@atlasauth/cli 0.25.0 → 0.26.0

package/dist/migrate/zitadel/plugin.js

@@ -0,0 +1,114 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.zitadelPlugin = void 0;
+const node_path_1 = require("node:path");
+const errors_1 = require("../../errors");
+const zitadel_1 = require("../export/zitadel");
+const zitadel_config_1 = require("../export/zitadel-config");
+const plugin_kit_1 = require("../export/plugin-kit");
+/**
+ * `atlas migrate zitadel` — ZITADEL Cloud and self-hosted ZITADEL: policies,
+ * applications, project roles and identity providers as Atlas config; users
+ * with their password hashes, TOTP secrets, verified email and phone, social
+ * and enterprise links, project roles (as app roles) and organizations with
+ * their members, from ZITADEL's own export (a file, or the admin API with a
+ * service-user token); a zero-logout bridge for ZITADEL ID tokens and JWT
+ * access tokens; lazy migration through the session API; and the code. The
+ * token stays on this machine.
+ */
+const URL_SPEC = { flag: '--zitadel-url', env: 'ZITADEL_URL', label: 'your ZITADEL URL (https://<instance>.zitadel.cloud, or your own domain)', required: false };
+const TOKEN = { flag: '--zitadel-token', env: 'ZITADEL_TOKEN', label: 'a service user\'s personal access token (IAM_OWNER to export, IAM_LOGIN_CLIENT for lazy migration)', required: false, secret: true };
+const EXPORT_FILE = { flag: '--zitadel-export', env: 'ZITADEL_EXPORT_FILE', label: 'the JSON file `zitadel export` wrote (or a saved POST /admin/v1/export response)', required: false };
+const ORGS = { flag: '--zitadel-orgs', env: 'ZITADEL_ORGS', label: 'how organizations move: auto (when there is more than one), all or skip', required: false };
+function instanceUrl(p) {
+    const raw = p.credential(URL_SPEC);
+    return raw ? (0, zitadel_1.zitadelBase)(raw) : undefined;
+}
+function orgsMode(p) {
+    const raw = (p.credential(ORGS) ?? 'auto').trim().toLowerCase();
+    if (raw !== 'auto' && raw !== 'all' && raw !== 'skip')
+        throw new errors_1.CliError(`ZITADEL: --set zitadel-orgs takes auto, all or skip (got ${raw}).`);
+    return raw;
+}
+function readDocument(p, path) {
+    try {
+        return JSON.parse(p.ctx.readFile((0, node_path_1.resolve)(path)));
+    }
+    catch (err) {
+        throw new errors_1.CliError(`ZITADEL: could not read the export ${path}: ${err.message}`);
+    }
+}
+exports.zitadelPlugin = {
+    vendor: 'zitadel',
+    source: 'zitadel',
+    label: 'ZITADEL',
+    help: 'Move ZITADEL (Cloud or self-hosted): login, password and lockout policy, applications, project roles and identity providers as Atlas config; users with password hashes, TOTP secrets, verified email and phone, social and enterprise links, roles and organizations from ZITADEL\'s own export; a zero-logout bridge for ZITADEL ID tokens and JWT access tokens; lazy migration through the session API; and the code. Your service-user token stays on this machine.',
+    config: {
+        reads: 'a `zitadel export` file, or your instance through the admin API (policies, applications, roles, identity providers, actions)',
+        credentials: [EXPORT_FILE, URL_SPEC, TOKEN],
+        async translate(p) {
+            const file = p.credential(EXPORT_FILE);
+            const url = instanceUrl(p);
+            if (file)
+                return (0, zitadel_config_1.translateZitadelConfig)((0, zitadel_config_1.configSnapshotFromExport)(readDocument(p, file), file, url));
+            const token = p.credential(TOKEN);
+            if (!url || !token) {
+                throw new errors_1.CliError('ZITADEL: pass the export file (--set zitadel-export=<file>), or your instance URL and a service-user token (--set zitadel-url=… --set zitadel-token=…).');
+            }
+            return (0, zitadel_config_1.translateZitadelConfig)(await (0, plugin_kit_1.vendorStep)('ZITADEL', () => (0, zitadel_config_1.fetchZitadelConfig)({ instance: url, token, fetchImpl: p.fetch })));
+        },
+    },
+    export: {
+        reads: 'ZITADEL\'s export (a `zitadel export` file, or POST /admin/v1/export with a service-user token)',
+        credentials: [EXPORT_FILE, URL_SPEC, TOKEN, ORGS],
+        limits: [
+            'Passkeys and security keys live only in ZITADEL\'s event store and are not exported: users register a passkey again.',
+            'Password hashes and TOTP secrets need the export with passwords and secrets on (`zitadel export`, or an IAM_OWNER token on the admin API). With a narrower role the export lists users through the user API instead, and passwords move by lazy migration.',
+            'Machine users (service accounts) are not exported: recreate them as Atlas API keys or M2M clients.',
+            'Organizations become Atlas organizations when the instance has more than one (--set zitadel-orgs=all to always, skip to never); organization roles other than ORG_OWNER join as plain members.',
+            'Sessions are opaque to Atlas: the bridge accepts ZITADEL ID tokens and JWT access tokens instead.',
+        ],
+        async run(p, writer, resume) {
+            const file = p.credential(EXPORT_FILE);
+            const orgs = orgsMode(p);
+            let set;
+            if (file) {
+                const url = instanceUrl(p);
