@atlasauth/cli 0.6.0 → 0.8.0

package/dist/help.js

@@ -20,7 +20,7 @@ Commands:
   webhooks list|create
   sessions revoke
   config export|import       Config-as-code: round-trip the instance's config
-  actions list|deploy|test|logs
+  actions list|deploy|test|logs|gallery|show|install|installs|update|publish
   init                       Create or complete an app's setup (idempotent); secrets to 0600 files
   preflight                  Check an instance's setup; non-zero exit on errors (for CI)
   env                        Print deploy variables: public values + secret file paths
@@ -30,6 +30,16 @@ Commands:
   import --from <vendor> <file>
                              Move users from Auth0, Clerk, Supabase, Firebase, Cognito,
                              Auth.js, WorkOS or Better Auth (resumable; --dry-run first)
+  migrate code --from <vendor> [path]
+                             Rewrite an app's auth code onto Atlas (Clerk, Auth.js,
+                             Supabase, Auth0, Better Auth); a dry run with a diff unless --yes
+  migrate better-auth [path] Move a Better Auth app to Atlas end to end: config, users,
+                             sessions and code, resumable (--dry-run, --resume, --yes)
+  migrate better-auth config [path]
+                             Translate the app's betterAuth({...}) options into Atlas
+                             config files plus a report (offline)
+  info [path]                Print the environment for a support ticket (versions, SDKs,
+                             instance, API latency, preflight); secrets redacted
   mcp install                Add the Atlas MCP server (docs search) to Cursor, Claude Code,
                              Codex or VS Code
 
@@ -54,10 +64,78 @@ Secrets: a command that receives a secret writes it to a 0600 file under
 Run 'atlas <command> --help' for command-specific help.`;
 /** Per-command help, keyed by the resource word. */
 exports.COMMAND_HELP = {
+    migrate: `atlas migrate — move an app's auth onto Atlas
+
+Usage:
+  atlas migrate code --from <vendor> [path] [--yes] [--json]
+  atlas migrate better-auth config [path] [--dir <dir>] [--format json|yaml] [--entry <file>] [--json]
+  atlas migrate better-auth [path] [--dry-run] [--yes] [--resume] [--force] [--json]
+        [--dir <dir>] [--state-file <file>] [--entry <file>] [--bundle <file>] [--run-export]
+        [--confirm-conflicts] [--bridge-days <n>] [--skip <step,...>]
+
+migrate better-auth config reads your betterAuth({...}) setup statically (it
+follows imports and resolves env vars by NAME, never their values) and writes
+Atlas config-as-code files (the 'atlas config import' format) plus
+better-auth-report.md: what maps 1:1, what maps with a difference, and what
+needs a manual step, each with file:line. Default --dir: atlas-migrate/config.
+
+migrate better-auth runs the whole program, checkpointing each step in
+atlas-migrate/state.json (--state-file):
+  preflight  instance and key, CLI version, the betterAuth() call
+  translate  the config files and report (as above)
+  apply      review the diff, confirm, push the config (env placeholders are
+             filled from the environment and the app's .env files)
+  export     run the exporter in the app (prints the command; --run-export runs it)
+  import     upload the bundle, dry-run report, confirm, import (conflicts with
+             existing Atlas users need --confirm-conflicts; a stopped import resumes)
+  bridge     accept Better Auth sessions for --bridge-days (default 30): no forced logout
+  code       atlas migrate code --from better-auth, after a confirmation
+  verify     counts, preflight and a sign-in checklist
+--dry-run walks every step without changing the instance or the code. --yes
+answers every confirmation. --resume continues a stopped run. --json prints the
+step summary (with --json and no --yes it stops at the first confirmation).
+
+Code rewrite (migrate code):
+
+Vendors:
+  clerk        @clerk/* SDKs
+  authjs       Auth.js / NextAuth (next-auth v4 and v5, @auth/*)
+  supabase     Supabase Auth (supabase.auth.*, auth-helpers, auth-ui); the
+               Supabase client itself stays for your database
+  auth0        @auth0/auth0-react, @auth0/nextjs-auth0 (v3 and v4), @auth0/auth0-spa-js
+  better-auth  better-auth (client, server, Next.js handler, cookies)
+
+What it rewrites: imports, providers, hooks, server session helpers, middleware,
+sign-in/out calls and env var names, onto native Atlas APIs and the drop-in
+compat helpers in @atlasauth/react/compat and @atlasauth/nextjs/compat that keep the
+old shapes. Everything it cannot rewrite is listed with file:line and marked in
+code with TODO(atlas-migrate).
+
+Options:
+  --yes                  Write the changes (without it: a dry run printing the diff)
+  --dry-run              Force a dry run even with --yes
+  --json                 Machine-readable result (diffs, report, packages, env)
+
+Safe to re-run: migrated code is left as it is. Move your users with
+'atlas import --from <vendor> <export-file>'.`,
+    info: `atlas info — the environment, for support tickets
+
+Usage:
+  atlas info [path] [--json] [--product <name> | --instance <id>]
+
+Prints the CLI, Node and OS versions; the project's framework and Atlas SDK
+packages with the installed version and whether npm has a newer one; the
+configured instance (key prefixes only, never a key) and whether the app's
+publishable key belongs to it; API reachability and latency; and the
+instance's preflight summary. Network steps time out after 5 s and are
+reported, not fatal. Anything shaped like a secret is redacted.`,
     import: `atlas import — move users from another auth provider
 
