@atlasauth/cli 0.12.0 → 0.13.0

package/dist/migrate/user-table/plugin.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.userTablePlugin = void 0;
+const node_path_1 = require("node:path");
+const args_1 = require("../../args");
+const errors_1 = require("../../errors");
+const plugin_kit_1 = require("../export/plugin-kit");
+const table_1 = require("../export/table");
+/**
+ * `atlas migrate user-table export --file users.csv` — a user table from any
+ * system as CSV / TSV / JSON / NDJSON, with the hash-algorithm picker for
+ * stores whose password column is not self-describing. The vendor-neutral
+ * catch-all: every flag below is optional.
+ */
+const SPEC = (flag, env, label) => ({ flag, env, label, required: false });
+const HASH_ALGORITHM = SPEC('hash-algorithm', 'ATLAS_HASH_ALGORITHM', 'the password hash algorithm: auto (default), plaintext, or any id such as bcrypt, md5, sha256_salted, pbkdf2, scrypt');
+const SALT_POSITION = SPEC('salt-position', 'ATLAS_SALT_POSITION', 'salted digests: prefix or suffix (default suffix)');
+const HASH_ENCODING = SPEC('hash-encoding', 'ATLAS_HASH_ENCODING', 'how the hash column is encoded: hex, base64 or base64url');
+const HASH_PARAMS = SPEC('hash-params', 'ATLAS_HASH_PARAMS', 'algorithm parameters, e.g. iterations=10000,digest=sha256');
+const COLUMNS = SPEC('map', 'ATLAS_COLUMN_MAP', 'column names when yours differ: email=Mail,id=uid,password=pwd,salt=pwd_salt');
+const TRUST = SPEC('trust-emails', 'ATLAS_TRUST_EMAILS', 'mark every address verified (true or false)');
+function file(p) {
+    return (0, args_1.str)(p.args.values, 'file') ?? p.credential({ flag: 'file', env: 'ATLAS_MIGRATE_FILE', label: 'the users file (--file)', required: true });
+}
+exports.userTablePlugin = {
+    vendor: 'user-table',
+    source: 'custom',
+    label: 'Your own user table (CSV / JSON)',
+    help: 'Import users from a CSV, TSV, JSON array or NDJSON file — a SELECT * of your users table. Columns are recognised by their usual names (id, email, email_verified, username, first_name, last_name, phone, password_hash, salt, created_at, roles, disabled …) or named with --set map=email=Mail,id=uid. Name the password algorithm with --set hash-algorithm=<id> when the column is not self-describing (add salt-position, hash-encoding and hash-params as needed), or plaintext to hash it on this machine. The file is read locally.',
+    export: {
+        reads: 'a local CSV / TSV / JSON / NDJSON file (--file)',
+        credentials: [HASH_ALGORITHM, SALT_POSITION, HASH_ENCODING, HASH_PARAMS, COLUMNS, TRUST],
+        limits: ['Social links, second factors, organizations and sessions are not in a flat table: import those with atlas migrate custom (canonical records) after this.'],
+        async run(p, writer, resume) {
+            const path = (0, node_path_1.resolve)(file(p));
+            let rows;
+            try {
+                rows = (0, table_1.parseTable)(p.ctx.readFile(path));
+            }
+            catch (err) {
+                throw new errors_1.CliError(`${path}: ${err.message}`);
+            }
+            if (!rows.length)
+                throw new errors_1.CliError(`No rows found in ${path}.`);
+            const position = p.credential(SALT_POSITION);
+            if (position && position !== 'prefix' && position !== 'suffix')
+                throw new errors_1.CliError('--set salt-position must be prefix or suffix.');
+            const set = (0, table_1.mapTable)(rows, {
+                map: (0, table_1.parseKeyValues)(p.credential(COLUMNS)),
+                hashAlgorithm: p.credential(HASH_ALGORITHM),
+                saltPosition: position,
+                hashEncoding: p.credential(HASH_ENCODING),
+                hashParams: (0, table_1.typedParams)(p.credential(HASH_PARAMS)),
+                trustEmails: p.credential(TRUST) === 'true',
+                origin: `user table ${path}`,
+            });
+            p.say(`  read ${rows.length} row(s) from ${path}`);
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/user-table/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/user-table/plugin.ts"],"names":[],"mappings":";;;AAAA,yCAAoC;AACpC,qCAAiC;AACjC,yCAAwC;AACxC,qDAAsD;AACtD,2CAAoF;AAGpF;;;;;GAKG;AAEH,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,GAAW,EAAE,KAAa,EAAkB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;AACnH,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB,EAAE,sBAAsB,EAAE,sHAAsH,CAAC,CAAC;AAC9L,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,EAAE,qBAAqB,EAAE,mDAAmD,CAAC,CAAC;AACxH,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,EAAE,qBAAqB,EAAE,0DAA0D,CAAC,CAAC;AAC/H,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,EAAE,mBAAmB,EAAE,2DAA2D,CAAC,CAAC;AAC1H,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