@atlasauth/cli 0.24.0 → 0.25.0

package/dist/migrate/zitadel/plugin.js

@@ -1,114 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.zitadelPlugin = void 0;
-const node_path_1 = require("node:path");
-const errors_1 = require("../../errors");
-const zitadel_1 = require("../export/zitadel");
-const zitadel_config_1 = require("../export/zitadel-config");
-const plugin_kit_1 = require("../export/plugin-kit");
-/**
- * `atlas migrate zitadel` — ZITADEL Cloud and self-hosted ZITADEL: policies,
- * applications, project roles and identity providers as Atlas config; users
- * with their password hashes, TOTP secrets, verified email and phone, social
- * and enterprise links, project roles (as app roles) and organizations with
- * their members, from ZITADEL's own export (a file, or the admin API with a
- * service-user token); a zero-logout bridge for ZITADEL ID tokens and JWT
- * access tokens; lazy migration through the session API; and the code. The
- * token stays on this machine.
- */
-const URL_SPEC = { flag: '--zitadel-url', env: 'ZITADEL_URL', label: 'your ZITADEL URL (https://<instance>.zitadel.cloud, or your own domain)', required: false };
-const TOKEN = { flag: '--zitadel-token', env: 'ZITADEL_TOKEN', label: 'a service user\'s personal access token (IAM_OWNER to export, IAM_LOGIN_CLIENT for lazy migration)', required: false, secret: true };
-const EXPORT_FILE = { flag: '--zitadel-export', env: 'ZITADEL_EXPORT_FILE', label: 'the JSON file `zitadel export` wrote (or a saved POST /admin/v1/export response)', required: false };
-const ORGS = { flag: '--zitadel-orgs', env: 'ZITADEL_ORGS', label: 'how organizations move: auto (when there is more than one), all or skip', required: false };
-function instanceUrl(p) {
-    const raw = p.credential(URL_SPEC);
-    return raw ? (0, zitadel_1.zitadelBase)(raw) : undefined;
-}
-function orgsMode(p) {
-    const raw = (p.credential(ORGS) ?? 'auto').trim().toLowerCase();
-    if (raw !== 'auto' && raw !== 'all' && raw !== 'skip')
-        throw new errors_1.CliError(`ZITADEL: --set zitadel-orgs takes auto, all or skip (got ${raw}).`);
-    return raw;
-}
-function readDocument(p, path) {
-    try {
-        return JSON.parse(p.ctx.readFile((0, node_path_1.resolve)(path)));
-    }
-    catch (err) {
-        throw new errors_1.CliError(`ZITADEL: could not read the export ${path}: ${err.message}`);
-    }
-}
-exports.zitadelPlugin = {
-    vendor: 'zitadel',
-    source: 'zitadel',
-    label: 'ZITADEL',
-    help: 'Move ZITADEL (Cloud or self-hosted): login, password and lockout policy, applications, project roles and identity providers as Atlas config; users with password hashes, TOTP secrets, verified email and phone, social and enterprise links, roles and organizations from ZITADEL\'s own export; a zero-logout bridge for ZITADEL ID tokens and JWT access tokens; lazy migration through the session API; and the code. Your service-user token stays on this machine.',
-    config: {
-        reads: 'a `zitadel export` file, or your instance through the admin API (policies, applications, roles, identity providers, actions)',
-        credentials: [EXPORT_FILE, URL_SPEC, TOKEN],
-        async translate(p) {
-            const file = p.credential(EXPORT_FILE);
-            const url = instanceUrl(p);
-            if (file)
-                return (0, zitadel_config_1.translateZitadelConfig)((0, zitadel_config_1.configSnapshotFromExport)(readDocument(p, file), file, url));
-            const token = p.credential(TOKEN);
-            if (!url || !token) {
-                throw new errors_1.CliError('ZITADEL: pass the export file (--set zitadel-export=<file>), or your instance URL and a service-user token (--set zitadel-url=… --set zitadel-token=…).');
-            }
-            return (0, zitadel_config_1.translateZitadelConfig)(await (0, plugin_kit_1.vendorStep)('ZITADEL', () => (0, zitadel_config_1.fetchZitadelConfig)({ instance: url, token, fetchImpl: p.fetch })));
-        },
-    },
-    export: {
-        reads: 'ZITADEL\'s export (a `zitadel export` file, or POST /admin/v1/export with a service-user token)',
-        credentials: [EXPORT_FILE, URL_SPEC, TOKEN, ORGS],
-        limits: [
-            'Passkeys and security keys live only in ZITADEL\'s event store and are not exported: users register a passkey again.',
-            'Password hashes and TOTP secrets need the export with passwords and secrets on (`zitadel export`, or an IAM_OWNER token on the admin API). With a narrower role the export lists users through the user API instead, and passwords move by lazy migration.',
-            'Machine users (service accounts) are not exported: recreate them as Atlas API keys or M2M clients.',
-            'Organizations become Atlas organizations when the instance has more than one (--set zitadel-orgs=all to always, skip to never); organization roles other than ORG_OWNER join as plain members.',
-            'Sessions are opaque to Atlas: the bridge accepts ZITADEL ID tokens and JWT access tokens instead.',
-        ],
-        async run(p, writer, resume) {
-            const file = p.credential(EXPORT_FILE);
-            const orgs = orgsMode(p);
-            let set;
-            if (file) {
-                const url = instanceUrl(p);
-                set = await (0, plugin_kit_1.vendorStep)('ZITADEL', async () => (0, zitadel_1.mapZitadel)({ ...(0, zitadel_1.readZitadelExport)(readDocument(p, file)), instance: url }, { orgs }));
-            }
-            else {
-                const url = instanceUrl(p);
-                if (!url)
-                    throw new errors_1.CliError('ZITADEL: pass the export file (--set zitadel-export=<file>), or your instance URL and a service-user token (--set zitadel-url=… --set zitadel-token=…).');
-                const token = (0, plugin_kit_1.need)(p, TOKEN);
-                set = await (0, plugin_kit_1.vendorStep)('ZITADEL', () => (0, zitadel_1.exportZitadelApi)({ instance: url, token, orgs, fetchImpl: p.fetch, onProgress: (m) => p.say(`  reading ${m}`) }));
-            }
-            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
-        },
-    },
-    bridge: {
-        preset: 'zitadel',
-        vars(p, t) {
-            const vars = { ...t?.bridge?.vars };
-            const url = instanceUrl(p);
-            if (url)
-                vars.issuer = url;
-            if (!vars.issuer)
-                throw new errors_1.CliError('ZITADEL: the bridge needs the issuer: pass your instance URL (--set zitadel-url=https://<instance>.zitadel.cloud).');
-            return vars;
-        },
-    },
-    lazy: {
-        preset: 'zitadel',
-        config(p, t) {
-            const config = { ...t?.lazy?.config };
-            const url = instanceUrl(p);
-            if (url)
-                config.base_url = url;
-            return config;
-        },
-        secret: TOKEN,
-    },
-    codemod: 'zitadel',
-};
-//# sourceMappingURL=plugin.js.map

