@atlasauth/cli 0.10.0 → 0.11.0

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # @atlasauth/cli changelog
 
+## 0.11.0 — 2026-10-25
+
+- `atlas id-accounts provision|list|rotate|remove`: test and review accounts for a Sign in with Atlas app (reviewer logins, CI, demos), with a platform key or a per-app key scoped `atlas_id_apps:<app id>:provision`. Passwords go to 0600 files and are never printed (`--print-secret` is the opt-out).
+- `atlas admin id-accounts list|provision|extend|rotate|revoke` and `atlas admin developer-accounts provision|revoke`: for Atlas staff, accounts for other platforms' integration teams. Uses the operator sign-in (`atlas login --device`) exchanged for Atlas's own account, signs in again once when a recent second factor is needed (`--no-step-up` to just fail), and writes passwords (delivered sealed) to 0600 files.
+
 ## 0.10.0 — 2026-10-24
 
 - Per-call integration audiences (`getToken({ for, cbid })`), partner platforms, operator tokens for partner products.

package/dist/args.d.ts

@@ -375,6 +375,45 @@ declare const OPTIONS: {
     readonly rotate: {
         readonly type: "boolean";
     };
+    readonly app: {
+        readonly type: "string";
+    };
+    readonly label: {
+        readonly type: "string";
+    };
+    readonly 'password-file': {
+        readonly type: "string";
+    };
+    readonly 'two-factor-exempt': {
+        readonly type: "boolean";
+    };
+    readonly unverified: {
+        readonly type: "boolean";
+    };
+    readonly team: {
+        readonly type: "string";
+    };
+    readonly kind: {
+        readonly type: "string";
+    };
+    readonly days: {
+        readonly type: "string";
+    };
+    readonly 'any-app': {
+        readonly type: "boolean";
+    };
+    readonly 'staff-account': {
+        readonly type: "string";
+    };
+    readonly 'account-name': {
+        readonly type: "string";
+    };
+    readonly 'application-name': {
+        readonly type: "string";
+    };
+    readonly 'no-step-up': {
+        readonly type: "boolean";
+    };
     readonly cursor: {
         readonly type: "boolean";
     };

package/dist/args.js

@@ -163,6 +163,21 @@ const OPTIONS = {
     'allowed-source': { type: 'string', multiple: true },
     'token-file': { type: 'string' },
     rotate: { type: 'boolean' },
+    // id-accounts provision / list / rotate / remove.
+    app: { type: 'string' },
+    label: { type: 'string' },
+    'password-file': { type: 'string' },
+    'two-factor-exempt': { type: 'boolean' },
+    unverified: { type: 'boolean' },
+    // admin id-accounts / developer-accounts (Atlas staff).
+    team: { type: 'string' },
+    kind: { type: 'string' },
+    days: { type: 'string' },
+    'any-app': { type: 'boolean' },
+    'staff-account': { type: 'string' },
+    'account-name': { type: 'string' },
+    'application-name': { type: 'string' },
+    'no-step-up': { type: 'boolean' },
     // mcp install.
     cursor: { type: 'boolean' },
     'claude-code': { type: 'boolean' },

package/dist/args.js.map

@@ -1 +1 @@
-{"version":3,"file":"args.js","sourceRoot":"","sources":["../src/args.ts"],"names":[],"mappings":";;AAwLA,sBAeC;AAGD,kBAGC;AAGD,oBAOC;AAGD,sBAQC;AAlOD,yCAAsC;AACtC,qCAAoC;AAEpC;;;;;GAKG;AACH,MAAM,OAAO,GAAG;IACd,UAAU;IACV,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACzB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACpC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;IACrC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;IACxC,qDAAqD;IACrD,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACvB,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,uEAAuE;IACvE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,wBAAwB;IACxB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACvB,gBAAgB;IAChB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC/B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,YAAY;IACZ,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAClC,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,0BAA0B;IAC1B,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACvB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC9B,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1B,WAAW;IACX,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,0EAA0E;IAC1E,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAClC,0EAA0E;IAC1E,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1B,0CAA0C;IAC1C,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC/B,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAClC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC9B,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,qFAAqF;IACrF,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACpC,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACpC,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;IACrD,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC/B,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;IACpC,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1B,eAAe,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACpC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC7B,gBAAgB;IAChB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC/B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACxB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,+EAA+E;IAC/E,cAAc,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACnC,qCAAqC;IACrC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,mDAAmD;IACnD,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC9B,eAAe;IACf,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACtB,UAAU;IACV,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACjC,OAAO;IACP,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC7B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC5C,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC/B,eAAe;IACf,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAChC,gCAAgC;IAChC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC9B,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,oBAAoB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxC,mGAAmG;IACnG,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,oBAAoB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxC,kEAAkE;IAClE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,kDAAkD;IAClD,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,uFAAuF;IACvF,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC7B,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAClC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC/B,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACpC,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC9B,qBAAqB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1C,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACvB,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACzB,0BAA0B;IAC1B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAClC,kFAAkF;IAClF,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,mBAAmB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACxC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACjC,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC3B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;IACxC,iCAAiC;IACjC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,wBAAwB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5C,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACrC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC5B,qBAAqB;IACrB,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC9B,kBAAkB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACtC,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;IACpD,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC3B,eAAe;IACf,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC3B,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAClC,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC3B,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;CACnB,CAAC;AAiBX,6FAA6F;AAC7F,SAAgB,KAAK,CAAC,IAAc;IAClC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,IAAA,qBAAS,EAAC;YACxC,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,OAAO;YAChB,gBAAgB,EAAE,IAAI;YACtB,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,MAAgB,EAAE,WAAW,EAAE,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0EAA0E;QAC1E,8DAA8D;QAC9D,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,iBAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,2CAA2C;AAC3C,SAAgB,GAAG,CAAC,MAAc,EAAE,GAAiB;IACnD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED,mFAAmF;AACnF,SAAgB,IAAI,CAAC,MAAc,EAAE,GAAiB;IACpD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,OAAO,GAAG;SACP,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;SAC5B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,yFAAyF;AACzF,SAAgB,KAAK,CAAC,MAAc;IAClC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,iBAAQ,CAAC,4CAA4C,GAAG,IAAI,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"args.js","sourceRoot":"","sources":["../src/args.ts"],"names":[],"mappings":";;AAuMA,sBAeC;AAGD,kBAGC;AAGD,oBAOC;AAGD,sBAQC;AAjPD,yCAAsC;AACtC,qCAAoC;AAEpC;;;;;GAKG;AACH,MAAM,OAAO,GAAG;IACd,UAAU;IACV,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACzB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACpC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;IACrC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;IACxC,qDAAqD;IACrD,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACvB,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,uEAAuE;IACvE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,wBAAwB;IACxB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACvB,gBAAgB;IAChB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC/B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,YAAY;IACZ,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAClC,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,0BAA0B;IAC1B,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACvB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC9B,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1B,WAAW;IACX,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,0EAA0E;IAC1E,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAClC,0EAA0E;IAC1E,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1B,0CAA0C;IAC1C,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC/B,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAClC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC9B,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,qFAAqF;IACrF,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACpC,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACpC,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;IACrD,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC/B,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;IACpC,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1B,eAAe,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACpC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC7B,gBAAgB;IAChB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC/B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACxB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,+EAA+E;IAC/E,cAAc,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACnC,qCAAqC;IACrC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,mDAAmD;IACnD,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC9B,eAAe;IACf,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACtB,UAAU;IACV,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACjC,OAAO;IACP,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC7B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC5C,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC/B,eAAe;IACf,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAChC,gCAAgC;IAChC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC9B,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,oBAAoB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxC,mGAAmG;IACnG,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,oBAAoB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxC,kEAAkE;IAClE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,kDAAkD;IAClD,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,uFAAuF;IACvF,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC7B,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAClC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC/B,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACpC,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC9B,qBAAqB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1C,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACvB,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACzB,0BAA0B;IAC1B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAClC,kFAAkF;IAClF,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,mBAAmB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACxC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACjC,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC3B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;IACxC,iCAAiC;IACjC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,wBAAwB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5C,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACrC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC5B,qBAAqB;IACrB,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC9B,kBAAkB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACtC,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;IACpD,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC3B,kDAAkD;IAClD,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACvB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,mBAAmB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACxC,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC/B,wDAAwD;IACxD,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC9B,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAClC,kBAAkB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACtC,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACjC,eAAe;IACf,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC3B,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAClC,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC3B,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;CACnB,CAAC;AAiBX,6FAA6F;AAC7F,SAAgB,KAAK,CAAC,IAAc;IAClC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,IAAA,qBAAS,EAAC;YACxC,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,OAAO;YAChB,gBAAgB,EAAE,IAAI;YACtB,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,MAAgB,EAAE,WAAW,EAAE,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0EAA0E;QAC1E,8DAA8D;QAC9D,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,iBAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,2CAA2C;AAC3C,SAAgB,GAAG,CAAC,MAAc,EAAE,GAAiB;IACnD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED,mFAAmF;AACnF,SAAgB,IAAI,CAAC,MAAc,EAAE,GAAiB;IACpD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,OAAO,GAAG;SACP,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;SAC5B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,yFAAyF;AACzF,SAAgB,KAAK,CAAC,MAAc;IAClC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,iBAAQ,CAAC,4CAA4C,GAAG,IAAI,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/commands/admin.d.ts

@@ -0,0 +1,49 @@
+import { type ParsedArgs } from '../args';
+import type { RunContext } from '../context';
+/** The scope an operator token needs on Atlas's own account for the staff routes. */
+export declare const STAFF_PROVISION_SCOPE = "platform:atlas_id_apps:provision";
+/** A staff-made account as the /v1/admin routes return it. */
+export interface StaffAccount {
+    object: 'atlas_id_provisioned_account';
+    id: string;
+    sub: string;
+    email: string | null;
+    label: string;
+    team: string;
+    kind: 'provisioned' | 'developer' | 'test_mode';
+    app_ids: string[];
+    apps: Array<{
+        id: string;
+        client_id: string;
+        name: string;
+    }>;
+    any_app: boolean;
+    two_factor_exempt: boolean;
+    expires_at: number | null;
+    expired: boolean;
+    developer_account_id: string | null;
+    developer_account?: {
+        id: string;
+        name: string;
+    } | null;
+    last_sign_in_at: number | null;
+    password?: string;
+    sealed_password?: string;
+    application?: {
+        id: string;
+        name: string;
+    };
+}
+/**
+ * `atlas admin id-accounts list|provision|extend|rotate|revoke` and
+ * `atlas admin developer-accounts provision|revoke`: Atlas STAFF provisioning
+ * Sign in with Atlas accounts for other platforms' integration teams.
+ *
+ * Credential: the operator sign-in (`atlas login --device`), exchanged for a
+ * one-hour token on Atlas's own account with `platform:atlas_id_apps:provision`.
+ * Writes need a second factor proved in the last 5 minutes; when the server
+ * says so, the CLI runs the operator sign-in again and retries once. Passwords
+ * come back sealed to a key pair made for the run and are written to 0600 files,
+ * never printed (unless --print-secret).
+ */
+export declare function admin(ctx: RunContext, args: ParsedArgs): Promise<number>;

