@atlasauth/cli 0.5.0 → 0.7.0

package/dist/commands/migrate.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.migrate = migrate;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const upgrade_1 = require("@atlasauth/upgrade");
+const args_1 = require("../args");
+const errors_1 = require("../errors");
+const output_1 = require("../output");
+const shared_1 = require("./shared");
+/**
+ * `atlas migrate code --from <vendor> [path]` — rewrite an app's auth code onto
+ * Atlas (Clerk, Auth.js/NextAuth, Supabase Auth, Auth0, Better Auth).
+ *
+ * Safe by default: without `--yes` it is a dry run that prints the diff of every
+ * file it would change plus a report of what it could not rewrite (file:line).
+ * `--yes` writes the changes. Running it again over migrated code changes nothing.
+ * Users move separately, with `atlas import --from <vendor>`.
+ */
+async function migrate(ctx, args) {
+    const sub = args.positionals[1];
+    if (sub !== 'code') {
+        throw new errors_1.CliError(sub ? `Unknown subcommand 'migrate ${sub}'. Try: code.` : 'migrate needs a subcommand: code.');
+    }
+    const raw = (0, args_1.str)(args.values, 'from');
+    const vendor = (0, upgrade_1.resolveVendor)(raw);
+    if (!vendor) {
+        throw new errors_1.CliError(raw
+            ? `Unknown --from '${raw}'. Use one of: ${upgrade_1.MIGRATE_VENDORS.join(', ')}.`
+            : `migrate code needs --from <${upgrade_1.MIGRATE_VENDORS.join('|')}>.`);
+    }
+    const target = (0, node_path_1.resolve)(args.positionals[2] ?? process.cwd());
+    if (!(0, node_fs_1.existsSync)(target))
+        throw new errors_1.CliError(`Path not found: ${target}`);
+    const write = args.values.yes === true && args.values['dry-run'] !== true;
+    const result = (0, upgrade_1.runMigration)(target, { from: vendor, write });
+    if ((0, shared_1.wantsJson)(args.values)) {
+        (0, output_1.printJson)(ctx.io, {
+            object: 'code_migration',
+            vendor: result.vendor,
+            written: write,
+            env_style: result.envStyle,
+            files_scanned: result.filesScanned,
+            files_changed: result.filesChanged,
+            rewrites: result.rewrites,
+            changes: result.changes.map((c) => ({ path: c.path, diff: (0, upgrade_1.unifiedDiff)(c.before, c.after, c.path) })),
+            manual: result.manual,
+            packages: result.packages,
+            env_to_set: result.envToSet,
+        });
+        return 0;
+    }
+    for (const change of result.changes) {
+        if (write)
+            ctx.io.out(`updated ${change.path}`);
+        else {
+            ctx.io.out((0, upgrade_1.unifiedDiff)(change.before, change.after, change.path));
+            ctx.io.out('');
+        }
+    }
+    for (const line of (0, upgrade_1.formatMigration)(result, { written: write }))
+        ctx.io.out(line);
+    return 0;
+}
+//# sourceMappingURL=migrate.js.map

package/dist/commands/migrate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.js","sourceRoot":"","sources":["../../src/commands/migrate.ts"],"names":[],"mappings":";;AAkBA,0BA8CC;AAhED,qCAAqC;AACrC,yCAAoC;AACpC,gDAAgH;AAChH,kCAA+C;AAE/C,sCAAqC;AACrC,sCAAsC;AACtC,qCAAqC;AAErC;;;;;;;;GAQG;AACI,KAAK,UAAU,OAAO,CAAC,GAAe,EAAE,IAAgB;IAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACnB,MAAM,IAAI,iBAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,+BAA+B,GAAG,eAAe,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC;IACpH,CAAC;IACD,MAAM,GAAG,GAAG,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,IAAA,uBAAa,EAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,iBAAQ,CAChB,GAAG;YACD,CAAC,CAAC,mBAAmB,GAAG,kBAAkB,yBAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACvE,CAAC,CAAC,8BAA8B,yBAAe,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAChE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,mBAAO,EAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC,IAAA,oBAAU,EAAC,MAAM,CAAC;QAAE,MAAM,IAAI,iBAAQ,CAAC,mBAAmB,MAAM,EAAE,CAAC,CAAC;IAEzE,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC;IAC1E,MAAM,MAAM,GAAG,IAAA,sBAAY,EAAC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAE7D,IAAI,IAAA,kBAAS,EAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE;YAChB,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,KAAK;YACd,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAA,qBAAW,EAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACpG,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,MAAM,CAAC,QAAQ;SAC5B,CAAC,CAAC;QACH,OAAO,CAAC,CAAC;IACX,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpC,IAAI,KAAK;YAAE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;aAC3C,CAAC;YACJ,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAA,qBAAW,EAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YAClE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,IAAA,yBAAe,EAAC,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAAE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjF,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/commands/referrals.d.ts

