@tula-tech/cli 0.1.1 → 0.3.0

package/dist/shared/{chunk-4qr9zsgj.js → chunk-erqwg4v0.js}

@@ -65,6 +65,9 @@ function parseArgs2(argv, options) {
     if (value === undefined || equals === -1 && value.startsWith("--")) {
       throw new UsageError2(`--${name} needs a value.`);
     }
+    if (Object.hasOwn(flags, name)) {
+      throw new UsageError2(`--${name} was given more than once.`);
+    }
     flags[name] = value;
     if (equals === -1) {
       index += 1;
@@ -74,7 +77,9 @@ function parseArgs2(argv, options) {
 }
 
 // src/diff.ts
-import { providerSecret } from "@tula-tech/config";
+import {
+  providerSecret
+} from "@tula-tech/config";
 import {
   HOOK_FIELDS,
   HOOK_POINTS,
@@ -82,6 +87,7 @@ import {
   hookWeakenings,
   isEmailTemplateKind,
   isSmsTemplateKind,
+  MAX_CUSTOM_ROLES,
   MAX_NATIVE_APPS,
   MAX_WEBHOOK_ENDPOINTS,
   NATIVE_APP_PLATFORMS,
@@ -89,8 +95,10 @@ import {
   nativeAppWeakenings,
   normalizeAppLinkPaths,
   normalizeCertFingerprints,
+  normalizePermissions,
   OAUTH_PROVIDERS,
   oauthProviderWeakenings,
+  organizationRoleWeakenings,
   parseStoredEnvironmentSettings,
   settingsWeakenings
 } from "@tula-tech/contract";
@@ -310,6 +318,72 @@ function planNativeApps(remote, desired, options) {
     seen: nativeAppSnapshot(existing)
   };
 }
+function organizationRoleFields(current, entry) {
+  const after = normalizePermissions(entry.permissions);
+  if (!current) {
+    return [
+      { path: "name", kind: "added", after: entry.name },
+      { path: "permissions", kind: "added", after }
+    ];
+  }
+  const fields = [];
+  if (current.name !== entry.name) {
+    fields.push({ path: "name", kind: "changed", before: current.name, after: entry.name });
+  }
+  const before = normalizePermissions(current.permissions);
+  const added = after.filter((key) => !before.includes(key));
+  const removed = before.filter((key) => !after.includes(key));
+  if (added.length > 0 || removed.length > 0) {
+    fields.push({ path: "permissions", kind: "changed", before, after, added, removed });
+  }
+  return fields;
+}
+function planOrganizationRoles(remote, desired, options, unread = false) {
+  if (desired === undefined) {
+    return { managed: false, roles: [], overLimit: null, unread: false };
+  }
+  const existing = (remote ?? []).filter((role) => !role.builtIn);
+  const byKey = new Map(existing.map((role) => [role.key, role]));
+  const listed = new Set;
+  const roles = desired.map((entry) => {
+    listed.add(entry.key);
+    const current = byKey.get(entry.key);
+    const fields = organizationRoleFields(current, entry);
+    if (!current) {
+      return { key: entry.key, action: "create", fields, weakened: [], entry };
+    }
+    const weakened = organizationRoleWeakenings(current.permissions, normalizePermissions(entry.permissions)).map((field) => `organizationRoles.${entry.key}.${field}`);
+    return {
+      key: entry.key,
+      id: current.id,
+      version: current.version,
+      action: fields.length > 0 ? "update" : "none",
+      fields,
+      weakened,
+      entry
+    };
+  });
+  for (const role of existing) {
+    if (!listed.has(role.key)) {
+      roles.push({
+        key: role.key,
+        id: role.id,
+        version: role.version,
+        action: options.prune === true ? "delete" : "unmanaged",
+        fields: [],
+        weakened: []
+      });
+    }
+  }
+  const count = (action) => roles.filter((role) => role.action === action).length;
+  const after = existing.length + count("create") - count("delete");
+  return {
+    managed: true,
+    roles,
+    overLimit: count("create") > 0 && after > MAX_CUSTOM_ROLES ? after : null,
+    unread
+  };
+}
 function hookSnapshot(hooks) {
   return JSON.stringify(hooks.map((hook) => [
     hook.id,
@@ -640,6 +714,7 @@ function buildPlan2(remote, environment, options) {
   const webhooks = planWebhooks(remote.webhooks, environment.webhooks, options);
   const hooks = planHooks(remote.hooks, environment.hooks, options);
   const nativeApps = planNativeApps(remote.nativeApps, environment.nativeApps, options);
+  const organizationRoles = planOrganizationRoles(remote.organizationRoles, environment.organizationRoles, options, remote.organizationRolesUnread === true);
   const marker = planMarker(remote, options.configHash);
   return {
     revision: remote.revision,
@@ -648,7 +723,8 @@ function buildPlan2(remote, environment, options) {
       ...weakenings(remote.settings, body),
       ...providers.flatMap((provider) => provider.weakened),
       ...hooks.hooks.flatMap((hook) => hook.weakened),
-      ...nativeApps.apps.flatMap((app) => app.weakened)
+      ...nativeApps.apps.flatMap((app) => app.weakened),
+      ...organizationRoles.roles.flatMap((role) => role.weakened)
     ],
     kept,
     unknown,
@@ -656,9 +732,10 @@ function buildPlan2(remote, environment, options) {
     webhooks,
     hooks,
     nativeApps,
+    organizationRoles,
     marker,
     body,
-    changes: settings.length > 0 || marker.pending || providers.some((provider) => ["create", "update", "delete"].includes(provider.action)) || webhooks.endpoints.some((endpoint) => ["create", "update", "delete", "ambiguous"].includes(endpoint.action)) || hooks.hooks.some((hook) => ["create", "update", "delete"].includes(hook.action)) || nativeApps.apps.some((app) => ["create", "update", "delete"].includes(app.action))
+    changes: settings.length > 0 || marker.pending || providers.some((provider) => ["create", "update", "delete"].includes(provider.action)) || webhooks.endpoints.some((endpoint) => ["create", "update", "delete", "ambiguous"].includes(endpoint.action)) || hooks.hooks.some((hook) => ["create", "update", "delete"].includes(hook.action)) || nativeApps.apps.some((app) => ["create", "update", "delete"].includes(app.action)) || organizationRoles.roles.some((role) => ["create", "update", "delete"].includes(role.action))
   };
 }
 function orderOperations2(plan) {
@@ -678,9 +755,28 @@ function orderOperations2(plan) {
     ...signIn,
     ...orderWebhooks(plan.webhooks),
     ...orderHooks(plan.hooks),
-    ...orderNativeApps(plan.nativeApps)
+    ...orderNativeApps(plan.nativeApps),
+    ...orderOrganizationRoles(plan.organizationRoles)
   ];
 }
+function orderOrganizationRoles(roles) {
+  const removals = [];
+  const narrowing = [];
+  const widening = [];
+  const creates = [];
+  for (const change of roles.roles) {
+    const { key, version, entry } = change;
+    if (change.action === "create" && entry) {
+      creates.push({ kind: "organizationRole.create", key, entry, change });
+    } else if (version !== undefined && change.action === "update" && entry) {
+      const bucket = change.weakened.length > 0 ? widening : narrowing;
+      bucket.push({ kind: "organizationRole.update", key, version, entry, change });
+    } else if (version !== undefined && change.action === "delete") {
+      removals.push({ kind: "organizationRole.delete", key, version, change });
+    }
+  }
+  return [...removals, ...narrowing, ...widening, ...creates];
+}
 function orderNativeApps(nativeApps) {
   const removals = [];
   const narrowing = [];
@@ -748,7 +844,7 @@ function orderWebhooks(webhooks) {
 import { isTulaAdminError } from "@tula-tech/admin";
 
 // src/version.ts
-var VERSION2 = "0.1.1";
+var VERSION2 = "0.3.0";
 
 // src/doctor.ts
 var SKEW_WARN_MS = 5000;
@@ -1156,6 +1252,7 @@ async function runCli2(argv, io, commands) {
 
