@atlasauth/cli 0.7.0 → 0.9.0

package/dist/help.js

@@ -12,27 +12,44 @@ Usage: atlas <command> [subcommand] [arguments] [options]
 
 Commands:
   login                      Authenticate and store a profile credential
+                             (--device: operator sign-in in the browser, no key stored)
+  token --resource <id>      A one-hour token for one instance/app from your operator sign-in
+  keys whoami|list|create|rotate|revoke|revoke-leaked
+                             Scoped secret keys; new secrets go sealed into 0600 files
   logout                     Remove a stored profile credential
   whoami                     Show the active profile and instance
   users list|get|create|delete
   orgs list|get|members
   api-keys list|create|revoke
-  webhooks list|create
+  webhooks list|create|upsert|update|test|deliveries|redeliver|replay|rotate|reveal
+  listen --forward-to <url>  Forward live events to your local server, signed (no tunnel)
+  move-origin --from --to    Move an app to a new domain in one step (--dry-run first)
+  csp --framework next|express|nginx
+                             Print the Content Security Policy sources Atlas needs
+  integrations list|get|set|remove|deliveries   Identity integrations (chat, docs, consent, referrals, custom)
   sessions revoke
-  config export|import       Config-as-code: round-trip the instance's config
+  config export|import|plan  Config-as-code: round-trip the instance's config; plan = drift diff
   actions list|deploy|test|logs|gallery|show|install|installs|update|publish
   init                       Create or complete an app's setup (idempotent); secrets to 0600 files
   preflight                  Check an instance's setup; non-zero exit on errors (for CI)
+  doctor                     Integration health: webhooks, logout, referrals, email, consent (exit 1 on a failure)
   env                        Print deploy variables: public values + secret file paths
   client rotate              Rotate an OAuth client secret straight into its file
   referrals connect|backfill|status
                              Connect a referral platform, backfill, check the connection
+  status                     Atlas status, incidents that concern the instance and its
+                             upstream status pages; non-zero exit on an outage
   import --from <vendor> <file>
                              Move users from Auth0, Clerk, Supabase, Firebase, Cognito,
                              Auth.js, WorkOS or Better Auth (resumable; --dry-run first)
   migrate code --from <vendor> [path]
                              Rewrite an app's auth code onto Atlas (Clerk, Auth.js,
                              Supabase, Auth0, Better Auth); a dry run with a diff unless --yes
+  migrate better-auth [path] Move a Better Auth app to Atlas end to end: config, users,
+                             sessions and code, resumable (--dry-run, --resume, --yes)
+  migrate better-auth config [path]
+                             Translate the app's betterAuth({...}) options into Atlas
+                             config files plus a report (offline)
   info [path]                Print the environment for a support ticket (versions, SDKs,
                              instance, API latency, preflight); secrets redacted
   mcp install                Add the Atlas MCP server (docs search) to Cursor, Claude Code,
@@ -48,10 +65,12 @@ Global options:
 
 Environment overrides:
   ATLAS_SECRET_KEY           Secret key to use instead of the stored one
-  ATLAS_API_URL              API URL to use instead of the stored one
+  ATLAS_API_BASE             API URL to use instead of the stored one
+  ATLAS_API_URL              Same (the older name); ATLAS_API_BASE wins when both are set
   ATLAS_PLATFORM_KEY         Platform key (psk_) for atlas init
-  REFERALLY_BASE_URL         Referalli base URL for atlas referrals connect
-  REFERALLY_API_KEY          Referalli merchant key for atlas referrals connect (never stored)
+  REFERALLI_BASE_URL         Referalli base URL for atlas referrals connect
+  REFERALLI_API_KEY          Referalli merchant key for atlas referrals connect (never stored)
+                             (the old REFERALLY_BASE_URL / REFERALLY_API_KEY still work, with a notice)
 
 Secrets: a command that receives a secret writes it to a 0600 file under
 ~/.config/<product>/ and prints only the path. --print-secret prints it instead.
@@ -59,10 +78,38 @@ Secrets: a command that receives a secret writes it to a 0600 file under
 Run 'atlas <command> --help' for command-specific help.`;
 /** Per-command help, keyed by the resource word. */
 exports.COMMAND_HELP = {
-    migrate: `atlas migrate code — rewrite an app's auth code onto Atlas
+    migrate: `atlas migrate — move an app's auth onto Atlas
 
 Usage:
   atlas migrate code --from <vendor> [path] [--yes] [--json]
+  atlas migrate better-auth config [path] [--dir <dir>] [--format json|yaml] [--entry <file>] [--json]
+  atlas migrate better-auth [path] [--dry-run] [--yes] [--resume] [--force] [--json]
+        [--dir <dir>] [--state-file <file>] [--entry <file>] [--bundle <file>] [--run-export]
+        [--confirm-conflicts] [--bridge-days <n>] [--skip <step,...>]
+
+migrate better-auth config reads your betterAuth({...}) setup statically (it
+follows imports and resolves env vars by NAME, never their values) and writes
+Atlas config-as-code files (the 'atlas config import' format) plus
+better-auth-report.md: what maps 1:1, what maps with a difference, and what
+needs a manual step, each with file:line. Default --dir: atlas-migrate/config.
+
+migrate better-auth runs the whole program, checkpointing each step in
+atlas-migrate/state.json (--state-file):
+  preflight  instance and key, CLI version, the betterAuth() call
+  translate  the config files and report (as above)
+  apply      review the diff, confirm, push the config (env placeholders are
+             filled from the environment and the app's .env files)
+  export     run the exporter in the app (prints the command; --run-export runs it)
+  import     upload the bundle, dry-run report, confirm, import (conflicts with
+             existing Atlas users need --confirm-conflicts; a stopped import resumes)
+  bridge     accept Better Auth sessions for --bridge-days (default 30): no forced logout
+  code       atlas migrate code --from better-auth, after a confirmation
+  verify     counts, preflight and a sign-in checklist
+--dry-run walks every step without changing the instance or the code. --yes
+answers every confirmation. --resume continues a stopped run. --json prints the
+step summary (with --json and no --yes it stops at the first confirmation).
+
+Code rewrite (migrate code):
 
