@atlasauth/cli 0.25.0 → 0.26.0

package/dist/run.d.ts

@@ -0,0 +1,12 @@
+import { type ParsedArgs } from './args';
+import { type RunContext } from './context';
+/** A command handler: given the context and parsed args, do the work; return an exit code. */
+export type Handler = (ctx: RunContext, args: ParsedArgs) => Promise<number>;
+/**
+ * The CLI's whole control flow, as a pure function of (argv, context) → exit
+ * code. It NEVER calls `process.exit` and NEVER throws: the bin calls it and
+ * exits with what it returns, and every test drives this same path with a
+ * captured IO. All error reporting funnels through the one try/catch so a user
+ * sees a clean message and a non-zero code — never a stack trace.
+ */
+export declare function run(argv: string[], rawCtx: RunContext): Promise<number>;

package/dist/run.js

@@ -0,0 +1,169 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.run = run;
+const backend_1 = require("@atlasauth/backend");
+const args_1 = require("./args");
+const actions_1 = require("./commands/actions");
+const pages_1 = require("./commands/pages");
+const api_keys_1 = require("./commands/api-keys");
+const auth_1 = require("./commands/auth");
+const operator_1 = require("./commands/operator");
+const config_1 = require("./commands/config");
+const init_1 = require("./commands/init");
+const golive_1 = require("./commands/golive");
+const import_1 = require("./commands/import");
+const info_1 = require("./commands/info");
+const csp_1 = require("./commands/csp");
+const fga_1 = require("./commands/fga");
+const dev_1 = require("./commands/dev");
+const listen_1 = require("./commands/listen");
+const migrate_1 = require("./commands/migrate");
+const move_origin_1 = require("./commands/move-origin");
+const mcp_1 = require("./commands/mcp");
+const project_commands_1 = require("./commands/project-commands");
+const orgs_1 = require("./commands/orgs");
+const referrals_1 = require("./commands/referrals");
+const sessions_1 = require("./commands/sessions");
+const status_1 = require("./commands/status");
+const users_1 = require("./commands/users");
+const webhooks_1 = require("./commands/webhooks");
+const integrations_1 = require("./commands/integrations");
+const id_accounts_1 = require("./commands/id-accounts");
+const admin_1 = require("./commands/admin");
+const partner_platforms_1 = require("./commands/partner-platforms");
+const resources_1 = require("./commands/resources");
+const context_1 = require("./context");
+const errors_1 = require("./errors");
+const help_1 = require("./help");
+const redact_1 = require("./redact");
+const setup_guide_1 = require("./commands/setup-guide");
+const version_1 = require("./version");
+/** The command table — the single place every top-level command is registered. */
+const COMMANDS = {
+    login: auth_1.login,
+    logout: auth_1.logout,
+    whoami: auth_1.whoami,
+    token: operator_1.token,
+    keys: operator_1.keys,
+    users: users_1.users,
+    orgs: orgs_1.orgs,
+    'api-keys': api_keys_1.apiKeys,
+    webhooks: webhooks_1.webhooks,
+    integrations: integrations_1.integrations,
+    'partner-platforms': partner_platforms_1.partnerPlatforms,
+    'id-accounts': id_accounts_1.idAccounts,
+    admin: admin_1.admin,
+    sessions: sessions_1.sessions,
+    config: config_1.config,
+    plan: config_1.planCommand,
+    apply: config_1.applyCommand,
+    actions: actions_1.actions,
+    pages: pages_1.pages,
+    init: init_1.init,
+    'setup-guide': setup_guide_1.setupGuide,
+    preflight: project_commands_1.preflight,
+    doctor: project_commands_1.doctor,
+    golive: golive_1.golive,
+    env: project_commands_1.envCommand,
+    client: project_commands_1.client,
+    referrals: referrals_1.referrals,
+    status: status_1.status,
+    import: import_1.importUsers,
+    migrate: migrate_1.migrate,
+    info: info_1.info,
+    mcp: mcp_1.mcp,
+    listen: listen_1.listen,
+    dev: dev_1.dev,
+    'move-origin': move_origin_1.moveOrigin,
+    csp: csp_1.csp,
+    fga: fga_1.fga,
