@atlasauth/cli 0.8.0 → 0.10.0

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # @atlasauth/cli changelog
 
+## 0.10.0 — 2026-10-24
+
+- Per-call integration audiences (`getToken({ for, cbid })`), partner platforms, operator tokens for partner products.
+
+## 0.9.0 — 2026-10-24
+
+### Added
+
+- `atlas webhooks` gains `upsert`, `update`, `test`, `deliveries`, `redeliver`, `replay`, `rotate` and `reveal`. Secrets go to 0600 files.
+- `atlas listen --forward-to <url> [--events user.*]`: signed local webhook forwarding with no tunnel.
+- `atlas move-origin --from --to [--dry-run]`: one-step domain move with a diff, a confirmation and a test delivery per moved webhook.
+- `atlas csp --framework next|express|nginx`: the CSP sources for your integration shape; `--manifest` merges any provider's embed manifest.
+- `atlas config plan`: field-level drift diff with `--exit-code` and `--json`. New `atlas-plan` GitHub Action.
+- `atlas env --format k8s`, and `atlas env` without `--product` reads the live instance.
+- `atlas migrate code --from openid-client|jose|generic-oidc`.
+- `ATLAS_API_BASE` is accepted everywhere `ATLAS_API_URL` is (BASE wins when both are set); `atlas env` prints both.
+- `atlas referrals conformance`: runs `@atlasauth/referral-conformance` against any referral platform (`--protocol webhook` for the generic Atlas referral protocol, `connection` for the Referalli dialect; defaults to the connected one), with `--secret-file`, `--only` and `--simulate`. Exits 1 on a failed case.
+- `atlas referrals connect --oauth [--preset <id>]`: one-click connect. Prints the platform's link, waits for the connection to appear, pings it. No key or secret is copied.
+
+### Changed
+
+- Referalli is `--provider referalli`; `--provider referally`, `--referally-key`, `--referally-key-file`, `REFERALLY_BASE_URL` and `REFERALLY_API_KEY` still work and print a notice.
+
+- `atlas status`: Atlas's components and regions, the open Atlas incidents that concern the instance, its status subscription, and the state of every upstream status page it declared. Exits 1 on an Atlas major outage or a major / critical incident that concerns the instance, or an upstream partial / major outage; `--json` for scripts.
+- `atlas doctor` (the integration-health report, exit 1 on a failing check) and `atlas csp` (the Content-Security-Policy sources for your pages, from the embed manifest).
+- `atlas init --backchannel <url>`: sets the first-party OAuth client's back-channel logout URI (on create, or on a re-run) and points at the ready-made receivers in `@atlasauth/backend`.
+
 ## 0.8.0 — 2026-10-24
 
 ### Added

package/dist/args.d.ts

@@ -31,6 +31,30 @@ declare const OPTIONS: {
     readonly 'secret-key': {
         readonly type: "string";
     };
+    readonly device: {
+        readonly type: "boolean";
+    };
+    readonly resource: {
+        readonly type: "string";
+    };
+    readonly scope: {
+        readonly type: "string";
+    };
+    readonly scopes: {
+        readonly type: "string";
+    };
+    readonly owner: {
+        readonly type: "string";
+    };
+    readonly 'expires-at': {
+        readonly type: "string";
+    };
+    readonly 'allowed-ips': {
+        readonly type: "string";
+    };
+    readonly out: {
+        readonly type: "string";
+    };
     readonly email: {
         readonly type: "string";
     };
@@ -104,6 +128,9 @@ declare const OPTIONS: {
     readonly 'webhook-url': {
         readonly type: "string";
     };
+    readonly backchannel: {
+        readonly type: "string";
+    };
     readonly yes: {
         readonly type: "boolean";
         readonly short: "y";
@@ -120,6 +147,18 @@ declare const OPTIONS: {
     readonly 'fail-on': {
         readonly type: "string";
     };
+    readonly only: {
+        readonly type: "string";
+    };
+    readonly 'no-probe': {
+        readonly type: "boolean";
+    };
+    readonly shape: {
+        readonly type: "string";
+    };
+    readonly origin: {
+        readonly type: "string";
+    };
     readonly now: {
         readonly type: "boolean";
     };
@@ -132,6 +171,55 @@ declare const OPTIONS: {
     readonly events: {
         readonly type: "string";
     };
