@atlasauth/cli 0.11.0 → 0.13.0

package/dist/migrate/keycloak/plugin.js

@@ -0,0 +1,148 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.keycloakPlugin = void 0;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const errors_1 = require("../../errors");
+const keycloak_1 = require("../export/keycloak");
+const keycloak_config_1 = require("../export/keycloak-config");
+const plugin_kit_1 = require("../export/plugin-kit");
+/**
+ * `atlas migrate keycloak` — a Keycloak (or Red Hat build of Keycloak) realm:
+ * its settings as Atlas config (Admin API or a realm export); users with their
+ * federated identities, roles, groups, organizations, SSO brokers, TOTP,
+ * recovery codes and passkeys from a REALM EXPORT (`kc.sh export`, the only
+ * path that carries password hashes and OTP secrets) or the Admin API (no
+ * secrets); the `keycloak` bridge preset for access / ID tokens; lazy migration
+ * through the password grant; and the code. Your admin credentials stay on this machine.
+ */
+const URL_SPEC = { flag: '--keycloak-url', env: 'KEYCLOAK_URL', label: 'your Keycloak base URL (https://sso.example.com; with /auth on Keycloak 16 and older)', required: false };
+const REALM = { flag: '--keycloak-realm', env: 'KEYCLOAK_REALM', label: 'the realm to move', required: false };
+const CLIENT_ID = { flag: '--keycloak-client-id', env: 'KEYCLOAK_CLIENT_ID', label: 'an admin client (service account with view-users, view-realm, query-users, view-clients) or the client of an admin user (default admin-cli)', required: false };
+const CLIENT_SECRET = { flag: '--keycloak-client-secret', env: 'KEYCLOAK_CLIENT_SECRET', label: 'that client\'s secret', required: false, secret: true };
+const ADMIN_USER = { flag: '--keycloak-admin-user', env: 'KEYCLOAK_ADMIN_USER', label: 'an admin user (alternative to a client)', required: false };
+const ADMIN_PASSWORD = { flag: '--keycloak-admin-password', env: 'KEYCLOAK_ADMIN_PASSWORD', label: 'that admin user\'s password', required: false, secret: true };
+const AUTH_REALM = { flag: '--keycloak-auth-realm', env: 'KEYCLOAK_AUTH_REALM', label: 'the realm the admin credential lives in (default master for a user, the realm for a client)', required: false };
+const EXPORT_FILE = { flag: '--keycloak-export', env: 'KEYCLOAK_EXPORT', label: 'a realm export: the file or folder `kc.sh export` wrote', required: false };
+const RP_ID = { flag: '--keycloak-rp-id', env: 'KEYCLOAK_RP_ID', label: 'the WebAuthn relying-party id when the realm leaves it empty', required: false };
+const GROUPS_AS = { flag: '--groups-as', env: 'ATLAS_MIGRATE_GROUPS_AS', label: 'how groups move: roles, organizations or skip', required: false };
+const LAZY_CLIENT = { flag: '--keycloak-lazy-client-id', env: 'KEYCLOAK_LAZY_CLIENT_ID', label: 'a client with Direct access grants enabled (lazy migration)', required: false };
+function groupsAs(p) {
+    const raw = p.credential(GROUPS_AS) ?? 'roles';
+    if (raw !== 'roles' && raw !== 'organizations' && raw !== 'skip')
+        throw new errors_1.CliError(`Keycloak: --groups-as must be roles, organizations or skip (got ${raw}).`);
+    return raw;
+}
+function baseUrl(p, required) {
+    const raw = p.credential({ ...URL_SPEC, required });
+    return raw ? (0, keycloak_1.keycloakBase)(raw) : undefined;
+}
+function adminApi(p, realm) {
+    const url = baseUrl(p, true);
+    const username = p.credential(ADMIN_USER);
+    const password = p.credential(ADMIN_PASSWORD);
+    const clientId = p.credential(CLIENT_ID);
+    const clientSecret = p.credential(CLIENT_SECRET);
+    if (!(username && password) && !(clientId && clientSecret)) {
+        throw new errors_1.CliError('Keycloak: pass an admin client (--set keycloak-client-id=… and KEYCLOAK_CLIENT_SECRET) or an admin user (--set keycloak-admin-user=… and KEYCLOAK_ADMIN_PASSWORD).');
+    }
+    return { baseUrl: url, realm, clientId, clientSecret, username, password, authRealm: p.credential(AUTH_REALM), fetchImpl: p.fetch };
+}
+/** The JSON documents of a realm export: one file, or every .json in a folder. */
+function readExportDocs(p, path) {
+    const abs = (0, node_path_1.resolve)(path);
+    let files;
+    try {
+        files = (0, node_fs_1.statSync)(abs).isDirectory() ? (0, node_fs_1.readdirSync)(abs).filter((f) => f.endsWith('.json')).sort().map((f) => (0, node_path_1.join)(abs, f)) : [abs];
+    }
+    catch (err) {
+        throw new errors_1.CliError(`Keycloak: could not read the realm export at ${path}: ${err.message}`);
+    }
+    if (!files.length)
+        throw new errors_1.CliError(`Keycloak: no .json files in ${path}.`);
+    return files.map((f) => {
+        try {
+            return JSON.parse(p.ctx.readFile(f));
+        }
+        catch (err) {
+            throw new errors_1.CliError(`Keycloak: ${f} is not valid JSON: ${err.message}`);
+        }
+    });
+}
+exports.keycloakPlugin = {
+    vendor: 'keycloak',
+    source: 'keycloak',
+    label: 'Keycloak',
+    help: 'Move a Keycloak realm: its settings (password policy, sessions, OTP and WebAuthn, brokers, clients\' redirect URIs, roles) as Atlas config; users with identities, roles, groups or organizations, SAML and OIDC brokers as SSO connections, and, from a realm export, password hashes (PBKDF2, Argon2), TOTP secrets, recovery codes and passkeys; a zero-logout bridge on your realm\'s tokens; lazy migration through the password grant; and the code. Admin credentials stay on this machine.',
+    config: {
+        reads: 'your realm via the Admin REST API, or a realm export',
+        credentials: [URL_SPEC, REALM, CLIENT_ID, CLIENT_SECRET, ADMIN_USER, ADMIN_PASSWORD, AUTH_REALM, EXPORT_FILE],
+        async translate(p) {
+            const file = p.credential(EXPORT_FILE);
+            if (file) {
+                const snap = (0, keycloak_1.readKeycloakExport)(readExportDocs(p, file), p.credential(REALM));
+                return (0, keycloak_config_1.translateKeycloakConfig)(snap.realm, { groupsAs: groupsAs(p), baseUrl: baseUrl(p, false) });
+            }
+            const realm = p.credential({ ...REALM, required: true });
+            const http = (0, keycloak_1.keycloakAdminHttp)(adminApi(p, realm));
+            const doc = await (0, plugin_kit_1.vendorStep)('Keycloak', () => (0, keycloak_config_1.fetchKeycloakConfig)(http, realm, baseUrl(p, true)));
+            return (0, keycloak_config_1.translateKeycloakConfig)(doc, { groupsAs: groupsAs(p), baseUrl: baseUrl(p, true) });
+        },
+    },
+    export: {
+        reads: 'a realm export (kc.sh export) or the Keycloak Admin REST API',
+        credentials: [EXPORT_FILE, URL_SPEC, REALM, CLIENT_ID, CLIENT_SECRET, ADMIN_USER, ADMIN_PASSWORD, AUTH_REALM, RP_ID],
+        limits: [
+            'Only a realm export carries password hashes (PBKDF2-SHA1/256/512, Argon2), OTP secrets and recovery-code hashes: run `kc.sh export --realm <realm> --file realm.json --users realm_file` (or `--dir`) and pass it with --set keycloak-export=<path>. The Admin API strips every secret.',
+            'With the Admin API alone, passwords move by lazy migration (the keycloak preset) and authenticator-app users enrol again; WebAuthn public keys DO come back.',
