@atlasauth/cli 0.25.0 → 0.26.0

package/dist/commands/doctor-scan.js

@@ -0,0 +1,221 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scanDockerfile = scanDockerfile;
+exports.scanCompose = scanCompose;
+exports.scanEnvFolders = scanEnvFolders;
+exports.scanForSecrets = scanForSecrets;
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const yaml_1 = require("yaml");
+const errors_1 = require("../errors");
+const output_1 = require("../output");
+const redact_1 = require("../redact");
+const SECRET_VALUE = new RegExp(redact_1.SECRET_VALUE_SOURCE);
+/** The variables that hold a secret whatever their value looks like (a `${VAR}` build arg passes it too). */
+const SECRET_NAME = /(^|_)ATLAS_[A-Z0-9_]*SECRET|WEBHOOK_SECRET|HOOK_SECRET/;
+const TEST_KEY = /\b(?:atlas_test_sk_|sk_test_)[A-Za-z0-9_-]+/;
+const LIVE_KEY = /\b(?:atlas_live_sk_|sk_live_)[A-Za-z0-9_-]+/;
+const SKIP_DIRS = new Set(['node_modules', '.git']);
+const MAX_FILE_BYTES = 1024 * 1024;
+const VALUE_MESSAGE = 'A secret-key-shaped value is stored in the build. Rotate it and pass it at runtime; only the publishable key is a build arg.';
+const nameMessage = (name) => `${name} is a secret passed to the build, where it stays in the image metadata. Set it at runtime; only the publishable key is a build arg.`;
+const isDockerfile = (name) => /^Dockerfile(\..+)?$|\.dockerfile$/i.test(name);
+const isCompose = (name) => /^(docker-)?compose[\w.-]*\.ya?ml$/i.test(name);
+const isEnvFile = (name) => /\.env$|^\.env(\..+)?$/.test(name);
+/** The files worth reading under `root`: no symlinks, dependency trees, big or binary files. */
+function walk(root, out = []) {
+    for (const entry of (0, node_fs_1.readdirSync)(root, { withFileTypes: true })) {
+        const path = (0, node_path_1.join)(root, entry.name);
+        if (entry.isDirectory()) {
+            if (!SKIP_DIRS.has(entry.name))
+                walk(path, out);
+        }
+        else if (entry.isFile() && (isDockerfile(entry.name) || isCompose(entry.name) || isEnvFile(entry.name)) && (0, node_fs_1.lstatSync)(path).size <= MAX_FILE_BYTES) {
+            const bytes = (0, node_fs_1.readFileSync)(path);
+            if (!bytes.subarray(0, 8192).includes(0))
+                out.push({ path, text: bytes.toString('utf8') });
+        }
+    }
+    return out;
+}
+/** `ARG` defaults and `ENV` values, through line continuations. */
+function scanDockerfile(file, text) {
+    const out = [];
+    let instruction = null;
+    text.split(/\r?\n/).forEach((raw, i) => {
+        const line = raw.trim();
+        if (line.startsWith('#'))
+            return;
+        const head = /^(ARG|ENV)\s+(.*)$/i.exec(line);
+        if (head)
+            instruction = head[1].toUpperCase();
+        if (instruction) {
+            const body = head ? head[2] : line;
+            if (SECRET_VALUE.test(body))
+                out.push({ file, line: i + 1, code: 'secret_value_in_build', message: VALUE_MESSAGE });
+            else {
+                for (const m of body.matchAll(/([A-Za-z_][A-Za-z0-9_]*)(?:=(\S*)|\s+(\S+))?/g)) {
+                    const value = m[2] ?? m[3];
+                    if (!SECRET_NAME.test(m[1]))
+                        continue;
+                    // `ENV X=$X` only re-exports; the ARG it comes from is the finding.
