mindvest-atlas 0.1.0

package/src/auth/store.js

@@ -0,0 +1,46 @@
+// On-disk state: OAuth credentials, the registered client_id, and the tool
+// catalog cache. Credentials are persisted 0600 inside a 0700 config dir.
+import fs from 'node:fs';
+import path from 'node:path';
+import { configDir, FILES } from '../config.js';
+
+function ensureDir() {
+  const dir = configDir();
+  fs.mkdirSync(dir, { recursive: true });
+  try { fs.chmodSync(dir, 0o700); } catch { /* best effort (e.g. non-POSIX) */ }
+  return dir;
+}
+
+export function filePath(name) {
+  return path.join(configDir(), name);
+}
+
+export function readJson(name) {
+  try {
+    return JSON.parse(fs.readFileSync(filePath(name), 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+// Write JSON and force the mode even if the file already existed.
+export function writeJson(name, data, mode = 0o600) {
+  ensureDir();
+  const p = filePath(name);
+  fs.writeFileSync(p, JSON.stringify(data, null, 2) + '\n', { mode });
+  try { fs.chmodSync(p, mode); } catch { /* best effort */ }
+  return p;
+}
+
+export function removeJson(name) {
+  try { fs.unlinkSync(filePath(name)); return true; } catch { return false; }
+}
+
+// --- credential blob (0600) ---
+export function loadCredentials() { return readJson(FILES.credentials); }
+export function saveCredentials(creds) { return writeJson(FILES.credentials, creds, 0o600); }
+export function clearCredentials() { return removeJson(FILES.credentials); }
+
+// --- non-secret config (client_id, cached discovery) ---
+export function loadConfig() { return readJson(FILES.config) || {}; }
+export function saveConfig(cfg) { return writeJson(FILES.config, cfg, 0o600); }

package/src/cli.js

@@ -0,0 +1,60 @@
+// Argument parsing and command dispatch. Anything that isn't a built-in command
+// is treated as a tool slug and routed to the dynamic tool caller.
+import { parseArgs, withoutCommand } from './util/args.js';
+import { printRootHelp } from './util/help.js';
+import { VERSION } from './config.js';
+import { println, eprintln, color } from './util/ui.js';
+import { AuthError, ApiError } from './api/client.js';
+
+import { loginCommand } from './commands/login.js';
+import { logoutCommand } from './commands/logout.js';
+import { whoamiCommand } from './commands/whoami.js';
+import { toolsCommand } from './commands/tools.js';
+import { alertsCommand } from './commands/alerts.js';
+import { flowCommand } from './commands/flow.js';
+import { callCommand } from './commands/call.js';
+
+export async function main(rawArgs) {
+  const args = parseArgs(rawArgs);
+
+  // Global --base-url override, applied before any command resolves endpoints.
+  if (typeof args.flags['base-url'] === 'string') {
+    process.env.ATLAS_BASE_URL = args.flags['base-url'];
+  }
+
+  const cmd = args._[0];
+
+  // Version / no-arg / root help.
+  if (!cmd && (args.flags.version)) { println(VERSION); return 0; }
+  if (!cmd || cmd === 'help') {
+    // `atlas help <tool>` shows that tool's help.
+    if (cmd === 'help' && args._[1]) {
+      return callCommand(args._[1], { _: [], flags: { help: true } });
+    }
+    printRootHelp();
+    return 0;
+  }
+  if (cmd === 'version') { println(VERSION); return 0; }
+  // `atlas --help` with no command still shows root help (parseArgs put help in flags).
+  if (args.flags.help && !cmd) { printRootHelp(); return 0; }
+
+  try {
+    switch (cmd) {
+      case 'login': return await loginCommand(withoutCommand(args));
+      case 'logout': return await logoutCommand(withoutCommand(args));
+      case 'whoami': return await whoamiCommand(withoutCommand(args));
+      case 'tools': return await toolsCommand(withoutCommand(args));
+      case 'alerts': return await alertsCommand(withoutCommand(args));
+      case 'flow': return await flowCommand(withoutCommand(args));
+      default:
+        // Treat the first positional as a tool slug (e.g. stock-quote).
+        return await callCommand(cmd, withoutCommand(args));
+    }
+  } catch (err) {
+    // Friendly, prefix-free messages for the common API failures; anything
+    // else bubbles to the bin's last-resort handler.
+    if (err instanceof AuthError) { eprintln(color.red(err.message)); return 1; }
+    if (err instanceof ApiError) { eprintln(color.red(`Error: ${err.message}`)); return 1; }
+    throw err;
+  }
+}

