@atlasauth/cli 0.25.0 → 0.25.1

package/dist/commands/listen.js

@@ -0,0 +1,223 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readSse = readSse;
+exports.listen = listen;
+const args_1 = require("../args");
+const errors_1 = require("../errors");
+const output_1 = require("../output");
+const secrets_1 = require("../secrets");
+const shared_1 = require("./shared");
+const webhooks_1 = require("./webhooks");
+/** Parse a Server-Sent Events byte stream into `{event, id, data}` messages. */
+async function* readSse(body) {
+    const reader = body.getReader();
+    const decoder = new TextDecoder();
+    let buffer = '';
+    try {
+        for (;;) {
+            const { value, done } = await reader.read();
+            if (done)
+                break;
+            buffer += decoder.decode(value, { stream: true });
+            let at;
+            while ((at = buffer.search(/\r?\n\r?\n/)) >= 0) {
+                const block = buffer.slice(0, at);
+                buffer = buffer.slice(at).replace(/^\r?\n\r?\n/, '');
+                let event = 'message';
+                let id;
+                const data = [];
+                for (const line of block.split(/\r?\n/)) {
+                    if (line.startsWith(':'))
+                        continue;
+                    const colon = line.indexOf(':');
+                    const field = colon < 0 ? line : line.slice(0, colon);
+                    const val = colon < 0 ? '' : line.slice(colon + 1).replace(/^ /, '');
+                    if (field === 'event')
+                        event = val;
+                    else if (field === 'id')
+                        id = val;
+                    else if (field === 'data')
+                        data.push(val);
+                }
+                if (data.length || event !== 'message')
+                    yield { event, id, data: data.join('\n') };
+            }
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+}
+/**
+ * `atlas listen --forward-to <url> [--events user.*,session.created]`: the
+ * Stripe-CLI pattern for local webhook development. Opens a signed event
+ * stream from the instance, POSTs each event to your local server with the
+ * normal `atlas-id` / `atlas-timestamp` / `atlas-signature` headers, and
+ * prints what your server answered. The signing secret is for this session
+ * only and is written to a 0600 file; point your verifier at it.
+ */
+async function listen(ctx, args) {
+    const v = args.values;
+    const json = (0, shared_1.wantsJson)(v);
+    const forwardTo = (0, args_1.str)(v, 'forward-to');
+    if (!forwardTo && v['no-forward'] !== true) {
+        throw new errors_1.CliError('listen needs --forward-to <url> (for example http://localhost:4000/webhooks/atlas), or --no-forward to only print events.');
+    }
+    if (forwardTo && !/^https?:\/\//i.test(forwardTo))
+        throw new errors_1.CliError(`--forward-to must be an http(s) URL, got '${forwardTo}'.`);
+    const events = (0, args_1.list)(v, 'events');
+    const maxCount = (0, args_1.str)(v, 'count') ? Number((0, args_1.str)(v, 'count')) : undefined;
+    if (maxCount !== undefined && (!Number.isInteger(maxCount) || maxCount < 1))
+        throw new errors_1.CliError('--count must be a positive integer.');
+    const timeoutMs = (0, args_1.str)(v, 'timeout') ? (0, webhooks_1.parseDuration)((0, args_1.str)(v, 'timeout'), '--timeout') : undefined;
+    const auth = (0, shared_1.resolveAuth)(ctx, v);
+    const base = auth.apiUrl.replace(/\/+$/, '');
+    const doFetch = ctx.fetch ?? globalThis.fetch;
+    const bearer = { authorization: `Bearer ${auth.secretKey}` };
+    const controller = new AbortController();
+    const stop = () => controller.abort();
+    ctx.signal?.addEventListener('abort', stop);
+    const sigs = ctx.signal ? [] : ['SIGINT', 'SIGTERM'];
+    for (const s of sigs)
+        process.once(s, stop);
+    const cleanup = () => {
+        ctx.signal?.removeEventListener('abort', stop);
+        for (const s of sigs)
+            process.removeListener(s, stop);
+    };
+    try {
+        // 1. A session: id, session-only secret.
+        const created = await doFetch(`${base}/v1/listen/sessions`, {
+            method: 'POST',
+            headers: { ...bearer, 'content-type': 'application/json', accept: 'application/json' },
+            body: JSON.stringify(events.length ? { events } : {}),
+            signal: controller.signal,
+        });
+        if (!created.ok) {
+            throw new errors_1.CliError(`Could not start a listen session (HTTP ${created.status}). Is this key allowed webhooks:write, and does the API support listen?`);
+        }
+        const session = (await created.json());
+        const secretFile = (0, secrets_1.deliverSecret)({
+            io: json ? { out: () => undefined, err: ctx.io.err } : ctx.io,
+            env: ctx.env,
+            product: (0, args_1.str)(v, 'product') ?? 'atlasauth',
+            fileName: 'webhook-listen.env',
+            entries: { ATLAS_WEBHOOK_SECRET: session.secret },
+            label: 'The listen signing secret',
+            printSecret: v['print-secret'] === true,
+            force: true,
+            comment: 'Signing secret for `atlas listen`. Valid for this session only; verify forwarded events with it.',
+        }).path;
+        if (!json) {
+            ctx.io.out(`Listening for ${session.events.join(', ')} until ${new Date(session.expires_at).toISOString()}${forwardTo ? `, forwarding to ${forwardTo}` : ''}. Ctrl-C to stop.`);
+            if (secretFile)
+                ctx.io.out(`Verify with the secret in ${secretFile} (ATLAS_WEBHOOK_SECRET).`);
+        }
+        // 2. The stream, reconnecting with Last-Event-ID until the session ends.
