@atlasauth/cli 0.23.0 → 0.25.0

package/dist/config-http.js

@@ -1,64 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createConfigHttp = createConfigHttp;
-exports.isNotFound = isNotFound;
-const backend_1 = require("@atlasauth/backend");
-/** The production {@link ConfigHttp}: Bearer-authed `fetch`, mirroring the backend client. */
-function createConfigHttp(opts) {
-    const base = opts.apiUrl.replace(/\/+$/, '');
-    const fetchImpl = opts.fetch ?? globalThis.fetch;
-    if (typeof fetchImpl !== 'function') {
-        throw new Error('No fetch implementation found for the Atlas config client.');
-    }
-    async function send(method, path, body) {
-        const headers = {
-            ...opts.headers,
-            authorization: `Bearer ${opts.secretKey}`,
-            accept: 'application/json',
-        };
-        let payload;
-        if (body !== undefined) {
-            headers['content-type'] = 'application/json';
-            payload = JSON.stringify(body);
-        }
-        const res = await fetchImpl(`${base}${path}`, { method, headers, body: payload });
-        if (!res.ok)
-            throw await toApiError(res);
-        if (res.status === 204)
-            return undefined;
-        const text = await res.text();
-        return (text ? JSON.parse(text) : undefined);
-    }
-    return {
-        get: (path) => send('GET', path),
-        post: (path, body) => send('POST', path, body),
-        put: (path, body) => send('PUT', path, body),
-        patch: (path, body) => send('PATCH', path, body),
-        delete: async (path, body) => {
-            await send('DELETE', path, body);
-        },
-    };
-}
-async function toApiError(res) {
-    let errors = [];
-    const text = await res.text().catch(() => '');
-    if (text) {
-        try {
-            const parsed = JSON.parse(text);
-            if (Array.isArray(parsed.errors) && parsed.errors.length)
-                errors = parsed.errors;
-        }
-        catch {
-            /* non-JSON body */
-        }
-    }
-    if (!errors.length) {
-        errors = [{ code: 'UNKNOWN', message: `Atlas API request failed with status ${res.status}` }];
-    }
-    return new backend_1.AtlasApiError(res.status, errors);
-}
-/** True when an error is an Atlas 404 — a resource that does not (yet) exist. */
-function isNotFound(err) {
-    return err instanceof backend_1.AtlasApiError && err.status === 404;
-}
-//# sourceMappingURL=config-http.js.map

package/dist/config-http.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"config-http.js","sourceRoot":"","sources":["../src/config-http.ts"],"names":[],"mappings":";;AAuBA,4CAwCC;AAoBD,gCAEC;AArFD,gDAAwE;AAsBxE,8FAA8F;AAC9F,SAAgB,gBAAgB,CAAC,IAMhC;IACC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACjD,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IAED,KAAK,UAAU,IAAI,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACjE,MAAM,OAAO,GAA2B;YACtC,GAAG,IAAI,CAAC,OAAO;YACf,aAAa,EAAE,UAAU,IAAI,CAAC,SAAS,EAAE;YACzC,MAAM,EAAE,kBAAkB;SAC3B,CAAC;QACF,IAAI,OAA2B,CAAC;QAChC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YAC7C,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAc,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAO,CAAC,CAAC,CAAE,SAAe,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO;QACL,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC;QAChC,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC;QAC9C,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC;QAC5C,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;QAChD,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YAC3B,MAAM,IAAI,CAAO,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,GAAa;IACrC,IAAI,MAAM,GAAqB,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9C,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkC,CAAC;YACjE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM;gBAAE,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QACnF,CAAC;QAAC,MAAM,CAAC;YACP,mBAAmB;QACrB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,wCAAwC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,IAAI,uBAAa,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED,iFAAiF;AACjF,SAAgB,UAAU,CAAC,GAAY;IACrC,OAAO,GAAG,YAAY,uBAAa,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;AAC5D,CAAC"}

