@atlasauth/cli 0.25.0 → 0.26.0

package/dist/commands/config.js

@@ -0,0 +1,1822 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_CONFIG_FILES = void 0;
+exports.config = config;
+exports.resolveFormat = resolveFormat;
+exports.planConfigImport = planConfigImport;
+exports.diffFields = diffFields;
+exports.printedFields = printedFields;
+exports.readSecretsEnv = readSecretsEnv;
+exports.unresolvedPlaceholders = unresolvedPlaceholders;
+exports.configTypes = configTypes;
+exports.loadCodeConfig = loadCodeConfig;
+exports.planCommand = planCommand;
+exports.applyCommand = applyCommand;
+exports.printPlan = printPlan;
+exports.interpolate = interpolate;
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const node_url_1 = require("node:url");
+const args_1 = require("../args");
+const config_http_1 = require("../config-http");
+const errors_1 = require("../errors");
+const serialize_1 = require("../serialize");
+const backend_1 = require("@atlasauth/backend");
+const shared_1 = require("./shared");
+const secrets_1 = require("../secrets");
+const redact_1 = require("../redact");
+/** The refusal `rotate_secret` answers when the secret is the one already stored. */
+const isSameSecretRefusal = (err) => err instanceof backend_1.AtlasApiError && err.status === 422 && /must differ/.test(err.message);
+// ───────────────────────────── small helpers ─────────────────────────────
+/** GET a `{ data: [...] }` list envelope, tolerating an absent/garbled body. */
+async function listData(http, path) {
+    const res = await http.get(path);
+    return Array.isArray(res?.data) ? res.data : [];
+}
+/** Build a config object from a row, keeping only the named keys and dropping null/undefined. */
+function pick(row, keys) {
+    const out = {};
+    for (const k of keys) {
+        const v = row[k];
+        if (v === null || v === undefined)
+            continue;
+        out[k] = v;
+    }
+    return out;
+}
+/**
+ * The write body: strip null/undefined. On a PATCH (`keepNull`) an explicit file
+ * `null` is kept so it clears a nullable field; an absent key stays unmanaged.
+ */
+function compact(config, keepNull = false) {
+    const out = {};
+    if (config && typeof config === 'object' && !Array.isArray(config)) {
+        for (const [k, v] of Object.entries(config)) {
+            if (v === undefined || (v === null && !keepNull))
+                continue;
+            out[k] = v;
+        }
+    }
+    return out;
+}
+function enc(segment) {
+    return encodeURIComponent(segment);
+}
+// ───────────────────────────── the registry ─────────────────────────────
+/**
+ * The single source of truth for what `atlas config` round-trips — the same
+ * resource set the Terraform provider manages. Each entry maps a resource type
+ * to its list/create/update/delete endpoints and its redacted projection.
+ * SECRETS ARE NEVER PART OF A PROJECTION: the management API never returns them
+ * on a read, so they never reach disk; a credential that must be (re)written is
+ * supplied at import time via a `${ENV_VAR}` placeholder in the file.
+ */
+function registry() {
+    const specs = [
+        // 0. Email provider — first, because email sign-in strategies need one. Secrets
+        //    (api_key, …) are write-only: the live side shows "(secret set)", never a value.
+        {
+            kind: 'singleton',
+            type: 'email_provider',
+            async fetchLive(http) {
+                let p;
+                try {
+                    p = await http.get('/v1/messaging_providers/email');
+                }
+                catch (err) {
+                    if ((0, config_http_1.isNotFound)(err))
+                        return null;
+                    throw err;
+                }
+                if (!p || p.configured === false)
+                    return null;
+                const config = { ...obj((p.config ?? null)) };
+                const set = obj((p.secrets_set ?? null));
+                const names = Array.isArray(p.secrets_set) ? p.secrets_set : Object.keys(set).filter((k) => set[k] === true);
+                for (const k of names)
+                    config[k] = SECRET_SET;
+                return pick({ ...p, config }, ['transport', 'from_address', 'config']);
+            },
+            async apply(http, config) {
+                await http.put('/v1/messaging_providers/email', compact(withoutMarkers(config)));
+            },
+            fileKeys: ['transport', 'from_address', 'mode', 'config'],
+            reportsSecrets: true,
+        },
+        // 1. Instance config (auth_config + allowed origins) — the §9.3 singleton.
+        {
+            kind: 'singleton',
+            type: 'instance',
+            fileKeys: ['allowed_origins', 'auth_config'],
+            async fetchLive(http) {
+                const inst = await http.get('/v1/instance');
+                const hints = obj(inst.allowed_origin_integrations ?? null);
+                const origins = originStrings(inst.allowed_origins ?? []).map((o) => (hints[o] ? { origin: o, integration: hints[o] } : o));
+                return { allowed_origins: origins, auth_config: stripOriginIntegrations(inst.auth_config ?? {}) };
+            },
+            async apply(http, config) {
+                const c = compact(config);
+                // Integration hints live in auth_config.originIntegrations server-side and a
+                // write replaces auth_config, so carry the live hints over for any origin the
+                // file names as a plain string (the plan ignores hints the file does not set).
+                const live = await http.get('/v1/instance');
+                const liveHints = obj(live.allowed_origin_integrations ?? null);
+                const authConfig = stripOriginIntegrations(c.auth_config ?? {});
+                const body = { auth_config: authConfig };
+                if (c.allowed_origins !== undefined) {
+                    // A file without allowed_origins leaves the live origins alone (a partial
+                    // document, e.g. one produced by `atlas migrate better-auth config`).
+                    body.allowed_origins = (Array.isArray(c.allowed_origins) ? c.allowed_origins : []).map((e) => typeof e === 'string' && liveHints[e] ? { origin: e, integration: liveHints[e] } : e);
+                }
+                else {
+                    const kept = obj(live.auth_config ?? null).originIntegrations;
+                    if (kept !== undefined)
+                        authConfig.originIntegrations = kept;
+                }
+                await http.patch('/v1/instance', body);
+            },
+            normalize(c) {
+                const d = obj(c);
+                const hints = {};
+                for (const e of Array.isArray(d.allowed_origins) ? d.allowed_origins : []) {
+                    const o = obj(e);
+                    if (o.integration)
+                        hints[String(o.origin)] = o.integration;
+                }
+                const out = {};
+                if (d.allowed_origins !== undefined)
+                    out.allowed_origins = originStrings(d.allowed_origins);
+                if (Object.keys(hints).length)
+                    out.allowed_origin_integrations = hints;
+                if (d.auth_config !== undefined)
+                    out.auth_config = stripOriginIntegrations(d.auth_config);
+                return out;
+            },
+        },
+        // 2. Org settings schema (P1-5) — a singleton JSON Schema; 404 when unset.
+        {
+            kind: 'singleton',
+            type: 'org_settings_schema',
+            fileKeys: ['schema'],
+            async fetchLive(http) {
+                try {
+                    const s = await http.get('/v1/organization_settings_schema');
+                    return { schema: s.schema ?? {} };
+                }
+                catch (err) {
+                    if ((0, config_http_1.isNotFound)(err))
+                        return null;
+                    throw err;
+                }
+            },
+            async apply(http, config) {
+                const c = compact(config);
+                await http.put('/v1/organization_settings_schema', { schema: c.schema ?? {} });
+            },
+        },
+        // 3. Redirect URL allowlist — key = the (normalised) url; immutable, so no update.
+        {
+            kind: 'collection',
+            type: 'redirect_urls',
+            fileKeys: ['url'],
+            keyOf: (c) => String(obj(c).url ?? ''),
+            async fetchLive(http) {
+                const rows = await listData(http, '/v1/redirect_urls');
+                return rows.map((r) => ({ key: r.url, id: r.id, config: pick(r, ['url']) }));
+            },
+            async create(http, config) {
+                await http.post('/v1/redirect_urls', { url: obj(config).url });
+            },
+            async remove(http, live) {
+                await http.delete(`/v1/redirect_urls/${enc(live.id)}`);
+            },
+        },
+        // 4. OAuth clients (first-party / M2M apps) — key = name.
+        {
+            kind: 'collection',
+            type: 'oauth_clients',
+            fileKeys: [...OAUTH_CLIENT_KEYS, ...OAUTH_CLIENT_WRITE_KEYS],
+            keyOf: (c) => String(obj(c).name ?? ''),
+            async fetchLive(http) {
+                const rows = await listData(http, '/v1/oauth_clients');
+                return rows.map((r) => ({
+                    key: String(r.name ?? ''),
+                    id: String(r.id ?? ''),
+                    config: pick(r, OAUTH_CLIENT_KEYS),
+                }));
+            },
+            async create(http, config) {
+                await http.post('/v1/oauth_clients', compact(config));
+            },
+            async update(http, live, config) {
+                await http.patch(`/v1/oauth_clients/${enc(live.id)}`, compact(config, true));
+            },
+            async remove(http, live) {
+                await http.delete(`/v1/oauth_clients/${enc(live.id)}`);
+            },
+        },
+        // 4b. Hooks — after the clients. before_user_create: url, timeout_ms, fail_closed,
+        //     enabled; the signing secret is write-only ("(secret set)").
