@atlasauth/cli 0.8.0 → 0.9.0

package/dist/help.js

@@ -12,21 +12,33 @@ Usage: atlas <command> [subcommand] [arguments] [options]
 
 Commands:
   login                      Authenticate and store a profile credential
+                             (--device: operator sign-in in the browser, no key stored)
+  token --resource <id>      A one-hour token for one instance/app from your operator sign-in
+  keys whoami|list|create|rotate|revoke|revoke-leaked
+                             Scoped secret keys; new secrets go sealed into 0600 files
   logout                     Remove a stored profile credential
   whoami                     Show the active profile and instance
   users list|get|create|delete
   orgs list|get|members
   api-keys list|create|revoke
-  webhooks list|create
+  webhooks list|create|upsert|update|test|deliveries|redeliver|replay|rotate|reveal
+  listen --forward-to <url>  Forward live events to your local server, signed (no tunnel)
+  move-origin --from --to    Move an app to a new domain in one step (--dry-run first)
+  csp --framework next|express|nginx
+                             Print the Content Security Policy sources Atlas needs
+  integrations list|get|set|remove|deliveries   Identity integrations (chat, docs, consent, referrals, custom)
   sessions revoke
-  config export|import       Config-as-code: round-trip the instance's config
+  config export|import|plan  Config-as-code: round-trip the instance's config; plan = drift diff
   actions list|deploy|test|logs|gallery|show|install|installs|update|publish
   init                       Create or complete an app's setup (idempotent); secrets to 0600 files
   preflight                  Check an instance's setup; non-zero exit on errors (for CI)
+  doctor                     Integration health: webhooks, logout, referrals, email, consent (exit 1 on a failure)
   env                        Print deploy variables: public values + secret file paths
   client rotate              Rotate an OAuth client secret straight into its file
   referrals connect|backfill|status
                              Connect a referral platform, backfill, check the connection
+  status                     Atlas status, incidents that concern the instance and its
+                             upstream status pages; non-zero exit on an outage
   import --from <vendor> <file>
                              Move users from Auth0, Clerk, Supabase, Firebase, Cognito,
                              Auth.js, WorkOS or Better Auth (resumable; --dry-run first)
@@ -53,10 +65,12 @@ Global options:
 
 Environment overrides:
   ATLAS_SECRET_KEY           Secret key to use instead of the stored one
-  ATLAS_API_URL              API URL to use instead of the stored one
+  ATLAS_API_BASE             API URL to use instead of the stored one
+  ATLAS_API_URL              Same (the older name); ATLAS_API_BASE wins when both are set
   ATLAS_PLATFORM_KEY         Platform key (psk_) for atlas init
-  REFERALLY_BASE_URL         Referalli base URL for atlas referrals connect
-  REFERALLY_API_KEY          Referalli merchant key for atlas referrals connect (never stored)
+  REFERALLI_BASE_URL         Referalli base URL for atlas referrals connect
+  REFERALLI_API_KEY          Referalli merchant key for atlas referrals connect (never stored)
+                             (the old REFERALLY_BASE_URL / REFERALLY_API_KEY still work, with a notice)
 
 Secrets: a command that receives a secret writes it to a 0600 file under
 ~/.config/<product>/ and prints only the path. --print-secret prints it instead.
@@ -104,6 +118,10 @@ Vendors:
                Supabase client itself stays for your database
   auth0        @auth0/auth0-react, @auth0/nextjs-auth0 (v3 and v4), @auth0/auth0-spa-js
   better-auth  better-auth (client, server, Next.js handler, cookies)
+  openid-client  openid-client (Issuer.discover, authorizationUrl, callback, endSessionUrl)
+  jose         jose used to verify OIDC ID tokens (jwtVerify + createRemoteJWKSet)
+  generic-oidc a hand-rolled relying party (discovery, PKCE, code exchange, JWKS) found
+               by its code; replaced by oidc.start / oidc.callback / oidc.logoutUrl
 
 What it rewrites: imports, providers, hooks, server session helpers, middleware,
 sign-in/out calls and env var names, onto native Atlas APIs and the drop-in
@@ -181,20 +199,47 @@ agent can search and read the Atlas docs. Servers already in the file are kept.
 