package/src/commands/alerts.js

@@ -0,0 +1,60 @@
+// `atlas alerts` — subscribe to the live alert-fire SSE feed, print each fire,
+// and optionally decode the attached chart PNG to a file.
+import fs from 'node:fs';
+import path from 'node:path';
+import { API } from '../config.js';
+import { runStream } from '../util/stream-loop.js';
+import { formatAlert } from '../util/format.js';
+import { color, println, eprintln } from '../util/ui.js';
+
+function sanitizeFilename(name) {
+  return String(name || '').replace(/[^A-Za-z0-9._-]/g, '_') || 'alert.png';
+}
+
+export async function alertsCommand(args) {
+  const flags = args.flags;
+  const qs = new URLSearchParams();
+  if (flags.symbol) qs.set('symbol', String(flags.symbol).toUpperCase());
+  const name = flags.name || flags.type || flags['alert-type'];
+  if (typeof name === 'string' && name) qs.set('name', name);
+  // --no-chart (flags.chart === false) suppresses chart payloads server-side.
+  if (flags.chart === false || flags['no-chart']) qs.set('chart', '0');
+
+  const saveDir = (typeof flags['save-charts'] === 'string' && flags['save-charts'])
+    || (typeof flags.out === 'string' && flags.out);
+  if (saveDir) fs.mkdirSync(saveDir, { recursive: true });
+
+  const json = !!flags.json;
+  const pathname = API.alerts + (qs.toString() ? '?' + qs.toString() : '');
+
+  if (!json) {
+    eprintln(color.dim('Listening for alert fires' + (flags.symbol ? ` on ${String(flags.symbol).toUpperCase()}` : '') + (name ? ` (${name})` : '') + '…'));
+  }
+
+  return runStream(pathname, {
+    label: 'alerts',
+    // `--no-reconnect` parses to flags.reconnect === false (the --no- convention).
+    reconnect: flags.reconnect !== false,
+    onEvent: ({ event, payload }) => {
+      // Decode + save the chart if present and requested.
+      if (saveDir && payload.chart && payload.chart.image_base64) {
+        const file = path.join(saveDir, sanitizeFilename(payload.chart.filename));
+        try {
+          fs.writeFileSync(file, Buffer.from(payload.chart.image_base64, 'base64'));
+          if (!json) eprintln(color.green('  ↳ chart saved: ') + file);
+        } catch (err) {
+          eprintln(color.red('  ↳ could not save chart: ') + err.message);
+        }
+      }
+
+      if (json) {
+        println(JSON.stringify(payload));
+        return;
+      }
+      println(formatAlert(payload, event));
+      if (Array.isArray(payload.bullets)) {
+        for (const b of payload.bullets) println('  ' + color.dim(b));
+      }
+    },
+  });
+}

