@atlasauth/cli 0.25.0 → 0.25.1

package/dist/secrets.d.ts

@@ -0,0 +1,41 @@
+import type { IO } from './io';
+export declare function assertProductName(product: string): string;
+/** `$XDG_CONFIG_HOME/<product>` (default `~/.config/<product>`). */
+export declare function productDir(env: NodeJS.ProcessEnv, product: string): string;
+export declare function renderDotenv(entries: Record<string, string>, comment?: string): string;
+/** Parse a dotenv file this CLI wrote (KEY=value lines, `#` comments). */
+export declare function parseDotenv(text: string): Record<string, string>;
+/**
+ * Write a 0600 dotenv file inside a 0700 directory. Refuses an existing file
+ * unless `force` (the same content is not a conflict: a re-run is a no-op).
+ * Returns the path.
+ */
+export declare function writeSecretFile(dir: string, fileName: string, entries: Record<string, string>, opts?: {
+    force?: boolean;
+    comment?: string;
+}): {
+    path: string;
+    written: boolean;
+};
+/** Read one of the CLI's env files, or undefined when it does not exist. */
+export declare function readEnvFile(path: string): Record<string, string> | undefined;
+/** The env files in a product directory (for `atlas env`). */
+export declare function listEnvFiles(dir: string): string[];
+/**
+ * The common "a secret arrived" path for single-secret commands: write it to
+ * `<dir>/<fileName>` (0600) and print the path, or — only with
+ * `--print-secret` — print it after a warning on stderr.
+ */
+export declare function deliverSecret(input: {
+    io: IO;
+    env: NodeJS.ProcessEnv;
+    product: string;
+    fileName: string;
+    entries: Record<string, string>;
+    label: string;
+    printSecret?: boolean;
+    force?: boolean;
+    comment?: string;
+}): {
+    path?: string;
+};