 Vendors:
   clerk        @clerk/* SDKs
@@ -71,6 +118,10 @@ Vendors:
                Supabase client itself stays for your database
   auth0        @auth0/auth0-react, @auth0/nextjs-auth0 (v3 and v4), @auth0/auth0-spa-js
   better-auth  better-auth (client, server, Next.js handler, cookies)
+  openid-client  openid-client (Issuer.discover, authorizationUrl, callback, endSessionUrl)
+  jose         jose used to verify OIDC ID tokens (jwtVerify + createRemoteJWKSet)
+  generic-oidc a hand-rolled relying party (discovery, PKCE, code exchange, JWKS) found
+               by its code; replaced by oidc.start / oidc.callback / oidc.logoutUrl
 
 What it rewrites: imports, providers, hooks, server session helpers, middleware,
 sign-in/out calls and env var names, onto native Atlas APIs and the drop-in
@@ -100,6 +151,9 @@ reported, not fatal. Anything shaped like a secret is redacted.`,
 
 Usage:
   atlas import --from <vendor> <export-file> [--dry-run]
+  atlas import --from better-auth --bundle <file> [--dry-run] [--yes]
+  atlas import --from better-auth --import <id> [--confirm-conflicts]
+  atlas import --from better-auth             (prints the import key and export command)
 
 Vendors and the file each one reads:
   auth0        the user export job (NDJSON/JSON); --hashes <file> merges the password export
@@ -120,6 +174,13 @@ Options:
   --create-orgs          Create organizations that memberships name but that do not exist yet
   --json                 Machine-readable summary
 
+Better Auth bundle (npx atlas-better-auth-export --out <file> --public-key <key>):
+  --bundle <file>        Upload the sealed bundle, show the dry run, then apply
+  --import <id>          Continue an uploaded import (apply it, or resume a failed one)
+  --confirm-conflicts    Apply although the dry run found conflicts with existing users
+  --options <json|@file> Import options, e.g. '{"import_sessions":false}'
+  --yes                  Apply without asking
+
 Batches are sent with upsert, so a resumed or repeated run never duplicates a
 user or a membership. Exit code 2 means some rows were reported as issues.`,
     mcp: `atlas mcp — connect AI coding agents to Atlas
@@ -138,20 +199,47 @@ agent can search and read the Atlas docs. Servers already in the file are kept.
 
 No key is written. To also manage your instance from the agent, add
 ATLAS_SECRET_KEY to the server's env yourself.`,
+    status: `atlas status — is it Atlas, a service you depend on, or you?
+
+Usage:
+  atlas status [--json]
+
+Shows Atlas's components (with their regions), the open Atlas incidents that
+concern this instance (its status subscription's regions, components and
+minimum impact), the subscription itself, and the state of every upstream
+status page the instance declared (POST /v1/instance/status_dependencies).
+
+Exit code 1 when Atlas reports a major outage or an open major / critical
+incident concerns the instance, or an enabled upstream status page reports a
+partial or major outage; 0 otherwise.`,
     referrals: `atlas referrals — referral attribution
 
 Usage:
-  atlas referrals connect --provider referally --program <prg_…> --base-url <url>
-        [--referally-key-file <path|-> | --referally-key <rk_…>]
+  atlas referrals connect --provider referalli --program <prg_…> --base-url <url>
+        [--referalli-key-file <path|-> | --referalli-key <rk_…>]
         [--auto-enroll] [--destination <url>] [--tracking-token <token>] [--enable]
         [--no-sync] [--allow-mode-mismatch]
+  atlas referrals connect --oauth [--preset <id>] [--enable]   (default preset: referalli)
   atlas referrals connect --provider webhook --endpoint <https-url>
         [--secret-file <path|->] [--program <id>] [--auto-enroll] [--enable]
   atlas referrals backfill --since <YYYY-MM-DD> [--map <file.csv>]
         [--metadata-path public_metadata.referral_code] [--wait]
   atlas referrals status
+  atlas referrals conformance [--protocol webhook|connection] [--base-url <url>] [--connection-id <id>] --secret-file <path|->
+        [--only <case ids or areas>] [--simulate]
 
-connect --provider referally creates the Atlas connection on Referalli with
+connect --provider referalli --oauth is one-click: it prints a Referalli link, you choose the
+organization and program there, and Referalli hands Atlas the connection secret directly (nothing to
+copy). It needs no key, --program or --base-url, and waits until the connection appears. Where the
+deployment does not offer it yet, use a key as below.
+
+conformance runs the referral protocol conformance suite (@atlasauth/referral-conformance) against
+any platform (--protocol webhook: the generic Atlas referral protocol; connection: the Referalli dialect): signed calls with the answers a conforming server must give (401 for a bad signature,
+an empty export for an unknown customer, nulls accepted, …). It defaults to the connected Referalli;
+the secret is read from --secret-file because Atlas never shows it. --simulate also sends Atlas's own
+simulated sign-up. It exits 1 on any failed case.
+
+connect --provider referalli creates the Atlas connection on Referalli with
 your merchant key (bring your own key: used for this one call, never stored or
 printed), saves the connection id and secret on the instance, and runs a ping.
 It requires v2 signatures on the connection from the start and registers a
@@ -159,9 +247,10 @@ Referalli webhook that sends referral changes (voided, approved, reassigned…)
 back to Atlas; --no-sync skips the webhook. A test key (rk_test_) belongs with a
 development instance and a live key with production: a mismatch is refused
 unless --allow-mode-mismatch. --auto-enroll and --destination are passed to
-Referalli. --enable turns referrals on when the ping passes. Prefer --referally-key-file (or
-REFERALLY_API_KEY) to --referally-key: a key on the command line can end up in
-your shell history.
+Referalli. --enable turns referrals on when the ping passes. Prefer --referalli-key-file (or
+REFERALLI_API_KEY) to --referalli-key: a key on the command line can end up in
+your shell history. The old names (--provider referally, --referally-key-file,
+--referally-key, REFERALLY_*) still work and print a notice.
 