 // src/render.ts
 import {
+  MAX_CUSTOM_ROLES as MAX_CUSTOM_ROLES2,
   MAX_EMAIL_BODY_LENGTH,
   MAX_NATIVE_APPS as MAX_NATIVE_APPS2,
   MAX_WEBHOOK_ENDPOINTS as MAX_WEBHOOK_ENDPOINTS2,
@@ -1163,7 +1260,7 @@ import {
 } from "@tula-tech/contract";
 var MAX_VALUE_LENGTH = 100;
 function show(value) {
-  const text = JSON.stringify(value) ?? "undefined";
+  const text = printable2(JSON.stringify(value) ?? "undefined", Number.MAX_SAFE_INTEGER);
   return text.length > MAX_VALUE_LENGTH ? `${text.slice(0, MAX_VALUE_LENGTH - 1)}\u2026` : text;
 }
 function shown(change, value) {
@@ -1319,6 +1416,38 @@ function unmanagedLinkPathsLine(change) {
   const paths = count === 1 ? "1 link path" : `${count} link paths`;
   return `      ${paths} on the server, not managed by the file (kept; write appLinkPaths to manage them, [] to remove them)`;
 }
+function roleText(value) {
+  return printable2(String(value), 100);
+}
+function organizationRoleFields2(change) {
+  return change.fields.map((field) => {
+    if (field.path === "permissions") {
+      const entries = field.kind === "added" ? field.after.map(roleText) : [
+        ...(field.added ?? []).map((entry) => `+${roleText(entry)}`),
+        ...(field.removed ?? []).map((entry) => `-${roleText(entry)}`)
+      ];
+      return entries.length > 0 ? `permissions ${entries.join(" ")}` : "permissions none";
+    }
+    return field.kind === "added" ? `name ${show(roleText(field.after))}` : `name ${show(roleText(field.before))} \u2192 ${show(roleText(field.after))}`;
+  });
+}
+function organizationRoleLine(output, change) {
+  const { style } = output;
+  const name = roleText(change.key);
+  const fields = organizationRoleFields2(change).join(", ");
+  switch (change.action) {
+    case "create":
+      return style.green(`  + ${name}: define (${fields})`);
+    case "update":
+      return style.yellow(`  ~ ${name}: update (${fields})`);
+    case "delete":
+      return style.red(`  - ${name}: remove (refused by the server while a member holds the role)`);
+    case "unmanaged":
+      return style.dim(`  = ${name}: unmanaged (on the server, not in the file; --prune removes it)`);
+    default:
+      return style.dim(`  = ${name}: unchanged`);
+  }
+}
 function nativeAppLine(output, change) {
   const { style } = output;
   const name = appName(change);
@@ -1361,6 +1490,10 @@ function planBlockers(plan) {
   if (apps !== null) {
     blockers.push(`The environment would have ${apps} native apps and may have ${MAX_NATIVE_APPS2}.`);
   }
+  const roles = plan.organizationRoles?.overLimit ?? null;
+  if (roles !== null) {
+    blockers.push(`The environment would have ${roles} custom organization roles and may have ${MAX_CUSTOM_ROLES2}.`);
+  }
   return blockers;
 }
 var OVER_LIMIT_ADVICE = "List fewer in the file, or remove the ones it does not list (--prune).";
@@ -1503,6 +1636,14 @@ function describeOperation2(operation) {
     };
     return `native app ${appName(operation.change)}: ${did[operation.kind]}`;
   }
+  if (operation.kind === "organizationRole.create" || operation.kind === "organizationRole.update" || operation.kind === "organizationRole.delete") {
+    const did = {
+      "organizationRole.create": "define",
+      "organizationRole.update": "update",
+      "organizationRole.delete": "remove"
+    };
+    return `organization role ${roleText(operation.key)}: ${did[operation.kind]}`;
+  }
   if (operation.kind === "provider.delete") {
     return `provider ${operation.provider}: delete`;
   }
@@ -1578,6 +1719,19 @@ function renderPlan2(output, target, plan) {
       }
     }
   }
+  if (plan.organizationRoles.managed) {
+    output.line();
+    output.line(style.bold("Organization roles"));
+    if (plan.organizationRoles.roles.length === 0) {
+      output.line(style.dim("  none in the file, none on the server"));
+    }
+    if (plan.organizationRoles.unread) {
+      output.line(style.dim("  organizations are off on the server, so its custom roles were not read: a role it already has fails its definition (nothing is written over it); run tula diff again once organizations are on"));
+    }
+    for (const change of plan.organizationRoles.roles) {
+      output.line(organizationRoleLine(output, change));
+    }
+  }
   const warnings = planWarnings2(plan);
   if (warnings.length > 0) {
     output.line();
@@ -1610,6 +1764,12 @@ function planToJson2(target, plan) {
       apps: plan.nativeApps.apps.map(({ entry: _entry, ...change }) => change),
       overLimit: plan.nativeApps.overLimit
     },
+    organizationRoles: {
+      managed: plan.organizationRoles.managed,
+      roles: plan.organizationRoles.roles.map(({ entry: _entry, ...change }) => change),
+      overLimit: plan.organizationRoles.overLimit,
+      unread: plan.organizationRoles.unread
+    },
     blockers: planBlockers(plan),
     managedBy: {
       supported: plan.marker.supported,
@@ -1640,6 +1800,79 @@ import {
   isTulaAdminError as isTulaAdminError3
 } from "@tula-tech/admin";
 import { secretKeyMatchesKind } from "@tula-tech/config";
+
+// src/import/progress.ts
+import { createHash } from "crypto";
+
+// src/import/types.ts
+var IMPORT_PROVIDERS = ["clerk", "auth0", "firebase", "supabase", "better-auth"];
+
+// src/import/progress.ts
+function newProgress(provider, fingerprint, target) {
+  return {
+    version: 1,
+    provider,
+    fingerprint,
+    target,
+    doneThrough: 0,
+    batches: 0,
+    counts: { created: 0, skipped: 0, refused: 0 },
+    refused: [],
+    userIds: {},
+    organizations: { cursor: 0, created: 0, existing: 0, failed: [], ids: {} },
+    memberships: { cursor: 0, added: 0, existing: 0, failed: [] }
+  };
+}
+function fingerprintOf(files) {
+  const hash = createHash("sha256");
+  for (const [name, text] of files) {
+    hash.update(`${name}
+${Buffer.byteLength(text)}
+`);
+    hash.update(text);
+  }
+  return hash.digest("hex");
+}
+function targetOf(apiUrl, secretKey) {
+  return createHash("sha256").update(`tula-import-target
+${new URL(apiUrl).origin}
+${secretKey}`).digest("hex").slice(0, 16);
+}
+var CORRUPT = "The progress file is not one this version of `tula import` wrote. Nothing was changed: move it away, or pass --fresh to start over.";
+function count(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+function items(value) {
+  return Array.isArray(value) && value.every((entry) => typeof entry === "object" && entry !== null && count(entry.row) && typeof entry.code === "string" && entry.code.length <= 80);
+}
+function pairs(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) && Object.values(value).every((entry) => typeof entry === "string");
+}
+function readProgress(source) {
+  let value;
+  try {
+    value = JSON.parse(source);
+  } catch {
+    throw new UsageError2(CORRUPT);
+  }
+  if (typeof value !== "object" || value === null) {
+    throw new UsageError2(CORRUPT);
+  }
+  const found = value;
+  const counts = found.counts;
+  const orgs = found.organizations;
+  const members = found.memberships;
+  if (found.version !== 1 || !IMPORT_PROVIDERS.includes(found.provider) || typeof found.fingerprint !== "string" || typeof found.target !== "string" || !count(found.doneThrough) || !count(found.batches) || !counts || !count(counts.created) || !count(counts.skipped) || !count(counts.refused) || !items(found.refused) || !pairs(found.userIds) || !orgs || !count(orgs.cursor) || !count(orgs.created) || !count(orgs.existing) || !items(orgs.failed) || !pairs(orgs.ids) || !members || !count(members.cursor) || !count(members.added) || !count(members.existing) || !items(members.failed)) {
+    throw new UsageError2(CORRUPT);
+  }
+  return found;
+}
+function serializeProgress(progress) {
+  return `${JSON.stringify(progress, null, 2)}
+`;
+}
+
+// src/target.ts
 function variableSuffix(name) {
   return name.toUpperCase().replace(/[^A-Z0-9]/g, "_");
 }
@@ -1692,7 +1925,13 @@ async function resolveTarget2(input) {
   if (!secretKeyMatchesKind(environment.kind, secretKey)) {
     throw new UsageError2(`The config says "${name}" is a ${environment.kind} environment, and the secret key is not ` + `a ${environment.kind} key. Nothing was read or changed.`);
   }
-  return { apiUrl: apiUrl.replace(/\/+$/, ""), admin };
+  const segment = /^tula_sk_([a-z]+)_/.exec(secretKey)?.[1];
+  return {
+    apiUrl: apiUrl.replace(/\/+$/, ""),
+    admin,
+    fingerprint: targetOf(apiUrl, secretKey),
+    keyLabel: segment === undefined ? "secret key" : `secret key, ${segment}`
+  };
 }
 async function resolveAgent2(input) {
   const { name, flags, io, output } = input;
@@ -1710,6 +1949,8 @@ async function resolveAgent2(input) {
   try {
     return {
       apiUrl: apiUrl.replace(/\/+$/, ""),
+      fingerprint: targetOf(apiUrl, agentKey),
+      keyLabel: "agent key",
       admin: createAgentClient({
         baseUrl: apiUrl,
         agentKey,
@@ -1815,7 +2056,7 @@ var PLAN_OPTIONS = {
   },
   prune: {
     type: "boolean",
-    description: "Delete providers, and remove webhook endpoints, hooks and native apps, that the server has and the file does not list (default: leave them). A file with no webhooks list keeps every endpoint, one with no hooks key every hook, and one with no nativeApps list every app."
+    description: "Delete providers, and remove webhook endpoints, hooks, native apps and custom organization roles, that the server has and the file does not list (default: leave them). A file with no webhooks list keeps every endpoint, one with no hooks key every hook, one with no nativeApps list every app, and one with no organizationRoles list every role."
   },
   "rotate-secrets": {
     type: "boolean",
@@ -1829,6 +2070,14 @@ async function readRemote(admin, options) {
   const webhooks = options.webhooks ? (await admin.call("listWebhookEndpoints")).data.data : undefined;
   const hooks = options.hooks ? (await admin.call("listHooks")).data.data : undefined;
   const nativeApps = options.nativeApps ? (await admin.call("listNativeApps")).data.data : undefined;
+  const unread = { roles: false };
+  const organizationRoles = options.organizationRoles ? await admin.call("listOrganizationRoles").then((answer) => answer.data.data).catch((error) => {
+    if (isTulaAdminError4(error) && error.code === "organization.disabled") {
+      unread.roles = true;
+      return [];
+    }
+    throw error;
+  }) : undefined;
   const managedBy = settings.data.managedBy;
   return {
     revision: settings.data.revision,
@@ -1837,7 +2086,9 @@ async function readRemote(admin, options) {
     providers: providers.data.data,
     ...webhooks !== undefined && { webhooks },
     ...hooks !== undefined && { hooks },
-    ...nativeApps !== undefined && { nativeApps }
+    ...nativeApps !== undefined && { nativeApps },
+    ...organizationRoles !== undefined && { organizationRoles },
+    ...unread.roles && { organizationRolesUnread: true }
   };
 }
 function isUnknownRoute(error) {
@@ -1869,7 +2120,8 @@ async function prepare(context) {
   const remote = await readRemote(target.admin, {
     webhooks: environment.webhooks !== undefined,
     hooks: environment.hooks !== undefined,
-    nativeApps: environment.nativeApps !== undefined
+    nativeApps: environment.nativeApps !== undefined,
+    organizationRoles: environment.organizationRoles !== undefined
   });
   const prune = flags.prune === true;
   const dependents = await readDependents(target.admin, providersGoingOff2(remote.providers, environment.providers, { prune }));
@@ -2054,6 +2306,43 @@ async function runNativeAppOperation(admin, operation) {
     }
   });
 }
+var STALE_ORGANIZATION_ROLE = "An organization role was changed by someone else after this plan was made. Nothing was " + "written to it. Run `tula diff` again and review the new plan.";
+
+class StaleOrganizationRole extends Error {
+  constructor() {
+    super("an organization role changed after the plan was made");
+  }
+}
+async function runOrganizationRoleOperation(admin, operation) {
+  if (operation.kind === "organizationRole.create") {
+    const { entry } = operation;
+    await admin.call("createOrganizationRole", {
+      body: { key: entry.key, name: entry.name, permissions: entry.permissions }
+    });
+    return;
+  }
+  const headers = { "If-Match": ifMatch(operation.version) };
+  try {
+    if (operation.kind === "organizationRole.delete") {
+      await admin.call("deleteOrganizationRole", { params: { key: operation.key }, headers });
+      return;
+    }
+    const differs = (path) => operation.change.fields.some((field) => field.path === path);
+    await admin.call("updateOrganizationRole", {
+      params: { key: operation.key },
+      headers,
+      body: {
+        ...differs("name") && { name: operation.entry.name },
+        ...differs("permissions") && { permissions: operation.entry.permissions }
+      }
+    });
+  } catch (error) {
+    if (isTulaAdminError5(error) && error.code === "precondition.failed") {
+      throw new StaleOrganizationRole;
+    }
+    throw error;
+  }
+}
 async function runHookOperation(admin, environment, operation) {
   if (operation.kind === "hook.delete") {
     await admin.call("deleteHook", { params: { id: operation.id } });
@@ -2425,6 +2714,8 @@ var applyCommand2 = {
             nativeAppsChecked = true;
           }
           await runNativeAppOperation(target.admin, operation);
+        } else if (operation.kind === "organizationRole.create" || operation.kind === "organizationRole.update" || operation.kind === "organizationRole.delete") {
+          await runOrganizationRoleOperation(target.admin, operation);
         } else if (operation.kind === "webhook.create" || operation.kind === "webhook.update" || operation.kind === "webhook.delete") {
           if (!webhooksChecked) {
             const now = await target.admin.call("listWebhookEndpoints").catch((reason) => {
@@ -2456,6 +2747,8 @@ var applyCommand2 = {
         } else if (error instanceof UnreadHooks) {
           output.error(`${output.errorStyle.red("error:")} ${UNREAD_HOOKS}`);
           reportError2(output, error.reason);
+        } else if (error instanceof StaleOrganizationRole) {
+          output.error(`${output.errorStyle.red("error:")} ${STALE_ORGANIZATION_ROLE}`);
         } else if (error instanceof StaleNativeApps) {
           output.error(`${output.errorStyle.red("error:")} ${STALE_NATIVE_APPS}`);
         } else if (error instanceof UnreadNativeApps) {
@@ -2558,6 +2851,7 @@ function failureWords(proposal) {
 var STATUS_WORDS = {
   pending: "waiting for approval",
   expired: "expired",
+  rejected: "rejected by a person",
   approved: "approved, its operation not finished",
   executed: "approved and carried out",
   failed: "approved, and its operation did not end as carried out"
@@ -2697,7 +2991,7 @@ function render(line, proposal, about, now) {
   line(`  Asked for by   an agent (agent key ${printable2(proposal.proposedBy.id, 64)})`);
   line(`  Operation      ${printable2(proposal.operation, 40)}`);
   line(`  About          ${about}`);
-  line(`  What it does   ${printable2(proposal.summary, 400)}`);
+  line(`  Agent says     ${printable2(proposal.summary, 400)}`);
   line(`  Status         ${statusWords(proposal)}`);
   if (status === "pending") {
     line(`  Expires        ${timeLeft(proposal.expiresAt, now)} (${printable2(proposal.expiresAt, 40)})`);
@@ -2772,7 +3066,7 @@ async function run(context) {
   }
   const dependents = await dependentsOf(target.admin, proposal, described);
   const asked = dependents === null ? consequence : `${consequence} ${dependents}`;
-  const answer = await ask(`${asked} Approve ${printable2(proposal.operation, 40)} for ${about} at ${target.apiUrl}? Type yes to continue: `);
+  const answer = await ask(`${asked} Approve ${printable2(proposal.operation, 40)} for ${about} at ${target.apiUrl} (${target.keyLabel})? Type yes to continue: `);
   if (answer.trim().toLowerCase() !== "yes") {
     output.error("Cancelled. Nothing was changed.");
     return EXIT2.error;
@@ -2857,8 +3151,166 @@ var approveCommand2 = {
   run
 };
 
+// src/commands/audit.ts
+import { isTulaAdminError as isTulaAdminError7 } from "@tula-tech/admin";
+import {
+  AUDIT_EXPORT_FORMATS,
+  auditExportCursor
+} from "@tula-tech/contract";
+function instant(flag, value) {
+  if (value === undefined) {
+    return;
+  }
+  const ms = Date.parse(String(value));
+  if (!Number.isFinite(ms)) {
+    throw new UsageError2(`--${flag} is not a time. Use ISO 8601, e.g. 2026-01-31T00:00:00Z.`);
+  }
+  return new Date(ms).toISOString();
+}
+function takeRecords(buffer, format) {
+  const records = [];
+  let start = 0;
+  let quotes = 0;
+  for (let i = 0;i < buffer.length; i += 1) {
+    const char = buffer[i];
+    if (char === '"' && format === "csv") {
+      quotes += 1;
+    } else if (char === `
+` && (format === "ndjson" || quotes % 2 === 0)) {
+      records.push(buffer.slice(start, i).replace(/\r$/, ""));
+      start = i + 1;
+    }
+  }
+  return { records, rest: buffer.slice(start) };
+}
+function cursorOf(record, format) {
+  try {
+    if (format === "ndjson") {
+      const row = JSON.parse(record);
+      return auditExportCursor(row);
+    }
+    const [id, occurredAt] = record.split(",");
+    return id && occurredAt && id !== "id" ? auditExportCursor({ id, occurredAt }) : null;
+  } catch {
+    return null;
+  }
+}
+function requestOf(flags) {
+  const format = typeof flags.format === "string" ? flags.format : "ndjson";
+  if (!AUDIT_EXPORT_FORMATS.includes(format)) {
+    throw new UsageError2(`--format is one of ${AUDIT_EXPORT_FORMATS.join(", ")}.`);
+  }
+  return {
+    format,
+    from: instant("from", flags.from),
+    to: instant("to", flags.to),
+    after: typeof flags.resume === "string" ? flags.resume : undefined,
+    action: typeof flags.action === "string" ? flags.action : undefined,
+    organizationId: typeof flags.organization === "string" ? flags.organization : undefined
+  };
+}
+async function drain(response, format, output) {
+  let rows = 0;
+  let last = null;
+  let failed = false;
+  const emit = (records) => {
+    for (const record of records) {
+      output.line(record);
+      const cursor = cursorOf(record, format);
+      if (cursor !== null) {
+        rows += 1;
+        last = cursor;
+      }
+    }
+  };
+  let buffer = "";
+  try {
+    const decoder = new TextDecoder;
+    for await (const chunk of response.body) {
+      const taken = takeRecords(buffer + decoder.decode(chunk, { stream: true }), format);
+      buffer = taken.rest;
+      emit(taken.records);
+    }
+    emit(takeRecords(`${buffer}
+`, format).records.filter(Boolean));
+  } catch {
+    failed = true;
+  }
+  return { rows, last, failed };
+}
+async function run2(context) {
+  const { flags, io, output, positionals } = context;
+  if (positionals[0] !== "export") {
+    throw new UsageError2("Usage: tula audit export [--format ndjson|csv] [--from <time>] [--to <time>]");
+  }
+  const body = requestOf(flags);
+  const name = typeof flags.env === "string" ? flags.env : "default";
+  const target = await resolveTarget2({ name, environment: {}, flags, io, output }).catch((error) => {
+    if (isTulaAdminError7(error) && error.code === "client.agent_key") {
+      throw new UsageError2("That is an agent key (tula_ak_\u2026). An audit export needs a secret key (tula_sk_\u2026).");
+    }
+    throw error;
+  });
+  let response;
+  try {
+    response = await target.admin.stream("exportAuditLogs", { body });
+  } catch (error) {
+    if (isTulaAdminError7(error)) {
+      output.error(`${output.errorStyle.red("error:")} ${printable2(error.code, 80)}`);
+      return EXIT2.error;
+    }
+    throw error;
+  }
+  const { rows, last, failed } = await drain(response, body.format, output);
+  output.error(`${rows} ${rows === 1 ? "entry" : "entries"} exported.`);
+  if (failed) {
+    output.error(`${output.errorStyle.red("error:")} The stream ended early.`);
+  }
+  if (last !== null && (failed || rows >= 1e5)) {
+    output.error(`Continue with: tula audit export --resume ${last}`);
+  }
+  return failed ? EXIT2.error : EXIT2.ok;
+}
+var auditCommand2 = {
+  name: "audit",
+  summary: "Export the audit log as NDJSON or CSV.",
+  usage: "tula audit export [--format ndjson|csv] [--from <time>] [--to <time>] [--action <type>] [--organization <id>] [--resume <cursor>] [--env <name>]",
+  description: "Streams the environment\u2019s audit entries to standard output, oldest first. One request " + "writes at most 100000 entries; when a run stops early or reaches that limit, standard " + "error names the cursor to pass to --resume, which continues with no gap and no repeat. " + "The export is itself recorded in the audit log. Needs a secret key (not an agent key).",
+  maxPositionals: 1,
+  options: {
+    format: {
+      type: "string",
+      value: "<ndjson|csv>",
+      description: "Output format. Default ndjson."
+    },
+    from: { type: "string", value: "<time>", description: "Entries at or after this time." },
+    to: { type: "string", value: "<time>", description: "Entries before this time." },
+    action: { type: "string", value: "<type>", description: "Only this action." },
+    organization: {
+      type: "string",
+      value: "<id>",
+      description: "Only entries about this organization."
+    },
+    resume: { type: "string", value: "<cursor>", description: "Continue after this cursor." },
+    env: {
+      type: "string",
+      short: "e",
+      value: "<name>",
+      description: "Read TULA_SECRET_KEY_<NAME> first."
+    },
+    "api-url": { type: "string", value: "<url>", description: "The Tula API." },
+    "insecure-http": { type: "boolean", description: "Allow plain http that is not localhost." },
+    "secret-key-file": {
+      type: "string",
+      value: "<path>",
+      description: "Read the secret key from a file."
+    }
+  },
+  run: run2
+};
+
 // src/dev.ts
-import { createAdminClient as createAdminClient2, isTulaAdminError as isTulaAdminError7 } from "@tula-tech/admin";
+import { createAdminClient as createAdminClient2, isTulaAdminError as isTulaAdminError8 } from "@tula-tech/admin";
 import { environmentIssuer } from "@tula-tech/contract/issuer";
 