package/dist/secrets.js

@@ -0,0 +1,142 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertProductName = assertProductName;
+exports.productDir = productDir;
+exports.renderDotenv = renderDotenv;
+exports.parseDotenv = parseDotenv;
+exports.writeSecretFile = writeSecretFile;
+exports.readEnvFile = readEnvFile;
+exports.listEnvFiles = listEnvFiles;
+exports.deliverSecret = deliverSecret;
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const errors_1 = require("./errors");
+/**
+ * Secrets the CLI receives are written to disk, never printed.
+ *
+ * Every command that gets a secret back from the API (an instance secret key,
+ * an OAuth client secret, a webhook signing secret, an end-user API key) writes
+ * it to a dotenv file under `~/.config/<product>/` — directory 0700, file 0600 —
+ * and prints only the file path. `--print-secret` is the one explicit opt-out,
+ * and it prints a warning first. An existing file is never overwritten unless
+ * the command was given `--force`, so a re-run cannot silently destroy the only
+ * copy of a working secret.
+ *
+ * The product name doubles as the directory name, so it is restricted to a safe
+ * slug (no path separators, no dot-dot).
+ */
+const PRODUCT_RE = /^[a-z0-9][a-z0-9_-]{0,62}$/i;
+function assertProductName(product) {
+    if (!PRODUCT_RE.test(product)) {
+        throw new errors_1.CliError(`--product must be letters, digits, '-' or '_' (up to 63 characters), got '${product}'.`);
+    }
+    return product;
+}
+/** `$XDG_CONFIG_HOME/<product>` (default `~/.config/<product>`). */
+function productDir(env, product) {
+    const base = env.XDG_CONFIG_HOME?.trim() || (0, node_path_1.join)(env.HOME?.trim() || (0, node_os_1.homedir)(), '.config');
+    return (0, node_path_1.join)(base, assertProductName(product));
+}
+/** Quote a dotenv value when it needs it. Secrets are token-shaped, so this is rarely used. */
+function dotenvValue(v) {
+    return /^[A-Za-z0-9_./:@+=,-]*$/.test(v) ? v : JSON.stringify(v);
+}
+function renderDotenv(entries, comment) {
+    const lines = comment ? comment.split('\n').map((l) => `# ${l}`) : [];
+    for (const [k, v] of Object.entries(entries))
+        lines.push(`${k}=${dotenvValue(v)}`);
+    return lines.join('\n') + '\n';
+}
+/** Parse a dotenv file this CLI wrote (KEY=value lines, `#` comments). */
+function parseDotenv(text) {
+    const out = {};
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        const i = line.indexOf('=');
+        if (i < 1)
+            continue;
+        const key = line.slice(0, i).trim();
+        let value = line.slice(i + 1).trim();
+        if (value.startsWith('"') && value.endsWith('"')) {
+            try {
+                value = JSON.parse(value);
+            }
+            catch {
+                /* keep raw */
+            }
+        }
+        out[key] = value;
+    }
+    return out;
+}
+/**
+ * Write a 0600 dotenv file inside a 0700 directory. Refuses an existing file
+ * unless `force` (the same content is not a conflict: a re-run is a no-op).
+ * Returns the path.
+ */
+function writeSecretFile(dir, fileName, entries, opts = {}) {
+    if (fileName.includes('/') || fileName.includes('\\') || fileName.startsWith('.')) {
+        throw new errors_1.CliError(`Refusing to write a secret file named '${fileName}'.`);
+    }
+    const path = (0, node_path_1.join)(dir, fileName);
+    const content = renderDotenv(entries, opts.comment);
+    (0, node_fs_1.mkdirSync)(dir, { recursive: true, mode: 0o700 });
+    (0, node_fs_1.chmodSync)(dir, 0o700);
+    if ((0, node_fs_1.existsSync)(path)) {
+        const current = (0, node_fs_1.readFileSync)(path, 'utf8');
+        if (current === content) {
+            (0, node_fs_1.chmodSync)(path, 0o600);
+            return { path, written: false };
+        }
+        if (!opts.force) {
+            throw new errors_1.CliError(`${path} already exists and holds a different secret. Nothing was overwritten. Move it aside, or re-run with --force to replace it.`);
+        }
+    }
+    // Write THEN chmod: `mode` is masked by umask and ignored for an existing file.
+    (0, node_fs_1.writeFileSync)(path, content, { mode: 0o600 });
+    (0, node_fs_1.chmodSync)(path, 0o600);
+    return { path, written: true };
+}
+/** Read one of the CLI's env files, or undefined when it does not exist. */
+function readEnvFile(path) {
+    try {
+        return parseDotenv((0, node_fs_1.readFileSync)(path, 'utf8'));
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The env files in a product directory (for `atlas env`). */
+function listEnvFiles(dir) {
+    try {
+        return (0, node_fs_1.readdirSync)(dir)
+            .filter((f) => f.endsWith('.env'))
+            .sort();
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * The common "a secret arrived" path for single-secret commands: write it to
+ * `<dir>/<fileName>` (0600) and print the path, or — only with
+ * `--print-secret` — print it after a warning on stderr.
+ */
+function deliverSecret(input) {
+    if (input.printSecret) {
+        input.io.err(`atlas: warning: printing ${input.label} because --print-secret was given. It may end up in your shell history, terminal scrollback or CI logs.`);
+        for (const [k, v] of Object.entries(input.entries))
+            input.io.out(`${k}=${v}`);
+        return {};
+    }
+    const { path } = writeSecretFile(productDir(input.env, input.product), input.fileName, input.entries, {
+        force: input.force,
+        comment: input.comment,
+    });
+    input.io.out(`${input.label} written to ${path} (mode 0600).`);
+    return { path };
+}
+//# sourceMappingURL=secrets.js.map