 connect --provider webhook points the instance at a platform that speaks the
 Atlas referral protocol. Without --secret-file, a signing secret is generated
@@ -180,7 +269,34 @@ Usage: atlas login [--profile <name>] [--url <api-url>] [--secret-key <sk_...>]
 
 Prompts for an API URL and a secret key, validates the key with one Backend
 call, then stores it (0600) under the profile. --url / --secret-key skip the
-prompts for non-interactive setup.`,
+prompts for non-interactive setup.
+
+Operator sign-in (no key on disk):
+  atlas login --device [--resource <ins_…|app_…>] [--scope "<scopes>"]
+Opens Atlas's sign-in (passkey, multi-factor) with a device code. Only
+short-lived tokens are stored: the operator token, and with --resource a
+one-hour token bound to that instance or app (scope "read" by default).
+Creating apps or instances and minting keys need a multi-factor sign-in
+within the last 5 minutes.`,
+    token: `atlas token — a one-hour token bound to one instance or app
+
+Usage: atlas token --resource <ins_…|app_…|acct_…> [--scope "<scopes>"] [--json]
+
+Swaps your operator sign-in (atlas login --device) for an Atlas token (RFC 8693
+token exchange). "read" = every read scope.`,
+    keys: `atlas keys — the instance's secret keys
+
+Usage:
+  atlas keys whoami                         What the current key is and can do
+  atlas keys list                           Every credential on the instance
+  atlas keys create --scopes "<scopes>" [--name n] [--owner o] [--expires-at <ISO>] [--allowed-ips <cidr,…>] [--out <file>]
+  atlas keys rotate <id> [--overlap <seconds>] [--out <file>]
+  atlas keys revoke <id>
+  atlas keys revoke-leaked [<secret>]       Revoke a leaked Atlas credential (no login needed)
+
+New secrets come back sealed to a key pair made on this machine and are
+written to a 0600 file (default .atlas/secret-key-<id>.env); --print-secret
+prints them instead.`,
     logout: `atlas logout — remove a stored profile credential
 
 Usage: atlas logout [--profile <name>]`,
@@ -212,8 +328,76 @@ Usage:
 Usage:
   atlas webhooks list [--json]
   atlas webhooks create --url <https-url> [--events a,b] [--product <name>] [--print-secret] [--json]
+  atlas webhooks upsert --url <https-url> [--events a,b]       one endpoint per URL; idempotent
+  atlas webhooks update <id> [--url <u>] [--events a,b] [--active | --inactive]
+  atlas webhooks test <id> [--timeout 10s] [--no-wait] [--json]
+  atlas webhooks deliveries <id> [--status failed] [--event-type user.created]
+        [--since <iso|2h|7d>] [--until <iso>] [--limit <n>] [--starting-after <id>] [--json]
+  atlas webhooks redeliver <id> --delivery <delivery-id>
+  atlas webhooks redeliver <id> --since <iso|2h|7d> [--until <iso>] [--status failed]
+  atlas webhooks replay <id> [--since failing_since]           re-send what a disabled endpoint missed
+  atlas webhooks rotate <id> [--now | --overlap <seconds>]
+  atlas webhooks reveal <id>
+
+create, upsert, rotate and reveal write the signing secret to a 0600 file and
+print only its path (--print-secret prints it instead; --force replaces a file).
+test sends a signed webhook.test event and waits for your endpoint's answer;
+the exit code is 1 when it did not answer 2xx. rotate --overlap keeps the old
+secret signing alongside the new one for that many seconds.`,
+    listen: `atlas listen — forward live events to your local server
+
+Usage:
+  atlas listen --forward-to <url> [--events user.*,session.created] [--count <n>] [--timeout <dur>] [--json]
+  atlas listen --no-forward [--events ...]            only print events
+
+Opens a signed event stream from your instance and POSTs each event to
+--forward-to with the same atlas-id, atlas-timestamp and atlas-signature headers a
+real delivery carries, then prints the status your server returned. No tunnel
+and no second endpoint. The signing secret belongs to this session only and is
+written to a 0600 file (webhook-listen.env): point your verifier at it. --events
+takes names or patterns (user.*, *.created). The session lasts up to an hour;
+Ctrl-C stops it. --count n exits after n events (exit 1 if any forward failed).`,
+    'move-origin': `atlas move-origin — move an app to a new domain
+
+Usage: atlas move-origin --from <origin> --to <origin> [--dry-run] [--yes] [--json]
+
+Rewrites every field that points at the old origin: allowed origins, branding
+links, OAuth client redirect and logout URIs, webhook URLs, the redirect-URL
+allowlist and your Sign in with Atlas apps. Shows the before and after of every
+field first and asks before writing (--yes skips the question). After a real
+move it sends a signed test delivery to each webhook endpoint that moved.
+--dry-run prints the diff and writes nothing; running it twice changes nothing.`,
+    csp: `atlas csp — the Content Security Policy sources Atlas needs
+
+Usage: atlas csp [--framework next|express|nginx] [--shape redirect|panel|button]
+                 [--instance <id> | --product <name> [--instance-env <env>]] [--origin <url>]
+                 [--manifest <url|file>]... [--no-atlas] [--json]
+
+Reads your instance's embed manifest (including a custom Frontend API host) and
+prints the script-src, connect-src, img-src and frame-src sources for your
+setup, as a next.config.ts headers() block, a helmet() config or an nginx
+add_header line. Read-only. --shape redirect (hosted sign-in) needs none.
+With --origin, warns when that origin is not one of the instance's allowed origins.
+
+Any provider that publishes the open embed-manifest format ({surfaces:{name:{csp:{directive:[sources]}}}},
+usually at /.well-known/atlas-embed.json) can be merged in with --manifest <url|file>
+(repeatable): a consent platform, chat widget, captcha or analytics vendor. --no-atlas
+skips the Atlas instance and uses only the manifests you list.`,
+    integrations: `atlas integrations — identity integrations (presets and custom)
 
