@atlasauth/cli 0.7.0 → 0.9.0

package/dist/commands/move-origin.js

@@ -0,0 +1,95 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.moveOrigin = moveOrigin;
+const args_1 = require("../args");
+const errors_1 = require("../errors");
+const output_1 = require("../output");
+const project_1 = require("../project");
+const shared_1 = require("./shared");
+const COLUMNS = [
+    { header: 'OBJECT', get: (c) => `${c.object} ${c.id}` },
+    { header: 'FIELD', get: (c) => c.field },
+    { header: 'BEFORE', get: (c) => c.before },
+    { header: 'AFTER', get: (c) => c.after },
+];
+/**
+ * `atlas move-origin --from <origin> --to <origin> [--dry-run] [--yes]`: move an
+ * app to a new domain in one step. The server rewrites every origin-bearing
+ * field (allowed origins, OAuth client redirect/logout URIs, webhook URLs,
+ * redirect allowlist, branding links, Sign in with Atlas apps). The CLI always
+ * shows the diff first, asks before writing (skip with --yes), and after a real
+ * move sends a signed test delivery to each webhook endpoint that moved.
+ */
+async function moveOrigin(ctx, args) {
+    const v = args.values;
+    const from = (0, args_1.str)(v, 'from');
+    const to = (0, args_1.str)(v, 'to');
+    if (!from || !to)
+        throw new errors_1.CliError('move-origin needs --from <origin> and --to <origin>, e.g. --from https://old.example --to https://new.example.');
+    const json = (0, shared_1.wantsJson)(v);
+    const auth = (0, shared_1.resolveAuth)(ctx, v);
+    const http = (0, project_1.httpFor)(ctx, { secretKey: auth.secretKey, apiUrl: auth.apiUrl });
+    const path = '/v1/instance/move_origin';
+    const plan = await http.post(path, { from, to, dry_run: true });
+    if (!json) {
+        if (plan.changes.length === 0)
+            ctx.io.out(`Nothing on ${plan.from} to move: no field of this instance uses that origin.`);
+        else {
+            ctx.io.out(`${plan.from} → ${plan.to}: ${plan.changes.length} field(s) would change.`);
+            ctx.io.out((0, output_1.renderTable)(COLUMNS, plan.changes));
+        }
+        for (const p of plan.problems)
+            ctx.io.out(`problem: ${p.object} ${p.id} ${p.field}: ${p.message} (${p.url})`);
+    }
+    if (v['dry-run'] === true) {
+        if (json)
+            (0, output_1.printJson)(ctx.io, plan);
+        else
+            ctx.io.out('Dry run: nothing was written.');
+        return plan.problems.length > 0 ? 1 : 0;
+    }
+    if (plan.problems.length > 0) {
+        if (json)
+            (0, output_1.printJson)(ctx.io, plan);
+        throw new errors_1.CliError(`${plan.problems.length} rewritten value(s) would be refused (see above); fix them and run again. Nothing was written.`);
+    }
+    if (plan.changes.length === 0) {
+        if (json)
+            (0, output_1.printJson)(ctx.io, plan);
+        return 0;
+    }
+    if (v.yes !== true) {
+        if (json)
+            throw new errors_1.CliError('Pass --yes to apply a move with --json (the confirmation prompt is interactive).');
+        const answer = (await ctx.prompt.text('Apply these changes? [y/N]', { default: 'n' })).trim().toLowerCase();
+        if (answer !== 'y' && answer !== 'yes') {
+            ctx.io.out('Cancelled: nothing was written.');
+            return 1;
+        }
+    }
+    const done = await http.post(path, { from, to });
+    const hooks = [...new Set(done.changes.filter((c) => c.object === 'webhook_endpoint').map((c) => c.id))];
+    const tests = [];
+    for (const id of hooks) {
+        try {
+            const res = await http.post(`/v1/webhook_endpoints/${encodeURIComponent(id)}/test?wait=10s`, {});
+            const status = res.http_status ?? null;
+            tests.push({ endpoint: id, ok: status !== null && status >= 200 && status < 300, http_status: status, error: res.error ?? null });
+        }
+        catch (err) {
+            tests.push({ endpoint: id, ok: false, http_status: null, error: err instanceof Error ? err.message : String(err) });
+        }
+    }
+    if (json) {
+        (0, output_1.printJson)(ctx.io, { ...done, webhook_tests: tests });
+    }
+    else {
+        ctx.io.out(`Moved ${done.changes.length} field(s) from ${done.from} to ${done.to}.`);
+        for (const t of tests) {
+            ctx.io.out(`webhook ${t.endpoint}: ${t.ok ? `test delivery answered ${t.http_status}` : `test delivery did not get a 2xx${t.http_status ? ` (${t.http_status})` : ''}${t.error ? `: ${t.error}` : ''}`}`);
+        }
+        ctx.io.out("Next: update your app's own config (env vars, DNS, deploy) to the new origin, then run 'atlas preflight'.");
+    }
+    return tests.some((t) => !t.ok) ? 1 : 0;
+}
+//# sourceMappingURL=move-origin.js.map

