@atlasauth/cli 0.12.0 → 0.13.0

package/dist/migrate/keycloak/plugin.js

@@ -0,0 +1,148 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.keycloakPlugin = void 0;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const errors_1 = require("../../errors");
+const keycloak_1 = require("../export/keycloak");
+const keycloak_config_1 = require("../export/keycloak-config");
+const plugin_kit_1 = require("../export/plugin-kit");
+/**
+ * `atlas migrate keycloak` — a Keycloak (or Red Hat build of Keycloak) realm:
+ * its settings as Atlas config (Admin API or a realm export); users with their
+ * federated identities, roles, groups, organizations, SSO brokers, TOTP,
+ * recovery codes and passkeys from a REALM EXPORT (`kc.sh export`, the only
+ * path that carries password hashes and OTP secrets) or the Admin API (no
+ * secrets); the `keycloak` bridge preset for access / ID tokens; lazy migration
+ * through the password grant; and the code. Your admin credentials stay on this machine.
+ */
+const URL_SPEC = { flag: '--keycloak-url', env: 'KEYCLOAK_URL', label: 'your Keycloak base URL (https://sso.example.com; with /auth on Keycloak 16 and older)', required: false };
+const REALM = { flag: '--keycloak-realm', env: 'KEYCLOAK_REALM', label: 'the realm to move', required: false };
+const CLIENT_ID = { flag: '--keycloak-client-id', env: 'KEYCLOAK_CLIENT_ID', label: 'an admin client (service account with view-users, view-realm, query-users, view-clients) or the client of an admin user (default admin-cli)', required: false };
+const CLIENT_SECRET = { flag: '--keycloak-client-secret', env: 'KEYCLOAK_CLIENT_SECRET', label: 'that client\'s secret', required: false, secret: true };
+const ADMIN_USER = { flag: '--keycloak-admin-user', env: 'KEYCLOAK_ADMIN_USER', label: 'an admin user (alternative to a client)', required: false };
+const ADMIN_PASSWORD = { flag: '--keycloak-admin-password', env: 'KEYCLOAK_ADMIN_PASSWORD', label: 'that admin user\'s password', required: false, secret: true };
+const AUTH_REALM = { flag: '--keycloak-auth-realm', env: 'KEYCLOAK_AUTH_REALM', label: 'the realm the admin credential lives in (default master for a user, the realm for a client)', required: false };
+const EXPORT_FILE = { flag: '--keycloak-export', env: 'KEYCLOAK_EXPORT', label: 'a realm export: the file or folder `kc.sh export` wrote', required: false };
+const RP_ID = { flag: '--keycloak-rp-id', env: 'KEYCLOAK_RP_ID', label: 'the WebAuthn relying-party id when the realm leaves it empty', required: false };
+const GROUPS_AS = { flag: '--groups-as', env: 'ATLAS_MIGRATE_GROUPS_AS', label: 'how groups move: roles, organizations or skip', required: false };
+const LAZY_CLIENT = { flag: '--keycloak-lazy-client-id', env: 'KEYCLOAK_LAZY_CLIENT_ID', label: 'a client with Direct access grants enabled (lazy migration)', required: false };
+function groupsAs(p) {
+    const raw = p.credential(GROUPS_AS) ?? 'roles';
+    if (raw !== 'roles' && raw !== 'organizations' && raw !== 'skip')
+        throw new errors_1.CliError(`Keycloak: --groups-as must be roles, organizations or skip (got ${raw}).`);
+    return raw;
+}
+function baseUrl(p, required) {
+    const raw = p.credential({ ...URL_SPEC, required });
+    return raw ? (0, keycloak_1.keycloakBase)(raw) : undefined;
+}
+function adminApi(p, realm) {
+    const url = baseUrl(p, true);
+    const username = p.credential(ADMIN_USER);
+    const password = p.credential(ADMIN_PASSWORD);
+    const clientId = p.credential(CLIENT_ID);
+    const clientSecret = p.credential(CLIENT_SECRET);
+    if (!(username && password) && !(clientId && clientSecret)) {
+        throw new errors_1.CliError('Keycloak: pass an admin client (--set keycloak-client-id=… and KEYCLOAK_CLIENT_SECRET) or an admin user (--set keycloak-admin-user=… and KEYCLOAK_ADMIN_PASSWORD).');
+    }
+    return { baseUrl: url, realm, clientId, clientSecret, username, password, authRealm: p.credential(AUTH_REALM), fetchImpl: p.fetch };
+}
+/** The JSON documents of a realm export: one file, or every .json in a folder. */
+function readExportDocs(p, path) {
+    const abs = (0, node_path_1.resolve)(path);
+    let files;
+    try {