-create writes the signing secret to a 0600 file and prints only its path.`,
+Usage:
+  atlas integrations list [--json]
+  atlas integrations get <id>
+  atlas integrations set <id> --audience <aud> [--name <n>] [--events-url <url|none>]
+                         [--backchannel-logout-url <url|none>] [--oauth-client-id <client_id|none>]
+                         [--disable] [--dry-run] [--json]
+  atlas integrations remove <id> [--json]
+  atlas integrations deliveries <id> [--trace <id>] [--json]
+
+<id> is a preset (chatly, forumulate, cookiemunch, referalli) or your own id.
+--oauth-client-id names the first-party OAuth client the service signs users in
+with: while no --backchannel-logout-url is set, its backchannel_logout_uri is the
+integration's back-channel receiver.`,
     init: `atlas init — create or complete an app's setup, idempotently
 
 Usage:
@@ -223,13 +407,16 @@ Usage:
              [--email managed|development|none] [--email-from <address>]
              [--email-provider resend|brevo --email-key-file <path|->]
              [--client-redirect <url>]... [--webhook-url <url>]
+             [--backchannel <url>]
              [--yes] [--force] [--rotate-secret] [--json]
 
 Needs a platform key (ATLAS_PLATFORM_KEY, or a psk_ profile from atlas login).
 Finds the app by name and environment, or creates it, then sets strategies, the
 email sender, the custom domain (auth.<domain> unless --auth-host; prints the
 CNAME), a first-party OAuth client and a webhook. Re-running only fills what is
-missing.
+missing. --backchannel <url> sets the client's back-channel logout URI (your
+route that ends the app session when Atlas ends one; @atlasauth/backend has
+ready-made handlers).
 
 Email always goes through YOUR provider account (Atlas lends none):
   managed      Atlas sets your domain up on your Resend or Brevo account and
@@ -250,14 +437,26 @@ Usage: atlas preflight [--instance <id> | --product <name> [--instance-env <env>
 
 Prints every finding (severity, code, message, fix). Exits 1 when there is an
 error, or with --fail-on warning also on a warning.`,
+    doctor: `atlas doctor — integration health (a CI / deploy gate)
+
+Usage: atlas doctor [--instance <id> | --product <name> [--instance-env <env>]]
+                    [--only <source,...>] [--no-probe] [--json]
+
+Prints every check: setup findings, webhook receivers (with the failing hop:
+dns, tls, http, challenge or auth), back-channel logout, the referral
+platform, email, the consent manager and SDK versions. Exits 1 when a check
+fails. --no-probe uses recorded deliveries only (no live calls).`,
     env: `atlas env — print deploy variables without secrets
 
-Usage: atlas env --product <name> [--instance-env <env>] [--format dotenv|coolify|vercel] [--json]
+Usage: atlas env [--product <name> [--instance-env <env>]] [--format dotenv|coolify|vercel|k8s] [--json]
 
 Public values (publishable key, Frontend API, issuer, discovery and JWKS URLs,
 OAuth client id) are printed as-is. Secrets are printed as references to their
 0600 files: *_FILE=<path> (dotenv), KEY=@<path> (coolify), or a vercel env add
-command that pipes the value from the file (vercel).`,
+command that pipes the value from the file (vercel). k8s prints a ConfigMap plus
+kubectl create secret commands that read each file. Without --product it reads
+the public values from the instance your key belongs to (no secret references).
+Both ATLAS_API_BASE and ATLAS_API_URL are printed.`,
     client: `atlas client — OAuth clients
 
 Usage: atlas client rotate <client-id> [--now | --overlap <seconds>]
@@ -276,6 +475,7 @@ Usage:
 Usage:
   atlas config export [--dir <path>] [--format json|yaml]
   atlas config import [--dir <path>] [--format json|yaml] [--dry-run] [--prune]
+  atlas config plan   [--dir <path>] [--format json|yaml] [--prune] [--exit-code] [--json]
 
 export  Read the instance's current config (instance/auth config, OAuth clients
         and providers, SSO connections, resource servers, JWT templates, roles,
@@ -290,6 +490,10 @@ import  Diff the directory against live config and apply creates/updates
           --dir       config directory (default: ./atlas-config)
           --format    json (default) or yaml
 
+plan    A Terraform-style, read-only diff of the directory against the live
+        instance: field-by-field before -> after for updates. --exit-code exits 2
+        when there is drift (for CI); --json for tooling.
+
 Secrets never live on disk. Inject a credential at import with a \${ENV_VAR}
 placeholder in a file (e.g. a provider "client_secret": "\${GOOGLE_SECRET}").`,
     actions: `atlas actions — manage Actions (tenant code run in the auth pipeline)

