@atlasauth/cli 0.25.0 → 0.25.1

package/dist/config-http.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createConfigHttp = createConfigHttp;
+exports.isNotFound = isNotFound;
+const backend_1 = require("@atlasauth/backend");
+/** The production {@link ConfigHttp}: Bearer-authed `fetch`, mirroring the backend client. */
+function createConfigHttp(opts) {
+    const base = opts.apiUrl.replace(/\/+$/, '');
+    const fetchImpl = opts.fetch ?? globalThis.fetch;
+    if (typeof fetchImpl !== 'function') {
+        throw new Error('No fetch implementation found for the Atlas config client.');
+    }
+    async function send(method, path, body) {
+        const headers = {
+            ...opts.headers,
+            authorization: `Bearer ${opts.secretKey}`,
+            accept: 'application/json',
+        };
+        let payload;
+        if (body !== undefined) {
+            headers['content-type'] = 'application/json';
+            payload = JSON.stringify(body);
+        }
+        const res = await fetchImpl(`${base}${path}`, { method, headers, body: payload });
+        if (!res.ok)
+            throw await toApiError(res);
+        if (res.status === 204)
+            return undefined;
+        const text = await res.text();
+        return (text ? JSON.parse(text) : undefined);
+    }
+    return {
+        get: (path) => send('GET', path),
+        post: (path, body) => send('POST', path, body),
+        put: (path, body) => send('PUT', path, body),
+        patch: (path, body) => send('PATCH', path, body),
+        delete: async (path, body) => {
+            await send('DELETE', path, body);
+        },
+    };
+}
+async function toApiError(res) {
+    let errors = [];
+    const text = await res.text().catch(() => '');
+    if (text) {
+        try {
+            const parsed = JSON.parse(text);
+            if (Array.isArray(parsed.errors) && parsed.errors.length)
+                errors = parsed.errors;
+        }
+        catch {
+            /* non-JSON body */
+        }
+    }
+    if (!errors.length) {
+        errors = [{ code: 'UNKNOWN', message: `Atlas API request failed with status ${res.status}` }];
+    }
+    return new backend_1.AtlasApiError(res.status, errors);
+}
+/** True when an error is an Atlas 404 — a resource that does not (yet) exist. */
+function isNotFound(err) {
+    return err instanceof backend_1.AtlasApiError && err.status === 404;
+}
+//# sourceMappingURL=config-http.js.map

