@atlasauth/cli 0.5.0 → 0.6.0

package/dist/help.js

@@ -27,6 +27,11 @@ Commands:
   client rotate              Rotate an OAuth client secret straight into its file
   referrals connect|backfill|status
                              Connect a referral platform, backfill, check the connection
+  import --from <vendor> <file>
+                             Move users from Auth0, Clerk, Supabase, Firebase, Cognito,
+                             Auth.js, WorkOS or Better Auth (resumable; --dry-run first)
+  mcp install                Add the Atlas MCP server (docs search) to Cursor, Claude Code,
+                             Codex or VS Code
 
 Global options:
   --profile <name>           Use a named profile (default: active, else "default")
@@ -40,8 +45,8 @@ Environment overrides:
   ATLAS_SECRET_KEY           Secret key to use instead of the stored one
   ATLAS_API_URL              API URL to use instead of the stored one
   ATLAS_PLATFORM_KEY         Platform key (psk_) for atlas init
-  REFERALLY_BASE_URL         Referally base URL for atlas referrals connect
-  REFERALLY_API_KEY          Referally merchant key for atlas referrals connect (never stored)
+  REFERALLY_BASE_URL         Referalli base URL for atlas referrals connect
+  REFERALLY_API_KEY          Referalli merchant key for atlas referrals connect (never stored)
 
 Secrets: a command that receives a secret writes it to a 0600 file under
 ~/.config/<product>/ and prints only the path. --print-secret prints it instead.
@@ -49,6 +54,48 @@ Secrets: a command that receives a secret writes it to a 0600 file under
 Run 'atlas <command> --help' for command-specific help.`;
 /** Per-command help, keyed by the resource word. */
 exports.COMMAND_HELP = {
+    import: `atlas import — move users from another auth provider
+
+Usage:
+  atlas import --from <vendor> <export-file> [--dry-run]
+
+Vendors and the file each one reads:
+  auth0        the user export job (NDJSON/JSON); --hashes <file> merges the password export
+  clerk        the dashboard CSV export, or users JSON from the Backend API
+  supabase     auth.users rows as CSV or JSON (with an identities array for social links)
+  firebase     firebase auth:export --format=json; needs --hash-config <file>
+  cognito      aws cognito-idp list-users JSON, or the user-pool CSV
+  authjs       the adapter's users + accounts tables as JSON
+  workos       User Management users JSON (+ organization_memberships)
+  better-auth  JSON of the user, account, member and organization tables
+
+Options:
+  --dry-run              Map and summarise only; nothing is sent
+  --batch-size <n>       Users per request, 1-100 (default 100)
+  --state-file <file>    Progress file (default <export-file>.atlas-import.json); re-running resumes
+  --hash-config <file>   Firebase hash parameters: {signer_key, salt_separator, rounds, mem_cost}
+  --hashes <file>        Password hashes keyed by email, merged onto the users
+  --create-orgs          Create organizations that memberships name but that do not exist yet
+  --json                 Machine-readable summary
+
+Batches are sent with upsert, so a resumed or repeated run never duplicates a
+user or a membership. Exit code 2 means some rows were reported as issues.`,
+    mcp: `atlas mcp — connect AI coding agents to Atlas
+
+Usage:
+  atlas mcp install --cursor | --claude-code | --codex | --vscode [--dir <project>] [--global]
+
+Adds the Atlas MCP server (npx -y @atlasauth/mcp) to the client's config so the
+agent can search and read the Atlas docs. Servers already in the file are kept.
+
+  --cursor        .cursor/mcp.json in the project (~/.cursor/mcp.json with --global)
+  --claude-code   .mcp.json in the project
+  --codex         ~/.codex/config.toml (or $CODEX_HOME/config.toml)
+  --vscode        .vscode/mcp.json in the project
+  --dir <path>    The project directory (default: the current directory)
+
+No key is written. To also manage your instance from the agent, add
+ATLAS_SECRET_KEY to the server's env yourself.`,
     referrals: `atlas referrals — referral attribution
 
 Usage:
@@ -62,15 +109,15 @@ Usage:
         [--metadata-path public_metadata.referral_code] [--wait]
   atlas referrals status
 