package/dist/commands/admin.js

@@ -0,0 +1,353 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.STAFF_PROVISION_SCOPE = void 0;
+exports.admin = admin;
+const backend_1 = require("@atlasauth/backend");
+const args_1 = require("../args");
+const errors_1 = require("../errors");
+const output_1 = require("../output");
+const project_1 = require("../project");
+const secrets_1 = require("../secrets");
+const shared_1 = require("./shared");
+/** The scope an operator token needs on Atlas's own account for the staff routes. */
+exports.STAFF_PROVISION_SCOPE = 'platform:atlas_id_apps:provision';
+const MIN_PASSWORD_LENGTH = 12;
+const BASE = '/v1/admin/atlas_id/provisioned_accounts';
+const DEVELOPER_BASE = '/v1/admin/atlas_id/developer_accounts';
+const COLUMNS = [
+    { header: 'ID', get: (a) => a.id },
+    { header: 'EMAIL', get: (a) => a.email ?? '' },
+    { header: 'TEAM', get: (a) => a.team ?? a.label },
+    { header: 'KIND', get: (a) => a.kind },
+    { header: 'APPS', get: (a) => (a.any_app ? 'any' : a.kind === 'developer' ? '-' : a.apps.map((x) => x.name).join(', ') || a.app_ids.join(', ')) },
+    { header: 'EXPIRES', get: (a) => (a.expires_at ? (a.expired ? `${(0, output_1.fmtTime)(a.expires_at)} (expired)` : (0, output_1.fmtTime)(a.expires_at)) : 'never') },
+];
+/** The first non-comment line of a file (or stdin): `NAME=value` or a bare value. */
+function readPasswordFile(ctx, file) {
+    const where = file === '-' ? 'stdin' : file;
+    let text;
+    try {
+        text = ctx.readFile(file === '-' ? '/dev/stdin' : file);
+    }
+    catch {
+        throw new errors_1.CliError(`Could not read the password from ${where}.`);
+    }
+    const line = text.split(/\r?\n/).find((l) => l.trim() && !l.trim().startsWith('#')) ?? '';
+    const m = /^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(line.trim());
+    const password = (m ? m[1] : line).replace(/[\r\n]+$/, '').replace(/^"(.*)"$/, '$1');
+    if (!password)
+        throw new errors_1.CliError(`No password found in ${where}.`);
+    if (password.length < MIN_PASSWORD_LENGTH)
+        throw new errors_1.CliError(`The password in ${where} must be at least ${MIN_PASSWORD_LENGTH} characters.`);
+    return password;
+}
+/** `--days N` / `--expires-at <ISO|epoch ms>` as the staff routes take them. */
+function expiryBody(values) {
+    const days = (0, args_1.str)(values, 'days');
+    const at = (0, args_1.str)(values, 'expires-at');
+    if (days && at)
+        throw new errors_1.CliError('Pass --days or --expires-at, not both.');
+    if (days) {
+        const n = Number(days);
+        if (!Number.isInteger(n) || n < 1)
+            throw new errors_1.CliError(`--days must be a whole number of days, got '${days}'.`);
+        return { days: n };
+    }
+    if (at) {
+        if (/^\d+$/.test(at))
+            return { expires_at: Number(at) };
+        if (Number.isNaN(Date.parse(at)))
+            throw new errors_1.CliError(`--expires-at must be an ISO 8601 date (2026-12-31) or epoch milliseconds, got '${at}'.`);
+        return { expires_at: at };
+    }
+    return {};
+}
+function withoutSecrets(a) {
+    const { password: _p, sealed_password: _s, ...rest } = a;
+    void _p;
+    void _s;
+    return rest;
+}
+const stepUpError = (err) => err instanceof backend_1.AtlasApiError && err.errors.some((e) => e.code === 'STEP_UP_REQUIRED' || e.code === 'MFA_REQUIRED');
+/**
+ * The staff credential: the profile's operator sign-in (`atlas login --device`)
+ * exchanged for a one-hour token on Atlas's own account with the provision
+ * scope. Nothing long-lived is stored; the staff account id is remembered on
+ * the profile once given.
+ */
+class StaffSession {
+    ctx;
+    args;
+    token;
+    pair = (0, backend_1.generateSealKeyPair)();
+    constructor(ctx, args) {
+        this.ctx = ctx;
+        this.args = args;
+    }
+    profileName() {
+        const file = this.ctx.config.load();
+        return (0, args_1.str)(this.args.values, 'profile') || file.active_profile || 'default';
+    }
+    apiUrl() {
+        const profile = this.ctx.config.load().profiles[this.profileName()];
+        return (0, args_1.str)(this.args.values, 'url') || (0, shared_1.envApiUrl)(this.ctx.env) || profile?.api_url || backend_1.DEFAULT_API_URL;
+    }
+    staffAccount() {
+        const file = this.ctx.config.load();
+        const name = this.profileName();
+        const given = (0, args_1.str)(this.args.values, 'staff-account') || this.ctx.env.ATLAS_STAFF_ACCOUNT_ID?.trim();
+        const account = given || file.profiles[name]?.staff_account_id;
+        if (!account) {
+            throw new errors_1.CliError("atlas admin needs Atlas's own account id once: pass --staff-account <acct_…> (or set ATLAS_STAFF_ACCOUNT_ID). It is remembered on the profile.");
+        }
+        if (given && file.profiles[name] && file.profiles[name].staff_account_id !== given) {
+            file.profiles[name].staff_account_id = given;
+            this.ctx.config.save(file);
+        }
+        return account;
+    }
+    async exchange() {
+        const file = this.ctx.config.load();
+        const operator = file.profiles[this.profileName()]?.operator;
+        if (!operator || operator.expires_at <= Date.now()) {
+            throw new errors_1.CliError("No current operator sign-in. Run 'atlas login --device' (confirm with your second factor) first.");
+        }
+        try {
+            const bound = await (0, backend_1.exchangeOperatorToken)(operator.access_token, { resource: this.staffAccount(), scope: exports.STAFF_PROVISION_SCOPE }, { apiUrl: this.apiUrl(), fetch: this.ctx.fetch });
+            return bound.access_token;
+        }
+        catch (err) {
+            if (err instanceof backend_1.OAuthFlowError) {
+                throw new errors_1.CliError(`Atlas refused the staff token (${err.error}): ${err.message}. Only owners and admins of Atlas's own account can use 'atlas admin'.`);
+            }
+            throw err;
+        }
+    }
+    /** A fresh operator sign-in (the device flow), for a write that needs a recent second factor. */
+    async stepUp() {
+        const opts = { apiUrl: this.apiUrl(), fetch: this.ctx.fetch };
+        let start;
+        try {
+            start = await (0, backend_1.startOperatorLogin)(opts);
+        }
+        catch (err) {
+            throw new errors_1.CliError(err instanceof Error ? err.message : String(err));
+        }
+        this.ctx.io.err('This action needs a sign-in verified with your second factor in the last 5 minutes.');
+        this.ctx.io.err(`Open ${start.verification_uri_complete}`);
+        this.ctx.io.err(`and confirm the code ${start.user_code} with your passkey or authenticator.`);
+        let token;
+        try {
+            token = await (0, backend_1.pollOperatorLogin)(start, { fetch: this.ctx.fetch, sleep: this.ctx.sleep });
+        }
+        catch (err) {
+            if (err instanceof backend_1.OAuthFlowError)
+                throw new errors_1.CliError(`Sign-in did not complete: ${err.message}`);
+            throw err;
+        }
+        const file = this.ctx.config.load();
+        const name = this.profileName();
+        const entry = file.profiles[name] ?? { api_url: opts.apiUrl, secret_key: '' };
+        entry.operator = { access_token: token.access_token, expires_at: Date.now() + token.expires_in * 1000, issuer: start.config.issuer };
+        file.profiles[name] = entry;
+        this.ctx.config.save(file);
+        this.token = undefined;
+    }
+    async http() {
+        this.token ??= await this.exchange();
+        // Passwords come back sealed to a key pair made here, opened only locally.
+        return (0, project_1.httpFor)(this.ctx, { secretKey: this.token, apiUrl: this.apiUrl(), headers: { 'x-secret-recipient': this.pair.secretRecipient } });
+    }
+    read(fn) {
+        return this.http().then(fn);
+    }
+    /** A write: on STEP_UP_REQUIRED, sign in again (unless --no-step-up) and retry once. */
+    async write(fn) {
+        try {
+            return await fn(await this.http());
+        }
+        catch (err) {
+            if (!stepUpError(err))
+                throw err;
+            if (this.args.values['no-step-up'] === true) {
+                throw new errors_1.CliError("This action needs a sign-in verified with your second factor in the last 5 minutes. Run 'atlas login --device' and retry.");
+            }
+            await this.stepUp();
+            return fn(await this.http());
+        }
+    }
+    /** The password: opened from `sealed_password` (or the plain field), then to a 0600 file. */
+    deliverPassword(account, label) {
+        const password = account.sealed_password ? (0, backend_1.openSealedSecret)(account.sealed_password, this.pair) : account.password;
+        if (!password)
+            return undefined;
+        const json = (0, shared_1.wantsJson)(this.args.values);
+        const io = json ? { out: () => undefined, err: this.ctx.io.err } : this.ctx.io;
+        return (0, secrets_1.deliverSecret)({
+            io,
+            env: this.ctx.env,
+            product: (0, args_1.str)(this.args.values, 'product') ?? 'atlasauth',
+            fileName: `staff-account-${account.id}.env`,
+            entries: { ATLAS_ID_TEST_EMAIL: account.email ?? '', ATLAS_ID_TEST_PASSWORD: password },
+            label,
+            printSecret: this.args.values['print-secret'] === true,
+            force: true,
+            comment: `Atlas staff-provisioned account ${account.email ?? account.id} (team ${account.team ?? account.label}). Hand it to that team only.`,
+        }).path;
+    }
+}
+function emitAccount(ctx, args, account, path, line) {
+    if ((0, shared_1.wantsJson)(args.values))
+        (0, output_1.printJson)(ctx.io, { ...withoutSecrets(account), ...(path ? { secret_file: path } : {}) });
+    else
+        ctx.io.out(line);
+}
+async function idAccountsCommand(ctx, args, staff) {
+    const v = args.values;
+    const sub = args.positionals[2];
+    switch (sub) {
+        case 'list': {
+            const kind = (0, args_1.str)(v, 'kind');
+            if (kind && kind !== 'provisioned' && kind !== 'developer')
+                throw new errors_1.CliError('--kind must be provisioned or developer.');
+            const q = new URLSearchParams();
+            const team = (0, args_1.str)(v, 'team');
+            if (team)
+                q.set('team', team);
+            if (kind)
+                q.set('kind', kind);
+            const limit = (0, args_1.str)(v, 'limit');
+            if (limit)
+                q.set('limit', limit);
+            const qs = q.toString();
+            const page = await staff.read((http) => http.get(`${BASE}${qs ? `?${qs}` : ''}`));
+            if ((0, shared_1.wantsJson)(v))
+                (0, output_1.printJson)(ctx.io, page);
+            else {
+                ctx.io.out((0, output_1.renderTable)(COLUMNS, page.data));
+                for (const t of page.teams)
+                    ctx.io.out(`${t.team}: ${t.count} of ${t.limit}${t.expired ? ` (${t.expired} expired)` : ''}`);
+            }
+            return 0;
+        }
+        case 'provision': {
+            const email = (0, args_1.str)(v, 'email');
+            const team = (0, args_1.str)(v, 'team');
+            if (!email || !team)
+                throw new errors_1.CliError('admin id-accounts provision needs --email <address> and --team <partner team>.');
+            const anyApp = v['any-app'] === true;
+            const apps = ((0, args_1.str)(v, 'app') ?? '').split(',').map((s) => s.trim()).filter(Boolean);
+            if (anyApp === (apps.length > 0))
+                throw new errors_1.CliError('Pass --app <id[,id…]> (the apps the account may sign in to) or --any-app, exactly one.');
+            if (anyApp && v['two-factor-exempt'] === true)
+                throw new errors_1.CliError('--two-factor-exempt needs named apps (--app), not --any-app.');
+            const passwordFile = (0, args_1.str)(v, 'password-file');
+            const body = {
+                email,
+                team,
+                ...(anyApp ? { any_app: true } : { app_ids: apps }),
+                email_verified: v.unverified !== true,
+                ...(passwordFile ? { password: readPasswordFile(ctx, passwordFile) } : {}),
+                ...(v['two-factor-exempt'] === true ? { two_factor_exempt: true } : {}),
+                ...expiryBody(v),
+            };
+            const created = await staff.write((http) => http.post(BASE, body));
+            const path = staff.deliverPassword(created, `The password for ${created.email ?? email}`);
+            emitAccount(ctx, args, created, path, `Created ${created.email ?? email} (${created.id}) for team ${team}${anyApp ? ', any Sign in with Atlas app' : ''}${created.expires_at ? `, expires ${(0, output_1.fmtTime)(created.expires_at)}` : ''}.`);
+            return 0;
+        }
+        case 'extend': {
+            const id = (0, shared_1.requireArg)(args.positionals, 3, 'account id');
+            const extended = await staff.write((http) => http.post(`${BASE}/${encodeURIComponent(id)}/extend`, expiryBody(v)));
+            emitAccount(ctx, args, extended, undefined, `${id} now expires ${extended.expires_at ? (0, output_1.fmtTime)(extended.expires_at) : 'never'}.`);
+            return 0;
+        }
+        case 'rotate': {
+            const id = (0, shared_1.requireArg)(args.positionals, 3, 'account id');
+            const passwordFile = (0, args_1.str)(v, 'password-file');
+            const rotated = await staff.write((http) => http.post(`${BASE}/${encodeURIComponent(id)}/password`, passwordFile ? { password: readPasswordFile(ctx, passwordFile) } : {}));
+            const path = staff.deliverPassword(rotated, `The new password for ${rotated.email ?? id}`);
+            emitAccount(ctx, args, rotated, path, 'Existing sessions stay signed in; revoke the account to end them.');
+            return 0;
+        }
+        case 'revoke': {
+            const id = (0, shared_1.requireArg)(args.positionals, 3, 'account id');
+            await staff.write((http) => http.delete(`${BASE}/${encodeURIComponent(id)}`));
+            if ((0, shared_1.wantsJson)(v))
+                (0, output_1.printJson)(ctx.io, { id, revoked: true });
+            else
+                ctx.io.out(`Revoked ${id}: the account is deleted and its sessions and grants end.`);
+            return 0;
+        }
+        default:
+            throw new errors_1.CliError(sub
+                ? `Unknown subcommand 'admin id-accounts ${sub}'. Try: list, provision, extend, rotate, revoke.`
+                : 'admin id-accounts needs a subcommand: list, provision, extend, rotate, revoke.');
+    }
+}
+async function developerAccountsCommand(ctx, args, staff) {
+    const v = args.values;
+    const sub = args.positionals[2];
+    switch (sub) {
+        case 'provision': {
+            const email = (0, args_1.str)(v, 'email');
+            const team = (0, args_1.str)(v, 'team');
+            if (!email || !team)
+                throw new errors_1.CliError('admin developer-accounts provision needs --email <address> and --team <partner team>.');
+            const passwordFile = (0, args_1.str)(v, 'password-file');
+            const body = {
+                email,
+                team,
+                ...((0, args_1.str)(v, 'account-name') ? { account_name: (0, args_1.str)(v, 'account-name') } : {}),
+                ...((0, args_1.str)(v, 'application-name') ? { application_name: (0, args_1.str)(v, 'application-name') } : {}),
+                ...(passwordFile ? { password: readPasswordFile(ctx, passwordFile) } : {}),
+                ...expiryBody(v),
+            };
+            const created = await staff.write((http) => http.post(DEVELOPER_BASE, body));
+            const path = staff.deliverPassword(created, `The password for ${created.email ?? email}`);
+            emitAccount(ctx, args, created, path, `Created developer account ${created.email ?? email} (${created.id}) for team ${team}${created.application ? `, owning ${created.application.name} (${created.application.id})` : ''}${created.expires_at ? `, expires ${(0, output_1.fmtTime)(created.expires_at)}` : ''}.`);
+            return 0;
+        }
+        case 'revoke': {
+            const id = (0, shared_1.requireArg)(args.positionals, 3, 'account id');
+            const out = await staff.write((http) => http.get(`${BASE}/${encodeURIComponent(id)}`).then(async (row) => {
+                if (row.kind !== 'developer')
+                    throw new errors_1.CliError(`${id} is not a developer account; use 'atlas admin id-accounts revoke'.`);
+                await http.delete(`${BASE}/${encodeURIComponent(id)}`);
+                return row;
+            }));
+            if ((0, shared_1.wantsJson)(v))
+                (0, output_1.printJson)(ctx.io, { id, revoked: true, developer_account_id: out.developer_account_id });
+            else
+                ctx.io.out(`Revoked ${id}: the account is deleted, its sessions end, and its dashboard account goes when no one else is a member.`);
+            return 0;
+        }
+        default:
+            throw new errors_1.CliError(sub
+                ? `Unknown subcommand 'admin developer-accounts ${sub}'. Try: provision, revoke.`
+                : 'admin developer-accounts needs a subcommand: provision, revoke.');
+    }
+}
+/**
+ * `atlas admin id-accounts list|provision|extend|rotate|revoke` and
+ * `atlas admin developer-accounts provision|revoke`: Atlas STAFF provisioning
+ * Sign in with Atlas accounts for other platforms' integration teams.
+ *
+ * Credential: the operator sign-in (`atlas login --device`), exchanged for a
+ * one-hour token on Atlas's own account with `platform:atlas_id_apps:provision`.
+ * Writes need a second factor proved in the last 5 minutes; when the server
+ * says so, the CLI runs the operator sign-in again and retries once. Passwords
+ * come back sealed to a key pair made for the run and are written to 0600 files,
+ * never printed (unless --print-secret).
+ */
+async function admin(ctx, args) {
+    const group = args.positionals[1];
+    if (group !== 'id-accounts' && group !== 'developer-accounts') {
+        throw new errors_1.CliError(group
+            ? `Unknown 'atlas admin ${group}'. Try: atlas admin id-accounts …, atlas admin developer-accounts ….`
+            : 'atlas admin needs a group: id-accounts or developer-accounts.');
+    }
+    const staff = new StaffSession(ctx, args);
+    return group === 'id-accounts' ? idAccountsCommand(ctx, args, staff) : developerAccountsCommand(ctx, args, staff);
+}
+//# sourceMappingURL=admin.js.map