package/dist/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":";;AAuBA,8CAOC;AAGD,gCAGC;AAOD,oCAIC;AAGD,kCAmBC;AAOD,0CA6BC;AAGD,kCAMC;AAGD,oCAQC;AAOD,sCAwBC;AA5JD,qCAAqG;AACrG,qCAAkC;AAClC,yCAAiC;AACjC,qCAAoC;AAGpC;;;;;;;;;;;;;GAaG;AAEH,MAAM,UAAU,GAAG,6BAA6B,CAAC;AAEjD,SAAgB,iBAAiB,CAAC,OAAe;IAC/C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,iBAAQ,CAChB,6EAA6E,OAAO,IAAI,CACzF,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,oEAAoE;AACpE,SAAgB,UAAU,CAAC,GAAsB,EAAE,OAAe;IAChE,MAAM,IAAI,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,IAAA,gBAAI,EAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,IAAA,iBAAO,GAAE,EAAE,SAAS,CAAC,CAAC;IAC3F,OAAO,IAAA,gBAAI,EAAC,IAAI,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,+FAA+F;AAC/F,SAAS,WAAW,CAAC,CAAS;IAC5B,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,SAAgB,YAAY,CAAC,OAA+B,EAAE,OAAgB;IAC5E,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC;AAED,0EAA0E;AAC1E,SAAgB,WAAW,CAAC,IAAY;IACtC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACpC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC;gBACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAW,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc;YAChB,CAAC;QACH,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAgB,eAAe,CAC7B,GAAW,EACX,QAAgB,EAChB,OAA+B,EAC/B,OAA8C,EAAE;IAEhD,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,iBAAQ,CAAC,0CAA0C,QAAQ,IAAI,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,IAAI,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACpD,IAAA,mBAAS,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,IAAA,mBAAS,EAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtB,IAAI,IAAA,oBAAU,EAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3C,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACxB,IAAA,mBAAS,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACvB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAClC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,iBAAQ,CAChB,GAAG,IAAI,6HAA6H,CACrI,CAAC;QACJ,CAAC;IACH,CAAC;IACD,gFAAgF;IAChF,IAAA,uBAAa,EAAC,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9C,IAAA,mBAAS,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,4EAA4E;AAC5E,SAAgB,WAAW,CAAC,IAAY;IACtC,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,8DAA8D;AAC9D,SAAgB,YAAY,CAAC,GAAW;IACtC,IAAI,CAAC;QACH,OAAO,IAAA,qBAAW,EAAC,GAAG,CAAC;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;aACjC,IAAI,EAAE,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAAC,KAU7B;IACC,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,KAAK,CAAC,EAAE,CAAC,GAAG,CACV,4BAA4B,KAAK,CAAC,KAAK,yGAAyG,CACjJ,CAAC;QACF,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;YAAE,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9E,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,GAAG,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE;QACpG,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IACH,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,eAAe,IAAI,eAAe,CAAC,CAAC;IAC/D,OAAO,EAAE,IAAI,EAAE,CAAC;AAClB,CAAC"}

package/dist/serialize.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The on-disk format for `atlas config` — the config-as-code layer. Two
+ * concerns live here, kept away from the command logic:
+ *
+ *  1. CANONICALIZATION. A value is normalised before it is written or compared
+ *     so an export is byte-for-byte deterministic and a round-trip is a no-op
+ *     diff. We sort object keys (the same rule Go's `json.Marshal` and the
+ *     Terraform provider's `canonicalJSON` use) and PRESERVE array order — so a
+ *     field whose order is meaningful (a claim mapping, an auth_config list) is
+ *     never silently reordered.
+ *
+ *  2. THE CODEC. JSON is the robust default. YAML is offered for readable diffs
+ *     in a repo; we WRITE a small subset where every map key and every scalar is
+ *     JSON-encoded (it round-trips exactly: newlines, URL-shaped keys, unicode),
+ *     and READ any YAML, so a hand-written atlas.yaml works too.
+ */
+export type Json = string | number | boolean | null | Json[] | {
+    [k: string]: Json;
+};
+export type Format = 'json' | 'yaml';
+/** A plain JSON value with all object keys recursively sorted; arrays untouched. */
+export declare function canonicalize(value: unknown): Json;
+/** Canonical JSON string — the equality oracle for the diff engine. */
+export declare function canonicalString(value: unknown): string;
+/** True when two config values are equal after canonicalization. */
+export declare function deepEqual(a: unknown, b: unknown): boolean;
+/** Serialize a canonicalizable value to the chosen format, with a trailing newline. */
+export declare function serialize(value: unknown, format: Format): string;
+/** Parse a document written by {@link serialize}. */
+export declare function deserialize(text: string, format: Format): Json;