+        const sleep = ctx.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+        let lastId;
+        let seen = 0;
+        let failures = 0;
+        let forwardFailures = 0;
+        const deadline = timeoutMs ? Date.now() + timeoutMs : undefined;
+        while (!controller.signal.aborted) {
+            if (deadline && Date.now() >= deadline)
+                break;
+            const params = new URLSearchParams();
+            if (events.length)
+                params.set('events', events.join(','));
+            if (maxCount)
+                params.set('max_events', String(maxCount - seen));
+            if (deadline)
+                params.set('max_wait_seconds', String(Math.max(1, Math.ceil((deadline - Date.now()) / 1000))));
+            const headers = { ...bearer, accept: 'text/event-stream' };
+            if (lastId)
+                headers['last-event-id'] = lastId;
+            let res;
+            try {
+                res = await doFetch(`${base}/v1/listen/sessions/${session.id}/stream?${params}`, {
+                    headers,
+                    signal: controller.signal,
+                });
+            }
+            catch (err) {
+                if (controller.signal.aborted)
+                    break;
+                if (++failures > 5)
+                    throw new errors_1.CliError(`Lost the event stream: ${err instanceof Error ? err.message : String(err)}`);
+                await sleep(1000 * failures);
+                continue;
+            }
+            if (!res.ok || !res.body) {
+                throw new errors_1.CliError(`The event stream was refused (HTTP ${res.status}). ${res.status === 422 ? 'The session expired: run atlas listen again.' : ''}`.trim());
+            }
+            failures = 0;
+            let expired = false;
+            try {
+                for await (const msg of readSse(res.body)) {
+                    if (msg.event === 'expired') {
+                        expired = true;
+                        break;
+                    }
+                    if (msg.event !== 'webhook')
+                        continue;
+                    if (msg.id)
+                        lastId = msg.id;
+                    const frame = JSON.parse(msg.data);
+                    seen++;
+                    const t0 = Date.now();
+                    let status = null;
+                    let error = null;
+                    if (forwardTo) {
+                        try {
+                            const out = await doFetch(forwardTo, { method: 'POST', headers: frame.headers, body: frame.body, redirect: 'manual', signal: controller.signal });
+                            status = out.status;
+                            await out.arrayBuffer().catch(() => undefined);
+                        }
+                        catch (err) {
+                            error = err instanceof Error ? err.message : String(err);
+                        }
+                    }
+                    const ms = Date.now() - t0;
+                    const ok = status !== null && status >= 200 && status < 300;
+                    if (forwardTo && !ok)
+                        forwardFailures++;
+                    if (json)
+                        (0, output_1.printJson)(ctx.io, { id: frame.id, type: frame.type, forwarded: Boolean(forwardTo), http_status: status, error, latency_ms: ms });
+                    else
+                        ctx.io.out(`${new Date().toISOString()}  ${frame.type}  ${frame.id}${forwardTo ? `  → ${status ?? 'failed'}${error ? ` (${error})` : ''} ${ms}ms` : ''}`);
+                    if (maxCount && seen >= maxCount) {
+                        controller.abort();
+                        break;
+                    }
+                }
+            }
+            catch (err) {
+                if (!controller.signal.aborted) {
+                    if (++failures > 5)
+                        throw new errors_1.CliError(`Lost the event stream: ${err instanceof Error ? err.message : String(err)}`);
+                }
+            }
+            if (expired) {
+                if (!json)
+                    ctx.io.out('The listen session expired. Run atlas listen again for a new one.');
+                break;
+            }
+            if (controller.signal.aborted || (maxCount && seen >= maxCount))
+                break;
+            if (deadline && Date.now() >= deadline)
+                break;
+            await sleep(1000);
+        }
+        return forwardTo && forwardFailures > 0 && maxCount !== undefined ? 1 : 0;
+    }
+    catch (err) {
+        if (controller.signal.aborted && !(err instanceof errors_1.CliError))
+            return 0;
+        throw err;
+    }
+    finally {
+        cleanup();
+    }
+}
+//# sourceMappingURL=listen.js.map