package/dist/migrate/zitadel/plugin.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/zitadel/plugin.ts"],"names":[],"mappings":";;;AAAA,yCAAoC;AACpC,yCAAwC;AACxC,+CAAyH;AACzH,6DAAgH;AAChH,qDAAwE;AAIxE;;;;;;;;;GASG;AAEH,MAAM,QAAQ,GAAmB,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,yEAAyE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAClL,MAAM,KAAK,GAAmB,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,oGAAoG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC5N,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,kFAAkF,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACzM,MAAM,IAAI,GAAmB,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,yEAAyE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAEhL,SAAS,WAAW,CAAC,CAAgB;IACnC,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACnC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAA,qBAAW,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC;AAED,SAAS,QAAQ,CAAC,CAAgB;IAChC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChE,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,MAAM;QAAE,MAAM,IAAI,iBAAQ,CAAC,4DAA4D,GAAG,IAAI,CAAC,CAAC;IAC/I,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,CAAgB,EAAE,IAAY;IAClD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC,CAAY,CAAC;IAC9D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,iBAAQ,CAAC,sCAAsC,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9F,CAAC;AACH,CAAC;AAEY,QAAA,aAAa,GAAoB;IAC5C,MAAM,EAAE,SAAS;IACjB,MAAM,EAAE,SAAS;IACjB,KAAK,EAAE,SAAS;IAChB,IAAI,EAAE,0cAA0c;IAChd,MAAM,EAAE;QACN,KAAK,EAAE,8HAA8H;QACrI,WAAW,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC;QAC3C,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YACvC,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,IAAI;gBAAE,OAAO,IAAA,uCAAsB,EAAC,IAAA,yCAAwB,EAAC,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;YACpG,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAClC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,IAAI,iBAAQ,CAAC,yJAAyJ,CAAC,CAAC;YAChL,CAAC;YACD,OAAO,IAAA,uCAAsB,EAAC,MAAM,IAAA,uBAAU,EAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAA,mCAAkB,EAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QACrI,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,iGAAiG;QACxG,WAAW,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC;QACjD,MAAM,EAAE;YACN,sHAAsH;YACtH,4PAA4P;YAC5P,oGAAoG;YACpG,gMAAgM;YAChM,mGAAmG;SACpG;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,GAAc,CAAC;YACnB,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;gBAC3B,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,IAAA,oBAAU,EAAC,EAAE,GAAG,IAAA,2BAAiB,EAAC,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACtI,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;gBAC3B,IAAI,CAAC,GAAG;oBAAE,MAAM,IAAI,iBAAQ,CAAC,yJAAyJ,CAAC,CAAC;gBACxL,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBAC7B,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAA,0BAAgB,EAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5J,CAAC;YACD,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,SAAS;QACjB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,GAA2B,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC5D,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,GAAG;gBAAE,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC;YAC3B,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,iBAAQ,CAAC,oHAAoH,CAAC,CAAC;YAC3J,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,SAAS;QACjB,MAAM,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,MAAM,GAA2B,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9D,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,GAAG;gBAAE,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC;YAC/B,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,EAAE,KAAK;KACd;IACD,OAAO,EAAE,SAAS;CACnB,CAAC"}