+            'Users of an LDAP / Kerberos user-storage provider have no password in Keycloak: lazy migration lets Keycloak (and the directory) verify them. Users of a provider without local import are not exported.',
+            'Identity-provider and client secrets are masked by the Admin API (a realm export keeps them unless they live in a vault): enter them on the SSO connection.',
+            'Live sessions are not exportable: the bridge exchanges Keycloak access and ID tokens for Atlas sessions.',
+            'Composite roles import as plain roles; fine-grained authorization services are not migrated.',
+        ],
+        async run(p, writer, resume) {
+            const file = p.credential(EXPORT_FILE);
+            const realm = p.credential(REALM);
+            const common = { realm, groupsAs: groupsAs(p), rpId: p.credential(RP_ID), onProgress: (m) => p.say(`  reading ${m}`) };
+            if (!file && !(baseUrl(p, false) && realm)) {
+                throw new errors_1.CliError('Keycloak: pass a realm export (--set keycloak-export=<path>), or the base URL and realm with an admin credential (--set keycloak-url=… --set keycloak-realm=…).');
+            }
+            const set = await (0, plugin_kit_1.vendorStep)('Keycloak', async () => file
+                ? (0, keycloak_1.exportKeycloak)({ ...common, exportDocs: readExportDocs(p, file), api: baseUrl(p, false) ? { baseUrl: baseUrl(p, false), clientId: undefined } : undefined })
+                : (0, keycloak_1.exportKeycloak)({ ...common, api: adminApi(p, realm) }));
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    bridge: {
+        preset: 'keycloak',
+        vars(p, t) {
+            const vars = { ...t?.bridge?.vars };
+            const url = baseUrl(p, false);
+            if (url)
+                vars.base_url = url;
+            const realm = p.credential(REALM);
+            if (realm)
+                vars.realm = realm;
+            return vars;
+        },
+    },
+    lazy: {
+        preset: 'keycloak',
+        config(p, t) {
+            const config = { ...t?.lazy?.config };
+            const url = baseUrl(p, false);
+            if (url)
+                config.base_url = url;
+            const realm = p.credential(REALM);
+            if (realm)
+                config.realm = realm;
+            const client = p.credential(LAZY_CLIENT) ?? p.credential(CLIENT_ID);
+            if (client)
+                config.client_id = client;
+            return config;
+        },
+        secret: { flag: '--keycloak-lazy-client-secret', env: 'KEYCLOAK_LAZY_CLIENT_SECRET', label: 'the secret of that client (confidential clients only)', required: false, secret: true },
+    },
+    codemod: 'keycloak',
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/keycloak/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/keycloak/plugin.ts"],"names":[],"mappings":";;;AAAA,qCAAgD;AAChD,yCAA0C;AAC1C,yCAAwC;AACxC,iDAAyG;AACzG,+DAAyF;AACzF,qDAAkE;AAGlE;;;;;;;;GAQG;AAEH,MAAM,QAAQ,GAAmB,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,uFAAuF,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAClM,MAAM,KAAK,GAAmB,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC/H,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,6IAA6I,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACrQ,MAAM,aAAa,GAAmB,EAAE,IAAI,EAAE,0BAA0B,EAAE,GAAG,EAAE,wBAAwB,EAAE,KAAK,EAAE,uBAAuB,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACzK,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,yCAAyC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACpK,MAAM,cAAc,GAAmB,EAAE,IAAI,EAAE,2BAA2B,EAAE,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,6BAA6B,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAClL,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,6FAA6F,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACxN,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,yDAAyD,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC7K,MAAM,KAAK,GAAmB,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,8DAA8D,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC1K,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,+CAA+C,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACnK,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,2BAA2B,EAAE,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,6DAA6D,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAEjM,SAAS,QAAQ,CAAC,CAAgB;IAChC,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC;IAC/C,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,eAAe,IAAI,GAAG,KAAK,MAAM;QAAE,MAAM,IAAI,iBAAQ,CAAC,mEAAmE,GAAG,IAAI,CAAC,CAAC;IACjK,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,OAAO,CAAC,CAAgB,EAAE,QAAiB;IAClD,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpD,OAAO,GAAG,CAAC,CAAC,CAAC,IAAA,uBAAY,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7C,CAAC;AAED,SAAS,QAAQ,CAAC,CAAgB,EAAE,KAAa;IAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,EAAE,IAAI,CAAE,CAAC;IAC9B,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,YAAY,GAAG,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IACjD,IAAI,CAAC,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,YAAY,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,iBAAQ,CAAC,oKAAoK,CAAC,CAAC;IAC3L,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;AACtI,CAAC;AAED,kFAAkF;AAClF,SAAS,cAAc,CAAC,CAAgB,EAAE,IAAY;IACpD,MAAM,GAAG,GAAG,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,IAAA,kBAAQ,EAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAA,qBAAW,EAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACpI,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,iBAAQ,CAAC,gDAAgD,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,iBAAQ,CAAC,+BAA+B,IAAI,GAAG,CAAC,CAAC;IAC9E,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAY,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,iBAAQ,CAAC,aAAa,CAAC,uBAAwB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAEY,QAAA,cAAc,GAAoB;IAC7C,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,UAAU;IAClB,KAAK,EAAE,UAAU;IACjB,IAAI,EAAE,oeAAoe;IAC1e,MAAM,EAAE;QACN,KAAK,EAAE,sDAAsD;QAC7D,WAAW,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,CAAC;QAC7G,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YACvC,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,IAAI,GAAG,IAAA,6BAAkB,EAAC,cAAc,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC9E,OAAO,IAAA,yCAAuB,EAAC,IAAI,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;YACpG,CAAC;YACD,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAE,CAAC;YAC1D,MAAM,IAAI,GAAG,IAAA,4BAAiB,EAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;YACnD,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,UAAU,EAAE,GAAG,EAAE,CAAC,IAAA,qCAAmB,EAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YACnG,OAAO,IAAA,yCAAuB,EAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5F,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,8DAA8D;QACrE,WAAW,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,KAAK,CAAC;QACpH,MAAM,EAAE;YACN,yRAAyR;YACzR,8JAA8J;YAC9J,0MAA0M;YAC1M,6JAA6J;YAC7J,0GAA0G