@atlasauth/cli 0.11.0 → 0.13.0

package/dist/migrate/supabase/plugin.js

@@ -0,0 +1,149 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.supabasePlugin = void 0;
+const node_path_1 = require("node:path");
+const supabase_1 = require("../export/supabase");
+const supabase_config_1 = require("../export/supabase-config");
+const errors_1 = require("../../errors");
+const plugin_kit_1 = require("../export/plugin-kit");
+/**
+ * `atlas migrate supabase` — Supabase Auth, hosted or self-hosted: its
+ * `config.toml` (or the hosted project's settings through the Management
+ * API) as Atlas config; users with their bcrypt / argon2 / Firebase-scrypt
+ * hashes, identities, SAML connections, TOTP secrets, phone and WebAuthn
+ * factors, recovery-code hashes and live sessions from a dump of the auth
+ * schema made on this machine; the `supabase` bridge preset (a Supabase
+ * access token becomes an Atlas session); lazy migration when only the Admin
+ * API is available; and the code. Nothing here connects to the database.
+ */
+const PROJECT_URL = { flag: '--supabase-url', env: 'SUPABASE_URL', label: 'your project URL (https://<ref>.supabase.co)', required: false };
+const DUMP = { flag: '--supabase-dump', env: 'SUPABASE_DUMP_DIR', label: 'a folder of auth-schema table dumps (users.csv, identities.csv, …)', required: false };
+const SERVICE_ROLE = { flag: '--supabase-service-role-key', env: 'SUPABASE_SERVICE_ROLE_KEY', label: 'the service_role / secret key (Admin API export only)', required: false, secret: true };
+const CONFIG_FILE = { flag: '--supabase-config', env: 'SUPABASE_CONFIG_TOML', label: 'supabase/config.toml', required: false };
+const ACCESS_TOKEN = { flag: '--supabase-access-token', env: 'SUPABASE_ACCESS_TOKEN', label: 'a personal access token (Management API)', required: false, secret: true };
+const PROJECT_REF = { flag: '--supabase-project-ref', env: 'SUPABASE_PROJECT_REF', label: 'the project ref (the subdomain of <ref>.supabase.co)', required: false };
+const ANONYMOUS = { flag: '--supabase-anonymous', env: 'SUPABASE_ANONYMOUS', label: '"include" to export anonymous users too', required: false };
+const ANON_KEY = { flag: '--supabase-anon-key', env: 'SUPABASE_ANON_KEY', label: 'the anon / publishable key, for lazy migration', required: false };
+const DB_KEYS = { flag: '--supabase-db-encryption-keys', env: 'GOTRUE_SECURITY_DB_ENCRYPTION_KEYS', label: 'GoTrue column-encryption keys, comma-separated key_id:key (only when GOTRUE_SECURITY_DB_ENCRYPTION_ENCRYPT is on)', required: false, secret: true };
+const BRIDGE = { flag: '--supabase-bridge', env: 'SUPABASE_BRIDGE', label: 'what the bridge exchanges: access-token (default; up to a week past expiry) or refresh-token (the sessions the dump imported)', required: false };
+const AUTH_URL = { flag: '--supabase-auth-url', env: 'SUPABASE_AUTH_URL', label: 'self-hosted or custom domain: the Auth URL (https://db.example.com/auth/v1)', required: false };
+const COOKIE_NAME = { flag: '--supabase-cookie-name', env: 'SUPABASE_COOKIE_NAME', label: 'self-hosted: the SSR cookie name (sb-<first label of the host>-auth-token)', required: false };
+const RP_ID = { flag: '--rp-id', env: 'ATLAS_MIGRATE_RP_ID', label: 'the WebAuthn relying party id passkeys were registered for', required: false };
+/** The project ref, from the flag or a hosted URL. */
+function refOf(p) {
+    const ref = p.credential(PROJECT_REF);
+    if (ref)
+        return ref.trim();
+    const url = p.credential(PROJECT_URL);
+    return url ? /^https:\/\/([a-z0-9]+)\.supabase\.co\/?$/.exec(url.trim())?.[1] : undefined;
+}
+/**
+ * `supabase` (hosted access tokens), `supabase_self_hosted` (an Auth URL of
+ * your own) or `supabase_refresh_token` (refresh tokens among the sessions the
+ * dump imported; hosted cookie names).