package/src/commands/call.js

@@ -0,0 +1,160 @@
+// `atlas <tool> [--param value]` — resolve a slug to a server tool, build the
+// JSON body from flags (type-coerced via the schema), POST, and render.
+import fs from 'node:fs';
+import path from 'node:path';
+import { API } from '../config.js';
+import { fetchCatalog, resolveToolName, suggestTools, slugify } from '../api/catalog.js';
+import { requestJson, ApiError, AuthError } from '../api/client.js';
+import { printToolHelp } from '../util/help.js';
+import { color, println, eprintln, prettyJson, redactBase64 } from '../util/ui.js';
+
+const RESERVED = new Set(['help', 'h', 'json', 'out', 'save-charts', 'raw', 'base-url', 'version', 'v']);
+
+function coerce(raw, type) {
+  if (raw === true || raw === false) return raw;
+  const s = String(raw);
+  if (type === 'integer') {
+    const n = parseInt(s, 10);
+    if (Number.isNaN(n)) throw new Error(`expected an integer, got "${s}"`);
+    return n;
+  }
+  if (type === 'number') {
+    const n = Number(s);
+    if (Number.isNaN(n)) throw new Error(`expected a number, got "${s}"`);
+    return n;
+  }
+  if (type === 'boolean') return /^(true|1|yes|y|on)$/i.test(s);
+  // string / unknown: accept inline JSON for array/object params.
+  if (s.startsWith('[') || s.startsWith('{')) {
+    try { return JSON.parse(s); } catch { return s; }
+  }
+  return s;
+}
+
+const norm = (s) => s.replace(/-/g, '_');
+
+function buildBody(tool, flags) {
+  const params = tool.parameters || {};
+  const byNorm = {};
+  for (const p of Object.keys(params)) byNorm[norm(p)] = p;
+
+  const body = {};
+  for (const [key, val] of Object.entries(flags)) {
+    if (RESERVED.has(key)) continue;
+    const pname = params[key] ? key : byNorm[norm(key)];
+    if (pname) {
+      body[pname] = coerce(val, (params[pname].type) || 'string');
+    } else {
+      // Unknown to the cached schema — forward it (the server ignores unknown
+      // keys), normalising hyphens so `--from-date` maps to `from_date`.
+      body[norm(key)] = coerce(val, 'string');
+    }
+  }
+  return body;
+}
+
+function requiredMissing(tool, body) {
+  const params = tool.parameters || {};
+  return Object.entries(params)
+    .filter(([p, meta]) => meta.required && (body[p] === undefined || body[p] === ''))
+    .map(([p]) => '--' + p.replace(/_/g, '-'));
+}
+
+// Decode any base64 images in a tool response and write them to `dir`.
+function saveImages(data, dir, toolName) {
+  fs.mkdirSync(dir, { recursive: true });
+  const saved = [];
+  let i = 0;
+  const writeImg = (b64, hint) => {
+    if (typeof b64 !== 'string' || b64.length < 64) return;
+    const file = path.join(dir, `${slugify(toolName)}${i ? '_' + i : ''}.png`);
+    fs.writeFileSync(file, Buffer.from(b64.replace(/^data:image\/\w+;base64,/, ''), 'base64'));
+    saved.push(file);
+    i++;
+  };
+  if (Array.isArray(data.images)) for (const img of data.images) writeImg(img && img.image_base64);
+  if (data.image_base64) writeImg(data.image_base64);
+  return saved;
+}
+
+export async function callCommand(toolSlug, args) {
+  const flags = args.flags;
+
+  let catalog;
+  try {
+    catalog = await fetchCatalog({});
+  } catch (err) {
+    if (err instanceof AuthError) { eprintln(color.red(err.message)); return 1; }
+    eprintln(color.red('Could not load tool catalog: ') + err.message);
+    return 1;
+  }
+
+  const name = resolveToolName(catalog, toolSlug);
+  if (!name) {
+    eprintln(color.red(`Unknown command or tool: ${toolSlug}`));
+    const hints = suggestTools(catalog, toolSlug);
+    if (hints.length) eprintln(color.dim('Did you mean: ') + hints.join(', '));
+    eprintln(color.dim('Run `atlas tools` to list everything.'));
+    return 1;
+  }
+
+  const tool = catalog.tools[name];
+
+  if (flags.help || flags.h) {
+    printToolHelp(name, tool);
+    return 0;
+  }
+
+  // Build the request body (either an explicit --json or flag-derived).
+  let body;
+  if (typeof flags.json === 'string') {
+    try { body = JSON.parse(flags.json); } catch (err) {
+      eprintln(color.red('Invalid --json: ') + err.message);
+      return 1;
+    }
+  } else {
+    try { body = buildBody(tool, flags); } catch (err) {
+      eprintln(color.red('Bad parameter: ') + err.message);
+      return 1;
+    }
+  }
+
+  const missing = requiredMissing(tool, body);
+  if (missing.length) {
+    eprintln(color.red('Missing required parameter(s): ') + missing.join(', '));
+    eprintln(color.dim(`See: atlas ${toolSlug} --help`));
+    return 1;
+  }
+
+  let data;
+  try {
+    data = await requestJson(API.tool(name), { method: 'POST', body });
+  } catch (err) {
+    if (err instanceof AuthError) { eprintln(color.red(err.message)); return 1; }
+    if (err instanceof ApiError) {
+      eprintln(color.red(`Error (${err.status || '?'}): ${err.message}`));
+      if (err.data && err.data.available) eprintln(color.dim('Hint: run `atlas tools` to list valid tools.'));
+      return 1;
+    }
+    eprintln(color.red('Request failed: ') + err.message);
+    return 1;
+  }
+
+  // Save chart images if requested.
+  const outDir = (typeof flags.out === 'string' && flags.out) || (typeof flags['save-charts'] === 'string' && flags['save-charts']);
+  if (outDir) {
+    const saved = saveImages(data, outDir, name);
+    if (saved.length) for (const f of saved) eprintln(color.green('Saved: ') + f);
+    else eprintln(color.dim('No chart image in the response.'));
+  }
+
+  // The tools API returns 200 with an { error } body on bad input.
+  const isError = data && typeof data === 'object' && typeof data.error === 'string';
+
+  if (flags.json || flags.raw || !process.stdout.isTTY) {
+    println(JSON.stringify(data, null, 2));
+  } else {
+    println(prettyJson(redactBase64(data)));
+  }
+  return isError ? 1 : 0;
+}