+    readonly delivery: {
+        readonly type: "string";
+    };
+    readonly status: {
+        readonly type: "string";
+    };
+    readonly 'event-type': {
+        readonly type: "string";
+    };
+    readonly until: {
+        readonly type: "string";
+    };
+    readonly active: {
+        readonly type: "boolean";
+    };
+    readonly inactive: {
+        readonly type: "boolean";
+    };
+    readonly timeout: {
+        readonly type: "string";
+    };
+    readonly 'no-wait': {
+        readonly type: "boolean";
+    };
+    readonly to: {
+        readonly type: "string";
+    };
+    readonly 'forward-to': {
+        readonly type: "string";
+    };
+    readonly count: {
+        readonly type: "string";
+    };
+    readonly 'no-forward': {
+        readonly type: "boolean";
+    };
+    readonly framework: {
+        readonly type: "string";
+    };
+    readonly manifest: {
+        readonly type: "string";
+        readonly multiple: true;
+    };
+    readonly 'no-atlas': {
+        readonly type: "boolean";
+    };
+    readonly 'exit-code': {
+        readonly type: "boolean";
+    };
     readonly provider: {
         readonly type: "string";
     };
@@ -141,12 +229,33 @@ declare const OPTIONS: {
     readonly 'base-url': {
         readonly type: "string";
     };
+    readonly 'referalli-key': {
+        readonly type: "string";
+    };
+    readonly 'referalli-key-file': {
+        readonly type: "string";
+    };
     readonly 'referally-key': {
         readonly type: "string";
     };
     readonly 'referally-key-file': {
         readonly type: "string";
     };
+    readonly oauth: {
+        readonly type: "boolean";
+    };
+    readonly preset: {
+        readonly type: "string";
+    };
+    readonly 'connection-id': {
+        readonly type: "string";
+    };
+    readonly protocol: {
+        readonly type: "string";
+    };
+    readonly simulate: {
+        readonly type: "boolean";
+    };
     readonly 'auto-enroll': {
         readonly type: "boolean";
     };
@@ -229,6 +338,43 @@ declare const OPTIONS: {
         readonly type: "string";
         readonly multiple: true;
     };
+    readonly audience: {
+        readonly type: "string";
+    };
+    readonly 'events-url': {
+        readonly type: "string";
+    };
+    readonly 'backchannel-logout-url': {
+        readonly type: "string";
+    };
+    readonly 'oauth-client-id': {
+        readonly type: "string";
+    };
+    readonly trace: {
+        readonly type: "string";
+    };
+    readonly disable: {
+        readonly type: "boolean";
+    };
+    readonly 'platform-id': {
+        readonly type: "string";
+    };
+    readonly 'jwks-url': {
+        readonly type: "string";
+    };
+    readonly 'signature-header': {
+        readonly type: "string";
+    };
+    readonly 'allowed-source': {
+        readonly type: "string";
+        readonly multiple: true;
+    };
+    readonly 'token-file': {
+        readonly type: "string";
+    };
+    readonly rotate: {
+        readonly type: "boolean";
+    };
     readonly cursor: {
         readonly type: "boolean";
     };

package/dist/args.js

@@ -23,6 +23,16 @@ const OPTIONS = {
     // login (non-interactive overrides for the prompts).
     url: { type: 'string' },
     'secret-key': { type: 'string' },
+    // login --device / token: the operator device flow and token exchange.
+    device: { type: 'boolean' },
+    resource: { type: 'string' },
+    scope: { type: 'string' },
+    // keys create / rotate.
+    scopes: { type: 'string' },
+    owner: { type: 'string' },
+    'expires-at': { type: 'string' },
+    'allowed-ips': { type: 'string' },
+    out: { type: 'string' },
     // users create.
     email: { type: 'string' },
     'first-name': { type: 'string' },
@@ -55,23 +65,61 @@ const OPTIONS = {
     'email-key-file': { type: 'string' },
     'client-redirect': { type: 'string', multiple: true },
     'webhook-url': { type: 'string' },
+    backchannel: { type: 'string' },
     yes: { type: 'boolean', short: 'y' },
     force: { type: 'boolean' },
     'rotate-secret': { type: 'boolean' },
     instance: { type: 'string' },
     'fail-on': { type: 'string' },
+    // doctor / csp.