+ */
+function bridgePreset(p) {
+    const mode = (p.credential(BRIDGE) ?? 'access-token').trim().toLowerCase();
+    if (mode === 'refresh-token') {
+        if (p.credential(AUTH_URL))
+            throw new errors_1.CliError('Supabase: --set supabase-bridge=refresh-token reads the hosted cookie (sb-<ref>-auth-token); for a self-hosted project use the access-token bridge, or set the preset and cookie name through the bridge API.');
+        return 'supabase_refresh_token';
+    }
+    if (mode !== 'access-token')
+        throw new errors_1.CliError(`Supabase: --set supabase-bridge takes access-token or refresh-token (got ${mode}).`);
+    return p.credential(AUTH_URL) ? 'supabase_self_hosted' : 'supabase';
+}
+exports.supabasePlugin = {
+    vendor: 'supabase',
+    source: 'supabase',
+    label: 'Supabase Auth',
+    help: 'Move Supabase Auth (hosted or self-hosted): config.toml or the hosted project settings as Atlas config; users with their password hashes, social and SAML identities, TOTP secrets, phone and WebAuthn factors and live sessions from a dump of the auth schema you make with psql; a zero-logout bridge for Supabase access tokens; lazy migration when you only have the Admin API; and the code. Database access stays on this machine.',
+    config: {
+        reads: 'supabase/config.toml (or the hosted project through the Management API)',
+        credentials: [CONFIG_FILE, ACCESS_TOKEN, PROJECT_REF, PROJECT_URL],
+        async translate(p) {
+            const token = p.credential(ACCESS_TOKEN);
+            const ref = refOf(p);
+            if (token && ref) {
+                return (0, supabase_config_1.translateSupabaseConfig)(await (0, plugin_kit_1.vendorStep)('Supabase', () => (0, supabase_config_1.fetchSupabaseAuthConfig)({ projectRef: ref, accessToken: token, fetchImpl: p.fetch })));
+            }
+            const path = p.credential(CONFIG_FILE) ?? `${p.project}/supabase/config.toml`;
+            let text;
+            try {
+                text = p.ctx.readFile((0, node_path_1.resolve)(path));
+            }
+            catch {
+                throw new errors_1.CliError(`Supabase: no config.toml at ${path}. Pass --set supabase-config=<path>, or a personal access token and project ref to read the hosted project.`);
+            }
+            const settings = (0, supabase_config_1.settingsFromToml)(text, path);
+            return (0, supabase_config_1.translateSupabaseConfig)(ref ? { ...settings, projectRef: ref } : settings);
+        },
+    },
+    export: {
+        reads: 'a dump of the auth schema (psql \\copy of auth.users, identities, mfa_factors, sessions, refresh_tokens, sso_*, webauthn_credentials) or the Admin API',
+        credentials: [DUMP, PROJECT_URL, SERVICE_ROLE, ANONYMOUS, RP_ID, DB_KEYS],
+        limits: [
+            'Password hashes, TOTP secrets and sessions live only in the database: dump the auth schema (see the guide). The Admin API export has none of them, and passwords then move by lazy migration.',
+            'Values encrypted with GoTrue column encryption (GOTRUE_SECURITY_DB_ENCRYPTION_*) are decrypted on this machine with --set supabase-db-encryption-keys=<key_id>:<key>; without the keys those passwords move by lazy migration and those TOTP users enrol again.',
+            'Recovery codes move as their argon2id hashes; passkeys and WebAuthn factors only with --rp-id and when Atlas serves sign-in on that domain.',
+            'Refresh tokens in the newer signed format (no auth.refresh_tokens row) cannot be exported; the supabase bridge still exchanges the access token.',
+        ],
+        async run(p, writer, resume) {
+            const dump = p.credential(DUMP);
+            const url = p.credential(PROJECT_URL);
+            const key = dump ? undefined : p.credential(SERVICE_ROLE);
+            if (!dump && !(url && key)) {
+                throw new errors_1.CliError('Supabase: pass a folder of auth-schema dumps (--set supabase-dump=<folder>), or the project URL and service_role key for an Admin API export without password hashes.');
+            }
+            const set = await (0, plugin_kit_1.vendorStep)('Supabase', () => (0, supabase_1.exportSupabase)({
+                dumpDir: dump ? (0, node_path_1.resolve)(dump) : undefined,
+                url,
+                serviceRoleKey: key,
+                rpId: p.credential(RP_ID),
+                includeAnonymous: p.credential(ANONYMOUS) === 'include',
+                dbEncryptionKeys: p.credential(DB_KEYS)?.split(',').map((k) => k.trim()).filter(Boolean),
+                fetchImpl: p.fetch,
+                onProgress: (m) => p.say(`  reading ${m}`),
+            }));
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    bridge: {
+        preset: 'supabase',
+        presetFor: bridgePreset,
+        vars(p, t) {
+            const vars = { ...t?.bridge?.vars };
+            const preset = bridgePreset(p);
+            if (preset === 'supabase_self_hosted') {
+                const authUrl = p.credential(AUTH_URL).trim().replace(/\/+$/, '');
+                delete vars.project_ref;
+                vars.auth_url = authUrl;
+                const host = /^https?:\/\/([^/:]+)/i.exec(authUrl)?.[1];
+                if (!host)
+                    throw new errors_1.CliError(`Supabase: --set supabase-auth-url must be an https URL ending in /auth/v1 (got ${authUrl}).`);
+                // @supabase/ssr names the cookie after the first label of the project host.
+                vars.cookie_name = p.credential(COOKIE_NAME)?.trim() ?? `sb-${host.split('.')[0]}-auth-token`;
+                return vars;
+            }
+            const ref = refOf(p);
+            if (ref)
+                vars.project_ref = ref;
+            return vars;
+        },
+    },
+    lazy: {
+        preset: 'supabase',
+        config(p, t) {
+            const config = { ...t?.lazy?.config };
+            const url = p.credential(PROJECT_URL);
+            if (url)
+                config.url = url.trim().replace(/\/+$/, '');
+            const anon = p.credential(ANON_KEY);
+            if (anon)
+                config.anon_key = anon;
+            return config;
+        },
+    },
+    codemod: 'supabase',