+    workflows: (0, resources_1.resourceCommand)('workflows', resources_1.WORKFLOWS),
+    chat: (0, resources_1.resourceCommand)('chat', resources_1.CHAT),
+    cloud: (0, resources_1.resourceCommand)('cloud', resources_1.CLOUD),
+    'saml-idp': (0, resources_1.resourceCommand)('saml-idp', resources_1.SAML_IDP),
+    provisioning: (0, resources_1.resourceCommand)('provisioning', resources_1.PROVISIONING),
+    catalog: (0, resources_1.resourceCommand)('catalog', resources_1.CATALOG),
+    'device-sso': (0, resources_1.resourceCommand)('device-sso', resources_1.DEVICE_SSO),
+    'connection-actions': (0, resources_1.resourceCommand)('connection-actions', resources_1.CONNECTION_ACTIONS),
+    triggers: (0, resources_1.resourceCommand)('triggers', resources_1.TRIGGERS),
+    agents: (0, resources_1.resourceCommand)('agents', resources_1.AGENTS),
+    telemetry: (0, resources_1.resourceCommand)('telemetry', resources_1.TELEMETRY),
+    pdp: (0, resources_1.resourceCommand)('pdp', resources_1.PDP),
+    billing: (0, resources_1.resourceCommand)('billing', resources_1.BILLING),
+    audit: (0, resources_1.resourceCommand)('audit', resources_1.AUDIT),
+    federation: (0, resources_1.resourceCommand)('federation', resources_1.FEDERATION),
+    vc: (0, resources_1.resourceCommand)('vc', resources_1.VC),
+};
+/**
+ * The CLI's whole control flow, as a pure function of (argv, context) → exit
+ * code. It NEVER calls `process.exit` and NEVER throws: the bin calls it and
+ * exits with what it returns, and every test drives this same path with a
+ * captured IO. All error reporting funnels through the one try/catch so a user
+ * sees a clean message and a non-zero code — never a stack trace.
+ */
+async function run(argv, rawCtx) {
+    (0, redact_1.resetRedaction)();
+    const ctx = { ...rawCtx, io: (0, redact_1.scrubbingIO)(rawCtx.io) };
+    let args;
+    try {
+        args = (0, args_1.parse)(argv);
+    }
+    catch (err) {
+        return report(ctx, err);
+    }
+    // --version wins over everything, like most CLIs.
+    if (args.values.version) {
+        ctx.io.out((0, version_1.getVersion)());
+        return 0;
+    }
+    if (args.values['show-secrets']) {
+        if (!(0, context_1.ttyOf)(ctx).stdout || ctx.env.CI) {
+            return report(ctx, new errors_1.CliError('--show-secrets needs a terminal: it is refused when stdout is not a TTY or CI is set.'));
+        }
+        (0, redact_1.setRevealSecrets)(true);
+    }
+    const command = args.positionals[0];
+    // Bare `atlas` or `atlas --help`: top-level help on stdout, success.
+    if (!command) {
+        ctx.io.out(help_1.TOP_HELP);
+        return 0;
+    }
+    const handler = COMMANDS[command];
+    if (!handler) {
+        ctx.io.err(`Unknown command '${command}'.`);
+        ctx.io.err("Run 'atlas --help' to see available commands.");
+        return 1;
+    }
+    // `atlas <command> --help`: command-specific help on stdout, success.
+    if (args.values.help) {
+        ctx.io.out(help_1.COMMAND_HELP[command] ?? help_1.TOP_HELP);
+        return 0;
+    }
+    try {
+        return await handler(ctx, args);
+    }
+    catch (err) {
+        return report(ctx, err);
+    }
+}
+/**
+ * Turn any thrown error into a clean stderr message + exit code. An
+ * {@link AtlasApiError} keeps its HTTP status and stable `code` so the user can
+ * act on it; a {@link CliError} carries its own code; anything else is an
+ * unexpected bug reported as its message (still no stack).
+ */
+function report(ctx, err) {
+    if (err instanceof backend_1.AtlasApiError) {
+        const code = err.code ? ` [${err.code}]` : '';
+        ctx.io.err(`atlas: API error (HTTP ${err.status})${code}: ${(0, redact_1.scrubText)(err.message)}`);
+        return 1;
+    }
+    if (err instanceof errors_1.CliError) {
+        ctx.io.err(`atlas: ${(0, redact_1.scrubText)(err.message)}`);
+        return err.exitCode;
+    }
+    const message = err instanceof Error ? err.message : String(err);
+    ctx.io.err(`atlas: ${(0, redact_1.scrubText)(message)}`);
+    return 1;
+}
+//# sourceMappingURL=run.js.map

