
Security News
Open VSX Unblocks Extension IDs Used in Malware Campaign
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.
@aurorajs.dev/catalyst-cli
Advanced tools
A new CLI generated with oclif
$ npm install -g @aurorajs.dev/catalyst-cli
$ catalyst COMMAND
running command...
$ catalyst (--version)
@aurorajs.dev/catalyst-cli/1.0.2 darwin-arm64 node-v24.14.0
$ catalyst --help [COMMAND]
USAGE
$ catalyst COMMAND
...
catalyst add - Add an Aurora package to an existing project.catalyst ai - AI provider configuration sync (CLAUDE.md, AGENTS.md, skills symlinks)catalyst autocomplete - Display autocomplete installation instructions.catalyst deploy - Deploy Aurora projectscatalyst env - Encrypt/decrypt environment files with SOPScatalyst generate - Generate a module's source code from its YAML definition.catalyst help - Display help for catalyst.catalyst keys - Generate RSA private key and public key (defaults to ./backend/.keys)catalyst new - Create a new Aurora monorepo project.catalyst origin - Manage .origin files emitted by catalyst generatecatalyst pipeline - Generate a deploy workflow from templates (interactive).catalyst plugins - List installed plugins.catalyst provision - Provision Aurora project infrastructure (DNS + Hosting + CI/CD)catalyst sheets - Bidirectional sync between Aurora YAML schemas and Google SheetsBidirectional sync between Aurora YAML schemas and Google Sheets. Each bounded context maps to a spreadsheet where module schemas can be collaboratively edited.
Create a service account in Google Cloud Console with Google Sheets API enabled, then base64-encode the JSON key:
base64 -i service-account.json
Add it to your .env:
GOOGLE_SERVICE_ACCOUNT=eyJ0eXBlIjoic2VydmljZV9hY2NvdW50Ii...
Share each spreadsheet with the service account email (with Editor access).
Add a sheets section to aurora.yaml:
sheets:
bounded_contexts:
iam:
spreadsheet_id: 'YOUR_SPREADSHEET_ID'
description: 'Identity and Access Management'
common:
spreadsheet_id: 'YOUR_SPREADSHEET_ID'
description: 'Common module schemas'
YAML schemas are expected in ./cliter/{bounded_context}/*.aurora.yaml.
# List configured bounded contexts
catalyst sheets list
# Validate connection to a spreadsheet
catalyst sheets validate --bc iam
# Push YAML schemas to Google Sheets
catalyst sheets push --bc iam
catalyst sheets push --all
catalyst sheets push --all --dry-run
# Pull from Google Sheets to YAML files
catalyst sheets pull --bc iam
catalyst sheets pull --all
catalyst sheets pull --all --no-backup
# Show differences between YAML and Sheets
catalyst sheets diff --bc iam
catalyst sheets diff --all --summary
Without --bc or --all, commands prompt interactively for the bounded context.
Trigger CI/CD pipelines by pushing source branches to environments/{env}. The GitHub Actions workflow is configured to run on push to environments/**.
Each environment in aurora.yaml has an optional source field (defaults to main) that specifies which branch to push:
environments:
dev:
source: main # pushes main → environments/dev
prod:
source: qa # promotes qa → environments/prod
# Deploy all environments
catalyst deploy
# Deploy only dev
catalyst deploy --env dev
# Dry run — show what would be pushed without executing
catalyst deploy --dry-run
# Custom config path
catalyst deploy --env prod -c ../aurora.yaml
Internally, the command runs git push origin {source}:environments/{env} for each resolved environment.
Create a .env file in your project root (next to aurora.yaml):
IONOS_API_KEY=prefix.secret
PLESK_API_KEY=your-plesk-api-key
PLESK_HOST=plesk.yourserver.com
PLESK_SSH_KEY=~/.ssh/plesk.yourserver.com
PLESK_SSH_USER=root
# Global passwords (used as fallback for all environments)
FTP_PASSWORD=your-ftp-password
DB_PASSWORD=your-db-password
# Per-environment passwords (take priority over global)
# DEV_FTP_PASSWORD=dev-ftp-pass
# PROD_FTP_PASSWORD=prod-ftp-pass
# DEV_DB_PASSWORD=dev-db-pass
# PROD_DB_PASSWORD=prod-db-pass
The deploy key installation on the Plesk server requires SSH access. If SSH is not available, the CLI will show a warning with the public key to install manually — it does not block the deployment.
To set up SSH access, generate a key named after the server and copy it:
# 1. Generate key (one time per machine)
ssh-keygen -t ed25519 -C "aurora-cli@PLESK_HOST" -f ~/.ssh/PLESK_HOST -N ""
# 2. Copy to server (will ask for root password)
ssh-copy-id -i ~/.ssh/PLESK_HOST.pub root@PLESK_HOST
# 3. Verify
ssh -i ~/.ssh/PLESK_HOST root@PLESK_HOST "echo OK"
Replace PLESK_HOST with your actual server hostname (e.g., s14.beopen.cloud).
Then add the key path to your .env:
PLESK_SSH_KEY=~/.ssh/PLESK_HOST
Copy aurora.example.yaml to aurora.yaml in your project and fill in your values.
# Provision all environments (passwords from .env)
catalyst provision
# Provision only dev
catalyst provision --env dev
# Provision only prod backend
catalyst provision --env prod --target back
# Provision only frontend (all environments)
catalyst provision --target front
# Skip DNS and CI/CD (applies to all plans)
catalyst provision --skip-dns --skip-cicd
# Pass passwords inline (overrides .env)
catalyst provision --ftp-password s3cret --db-password dbpass
GitHub secrets and variables are prefixed with ENV_TARGET_ (e.g., DEV_BACK_SSH_PRIVATE_KEY, PROD_FRONT_SERVER_HOST).
FAQs
A CLI tool to manage Aurora Catalyst projects
We found that @aurorajs.dev/catalyst-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.

Product
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.