@atlasauth/cli 0.25.0 → 0.25.1

package/dist/commands/api-keys.js

@@ -0,0 +1,96 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.apiKeys = apiKeys;
+const args_1 = require("../args");
+const errors_1 = require("../errors");
+const output_1 = require("../output");
+const secrets_1 = require("../secrets");
+const shared_1 = require("./shared");
+const COLUMNS = [
+    { header: 'ID', get: (k) => k.id },
+    { header: 'SUBJECT_TYPE', get: (k) => k.subject_type },
+    { header: 'SUBJECT_ID', get: (k) => k.subject_id },
+    { header: 'NAME', get: (k) => k.name },
+    { header: 'PREFIX', get: (k) => k.prefix },
+    { header: 'CREATED', get: (k) => (0, output_1.fmtTime)(k.created_at) },
+];
+const SUBJECT_TYPES = ['user', 'organization'];
+function parseSubjectType(value, flag) {
+    if (!value)
+        throw new errors_1.CliError(`api-keys create requires ${flag} <user|organization>.`);
+    if (!SUBJECT_TYPES.includes(value)) {
+        throw new errors_1.CliError(`${flag} must be one of: ${SUBJECT_TYPES.join(', ')} (got '${value}').`);
+    }
+    return value;
+}
+/** `atlas api-keys <list|create|revoke>` — maps onto `client.apiKeys.*`. */
+async function apiKeys(ctx, args) {
+    const sub = args.positionals[1];
+    const json = (0, shared_1.wantsJson)(args.values);
+    switch (sub) {
+        case 'list': {
+            const { client } = (0, shared_1.requireClient)(ctx, args.values);
+            // Optional narrowing to one subject; the route itself is not cursor-paged.
+            const subjectType = (0, args_1.str)(args.values, 'subject-type');
+            const page = await client.apiKeys.list({
+                subject_type: subjectType ? parseSubjectType(subjectType, '--subject-type') : undefined,
+                subject_id: (0, args_1.str)(args.values, 'subject-id'),
+            });
+            if (json)
+                (0, output_1.printJson)(ctx.io, page);
+            else
+                ctx.io.out((0, output_1.renderTable)(COLUMNS, page.data));
+            return 0;
+        }
+        case 'create': {
+            const subjectType = parseSubjectType((0, args_1.str)(args.values, 'subject-type'), '--subject-type');
+            const subjectId = (0, args_1.str)(args.values, 'subject-id');
+            if (!subjectId)
+                throw new errors_1.CliError('api-keys create requires --subject-id <id>.');
+            const { client } = (0, shared_1.requireClient)(ctx, args.values);
+            const key = await client.apiKeys.create({
+                subject_type: subjectType,
+                subject_id: subjectId,
+                name: (0, args_1.str)(args.values, 'name'),
+            });
+            // The secret is revealed exactly once. By default it goes to a 0600 file
+            // and only the path is printed; --print-secret is the explicit opt-out.
