@atlasauth/cli 0.16.0 → 0.18.0

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # @atlasauth/cli changelog
 
+## 0.18.0 — 2026-11-02
+
+### Fixed
+
+- `atlas referrals connect --provider referalli` registers the two-way sync webhook limited to `--program` (`programIds: [<program>]`). It used to register it for every program, so a shared Referalli organization sent other products' referral events to the instance. A webhook an earlier run registered for every program is re-scoped in place.
+- `connect` is idempotent: a second run reuses the instance's existing Referalli connection (one per instance) and sync webhook and updates them in place, never creating a duplicate. A secret the instance does not already hold is rotated on Referalli and saved (never printed). A connection for the instance in another program is refused with the program to use.
+- `connect` sets `tracking_token` (from the Referalli organization) and `link_template` (`{link host}/go/{tracking token}/{code}`, on the active link domain when there is one); a link template set before is kept. What it cannot read is printed as the exact `PATCH /v1/instance/referrals` body left to send (`left_to_do` with `--json`).
+
+### Added
+
+- `connect --link-template <url>`.
+- `atlas referrals status --json` prints a `status` object (connection id, program, webhook endpoint id, URL and program scope, `link_template_set`, `tracking_token_set`, last sync, last test) next to the raw `settings`. The webhook scope is read from Referalli when a merchant key is given (`--referalli-key-file` or `REFERALLI_API_KEY`); otherwise it is `unknown`. The text output shows the link template, tracking token and, when known, the webhook scope.
+
+### Dependencies
+
+- Pulls `@atlasauth/backend` 0.31.0, which depends on the published `@atlasauth/pca` ^0.4.3 instead of the deprecated 0.1.0, and `@atlasauth/upgrade` 0.7.0, which drops the deprecated `jscodeshift` 0.16 chain (`rimraf@2`, `glob@7`, `inflight`).
+
+## 0.17.0 — 2026-10-30
+
+### Added
+
+- `atlas referrals backfill --own-map <file.csv>` and `--own-metadata-path <path>`: keep each user's own referral code (the one they share) through a backfill. The command reports how many were kept and names the customer refs whose code another user already holds.
+
 ## 0.16.0 — 2026-10-30
 
 ### Fixed

package/README.md

@@ -44,6 +44,8 @@ atlas webhooks list | create --url <url> [--events a,b]
 atlas sessions revoke <id>
 atlas config   export [--dir <path>] [--format json|yaml]
 atlas config   import [--dir <path>] [--format json|yaml] [--dry-run] [--prune]
+atlas plan     [<file|dir>] [--check] [--json] [--secrets-file <dotenv>]
+atlas apply    [<file|dir>] [--yes] [--check] [--prune] [--secrets-file <dotenv>] [--out <dir>]
 atlas init     --product <name> [--domain <d>] [--instance-env development|production] ...
 atlas preflight [--instance <id> | --product <name>] [--fail-on error|warning]
 atlas env      --product <name> --format dotenv|coolify|vercel
@@ -133,4 +135,50 @@ Rules that make it safe and repeatable:
 - **Non-destructive.** `import` never deletes without `--prune`, and a resource
   type with no file is left untouched (only committed types are managed).
 