+                set = await (0, plugin_kit_1.vendorStep)('ZITADEL', async () => (0, zitadel_1.mapZitadel)({ ...(0, zitadel_1.readZitadelExport)(readDocument(p, file)), instance: url }, { orgs }));
+            }
+            else {
+                const url = instanceUrl(p);
+                if (!url)
+                    throw new errors_1.CliError('ZITADEL: pass the export file (--set zitadel-export=<file>), or your instance URL and a service-user token (--set zitadel-url=… --set zitadel-token=…).');
+                const token = (0, plugin_kit_1.need)(p, TOKEN);
+                set = await (0, plugin_kit_1.vendorStep)('ZITADEL', () => (0, zitadel_1.exportZitadelApi)({ instance: url, token, orgs, fetchImpl: p.fetch, onProgress: (m) => p.say(`  reading ${m}`) }));
+            }
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    bridge: {
+        preset: 'zitadel',
+        vars(p, t) {
+            const vars = { ...t?.bridge?.vars };
+            const url = instanceUrl(p);
+            if (url)
+                vars.issuer = url;
+            if (!vars.issuer)
+                throw new errors_1.CliError('ZITADEL: the bridge needs the issuer: pass your instance URL (--set zitadel-url=https://<instance>.zitadel.cloud).');
+            return vars;
+        },
+    },
+    lazy: {
+        preset: 'zitadel',
+        config(p, t) {
+            const config = { ...t?.lazy?.config };
+            const url = instanceUrl(p);
+            if (url)
+                config.base_url = url;
+            return config;
+        },
+        secret: TOKEN,
+    },
+    codemod: 'zitadel',
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/zitadel/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/zitadel/plugin.ts"],"names":[],"mappings":";;;AAAA,yCAAoC;AACpC,yCAAwC;AACxC,+CAAyH;AACzH,6DAAgH;AAChH,qDAAwE;AAIxE;;;;;;;;;GASG;AAEH,MAAM,QAAQ,GAAmB,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,yEAAyE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAClL,MAAM,KAAK,GAAmB,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,oGAAoG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC5N,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,kFAAkF,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACzM,MAAM,IAAI,GAAmB,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,yEAAyE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAEhL,SAAS,WAAW,CAAC,CAAgB;IACnC,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACnC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAA,qBAAW,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC;AAED,SAAS,QAAQ,CAAC,CAAgB;IAChC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChE,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,MAAM;QAAE,MAAM,IAAI,iBAAQ,CAAC,4DAA4D,GAAG,IAAI,CAAC,CAAC;IAC/I,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,CAAgB,EAAE,IAAY;IAClD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC,CAAY,CAAC;IAC9D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,iBAAQ,CAAC,sCAAsC,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9F,CAAC;AACH,CAAC;AAEY,QAAA,aAAa,GAAoB;IAC5C,MAAM,EAAE,SAAS;IACjB,MAAM,EAAE,SAAS;IACjB,KAAK,EAAE,SAAS;IAChB,IAAI,EAAE,0cAA0c;IAChd,MAAM,EAAE;QACN,KAAK,EAAE,8HAA8H;QACrI,WAAW,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC;QAC3C,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YACvC,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,IAAI;gBAAE,OAAO,IAAA,uCAAsB,EAAC,IAAA,yCAAwB,EAAC,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;YACpG,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAClC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,IAAI,iBAAQ,CAAC,yJAAyJ,CAAC,CAAC;YAChL,CAAC;YACD,OAAO,IAAA,uCAAsB,EAAC,MAAM,IAAA,uBAAU,EAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAA,mCAAkB,EAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QACrI,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,iGAAiG;QACxG,WAAW,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC;QACjD,MAAM,EAAE;YACN,sHAAsH;YACtH,4PAA4P;YAC5P,oGAAoG;YACpG,gMAAgM;YAChM,mGAAmG;SACpG;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,GAAc,CAAC;YACnB,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;gBAC3B,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,IAAA,oBAAU,EAAC,EAAE,GAAG,IAAA,2BAAiB,EAAC,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACtI,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;gBAC3B,IAAI,CAAC,GAAG;oBAAE,MAAM,IAAI,iBAAQ,CAAC,yJAAyJ,CAAC,CAAC;gBACxL,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBAC7B,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAA,0BAAgB,EAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5J,CAAC;YACD,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,SAAS;QACjB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,GAA2B,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC5D,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,GAAG;gBAAE,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC;YAC3B,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,iBAAQ,CAAC,oHAAoH,CAAC,CAAC;YAC3J,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,SAAS;QACjB,MAAM,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,MAAM,GAA2B,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9D,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,GAAG;gBAAE,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC;YAC/B,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,EAAE,KAAK;KACd;IACD,OAAO,EAAE,SAAS;CACnB,CAAC"}

