@atlasauth/cli 0.11.0 → 0.13.0

package/dist/help.js

@@ -23,6 +23,7 @@ Commands:
   api-keys list|create|revoke
   webhooks list|create|upsert|update|test|deliveries|redeliver|replay|rotate|reveal
   listen --forward-to <url>  Forward live events to your local server, signed (no tunnel)
+  dev [proxy]                Local in-memory Atlas (emulator) / one-origin dev proxy
   move-origin --from --to    Move an app to a new domain in one step (--dry-run first)
   csp --framework next|express|nginx
                              Print the Content Security Policy sources Atlas needs
@@ -36,8 +37,12 @@ Commands:
                              Atlas staff: accounts for other platforms' integration teams
                              (operator sign-in with a recent second factor; passwords to 0600 files)
   sessions revoke
-  config export|import|plan  Config-as-code: round-trip the instance's config; plan = drift diff
+  config export|import|plan|promote
+                             Config-as-code: round-trip the instance's config; plan = drift diff;
+                             promote = copy one environment's config to another
   actions list|deploy|test|logs|gallery|show|install|installs|update|publish
+  pages list|push|preview|promote|pull|discard
+                             Code-defined hosted-page templates: draft, signed preview link, promote
   init                       Create or complete an app's setup (idempotent); secrets to 0600 files
   preflight                  Check an instance's setup; non-zero exit on errors (for CI)
   doctor                     Integration health: webhooks, logout, referrals, email, consent (exit 1 on a failure)
@@ -58,6 +63,9 @@ Commands:
   migrate better-auth config [path]
                              Translate the app's betterAuth({...}) options into Atlas
                              config files plus a report (offline)
+  migrate <vendor> [step] [path]
+                             Move from any vendor (config, export, import, bridge, lazy):
+                             resumable; vendor credentials never leave this machine
   info [path]                Print the environment for a support ticket (versions, SDKs,
                              instance, API latency, preflight); secrets redacted
   mcp install                Add the Atlas MCP server (docs search) to Cursor, Claude Code,
@@ -94,6 +102,35 @@ Usage:
   atlas migrate better-auth [path] [--dry-run] [--yes] [--resume] [--force] [--json]
         [--dir <dir>] [--state-file <file>] [--entry <file>] [--bundle <file>] [--run-export]
         [--confirm-conflicts] [--bridge-days <n>] [--skip <step,...>]
+  atlas migrate <vendor> [path] [--dry-run] [--yes] [--resume] [--force] [--json]
+        [--set name=value ...] [--skip <step,...>] [--bridge-days <n>] [--confirm-conflicts]
+  atlas migrate <vendor> config|export|import|bridge|lazy [path] [--set name=value ...]
+  atlas migrate export <vendor> [path]      (same as: atlas migrate <vendor> export)
+  atlas migrate custom export --file <records.ndjson|.json> [path]
+
+migrate <vendor> is the program for every other vendor, one plugin each
+(atlas migrate --help lists them). Steps, checkpointed in
+atlas-migrate/<vendor>/state.json (--state-file):
+  preflight  instance and key
+  config     read the vendor's configuration, write Atlas config files and
+             <vendor>-report.md (1:1 / differs / manual, with where each came from)
+  export     read the vendor (its API with YOUR vendor credentials, an export
+             file, or your database) and write atlas-migrate/<vendor>/bundle.atlas,
+             sealed to this instance's import key; resumable from a checkpoint
+  import     upload, dry-run report, confirm, import (resumes a stopped import)
+  bridge     accept the vendor's sessions for --bridge-days (default 30)
+  lazy       verify passwords against the vendor on first sign-in (vendors whose
+             hashes never leave them)
+  code       atlas migrate code --from <vendor>, after a confirmation
+  verify     the import's counts and a checklist
+Vendor settings and credentials are --set name=value (e.g. --set auth0-domain=…)
+or the environment variable the plugin names; they are used here only.
+
+Self-hosted frameworks (authjs, lucia, passport, iron-session, devise, django)
+keep users in your own database, so nothing calls a vendor: config reads your
+app's source, and export reads table dumps you make with your own tools
+(--set dump=<dir>: one <table>.csv/.json/.ndjson per table) or, for devise and
+django, the export script it writes on the first run, piped in with --file -.
 
 migrate better-auth config reads your betterAuth({...}) setup statically (it
 follows imports and resolves env vars by NAME, never their values) and writes
@@ -126,10 +163,33 @@ Vendors:
                Supabase client itself stays for your database
   auth0        @auth0/auth0-react, @auth0/nextjs-auth0 (v3 and v4), @auth0/auth0-spa-js
   better-auth  better-auth (client, server, Next.js handler, cookies)
+  lucia        lucia v2 / v3 (validateSession, cookies, invalidate…): TODO markers
+               naming the Atlas call for each, since no call has the same shape
+  passport     passport + express-session (initialize, session, authenticate('jwt'),
+               req.isAuthenticated()); strategies and req.user are reported
+  iron-session getIronSession() reads of the user id -> auth()
+  keycloak     keycloak-js, @react-keycloak, keycloak-connect, the Keycloak Auth.js provider
+  ory          @ory/client, @ory/nextjs, @ory/elements (Kratos and Hydra)
+  zitadel      @zitadel/react, @zitadel/node, @zitadel/next
+  logto        @logto/react, @logto/next, @logto/node and the other Logto SDKs
+  supertokens  supertokens-node, supertokens-web-js, supertokens-auth-react
+  authentik    react-oidc-context / oidc-client-ts pointed at authentik, @goauthentik/api
+  fusionauth   @fusionauth/react-sdk, @fusionauth/typescript-client and the other FusionAuth SDKs
+  hanko        @teamhanko/hanko-elements and hanko-frontend-sdk
   openid-client  openid-client (Issuer.discover, authorizationUrl, callback, endSessionUrl)
   jose         jose used to verify OIDC ID tokens (jwtVerify + createRemoteJWKSet)
   generic-oidc a hand-rolled relying party (discovery, PKCE, code exchange, JWKS) found
                by its code; replaced by oidc.start / oidc.callback / oidc.logoutUrl
+  firebase     firebase/auth (modular and v8 compat), react-firebase-hooks, FirebaseUI,
+               firebase-admin auth calls; Firebase itself stays for Firestore/Storage
+  cognito      aws-amplify/auth (v6 and v5 Auth), Hub auth events, @aws-amplify/ui-react,
+               amazon-cognito-identity-js, aws-jwt-verify
+  azure-ad-b2c @azure/msal-browser, @azure/msal-react, @azure/msal-node, passport-azure-ad
+  entra-external-id  the same MSAL rewrite, for Entra External ID tenants
+  appwrite     the Appwrite Account API (new Account(client)), node-appwrite Users/Teams;
+               Databases/Storage stay
+  pocketbase   pb.authStore and collection auth calls; collections and files stay
+  nhost        @nhost/react / @nhost/nextjs hooks and nhost.auth.*; GraphQL/Storage stay
 
 What it rewrites: imports, providers, hooks, server session helpers, middleware,
 sign-in/out calls and env var names, onto native Atlas APIs and the drop-in
@@ -143,6 +203,7 @@ Options:
   --json                 Machine-readable result (diffs, report, packages, env)
 