+                    if (instruction === 'ENV' && (!value || value.startsWith('$')))
+                        continue;
+                    out.push({ file, line: i + 1, code: 'secret_name_in_build', message: nameMessage(m[1]) });
+                }
+            }
+        }
+        if (!line.endsWith('\\'))
+            instruction = null;
+    });
+    return out;
+}
+/** `services.*.build.args`, in either the map or the list form. */
+function scanCompose(file, text) {
+    const counter = new yaml_1.LineCounter();
+    const doc = (0, yaml_1.parseDocument)(text, { lineCounter: counter });
+    if (doc.errors.length)
+        return [];
+    const out = [];
+    const at = (n) => {
+        const start = n?.range?.[0];
+        return start === undefined ? null : counter.linePos(start).line;
+    };
+    const check = (name, value, node) => {
+        if (SECRET_VALUE.test(value))
+            out.push({ file, line: at(node), code: 'secret_value_in_build', message: VALUE_MESSAGE });
+        else if (SECRET_NAME.test(name))
+            out.push({ file, line: at(node), code: 'secret_name_in_build', message: nameMessage(name) });
+    };
+    const services = doc.get('services');
+    if (!(0, yaml_1.isMap)(services))
+        return out;
+    for (const service of services.items) {
+        const build = (0, yaml_1.isPair)(service) && (0, yaml_1.isMap)(service.value) ? service.value.get('build') : null;
+        const args = (0, yaml_1.isMap)(build) ? build.get('args') : null;
+        if ((0, yaml_1.isMap)(args)) {
+            for (const pair of args.items) {
+                const name = (0, yaml_1.isScalar)(pair.key) ? String(pair.key.value) : '';
+                check(name, (0, yaml_1.isScalar)(pair.value) ? String(pair.value.value ?? '') : '', pair.key);
+            }
+        }
+        else if ((0, yaml_1.isSeq)(args)) {
+            for (const item of args.items) {
+                if (!(0, yaml_1.isScalar)(item))
+                    continue;
+                const [name = '', ...rest] = String(item.value).split('=');
+                check(name, rest.join('='), item);
+            }
+        }
+    }
+    return out;
+}
+/** One folder's `*.env` files holding both a test and a live secret key. */
+function scanEnvFolders(files) {
+    const out = [];
+    const byDir = new Map();
+    for (const f of files.filter((x) => isEnvFile((0, node_path_1.basename)(x.path))))
+        byDir.set((0, node_path_1.dirname)(f.path), [...(byDir.get((0, node_path_1.dirname)(f.path)) ?? []), f]);
+    for (const group of byDir.values()) {
+        const hits = [];
+        for (const f of group) {
+            f.text.split(/\r?\n/).forEach((raw, i) => {
+                if (raw.trim().startsWith('#'))
+                    return;
+                if (TEST_KEY.test(raw))
+                    hits.push({ file: f.path, line: i + 1, kind: 'test' });
+                if (LIVE_KEY.test(raw))
+                    hits.push({ file: f.path, line: i + 1, kind: 'live' });
+            });
+        }
+        if (hits.some((h) => h.kind === 'test') && hits.some((h) => h.kind === 'live')) {
+            for (const h of hits) {
+                out.push({
+                    file: h.file,
+                    line: h.line,
+                    code: 'dev_and_prod_keys_together',
+                    message: `A ${h.kind === 'live' ? 'production' : 'development'} secret key, in a folder that holds both. A deploy script reading this folder can ship the wrong one; keep one environment per folder and delete stale files.`,
+                });
+            }
+        }
+    }
+    return out;
+}
+const captureDefault = (cmd, args) => new Promise((resolve, reject) => {
+    (0, node_child_process_1.execFile)(cmd, args, { maxBuffer: 16 * 1024 * 1024 }, (err, stdout) => (err ? reject(err) : resolve(stdout)));
+});
+/** Metadata of one image: every history line and the configured environment. */
+async function scanImage(ctx, ref) {
+    if (ref.startsWith('-'))
+        throw new errors_1.CliError(`--scan-image takes an image reference, got '${ref}'.`);
+    const capture = ctx.execFile ?? captureDefault;
+    const read = async (args) => {
+        try {
+            return await capture('docker', args);
+        }
+        catch (err) {
+            if (err.code === 'ENOENT')
+                throw new errors_1.CliError('docker was not found on PATH. Install Docker to use --scan-image, or use --scan-dir.');
+            throw new errors_1.CliError(`docker could not read image ${ref}. Pull or build it first.`);
+        }
+    };
+    const history = await read(['history', '--no-trunc', '--format', '{{.CreatedBy}}', ref]);
+    const inspected = await read(['inspect', '--format', '{{json .Config.Env}}', ref]);
+    let env = [];
+    try {
+        const parsed = JSON.parse(inspected);
+        if (Array.isArray(parsed))
+            env = parsed.map(String);
+    }
+    catch {
+        // shortcut: an unreadable Env is treated as empty, the history scan still runs; docker always prints JSON for this format.