package/dist/output.d.ts

@@ -0,0 +1,41 @@
+import type { IO } from './io';
+/**
+ * A single rendered column: a header plus a getter that pulls the raw value off
+ * a row. Getters (not keys) because a few columns are derived — a user's name
+ * joins first + last, a webhook's events join an array — and a getter keeps that
+ * shaping next to the column instead of forcing a pre-massaged row.
+ */
+export interface Column<T> {
+    header: string;
+    get: (row: T) => unknown;
+}
+/**
+ * Epoch-millisecond timestamp → ISO-8601, the form every Atlas `*_at` field
+ * takes on the wire. Blank for null (e.g. a user who never signed in) so the
+ * column stays readable rather than printing `1970-...`.
+ */
+export declare function fmtTime(value: unknown): string;
+/**
+ * Hand-rolled fixed-width table — the only "formatting library" this CLI has.
+ * Columns are padded to the widest cell (header included); a dashed rule sits
+ * under the header; trailing padding on the last column is trimmed so lines
+ * don't carry invisible whitespace. Empty input prints a friendly placeholder
+ * rather than a bare header with no rows.
+ */
+export declare function renderTable<T>(columns: Column<T>[], rows: T[]): string;
+/** Pretty-print any value as the `--json` output on stdout. */
+export declare function printJson(io: IO, value: unknown): void;
+/**
+ * Print a cursor-paginated list as either raw JSON or a table, and — in table
+ * mode, when there is another page — a footer naming the exact flag to fetch
+ * it. Keeping the hint next to the data is what makes `--starting-after`
+ * discoverable without the user reading `--help`.
+ */
+export declare function printList<T>(io: IO, opts: {
+    json: boolean;
+    columns: Column<T>[];
+}, page: {
+    data: T[];
+    has_more?: boolean;
+    next_cursor?: string | null;
+}, raw?: unknown): void;

package/dist/output.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fmtTime = fmtTime;
+exports.renderTable = renderTable;
+exports.printJson = printJson;
+exports.printList = printList;
+/** Render a value as a table cell: null/undefined blank, arrays joined, objects JSON. */
+function cell(value) {
+    if (value === null || value === undefined)
+        return '';
+    if (Array.isArray(value))
+        return value.map((v) => cell(v)).join(', ');
+    if (typeof value === 'object')
+        return JSON.stringify(value);
+    return String(value);
+}
+/**
+ * Epoch-millisecond timestamp → ISO-8601, the form every Atlas `*_at` field
+ * takes on the wire. Blank for null (e.g. a user who never signed in) so the
+ * column stays readable rather than printing `1970-...`.
+ */
+function fmtTime(value) {
+    if (value === null || value === undefined)
+        return '';
+    const n = Number(value);
+    if (!Number.isFinite(n))
+        return '';
+    return new Date(n).toISOString();
+}
+/**
+ * Hand-rolled fixed-width table — the only "formatting library" this CLI has.
+ * Columns are padded to the widest cell (header included); a dashed rule sits
+ * under the header; trailing padding on the last column is trimmed so lines
+ * don't carry invisible whitespace. Empty input prints a friendly placeholder
+ * rather than a bare header with no rows.
+ */
+function renderTable(columns, rows) {
+    if (rows.length === 0)
+        return '(no results)';
+    const matrix = rows.map((row) => columns.map((col) => cell(col.get(row))));
+    const widths = columns.map((col, i) => Math.max(col.header.length, ...matrix.map((r) => r[i].length)));
+    const pad = (text, width) => text.padEnd(width);
+    const line = (fields) => fields.map((f, i) => pad(f, widths[i])).join('  ').replace(/\s+$/, '');
+    const lines = [
+        line(columns.map((c) => c.header)),
+        line(widths.map((w) => '-'.repeat(w))),
+        ...matrix.map((r) => line(r)),
+    ];
+    return lines.join('\n');
+}
+/** Pretty-print any value as the `--json` output on stdout. */
+function printJson(io, value) {
+    io.out(JSON.stringify(value, null, 2));
+}
+/**
+ * Print a cursor-paginated list as either raw JSON or a table, and — in table
+ * mode, when there is another page — a footer naming the exact flag to fetch
+ * it. Keeping the hint next to the data is what makes `--starting-after`
+ * discoverable without the user reading `--help`.
+ */
+function printList(io, opts, page, raw = page) {
+    if (opts.json) {
+        printJson(io, raw);
+        return;
+    }
+    io.out(renderTable(opts.columns, page.data));
+    if (page.has_more && page.next_cursor) {
+        io.out('');
+        io.out(`More results — fetch the next page with: --starting-after ${page.next_cursor}`);
+    }
+}
+//# sourceMappingURL=output.js.map

package/dist/output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.js","sourceRoot":"","sources":["../src/output.ts"],"names":[],"mappings":";;AA0BA,0BAKC;AASD,kCAkBC;AAGD,8BAEC;AAQD,8BAeC;AAzED,yFAAyF;AACzF,SAAS,IAAI,CAAC,KAAc;IAC1B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,SAAgB,OAAO,CAAC,KAAc;IACpC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrD,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACxB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,WAAW,CAAI,OAAoB,EAAE,IAAS;IAC5D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,cAAc,CAAC;IAE7C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CACpC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC,CAAC,CAChE,CAAC;IAEF,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,CAAC,MAAgB,EAAE,EAAE,CAChC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAE1E,MAAM,KAAK,GAAG;QACZ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACtC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;KAC9B,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,+DAA+D;AAC/D,SAAgB,SAAS,CAAC,EAAM,EAAE,KAAc;IAC9C,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACzC,CAAC;AAED;;;;;GAKG;AACH,SAAgB,SAAS,CACvB,EAAM,EACN,IAA6C,EAC7C,IAAoE,EACpE,MAAe,IAAI;IAEnB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACnB,OAAO;IACT,CAAC;IACD,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7C,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACtC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACX,EAAE,CAAC,GAAG,CAAC,6DAA6D,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC"}