package/dist/commands/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../../src/commands/admin.ts"],"names":[],"mappings":";;;AAwYA,sBAWC;AAnZD,gDAS4B;AAC5B,kCAA+C;AAG/C,sCAAqC;AACrC,sCAAyE;AACzE,wCAAqC;AACrC,wCAA2C;AAC3C,qCAA4D;AAE5D,qFAAqF;AACxE,QAAA,qBAAqB,GAAG,kCAAkC,CAAC;AACxE,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,MAAM,IAAI,GAAG,yCAAyC,CAAC;AACvD,MAAM,cAAc,GAAG,uCAAuC,CAAC;AAiC/D,MAAM,OAAO,GAA2B;IACtC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;IAClC,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE;IAC9C,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE;IACjD,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;IACtC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE;IACjJ,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAA,gBAAO,EAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,IAAA,gBAAO,EAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;CACzI,CAAC;AAEF,qFAAqF;AACrF,SAAS,gBAAgB,CAAC,GAAe,EAAE,IAAY;IACrD,MAAM,KAAK,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5C,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAQ,CAAC,oCAAoC,KAAK,GAAG,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1F,MAAM,CAAC,GAAG,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACtF,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,iBAAQ,CAAC,wBAAwB,KAAK,GAAG,CAAC,CAAC;IACpE,IAAI,QAAQ,CAAC,MAAM,GAAG,mBAAmB;QAAE,MAAM,IAAI,iBAAQ,CAAC,mBAAmB,KAAK,qBAAqB,mBAAmB,cAAc,CAAC,CAAC;IAC9I,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gFAAgF;AAChF,SAAS,UAAU,CAAC,MAA4B;IAC9C,MAAM,IAAI,GAAG,IAAA,UAAG,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,MAAM,EAAE,GAAG,IAAA,UAAG,EAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACrC,IAAI,IAAI,IAAI,EAAE;QAAE,MAAM,IAAI,iBAAQ,CAAC,wCAAwC,CAAC,CAAC;IAC7E,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACvB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,iBAAQ,CAAC,+CAA+C,IAAI,IAAI,CAAC,CAAC;QAC/G,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IACrB,CAAC;IACD,IAAI,EAAE,EAAE,CAAC;QACP,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;QACxD,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAAE,MAAM,IAAI,iBAAQ,CAAC,kFAAkF,EAAE,IAAI,CAAC,CAAC;QAC/I,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAC5B,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,cAAc,CAAC,CAAe;IACrC,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;IACzD,KAAK,EAAE,CAAC;IACR,KAAK,EAAE,CAAC;IACR,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,GAAY,EAAW,EAAE,CAC5C,GAAG,YAAY,uBAAa,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC;AAErH;;;;;GAKG;AACH,MAAM,YAAY;IAIG;IACA;IAJX,KAAK,CAAqB;IACzB,IAAI,GAAG,IAAA,6BAAmB,GAAE,CAAC;IACtC,YACmB,GAAe,EACf,IAAgB;QADhB,QAAG,GAAH,GAAG,CAAY;QACf,SAAI,GAAJ,IAAI,CAAY;IAChC,CAAC;IAEI,WAAW;QACjB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACpC,OAAO,IAAA,UAAG,EAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,cAAc,IAAI,SAAS,CAAC;IAC9E,CAAC;IAEO,MAAM;QACZ,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACpE,OAAO,IAAA,UAAG,EAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,IAAA,kBAAS,EAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,EAAE,OAAO,IAAI,yBAAe,CAAC;IACxG,CAAC;IAEO,YAAY;QAClB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,IAAA,UAAG,EAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,CAAC;QACpG,MAAM,OAAO,GAAG,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,gBAAgB,CAAC;QAC/D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,iBAAQ,CAAC,gJAAgJ,CAAC,CAAC;QACvK,CAAC;QACD,IAAI,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAE,CAAC,gBAAgB,KAAK,KAAK,EAAE,CAAC;YACpF,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAE,CAAC,gBAAgB,GAAG,KAAK,CAAC;YAC9C,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,QAAQ;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,QAAQ,CAAC;QAC7D,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACnD,MAAM,IAAI,iBAAQ,CAAC,kGAAkG,CAAC,CAAC;QACzH,CAAC;QACD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAA,+BAAqB,EACvC,QAAQ,CAAC,YAAY,EACrB,EAAE,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,6BAAqB,EAAE,EAC/D,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CACjD,CAAC;YACF,OAAO,KAAK,CAAC,YAAY,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,wBAAc,EAAE,CAAC;gBAClC,MAAM,IAAI,iBAAQ,CAAC,kCAAkC,GAAG,CAAC,KAAK,MAAM,GAAG,CAAC,OAAO,wEAAwE,CAAC,CAAC;YAC3J,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,iGAAiG;IACzF,KAAK,CAAC,MAAM;QAClB,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QAC9D,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAA,4BAAkB,EAAC,IAAI,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,iBAAQ,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,qFAAqF,CAAC,CAAC;QACvG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,CAAC,yBAAyB,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,wBAAwB,KAAK,CAAC,SAAS,sCAAsC,CAAC,CAAC;QAC/F,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAA,2BAAiB,EAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QAC3F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,wBAAc;gBAAE,MAAM,IAAI,iBAAQ,CAAC,6BAA6B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAClG,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QAC9E,KAAK,CAAC,QAAQ,GAAG,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACrI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QAC5B,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACrC,2EAA2E;QAC3E,OAAO,IAAA,iBAAO,EAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,oBAAoB,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IAC3I,CAAC;IAED,IAAI,CAAI,EAAoC;QAC1C,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED,wFAAwF;IACxF,KAAK,CAAC,KAAK,CAAI,EAAoC;QACjD,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;YACjC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC5C,MAAM,IAAI,iBAAQ,CAAC,2HAA2H,CAAC,CAAC;YAClJ,CAAC;YACD,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YACpB,OAAO,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,6FAA6F;IAC7F,eAAe,CAAC,OAAqB,EAAE,KAAa;QAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,IAAA,0BAAgB,EAAC,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACnH,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QAChC,MAAM,IAAI,GAAG,IAAA,kBAAS,EAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/E,OAAO,IAAA,uBAAa,EAAC;YACnB,EAAE;YACF,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG;YACjB,OAAO,EAAE,IAAA,UAAG,EAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,WAAW;YACxD,QAAQ,EAAE,iBAAiB,OAAO,CAAC,EAAE,MAAM;YAC3C,OAAO,EAAE,EAAE,mBAAmB,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE,EAAE,sBAAsB,EAAE,QAAQ,EAAE;YACvF,KAAK;YACL,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,IAAI;YACtD,KAAK,EAAE,IAAI;YACX,OAAO,EAAE,mCAAmC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,EAAE,UAAU,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,+BAA+B;SAC9I,CAAC,CAAC,IAAI,CAAC;IACV,CAAC;CACF;AAED,SAAS,WAAW,CAAC,GAAe,EAAE,IAAgB,EAAE,OAAqB,EAAE,IAAwB,EAAE,IAAY;IACnH,IAAI,IAAA,kBAAS,EAAC,IAAI,CAAC,MAAM,CAAC;QAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;;QACjH,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,GAAe,EAAE,IAAgB,EAAE,KAAmB;IACrF,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IACtB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAChC,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,IAAI,GAAG,IAAA,UAAG,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YAC5B,IAAI,IAAI,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,WAAW;gBAAE,MAAM,IAAI,iBAAQ,CAAC,0CAA0C,CAAC,CAAC;YAC3H,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,IAAA,UAAG,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YAC5B,IAAI,IAAI;gBAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC9B,IAAI,IAAI;gBAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC9B,MAAM,KAAK,GAAG,IAAA,UAAG,EAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAC9B,IAAI,KAAK;gBAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACjC,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAY,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAC7F,IAAI,IAAA,kBAAS,EAAC,CAAC,CAAC;gBAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;iBACrC,CAAC;gBACJ,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAA,oBAAW,EAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC5C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK;oBAAE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7H,CAAC;YACD,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,KAAK,GAAG,IAAA,UAAG,EAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAC9B,MAAM,IAAI,GAAG,IAAA,UAAG,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YAC5B,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,iBAAQ,CAAC,gFAAgF,CAAC,CAAC;YAC1H,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC;YACrC,MAAM,IAAI,GAAG,CAAC,IAAA,UAAG,EAAC,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACnF,IAAI,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;gBAAE,MAAM,IAAI,iBAAQ,CAAC,wFAAwF,CAAC,CAAC;YAC/I,IAAI,MAAM,IAAI,CAAC,CAAC,mBAAmB,CAAC,KAAK,IAAI;gBAAE,MAAM,IAAI,iBAAQ,CAAC,8DAA8D,CAAC,CAAC;YAClI,MAAM,YAAY,GAAG,IAAA,UAAG,EAAC,CAAC,EAAE,eAAe,CAAC,CAAC;YAC7C,MAAM,IAAI,GAAG;gBACX,KAAK;gBACL,IAAI;gBACJ,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBACnD,cAAc,EAAE,CAAC,CAAC,UAAU,KAAK,IAAI;gBACrC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,gBAAgB,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1E,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,GAAG,UAAU,CAAC,CAAC,CAAC;aACjB,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAe,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YACjF,MAAM,IAAI,GAAG,KAAK,CAAC,eAAe,CAAC,OAAO,EAAE,oBAAoB,OAAO,CAAC,KAAK,IAAI,KAAK,EAAE,CAAC,CAAC;YAC1F,WAAW,CACT,GAAG,EACH,IAAI,EACJ,OAAO,EACP,IAAI,EACJ,WAAW,OAAO,CAAC,KAAK,IAAI,KAAK,KAAK,OAAO,CAAC,EAAE,cAAc,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,IAAA,gBAAO,EAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAC5L,CAAC;YACF,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,EAAE,GAAG,IAAA,mBAAU,EAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,YAAY,CAAC,CAAC;YACzD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAe,GAAG,IAAI,IAAI,kBAAkB,CAAC,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACjI,WAAW,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,gBAAgB,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,IAAA,gBAAO,EAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;YAClI,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,EAAE,GAAG,IAAA,mBAAU,EAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,YAAY,CAAC,CAAC;YACzD,MAAM,YAAY,GAAG,IAAA,UAAG,EAAC,CAAC,EAAE,eAAe,CAAC,CAAC;YAC7C,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CACzC,IAAI,CAAC,IAAI,CAAe,GAAG,IAAI,IAAI,kBAAkB,CAAC,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,gBAAgB,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAC7I,CAAC;YACF,MAAM,IAAI,GAAG,KAAK,CAAC,eAAe,CAAC,OAAO,EAAE,wBAAwB,OAAO,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC;YAC3F,WAAW,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,mEAAmE,CAAC,CAAC;YAC3G,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,EAAE,GAAG,IAAA,mBAAU,EAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,YAAY,CAAC,CAAC;YACzD,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAC9E,IAAI,IAAA,kBAAS,EAAC,CAAC,CAAC;gBAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;;gBACtD,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,2DAA2D,CAAC,CAAC;YAC1F,OAAO,CAAC,CAAC;QACX,CAAC;QACD;YACE,MAAM,IAAI,iBAAQ,CAChB,GAAG;gBACD,CAAC,CAAC,yCAAyC,GAAG,kDAAkD;gBAChG,CAAC,CAAC,gFAAgF,CACrF,CAAC;IACN,CAAC;AACH,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,GAAe,EAAE,IAAgB,EAAE,KAAmB;IAC5F,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IACtB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAChC,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,KAAK,GAAG,IAAA,UAAG,EAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAC9B,MAAM,IAAI,GAAG,IAAA,UAAG,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YAC5B,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,iBAAQ,CAAC,uFAAuF,CAAC,CAAC;YACjI,MAAM,YAAY,GAAG,IAAA,UAAG,EAAC,CAAC,EAAE,eAAe,CAAC,CAAC;YAC7C,MAAM,IAAI,GAAG;gBACX,KAAK;gBACL,IAAI;gBACJ,GAAG,CAAC,IAAA,UAAG,EAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAA,UAAG,EAAC,CAAC,EAAE,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3E,GAAG,CAAC,IAAA,UAAG,EAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAA,UAAG,EAAC,CAAC,EAAE,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvF,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,gBAAgB,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1E,GAAG,UAAU,CAAC,CAAC,CAAC;aACjB,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAe,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC;YAC3F,MAAM,IAAI,GAAG,KAAK,CAAC,eAAe,CAAC,OAAO,EAAE,oBAAoB,OAAO,CAAC,KAAK,IAAI,KAAK,EAAE,CAAC,CAAC;YAC1F,WAAW,CACT,GAAG,EACH,IAAI,EACJ,OAAO,EACP,IAAI,EACJ,6BAA6B,OAAO,CAAC,KAAK,IAAI,KAAK,KAAK,OAAO,CAAC,EAAE,cAAc,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,OAAO,CAAC,WAAW,CAAC,IAAI,KAAK,OAAO,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,IAAA,gBAAO,EAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAC/P,CAAC;YACF,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,EAAE,GAAG,IAAA,mBAAU,EAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,YAAY,CAAC,CAAC;YACzD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CACrC,IAAI,CAAC,GAAG,CAAe,GAAG,IAAI,IAAI,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC7E,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW;oBAAE,MAAM,IAAI,iBAAQ,CAAC,GAAG,EAAE,oEAAoE,CAAC,CAAC;gBAC5H,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBACvD,OAAO,GAAG,CAAC;YACb,CAAC,CAAC,CACH,CAAC;YACF,IAAI,IAAA,kBAAS,EAAC,CAAC,CAAC;gBAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC;;gBACtG,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,0GAA0G,CAAC,CAAC;YACzI,OAAO,CAAC,CAAC;QACX,CAAC;QACD;YACE,MAAM,IAAI,iBAAQ,CAChB,GAAG;gBACD,CAAC,CAAC,gDAAgD,GAAG,4BAA4B;gBACjF,CAAC,CAAC,iEAAiE,CACtE,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACI,KAAK,UAAU,KAAK,CAAC,GAAe,EAAE,IAAgB;IAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,KAAK,KAAK,aAAa,IAAI,KAAK,KAAK,oBAAoB,EAAE,CAAC;QAC9D,MAAM,IAAI,iBAAQ,CAChB,KAAK;YACH,CAAC,CAAC,wBAAwB,KAAK,sEAAsE;YACrG,CAAC,CAAC,+DAA+D,CACpE,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1C,OAAO,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;AACpH,CAAC"}