package/dist/commands/listen.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"listen.js","sourceRoot":"","sources":["../../src/commands/listen.ts"],"names":[],"mappings":";;AAgBA,0BAiCC;AAUD,wBA4IC;AAvMD,kCAAqD;AAErD,sCAAqC;AACrC,sCAAsC;AACtC,wCAA2C;AAC3C,qCAAkD;AAClD,yCAA2C;AAS3C,gFAAgF;AACzE,KAAK,SAAS,CAAC,CAAC,OAAO,CAC5B,IAAgC;IAEhC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,IAAI,EAAU,CAAC;YACf,OAAO,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAClC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;gBACrD,IAAI,KAAK,GAAG,SAAS,CAAC;gBACtB,IAAI,EAAsB,CAAC;gBAC3B,MAAM,IAAI,GAAa,EAAE,CAAC;gBAC1B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;oBACxC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;wBAAE,SAAS;oBACnC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBAChC,MAAM,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;oBACtD,MAAM,GAAG,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBACrE,IAAI,KAAK,KAAK,OAAO;wBAAE,KAAK,GAAG,GAAG,CAAC;yBAC9B,IAAI,KAAK,KAAK,IAAI;wBAAE,EAAE,GAAG,GAAG,CAAC;yBAC7B,IAAI,KAAK,KAAK,MAAM;wBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC5C,CAAC;gBACD,IAAI,IAAI,CAAC,MAAM,IAAI,KAAK,KAAK,SAAS;oBAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrF,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,MAAM,CAAC,GAAe,EAAE,IAAgB;IAC5D,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IACtB,MAAM,IAAI,GAAG,IAAA,kBAAS,EAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,SAAS,GAAG,IAAA,UAAG,EAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IACvC,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,IAAI,EAAE,CAAC;QAC3C,MAAM,IAAI,iBAAQ,CAAC,2HAA2H,CAAC,CAAC;IAClJ,CAAC;IACD,IAAI,SAAS,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,iBAAQ,CAAC,6CAA6C,SAAS,IAAI,CAAC,CAAC;IAClI,MAAM,MAAM,GAAG,IAAA,WAAI,EAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,IAAA,UAAG,EAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAA,UAAG,EAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,iBAAQ,CAAC,qCAAqC,CAAC,CAAC;IACvI,MAAM,SAAS,GAAG,IAAA,UAAG,EAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAA,wBAAa,EAAC,IAAA,UAAG,EAAC,CAAC,EAAE,SAAS,CAAE,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEjG,MAAM,IAAI,GAAG,IAAA,oBAAW,EAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAC9C,MAAM,MAAM,GAAG,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;IAE7D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IACtC,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,QAAQ,EAAE,SAAS,CAAW,CAAC;IAChE,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC/C,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,OAAO,CAAC,cAAc,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACxD,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,yCAAyC;QACzC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,qBAAqB,EAAE;YAC1D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,GAAG,MAAM,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACtF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,iBAAQ,CAAC,0CAA0C,OAAO,CAAC,MAAM,yEAAyE,CAAC,CAAC;QACxJ,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAyE,CAAC;QAC/G,MAAM,UAAU,GAAG,IAAA,uBAAa,EAAC;YAC/B,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE;YAC7D,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,OAAO,EAAE,IAAA,UAAG,EAAC,CAAC,EAAE,SAAS,CAAC,IAAI,WAAW;YACzC,QAAQ,EAAE,oBAAoB;YAC9B,OAAO,EAAE,EAAE,oBAAoB,EAAE,OAAO,CAAC,MAAM,EAAE;YACjD,KAAK,EAAE,2BAA2B;YAClC,WAAW,EAAE,CAAC,CAAC,cAAc,CAAC,KAAK,IAAI;YACvC,KAAK,EAAE,IAAI;YACX,OAAO,EAAE,kGAAkG;SAC5G,CAAC,CAAC,IAAI,CAAC;QACR,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,iBAAiB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,mBAAmB,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;YAChL,IAAI,UAAU;gBAAE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,6BAA6B,UAAU,0BAA0B,CAAC,CAAC;QAChG,CAAC;QAED,yEAAyE;QACzE,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACzF,IAAI,MAA0B,CAAC;QAC/B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;gBAAE,MAAM;YAC9C,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;YACrC,IAAI,MAAM,CAAC,MAAM;gBAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1D,IAAI,QAAQ;gBAAE,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC;YAChE,IAAI,QAAQ;gBAAE,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7G,MAAM,OAAO,GAA2B,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;YACnF,IAAI,MAAM;gBAAE,OAAO,CAAC,eAAe,CAAC,GAAG,MAAM,CAAC;YAC9C,IAAI,GAAa,CAAC;YAClB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,uBAAuB,OAAO,CAAC,EAAE,WAAW,MAAM,EAAE,EAAE;oBAC/E,OAAO;oBACP,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;oBAAE,MAAM;gBACrC,IAAI,EAAE,QAAQ,GAAG,CAAC;oBAAE,MAAM,IAAI,iBAAQ,CAAC,0BAA0B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACrH,MAAM,KAAK,CAAC,IAAI,GAAG,QAAQ,CAAC,CAAC;gBAC7B,SAAS;YACX,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBACzB,MAAM,IAAI,iBAAQ,CAAC,sCAAsC,GAAG,CAAC,MAAM,MAAM,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,8CAA8C,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;YAC9J,CAAC;YACD,QAAQ,GAAG,CAAC,CAAC;YACb,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,CAAC;gBACH,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1C,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;wBAC5B,OAAO,GAAG,IAAI,CAAC;wBACf,MAAM;oBACR,CAAC;oBACD,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS;wBAAE,SAAS;oBACtC,IAAI,GAAG,CAAC,EAAE;wBAAE,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;oBAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAU,CAAC;oBAC5C,IAAI,EAAE,CAAC;oBACP,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;oBACtB,IAAI,MAAM,GAAkB,IAAI,CAAC;oBACjC,IAAI,KAAK,GAAkB,IAAI,CAAC;oBAChC,IAAI,SAAS,EAAE,CAAC;wBACd,IAAI,CAAC;4BACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;4BAClJ,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;4BACpB,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;wBACjD,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;wBAC3D,CAAC;oBACH,CAAC;oBACD,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;oBAC3B,MAAM,EAAE,GAAG,MAAM,KAAK,IAAI,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC;oBAC5D,IAAI,SAAS,IAAI,CAAC,EAAE;wBAAE,eAAe,EAAE,CAAC;oBACxC,IAAI,IAAI;wBAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;;wBACtI,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,MAAM,IAAI,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC/J,IAAI,QAAQ,IAAI,IAAI,IAAI,QAAQ,EAAE,CAAC;wBACjC,UAAU,CAAC,KAAK,EAAE,CAAC;wBACnB,MAAM;oBACR,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBAC/B,IAAI,EAAE,QAAQ,GAAG,CAAC;wBAAE,MAAM,IAAI,iBAAQ,CAAC,0BAA0B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACvH,CAAC;YACH,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,CAAC,IAAI;oBAAE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;gBAC3F,MAAM;YACR,CAAC;YACD,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,QAAQ,IAAI,IAAI,IAAI,QAAQ,CAAC;gBAAE,MAAM;YACvE,IAAI,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;gBAAE,MAAM;YAC9C,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QACD,OAAO,SAAS,IAAI,eAAe,GAAG,CAAC,IAAI,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,YAAY,iBAAQ,CAAC;YAAE,OAAO,CAAC,CAAC;QACtE,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/commands/mcp.d.ts

@@ -0,0 +1,38 @@
+import { type ParsedArgs } from '../args';
+import type { RunContext } from '../context';
+/**
+ * `atlas mcp install --cursor | --claude-code | --codex | --vscode` — add the
+ * Atlas MCP server to an AI coding agent's config, so the agent can search and
+ * read the Atlas docs while it works.
+ *
+ * The server runs as `npx -y @atlasauth/mcp`. No key is written: without
+ * `ATLAS_SECRET_KEY` it serves only the read-only docs tools, which is what a
+ * coding agent needs. Existing servers in the file are kept; an existing
+ * `atlas` entry is replaced (or, in Codex's TOML, left alone and reported).
+ */
+export declare const MCP_SERVER_NAME = "atlas";
+export declare const MCP_CLIENTS: readonly ["cursor", "claude-code", "codex", "vscode"];
+export type McpClient = (typeof MCP_CLIENTS)[number];
+interface InstallResult {
+    client: McpClient;
+    path: string;
+    status: 'added' | 'updated' | 'unchanged';
+}
+/** Where each client keeps its MCP config. Project files go under `dir`. */
+export declare function mcpConfigPath(client: McpClient, opts: {
+    dir: string;
+    global: boolean;
+    env: NodeJS.ProcessEnv;
+}): string;
+/** Merge the Atlas server into a JSON MCP config. Pure, for tests. */
+export declare function mergeJsonConfig(existing: string | null, client: McpClient): {
+    text: string;
+    status: InstallResult['status'];
+};
+/** Append the Atlas server to Codex's TOML config, unless one is already there. Pure, for tests. */
+export declare function mergeCodexToml(existing: string | null): {
+    text: string;
+    status: InstallResult['status'];
+};
+export declare function mcp(ctx: RunContext, args: ParsedArgs): Promise<number>;
+export {};

package/dist/commands/mcp.js

@@ -0,0 +1,111 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MCP_CLIENTS = exports.MCP_SERVER_NAME = void 0;
+exports.mcpConfigPath = mcpConfigPath;
+exports.mergeJsonConfig = mergeJsonConfig;
+exports.mergeCodexToml = mergeCodexToml;
+exports.mcp = mcp;
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const args_1 = require("../args");
+const errors_1 = require("../errors");
+const output_1 = require("../output");
+const shared_1 = require("./shared");
+const resources_1 = require("./resources");
+/**
+ * `atlas mcp install --cursor | --claude-code | --codex | --vscode` — add the
+ * Atlas MCP server to an AI coding agent's config, so the agent can search and
+ * read the Atlas docs while it works.
+ *
+ * The server runs as `npx -y @atlasauth/mcp`. No key is written: without
+ * `ATLAS_SECRET_KEY` it serves only the read-only docs tools, which is what a
+ * coding agent needs. Existing servers in the file are kept; an existing
+ * `atlas` entry is replaced (or, in Codex's TOML, left alone and reported).
+ */
+exports.MCP_SERVER_NAME = 'atlas';
+const COMMAND = 'npx';
+const ARGS = ['-y', '@atlasauth/mcp'];
+exports.MCP_CLIENTS = ['cursor', 'claude-code', 'codex', 'vscode'];
+/** Where each client keeps its MCP config. Project files go under `dir`. */
+function mcpConfigPath(client, opts) {
+    const home = opts.env.HOME || (0, node_os_1.homedir)();
+    switch (client) {
+        case 'cursor':
+            return opts.global ? (0, node_path_1.join)(home, '.cursor', 'mcp.json') : (0, node_path_1.join)(opts.dir, '.cursor', 'mcp.json');
+        case 'claude-code':
+            // Project scope: a checked-in `.mcp.json` that Claude Code offers to the whole team.
