@atlasauth/cli 0.11.0 → 0.12.0

package/dist/migrate/auth0/plugin.js

@@ -0,0 +1,126 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.auth0Plugin = void 0;
+const auth0_1 = require("../export/auth0");
+const auth0_config_1 = require("../export/auth0-config");
+const errors_1 = require("../../errors");
+const plugin_kit_1 = require("../export/plugin-kit");
+const vendor_http_1 = require("../export/vendor-http");
+/**
+ * `atlas migrate auth0` (also Okta Customer Identity Cloud) — the tenant's
+ * settings through the Management API, users through a users-export job (or
+ * an export file), the password hashes and MFA secrets from Auth0 support's
+ * encrypted export when the owner has it, the `auth0` bridge preset (the ID
+ * token in the app session, verified against the tenant's JWKS) and lazy
+ * migration through the password-realm grant for every other password.
+ */
+const DOMAIN = { flag: '--auth0-domain', env: 'AUTH0_DOMAIN', label: 'your Auth0 domain (tenant.us.auth0.com)', required: true };
+const MGMT_CLIENT_ID = { flag: '--auth0-mgmt-client-id', env: 'AUTH0_MGMT_CLIENT_ID', label: 'the client id of a machine-to-machine app authorized for the Management API', required: false };
+const MGMT_CLIENT_SECRET = { flag: '--auth0-mgmt-client-secret', env: 'AUTH0_MGMT_CLIENT_SECRET', label: 'that app\'s client secret', required: false, secret: true };
+const MGMT_TOKEN = { flag: '--auth0-mgmt-token', env: 'AUTH0_MGMT_TOKEN', label: 'a Management API token', required: false, secret: true };
+const CLIENT_ID = { flag: '--auth0-client-id', env: 'AUTH0_CLIENT_ID', label: 'your application\'s client id (the ID token audience)', required: false };
+const CLIENT_SECRET = { flag: '--auth0-client-secret', env: 'AUTH0_CLIENT_SECRET', label: 'your application\'s client secret (for a confidential application)', required: false, secret: true };
+const CONNECTION = { flag: '--auth0-connection', env: 'AUTH0_CONNECTION', label: 'the database connection', required: false };
+const USERS_FILE = { flag: '--auth0-users-file', env: 'AUTH0_USERS_FILE', label: 'a users export file (NDJSON or JSON)', required: false };
+const HASHES_FILE = { flag: '--auth0-hashes-file', env: 'AUTH0_HASHES_FILE', label: 'the decrypted password-hash export from Auth0 support', required: false };
+const RP_ID = { flag: '--rp-id', env: 'ATLAS_MIGRATE_RP_ID', label: 'the WebAuthn relying party id passkeys were registered for', required: false };
+function domainOf(p) {
+    return (0, plugin_kit_1.hostOf)((0, plugin_kit_1.need)(p, DOMAIN));
+}
+/** The Management API, with a token or client credentials (asked for on this machine, sent only to Auth0). */
+function managementHttp(p, domain) {
+    const token = p.credential(MGMT_TOKEN);
+    const clientId = p.credential(MGMT_CLIENT_ID);
+    const clientSecret = p.credential(MGMT_CLIENT_SECRET);
+    if (!token && !(clientId && clientSecret)) {
+        throw new errors_1.CliError('Auth0: pass a Management API token (--auth0-mgmt-token / AUTH0_MGMT_TOKEN), or the client id and secret of a machine-to-machine app authorized for it (AUTH0_MGMT_CLIENT_ID, AUTH0_MGMT_CLIENT_SECRET).');
+    }
+    let bearer = token;
+    return new vendor_http_1.VendorHttp({
+        vendor: 'Auth0',
+        baseUrl: `https://${domain}/api/v2`,
+        headers: async () => ({ authorization: `Bearer ${(bearer ??= await (0, auth0_1.managementToken)(domain, { domain, clientId, clientSecret }, p.fetch))}` }),
+        fetchImpl: p.fetch,
+    });
+}
+exports.auth0Plugin = {
+    vendor: 'auth0',
+    source: 'auth0',
+    label: 'Auth0',
+    help: 'Move an Auth0 (Okta Customer Identity Cloud) tenant: its connections, MFA, password policy, applications, APIs, roles and organizations as Atlas config; its users (export job), identities, organizations, members, roles and invitations, plus password hashes and MFA secrets from the encrypted export Auth0 support provides; a zero-logout bridge; lazy migration for every password you do not have; and the code. Management credentials stay on this machine.',
+    config: {
+        reads: 'your Auth0 tenant via the Management API',
+        credentials: [DOMAIN, MGMT_TOKEN, MGMT_CLIENT_ID, MGMT_CLIENT_SECRET],
+        async translate(p) {
+            const domain = domainOf(p);
+            const snap = await (0, plugin_kit_1.vendorStep)('Auth0', () => (0, auth0_config_1.fetchAuth0Config)(managementHttp(p, domain), domain));
+            return (0, auth0_config_1.translateAuth0Config)(snap);
+        },
+    },
+    export: {
+        reads: 'the Auth0 Management API (users-export job, organizations, roles) and the support hash export (--auth0-hashes-file)',
+        credentials: [DOMAIN, MGMT_TOKEN, MGMT_CLIENT_ID, MGMT_CLIENT_SECRET, USERS_FILE, HASHES_FILE, CONNECTION],
+        limits: [
+            'Password hashes and MFA secrets never come out of the Management API: Auth0 support exports them on request (paid plans, encrypted to your PGP key). Pass the decrypted file with --auth0-hashes-file; without it, passwords move by lazy migration.',
+            'Users-export jobs are not available on the Free plan: export from the dashboard (or the User Import / Export extension) and pass the file with --auth0-users-file.',
+            'Passkey private keys never leave the authenticator; with --authentication-methods the public credentials are exported and keep working when your Atlas domain matches the relying party (--rp-id).',
+            'Sessions are not exported: the auth0 bridge preset exchanges the ID token from the app session.',
+        ],
+        async run(p, writer, resume) {
+            const domain = domainOf(p);
+            const usersText = (0, plugin_kit_1.localFile)(p, USERS_FILE, 'text');
+            const token = p.credential(MGMT_TOKEN);
+            const clientId = p.credential(MGMT_CLIENT_ID);
+            const clientSecret = p.credential(MGMT_CLIENT_SECRET);
+            if (!usersText && !token && !(clientId && clientSecret)) {
+                throw new errors_1.CliError('Auth0: pass Management API credentials (AUTH0_MGMT_TOKEN, or AUTH0_MGMT_CLIENT_ID and AUTH0_MGMT_CLIENT_SECRET), or a users export file (--auth0-users-file).');
+            }
+            const set = await (0, plugin_kit_1.vendorStep)('Auth0', () => (0, auth0_1.exportAuth0)({
+                domain,
+                token,
+                clientId,
+                clientSecret,
+                usersText,
+                hashesText: (0, plugin_kit_1.localFile)(p, HASHES_FILE, 'text'),
+                connectionId: p.credential(CONNECTION),
+                authenticationMethods: (0, plugin_kit_1.flag)(p, 'authentication-methods'),
+                rpId: p.credential(RP_ID),
+                fetchImpl: p.fetch,
+                onProgress: (m) => p.say(`  reading ${m}`),
+            }));
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    bridge: {
+        preset: 'auth0',
+        vars(p, t) {
