAsE;IACtE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACrB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,mBAAY,CAAC,OAAO,CAAC,IAAI,eAAQ,CAAC,CAAC;QAC9C,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,MAAM,CAAC,GAAe,EAAE,GAAY;IAC3C,IAAI,GAAG,YAAY,uBAAa,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,0BAA0B,GAAG,CAAC,MAAM,IAAI,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3E,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,GAAG,YAAY,iBAAQ,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACpC,OAAO,GAAG,CAAC,QAAQ,CAAC;IACtB,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC;IAChC,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/secrets.d.ts

@@ -0,0 +1,41 @@
+import type { IO } from './io';
+export declare function assertProductName(product: string): string;
+/** `$XDG_CONFIG_HOME/<product>` (default `~/.config/<product>`). */
+export declare function productDir(env: NodeJS.ProcessEnv, product: string): string;
+export declare function renderDotenv(entries: Record<string, string>, comment?: string): string;
+/** Parse a dotenv file this CLI wrote (KEY=value lines, `#` comments). */
+export declare function parseDotenv(text: string): Record<string, string>;
+/**
+ * Write a 0600 dotenv file inside a 0700 directory. Refuses an existing file
+ * unless `force` (the same content is not a conflict: a re-run is a no-op).
+ * Returns the path.
+ */
+export declare function writeSecretFile(dir: string, fileName: string, entries: Record<string, string>, opts?: {
+    force?: boolean;
+    comment?: string;
+}): {
+    path: string;
+    written: boolean;
+};
+/** Read one of the CLI's env files, or undefined when it does not exist. */
+export declare function readEnvFile(path: string): Record<string, string> | undefined;
+/** The env files in a product directory (for `atlas env`). */
+export declare function listEnvFiles(dir: string): string[];
+/**
+ * The common "a secret arrived" path for single-secret commands: write it to
+ * `<dir>/<fileName>` (0600) and print the path, or — only with
+ * `--print-secret` — print it after a warning on stderr.
+ */
+export declare function deliverSecret(input: {
+    io: IO;
+    env: NodeJS.ProcessEnv;
+    product: string;
+    fileName: string;
+    entries: Record<string, string>;
+    label: string;
+    printSecret?: boolean;
+    force?: boolean;
+    comment?: string;
+}): {
+    path?: string;
+};

package/dist/secrets.js

@@ -0,0 +1,142 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertProductName = assertProductName;
+exports.productDir = productDir;
+exports.renderDotenv = renderDotenv;
+exports.parseDotenv = parseDotenv;
+exports.writeSecretFile = writeSecretFile;
+exports.readEnvFile = readEnvFile;
+exports.listEnvFiles = listEnvFiles;
+exports.deliverSecret = deliverSecret;
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const errors_1 = require("./errors");
+/**
+ * Secrets the CLI receives are written to disk, never printed.
+ *
+ * Every command that gets a secret back from the API (an instance secret key,
+ * an OAuth client secret, a webhook signing secret, an end-user API key) writes
+ * it to a dotenv file under `~/.config/<product>/` — directory 0700, file 0600 —
+ * and prints only the file path. `--print-secret` is the one explicit opt-out,
+ * and it prints a warning first. An existing file is never overwritten unless
+ * the command was given `--force`, so a re-run cannot silently destroy the only
+ * copy of a working secret.
+ *
+ * The product name doubles as the directory name, so it is restricted to a safe
+ * slug (no path separators, no dot-dot).