-connect --provider referally creates the Atlas connection on Referally with
+connect --provider referally creates the Atlas connection on Referalli with
 your merchant key (bring your own key: used for this one call, never stored or
 printed), saves the connection id and secret on the instance, and runs a ping.
 It requires v2 signatures on the connection from the start and registers a
-Referally webhook that sends referral changes (voided, approved, reassigned…)
+Referalli webhook that sends referral changes (voided, approved, reassigned…)
 back to Atlas; --no-sync skips the webhook. A test key (rk_test_) belongs with a
 development instance and a live key with production: a mismatch is refused
 unless --allow-mode-mismatch. --auto-enroll and --destination are passed to
-Referally. --enable turns referrals on when the ping passes. Prefer --referally-key-file (or
+Referalli. --enable turns referrals on when the ping passes. Prefer --referally-key-file (or
 REFERALLY_API_KEY) to --referally-key: a key on the command line can end up in
 your shell history.
 

package/dist/help.js.map

@@ -1 +1 @@
-{"version":3,"file":"help.js","sourceRoot":"","sources":["../src/help.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEU,QAAA,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wDAwCgC,CAAC;AAEzD,oDAAoD;AACvC,QAAA,YAAY,GAA2B;IAClD,SAAS,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yEAmC4D;IAEvE,KAAK,EAAE;;;;;;mCAM0B;IAEjC,MAAM,EAAE;;uCAE6B;IAErC,MAAM,EAAE;;gDAEsC;IAE9C,KAAK,EAAE;;;;;;wCAM+B;IAEtC,IAAI,EAAE;;;;;uCAK+B;IAErC,UAAU,EAAE;;;;;;8CAMgC;IAE5C,QAAQ,EAAE;;;;;;0EAM8D;IAExE,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;yEA4BiE;IAEvE,SAAS,EAAE;;;;;;oDAMuC;IAElD,GAAG,EAAE;;;;;;;qDAO8C;IAEnD,MAAM,EAAE;;;;;;;;wDAQ8C;IAEtD,QAAQ,EAAE;;;8CAGkC;IAE5C,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;8EAoBoE;IAC5E,OAAO,EAAE;;;;;;;;;;;gFAWqE;CAC/E,CAAC"}
+{"version":3,"file":"help.js","sourceRoot":"","sources":["../src/help.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEU,QAAA,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wDA6CgC,CAAC;AAEzD,oDAAoD;AACvC,QAAA,YAAY,GAA2B;IAClD,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;2EAyBiE;IACzE,GAAG,EAAE;;;;;;;;;;;;;;;+CAewC;IAC7C,SAAS,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yEAmC4D;IAEvE,KAAK,EAAE;;;;;;mCAM0B;IAEjC,MAAM,EAAE;;uCAE6B;IAErC,MAAM,EAAE;;gDAEsC;IAE9C,KAAK,EAAE;;;;;;wCAM+B;IAEtC,IAAI,EAAE;;;;;uCAK+B;IAErC,UAAU,EAAE;;;;;;8CAMgC;IAE5C,QAAQ,EAAE;;;;;;0EAM8D;IAExE,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;yEA4BiE;IAEvE,SAAS,EAAE;;;;;;oDAMuC;IAElD,GAAG,EAAE;;;;;;;qDAO8C;IAEnD,MAAM,EAAE;;;;;;;;wDAQ8C;IAEtD,QAAQ,EAAE;;;8CAGkC;IAE5C,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;8EAoBoE;IAC5E,OAAO,EAAE;;;;;;;;;;;gFAWqE;CAC/E,CAAC"}

package/dist/import/csv.d.ts

@@ -0,0 +1,6 @@
+/**
+ * A small RFC 4180 CSV reader for vendor exports: quoted fields, doubled quotes,
+ * embedded commas and newlines, CRLF. Returns one object per data row keyed by
+ * the header row. No dependency, because the CLI ships none it does not need.
+ */
+export declare function parseCsv(text: string): Array<Record<string, string>>;

package/dist/import/csv.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseCsv = parseCsv;
+/**
+ * A small RFC 4180 CSV reader for vendor exports: quoted fields, doubled quotes,
+ * embedded commas and newlines, CRLF. Returns one object per data row keyed by
+ * the header row. No dependency, because the CLI ships none it does not need.
+ */
+function parseCsv(text) {
+    const rows = [];
+    let row = [];
+    let field = '';
+    let quoted = false;
+    const src = text.charCodeAt(0) === 0xfeff ? text.slice(1) : text;
+    for (let i = 0; i < src.length; i++) {
+        const c = src[i];
+        if (quoted) {
+            if (c === '"') {
+                if (src[i + 1] === '"') {
+                    field += '"';
+                    i++;
+                }
+                else
+                    quoted = false;
+            }
+            else
+                field += c;
+            continue;
+        }
+        if (c === '"')
+            quoted = true;
+        else if (c === ',') {
+            row.push(field);
+            field = '';
+        }
+        else if (c === '\n' || c === '\r') {
+            if (c === '\r' && src[i + 1] === '\n')
+                i++;
+            row.push(field);
+            field = '';
+            if (row.some((v) => v !== ''))
+                rows.push(row);
+            row = [];
+        }
+        else
+            field += c;
+    }
+    row.push(field);
+    if (row.some((v) => v !== ''))
+        rows.push(row);
+    const [header, ...data] = rows;
+    if (!header)
+        return [];
+    const keys = header.map((h) => h.trim());
+    return data.map((cells) => {
+        const out = {};
+        keys.forEach((k, idx) => {
+            out[k] = cells[idx] ?? '';
+        });
+        return out;
+    });
+}
+//# sourceMappingURL=csv.js.map