 // src/tunnel.ts
@@ -2964,7 +3416,7 @@ function said(result) {
 `).slice(-6).map((line) => `    ${printable2(line, 300)}`).join(`
 `);
 }
-async function run2(context, command, timeoutMs) {
+async function run3(context, command, timeoutMs) {
   try {
     return await context.host.run(command, {
       cwd: context.cwd,
@@ -2980,7 +3432,7 @@ async function run2(context, command, timeoutMs) {
 }
 async function tunnelStatus(context) {
   const { service } = context;
-  const result = await run2(context, service.statusCommand(), STATUS_MS);
+  const result = await run3(context, service.statusCommand(), STATUS_MS);
   if (result.timedOut) {
     throw new UsageError2(`\`${service.inspect}\` did not answer in ${STATUS_MS / 1000}s. Is ${service.binary} running on this machine?`);
   }
@@ -3000,7 +3452,7 @@ async function closeTunnel(context, routes) {
     if (before.kind !== "ours") {
       return before.kind === "absent" ? "gone" : "foreign";
     }
-    await run2(context, context.service.closeCommand(), CHANGE_MS);
+    await run3(context, context.service.closeCommand(), CHANGE_MS);
     const after = judgeTunnel(await tunnelStatus(context), routes);
     return after.kind === "absent" ? "closed" : "failed";
   } catch (error) {
@@ -3023,7 +3475,7 @@ async function openTunnel(context, routes, beforeOpening) {
   const toOpen = missing.length > 0 ? missing : routes.slice(0, 1);
   await beforeOpening?.();
   for (const route of toOpen) {
-    const result = await run2(context, service.openCommand(route), CHANGE_MS);
+    const result = await run3(context, service.openCommand(route), CHANGE_MS);
     if (result.timedOut) {
       throw new UsageError2(service.noAddress);
     }
@@ -3104,7 +3556,18 @@ function withoutDevBlock2(text) {
   const after = text.slice(found.end).replace(/^\r?\n/, "");
   return `${text.slice(0, found.start)}${after}`;
 }
+function hasControlCharacter(text) {
+  return [...text].some((char) => {
+    const code = char.charCodeAt(0);
+    return code < 32 || code === 127;
+  });
+}
 function withDevBlock2(text, vars) {
+  for (const [name, value] of Object.entries(vars)) {
+    if (!/^[A-Z][A-Z0-9_]*$/.test(name) || hasControlCharacter(value)) {
+      throw new UsageError2(`The dev block cannot hold ${name}: a name must be NAME_LIKE and a value has no newline or control character.`);
+    }
+  }
   const block = [
     BLOCK_START,
     BLOCK_NOTE,
@@ -3265,7 +3728,10 @@ and run this again. ${untouched}`);
   return `http://127.0.0.1:${port}`;
 }
 async function publishedUrl(options, service, port) {
-  const result = await options.host.run(compose(options, "port", service, port), { cwd: options.io.cwd, timeoutMs: QUICK_MS }).catch(() => null);
+  const result = await options.host.run(compose(options, "port", "--", service, port), {
+    cwd: options.io.cwd,
+    timeoutMs: QUICK_MS
+  }).catch(() => null);
   const match = /:(\d{1,5})\s*$/.exec(result?.code === 0 ? result.stdout.trim() : "");
   return match ? `http://localhost:${match[1]}` : null;
 }
@@ -3305,7 +3771,7 @@ async function accepts(options, apiUrl, secretKey) {
     await admin.call("getEnvironmentSettings");
     return true;
   } catch (error) {
-    if (isTulaAdminError7(error) && (error.code === "auth.invalid_key" || error.code === "client.invalid_key")) {
+    if (isTulaAdminError8(error) && (error.code === "auth.invalid_key" || error.code === "client.invalid_key")) {
       return false;
     }
     throw error;
@@ -3826,75 +4292,1728 @@ var doctorCommand2 = {
   }
 };
 