package/dist/serialize.js

@@ -0,0 +1,131 @@
+"use strict";
+/**
+ * The on-disk format for `atlas config` — the config-as-code layer. Two
+ * concerns live here, kept away from the command logic:
+ *
+ *  1. CANONICALIZATION. A value is normalised before it is written or compared
+ *     so an export is byte-for-byte deterministic and a round-trip is a no-op
+ *     diff. We sort object keys (the same rule Go's `json.Marshal` and the
+ *     Terraform provider's `canonicalJSON` use) and PRESERVE array order — so a
+ *     field whose order is meaningful (a claim mapping, an auth_config list) is
+ *     never silently reordered.
+ *
+ *  2. THE CODEC. JSON is the robust default. YAML is offered for readable diffs
+ *     in a repo; we WRITE a small subset where every map key and every scalar is
+ *     JSON-encoded (it round-trips exactly: newlines, URL-shaped keys, unicode),
+ *     and READ any YAML, so a hand-written atlas.yaml works too.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canonicalize = canonicalize;
+exports.canonicalString = canonicalString;
+exports.deepEqual = deepEqual;
+exports.serialize = serialize;
+exports.deserialize = deserialize;
+const yaml_1 = require("yaml");
+/** A plain JSON value with all object keys recursively sorted; arrays untouched. */
+function canonicalize(value) {
+    if (value === null || value === undefined)
+        return null;
+    if (Array.isArray(value))
+        return value.map((v) => canonicalize(v));
+    if (typeof value === 'object') {
+        const out = {};
+        for (const key of Object.keys(value).sort()) {
+            const v = value[key];
+            if (v === undefined)
+                continue; // omit undefined so it never reaches disk
+            out[key] = canonicalize(v);
+        }
+        return out;
+    }
+    if (typeof value === 'number' || typeof value === 'boolean' || typeof value === 'string') {
+        return value;
+    }
+    // Functions, symbols, bigint: not part of a config document.
+    return null;
+}
+/** Canonical JSON string — the equality oracle for the diff engine. */
+function canonicalString(value) {
+    return JSON.stringify(canonicalize(value));
+}
+/** True when two config values are equal after canonicalization. */
+function deepEqual(a, b) {
+    return canonicalString(a) === canonicalString(b);
+}
+/** Serialize a canonicalizable value to the chosen format, with a trailing newline. */
+function serialize(value, format) {
+    const canon = canonicalize(value);
+    if (format === 'json')
+        return JSON.stringify(canon, null, 2) + '\n';
+    return emitYaml(canon, 0) + '\n';
+}
+/** Parse a document written by {@link serialize}. */
+function deserialize(text, format) {
+    if (format === 'json')
+        return JSON.parse(text);
+    return parseYaml(text);
+}
+// ─────────────────────────────── YAML emit ───────────────────────────────
+const INDENT = '  ';
+function emitYaml(value, depth) {
+    const pad = INDENT.repeat(depth);
+    if (Array.isArray(value)) {
+        if (value.length === 0)
+            return `${pad}[]`;
+        return value.map((item) => emitSeqItem(item, depth)).join('\n');
+    }
+    if (value !== null && typeof value === 'object') {
+        const keys = Object.keys(value);
+        if (keys.length === 0)
+            return `${pad}{}`;
+        return keys.map((key) => emitMapEntry(key, value[key], depth)).join('\n');
+    }
+    // A bare scalar document.
+    return `${pad}${JSON.stringify(value)}`;
+}
+function emitMapEntry(key, value, depth) {
+    const pad = INDENT.repeat(depth);
+    const k = JSON.stringify(key);
+    if (isContainer(value) && !isEmptyContainer(value)) {
+        return `${pad}${k}:\n${emitYaml(value, depth + 1)}`;
+    }
+    return `${pad}${k}: ${scalarOrEmpty(value)}`;
+}
+function emitSeqItem(value, depth) {
+    const pad = INDENT.repeat(depth);
+    if (isContainer(value) && !isEmptyContainer(value)) {
+        return `${pad}-\n${emitYaml(value, depth + 1)}`;
+    }
+    return `${pad}- ${scalarOrEmpty(value)}`;
+}
+function scalarOrEmpty(value) {
+    if (Array.isArray(value))
+        return '[]';
+    if (value !== null && typeof value === 'object')
+        return '{}';
+    return JSON.stringify(value);
+}
+function isContainer(v) {
+    return Array.isArray(v) || (v !== null && typeof v === 'object');
+}
+function isEmptyContainer(v) {
+    if (Array.isArray(v))
+        return v.length === 0;
+    if (v !== null && typeof v === 'object')
+        return Object.keys(v).length === 0;
+    return false;
+}
+// ─────────────────────────────── YAML parse ───────────────────────────────
+/**
+ * Any YAML 1.2 document: our own export (JSON-encoded keys and scalars) and a
+ * hand-written atlas.yaml with plain keys alike.
+ */
+function parseYaml(text) {
+    try {
+        return ((0, yaml_1.parse)(text) ?? null);
+    }
+    catch (err) {
+        throw new Error(`atlas config: invalid YAML: ${err.message}`);
+    }
+}
+//# sourceMappingURL=serialize.js.map