@@ -4,12 +4,12 @@ import type { RunContext } from '../context';
  * `atlas referrals connect | backfill | status`: referral attribution from the
  * terminal.
  *
- * `connect --provider referally` is bring-your-own-key: the Referally merchant
- * key is used for one call (it creates the Atlas connection on Referally) and
- * is never stored or printed. The connection id and secret Referally returns
+ * `connect --provider referally` is bring-your-own-key: the Referalli merchant
+ * key is used for one call (it creates the Atlas connection on Referalli) and
+ * is never stored or printed. The connection id and secret Referalli returns
  * go straight onto the instance; the secret is never printed either.
  */
-/** The Referally API version pinned on every call. */
+/** The Referalli API version pinned on every call. */
 export declare const REFERALLY_VERSION = "2026-10-21";
 interface PingRead {
     ok?: boolean;
@@ -36,12 +36,12 @@ export declare function pingSkewMs(ping: PingRead, receivedAt: number, latencyMs
 export declare function describeTestLines(test: TestRead, receivedAt: number): string[];
 /** A `customerRef,code` CSV → map; throws on a bad line. A header row is skipped. */
 export declare function parseCodeCsv(text: string): Record<string, string>;
-/** The Referally topics two-way sync subscribes to (changes to a referral after sign-up). */
+/** The Referalli topics two-way sync subscribes to (changes to a referral after sign-up). */
 export declare const REFERALLY_SYNC_TOPICS: readonly ["referral.created", "referral.held", "referral.paused", "referral.resumed", "referral.approved", "referral.voided", "referral.reassigned"];
 /**
  * Whether the merchant key reaches live or test data: the org's `livemode`,
  * else the key prefix (rk_test_ = test; rk_live_ and older rk_ keys = live).
- * `known` is false when Referally reports no mode (no test mode there).
+ * `known` is false when Referalli reports no mode (no test mode there).
  */
 export declare function referallyKeyMode(ctx: RunContext, input: {
     baseUrl: string;