+    only: { type: 'string' },
+    'no-probe': { type: 'boolean' },
+    shape: { type: 'string' },
+    origin: { type: 'string' },
     now: { type: 'boolean' },
     overlap: { type: 'string' },
     // Any command that receives a secret: print it instead of writing a 0600 file.
     'print-secret': { type: 'boolean' },
-    // webhooks create.
+    // webhooks create / update / listen.
     events: { type: 'string' },
+    // webhooks deliveries / redeliver / test / update.
+    delivery: { type: 'string' },
+    status: { type: 'string' },
+    'event-type': { type: 'string' },
+    until: { type: 'string' },
+    active: { type: 'boolean' },
+    inactive: { type: 'boolean' },
+    timeout: { type: 'string' },
+    'no-wait': { type: 'boolean' },
+    // move-origin.
+    to: { type: 'string' },
+    // listen.
+    'forward-to': { type: 'string' },
+    count: { type: 'string' },
+    'no-forward': { type: 'boolean' },
+    // csp.
+    framework: { type: 'string' },
+    manifest: { type: 'string', multiple: true },
+    'no-atlas': { type: 'boolean' },
+    // config plan.
+    'exit-code': { type: 'boolean' },
     // referrals connect / backfill.
     provider: { type: 'string' },
     program: { type: 'string' },
     'base-url': { type: 'string' },
+    'referalli-key': { type: 'string' },
+    'referalli-key-file': { type: 'string' },
+    // The old spellings (Referalli was first published as "Referally"): still accepted, with a notice.
     'referally-key': { type: 'string' },
     'referally-key-file': { type: 'string' },
+    // referrals connect --oauth: one-click connect (no key to paste).
+    oauth: { type: 'boolean' },
+    preset: { type: 'string' },
+    // referrals conformance: the platform under test.
+    'connection-id': { type: 'string' },
+    // referrals conformance: webhook (generic protocol) or connection (Referalli dialect).
+    protocol: { type: 'string' },
+    simulate: { type: 'boolean' },
     'auto-enroll': { type: 'boolean' },
     destination: { type: 'string' },
     'tracking-token': { type: 'string' },
@@ -101,6 +149,20 @@ const OPTIONS = {
     'bridge-days': { type: 'string' },
     resume: { type: 'boolean' },
     skip: { type: 'string', multiple: true },
+    // integrations set / deliveries.
+    audience: { type: 'string' },
+    'events-url': { type: 'string' },
+    'backchannel-logout-url': { type: 'string' },
+    'oauth-client-id': { type: 'string' },
+    trace: { type: 'string' },
+    disable: { type: 'boolean' },
+    // partner-platforms.
+    'platform-id': { type: 'string' },
+    'jwks-url': { type: 'string' },
+    'signature-header': { type: 'string' },
+    'allowed-source': { type: 'string', multiple: true },
+    'token-file': { type: 'string' },
+    rotate: { type: 'boolean' },
     // mcp install.