package/dist/output.d.ts

@@ -1,41 +0,0 @@
-import type { IO } from './io';
-/**
- * A single rendered column: a header plus a getter that pulls the raw value off
- * a row. Getters (not keys) because a few columns are derived — a user's name
- * joins first + last, a webhook's events join an array — and a getter keeps that
- * shaping next to the column instead of forcing a pre-massaged row.
- */
-export interface Column<T> {
-    header: string;
-    get: (row: T) => unknown;
-}
-/**
- * Epoch-millisecond timestamp → ISO-8601, the form every Atlas `*_at` field
- * takes on the wire. Blank for null (e.g. a user who never signed in) so the
- * column stays readable rather than printing `1970-...`.
- */
-export declare function fmtTime(value: unknown): string;
-/**
- * Hand-rolled fixed-width table — the only "formatting library" this CLI has.
- * Columns are padded to the widest cell (header included); a dashed rule sits
- * under the header; trailing padding on the last column is trimmed so lines
- * don't carry invisible whitespace. Empty input prints a friendly placeholder
- * rather than a bare header with no rows.
- */
-export declare function renderTable<T>(columns: Column<T>[], rows: T[]): string;
-/** Pretty-print any value as the `--json` output on stdout. */
-export declare function printJson(io: IO, value: unknown): void;
-/**
- * Print a cursor-paginated list as either raw JSON or a table, and — in table
- * mode, when there is another page — a footer naming the exact flag to fetch
- * it. Keeping the hint next to the data is what makes `--starting-after`
- * discoverable without the user reading `--help`.
- */
-export declare function printList<T>(io: IO, opts: {
-    json: boolean;
-    columns: Column<T>[];
-}, page: {
-    data: T[];
-    has_more?: boolean;
-    next_cursor?: string | null;
-}, raw?: unknown): void;

package/dist/output.js

@@ -1,72 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.fmtTime = fmtTime;
-exports.renderTable = renderTable;
-exports.printJson = printJson;
-exports.printList = printList;
-/** Render a value as a table cell: null/undefined blank, arrays joined, objects JSON. */
-function cell(value) {
-    if (value === null || value === undefined)
-        return '';
-    if (Array.isArray(value))
-        return value.map((v) => cell(v)).join(', ');
-    if (typeof value === 'object')
-        return JSON.stringify(value);
-    return String(value);
-}
-/**
- * Epoch-millisecond timestamp → ISO-8601, the form every Atlas `*_at` field
- * takes on the wire. Blank for null (e.g. a user who never signed in) so the
- * column stays readable rather than printing `1970-...`.
- */
-function fmtTime(value) {
-    if (value === null || value === undefined)
-        return '';
-    const n = Number(value);
-    if (!Number.isFinite(n))
-        return '';
-    return new Date(n).toISOString();
-}
-/**
- * Hand-rolled fixed-width table — the only "formatting library" this CLI has.
- * Columns are padded to the widest cell (header included); a dashed rule sits
- * under the header; trailing padding on the last column is trimmed so lines
- * don't carry invisible whitespace. Empty input prints a friendly placeholder
- * rather than a bare header with no rows.
- */
-function renderTable(columns, rows) {
-    if (rows.length === 0)
-        return '(no results)';
-    const matrix = rows.map((row) => columns.map((col) => cell(col.get(row))));
-    const widths = columns.map((col, i) => Math.max(col.header.length, ...matrix.map((r) => r[i].length)));
-    const pad = (text, width) => text.padEnd(width);
-    const line = (fields) => fields.map((f, i) => pad(f, widths[i])).join('  ').replace(/\s+$/, '');
-    const lines = [
-        line(columns.map((c) => c.header)),
-        line(widths.map((w) => '-'.repeat(w))),
-        ...matrix.map((r) => line(r)),
-    ];
-    return lines.join('\n');
-}
-/** Pretty-print any value as the `--json` output on stdout. */
-function printJson(io, value) {
-    io.out(JSON.stringify(value, null, 2));
-}
-/**
- * Print a cursor-paginated list as either raw JSON or a table, and — in table
- * mode, when there is another page — a footer naming the exact flag to fetch
- * it. Keeping the hint next to the data is what makes `--starting-after`
- * discoverable without the user reading `--help`.
- */
-function printList(io, opts, page, raw = page) {
-    if (opts.json) {
-        printJson(io, raw);
-        return;
-    }
-    io.out(renderTable(opts.columns, page.data));
-    if (page.has_more && page.next_cursor) {
-        io.out('');
-        io.out(`More results — fetch the next page with: --starting-after ${page.next_cursor}`);
-    }
-}
-//# sourceMappingURL=output.js.map

package/dist/output.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"output.js","sourceRoot":"","sources":["../src/output.ts"],"names":[],"mappings":";;AA0BA,0BAKC;AASD,kCAkBC;AAGD,8BAEC;AAQD,8BAeC;AAzED,yFAAyF;AACzF,SAAS,IAAI,CAAC,KAAc;IAC1B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,SAAgB,OAAO,CAAC,KAAc;IACpC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrD,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACxB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,WAAW,CAAI,OAAoB,EAAE,IAAS;IAC5D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,cAAc,CAAC;IAE7C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CACpC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC,CAAC,CAChE,CAAC;IAEF,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,CAAC,MAAgB,EAAE,EAAE,CAChC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAE1E,MAAM,KAAK,GAAG;QACZ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACtC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;KAC9B,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,+DAA+D;AAC/D,SAAgB,SAAS,CAAC,EAAM,EAAE,KAAc;IAC9C,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACzC,CAAC;AAED;;;;;GAKG;AACH,SAAgB,SAAS,CACvB,EAAM,EACN,IAA6C,EAC7C,IAAoE,EACpE,MAAe,IAAI;IAEnB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACnB,OAAO;IACT,CAAC;IACD,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7C,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACtC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACX,EAAE,CAAC,GAAG,CAAC,6DAA6D,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC"}

