@atlasauth/cli 0.10.0 → 0.12.0

package/dist/migrate/auth0/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/auth0/plugin.ts"],"names":[],"mappings":";;;AAAA,2CAA+D;AAC/D,yDAAgF;AAChF,yCAAwC;AAExC,qDAAiG;AACjG,uDAAmD;AAEnD;;;;;;;GAOG;AAEH,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,yCAAyC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACjJ,MAAM,cAAc,GAAmB,EAAE,IAAI,EAAE,wBAAwB,EAAE,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,6EAA6E,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC9M,MAAM,kBAAkB,GAAmB,EAAE,IAAI,EAAE,4BAA4B,EAAE,GAAG,EAAE,0BAA0B,EAAE,KAAK,EAAE,2BAA2B,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACtL,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,wBAAwB,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC3J,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,uDAAuD,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACzK,MAAM,aAAa,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,oEAAoE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAChN,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,yBAAyB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC9I,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,sCAAsC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC3J,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,uDAAuD,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC/K,MAAM,KAAK,GAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,4DAA4D,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAEpK,SAAS,QAAQ,CAAC,CAAgB;IAChC,OAAO,IAAA,mBAAM,EAAC,IAAA,iBAAI,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,8GAA8G;AAC9G,SAAS,cAAc,CAAC,CAAgB,EAAE,MAAc;IACtD,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;IAC9C,MAAM,YAAY,GAAG,CAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ,IAAI,YAAY,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,iBAAQ,CAAC,yMAAyM,CAAC,CAAC;IAChO,CAAC;IACD,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,OAAO,IAAI,wBAAU,CAAC;QACpB,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,WAAW,MAAM,SAAS;QACnC,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,CAAC,MAAM,KAAK,MAAM,IAAA,uBAAe,EAAC,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAC7I,SAAS,EAAE,CAAC,CAAC,KAAK;KACnB,CAAC,CAAC;AACL,CAAC;AAEY,QAAA,WAAW,GAAoB;IAC1C,MAAM,EAAE,OAAO;IACf,MAAM,EAAE,OAAO;IACf,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,wcAAwc;IAC9c,MAAM,EAAE;QACN,KAAK,EAAE,0CAA0C;QACjD,WAAW,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,kBAAkB,CAAC;QACrE,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,IAAI,GAAG,MAAM,IAAA,uBAAU,EAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAA,+BAAgB,EAAC,cAAc,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YAClG,OAAO,IAAA,mCAAoB,EAAC,IAAI,CAAC,CAAC;QACpC,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,qHAAqH;QAC5H,WAAW,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,CAAC;QAC1G,MAAM,EAAE;YACN,sPAAsP;YACtP,oKAAoK;YACpK,oMAAoM;YACpM,iGAAiG;SAClG;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,SAAS,GAAG,IAAA,sBAAS,EAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;YACnD,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YACvC,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;YAC9C,MAAM,YAAY,GAAG,CAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;YACtD,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ,IAAI,YAAY,CAAC,EAAE,CAAC;gBACxD,MAAM,IAAI,iBAAQ,CAAC,+JAA+J,CAAC,CAAC;YACtL,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,OAAO,EAAE,GAAG,EAAE,CACzC,IAAA,mBAAW,EAAC;gBACV,MAAM;gBACN,KAAK;gBACL,QAAQ;gBACR,YAAY;gBACZ,SAAS;gBACT,UAAU,EAAE,IAAA,sBAAS,EAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC;gBAC7C,YAAY,EAAE,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;gBACtC,qBAAqB,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,wBAAwB,CAAC;gBACxD,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;gBACzB,SAAS,EAAE,CAAC,CAAC,KAAK;gBAClB,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;aAC3C,CAAC,CACH,CAAC;YACF,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,OAAO;QACf,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,GAA2B,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC5D,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5D,IAAI,MAAM;gBAAE,IAAI,CAAC,MAAM,GAAG,IAAA,mBAAM,EAAC,MAAM,CAAC,CAAC;YACzC,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,QAAQ;gBAAE,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;YACxC,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,OAAO;QACf,MAAM,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,MAAM,GAA2B,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9D,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5D,IAAI,MAAM;gBAAE,MAAM,CAAC,MAAM,GAAG,IAAA,mBAAM,EAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,QAAQ;gBAAE,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC;YAC1C,MAAM,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAC5C,IAAI,UAAU;gBAAE,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC;YAC/C,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,EAAE,aAAa;KACtB;IACD,OAAO,EAAE,OAAO;CACjB,CAAC"}

package/dist/migrate/clerk/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const clerkPlugin: MigrationPlugin;

package/dist/migrate/clerk/plugin.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.clerkPlugin = void 0;
+const clerk_1 = require("../export/clerk");
+const clerk_config_1 = require("../export/clerk-config");
+const backend_1 = require("@atlasauth/backend");
+const errors_1 = require("../../errors");
+const plugin_kit_1 = require("../export/plugin-kit");
+/**
+ * `atlas migrate clerk` — Clerk's Backend API (secret key) plus the dashboard
+ * CSV export (the only source of password digests and TOTP secrets), the
+ * `clerk` JWT bridge preset (session tokens verified against the Frontend
+ * API's JWKS), lazy password verification through Clerk's verify_password
+ * for users the CSV does not cover, and the `clerk` codemod.
+ */
+const SECRET_KEY = { flag: '--clerk-secret-key', env: 'CLERK_SECRET_KEY', label: 'your Clerk secret key (sk_…)', required: false, secret: true };
+const PUBLISHABLE_KEY = { flag: '--clerk-publishable-key', env: 'CLERK_PUBLISHABLE_KEY', label: 'your Clerk publishable key (pk_…)', required: false };
+const CSV = { flag: '--clerk-csv', env: 'CLERK_CSV_EXPORT', label: 'the Clerk dashboard CSV export (Users → Export)', required: false };
+/** The publishable key from the flag / CLERK_PUBLISHABLE_KEY, else the framework-prefixed env vars apps already have. */
+function publishableKey(p) {
+    return (p.credential(PUBLISHABLE_KEY) ??