package/dist/commands/referrals.js

@@ -19,12 +19,12 @@ const shared_1 = require("./shared");
  * `atlas referrals connect | backfill | status`: referral attribution from the
  * terminal.
  *
- * `connect --provider referally` is bring-your-own-key: the Referally merchant
- * key is used for one call (it creates the Atlas connection on Referally) and
- * is never stored or printed. The connection id and secret Referally returns
+ * `connect --provider referally` is bring-your-own-key: the Referalli merchant
+ * key is used for one call (it creates the Atlas connection on Referalli) and
+ * is never stored or printed. The connection id and secret Referalli returns
  * go straight onto the instance; the secret is never printed either.
  */
-/** The Referally API version pinned on every call. */
+/** The Referalli API version pinned on every call. */
 exports.REFERALLY_VERSION = '2026-10-21';
 const PROVIDERS = ['referally', 'webhook'];
 /** Read a key from a file, or stdin with '-'. A bare key or a dotenv line. Never printed. */
@@ -113,7 +113,7 @@ function parseCodeCsv(text) {
     });
     return out;
 }
-/** One call to the Referally merchant API with the merchant key. Throws a CliError naming `what` on failure. */
+/** One call to the Referalli merchant API with the merchant key. Throws a CliError naming `what` on failure. */
 async function referallyRequest(ctx, input) {
     const fetchImpl = ctx.fetch ?? globalThis.fetch;
     let res;
@@ -130,7 +130,7 @@ async function referallyRequest(ctx, input) {
         });
     }
     catch (err) {
-        throw new errors_1.CliError(`Could not reach Referally at ${input.baseUrl}: ${err instanceof Error ? err.message : String(err)}`);
+        throw new errors_1.CliError(`Could not reach Referalli at ${input.baseUrl}: ${err instanceof Error ? err.message : String(err)}`);
     }
     const text = await res.text();
     let json = {};
@@ -146,18 +146,18 @@ async function referallyRequest(ctx, input) {
             (Array.isArray(err) && err[0] && typeof err[0] === 'object' && 'message' in err[0] ? String(err[0].message) : null) ??
             (typeof json.message === 'string' ? json.message : null);
         const hint = res.status === 401 || res.status === 403 ? ' Check the merchant key.' : '';
-        throw new errors_1.CliError(`Referally refused to ${input.what} (HTTP ${res.status})${msg ? `: ${msg}` : ''}.${hint}`);
+        throw new errors_1.CliError(`Referalli refused to ${input.what} (HTTP ${res.status})${msg ? `: ${msg}` : ''}.${hint}`);
     }
     return json;
 }
 async function referallyCreateConnection(ctx, input) {
     const json = await referallyRequest(ctx, { ...input, method: 'POST', path: '/v1/auth/connections', what: 'create the connection' });
     if (typeof json.id !== 'string' || typeof json.secret !== 'string') {
-        throw new errors_1.CliError('Referally answered without a connection id and secret.');
+        throw new errors_1.CliError('Referalli answered without a connection id and secret.');
     }
     return json;
 }
-/** The Referally topics two-way sync subscribes to (changes to a referral after sign-up). */
+/** The Referalli topics two-way sync subscribes to (changes to a referral after sign-up). */
 exports.REFERALLY_SYNC_TOPICS = [
     'referral.created',
     'referral.held',
@@ -170,7 +170,7 @@ exports.REFERALLY_SYNC_TOPICS = [
 /**
  * Whether the merchant key reaches live or test data: the org's `livemode`,
  * else the key prefix (rk_test_ = test; rk_live_ and older rk_ keys = live).
- * `known` is false when Referally reports no mode (no test mode there).
+ * `known` is false when Referalli reports no mode (no test mode there).
  */
 async function referallyKeyMode(ctx, input) {
     try {
@@ -206,12 +206,12 @@ async function connect(ctx, args) {
             throw new errors_1.CliError('referrals connect --provider referally needs --program <prg_…>.');
         const baseRaw = (0, args_1.str)(v, 'base-url') ?? ctx.env.REFERALLY_BASE_URL?.trim();
         if (!baseRaw)
-            throw new errors_1.CliError('Pass --base-url <your Referally base URL> (or set REFERALLY_BASE_URL).');
+            throw new errors_1.CliError('Pass --base-url <your Referalli base URL> (or set REFERALLY_BASE_URL).');
         const baseUrl = httpsUrl(baseRaw, '--base-url');
         const keyFile = (0, args_1.str)(v, 'referally-key-file');
-        const key = (0, args_1.str)(v, 'referally-key') ?? (keyFile ? readKeyFile(ctx, keyFile, 'the Referally key') : ctx.env.REFERALLY_API_KEY?.trim());
+        const key = (0, args_1.str)(v, 'referally-key') ?? (keyFile ? readKeyFile(ctx, keyFile, 'the Referalli key') : ctx.env.REFERALLY_API_KEY?.trim());
         if (!key) {
-            throw new errors_1.CliError('Pass your Referally merchant key with --referally-key-file <path|-> (or --referally-key, or REFERALLY_API_KEY). It is used once and never stored.');
+            throw new errors_1.CliError('Pass your Referalli merchant key with --referally-key-file <path|-> (or --referally-key, or REFERALLY_API_KEY). It is used once and never stored.');
         }
         const destination = (0, args_1.str)(v, 'destination');
         if (destination)
@@ -222,7 +222,7 @@ async function connect(ctx, args) {
         const instanceLive = instance.environment === 'production';
         const mode = await referallyKeyMode(ctx, { baseUrl, key });
         if (mode.known && mode.live !== instanceLive) {
-            const message = `the Referally key reaches ${mode.live ? 'live' : 'test'} data but instance ${instance.id} is ` +
+            const message = `the Referalli key reaches ${mode.live ? 'live' : 'test'} data but instance ${instance.id} is ` +
                 `${instance.environment ?? 'not production'}. Use ${instanceLive ? 'a live (rk_live_…)' : 'a test (rk_test_…)'} key` +
                 ` for it, or pass --allow-mode-mismatch.`;
             if (v['allow-mode-mismatch'] !== true)
@@ -230,7 +230,7 @@ async function connect(ctx, args) {
             ctx.io.err(`atlas: warning: ${message.replace(/, or pass --allow-mode-mismatch\.$/, '.')}`);
         }
         else if (!mode.known && !instanceLive) {