;YAC1G,8FAA8F;SAC/F;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YACvC,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAClC,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC;YAC/H,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBAC3C,MAAM,IAAI,iBAAQ,CAAC,iKAAiK,CAAC,CAAC;YACxL,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,UAAU,EAAE,KAAK,IAAI,EAAE,CAClD,IAAI;gBACF,CAAC,CAAC,IAAA,yBAAc,EAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,CAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;gBAC/J,CAAC,CAAC,IAAA,yBAAc,EAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAM,CAAC,EAAE,CAAC,CAC5D,CAAC;YACF,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,UAAU;QAClB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,GAA2B,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAC9B,IAAI,GAAG;gBAAE,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC;YAC7B,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAClC,IAAI,KAAK;gBAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,UAAU;QAClB,MAAM,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,MAAM,GAA2B,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9D,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAC9B,IAAI,GAAG;gBAAE,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC;YAC/B,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAClC,IAAI,KAAK;gBAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;YAChC,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACpE,IAAI,MAAM;gBAAE,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC;YACtC,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,EAAE,EAAE,IAAI,EAAE,+BAA+B,EAAE,GAAG,EAAE,6BAA6B,EAAE,KAAK,EAAE,uDAAuD,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE;KACrL;IACD,OAAO,EAAE,UAAU;CACpB,CAAC"}

package/dist/migrate/kinde/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const kindePlugin: MigrationPlugin;

package/dist/migrate/kinde/plugin.js

@@ -0,0 +1,105 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.kindePlugin = void 0;
+const kinde_1 = require("../export/kinde");
+const kinde_descope_config_1 = require("../export/kinde-descope-config");
+const errors_1 = require("../../errors");
+const plugin_kit_1 = require("../export/plugin-kit");
+const vendor_http_1 = require("../export/vendor-http");
+/**
+ * `atlas migrate kinde` — Kinde's "All data" export (Settings → Business →
+ * Export data: an AES-256-CTR encrypted zip holding users.ndjson with bcrypt
+ * hashes and organizations.ndjson; the Key and IV are shown at download),
+ * merged with what the Management API adds (identities, organizations,
+ * members, roles, permissions, invitations). Kinde has no password grant, so
+ * there is no lazy-migration preset: passwords move with the export. The
+ * `kinde` bridge preset verifies Kinde's access and ID tokens against the
+ * business's JWKS.
+ */
+const DOMAIN = { flag: '--kinde-domain', env: 'KINDE_ISSUER_URL', label: 'your Kinde domain (https://example.kinde.com)', required: false };
+const CLIENT_ID = { flag: '--kinde-client-id', env: 'KINDE_M2M_CLIENT_ID', label: 'the client id of a machine-to-machine app authorized for the Kinde Management API', required: false };
+const CLIENT_SECRET = { flag: '--kinde-client-secret', env: 'KINDE_M2M_CLIENT_SECRET', label: 'that app\'s client secret', required: false, secret: true };
+const EXPORT_FILE = { flag: '--kinde-export', env: 'KINDE_EXPORT_FILE', label: 'the Kinde data export (.dat, or the decrypted .zip)', required: false };
+const EXPORT_KEY = { flag: '--kinde-export-key', env: 'KINDE_EXPORT_KEY', label: 'the Key Kinde showed with the export (hex)', required: false, secret: true };
+const EXPORT_IV = { flag: '--kinde-export-iv', env: 'KINDE_EXPORT_IV', label: 'the IV Kinde showed with the export (hex)', required: false };
+function domainOf(p) {
+    const raw = p.credential(DOMAIN) ?? p.ctx.env.KINDE_DOMAIN?.trim();
+    return raw ? (0, plugin_kit_1.hostOf)(raw) : undefined;
+}
+exports.kindePlugin = {
+    vendor: 'kinde',
+    source: 'kinde',
+    label: 'Kinde',
+    help: 'Move a Kinde business: applications, connections, roles, permissions and APIs as Atlas config; users with their bcrypt password hashes from Kinde\'s encrypted data export, plus organizations, members and roles from the Management API (social accounts relink by verified email); a zero-logout bridge for Kinde tokens; and the code. The export key and API credentials stay on this machine.',
+    config: {
+        reads: 'your Kinde business via the Management API (applications, connections, roles, permissions, APIs)',
+        credentials: [DOMAIN, CLIENT_ID, CLIENT_SECRET],
+        async translate(p) {
+            const domain = domainOf(p);
+            if (!domain)
+                throw new errors_1.CliError('Kinde: your Kinde domain is needed (--kinde-domain or KINDE_ISSUER_URL).');
+            const clientId = (0, plugin_kit_1.need)(p, CLIENT_ID);
+            const clientSecret = (0, plugin_kit_1.need)(p, CLIENT_SECRET);
+            const base = `https://${domain}`;
+            let token;
+            const http = new vendor_http_1.VendorHttp({
+                vendor: 'Kinde',
+                baseUrl: `${base}/api/v1`,
+                headers: async () => ({ authorization: `Bearer ${(token ??= await (0, kinde_1.m2mToken)(base, { clientId, clientSecret, fetchImpl: p.fetch }))}` }),
+                fetchImpl: p.fetch,
+            });
+            const snap = await (0, plugin_kit_1.vendorStep)('Kinde', () => (0, kinde_descope_config_1.fetchKindeConfig)(http, domain));
+            return (0, kinde_descope_config_1.translateKindeConfig)(snap);
+        },
+    },
+    export: {
+        reads: 'the Kinde data export (--kinde-export with its Key and IV) and/or the Kinde Management API',
+        credentials: [DOMAIN, CLIENT_ID, CLIENT_SECRET, EXPORT_FILE, EXPORT_KEY, EXPORT_IV],
+        limits: [
+            'Password hashes only come from the "All data" export (Settings → Business → Export data), which the business owner approves; Kinde has no password grant, so without it users set a new password (or sign in with a code / social login).',
+            'MFA secrets and passkeys are not exportable: users enrol again.',
+            'Sessions are not exported: Kinde tokens are JWTs, exchanged by the kinde bridge preset.',
+        ],
+        async run(p, writer, resume) {
+            const file = (0, plugin_kit_1.localFile)(p, EXPORT_FILE, 'bytes');
+            const domain = domainOf(p);
+            const clientId = p.credential(CLIENT_ID);
+            const clientSecret = p.credential(CLIENT_SECRET);
+            if (!file && !(domain && clientId && clientSecret)) {
+                throw new errors_1.CliError('Kinde: pass the data export (--kinde-export with --kinde-export-key and --kinde-export-iv), Management API credentials (KINDE_ISSUER_URL, KINDE_M2M_CLIENT_ID, KINDE_M2M_CLIENT_SECRET), or both.');
+            }
+            let encryptedExport;
+            let zip;
+            if (file) {
+                // A zip (already decrypted) starts with PK\x03\x04; anything else is the encrypted .dat.