package/dist/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":";;AA4GA,kBAiDC;AA7JD,gDAAmD;AACnD,iCAAgD;AAChD,gDAA6C;AAC7C,4CAAyC;AACzC,kDAA8C;AAC9C,0CAAwD;AACxD,kDAAkD;AAClD,8CAAsE;AACtE,0CAAuC;AACvC,8CAA2C;AAC3C,8CAAgD;AAChD,0CAAuC;AACvC,wCAAqC;AACrC,wCAAqC;AACrC,wCAAqC;AACrC,8CAA2C;AAC3C,gDAA6C;AAC7C,wDAAoD;AACpD,wCAAqC;AACrC,kEAAoF;AACpF,0CAAuC;AACvC,oDAAiD;AACjD,kDAA+C;AAC/C,8CAA2C;AAC3C,4CAAyC;AACzC,kDAA+C;AAC/C,0DAAuD;AACvD,wDAAoD;AACpD,4CAAyC;AACzC,oEAAgE;AAChE,oDAG8B;AAC9B,uCAAmD;AACnD,qCAAoC;AACpC,iCAAgD;AAChD,qCAAoF;AACpF,wDAAoD;AACpD,uCAAuC;AAKvC,kFAAkF;AAClF,MAAM,QAAQ,GAA4B;IACxC,KAAK,EAAL,YAAK;IACL,MAAM,EAAN,aAAM;IACN,MAAM,EAAN,aAAM;IACN,KAAK,EAAL,gBAAK;IACL,IAAI,EAAJ,eAAI;IACJ,KAAK,EAAL,aAAK;IACL,IAAI,EAAJ,WAAI;IACJ,UAAU,EAAE,kBAAO;IACnB,QAAQ,EAAR,mBAAQ;IACR,YAAY,EAAZ,2BAAY;IACZ,mBAAmB,EAAE,oCAAgB;IACrC,aAAa,EAAE,wBAAU;IACzB,KAAK,EAAL,aAAK;IACL,QAAQ,EAAR,mBAAQ;IACR,MAAM,EAAN,eAAM;IACN,IAAI,EAAE,oBAAW;IACjB,KAAK,EAAE,qBAAY;IACnB,OAAO,EAAP,iBAAO;IACP,KAAK,EAAL,aAAK;IACL,IAAI,EAAJ,WAAI;IACJ,aAAa,EAAE,wBAAU;IACzB,SAAS,EAAT,4BAAS;IACT,MAAM,EAAN,yBAAM;IACN,MAAM,EAAN,eAAM;IACN,GAAG,EAAE,6BAAU;IACf,MAAM,EAAN,yBAAM;IACN,SAAS,EAAT,qBAAS;IACT,MAAM,EAAN,eAAM;IACN,MAAM,EAAE,oBAAW;IACnB,OAAO,EAAP,iBAAO;IACP,IAAI,EAAJ,WAAI;IACJ,GAAG,EAAH,SAAG;IACH,MAAM,EAAN,eAAM;IACN,GAAG,EAAH,SAAG;IACH,aAAa,EAAE,wBAAU;IACzB,GAAG,EAAH,SAAG;IACH,GAAG,EAAH,SAAG;IACH,SAAS,EAAE,IAAA,2BAAe,EAAC,WAAW,EAAE,qBAAS,CAAC;IAClD,IAAI,EAAE,IAAA,2BAAe,EAAC,MAAM,EAAE,gBAAI,CAAC;IACnC,KAAK,EAAE,IAAA,2BAAe,EAAC,OAAO,EAAE,iBAAK,CAAC;IACtC,UAAU,EAAE,IAAA,2BAAe,EAAC,UAAU,EAAE,oBAAQ,CAAC;IACjD,YAAY,EAAE,IAAA,2BAAe,EAAC,cAAc,EAAE,wBAAY,CAAC;IAC3D,OAAO,EAAE,IAAA,2BAAe,EAAC,SAAS,EAAE,mBAAO,CAAC;IAC5C,YAAY,EAAE,IAAA,2BAAe,EAAC,YAAY,EAAE,sBAAU,CAAC;IACvD,oBAAoB,EAAE,IAAA,2BAAe,EAAC,oBAAoB,EAAE,8BAAkB,CAAC;IAC/E,QAAQ,EAAE,IAAA,2BAAe,EAAC,UAAU,EAAE,oBAAQ,CAAC;IAC/C,MAAM,EAAE,IAAA,2BAAe,EAAC,QAAQ,EAAE,kBAAM,CAAC;IACzC,SAAS,EAAE,IAAA,2BAAe,EAAC,WAAW,EAAE,qBAAS,CAAC;IAClD,GAAG,EAAE,IAAA,2BAAe,EAAC,KAAK,EAAE,eAAG,CAAC;IAChC,OAAO,EAAE,IAAA,2BAAe,EAAC,SAAS,EAAE,mBAAO,CAAC;IAC5C,KAAK,EAAE,IAAA,2BAAe,EAAC,OAAO,EAAE,iBAAK,CAAC;IACtC,UAAU,EAAE,IAAA,2BAAe,EAAC,YAAY,EAAE,sBAAU,CAAC;IACrD,EAAE,EAAE,IAAA,2BAAe,EAAC,IAAI,EAAE,cAAE,CAAC;CAC9B,CAAC;AAEF;;;;;;GAMG;AACI,KAAK,UAAU,GAAG,CAAC,IAAc,EAAE,MAAkB;IAC1D,IAAA,uBAAc,GAAE,CAAC;IACjB,MAAM,GAAG,GAAe,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,IAAA,oBAAW,EAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;IAClE,IAAI,IAAgB,CAAC;IACrB,IAAI,CAAC;QACH,IAAI,GAAG,IAAA,YAAK,EAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,kDAAkD;IAClD,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACxB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAA,oBAAU,GAAE,CAAC,CAAC;QACzB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC,IAAA,eAAK,EAAC,GAAG,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACrC,OAAO,MAAM,CAAC,GAAG,EAAE,IAAI,iBAAQ,CAAC,uFAAuF,CAAC,CAAC,CAAC;QAC5H,CAAC;QACD,IAAA,yBAAgB,EAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAEpC,qEAAqE;IACrE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,eAAQ,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,oBAAoB,OAAO,IAAI,CAAC,CAAC;QAC5C,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC5D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,sEAAsE;IACtE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACrB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,mBAAY,CAAC,OAAO,CAAC,IAAI,eAAQ,CAAC,CAAC;QAC9C,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,MAAM,CAAC,GAAe,EAAE,GAAY;IAC3C,IAAI,GAAG,YAAY,uBAAa,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,0BAA0B,GAAG,CAAC,MAAM,IAAI,IAAI,KAAK,IAAA,kBAAS,EAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACtF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,GAAG,YAAY,iBAAQ,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,IAAA,kBAAS,EAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/C,OAAO,GAAG,CAAC,QAAQ,CAAC;IACtB,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,IAAA,kBAAS,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3C,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/secrets.d.ts

