@atlasauth/cli 0.8.0 → 0.10.0

package/dist/commands/operator.js

@@ -0,0 +1,210 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deviceLogin = deviceLogin;
+exports.token = token;
+exports.keys = keys;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const backend_1 = require("@atlasauth/backend");
+const args_1 = require("../args");
+const errors_1 = require("../errors");
+const output_1 = require("../output");
+const shared_1 = require("./shared");
+/**
+ * `atlas login --device` — sign in as an OPERATOR through Atlas's own sign-in
+ * (passkey, MFA) with the OAuth device flow, instead of pasting a key. Only
+ * short-lived tokens are stored: the operator token (to swap later with
+ * `atlas token`) and, with `--resource`, a one-hour token bound to that
+ * instance or app, used as the profile credential. No long-lived key is written.
+ */
+async function deviceLogin(ctx, args) {
+    const { values } = args;
+    const profile = (0, args_1.str)(values, 'profile') || 'default';
+    const apiUrl = (0, args_1.str)(values, 'url') || (0, shared_1.envApiUrl)(ctx.env) || backend_1.DEFAULT_API_URL;
+    const opts = { apiUrl, fetch: ctx.fetch };
+    // --audience <id>: an operator token FOR another product that trusts Atlas's
+    // operator issuer (one of /v1/operator `audiences`). It is printed, not
+    // stored: Atlas's own token exchange refuses it.
+    const audience = (0, args_1.str)(values, 'audience');
+    let start;
+    try {
+        start = await (0, backend_1.startOperatorLogin)({ ...opts, ...(audience ? { audience } : {}) });
+    }
+    catch (err) {
+        throw new errors_1.CliError(err instanceof Error ? err.message : String(err));
+    }
+    ctx.io.out(`Open ${start.verification_uri_complete}`);
+    ctx.io.out(`and confirm the code ${start.user_code} (it expires in ${Math.round(start.expires_in / 60)} minutes).`);
+    let token;
+    try {
+        token = await (0, backend_1.pollOperatorLogin)(start, { fetch: ctx.fetch, sleep: ctx.sleep });
+    }
+    catch (err) {
+        if (err instanceof backend_1.OAuthFlowError)
+            throw new errors_1.CliError(`Sign-in did not complete: ${err.message}`);
+        throw err;
+    }
+    if (audience) {
+        if ((0, shared_1.wantsJson)(values))
+            (0, output_1.printJson)(ctx.io, { ...token, audience, issuer: start.config.issuer });
+        else
+            ctx.io.out(token.access_token);
+        ctx.io.err(`An operator token for ${audience} (expires in ${Math.round(token.expires_in / 60)} minutes). Hand it to that product; it is not stored.`);
+        return 0;
+    }
+    const now = Date.now();
+    const file = ctx.config.load();
+    const entry = file.profiles[profile] ?? { api_url: apiUrl, secret_key: '' };
+    entry.api_url = apiUrl;
+    entry.operator = { access_token: token.access_token, expires_at: now + token.expires_in * 1000, issuer: start.config.issuer };
+    const resource = (0, args_1.str)(values, 'resource');
+    if (resource) {
+        const scope = (0, args_1.str)(values, 'scope') || 'read';
+        const bound = await exchangeOrExplain(token.access_token, resource, scope, opts);
+        entry.secret_key = bound.access_token;
+        entry.expires_at = now + bound.expires_in * 1000;
+        entry.resource = resource;
+        entry.scope = bound.scope;
+    }
+    file.profiles[profile] = entry;
+    file.active_profile = profile;
+    ctx.config.save(file);
+    ctx.io.out(`Signed in to ${start.config.issuer} as an operator (profile '${profile}').`);
+    if (resource)
+        ctx.io.out(`Profile credential: a one-hour token for ${resource} (${entry.scope}).`);
+    else
+        ctx.io.out("Run 'atlas token --resource <ins_… | app_…> --scope <scopes>' for a token bound to one instance or app.");
+    return 0;
+}
+async function exchangeOrExplain(subject, resource, scope, opts) {
+    try {
+        return await (0, backend_1.exchangeOperatorToken)(subject, { resource, scope }, opts);
+    }
+    catch (err) {
+        if (err instanceof backend_1.OAuthFlowError)
+            throw new errors_1.CliError(`Token exchange refused (${err.error}): ${err.message}`);
+        throw err;
+    }
+}
+/**
+ * `atlas token --resource <ins_…|app_…|acct_…> --scope "<scopes>"` — swap the
+ * stored operator token for a one-hour Atlas token bound to that resource.