 No key is written. To also manage your instance from the agent, add
 ATLAS_SECRET_KEY to the server's env yourself.`,
+    status: `atlas status — is it Atlas, a service you depend on, or you?
+
+Usage:
+  atlas status [--json]
+
+Shows Atlas's components (with their regions), the open Atlas incidents that
+concern this instance (its status subscription's regions, components and
+minimum impact), the subscription itself, and the state of every upstream
+status page the instance declared (POST /v1/instance/status_dependencies).
+
+Exit code 1 when Atlas reports a major outage or an open major / critical
+incident concerns the instance, or an enabled upstream status page reports a
+partial or major outage; 0 otherwise.`,
     referrals: `atlas referrals — referral attribution
 
 Usage:
-  atlas referrals connect --provider referally --program <prg_…> --base-url <url>
-        [--referally-key-file <path|-> | --referally-key <rk_…>]
+  atlas referrals connect --provider referalli --program <prg_…> --base-url <url>
+        [--referalli-key-file <path|-> | --referalli-key <rk_…>]
         [--auto-enroll] [--destination <url>] [--tracking-token <token>] [--enable]
         [--no-sync] [--allow-mode-mismatch]
+  atlas referrals connect --oauth [--preset <id>] [--enable]   (default preset: referalli)
   atlas referrals connect --provider webhook --endpoint <https-url>
         [--secret-file <path|->] [--program <id>] [--auto-enroll] [--enable]
   atlas referrals backfill --since <YYYY-MM-DD> [--map <file.csv>]
         [--metadata-path public_metadata.referral_code] [--wait]
   atlas referrals status
+  atlas referrals conformance [--protocol webhook|connection] [--base-url <url>] [--connection-id <id>] --secret-file <path|->
+        [--only <case ids or areas>] [--simulate]
+
+connect --provider referalli --oauth is one-click: it prints a Referalli link, you choose the
+organization and program there, and Referalli hands Atlas the connection secret directly (nothing to
+copy). It needs no key, --program or --base-url, and waits until the connection appears. Where the
+deployment does not offer it yet, use a key as below.
 
-connect --provider referally creates the Atlas connection on Referalli with
+conformance runs the referral protocol conformance suite (@atlasauth/referral-conformance) against
+any platform (--protocol webhook: the generic Atlas referral protocol; connection: the Referalli dialect): signed calls with the answers a conforming server must give (401 for a bad signature,
+an empty export for an unknown customer, nulls accepted, …). It defaults to the connected Referalli;
+the secret is read from --secret-file because Atlas never shows it. --simulate also sends Atlas's own
+simulated sign-up. It exits 1 on any failed case.
+
+connect --provider referalli creates the Atlas connection on Referalli with
 your merchant key (bring your own key: used for this one call, never stored or
 printed), saves the connection id and secret on the instance, and runs a ping.
 It requires v2 signatures on the connection from the start and registers a
@@ -202,9 +247,10 @@ Referalli webhook that sends referral changes (voided, approved, reassigned…)
 back to Atlas; --no-sync skips the webhook. A test key (rk_test_) belongs with a
 development instance and a live key with production: a mismatch is refused
 unless --allow-mode-mismatch. --auto-enroll and --destination are passed to
-Referalli. --enable turns referrals on when the ping passes. Prefer --referally-key-file (or
-REFERALLY_API_KEY) to --referally-key: a key on the command line can end up in
-your shell history.
+Referalli. --enable turns referrals on when the ping passes. Prefer --referalli-key-file (or
+REFERALLI_API_KEY) to --referalli-key: a key on the command line can end up in
+your shell history. The old names (--provider referally, --referally-key-file,
+--referally-key, REFERALLY_*) still work and print a notice.
 