+        ['NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY', 'VITE_CLERK_PUBLISHABLE_KEY', 'PUBLIC_CLERK_PUBLISHABLE_KEY', 'EXPO_PUBLIC_CLERK_PUBLISHABLE_KEY'].map((k) => p.ctx.env[k]?.trim()).find(Boolean));
+}
+exports.clerkPlugin = {
+    vendor: 'clerk',
+    source: 'clerk',
+    label: 'Clerk',
+    help: 'Move a Clerk instance: its settings (social connections, sign-in methods, MFA, organizations, JWT templates), its users with their password digests and TOTP secrets from the dashboard CSV export, organizations, members, roles, invitations, enterprise connections and API keys from the Backend API, a zero-logout bridge for signed-in users, and the code. Your secret key stays on this machine.',
+    config: {
+        reads: 'your Clerk instance (the public environment via the publishable key, plus JWT templates, redirect URLs and roles with the secret key)',
+        credentials: [PUBLISHABLE_KEY, SECRET_KEY],
+        async translate(p) {
+            const pk = publishableKey(p);
+            if (!pk)
+                throw new errors_1.CliError('Clerk: the publishable key is needed (--clerk-publishable-key, CLERK_PUBLISHABLE_KEY or NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY).');
+            const snap = await (0, plugin_kit_1.vendorStep)('Clerk', () => (0, clerk_config_1.fetchClerkConfig)({ publishableKey: pk, secretKey: p.credential(SECRET_KEY), fetchImpl: p.fetch }));
+            return (0, clerk_config_1.translateClerkConfig)(snap);
+        },
+    },
+    export: {
+        reads: 'the Clerk Backend API (secret key) and/or the dashboard CSV export (--clerk-csv)',
+        credentials: [SECRET_KEY, CSV],
+        limits: [
+            'Password digests and TOTP secrets only come from the dashboard CSV export (Users → Export); without it, users keep their passwords through lazy migration (verify_password) instead.',
+            'Passkeys (only their names are readable) and backup codes cannot be exported: those users enrol again.',
+            'Sessions are not exported: Clerk session tokens are JWTs, exchanged by the clerk bridge preset.',
+        ],
+        async run(p, writer, resume) {
+            const secretKey = p.credential(SECRET_KEY);
+            const csv = (0, plugin_kit_1.localFile)(p, CSV, 'text');
+            if (!secretKey && !csv)
+                throw new errors_1.CliError('Clerk: pass the secret key (--clerk-secret-key / CLERK_SECRET_KEY), the dashboard CSV export (--clerk-csv), or both.');
+            const set = await (0, plugin_kit_1.vendorStep)('Clerk', () => (0, clerk_1.exportClerk)({ secretKey, csv, fetchImpl: p.fetch, skipApiKeys: (0, plugin_kit_1.flag)(p, 'skip-api-keys'), onProgress: (m) => p.say(`  reading ${m}`) }));
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    bridge: {
+        preset: 'clerk',
+        vars(p, t) {
+            const pk = publishableKey(p);
+            const fromKey = pk ? (0, backend_1.clerkFrontendApiFromPublishableKey)(pk) : null;
+            const frontend_api = t?.bridge?.vars.frontend_api ?? fromKey;
+            const vars = {};
+            if (frontend_api)
+                vars.frontend_api = frontend_api;
+            return vars;
+        },
+    },
+    lazy: {
+        preset: 'clerk',
+        config: () => ({}),
+        secret: { ...SECRET_KEY, required: true },
+    },
+    codemod: 'clerk',
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/clerk/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/clerk/plugin.ts"],"names":[],"mappings":";;;AAAA,2CAA8C;AAC9C,yDAAgF;AAChF,gDAAwE;AACxE,yCAAwC;AAExC,qDAAmF;AAEnF;;;;;;GAMG;AAEH,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,8BAA8B,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACjK,MAAM,eAAe,GAAmB,EAAE,IAAI,EAAE,yBAAyB,EAAE,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,mCAAmC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACvK,MAAM,GAAG,GAAmB,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,iDAAiD,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAExJ,yHAAyH;AACzH,SAAS,cAAc,CAAC,CAAgB;IACtC,OAAO,CACL,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC;QAC7B,CAAC,mCAAmC,EAAE,4BAA4B,EAAE,8BAA8B,EAAE,mCAAmC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CACxL,CAAC;AACJ,CAAC;AAEY,QAAA,WAAW,GAAoB;IAC1C,MAAM,EAAE,OAAO;IACf,MAAM,EAAE,OAAO;IACf,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,0YAA0Y;IAChZ,MAAM,EAAE;QACN,KAAK,EAAE,uIAAuI;QAC9I,WAAW,EAAE,CAAC,eAAe,EAAE,UAAU,CAAC;QAC1C,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;YAC7B,IAAI,CAAC,EAAE;gBAAE,MAAM,IAAI,iBAAQ,CAAC,6HAA6H,CAAC,CAAC;YAC3J,MAAM,IAAI,GAAG,MAAM,IAAA,uBAAU,EAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAA,+BAAgB,EAAC,EAAE,cAAc,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAChJ,OAAO,IAAA,mCAAoB,EAAC,IAAI,CAAC,CAAC;QACpC,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,kFAAkF;QACzF,WAAW,EAAE,CAAC,UAAU,EAAE,GAAG,CAAC;QAC9B,MAAM,EAAE;YACN,sLAAsL;YACtL,wGAAwG;YACxG,iGAAiG;SAClG;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,SAAS,GAAG,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,IAAA,sBAAS,EAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YACtC,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,iBAAQ,CAAC,sHAAsH,CAAC,CAAC;YACnK,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,OAAO,EAAE,GAAG,EAAE,CACzC,IAAA,mBAAW,EAAC,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,eAAe,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC,CACvI,CAAC;YACF,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,OAAO;QACf,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;YAC7B,MAAM,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC,IAAA,4CAAkC,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACnE,MAAM,YAAY,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC;YAC7D,MAAM,IAAI,GAA2B,EAAE,CAAC;YACxC,IAAI,YAAY;gBAAE,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,OAAO;QACf,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;QAClB,MAAM,EAAE,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE;KAC1C;IACD,OAAO,EAAE,OAAO;CACjB,CAAC"}

package/dist/migrate/descope/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const descopePlugin: MigrationPlugin;

package/dist/migrate/descope/plugin.js

@@ -0,0 +1,83 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.descopePlugin = void 0;
+const descope_1 = require("../export/descope");
+const kinde_descope_config_1 = require("../export/kinde-descope-config");
+const plugin_kit_1 = require("../export/plugin-kit");
+const vendor_http_1 = require("../export/vendor-http");
+/**
+ * `atlas migrate descope` — users, tenants, roles and permissions through the
+ * Descope Management API (project id + management key, on this machine),
+ * password hashes from the export Descope support provides when the owner
+ * has it, the `descope` bridge preset (DS session JWTs verified against the
+ * project's keys) and lazy migration through Descope's password sign-in for
+ * every other password.