+ * Prints the token (or JSON with --json); `--profile` stores it as that
+ * profile's credential instead.
+ */
+async function token(ctx, args) {
+    const { values } = args;
+    const file = ctx.config.load();
+    const profileName = (0, args_1.str)(values, 'profile') || file.active_profile || 'default';
+    const profile = file.profiles[profileName];
+    if (!profile?.operator || profile.operator.expires_at <= Date.now()) {
+        throw new errors_1.CliError("No current operator sign-in. Run 'atlas login --device' first.");
+    }
+    const resource = (0, args_1.str)(values, 'resource');
+    if (!resource)
+        throw new errors_1.CliError('--resource is required (an ins_…, app_… or acct_… id).');
+    const scope = (0, args_1.str)(values, 'scope') || 'read';
+    const bound = await exchangeOrExplain(profile.operator.access_token, resource, scope, { apiUrl: profile.api_url, fetch: ctx.fetch });
+    if ((0, shared_1.wantsJson)(values)) {
+        (0, output_1.printJson)(ctx.io, bound);
+        return 0;
+    }
+    ctx.io.out(bound.access_token);
+    return 0;
+}
+/** Write a secret to a 0600 file (directories 0700). */
+function writeSecret(path, name, secret) {
+    (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(path), { recursive: true, mode: 0o700 });
+    (0, node_fs_1.writeFileSync)(path, `${name}=${secret}\n`, { mode: 0o600 });
+    (0, node_fs_1.chmodSync)(path, 0o600);
+}
+/**
+ * `atlas keys whoami|list|create|rotate|revoke|revoke-leaked`.
+ *
+ * create / rotate ask for the new secret SEALED to a key pair generated here
+ * (X-Secret-Recipient), open it locally and write it to a 0600 file
+ * (`--out`, default `.atlas/secret-key-<id>.env`), so the plaintext never
+ * crosses a log or terminal. `--print-secret` prints it instead.
+ */
+async function keys(ctx, args) {
+    const { values, positionals } = args;
+    const sub = positionals[1];
+    if (sub === 'revoke-leaked') {
+        const secret = positionals[2] ?? (await ctx.prompt.secret('Leaked secret'));
+        if (!secret)
+            throw new errors_1.CliError('Pass the leaked secret (or enter it at the prompt).');
+        const apiUrl = (0, args_1.str)(values, 'url') || (0, shared_1.envApiUrl)(ctx.env) || backend_1.DEFAULT_API_URL;
+        const res = await (0, backend_1.revokeLeakedKeys)([secret], { apiUrl, fetch: ctx.fetch });
+        ctx.io.out(`Result: ${res.results[0]?.outcome ?? 'unknown'}`);
+        return 0;
+    }
+    const auth = (0, shared_1.resolveAuth)(ctx, values);
+    const pair = (0, backend_1.generateSealKeyPair)();
+    const atlas = (0, backend_1.createAtlasClient)({ secretKey: auth.secretKey, apiUrl: auth.apiUrl, fetch: ctx.fetch, secretRecipient: pair.secretRecipient });
+    const emit = (data, line) => ((0, shared_1.wantsJson)(values) ? (0, output_1.printJson)(ctx.io, data) : line());
+    const deliver = (id, sealed, plain) => {
+        const secret = sealed ? (0, backend_1.openSealedSecret)(sealed, pair) : plain;
+        if (!secret)
+            throw new errors_1.CliError('The response carried no secret.');
+        if (values['print-secret'] === true)
+            return ctx.io.out(secret);
+        const path = (0, args_1.str)(values, 'out') || `.atlas/secret-key-${id}.env`;
+        writeSecret(path, 'ATLAS_SECRET_KEY', secret);
+        ctx.io.out(`Secret written to ${path} (mode 0600).`);
+    };
+    switch (sub) {
+        case 'whoami': {
+            const me = await atlas.whoami();
+            emit(me, () => {
+                ctx.io.out(`Key:      ${me.key.id} (${me.key.type}, ${me.key.prefix ?? ''}…)`);
+                ctx.io.out(`Scopes:   ${me.key.scopes.join(' ')}`);
+                ctx.io.out(`Instance: ${me.instance?.id ?? '-'}  Account: ${me.account.id ?? '-'}`);
+                if (me.key.expires_at)
+                    ctx.io.out(`Expires:  ${new Date(me.key.expires_at).toISOString()}`);
+            });
+            return 0;
+        }
+        case 'list': {
+            const page = await atlas.keys.list();
+            emit(page, () => {
+                for (const k of page.data) {
+                    ctx.io.out(`${k.id}  ${k.kind.padEnd(14)} ${k.prefix.padEnd(20)} ${k.status.padEnd(9)} owner=${k.owner ?? '-'} last_used=${k.last_used_at ? new Date(k.last_used_at).toISOString() : 'never'}`);
+                }
+            });
+            return 0;
+        }
+        case 'create': {
+            const scopes = ((0, args_1.str)(values, 'scopes') || '').split(/[ ,]+/).filter(Boolean);