+        files = (0, node_fs_1.statSync)(abs).isDirectory() ? (0, node_fs_1.readdirSync)(abs).filter((f) => f.endsWith('.json')).sort().map((f) => (0, node_path_1.join)(abs, f)) : [abs];
+    }
+    catch (err) {
+        throw new errors_1.CliError(`Keycloak: could not read the realm export at ${path}: ${err.message}`);
+    }
+    if (!files.length)
+        throw new errors_1.CliError(`Keycloak: no .json files in ${path}.`);
+    return files.map((f) => {
+        try {
+            return JSON.parse(p.ctx.readFile(f));
+        }
+        catch (err) {
+            throw new errors_1.CliError(`Keycloak: ${f} is not valid JSON: ${err.message}`);
+        }
+    });
+}
+exports.keycloakPlugin = {
+    vendor: 'keycloak',
+    source: 'keycloak',
+    label: 'Keycloak',
+    help: 'Move a Keycloak realm: its settings (password policy, sessions, OTP and WebAuthn, brokers, clients\' redirect URIs, roles) as Atlas config; users with identities, roles, groups or organizations, SAML and OIDC brokers as SSO connections, and, from a realm export, password hashes (PBKDF2, Argon2), TOTP secrets, recovery codes and passkeys; a zero-logout bridge on your realm\'s tokens; lazy migration through the password grant; and the code. Admin credentials stay on this machine.',
+    config: {
+        reads: 'your realm via the Admin REST API, or a realm export',
+        credentials: [URL_SPEC, REALM, CLIENT_ID, CLIENT_SECRET, ADMIN_USER, ADMIN_PASSWORD, AUTH_REALM, EXPORT_FILE],
+        async translate(p) {
+            const file = p.credential(EXPORT_FILE);
+            if (file) {
+                const snap = (0, keycloak_1.readKeycloakExport)(readExportDocs(p, file), p.credential(REALM));
+                return (0, keycloak_config_1.translateKeycloakConfig)(snap.realm, { groupsAs: groupsAs(p), baseUrl: baseUrl(p, false) });
+            }
+            const realm = p.credential({ ...REALM, required: true });
+            const http = (0, keycloak_1.keycloakAdminHttp)(adminApi(p, realm));
+            const doc = await (0, plugin_kit_1.vendorStep)('Keycloak', () => (0, keycloak_config_1.fetchKeycloakConfig)(http, realm, baseUrl(p, true)));
+            return (0, keycloak_config_1.translateKeycloakConfig)(doc, { groupsAs: groupsAs(p), baseUrl: baseUrl(p, true) });
+        },
+    },
+    export: {
+        reads: 'a realm export (kc.sh export) or the Keycloak Admin REST API',
+        credentials: [EXPORT_FILE, URL_SPEC, REALM, CLIENT_ID, CLIENT_SECRET, ADMIN_USER, ADMIN_PASSWORD, AUTH_REALM, RP_ID],
+        limits: [
+            'Only a realm export carries password hashes (PBKDF2-SHA1/256/512, Argon2), OTP secrets and recovery-code hashes: run `kc.sh export --realm <realm> --file realm.json --users realm_file` (or `--dir`) and pass it with --set keycloak-export=<path>. The Admin API strips every secret.',
+            'With the Admin API alone, passwords move by lazy migration (the keycloak preset) and authenticator-app users enrol again; WebAuthn public keys DO come back.',
+            'Users of an LDAP / Kerberos user-storage provider have no password in Keycloak: lazy migration lets Keycloak (and the directory) verify them. Users of a provider without local import are not exported.',
+            'Identity-provider and client secrets are masked by the Admin API (a realm export keeps them unless they live in a vault): enter them on the SSO connection.',
+            'Live sessions are not exportable: the bridge exchanges Keycloak access and ID tokens for Atlas sessions.',
+            'Composite roles import as plain roles; fine-grained authorization services are not migrated.',
+        ],
+        async run(p, writer, resume) {
+            const file = p.credential(EXPORT_FILE);
+            const realm = p.credential(REALM);
+            const common = { realm, groupsAs: groupsAs(p), rpId: p.credential(RP_ID), onProgress: (m) => p.say(`  reading ${m}`) };
+            if (!file && !(baseUrl(p, false) && realm)) {
+                throw new errors_1.CliError('Keycloak: pass a realm export (--set keycloak-export=<path>), or the base URL and realm with an admin credential (--set keycloak-url=… --set keycloak-realm=…).');
+            }
+            const set = await (0, plugin_kit_1.vendorStep)('Keycloak', async () => file