+            const vars = { ...t?.bridge?.vars };
+            const domain = p.credential({ ...DOMAIN, required: false });
+            if (domain)
+                vars.domain = (0, plugin_kit_1.hostOf)(domain);
+            const clientId = p.credential(CLIENT_ID);
+            if (clientId)
+                vars.client_id = clientId;
+            return vars;
+        },
+    },
+    lazy: {
+        preset: 'auth0',
+        config(p, t) {
+            const config = { ...t?.lazy?.config };
+            const domain = p.credential({ ...DOMAIN, required: false });
+            if (domain)
+                config.domain = (0, plugin_kit_1.hostOf)(domain);
+            const clientId = p.credential(CLIENT_ID);
+            if (clientId)
+                config.client_id = clientId;
+            const connection = p.credential(CONNECTION);
+            if (connection)
+                config.connection = connection;
+            return config;
+        },
+        secret: CLIENT_SECRET,
+    },
+    codemod: 'auth0',
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/auth0/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/auth0/plugin.ts"],"names":[],"mappings":";;;AAAA,2CAA+D;AAC/D,yDAAgF;AAChF,yCAAwC;AAExC,qDAAiG;AACjG,uDAAmD;AAEnD;;;;;;;GAOG;AAEH,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,yCAAyC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACjJ,MAAM,cAAc,GAAmB,EAAE,IAAI,EAAE,wBAAwB,EAAE,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,6EAA6E,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC9M,MAAM,kBAAkB,GAAmB,EAAE,IAAI,EAAE,4BAA4B,EAAE,GAAG,EAAE,0BAA0B,EAAE,KAAK,EAAE,2BAA2B,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACtL,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,wBAAwB,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC3J,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,uDAAuD,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACzK,MAAM,aAAa,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,oEAAoE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAChN,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,yBAAyB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC9I,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,sCAAsC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC3J,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,uDAAuD,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC/K,MAAM,KAAK,GAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,4DAA4D,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAEpK,SAAS,QAAQ,CAAC,CAAgB;IAChC,OAAO,IAAA,mBAAM,EAAC,IAAA,iBAAI,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,8GAA8G;AAC9G,SAAS,cAAc,CAAC,CAAgB,EAAE,MAAc;IACtD,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;IAC9C,MAAM,YAAY,GAAG,CAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ,IAAI,YAAY,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,iBAAQ,CAAC,yMAAyM,CAAC,CAAC;IAChO,CAAC;IACD,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,OAAO,IAAI,wBAAU,CAAC;QACpB,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,WAAW,MAAM,SAAS;QACnC,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,CAAC,MAAM,KAAK,MAAM,IAAA,uBAAe,EAAC,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAC7I,SAAS,EAAE,CAAC,CAAC,KAAK;KACnB,CAAC,CAAC;AACL,CAAC;AAEY,QAAA,WAAW,GAAoB;IAC1C,MAAM,EAAE,OAAO;IACf,MAAM,EAAE,OAAO;IACf,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,wcAAwc;IAC9c,MAAM,EAAE;QACN,KAAK,EAAE,0CAA0C;QACjD,WAAW,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,kBAAkB,CAAC;QACrE,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,IAAI,GAAG,MAAM,IAAA,uBAAU,EAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAA,+BAAgB,EAAC,cAAc,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YAClG,OAAO,IAAA,mCAAoB,EAAC,IAAI,CAAC,CAAC;QACpC,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,qHAAqH;QAC5H,WAAW,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,CAAC;QAC1G,MAAM,EAAE;YACN,sPAAsP;YACtP,oKAAoK;YACpK,oMAAoM;YACpM,iGAAiG;SAClG;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,SAAS,GAAG,IAAA,sBAAS,EAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;YACnD,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YACvC,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;YAC9C,MAAM,YAAY,GAAG,CAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;YACtD,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ,IAAI,YAAY,CAAC,EAAE,CAAC;gBACxD,MAAM,IAAI,iBAAQ,CAAC,+JAA+J,CAAC,CAAC;YACtL,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,OAAO,EAAE,GAAG,EAAE,CACzC,IAAA,mBAAW,EAAC;gBACV,MAAM;gBACN,KAAK;gBACL,QAAQ;gBACR,YAAY;gBACZ,SAAS;gBACT,UAAU,EAAE,IAAA,sBAAS,EAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC;gBAC7C,YAAY,EAAE,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;gBACtC,qBAAqB,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,wBAAwB,CAAC;gBACxD,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;gBACzB,SAAS,EAAE,CAAC,CAAC,KAAK;gBAClB,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;aAC3C,CAAC,CACH,CAAC;YACF,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,OAAO;QACf,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,GAA2B,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC5D,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5D,IAAI,MAAM;gBAAE,IAAI,CAAC,MAAM,GAAG,IAAA,mBAAM,EAAC,MAAM,CAAC,CAAC;YACzC,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,QAAQ;gBAAE,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;YACxC,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,OAAO;QACf,MAAM,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,MAAM,GAA2B,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9D,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5D,IAAI,MAAM;gBAAE,MAAM,CAAC,MAAM,GAAG,IAAA,mBAAM,EAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,QAAQ;gBAAE,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC;YAC1C,MAAM,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAC5C,IAAI,UAAU;gBAAE,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC;YAC/C,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,EAAE,aAAa;KACtB;IACD,OAAO,EAAE,OAAO;CACjB,CAAC"}

package/dist/migrate/clerk/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const clerkPlugin: MigrationPlugin;

package/dist/migrate/clerk/plugin.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.clerkPlugin = void 0;
+const clerk_1 = require("../export/clerk");
+const clerk_config_1 = require("../export/clerk-config");
+const backend_1 = require("@atlasauth/backend");
+const errors_1 = require("../../errors");
+const plugin_kit_1 = require("../export/plugin-kit");
+/**
+ * `atlas migrate clerk` — Clerk's Backend API (secret key) plus the dashboard
+ * CSV export (the only source of password digests and TOTP secrets), the
+ * `clerk` JWT bridge preset (session tokens verified against the Frontend
+ * API's JWKS), lazy password verification through Clerk's verify_password
+ * for users the CSV does not cover, and the `clerk` codemod.