     cursor: { type: 'boolean' },
     'claude-code': { type: 'boolean' },

package/dist/args.js.map

@@ -1 +1 @@
-{"version":3,"file":"args.js","sourceRoot":"","sources":["../src/args.ts"],"names":[],"mappings":";;AA0HA,sBAeC;AAGD,kBAGC;AAGD,oBAOC;AAGD,sBAQC;AApKD,yCAAsC;AACtC,qCAAoC;AAEpC;;;;;GAKG;AACH,MAAM,OAAO,GAAG;IACd,UAAU;IACV,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACzB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACpC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;IACrC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;IACxC,qDAAqD;IACrD,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACvB,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,gBAAgB;IAChB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC/B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,YAAY;IACZ,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAClC,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,0BAA0B;IAC1B,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACvB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC9B,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1B,WAAW;IACX,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,0EAA0E;IAC1E,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAClC,0EAA0E;IAC1E,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1B,0CAA0C;IAC1C,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC/B,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAClC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC9B,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,qFAAqF;IACrF,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACpC,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACpC,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;IACrD,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;IACpC,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1B,eAAe,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACpC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC7B,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACxB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,+EAA+E;IAC/E,cAAc,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACnC,mBAAmB;IACnB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,gCAAgC;IAChC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC9B,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,oBAAoB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxC,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAClC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC/B,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACpC,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC9B,qBAAqB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1C,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACvB,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACzB,0BAA0B;IAC1B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAClC,kFAAkF;IAClF,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,mBAAmB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACxC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACjC,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC3B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;IACxC,eAAe;IACf,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC3B,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAClC,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC3B,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;CACnB,CAAC;AAiBX,6FAA6F;AAC7F,SAAgB,KAAK,CAAC,IAAc;IAClC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,IAAA,qBAAS,EAAC;YACxC,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,OAAO;YAChB,gBAAgB,EAAE,IAAI;YACtB,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,MAAgB,EAAE,WAAW,EAAE,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0EAA0E;QAC1E,8DAA8D;QAC9D,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,iBAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,2CAA2C;AAC3C,SAAgB,GAAG,CAAC,MAAc,EAAE,GAAiB;IACnD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED,mFAAmF;AACnF,SAAgB,IAAI,CAAC,MAAc,EAAE,GAAiB;IACpD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,OAAO,GAAG;SACP,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;SAC5B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,yFAAyF;AACzF,SAAgB,KAAK,CAAC,MAAc;IAClC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,iBAAQ,CAAC,4CAA4C,GAAG,IAAI,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"args.js","sourceRoot":"","sources":["../src/args.ts"],"names":[],"mappings":";;AAwLA,sBAeC;AAGD,kBAGC;AAGD,oBAOC;AAGD,sBAQC;AAlOD,yCAAsC;AACtC,qCAAoC;AAEpC;;;;;GAKG;AACH,MAAM,OAAO,GAAG;IACd,UAAU;IACV,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACzB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACpC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;IACrC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;IACxC,qDAAqD;IACrD,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACvB,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,uEAAuE;IACvE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,wBAAwB;IACxB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACvB,gBAAgB;IAChB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC/B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,YAAY;IACZ,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAClC,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,0BAA0B;IAC1B,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACvB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC9B,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1B,WAAW;IACX,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,0EAA0E;IAC1E,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAClC,0EAA0E;IAC1E,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1B,0CAA0C;IAC1C,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC/B,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAClC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC9B,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,qFAAqF;IACrF,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACpC,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACpC,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;IACrD,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC/B,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;IACpC,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1B,eAAe,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACpC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC7B,gBAAgB;IAChB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC/B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACxB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,+EAA+E;IAC/E,cAAc,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACnC,qCAAqC;IACrC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,mDAAmD;IACnD,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC9B,eAAe;IACf,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACtB,UAAU;IACV,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACjC,OAAO;IACP,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC7B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC5C,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC/B,eAAe;IACf,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAChC,gCAAgC;IAChC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC9B,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,oBAAoB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxC,mGAAmG;IACnG,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,oBAAoB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxC,kEAAkE;IAClE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,kDAAkD;IAClD,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,uFAAuF;IACvF,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC7B,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAClC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC/B,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACpC,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC9B,qBAAqB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1C,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACvB,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACzB,0BAA0B;IAC1B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAClC,kFAAkF;IAClF,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,mBAAmB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACxC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACjC,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC3B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;IACxC,iCAAiC;IACjC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,wBAAwB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5C,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACrC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC5B,qBAAqB;IACrB,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC9B,kBAAkB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACtC,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;IACpD,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC3B,eAAe;IACf,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC3B,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAClC,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC3B,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;CACnB,CAAC;AAiBX,6FAA6F;AAC7F,SAAgB,KAAK,CAAC,IAAc;IAClC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,IAAA,qBAAS,EAAC;YACxC,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,OAAO;YAChB,gBAAgB,EAAE,IAAI;YACtB,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,MAAgB,EAAE,WAAW,EAAE,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0EAA0E;QAC1E,8DAA8D;QAC9D,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,iBAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,2CAA2C;AAC3C,SAAgB,GAAG,CAAC,MAAc,EAAE,GAAiB;IACnD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED,mFAAmF;AACnF,SAAgB,IAAI,CAAC,MAAc,EAAE,GAAiB;IACpD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,OAAO,GAAG;SACP,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;SAC5B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,yFAAyF;AACzF,SAAgB,KAAK,CAAC,MAAc;IAClC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,iBAAQ,CAAC,4CAA4C,GAAG,IAAI,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/commands/auth.js

@@ -9,6 +9,7 @@ const errors_1 = require("../errors");
 const output_1 = require("../output");
 const project_1 = require("../project");
 const shared_1 = require("./shared");
+const operator_1 = require("./operator");
 /**
  * `atlas login` — prompt for an API URL + a secret key, PROVE the key works
  * with one cheap Backend call, then store it under a named profile (0600).