+ */
+const PRODUCT_RE = /^[a-z0-9][a-z0-9_-]{0,62}$/i;
+function assertProductName(product) {
+    if (!PRODUCT_RE.test(product)) {
+        throw new errors_1.CliError(`--product must be letters, digits, '-' or '_' (up to 63 characters), got '${product}'.`);
+    }
+    return product;
+}
+/** `$XDG_CONFIG_HOME/<product>` (default `~/.config/<product>`). */
+function productDir(env, product) {
+    const base = env.XDG_CONFIG_HOME?.trim() || (0, node_path_1.join)(env.HOME?.trim() || (0, node_os_1.homedir)(), '.config');
+    return (0, node_path_1.join)(base, assertProductName(product));
+}
+/** Quote a dotenv value when it needs it. Secrets are token-shaped, so this is rarely used. */
+function dotenvValue(v) {
+    return /^[A-Za-z0-9_./:@+=,-]*$/.test(v) ? v : JSON.stringify(v);
+}
+function renderDotenv(entries, comment) {
+    const lines = comment ? comment.split('\n').map((l) => `# ${l}`) : [];
+    for (const [k, v] of Object.entries(entries))
+        lines.push(`${k}=${dotenvValue(v)}`);
+    return lines.join('\n') + '\n';
+}
+/** Parse a dotenv file this CLI wrote (KEY=value lines, `#` comments). */
+function parseDotenv(text) {
+    const out = {};
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        const i = line.indexOf('=');
+        if (i < 1)
+            continue;
+        const key = line.slice(0, i).trim();
+        let value = line.slice(i + 1).trim();
+        if (value.startsWith('"') && value.endsWith('"')) {
+            try {
+                value = JSON.parse(value);
+            }
+            catch {
+                /* keep raw */
+            }
+        }
+        out[key] = value;
+    }
+    return out;
+}
+/**
+ * Write a 0600 dotenv file inside a 0700 directory. Refuses an existing file
+ * unless `force` (the same content is not a conflict: a re-run is a no-op).
+ * Returns the path.
+ */
+function writeSecretFile(dir, fileName, entries, opts = {}) {
+    if (fileName.includes('/') || fileName.includes('\\') || fileName.startsWith('.')) {
+        throw new errors_1.CliError(`Refusing to write a secret file named '${fileName}'.`);
+    }
+    const path = (0, node_path_1.join)(dir, fileName);
+    const content = renderDotenv(entries, opts.comment);
+    (0, node_fs_1.mkdirSync)(dir, { recursive: true, mode: 0o700 });
+    (0, node_fs_1.chmodSync)(dir, 0o700);
+    if ((0, node_fs_1.existsSync)(path)) {
+        const current = (0, node_fs_1.readFileSync)(path, 'utf8');
+        if (current === content) {
+            (0, node_fs_1.chmodSync)(path, 0o600);
+            return { path, written: false };
+        }
+        if (!opts.force) {
+            throw new errors_1.CliError(`${path} already exists and holds a different secret. Nothing was overwritten. Move it aside, or re-run with --force to replace it.`);
+        }
+    }
+    // Write THEN chmod: `mode` is masked by umask and ignored for an existing file.
+    (0, node_fs_1.writeFileSync)(path, content, { mode: 0o600 });
+    (0, node_fs_1.chmodSync)(path, 0o600);
+    return { path, written: true };
+}
+/** Read one of the CLI's env files, or undefined when it does not exist. */
+function readEnvFile(path) {
+    try {
+        return parseDotenv((0, node_fs_1.readFileSync)(path, 'utf8'));
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The env files in a product directory (for `atlas env`). */
+function listEnvFiles(dir) {
+    try {
+        return (0, node_fs_1.readdirSync)(dir)
+            .filter((f) => f.endsWith('.env'))
+            .sort();
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * The common "a secret arrived" path for single-secret commands: write it to
+ * `<dir>/<fileName>` (0600) and print the path, or — only with
+ * `--print-secret` — print it after a warning on stderr.
