@atlasauth/cli 0.12.0 → 0.13.0

package/dist/migrate/azure-ad-b2c/plugin.js

@@ -0,0 +1,165 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.azureAdB2cPlugin = void 0;
+exports.readPolicyDir = readPolicyDir;
+exports.azurePlugin = azurePlugin;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const azure_1 = require("../export/azure");
+const azure_config_1 = require("../export/azure-config");
+const errors_1 = require("../../errors");
+const project_files_1 = require("../export/project-files");
+const plugin_kit_1 = require("../export/plugin-kit");
+/**
+ * `atlas migrate azure-ad-b2c` and (through {@link azurePlugin})
+ * `atlas migrate entra-external-id` — a Microsoft customer-identity tenant
+ * through Microsoft Graph with an app registration the owner creates
+ * (client credentials). Users keyed by their object id with sign-in
+ * identities, federated links, custom attributes, groups and SMS / email
+ * factors; identity providers, user flows, custom policies (B2C), app
+ * registrations and groups as Atlas config; the JWT bridge preset; lazy
+ * migration (B2C ROPC user flow, External ID native authentication) — Graph
+ * never returns a password. The client secret is sent to Microsoft only.
+ */
+const TENANT = { flag: '--azure-tenant', env: 'AZURE_TENANT_ID', label: 'the tenant id (GUID) or domain (contoso.onmicrosoft.com)', required: true };
+const CLIENT_ID = { flag: '--azure-client-id', env: 'AZURE_CLIENT_ID', label: 'the client id of an app registration with Graph User.Read.All (application)', required: false };
+const CLIENT_SECRET = { flag: '--azure-client-secret', env: 'AZURE_CLIENT_SECRET', label: 'that app registration\'s client secret', required: false, secret: true };
+const ACCESS_TOKEN = { flag: '--azure-graph-token', env: 'AZURE_GRAPH_TOKEN', label: 'a Microsoft Graph access token, instead of client credentials', required: false, secret: true };
+const AUTH_METHODS = { flag: '--azure-auth-methods', env: 'AZURE_EXPORT_AUTH_METHODS', label: 'true to read each user\'s phone / email MFA methods (UserAuthenticationMethod.Read.All)', required: false };
+const DIRECTORY_USERS = { flag: '--azure-directory-users', env: 'AZURE_EXPORT_DIRECTORY_USERS', label: 'true to also export admin / work accounts', required: false };
+const GROUPS_AS = { flag: '--groups-as', env: 'ATLAS_MIGRATE_GROUPS_AS', label: 'how groups move: roles or skip', required: false };
+const POLICY_DIR = { flag: '--b2c-policy-dir', env: 'B2C_POLICY_DIR', label: 'a folder with your B2C custom policy XML files (TrustFrameworkBase.xml, …)', required: false };
+const APP_CLIENT_ID = { flag: '--azure-app-client-id', env: 'AZURE_APP_CLIENT_ID', label: 'your app\'s client id (the ID token audience; for lazy migration a public client)', required: false };
+const SIGN_IN_POLICY = { flag: '--b2c-policy', env: 'B2C_POLICY', label: 'the user flow / custom policy that issued your users\' tokens (B2C_1_signupsignin)', required: false };
+const ROPC_CLIENT_ID = { flag: '--b2c-ropc-client-id', env: 'B2C_ROPC_CLIENT_ID', label: 'the public client registration the ROPC user flow signs in with, when it is not your app\'s client id', required: false };
+const ROPC_POLICY = { flag: '--b2c-ropc-policy', env: 'B2C_ROPC_POLICY', label: 'the ROPC user flow lazy migration checks passwords with (B2C_1_ROPC_Auth)', required: false };
+const CUSTOM_DOMAIN = { flag: '--azure-custom-domain', env: 'AZURE_CUSTOM_DOMAIN', label: 'a custom domain in front of b2clogin.com / ciamlogin.com', required: false };
+function graph(p) {
+    const tenant = (0, plugin_kit_1.need)(p, TENANT).trim();
+    const accessToken = p.credential(ACCESS_TOKEN);
+    const clientId = p.credential(CLIENT_ID);
+    const clientSecret = p.credential(CLIENT_SECRET);
+    if (!accessToken && !(clientId && clientSecret)) {
+        throw new errors_1.CliError('Microsoft Graph: pass an app registration\'s client id and secret (AZURE_CLIENT_ID, AZURE_CLIENT_SECRET) with the User.Read.All application permission, or a Graph access token (AZURE_GRAPH_TOKEN).');
+    }
+    return { tenant, accessToken, clientId, clientSecret };
+}
+/** The B2C custom policy files of a folder (`*.xml`), for the config report. */
+function readPolicyDir(dir) {
+    const root = (0, node_path_1.resolve)(dir);
+    let names;
+    try {
+        names = (0, node_fs_1.readdirSync)(root);
+    }
+    catch (err) {
+        throw new errors_1.CliError(`Could not read the custom policy folder ${dir}: ${err.message}`);
+    }
+    return names
+        .filter((n) => n.toLowerCase().endsWith('.xml') && (0, node_fs_1.statSync)((0, node_path_1.join)(root, n)).isFile())
+        .sort()
+        .map((n) => ({ file: (0, node_path_1.basename)(n), text: (0, node_fs_1.readFileSync)((0, node_path_1.join)(root, n), 'utf8') }));
+}
+/** Tenant name of a domain argument (`contoso.onmicrosoft.com` → `contoso`), or undefined for a GUID. */
+function tenantNameOf(raw) {
+    const m = raw ? /^([a-z0-9-]+)\.(onmicrosoft|b2clogin|ciamlogin)\.com$/i.exec(raw.trim()) : null;
+    return m ? m[1].toLowerCase() : undefined;
+}
+const GUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** The plugin for one of the two Microsoft customer-identity products. */
+function azurePlugin(kind) {
+    const b2c = kind === 'b2c';
+    const label = b2c ? 'Azure AD B2C' : 'Microsoft Entra External ID';
+    const preset = b2c ? 'azure_ad_b2c' : 'entra_external_id';