package/dist/commands/id-accounts.d.ts

@@ -0,0 +1,13 @@
+import { type ParsedArgs } from '../args';
+import type { RunContext } from '../context';
+/**
+ * `atlas id-accounts provision|list|rotate|remove --app <app id>`: test and
+ * review accounts for a Sign in with Atlas app (a directory reviewer login, CI,
+ * a demo). Takes a platform key with `platform:atlas_id_apps:provision`, or a
+ * per-app key scoped `atlas_id_apps:<app id>:provision`.
+ *
+ * The password (yours, via `--password-file`, or one Atlas generates) is
+ * returned once. It is written to a 0600 file next to the CLI's other secrets
+ * and never printed, except with the explicit `--print-secret` opt-out.
+ */
+export declare function idAccounts(ctx: RunContext, args: ParsedArgs): Promise<number>;

package/dist/commands/id-accounts.js

@@ -0,0 +1,195 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.idAccounts = idAccounts;
+const backend_1 = require("@atlasauth/backend");
+const args_1 = require("../args");
+const errors_1 = require("../errors");
+const output_1 = require("../output");
+const project_1 = require("../project");
+const secrets_1 = require("../secrets");
+const shared_1 = require("./shared");
+const MIN_PASSWORD_LENGTH = 12;
+const COLUMNS = [
+    { header: 'ID', get: (a) => a.id },
+    { header: 'EMAIL', get: (a) => a.email ?? '' },
+    { header: 'LABEL', get: (a) => a.label },
+    { header: 'KIND', get: (a) => a.kind },
+    { header: '2FA', get: (a) => (a.two_factor_exempt ? 'exempt' : 'required') },
+    { header: 'EXPIRES', get: (a) => (a.expires_at ? (a.expired ? `${(0, output_1.fmtTime)(a.expires_at)} (expired)` : (0, output_1.fmtTime)(a.expires_at)) : 'never') },
+    { header: 'LAST SIGN-IN', get: (a) => (a.last_sign_in_at ? (0, output_1.fmtTime)(a.last_sign_in_at) : '') },
+];
+const isPlatformKey = (key) => Boolean(key && (key.startsWith('psk_') || /^atlas_(live|test)_psk_/.test(key)));
+/**
+ * The platform key (or a per-app scoped platform key) and API URL:
+ * ATLAS_PLATFORM_KEY, else ATLAS_SECRET_KEY when it is a platform key, else the
+ * profile's stored platform key.
+ */
+function platformAuth(ctx, args) {
+    const file = ctx.config.load();
+    const profile = (0, args_1.str)(args.values, 'profile') || file.active_profile || 'default';
+    const stored = file.profiles[profile];
+    const candidates = [ctx.env.ATLAS_PLATFORM_KEY?.trim(), ctx.env.ATLAS_SECRET_KEY?.trim(), stored?.secret_key];
+    const key = candidates.find(isPlatformKey);
+    if (!key) {
+        throw new errors_1.CliError("id-accounts needs a platform key with the provision scope: platform:atlas_id_apps:provision, or atlas_id_apps:<app id>:provision for one app. Set ATLAS_PLATFORM_KEY, or store one with 'atlas login --secret-key psk_…'.");
+    }
+    return { secretKey: key, apiUrl: (0, shared_1.envApiUrl)(ctx.env) || stored?.api_url || backend_1.DEFAULT_API_URL };
+}
+/** The first non-comment line of a file (or stdin), `NAME=value` or a bare value. */
+function readPasswordFile(ctx, file) {
+    const where = file === '-' ? 'stdin' : file;
+    let text;
+    try {
+        text = ctx.readFile(file === '-' ? '/dev/stdin' : file);
+    }
+    catch {
+        throw new errors_1.CliError(`Could not read the password from ${where}.`);
+    }
+    const line = text.split(/\r?\n/).find((l) => l.trim() && !l.trim().startsWith('#')) ?? '';
+    const m = /^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(line.trim());
+    const password = (m ? m[1] : line).replace(/[\r\n]+$/, '').replace(/^"(.*)"$/, '$1');
+    if (!password)
+        throw new errors_1.CliError(`No password found in ${where}.`);
+    if (password.length < MIN_PASSWORD_LENGTH)
+        throw new errors_1.CliError(`The password in ${where} must be at least ${MIN_PASSWORD_LENGTH} characters.`);
+    return password;
+}
+/** `--expires-at` as the API takes it: epoch ms/seconds stay numeric, anything else is an ISO date. */
+function expiresAt(raw) {
+    if (/^\d+$/.test(raw))
+        return Number(raw);
+    if (Number.isNaN(Date.parse(raw)))
+        throw new errors_1.CliError(`--expires-at must be an ISO 8601 date (2026-12-31) or epoch milliseconds, got '${raw}'.`);
+    return raw;
+}
+/** The response with the password removed: what is safe to print or log. */
+function withoutSecrets(account) {
+    const { password: _p, sealed_password: _s, ...rest } = account;
+    void _p;
+    void _s;
+    return rest;
+}
+/**
+ * `atlas id-accounts provision|list|rotate|remove --app <app id>`: test and
+ * review accounts for a Sign in with Atlas app (a directory reviewer login, CI,
+ * a demo). Takes a platform key with `platform:atlas_id_apps:provision`, or a
+ * per-app key scoped `atlas_id_apps:<app id>:provision`.
+ *
+ * The password (yours, via `--password-file`, or one Atlas generates) is
+ * returned once. It is written to a 0600 file next to the CLI's other secrets
+ * and never printed, except with the explicit `--print-secret` opt-out.
+ */
+async function idAccounts(ctx, args) {
+    const sub = args.positionals[1];
+    const v = args.values;
+    const json = (0, shared_1.wantsJson)(v);
+    const http = () => {
+        const auth = platformAuth(ctx, args);
+        return (0, project_1.httpFor)(ctx, auth);
+    };
+    const appId = () => {
+        const app = (0, args_1.str)(v, 'app');
+        if (!app)
+            throw new errors_1.CliError(`id-accounts ${sub} needs --app <Sign in with Atlas app id>.`);
+        return app;
+    };
+    const base = (app) => `/v1/platform/atlas_id_apps/${encodeURIComponent(app)}/provisioned_accounts`;
+    const accountArg = () => {
+        const id = args.positionals[2];
+        if (!id)
+            throw new errors_1.CliError(`id-accounts ${sub} needs the test account id (see: atlas id-accounts list --app <id>).`);
+        return id;
+    };
+    const deliverPassword = (account, label) => {
+        if (!account.password) {
+            if (account.sealed_password) {
+                ctx.io.err('The password came back sealed to your secret recipient; open it with your key. Nothing was written.');
+            }
+            return undefined;
+        }
+        const entries = {
+            ATLAS_ID_TEST_EMAIL: account.email ?? '',
+            ATLAS_ID_TEST_PASSWORD: account.password,
+        };
+        const io = json ? { out: () => undefined, err: ctx.io.err } : ctx.io;
+        return (0, secrets_1.deliverSecret)({
+            io,
+            env: ctx.env,
+            product: (0, args_1.str)(v, 'product') ?? 'atlasauth',
+            fileName: `id-account-${account.id}.env`,
+            entries,
+            label,
+            printSecret: v['print-secret'] === true,
+            // A rotation always replaces; a fresh account has a fresh id, so nothing to clobber.
+            force: true,
+            comment: `Sign in with Atlas test account ${account.email ?? account.id} (${account.label}). Use it only with the app it was created for.`,
+        }).path;
+    };
+    switch (sub) {
+        case 'list': {
+            const page = await http().get(base(appId()));
+            if (json)
+                (0, output_1.printJson)(ctx.io, page);
+            else {
+                ctx.io.out((0, output_1.renderTable)(COLUMNS, page.data));
+                ctx.io.out(`${page.total} of ${page.limit} test accounts used across your apps.`);
+            }
+            return 0;
+        }
+        case 'provision': {
+            const app = appId();
+            const email = (0, args_1.str)(v, 'email');
+            const label = (0, args_1.str)(v, 'label');
+            if (!email || !label)
+                throw new errors_1.CliError('id-accounts provision needs --email <address> and --label <what it is for, e.g. reviewer>.');
+            const passwordFile = (0, args_1.str)(v, 'password-file');
+            const expires = (0, args_1.str)(v, 'expires-at');
+            const body = {
+                email,
+                label,
+                email_verified: v.unverified === true ? false : true,
+                ...(passwordFile ? { password: readPasswordFile(ctx, passwordFile) } : {}),
+                ...(v['two-factor-exempt'] === true ? { two_factor_exempt: true } : {}),
+                ...(expires ? { expires_at: expiresAt(expires) } : {}),
+            };
+            const created = await http().post(base(app), body);
+            const path = deliverPassword(created, `The password for ${created.email ?? email}`);
+            if (json)
+                (0, output_1.printJson)(ctx.io, { ...withoutSecrets(created), ...(path ? { secret_file: path } : {}) });
+            else {
+                ctx.io.out(`Created ${created.email ?? email} (${created.id}) for app ${app}${created.two_factor_exempt ? ', exempt from two-factor sign-in' : ''}${created.expires_at ? `, expires ${(0, output_1.fmtTime)(created.expires_at)}` : ', never expires'}.`);
+                if (created.two_factor_exempt) {
+                    ctx.io.out('Two-factor exemption: anyone holding this password can sign in to the app. Share it only with the review team.');
+                }
+            }
+            return 0;
+        }
+        case 'rotate': {
+            const app = appId();
+            const id = accountArg();
+            const passwordFile = (0, args_1.str)(v, 'password-file');
+            const rotated = await http().post(`${base(app)}/${encodeURIComponent(id)}/password`, passwordFile ? { password: readPasswordFile(ctx, passwordFile) } : {});
+            const path = deliverPassword(rotated, `The new password for ${rotated.email ?? id}`);
+            if (json)
+                (0, output_1.printJson)(ctx.io, { ...withoutSecrets(rotated), ...(path ? { secret_file: path } : {}) });
+            else
+                ctx.io.out('Existing sessions stay signed in; remove the account to end them.');
+            return 0;
+        }
+        case 'remove': {
+            const app = appId();
+            const id = accountArg();
+            await http().delete(`${base(app)}/${encodeURIComponent(id)}`);
+            if (json)
+                (0, output_1.printJson)(ctx.io, { id, removed: true });
+            else
+                ctx.io.out(`Removed ${id}: the account is deleted and its sessions and grants are revoked.`);
+            return 0;
+        }
+        default:
+            throw new errors_1.CliError(sub
+                ? `Unknown subcommand 'id-accounts ${sub}'. Try: provision, list, rotate, remove.`
+                : 'id-accounts needs a subcommand: provision, list, rotate, remove.');
+    }
+}
+//# sourceMappingURL=id-accounts.js.map