package/dist/help.js.map

@@ -1 +1 @@
-{"version":3,"file":"help.js","sourceRoot":"","sources":["../src/help.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEU,QAAA,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wDAkDgC,CAAC;AAEzD,oDAAoD;AACvC,QAAA,YAAY,GAA2B;IAClD,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;8CAyBmC;IAC5C,IAAI,EAAE;;;;;;;;;;gEAUwD;IAC9D,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;2EAyBiE;IACzE,GAAG,EAAE;;;;;;;;;;;;;;;+CAewC;IAC7C,SAAS,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yEAmC4D;IAEvE,KAAK,EAAE;;;;;;mCAM0B;IAEjC,MAAM,EAAE;;uCAE6B;IAErC,MAAM,EAAE;;gDAEsC;IAE9C,KAAK,EAAE;;;;;;wCAM+B;IAEtC,IAAI,EAAE;;;;;uCAK+B;IAErC,UAAU,EAAE;;;;;;8CAMgC;IAE5C,QAAQ,EAAE;;;;;;0EAM8D;IAExE,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;yEA4BiE;IAEvE,SAAS,EAAE;;;;;;oDAMuC;IAElD,GAAG,EAAE;;;;;;;qDAO8C;IAEnD,MAAM,EAAE;;;;;;;;wDAQ8C;IAEtD,QAAQ,EAAE;;;8CAGkC;IAE5C,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;8EAoBoE;IAC5E,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;qEA0B0D;CACpE,CAAC"}
+{"version":3,"file":"help.js","sourceRoot":"","sources":["../src/help.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEU,QAAA,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wDAqEgC,CAAC;AAEzD,oDAAoD;AACvC,QAAA,YAAY,GAA2B;IAClD,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8CAyDmC;IAC5C,IAAI,EAAE;;;;;;;;;;gEAUwD;IAC9D,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2EAmCiE;IACzE,GAAG,EAAE;;;;;;;;;;;;;;;+CAewC;IAC7C,MAAM,EAAE;;;;;;;;;;;;sCAY4B;IACpC,SAAS,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yEAkD4D;IAEvE,KAAK,EAAE;;;;;;;;;;;;;;2BAckB;IAEzB,KAAK,EAAE;;;;;4CAKmC;IAE1C,IAAI,EAAE;;;;;;;;;;;;qBAYa;IAEnB,MAAM,EAAE;;uCAE6B;IAErC,MAAM,EAAE;;gDAEsC;IAE9C,KAAK,EAAE;;;;;;wCAM+B;IAEtC,IAAI,EAAE;;;;;uCAK+B;IAErC,UAAU,EAAE;;;;;;8CAMgC;IAE5C,QAAQ,EAAE;;;;;;;;;;;;;;;;;;;;4DAoBgD;IAC1D,MAAM,EAAE;;;;;;;;;;;;gFAYsE;IAC9E,aAAa,EAAE;;;;;;;;;gFAS+D;IAC9E,GAAG,EAAE;;;;;;;;;;;;;;;+DAewD;IAE7D,YAAY,EAAE;;;;;;;;;;;;;;qCAcqB;IAEnC,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yEA+BiE;IAEvE,SAAS,EAAE;;;;;;oDAMuC;IAElD,MAAM,EAAE;;;;;;;;iEAQuD;IAE/D,GAAG,EAAE;;;;;;;;;;mDAU4C;IAEjD,MAAM,EAAE;;;;;;;;wDAQ8C;IAEtD,QAAQ,EAAE;;;8CAGkC;IAE5C,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;8EAyBoE;IAC5E,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;qEA0B0D;CACpE,CAAC"}

package/dist/index.d.ts

@@ -25,3 +25,7 @@ export { preflight, envCommand, client } from './commands/project-commands';
 export { referrals } from './commands/referrals';
 export { writeSecretFile, readEnvFile, parseDotenv, renderDotenv, productDir, deliverSecret, } from './secrets';
 export { readManifest, writeManifest, manifestPath, type ProjectManifest, type ProjectInstance, type InstanceEnv, } from './project';
+export { migrate } from './commands/migrate';
+export { planConfigImport, type ConfigPlan, type PlannedChange } from './commands/config';
+export { translateBetterAuth, type Translation, type ReportEntry, type ConfigDocument } from './migrate/better-auth/translate';
+export { migrateBetterAuth, STEPS as BETTER_AUTH_MIGRATION_STEPS } from './migrate/better-auth/orchestrator';