-            ctx.io.err(`atlas: warning: Referally did not say whether this key reaches test data; instance ${instance.id} is ${instance.environment ?? 'not production'}.`);
+            ctx.io.err(`atlas: warning: Referalli did not say whether this key reaches test data; instance ${instance.id} is ${instance.environment ?? 'not production'}.`);
         }
         const created = await referallyCreateConnection(ctx, {
             baseUrl,
@@ -274,21 +274,21 @@ async function connect(ctx, args) {
             saved = await http.patch('/v1/instance/referrals', patch);
         }
         catch (err) {
-            // The secret is shown once by Referally: keep it so the merchant can finish by hand.
+            // The secret is shown once by Referalli: keep it so the merchant can finish by hand.
             const saved = (0, secrets_1.deliverSecret)({
                 io: out,
                 env: ctx.env,
                 product,
                 fileName: `referally-connection-${created.id}.env`,
                 entries: { REFERALLY_CONNECTION_ID: created.id, REFERALLY_CONNECTION_SECRET: created.secret },
-                label: 'The Referally connection secret (not saved on Atlas)',
+                label: 'The Referalli connection secret (not saved on Atlas)',
                 force: v.force === true,
-                comment: `Referally connection ${created.id}: saving it on the Atlas instance failed. Paste it in Users → Referrals.`,
+                comment: `Referalli connection ${created.id}: saving it on the Atlas instance failed. Paste it in Users → Referrals.`,
             });
-            ctx.io.err(`atlas: the connection ${created.id} was created on Referally, but saving it on the instance failed.${saved.path ? ` Its secret is in ${saved.path}.` : ''}`);
+            ctx.io.err(`atlas: the connection ${created.id} was created on Referalli, but saving it on the instance failed.${saved.path ? ` Its secret is in ${saved.path}.` : ''}`);
             throw err;
         }
-        // Two-way sync: Referally's referral events go to the instance's inbound URL.
+        // Two-way sync: Referalli's referral events go to the instance's inbound URL.
         let syncEndpoint = null;
         const inboundUrl = saved?.inbound?.url ?? null;
         if (v['no-sync'] !== true && inboundUrl) {
@@ -302,7 +302,7 @@ async function connect(ctx, args) {
                     what: 'register the referral event webhook',
                 });
                 if (typeof endpoint.id !== 'string' || typeof endpoint.secret !== 'string') {
-                    throw new errors_1.CliError('Referally answered without a webhook endpoint id and secret.');
+                    throw new errors_1.CliError('Referalli answered without a webhook endpoint id and secret.');
                 }
                 try {
                     await http.patch('/v1/instance/referrals', { inbound_secret: endpoint.secret, inbound_endpoint_id: endpoint.id });
@@ -315,17 +315,17 @@ async function connect(ctx, args) {
                         product,
                         fileName: `referally-webhook-${endpoint.id}.env`,
                         entries: { REFERALLY_WEBHOOK_ENDPOINT_ID: endpoint.id, REFERALLY_WEBHOOK_SECRET: endpoint.secret },
-                        label: 'The Referally webhook secret (not saved on Atlas)',
+                        label: 'The Referalli webhook secret (not saved on Atlas)',
                         force: v.force === true,
-                        comment: `Referally webhook ${endpoint.id}: saving it on the Atlas instance failed. Paste it as the inbound secret in Users → Referrals.`,
+                        comment: `Referalli webhook ${endpoint.id}: saving it on the Atlas instance failed. Paste it as the inbound secret in Users → Referrals.`,
                     });
-                    ctx.io.err(`atlas: warning: the webhook ${endpoint.id} was registered on Referally, but saving its secret failed (${err instanceof Error ? err.message : String(err)}).${kept.path ? ` It is in ${kept.path}.` : ''}`);
+                    ctx.io.err(`atlas: warning: the webhook ${endpoint.id} was registered on Referalli, but saving its secret failed (${err instanceof Error ? err.message : String(err)}).${kept.path ? ` It is in ${kept.path}.` : ''}`);
                 }
             }
             catch (err) {
                 if (!(err instanceof errors_1.CliError))
                     throw err;
-                ctx.io.err(`atlas: warning: ${err.message} Referral changes on Referally won't reach Atlas until it is registered (see the docs).`);
+                ctx.io.err(`atlas: warning: ${err.message} Referral changes on Referalli won't reach Atlas until it is registered (see the docs).`);
             }
         }
         summary = {
@@ -340,9 +340,9 @@ async function connect(ctx, args) {
             sync_endpoint_id: syncEndpoint,
         };
         if (!json) {
-            out.out(`Created Referally connection ${created.id} for instance ${instance.id} and saved it (the secret was not printed).`);
+            out.out(`Created Referalli connection ${created.id} for instance ${instance.id} and saved it (the secret was not printed).`);
             if (syncEndpoint)
-                out.out(`Referral changes on Referally sync back to Atlas (webhook ${syncEndpoint}).`);
+                out.out(`Referral changes on Referalli sync back to Atlas (webhook ${syncEndpoint}).`);
         }
     }
     else {
@@ -516,7 +516,7 @@ async function status(ctx, args) {
         lines.push(`Failed (7 days):      ${c.failed_calls_7d ?? 0}    Retrying: ${c.retrying_calls ?? 0}`);
     const inbound = settings.inbound;
     if (inbound?.url) {
-        // Referally needs its own webhook secret; the Atlas protocol falls back to the signing secret.
+        // Referalli needs its own webhook secret; the Atlas protocol falls back to the signing secret.
         const syncing = inbound.secret_set || (settings.provider === 'webhook' && settings.signing_secret_set);
         lines.push(`Two-way sync:         ${syncing ? 'on' : 'off (no inbound secret)'}${inbound.endpoint_id ? ` (webhook ${inbound.endpoint_id})` : ''}`);
         lines.push(`Inbound URL:          ${inbound.url}`);

