@atlasauth/cli 0.12.0 → 0.13.0

package/dist/commands/pages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pages.js","sourceRoot":"","sources":["../../src/commands/pages.ts"],"names":[],"mappings":";;AA6CA,sBAwDC;AApGD,kCAA+C;AAE/C,sCAAqC;AACrC,sCAAyE;AACzE,qCAAgE;AAEhE,MAAM,KAAK,GAAuB,CAAC,SAAS,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;AAEzE,MAAM,OAAO,GAA2B;IACtC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;IACtC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,IAAA,gBAAO,EAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE;IACnG,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,IAAA,gBAAO,EAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE;CACxG,CAAC;AAEF,SAAS,SAAS,CAAC,GAAuB;IACxC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAuB,CAAC;QAAE,MAAM,IAAI,iBAAQ,CAAC,+BAA+B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9H,OAAO,GAAuB,CAAC;AACjC,CAAC;AAED,0EAA0E;AAC1E,SAAS,cAAc,CAAC,GAAe,EAAE,IAAY;IACnD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,iBAAQ,CAAC,IAAI,IAAI,wBAAwB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,GAAG,GAAG,MAA2E,CAAC;IACxF,MAAM,GAAG,GAAG,GAAG,EAAE,UAAU,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAE,GAA8B,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC5F,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,iBAAQ,CAAC,IAAI,IAAI,sEAAsE,CAAC,CAAC;IAC7G,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;GAUG;AACI,KAAK,UAAU,KAAK,CAAC,GAAe,EAAE,IAAgB;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,IAAA,kBAAS,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,sBAAa,EAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAEnD,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;YAC/C,IAAI,IAAI;gBAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;;gBAC7B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAA,oBAAW,EAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACjD,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;YACrD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YACjD,IAAI,KAAK,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,EAAE,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YAClF,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,KAAK,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC1E,IAAI,IAAI;gBAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;;gBAC9B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B,IAAI,YAAY,CAAC,CAAC,CAAC,aAAa,IAAI,2CAA2C,IAAI,cAAc,CAAC,CAAC;YACpK,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;YACpF,IAAI,IAAI;gBAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;iBAC5B,CAAC;gBACJ,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACpB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,wBAAwB,IAAA,gBAAO,EAAC,GAAG,CAAC,UAAU,CAAC,6CAA6C,CAAC,CAAC;YAC3G,CAAC;YACD,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,IAAI,GAAG,SAAS,CAAC,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YACjD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACvD,IAAI,IAAI;gBAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;;gBAC9B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,IAAI,qBAAqB,CAAC,CAAC;YAClD,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;YAClF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;YAC1D,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,iBAAQ,CAAC,eAAe,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,iBAAiB,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;YACjH,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACnC,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,IAAI,GAAG,SAAS,CAAC,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC1C,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,MAAM;gBAAE,MAAM,IAAI,iBAAQ,CAAC,sCAAsC,CAAC,CAAC;YACxG,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC/D,IAAI,IAAI;gBAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;;gBAC9B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,eAAe,MAAM,IAAI,IAAI,YAAY,CAAC,CAAC;YAC3D,OAAO,CAAC,CAAC;QACX,CAAC;QACD;YACE,MAAM,IAAI,iBAAQ,CAAC,0BAA0B,GAAG,IAAI,EAAE,sDAAsD,CAAC,CAAC;IAClH,CAAC;AACH,CAAC"}

package/dist/context.d.ts

@@ -9,7 +9,7 @@ import { type Prompter } from './prompt';
  * enforces — that the command set maps only onto namespaces that really exist,
  * and it keeps the fake a test injects small (five namespaces, not forty).
  */
-export type ManagementClient = Pick<AtlasClient, 'users' | 'organizations' | 'apiKeys' | 'webhooks' | 'sessions' | 'actions' | 'actionGallery' | 'actionTemplates'>;
+export type ManagementClient = Pick<AtlasClient, 'users' | 'organizations' | 'apiKeys' | 'webhooks' | 'sessions' | 'actions' | 'actionGallery' | 'actionTemplates' | 'pageTemplates'>;
 /**
  * Everything a command touches the outside world through, in one injectable
  * bag. Production wires the real IO/config/prompt/client; every test builds