 Usage:
   atlas import --from <vendor> <export-file> [--dry-run]
+  atlas import --from better-auth --bundle <file> [--dry-run] [--yes]
+  atlas import --from better-auth --import <id> [--confirm-conflicts]
+  atlas import --from better-auth             (prints the import key and export command)
 
 Vendors and the file each one reads:
   auth0        the user export job (NDJSON/JSON); --hashes <file> merges the password export
@@ -78,6 +156,13 @@ Options:
   --create-orgs          Create organizations that memberships name but that do not exist yet
   --json                 Machine-readable summary
 
+Better Auth bundle (npx atlas-better-auth-export --out <file> --public-key <key>):
+  --bundle <file>        Upload the sealed bundle, show the dry run, then apply
+  --import <id>          Continue an uploaded import (apply it, or resume a failed one)
+  --confirm-conflicts    Apply although the dry run found conflicts with existing users
+  --options <json|@file> Import options, e.g. '{"import_sessions":false}'
+  --yes                  Apply without asking
+
 Batches are sent with upsert, so a resumed or repeated run never duplicates a
 user or a membership. Exit code 2 means some rows were reported as issues.`,
     mcp: `atlas mcp — connect AI coding agents to Atlas
@@ -258,9 +343,24 @@ Usage:
   atlas actions test <file> [--trigger <t>] [--json]
   atlas actions logs <action-id> [--json]
 
+  atlas actions gallery [query] [--trigger <t>] [--json]
+  atlas actions show <slug> [--json]
+  atlas actions install <slug> [--name <n>] [--secrets-file <dotenv>] [--json]
+  atlas actions installs [--json]
+  atlas actions update <action-id> [--secrets-file <dotenv>] [--json]
+  atlas actions publish <template.json> [--draft] [--json]
+
 deploy uploads the file's code verbatim as a new action (created, not yet bound).
 test runs the file OFFLINE through the @atlasauth/actions harness — no network,
 no real users — and exits non-zero if the action throws. logs explains where an
-action's execution history is recorded (Atlas has no live log-stream endpoint).`,
+action's execution history is recorded (Atlas has no live log-stream endpoint).
+
+The gallery: gallery lists first-party and community templates; install copies
+one into the instance as a DISABLED, unbound action (secret values come from a
+dotenv file, never argv); installs shows which actions came from the gallery
+and whether a newer version exists; update moves one to the latest version.
+publish reads a manifest {slug, name, author_name, summary, description,
+category, tags, trigger, license, version, code_file, secrets, changelog},
+creates the template or adds the version, and submits it for review.`,
 };
 //# sourceMappingURL=help.js.map