+ */
+const PROJECT_ID = { flag: '--descope-project-id', env: 'DESCOPE_PROJECT_ID', label: 'your Descope project id (P…)', required: true };
+const MANAGEMENT_KEY = { flag: '--descope-management-key', env: 'DESCOPE_MANAGEMENT_KEY', label: 'a Descope management key', required: true, secret: true };
+const BASE_URL = { flag: '--descope-base-url', env: 'DESCOPE_BASE_URL', label: 'the Descope API base URL (regional or custom domain)', required: false };
+const HASHES_FILE = { flag: '--descope-hashes-file', env: 'DESCOPE_HASHES_FILE', label: 'the password-hash export from Descope support', required: false };
+function projectId(p) {
+    return p.credential({ ...PROJECT_ID, required: false }) ?? (p.ctx.env.NEXT_PUBLIC_DESCOPE_PROJECT_ID?.trim() || (0, plugin_kit_1.need)(p, PROJECT_ID));
+}
+function baseUrl(p) {
+    return (p.credential(BASE_URL) ?? (p.ctx.env.NEXT_PUBLIC_DESCOPE_BASE_URL?.trim() || undefined))?.replace(/\/+$/, '');
+}
+exports.descopePlugin = {
+    vendor: 'descope',
+    source: 'descope',
+    label: 'Descope',
+    help: 'Move a Descope project: password policy, roles and permissions as Atlas config; users with their login ids, verified emails and phones, social and SSO links, tenants (as organizations), roles and custom attributes; password hashes from the export Descope support provides; a zero-logout bridge for DS session tokens; lazy migration for the other passwords; and the code. Your management key stays on this machine.',
+    config: {
+        reads: 'your Descope project via the Management API (password settings, roles, permissions)',
+        credentials: [PROJECT_ID, MANAGEMENT_KEY],
+        async translate(p) {
+            const pid = projectId(p);
+            const http = new vendor_http_1.VendorHttp({ vendor: 'Descope', baseUrl: baseUrl(p) ?? 'https://api.descope.com', headers: { authorization: `Bearer ${pid}:${(0, plugin_kit_1.need)(p, MANAGEMENT_KEY)}` }, fetchImpl: p.fetch });
+            const snap = await (0, plugin_kit_1.vendorStep)('Descope', () => (0, kinde_descope_config_1.fetchDescopeConfig)(http, pid));
+            return (0, kinde_descope_config_1.translateDescopeConfig)(snap);
+        },
+    },
+    export: {
+        reads: 'the Descope Management API (users, tenants, roles) and the support hash export (--descope-hashes-file)',
+        credentials: [PROJECT_ID, MANAGEMENT_KEY, HASHES_FILE],
+        limits: [
+            'Password hashes are not returned by the Management API: Descope support can export them on request. Pass that file with --descope-hashes-file; without it, passwords move by lazy migration.',
+            'TOTP seeds, passkeys and magic-link / OTP state cannot be exported: users enrol their second factor and passkeys again (email and SMS codes simply work).',
+            'Sessions are not exported: Descope session tokens are JWTs, exchanged by the descope bridge preset.',
+        ],
+        async run(p, writer, resume) {
+            const set = await (0, plugin_kit_1.vendorStep)('Descope', () => (0, descope_1.exportDescope)({
+                projectId: projectId(p),
+                managementKey: (0, plugin_kit_1.need)(p, MANAGEMENT_KEY),
+                baseUrl: baseUrl(p),
+                hashesText: (0, plugin_kit_1.localFile)(p, HASHES_FILE, 'text'),
+                fetchImpl: p.fetch,
+                onProgress: (m) => p.say(`  reading ${m}`),
+            }));
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    bridge: {
+        preset: 'descope',
+        vars(p, t) {
+            const vars = { ...t?.bridge?.vars, project_id: t?.bridge?.vars.project_id ?? projectId(p) };
+            const base = baseUrl(p);
+            if (base)
+                vars.base_url = base;
+            return vars;
+        },
+    },
+    lazy: {
+        preset: 'descope',
+        config(p, t) {
+            const config = { ...t?.lazy?.config, project_id: t?.lazy?.config.project_id ?? projectId(p) };
+            const base = baseUrl(p);
+            if (base)
+                config.base_url = base;
+            return config;
+        },
+    },
+    codemod: 'descope',
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/descope/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/descope/plugin.ts"],"names":[],"mappings":";;;AAAA,+CAAkD;AAClD,yEAA4F;AAE5F,qDAAmF;AACnF,uDAAmD;AAEnD;;;;;;;GAOG;AAEH,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,8BAA8B,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACtJ,MAAM,cAAc,GAAmB,EAAE,IAAI,EAAE,0BAA0B,EAAE,GAAG,EAAE,wBAAwB,EAAE,KAAK,EAAE,0BAA0B,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC5K,MAAM,QAAQ,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,sDAAsD,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACzK,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,+CAA+C,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAE3K,SAAS,SAAS,CAAC,CAAgB;IACjC,OAAO,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,8BAA8B,EAAE,IAAI,EAAE,IAAI,IAAA,iBAAI,EAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;AACvI,CAAC;AAED,SAAS,OAAO,CAAC,CAAgB;IAC/B,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,4BAA4B,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACxH,CAAC;AAEY,QAAA,aAAa,GAAoB;IAC5C,MAAM,EAAE,SAAS;IACjB,MAAM,EAAE,SAAS;IACjB,KAAK,EAAE,SAAS;IAChB,IAAI,EAAE,+ZAA+Z;IACra,MAAM,EAAE;QACN,KAAK,EAAE,qFAAqF;QAC5F,WAAW,EAAE,CAAC,UAAU,EAAE,cAAc,CAAC;QACzC,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,IAAI,GAAG,IAAI,wBAAU,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,yBAAyB,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,IAAI,IAAA,iBAAI,EAAC,CAAC,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YACjM,MAAM,IAAI,GAAG,MAAM,IAAA,uBAAU,EAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAA,yCAAkB,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;YAC9E,OAAO,IAAA,6CAAsB,EAAC,IAAI,CAAC,CAAC;QACtC,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,wGAAwG;QAC/G,WAAW,EAAE,CAAC,UAAU,EAAE,cAAc,EAAE,WAAW,CAAC;QACtD,MAAM,EAAE;YACN,8LAA8L;YAC9L,2JAA2J;YAC3J,qGAAqG;SACtG;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,SAAS,EAAE,GAAG,EAAE,CAC3C,IAAA,uBAAa,EAAC;gBACZ,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;gBACvB,aAAa,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,cAAc,CAAC;gBACtC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;gBACnB,UAAU,EAAE,IAAA,sBAAS,EAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC;gBAC7C,SAAS,EAAE,CAAC,CAAC,KAAK;gBAClB,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;aAC3C,CAAC,CACH,CAAC;YACF,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,SAAS;QACjB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,GAA2B,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YACpH,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,IAAI;gBAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,SAAS;QACjB,MAAM,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,MAAM,GAA2B,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YACtH,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,IAAI;gBAAE,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;YACjC,OAAO,MAAM,CAAC;QAChB,CAAC;KACF;IACD,OAAO,EAAE,SAAS;CACnB,CAAC"}

package/dist/migrate/export/auth0-config.d.ts

@@ -0,0 +1,29 @@
+import type { TranslationResult } from '../framework/plugin';
+import { type Obj } from './record-set';
+import { VendorHttp } from './vendor-http';
+/**
+ * `atlas migrate auth0 config` — an Auth0 tenant's settings → Atlas config,
+ * read with the Management API on this machine: tenant settings (session
+ * lifetimes), database connections (password policy, username, sign-up,
+ * passkeys), passwordless and social connections, MFA factors and policy,
+ * breached-password detection, applications (callback URLs, web origins),
+ * APIs, roles and permissions. Actions, Rules, Hooks and branding are code
+ * or design: reported as manual.