+            const printSecret = args.values['print-secret'] === true;
+            const { secret, ...rest } = key;
+            if (printSecret) {
+                ctx.io.err('atlas: warning: printing the API key because --print-secret was given. It may end up in your shell history, terminal scrollback or CI logs.');
+                if (json)
+                    (0, output_1.printJson)(ctx.io, key);
+                else {
+                    ctx.io.out(`Created API key ${key.id}.`);
+                    ctx.io.out(`Secret (shown once): ${secret}`);
+                }
+                return 0;
+            }
+            const { path } = (0, secrets_1.writeSecretFile)((0, secrets_1.productDir)(ctx.env, (0, args_1.str)(args.values, 'product') ?? 'atlasauth'), `api-key-${key.id}.env`, { ATLAS_API_KEY: secret ?? '' }, { force: args.values.force === true, comment: `End-user API key ${key.id} (${subjectType} ${subjectId}).` });
+            if (json) {
+                (0, output_1.printJson)(ctx.io, { ...rest, secret_file: path });
+            }
+            else {
+                ctx.io.out(`Created API key ${key.id}.`);
+                ctx.io.out(`Secret written to ${path} (mode 0600). It is shown nowhere else.`);
+            }
+            return 0;
+        }
+        case 'revoke': {
+            const id = (0, shared_1.requireArg)(args.positionals, 2, 'api-key-id');
+            const { client } = (0, shared_1.requireClient)(ctx, args.values);
+            const result = await client.apiKeys.delete(id);
+            if (json)
+                (0, output_1.printJson)(ctx.io, result);
+            else
+                ctx.io.out(`Revoked API key ${result.id}.`);
+            return 0;
+        }
+        default:
+            throw new errors_1.CliError(sub
+                ? `Unknown subcommand 'api-keys ${sub}'. Try: list, create, revoke.`
+                : 'api-keys needs a subcommand: list, create, revoke.');
+    }
+}
+//# sourceMappingURL=api-keys.js.map

package/dist/commands/api-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../../src/commands/api-keys.ts"],"names":[],"mappings":";;AA4BA,0BA0EC;AArGD,kCAA+C;AAE/C,sCAAqC;AACrC,sCAAyE;AACzE,wCAAyD;AACzD,qCAAgE;AAEhE,MAAM,OAAO,GAAqB;IAChC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;IAClC,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE;IACtD,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE;IAClD,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;IACtC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE;IAC1C,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAO,EAAC,CAAC,CAAC,UAAU,CAAC,EAAE;CACzD,CAAC;AAEF,MAAM,aAAa,GAAiC,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;AAE7E,SAAS,gBAAgB,CAAC,KAAyB,EAAE,IAAY;IAC/D,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,iBAAQ,CAAC,4BAA4B,IAAI,uBAAuB,CAAC,CAAC;IACxF,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,KAA0B,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,iBAAQ,CAAC,GAAG,IAAI,oBAAoB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,KAA0B,CAAC;AACpC,CAAC;AAED,4EAA4E;AACrE,KAAK,UAAU,OAAO,CAAC,GAAe,EAAE,IAAgB;IAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,IAAA,kBAAS,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEpC,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,sBAAa,EAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACnD,2EAA2E;YAC3E,MAAM,WAAW,GAAG,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;YACrD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;gBACrC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,gBAAgB,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS;gBACvF,UAAU,EAAE,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC;aAC3C,CAAC,CAAC;YACH,IAAI,IAAI;gBAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;;gBAC7B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAA,oBAAW,EAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACjD,OAAO,CAAC,CAAC;QACX,CAAC;QAED,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,gBAAgB,CAAC,CAAC;YACzF,MAAM,SAAS,GAAG,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YACjD,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,iBAAQ,CAAC,6CAA6C,CAAC,CAAC;YAClF,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,sBAAa,EAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACnD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;gBACtC,YAAY,EAAE,WAAW;gBACzB,UAAU,EAAE,SAAS;gBACrB,IAAI,EAAE,