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/supabase/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/supabase/plugin.ts"],"names":[],"mappings":";;;AAAA,yCAAoC;AACpC,iDAAoD;AACpD,+DAA+G;AAC/G,yCAAwC;AAExC,qDAAkE;AAElE;;;;;;;;;GASG;AAEH,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,8CAA8C,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC5J,MAAM,IAAI,GAAmB,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,oEAAoE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACjL,MAAM,YAAY,GAAmB,EAAE,IAAI,EAAE,6BAA6B,EAAE,GAAG,EAAE,2BAA2B,EAAE,KAAK,EAAE,uDAAuD,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC9M,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,sBAAsB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC/I,MAAM,YAAY,GAAmB,EAAE,IAAI,EAAE,yBAAyB,EAAE,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,0CAA0C,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACzL,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,wBAAwB,EAAE,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,sDAAsD,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACpL,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,yCAAyC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACjK,MAAM,QAAQ,GAAmB,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,gDAAgD,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACrK,MAAM,OAAO,GAAmB,EAAE,IAAI,EAAE,+BAA+B,EAAE,GAAG,EAAE,oCAAoC,EAAE,KAAK,EAAE,mHAAmH,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAChR,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,+HAA+H,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC9O,MAAM,QAAQ,GAAmB,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,6EAA6E,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAClM,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,wBAAwB,EAAE,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,4EAA4E,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC1M,MAAM,KAAK,GAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,4DAA4D,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAEpK,sDAAsD;AACtD,SAAS,KAAK,CAAC,CAAgB;IAC7B,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IACtC,OAAO,GAAG,CAAC,CAAC,CAAC,0CAA0C,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5F,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,CAAgB;IACpC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3E,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,iBAAQ,CAAC,+MAA+M,CAAC,CAAC;QAChQ,OAAO,wBAAwB,CAAC;IAClC,CAAC;IACD,IAAI,IAAI,KAAK,cAAc;QAAE,MAAM,IAAI,iBAAQ,CAAC,4EAA4E,IAAI,IAAI,CAAC,CAAC;IACtI,OAAO,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,UAAU,CAAC;AACtE,CAAC;AAEY,QAAA,cAAc,GAAoB;IAC7C,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,UAAU;IAClB,KAAK,EAAE,eAAe;IACtB,IAAI,EAAE,4aAA4a;IAClb,MAAM,EAAE;QACN,KAAK,EAAE,yEAAyE;QAChF,WAAW,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,CAAC;QAClE,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;YACzC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACrB,IAAI,KAAK,IAAI,GAAG,EAAE,CAAC;gBACjB,OAAO,IAAA,yCAAuB,EAAC,MAAM,IAAA,uBAAU,EAAC,UAAU,EAAE,GAAG,EAAE,CAAC,IAAA,yCAAuB,EAAC,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YAC3J,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,CAAC,OAAO,uBAAuB,CAAC;YAC9E,IAAI,IAAY,CAAC;YACjB,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,iBAAQ,CAAC,+BAA+B,IAAI,6GAA6G,CAAC,CAAC;YACvK,CAAC;YACD,MAAM,QAAQ,GAAG,IAAA,kCAAgB,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC9C,OAAO,IAAA,yCAAuB,EAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACpF,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,wJAAwJ;QAC/J,WAAW,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC;QACzE,MAAM,EAAE;YACN,+LAA+L;YAC/L,iQAAiQ;YACjQ,6IAA6I;YAC7I,kJAAkJ;SACnJ;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAChC,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YACtC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;YAC1D,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,iBAAQ,CAAC,uKAAuK,CAAC,CAAC;YAC9L,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,UAAU,EAAE,GAAG,EAAE,CAC5C,IAAA,yBAAc,EAAC;gBACb,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;gBACzC,GAAG;gBACH,cAAc,EAAE,GAAG;gBACnB,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;gBACzB,gBAAgB,EAAE,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,SAAS;gBACvD,gBAAgB,EAAE,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;gBACxF,SAAS,EAAE,CAAC,CAAC,KAAK;gBAClB,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;aAC3C,CAAC,CACH,CAAC;YACF,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,UAAU;QAClB,SAAS,EAAE,YAAY;QACvB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,GAA2B,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC5D,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;YAC/B,IAAI,MAAM,KAAK,sBAAsB,EAAE,CAAC;gBACtC,MAAM,OAAO,GAAG,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBACnE,OAAO,IAAI,CAAC,WAAW,CAAC;gBACxB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;gBACxB,MAAM,IAAI,GAAG,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBACxD,IAAI,CAAC,IAAI;oBAAE,MAAM,IAAI,iBAAQ,CAAC,kFAAkF,OAAO,IAAI,CAAC,CAAC;gBAC7H,4EAA4E;gBAC5E,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;gBAC9F,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACrB,IAAI,GAAG;gBAAE,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,UAAU;QAClB,MAAM,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,MAAM,GAA2B,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9D,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YACtC,IAAI,GAAG;gBAAE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACrD,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACpC,IAAI,IAAI;gBAAE,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;YACjC,OAAO,MAAM,CAAC;QAChB,CAAC;KACF;IACD,OAAO,EAAE,UAAU;CACpB,CAAC"}

package/dist/migrate/supertokens/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const supertokensPlugin: MigrationPlugin;

package/dist/migrate/supertokens/plugin.js

@@ -0,0 +1,114 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.supertokensPlugin = void 0;
+const node_path_1 = require("node:path");
+const errors_1 = require("../../errors");
+const tables_1 = require("../export/frameworks/tables");
+const plugin_kit_1 = require("../export/plugin-kit");
+const supertokens_1 = require("../export/supertokens");
+const supertokens_config_1 = require("../export/supertokens-config");
+/**
+ * `atlas migrate supertokens` — a SuperTokens core (self-hosted or the managed
+ * service): the core's recipes, providers and token settings as Atlas config;
+ * users with their linked login methods, verified emails, third-party links,
+ * metadata, roles and tenants through the core API with its API key (on this
+ * machine) or from a dump of the core database, which also carries bcrypt /
+ * Argon2 password hashes and TOTP secrets; the `supertokens` bridge preset (the
+ * session's access token verified against your backend's JWKS); lazy migration
+ * through the core's own sign-in; and the code.