package/dist/serialize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serialize.js","sourceRoot":"","sources":["../src/serialize.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;AAQH,oCAiBC;AAGD,0CAEC;AAGD,8BAEC;AAGD,8BAIC;AAGD,kCAGC;AA9CD,+BAAkD;AAKlD,oFAAoF;AACpF,SAAgB,YAAY,CAAC,KAAc;IACzC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAA0B,EAAE,CAAC;QACtC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACvE,MAAM,CAAC,GAAI,KAAiC,CAAC,GAAG,CAAC,CAAC;YAClD,IAAI,CAAC,KAAK,SAAS;gBAAE,SAAS,CAAC,0CAA0C;YACzE,GAAG,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACzF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,6DAA6D;IAC7D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uEAAuE;AACvE,SAAgB,eAAe,CAAC,KAAc;IAC5C,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,oEAAoE;AACpE,SAAgB,SAAS,CAAC,CAAU,EAAE,CAAU;IAC9C,OAAO,eAAe,CAAC,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,uFAAuF;AACvF,SAAgB,SAAS,CAAC,KAAc,EAAE,MAAc;IACtD,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;IACpE,OAAO,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;AACnC,CAAC;AAED,qDAAqD;AACrD,SAAgB,WAAW,CAAC,IAAY,EAAE,MAAc;IACtD,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAS,CAAC;IACvD,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,4EAA4E;AAE5E,MAAM,MAAM,GAAG,IAAI,CAAC;AAEpB,SAAS,QAAQ,CAAC,KAAW,EAAE,KAAa;IAC1C,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,GAAG,IAAI,CAAC;QAC1C,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,GAAG,IAAI,CAAC;QACzC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAS,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpF,CAAC;IACD,0BAA0B;IAC1B,OAAO,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,YAAY,CAAC,GAAW,EAAE,KAAW,EAAE,KAAa;IAC3D,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,OAAO,GAAG,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;IACtD,CAAC;IACD,OAAO,GAAG,GAAG,GAAG,CAAC,KAAK,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,WAAW,CAAC,KAAW,EAAE,KAAa;IAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,OAAO,GAAG,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;IAClD,CAAC;IACD,OAAO,GAAG,GAAG,KAAK,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,aAAa,CAAC,KAAW;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,WAAW,CAAC,CAAO;IAC1B,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AACnE,CAAC;AACD,SAAS,gBAAgB,CAAC,CAAO;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IAC5E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,6EAA6E;AAE7E;;;GAGG;AACH,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC;QACH,OAAO,CAAC,IAAA,YAAiB,EAAC,IAAI,CAAC,IAAI,IAAI,CAAS,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,+BAAgC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC"}

package/dist/version.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Read the package version from the shipped package.json at runtime rather than
+ * importing it — `src/` is the tsc rootDir, so a static `import ../package.json`
+ * would both break rootDir and bake a stale number into the bundle. At runtime
+ * `__dirname` is `dist/`, so `../package.json` is the real manifest beside it.
+ */
+export declare function getVersion(): string;

package/dist/version.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getVersion = getVersion;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+/**
+ * Read the package version from the shipped package.json at runtime rather than
+ * importing it — `src/` is the tsc rootDir, so a static `import ../package.json`
+ * would both break rootDir and bake a stale number into the bundle. At runtime
+ * `__dirname` is `dist/`, so `../package.json` is the real manifest beside it.
+ */
+function getVersion() {
+    try {
+        const manifest = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(__dirname, '..', 'package.json'), 'utf8'));
+        return manifest.version ?? '0.0.0';
+    }
+    catch {
+        return '0.0.0';
+    }
+}
+//# sourceMappingURL=version.js.map

package/dist/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":";;AASA,gCASC;AAlBD,qCAAuC;AACvC,yCAAiC;AAEjC;;;;;GAKG;AACH,SAAgB,UAAU;IACxB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAEtF,CAAC;QACF,OAAO,QAAQ,CAAC,OAAO,IAAI,OAAO,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlasauth/cli",
-  "version": "0.25.0",
+  "version": "0.25.1",
   "description": "atlas — manage an Atlas instance from the terminal via the Backend API.",
   "bin": {
     "atlas": "dist/cli.js"
@@ -18,10 +18,10 @@
     "yaml": "^2.6.0",
     "@atlasauth/actions": "0.5.0",
     "@atlasauth/backend": "0.35.0",
-    "@atlasauth/emulator": "0.1.0",
+    "@atlasauth/migrate": "0.2.0",
     "@atlasauth/upgrade": "0.7.0",
     "@atlasauth/referral-conformance": "0.2.1",
-    "@atlasauth/migrate": "0.2.0"
+    "@atlasauth/emulator": "0.1.0"
   },
   "devDependencies": {
     "@types/node": "^22.9.0",