@atlasauth/cli 0.23.0 → 0.25.0

package/dist/commands/referrals.js

@@ -1,1056 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.REFERALLI_SYNC_TOPICS = exports.REFERALLI_VERSION = void 0;
-exports.pingSkewMs = pingSkewMs;
-exports.describeTestLines = describeTestLines;
-exports.parseCodeCsv = parseCodeCsv;
-exports.appOrigins = appOrigins;
-exports.referalliKeyMode = referalliKeyMode;
-exports.referalliList = referalliList;
-exports.referalliLinkTemplate = referalliLinkTemplate;
-exports.webhookScope = webhookScope;
-exports.referrals = referrals;
-const node_crypto_1 = require("node:crypto");
-const referral_conformance_1 = require("@atlasauth/referral-conformance");
-const backend_1 = require("@atlasauth/backend");
-const args_1 = require("../args");
-const errors_1 = require("../errors");
-const output_1 = require("../output");
-const project_1 = require("../project");
-const secrets_1 = require("../secrets");
-const project_commands_1 = require("./project-commands");
-const shared_1 = require("./shared");
-/**
- * `atlas referrals connect | backfill | resync | status`: referral attribution from the
- * terminal.
- *
- * `connect --provider referalli` is bring-your-own-key: the Referalli merchant
- * key is used for one call (it creates the Atlas connection on Referalli) and
- * is never stored or printed. The connection id and secret Referalli returns
- * go straight onto the instance; the secret is never printed either.
- */
-/** The Referalli API version pinned on every call. */
-exports.REFERALLI_VERSION = '2026-10-21';
-const PROVIDERS = ['referalli', 'webhook'];
-/** The retired spelling of the Referalli provider id, flags and environment names, still accepted. */
-const LEGACY = {
-    provider: 'referally',
-    keyFlag: 'referally-key',
-    keyFileFlag: 'referally-key-file',
-    baseUrlEnv: 'REFERALLY_BASE_URL',
-    apiKeyEnv: 'REFERALLY_API_KEY',
-};
-const envNoticeShown = new WeakSet();
-/**
- * One notice naming each old REFERALLY_* environment variable to rename (only
- * those in use without their new name set), printed at most once per run.
- */
-function legacyEnvNotice(ctx) {
-    if (envNoticeShown.has(ctx))
-        return;
-    const renames = [
-        [LEGACY.baseUrlEnv, 'REFERALLI_BASE_URL'],
-        [LEGACY.apiKeyEnv, 'REFERALLI_API_KEY'],
-    ].filter(([old, current]) => ctx.env[old]?.trim() && !ctx.env[current]?.trim());
-    if (!renames.length)
-        return;
-    envNoticeShown.add(ctx);
-    ctx.io.err(`atlas: rename ${renames.map(([old, current]) => `${old} to ${current}`).join(' and ')} in your environment. The old name still works for now.`);
-}
-/** Print a one-line notice that an old name was used (stderr, so --json output stays clean). */
-function legacyNotice(ctx, old, current) {
-    ctx.io.err(`atlas: '${old}' is the old name of '${current}'. It still works; use '${current}'.`);
-}
-/** Read a key from a file, or stdin with '-'. A bare key or a dotenv line. Never printed. */
-function readKeyFile(ctx, file, what) {
-    let text;
-    try {
-        text = ctx.readFile(file === '-' ? '/dev/stdin' : file);
-    }
-    catch {
-        throw new errors_1.CliError(`Could not read ${what} from ${file === '-' ? 'stdin' : file}.`);
-    }
-    const line = text.split(/\r?\n/).map((l) => l.trim()).find((l) => l && !l.startsWith('#')) ?? '';
-    const m = /^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(line);
-    const key = (m ? m[1] : line).trim().replace(/^"(.*)"$/, '$1');
-    if (!key || /\s/.test(key))
-        throw new errors_1.CliError(`No ${what} found in ${file === '-' ? 'stdin' : file}.`);
-    return key;
-}
-function httpsUrl(raw, flag) {
-    let u;
-    try {
-        u = new URL(raw);
-    }
-    catch {
-        throw new errors_1.CliError(`${flag} must be an absolute URL, got '${raw}'.`);
-    }
-    const local = u.hostname === 'localhost' || u.hostname === '127.0.0.1' || u.hostname.endsWith('.localhost');
-    if (u.protocol !== 'https:' && !(u.protocol === 'http:' && local)) {
-        throw new errors_1.CliError(`${flag} must use https (http only for localhost), got '${raw}'.`);
-    }
-    return raw.replace(/\/+$/, '');
-}
-/** Platform clock minus ours, in ms, from a ping. */
-function pingSkewMs(ping, receivedAt, latencyMs) {
-    if (typeof ping.clock_skew_ms === 'number')
-        return ping.clock_skew_ms;
-    if (ping.server_time === undefined || ping.server_time === null)
-        return null;
-    const server = typeof ping.server_time === 'number' ? ping.server_time : Date.parse(ping.server_time);
-    if (!Number.isFinite(server))
-        return null;
-    return Math.round(server - (receivedAt - (latencyMs ?? 0) / 2));
-}
-/** Lines describing a connection test (a ping where the provider supports it). */
-function describeTestLines(test, receivedAt) {
-    const lines = [];
-    const meta = [test.http_status ? `HTTP ${test.http_status}` : '', typeof test.latency_ms === 'number' ? `${Math.round(test.latency_ms)} ms` : '']
-        .filter(Boolean)
-        .join(', ');
-    lines.push(test.ok ? `Connection OK${meta ? ` (${meta})` : ''}.` : `Connection test failed${meta ? ` (${meta})` : ''}: ${test.error?.message ?? 'no answer'}.`);
-    const ping = test.ping;
-    if (ping) {
-        if (ping.org_name)
-            lines.push(`  Organization:       ${ping.org_name}`);
-        const program = ping.program_name && ping.program_id ? `${ping.program_name} (${ping.program_id})` : (ping.program_name ?? ping.program_id);
-        if (program)
-            lines.push(`  Program:            ${program}`);
-        if (typeof ping.auto_enroll_users === 'boolean')
-            lines.push(`  Auto-enroll users:  ${ping.auto_enroll_users ? 'on' : 'off'}`);
-        const skew = pingSkewMs(ping, receivedAt, test.latency_ms);
-        if (skew !== null) {
-            lines.push(`  Clock skew:         ${(skew / 1000).toFixed(1)} s`);
-            if (Math.abs(skew) > 60_000) {
-                lines.push('  Warning: the clocks differ by more than 60 seconds. Signed calls fail beyond 5 minutes.');
-            }
-        }
-    }
-    return lines;
-}
-/** A `customerRef,code` CSV → map; throws on a bad line. A header row is skipped. */
-function parseCodeCsv(text, flag = '--map') {
-    const out = {};
-    const lines = text.split(/\r?\n/);
-    lines.forEach((line, i) => {
-        const l = line.trim();
-        if (!l || l.startsWith('#'))
-            return;
-        const [ref, code] = l.split(/[;,\t]/).map((x) => x.trim().replace(/^"(.*)"$/, '$1'));
-        if (i === 0 && /^(customer_?ref|user_?id|external_?id|user)$/i.test(ref ?? ''))
-            return;
-        if (!ref || !code)
-            throw new errors_1.CliError(`${flag} line ${i + 1}: expected customerRef,code.`);
-        if (!/^[A-Za-z0-9_-]{3,64}$/.test(code))
-            throw new errors_1.CliError(`${flag} line ${i + 1}: '${code}' is not a valid code.`);
-        out[ref] = code;
-    });
-    return out;
-}
-/** One call to the Referalli merchant API with the merchant key. Throws a CliError naming `what` on failure. */
-async function referalliRequest(ctx, input) {
-    const fetchImpl = ctx.fetch ?? globalThis.fetch;
-    let res;
-    try {
-        res = await fetchImpl(`${input.baseUrl}${input.path}`, {
-            method: input.method,
-            headers: {
-                authorization: `Bearer ${input.key}`,
-                accept: 'application/json',
-                'referalli-version': exports.REFERALLI_VERSION,
-                ...(input.body ? { 'content-type': 'application/json' } : {}),
-            },
-            ...(input.body ? { body: JSON.stringify(input.body) } : {}),
-        });
-    }
-    catch (err) {
-        throw new errors_1.CliError(`Could not reach Referalli at ${input.baseUrl}: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    const text = await res.text();
-    let json = {};
-    try {
-        json = text ? JSON.parse(text) : {};
-    }
-    catch {
-        /* not JSON */
-    }
-    if (!res.ok) {
-        const err = (json.error ?? json.errors);
-        const msg = (typeof err === 'object' && err && 'message' in err ? String(err.message) : null) ??