package/dist/config-http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-http.js","sourceRoot":"","sources":["../src/config-http.ts"],"names":[],"mappings":";;AAuBA,4CAwCC;AAoBD,gCAEC;AArFD,gDAAwE;AAsBxE,8FAA8F;AAC9F,SAAgB,gBAAgB,CAAC,IAMhC;IACC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACjD,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IAED,KAAK,UAAU,IAAI,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACjE,MAAM,OAAO,GAA2B;YACtC,GAAG,IAAI,CAAC,OAAO;YACf,aAAa,EAAE,UAAU,IAAI,CAAC,SAAS,EAAE;YACzC,MAAM,EAAE,kBAAkB;SAC3B,CAAC;QACF,IAAI,OAA2B,CAAC;QAChC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YAC7C,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAc,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAO,CAAC,CAAC,CAAE,SAAe,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO;QACL,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC;QAChC,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC;QAC9C,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC;QAC5C,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;QAChD,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YAC3B,MAAM,IAAI,CAAO,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,GAAa;IACrC,IAAI,MAAM,GAAqB,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9C,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkC,CAAC;YACjE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM;gBAAE,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QACnF,CAAC;QAAC,MAAM,CAAC;YACP,mBAAmB;QACrB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,wCAAwC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,IAAI,uBAAa,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED,iFAAiF;AACjF,SAAgB,UAAU,CAAC,GAAY;IACrC,OAAO,GAAG,YAAY,uBAAa,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;AAC5D,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,64 @@
+/**
+ * One stored instance credential. The secret key sits on disk in plaintext —
+ * the same trade-off `auth0-cli` and the `gh` CLI make: a long-lived token in a
+ * 0600 file under the user's home, not an OS keychain. {@link FileConfigStore}
+ * enforces the 0600 so another user on the box cannot read it.
+ */
+export interface Profile {
+    api_url: string;
+    secret_key: string;
+    /** When `secret_key` is a one-hour token (from `atlas login --device`), when it expires (Unix ms). */
+    expires_at?: number;
+    /** The resource the short-lived token is bound to (`ins_…`, `app_…`, `acct_…`). */
+    resource?: string;
+    scope?: string;
+    /**
+     * The operator token from `atlas login --device` (short-lived, Unix-ms expiry):
+     * `atlas token` swaps it for resource-bound tokens. Never a long-lived key.
+     */
+    operator?: {
+        access_token: string;
+        expires_at: number;
+        issuer: string;
+    };
+    /** Atlas's own (staff) account id, remembered for `atlas admin` once given. */
+    staff_account_id?: string;
+}
+/** The whole config file: named profiles plus which one is active. */
+export interface ConfigFile {
+    active_profile?: string;
+    profiles: Record<string, Profile>;
+}
+/**
+ * The persistence seam. Commands depend on this interface, never on `fs`, so a
+ * test injects a store backed by a temp path (or memory) and the real
+ * `~/.config/...` file is never touched.
+ */
+export interface ConfigStore {
+    /** Where this store reads/writes — surfaced for `login`'s success message. */
+    readonly path: string;
+    load(): ConfigFile;
+    save(config: ConfigFile): void;
+}
+/**
+ * Resolve the default config path: `$XDG_CONFIG_HOME/atlasauth/config.json`,
+ * falling back to `~/.config/atlasauth/config.json`. Honoring XDG keeps the CLI
+ * a good citizen on Linux while still working on macOS, where `~/.config` is
+ * the de-facto convention CLIs use.
+ */
+export declare function defaultConfigPath(env?: NodeJS.ProcessEnv): string;
+/** The real store: a JSON file written with 0600 perms and a 0700 parent dir. */
+export declare class FileConfigStore implements ConfigStore {
+    readonly path: string;
+    constructor(path: string);
+    load(): ConfigFile;
+    save(config: ConfigFile): void;
+}
+/** An in-memory store for tests that still want to exercise the resolve logic. */
+export declare class MemoryConfigStore implements ConfigStore {
+    readonly path = "<memory>";
+    private data;
+    constructor(initial?: ConfigFile);
+    load(): ConfigFile;
+    save(config: ConfigFile): void;
+}

package/dist/config.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MemoryConfigStore = exports.FileConfigStore = void 0;
+exports.defaultConfigPath = defaultConfigPath;
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const errors_1 = require("./errors");
+const EMPTY = { profiles: {} };
+/**
+ * Resolve the default config path: `$XDG_CONFIG_HOME/atlasauth/config.json`,
+ * falling back to `~/.config/atlasauth/config.json`. Honoring XDG keeps the CLI
+ * a good citizen on Linux while still working on macOS, where `~/.config` is
+ * the de-facto convention CLIs use.
+ */
+function defaultConfigPath(env = process.env) {
+    const base = env.XDG_CONFIG_HOME?.trim() || (0, node_path_1.join)((0, node_os_1.homedir)(), '.config');
+    return (0, node_path_1.join)(base, 'atlasauth', 'config.json');
+}
+/** The real store: a JSON file written with 0600 perms and a 0700 parent dir. */
+class FileConfigStore {
+    path;
+    constructor(path) {
+        this.path = path;
+    }
+    load() {
+        let text;
+        try {
+            text = (0, node_fs_1.readFileSync)(this.path, 'utf8');
+        }
+        catch {
+            // Missing file is the first-run state, not an error.
+            return { profiles: {} };
+        }
+        try {
+            const parsed = JSON.parse(text);
+            // Guard against a hand-corrupted file so every later `.profiles[...]` is safe.
+            return { active_profile: parsed.active_profile, profiles: parsed.profiles ?? {} };
+        }
+        catch {
+            throw new errors_1.CliError(`Config file at ${this.path} is not valid JSON. Fix or remove it, then run 'atlas login' again.`);
+        }
+    }
+    save(config) {
+        (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(this.path), { recursive: true, mode: 0o700 });
+        // Write THEN chmod: `mode` on writeFile is masked by umask and skipped
+        // entirely if the file already exists, so an explicit chmod is the only
+        // way to guarantee 0600 on every save.
+        (0, node_fs_1.writeFileSync)(this.path, JSON.stringify(config, null, 2) + '\n', { mode: 0o600 });
+        (0, node_fs_1.chmodSync)(this.path, 0o600);
+    }
+}
+exports.FileConfigStore = FileConfigStore;
+/** An in-memory store for tests that still want to exercise the resolve logic. */
+class MemoryConfigStore {
+    path = '<memory>';
+    data;
+    constructor(initial = EMPTY) {
+        this.data = structuredClone(initial);
+    }
+    load() {
+        return structuredClone(this.data);
+    }
+    save(config) {
+        this.data = structuredClone(config);
+    }
+}
+exports.MemoryConfigStore = MemoryConfigStore;
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":";;;AAsDA,8CAGC;AAzDD,qCAA4E;AAC5E,qCAAkC;AAClC,yCAA0C;AAC1C,qCAAoC;AA2CpC,MAAM,KAAK,GAAe,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAE3C;;;;;GAKG;AACH,SAAgB,iBAAiB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACpE,MAAM,IAAI,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,SAAS,CAAC,CAAC;IACvE,OAAO,IAAA,gBAAI,EAAC,IAAI,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;AAChD,CAAC;AAED,iFAAiF;AACjF,MAAa,eAAe;IACL;IAArB,YAAqB,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;IAErC,IAAI;QACF,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,IAAA,sBAAY,EAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,qDAAqD;YACrD,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;YAC9C,+EAA+E;YAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QACpF,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,iBAAQ,CAChB,kBAAkB,IAAI,CAAC,IAAI,qEAAqE,CACjG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAkB;QACrB,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAChE,uEAAuE;QACvE,wEAAwE;QACxE,uCAAuC;QACvC,IAAA,uBAAa,EAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,IAAA,mBAAS,EAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;CACF;AA9BD,0CA8BC;AAED,kFAAkF;AAClF,MAAa,iBAAiB;IACnB,IAAI,GAAG,UAAU,CAAC;IACnB,IAAI,CAAa;IACzB,YAAY,UAAsB,KAAK;QACrC,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IACD,IAAI;QACF,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,MAAkB;QACrB,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;CACF;AAZD,8CAYC"}