package/dist/help.js.map

@@ -1 +1 @@
-{"version":3,"file":"help.js","sourceRoot":"","sources":["../src/help.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEU,QAAA,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wDA6CgC,CAAC;AAEzD,oDAAoD;AACvC,QAAA,YAAY,GAA2B;IAClD,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;2EAyBiE;IACzE,GAAG,EAAE;;;;;;;;;;;;;;;+CAewC;IAC7C,SAAS,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yEAmC4D;IAEvE,KAAK,EAAE;;;;;;mCAM0B;IAEjC,MAAM,EAAE;;uCAE6B;IAErC,MAAM,EAAE;;gDAEsC;IAE9C,KAAK,EAAE;;;;;;wCAM+B;IAEtC,IAAI,EAAE;;;;;uCAK+B;IAErC,UAAU,EAAE;;;;;;8CAMgC;IAE5C,QAAQ,EAAE;;;;;;0EAM8D;IAExE,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;yEA4BiE;IAEvE,SAAS,EAAE;;;;;;oDAMuC;IAElD,GAAG,EAAE;;;;;;;qDAO8C;IAEnD,MAAM,EAAE;;;;;;;;wDAQ8C;IAEtD,QAAQ,EAAE;;;8CAGkC;IAE5C,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;8EAoBoE;IAC5E,OAAO,EAAE;;;;;;;;;;;gFAWqE;CAC/E,CAAC"}
+{"version":3,"file":"help.js","sourceRoot":"","sources":["../src/help.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEU,QAAA,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wDAuDgC,CAAC;AAEzD,oDAAoD;AACvC,QAAA,YAAY,GAA2B;IAClD,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8CAqDmC;IAC5C,IAAI,EAAE;;;;;;;;;;gEAUwD;IAC9D,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2EAmCiE;IACzE,GAAG,EAAE;;;;;;;;;;;;;;;+CAewC;IAC7C,SAAS,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yEAmC4D;IAEvE,KAAK,EAAE;;;;;;mCAM0B;IAEjC,MAAM,EAAE;;uCAE6B;IAErC,MAAM,EAAE;;gDAEsC;IAE9C,KAAK,EAAE;;;;;;wCAM+B;IAEtC,IAAI,EAAE;;;;;uCAK+B;IAErC,UAAU,EAAE;;;;;;8CAMgC;IAE5C,QAAQ,EAAE;;;;;;0EAM8D;IAExE,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;yEA4BiE;IAEvE,SAAS,EAAE;;;;;;oDAMuC;IAElD,GAAG,EAAE;;;;;;;qDAO8C;IAEnD,MAAM,EAAE;;;;;;;;wDAQ8C;IAEtD,QAAQ,EAAE;;;8CAGkC;IAE5C,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;8EAoBoE;IAC5E,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;qEA0B0D;CACpE,CAAC"}

package/dist/index.d.ts

@@ -25,3 +25,7 @@ export { preflight, envCommand, client } from './commands/project-commands';
 export { referrals } from './commands/referrals';
 export { writeSecretFile, readEnvFile, parseDotenv, renderDotenv, productDir, deliverSecret, } from './secrets';
 export { readManifest, writeManifest, manifestPath, type ProjectManifest, type ProjectInstance, type InstanceEnv, } from './project';
+export { migrate } from './commands/migrate';
+export { planConfigImport, type ConfigPlan, type PlannedChange } from './commands/config';
+export { translateBetterAuth, type Translation, type ReportEntry, type ConfigDocument } from './migrate/better-auth/translate';
+export { migrateBetterAuth, STEPS as BETTER_AUTH_MIGRATION_STEPS } from './migrate/better-auth/orchestrator';