 Safe to re-run: migrated code is left as it is. Move your users with
+'atlas migrate <vendor>' (Clerk, Auth0, Okta, Kinde, Descope, Better Auth) or
 'atlas import --from <vendor> <export-file>'.`,
     info: `atlas info — the environment, for support tickets
 
@@ -371,6 +432,16 @@ and no second endpoint. The signing secret belongs to this session only and is
 written to a 0600 file (webhook-listen.env): point your verifier at it. --events
 takes names or patterns (user.*, *.created). The session lasts up to an hour;
 Ctrl-C stops it. --count n exits after n events (exit 1 if any forward failed).`,
+    dev: `atlas dev — a local, in-memory Atlas
+
+Usage:
+  atlas dev [--port 4400] [--seed seed.json] [--app http://localhost:3000]
+  atlas dev proxy --app <url> --api <fapi url> [--port 4401]
+
+The emulator serves the Frontend API, a minimal Backend API, OIDC discovery and
+a mail/SMS catcher at /__emulator/mail. Every code is 424242. With --app it also
+forwards everything it does not own to your app, so both share one origin.
+'dev proxy' does the same against a real instance. No account, no network.`,
     'move-origin': `atlas move-origin — move an app to a new domain
 
 Usage: atlas move-origin --from <origin> --to <origin> [--dry-run] [--yes] [--json]
@@ -562,6 +633,7 @@ Usage:
   atlas config export [--dir <path>] [--format json|yaml]
   atlas config import [--dir <path>] [--format json|yaml] [--dry-run] [--prune]
   atlas config plan   [--dir <path>] [--format json|yaml] [--prune] [--exit-code] [--json]
+  atlas config promote --from <profile> --to <profile> [--dry-run] [--prune] [--yes] [--format json|yaml]
 
 export  Read the instance's current config (instance/auth config, OAuth clients
         and providers, SSO connections, resource servers, JWT templates, roles,
@@ -580,13 +652,35 @@ plan    A Terraform-style, read-only diff of the directory against the live
         instance: field-by-field before -> after for updates. --exit-code exits 2
         when there is drift (for CI); --json for tooling.
 
+promote Copy one environment's configuration to another (development ->
+        staging -> production). Each environment is a profile holding that
+        instance's secret key ('atlas login --profile staging'). Uses the same
+        plan/apply engine as import; --dry-run prints the plan only, and
+        applying to a live key needs --yes. Secrets never travel.
+
 Secrets never live on disk. Inject a credential at import with a \${ENV_VAR}
 placeholder in a file (e.g. a provider "client_secret": "\${GOOGLE_SECRET}").`,
+    pages: `atlas pages — code-defined hosted-page templates
+
+Usage:
+  atlas pages list [--json]
+  atlas pages push <file> --page <sign-in|sign-up|user-profile> [--promote] [--json]
+  atlas pages preview --page <page> [--json]
+  atlas pages promote --page <page> [--json]
+  atlas pages pull --page <page> [--draft]
+  atlas pages discard --page <page> --status <draft|live> [--json]
+
+A template is a JSON file of components (heading, text, image, link, button_link,
+list, divider, spacer, columns) in four regions around the sign-in card: header,
+above_form, below_form and footer. There is no raw HTML, CSS or script; Atlas
+validates the file and renders it. push saves a draft only; the live page does not
+change until promote (or push --promote). preview prints a signed link, valid for an
+hour, that shows the draft with a preview banner.`,
     actions: `atlas actions — manage Actions (tenant code run in the auth pipeline)
 
 Usage:
   atlas actions list [--json]
-  atlas actions deploy <file> --trigger <post_login|pre_user_registration|post_user_registration> [--name <n>] [--json]
+  atlas actions deploy <file> --trigger <trigger> [--name <n>] [--json]
   atlas actions test <file> [--trigger <t>] [--json]
   atlas actions logs <action-id> [--json]
 

package/dist/help.js.map

@@ -1 +1 @@
-{"version":3,"file":"help.js","sourceRoot":"","sources":["../src/help.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEU,QAAA,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wDA6EgC,CAAC;AAEzD,oDAAoD;AACvC,QAAA,YAAY,GAA2B;IAClD,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8CAyDmC;IAC5C,IAAI,EAAE;;;;;;;;;;gEAUwD;IAC9D,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2EAmCiE;IACzE,GAAG,EAAE;;;;;;;;;;;;;;;+CAewC;IAC7C,MAAM,EAAE;;;;;;;;;;;;sCAY4B;IACpC,SAAS,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yEAkD4D;IAEvE,KAAK,EAAE;;;;;;;;;;;;;;;;;;;;wEAoB+D;IAEtE,KAAK,EAAE;;;;;4CAKmC;IAE1C,IAAI,EAAE;;;;;;;;;;;;qBAYa;IAEnB,MAAM,EAAE;;uCAE6B;IAErC,MAAM,EAAE;;gDAEsC;IAE9C,KAAK,EAAE;;;;;;wCAM+B;IAEtC,IAAI,EAAE;;;;;uCAK+B;IAErC,UAAU,EAAE;;;;;;8CAMgC;IAE5C,QAAQ,EAAE;;;;;;;;;;;;;;;;;;;;4DAoBgD;IAC1D,MAAM,EAAE;;;;;;;;;;;;gFAYsE;IAC9E,aAAa,EAAE;;;;;;;;;gFAS+D;IAC9E,GAAG,EAAE;;;;;;;;;;;;;;;+DAewD;IAE7D,mBAAmB,EAAE;;;;;;;;;;;;;;;;oCAgBa;IAElC,KAAK,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8CA6BqC;IAE5C,aAAa,EAAE;;;;;;;;;;;;;;;;;;;;;;;;qBAwBI;IAEnB,YAAY,EAAE;;;;;;;;;;;;;;qCAcqB;IAEnC,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yEA+BiE;IAEvE,SAAS,EAAE;;;;;;oDAMuC;IAElD,MAAM,EAAE;;;;;;;;iEAQuD;IAE/D,GAAG,EAAE;;;;;;;;;;mDAU4C;IAEjD,MAAM,EAAE;;;;;;;;wDAQ8C;IAEtD,QAAQ,EAAE;;;8CAGkC;IAE5C,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;8EAyBoE;IAC5E,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;qEA0B0D;CACpE,CAAC"}
+{"version":3,"file":"help.js","sourceRoot":"","sources":["../src/help.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEU,QAAA,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wDAqFgC,CAAC;AAEzD,oDAAoD;AACvC,QAAA,YAAY,GAA2B;IAClD,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8CA8GmC;IAC5C,IAAI,EAAE;;;;;;;;;;gEAUwD;IAC9D,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2EAmCiE;IACzE,GAAG,EAAE;;;;;;;;;;;;;;;+CAewC;IAC7C,MAAM,EAAE;;;;;;;;;;;;sCAY4B;IACpC,SAAS,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yEAkD4D;IAEvE,KAAK,EAAE;;;;;;;;;;;;;;;;;;;;wEAoB+D;IAEtE,KAAK,EAAE;;;;;4CAKmC;IAE1C,IAAI,EAAE;;;;;;;;;;;;qBAYa;IAEnB,MAAM,EAAE;;uCAE6B;IAErC,MAAM,EAAE;;gDAEsC;IAE9C,KAAK,EAAE;;;;;;wCAM+B;IAEtC,IAAI,EAAE;;;;;uCAK+B;IAErC,UAAU,EAAE;;;;;;8CAMgC;IAE5C,QAAQ,EAAE;;;;;;;;;;;;;;;;;;;;4DAoBgD;IAC1D,MAAM,EAAE;;;;;;;;;;;;gFAYsE;IAC9E,GAAG,EAAE;;;;;;;;;2EASoE;IACzE,aAAa,EAAE;;;;;;;;;gFAS+D;IAC9E,GAAG,EAAE;;;;;;;;;;;;;;;+DAewD;IAE7D,mBAAmB,EAAE;;;;;;;;;;;;;;;;oCAgBa;IAElC,KAAK,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8CA6BqC;IAE5C,aAAa,EAAE;;;;;;;;;;;;;;;;;;;;;;;;qBAwBI;IAEnB,YAAY,EAAE;;;;;;;;;;;;;;qCAcqB;IAEnC,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yEA+BiE;IAEvE,SAAS,EAAE;;;;;;oDAMuC;IAElD,MAAM,EAAE;;;;;;;;iEAQuD;IAE/D,GAAG,EAAE;;;;;;;;;;mDAU4C;IAEjD,MAAM,EAAE;;;;;;;;wDAQ8C;IAEtD,QAAQ,EAAE;;;8CAGkC;IAE5C,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8EAgCoE;IAC5E,KAAK,EAAE;;;;;;;;;;;;;;;kDAeyC;IAChD,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;qEA0B0D;CACpE,CAAC"}