+ */
+const CONNECTION_URI = { flag: '--supertokens-connection-uri', env: 'SUPERTOKENS_CONNECTION_URI', label: 'the core address (https://st-dev-xxxx.aws.supertokens.io, or http://localhost:3567)', required: false };
+const API_KEY = { flag: '--supertokens-api-key', env: 'SUPERTOKENS_API_KEY', label: 'the core API key', required: false, secret: true };
+const DUMP = { flag: '--supertokens-dump', env: 'SUPERTOKENS_DUMP_DIR', label: 'a folder of core database table dumps (all_auth_recipe_users.csv, emailpassword_users.csv, …)', required: false };
+const APP_ID = { flag: '--supertokens-app-id', env: 'SUPERTOKENS_APP_ID', label: 'the SuperTokens app id (multi-app cores; default public)', required: false };
+const TENANT_ID = { flag: '--supertokens-tenant-id', env: 'SUPERTOKENS_TENANT_ID', label: 'the tenant the lazy-migration sign-in runs on (default public)', required: false };
+const PREFIX = { flag: '--supertokens-table-prefix', env: 'SUPERTOKENS_TABLE_PREFIX', label: 'the core\'s table_names_prefix, when it has one', required: false };
+const API_DOMAIN = { flag: '--supertokens-api-domain', env: 'SUPERTOKENS_API_DOMAIN', label: 'your backend\'s apiDomain (https://api.example.com), the issuer of your access tokens', required: false };
+const API_BASE_PATH = { flag: '--supertokens-api-base-path', env: 'SUPERTOKENS_API_BASE_PATH', label: 'your backend\'s apiBasePath without slashes (default auth)', required: false };
+function coreUri(p, required) {
+    const raw = p.credential({ ...CONNECTION_URI, required });
+    if (!raw)
+        return undefined;
+    try {
+        return (0, supertokens_1.normalizeCoreUri)(raw);
+    }
+    catch {
+        throw new errors_1.CliError(`SuperTokens: ${raw} is not a core address (https://host or http://host:3567).`);
+    }
+}
+exports.supertokensPlugin = {
+    vendor: 'supertokens',
+    source: 'supertokens',
+    label: 'SuperTokens',
+    help: 'Move a SuperTokens core (self-hosted or managed): its recipes, third-party providers and token settings as Atlas config; users with linked login methods, verified emails, third-party links, metadata, roles and tenants through the core API with its API key (on this machine) or from a dump of the core database, which also carries bcrypt and Argon2 password hashes and TOTP secrets; a zero-logout bridge on your access tokens; lazy migration through the core\'s own sign-in; and the code.',
+    config: {
+        reads: 'your SuperTokens core via its HTTP API',
+        credentials: [CONNECTION_URI, API_KEY, APP_ID],
+        async translate(p) {
+            const uri = coreUri(p, true);
+            const appId = p.credential(APP_ID)?.trim() || 'public';
+            const http = (0, supertokens_1.supertokensHttp)({ connectionUri: uri, apiKey: p.credential(API_KEY), fetchImpl: p.fetch });
+            return (0, supertokens_config_1.translateSupertokensConfig)(await (0, plugin_kit_1.vendorStep)('SuperTokens', () => (0, supertokens_config_1.fetchSupertokensConfig)(http, uri, appId)));
+        },
+    },
+    export: {
+        reads: 'the SuperTokens core API (API key) or a dump of the core database',
+        credentials: [CONNECTION_URI, API_KEY, DUMP, APP_ID, PREFIX],
+        limits: [
+            'The core API never returns password hashes or TOTP secrets: export from the core database (--set supertokens-dump=<folder>) to carry bcrypt and Argon2 hashes and verified TOTP devices; the managed service has no database access, so those users move by lazy migration and enrol their authenticator app again.',
+            'Sessions are not exported: the core keeps only a double hash of each refresh token. The bridge exchanges the access-token JWT a user still holds, verified against your backend\'s JWKS.',
+            'A password hash that is not bcrypt or Argon2 (for example one imported from Firebase) cannot be verified by Atlas: those users reset their password or move by lazy migration.',
+            'Tenants become organizations; a tenant\'s own enabled recipes and providers do not carry over (configure SSO connections per organization).',
+            'Code in supertokens.init (override functions, custom claims, MFA requirements, email and SMS delivery) is not visible to the core: it is listed in the config report as manual.',
+        ],
+        async run(p, writer, resume) {
+            const dumpDir = p.credential(DUMP);
+            const uri = coreUri(p, false);
+            if (!dumpDir && !uri) {
+                throw new errors_1.CliError('SuperTokens: pass a core database dump (--set supertokens-dump=<folder>), or the core address with its API key (--set supertokens-connection-uri=… and SUPERTOKENS_API_KEY).');
+            }
+            const set = await (0, plugin_kit_1.vendorStep)('SuperTokens', async () => (0, supertokens_1.exportSupertokens)({
+                tables: dumpDir ? (0, tables_1.readDumpDir)((0, node_path_1.resolve)(dumpDir)) : undefined,
+                connectionUri: uri,
+                apiKey: p.credential(API_KEY),
+                appId: p.credential(APP_ID)?.trim(),
+                tablePrefix: p.credential(PREFIX)?.trim(),
+                fetchImpl: p.fetch,
+                onProgress: (m) => p.say(`  reading ${m}`),
+            }));
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    bridge: {
+        preset: 'supertokens',
+        vars(p, t) {
+            const vars = { ...t?.bridge?.vars };
+            const domain = p.credential(API_DOMAIN)?.trim();
+            if (domain)
+                vars.base_url = domain;
+            const basePath = p.credential(API_BASE_PATH)?.trim().replace(/^\/+|\/+$/g, '');
+            if (basePath)
+                vars.api_base_path = basePath;
+            return vars;
+        },
+    },
+    lazy: {
+        preset: 'supertokens',
+        config(p, t) {
+            const config = { ...t?.lazy?.config };
+            const uri = coreUri(p, false);
+            if (uri)
+                config.base_url = uri;
+            const tenant = p.credential(TENANT_ID)?.trim();
+            if (tenant)
+                config.tenant_id = tenant;
+            const app = p.credential(APP_ID)?.trim();
+            if (app)
+                config.app_id = app;
+            return config;
+        },
+        secret: API_KEY,