+### One file: `atlas apply` and `atlas plan`
+
+`atlas apply atlas.yaml` takes one JSON or YAML file whose top-level keys are
+the resource types above (or a directory from `config export`), shows the plan,
+asks before applying (`--yes` skips the question; needed without a terminal),
+and applies. Re-running it is a no-op. `atlas plan atlas.yaml` shows the
+field-level diff without writing.
+
+```yaml
+# atlas.yaml
+instance:
+  allowed_origins: [https://app.example.com]
+  auth_config:
+    signUpMode: restricted
+redirect_urls:
+  - url: https://app.example.com/auth/callback
+webhook_endpoints:
+  - url: https://app.example.com/webhooks/atlas
+    enabled_events: [user.created, user.updated, session.revoked]
+```
+
+```sh
+atlas plan atlas.yaml --check     # CI: exit 2 when the instance differs
+atlas apply atlas.yaml            # plan, confirm, apply
+atlas apply atlas.yaml --yes --secrets-file .atlas.secrets   # non-interactive
+```
+
+- **CI gate.** `--check` (on `plan`, `apply` and `config plan`; alias `--exit-code`)
+  exits 2 when there is drift and never writes.
+- **Secrets.** `${VAR}` placeholders resolve from the environment, then from
+  `--secrets-file` (a dotenv file). The file must be readable only by you
+  (`chmod 600`); anything looser is refused. `apply` stops before writing if a
+  placeholder is still unresolved.
+- **New secrets.** When `apply` creates an OAuth client or a webhook endpoint,
+  the one-time `client_secret` / signing secret goes to a mode-0600 dotenv file
+  (`~/.config/atlas`, or `--out <dir>`) and the CLI prints the path.
+- **Order.** The CLI applies resource types in a fixed order: `instance`,
+  `org_settings_schema`, `redirect_urls`, `oauth_clients`, `oauth_providers`,
+  `custom_oauth_providers`, `resource_servers`, `jwt_templates`, `permissions`,
+  `roles`, `webhook_endpoints`, `sso_connections`, `billing_plans`,
+  `notification_templates`, `email_templates`, `organization_policies`. The
+  ordering is done by the CLI, not by the server. The email provider and the
+  `before_user_create` hook are not part of config files: set up the email
+  provider (your own Resend or Brevo account) before you apply sign-in methods
+  that send email, or they stay listed as inactive until you do.
+
 Ship it on push with the [`atlas-deploy` GitHub Action](../../actions/atlas-deploy).

package/dist/args.d.ts

@@ -241,6 +241,9 @@ declare const OPTIONS: {
     readonly 'exit-code': {
         readonly type: "boolean";
     };
+    readonly check: {
+        readonly type: "boolean";
+    };
     readonly provider: {
         readonly type: "string";
     };
@@ -286,6 +289,9 @@ declare const OPTIONS: {
     readonly 'tracking-token': {
         readonly type: "string";
     };
+    readonly 'link-template': {
+        readonly type: "string";
+    };
     readonly 'no-sync': {
         readonly type: "boolean";
     };
@@ -310,6 +316,12 @@ declare const OPTIONS: {
     readonly 'metadata-path': {
         readonly type: "string";
     };
+    readonly 'own-map': {
+        readonly type: "string";
+    };
+    readonly 'own-metadata-path': {
+        readonly type: "string";
+    };
     readonly wait: {
         readonly type: "boolean";
     };

package/dist/args.js

@@ -112,8 +112,9 @@ const OPTIONS = {
     framework: { type: 'string' },
     manifest: { type: 'string', multiple: true },
     'no-atlas': { type: 'boolean' },
-    // config plan.
+    // config plan / plan / apply: exit 2 on drift (`--check` is the CI spelling).
     'exit-code': { type: 'boolean' },
+    check: { type: 'boolean' },
     // referrals connect / backfill.
     provider: { type: 'string' },
     program: { type: 'string' },
@@ -134,6 +135,7 @@ const OPTIONS = {
     'auto-enroll': { type: 'boolean' },
     destination: { type: 'string' },
     'tracking-token': { type: 'string' },
+    'link-template': { type: 'string' },
     'no-sync': { type: 'boolean' },
     'allow-mode-mismatch': { type: 'boolean' },
     endpoint: { type: 'string' },
@@ -142,6 +144,8 @@ const OPTIONS = {
     since: { type: 'string' },
     map: { type: 'string' },
     'metadata-path': { type: 'string' },
+    'own-map': { type: 'string' },
+    'own-metadata-path': { type: 'string' },
     wait: { type: 'boolean' },
     // import --from <vendor>.
     from: { type: 'string' },