+    const commonVars = (p, base) => {
+        const out = { ...base };
+        const tenant = p.credential({ ...TENANT, required: false })?.trim();
+        const name = tenantNameOf(tenant);
+        if (name)
+            out.tenant = name;
+        if (tenant && GUID.test(tenant))
+            out.tenant_id = tenant.toLowerCase();
+        const clientId = p.credential(APP_CLIENT_ID);
+        if (clientId)
+            out.client_id = clientId;
+        return out;
+    };
+    return {
+        vendor: b2c ? 'azure-ad-b2c' : 'entra-external-id',
+        source: preset,
+        label,
+        help: b2c
+            ? 'Move an Azure AD B2C tenant: identity providers, user flows, custom policies (with file and line), custom attributes, app registrations and groups as Atlas config; consumer users keyed by object id with their sign-in names, social links, custom attributes, groups and SMS / email factors; a zero-logout bridge for B2C ID tokens; lazy migration through a ROPC user flow (Graph never returns passwords); and the MSAL code. Your app registration secret stays on this machine.'
+            : 'Move a Microsoft Entra External ID (external) tenant: identity providers, sign-up / sign-in flows, custom attributes, app registrations and groups as Atlas config; customers keyed by object id with their sign-in identities, social links, custom attributes, groups and SMS / email factors; a zero-logout bridge for External ID ID tokens; lazy migration through the native authentication API (Graph never returns passwords); and the MSAL code. Your app registration secret stays on this machine.',
+        config: {
+            reads: `your ${label} tenant via Microsoft Graph${b2c ? ' (and your custom policy files with --b2c-policy-dir)' : ''}`,
+            credentials: [TENANT, CLIENT_ID, CLIENT_SECRET, ACCESS_TOKEN, ...(b2c ? [POLICY_DIR] : [])],
+            async translate(p) {
+                const g = graph(p);
+                const dir = b2c ? p.credential(POLICY_DIR) : undefined;
+                const policies = dir ? readPolicyDir(dir) : [];
+                const snap = await (0, plugin_kit_1.vendorStep)(label, () => (0, azure_config_1.fetchAzureConfig)((0, azure_1.graphHttp)({ ...g, fetchImpl: p.fetch }), kind, g.tenant, policies));
+                return (0, azure_config_1.translateAzureConfig)(snap);
+            },
+        },
+        export: {
+            reads: 'Microsoft Graph (users with their identities and extension attributes, groups, authentication methods)',
+            credentials: [TENANT, CLIENT_ID, CLIENT_SECRET, ACCESS_TOKEN, AUTH_METHODS, DIRECTORY_USERS],
+            limits: [
+                `${label} never returns passwords: Graph's password field is write-only. Every password moves by lazy migration, ${b2c ? 'through a ROPC user flow' : 'through the native authentication API'}, on the user's first Atlas sign-in.`,
+                'Authenticator-app (software OATH) secrets and FIDO2 keys are never exported: those users enrol again. SMS and email methods move with --set azure-auth-methods=true.',
+                'Sessions are not exported: the bridge exchanges the ID token your app holds (MSAL caches up to v3 are read in the browser; v4 caches are encrypted).',
+                ...(b2c ? ['Federated identities that Graph keeps only as an alternativeSecurityId cannot be linked by id: those users relink by verified email on first sign-in.'] : []),
+            ],
+            async run(p, writer, resume) {
+                const g = graph(p);
+                const groups = p.credential(GROUPS_AS) ?? 'roles';
+                if (groups !== 'roles' && groups !== 'skip')
+                    throw new errors_1.CliError(`${label}: --groups-as must be roles or skip (got ${groups}).`);
+                const set = await (0, plugin_kit_1.vendorStep)(label, () => (0, azure_1.exportAzure)({
+                    kind,
+                    ...g,
+                    authMethods: (0, project_files_1.truthyCredential)(p, AUTH_METHODS),
+                    includeDirectoryUsers: (0, project_files_1.truthyCredential)(p, DIRECTORY_USERS),
+                    groups,
+                    fetchImpl: p.fetch,
+                    onProgress: (m) => p.say(`  reading ${m}`),
+                }));
+                await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+            },
+        },
+        bridge: {
+            preset,
+            vars(p, t) {
+                const vars = commonVars(p, t?.bridge?.vars);
+                if (b2c) {
+                    const policy = p.credential(SIGN_IN_POLICY);
+                    if (policy)
+                        vars.policy = policy;
+                }
+                return vars;
+            },
+        },
+        lazy: {
+            preset,
+            config(p, t) {
+                const config = commonVars(p, t?.lazy?.config);
+                delete config.tenant_id;
+                if (b2c) {
+                    const policy = p.credential(ROPC_POLICY);
+                    if (policy)
+                        config.policy = policy;
+                    const ropcClient = p.credential(ROPC_CLIENT_ID);
+                    if (ropcClient)
+                        config.client_id = ropcClient;
+                }
+                const domain = p.credential(CUSTOM_DOMAIN);
+                if (domain)