package/dist/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.manifestPath = exports.writeManifest = exports.readManifest = exports.deliverSecret = exports.productDir = exports.renderDotenv = exports.parseDotenv = exports.readEnvFile = exports.writeSecretFile = exports.referrals = exports.client = exports.envCommand = exports.preflight = exports.init = exports.actions = exports.config = exports.sessions = exports.webhooks = exports.apiKeys = exports.orgs = exports.users = exports.whoami = exports.logout = exports.login = exports.getVersion = exports.defaultPrompter = exports.defaultConfigPath = exports.MemoryConfigStore = exports.FileConfigStore = exports.captureIO = exports.defaultIO = exports.CliError = exports.isNotFound = exports.createConfigHttp = exports.defaultContext = exports.run = void 0;
+exports.BETTER_AUTH_MIGRATION_STEPS = exports.migrateBetterAuth = exports.translateBetterAuth = exports.planConfigImport = exports.migrate = exports.manifestPath = exports.writeManifest = exports.readManifest = exports.deliverSecret = exports.productDir = exports.renderDotenv = exports.parseDotenv = exports.readEnvFile = exports.writeSecretFile = exports.referrals = exports.client = exports.envCommand = exports.preflight = exports.init = exports.actions = exports.config = exports.sessions = exports.webhooks = exports.apiKeys = exports.orgs = exports.users = exports.whoami = exports.logout = exports.login = exports.getVersion = exports.defaultPrompter = exports.defaultConfigPath = exports.MemoryConfigStore = exports.FileConfigStore = exports.captureIO = exports.defaultIO = exports.CliError = exports.isNotFound = exports.createConfigHttp = exports.defaultContext = exports.run = void 0;
 /**
  * Library surface of `@atlasauth/cli`. The package ships a bin (`atlas`), but
  * exporting the pieces lets the handlers be unit-tested with injected deps and
@@ -65,4 +65,13 @@ var project_1 = require("./project");
 Object.defineProperty(exports, "readManifest", { enumerable: true, get: function () { return project_1.readManifest; } });
 Object.defineProperty(exports, "writeManifest", { enumerable: true, get: function () { return project_1.writeManifest; } });
 Object.defineProperty(exports, "manifestPath", { enumerable: true, get: function () { return project_1.manifestPath; } });
+var migrate_1 = require("./commands/migrate");
+Object.defineProperty(exports, "migrate", { enumerable: true, get: function () { return migrate_1.migrate; } });
+var config_3 = require("./commands/config");
+Object.defineProperty(exports, "planConfigImport", { enumerable: true, get: function () { return config_3.planConfigImport; } });
+var translate_1 = require("./migrate/better-auth/translate");
+Object.defineProperty(exports, "translateBetterAuth", { enumerable: true, get: function () { return translate_1.translateBetterAuth; } });
