@atlasauth/cli 0.11.0 → 0.13.0

package/dist/migrate/ping-identity/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const pingIdentityPlugin: MigrationPlugin;

package/dist/migrate/ping-identity/plugin.js

@@ -0,0 +1,100 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pingIdentityPlugin = void 0;
+const pingone_1 = require("../export/pingone");
+const plugin_kit_1 = require("../export/plugin-kit");
+const translate_kit_1 = require("../export/translate-kit");
+const record_set_1 = require("../export/record-set");
+const pingone_2 = require("../export/pingone");
+/**
+ * `atlas migrate ping-identity` — a PingOne environment: password policy,
+ * social providers and SAML / OIDC connections as Atlas config; users, groups
+ * (roles) and enterprise connections through the management API with a worker
+ * application on this machine; the `ping_identity` bridge preset (PingOne
+ * access / ID tokens verified against the environment's keys) and lazy
+ * migration through PingOne's password check. PingFederate keeps users in your
+ * directory: export that as LDIF (`atlas migrate ldap`) and its SAML
+ * connections as metadata (`atlas migrate saml`).
+ */
+const ENVIRONMENT = { flag: 'pingone-environment-id', env: 'PINGONE_ENVIRONMENT_ID', label: 'your PingOne environment id', required: true };
+const CLIENT_ID = { flag: 'pingone-client-id', env: 'PINGONE_CLIENT_ID', label: 'a PingOne worker application client id', required: true };
+const CLIENT_SECRET = { flag: 'pingone-client-secret', env: 'PINGONE_CLIENT_SECRET', label: 'the worker application client secret', required: true, secret: true };
+const REGION = { flag: 'pingone-region', env: 'PINGONE_REGION', label: 'the PingOne region (com, eu, asia, ca, com.au)', required: false };
+const GROUPS = { flag: 'pingone-groups', env: 'PINGONE_GROUPS', label: 'read each user\'s group memberships (true by default; false for very large environments)', required: false };
+const region = (p) => (0, pingone_1.pingRegion)(p.credential(REGION));
+const creds = (p) => ({ environmentId: (0, plugin_kit_1.need)(p, ENVIRONMENT), clientId: (0, plugin_kit_1.need)(p, CLIENT_ID), clientSecret: (0, plugin_kit_1.need)(p, CLIENT_SECRET), region: region(p), fetchImpl: p.fetch });
+exports.pingIdentityPlugin = {
+    vendor: 'ping-identity',
+    source: 'ping_identity',
+    label: 'Ping Identity (PingOne, PingFederate)',
+    help: 'Move a PingOne environment: password policy and social providers as Atlas config, SAML / OIDC identity providers as SSO connections, users with their login, verified email, phones, state and population, groups as roles, a zero-logout bridge for PingOne tokens, and lazy migration for passwords (PingOne never exports hashes). Your worker application credentials stay on this machine. PingFederate: export your directory as LDIF (atlas migrate ldap) and its connection metadata (atlas migrate saml).',
+    config: {
+        reads: 'your PingOne environment (password policies, identity providers)',
+        credentials: [ENVIRONMENT, CLIENT_ID, CLIENT_SECRET, REGION],
+        async translate(p) {
+            const c = creds(p);
+            const { policies, idps } = await (0, plugin_kit_1.vendorStep)('PingOne', async () => {
+                const http = (0, pingone_1.pingOneHttp)(c, await (0, pingone_1.pingOneToken)(c));
+                const safe = async (path, key) => {
+                    try {
+                        return await (0, pingone_1.pingOneList)(http, path, key);
+                    }
+                    catch {
+                        return [];
+                    }
+                };
+                return { policies: await safe('/passwordPolicies', 'passwordPolicies'), idps: await safe('/identityProviders', 'identityProviders') };
+            });
+            const b = new translate_kit_1.ConfigBuilder();
+            b.set('strategies.password', true);
+            b.add('differs', 'authentication', 'password', 'PingOne never exports password hashes: the ping_identity lazy-migration preset checks each password against PingOne on first sign-in.', 'auth_config.strategies.password');
+            const policy = policies.find((x) => x.default === true) ?? policies[0];
+            if (policy) {
+                const min = Number((0, record_set_1.isObj)(policy.length) ? policy.length.min : 8);
+                b.set('passwordPolicy.minLength', Math.max(8, Number.isFinite(min) ? min : 8));
+                b.add(min < 8 ? 'differs' : 'mapped', `passwordPolicies ${(0, record_set_1.str)(policy.name) ?? ''}`.trim(), 'length.min', `${min}${min < 8 ? ' (Atlas requires at least 8; existing passwords still sign in)' : ''}.`, 'auth_config.passwordPolicy.minLength');
+                b.add('differs', `passwordPolicies ${(0, record_set_1.str)(policy.name) ?? ''}`.trim(), 'minCharacters / excludesCommonlyUsed', 'Atlas follows NIST 800-63B: length and breached-password checks, no character-class rules.', 'auth_config.passwordPolicy');
+            }
+            for (const idp of idps) {
+                const type = (0, record_set_1.str)(idp.type) ?? '';
+                const name = (0, record_set_1.str)(idp.name) ?? type;
+                if ((0, pingone_2.ssoConnectionOf)(idp)) {
+                    b.add('mapped', 'identityProviders', `${name} (${type})`, 'Enterprise IdP: moves with the data export as an Atlas SSO connection; update the IdP with Atlas\'s ACS URL / redirect URI, and replace PingOne routing with the connection\'s domains.', 'sso_connections');
+                }
+                else if ((0, translate_kit_1.socialKey)(type)) {
+                    b.socialProvider({ atlasKey: (0, translate_kit_1.socialKey)(type), vendorName: name, area: 'identityProviders', setting: `${name} (${type})`, clientId: (0, record_set_1.str)(idp.clientId) });
+                }
+                else
+                    b.add('manual', 'identityProviders', `${name} (${type})`, 'No Atlas counterpart for this provider type: add it as a custom OAuth provider.');
+            }