+ */
+export interface Auth0ConfigSnapshot {
+    domain: string;
+    tenant: Obj;
+    connections: Obj[];
+    guardianFactors: Obj[];
+    guardianPolicies: string[];
+    breachedPassword: Obj | null;
+    clients: Obj[];
+    resourceServers: Obj[];
+    roles: Array<Obj & {
+        permissions?: Obj[];
+    }>;
+    actions: Obj[];
+    rules: Obj[];
+}
+export declare function fetchAuth0Config(http: VendorHttp, domain: string): Promise<Auth0ConfigSnapshot>;
+export declare function translateAuth0Config(snap: Auth0ConfigSnapshot): TranslationResult;

package/dist/migrate/export/auth0-config.js

@@ -0,0 +1,249 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fetchAuth0Config = fetchAuth0Config;
+exports.translateAuth0Config = translateAuth0Config;
+const record_set_1 = require("./record-set");
+const translate_kit_1 = require("./translate-kit");
+const vendor_http_1 = require("./vendor-http");
+async function fetchAuth0Config(http, domain) {
+    const get = async (path, fallback) => {
+        try {
+            return (await http.get(path)).body ?? fallback;
+        }
+        catch (err) {
+            if (err instanceof vendor_http_1.VendorApiError && [403, 404].includes(err.status))
+                return fallback;
+            throw err;
+        }
+    };
+    const list = async (path, key) => {
+        const body = await get(path, []);
+        return Array.isArray(body) ? (0, record_set_1.objs)(body) : (0, record_set_1.isObj)(body) ? (0, record_set_1.objs)(body[key]) : [];
+    };
+    const roles = (await list('/roles?per_page=100', 'roles'));
+    for (const r of roles)
+        r.permissions = await list(`/roles/${(0, record_set_1.str)(r.id)}/permissions?per_page=100`, 'permissions');
+    return {
+        domain,
+        tenant: await get('/tenants/settings', {}),
+        connections: await list('/connections?per_page=100', 'connections'),
+        guardianFactors: await list('/guardian/factors', 'factors'),
+        guardianPolicies: (0, record_set_1.strs)(await get('/guardian/policies', [])),
+        breachedPassword: await get('/attack-protection/breached-password-detection', null),
+        clients: await list('/clients?per_page=100&is_global=false', 'clients'),
+        resourceServers: await list('/resource-servers?per_page=100', 'resource_servers'),
+        roles,
+        actions: await list('/actions/actions?per_page=100', 'actions'),
+        rules: await list('/rules?per_page=100', 'rules'),
+    };
+}
+const HOUR = 3600_000;
+function translateAuth0Config(snap) {
+    const b = new translate_kit_1.ConfigBuilder();
+    // ── sessions ──
+    const t = snap.tenant;
+    if (typeof t.session_lifetime === 'number') {
+        const ms = (0, translate_kit_1.clampSessionMs)(t.session_lifetime * HOUR);
+        b.set('session.absoluteMs', ms);
+        b.add(ms === t.session_lifetime * HOUR ? 'mapped' : 'differs', 'tenant settings', 'session_lifetime', `${t.session_lifetime} hour(s)${ms !== t.session_lifetime * HOUR ? ' (clamped to Atlas\'s 90-day maximum)' : ''}.`, 'auth_config.session.absoluteMs');
+    }
+    if (typeof t.idle_session_lifetime === 'number') {
+        const ms = (0, translate_kit_1.clampSessionMs)(t.idle_session_lifetime * HOUR);
+        b.set('session.idleMs', ms);
+        b.add('mapped', 'tenant settings', 'idle_session_lifetime', `${t.idle_session_lifetime} hour(s) of inactivity.`, 'auth_config.session.idleMs');
+    }
+    // ── database connections ──
+    const dbs = snap.connections.filter((c) => (0, record_set_1.str)(c.strategy) === 'auth0');
+    if (dbs.length > 1)
+        b.add('differs', 'connections', 'database connections', `${dbs.length} database connections: Atlas has one user store per instance; their users are imported together (an email in two connections becomes one user).`, 'users');
+    const db = dbs.find((c) => (0, record_set_1.str)(c.name) === 'Username-Password-Authentication') ?? dbs[0];
+    b.set('strategies.password', Boolean(db));
+    if (db) {
+        const o = (0, record_set_1.isObj)(db.options) ? db.options : {};
+        const name = (0, record_set_1.str)(db.name);
+        const area = `connections ${name}`;
+        b.add('mapped', area, 'strategy auth0', 'Email + password sign-in. Imported password hashes (support export) verify as-is; lazy migration covers the rest.', 'auth_config.strategies.password');
+        const complexity = (0, record_set_1.isObj)(o.password_complexity_options) ? o.password_complexity_options : {};
+        const policyMin = { none: 1, low: 6, fair: 8, good: 8, excellent: 10 };
+        const policy = (0, record_set_1.str)(o.passwordPolicy) ?? 'good';
+        const min = typeof complexity.min_length === 'number' ? complexity.min_length : policyMin[policy] ?? 8;
+        b.set('passwordPolicy.minLength', Math.max(8, min));
+        b.add(min < 8 ? 'differs' : 'mapped', area, 'options.password_complexity_options.min_length', min < 8 ? `Auth0 allows ${min}; Atlas requires at least 8 (existing passwords still sign in).` : `${min}.`, 'auth_config.passwordPolicy.minLength');
+        if (policy === 'fair' || policy === 'good' || policy === 'excellent')
+            b.add('differs', area, `options.passwordPolicy "${policy}"`, 'Atlas follows NIST 800-63B (length and breached-password checks, no character-class rules).', 'auth_config.passwordPolicy');
+        if (o.password_history && (0, record_set_1.isObj)(o.password_history) && o.password_history.enable === true)
+            b.add('manual', area, 'options.password_history', 'Atlas does not keep a password history.');
+        if (o.password_dictionary && (0, record_set_1.isObj)(o.password_dictionary) && o.password_dictionary.enable === true)
+            b.add('differs', area, 'options.password_dictionary', 'Atlas checks breached-password corpora instead of a custom dictionary.', 'auth_config.passwordPolicy.checkBreaches');
+        if (o.requires_username === true) {
+            b.set('strategies.username', true);
+            const v = (0, record_set_1.isObj)(o.validation) && (0, record_set_1.isObj)(o.validation.username) ? o.validation.username : {};
+            if (typeof v.min === 'number')
+                b.set('accountUx.username.minLength', v.min);
+            if (typeof v.max === 'number')
+                b.set('accountUx.username.maxLength', v.max);
+            b.add('mapped', area, 'options.requires_username', 'Usernames (with the same length limits).', 'auth_config.strategies.username');
+        }
+        if (o.disable_signup === true) {
+            b.set('signUpMode', 'restricted');
+            b.add('mapped', area, 'options.disable_signup', 'Self sign-up is closed (invitations and the allowlist still work).', 'auth_config.signUpMode');
+        }
+        if (o.brute_force_protection !== false)
+            b.add('mapped', area, 'options.brute_force_protection', 'Atlas locks out repeated failed sign-ins per account and IP.', 'auth_config.rateLimit');
+        const methods = (0, record_set_1.isObj)(o.authentication_methods) ? o.authentication_methods : {};