+var orchestrator_1 = require("./migrate/better-auth/orchestrator");
+Object.defineProperty(exports, "migrateBetterAuth", { enumerable: true, get: function () { return orchestrator_1.migrateBetterAuth; } });
+Object.defineProperty(exports, "BETTER_AUTH_MIGRATION_STEPS", { enumerable: true, get: function () { return orchestrator_1.STEPS; } });
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA;;;;;GAKG;AACH,6BAA0C;AAAjC,0FAAA,GAAG,OAAA;AACZ,qCAAmF;AAA1E,yGAAA,cAAc,OAAA;AACvB,6CAA8E;AAArE,+GAAA,gBAAgB,OAAA;AAAE,yGAAA,UAAU,OAAA;AACrC,mCAAoC;AAA3B,kGAAA,QAAQ,OAAA;AACjB,2BAAqE;AAA5D,+FAAA,SAAS,OAAA;AAAE,+FAAA,SAAS,OAAA;AAC7B,mCAOkB;AANhB,yGAAA,eAAe,OAAA;AACf,2GAAA,iBAAiB,OAAA;AACjB,2GAAA,iBAAiB,OAAA;AAKnB,mCAA0D;AAAjD,yGAAA,eAAe,OAAA;AACxB,qCAAuC;AAA9B,qGAAA,UAAU,OAAA;AAEnB,0EAA0E;AAC1E,wCAAwD;AAA/C,6FAAA,KAAK,OAAA;AAAE,8FAAA,MAAM,OAAA;AAAE,8FAAA,MAAM,OAAA;AAC9B,0CAAyC;AAAhC,8FAAA,KAAK,OAAA;AACd,wCAAuC;AAA9B,4FAAA,IAAI,OAAA;AACb,gDAA8C;AAArC,mGAAA,OAAO,OAAA;AAChB,gDAA+C;AAAtC,oGAAA,QAAQ,OAAA;AACjB,gDAA+C;AAAtC,oGAAA,QAAQ,OAAA;AACjB,4CAA2C;AAAlC,gGAAA,MAAM,OAAA;AACf,8CAA6C;AAApC,kGAAA,OAAO,OAAA;AAChB,wCAAuC;AAA9B,4FAAA,IAAI,OAAA;AACb,gEAA4E;AAAnE,6GAAA,SAAS,OAAA;AAAE,8GAAA,UAAU,OAAA;AAAE,0GAAA,MAAM,OAAA;AACtC,kDAAiD;AAAxC,sGAAA,SAAS,OAAA;AAClB,qCAOmB;AANjB,0GAAA,eAAe,OAAA;AACf,sGAAA,WAAW,OAAA;AACX,sGAAA,WAAW,OAAA;AACX,uGAAA,YAAY,OAAA;AACZ,qGAAA,UAAU,OAAA;AACV,wGAAA,aAAa,OAAA;AAEf,qCAOmB;AANjB,uGAAA,YAAY,OAAA;AACZ,wGAAA,aAAa,OAAA;AACb,uGAAA,YAAY,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA;;;;;GAKG;AACH,6BAA0C;AAAjC,0FAAA,GAAG,OAAA;AACZ,qCAAmF;AAA1E,yGAAA,cAAc,OAAA;AACvB,6CAA8E;AAArE,+GAAA,gBAAgB,OAAA;AAAE,yGAAA,UAAU,OAAA;AACrC,mCAAoC;AAA3B,kGAAA,QAAQ,OAAA;AACjB,2BAAqE;AAA5D,+FAAA,SAAS,OAAA;AAAE,+FAAA,SAAS,OAAA;AAC7B,mCAOkB;AANhB,yGAAA,eAAe,OAAA;AACf,2GAAA,iBAAiB,OAAA;AACjB,2GAAA,iBAAiB,OAAA;AAKnB,mCAA0D;AAAjD,yGAAA,eAAe,OAAA;AACxB,qCAAuC;AAA9B,qGAAA,UAAU,OAAA;AAEnB,0EAA0E;AAC1E,wCAAwD;AAA/C,6FAAA,KAAK,OAAA;AAAE,8FAAA,MAAM,OAAA;AAAE,8FAAA,MAAM,OAAA;AAC9B,0CAAyC;AAAhC,8FAAA,KAAK,OAAA;AACd,wCAAuC;AAA9B,4FAAA,IAAI,OAAA;AACb,gDAA8C;AAArC,mGAAA,OAAO,OAAA;AAChB,gDAA+C;AAAtC,oGAAA,QAAQ,OAAA;AACjB,gDAA+C;AAAtC,oGAAA,QAAQ,OAAA;AACjB,4CAA2C;AAAlC,gGAAA,MAAM,OAAA;AACf,8CAA6C;AAApC,kGAAA,OAAO,OAAA;AAChB,wCAAuC;AAA9B,4FAAA,IAAI,OAAA;AACb,gEAA4E;AAAnE,6GAAA,SAAS,OAAA;AAAE,8GAAA,UAAU,OAAA;AAAE,0GAAA,MAAM,OAAA;AACtC,kDAAiD;AAAxC,sGAAA,SAAS,OAAA;AAClB,qCAOmB;AANjB,0GAAA,eAAe,OAAA;AACf,sGAAA,WAAW,OAAA;AACX,sGAAA,WAAW,OAAA;AACX,uGAAA,YAAY,OAAA;AACZ,qGAAA,UAAU,OAAA;AACV,wGAAA,aAAa,OAAA;AAEf,qCAOmB;AANjB,uGAAA,YAAY,OAAA;AACZ,wGAAA,aAAa,OAAA;AACb,uGAAA,YAAY,OAAA;AAKd,8CAA6C;AAApC,kGAAA,OAAO,OAAA;AAChB,4CAA0F;AAAjF,0GAAA,gBAAgB,OAAA;AACzB,6DAA+H;AAAtH,gHAAA,mBAAmB,OAAA;AAC5B,mEAA6G;AAApG,iHAAA,iBAAiB,OAAA;AAAE,2HAAA,KAAK,OAA+B"}