package/dist/project.d.ts

@@ -1,64 +0,0 @@
-import { type ConfigHttp } from './config-http';
-import type { RunContext } from './context';
-/**
- * The project manifest `atlas init` keeps at `~/.config/<product>/atlas.json`:
- * PUBLIC values only (ids, publishable key, hosts, redirect URIs) plus the path
- * of each secret file. `atlas env`, `atlas preflight --instance` and
- * `atlas client rotate` read it, so they know where a secret lives without
- * ever holding it in the manifest.
- */
-export type InstanceEnv = 'development' | 'production';
-export interface ProjectInstance {
-    instance_id: string;
-    environment: InstanceEnv;
-    publishable_key: string;
-    frontend_api_host: string | null;
-    issuer: string | null;
-    discovery_url: string | null;
-    jwks_uri: string | null;
-    /** The file holding ATLAS_SECRET_KEY. */
-    secret_file: string;
-    oauth_client?: {
-        id: string;
-        client_id: string;
-        redirect_uris: string[];
-        secret_file: string | null;
-    };
-    webhook?: {
-        id: string;
-        url: string;
-        secret_file: string | null;
-    };
-    custom_domain?: {
-        host: string;
-        cname_target: string | null;
-        status: string;
-    };
-    email?: {
-        mode: 'managed' | 'development' | 'none';
-        from_address?: string | null;
-    };
-}
-export interface ProjectManifest {
-    product: string;
-    api_url: string;
-    instances: Partial<Record<InstanceEnv, ProjectInstance>>;
-}
-export declare const MANIFEST_FILE = "atlas.json";
-export declare function manifestPath(env: NodeJS.ProcessEnv, product: string): string;
-export declare function readManifest(env: NodeJS.ProcessEnv, product: string): ProjectManifest | undefined;
-export declare function writeManifest(env: NodeJS.ProcessEnv, manifest: ProjectManifest): string;
-/** Find the project + instance an instance id belongs to, scanning every product directory. */
-export declare function findInstance(env: NodeJS.ProcessEnv, instanceId: string, product?: string): {
-    manifest: ProjectManifest;
-    instance: ProjectInstance;
-} | undefined;
-export declare function parseInstanceEnv(raw: string | undefined, fallback: InstanceEnv): InstanceEnv;
-/** The raw HTTP client for a credential (the context's, or the real one). */
-export declare function httpFor(ctx: RunContext, opts: {
-    secretKey: string;
-    apiUrl: string;
-    headers?: Record<string, string>;
-}): ConfigHttp;
-/** Read the instance secret key from the project's secret file. */
-export declare function instanceSecretFromFile(instance: ProjectInstance): string;

package/dist/project.js

@@ -1,86 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.MANIFEST_FILE = void 0;
-exports.manifestPath = manifestPath;
-exports.readManifest = readManifest;
-exports.writeManifest = writeManifest;
-exports.findInstance = findInstance;
-exports.parseInstanceEnv = parseInstanceEnv;
-exports.httpFor = httpFor;
-exports.instanceSecretFromFile = instanceSecretFromFile;
-const node_fs_1 = require("node:fs");
-const node_os_1 = require("node:os");
-const node_path_1 = require("node:path");
-const config_http_1 = require("./config-http");
-const errors_1 = require("./errors");
-const secrets_1 = require("./secrets");
-exports.MANIFEST_FILE = 'atlas.json';
-function manifestPath(env, product) {
-    return (0, node_path_1.join)((0, secrets_1.productDir)(env, product), exports.MANIFEST_FILE);
-}
-function readManifest(env, product) {
-    try {
-        return JSON.parse((0, node_fs_1.readFileSync)(manifestPath(env, product), 'utf8'));
-    }
-    catch {
-        return undefined;
-    }
-}
-function writeManifest(env, manifest) {
-    const dir = (0, secrets_1.productDir)(env, manifest.product);
-    (0, node_fs_1.mkdirSync)(dir, { recursive: true, mode: 0o700 });
-    const path = (0, node_path_1.join)(dir, exports.MANIFEST_FILE);
-    (0, node_fs_1.writeFileSync)(path, JSON.stringify(manifest, null, 2) + '\n', { mode: 0o600 });
-    (0, node_fs_1.chmodSync)(path, 0o600);
-    return path;
-}
-/** Find the project + instance an instance id belongs to, scanning every product directory. */
-function findInstance(env, instanceId, product) {
-    const products = product ? [product] : listProducts(env);
-    for (const p of products) {
-        const m = readManifest(env, p);
-        for (const inst of Object.values(m?.instances ?? {})) {
-            if (inst && inst.instance_id === instanceId)
-                return { manifest: m, instance: inst };
-        }
-    }
-    return undefined;
-}
-function listProducts(env) {
-    const base = env.XDG_CONFIG_HOME?.trim() || (0, node_path_1.join)(env.HOME?.trim() || (0, node_os_1.homedir)(), '.config');
-    try {
-        return (0, node_fs_1.readdirSync)(base).filter((d) => {
-            try {
-                (0, node_fs_1.readFileSync)((0, node_path_1.join)(base, d, exports.MANIFEST_FILE));
-                return true;
-            }
-            catch {
-                return false;
-            }
-        });
-    }
-    catch {
-        return [];
-    }
-}
-function parseInstanceEnv(raw, fallback) {
-    if (raw === undefined)
-        return fallback;
-    if (raw !== 'development' && raw !== 'production') {
-        throw new errors_1.CliError(`--instance-env must be development or production, got '${raw}'.`);
-    }
-    return raw;
-}
-/** The raw HTTP client for a credential (the context's, or the real one). */
-function httpFor(ctx, opts) {
-    return (ctx.makeHttp ?? config_http_1.createConfigHttp)(opts);
-}
-/** Read the instance secret key from the project's secret file. */
-function instanceSecretFromFile(instance) {
-    const key = (0, secrets_1.readEnvFile)(instance.secret_file)?.ATLAS_SECRET_KEY;
-    if (!key) {
-        throw new errors_1.CliError(`No ATLAS_SECRET_KEY in ${instance.secret_file}. Re-run 'atlas init' with --rotate-secret to mint a new one.`);
-    }
-    return key;
-}
-//# sourceMappingURL=project.js.map