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;aAC/B,CAAC,CAAC;YACH,yEAAyE;YACzE,wEAAwE;YACxE,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,IAAI,CAAC;YACzD,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;YAChC,IAAI,WAAW,EAAE,CAAC;gBAChB,GAAG,CAAC,EAAE,CAAC,GAAG,CACR,6IAA6I,CAC9I,CAAC;gBACF,IAAI,IAAI;oBAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;qBAC5B,CAAC;oBACJ,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,mBAAmB,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;oBACzC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,wBAAwB,MAAM,EAAE,CAAC,CAAC;gBAC/C,CAAC;gBACD,OAAO,CAAC,CAAC;YACX,CAAC;YACD,MAAM,EAAE,IAAI,EAAE,GAAG,IAAA,yBAAe,EAC9B,IAAA,oBAAU,EAAC,GAAG,CAAC,GAAG,EAAE,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,WAAW,CAAC,EAC/D,WAAW,GAAG,CAAC,EAAE,MAAM,EACvB,EAAE,aAAa,EAAE,MAAM,IAAI,EAAE,EAAE,EAC/B,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,EAAE,OAAO,EAAE,oBAAoB,GAAG,CAAC,EAAE,KAAK,WAAW,IAAI,SAAS,IAAI,EAAE,CAC5G,CAAC;YACF,IAAI,IAAI,EAAE,CAAC;gBACT,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;YACpD,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,mBAAmB,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;gBACzC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,qBAAqB,IAAI,yCAAyC,CAAC,CAAC;YACjF,CAAC;YACD,OAAO,CAAC,CAAC;QACX,CAAC;QAED,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,EAAE,GAAG,IAAA,mBAAU,EAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,YAAY,CAAC,CAAC;YACzD,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,sBAAa,EAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC/C,IAAI,IAAI;gBAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;;gBAC/B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;YACjD,OAAO,CAAC,CAAC;QACX,CAAC;QAED;YACE,MAAM,IAAI,iBAAQ,CAChB,GAAG;gBACD,CAAC,CAAC,gCAAgC,GAAG,+BAA+B;gBACpE,CAAC,CAAC,oDAAoD,CACzD,CAAC;IACN,CAAC;AACH,CAAC"}

package/dist/commands/auth.d.ts

@@ -0,0 +1,25 @@
+import { type ParsedArgs } from '../args';
+import type { RunContext } from '../context';
+/**
+ * `atlas login` — prompt for an API URL + a secret key, PROVE the key works
+ * with one cheap Backend call, then store it under a named profile (0600).
+ *
+ * Validating before saving is the point: a login that silently stored a typo'd
+ * key would surface only later as a baffling 401 on an unrelated command. We
+ * spend one `users.list({ limit: 1 })` round-trip here so every later command
+ * can trust the stored credential. `--url` / `--secret-key` skip the prompts
+ * for non-interactive setup (CI), mirroring the `ATLAS_*` env overrides.
+ */
+export declare function login(ctx: RunContext, args: ParsedArgs): Promise<number>;
+/**
+ * `atlas logout` — forget one profile's stored credential. If it was the active
+ * profile, the active pointer falls back to any remaining profile so the CLI
+ * isn't left pointing at nothing.
+ */
+export declare function logout(ctx: RunContext, args: ParsedArgs): Promise<number>;
+/**
+ * `atlas whoami` — report the active profile and instance without any network
+ * call. The secret is always masked; the per-field source tells a user whether
+ * an `ATLAS_*` env var is shadowing the stored profile.
+ */
+export declare function whoami(ctx: RunContext, args: ParsedArgs): Promise<number>;

package/dist/commands/auth.js

@@ -0,0 +1,102 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.login = login;
+exports.logout = logout;
+exports.whoami = whoami;
+const backend_1 = require("@atlasauth/backend");
+const args_1 = require("../args");
+const errors_1 = require("../errors");
+const output_1 = require("../output");
+const project_1 = require("../project");
+const shared_1 = require("./shared");
+const operator_1 = require("./operator");
+/**
+ * `atlas login` — prompt for an API URL + a secret key, PROVE the key works
+ * with one cheap Backend call, then store it under a named profile (0600).
+ *
+ * Validating before saving is the point: a login that silently stored a typo'd
+ * key would surface only later as a baffling 401 on an unrelated command. We
+ * spend one `users.list({ limit: 1 })` round-trip here so every later command
+ * can trust the stored credential. `--url` / `--secret-key` skip the prompts
+ * for non-interactive setup (CI), mirroring the `ATLAS_*` env overrides.
+ */
+async function login(ctx, args) {
+    const { values } = args;
+    // `--device`: operator sign-in through Atlas's own sign-in page (no key stored).