+    },
+    codemod: 'supertokens',
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/supertokens/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/supertokens/plugin.ts"],"names":[],"mappings":";;;AAAA,yCAAoC;AACpC,yCAAwC;AACxC,wDAA0D;AAC1D,qDAAkE;AAClE,uDAA6F;AAC7F,qEAAkG;AAGlG;;;;;;;;;GASG;AAEH,MAAM,cAAc,GAAmB,EAAE,IAAI,EAAE,8BAA8B,EAAE,GAAG,EAAE,4BAA4B,EAAE,KAAK,EAAE,qFAAqF,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAClO,MAAM,OAAO,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,kBAAkB,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACxJ,MAAM,IAAI,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,+FAA+F,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAClN,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,0DAA0D,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC/K,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,yBAAyB,EAAE,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,gEAAgE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC9L,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,4BAA4B,EAAE,GAAG,EAAE,0BAA0B,EAAE,KAAK,EAAE,iDAAiD,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAClL,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,0BAA0B,EAAE,GAAG,EAAE,wBAAwB,EAAE,KAAK,EAAE,uFAAuF,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACxN,MAAM,aAAa,GAAmB,EAAE,IAAI,EAAE,6BAA6B,EAAE,GAAG,EAAE,2BAA2B,EAAE,KAAK,EAAE,4DAA4D,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAEtM,SAAS,OAAO,CAAC,CAAgB,EAAE,QAAiB;IAClD,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,CAAC;QACH,OAAO,IAAA,8BAAgB,EAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAQ,CAAC,gBAAgB,GAAG,4DAA4D,CAAC,CAAC;IACtG,CAAC;AACH,CAAC;AAEY,QAAA,iBAAiB,GAAoB;IAChD,MAAM,EAAE,aAAa;IACrB,MAAM,EAAE,aAAa;IACrB,KAAK,EAAE,aAAa;IACpB,IAAI,EAAE,yeAAye;IAC/e,MAAM,EAAE;QACN,KAAK,EAAE,wCAAwC;QAC/C,WAAW,EAAE,CAAC,cAAc,EAAE,OAAO,EAAE,MAAM,CAAC;QAC9C,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,EAAE,IAAI,CAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC;YACvD,MAAM,IAAI,GAAG,IAAA,6BAAe,EAAC,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YACxG,OAAO,IAAA,+CAA0B,EAAC,MAAM,IAAA,uBAAU,EAAC,aAAa,EAAE,GAAG,EAAE,CAAC,IAAA,2CAAsB,EAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QACrH,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,mEAAmE;QAC1E,WAAW,EAAE,CAAC,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC;QAC5D,MAAM,EAAE;YACN,qTAAqT;YACrT,0LAA0L;YAC1L,gLAAgL;YAChL,6IAA6I;YAC7I,iLAAiL;SAClL;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,OAAO,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACnC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAC9B,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;gBACrB,MAAM,IAAI,iBAAQ,CAAC,8KAA8K,CAAC,CAAC;YACrM,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,aAAa,EAAE,KAAK,IAAI,EAAE,CACrD,IAAA,+BAAiB,EAAC;gBAChB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,IAAA,oBAAW,EAAC,IAAA,mBAAO,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC3D,aAAa,EAAE,GAAG;gBAClB,MAAM,EAAE,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC;gBAC7B,KAAK,EAAE,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE;gBACnC,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE;gBACzC,SAAS,EAAE,CAAC,CAAC,KAAK;gBAClB,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;aAC3C,CAAC,CACH,CAAC;YACF,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,aAAa;QACrB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,GAA2B,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC5D,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,CAAC;YAChD,IAAI,MAAM;gBAAE,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC;YACnC,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;YAC/E,IAAI,QAAQ;gBAAE,IAAI,CAAC,aAAa,GAAG,QAAQ,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,aAAa;QACrB,MAAM,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,MAAM,GAA2B,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9D,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAC9B,IAAI,GAAG;gBAAE,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC;YAC/B,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;YAC/C,IAAI,MAAM;gBAAE,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC;YACtC,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;YACzC,IAAI,GAAG;gBAAE,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC;YAC7B,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,EAAE,OAAO;KAChB;IACD,OAAO,EAAE,aAAa;CACvB,CAAC"}

package/dist/migrate/user-table/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const userTablePlugin: MigrationPlugin;

package/dist/migrate/user-table/plugin.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.userTablePlugin = void 0;
+const node_path_1 = require("node:path");
+const args_1 = require("../../args");
+const errors_1 = require("../../errors");
+const plugin_kit_1 = require("../export/plugin-kit");
+const table_1 = require("../export/table");
+/**
+ * `atlas migrate user-table export --file users.csv` — a user table from any
+ * system as CSV / TSV / JSON / NDJSON, with the hash-algorithm picker for
+ * stores whose password column is not self-describing. The vendor-neutral
+ * catch-all: every flag below is optional.
+ */
+const SPEC = (flag, env, label) => ({ flag, env, label, required: false });
+const HASH_ALGORITHM = SPEC('hash-algorithm', 'ATLAS_HASH_ALGORITHM', 'the password hash algorithm: auto (default), plaintext, or any id such as bcrypt, md5, sha256_salted, pbkdf2, scrypt');
+const SALT_POSITION = SPEC('salt-position', 'ATLAS_SALT_POSITION', 'salted digests: prefix or suffix (default suffix)');
+const HASH_ENCODING = SPEC('hash-encoding', 'ATLAS_HASH_ENCODING', 'how the hash column is encoded: hex, base64 or base64url');
+const HASH_PARAMS = SPEC('hash-params', 'ATLAS_HASH_PARAMS', 'algorithm parameters, e.g. iterations=10000,digest=sha256');
+const COLUMNS = SPEC('map', 'ATLAS_COLUMN_MAP', 'column names when yours differ: email=Mail,id=uid,password=pwd,salt=pwd_salt');
+const TRUST = SPEC('trust-emails', 'ATLAS_TRUST_EMAILS', 'mark every address verified (true or false)');
+function file(p) {
+    return (0, args_1.str)(p.args.values, 'file') ?? p.credential({ flag: 'file', env: 'ATLAS_MIGRATE_FILE', label: 'the users file (--file)', required: true });
+}