package/dist/config.d.ts

@@ -1,64 +0,0 @@
-/**
- * One stored instance credential. The secret key sits on disk in plaintext —
- * the same trade-off `auth0-cli` and the `gh` CLI make: a long-lived token in a
- * 0600 file under the user's home, not an OS keychain. {@link FileConfigStore}
- * enforces the 0600 so another user on the box cannot read it.
- */
-export interface Profile {
-    api_url: string;
-    secret_key: string;
-    /** When `secret_key` is a one-hour token (from `atlas login --device`), when it expires (Unix ms). */
-    expires_at?: number;
-    /** The resource the short-lived token is bound to (`ins_…`, `app_…`, `acct_…`). */
-    resource?: string;
-    scope?: string;
-    /**
-     * The operator token from `atlas login --device` (short-lived, Unix-ms expiry):
-     * `atlas token` swaps it for resource-bound tokens. Never a long-lived key.
-     */
-    operator?: {
-        access_token: string;
-        expires_at: number;
-        issuer: string;
-    };
-    /** Atlas's own (staff) account id, remembered for `atlas admin` once given. */
-    staff_account_id?: string;
-}
-/** The whole config file: named profiles plus which one is active. */
-export interface ConfigFile {
-    active_profile?: string;
-    profiles: Record<string, Profile>;
-}
-/**
- * The persistence seam. Commands depend on this interface, never on `fs`, so a
- * test injects a store backed by a temp path (or memory) and the real
- * `~/.config/...` file is never touched.
- */
-export interface ConfigStore {
-    /** Where this store reads/writes — surfaced for `login`'s success message. */
-    readonly path: string;
-    load(): ConfigFile;
-    save(config: ConfigFile): void;
-}
-/**
- * Resolve the default config path: `$XDG_CONFIG_HOME/atlasauth/config.json`,
- * falling back to `~/.config/atlasauth/config.json`. Honoring XDG keeps the CLI
- * a good citizen on Linux while still working on macOS, where `~/.config` is
- * the de-facto convention CLIs use.
- */
-export declare function defaultConfigPath(env?: NodeJS.ProcessEnv): string;
-/** The real store: a JSON file written with 0600 perms and a 0700 parent dir. */
-export declare class FileConfigStore implements ConfigStore {
-    readonly path: string;
-    constructor(path: string);
-    load(): ConfigFile;
-    save(config: ConfigFile): void;
-}
-/** An in-memory store for tests that still want to exercise the resolve logic. */
-export declare class MemoryConfigStore implements ConfigStore {
-    readonly path = "<memory>";
-    private data;
-    constructor(initial?: ConfigFile);
-    load(): ConfigFile;
-    save(config: ConfigFile): void;
-}