+            if (scopes.length === 0)
+                throw new errors_1.CliError('--scopes is required, e.g. --scopes "instance:read webhooks:read" or --scopes read_only.');
+            const created = await atlas.secretKeys.create({
+                scopes,
+                name: (0, args_1.str)(values, 'name') || undefined,
+                owner: (0, args_1.str)(values, 'owner') || undefined,
+                expires_at: (0, args_1.str)(values, 'expires-at') || undefined,
+                allowed_ips: (0, args_1.str)(values, 'allowed-ips') ? ((0, args_1.str)(values, 'allowed-ips') ?? '').split(',').map((s) => s.trim()) : undefined,
+            });
+            ctx.io.out(`Created ${created.id} (${created.prefix}…) with ${created.scopes.join(' ')}.`);
+            deliver(created.id, created.sealed_secret, created.secret);
+            return 0;
+        }
+        case 'rotate': {
+            const id = (0, shared_1.requireArg)(positionals, 2, 'key id');
+            const overlap = (0, args_1.str)(values, 'overlap');
+            const rotated = await atlas.secretKeys.rotate(id, overlap ? { overlap_seconds: Number(overlap) } : {});
+            ctx.io.out(`Rotated ${id} → ${rotated.id}.` +
+                (rotated.previous_key_expires_at ? ` The old key works until ${new Date(rotated.previous_key_expires_at).toISOString()}.` : ' The old key was revoked.'));
+            deliver(rotated.id, rotated.sealed_secret, rotated.secret);
+            return 0;
+        }
+        case 'revoke': {
+            const id = (0, shared_1.requireArg)(positionals, 2, 'key id');
+            await atlas.secretKeys.revoke(id);
+            ctx.io.out(`Revoked ${id}.`);
+            return 0;
+        }
+        default:
+            throw new errors_1.CliError('Usage: atlas keys whoami|list|create|rotate <id>|revoke <id>|revoke-leaked [secret]');
+    }
+}
+//# sourceMappingURL=operator.js.map

package/dist/commands/operator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operator.js","sourceRoot":"","sources":["../../src/commands/operator.ts"],"names":[],"mappings":";;AA0BA,kCAmDC;AAiBD,sBAkBC;AAiBD,oBA6EC;AA9MD,qCAA8D;AAC9D,yCAAoC;AACpC,gDAU4B;AAC5B,kCAA+C;AAE/C,sCAAqC;AACrC,sCAAsC;AACtC,qCAAyE;AAEzE;;;;;;GAMG;AACI,KAAK,UAAU,WAAW,CAAC,GAAe,EAAE,IAAgB;IACjE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,MAAM,OAAO,GAAG,IAAA,UAAG,EAAC,MAAM,EAAE,SAAS,CAAC,IAAI,SAAS,CAAC;IACpD,MAAM,MAAM,GAAG,IAAA,UAAG,EAAC,MAAM,EAAE,KAAK,CAAC,IAAI,IAAA,kBAAS,EAAC,GAAG,CAAC,GAAG,CAAC,IAAI,yBAAe,CAAC;IAC3E,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;IAC1C,6EAA6E;IAC7E,wEAAwE;IACxE,iDAAiD;IACjD,MAAM,QAAQ,GAAG,IAAA,UAAG,EAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACzC,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,IAAA,4BAAkB,EAAC,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,iBAAQ,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,CAAC,yBAAyB,EAAE,CAAC,CAAC;IACtD,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,wBAAwB,KAAK,CAAC,SAAS,mBAAmB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC;IACpH,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,IAAA,2BAAiB,EAAC,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IACjF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,wBAAc;YAAE,MAAM,IAAI,iBAAQ,CAAC,6BAA6B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAClG,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,IAAA,kBAAS,EAAC,MAAM,CAAC;YAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;;YACzF,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACpC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,yBAAyB,QAAQ,gBAAgB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,GAAG,EAAE,CAAC,uDAAuD,CAAC,CAAC;QACtJ,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAC5E,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC;IACvB,KAAK,CAAC,QAAQ,GAAG,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,UAAU,EAAE,GAAG,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;IAC9H,MAAM,QAAQ,GAAG,IAAA,UAAG,EAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACzC,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,IAAA,UAAG,EAAC,MAAM,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC;QAC7C,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QACjF,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,YAAY,CAAC;QACtC,KAAK,CAAC,UAAU,GAAG,GAAG,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;QACjD,