+    }
+    const out = [];
+    const check = (place, line, text) => {
+        if (SECRET_VALUE.test(text)) {
+            out.push({ file: place, line, code: 'secret_value_in_build', message: VALUE_MESSAGE });
+            return;
+        }
+        for (const m of text.matchAll(/([A-Za-z_][A-Za-z0-9_]*)=(\S+)/g)) {
+            if (SECRET_NAME.test(m[1]) && !m[2].startsWith('$'))
+                out.push({ file: place, line, code: 'secret_name_in_build', message: nameMessage(m[1]) });
+        }
+    };
+    history.split(/\r?\n/).forEach((text, i) => check(`image ${ref} history`, i + 1, text));
+    env.forEach((text, i) => check(`image ${ref} env`, i + 1, text));
+    return out;
+}
+async function scanForSecrets(ctx, opts) {
+    const findings = [];
+    if (opts.dir !== undefined) {
+        let files;
+        try {
+            files = walk(opts.dir);
+        }
+        catch {
+            throw new errors_1.CliError(`--scan-dir: cannot read ${opts.dir}.`);
+        }
+        for (const f of files) {
+            if (isDockerfile((0, node_path_1.basename)(f.path)))
+                findings.push(...scanDockerfile(f.path, f.text));
+            if (isCompose((0, node_path_1.basename)(f.path)))
+                findings.push(...scanCompose(f.path, f.text));
+        }
+        findings.push(...scanEnvFolders(files));
+    }
+    if (opts.image !== undefined)
+        findings.push(...(await scanImage(ctx, opts.image)));
+    if (opts.json)
+        (0, output_1.printJson)(ctx.io, { ok: findings.length === 0, findings });
+    else if (!findings.length)
+        ctx.io.out('No secrets found in build metadata.');
+    else {
+        for (const f of findings)
+            ctx.io.out(`${f.file}${f.line === null ? '' : `:${f.line}`}  ${f.code}  ${f.message}`);
+        ctx.io.out('');
+        ctx.io.out(`${findings.length} finding(s).`);
+    }
+    return findings.length ? 1 : 0;
+}
+//# sourceMappingURL=doctor-scan.js.map

package/dist/commands/doctor-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-scan.js","sourceRoot":"","sources":["../../src/commands/doctor-scan.ts"],"names":[],"mappings":";;AAqDA,wCAwBC;AAGD,kCAgCC;AAGD,wCAyBC;AA2CD,wCAyBC;AAhND,2DAA8C;AAC9C,qCAA+D;AAC/D,yCAAoD;AACpD,+BAA6F;AAE7F,sCAAqC;AACrC,sCAAsC;AACtC,sCAAgD;AAgBhD,MAAM,YAAY,GAAG,IAAI,MAAM,CAAC,4BAAmB,CAAC,CAAC;AACrD,6GAA6G;AAC7G,MAAM,WAAW,GAAG,wDAAwD,CAAC;AAC7E,MAAM,QAAQ,GAAG,6CAA6C,CAAC;AAC/D,MAAM,QAAQ,GAAG,6CAA6C,CAAC;AAE/D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;AACpD,MAAM,cAAc,GAAG,IAAI,GAAG,IAAI,CAAC;AACnC,MAAM,aAAa,GAAG,8HAA8H,CAAC;AACrJ,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,IAAI,qIAAqI,CAAC;AAEnL,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvF,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACpF,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEvE,gGAAgG;AAChG,SAAS,IAAI,CAAC,IAAY,EAAE,MAA6C,EAAE;IACzE,KAAK,MAAM,KAAK,IAAI,IAAA,qBAAW,EAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,GAAG,IAAA,gBAAI,EAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAClD,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,IAAA,mBAAS,EAAC,IAAI,CAAC,CAAC,IAAI,IAAI,cAAc,EAAE,CAAC;YACpJ,MAAM,KAAK,GAAG,IAAA,sBAAY,EAAC,IAAI,CAAC,CAAC;YACjC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mEAAmE;AACnE,SAAgB,cAAc,CAAC,IAAY,EAAE,IAAY;IACvD,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,IAAI,WAAW,GAAyB,IAAI,CAAC;IAC7C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO;QACjC,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,IAAI;YAAE,WAAW,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC,WAAW,EAAmB,CAAC;QAChE,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACpC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;iBAC/G,CAAC;gBACJ,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,+CAA+C,CAAC,EAAE,CAAC;oBAC/E,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC3B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;wBAAE,SAAS;oBACvC,oEAAoE;oBACpE,IAAI,WAAW,KAAK,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