+                ? (0, keycloak_1.exportKeycloak)({ ...common, exportDocs: readExportDocs(p, file), api: baseUrl(p, false) ? { baseUrl: baseUrl(p, false), clientId: undefined } : undefined })
+                : (0, keycloak_1.exportKeycloak)({ ...common, api: adminApi(p, realm) }));
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    bridge: {
+        preset: 'keycloak',
+        vars(p, t) {
+            const vars = { ...t?.bridge?.vars };
+            const url = baseUrl(p, false);
+            if (url)
+                vars.base_url = url;
+            const realm = p.credential(REALM);
+            if (realm)
+                vars.realm = realm;
+            return vars;
+        },
+    },
+    lazy: {
+        preset: 'keycloak',
+        config(p, t) {
+            const config = { ...t?.lazy?.config };
+            const url = baseUrl(p, false);
+            if (url)
+                config.base_url = url;
+            const realm = p.credential(REALM);
+            if (realm)
+                config.realm = realm;
+            const client = p.credential(LAZY_CLIENT) ?? p.credential(CLIENT_ID);
+            if (client)
+                config.client_id = client;
+            return config;
+        },
+        secret: { flag: '--keycloak-lazy-client-secret', env: 'KEYCLOAK_LAZY_CLIENT_SECRET', label: 'the secret of that client (confidential clients only)', required: false, secret: true },
+    },
+    codemod: 'keycloak',
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/keycloak/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/keycloak/plugin.ts"],"names":[],"mappings":";;;AAAA,qCAAgD;AAChD,yCAA0C;AAC1C,yCAAwC;AACxC,iDAAyG;AACzG,+DAAyF;AACzF,qDAAkE;AAGlE;;;;;;;;GAQG;AAEH,MAAM,QAAQ,GAAmB,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,uFAAuF,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAClM,MAAM,KAAK,GAAmB,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC/H,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,6IAA6I,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACrQ,MAAM,aAAa,GAAmB,EAAE,IAAI,EAAE,0BAA0B,EAAE,GAAG,EAAE,wBAAwB,EAAE,KAAK,EAAE,uBAAuB,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACzK,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,yCAAyC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACpK,MAAM,cAAc,GAAmB,EAAE,IAAI,EAAE,2BAA2B,EAAE,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,6BAA6B,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAClL,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,6FAA6F,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACxN,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,yDAAyD,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC7K,MAAM,KAAK,GAAmB,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,8DAA8D,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC1K,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,+CAA+C,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACnK,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,2BAA2B,EAAE,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,6DAA6D,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAEjM,SAAS,QAAQ,CAAC,CAAgB;IAChC,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC;IAC/C,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,eAAe,IAAI,GAAG,KAAK,MAAM;QAAE,MAAM,IAAI,iBAAQ,CAAC,mEAAmE,GAAG,IAAI,CAAC,CAAC;IACjK,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,OAAO,CAAC,CAAgB,EAAE,QAAiB;IAClD,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpD,OAAO,GAAG,CAAC,CAAC,CAAC,IAAA,uBAAY,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7C,CAAC;AAED,SAAS,QAAQ,CAAC,CAAgB,EAAE,KAAa;IAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,EAAE,IAAI,CAAE,CAAC;IAC9B,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,YAAY,GAAG,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IACjD,IAAI,CAAC,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,YAAY,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,iBAAQ,CAAC,oKAAoK,CAAC,CAAC;IAC3L,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;AACtI,CAAC;AAED,kFAAkF;AAClF,SAAS,cAAc,CAAC,CAAgB,EAAE,IAAY;IACpD,MAAM,GAAG,GAAG,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,IAAA,kBAAQ,EAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAA,qBAAW,EAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACpI,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,iBAAQ,CAAC,gDAAgD,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,iBAAQ,CAAC,+BAA+B,IAAI,GAAG,CAAC,CAAC;IAC9E,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAY,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,iBAAQ,CAAC,aAAa,CAAC,uBAAwB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAEY,QAAA,cAAc,GAAoB;IAC7C,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,UAAU;IAClB,KAAK,EAAE,UAAU;IACjB,IAAI,EAAE,oeAAoe;IAC1e,MAAM,EAAE;QACN,KAAK,EAAE,sDAAsD;QAC7D,WAAW,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,CAAC;QAC7G,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YACvC,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,IAAI,GAAG,IAAA,6BAAkB,EAAC,cAAc,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC9E,OAAO,IAAA,yCAAuB,EAAC,IAAI,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;YACpG,CAAC;YACD,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAE,CAAC;YAC1D,MAAM,IAAI,GAAG,IAAA,4BAAiB,EAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;YACnD,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,UAAU,EAAE,GAAG,EAAE,CAAC,IAAA,qCAAmB,EAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YACnG,OAAO,IAAA,yCAAuB,EAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5F,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,8DAA8D;QACrE,WAAW,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,KAAK,CAAC;QACpH,MAAM,EAAE;YACN,yRAAyR;YACzR,8JAA8J;YAC9J,0MAA0M;YAC1M,6JAA6J;YAC7J,0GAA0G;YAC1G,8FAA8F;SAC/F;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YACvC,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAClC,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC;YAC/H,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBAC3C,MAAM,IAAI,iBAAQ,CAAC,iKAAiK,CAAC,CAAC;YACxL,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,UAAU,EAAE,KAAK,IAAI,EAAE,CAClD,IAAI;gBACF,CAAC,CAAC,IAAA,yBAAc,EAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,CAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;gBAC/J,CAAC,CAAC,IAAA,yBAAc,EAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAM,CAAC,EAAE,CAAC,CAC5D,CAAC;YACF,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,UAAU;QAClB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,GAA2B,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAC9B,IAAI,GAAG;gBAAE,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC;YAC7B,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAClC,IAAI,KAAK;gBAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,UAAU;QAClB,MAAM,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,MAAM,GAA2B,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9D,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAC9B,IAAI,GAAG;gBAAE,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC;YAC/B,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAClC,IAAI,KAAK;gBAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;YAChC,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACpE,IAAI,MAAM;gBAAE,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC;YACtC,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,EAAE,EAAE,IAAI,EAAE,+BAA+B,EAAE,GAAG,EAAE,6BAA6B,EAAE,KAAK,EAAE,uDAAuD,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE;KACrL;IACD,OAAO,EAAE,UAAU;CACpB,CAAC"}

package/dist/migrate/ldap/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const ldapPlugin: MigrationPlugin;

package/dist/migrate/ldap/plugin.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ldapPlugin = void 0;
+const node_path_1 = require("node:path");
+const args_1 = require("../../args");
+const errors_1 = require("../../errors");
+const ldap_1 = require("../export/ldap");
+const plugin_kit_1 = require("../export/plugin-kit");
+/**
+ * `atlas migrate ldap export --file dir.ldif` — an LDAP directory (OpenLDAP,
+ * 389 DS, PingDirectory, Oracle/Sun DS, Active Directory) from an LDIF export
+ * made with the directory's own tools. Users keep a password hash Atlas can
+ * verify; the rest move by lazy migration (the `ldap` preset binds to the
+ * directory over ldaps:// on the user's first sign-in).