package/dist/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.manifestPath = exports.writeManifest = exports.readManifest = exports.deliverSecret = exports.productDir = exports.renderDotenv = exports.parseDotenv = exports.readEnvFile = exports.writeSecretFile = exports.referrals = exports.client = exports.envCommand = exports.preflight = exports.init = exports.actions = exports.config = exports.sessions = exports.webhooks = exports.apiKeys = exports.orgs = exports.users = exports.whoami = exports.logout = exports.login = exports.getVersion = exports.defaultPrompter = exports.defaultConfigPath = exports.MemoryConfigStore = exports.FileConfigStore = exports.captureIO = exports.defaultIO = exports.CliError = exports.isNotFound = exports.createConfigHttp = exports.defaultContext = exports.run = void 0;
+exports.BETTER_AUTH_MIGRATION_STEPS = exports.migrateBetterAuth = exports.translateBetterAuth = exports.planConfigImport = exports.migrate = exports.manifestPath = exports.writeManifest = exports.readManifest = exports.deliverSecret = exports.productDir = exports.renderDotenv = exports.parseDotenv = exports.readEnvFile = exports.writeSecretFile = exports.referrals = exports.client = exports.envCommand = exports.preflight = exports.init = exports.actions = exports.config = exports.sessions = exports.webhooks = exports.apiKeys = exports.orgs = exports.users = exports.whoami = exports.logout = exports.login = exports.getVersion = exports.defaultPrompter = exports.defaultConfigPath = exports.MemoryConfigStore = exports.FileConfigStore = exports.captureIO = exports.defaultIO = exports.CliError = exports.isNotFound = exports.createConfigHttp = exports.defaultContext = exports.run = void 0;
 /**
  * Library surface of `@atlasauth/cli`. The package ships a bin (`atlas`), but
  * exporting the pieces lets the handlers be unit-tested with injected deps and
@@ -65,4 +65,13 @@ var project_1 = require("./project");
 Object.defineProperty(exports, "readManifest", { enumerable: true, get: function () { return project_1.readManifest; } });
 Object.defineProperty(exports, "writeManifest", { enumerable: true, get: function () { return project_1.writeManifest; } });
 Object.defineProperty(exports, "manifestPath", { enumerable: true, get: function () { return project_1.manifestPath; } });
+var migrate_1 = require("./commands/migrate");
+Object.defineProperty(exports, "migrate", { enumerable: true, get: function () { return migrate_1.migrate; } });
+var config_3 = require("./commands/config");
+Object.defineProperty(exports, "planConfigImport", { enumerable: true, get: function () { return config_3.planConfigImport; } });
+var translate_1 = require("./migrate/better-auth/translate");
+Object.defineProperty(exports, "translateBetterAuth", { enumerable: true, get: function () { return translate_1.translateBetterAuth; } });
+var orchestrator_1 = require("./migrate/better-auth/orchestrator");
+Object.defineProperty(exports, "migrateBetterAuth", { enumerable: true, get: function () { return orchestrator_1.migrateBetterAuth; } });
+Object.defineProperty(exports, "BETTER_AUTH_MIGRATION_STEPS", { enumerable: true, get: function () { return orchestrator_1.STEPS; } });
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA;;;;;GAKG;AACH,6BAA0C;AAAjC,0FAAA,GAAG,OAAA;AACZ,qCAAmF;AAA1E,yGAAA,cAAc,OAAA;AACvB,6CAA8E;AAArE,+GAAA,gBAAgB,OAAA;AAAE,yGAAA,UAAU,OAAA;AACrC,mCAAoC;AAA3B,kGAAA,QAAQ,OAAA;AACjB,2BAAqE;AAA5D,+FAAA,SAAS,OAAA;AAAE,+FAAA,SAAS,OAAA;AAC7B,mCAOkB;AANhB,yGAAA,eAAe,OAAA;AACf,2GAAA,iBAAiB,OAAA;AACjB,2GAAA,iBAAiB,OAAA;AAKnB,mCAA0D;AAAjD,yGAAA,eAAe,OAAA;AACxB,qCAAuC;AAA9B,qGAAA,UAAU,OAAA;AAEnB,0EAA0E;AAC1E,wCAAwD;AAA/C,6FAAA,KAAK,OAAA;AAAE,8FAAA,MAAM,OAAA;AAAE,8FAAA,MAAM,OAAA;AAC9B,0CAAyC;AAAhC,8FAAA,KAAK,OAAA;AACd,wCAAuC;AAA9B,4FAAA,IAAI,OAAA;AACb,gDAA8C;AAArC,mGAAA,OAAO,OAAA;AAChB,gDAA+C;AAAtC,oGAAA,QAAQ,OAAA;AACjB,gDAA+C;AAAtC,oGAAA,QAAQ,OAAA;AACjB,4CAA2C;AAAlC,gGAAA,MAAM,OAAA;AACf,8CAA6C;AAApC,kGAAA,OAAO,OAAA;AAChB,wCAAuC;AAA9B,4FAAA,IAAI,OAAA;AACb,gEAA4E;AAAnE,6GAAA,SAAS,OAAA;AAAE,8GAAA,UAAU,OAAA;AAAE,0GAAA,MAAM,OAAA;AACtC,kDAAiD;AAAxC,sGAAA,SAAS,OAAA;AAClB,qCAOmB;AANjB,0GAAA,eAAe,OAAA;AACf,sGAAA,WAAW,OAAA;AACX,sGAAA,WAAW,OAAA;AACX,uGAAA,YAAY,OAAA;AACZ,qGAAA,UAAU,OAAA;AACV,wGAAA,aAAa,OAAA;AAEf,qCAOmB;AANjB,uGAAA,YAAY,OAAA;AACZ,wGAAA,aAAa,OAAA;AACb,uGAAA,YAAY,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA;;;;;GAKG;AACH,6BAA0C;AAAjC,0FAAA,GAAG,OAAA;AACZ,qCAAmF;AAA1E,yGAAA,cAAc,OAAA;AACvB,6CAA8E;AAArE,+GAAA,gBAAgB,OAAA;AAAE,yGAAA,UAAU,OAAA;AACrC,mCAAoC;AAA3B,kGAAA,QAAQ,OAAA;AACjB,2BAAqE;AAA5D,+FAAA,SAAS,OAAA;AAAE,+FAAA,SAAS,OAAA;AAC7B,mCAOkB;AANhB,yGAAA,eAAe,OAAA;AACf,2GAAA,iBAAiB,OAAA;AACjB,2GAAA,iBAAiB,OAAA;AAKnB,mCAA0D;AAAjD,yGAAA,eAAe,OAAA;AACxB,qCAAuC;AAA9B,qGAAA,UAAU,OAAA;AAEnB,0EAA0E;AAC1E,wCAAwD;AAA/C,6FAAA,KAAK,OAAA;AAAE,8FAAA,MAAM,OAAA;AAAE,8FAAA,MAAM,OAAA;AAC9B,0CAAyC;AAAhC,8FAAA,KAAK,OAAA;AACd,wCAAuC;AAA9B,4FAAA,IAAI,OAAA;AACb,gDAA8C;AAArC,mGAAA,OAAO,OAAA;AAChB,gDAA+C;AAAtC,oGAAA,QAAQ,OAAA;AACjB,gDAA+C;AAAtC,oGAAA,QAAQ,OAAA;AACjB,4CAA2C;AAAlC,gGAAA,MAAM,OAAA;AACf,8CAA6C;AAApC,kGAAA,OAAO,OAAA;AAChB,wCAAuC;AAA9B,4FAAA,IAAI,OAAA;AACb,gEAA4E;AAAnE,6GAAA,SAAS,OAAA;AAAE,8GAAA,UAAU,OAAA;AAAE,0GAAA,MAAM,OAAA;AACtC,kDAAiD;AAAxC,sGAAA,SAAS,OAAA;AAClB,qCAOmB;AANjB,0GAAA,eAAe,OAAA;AACf,sGAAA,WAAW,OAAA;AACX,sGAAA,WAAW,OAAA;AACX,uGAAA,YAAY,OAAA;AACZ,qGAAA,UAAU,OAAA;AACV,wGAAA,aAAa,OAAA;AAEf,qCAOmB;AANjB,uGAAA,YAAY,OAAA;AACZ,wGAAA,aAAa,OAAA;AACb,uGAAA,YAAY,OAAA;AAKd,8CAA6C;AAApC,kGAAA,OAAO,OAAA;AAChB,4CAA0F;AAAjF,0GAAA,gBAAgB,OAAA;AACzB,6DAA+H;AAAtH,gHAAA,mBAAmB,OAAA;AAC5B,mEAA6G;AAApG,iHAAA,iBAAiB,OAAA;AAAE,2HAAA,KAAK,OAA+B"}