;wBAAE,SAAS;oBACzE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC,CAAC;gBAC7F,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,WAAW,GAAG,IAAI,CAAC;IAC/C,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mEAAmE;AACnE,SAAgB,WAAW,CAAC,IAAY,EAAE,IAAY;IACpD,MAAM,OAAO,GAAG,IAAI,kBAAW,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,IAAA,oBAAa,EAAC,IAAI,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1D,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,MAAM,EAAE,GAAG,CAAC,CAAU,EAAE,EAAE;QACxB,MAAM,KAAK,GAAI,CAAiB,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7C,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;IAClE,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,IAAa,EAAE,EAAE;QAC3D,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;aACnH,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChI,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,CAAC,IAAA,YAAK,EAAC,QAAQ,CAAC;QAAE,OAAO,GAAG,CAAC;IACjC,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,IAAA,aAAM,EAAC,OAAO,CAAC,IAAI,IAAA,YAAK,EAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1F,MAAM,IAAI,GAAG,IAAA,YAAK,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACrD,IAAI,IAAA,YAAK,EAAC,IAAI,CAAC,EAAE,CAAC;YAChB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG,IAAA,eAAQ,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,KAAK,CAAC,IAAI,EAAE,IAAA,eAAQ,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;aAAM,IAAI,IAAA,YAAK,EAAC,IAAI,CAAC,EAAE,CAAC;YACvB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC9B,IAAI,CAAC,IAAA,eAAQ,EAAC,IAAI,CAAC;oBAAE,SAAS;gBAC9B,MAAM,CAAC,IAAI,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC3D,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4EAA4E;AAC5E,SAAgB,cAAc,CAAC,KAA4C;IACzE,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAiD,CAAC;IACvE,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAA,oBAAQ,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,KAAK,CAAC,GAAG,CAAC,IAAA,mBAAO,EAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAA,mBAAO,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzI,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,GAAiE,EAAE,CAAC;QAC9E,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;gBACvC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,OAAO;gBACvC,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;oBAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC/E,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;oBAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YACjF,CAAC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,CAAC;YAC/E,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,GAAG,CAAC,IAAI,CAAC;oBACP,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,IAAI,EAAE,4BAA4B;oBAClC,OAAO,EAAE,KAAK,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,+JAA+J;iBAC9N,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,GAAW,EAAE,IAAc,EAAE,EAAE,CACrD,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IACtC,IAAA,6BAAQ,EAAC,GAAG,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC/G,CAAC,CAAC,CAAC;AAEL,gFAAgF;AAChF,KAAK,UAAU,SAAS,CAAC,GAAe,EAAE,GAAW;IACnD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,iBAAQ,CAAC,+CAA+C,GAAG,IAAI,CAAC,CAAC;IACpG,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,IAAI,cAAc,CAAC;IAC/C,MAAM,IAAI,GAAG,KAAK,EAAE,IAAc,EAAE,EAAE;QACpC,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAAyB,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,IAAI,iBAAQ,CAAC,sFAAsF,CAAC,CAAC;YAC7J,MAAM,IAAI,iBAAQ,CAAC,+BAA+B,GAAG,2BAA2B,CAAC,CAAC;QACpF,CAAC;IACH,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC,CAAC;IACzF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAC,CAAC;IACnF,IAAI,GAAG,GAAa,EAAE,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAY,CAAC;QAChD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,2HAA2H;IAC7H,CAAC;IACD,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,IAAmB,EAAE,IAAY,EAAE,EAAE;QACjE,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;YACvF,