package/dist/commands/move-origin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"move-origin.js","sourceRoot":"","sources":["../../src/commands/move-origin.ts"],"names":[],"mappings":";;AAiDA,gCAsEC;AAtHD,kCAA8B;AAE9B,sCAAqC;AACrC,sCAAgE;AAChE,wCAAqC;AACrC,qCAAkD;AA4BlD,MAAM,OAAO,GAA2B;IACtC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE;IACvD,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE;IACxC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE;IAC1C,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE;CACzC,CAAC;AAEF;;;;;;;GAOG;AACI,KAAK,UAAU,UAAU,CAAC,GAAe,EAAE,IAAgB;IAChE,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IACtB,MAAM,IAAI,GAAG,IAAA,UAAG,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC5B,MAAM,EAAE,GAAG,IAAA,UAAG,EAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACxB,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,iBAAQ,CAAC,gHAAgH,CAAC,CAAC;IACvJ,MAAM,IAAI,GAAG,IAAA,kBAAS,EAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,IAAA,oBAAW,EAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,IAAA,iBAAO,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,0BAA0B,CAAC;IAExC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAa,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5E,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,IAAI,uDAAuD,CAAC,CAAC;aACrH,CAAC;YACJ,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,yBAAyB,CAAC,CAAC;YACvF,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAA,oBAAW,EAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ;YAAE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;IAChH,CAAC;IAED,IAAI,CAAC,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;QAC1B,IAAI,IAAI;YAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;;YAC7B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,IAAI,IAAI;YAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAClC,MAAM,IAAI,iBAAQ,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,gGAAgG,CAAC,CAAC;IAC9I,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,IAAI,IAAI;YAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAClC,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACnB,IAAI,IAAI;YAAE,MAAM,IAAI,iBAAQ,CAAC,kFAAkF,CAAC,CAAC;QACjH,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC5G,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACvC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;YAC9C,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAa,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzG,MAAM,KAAK,GAA+F,EAAE,CAAC;IAC7G,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CACzB,yBAAyB,kBAAkB,CAAC,EAAE,CAAC,gBAAgB,EAC/D,EAAE,CACH,CAAC;YACF,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC;YACvC,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,KAAK,IAAI,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC;QACpI,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtH,CAAC;IACH,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACT,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,MAAM,kBAAkB,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QACrF,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5M,CAAC;QACD,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,2GAA2G,CAAC,CAAC;IAC1H,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1C,CAAC"}

package/dist/commands/operator.d.ts

@@ -0,0 +1,26 @@
+import { type ParsedArgs } from '../args';
+import type { RunContext } from '../context';
+/**
+ * `atlas login --device` — sign in as an OPERATOR through Atlas's own sign-in
+ * (passkey, MFA) with the OAuth device flow, instead of pasting a key. Only
+ * short-lived tokens are stored: the operator token (to swap later with
+ * `atlas token`) and, with `--resource`, a one-hour token bound to that
+ * instance or app, used as the profile credential. No long-lived key is written.
+ */
+export declare function deviceLogin(ctx: RunContext, args: ParsedArgs): Promise<number>;
+/**
+ * `atlas token --resource <ins_…|app_…|acct_…> --scope "<scopes>"` — swap the
+ * stored operator token for a one-hour Atlas token bound to that resource.
+ * Prints the token (or JSON with --json); `--profile` stores it as that
+ * profile's credential instead.
+ */
+export declare function token(ctx: RunContext, args: ParsedArgs): Promise<number>;
+/**
+ * `atlas keys whoami|list|create|rotate|revoke|revoke-leaked`.
+ *
+ * create / rotate ask for the new secret SEALED to a key pair generated here
+ * (X-Secret-Recipient), open it locally and write it to a 0600 file
+ * (`--out`, default `.atlas/secret-key-<id>.env`), so the plaintext never
+ * crosses a log or terminal. `--print-secret` prints it instead.
+ */
+export declare function keys(ctx: RunContext, args: ParsedArgs): Promise<number>;

package/dist/commands/operator.js

@@ -0,0 +1,198 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deviceLogin = deviceLogin;
+exports.token = token;
+exports.keys = keys;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const backend_1 = require("@atlasauth/backend");
+const args_1 = require("../args");
+const errors_1 = require("../errors");
+const output_1 = require("../output");
+const shared_1 = require("./shared");
+/**
+ * `atlas login --device` — sign in as an OPERATOR through Atlas's own sign-in
+ * (passkey, MFA) with the OAuth device flow, instead of pasting a key. Only
+ * short-lived tokens are stored: the operator token (to swap later with
+ * `atlas token`) and, with `--resource`, a one-hour token bound to that
+ * instance or app, used as the profile credential. No long-lived key is written.