package/dist/migrate/better-auth/integration.d.ts

@@ -0,0 +1,59 @@
+import { type BetterAuthImport, type BetterAuthImportOptions } from '@atlasauth/backend';
+import type { ConfigHttp } from '../../config-http';
+/**
+ * Every call the Better Auth migration makes into the import and session-bridge
+ * APIs lives in this one module:
+ *
+ *  - the export/import pair: the `@atlasauth/better-auth-migrate` exporter seals
+ *    a bundle to the instance's import key (`GET /v1/better_auth_imports/public_key`),
+ *    which is uploaded in line-split parts, finalized (which runs the dry run)
+ *    and applied under `/v1/better_auth_imports`, and
+ *  - the session bridge (`/v1/migrations/better_auth/bridge`), which lets a live
+ *    Better Auth session become an Atlas session during the cutover window.
+ */
+/** The exporter's documented command line. */
+export declare const EXPORTER_BIN = "atlas-better-auth-export";
+export declare const EXPORTER_PACKAGE = "@atlasauth/better-auth-migrate";
+/** `publicKey` is the key's compact `kid:public_key` form. */
+export declare function exporterCommand(opts: {
+    out: string;
+    publicKey: string;
+}): {
+    cmd: string;
+    args: string[];
+    display: string;
+};
+/** The import key the exporter seals the bundle to (the private half stays with Atlas), as `kid:public_key`. */
+export declare function getImportPublicKey(http: ConfigHttp): Promise<string>;
+export type ImportJob = BetterAuthImport;
+/** Statuses an import rests in; anything else is still being worked on. */
+export declare const RESTING_STATUSES: readonly string[];
+/**
+ * Upload a sealed bundle: create the import, send it in line-split parts of at
+ * most 8 MiB, then finalize (which checks the parts and the key and runs the
+ * dry run; a large bundle comes back `analyzing` and finishes in the background).
+ */
+export declare function uploadBundle(http: ConfigHttp, opts: {
+    bundle: string;
+    options?: BetterAuthImportOptions;
+    onPart?: (n: number, of: number) => void;
+}): Promise<ImportJob>;
+export declare function getImport(http: ConfigHttp, id: string): Promise<ImportJob>;
+/** Finalize an import whose upload finished but was never finalized. */
+export declare function finalizeImport(http: ConfigHttp, id: string): Promise<ImportJob>;
+/** Apply a dry-run-ready import, or resume a failed one from where it stopped. */
+export declare function applyImport(http: ConfigHttp, id: string, opts: {
+    confirmConflicts: boolean;
+}): Promise<ImportJob>;
+export interface BridgeSettings {
+    /** Better Auth's `advanced.cookiePrefix` (default `better-auth`). */
+    cookiePrefix: string;
+    /** When the bridge stops accepting Better Auth sessions (epoch ms). */
+    endsAt: number;
+}
+/**
+ * Turn the Better Auth session bridge on for a window. The old app's Better
+ * Auth secret is stored write-only so Atlas can check the cookie signature
+ * (the live fallback to the old app stays off unless set up separately).
+ */
+export declare function enableSessionBridge(http: ConfigHttp, settings: BridgeSettings, secret: string): Promise<void>;

package/dist/migrate/better-auth/integration.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RESTING_STATUSES = exports.EXPORTER_PACKAGE = exports.EXPORTER_BIN = void 0;
+exports.exporterCommand = exporterCommand;
+exports.getImportPublicKey = getImportPublicKey;
+exports.uploadBundle = uploadBundle;
+exports.getImport = getImport;
+exports.finalizeImport = finalizeImport;
+exports.applyImport = applyImport;
+exports.enableSessionBridge = enableSessionBridge;
+const backend_1 = require("@atlasauth/backend");
+/**
+ * Every call the Better Auth migration makes into the import and session-bridge
+ * APIs lives in this one module:
+ *
+ *  - the export/import pair: the `@atlasauth/better-auth-migrate` exporter seals
+ *    a bundle to the instance's import key (`GET /v1/better_auth_imports/public_key`),
+ *    which is uploaded in line-split parts, finalized (which runs the dry run)
+ *    and applied under `/v1/better_auth_imports`, and
+ *  - the session bridge (`/v1/migrations/better_auth/bridge`), which lets a live
+ *    Better Auth session become an Atlas session during the cutover window.
+ */
+/** The exporter's documented command line. */
+exports.EXPORTER_BIN = 'atlas-better-auth-export';
+exports.EXPORTER_PACKAGE = '@atlasauth/better-auth-migrate';
+/** `publicKey` is the key's compact `kid:public_key` form. */
+function exporterCommand(opts) {
+    const args = ['--yes', exports.EXPORTER_BIN, '--out', opts.out, '--public-key', opts.publicKey];
+    return { cmd: 'npx', args, display: `npx ${exports.EXPORTER_BIN} --out ${opts.out} --public-key ${opts.publicKey}` };
+}
+/** The import key the exporter seals the bundle to (the private half stays with Atlas), as `kid:public_key`. */
+async function getImportPublicKey(http) {
+    const key = await http.get('/v1/better_auth_imports/public_key');
+    if (!key?.compact)
+        throw new Error('The instance did not return an import key.');
+    return key.compact;
+}
+/** Statuses an import rests in; anything else is still being worked on. */
+exports.RESTING_STATUSES = ['uploading', 'ready', 'invalid', 'completed', 'failed'];
+const importPath = (id, sub = '') => `/v1/better_auth_imports/${encodeURIComponent(id)}${sub}`;
+/**
+ * Upload a sealed bundle: create the import, send it in line-split parts of at
+ * most 8 MiB, then finalize (which checks the parts and the key and runs the
+ * dry run; a large bundle comes back `analyzing` and finishes in the background).
+ */
+async function uploadBundle(http, opts) {
+    const parts = (0, backend_1.splitBundleParts)(opts.bundle);
+    if (parts.length === 0)
+        throw new Error('The bundle is empty.');
+    const created = await http.post('/v1/better_auth_imports', opts.options ? { options: opts.options } : {});
+    for (let i = 0; i < parts.length; i++) {
+        await http.put(importPath(created.id, `/parts/${i + 1}`), { data: parts[i] });
+        opts.onPart?.(i + 1, parts.length);
+    }
+    return http.post(importPath(created.id, '/finalize'), {});
+}
+async function getImport(http, id) {
+    return http.get(importPath(id));
+}
+/** Finalize an import whose upload finished but was never finalized. */
+async function finalizeImport(http, id) {
+    return http.post(importPath(id, '/finalize'), {});
+}
+/** Apply a dry-run-ready import, or resume a failed one from where it stopped. */
+async function applyImport(http, id, opts) {
+    return http.post(importPath(id, '/apply'), opts.confirmConflicts ? { confirm_conflicts: true } : {});
+}
+/**
+ * Turn the Better Auth session bridge on for a window. The old app's Better
+ * Auth secret is stored write-only so Atlas can check the cookie signature
+ * (the live fallback to the old app stays off unless set up separately).
+ */
+async function enableSessionBridge(http, settings, secret) {
+    await http.put('/v1/migrations/better_auth/bridge', {
+        enabled: true,
+        ends_at: settings.endsAt,
+        cookie_prefix: settings.cookiePrefix,
+        live_fallback: { secret },
+    });
+}
+//# sourceMappingURL=integration.js.map