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC1B,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC5B,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;IAC/B,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC;IAC9B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,gBAAgB,KAAK,CAAC,MAAM,CAAC,MAAM,6BAA6B,OAAO,KAAK,CAAC,CAAC;IACzF,IAAI,QAAQ;QAAE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,4CAA4C,QAAQ,KAAK,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;;QAC9F,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,yGAAyG,CAAC,CAAC;IAC3H,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,OAAe,EAAE,QAAgB,EAAE,KAAa,EAAE,IAA8C;IAC/H,IAAI,CAAC;QACH,OAAO,MAAM,IAAA,+BAAqB,EAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,wBAAc;YAAE,MAAM,IAAI,iBAAQ,CAAC,2BAA2B,GAAG,CAAC,KAAK,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/G,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,KAAK,CAAC,GAAe,EAAE,IAAgB;IAC3D,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,IAAA,UAAG,EAAC,MAAM,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,cAAc,IAAI,SAAS,CAAC;IAC/E,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO,EAAE,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACpE,MAAM,IAAI,iBAAQ,CAAC,gEAAgE,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,QAAQ,GAAG,IAAA,UAAG,EAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACzC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,iBAAQ,CAAC,wDAAwD,CAAC,CAAC;IAC5F,MAAM,KAAK,GAAG,IAAA,UAAG,EAAC,MAAM,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC;IAC7C,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IACrI,IAAI,IAAA,kBAAS,EAAC,MAAM,CAAC,EAAE,CAAC;QACtB,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACzB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC/B,OAAO,CAAC,CAAC;AACX,CAAC;AAED,wDAAwD;AACxD,SAAS,WAAW,CAAC,IAAY,EAAE,IAAY,EAAE,MAAc;IAC7D,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,IAAA,uBAAa,EAAC,IAAI,EAAE,GAAG,IAAI,IAAI,MAAM,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5D,IAAA,mBAAS,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,IAAI,CAAC,GAAe,EAAE,IAAgB;IAC1D,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IACrC,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,GAAG,KAAK,eAAe,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;QAC5E,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,iBAAQ,CAAC,qDAAqD,CAAC,CAAC;QACvF,MAAM,MAAM,GAAG,IAAA,UAAG,EAAC,MAAM,EAAE,KAAK,CAAC,IAAI,IAAA,kBAAS,EAAC,GAAG,CAAC,GAAG,CAAC,IAAI,yBAAe,CAAC;QAC3E,MAAM,GAAG,GAAG,MAAM,IAAA,0BAAgB,EAAC,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QAC3E,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,SAAS,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,IAAI,GAAG,IAAA,oBAAW,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,IAAA,6BAAmB,GAAE,CAAC;IACnC,MAAM,KAAK,GAAG,IAAA,2BAAiB,EAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;IAC7I,MAAM,IAAI,GAAG,CAAC,IAAa,EAAE,IAAgB,EAAE,EAAE,CAAC,CAAC,IAAA,kBAAS,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACzG,MAAM,OAAO,GAAG,CAAC,EAAU,EAAE,MAA0B,EAAE,KAAyB,EAAE,EAAE;QACpF,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,IAAA,0BAAgB,EAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC/D,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,iBAAQ,CAAC,iCAAiC,CAAC,CAAC;QACnE,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,IAAA,UAAG,EAAC,MAAM,EAAE,KAAK,CAAC,IAAI,qBAAqB,EAAE,MAAM,CAAC;QACjE,WAAW,CAAC,IAAI,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC;QAC9C,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,qBAAqB,IAAI,eAAe,CAAC,CAAC;IACvD,CAAC,CAAC;IACF,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;YAChC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE;gBACZ,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,IAAI,CAAC,CAAC;gBAC/E,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACnD,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,EAAE,IAAI,GAAG,cAAc,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;gBACpF,IAAI,EAAE,CAAC,GAAG,CAAC,UAAU;oBAAE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC9F,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACrC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE;gBACd,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;oBAC1B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI,GAAG,cAAc,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;gBAClM,CAAC;YACH,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,MAAM,GAAG,CAAC,IAAA