 connect --provider webhook points the instance at a platform that speaks the
 Atlas referral protocol. Without --secret-file, a signing secret is generated
@@ -223,7 +269,34 @@ Usage: atlas login [--profile <name>] [--url <api-url>] [--secret-key <sk_...>]
 
 Prompts for an API URL and a secret key, validates the key with one Backend
 call, then stores it (0600) under the profile. --url / --secret-key skip the
-prompts for non-interactive setup.`,
+prompts for non-interactive setup.
+
+Operator sign-in (no key on disk):
+  atlas login --device [--resource <ins_…|app_…>] [--scope "<scopes>"]
+Opens Atlas's sign-in (passkey, multi-factor) with a device code. Only
+short-lived tokens are stored: the operator token, and with --resource a
+one-hour token bound to that instance or app (scope "read" by default).
+Creating apps or instances and minting keys need a multi-factor sign-in
+within the last 5 minutes.`,
+    token: `atlas token — a one-hour token bound to one instance or app
+
+Usage: atlas token --resource <ins_…|app_…|acct_…> [--scope "<scopes>"] [--json]
+
+Swaps your operator sign-in (atlas login --device) for an Atlas token (RFC 8693
+token exchange). "read" = every read scope.`,
+    keys: `atlas keys — the instance's secret keys
+
+Usage:
+  atlas keys whoami                         What the current key is and can do
+  atlas keys list                           Every credential on the instance
+  atlas keys create --scopes "<scopes>" [--name n] [--owner o] [--expires-at <ISO>] [--allowed-ips <cidr,…>] [--out <file>]
+  atlas keys rotate <id> [--overlap <seconds>] [--out <file>]
+  atlas keys revoke <id>
+  atlas keys revoke-leaked [<secret>]       Revoke a leaked Atlas credential (no login needed)
+
+New secrets come back sealed to a key pair made on this machine and are
+written to a 0600 file (default .atlas/secret-key-<id>.env); --print-secret
+prints them instead.`,
     logout: `atlas logout — remove a stored profile credential
 
