workos 0.15.2 → 0.16.0

package/README.md

@@ -81,6 +81,9 @@ Resource Management:
   api-key                Manage per-org API keys
   org-domain             Manage organization domains
 
+Migrations:
+  migrations             Migrate users and SSO connections into WorkOS
+
 Workflows:
   seed                   Declarative resource provisioning from YAML
   setup-org              One-shot organization onboarding
@@ -196,6 +199,27 @@ Inspects a directory's sync state, user/group counts, recent events, and detects
 workos debug-sync directory_01ABC123
 ```
 
+### Migrations
+
+Migrate users and SSO connections from other identity providers into WorkOS. The `migrations` namespace passes through to `@workos/migrations`.
+
+```bash
+# Interactive migration wizard
+workos migrations wizard
+
+# Export a blank CSV template
+workos migrations export-template saml_connections --output saml_connections.csv
+workos migrations export-template oidc_connections --output oidc_connections.csv
+
+# Export from Auth0
+workos migrations export-auth0 --domain your-tenant.auth0.com --client-id <id> --client-secret <secret>
+
+# Import users from CSV
+workos migrations import --csv users.csv
+```
+
+Run `workos migrations --help` for all available subcommands.
+
 <!-- UNRELEASED: Local Development (emulator) — hidden until beta testing is complete.
      To restore, uncomment this section and re-enable the `emulate` and `dev` commands
      in src/bin.ts and src/utils/help-json.ts.
@@ -512,13 +536,14 @@ workos portal generate-link --intent <intent> --org <orgId> [--return-url] [--su
 
 ```bash
 workos vault list [--limit]
-workos vault get <id>
-workos vault get-by-name <name>
-workos vault create --name <name> --value <secret> [--org <orgId>]
-workos vault update <id> --value <secret> [--version-check]
+workos vault get <id> [--decrypt]
+workos vault get-by-name <name> [--decrypt]
+workos vault create --name <name> --org <orgId> [--value <secret>]   # omit --value to read from stdin
+workos vault update <id> [--value <secret>] [--version-check]        # omit --value to read from stdin
 workos vault delete <id>
 workos vault describe <id>
 workos vault list-versions <id>
+workos vault run --secret ENV_VAR=vault-name [...] [--env <name>] [--dry-run] -- <command>
 ```
 
 #### api-key
@@ -712,17 +737,18 @@ OAuth credentials are stored in the system keychain (with `~/.workos/credentials
 
 ## Telemetry
 
-The installer collects anonymous usage telemetry to help improve the product:
+The CLI collects anonymous usage telemetry to help improve the product:
+
+- **Command events** -- command name, duration, success/failure, termination reason, and which flags were used (for telemetry-enabled commands; `install` and `dashboard` use session events instead)
+- **Session events** -- framework detected, step timing, token usage (installer only)
+- **Crash events** -- sanitized error type and stack trace (no secrets, truncated to 4KB)
 
-- Session outcome (success/error/cancelled)
-- Framework detected
-- Duration and step timing
-- Token usage (for capacity planning)
+Environment fingerprint (OS, Node version, shell, CI detection) is included on all events. No code, credentials, or personal data is collected.
 
-No code, credentials, or personal data is collected. Disable with:
+Disable with:
 
 ```bash
-WORKOS_TELEMETRY=false npx workos@latest install
+WORKOS_TELEMETRY=false workos <command>
 ```
 
 ## Logs