package/dist/migrate/better-auth/integration.d.ts

@@ -0,0 +1,59 @@
+import { type BetterAuthImport, type BetterAuthImportOptions } from '@atlasauth/backend';
+import type { ConfigHttp } from '../../config-http';
+/**
+ * Every call the Better Auth migration makes into the import and session-bridge
+ * APIs lives in this one module:
+ *
+ *  - the export/import pair: the `@atlasauth/better-auth-migrate` exporter seals
+ *    a bundle to the instance's import key (`GET /v1/better_auth_imports/public_key`),
+ *    which is uploaded in line-split parts, finalized (which runs the dry run)
+ *    and applied under `/v1/better_auth_imports`, and
+ *  - the session bridge (`/v1/migrations/better_auth/bridge`), which lets a live
+ *    Better Auth session become an Atlas session during the cutover window.
+ */
+/** The exporter's documented command line. */
+export declare const EXPORTER_BIN = "atlas-better-auth-export";
+export declare const EXPORTER_PACKAGE = "@atlasauth/better-auth-migrate";
+/** `publicKey` is the key's compact `kid:public_key` form. */
+export declare function exporterCommand(opts: {
+    out: string;
+    publicKey: string;
+}): {
+    cmd: string;
+    args: string[];
+    display: string;
+};
+/** The import key the exporter seals the bundle to (the private half stays with Atlas), as `kid:public_key`. */
+export declare function getImportPublicKey(http: ConfigHttp): Promise<string>;
+export type ImportJob = BetterAuthImport;
+/** Statuses an import rests in; anything else is still being worked on. */
+export declare const RESTING_STATUSES: readonly string[];
+/**
+ * Upload a sealed bundle: create the import, send it in line-split parts of at
+ * most 8 MiB, then finalize (which checks the parts and the key and runs the
+ * dry run; a large bundle comes back `analyzing` and finishes in the background).
+ */
+export declare function uploadBundle(http: ConfigHttp, opts: {
+    bundle: string;
+    options?: BetterAuthImportOptions;
+    onPart?: (n: number, of: number) => void;
+}): Promise<ImportJob>;
+export declare function getImport(http: ConfigHttp, id: string): Promise<ImportJob>;
+/** Finalize an import whose upload finished but was never finalized. */
+export declare function finalizeImport(http: ConfigHttp, id: string): Promise<ImportJob>;
+/** Apply a dry-run-ready import, or resume a failed one from where it stopped. */
+export declare function applyImport(http: ConfigHttp, id: string, opts: {
+    confirmConflicts: boolean;
+}): Promise<ImportJob>;
+export interface BridgeSettings {
+    /** Better Auth's `advanced.cookiePrefix` (default `better-auth`). */
+    cookiePrefix: string;
+    /** When the bridge stops accepting Better Auth sessions (epoch ms). */
+    endsAt: number;
+}
+/**
+ * Turn the Better Auth session bridge on for a window. The old app's Better
+ * Auth secret is stored write-only so Atlas can check the cookie signature
+ * (the live fallback to the old app stays off unless set up separately).
+ */
+export declare function enableSessionBridge(http: ConfigHttp, settings: BridgeSettings, secret: string): Promise<void>;