package/dist/migrate/better-auth/integration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration.js","sourceRoot":"","sources":["../../../src/migrate/better-auth/integration.ts"],"names":[],"mappings":";;;AAoBA,0CAGC;AAGD,gDAIC;AAcD,oCAYC;AAED,8BAEC;AAGD,wCAEC;AAGD,kCAEC;AAcD,kDAOC;AA3FD,gDAAqI;AAGrI;;;;;;;;;;GAUG;AAEH,8CAA8C;AACjC,QAAA,YAAY,GAAG,0BAA0B,CAAC;AAC1C,QAAA,gBAAgB,GAAG,gCAAgC,CAAC;AAEjE,8DAA8D;AAC9D,SAAgB,eAAe,CAAC,IAAwC;IACtE,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,oBAAY,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACxF,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,oBAAY,UAAU,IAAI,CAAC,GAAG,iBAAiB,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;AAC/G,CAAC;AAED,gHAAgH;AACzG,KAAK,UAAU,kBAAkB,CAAC,IAAgB;IACvD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAsB,oCAAoC,CAAC,CAAC;IACtF,IAAI,CAAC,GAAG,EAAE,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IACjF,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAID,2EAA2E;AAC9D,QAAA,gBAAgB,GAAsB,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;AAE5G,MAAM,UAAU,GAAG,CAAC,EAAU,EAAE,GAAG,GAAG,EAAE,EAAE,EAAE,CAAC,2BAA2B,kBAAkB,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC;AAEvG;;;;GAIG;AACI,KAAK,UAAU,YAAY,CAChC,IAAgB,EAChB,IAAqG;IAErG,MAAM,KAAK,GAAG,IAAA,0BAAgB,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAY,yBAAyB,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrH,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAY,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC;AACvE,CAAC;AAEM,KAAK,UAAU,SAAS,CAAC,IAAgB,EAAE,EAAU;IAC1D,OAAO,IAAI,CAAC,GAAG,CAAY,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,wEAAwE;AACjE,KAAK,UAAU,cAAc,CAAC,IAAgB,EAAE,EAAU;IAC/D,OAAO,IAAI,CAAC,IAAI,CAAY,UAAU,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,kFAAkF;AAC3E,KAAK,UAAU,WAAW,CAAC,IAAgB,EAAE,EAAU,EAAE,IAAmC;IACjG,OAAO,IAAI,CAAC,IAAI,CAAY,UAAU,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAClH,CAAC;AASD;;;;GAIG;AACI,KAAK,UAAU,mBAAmB,CAAC,IAAgB,EAAE,QAAwB,EAAE,MAAc;IAClG,MAAM,IAAI,CAAC,GAAG,CAAC,mCAAmC,EAAE;QAClD,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,QAAQ,CAAC,MAAM;QACxB,aAAa,EAAE,QAAQ,CAAC,YAAY;QACpC,aAAa,EAAE,EAAE,MAAM,EAAE;KAC1B,CAAC,CAAC;AACL,CAAC"}

package/dist/migrate/better-auth/orchestrator.d.ts

@@ -0,0 +1,43 @@
+import { type ParsedArgs } from '../../args';
+import type { RunContext } from '../../context';
+import { type Json } from '../../serialize';
+/**
+ * `atlas migrate better-auth [path]` — the whole Better Auth → Atlas program as
+ * one resumable run:
+ *
+ *   preflight → translate → apply (review the diff, confirm, config push) →
+ *   export (the exporter runs in the app) → import (dry run, confirm, apply) →
+ *   bridge (no forced logout) → code (the codemod) → verify (checklist).
+ *
+ * Each finished step is checkpointed in the state file, so `--resume` carries
+ * on where a run stopped (a confirmation declined, an env var missing, the
+ * export not run yet). `--dry-run` walks every step without changing the
+ * instance or the code; `--yes` answers every confirmation.
+ */
+export declare const STEPS: readonly ["preflight", "translate", "apply", "export", "import", "bridge", "code", "verify"];
+export type StepId = (typeof STEPS)[number];
+type StepStatus = 'done' | 'skipped' | 'planned' | 'action_needed' | 'awaiting_confirmation' | 'blocked';
+interface StepRecord {
+    status: StepStatus;
+    at?: number;
+    detail?: Record<string, unknown>;
+    message?: string;
+}
+export interface MigrationState {
+    version: 1;
+    project: string;
+    instance_id: string | null;
+    environment: string | null;
+    started_at: number;
+    steps: Partial<Record<StepId, StepRecord>>;
+}
+/** `${NAME}` placeholders in the config files that the environment does not set. */
+export declare function missingPlaceholders(dir: string, env: NodeJS.ProcessEnv): Set<string>;
+/** Leaves of `desired` that differ from `live` (arrays compare as a whole). */
+export declare function leafDiff(desired: Json, live: Json, prefix?: string): Array<{
+    path: string;
+    from: Json | undefined;
+    to: Json;
+}>;
+export declare function migrateBetterAuth(ctx: RunContext, args: ParsedArgs, projectArg: string | undefined): Promise<number>;
+export {};