package/dist/help.d.ts

@@ -3,6 +3,6 @@
  * out of the handlers so the dispatch code stays about control flow and the
  * copy can be read (and kept consistent) in one place.
  */
-export declare const TOP_HELP = "atlas \u2014 manage an Atlas instance from the terminal\n\nUsage: atlas <command> [subcommand] [arguments] [options]\n\nCommands:\n  login                      Authenticate and store a profile credential\n                             (--device: operator sign-in in the browser, no key stored)\n  token --resource <id>      A one-hour token for one instance/app from your operator sign-in\n  keys whoami|list|create|rotate|revoke|revoke-leaked\n                             Scoped secret keys; new secrets go sealed into 0600 files\n  logout                     Remove a stored profile credential\n  whoami                     Show the active profile and instance\n  users list|get|create|delete\n  orgs list|get|members\n  api-keys list|create|revoke\n  webhooks list|create|upsert|update|test|deliveries|redeliver|replay|rotate|reveal\n  listen --forward-to <url>  Forward live events to your local server, signed (no tunnel)\n  move-origin --from --to    Move an app to a new domain in one step (--dry-run first)\n  csp --framework next|express|nginx\n                             Print the Content Security Policy sources Atlas needs\n  integrations list|get|set|remove|deliveries   Identity integrations (chat, docs, consent, referrals, custom)\n  partner-platforms list|get|set|registration|token|deliveries|remove\n                             This instance as a partner platform (signed consent deliveries in)\n  id-accounts provision|list|rotate|remove\n                             Test and review accounts for a Sign in with Atlas app (passwords go to 0600 files)\n  admin id-accounts list|provision|extend|rotate|revoke\n  admin developer-accounts provision|revoke\n                             Atlas staff: accounts for other platforms' integration teams\n                             (operator sign-in with a recent second factor; passwords to 0600 files)\n  sessions revoke\n  config export|import|plan  Config-as-code: round-trip the instance's config; plan = drift diff\n  actions list|deploy|test|logs|gallery|show|install|installs|update|publish\n  init                       Create or complete an app's setup (idempotent); secrets to 0600 files\n  preflight                  Check an instance's setup; non-zero exit on errors (for CI)\n  doctor                     Integration health: webhooks, logout, referrals, email, consent (exit 1 on a failure)\n  env                        Print deploy variables: public values + secret file paths\n  client rotate              Rotate an OAuth client secret straight into its file\n  referrals connect|backfill|status\n                             Connect a referral platform, backfill, check the connection\n  status                     Atlas status, incidents that concern the instance and its\n                             upstream status pages; non-zero exit on an outage\n  import --from <vendor> <file>\n                             Move users from Auth0, Clerk, Supabase, Firebase, Cognito,\n                             Auth.js, WorkOS or Better Auth (resumable; --dry-run first)\n  migrate code --from <vendor> [path]\n                             Rewrite an app's auth code onto Atlas (Clerk, Auth.js,\n                             Supabase, Auth0, Better Auth); a dry run with a diff unless --yes\n  migrate better-auth [path] Move a Better Auth app to Atlas end to end: config, users,\n                             sessions and code, resumable (--dry-run, --resume, --yes)\n  migrate better-auth config [path]\n                             Translate the app's betterAuth({...}) options into Atlas\n                             config files plus a report (offline)\n  migrate <vendor> [step] [path]\n                             Move from any vendor (config, export, import, bridge, lazy):\n                             resumable; vendor credentials never leave this machine\n  info [path]                Print the environment for a support ticket (versions, SDKs,\n                             instance, API latency, preflight); secrets redacted\n  mcp install                Add the Atlas MCP server (docs search) to Cursor, Claude Code,\n                             Codex or VS Code\n\nGlobal options:\n  --profile <name>           Use a named profile (default: active, else \"default\")\n  --json                     Emit raw JSON instead of a human table\n  --limit <n>                Page size for list commands that paginate\n  --starting-after <cursor>  Pagination cursor (from a prior page's hint)\n  -h, --help                 Show this help, or help for a command\n  -v, --version              Print the version\n\nEnvironment overrides:\n  ATLAS_SECRET_KEY           Secret key to use instead of the stored one\n  ATLAS_API_BASE             API URL to use instead of the stored one\n  ATLAS_API_URL              Same (the older name); ATLAS_API_BASE wins when both are set\n  ATLAS_PLATFORM_KEY         Platform key (psk_) for atlas init\n  REFERALLI_BASE_URL         Referalli base URL for atlas referrals connect\n  REFERALLI_API_KEY          Referalli merchant key for atlas referrals connect (never stored)\n                             (the old REFERALLY_BASE_URL / REFERALLY_API_KEY still work, with a notice)\n\nSecrets: a command that receives a secret writes it to a 0600 file under\n~/.config/<product>/ and prints only the path. --print-secret prints it instead.\n\nRun 'atlas <command> --help' for command-specific help.";
+export declare const TOP_HELP = "atlas \u2014 manage an Atlas instance from the terminal\n\nUsage: atlas <command> [subcommand] [arguments] [options]\n\nCommands:\n  login                      Authenticate and store a profile credential\n                             (--device: operator sign-in in the browser, no key stored)\n  token --resource <id>      A one-hour token for one instance/app from your operator sign-in\n  keys whoami|list|create|rotate|revoke|revoke-leaked\n                             Scoped secret keys; new secrets go sealed into 0600 files\n  logout                     Remove a stored profile credential\n  whoami                     Show the active profile and instance\n  users list|get|create|delete\n  orgs list|get|members\n  api-keys list|create|revoke\n  webhooks list|create|upsert|update|test|deliveries|redeliver|replay|rotate|reveal\n  listen --forward-to <url>  Forward live events to your local server, signed (no tunnel)\n  dev [proxy]                Local in-memory Atlas (emulator) / one-origin dev proxy\n  move-origin --from --to    Move an app to a new domain in one step (--dry-run first)\n  csp --framework next|express|nginx\n                             Print the Content Security Policy sources Atlas needs\n  integrations list|get|set|remove|deliveries   Identity integrations (chat, docs, consent, referrals, custom)\n  partner-platforms list|get|set|registration|token|deliveries|remove\n                             This instance as a partner platform (signed consent deliveries in)\n  id-accounts provision|list|rotate|remove\n                             Test and review accounts for a Sign in with Atlas app (passwords go to 0600 files)\n  admin id-accounts list|provision|extend|rotate|revoke\n  admin developer-accounts provision|revoke\n                             Atlas staff: accounts for other platforms' integration teams\n                             (operator sign-in with a recent second factor; passwords to 0600 files)\n  sessions revoke\n  config export|import|plan|promote\n                             Config-as-code: round-trip the instance's config; plan = drift diff;\n                             promote = copy one environment's config to another\n  actions list|deploy|test|logs|gallery|show|install|installs|update|publish\n  pages list|push|preview|promote|pull|discard\n                             Code-defined hosted-page templates: draft, signed preview link, promote\n  init                       Create or complete an app's setup (idempotent); secrets to 0600 files\n  preflight                  Check an instance's setup; non-zero exit on errors (for CI)\n  doctor                     Integration health: webhooks, logout, referrals, email, consent (exit 1 on a failure)\n  env                        Print deploy variables: public values + secret file paths\n  client rotate              Rotate an OAuth client secret straight into its file\n  referrals connect|backfill|status\n                             Connect a referral platform, backfill, check the connection\n  status                     Atlas status, incidents that concern the instance and its\n                             upstream status pages; non-zero exit on an outage\n  import --from <vendor> <file>\n                             Move users from Auth0, Clerk, Supabase, Firebase, Cognito,\n                             Auth.js, WorkOS or Better Auth (resumable; --dry-run first)\n  migrate code --from <vendor> [path]\n                             Rewrite an app's auth code onto Atlas (Clerk, Auth.js,\n                             Supabase, Auth0, Better Auth); a dry run with a diff unless --yes\n  migrate better-auth [path] Move a Better Auth app to Atlas end to end: config, users,\n                             sessions and code, resumable (--dry-run, --resume, --yes)\n  migrate better-auth config [path]\n                             Translate the app's betterAuth({...}) options into Atlas\n                             config files plus a report (offline)\n  migrate <vendor> [step] [path]\n                             Move from any vendor (config, export, import, bridge, lazy):\n                             resumable; vendor credentials never leave this machine\n  info [path]                Print the environment for a support ticket (versions, SDKs,\n                             instance, API latency, preflight); secrets redacted\n  mcp install                Add the Atlas MCP server (docs search) to Cursor, Claude Code,\n                             Codex or VS Code\n\nGlobal options:\n  --profile <name>           Use a named profile (default: active, else \"default\")\n  --json                     Emit raw JSON instead of a human table\n  --limit <n>                Page size for list commands that paginate\n  --starting-after <cursor>  Pagination cursor (from a prior page's hint)\n  -h, --help                 Show this help, or help for a command\n  -v, --version              Print the version\n\nEnvironment overrides:\n  ATLAS_SECRET_KEY           Secret key to use instead of the stored one\n  ATLAS_API_BASE             API URL to use instead of the stored one\n  ATLAS_API_URL              Same (the older name); ATLAS_API_BASE wins when both are set\n  ATLAS_PLATFORM_KEY         Platform key (psk_) for atlas init\n  REFERALLI_BASE_URL         Referalli base URL for atlas referrals connect\n  REFERALLI_API_KEY          Referalli merchant key for atlas referrals connect (never stored)\n                             (the old REFERALLY_BASE_URL / REFERALLY_API_KEY still work, with a notice)\n\nSecrets: a command that receives a secret writes it to a 0600 file under\n~/.config/<product>/ and prints only the path. --print-secret prints it instead.\n\nRun 'atlas <command> --help' for command-specific help.";
 /** Per-command help, keyed by the resource word. */
 export declare const COMMAND_HELP: Record<string, string>;