,kBAAkB,EAAE,8EAA8E,CAAC,CAAC;AAChI,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,EAAE,oBAAoB,EAAE,6CAA6C,CAAC,CAAC;AAExG,SAAS,IAAI,CAAC,CAAgB;IAC5B,OAAO,IAAA,UAAG,EAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,yBAAyB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAE,CAAC;AACpJ,CAAC;AAEY,QAAA,eAAe,GAAoB;IAC9C,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,kCAAkC;IACzC,IAAI,EAAE,6gBAA6gB;IACnhB,MAAM,EAAE;QACN,KAAK,EAAE,iDAAiD;QACxD,WAAW,EAAE,CAAC,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC;QACxF,MAAM,EAAE,CAAC,0JAA0J,CAAC;QACpK,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,IAAI,GAAG,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,IAAI,CAAC;YACT,IAAI,CAAC;gBACH,IAAI,GAAG,IAAA,kBAAU,EAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,iBAAQ,CAAC,GAAG,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3D,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,iBAAQ,CAAC,oBAAoB,IAAI,GAAG,CAAC,CAAC;YAClE,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;YAC7C,IAAI,QAAQ,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,QAAQ;gBAAE,MAAM,IAAI,iBAAQ,CAAC,+CAA+C,CAAC,CAAC;YACpI,MAAM,GAAG,GAAG,IAAA,gBAAQ,EAAC,IAAI,EAAE;gBACzB,GAAG,EAAE,IAAA,sBAAc,EAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBAC1C,aAAa,EAAE,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC;gBAC3C,YAAY,EAAE,QAA2C;gBACzD,YAAY,EAAE,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC;gBACzC,UAAU,EAAE,IAAA,mBAAW,EAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;gBAClD,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,MAAM;gBAC3C,MAAM,EAAE,cAAc,IAAI,EAAE;aAC7B,CAAC,CAAC;YACH,CAAC,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,MAAM,gBAAgB,IAAI,EAAE,CAAC,CAAC;YACnD,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;CACF,CAAC"}

package/dist/migrate/userfront/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const userfrontPlugin: MigrationPlugin;

package/dist/migrate/userfront/plugin.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.userfrontPlugin = void 0;
+const userfront_1 = require("../export/userfront");
+const userfront_config_1 = require("../export/userfront-config");
+const plugin_kit_1 = require("../export/plugin-kit");
+/**
+ * `atlas migrate userfront` — users, sub-tenants (as organizations) and roles
+ * through Userfront's admin API (tenant id + admin key, on this machine), and
+ * lazy migration through Userfront's password sign-in for every password:
+ * Userfront never returns hashes. There is no bridge preset: Userfront tokens
+ * carry no issuer claim, which the zero-logout bridge requires.
+ */
+const TENANT_ID = { flag: '--userfront-tenant-id', env: 'USERFRONT_TENANT_ID', label: 'your Userfront tenant id', required: true };
+const API_KEY = { flag: '--userfront-api-key', env: 'USERFRONT_API_KEY', label: 'a Userfront admin API key (uf_live_admin_…)', required: true, secret: true };
+/** The tenant id from the flag or env, else the one the app already uses. */
+function tenantId(p) {
+    const env = p.ctx.env;
+    const raw = p.credential({ ...TENANT_ID, required: false }) ??
+        (env.NEXT_PUBLIC_USERFRONT_TENANT_ID ?? env.REACT_APP_USERFRONT_TENANT_ID ?? env.VITE_USERFRONT_TENANT_ID)?.trim() ??
+        (0, plugin_kit_1.need)(p, TENANT_ID);
+    return (0, userfront_1.checkTenantId)(raw);
+}
+exports.userfrontPlugin = {
+    vendor: 'userfront',
+    source: 'userfront',
+    label: 'Userfront',
+    help: 'Move a Userfront tenant: users with their verified emails and phones, usernames and custom data, sub-tenants as organizations with member roles, roles as Atlas roles, lazy migration through Userfront\'s own sign-in for every password (Userfront never returns hashes), and the code. Your admin key stays on this machine.',
+    config: {
+        reads: 'your Userfront tenant via the admin API (roles)',
+        credentials: [TENANT_ID, API_KEY],
+        async translate(p) {
+            const tid = tenantId(p);
+            const http = (0, userfront_1.userfrontHttp)({ apiKey: (0, plugin_kit_1.need)(p, API_KEY), fetchImpl: p.fetch });
+            return (0, userfront_config_1.translateUserfrontConfig)(await (0, plugin_kit_1.vendorStep)('Userfront', () => (0, userfront_config_1.fetchUserfrontConfig)(http, tid)));
+        },
+    },
+    export: {
+        reads: 'the Userfront admin API (users, sub-tenants, roles)',
+        credentials: [TENANT_ID, API_KEY],
+        limits: [
+            'Userfront never returns password hashes: passwords move by lazy migration (the userfront preset checks each one against Userfront on the first Atlas sign-in).',
+            'Second factors, passkeys and social-account ids cannot be exported: members enrol again, register passkeys again and relink social accounts by verified email.',