+            b.add('manual', 'authentication', 'sign-on policies / MFA policies / DaVinci flows', 'PingOne sign-on policies, MFA policies and DaVinci flows are not translated: set Atlas\'s MFA policy and sign-in methods in auth_config.');
+            return b.result(`PingOne environment ${c.environmentId}`, {
+                bridge: { preset: 'ping_identity', vars: { environment_id: c.environmentId, region: c.region } },
+                lazy: { preset: 'ping_identity', config: { environment_id: c.environmentId, region: c.region, client_id: c.clientId } },
+            });
+        },
+    },
+    export: {
+        reads: 'your PingOne environment through the management API (users, groups, identity providers)',
+        credentials: [ENVIRONMENT, CLIENT_ID, CLIENT_SECRET, REGION, GROUPS],
+        limits: [
+            'Password hashes are never exported by PingOne: passwords move by lazy migration (preset ping_identity).',
+            'TOTP secrets, FIDO2 credentials and mobile-app pairings cannot be exported: users enrol their second factor again.',
+            'PingFederate has no user store of its own: export your directory (LDIF) and the SAML connection metadata with atlas migrate ldap / saml.',
+        ],
+        async run(p, writer, resume) {
+            const set = await (0, plugin_kit_1.vendorStep)('PingOne', () => (0, pingone_1.exportPingOne)({ ...creds(p), groups: p.credential(GROUPS) !== 'false', onProgress: (m) => p.say(`  reading ${m}`) }));
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    bridge: {
+        preset: 'ping_identity',
+        vars: (p, t) => ({ environment_id: (0, plugin_kit_1.need)(p, ENVIRONMENT), region: region(p), ...t?.bridge?.vars }),
+    },
+    lazy: {
+        preset: 'ping_identity',
+        config: (p, t) => ({ environment_id: (0, plugin_kit_1.need)(p, ENVIRONMENT), region: region(p), client_id: (0, plugin_kit_1.need)(p, CLIENT_ID), ...t?.lazy?.config }),
+        secret: CLIENT_SECRET,
+    },
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/ping-identity/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/ping-identity/plugin.ts"],"names":[],"mappings":";;;AAAA,+CAAsG;AACtG,qDAAwE;AACxE,2DAAmE;AACnE,qDAA4D;AAC5D,+CAAoD;AAGpD;;;;;;;;;GASG;AAEH,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,wBAAwB,EAAE,GAAG,EAAE,wBAAwB,EAAE,KAAK,EAAE,6BAA6B,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC5J,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,wCAAwC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC3J,MAAM,aAAa,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,sCAAsC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACnL,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,gDAAgD,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC3J,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,0FAA0F,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAErM,MAAM,MAAM,GAAG,CAAC,CAAgB,EAAE,EAAE,CAAC,IAAA,oBAAU,EAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AACtE,MAAM,KAAK,GAAG,CAAC,CAAgB,EAAE,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AAE5K,QAAA,kBAAkB,GAAoB;IACjD,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,eAAe;IACvB,KAAK,EAAE,uCAAuC;IAC9C,IAAI,EAAE,ofAAof;IAC1f,MAAM,EAAE;QACN,KAAK,EAAE,kEAAkE;QACzE,WAAW,EAAE,CAAC,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,CAAC;QAC5D,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACnB,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,IAAA,uBAAU,EAAC,SAAS,EAAE,KAAK,IAAI,EAAE;gBAChE,MAAM,IAAI,GAAG,IAAA,qBAAW,EAAC,CAAC,EAAE,MAAM,IAAA,sBAAY,EAAC,CAAC,CAAC,CAAC,CAAC;gBACnD,MAAM,IAAI,GAAG,KAAK,EAAE,IAAY,EAAE,GAAW,EAAE,EAAE;oBAC/C,IAAI,CAAC;wBACH,OAAO,MAAM,IAAA,qBAAW,EAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;oBAC5C,CAAC;oBAAC,MAAM,CAAC;wBACP,OAAO,EAAW,CAAC;oBACrB,CAAC;gBACH,CAAC,CAAC;gBACF,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC,oBAAoB,EAAE,mBAAmB,CAAC,EAAE,CAAC;YACxI,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,6BAAa,EAAE,CAAC;YAC9B,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;YACnC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,gBAAgB,EAAE,UAAU,EAAE,uIAAuI,EAAE,iCAAiC,CAAC,CAAC;YAC3N,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC;YACvE,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,GAAG,GAAG,MAAM,CAAC,IAAA,kBAAK,EAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjE,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC/E,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,oBAAoB,IAAA,gBAAG,EAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,gEAAgE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,sCAAsC,CAAC,CAAC;gBAC9O,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,oBAAoB,IAAA,gBAAG,EAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,sCAAsC,EAAE,4FAA4F,EAAE,4BAA4B,CAAC,CAAC;YAC5O,CAAC;YACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACjC,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;gBACnC,IAAI,IAAA,yBAAe,EAAC,GAAG,CAAC,EAAE,CAAC;oBACzB,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,mBAAmB,EAAE,GAAG,IAAI,KAAK,IAAI,GAAG,EAAE,yLAAyL,EAAE,iBAAiB,CAAC,CAAC;gBAC1Q,CAAC;qBAAM,IAAI,IAAA,yBAAS,EAAC,IAAI,CAAC,EAAE,CAAC;oBAC3B,CAAC,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,IAAA,yBAAS,EAAC,IAAI,CAAE,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,GAAG,IAAI,KAAK,IAAI,GAAG,EAAE,QAAQ,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC3J,CAAC;;oBAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,mBAAmB,EAAE,GAAG,IAAI,KAAK,IAAI,GAAG,EAAE,iFAAiF,CAAC,CAAC;YACtJ,CAAC;YACD,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,iDAAiD,EAAE,0IAA0I,CAAC,CAAC;YACjO,OAAO,CAAC,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,aAAa,EAAE,EAAE;gBACxD,MAAM,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE;gBAChG,IAAI,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE;aACxH,CAAC,CAAC;QACL,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,yFAAyF;QAChG,WAAW,EAAE,CAAC,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC;QACpE,MAAM,EAAE;YACN,yGAAyG;YACzG,oHAAoH;YACpH,0IAA0I;SAC3I;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAA,uBAAa,EAAC,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YACpK,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,eAAe;QACvB,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,cAAc,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;KAClG;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,eAAe;QACvB,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,cAAc,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAClI,MAAM,EAAE,aAAa;KACtB;CACF,CAAC"}