+ */
+const SECRET_KEY = { flag: '--clerk-secret-key', env: 'CLERK_SECRET_KEY', label: 'your Clerk secret key (sk_…)', required: false, secret: true };
+const PUBLISHABLE_KEY = { flag: '--clerk-publishable-key', env: 'CLERK_PUBLISHABLE_KEY', label: 'your Clerk publishable key (pk_…)', required: false };
+const CSV = { flag: '--clerk-csv', env: 'CLERK_CSV_EXPORT', label: 'the Clerk dashboard CSV export (Users → Export)', required: false };
+/** The publishable key from the flag / CLERK_PUBLISHABLE_KEY, else the framework-prefixed env vars apps already have. */
+function publishableKey(p) {
+    return (p.credential(PUBLISHABLE_KEY) ??
+        ['NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY', 'VITE_CLERK_PUBLISHABLE_KEY', 'PUBLIC_CLERK_PUBLISHABLE_KEY', 'EXPO_PUBLIC_CLERK_PUBLISHABLE_KEY'].map((k) => p.ctx.env[k]?.trim()).find(Boolean));
+}
+exports.clerkPlugin = {
+    vendor: 'clerk',
+    source: 'clerk',
+    label: 'Clerk',
+    help: 'Move a Clerk instance: its settings (social connections, sign-in methods, MFA, organizations, JWT templates), its users with their password digests and TOTP secrets from the dashboard CSV export, organizations, members, roles, invitations, enterprise connections and API keys from the Backend API, a zero-logout bridge for signed-in users, and the code. Your secret key stays on this machine.',
+    config: {
+        reads: 'your Clerk instance (the public environment via the publishable key, plus JWT templates, redirect URLs and roles with the secret key)',
+        credentials: [PUBLISHABLE_KEY, SECRET_KEY],
+        async translate(p) {
+            const pk = publishableKey(p);
+            if (!pk)
+                throw new errors_1.CliError('Clerk: the publishable key is needed (--clerk-publishable-key, CLERK_PUBLISHABLE_KEY or NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY).');
+            const snap = await (0, plugin_kit_1.vendorStep)('Clerk', () => (0, clerk_config_1.fetchClerkConfig)({ publishableKey: pk, secretKey: p.credential(SECRET_KEY), fetchImpl: p.fetch }));
+            return (0, clerk_config_1.translateClerkConfig)(snap);
+        },
+    },
+    export: {
+        reads: 'the Clerk Backend API (secret key) and/or the dashboard CSV export (--clerk-csv)',
+        credentials: [SECRET_KEY, CSV],
+        limits: [
+            'Password digests and TOTP secrets only come from the dashboard CSV export (Users → Export); without it, users keep their passwords through lazy migration (verify_password) instead.',
+            'Passkeys (only their names are readable) and backup codes cannot be exported: those users enrol again.',
+            'Sessions are not exported: Clerk session tokens are JWTs, exchanged by the clerk bridge preset.',
+        ],
+        async run(p, writer, resume) {
+            const secretKey = p.credential(SECRET_KEY);
+            const csv = (0, plugin_kit_1.localFile)(p, CSV, 'text');
+            if (!secretKey && !csv)
+                throw new errors_1.CliError('Clerk: pass the secret key (--clerk-secret-key / CLERK_SECRET_KEY), the dashboard CSV export (--clerk-csv), or both.');
+            const set = await (0, plugin_kit_1.vendorStep)('Clerk', () => (0, clerk_1.exportClerk)({ secretKey, csv, fetchImpl: p.fetch, skipApiKeys: (0, plugin_kit_1.flag)(p, 'skip-api-keys'), onProgress: (m) => p.say(`  reading ${m}`) }));
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    bridge: {
+        preset: 'clerk',
+        vars(p, t) {
+            const pk = publishableKey(p);
+            const fromKey = pk ? (0, backend_1.clerkFrontendApiFromPublishableKey)(pk) : null;
+            const frontend_api = t?.bridge?.vars.frontend_api ?? fromKey;
+            const vars = {};
+            if (frontend_api)
+                vars.frontend_api = frontend_api;
+            return vars;
+        },
+    },
+    lazy: {
+        preset: 'clerk',
+        config: () => ({}),
+        secret: { ...SECRET_KEY, required: true },
+    },
+    codemod: 'clerk',
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/clerk/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/clerk/plugin.ts"],"names":[],"mappings":";;;AAAA,2CAA8C;AAC9C,yDAAgF;AAChF,gDAAwE;AACxE,yCAAwC;AAExC,qDAAmF;AAEnF;;;;;;GAMG;AAEH,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,8BAA8B,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACjK,MAAM,eAAe,GAAmB,EAAE,IAAI,EAAE,yBAAyB,EAAE,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,mCAAmC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACvK,MAAM,GAAG,GAAmB,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,iDAAiD,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAExJ,yHAAyH;AACzH,SAAS,cAAc,CAAC,CAAgB;IACtC,OAAO,CACL,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC;QAC7B,CAAC,mCAAmC,EAAE,4BAA4B,EAAE,8BAA8B,EAAE,mCAAmC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CACxL,CAAC;AACJ,CAAC;AAEY,QAAA,WAAW,GAAoB;IAC1C,MAAM,EAAE,OAAO;IACf,MAAM,EAAE,OAAO;IACf,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,0YAA0Y;IAChZ,MAAM,EAAE;QACN,KAAK,EAAE,uIAAuI;QAC9I,WAAW,EAAE,CAAC,eAAe,EAAE,UAAU,CAAC;QAC1C,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