package/dist/help.js

@@ -23,6 +23,7 @@ Commands:
   api-keys list|create|revoke
   webhooks list|create|upsert|update|test|deliveries|redeliver|replay|rotate|reveal
   listen --forward-to <url>  Forward live events to your local server, signed (no tunnel)
+  dev [proxy]                Local in-memory Atlas (emulator) / one-origin dev proxy
   move-origin --from --to    Move an app to a new domain in one step (--dry-run first)
   csp --framework next|express|nginx
                              Print the Content Security Policy sources Atlas needs
@@ -36,8 +37,12 @@ Commands:
                              Atlas staff: accounts for other platforms' integration teams
                              (operator sign-in with a recent second factor; passwords to 0600 files)
   sessions revoke
-  config export|import|plan  Config-as-code: round-trip the instance's config; plan = drift diff
+  config export|import|plan|promote
+                             Config-as-code: round-trip the instance's config; plan = drift diff;
+                             promote = copy one environment's config to another
   actions list|deploy|test|logs|gallery|show|install|installs|update|publish
+  pages list|push|preview|promote|pull|discard
+                             Code-defined hosted-page templates: draft, signed preview link, promote
   init                       Create or complete an app's setup (idempotent); secrets to 0600 files
   preflight                  Check an instance's setup; non-zero exit on errors (for CI)
   doctor                     Integration health: webhooks, logout, referrals, email, consent (exit 1 on a failure)
@@ -163,10 +168,28 @@ Vendors:
   passport     passport + express-session (initialize, session, authenticate('jwt'),
                req.isAuthenticated()); strategies and req.user are reported
   iron-session getIronSession() reads of the user id -> auth()
+  keycloak     keycloak-js, @react-keycloak, keycloak-connect, the Keycloak Auth.js provider
+  ory          @ory/client, @ory/nextjs, @ory/elements (Kratos and Hydra)
+  zitadel      @zitadel/react, @zitadel/node, @zitadel/next
+  logto        @logto/react, @logto/next, @logto/node and the other Logto SDKs
+  supertokens  supertokens-node, supertokens-web-js, supertokens-auth-react
+  authentik    react-oidc-context / oidc-client-ts pointed at authentik, @goauthentik/api
+  fusionauth   @fusionauth/react-sdk, @fusionauth/typescript-client and the other FusionAuth SDKs
+  hanko        @teamhanko/hanko-elements and hanko-frontend-sdk
   openid-client  openid-client (Issuer.discover, authorizationUrl, callback, endSessionUrl)
   jose         jose used to verify OIDC ID tokens (jwtVerify + createRemoteJWKSet)
   generic-oidc a hand-rolled relying party (discovery, PKCE, code exchange, JWKS) found
                by its code; replaced by oidc.start / oidc.callback / oidc.logoutUrl
+  firebase     firebase/auth (modular and v8 compat), react-firebase-hooks, FirebaseUI,
+               firebase-admin auth calls; Firebase itself stays for Firestore/Storage
+  cognito      aws-amplify/auth (v6 and v5 Auth), Hub auth events, @aws-amplify/ui-react,
+               amazon-cognito-identity-js, aws-jwt-verify
+  azure-ad-b2c @azure/msal-browser, @azure/msal-react, @azure/msal-node, passport-azure-ad
+  entra-external-id  the same MSAL rewrite, for Entra External ID tenants
+  appwrite     the Appwrite Account API (new Account(client)), node-appwrite Users/Teams;
+               Databases/Storage stay
+  pocketbase   pb.authStore and collection auth calls; collections and files stay
+  nhost        @nhost/react / @nhost/nextjs hooks and nhost.auth.*; GraphQL/Storage stay
 
 What it rewrites: imports, providers, hooks, server session helpers, middleware,
 sign-in/out calls and env var names, onto native Atlas APIs and the drop-in
@@ -409,6 +432,16 @@ and no second endpoint. The signing secret belongs to this session only and is
 written to a 0600 file (webhook-listen.env): point your verifier at it. --events
 takes names or patterns (user.*, *.created). The session lasts up to an hour;
 Ctrl-C stops it. --count n exits after n events (exit 1 if any forward failed).`,
+    dev: `atlas dev — a local, in-memory Atlas
+
+Usage:
+  atlas dev [--port 4400] [--seed seed.json] [--app http://localhost:3000]
+  atlas dev proxy --app <url> --api <fapi url> [--port 4401]
+
+The emulator serves the Frontend API, a minimal Backend API, OIDC discovery and
+a mail/SMS catcher at /__emulator/mail. Every code is 424242. With --app it also
+forwards everything it does not own to your app, so both share one origin.
+'dev proxy' does the same against a real instance. No account, no network.`,
     'move-origin': `atlas move-origin — move an app to a new domain
 
 Usage: atlas move-origin --from <origin> --to <origin> [--dry-run] [--yes] [--json]
@@ -600,6 +633,7 @@ Usage:
   atlas config export [--dir <path>] [--format json|yaml]
   atlas config import [--dir <path>] [--format json|yaml] [--dry-run] [--prune]
   atlas config plan   [--dir <path>] [--format json|yaml] [--prune] [--exit-code] [--json]
+  atlas config promote --from <profile> --to <profile> [--dry-run] [--prune] [--yes] [--format json|yaml]
 
 export  Read the instance's current config (instance/auth config, OAuth clients
         and providers, SSO connections, resource servers, JWT templates, roles,
@@ -618,13 +652,35 @@ plan    A Terraform-style, read-only diff of the directory against the live
         instance: field-by-field before -> after for updates. --exit-code exits 2
         when there is drift (for CI); --json for tooling.
 
+promote Copy one environment's configuration to another (development ->
+        staging -> production). Each environment is a profile holding that
+        instance's secret key ('atlas login --profile staging'). Uses the same
+        plan/apply engine as import; --dry-run prints the plan only, and
+        applying to a live key needs --yes. Secrets never travel.
+
 Secrets never live on disk. Inject a credential at import with a \${ENV_VAR}
 placeholder in a file (e.g. a provider "client_secret": "\${GOOGLE_SECRET}").`,
+    pages: `atlas pages — code-defined hosted-page templates
+
+Usage:
+  atlas pages list [--json]
+  atlas pages push <file> --page <sign-in|sign-up|user-profile> [--promote] [--json]
+  atlas pages preview --page <page> [--json]
+  atlas pages promote --page <page> [--json]
+  atlas pages pull --page <page> [--draft]
+  atlas pages discard --page <page> --status <draft|live> [--json]
+
+A template is a JSON file of components (heading, text, image, link, button_link,
+list, divider, spacer, columns) in four regions around the sign-in card: header,
+above_form, below_form and footer. There is no raw HTML, CSS or script; Atlas
+validates the file and renders it. push saves a draft only; the live page does not
+change until promote (or push --promote). preview prints a signed link, valid for an
+hour, that shows the draft with a preview banner.`,
     actions: `atlas actions — manage Actions (tenant code run in the auth pipeline)
 
 Usage:
   atlas actions list [--json]
-  atlas actions deploy <file> --trigger <post_login|pre_user_registration|post_user_registration> [--name <n>] [--json]
+  atlas actions deploy <file> --trigger <trigger> [--name <n>] [--json]
   atlas actions test <file> [--trigger <t>] [--json]
   atlas actions logs <action-id> [--json]
 