+                    config.custom_domain = domain;
+                return config;
+            },
+        },
+        codemod: b2c ? 'azure-ad-b2c' : 'entra-external-id',
+    };
+}
+exports.azureAdB2cPlugin = azurePlugin('b2c');
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/azure-ad-b2c/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/azure-ad-b2c/plugin.ts"],"names":[],"mappings":";;;AA+CA,sCAYC;AAWD,kCAwFC;AA9JD,qCAA8D;AAC9D,yCAAoD;AACpD,2CAAyE;AACzE,yDAA0G;AAC1G,yCAAwC;AACxC,2DAA2D;AAE3D,qDAAwE;AAExE;;;;;;;;;;GAUG;AAEH,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,0DAA0D,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACrK,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,6EAA6E,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC/L,MAAM,aAAa,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,wCAAwC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACpL,MAAM,YAAY,GAAmB,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,+DAA+D,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACtM,MAAM,YAAY,GAAmB,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,2BAA2B,EAAE,KAAK,EAAE,yFAAyF,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC3N,MAAM,eAAe,GAAmB,EAAE,IAAI,EAAE,yBAAyB,EAAE,GAAG,EAAE,8BAA8B,EAAE,KAAK,EAAE,2CAA2C,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACtL,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,gCAAgC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACpJ,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,4EAA4E,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC7L,MAAM,aAAa,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,mFAAmF,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACjN,MAAM,cAAc,GAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,oFAAoF,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACjM,MAAM,cAAc,GAAmB,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,uGAAuG,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACpO,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,2EAA2E,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC/L,MAAM,aAAa,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,0DAA0D,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAExL,SAAS,KAAK,CAAC,CAAgB;IAC7B,MAAM,MAAM,GAAG,IAAA,iBAAI,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,MAAM,WAAW,GAAG,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,YAAY,GAAG,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IACjD,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,QAAQ,IAAI,YAAY,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,iBAAQ,CAAC,sMAAsM,CAAC,CAAC;IAC7N,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AACzD,CAAC;AAED,gFAAgF;AAChF,SAAgB,aAAa,CAAC,GAAW;IACvC,MAAM,IAAI,GAAG,IAAA,mBAAO,EAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,IAAA,qBAAW,EAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,iBAAQ,CAAC,2CAA2C,GAAG,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,KAAK;SACT,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAA,kBAAQ,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACnF,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAA,oBAAQ,EAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,yGAAyG;AACzG,SAAS,YAAY,CAAC,GAAuB;IAC3C,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,wDAAwD,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7C,CAAC;AAED,MAAM,IAAI,GAAG,iEAAiE,CAAC;AAE/E,0EAA0E;AAC1E,SAAgB,WAAW,CAAC,IAAe;IACzC,MAAM,GAAG,GAAG,IAAI,KAAK,KAAK,CAAC;IAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,6BAA6B,CAAC;IACnE,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,mBAAmB,CAAC;IAC1D,MAAM,UAAU,GAAG,CAAC,CAAgB,EAAE,IAAwC,EAA0B,EAAE;QACxG,MAAM,GAAG,GAA2B,EAAE,GAAG,IAAI,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;QACpE,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,IAAI;YAAE,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC;QAC5B,IAAI,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,GAAG,CAAC,SAAS,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QACtE,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QAC7C,IAAI,QAAQ;YAAE,GAAG,CAAC,SAAS,GAAG,QAAQ,CAAC;QACvC,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IACF,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,mBAAmB;QAClD,MAAM,EAAE,MAAM;QACd,KAAK;QACL,IAAI,EAAE,GAAG;YACP,CAAC,CAAC,0dAA0d;YAC5d,CAAC,CAAC,+eAA+e;QACnf,MAAM,EAAE;YACN,KAAK,EAAE,QAAQ,KAAK,8BAA8B,GAAG,CAAC,CAAC,CAAC,uDAAuD,CAAC,CAAC,CAAC,EAAE,EAAE;YACtH,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC3F,KAAK,CAAC,SAAS,CAAC,CAAC;gBACf,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACnB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACvD,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,GAAG,MAAM,IAAA,uBAAU,EAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAA,+BAAgB,EAAC,IAAA,iBAAS,EAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;gBAChI,OAAO,IAAA,mCAAoB,EAAC,IAAI,CAAC,CAAC;YACpC,CAAC;SACF;QACD,MAAM,EAAE;YACN,KAAK,EAAE,wGAAwG;YAC/G,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,eAAe,CAAC;YAC5F,MAAM,EAAE;gBACN,GAAG,KAAK,2GAA2G,GAAG,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,uCAAuC,sCAAsC;gBACnO,sKAAsK;gBACtK,sJAAsJ;gBACtJ,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,uJAAuJ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1K;YACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;gBACzB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACnB,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC;gBAClD,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,MAAM;oBAAE,MAAM,IAAI,iBAAQ,CAAC,GAAG,KAAK,4CAA4C,MAAM,IAAI,CAAC,CAAC;gBAChI,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,KAAK,EAAE,GAAG,EAAE,CACvC,IAAA,mBAAW,EAAC;oBACV,IAAI;oBACJ,GAAG,CAAC;oBACJ,WAAW,EAAE,IAAA,gCAAgB,EAAC,CAAC,EAAE,YAAY,CAAC;oBAC9C,qBAAqB,EAAE,IAAA,gCAAgB,EAAC,CAAC,EAAE,eAAe,CAAC;oBAC3D,MAAM;oBACN,SAAS,EAAE,CAAC,CAAC,KAAK;oBAClB,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;iBAC3C,CAAC,CACH,CAAC;gBACF,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;YACnD,CAAC;SACF;QACD,MAAM,EAAE;YACN,MAAM;YACN,IAAI,CAAC,CAAC,EAAE,CAAC;gBACP,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;gBAC5C,IAAI,GAAG,EAAE,CAAC;oBACR,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;oBAC5C,IAAI,MAAM;wBAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;gBACnC,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;SACF;QACD,IAAI,EAAE;YACJ,MAAM;YACN,MAAM,CAAC,CAAC,EAAE,CAAC;gBACT,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;gBAC9C,OAAO,MAAM,CAAC,SAAS,CAAC;gBACxB,IAAI,GAAG,EAAE,CAAC;oBACR,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;oBACzC,IAAI,MAAM;wBAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;oBACnC,MAAM,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;oBAChD,IAAI,UAAU;wBAAE,MAAM,CAAC,SAAS,GAAG,UAAU,CAAC;gBAChD,CAAC;gBACD,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;gBAC3C,IAAI,MAAM;oBAAE,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC;gBAC1C,OAAO,MAAM,CAAC;YAChB,CAAC;SACF;QACD,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,mBAAmB;KACpD,CAAC;AACJ,CAAC;AAEY,QAAA,gBAAgB,GAAoB,WAAW,CAAC,KAAK,CAAC,CAAC"}

package/dist/migrate/cognito/plugin.d.ts

@@ -0,0 +1,5 @@
+import { type AwsCredentials } from '../export/cognito';
+import type { MigrationPlugin } from '../framework/plugin';
+/** Static keys of a profile in the shared credentials file (SSO / assume-role profiles need `aws configure export-credentials`). */
+export declare function profileCredentials(text: string, profile: string): AwsCredentials | undefined;
+export declare const cognitoPlugin: MigrationPlugin;

package/dist/migrate/cognito/plugin.js

@@ -0,0 +1,170 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cognitoPlugin = void 0;
+exports.profileCredentials = profileCredentials;
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const cognito_1 = require("../export/cognito");
+const cognito_config_1 = require("../export/cognito-config");
+const errors_1 = require("../../errors");
+const project_files_1 = require("../export/project-files");
+const plugin_kit_1 = require("../export/plugin-kit");
+/**
+ * `atlas migrate cognito` — an Amazon Cognito user pool: its settings as
+ * Atlas config (DescribeUserPool, app clients, identity providers, resource
+ * servers, groups), its users with their attributes, federated links, groups
+ * and SMS / email factors through the cognito-idp API (or `aws cognito-idp
+ * list-users` output), the `cognito` bridge preset (ID tokens verified
+ * against the pool's JWKS) and lazy migration for every password (Cognito
+ * never exports hashes). AWS credentials stay on this machine: they sign the
+ * requests and are sent to AWS only as a signature.
+ */
+const POOL = { flag: '--cognito-user-pool-id', env: 'COGNITO_USER_POOL_ID', label: 'the user pool id (us-east-1_AbC123xyz)', required: true };
+const REGION = { flag: '--aws-region', env: 'AWS_REGION', label: 'the AWS region (default: from the pool id)', required: false };
+const ACCESS_KEY = { flag: '--aws-access-key-id', env: 'AWS_ACCESS_KEY_ID', label: 'an AWS access key id allowed cognito-idp:List*/Describe*', required: false };
+const SECRET_KEY = { flag: '--aws-secret-access-key', env: 'AWS_SECRET_ACCESS_KEY', label: 'its secret access key', required: false, secret: true };
+const SESSION_TOKEN = { flag: '--aws-session-token', env: 'AWS_SESSION_TOKEN', label: 'the session token of temporary credentials', required: false, secret: true };
+const PROFILE = { flag: '--aws-profile', env: 'AWS_PROFILE', label: 'a profile with static keys in ~/.aws/credentials', required: false };
+const USERS_FILE = { flag: '--cognito-users-file', env: 'COGNITO_USERS_FILE', label: '`aws cognito-idp list-users --output json` output', required: false };
+const CLIENT_ID = { flag: '--cognito-client-id', env: 'COGNITO_CLIENT_ID', label: 'the app client id (the ID token audience; for lazy migration a client without a secret that allows USER_PASSWORD_AUTH)', required: false };
+const MFA = { flag: '--cognito-mfa', env: 'COGNITO_EXPORT_MFA', label: 'true to read every user\'s MFA settings (one AdminGetUser per user)', required: false };
+const GROUPS_AS = { flag: '--groups-as', env: 'ATLAS_MIGRATE_GROUPS_AS', label: 'how groups move: roles or skip', required: false };
+/** Static keys of a profile in the shared credentials file (SSO / assume-role profiles need `aws configure export-credentials`). */
+function profileCredentials(text, profile) {
+    let current = '';
+    const values = {};
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.trim();
+        if (!line || line.startsWith('#') || line.startsWith(';'))
+            continue;
+        const section = /^\[\s*(?:profile\s+)?([^\]]+?)\s*\]$/.exec(line);
+        if (section) {
+            current = section[1];
+            continue;
+        }