-// src/commands/mcp.ts
-import { isTulaAdminError as isTulaAdminError8 } from "@tula-tech/admin";
-function suffix(name) {
-  return name.toUpperCase().replace(/[^A-Z0-9]/g, "_");
-}
-function reason(error) {
-  if (error instanceof UsageError2) {
-    return error.message.replace(/ \(or TULA_[A-Z_]+_DEFAULT\)/g, "");
-  }
-  if (isTulaAdminError8(error)) {
-    return `The configured credential or API URL is not usable (${error.code}).`;
-  }
-  throw error;
+// src/commands/import.ts
+import { createHash as createHash2 } from "crypto";
+import { resolve as resolve2 } from "path";
+import { MAX_IMPORT_ROWS as MAX_IMPORT_ROWS2 } from "@tula-tech/contract";
+
+// src/import/formats.ts
+var UNREADABLE = "is not a JSON, NDJSON or CSV export this command reads";
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-async function buildMcpServer2(context) {
-  const { flags, io } = context;
-  for (const option of ["secret-key-file", "admin-token-file", "agent-key-file"]) {
-    if (flags[option] === "-") {
-      throw new UsageError2(`--${option} - would read from standard input, which carries the protocol. Use a file or the environment.`);
+function parseCsv(text) {
+  const rows = [];
+  let row = [];
+  let field = "";
+  let quoted = false;
+  let started = false;
+  const source = text.charCodeAt(0) === 65279 ? text.slice(1) : text;
+  for (let index = 0;index < source.length; index += 1) {
+    const char = source[index];
+    if (quoted) {
+      if (char === '"') {
+        if (source[index + 1] === '"') {
+          field += '"';
+          index += 1;
+        } else {
+          quoted = false;
+        }
+      } else {
+        field += char;
+      }
+      continue;
     }
-  }
-  const { createTulaMcpServer, TOOL_NAMES } = await import("@tula-tech/mcp");
-  const secrets = [];
-  const output = {
-    ...context.output,
-    redact: (value, scope) => {
-      secrets.push(value);
-      context.output.redact(value, scope);
+    if (char === '"' && field === "") {
+      quoted = true;
+      started = true;
+    } else if (char === ",") {
+      row.push(field);
+      field = "";
+      started = true;
+    } else if (char === `
+` || char === "\r") {
+      if (char === "\r" && source[index + 1] === `
+`) {
+        index += 1;
+      }
+      if (started || field !== "") {
+        row.push(field);
+        rows.push(row);
+      }
+      row = [];
+      field = "";
+      started = false;
+    } else {
+      field += char;
     }
-  };
-  const name = typeof flags.env === "string" ? flags.env : "default";
-  const unavailable = {};
-  let agentConfigured = false;
-  const agent = await resolveAgent2({ name, flags, io, output }).then((target) => {
-    agentConfigured = target !== null;
-    return target?.admin ?? null;
-  }, (error) => {
-    agentConfigured = true;
-    unavailable.agent = reason(error);
-    unavailable.admin = unavailable.agent;
-    return null;
-  });
-  const admin = agentConfigured ? null : await resolveTarget2({ name, environment: {}, flags, io, output }).then((target) => target.admin, (error) => {
-    unavailable.admin = reason(error);
-    return null;
-  });
-  const secretKeyLeftUnread = agentConfigured && (flags["secret-key-file"] !== undefined || Boolean(io.env[`TULA_SECRET_KEY_${suffix(name)}`]?.trim()) || Boolean(io.env.TULA_SECRET_KEY?.trim()));
-  let doctor = null;
-  try {
-    const named = io.env[`TULA_API_URL_${suffix(name)}`]?.trim();
-    const apiUrl = resolveApiUrl2(flags["api-url"] === undefined && named ? { ...flags, "api-url": named } : flags, io);
-    const instance = await resolveInstance2({ apiUrl, flags, io, output });
-    doctor = ({ signal }) => examine2({ apiUrl, instance, io, signal });
-  } catch (error) {
-    unavailable.doctor = reason(error);
   }
-  context.output.error(`tula mcp: ${TOOL_NAMES.length} tools; one changes live data while it runs (test_signin, where the environment allows it). Read tools: ${agent ? "configured (agent key)" : admin ? "configured" : "not configured"}. Propose tools: ${agent ? "configured" : "not configured"}. Doctor: ${doctor ? "configured" : "not configured"}.`);
-  if (secretKeyLeftUnread) {
-    context.output.error("tula mcp: an agent key is configured, so the secret key was not read. Keep the secret key out of the environment an agent runs in: it is what approves a proposal.");
+  if (quoted) {
+    throw new UsageError2("A quoted field in the CSV file is never closed.");
   }
-  if (agentConfigured && doctor && io.env.TULA_ADMIN_TOKEN?.trim()) {
-    context.output.error("tula mcp: the instance admin token is set beside an agent key. No tool can use it for anything but the deployment checks, but it is a credential of a person: prefer to " + "leave it out of an agent\u2019s environment.");
+  if (started || field !== "") {
+    row.push(field);
+    rows.push(row);
   }
-  for (const why of new Set(Object.values(unavailable))) {
-    context.output.error(`tula mcp: ${why}`);
+  return rows;
+}
+function readRecords(text, options) {
+  const body = (text.charCodeAt(0) === 65279 ? text.slice(1) : text).trim();
+  if (body === "") {
+    return [];
   }
-  return createTulaMcpServer({
-    admin,
-    agent,
+  if (body.startsWith("[") || body.startsWith("{")) {
+    let whole;
+    try {
+      whole = JSON.parse(body);
+    } catch {
+      whole = undefined;
+    }
+    if (Array.isArray(whole)) {
+      return whole.map((entry) => isRecord3(entry) ? entry : null);
+    }
+    if (isRecord3(whole)) {
+      for (const key of options.containers) {
+        const inside = whole[key];
+        if (Array.isArray(inside)) {
+          return inside.map((entry) => isRecord3(entry) ? entry : null);
+        }
+      }
+      if (!body.includes(`
+`)) {
+        return [whole];
+      }
+    }
+    if (body.startsWith("{")) {
+      return body.split(/\r?\n/).filter((line) => line.trim() !== "").map((line) => {
+        try {
+          const parsed = JSON.parse(line);
+          return isRecord3(parsed) ? parsed : null;
+        } catch {
+          return null;
+        }
+      });
+    }
+    throw new UsageError2(`${options.label} ${UNREADABLE}.`);
+  }
+  if (!options.csv) {
+    throw new UsageError2(`${options.label} ${UNREADABLE}.`);
+  }
+  const [header, ...lines] = parseCsv(body);
+  if (!header) {
+    return [];
+  }
+  const names = header.map((name) => name.trim());
+  return lines.map((fields) => {
+    const record = {};
+    names.forEach((name, position) => {
+      if (name !== "") {
+        record[name] = fields[position] ?? "";
+      }
+    });
+    return record;
+  });
+}
+function pick(record, ...keys) {
+  for (const key of keys) {
+    if (Object.hasOwn(record, key)) {
+      const value = record[key];
+      if (value !== null && value !== undefined && value !== "") {
+        return value;
+      }
+    }
+  }
+  return;
+}
+function text(value) {
+  if (typeof value === "number" && Number.isFinite(value)) {
+    return String(value);
+  }
+  if (typeof value !== "string") {
+    return;
+  }
+  const trimmed = value.trim();
+  return trimmed === "" ? undefined : trimmed;
+}
+function truthy(value) {
+  if (typeof value === "boolean") {
+    return value;
+  }
+  if (typeof value === "number") {
+    return value === 1;
+  }
+  return typeof value === "string" && /^(?:true|t|1|yes|y|on|enabled)$/i.test(value.trim());
+}
+function objectOf(value) {
+  if (isRecord3(value)) {
+    return value;
+  }
+  if (typeof value === "string" && value.trim().startsWith("{")) {
+    try {
+      const parsed = JSON.parse(value);
+      return isRecord3(parsed) ? parsed : undefined;
+    } catch {
+      return;
+    }
+  }
+  return;
+}
+function maskEmail(email) {
+  if (email === null || email.trim() === "") {
+    return "(no address)";
+  }
+  const trimmed = email.trim();
+  const at = trimmed.lastIndexOf("@");
+  if (at < 1) {
+    return "***";
+  }
+  const first = Array.from(trimmed)[0] ?? "";
+  const domain = trimmed.slice(at + 1);
+  const dot = domain.lastIndexOf(".");
+  const label = dot === -1 ? "" : domain.slice(dot).replace(/[^\w.-]/g, "");
+  return `${first}***@***${label}`;
+}
+function comparable(email) {
+  return email.trim().toLowerCase();
+}
+function usableEmail(email) {
+  const value = text(email);
+  if (value === undefined || value.length > 320 || /\s/.test(value)) {
+    return;
+  }
+  const at = value.indexOf("@");
+  return at > 0 && at === value.lastIndexOf("@") && at < value.length - 1 ? value : undefined;
+}
+var NO_EMAIL = {
+  code: "email.invalid",
+  reason: "The row has no usable email address."
+};
+var UNREADABLE_ROW = {
+  code: "source.row_unreadable",
+  reason: "The record is not a JSON object, so nothing could be read from it."
+};
+var DISABLED_USER = {
+  code: "source.user_disabled",
+  reason: "The user is disabled, blocked or banned at the provider, and importing would make the account usable again."
+};
+function storedSize(value) {
+  const json = JSON.stringify(value);
+  let extra = 0;
+  for (const char of json) {
+    if (char === ":" || char === ",") {
+      extra += 1;
+    }
+  }
+  return Buffer.byteLength(json) + extra;
+}
+var METADATA_LIMIT = 4000;
+function fitMetadata(value) {
+  const kept = Object.fromEntries(Object.entries(value).filter(([, entry]) => entry !== undefined && entry !== null));
+  if (Object.keys(kept).length === 0) {
+    return;
+  }
+  return storedSize(kept) > METADATA_LIMIT ? "too_large" : kept;
+}
+function standardBase64(value) {
+  return value.trim().replaceAll("-", "+").replaceAll("_", "/");
+}
+function readHash(hash) {
+  const value = hash.trim();
+  if (/^\$2[aby]\$/.test(value)) {
+    return { kind: "password", password: { algorithm: "bcrypt", hash: value } };
+  }
+  if (value.startsWith("$argon2id$")) {
+    return { kind: "password", password: { algorithm: "argon2id", hash: value } };
+  }
+  if (value.startsWith("$argon2i$")) {
+    return { kind: "password", password: { algorithm: "argon2i", hash: value } };
+  }
+  if (value.startsWith("pbkdf2_sha256$") || value.startsWith("$pbkdf2-sha256$")) {
+    return { kind: "password", password: { algorithm: "pbkdf2_sha256", hash: value } };
+  }
+  if (/^[0-9a-f]{16,64}:[0-9a-f]{64,256}$/i.test(value) || value.startsWith("$scrypt$")) {
+    return {
+      kind: "unsupported",
+      refusal: {
+        code: "import.unsupported_algorithm",
+        reason: "The password is hashed with scrypt, which the server does not read yet (only bcrypt, argon2, PBKDF2-SHA256 and Firebase scrypt)."
+      }
+    };
+  }
+  return {
+    kind: "unsupported",
+    refusal: {
+      code: "import.unsupported_algorithm",
+      reason: "The password hash is in a format the server does not read (it reads bcrypt, argon2id, argon2i, PBKDF2-SHA256 and Firebase scrypt)."
+    }
+  };
+}
+function refused(row, email, refusal, sourceId) {
+  return { row, sourceId, email, user: null, refusal };
+}
+function accepted(row, email, user, sourceId) {
+  return { row, sourceId, email, user, refusal: null };
+}
+function addCountNotes(notes, counts) {
+  if (counts.droppedMetadata) {
+    notes.push(`${counts.droppedMetadata} user(s) had metadata over the 4 KiB limit; it was left out and the users are imported without it.`);
+  }
+  if (counts.passwordless) {
+    notes.push(`${counts.passwordless} user(s) are imported without a password because their hash cannot be carried over (--allow-passwordless).`);
+  }
+}
+
+// src/import/auth0.ts
+function oidOf(record) {
+  const id = record._id;
+  if (isRecord3(id)) {
+    return text(id.$oid);
+  }
+  return text(id);
+}
+function indexHashes(source) {
+  const index = {
+    byId: new Map,
+    byEmail: new Map,
+    unused: new Set,
+    unreadable: 0
+  };
+  if (source === undefined) {
+    return index;
+  }
+  const records = readRecords(source, {
+    containers: ["users", "data"],
+    csv: false,
+    label: "The password hash file"
+  });
+  records.forEach((record, position) => {
+    const hash = record === null ? undefined : text(pick(record, "passwordHash", "password_hash"));
+    if (record === null || hash === undefined) {
+      index.unreadable += 1;
+      return;
+    }
+    const key = String(position);
+    index.unused.add(key);
+    const oid = oidOf(record);
+    if (oid !== undefined) {
+      index.byId.set(`auth0|${oid}`, `${key}
+${hash}`);
+    }
+    const email = usableEmail(record.email)?.toLowerCase();
+    if (email !== undefined) {
+      index.byEmail.set(email, [...index.byEmail.get(email) ?? [], `${key}
+${hash}`]);
+    }
+  });
+  return index;
+}
+function hashFor(index, userId, email) {
+  const found = (userId === undefined ? undefined : index.byId.get(userId)) ?? (index.byEmail.get(email.toLowerCase())?.length === 1 ? index.byEmail.get(email.toLowerCase())?.[0] : undefined);
+  if (found === undefined) {
+    return;
+  }
+  const [key, ...rest] = found.split(`
+`);
+  index.unused.delete(key);
+  return rest.join(`
+`);
+}
+var UNSUPPORTED = {
+  code: "import.unsupported_algorithm",
+  reason: "The password hash is in a format the server does not read. Auth0 password hashes are bcrypt; custom_password_hash is read for bcrypt and argon2 only."
+};
+function customHash(value) {
+  if (!isRecord3(value)) {
+    return;
+  }
+  const algorithm = text(value.algorithm)?.toLowerCase();
+  const hash = isRecord3(value.hash) ? text(value.hash.value) : undefined;
+  if (hash === undefined) {
+    return { refusal: UNSUPPORTED };
+  }
+  if (algorithm === "bcrypt" || algorithm === "argon2") {
+    const read = readHash(hash);
+    return read.kind === "password" ? { password: read.password } : { refusal: read.refusal };
+  }
+  return { refusal: UNSUPPORTED };
+}
+function parseAuth0(input) {
+  const notes = [];
+  const counts = { droppedMetadata: 0, passwordless: 0 };
+  const hashes = indexHashes(input.files["password-hashes"]);
+  const records = readRecords(input.text, {
+    containers: ["users", "data"],
+    csv: false,
+    label: "The Auth0 export"
+  });
+  let databaseUsers = 0;
+  let withHash = 0;
+  const rows = records.map((record, position) => {
+    const row = position + 1;
+    if (record === null) {
+      return refused(row, null, UNREADABLE_ROW);
+    }
+    const sourceId = text(pick(record, "user_id", "id"));
+    const email = usableEmail(record.email);
+    if (email === undefined) {
+      return refused(row, null, NO_EMAIL, sourceId);
+    }
+    if (truthy(record.blocked)) {
+      return refused(row, email, DISABLED_USER, sourceId);
+    }
+    const user = { email, emailVerified: truthy(record.email_verified) };
+    const name = text(record.name) ?? [text(record.given_name), text(record.family_name)].filter((part) => part !== undefined).join(" ");
+    if (name !== undefined && name !== "") {
+      user.name = name;
+    }
+    if (sourceId !== undefined) {
+      user.externalId = sourceId;
+    }
+    const meta = fitMetadata({
+      userMetadata: objectOf(record.user_metadata),
+      appMetadata: objectOf(record.app_metadata),
+      username: text(record.username)
+    });
+    if (meta === "too_large") {
+      counts.droppedMetadata += 1;
+    } else if (meta !== undefined) {
+      user.metadata = { auth0: meta };
+    }
+    if (sourceId?.startsWith("auth0|")) {
+      databaseUsers += 1;
+    }
+    const direct = text(pick(record, "passwordHash", "password_hash")) ?? hashFor(hashes, sourceId, email);
+    const found = direct !== undefined ? (() => {
+      const read = readHash(direct);
+      return read.kind === "password" ? { password: read.password } : { refusal: read.refusal };
+    })() : customHash(record.custom_password_hash);
+    if (found !== undefined) {
+      if ("password" in found) {
+        user.password = found.password;
+        withHash += 1;
+      } else {
+        if (!input.allowPasswordless) {
+          return refused(row, email, found.refusal, sourceId);
+        }
+        counts.passwordless += 1;
+      }
+    }
+    return accepted(row, email, user, sourceId);
+  });
+  if (input.files["password-hashes"] === undefined && databaseUsers > 0) {
+    notes.push(`${databaseUsers} user(s) are database-connection users, and Auth0 does not put password hashes in the user export. Without --password-hashes they are imported without a password and reset it. See the Auth0 guide for how to ask Auth0 support for the hashes.`);
+  } else if (input.files["password-hashes"] !== undefined) {
+    if (hashes.unused.size > 0) {
+      notes.push(`${hashes.unused.size} entr${hashes.unused.size === 1 ? "y" : "ies"} of the password hash file matched no user of the export.`);
+    }
+    if (hashes.unreadable > 0) {
+      notes.push(`${hashes.unreadable} line(s) of the password hash file had no readable passwordHash.`);
+    }
+    if (withHash === 0) {
+      notes.push("No password hash was matched to a user: check that the two files are from the same tenant.");
+    }
+  }
+  addCountNotes(notes, counts);
+  return { rows, organizations: [], memberships: [], notes };
+}
+
+// src/import/better-auth.ts
+function parseBetterAuth(input) {
+  const notes = [];
+  const counts = { droppedMetadata: 0, passwordless: 0 };
+  const accounts = input.files.accounts;
+  const passwords = new Map;
+  if (accounts !== undefined) {
+    for (const record of readRecords(accounts, {
+      containers: ["account", "accounts", "data"],
+      csv: true,
+      label: "The accounts file"
+    })) {
+      const provider = record === null ? undefined : text(pick(record, "providerId", "provider_id"));
+      const owner = record === null ? undefined : text(pick(record, "userId", "user_id"));
+      const hash = record === null ? undefined : text(record.password);
+      if (provider === "credential" && owner !== undefined && hash !== undefined) {
+        passwords.set(owner, hash);
+      }
+    }
+  } else {
+    notes.push("No --accounts file was given, so no password is carried over: every user is imported without one and signs in another way or resets it.");
+  }
+  const records = readRecords(input.text, {
+    containers: ["user", "users", "data"],
+    csv: true,
+    label: "The better-auth user file"
+  });
+  const rows = records.map((record, position) => {
+    const row = position + 1;
+    if (record === null) {
+      return refused(row, null, UNREADABLE_ROW);
+    }
+    const sourceId = text(pick(record, "id"));
+    const email = usableEmail(record.email);
+    if (email === undefined) {
+      return refused(row, null, NO_EMAIL, sourceId);
+    }
+    if (truthy(record.banned)) {
+      return refused(row, email, DISABLED_USER, sourceId);
+    }
+    const user = {
+      email,
+      emailVerified: truthy(pick(record, "emailVerified", "email_verified"))
+    };
+    const name = text(record.name);
+    if (name !== undefined) {
+      user.name = name;
+    }
+    if (sourceId !== undefined) {
+      user.externalId = sourceId;
+    }
+    const meta = fitMetadata({
+      username: text(record.username),
+      role: text(record.role)
+    });
+    if (meta === "too_large") {
+      counts.droppedMetadata += 1;
+    } else if (meta !== undefined) {
+      user.metadata = { betterAuth: meta };
+    }
+    const hash = sourceId === undefined ? undefined : passwords.get(sourceId);
+    if (hash !== undefined) {
+      const read = readHash(hash);
+      if (read.kind === "password") {
+        user.password = read.password;
+      } else if (input.allowPasswordless) {
+        counts.passwordless += 1;
+      } else {
+        return refused(row, email, read.refusal, sourceId);
+      }
+    }
+    return accepted(row, email, user, sourceId);
+  });
+  addCountNotes(notes, counts);
+  return { rows, organizations: [], memberships: [], notes };
+}
+
+// src/import/clerk.ts
+import { CreateOrganizationRequestSchema } from "@tula-tech/contract";
+var HASHERS = {
+  bcrypt: "bcrypt",
+  argon2id: "argon2id",
+  argon2i: "argon2i",
+  pbkdf2_sha256: "pbkdf2_sha256",
+  pbkdf2_sha256_django: "pbkdf2_sha256"
+};
+var FIREBASE_HASHER = {
+  code: "import.unsupported_algorithm",
+  reason: "The password is hashed with Firebase scrypt, whose project parameters a Clerk export does not hold. Import from the Firebase export with `--from firebase`, or use --allow-passwordless."
+};
+var UNKNOWN_HASHER = {
+  code: "import.unsupported_algorithm",
+  reason: "The password was hashed with an algorithm the server does not read (it reads bcrypt, argon2id, argon2i and PBKDF2-SHA256). Clerk's md5, sha256, scrypt, phpass and LDAP hashers are not supported."
+};
+function addressList(value) {
+  if (Array.isArray(value)) {
+    return value.flatMap((entry) => addressList(entry));
+  }
+  const single = text(value);
+  return single === undefined ? [] : single.split(/[,;]/).map((part) => part.trim().toLowerCase()).filter((part) => part !== "");
+}
+function emailOf(record) {
+  const listed = pick(record, "email_addresses", "emailAddresses");
+  if (Array.isArray(listed)) {
+    const primaryId = text(pick(record, "primary_email_address_id", "primaryEmailAddressId"));
+    const entries = listed.filter(isRecord3);
+    const chosen = entries.find((entry) => entry.id === primaryId) ?? entries[0];
+    if (chosen) {
+      const status = isRecord3(chosen.verification) ? chosen.verification.status : undefined;
+      return {
+        email: usableEmail(pick(chosen, "email_address", "emailAddress", "email")),
+        verified: status === "verified"
+      };
+    }
+  }
+  const email = usableEmail(pick(record, "primary_email_address", "primaryEmailAddress", "email", "email_address"));
+  const verified = addressList(pick(record, "verified_email_addresses", "verifiedEmailAddresses"));
+  return { email, verified: email !== undefined && verified.includes(email.toLowerCase()) };
+}
+function passwordOf(record) {
+  const digest = text(pick(record, "password_digest", "passwordDigest"));
+  if (digest === undefined) {
+    return;
+  }
+  const hasher = text(pick(record, "password_hasher", "passwordHasher"))?.toLowerCase();
+  if (hasher === undefined) {
+    const read = readHash(digest);
+    return read.kind === "password" ? { password: read.password } : { refusal: read.refusal };
+  }
+  if (hasher === "scrypt_firebase") {
+    return { refusal: FIREBASE_HASHER };
+  }
+  const algorithm = Object.hasOwn(HASHERS, hasher) ? HASHERS[hasher] : undefined;
+  return algorithm === undefined ? { refusal: UNKNOWN_HASHER } : { password: { algorithm, hash: digest } };
+}
+function metadataOf(record) {
+  const keep = {};
+  const username = text(pick(record, "username"));
+  if (username !== undefined) {
+    keep.username = username;
+  }
+  for (const [key, spellings] of [
+    ["publicMetadata", ["public_metadata", "publicMetadata"]],
+    ["privateMetadata", ["private_metadata", "privateMetadata"]],
+    ["unsafeMetadata", ["unsafe_metadata", "unsafeMetadata"]]
+  ]) {
+    const value = objectOf(pick(record, ...spellings));
+    if (value !== undefined && Object.keys(value).length > 0) {
+      keep[key] = value;
+    }
+  }
+  return keep;
+}
+function parseClerk(input) {
+  const notes = [];
+  const counts = { droppedMetadata: 0, passwordless: 0 };
+  const records = readRecords(input.text, {
+    containers: ["data", "users"],
+    csv: true,