package/dist/help.js.map

@@ -1 +1 @@
-{"version":3,"file":"help.js","sourceRoot":"","sources":["../src/help.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEU,QAAA,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wDAgFgC,CAAC;AAEzD,oDAAoD;AACvC,QAAA,YAAY,GAA2B;IAClD,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8CA4FmC;IAC5C,IAAI,EAAE;;;;;;;;;;gEAUwD;IAC9D,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2EAmCiE;IACzE,GAAG,EAAE;;;;;;;;;;;;;;;+CAewC;IAC7C,MAAM,EAAE;;;;;;;;;;;;sCAY4B;IACpC,SAAS,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yEAkD4D;IAEvE,KAAK,EAAE;;;;;;;;;;;;;;;;;;;;wEAoB+D;IAEtE,KAAK,EAAE;;;;;4CAKmC;IAE1C,IAAI,EAAE;;;;;;;;;;;;qBAYa;IAEnB,MAAM,EAAE;;uCAE6B;IAErC,MAAM,EAAE;;gDAEsC;IAE9C,KAAK,EAAE;;;;;;wCAM+B;IAEtC,IAAI,EAAE;;;;;uCAK+B;IAErC,UAAU,EAAE;;;;;;8CAMgC;IAE5C,QAAQ,EAAE;;;;;;;;;;;;;;;;;;;;4DAoBgD;IAC1D,MAAM,EAAE;;;;;;;;;;;;gFAYsE;IAC9E,aAAa,EAAE;;;;;;;;;gFAS+D;IAC9E,GAAG,EAAE;;;;;;;;;;;;;;;+DAewD;IAE7D,mBAAmB,EAAE;;;;;;;;;;;;;;;;oCAgBa;IAElC,KAAK,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8CA6BqC;IAE5C,aAAa,EAAE;;;;;;;;;;;;;;;;;;;;;;;;qBAwBI;IAEnB,YAAY,EAAE;;;;;;;;;;;;;;qCAcqB;IAEnC,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yEA+BiE;IAEvE,SAAS,EAAE;;;;;;oDAMuC;IAElD,MAAM,EAAE;;;;;;;;iEAQuD;IAE/D,GAAG,EAAE;;;;;;;;;;mDAU4C;IAEjD,MAAM,EAAE;;;;;;;;wDAQ8C;IAEtD,QAAQ,EAAE;;;8CAGkC;IAE5C,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;8EAyBoE;IAC5E,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;qEA0B0D;CACpE,CAAC"}
+{"version":3,"file":"help.js","sourceRoot":"","sources":["../src/help.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEU,QAAA,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wDAqFgC,CAAC;AAEzD,oDAAoD;AACvC,QAAA,YAAY,GAA2B;IAClD,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8CA8GmC;IAC5C,IAAI,EAAE;;;;;;;;;;gEAUwD;IAC9D,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2EAmCiE;IACzE,GAAG,EAAE;;;;;;;;;;;;;;;+CAewC;IAC7C,MAAM,EAAE;;;;;;;;;;;;sCAY4B;IACpC,SAAS,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yEAkD4D;IAEvE,KAAK,EAAE;;;;;;;;;;;;;;;;;;;;wEAoB+D;IAEtE,KAAK,EAAE;;;;;4CAKmC;IAE1C,IAAI,EAAE;;;;;;;;;;;;qBAYa;IAEnB,MAAM,EAAE;;uCAE6B;IAErC,MAAM,EAAE;;gDAEsC;IAE9C,KAAK,EAAE;;;;;;wCAM+B;IAEtC,IAAI,EAAE;;;;;uCAK+B;IAErC,UAAU,EAAE;;;;;;8CAMgC;IAE5C,QAAQ,EAAE;;;;;;;;;;;;;;;;;;;;4DAoBgD;IAC1D,MAAM,EAAE;;;;;;;;;;;;gFAYsE;IAC9E,GAAG,EAAE;;;;;;;;;2EASoE;IACzE,aAAa,EAAE;;;;;;;;;gFAS+D;IAC9E,GAAG,EAAE;;;;;;;;;;;;;;;+DAewD;IAE7D,mBAAmB,EAAE;;;;;;;;;;;;;;;;oCAgBa;IAElC,KAAK,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8CA6BqC;IAE5C,aAAa,EAAE;;;;;;;;;;;;;;;;;;;;;;;;qBAwBI;IAEnB,YAAY,EAAE;;;;;;;;;;;;;;qCAcqB;IAEnC,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yEA+BiE;IAEvE,SAAS,EAAE;;;;;;oDAMuC;IAElD,MAAM,EAAE;;;;;;;;iEAQuD;IAE/D,GAAG,EAAE;;;;;;;;;;mDAU4C;IAEjD,MAAM,EAAE;;;;;;;;wDAQ8C;IAEtD,QAAQ,EAAE;;;8CAGkC;IAE5C,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8EAgCoE;IAC5E,KAAK,EAAE;;;;;;;;;;;;;;;kDAeyC;IAChD,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;qEA0B0D;CACpE,CAAC"}

package/dist/index.d.ts

@@ -20,6 +20,7 @@ export { webhooks } from './commands/webhooks';
 export { sessions } from './commands/sessions';
 export { config } from './commands/config';
 export { actions } from './commands/actions';
+export { pages } from './commands/pages';
 export { init } from './commands/init';
 export { preflight, envCommand, client } from './commands/project-commands';
 export { referrals } from './commands/referrals';

package/dist/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.BETTER_AUTH_MIGRATION_STEPS = exports.migrateBetterAuth = exports.translateBetterAuth = exports.planConfigImport = exports.migrate = exports.manifestPath = exports.writeManifest = exports.readManifest = exports.deliverSecret = exports.productDir = exports.renderDotenv = exports.parseDotenv = exports.readEnvFile = exports.writeSecretFile = exports.referrals = exports.client = exports.envCommand = exports.preflight = exports.init = exports.actions = exports.config = exports.sessions = exports.webhooks = exports.apiKeys = exports.orgs = exports.users = exports.whoami = exports.logout = exports.login = exports.getVersion = exports.defaultPrompter = exports.defaultConfigPath = exports.MemoryConfigStore = exports.FileConfigStore = exports.captureIO = exports.defaultIO = exports.CliError = exports.isNotFound = exports.createConfigHttp = exports.defaultContext = exports.run = void 0;
+exports.BETTER_AUTH_MIGRATION_STEPS = exports.migrateBetterAuth = exports.translateBetterAuth = exports.planConfigImport = exports.migrate = exports.manifestPath = exports.writeManifest = exports.readManifest = exports.deliverSecret = exports.productDir = exports.renderDotenv = exports.parseDotenv = exports.readEnvFile = exports.writeSecretFile = exports.referrals = exports.client = exports.envCommand = exports.preflight = exports.init = exports.pages = exports.actions = exports.config = exports.sessions = exports.webhooks = exports.apiKeys = exports.orgs = exports.users = exports.whoami = exports.logout = exports.login = exports.getVersion = exports.defaultPrompter = exports.defaultConfigPath = exports.MemoryConfigStore = exports.FileConfigStore = exports.captureIO = exports.defaultIO = exports.CliError = exports.isNotFound = exports.createConfigHttp = exports.defaultContext = exports.run = void 0;
 /**
  * Library surface of `@atlasauth/cli`. The package ships a bin (`atlas`), but
  * exporting the pieces lets the handlers be unit-tested with injected deps and
@@ -46,6 +46,8 @@ var config_2 = require("./commands/config");
 Object.defineProperty(exports, "config", { enumerable: true, get: function () { return config_2.config; } });
 var actions_1 = require("./commands/actions");
 Object.defineProperty(exports, "actions", { enumerable: true, get: function () { return actions_1.actions; } });
+var pages_1 = require("./commands/pages");
+Object.defineProperty(exports, "pages", { enumerable: true, get: function () { return pages_1.pages; } });
 var init_1 = require("./commands/init");
 Object.defineProperty(exports, "init", { enumerable: true, get: function () { return init_1.init; } });
 var project_commands_1 = require("./commands/project-commands");