package/dist/commands/id-accounts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"id-accounts.js","sourceRoot":"","sources":["../../src/commands/id-accounts.ts"],"names":[],"mappings":";;AAqFA,gCA6GC;AAlMD,gDAAyH;AACzH,kCAA+C;AAE/C,sCAAqC;AACrC,sCAAyE;AACzE,wCAAqC;AACrC,wCAA2C;AAC3C,qCAAgD;AAEhD,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B,MAAM,OAAO,GAAwC;IACnD,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;IAClC,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE;IAC9C,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE;IACxC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;IACtC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE;IAC5E,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAA,gBAAO,EAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,IAAA,gBAAO,EAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;IACxI,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,IAAA,gBAAO,EAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;CAC9F,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,GAAuB,EAAiB,EAAE,CAC/D,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,yBAAyB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAElF;;;;GAIG;AACH,SAAS,YAAY,CAAC,GAAe,EAAE,IAAgB;IACrD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAG,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,cAAc,IAAI,SAAS,CAAC;IAChF,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IAC9G,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC3C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,iBAAQ,CAChB,2NAA2N,CAC5N,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,GAAG,CAAC,IAAI,MAAM,EAAE,OAAO,IAAI,yBAAe,EAAE,CAAC;AAC9F,CAAC;AAED,qFAAqF;AACrF,SAAS,gBAAgB,CAAC,GAAe,EAAE,IAAY;IACrD,MAAM,KAAK,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5C,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAQ,CAAC,oCAAoC,KAAK,GAAG,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1F,MAAM,CAAC,GAAG,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACtF,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,iBAAQ,CAAC,wBAAwB,KAAK,GAAG,CAAC,CAAC;IACpE,IAAI,QAAQ,CAAC,MAAM,GAAG,mBAAmB;QAAE,MAAM,IAAI,iBAAQ,CAAC,mBAAmB,KAAK,qBAAqB,mBAAmB,cAAc,CAAC,CAAC;IAC9I,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,uGAAuG;AACvG,SAAS,SAAS,CAAC,GAAW;IAC5B,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,iBAAQ,CAAC,kFAAkF,GAAG,IAAI,CAAC,CAAC;IACjJ,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4EAA4E;AAC5E,SAAS,cAAc,CAAC,OAAkC;IACxD,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IAC/D,KAAK,EAAE,CAAC;IACR,KAAK,EAAE,CAAC;IACR,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACI,KAAK,UAAU,UAAU,CAAC,GAAe,EAAE,IAAgB;IAChE,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IACtB,MAAM,IAAI,GAAG,IAAA,kBAAS,EAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,GAAG,EAAE;QAChB,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACrC,OAAO,IAAA,iBAAO,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,MAAM,GAAG,GAAG,IAAA,UAAG,EAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,iBAAQ,CAAC,eAAe,GAAG,2CAA2C,CAAC,CAAC;QAC5F,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,8BAA8B,kBAAkB,CAAC,GAAG,CAAC,uBAAuB,CAAC;IAC3G,MAAM,UAAU,GAAG,GAAG,EAAE;QACtB,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,iBAAQ,CAAC,eAAe,GAAG,sEAAsE,CAAC,CAAC;QACtH,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC;IAEF,MAAM,eAAe,GAAG,CAAC,OAAkC,EAAE,KAAa,EAAsB,EAAE;QAChG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;gBAC5B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,qGAAqG,CAAC,CAAC;YACpH,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,OAAO,GAA2B;YACtC,mBAAmB,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;YACxC,sBAAsB,EAAE,OAAO,CAAC,QAAQ;SACzC,CAAC;QACF,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACrE,OAAO,IAAA,uBAAa,EAAC;YACnB,EAAE;YACF,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,OAAO,EAAE,IAAA,UAAG,EAAC,CAAC,EAAE,SAAS,CAAC,IAAI,WAAW;YACzC,QAAQ,EAAE,cAAc,OAAO,CAAC,EAAE,MAAM;YACxC,OAAO;YACP,KAAK;YACL,WAAW,EAAE,CAAC,CAAC,cAAc,CAAC,KAAK,IAAI;YACvC,qFAAqF;YACrF,KAAK,EAAE,IAAI;YACX,OAAO,EAAE,mCAAmC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,EAAE,KAAK,OAAO,CAAC,KAAK,iDAAiD;SAC3I,CAAC,CAAC,IAAI,CAAC;IACV,CAAC,CAAC;IAEF,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,IAAI,EAAE,CAAC,GAAG,CAAgC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAC5E,IAAI,IAAI;gBAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;iBAC7B,CAAC;gBACJ,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAA,oBAAW,EAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC5C,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,uCAAuC,CAAC,CAAC;YACpF,CAAC;YACD,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAA,UAAG,EAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAC9B,MAAM,KAAK,GAAG,IAAA,UAAG,EAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAC9B,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,iBAAQ,CAAC,4FAA4F,CAAC,CAAC;YACvI,MAAM,YAAY,GAAG,IAAA,UAAG,EAAC,CAAC,EAAE,eAAe,CAAC,CAAC;YAC7C,MAAM,OAAO,GAAG,IAAA,UAAG,EAAC,CAAC,EAAE,YAAY,CAAC,CAAC;YACrC,MAAM,IAAI,GAAG;gBACX,KAAK;gBACL,KAAK;gBACL,cAAc,EAAE,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;gBACpD,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,gBAAgB,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1E,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvD,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,IAAI,EAAE,CAAC,IAAI,CAA4B,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;YAC9E,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,EAAE,oBAAoB,OAAO,CAAC,KAAK,IAAI,KAAK,EAAE,CAAC,CAAC;YACpF,IAAI,IAAI;gBAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;iBAC/F,CAAC;gBACJ,GAAG,CAAC,EAAE,CAAC,GAAG,CACR,WAAW,OAAO,CAAC,KAAK,IAAI,KAAK,KAAK,OAAO,CAAC,EAAE,aAAa,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,IAAA,gBAAO,EAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,GAAG,CAChO,CAAC;gBACF,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;oBAC9B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,gHAAgH,CAAC,CAAC;gBAC/H,CAAC;YACH,CAAC;YACD,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;YACpB,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;YACxB,MAAM,YAAY,GAAG,IAAA,UAAG,EAAC,CAAC,EAAE,eAAe,CAAC,CAAC;YAC7C,MAAM,OAAO,GAAG,MAAM,IAAI,EAAE,CAAC,IAAI,CAA4B,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,gBAAgB,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACvL,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,EAAE,wBAAwB,OAAO,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC;YACrF,IAAI,IAAI;gBAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;;gBAC/F,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;YACrF,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;YACpB,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;YACxB,MAAM,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9D,IAAI,IAAI;gBAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;;gBAC9C,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,mEAAmE,CAAC,CAAC;YAClG,OAAO,CAAC,CAAC;QACX,CAAC;QACD;YACE,MAAM,IAAI,iBAAQ,CAChB,GAAG;gBACD,CAAC,CAAC,mCAAmC,GAAG,0CAA0C;gBAClF,CAAC,CAAC,kEAAkE,CACvE,CAAC;IACN,CAAC;AACH,CAAC"}

package/dist/config-http.d.ts

@@ -22,6 +22,8 @@ export declare function createConfigHttp(opts: {
     secretKey: string;
     apiUrl: string;
     fetch?: typeof fetch;
+    /** Extra request headers (e.g. `X-Secret-Recipient` for sealed secret delivery). */
+    headers?: Record<string, string>;
 }): ConfigHttp;
 /** True when an error is an Atlas 404 — a resource that does not (yet) exist. */
 export declare function isNotFound(err: unknown): boolean;

package/dist/config-http.js

@@ -12,6 +12,7 @@ function createConfigHttp(opts) {
     }
     async function send(method, path, body) {
         const headers = {
+            ...opts.headers,
             authorization: `Bearer ${opts.secretKey}`,
             accept: 'application/json',
         };

package/dist/config-http.js.map

@@ -1 +1 @@
-{"version":3,"file":"config-http.js","sourceRoot":"","sources":["../src/config-http.ts"],"names":[],"mappings":";;AAuBA,4CAqCC;AAoBD,gCAEC;AAlFD,gDAAwE;AAsBxE,8FAA8F;AAC9F,SAAgB,gBAAgB,CAAC,IAIhC;IACC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACjD,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IAED,KAAK,UAAU,IAAI,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACjE,MAAM,OAAO,GAA2B;YACtC,aAAa,EAAE,UAAU,IAAI,CAAC,SAAS,EAAE;YACzC,MAAM,EAAE,kBAAkB;SAC3B,CAAC;QACF,IAAI,OAA2B,CAAC;QAChC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YAC7C,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAc,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAO,CAAC,CAAC,CAAE,SAAe,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO;QACL,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC;QAChC,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC;QAC9C,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC;QAC5C,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;QAChD,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACrB,MAAM,IAAI,CAAO,QAAQ,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,GAAa;IACrC,IAAI,MAAM,GAAqB,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9C,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkC,CAAC;YACjE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM;gBAAE,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QACnF,CAAC;QAAC,MAAM,CAAC;YACP,mBAAmB;QACrB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,wCAAwC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,IAAI,uBAAa,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED,iFAAiF;AACjF,SAAgB,UAAU,CAAC,GAAY;IACrC,OAAO,GAAG,YAAY,uBAAa,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;AAC5D,CAAC"}
+{"version":3,"file":"config-http.js","sourceRoot":"","sources":["../src/config-http.ts"],"names":[],"mappings":";;AAuBA,4CAwCC;AAoBD,gCAEC;AArFD,gDAAwE;AAsBxE,8FAA8F;AAC9F,SAAgB,gBAAgB,CAAC,IAMhC;IACC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACjD,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IAED,KAAK,UAAU,IAAI,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACjE,MAAM,OAAO,GAA2B;YACtC,GAAG,IAAI,CAAC,OAAO;YACf,aAAa,EAAE,UAAU,IAAI,CAAC,SAAS,EAAE;YACzC,MAAM,EAAE,kBAAkB;SAC3B,CAAC;QACF,IAAI,OAA2B,CAAC;QAChC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YAC7C,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAc,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAO,CAAC,CAAC,CAAE,SAAe,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO;QACL,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC;QAChC,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC;QAC9C,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC;QAC5C,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;QAChD,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACrB,MAAM,IAAI,CAAO,QAAQ,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,GAAa;IACrC,IAAI,MAAM,GAAqB,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9C,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkC,CAAC;YACjE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM;gBAAE,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QACnF,CAAC;QAAC,MAAM,CAAC;YACP,mBAAmB;QACrB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,wCAAwC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,IAAI,uBAAa,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED,iFAAiF;AACjF,SAAgB,UAAU,CAAC,GAAY;IACrC,OAAO,GAAG,YAAY,uBAAa,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;AAC5D,CAAC"}

package/dist/config.d.ts

@@ -21,6 +21,8 @@ export interface Profile {
         expires_at: number;
         issuer: string;
     };
+    /** Atlas's own (staff) account id, remembered for `atlas admin` once given. */
+    staff_account_id?: string;
 }
 /** The whole config file: named profiles plus which one is active. */
 export interface ConfigFile {