+                if (file.length >= 4 && file.readUInt32LE(0) === 0x04034b50)
+                    zip = file;
+                else
+                    encryptedExport = { data: file, key: (0, plugin_kit_1.need)(p, EXPORT_KEY), iv: (0, plugin_kit_1.need)(p, EXPORT_IV) };
+            }
+            const set = await (0, plugin_kit_1.vendorStep)('Kinde', () => (0, kinde_1.exportKinde)({
+                domain,
+                clientId,
+                clientSecret,
+                encryptedExport,
+                zip,
+                includeDefaultOrganization: (0, plugin_kit_1.flag)(p, 'kinde-include-default-org'),
+                fetchImpl: p.fetch,
+                onProgress: (m) => p.say(`  reading ${m}`),
+            }));
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    bridge: {
+        preset: 'kinde',
+        vars(p, t) {
+            const domain = domainOf(p) ?? t?.bridge?.vars.domain;
+            const vars = {};
+            if (domain)
+                vars.domain = domain;
+            return vars;
+        },
+    },
+    codemod: 'kinde',
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/kinde/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/kinde/plugin.ts"],"names":[],"mappings":";;;AAAA,2CAAwD;AACxD,yEAAwF;AACxF,yCAAwC;AAExC,qDAAiG;AACjG,uDAAmD;AAEnD;;;;;;;;;GASG;AAEH,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,+CAA+C,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC5J,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,mFAAmF,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACzM,MAAM,aAAa,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,2BAA2B,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC3K,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,qDAAqD,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACxK,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,4CAA4C,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC/K,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,2CAA2C,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAE7J,SAAS,QAAQ,CAAC,CAAgB;IAChC,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;IACnE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAA,mBAAM,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACvC,CAAC;AAEY,QAAA,WAAW,GAAoB;IAC1C,MAAM,EAAE,OAAO;IACf,MAAM,EAAE,OAAO;IACf,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,qYAAqY;IAC3Y,MAAM,EAAE;QACN,KAAK,EAAE,kGAAkG;QACzG,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,aAAa,CAAC;QAC/C,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,iBAAQ,CAAC,0EAA0E,CAAC,CAAC;YAC5G,MAAM,QAAQ,GAAG,IAAA,iBAAI,EAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YACpC,MAAM,YAAY,GAAG,IAAA,iBAAI,EAAC,CAAC,EAAE,aAAa,CAAC,CAAC;YAC5C,MAAM,IAAI,GAAG,WAAW,MAAM,EAAE,CAAC;YACjC,IAAI,KAAyB,CAAC;YAC9B,MAAM,IAAI,GAAG,IAAI,wBAAU,CAAC;gBAC1B,MAAM,EAAE,OAAO;gBACf,OAAO,EAAE,GAAG,IAAI,SAAS;gBACzB,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,CAAC,KAAK,KAAK,MAAM,IAAA,gBAAQ,EAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;gBACtI,SAAS,EAAE,CAAC,CAAC,KAAK;aACnB,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAA,uBAAU,EAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAA,uCAAgB,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YAC7E,OAAO,IAAA,2CAAoB,EAAC,IAAI,CAAC,CAAC;QACpC,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,4FAA4F;QACnG,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,CAAC;QACnF,MAAM,EAAE;YACN,2OAA2O;YAC3O,iEAAiE;YACjE,yFAAyF;SAC1F;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,IAAI,GAAG,IAAA,sBAAS,EAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;YAChD,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACzC,MAAM,YAAY,GAAG,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;YACjD,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,QAAQ,IAAI,YAAY,CAAC,EAAE,CAAC;gBACnD,MAAM,IAAI,iBAAQ,CAAC,mMAAmM,CAAC,CAAC;YAC1N,CAAC;YACD,IAAI,eAAsE,CAAC;YAC3E,IAAI,GAAuB,CAAC;YAC5B,IAAI,IAAI,EAAE,CAAC;gBACT,yFAAyF;gBACzF,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,UAAU;oBAAE,GAAG,GAAG,IAAI,CAAC;;oBACnE,eAAe,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;YAC1F,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,OAAO,EAAE,GAAG,EAAE,CACzC,IAAA,mBAAW,EAAC;gBACV,MAAM;gBACN,QAAQ;gBACR,YAAY;gBACZ,eAAe;gBACf,GAAG;gBACH,0BAA0B,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,2BAA2B,CAAC;gBAChE,SAAS,EAAE,CAAC,CAAC,KAAK;gBAClB,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;aAC3C,CAAC,CACH,CAAC;YACF,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,OAAO;QACf,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;YACrD,MAAM,IAAI,GAA2B,EAAE,CAAC;YACxC,IAAI,MAAM;gBAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;YACjC,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD,OAAO,EAAE,OAAO;CACjB,CAAC"}

package/dist/migrate/ldap/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const ldapPlugin: MigrationPlugin;

package/dist/migrate/ldap/plugin.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ldapPlugin = void 0;
+const node_path_1 = require("node:path");
+const args_1 = require("../../args");
+const errors_1 = require("../../errors");
+const ldap_1 = require("../export/ldap");
+const plugin_kit_1 = require("../export/plugin-kit");
+/**
+ * `atlas migrate ldap export --file dir.ldif` — an LDAP directory (OpenLDAP,
+ * 389 DS, PingDirectory, Oracle/Sun DS, Active Directory) from an LDIF export
+ * made with the directory's own tools. Users keep a password hash Atlas can
+ * verify; the rest move by lazy migration (the `ldap` preset binds to the
+ * directory over ldaps:// on the user's first sign-in).