package/dist/project.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"project.js","sourceRoot":"","sources":["../src/project.ts"],"names":[],"mappings":";;;AA0CA,oCAEC;AAED,oCAMC;AAED,sCAOC;AAGD,oCAaC;AAkBD,4CAMC;AAGD,0BAEC;AAGD,wDAQC;AArHD,qCAAyF;AACzF,qCAAkC;AAClC,yCAAiC;AACjC,+CAAkE;AAElE,qCAAoC;AACpC,uCAAoD;AAkCvC,QAAA,aAAa,GAAG,YAAY,CAAC;AAE1C,SAAgB,YAAY,CAAC,GAAsB,EAAE,OAAe;IAClE,OAAO,IAAA,gBAAI,EAAC,IAAA,oBAAU,EAAC,GAAG,EAAE,OAAO,CAAC,EAAE,qBAAa,CAAC,CAAC;AACvD,CAAC;AAED,SAAgB,YAAY,CAAC,GAAsB,EAAE,OAAe;IAClE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAoB,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAgB,aAAa,CAAC,GAAsB,EAAE,QAAyB;IAC7E,MAAM,GAAG,GAAG,IAAA,oBAAU,EAAC,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAA,mBAAS,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,qBAAa,CAAC,CAAC;IACtC,IAAA,uBAAa,EAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,IAAA,mBAAS,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+FAA+F;AAC/F,SAAgB,YAAY,CAC1B,GAAsB,EACtB,UAAkB,EAClB,OAAgB;IAEhB,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACzD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;YACrD,IAAI,IAAI,IAAI,IAAI,CAAC,WAAW,KAAK,UAAU;gBAAE,OAAO,EAAE,QAAQ,EAAE,CAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACvF,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,GAAsB;IAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,IAAA,gBAAI,EAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,IAAA,iBAAO,GAAE,EAAE,SAAS,CAAC,CAAC;IAC3F,IAAI,CAAC;QACH,OAAO,IAAA,qBAAW,EAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACpC,IAAI,CAAC;gBACH,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,CAAC,EAAE,qBAAa,CAAC,CAAC,CAAC;gBAC3C,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAgB,gBAAgB,CAAC,GAAuB,EAAE,QAAqB;IAC7E,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACvC,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;QAClD,MAAM,IAAI,iBAAQ,CAAC,0DAA0D,GAAG,IAAI,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6EAA6E;AAC7E,SAAgB,OAAO,CAAC,GAAe,EAAE,IAA6E;IACpH,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,8BAAgB,CAAC,CAAC,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,mEAAmE;AACnE,SAAgB,sBAAsB,CAAC,QAAyB;IAC9D,MAAM,GAAG,GAAG,IAAA,qBAAW,EAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAChE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,iBAAQ,CAChB,0BAA0B,QAAQ,CAAC,WAAW,+DAA+D,CAC9G,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/prompt.d.ts

@@ -1,15 +0,0 @@
-/**
- * The interactive input seam for `atlas login`. An interface (not a direct
- * `readline` call) so tests script answers without a TTY, and so `secret()`
- * can hide the key no matter where it's wired.
- */
-export interface Prompter {
-    /** A visible line of input, with an optional default shown in brackets. */
-    text(query: string, opts?: {
-        default?: string;
-    }): Promise<string>;
-    /** A hidden line of input — the terminal never echoes what's typed. */
-    secret(query: string): Promise<string>;
-}
-/** The real prompter, reading the TTY. Not exercised by unit tests (they inject). */
-export declare function defaultPrompter(input?: NodeJS.ReadableStream, output?: NodeJS.WritableStream): Prompter;

package/dist/prompt.js

@@ -1,46 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.defaultPrompter = defaultPrompter;
-const node_readline_1 = require("node:readline");
-function ask(input, output, query) {
-    const rl = (0, node_readline_1.createInterface)({ input, output });
-    return new Promise((resolve) => {
-        rl.question(query, (answer) => {
-            rl.close();
-            resolve(answer);
-        });
-    });
-}
-/** The real prompter, reading the TTY. Not exercised by unit tests (they inject). */
-function defaultPrompter(input = process.stdin, output = process.stdout) {
-    return {
-        async text(query, opts) {
-            const suffix = opts?.default ? ` [${opts.default}]` : '';
-            const answer = (await ask(input, output, `${query}${suffix}: `)).trim();
-            return answer || opts?.default || '';
-        },
-        secret(query) {
-            // Echo the prompt, then mute readline's output so the secret never lands
-            // on screen or in scrollback. `_writeToOutput` is readline's own hook;
-            // overriding it is the standard way to hide typed input.
-            return new Promise((resolve) => {
-                const rl = (0, node_readline_1.createInterface)({ input, output, terminal: true });
-                let muted = false;
-                const rlInternal = rl;
-                rlInternal._writeToOutput = (s) => {
-                    if (!muted)
-                        output.write(s);
-                };
-                output.write(`${query}: `);
-                muted = true;
-                rl.question('', (answer) => {
-                    muted = false;
-                    output.write('\n');
-                    rl.close();
-                    resolve(answer.trim());
-                });
-            });
-        },
-    };
-}
-//# sourceMappingURL=prompt.js.map