@@ -21,6 +22,9 @@ const shared_1 = require("./shared");
  */
 async function login(ctx, args) {
     const { values } = args;
+    // `--device`: operator sign-in through Atlas's own sign-in page (no key stored).
+    if (values.device === true)
+        return (0, operator_1.deviceLogin)(ctx, args);
     const profile = (0, args_1.str)(values, 'profile') || 'default';
     const apiUrl = (0, args_1.str)(values, 'url') ||
         (await ctx.prompt.text('Atlas API URL', { default: backend_1.DEFAULT_API_URL })) ||
@@ -31,7 +35,7 @@ async function login(ctx, args) {
     // Prove the credential before persisting it. A platform key (psk_, for
     // `atlas init`) is proven against the platform API instead.
     try {
-        if (secretKey.startsWith('psk_'))
+        if (secretKey.startsWith('psk_') || /^atlas_(live|test)_psk_/.test(secretKey))
             await (0, project_1.httpFor)(ctx, { secretKey, apiUrl }).get('/v1/platform/apps');
         else
             await ctx.makeClient({ secretKey, apiUrl }).users.list({ limit: 1 });

package/dist/commands/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":";;AAkBA,sBAoCC;AAOD,wBAkBC;AAOD,wBAkBC;AAxGD,gDAAoE;AACpE,kCAA+C;AAE/C,sCAAqC;AACrC,sCAAsC;AACtC,wCAAqC;AACrC,qCAA8D;AAE9D;;;;;;;;;GASG;AACI,KAAK,UAAU,KAAK,CAAC,GAAe,EAAE,IAAgB;IAC3D,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,MAAM,OAAO,GAAG,IAAA,UAAG,EAAC,MAAM,EAAE,SAAS,CAAC,IAAI,SAAS,CAAC;IAEpD,MAAM,MAAM,GACV,IAAA,UAAG,EAAC,MAAM,EAAE,KAAK,CAAC;QAClB,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,OAAO,EAAE,yBAAe,EAAE,CAAC,CAAC;QACtE,yBAAe,CAAC;IAClB,MAAM,SAAS,GAAG,IAAA,UAAG,EAAC,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAEtG,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,iBAAQ,CAAC,qCAAqC,CAAC,CAAC;IAE1E,uEAAuE;IACvE,4DAA4D;IAC5D,IAAI,CAAC;QACH,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,MAAM,IAAA,iBAAO,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;;YAChG,MAAM,GAAG,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,uBAAa,EAAE,CAAC;YACjC,MAAM,IAAI,iBAAQ,CAChB,0BAA0B,MAAM,UAAU,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,uBAAuB,CAC9G,CAAC;QACJ,CAAC;QACD,4DAA4D;QAC5D,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,iBAAQ,CAAC,mBAAmB,MAAM,KAAK,MAAM,sBAAsB,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IACpE,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC;IAC9B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEtB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,gBAAgB,MAAM,gBAAgB,OAAO,IAAI,CAAC,CAAC;IAC9D,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,wBAAwB,GAAG,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,CAAC;IACnE,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,MAAM,CAAC,GAAe,EAAE,IAAgB;IAC5D,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAG,IAAA,UAAG,EAAC,MAAM,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,cAAc,IAAI,SAAS,CAAC;IAE3E,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,qCAAqC,OAAO,IAAI,CAAC,CAAC;QAC7D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,cAAc,KAAK,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEtB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,0BAA0B,OAAO,IAAI,CAAC,CAAC;IAClD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,MAAM,CAAC,GAAe,EAAE,IAAgB;IAC5D,MAAM,IAAI,GAAG,IAAA,oBAAW,EAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAE3C,IAAI,IAAA,kBAAS,EAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE;YAChB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