@@ -0,0 +1,41 @@
+import type { IO } from './io';
+export declare function assertProductName(product: string): string;
+/** `$XDG_CONFIG_HOME/<product>` (default `~/.config/<product>`). */
+export declare function productDir(env: NodeJS.ProcessEnv, product: string): string;
+export declare function renderDotenv(entries: Record<string, string>, comment?: string): string;
+/** Parse a dotenv file this CLI wrote (KEY=value lines, `#` comments). */
+export declare function parseDotenv(text: string): Record<string, string>;
+/**
+ * Write a 0600 dotenv file inside a 0700 directory. Refuses an existing file
+ * unless `force` (the same content is not a conflict: a re-run is a no-op).
+ * Returns the path.
+ */
+export declare function writeSecretFile(dir: string, fileName: string, entries: Record<string, string>, opts?: {
+    force?: boolean;
+    comment?: string;
+}): {
+    path: string;
+    written: boolean;
+};
+/** Read one of the CLI's env files, or undefined when it does not exist. */
+export declare function readEnvFile(path: string): Record<string, string> | undefined;
+/** The env files in a product directory (for `atlas env`). */
+export declare function listEnvFiles(dir: string): string[];
+/**
+ * The common "a secret arrived" path for single-secret commands: write it to
+ * `<dir>/<fileName>` (0600) and print the path, or — only with
+ * `--print-secret` — print it after a warning on stderr.
+ */
+export declare function deliverSecret(input: {
+    io: IO;
+    env: NodeJS.ProcessEnv;
+    product: string;
+    fileName: string;
+    entries: Record<string, string>;
+    label: string;
+    printSecret?: boolean;
+    force?: boolean;
+    comment?: string;
+}): {
+    path?: string;
+};