package/dist/migrate/pocketbase/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const pocketbasePlugin: MigrationPlugin;

package/dist/migrate/pocketbase/plugin.js

@@ -0,0 +1,99 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pocketbasePlugin = void 0;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const pocketbase_1 = require("../export/pocketbase");
+const pocketbase_config_1 = require("../export/pocketbase-config");
+const errors_1 = require("../../errors");
+const plugin_kit_1 = require("../export/plugin-kit");
+const project_files_1 = require("../export/project-files");
+/**
+ * `atlas migrate pocketbase` — a PocketBase app (v0.23+ and ≤0.22). The REST
+ * API never returns password hashes, so everything is read from the SQLite
+ * database on this machine: `pb_data/data.db` through Node's built-in SQLite
+ * (read-only), or a `sqlite3 -json` dump folder. Auth collection options
+ * become Atlas config; the `pocketbase` remote bridge asks PocketBase about a
+ * live token once (auth-refresh); lazy migration signs in against PocketBase
+ * for anyone left; and the `pocketbase` codemod rewrites the JS SDK calls.
+ */
+const DB = { flag: '--pocketbase-db', env: 'POCKETBASE_DB', label: 'pb_data/data.db (copy it with its -wal/-shm files, or stop the server)', required: false };
+const DUMP = { flag: '--pocketbase-dump', env: 'POCKETBASE_DUMP', label: 'a folder of sqlite3 -json table dumps (_collections, your auth collections, _externalAuths)', required: false };
+const SCHEMA = { flag: '--pocketbase-schema', env: 'POCKETBASE_SCHEMA', label: 'a collections export (Settings → Export collections, pb_schema.json)', required: false };
+const URL_SPEC = { flag: '--pocketbase-url', env: 'POCKETBASE_URL', label: 'the public PocketBase URL (https://pb.example.com)', required: false };
+const COLLECTIONS = { flag: '--pocketbase-collections', env: 'POCKETBASE_COLLECTIONS', label: 'auth collections to export, comma-separated (default: all but _superusers)', required: false };
+const SUPERUSERS = { flag: '--pocketbase-superusers', env: 'POCKETBASE_SUPERUSERS', label: 'true to export _superusers too', required: false };
+async function readTables(p) {
+    const dump = (0, project_files_1.projectDir)(p, DUMP);
+    if (dump)
+        return { tables: (0, pocketbase_1.readPocketBaseDump)(dump), origin: 'sqlite3 dump' };
+    const named = p.credential(DB);
+    const db = named ? (0, node_path_1.resolve)(named) : [(0, node_path_1.join)((0, node_path_1.resolve)(p.project), 'pb_data', 'data.db')].find((f) => (0, node_fs_1.existsSync)(f));
+    if (!db)
+        return undefined;
+    return { tables: await (0, pocketbase_1.readPocketBaseDb)(db), origin: 'pb_data/data.db' };
+}
+function url(p) {
+    return p.credential(URL_SPEC)?.trim().replace(/\/+$/, '');
+}
+exports.pocketbasePlugin = {
+    vendor: 'pocketbase',
+    source: 'pocketbase',
+    label: 'PocketBase',
+    help: 'Move a PocketBase app: auth collection options (password, OAuth2, OTP, MFA, token duration, rules) as Atlas config; every auth record with its bcrypt hash, verified email, username, custom fields and OAuth2 links, read from pb_data/data.db or a sqlite3 dump on this machine; a zero-logout bridge that asks PocketBase about each live token once; lazy migration for anyone left; and the code.',
+    config: {
+        reads: 'a collections export (pb_schema.json) or _collections in pb_data/data.db',
+        credentials: [SCHEMA, DB, DUMP, URL_SPEC],
+        async translate(p) {
+            const file = (0, project_files_1.projectFile)(p, SCHEMA, ['pb_schema.json']);
+            if (file)
+                return (0, plugin_kit_1.vendorStep)('PocketBase', async () => (0, pocketbase_config_1.translatePocketBaseConfig)({ collections: (0, pocketbase_config_1.parsePocketBaseSchema)(file.text), file, url: url(p) }));
+            const read = await (0, plugin_kit_1.vendorStep)('PocketBase', () => readTables(p));
+            if (!read)
+                throw new errors_1.CliError('PocketBase: pass a collections export (--set pocketbase-schema=pb_schema.json), the database (--set pocketbase-db=pb_data/data.db) or a dump folder (--set pocketbase-dump=<dir>).');
+            return (0, pocketbase_config_1.translatePocketBaseConfig)({ collections: read.tables.collections, url: url(p) });
+        },
+    },
+    export: {
+        reads: 'pb_data/data.db (read-only, built-in SQLite) or a sqlite3 -json dump folder',
+        credentials: [DB, DUMP, URL_SPEC, COLLECTIONS, SUPERUSERS],
+        limits: [
+            'The PocketBase API never returns password hashes or token keys: the export reads the SQLite database (or your dump of it) on this machine.',
+            'Auth tokens are signed per record and are not imported: the pocketbase bridge preset asks PocketBase (auth-refresh) about each live token once instead.',
+            'PocketBase MFA and OTP are one-time sign-in state, not enrolled factors: users enrol an Atlas second factor after the move.',
+            '≤0.22 admins (_admins) are not exported.',
+        ],
+        async run(p, writer, resume) {
+            const read = await (0, plugin_kit_1.vendorStep)('PocketBase', () => readTables(p));
+            if (!read)
+                throw new errors_1.CliError('PocketBase: no pb_data/data.db in this folder. Pass --set pocketbase-db=<path to data.db> or --set pocketbase-dump=<folder of sqlite3 -json dumps>.');