package/dist/project.d.ts

@@ -0,0 +1,64 @@
+import { type ConfigHttp } from './config-http';
+import type { RunContext } from './context';
+/**
+ * The project manifest `atlas init` keeps at `~/.config/<product>/atlas.json`:
+ * PUBLIC values only (ids, publishable key, hosts, redirect URIs) plus the path
+ * of each secret file. `atlas env`, `atlas preflight --instance` and
+ * `atlas client rotate` read it, so they know where a secret lives without
+ * ever holding it in the manifest.
+ */
+export type InstanceEnv = 'development' | 'production';
+export interface ProjectInstance {
+    instance_id: string;
+    environment: InstanceEnv;
+    publishable_key: string;
+    frontend_api_host: string | null;
+    issuer: string | null;
+    discovery_url: string | null;
+    jwks_uri: string | null;
+    /** The file holding ATLAS_SECRET_KEY. */
+    secret_file: string;
+    oauth_client?: {
+        id: string;
+        client_id: string;
+        redirect_uris: string[];
+        secret_file: string | null;
+    };
+    webhook?: {
+        id: string;
+        url: string;
+        secret_file: string | null;
+    };
+    custom_domain?: {
+        host: string;
+        cname_target: string | null;
+        status: string;
+    };
+    email?: {
+        mode: 'managed' | 'development' | 'none';
+        from_address?: string | null;
+    };
+}
+export interface ProjectManifest {
+    product: string;
+    api_url: string;
+    instances: Partial<Record<InstanceEnv, ProjectInstance>>;
+}
+export declare const MANIFEST_FILE = "atlas.json";
+export declare function manifestPath(env: NodeJS.ProcessEnv, product: string): string;
+export declare function readManifest(env: NodeJS.ProcessEnv, product: string): ProjectManifest | undefined;
+export declare function writeManifest(env: NodeJS.ProcessEnv, manifest: ProjectManifest): string;
+/** Find the project + instance an instance id belongs to, scanning every product directory. */
+export declare function findInstance(env: NodeJS.ProcessEnv, instanceId: string, product?: string): {
+    manifest: ProjectManifest;
+    instance: ProjectInstance;
+} | undefined;
+export declare function parseInstanceEnv(raw: string | undefined, fallback: InstanceEnv): InstanceEnv;
+/** The raw HTTP client for a credential (the context's, or the real one). */
+export declare function httpFor(ctx: RunContext, opts: {
+    secretKey: string;
+    apiUrl: string;
+    headers?: Record<string, string>;
+}): ConfigHttp;
+/** Read the instance secret key from the project's secret file. */
+export declare function instanceSecretFromFile(instance: ProjectInstance): string;

package/dist/project.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MANIFEST_FILE = void 0;
+exports.manifestPath = manifestPath;
+exports.readManifest = readManifest;
+exports.writeManifest = writeManifest;
+exports.findInstance = findInstance;
+exports.parseInstanceEnv = parseInstanceEnv;
+exports.httpFor = httpFor;
+exports.instanceSecretFromFile = instanceSecretFromFile;
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const config_http_1 = require("./config-http");
+const errors_1 = require("./errors");
+const secrets_1 = require("./secrets");
+exports.MANIFEST_FILE = 'atlas.json';
+function manifestPath(env, product) {
+    return (0, node_path_1.join)((0, secrets_1.productDir)(env, product), exports.MANIFEST_FILE);
+}
+function readManifest(env, product) {
+    try {
+        return JSON.parse((0, node_fs_1.readFileSync)(manifestPath(env, product), 'utf8'));
+    }
+    catch {
+        return undefined;
+    }
+}
+function writeManifest(env, manifest) {
+    const dir = (0, secrets_1.productDir)(env, manifest.product);
+    (0, node_fs_1.mkdirSync)(dir, { recursive: true, mode: 0o700 });
+    const path = (0, node_path_1.join)(dir, exports.MANIFEST_FILE);
+    (0, node_fs_1.writeFileSync)(path, JSON.stringify(manifest, null, 2) + '\n', { mode: 0o600 });
+    (0, node_fs_1.chmodSync)(path, 0o600);
+    return path;
+}
+/** Find the project + instance an instance id belongs to, scanning every product directory. */
+function findInstance(env, instanceId, product) {
+    const products = product ? [product] : listProducts(env);
+    for (const p of products) {
+        const m = readManifest(env, p);
+        for (const inst of Object.values(m?.instances ?? {})) {
+            if (inst && inst.instance_id === instanceId)
+                return { manifest: m, instance: inst };
+        }
+    }
+    return undefined;
+}
+function listProducts(env) {
+    const base = env.XDG_CONFIG_HOME?.trim() || (0, node_path_1.join)(env.HOME?.trim() || (0, node_os_1.homedir)(), '.config');
+    try {
+        return (0, node_fs_1.readdirSync)(base).filter((d) => {
+            try {
+                (0, node_fs_1.readFileSync)((0, node_path_1.join)(base, d, exports.MANIFEST_FILE));
+                return true;
+            }
+            catch {
+                return false;
+            }
+        });
+    }
+    catch {
+        return [];
+    }
+}
+function parseInstanceEnv(raw, fallback) {
+    if (raw === undefined)
+        return fallback;
+    if (raw !== 'development' && raw !== 'production') {
+        throw new errors_1.CliError(`--instance-env must be development or production, got '${raw}'.`);
+    }
+    return raw;
+}
+/** The raw HTTP client for a credential (the context's, or the real one). */
+function httpFor(ctx, opts) {
+    return (ctx.makeHttp ?? config_http_1.createConfigHttp)(opts);
+}
+/** Read the instance secret key from the project's secret file. */
+function instanceSecretFromFile(instance) {
+    const key = (0, secrets_1.readEnvFile)(instance.secret_file)?.ATLAS_SECRET_KEY;
+    if (!key) {
+        throw new errors_1.CliError(`No ATLAS_SECRET_KEY in ${instance.secret_file}. Re-run 'atlas init' with --rotate-secret to mint a new one.`);
+    }
+    return key;
+}
+//# sourceMappingURL=project.js.map