package/dist/context.d.ts

@@ -9,7 +9,7 @@ import { type Prompter } from './prompt';
  * enforces — that the command set maps only onto namespaces that really exist,
  * and it keeps the fake a test injects small (five namespaces, not forty).
  */
-export type ManagementClient = Pick<AtlasClient, 'users' | 'organizations' | 'apiKeys' | 'webhooks' | 'sessions' | 'actions'>;
+export type ManagementClient = Pick<AtlasClient, 'users' | 'organizations' | 'apiKeys' | 'webhooks' | 'sessions' | 'actions' | 'actionGallery' | 'actionTemplates'>;
 /**
  * Everything a command touches the outside world through, in one injectable
  * bag. Production wires the real IO/config/prompt/client; every test builds

package/dist/help.d.ts

@@ -3,6 +3,6 @@
  * out of the handlers so the dispatch code stays about control flow and the
  * copy can be read (and kept consistent) in one place.
  */
-export declare const TOP_HELP = "atlas \u2014 manage an Atlas instance from the terminal\n\nUsage: atlas <command> [subcommand] [arguments] [options]\n\nCommands:\n  login                      Authenticate and store a profile credential\n  logout                     Remove a stored profile credential\n  whoami                     Show the active profile and instance\n  users list|get|create|delete\n  orgs list|get|members\n  api-keys list|create|revoke\n  webhooks list|create\n  sessions revoke\n  config export|import       Config-as-code: round-trip the instance's config\n  actions list|deploy|test|logs\n  init                       Create or complete an app's setup (idempotent); secrets to 0600 files\n  preflight                  Check an instance's setup; non-zero exit on errors (for CI)\n  env                        Print deploy variables: public values + secret file paths\n  client rotate              Rotate an OAuth client secret straight into its file\n  referrals connect|backfill|status\n                             Connect a referral platform, backfill, check the connection\n\nGlobal options:\n  --profile <name>           Use a named profile (default: active, else \"default\")\n  --json                     Emit raw JSON instead of a human table\n  --limit <n>                Page size for list commands that paginate\n  --starting-after <cursor>  Pagination cursor (from a prior page's hint)\n  -h, --help                 Show this help, or help for a command\n  -v, --version              Print the version\n\nEnvironment overrides:\n  ATLAS_SECRET_KEY           Secret key to use instead of the stored one\n  ATLAS_API_URL              API URL to use instead of the stored one\n  ATLAS_PLATFORM_KEY         Platform key (psk_) for atlas init\n  REFERALLY_BASE_URL         Referally base URL for atlas referrals connect\n  REFERALLY_API_KEY          Referally merchant key for atlas referrals connect (never stored)\n\nSecrets: a command that receives a secret writes it to a 0600 file under\n~/.config/<product>/ and prints only the path. --print-secret prints it instead.\n\nRun 'atlas <command> --help' for command-specific help.";
+export declare const TOP_HELP = "atlas \u2014 manage an Atlas instance from the terminal\n\nUsage: atlas <command> [subcommand] [arguments] [options]\n\nCommands:\n  login                      Authenticate and store a profile credential\n  logout                     Remove a stored profile credential\n  whoami                     Show the active profile and instance\n  users list|get|create|delete\n  orgs list|get|members\n  api-keys list|create|revoke\n  webhooks list|create\n  sessions revoke\n  config export|import       Config-as-code: round-trip the instance's config\n  actions list|deploy|test|logs|gallery|show|install|installs|update|publish\n  init                       Create or complete an app's setup (idempotent); secrets to 0600 files\n  preflight                  Check an instance's setup; non-zero exit on errors (for CI)\n  env                        Print deploy variables: public values + secret file paths\n  client rotate              Rotate an OAuth client secret straight into its file\n  referrals connect|backfill|status\n                             Connect a referral platform, backfill, check the connection\n  import --from <vendor> <file>\n                             Move users from Auth0, Clerk, Supabase, Firebase, Cognito,\n                             Auth.js, WorkOS or Better Auth (resumable; --dry-run first)\n  migrate code --from <vendor> [path]\n                             Rewrite an app's auth code onto Atlas (Clerk, Auth.js,\n                             Supabase, Auth0, Better Auth); a dry run with a diff unless --yes\n  info [path]                Print the environment for a support ticket (versions, SDKs,\n                             instance, API latency, preflight); secrets redacted\n  mcp install                Add the Atlas MCP server (docs search) to Cursor, Claude Code,\n                             Codex or VS Code\n\nGlobal options:\n  --profile <name>           Use a named profile (default: active, else \"default\")\n  --json                     Emit raw JSON instead of a human table\n  --limit <n>                Page size for list commands that paginate\n  --starting-after <cursor>  Pagination cursor (from a prior page's hint)\n  -h, --help                 Show this help, or help for a command\n  -v, --version              Print the version\n\nEnvironment overrides:\n  ATLAS_SECRET_KEY           Secret key to use instead of the stored one\n  ATLAS_API_URL              API URL to use instead of the stored one\n  ATLAS_PLATFORM_KEY         Platform key (psk_) for atlas init\n  REFERALLY_BASE_URL         Referalli base URL for atlas referrals connect\n  REFERALLY_API_KEY          Referalli merchant key for atlas referrals connect (never stored)\n\nSecrets: a command that receives a secret writes it to a 0600 file under\n~/.config/<product>/ and prints only the path. --print-secret prints it instead.\n\nRun 'atlas <command> --help' for command-specific help.";
 /** Per-command help, keyed by the resource word. */
 export declare const COMMAND_HELP: Record<string, string>;

package/dist/help.js

@@ -20,13 +20,23 @@ Commands:
   webhooks list|create
   sessions revoke
   config export|import       Config-as-code: round-trip the instance's config
-  actions list|deploy|test|logs
+  actions list|deploy|test|logs|gallery|show|install|installs|update|publish
   init                       Create or complete an app's setup (idempotent); secrets to 0600 files
   preflight                  Check an instance's setup; non-zero exit on errors (for CI)
   env                        Print deploy variables: public values + secret file paths
   client rotate              Rotate an OAuth client secret straight into its file
   referrals connect|backfill|status
                              Connect a referral platform, backfill, check the connection
+  import --from <vendor> <file>
+                             Move users from Auth0, Clerk, Supabase, Firebase, Cognito,
+                             Auth.js, WorkOS or Better Auth (resumable; --dry-run first)
+  migrate code --from <vendor> [path]
+                             Rewrite an app's auth code onto Atlas (Clerk, Auth.js,
+                             Supabase, Auth0, Better Auth); a dry run with a diff unless --yes
+  info [path]                Print the environment for a support ticket (versions, SDKs,
+                             instance, API latency, preflight); secrets redacted
+  mcp install                Add the Atlas MCP server (docs search) to Cursor, Claude Code,
+                             Codex or VS Code
 
 Global options:
   --profile <name>           Use a named profile (default: active, else "default")
@@ -40,8 +50,8 @@ Environment overrides:
   ATLAS_SECRET_KEY           Secret key to use instead of the stored one
   ATLAS_API_URL              API URL to use instead of the stored one
   ATLAS_PLATFORM_KEY         Platform key (psk_) for atlas init
-  REFERALLY_BASE_URL         Referally base URL for atlas referrals connect
-  REFERALLY_API_KEY          Referally merchant key for atlas referrals connect (never stored)
+  REFERALLY_BASE_URL         Referalli base URL for atlas referrals connect
+  REFERALLY_API_KEY          Referalli merchant key for atlas referrals connect (never stored)
 