+            const collections = p.credential(COLLECTIONS)?.split(',').map((c) => c.trim()).filter(Boolean);
+            const set = (0, pocketbase_1.exportPocketBase)(read.tables, { collections, includeSuperusers: (0, project_files_1.truthyCredential)(p, SUPERUSERS), url: url(p), origin: read.origin });
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    bridge: {
+        preset: 'pocketbase',
+        vars(p, t) {
+            const vars = { ...t?.bridge?.vars };
+            const u = url(p);
+            if (u)
+                vars.url = u;
+            vars.collection ??= 'users';
+            return vars;
+        },
+    },
+    lazy: {
+        preset: 'pocketbase',
+        config(p, t) {
+            const config = { ...t?.lazy?.config };
+            const u = url(p);
+            if (u)
+                config.url = u;
+            config.collection ??= 'users';
+            return config;
+        },
+    },
+    codemod: 'pocketbase',
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/pocketbase/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/pocketbase/plugin.ts"],"names":[],"mappings":";;;AAAA,qCAAqC;AACrC,yCAA0C;AAC1C,qDAAqH;AACrH,mEAA+F;AAC/F,yCAAwC;AAExC,qDAAkE;AAClE,2DAAoF;AAEpF;;;;;;;;GAQG;AAEH,MAAM,EAAE,GAAmB,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,wEAAwE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC/K,MAAM,IAAI,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,6FAA6F,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC1M,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,sEAAsE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACzL,MAAM,QAAQ,GAAmB,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,oDAAoD,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACnK,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,0BAA0B,EAAE,GAAG,EAAE,wBAAwB,EAAE,KAAK,EAAE,4EAA4E,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC9M,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,yBAAyB,EAAE,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,gCAAgC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAE/J,KAAK,UAAU,UAAU,CAAC,CAAgB;IACxC,MAAM,IAAI,GAAG,IAAA,0BAAU,EAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACjC,IAAI,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,IAAA,+BAAkB,EAAC,IAAI,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC9E,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,IAAA,mBAAO,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAI,EAAC,IAAA,mBAAO,EAAC,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,oBAAU,EAAC,CAAC,CAAC,CAAC,CAAC;IAChH,IAAI,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAC1B,OAAO,EAAE,MAAM,EAAE,MAAM,IAAA,6BAAgB,EAAC,EAAE,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;AAC3E,CAAC;AAED,SAAS,GAAG,CAAC,CAAgB;IAC3B,OAAO,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC5D,CAAC;AAEY,QAAA,gBAAgB,GAAoB;IAC/C,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,YAAY;IACpB,KAAK,EAAE,YAAY;IACnB,IAAI,EAAE,wYAAwY;IAC9Y,MAAM,EAAE;QACN,KAAK,EAAE,0EAA0E;QACjF,WAAW,EAAE,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC;QACzC,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,IAAI,GAAG,IAAA,2BAAW,EAAC,CAAC,EAAE,MAAM,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;YACxD,IAAI,IAAI;gBAAE,OAAO,IAAA,uBAAU,EAAC,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,IAAA,6CAAyB,EAAC,EAAE,WAAW,EAAE,IAAA,yCAAqB,EAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACvJ,MAAM,IAAI,GAAG,MAAM,IAAA,uBAAU,EAAC,YAAY,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;YACjE,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,iBAAQ,CAAC,oLAAoL,CAAC,CAAC;YACpN,OAAO,IAAA,6CAAyB,EAAC,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1F,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,6EAA6E;QACpF,WAAW,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC;QAC1D,MAAM,EAAE;YACN,4IAA4I;YAC5I,yJAAyJ;YACzJ,6HAA6H;YAC7H,0CAA0C;SAC3C;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,IAAI,GAAG,MAAM,IAAA,uBAAU,EAAC,YAAY,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;YACjE,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,iBAAQ,CAAC,qJAAqJ,CAAC,CAAC;YACrL,MAAM,WAAW,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC/F,MAAM,GAAG,GAAG,IAAA,6BAAgB,EAAC,IAAI,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,iBAAiB,EAAE,IAAA,gCAAgB,EAAC,CAAC,EAAE,UAAU,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACjJ,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,YAAY;QACpB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,GAA2B,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC5D,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YACjB,IAAI,CAAC;gBAAE,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;YACpB,IAAI,CAAC,UAAU,KAAK,OAAO,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,YAAY;QACpB,MAAM,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,MAAM,GAA2B,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9D,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YACjB,IAAI,CAAC;gBAAE,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC;YACtB,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC;YAC9B,OAAO,MAAM,CAAC;QAChB,CAAC;KACF;IACD,OAAO,EAAE,YAAY;CACtB,CAAC"}

package/dist/migrate/propelauth/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const propelauthPlugin: MigrationPlugin;

package/dist/migrate/propelauth/plugin.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.propelauthPlugin = void 0;
+const propelauth_1 = require("../export/propelauth");
+const propelauth_config_1 = require("../export/propelauth-config");
+const plugin_kit_1 = require("../export/plugin-kit");
+/**
+ * `atlas migrate propelauth` — users, organizations, roles and pending
+ * invitations through PropelAuth's backend API (auth URL + API key, on this
+ * machine), password hashes from the export PropelAuth support provides when
+ * the owner has it, and the `propelauth` bridge preset (RS256 access tokens
+ * verified with the project's verifier key). PropelAuth has no password-verify
+ * API, so there is no lazy-migration preset.