package/dist/project.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project.js","sourceRoot":"","sources":["../src/project.ts"],"names":[],"mappings":";;;AA0CA,oCAEC;AAED,oCAMC;AAED,sCAOC;AAGD,oCAaC;AAkBD,4CAMC;AAGD,0BAEC;AAGD,wDAQC;AArHD,qCAAyF;AACzF,qCAAkC;AAClC,yCAAiC;AACjC,+CAAkE;AAElE,qCAAoC;AACpC,uCAAoD;AAkCvC,QAAA,aAAa,GAAG,YAAY,CAAC;AAE1C,SAAgB,YAAY,CAAC,GAAsB,EAAE,OAAe;IAClE,OAAO,IAAA,gBAAI,EAAC,IAAA,oBAAU,EAAC,GAAG,EAAE,OAAO,CAAC,EAAE,qBAAa,CAAC,CAAC;AACvD,CAAC;AAED,SAAgB,YAAY,CAAC,GAAsB,EAAE,OAAe;IAClE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAoB,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAgB,aAAa,CAAC,GAAsB,EAAE,QAAyB;IAC7E,MAAM,GAAG,GAAG,IAAA,oBAAU,EAAC,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAA,mBAAS,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,qBAAa,CAAC,CAAC;IACtC,IAAA,uBAAa,EAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,IAAA,mBAAS,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+FAA+F;AAC/F,SAAgB,YAAY,CAC1B,GAAsB,EACtB,UAAkB,EAClB,OAAgB;IAEhB,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACzD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;YACrD,IAAI,IAAI,IAAI,IAAI,CAAC,WAAW,KAAK,UAAU;gBAAE,OAAO,EAAE,QAAQ,EAAE,CAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACvF,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,GAAsB;IAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,IAAA,gBAAI,EAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,IAAA,iBAAO,GAAE,EAAE,SAAS,CAAC,CAAC;IAC3F,IAAI,CAAC;QACH,OAAO,IAAA,qBAAW,EAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACpC,IAAI,CAAC;gBACH,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,CAAC,EAAE,qBAAa,CAAC,CAAC,CAAC;gBAC3C,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAgB,gBAAgB,CAAC,GAAuB,EAAE,QAAqB;IAC7E,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACvC,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;QAClD,MAAM,IAAI,iBAAQ,CAAC,0DAA0D,GAAG,IAAI,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6EAA6E;AAC7E,SAAgB,OAAO,CAAC,GAAe,EAAE,IAA6E;IACpH,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,8BAAgB,CAAC,CAAC,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,mEAAmE;AACnE,SAAgB,sBAAsB,CAAC,QAAyB;IAC9D,MAAM,GAAG,GAAG,IAAA,qBAAW,EAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAChE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,iBAAQ,CAChB,0BAA0B,QAAQ,CAAC,WAAW,+DAA+D,CAC9G,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/prompt.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The interactive input seam for `atlas login`. An interface (not a direct
+ * `readline` call) so tests script answers without a TTY, and so `secret()`
+ * can hide the key no matter where it's wired.
+ */
+export interface Prompter {
+    /** A visible line of input, with an optional default shown in brackets. */
+    text(query: string, opts?: {
+        default?: string;
+    }): Promise<string>;
+    /** A hidden line of input — the terminal never echoes what's typed. */
+    secret(query: string): Promise<string>;
+}
+/** The real prompter, reading the TTY. Not exercised by unit tests (they inject). */
+export declare function defaultPrompter(input?: NodeJS.ReadableStream, output?: NodeJS.WritableStream): Prompter;