+ */
+const GROUPS = { flag: 'ldap-groups', env: 'LDAP_GROUPS', label: 'what groups become: roles (default), organizations or none', required: false };
+const ID_ATTRIBUTE = { flag: 'ldap-id-attribute', env: 'LDAP_ID_ATTRIBUTE', label: 'the attribute used as the user id (entryUUID, nsUniqueId, objectGUID …)', required: false };
+const URL_SPEC = { flag: 'ldap-url', env: 'LDAP_URL', label: 'the directory URL for lazy migration (ldaps://ldap.example.com:636)', required: false };
+const BIND_DN = { flag: 'ldap-bind-dn', env: 'LDAP_BIND_DN', label: 'the service account DN for lazy migration', required: false };
+const BASE_DN = { flag: 'ldap-base-dn', env: 'LDAP_BASE_DN', label: 'the search base for lazy migration', required: false };
+const FILTER = { flag: 'ldap-user-filter', env: 'LDAP_USER_FILTER', label: 'the user search filter with {{username}}', required: false };
+const TRUST = { flag: 'ldap-trust-emails', env: 'LDAP_TRUST_EMAILS', label: 'mark directory addresses verified (true or false)', required: false };
+function file(p) {
+    return (0, args_1.str)(p.args.values, 'file') ?? p.credential({ flag: 'file', env: 'ATLAS_MIGRATE_FILE', label: 'the LDIF file (--file)', required: true });
+}
+exports.ldapPlugin = {
+    vendor: 'ldap',
+    source: 'ldap',
+    label: 'LDAP / Active Directory',
+    help: 'Move a directory: users (mail, uid, names, phones, disabled and locked state, creation and last login), groups as roles or organizations, and every userPassword hash Atlas verifies ({SSHA}, {SMD5}, {PBKDF2-*}, {CRYPT}$6$…, bcrypt, Argon2, …). Export the directory as LDIF first (slapcat, ldifde, export-ldif, dsctl db2ldif); the file is read on this machine. Passwords Atlas cannot verify (Active Directory, DES crypt, pass-through) move by lazy migration against your directory over ldaps://.',
+    export: {
+        reads: 'a local LDIF export of the directory (--file)',
+        credentials: [GROUPS, ID_ATTRIBUTE, TRUST],
+        limits: [
+            'Active Directory never exports password hashes (unicodePwd is write-only): configure lazy migration (preset ldap) so each user moves on their first sign-in.',
+            'Traditional DES {CRYPT} and pass-through schemes ({SASL}) cannot be verified by Atlas: those users move by lazy migration.',
+            'Directory addresses were set by administrators, not confirmed by the users: they import unverified unless --set ldap-trust-emails=true.',
+        ],
+        async run(p, writer, resume) {
+            const path = (0, node_path_1.resolve)(file(p));
+            const { entries, problems } = (0, ldap_1.parseLdif)(p.ctx.readFile(path));
+            if (!entries.length)
+                throw new errors_1.CliError(`No entries found in ${path}: is it an LDIF export?`);
+            const mode = p.credential(GROUPS) ?? 'roles';
+            if (!['roles', 'organizations', 'none'].includes(mode))
+                throw new errors_1.CliError('--set ldap-groups must be roles, organizations or none.');
+            const set = (0, ldap_1.mapLdif)(entries, {
+                groups: mode,
+                idAttribute: p.credential(ID_ATTRIBUTE),
+                trustEmails: p.credential(TRUST) === 'true',
+                origin: `LDIF export ${path}`,
+            });
+            for (const problem of problems.slice(0, 20))
+                set.warn(`LDIF: ${problem}`);
+            p.say(`  read ${entries.length} entries from ${path}`);
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    lazy: {
+        preset: 'ldap',
+        config(p) {
+            const config = {};