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":";;;AAoDA,8CAGC;AAvDD,qCAA4E;AAC5E,qCAAkC;AAClC,yCAA0C;AAC1C,qCAAoC;AAyCpC,MAAM,KAAK,GAAe,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAE3C;;;;;GAKG;AACH,SAAgB,iBAAiB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACpE,MAAM,IAAI,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,SAAS,CAAC,CAAC;IACvE,OAAO,IAAA,gBAAI,EAAC,IAAI,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;AAChD,CAAC;AAED,iFAAiF;AACjF,MAAa,eAAe;IACL;IAArB,YAAqB,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;IAErC,IAAI;QACF,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,IAAA,sBAAY,EAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,qDAAqD;YACrD,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;YAC9C,+EAA+E;YAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QACpF,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,iBAAQ,CAChB,kBAAkB,IAAI,CAAC,IAAI,qEAAqE,CACjG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAkB;QACrB,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAChE,uEAAuE;QACvE,wEAAwE;QACxE,uCAAuC;QACvC,IAAA,uBAAa,EAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,IAAA,mBAAS,EAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;CACF;AA9BD,0CA8BC;AAED,kFAAkF;AAClF,MAAa,iBAAiB;IACnB,IAAI,GAAG,UAAU,CAAC;IACnB,IAAI,CAAa;IACzB,YAAY,UAAsB,KAAK;QACrC,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IACD,IAAI;QACF,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,MAAkB;QACrB,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;CACF;AAZD,8CAYC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":";;;AAsDA,8CAGC;AAzDD,qCAA4E;AAC5E,qCAAkC;AAClC,yCAA0C;AAC1C,qCAAoC;AA2CpC,MAAM,KAAK,GAAe,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAE3C;;;;;GAKG;AACH,SAAgB,iBAAiB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACpE,MAAM,IAAI,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,SAAS,CAAC,CAAC;IACvE,OAAO,IAAA,gBAAI,EAAC,IAAI,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;AAChD,CAAC;AAED,iFAAiF;AACjF,MAAa,eAAe;IACL;IAArB,YAAqB,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;IAErC,IAAI;QACF,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,IAAA,sBAAY,EAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,qDAAqD;YACrD,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;YAC9C,+EAA+E;YAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QACpF,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,iBAAQ,CAChB,kBAAkB,IAAI,CAAC,IAAI,qEAAqE,CACjG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAkB;QACrB,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAChE,uEAAuE;QACvE,wEAAwE;QACxE,uCAAuC;QACvC,IAAA,uBAAa,EAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,IAAA,mBAAS,EAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;CACF;AA9BD,0CA8BC;AAED,kFAAkF;AAClF,MAAa,iBAAiB;IACnB,IAAI,GAAG,UAAU,CAAC;IACnB,IAAI,CAAa;IACzB,YAAY,UAAsB,KAAK;QACrC,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IACD,IAAI;QACF,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,MAAkB;QACrB,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;CACF;AAZD,8CAYC"}

package/dist/context.d.ts

@@ -35,6 +35,7 @@ export interface RunContext {
     makeHttp?: (opts: {
         secretKey: string;
         apiUrl: string;
+        headers?: Record<string, string>;
     }) => ConfigHttp;
     /**
      * Read a file's text, for commands that take a path (`atlas actions deploy`

package/dist/context.js

@@ -19,7 +19,7 @@ function defaultContext(overrides = {}) {
         config: new config_1.FileConfigStore((0, config_1.defaultConfigPath)()),
         prompt: (0, prompt_1.defaultPrompter)(),
         makeClient: ({ secretKey, apiUrl }) => (0, backend_1.createAtlasClient)({ secretKey, apiUrl }),
-        makeHttp: ({ secretKey, apiUrl }) => (0, config_http_1.createConfigHttp)({ secretKey, apiUrl }),
+        makeHttp: ({ secretKey, apiUrl, headers }) => (0, config_http_1.createConfigHttp)({ secretKey, apiUrl, headers }),
         readFile: (path) => (0, node_fs_1.readFileSync)(path, 'utf8'),
         ...overrides,
     };

package/dist/context.js.map

@@ -1 +1 @@
-{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":";;AAqEA,wCAWC;AAhFD,qCAAuC;AACvC,gDAAyE;AACzE,qCAAgF;AAChF,+CAAkE;AAClE,6BAA0C;AAC1C,qCAA0D;AA2D1D;;;;GAIG;AACH,SAAgB,cAAc,CAAC,YAAiC,EAAE;IAChE,OAAO;QACL,EAAE,EAAE,IAAA,cAAS,GAAE;QACf,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,MAAM,EAAE,IAAI,wBAAe,CAAC,IAAA,0BAAiB,GAAE,CAAC;QAChD,MAAM,EAAE,IAAA,wBAAe,GAAE;QACzB,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,IAAA,2BAAiB,EAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAC/E,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,IAAA,8BAAgB,EAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAC5E,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC;QAC9C,GAAG,SAAS;KACb,CAAC;AACJ,CAAC"}
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":";;AAqEA,wCAWC;AAhFD,qCAAuC;AACvC,gDAAyE;AACzE,qCAAgF;AAChF,+CAAkE;AAClE,6BAA0C;AAC1C,qCAA0D;AA2D1D;;;;GAIG;AACH,SAAgB,cAAc,CAAC,YAAiC,EAAE;IAChE,OAAO;QACL,EAAE,EAAE,IAAA,cAAS,GAAE;QACf,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,MAAM,EAAE,IAAI,wBAAe,CAAC,IAAA,0BAAiB,GAAE,CAAC;QAChD,MAAM,EAAE,IAAA,wBAAe,GAAE;QACzB,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,IAAA,2BAAiB,EAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAC/E,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,IAAA,8BAAgB,EAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC9F,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC;QAC9C,GAAG,SAAS;KACb,CAAC;AACJ,CAAC"}

package/dist/help.d.ts

@@ -3,6 +3,6 @@
  * out of the handlers so the dispatch code stays about control flow and the
  * copy can be read (and kept consistent) in one place.
  */
-export declare const TOP_HELP = "atlas \u2014 manage an Atlas instance from the terminal\n\nUsage: atlas <command> [subcommand] [arguments] [options]\n\nCommands:\n  login                      Authenticate and store a profile credential\n                             (--device: operator sign-in in the browser, no key stored)\n  token --resource <id>      A one-hour token for one instance/app from your operator sign-in\n  keys whoami|list|create|rotate|revoke|revoke-leaked\n                             Scoped secret keys; new secrets go sealed into 0600 files\n  logout                     Remove a stored profile credential\n  whoami                     Show the active profile and instance\n  users list|get|create|delete\n  orgs list|get|members\n  api-keys list|create|revoke\n  webhooks list|create|upsert|update|test|deliveries|redeliver|replay|rotate|reveal\n  listen --forward-to <url>  Forward live events to your local server, signed (no tunnel)\n  move-origin --from --to    Move an app to a new domain in one step (--dry-run first)\n  csp --framework next|express|nginx\n                             Print the Content Security Policy sources Atlas needs\n  integrations list|get|set|remove|deliveries   Identity integrations (chat, docs, consent, referrals, custom)\n  partner-platforms list|get|set|registration|token|deliveries|remove\n                             This instance as a partner platform (signed consent deliveries in)\n  sessions revoke\n  config export|import|plan  Config-as-code: round-trip the instance's config; plan = drift diff\n  actions list|deploy|test|logs|gallery|show|install|installs|update|publish\n  init                       Create or complete an app's setup (idempotent); secrets to 0600 files\n  preflight                  Check an instance's setup; non-zero exit on errors (for CI)\n  doctor                     Integration health: webhooks, logout, referrals, email, consent (exit 1 on a failure)\n  env                        Print deploy variables: public values + secret file paths\n  client rotate              Rotate an OAuth client secret straight into its file\n  referrals connect|backfill|status\n                             Connect a referral platform, backfill, check the connection\n  status                     Atlas status, incidents that concern the instance and its\n                             upstream status pages; non-zero exit on an outage\n  import --from <vendor> <file>\n                             Move users from Auth0, Clerk, Supabase, Firebase, Cognito,\n                             Auth.js, WorkOS or Better Auth (resumable; --dry-run first)\n  migrate code --from <vendor> [path]\n                             Rewrite an app's auth code onto Atlas (Clerk, Auth.js,\n                             Supabase, Auth0, Better Auth); a dry run with a diff unless --yes\n  migrate better-auth [path] Move a Better Auth app to Atlas end to end: config, users,\n                             sessions and code, resumable (--dry-run, --resume, --yes)\n  migrate better-auth config [path]\n                             Translate the app's betterAuth({...}) options into Atlas\n                             config files plus a report (offline)\n  info [path]                Print the environment for a support ticket (versions, SDKs,\n                             instance, API latency, preflight); secrets redacted\n  mcp install                Add the Atlas MCP server (docs search) to Cursor, Claude Code,\n                             Codex or VS Code\n\nGlobal options:\n  --profile <name>           Use a named profile (default: active, else \"default\")\n  --json                     Emit raw JSON instead of a human table\n  --limit <n>                Page size for list commands that paginate\n  --starting-after <cursor>  Pagination cursor (from a prior page's hint)\n  -h, --help                 Show this help, or help for a command\n  -v, --version              Print the version\n\nEnvironment overrides:\n  ATLAS_SECRET_KEY           Secret key to use instead of the stored one\n  ATLAS_API_BASE             API URL to use instead of the stored one\n  ATLAS_API_URL              Same (the older name); ATLAS_API_BASE wins when both are set\n  ATLAS_PLATFORM_KEY         Platform key (psk_) for atlas init\n  REFERALLI_BASE_URL         Referalli base URL for atlas referrals connect\n  REFERALLI_API_KEY          Referalli merchant key for atlas referrals connect (never stored)\n                             (the old REFERALLY_BASE_URL / REFERALLY_API_KEY still work, with a notice)\n\nSecrets: a command that receives a secret writes it to a 0600 file under\n~/.config/<product>/ and prints only the path. --print-secret prints it instead.\n\nRun 'atlas <command> --help' for command-specific help.";
+export declare const TOP_HELP = "atlas \u2014 manage an Atlas instance from the terminal\n\nUsage: atlas <command> [subcommand] [arguments] [options]\n\nCommands:\n  login                      Authenticate and store a profile credential\n                             (--device: operator sign-in in the browser, no key stored)\n  token --resource <id>      A one-hour token for one instance/app from your operator sign-in\n  keys whoami|list|create|rotate|revoke|revoke-leaked\n                             Scoped secret keys; new secrets go sealed into 0600 files\n  logout                     Remove a stored profile credential\n  whoami                     Show the active profile and instance\n  users list|get|create|delete\n  orgs list|get|members\n  api-keys list|create|revoke\n  webhooks list|create|upsert|update|test|deliveries|redeliver|replay|rotate|reveal\n  listen --forward-to <url>  Forward live events to your local server, signed (no tunnel)\n  move-origin --from --to    Move an app to a new domain in one step (--dry-run first)\n  csp --framework next|express|nginx\n                             Print the Content Security Policy sources Atlas needs\n  integrations list|get|set|remove|deliveries   Identity integrations (chat, docs, consent, referrals, custom)\n  partner-platforms list|get|set|registration|token|deliveries|remove\n                             This instance as a partner platform (signed consent deliveries in)\n  id-accounts provision|list|rotate|remove\n                             Test and review accounts for a Sign in with Atlas app (passwords go to 0600 files)\n  admin id-accounts list|provision|extend|rotate|revoke\n  admin developer-accounts provision|revoke\n                             Atlas staff: accounts for other platforms' integration teams\n                             (operator sign-in with a recent second factor; passwords to 0600 files)\n  sessions revoke\n  config export|import|plan  Config-as-code: round-trip the instance's config; plan = drift diff\n  actions list|deploy|test|logs|gallery|show|install|installs|update|publish\n  init                       Create or complete an app's setup (idempotent); secrets to 0600 files\n  preflight                  Check an instance's setup; non-zero exit on errors (for CI)\n  doctor                     Integration health: webhooks, logout, referrals, email, consent (exit 1 on a failure)\n  env                        Print deploy variables: public values + secret file paths\n  client rotate              Rotate an OAuth client secret straight into its file\n  referrals connect|backfill|status\n                             Connect a referral platform, backfill, check the connection\n  status                     Atlas status, incidents that concern the instance and its\n                             upstream status pages; non-zero exit on an outage\n  import --from <vendor> <file>\n                             Move users from Auth0, Clerk, Supabase, Firebase, Cognito,\n                             Auth.js, WorkOS or Better Auth (resumable; --dry-run first)\n  migrate code --from <vendor> [path]\n                             Rewrite an app's auth code onto Atlas (Clerk, Auth.js,\n                             Supabase, Auth0, Better Auth); a dry run with a diff unless --yes\n  migrate better-auth [path] Move a Better Auth app to Atlas end to end: config, users,\n                             sessions and code, resumable (--dry-run, --resume, --yes)\n  migrate better-auth config [path]\n                             Translate the app's betterAuth({...}) options into Atlas\n                             config files plus a report (offline)\n  info [path]                Print the environment for a support ticket (versions, SDKs,\n                             instance, API latency, preflight); secrets redacted\n  mcp install                Add the Atlas MCP server (docs search) to Cursor, Claude Code,\n                             Codex or VS Code\n\nGlobal options:\n  --profile <name>           Use a named profile (default: active, else \"default\")\n  --json                     Emit raw JSON instead of a human table\n  --limit <n>                Page size for list commands that paginate\n  --starting-after <cursor>  Pagination cursor (from a prior page's hint)\n  -h, --help                 Show this help, or help for a command\n  -v, --version              Print the version\n\nEnvironment overrides:\n  ATLAS_SECRET_KEY           Secret key to use instead of the stored one\n  ATLAS_API_BASE             API URL to use instead of the stored one\n  ATLAS_API_URL              Same (the older name); ATLAS_API_BASE wins when both are set\n  ATLAS_PLATFORM_KEY         Platform key (psk_) for atlas init\n  REFERALLI_BASE_URL         Referalli base URL for atlas referrals connect\n  REFERALLI_API_KEY          Referalli merchant key for atlas referrals connect (never stored)\n                             (the old REFERALLY_BASE_URL / REFERALLY_API_KEY still work, with a notice)\n\nSecrets: a command that receives a secret writes it to a 0600 file under\n~/.config/<product>/ and prints only the path. --print-secret prints it instead.\n\nRun 'atlas <command> --help' for command-specific help.";
 /** Per-command help, keyed by the resource word. */
 export declare const COMMAND_HELP: Record<string, string>;