+ */
+const GROUPS = { flag: 'ldap-groups', env: 'LDAP_GROUPS', label: 'what groups become: roles (default), organizations or none', required: false };
+const ID_ATTRIBUTE = { flag: 'ldap-id-attribute', env: 'LDAP_ID_ATTRIBUTE', label: 'the attribute used as the user id (entryUUID, nsUniqueId, objectGUID …)', required: false };
+const URL_SPEC = { flag: 'ldap-url', env: 'LDAP_URL', label: 'the directory URL for lazy migration (ldaps://ldap.example.com:636)', required: false };
+const BIND_DN = { flag: 'ldap-bind-dn', env: 'LDAP_BIND_DN', label: 'the service account DN for lazy migration', required: false };
+const BASE_DN = { flag: 'ldap-base-dn', env: 'LDAP_BASE_DN', label: 'the search base for lazy migration', required: false };
+const FILTER = { flag: 'ldap-user-filter', env: 'LDAP_USER_FILTER', label: 'the user search filter with {{username}}', required: false };
+const TRUST = { flag: 'ldap-trust-emails', env: 'LDAP_TRUST_EMAILS', label: 'mark directory addresses verified (true or false)', required: false };
+function file(p) {
+    return (0, args_1.str)(p.args.values, 'file') ?? p.credential({ flag: 'file', env: 'ATLAS_MIGRATE_FILE', label: 'the LDIF file (--file)', required: true });
+}
+exports.ldapPlugin = {
+    vendor: 'ldap',
+    source: 'ldap',
+    label: 'LDAP / Active Directory',
+    help: 'Move a directory: users (mail, uid, names, phones, disabled and locked state, creation and last login), groups as roles or organizations, and every userPassword hash Atlas verifies ({SSHA}, {SMD5}, {PBKDF2-*}, {CRYPT}$6$…, bcrypt, Argon2, …). Export the directory as LDIF first (slapcat, ldifde, export-ldif, dsctl db2ldif); the file is read on this machine. Passwords Atlas cannot verify (Active Directory, DES crypt, pass-through) move by lazy migration against your directory over ldaps://.',
+    export: {
+        reads: 'a local LDIF export of the directory (--file)',
+        credentials: [GROUPS, ID_ATTRIBUTE, TRUST],
+        limits: [
+            'Active Directory never exports password hashes (unicodePwd is write-only): configure lazy migration (preset ldap) so each user moves on their first sign-in.',
+            'Traditional DES {CRYPT} and pass-through schemes ({SASL}) cannot be verified by Atlas: those users move by lazy migration.',
+            'Directory addresses were set by administrators, not confirmed by the users: they import unverified unless --set ldap-trust-emails=true.',
+        ],
+        async run(p, writer, resume) {
+            const path = (0, node_path_1.resolve)(file(p));
+            const { entries, problems } = (0, ldap_1.parseLdif)(p.ctx.readFile(path));
+            if (!entries.length)
+                throw new errors_1.CliError(`No entries found in ${path}: is it an LDIF export?`);
+            const mode = p.credential(GROUPS) ?? 'roles';
+            if (!['roles', 'organizations', 'none'].includes(mode))
+                throw new errors_1.CliError('--set ldap-groups must be roles, organizations or none.');
+            const set = (0, ldap_1.mapLdif)(entries, {
+                groups: mode,
+                idAttribute: p.credential(ID_ATTRIBUTE),
+                trustEmails: p.credential(TRUST) === 'true',
+                origin: `LDIF export ${path}`,
+            });
+            for (const problem of problems.slice(0, 20))
+                set.warn(`LDIF: ${problem}`);
+            p.say(`  read ${entries.length} entries from ${path}`);
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    lazy: {
+        preset: 'ldap',
+        config(p) {
+            const config = {};
+            for (const [key, spec] of [['url', URL_SPEC], ['bind_dn', BIND_DN], ['base_dn', BASE_DN], ['user_filter', FILTER], ['id_attribute', ID_ATTRIBUTE]]) {
+                const v = p.credential(spec);
+                if (v)
+                    config[key] = v;
+            }
+            return config;
+        },
+        secret: { flag: 'ldap-bind-password', env: 'LDAP_BIND_PASSWORD', label: 'the service account password', required: false, secret: true },
+    },
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/ldap/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/ldap/plugin.ts"],"names":[],"mappings":";;;AAAA,yCAAoC;AACpC,qCAAiC;AACjC,yCAAwC;AACxC,yCAAoD;AACpD,qDAAsD;AAGtD;;;;;;GAMG;AAEH,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,4DAA4D,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACjK,MAAM,YAAY,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,yEAAyE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAChM,MAAM,QAAQ,GAAmB,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,qEAAqE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACtK,MAAM,OAAO,GAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,2CAA2C,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACnJ,MAAM,OAAO,GAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,oCAAoC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC5I,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,0CAA0C,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACzJ,MAAM,KAAK,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,mDAAmD,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAEnK,SAAS,IAAI,CAAC,CAAgB;IAC5B,OAAO,IAAA,UAAG,EAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,wBAAwB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAE,CAAC;AACnJ,CAAC;AAEY,QAAA,UAAU,GAAoB;IACzC,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,MAAM;IACd,KAAK,EAAE,yBAAyB;IAChC,IAAI,EAAE,+eAA+e;IACrf,MAAM,EAAE;QACN,KAAK,EAAE,+CAA+C;QACtD,WAAW,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,CAAC;QAC1C,MAAM,EAAE;YACN,8JAA8J;YAC9J,4HAA4H;YAC5H,yIAAyI;SAC1I;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,IAAI,GAAG,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9B,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAA,gBAAS,EAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,OAAO,CAAC,MAAM;gBAAE,MAAM,IAAI,iBAAQ,CAAC,uBAAuB,IAAI,yBAAyB,CAAC,CAAC;YAC9F,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC;YAC7C,IAAI,CAAC,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,iBAAQ,CAAC,yDAAyD,CAAC,CAAC;YACtI,MAAM,GAAG,GAAG,IAAA,cAAO,EAAC,OAAO,EAAE;gBAC3B,MAAM,EAAE,IAA0C;gBAClD,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC;gBACvC,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,MAAM;gBAC3C,MAAM,EAAE,eAAe,IAAI,EAAE;aAC9B,CAAC,CAAC;YACH,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,SAAS,OAAO,EAAE,CAAC,CAAC;YAC1E,CAAC,CAAC,GAAG,CAAC,UAAU,OAAO,CAAC,MAAM,iBAAiB,IAAI,EAAE,CAAC,CAAC;YACvD,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,MAAM;QACd,MAAM,CAAC,CAAC;YACN,MAAM,MAAM,GAA2B,EAAE,CAAC;YAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,CAAC,cAAc,EAAE,YAAY,CAAC,CAAU,EAAE,CAAC;gBAC5J,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBAC7B,IAAI,CAAC;oBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACzB,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,8BAA8B,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE;KACxI;CACF,CAAC"}