+ */
+const AUTH_URL = { flag: '--propelauth-auth-url', env: 'PROPELAUTH_AUTH_URL', label: 'your PropelAuth auth URL (https://123456.propelauthtest.com)', required: true };
+const API_KEY = { flag: '--propelauth-api-key', env: 'PROPELAUTH_API_KEY', label: 'a PropelAuth backend API key', required: true, secret: true };
+const HASHES_FILE = { flag: '--propelauth-hashes-file', env: 'PROPELAUTH_HASHES_FILE', label: 'the password-hash export from PropelAuth support', required: false };
+/** The auth URL from the flag or env, else the one the app already uses (`NEXT_PUBLIC_AUTH_URL`). */
+function authUrl(p) {
+    const raw = p.credential({ ...AUTH_URL, required: false }) ?? (p.ctx.env.NEXT_PUBLIC_AUTH_URL?.trim() || (0, plugin_kit_1.need)(p, AUTH_URL));
+    return (0, propelauth_1.normalizeAuthUrl)(raw);
+}
+exports.propelauthPlugin = {
+    vendor: 'propelauth',
+    source: 'propelauth',
+    label: 'PropelAuth',
+    help: 'Move a PropelAuth project: users with their verified emails, usernames and metadata, organizations with members, roles and permissions, pending invitations, password hashes from the export PropelAuth support provides, a zero-logout bridge for PropelAuth access tokens, and the code. Your API key stays on this machine.',
+    config: {
+        reads: 'your PropelAuth project via the backend API (role mappings, organizations with SAML)',
+        credentials: [AUTH_URL, API_KEY],
+        async translate(p) {
+            const url = authUrl(p);
+            const http = (0, propelauth_1.propelauthHttp)({ authUrl: url, apiKey: (0, plugin_kit_1.need)(p, API_KEY), fetchImpl: p.fetch });
+            return (0, propelauth_config_1.translatePropelauthConfig)(await (0, plugin_kit_1.vendorStep)('PropelAuth', () => (0, propelauth_config_1.fetchPropelauthConfig)(http, url)));
+        },
+    },
+    export: {
+        reads: 'the PropelAuth backend API (users, organizations, invitations) and the support hash export (--propelauth-hashes-file)',
+        credentials: [AUTH_URL, API_KEY, HASHES_FILE],
+        limits: [
+            'PropelAuth has no password-verify API and does not return hashes: PropelAuth support can export them on request. Pass that file with --propelauth-hashes-file; without it members set a password again on first sign-in.',
+            'TOTP secrets, social-account ids and end-user API key secrets cannot be exported: members enrol their second factor again, relink social accounts by verified email and reissue API keys.',
+            'SAML connections cannot be read back (the IdP settings are write-only): set each one up again in Atlas.',
+            'Sessions are not exported: PropelAuth access tokens are exchanged by the propelauth bridge preset, which needs your project\'s verifier key.',
+        ],
+        async run(p, writer, resume) {
+            const set = await (0, plugin_kit_1.vendorStep)('PropelAuth', () => (0, propelauth_1.exportPropelauth)({
+                authUrl: authUrl(p),
+                apiKey: (0, plugin_kit_1.need)(p, API_KEY),
+                hashesText: (0, plugin_kit_1.localFile)(p, HASHES_FILE, 'text'),
+                fetchImpl: p.fetch,
+                onProgress: (m) => p.say(`  reading ${m}`),
+            }));
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    bridge: {
+        preset: 'propelauth',
+        vars(p, t) {
+            return { ...t?.bridge?.vars, auth_url: t?.bridge?.vars.auth_url ?? authUrl(p) };
+        },
+    },
+    codemod: 'propelauth',
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/propelauth/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/propelauth/plugin.ts"],"names":[],"mappings":";;;AAAA,qDAA0F;AAC1F,mEAA+F;AAE/F,qDAAmF;AAEnF;;;;;;;GAOG;AAEH,MAAM,QAAQ,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,8DAA8D,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACtL,MAAM,OAAO,GAAmB,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,8BAA8B,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACjK,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,0BAA0B,EAAE,GAAG,EAAE,wBAAwB,EAAE,KAAK,EAAE,kDAAkD,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAEpL,qGAAqG;AACrG,SAAS,OAAO,CAAC,CAAgB;IAC/B,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,IAAI,IAAA,iBAAI,EAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC5H,OAAO,IAAA,6BAAgB,EAAC,GAAG,CAAC,CAAC;AAC/B,CAAC;AAEY,QAAA,gBAAgB,GAAoB;IAC/C,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,YAAY;IACpB,KAAK,EAAE,YAAY;IACnB,IAAI,EAAE,gUAAgU;IACtU,MAAM,EAAE;QACN,KAAK,EAAE,sFAAsF;QAC7F,WAAW,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;QAChC,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACvB,MAAM,IAAI,GAAG,IAAA,2BAAc,EAAC,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YAC5F,OAAO,IAAA,6CAAyB,EAAC,MAAM,IAAA,uBAAU,EAAC,YAAY,EAAE,GAAG,EAAE,CAAC,IAAA,yCAAqB,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAC3G,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,uHAAuH;QAC9H,WAAW,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,WAAW,CAAC;QAC7C,MAAM,EAAE;YACN,0NAA0N;YAC1N,2LAA2L;YAC3L,yGAAyG;YACzG,8IAA8I;SAC/I;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,YAAY,EAAE,GAAG,EAAE,CAC9C,IAAA,6BAAgB,EAAC;gBACf,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;gBACnB,MAAM,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,OAAO,CAAC;gBACxB,UAAU,EAAE,IAAA,sBAAS,EAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC;gBAC7C,SAAS,EAAE,CAAC,CAAC,KAAK;gBAClB,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;aAC3C,CAAC,CACH,CAAC;YACF,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,YAAY;QACpB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,CAAC;KACF;IACD,OAAO,EAAE,YAAY;CACtB,CAAC"}

package/dist/migrate/saml/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const samlPlugin: MigrationPlugin;

package/dist/migrate/saml/plugin.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.samlPlugin = void 0;
+const node_path_1 = require("node:path");
+const errors_1 = require("../../errors");
+const plugin_kit_1 = require("../export/plugin-kit");
+const sso_metadata_1 = require("../export/sso-metadata");
+const translate_kit_1 = require("../export/translate-kit");
+/**
+ * `atlas migrate saml export --set saml-metadata=<file or https URL>` — any
+ * SAML 2.0 identity provider (Ping, OneLogin, Okta, ADFS, Entra, Shibboleth,
+ * Keycloak …) from its metadata: an Atlas SSO connection with the IdP's
+ * entity id, sign-on URL and signing certificate. The users stay in the IdP:
+ * they sign in through it, now via Atlas, and relink on their verified email.