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,iCAAiC,CAAC,EAAE,CAAC;YACjE,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC,CAAC;QACpJ,CAAC;IACH,CAAC,CAAC;IACF,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,GAAG,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACxF,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACjE,OAAO,GAAG,CAAC;AACb,CAAC;AAEM,KAAK,UAAU,cAAc,CAAC,GAAe,EAAE,IAAqD;IACzG,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,KAA4C,CAAC;QACjD,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,iBAAQ,CAAC,2BAA2B,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;QAC7D,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,YAAY,CAAC,IAAA,oBAAQ,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACrF,IAAI,SAAS,CAAC,IAAA,oBAAQ,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACjF,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;QAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEnF,IAAI,IAAI,CAAC,IAAI;QAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;SACrE,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;SACxE,CAAC;QACJ,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACjH,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACf,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,cAAc,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjC,CAAC"}

package/dist/commands/fga.d.ts

@@ -0,0 +1,10 @@
+import { type ParsedArgs } from '../args';
+import type { RunContext } from '../context';
+/** Resolve a suite file (`model_file`, `tuple_file` are relative to the suite) into a request body. */
+export declare function loadSuite(ctx: RunContext, path: string): {
+    dsl?: string;
+    model?: unknown;
+    tuples: unknown[];
+    tests: unknown[];
+};
+export declare function fga(ctx: RunContext, args: ParsedArgs): Promise<number>;

package/dist/commands/fga.js

@@ -0,0 +1,146 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadSuite = loadSuite;
+exports.fga = fga;
+const node_path_1 = require("node:path");
+const yaml_1 = require("yaml");
+const args_1 = require("../args");
+const errors_1 = require("../errors");
+const output_1 = require("../output");
+const project_1 = require("../project");
+const resources_1 = require("./resources");
+const shared_1 = require("./shared");
+const parseDoc = (path, text) => {
+    try {
+        return /\.json$/i.test(path) ? JSON.parse(text) : (0, yaml_1.parse)(text);
+    }
+    catch (e) {
+        throw new errors_1.CliError(`${path} could not be parsed: ${e.message}`);
+    }
+};
+function http(ctx, args) {
+    const auth = (0, shared_1.resolveAuth)(ctx, args.values);
+    return (0, project_1.httpFor)(ctx, { secretKey: auth.secretKey, apiUrl: (0, shared_1.envApiUrl)(ctx.env) ?? auth.apiUrl });
+}
+/** Resolve a suite file (`model_file`, `tuple_file` are relative to the suite) into a request body. */
+function loadSuite(ctx, path) {
+    const doc = parseDoc(path, ctx.readFile(path));
+    if (!doc || typeof doc !== 'object')
+        throw new errors_1.CliError(`${path} is not a test file.`);
+    const rel = (p) => (0, node_path_1.resolve)((0, node_path_1.dirname)(path), p);
+    let dsl;
+    let model;
+    if (typeof doc.model === 'string')
+        dsl = doc.model;
+    else if (doc.model && typeof doc.model === 'object')
+        model = doc.model;
+    else if (typeof doc.model_file === 'string') {
+        const mf = rel(doc.model_file);
+        const text = ctx.readFile(mf);
+        if (/\.json$/i.test(mf))
+            model = JSON.parse(text);
+        else
+            dsl = text;
+    }
+    else
+        throw new errors_1.CliError(`${path} needs a model or model_file.`);
+    let tuples = Array.isArray(doc.tuples) ? doc.tuples : [];
+    if (typeof doc.tuple_file === 'string') {
+        const more = parseDoc(doc.tuple_file, ctx.readFile(rel(doc.tuple_file)));
+        if (!Array.isArray(more))
+            throw new errors_1.CliError(`${doc.tuple_file} must hold a list of tuples.`);
+        tuples = [...tuples, ...more];
+    }