;YAC7B,IAAI,CAAC,EAAE;gBAAE,MAAM,IAAI,iBAAQ,CAAC,6HAA6H,CAAC,CAAC;YAC3J,MAAM,IAAI,GAAG,MAAM,IAAA,uBAAU,EAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAA,+BAAgB,EAAC,EAAE,cAAc,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAChJ,OAAO,IAAA,mCAAoB,EAAC,IAAI,CAAC,CAAC;QACpC,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,kFAAkF;QACzF,WAAW,EAAE,CAAC,UAAU,EAAE,GAAG,CAAC;QAC9B,MAAM,EAAE;YACN,sLAAsL;YACtL,wGAAwG;YACxG,iGAAiG;SAClG;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,SAAS,GAAG,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,IAAA,sBAAS,EAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YACtC,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,iBAAQ,CAAC,sHAAsH,CAAC,CAAC;YACnK,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,OAAO,EAAE,GAAG,EAAE,CACzC,IAAA,mBAAW,EAAC,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,eAAe,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC,CACvI,CAAC;YACF,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,OAAO;QACf,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;YAC7B,MAAM,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC,IAAA,4CAAkC,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACnE,MAAM,YAAY,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC;YAC7D,MAAM,IAAI,GAA2B,EAAE,CAAC;YACxC,IAAI,YAAY;gBAAE,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,OAAO;QACf,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;QAClB,MAAM,EAAE,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE;KAC1C;IACD,OAAO,EAAE,OAAO;CACjB,CAAC"}

package/dist/migrate/descope/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const descopePlugin: MigrationPlugin;

package/dist/migrate/descope/plugin.js

@@ -0,0 +1,83 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.descopePlugin = void 0;
+const descope_1 = require("../export/descope");
+const kinde_descope_config_1 = require("../export/kinde-descope-config");
+const plugin_kit_1 = require("../export/plugin-kit");
+const vendor_http_1 = require("../export/vendor-http");
+/**
+ * `atlas migrate descope` — users, tenants, roles and permissions through the
+ * Descope Management API (project id + management key, on this machine),
+ * password hashes from the export Descope support provides when the owner
+ * has it, the `descope` bridge preset (DS session JWTs verified against the
+ * project's keys) and lazy migration through Descope's password sign-in for
+ * every other password.
+ */
+const PROJECT_ID = { flag: '--descope-project-id', env: 'DESCOPE_PROJECT_ID', label: 'your Descope project id (P…)', required: true };
+const MANAGEMENT_KEY = { flag: '--descope-management-key', env: 'DESCOPE_MANAGEMENT_KEY', label: 'a Descope management key', required: true, secret: true };
+const BASE_URL = { flag: '--descope-base-url', env: 'DESCOPE_BASE_URL', label: 'the Descope API base URL (regional or custom domain)', required: false };
+const HASHES_FILE = { flag: '--descope-hashes-file', env: 'DESCOPE_HASHES_FILE', label: 'the password-hash export from Descope support', required: false };
+function projectId(p) {
+    return p.credential({ ...PROJECT_ID, required: false }) ?? (p.ctx.env.NEXT_PUBLIC_DESCOPE_PROJECT_ID?.trim() || (0, plugin_kit_1.need)(p, PROJECT_ID));
+}
+function baseUrl(p) {
+    return (p.credential(BASE_URL) ?? (p.ctx.env.NEXT_PUBLIC_DESCOPE_BASE_URL?.trim() || undefined))?.replace(/\/+$/, '');
+}
+exports.descopePlugin = {
+    vendor: 'descope',
+    source: 'descope',
+    label: 'Descope',
+    help: 'Move a Descope project: password policy, roles and permissions as Atlas config; users with their login ids, verified emails and phones, social and SSO links, tenants (as organizations), roles and custom attributes; password hashes from the export Descope support provides; a zero-logout bridge for DS session tokens; lazy migration for the other passwords; and the code. Your management key stays on this machine.',
+    config: {
+        reads: 'your Descope project via the Management API (password settings, roles, permissions)',
+        credentials: [PROJECT_ID, MANAGEMENT_KEY],
+        async translate(p) {
+            const pid = projectId(p);
+            const http = new vendor_http_1.VendorHttp({ vendor: 'Descope', baseUrl: baseUrl(p) ?? 'https://api.descope.com', headers: { authorization: `Bearer ${pid}:${(0, plugin_kit_1.need)(p, MANAGEMENT_KEY)}` }, fetchImpl: p.fetch });
+            const snap = await (0, plugin_kit_1.vendorStep)('Descope', () => (0, kinde_descope_config_1.fetchDescopeConfig)(http, pid));
+            return (0, kinde_descope_config_1.translateDescopeConfig)(snap);
+        },
+    },
+    export: {
+        reads: 'the Descope Management API (users, tenants, roles) and the support hash export (--descope-hashes-file)',
+        credentials: [PROJECT_ID, MANAGEMENT_KEY, HASHES_FILE],
+        limits: [
+            'Password hashes are not returned by the Management API: Descope support can export them on request. Pass that file with --descope-hashes-file; without it, passwords move by lazy migration.',
+            'TOTP seeds, passkeys and magic-link / OTP state cannot be exported: users enrol their second factor and passkeys again (email and SMS codes simply work).',