+exports.userTablePlugin = {
+    vendor: 'user-table',
+    source: 'custom',
+    label: 'Your own user table (CSV / JSON)',
+    help: 'Import users from a CSV, TSV, JSON array or NDJSON file — a SELECT * of your users table. Columns are recognised by their usual names (id, email, email_verified, username, first_name, last_name, phone, password_hash, salt, created_at, roles, disabled …) or named with --set map=email=Mail,id=uid. Name the password algorithm with --set hash-algorithm=<id> when the column is not self-describing (add salt-position, hash-encoding and hash-params as needed), or plaintext to hash it on this machine. The file is read locally.',
+    export: {
+        reads: 'a local CSV / TSV / JSON / NDJSON file (--file)',
+        credentials: [HASH_ALGORITHM, SALT_POSITION, HASH_ENCODING, HASH_PARAMS, COLUMNS, TRUST],
+        limits: ['Social links, second factors, organizations and sessions are not in a flat table: import those with atlas migrate custom (canonical records) after this.'],
+        async run(p, writer, resume) {
+            const path = (0, node_path_1.resolve)(file(p));
+            let rows;
+            try {
+                rows = (0, table_1.parseTable)(p.ctx.readFile(path));
+            }
+            catch (err) {
+                throw new errors_1.CliError(`${path}: ${err.message}`);
+            }
+            if (!rows.length)
+                throw new errors_1.CliError(`No rows found in ${path}.`);
+            const position = p.credential(SALT_POSITION);
+            if (position && position !== 'prefix' && position !== 'suffix')
+                throw new errors_1.CliError('--set salt-position must be prefix or suffix.');
+            const set = (0, table_1.mapTable)(rows, {
+                map: (0, table_1.parseKeyValues)(p.credential(COLUMNS)),
+                hashAlgorithm: p.credential(HASH_ALGORITHM),
+                saltPosition: position,
+                hashEncoding: p.credential(HASH_ENCODING),
+                hashParams: (0, table_1.typedParams)(p.credential(HASH_PARAMS)),
+                trustEmails: p.credential(TRUST) === 'true',
+                origin: `user table ${path}`,
+            });
+            p.say(`  read ${rows.length} row(s) from ${path}`);
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/user-table/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/user-table/plugin.ts"],"names":[],"mappings":";;;AAAA,yCAAoC;AACpC,qCAAiC;AACjC,yCAAwC;AACxC,qDAAsD;AACtD,2CAAoF;AAGpF;;;;;GAKG;AAEH,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,GAAW,EAAE,KAAa,EAAkB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;AACnH,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB,EAAE,sBAAsB,EAAE,sHAAsH,CAAC,CAAC;AAC9L,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,EAAE,qBAAqB,EAAE,mDAAmD,CAAC,CAAC;AACxH,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,EAAE,qBAAqB,EAAE,0DAA0D,CAAC,CAAC;AAC/H,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,EAAE,mBAAmB,EAAE,2DAA2D,CAAC,CAAC;AAC1H,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,kBAAkB,EAAE,8EAA8E,CAAC,CAAC;AAChI,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,EAAE,oBAAoB,EAAE,6CAA6C,CAAC,CAAC;AAExG,SAAS,IAAI,CAAC,CAAgB;IAC5B,OAAO,IAAA,UAAG,EAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,yBAAyB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAE,CAAC;AACpJ,CAAC;AAEY,QAAA,eAAe,GAAoB;IAC9C,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,kCAAkC;IACzC,IAAI,EAAE,6gBAA6gB;IACnhB,MAAM,EAAE;QACN,KAAK,EAAE,iDAAiD;QACxD,WAAW,EAAE,CAAC,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC;QACxF,MAAM,EAAE,CAAC,0JAA0J,CAAC;QACpK,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,IAAI,GAAG,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,IAAI,CAAC;YACT,IAAI,CAAC;gBACH,IAAI,GAAG,IAAA,kBAAU,EAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,iBAAQ,CAAC,GAAG,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3D,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,iBAAQ,CAAC,oBAAoB,IAAI,GAAG,CAAC,CAAC;YAClE,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;YAC7C,IAAI,QAAQ,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,QAAQ;gBAAE,MAAM,IAAI,iBAAQ,CAAC,+CAA+C,CAAC,CAAC;YACpI,MAAM,GAAG,GAAG,IAAA,gBAAQ,EAAC,IAAI,EAAE;gBACzB,GAAG,EAAE,IAAA,sBAAc,EAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBAC1C,aAAa,EAAE,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC;gBAC3C,YAAY,EAAE,QAA2C;gBACzD,YAAY,EAAE,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC;gBACzC,UAAU,EAAE,IAAA,mBAAW,EAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;gBAClD,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,MAAM;gBAC3C,MAAM,EAAE,cAAc,IAAI,EAAE;aAC7B,CAAC,CAAC;YACH,CAAC,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,MAAM,gBAAgB,IAAI,EAAE,CAAC,CAAC;YACnD,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;CACF,CAAC"}

package/dist/migrate/userfront/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const userfrontPlugin: MigrationPlugin;

package/dist/migrate/userfront/plugin.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.userfrontPlugin = void 0;
+const userfront_1 = require("../export/userfront");
+const userfront_config_1 = require("../export/userfront-config");
+const plugin_kit_1 = require("../export/plugin-kit");
+/**
+ * `atlas migrate userfront` — users, sub-tenants (as organizations) and roles
+ * through Userfront's admin API (tenant id + admin key, on this machine), and
+ * lazy migration through Userfront's password sign-in for every password:
+ * Userfront never returns hashes. There is no bridge preset: Userfront tokens
+ * carry no issuer claim, which the zero-logout bridge requires.
+ */
+const TENANT_ID = { flag: '--userfront-tenant-id', env: 'USERFRONT_TENANT_ID', label: 'your Userfront tenant id', required: true };
+const API_KEY = { flag: '--userfront-api-key', env: 'USERFRONT_API_KEY', label: 'a Userfront admin API key (uf_live_admin_…)', required: true, secret: true };
+/** The tenant id from the flag or env, else the one the app already uses. */
+function tenantId(p) {
+    const env = p.ctx.env;
+    const raw = p.credential({ ...TENANT_ID, required: false }) ??
+        (env.NEXT_PUBLIC_USERFRONT_TENANT_ID ?? env.REACT_APP_USERFRONT_TENANT_ID ?? env.VITE_USERFRONT_TENANT_ID)?.trim() ??