package/dist/index.d.ts

@@ -20,6 +20,7 @@ export { webhooks } from './commands/webhooks';
 export { sessions } from './commands/sessions';
 export { config } from './commands/config';
 export { actions } from './commands/actions';
+export { pages } from './commands/pages';
 export { init } from './commands/init';
 export { preflight, envCommand, client } from './commands/project-commands';
 export { referrals } from './commands/referrals';

package/dist/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.BETTER_AUTH_MIGRATION_STEPS = exports.migrateBetterAuth = exports.translateBetterAuth = exports.planConfigImport = exports.migrate = exports.manifestPath = exports.writeManifest = exports.readManifest = exports.deliverSecret = exports.productDir = exports.renderDotenv = exports.parseDotenv = exports.readEnvFile = exports.writeSecretFile = exports.referrals = exports.client = exports.envCommand = exports.preflight = exports.init = exports.actions = exports.config = exports.sessions = exports.webhooks = exports.apiKeys = exports.orgs = exports.users = exports.whoami = exports.logout = exports.login = exports.getVersion = exports.defaultPrompter = exports.defaultConfigPath = exports.MemoryConfigStore = exports.FileConfigStore = exports.captureIO = exports.defaultIO = exports.CliError = exports.isNotFound = exports.createConfigHttp = exports.defaultContext = exports.run = void 0;
+exports.BETTER_AUTH_MIGRATION_STEPS = exports.migrateBetterAuth = exports.translateBetterAuth = exports.planConfigImport = exports.migrate = exports.manifestPath = exports.writeManifest = exports.readManifest = exports.deliverSecret = exports.productDir = exports.renderDotenv = exports.parseDotenv = exports.readEnvFile = exports.writeSecretFile = exports.referrals = exports.client = exports.envCommand = exports.preflight = exports.init = exports.pages = exports.actions = exports.config = exports.sessions = exports.webhooks = exports.apiKeys = exports.orgs = exports.users = exports.whoami = exports.logout = exports.login = exports.getVersion = exports.defaultPrompter = exports.defaultConfigPath = exports.MemoryConfigStore = exports.FileConfigStore = exports.captureIO = exports.defaultIO = exports.CliError = exports.isNotFound = exports.createConfigHttp = exports.defaultContext = exports.run = void 0;
 /**
  * Library surface of `@atlasauth/cli`. The package ships a bin (`atlas`), but
  * exporting the pieces lets the handlers be unit-tested with injected deps and
@@ -46,6 +46,8 @@ var config_2 = require("./commands/config");
 Object.defineProperty(exports, "config", { enumerable: true, get: function () { return config_2.config; } });
 var actions_1 = require("./commands/actions");
 Object.defineProperty(exports, "actions", { enumerable: true, get: function () { return actions_1.actions; } });
+var pages_1 = require("./commands/pages");
+Object.defineProperty(exports, "pages", { enumerable: true, get: function () { return pages_1.pages; } });
 var init_1 = require("./commands/init");
 Object.defineProperty(exports, "init", { enumerable: true, get: function () { return init_1.init; } });
 var project_commands_1 = require("./commands/project-commands");