+            'Sessions are not exported: Descope session tokens are JWTs, exchanged by the descope bridge preset.',
+        ],
+        async run(p, writer, resume) {
+            const set = await (0, plugin_kit_1.vendorStep)('Descope', () => (0, descope_1.exportDescope)({
+                projectId: projectId(p),
+                managementKey: (0, plugin_kit_1.need)(p, MANAGEMENT_KEY),
+                baseUrl: baseUrl(p),
+                hashesText: (0, plugin_kit_1.localFile)(p, HASHES_FILE, 'text'),
+                fetchImpl: p.fetch,
+                onProgress: (m) => p.say(`  reading ${m}`),
+            }));
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    bridge: {
+        preset: 'descope',
+        vars(p, t) {
+            const vars = { ...t?.bridge?.vars, project_id: t?.bridge?.vars.project_id ?? projectId(p) };
+            const base = baseUrl(p);
+            if (base)
+                vars.base_url = base;
+            return vars;
+        },
+    },
+    lazy: {
+        preset: 'descope',
+        config(p, t) {
+            const config = { ...t?.lazy?.config, project_id: t?.lazy?.config.project_id ?? projectId(p) };
+            const base = baseUrl(p);
+            if (base)
+                config.base_url = base;
+            return config;
+        },
+    },
+    codemod: 'descope',
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/descope/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/descope/plugin.ts"],"names":[],"mappings":";;;AAAA,+CAAkD;AAClD,yEAA4F;AAE5F,qDAAmF;AACnF,uDAAmD;AAEnD;;;;;;;GAOG;AAEH,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,8BAA8B,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACtJ,MAAM,cAAc,GAAmB,EAAE,IAAI,EAAE,0BAA0B,EAAE,GAAG,EAAE,wBAAwB,EAAE,KAAK,EAAE,0BAA0B,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC5K,MAAM,QAAQ,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,sDAAsD,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACzK,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,+CAA+C,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAE3K,SAAS,SAAS,CAAC,CAAgB;IACjC,OAAO,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,8BAA8B,EAAE,IAAI,EAAE,IAAI,IAAA,iBAAI,EAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;AACvI,CAAC;AAED,SAAS,OAAO,CAAC,CAAgB;IAC/B,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,4BAA4B,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACxH,CAAC;AAEY,QAAA,aAAa,GAAoB;IAC5C,MAAM,EAAE,SAAS;IACjB,MAAM,EAAE,SAAS;IACjB,KAAK,EAAE,SAAS;IAChB,IAAI,EAAE,+ZAA+Z;IACra,MAAM,EAAE;QACN,KAAK,EAAE,qFAAqF;QAC5F,WAAW,EAAE,CAAC,UAAU,EAAE,cAAc,CAAC;QACzC,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,IAAI,GAAG,IAAI,wBAAU,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,yBAAyB,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,IAAI,IAAA,iBAAI,EAAC,CAAC,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YACjM,MAAM,IAAI,GAAG,MAAM,IAAA,uBAAU,EAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAA,yCAAkB,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;YAC9E,OAAO,IAAA,6CAAsB,EAAC,IAAI,CAAC,CAAC;QACtC,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,wGAAwG;QAC/G,WAAW,EAAE,CAAC,UAAU,EAAE,cAAc,EAAE,WAAW,CAAC;QACtD,MAAM,EAAE;YACN,8LAA8L;YAC9L,2JAA2J;YAC3J,qGAAqG;SACtG;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,SAAS,EAAE,GAAG,EAAE,CAC3C,IAAA,uBAAa,EAAC;gBACZ,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;gBACvB,aAAa,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,cAAc,CAAC;gBACtC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;gBACnB,UAAU,EAAE,IAAA,sBAAS,EAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC;gBAC7C,SAAS,EAAE,CAAC,CAAC,KAAK;gBAClB,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;aAC3C,CAAC,CACH,CAAC;YACF,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,SAAS;QACjB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,GAA2B,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YACpH,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,IAAI;gBAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,SAAS;QACjB,MAAM,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,MAAM,GAA2B,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YACtH,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,IAAI;gBAAE,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;YACjC,OAAO,MAAM,CAAC;QAChB,CAAC;KACF;IACD,OAAO,EAAE,SAAS;CACnB,CAAC"}

package/dist/migrate/export/auth0-config.d.ts

@@ -0,0 +1,29 @@
+import type { TranslationResult } from '../framework/plugin';
+import { type Obj } from './record-set';
+import { VendorHttp } from './vendor-http';
+/**
+ * `atlas migrate auth0 config` — an Auth0 tenant's settings → Atlas config,
+ * read with the Management API on this machine: tenant settings (session
+ * lifetimes), database connections (password policy, username, sign-up,
+ * passkeys), passwordless and social connections, MFA factors and policy,
+ * breached-password detection, applications (callback URLs, web origins),
+ * APIs, roles and permissions. Actions, Rules, Hooks and branding are code
+ * or design: reported as manual.