+    const tests = Array.isArray(doc.tests) ? doc.tests : [];
+    if (tests.length === 0)
+        throw new errors_1.CliError(`${path} has no tests.`);
+    return { ...(dsl !== undefined ? { dsl } : {}), ...(model !== undefined ? { model } : {}), tuples, tests };
+}
+async function fga(ctx, args) {
+    const [, sub, file] = args.positionals;
+    const v = args.values;
+    if (sub && sub in resources_1.FGA_STORE)
+        return (0, resources_1.resourceCommand)('fga', resources_1.FGA_STORE)(ctx, args);
+    if (sub === 'watch')
+        return watch(ctx, args);
+    if (!sub || !['test', 'validate', 'transform'].includes(sub))
+        throw new errors_1.CliError("Usage: atlas fga test|validate|transform <file> | export|import|watch|materializations|materialize|rebuild|unmaterialize <store> (see 'atlas fga --help').");
+    if (!file)
+        throw new errors_1.CliError(`atlas fga ${sub} needs a file.`);
+    if (sub === 'test') {
+        const suite = loadSuite(ctx, file);
+        // A model given as JSON goes through the transform endpoint so the test route only ever receives DSL.
+        const h = http(ctx, args);
+        let dsl = suite.dsl;
+        if (!dsl)
+            dsl = (await h.post('/v1/fga/models/transform', { model: suite.model })).dsl;
+        const store = (0, args_1.str)(v, 'store');
+        const body = { dsl, tuples: suite.tuples, tests: suite.tests };
+        const report = await h.post(store ? `/v1/fga/stores/${encodeURIComponent(store)}/tests` : '/v1/fga/tests', body);
+        if ((0, shared_1.wantsJson)(v)) {
+            (0, output_1.printJson)(ctx.io, report);
+            return report.passed ? 0 : 1;
+        }
+        for (const r of report.results) {
+            ctx.io.out(`${r.passed ? 'PASS' : 'FAIL'}  ${r.name}  (${r.checks} assertion${r.checks === 1 ? '' : 's'})`);
+            for (const f of r.failures)
+                ctx.io.out(`        ${f.kind} ${f.query}: expected ${JSON.stringify(f.expected)}, got ${f.error ? `error: ${f.error}` : JSON.stringify(f.actual)}`);
+        }
+        ctx.io.out(`\n${report.total - report.failed}/${report.total} tests passed. Relations covered: ${report.coverage.covered}/${report.coverage.relations}.`);
+        if (report.coverage.uncovered.length)
+            ctx.io.out(`Not covered: ${report.coverage.uncovered.join(', ')}`);
+        return report.passed ? 0 : 1;
+    }
+    const text = ctx.readFile(file);
+    const isJson = /\.json$/i.test(file);
+    const out = await http(ctx, args).post('/v1/fga/models/transform', isJson ? { model: JSON.parse(text) } : { dsl: text });
+    if (sub === 'validate') {
+        if ((0, shared_1.wantsJson)(v))
+            (0, output_1.printJson)(ctx.io, { valid: true });
+        else
+            ctx.io.out(`${file}: valid`);
+        return 0;
+    }
+    const to = (0, args_1.str)(v, 'to') ?? (isJson ? 'dsl' : 'json');
+    if (to !== 'dsl' && to !== 'json')
+        throw new errors_1.CliError("--to must be 'dsl' or 'json'.");
+    ctx.io.out(to === 'dsl' ? out.dsl : JSON.stringify(out.model, null, 2));
+    return 0;
+}
+/** `atlas fga watch <store> [--since <revision>]`: stream tuple changes (server-sent events) until interrupted. */
+async function watch(ctx, args) {
+    const store = args.positionals[2];
+    if (!store)
+        throw new errors_1.CliError('atlas fga watch needs a store id.');
+    const auth = (0, shared_1.resolveAuth)(ctx, args.values);
+    const since = (0, args_1.str)(args.values, 'since');
+    if (since !== undefined && !/^\d+$/.test(since))
+        throw new errors_1.CliError('--since must be a store revision (a non-negative integer).');
+    const base = ((0, shared_1.envApiUrl)(ctx.env) ?? auth.apiUrl).replace(/\/+$/, '');
+    const res = await (ctx.fetch ?? fetch)(`${base}/v1/fga/stores/${encodeURIComponent(store)}/watch${since ? `?since=${since}` : ''}`, {
+        headers: { authorization: `Bearer ${auth.secretKey}`, accept: 'text/event-stream' },
+        signal: ctx.signal,
+    });
+    if (!res.ok || !res.body)