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA;;;;;GAKG;AACH,6BAA0C;AAAjC,0FAAA,GAAG,OAAA;AACZ,qCAAmF;AAA1E,yGAAA,cAAc,OAAA;AACvB,6CAA8E;AAArE,+GAAA,gBAAgB,OAAA;AAAE,yGAAA,UAAU,OAAA;AACrC,mCAAoC;AAA3B,kGAAA,QAAQ,OAAA;AACjB,2BAAqE;AAA5D,+FAAA,SAAS,OAAA;AAAE,+FAAA,SAAS,OAAA;AAC7B,mCAOkB;AANhB,yGAAA,eAAe,OAAA;AACf,2GAAA,iBAAiB,OAAA;AACjB,2GAAA,iBAAiB,OAAA;AAKnB,mCAA0D;AAAjD,yGAAA,eAAe,OAAA;AACxB,qCAAuC;AAA9B,qGAAA,UAAU,OAAA;AAEnB,0EAA0E;AAC1E,wCAAwD;AAA/C,6FAAA,KAAK,OAAA;AAAE,8FAAA,MAAM,OAAA;AAAE,8FAAA,MAAM,OAAA;AAC9B,0CAAyC;AAAhC,8FAAA,KAAK,OAAA;AACd,wCAAuC;AAA9B,4FAAA,IAAI,OAAA;AACb,gDAA8C;AAArC,mGAAA,OAAO,OAAA;AAChB,gDAA+C;AAAtC,oGAAA,QAAQ,OAAA;AACjB,gDAA+C;AAAtC,oGAAA,QAAQ,OAAA;AACjB,4CAA2C;AAAlC,gGAAA,MAAM,OAAA;AACf,8CAA6C;AAApC,kGAAA,OAAO,OAAA;AAChB,wCAAuC;AAA9B,4FAAA,IAAI,OAAA;AACb,gEAA4E;AAAnE,6GAAA,SAAS,OAAA;AAAE,8GAAA,UAAU,OAAA;AAAE,0GAAA,MAAM,OAAA;AACtC,kDAAiD;AAAxC,sGAAA,SAAS,OAAA;AAClB,qCAOmB;AANjB,0GAAA,eAAe,OAAA;AACf,sGAAA,WAAW,OAAA;AACX,sGAAA,WAAW,OAAA;AACX,uGAAA,YAAY,OAAA;AACZ,qGAAA,UAAU,OAAA;AACV,wGAAA,aAAa,OAAA;AAEf,qCAOmB;AANjB,uGAAA,YAAY,OAAA;AACZ,wGAAA,aAAa,OAAA;AACb,uGAAA,YAAY,OAAA;AAKd,8CAA6C;AAApC,kGAAA,OAAO,OAAA;AAChB,4CAA0F;AAAjF,0GAAA,gBAAgB,OAAA;AACzB,6DAA+H;AAAtH,gHAAA,mBAAmB,OAAA;AAC5B,mEAA6G;AAApG,iHAAA,iBAAiB,OAAA;AAAE,2HAAA,KAAK,OAA+B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA;;;;;GAKG;AACH,6BAA0C;AAAjC,0FAAA,GAAG,OAAA;AACZ,qCAAmF;AAA1E,yGAAA,cAAc,OAAA;AACvB,6CAA8E;AAArE,+GAAA,gBAAgB,OAAA;AAAE,yGAAA,UAAU,OAAA;AACrC,mCAAoC;AAA3B,kGAAA,QAAQ,OAAA;AACjB,2BAAqE;AAA5D,+FAAA,SAAS,OAAA;AAAE,+FAAA,SAAS,OAAA;AAC7B,mCAOkB;AANhB,yGAAA,eAAe,OAAA;AACf,2GAAA,iBAAiB,OAAA;AACjB,2GAAA,iBAAiB,OAAA;AAKnB,mCAA0D;AAAjD,yGAAA,eAAe,OAAA;AACxB,qCAAuC;AAA9B,qGAAA,UAAU,OAAA;AAEnB,0EAA0E;AAC1E,wCAAwD;AAA/C,6FAAA,KAAK,OAAA;AAAE,8FAAA,MAAM,OAAA;AAAE,8FAAA,MAAM,OAAA;AAC9B,0CAAyC;AAAhC,8FAAA,KAAK,OAAA;AACd,wCAAuC;AAA9B,4FAAA,IAAI,OAAA;AACb,gDAA8C;AAArC,mGAAA,OAAO,OAAA;AAChB,gDAA+C;AAAtC,oGAAA,QAAQ,OAAA;AACjB,gDAA+C;AAAtC,oGAAA,QAAQ,OAAA;AACjB,4CAA2C;AAAlC,gGAAA,MAAM,OAAA;AACf,8CAA6C;AAApC,kGAAA,OAAO,OAAA;AAChB,0CAAyC;AAAhC,8FAAA,KAAK,OAAA;AACd,wCAAuC;AAA9B,4FAAA,IAAI,OAAA;AACb,gEAA4E;AAAnE,6GAAA,SAAS,OAAA;AAAE,8GAAA,UAAU,OAAA;AAAE,0GAAA,MAAM,OAAA;AACtC,kDAAiD;AAAxC,sGAAA,SAAS,OAAA;AAClB,qCAOmB;AANjB,0GAAA,eAAe,OAAA;AACf,sGAAA,WAAW,OAAA;AACX,sGAAA,WAAW,OAAA;AACX,uGAAA,YAAY,OAAA;AACZ,qGAAA,UAAU,OAAA;AACV,wGAAA,aAAa,OAAA;AAEf,qCAOmB;AANjB,uGAAA,YAAY,OAAA;AACZ,wGAAA,aAAa,OAAA;AACb,uGAAA,YAAY,OAAA;AAKd,8CAA6C;AAApC,kGAAA,OAAO,OAAA;AAChB,4CAA0F;AAAjF,0GAAA,gBAAgB,OAAA;AACzB,6DAA+H;AAAtH,gHAAA,mBAAmB,OAAA;AAC5B,mEAA6G;AAApG,iHAAA,iBAAiB,OAAA;AAAE,2HAAA,KAAK,OAA+B"}

package/dist/migrate/appwrite/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const appwritePlugin: MigrationPlugin;