,IAAI,CAAC,MAAM;YACpB,UAAU,EAAE,IAAA,mBAAU,EAAC,IAAI,CAAC,SAAS,CAAC;YACtC,UAAU,EAAE,IAAI,CAAC,SAAS;YAC1B,UAAU,EAAE,IAAI,CAAC,SAAS;SAC3B,CAAC,CAAC;QACH,OAAO,CAAC,CAAC;IACX,CAAC;IAED,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1C,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;IAC7D,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,eAAe,IAAA,mBAAU,EAAC,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;IAC5E,OAAO,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":";;AAmBA,sBAsCC;AAOD,wBAkBC;AAOD,wBAkBC;AA3GD,gDAAoE;AACpE,kCAA+C;AAE/C,sCAAqC;AACrC,sCAAsC;AACtC,wCAAqC;AACrC,qCAA8D;AAC9D,yCAAyC;AAEzC;;;;;;;;;GASG;AACI,KAAK,UAAU,KAAK,CAAC,GAAe,EAAE,IAAgB;IAC3D,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,iFAAiF;IACjF,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,IAAA,sBAAW,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,IAAA,UAAG,EAAC,MAAM,EAAE,SAAS,CAAC,IAAI,SAAS,CAAC;IAEpD,MAAM,MAAM,GACV,IAAA,UAAG,EAAC,MAAM,EAAE,KAAK,CAAC;QAClB,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,OAAO,EAAE,yBAAe,EAAE,CAAC,CAAC;QACtE,yBAAe,CAAC;IAClB,MAAM,SAAS,GAAG,IAAA,UAAG,EAAC,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAEtG,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,iBAAQ,CAAC,qCAAqC,CAAC,CAAC;IAE1E,uEAAuE;IACvE,4DAA4D;IAC5D,IAAI,CAAC;QACH,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,MAAM,IAAA,iBAAO,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;;YAC7I,MAAM,GAAG,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,uBAAa,EAAE,CAAC;YACjC,MAAM,IAAI,iBAAQ,CAChB,0BAA0B,MAAM,UAAU,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,uBAAuB,CAC9G,CAAC;QACJ,CAAC;QACD,4DAA4D;QAC5D,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,iBAAQ,CAAC,mBAAmB,MAAM,KAAK,MAAM,sBAAsB,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IACpE,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC;IAC9B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEtB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,gBAAgB,MAAM,gBAAgB,OAAO,IAAI,CAAC,CAAC;IAC9D,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,wBAAwB,GAAG,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,CAAC;IACnE,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,MAAM,CAAC,GAAe,EAAE,IAAgB;IAC5D,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAG,IAAA,UAAG,EAAC,MAAM,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,cAAc,IAAI,SAAS,CAAC;IAE3E,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,qCAAqC,OAAO,IAAI,CAAC,CAAC;QAC7D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,cAAc,KAAK,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEtB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,0BAA0B,OAAO,IAAI,CAAC,CAAC;IAClD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,MAAM,CAAC,GAAe,EAAE,IAAgB;IAC5D,MAAM,IAAI,GAAG,IAAA,oBAAW,EAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAE3C,IAAI,IAAA,kBAAS,EAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE;YAChB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,IAAI,CAAC,MAAM;YACpB,UAAU,EAAE,IAAA,mBAAU,EAAC,IAAI,CAAC,SAAS,CAAC;YACtC,UAAU,EAAE,IAAI,CAAC,SAAS;YAC1B,UAAU,EAAE,IAAI,CAAC,SAAS;SAC3B,CAAC,CAAC;QACH,OAAO,CAAC,CAAC;IACX,CAAC;IAED,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1C,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;IAC7D,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,eAAe,IAAA,mBAAU,EAAC,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;IAC5E,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/commands/config.d.ts