+ */
+export interface Auth0ConfigSnapshot {
+    domain: string;
+    tenant: Obj;
+    connections: Obj[];
+    guardianFactors: Obj[];
+    guardianPolicies: string[];
+    breachedPassword: Obj | null;
+    clients: Obj[];
+    resourceServers: Obj[];
+    roles: Array<Obj & {
+        permissions?: Obj[];
+    }>;
+    actions: Obj[];
+    rules: Obj[];
+}
+export declare function fetchAuth0Config(http: VendorHttp, domain: string): Promise<Auth0ConfigSnapshot>;
+export declare function translateAuth0Config(snap: Auth0ConfigSnapshot): TranslationResult;

package/dist/migrate/export/auth0-config.js

@@ -0,0 +1,249 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fetchAuth0Config = fetchAuth0Config;
+exports.translateAuth0Config = translateAuth0Config;
+const record_set_1 = require("./record-set");
+const translate_kit_1 = require("./translate-kit");
+const vendor_http_1 = require("./vendor-http");
+async function fetchAuth0Config(http, domain) {
+    const get = async (path, fallback) => {
+        try {
+            return (await http.get(path)).body ?? fallback;
+        }
+        catch (err) {
+            if (err instanceof vendor_http_1.VendorApiError && [403, 404].includes(err.status))
+                return fallback;
+            throw err;
+        }
+    };
+    const list = async (path, key) => {
+        const body = await get(path, []);
+        return Array.isArray(body) ? (0, record_set_1.objs)(body) : (0, record_set_1.isObj)(body) ? (0, record_set_1.objs)(body[key]) : [];
+    };
+    const roles = (await list('/roles?per_page=100', 'roles'));
+    for (const r of roles)
+        r.permissions = await list(`/roles/${(0, record_set_1.str)(r.id)}/permissions?per_page=100`, 'permissions');
+    return {
+        domain,
+        tenant: await get('/tenants/settings', {}),
+        connections: await list('/connections?per_page=100', 'connections'),
+        guardianFactors: await list('/guardian/factors', 'factors'),
+        guardianPolicies: (0, record_set_1.strs)(await get('/guardian/policies', [])),
+        breachedPassword: await get('/attack-protection/breached-password-detection', null),
+        clients: await list('/clients?per_page=100&is_global=false', 'clients'),
+        resourceServers: await list('/resource-servers?per_page=100', 'resource_servers'),
+        roles,
+        actions: await list('/actions/actions?per_page=100', 'actions'),
+        rules: await list('/rules?per_page=100', 'rules'),
+    };
+}
+const HOUR = 3600_000;
+function translateAuth0Config(snap) {
+    const b = new translate_kit_1.ConfigBuilder();
+    // ── sessions ──
+    const t = snap.tenant;
+    if (typeof t.session_lifetime === 'number') {
+        const ms = (0, translate_kit_1.clampSessionMs)(t.session_lifetime * HOUR);
+        b.set('session.absoluteMs', ms);
+        b.add(ms === t.session_lifetime * HOUR ? 'mapped' : 'differs', 'tenant settings', 'session_lifetime', `${t.session_lifetime} hour(s)${ms !== t.session_lifetime * HOUR ? ' (clamped to Atlas\'s 90-day maximum)' : ''}.`, 'auth_config.session.absoluteMs');
+    }
+    if (typeof t.idle_session_lifetime === 'number') {
+        const ms = (0, translate_kit_1.clampSessionMs)(t.idle_session_lifetime * HOUR);
+        b.set('session.idleMs', ms);
+        b.add('mapped', 'tenant settings', 'idle_session_lifetime', `${t.idle_session_lifetime} hour(s) of inactivity.`, 'auth_config.session.idleMs');
+    }
+    // ── database connections ──
+    const dbs = snap.connections.filter((c) => (0, record_set_1.str)(c.strategy) === 'auth0');
+    if (dbs.length > 1)
+        b.add('differs', 'connections', 'database connections', `${dbs.length} database connections: Atlas has one user store per instance; their users are imported together (an email in two connections becomes one user).`, 'users');
+    const db = dbs.find((c) => (0, record_set_1.str)(c.name) === 'Username-Password-Authentication') ?? dbs[0];
+    b.set('strategies.password', Boolean(db));
+    if (db) {
+        const o = (0, record_set_1.isObj)(db.options) ? db.options : {};
+        const name = (0, record_set_1.str)(db.name);
+        const area = `connections ${name}`;
+        b.add('mapped', area, 'strategy auth0', 'Email + password sign-in. Imported password hashes (support export) verify as-is; lazy migration covers the rest.', 'auth_config.strategies.password');
+        const complexity = (0, record_set_1.isObj)(o.password_complexity_options) ? o.password_complexity_options : {};
+        const policyMin = { none: 1, low: 6, fair: 8, good: 8, excellent: 10 };
+        const policy = (0, record_set_1.str)(o.passwordPolicy) ?? 'good';
+        const min = typeof complexity.min_length === 'number' ? complexity.min_length : policyMin[policy] ?? 8;
+        b.set('passwordPolicy.minLength', Math.max(8, min));
+        b.add(min < 8 ? 'differs' : 'mapped', area, 'options.password_complexity_options.min_length', min < 8 ? `Auth0 allows ${min}; Atlas requires at least 8 (existing passwords still sign in).` : `${min}.`, 'auth_config.passwordPolicy.minLength');
+        if (policy === 'fair' || policy === 'good' || policy === 'excellent')
+            b.add('differs', area, `options.passwordPolicy "${policy}"`, 'Atlas follows NIST 800-63B (length and breached-password checks, no character-class rules).', 'auth_config.passwordPolicy');
+        if (o.password_history && (0, record_set_1.isObj)(o.password_history) && o.password_history.enable === true)
+            b.add('manual', area, 'options.password_history', 'Atlas does not keep a password history.');