-            (Array.isArray(err) && err[0] && typeof err[0] === 'object' && 'message' in err[0] ? String(err[0].message) : null) ??
-            (typeof json.message === 'string' ? json.message : null);
-        const hint = res.status === 401 || res.status === 403 ? ' Check the merchant key.' : '';
-        throw new errors_1.CliError(`Referalli refused to ${input.what} (HTTP ${res.status})${msg ? `: ${msg}` : ''}.${hint}`);
-    }
-    return json;
-}
-/** The exact origins of an instance's app: its allowed origins (no wildcards) and its Frontend API host. */
-function appOrigins(instance) {
-    const out = new Set();
-    const add = (raw) => {
-        if (typeof raw !== 'string' || raw.includes('*'))
-            return;
-        try {
-            const u = new URL(raw);
-            if (u.protocol === 'https:' || u.protocol === 'http:')
-                out.add(u.origin);
-        }
-        catch {
-            /* not a URL */
-        }
-    };
-    for (const o of instance.allowed_origins ?? [])
-        add(typeof o === 'object' && o !== null ? o.origin : o);
-    if (instance.frontend_api_host)
-        add(`https://${instance.frontend_api_host}`);
-    return [...out].sort();
-}
-async function referalliCreateConnection(ctx, input) {
-    const json = await referalliRequest(ctx, { ...input, method: 'POST', path: '/v1/auth/connections', what: 'create the connection' });
-    if (typeof json.id !== 'string' || typeof json.secret !== 'string') {
-        throw new errors_1.CliError('Referalli answered without a connection id and secret.');
-    }
-    return json;
-}
-/** The Referalli topics two-way sync subscribes to (changes to a referral after sign-up). */
-exports.REFERALLI_SYNC_TOPICS = [
-    'referral.created',
-    'referral.held',
-    'referral.paused',
-    'referral.resumed',
-    'referral.approved',
-    'referral.voided',
-    'referral.reassigned',
-];
-/**
- * Whether the merchant key reaches live or test data: the org's `livemode`,
- * else the key prefix (rk_test_ = test; rk_live_ and older rk_ keys = live).
- * `known` is false when Referalli reports no mode (no test mode there).
- */
-async function referalliKeyMode(ctx, input) {
-    const org = await referalliTry(ctx, { ...input, path: '/v1/org', what: 'read the organization' });
-    if (typeof org?.livemode === 'boolean')
-        return { live: org.livemode, known: true, org };
-    if (input.key.startsWith('rk_test_'))
-        return { live: false, known: true, org };
-    if (input.key.startsWith('rk_live_'))
-        return { live: true, known: true, org };
-    return { live: true, known: false, org };
-}
-/** A best-effort Referalli read: null when it fails (an older Referalli, a key without access). */
-async function referalliTry(ctx, input) {
-    try {
-        return await referalliRequest(ctx, { ...input, method: 'GET' });
-    }
-    catch (err) {
-        if (err instanceof errors_1.CliError)
-            return null;
-        throw err;
-    }
-}
-/** A Referalli list answer: a plain array (API version 2026-10-21) or a `{ data: [...] }` page. */
-function referalliList(body) {
-    const rows = Array.isArray(body) ? body : body && typeof body === 'object' && Array.isArray(body.data) ? body.data : [];
-    return rows.filter((r) => !!r && typeof r === 'object' && !Array.isArray(r));
-}
-/** Referalli's public tracked link for a code: `{host}/go/{trackingToken}/{code}`, on the org's link domain once it is active. */
-function referalliLinkTemplate(baseUrl, trackingToken, branding) {
-    const domain = branding?.linkDomainStatus === 'active' && typeof branding.linkDomain === 'string' && branding.linkDomain ? branding.linkDomain : null;
-    return `${domain ? `https://${domain}` : baseUrl}/go/${encodeURIComponent(trackingToken)}/{code}`;
-}
-/** The merchant key from --referalli-key / --referalli-key-file / REFERALLI_API_KEY (or their old names); never printed. */
-function referalliKeyFrom(ctx, v) {
-    const oldKeyFile = (0, args_1.str)(v, LEGACY.keyFileFlag);
-    const oldKey = (0, args_1.str)(v, LEGACY.keyFlag);
-    if (oldKeyFile)
-        legacyNotice(ctx, `--${LEGACY.keyFileFlag}`, '--referalli-key-file');
-    if (oldKey)
-        legacyNotice(ctx, `--${LEGACY.keyFlag}`, '--referalli-key');
-    const legacyKey = ctx.env[LEGACY.apiKeyEnv]?.trim();
-    legacyEnvNotice(ctx);
-    const keyFile = (0, args_1.str)(v, 'referalli-key-file') ?? oldKeyFile;
-    return ((0, args_1.str)(v, 'referalli-key') ??
-        oldKey ??