+    if (values.device === true)
+        return (0, operator_1.deviceLogin)(ctx, args);
+    const profile = (0, args_1.str)(values, 'profile') || 'default';
+    const apiUrl = (0, args_1.str)(values, 'url') ||
+        (await ctx.prompt.text('Atlas API URL', { default: backend_1.DEFAULT_API_URL })) ||
+        backend_1.DEFAULT_API_URL;
+    const secretKey = (0, args_1.str)(values, 'secret-key') || (await ctx.prompt.secret('Atlas secret key (sk_...)'));
+    if (!secretKey)
+        throw new errors_1.CliError('A secret key is required to log in.');
+    // Prove the credential before persisting it. A platform key (psk_, for
+    // `atlas init`) is proven against the platform API instead.
+    try {
+        if (secretKey.startsWith('psk_') || /^atlas_(live|test)_psk_/.test(secretKey))
+            await (0, project_1.httpFor)(ctx, { secretKey, apiUrl }).get('/v1/platform/apps');
+        else
+            await ctx.makeClient({ secretKey, apiUrl }).users.list({ limit: 1 });
+    }
+    catch (err) {
+        if (err instanceof backend_1.AtlasApiError) {
+            throw new errors_1.CliError(`Secret key rejected by ${apiUrl} (HTTP ${err.status}${err.code ? `, ${err.code}` : ''}). Nothing was saved.`);
+        }
+        // A network/DNS failure, not a bad key — say so distinctly.
+        const detail = err instanceof Error ? err.message : String(err);
+        throw new errors_1.CliError(`Could not reach ${apiUrl}: ${detail}. Nothing was saved.`);
+    }
+    const file = ctx.config.load();
+    file.profiles[profile] = { api_url: apiUrl, secret_key: secretKey };
+    file.active_profile = profile;
+    ctx.config.save(file);
+    ctx.io.out(`Logged in to ${apiUrl} as profile '${profile}'.`);
+    ctx.io.out(`Credential stored at ${ctx.config.path} (mode 0600).`);
+    return 0;
+}
+/**
+ * `atlas logout` — forget one profile's stored credential. If it was the active
+ * profile, the active pointer falls back to any remaining profile so the CLI
+ * isn't left pointing at nothing.
+ */
+async function logout(ctx, args) {
+    const { values } = args;
+    const file = ctx.config.load();
+    const profile = (0, args_1.str)(values, 'profile') || file.active_profile || 'default';
+    if (!file.profiles[profile]) {
+        ctx.io.out(`No stored credential for profile '${profile}'.`);
+        return 0;
+    }
+    delete file.profiles[profile];
+    if (file.active_profile === profile) {
+        file.active_profile = Object.keys(file.profiles)[0];
+    }
+    ctx.config.save(file);
+    ctx.io.out(`Logged out of profile '${profile}'.`);
+    return 0;
+}
+/**
+ * `atlas whoami` — report the active profile and instance without any network
+ * call. The secret is always masked; the per-field source tells a user whether
+ * an `ATLAS_*` env var is shadowing the stored profile.