+        if ((0, record_set_1.isObj)(methods.passkey) && methods.passkey.enabled === true) {
+            b.set('strategies.passkey', true);
+            b.add('mapped', area, 'options.authentication_methods.passkey', 'Passkeys. Existing Auth0 passkeys move with --authentication-methods when the RP id stays the same.', 'auth_config.strategies.passkey');
+        }
+        if (o.customScripts && (0, record_set_1.isObj)(o.customScripts) && o.enabledDatabaseCustomization === true) {
+            b.add('manual', area, 'options.customScripts', 'A custom database (Login / Get User scripts): point an Atlas legacy-auth connection at your user store instead (lazy migration webhook).', 'legacy_auth_connection');
+        }
+    }
+    // ── passwordless ──
+    for (const c of snap.connections) {
+        const strategy = (0, record_set_1.str)(c.strategy);
+        const o = (0, record_set_1.isObj)(c.options) ? c.options : {};
+        if (strategy === 'email') {
+            const link = (0, record_set_1.str)(o.authParams && (0, record_set_1.isObj)(o.authParams) ? o.authParams.response_type : undefined) === 'code' ? false : (0, record_set_1.str)(o.email && (0, record_set_1.isObj)(o.email) ? o.email.body : undefined)?.includes('@@link@@');
+            b.set(link ? 'strategies.emailLink' : 'strategies.emailCode', true);
+            b.add('mapped', 'connections email', 'strategy email', link ? 'Passwordless magic link.' : 'Passwordless email code.', link ? 'auth_config.strategies.emailLink' : 'auth_config.strategies.emailCode');
+            if (typeof o.totp === 'object' && (0, record_set_1.isObj)(o.totp) && typeof o.totp.time_step === 'number')
+                b.add('differs', 'connections email', 'options.totp.time_step', `Auth0 codes live ${o.totp.time_step}s; set Atlas's verification.emailCode.ttlMinutes.`, 'auth_config.verification.emailCode.ttlMinutes');
+        }
+        else if (strategy === 'sms') {
+            b.set('strategies.phoneCode', true);
+            b.add('mapped', 'connections sms', 'strategy sms', 'Passwordless SMS code (Atlas sends through its own SMS provider settings).', 'auth_config.strategies.phoneCode');
+        }
+    }
+    // ── social connections ──
+    const ENTERPRISE = new Set(['samlp', 'oidc', 'waad', 'adfs', 'okta', 'pingfederate', 'google-apps', 'ad', 'auth0-adldap', 'office365']);
+    for (const c of snap.connections) {
+        const strategy = (0, record_set_1.str)(c.strategy);
+        const name = (0, record_set_1.str)(c.name) ?? strategy ?? '';
+        if (!strategy || strategy === 'auth0' || strategy === 'email' || strategy === 'sms')
+            continue;
+        const o = (0, record_set_1.isObj)(c.options) ? c.options : {};
+        if (ENTERPRISE.has(strategy)) {
+            b.add(strategy === 'ad' || strategy === 'auth0-adldap' ? 'manual' : 'mapped', `connections ${name}`, `strategy ${strategy}`, strategy === 'ad' || strategy === 'auth0-adldap' ? 'AD/LDAP connector: no Atlas counterpart; use a lazy-migration webhook against your directory, or an enterprise IdP in front of it.' : 'Enterprise connection: moves with the data export as an Atlas SSO connection. Update the IdP with Atlas\'s ACS URL / redirect URI.', 'sso_connections');
+            continue;
+        }
+        if (strategy === 'oauth2') {
+            b.add('manual', `connections ${name}`, 'strategy oauth2', `Custom social connection "${name}": recreate it as an Atlas custom OAuth provider (authorization ${(0, record_set_1.str)(o.authorizationURL) ?? '?'}, token ${(0, record_set_1.str)(o.tokenURL) ?? '?'}); its fetchUserProfile script becomes a claim mapping.`, 'custom_oauth_providers');
+            continue;
+        }
+        const key = (0, translate_kit_1.socialKey)(strategy);
+        if (!key) {
+            b.add('manual', `connections ${name}`, `strategy ${strategy}`, `"${strategy}" is not a built-in Atlas provider; add it as a custom OAuth provider.`, 'custom_oauth_providers');
+            continue;
+        }
+        // Auth0's developer keys (no client_id) never work outside Auth0.
+        const clientId = (0, record_set_1.str)(o.client_id);
+        b.socialProvider({ atlasKey: key, vendorName: strategy, area: `connections ${name}`, setting: `strategy ${strategy}`, clientId, scopes: (0, record_set_1.strs)(o.scope ?? o.scopes) });
+        if (!clientId)
+            b.add('manual', `connections ${name}`, 'options.client_id', 'This connection uses Auth0\'s shared developer keys, which only work inside Auth0: create your own OAuth app (provider user ids change, so these users relink by email).', `oauth_providers ${key}`);
+    }
+    // ── MFA ──
+    const factors = new Map(snap.guardianFactors.map((f) => [(0, record_set_1.str)(f.name) ?? '', f.enabled === true]));
+    if (factors.get('otp')) {
+        b.set('mfa.factors.totp', true);
+        b.add('mapped', 'multi-factor', 'guardian factor otp', 'Authenticator apps. TOTP secrets move only with Auth0 support\'s secrets export.', 'auth_config.mfa.factors.totp');
+    }
+    if (factors.get('webauthn-roaming') || factors.get('webauthn-platform')) {
+        b.set('mfa.factors.passkey', true);
+        b.add('mapped', 'multi-factor', 'guardian factor webauthn', 'Security keys / device biometrics as a second factor.', 'auth_config.mfa.factors.passkey');
+    }
+    if (factors.get('email')) {
+        b.set('mfa.factors.emailCode', true);
+        b.add('mapped', 'multi-factor', 'guardian factor email', 'Email code second factor.', 'auth_config.mfa.factors.emailCode');
+    }
+    if (factors.get('sms') || factors.get('phone-message'))
+        b.add('differs', 'multi-factor', 'guardian factor sms', 'SMS second factor: phone factors move with --authentication-methods; Atlas recommends TOTP or passkeys.', 'auth_config.mfa');
+    if (factors.get('push-notification'))
+        b.add('manual', 'multi-factor', 'guardian factor push-notification', 'Auth0 Guardian push has no Atlas counterpart: those users enrol TOTP or a passkey.');
+    if (factors.get('recovery-code'))
+        b.add('mapped', 'multi-factor', 'guardian factor recovery-code', 'Backup codes (new ones are generated in Atlas).', 'auth_config.mfa.backupCodes');
+    if (snap.guardianPolicies.includes('all-applications')) {
+        b.set('mfaPolicy', 'required');
+        b.add('mapped', 'multi-factor', 'guardian policies all-applications', 'MFA always required.', 'auth_config.mfaPolicy');
+    }
+    else if (snap.guardianPolicies.includes('confidence-score')) {
+        b.add('differs', 'multi-factor', 'guardian policies confidence-score', 'Adaptive MFA: Atlas uses step-up and risk policies instead; review auth_config.stepUp.', 'auth_config.stepUp');
+    }
+    if (snap.breachedPassword) {
+        const on = snap.breachedPassword.enabled === true;
+        b.set('passwordPolicy.checkBreaches', on);
+        b.add('mapped', 'attack protection', 'breached-password-detection.enabled', on ? 'Breached passwords are refused.' : 'Breached-password check off.', 'auth_config.passwordPolicy.checkBreaches');
+    }
+    // ── applications ──
+    const origins = new Set();
+    const redirects = new Set();