,UAAG,EAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC5E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,iBAAQ,CAAC,0FAA0F,CAAC,CAAC;YACxI,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;gBAC5C,MAAM;gBACN,IAAI,EAAE,IAAA,UAAG,EAAC,MAAM,EAAE,MAAM,CAAC,IAAI,SAAS;gBACtC,KAAK,EAAE,IAAA,UAAG,EAAC,MAAM,EAAE,OAAO,CAAC,IAAI,SAAS;gBACxC,UAAU,EAAE,IAAA,UAAG,EAAC,MAAM,EAAE,YAAY,CAAC,IAAI,SAAS;gBAClD,WAAW,EAAE,IAAA,UAAG,EAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,IAAA,UAAG,EAAC,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;aACzH,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,OAAO,CAAC,EAAE,KAAK,OAAO,CAAC,MAAM,WAAW,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3F,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAC3D,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,EAAE,GAAG,IAAA,mBAAU,EAAC,WAAW,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;YAChD,MAAM,OAAO,GAAG,IAAA,UAAG,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACvC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACvG,GAAG,CAAC,EAAE,CAAC,GAAG,CACR,WAAW,EAAE,MAAM,OAAO,CAAC,EAAE,GAAG;gBAC9B,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC,4BAA4B,IAAI,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAC3J,CAAC;YACF,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAC3D,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,EAAE,GAAG,IAAA,mBAAU,EAAC,WAAW,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;YAChD,MAAM,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAClC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YAC7B,OAAO,CAAC,CAAC;QACX,CAAC;QACD;YACE,MAAM,IAAI,iBAAQ,CAAC,qFAAqF,CAAC,CAAC;IAC9G,CAAC;AACH,CAAC"}

package/dist/commands/partner-platforms.d.ts

@@ -0,0 +1,10 @@
+import { type ParsedArgs } from '../args';
+import type { RunContext } from '../context';
+/**
+ * `atlas partner-platforms list | get <partner> | set <partner> | registration <partner>
+ *  | token <partner> | deliveries <partner> | remove <partner>`: this instance as a
+ * partner platform of another product (cookiemunch is a preset). The partner
+ * token is read from a file or stdin (`--token-file <path|->`) or
+ * `ATLAS_PARTNER_TOKEN`, sent once and never printed.
+ */
+export declare function partnerPlatforms(ctx: RunContext, args: ParsedArgs): Promise<number>;

package/dist/commands/partner-platforms.js

@@ -0,0 +1,157 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.partnerPlatforms = partnerPlatforms;
+const args_1 = require("../args");
+const errors_1 = require("../errors");
+const output_1 = require("../output");
+const project_1 = require("../project");
+const shared_1 = require("./shared");
+const COLUMNS = [
+    { header: 'PARTNER', get: (p) => p.partner },
+    { header: 'STATUS', get: (p) => (p.enabled ? 'on' : 'off') },
+    { header: 'TOKEN', get: (p) => (p.token_set ? 'stored' : 'not stored') },
+    { header: 'RECEIVER', get: (p) => p.receiver_url },
+    { header: 'LAST DELIVERY', get: (p) => (p.last_delivery_at ? (0, output_1.fmtTime)(p.last_delivery_at) : '') },
+];
+const DELIVERY_COLUMNS = [
+    { header: 'WHEN', get: (d) => (0, output_1.fmtTime)(d.received_at) },
+    { header: 'EVENT', get: (d) => d.event_type ?? '' },
+    { header: 'OUTCOME', get: (d) => d.outcome },
+    { header: 'USER', get: (d) => d.user_id ?? '' },
+];
+/** The first non-comment line of a file (or stdin), `NAME=value` or a bare value. */
+function readTokenFile(ctx, file) {
+    let text;
+    try {
+        text = ctx.readFile(file === '-' ? '/dev/stdin' : file);
+    }
+    catch {
+        throw new errors_1.CliError(`Could not read the partner token from ${file === '-' ? 'stdin' : file}.`);
+    }
+    const line = text.split(/\r?\n/).map((l) => l.trim()).find((l) => l && !l.startsWith('#')) ?? '';
+    const m = /^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(line);
+    const token = (m ? m[1] : line).trim().replace(/^"(.*)"$/, '$1');
+    if (!token || /\s/.test(token))
+        throw new errors_1.CliError(`No partner token found in ${file === '-' ? 'stdin' : file}.`);
+    return token;
+}
+/**
+ * `atlas partner-platforms list | get <partner> | set <partner> | registration <partner>
+ *  | token <partner> | deliveries <partner> | remove <partner>`: this instance as a
+ * partner platform of another product (cookiemunch is a preset). The partner
+ * token is read from a file or stdin (`--token-file <path|->`) or
+ * `ATLAS_PARTNER_TOKEN`, sent once and never printed.