+ */
+async function deviceLogin(ctx, args) {
+    const { values } = args;
+    const profile = (0, args_1.str)(values, 'profile') || 'default';
+    const apiUrl = (0, args_1.str)(values, 'url') || (0, shared_1.envApiUrl)(ctx.env) || backend_1.DEFAULT_API_URL;
+    const opts = { apiUrl, fetch: ctx.fetch };
+    let start;
+    try {
+        start = await (0, backend_1.startOperatorLogin)(opts);
+    }
+    catch (err) {
+        throw new errors_1.CliError(err instanceof Error ? err.message : String(err));
+    }
+    ctx.io.out(`Open ${start.verification_uri_complete}`);
+    ctx.io.out(`and confirm the code ${start.user_code} (it expires in ${Math.round(start.expires_in / 60)} minutes).`);
+    let token;
+    try {
+        token = await (0, backend_1.pollOperatorLogin)(start, { fetch: ctx.fetch, sleep: ctx.sleep });
+    }
+    catch (err) {
+        if (err instanceof backend_1.OAuthFlowError)
+            throw new errors_1.CliError(`Sign-in did not complete: ${err.message}`);
+        throw err;
+    }
+    const now = Date.now();
+    const file = ctx.config.load();
+    const entry = file.profiles[profile] ?? { api_url: apiUrl, secret_key: '' };
+    entry.api_url = apiUrl;
+    entry.operator = { access_token: token.access_token, expires_at: now + token.expires_in * 1000, issuer: start.config.issuer };
+    const resource = (0, args_1.str)(values, 'resource');
+    if (resource) {
+        const scope = (0, args_1.str)(values, 'scope') || 'read';
+        const bound = await exchangeOrExplain(token.access_token, resource, scope, opts);
+        entry.secret_key = bound.access_token;
+        entry.expires_at = now + bound.expires_in * 1000;
+        entry.resource = resource;
+        entry.scope = bound.scope;
+    }
+    file.profiles[profile] = entry;
+    file.active_profile = profile;
+    ctx.config.save(file);
+    ctx.io.out(`Signed in to ${start.config.issuer} as an operator (profile '${profile}').`);
+    if (resource)
+        ctx.io.out(`Profile credential: a one-hour token for ${resource} (${entry.scope}).`);
+    else
+        ctx.io.out("Run 'atlas token --resource <ins_… | app_…> --scope <scopes>' for a token bound to one instance or app.");
+    return 0;
+}
+async function exchangeOrExplain(subject, resource, scope, opts) {
+    try {
+        return await (0, backend_1.exchangeOperatorToken)(subject, { resource, scope }, opts);
+    }
+    catch (err) {
+        if (err instanceof backend_1.OAuthFlowError)
+            throw new errors_1.CliError(`Token exchange refused (${err.error}): ${err.message}`);
+        throw err;
+    }
+}
+/**
+ * `atlas token --resource <ins_…|app_…|acct_…> --scope "<scopes>"` — swap the
+ * stored operator token for a one-hour Atlas token bound to that resource.
+ * Prints the token (or JSON with --json); `--profile` stores it as that
+ * profile's credential instead.
+ */
+async function token(ctx, args) {
+    const { values } = args;
+    const file = ctx.config.load();
+    const profileName = (0, args_1.str)(values, 'profile') || file.active_profile || 'default';
+    const profile = file.profiles[profileName];
+    if (!profile?.operator || profile.operator.expires_at <= Date.now()) {
+        throw new errors_1.CliError("No current operator sign-in. Run 'atlas login --device' first.");
+    }
+    const resource = (0, args_1.str)(values, 'resource');
+    if (!resource)
+        throw new errors_1.CliError('--resource is required (an ins_…, app_… or acct_… id).');
+    const scope = (0, args_1.str)(values, 'scope') || 'read';
+    const bound = await exchangeOrExplain(profile.operator.access_token, resource, scope, { apiUrl: profile.api_url, fetch: ctx.fetch });
+    if ((0, shared_1.wantsJson)(values)) {
+        (0, output_1.printJson)(ctx.io, bound);
+        return 0;
+    }
+    ctx.io.out(bound.access_token);
+    return 0;
+}
+/** Write a secret to a 0600 file (directories 0700). */
+function writeSecret(path, name, secret) {
+    (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(path), { recursive: true, mode: 0o700 });
+    (0, node_fs_1.writeFileSync)(path, `${name}=${secret}\n`, { mode: 0o600 });
+    (0, node_fs_1.chmodSync)(path, 0o600);
+}
+/**
+ * `atlas keys whoami|list|create|rotate|revoke|revoke-leaked`.
+ *
+ * create / rotate ask for the new secret SEALED to a key pair generated here
+ * (X-Secret-Recipient), open it locally and write it to a 0600 file
+ * (`--out`, default `.atlas/secret-key-<id>.env`), so the plaintext never
+ * crosses a log or terminal. `--print-secret` prints it instead.