package/dist/migrate/logto/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const logtoPlugin: MigrationPlugin;

package/dist/migrate/logto/plugin.js

@@ -0,0 +1,131 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.logtoPlugin = void 0;
+const node_path_1 = require("node:path");
+const errors_1 = require("../../errors");
+const logto_1 = require("../export/logto");
+const logto_config_1 = require("../export/logto-config");
+const tables_1 = require("../export/frameworks/tables");
+const plugin_kit_1 = require("../export/plugin-kit");
+/**
+ * `atlas migrate logto` — a Logto tenant (self-hosted or Logto Cloud): the
+ * sign-in experience, connectors, applications, API resources and roles as
+ * Atlas config; users, social and enterprise identities, organizations,
+ * roles, invitations and personal access tokens through the Management API
+ * (a machine-to-machine app on this machine) or from a database dump of a
+ * self-hosted Logto, which also carries password hashes, TOTP secrets,
+ * passkeys and backup codes; the `logto` bridge preset (an ID token verified
+ * against the tenant's `/oidc/jwks`); lazy migration through the Management
+ * API's password check; and the code.
+ */
+const ENDPOINT = { flag: '--logto-endpoint', env: 'LOGTO_ENDPOINT', label: 'your Logto endpoint (https://auth.example.com or https://abc123.logto.app)', required: false };
+const TENANT = { flag: '--logto-tenant-id', env: 'LOGTO_TENANT_ID', label: 'the tenant id (default on a self-hosted Logto; the abc123 of abc123.logto.app on Logto Cloud)', required: false };
+const APP_ID = { flag: '--logto-m2m-app-id', env: 'LOGTO_M2M_APP_ID', label: 'the id of a machine-to-machine app with the Management API role', required: false };
+const APP_SECRET = { flag: '--logto-m2m-app-secret', env: 'LOGTO_M2M_APP_SECRET', label: 'that app\'s secret', required: false, secret: true };
+const DUMP = { flag: '--logto-dump', env: 'LOGTO_DUMP_DIR', label: 'a folder of database table dumps (users.csv, roles.csv, organizations.csv, …)', required: false };
+const CLIENT_ID = { flag: '--logto-client-id', env: 'LOGTO_APP_ID', label: 'the id of your Logto application (the audience of its ID tokens)', required: false };
+const PATS = { flag: '--logto-personal-access-tokens', env: 'LOGTO_PERSONAL_ACCESS_TOKENS', label: 'true, to read each user\'s personal access tokens too (one API call per user)', required: false };
+const RP_ID = { flag: '--rp-id', env: 'ATLAS_MIGRATE_RP_ID', label: 'the WebAuthn relying party id passkeys were registered for', required: false };
+function endpointOf(p, required) {
+    const raw = p.credential({ ...ENDPOINT, required });
+    if (!raw)
+        return undefined;
+    try {
+        return (0, logto_1.normalizeEndpoint)(raw);
+    }
+    catch (err) {
+        throw new errors_1.CliError(`Logto: ${err.message}`);
+    }
+}
+function m2m(p) {
+    const appId = p.credential(APP_ID);
+    const appSecret = p.credential(APP_SECRET);
+    return appId && appSecret ? { appId, appSecret } : undefined;
+}
+function tenantOf(p, endpoint) {
+    return p.credential(TENANT)?.trim() ?? (endpoint ? (0, logto_1.tenantOfEndpoint)(endpoint) : null) ?? 'default';
+}
+exports.logtoPlugin = {
+    vendor: 'logto',
+    source: 'logto',
+    label: 'Logto',
+    help: 'Move a Logto tenant (self-hosted or Logto Cloud): its sign-in experience, connectors, applications, API resources and roles as Atlas config; users, social and enterprise identities, organizations, roles, invitations and personal access tokens through the Management API with a machine-to-machine app (on this machine) or from a database dump, which also carries password hashes, TOTP secrets, passkeys and backup codes; a zero-logout bridge on the tenant\'s ID tokens; lazy migration for passwords you cannot export; and the code.',
+    config: {
+        reads: 'your Logto tenant via the Management API',
+        credentials: [ENDPOINT, TENANT, APP_ID, APP_SECRET],
+        async translate(p) {
+            const endpoint = endpointOf(p, true);
+            const credentials = m2m(p);
+            if (!credentials)
+                throw new errors_1.CliError('Logto: pass the machine-to-machine app id and secret (--set logto-m2m-app-id=… --set logto-m2m-app-secret=…, or LOGTO_M2M_APP_ID / LOGTO_M2M_APP_SECRET).');
+            const tenantId = tenantOf(p, endpoint);
+            const http = (0, logto_1.logtoManagementHttp)({ endpoint, m2m: credentials, tenantId, fetchImpl: p.fetch });
+            return (0, logto_config_1.translateLogtoConfig)(await (0, plugin_kit_1.vendorStep)('Logto', () => (0, logto_config_1.fetchLogtoConfig)(http, endpoint, tenantId)));
+        },
+    },
+    export: {
+        reads: 'the Logto Management API (machine-to-machine app) or a database dump of a self-hosted Logto',
+        credentials: [ENDPOINT, TENANT, APP_ID, APP_SECRET, DUMP, RP_ID, PATS],
+        limits: [
+            'The Management API never returns MFA secrets (TOTP keys, WebAuthn credentials, backup codes): those users enrol again, unless you export from the database of a self-hosted Logto (--set logto-dump=<folder>).',
+            'The Management API does not reliably return password hashes: a database dump of a self-hosted Logto carries them (Argon2, bcrypt, SHA-family and legacy expressions). Logto Cloud tenants, and every user without a hash, move by lazy migration (the logto preset).',
+            'Passkeys move only with the relying-party id they were registered for (--set rp-id=…, or the endpoint host): your Atlas domain must match it.',
+            'Machine-to-machine apps and their secrets are not exported: create Atlas M2M clients.',
+            'Logto sessions are encrypted cookies of your app\'s SDK: the bridge exchanges the ID token inside them (see the guide for the extractor).',
+            'Personal access tokens come over the API one call per user: add --set logto-personal-access-tokens=true.',
+        ],
+        async run(p, writer, resume) {
+            const dumpDir = p.credential(DUMP);
+            const endpoint = endpointOf(p, false);
+            const credentials = m2m(p);
+            if (!dumpDir && !(endpoint && credentials)) {
+                throw new errors_1.CliError('Logto: pass a database dump (--set logto-dump=<folder>), or the endpoint with a machine-to-machine app (--set logto-endpoint=… plus LOGTO_M2M_APP_ID and LOGTO_M2M_APP_SECRET).');
+            }
+            const set = await (0, plugin_kit_1.vendorStep)('Logto', async () => (0, logto_1.exportLogto)({
+                tables: dumpDir ? (0, tables_1.readDumpDir)((0, node_path_1.resolve)(dumpDir)) : undefined,
+                endpoint,
+                m2m: credentials,
+                tenantId: p.credential(TENANT)?.trim(),
+                rpId: p.credential(RP_ID)?.trim(),
+                personalAccessTokens: /^(1|true|yes)$/i.test(p.credential(PATS)?.trim() ?? ''),