+        throw new errors_1.CliError(`Could not open the watch stream (HTTP ${res.status}).`);
+    const decoder = new TextDecoder();
+    let buf = '';
+    try {
+        for await (const chunk of res.body) {
+            buf += decoder.decode(chunk, { stream: true });
+            let i;
+            while ((i = buf.indexOf('\n\n')) >= 0) {
+                const data = buf.slice(0, i).split('\n').filter((l) => l.startsWith('data:')).map((l) => l.slice(5).trim()).join('\n');
+                buf = buf.slice(i + 2);
+                if (data)
+                    ctx.io.out(data);
+            }
+        }
+    }
+    catch (e) {
+        if (e.name !== 'AbortError')
+            throw e;
+    }
+    return 0;
+}
+//# sourceMappingURL=fga.js.map

package/dist/commands/fga.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fga.js","sourceRoot":"","sources":["../../src/commands/fga.ts"],"names":[],"mappings":";;AA2CA,8BAuBC;AAED,kBA0CC;AA9GD,yCAA6C;AAC7C,+BAA0C;AAC1C,kCAA+C;AAE/C,sCAAqC;AACrC,sCAAsC;AACtC,wCAAqC;AACrC,2CAAyD;AACzD,qCAA6D;AAqB7D,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,IAAY,EAAW,EAAE;IACvD,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,YAAS,EAAC,IAAI,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,iBAAQ,CAAC,GAAG,IAAI,yBAA0B,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC,CAAC;AAEF,SAAS,IAAI,CAAC,GAAe,EAAE,IAAgB;IAC7C,MAAM,IAAI,GAAG,IAAA,oBAAW,EAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,OAAO,IAAA,iBAAO,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AAChG,CAAC;AAED,uGAAuG;AACvG,SAAgB,SAAS,CAAC,GAAe,EAAE,IAAY;IACrD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAmC,CAAC;IACjF,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,iBAAQ,CAAC,GAAG,IAAI,sBAAsB,CAAC,CAAC;IACvF,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAA,mBAAO,EAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACrD,IAAI,GAAuB,CAAC;IAC5B,IAAI,KAAc,CAAC;IACnB,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC;SAC9C,IAAI,GAAG,CAAC,KAAK,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;SAClE,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;;YAC7C,GAAG,GAAG,IAAI,CAAC;IAClB,CAAC;;QAAM,MAAM,IAAI,iBAAQ,CAAC,GAAG,IAAI,+BAA+B,CAAC,CAAC;IAClE,IAAI,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,iBAAQ,CAAC,GAAG,GAAG,CAAC,UAAU,8BAA8B,CAAC,CAAC;QAC9F,MAAM,GAAG,CAAC,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,iBAAQ,CAAC,GAAG,IAAI,gBAAgB,CAAC,CAAC;IACpE,OAAO,EAAE,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC7G,CAAC;AAEM,KAAK,UAAU,GAAG,CAAC,GAAe,EAAE,IAAgB;IACzD,MAAM,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC;IACvC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IACtB,IAAI,GAAG,IAAI,GAAG,IAAI,qBAAS;QAAE,OAAO,IAAA,2BAAe,EAAC,KAAK,EAAE,qBAAS,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACjF,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,iBAAQ,CAAC,4JAA4J,CAAC,CAAC;IAC/O,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,iBAAQ,CAAC,aAAa,GAAG,gBAAgB,CAAC,CAAC;IAEhE,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,sGAAsG;QACtG,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC1B,IAAI,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;QACpB,IAAI,CAAC,GAAG;YAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAkB,0BAA0B,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QACxG,MAAM,KAAK,GAAG,IAAA,UAAG,EAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,IAAI,CAAS,KAAK,CAAC,CAAC,CAAC,kBAAkB,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;QACzH,IAAI,IAAA,kBAAS,EAAC,CAAC,CAAC,EAAE,CAAC;YACjB,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAC1B,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAC/B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,MAAM,aAAa,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;YAC5G,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ;gBAAE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,cAAc,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAClL,CAAC;QACD,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,qCAAqC,MAAM,CAAC,QAAQ,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,GAAG,CAAC,CAAC;QAC1J,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM;YAAE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzG,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,IAAI,CAAkC,0BAA0B,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1J,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;QACvB,IAAI,IAAA,kBAAS,EAAC,CAAC,CAAC;YAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;;YAChD,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,SAAS,CAAC,CAAC;QAClC,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,EAAE,GAAG,IAAA,UAAG,EAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACrD,IAAI,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,MAAM;QAAE,MAAM,IAAI,iBAAQ,CAAC,+BAA+B,CAAC,CAAC;IACvF,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACxE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,mHAAmH;AACnH,KAAK,UAAU,KAAK,CAAC,GAAe,EAAE,IAAgB;IACpD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,iBAAQ,CAAC,mCAAmC,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,IAAA,oBAAW,EAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,iBAAQ,CAAC,4DAA4D,CAAC,CAAC;IAClI,MAAM,IAAI,GAAG,CAAC,IAAA,kBAAS,EAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,GAAG,IAAI,kBAAkB,kBAAkB,CAAC,KAAK,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE;QAClI,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE;QACnF,MAAM,EAAE,GAAG,CAAC,MAAM;KACnB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,MAAM,IAAI,iBAAQ,CAAC,yCAAyC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;IACtG,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,CAAC,IAA4C,EAAE,CAAC;YAC3E,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/C,IAAI,CAAS,CAAC;YACd,OAAO,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACvH,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBACvB,IAAI,IAAI;oBAAE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAK,CAAW,CAAC,IAAI,KAAK,YAAY;YAAE,MAAM,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/commands/golive.d.ts

@@ -0,0 +1,40 @@
+import { type ParsedArgs } from '../args';
+import type { ConfigHttp } from '../config-http';
+import type { RunContext } from '../context';
+/**
+ * `atlas golive --origin <url>`: take an instance from "configured" to "live"
+ * for one app origin. Runs the steps in order and stops at the first failure,
+ * printing the fix. `--dry-run` sends every write with `?dry_run=true`, so the
+ * server validates it and nothing changes.
+ */
+/** One result line. `ok: false` carries the fix. */
+export interface CheckResult {
+    id: string;
+    ok: boolean;
+    detail: string;
+    fix?: string;
+}
+interface Domain {
+    id: string;
+    role: string;
+    host: string;
+    status: string;
+    method?: 'cname' | 'path';
+    base_path?: string | null;
+    action?: string | null;
+    failure_reason?: string | null;
+    verified?: boolean;
+}
+/** The cookies the SDKs read: a consent manager that does not declare them may block sign-in. */
+export declare const SDK_COOKIES: readonly ["__session", "__atlas_uat", "__atlas_rt", "__client"];
+/** Parse `--origin` to a bare origin (scheme + host + port). */
+export declare function parseOrigin(raw: string | undefined, command: string): URL;
+/** The custom domain serving this origin's host: an exact host match, else the Frontend API domain. */
+export declare function domainFor(domains: Domain[], host: string): Domain | undefined;
+export declare function preflightCheck(api: ConfigHttp): Promise<CheckResult>;
+export declare function loginReadinessCheck(api: ConfigHttp, origin: string): Promise<CheckResult>;
+/** A path mount on the origin's host: verified (active) or the step still to do. */
+export declare function pathMountCheck(api: ConfigHttp, host: string): Promise<CheckResult>;
+export declare function declaredCookiesCheck(api: ConfigHttp): Promise<CheckResult>;
+export declare function golive(ctx: RunContext, args: ParsedArgs): Promise<number>;
+export {};