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA;;;;;GAKG;AACH,6BAA0C;AAAjC,0FAAA,GAAG,OAAA;AACZ,qCAAmF;AAA1E,yGAAA,cAAc,OAAA;AACvB,6CAA8E;AAArE,+GAAA,gBAAgB,OAAA;AAAE,yGAAA,UAAU,OAAA;AACrC,mCAAoC;AAA3B,kGAAA,QAAQ,OAAA;AACjB,2BAAqE;AAA5D,+FAAA,SAAS,OAAA;AAAE,+FAAA,SAAS,OAAA;AAC7B,mCAOkB;AANhB,yGAAA,eAAe,OAAA;AACf,2GAAA,iBAAiB,OAAA;AACjB,2GAAA,iBAAiB,OAAA;AAKnB,mCAA0D;AAAjD,yGAAA,eAAe,OAAA;AACxB,qCAAuC;AAA9B,qGAAA,UAAU,OAAA;AAEnB,0EAA0E;AAC1E,wCAAwD;AAA/C,6FAAA,KAAK,OAAA;AAAE,8FAAA,MAAM,OAAA;AAAE,8FAAA,MAAM,OAAA;AAC9B,0CAAyC;AAAhC,8FAAA,KAAK,OAAA;AACd,wCAAuC;AAA9B,4FAAA,IAAI,OAAA;AACb,gDAA8C;AAArC,mGAAA,OAAO,OAAA;AAChB,gDAA+C;AAAtC,oGAAA,QAAQ,OAAA;AACjB,gDAA+C;AAAtC,oGAAA,QAAQ,OAAA;AACjB,4CAA2C;AAAlC,gGAAA,MAAM,OAAA;AACf,8CAA6C;AAApC,kGAAA,OAAO,OAAA;AAChB,wCAAuC;AAA9B,4FAAA,IAAI,OAAA;AACb,gEAA4E;AAAnE,6GAAA,SAAS,OAAA;AAAE,8GAAA,UAAU,OAAA;AAAE,0GAAA,MAAM,OAAA;AACtC,kDAAiD;AAAxC,sGAAA,SAAS,OAAA;AAClB,qCAOmB;AANjB,0GAAA,eAAe,OAAA;AACf,sGAAA,WAAW,OAAA;AACX,sGAAA,WAAW,OAAA;AACX,uGAAA,YAAY,OAAA;AACZ,qGAAA,UAAU,OAAA;AACV,wGAAA,aAAa,OAAA;AAEf,qCAOmB;AANjB,uGAAA,YAAY,OAAA;AACZ,wGAAA,aAAa,OAAA;AACb,uGAAA,YAAY,OAAA;AAKd,8CAA6C;AAApC,kGAAA,OAAO,OAAA;AAChB,4CAA0F;AAAjF,0GAAA,gBAAgB,OAAA;AACzB,6DAA+H;AAAtH,gHAAA,mBAAmB,OAAA;AAC5B,mEAA6G;AAApG,iHAAA,iBAAiB,OAAA;AAAE,2HAAA,KAAK,OAA+B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA;;;;;GAKG;AACH,6BAA0C;AAAjC,0FAAA,GAAG,OAAA;AACZ,qCAAmF;AAA1E,yGAAA,cAAc,OAAA;AACvB,6CAA8E;AAArE,+GAAA,gBAAgB,OAAA;AAAE,yGAAA,UAAU,OAAA;AACrC,mCAAoC;AAA3B,kGAAA,QAAQ,OAAA;AACjB,2BAAqE;AAA5D,+FAAA,SAAS,OAAA;AAAE,+FAAA,SAAS,OAAA;AAC7B,mCAOkB;AANhB,yGAAA,eAAe,OAAA;AACf,2GAAA,iBAAiB,OAAA;AACjB,2GAAA,iBAAiB,OAAA;AAKnB,mCAA0D;AAAjD,yGAAA,eAAe,OAAA;AACxB,qCAAuC;AAA9B,qGAAA,UAAU,OAAA;AAEnB,0EAA0E;AAC1E,wCAAwD;AAA/C,6FAAA,KAAK,OAAA;AAAE,8FAAA,MAAM,OAAA;AAAE,8FAAA,MAAM,OAAA;AAC9B,0CAAyC;AAAhC,8FAAA,KAAK,OAAA;AACd,wCAAuC;AAA9B,4FAAA,IAAI,OAAA;AACb,gDAA8C;AAArC,mGAAA,OAAO,OAAA;AAChB,gDAA+C;AAAtC,oGAAA,QAAQ,OAAA;AACjB,gDAA+C;AAAtC,oGAAA,QAAQ,OAAA;AACjB,4CAA2C;AAAlC,gGAAA,MAAM,OAAA;AACf,8CAA6C;AAApC,kGAAA,OAAO,OAAA;AAChB,0CAAyC;AAAhC,8FAAA,KAAK,OAAA;AACd,wCAAuC;AAA9B,4FAAA,IAAI,OAAA;AACb,gEAA4E;AAAnE,6GAAA,SAAS,OAAA;AAAE,8GAAA,UAAU,OAAA;AAAE,0GAAA,MAAM,OAAA;AACtC,kDAAiD;AAAxC,sGAAA,SAAS,OAAA;AAClB,qCAOmB;AANjB,0GAAA,eAAe,OAAA;AACf,sGAAA,WAAW,OAAA;AACX,sGAAA,WAAW,OAAA;AACX,uGAAA,YAAY,OAAA;AACZ,qGAAA,UAAU,OAAA;AACV,wGAAA,aAAa,OAAA;AAEf,qCAOmB;AANjB,uGAAA,YAAY,OAAA;AACZ,wGAAA,aAAa,OAAA;AACb,uGAAA,YAAY,OAAA;AAKd,8CAA6C;AAApC,kGAAA,OAAO,OAAA;AAChB,4CAA0F;AAAjF,0GAAA,gBAAgB,OAAA;AACzB,6DAA+H;AAAtH,gHAAA,mBAAmB,OAAA;AAC5B,mEAA6G;AAApG,iHAAA,iBAAiB,OAAA;AAAE,2HAAA,KAAK,OAA+B"}

package/dist/migrate/appwrite/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const appwritePlugin: MigrationPlugin;