package/dist/migrate/appwrite/plugin.js

@@ -0,0 +1,103 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.appwritePlugin = void 0;
+const appwrite_1 = require("../export/appwrite");
+const appwrite_config_1 = require("../export/appwrite-config");
+const errors_1 = require("../../errors");
+const plugin_kit_1 = require("../export/plugin-kit");
+const project_files_1 = require("../export/project-files");
+/**
+ * `atlas migrate appwrite` — an Appwrite project (Cloud or self-hosted): auth
+ * settings from appwrite.json and the project document, users with their
+ * hashes and hash options, identities, MFA recovery codes, teams, memberships
+ * and invitations through the Server API (an API key on this machine), the
+ * `appwrite` remote bridge (Appwrite vouches for a live session once), lazy
+ * migration through the Account API for anyone the export missed, and the
+ * `appwrite` codemod.
+ */
+const ENDPOINT = { flag: '--appwrite-endpoint', env: 'APPWRITE_ENDPOINT', label: 'the Appwrite API endpoint including /v1 (default https://cloud.appwrite.io/v1)', required: false };
+const PROJECT_ID = { flag: '--appwrite-project-id', env: 'APPWRITE_PROJECT_ID', label: 'the Appwrite project id', required: true };
+const API_KEY = { flag: '--appwrite-api-key', env: 'APPWRITE_API_KEY', label: 'an Appwrite API key with users.read and teams.read', required: true, secret: true };
+const RECOVERY_CODES = { flag: '--appwrite-recovery-codes', env: 'APPWRITE_RECOVERY_CODES', label: 'true to export MFA recovery codes', required: false };
+const SKIP_TEAMS = { flag: '--appwrite-skip-teams', env: 'APPWRITE_SKIP_TEAMS', label: 'true to leave teams out', required: false };
+const CONFIG_FILE = { flag: '--appwrite-config', env: 'APPWRITE_CONFIG_FILE', label: 'appwrite.json (after appwrite pull settings)', required: false };
+const PROJECT_FILE = { flag: '--appwrite-project-file', env: 'APPWRITE_PROJECT_FILE', label: 'the project document (appwrite projects get --project-id <id> --json)', required: false };
+function endpointOf(p) {
+    return (p.credential(ENDPOINT) ?? appwrite_1.APPWRITE_CLOUD).trim().replace(/\/+$/, '');
+}
+exports.appwritePlugin = {
+    vendor: 'appwrite',
+    source: 'appwrite',
+    label: 'Appwrite',
+    help: 'Move an Appwrite project: its auth methods, session and password settings and OAuth providers as Atlas config; its users with their password hashes (Argon2, bcrypt, scrypt, Firebase scrypt, MD5, SHA, phpass), labels, prefs, OAuth identities, MFA recovery codes, teams, memberships and invitations; a zero-logout bridge that asks Appwrite about each live session once; lazy migration for anyone left; and the code. Your API key stays on this machine.',
+    config: {
+        reads: 'appwrite.json (appwrite pull settings) and, for OAuth providers, the project document (appwrite projects get --json)',
+        credentials: [CONFIG_FILE, PROJECT_FILE, ENDPOINT, { ...PROJECT_ID, required: false }],
+        async translate(p) {
+            const file = (0, project_files_1.projectFile)(p, CONFIG_FILE, ['appwrite.json', 'appwrite.config.json']);
+            const projectText = (0, plugin_kit_1.localFile)(p, PROJECT_FILE, 'text');
+            if (!file && !projectText)
+                throw new errors_1.CliError('Appwrite: no appwrite.json in this folder. Run appwrite pull settings, or pass --set appwrite-config=<file> / --set appwrite-project-file=<appwrite projects get --json output>.');
+            let project;
+            if (projectText) {
+                try {
+                    project = JSON.parse(projectText);
+                }
+                catch {
+                    throw new errors_1.CliError('Appwrite: the project document is not JSON (use appwrite projects get --project-id <id> --json).');
+                }
+            }
+            return (0, plugin_kit_1.vendorStep)('Appwrite', async () => (0, appwrite_config_1.translateAppwriteConfig)({ file, project, endpoint: p.credential(ENDPOINT), projectId: p.credential({ ...PROJECT_ID, required: false }) }));
+        },
+    },
+    export: {
+        reads: 'the Appwrite Server API (users with hashes, identities, MFA, teams and memberships)',
+        credentials: [ENDPOINT, PROJECT_ID, API_KEY, RECOVERY_CODES, SKIP_TEAMS],
+        limits: [
+            'TOTP secrets are encrypted at rest and Appwrite has no API to read them: those users enrol an authenticator app again. Recovery codes move with --set appwrite-recovery-codes=true.',
+            'Sessions are stored as hashes and cannot be exported: the appwrite bridge preset asks Appwrite about each live session once instead.',
+            'A SHA hash imported into Appwrite without a version is ambiguous (SHA3-512 on 1.x, SHA-256 on 2.x): the export picks by digest length and warns.',
+            'OAuth access and refresh tokens are not exported: users keep their link and re-consent when your app next calls the provider.',
+        ],
+        async run(p, writer, resume) {
+            const set = await (0, plugin_kit_1.vendorStep)('Appwrite', () => (0, appwrite_1.exportAppwrite)({
+                endpoint: endpointOf(p),
+                projectId: (0, plugin_kit_1.need)(p, PROJECT_ID),
+                apiKey: (0, plugin_kit_1.need)(p, API_KEY),
+                recoveryCodes: (0, project_files_1.truthyCredential)(p, RECOVERY_CODES),
+                skipTeams: (0, project_files_1.truthyCredential)(p, SKIP_TEAMS),
+                fetchImpl: p.fetch,
+                onProgress: (m) => p.say(`  reading ${m}`),
+            }));
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    bridge: {
+        preset: 'appwrite',
+        vars(p, t) {
+            const vars = { ...t?.bridge?.vars };
+            const endpoint = p.credential(ENDPOINT);
+            if (endpoint || !vars.endpoint_url)
+                vars.endpoint_url = endpointOf(p);
+            const project = p.credential({ ...PROJECT_ID, required: false });
+            if (project)
+                vars.project_id = project;
+            return vars;
+        },
+    },
+    lazy: {
+        preset: 'appwrite',
+        config(p, t) {
+            const config = { ...t?.lazy?.config };
+            const endpoint = p.credential(ENDPOINT);
+            if (endpoint || !config.endpoint)
+                config.endpoint = endpointOf(p);
+            const project = p.credential({ ...PROJECT_ID, required: false });
+            if (project)
+                config.project_id = project;
+            return config;
+        },
+    },
+    codemod: 'appwrite',
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/appwrite/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/appwrite/plugin.ts"],"names":[],"mappings":";;;AAAA,iDAAoE;AACpE,+DAAoE;AACpE,yCAAwC;AAExC,qDAAmF;AACnF,2DAAwE;AAExE;;;;;;;;GAQG;AAEH,MAAM,QAAQ,GAAmB,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,gFAAgF,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACrM,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,yBAAyB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACnJ,MAAM,OAAO,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,oDAAoD,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACnL,MAAM,cAAc,GAAmB,EAAE,IAAI,EAAE,2BAA2B,EAAE,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,mCAAmC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC1K,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,yBAAyB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACpJ,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,8CAA8C,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACvK,MAAM,YAAY,GAAmB,EAAE,IAAI,EAAE,yBAAyB,EAAE,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,uEAAuE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAExM,SAAS,UAAU,CAAC,CAAgB;IAClC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,yBAAc,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC/E,CAAC;AAEY,QAAA,cAAc,GAAoB;IAC7C,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,UAAU;IAClB,KAAK,EAAE,UAAU;IACjB,IAAI,EAAE,mcAAmc;IACzc,MAAM,EAAE;QACN,KAAK,EAAE,sHAAsH;QAC7H,WAAW,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACtF,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,IAAI,GAAG,IAAA,2BAAW,EAAC,CAAC,EAAE,WAAW,EAAE,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC,CAAC;YACpF,MAAM,WAAW,GAAG,IAAA,sBAAS,EAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;YACvD,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW;gBAAE,MAAM,IAAI,iBAAQ,CAAC,kLAAkL,CAAC,CAAC;YAClO,IAAI,OAA4C,CAAC;YACjD,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAA4B,CAAC;gBAC/D,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,IAAI,iBAAQ,CAAC,kGAAkG,CAAC,CAAC;gBACzH,CAAC;YACH,CAAC;YACD,OAAO,IAAA,uBAAU,EAAC,UAAU,EAAE,KAAK,IAAI,EAAE,CACvC,IAAA,yCAAuB,EAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAC1I,CAAC;QACJ,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,qFAAqF;QAC5F,WAAW,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,CAAC;QACxE,MAAM,EAAE;YACN,qLAAqL;YACrL,sIAAsI;YACtI,kJAAkJ;YAClJ,+HAA+H;SAChI;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,UAAU,EAAE,GAAG,EAAE,CAC5C,IAAA,yBAAc,EAAC;gBACb,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;gBACvB,SAAS,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,UAAU,CAAC;gBAC9B,MAAM,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,OAAO,CAAC;gBACxB,aAAa,EAAE,IAAA,gCAAgB,EAAC,CAAC,EAAE,cAAc,CAAC;gBAClD,SAAS,EAAE,IAAA,gCAAgB,EAAC,CAAC,EAAE,UAAU,CAAC;gBAC1C,SAAS,EAAE,CAAC,CAAC,KAAK;gBAClB,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;aAC3C,CAAC,CACH,CAAC;YACF,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,UAAU;QAClB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,GAA2B,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC5D,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACxC,IAAI,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY;gBAAE,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YACtE,MAAM,OAAO,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YACjE,IAAI,OAAO;gBAAE,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC;YACvC,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,UAAU;QAClB,MAAM,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,MAAM,GAA2B,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9D,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACxC,IAAI,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAAE,MAAM,CAAC,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAClE,MAAM,OAAO,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YACjE,IAAI,OAAO;gBAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC;YACzC,OAAO,MAAM,CAAC;QAChB,CAAC;KACF;IACD,OAAO,EAAE,UAAU;CACpB,CAAC"}

package/dist/migrate/auth0/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const auth0Plugin: MigrationPlugin;