package/dist/prompt.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"prompt.js","sourceRoot":"","sources":["../src/prompt.ts"],"names":[],"mappings":";;AAyBA,0CAiCC;AA1DD,iDAAgD;AAchD,SAAS,GAAG,CAAC,KAA4B,EAAE,MAA6B,EAAE,KAAa;IACrF,MAAM,EAAE,GAAG,IAAA,+BAAe,EAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9C,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;QACrC,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE;YAC5B,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,qFAAqF;AACrF,SAAgB,eAAe,CAC7B,QAA+B,OAAO,CAAC,KAAK,EAC5C,SAAgC,OAAO,CAAC,MAAM;IAE9C,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI;YACpB,MAAM,MAAM,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,KAAK,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACxE,OAAO,MAAM,IAAI,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC;QACvC,CAAC;QAED,MAAM,CAAC,KAAK;YACV,yEAAyE;YACzE,uEAAuE;YACvE,yDAAyD;YACzD,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;gBACrC,MAAM,EAAE,GAAG,IAAA,+BAAe,EAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC9D,IAAI,KAAK,GAAG,KAAK,CAAC;gBAClB,MAAM,UAAU,GAAG,EAAyD,CAAC;gBAC7E,UAAU,CAAC,cAAc,GAAG,CAAC,CAAS,EAAE,EAAE;oBACxC,IAAI,CAAC,KAAK;wBAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC9B,CAAC,CAAC;gBACF,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;gBAC3B,KAAK,GAAG,IAAI,CAAC;gBACb,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE;oBACzB,KAAK,GAAG,KAAK,CAAC;oBACd,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBACnB,EAAE,CAAC,KAAK,EAAE,CAAC;oBACX,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;gBACzB,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/run.d.ts

@@ -1,12 +0,0 @@
-import { type ParsedArgs } from './args';
-import type { RunContext } from './context';
-/** A command handler: given the context and parsed args, do the work; return an exit code. */
-export type Handler = (ctx: RunContext, args: ParsedArgs) => Promise<number>;
-/**
- * The CLI's whole control flow, as a pure function of (argv, context) → exit
- * code. It NEVER calls `process.exit` and NEVER throws: the bin calls it and
- * exits with what it returns, and every test drives this same path with a
- * captured IO. All error reporting funnels through the one try/catch so a user
- * sees a clean message and a non-zero code — never a stack trace.
- */
-export declare function run(argv: string[], ctx: RunContext): Promise<number>;