+ */
+async function whoami(ctx, args) {
+    const auth = (0, shared_1.resolveAuth)(ctx, args.values);
+    if ((0, shared_1.wantsJson)(args.values)) {
+        (0, output_1.printJson)(ctx.io, {
+            profile: auth.profile,
+            api_url: auth.apiUrl,
+            secret_key: (0, shared_1.maskSecret)(auth.secretKey),
+            key_source: auth.keySource,
+            url_source: auth.urlSource,
+        });
+        return 0;
+    }
+    ctx.io.out(`Profile:    ${auth.profile}`);
+    ctx.io.out(`API URL:    ${auth.apiUrl} (${auth.urlSource})`);
+    ctx.io.out(`Secret key: ${(0, shared_1.maskSecret)(auth.secretKey)} (${auth.keySource})`);
+    return 0;
+}
+//# sourceMappingURL=auth.js.map

package/dist/commands/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":";;AAmBA,sBAsCC;AAOD,wBAkBC;AAOD,wBAkBC;AA3GD,gDAAoE;AACpE,kCAA+C;AAE/C,sCAAqC;AACrC,sCAAsC;AACtC,wCAAqC;AACrC,qCAA8D;AAC9D,yCAAyC;AAEzC;;;;;;;;;GASG;AACI,KAAK,UAAU,KAAK,CAAC,GAAe,EAAE,IAAgB;IAC3D,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,iFAAiF;IACjF,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,IAAA,sBAAW,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,IAAA,UAAG,EAAC,MAAM,EAAE,SAAS,CAAC,IAAI,SAAS,CAAC;IAEpD,MAAM,MAAM,GACV,IAAA,UAAG,EAAC,MAAM,EAAE,KAAK,CAAC;QAClB,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,OAAO,EAAE,yBAAe,EAAE,CAAC,CAAC;QACtE,yBAAe,CAAC;IAClB,MAAM,SAAS,GAAG,IAAA,UAAG,EAAC,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAEtG,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,iBAAQ,CAAC,qCAAqC,CAAC,CAAC;IAE1E,uEAAuE;IACvE,4DAA4D;IAC5D,IAAI,CAAC;QACH,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,MAAM,IAAA,iBAAO,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;;YAC7I,MAAM,GAAG,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,uBAAa,EAAE,CAAC;YACjC,MAAM,IAAI,iBAAQ,CAChB,0BAA0B,MAAM,UAAU,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,uBAAuB,CAC9G,CAAC;QACJ,CAAC;QACD,4DAA4D;QAC5D,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,iBAAQ,CAAC,mBAAmB,MAAM,KAAK,MAAM,sBAAsB,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IACpE,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC;IAC9B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEtB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,gBAAgB,MAAM,gBAAgB,OAAO,IAAI,CAAC,CAAC;IAC9D,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,wBAAwB,GAAG,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,CAAC;IACnE,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,MAAM,CAAC,GAAe,EAAE,IAAgB;IAC5D,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAG,IAAA,UAAG,EAAC,MAAM,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,cAAc,IAAI,SAAS,CAAC;IAE3E,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,qCAAqC,OAAO,IAAI,CAAC,CAAC;QAC7D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,cAAc,KAAK,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEtB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,0BAA0B,OAAO,IAAI,CAAC,CAAC;IAClD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,MAAM,CAAC,GAAe,EAAE,IAAgB;IAC5D,MAAM,IAAI,GAAG,IAAA,oBAAW,EAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAE3C,IAAI,IAAA,kBAAS,EAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE;YAChB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,IAAI,CAAC,MAAM;YACpB,UAAU,EAAE,IAAA,mBAAU,EAAC,IAAI,CAAC,SAAS,CAAC;YACtC,UAAU,EAAE,IAAI,CAAC,SAAS;YAC1B,UAAU,EAAE,IAAI,CAAC,SAAS;SAC3B,CAAC,CAAC;QACH,OAAO,CAAC,CAAC;IACX,CAAC;IAED,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1C,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;IAC7D,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,eAAe,IAAA,mBAAU,EAAC,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;IAC5E,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/commands/config.d.ts

@@ -0,0 +1,104 @@
+import { type ParsedArgs, type Values } from '../args';
+import { type ConfigHttp } from '../config-http';
+import type { RunContext } from '../context';
+import { type Format, type Json } from '../serialize';
+/** A config document ready for disk / comparison: a plain, redacted JSON value. */
+type Config = Json;
+/** `atlas config export|import` — Auth0 `deploy-cli`-style config-as-code. */
+export declare function config(ctx: RunContext, args: ParsedArgs): Promise<number>;
+export declare function resolveFormat(values: Values): Format;
+export interface Change {
+    type: string;
+    action: 'create' | 'update' | 'delete';
+    key: string;
+    /** The live document (absent on a create). Carried for `atlas config plan`'s field diff. */
+    before?: Config;
+    /** The desired document (absent on a delete). */
+    after?: Config;
+}
+/** A planned change and the call that applies it. */
+export interface PlannedChange extends Change {
+    apply: () => Promise<void>;
+}
+/** What `atlas config import` would do: the changes, the unchanged count and the skipped deletes. */
+export interface ConfigPlan {
+    changes: PlannedChange[];
+    unchanged: number;
+    skippedDeletes: Change[];
+    /** Live resources owned by a connected platform: shown for information, never changed. */
+    managed: Array<{
+        type: string;
+        key: string;
+        managedBy: string;
+    }>;
+}
+/**
+ * Diff a config directory against the live instance. Nothing is written: the
+ * returned changes carry their own `apply`. Used by `atlas config import` and by
+ * `atlas migrate better-auth` (which shows the plan before applying it).