package/dist/prompt.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultPrompter = defaultPrompter;
+const node_readline_1 = require("node:readline");
+function ask(input, output, query) {
+    const rl = (0, node_readline_1.createInterface)({ input, output });
+    return new Promise((resolve) => {
+        rl.question(query, (answer) => {
+            rl.close();
+            resolve(answer);
+        });
+    });
+}
+/** The real prompter, reading the TTY. Not exercised by unit tests (they inject). */
+function defaultPrompter(input = process.stdin, output = process.stdout) {
+    return {
+        async text(query, opts) {
+            const suffix = opts?.default ? ` [${opts.default}]` : '';
+            const answer = (await ask(input, output, `${query}${suffix}: `)).trim();
+            return answer || opts?.default || '';
+        },
+        secret(query) {
+            // Echo the prompt, then mute readline's output so the secret never lands
+            // on screen or in scrollback. `_writeToOutput` is readline's own hook;
+            // overriding it is the standard way to hide typed input.
+            return new Promise((resolve) => {
+                const rl = (0, node_readline_1.createInterface)({ input, output, terminal: true });
+                let muted = false;
+                const rlInternal = rl;
+                rlInternal._writeToOutput = (s) => {
+                    if (!muted)
+                        output.write(s);
+                };
+                output.write(`${query}: `);
+                muted = true;
+                rl.question('', (answer) => {
+                    muted = false;
+                    output.write('\n');
+                    rl.close();
+                    resolve(answer.trim());
+                });
+            });
+        },
+    };
+}
+//# sourceMappingURL=prompt.js.map

package/dist/prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt.js","sourceRoot":"","sources":["../src/prompt.ts"],"names":[],"mappings":";;AAyBA,0CAiCC;AA1DD,iDAAgD;AAchD,SAAS,GAAG,CAAC,KAA4B,EAAE,MAA6B,EAAE,KAAa;IACrF,MAAM,EAAE,GAAG,IAAA,+BAAe,EAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9C,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;QACrC,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE;YAC5B,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,qFAAqF;AACrF,SAAgB,eAAe,CAC7B,QAA+B,OAAO,CAAC,KAAK,EAC5C,SAAgC,OAAO,CAAC,MAAM;IAE9C,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI;YACpB,MAAM,MAAM,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,KAAK,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACxE,OAAO,MAAM,IAAI,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC;QACvC,CAAC;QAED,MAAM,CAAC,KAAK;YACV,yEAAyE;YACzE,uEAAuE;YACvE,yDAAyD;YACzD,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;gBACrC,MAAM,EAAE,GAAG,IAAA,+BAAe,EAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC9D,IAAI,KAAK,GAAG,KAAK,CAAC;gBAClB,MAAM,UAAU,GAAG,EAAyD,CAAC;gBAC7E,UAAU,CAAC,cAAc,GAAG,CAAC,CAAS,EAAE,EAAE;oBACxC,IAAI,CAAC,KAAK;wBAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC9B,CAAC,CAAC;gBACF,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;gBAC3B,KAAK,GAAG,IAAI,CAAC;gBACb,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE;oBACzB,KAAK,GAAG,KAAK,CAAC;oBACd,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBACnB,EAAE,CAAC,KAAK,EAAE,CAAC;oBACX,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;gBACzB,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/redact.d.ts

@@ -0,0 +1,41 @@
+/**
+ * The CLI's one output-side secret filter. Every change a plan prints, every
+ * `--json` report of plan / preflight / golive and every API error passes through
+ * here, so a resource added later cannot leak by forgetting to mask a field.
+ *
+ *  - {@link isSecretKey}: a field name that holds a secret. Names that only mention
+ *    the word (`token_endpoint`, `password_policy`, `secret_key_prefix`) are not.
+ *  - {@link redactDeep}: masks secret-named strings at any depth, and scrubs the rest.
+ *  - {@link scrubText}: removes known values, Atlas-key-shaped values and
+ *    `name=value` pairs from free text.
+ *  - {@link rememberResolved}: records what a `${VAR}` placeholder resolved to, so a
+ *    secret under an unexpected key still cannot print. {@link scrubbingIO} applies
+ *    those values to everything the command writes.
+ *
+ * The state is per `run()`; {@link resetRedaction} clears it.
+ */
+import type { IO } from './io';
+export declare const REDACTED = "<redacted>";
+/** True for a field name whose string value is a secret. */
+export declare function isSecretKey(key: string): boolean;
+/** An unresolved `${VAR}` is a name, not a value: it stays visible (apply refuses it). */
+export declare const isPlaceholder: (v: unknown) => boolean;
+/** The secret formats Atlas mints: `atlas_<env>_<kind>_…`, and the legacy `sk_<env>_`, `psk_`, `dsk_`, `whsec_`. */
+export declare const SECRET_VALUE_SOURCE = "\\b(?:atlas_(?:live|test)_(?:sk|psk|dsk|whsec|pl|at)_[A-Za-z0-9]+|(?:sk_(?:live|test)|psk|dsk|whsec)_[A-Za-z0-9_\\-+/=]+)";
+/** Forget the remembered values and leave `--show-secrets` off. */
+export declare function resetRedaction(): void;
+/** `--show-secrets`: the caller has checked it is allowed here. */
+export declare function setRevealSecrets(on: boolean): void;
+export declare const revealingSecrets: () => boolean;
+/** Remember what a `${VAR}` under `key` resolved to. Public values (a client id, a plain URL) stay printable. */
+export declare function rememberResolved(key: string | undefined, value: string): void;
+/** Remove known values, key-shaped values and secret `name=value` pairs from free text. */
+export declare function scrubText(text: string): string;
+/** A copy with every secret-named string masked and every other string scrubbed. */
+export declare function redactDeep<T>(value: T, key?: string): T;
+/**
+ * The sinks every command writes through, without any value `${VAR}` resolved to.
+ * Only remembered values: a secret a command prints on purpose (`--print-secret`)
+ * was never remembered, so it still prints.
+ */
+export declare function scrubbingIO(io: IO): IO;