+ */
+async function keys(ctx, args) {
+    const { values, positionals } = args;
+    const sub = positionals[1];
+    if (sub === 'revoke-leaked') {
+        const secret = positionals[2] ?? (await ctx.prompt.secret('Leaked secret'));
+        if (!secret)
+            throw new errors_1.CliError('Pass the leaked secret (or enter it at the prompt).');
+        const apiUrl = (0, args_1.str)(values, 'url') || (0, shared_1.envApiUrl)(ctx.env) || backend_1.DEFAULT_API_URL;
+        const res = await (0, backend_1.revokeLeakedKeys)([secret], { apiUrl, fetch: ctx.fetch });
+        ctx.io.out(`Result: ${res.results[0]?.outcome ?? 'unknown'}`);
+        return 0;
+    }
+    const auth = (0, shared_1.resolveAuth)(ctx, values);
+    const pair = (0, backend_1.generateSealKeyPair)();
+    const atlas = (0, backend_1.createAtlasClient)({ secretKey: auth.secretKey, apiUrl: auth.apiUrl, fetch: ctx.fetch, secretRecipient: pair.secretRecipient });
+    const emit = (data, line) => ((0, shared_1.wantsJson)(values) ? (0, output_1.printJson)(ctx.io, data) : line());
+    const deliver = (id, sealed, plain) => {
+        const secret = sealed ? (0, backend_1.openSealedSecret)(sealed, pair) : plain;
+        if (!secret)
+            throw new errors_1.CliError('The response carried no secret.');
+        if (values['print-secret'] === true)
+            return ctx.io.out(secret);
+        const path = (0, args_1.str)(values, 'out') || `.atlas/secret-key-${id}.env`;
+        writeSecret(path, 'ATLAS_SECRET_KEY', secret);
+        ctx.io.out(`Secret written to ${path} (mode 0600).`);
+    };
+    switch (sub) {
+        case 'whoami': {
+            const me = await atlas.whoami();
+            emit(me, () => {
+                ctx.io.out(`Key:      ${me.key.id} (${me.key.type}, ${me.key.prefix ?? ''}…)`);
+                ctx.io.out(`Scopes:   ${me.key.scopes.join(' ')}`);
+                ctx.io.out(`Instance: ${me.instance?.id ?? '-'}  Account: ${me.account.id ?? '-'}`);
+                if (me.key.expires_at)
+                    ctx.io.out(`Expires:  ${new Date(me.key.expires_at).toISOString()}`);
+            });
+            return 0;
+        }
+        case 'list': {
+            const page = await atlas.keys.list();
+            emit(page, () => {
+                for (const k of page.data) {
+                    ctx.io.out(`${k.id}  ${k.kind.padEnd(14)} ${k.prefix.padEnd(20)} ${k.status.padEnd(9)} owner=${k.owner ?? '-'} last_used=${k.last_used_at ? new Date(k.last_used_at).toISOString() : 'never'}`);
+                }
+            });
+            return 0;
+        }
+        case 'create': {
+            const scopes = ((0, args_1.str)(values, 'scopes') || '').split(/[ ,]+/).filter(Boolean);
+            if (scopes.length === 0)
+                throw new errors_1.CliError('--scopes is required, e.g. --scopes "instance:read webhooks:read" or --scopes read_only.');
+            const created = await atlas.secretKeys.create({
+                scopes,
+                name: (0, args_1.str)(values, 'name') || undefined,
+                owner: (0, args_1.str)(values, 'owner') || undefined,
+                expires_at: (0, args_1.str)(values, 'expires-at') || undefined,
+                allowed_ips: (0, args_1.str)(values, 'allowed-ips') ? ((0, args_1.str)(values, 'allowed-ips') ?? '').split(',').map((s) => s.trim()) : undefined,
+            });
+            ctx.io.out(`Created ${created.id} (${created.prefix}…) with ${created.scopes.join(' ')}.`);
+            deliver(created.id, created.sealed_secret, created.secret);
+            return 0;
+        }
+        case 'rotate': {
+            const id = (0, shared_1.requireArg)(positionals, 2, 'key id');
+            const overlap = (0, args_1.str)(values, 'overlap');
+            const rotated = await atlas.secretKeys.rotate(id, overlap ? { overlap_seconds: Number(overlap) } : {});
+            ctx.io.out(`Rotated ${id} → ${rotated.id}.` +
+                (rotated.previous_key_expires_at ? ` The old key works until ${new Date(rotated.previous_key_expires_at).toISOString()}.` : ' The old key was revoked.'));
+            deliver(rotated.id, rotated.sealed_secret, rotated.secret);
+            return 0;
+        }
+        case 'revoke': {
+            const id = (0, shared_1.requireArg)(positionals, 2, 'key id');
+            await atlas.secretKeys.revoke(id);
+            ctx.io.out(`Revoked ${id}.`);
+            return 0;
+        }
+        default:
+            throw new errors_1.CliError('Usage: atlas keys whoami|list|create|rotate <id>|revoke <id>|revoke-leaked [secret]');
+    }
+}
+//# sourceMappingURL=operator.js.map