-        (keyFile ? readKeyFile(ctx, keyFile, 'the Referalli key') : (ctx.env.REFERALLI_API_KEY?.trim() || legacyKey || undefined)));
-}
-/** The `programIds` a Referalli webhook endpoint is limited to: null or [] means every program in the organization. */
-function webhookScope(endpoint) {
-    if (!endpoint)
-        return { scope: 'unknown', program_ids: null };
-    const ids = Array.isArray(endpoint.programIds) ? endpoint.programIds.filter((x) => typeof x === 'string') : [];
-    return ids.length ? { scope: 'program', program_ids: ids } : { scope: 'all_programs', program_ids: null };
-}
-/**
- * The two-way sync webhook on Referalli, limited to the connected program
- * (`programIds: [program]`) so another product's referrals in a shared
- * organization never reach this instance. Idempotent: an endpoint already
- * pointing at this instance's inbound URL is reused and re-scoped in place
- * (an unscoped one from an earlier run is repaired); its secret is rotated
- * only when Atlas does not hold it (`held`: the endpoint whose secret Atlas
- * stores). `secret` is null when nothing new needs saving.
- */
-async function referalliSyncEndpoint(ctx, input) {
-    const { baseUrl, key } = input;
-    const scope = { topics: [...exports.REFERALLI_SYNC_TOPICS], legacySignature: false, programIds: [input.program] };
-    const listed = await referalliTry(ctx, { baseUrl, key, path: '/v1/webhook-endpoints', what: 'list the webhook endpoints' });
-    const mine = referalliList(listed).filter((e) => e.url === input.url && typeof e.id === 'string');
-    const found = mine.find((e) => e.id === input.held) ?? mine[0];
-    if (!found) {
-        const endpoint = await referalliRequest(ctx, {
-            baseUrl,
-            key,
-            method: 'POST',
-            path: '/v1/webhook-endpoints',
-            body: { url: input.url, ...scope },
-            what: 'register the referral event webhook',
-        });
-        if (typeof endpoint.id !== 'string' || typeof endpoint.secret !== 'string') {
-            throw new errors_1.CliError('Referalli answered without a webhook endpoint id and secret.');
-        }
-        return { id: endpoint.id, secret: endpoint.secret, duplicates: [] };
-    }
-    const id = found.id;
-    const duplicates = mine.filter((e) => e !== found).map((e) => e.id);
-    await referalliRequest(ctx, {
-        baseUrl,
-        key,
-        method: 'PATCH',
-        path: `/v1/webhook-endpoints/${encodeURIComponent(id)}`,
-        body: scope,
-        what: 'limit the referral event webhook to the program',
-    });
-    if (id === input.held)
-        return { id, secret: null, duplicates };
-    const rotated = await referalliRequest(ctx, {
-        baseUrl,
-        key,
-        method: 'POST',
-        path: `/v1/webhook-endpoints/${encodeURIComponent(id)}/rotate-secret`,
-        body: {},
-        what: 'rotate the referral event webhook secret',
-    });
-    if (typeof rotated.secret !== 'string')
-        throw new errors_1.CliError('Referalli answered without a webhook secret.');
-    return { id, secret: rotated.secret, duplicates };
-}
-/**
- * `connect --provider referalli --oauth`: Atlas starts an OAuth install at
- * Referalli. The merchant opens the printed link, picks an organization and
- * program, and Referalli returns the connection secret to Atlas directly. The
- * command waits until the instance shows the new connection, then pings it.
- */
-async function connectWithOAuth(ctx, args, io) {
-    const v = args.values;
-    const { http, json, out, presetId } = io;
-    const before = await http.get('/v1/instance/referrals');
-    let started;
-    try {
-        started = await http.post(`/v1/instance/referrals/${encodeURIComponent(presetId)}/install`, {});
-    }
-    catch (err) {
-        if (err instanceof backend_1.AtlasApiError && err.status === 422) {
-            throw new errors_1.CliError(`One-click connect to '${presetId}' is not available on this Atlas. Connect with a key or the signing secret instead (atlas referrals connect --provider referalli --program <prg_…> --base-url <url> --referalli-key-file <path>, or --provider webhook --endpoint <url>).`);
-        }
-        throw err;
-    }
-    if (json)
-        ctx.io.err(`atlas: open ${started.authorize_url}`);
-    else {
-        out.out('Open this link, choose your Referalli organization and program, and approve:');
-        out.out('');
-        out.out(`  ${started.authorize_url}`);
-        out.out('');
-        out.out('Waiting for Referalli to finish (the link is valid for 15 minutes)…');
-    }
-    const sleep = ctx.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
-    const now = () => Date.now();
-    let after = before;
-    const changed = (s) => s.signing_secret_set && (s.provider !== before.provider || s.connection_id !== before.connection_id || s.endpoint_url !== before.endpoint_url || s.updated_at !== before.updated_at);
-    while (!changed(after)) {
-        if (now() > started.expires_at)
-            throw new errors_1.CliError('The link expired before Referalli finished. Run the command again.');
-        await sleep(2000);
-        after = await http.get('/v1/instance/referrals');
-    }
-    const test = await http.post('/v1/instance/referrals/test', {});
-    const receivedAt = Date.now();
-    let enabled = false;
-    if (v.enable === true) {
-        if (!test.ok)
-            ctx.io.err('atlas: not turning referrals on: the connection test failed.');
-        else {
-            await http.patch('/v1/instance/referrals', { enabled: true, ...(v['no-identity-backfill'] === true ? { backfill_existing_users: false } : {}) });
-            enabled = true;
-        }
-    }
-    if (json) {
-        (0, output_1.printJson)(ctx.io, { provider: after.provider, preset: presetId, connection_id: after.connection_id, program_id: after.program_id, test, enabled });
-    }
-    else {
-        out.out(`Connected to ${presetId} (${after.connection_id ? `connection ${after.connection_id}` : (after.endpoint_url ?? 'endpoint set')}${after.program_id ? `, program ${after.program_id}` : ''}). No secret was shown or copied.`);
-        for (const line of describeTestLines(test, receivedAt))
-            ctx.io.out(line);
-        ctx.io.out(enabled
-            ? 'Referral attribution is on.'
-            : v.enable === true
-                ? 'Referral attribution stays off until the test passes.'
-                : "Turn it on with 'atlas referrals connect --provider referalli --oauth --enable', or in the dashboard (Users → Referrals).");
-    }
-    return test.ok ? 0 : 1;
-}
-/**
- * `connect --dry-run`: list the platform calls it would make, and validate the
- * Atlas settings write with `?dry_run=true` (nothing is saved, no secret kept).