package/src/commands/flow.js

@@ -0,0 +1,51 @@
+// `atlas flow stream --symbol NVDA` — subscribe to the live options-flow SSE
+// feed and print each trade. (`flow` is a group so we can add subcommands.)
+import { API } from '../config.js';
+import { runStream } from '../util/stream-loop.js';
+import { formatTrade } from '../util/format.js';
+import { color, println, eprintln } from '../util/ui.js';
+
+const PASS_THROUGH = [
+  'option_symbol', 'expiration_date', 'strike', 'side',
+  'from_date', 'to_date', 'limit', 'min_premium', 'min_tag', 'client_id',
+];
+
+export async function flowCommand(args) {
+  // Accept `flow stream --symbol X`, `flow --symbol X`, and `flow stream NVDA`.
+  const rest = args._.slice();
+  if (rest[0] === 'stream') rest.shift();
+  const flags = args.flags;
+
+  const symbol = (typeof flags.symbol === 'string' && flags.symbol) || rest[0];
+  if (!symbol) {
+    eprintln(color.red('`flow stream` requires a symbol, e.g. `atlas flow stream --symbol NVDA`'));
+    return 1;
+  }
+
+  const qs = new URLSearchParams();
+  qs.set('symbol', String(symbol).toUpperCase());
+  for (const key of PASS_THROUGH) {
+    const v = flags[key] ?? flags[key.replace(/_/g, '-')];
+    if (v !== undefined && v !== true) qs.set(key, String(v));
+  }
+
+  const json = !!flags.json;
+  const pathname = API.flowStream + '?' + qs.toString();
+
+  if (!json) eprintln(color.dim(`Streaming options flow for ${String(symbol).toUpperCase()}…`));
+
+  return runStream(pathname, {
+    label: 'flow',
+    // `--no-reconnect` parses to flags.reconnect === false (the --no- convention).
+    reconnect: flags.reconnect !== false,
+    onEvent: ({ payload }) => {
+      const trades = Array.isArray(payload.trades)
+        ? payload.trades
+        : (payload.trade ? [payload.trade] : []);
+      for (const t of trades) {
+        if (json) println(JSON.stringify(t));
+        else println(formatTrade(t));
+      }
+    },
+  });
+}