package/dist/migrate/appwrite/plugin.js

@@ -0,0 +1,103 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.appwritePlugin = void 0;
+const appwrite_1 = require("../export/appwrite");
+const appwrite_config_1 = require("../export/appwrite-config");
+const errors_1 = require("../../errors");
+const plugin_kit_1 = require("../export/plugin-kit");
+const project_files_1 = require("../export/project-files");
+/**
+ * `atlas migrate appwrite` — an Appwrite project (Cloud or self-hosted): auth
+ * settings from appwrite.json and the project document, users with their
+ * hashes and hash options, identities, MFA recovery codes, teams, memberships
+ * and invitations through the Server API (an API key on this machine), the
+ * `appwrite` remote bridge (Appwrite vouches for a live session once), lazy
+ * migration through the Account API for anyone the export missed, and the
+ * `appwrite` codemod.
+ */
+const ENDPOINT = { flag: '--appwrite-endpoint', env: 'APPWRITE_ENDPOINT', label: 'the Appwrite API endpoint including /v1 (default https://cloud.appwrite.io/v1)', required: false };
+const PROJECT_ID = { flag: '--appwrite-project-id', env: 'APPWRITE_PROJECT_ID', label: 'the Appwrite project id', required: true };
+const API_KEY = { flag: '--appwrite-api-key', env: 'APPWRITE_API_KEY', label: 'an Appwrite API key with users.read and teams.read', required: true, secret: true };
+const RECOVERY_CODES = { flag: '--appwrite-recovery-codes', env: 'APPWRITE_RECOVERY_CODES', label: 'true to export MFA recovery codes', required: false };
+const SKIP_TEAMS = { flag: '--appwrite-skip-teams', env: 'APPWRITE_SKIP_TEAMS', label: 'true to leave teams out', required: false };
+const CONFIG_FILE = { flag: '--appwrite-config', env: 'APPWRITE_CONFIG_FILE', label: 'appwrite.json (after appwrite pull settings)', required: false };
+const PROJECT_FILE = { flag: '--appwrite-project-file', env: 'APPWRITE_PROJECT_FILE', label: 'the project document (appwrite projects get --project-id <id> --json)', required: false };
+function endpointOf(p) {
+    return (p.credential(ENDPOINT) ?? appwrite_1.APPWRITE_CLOUD).trim().replace(/\/+$/, '');
+}
+exports.appwritePlugin = {
+    vendor: 'appwrite',
+    source: 'appwrite',
+    label: 'Appwrite',
+    help: 'Move an Appwrite project: its auth methods, session and password settings and OAuth providers as Atlas config; its users with their password hashes (Argon2, bcrypt, scrypt, Firebase scrypt, MD5, SHA, phpass), labels, prefs, OAuth identities, MFA recovery codes, teams, memberships and invitations; a zero-logout bridge that asks Appwrite about each live session once; lazy migration for anyone left; and the code. Your API key stays on this machine.',
+    config: {
+        reads: 'appwrite.json (appwrite pull settings) and, for OAuth providers, the project document (appwrite projects get --json)',
+        credentials: [CONFIG_FILE, PROJECT_FILE, ENDPOINT, { ...PROJECT_ID, required: false }],
+        async translate(p) {
+            const file = (0, project_files_1.projectFile)(p, CONFIG_FILE, ['appwrite.json', 'appwrite.config.json']);
+            const projectText = (0, plugin_kit_1.localFile)(p, PROJECT_FILE, 'text');
+            if (!file && !projectText)
+                throw new errors_1.CliError('Appwrite: no appwrite.json in this folder. Run appwrite pull settings, or pass --set appwrite-config=<file> / --set appwrite-project-file=<appwrite projects get --json output>.');
+            let project;
+            if (projectText) {
+                try {
+                    project = JSON.parse(projectText);
+                }
+                catch {
+                    throw new errors_1.CliError('Appwrite: the project document is not JSON (use appwrite projects get --project-id <id> --json).');
+                }
+            }
+            return (0, plugin_kit_1.vendorStep)('Appwrite', async () => (0, appwrite_config_1.translateAppwriteConfig)({ file, project, endpoint: p.credential(ENDPOINT), projectId: p.credential({ ...PROJECT_ID, required: false }) }));
+        },
+    },
+    export: {
+        reads: 'the Appwrite Server API (users with hashes, identities, MFA, teams and memberships)',
+        credentials: [ENDPOINT, PROJECT_ID, API_KEY, RECOVERY_CODES, SKIP_TEAMS],
+        limits: [
+            'TOTP secrets are encrypted at rest and Appwrite has no API to read them: those users enrol an authenticator app again. Recovery codes move with --set appwrite-recovery-codes=true.',
+            'Sessions are stored as hashes and cannot be exported: the appwrite bridge preset asks Appwrite about each live session once instead.',
+            'A SHA hash imported into Appwrite without a version is ambiguous (SHA3-512 on 1.x, SHA-256 on 2.x): the export picks by digest length and warns.',
+            'OAuth access and refresh tokens are not exported: users keep their link and re-consent when your app next calls the provider.',
+        ],
+        async run(p, writer, resume) {
+            const set = await (0, plugin_kit_1.vendorStep)('Appwrite', () => (0, appwrite_1.exportAppwrite)({
+                endpoint: endpointOf(p),
+                projectId: (0, plugin_kit_1.need)(p, PROJECT_ID),
+                apiKey: (0, plugin_kit_1.need)(p, API_KEY),
+                recoveryCodes: (0, project_files_1.truthyCredential)(p, RECOVERY_CODES),
+                skipTeams: (0, project_files_1.truthyCredential)(p, SKIP_TEAMS),
+                fetchImpl: p.fetch,
+                onProgress: (m) => p.say(`  reading ${m}`),
+            }));
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    bridge: {
+        preset: 'appwrite',
+        vars(p, t) {
+            const vars = { ...t?.bridge?.vars };
+            const endpoint = p.credential(ENDPOINT);
+            if (endpoint || !vars.endpoint_url)
+                vars.endpoint_url = endpointOf(p);
+            const project = p.credential({ ...PROJECT_ID, required: false });
+            if (project)
+                vars.project_id = project;
+            return vars;
+        },
+    },
+    lazy: {
+        preset: 'appwrite',
+        config(p, t) {
+            const config = { ...t?.lazy?.config };
+            const endpoint = p.credential(ENDPOINT);
+            if (endpoint || !config.endpoint)
+                config.endpoint = endpointOf(p);
+            const project = p.credential({ ...PROJECT_ID, required: false });
+            if (project)
+                config.project_id = project;
+            return config;
+        },
+    },
+    codemod: 'appwrite',
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/appwrite/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/appwrite/plugin.ts"],"names":[],"mappings":";;;AAAA,iDAAoE;AACpE,+DAAoE;AACpE,yCAAwC;AAExC,qDAAmF;AACnF,2DAAwE;AAExE;;;;;;;;GAQG;AAEH,MAAM,QAAQ,GAAmB,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,gFAAgF,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACrM,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,yBAAyB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACnJ,MAAM,OAAO,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,oDAAoD,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACnL,MAAM,cAAc,GAAmB,EAAE,IAAI,EAAE,2BAA2B,EAAE,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,mCAAmC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC1K,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,yBAAyB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACpJ,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,8CAA8C,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACvK,MAAM,YAAY,GAAmB,EAAE,IAAI,EAAE,yBAAyB,EAAE,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,uEAAuE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAExM,SAAS,UAAU,CAAC,CAAgB;IAClC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,yBAAc,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC/E,CAAC;AAEY,QAAA,cAAc,GAAoB;IAC7C,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,UAAU;IAClB,KAAK,EAAE,UAAU;IACjB,IAAI,EAAE,mcAAmc;IACzc,MAAM,EAAE;QACN,KAAK,EAAE,sHAAsH;QAC7H,WAAW,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACtF,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,IAAI,GAAG,IAAA,2BAAW,EAAC,CAAC,EAAE,WAAW,EAAE,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC,CAAC;YACpF,MAAM,WAAW,GAAG,IAAA,sBAAS,EAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;YACvD,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW;gBAAE,MAAM,IAAI,iBAAQ,CAAC,kLAAkL,CAAC,CAAC;YAClO,IAAI,OAA4C,CAAC;YACjD,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAA4B,CAAC;gBAC/D,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,IAAI,iBAAQ,CAAC,kGAAkG,CAAC,CAAC;gBACzH,CAAC;YACH,CAAC;YACD,OAAO,IAAA,uBAAU,EAAC,UAAU,EAAE,KAAK,IAAI,EAAE,CACvC,IAAA,yCAAuB,EAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAC1I,CAAC;QACJ,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,qFAAqF;QAC5F,WAAW,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,CAAC;QACxE,MAAM,EAAE;YACN,qLAAqL;YACrL,sIAAsI;YACtI,kJAAkJ;YAClJ,+HAA+H;SAChI;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,UAAU,EAAE,GAAG,EAAE,CAC5C,IAAA,yBAAc,EAAC;gBACb,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;gBACvB,SAAS,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,UAAU,CAAC;gBAC9B,MAAM,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,OAAO,CAAC;gBACxB,aAAa,EAAE,IAAA,gCAAgB,EAAC,CAAC,EAAE,cAAc,CAAC;gBAClD,SAAS,EAAE,IAAA,gCAAgB,EAAC,CAAC,EAAE,UAAU,CAAC;gBAC1C,SAAS,EAAE,CAAC,CAAC,KAAK;gBAClB,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;aAC3C,CAAC,CACH,CAAC;YACF,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,UAAU;QAClB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,GAA2B,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC5D,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACxC,IAAI,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY;gBAAE,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YACtE,MAAM,OAAO,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YACjE,IAAI,OAAO;gBAAE,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC;YACvC,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,UAAU;QAClB,MAAM,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,MAAM,GAA2B,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9D,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACxC,IAAI,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAAE,MAAM,CAAC,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAClE,MAAM,OAAO,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YACjE,IAAI,OAAO;gBAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC;YACzC,OAAO,MAAM,CAAC;QAChB,CAAC;KACF;IACD,OAAO,EAAE,UAAU;CACpB,CAAC"}