- */
-async function printDryRun(ctx, json, planned, atlas) {
-    const result = atlas
-        ? await atlas.http.patch('/v1/instance/referrals?dry_run=true', atlas.patch)
-        : null;
-    const redacted = atlas ? { ...atlas.patch, ...('signing_secret' in atlas.patch ? { signing_secret: '<redacted>' } : {}) } : null;
-    if (json) {
-        (0, output_1.printJson)(ctx.io, { dry_run: true, planned_requests: planned, atlas_request: redacted && { method: 'PATCH', path: '/v1/instance/referrals', body: redacted }, atlas_result: result });
-    }
-    else {
-        for (const p of planned)
-            ctx.io.out(`Would call: ${p}`);
-        if (redacted) {
-            ctx.io.out(`Would save: PATCH /v1/instance/referrals ${JSON.stringify(redacted)}`);
-            ctx.io.out(result?.validated === false ? 'Atlas could not fully validate it in a dry run.' : 'Atlas validated the settings.');
-        }
-        ctx.io.out('Dry run: nothing was written and no connection test was run.');
-    }
-    return 0;
-}
-async function connect(ctx, args) {
-    const v = args.values;
-    const json = (0, shared_1.wantsJson)(v);
-    let provider = (0, args_1.str)(v, 'provider') ?? 'referalli';
-    if (provider === LEGACY.provider) {
-        legacyNotice(ctx, '--provider referally', '--provider referalli');
-        provider = 'referalli';
-    }
-    if (!PROVIDERS.includes(provider)) {
-        throw new errors_1.CliError(`--provider must be one of ${PROVIDERS.join(', ')}, got '${provider}'.`);
-    }
-    const cred = (0, project_commands_1.instanceCredential)(ctx, args);
-    const http = (0, project_1.httpFor)(ctx, cred);
-    // --dry-run: reads only. Atlas validates the settings write with ?dry_run=true; calls to the platform are listed, not made.
-    const dryRun = v['dry-run'] === true;
-    // One-click: the platform asks the merchant for the organization and program and hands Atlas the secret.
-    // Any platform the deployment offers works (--preset <id>); Referalli is the default preset.
-    if (v.oauth === true) {
-        const presetId = (0, args_1.str)(v, 'preset') ?? (provider === 'webhook' ? null : 'referalli');
-        if (!presetId)
-            throw new errors_1.CliError('referrals connect --provider webhook --oauth needs --preset <id> (see one_click_presets in `atlas referrals status --json`).');
-        if (dryRun)
-            return printDryRun(ctx, json, [`POST /v1/instance/referrals/${presetId}/install (then you approve on the platform)`], null);
-        return connectWithOAuth(ctx, args, { http, json, out: json ? { out: () => undefined } : ctx.io, presetId });
-    }
-    const product = (0, args_1.str)(v, 'product') ?? 'atlasauth';
-    const out = json ? { out: () => undefined, err: ctx.io.err } : ctx.io;
-    let patch;
-    let summary;
-    if (provider === 'referalli') {
-        const program = (0, args_1.str)(v, 'program');
-        if (!program)
-            throw new errors_1.CliError('referrals connect --provider referalli needs --program <prg_…>.');
-        const legacyBase = ctx.env[LEGACY.baseUrlEnv]?.trim();
-        legacyEnvNotice(ctx);
-        const baseRaw = (0, args_1.str)(v, 'base-url') ?? ctx.env.REFERALLI_BASE_URL?.trim() ?? legacyBase;
-        if (!baseRaw)
-            throw new errors_1.CliError('Pass --base-url <your Referalli base URL> (or set REFERALLI_BASE_URL).');
-        const baseUrl = httpsUrl(baseRaw, '--base-url');
-        const key = referalliKeyFrom(ctx, v);
-        if (!key) {
-            throw new errors_1.CliError('Pass your Referalli merchant key with --referalli-key-file <path|-> (or --referalli-key, or REFERALLI_API_KEY). It is used once and never stored.');
-        }
-        const destination = (0, args_1.str)(v, 'destination');
-        if (destination)
-            httpsUrl(destination, '--destination');
-        const instance = await http.get('/v1/instance');
-        // Test data for development instances, live data for production: a mix-up
-        // would pay real partners for test sign-ups, or lose real ones.
-        const instanceLive = instance.environment === 'production';
-        const mode = await referalliKeyMode(ctx, { baseUrl, key });
-        if (mode.known && mode.live !== instanceLive) {
-            const message = `the Referalli key reaches ${mode.live ? 'live' : 'test'} data but instance ${instance.id} is ` +
-                `${instance.environment ?? 'not production'}. Use ${instanceLive ? 'a live (rk_live_…)' : 'a test (rk_test_…)'} key` +
-                ` for it, or pass --allow-mode-mismatch.`;
-            if (v['allow-mode-mismatch'] !== true)
-                throw new errors_1.CliError(message.charAt(0).toUpperCase() + message.slice(1));
-            ctx.io.err(`atlas: warning: ${message.replace(/, or pass --allow-mode-mismatch\.$/, '.')}`);
-        }
-        else if (!mode.known && !instanceLive) {
-            ctx.io.err(`atlas: warning: Referalli did not say whether this key reaches test data; instance ${instance.id} is ${instance.environment ?? 'not production'}.`);
-        }
-        // The app's origins travel with the connection (Referalli's widget CORS then needs no dashboard step); kept current by Atlas afterwards.
-        const origins = appOrigins(instance);
-        const enrollment = {
-            ...(v['auto-enroll'] === true ? { autoEnrollUsers: true } : {}),
-            ...(origins.length ? { allowedOrigins: origins } : {}),
-            ...(destination ? { destinationUrl: destination } : {}),
-        };
-        const current = await http.get('/v1/instance/referrals');
-        // Re-runs reuse the instance's connection, updated in place: Referalli keeps one per instance per organization.
-        const listed = await referalliTry(ctx, { baseUrl, key, path: '/v1/auth/connections', what: 'list the connections' });
-        const existing = referalliList(listed).find((c) => c.provider === 'atlas' && c.instanceId === instance.id && typeof c.id === 'string');
-        if (existing && typeof existing.programId === 'string' && existing.programId !== program) {
-            throw new errors_1.CliError(`Referalli already has connection ${String(existing.id)} for instance ${instance.id}, in program ${existing.programId}. ` +
-                `It allows one per instance: run again with --program ${existing.programId}, or delete that connection on Referalli first.`);
-        }
-        if (dryRun) {
-            const held = existing && current.connection_id === existing.id && current.signing_secret_set;
-            const planned = existing
-                ? [
-                    ...(held ? [] : [`POST ${baseUrl}/v1/auth/connections/${String(existing.id)}/rotate-secret`]),
-                    `PATCH ${baseUrl}/v1/auth/connections/${String(existing.id)} ${JSON.stringify({ signatureVersion: 'v2', ...enrollment })}`,
-                ]
-                : [
-                    `POST ${baseUrl}/v1/auth/connections ${JSON.stringify({ provider: 'atlas', instanceId: instance.id, programId: program, ...enrollment })}`,
-                    `PATCH ${baseUrl}/v1/auth/connections/<new id> {"signatureVersion":"v2"}`,
-                ];
-            if (v['no-sync'] !== true)
-                planned.push(`Register the two-way sync webhook on Referalli for program ${program}`);
-            const tracking = (0, args_1.str)(v, 'tracking-token') ?? (typeof mode.org?.trackingToken === 'string' ? mode.org.trackingToken : null);
-            const linkTemplate = (0, args_1.str)(v, 'link-template');
-            return printDryRun(ctx, json, planned, {
-                http,
-                patch: {
-                    provider: 'referalli',
-                    endpoint_url: baseUrl,
-                    ...(existing ? { connection_id: existing.id } : {}),
-                    program_id: program,
-                    ...(v['auto-enroll'] === true ? { auto_enroll_users: true } : {}),
-                    ...(tracking ? { tracking_token: tracking } : {}),
-                    ...(linkTemplate ? { link_template: linkTemplate } : {}),
-                },
-            });
-        }
-        let connectionId;
-        // Null when Atlas already holds the reused connection's secret.