package/dist/run.js

@@ -1,157 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.run = run;
-const backend_1 = require("@atlasauth/backend");
-const args_1 = require("./args");
-const actions_1 = require("./commands/actions");
-const pages_1 = require("./commands/pages");
-const api_keys_1 = require("./commands/api-keys");
-const auth_1 = require("./commands/auth");
-const operator_1 = require("./commands/operator");
-const config_1 = require("./commands/config");
-const init_1 = require("./commands/init");
-const golive_1 = require("./commands/golive");
-const import_1 = require("./commands/import");
-const info_1 = require("./commands/info");
-const csp_1 = require("./commands/csp");
-const fga_1 = require("./commands/fga");
-const dev_1 = require("./commands/dev");
-const listen_1 = require("./commands/listen");
-const migrate_1 = require("./commands/migrate");
-const move_origin_1 = require("./commands/move-origin");
-const mcp_1 = require("./commands/mcp");
-const project_commands_1 = require("./commands/project-commands");
-const orgs_1 = require("./commands/orgs");
-const referrals_1 = require("./commands/referrals");
-const sessions_1 = require("./commands/sessions");
-const status_1 = require("./commands/status");
-const users_1 = require("./commands/users");
-const webhooks_1 = require("./commands/webhooks");
-const integrations_1 = require("./commands/integrations");
-const id_accounts_1 = require("./commands/id-accounts");
-const admin_1 = require("./commands/admin");
-const partner_platforms_1 = require("./commands/partner-platforms");
-const resources_1 = require("./commands/resources");
-const errors_1 = require("./errors");
-const help_1 = require("./help");
-const version_1 = require("./version");
-/** The command table — the single place every top-level command is registered. */
-const COMMANDS = {
-    login: auth_1.login,
-    logout: auth_1.logout,
-    whoami: auth_1.whoami,
-    token: operator_1.token,
-    keys: operator_1.keys,
-    users: users_1.users,
-    orgs: orgs_1.orgs,
-    'api-keys': api_keys_1.apiKeys,
-    webhooks: webhooks_1.webhooks,
-    integrations: integrations_1.integrations,
-    'partner-platforms': partner_platforms_1.partnerPlatforms,
-    'id-accounts': id_accounts_1.idAccounts,
-    admin: admin_1.admin,
-    sessions: sessions_1.sessions,
-    config: config_1.config,
-    plan: config_1.planCommand,
-    apply: config_1.applyCommand,
-    actions: actions_1.actions,
-    pages: pages_1.pages,
-    init: init_1.init,
-    preflight: project_commands_1.preflight,
-    doctor: project_commands_1.doctor,
-    golive: golive_1.golive,
-    env: project_commands_1.envCommand,
-    client: project_commands_1.client,
-    referrals: referrals_1.referrals,
-    status: status_1.status,
-    import: import_1.importUsers,
-    migrate: migrate_1.migrate,
-    info: info_1.info,
-    mcp: mcp_1.mcp,
-    listen: listen_1.listen,
-    dev: dev_1.dev,
-    'move-origin': move_origin_1.moveOrigin,
-    csp: csp_1.csp,
-    fga: fga_1.fga,
-    workflows: (0, resources_1.resourceCommand)('workflows', resources_1.WORKFLOWS),
-    chat: (0, resources_1.resourceCommand)('chat', resources_1.CHAT),
-    cloud: (0, resources_1.resourceCommand)('cloud', resources_1.CLOUD),
-    'saml-idp': (0, resources_1.resourceCommand)('saml-idp', resources_1.SAML_IDP),
-    provisioning: (0, resources_1.resourceCommand)('provisioning', resources_1.PROVISIONING),
-    catalog: (0, resources_1.resourceCommand)('catalog', resources_1.CATALOG),
-    'device-sso': (0, resources_1.resourceCommand)('device-sso', resources_1.DEVICE_SSO),
-    'connection-actions': (0, resources_1.resourceCommand)('connection-actions', resources_1.CONNECTION_ACTIONS),
-    triggers: (0, resources_1.resourceCommand)('triggers', resources_1.TRIGGERS),
-    agents: (0, resources_1.resourceCommand)('agents', resources_1.AGENTS),
-    telemetry: (0, resources_1.resourceCommand)('telemetry', resources_1.TELEMETRY),
-    pdp: (0, resources_1.resourceCommand)('pdp', resources_1.PDP),
-    billing: (0, resources_1.resourceCommand)('billing', resources_1.BILLING),
-    audit: (0, resources_1.resourceCommand)('audit', resources_1.AUDIT),
-    federation: (0, resources_1.resourceCommand)('federation', resources_1.FEDERATION),
-    vc: (0, resources_1.resourceCommand)('vc', resources_1.VC),
-};
-/**
- * The CLI's whole control flow, as a pure function of (argv, context) → exit
- * code. It NEVER calls `process.exit` and NEVER throws: the bin calls it and
- * exits with what it returns, and every test drives this same path with a
- * captured IO. All error reporting funnels through the one try/catch so a user
- * sees a clean message and a non-zero code — never a stack trace.
- */
-async function run(argv, ctx) {
-    let args;
-    try {
-        args = (0, args_1.parse)(argv);
-    }
-    catch (err) {
-        return report(ctx, err);
-    }
-    // --version wins over everything, like most CLIs.
-    if (args.values.version) {
-        ctx.io.out((0, version_1.getVersion)());
-        return 0;
-    }
-    const command = args.positionals[0];
-    // Bare `atlas` or `atlas --help`: top-level help on stdout, success.
-    if (!command) {
-        ctx.io.out(help_1.TOP_HELP);
-        return 0;
-    }
-    const handler = COMMANDS[command];
-    if (!handler) {
-        ctx.io.err(`Unknown command '${command}'.`);
-        ctx.io.err("Run 'atlas --help' to see available commands.");
-        return 1;
-    }
-    // `atlas <command> --help`: command-specific help on stdout, success.
-    if (args.values.help) {
-        ctx.io.out(help_1.COMMAND_HELP[command] ?? help_1.TOP_HELP);
-        return 0;
-    }
-    try {
-        return await handler(ctx, args);
-    }
-    catch (err) {
-        return report(ctx, err);
-    }
-}
-/**
- * Turn any thrown error into a clean stderr message + exit code. An
- * {@link AtlasApiError} keeps its HTTP status and stable `code` so the user can
- * act on it; a {@link CliError} carries its own code; anything else is an
- * unexpected bug reported as its message (still no stack).
- */
-function report(ctx, err) {
-    if (err instanceof backend_1.AtlasApiError) {
-        const code = err.code ? ` [${err.code}]` : '';
-        ctx.io.err(`atlas: API error (HTTP ${err.status})${code}: ${err.message}`);
-        return 1;
-    }
-    if (err instanceof errors_1.CliError) {
-        ctx.io.err(`atlas: ${err.message}`);
-        return err.exitCode;
-    }
-    const message = err instanceof Error ? err.message : String(err);
-    ctx.io.err(`atlas: ${message}`);
-    return 1;
-}
-//# sourceMappingURL=run.js.map