package/dist/migrate/authentik/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const authentikPlugin: MigrationPlugin;

package/dist/migrate/authentik/plugin.js

@@ -0,0 +1,135 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authentikPlugin = void 0;
+const node_path_1 = require("node:path");
+const errors_1 = require("../../errors");
+const authentik_1 = require("../export/authentik");
+const authentik_config_1 = require("../export/authentik-config");
+const tables_1 = require("../export/frameworks/tables");
+const plugin_kit_1 = require("../export/plugin-kit");
+/**
+ * `atlas migrate authentik` — a self-hosted authentik: its blueprint file (or
+ * the settings objects through the API) as Atlas config; users with their
+ * Django password digests (PBKDF2, bcrypt, Argon2, scrypt), social and SAML
+ * source links, groups and RBAC roles, API and app-password tokens, TOTP
+ * seeds, recovery codes, SMS / email factors and WebAuthn passkeys from a
+ * dump of authentik's own PostgreSQL tables made on this machine; the
+ * `authentik` bridge preset (an OAuth2 provider's token becomes an Atlas
+ * session); lazy migration through authentik's flow executor when only the API
+ * is available; and the code. Nothing here connects to the database.
+ */
+const DUMP = { flag: '--authentik-dump', env: 'AUTHENTIK_DUMP_DIR', label: 'a folder of authentik table dumps (authentik_core_user.csv, authentik_core_group.json, …)', required: false };
+const URL_ = { flag: '--authentik-url', env: 'AUTHENTIK_URL', label: 'the authentik URL (https://auth.example.com)', required: false };
+const TOKEN = { flag: '--authentik-token', env: 'AUTHENTIK_TOKEN', label: 'an authentik API token (Directory → Tokens, intent API)', required: false, secret: true };
+const BLUEPRINT = { flag: '--authentik-blueprint', env: 'AUTHENTIK_BLUEPRINT', label: 'a blueprint YAML file (ak export_blueprint)', required: false };
+const SUB_MODE = { flag: '--authentik-sub-mode', env: 'AUTHENTIK_SUB_MODE', label: `the provider's Subject mode (${authentik_1.AUTHENTIK_SUB_MODES.join(', ')}); default: the mode the providers in the dump use, else hashed_user_id`, required: false };
+const INSTALL_ID = { flag: '--authentik-install-id', env: 'AUTHENTIK_INSTALL_ID', label: 'the install id (SELECT id FROM authentik_install_id), when the dump lacks that table', required: false };
+const GROUPS_AS = { flag: '--authentik-groups-as', env: 'AUTHENTIK_GROUPS_AS', label: 'roles (default), organizations or skip: what authentik groups become', required: false };
+const RP_ID = { flag: '--rp-id', env: 'ATLAS_MIGRATE_RP_ID', label: 'the WebAuthn relying party id for passkeys registered before authentik stored one (your authentik host)', required: false };
+const TRUST_EMAILS = { flag: '--authentik-trust-emails', env: 'AUTHENTIK_TRUST_EMAILS', label: '"true" to treat every email address as verified (authentik has no verified flag)', required: false };
+const OAUTH_TOKENS = { flag: '--authentik-oauth-tokens', env: 'AUTHENTIK_OAUTH_TOKENS', label: '"include" to carry the stored upstream OAuth access tokens of social links', required: false };
+const ISSUER = { flag: '--authentik-issuer', env: 'AUTHENTIK_ISSUER', label: "the provider's issuer URL (https://auth.example.com/application/o/<application slug>)", required: false };
+const CLIENT_ID = { flag: '--authentik-client-id', env: 'AUTHENTIK_CLIENT_ID', label: "the OAuth2 provider's client id (the tokens' aud)", required: false };
+const FLOW_SLUG = { flag: '--authentik-flow-slug', env: 'AUTHENTIK_FLOW_SLUG', label: 'the authentication flow slug for lazy migration (default default-authentication-flow)', required: false };
+const LAZY_SUB_MODES = ['hashed_user_id', 'user_id', 'user_username', 'user_email'];
+function subMode(p) {
+    const raw = p.credential(SUB_MODE)?.trim().toLowerCase();
+    if (!raw)
+        return undefined;
+    if (!authentik_1.AUTHENTIK_SUB_MODES.includes(raw))
+        throw new errors_1.CliError(`authentik: --set authentik-sub-mode takes ${authentik_1.AUTHENTIK_SUB_MODES.join(', ')} (got ${raw}).`);
+    return raw;
+}
+const baseUrl = (p) => p.credential(URL_)?.trim().replace(/\/+$/, '');
+exports.authentikPlugin = {
+    vendor: 'authentik',
+    source: 'authentik',
+    label: 'authentik',
+    help: "Move authentik: a blueprint file (or the settings objects through the API) as Atlas config; users with their password digests, social and SAML identities, groups and roles, tokens, authenticator apps, recovery codes and passkeys from a dump of authentik's own tables made with psql; a zero-logout bridge for an OAuth2 provider's tokens; lazy migration through authentik's flows when you only have the API; and the code. Database access stays on this machine.",
+    config: {
+        reads: 'a blueprint YAML file, or the settings objects through the authentik API',
+        credentials: [BLUEPRINT, URL_, TOKEN],
+        async translate(p) {
+            const url = baseUrl(p);
+            const file = p.credential(BLUEPRINT);
+            if (file) {
+                const text = (0, plugin_kit_1.localFile)(p, BLUEPRINT, 'text');
+                return (0, authentik_config_1.translateAuthentikConfig)(await (0, plugin_kit_1.vendorStep)('authentik', async () => (0, authentik_config_1.snapshotFromBlueprint)(text, file, url)));
+            }
+            const token = p.credential(TOKEN);
+            if (url && token)
+                return (0, authentik_config_1.translateAuthentikConfig)(await (0, plugin_kit_1.vendorStep)('authentik', () => (0, authentik_config_1.fetchAuthentikConfig)({ baseUrl: url, token, fetchImpl: p.fetch })));
+            throw new errors_1.CliError('authentik: pass a blueprint file (--set authentik-blueprint=<file>, from `ak export_blueprint`), or the authentik URL and an API token to read the settings through the API.');
+        },
+    },
+    export: {
+        reads: "a dump of authentik's tables (psql \\copy of authentik_core_user, groups, tokens, source links, authenticator devices …) or the authentik API",
+        credentials: [DUMP, URL_, TOKEN, SUB_MODE, INSTALL_ID, GROUPS_AS, RP_ID, TRUST_EMAILS, OAUTH_TOKENS],
+        limits: [
+            'The API never returns password hashes, TOTP seeds, recovery codes or WebAuthn public keys: dump the database tables to move them. The API export has users, groups, roles, source links and API token keys only; passwords then move by lazy migration and authenticator users enrol again.',
+            'authentik has no verified-email flag: addresses are verified only when the user attribute email_verified is true, or with --set authentik-trust-emails=true.',
+            'Users are keyed by the `sub` your providers hand out (the Subject mode; hashed_user_id by default, which needs the install id): the export reads it from the dump, and warns when providers disagree.',
+            'Service accounts, outpost accounts and recovery or verification tokens do not move; LDAP, Kerberos and other directory source links stay with their directory.',
+            'Passkeys only work on the domain they were registered for; devices registered before authentik stored an RP id need --set rp-id=<your authentik host>.',
+        ],
+        async run(p, writer, resume) {
+            const dump = p.credential(DUMP);
+            const url = baseUrl(p);
+            const token = dump ? undefined : p.credential(TOKEN);
+            if (!dump && !(url && token)) {
+                throw new errors_1.CliError('authentik: pass a folder of table dumps (--set authentik-dump=<folder>), or the authentik URL and an API token for an export without password hashes.');
+            }
+            const groups = p.credential(GROUPS_AS)?.trim().toLowerCase();
+            if (groups && !['roles', 'organizations', 'skip'].includes(groups))
+                throw new errors_1.CliError(`authentik: --set authentik-groups-as takes roles, organizations or skip (got ${groups}).`);
+            const set = await (0, plugin_kit_1.vendorStep)('authentik', () => (0, authentik_1.exportAuthentik)({
+                tables: dump ? (0, tables_1.readDumpDir)((0, node_path_1.resolve)(dump)) : undefined,
+                baseUrl: url,
+                token,