+        const kv = /^([A-Za-z_]+)\s*=\s*(.*)$/.exec(line);
+        if (kv && current === profile)
+            values[kv[1].toLowerCase()] = kv[2].trim();
+    }
+    if (!values.aws_access_key_id || !values.aws_secret_access_key)
+        return undefined;
+    return { accessKeyId: values.aws_access_key_id, secretAccessKey: values.aws_secret_access_key, ...(values.aws_session_token ? { sessionToken: values.aws_session_token } : {}) };
+}
+/** AWS credentials from flags / env, else the named (or default) profile; undefined when none. */
+function awsCredentials(p) {
+    const accessKeyId = p.credential(ACCESS_KEY);
+    const secretAccessKey = p.credential(SECRET_KEY);
+    if (accessKeyId && secretAccessKey) {
+        const sessionToken = p.credential(SESSION_TOKEN);
+        return { accessKeyId, secretAccessKey, ...(sessionToken ? { sessionToken } : {}) };
+    }
+    const profile = p.credential(PROFILE) ?? 'default';
+    const file = p.ctx.env.AWS_SHARED_CREDENTIALS_FILE?.trim() || (0, node_path_1.join)((0, node_os_1.homedir)(), '.aws', 'credentials');
+    let text;
+    try {
+        text = (0, node_fs_1.readFileSync)(file, 'utf8');
+    }
+    catch {
+        return undefined;
+    }
+    return profileCredentials(text, profile);
+}
+function requireCredentials(p) {
+    const creds = awsCredentials(p);
+    if (!creds) {
+        throw new errors_1.CliError('Cognito: pass AWS credentials (AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY, plus AWS_SESSION_TOKEN for temporary ones) or a profile with static keys (AWS_PROFILE). For SSO profiles run `eval "$(aws configure export-credentials --format env)"` first.');
+    }
+    return creds;
+}
+function poolOf(p) {
+    const poolId = (0, plugin_kit_1.need)(p, POOL).trim();
+    const region = p.credential(REGION) ?? (0, cognito_1.regionOfPool)(poolId);
+    if (!region)
+        throw new errors_1.CliError(`Cognito: ${poolId} is not a user pool id (expected <region>_<id>, e.g. us-east-1_AbC123xyz).`);
+    return { poolId, region };
+}
+function groupsAs(p) {
+    const raw = p.credential(GROUPS_AS) ?? 'roles';
+    if (raw !== 'roles' && raw !== 'skip')
+        throw new errors_1.CliError(`Cognito: --groups-as must be roles or skip (got ${raw}).`);
+    return raw;
+}
+exports.cognitoPlugin = {
+    vendor: 'cognito',
+    source: 'cognito',
+    label: 'Amazon Cognito',
+    help: 'Move an Amazon Cognito user pool: password policy, MFA, sign-in identifiers, app clients, identity providers, resource servers and groups as Atlas config; users (keyed by sub) with their attributes, federated links, groups and SMS / email factors; enterprise SAML / OIDC connections; a zero-logout bridge for Cognito ID tokens; lazy migration for every password (Cognito never exports hashes); and the Amplify code. AWS credentials stay on this machine.',
+    config: {
+        reads: 'your user pool via the Cognito API (DescribeUserPool, app clients, identity providers, resource servers, groups)',
+        credentials: [POOL, REGION, ACCESS_KEY, SECRET_KEY, SESSION_TOKEN, PROFILE],
+        async translate(p) {
+            const { poolId, region } = poolOf(p);
+            const api = new cognito_1.CognitoApi({ region, credentials: requireCredentials(p), fetchImpl: p.fetch });
+            const snap = await (0, plugin_kit_1.vendorStep)('Cognito', () => (0, cognito_config_1.fetchCognitoConfig)(api, poolId, region));
+            return (0, cognito_config_1.translateCognitoConfig)(snap);
+        },
+    },
+    export: {
+        reads: 'the Cognito API (ListUsers, groups, identity providers) or `aws cognito-idp list-users` output (--cognito-users-file)',
+        credentials: [POOL, REGION, ACCESS_KEY, SECRET_KEY, SESSION_TOKEN, PROFILE, USERS_FILE, MFA],
+        limits: [
+            'Cognito never exports password hashes (no API, no support request): every password moves by lazy migration, checked against Cognito on the user\'s first Atlas sign-in. Users who never sign in during the window reset their password.',
+            'TOTP secrets and passkeys never leave Cognito: those users enrol again. SMS and email second factors move (the verified phone number / email).',
+            'Users with FORCE_CHANGE_PASSWORD or RESET_REQUIRED status cannot move by lazy migration: they reset their password in Atlas.',
+            'With a list-users file only users move; groups and enterprise connections need API access.',
+        ],
+        async run(p, writer, resume) {
+            const { poolId, region } = poolOf(p);
+            const usersText = (0, plugin_kit_1.localFile)(p, USERS_FILE, 'text');
+            const credentials = usersText ? awsCredentials(p) : requireCredentials(p);
+            const set = await (0, plugin_kit_1.vendorStep)('Cognito', () => (0, cognito_1.exportCognito)({
+                userPoolId: poolId,
+                region,
+                credentials,
+                usersText,
+                mfa: (0, project_files_1.truthyCredential)(p, MFA),
+                groups: groupsAs(p),
+                fetchImpl: p.fetch,
+                onProgress: (m) => p.say(`  reading ${m}`),
+            }));
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    bridge: {
+        preset: 'cognito',
+        vars(p, t) {
+            const vars = { ...t?.bridge?.vars };
+            const pool = p.credential({ ...POOL, required: false });