+            'Pending invitations cannot be listed (Userfront can only create them): invite members again from Atlas.',
+            'Sessions are not exported: Userfront tokens carry no issuer claim, so there is no zero-logout bridge; users sign in once after the switch.',
+        ],
+        async run(p, writer, resume) {
+            const set = await (0, plugin_kit_1.vendorStep)('Userfront', () => (0, userfront_1.exportUserfront)({ tenantId: tenantId(p), apiKey: (0, plugin_kit_1.need)(p, API_KEY), fetchImpl: p.fetch, onProgress: (m) => p.say(`  reading ${m}`) }));
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    lazy: {
+        preset: 'userfront',
+        config(p, t) {
+            return { ...t?.lazy?.config, tenant_id: t?.lazy?.config.tenant_id ?? tenantId(p) };
+        },
+    },
+    codemod: 'userfront',
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/userfront/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/userfront/plugin.ts"],"names":[],"mappings":";;;AAAA,mDAAoF;AACpF,iEAA4F;AAE5F,qDAAwE;AAExE;;;;;;GAMG;AAEH,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,0BAA0B,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACnJ,MAAM,OAAO,GAAmB,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,6CAA6C,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAE9K,6EAA6E;AAC7E,SAAS,QAAQ,CAAC,CAAgB;IAChC,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACtB,MAAM,GAAG,GACP,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC/C,CAAC,GAAG,CAAC,+BAA+B,IAAI,GAAG,CAAC,6BAA6B,IAAI,GAAG,CAAC,wBAAwB,CAAC,EAAE,IAAI,EAAE;QAClH,IAAA,iBAAI,EAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACrB,OAAO,IAAA,yBAAa,EAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAEY,QAAA,eAAe,GAAoB;IAC9C,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,WAAW;IACnB,KAAK,EAAE,WAAW;IAClB,IAAI,EAAE,iUAAiU;IACvU,MAAM,EAAE;QACN,KAAK,EAAE,iDAAiD;QACxD,WAAW,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;QACjC,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YACxB,MAAM,IAAI,GAAG,IAAA,yBAAa,EAAC,EAAE,MAAM,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YAC7E,OAAO,IAAA,2CAAwB,EAAC,MAAM,IAAA,uBAAU,EAAC,WAAW,EAAE,GAAG,EAAE,CAAC,IAAA,uCAAoB,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QACxG,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,qDAAqD;QAC5D,WAAW,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;QACjC,MAAM,EAAE;YACN,gKAAgK;YAChK,gKAAgK;YAChK,yGAAyG;YACzG,4IAA4I;SAC7I;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,WAAW,EAAE,GAAG,EAAE,CAC7C,IAAA,2BAAe,EAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC,CACrI,CAAC;YACF,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,WAAW;QACnB,MAAM,CAAC,CAAC,EAAE,CAAC;YACT,OAAO,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,CAAC;KACF;IACD,OAAO,EAAE,WAAW;CACrB,CAAC"}

package/dist/migrate/workos/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const workosPlugin: MigrationPlugin;

package/dist/migrate/workos/plugin.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.workosPlugin = void 0;
+const workos_1 = require("../export/workos");
+const workos_config_1 = require("../export/workos-config");
+const plugin_kit_1 = require("../export/plugin-kit");
+const vendor_http_1 = require("../export/vendor-http");
+/**
+ * `atlas migrate workos` — a WorkOS environment (AuthKit, SSO, Directory
+ * Sync) through the WorkOS API with the environment's API key (on this
+ * machine): roles and permissions as Atlas config; users with verified
+ * emails, OAuth identities, organizations, memberships and role slugs,
+ * invitations and SSO connections as data; the `workos` bridge preset (access
+ * tokens verified against the client's JWKS, with a local unsealer for the
+ * `wos-session` cookie) and lazy migration through WorkOS's password
+ * authentication for every password.
+ */
+const API_KEY = { flag: '--workos-api-key', env: 'WORKOS_API_KEY', label: 'a WorkOS API key (sk_…)', required: true, secret: true };
+const CLIENT_ID = { flag: '--workos-client-id', env: 'WORKOS_CLIENT_ID', label: 'your WorkOS client id (client_…)', required: true };
+const HASHES_FILE = { flag: '--workos-hashes-file', env: 'WORKOS_HASHES_FILE', label: 'a password-hash export from WorkOS support', required: false };
+const BASE_URL = { flag: '--workos-base-url', env: 'WORKOS_BASE_URL', label: 'the WorkOS API base URL', required: false };
+const COUNT_FACTORS = { flag: '--workos-factors', env: 'WORKOS_COUNT_FACTORS', label: 'set to 1 to count second factors (one extra request per user)', required: false };
+/** The client id from the flag/env, or the app's own public env var; undefined when neither is set. */
+function clientIdOpt(p) {
+    return (p.credential({ ...CLIENT_ID, required: false }) ??