package/dist/import/csv.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csv.js","sourceRoot":"","sources":["../../src/import/csv.ts"],"names":[],"mappings":";;AAKA,4BA2CC;AAhDD;;;;GAIG;AACH,SAAgB,QAAQ,CAAC,IAAY;IACnC,MAAM,IAAI,GAAe,EAAE,CAAC;IAC5B,IAAI,GAAG,GAAa,EAAE,CAAC;IACvB,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEjE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC;QAClB,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBACd,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBACvB,KAAK,IAAI,GAAG,CAAC;oBACb,CAAC,EAAE,CAAC;gBACN,CAAC;;oBAAM,MAAM,GAAG,KAAK,CAAC;YACxB,CAAC;;gBAAM,KAAK,IAAI,CAAC,CAAC;YAClB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG;YAAE,MAAM,GAAG,IAAI,CAAC;aACxB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACnB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChB,KAAK,GAAG,EAAE,CAAC;QACb,CAAC;aAAM,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACpC,IAAI,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChB,KAAK,GAAG,EAAE,CAAC;YACX,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC9C,GAAG,GAAG,EAAE,CAAC;QACX,CAAC;;YAAM,KAAK,IAAI,CAAC,CAAC;IACpB,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE9C,MAAM,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC/B,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACzC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACxB,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YACtB,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/import/vendors.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Vendor export → Atlas bulk-import rows. Each mapper reads the file format the
+ * vendor's own export produces and returns the rows `POST /v1/user_imports`
+ * accepts, plus warnings for what could not be carried over. Pure functions of
+ * the parsed file, so every mapping is tested from a fixture with no network.
+ */
+export declare const VENDORS: readonly ["auth0", "clerk", "supabase", "firebase", "cognito", "authjs", "workos", "better-auth"];
+export type Vendor = (typeof VENDORS)[number];
+export interface ImportMembershipRow {
+    organization_id?: string;
+    organization_external_id?: string;
+    organization_slug?: string;
+    organization_name?: string;
+    role?: string;
+}
+/** One row of the Atlas import body. Only fields with a value are set. */
+export interface ImportRow {
+    email_address: string;
+    email_verified?: boolean;
+    first_name?: string;
+    last_name?: string;
+    username?: string;
+    external_id?: string;
+    created_at?: string | number;
+    password_hash?: string;
+    password_salt?: string;
+    password_hasher?: string;
+    phone_numbers?: Array<{
+        phone_number: string;
+        verified?: boolean;
+    }>;
+    external_accounts?: Array<{
+        provider: string;
+        provider_user_id: string;
+        email?: string;
+    }>;
+    organization_memberships?: ImportMembershipRow[];
+    public_metadata?: Record<string, unknown>;
+    private_metadata?: Record<string, unknown>;
+    unsafe_metadata?: Record<string, unknown>;
+}
+export interface MappedExport {
+    rows: ImportRow[];
+    /** Human-readable notes: records skipped, data that cannot move, follow-ups. */
+    warnings: string[];
+}
+/** Parse the file text: a JSON document, newline-delimited JSON, or CSV. */
+export declare function parseExport(text: string, fileName?: string): unknown;
+export declare function atlasProvider(raw: string): string;
+/**
+ * Map a parsed vendor export. `hashes` is an optional second file of password
+ * hashes keyed by email (Auth0's support export, WorkOS's, or any `{email,
+ * password_hash}` list), merged onto the rows.
+ */
+export declare function mapExport(vendor: Vendor, doc: unknown, hashes?: unknown): MappedExport;
+/** A one-screen summary of what an import would do (the dry run). */
+export declare function summarize(rows: ImportRow[]): Record<string, number>;