-        let secret = null;
-        let createdToken = null;
-        if (existing) {
-            connectionId = existing.id;
-            if (current.connection_id !== connectionId || !current.signing_secret_set) {
-                // Atlas does not hold this connection's secret: rotate it (the old one keeps verifying for 24 hours).
-                const rotated = await referalliRequest(ctx, {
-                    baseUrl,
-                    key,
-                    method: 'POST',
-                    path: `/v1/auth/connections/${encodeURIComponent(connectionId)}/rotate-secret`,
-                    body: {},
-                    what: 'rotate the connection secret',
-                });
-                if (typeof rotated.secret !== 'string')
-                    throw new errors_1.CliError('Referalli answered without a connection secret.');
-                secret = rotated.secret;
-            }
-        }
-        else {
-            const created = await referalliCreateConnection(ctx, {
-                baseUrl,
-                key,
-                body: { provider: 'atlas', instanceId: instance.id, programId: program, ...enrollment },
-            });
-            connectionId = created.id;
-            secret = created.secret;
-            createdToken = typeof created.trackingToken === 'string' ? created.trackingToken : null;
-        }
-        // Atlas always signs with v2: require it from the first call, so v1 is never accepted on this connection.
-        let signatureV2 = true;
-        try {
-            await referalliRequest(ctx, {
-                baseUrl,
-                key,
-                method: 'PATCH',
-                path: `/v1/auth/connections/${encodeURIComponent(connectionId)}`,
-                body: { signatureVersion: 'v2', ...(existing ? enrollment : {}) },
-                what: existing ? 'update the connection' : 'require v2 signatures on the connection',
-            });
-        }
-        catch (err) {
-            signatureV2 = false;
-            ctx.io.err(`atlas: warning: ${err instanceof Error ? err.message : String(err)} It switches to v2 on Atlas's first call anyway.`);
-        }
-        // The org's public tracking token (GET /v1/org) builds Referalli's tracked links; a link template set before is kept.
-        const orgToken = typeof mode.org?.trackingToken === 'string' ? mode.org.trackingToken : null;
-        const trackingToken = (0, args_1.str)(v, 'tracking-token') ?? orgToken ?? createdToken;
-        let linkTemplate = (0, args_1.str)(v, 'link-template') ?? null;
-        if (!linkTemplate && !current.link_template && trackingToken) {
-            const branding = await referalliTry(ctx, { baseUrl, key, path: '/v1/branding', what: 'read the link domain' });
-            linkTemplate = referalliLinkTemplate(baseUrl, trackingToken, branding);
-        }
-        patch = {
-            provider: 'referalli',
-            endpoint_url: baseUrl,
-            connection_id: connectionId,
-            ...(secret ? { signing_secret: secret } : {}),
-            program_id: program,
-            ...(v['auto-enroll'] === true ? { auto_enroll_users: true } : {}),
-            ...(trackingToken ? { tracking_token: trackingToken } : {}),
-            ...(linkTemplate ? { link_template: linkTemplate } : {}),
-        };
-        let saved;
-        try {
-            saved = await http.patch('/v1/instance/referrals', patch);
-        }
-        catch (err) {
-            // The secret is shown once by Referalli: keep it so the merchant can finish by hand.
-            const kept = secret
-                ? (0, secrets_1.deliverSecret)({
-                    io: out,
-                    env: ctx.env,
-                    product,
-                    fileName: `referalli-connection-${connectionId}.env`,
-                    entries: { REFERALLI_CONNECTION_ID: connectionId, REFERALLI_CONNECTION_SECRET: secret },
-                    label: 'The Referalli connection secret (not saved on Atlas)',
-                    force: v.force === true,
-                    comment: `Referalli connection ${connectionId}: saving it on the Atlas instance failed. Paste it in Users → Referrals.`,
-                })
-                : { path: undefined };
-            ctx.io.err(`atlas: the connection ${connectionId} ${existing ? 'exists' : 'was created'} on Referalli, but saving it on the instance failed.${kept.path ? ` Its secret is in ${kept.path}.` : ''}`);
-            throw err;
-        }
-        // Two-way sync: Referalli's referral events for this program go to the instance's inbound URL.
-        let syncEndpoint = null;
-        let syncScope = null;
-        const inboundUrl = saved?.inbound?.url ?? null;
-        if (v['no-sync'] !== true && inboundUrl) {
-            try {
-                const sync = await referalliSyncEndpoint(ctx, {
-                    baseUrl,
-                    key,
-                    url: inboundUrl,
-                    program,
-                    held: current.inbound?.secret_set ? (current.inbound.endpoint_id ?? null) : null,
-                });
-                if (!sync.secret) {
-                    syncEndpoint = sync.id;
-                    syncScope = [program];
-                }
-                else {
-                    try {
-                        await http.patch('/v1/instance/referrals', { inbound_secret: sync.secret, inbound_endpoint_id: sync.id });
-                        syncEndpoint = sync.id;
-                        syncScope = [program];
-                    }
-                    catch (err) {
-                        const kept = (0, secrets_1.deliverSecret)({
-                            io: out,
-                            env: ctx.env,
-                            product,
-                            fileName: `referalli-webhook-${sync.id}.env`,
-                            entries: { REFERALLI_WEBHOOK_ENDPOINT_ID: sync.id, REFERALLI_WEBHOOK_SECRET: sync.secret },
-                            label: 'The Referalli webhook secret (not saved on Atlas)',
-                            force: v.force === true,
-                            comment: `Referalli webhook ${sync.id}: saving it on the Atlas instance failed. Paste it as the inbound secret in Users → Referrals.`,
-                        });
-                        ctx.io.err(`atlas: warning: the webhook ${sync.id} was registered on Referalli, but saving its secret failed (${err instanceof Error ? err.message : String(err)}).${kept.path ? ` It is in ${kept.path}.` : ''}`);
-                    }
-                }
-                if (sync.duplicates.length) {
-                    ctx.io.err(`atlas: warning: Referalli has more webhook endpoints for this instance (${sync.duplicates.join(', ')}). Atlas cannot verify their deliveries; delete them on Referalli.`);
-                }
-            }
-            catch (err) {
-                if (!(err instanceof errors_1.CliError))
-                    throw err;
-                ctx.io.err(`atlas: warning: ${err.message} Referral changes on Referalli won't reach Atlas until it is registered (see the docs).`);
-            }
-        }
-        // What connect could not set: the exact settings call that finishes it.