+                fetchImpl: p.fetch,
+                onProgress: (m) => p.say(`  reading ${m}`),
+            }));
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    bridge: {
+        preset: 'logto',
+        vars(p, t) {
+            const vars = { ...t?.bridge?.vars };
+            const endpoint = endpointOf(p, false);
+            if (endpoint)
+                vars.base_url = endpoint;
+            const clientId = p.credential(CLIENT_ID);
+            if (clientId)
+                vars.client_id = clientId;
+            return vars;
+        },
+    },
+    lazy: {
+        preset: 'logto',
+        config(p, t) {
+            const config = { ...t?.lazy?.config };
+            const endpoint = endpointOf(p, false);
+            if (endpoint)
+                config.base_url = endpoint;
+            const appId = p.credential(APP_ID);
+            if (appId)
+                config.app_id = appId;
+            const tenant = p.credential(TENANT)?.trim();
+            if (tenant)
+                config.tenant_id = tenant;
+            else if (endpoint && (0, logto_1.tenantOfEndpoint)(endpoint))
+                config.tenant_id = (0, logto_1.tenantOfEndpoint)(endpoint);
+            return config;
+        },
+        secret: APP_SECRET,
+    },
+    codemod: 'logto',
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/logto/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/logto/plugin.ts"],"names":[],"mappings":";;;AAAA,yCAAoC;AACpC,yCAAwC;AACxC,2CAAwG;AACxG,yDAAgF;AAChF,wDAA0D;AAC1D,qDAAkE;AAGlE;;;;;;;;;;GAUG;AAEH,MAAM,QAAQ,GAAmB,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,4EAA4E,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC3L,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,+FAA+F,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC9M,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,iEAAiE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAClL,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,wBAAwB,EAAE,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC/J,MAAM,IAAI,GAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,+EAA+E,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACtL,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,kEAAkE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACjL,MAAM,IAAI,GAAmB,EAAE,IAAI,EAAE,gCAAgC,EAAE,GAAG,EAAE,8BAA8B,EAAE,KAAK,EAAE,+EAA+E,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACtN,MAAM,KAAK,GAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,4DAA4D,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAEpK,SAAS,UAAU,CAAC,CAAgB,EAAE,QAAiB;IACrD,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,CAAC;QACH,OAAO,IAAA,yBAAiB,EAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,iBAAQ,CAAC,UAAW,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED,SAAS,GAAG,CAAC,CAAgB;IAC3B,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAC3C,OAAO,KAAK,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC;AAED,SAAS,QAAQ,CAAC,CAAgB,EAAE,QAA4B;IAC9D,OAAO,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAA,wBAAgB,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;AACrG,CAAC;AAEY,QAAA,WAAW,GAAoB;IAC1C,MAAM,EAAE,OAAO;IACf,MAAM,EAAE,OAAO;IACf,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,ohBAAohB;IAC1hB,MAAM,EAAE;QACN,KAAK,EAAE,0CAA0C;QACjD,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC;QACnD,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,EAAE,IAAI,CAAE,CAAC;YACtC,MAAM,WAAW,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,CAAC,WAAW;gBAAE,MAAM,IAAI,iBAAQ,CAAC,2JAA2J,CAAC,CAAC;YAClM,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YACvC,MAAM,IAAI,GAAG,IAAA,2BAAmB,EAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YAC/F,OAAO,IAAA,mCAAoB,EAAC,MAAM,IAAA,uBAAU,EAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAA,+BAAgB,EAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC3G,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,6FAA6F;QACpG,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC;QACtE,MAAM,EAAE;YACN,gNAAgN;YAChN,sQAAsQ;YACtQ,+IAA+I;YAC/I,uFAAuF;YACvF,2IAA2I;YAC3I,0GAA0G;SAC3G;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,OAAO,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACnC,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YACtC,MAAM,WAAW,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,IAAI,WAAW,CAAC,EAAE,CAAC;gBAC3C,MAAM,IAAI,iBAAQ,CAAC,iLAAiL,CAAC,CAAC;YACxM,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,OAAO,EAAE,KAAK,IAAI,EAAE,CAC/C,IAAA,mBAAW,EAAC;gBACV,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,IAAA,oBAAW,EAAC,IAAA,mBAAO,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC3D,QAAQ;gBACR,GAAG,EAAE,WAAW;gBAChB,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE;gBACtC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE;gBACjC,oBAAoB,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;gBAC9E,SAAS,EAAE,CAAC,CAAC,KAAK;gBAClB,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;aAC3C,CAAC,CACH,CAAC;YACF,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,OAAO;QACf,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,GAA2B,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC5D,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YACtC,IAAI,QAAQ;gBAAE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;YACvC,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,QAAQ;gBAAE,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;YACxC,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,OAAO;QACf,MAAM,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,MAAM,GAA2B,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9D,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YACtC,IAAI,QAAQ;gBAAE,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;YACzC,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACnC,IAAI,KAAK;gBAAE,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC;YACjC,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;YAC5C,IAAI,MAAM;gBAAE,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC;iBACjC,IAAI,QAAQ,IAAI,IAAA,wBAAgB,EAAC,QAAQ,CAAC;gBAAE,MAAM,CAAC,SAAS,GAAG,IAAA,wBAAgB,EAAC,QAAQ,CAAE,CAAC;YAChG,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,EAAE,UAAU;KACnB;IACD,OAAO,EAAE,OAAO;CACjB,CAAC"}

package/dist/migrate/magic/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const magicPlugin: MigrationPlugin;

package/dist/migrate/magic/plugin.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.magicPlugin = void 0;
+const magic_1 = require("../export/magic");
+const magic_config_1 = require("../export/magic-config");
+const plugin_kit_1 = require("../export/plugin-kit");
+/**
+ * `atlas migrate magic` — users from the export file in your Magic dashboard
+ * (Magic has no API to list users), their issuers from an optional email →
+ * issuer file, and the `magic` bridge preset (DID tokens verified against the
+ * signer's own key and your client id). Magic holds no passwords.