+            return (0, node_path_1.join)(opts.dir, '.mcp.json');
+        case 'vscode':
+            return (0, node_path_1.join)(opts.dir, '.vscode', 'mcp.json');
+        case 'codex':
+            return (0, node_path_1.join)(opts.env.CODEX_HOME || (0, node_path_1.join)(home, '.codex'), 'config.toml');
+    }
+}
+/** Merge the Atlas server into a JSON MCP config. Pure, for tests. */
+function mergeJsonConfig(existing, client) {
+    let doc = {};
+    if (existing && existing.trim()) {
+        try {
+            const parsed = JSON.parse(existing);
+            if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed))
+                throw new Error('not an object');
+            doc = parsed;
+        }
+        catch {
+            throw new errors_1.CliError('The existing MCP config is not valid JSON. Fix or move it, then run this again; it was not changed.');
+        }
+    }
+    // VS Code calls the map `servers` and wants an explicit transport type.
+    const key = client === 'vscode' ? 'servers' : 'mcpServers';
+    const entry = client === 'vscode' ? { type: 'stdio', command: COMMAND, args: ARGS } : { command: COMMAND, args: ARGS };
+    const servers = (typeof doc[key] === 'object' && doc[key] !== null ? doc[key] : {});
+    const before = servers[exports.MCP_SERVER_NAME];
+    const status = before === undefined ? 'added' : JSON.stringify(before) === JSON.stringify(entry) ? 'unchanged' : 'updated';
+    doc[key] = { ...servers, [exports.MCP_SERVER_NAME]: entry };
+    return { text: `${JSON.stringify(doc, null, 2)}\n`, status };
+}
+/** Append the Atlas server to Codex's TOML config, unless one is already there. Pure, for tests. */
+function mergeCodexToml(existing) {
+    const current = existing ?? '';
+    if (/^\s*\[mcp_servers\.(atlas|"atlas")\]\s*$/m.test(current))
+        return { text: current, status: 'unchanged' };
+    const block = `[mcp_servers.${exports.MCP_SERVER_NAME}]\ncommand = "${COMMAND}"\nargs = [${ARGS.map((a) => JSON.stringify(a)).join(', ')}]\n`;
+    const sep = current === '' ? '' : current.endsWith('\n\n') ? '' : current.endsWith('\n') ? '\n' : '\n\n';
+    return { text: `${current}${sep}${block}`, status: 'added' };
+}
+async function mcp(ctx, args) {
+    const sub = args.positionals[1];
+    if (sub && sub in resources_1.GATEWAYS)
+        return (0, resources_1.resourceCommand)('mcp', resources_1.GATEWAYS)(ctx, args);
+    if (sub !== 'install')
+        throw new errors_1.CliError("Usage: atlas mcp install --cursor | --claude-code | --codex | --vscode, or a gateway command (atlas mcp --help)");
+    const chosen = exports.MCP_CLIENTS.filter((c) => args.values[c] === true);
+    if (chosen.length === 0) {
+        throw new errors_1.CliError('Choose at least one client: --cursor, --claude-code, --codex or --vscode.');
+    }
+    const dir = (0, node_path_1.resolve)((0, args_1.str)(args.values, 'dir') ?? process.cwd());
+    const global = args.values.global === true;
+    const results = [];
+    for (const client of chosen) {
+        const path = mcpConfigPath(client, { dir, global, env: ctx.env });
+        const existing = (0, node_fs_1.existsSync)(path) ? (0, node_fs_1.readFileSync)(path, 'utf8') : null;
+        const merged = client === 'codex' ? mergeCodexToml(existing) : mergeJsonConfig(existing, client);
+        if (merged.status !== 'unchanged') {
+            (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(path), { recursive: true });
+            (0, node_fs_1.writeFileSync)(path, merged.text);
+        }
+        results.push({ client, path, status: merged.status });
+    }
+    if ((0, shared_1.wantsJson)(args.values))
+        (0, output_1.printJson)(ctx.io, { server: exports.MCP_SERVER_NAME, command: [COMMAND, ...ARGS].join(' '), results });
+    else {
+        for (const r of results) {
+            const verb = r.status === 'unchanged' ? 'already set up in' : r.status === 'updated' ? 'updated in' : 'added to';
+            ctx.io.out(`${r.client}: Atlas MCP server ${verb} ${r.path}`);
+        }
+        ctx.io.out('Restart the client (or reload its MCP servers). It can now search and read the Atlas docs.');
+    }
+    return 0;
+}
+//# sourceMappingURL=mcp.js.map

package/dist/commands/mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../src/commands/mcp.ts"],"names":[],"mappings":";;;AAmCA,sCAaC;AAGD,0CAoBC;AAGD,wCAMC;AAED,kBAiCC;AAnHD,qCAA6E;AAC7E,qCAAkC;AAClC,yCAAmD;AACnD,kCAA+C;AAE/C,sCAAqC;AACrC,sCAAsC;AACtC,qCAAqC;AACrC,2CAAwD;AAExD;;;;;;;;;GASG;AAEU,QAAA,eAAe,GAAG,OAAO,CAAC;AACvC,MAAM,OAAO,GAAG,KAAK,CAAC;AACtB,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;AAEzB,QAAA,WAAW,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,CAAU,CAAC;AASjF,4EAA4E;AAC5E,SAAgB,aAAa,CAAC,MAAiB,EAAE,IAA8D;IAC7G,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,IAAA,iBAAO,GAAE,CAAC;IACxC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAI,EAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QACjG,KAAK,aAAa;YAChB,qFAAqF;YACrF,OAAO,IAAA,gBAAI,EAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACrC,KAAK,QAAQ;YACX,OAAO,IAAA,gBAAI,EAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QAC/C,KAAK,OAAO;YACV,OAAO,IAAA,gBAAI,EAAC,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,IAAA,gBAAI,EAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,aAAa,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED,sEAAsE;AACtE,SAAgB,eAAe,CAAC,QAAuB,EAAE,MAAiB;IACxE,IAAI,GAAG,GAA4B,EAAE,CAAC;IACtC,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAY,CAAC;YAC/C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;YAC7G,GAAG,GAAG,MAAiC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,iBAAQ,CAAC,qGAAqG,CAAC,CAAC;QAC5H,CAAC;IACH,CAAC;IACD,wEAAwE;IACxE,MAAM,GAAG,GAAG,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC;IAC3D,MAAM,KAAK,GAAG,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACvH,MAAM,OAAO,GAAG,CAAC,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAA4B,CAAC;IAC/G,MAAM,MAAM,GAAG,OAAO,CAAC,uBAAe,CAAC,CAAC;IACxC,MAAM,MAAM,GACV,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9G,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,uBAAe,CAAC,EAAE,KAAK,EAAE,CAAC;IACpD,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;AAC/D,CAAC;AAED,oGAAoG;AACpG,SAAgB,cAAc,CAAC,QAAuB;IACpD,MAAM,OAAO,GAAG,QAAQ,IAAI,EAAE,CAAC;IAC/B,IAAI,2CAA2C,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC7G,MAAM,KAAK,GAAG,gBAAgB,uBAAe,iBAAiB,OAAO,cAAc,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;IACtI,MAAM,GAAG,GAAG,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IACzG,OAAO,EAAE,IAAI,EAAE,GAAG,OAAO,GAAG,GAAG,GAAG,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC/D,CAAC;AAEM,KAAK,UAAU,GAAG,CAAC,GAAe,EAAE,IAAgB;IACzD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,GAAG,IAAI,GAAG,IAAI,oBAAQ;QAAE,OAAO,IAAA,2BAAe,EAAC,KAAK,EAAE,oBAAQ,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC/E,IAAI,GAAG,KAAK,SAAS;QAAE,MAAM,IAAI,iBAAQ,CAAC,iHAAiH,CAAC,CAAC;IAE7J,MAAM,MAAM,GAAG,mBAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAClE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,iBAAQ,CAAC,2EAA2E,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,GAAG,GAAG,IAAA,mBAAO,EAAC,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC;IAE3C,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,KAAK,MAAM,MAAM,IAAI,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,IAAA,oBAAU,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtE,MAAM,MAAM,GAAG,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACjG,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAClC,IAAA,mBAAS,EAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9C,IAAA,uBAAa,EAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,IAAA,kBAAS,EAAC,IAAI,CAAC,MAAM,CAAC;QAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,uBAAe,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;SACtH,CAAC;QACJ,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC;YACjH,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,sBAAsB,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,4FAA4F,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/commands/migrate.d.ts

@@ -0,0 +1,16 @@
+import { type ParsedArgs } from '../args';
+import type { RunContext } from '../context';
+/**
+ * `atlas migrate <vendor> [config|export|import|bridge|lazy] [path]` — the
+ * vendor-neutral program, one plugin per vendor (src/migrate/framework);
+ * `atlas migrate export <vendor>` is the same as `atlas migrate <vendor> export`.
+ *
+ * `atlas migrate code --from <vendor> [path]` — rewrite an app's auth code onto
+ * Atlas (Clerk, Auth.js/NextAuth, Supabase Auth, Auth0, Okta, Kinde, Descope, Better Auth).
+ *
+ * Safe by default: without `--yes` it is a dry run that prints the diff of every
+ * file it would change plus a report of what it could not rewrite (file:line).
+ * `--yes` writes the changes. Running it again over migrated code changes nothing.
+ * Users move separately, with `atlas migrate <vendor>` (or `atlas import --from <vendor>`).
+ */
+export declare function migrate(ctx: RunContext, args: ParsedArgs): Promise<number>;

package/dist/commands/migrate.js

@@ -0,0 +1,114 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.migrate = migrate;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const upgrade_1 = require("@atlasauth/upgrade");
+const args_1 = require("../args");
+const errors_1 = require("../errors");
+const output_1 = require("../output");
+const shared_1 = require("./shared");
+const config_1 = require("./config");
+const orchestrator_1 = require("../migrate/better-auth/orchestrator");
+const output_2 = require("../migrate/better-auth/output");
+const translate_1 = require("../migrate/better-auth/translate");
+const commands_1 = require("../migrate/framework/commands");
+/**
+ * `atlas migrate <vendor> [config|export|import|bridge|lazy] [path]` — the
+ * vendor-neutral program, one plugin per vendor (src/migrate/framework);
+ * `atlas migrate export <vendor>` is the same as `atlas migrate <vendor> export`.