package/dist/context.d.ts

@@ -0,0 +1,72 @@
+import { type AtlasClient } from '@atlasauth/backend';
+import { type ConfigStore } from './config';
+import { type ConfigHttp } from './config-http';
+import { type IO } from './io';
+import { type Prompter } from './prompt';
+/**
+ * The exact slice of the Backend API client this CLI drives. Narrowed from the
+ * full {@link AtlasClient} on purpose: it documents — and the typechecker
+ * enforces — that the command set maps only onto namespaces that really exist,
+ * and it keeps the fake a test injects small (five namespaces, not forty).
+ */
+export type ManagementClient = Pick<AtlasClient, 'users' | 'organizations' | 'apiKeys' | 'webhooks' | 'sessions' | 'actions' | 'actionGallery' | 'actionTemplates' | 'pageTemplates'>;
+/**
+ * Everything a command touches the outside world through, in one injectable
+ * bag. Production wires the real IO/config/prompt/client; every test builds
+ * this with fakes so a handler runs with no network, no TTY and no real
+ * `~/.config` file.
+ */
+export interface RunContext {
+    io: IO;
+    /** Process environment — read for `ATLAS_SECRET_KEY` / `ATLAS_API_URL`. */
+    env: NodeJS.ProcessEnv;
+    config: ConfigStore;
+    prompt: Prompter;
+    /** Builds the Backend API client from a resolved credential. */
+    makeClient: (opts: {
+        secretKey: string;
+        apiUrl: string;
+    }) => ManagementClient;
+    /**
+     * Builds the raw management-API HTTP client used by `atlas config` (the
+     * config-only `/v1` endpoints the typed client omits). Optional so existing
+     * contexts stay valid; the config command falls back to the real one.
+     */
+    makeHttp?: (opts: {
+        secretKey: string;
+        apiUrl: string;
+        headers?: Record<string, string>;
+    }) => ConfigHttp;
+    /**
+     * Read a file's text, for commands that take a path (`atlas actions deploy`
+     * / `test`). Injectable so a test drives them with an in-memory file instead
+     * of touching the disk. Defaults to reading UTF-8 off the real filesystem.
+     */
+    readFile: (path: string) => string;
+    /**
+     * `fetch` for calls outside the Atlas API (`atlas referrals connect` calls
+     * the referral platform's own API). Optional; defaults to the global fetch.
+     */
+    fetch?: typeof fetch;
+    /** Wait between polls (`--wait`). Optional; defaults to a real timer. */
+    sleep?: (ms: number) => Promise<void>;
+    /**
+     * Run a program with inherited stdio and return its exit code (`atlas migrate
+     * better-auth --run-export` runs the exporter in the app). Optional; defaults
+     * to a real child process.
+     */
+    exec?: (cmd: string, args: string[], opts: {
+        cwd: string;
+    }) => Promise<number>;
+    /**
+     * Stops a long-running command (`atlas listen`). Optional; defaults to an
+     * abort on SIGINT/SIGTERM so Ctrl-C ends the stream cleanly.
+     */
+    signal?: AbortSignal;
+}
+/**
+ * The production context, with any piece overridable. Tests call this with a
+ * `config` pointed at a temp path and a `makeClient` returning a stub, so the
+ * same `run()` path is exercised end to end without side effects.
+ */
+export declare function defaultContext(overrides?: Partial<RunContext>): RunContext;