 Usage: atlas logout [--profile <name>]`,
@@ -255,8 +328,76 @@ Usage:
 Usage:
   atlas webhooks list [--json]
   atlas webhooks create --url <https-url> [--events a,b] [--product <name>] [--print-secret] [--json]
+  atlas webhooks upsert --url <https-url> [--events a,b]       one endpoint per URL; idempotent
+  atlas webhooks update <id> [--url <u>] [--events a,b] [--active | --inactive]
+  atlas webhooks test <id> [--timeout 10s] [--no-wait] [--json]
+  atlas webhooks deliveries <id> [--status failed] [--event-type user.created]
+        [--since <iso|2h|7d>] [--until <iso>] [--limit <n>] [--starting-after <id>] [--json]
+  atlas webhooks redeliver <id> --delivery <delivery-id>
+  atlas webhooks redeliver <id> --since <iso|2h|7d> [--until <iso>] [--status failed]
+  atlas webhooks replay <id> [--since failing_since]           re-send what a disabled endpoint missed
+  atlas webhooks rotate <id> [--now | --overlap <seconds>]
+  atlas webhooks reveal <id>
+
+create, upsert, rotate and reveal write the signing secret to a 0600 file and
+print only its path (--print-secret prints it instead; --force replaces a file).
+test sends a signed webhook.test event and waits for your endpoint's answer;
+the exit code is 1 when it did not answer 2xx. rotate --overlap keeps the old
+secret signing alongside the new one for that many seconds.`,
+    listen: `atlas listen — forward live events to your local server
+
+Usage:
+  atlas listen --forward-to <url> [--events user.*,session.created] [--count <n>] [--timeout <dur>] [--json]
+  atlas listen --no-forward [--events ...]            only print events
+
+Opens a signed event stream from your instance and POSTs each event to
+--forward-to with the same atlas-id, atlas-timestamp and atlas-signature headers a
+real delivery carries, then prints the status your server returned. No tunnel
+and no second endpoint. The signing secret belongs to this session only and is
+written to a 0600 file (webhook-listen.env): point your verifier at it. --events
+takes names or patterns (user.*, *.created). The session lasts up to an hour;
+Ctrl-C stops it. --count n exits after n events (exit 1 if any forward failed).`,
+    'move-origin': `atlas move-origin — move an app to a new domain
+
+Usage: atlas move-origin --from <origin> --to <origin> [--dry-run] [--yes] [--json]
+
+Rewrites every field that points at the old origin: allowed origins, branding
+links, OAuth client redirect and logout URIs, webhook URLs, the redirect-URL
+allowlist and your Sign in with Atlas apps. Shows the before and after of every
+field first and asks before writing (--yes skips the question). After a real
+move it sends a signed test delivery to each webhook endpoint that moved.
+--dry-run prints the diff and writes nothing; running it twice changes nothing.`,
+    csp: `atlas csp — the Content Security Policy sources Atlas needs
+
+Usage: atlas csp [--framework next|express|nginx] [--shape redirect|panel|button]
+                 [--instance <id> | --product <name> [--instance-env <env>]] [--origin <url>]
+                 [--manifest <url|file>]... [--no-atlas] [--json]
+
+Reads your instance's embed manifest (including a custom Frontend API host) and
+prints the script-src, connect-src, img-src and frame-src sources for your
+setup, as a next.config.ts headers() block, a helmet() config or an nginx
+add_header line. Read-only. --shape redirect (hosted sign-in) needs none.
+With --origin, warns when that origin is not one of the instance's allowed origins.
+
+Any provider that publishes the open embed-manifest format ({surfaces:{name:{csp:{directive:[sources]}}}},
+usually at /.well-known/atlas-embed.json) can be merged in with --manifest <url|file>
+(repeatable): a consent platform, chat widget, captcha or analytics vendor. --no-atlas
+skips the Atlas instance and uses only the manifests you list.`,
+    integrations: `atlas integrations — identity integrations (presets and custom)
 
-create writes the signing secret to a 0600 file and prints only its path.`,
+Usage:
+  atlas integrations list [--json]
+  atlas integrations get <id>
+  atlas integrations set <id> --audience <aud> [--name <n>] [--events-url <url|none>]
+                         [--backchannel-logout-url <url|none>] [--oauth-client-id <client_id|none>]
+                         [--disable] [--dry-run] [--json]
+  atlas integrations remove <id> [--json]
+  atlas integrations deliveries <id> [--trace <id>] [--json]
+
+<id> is a preset (chatly, forumulate, cookiemunch, referalli) or your own id.
+--oauth-client-id names the first-party OAuth client the service signs users in
+with: while no --backchannel-logout-url is set, its backchannel_logout_uri is the
+integration's back-channel receiver.`,
     init: `atlas init — create or complete an app's setup, idempotently
 
 Usage:
@@ -266,13 +407,16 @@ Usage:
              [--email managed|development|none] [--email-from <address>]
              [--email-provider resend|brevo --email-key-file <path|->]
              [--client-redirect <url>]... [--webhook-url <url>]
+             [--backchannel <url>]
              [--yes] [--force] [--rotate-secret] [--json]
 
 Needs a platform key (ATLAS_PLATFORM_KEY, or a psk_ profile from atlas login).
 Finds the app by name and environment, or creates it, then sets strategies, the
 email sender, the custom domain (auth.<domain> unless --auth-host; prints the
 CNAME), a first-party OAuth client and a webhook. Re-running only fills what is
-missing.
+missing. --backchannel <url> sets the client's back-channel logout URI (your
+route that ends the app session when Atlas ends one; @atlasauth/backend has
+ready-made handlers).
 