+        if (o.password_dictionary && (0, record_set_1.isObj)(o.password_dictionary) && o.password_dictionary.enable === true)
+            b.add('differs', area, 'options.password_dictionary', 'Atlas checks breached-password corpora instead of a custom dictionary.', 'auth_config.passwordPolicy.checkBreaches');
+        if (o.requires_username === true) {
+            b.set('strategies.username', true);
+            const v = (0, record_set_1.isObj)(o.validation) && (0, record_set_1.isObj)(o.validation.username) ? o.validation.username : {};
+            if (typeof v.min === 'number')
+                b.set('accountUx.username.minLength', v.min);
+            if (typeof v.max === 'number')
+                b.set('accountUx.username.maxLength', v.max);
+            b.add('mapped', area, 'options.requires_username', 'Usernames (with the same length limits).', 'auth_config.strategies.username');
+        }
+        if (o.disable_signup === true) {
+            b.set('signUpMode', 'restricted');
+            b.add('mapped', area, 'options.disable_signup', 'Self sign-up is closed (invitations and the allowlist still work).', 'auth_config.signUpMode');
+        }
+        if (o.brute_force_protection !== false)
+            b.add('mapped', area, 'options.brute_force_protection', 'Atlas locks out repeated failed sign-ins per account and IP.', 'auth_config.rateLimit');
+        const methods = (0, record_set_1.isObj)(o.authentication_methods) ? o.authentication_methods : {};
+        if ((0, record_set_1.isObj)(methods.passkey) && methods.passkey.enabled === true) {
+            b.set('strategies.passkey', true);
+            b.add('mapped', area, 'options.authentication_methods.passkey', 'Passkeys. Existing Auth0 passkeys move with --authentication-methods when the RP id stays the same.', 'auth_config.strategies.passkey');
+        }
+        if (o.customScripts && (0, record_set_1.isObj)(o.customScripts) && o.enabledDatabaseCustomization === true) {
+            b.add('manual', area, 'options.customScripts', 'A custom database (Login / Get User scripts): point an Atlas legacy-auth connection at your user store instead (lazy migration webhook).', 'legacy_auth_connection');
+        }
+    }
+    // ── passwordless ──
+    for (const c of snap.connections) {
+        const strategy = (0, record_set_1.str)(c.strategy);
+        const o = (0, record_set_1.isObj)(c.options) ? c.options : {};
+        if (strategy === 'email') {
+            const link = (0, record_set_1.str)(o.authParams && (0, record_set_1.isObj)(o.authParams) ? o.authParams.response_type : undefined) === 'code' ? false : (0, record_set_1.str)(o.email && (0, record_set_1.isObj)(o.email) ? o.email.body : undefined)?.includes('@@link@@');
+            b.set(link ? 'strategies.emailLink' : 'strategies.emailCode', true);
+            b.add('mapped', 'connections email', 'strategy email', link ? 'Passwordless magic link.' : 'Passwordless email code.', link ? 'auth_config.strategies.emailLink' : 'auth_config.strategies.emailCode');
+            if (typeof o.totp === 'object' && (0, record_set_1.isObj)(o.totp) && typeof o.totp.time_step === 'number')
+                b.add('differs', 'connections email', 'options.totp.time_step', `Auth0 codes live ${o.totp.time_step}s; set Atlas's verification.emailCode.ttlMinutes.`, 'auth_config.verification.emailCode.ttlMinutes');
+        }
+        else if (strategy === 'sms') {
+            b.set('strategies.phoneCode', true);
+            b.add('mapped', 'connections sms', 'strategy sms', 'Passwordless SMS code (Atlas sends through its own SMS provider settings).', 'auth_config.strategies.phoneCode');
+        }
+    }
+    // ── social connections ──
+    const ENTERPRISE = new Set(['samlp', 'oidc', 'waad', 'adfs', 'okta', 'pingfederate', 'google-apps', 'ad', 'auth0-adldap', 'office365']);
+    for (const c of snap.connections) {
+        const strategy = (0, record_set_1.str)(c.strategy);
+        const name = (0, record_set_1.str)(c.name) ?? strategy ?? '';
+        if (!strategy || strategy === 'auth0' || strategy === 'email' || strategy === 'sms')
+            continue;
+        const o = (0, record_set_1.isObj)(c.options) ? c.options : {};
+        if (ENTERPRISE.has(strategy)) {
+            b.add(strategy === 'ad' || strategy === 'auth0-adldap' ? 'manual' : 'mapped', `connections ${name}`, `strategy ${strategy}`, strategy === 'ad' || strategy === 'auth0-adldap' ? 'AD/LDAP connector: no Atlas counterpart; use a lazy-migration webhook against your directory, or an enterprise IdP in front of it.' : 'Enterprise connection: moves with the data export as an Atlas SSO connection. Update the IdP with Atlas\'s ACS URL / redirect URI.', 'sso_connections');
+            continue;
+        }
+        if (strategy === 'oauth2') {
+            b.add('manual', `connections ${name}`, 'strategy oauth2', `Custom social connection "${name}": recreate it as an Atlas custom OAuth provider (authorization ${(0, record_set_1.str)(o.authorizationURL) ?? '?'}, token ${(0, record_set_1.str)(o.tokenURL) ?? '?'}); its fetchUserProfile script becomes a claim mapping.`, 'custom_oauth_providers');
+            continue;
+        }
+        const key = (0, translate_kit_1.socialKey)(strategy);
+        if (!key) {
+            b.add('manual', `connections ${name}`, `strategy ${strategy}`, `"${strategy}" is not a built-in Atlas provider; add it as a custom OAuth provider.`, 'custom_oauth_providers');
+            continue;
+        }
+        // Auth0's developer keys (no client_id) never work outside Auth0.