+        {
+            kind: 'singleton',
+            type: 'hooks',
+            async fetchLive(http) {
+                let h;
+                try {
+                    h = await http.get('/v1/instance/hooks/before_user_create');
+                }
+                catch (err) {
+                    if ((0, config_http_1.isNotFound)(err))
+                        return null;
+                    throw err;
+                }
+                if (!h || (h.url == null && h.enabled !== true))
+                    return null;
+                const bu = pick(h, ['url', 'timeout_ms', 'fail_closed', 'enabled']);
+                if (h.signing_secret_set === true)
+                    bu.signing_secret = SECRET_SET;
+                return { before_user_create: bu };
+            },
+            async apply(http, config, opts) {
+                const bu = compact(obj(withoutMarkers(config)).before_user_create ?? {}, true);
+                if (Object.keys(bu).length === 0)
+                    return;
+                try {
+                    await http.patch(`/v1/instance/hooks/before_user_create${opts.forceHook ? '?force=true' : ''}`, bu);
+                }
+                catch (err) {
+                    const refused = err instanceof backend_1.AtlasApiError && err.status === 409 ? err.errors.find((e) => e.code === 'HOOK_TEST_FAILED') : undefined;
+                    if (refused) {
+                        throw new errors_1.CliError(`hooks.before_user_create: the change was refused because the hook test call failed (HOOK_TEST_FAILED): ${refused.message} ` +
+                            'The hook was left as it was. Deploy the route, or pass --force-hook to apply it anyway.');
+                    }
+                    throw err;
+                }
+            },
+            fileKeys: ['before_user_create'],
+            nestedKeys: { before_user_create: ['url', 'timeout_ms', 'fail_closed', 'enabled', 'signing_secret'] },
+            reportsSecrets: true,
+        },
+        // 5. Social / enterprise OAuth providers — key = the catalog provider slug.
+        {
+            kind: 'collection',
+            type: 'oauth_providers',
+            fileKeys: [...OAUTH_PROVIDER_KEYS, 'client_secret', 'values', 'settings'],
+            reportsSecrets: true,
+            defaulted: ['mode'],
+            writeOnly: ['values'],
+            warnings(config, live) {
+                const c = obj(config);
+                const lv = obj(live ?? null);
+                const inFile = typeof c.client_secret === 'string' && c.client_secret !== '';
+                const out = [];
+                if (c.mode === 'redirect' && !inFile && !lv.client_secret) {
+                    out.push(`oauth_providers ${String(c.provider)}: mode redirect needs a client_secret, and neither the file nor the instance has one.`);
+                }
+                if ((c.mode ?? lv.mode) === 'native' && inFile) {
+                    out.push(`oauth_providers ${String(c.provider)}: secret unused in native mode. Remove client_secret, or set mode: redirect.`);
+                }
+                return out;
+            },
+            keyOf: (c) => String(obj(c).provider ?? ''),
+            async fetchLive(http) {
+                const rows = await listData(http, '/v1/oauth_providers');
+                return rows
+                    .filter((r) => r.configured === true)
+                    .map((r) => ({
+                    key: String(r.provider ?? ''),
+                    id: String(r.provider ?? ''),
+                    config: {
+                        ...obj(pick(r, OAUTH_PROVIDER_KEYS)),
+                        ...(r.setting_values && Object.keys(r.setting_values).length ? { settings: r.setting_values } : {}),
+                        ...(r.has_secret === true ? { client_secret: SECRET_SET } : {}),
+                    },
+                }));
+            },
+            create: putProvider,
+            update: (http, _live, config) => putProvider(http, config),
+            async remove(http, live) {
+                await http.delete(`/v1/oauth_providers/${enc(live.id)}`);
+            },
+        },
+        // 5b. Custom (generic) OAuth 2.0 / OIDC login providers — key = provider_key.
+        {
+            kind: 'collection',
+            type: 'custom_oauth_providers',
+            fileKeys: [...CUSTOM_PROVIDER_KEYS, ...CUSTOM_PROVIDER_WRITE_KEYS],
+            reportsSecrets: true,
+            keyOf: (c) => String(obj(c).provider_key ?? ''),
+            async fetchLive(http) {
+                const rows = await listData(http, '/v1/custom_oauth_providers');
+                return rows.map((r) => ({
+                    key: String(r.provider_key ?? ''),
+                    id: String(r.id ?? ''),
+                    config: { ...obj(pick(r, CUSTOM_PROVIDER_KEYS)), ...(r.has_secret === true ? { client_secret: SECRET_SET } : {}) },
+                }));
+            },
+            async create(http, config) {
+                await http.post('/v1/custom_oauth_providers', compact(config));
+            },
+            async update(http, live, config) {
+                const body = compact(config, true);
+                delete body.provider_key; // immutable
+                await http.patch(`/v1/custom_oauth_providers/${enc(live.id)}`, body);
+            },
+            async remove(http, live) {
+                await http.delete(`/v1/custom_oauth_providers/${enc(live.id)}`);
+            },
+        },
+        // 6. Resource servers (API audiences) — key = identifier.
+        {
+            kind: 'collection',
+            type: 'resource_servers',
+            fileKeys: [...RESOURCE_SERVER_KEYS, 'publish_resource_metadata', 'access_token_format', 'refresh_token_absolute_ttl_seconds', 'refresh_token_idle_ttl_seconds', 'introspection_client_ids'],
+            keyOf: (c) => String(obj(c).identifier ?? ''),
+            async fetchLive(http) {
+                const rows = await listData(http, '/v1/resource_servers');
+                return rows.map((r) => ({
+                    key: String(r.identifier ?? ''),
+                    id: String(r.id ?? ''),
+                    config: pick(r, RESOURCE_SERVER_KEYS),
+                }));
+            },
+            async create(http, config) {
+                const body = compact(config);
+                delete body.signing_alg; // read-only (reported, not settable)
+                await http.post('/v1/resource_servers', body);
+            },
+            async update(http, live, config) {
+                const body = compact(config, true);
+                delete body.identifier; // immutable
+                delete body.signing_alg; // read-only
+                await http.patch(`/v1/resource_servers/${enc(live.id)}`, body);
+            },
+            async remove(http, live) {
+                await http.delete(`/v1/resource_servers/${enc(live.id)}`);
+            },
+        },
+        // 7. JWT templates — key = name; claims is a flat template map.
+        {
+            kind: 'collection',
+            type: 'jwt_templates',
+            fileKeys: ['name', 'claims'],
+            keyOf: (c) => String(obj(c).name ?? ''),
+            async fetchLive(http) {
+                const rows = await listData(http, '/v1/jwt_templates');
+                return rows.map((r) => ({
+                    key: r.name,
+                    id: r.name,
+                    config: { name: r.name, claims: r.claims ?? {} },
+                }));
+            },
+            async create(http, config) {
+                const c = obj(config);
+                await http.post('/v1/jwt_templates', { name: c.name, claims: c.claims ?? {} });
+            },
+            async update(http, live, config) {
+                await http.patch(`/v1/jwt_templates/${enc(live.id)}`, { claims: obj(config).claims ?? {} });
+            },
+            async remove(http, live) {
+                await http.delete(`/v1/jwt_templates/${enc(live.id)}`);
+            },
+        },
+        // 7b. Custom permissions — key = key. Before roles, which grant them. System ones skipped.
+        {
+            kind: 'collection',
+            type: 'permissions',
+            fileKeys: PERMISSION_KEYS,
+            keyOf: (c) => String(obj(c).key ?? ''),
+            async fetchLive(http) {
+                const rows = await listData(http, '/v1/permissions');
+                return rows
+                    .filter((r) => r.is_system !== true)
+                    .map((r) => ({ key: String(r.key ?? ''), id: String(r.id ?? ''), config: pick(r, PERMISSION_KEYS) }));
+            },
+            async create(http, config) {
+                await http.post('/v1/permissions', compact(config));
+            },
+            async update(http, live, config) {
+                const c = obj(config);
+                await http.patch(`/v1/permissions/${enc(live.id)}`, { name: c.name, description: c.description ?? null });
+            },
+            async remove(http, live) {
+                await http.delete(`/v1/permissions/${enc(live.id)}`);
+            },
+        },
+        // 8. Roles — key = key; label via PATCH, permission set via PUT. System roles skipped.
+        {
+            kind: 'collection',
+            type: 'roles',
+            fileKeys: [...ROLE_KEYS, 'visibility'],
+            keyOf: (c) => String(obj(c).key ?? ''),
+            async fetchLive(http) {
+                const rows = await listData(http, '/v1/roles');
+                return rows
+                    .filter((r) => r.is_system !== true)
+                    .map((r) => ({
+                    key: String(r.key ?? ''),
+                    id: String(r.id ?? ''),
+                    config: pick(r, ROLE_KEYS),
+                }));
+            },
+            async create(http, config) {
+                await http.post('/v1/roles', compact(config));
+            },
+            async update(http, live, config) {
+                const c = obj(config);
+                await http.patch(`/v1/roles/${enc(live.id)}`, {
+                    name: c.name,
+                    description: c.description ?? null,
+                });
+                await http.put(`/v1/roles/${enc(live.id)}/permissions`, {
+                    permissions: Array.isArray(c.permissions) ? c.permissions : [],
+                });
+            },
+            async remove(http, live) {
+                await http.delete(`/v1/roles/${enc(live.id)}`);
+            },
+        },
+        // 9. Webhook endpoints — key = url.
+        {
+            kind: 'collection',
+            type: 'webhook_endpoints',
+            fileKeys: [...WEBHOOK_KEYS, 'secret'],
+            // A dry-run rotation tells a new secret from the stored one without revealing either.
+            async secretChanged(http, live, config) {
+                try {
+                    await http.post(`/v1/webhook_endpoints/${enc(live.id)}/rotate_secret?dry_run=true`, { secret: obj(config).secret });
+                    return true;
+                }
+                catch (err) {
+                    return isSameSecretRefusal(err) ? false : null;
+                }
+            },
+            keyOf: (c) => String(obj(c).url ?? ''),
+            async fetchLive(http) {
+                const rows = await listData(http, '/v1/webhook_endpoints');
+                return rows.map((r) => ({
+                    key: String(r.url ?? ''),
+                    id: String(r.id ?? ''),
+                    config: pick(r, WEBHOOK_KEYS),
+                    ...(typeof r.managed_by === 'string' && r.managed_by ? { managedBy: r.managed_by } : {}),
+                }));
+            },
+            async create(http, config) {
+                const c = obj(config);
+                await http.post('/v1/webhook_endpoints', {
+                    url: c.url,
+                    enabled_events: c.enabled_events ?? [],
+                    // Sent on create so a paused endpoint is never live, even briefly.