+        (p.ctx.env.NEXT_PUBLIC_WORKOS_CLIENT_ID?.trim() || p.ctx.env.VITE_WORKOS_CLIENT_ID?.trim() || undefined));
+}
+function clientId(p) {
+    return clientIdOpt(p) ?? (0, plugin_kit_1.need)(p, CLIENT_ID);
+}
+function baseUrl(p) {
+    return p.credential(BASE_URL)?.replace(/\/+$/, '');
+}
+exports.workosPlugin = {
+    vendor: 'workos',
+    source: 'workos',
+    label: 'WorkOS',
+    help: 'Move a WorkOS environment: roles and permissions as Atlas config; users with verified emails and OAuth identities, organizations, memberships and role slugs, invitations and SSO connections; password hashes when WorkOS support provides them; a zero-logout bridge for AuthKit access tokens (including the sealed wos-session cookie); lazy migration through WorkOS password authentication; and the code. Your API key stays on this machine.',
+    config: {
+        reads: 'your WorkOS environment via the API (roles, permissions, redirect URIs, connections)',
+        credentials: [API_KEY, CLIENT_ID],
+        async translate(p) {
+            const http = new vendor_http_1.VendorHttp({ vendor: 'WorkOS', baseUrl: baseUrl(p) ?? 'https://api.workos.com', headers: { authorization: `Bearer ${(0, plugin_kit_1.need)(p, API_KEY)}` }, fetchImpl: p.fetch });
+            const snap = await (0, plugin_kit_1.vendorStep)('WorkOS', () => (0, workos_config_1.fetchWorkosConfig)(http, clientIdOpt(p)));
+            return (0, workos_config_1.translateWorkosConfig)(snap);
+        },
+    },
+    export: {
+        reads: 'the WorkOS API (organizations, roles, users, identities, memberships, invitations, connections) and, if you have one, the support hash export (--workos-hashes-file)',
+        credentials: [API_KEY, CLIENT_ID, HASHES_FILE, BASE_URL, COUNT_FACTORS],
+        limits: [
+            'WorkOS has no password-hash export: if WorkOS support provides one, pass it with --workos-hashes-file; otherwise passwords move by lazy migration (checked against WorkOS on each user\'s first sign-in).',
+            'TOTP secrets and passkeys are not exportable: users enrol their second factor and passkeys again.',
+            'SSO connections move without the identity provider\'s entity id, SSO URL or OIDC secret (the WorkOS API does not return them): each customer\'s IdP admin sets the connection up again against the new Atlas details.',
+            'API key secrets are shown once by WorkOS: reissue them as Atlas API keys. Sessions are not exported: AuthKit access tokens are JWTs, exchanged by the workos bridge preset.',
+        ],
+        async run(p, writer, resume) {
+            const set = await (0, plugin_kit_1.vendorStep)('WorkOS', () => (0, workos_1.exportWorkos)({
+                apiKey: (0, plugin_kit_1.need)(p, API_KEY),
+                clientId: clientIdOpt(p),
+                baseUrl: baseUrl(p),
+                hashesText: (0, plugin_kit_1.localFile)(p, HASHES_FILE, 'text'),
+                countFactors: Boolean(p.credential(COUNT_FACTORS)),
+                fetchImpl: p.fetch,
+                onProgress: (m) => p.say(`  reading ${m}`),
+            }));
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    bridge: {
+        preset: 'workos',
+        vars: (p, t) => ({ ...t?.bridge?.vars, client_id: t?.bridge?.vars.client_id ?? clientId(p) }),
+    },
+    lazy: {
+        preset: 'workos',
+        config: (p, t) => ({ ...t?.lazy?.config, client_id: t?.lazy?.config.client_id ?? clientId(p) }),
+        secret: API_KEY,
+    },
+    codemod: 'workos',
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/workos/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/workos/plugin.ts"],"names":[],"mappings":";;;AAAA,6CAAgD;AAChD,2DAAmF;AAEnF,qDAAmF;AACnF,uDAAmD;AAEnD;;;;;;;;;GASG;AAEH,MAAM,OAAO,GAAmB,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,yBAAyB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACpJ,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,kCAAkC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACrJ,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,4CAA4C,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACtK,MAAM,QAAQ,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,yBAAyB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC1I,MAAM,aAAa,GAAmB,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,+DAA+D,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAEzL,uGAAuG;AACvG,SAAS,WAAW,CAAC,CAAgB;IACnC,OAAO,CACL,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC/C,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,4BAA4B,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC,CACzG,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,CAAgB;IAChC,OAAO,WAAW,CAAC,CAAC,CAAC,IAAI,IAAA,iBAAI,EAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,OAAO,CAAC,CAAgB;IAC/B,OAAO,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACrD,CAAC;AAEY,QAAA,YAAY,GAAoB;IAC3C,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,QAAQ;IACf,IAAI,EAAE,sbAAsb;IAC5b,MAAM,EAAE;QACN,KAAK,EAAE,sFAAsF;QAC7F,WAAW,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC;QACjC,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,IAAI,GAAG,IAAI,wBAAU,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,wBAAwB,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAA,iBAAI,EAAC,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YACjL,MAAM,IAAI,GAAG,MAAM,IAAA,uBAAU,EAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAA,iCAAiB,EAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvF,OAAO,IAAA,qCAAqB,EAAC,IAAI,CAAC,CAAC;QACrC,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,sKAAsK;QAC7K,WAAW,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,CAAC;QACvE,MAAM,EAAE;YACN,2MAA2M;YAC3M,mGAAmG;YACnG,uNAAuN;YACvN,6KAA6K;SAC9K;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,QAAQ,EAAE,GAAG,EAAE,CAC1C,IAAA,qBAAY,EAAC;gBACX,MAAM,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,OAAO,CAAC;gBACxB,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;gBACxB,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;gBACnB,UAAU,EAAE,IAAA,sBAAS,EAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC;gBAC7C,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;gBAClD,SAAS,EAAE,CAAC,CAAC,KAAK;gBAClB,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;aAC3C,CAAC,CACH,CAAC;YACF,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,QAAQ;QAChB,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9F;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,MAAM,EAAE,OAAO;KAChB;IACD,OAAO,EAAE,QAAQ;CAClB,CAAC"}

package/dist/migrate/zitadel/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const zitadelPlugin: MigrationPlugin;

package/dist/migrate/zitadel/plugin.js

@@ -0,0 +1,114 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.zitadelPlugin = void 0;
+const node_path_1 = require("node:path");
+const errors_1 = require("../../errors");
+const zitadel_1 = require("../export/zitadel");
+const zitadel_config_1 = require("../export/zitadel-config");
+const plugin_kit_1 = require("../export/plugin-kit");
+/**
+ * `atlas migrate zitadel` — ZITADEL Cloud and self-hosted ZITADEL: policies,
+ * applications, project roles and identity providers as Atlas config; users
+ * with their password hashes, TOTP secrets, verified email and phone, social
+ * and enterprise links, project roles (as app roles) and organizations with
+ * their members, from ZITADEL's own export (a file, or the admin API with a
+ * service-user token); a zero-logout bridge for ZITADEL ID tokens and JWT
+ * access tokens; lazy migration through the session API; and the code. The
+ * token stays on this machine.
+ */
+const URL_SPEC = { flag: '--zitadel-url', env: 'ZITADEL_URL', label: 'your ZITADEL URL (https://<instance>.zitadel.cloud, or your own domain)', required: false };
+const TOKEN = { flag: '--zitadel-token', env: 'ZITADEL_TOKEN', label: 'a service user\'s personal access token (IAM_OWNER to export, IAM_LOGIN_CLIENT for lazy migration)', required: false, secret: true };
+const EXPORT_FILE = { flag: '--zitadel-export', env: 'ZITADEL_EXPORT_FILE', label: 'the JSON file `zitadel export` wrote (or a saved POST /admin/v1/export response)', required: false };
+const ORGS = { flag: '--zitadel-orgs', env: 'ZITADEL_ORGS', label: 'how organizations move: auto (when there is more than one), all or skip', required: false };
+function instanceUrl(p) {
+    const raw = p.credential(URL_SPEC);
+    return raw ? (0, zitadel_1.zitadelBase)(raw) : undefined;
+}
+function orgsMode(p) {
+    const raw = (p.credential(ORGS) ?? 'auto').trim().toLowerCase();
+    if (raw !== 'auto' && raw !== 'all' && raw !== 'skip')
+        throw new errors_1.CliError(`ZITADEL: --set zitadel-orgs takes auto, all or skip (got ${raw}).`);
+    return raw;
+}
+function readDocument(p, path) {
+    try {
+        return JSON.parse(p.ctx.readFile((0, node_path_1.resolve)(path)));
+    }
+    catch (err) {
+        throw new errors_1.CliError(`ZITADEL: could not read the export ${path}: ${err.message}`);
+    }
+}
+exports.zitadelPlugin = {
+    vendor: 'zitadel',
+    source: 'zitadel',
+    label: 'ZITADEL',
+    help: 'Move ZITADEL (Cloud or self-hosted): login, password and lockout policy, applications, project roles and identity providers as Atlas config; users with password hashes, TOTP secrets, verified email and phone, social and enterprise links, roles and organizations from ZITADEL\'s own export; a zero-logout bridge for ZITADEL ID tokens and JWT access tokens; lazy migration through the session API; and the code. Your service-user token stays on this machine.',
+    config: {
+        reads: 'a `zitadel export` file, or your instance through the admin API (policies, applications, roles, identity providers, actions)',