package/dist/secrets.js

@@ -0,0 +1,142 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertProductName = assertProductName;
+exports.productDir = productDir;
+exports.renderDotenv = renderDotenv;
+exports.parseDotenv = parseDotenv;
+exports.writeSecretFile = writeSecretFile;
+exports.readEnvFile = readEnvFile;
+exports.listEnvFiles = listEnvFiles;
+exports.deliverSecret = deliverSecret;
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const errors_1 = require("./errors");
+/**
+ * Secrets the CLI receives are written to disk, never printed.
+ *
+ * Every command that gets a secret back from the API (an instance secret key,
+ * an OAuth client secret, a webhook signing secret, an end-user API key) writes
+ * it to a dotenv file under `~/.config/<product>/` — directory 0700, file 0600 —
+ * and prints only the file path. `--print-secret` is the one explicit opt-out,
+ * and it prints a warning first. An existing file is never overwritten unless
+ * the command was given `--force`, so a re-run cannot silently destroy the only
+ * copy of a working secret.
+ *
+ * The product name doubles as the directory name, so it is restricted to a safe
+ * slug (no path separators, no dot-dot).
+ */
+const PRODUCT_RE = /^[a-z0-9][a-z0-9_-]{0,62}$/i;
+function assertProductName(product) {
+    if (!PRODUCT_RE.test(product)) {
+        throw new errors_1.CliError(`--product must be letters, digits, '-' or '_' (up to 63 characters), got '${product}'.`);
+    }
+    return product;
+}
+/** `$XDG_CONFIG_HOME/<product>` (default `~/.config/<product>`). */
+function productDir(env, product) {
+    const base = env.XDG_CONFIG_HOME?.trim() || (0, node_path_1.join)(env.HOME?.trim() || (0, node_os_1.homedir)(), '.config');
+    return (0, node_path_1.join)(base, assertProductName(product));
+}
+/** Quote a dotenv value when it needs it. Secrets are token-shaped, so this is rarely used. */
+function dotenvValue(v) {
+    return /^[A-Za-z0-9_./:@+=,-]*$/.test(v) ? v : JSON.stringify(v);
+}
+function renderDotenv(entries, comment) {
+    const lines = comment ? comment.split('\n').map((l) => `# ${l}`) : [];
+    for (const [k, v] of Object.entries(entries))
+        lines.push(`${k}=${dotenvValue(v)}`);
+    return lines.join('\n') + '\n';
+}
+/** Parse a dotenv file this CLI wrote (KEY=value lines, `#` comments). */
+function parseDotenv(text) {
+    const out = {};
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        const i = line.indexOf('=');
+        if (i < 1)
+            continue;
+        const key = line.slice(0, i).trim();
+        let value = line.slice(i + 1).trim();
+        if (value.startsWith('"') && value.endsWith('"')) {
+            try {
+                value = JSON.parse(value);
+            }
+            catch {
+                /* keep raw */
+            }
+        }
+        out[key] = value;
+    }
+    return out;
+}
+/**
+ * Write a 0600 dotenv file inside a 0700 directory. Refuses an existing file
+ * unless `force` (the same content is not a conflict: a re-run is a no-op).
+ * Returns the path.
+ */
+function writeSecretFile(dir, fileName, entries, opts = {}) {
+    if (fileName.includes('/') || fileName.includes('\\') || fileName.startsWith('.')) {
+        throw new errors_1.CliError(`Refusing to write a secret file named '${fileName}'.`);
+    }
+    const path = (0, node_path_1.join)(dir, fileName);
+    const content = renderDotenv(entries, opts.comment);
+    (0, node_fs_1.mkdirSync)(dir, { recursive: true, mode: 0o700 });
+    (0, node_fs_1.chmodSync)(dir, 0o700);
+    if ((0, node_fs_1.existsSync)(path)) {
+        const current = (0, node_fs_1.readFileSync)(path, 'utf8');
+        if (current === content) {
+            (0, node_fs_1.chmodSync)(path, 0o600);
+            return { path, written: false };
+        }
+        if (!opts.force) {
+            throw new errors_1.CliError(`${path} already exists and holds a different secret. Nothing was overwritten. Move it aside, or re-run with --force to replace it.`);
+        }
+    }
+    // Write THEN chmod: `mode` is masked by umask and ignored for an existing file.
+    (0, node_fs_1.writeFileSync)(path, content, { mode: 0o600 });
+    (0, node_fs_1.chmodSync)(path, 0o600);
+    return { path, written: true };
+}
+/** Read one of the CLI's env files, or undefined when it does not exist. */
+function readEnvFile(path) {
+    try {
+        return parseDotenv((0, node_fs_1.readFileSync)(path, 'utf8'));
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The env files in a product directory (for `atlas env`). */
+function listEnvFiles(dir) {
+    try {
+        return (0, node_fs_1.readdirSync)(dir)
+            .filter((f) => f.endsWith('.env'))
+            .sort();
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * The common "a secret arrived" path for single-secret commands: write it to
+ * `<dir>/<fileName>` (0600) and print the path, or — only with
+ * `--print-secret` — print it after a warning on stderr.
+ */
+function deliverSecret(input) {
+    if (input.printSecret) {
+        input.io.err(`atlas: warning: printing ${input.label} because --print-secret was given. It may end up in your shell history, terminal scrollback or CI logs.`);
+        for (const [k, v] of Object.entries(input.entries))
+            input.io.out(`${k}=${v}`);
+        return {};
+    }
+    const { path } = writeSecretFile(productDir(input.env, input.product), input.fileName, input.entries, {
+        force: input.force,
+        comment: input.comment,
+    });
+    input.io.out(`${input.label} written to ${path} (mode 0600).`);
+    return { path };
+}
+//# sourceMappingURL=secrets.js.map