+ *
+ * `atlas migrate code --from <vendor> [path]` — rewrite an app's auth code onto
+ * Atlas (Clerk, Auth.js/NextAuth, Supabase Auth, Auth0, Okta, Kinde, Descope, Better Auth).
+ *
+ * Safe by default: without `--yes` it is a dry run that prints the diff of every
+ * file it would change plus a report of what it could not rewrite (file:line).
+ * `--yes` writes the changes. Running it again over migrated code changes nothing.
+ * Users move separately, with `atlas migrate <vendor>` (or `atlas import --from <vendor>`).
+ */
+async function migrate(ctx, args) {
+    const sub = args.positionals[1];
+    if (sub === 'better-auth') {
+        if (args.positionals[2] === 'config')
+            return betterAuthConfig(ctx, args, args.positionals[3]);
+        return (0, orchestrator_1.migrateBetterAuth)(ctx, args, args.positionals[2]);
+    }
+    if (sub === 'export')
+        return (0, commands_1.migrateExportAlias)(ctx, args, args.positionals.slice(2));
+    if (sub !== 'code' && sub && (0, commands_1.hasPlugin)(sub))
+        return (0, commands_1.migrateWithPlugin)(ctx, args, sub, args.positionals.slice(2));
+    if (sub !== 'code') {
+        const others = `Other vendors: ${(0, commands_1.knownVendors)().join(', ')} (atlas migrate <vendor> [config|export|import|bridge|lazy]).`;
+        throw new errors_1.CliError(sub ? `Unknown subcommand 'migrate ${sub}'. Try: code, better-auth. ${others}` : `migrate needs a subcommand: code, better-auth. ${others}`);
+    }
+    const raw = (0, args_1.str)(args.values, 'from');
+    const vendor = (0, upgrade_1.resolveVendor)(raw);
+    if (!vendor) {
+        throw new errors_1.CliError(raw
+            ? `Unknown --from '${raw}'. Use one of: ${upgrade_1.MIGRATE_VENDORS.join(', ')}.`
+            : `migrate code needs --from <${upgrade_1.MIGRATE_VENDORS.join('|')}>.`);
+    }
+    const target = (0, node_path_1.resolve)(args.positionals[2] ?? process.cwd());
+    if (!(0, node_fs_1.existsSync)(target))
+        throw new errors_1.CliError(`Path not found: ${target}`);
+    const write = args.values.yes === true && args.values['dry-run'] !== true;
+    const result = (0, upgrade_1.runMigration)(target, { from: vendor, write });
+    if ((0, shared_1.wantsJson)(args.values)) {
+        (0, output_1.printJson)(ctx.io, {
+            object: 'code_migration',
+            vendor: result.vendor,
+            written: write,
+            env_style: result.envStyle,
+            files_scanned: result.filesScanned,
+            files_changed: result.filesChanged,
+            rewrites: result.rewrites,
+            changes: result.changes.map((c) => ({ path: c.path, diff: (0, upgrade_1.unifiedDiff)(c.before, c.after, c.path) })),
+            manual: result.manual,
+            packages: result.packages,
+            env_to_set: result.envToSet,
+        });
+        return 0;
+    }
+    for (const change of result.changes) {
+        if (write)
+            ctx.io.out(`updated ${change.path}`);
+        else {
+            ctx.io.out((0, upgrade_1.unifiedDiff)(change.before, change.after, change.path));
+            ctx.io.out('');
+        }
+    }
+    for (const line of (0, upgrade_1.formatMigration)(result, { written: write }))
+        ctx.io.out(line);
+    return 0;
+}
+/**
+ * `atlas migrate better-auth config [path]` — offline: read the app's Better Auth
+ * setup statically and write the Atlas config-as-code files plus the report.
+ * Needs no login; nothing is sent anywhere.