-        const leftToDo = {};
-        if (!(trackingToken ?? current.tracking_token))
-            leftToDo.tracking_token = '<your Referalli tracking token (tk_…), from GET /v1/org on Referalli>';
-        if (!(linkTemplate ?? current.link_template))
-            leftToDo.link_template = 'https://<your Referalli link host>/go/<tracking token>/{code}';
-        summary = {
-            provider: 'referalli',
-            instance_id: instance.id,
-            endpoint_url: baseUrl,
-            connection_id: connectionId,
-            reused: Boolean(existing),
-            program_id: program,
-            tracking_token: trackingToken ?? current.tracking_token ?? null,
-            link_template: linkTemplate ?? current.link_template ?? null,
-            livemode: mode.known ? mode.live : null,
-            signature_v2_required: signatureV2,
-            sync_endpoint_id: syncEndpoint,
-            sync_program_ids: syncScope,
-            left_to_do: Object.keys(leftToDo).length ? { method: 'PATCH', path: '/v1/instance/referrals', body: leftToDo } : null,
-        };
-        if (!json) {
-            out.out(existing
-                ? `Reused Referalli connection ${connectionId} for instance ${instance.id} and updated it${secret ? ' (new secret saved, not printed)' : ''}.`
-                : `Created Referalli connection ${connectionId} for instance ${instance.id} and saved it (the secret was not printed).`);
-            if (syncEndpoint)
-                out.out(`Referral changes on Referalli sync back to Atlas (webhook ${syncEndpoint}, program ${program} only).`);
-            if (Object.keys(leftToDo).length) {
-                out.out(`Left to do: ${Object.keys(leftToDo).join(' and ')} could not be read from Referalli. Set them with PATCH /v1/instance/referrals:`);
-                out.out(`  ${JSON.stringify(leftToDo)}`);
-                out.out('  (or run this again with --tracking-token <tk_…> and --link-template <url with {code}>)');
-            }
-        }
-    }
-    else {
-        const endpoint = (0, args_1.str)(v, 'endpoint');
-        if (!endpoint)
-            throw new errors_1.CliError('referrals connect --provider webhook needs --endpoint <https-url>.');
-        const endpointUrl = httpsUrl(endpoint, '--endpoint');
-        const secretFile = (0, args_1.str)(v, 'secret-file');
-        let secret;
-        let generated = false;
-        if (secretFile)
-            secret = readKeyFile(ctx, secretFile, 'the signing secret');
-        else {
-            secret = `rfs_${(0, node_crypto_1.randomBytes)(32).toString('base64url')}`;
-            generated = true;
-        }
-        if (secret.length < 16)
-            throw new errors_1.CliError('The signing secret must be at least 16 characters.');
-        patch = {
-            provider: 'webhook',
-            endpoint_url: endpointUrl,
-            signing_secret: secret,
-            ...((0, args_1.str)(v, 'program') ? { program_id: (0, args_1.str)(v, 'program') } : {}),
-            ...(v['auto-enroll'] === true ? { auto_enroll_users: true } : {}),
-        };
-        // A generated secret is only validated here, never saved or printed.
-        if (dryRun)
-            return printDryRun(ctx, json, [], { http, patch });
-        await http.patch('/v1/instance/referrals', patch);
-        let secretPath;
-        if (generated) {
-            secretPath = (0, secrets_1.deliverSecret)({
-                io: out,
-                env: ctx.env,
-                product,
-                fileName: 'referrals-signing-secret.env',
-                entries: { ATLAS_REFERRALS_SIGNING_SECRET: secret },
-                label: 'The signing secret (configure it on your referral platform)',
-                printSecret: v['print-secret'] === true,
-                force: v.force === true,
-                comment: `Signing secret for Atlas referral calls to ${endpointUrl}.`,
-            }).path;
-        }
-        const inboundUrl = (await http.get('/v1/instance/referrals')).inbound?.url ?? null;
-        summary = { provider: 'webhook', endpoint_url: endpointUrl, secret_file: secretPath ?? null, inbound_url: inboundUrl };
-        if (!json) {
-            out.out(`Saved the referral protocol connection to ${endpointUrl}.`);
-            if (inboundUrl)
-                out.out(`For two-way sync, have the platform send referral changes to ${inboundUrl}, signed with the same secret.`);
-        }
-    }
-    const test = await http.post('/v1/instance/referrals/test', {});
-    const receivedAt = Date.now();
-    let enabled = false;
-    if (v.enable === true) {
-        if (!test.ok) {
-            ctx.io.err('atlas: not turning referrals on: the connection test failed.');
-        }
-        else {
-            await http.patch('/v1/instance/referrals', { enabled: true, ...(v['no-identity-backfill'] === true ? { backfill_existing_users: false } : {}) });
-            enabled = true;
-        }
-    }
-    if (json) {
-        (0, output_1.printJson)(ctx.io, { ...summary, test, enabled });
-    }
-    else {
-        for (const line of describeTestLines(test, receivedAt))
-            ctx.io.out(line);
-        ctx.io.out(enabled
-            ? 'Referral attribution is on.'
-            : v.enable === true
-                ? 'Referral attribution stays off until the test passes.'