 Secrets: a command that receives a secret writes it to a 0600 file under
 ~/.config/<product>/ and prints only the path. --print-secret prints it instead.
@@ -49,6 +59,85 @@ Secrets: a command that receives a secret writes it to a 0600 file under
 Run 'atlas <command> --help' for command-specific help.`;
 /** Per-command help, keyed by the resource word. */
 exports.COMMAND_HELP = {
+    migrate: `atlas migrate code — rewrite an app's auth code onto Atlas
+
+Usage:
+  atlas migrate code --from <vendor> [path] [--yes] [--json]
+
+Vendors:
+  clerk        @clerk/* SDKs
+  authjs       Auth.js / NextAuth (next-auth v4 and v5, @auth/*)
+  supabase     Supabase Auth (supabase.auth.*, auth-helpers, auth-ui); the
+               Supabase client itself stays for your database
+  auth0        @auth0/auth0-react, @auth0/nextjs-auth0 (v3 and v4), @auth0/auth0-spa-js
+  better-auth  better-auth (client, server, Next.js handler, cookies)
+
+What it rewrites: imports, providers, hooks, server session helpers, middleware,
+sign-in/out calls and env var names, onto native Atlas APIs and the drop-in
+compat helpers in @atlasauth/react/compat and @atlasauth/nextjs/compat that keep the
+old shapes. Everything it cannot rewrite is listed with file:line and marked in
+code with TODO(atlas-migrate).
+
+Options:
+  --yes                  Write the changes (without it: a dry run printing the diff)
+  --dry-run              Force a dry run even with --yes
+  --json                 Machine-readable result (diffs, report, packages, env)
+
+Safe to re-run: migrated code is left as it is. Move your users with
+'atlas import --from <vendor> <export-file>'.`,
+    info: `atlas info — the environment, for support tickets
+
+Usage:
+  atlas info [path] [--json] [--product <name> | --instance <id>]
+
+Prints the CLI, Node and OS versions; the project's framework and Atlas SDK
+packages with the installed version and whether npm has a newer one; the
+configured instance (key prefixes only, never a key) and whether the app's
+publishable key belongs to it; API reachability and latency; and the
+instance's preflight summary. Network steps time out after 5 s and are
+reported, not fatal. Anything shaped like a secret is redacted.`,
+    import: `atlas import — move users from another auth provider
+
+Usage:
+  atlas import --from <vendor> <export-file> [--dry-run]
+
+Vendors and the file each one reads:
+  auth0        the user export job (NDJSON/JSON); --hashes <file> merges the password export
+  clerk        the dashboard CSV export, or users JSON from the Backend API
+  supabase     auth.users rows as CSV or JSON (with an identities array for social links)
+  firebase     firebase auth:export --format=json; needs --hash-config <file>
+  cognito      aws cognito-idp list-users JSON, or the user-pool CSV
+  authjs       the adapter's users + accounts tables as JSON
+  workos       User Management users JSON (+ organization_memberships)
+  better-auth  JSON of the user, account, member and organization tables
+
+Options:
+  --dry-run              Map and summarise only; nothing is sent
+  --batch-size <n>       Users per request, 1-100 (default 100)
+  --state-file <file>    Progress file (default <export-file>.atlas-import.json); re-running resumes
+  --hash-config <file>   Firebase hash parameters: {signer_key, salt_separator, rounds, mem_cost}
+  --hashes <file>        Password hashes keyed by email, merged onto the users
+  --create-orgs          Create organizations that memberships name but that do not exist yet
+  --json                 Machine-readable summary
+
+Batches are sent with upsert, so a resumed or repeated run never duplicates a
+user or a membership. Exit code 2 means some rows were reported as issues.`,
+    mcp: `atlas mcp — connect AI coding agents to Atlas
+
+Usage:
+  atlas mcp install --cursor | --claude-code | --codex | --vscode [--dir <project>] [--global]
+
+Adds the Atlas MCP server (npx -y @atlasauth/mcp) to the client's config so the
+agent can search and read the Atlas docs. Servers already in the file are kept.
+
+  --cursor        .cursor/mcp.json in the project (~/.cursor/mcp.json with --global)
+  --claude-code   .mcp.json in the project
+  --codex         ~/.codex/config.toml (or $CODEX_HOME/config.toml)
+  --vscode        .vscode/mcp.json in the project
+  --dir <path>    The project directory (default: the current directory)
+
+No key is written. To also manage your instance from the agent, add
+ATLAS_SECRET_KEY to the server's env yourself.`,
     referrals: `atlas referrals — referral attribution
 
 Usage:
@@ -62,15 +151,15 @@ Usage:
         [--metadata-path public_metadata.referral_code] [--wait]
   atlas referrals status
 
-connect --provider referally creates the Atlas connection on Referally with
+connect --provider referally creates the Atlas connection on Referalli with
 your merchant key (bring your own key: used for this one call, never stored or
 printed), saves the connection id and secret on the instance, and runs a ping.
 It requires v2 signatures on the connection from the start and registers a
-Referally webhook that sends referral changes (voided, approved, reassigned…)
+Referalli webhook that sends referral changes (voided, approved, reassigned…)
 back to Atlas; --no-sync skips the webhook. A test key (rk_test_) belongs with a
 development instance and a live key with production: a mismatch is refused
 unless --allow-mode-mismatch. --auto-enroll and --destination are passed to
-Referally. --enable turns referrals on when the ping passes. Prefer --referally-key-file (or
+Referalli. --enable turns referrals on when the ping passes. Prefer --referally-key-file (or
 REFERALLY_API_KEY) to --referally-key: a key on the command line can end up in
 your shell history.
 