+    label: "The Clerk export"
+  });
+  let withTotp = 0;
+  const rows = records.map((record, position) => {
+    const row = position + 1;
+    if (record === null) {
+      return refused(row, null, UNREADABLE_ROW);
+    }
+    const sourceId = text(pick(record, "id", "user_id", "userId"));
+    const { email, verified } = emailOf(record);
+    if (email === undefined) {
+      return refused(row, null, NO_EMAIL, sourceId);
+    }
+    if (truthy(pick(record, "banned", "locked"))) {
+      return refused(row, email, DISABLED_USER, sourceId);
+    }
+    if (text(pick(record, "totp_secret", "totpSecret")) !== undefined) {
+      withTotp += 1;
+    }
+    const user = { email, emailVerified: verified };
+    const name = [
+      text(pick(record, "first_name", "firstName")),
+      text(pick(record, "last_name", "lastName"))
+    ].filter((part) => part !== undefined).join(" ");
+    if (name !== "") {
+      user.name = name;
+    }
+    if (sourceId !== undefined) {
+      user.externalId = sourceId;
+    }
+    const meta = fitMetadata(metadataOf(record));
+    if (meta === "too_large") {
+      counts.droppedMetadata += 1;
+    } else if (meta !== undefined) {
+      user.metadata = { clerk: meta };
+    }
+    const password = passwordOf(record);
+    if (password !== undefined) {
+      if ("password" in password) {
+        user.password = password.password;
+      } else {
+        if (!input.allowPasswordless) {
+          return refused(row, email, password.refusal, sourceId);
+        }
+        counts.passwordless += 1;
+      }
+    }
+    return accepted(row, email, user, sourceId);
+  });
+  if (withTotp > 0) {
+    notes.push(`${withTotp} user(s) had an authenticator app at Clerk. Two-step verification is not carried over: they enrol again in Tula.`);
+  }
+  addCountNotes(notes, counts);
+  const { organizations, memberships } = parseOrganizations(input, notes);
+  return { rows, organizations, memberships, notes };
+}
+function slugOf(value) {
+  return value.normalize("NFKD").replace(/[\u0300-\u036F]/g, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 48).replace(/-+$/g, "");
+}
+function roleOf(value) {
+  if (value === undefined) {
+    return;
+  }
+  const key = value.toLowerCase().replace(/^org:/, "").replace(/[^a-z0-9_]+/g, "_");
+  return key === "basic_member" ? "member" : key;
+}
+function listOf(source, label) {
+  return source === undefined ? [] : readRecords(source, { containers: ["data"], csv: false, label });
+}
+function parseOrganizations(input, notes) {
+  const organizations = listOf(input.files.organizations, "The organizations file").map((record, position) => {
+    const row = position + 1;
+    if (record === null) {
+      return { row, sourceId: "", name: null, slug: null, refusal: UNREADABLE_ROW };
+    }
+    const sourceId = text(pick(record, "id", "organization_id")) ?? "";
+    const name = text(pick(record, "name"));
+    const slug = slugOf(text(pick(record, "slug")) ?? name ?? "");
+    const checked = CreateOrganizationRequestSchema.safeParse({ name, slug });
+    if (sourceId === "" || !checked.success) {
+      return {
+        row,
+        sourceId,
+        name: null,
+        slug: null,
+        refusal: {
+          code: "source.organization_invalid",
+          reason: "The organization has no id, or no name and slug the API accepts."
+        }
+      };
+    }
+    return { row, sourceId, name: checked.data.name, slug: checked.data.slug, refusal: null };
+  });
+  const memberships = listOf(input.files.memberships, "The memberships file").map((record, position) => {
+    const row = position + 1;
+    const invalid = (organizationId, userId) => ({
+      row,
+      organizationId,
+      userId,
+      role: null,
+      refusal: {
+        code: "source.membership_invalid",
+        reason: "The membership has no organization, no user or no role."
+      }
+    });
+    if (record === null) {
+      return invalid("", "");
+    }
+    const organization = isRecord3(record.organization) ? record.organization : undefined;
+    const data = isRecord3(record.public_user_data) ? record.public_user_data : undefined;
+    const organizationId = text(pick(record, "organization_id", "organizationId")) ?? text(organization?.id) ?? "";
+    const userId = text(pick(record, "user_id", "userId")) ?? text(data?.user_id) ?? text(data?.userId) ?? "";
+    const role = roleOf(text(pick(record, "role", "role_name")));
+    if (organizationId === "" || userId === "" || role === undefined || !/^[a-z][a-z0-9_]{0,31}$/.test(role)) {
+      return invalid(organizationId, userId);
+    }
+    return { row, organizationId, userId, role, refusal: null };
+  });
+  if (memberships.length > 0 && organizations.length === 0) {
+    notes.push("A memberships file was given without an organizations file; no organization is created.");
+  }
+  return { organizations, memberships };
+}
+
+// src/import/firebase.ts
+function parseHashConfig(source) {
+  const values = new Map;
+  const put = (key, value) => {
+    const name = key.replace(/[_-]/g, "").toLowerCase();
+    if (values.has(name)) {
+      throw new UsageError2(`The Firebase hash config file names ${name} twice. Keep one value and run the command again.`);
+    }
+    values.set(name, value);
+  };
+  const trimmed = source.trim();
+  const json = trimmed.startsWith("{") ? objectOf(trimmed) : undefined;
+  if (json !== undefined) {
+    for (const [key, value] of Object.entries(json)) {
+      if (typeof value === "string" || typeof value === "number") {
+        put(key, String(value));
+      }
+    }
+  } else {
+    for (const match of trimmed.matchAll(/([A-Za-z_][\w-]*)\s*[:=]\s*"?([^\s",}]+)"?/g)) {
+      put(match[1], match[2]);
+    }
+  }
+  const signerKey = values.get("base64signerkey") ?? values.get("signerkey");
+  if (signerKey === undefined || signerKey === "") {
+    throw new UsageError2("The Firebase hash config file has no base64_signer_key. It is the file or console text with base64_signer_key, base64_salt_separator, rounds and mem_cost.");
+  }
+  const number = (name) => {
+    const value = values.get(name);
+    return value === undefined || !/^\d{1,3}$/.test(value) ? undefined : Number(value);
+  };
+  return {
+    signerKey: standardBase64(signerKey),
+    saltSeparator: standardBase64(values.get("base64saltseparator") ?? values.get("saltseparator") ?? ""),
+    rounds: number("rounds"),
+    memCost: number("memcost")
+  };
+}
+var NO_SALT = {
+  code: "import.hash_malformed",
+  reason: "The user has a passwordHash but no salt, so the hash cannot be checked later."
+};
+var NO_CONFIG = {
+  code: "import.hash_malformed",
+  reason: "The user has a password hash and no Firebase hash parameters were given (--firebase-hash-config)."
+};
+function parseFirebase(input) {
+  const notes = [];
+  const counts = { droppedMetadata: 0, passwordless: 0 };
+  const records = readRecords(input.text, {
+    containers: ["users"],
+    csv: false,
+    label: "The Firebase export"
+  });
+  const needsConfig = records.filter((record) => record !== null && text(record.passwordHash) !== undefined);
+  if (needsConfig.length > 0 && input.firebase === undefined && !input.allowPasswordless) {
+    throw new UsageError2(`${needsConfig.length} user(s) of the export have a password hash, and Firebase's hash parameters are needed to carry them: pass --firebase-hash-config <file> (Authentication, Users, the menu, Password hash parameters), or --allow-passwordless to import them without a password.`);
+  }
+  const rows = records.map((record, position) => {
+    const row = position + 1;
+    if (record === null) {
+      return refused(row, null, UNREADABLE_ROW);
+    }
+    const sourceId = text(pick(record, "localId", "uid"));
+    const email = usableEmail(record.email);
+    if (email === undefined) {
+      return refused(row, null, NO_EMAIL, sourceId);
+    }
+    if (truthy(record.disabled)) {
+      return refused(row, email, DISABLED_USER, sourceId);
+    }
+    const user = { email, emailVerified: truthy(record.emailVerified) };
+    const name = text(record.displayName);
+    if (name !== undefined) {
+      user.name = name;
+    }
+    if (sourceId !== undefined) {
+      user.externalId = sourceId;
+    }
+    const meta = fitMetadata({ customAttributes: objectOf(record.customAttributes) });
+    if (meta === "too_large") {
+      counts.droppedMetadata += 1;
+    } else if (meta !== undefined) {
+      user.metadata = { firebase: meta };
+    }
+    const hash = text(record.passwordHash);
+    if (hash !== undefined) {
+      const salt = text(record.salt);
+      const missing = input.firebase === undefined ? NO_CONFIG : salt === undefined ? NO_SALT : null;
+      if (missing === null && salt !== undefined) {
+        user.password = {
+          algorithm: "firebase_scrypt",
+          hash: standardBase64(hash),
+          params: { salt: standardBase64(salt) }
+        };
+      } else if (input.allowPasswordless) {
+        counts.passwordless += 1;
+      } else {
+        return refused(row, email, missing ?? NO_SALT, sourceId);
+      }
+    }
+    return accepted(row, email, user, sourceId);
+  });
+  addCountNotes(notes, counts);
+  const usesScrypt = rows.some((entry) => entry.user?.password?.algorithm === "firebase_scrypt");
+  const firebaseScrypt = usesScrypt && input.firebase !== undefined ? input.firebase : undefined;
+  return { rows, firebaseScrypt, organizations: [], memberships: [], notes };
+}
+
+// src/import/report.ts
+var SERVER_REASONS = {
+  "email.invalid": "The server does not accept the address.",
+  "import.unsupported_algorithm": "The server does not read this password hash algorithm.",
+  "import.hash_malformed": "The password hash is not a well-formed hash of its algorithm.",
+  "import.hash_parameters_too_weak": "The password hash has parameters below the server\u2019s minimum (see docs/user-import.md).",
+  "import.hash_parameters_too_costly": "The password hash has parameters above the server\u2019s maximum (see docs/user-import.md).",
+  "validation.failed": "The row\u2019s name, metadata or external id cannot be stored.",
+  "source.organization_missing": "The membership\u2019s organization was not created.",
+  "source.member_user_missing": "The membership\u2019s user is not in the environment.",
+  "organization.role_unknown": "The role does not exist in the environment.",
+  "organization.slug_taken": "The slug is taken and no organization with it could be found."
+};
+function reasonOf(code) {
+  return Object.hasOwn(SERVER_REASONS, code) ? SERVER_REASONS[code] : "See the code.";
+}
+function summarize(parsed) {
+  const algorithms = {};
+  const seen = new Set;
+  const summary = {
+    total: parsed.rows.length,
+    ready: 0,
+    algorithms,
+    withoutPassword: 0,
+    repeated: 0,
+    refused: [],
+    organizations: parsed.organizations.length,
+    memberships: parsed.memberships.length
+  };
+  for (const entry of parsed.rows) {
+    if (entry.user === null || entry.refusal !== null) {
+      if (entry.refusal) {
+        summary.refused.push({
+          kind: "user",
+          row: entry.row,
+          code: entry.refusal.code,
+          email: maskEmail(entry.email),
+          reason: entry.refusal.reason
+        });
+      }
+      continue;
+    }
+    summary.ready += 1;
+    const algorithm = entry.user.password?.algorithm;
+    if (algorithm === undefined) {
+      summary.withoutPassword += 1;
+    } else {
+      algorithms[algorithm] = (algorithms[algorithm] ?? 0) + 1;
+    }
+    const key = comparable(entry.user.email);
+    if (seen.has(key)) {
+      summary.repeated += 1;
+    }
+    seen.add(key);
+  }
+  for (const entry of parsed.organizations) {
+    if (entry.refusal) {
+      summary.refused.push({
+        kind: "organization",
+        row: entry.row,
+        code: entry.refusal.code,
+        reason: entry.refusal.reason
+      });
+    }
+  }
+  for (const entry of parsed.memberships) {
+    if (entry.refusal) {
+      summary.refused.push({
+        kind: "membership",
+        row: entry.row,
+        code: entry.refusal.code,
+        reason: entry.refusal.reason
+      });
+    }
+  }
+  return summary;
+}
+function serverRefusals(parsed, progress) {
+  const emails = new Map(parsed.rows.map((entry) => [entry.row, entry.email]));
+  const lines = progress.refused.map((item) => ({
+    kind: "user",
+    row: item.row,
+    code: item.code,
+    email: maskEmail(emails.get(item.row) ?? null),
+    reason: reasonOf(item.code)
+  }));
+  for (const item of progress.organizations.failed) {
+    lines.push({
+      kind: "organization",
+      row: item.row,
+      code: item.code,
+      reason: reasonOf(item.code)
+    });
+  }
+  for (const item of progress.memberships.failed) {
+    lines.push({ kind: "membership", row: item.row, code: item.code, reason: reasonOf(item.code) });
+  }
+  return lines;
+}
+function plural2(count, one, many = `${one}s`) {
+  return `${count} ${count === 1 ? one : many}`;
+}
+function refusedLines(output, lines) {
+  if (lines.length === 0) {
+    return;
+  }
+  output.line();
+  output.line(output.style.bold(`Refused (${lines.length}):`));
+  for (const line of lines) {
+    const who = line.email === undefined ? "" : `  ${line.email}`;
+    output.line(`  ${line.kind} ${line.row}  ${line.code}${who}  ${line.reason}`);
+  }
+}
+function renderDryRun(output, provider, parsed, summary) {
+  output.line(output.style.bold(`Dry run: ${provider} export. Nothing was sent.`));
+  output.line();
+  output.line(`Users in the file:        ${summary.total}`);
+  output.line(`  would be imported:      ${summary.ready}`);
+  for (const [algorithm, count] of Object.entries(summary.algorithms).sort()) {
+    output.line(`    with ${algorithm} password: ${count}`);
+  }
+  output.line(`    without a password:   ${summary.withoutPassword}`);
+  if (summary.repeated > 0) {
+    output.line(`    repeating an address: ${summary.repeated} (the server skips them: the first row wins)`);
+  }
+  output.line(`  refused here:           ${summary.refused.filter((line) => line.kind === "user").length}`);
+  if (summary.organizations > 0 || summary.memberships > 0) {
+    output.line(`Organizations:            ${summary.organizations}`);
+    output.line(`Memberships:              ${summary.memberships}`);
+  }
+  for (const note of parsed.notes) {
+    output.line();
+    output.line(`Note: ${note}`);
+  }
+  refusedLines(output, summary.refused);
+  output.line();
+  output.line(summary.ready === 0 && summary.organizations === 0 ? "Nothing would be imported." : "Run the same command with --yes to import. It is safe to run again: users that exist are skipped.");
+}
+function renderResult(output, provider, parsed, summary, progress) {
+  const server = serverRefusals(parsed, progress);
+  const all = [...summary.refused, ...server];
+  output.line(output.style.bold(`Imported the ${provider} export.`));
+  output.line();
+  output.line(`Users created:            ${progress.counts.created}`);
+  output.line(`Users skipped:            ${progress.counts.skipped} (their address was already a user)`);
+  output.line(`Users refused:            ${summary.refused.filter((line) => line.kind === "user").length + progress.counts.refused}`);
+  if (summary.organizations > 0 || summary.memberships > 0) {
+    const orgs = progress.organizations;
+    const members = progress.memberships;
+    output.line(`Organizations:            ${orgs.created} created, ${orgs.existing} already there, ${orgs.failed.length} failed`);
+    output.line(`Memberships:              ${members.added} added, ${members.existing} already members, ${members.failed.length} failed`);
+  }
+  for (const note of parsed.notes) {
+    output.line();
+    output.line(`Note: ${note}`);
+  }
+  refusedLines(output, all);
+  output.line();
+  output.line(all.length === 0 ? "Done." : `Done, with ${plural2(all.length, "refused item")}. Fix the export and run the same command again to retry: what exists is skipped.`);
+  return all.length;
+}
+function reportToJson(provider, parsed, summary, progress) {
+  return {
+    provider,
+    dryRun: progress === undefined,
+    users: {
+      total: summary.total,
+      ready: summary.ready,
+      withoutPassword: summary.withoutPassword,
+      algorithms: summary.algorithms,
+      repeatedAddresses: summary.repeated
+    },
+    organizations: summary.organizations,
+    memberships: summary.memberships,
+    notes: parsed.notes,
+    refused: [...summary.refused, ...progress ? serverRefusals(parsed, progress) : []],
+    ...progress ? {
+      result: {
+        created: progress.counts.created,
+        skipped: progress.counts.skipped,
+        refusedByServer: progress.counts.refused,
+        organizations: {
+          created: progress.organizations.created,
+          existing: progress.organizations.existing,
+          failed: progress.organizations.failed.length
+        },
+        memberships: {
+          added: progress.memberships.added,
+          existing: progress.memberships.existing,
+          failed: progress.memberships.failed.length
+        }
+      }
+    } : {}
+  };
+}
+
+// src/import/run.ts
+import { isTulaAdminError as isTulaAdminError9 } from "@tula-tech/admin";
+import { MAX_IMPORT_ROWS } from "@tula-tech/contract";
+var BATCH_BYTE_LIMIT = 4000000;
+var MAX_ATTEMPTS = 6;
+var BACKOFF_MS = 2000;
+function say(context, text) {
+  context.output.error(text);
+}
+function isRateLimited(error) {
+  return error.status === 429 || error.code === "rate_limited";
+}
+function isTransient(error) {
+  return error.status === 0 || error.status >= 500;
+}
+async function withRetry(context, what, call) {
+  for (let attempt = 1;; attempt += 1) {
+    try {
+      return await call();
+    } catch (error) {
+      if (!isTulaAdminError9(error) || attempt >= MAX_ATTEMPTS) {
+        throw error;
+      }
+      let wait;
+      if (isRateLimited(error)) {
+        wait = Math.min(error.retryAfterMs ?? BACKOFF_MS * attempt, context.maxWaitMs);
+        say(context, `The rate limit was reached; waiting ${Math.ceil(wait / 1000)}s before ${what}.`);
+      } else if (isTransient(error)) {
+        wait = BACKOFF_MS * attempt;
+        say(context, `The server did not answer (${error.status === 0 ? "no response" : `HTTP ${error.status}`}); trying ${what} again in ${Math.ceil(wait / 1000)}s.`);
+      } else {
+        throw error;
+      }
+      await context.host.sleep(Math.max(0, wait));
+    }
+  }
+}
+async function save(context, progress) {
+  await context.host.writeSecretFile(context.progressPath, serializeProgress(progress));
+}
+function setOwn(record, key, value) {
+  Object.defineProperty(record, key, {
+    value,
+    enumerable: true,
+    writable: true,
+    configurable: true
+  });
+}
+function codeOf(error) {
+  return /^[a-z][a-z0-9_]*(?:\.[a-z][a-z0-9_]*)*$/.test(error.code) && error.code.length <= 80 ? error.code : "unknown";
+}
+function nextBatch(rows, after, batchSize, extraBytes) {
+  const batch = [];
+  let bytes = extraBytes + 32;
+  for (const entry of rows) {
+    if (entry.row <= after || entry.user === null) {
+      continue;
+    }
+    const size = Buffer.byteLength(JSON.stringify(entry.user)) + 1;
+    if (batch.length > 0 && (batch.length >= batchSize || bytes + size > BATCH_BYTE_LIMIT)) {
+      break;
+    }
+    batch.push(entry);
+    bytes += size;
+  }
+  return batch;
+}
+function importable(parsed) {
+  return parsed.rows.filter((entry) => entry.user !== null).length;
+}
+async function importUsers(context, parsed, progress) {
+  const total = importable(parsed);
+  const batchSize = Math.min(context.batchSize, MAX_IMPORT_ROWS);
+  const firebaseBytes = parsed.firebaseScrypt ? Buffer.byteLength(JSON.stringify(parsed.firebaseScrypt)) : 0;
+  const keepIds = parsed.memberships.length > 0;
+  for (;; ) {
+    const batch = nextBatch(parsed.rows, progress.doneThrough, batchSize, firebaseBytes);
+    if (batch.length === 0) {
+      return;
+    }
+    const users = batch.map((entry) => entry.user);
+    const needsFirebase = parsed.firebaseScrypt !== undefined && users.some((user) => user.password?.algorithm === "firebase_scrypt");
+    let retried = false;
+    const { data } = await withRetry(context, "importing", async () => {
+      try {
+        return await context.admin.call("importUsers", {
+          body: needsFirebase ? { users, firebaseScrypt: parsed.firebaseScrypt } : { users }
+        });
+      } catch (error) {
+        if (isTulaAdminError9(error) && isTransient(error)) {
+          retried = true;
+        }
+        throw error;
+      }
+    });
+    if (data.results.length !== batch.length) {
+      throw new UsageError2("The server answered a batch with a different number of results than rows sent. Nothing more was sent; the progress file is unchanged.");
+    }
+    for (const result of data.results) {
+      const entry = batch[result.index];
+      if (entry === undefined) {
+        continue;
+      }
+      if (result.status === "created") {
+        progress.counts.created += 1;
+        if (keepIds && entry.sourceId !== undefined) {
+          setOwn(progress.userIds, entry.sourceId, result.id);
+        }
+      } else if (result.status === "skipped") {
+        if (keepIds && entry.sourceId !== undefined && result.id !== undefined) {
+          setOwn(progress.userIds, entry.sourceId, result.id);
+        }
+        if (retried && result.sameExternalId === true) {
+          progress.counts.created += 1;
+        } else {
+          progress.counts.skipped += 1;
+        }
+      } else {
+        progress.counts.refused += 1;
+        progress.refused.push({
+          row: entry.row,
+          code: /^[a-z][a-z0-9_.]{0,79}$/.test(result.code) ? result.code : "unknown"
+        });
+      }
+    }
+    progress.doneThrough = batch[batch.length - 1].row;
+    progress.batches += 1;
+    await save(context, progress);
+    const done = progress.counts.created + progress.counts.skipped + progress.counts.refused;
+    say(context, `Imported ${done} of ${total} users (batch ${progress.batches}).`);
+  }
+}
+async function findUser(context, cache, email) {
+  const key = comparable(email);
+  const cached = cache.get(key);
+  if (cached !== undefined) {
+    return cached;
+  }
+  const { data } = await withRetry(context, "looking a user up", () => context.admin.call("listUsers", { query: { q: email, size: 20 } }));
+  const match = data.data.find((user) => user.email !== null && comparable(user.email) === key);
+  cache.set(key, match?.id ?? null);
+  return match?.id ?? null;
+}
+async function findOrganization(context, slug) {
+  for (let page = 1;; page += 1) {
+    const { data } = await withRetry(context, "looking an organization up", () => context.admin.call("listOrganizations", { query: { page, size: 100 } }));
+    const match = data.data.find((organization) => organization.slug === slug);
+    if (match) {
+      return match.id;
+    }
+    if (page >= data.meta.totalPages) {
+      return null;
+    }
+  }
+}
+var DISABLED = "Organizations are switched off in this environment (organizations.enabled). Switch them on and run the same command again: it continues from the progress file.";
+async function importOrganizations(context, parsed, progress) {