package/dist/commands/operator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operator.js","sourceRoot":"","sources":["../../src/commands/operator.ts"],"names":[],"mappings":";;AA0BA,kCAyCC;AAiBD,sBAkBC;AAiBD,oBA6EC;AApMD,qCAA8D;AAC9D,yCAAoC;AACpC,gDAU4B;AAC5B,kCAA+C;AAE/C,sCAAqC;AACrC,sCAAsC;AACtC,qCAAyE;AAEzE;;;;;;GAMG;AACI,KAAK,UAAU,WAAW,CAAC,GAAe,EAAE,IAAgB;IACjE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,MAAM,OAAO,GAAG,IAAA,UAAG,EAAC,MAAM,EAAE,SAAS,CAAC,IAAI,SAAS,CAAC;IACpD,MAAM,MAAM,GAAG,IAAA,UAAG,EAAC,MAAM,EAAE,KAAK,CAAC,IAAI,IAAA,kBAAS,EAAC,GAAG,CAAC,GAAG,CAAC,IAAI,yBAAe,CAAC;IAC3E,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;IAC1C,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,IAAA,4BAAkB,EAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,iBAAQ,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,CAAC,yBAAyB,EAAE,CAAC,CAAC;IACtD,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,wBAAwB,KAAK,CAAC,SAAS,mBAAmB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC;IACpH,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,IAAA,2BAAiB,EAAC,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IACjF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,wBAAc;YAAE,MAAM,IAAI,iBAAQ,CAAC,6BAA6B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAClG,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAC5E,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC;IACvB,KAAK,CAAC,QAAQ,GAAG,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,UAAU,EAAE,GAAG,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;IAC9H,MAAM,QAAQ,GAAG,IAAA,UAAG,EAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACzC,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,IAAA,UAAG,EAAC,MAAM,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC;QAC7C,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QACjF,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,YAAY,CAAC;QACtC,KAAK,CAAC,UAAU,GAAG,GAAG,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;QACjD,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC1B,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC5B,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;IAC/B,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC;IAC9B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,MAAM,CAAC,MAAM,6BAA6B,OAAO,KAAK,CAAC,CAAC;IACzF,IAAI,QAAQ;QAAE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,4CAA4C,QAAQ,KAAK,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;;QAC9F,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,yGAAyG,CAAC,CAAC;IAC3H,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,OAAe,EAAE,QAAgB,EAAE,KAAa,EAAE,IAA8C;IAC/H,IAAI,CAAC;QACH,OAAO,MAAM,IAAA,+BAAqB,EAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,wBAAc;YAAE,MAAM,IAAI,iBAAQ,CAAC,2BAA2B,GAAG,CAAC,KAAK,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/G,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,KAAK,CAAC,GAAe,EAAE,IAAgB;IAC3D,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,IAAA,UAAG,EAAC,MAAM,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,cAAc,IAAI,SAAS,CAAC;IAC/E,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO,EAAE,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACpE,MAAM,IAAI,iBAAQ,CAAC,gEAAgE,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,QAAQ,GAAG,IAAA,UAAG,EAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACzC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,iBAAQ,CAAC,wDAAwD,CAAC,CAAC;IAC5F,MAAM,KAAK,GAAG,IAAA,UAAG,EAAC,MAAM,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC;IAC7C,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IACrI,IAAI,IAAA,kBAAS,EAAC,MAAM,CAAC,EAAE,CAAC;QACtB,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACzB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC/B,OAAO,CAAC,CAAC;AACX,CAAC;AAED,wDAAwD;AACxD,SAAS,WAAW,CAAC,IAAY,EAAE,IAAY,EAAE,MAAc;IAC7D,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,IAAA,uBAAa,EAAC,IAAI,EAAE,GAAG,IAAI,IAAI,MAAM,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5D,IAAA,mBAAS,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,IAAI,CAAC,GAAe,EAAE,IAAgB;IAC1D,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IACrC,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,GAAG,KAAK,eAAe,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;QAC5E,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,iBAAQ,CAAC,qDAAqD,CAAC,CAAC;QACvF,MAAM,MAAM,GAAG,IAAA,UAAG,EAAC,MAAM,EAAE,KAAK,CAAC,IAAI,IAAA,kBAAS,EAAC,GAAG,CAAC,GAAG,CAAC,IAAI,yBAAe,CAAC;QAC3E,MAAM,GAAG,GAAG,MAAM,IAAA,0BAAgB,EAAC,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QAC3E,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,SAAS,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,IAAI,GAAG,IAAA,oBAAW,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,IAAA,6BAAmB,GAAE,CAAC;IACnC,MAAM,KAAK,GAAG,IAAA,2BAAiB,EAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;IAC7I,MAAM,IAAI,GAAG,CAAC,IAAa,EAAE,IAAgB,EAAE,EAAE,CAAC,CAAC,IAAA,kBAAS,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACzG,MAAM,OAAO,GAAG,CAAC,EAAU,EAAE,MAA0B,EAAE,KAAyB,EAAE,EAAE;QACpF,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,IAAA,0BAAgB,EAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC/D,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,iBAAQ,CAAC,iCAAiC,CAAC,CAAC;QACnE,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,IAAA,UAAG,EAAC,MAAM,EAAE,KAAK,CAAC,IAAI,qBAAqB,EAAE,MAAM,CAAC;QACjE,WAAW,CAAC,IAAI,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC;QAC9C,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,qBAAqB,IAAI,eAAe,CAAC,CAAC;IACvD,CAAC,CAAC;IACF,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;YAChC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE;gBACZ,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,IAAI,CAAC,CAAC;gBAC/E,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACnD,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,EAAE,IAAI,GAAG,cAAc,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;gBACpF,IAAI,EAAE,CAAC,GAAG,CAAC,UAAU;oBAAE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC9F,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACrC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE;gBACd,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;oBAC1B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI,GAAG,cAAc,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;gBAClM,CAAC;YACH,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,MAAM,GAAG,CAAC,IAAA,UAAG,EAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC5E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,iBAAQ,CAAC,0FAA0F,CAAC,CAAC;YACxI,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;gBAC5C,MAAM;gBACN,IAAI,EAAE,IAAA,UAAG,EAAC,MAAM,EAAE,MAAM,CAAC,IAAI,SAAS;gBACtC,KAAK,EAAE,IAAA,UAAG,EAAC,MAAM,EAAE,OAAO,CAAC,IAAI,SAAS;gBACxC,UAAU,EAAE,IAAA,UAAG,EAAC,MAAM,EAAE,YAAY,CAAC,IAAI,SAAS;gBAClD,WAAW,EAAE,IAAA,UAAG,EAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,IAAA,UAAG,EAAC,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;aACzH,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,OAAO,CAAC,EAAE,KAAK,OAAO,CAAC,MAAM,WAAW,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3F,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAC3D,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,EAAE,GAAG,IAAA,mBAAU,EAAC,WAAW,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;YAChD,MAAM,OAAO,GAAG,IAAA,UAAG,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACvC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACvG,GAAG,CAAC,EAAE,CAAC,GAAG,CACR,WAAW,EAAE,MAAM,OAAO,CAAC,EAAE,GAAG;gBAC9B,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC,4BAA4B,IAAI,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAC3J,CAAC;YACF,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAC3D,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,EAAE,GAAG,IAAA,mBAAU,EAAC,WAAW,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;YAChD,MAAM,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAClC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YAC7B,OAAO,CAAC,CAAC;QACX,CAAC;QACD;YACE,MAAM,IAAI,iBAAQ,CAAC,qFAAqF,CAAC,CAAC;IAC9G,CAAC;AACH,CAAC"}

package/dist/commands/project-commands.d.ts

@@ -20,7 +20,19 @@ export declare function instanceCredential(ctx: RunContext, args: ParsedArgs): {
 };
 /** `atlas preflight` — run the instance's setup checks; exit 1 on errors (or warnings with --fail-on warning). */
 export declare function preflight(ctx: RunContext, args: ParsedArgs): Promise<number>;
+/** `atlas doctor` — the integration-health report; exit 1 when a check fails. */
+export declare function doctor(ctx: RunContext, args: ParsedArgs): Promise<number>;
 /** Public values, then each secret as a reference to its file — never the value. */
 export declare function envCommand(ctx: RunContext, args: ParsedArgs): Promise<number>;
+/**
+ * Kubernetes output: a ConfigMap with the public values, `kubectl create secret`
+ * commands that read each secret straight from its 0600 file (so a value never
+ * passes through this output), and the container `envFrom` / `secretKeyRef`
+ * snippet that wires both in.
+ */
+export declare function k8sManifest(product: string, environment: string, pub: Record<string, string>, secrets: Array<{
+    key: string;
+    file: string;
+}>): string;
 /** `atlas client rotate <id> [--now | --overlap <seconds>]` — the new secret goes straight to its file. */
 export declare function client(ctx: RunContext, args: ParsedArgs): Promise<number>;

package/dist/commands/project-commands.js

@@ -2,7 +2,9 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.instanceCredential = instanceCredential;
 exports.preflight = preflight;
+exports.doctor = doctor;
 exports.envCommand = envCommand;
+exports.k8sManifest = k8sManifest;
 exports.client = client;
 const backend_1 = require("@atlasauth/backend");
 const args_1 = require("../args");
@@ -33,7 +35,7 @@ function instanceCredential(ctx, args) {
         }
         return {
             secretKey: (0, project_1.instanceSecretFromFile)(found.instance),
-            apiUrl: ctx.env.ATLAS_API_URL?.trim() || found.manifest.api_url,
+            apiUrl: (0, shared_1.envApiUrl)(ctx.env) || found.manifest.api_url,
             manifest: found.manifest,
             instance: found.instance,
         };
@@ -42,7 +44,7 @@ function instanceCredential(ctx, args) {
         const { manifest, instance } = projectInstance(ctx, args, product);
         return {
             secretKey: (0, project_1.instanceSecretFromFile)(instance),