package/dist/migrate/auth0/plugin.js

@@ -0,0 +1,126 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.auth0Plugin = void 0;
+const auth0_1 = require("../export/auth0");
+const auth0_config_1 = require("../export/auth0-config");
+const errors_1 = require("../../errors");
+const plugin_kit_1 = require("../export/plugin-kit");
+const vendor_http_1 = require("../export/vendor-http");
+/**
+ * `atlas migrate auth0` (also Okta Customer Identity Cloud) — the tenant's
+ * settings through the Management API, users through a users-export job (or
+ * an export file), the password hashes and MFA secrets from Auth0 support's
+ * encrypted export when the owner has it, the `auth0` bridge preset (the ID
+ * token in the app session, verified against the tenant's JWKS) and lazy
+ * migration through the password-realm grant for every other password.
+ */
+const DOMAIN = { flag: '--auth0-domain', env: 'AUTH0_DOMAIN', label: 'your Auth0 domain (tenant.us.auth0.com)', required: true };
+const MGMT_CLIENT_ID = { flag: '--auth0-mgmt-client-id', env: 'AUTH0_MGMT_CLIENT_ID', label: 'the client id of a machine-to-machine app authorized for the Management API', required: false };
+const MGMT_CLIENT_SECRET = { flag: '--auth0-mgmt-client-secret', env: 'AUTH0_MGMT_CLIENT_SECRET', label: 'that app\'s client secret', required: false, secret: true };
+const MGMT_TOKEN = { flag: '--auth0-mgmt-token', env: 'AUTH0_MGMT_TOKEN', label: 'a Management API token', required: false, secret: true };
+const CLIENT_ID = { flag: '--auth0-client-id', env: 'AUTH0_CLIENT_ID', label: 'your application\'s client id (the ID token audience)', required: false };
+const CLIENT_SECRET = { flag: '--auth0-client-secret', env: 'AUTH0_CLIENT_SECRET', label: 'your application\'s client secret (for a confidential application)', required: false, secret: true };
+const CONNECTION = { flag: '--auth0-connection', env: 'AUTH0_CONNECTION', label: 'the database connection', required: false };
+const USERS_FILE = { flag: '--auth0-users-file', env: 'AUTH0_USERS_FILE', label: 'a users export file (NDJSON or JSON)', required: false };
+const HASHES_FILE = { flag: '--auth0-hashes-file', env: 'AUTH0_HASHES_FILE', label: 'the decrypted password-hash export from Auth0 support', required: false };
+const RP_ID = { flag: '--rp-id', env: 'ATLAS_MIGRATE_RP_ID', label: 'the WebAuthn relying party id passkeys were registered for', required: false };
+function domainOf(p) {
+    return (0, plugin_kit_1.hostOf)((0, plugin_kit_1.need)(p, DOMAIN));
+}
+/** The Management API, with a token or client credentials (asked for on this machine, sent only to Auth0). */
+function managementHttp(p, domain) {
+    const token = p.credential(MGMT_TOKEN);
+    const clientId = p.credential(MGMT_CLIENT_ID);
+    const clientSecret = p.credential(MGMT_CLIENT_SECRET);
+    if (!token && !(clientId && clientSecret)) {
+        throw new errors_1.CliError('Auth0: pass a Management API token (--auth0-mgmt-token / AUTH0_MGMT_TOKEN), or the client id and secret of a machine-to-machine app authorized for it (AUTH0_MGMT_CLIENT_ID, AUTH0_MGMT_CLIENT_SECRET).');
+    }
+    let bearer = token;
+    return new vendor_http_1.VendorHttp({
+        vendor: 'Auth0',
+        baseUrl: `https://${domain}/api/v2`,
+        headers: async () => ({ authorization: `Bearer ${(bearer ??= await (0, auth0_1.managementToken)(domain, { domain, clientId, clientSecret }, p.fetch))}` }),
+        fetchImpl: p.fetch,
+    });
+}
+exports.auth0Plugin = {
+    vendor: 'auth0',
+    source: 'auth0',
+    label: 'Auth0',
+    help: 'Move an Auth0 (Okta Customer Identity Cloud) tenant: its connections, MFA, password policy, applications, APIs, roles and organizations as Atlas config; its users (export job), identities, organizations, members, roles and invitations, plus password hashes and MFA secrets from the encrypted export Auth0 support provides; a zero-logout bridge; lazy migration for every password you do not have; and the code. Management credentials stay on this machine.',
+    config: {
+        reads: 'your Auth0 tenant via the Management API',
+        credentials: [DOMAIN, MGMT_TOKEN, MGMT_CLIENT_ID, MGMT_CLIENT_SECRET],
+        async translate(p) {
+            const domain = domainOf(p);
+            const snap = await (0, plugin_kit_1.vendorStep)('Auth0', () => (0, auth0_config_1.fetchAuth0Config)(managementHttp(p, domain), domain));
+            return (0, auth0_config_1.translateAuth0Config)(snap);
+        },
+    },
+    export: {
+        reads: 'the Auth0 Management API (users-export job, organizations, roles) and the support hash export (--auth0-hashes-file)',
+        credentials: [DOMAIN, MGMT_TOKEN, MGMT_CLIENT_ID, MGMT_CLIENT_SECRET, USERS_FILE, HASHES_FILE, CONNECTION],
+        limits: [
+            'Password hashes and MFA secrets never come out of the Management API: Auth0 support exports them on request (paid plans, encrypted to your PGP key). Pass the decrypted file with --auth0-hashes-file; without it, passwords move by lazy migration.',
+            'Users-export jobs are not available on the Free plan: export from the dashboard (or the User Import / Export extension) and pass the file with --auth0-users-file.',
+            'Passkey private keys never leave the authenticator; with --authentication-methods the public credentials are exported and keep working when your Atlas domain matches the relying party (--rp-id).',
+            'Sessions are not exported: the auth0 bridge preset exchanges the ID token from the app session.',
+        ],
+        async run(p, writer, resume) {
+            const domain = domainOf(p);
+            const usersText = (0, plugin_kit_1.localFile)(p, USERS_FILE, 'text');
+            const token = p.credential(MGMT_TOKEN);
+            const clientId = p.credential(MGMT_CLIENT_ID);
+            const clientSecret = p.credential(MGMT_CLIENT_SECRET);
+            if (!usersText && !token && !(clientId && clientSecret)) {
+                throw new errors_1.CliError('Auth0: pass Management API credentials (AUTH0_MGMT_TOKEN, or AUTH0_MGMT_CLIENT_ID and AUTH0_MGMT_CLIENT_SECRET), or a users export file (--auth0-users-file).');
+            }
+            const set = await (0, plugin_kit_1.vendorStep)('Auth0', () => (0, auth0_1.exportAuth0)({
+                domain,
+                token,
+                clientId,
+                clientSecret,
+                usersText,
+                hashesText: (0, plugin_kit_1.localFile)(p, HASHES_FILE, 'text'),