+  const organizations = progress.organizations;
+  while (organizations.cursor < parsed.organizations.length) {
+    const entry = parsed.organizations[organizations.cursor];
+    if (entry.refusal === null && entry.name !== null && entry.slug !== null) {
+      try {
+        const { data } = await withRetry(context, "creating an organization", () => context.admin.call("createOrganization", {
+          body: { name: entry.name, slug: entry.slug }
+        }));
+        setOwn(organizations.ids, entry.sourceId, data.id);
+        organizations.created += 1;
+      } catch (error) {
+        if (!isTulaAdminError9(error)) {
+          throw error;
+        }
+        if (error.code === "organization.disabled") {
+          throw new UsageError2(DISABLED);
+        }
+        if (error.code === "organization.slug_taken") {
+          const id = await findOrganization(context, entry.slug);
+          if (id === null) {
+            organizations.failed.push({ row: entry.row, code: "organization.slug_taken" });
+          } else {
+            setOwn(organizations.ids, entry.sourceId, id);
+            organizations.existing += 1;
+          }
+        } else if (isRateLimited(error) || isTransient(error)) {
+          throw error;
+        } else {
+          organizations.failed.push({ row: entry.row, code: codeOf(error) });
+        }
+      }
+    }
+    organizations.cursor += 1;
+    await save(context, progress);
+  }
+  const emails = new Map;
+  for (const entry of parsed.rows) {
+    if (entry.sourceId !== undefined && entry.email !== null) {
+      emails.set(entry.sourceId, entry.email);
+    }
+  }
+  const cache = new Map;
+  const members = progress.memberships;
+  while (members.cursor < parsed.memberships.length) {
+    const entry = parsed.memberships[members.cursor];
+    if (entry.refusal === null && entry.role !== null) {
+      const organizationId = Object.hasOwn(organizations.ids, entry.organizationId) ? organizations.ids[entry.organizationId] : undefined;
+      const email = emails.get(entry.userId);
+      const userId = Object.hasOwn(progress.userIds, entry.userId) ? progress.userIds[entry.userId] : email === undefined ? null : await findUser(context, cache, email);
+      if (organizationId === undefined) {
+        members.failed.push({ row: entry.row, code: "source.organization_missing" });
+      } else if (userId === null || userId === undefined) {
+        members.failed.push({ row: entry.row, code: "source.member_user_missing" });
+      } else {
+        try {
+          await withRetry(context, "adding a member", () => context.admin.call("addOrganizationMember", {
+            params: { id: organizationId },
+            body: { userId, role: entry.role }
+          }));
+          members.added += 1;
+        } catch (error) {
+          if (!isTulaAdminError9(error)) {
+            throw error;
+          }
+          if (error.code === "organization.disabled") {
+            throw new UsageError2(DISABLED);
+          }
+          if (error.code === "organization.member_exists") {
+            members.existing += 1;
+          } else if (isRateLimited(error) || isTransient(error)) {
+            throw error;
+          } else {
+            members.failed.push({ row: entry.row, code: codeOf(error) });
+          }
+        }
+      }
+    }
+    members.cursor += 1;
+    await save(context, progress);
+  }
+}
+
+// src/import/supabase.ts
+var DELETED = {
+  code: "source.user_deleted",
+  reason: "The user is soft-deleted at Supabase (`deleted_at` is set)."
+};
+var ANONYMOUS = {
+  code: "email.invalid",
+  reason: "The row is an anonymous user and has no email address."
+};
+function stillAhead(value, now) {
+  const iso = text(value);
+  if (iso === undefined) {
+    return false;
+  }
+  const at = Date.parse(iso);
+  return Number.isNaN(at) ? true : at > now;
+}
+function parseSupabase(input, now = Date.now()) {
+  const notes = [];
+  const counts = { droppedMetadata: 0, passwordless: 0 };
+  const records = readRecords(input.text, {
+    containers: ["users", "data"],
+    csv: true,
+    label: "The Supabase export"
+  });
+  const rows = records.map((record, position) => {
+    const row = position + 1;
+    if (record === null) {
+      return refused(row, null, UNREADABLE_ROW);
+    }
+    const sourceId = text(pick(record, "id"));
+    const email = usableEmail(record.email);
+    if (pick(record, "deleted_at") !== undefined) {
+      return refused(row, email ?? null, DELETED, sourceId);
+    }
+    if (email === undefined) {
+      return refused(row, null, truthy(record.is_anonymous) ? ANONYMOUS : NO_EMAIL, sourceId);
+    }
+    if (stillAhead(record.banned_until, now)) {
+      return refused(row, email, DISABLED_USER, sourceId);
+    }
+    const metaUser = objectOf(record.raw_user_meta_data);
+    const user = {
+      email,
+      emailVerified: pick(record, "email_confirmed_at", "confirmed_at") !== undefined
+    };
+    const nameValue = text(metaUser?.full_name) ?? text(metaUser?.name);
+    if (nameValue !== undefined) {
+      user.name = nameValue;
+    }
+    if (sourceId !== undefined) {
+      user.externalId = sourceId;
+    }
+    const meta = fitMetadata({
+      userMetadata: metaUser,
+      appMetadata: objectOf(record.raw_app_meta_data)
+    });
+    if (meta === "too_large") {
+      counts.droppedMetadata += 1;
+    } else if (meta !== undefined) {
+      user.metadata = { supabase: meta };
+    }
+    const hash = text(record.encrypted_password);
+    if (hash !== undefined) {
+      const read = readHash(hash);
+      if (read.kind === "password") {
+        user.password = read.password;
+      } else if (input.allowPasswordless) {
+        counts.passwordless += 1;
+      } else {
+        return refused(row, email, read.refusal, sourceId);
+      }
+    }
+    return accepted(row, email, user, sourceId);
+  });
+  addCountNotes(notes, counts);
+  return { rows, organizations: [], memberships: [], notes };
+}
+
+// src/commands/import.ts
+var USAGE2 = `tula import --from <provider> <export file> [--yes] [--progress-file <path>] [--fresh] [--allow-passwordless] [--no-trust-verified]
+` + `            [--password-hashes <file>] [--accounts <file>] [--organizations <file>] [--memberships <file>]
+` + `            [--firebase-hash-config <file>] [--firebase-rounds <n>] [--firebase-mem-cost <n>]
+` + "            [--batch-size <n>] [--max-wait <seconds>] [--env <name>] [--api-url <url>] [--secret-key-file <path>] [--json]";
+var PARSERS = {
+  clerk: parseClerk,
+  auth0: parseAuth0,
+  firebase: parseFirebase,
+  supabase: (input) => parseSupabase(input),
+  "better-auth": parseBetterAuth
+};
+var EXTRA_FILES = {
+  clerk: ["organizations", "memberships"],
+  auth0: ["password-hashes"],
+  firebase: [],
+  supabase: [],
+  "better-auth": ["accounts"]
+};
+var ALL_EXTRA = ["organizations", "memberships", "password-hashes", "accounts"];
+var DEFAULT_MAX_WAIT_SECONDS = 120;
+function whole(flags, name, min, max) {
+  const value = flags[name];
+  if (typeof value !== "string") {
+    return;
+  }
+  const number = /^\d{1,6}$/.test(value) ? Number(value) : Number.NaN;
+  if (!(number >= min && number <= max)) {
+    throw new UsageError2(`--${name} takes a whole number from ${min} to ${max}.`);
+  }
+  return number;
+}
+async function readInput(context, path, option) {
+  const host = context.io.host;
+  if (!host) {
+    throw new UsageError2("This run cannot read files.");
+  }
+  const found = await host.readFile(resolve2(context.io.cwd, path));
+  if (found === null) {
+    throw new UsageError2(`The file given as ${option} does not exist.`);
+  }
+  return found;
+}
+async function firebaseParameters(context) {
+  const { flags, io, output } = context;
+  const file = typeof flags["firebase-hash-config"] === "string" ? flags["firebase-hash-config"] : undefined;
+  const rounds = whole(flags, "firebase-rounds", 1, 1000);
+  const memCost = whole(flags, "firebase-mem-cost", 1, 1000);
+  const fromEnv = io.env.TULA_FIREBASE_SIGNER_KEY?.trim();
+  if (file === undefined && !fromEnv) {
+    return;
+  }
+  const config = file !== undefined ? parseHashConfig(await readInput(context, file, "--firebase-hash-config")) : {
+    signerKey: standardBase64(fromEnv ?? ""),
+    saltSeparator: standardBase64(io.env.TULA_FIREBASE_SALT_SEPARATOR ?? ""),
+    rounds: undefined,
+    memCost: undefined
+  };
+  output.redact(config.signerKey);
+  if (fromEnv) {
+    output.redact(fromEnv);
+  }
+  output.redact(config.saltSeparator);
+  const rawSeparator = io.env.TULA_FIREBASE_SALT_SEPARATOR?.trim();
+  if (rawSeparator) {
+    output.redact(rawSeparator);
+  }
+  const finalRounds = rounds ?? config.rounds;
+  const finalMemCost = memCost ?? config.memCost;
+  if (finalRounds === undefined || finalMemCost === undefined) {
+    throw new UsageError2("Firebase\u2019s rounds and mem_cost are needed: put them in the hash config file, or pass --firebase-rounds and --firebase-mem-cost.");
+  }
+  return {
+    signerKey: config.signerKey,
+    saltSeparator: config.saltSeparator,
+    rounds: finalRounds,
+    memCost: finalMemCost
+  };
+}
+function checkOptions(provider, flags) {
+  for (const name of ALL_EXTRA) {
+    if (flags[name] !== undefined && !EXTRA_FILES[provider].includes(name)) {
+      throw new UsageError2(`--${name} is not used with --from ${provider}.`);
+    }
+  }
+  if (provider !== "firebase") {
+    for (const name of ["firebase-hash-config", "firebase-rounds", "firebase-mem-cost"]) {
+      if (flags[name] !== undefined) {
+        throw new UsageError2(`--${name} is only used with --from firebase.`);
+      }
+    }
+  }
+}
+async function load(context, provider, file) {
+  const { flags } = context;
+  const text = await readInput(context, file, "the export file");
+  const files = {};
+  for (const name of EXTRA_FILES[provider]) {
+    const path = flags[name];
+    if (typeof path === "string") {
+      files[name] = await readInput(context, path, `--${name}`);
+    }
+  }
+  const firebase = provider === "firebase" ? await firebaseParameters(context) : undefined;
+  const parsed = PARSERS[provider]({
+    text,
+    files,
+    allowPasswordless: flags["allow-passwordless"] === true,
+    firebase
+  });
+  if (flags["no-trust-verified"] === true) {
+    for (const entry of parsed.rows) {
+      if (entry.user !== null) {
+        entry.user.emailVerified = false;
+      }
+    }
+  }
+  const fingerprint = fingerprintOf([
+    ["export", text],
+    ...Object.entries(files).sort(([left], [right]) => left.localeCompare(right)),
+    [
+      "options",
+      JSON.stringify({
+        passwordless: flags["allow-passwordless"] === true,
+        unverified: flags["no-trust-verified"] === true,
+        firebase: firebase === undefined ? null : createHash2("sha256").update(JSON.stringify(firebase)).digest("hex")
+      })
+    ]
+  ]);
+  return { parsed, fingerprint };
+}
+async function loadProgress(context, path, fresh) {
+  const { host } = context.io;
+  const existing = await host?.readFile(path);
+  if (existing === null || existing === undefined || context.flags.fresh === true) {
+    return fresh;
+  }
+  const found = readProgress(existing);
+  if (found.provider !== fresh.provider || found.fingerprint !== fresh.fingerprint) {
+    throw new UsageError2("The progress file belongs to a different export. Nothing was sent. Use the matching export, name another file with --progress-file, or pass --fresh to start over (users that exist are skipped).");
+  }
+  if (found.target !== fresh.target) {
+    throw new UsageError2("The progress file was made for a different API or secret key. Nothing was sent. Use the same ones, name another file with --progress-file, or pass --fresh to start over (users that exist are skipped).");
+  }
+  return found;
+}
+var importCommand2 = {
+  name: "import",
+  summary: "Import users from Clerk, Auth0, Firebase, Supabase or better-auth.",
+  usage: USAGE2,
+  description: "Reads the provider\u2019s export file on this machine, with no request to the old provider, " + "and prints a report of what would be imported and what is refused (row number, code, and a " + "masked address). With --yes it sends the users in batches of up to 500 to " + "POST /v1/admin/users/import with the secret key from TULA_SECRET_KEY or " + `--secret-key-file, waiting out the rate limit.
+
+` + "A progress file (default: <export file>.tula-import-progress.json) holds row numbers, " + "counts, codes and ids, never a password hash or an address; run the same command again " + "after an interruption and it continues. A user whose address exists is skipped, so " + "running it again is safe. The progress file is bound to the export and to the API and " + `key; --fresh ignores it.
+
+` + "Providers: clerk (CSV or JSON, with --organizations and --memberships), auth0 (NDJSON or " + "JSON, with --password-hashes), firebase (auth:export JSON, with --firebase-hash-config), " + "supabase (auth.users CSV or JSON) and better-auth (user table, with --accounts). " + "A password hash the server cannot read refuses its row, or with --allow-passwordless " + `imports the user without a password.
+
+` + "Firebase\u2019s signer key is never taken on the command line: it is in the hash config file, " + `or in TULA_FIREBASE_SIGNER_KEY (and TULA_FIREBASE_SALT_SEPARATOR).
+
+` + "Exit codes: 0 done and nothing refused, 2 something was refused (a report, not a failure), " + "1 an error (the progress file keeps what was done).",
+  maxPositionals: 1,
+  options: {
+    from: {
+      type: "string",
+      value: "<provider>",
+      description: `The provider: ${IMPORT_PROVIDERS.join(", ")}.`
+    },
+    yes: {
+      type: "boolean",
+      short: "y",
+      description: "Import. Without it only the report is printed."
+    },
+    "progress-file": {
+      type: "string",
+      value: "<path>",
+      description: "Where the progress is kept. Default: <export file>.tula-import-progress.json."
+    },
+    fresh: { type: "boolean", description: "Ignore an existing progress file and start over." },
+    "allow-passwordless": {
+      type: "boolean",
+      description: "Import a user whose password hash cannot be carried over without a password, instead of refusing the row."
+    },
+    "no-trust-verified": {
+      type: "boolean",
+      description: "Import every address as unverified, whatever the export says. For an export from a source you do not control."
+    },
+    "password-hashes": {
+      type: "string",
+      value: "<file>",
+      description: "Auth0: the password hash export from Auth0 support (NDJSON)."
+    },
+    accounts: {
+      type: "string",
+      value: "<file>",
+      description: "better-auth: the account table, which holds the password hashes."
+    },
+    organizations: {
+      type: "string",
+      value: "<file>",
+      description: "Clerk: the organizations (JSON from the Backend API)."
+    },
+    memberships: {
+      type: "string",
+      value: "<file>",
+      description: "Clerk: the organization memberships (JSON from the Backend API)."
+    },
+    "firebase-hash-config": {
+      type: "string",
+      value: "<file>",
+      description: "Firebase: the project\u2019s password hash parameters (base64_signer_key, base64_salt_separator, rounds, mem_cost)."
+    },
+    "firebase-rounds": {
+      type: "string",
+      value: "<n>",
+      description: "Firebase: rounds, when the config file lacks it."
+    },
+    "firebase-mem-cost": {
+      type: "string",
+      value: "<n>",
+      description: "Firebase: mem_cost, when the config file lacks it."
+    },
+    "batch-size": {
+      type: "string",
+      value: "<n>",
+      description: `Users per request, at most ${MAX_IMPORT_ROWS2} (the default).`
+    },
+    "max-wait": {
+      type: "string",
+      value: "<seconds>",
+      description: `The longest a Retry-After is waited. Default: ${DEFAULT_MAX_WAIT_SECONDS}.`
+    },
+    env: {
+      type: "string",
+      short: "e",
+      value: "<name>",
+      description: "Names the TULA_API_URL_<NAME> and TULA_SECRET_KEY_<NAME> variables read."
+    },
+    "api-url": {
+      type: "string",
+      value: "<url>",
+      description: "The Tula API. Default: TULA_API_URL_<NAME>, then TULA_API_URL."
+    },
+    "insecure-http": {
+      type: "boolean",
+      description: "Allow a plain http API URL that is not localhost: the secret key then crosses the network in clear text."
+    },
+    "secret-key-file": {
+      type: "string",
+      value: "<path>",
+      description: "Read the secret key from a file (- for standard input, piped)."
+    },
+    json: { type: "boolean", description: "Print the report as JSON." }
+  },
+  run: async (context) => {
+    const { flags, positionals, io, output } = context;
+    const provider = flags.from;
+    if (typeof provider !== "string" || !IMPORT_PROVIDERS.includes(provider)) {
+      throw new UsageError2(`--from names the provider: one of ${IMPORT_PROVIDERS.join(", ")}. Usage: ${USAGE2}`);
+    }
+    const source = provider;
+    const file = positionals[0];
+    if (file === undefined) {
+      throw new UsageError2(`Name the export file. Usage: ${USAGE2}`);
+    }
+    const batchSize = whole(flags, "batch-size", 1, MAX_IMPORT_ROWS2) ?? MAX_IMPORT_ROWS2;
+    const maxWait = whole(flags, "max-wait", 0, 3600) ?? DEFAULT_MAX_WAIT_SECONDS;
+    checkOptions(source, flags);
+    const { parsed, fingerprint } = await load(context, source, file);
+    const summary = summarize(parsed);
+    if (flags.yes !== true) {
+      if (flags.json) {
+        output.line(JSON.stringify(reportToJson(source, parsed, summary), null, 2));
+      } else {
+        renderDryRun(output, source, parsed, summary);
+      }
+      return summary.refused.length > 0 ? EXIT2.refused : EXIT2.ok;
+    }
+    const target = await resolveTarget2({
+      name: typeof flags.env === "string" ? flags.env : "default",
+      environment: {},
+      flags,
+      io,
+      output
+    });
+    const host = io.host;
+    if (!host) {
+      throw new UsageError2("This run cannot write files.");
+    }
+    const progressPath = resolve2(io.cwd, typeof flags["progress-file"] === "string" ? flags["progress-file"] : `${file}.tula-import-progress.json`);
+    const progress = await loadProgress(context, progressPath, newProgress(source, fingerprint, target.fingerprint));
+    if (progress.batches > 0 || progress.organizations.cursor > 0) {
+      output.error(`Continuing from the progress file (after user row ${progress.doneThrough}).`);
+    }
+    const run = {
+      admin: target.admin,
+      host,
+      output,
+      progressPath,
+      batchSize,
+      maxWaitMs: maxWait * 1000
+    };
+    try {
+      await importUsers(run, parsed, progress);
+      await importOrganizations(run, parsed, progress);
+    } catch (error) {
+      const code = reportError2(output, error);
+      output.error(`Stopped. The progress file keeps what was done (${progress.counts.created + progress.counts.skipped + progress.counts.refused} users answered); run the same command again to continue.`);
+      return code;
+    }
+    if (flags.json) {
+      output.line(JSON.stringify(reportToJson(source, parsed, summary, progress), null, 2));
+      return summary.refused.length + progress.counts.refused > 0 || progress.organizations.failed.length + progress.memberships.failed.length > 0 ? EXIT2.refused : EXIT2.ok;
+    }
+    return renderResult(output, source, parsed, summary, progress) > 0 ? EXIT2.refused : EXIT2.ok;
+  }
+};
+
+// src/commands/mcp.ts
+import { isTulaAdminError as isTulaAdminError10 } from "@tula-tech/admin";
+function suffix(name) {
+  return name.toUpperCase().replace(/[^A-Z0-9]/g, "_");
+}
+function reason(error) {
+  if (error instanceof UsageError2) {
+    return error.message.replace(/ \(or TULA_[A-Z_]+_DEFAULT\)/g, "");
+  }
+  if (isTulaAdminError10(error)) {
+    return `The configured credential or API URL is not usable (${error.code}).`;
+  }
+  throw error;
+}
+async function buildMcpServer2(context) {
+  const { flags, io } = context;
+  for (const option of ["secret-key-file", "admin-token-file", "agent-key-file"]) {
+    if (flags[option] === "-") {
+      throw new UsageError2(`--${option} - would read from standard input, which carries the protocol. Use a file or the environment.`);
+    }
+  }
+  const { createTulaMcpServer, TOOL_NAMES } = await import("@tula-tech/mcp");
+  const secrets = [];
+  const output = {
+    ...context.output,
+    redact: (value, scope) => {
+      secrets.push(value);
+      context.output.redact(value, scope);
+    }
+  };
+  const name = typeof flags.env === "string" ? flags.env : "default";
+  const unavailable = {};
+  let agentConfigured = false;
+  const agent = await resolveAgent2({ name, flags, io, output }).then((target) => {
+    agentConfigured = target !== null;
+    return target?.admin ?? null;
+  }, (error) => {
+    agentConfigured = true;
+    unavailable.agent = reason(error);
+    unavailable.admin = unavailable.agent;
+    return null;
+  });
+  const admin = agentConfigured ? null : await resolveTarget2({ name, environment: {}, flags, io, output }).then((target) => target.admin, (error) => {
+    unavailable.admin = reason(error);
+    return null;
+  });
+  const secretKeyLeftUnread = agentConfigured && (flags["secret-key-file"] !== undefined || Boolean(io.env[`TULA_SECRET_KEY_${suffix(name)}`]?.trim()) || Boolean(io.env.TULA_SECRET_KEY?.trim()));
+  const agentIgnoredAdminToken = agentConfigured && flags["admin-token-file"] === undefined && Boolean(io.env.TULA_ADMIN_TOKEN?.trim());
+  let doctor = null;
+  try {
+    const named = io.env[`TULA_API_URL_${suffix(name)}`]?.trim();
+    const apiUrl = resolveApiUrl2(flags["api-url"] === undefined && named ? { ...flags, "api-url": named } : flags, io);
+    const instance = await resolveInstance2({
+      apiUrl,
+      flags,
+      io: agentIgnoredAdminToken ? { ...io, env: { ...io.env, TULA_ADMIN_TOKEN: undefined } } : io,
+      output
+    });
+    doctor = ({ signal }) => examine2({ apiUrl, instance, io, signal });
+  } catch (error) {
+    unavailable.doctor = reason(error);
+  }
+  context.output.error(`tula mcp: ${TOOL_NAMES.length} tools; one changes live data while it runs (test_signin, where the environment allows it). Read tools: ${agent ? "configured (agent key)" : admin ? "configured" : "not configured"}. Propose tools: ${agent ? "configured" : "not configured"}. Doctor: ${doctor ? "configured" : "not configured"}.`);
+  if (secretKeyLeftUnread) {
+    context.output.error("tula mcp: an agent key is configured, so the secret key was not read. Keep the secret key out of the environment an agent runs in: it is what approves a proposal.");
+  }
+  if (agentIgnoredAdminToken) {
+    context.output.error("tula mcp: an agent key is configured, so the admin token was ignored (it is a credential of a person). Pass --admin-token-file to enable run_doctor.");
+  }
+  for (const why of new Set(Object.values(unavailable))) {
+    context.output.error(`tula mcp: ${why}`);
+  }
+  return createTulaMcpServer({
+    admin,
+    agent,
     doctor,
     cwd: io.cwd,
     secrets,
@@ -3911,7 +6030,7 @@ var mcpCommand2 = {
 