 Email always goes through YOUR provider account (Atlas lends none):
   managed      Atlas sets your domain up on your Resend or Brevo account and
@@ -293,14 +437,26 @@ Usage: atlas preflight [--instance <id> | --product <name> [--instance-env <env>
 
 Prints every finding (severity, code, message, fix). Exits 1 when there is an
 error, or with --fail-on warning also on a warning.`,
+    doctor: `atlas doctor — integration health (a CI / deploy gate)
+
+Usage: atlas doctor [--instance <id> | --product <name> [--instance-env <env>]]
+                    [--only <source,...>] [--no-probe] [--json]
+
+Prints every check: setup findings, webhook receivers (with the failing hop:
+dns, tls, http, challenge or auth), back-channel logout, the referral
+platform, email, the consent manager and SDK versions. Exits 1 when a check
+fails. --no-probe uses recorded deliveries only (no live calls).`,
     env: `atlas env — print deploy variables without secrets
 
-Usage: atlas env --product <name> [--instance-env <env>] [--format dotenv|coolify|vercel] [--json]
+Usage: atlas env [--product <name> [--instance-env <env>]] [--format dotenv|coolify|vercel|k8s] [--json]
 
 Public values (publishable key, Frontend API, issuer, discovery and JWKS URLs,
 OAuth client id) are printed as-is. Secrets are printed as references to their
 0600 files: *_FILE=<path> (dotenv), KEY=@<path> (coolify), or a vercel env add
-command that pipes the value from the file (vercel).`,
+command that pipes the value from the file (vercel). k8s prints a ConfigMap plus
+kubectl create secret commands that read each file. Without --product it reads
+the public values from the instance your key belongs to (no secret references).
+Both ATLAS_API_BASE and ATLAS_API_URL are printed.`,
     client: `atlas client — OAuth clients
 
 Usage: atlas client rotate <client-id> [--now | --overlap <seconds>]
@@ -319,6 +475,7 @@ Usage:
 Usage:
   atlas config export [--dir <path>] [--format json|yaml]
   atlas config import [--dir <path>] [--format json|yaml] [--dry-run] [--prune]
+  atlas config plan   [--dir <path>] [--format json|yaml] [--prune] [--exit-code] [--json]
 
 export  Read the instance's current config (instance/auth config, OAuth clients
         and providers, SSO connections, resource servers, JWT templates, roles,
@@ -333,6 +490,10 @@ import  Diff the directory against live config and apply creates/updates
           --dir       config directory (default: ./atlas-config)
           --format    json (default) or yaml
 
+plan    A Terraform-style, read-only diff of the directory against the live
+        instance: field-by-field before -> after for updates. --exit-code exits 2
+        when there is drift (for CI); --json for tooling.
+
 Secrets never live on disk. Inject a credential at import with a \${ENV_VAR}
 placeholder in a file (e.g. a provider "client_secret": "\${GOOGLE_SECRET}").`,
     actions: `atlas actions — manage Actions (tenant code run in the auth pipeline)