+                subMode: subMode(p),
+                installId: p.credential(INSTALL_ID),
+                groupsAs: groups,
+                rpId: p.credential(RP_ID),
+                trustEmails: p.credential(TRUST_EMAILS)?.toLowerCase() === 'true',
+                oauthTokens: p.credential(OAUTH_TOKENS) === 'include',
+                fetchImpl: p.fetch,
+                onProgress: (m) => p.say(`  reading ${m}`),
+            }));
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    bridge: {
+        preset: 'authentik',
+        vars(p, t) {
+            const vars = { ...t?.bridge?.vars };
+            const issuer = p.credential(ISSUER);
+            if (issuer)
+                vars.issuer = issuer.trim().replace(/\/+$/, '');
+            const clientId = p.credential(CLIENT_ID);
+            if (clientId)
+                vars.client_id = clientId.trim();
+            return vars;
+        },
+    },
+    lazy: {
+        preset: 'authentik',
+        config(p, t) {
+            const config = { ...t?.lazy?.config };
+            const url = baseUrl(p);
+            if (url)
+                config.base_url = url;
+            const flow = p.credential(FLOW_SLUG);
+            if (flow)
+                config.flow_slug = flow.trim();
+            const mode = subMode(p);
+            if (mode) {
+                if (!LAZY_SUB_MODES.includes(mode))
+                    throw new errors_1.CliError(`authentik: lazy migration reads the user from a session, which has no ${mode}: use ${LAZY_SUB_MODES.join(', ')}, or move users with the database export.`);
+                config.sub_mode = mode;
+            }
+            return config;
+        },
+    },
+    codemod: 'authentik',
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/authentik/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/authentik/plugin.ts"],"names":[],"mappings":";;;AAAA,yCAAoC;AACpC,yCAAwC;AACxC,mDAAkG;AAClG,iEAAmH;AACnH,wDAA0D;AAC1D,qDAA6E;AAG7E;;;;;;;;;;GAUG;AAEH,MAAM,IAAI,GAAmB,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,2FAA2F,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC1M,MAAM,IAAI,GAAmB,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,8CAA8C,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACvJ,MAAM,KAAK,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,yDAAyD,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACrL,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,6CAA6C,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACvK,MAAM,QAAQ,GAAmB,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,gCAAgC,+BAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,yEAAyE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC9P,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,wBAAwB,EAAE,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,sFAAsF,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACnN,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,sEAAsE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAChM,MAAM,KAAK,GAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,yGAAyG,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACjN,MAAM,YAAY,GAAmB,EAAE,IAAI,EAAE,0BAA0B,EAAE,GAAG,EAAE,wBAAwB,EAAE,KAAK,EAAE,kFAAkF,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACrN,MAAM,YAAY,GAAmB,EAAE,IAAI,EAAE,0BAA0B,EAAE,GAAG,EAAE,wBAAwB,EAAE,KAAK,EAAE,4EAA4E,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC/M,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,uFAAuF,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACxM,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,mDAAmD,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC7K,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,uFAAuF,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAEjN,MAAM,cAAc,GAAsB,CAAC,gBAAgB,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC;AAEvG,SAAS,OAAO,CAAC,CAAgB;IAC/B,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,CAAE,+BAAyC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,iBAAQ,CAAC,6CAA6C,+BAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC/K,OAAO,GAAuB,CAAC;AACjC,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,CAAgB,EAAsB,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAE5F,QAAA,eAAe,GAAoB;IAC9C,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,WAAW;IACnB,KAAK,EAAE,WAAW;IAClB,IAAI,EAAE,4cAA4c;IACld,MAAM,EAAE;QACN,KAAK,EAAE,0EAA0E;QACjF,WAAW,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC;QACrC,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACvB,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACrC,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,IAAI,GAAG,IAAA,sBAAS,EAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAE,CAAC;gBAC9C,OAAO,IAAA,2CAAwB,EAAC,MAAM,IAAA,uBAAU,EAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,IAAA,wCAAqB,EAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;YACrH,CAAC;YACD,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAClC,IAAI,GAAG,IAAI,KAAK;gBAAE,OAAO,IAAA,2CAAwB,EAAC,MAAM,IAAA,uBAAU,EAAC,WAAW,EAAE,GAAG,EAAE,CAAC,IAAA,uCAAoB,EAAC,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YAC1J,MAAM,IAAI,iBAAQ,CAAC,8KAA8K,CAAC,CAAC;QACrM,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,+IAA+I;QACtJ,WAAW,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,YAAY,CAAC;QACpG,MAAM,EAAE;YACN,6RAA6R;YAC7R,8JAA8J;YAC9J,uMAAuM;YACvM,gKAAgK;YAChK,wJAAwJ;SACzJ;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAChC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACvB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YACrD,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,iBAAQ,CAAC,uJAAuJ,CAAC,CAAC;YAC9K,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC7D,IAAI,MAAM,IAAI,CAAC,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,iBAAQ,CAAC,gFAAgF,MAAM,IAAI,CAAC,CAAC;YACnL,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,WAAW,EAAE,GAAG,EAAE,CAC7C,IAAA,2BAAe,EAAC;gBACd,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,IAAA,oBAAW,EAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBACrD,OAAO,EAAE,GAAG;gBACZ,KAAK;gBACL,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;gBACnB,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;gBACnC,QAAQ,EAAE,MAAwD;gBAClE,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;gBACzB,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,WAAW,EAAE,KAAK,MAAM;gBACjE,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,KAAK,SAAS;gBACrD,SAAS,EAAE,CAAC,CAAC,KAAK;gBAClB,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;aAC3C,CAAC,CACH,CAAC;YACF,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,WAAW;QACnB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,GAA2B,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC5D,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,MAAM;gBAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC5D,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,QAAQ;gBAAE,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,WAAW;QACnB,MAAM,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,MAAM,GAA2B,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9D,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACvB,IAAI,GAAG;gBAAE,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC;YAC/B,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACrC,IAAI,IAAI;gBAAE,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,iBAAQ,CAAC,yEAAyE,IAAI,SAAS,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;gBACnN,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;YACzB,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KACF;IACD,OAAO,EAAE,WAAW;CACrB,CAAC"}

package/dist/migrate/azure-ad-b2c/plugin.d.ts

@@ -0,0 +1,8 @@
+import { type AzureKind } from '../export/azure';
+import { type AzureConfigSnapshot } from '../export/azure-config';
+import type { MigrationPlugin } from '../framework/plugin';
+/** The B2C custom policy files of a folder (`*.xml`), for the config report. */
+export declare function readPolicyDir(dir: string): AzureConfigSnapshot['policies'];
+/** The plugin for one of the two Microsoft customer-identity products. */
+export declare function azurePlugin(kind: AzureKind): MigrationPlugin;
+export declare const azureAdB2cPlugin: MigrationPlugin;