package/dist/migrate/better-auth/integration.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RESTING_STATUSES = exports.EXPORTER_PACKAGE = exports.EXPORTER_BIN = void 0;
+exports.exporterCommand = exporterCommand;
+exports.getImportPublicKey = getImportPublicKey;
+exports.uploadBundle = uploadBundle;
+exports.getImport = getImport;
+exports.finalizeImport = finalizeImport;
+exports.applyImport = applyImport;
+exports.enableSessionBridge = enableSessionBridge;
+const backend_1 = require("@atlasauth/backend");
+/**
+ * Every call the Better Auth migration makes into the import and session-bridge
+ * APIs lives in this one module:
+ *
+ *  - the export/import pair: the `@atlasauth/better-auth-migrate` exporter seals
+ *    a bundle to the instance's import key (`GET /v1/better_auth_imports/public_key`),
+ *    which is uploaded in line-split parts, finalized (which runs the dry run)
+ *    and applied under `/v1/better_auth_imports`, and
+ *  - the session bridge (`/v1/migrations/better_auth/bridge`), which lets a live
+ *    Better Auth session become an Atlas session during the cutover window.
+ */
+/** The exporter's documented command line. */
+exports.EXPORTER_BIN = 'atlas-better-auth-export';
+exports.EXPORTER_PACKAGE = '@atlasauth/better-auth-migrate';
+/** `publicKey` is the key's compact `kid:public_key` form. */
+function exporterCommand(opts) {
+    const args = ['--yes', exports.EXPORTER_BIN, '--out', opts.out, '--public-key', opts.publicKey];
+    return { cmd: 'npx', args, display: `npx ${exports.EXPORTER_BIN} --out ${opts.out} --public-key ${opts.publicKey}` };
+}
+/** The import key the exporter seals the bundle to (the private half stays with Atlas), as `kid:public_key`. */
+async function getImportPublicKey(http) {
+    const key = await http.get('/v1/better_auth_imports/public_key');
+    if (!key?.compact)
+        throw new Error('The instance did not return an import key.');
+    return key.compact;
+}
+/** Statuses an import rests in; anything else is still being worked on. */
+exports.RESTING_STATUSES = ['uploading', 'ready', 'invalid', 'completed', 'failed'];
+const importPath = (id, sub = '') => `/v1/better_auth_imports/${encodeURIComponent(id)}${sub}`;
+/**
+ * Upload a sealed bundle: create the import, send it in line-split parts of at
+ * most 8 MiB, then finalize (which checks the parts and the key and runs the
+ * dry run; a large bundle comes back `analyzing` and finishes in the background).
+ */
+async function uploadBundle(http, opts) {
+    const parts = (0, backend_1.splitBundleParts)(opts.bundle);
+    if (parts.length === 0)
+        throw new Error('The bundle is empty.');
+    const created = await http.post('/v1/better_auth_imports', opts.options ? { options: opts.options } : {});
+    for (let i = 0; i < parts.length; i++) {
+        await http.put(importPath(created.id, `/parts/${i + 1}`), { data: parts[i] });
+        opts.onPart?.(i + 1, parts.length);
+    }
+    return http.post(importPath(created.id, '/finalize'), {});
+}
+async function getImport(http, id) {
+    return http.get(importPath(id));
+}
+/** Finalize an import whose upload finished but was never finalized. */
+async function finalizeImport(http, id) {
+    return http.post(importPath(id, '/finalize'), {});
+}
+/** Apply a dry-run-ready import, or resume a failed one from where it stopped. */
+async function applyImport(http, id, opts) {
+    return http.post(importPath(id, '/apply'), opts.confirmConflicts ? { confirm_conflicts: true } : {});
+}
+/**
+ * Turn the Better Auth session bridge on for a window. The old app's Better
+ * Auth secret is stored write-only so Atlas can check the cookie signature
+ * (the live fallback to the old app stays off unless set up separately).
+ */
+async function enableSessionBridge(http, settings, secret) {
+    await http.put('/v1/migrations/better_auth/bridge', {
+        enabled: true,
+        ends_at: settings.endsAt,
+        cookie_prefix: settings.cookiePrefix,
+        live_fallback: { secret },
+    });
+}
+//# sourceMappingURL=integration.js.map