+    for (const c of snap.clients) {
+        const app = (0, record_set_1.str)(c.name) ?? (0, record_set_1.str)(c.client_id) ?? 'application';
+        const type = (0, record_set_1.str)(c.app_type);
+        if (type === 'non_interactive') {
+            b.add('manual', `applications ${app}`, 'app_type non_interactive', 'A machine-to-machine application: create an Atlas M2M client (client credentials) for it.', 'oauth_clients');
+            continue;
+        }
+        for (const u of (0, record_set_1.strs)(c.callbacks))
+            redirects.add(u);
+        for (const u of [...(0, record_set_1.strs)(c.web_origins), ...(0, record_set_1.strs)(c.allowed_origins)])
+            origins.add(u);
+        if (c.is_first_party === false)
+            b.add('manual', `applications ${app}`, 'is_first_party false', 'A third-party application: register it as an Atlas OAuth client.', 'oauth_clients');
+    }
+    let exact = 0;
+    for (const url of redirects) {
+        if (url.includes('*')) {
+            b.add('differs', 'applications', `callbacks ${url}`, 'Atlas redirect URLs are exact (no wildcards); list each URL.', 'redirect_urls');
+            continue;
+        }
+        b.push('redirect_urls', { url });
+        exact++;
+    }
+    if (exact)
+        b.add('mapped', 'applications', 'callbacks', `${exact} callback URL(s) become redirect URLs.`, 'redirect_urls');
+    if (origins.size) {
+        b.instance.allowed_origins = [...origins].filter((o) => !o.includes('*'));
+        b.add('mapped', 'applications', 'web_origins / allowed_origins', 'Allowed origins for the browser SDK.', 'instance.allowed_origins');
+    }
+    // ── APIs, roles, permissions ──
+    for (const rs of snap.resourceServers) {
+        const identifier = (0, record_set_1.str)(rs.identifier);
+        if (!identifier || rs.is_system === true)
+            continue;
+        b.push('resource_servers', { identifier, name: (0, record_set_1.str)(rs.name) ?? identifier, scopes: (0, record_set_1.objs)(rs.scopes).map((s) => (0, record_set_1.str)(s.value)).filter((s) => !!s) });
+        b.add('mapped', 'APIs', `resource-servers ${identifier}`, `API with ${(0, record_set_1.objs)(rs.scopes).length} scope(s); access tokens for it keep "aud": "${identifier}".`, `resource_servers ${identifier}`);
+    }
+    const perms = new Map();
+    for (const r of snap.roles) {
+        const name = (0, record_set_1.str)(r.name);
+        if (!name)
+            continue;
+        const key = (0, translate_kit_1.keyOf)(name);
+        b.roles[name] = key;
+        const rp = (r.permissions ?? []).map((p) => (0, record_set_1.str)(p.permission_name)).filter((p) => !!p);
+        for (const p of r.permissions ?? []) {
+            const n = (0, record_set_1.str)(p.permission_name);
+            if (n)
+                perms.set(n, (0, record_set_1.str)(p.description) ?? '');
+        }
+        b.push('roles', { key, name, description: (0, record_set_1.str)(r.description) ?? '', permissions: rp });
+    }
+    for (const [key, description] of [...perms.entries()].sort())
+        b.push('permissions', { key, name: key, description });
+    if (snap.roles.length)
+        b.add('mapped', 'roles', 'roles', `${snap.roles.length} role(s) with their permissions; assignments move with the data export.`, 'roles');
+    // ── code ──
+    for (const a of snap.actions) {
+        const triggers = (0, record_set_1.objs)(a.supported_triggers).map((tr) => (0, record_set_1.str)(tr.id)).filter(Boolean).join(', ');
+        b.add('manual', 'actions', `actions ${(0, record_set_1.str)(a.name) ?? '?'}`, `Auth0 Action (${triggers || 'trigger unknown'}): port it to an Atlas action or webhook; token claims it adds become a JWT template or session claims.`, 'actions');
+    }
+    for (const r of snap.rules)
+        if (r.enabled !== false)
+            b.add('manual', 'rules', `rules ${(0, record_set_1.str)(r.name) ?? '?'}`, 'Auth0 Rule: port it to an Atlas action.', 'actions');
+    return b.result(`Auth0 tenant ${snap.domain}`, {
+        bridge: { preset: 'auth0', vars: { domain: snap.domain } },
+        lazy: db ? { preset: 'auth0', config: { domain: snap.domain, connection: (0, record_set_1.str)(db.name) ?? 'Username-Password-Authentication' } } : undefined,
+    });
+}
+//# sourceMappingURL=auth0-config.js.map

package/dist/migrate/export/auth0-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth0-config.js","sourceRoot":"","sources":["../../../src/migrate/export/auth0-config.ts"],"names":[],"mappings":";;AA6BA,4CA4BC;AAID,oDA8LC;AAzPD,6CAAgE;AAChE,mDAAkF;AAClF,+CAA2D;AAyBpD,KAAK,UAAU,gBAAgB,CAAC,IAAgB,EAAE,MAAc;IACrE,MAAM,GAAG,GAAG,KAAK,EAAK,IAAY,EAAE,QAAW,EAAc,EAAE;QAC7D,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,CAAI,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,QAAQ,CAAC;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO,QAAQ,CAAC;YACtF,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,EAAE,IAAY,EAAE,GAAW,EAAkB,EAAE;QAC/D,MAAM,IAAI,GAAG,MAAM,GAAG,CAAU,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1C,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,iBAAI,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,iBAAI,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAiC,CAAC;IAC3F,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,CAAC,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,IAAA,gBAAG,EAAC,CAAC,CAAC,EAAE,CAAC,2BAA2B,EAAE,aAAa,CAAC,CAAC;IACjH,OAAO;QACL,MAAM;QACN,MAAM,EAAE,MAAM,GAAG,CAAM,mBAAmB,EAAE,EAAE,CAAC;QAC/C,WAAW,EAAE,MAAM,IAAI,CAAC,2BAA2B,EAAE,aAAa,CAAC;QACnE,eAAe,EAAE,MAAM,IAAI,CAAC,mBAAmB,EAAE,SAAS,CAAC;QAC3D,gBAAgB,EAAE,IAAA,iBAAI,EAAC,MAAM,GAAG,CAAU,oBAAoB,EAAE,EAAE,CAAC,CAAC;QACpE,gBAAgB,EAAE,MAAM,GAAG,CAAa,gDAAgD,EAAE,IAAI,CAAC;QAC/F,OAAO,EAAE,MAAM,IAAI,CAAC,uCAAuC,EAAE,SAAS,CAAC;QACvE,eAAe,EAAE,MAAM,IAAI,CAAC,gCAAgC,EAAE,kBAAkB,CAAC;QACjF,KAAK;QACL,OAAO,EAAE,MAAM,IAAI,CAAC,+BAA+B,EAAE,SAAS,CAAC;QAC/D,KAAK,EAAE,MAAM,IAAI,CAAC,qBAAqB,EAAE,OAAO,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,MAAM,IAAI,GAAG,QAAQ,CAAC;AAEtB,SAAgB,oBAAoB,CAAC,IAAyB;IAC5D,MAAM,CAAC,GAAG,IAAI,6BAAa,EAAE,CAAC;IAE9B,iBAAiB;IACjB,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IACtB,IAAI,OAAO,CAAC,CAAC,gBAAgB,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,EAAE,GAAG,IAAA,8BAAc,EAAC,CAAC,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;QACrD,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;QAChC,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,GAAG,CAAC,CAAC,gBAAgB,WAAW,EAAE,KAAK,CAAC,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC,CAAC,uCAAuC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,gCAAgC,CAAC,CAAC;IAC9P,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,qBAAqB,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,EAAE,GAAG,IAAA,8BAAc,EAAC,CAAC,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;QAC1D,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;QAC5B,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,GAAG,CAAC,CAAC,qBAAqB,yBAAyB,EAAE,4BAA4B,CAAC,CAAC;IACjJ,CAAC;IAED,6BAA6B;IAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