-                : "Turn it on with 'atlas referrals connect … --enable', or in the dashboard (Users → Referrals).");
-    }
-    return test.ok ? 0 : 1;
-}
-async function backfill(ctx, args) {
-    const v = args.values;
-    const since = (0, args_1.str)(v, 'since');
-    if (!since || !/^\d{4}-\d{2}-\d{2}(T.*)?$/.test(since) || Number.isNaN(Date.parse(since))) {
-        throw new errors_1.CliError('referrals backfill needs --since <YYYY-MM-DD>.');
-    }
-    const readMap = (flag, file) => {
-        if (!file)
-            return undefined;
-        let text;
-        try {
-            text = ctx.readFile(file === '-' ? '/dev/stdin' : file);
-        }
-        catch {
-            throw new errors_1.CliError(`Could not read ${file}.`);
-        }
-        return parseCodeCsv(text, `--${flag}`);
-    };
-    const checkPath = (flag) => {
-        const p = (0, args_1.str)(v, flag);
-        if (p && !/^(public|private|unsafe)_metadata(\.[A-Za-z0-9_-]{1,64}){1,4}$/.test(p)) {
-            throw new errors_1.CliError(`--${flag} must look like public_metadata.referral_code, got '${p}'.`);
-        }
-        return p;
-    };
-    const mapFile = (0, args_1.str)(v, 'map');
-    const ownMapFile = (0, args_1.str)(v, 'own-map');
-    if (mapFile === '-' && ownMapFile === '-')
-        throw new errors_1.CliError('Only one of --map and --own-map can read stdin.');
-    const codes = readMap('map', mapFile);
-    const ownCodes = readMap('own-map', ownMapFile);
-    const metadataPath = checkPath('metadata-path');
-    const ownMetadataPath = checkPath('own-metadata-path');
-    const http = (0, project_1.httpFor)(ctx, (0, project_commands_1.instanceCredential)(ctx, args));
-    let job = await http.post('/v1/instance/referrals/backfill', {
-        since,
-        ...(codes && Object.keys(codes).length ? { codes } : {}),
-        ...(metadataPath ? { code_metadata_path: metadataPath } : {}),
-        ...(ownCodes && Object.keys(ownCodes).length ? { own_codes: ownCodes } : {}),
-        ...(ownMetadataPath ? { own_code_metadata_path: ownMetadataPath } : {}),
-    });
-    const running = (s) => s === 'queued' || s === 'running' || s === 'pending';
-    if (v.wait === true) {
-        const sleep = ctx.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
-        while (running(job.status)) {
-            await sleep(2000);
-            job = await http.get(`/v1/instance/referrals/backfill/${encodeURIComponent(job.id)}`);
-        }
-    }
-    if ((0, shared_1.wantsJson)(v))
-        (0, output_1.printJson)(ctx.io, job);
-    else {
-        const counts = [
-            typeof job.users_scanned === 'number' ? `${job.users_scanned} users` : '',
-            typeof job.calls_queued === 'number' ? `${job.calls_queued} calls queued` : '',
-            typeof job.users_skipped === 'number' ? `${job.users_skipped} skipped` : '',
-            job.calls ? `${job.calls.succeeded} sent, ${job.calls.failed} failed` : '',
-        ].filter(Boolean);
-        ctx.io.out(`Backfill ${job.id}: ${job.status}${counts.length ? ` (${counts.join(', ')})` : ''}.`);
-        if (codes)
-            ctx.io.out(`${Object.keys(codes).length} code(s) read from ${mapFile}.`);
-        if (ownCodes)
-            ctx.io.out(`${Object.keys(ownCodes).length} own code(s) read from ${ownMapFile}.`);
-        if (typeof job.own_codes_set === 'number' && (ownCodes || ownMetadataPath))
-            ctx.io.out(`${job.own_codes_set} own code(s) kept.`);
-        if (job.own_codes_taken?.length) {
-            ctx.io.err(`atlas: ${job.own_codes_taken.length} own code(s) already belong to another user, not set: ${job.own_codes_taken.join(', ')}`);
-        }
-        if (running(job.status) && v.wait !== true)
-            ctx.io.out("Add --wait to follow it, or watch the delivery log in the dashboard.");
-        if (job.truncated && job.next_since) {
-            ctx.io.out(`Stopped at the cap. Run it again with --since ${new Date(job.next_since).toISOString().slice(0, 10)} for the rest.`);
-        }
-        if (job.error)
-            ctx.io.err(`atlas: ${job.error}`);
-    }
-    return job.status === 'failed' || (job.calls?.failed ?? 0) > 0 ? 1 : 0;
-}
-async function resync(ctx, args) {
-    const userId = args.positionals[2];
-    if (!userId)
-        throw new errors_1.CliError('referrals resync needs a user id: atlas referrals resync <user_id> [--dry-run].');
-    const http = (0, project_1.httpFor)(ctx, (0, project_commands_1.instanceCredential)(ctx, args));
-    const res = await http.post(`/v1/users/${encodeURIComponent(userId)}/referral/resync${args.values['dry-run'] === true ? '?dry_run=true' : ''}`, {});
-    if ((0, shared_1.wantsJson)(args.values))
-        (0, output_1.printJson)(ctx.io, res);
-    else {
-        ctx.io.out(`Re-reported ${res.user_id}: call ${res.call_id ?? '-'} ${res.call_status ?? 'not sent'}${args.values['dry-run'] === true ? ' (dry run, nothing sent)' : ''}.`);
-        if (res.error)
-            ctx.io.err(`atlas: ${res.error}`);
-        const code = res.referral?.referral_code;
-        if (code)
-            ctx.io.out(`Referral code ${code}${res.referral?.referral_link ? `, link ${res.referral.referral_link}` : ''}.`);
-    }
-    return res.call_status === 'failed' ? 1 : 0;
-}
-const FINDING_COLUMNS = [
-    { header: 'SEVERITY', get: (f) => f.severity },
-    { header: 'CODE', get: (f) => f.code },
-    { header: 'MESSAGE', get: (f) => f.message },
-];
-async function status(ctx, args) {
-    const http = (0, project_1.httpFor)(ctx, (0, project_commands_1.instanceCredential)(ctx, args));
-    const settings = await http.get('/v1/instance/referrals');
-    let findings = [];
-    try {
-        const report = await http.get('/v1/instance/preflight');
-        findings = (report.findings ?? []).filter((f) => f.code.startsWith('referral'));
-    }
-    catch (err) {
-        if (!(err instanceof backend_1.AtlasApiError))
-            throw err;
-    }
-    // The sync webhook's program scope lives on Referalli: read it when a merchant key is given (never required).
-    const inbound = settings.inbound;
-    let webhook = null;
-    const key = settings.provider === 'referalli' && settings.endpoint_url && inbound?.endpoint_id ? referalliKeyFrom(ctx, args.values) : undefined;
-    if (key && settings.endpoint_url && inbound?.endpoint_id) {
-        webhook = await referalliTry(ctx, {
-            baseUrl: settings.endpoint_url,
-            key,
-            path: `/v1/webhook-endpoints/${encodeURIComponent(inbound.endpoint_id)}`,
-            what: 'read the referral event webhook',
-        });
-    }
-    const scope = webhookScope(webhook);
-    if ((0, shared_1.wantsJson)(args.values)) {
-        const c = settings.connection ?? null;
-        (0, output_1.printJson)(ctx.io, {
-            // Flat, stable fields for scripts; `settings` is the raw GET /v1/instance/referrals answer.
-            status: {
-                enabled: settings.enabled,
-                provider: settings.provider,
-                connection_id: settings.connection_id,
-                program_id: settings.program_id,
-                signing_secret_set: settings.signing_secret_set,
-                webhook: {
-                    endpoint_id: inbound?.endpoint_id ?? null,
-                    url: inbound?.url ?? null,
-                    secret_set: inbound?.secret_set ?? false,
-                    // program: limited to program_ids; all_programs: every program in the organization; unknown: no merchant key given.