+                    ...(typeof c.active === 'boolean' ? { active: c.active } : {}),
+                    ...(typeof c.secret === 'string' ? { secret: c.secret } : {}),
+                });
+            },
+            async update(http, live, config) {
+                // PATCH leaves the signing secret alone; only rotate_secret changes it.
+                const { secret, ...rest } = obj(config);
+                await http.patch(`/v1/webhook_endpoints/${enc(live.id)}`, compact(rest, true));
+                if (typeof secret !== 'string' || !secret)
+                    return;
+                try {
+                    await http.post(`/v1/webhook_endpoints/${enc(live.id)}/rotate_secret`, { secret });
+                }
+                catch (err) {
+                    if (!isSameSecretRefusal(err))
+                        throw err;
+                }
+            },
+            async remove(http, live) {
+                await http.delete(`/v1/webhook_endpoints/${enc(live.id)}`);
+            },
+        },
+        // 10. SSO connections — key = a stable identifier derived from the connection.
+        {
+            kind: 'collection',
+            type: 'sso_connections',
+            fileKeys: [...SSO_KEYS, ...SSO_WRITE_KEYS],
+            reportsSecrets: true,
+            writeOnly: ['saml_idp_certificate'],
+            keyOf: ssoKey,
+            async fetchLive(http) {
+                const rows = await listData(http, '/v1/sso_connections');
+                return rows.map((r) => {
+                    const config = { ...obj(pick(r, SSO_KEYS)), ...(r.has_secret === true ? { oidc_client_secret: SECRET_SET, discourse_secret: SECRET_SET } : {}) };
+                    return { key: ssoKey(config), id: String(r.id ?? ''), config };
+                });
+            },
+            async create(http, config) {
+                await http.post('/v1/sso_connections', compact(config));
+            },
+            async update(http, live, config) {
+                const body = compact(config, true);
+                delete body.type; // fixed at creation; PATCH does not take it
+                await http.patch(`/v1/sso_connections/${enc(live.id)}`, body);
+            },
+            async remove(http, live) {
+                await http.delete(`/v1/sso_connections/${enc(live.id)}`);
+            },
+        },
+        // 10b. SSO onboarding profiles (hosted setup links) — key = name. After the SSO
+        //      connections; a profile may name an organization that already exists.
+        {
+            kind: 'collection',
+            type: 'sso_onboarding_profiles',
+            fileKeys: SSO_PROFILE_KEYS,
+            keyOf: (c) => String(obj(c).name ?? ''),
+            async fetchLive(http) {
+                let rows;
+                try {
+                    rows = await listData(http, '/v1/sso_onboarding_profiles');
+                }
+                catch (err) {
+                    if ((0, config_http_1.isNotFound)(err))
+                        return [];
+                    throw err;
+                }
+                return rows.map((r) => {
+                    const config = pick(r, SSO_PROFILE_KEYS);
+                    return { key: String(r.name ?? ''), id: String(r.id ?? ''), config };
+                });
+            },
+            async create(http, config) {
+                await http.post('/v1/sso_onboarding_profiles', compact(config));
+            },
+            async update(http, live, config) {
+                await http.patch(`/v1/sso_onboarding_profiles/${enc(live.id)}`, compact(config, true));
+            },
+            async remove(http, live) {
+                await http.delete(`/v1/sso_onboarding_profiles/${enc(live.id)}`);
+            },
+        },
+        // 11. Billing plans — key = slug.
+        {
+            kind: 'collection',
+            type: 'billing_plans',
+            fileKeys: [...BILLING_KEYS, 'grace_days', 'provider_price_id', 'annual_amount', 'seat_feature_id', 'promotion'],
+            keyOf: (c) => String(obj(c).slug ?? ''),
+            async fetchLive(http) {
+                const rows = await listData(http, '/v1/billing/plans');
+                return rows.map((r) => ({
+                    key: String(r.slug ?? ''),
+                    id: String(r.id ?? ''),
+                    config: pick(r, BILLING_KEYS),
+                }));
+            },
+            async create(http, config) {
+                await http.post('/v1/billing/plans', compact(config));
+            },
+            async update(http, live, config) {
+                const body = compact(config, true);
+                delete body.slug; // immutable
+                await http.patch(`/v1/billing/plans/${enc(live.id)}`, body);
+            },
+            async remove(http, live) {
+                await http.delete(`/v1/billing/plans/${enc(live.id)}`);
+            },
+        },
+        // 12. Notification templates (P2-12) — key = name; replace via PUT.
+        {
+            kind: 'collection',
+            type: 'notification_templates',
+            fileKeys: NOTIFICATION_KEYS,
+            keyOf: (c) => String(obj(c).name ?? ''),
+            async fetchLive(http) {
+                const rows = await listData(http, '/v1/notification_templates');
+                return rows.map((r) => ({
+                    key: String(r.name ?? ''),
+                    id: String(r.name ?? ''),
+                    config: pick(r, NOTIFICATION_KEYS),
+                }));
+            },
+            async create(http, config) {
+                await http.post('/v1/notification_templates', compact(config));
+            },
+            async update(http, live, config) {
+                const body = compact(config, true);
+                delete body.name; // the name is the URL key
+                await http.put(`/v1/notification_templates/${enc(live.id)}`, body);
+            },
+            async remove(http, live) {
+                await http.delete(`/v1/notification_templates/${enc(live.id)}`);
+            },
+        },
+        // 13. Email templates (§11.1) — key = name; only the CUSTOMISED overrides are config.
+        {
+            kind: 'collection',
+            type: 'email_templates',
+            fileKeys: EMAIL_KEYS,
+            keyOf: (c) => String(obj(c).name ?? ''),
+            async fetchLive(http) {
+                const rows = await listData(http, '/v1/email_templates');
+                return rows
+                    .filter((r) => r.customised && r.override)
+                    .map((r) => ({
+                    key: r.name,
+                    id: r.name,
+                    config: pick({ name: r.name, ...(r.override ?? {}) }, EMAIL_KEYS),
+                }));
+            },
+            async create(http, config) {
+                await putEmail(http, config);
+            },
+            async update(http, _live, config) {
+                await putEmail(http, config);
+            },
+            async remove(http, live) {
+                await http.delete(`/v1/email_templates/${enc(live.id)}`);
+            },
+        },
+        // 14. Organization policies — key = organization_id; attaches to existing orgs.
+        {
+            kind: 'collection',
+            type: 'organization_policies',
+            fileKeys: ORG_POLICY_KEYS,
+            keyOf: (c) => String(obj(c).organization_id ?? ''),
+            async fetchLive(http) {
+                const orgs = await listData(http, '/v1/organizations');
+                const out = [];
+                for (const org of orgs) {
+                    // There is no GET for org policy; an empty PATCH returns it unchanged.
+                    const res = await http.patch(`/v1/organizations/${enc(org.id)}/policy`, {});
+                    const policy = res?.policy ?? {};
+                    const config = pick({ organization_id: org.id, ...policy }, ORG_POLICY_KEYS);
+                    // Only orgs with a real (non-default) policy are config.
+                    if (Object.keys(obj(config)).length > 1) {
+                        out.push({ key: org.id, id: org.id, config });
+                    }
+                }
+                return out;
+            },
+            async create(http, config) {
+                await patchOrgPolicy(http, config);
+            },
+            async update(http, _live, config) {
+                await patchOrgPolicy(http, config);
+            },
+            // No delete: pruning a policy would silently loosen an org's security, so
+            // org policies are never deleted by import (reported as skipped).
+        },
+        // 12. Branding — the hosted-page appearance; a partial merge on write (PATCH).
+        {
+            kind: 'singleton',
+            type: 'branding',
+            async fetchLive(http) {
+                let b;
+                try {
+                    b = await http.get('/v1/branding');
+                }
+                catch (err) {
+                    if ((0, config_http_1.isNotFound)(err))
+                        return null;
+                    throw err;
+                }
+                const { object: _o, resolved: _r, ...fields } = b ?? {};
+                const out = compact(fields);
+                return Object.keys(out).length ? out : null;
+            },
+            async apply(http, config) {
+                await http.patch('/v1/branding', compact(config, true));
+            },
+        },
+        // 13. Cookie-consent banner — last: it only needs the instance. PUT replaces the
+        //     whole setting and needs script_url, so apply merges the file over the live one.
+        {
+            kind: 'singleton',
+            type: 'cookie_consent',
+            fileKeys: COOKIE_CONSENT_KEYS,
+            async fetchLive(http) {
+                let cc;
+                try {
+                    cc = await http.get('/v1/instance/cookie_consent');
+                }
+                catch (err) {
+                    if ((0, config_http_1.isNotFound)(err))
+                        return null;
+                    throw err;
+                }
+                const out = pick(cc ?? {}, COOKIE_CONSENT_KEYS);
+                return Object.keys(out).length ? out : null;
+            },
+            async apply(http, config) {
+                const live = await http.get('/v1/instance/cookie_consent');
+                const body = { ...pick(live ?? {}, COOKIE_CONSENT_KEYS), ...compact(config, true) };
+                if (body.script_url === undefined || body.script_url === null) {
+                    throw new errors_1.CliError('cookie_consent needs a script_url (the consent manager script) when none is set on the instance.');
+                }
+                await http.put('/v1/instance/cookie_consent', body);
+            },
+        },
+        // 14. "Sign in with Atlas" button on the hosted pages. The file says whether it
+        //     is on; `connection_id` (optional) links an SSO connection the instance
+        //     already has instead of the preset one. Only `enabled` is exported or
+        //     compared: the connection id is this instance's own.