+            if (pool) {
+                vars.user_pool_id = pool.trim();
+                const region = p.credential(REGION) ?? (0, cognito_1.regionOfPool)(pool);
+                if (region)
+                    vars.region = region;
+            }
+            const clientId = p.credential(CLIENT_ID);
+            if (clientId)
+                vars.client_id = clientId;
+            return vars;
+        },
+    },
+    lazy: {
+        preset: 'cognito',
+        config(p, t) {
+            const config = { ...t?.lazy?.config };
+            const pool = p.credential({ ...POOL, required: false });
+            if (pool) {
+                config.user_pool_id = pool.trim();
+                const region = p.credential(REGION) ?? (0, cognito_1.regionOfPool)(pool);
+                if (region)
+                    config.region = region;
+            }
+            const clientId = p.credential(CLIENT_ID);
+            if (clientId)
+                config.client_id = clientId;
+            return config;
+        },
+    },
+    codemod: 'cognito',
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/cognito/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/cognito/plugin.ts"],"names":[],"mappings":";;;AAiCA,gDAgBC;AAjDD,qCAAuC;AACvC,qCAAkC;AAClC,yCAAiC;AACjC,+CAAiG;AACjG,6DAAsF;AACtF,yCAAwC;AACxC,2DAA2D;AAE3D,qDAAmF;AAEnF;;;;;;;;;GASG;AAEH,MAAM,IAAI,GAAmB,EAAE,IAAI,EAAE,wBAAwB,EAAE,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,wCAAwC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC9J,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,4CAA4C,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACjJ,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,0DAA0D,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACjL,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,yBAAyB,EAAE,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,uBAAuB,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACpK,MAAM,aAAa,GAAmB,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,4CAA4C,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACpL,MAAM,OAAO,GAAmB,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,kDAAkD,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC1J,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,mDAAmD,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC5K,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,wHAAwH,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC9O,MAAM,GAAG,GAAmB,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,qEAAqE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAChL,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,gCAAgC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAEpJ,oIAAoI;AACpI,SAAgB,kBAAkB,CAAC,IAAY,EAAE,OAAe;IAC9D,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACpE,MAAM,OAAO,GAAG,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClE,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;YACtB,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,EAAE,IAAI,OAAO,KAAK,OAAO;YAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,iBAAiB,IAAI,CAAC,MAAM,CAAC,qBAAqB;QAAE,OAAO,SAAS,CAAC;IACjF,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,iBAAiB,EAAE,eAAe,EAAE,MAAM,CAAC,qBAAqB,EAAE,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACnL,CAAC;AAED,kGAAkG;AAClG,SAAS,cAAc,CAAC,CAAgB;IACtC,MAAM,WAAW,GAAG,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,eAAe,GAAG,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,WAAW,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,YAAY,GAAG,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QACjD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACrF,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;IACnD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,IAAI,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;IACrG,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAgB;IAC1C,MAAM,KAAK,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,iBAAQ,CAChB,2PAA2P,CAC5P,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,CAAgB;IAC9B,MAAM,MAAM,GAAG,IAAA,iBAAI,EAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAA,sBAAY,EAAC,MAAM,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,iBAAQ,CAAC,YAAY,MAAM,4EAA4E,CAAC,CAAC;IAChI,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,QAAQ,CAAC,CAAgB;IAChC,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC;IAC/C,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,MAAM;QAAE,MAAM,IAAI,iBAAQ,CAAC,mDAAmD,GAAG,IAAI,CAAC,CAAC;IACtH,OAAO,GAAG,CAAC;AACb,CAAC;AAEY,QAAA,aAAa,GAAoB;IAC5C,MAAM,EAAE,SAAS;IACjB,MAAM,EAAE,SAAS;IACjB,KAAK,EAAE,gBAAgB;IACvB,IAAI,EAAE,ucAAuc;IAC7c,MAAM,EAAE;QACN,KAAK,EAAE,kHAAkH;QACzH,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,CAAC;QAC3E,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACrC,MAAM,GAAG,GAAG,IAAI,oBAAU,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YAC/F,MAAM,IAAI,GAAG,MAAM,IAAA,uBAAU,EAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAA,mCAAkB,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YACxF,OAAO,IAAA,uCAAsB,EAAC,IAAI,CAAC,CAAC;QACtC,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,uHAAuH;QAC9H,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC;QAC5F,MAAM,EAAE;YACN,yOAAyO;YACzO,gJAAgJ;YAChJ,8HAA8H;YAC9H,4FAA4F;SAC7F;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACrC,MAAM,SAAS,GAAG,IAAA,sBAAS,EAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