+ */
+export declare function planConfigImport(http: ConfigHttp, opts: {
+    dir: string;
+    format: Format;
+    env: NodeJS.ProcessEnv;
+    prune: boolean;
+    forceHook?: boolean;
+}): Promise<ConfigPlan>;
+/** One differing field between the live and the desired document. */
+export interface FieldDiff {
+    path: string;
+    before?: Json;
+    after?: Json;
+}
+/** Leaf-level differences between two documents, as dotted paths (arrays compare whole). */
+export declare function diffFields(before: Json | undefined, after: Json | undefined, path?: string): FieldDiff[];
+/**
+ * The environment `${VAR}` placeholders resolve against: the process env, then
+ * `--secrets-file` (a dotenv file) on top. The file holds credentials, so it
+ * must be readable by its owner only (mode 0600 or stricter); anything looser
+ * is refused rather than read. POSIX only: Windows has no such mode bits.
+ */
+export declare function readSecretsEnv(ctx: RunContext, values: Values): NodeJS.ProcessEnv;
+/** `${VAR}` placeholders still in a planned change (no env value and no --secrets-file entry). */
+export declare function unresolvedPlaceholders(changes: Change[]): string[];
+/** The resource types a single config file may hold, in the order they are applied. */
+export declare function configTypes(): string[];
+/**
+ * Resolve `atlas plan|apply [<path>]`: a directory of per-type files (as
+ * `atlas config export` writes), or ONE file whose top-level keys are resource
+ * types (`instance`, `webhook_endpoints`, …), split into a temp directory.
+ * `cleanup` removes that temp directory.
+ */
+/** Config files `atlas plan` / `atlas apply` pick up from the current directory when given no path. */
+export declare const DEFAULT_CONFIG_FILES: string[];
+/**
+ * Load an `atlas.config.ts` (or .js/.mjs): its default export is the config
+ * object, or a function (sync or async) returning it. A .ts file runs on
+ * Node's own type stripping (Node 22.18+ / 23.6+), so it adds no dependency.
+ */
+export declare function loadCodeConfig(path: string): Promise<unknown>;
+/**
+ * `atlas plan [<file|dir>]`: the read-only diff of `atlas config plan`, taking
+ * a single config file as well. `--check` exits 2 on drift for CI.
+ */
+export declare function planCommand(ctx: RunContext, args: ParsedArgs): Promise<number>;
+/**
+ * `atlas apply [<file|dir>]`: plan, show it, confirm, then apply in the fixed
+ * resource order (see {@link configTypes}). `--yes` skips the question (needed
+ * when there is no terminal); `--check` only plans and exits 2 on drift.
+ * Refuses to apply while any `${VAR}` placeholder is unresolved, so a missing
+ * secret is never sent as the literal text.
+ */
+export declare function applyCommand(ctx: RunContext, args: ParsedArgs): Promise<number>;
+export declare function printPlan(ctx: RunContext, changes: Change[], unchanged: number, skippedDeletes: Change[], opts: {
+    dryRun: boolean;
+    prune: boolean;
+}): void;
+/**
+ * Replace `${ENV_VAR}` placeholders inside any string with the environment's
+ * value — the one sanctioned way a secret enters an import without ever living
+ * on disk. An unset variable is left verbatim so the plan surfaces it rather
+ * than silently blanking a credential.
+ */
+export declare function interpolate(value: Json, env: NodeJS.ProcessEnv): Json;
+export {};