package/dist/config.js

@@ -1,69 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.MemoryConfigStore = exports.FileConfigStore = void 0;
-exports.defaultConfigPath = defaultConfigPath;
-const node_fs_1 = require("node:fs");
-const node_os_1 = require("node:os");
-const node_path_1 = require("node:path");
-const errors_1 = require("./errors");
-const EMPTY = { profiles: {} };
-/**
- * Resolve the default config path: `$XDG_CONFIG_HOME/atlasauth/config.json`,
- * falling back to `~/.config/atlasauth/config.json`. Honoring XDG keeps the CLI
- * a good citizen on Linux while still working on macOS, where `~/.config` is
- * the de-facto convention CLIs use.
- */
-function defaultConfigPath(env = process.env) {
-    const base = env.XDG_CONFIG_HOME?.trim() || (0, node_path_1.join)((0, node_os_1.homedir)(), '.config');
-    return (0, node_path_1.join)(base, 'atlasauth', 'config.json');
-}
-/** The real store: a JSON file written with 0600 perms and a 0700 parent dir. */
-class FileConfigStore {
-    path;
-    constructor(path) {
-        this.path = path;
-    }
-    load() {
-        let text;
-        try {
-            text = (0, node_fs_1.readFileSync)(this.path, 'utf8');
-        }
-        catch {
-            // Missing file is the first-run state, not an error.
-            return { profiles: {} };
-        }
-        try {
-            const parsed = JSON.parse(text);
-            // Guard against a hand-corrupted file so every later `.profiles[...]` is safe.
-            return { active_profile: parsed.active_profile, profiles: parsed.profiles ?? {} };
-        }
-        catch {
-            throw new errors_1.CliError(`Config file at ${this.path} is not valid JSON. Fix or remove it, then run 'atlas login' again.`);
-        }
-    }
-    save(config) {
-        (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(this.path), { recursive: true, mode: 0o700 });
-        // Write THEN chmod: `mode` on writeFile is masked by umask and skipped
-        // entirely if the file already exists, so an explicit chmod is the only
-        // way to guarantee 0600 on every save.
-        (0, node_fs_1.writeFileSync)(this.path, JSON.stringify(config, null, 2) + '\n', { mode: 0o600 });
-        (0, node_fs_1.chmodSync)(this.path, 0o600);
-    }
-}
-exports.FileConfigStore = FileConfigStore;
-/** An in-memory store for tests that still want to exercise the resolve logic. */
-class MemoryConfigStore {
-    path = '<memory>';
-    data;
-    constructor(initial = EMPTY) {
-        this.data = structuredClone(initial);
-    }
-    load() {
-        return structuredClone(this.data);
-    }
-    save(config) {
-        this.data = structuredClone(config);
-    }
-}
-exports.MemoryConfigStore = MemoryConfigStore;
-//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":";;;AAsDA,8CAGC;AAzDD,qCAA4E;AAC5E,qCAAkC;AAClC,yCAA0C;AAC1C,qCAAoC;AA2CpC,MAAM,KAAK,GAAe,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAE3C;;;;;GAKG;AACH,SAAgB,iBAAiB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACpE,MAAM,IAAI,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,SAAS,CAAC,CAAC;IACvE,OAAO,IAAA,gBAAI,EAAC,IAAI,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;AAChD,CAAC;AAED,iFAAiF;AACjF,MAAa,eAAe;IACL;IAArB,YAAqB,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;IAErC,IAAI;QACF,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,IAAA,sBAAY,EAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,qDAAqD;YACrD,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;YAC9C,+EAA+E;YAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QACpF,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,iBAAQ,CAChB,kBAAkB,IAAI,CAAC,IAAI,qEAAqE,CACjG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAkB;QACrB,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAChE,uEAAuE;QACvE,wEAAwE;QACxE,uCAAuC;QACvC,IAAA,uBAAa,EAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,IAAA,mBAAS,EAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;CACF;AA9BD,0CA8BC;AAED,kFAAkF;AAClF,MAAa,iBAAiB;IACnB,IAAI,GAAG,UAAU,CAAC;IACnB,IAAI,CAAa;IACzB,YAAY,UAAsB,KAAK;QACrC,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IACD,IAAI;QACF,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,MAAkB;QACrB,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;CACF;AAZD,8CAYC"}