package/dist/run.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"run.js","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":";;AAyGA,kBAwCC;AAjJD,gDAAmD;AACnD,iCAAgD;AAChD,gDAA6C;AAC7C,4CAAyC;AACzC,kDAA8C;AAC9C,0CAAwD;AACxD,kDAAkD;AAClD,8CAAsE;AACtE,0CAAuC;AACvC,8CAA2C;AAC3C,8CAAgD;AAChD,0CAAuC;AACvC,wCAAqC;AACrC,wCAAqC;AACrC,wCAAqC;AACrC,8CAA2C;AAC3C,gDAA6C;AAC7C,wDAAoD;AACpD,wCAAqC;AACrC,kEAAoF;AACpF,0CAAuC;AACvC,oDAAiD;AACjD,kDAA+C;AAC/C,8CAA2C;AAC3C,4CAAyC;AACzC,kDAA+C;AAC/C,0DAAuD;AACvD,wDAAoD;AACpD,4CAAyC;AACzC,oEAAgE;AAChE,oDAG8B;AAE9B,qCAAoC;AACpC,iCAAgD;AAChD,uCAAuC;AAKvC,kFAAkF;AAClF,MAAM,QAAQ,GAA4B;IACxC,KAAK,EAAL,YAAK;IACL,MAAM,EAAN,aAAM;IACN,MAAM,EAAN,aAAM;IACN,KAAK,EAAL,gBAAK;IACL,IAAI,EAAJ,eAAI;IACJ,KAAK,EAAL,aAAK;IACL,IAAI,EAAJ,WAAI;IACJ,UAAU,EAAE,kBAAO;IACnB,QAAQ,EAAR,mBAAQ;IACR,YAAY,EAAZ,2BAAY;IACZ,mBAAmB,EAAE,oCAAgB;IACrC,aAAa,EAAE,wBAAU;IACzB,KAAK,EAAL,aAAK;IACL,QAAQ,EAAR,mBAAQ;IACR,MAAM,EAAN,eAAM;IACN,IAAI,EAAE,oBAAW;IACjB,KAAK,EAAE,qBAAY;IACnB,OAAO,EAAP,iBAAO;IACP,KAAK,EAAL,aAAK;IACL,IAAI,EAAJ,WAAI;IACJ,SAAS,EAAT,4BAAS;IACT,MAAM,EAAN,yBAAM;IACN,MAAM,EAAN,eAAM;IACN,GAAG,EAAE,6BAAU;IACf,MAAM,EAAN,yBAAM;IACN,SAAS,EAAT,qBAAS;IACT,MAAM,EAAN,eAAM;IACN,MAAM,EAAE,oBAAW;IACnB,OAAO,EAAP,iBAAO;IACP,IAAI,EAAJ,WAAI;IACJ,GAAG,EAAH,SAAG;IACH,MAAM,EAAN,eAAM;IACN,GAAG,EAAH,SAAG;IACH,aAAa,EAAE,wBAAU;IACzB,GAAG,EAAH,SAAG;IACH,GAAG,EAAH,SAAG;IACH,SAAS,EAAE,IAAA,2BAAe,EAAC,WAAW,EAAE,qBAAS,CAAC;IAClD,IAAI,EAAE,IAAA,2BAAe,EAAC,MAAM,EAAE,gBAAI,CAAC;IACnC,KAAK,EAAE,IAAA,2BAAe,EAAC,OAAO,EAAE,iBAAK,CAAC;IACtC,UAAU,EAAE,IAAA,2BAAe,EAAC,UAAU,EAAE,oBAAQ,CAAC;IACjD,YAAY,EAAE,IAAA,2BAAe,EAAC,cAAc,EAAE,wBAAY,CAAC;IAC3D,OAAO,EAAE,IAAA,2BAAe,EAAC,SAAS,EAAE,mBAAO,CAAC;IAC5C,YAAY,EAAE,IAAA,2BAAe,EAAC,YAAY,EAAE,sBAAU,CAAC;IACvD,oBAAoB,EAAE,IAAA,2BAAe,EAAC,oBAAoB,EAAE,8BAAkB,CAAC;IAC/E,QAAQ,EAAE,IAAA,2BAAe,EAAC,UAAU,EAAE,oBAAQ,CAAC;IAC/C,MAAM,EAAE,IAAA,2BAAe,EAAC,QAAQ,EAAE,kBAAM,CAAC;IACzC,SAAS,EAAE,IAAA,2BAAe,EAAC,WAAW,EAAE,qBAAS,CAAC;IAClD,GAAG,EAAE,IAAA,2BAAe,EAAC,KAAK,EAAE,eAAG,CAAC;IAChC,OAAO,EAAE,IAAA,2BAAe,EAAC,SAAS,EAAE,mBAAO,CAAC;IAC5C,KAAK,EAAE,IAAA,2BAAe,EAAC,OAAO,EAAE,iBAAK,CAAC;IACtC,UAAU,EAAE,IAAA,2BAAe,EAAC,YAAY,EAAE,sBAAU,CAAC;IACrD,EAAE,EAAE,IAAA,2BAAe,EAAC,IAAI,EAAE,cAAE,CAAC;CAC9B,CAAC;AAEF;;;;;;GAMG;AACI,KAAK,UAAU,GAAG,CAAC,IAAc,EAAE,GAAe;IACvD,IAAI,IAAgB,CAAC;IACrB,IAAI,CAAC;QACH,IAAI,GAAG,IAAA,YAAK,EAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,kDAAkD;IAClD,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACxB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAA,oBAAU,GAAE,CAAC,CAAC;QACzB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAEpC,qEAAqE;IACrE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,eAAQ,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,oBAAoB,OAAO,IAAI,CAAC,CAAC;QAC5C,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC5D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,sEAAsE;IACtE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACrB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,mBAAY,CAAC,OAAO,CAAC,IAAI,eAAQ,CAAC,CAAC;QAC9C,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,MAAM,CAAC,GAAe,EAAE,GAAY;IAC3C,IAAI,GAAG,YAAY,uBAAa,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,0BAA0B,GAAG,CAAC,MAAM,IAAI,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3E,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,GAAG,YAAY,iBAAQ,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACpC,OAAO,GAAG,CAAC,QAAQ,CAAC;IACtB,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC;IAChC,OAAO,CAAC,CAAC;AACX,CAAC"}