+ */
+const METADATA = { flag: 'saml-metadata', env: 'SAML_METADATA', label: 'the IdP metadata: a file, or an https:// URL', required: true };
+const DOMAINS = { flag: 'saml-domains', env: 'SAML_DOMAINS', label: 'email domains that sign in through this IdP (comma separated)', required: false };
+const NAME = { flag: 'saml-name', env: 'SAML_CONNECTION_NAME', label: 'a name for the connection', required: false };
+const ORG = { flag: 'saml-organization', env: 'SAML_ORGANIZATION', label: 'create the connection inside an organization with this name', required: false };
+async function metadata(p) {
+    const src = p.credential({ ...METADATA, required: true });
+    if (/^https:\/\//i.test(src)) {
+        const res = await p.fetch(src, { headers: { accept: 'application/samlmetadata+xml, application/xml, text/xml' }, redirect: 'error' });
+        if (res.status !== 200)
+            throw new errors_1.CliError(`${src} answered ${res.status}.`);
+        return { xml: await res.text(), url: src };
+    }
+    if (/^http:\/\//i.test(src))
+        throw new errors_1.CliError('The metadata URL must be https://.');
+    return { xml: p.ctx.readFile((0, node_path_1.resolve)(src)) };
+}
+function build(p, xml, url) {
+    const domains = (p.credential(DOMAINS) ?? '').split(',').map((d) => d.trim().toLowerCase()).filter(Boolean);
+    try {
+        return (0, sso_metadata_1.samlConnections)(xml, { name: p.credential(NAME), domains: domains.length ? domains : undefined, metadataUrl: url });
+    }
+    catch (err) {
+        throw new errors_1.CliError(err.message);
+    }
+}
+exports.samlPlugin = {
+    vendor: 'saml',
+    source: 'saml',
+    label: 'Any SAML identity provider',
+    help: 'Move a SAML single sign-on connection: read the IdP metadata (--set saml-metadata=<file or URL>) and create the Atlas SSO connection from it (entity id, sign-on URL, signing certificate, email domains). Afterwards give the IdP Atlas\'s entity id and ACS URL and switch the application to Atlas. The IdP\'s users are not exportable over SAML: they relink on their verified email at first sign-in.',
+    config: {
+        reads: 'the IdP metadata document',
+        credentials: [METADATA, DOMAINS, NAME],
+        async translate(p) {
+            const { xml, url } = await metadata(p);
+            const { connections, warnings } = build(p, xml, url);
+            const b = new translate_kit_1.ConfigBuilder();
+            for (const c of connections) {
+                b.add('mapped', 'saml', `${c.saml?.idp_entity_id}`, 'Becomes an Atlas SSO connection (atlas migrate saml export + import). Give the IdP Atlas\'s entity id and ACS URL, shown after the import.', 'sso_connections');
+                if (!c.domains?.length)
+                    b.add('manual', 'saml', `${c.saml?.idp_entity_id} domains`, 'Name the email domains that sign in through this IdP (--set saml-domains=…) so Atlas routes them to it.', 'sso_connections');
+            }
+            for (const w of warnings)
+                b.add('differs', 'saml', 'metadata', w);
+            return b.result(`SAML metadata ${url ?? ''}`.trim());
+        },
+    },
+    export: {
+        reads: 'the IdP metadata document (--set saml-metadata=<file or https URL>)',
+        credentials: [METADATA, DOMAINS, NAME, ORG],
+        limits: ['A SAML identity provider exposes no user list: users sign in through it and link to Atlas accounts on their verified email.'],
+        async run(p, writer, resume) {
+            const { xml, url } = await metadata(p);
+            const { connections, warnings } = build(p, xml, url);
+            const org = p.credential(ORG);
+            const set = (0, sso_metadata_1.connectionSet)(connections, `SAML metadata ${url ?? ''}`.trim(), org ? { id: org.toLowerCase().replace(/[^a-z0-9]+/g, '-'), name: org } : undefined);
+            for (const w of warnings)
+                set.warn(w);
+            p.say(`  ${connections.length} identity provider(s) in the metadata`);
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/saml/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/saml/plugin.ts"],"names":[],"mappings":";;;AAAA,yCAAoC;AACpC,yCAAwC;AACxC,qDAAsD;AACtD,yDAAwE;AACxE,2DAAwD;AAGxD;;;;;;GAMG;AAEH,MAAM,QAAQ,GAAmB,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,8CAA8C,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACxJ,MAAM,OAAO,GAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,+DAA+D,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACvK,MAAM,IAAI,GAAmB,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,2BAA2B,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACrI,MAAM,GAAG,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,6DAA6D,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAE3K,KAAK,UAAU,QAAQ,CAAC,CAAgB;IACtC,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAE,CAAC;IAC3D,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,yDAAyD,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACtI,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,MAAM,IAAI,iBAAQ,CAAC,GAAG,GAAG,aAAa,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QAC7E,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IAC7C,CAAC;IACD,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,iBAAQ,CAAC,oCAAoC,CAAC,CAAC;IACtF,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAA,mBAAO,EAAC,GAAG,CAAC,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,KAAK,CAAC,CAAgB,EAAE,GAAW,EAAE,GAAY;IACxD,