 ` + "For an AI agent, give it an agent key (tula_ak_\u2026): --agent-key-file, " + `TULA_AGENT_KEY_<NAME> or TULA_AGENT_KEY. It reads what a secret key reads, proposes, and runs a sign-in test where the environment allows one; it changes nothing else. With it the secret key is not read at all.
 
-The API URL comes from --api-url, TULA_API_URL_<NAME> or TULA_API_URL; the secret key from --secret-key-file, TULA_SECRET_KEY_<NAME> or TULA_SECRET_KEY; the instance admin token (run_doctor only) from --admin-token-file or TULA_ADMIN_TOKEN. None is required: without a key the read tools answer "not configured" and the scaffold tools still work. Standard output carries only the protocol; everything else is written to standard error.`,
+The API URL comes from --api-url, TULA_API_URL_<NAME> or TULA_API_URL; the secret key from --secret-key-file, TULA_SECRET_KEY_<NAME> or TULA_SECRET_KEY; the instance admin token (run_doctor only) from --admin-token-file or TULA_ADMIN_TOKEN (with an agent key, only --admin-token-file). None is required: without a key the read tools answer "not configured" and the scaffold tools still work. Standard output carries only the protocol; everything else is written to standard error.`,
   options: {
     env: {
       type: "string",
@@ -3960,7 +6079,7 @@ The API URL comes from --api-url, TULA_API_URL_<NAME> or TULA_API_URL; the secre
 import {
   evaluatePassword
 } from "@tula-tech/contract/password-rules";
-var USAGE2 = "tula policy test [--env <name>] [--email <address>] [--name <full name>] [--json]";
+var USAGE3 = "tula policy test [--env <name>] [--email <address>] [--name <full name>] [--json]";
 function describeRule(check) {
   const params = check.params ?? {};
   switch (check.rule) {
@@ -4012,7 +6131,7 @@ async function readPassword(context) {
 var policyCommand2 = {
   name: "policy",
   summary: "Test a password against an environment\u2019s password policy.",
-  usage: USAGE2,
+  usage: USAGE3,
   description: "Shows which rules of the environment\u2019s password policy a password passes. The password " + "is asked for without being shown, or read from standard input when it is piped. It is " + "checked on this machine and never sent anywhere; the breached-password check, which only " + "the server makes, is reported as not run. A password given as an argument works too, with " + `a warning: a command line is recorded in shell history.
 