@@ -211,9 +300,24 @@ Usage:
   atlas actions test <file> [--trigger <t>] [--json]
   atlas actions logs <action-id> [--json]
 
+  atlas actions gallery [query] [--trigger <t>] [--json]
+  atlas actions show <slug> [--json]
+  atlas actions install <slug> [--name <n>] [--secrets-file <dotenv>] [--json]
+  atlas actions installs [--json]
+  atlas actions update <action-id> [--secrets-file <dotenv>] [--json]
+  atlas actions publish <template.json> [--draft] [--json]
+
 deploy uploads the file's code verbatim as a new action (created, not yet bound).
 test runs the file OFFLINE through the @atlasauth/actions harness — no network,
 no real users — and exits non-zero if the action throws. logs explains where an
-action's execution history is recorded (Atlas has no live log-stream endpoint).`,
+action's execution history is recorded (Atlas has no live log-stream endpoint).
+
+The gallery: gallery lists first-party and community templates; install copies
+one into the instance as a DISABLED, unbound action (secret values come from a
+dotenv file, never argv); installs shows which actions came from the gallery
+and whether a newer version exists; update moves one to the latest version.
+publish reads a manifest {slug, name, author_name, summary, description,
+category, tags, trigger, license, version, code_file, secrets, changelog},
+creates the template or adds the version, and submits it for review.`,
 };
 //# sourceMappingURL=help.js.map

package/dist/help.js.map

@@ -1 +1 @@
-{"version":3,"file":"help.js","sourceRoot":"","sources":["../src/help.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEU,QAAA,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wDAwCgC,CAAC;AAEzD,oDAAoD;AACvC,QAAA,YAAY,GAA2B;IAClD,SAAS,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yEAmC4D;IAEvE,KAAK,EAAE;;;;;;mCAM0B;IAEjC,MAAM,EAAE;;uCAE6B;IAErC,MAAM,EAAE;;gDAEsC;IAE9C,KAAK,EAAE;;;;;;wCAM+B;IAEtC,IAAI,EAAE;;;;;uCAK+B;IAErC,UAAU,EAAE;;;;;;8CAMgC;IAE5C,QAAQ,EAAE;;;;;;0EAM8D;IAExE,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;yEA4BiE;IAEvE,SAAS,EAAE;;;;;;oDAMuC;IAElD,GAAG,EAAE;;;;;;;qDAO8C;IAEnD,MAAM,EAAE;;;;;;;;wDAQ8C;IAEtD,QAAQ,EAAE;;;8CAGkC;IAE5C,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;8EAoBoE;IAC5E,OAAO,EAAE;;;;;;;;;;;gFAWqE;CAC/E,CAAC"}
+{"version":3,"file":"help.js","sourceRoot":"","sources":["../src/help.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEU,QAAA,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wDAkDgC,CAAC;AAEzD,oDAAoD;AACvC,QAAA,YAAY,GAA2B;IAClD,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;8CAyBmC;IAC5C,IAAI,EAAE;;;;;;;;;;gEAUwD;IAC9D,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;2EAyBiE;IACzE,GAAG,EAAE;;;;;;;;;;;;;;;+CAewC;IAC7C,SAAS,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yEAmC4D;IAEvE,KAAK,EAAE;;;;;;mCAM0B;IAEjC,MAAM,EAAE;;uCAE6B;IAErC,MAAM,EAAE;;gDAEsC;IAE9C,KAAK,EAAE;;;;;;wCAM+B;IAEtC,IAAI,EAAE;;;;;uCAK+B;IAErC,UAAU,EAAE;;;;;;8CAMgC;IAE5C,QAAQ,EAAE;;;;;;0EAM8D;IAExE,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;yEA4BiE;IAEvE,SAAS,EAAE;;;;;;oDAMuC;IAElD,GAAG,EAAE;;;;;;;qDAO8C;IAEnD,MAAM,EAAE;;;;;;;;wDAQ8C;IAEtD,QAAQ,EAAE;;;8CAGkC;IAE5C,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;8EAoBoE;IAC5E,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;qEA0B0D;CACpE,CAAC"}

package/dist/import/csv.d.ts

@@ -0,0 +1,6 @@
+/**
+ * A small RFC 4180 CSV reader for vendor exports: quoted fields, doubled quotes,
+ * embedded commas and newlines, CRLF. Returns one object per data row keyed by
+ * the header row. No dependency, because the CLI ships none it does not need.
+ */
+export declare function parseCsv(text: string): Array<Record<string, string>>;