-            apiUrl: ctx.env.ATLAS_API_URL?.trim() || manifest.api_url,
+            apiUrl: (0, shared_1.envApiUrl)(ctx.env) || manifest.api_url,
             manifest,
             instance,
         };
@@ -108,43 +110,104 @@ async function preflight(ctx, args) {
     }
     return 0;
 }
+const HEALTH_COLUMNS = [
+    { header: 'STATE', get: (c) => (c.ok === true ? 'ok' : c.ok === false ? 'FAIL' : '-') },
+    { header: 'CHECK', get: (c) => c.id },
+    { header: 'HOP', get: (c) => c.hop ?? '' },
+    { header: 'DETAIL', get: (c) => c.detail },
+];
+/** `atlas doctor` — the integration-health report; exit 1 when a check fails. */
+async function doctor(ctx, args) {
+    const cred = instanceCredential(ctx, args);
+    const q = new URLSearchParams();
+    const only = (0, args_1.str)(args.values, 'only');
+    if (only)
+        q.set('only', only);
+    if (args.values['no-probe'] === true)
+        q.set('probe', 'false');
+    const qs = q.toString();
+    const report = await (0, project_1.httpFor)(ctx, cred).get(`/v1/integration-health${qs ? `?${qs}` : ''}`);
+    if ((0, shared_1.wantsJson)(args.values)) {
+        (0, output_1.printJson)(ctx.io, report);
+    }
+    else {
+        const rows = [...report.checks].sort((a, b) => (a.ok === false ? 0 : a.ok === null ? 2 : 1) - (b.ok === false ? 0 : b.ok === null ? 2 : 1));
+        ctx.io.out((0, output_1.renderTable)(HEALTH_COLUMNS, rows));
+        const failing = rows.filter((c) => c.ok === false && c.fix);
+        if (failing.length) {
+            ctx.io.out('');
+            for (const c of failing)
+                ctx.io.out(`${c.id}: ${c.fix}`);
+        }
+        ctx.io.out('');
+        ctx.io.out(`${report.summary.failing} failing, ${report.summary.passing} passing, ${report.summary.unknown} not known or not configured.`);
+    }
+    if (!report.ok) {
+        ctx.io.err(`atlas: ${report.summary.failing} integration check(s) failing.`);
+        return 1;
+    }
+    return 0;
+}
 // ---- atlas env ----------------------------------------------------------------
-const FORMATS = ['dotenv', 'coolify', 'vercel'];
+const FORMATS = ['dotenv', 'coolify', 'vercel', 'k8s'];
 /** Public values, then each secret as a reference to its file — never the value. */
 async function envCommand(ctx, args) {
     const format = ((0, args_1.str)(args.values, 'format') ?? 'dotenv');
     if (!FORMATS.includes(format))
         throw new errors_1.CliError(`--format must be one of: ${FORMATS.join(', ')} (got '${format}').`);
     const product = (0, args_1.str)(args.values, 'product');
-    if (!product)
-        throw new errors_1.CliError('atlas env needs --product <name> (the name you passed to atlas init).');
-    const { manifest, instance } = projectInstance(ctx, args, product);
-    const pub = {
-        ATLAS_PUBLISHABLE_KEY: instance.publishable_key,
-        ATLAS_API_URL: manifest.api_url,
-    };
-    if (instance.frontend_api_host)
-        pub.ATLAS_FRONTEND_API = `https://${instance.frontend_api_host}`;
-    if (instance.issuer)
-        pub.ATLAS_ISSUER = instance.issuer;
-    if (instance.discovery_url)
-        pub.ATLAS_DISCOVERY_URL = instance.discovery_url;
-    if (instance.jwks_uri)
-        pub.ATLAS_JWKS_URI = instance.jwks_uri;
-    if (instance.oauth_client)
-        pub.ATLAS_CLIENT_ID = instance.oauth_client.client_id;
-    const secrets = [{ key: 'ATLAS_SECRET_KEY', file: instance.secret_file }];
-    if (instance.oauth_client?.secret_file)
-        secrets.push({ key: 'ATLAS_CLIENT_SECRET', file: instance.oauth_client.secret_file });
-    if (instance.webhook?.secret_file)
-        secrets.push({ key: 'ATLAS_WEBHOOK_SECRET', file: instance.webhook.secret_file });
+    const pub = {};
+    const secrets = [];
+    let environment;
+    let label;
+    if (product) {
+        const { manifest, instance } = projectInstance(ctx, args, product);
+        environment = instance.environment;
+        label = product;
+        pub.ATLAS_PUBLISHABLE_KEY = instance.publishable_key;
+        pub.ATLAS_API_BASE = manifest.api_url;
+        pub.ATLAS_API_URL = manifest.api_url;
+        if (instance.frontend_api_host)
+            pub.ATLAS_FRONTEND_API = `https://${instance.frontend_api_host}`;
+        if (instance.issuer)
+            pub.ATLAS_ISSUER = instance.issuer;
+        if (instance.discovery_url)
+            pub.ATLAS_DISCOVERY_URL = instance.discovery_url;
+        if (instance.jwks_uri)
+            pub.ATLAS_JWKS_URI = instance.jwks_uri;
+        if (instance.oauth_client)
+            pub.ATLAS_CLIENT_ID = instance.oauth_client.client_id;
+        secrets.push({ key: 'ATLAS_SECRET_KEY', file: instance.secret_file });
+        if (instance.oauth_client?.secret_file)
+            secrets.push({ key: 'ATLAS_CLIENT_SECRET', file: instance.oauth_client.secret_file });
+        if (instance.webhook?.secret_file)
+            secrets.push({ key: 'ATLAS_WEBHOOK_SECRET', file: instance.webhook.secret_file });
+    }
+    else {
+        // No project manifest: read the public values straight from the instance the credential belongs to.