package/dist/args.js.map

@@ -1 +1 @@
-{"version":3,"file":"args.js","sourceRoot":"","sources":["../src/args.ts"],"names":[],"mappings":";;AA0PA,sBAeC;AAGD,kBAGC;AAGD,oBAOC;AAGD,sBAQC;AApSD,yCAAsC;AACtC,qCAAoC;AAEpC;;;;;GAKG;AACH,MAAM,OAAO,GAAG;IACd,UAAU;IACV,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACzB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACpC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;IACrC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;IACxC,qDAAqD;IACrD,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACvB,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,uEAAuE;IACvE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,wBAAwB;IACxB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACvB,gBAAgB;IAChB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC/B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,YAAY;IACZ,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAClC,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,0BAA0B;IAC1B,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACvB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC9B,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1B,WAAW;IACX,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,0EAA0E;IAC1E,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAClC,0EAA0E;IAC1E,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1B,mDAAmD;IACnD,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC5B,0CAA0C;IAC1C,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC/B,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAClC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC9B,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,qFAAqF;IACrF,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACpC,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACpC,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;IACrD,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC/B,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;IACpC,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1B,eAAe,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACpC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC7B,gBAAgB;IAChB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC/B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACxB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,+EAA+E;IAC/E,cAAc,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACnC,qCAAqC;IACrC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,mDAAmD;IACnD,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC9B,eAAe;IACf,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACtB,UAAU;IACV,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACjC,OAAO;IACP,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACvB,YAAY;IACZ,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,sDAAsD;IACtD,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,OAAO;IACP,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC7B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC5C,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC/B,eAAe;IACf,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAChC,gCAAgC;IAChC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC9B,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,oBAAoB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxC,mGAAmG;IACnG,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,oBAAoB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxC,kEAAkE;IAClE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,kDAAkD;IAClD,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,uFAAuF;IACvF,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC7B,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAClC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC/B,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACpC,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC9B,qBAAqB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1C,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACvB,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACzB,0BAA0B;IAC1B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAClC,kFAAkF;IAClF,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,mBAAmB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACxC,2CAA2C;IAC3C,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACjC,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,kFAAkF;IAClF,kFAAkF;IAClF,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;IACvC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC3B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;IACxC,iCAAiC;IACjC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,wBAAwB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5C,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACrC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC5B,qBAAqB;IACrB,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC9B,kBAAkB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACtC,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;IACpD,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC3B,kDAAkD;IAClD,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACvB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,mBAAmB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACxC,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC/B,wDAAwD;IACxD,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC9B,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAClC,kBAAkB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACtC,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACjC,kGAAkG;IAClG,kBAAkB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACtC,uBAAuB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3C,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC/B,eAAe,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACpC,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAClC,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACrC,qBAAqB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzC,sBAAsB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1C,0BAA0B,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC9C,kBAAkB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACtC,kBAAkB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACtC,kBAAkB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACtC,mBAAmB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACvC,wBAAwB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC7C,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACpC,kBAAkB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACtC,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACpC,oBAAoB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC/B,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC5B,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAClC,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACrC,qBAAqB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzC,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAClC,kBAAkB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACtC,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACrC,2BAA2B,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAChD,oBAAoB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxC,wBAAwB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5C,kBAAkB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACtC,qBAAqB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzC,eAAe;IACf,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC3B,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAClC,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC3B,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;CACnB,CAAC;AAiBX,6FAA6F;AAC7F,SAAgB,KAAK,CAAC,IAAc;IAClC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,IAAA,qBAAS,EAAC;YACxC,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,OAAO;YAChB,gBAAgB,EAAE,IAAI;YACtB,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,MAAgB,EAAE,WAAW,EAAE,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0EAA0E;QAC1E,8DAA8D;QAC9D,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,iBAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,2CAA2C;AAC3C,SAAgB,GAAG,CAAC,MAAc,EAAE,GAAiB;IACnD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED,mFAAmF;AACnF,SAAgB,IAAI,CAAC,MAAc,EAAE,GAAiB;IACpD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,OAAO,GAAG;SACP,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;SAC5B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,yFAAyF;AACzF,SAAgB,KAAK,CAAC,MAAc;IAClC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,iBAAQ,CAAC,4CAA4C,GAAG,IAAI,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"args.js","sourceRoot":"","sources":["../src/args.ts"],"names":[],"mappings":";;AA8PA,sBAeC;AAGD,kBAGC;AAGD,oBAOC;AAGD,sBAQC;AAxSD,yCAAsC;AACtC,qCAAoC;AAEpC;;;;;GAKG;AACH,MAAM,OAAO,GAAG;IACd,UAAU;IACV,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACzB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACpC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;IACrC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;IACxC,qDAAqD;IACrD,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACvB,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,uEAAuE;IACvE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,wBAAwB;IACxB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACvB,gBAAgB;IAChB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC/B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,YAAY;IACZ,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAClC,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,0BAA0B;IAC1B,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACvB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC9B,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1B,WAAW;IACX,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,0EAA0E;IAC1E,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAClC,0EAA0E;IAC1E,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1B,mDAAmD;IACnD,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC5B,0CAA0C;IAC1C,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC/B,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAClC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC9B,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,qFAAqF;IACrF,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACpC,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACpC,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;IACrD,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC/B,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;IACpC,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1B,eAAe,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACpC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC7B,gBAAgB;IAChB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC/B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACxB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,+EAA+E;IAC/E,cAAc,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACnC,qCAAqC;IACrC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,mDAAmD;IACnD,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC9B,eAAe;IACf,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACtB,UAAU;IACV,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACjC,OAAO;IACP,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACvB,YAAY;IACZ,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,sDAAsD;IACtD,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,OAAO;IACP,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC7B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC5C,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC/B,8EAA8E;IAC9E,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAChC,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1B,gCAAgC;IAChC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC9B,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,oBAAoB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxC,mGAAmG;IACnG,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,oBAAoB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxC,kEAAkE;IAClE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,kDAAkD;IAClD,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,uFAAuF;IACvF,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC7B,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAClC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC/B,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACpC,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC9B,qBAAqB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1C,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACvB,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC7B,mBAAmB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACvC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACzB,0BAA0B;IAC1B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAClC,kFAAkF;IAClF,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,mBAAmB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACxC,2CAA2C;IAC3C,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACjC,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,kFAAkF;IAClF,kFAAkF;IAClF,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;IACvC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC3B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;IACxC,iCAAiC;IACjC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,wBAAwB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5C,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACrC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC5B,qBAAqB;IACrB,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC9B,kBAAkB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACtC,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;IACpD,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC3B,kDAAkD;IAClD,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACvB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,mBAAmB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACxC,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC/B,wDAAwD;IACxD,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC9B,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAClC,kBAAkB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACtC,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACjC,kGAAkG;IAClG,kBAAkB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACtC,uBAAuB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3C,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC/B,eAAe,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACpC,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAClC,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACrC,qBAAqB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzC,sBAAsB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1C,0BAA0B,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC9C,kBAAkB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACtC,kBAAkB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACtC,kBAAkB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACtC,mBAAmB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACvC,wBAAwB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC7C,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACpC,kBAAkB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACtC,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACpC,oBAAoB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC/B,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC5B,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAClC,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACrC,qBAAqB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzC,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAClC,kBAAkB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACtC,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACrC,2BAA2B,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAChD,oBAAoB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxC,wBAAwB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5C,kBAAkB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACtC,qBAAqB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzC,eAAe;IACf,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC3B,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAClC,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC3B,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;CACnB,CAAC;AAiBX,6FAA6F;AAC7F,SAAgB,KAAK,CAAC,IAAc;IAClC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,IAAA,qBAAS,EAAC;YACxC,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,OAAO;YAChB,gBAAgB,EAAE,IAAI;YACtB,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,MAAgB,EAAE,WAAW,EAAE,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0EAA0E;QAC1E,8DAA8D;QAC9D,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,iBAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,2CAA2C;AAC3C,SAAgB,GAAG,CAAC,MAAc,EAAE,GAAiB;IACnD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED,mFAAmF;AACnF,SAAgB,IAAI,CAAC,MAAc,EAAE,GAAiB;IACpD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,OAAO,GAAG;SACP,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;SAC5B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,yFAAyF;AACzF,SAAgB,KAAK,CAAC,MAAc;IAClC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,iBAAQ,CAAC,4CAA4C,GAAG,IAAI,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/commands/config.d.ts