package/dist/help.js.map

@@ -1 +1 @@
-{"version":3,"file":"help.js","sourceRoot":"","sources":["../src/help.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEU,QAAA,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wDAuDgC,CAAC;AAEzD,oDAAoD;AACvC,QAAA,YAAY,GAA2B;IAClD,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8CAqDmC;IAC5C,IAAI,EAAE;;;;;;;;;;gEAUwD;IAC9D,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2EAmCiE;IACzE,GAAG,EAAE;;;;;;;;;;;;;;;+CAewC;IAC7C,SAAS,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yEAmC4D;IAEvE,KAAK,EAAE;;;;;;mCAM0B;IAEjC,MAAM,EAAE;;uCAE6B;IAErC,MAAM,EAAE;;gDAEsC;IAE9C,KAAK,EAAE;;;;;;wCAM+B;IAEtC,IAAI,EAAE;;;;;uCAK+B;IAErC,UAAU,EAAE;;;;;;8CAMgC;IAE5C,QAAQ,EAAE;;;;;;0EAM8D;IAExE,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;yEA4BiE;IAEvE,SAAS,EAAE;;;;;;oDAMuC;IAElD,GAAG,EAAE;;;;;;;qDAO8C;IAEnD,MAAM,EAAE;;;;;;;;wDAQ8C;IAEtD,QAAQ,EAAE;;;8CAGkC;IAE5C,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;8EAoBoE;IAC5E,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;qEA0B0D;CACpE,CAAC"}
+{"version":3,"file":"help.js","sourceRoot":"","sources":["../src/help.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEU,QAAA,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wDAqEgC,CAAC;AAEzD,oDAAoD;AACvC,QAAA,YAAY,GAA2B;IAClD,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8CAyDmC;IAC5C,IAAI,EAAE;;;;;;;;;;gEAUwD;IAC9D,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2EAmCiE;IACzE,GAAG,EAAE;;;;;;;;;;;;;;;+CAewC;IAC7C,MAAM,EAAE;;;;;;;;;;;;sCAY4B;IACpC,SAAS,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yEAkD4D;IAEvE,KAAK,EAAE;;;;;;;;;;;;;;2BAckB;IAEzB,KAAK,EAAE;;;;;4CAKmC;IAE1C,IAAI,EAAE;;;;;;;;;;;;qBAYa;IAEnB,MAAM,EAAE;;uCAE6B;IAErC,MAAM,EAAE;;gDAEsC;IAE9C,KAAK,EAAE;;;;;;wCAM+B;IAEtC,IAAI,EAAE;;;;;uCAK+B;IAErC,UAAU,EAAE;;;;;;8CAMgC;IAE5C,QAAQ,EAAE;;;;;;;;;;;;;;;;;;;;4DAoBgD;IAC1D,MAAM,EAAE;;;;;;;;;;;;gFAYsE;IAC9E,aAAa,EAAE;;;;;;;;;gFAS+D;IAC9E,GAAG,EAAE;;;;;;;;;;;;;;;+DAewD;IAE7D,YAAY,EAAE;;;;;;;;;;;;;;qCAcqB;IAEnC,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yEA+BiE;IAEvE,SAAS,EAAE;;;;;;oDAMuC;IAElD,MAAM,EAAE;;;;;;;;iEAQuD;IAE/D,GAAG,EAAE;;;;;;;;;;mDAU4C;IAEjD,MAAM,EAAE;;;;;;;;wDAQ8C;IAEtD,QAAQ,EAAE;;;8CAGkC;IAE5C,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;8EAyBoE;IAC5E,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;qEA0B0D;CACpE,CAAC"}

package/dist/run.js

@@ -6,18 +6,24 @@ const args_1 = require("./args");
 const actions_1 = require("./commands/actions");
 const api_keys_1 = require("./commands/api-keys");
 const auth_1 = require("./commands/auth");
+const operator_1 = require("./commands/operator");
 const config_1 = require("./commands/config");
 const init_1 = require("./commands/init");
 const import_1 = require("./commands/import");
 const info_1 = require("./commands/info");
+const csp_1 = require("./commands/csp");
+const listen_1 = require("./commands/listen");
 const migrate_1 = require("./commands/migrate");
+const move_origin_1 = require("./commands/move-origin");
 const mcp_1 = require("./commands/mcp");
 const project_commands_1 = require("./commands/project-commands");
 const orgs_1 = require("./commands/orgs");
 const referrals_1 = require("./commands/referrals");
 const sessions_1 = require("./commands/sessions");
+const status_1 = require("./commands/status");
 const users_1 = require("./commands/users");
 const webhooks_1 = require("./commands/webhooks");
+const integrations_1 = require("./commands/integrations");
 const errors_1 = require("./errors");
 const help_1 = require("./help");
 const version_1 = require("./version");
@@ -26,22 +32,30 @@ const COMMANDS = {
     login: auth_1.login,
     logout: auth_1.logout,
     whoami: auth_1.whoami,
+    token: operator_1.token,
+    keys: operator_1.keys,
     users: users_1.users,
     orgs: orgs_1.orgs,
     'api-keys': api_keys_1.apiKeys,
     webhooks: webhooks_1.webhooks,
+    integrations: integrations_1.integrations,
     sessions: sessions_1.sessions,
     config: config_1.config,
     actions: actions_1.actions,
     init: init_1.init,
     preflight: project_commands_1.preflight,
+    doctor: project_commands_1.doctor,
     env: project_commands_1.envCommand,
     client: project_commands_1.client,
     referrals: referrals_1.referrals,
+    status: status_1.status,
     import: import_1.importUsers,
     migrate: migrate_1.migrate,
     info: info_1.info,
     mcp: mcp_1.mcp,
+    listen: listen_1.listen,
+    'move-origin': move_origin_1.moveOrigin,
+    csp: csp_1.csp,
 };
 /**
  * The CLI's whole control flow, as a pure function of (argv, context) → exit