package/dist/help.js

@@ -29,6 +29,12 @@ Commands:
   integrations list|get|set|remove|deliveries   Identity integrations (chat, docs, consent, referrals, custom)
   partner-platforms list|get|set|registration|token|deliveries|remove
                              This instance as a partner platform (signed consent deliveries in)
+  id-accounts provision|list|rotate|remove
+                             Test and review accounts for a Sign in with Atlas app (passwords go to 0600 files)
+  admin id-accounts list|provision|extend|rotate|revoke
+  admin developer-accounts provision|revoke
+                             Atlas staff: accounts for other platforms' integration teams
+                             (operator sign-in with a recent second factor; passwords to 0600 files)
   sessions revoke
   config export|import|plan  Config-as-code: round-trip the instance's config; plan = drift diff
   actions list|deploy|test|logs|gallery|show|install|installs|update|publish
@@ -408,6 +414,61 @@ and --signature-header are required). "registration" prints what to send the
 partner; the partner registers the receiver and hands back a partner token once.
 "token" stores it encrypted (from a file, stdin with -, or ATLAS_PARTNER_TOKEN);
 it is never printed or shown again.`,
+    admin: `atlas admin — Atlas staff: Sign in with Atlas accounts for other platforms' integration teams
+
+Usage:
+  atlas admin id-accounts list [--team <team>] [--kind provisioned|developer] [--limit <n>] [--json]
+  atlas admin id-accounts provision --email <address> --team <team> (--app <id[,id…]> | --any-app)
+                              [--days <n> | --expires-at <ISO date|epoch ms>] [--two-factor-exempt]
+                              [--password-file <path|->] [--unverified] [--product <name>] [--print-secret] [--json]
+  atlas admin id-accounts extend <account id> [--days <n> | --expires-at <ISO date|epoch ms>] [--json]
+  atlas admin id-accounts rotate <account id> [--password-file <path|->] [--print-secret] [--json]
+  atlas admin id-accounts revoke <account id> [--json]
+  atlas admin developer-accounts provision --email <address> --team <team>
+                              [--account-name <name>] [--application-name <name>]
+                              [--days <n> | --expires-at <ISO date|epoch ms>] [--password-file <path|->] [--json]
+  atlas admin developer-accounts revoke <account id> [--json]
+
+Common: [--profile <name>] [--staff-account <acct_…>] [--no-step-up]
+
+Only owners and admins of Atlas's own account can use these. The credential is your
+operator sign-in ('atlas login --device'), exchanged for a one-hour token on Atlas's
+account (--staff-account, or ATLAS_STAFF_ACCOUNT_ID; remembered on the profile) with
+the platform:atlas_id_apps:provision scope. Every call needs a sign-in verified with a
+second factor; writes need one from the last 5 minutes. When Atlas asks for that, the
+CLI starts the operator sign-in again and retries once (--no-step-up: just fail).
+
+Accounts expire (30 days by default, at most a year; never "never"). An "id-account"
+signs in only to the named apps (or any customer app with --any-app), never to the
+Atlas dashboard, the CLI or account settings. A developer account is a dashboard
+account owning a test application. Passwords come back sealed to a key made for the
+run and are written to a 0600 file (staff-account-<id>.env under ~/.config/<product>/),
+never printed unless you pass --print-secret.`,
+    'id-accounts': `atlas id-accounts — test and review accounts for a Sign in with Atlas app
+
+Usage:
+  atlas id-accounts provision --app <app id> --email <address> --label <purpose>
+                              [--password-file <path|->] [--two-factor-exempt]
+                              [--expires-at <ISO date|epoch ms>] [--unverified]
+                              [--product <name>] [--print-secret] [--json]
+  atlas id-accounts list --app <app id> [--json]
+  atlas id-accounts rotate <account id> --app <app id> [--password-file <path|->]
+                              [--product <name>] [--print-secret] [--json]
+  atlas id-accounts remove <account id> --app <app id> [--json]
+
+For directory and app-store reviewer logins, end-to-end tests in CI, demos and
+partner testing. The account is a real Atlas account that works with THIS app
+only (never other apps, the Atlas dashboard or account settings). Needs a
+platform key scoped platform:atlas_id_apps:provision, or atlas_id_apps:<app id>:provision
+for one app (ATLAS_PLATFORM_KEY, or a psk_ profile from atlas login).
+
+Without --password-file Atlas generates a strong password. Either way the password
+is returned once and written to a 0600 file (id-account-<id>.env under
+~/.config/<product>/); it is never printed unless you pass --print-secret.
+--two-factor-exempt lets the account skip the second factor for this app: anyone who
+holds the password can sign in, so use it only for reviewer logins. Without
+--expires-at the account never expires. "remove" deletes the account and ends its
+sessions and grants.`,
     integrations: `atlas integrations — identity integrations (presets and custom)
 
 Usage:

package/dist/help.js.map

@@ -1 +1 @@
-{"version":3,"file":"help.js","sourceRoot":"","sources":["../src/help.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEU,QAAA,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wDAuEgC,CAAC;AAEzD,oDAAoD;AACvC,QAAA,YAAY,GAA2B;IAClD,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8CAyDmC;IAC5C,IAAI,EAAE;;;;;;;;;;gEAUwD;IAC9D,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2EAmCiE;IACzE,GAAG,EAAE;;;;;;;;;;;;;;;+CAewC;IAC7C,MAAM,EAAE;;;;;;;;;;;;sCAY4B;IACpC,SAAS,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yEAkD4D;IAEvE,KAAK,EAAE;;;;;;;;;;;;;;;;;;;;wEAoB+D;IAEtE,KAAK,EAAE;;;;;4CAKmC;IAE1C,IAAI,EAAE;;;;;;;;;;;;qBAYa;IAEnB,MAAM,EAAE;;uCAE6B;IAErC,MAAM,EAAE;;gDAEsC;IAE9C,KAAK,EAAE;;;;;;wCAM+B;IAEtC,IAAI,EAAE;;;;;uCAK+B;IAErC,UAAU,EAAE;;;;;;8CAMgC;IAE5C,QAAQ,EAAE;;;;;;;;;;;;;;;;;;;;4DAoBgD;IAC1D,MAAM,EAAE;;;;;;;;;;;;gFAYsE;IAC9E,aAAa,EAAE;;;;;;;;;gFAS+D;IAC9E,GAAG,EAAE;;;;;;;;;;;;;;;+DAewD;IAE7D,mBAAmB,EAAE;;;;;;;;;;;;;;;;oCAgBa;IAElC,YAAY,EAAE;;;;;;;;;;;;;;qCAcqB;IAEnC,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yEA+BiE;IAEvE,SAAS,EAAE;;;;;;oDAMuC;IAElD,MAAM,EAAE;;;;;;;;iEAQuD;IAE/D,GAAG,EAAE;;;;;;;;;;mDAU4C;IAEjD,MAAM,EAAE;;;;;;;;wDAQ8C;IAEtD,QAAQ,EAAE;;;8CAGkC;IAE5C,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;8EAyBoE;IAC5E,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;qEA0B0D;CACpE,CAAC"}
+{"version":3,"file":"help.js","sourceRoot":"","sources":["../src/help.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEU,QAAA,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wDA6EgC,CAAC;AAEzD,oDAAoD;AACvC,QAAA,YAAY,GAA2B;IAClD,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8CAyDmC;IAC5C,IAAI,EAAE;;;;;;;;;;gEAUwD;IAC9D,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2EAmCiE;IACzE,GAAG,EAAE;;;;;;;;;;;;;;;+CAewC;IAC7C,MAAM,EAAE;;;;;;;;;;;;sCAY4B;IACpC,SAAS,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yEAkD4D;IAEvE,KAAK,EAAE;;;;;;;;;;;;;;;;;;;;wEAoB+D;IAEtE,KAAK,EAAE;;;;;4CAKmC;IAE1C,IAAI,EAAE;;;;;;;;;;;;qBAYa;IAEnB,MAAM,EAAE;;uCAE6B;IAErC,MAAM,EAAE;;gDAEsC;IAE9C,KAAK,EAAE;;;;;;wCAM+B;IAEtC,IAAI,EAAE;;;;;uCAK+B;IAErC,UAAU,EAAE;;;;;;8CAMgC;IAE5C,QAAQ,EAAE;;;;;;;;;;;;;;;;;;;;4DAoBgD;IAC1D,MAAM,EAAE;;;;;;;;;;;;gFAYsE;IAC9E,aAAa,EAAE;;;;;;;;;gFAS+D;IAC9E,GAAG,EAAE;;;;;;;;;;;;;;;+DAewD;IAE7D,mBAAmB,EAAE;;;;;;;;;;;;;;;;oCAgBa;IAElC,KAAK,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8CA6BqC;IAE5C,aAAa,EAAE;;;;;;;;;;;;;;;;;;;;;;;;qBAwBI;IAEnB,YAAY,EAAE;;;;;;;;;;;;;;qCAcqB;IAEnC,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yEA+BiE;IAEvE,SAAS,EAAE;;;;;;oDAMuC;IAElD,MAAM,EAAE;;;;;;;;iEAQuD;IAE/D,GAAG,EAAE;;;;;;;;;;mDAU4C;IAEjD,MAAM,EAAE;;;;;;;;wDAQ8C;IAEtD,QAAQ,EAAE;;;8CAGkC;IAE5C,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;8EAyBoE;IAC5E,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;qEA0B0D;CACpE,CAAC"}

package/dist/project.d.ts

@@ -58,6 +58,7 @@ export declare function parseInstanceEnv(raw: string | undefined, fallback: Inst
 export declare function httpFor(ctx: RunContext, opts: {
     secretKey: string;
     apiUrl: string;
+    headers?: Record<string, string>;
 }): ConfigHttp;
 /** Read the instance secret key from the project's secret file. */
 export declare function instanceSecretFromFile(instance: ProjectInstance): string;