+        {
+            kind: 'singleton',
+            type: 'sign_in_with_atlas',
+            fileKeys: ['enabled', 'connection_id'],
+            async fetchLive(http) {
+                let live;
+                try {
+                    live = await http.get('/v1/instance/sign_in_with_atlas');
+                }
+                catch (err) {
+                    if ((0, config_http_1.isNotFound)(err))
+                        return null;
+                    throw err;
+                }
+                return { enabled: live?.enabled === true };
+            },
+            normalize: (c) => ({ enabled: obj(c).enabled === true }),
+            async apply(http, config) {
+                const c = obj(config);
+                if (typeof c.enabled !== 'boolean')
+                    throw new errors_1.CliError('sign_in_with_atlas needs enabled: true or false.');
+                await http.patch('/v1/instance/sign_in_with_atlas', {
+                    enabled: c.enabled,
+                    ...(c.connection_id !== undefined ? { connection_id: c.connection_id } : {}),
+                });
+            },
+        },
+        // 15. Staged signing-key rotation: `prepublish_days` (1..90) publishes each new key
+        //     that many days before it signs; null or 0 turns it off. Only the policy, never keys.
+        {
+            kind: 'singleton',
+            type: 'signing_key_policy',
+            fileKeys: ['prepublish_days'],
+            async fetchLive(http) {
+                let live;
+                try {
+                    live = await http.get('/v1/instance/signing_key_policy');
+                }
+                catch (err) {
+                    if ((0, config_http_1.isNotFound)(err))
+                        return null;
+                    throw err;
+                }
+                return live?.prepublish_days ? { prepublish_days: live.prepublish_days } : null;
+            },
+            normalize: (c) => ({ prepublish_days: obj(c).prepublish_days || null }),
+            async apply(http, config) {
+                const d = obj(config).prepublish_days ?? null;
+                if (d !== null && (typeof d !== 'number' || !Number.isInteger(d) || d < 0 || d > 90)) {
+                    throw new errors_1.CliError('signing_key_policy.prepublish_days must be a whole number of days from 1 to 90, or null / 0 to turn it off.');
+                }
+                await http.patch('/v1/instance/signing_key_policy', { prepublish_days: d || null });
+            },
+        },
+    ];
+    return specs;
+}
+const OAUTH_CLIENT_KEYS = [
+    'name',
+    'redirect_uris',
+    'allowed_scopes',
+    'grant_types',
+    'token_endpoint_auth_method',
+    'logo_url',
+    'first_party',
+    'post_logout_redirect_uris',
+    'claims_redirect_uris',
+    'backchannel_logout_uri',
+    'backchannel_logout_session_required',
+    'frontchannel_logout_uri',
+    'frontchannel_logout_session_required',
+    'skip_logout_confirmation',
+    'refresh_touches_session',
+    'require_verified_email',
+    'require_pkce',
+    'login_url',
+    'consent_url',
+    'subject_type',
+    'sector_identifier_uri',
+    'access_token_format',
+    'token_lifetimes',
+];
+/** What a file may also send on an OAuth client: accepted on write, never exported. */
+const OAUTH_CLIENT_WRITE_KEYS = [
+    'application_type',
+    'client_secret',
+    'secret_expires_in_seconds',
+    'jwks',
+    'jwks_uri',
+    'tls_client_auth_subject_dn',
+    'frontchannel_logout_session_required',
+    'disabled',
+    'metadata',
+    'external_ref',
+    'add_redirect_origins',
+];
+const OAUTH_PROVIDER_KEYS = [
+    'provider',
+    'enabled',
+    'allow_sign_in',
+    'allow_sign_up',
+    'scopes',
+    'client_id',
+    'mode',
+];
+const RESOURCE_SERVER_KEYS = [
+    'identifier',
+    'name',
+    'scopes',
+    'token_ttl_seconds',
+    'signing_alg',
+];
+const ROLE_KEYS = ['key', 'name', 'description', 'permissions'];
+const PERMISSION_KEYS = ['key', 'name', 'description'];
+const CUSTOM_PROVIDER_KEYS = [
+    'provider_key',
+    'display_name',
+    'icon_url',
+    'protocol',
+    'issuer',
+    'discovery_url',
+    'authorization_endpoint',
+    'token_endpoint',
+    'userinfo_endpoint',
+    'jwks_uri',
+    'scopes',
+    'pkce',
+    'authorization_params',
+    'token_params',
+    'token_endpoint_auth_method',
+    'profile_source',
+    'profile_mapping',
+    'client_id',
+    'enabled',
+    'allow_sign_in',
+    'allow_sign_up',
+];
+const CUSTOM_PROVIDER_WRITE_KEYS = [
+    'client_secret',
+    'end_session_endpoint',
+    'revocation_endpoint',
+    'host_params_schema',
+    'data_only',
+    'scope_separator',
+    'userinfo_auth',
+    'client_assertion_audience',
+    'logout',
+    'idp_initiated_login',
+];
+const WEBHOOK_KEYS = ['url', 'enabled_events', 'active'];
+const SSO_KEYS = [
+    'type',
+    'status',
+    'organization_id',
+    'oidc_issuer',
+    'oidc_client_id',
+    'saml_idp_entity_id',
+    'saml_idp_sso_url',
+    'saml_sp_entity_id',
+    'saml_allow_idp_initiated',
+    'saml_sign_authn_requests',
+    'saml_want_response_signed',
+    'discourse_provider_url',
+    'allowed_domains',
+    'claim_role_mappings',
+    'default_role_id',
+];
+const SSO_WRITE_KEYS = [
+    'oidc_client_secret',
+    'saml_idp_certificate',
+    'saml_single_logout',
+    'saml_idp_slo_url',
+    'saml_idp_slo_response_url',
+    'saml_idp_slo_binding',
+    'saml_idp_slo_soap_url',
+    'saml_require_encrypted_assertions',
+    'saml_acs_path',
+    'require_consent_screen',
+    'discourse_secret',
+    'provisioning_mode',
+    'manual_endpoints',
+    'github_access',
+    'attribute_mapping',
+    'oidc_scopes',
+    'profile_mapping',
+    'token_endpoint_auth_method',
+    'client_assertion_audience',
+    'logout',
+    'idp_initiated_login',
+];
+const SSO_PROFILE_KEYS = ['name', 'allowed_connection_types', 'organization_id', 'company_name', 'allow_scim', 'intents', 'return_url'];
+const COOKIE_CONSENT_KEYS = ['enabled', 'script_url', 'script_id', 'site_id', 'blocking_mode', 'extra_origins', 'settings_link', 'culture', 'host_aliases'];
+const BILLING_KEYS = [
+    'name',
+    'slug',
+    'stripe_price_id',
+    'interval',
+    'amount',
+    'currency',
+    'features',
+    'limits',
+    'audience',
+    'active',
+    'pricing_model',
+    'trial_days',
+    'stripe_meter_id',
+    'usage_unit',
+    'provider',
+    'annual_price_id',
+    'kind',
+];
+const NOTIFICATION_KEYS = ['name', 'subject', 'body', 'category'];
+const EMAIL_KEYS = ['name', 'subject', 'text'];
+const ORG_POLICY_KEYS = [
+    'organization_id',
+    'requireMfa',
+    'ssoRequired',
+    'sessionIdleOverrideMs',
+    'allowedSignInMethods',
+    'ipAllowlist',
+    'maxSessionAgeSeconds',
+];
+/** Narrow a Config to a plain string-keyed record for field access. */
+function obj(config) {
+    return config && typeof config === 'object' && !Array.isArray(config)
+        ? config
+        : {};
+}
+/** What a write-only secret looks like on the live side, and in a plan. */
+const SECRET_SET = '(secret set)';
+const isObj = (x) => x !== null && typeof x === 'object' && !Array.isArray(x);
+/**
+ * Bring a file's secrets and the live document to one comparable shape. A secret
+ * value becomes "(secret set)", so a plan never holds it and it compares equal to
+ * the live marker. `unverifiable` lists the secrets set on both sides, or that the
+ * API never reports (`reported` false): Atlas cannot say whether they differ, so
+ * they are not drift, and the plan says so. A secret the API reports as unset stays
+ * a difference. An unresolved ${VAR} stays visible (apply refuses it), as does an
+ * empty value.