package/dist/run.js.map

@@ -1 +1 @@
-{"version":3,"file":"run.js","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":";;AAuDA,kBAwCC;AA/FD,gDAAmD;AACnD,iCAAgD;AAChD,gDAA6C;AAC7C,kDAA8C;AAC9C,0CAAwD;AACxD,8CAA2C;AAC3C,0CAAuC;AACvC,8CAAgD;AAChD,0CAAuC;AACvC,gDAA6C;AAC7C,wCAAqC;AACrC,kEAA4E;AAC5E,0CAAuC;AACvC,oDAAiD;AACjD,kDAA+C;AAC/C,4CAAyC;AACzC,kDAA+C;AAE/C,qCAAoC;AACpC,iCAAgD;AAChD,uCAAuC;AAKvC,kFAAkF;AAClF,MAAM,QAAQ,GAA4B;IACxC,KAAK,EAAL,YAAK;IACL,MAAM,EAAN,aAAM;IACN,MAAM,EAAN,aAAM;IACN,KAAK,EAAL,aAAK;IACL,IAAI,EAAJ,WAAI;IACJ,UAAU,EAAE,kBAAO;IACnB,QAAQ,EAAR,mBAAQ;IACR,QAAQ,EAAR,mBAAQ;IACR,MAAM,EAAN,eAAM;IACN,OAAO,EAAP,iBAAO;IACP,IAAI,EAAJ,WAAI;IACJ,SAAS,EAAT,4BAAS;IACT,GAAG,EAAE,6BAAU;IACf,MAAM,EAAN,yBAAM;IACN,SAAS,EAAT,qBAAS;IACT,MAAM,EAAE,oBAAW;IACnB,OAAO,EAAP,iBAAO;IACP,IAAI,EAAJ,WAAI;IACJ,GAAG,EAAH,SAAG;CACJ,CAAC;AAEF;;;;;;GAMG;AACI,KAAK,UAAU,GAAG,CAAC,IAAc,EAAE,GAAe;IACvD,IAAI,IAAgB,CAAC;IACrB,IAAI,CAAC;QACH,IAAI,GAAG,IAAA,YAAK,EAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,kDAAkD;IAClD,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACxB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAA,oBAAU,GAAE,CAAC,CAAC;QACzB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAEpC,qEAAqE;IACrE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,eAAQ,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,oBAAoB,OAAO,IAAI,CAAC,CAAC;QAC5C,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC5D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,sEAAsE;IACtE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACrB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,mBAAY,CAAC,OAAO,CAAC,IAAI,eAAQ,CAAC,CAAC;QAC9C,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,MAAM,CAAC,GAAe,EAAE,GAAY;IAC3C,IAAI,GAAG,YAAY,uBAAa,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,0BAA0B,GAAG,CAAC,MAAM,IAAI,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3E,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,GAAG,YAAY,iBAAQ,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACpC,OAAO,GAAG,CAAC,QAAQ,CAAC;IACtB,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC;IAChC,OAAO,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":";;AAqEA,kBAwCC;AA7GD,gDAAmD;AACnD,iCAAgD;AAChD,gDAA6C;AAC7C,kDAA8C;AAC9C,0CAAwD;AACxD,kDAAkD;AAClD,8CAA2C;AAC3C,0CAAuC;AACvC,8CAAgD;AAChD,0CAAuC;AACvC,wCAAqC;AACrC,8CAA2C;AAC3C,gDAA6C;AAC7C,wDAAoD;AACpD,wCAAqC;AACrC,kEAAoF;AACpF,0CAAuC;AACvC,oDAAiD;AACjD,kDAA+C;AAC/C,8CAA2C;AAC3C,4CAAyC;AACzC,kDAA+C;AAC/C,0DAAuD;AAEvD,qCAAoC;AACpC,iCAAgD;AAChD,uCAAuC;AAKvC,kFAAkF;AAClF,MAAM,QAAQ,GAA4B;IACxC,KAAK,EAAL,YAAK;IACL,MAAM,EAAN,aAAM;IACN,MAAM,EAAN,aAAM;IACN,KAAK,EAAL,gBAAK;IACL,IAAI,EAAJ,eAAI;IACJ,KAAK,EAAL,aAAK;IACL,IAAI,EAAJ,WAAI;IACJ,UAAU,EAAE,kBAAO;IACnB,QAAQ,EAAR,mBAAQ;IACR,YAAY,EAAZ,2BAAY;IACZ,QAAQ,EAAR,mBAAQ;IACR,MAAM,EAAN,eAAM;IACN,OAAO,EAAP,iBAAO;IACP,IAAI,EAAJ,WAAI;IACJ,SAAS,EAAT,4BAAS;IACT,MAAM,EAAN,yBAAM;IACN,GAAG,EAAE,6BAAU;IACf,MAAM,EAAN,yBAAM;IACN,SAAS,EAAT,qBAAS;IACT,MAAM,EAAN,eAAM;IACN,MAAM,EAAE,oBAAW;IACnB,OAAO,EAAP,iBAAO;IACP,IAAI,EAAJ,WAAI;IACJ,GAAG,EAAH,SAAG;IACH,MAAM,EAAN,eAAM;IACN,aAAa,EAAE,wBAAU;IACzB,GAAG,EAAH,SAAG;CACJ,CAAC;AAEF;;;;;;GAMG;AACI,KAAK,UAAU,GAAG,CAAC,IAAc,EAAE,GAAe;IACvD,IAAI,IAAgB,CAAC;IACrB,IAAI,CAAC;QACH,IAAI,GAAG,IAAA,YAAK,EAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,kDAAkD;IAClD,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACxB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAA,oBAAU,GAAE,CAAC,CAAC;QACzB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAEpC,qEAAqE;IACrE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,eAAQ,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,oBAAoB,OAAO,IAAI,CAAC,CAAC;QAC5C,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC5D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,sEAAsE;IACtE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACrB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,mBAAY,CAAC,OAAO,CAAC,IAAI,eAAQ,CAAC,CAAC;QAC9C,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,MAAM,CAAC,GAAe,EAAE,GAAY;IAC3C,IAAI,GAAG,YAAY,uBAAa,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,0BAA0B,GAAG,CAAC,MAAM,IAAI,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3E,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,GAAG,YAAY,iBAAQ,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACpC,OAAO,GAAG,CAAC,QAAQ,CAAC;IACtB,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC;IAChC,OAAO,CAAC,CAAC;AACX,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlasauth/cli",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "atlas — manage an Atlas instance from the terminal via the Backend API.",
   "bin": {
     "atlas": "dist/cli.js"
@@ -16,8 +16,9 @@
   },
   "dependencies": {
     "@atlasauth/actions": "0.3.0",
-    "@atlasauth/backend": "0.17.0",
-    "@atlasauth/upgrade": "0.3.0"
+    "@atlasauth/backend": "0.19.0",
+    "@atlasauth/upgrade": "0.4.0",
+    "@atlasauth/referral-conformance": "0.1.0"
   },
   "devDependencies": {
     "@types/node": "^22.9.0",