package/dist/context.d.ts

@@ -1,72 +0,0 @@
-import { type AtlasClient } from '@atlasauth/backend';
-import { type ConfigStore } from './config';
-import { type ConfigHttp } from './config-http';
-import { type IO } from './io';
-import { type Prompter } from './prompt';
-/**
- * The exact slice of the Backend API client this CLI drives. Narrowed from the
- * full {@link AtlasClient} on purpose: it documents — and the typechecker
- * enforces — that the command set maps only onto namespaces that really exist,
- * and it keeps the fake a test injects small (five namespaces, not forty).
- */
-export type ManagementClient = Pick<AtlasClient, 'users' | 'organizations' | 'apiKeys' | 'webhooks' | 'sessions' | 'actions' | 'actionGallery' | 'actionTemplates' | 'pageTemplates'>;
-/**
- * Everything a command touches the outside world through, in one injectable
- * bag. Production wires the real IO/config/prompt/client; every test builds
- * this with fakes so a handler runs with no network, no TTY and no real
- * `~/.config` file.
- */
-export interface RunContext {
-    io: IO;
-    /** Process environment — read for `ATLAS_SECRET_KEY` / `ATLAS_API_URL`. */
-    env: NodeJS.ProcessEnv;
-    config: ConfigStore;
-    prompt: Prompter;
-    /** Builds the Backend API client from a resolved credential. */
-    makeClient: (opts: {
-        secretKey: string;
-        apiUrl: string;
-    }) => ManagementClient;
-    /**
-     * Builds the raw management-API HTTP client used by `atlas config` (the
-     * config-only `/v1` endpoints the typed client omits). Optional so existing
-     * contexts stay valid; the config command falls back to the real one.
-     */
-    makeHttp?: (opts: {
-        secretKey: string;
-        apiUrl: string;
-        headers?: Record<string, string>;
-    }) => ConfigHttp;
-    /**
-     * Read a file's text, for commands that take a path (`atlas actions deploy`
-     * / `test`). Injectable so a test drives them with an in-memory file instead
-     * of touching the disk. Defaults to reading UTF-8 off the real filesystem.
-     */
-    readFile: (path: string) => string;
-    /**
-     * `fetch` for calls outside the Atlas API (`atlas referrals connect` calls
-     * the referral platform's own API). Optional; defaults to the global fetch.
-     */
-    fetch?: typeof fetch;
-    /** Wait between polls (`--wait`). Optional; defaults to a real timer. */
-    sleep?: (ms: number) => Promise<void>;
-    /**
-     * Run a program with inherited stdio and return its exit code (`atlas migrate
-     * better-auth --run-export` runs the exporter in the app). Optional; defaults
-     * to a real child process.
-     */
-    exec?: (cmd: string, args: string[], opts: {
-        cwd: string;
-    }) => Promise<number>;
-    /**
-     * Stops a long-running command (`atlas listen`). Optional; defaults to an
-     * abort on SIGINT/SIGTERM so Ctrl-C ends the stream cleanly.
-     */
-    signal?: AbortSignal;
-}
-/**
- * The production context, with any piece overridable. Tests call this with a
- * `config` pointed at a temp path and a `makeClient` returning a stub, so the
- * same `run()` path is exercised end to end without side effects.
- */
-export declare function defaultContext(overrides?: Partial<RunContext>): RunContext;

package/dist/context.js

@@ -1,27 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.defaultContext = defaultContext;
-const node_fs_1 = require("node:fs");
-const backend_1 = require("@atlasauth/backend");
-const config_1 = require("./config");
-const config_http_1 = require("./config-http");
-const io_1 = require("./io");
-const prompt_1 = require("./prompt");
-/**
- * The production context, with any piece overridable. Tests call this with a
- * `config` pointed at a temp path and a `makeClient` returning a stub, so the
- * same `run()` path is exercised end to end without side effects.
- */
-function defaultContext(overrides = {}) {
-    return {
-        io: (0, io_1.defaultIO)(),
-        env: process.env,
-        config: new config_1.FileConfigStore((0, config_1.defaultConfigPath)()),
-        prompt: (0, prompt_1.defaultPrompter)(),
-        makeClient: ({ secretKey, apiUrl }) => (0, backend_1.createAtlasClient)({ secretKey, apiUrl }),
-        makeHttp: ({ secretKey, apiUrl, headers }) => (0, config_http_1.createConfigHttp)({ secretKey, apiUrl, headers }),
-        readFile: (path) => (0, node_fs_1.readFileSync)(path, 'utf8'),
-        ...overrides,
-    };
-}
-//# sourceMappingURL=context.js.map

package/dist/context.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":";;AAqEA,wCAWC;AAhFD,qCAAuC;AACvC,gDAAyE;AACzE,qCAAgF;AAChF,+CAAkE;AAClE,6BAA0C;AAC1C,qCAA0D;AA2D1D;;;;GAIG;AACH,SAAgB,cAAc,CAAC,YAAiC,EAAE;IAChE,OAAO;QACL,EAAE,EAAE,IAAA,cAAS,GAAE;QACf,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,MAAM,EAAE,IAAI,wBAAe,CAAC,IAAA,0BAAiB,GAAE,CAAC;QAChD,MAAM,EAAE,IAAA,wBAAe,GAAE;QACzB,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,IAAA,2BAAiB,EAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAC/E,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,IAAA,8BAAgB,EAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC9F,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC;QAC9C,GAAG,SAAS;KACb,CAAC;AACJ,CAAC"}