@@ -45,6 +45,30 @@ export interface FieldDiff {
 }
 /** Leaf-level differences between two documents, as dotted paths (arrays compare whole). */
 export declare function diffFields(before: Json | undefined, after: Json | undefined, path?: string): FieldDiff[];
+/**
+ * The environment `${VAR}` placeholders resolve against: the process env, then
+ * `--secrets-file` (a dotenv file) on top. The file holds credentials, so it
+ * must be readable by its owner only (mode 0600 or stricter); anything looser
+ * is refused rather than read. POSIX only: Windows has no such mode bits.
+ */
+export declare function readSecretsEnv(ctx: RunContext, values: Values): NodeJS.ProcessEnv;
+/** `${VAR}` placeholders still in a planned change (no env value and no --secrets-file entry). */
+export declare function unresolvedPlaceholders(changes: Change[]): string[];
+/** The resource types a single config file may hold, in the order they are applied. */
+export declare function configTypes(): string[];
+/**
+ * `atlas plan [<file|dir>]`: the read-only diff of `atlas config plan`, taking
+ * a single config file as well. `--check` exits 2 on drift for CI.
+ */
+export declare function planCommand(ctx: RunContext, args: ParsedArgs): Promise<number>;
+/**
+ * `atlas apply [<file|dir>]`: plan, show it, confirm, then apply in the fixed
+ * resource order (see {@link configTypes}). `--yes` skips the question (needed
+ * when there is no terminal); `--check` only plans and exits 2 on drift.
+ * Refuses to apply while any `${VAR}` placeholder is unresolved, so a missing
+ * secret is never sent as the literal text.
+ */
+export declare function applyCommand(ctx: RunContext, args: ParsedArgs): Promise<number>;
 export declare function printPlan(ctx: RunContext, changes: Change[], unchanged: number, skippedDeletes: Change[], opts: {
     dryRun: boolean;
     prune: boolean;