-                    scope: inbound?.endpoint_id ? scope.scope : null,
-                    program_ids: scope.program_ids,
-                },
-                link_template_set: Boolean(settings.link_template),
-                tracking_token_set: Boolean(settings.tracking_token),
-                last_sync: inbound?.last_event ?? null,
-                last_test: c?.last_test ?? null,
-                last_success_at: c?.last_success_at ?? null,
-                missing: settings.missing ?? [],
-            },
-            settings,
-            findings,
-        });
-        return findings.some((f) => f.severity === 'error') ? 1 : 0;
-    }
-    const c = settings.connection ?? null;
-    const lines = [
-        `Referral attribution: ${settings.enabled ? 'on' : 'off'}`,
-        `Provider:             ${settings.provider}`,
-        `Endpoint:             ${settings.endpoint_url ?? '(not set)'}`,
-        `Connection ID:        ${settings.connection_id ?? '(not set)'}`,
-        `Program ID:           ${settings.program_id ?? '(not set)'}`,
-        `Signing secret:       ${settings.signing_secret_set ? 'set' : 'not set'}`,
-        `Link template:        ${settings.link_template ?? '(not set)'}`,
-        `Tracking token:       ${settings.tracking_token ?? '(not set)'}`,
-    ];
-    if (settings.forward_lifecycle !== undefined)
-        lines.push(`Forward lifecycle:    ${settings.forward_lifecycle ? 'on' : 'off'}`);
-    if (settings.missing?.length)
-        lines.push(`Missing:              ${settings.missing.join(', ')}`);
-    if (c?.last_test) {
-        lines.push(`Last test:            ${c.last_test.ok ? 'ok' : `failed${c.last_test.error ? ` (${c.last_test.error})` : ''}`} at ${new Date(c.last_test.at).toISOString()}`);
-    }
-    if (c)
-        lines.push(`Failed (7 days):      ${c.failed_calls_7d ?? 0}    Retrying: ${c.retrying_calls ?? 0}`);
-    if (inbound?.url) {
-        // Referalli needs its own webhook secret; the Atlas protocol falls back to the signing secret.
-        const syncing = inbound.secret_set || (settings.provider === 'webhook' && settings.signing_secret_set);
-        lines.push(`Two-way sync:         ${syncing ? 'on' : 'off (no inbound secret)'}${inbound.endpoint_id ? ` (webhook ${inbound.endpoint_id})` : ''}`);
-        if (scope.scope !== 'unknown') {
-            lines.push(`Webhook scope:        ${scope.program_ids ? `program ${scope.program_ids.join(', ')}` : 'every program (re-run connect to limit it)'}`);
-        }
-        lines.push(`Inbound URL:          ${inbound.url}`);
-        if (inbound.last_event) {
-            lines.push(`Last event:           ${inbound.last_event.type} → ${inbound.last_event.outcome} at ${new Date(inbound.last_event.at).toISOString()}`);
-        }
-    }
-    for (const l of lines)
-        ctx.io.out(l);
-    if (c?.alert)
-        ctx.io.out(`Alert:                ${c.alert.code}${c.alert.message ? `: ${c.alert.message}` : ''}`);
-    ctx.io.out('');
-    if (findings.length === 0)
-        ctx.io.out('No referral findings in preflight.');
-    else {
-        ctx.io.out((0, output_1.renderTable)(FINDING_COLUMNS, findings));
-        for (const f of findings.filter((x) => x.severity !== 'info'))
-            ctx.io.out(`${f.code}: ${f.fix}`);
-    }
-    return findings.some((f) => f.severity === 'error') ? 1 : 0;
-}
-/**
- * `atlas referrals conformance`: run the referral protocol conformance suite
- * (@atlasauth/referral-conformance) against a platform, and optionally Atlas's
- * own simulated sign-up against the connected instance.
- *
- * The platform defaults to the instance's configured Referalli endpoint and
- * connection id; the connection secret is never readable from Atlas, so it
- * comes from --secret-file (or '-' for stdin).
- */
-async function conformance(ctx, args) {
-    const v = args.values;
-    const json = (0, shared_1.wantsJson)(v);
-    const http = (0, project_1.httpFor)(ctx, (0, project_commands_1.instanceCredential)(ctx, args));
-    const settings = await http.get('/v1/instance/referrals');
-    // Any platform: `webhook` tests the generic Atlas referral protocol, `connection` the connection-API dialect
-    // (Referalli's). Default: what the instance is connected to.
-    const profileFlag = (0, args_1.str)(v, 'protocol');
-    if (profileFlag && profileFlag !== 'webhook' && profileFlag !== 'connection') {
-        throw new errors_1.CliError(`--protocol must be webhook or connection, got '${profileFlag}'.`);
-    }
-    const profile = profileFlag ?? (settings.provider === 'webhook' ? 'webhook' : 'connection');
-    const configured = settings.provider === 'webhook' || settings.provider === 'referalli';
-    const baseRaw = (0, args_1.str)(v, 'base-url') ?? (configured ? settings.endpoint_url : null);
-    if (!baseRaw)
-        throw new errors_1.CliError('Pass --base-url <the platform to test> (or connect a platform first).');
-    const baseUrl = httpsUrl(baseRaw, '--base-url');
-    const connectionId = (0, args_1.str)(v, 'connection-id') ?? (profile === 'webhook' ? 'n/a' : settings.connection_id);
-    if (!connectionId)
-        throw new errors_1.CliError('Pass --connection-id <id> (the connection the suite signs its calls for).');
-    const secretFile = (0, args_1.str)(v, 'secret-file');
-    if (!secretFile) {
-        throw new errors_1.CliError('Pass --secret-file <path|-> with the connection secret. Atlas never shows it, so take it from the platform.');
-    }
-    const secret = readKeyFile(ctx, secretFile, 'the connection secret');
-    const only = (0, args_1.str)(v, 'only')
-        ?.split(',')
-        .map((s) => s.trim())
-        .filter(Boolean);
-    const report = await (0, referral_conformance_1.runConformance)({
-        profile,
-        baseUrl,
-        connectionId,
-        secret,
-        ...(ctx.fetch ? { fetch: ctx.fetch } : {}),
-        ...(only?.length ? { only } : {}),
-    });
-    let simulation = null;
-    if (v.simulate === true) {
-        simulation = await http.post('/v1/instance/referrals/simulate', {});
-    }
-    if (json)
-        (0, output_1.printJson)(ctx.io, { ...report, simulation });
-    else {
-        for (const line of (0, referral_conformance_1.formatReport)(report))
-            ctx.io.out(line);
-        if (simulation) {
-            ctx.io.out('');
-            ctx.io.out(simulation.ok === true
-                ? `Atlas's simulated sign-up reached the platform (call ${String(simulation.call_id ?? '')}).`
-                : `Atlas's simulated sign-up failed: ${String(simulation.error?.message ?? 'no answer')}.`);
-        }
-    }
-    return report.ok && (simulation === null || simulation.ok === true) ? 0 : 1;
-}
-async function referrals(ctx, args) {
-    const sub = args.positionals[1];
-    switch (sub) {
-        case 'connect':
-            return connect(ctx, args);
-        case 'backfill':
-            return backfill(ctx, args);
-        case 'resync':
-            return resync(ctx, args);
-        case 'status':
-            return status(ctx, args);
-        case 'conformance':
-            return conformance(ctx, args);
-        default:
-            throw new errors_1.CliError(sub
-                ? `Unknown subcommand 'referrals ${sub}'. Try: connect, backfill, resync, status, conformance.`
-                : 'referrals needs a subcommand: connect, backfill, resync, status, conformance.');
-    }
-}
-//# sourceMappingURL=referrals.js.map