;YACnD,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;YAC1E,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,SAAS,EAAE,GAAG,EAAE,CAC3C,IAAA,uBAAa,EAAC;gBACZ,UAAU,EAAE,MAAM;gBAClB,MAAM;gBACN,WAAW;gBACX,SAAS;gBACT,GAAG,EAAE,IAAA,gCAAgB,EAAC,CAAC,EAAE,GAAG,CAAC;gBAC7B,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;gBACnB,SAAS,EAAE,CAAC,CAAC,KAAK;gBAClB,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;aAC3C,CAAC,CACH,CAAC;YACF,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,SAAS;QACjB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,GAA2B,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC5D,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YACxD,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBAChC,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAA,sBAAY,EAAC,IAAI,CAAC,CAAC;gBAC1D,IAAI,MAAM;oBAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;YACnC,CAAC;YACD,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,QAAQ;gBAAE,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;YACxC,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,SAAS;QACjB,MAAM,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,MAAM,GAA2B,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9D,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YACxD,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBAClC,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAA,sBAAY,EAAC,IAAI,CAAC,CAAC;gBAC1D,IAAI,MAAM;oBAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;YACrC,CAAC;YACD,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,QAAQ;gBAAE,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC;YAC1C,OAAO,MAAM,CAAC;QAChB,CAAC;KACF;IACD,OAAO,EAAE,SAAS;CACnB,CAAC"}

package/dist/migrate/corbado/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const corbadoPlugin: MigrationPlugin;

package/dist/migrate/corbado/plugin.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.corbadoPlugin = void 0;
+const corbado_1 = require("../export/corbado");
+const corbado_config_1 = require("../export/corbado-config");
+const plugin_kit_1 = require("../export/plugin-kit");
+/**
+ * `atlas migrate corbado` — users with their verified emails, phones and
+ * usernames AND their passkeys (credential ids and public keys, which
+ * Corbado's Backend API exports), the sign-in methods inferred from your
+ * users' identifiers, and the `corbado` bridge preset (short-session JWTs
+ * verified against the project's JWKS). Corbado holds no passwords.
+ */
+const PROJECT_ID = { flag: '--corbado-project-id', env: 'CORBADO_PROJECT_ID', label: 'your Corbado project id (pro-…)', required: true };
+const API_SECRET = { flag: '--corbado-api-secret', env: 'CORBADO_API_SECRET', label: 'your Corbado API secret', required: true, secret: true };
+const RP_ID = { flag: '--corbado-rp-id', env: 'CORBADO_RP_ID', label: 'the relying-party id (domain) your passkeys were registered for', required: false };
+const BASE_URL = { flag: '--corbado-base-url', env: 'CORBADO_BASE_URL', label: 'the Corbado Backend API origin', required: false };
+function projectId(p) {
+    return p.credential({ ...PROJECT_ID, required: false }) ?? (p.ctx.env.NEXT_PUBLIC_CORBADO_PROJECT_ID?.trim() || p.ctx.env.VITE_CORBADO_PROJECT_ID?.trim() || (0, plugin_kit_1.need)(p, PROJECT_ID));
+}
+exports.corbadoPlugin = {
+    vendor: 'corbado',
+    source: 'corbado',
+    label: 'Corbado',
+    help: 'Move a Corbado project: users with their verified emails, phone numbers and usernames, and their passkeys (credential ids and public keys) so members keep signing in with the passkey they have; the sign-in methods as Atlas config; a zero-logout bridge for Corbado session tokens; and the code. Your API secret stays on this machine.',
+    config: {
+        reads: 'your Corbado project via the Backend API (login identifier counts)',
+        credentials: [PROJECT_ID, API_SECRET, RP_ID, BASE_URL],
+        async translate(p) {
+            const pid = projectId(p);
+            const http = (0, corbado_1.corbadoHttp)({ projectId: pid, apiSecret: (0, plugin_kit_1.need)(p, API_SECRET), baseUrl: p.credential(BASE_URL), fetchImpl: p.fetch });
+            const snap = await (0, plugin_kit_1.vendorStep)('Corbado', () => (0, corbado_config_1.fetchCorbadoConfig)(http, pid, p.credential(RP_ID)));
+            return (0, corbado_config_1.translateCorbadoConfig)(snap);
+        },
+    },
+    export: {
+        reads: 'the Corbado Backend API (users, identifiers, passkeys)',
+        credentials: [PROJECT_ID, API_SECRET, RP_ID, BASE_URL],
+        limits: [
+            'Passkeys are exported with their public keys but are bound to your relying-party id (--corbado-rp-id): Atlas must be served from that domain, or a subdomain, for them to keep working. Without the flag, members register passkeys again.',
+            'Corbado keeps no passwords, authenticator-app secrets, organizations or API keys.',
+            'Linked social accounts are not returned: they relink by verified email on first social sign-in.',
+            'Sessions are not exported: Corbado session tokens are JWTs, exchanged by the corbado bridge preset.',
+        ],
+        async run(p, writer, resume) {
+            const set = await (0, plugin_kit_1.vendorStep)('Corbado', () => (0, corbado_1.exportCorbado)({
+                projectId: projectId(p),
+                apiSecret: (0, plugin_kit_1.need)(p, API_SECRET),