+                connectionId: p.credential(CONNECTION),
+                authenticationMethods: (0, plugin_kit_1.flag)(p, 'authentication-methods'),
+                rpId: p.credential(RP_ID),
+                fetchImpl: p.fetch,
+                onProgress: (m) => p.say(`  reading ${m}`),
+            }));
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    bridge: {
+        preset: 'auth0',
+        vars(p, t) {
+            const vars = { ...t?.bridge?.vars };
+            const domain = p.credential({ ...DOMAIN, required: false });
+            if (domain)
+                vars.domain = (0, plugin_kit_1.hostOf)(domain);
+            const clientId = p.credential(CLIENT_ID);
+            if (clientId)
+                vars.client_id = clientId;
+            return vars;
+        },
+    },
+    lazy: {
+        preset: 'auth0',
+        config(p, t) {
+            const config = { ...t?.lazy?.config };
+            const domain = p.credential({ ...DOMAIN, required: false });
+            if (domain)
+                config.domain = (0, plugin_kit_1.hostOf)(domain);
+            const clientId = p.credential(CLIENT_ID);
+            if (clientId)
+                config.client_id = clientId;
+            const connection = p.credential(CONNECTION);
+            if (connection)
+                config.connection = connection;
+            return config;
+        },
+        secret: CLIENT_SECRET,
+    },
+    codemod: 'auth0',
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/auth0/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/auth0/plugin.ts"],"names":[],"mappings":";;;AAAA,2CAA+D;AAC/D,yDAAgF;AAChF,yCAAwC;AAExC,qDAAiG;AACjG,uDAAmD;AAEnD;;;;;;;GAOG;AAEH,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,yCAAyC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACjJ,MAAM,cAAc,GAAmB,EAAE,IAAI,EAAE,wBAAwB,EAAE,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,6EAA6E,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC9M,MAAM,kBAAkB,GAAmB,EAAE,IAAI,EAAE,4BAA4B,EAAE,GAAG,EAAE,0BAA0B,EAAE,KAAK,EAAE,2BAA2B,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACtL,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,wBAAwB,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC3J,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,uDAAuD,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACzK,MAAM,aAAa,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,oEAAoE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAChN,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,yBAAyB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC9I,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,sCAAsC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC3J,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,uDAAuD,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC/K,MAAM,KAAK,GAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,4DAA4D,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAEpK,SAAS,QAAQ,CAAC,CAAgB;IAChC,OAAO,IAAA,mBAAM,EAAC,IAAA,iBAAI,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,8GAA8G;AAC9G,SAAS,cAAc,CAAC,CAAgB,EAAE,MAAc;IACtD,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;IAC9C,MAAM,YAAY,GAAG,CAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ,IAAI,YAAY,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,iBAAQ,CAAC,yMAAyM,CAAC,CAAC;IAChO,CAAC;IACD,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,OAAO,IAAI,wBAAU,CAAC;QACpB,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,WAAW,MAAM,SAAS;QACnC,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,CAAC,MAAM,KAAK,MAAM,IAAA,uBAAe,EAAC,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAC7I,SAAS,EAAE,CAAC,CAAC,KAAK;KACnB,CAAC,CAAC;AACL,CAAC;AAEY,QAAA,WAAW,GAAoB;IAC1C,MAAM,EAAE,OAAO;IACf,MAAM,EAAE,OAAO;IACf,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,wcAAwc;IAC9c,MAAM,EAAE;QACN,KAAK,EAAE,0CAA0C;QACjD,WAAW,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,kBAAkB,CAAC;QACrE,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,IAAI,GAAG,MAAM,IAAA,uBAAU,EAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAA,+BAAgB,EAAC,cAAc,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YAClG,OAAO,IAAA,mCAAoB,EAAC,IAAI,CAAC,CAAC;QACpC,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,qHAAqH;QAC5H,WAAW,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,CAAC;QAC1G,MAAM,EAAE;YACN,sPAAsP;YACtP,oKAAoK;YACpK,oMAAoM;YACpM,iGAAiG;SAClG;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,SAAS,GAAG,IAAA,sBAAS,EAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;YACnD,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YACvC,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;YAC9C,MAAM,YAAY,GAAG,CAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;YACtD,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ,IAAI,YAAY,CAAC,EAAE,CAAC;gBACxD,MAAM,IAAI,iBAAQ,CAAC,+JAA+J,CAAC,CAAC;YACtL,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,OAAO,EAAE,GAAG,EAAE,CACzC,IAAA,mBAAW,EAAC;gBACV,MAAM;gBACN,KAAK;gBACL,QAAQ;gBACR,YAAY;gBACZ,SAAS;gBACT,UAAU,EAAE,IAAA,sBAAS,EAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC;gBAC7C,YAAY,EAAE,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;gBACtC,qBAAqB,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,wBAAwB,CAAC;gBACxD,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;gBACzB,SAAS,EAAE,CAAC,CAAC,KAAK;gBAClB,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;aAC3C,CAAC,CACH,CAAC;YACF,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,OAAO;QACf,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,GAA2B,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC5D,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5D,IAAI,MAAM;gBAAE,IAAI,CAAC,MAAM,GAAG,IAAA,mBAAM,EAAC,MAAM,CAAC,CAAC;YACzC,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,QAAQ;gBAAE,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;YACxC,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,OAAO;QACf,MAAM,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,MAAM,GAA2B,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9D,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5D,IAAI,MAAM;gBAAE,MAAM,CAAC,MAAM,GAAG,IAAA,mBAAM,EAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,QAAQ;gBAAE,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC;YAC1C,MAAM,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAC5C,IAAI,UAAU;gBAAE,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC;YAC/C,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,EAAE,aAAa;KACtB;IACD,OAAO,EAAE,OAAO;CACjB,CAAC"}