+ */
+function reconcileSecrets(desired, live, reported, prefix = '') {
+    if (!isObj(desired))
+        return { desired, live, unverifiable: [] };
+    const d = { ...desired };
+    const l = isObj(live) ? { ...live } : {};
+    const unverifiable = [];
+    for (const [k, v] of Object.entries(desired)) {
+        const path = prefix ? `${prefix}.${k}` : k;
+        if (isObj(v)) {
+            const inner = reconcileSecrets(v, l[k], reported, path);
+            d[k] = inner.desired;
+            if (isObj(l[k]))
+                l[k] = inner.live;
+            unverifiable.push(...inner.unverifiable);
+        }
+        else if ((0, redact_1.isSecretKey)(k) && typeof v === 'string' && v !== '' && v !== SECRET_SET && !(0, redact_1.isPlaceholder)(v)) {
+            if (l[k] === SECRET_SET) {
+                d[k] = SECRET_SET;
+                unverifiable.push(path);
+            }
+            else if (l[k] === undefined || l[k] === null) {
+                d[k] = SECRET_SET;
+                if (!reported) {
+                    l[k] = SECRET_SET;
+                    unverifiable.push(path);
+                }
+            }
+        }
+    }
+    return { desired: d, live: isObj(live) || unverifiable.length ? l : live, unverifiable };
+}
+/** The live document without the secret markers and server defaults the file says nothing about. */
+function withoutUnstated(live, desired, defaulted = []) {
+    if (!isObj(live))
+        return live;
+    const want = isObj(desired) ? desired : {};
+    const out = {};
+    for (const [k, v] of Object.entries(live)) {
+        if (!(k in want) && (v === SECRET_SET || defaulted.includes(k)))
+            continue;
+        out[k] = isObj(v) && isObj(want[k]) ? withoutUnstated(v, want[k]) : v;
+    }
+    return out;
+}
+/** How close two key names are (edit distance). */
+function distance(a, b) {
+    let prev = Array.from({ length: b.length + 1 }, (_, i) => i);
+    for (let i = 1; i <= a.length; i++) {
+        const row = [i];
+        for (let j = 1; j <= b.length; j++)
+            row[j] = Math.min(prev[j] + 1, row[j - 1] + 1, prev[j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1));
+        prev = row;
+    }
+    return prev[b.length];
+}
+function didYouMean(key, known) {
+    const norm = (x) => x.replace(/([a-z0-9])([A-Z])/g, '$1_$2').toLowerCase();
+    const best = [...known].sort((a, b) => distance(norm(key), a) - distance(norm(key), b))[0];
+    return best && distance(norm(key), best) <= Math.max(2, Math.floor(key.length / 3)) ? ` (did you mean ${best}?)` : '';
+}
+/** The keys in one parsed resource file that no spec knows, each named with its nearest real key. */
+function unknownFileKeys(spec, doc) {
+    const out = [];
+    const check = (value, known, label) => {
+        if (!isObj(value))
+            return;
+        for (const k of Object.keys(value))
+            if (!known.includes(k))
+                out.push(`${label}: ${k}${didYouMean(k, known)}`);
+    };
+    if (spec.kind === 'collection') {
+        for (const entry of asArray(doc))
+            check(entry, spec.fileKeys, `${spec.type} ${spec.keyOf(entry) || '(no key)'}`);
+    }
+    else if (spec.fileKeys) {
+        check(doc, spec.fileKeys, spec.type);
+        for (const [k, known] of Object.entries(spec.nestedKeys ?? {}))
+            if (isObj(doc))
+                check(doc[k], known, `${spec.type}.${k}`);
+    }
+    return out;
+}
+/** A document without any "(secret set)" marker: what an export writes and what apply sends. */
+function withoutMarkers(value) {
+    if (Array.isArray(value))
+        return value.map(withoutMarkers);
+    if (value && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== SECRET_SET).map(([k, v]) => [k, withoutMarkers(v)]));
+    }
+    return value;
+}
+/** An origin list in either form (strings, or { origin, integration }) as plain strings. */
+function originStrings(list) {
+    return (Array.isArray(list) ? list : []).map((e) => (typeof e === 'string' ? e : String(obj(e).origin ?? '')));
+}
+/** auth_config without the integration hints, which belong to allowed_origins. */
+function stripOriginIntegrations(authConfig) {
+    const { originIntegrations: _hints, ...rest } = obj(authConfig);
+    return rest;
+}
+/** A stable natural key for an SSO connection, which has no name field. */
+function ssoKey(config) {
+    const c = obj(config);
+    const type = String(c.type ?? 'sso');
+    const id = c.oidc_issuer ?? c.saml_idp_entity_id ?? c.saml_sp_entity_id ?? c.discourse_provider_url ?? '';
+    return `${type}:${String(id)}`;
+}
+/** Configure an OAuth provider: credentials/scopes (PUT), then scope + enabled toggles. */
+async function putProvider(http, config) {
+    const c = obj(config);
+    // Provider settings (a tenant, a domain, Apple's team/key ids) ride along in `values`.
+    const values = { ...obj(c.values ?? null) };
+    if (c.client_id !== undefined && c.client_id !== null)
+        values.client_id = c.client_id;
+    // A secret only exists here when the file carried a ${ENV} placeholder for it.
+    if (c.client_secret !== undefined && c.client_secret !== null) {
+        values.client_secret = c.client_secret;
+    }
+    const body = {};
+    if (Object.keys(values).length)
+        body.values = values;
+    if (Array.isArray(c.scopes))
+        body.scopes = c.scopes;
+    // Credential-less providers (siwe, siws, siwb, siwf) take verifier settings instead.
+    if (c.settings && typeof c.settings === 'object' && !Array.isArray(c.settings))
+        body.settings = c.settings;
+    if (c.mode === 'native' || c.mode === 'redirect')
+        body.mode = c.mode;
+    const provider = String(c.provider ?? '');
+    if (Object.keys(body).length) {
+        await http.put(`/v1/oauth_providers/${enc(provider)}`, body);
+    }
+    if (c.allow_sign_in !== undefined || c.allow_sign_up !== undefined) {
+        await http.post(`/v1/oauth_providers/${enc(provider)}/scope`, {
+            allow_sign_in: c.allow_sign_in ?? true,
+            allow_sign_up: c.allow_sign_up ?? true,
+        });
+    }
+    if (c.enabled !== undefined) {
+        await http.post(`/v1/oauth_providers/${enc(provider)}/enabled`, { enabled: c.enabled });
+    }
+}
+async function putEmail(http, config) {
+    const c = obj(config);
+    const body = {};
+    if (c.subject !== undefined)
+        body.subject = c.subject;
+    if (c.text !== undefined)
+        body.text = c.text;
+    await http.put(`/v1/email_templates/${enc(String(c.name ?? ''))}`, body);
+}
+async function patchOrgPolicy(http, config) {
+    const c = obj(config);
+    const body = {};
+    for (const k of ORG_POLICY_KEYS) {
+        if (k === 'organization_id')
+            continue;
+        if (c[k] !== undefined && c[k] !== null)
+            body[k] = c[k];
+    }
+    await http.patch(`/v1/organizations/${enc(String(c.organization_id ?? ''))}/policy`, body);
+}
+// ───────────────────────────── the command ─────────────────────────────
+/** `atlas config export|import` — Auth0 `deploy-cli`-style config-as-code. */
+async function config(ctx, args) {
+    const sub = args.positionals[1];
+    switch (sub) {
+        case 'export':
+            return exportConfig(ctx, args.values);
+        case 'import':
+            return importConfig(ctx, args.values);
+        case 'plan':
+            return planConfig(ctx, args.values, { dir: resolveDir(args.values), format: resolveFormat(args.values), env: readSecretsEnv(ctx, args.values) });
+        case 'promote':
+            return promoteConfig(ctx, args.values);
+        default:
+            throw new errors_1.CliError(sub
+                ? `Unknown subcommand 'config ${sub}'. Try: export, import, plan, promote.`
+                : 'config needs a subcommand: export, import, plan, promote.');
+    }
+}
+function resolveFormat(values) {
+    const raw = (0, args_1.str)(values, 'format');
+    if (raw === undefined)
+        return 'json';
+    if (raw !== 'json' && raw !== 'yaml') {
+        throw new errors_1.CliError(`--format must be 'json' or 'yaml', got '${raw}'.`);
+    }
+    return raw;
+}
+function resolveDir(values) {
+    return (0, args_1.str)(values, 'dir') || './atlas-config';
+}
+/** Build the config HTTP client from the resolved profile credential. */
+function requireHttp(ctx, values, onUnknownFields) {
+    const auth = (0, shared_1.resolveAuth)(ctx, values);
+    const make = ctx.makeHttp ?? config_http_1.createConfigHttp;
+    return make({ secretKey: auth.secretKey, apiUrl: auth.apiUrl, ...(onUnknownFields ? { onUnknownFields } : {}) });
+}
+/** Write every resource type's live config to `dir` (deterministic, secrets omitted); returns the file count. */
+async function writeExport(http, dir, format) {
+    const ext = format === 'json' ? 'json' : 'yaml';
+    (0, node_fs_1.mkdirSync)(dir, { recursive: true });
+    let fileCount = 0;
+    for (const spec of registry()) {
+        if (spec.kind === 'singleton') {
+            const live = await spec.fetchLive(http);
+            if (live === null)
+                continue; // nothing to write (e.g. no schema registered)
+            (0, node_fs_1.writeFileSync)((0, node_path_1.join)(dir, `${spec.type}.${ext}`), (0, serialize_1.serialize)(withoutMarkers(live), format));
+            fileCount += 1;
+        }
+        else {
+            const entries = (await spec.fetchLive(http)).filter((e) => !e.managedBy);
+            // Deterministic: entries sorted by natural key, keys sorted inside each.
+            const sorted = [...entries].sort((a, b) => (a.key < b.key ? -1 : a.key > b.key ? 1 : 0));
+            const doc = sorted.map((e) => (0, serialize_1.canonicalize)(withoutMarkers(e.config)));
+            (0, node_fs_1.writeFileSync)((0, node_path_1.join)(dir, `${spec.type}.${ext}`), (0, serialize_1.serialize)(doc, format));
+            fileCount += 1;
+        }
+    }
+    return fileCount;
+}
+async function exportConfig(ctx, values) {
+    const http = requireHttp(ctx, values);
+    const dir = resolveDir(values);
+    const format = resolveFormat(values);
+    const fileCount = await writeExport(http, dir, format);
+    ctx.io.out(`Exported ${fileCount} resource file(s) to ${dir} (${format}).`);
+    ctx.io.out('Secrets are never exported — supply any credential at import via a ${ENV} placeholder.');
+    return 0;
+}
+/**
+ * Diff a config directory against the live instance. Nothing is written: the
+ * returned changes carry their own `apply`. Used by `atlas config import` and by
+ * `atlas migrate better-auth` (which shows the plan before applying it).
+ */
+async function planConfigImport(http, opts) {
+    const { dir, format, env, prune } = opts;
+    const applyOpts = { forceHook: opts.forceHook === true };
+    const ext = format === 'json' ? 'json' : 'yaml';
+    if (!(0, node_fs_1.existsSync)(dir)) {
+        throw new errors_1.CliError(`Config directory not found: ${dir}. Run 'atlas config export' first.`);
+    }
+    const present = new Set((0, node_fs_1.readdirSync)(dir));
+    const unknown = registry().flatMap((spec) => present.has(`${spec.type}.${ext}`) ? unknownFileKeys(spec, (0, serialize_1.deserialize)((0, node_fs_1.readFileSync)((0, node_path_1.join)(dir, `${spec.type}.${ext}`), 'utf8'), format)) : []);
+    if (unknown.length)
+        throw new errors_1.CliError(`Unknown key(s) in the config:\n  ${unknown.join('\n  ')}`);
+    const rotate = opts.rotateSecrets === true;
+    const warnings = [];
+    const unverifiableSecrets = [];
+    const changes = [];
+    let unchanged = 0;
+    const skippedDeletes = [];
+    const managed = [];
+    for (const spec of registry()) {
+        const file = `${spec.type}.${ext}`;
+        // A type with no file is simply NOT MANAGED — leave live untouched.