package/dist/redact.js

@@ -0,0 +1,115 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.revealingSecrets = exports.SECRET_VALUE_SOURCE = exports.isPlaceholder = exports.REDACTED = void 0;
+exports.isSecretKey = isSecretKey;
+exports.resetRedaction = resetRedaction;
+exports.setRevealSecrets = setRevealSecrets;
+exports.rememberResolved = rememberResolved;
+exports.scrubText = scrubText;
+exports.redactDeep = redactDeep;
+exports.scrubbingIO = scrubbingIO;
+exports.REDACTED = '<redacted>';
+const SECRET_WORD = /secret|token|password|passwd|api_?key|private_?key|signing_?key|encryption_?key|access_?key|credential|authorization/;
+/** The name describes the secret rather than holding it. */
+const DESCRIBES_IT = /_(endpoint|url|uri|method|policy|prefix|format|ttl|seconds|lifetimes?|params|set|file|files|at|type|name|id|ref|hint|hasher|alg|algorithm|enabled|required|source|length|mode|count|version)$/;
+/** True for a field name whose string value is a secret. */
+function isSecretKey(key) {
+    const snake = key.replace(/([a-z0-9])([A-Z])/g, '$1_$2').toLowerCase();
+    // `has_secret`, `is_token`: a flag about the secret, never the secret.
+    return SECRET_WORD.test(snake) && !DESCRIBES_IT.test(snake) && !/^(has|is)_/.test(snake);
+}
+const PLACEHOLDER = /^\$\{[A-Z0-9_]+\}$/;
+/** An unresolved `${VAR}` is a name, not a value: it stays visible (apply refuses it). */
+const isPlaceholder = (v) => typeof v === 'string' && PLACEHOLDER.test(v);
+exports.isPlaceholder = isPlaceholder;
+/** The secret formats Atlas mints: `atlas_<env>_<kind>_…`, and the legacy `sk_<env>_`, `psk_`, `dsk_`, `whsec_`. */
+exports.SECRET_VALUE_SOURCE = '\\b(?:atlas_(?:live|test)_(?:sk|psk|dsk|whsec|pl|at)_[A-Za-z0-9]+|(?:sk_(?:live|test)|psk|dsk|whsec)_[A-Za-z0-9_\\-+/=]+)';
+const SECRET_VALUE = new RegExp(exports.SECRET_VALUE_SOURCE, 'g');
+const KEY_VALUE = /(["']?)([A-Za-z][\w-]*)\1(\s*[:=]\s*)("(?:[^"\\]|\\.)*"|'[^']*'|[^\s,&;}"']+)/g;
+const BEARER = /\bBearer\s+[A-Za-z0-9._~+/=-]{8,}/g;
+const known = new Set();
+let reveal = false;
+/** Forget the remembered values and leave `--show-secrets` off. */
+function resetRedaction() {
+    known.clear();
+    reveal = false;
+}
+/** `--show-secrets`: the caller has checked it is allowed here. */
+function setRevealSecrets(on) {
+    reveal = on;
+}
+const revealingSecrets = () => reveal;
+exports.revealingSecrets = revealingSecrets;
+/** Below this a value is too short to scrub without mangling ordinary words; a secret-named key is masked anyway. */
+const MIN_SCRUB_LENGTH = 6;
+const PUBLIC_KEY = /(^|_)client_id$|^provider$|^from_address$/i;
+function isPlainUrl(v) {
+    try {
+        const u = new URL(v);
+        return (u.protocol === 'https:' || u.protocol === 'http:') && !u.username && !u.password && !u.search;
+    }
+    catch {
+        return false;
+    }
+}
+/** Remember what a `${VAR}` under `key` resolved to. Public values (a client id, a plain URL) stay printable. */
+function rememberResolved(key, value) {
+    if (value.length < MIN_SCRUB_LENGTH)
+        return;
+    if (!(key && isSecretKey(key)) && ((key && PUBLIC_KEY.test(key)) || isPlainUrl(value)))
+        return;
+    known.add(value);
+    known.add(JSON.stringify(value).slice(1, -1));
+}
+function scrubKnown(text) {
+    if (reveal || known.size === 0)
+        return text;
+    let out = text;
+    for (const v of [...known].sort((a, b) => b.length - a.length))
+        out = out.split(v).join(exports.REDACTED);
+    return out;
+}
+/** Remove known values, key-shaped values and secret `name=value` pairs from free text. */
+function scrubText(text) {
+    if (reveal)
+        return text;
+    return scrubKnown(text)
+        .replace(SECRET_VALUE, exports.REDACTED)
+        .replace(BEARER, `Bearer ${exports.REDACTED}`)
+        .replace(KEY_VALUE, (match, _q, name, sep, value) => {
+        // `<value>` in a help line is a placeholder too.
+        if (!isSecretKey(name) || (0, exports.isPlaceholder)(value) || /^<[\w-]+>$/.test(value))
+            return match;
+        const quoted = value.startsWith('"') || value.startsWith("'");
+        // `client_secret: missing` is prose; `client_secret: 8f3a91c2…` and `token=abc` are not.
+        if (!quoted && sep.includes(':') && value.length < 8)
+            return match;
+        const q = quoted ? value[0] : '';
+        return `${match.slice(0, match.length - value.length)}${q}${exports.REDACTED}${q}`;
+    });
+}
+/** A copy with every secret-named string masked and every other string scrubbed. */
+function redactDeep(value, key) {
+    if (reveal)
+        return value;
+    if (typeof value === 'string') {
+        if (key && isSecretKey(key) && value !== '' && !(0, exports.isPlaceholder)(value))
+            return exports.REDACTED;
+        return scrubText(value);
+    }
+    if (Array.isArray(value))
+        return value.map((v) => redactDeep(v, key));
+    if (value !== null && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, redactDeep(v, k)]));
+    }
+    return value;
+}
+/**
+ * The sinks every command writes through, without any value `${VAR}` resolved to.
+ * Only remembered values: a secret a command prints on purpose (`--print-secret`)
+ * was never remembered, so it still prints.
+ */
+function scrubbingIO(io) {
+    return { out: (t) => io.out(scrubKnown(t)), err: (t) => io.err(scrubKnown(t)) };
+}
+//# sourceMappingURL=redact.js.map