package/dist/project.js.map

@@ -1 +1 @@
-{"version":3,"file":"project.js","sourceRoot":"","sources":["../src/project.ts"],"names":[],"mappings":";;;AA0CA,oCAEC;AAED,oCAMC;AAED,sCAOC;AAGD,oCAaC;AAkBD,4CAMC;AAGD,0BAEC;AAGD,wDAQC;AArHD,qCAAyF;AACzF,qCAAkC;AAClC,yCAAiC;AACjC,+CAAkE;AAElE,qCAAoC;AACpC,uCAAoD;AAkCvC,QAAA,aAAa,GAAG,YAAY,CAAC;AAE1C,SAAgB,YAAY,CAAC,GAAsB,EAAE,OAAe;IAClE,OAAO,IAAA,gBAAI,EAAC,IAAA,oBAAU,EAAC,GAAG,EAAE,OAAO,CAAC,EAAE,qBAAa,CAAC,CAAC;AACvD,CAAC;AAED,SAAgB,YAAY,CAAC,GAAsB,EAAE,OAAe;IAClE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAoB,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAgB,aAAa,CAAC,GAAsB,EAAE,QAAyB;IAC7E,MAAM,GAAG,GAAG,IAAA,oBAAU,EAAC,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAA,mBAAS,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,qBAAa,CAAC,CAAC;IACtC,IAAA,uBAAa,EAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,IAAA,mBAAS,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+FAA+F;AAC/F,SAAgB,YAAY,CAC1B,GAAsB,EACtB,UAAkB,EAClB,OAAgB;IAEhB,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACzD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;YACrD,IAAI,IAAI,IAAI,IAAI,CAAC,WAAW,KAAK,UAAU;gBAAE,OAAO,EAAE,QAAQ,EAAE,CAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACvF,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,GAAsB;IAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,IAAA,gBAAI,EAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,IAAA,iBAAO,GAAE,EAAE,SAAS,CAAC,CAAC;IAC3F,IAAI,CAAC;QACH,OAAO,IAAA,qBAAW,EAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACpC,IAAI,CAAC;gBACH,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,CAAC,EAAE,qBAAa,CAAC,CAAC,CAAC;gBAC3C,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAgB,gBAAgB,CAAC,GAAuB,EAAE,QAAqB;IAC7E,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACvC,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;QAClD,MAAM,IAAI,iBAAQ,CAAC,0DAA0D,GAAG,IAAI,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6EAA6E;AAC7E,SAAgB,OAAO,CAAC,GAAe,EAAE,IAA2C;IAClF,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,8BAAgB,CAAC,CAAC,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,mEAAmE;AACnE,SAAgB,sBAAsB,CAAC,QAAyB;IAC9D,MAAM,GAAG,GAAG,IAAA,qBAAW,EAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAChE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,iBAAQ,CAChB,0BAA0B,QAAQ,CAAC,WAAW,+DAA+D,CAC9G,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"project.js","sourceRoot":"","sources":["../src/project.ts"],"names":[],"mappings":";;;AA0CA,oCAEC;AAED,oCAMC;AAED,sCAOC;AAGD,oCAaC;AAkBD,4CAMC;AAGD,0BAEC;AAGD,wDAQC;AArHD,qCAAyF;AACzF,qCAAkC;AAClC,yCAAiC;AACjC,+CAAkE;AAElE,qCAAoC;AACpC,uCAAoD;AAkCvC,QAAA,aAAa,GAAG,YAAY,CAAC;AAE1C,SAAgB,YAAY,CAAC,GAAsB,EAAE,OAAe;IAClE,OAAO,IAAA,gBAAI,EAAC,IAAA,oBAAU,EAAC,GAAG,EAAE,OAAO,CAAC,EAAE,qBAAa,CAAC,CAAC;AACvD,CAAC;AAED,SAAgB,YAAY,CAAC,GAAsB,EAAE,OAAe;IAClE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAoB,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAgB,aAAa,CAAC,GAAsB,EAAE,QAAyB;IAC7E,MAAM,GAAG,GAAG,IAAA,oBAAU,EAAC,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAA,mBAAS,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,qBAAa,CAAC,CAAC;IACtC,IAAA,uBAAa,EAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,IAAA,mBAAS,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+FAA+F;AAC/F,SAAgB,YAAY,CAC1B,GAAsB,EACtB,UAAkB,EAClB,OAAgB;IAEhB,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACzD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;YACrD,IAAI,IAAI,IAAI,IAAI,CAAC,WAAW,KAAK,UAAU;gBAAE,OAAO,EAAE,QAAQ,EAAE,CAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACvF,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,GAAsB;IAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,IAAA,gBAAI,EAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,IAAA,iBAAO,GAAE,EAAE,SAAS,CAAC,CAAC;IAC3F,IAAI,CAAC;QACH,OAAO,IAAA,qBAAW,EAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACpC,IAAI,CAAC;gBACH,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,CAAC,EAAE,qBAAa,CAAC,CAAC,CAAC;gBAC3C,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAgB,gBAAgB,CAAC,GAAuB,EAAE,QAAqB;IAC7E,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACvC,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;QAClD,MAAM,IAAI,iBAAQ,CAAC,0DAA0D,GAAG,IAAI,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6EAA6E;AAC7E,SAAgB,OAAO,CAAC,GAAe,EAAE,IAA6E;IACpH,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,8BAAgB,CAAC,CAAC,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,mEAAmE;AACnE,SAAgB,sBAAsB,CAAC,QAAyB;IAC9D,MAAM,GAAG,GAAG,IAAA,qBAAW,EAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAChE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,iBAAQ,CAChB,0BAA0B,QAAQ,CAAC,WAAW,+DAA+D,CAC9G,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/run.js

@@ -24,6 +24,8 @@ const status_1 = require("./commands/status");
 const users_1 = require("./commands/users");
 const webhooks_1 = require("./commands/webhooks");
 const integrations_1 = require("./commands/integrations");
+const id_accounts_1 = require("./commands/id-accounts");
+const admin_1 = require("./commands/admin");
 const partner_platforms_1 = require("./commands/partner-platforms");
 const errors_1 = require("./errors");
 const help_1 = require("./help");
@@ -41,6 +43,8 @@ const COMMANDS = {
     webhooks: webhooks_1.webhooks,
     integrations: integrations_1.integrations,
     'partner-platforms': partner_platforms_1.partnerPlatforms,
+    'id-accounts': id_accounts_1.idAccounts,
+    admin: admin_1.admin,
     sessions: sessions_1.sessions,
     config: config_1.config,
     actions: actions_1.actions,

package/dist/run.js.map

@@ -1 +1 @@
-{"version":3,"file":"run.js","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":";;AAuEA,kBAwCC;AA/GD,gDAAmD;AACnD,iCAAgD;AAChD,gDAA6C;AAC7C,kDAA8C;AAC9C,0CAAwD;AACxD,kDAAkD;AAClD,8CAA2C;AAC3C,0CAAuC;AACvC,8CAAgD;AAChD,0CAAuC;AACvC,wCAAqC;AACrC,8CAA2C;AAC3C,gDAA6C;AAC7C,wDAAoD;AACpD,wCAAqC;AACrC,kEAAoF;AACpF,0CAAuC;AACvC,oDAAiD;AACjD,kDAA+C;AAC/C,8CAA2C;AAC3C,4CAAyC;AACzC,kDAA+C;AAC/C,0DAAuD;AACvD,oEAAgE;AAEhE,qCAAoC;AACpC,iCAAgD;AAChD,uCAAuC;AAKvC,kFAAkF;AAClF,MAAM,QAAQ,GAA4B;IACxC,KAAK,EAAL,YAAK;IACL,MAAM,EAAN,aAAM;IACN,MAAM,EAAN,aAAM;IACN,KAAK,EAAL,gBAAK;IACL,IAAI,EAAJ,eAAI;IACJ,KAAK,EAAL,aAAK;IACL,IAAI,EAAJ,WAAI;IACJ,UAAU,EAAE,kBAAO;IACnB,QAAQ,EAAR,mBAAQ;IACR,YAAY,EAAZ,2BAAY;IACZ,mBAAmB,EAAE,oCAAgB;IACrC,QAAQ,EAAR,mBAAQ;IACR,MAAM,EAAN,eAAM;IACN,OAAO,EAAP,iBAAO;IACP,IAAI,EAAJ,WAAI;IACJ,SAAS,EAAT,4BAAS;IACT,MAAM,EAAN,yBAAM;IACN,GAAG,EAAE,6BAAU;IACf,MAAM,EAAN,yBAAM;IACN,SAAS,EAAT,qBAAS;IACT,MAAM,EAAN,eAAM;IACN,MAAM,EAAE,oBAAW;IACnB,OAAO,EAAP,iBAAO;IACP,IAAI,EAAJ,WAAI;IACJ,GAAG,EAAH,SAAG;IACH,MAAM,EAAN,eAAM;IACN,aAAa,EAAE,wBAAU;IACzB,GAAG,EAAH,SAAG;CACJ,CAAC;AAEF;;;;;;GAMG;AACI,KAAK,UAAU,GAAG,CAAC,IAAc,EAAE,GAAe;IACvD,IAAI,IAAgB,CAAC;IACrB,IAAI,CAAC;QACH,IAAI,GAAG,IAAA,YAAK,EAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,kDAAkD;IAClD,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACxB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAA,oBAAU,GAAE,CAAC,CAAC;QACzB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAEpC,qEAAqE;IACrE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,eAAQ,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,oBAAoB,OAAO,IAAI,CAAC,CAAC;QAC5C,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC5D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,sEAAsE;IACtE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACrB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,mBAAY,CAAC,OAAO,CAAC,IAAI,eAAQ,CAAC,CAAC;QAC9C,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,MAAM,CAAC,GAAe,EAAE,GAAY;IAC3C,IAAI,GAAG,YAAY,uBAAa,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,0BAA0B,GAAG,CAAC,MAAM,IAAI,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3E,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,GAAG,YAAY,iBAAQ,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACpC,OAAO,GAAG,CAAC,QAAQ,CAAC;IACtB,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC;IAChC,OAAO,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":";;AA2EA,kBAwCC;AAnHD,gDAAmD;AACnD,iCAAgD;AAChD,gDAA6C;AAC7C,kDAA8C;AAC9C,0CAAwD;AACxD,kDAAkD;AAClD,8CAA2C;AAC3C,0CAAuC;AACvC,8CAAgD;AAChD,0CAAuC;AACvC,wCAAqC;AACrC,8CAA2C;AAC3C,gDAA6C;AAC7C,wDAAoD;AACpD,wCAAqC;AACrC,kEAAoF;AACpF,0CAAuC;AACvC,oDAAiD;AACjD,kDAA+C;AAC/C,8CAA2C;AAC3C,4CAAyC;AACzC,kDAA+C;AAC/C,0DAAuD;AACvD,wDAAoD;AACpD,4CAAyC;AACzC,oEAAgE;AAEhE,qCAAoC;AACpC,iCAAgD;AAChD,uCAAuC;AAKvC,kFAAkF;AAClF,MAAM,QAAQ,GAA4B;IACxC,KAAK,EAAL,YAAK;IACL,MAAM,EAAN,aAAM;IACN,MAAM,EAAN,aAAM;IACN,KAAK,EAAL,gBAAK;IACL,IAAI,EAAJ,eAAI;IACJ,KAAK,EAAL,aAAK;IACL,IAAI,EAAJ,WAAI;IACJ,UAAU,EAAE,kBAAO;IACnB,QAAQ,EAAR,mBAAQ;IACR,YAAY,EAAZ,2BAAY;IACZ,mBAAmB,EAAE,oCAAgB;IACrC,aAAa,EAAE,wBAAU;IACzB,KAAK,EAAL,aAAK;IACL,QAAQ,EAAR,mBAAQ;IACR,MAAM,EAAN,eAAM;IACN,OAAO,EAAP,iBAAO;IACP,IAAI,EAAJ,WAAI;IACJ,SAAS,EAAT,4BAAS;IACT,MAAM,EAAN,yBAAM;IACN,GAAG,EAAE,6BAAU;IACf,MAAM,EAAN,yBAAM;IACN,SAAS,EAAT,qBAAS;IACT,MAAM,EAAN,eAAM;IACN,MAAM,EAAE,oBAAW;IACnB,OAAO,EAAP,iBAAO;IACP,IAAI,EAAJ,WAAI;IACJ,GAAG,EAAH,SAAG;IACH,MAAM,EAAN,eAAM;IACN,aAAa,EAAE,wBAAU;IACzB,GAAG,EAAH,SAAG;CACJ,CAAC;AAEF;;;;;;GAMG;AACI,KAAK,UAAU,GAAG,CAAC,IAAc,EAAE,GAAe;IACvD,IAAI,IAAgB,CAAC;IACrB,IAAI,CAAC;QACH,IAAI,GAAG,IAAA,YAAK,EAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,kDAAkD;IAClD,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACxB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAA,oBAAU,GAAE,CAAC,CAAC;QACzB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAEpC,qEAAqE;IACrE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,eAAQ,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,oBAAoB,OAAO,IAAI,CAAC,CAAC;QAC5C,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC5D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,sEAAsE;IACtE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACrB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,mBAAY,CAAC,OAAO,CAAC,IAAI,eAAQ,CAAC,CAAC;QAC9C,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,MAAM,CAAC,GAAe,EAAE,GAAY;IAC3C,IAAI,GAAG,YAAY,uBAAa,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,0BAA0B,GAAG,CAAC,MAAM,IAAI,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3E,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,GAAG,YAAY,iBAAQ,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACpC,OAAO,GAAG,CAAC,QAAQ,CAAC;IACtB,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC;IAChC,OAAO,CAAC,CAAC;AACX,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlasauth/cli",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "atlas — manage an Atlas instance from the terminal via the Backend API.",
   "bin": {
     "atlas": "dist/cli.js"
@@ -16,9 +16,9 @@
   },
   "dependencies": {
     "@atlasauth/actions": "0.3.0",
-    "@atlasauth/backend": "0.21.0",
+    "@atlasauth/upgrade": "0.4.0",
     "@atlasauth/referral-conformance": "0.1.0",
-    "@atlasauth/upgrade": "0.4.0"
+    "@atlasauth/backend": "0.22.0"
   },
   "devDependencies": {
     "@types/node": "^22.9.0",
@@ -36,7 +36,7 @@
   ],
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
-    "typecheck": "tsc -p tsconfig.json --noEmit",
-    "test": "vitest run"
+    "typecheck": "tsgo -p tsconfig.json --noEmit --module preserve --moduleResolution bundler --incremental --tsBuildInfoFile node_modules/.cache/typecheck.tsbuildinfo",
+    "test": "vitest run --no-isolate"
   }
 }