+        if (!present.has(file))
+            continue;
+        const text = (0, node_fs_1.readFileSync)((0, node_path_1.join)(dir, file), 'utf8');
+        const parsed = interpolate((0, serialize_1.deserialize)(text, format), env);
+        if (spec.kind === 'singleton') {
+            const desired = parsed;
+            const liveRaw = await spec.fetchLive(http);
+            const norm = spec.normalize ?? ((c) => c);
+            const desiredN = norm(desired);
+            // A section that only clears fields (all null) against nothing live is already satisfied.
+            if (liveRaw === null && onlyNulls(desiredN)) {
+                unchanged += 1;
+                continue;
+            }
+            if (liveRaw === null) {
+                const masked = reconcileSecrets(desiredN, undefined, true).desired;
+                changes.push({ type: spec.type, action: 'create', key: '', after: masked, raw: desiredN, apply: () => spec.apply(http, desired, applyOpts) });
+                continue;
+            }
+            const seen = withoutUnstated(comparable(norm(liveRaw), desiredN, prune), desiredN);
+            const r = reconcileSecrets(desiredN, seen, spec.reportsSecrets === true);
+            const forced = rotate ? r.unverifiable : [];
+            if (!rotate)
+                unverifiableSecrets.push(...r.unverifiable.map((path) => ({ type: spec.type, key: '', path })));
+            if (forced.length === 0 && (0, serialize_1.deepEqual)(r.desired, r.live)) {
+                unchanged += 1;
+                continue;
+            }
+            changes.push({ type: spec.type, action: 'update', key: '', before: r.live, after: r.desired, raw: desiredN, changedSecrets: forced, apply: () => spec.apply(http, desired, applyOpts) });
+            continue;
+        }
+        // Collection: diff desired-by-key against live-by-key.
+        const desiredList = asArray(parsed);
+        const desiredByKey = new Map();
+        for (const cfg of desiredList)
+            desiredByKey.set(spec.keyOf(cfg), cfg);
+        const all = await spec.fetchLive(http);
+        for (const e of all)
+            if (e.managedBy)
+                managed.push({ type: spec.type, key: e.key, managedBy: e.managedBy });
+        const live = all.filter((e) => !e.managedBy);
+        const liveByKey = new Map(live.map((e) => [e.key, e]));
+        for (const [key, cfg] of desiredByKey) {
+            const existing = liveByKey.get(key);
+            warnings.push(...(spec.warnings?.(cfg, existing?.config) ?? []));
+            if (!existing) {
+                changes.push({ type: spec.type, action: 'create', key, after: reconcileSecrets(cfg, undefined, true).desired, raw: cfg, apply: () => spec.create(http, cfg) });
+                continue;
+            }
+            const seen = withoutUnstated(comparable(existing.config, cfg, prune), cfg, spec.defaulted);
+            const r = reconcileSecrets(cfg, seen, spec.reportsSecrets === true);
+            const unverifiable = [...r.unverifiable];
+            const liveSeen = obj(r.live);
+            for (const k of spec.writeOnly ?? []) {
+                if (obj(r.desired)[k] === undefined)
+                    continue;
+                liveSeen[k] = obj(r.desired)[k];
+                unverifiable.push(k);
+            }
+            let forced = rotate ? unverifiable : [];
+            let unknownToApi = rotate ? [] : unverifiable;
+            if (spec.secretChanged && unverifiable.length) {
+                const changed = await spec.secretChanged(http, existing, cfg);
+                if (changed !== null) {
+                    forced = changed ? unverifiable : [];
+                    unknownToApi = [];
+                }
+            }
+            unverifiableSecrets.push(...unknownToApi.map((path) => ({ type: spec.type, key, path })));
+            if (forced.length === 0 && (0, serialize_1.deepEqual)(r.desired, liveSeen)) {
+                unchanged += 1;
+                continue;
+            }
+            if (!spec.update) {
+                throw new errors_1.CliError(`${spec.type} '${key}' changed but is immutable; recreate it instead.`);
+            }
+            const upd = spec.update;
+            changes.push({ type: spec.type, action: 'update', key, before: liveSeen, after: r.desired, raw: cfg, changedSecrets: forced, apply: () => upd(http, existing, cfg) });
+        }
+        for (const entry of live) {
+            if (desiredByKey.has(entry.key))
+                continue;
+            const change = { type: spec.type, action: 'delete', key: entry.key, before: entry.config };
+            if (!spec.remove) {
+                skippedDeletes.push(change);
+                continue;
+            }
+            if (prune) {
+                const rm = spec.remove;
+                changes.push({ ...change, apply: () => rm(http, entry) });
+            }
+            else {
+                skippedDeletes.push(change);
+            }
+        }
+    }
+    return { changes, unchanged, skippedDeletes, managed, warnings, unverifiableSecrets };
+}
+/** True for a non-empty object whose every leaf is `null` (a file that only clears fields). */
+function onlyNulls(x) {
+    if (x === null)
+        return true;
+    if (typeof x !== 'object' || Array.isArray(x) || x === undefined)
+        return false;
+    const vals = Object.values(x);
+    return vals.length > 0 && vals.every(onlyNulls);
+}
+/**
+ * The live document as the plan compares it. With `--prune` the whole live
+ * document (keys the file leaves unset show as drift). Without it only the keys
+ * the file sets, recursively, so a freshly applied file plans clean. A desired
+ * `null` means "unset", so it matches a live key that is absent.
+ */
+function comparable(live, desired, prune) {
+    if (prune)
+        return live;
+    if (!isObj(live) || !isObj(desired))
+        return live;
+    const out = {};
+    for (const k of Object.keys(desired)) {
+        const l = live[k];
+        if (l === undefined || l === null) {
+            if (desired[k] === null)
+                out[k] = null;
+            continue;
+        }
+        out[k] = comparable(l, desired[k], false);
+    }
+    return out;
+}
+/** The stored credential of a named profile (one profile per environment). */
+function profileHttp(ctx, name) {
+    const stored = ctx.config.load().profiles[name];
+    if (!stored?.secret_key) {
+        throw new errors_1.CliError(`No profile named '${name}'. Run 'atlas login --profile ${name}' with that environment's secret key.`);
+    }
+    const secretKey = stored.secret_key;
+    const apiUrl = (0, shared_1.envApiUrl)(ctx.env) || stored.api_url || backend_1.DEFAULT_API_URL;
+    const make = ctx.makeHttp ?? config_http_1.createConfigHttp;
+    return { http: make({ secretKey, apiUrl }), secretKey };
+}
+/** True for a production (live) secret key: `atlas_live_sk_…` or `sk_live_…`. */
+const isLiveKey = (key) => /(?:^|_)live_/.test(key);
+/**
+ * `atlas config promote --from <profile> --to <profile>`: copy one environment's
+ * configuration to another (development → staging → production) through the same
+ * plan/apply engine as `config import`. Each environment is a profile holding that
+ * instance's secret key. Secrets never travel: `${ENV}` placeholders stay as they
+ * are and credentials are set per environment. `--dry-run` prints the plan only;
+ * applying to a live (production) key needs `--yes`.
+ */
+async function promoteConfig(ctx, values) {
+    const from = (0, args_1.str)(values, 'from');
+    const to = (0, args_1.str)(values, 'to');
+    if (!from || !to)
+        throw new errors_1.CliError('promote needs --from <profile> and --to <profile> (one profile per environment).');
+    if (from === to)
+        throw new errors_1.CliError('--from and --to name the same profile.');
+    const format = resolveFormat(values);
+    const dryRun = values['dry-run'] === true;
+    const prune = values.prune === true;
+    const source = profileHttp(ctx, from);
+    const target = profileHttp(ctx, to);
+    if (source.secretKey === target.secretKey) {
+        throw new errors_1.CliError(`Profiles '${from}' and '${to}' hold the same secret key — they are the same environment.`);
+    }
+    if (!dryRun && isLiveKey(target.secretKey) && values.yes !== true) {
+        throw new errors_1.CliError(`'${to}' is a live (production) environment. Review with --dry-run, then re-run with --yes to apply.`);
+    }
+    const dir = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'atlas-promote-'));
+    try {
+        await writeExport(source.http, dir, format);
+        const plan = await planConfigImport(target.http, { dir, format, env: ctx.env, prune });
+        ctx.io.out(`Promoting ${from} -> ${to}`);
+        printPlan(ctx, plan.changes, plan.unchanged, plan.skippedDeletes, { dryRun, prune });
+        printPlanNotes(ctx, plan);
+        if (dryRun)
+            return 0;
+        for (const change of plan.changes)
+            await change.apply();
+        ctx.io.out(plan.changes.length ? `Applied ${plan.changes.length} change(s) to ${to}.` : 'No changes to apply.');
+        return 0;
+    }
+    finally {
+        (0, node_fs_1.rmSync)(dir, { recursive: true, force: true });
+    }
+}
+async function importConfig(ctx, values) {
+    const http = requireHttp(ctx, values);
+    const dir = resolveDir(values);
+    const format = resolveFormat(values);
+    const dryRun = values['dry-run'] === true;
+    const prune = values.prune === true;
+    const plan = await planConfigImport(http, { dir, format, env: readSecretsEnv(ctx, values), prune, forceHook: values['force-hook'] === true, rotateSecrets: values['rotate-secret'] === true });
+    printPlan(ctx, plan.changes, plan.unchanged, plan.skippedDeletes, { dryRun, prune });
+    printPlanNotes(ctx, plan);
+    if (dryRun)
+        return 0;
+    for (const change of plan.changes)
+        await change.apply();
+    if (plan.changes.length)
+        ctx.io.out(`Applied ${plan.changes.length} change(s).`);
+    else
+        ctx.io.out('No changes to apply.');
+    return 0;
+}
+/** Leaf-level differences between two documents, as dotted paths (arrays compare whole). */
+function diffFields(before, after, path = '') {
+    if (isObj(before) && isObj(after)) {
+        const keys = [...new Set([...Object.keys(before), ...Object.keys(after)])].sort();
+        return keys.flatMap((k) => diffFields(before[k], after[k], path ? `${path}.${k}` : k));
+    }
+    if (before !== undefined && after !== undefined && (0, serialize_1.deepEqual)(before, after))
+        return [];
+    if (before === undefined && after === undefined)
+        return [];
+    return [{ path: path || '(document)', ...(before === undefined ? {} : { before }), ...(after === undefined ? {} : { after }) }];
+}
+const show = (v) => (v === undefined ? '(unset)' : typeof v === 'string' ? JSON.stringify(v) : JSON.stringify(v));
+/**
+ * The only form a change's fields are printed or serialised in. A secret-named
+ * string is `<redacted>` with a changed flag, whatever the resource; everything else
+ * goes through the deep redactor.