package/dist/errors.d.ts

@@ -1,15 +0,0 @@
-/**
- * The one error a command handler throws to abort with a clean, user-facing
- * message and a chosen exit code. {@link run} catches it, prints `message` to
- * stderr (no stack), and returns `exitCode` — so a bad flag or a missing key
- * never dumps a stack trace at the terminal the way an uncaught throw would.
- *
- * API failures are NOT CliErrors: they arrive as `AtlasApiError` from
- * `@atlasauth/backend` and {@link run} formats those separately so the stable
- * error `code` and HTTP status survive to the user.
- */
-export declare class CliError extends Error {
-    readonly name = "CliError";
-    readonly exitCode: number;
-    constructor(message: string, exitCode?: number);
-}

package/dist/errors.js

@@ -1,25 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CliError = void 0;
-/**
- * The one error a command handler throws to abort with a clean, user-facing
- * message and a chosen exit code. {@link run} catches it, prints `message` to
- * stderr (no stack), and returns `exitCode` — so a bad flag or a missing key
- * never dumps a stack trace at the terminal the way an uncaught throw would.
- *
- * API failures are NOT CliErrors: they arrive as `AtlasApiError` from
- * `@atlasauth/backend` and {@link run} formats those separately so the stable
- * error `code` and HTTP status survive to the user.
- */
-class CliError extends Error {
-    name = 'CliError';
-    exitCode;
-    constructor(message, exitCode = 1) {
-        super(message);
-        this.exitCode = exitCode;
-        // Keep `instanceof CliError` working under down-level compile targets.
-        Object.setPrototypeOf(this, CliError.prototype);
-    }
-}
-exports.CliError = CliError;
-//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;GASG;AACH,MAAa,QAAS,SAAQ,KAAK;IACf,IAAI,GAAG,UAAU,CAAC;IAC3B,QAAQ,CAAS;IAE1B,YAAY,OAAe,EAAE,QAAQ,GAAG,CAAC;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,uEAAuE;QACvE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;IAClD,CAAC;CACF;AAVD,4BAUC"}