+ */
+async function partnerPlatforms(ctx, args) {
+    const sub = args.positionals[1];
+    const partner = args.positionals[2];
+    const json = (0, shared_1.wantsJson)(args.values);
+    const http = () => {
+        const auth = (0, shared_1.resolveAuth)(ctx, args.values);
+        return (0, project_1.httpFor)(ctx, { secretKey: auth.secretKey, apiUrl: auth.apiUrl });
+    };
+    const path = (p, rest = '') => `/v1/partner_platforms/${encodeURIComponent(p)}${rest}`;
+    const needPartner = () => {
+        if (!partner)
+            throw new errors_1.CliError(`partner-platforms ${sub} needs a partner id (a preset such as cookiemunch, or your own id).`);
+        return partner;
+    };
+    switch (sub) {
+        case 'list': {
+            const page = await http().get('/v1/partner_platforms');
+            if (json)
+                (0, output_1.printJson)(ctx.io, page);
+            else
+                ctx.io.out((0, output_1.renderTable)(COLUMNS, page.data));
+            return 0;
+        }
+        case 'get': {
+            (0, output_1.printJson)(ctx.io, await http().get(path(needPartner())));
+            return 0;
+        }
+        case 'set': {
+            const target = needPartner();
+            const body = {};
+            const platformId = (0, args_1.str)(args.values, 'platform-id');
+            if (platformId)
+                body.platform_id = platformId;
+            const jwks = (0, args_1.str)(args.values, 'jwks-url');
+            if (jwks)
+                body.jwks_url = jwks;
+            const header = (0, args_1.str)(args.values, 'signature-header');
+            if (header)
+                body.signature_header = header;
+            const sources = (0, args_1.list)(args.values, 'allowed-source');
+            if (sources.length)
+                body.allowed_sources = sources;
+            if (args.values.disable === true)
+                body.enabled = false;
+            const saved = await http().put(path(target), body);
+            if (json)
+                (0, output_1.printJson)(ctx.io, saved);
+            else
+                ctx.io.out(`Saved ${saved.partner}: ${saved.enabled ? 'on' : 'off'}, receiver ${saved.receiver_url}. Next: atlas partner-platforms registration ${saved.partner}`);
+            return 0;
+        }
+        case 'registration': {
+            const details = await http().get(path(needPartner(), '/registration'));
+            if (json) {
+                (0, output_1.printJson)(ctx.io, details);
+                return 0;
+            }
+            ctx.io.out([
+                `Send ${details.send_to ? details.send_to.contact : 'the partner'} these details:`,
+                `  platform id:   ${details.platform_id}`,
+                `  receiver URL:  ${details.receiver_url}${details.receiver_url_is_template ? '  ({externalId} = the Atlas instance id)' : ''}`,
+                `  events:        ${details.events.join(', ')}`,
+                `  signature:     ${details.signature.header}: ${details.signature.format}`,
+                `  key set:       ${details.signature.jwks_url} (tolerance ${details.signature.tolerance_seconds}s)`,
+                ...(details.send_to ? [`  docs:          ${details.send_to.docs}`] : []),
+                `Then store the token it hands back: atlas partner-platforms token ${details.partner} --token-file -`,
+            ].join('\n'));
+            return 0;
+        }
+        case 'token': {
+            const target = needPartner();
+            const file = (0, args_1.str)(args.values, 'token-file');
+            const token = file ? readTokenFile(ctx, file) : ctx.env.ATLAS_PARTNER_TOKEN?.trim();
+            if (!token) {
+                throw new errors_1.CliError('Pass the partner token with --token-file <path|-> (or ATLAS_PARTNER_TOKEN). It is stored encrypted and never shown again.');
+            }
+            const apiBase = (0, args_1.str)(args.values, 'base-url');
+            const saved = await http().post(path(target, '/token'), {
+                token,
+                ...(args.values.rotate === true ? { rotate: true } : {}),
+                ...(apiBase ? { api_base_url: apiBase } : {}),
+            });
+            if (json)
+                (0, output_1.printJson)(ctx.io, saved);
+            else