@@ -2,6 +2,8 @@ import { type ParsedArgs, type Values } from '../args';
 import { type ConfigHttp } from '../config-http';
 import type { RunContext } from '../context';
 import { type Format, type Json } from '../serialize';
+/** A config document ready for disk / comparison: a plain, redacted JSON value. */
+type Config = Json;
 /** `atlas config export|import` — Auth0 `deploy-cli`-style config-as-code. */
 export declare function config(ctx: RunContext, args: ParsedArgs): Promise<number>;
 export declare function resolveFormat(values: Values): Format;
@@ -9,6 +11,10 @@ export interface Change {
     type: string;
     action: 'create' | 'update' | 'delete';
     key: string;
+    /** The live document (absent on a create). Carried for `atlas config plan`'s field diff. */
+    before?: Config;
+    /** The desired document (absent on a delete). */
+    after?: Config;
 }
 /** A planned change and the call that applies it. */
 export interface PlannedChange extends Change {
@@ -31,6 +37,14 @@ export declare function planConfigImport(http: ConfigHttp, opts: {
     env: NodeJS.ProcessEnv;
     prune: boolean;
 }): Promise<ConfigPlan>;
+/** One differing field between the live and the desired document. */
+export interface FieldDiff {
+    path: string;
+    before?: Json;
+    after?: Json;
+}
+/** Leaf-level differences between two documents, as dotted paths (arrays compare whole). */
+export declare function diffFields(before: Json | undefined, after: Json | undefined, path?: string): FieldDiff[];
 export declare function printPlan(ctx: RunContext, changes: Change[], unchanged: number, skippedDeletes: Change[], opts: {
     dryRun: boolean;
     prune: boolean;
@@ -42,3 +56,4 @@ export declare function printPlan(ctx: RunContext, changes: Change[], unchanged:
  * than silently blanking a credential.
  */
 export declare function interpolate(value: Json, env: NodeJS.ProcessEnv): Json;
+export {};

package/dist/commands/config.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.config = config;
 exports.resolveFormat = resolveFormat;
 exports.planConfigImport = planConfigImport;
+exports.diffFields = diffFields;
 exports.printPlan = printPlan;
 exports.interpolate = interpolate;
 const node_fs_1 = require("node:fs");
@@ -617,10 +618,12 @@ async function config(ctx, args) {
             return exportConfig(ctx, args.values);
         case 'import':
             return importConfig(ctx, args.values);
+        case 'plan':
+            return planConfig(ctx, args.values);
         default:
             throw new errors_1.CliError(sub
-                ? `Unknown subcommand 'config ${sub}'. Try: export, import.`
-                : 'config needs a subcommand: export, import.');
+                ? `Unknown subcommand 'config ${sub}'. Try: export, import, plan.`
+                : 'config needs a subcommand: export, import, plan.');
     }
 }
 function resolveFormat(values) {
@@ -698,7 +701,7 @@ async function planConfigImport(http, opts) {
                 unchanged += 1;
                 continue;
             }
-            changes.push({ type: spec.type, action: live === null ? 'create' : 'update', key: '', apply: () => spec.apply(http, desired) });
+            changes.push({ type: spec.type, action: live === null ? 'create' : 'update', key: '', ...(live === null ? {} : { before: live }), after: desired, apply: () => spec.apply(http, desired) });
             continue;
         }
         // Collection: diff desired-by-key against live-by-key.