package/src/commands/login.js

@@ -0,0 +1,110 @@
+// `atlas login` — OAuth authorization-code + PKCE loopback flow, or `--token`
+// to store a bearer directly. Mirrors how the GitHub CLI / Claude Code sign in.
+import { baseUrl, DEFAULT_SCOPE } from '../config.js';
+import { LoopbackServer } from '../auth/loopback.js';
+import { createPkce, randomState } from '../auth/pkce.js';
+import {
+  getEndpoints, ensureClientId, buildAuthorizeUrl, exchangeCode,
+  fetchUserinfo, credentialsFromTokenResponse,
+} from '../auth/oauth.js';
+import { saveCredentials } from '../auth/store.js';
+import { filePath } from '../auth/store.js';
+import { FILES } from '../config.js';
+import { color, println, eprintln, openBrowser } from '../util/ui.js';
+
+async function showAccount(accessToken) {
+  try {
+    const endpoints = await getEndpoints();
+    const info = await fetchUserinfo(endpoints, accessToken);
+    const who = info.email || info.sub || 'unknown account';
+    println(color.green('✓ Signed in as ') + color.bold(who));
+  } catch {
+    println(color.green('✓ Signed in.'));
+  }
+}
+
+export async function loginCommand(args) {
+  const flags = args.flags;
+
+  // --- token mode: store a bearer directly (e.g. a dashboard MCP secret) ---
+  const token = flags.token || flags.t;
+  if (typeof token === 'string' && token.trim()) {
+    saveCredentials({
+      base_url: baseUrl(),
+      access_token: token.trim(),
+      refresh_token: null,
+      token_type: 'Bearer',
+      scope: null,
+      expires_at: null,
+      obtained_at: Date.now(),
+      client_id: null,
+      source: 'manual',
+    });
+    println(color.green('✓ Token saved to ') + color.dim(filePath(FILES.credentials)));
+    await showAccount(token.trim());
+    return 0;
+  }
+  if (token === true) {
+    eprintln(color.red('`--token` needs a value, e.g. `atlas login --token at_...`'));
+    return 1;
+  }
+
+  // --- OAuth browser flow ---
+  const scope = (typeof flags.scope === 'string' && flags.scope) || DEFAULT_SCOPE;
+  const endpoints = await getEndpoints({ refresh: true });
+
+  const loop = new LoopbackServer();
+  const { redirectUri } = await loop.start();
+
+  let clientId;
+  try {
+    clientId = await ensureClientId(endpoints, redirectUri);
+  } catch (err) {
+    loop.close();
+    eprintln(color.red('Could not register an OAuth client: ') + err.message);
+    eprintln(color.dim('If this persists, set ATLAS_CLIENT_ID to a pre-provisioned client.'));
+    return 1;
+  }
+
+  const { verifier, challenge, method } = createPkce();
+  const state = randomState();
+  const authUrl = buildAuthorizeUrl(endpoints, { clientId, redirectUri, scope, state, challenge, method });
+
+  println();
+  println(color.bold('Sign in to Atlas'));
+  println(color.dim('A browser window will open for you to authenticate.'));
+  println();
+  println(color.dim('If it does not open, visit:'));
+  println('  ' + color.cyan(authUrl));
+  println();
+
+  const noBrowser = flags['no-browser'] || process.env.ATLAS_NO_BROWSER;
+  if (!noBrowser) openBrowser(authUrl);
+  eprintln(color.dim('Waiting for you to finish in the browser…'));
+
+  let code;
+  try {
+    ({ code } = await loop.waitForCallback({ expectedState: state, timeoutMs: 300_000 }));
+  } catch (err) {
+    loop.close();
+    eprintln(color.red('Login failed: ') + err.message);
+    return 1;
+  } finally {
+    loop.close();
+  }
+
+  let tok;
+  try {
+    tok = await exchangeCode(endpoints, { code, redirectUri, clientId, verifier });
+  } catch (err) {
+    eprintln(color.red('Token exchange failed: ') + err.message);
+    return 1;
+  }
+
+  const creds = credentialsFromTokenResponse(tok, { clientId, base: baseUrl() });
+  saveCredentials(creds);
+  println();
+  await showAccount(creds.access_token);
+  println(color.dim('Credentials stored 0600 at ') + color.dim(filePath(FILES.credentials)));
+  return 0;
+}