package/dist/help.d.ts

@@ -1,8 +0,0 @@
-/**
- * All help text lives here as plain strings — the CLI's "docs" surface. Kept
- * out of the handlers so the dispatch code stays about control flow and the
- * copy can be read (and kept consistent) in one place.
- */
-export declare const TOP_HELP = "atlas \u2014 manage an Atlas instance from the terminal\n\nUsage: atlas <command> [subcommand] [arguments] [options]\n\nCommands:\n  login                      Authenticate and store a profile credential\n                             (--device: operator sign-in in the browser, no key stored)\n  token --resource <id>      A one-hour token for one instance/app from your operator sign-in\n  keys whoami|list|create|rotate|revoke|revoke-leaked|data|op\n                             Scoped secret keys; new secrets go sealed into 0600 files\n  logout                     Remove a stored profile credential\n  whoami                     Show the active profile and instance\n  users list|get|create|merge|delete\n  orgs list|get|members\n  api-keys list|create|revoke\n  webhooks list|create|upsert|update|test|deliveries|redeliver|replay|rotate|reveal\n  listen --forward-to <url>  Forward live events to your local server, signed (no tunnel)\n  dev [proxy]                Local in-memory Atlas (emulator) / one-origin dev proxy\n  move-origin --from --to    Move an app to a new domain in one step (--dry-run first)\n  workflows list|run|resume|status|templates|approvals|decide\n  chat list|test|links|interactions   Chat approval integrations\n  cloud targets|setup|login <id>      Cloud access portal (AWS, Google Cloud, Azure)\n  device-sso list|show|revoke|delete  Native OS single sign-on registrations\n  connection-actions catalog|list|run|define|remove\n  triggers list|get|create|set|delete Connection triggers\n  agents list|lifecycle|renew|activity|reviews|review-decide ...\n  telemetry show|set|test             OTLP export of gateway and relay calls\n  pdp list|remove                     Local decision points\n  billing coupons|credits ...         Discount codes and account credit\n  audit retention|set-retention       Audit log retention\n  federation show|resolve             OpenID federation\n  vc deferred|approve|deny            Deferred credential issuance\n  csp --framework next|express|nginx\n                             Print the Content Security Policy sources Atlas needs\n  fga test|validate|transform <file>\n  fga export|import|watch|materialize <store>\n                             Run .fga.yaml test suites, validate and convert authorization models\n  integrations list|get|set|remove|deliveries   Identity integrations (chat, docs, consent, referrals, custom)\n  partner-platforms list|get|set|registration|token|deliveries|remove\n                             This instance as a partner platform (signed consent deliveries in)\n  id-accounts provision|list|rotate|remove\n                             Test and review accounts for a Sign in with Atlas app (passwords go to 0600 files)\n  admin id-accounts list|provision|extend|rotate|revoke\n  admin developer-accounts provision|revoke\n                             Atlas staff: accounts for other platforms' integration teams\n                             (operator sign-in with a recent second factor; passwords to 0600 files)\n  sessions revoke\n  config export|import|plan|promote\n                             Config-as-code: round-trip the instance's config; plan = drift diff;\n                             promote = copy one environment's config to another\n  plan [<file|dir>]          Drift diff of a config file or directory; --check exits 2 on drift\n  apply [<file|dir>]         Plan, confirm (--yes to skip), then apply; --check = plan only, exit 2 on drift\n  actions list|deploy|test|logs|gallery|show|install|installs|update|publish\n  pages list|push|preview|promote|pull|discard\n                             Code-defined hosted-page templates: draft, signed preview link, promote\n  init                       Create or complete an app's setup (idempotent); secrets to 0600 files\n  preflight                  Check an instance's setup; non-zero exit on errors (for CI)\n  doctor                     Integration health: webhooks, logout, referrals, email, consent (exit 1 on a failure)\n  golive --origin <url>      Take an instance live for an app origin, step by step; stops at the first failure\n  env                        Print deploy variables: public values + secret file paths\n  client rotate              Rotate an OAuth client secret straight into its file\n  referrals connect|backfill|resync|status\n                             Connect a referral platform, backfill, check the connection\n  status                     Atlas status, incidents that concern the instance and its\n                             upstream status pages; non-zero exit on an outage\n  import --from <vendor> <file>\n                             Move users from Auth0, Clerk, Supabase, Firebase, Cognito,\n                             Auth.js, WorkOS or Better Auth (resumable; --dry-run first)\n  migrate code --from <vendor> [path]\n                             Rewrite an app's auth code onto Atlas (Clerk, Auth.js,\n                             Supabase, Auth0, Better Auth); a dry run with a diff unless --yes\n  migrate better-auth [path] Move a Better Auth app to Atlas end to end: config, users,\n                             sessions and code, resumable (--dry-run, --resume, --yes)\n  migrate better-auth config [path]\n                             Translate the app's betterAuth({...}) options into Atlas\n                             config files plus a report (offline)\n  migrate <vendor> [step] [path]\n                             Move from any vendor (config, export, import, bridge, lazy):\n                             resumable; vendor credentials never leave this machine\n  info [path]                Print the environment for a support ticket (versions, SDKs,\n                             instance, API latency, preflight); secrets redacted\n  mcp install                Add the Atlas MCP server (docs search) to Cursor, Claude Code,\n                             Codex or VS Code\n\nGlobal options:\n  --profile <name>           Use a named profile (default: active, else \"default\")\n  --json                     Emit raw JSON instead of a human table\n  --limit <n>                Page size for list commands that paginate\n  --starting-after <cursor>  Pagination cursor (from a prior page's hint)\n  -h, --help                 Show this help, or help for a command\n  -v, --version              Print the version\n\nEnvironment overrides:\n  ATLAS_SECRET_KEY           Secret key to use instead of the stored one\n  ATLAS_API_BASE             API URL to use instead of the stored one\n  ATLAS_API_URL              Same (the older name); ATLAS_API_BASE wins when both are set\n  ATLAS_PLATFORM_KEY         Platform key (psk_) for atlas init\n  REFERALLI_BASE_URL         Referalli base URL for atlas referrals connect\n  REFERALLI_API_KEY          Referalli merchant key for atlas referrals connect (never stored)\n                             (the old REFERALLY_BASE_URL / REFERALLY_API_KEY still work, with a notice)\n\nSecrets: a command that receives a secret writes it to a 0600 file under\n~/.config/<product>/ and prints only the path. --print-secret prints it instead.\n\nRun 'atlas <command> --help' for command-specific help.";
-/** Per-command help, keyed by the resource word. */
-export declare const COMMAND_HELP: Record<string, string>;