+ */
+async function betterAuthConfig(ctx, args, pathArg) {
+    const target = (0, node_path_1.resolve)(pathArg ?? process.cwd());
+    if (!(0, node_fs_1.existsSync)(target))
+        throw new errors_1.CliError(`Path not found: ${target}`);
+    const entry = (0, args_1.str)(args.values, 'entry');
+    const analysis = (0, upgrade_1.analyzeBetterAuth)(target, entry ? { entry } : {});
+    if (!analysis.instances.length) {
+        throw new errors_1.CliError(`No betterAuth({...}) call found under ${target}. Point at the app folder, or pass --entry <file>.`);
+    }
+    const translation = (0, translate_1.translateBetterAuth)(analysis);
+    const format = (0, config_1.resolveFormat)(args.values);
+    const root = (0, node_fs_1.statSync)(target).isDirectory() ? target : (0, node_path_1.dirname)(target);
+    const dir = (0, node_path_1.resolve)(root, (0, args_1.str)(args.values, 'dir') ?? 'atlas-migrate/config');
+    const written = (0, output_2.writeTranslation)(translation, dir, format);
+    if ((0, shared_1.wantsJson)(args.values)) {
+        (0, output_1.printJson)(ctx.io, { ...(0, output_2.reportJson)(translation), config_dir: dir, files: written });
+        return 0;
+    }
+    for (const line of (0, output_2.summaryLines)(translation, dir, written))
+        ctx.io.out(line);
+    ctx.io.out('');
+    ctx.io.out(`Review the files, then apply them with: atlas config import --dir ${dir} --dry-run`);
+    ctx.io.out('Or run the whole program: atlas migrate better-auth');
+    return 0;
+}
+//# sourceMappingURL=migrate.js.map

package/dist/commands/migrate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.js","sourceRoot":"","sources":["../../src/commands/migrate.ts"],"names":[],"mappings":";;AA2BA,0BAuDC;AAlFD,qCAA+C;AAC/C,yCAA6C;AAC7C,gDAAmI;AACnI,kCAA+C;AAE/C,sCAAqC;AACrC,sCAAsC;AACtC,qCAAqC;AACrC,qCAAyC;AACzC,sEAAwE;AACxE,0DAA2F;AAC3F,gEAAuE;AACvE,4DAA+G;AAE/G;;;;;;;;;;;;GAYG;AACI,KAAK,UAAU,OAAO,CAAC,GAAe,EAAE,IAAgB;IAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;QAC1B,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,QAAQ;YAAE,OAAO,gBAAgB,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9F,OAAO,IAAA,gCAAiB,EAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAA,6BAAkB,EAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACtF,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,IAAI,IAAA,oBAAS,EAAC,GAAG,CAAC;QAAE,OAAO,IAAA,4BAAiB,EAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACjH,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,kBAAkB,IAAA,uBAAY,GAAE,CAAC,IAAI,CAAC,IAAI,CAAC,+DAA+D,CAAC;QAC1H,MAAM,IAAI,iBAAQ,CAChB,GAAG,CAAC,CAAC,CAAC,+BAA+B,GAAG,8BAA8B,MAAM,EAAE,CAAC,CAAC,CAAC,kDAAkD,MAAM,EAAE,CAC5I,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,IAAA,uBAAa,EAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,iBAAQ,CAChB,GAAG;YACD,CAAC,CAAC,mBAAmB,GAAG,kBAAkB,yBAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACvE,CAAC,CAAC,8BAA8B,yBAAe,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAChE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,mBAAO,EAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC,IAAA,oBAAU,EAAC,MAAM,CAAC;QAAE,MAAM,IAAI,iBAAQ,CAAC,mBAAmB,MAAM,EAAE,CAAC,CAAC;IAEzE,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC;IAC1E,MAAM,MAAM,GAAG,IAAA,sBAAY,EAAC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAE7D,IAAI,IAAA,kBAAS,EAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE;YAChB,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,KAAK;YACd,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAA,qBAAW,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACpG,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,MAAM,CAAC,QAAQ;SAC5B,CAAC,CAAC;QACH,OAAO,CAAC,CAAC;IACX,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpC,IAAI,KAAK;YAAE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;aAC3C,CAAC;YACJ,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAA,qBAAW,EAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YAClE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,IAAA,yBAAe,EAAC,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAAE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjF,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,gBAAgB,CAAC,GAAe,EAAE,IAAgB,EAAE,OAA2B;IAC5F,MAAM,MAAM,GAAG,IAAA,mBAAO,EAAC,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACjD,IAAI,CAAC,IAAA,oBAAU,EAAC,MAAM,CAAC;QAAE,MAAM,IAAI,iBAAQ,CAAC,mBAAmB,MAAM,EAAE,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAA,2BAAiB,EAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QAC/B,MAAM,IAAI,iBAAQ,CAAC,yCAAyC,MAAM,oDAAoD,CAAC,CAAC;IAC1H,CAAC;IACD,MAAM,WAAW,GAAG,IAAA,+BAAmB,EAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,IAAA,sBAAa,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAA,kBAAQ,EAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAA,mBAAO,EAAC,MAAM,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,IAAA,mBAAO,EAAC,IAAI,EAAE,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,sBAAsB,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,IAAA,yBAAgB,EAAC,WAAW,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC3D,IAAI,IAAA,kBAAS,EAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,IAAA,mBAAU,EAAC,WAAW,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACnF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,IAAA,qBAAY,EAAC,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC;QAAE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7E,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACf,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,qEAAqE,GAAG,YAAY,CAAC,CAAC;IACjG,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;IAClE,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/commands/move-origin.d.ts

@@ -0,0 +1,11 @@
+import type { ParsedArgs } from '../args';
+import type { RunContext } from '../context';
+/**
+ * `atlas move-origin --from <origin> --to <origin> [--dry-run] [--yes]`: move an
+ * app to a new domain in one step. The server rewrites every origin-bearing
+ * field (allowed origins, OAuth client redirect/logout URIs, webhook URLs,
+ * redirect allowlist, branding links, Sign in with Atlas apps). The CLI always
+ * shows the diff first, asks before writing (skip with --yes), and after a real
+ * move sends a signed test delivery to each webhook endpoint that moved.
+ */
+export declare function moveOrigin(ctx: RunContext, args: ParsedArgs): Promise<number>;