package/dist/context.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultContext = defaultContext;
+const node_fs_1 = require("node:fs");
+const backend_1 = require("@atlasauth/backend");
+const config_1 = require("./config");
+const config_http_1 = require("./config-http");
+const io_1 = require("./io");
+const prompt_1 = require("./prompt");
+/**
+ * The production context, with any piece overridable. Tests call this with a
+ * `config` pointed at a temp path and a `makeClient` returning a stub, so the
+ * same `run()` path is exercised end to end without side effects.
+ */
+function defaultContext(overrides = {}) {
+    return {
+        io: (0, io_1.defaultIO)(),
+        env: process.env,
+        config: new config_1.FileConfigStore((0, config_1.defaultConfigPath)()),
+        prompt: (0, prompt_1.defaultPrompter)(),
+        makeClient: ({ secretKey, apiUrl }) => (0, backend_1.createAtlasClient)({ secretKey, apiUrl }),
+        makeHttp: ({ secretKey, apiUrl, headers }) => (0, config_http_1.createConfigHttp)({ secretKey, apiUrl, headers }),
+        readFile: (path) => (0, node_fs_1.readFileSync)(path, 'utf8'),
+        ...overrides,
+    };
+}
+//# sourceMappingURL=context.js.map

package/dist/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":";;AAqEA,wCAWC;AAhFD,qCAAuC;AACvC,gDAAyE;AACzE,qCAAgF;AAChF,+CAAkE;AAClE,6BAA0C;AAC1C,qCAA0D;AA2D1D;;;;GAIG;AACH,SAAgB,cAAc,CAAC,YAAiC,EAAE;IAChE,OAAO;QACL,EAAE,EAAE,IAAA,cAAS,GAAE;QACf,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,MAAM,EAAE,IAAI,wBAAe,CAAC,IAAA,0BAAiB,GAAE,CAAC;QAChD,MAAM,EAAE,IAAA,wBAAe,GAAE;QACzB,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,IAAA,2BAAiB,EAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAC/E,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,IAAA,8BAAgB,EAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC9F,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC;QAC9C,GAAG,SAAS;KACb,CAAC;AACJ,CAAC"}

package/dist/define-config.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The shape of an `atlas.config.ts`: one key per resource type, each holding
+ * what `atlas config export` writes for that type (an object for a singleton
+ * such as `instance`, a list for a collection such as `webhooks`). Run `atlas config export`
+ * to start from your live instance. `${VAR}` placeholders are filled from the environment.
+ */
+export type AtlasConfig = Record<string, unknown>;
+/** Identity helper for typing and editor completion: `export default defineConfig({ ... })`. */
+export declare function defineConfig<T extends AtlasConfig | (() => AtlasConfig | Promise<AtlasConfig>)>(config: T): T;

package/dist/define-config.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defineConfig = defineConfig;
+/** Identity helper for typing and editor completion: `export default defineConfig({ ... })`. */
+function defineConfig(config) {
+    return config;
+}
+//# sourceMappingURL=define-config.js.map