package/dist/import/csv.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseCsv = parseCsv;
+/**
+ * A small RFC 4180 CSV reader for vendor exports: quoted fields, doubled quotes,
+ * embedded commas and newlines, CRLF. Returns one object per data row keyed by
+ * the header row. No dependency, because the CLI ships none it does not need.
+ */
+function parseCsv(text) {
+    const rows = [];
+    let row = [];
+    let field = '';
+    let quoted = false;
+    const src = text.charCodeAt(0) === 0xfeff ? text.slice(1) : text;
+    for (let i = 0; i < src.length; i++) {
+        const c = src[i];
+        if (quoted) {
+            if (c === '"') {
+                if (src[i + 1] === '"') {
+                    field += '"';
+                    i++;
+                }
+                else
+                    quoted = false;
+            }
+            else
+                field += c;
+            continue;
+        }
+        if (c === '"')
+            quoted = true;
+        else if (c === ',') {
+            row.push(field);
+            field = '';
+        }
+        else if (c === '\n' || c === '\r') {
+            if (c === '\r' && src[i + 1] === '\n')
+                i++;
+            row.push(field);
+            field = '';
+            if (row.some((v) => v !== ''))
+                rows.push(row);
+            row = [];
+        }
+        else
+            field += c;
+    }
+    row.push(field);
+    if (row.some((v) => v !== ''))
+        rows.push(row);
+    const [header, ...data] = rows;
+    if (!header)
+        return [];
+    const keys = header.map((h) => h.trim());
+    return data.map((cells) => {
+        const out = {};
+        keys.forEach((k, idx) => {
+            out[k] = cells[idx] ?? '';
+        });
+        return out;
+    });
+}
+//# sourceMappingURL=csv.js.map

package/dist/import/csv.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csv.js","sourceRoot":"","sources":["../../src/import/csv.ts"],"names":[],"mappings":";;AAKA,4BA2CC;AAhDD;;;;GAIG;AACH,SAAgB,QAAQ,CAAC,IAAY;IACnC,MAAM,IAAI,GAAe,EAAE,CAAC;IAC5B,IAAI,GAAG,GAAa,EAAE,CAAC;IACvB,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEjE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC;QAClB,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBACd,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBACvB,KAAK,IAAI,GAAG,CAAC;oBACb,CAAC,EAAE,CAAC;gBACN,CAAC;;oBAAM,MAAM,GAAG,KAAK,CAAC;YACxB,CAAC;;gBAAM,KAAK,IAAI,CAAC,CAAC;YAClB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG;YAAE,MAAM,GAAG,IAAI,CAAC;aACxB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACnB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChB,KAAK,GAAG,EAAE,CAAC;QACb,CAAC;aAAM,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACpC,IAAI,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChB,KAAK,GAAG,EAAE,CAAC;YACX,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC9C,GAAG,GAAG,EAAE,CAAC;QACX,CAAC;;YAAM,KAAK,IAAI,CAAC,CAAC;IACpB,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE9C,MAAM,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC/B,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACzC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACxB,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YACtB,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/import/vendors.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Vendor export → Atlas bulk-import rows. Each mapper reads the file format the
+ * vendor's own export produces and returns the rows `POST /v1/user_imports`
+ * accepts, plus warnings for what could not be carried over. Pure functions of
+ * the parsed file, so every mapping is tested from a fixture with no network.
+ */
+export declare const VENDORS: readonly ["auth0", "clerk", "supabase", "firebase", "cognito", "authjs", "workos", "better-auth"];
+export type Vendor = (typeof VENDORS)[number];
+export interface ImportMembershipRow {
+    organization_id?: string;
+    organization_external_id?: string;
+    organization_slug?: string;
+    organization_name?: string;
+    role?: string;
+}
+/** One row of the Atlas import body. Only fields with a value are set. */
+export interface ImportRow {
+    email_address: string;
+    email_verified?: boolean;
+    first_name?: string;
+    last_name?: string;
+    username?: string;
+    external_id?: string;
+    created_at?: string | number;
+    password_hash?: string;
+    password_salt?: string;
+    password_hasher?: string;
+    phone_numbers?: Array<{
+        phone_number: string;
+        verified?: boolean;
+    }>;
+    external_accounts?: Array<{
+        provider: string;
+        provider_user_id: string;
+        email?: string;
+    }>;
+    organization_memberships?: ImportMembershipRow[];
+    public_metadata?: Record<string, unknown>;
+    private_metadata?: Record<string, unknown>;
+    unsafe_metadata?: Record<string, unknown>;
+}
+export interface MappedExport {
+    rows: ImportRow[];
+    /** Human-readable notes: records skipped, data that cannot move, follow-ups. */
+    warnings: string[];
+}
+/** Parse the file text: a JSON document, newline-delimited JSON, or CSV. */
+export declare function parseExport(text: string, fileName?: string): unknown;
+export declare function atlasProvider(raw: string): string;
+/**
+ * Map a parsed vendor export. `hashes` is an optional second file of password
+ * hashes keyed by email (Auth0's support export, WorkOS's, or any `{email,
+ * password_hash}` list), merged onto the rows.
+ */
+export declare function mapExport(vendor: Vendor, doc: unknown, hashes?: unknown): MappedExport;
+/** A one-screen summary of what an import would do (the dry run). */
+export declare function summarize(rows: ImportRow[]): Record<string, number>;