,CAAC;IACxE,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,sBAAsB,EAAE,GAAG,GAAG,CAAC,MAAM,iJAAiJ,EAAE,OAAO,CAAC,CAAC;IACrP,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,KAAK,kCAAkC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IACzF,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1C,IAAI,EAAE,EAAE,CAAC;QACP,MAAM,CAAC,GAAG,IAAA,kBAAK,EAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,EAAE,CAAC,IAAI,CAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,eAAe,IAAI,EAAE,CAAC;QACnC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,gBAAgB,EAAE,mHAAmH,EAAE,iCAAiC,CAAC,CAAC;QAChM,MAAM,UAAU,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,MAAM,SAAS,GAA2B,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QAC/F,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC;QAC/C,MAAM,GAAG,GAAG,OAAO,UAAU,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvG,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACpD,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,gDAAgD,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,GAAG,iEAAiE,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,EAAE,sCAAsC,CAAC,CAAC;QAClP,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,WAAW;YAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,2BAA2B,MAAM,GAAG,EAAE,6FAA6F,EAAE,4BAA4B,CAAC,CAAC;QAChQ,IAAI,CAAC,CAAC,gBAAgB,IAAI,IAAA,kBAAK,EAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,gBAAgB,CAAC,MAAM,KAAK,IAAI;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,0BAA0B,EAAE,yCAAyC,CAAC,CAAC;QACxL,IAAI,CAAC,CAAC,mBAAmB,IAAI,IAAA,kBAAK,EAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,mBAAmB,CAAC,MAAM,KAAK,IAAI;YAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,6BAA6B,EAAE,wEAAwE,EAAE,0CAA0C,CAAC,CAAC;QAChR,IAAI,CAAC,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;YACjC,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;YACnC,MAAM,CAAC,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,UAAU,CAAC,IAAI,IAAA,kBAAK,EAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;gBAAE,CAAC,CAAC,GAAG,CAAC,8BAA8B,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;YAC5E,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;gBAAE,CAAC,CAAC,GAAG,CAAC,8BAA8B,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;YAC5E,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,2BAA2B,EAAE,0CAA0C,EAAE,iCAAiC,CAAC,CAAC;QACpI,CAAC;QACD,IAAI,CAAC,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YAC9B,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;YAClC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,wBAAwB,EAAE,oEAAoE,EAAE,wBAAwB,CAAC,CAAC;QAClJ,CAAC;QACD,IAAI,CAAC,CAAC,sBAAsB,KAAK,KAAK;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,gCAAgC,EAAE,8DAA8D,EAAE,uBAAuB,CAAC,CAAC;QACzL,MAAM,OAAO,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,IAAI,IAAA,kBAAK,EAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC/D,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;YAClC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,wCAAwC,EAAE,qGAAqG,EAAE,gCAAgC,CAAC,CAAC;QAC3M,CAAC;QACD,IAAI,CAAC,CAAC,aAAa,IAAI,IAAA,kBAAK,EAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,4BAA4B,KAAK,IAAI,EAAE,CAAC;YACzF,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,uBAAuB,EAAE,0IAA0I,EAAE,wBAAwB,CAAC,CAAC;QACvN,CAAC;IACH,CAAC;IAED,qBAAqB;IACrB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,UAAU,IAAI,IAAA,kBAAK,EAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,IAAI,IAAA,kBAAK,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;YACpM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;YACpE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,0BAA0B,EAAE,IAAI,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC;YACvM,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAA,kBAAK,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,KAAK,QAAQ;gBAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,oBAAoB,CAAC,CAAC,IAAI,CAAC,SAAS,mDAAmD,EAAE,+CAA+C,CAAC,CAAC;QACrS,CAAC;aAAM,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC9B,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;YACpC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,iBAAiB,EAAE,cAAc,EAAE,4EAA4E,EAAE,kCAAkC,CAAC,CAAC;QACvK,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC;IACxI,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,QAAQ,IAAI,EAAE,CAAC;QAC3C,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,KAAK;YAAE,SAAS;QAC9F,MAAM,CAAC,GAAG,IAAA,kBAAK,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,eAAe,IAAI,EAAE,EAAE,YAAY,QAAQ,EAAE,EAAE,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,cAAc,CAAC,CAAC,CAAC,oIAAoI,CAAC,CAAC,CAAC,oIAAoI,EAAE,iBAAiB,CAAC,CAAC;YAChd,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,IAAI,EAAE,EAAE,iBAAiB,EAAE,6BAA6B,IAAI,mEAAmE,IAAA,gBAAG,EAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,GAAG,WAAW,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,yDAAyD,EAAE,wBAAwB,CAAC,CAAC;YAClT,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,IAAA,yBAAS,EAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,IAAI,EAAE,EAAE,YAAY,QAAQ,EAAE,EAAE,IAAI,QAAQ,wEAAwE,EAAE,wBAAwB,CAAC,CAAC;YAC/K,SAAS;QACX,CAAC;QACD,kEAAkE;QAClE,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAClC,CAAC,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,IAAI,EAAE,EAAE,OAAO,EAAE,YAAY,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAA,iBAAI,EAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrK,IAAI,CAAC,QAAQ;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,IAAI,EAAE,EAAE,mBAAmB,EAAE,0KAA0K,EAAE,mBAAmB,GAAG,EAAE,CAAC,CAAC;IACnR,CAAC;IAED,YAAY;IACZ,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC;IAClG,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC;QAChC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,qBAAqB,EAAE,kFAAkF,EAAE,8BAA8B,CAAC,CAAC;IAC7K,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACxE,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,0BAA0B,EAAE,uDAAuD,EAAE,iCAAiC,CAAC,CAAC;IAC1J,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,CAAC,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,CAAC,CAAC;QACrC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,mCAAmC,CAAC,CAAC;IAC7H,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,qBAAqB,EAAE,yGAAyG,EAAE,iBAAiB,CAAC,CAAC;IAC9O,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,mCAAmC,EAAE,oFAAoF,CAAC,CAAC;IACjM,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,+BAA+B,EAAE,iDAAiD,EAAE,6BAA6B,CAAC,CAAC;IACrL,IAAI,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACvD,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAC/B,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,oCAAoC,EAAE,sBAAsB,EAAE,uBAAuB,CAAC,CAAC;IACzH,CAAC;SAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC9D,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,oCAAoC,EAAE,wFAAwF,EAAE,oBAAoB,CAAC,CAAC;IACzL,CAAC;IACD,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,KAAK,IAAI,CAAC;QAClD,CAAC,CAAC,GAAG,CAAC,8BAA8B,EAAE,EAAE,CAAC,CAAC;QAC1C,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,mBAAmB,EAAE,qCAAqC,EAAE,EAAE,