package/dist/commands/config.js

@@ -4,6 +4,11 @@ exports.config = config;
 exports.resolveFormat = resolveFormat;
 exports.planConfigImport = planConfigImport;
 exports.diffFields = diffFields;
+exports.readSecretsEnv = readSecretsEnv;
+exports.unresolvedPlaceholders = unresolvedPlaceholders;
+exports.configTypes = configTypes;
+exports.planCommand = planCommand;
+exports.applyCommand = applyCommand;
 exports.printPlan = printPlan;
 exports.interpolate = interpolate;
 const node_fs_1 = require("node:fs");
@@ -15,6 +20,7 @@ const errors_1 = require("../errors");
 const serialize_1 = require("../serialize");
 const backend_1 = require("@atlasauth/backend");
 const shared_1 = require("./shared");
+const secrets_1 = require("../secrets");
 // ───────────────────────────── small helpers ─────────────────────────────
 /** GET a `{ data: [...] }` list envelope, tolerating an absent/garbled body. */
 async function listData(http, path) {
@@ -621,7 +627,7 @@ async function config(ctx, args) {
         case 'import':
             return importConfig(ctx, args.values);
         case 'plan':
-            return planConfig(ctx, args.values);
+            return planConfig(ctx, args.values, { dir: resolveDir(args.values), format: resolveFormat(args.values), env: readSecretsEnv(ctx, args.values) });
         case 'promote':
             return promoteConfig(ctx, args.values);
         default:
@@ -817,7 +823,7 @@ async function importConfig(ctx, values) {
     const format = resolveFormat(values);
     const dryRun = values['dry-run'] === true;
     const prune = values.prune === true;
-    const plan = await planConfigImport(http, { dir, format, env: ctx.env, prune });
+    const plan = await planConfigImport(http, { dir, format, env: readSecretsEnv(ctx, values), prune });
     printPlan(ctx, plan.changes, plan.unchanged, plan.skippedDeletes, { dryRun, prune });
     if (dryRun)
         return 0;
@@ -849,12 +855,11 @@ const show = (v) => (v === undefined ? '(unset)' : typeof v === 'string' ? JSON.
  * Field-level for updates, `--json` for tooling, and `--exit-code` to exit 2
  * when there is drift so CI can gate on it. Never writes anything.
  */
-async function planConfig(ctx, values) {
+async function planConfig(ctx, values, source) {
     const http = requireHttp(ctx, values);
-    const dir = resolveDir(values);
-    const format = resolveFormat(values);
+    const { dir, format, env } = source;
     const prune = values.prune === true;
-    const plan = await planConfigImport(http, { dir, format, env: ctx.env, prune });
+    const plan = await planConfigImport(http, { dir, format, env, prune });
     const deletes = prune ? [] : plan.skippedDeletes;
     const all = plan.changes;
     const rows = all.map((c) => ({
@@ -894,7 +899,167 @@ async function planConfig(ctx, values) {
         if (pending === 0)
             ctx.io.out('No drift: the instance matches the config directory.');
     }
-    return values['exit-code'] === true && pending > 0 ? 2 : 0;
+    return wantsCheck(values) && pending > 0 ? 2 : 0;
+}
+/** `--check` (CI) and `--exit-code` (Terraform's name) both mean: exit 2 when there is drift. */
+const wantsCheck = (values) => values['exit-code'] === true || values.check === true;
+/**
+ * The environment `${VAR}` placeholders resolve against: the process env, then
+ * `--secrets-file` (a dotenv file) on top. The file holds credentials, so it
+ * must be readable by its owner only (mode 0600 or stricter); anything looser
+ * is refused rather than read. POSIX only: Windows has no such mode bits.
+ */
+function readSecretsEnv(ctx, values) {
+    const file = (0, args_1.str)(values, 'secrets-file');
+    if (!file)
+        return ctx.env;
+    let mode;
+    try {
+        mode = (0, node_fs_1.statSync)(file).mode;
+    }
+    catch {
+        throw new errors_1.CliError(`--secrets-file not found: ${file}.`);
+    }
+    if (process.platform !== 'win32' && (mode & 0o077) !== 0) {
+        throw new errors_1.CliError(`--secrets-file ${file} is readable by others (mode ${(mode & 0o777).toString(8)}). Run 'chmod 600 ${file}' and try again.`);
+    }
+    return { ...ctx.env, ...(0, secrets_1.parseDotenv)(ctx.readFile(file)) };
+}
+/** `${VAR}` placeholders still in a planned change (no env value and no --secrets-file entry). */
+function unresolvedPlaceholders(changes) {
+    const names = new Set();
+    for (const c of changes) {
+        for (const m of JSON.stringify(c.after ?? null).matchAll(/\$\{([A-Z0-9_]+)\}/g))
+            names.add(m[1]);
+    }
+    return [...names].sort();
+}
+/** The resource types a single config file may hold, in the order they are applied. */
+function configTypes() {
+    return registry().map((s) => s.type);
+}
+/**
+ * Resolve `atlas plan|apply [<path>]`: a directory of per-type files (as
+ * `atlas config export` writes), or ONE file whose top-level keys are resource
+ * types (`instance`, `webhook_endpoints`, …), split into a temp directory.
+ * `cleanup` removes that temp directory.
+ */
+function resolveSource(ctx, args) {
+    const path = args.positionals[1] ?? resolveDir(args.values);
+    const env = readSecretsEnv(ctx, args.values);
+    let isFile = false;
+    try {
+        isFile = (0, node_fs_1.statSync)(path).isFile();
+    }
+    catch {
+        throw new errors_1.CliError(`Config not found: ${path}. Pass a config file (atlas.yaml / atlas.json) or a directory from 'atlas config export'.`);
+    }
+    if (!isFile)