package/dist/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":";;AAuBA,8CAOC;AAGD,gCAGC;AAOD,oCAIC;AAGD,kCAmBC;AAOD,0CA6BC;AAGD,kCAMC;AAGD,oCAQC;AAOD,sCAwBC;AA5JD,qCAAqG;AACrG,qCAAkC;AAClC,yCAAiC;AACjC,qCAAoC;AAGpC;;;;;;;;;;;;;GAaG;AAEH,MAAM,UAAU,GAAG,6BAA6B,CAAC;AAEjD,SAAgB,iBAAiB,CAAC,OAAe;IAC/C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,iBAAQ,CAChB,6EAA6E,OAAO,IAAI,CACzF,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,oEAAoE;AACpE,SAAgB,UAAU,CAAC,GAAsB,EAAE,OAAe;IAChE,MAAM,IAAI,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,IAAA,gBAAI,EAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,IAAA,iBAAO,GAAE,EAAE,SAAS,CAAC,CAAC;IAC3F,OAAO,IAAA,gBAAI,EAAC,IAAI,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,+FAA+F;AAC/F,SAAS,WAAW,CAAC,CAAS;IAC5B,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,SAAgB,YAAY,CAAC,OAA+B,EAAE,OAAgB;IAC5E,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC;AAED,0EAA0E;AAC1E,SAAgB,WAAW,CAAC,IAAY;IACtC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACpC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC;gBACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAW,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc;YAChB,CAAC;QACH,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAgB,eAAe,CAC7B,GAAW,EACX,QAAgB,EAChB,OAA+B,EAC/B,OAA8C,EAAE;IAEhD,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,iBAAQ,CAAC,0CAA0C,QAAQ,IAAI,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,IAAI,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACpD,IAAA,mBAAS,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,IAAA,mBAAS,EAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtB,IAAI,IAAA,oBAAU,EAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3C,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACxB,IAAA,mBAAS,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACvB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAClC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,iBAAQ,CAChB,GAAG,IAAI,6HAA6H,CACrI,CAAC;QACJ,CAAC;IACH,CAAC;IACD,gFAAgF;IAChF,IAAA,uBAAa,EAAC,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9C,IAAA,mBAAS,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,4EAA4E;AAC5E,SAAgB,WAAW,CAAC,IAAY;IACtC,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,8DAA8D;AAC9D,SAAgB,YAAY,CAAC,GAAW;IACtC,IAAI,CAAC;QACH,OAAO,IAAA,qBAAW,EAAC,GAAG,CAAC;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;aACjC,IAAI,EAAE,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAAC,KAU7B;IACC,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,KAAK,CAAC,EAAE,CAAC,GAAG,CACV,4BAA4B,KAAK,CAAC,KAAK,yGAAyG,CACjJ,CAAC;QACF,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;YAAE,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9E,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,GAAG,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE;QACpG,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IACH,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,eAAe,IAAI,eAAe,CAAC,CAAC;IAC/D,OAAO,EAAE,IAAI,EAAE,CAAC;AAClB,CAAC"}

package/dist/serialize.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The on-disk format for `atlas config` — the config-as-code layer. Two
+ * concerns live here, kept away from the command logic:
+ *
+ *  1. CANONICALIZATION. A value is normalised before it is written or compared
+ *     so an export is byte-for-byte deterministic and a round-trip is a no-op
+ *     diff. We sort object keys (the same rule Go's `json.Marshal` and the
+ *     Terraform provider's `canonicalJSON` use) and PRESERVE array order — so a
+ *     field whose order is meaningful (a claim mapping, an auth_config list) is
+ *     never silently reordered.
+ *
+ *  2. THE CODEC. JSON is the robust default. YAML is offered for readable diffs
+ *     in a repo; we WRITE a small subset where every map key and every scalar is
+ *     JSON-encoded (it round-trips exactly: newlines, URL-shaped keys, unicode),
+ *     and READ any YAML, so a hand-written atlas.yaml works too.
+ */
+export type Json = string | number | boolean | null | Json[] | {
+    [k: string]: Json;
+};
+export type Format = 'json' | 'yaml';
+/** A plain JSON value with all object keys recursively sorted; arrays untouched. */
+export declare function canonicalize(value: unknown): Json;
+/** Canonical JSON string — the equality oracle for the diff engine. */
+export declare function canonicalString(value: unknown): string;
+/** True when two config values are equal after canonicalization. */
+export declare function deepEqual(a: unknown, b: unknown): boolean;
+/** Serialize a canonicalizable value to the chosen format, with a trailing newline. */
+export declare function serialize(value: unknown, format: Format): string;
+/** Parse a document written by {@link serialize}. */
+export declare function deserialize(text: string, format: Format): Json;