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5G,IAAI,CAAC;QACH,OAAO,IAAA,8BAAe,EAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7H,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,iBAAQ,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAEY,QAAA,UAAU,GAAoB;IACzC,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,MAAM;IACd,KAAK,EAAE,4BAA4B;IACnC,IAAI,EAAE,6YAA6Y;IACnZ,MAAM,EAAE;QACN,KAAK,EAAE,2BAA2B;QAClC,WAAW,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC;QACtC,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;YACvC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,MAAM,CAAC,GAAG,IAAI,6BAAa,EAAE,CAAC;YAC9B,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;gBAC5B,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,aAAa,EAAE,EAAE,4IAA4I,EAAE,iBAAiB,CAAC,CAAC;gBACrN,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM;oBAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,aAAa,UAAU,EAAE,yGAAyG,EAAE,iBAAiB,CAAC,CAAC;YACpN,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,QAAQ;gBAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;YAClE,OAAO,CAAC,CAAC,MAAM,CAAC,iBAAiB,GAAG,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,qEAAqE;QAC5E,WAAW,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC;QAC3C,MAAM,EAAE,CAAC,6HAA6H,CAAC;QACvI,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;YACvC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAC9B,MAAM,GAAG,GAAG,IAAA,4BAAa,EAAC,WAAW,EAAE,iBAAiB,GAAG,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAChK,KAAK,MAAM,CAAC,IAAI,QAAQ;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACtC,CAAC,CAAC,GAAG,CAAC,KAAK,WAAW,CAAC,MAAM,uCAAuC,CAAC,CAAC;YACtE,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;CACF,CAAC"}

package/dist/migrate/stytch/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const stytchPlugin: MigrationPlugin;

package/dist/migrate/stytch/plugin.js

@@ -0,0 +1,97 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.stytchPlugin = void 0;
+const stytch_1 = require("../export/stytch");
+const stytch_config_1 = require("../export/stytch-config");
+const plugin_kit_1 = require("../export/plugin-kit");
+/**
+ * `atlas migrate stytch` — a Stytch project (consumer or B2B) through the
+ * Stytch API with the project id and secret (on this machine): users with
+ * verified emails and phones, OAuth identities, organizations, members, roles
+ * and SSO connections as data, RBAC as Atlas config; password hashes from the
+ * export Stytch support provides; the `stytch` bridge preset (session JWTs
+ * verified against the project's JWKS) and lazy migration through Stytch's
+ * password authentication.
+ */
+const PROJECT_ID = { flag: '--stytch-project-id', env: 'STYTCH_PROJECT_ID', label: 'your Stytch project id (project-live-…)', required: true };
+const SECRET = { flag: '--stytch-secret', env: 'STYTCH_SECRET', label: 'your Stytch project secret', required: true, secret: true };
+const HASHES = { flag: '--stytch-hashes', env: 'STYTCH_HASHES_FILE', label: 'the password-hash export from Stytch support', required: false };
+const PRODUCT = { flag: '--stytch-product', env: 'STYTCH_PRODUCT', label: 'consumer or b2b (detected when omitted)', required: false };
+const BASE_URL = { flag: '--stytch-base-url', env: 'STYTCH_BASE_URL', label: 'the Stytch API base URL (custom domain)', required: false };
+function baseUrl(p) {
+    return p.credential(BASE_URL)?.replace(/\/+$/, '');
+}
+function productOpt(p) {
+    const v = p.credential(PRODUCT)?.trim().toLowerCase();
+    if (v === undefined || v === '')
+        return undefined;
+    if (v !== 'consumer' && v !== 'b2b')
+        throw new Error(`${PRODUCT.flag} must be "consumer" or "b2b"`);
+    return v;
+}
+function http(p) {
+    return (0, stytch_1.stytchHttp)({ projectId: (0, plugin_kit_1.need)(p, PROJECT_ID), secret: (0, plugin_kit_1.need)(p, SECRET), baseUrl: baseUrl(p), fetchImpl: p.fetch });
+}
+exports.stytchPlugin = {
+    vendor: 'stytch',
+    source: 'stytch',
+    label: 'Stytch',
+    help: 'Move a Stytch project (consumer or B2B): users with verified emails and phones and OAuth identities, organizations with members, roles and SSO connections, RBAC as Atlas config, password hashes from the export Stytch support provides, a zero-logout bridge for Stytch session JWTs, lazy migration through Stytch password authentication, and the code. Your project secret stays on this machine.',
+    config: {
+        reads: 'your Stytch project via the API (RBAC policy, organizations, SSO connections)',
+        credentials: [PROJECT_ID, SECRET, PRODUCT, BASE_URL],
+        async translate(p) {
+            const projectId = (0, plugin_kit_1.need)(p, PROJECT_ID);
+            const client = http(p);
+            const snap = await (0, plugin_kit_1.vendorStep)('Stytch', async () => (0, stytch_config_1.fetchStytchConfig)(client, projectId, productOpt(p) ?? (await (0, stytch_1.detectStytchProduct)(client))));
+            return (0, stytch_config_1.translateStytchConfig)(snap);
+        },
+    },
+    export: {
+        reads: 'the Stytch API (users, or organizations, members and SSO connections, plus the RBAC policy) and, if you have one, the support hash export (--stytch-hashes)',
+        credentials: [PROJECT_ID, SECRET, HASHES, PRODUCT, BASE_URL],
+        limits: [
+            'Stytch only provides password hashes through support (support@stytch.com): pass that file with --stytch-hashes; otherwise passwords move by lazy migration (checked against Stytch on each user\'s first sign-in).',