+                ctx.io.out(`Stored the ${saved.name} partner token (encrypted; it is never shown again).`);
+            return 0;
+        }
+        case 'deliveries': {
+            const lim = (0, args_1.str)(args.values, 'limit');
+            const page = await http().get(path(needPartner(), `/deliveries${lim ? `?limit=${encodeURIComponent(lim)}` : ''}`));
+            if (json)
+                (0, output_1.printJson)(ctx.io, page);
+            else
+                ctx.io.out((0, output_1.renderTable)(DELIVERY_COLUMNS, page.data));
+            return 0;
+        }
+        case 'remove': {
+            const target = needPartner();
+            await http().delete(path(target));
+            if (json)
+                (0, output_1.printJson)(ctx.io, { partner: target, removed: true });
+            else
+                ctx.io.out(`Removed ${target} and its stored partner token.`);
+            return 0;
+        }
+        default:
+            throw new errors_1.CliError(sub
+                ? `Unknown subcommand 'partner-platforms ${sub}'. Try: list, get, set, registration, token, deliveries, remove.`
+                : 'partner-platforms needs a subcommand: list, get, set, registration, token, deliveries, remove.');
+    }
+}
+//# sourceMappingURL=partner-platforms.js.map

package/dist/commands/partner-platforms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"partner-platforms.js","sourceRoot":"","sources":["../../src/commands/partner-platforms.ts"],"names":[],"mappings":";;AA6CA,4CAuGC;AAnJD,kCAAqD;AAErD,sCAAqC;AACrC,sCAAyE;AACzE,wCAAqC;AACrC,qCAAkD;AAElD,MAAM,OAAO,GAA8B;IACzC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE;IAC5C,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE;IAC5D,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE;IACxE,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE;IAClD,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAA,gBAAO,EAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;CACjG,CAAC;AAEF,MAAM,gBAAgB,GAA8B;IAClD,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAO,EAAC,CAAC,CAAC,WAAW,CAAC,EAAE;IACtD,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,EAAE;IACnD,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE;IAC5C,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE;CAChD,CAAC;AAEF,qFAAqF;AACrF,SAAS,aAAa,CAAC,GAAe,EAAE,IAAY;IAClD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAQ,CAAC,yCAAyC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACjG,MAAM,CAAC,GAAG,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAClE,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,iBAAQ,CAAC,6BAA6B,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;IAClH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,gBAAgB,CAAC,GAAe,EAAE,IAAgB;IACtE,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAA,kBAAS,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,GAAG,EAAE;QAChB,MAAM,IAAI,GAAG,IAAA,oBAAW,EAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3C,OAAO,IAAA,iBAAO,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,IAAI,GAAG,EAAE,EAAE,EAAE,CAAC,yBAAyB,kBAAkB,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC;IAC/F,MAAM,WAAW,GAAG,GAAG,EAAE;QACvB,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,iBAAQ,CAAC,qBAAqB,GAAG,qEAAqE,CAAC,CAAC;QAChI,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,IAAI,EAAE,CAAC,GAAG,CAA8B,uBAAuB,CAAC,CAAC;YACpF,IAAI,IAAI;gBAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;;gBAC7B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAA,oBAAW,EAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACjD,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,CAAC,GAAG,CAAkB,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;YAC1E,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAyB,EAAE,CAAC;YACtC,MAAM,UAAU,GAAG,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;YACnD,IAAI,UAAU;gBAAE,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC;YAC9C,MAAM,IAAI,GAAG,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YAC1C,IAAI,IAAI;gBAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YAC/B,MAAM,MAAM,GAAG,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;YACpD,IAAI,MAAM;gBAAE,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC;YAC3C,MAAM,OAAO,GAAG,IAAA,WAAI,EAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;YACpD