+        return { dir: path, format: resolveFormat(args.values), env, cleanup: () => undefined };
+    const ext = (0, node_path_1.extname)(path).toLowerCase();
+    const format = ext === '.yaml' || ext === '.yml' ? 'yaml' : ext === '.json' ? 'json' : resolveFormat(args.values);
+    const doc = (0, serialize_1.deserialize)(ctx.readFile(path), format);
+    if (doc === null || typeof doc !== 'object' || Array.isArray(doc)) {
+        throw new errors_1.CliError(`${path} must be an object keyed by resource type (${configTypes().join(', ')}).`);
+    }
+    const known = new Set(configTypes());
+    const unknown = Object.keys(doc).filter((k) => !known.has(k));
+    if (unknown.length) {
+        throw new errors_1.CliError(`${path}: unknown resource type(s) ${unknown.join(', ')}. Known: ${configTypes().join(', ')}.`);
+    }
+    const dir = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'atlas-apply-'));
+    for (const [type, value] of Object.entries(doc))
+        (0, node_fs_1.writeFileSync)((0, node_path_1.join)(dir, `${type}.json`), (0, serialize_1.serialize)(value, 'json'));
+    return { dir, format: 'json', env, cleanup: () => (0, node_fs_1.rmSync)(dir, { recursive: true, force: true }) };
+}
+/**
+ * `atlas plan [<file|dir>]`: the read-only diff of `atlas config plan`, taking
+ * a single config file as well. `--check` exits 2 on drift for CI.
+ */
+async function planCommand(ctx, args) {
+    const source = resolveSource(ctx, args);
+    try {
+        return await planConfig(ctx, args.values, source);
+    }
+    finally {
+        source.cleanup();
+    }
+}
+/**
+ * `atlas apply [<file|dir>]`: plan, show it, confirm, then apply in the fixed
+ * resource order (see {@link configTypes}). `--yes` skips the question (needed
+ * when there is no terminal); `--check` only plans and exits 2 on drift.
+ * Refuses to apply while any `${VAR}` placeholder is unresolved, so a missing
+ * secret is never sent as the literal text.
+ */
+async function applyCommand(ctx, args) {
+    const values = args.values;
+    if (values.check === true || values['exit-code'] === true)
+        return planCommand(ctx, args);
+    const source = resolveSource(ctx, args);
+    try {
+        const kept = keepingSecrets(requireHttp(ctx, values), (0, args_1.str)(values, 'out') || (0, secrets_1.productDir)(ctx.env, 'atlas'));
+        const prune = values.prune === true;
+        const plan = await planConfigImport(kept.http, { dir: source.dir, format: source.format, env: source.env, prune });
+        printPlan(ctx, plan.changes, plan.unchanged, plan.skippedDeletes, { dryRun: false, prune });
+        if (plan.changes.length === 0) {
+            ctx.io.out('No changes to apply.');
+            return 0;
+        }
+        const missing = unresolvedPlaceholders(plan.changes);
+        if (missing.length) {
+            throw new errors_1.CliError(`Unresolved placeholder(s): ${missing.map((n) => `\${${n}}`).join(', ')}. Set them in the environment or in --secrets-file.`);
+        }
+        if (values.yes !== true) {
+            const answer = (await ctx.prompt.text(`Apply ${plan.changes.length} change(s)? [y/N]`, { default: 'n' })).trim().toLowerCase();
+            if (answer !== 'y' && answer !== 'yes') {
+                ctx.io.out('Nothing applied.');
+                return 1;
+            }
+        }
+        for (const change of plan.changes)
+            await change.apply();
+        ctx.io.out(`Applied ${plan.changes.length} change(s).`);
+        for (const path of kept.saved)
+            ctx.io.out(`A new secret was written to ${path} (mode 0600). It is shown only once.`);
+        return 0;
+    }
+    finally {
+        source.cleanup();
+    }
+}
+/**
+ * The API, but a create that answers with a one-time secret (a new OAuth
+ * client's `client_secret`, a new webhook endpoint's `secret`) writes it to a
+ * 0600 dotenv file in `dir` (default `~/.config/atlas`, or `--out`) instead of
+ * dropping it. The file names are the hosted-redirect env names.
+ */
+function keepingSecrets(http, dir) {
+    const saved = [];
+    const wrapped = {
+        get: (path) => http.get(path),
+        put: (path, body) => http.put(path, body),
+        patch: (path, body) => http.patch(path, body),
+        delete: (path, body) => http.delete(path, body),
+        async post(path, body) {
+            const res = await http.post(path, body);
+            const r = (res ?? {});
+            const id = String(r.id ?? r.client_id ?? 'new').replace(/[^A-Za-z0-9_-]/g, '_');
+            let entries = null;
+            if (path === '/v1/oauth_clients' && typeof r.client_secret === 'string') {
+                entries = { ATLAS_CLIENT_ID: String(r.client_id ?? ''), ATLAS_CLIENT_SECRET: r.client_secret };
+            }
+            else if (path === '/v1/webhook_endpoints' && typeof r.secret === 'string') {
+                entries = { ATLAS_WEBHOOK_SECRET: r.secret };
+            }
+            if (entries) {
+                const kind = path === '/v1/oauth_clients' ? 'oauth-client' : 'webhook';
+                saved.push((0, secrets_1.writeSecretFile)(dir, `${kind}-${id}.env`, entries, { comment: `Written by atlas apply. ${kind} ${id}.` }).path);
+            }
+            return res;
+        },
+    };
+    return { http: wrapped, saved };
 }
 function printPlan(ctx, changes, unchanged, skippedDeletes, opts) {
     const heading = opts.dryRun ? 'Plan (dry run — nothing applied):' : 'Plan:';