+        const cred = instanceCredential(ctx, args);
+        const live = await (0, project_1.httpFor)(ctx, cred).get('/v1/instance');
+        environment = live.environment;
+        label = live.id;
+        pub.ATLAS_PUBLISHABLE_KEY = live.publishable_key;
+        pub.ATLAS_API_BASE = cred.apiUrl;
+        pub.ATLAS_API_URL = cred.apiUrl;
+        if (live.frontend_api_host)
+            pub.ATLAS_FRONTEND_API = `https://${live.frontend_api_host}`;
+        if (live.issuer)
+            pub.ATLAS_ISSUER = live.issuer;
+        if (live.discovery_url)
+            pub.ATLAS_DISCOVERY_URL = live.discovery_url;
+        if (live.jwks_uri)
+            pub.ATLAS_JWKS_URI = live.jwks_uri;
+    }
     if ((0, shared_1.wantsJson)(args.values)) {
-        (0, output_1.printJson)(ctx.io, { product, environment: instance.environment, public: pub, secret_files: Object.fromEntries(secrets.map((s) => [s.key, s.file])) });
+        (0, output_1.printJson)(ctx.io, { product: product ?? null, environment, public: pub, secret_files: Object.fromEntries(secrets.map((s) => [s.key, s.file])) });
         return 0;
     }
     const out = (l) => ctx.io.out(l);
     if (format === 'dotenv') {
-        out(`# ${product} (${instance.environment}): public values`);
+        out(`# ${label} (${environment}): public values`);
         for (const [k, v] of Object.entries(pub))
             out(`${k}=${v}`);
         out('# Secrets are not printed. Each *_FILE variable names the 0600 file that holds it.');
@@ -152,16 +215,19 @@ async function envCommand(ctx, args) {
             out(`${s.key}_FILE=${s.file}`);
     }
     else if (format === 'coolify') {
-        out(`# ${product} (${instance.environment}): paste into Coolify → Environment Variables (Developer view).`);
+        out(`# ${label} (${environment}): paste into Coolify → Environment Variables (Developer view).`);
         for (const [k, v] of Object.entries(pub))
             out(`${k}=${v}`);
         out('# Secrets: copy each value from its file (mark them as secret in Coolify):');
         for (const s of secrets)
             out(`${s.key}=@${s.file}`);
     }
+    else if (format === 'k8s') {
+        out(k8sManifest(label, environment, pub, secrets));
+    }
     else {
-        out(`# ${product} (${instance.environment}): Vercel CLI commands. Secrets are piped from their files, never echoed.`);
-        const target = instance.environment === 'production' ? 'production' : 'preview';
+        out(`# ${label} (${environment}): Vercel CLI commands. Secrets are piped from their files, never echoed.`);
+        const target = environment === 'production' ? 'production' : 'preview';
         for (const [k, v] of Object.entries(pub))
             out(`printf '%s' '${v.replace(/'/g, "'\\''")}' | vercel env add ${k} ${target}`);
         for (const s of secrets)
@@ -169,6 +235,40 @@ async function envCommand(ctx, args) {
     }
     return 0;
 }
+/** DNS-1123 name fragment for a Kubernetes resource. */
+function k8sName(raw) {
+    return raw.toLowerCase().replace(/[^a-z0-9-]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 40) || 'atlas';
+}
+/** YAML double-quoted scalar (JSON strings are valid YAML). */
+const yamlStr = (v) => JSON.stringify(v);
+/**
+ * Kubernetes output: a ConfigMap with the public values, `kubectl create secret`
+ * commands that read each secret straight from its 0600 file (so a value never
+ * passes through this output), and the container `envFrom` / `secretKeyRef`
+ * snippet that wires both in.
+ */
+function k8sManifest(product, environment, pub, secrets) {
+    const base = `${k8sName(product)}-atlas`;
+    const lines = [
+        `# ${product} (${environment}): Kubernetes. Public values go in a ConfigMap; secrets are created from their 0600 files.`,
+        'apiVersion: v1',
+        'kind: ConfigMap',
+        'metadata:',
+        `  name: ${base}`,
+        'data:',
+        ...Object.entries(pub).map(([k, v]) => `  ${k}: ${yamlStr(v)}`),
+        '---',
+        '# Create each secret from its file (nothing is printed or stored in this manifest):',
+    ];
+    for (const s of secrets) {
+        lines.push(`#   kubectl create secret generic ${base}-${k8sName(s.key)} --from-env-file='${s.file.replace(/'/g, "'\\''")}'`);
+    }
+    lines.push('---', '# Container spec fragment:', '#   envFrom:', `#     - configMapRef: { name: ${base} }`, '#   env:');
+    for (const s of secrets) {
+        lines.push(`#     - name: ${s.key}`, `#       valueFrom: { secretKeyRef: { name: ${base}-${k8sName(s.key)}, key: ${s.key} } }`);
+    }
+    return lines.join('\n');
+}
 // ---- atlas client rotate ----------------------------------------------------------
 /** `atlas client rotate <id> [--now | --overlap <seconds>]` — the new secret goes straight to its file. */
 async function client(ctx, args) {