+ */
+const USERS_FILE = { flag: '--magic-users-file', env: 'MAGIC_USERS_FILE', label: 'the user export file from your Magic dashboard (CSV)', required: true };
+const ISSUERS_FILE = { flag: '--magic-issuers-file', env: 'MAGIC_ISSUERS_FILE', label: 'a file mapping each email to its Magic issuer (did:ethr:…)', required: false };
+const CLIENT_ID = { flag: '--magic-client-id', env: 'MAGIC_CLIENT_ID', label: 'your Magic client id (did:magic:…)', required: false };
+function clientId(p) {
+    return p.credential(CLIENT_ID) ?? (p.ctx.env.NEXT_PUBLIC_MAGIC_CLIENT_ID?.trim() || undefined);
+}
+exports.magicPlugin = {
+    vendor: 'magic',
+    source: 'magic',
+    label: 'Magic (magic.link)',
+    help: 'Move a Magic (magic.link) app: users from the export file in your Magic dashboard, with verified emails and, when you have them, Magic issuers so the zero-logout bridge recognises each person\'s current DID token; email code and link sign-in as Atlas config; and the code. Magic has no user-listing API, so no Magic secret key is needed.',
+    config: {
+        reads: 'nothing from Magic (it has no settings API): the translation lists where each Magic setting lives',
+        credentials: [CLIENT_ID],
+        async translate(p) {
+            return (0, magic_config_1.translateMagicConfig)({ ...(clientId(p) ? { clientId: clientId(p) } : {}) });
+        },
+    },
+    export: {
+        reads: 'the Magic dashboard user export (--magic-users-file) and an optional email → issuer file (--magic-issuers-file)',
+        credentials: [USERS_FILE, ISSUERS_FILE],
+        limits: [
+            'Magic has no API to list users: export them from the Magic dashboard (Users → Export) and pass that file with --magic-users-file.',
+            'The dashboard export has no issuers. Users without one are imported by email and sign in with an email code; give an email → issuer file (--magic-issuers-file) to keep their current sessions alive through the bridge.',
+            'Magic holds no passwords. Embedded wallet keys cannot be exported: users export them from Magic themselves.',
+        ],
+        async run(p, writer, resume) {
+            const usersText = (0, plugin_kit_1.localFile)(p, USERS_FILE, 'text');
+            if (usersText === undefined)
+                (0, plugin_kit_1.need)(p, USERS_FILE);
+            const set = await (0, plugin_kit_1.vendorStep)('Magic', async () => (0, magic_1.exportMagic)({ usersText: usersText, issuersText: (0, plugin_kit_1.localFile)(p, ISSUERS_FILE, 'text'), onProgress: (m) => p.say(`  reading ${m}`) }));
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    bridge: {
+        preset: 'magic',
+        vars(p, t) {
+            const id = t?.bridge?.vars.client_id ?? clientId(p);
+            return id ? { ...t?.bridge?.vars, client_id: id } : { ...t?.bridge?.vars };
+        },
+    },
+    codemod: 'magic',
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/magic/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/magic/plugin.ts"],"names":[],"mappings":";;;AAAA,2CAA8C;AAC9C,yDAA8D;AAE9D,qDAAmF;AAEnF;;;;;GAKG;AAEH,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,sDAAsD,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC1K,MAAM,YAAY,GAAmB,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,4DAA4D,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACvL,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,oCAAoC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAEtJ,SAAS,QAAQ,CAAC,CAAgB;IAChC,OAAO,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC,CAAC;AACjG,CAAC;AAEY,QAAA,WAAW,GAAoB;IAC1C,MAAM,EAAE,OAAO;IACf,MAAM,EAAE,OAAO;IACf,KAAK,EAAE,oBAAoB;IAC3B,IAAI,EAAE,mVAAmV;IACzV,MAAM,EAAE;QACN,KAAK,EAAE,mGAAmG;QAC1G,WAAW,EAAE,CAAC,SAAS,CAAC;QACxB,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,OAAO,IAAA,mCAAoB,EAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,iHAAiH;QACxH,WAAW,EAAE,CAAC,UAAU,EAAE,YAAY,CAAC;QACvC,MAAM,EAAE;YACN,mIAAmI;YACnI,0NAA0N;YAC1N,6GAA6G;SAC9G;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,SAAS,GAAG,IAAA,sBAAS,EAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;YACnD,IAAI,SAAS,KAAK,SAAS;gBAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,UAAU,CAAC,CAAC;YACjD,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,IAAA,mBAAW,EAAC,EAAE,SAAS,EAAE,SAAU,EAAE,WAAW,EAAE,IAAA,sBAAS,EAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YACvL,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,OAAO;QACf,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC;YACpD,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC7E,CAAC;KACF;IACD,OAAO,EAAE,OAAO;CACjB,CAAC"}

package/dist/migrate/nhost/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const nhostPlugin: MigrationPlugin;