+                baseUrl: p.credential(BASE_URL),
+                rpId: p.credential(RP_ID),
+                fetchImpl: p.fetch,
+                onProgress: (m) => p.say(`  reading ${m}`),
+            }));
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    bridge: {
+        preset: 'corbado',
+        vars: (p, t) => ({ ...t?.bridge?.vars, project_id: t?.bridge?.vars.project_id ?? projectId(p) }),
+    },
+    codemod: 'corbado',
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/corbado/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/corbado/plugin.ts"],"names":[],"mappings":";;;AAAA,+CAA+D;AAC/D,6DAAsF;AAEtF,qDAAwE;AAExE;;;;;;GAMG;AAEH,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,iCAAiC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACzJ,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,yBAAyB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC/J,MAAM,KAAK,GAAmB,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,iEAAiE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC3K,MAAM,QAAQ,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,gCAAgC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAEnJ,SAAS,SAAS,CAAC,CAAgB;IACjC,OAAO,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,8BAA8B,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE,IAAI,IAAA,iBAAI,EAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;AACpL,CAAC;AAEY,QAAA,aAAa,GAAoB;IAC5C,MAAM,EAAE,SAAS;IACjB,MAAM,EAAE,SAAS;IACjB,KAAK,EAAE,SAAS;IAChB,IAAI,EAAE,8UAA8U;IACpV,MAAM,EAAE;QACN,KAAK,EAAE,oEAAoE;QAC3E,WAAW,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC;QACtD,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,IAAI,GAAG,IAAA,qBAAW,EAAC,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YAClI,MAAM,IAAI,GAAG,MAAM,IAAA,uBAAU,EAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAA,mCAAkB,EAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACnG,OAAO,IAAA,uCAAsB,EAAC,IAAI,CAAC,CAAC;QACtC,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,wDAAwD;QAC/D,WAAW,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC;QACtD,MAAM,EAAE;YACN,4OAA4O;YAC5O,mFAAmF;YACnF,iGAAiG;YACjG,qGAAqG;SACtG;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,SAAS,EAAE,GAAG,EAAE,CAC3C,IAAA,uBAAa,EAAC;gBACZ,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;gBACvB,SAAS,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,UAAU,CAAC;gBAC9B,OAAO,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAC/B,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;gBACzB,SAAS,EAAE,CAAC,CAAC,KAAK;gBAClB,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;aAC3C,CAAC,CACH,CAAC;YACF,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,SAAS;QACjB,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;KACjG;IACD,OAAO,EAAE,SAAS;CACnB,CAAC"}

package/dist/migrate/entra-external-id/plugin.d.ts

@@ -0,0 +1,8 @@
+import type { MigrationPlugin } from '../framework/plugin';
+/**
+ * `atlas migrate entra-external-id` — Microsoft Entra External ID (external
+ * tenants). Same Graph exporter and translator as Azure AD B2C; lazy
+ * migration through the native authentication API (external tenants have no
+ * ROPC) and the bridge matching on the `oid` claim.
+ */
+export declare const entraExternalIdPlugin: MigrationPlugin;

package/dist/migrate/entra-external-id/plugin.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.entraExternalIdPlugin = void 0;
+const plugin_1 = require("../azure-ad-b2c/plugin");
+/**
+ * `atlas migrate entra-external-id` — Microsoft Entra External ID (external
+ * tenants). Same Graph exporter and translator as Azure AD B2C; lazy
+ * migration through the native authentication API (external tenants have no
+ * ROPC) and the bridge matching on the `oid` claim.
+ */
+exports.entraExternalIdPlugin = (0, plugin_1.azurePlugin)('entra');
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/entra-external-id/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/entra-external-id/plugin.ts"],"names":[],"mappings":";;;AAAA,mDAAqD;AAGrD;;;;;GAKG;AACU,QAAA,qBAAqB,GAAoB,IAAA,oBAAW,EAAC,OAAO,CAAC,CAAC"}

package/dist/migrate/export/appwrite-config.d.ts

@@ -0,0 +1,28 @@
+import type { TranslationResult } from '../framework/plugin';
+import { type Obj } from './record-set';
+/**
+ * `atlas migrate appwrite config` — an Appwrite project's auth settings →
+ * Atlas config.
+ *
+ * Two local sources, either or both (Appwrite's Projects API is console-only,
+ * so no project key can read it — the owner's own CLI can):
+ *   - `appwrite.json` (or `appwrite.config.json`) after `appwrite pull
+ *     settings`: `settings.auth.methods` and `settings.auth.security`, read
+ *     with file:line;
+ *   - the project document (`appwrite projects get --project-id <id> --json`,
+ *     Appwrite 1.x model: `authDuration`, `authLimit`, … and `oAuthProviders`),
+ *     the only place the OAuth providers are listed.
+ */
+export interface AppwriteConfigSnapshot {
+    /** The CLI config file, as text, with its path for the report. */
+    file?: {
+        path: string;
+        text: string;
+    };
+    /** The project document (Projects API / `appwrite projects get --json`). */
+    project?: Obj;
+    endpoint?: string;
+    projectId?: string;
+}
+export declare function parseAppwriteConfigFile(text: string): Obj;
+export declare function translateAppwriteConfig(snap: AppwriteConfigSnapshot): TranslationResult;