package/dist/define-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"define-config.js","sourceRoot":"","sources":["../src/define-config.ts"],"names":[],"mappings":";;AASA,oCAEC;AAHD,gGAAgG;AAChG,SAAgB,YAAY,CAAqE,MAAS;IACxG,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The one error a command handler throws to abort with a clean, user-facing
+ * message and a chosen exit code. {@link run} catches it, prints `message` to
+ * stderr (no stack), and returns `exitCode` — so a bad flag or a missing key
+ * never dumps a stack trace at the terminal the way an uncaught throw would.
+ *
+ * API failures are NOT CliErrors: they arrive as `AtlasApiError` from
+ * `@atlasauth/backend` and {@link run} formats those separately so the stable
+ * error `code` and HTTP status survive to the user.
+ */
+export declare class CliError extends Error {
+    readonly name = "CliError";
+    readonly exitCode: number;
+    constructor(message: string, exitCode?: number);
+}

package/dist/errors.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CliError = void 0;
+/**
+ * The one error a command handler throws to abort with a clean, user-facing
+ * message and a chosen exit code. {@link run} catches it, prints `message` to
+ * stderr (no stack), and returns `exitCode` — so a bad flag or a missing key
+ * never dumps a stack trace at the terminal the way an uncaught throw would.
+ *
+ * API failures are NOT CliErrors: they arrive as `AtlasApiError` from
+ * `@atlasauth/backend` and {@link run} formats those separately so the stable
+ * error `code` and HTTP status survive to the user.
+ */
+class CliError extends Error {
+    name = 'CliError';
+    exitCode;
+    constructor(message, exitCode = 1) {
+        super(message);
+        this.exitCode = exitCode;
+        // Keep `instanceof CliError` working under down-level compile targets.
+        Object.setPrototypeOf(this, CliError.prototype);
+    }
+}
+exports.CliError = CliError;
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;GASG;AACH,MAAa,QAAS,SAAQ,KAAK;IACf,IAAI,GAAG,UAAU,CAAC;IAC3B,QAAQ,CAAS;IAE1B,YAAY,OAAe,EAAE,QAAQ,GAAG,CAAC;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,uEAAuE;QACvE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;IAClD,CAAC;CACF;AAVD,4BAUC"}

package/dist/help.d.ts

@@ -0,0 +1,8 @@
+/**
+ * All help text lives here as plain strings — the CLI's "docs" surface. Kept
+ * out of the handlers so the dispatch code stays about control flow and the
+ * copy can be read (and kept consistent) in one place.
+ */
+export declare const TOP_HELP = "atlas \u2014 manage an Atlas instance from the terminal\n\nUsage: atlas <command> [subcommand] [arguments] [options]\n\nCommands:\n  login                      Authenticate and store a profile credential\n                             (--device: operator sign-in in the browser, no key stored)\n  token --resource <id>      A one-hour token for one instance/app from your operator sign-in\n  keys whoami|list|create|rotate|revoke|revoke-leaked|data|op\n                             Scoped secret keys; new secrets go sealed into 0600 files\n  logout                     Remove a stored profile credential\n  whoami                     Show the active profile and instance\n  users list|get|create|merge|delete\n  orgs list|get|members\n  api-keys list|create|revoke\n  webhooks list|create|upsert|update|test|deliveries|redeliver|replay|rotate|reveal\n  listen --forward-to <url>  Forward live events to your local server, signed (no tunnel)\n  dev [proxy]                Local in-memory Atlas (emulator) / one-origin dev proxy\n  move-origin --from --to    Move an app to a new domain in one step (--dry-run first)\n  workflows list|run|resume|status|templates|approvals|decide\n  chat list|test|links|interactions   Chat approval integrations\n  cloud targets|setup|login <id>      Cloud access portal (AWS, Google Cloud, Azure)\n  device-sso list|show|revoke|delete  Native OS single sign-on registrations\n  connection-actions catalog|list|run|define|remove\n  triggers list|get|create|set|delete Connection triggers\n  agents list|lifecycle|renew|activity|reviews|review-decide ...\n  telemetry show|set|test             OTLP export of gateway and relay calls\n  pdp list|remove                     Local decision points\n  billing coupons|credits ...         Discount codes and account credit\n  audit retention|set-retention       Audit log retention\n  federation show|resolve             OpenID federation\n  vc deferred|approve|deny            Deferred credential issuance\n  csp --framework next|express|nginx\n                             Print the Content Security Policy sources Atlas needs\n  fga test|validate|transform <file>\n  fga export|import|watch|materialize <store>\n                             Run .fga.yaml test suites, validate and convert authorization models\n  integrations list|get|set|remove|deliveries   Identity integrations (chat, docs, consent, referrals, custom)\n  partner-platforms list|get|set|registration|token|deliveries|remove\n                             This instance as a partner platform (signed consent deliveries in)\n  id-accounts provision|list|rotate|remove\n                             Test and review accounts for a Sign in with Atlas app (passwords go to 0600 files)\n  admin id-accounts list|provision|extend|rotate|revoke\n  admin developer-accounts provision|revoke\n                             Atlas staff: accounts for other platforms' integration teams\n                             (operator sign-in with a recent second factor; passwords to 0600 files)\n  sessions revoke\n  config export|import|plan|promote\n                             Config-as-code: round-trip the instance's config; plan = drift diff;\n                             promote = copy one environment's config to another\n  plan [<file|dir>]          Drift diff of a config file or directory; --check exits 2 on drift\n  apply [<file|dir>]         Plan, confirm (--yes to skip), then apply; --check = plan only, exit 2 on drift\n  actions list|deploy|test|logs|gallery|show|install|installs|update|publish\n  pages list|push|preview|promote|pull|discard\n                             Code-defined hosted-page templates: draft, signed preview link, promote\n  init                       Create or complete an app's setup (idempotent); secrets to 0600 files\n  preflight                  Check an instance's setup; non-zero exit on errors (for CI)\n  doctor                     Integration health: webhooks, logout, referrals, email, consent (exit 1 on a failure)\n  golive --origin <url>      Take an instance live for an app origin, step by step; stops at the first failure\n  env                        Print deploy variables: public values + secret file paths\n  client rotate              Rotate an OAuth client secret straight into its file\n  referrals connect|backfill|resync|status\n                             Connect a referral platform, backfill, check the connection\n  status                     Atlas status, incidents that concern the instance and its\n                             upstream status pages; non-zero exit on an outage\n  import --from <vendor> <file>\n                             Move users from Auth0, Clerk, Supabase, Firebase, Cognito,\n                             Auth.js, WorkOS or Better Auth (resumable; --dry-run first)\n  migrate code --from <vendor> [path]\n                             Rewrite an app's auth code onto Atlas (Clerk, Auth.js,\n                             Supabase, Auth0, Better Auth); a dry run with a diff unless --yes\n  migrate better-auth [path] Move a Better Auth app to Atlas end to end: config, users,\n                             sessions and code, resumable (--dry-run, --resume, --yes)\n  migrate better-auth config [path]\n                             Translate the app's betterAuth({...}) options into Atlas\n                             config files plus a report (offline)\n  migrate <vendor> [step] [path]\n                             Move from any vendor (config, export, import, bridge, lazy):\n                             resumable; vendor credentials never leave this machine\n  info [path]                Print the environment for a support ticket (versions, SDKs,\n                             instance, API latency, preflight); secrets redacted\n  mcp install                Add the Atlas MCP server (docs search) to Cursor, Claude Code,\n                             Codex or VS Code\n\nGlobal options:\n  --profile <name>           Use a named profile (default: active, else \"default\")\n  --json                     Emit raw JSON instead of a human table\n  --limit <n>                Page size for list commands that paginate\n  --starting-after <cursor>  Pagination cursor (from a prior page's hint)\n  -h, --help                 Show this help, or help for a command\n  -v, --version              Print the version\n\nEnvironment overrides:\n  ATLAS_SECRET_KEY           Secret key to use instead of the stored one\n  ATLAS_API_BASE             API URL to use instead of the stored one\n  ATLAS_API_URL              Same (the older name); ATLAS_API_BASE wins when both are set\n  ATLAS_PLATFORM_KEY         Platform key (psk_) for atlas init\n  REFERALLI_BASE_URL         Referalli base URL for atlas referrals connect\n  REFERALLI_API_KEY          Referalli merchant key for atlas referrals connect (never stored)\n                             (the old REFERALLY_BASE_URL / REFERALLY_API_KEY still work, with a notice)\n\nSecrets: a command that receives a secret writes it to a 0600 file under\n~/.config/<product>/ and prints only the path. --print-secret prints it instead.\n\nRun 'atlas <command> --help' for command-specific help.";
+/** Per-command help, keyed by the resource word. */
+export declare const COMMAND_HELP: Record<string, string>;