package/dist/migrate/authentik/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const authentikPlugin: MigrationPlugin;

package/dist/migrate/authentik/plugin.js

@@ -0,0 +1,135 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authentikPlugin = void 0;
+const node_path_1 = require("node:path");
+const errors_1 = require("../../errors");
+const authentik_1 = require("../export/authentik");
+const authentik_config_1 = require("../export/authentik-config");
+const tables_1 = require("../export/frameworks/tables");
+const plugin_kit_1 = require("../export/plugin-kit");
+/**
+ * `atlas migrate authentik` — a self-hosted authentik: its blueprint file (or
+ * the settings objects through the API) as Atlas config; users with their
+ * Django password digests (PBKDF2, bcrypt, Argon2, scrypt), social and SAML
+ * source links, groups and RBAC roles, API and app-password tokens, TOTP
+ * seeds, recovery codes, SMS / email factors and WebAuthn passkeys from a
+ * dump of authentik's own PostgreSQL tables made on this machine; the
+ * `authentik` bridge preset (an OAuth2 provider's token becomes an Atlas
+ * session); lazy migration through authentik's flow executor when only the API
+ * is available; and the code. Nothing here connects to the database.
+ */
+const DUMP = { flag: '--authentik-dump', env: 'AUTHENTIK_DUMP_DIR', label: 'a folder of authentik table dumps (authentik_core_user.csv, authentik_core_group.json, …)', required: false };
+const URL_ = { flag: '--authentik-url', env: 'AUTHENTIK_URL', label: 'the authentik URL (https://auth.example.com)', required: false };
+const TOKEN = { flag: '--authentik-token', env: 'AUTHENTIK_TOKEN', label: 'an authentik API token (Directory → Tokens, intent API)', required: false, secret: true };
+const BLUEPRINT = { flag: '--authentik-blueprint', env: 'AUTHENTIK_BLUEPRINT', label: 'a blueprint YAML file (ak export_blueprint)', required: false };
+const SUB_MODE = { flag: '--authentik-sub-mode', env: 'AUTHENTIK_SUB_MODE', label: `the provider's Subject mode (${authentik_1.AUTHENTIK_SUB_MODES.join(', ')}); default: the mode the providers in the dump use, else hashed_user_id`, required: false };
+const INSTALL_ID = { flag: '--authentik-install-id', env: 'AUTHENTIK_INSTALL_ID', label: 'the install id (SELECT id FROM authentik_install_id), when the dump lacks that table', required: false };
+const GROUPS_AS = { flag: '--authentik-groups-as', env: 'AUTHENTIK_GROUPS_AS', label: 'roles (default), organizations or skip: what authentik groups become', required: false };
+const RP_ID = { flag: '--rp-id', env: 'ATLAS_MIGRATE_RP_ID', label: 'the WebAuthn relying party id for passkeys registered before authentik stored one (your authentik host)', required: false };
+const TRUST_EMAILS = { flag: '--authentik-trust-emails', env: 'AUTHENTIK_TRUST_EMAILS', label: '"true" to treat every email address as verified (authentik has no verified flag)', required: false };
+const OAUTH_TOKENS = { flag: '--authentik-oauth-tokens', env: 'AUTHENTIK_OAUTH_TOKENS', label: '"include" to carry the stored upstream OAuth access tokens of social links', required: false };
+const ISSUER = { flag: '--authentik-issuer', env: 'AUTHENTIK_ISSUER', label: "the provider's issuer URL (https://auth.example.com/application/o/<application slug>)", required: false };
+const CLIENT_ID = { flag: '--authentik-client-id', env: 'AUTHENTIK_CLIENT_ID', label: "the OAuth2 provider's client id (the tokens' aud)", required: false };
+const FLOW_SLUG = { flag: '--authentik-flow-slug', env: 'AUTHENTIK_FLOW_SLUG', label: 'the authentication flow slug for lazy migration (default default-authentication-flow)', required: false };
+const LAZY_SUB_MODES = ['hashed_user_id', 'user_id', 'user_username', 'user_email'];
+function subMode(p) {
+    const raw = p.credential(SUB_MODE)?.trim().toLowerCase();
+    if (!raw)
+        return undefined;
+    if (!authentik_1.AUTHENTIK_SUB_MODES.includes(raw))
+        throw new errors_1.CliError(`authentik: --set authentik-sub-mode takes ${authentik_1.AUTHENTIK_SUB_MODES.join(', ')} (got ${raw}).`);
+    return raw;
+}
+const baseUrl = (p) => p.credential(URL_)?.trim().replace(/\/+$/, '');
+exports.authentikPlugin = {
+    vendor: 'authentik',
+    source: 'authentik',
+    label: 'authentik',
+    help: "Move authentik: a blueprint file (or the settings objects through the API) as Atlas config; users with their password digests, social and SAML identities, groups and roles, tokens, authenticator apps, recovery codes and passkeys from a dump of authentik's own tables made with psql; a zero-logout bridge for an OAuth2 provider's tokens; lazy migration through authentik's flows when you only have the API; and the code. Database access stays on this machine.",
+    config: {
+        reads: 'a blueprint YAML file, or the settings objects through the authentik API',
+        credentials: [BLUEPRINT, URL_, TOKEN],
+        async translate(p) {
+            const url = baseUrl(p);
+            const file = p.credential(BLUEPRINT);
+            if (file) {
+                const text = (0, plugin_kit_1.localFile)(p, BLUEPRINT, 'text');
+                return (0, authentik_config_1.translateAuthentikConfig)(await (0, plugin_kit_1.vendorStep)('authentik', async () => (0, authentik_config_1.snapshotFromBlueprint)(text, file, url)));
+            }
+            const token = p.credential(TOKEN);
+            if (url && token)
+                return (0, authentik_config_1.translateAuthentikConfig)(await (0, plugin_kit_1.vendorStep)('authentik', () => (0, authentik_config_1.fetchAuthentikConfig)({ baseUrl: url, token, fetchImpl: p.fetch })));
+            throw new errors_1.CliError('authentik: pass a blueprint file (--set authentik-blueprint=<file>, from `ak export_blueprint`), or the authentik URL and an API token to read the settings through the API.');
+        },
+    },
+    export: {
+        reads: "a dump of authentik's tables (psql \\copy of authentik_core_user, groups, tokens, source links, authenticator devices …) or the authentik API",
+        credentials: [DUMP, URL_, TOKEN, SUB_MODE, INSTALL_ID, GROUPS_AS, RP_ID, TRUST_EMAILS, OAUTH_TOKENS],
+        limits: [
+            'The API never returns password hashes, TOTP seeds, recovery codes or WebAuthn public keys: dump the database tables to move them. The API export has users, groups, roles, source links and API token keys only; passwords then move by lazy migration and authenticator users enrol again.',
+            'authentik has no verified-email flag: addresses are verified only when the user attribute email_verified is true, or with --set authentik-trust-emails=true.',
+            'Users are keyed by the `sub` your providers hand out (the Subject mode; hashed_user_id by default, which needs the install id): the export reads it from the dump, and warns when providers disagree.',
+            'Service accounts, outpost accounts and recovery or verification tokens do not move; LDAP, Kerberos and other directory source links stay with their directory.',
+            'Passkeys only work on the domain they were registered for; devices registered before authentik stored an RP id need --set rp-id=<your authentik host>.',
+        ],
+        async run(p, writer, resume) {
+            const dump = p.credential(DUMP);
+            const url = baseUrl(p);
+            const token = dump ? undefined : p.credential(TOKEN);
+            if (!dump && !(url && token)) {
+                throw new errors_1.CliError('authentik: pass a folder of table dumps (--set authentik-dump=<folder>), or the authentik URL and an API token for an export without password hashes.');
+            }
+            const groups = p.credential(GROUPS_AS)?.trim().toLowerCase();
+            if (groups && !['roles', 'organizations', 'skip'].includes(groups))
+                throw new errors_1.CliError(`authentik: --set authentik-groups-as takes roles, organizations or skip (got ${groups}).`);
+            const set = await (0, plugin_kit_1.vendorStep)('authentik', () => (0, authentik_1.exportAuthentik)({
+                tables: dump ? (0, tables_1.readDumpDir)((0, node_path_1.resolve)(dump)) : undefined,
+                baseUrl: url,
+                token,
+                subMode: subMode(p),
+                installId: p.credential(INSTALL_ID),
+                groupsAs: groups,
+                rpId: p.credential(RP_ID),
+                trustEmails: p.credential(TRUST_EMAILS)?.toLowerCase() === 'true',
+                oauthTokens: p.credential(OAUTH_TOKENS) === 'include',
+                fetchImpl: p.fetch,
+                onProgress: (m) => p.say(`  reading ${m}`),
+            }));
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    bridge: {
+        preset: 'authentik',
+        vars(p, t) {
+            const vars = { ...t?.bridge?.vars };
+            const issuer = p.credential(ISSUER);
+            if (issuer)
+                vars.issuer = issuer.trim().replace(/\/+$/, '');
+            const clientId = p.credential(CLIENT_ID);
+            if (clientId)
+                vars.client_id = clientId.trim();
+            return vars;
+        },
+    },
+    lazy: {
+        preset: 'authentik',
+        config(p, t) {
+            const config = { ...t?.lazy?.config };
+            const url = baseUrl(p);
+            if (url)
+                config.base_url = url;
+            const flow = p.credential(FLOW_SLUG);
+            if (flow)
+                config.flow_slug = flow.trim();
+            const mode = subMode(p);
+            if (mode) {
+                if (!LAZY_SUB_MODES.includes(mode))
+                    throw new errors_1.CliError(`authentik: lazy migration reads the user from a session, which has no ${mode}: use ${LAZY_SUB_MODES.join(', ')}, or move users with the database export.`);
+                config.sub_mode = mode;
+            }
+            return config;
+        },
+    },
+    codemod: 'authentik',
+};
+//# sourceMappingURL=plugin.js.map