,IAAI,OAAO,CAAC,MAAM;gBAAE,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC;YACnD,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI;gBAAE,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;YACvD,MAAM,KAAK,GAAG,MAAM,IAAI,EAAE,CAAC,GAAG,CAAkB,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;YACpE,IAAI,IAAI;gBAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;;gBAEjC,GAAG,CAAC,EAAE,CAAC,GAAG,CACR,SAAS,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,cAAc,KAAK,CAAC,YAAY,gDAAgD,KAAK,CAAC,OAAO,EAAE,CACvJ,CAAC;YACJ,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,MAAM,OAAO,GAAG,MAAM,IAAI,EAAE,CAAC,GAAG,CAA8B,IAAI,CAAC,WAAW,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;YACpG,IAAI,IAAI,EAAE,CAAC;gBACT,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;gBAC3B,OAAO,CAAC,CAAC;YACX,CAAC;YACD,GAAG,CAAC,EAAE,CAAC,GAAG,CACR;gBACE,QAAQ,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,iBAAiB;gBAClF,oBAAoB,OAAO,CAAC,WAAW,EAAE;gBACzC,oBAAoB,OAAO,CAAC,YAAY,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC/H,oBAAoB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAC/C,oBAAoB,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE;gBAC3E,oBAAoB,OAAO,CAAC,SAAS,CAAC,QAAQ,eAAe,OAAO,CAAC,SAAS,CAAC,iBAAiB,IAAI;gBACpG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,oBAAoB,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxE,qEAAqE,OAAO,CAAC,OAAO,iBAAiB;aACtG,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YACF,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAC;YACpF,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,iBAAQ,CAAC,2HAA2H,CAAC,CAAC;YAClJ,CAAC;YACD,MAAM,OAAO,GAAG,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,MAAM,IAAI,EAAE,CAAC,IAAI,CAAkB,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE;gBACvE,KAAK;gBACL,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxD,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9C,CAAC,CAAC;YACH,IAAI,IAAI;gBAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;;gBAC9B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,IAAI,sDAAsD,CAAC,CAAC;YAChG,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,GAAG,GAAG,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,MAAM,IAAI,EAAE,CAAC,GAAG,CAA8B,IAAI,CAAC,WAAW,EAAE,EAAE,cAAc,GAAG,CAAC,CAAC,CAAC,UAAU,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAChJ,IAAI,IAAI;gBAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;;gBAC7B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAA,oBAAW,EAAC,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1D,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;YAC7B,MAAM,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YAClC,IAAI,IAAI;gBAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;;gBAC3D,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,MAAM,gCAAgC,CAAC,CAAC;YACnE,OAAO,CAAC,CAAC;QACX,CAAC;QACD;YACE,MAAM,IAAI,iBAAQ,CAChB,GAAG;gBACD,CAAC,CAAC,yCAAyC,GAAG,kEAAkE;gBAChH,CAAC,CAAC,gGAAgG,CACrG,CAAC;IACN,CAAC;AACH,CAAC"}

package/dist/commands/project-commands.d.ts

@@ -20,7 +20,19 @@ export declare function instanceCredential(ctx: RunContext, args: ParsedArgs): {
 };
 /** `atlas preflight` — run the instance's setup checks; exit 1 on errors (or warnings with --fail-on warning). */
 export declare function preflight(ctx: RunContext, args: ParsedArgs): Promise<number>;
+/** `atlas doctor` — the integration-health report; exit 1 when a check fails. */
+export declare function doctor(ctx: RunContext, args: ParsedArgs): Promise<number>;
 /** Public values, then each secret as a reference to its file — never the value. */
 export declare function envCommand(ctx: RunContext, args: ParsedArgs): Promise<number>;
+/**
+ * Kubernetes output: a ConfigMap with the public values, `kubectl create secret`
+ * commands that read each secret straight from its 0600 file (so a value never
+ * passes through this output), and the container `envFrom` / `secretKeyRef`
+ * snippet that wires both in.
+ */
+export declare function k8sManifest(product: string, environment: string, pub: Record<string, string>, secrets: Array<{
+    key: string;
+    file: string;
+}>): string;
 /** `atlas client rotate <id> [--now | --overlap <seconds>]` — the new secret goes straight to its file. */
 export declare function client(ctx: RunContext, args: ParsedArgs): Promise<number>;