+ */
+function printedFields(c) {
+    const reveal = (0, redact_1.revealingSecrets)();
+    const diffs = diffFields(c.before, reveal ? (c.raw ?? c.after) : c.after);
+    const rows = diffs.map((f) => {
+        const leaf = f.path.split('.').pop();
+        const textual = [f.before, f.after].every((v) => v === undefined || v === null || typeof v === 'string');
+        if (!reveal && (0, redact_1.isSecretKey)(leaf) && textual && !(0, redact_1.isPlaceholder)(f.after))
+            return { path: f.path, redacted: true, changed: true };
+        return { path: f.path, ...(f.before === undefined ? {} : { before: (0, redact_1.redactDeep)(f.before, leaf) }), ...(f.after === undefined ? {} : { after: (0, redact_1.redactDeep)(f.after, leaf) }) };
+    });
+    for (const path of c.changedSecrets ?? [])
+        if (!rows.some((r) => r.path === path))
+            rows.push({ path, redacted: true, changed: true });
+    return rows;
+}
+const printedLine = (f) => (f.redacted ? `${f.path}: ${redact_1.REDACTED} (changed)` : `${f.path}: ${show(f.before)} -> ${show(f.after)}`);
+/** The plan's advice: warnings, and the secrets Atlas cannot compare. */
+function printPlanNotes(ctx, plan) {
+    for (const w of plan.warnings)
+        ctx.io.out(`warning: ${w}`);
+    for (const u of plan.unverifiableSecrets) {
+        ctx.io.out(`note: ${u.type}${u.key ? ` ${u.key}` : ''} ${u.path}: Atlas does not return this value, so a change to it cannot be detected. Send it again with --rotate-secret.`);
+    }
+}
+/**
+ * `atlas config plan`: a Terraform-style, read-only diff of a config directory
+ * (`atlas config export` output, committed to git) against the live instance.
+ * Field-level for updates, `--json` for tooling, and `--exit-code` to exit 2
+ * when there is drift so CI can gate on it. Never writes anything.
+ */
+async function planConfig(ctx, values, source) {
+    const http = requireHttp(ctx, values);
+    const { dir, format, env } = source;
+    const where = source.label ?? dir;
+    const prune = values.prune === true;
+    const plan = await planConfigImport(http, { dir, format, env, prune, rotateSecrets: values['rotate-secret'] === true });
+    const deletes = prune ? [] : plan.skippedDeletes;
+    const all = plan.changes;
+    const rows = all.map((c) => ({
+        type: c.type,
+        key: c.key || null,
+        action: c.action,
+        fields: c.action === 'update' ? printedFields(c) : [],
+    }));
+    const pending = rows.length;
+    if (values.json === true) {
+        ctx.io.out(JSON.stringify({
+            object: 'config_plan',
+            changes: rows,
+            unchanged: plan.unchanged,
+            unmanaged_live: deletes.map((d) => ({ type: d.type, key: d.key || null })),
+            managed_by_platform: plan.managed.map((m) => ({ type: m.type, key: m.key, managed_by: m.managedBy })),
+            warnings: plan.warnings,
+            unverifiable_secrets: plan.unverifiableSecrets.map((u) => ({ type: u.type, key: u.key || null, path: u.path })),
+            has_changes: pending > 0,
+        }, null, 2));
+    }
+    else {
+        ctx.io.out(`Plan: ${pending} to change, ${plan.unchanged} unchanged${deletes.length ? `, ${deletes.length} live but not in config` : ''}.`);
+        const sign = { create: '+', update: '~', delete: '-' };
+        for (const c of [...all].sort(sortChange)) {
+            const label = c.key ? `${c.type} ${c.key}` : c.type;
+            ctx.io.out('');
+            ctx.io.out(`${sign[c.action]} ${label} (${c.action})`);
+            if (c.action === 'update') {
+                for (const f of printedFields(c))
+                    ctx.io.out(`    ${printedLine(f)}`);
+            }
+        }
+        if (deletes.length) {
+            ctx.io.out('');
+            ctx.io.out(`Live but not in ${where} (kept; pass --prune to plan their deletion):`);
+            for (const d of deletes)
+                ctx.io.out(`    ${d.type}${d.key ? ` ${d.key}` : ''}`);
+        }
+        if (plan.managed.length) {
+            ctx.io.out('');
+            ctx.io.out('Managed by a connected platform (not part of this file; never pruned):');
+            for (const m of plan.managed)
+                ctx.io.out(`    ${m.type} ${m.key} (${m.managedBy})`);
+        }
+        if (plan.warnings.length || plan.unverifiableSecrets.length)
+            ctx.io.out('');
+        printPlanNotes(ctx, plan);
+        if (pending === 0)
+            ctx.io.out(`No drift: the instance matches ${where}.`);
+    }
+    return wantsCheck(values) && pending > 0 ? 2 : 0;
+}
+/** `--check` (CI) and `--exit-code` (Terraform's name) both mean: exit 2 when there is drift. */
+const wantsCheck = (values) => values['exit-code'] === true || values.check === true;
+/**
+ * The environment `${VAR}` placeholders resolve against: the process env, then
+ * `--secrets-file` (a dotenv file) on top. The file holds credentials, so it
+ * must be readable by its owner only (mode 0600 or stricter); anything looser
+ * is refused rather than read. POSIX only: Windows has no such mode bits.
+ */
+function readSecretsEnv(ctx, values) {
+    const file = (0, args_1.str)(values, 'secrets-file');
+    if (!file)
+        return ctx.env;
+    let mode;
+    try {
+        mode = (0, node_fs_1.statSync)(file).mode;
+    }
+    catch {
+        throw new errors_1.CliError(`--secrets-file not found: ${file}.`);
+    }
+    if (process.platform !== 'win32' && (mode & 0o077) !== 0) {
+        throw new errors_1.CliError(`--secrets-file ${file} is readable by others (mode ${(mode & 0o777).toString(8)}). Run 'chmod 600 ${file}' and try again.`);
+    }
+    return { ...ctx.env, ...(0, secrets_1.parseDotenv)(ctx.readFile(file)) };
+}
+/** `${VAR}` placeholders still in a planned change (no env value and no --secrets-file entry). */
+function unresolvedPlaceholders(changes) {
+    const names = new Set();
+    for (const c of changes) {
+        for (const m of JSON.stringify(c.after ?? null).matchAll(/\$\{([A-Z0-9_]+)\}/g))
+            names.add(m[1]);
+    }
+    return [...names].sort();
+}
+/** The resource types a single config file may hold, in the order they are applied. */
+function configTypes() {
+    return registry().map((s) => s.type);
+}
+/**
+ * Resolve `atlas plan|apply [<path>]`: a directory of per-type files (as
+ * `atlas config export` writes), or ONE file whose top-level keys are resource
+ * types (`instance`, `webhook_endpoints`, …), split into a temp directory.
+ * `cleanup` removes that temp directory.
+ */
+/** Config files `atlas plan` / `atlas apply` pick up from the current directory when given no path. */
+exports.DEFAULT_CONFIG_FILES = ['atlas.config.ts', 'atlas.config.mts', 'atlas.config.mjs', 'atlas.config.js', 'atlas.yaml', 'atlas.yml', 'atlas.json'];
+const CODE_EXTS = new Set(['.ts', '.mts', '.cts', '.js', '.mjs', '.cjs']);
+// The CLI compiles to CommonJS, where tsc turns import() into require(), which cannot load ESM or .ts,
+// so the real import() is reached through Function. A vm context with no import hook (a test runner)
+// cannot run that one, and gets the plain import() the runner itself transforms.
+const nativeImport = async (url) => {
+    try {
+        return await new Function('url', 'return import(url)')(url);
+    }
+    catch (err) {
+        if (err.code !== 'ERR_VM_DYNAMIC_IMPORT_CALLBACK_MISSING')
+            throw err;
+        return Promise.resolve(`${url}`).then(s => __importStar(require(s)));
+    }
+};
+/**
+ * Load an `atlas.config.ts` (or .js/.mjs): its default export is the config
+ * object, or a function (sync or async) returning it. A .ts file runs on
+ * Node's own type stripping (Node 22.18+ / 23.6+), so it adds no dependency.
+ */
+async function loadCodeConfig(path) {
+    let mod;
+    try {
+        mod = (await nativeImport((0, node_url_1.pathToFileURL)((0, node_path_1.resolve)(path)).href));
+    }
+    catch (err) {
+        const msg = err.message;
+        if (/\.ts|Unknown file extension|ERR_UNKNOWN_FILE_EXTENSION/.test(msg) && /\.[cm]?ts$/.test(path)) {
+            throw new errors_1.CliError(`${path}: this Node (${process.version}) cannot load TypeScript directly. Use Node 22.18+ (or 23.6+), or rename it to atlas.config.mjs.`);
+        }
+        throw new errors_1.CliError(`${path}: ${msg}`);
+    }
+    const exported = mod.default;
+    if (exported === undefined)
+        throw new errors_1.CliError(`${path} has no default export. Write: export default defineConfig({ ... }).`);
+    return typeof exported === 'function' ? await exported() : exported;
+}
+async function resolveSource(ctx, args) {
+    const path = args.positionals[1] ??