+        (0, plugin_kit_1.need)(p, TENANT_ID);
+    return (0, userfront_1.checkTenantId)(raw);
+}
+exports.userfrontPlugin = {
+    vendor: 'userfront',
+    source: 'userfront',
+    label: 'Userfront',
+    help: 'Move a Userfront tenant: users with their verified emails and phones, usernames and custom data, sub-tenants as organizations with member roles, roles as Atlas roles, lazy migration through Userfront\'s own sign-in for every password (Userfront never returns hashes), and the code. Your admin key stays on this machine.',
+    config: {
+        reads: 'your Userfront tenant via the admin API (roles)',
+        credentials: [TENANT_ID, API_KEY],
+        async translate(p) {
+            const tid = tenantId(p);
+            const http = (0, userfront_1.userfrontHttp)({ apiKey: (0, plugin_kit_1.need)(p, API_KEY), fetchImpl: p.fetch });
+            return (0, userfront_config_1.translateUserfrontConfig)(await (0, plugin_kit_1.vendorStep)('Userfront', () => (0, userfront_config_1.fetchUserfrontConfig)(http, tid)));
+        },
+    },
+    export: {
+        reads: 'the Userfront admin API (users, sub-tenants, roles)',
+        credentials: [TENANT_ID, API_KEY],
+        limits: [
+            'Userfront never returns password hashes: passwords move by lazy migration (the userfront preset checks each one against Userfront on the first Atlas sign-in).',
+            'Second factors, passkeys and social-account ids cannot be exported: members enrol again, register passkeys again and relink social accounts by verified email.',
+            'Pending invitations cannot be listed (Userfront can only create them): invite members again from Atlas.',
+            'Sessions are not exported: Userfront tokens carry no issuer claim, so there is no zero-logout bridge; users sign in once after the switch.',
+        ],
+        async run(p, writer, resume) {
+            const set = await (0, plugin_kit_1.vendorStep)('Userfront', () => (0, userfront_1.exportUserfront)({ tenantId: tenantId(p), apiKey: (0, plugin_kit_1.need)(p, API_KEY), fetchImpl: p.fetch, onProgress: (m) => p.say(`  reading ${m}`) }));
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    lazy: {
+        preset: 'userfront',
+        config(p, t) {
+            return { ...t?.lazy?.config, tenant_id: t?.lazy?.config.tenant_id ?? tenantId(p) };
+        },
+    },
+    codemod: 'userfront',
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/userfront/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/userfront/plugin.ts"],"names":[],"mappings":";;;AAAA,mDAAoF;AACpF,iEAA4F;AAE5F,qDAAwE;AAExE;;;;;;GAMG;AAEH,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,0BAA0B,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACnJ,MAAM,OAAO,GAAmB,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,6CAA6C,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAE9K,6EAA6E;AAC7E,SAAS,QAAQ,CAAC,CAAgB;IAChC,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACtB,MAAM,GAAG,GACP,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC/C,CAAC,GAAG,CAAC,+BAA+B,IAAI,GAAG,CAAC,6BAA6B,IAAI,GAAG,CAAC,wBAAwB,CAAC,EAAE,IAAI,EAAE;QAClH,IAAA,iBAAI,EAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACrB,OAAO,IAAA,yBAAa,EAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAEY,QAAA,eAAe,GAAoB;IAC9C,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,WAAW;IACnB,KAAK,EAAE,WAAW;IAClB,IAAI,EAAE,iUAAiU;IACvU,MAAM,EAAE;QACN,KAAK,EAAE,iDAAiD;QACxD,WAAW,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;QACjC,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YACxB,MAAM,IAAI,GAAG,IAAA,yBAAa,EAAC,EAAE,MAAM,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YAC7E,OAAO,IAAA,2CAAwB,EAAC,MAAM,IAAA,uBAAU,EAAC,WAAW,EAAE,GAAG,EAAE,CAAC,IAAA,uCAAoB,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QACxG,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,qDAAqD;QAC5D,WAAW,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;QACjC,MAAM,EAAE;YACN,gKAAgK;YAChK,gKAAgK;YAChK,yGAAyG;YACzG,4IAA4I;SAC7I;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,WAAW,EAAE,GAAG,EAAE,CAC7C,IAAA,2BAAe,EAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC,CACrI,CAAC;YACF,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,WAAW;QACnB,MAAM,CAAC,CAAC,EAAE,CAAC;YACT,OAAO,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,CAAC;KACF;IACD,OAAO,EAAE,WAAW;CACrB,CAAC"}

package/dist/migrate/workos/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const workosPlugin: MigrationPlugin;

package/dist/migrate/workos/plugin.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.workosPlugin = void 0;
+const workos_1 = require("../export/workos");
+const workos_config_1 = require("../export/workos-config");
+const plugin_kit_1 = require("../export/plugin-kit");
+const vendor_http_1 = require("../export/vendor-http");
+/**
+ * `atlas migrate workos` — a WorkOS environment (AuthKit, SSO, Directory
+ * Sync) through the WorkOS API with the environment's API key (on this
+ * machine): roles and permissions as Atlas config; users with verified
+ * emails, OAuth identities, organizations, memberships and role slugs,
+ * invitations and SSO connections as data; the `workos` bridge preset (access
+ * tokens verified against the client's JWKS, with a local unsealer for the
+ * `wos-session` cookie) and lazy migration through WorkOS's password
+ * authentication for every password.
+ */
+const API_KEY = { flag: '--workos-api-key', env: 'WORKOS_API_KEY', label: 'a WorkOS API key (sk_…)', required: true, secret: true };
+const CLIENT_ID = { flag: '--workos-client-id', env: 'WORKOS_CLIENT_ID', label: 'your WorkOS client id (client_…)', required: true };
+const HASHES_FILE = { flag: '--workos-hashes-file', env: 'WORKOS_HASHES_FILE', label: 'a password-hash export from WorkOS support', required: false };
+const BASE_URL = { flag: '--workos-base-url', env: 'WORKOS_BASE_URL', label: 'the WorkOS API base URL', required: false };
+const COUNT_FACTORS = { flag: '--workos-factors', env: 'WORKOS_COUNT_FACTORS', label: 'set to 1 to count second factors (one extra request per user)', required: false };
+/** The client id from the flag/env, or the app's own public env var; undefined when neither is set. */
+function clientIdOpt(p) {
+    return (p.credential({ ...CLIENT_ID, required: false }) ??