+ */
+function deliverSecret(input) {
+    if (input.printSecret) {
+        input.io.err(`atlas: warning: printing ${input.label} because --print-secret was given. It may end up in your shell history, terminal scrollback or CI logs.`);
+        for (const [k, v] of Object.entries(input.entries))
+            input.io.out(`${k}=${v}`);
+        return {};
+    }
+    const { path } = writeSecretFile(productDir(input.env, input.product), input.fileName, input.entries, {
+        force: input.force,
+        comment: input.comment,
+    });
+    input.io.out(`${input.label} written to ${path} (mode 0600).`);
+    return { path };
+}
+//# sourceMappingURL=secrets.js.map

package/dist/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":";;AAuBA,8CAOC;AAGD,gCAGC;AAOD,oCAIC;AAGD,kCAmBC;AAOD,0CA6BC;AAGD,kCAMC;AAGD,oCAQC;AAOD,sCAwBC;AA5JD,qCAAqG;AACrG,qCAAkC;AAClC,yCAAiC;AACjC,qCAAoC;AAGpC;;;;;;;;;;;;;GAaG;AAEH,MAAM,UAAU,GAAG,6BAA6B,CAAC;AAEjD,SAAgB,iBAAiB,CAAC,OAAe;IAC/C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,iBAAQ,CAChB,6EAA6E,OAAO,IAAI,CACzF,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,oEAAoE;AACpE,SAAgB,UAAU,CAAC,GAAsB,EAAE,OAAe;IAChE,MAAM,IAAI,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,IAAA,gBAAI,EAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,IAAA,iBAAO,GAAE,EAAE,SAAS,CAAC,CAAC;IAC3F,OAAO,IAAA,gBAAI,EAAC,IAAI,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,+FAA+F;AAC/F,SAAS,WAAW,CAAC,CAAS;IAC5B,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,SAAgB,YAAY,CAAC,OAA+B,EAAE,OAAgB;IAC5E,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC;AAED,0EAA0E;AAC1E,SAAgB,WAAW,CAAC,IAAY;IACtC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACpC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC;gBACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAW,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc;YAChB,CAAC;QACH,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAgB,eAAe,CAC7B,GAAW,EACX,QAAgB,EAChB,OAA+B,EAC/B,OAA8C,EAAE;IAEhD,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,iBAAQ,CAAC,0CAA0C,QAAQ,IAAI,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,IAAI,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACpD,IAAA,mBAAS,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,IAAA,mBAAS,EAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtB,IAAI,IAAA,oBAAU,EAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3C,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACxB,IAAA,mBAAS,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACvB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAClC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,iBAAQ,CAChB,GAAG,IAAI,6HAA6H,CACrI,CAAC;QACJ,CAAC;IACH,CAAC;IACD,gFAAgF;IAChF,IAAA,uBAAa,EAAC,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9C,IAAA,mBAAS,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,4EAA4E;AAC5E,SAAgB,WAAW,CAAC,IAAY;IACtC,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,8DAA8D;AAC9D,SAAgB,YAAY,CAAC,GAAW;IACtC,IAAI,CAAC;QACH,OAAO,IAAA,qBAAW,EAAC,GAAG,CAAC;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;aACjC,IAAI,EAAE,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAAC,KAU7B;IACC,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,KAAK,CAAC,EAAE,CAAC,GAAG,CACV,4BAA4B,KAAK,CAAC,KAAK,yGAAyG,CACjJ,CAAC;QACF,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;YAAE,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9E,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,GAAG,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE;QACpG,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IACH,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,eAAe,IAAI,eAAe,CAAC,CAAC;IAC/D,OAAO,EAAE,IAAI,EAAE,CAAC;AAClB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlasauth/cli",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "atlas — manage an Atlas instance from the terminal via the Backend API.",
   "bin": {
     "atlas": "dist/cli.js"
@@ -15,8 +15,8 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@atlasauth/backend": "0.3.0",
-    "@atlasauth/actions": "0.1.0"
+    "@atlasauth/actions": "0.1.1",
+    "@atlasauth/backend": "0.9.0"
   },
   "devDependencies": {
     "@types/node": "^22.9.0",
@@ -28,7 +28,8 @@
   },
   "files": [
     "dist",
-    "README.md"
+    "README.md",
+    "CHANGELOG.md"
   ],
   "scripts": {
     "build": "tsc -p tsconfig.build.json",