package/dist/serialize.js

@@ -0,0 +1,131 @@
+"use strict";
+/**
+ * The on-disk format for `atlas config` — the config-as-code layer. Two
+ * concerns live here, kept away from the command logic:
+ *
+ *  1. CANONICALIZATION. A value is normalised before it is written or compared
+ *     so an export is byte-for-byte deterministic and a round-trip is a no-op
+ *     diff. We sort object keys (the same rule Go's `json.Marshal` and the
+ *     Terraform provider's `canonicalJSON` use) and PRESERVE array order — so a
+ *     field whose order is meaningful (a claim mapping, an auth_config list) is
+ *     never silently reordered.
+ *
+ *  2. THE CODEC. JSON is the robust default. YAML is offered for readable diffs
+ *     in a repo; we WRITE a small subset where every map key and every scalar is
+ *     JSON-encoded (it round-trips exactly: newlines, URL-shaped keys, unicode),
+ *     and READ any YAML, so a hand-written atlas.yaml works too.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canonicalize = canonicalize;
+exports.canonicalString = canonicalString;
+exports.deepEqual = deepEqual;
+exports.serialize = serialize;
+exports.deserialize = deserialize;
+const yaml_1 = require("yaml");
+/** A plain JSON value with all object keys recursively sorted; arrays untouched. */
+function canonicalize(value) {
+    if (value === null || value === undefined)
+        return null;
+    if (Array.isArray(value))
+        return value.map((v) => canonicalize(v));
+    if (typeof value === 'object') {
+        const out = {};
+        for (const key of Object.keys(value).sort()) {
+            const v = value[key];
+            if (v === undefined)
+                continue; // omit undefined so it never reaches disk
+            out[key] = canonicalize(v);
+        }
+        return out;
+    }
+    if (typeof value === 'number' || typeof value === 'boolean' || typeof value === 'string') {
+        return value;
+    }
+    // Functions, symbols, bigint: not part of a config document.
+    return null;
+}
+/** Canonical JSON string — the equality oracle for the diff engine. */
+function canonicalString(value) {
+    return JSON.stringify(canonicalize(value));
+}
+/** True when two config values are equal after canonicalization. */
+function deepEqual(a, b) {
+    return canonicalString(a) === canonicalString(b);
+}
+/** Serialize a canonicalizable value to the chosen format, with a trailing newline. */
+function serialize(value, format) {
+    const canon = canonicalize(value);
+    if (format === 'json')
+        return JSON.stringify(canon, null, 2) + '\n';
+    return emitYaml(canon, 0) + '\n';
+}
+/** Parse a document written by {@link serialize}. */
+function deserialize(text, format) {
+    if (format === 'json')
+        return JSON.parse(text);
+    return parseYaml(text);
+}
+// ─────────────────────────────── YAML emit ───────────────────────────────
+const INDENT = '  ';
+function emitYaml(value, depth) {
+    const pad = INDENT.repeat(depth);
+    if (Array.isArray(value)) {
+        if (value.length === 0)
+            return `${pad}[]`;
+        return value.map((item) => emitSeqItem(item, depth)).join('\n');
+    }
+    if (value !== null && typeof value === 'object') {
+        const keys = Object.keys(value);
+        if (keys.length === 0)
+            return `${pad}{}`;
+        return keys.map((key) => emitMapEntry(key, value[key], depth)).join('\n');
+    }
+    // A bare scalar document.
+    return `${pad}${JSON.stringify(value)}`;
+}
+function emitMapEntry(key, value, depth) {
+    const pad = INDENT.repeat(depth);
+    const k = JSON.stringify(key);
+    if (isContainer(value) && !isEmptyContainer(value)) {
+        return `${pad}${k}:\n${emitYaml(value, depth + 1)}`;
+    }
+    return `${pad}${k}: ${scalarOrEmpty(value)}`;
+}
+function emitSeqItem(value, depth) {
+    const pad = INDENT.repeat(depth);
+    if (isContainer(value) && !isEmptyContainer(value)) {
+        return `${pad}-\n${emitYaml(value, depth + 1)}`;
+    }
+    return `${pad}- ${scalarOrEmpty(value)}`;
+}
+function scalarOrEmpty(value) {
+    if (Array.isArray(value))
+        return '[]';
+    if (value !== null && typeof value === 'object')
+        return '{}';
+    return JSON.stringify(value);
+}
+function isContainer(v) {
+    return Array.isArray(v) || (v !== null && typeof v === 'object');
+}
+function isEmptyContainer(v) {
+    if (Array.isArray(v))
+        return v.length === 0;
+    if (v !== null && typeof v === 'object')
+        return Object.keys(v).length === 0;
+    return false;
+}
+// ─────────────────────────────── YAML parse ───────────────────────────────
+/**
+ * Any YAML 1.2 document: our own export (JSON-encoded keys and scalars) and a
+ * hand-written atlas.yaml with plain keys alike.
+ */
+function parseYaml(text) {
+    try {
+        return ((0, yaml_1.parse)(text) ?? null);
+    }
+    catch (err) {
+        throw new Error(`atlas config: invalid YAML: ${err.message}`);
+    }
+}
+//# sourceMappingURL=serialize.js.map