 ` + "The secret key decides the environment (TULA_SECRET_KEY, or TULA_SECRET_KEY_<NAME> with " + `--env <name>).
@@ -4055,7 +6174,7 @@ var policyCommand2 = {
   run: async (context) => {
     const { flags, io, output, positionals } = context;
     if (positionals[0] !== "test") {
-      throw new UsageError2(`Usage: ${USAGE2}`);
+      throw new UsageError2(`Usage: ${USAGE3}`);
     }
     if (flags["secret-key-file"] === "-") {
       throw new UsageError2("--secret-key-file - would read the key from standard input, which is where the password comes from. Use a file or TULA_SECRET_KEY.");
@@ -4117,13 +6236,14 @@ var policyCommand2 = {
 
 // src/process-io.ts
 import { readFile, stat } from "fs/promises";
-import { isAbsolute, resolve as resolve2 } from "path";
+import { isAbsolute, resolve as resolve3 } from "path";
 import { createInterface } from "readline/promises";
 
 // src/process-host.ts
 import { constants } from "fs";
 import { lstat, open, rename, rm, unlink } from "fs/promises";
 import { basename as basename2 } from "path";
+var MAX_INPUT_BYTES = 1024 * 1024;
 function linkRefusal(path) {
   return new UsageError2(`${basename2(path)} is a symbolic link. \`tula\` does not write a secret or change a mode through a link: replace it with a regular file.`);
 }
@@ -4239,6 +6359,9 @@ function createProcessHost(env) {
         return null;
       }
       try {
+        if ((await file.stat()).size > MAX_INPUT_BYTES) {
+          throw new Error(`${path} is larger than ${MAX_INPUT_BYTES} bytes.`);
+        }
         return await file.readFile("utf8");
       } finally {
         await file.close();
@@ -4348,17 +6471,21 @@ function readHidden(parts, question) {
   });
 }
 function createProcessIo(parts) {
-  let warned = false;
-  async function checkMode(path) {
-    if (warned || parts.platform === "win32") {
+  const warned = new Set;
+  async function checkFile(path) {
+    const stats = await parts.stat(path).then((found) => found, () => {
       return;
+    });
+    if (stats?.size !== undefined && stats.size > MAX_INPUT_BYTES) {
+      throw new UsageError2(`The file is larger than ${MAX_INPUT_BYTES} bytes.`);
     }
-    const mode = await parts.stat(path).then((stats) => stats.mode, () => {
+    if (warned.has(path) || parts.platform === "win32") {
       return;
-    });
+    }
+    const mode = stats?.mode;
     if (mode !== undefined && (mode & 63) !== 0) {
-      warned = true;
-      parts.stderr.write(`warning: the file given as --secret-key-file is readable by other users (mode ${(mode & 511).toString(8).padStart(4, "0")}). Restrict it: chmod 600 <file>.
+      warned.add(path);
+      parts.stderr.write(`warning: ${printable2(path, 200)} is readable by other users (mode ${(mode & 511).toString(8).padStart(4, "0")}). Restrict it: chmod 600 <file>.
 `);
     }
   }
@@ -4389,12 +6516,15 @@ function createProcessIo(parts) {
       let text = "";
       for await (const chunk of parts.stdin) {
         text += String(chunk);
+        if (text.length > MAX_INPUT_BYTES) {
+          throw new UsageError2(`Standard input is larger than ${MAX_INPUT_BYTES} bytes.`);
+        }
       }
       return text;
     },
     readFile: async (path) => {
-      const absolute = isAbsolute(path) ? path : resolve2(parts.cwd, path);
-      await checkMode(absolute);
+      const absolute = isAbsolute(path) ? path : resolve3(parts.cwd, path);
+      await checkFile(absolute);
       return parts.readFile(absolute);
     }
   };
@@ -4428,10 +6558,12 @@ var COMMANDS2 = [
   policyCommand2,
   devCommand2,
   mcpCommand2,
-  approveCommand2
+  approveCommand2,
+  importCommand2,
+  auditCommand2
 ];
 async function main2(argv, overrides = {}) {
   return runCli2(argv, { ...processIo(), ...overrides }, COMMANDS2);
 }
 
-export { UsageError2, parseArgs2, MANAGING_TOOL2, SET_PATHS2, diffValues2, DEPENDENTS_UNREAD2, readDependentCount2, planProviders2, providersGoingOff2, buildPlan2, orderOperations2, VERSION2, printable2, examine2, exitCode2, reportToJson2, renderReport2, shouldUseColor2, createOutput2, EXIT2, reportError2, runCli2, planWarnings2, applyRequirements2, describeOperation2, renderPlan2, planToJson2, resolveTarget2, resolveAgent2, resolveApiUrl2, readSecretFile2, resolveInstance2, applyCommand2, approveCommand2, DEV_ENV_FILE2, parseDevBlock2, withoutDevBlock2, withDevBlock2, startDev2, stopDev2, devCommand2, diffCommand2, doctorCommand2, buildMcpServer2, mcpCommand2, policyCommand2, COMMANDS2, main2 };
+export { UsageError2, parseArgs2, MANAGING_TOOL2, SET_PATHS2, diffValues2, DEPENDENTS_UNREAD2, readDependentCount2, planProviders2, providersGoingOff2, buildPlan2, orderOperations2, VERSION2, printable2, examine2, exitCode2, reportToJson2, renderReport2, shouldUseColor2, createOutput2, EXIT2, reportError2, runCli2, planWarnings2, applyRequirements2, describeOperation2, renderPlan2, planToJson2, resolveTarget2, resolveAgent2, resolveApiUrl2, readSecretFile2, resolveInstance2, applyCommand2, approveCommand2, auditCommand2, DEV_ENV_FILE2, parseDevBlock2, withoutDevBlock2, withDevBlock2, startDev2, stopDev2, devCommand2, diffCommand2, doctorCommand2, importCommand2, buildMcpServer2, mcpCommand2, policyCommand2, COMMANDS2, main2 };