package/src/commands/logout.js

@@ -0,0 +1,22 @@
+// `atlas logout` — best-effort token revocation, then wipe local credentials.
+import { loadCredentials, clearCredentials } from '../auth/store.js';
+import { getEndpoints, revokeToken } from '../auth/oauth.js';
+import { color, println } from '../util/ui.js';
+
+export async function logoutCommand() {
+  const creds = loadCredentials();
+  if (!creds) {
+    println('Not signed in.');
+    return 0;
+  }
+  if (creds.source !== 'manual') {
+    try {
+      const endpoints = await getEndpoints();
+      if (creds.access_token) await revokeToken(endpoints, { token: creds.access_token });
+      if (creds.refresh_token) await revokeToken(endpoints, { token: creds.refresh_token });
+    } catch { /* revocation is best-effort */ }
+  }
+  clearCredentials();
+  println(color.green('✓ Signed out.'));
+  return 0;
+}

package/src/commands/tools.js

@@ -0,0 +1,45 @@
+// `atlas tools` — list available tools from the discovery endpoint.
+import { fetchCatalog, listDisplayTools, slugify } from '../api/catalog.js';
+import { color, println } from '../util/ui.js';
+
+function firstLine(desc) {
+  if (!desc) return '';
+  for (const line of String(desc).split('\n')) {
+    const t = line.trim();
+    if (t) return t;
+  }
+  return '';
+}
+
+export async function toolsCommand(args) {
+  const flags = args.flags;
+  const catalog = await fetchCatalog({ force: !!flags.refresh });
+
+  if (flags.json) {
+    println(JSON.stringify(catalog.tools, null, 2));
+    return 0;
+  }
+
+  const names = listDisplayTools(catalog);
+  const filter = String(
+    (typeof flags.search === 'string' && flags.search) || args._[0] || '',
+  ).toLowerCase();
+
+  const rows = names
+    .map((name) => ({ slug: slugify(name), desc: firstLine(catalog.tools[name].description) }))
+    .filter((r) => !filter || r.slug.includes(filter) || r.desc.toLowerCase().includes(filter));
+
+  println(
+    color.bold('Atlas tools') +
+    color.dim(`  (${names.length} tools, ${catalog.count} endpoints incl. snake_case aliases)`),
+  );
+  println();
+  const width = rows.reduce((w, r) => Math.max(w, r.slug.length), 0) + 2;
+  for (const r of rows) {
+    println('  ' + color.cyan(r.slug.padEnd(width)) + color.dim(r.desc));
+  }
+  if (!rows.length) println(color.dim('  (no tools match "' + filter + '")'));
+  println();
+  println(color.dim('Run ') + color.cyan('atlas <tool> --help') + color.dim(' for parameters.'));
+  return 0;
+}