+        credentials: [EXPORT_FILE, URL_SPEC, TOKEN],
+        async translate(p) {
+            const file = p.credential(EXPORT_FILE);
+            const url = instanceUrl(p);
+            if (file)
+                return (0, zitadel_config_1.translateZitadelConfig)((0, zitadel_config_1.configSnapshotFromExport)(readDocument(p, file), file, url));
+            const token = p.credential(TOKEN);
+            if (!url || !token) {
+                throw new errors_1.CliError('ZITADEL: pass the export file (--set zitadel-export=<file>), or your instance URL and a service-user token (--set zitadel-url=… --set zitadel-token=…).');
+            }
+            return (0, zitadel_config_1.translateZitadelConfig)(await (0, plugin_kit_1.vendorStep)('ZITADEL', () => (0, zitadel_config_1.fetchZitadelConfig)({ instance: url, token, fetchImpl: p.fetch })));
+        },
+    },
+    export: {
+        reads: 'ZITADEL\'s export (a `zitadel export` file, or POST /admin/v1/export with a service-user token)',
+        credentials: [EXPORT_FILE, URL_SPEC, TOKEN, ORGS],
+        limits: [
+            'Passkeys and security keys live only in ZITADEL\'s event store and are not exported: users register a passkey again.',
+            'Password hashes and TOTP secrets need the export with passwords and secrets on (`zitadel export`, or an IAM_OWNER token on the admin API). With a narrower role the export lists users through the user API instead, and passwords move by lazy migration.',
+            'Machine users (service accounts) are not exported: recreate them as Atlas API keys or M2M clients.',
+            'Organizations become Atlas organizations when the instance has more than one (--set zitadel-orgs=all to always, skip to never); organization roles other than ORG_OWNER join as plain members.',
+            'Sessions are opaque to Atlas: the bridge accepts ZITADEL ID tokens and JWT access tokens instead.',
+        ],
+        async run(p, writer, resume) {
+            const file = p.credential(EXPORT_FILE);
+            const orgs = orgsMode(p);
+            let set;
+            if (file) {
+                const url = instanceUrl(p);
+                set = await (0, plugin_kit_1.vendorStep)('ZITADEL', async () => (0, zitadel_1.mapZitadel)({ ...(0, zitadel_1.readZitadelExport)(readDocument(p, file)), instance: url }, { orgs }));
+            }
+            else {
+                const url = instanceUrl(p);
+                if (!url)
+                    throw new errors_1.CliError('ZITADEL: pass the export file (--set zitadel-export=<file>), or your instance URL and a service-user token (--set zitadel-url=… --set zitadel-token=…).');
+                const token = (0, plugin_kit_1.need)(p, TOKEN);
+                set = await (0, plugin_kit_1.vendorStep)('ZITADEL', () => (0, zitadel_1.exportZitadelApi)({ instance: url, token, orgs, fetchImpl: p.fetch, onProgress: (m) => p.say(`  reading ${m}`) }));
+            }
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    bridge: {
+        preset: 'zitadel',
+        vars(p, t) {
+            const vars = { ...t?.bridge?.vars };
+            const url = instanceUrl(p);
+            if (url)
+                vars.issuer = url;
+            if (!vars.issuer)
+                throw new errors_1.CliError('ZITADEL: the bridge needs the issuer: pass your instance URL (--set zitadel-url=https://<instance>.zitadel.cloud).');
+            return vars;
+        },
+    },
+    lazy: {
+        preset: 'zitadel',
+        config(p, t) {
+            const config = { ...t?.lazy?.config };
+            const url = instanceUrl(p);
+            if (url)
+                config.base_url = url;
+            return config;
+        },
+        secret: TOKEN,
+    },
+    codemod: 'zitadel',
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/zitadel/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/zitadel/plugin.ts"],"names":[],"mappings":";;;AAAA,yCAAoC;AACpC,yCAAwC;AACxC,+CAAyH;AACzH,6DAAgH;AAChH,qDAAwE;AAIxE;;;;;;;;;GASG;AAEH,MAAM,QAAQ,GAAmB,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,yEAAyE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAClL,MAAM,KAAK,GAAmB,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,oGAAoG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC5N,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,kFAAkF,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACzM,MAAM,IAAI,GAAmB,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,yEAAyE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAEhL,SAAS,WAAW,CAAC,CAAgB;IACnC,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACnC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAA,qBAAW,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC;AAED,SAAS,QAAQ,CAAC,CAAgB;IAChC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChE,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,MAAM;QAAE,MAAM,IAAI,iBAAQ,CAAC,4DAA4D,GAAG,IAAI,CAAC,CAAC;IAC/I,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,CAAgB,EAAE,IAAY;IAClD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC,CAAY,CAAC;IAC9D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,iBAAQ,CAAC,sCAAsC,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9F,CAAC;AACH,CAAC;AAEY,QAAA,aAAa,GAAoB;IAC5C,MAAM,EAAE,SAAS;IACjB,MAAM,EAAE,SAAS;IACjB,KAAK,EAAE,SAAS;IAChB,IAAI,EAAE,0cAA0c;IAChd,MAAM,EAAE;QACN,KAAK,EAAE,8HAA8H;QACrI,WAAW,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC;QAC3C,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YACvC,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,IAAI;gBAAE,OAAO,IAAA,uCAAsB,EAAC,IAAA,yCAAwB,EAAC,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;YACpG,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAClC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,IAAI,iBAAQ,CAAC,yJAAyJ,CAAC,CAAC;YAChL,CAAC;YACD,OAAO,IAAA,uCAAsB,EAAC,MAAM,IAAA,uBAAU,EAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAA,mCAAkB,EAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QACrI,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,iGAAiG;QACxG,WAAW,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC;QACjD,MAAM,EAAE;YACN,sHAAsH;YACtH,4PAA4P;YAC5P,oGAAoG;YACpG,gMAAgM;YAChM,mGAAmG;SACpG;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,GAAc,CAAC;YACnB,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;gBAC3B,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,IAAA,oBAAU,EAAC,EAAE,GAAG,IAAA,2BAAiB,EAAC,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACtI,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;gBAC3B,IAAI,CAAC,GAAG;oBAAE,MAAM,IAAI,iBAAQ,CAAC,yJAAyJ,CAAC,CAAC;gBACxL,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBAC7B,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAA,0BAAgB,EAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5J,CAAC;YACD,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,SAAS;QACjB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,GAA2B,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC5D,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,GAAG;gBAAE,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC;YAC3B,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,iBAAQ,CAAC,oHAAoH,CAAC,CAAC;YAC3J,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,SAAS;QACjB,MAAM,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,MAAM,GAA2B,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9D,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,GAAG;gBAAE,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC;YAC/B,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,EAAE,KAAK;KACd;IACD,OAAO,EAAE,SAAS;CACnB,CAAC"}

package/dist/run.js

@@ -4,6 +4,7 @@ exports.run = run;
 const backend_1 = require("@atlasauth/backend");
 const args_1 = require("./args");
 const actions_1 = require("./commands/actions");
+const pages_1 = require("./commands/pages");
 const api_keys_1 = require("./commands/api-keys");
 const auth_1 = require("./commands/auth");
 const operator_1 = require("./commands/operator");
@@ -12,6 +13,7 @@ const init_1 = require("./commands/init");
 const import_1 = require("./commands/import");
 const info_1 = require("./commands/info");
 const csp_1 = require("./commands/csp");
+const dev_1 = require("./commands/dev");
 const listen_1 = require("./commands/listen");
 const migrate_1 = require("./commands/migrate");
 const move_origin_1 = require("./commands/move-origin");
@@ -48,6 +50,7 @@ const COMMANDS = {
     sessions: sessions_1.sessions,
     config: config_1.config,
     actions: actions_1.actions,
+    pages: pages_1.pages,
     init: init_1.init,
     preflight: project_commands_1.preflight,
     doctor: project_commands_1.doctor,
@@ -60,6 +63,7 @@ const COMMANDS = {
     info: info_1.info,
     mcp: mcp_1.mcp,
     listen: listen_1.listen,
+    dev: dev_1.dev,
     'move-origin': move_origin_1.moveOrigin,
     csp: csp_1.csp,
 };

package/dist/run.js.map

@@ -1 +1 @@
-{"version":3,"file":"run.js","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":";;AA2EA,kBAwCC;AAnHD,gDAAmD;AACnD,iCAAgD;AAChD,gDAA6C;AAC7C,kDAA8C;AAC9C,0CAAwD;AACxD,kDAAkD;AAClD,8CAA2C;AAC3C,0CAAuC;AACvC,8CAAgD;AAChD,0CAAuC;AACvC,wCAAqC;AACrC,8CAA2C;AAC3C,gDAA6C;AAC7C,wDAAoD;AACpD,wCAAqC;AACrC,kEAAoF;AACpF,0CAAuC;AACvC,oDAAiD;AACjD,kDAA+C;AAC/C,8CAA2C;AAC3C,4CAAyC;AACzC,kDAA+C;AAC/C,0DAAuD;AACvD,wDAAoD;AACpD,4CAAyC;AACzC,oEAAgE;AAEhE,qCAAoC;AACpC,iCAAgD;AAChD,uCAAuC;AAKvC,kFAAkF;AAClF,MAAM,QAAQ,GAA4B;IACxC,KAAK,EAAL,YAAK;IACL,MAAM,EAAN,aAAM;IACN,MAAM,EAAN,aAAM;IACN,KAAK,EAAL,gBAAK;IACL,IAAI,EAAJ,eAAI;IACJ,KAAK,EAAL,aAAK;IACL,IAAI,EAAJ,WAAI;IACJ,UAAU,EAAE,kBAAO;IACnB,QAAQ,EAAR,mBAAQ;IACR,YAAY,EAAZ,2BAAY;IACZ,mBAAmB,EAAE,oCAAgB;IACrC,aAAa,EAAE,wBAAU;IACzB,KAAK,EAAL,aAAK;IACL,QAAQ,EAAR,mBAAQ;IACR,MAAM,EAAN,eAAM;IACN,OAAO,EAAP,iBAAO;IACP,IAAI,EAAJ,WAAI;IACJ,SAAS,EAAT,4BAAS;IACT,MAAM,EAAN,yBAAM;IACN,GAAG,EAAE,6BAAU;IACf,MAAM,EAAN,yBAAM;IACN,SAAS,EAAT,qBAAS;IACT,MAAM,EAAN,eAAM;IACN,MAAM,EAAE,oBAAW;IACnB,OAAO,EAAP,iBAAO;IACP,IAAI,EAAJ,WAAI;IACJ,GAAG,EAAH,SAAG;IACH,MAAM,EAAN,eAAM;IACN,aAAa,EAAE,wBAAU;IACzB,GAAG,EAAH,SAAG;CACJ,CAAC;AAEF;;;;;;GAMG;AACI,KAAK,UAAU,GAAG,CAAC,IAAc,EAAE,GAAe;IACvD,IAAI,IAAgB,CAAC;IACrB,IAAI,CAAC;QACH,IAAI,GAAG,IAAA,YAAK,EAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,kDAAkD;IAClD,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACxB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAA,oBAAU,GAAE,CAAC,CAAC;QACzB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAEpC,qEAAqE;IACrE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,eAAQ,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,oBAAoB,OAAO,IAAI,CAAC,CAAC;QAC5C,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC5D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,sEAAsE;IACtE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACrB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,mBAAY,CAAC,OAAO,CAAC,IAAI,eAAQ,CAAC,CAAC;QAC9C,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,MAAM,CAAC,GAAe,EAAE,GAAY;IAC3C,IAAI,GAAG,YAAY,uBAAa,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,0BAA0B,GAAG,CAAC,MAAM,IAAI,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3E,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,GAAG,YAAY,iBAAQ,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACpC,OAAO,GAAG,CAAC,QAAQ,CAAC;IACtB,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC;IAChC,OAAO,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":";;AA+EA,kBAwCC;AAvHD,gDAAmD;AACnD,iCAAgD;AAChD,gDAA6C;AAC7C,4CAAyC;AACzC,kDAA8C;AAC9C,0CAAwD;AACxD,kDAAkD;AAClD,8CAA2C;AAC3C,0CAAuC;AACvC,8CAAgD;AAChD,0CAAuC;AACvC,wCAAqC;AACrC,wCAAqC;AACrC,8CAA2C;AAC3C,gDAA6C;AAC7C,wDAAoD;AACpD,wCAAqC;AACrC,kEAAoF;AACpF,0CAAuC;AACvC,oDAAiD;AACjD,kDAA+C;AAC/C,8CAA2C;AAC3C,4CAAyC;AACzC,kDAA+C;AAC/C,0DAAuD;AACvD,wDAAoD;AACpD,4CAAyC;AACzC,oEAAgE;AAEhE,qCAAoC;AACpC,iCAAgD;AAChD,uCAAuC;AAKvC,kFAAkF;AAClF,MAAM,QAAQ,GAA4B;IACxC,KAAK,EAAL,YAAK;IACL,MAAM,EAAN,aAAM;IACN,MAAM,EAAN,aAAM;IACN,KAAK,EAAL,gBAAK;IACL,IAAI,EAAJ,eAAI;IACJ,KAAK,EAAL,aAAK;IACL,IAAI,EAAJ,WAAI;IACJ,UAAU,EAAE,kBAAO;IACnB,QAAQ,EAAR,mBAAQ;IACR,YAAY,EAAZ,2BAAY;IACZ,mBAAmB,EAAE,oCAAgB;IACrC,aAAa,EAAE,wBAAU;IACzB,KAAK,EAAL,aAAK;IACL,QAAQ,EAAR,mBAAQ;IACR,MAAM,EAAN,eAAM;IACN,OAAO,EAAP,iBAAO;IACP,KAAK,EAAL,aAAK;IACL,IAAI,EAAJ,WAAI;IACJ,SAAS,EAAT,4BAAS;IACT,MAAM,EAAN,yBAAM;IACN,GAAG,EAAE,6BAAU;IACf,MAAM,EAAN,yBAAM;IACN,SAAS,EAAT,qBAAS;IACT,MAAM,EAAN,eAAM;IACN,MAAM,EAAE,oBAAW;IACnB,OAAO,EAAP,iBAAO;IACP,IAAI,EAAJ,WAAI;IACJ,GAAG,EAAH,SAAG;IACH,MAAM,EAAN,eAAM;IACN,GAAG,EAAH,SAAG;IACH,aAAa,EAAE,wBAAU;IACzB,GAAG,EAAH,SAAG;CACJ,CAAC;AAEF;;;;;;GAMG;AACI,KAAK,UAAU,GAAG,CAAC,IAAc,EAAE,GAAe;IACvD,IAAI,IAAgB,CAAC;IACrB,IAAI,CAAC;QACH,IAAI,GAAG,IAAA,YAAK,EAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,kDAAkD;IAClD,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACxB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAA,oBAAU,GAAE,CAAC,CAAC;QACzB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAEpC,qEAAqE;IACrE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,eAAQ,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,oBAAoB,OAAO,IAAI,CAAC,CAAC;QAC5C,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC5D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,sEAAsE;IACtE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACrB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,mBAAY,CAAC,OAAO,CAAC,IAAI,eAAQ,CAAC,CAAC;QAC9C,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,MAAM,CAAC,GAAe,EAAE,GAAY;IAC3C,IAAI,GAAG,YAAY,uBAAa,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,0BAA0B,GAAG,CAAC,MAAM,IAAI,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3E,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,GAAG,YAAY,iBAAQ,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACpC,OAAO,GAAG,CAAC,QAAQ,CAAC;IACtB,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC;IAChC,OAAO,CAAC,CAAC;AACX,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlasauth/cli",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "atlas — manage an Atlas instance from the terminal via the Backend API.",
   "bin": {
     "atlas": "dist/cli.js"
@@ -15,10 +15,11 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@atlasauth/actions": "0.3.0",
-    "@atlasauth/migrate": "0.1.0",
-    "@atlasauth/backend": "0.24.0",
-    "@atlasauth/upgrade": "0.5.0",
+    "@atlasauth/backend": "0.25.0",
+    "@atlasauth/actions": "0.4.0",
+    "@atlasauth/migrate": "0.2.0",
+    "@atlasauth/emulator": "0.1.0",
+    "@atlasauth/upgrade": "0.6.0",
     "@atlasauth/referral-conformance": "0.1.0"
   },
   "devDependencies": {