@@ -711,14 +714,14 @@ async function planConfigImport(http, opts) {
         for (const [key, cfg] of desiredByKey) {
             const existing = liveByKey.get(key);
             if (!existing) {
-                changes.push({ type: spec.type, action: 'create', key, apply: () => spec.create(http, cfg) });
+                changes.push({ type: spec.type, action: 'create', key, after: cfg, apply: () => spec.create(http, cfg) });
             }
             else if (!(0, serialize_1.deepEqual)(cfg, existing.config)) {
                 if (!spec.update) {
                     throw new errors_1.CliError(`${spec.type} '${key}' changed but is immutable; recreate it instead.`);
                 }
                 const upd = spec.update;
-                changes.push({ type: spec.type, action: 'update', key, apply: () => upd(http, existing, cfg) });
+                changes.push({ type: spec.type, action: 'update', key, before: existing.config, after: cfg, apply: () => upd(http, existing, cfg) });
             }
             else {
                 unchanged += 1;
@@ -727,7 +730,7 @@ async function planConfigImport(http, opts) {
         for (const entry of live) {
             if (desiredByKey.has(entry.key))
                 continue;
-            const change = { type: spec.type, action: 'delete', key: entry.key };
+            const change = { type: spec.type, action: 'delete', key: entry.key, before: entry.config };
             if (!spec.remove) {
                 skippedDeletes.push(change);
                 continue;
@@ -761,6 +764,73 @@ async function importConfig(ctx, values) {
         ctx.io.out('No changes to apply.');
     return 0;
 }
+/** Leaf-level differences between two documents, as dotted paths (arrays compare whole). */
+function diffFields(before, after, path = '') {
+    const isObj = (x) => x !== null && typeof x === 'object' && !Array.isArray(x);
+    if (isObj(before) && isObj(after)) {
+        const keys = [...new Set([...Object.keys(before), ...Object.keys(after)])].sort();
+        return keys.flatMap((k) => diffFields(before[k], after[k], path ? `${path}.${k}` : k));
+    }
+    if (before !== undefined && after !== undefined && (0, serialize_1.deepEqual)(before, after))
+        return [];
+    if (before === undefined && after === undefined)
+        return [];
+    return [{ path: path || '(document)', ...(before === undefined ? {} : { before }), ...(after === undefined ? {} : { after }) }];
+}
+const show = (v) => (v === undefined ? '(unset)' : typeof v === 'string' ? JSON.stringify(v) : JSON.stringify(v));
+/**
+ * `atlas config plan`: a Terraform-style, read-only diff of a config directory
+ * (`atlas config export` output, committed to git) against the live instance.
+ * Field-level for updates, `--json` for tooling, and `--exit-code` to exit 2
+ * when there is drift so CI can gate on it. Never writes anything.
+ */
+async function planConfig(ctx, values) {
+    const http = requireHttp(ctx, values);
+    const dir = resolveDir(values);
+    const format = resolveFormat(values);
+    const prune = values.prune === true;
+    const plan = await planConfigImport(http, { dir, format, env: ctx.env, prune });
+    const deletes = prune ? [] : plan.skippedDeletes;
+    const all = plan.changes;
+    const rows = all.map((c) => ({
+        type: c.type,
+        key: c.key || null,
+        action: c.action,
+        fields: c.action === 'update' ? diffFields(c.before, c.after) : [],
+    }));
+    const pending = rows.length;
+    if (values.json === true) {
+        ctx.io.out(JSON.stringify({
+            object: 'config_plan',
+            changes: rows,
+            unchanged: plan.unchanged,
+            unmanaged_live: deletes.map((d) => ({ type: d.type, key: d.key || null })),
+            has_changes: pending > 0,
+        }, null, 2));
+    }
+    else {
+        ctx.io.out(`Plan: ${pending} to change, ${plan.unchanged} unchanged${deletes.length ? `, ${deletes.length} live but not in config` : ''}.`);
+        const sign = { create: '+', update: '~', delete: '-' };
+        for (const c of [...all].sort(sortChange)) {
+            const label = c.key ? `${c.type} ${c.key}` : c.type;
+            ctx.io.out('');
+            ctx.io.out(`${sign[c.action]} ${label} (${c.action})`);
+            if (c.action === 'update') {
+                for (const f of diffFields(c.before, c.after))
+                    ctx.io.out(`    ${f.path}: ${show(f.before)} -> ${show(f.after)}`);
+            }
+        }
+        if (deletes.length) {
+            ctx.io.out('');
+            ctx.io.out(`Live but not in ${dir} (kept; pass --prune to plan their deletion):`);
+            for (const d of deletes)
+                ctx.io.out(`    ${d.type}${d.key ? ` ${d.key}` : ''}`);
+        }
+        if (pending === 0)
+            ctx.io.out('No drift: the instance matches the config directory.');
+    }
+    return values['exit-code'] === true && pending > 0 ? 2 : 0;
+}
 function printPlan(ctx, changes, unchanged, skippedDeletes, opts) {
     const heading = opts.dryRun ? 'Plan (dry run — nothing applied):' : 'Plan:';
     ctx.io.out(heading);