+        ((0, args_1.str)(args.values, 'dir') ? resolveDir(args.values) : (exports.DEFAULT_CONFIG_FILES.find((f) => (0, node_fs_1.existsSync)(f)) ?? resolveDir(args.values)));
+    const env = readSecretsEnv(ctx, args.values);
+    let isFile = false;
+    try {
+        isFile = (0, node_fs_1.statSync)(path).isFile();
+    }
+    catch {
+        throw new errors_1.CliError(`Config not found: ${path}. Pass a config file (atlas.config.ts / atlas.yaml / atlas.json) or a directory from 'atlas config export'.`);
+    }
+    if (!isFile)
+        return { dir: path, label: path, format: resolveFormat(args.values), env, cleanup: () => undefined };
+    const ext = (0, node_path_1.extname)(path).toLowerCase();
+    const format = ext === '.yaml' || ext === '.yml' ? 'yaml' : ext === '.json' ? 'json' : resolveFormat(args.values);
+    // A round-trip through JSON keeps only plain data (no functions, Dates become strings), like a .json file.
+    const doc = CODE_EXTS.has(ext) ? JSON.parse(JSON.stringify((await loadCodeConfig(path)) ?? null)) : (0, serialize_1.deserialize)(ctx.readFile(path), format);
+    if (doc === null || typeof doc !== 'object' || Array.isArray(doc)) {
+        throw new errors_1.CliError(`${path} must be an object keyed by resource type (${configTypes().join(', ')}).`);
+    }
+    const known = new Set(configTypes());
+    const unknown = Object.keys(doc).filter((k) => !known.has(k));
+    if (unknown.length) {
+        throw new errors_1.CliError(`${path}: unknown resource type(s) ${unknown.join(', ')}. Known: ${configTypes().join(', ')}.`);
+    }
+    const dir = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'atlas-apply-'));
+    for (const [type, value] of Object.entries(doc))
+        (0, node_fs_1.writeFileSync)((0, node_path_1.join)(dir, `${type}.json`), (0, serialize_1.serialize)(value, 'json'));
+    return { dir, label: path, format: 'json', env, cleanup: () => (0, node_fs_1.rmSync)(dir, { recursive: true, force: true }) };
+}
+/**
+ * `atlas plan [<file|dir>]`: the read-only diff of `atlas config plan`, taking
+ * a single config file as well. `--check` exits 2 on drift for CI.
+ */
+async function planCommand(ctx, args) {
+    const source = await resolveSource(ctx, args);
+    try {
+        return await planConfig(ctx, args.values, source);
+    }
+    finally {
+        source.cleanup();
+    }
+}
+/**
+ * `atlas apply [<file|dir>]`: plan, show it, confirm, then apply in the fixed
+ * resource order (see {@link configTypes}). `--yes` skips the question (needed
+ * when there is no terminal); `--check` only plans and exits 2 on drift.
+ * Refuses to apply while any `${VAR}` placeholder is unresolved, so a missing
+ * secret is never sent as the literal text.
+ */
+async function applyCommand(ctx, args) {
+    const values = args.values;
+    if (values.check === true || values['exit-code'] === true)
+        return planCommand(ctx, args);
+    const source = await resolveSource(ctx, args);
+    try {
+        const onUnknownFields = (n) => ctx.io.err(`atlas: warning: ${n.method} ${n.path} ignored field(s) ${n.fields}${n.suggestions ? ` (did you mean: ${n.suggestions})` : ''}. This instance is lenient; set auth_config.strictRequestBodies to refuse them.`);
+        const kept = keepingSecrets(requireHttp(ctx, values, onUnknownFields), (0, args_1.str)(values, 'out') || (0, secrets_1.productDir)(ctx.env, 'atlas'));
+        const prune = values.prune === true;
+        const plan = await planConfigImport(kept.http, { dir: source.dir, format: source.format, env: source.env, prune, forceHook: values['force-hook'] === true, rotateSecrets: values['rotate-secret'] === true });
+        printPlan(ctx, plan.changes, plan.unchanged, plan.skippedDeletes, { dryRun: false, prune });
+        for (const c of plan.changes) {
+            if (c.action !== 'update')
+                continue;
+            const fields = printedFields(c);
+            if (fields.length)
+                ctx.io.out(`  ~ ${c.key ? `${c.type} ${c.key}` : c.type}:`);
+            for (const f of fields)
+                ctx.io.out(`      ${printedLine(f)}`);
+        }
+        printPlanNotes(ctx, plan);
+        if (plan.changes.length === 0) {
+            ctx.io.out('No changes to apply.');
+            return 0;
+        }
+        const missing = unresolvedPlaceholders(plan.changes);
+        if (missing.length) {
+            throw new errors_1.CliError(`Unresolved placeholder(s): ${missing.map((n) => `\${${n}}`).join(', ')}. Set them in the environment or in --secrets-file.`);
+        }
+        if (values.yes !== true) {
+            const answer = (await ctx.prompt.text(`Apply ${plan.changes.length} change(s)? [y/N]`, { default: 'n' })).trim().toLowerCase();
+            if (answer !== 'y' && answer !== 'yes') {
+                ctx.io.out('Nothing applied.');
+                return 1;
+            }
+        }
+        for (const change of plan.changes)
+            await change.apply();
+        ctx.io.out(`Applied ${plan.changes.length} change(s).`);
+        for (const path of kept.saved)
+            ctx.io.out(`A new secret was written to ${path} (mode 0600). It is shown only once.`);
+        return 0;
+    }
+    finally {
+        source.cleanup();
+    }
+}
+/**
+ * The API, but a create that answers with a one-time secret (a new OAuth
+ * client's `client_secret`, a new webhook endpoint's `secret`) writes it to a
+ * 0600 dotenv file in `dir` (default `~/.config/atlas`, or `--out`) instead of
+ * dropping it. The file names are the hosted-redirect env names.
+ */
+function keepingSecrets(http, dir) {
+    const saved = [];
+    const wrapped = {
+        get: (path) => http.get(path),
+        put: (path, body) => http.put(path, body),
+        patch: (path, body) => http.patch(path, body),
+        delete: (path, body) => http.delete(path, body),
+        async post(path, body) {
+            const res = await http.post(path, body);
+            const r = (res ?? {});
+            const id = String(r.id ?? r.client_id ?? 'new').replace(/[^A-Za-z0-9_-]/g, '_');
+            let entries = null;
+            if (path === '/v1/oauth_clients' && typeof r.client_secret === 'string') {
+                entries = { ATLAS_CLIENT_ID: String(r.client_id ?? ''), ATLAS_CLIENT_SECRET: r.client_secret };
+            }
+            else if (path === '/v1/webhook_endpoints' && typeof r.secret === 'string' && !body?.secret) {
+                // A secret the file chose is already the caller's; only a minted one needs keeping.
+                entries = { ATLAS_WEBHOOK_SECRET: r.secret };
+            }
+            if (entries) {
+                const kind = path === '/v1/oauth_clients' ? 'oauth-client' : 'webhook';
+                saved.push((0, secrets_1.writeSecretFile)(dir, `${kind}-${id}.env`, entries, { comment: `Written by atlas apply. ${kind} ${id}.` }).path);
+            }
+            return res;
+        },
+    };
+    return { http: wrapped, saved };
+}
+function printPlan(ctx, changes, unchanged, skippedDeletes, opts) {
+    const heading = opts.dryRun ? 'Plan (dry run — nothing applied):' : 'Plan:';
+    ctx.io.out(heading);
+    if (changes.length === 0) {
+        ctx.io.out('  (no changes)');
+    }
+    const sign = { create: '+', update: '~', delete: '-' };
+    for (const c of [...changes].sort(sortChange)) {
+        const label = c.key ? `${c.type} ${c.key}` : c.type;
+        ctx.io.out(`  ${sign[c.action]} ${c.action} ${label}`);
+    }
+    if (!opts.prune && skippedDeletes.length) {
+        ctx.io.out(`  ${skippedDeletes.length} resource(s) exist live but not in config — pass --prune to delete.`);
+    }
+    ctx.io.out(`  ${unchanged} unchanged.`);
+}
+function sortChange(a, b) {
+    if (a.type !== b.type)
+        return a.type < b.type ? -1 : 1;
+    if (a.action !== b.action)
+        return a.action < b.action ? -1 : 1;
+    return a.key < b.key ? -1 : a.key > b.key ? 1 : 0;
+}
+function asArray(value) {
+    return Array.isArray(value) ? value : [];
+}
+/**
+ * Replace `${ENV_VAR}` placeholders inside any string with the environment's
+ * value — the one sanctioned way a secret enters an import without ever living
+ * on disk. An unset variable is left verbatim so the plan surfaces it rather
+ * than silently blanking a credential.
+ */
+function interpolate(value, env, key) {
+    if (typeof value === 'string') {
+        return value.replace(/\$\{([A-Z0-9_]+)\}/g, (match, name) => {
+            const resolved = env[name];
+            if (resolved === undefined)
+                return match;
+            (0, redact_1.rememberResolved)(key, resolved);
+            return resolved;
+        });
+    }
+    if (Array.isArray(value))
+        return value.map((v) => interpolate(v, env, key));
+    if (value !== null && typeof value === 'object') {
+        const out = {};
+        for (const [k, v] of Object.entries(value))
+            out[k] = interpolate(v, env, k);
+        return out;
+    }
+    return value;
+}
+//# sourceMappingURL=config.js.map