package/dist/serialize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serialize.js","sourceRoot":"","sources":["../src/serialize.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;AAQH,oCAiBC;AAGD,0CAEC;AAGD,8BAEC;AAGD,8BAIC;AAGD,kCAGC;AA9CD,+BAAkD;AAKlD,oFAAoF;AACpF,SAAgB,YAAY,CAAC,KAAc;IACzC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAA0B,EAAE,CAAC;QACtC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACvE,MAAM,CAAC,GAAI,KAAiC,CAAC,GAAG,CAAC,CAAC;YAClD,IAAI,CAAC,KAAK,SAAS;gBAAE,SAAS,CAAC,0CAA0C;YACzE,GAAG,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACzF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,6DAA6D;IAC7D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uEAAuE;AACvE,SAAgB,eAAe,CAAC,KAAc;IAC5C,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,oEAAoE;AACpE,SAAgB,SAAS,CAAC,CAAU,EAAE,CAAU;IAC9C,OAAO,eAAe,CAAC,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,uFAAuF;AACvF,SAAgB,SAAS,CAAC,KAAc,EAAE,MAAc;IACtD,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;IACpE,OAAO,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;AACnC,CAAC;AAED,qDAAqD;AACrD,SAAgB,WAAW,CAAC,IAAY,EAAE,MAAc;IACtD,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAS,CAAC;IACvD,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,4EAA4E;AAE5E,MAAM,MAAM,GAAG,IAAI,CAAC;AAEpB,SAAS,QAAQ,CAAC,KAAW,EAAE,KAAa;IAC1C,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,GAAG,IAAI,CAAC;QAC1C,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,GAAG,IAAI,CAAC;QACzC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAS,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpF,CAAC;IACD,0BAA0B;IAC1B,OAAO,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,YAAY,CAAC,GAAW,EAAE,KAAW,EAAE,KAAa;IAC3D,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,OAAO,GAAG,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;IACtD,CAAC;IACD,OAAO,GAAG,GAAG,GAAG,CAAC,KAAK,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,WAAW,CAAC,KAAW,EAAE,KAAa;IAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,OAAO,GAAG,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;IAClD,CAAC;IACD,OAAO,GAAG,GAAG,KAAK,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,aAAa,CAAC,KAAW;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,WAAW,CAAC,CAAO;IAC1B,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AACnE,CAAC;AACD,SAAS,gBAAgB,CAAC,CAAO;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IAC5E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,6EAA6E;AAE7E;;;GAGG;AACH,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC;QACH,OAAO,CAAC,IAAA,YAAiB,EAAC,IAAI,CAAC,IAAI,IAAI,CAAS,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,+BAAgC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC"}

package/dist/version.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Read the package version from the shipped package.json at runtime rather than
+ * importing it — `src/` is the tsc rootDir, so a static `import ../package.json`
+ * would both break rootDir and bake a stale number into the bundle. At runtime
+ * `__dirname` is `dist/`, so `../package.json` is the real manifest beside it.
+ */
+export declare function getVersion(): string;

package/dist/version.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getVersion = getVersion;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+/**
+ * Read the package version from the shipped package.json at runtime rather than
+ * importing it — `src/` is the tsc rootDir, so a static `import ../package.json`
+ * would both break rootDir and bake a stale number into the bundle. At runtime
+ * `__dirname` is `dist/`, so `../package.json` is the real manifest beside it.
+ */
+function getVersion() {
+    try {
+        const manifest = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(__dirname, '..', 'package.json'), 'utf8'));
+        return manifest.version ?? '0.0.0';
+    }
+    catch {
+        return '0.0.0';
+    }
+}
+//# sourceMappingURL=version.js.map

package/dist/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":";;AASA,gCASC;AAlBD,qCAAuC;AACvC,yCAAiC;AAEjC;;;;;GAKG;AACH,SAAgB,UAAU;IACxB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAEtF,CAAC;QACF,OAAO,QAAQ,CAAC,OAAO,IAAI,OAAO,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlasauth/cli",
-  "version": "0.25.0",
+  "version": "0.26.0",
   "description": "atlas — manage an Atlas instance from the terminal via the Backend API.",
   "bin": {
     "atlas": "dist/cli.js"
@@ -17,10 +17,10 @@
   "dependencies": {
     "yaml": "^2.6.0",
     "@atlasauth/actions": "0.5.0",
-    "@atlasauth/backend": "0.35.0",
     "@atlasauth/emulator": "0.1.0",
-    "@atlasauth/upgrade": "0.7.0",
+    "@atlasauth/backend": "0.37.0",
     "@atlasauth/referral-conformance": "0.2.1",
+    "@atlasauth/upgrade": "0.7.0",
     "@atlasauth/migrate": "0.2.0"
   },
   "devDependencies": {