+            'TOTP secrets, passkeys (WebAuthn) and crypto wallets are not exportable: users enrol again.',
+            'SCIM bearer tokens and OIDC client secrets are not returned: recreate those connections in Atlas.',
+            'Sessions are not exported: Stytch session JWTs are exchanged by the stytch bridge preset.',
+        ],
+        async run(p, writer, resume) {
+            const set = await (0, plugin_kit_1.vendorStep)('Stytch', () => (0, stytch_1.exportStytch)({
+                projectId: (0, plugin_kit_1.need)(p, PROJECT_ID),
+                secret: (0, plugin_kit_1.need)(p, SECRET),
+                product: productOpt(p),
+                baseUrl: baseUrl(p),
+                hashesText: (0, plugin_kit_1.localFile)(p, HASHES, 'text'),
+                fetchImpl: p.fetch,
+                onProgress: (m) => p.say(`  reading ${m}`),
+            }));
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    bridge: {
+        preset: 'stytch',
+        vars(p, t) {
+            if (t?.bridge)
+                return t.bridge.vars;
+            const projectId = (0, plugin_kit_1.need)(p, PROJECT_ID);
+            return {
+                project_id: projectId,
+                ...(projectId.startsWith('project-test-') ? { api_host: 'test.stytch.com' } : {}),
+                ...(productOpt(p) === 'b2b' ? { jwks_path: 'b2b/sessions' } : {}),
+            };
+        },
+    },
+    lazy: {
+        preset: 'stytch',
+        config(p, t) {
+            if (t?.lazy)
+                return t.lazy.config;
+            const product = productOpt(p);
+            return { project_id: (0, plugin_kit_1.need)(p, PROJECT_ID), ...(product ? { product } : {}) };
+        },
+        secret: SECRET,
+    },
+    codemod: 'stytch',
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/stytch/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/stytch/plugin.ts"],"names":[],"mappings":";;;AAAA,6CAAqG;AACrG,2DAAmF;AAEnF,qDAAmF;AAEnF;;;;;;;;GAQG;AAEH,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,yCAAyC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC/J,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,4BAA4B,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACpJ,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,8CAA8C,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC9J,MAAM,OAAO,GAAmB,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,yCAAyC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACvJ,MAAM,QAAQ,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,yCAAyC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAE1J,SAAS,OAAO,CAAC,CAAgB;IAC/B,OAAO,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,UAAU,CAAC,CAAgB;IAClC,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtD,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAClD,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,8BAA8B,CAAC,CAAC;IACpG,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,IAAI,CAAC,CAAgB;IAC5B,OAAO,IAAA,mBAAU,EAAC,EAAE,SAAS,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AAC1H,CAAC;AAEY,QAAA,YAAY,GAAoB;IAC3C,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,QAAQ;IACf,IAAI,EAAE,0YAA0Y;IAChZ,MAAM,EAAE;QACN,KAAK,EAAE,+EAA+E;QACtF,WAAW,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;QACpD,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,SAAS,GAAG,IAAA,iBAAI,EAAC,CAAC,EAAE,UAAU,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACvB,MAAM,IAAI,GAAG,MAAM,IAAA,uBAAU,EAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,IAAA,iCAAiB,EAAC,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,IAAA,4BAAmB,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAChJ,OAAO,IAAA,qCAAqB,EAAC,IAAI,CAAC,CAAC;QACrC,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,6JAA6J;QACpK,WAAW,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;QAC5D,MAAM,EAAE;YACN,oNAAoN;YACpN,6FAA6F;YAC7F,mGAAmG;YACnG,2FAA2F;SAC5F;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,QAAQ,EAAE,GAAG,EAAE,CAC1C,IAAA,qBAAY,EAAC;gBACX,SAAS,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,UAAU,CAAC;gBAC9B,MAAM,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,MAAM,CAAC;gBACvB,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;gBACtB,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;gBACnB,UAAU,EAAE,IAAA,sBAAS,EAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC;gBACxC,SAAS,EAAE,CAAC,CAAC,KAAK;gBAClB,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;aAC3C,CAAC,CACH,CAAC;YACF,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,QAAQ;QAChB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,IAAI,CAAC,EAAE,MAAM;gBAAE,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;YACpC,MAAM,SAAS,GAAG,IAAA,iBAAI,EAAC,CAAC,EAAE,UAAU,CAAC,CAAC;YACtC,OAAO;gBACL,UAAU,EAAE,SAAS;gBACrB,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjF,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClE,CAAC;QACJ,CAAC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,QAAQ;QAChB,MAAM,CAAC,CAAC,EAAE,CAAC;YACT,IAAI,CAAC,EAAE,IAAI;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;YAClC,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC9B,OAAO,EAAE,UAAU,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,UAAU,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC9E,CAAC;QACD,MAAM,EAAE,MAAM;KACf;IACD,OAAO,EAAE,QAAQ;CAClB,CAAC"}

package/dist/migrate/supabase/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const supabasePlugin: MigrationPlugin;