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,8BAA8B,EAAE,0CAA0C,CAAC,CAAC;IACnM,CAAC;IAED,qBAAqB;IACrB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAA,gBAAG,EAAC,CAAC,CAAC,SAAS,CAAC,IAAI,aAAa,CAAC;QAC7D,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC7B,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC/B,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,GAAG,EAAE,EAAE,0BAA0B,EAAE,2FAA2F,EAAE,eAAe,CAAC,CAAC;YACjL,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,CAAC,CAAC,SAAS,CAAC;YAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACpD,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,WAAW,CAAC,EAAE,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,eAAe,CAAC,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACrF,IAAI,CAAC,CAAC,cAAc,KAAK,KAAK;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,GAAG,EAAE,EAAE,sBAAsB,EAAE,kEAAkE,EAAE,eAAe,CAAC,CAAC;IACtL,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,aAAa,GAAG,EAAE,EAAE,8DAA8D,EAAE,eAAe,CAAC,CAAC;YACtI,SAAS;QACX,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACjC,KAAK,EAAE,CAAC;IACV,CAAC;IACD,IAAI,KAAK;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,KAAK,wCAAwC,EAAE,eAAe,CAAC,CAAC;IAC3H,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,CAAC,CAAC,QAAQ,CAAC,eAAe,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1E,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,+BAA+B,EAAE,sCAAsC,EAAE,0BAA0B,CAAC,CAAC;IACvI,CAAC;IAED,iCAAiC;IACjC,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,IAAA,gBAAG,EAAC,EAAE,CAAC,UAAU,CAAC,CAAC;QACtC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,SAAS,KAAK,IAAI;YAAE,SAAS;QACnD,CAAC,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,IAAA,gBAAG,EAAC,EAAE,CAAC,IAAI,CAAC,IAAI,UAAU,EAAE,MAAM,EAAE,IAAA,iBAAI,EAAC,EAAE,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAU,CAAC,CAAC;QACvK,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,oBAAoB,UAAU,EAAE,EAAE,YAAY,IAAA,iBAAI,EAAC,EAAE,CAAC,MAAM,CAAC,CAAC,MAAM,gDAAgD,UAAU,IAAI,EAAE,oBAAoB,UAAU,EAAE,CAAC,CAAC;IAChM,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,GAAG,GAAG,IAAA,qBAAK,EAAC,IAAI,CAAC,CAAC;QACxB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;QACpB,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpG,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,eAAe,CAAC,CAAC;YACjC,IAAI,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,EAAE,EAAU,CAAC,CAAC;IACjG,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE;QAAE,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAU,CAAC,CAAC;IAC7H,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,yEAAyE,EAAE,OAAO,CAAC,CAAC;IAEjK,aAAa;IACb,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAA,gBAAG,EAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/F,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,EAAE,iBAAiB,QAAQ,IAAI,iBAAiB,yGAAyG,EAAE,SAAS,CAAC,CAAC;IAClO,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK;QAAE,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,IAAA,gBAAG,EAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,EAAE,yCAAyC,EAAE,SAAS,CAAC,CAAC;IAEnK,OAAO,CAAC,CAAC,MAAM,CAAC,gBAAgB,IAAI,CAAC,MAAM,EAAE,EAAE;QAC7C,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;QAC1D,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,IAAA,gBAAG,EAAC,EAAE,CAAC,IAAI,CAAC,IAAI,kCAAkC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS;KAC5I,CAAC,CAAC;AACL,CAAC"}

package/dist/migrate/export/auth0.d.ts

@@ -0,0 +1,62 @@
+import type { PasswordHash } from '@atlasauth/migrate';
+import { RecordSet, type Obj } from './record-set';
+/**
+ * `atlas migrate export auth0` — Auth0 (and Okta Customer Identity Cloud,
+ * which is Auth0) onto the canonical bundle models.
+ *
+ * Read with a Management API token the owner holds (a machine-to-machine
+ * application's client id + secret, or a token pasted from the dashboard);
+ * the calls run on this machine and the credentials go nowhere else.
+ *
+ *   - users: through a user-export JOB (the only complete listing — user
+ *     search stops at 1,000), or from an export file the owner already has;
+ *   - password hashes and MFA secrets: Auth0 releases them ONLY through a
+ *     support ticket. Pass the decrypted file with --auth0-hashes-file; rows are matched
+ *     by user id (`_id.$oid` → `auth0|<oid>`) or email. Without it, enable the
+ *     `auth0` lazy-migration preset so passwords move on first sign-in;
+ *   - social and enterprise identities, app roles (role → users), organizations,
+ *     members with their roles, pending invitations, enterprise connections
+ *     (SAML / OIDC / Azure AD / ADFS / Okta / Ping / Google Workspace), and the
+ *     tenant's public signing keys;
+ *   - with --authentication-methods: per user, phone/email second factors and
+ *     passkeys (public key only — Auth0 never returns a TOTP secret by API).
+ *
+ * Sessions are not exported: Auth0 issues JWTs, bridged by the `auth0`
+ * bridge preset against the tenant's JWKS.
+ */
+export interface Auth0ExportOptions {
+    /** The tenant's canonical domain (`acme.us.auth0.com`), not a custom domain. */
+    domain: string;
+    clientId?: string;
+    clientSecret?: string;
+    /** A Management API token, instead of client credentials. */
+    token?: string;
+    /** The text of a user export file (NDJSON or JSON array), instead of running an export job. */
+    usersText?: string;
+    /** The text of the decrypted password-hash / MFA export from Auth0 support (NDJSON or JSON). */
+    hashesText?: string;
+    /** Only this database / social connection's users (export job `connection_id`). */
+    connectionId?: string;
+    /** Read each user's authentication methods (phone/email factors, passkeys). One call per user. */
+    authenticationMethods?: boolean;
+    /** The WebAuthn relying party the passkeys were registered for (default: the domain). */
+    rpId?: string;
+    fetchImpl?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    onProgress?: (message: string) => void;
+}
+/** Fields requested from the export job (json format allows whole metadata objects). */
+export declare const AUTH0_EXPORT_FIELDS: readonly ["user_id", "email", "email_verified", "username", "phone_number", "phone_verified", "given_name", "family_name", "name", "nickname", "picture", "identities", "app_metadata", "user_metadata", "created_at", "last_login", "blocked"];
+export declare function exportAuth0(opts: Auth0ExportOptions): Promise<RecordSet>;
+export declare function managementToken(domain: string, opts: Auth0ExportOptions, fetchImpl: typeof fetch): Promise<string>;
+/** NDJSON (Auth0's export format) or a JSON array / `{ users: [] }`. */
+export declare function parseLines(text: string): Obj[];
+/** Auth0 role names are free text: `Billing Admin` → `billing_admin`. */
+export declare function roleKey(name: string): string;
+/**
+ * An Auth0 bulk-import `custom_password_hash` (users imported into Auth0 that
+ * never signed in since keep it) → the Atlas registry's algorithm + params.
+ */
+export declare function auth0CustomHash(c: Obj): PasswordHash | {
+    reason: string;
+};