package/dist/migrate/better-auth/integration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration.js","sourceRoot":"","sources":["../../../src/migrate/better-auth/integration.ts"],"names":[],"mappings":";;;AAoBA,0CAGC;AAGD,gDAIC;AAcD,oCAYC;AAED,8BAEC;AAGD,wCAEC;AAGD,kCAEC;AAcD,kDAOC;AA3FD,gDAAqI;AAGrI;;;;;;;;;;GAUG;AAEH,8CAA8C;AACjC,QAAA,YAAY,GAAG,0BAA0B,CAAC;AAC1C,QAAA,gBAAgB,GAAG,gCAAgC,CAAC;AAEjE,8DAA8D;AAC9D,SAAgB,eAAe,CAAC,IAAwC;IACtE,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,oBAAY,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACxF,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,oBAAY,UAAU,IAAI,CAAC,GAAG,iBAAiB,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;AAC/G,CAAC;AAED,gHAAgH;AACzG,KAAK,UAAU,kBAAkB,CAAC,IAAgB;IACvD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAsB,oCAAoC,CAAC,CAAC;IACtF,IAAI,CAAC,GAAG,EAAE,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IACjF,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAID,2EAA2E;AAC9D,QAAA,gBAAgB,GAAsB,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;AAE5G,MAAM,UAAU,GAAG,CAAC,EAAU,EAAE,GAAG,GAAG,EAAE,EAAE,EAAE,CAAC,2BAA2B,kBAAkB,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC;AAEvG;;;;GAIG;AACI,KAAK,UAAU,YAAY,CAChC,IAAgB,EAChB,IAAqG;IAErG,MAAM,KAAK,GAAG,IAAA,0BAAgB,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAY,yBAAyB,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrH,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAY,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC;AACvE,CAAC;AAEM,KAAK,UAAU,SAAS,CAAC,IAAgB,EAAE,EAAU;IAC1D,OAAO,IAAI,CAAC,GAAG,CAAY,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,wEAAwE;AACjE,KAAK,UAAU,cAAc,CAAC,IAAgB,EAAE,EAAU;IAC/D,OAAO,IAAI,CAAC,IAAI,CAAY,UAAU,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,kFAAkF;AAC3E,KAAK,UAAU,WAAW,CAAC,IAAgB,EAAE,EAAU,EAAE,IAAmC;IACjG,OAAO,IAAI,CAAC,IAAI,CAAY,UAAU,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAClH,CAAC;AASD;;;;GAIG;AACI,KAAK,UAAU,mBAAmB,CAAC,IAAgB,EAAE,QAAwB,EAAE,MAAc;IAClG,MAAM,IAAI,CAAC,GAAG,CAAC,mCAAmC,EAAE;QAClD,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,QAAQ,CAAC,MAAM;QACxB,aAAa,EAAE,QAAQ,CAAC,YAAY;QACpC,aAAa,EAAE,EAAE,MAAM,EAAE;KAC1B,CAAC,CAAC;AACL,CAAC"}

package/dist/migrate/better-auth/orchestrator.d.ts

@@ -0,0 +1,43 @@
+import { type ParsedArgs } from '../../args';
+import type { RunContext } from '../../context';
+import { type Json } from '../../serialize';
+/**
+ * `atlas migrate better-auth [path]` — the whole Better Auth → Atlas program as
+ * one resumable run:
+ *
+ *   preflight → translate → apply (review the diff, confirm, config push) →
+ *   export (the exporter runs in the app) → import (dry run, confirm, apply) →
+ *   bridge (no forced logout) → code (the codemod) → verify (checklist).
+ *
+ * Each finished step is checkpointed in the state file, so `--resume` carries
+ * on where a run stopped (a confirmation declined, an env var missing, the
+ * export not run yet). `--dry-run` walks every step without changing the
+ * instance or the code; `--yes` answers every confirmation.
+ */
+export declare const STEPS: readonly ["preflight", "translate", "apply", "export", "import", "bridge", "code", "verify"];
+export type StepId = (typeof STEPS)[number];
+type StepStatus = 'done' | 'skipped' | 'planned' | 'action_needed' | 'awaiting_confirmation' | 'blocked';
+interface StepRecord {
+    status: StepStatus;
+    at?: number;
+    detail?: Record<string, unknown>;
+    message?: string;
+}
+export interface MigrationState {
+    version: 1;
+    project: string;
+    instance_id: string | null;
+    environment: string | null;
+    started_at: number;
+    steps: Partial<Record<StepId, StepRecord>>;
+}
+/** `${NAME}` placeholders in the config files that the environment does not set. */
+export declare function missingPlaceholders(dir: string, env: NodeJS.ProcessEnv): Set<string>;
+/** Leaves of `desired` that differ from `live` (arrays compare as a whole). */
+export declare function leafDiff(desired: Json, live: Json, prefix?: string): Array<{
+    path: string;
+    from: Json | undefined;
+    to: Json;
+}>;
+export declare function migrateBetterAuth(ctx: RunContext, args: ParsedArgs, projectArg: string | undefined): Promise<number>;
+export {};