+        const clientId = (0, record_set_1.str)(o.client_id);
+        b.socialProvider({ atlasKey: key, vendorName: strategy, area: `connections ${name}`, setting: `strategy ${strategy}`, clientId, scopes: (0, record_set_1.strs)(o.scope ?? o.scopes) });
+        if (!clientId)
+            b.add('manual', `connections ${name}`, 'options.client_id', 'This connection uses Auth0\'s shared developer keys, which only work inside Auth0: create your own OAuth app (provider user ids change, so these users relink by email).', `oauth_providers ${key}`);
+    }
+    // ── MFA ──
+    const factors = new Map(snap.guardianFactors.map((f) => [(0, record_set_1.str)(f.name) ?? '', f.enabled === true]));
+    if (factors.get('otp')) {
+        b.set('mfa.factors.totp', true);
+        b.add('mapped', 'multi-factor', 'guardian factor otp', 'Authenticator apps. TOTP secrets move only with Auth0 support\'s secrets export.', 'auth_config.mfa.factors.totp');
+    }
+    if (factors.get('webauthn-roaming') || factors.get('webauthn-platform')) {
+        b.set('mfa.factors.passkey', true);
+        b.add('mapped', 'multi-factor', 'guardian factor webauthn', 'Security keys / device biometrics as a second factor.', 'auth_config.mfa.factors.passkey');
+    }
+    if (factors.get('email')) {
+        b.set('mfa.factors.emailCode', true);
+        b.add('mapped', 'multi-factor', 'guardian factor email', 'Email code second factor.', 'auth_config.mfa.factors.emailCode');
+    }
+    if (factors.get('sms') || factors.get('phone-message'))
+        b.add('differs', 'multi-factor', 'guardian factor sms', 'SMS second factor: phone factors move with --authentication-methods; Atlas recommends TOTP or passkeys.', 'auth_config.mfa');
+    if (factors.get('push-notification'))
+        b.add('manual', 'multi-factor', 'guardian factor push-notification', 'Auth0 Guardian push has no Atlas counterpart: those users enrol TOTP or a passkey.');
+    if (factors.get('recovery-code'))
+        b.add('mapped', 'multi-factor', 'guardian factor recovery-code', 'Backup codes (new ones are generated in Atlas).', 'auth_config.mfa.backupCodes');
+    if (snap.guardianPolicies.includes('all-applications')) {
+        b.set('mfaPolicy', 'required');
+        b.add('mapped', 'multi-factor', 'guardian policies all-applications', 'MFA always required.', 'auth_config.mfaPolicy');
+    }
+    else if (snap.guardianPolicies.includes('confidence-score')) {
+        b.add('differs', 'multi-factor', 'guardian policies confidence-score', 'Adaptive MFA: Atlas uses step-up and risk policies instead; review auth_config.stepUp.', 'auth_config.stepUp');
+    }
+    if (snap.breachedPassword) {
+        const on = snap.breachedPassword.enabled === true;
+        b.set('passwordPolicy.checkBreaches', on);
+        b.add('mapped', 'attack protection', 'breached-password-detection.enabled', on ? 'Breached passwords are refused.' : 'Breached-password check off.', 'auth_config.passwordPolicy.checkBreaches');
+    }
+    // ── applications ──
+    const origins = new Set();
+    const redirects = new Set();
+    for (const c of snap.clients) {
+        const app = (0, record_set_1.str)(c.name) ?? (0, record_set_1.str)(c.client_id) ?? 'application';
+        const type = (0, record_set_1.str)(c.app_type);
+        if (type === 'non_interactive') {
+            b.add('manual', `applications ${app}`, 'app_type non_interactive', 'A machine-to-machine application: create an Atlas M2M client (client credentials) for it.', 'oauth_clients');
+            continue;
+        }
+        for (const u of (0, record_set_1.strs)(c.callbacks))
+            redirects.add(u);
+        for (const u of [...(0, record_set_1.strs)(c.web_origins), ...(0, record_set_1.strs)(c.allowed_origins)])
+            origins.add(u);
+        if (c.is_first_party === false)
+            b.add('manual', `applications ${app}`, 'is_first_party false', 'A third-party application: register it as an Atlas OAuth client.', 'oauth_clients');
+    }
+    let exact = 0;
+    for (const url of redirects) {
+        if (url.includes('*')) {
+            b.add('differs', 'applications', `callbacks ${url}`, 'Atlas redirect URLs are exact (no wildcards); list each URL.', 'redirect_urls');
+            continue;
+        }
+        b.push('redirect_urls', { url });
+        exact++;
+    }
+    if (exact)
+        b.add('mapped', 'applications', 'callbacks', `${exact} callback URL(s) become redirect URLs.`, 'redirect_urls');
+    if (origins.size) {
+        b.instance.allowed_origins = [...origins].filter((o) => !o.includes('*'));
+        b.add('mapped', 'applications', 'web_origins / allowed_origins', 'Allowed origins for the browser SDK.', 'instance.allowed_origins');
+    }
+    // ── APIs, roles, permissions ──
+    for (const rs of snap.resourceServers) {
+        const identifier = (0, record_set_1.str)(rs.identifier);
+        if (!identifier || rs.is_system === true)
+            continue;
+        b.push('resource_servers', { identifier, name: (0, record_set_1.str)(rs.name) ?? identifier, scopes: (0, record_set_1.objs)(rs.scopes).map((s) => (0, record_set_1.str)(s.value)).filter((s) => !!s) });
+        b.add('mapped', 'APIs', `resource-servers ${identifier}`, `API with ${(0, record_set_1.objs)(rs.scopes).length} scope(s); access tokens for it keep "aud": "${identifier}".`, `resource_servers ${identifier}`);
+    }
+    const perms = new Map();
+    for (const r of snap.roles) {
+        const name = (0, record_set_1.str)(r.name);
+        if (!name)
+            continue;
+        const key = (0, translate_kit_1.keyOf)(name);
+        b.roles[name] = key;
+        const rp = (r.permissions ?? []).map((p) => (0, record_set_1.str)(p.permission_name)).filter((p) => !!p);
+        for (const p of r.permissions ?? []) {
+            const n = (0, record_set_1.str)(p.permission_name);
+            if (n)
+                perms.set(n, (0, record_set_1.str)(p.description) ?? '');
+        }
+        b.push('roles', { key, name, description: (0, record_set_1.str)(r.description) ?? '', permissions: rp });
+    }
+    for (const [key, description] of [...perms.entries()].sort())
+        b.push('permissions', { key, name: key, description });
+    if (snap.roles.length)
+        b.add('mapped', 'roles', 'roles', `${snap.roles.length} role(s) with their permissions; assignments move with the data export.`, 'roles');
+    // ── code ──
+    for (const a of snap.actions) {
+        const triggers = (0, record_set_1.objs)(a.supported_triggers).map((tr) => (0, record_set_1.str)(tr.id)).filter(Boolean).join(', ');
+        b.add('manual', 'actions', `actions ${(0, record_set_1.str)(a.name) ?? '?'}`, `Auth0 Action (${triggers || 'trigger unknown'}): port it to an Atlas action or webhook; token claims it adds become a JWT template or session claims.`, 'actions');
+    }
+    for (const r of snap.rules)
+        if (r.enabled !== false)
+            b.add('manual', 'rules', `rules ${(0, record_set_1.str)(r.name) ?? '?'}`, 'Auth0 Rule: port it to an Atlas action.', 'actions');
+    return b.result(`Auth0 tenant ${snap.domain}`, {
+        bridge: { preset: 'auth0', vars: { domain: snap.domain } },
+        lazy: db ? { preset: 'auth0', config: { domain: snap.domain, connection: (0, record_set_1.str)(db.name) ?? 'Username-Password-Authentication' } } : undefined,
+    });
+}
+//# sourceMappingURL=auth0-config.js.map