package/dist/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":";;;AAyBA,kCAIC;AAiBD,wCAGC;AAGD,4CAEC;AAiBD,4CAKC;AAUD,8BAcC;AAGD,gCAWC;AAOD,kCAEC;AAzGY,QAAA,QAAQ,GAAG,YAAY,CAAC;AAErC,MAAM,WAAW,GAAG,sHAAsH,CAAC;AAC3I,4DAA4D;AAC5D,MAAM,YAAY,GAAG,+LAA+L,CAAC;AAErN,4DAA4D;AAC5D,SAAgB,WAAW,CAAC,GAAW;IACrC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;IACvE,uEAAuE;IACvE,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,WAAW,GAAG,oBAAoB,CAAC;AACzC,0FAA0F;AACnF,MAAM,aAAa,GAAG,CAAC,CAAU,EAAW,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAAtF,QAAA,aAAa,iBAAyE;AAEnG,oHAAoH;AACvG,QAAA,mBAAmB,GAC9B,2HAA2H,CAAC;AAC9H,MAAM,YAAY,GAAG,IAAI,MAAM,CAAC,2BAAmB,EAAE,GAAG,CAAC,CAAC;AAC1D,MAAM,SAAS,GAAG,gFAAgF,CAAC;AACnG,MAAM,MAAM,GAAG,oCAAoC,CAAC;AAEpD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;AAChC,IAAI,MAAM,GAAG,KAAK,CAAC;AAEnB,mEAAmE;AACnE,SAAgB,cAAc;IAC5B,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,MAAM,GAAG,KAAK,CAAC;AACjB,CAAC;AAED,mEAAmE;AACnE,SAAgB,gBAAgB,CAAC,EAAW;IAC1C,MAAM,GAAG,EAAE,CAAC;AACd,CAAC;AACM,MAAM,gBAAgB,GAAG,GAAY,EAAE,CAAC,MAAM,CAAC;AAAzC,QAAA,gBAAgB,oBAAyB;AAEtD,qHAAqH;AACrH,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAC3B,MAAM,UAAU,GAAG,4CAA4C,CAAC;AAEhE,SAAS,UAAU,CAAC,CAAS;IAC3B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IACxG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,iHAAiH;AACjH,SAAgB,gBAAgB,CAAC,GAAuB,EAAE,KAAa;IACrE,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB;QAAE,OAAO;IAC5C,IAAI,CAAC,CAAC,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO;IAC/F,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjB,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAQ,CAAC,CAAC;IAClG,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2FAA2F;AAC3F,SAAgB,SAAS,CAAC,IAAY;IACpC,IAAI,MAAM;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,UAAU,CAAC,IAAI,CAAC;SACpB,OAAO,CAAC,YAAY,EAAE,gBAAQ,CAAC;SAC/B,OAAO,CAAC,MAAM,EAAE,UAAU,gBAAQ,EAAE,CAAC;SACrC,OAAO,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,EAAU,EAAE,IAAY,EAAE,GAAW,EAAE,KAAa,EAAE,EAAE;QAClF,iDAAiD;QACjD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,IAAA,qBAAa,EAAC,KAAK,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACzF,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC9D,yFAAyF;QACzF,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACnE,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,gBAAQ,GAAG,CAAC,EAAE,CAAC;IAC7E,CAAC,CAAC,CAAC;AACP,CAAC;AAED,oFAAoF;AACpF,SAAgB,UAAU,CAAI,KAAQ,EAAE,GAAY;IAClD,IAAI,MAAM;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,EAAE,IAAI,CAAC,IAAA,qBAAa,EAAC,KAAK,CAAC;YAAE,OAAO,gBAAa,CAAC;QAC3F,OAAO,SAAS,CAAC,KAAK,CAAM,CAAC;IAC/B,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAM,CAAC;IAC3E,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAM,CAAC;IAC/F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAgB,WAAW,CAAC,EAAM;IAChC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAClF,CAAC"}