+        (p.ctx.env.NEXT_PUBLIC_WORKOS_CLIENT_ID?.trim() || p.ctx.env.VITE_WORKOS_CLIENT_ID?.trim() || undefined));
+}
+function clientId(p) {
+    return clientIdOpt(p) ?? (0, plugin_kit_1.need)(p, CLIENT_ID);
+}
+function baseUrl(p) {
+    return p.credential(BASE_URL)?.replace(/\/+$/, '');
+}
+exports.workosPlugin = {
+    vendor: 'workos',
+    source: 'workos',
+    label: 'WorkOS',
+    help: 'Move a WorkOS environment: roles and permissions as Atlas config; users with verified emails and OAuth identities, organizations, memberships and role slugs, invitations and SSO connections; password hashes when WorkOS support provides them; a zero-logout bridge for AuthKit access tokens (including the sealed wos-session cookie); lazy migration through WorkOS password authentication; and the code. Your API key stays on this machine.',
+    config: {
+        reads: 'your WorkOS environment via the API (roles, permissions, redirect URIs, connections)',
+        credentials: [API_KEY, CLIENT_ID],
+        async translate(p) {
+            const http = new vendor_http_1.VendorHttp({ vendor: 'WorkOS', baseUrl: baseUrl(p) ?? 'https://api.workos.com', headers: { authorization: `Bearer ${(0, plugin_kit_1.need)(p, API_KEY)}` }, fetchImpl: p.fetch });
+            const snap = await (0, plugin_kit_1.vendorStep)('WorkOS', () => (0, workos_config_1.fetchWorkosConfig)(http, clientIdOpt(p)));
+            return (0, workos_config_1.translateWorkosConfig)(snap);
+        },
+    },
+    export: {
+        reads: 'the WorkOS API (organizations, roles, users, identities, memberships, invitations, connections) and, if you have one, the support hash export (--workos-hashes-file)',
+        credentials: [API_KEY, CLIENT_ID, HASHES_FILE, BASE_URL, COUNT_FACTORS],
+        limits: [
+            'WorkOS has no password-hash export: if WorkOS support provides one, pass it with --workos-hashes-file; otherwise passwords move by lazy migration (checked against WorkOS on each user\'s first sign-in).',
+            'TOTP secrets and passkeys are not exportable: users enrol their second factor and passkeys again.',
+            'SSO connections move without the identity provider\'s entity id, SSO URL or OIDC secret (the WorkOS API does not return them): each customer\'s IdP admin sets the connection up again against the new Atlas details.',
+            'API key secrets are shown once by WorkOS: reissue them as Atlas API keys. Sessions are not exported: AuthKit access tokens are JWTs, exchanged by the workos bridge preset.',
+        ],
+        async run(p, writer, resume) {
+            const set = await (0, plugin_kit_1.vendorStep)('WorkOS', () => (0, workos_1.exportWorkos)({
+                apiKey: (0, plugin_kit_1.need)(p, API_KEY),
+                clientId: clientIdOpt(p),
+                baseUrl: baseUrl(p),
+                hashesText: (0, plugin_kit_1.localFile)(p, HASHES_FILE, 'text'),
+                countFactors: Boolean(p.credential(COUNT_FACTORS)),
+                fetchImpl: p.fetch,
+                onProgress: (m) => p.say(`  reading ${m}`),
+            }));
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    bridge: {
+        preset: 'workos',
+        vars: (p, t) => ({ ...t?.bridge?.vars, client_id: t?.bridge?.vars.client_id ?? clientId(p) }),
+    },
+    lazy: {
+        preset: 'workos',
+        config: (p, t) => ({ ...t?.lazy?.config, client_id: t?.lazy?.config.client_id ?? clientId(p) }),
+        secret: API_KEY,
+    },
+    codemod: 'workos',
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/workos/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/workos/plugin.ts"],"names":[],"mappings":";;;AAAA,6CAAgD;AAChD,2DAAmF;AAEnF,qDAAmF;AACnF,uDAAmD;AAEnD;;;;;;;;;GASG;AAEH,MAAM,OAAO,GAAmB,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,yBAAyB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACpJ,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,kCAAkC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACrJ,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,4CAA4C,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACtK,MAAM,QAAQ,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,yBAAyB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC1I,MAAM,aAAa,GAAmB,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,+DAA+D,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAEzL,uGAAuG;AACvG,SAAS,WAAW,CAAC,CAAgB;IACnC,OAAO,CACL,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC/C,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,4BAA4B,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC,CACzG,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,CAAgB;IAChC,OAAO,WAAW,CAAC,CAAC,CAAC,IAAI,IAAA,iBAAI,EAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,OAAO,CAAC,CAAgB;IAC/B,OAAO,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACrD,CAAC;AAEY,QAAA,YAAY,GAAoB;IAC3C,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,QAAQ;IACf,IAAI,EAAE,sbAAsb;IAC5b,MAAM,EAAE;QACN,KAAK,EAAE,sFAAsF;QAC7F,WAAW,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC;QACjC,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,IAAI,GAAG,IAAI,wBAAU,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,wBAAwB,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAA,iBAAI,EAAC,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YACjL,MAAM,IAAI,GAAG,MAAM,IAAA,uBAAU,EAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAA,iCAAiB,EAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvF,OAAO,IAAA,qCAAqB,EAAC,IAAI,CAAC,CAAC;QACrC,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,sKAAsK;QAC7K,WAAW,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,CAAC;QACvE,MAAM,EAAE;YACN,2MAA2M;YAC3M,mGAAmG;YACnG,uNAAuN;YACvN,6KAA6K;SAC9K;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,QAAQ,EAAE,GAAG,EAAE,CAC1C,IAAA,qBAAY,EAAC;gBACX,MAAM,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,OAAO,CAAC;gBACxB,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;gBACxB,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;gBACnB,UAAU,EAAE,IAAA,sBAAS,EAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC;gBAC7C,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;gBAClD,SAAS,EAAE,CAAC,CAAC,KAAK;gBAClB,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;aAC3C,CAAC,CACH,CAAC;YACF,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,QAAQ;QAChB,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9F;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,MAAM,EAAE,OAAO;KAChB;IACD,OAAO,EAAE,QAAQ;CAClB,CAAC"}

package/dist/migrate/zitadel/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const zitadelPlugin: MigrationPlugin;