package/src/commands/whoami.js

@@ -0,0 +1,50 @@
+// `atlas whoami` — show the signed-in account via the OAuth userinfo endpoint.
+import { isLoggedIn } from '../api/client.js';
+import { loadCredentials } from '../auth/store.js';
+import { getEndpoints, fetchUserinfo } from '../auth/oauth.js';
+import { request } from '../api/client.js';
+import { color, println, eprintln } from '../util/ui.js';
+
+export async function whoamiCommand() {
+  if (!isLoggedIn()) {
+    eprintln(color.red('Not signed in. Run `atlas login`.'));
+    return 1;
+  }
+
+  // Resolve a usable access token via the normal request path (handles env
+  // token + refresh) by hitting userinfo. We re-fetch the token implicitly.
+  const endpoints = await getEndpoints();
+  try {
+    // Use the authenticated request helper so env/stored/refresh all work.
+    const res = await request('/oauth/userinfo', { accept: 'application/json' });
+    if (res.status === 200) {
+      const info = await res.json();
+      println(color.bold(info.email || info.sub || 'unknown'));
+      if (info.sub) println(color.dim('  user id: ') + info.sub);
+      if (info.scope) println(color.dim('  scope:   ') + info.scope);
+      const creds = loadCredentials();
+      if (creds && creds.source) println(color.dim('  via:     ') + (process.env.ATLAS_TOKEN ? 'ATLAS_TOKEN env' : creds.source));
+      else if (process.env.ATLAS_TOKEN) println(color.dim('  via:     ') + 'ATLAS_TOKEN env');
+      return 0;
+    }
+    if (res.status === 401) {
+      eprintln(color.red('Token is invalid or expired. Run `atlas login` again.'));
+      return 1;
+    }
+    eprintln(color.red(`Could not fetch account (HTTP ${res.status}).`));
+    return 1;
+  } catch (err) {
+    // Fall back to a direct userinfo call if the helper path failed.
+    const creds = loadCredentials();
+    const tok = (process.env.ATLAS_TOKEN || (creds && creds.access_token) || '').trim();
+    if (tok) {
+      try {
+        const info = await fetchUserinfo(endpoints, tok);
+        println(color.bold(info.email || info.sub || 'unknown'));
+        return 0;
+      } catch { /* ignore */ }
+    }
+    eprintln(color.red('whoami failed: ') + err.message);
+    return 1;
+  }
+}

package/src/config.js

@@ -0,0 +1,52 @@
+// Centralised constants and path/endpoint resolution.
+import path from 'node:path';
+import os from 'node:os';
+
+export const VERSION = '0.1.0';
+export const DEFAULT_BASE_URL = 'https://atlasmcp.finmanagerai.com';
+export const DEFAULT_SCOPE = 'atlas broker';
+export const CLIENT_NAME = 'Atlas CLI';
+export const REDIRECT_PATH = '/callback';
+
+// Effective server base URL (env override wins; trailing slashes trimmed).
+export function baseUrl() {
+  return (process.env.ATLAS_BASE_URL || DEFAULT_BASE_URL).replace(/\/+$/, '');
+}
+
+// Default OAuth endpoints derived from the base URL. These mirror the server's
+// /.well-known/oauth-authorization-server document. At login we fetch that doc
+// and cache any overrides, but these defaults keep the CLI working even if
+// discovery is briefly unavailable.
+export function defaultEndpoints(base = baseUrl()) {
+  return {
+    issuer: base,
+    discovery: `${base}/.well-known/oauth-authorization-server`,
+    authorization_endpoint: `${base}/oauth/authorize`,
+    token_endpoint: `${base}/oauth/token`,
+    registration_endpoint: `${base}/oauth/register`,
+    revocation_endpoint: `${base}/oauth/revoke`,
+    userinfo_endpoint: `${base}/oauth/userinfo`,
+  };
+}
+
+// REST API paths (relative to baseUrl()).
+export const API = {
+  tools: '/api/v1/tools',
+  tool: (name) => `/api/v1/tools/${encodeURIComponent(name)}`,
+  alerts: '/api/v1/alerts',
+  flowStream: '/api/v1/options-flow/stream',
+};
+
+// Config directory: $ATLAS_CONFIG_DIR, else $XDG_CONFIG_HOME/atlas, else
+// ~/.config/atlas. Credentials inside are written 0600 (see auth/store.js).
+export function configDir() {
+  if (process.env.ATLAS_CONFIG_DIR) return process.env.ATLAS_CONFIG_DIR;
+  if (process.env.XDG_CONFIG_HOME) return path.join(process.env.XDG_CONFIG_HOME, 'atlas');
+  return path.join(os.homedir(), '.config', 'atlas');
+}
+
+export const FILES = {
+  credentials: 'credentials.json',
+  config: 'config.json',
+  catalog: 'tools-cache.json',
+};