+            for (const [key, spec] of [['url', URL_SPEC], ['bind_dn', BIND_DN], ['base_dn', BASE_DN], ['user_filter', FILTER], ['id_attribute', ID_ATTRIBUTE]]) {
+                const v = p.credential(spec);
+                if (v)
+                    config[key] = v;
+            }
+            return config;
+        },
+        secret: { flag: 'ldap-bind-password', env: 'LDAP_BIND_PASSWORD', label: 'the service account password', required: false, secret: true },
+    },
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/ldap/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/ldap/plugin.ts"],"names":[],"mappings":";;;AAAA,yCAAoC;AACpC,qCAAiC;AACjC,yCAAwC;AACxC,yCAAoD;AACpD,qDAAsD;AAGtD;;;;;;GAMG;AAEH,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,4DAA4D,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACjK,MAAM,YAAY,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,yEAAyE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAChM,MAAM,QAAQ,GAAmB,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,qEAAqE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACtK,MAAM,OAAO,GAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,2CAA2C,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACnJ,MAAM,OAAO,GAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,oCAAoC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC5I,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,0CAA0C,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACzJ,MAAM,KAAK,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,mDAAmD,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAEnK,SAAS,IAAI,CAAC,CAAgB;IAC5B,OAAO,IAAA,UAAG,EAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,wBAAwB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAE,CAAC;AACnJ,CAAC;AAEY,QAAA,UAAU,GAAoB;IACzC,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,MAAM;IACd,KAAK,EAAE,yBAAyB;IAChC,IAAI,EAAE,+eAA+e;IACrf,MAAM,EAAE;QACN,KAAK,EAAE,+CAA+C;QACtD,WAAW,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,CAAC;QAC1C,MAAM,EAAE;YACN,8JAA8J;YAC9J,4HAA4H;YAC5H,yIAAyI;SAC1I;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,IAAI,GAAG,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9B,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAA,gBAAS,EAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,OAAO,CAAC,MAAM;gBAAE,MAAM,IAAI,iBAAQ,CAAC,uBAAuB,IAAI,yBAAyB,CAAC,CAAC;YAC9F,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC;YAC7C,IAAI,CAAC,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,iBAAQ,CAAC,yDAAyD,CAAC,CAAC;YACtI,MAAM,GAAG,GAAG,IAAA,cAAO,EAAC,OAAO,EAAE;gBAC3B,MAAM,EAAE,IAA0C;gBAClD,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC;gBACvC,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,MAAM;gBAC3C,MAAM,EAAE,eAAe,IAAI,EAAE;aAC9B,CAAC,CAAC;YACH,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,SAAS,OAAO,EAAE,CAAC,CAAC;YAC1E,CAAC,CAAC,GAAG,CAAC,UAAU,OAAO,CAAC,MAAM,iBAAiB,IAAI,EAAE,CAAC,CAAC;YACvD,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,MAAM;QACd,MAAM,CAAC,CAAC;YACN,MAAM,MAAM,GAA2B,EAAE,CAAC;YAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,CAAC,cAAc,EAAE,YAAY,CAAC,CAAU,EAAE,CAAC;gBAC5J,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBAC7B,IAAI,CAAC;oBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACzB,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,8BAA8B,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE;KACxI;CACF,CAAC"}

package/dist/migrate/logto/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const logtoPlugin: MigrationPlugin;

package/dist/migrate/logto/plugin.js

@@ -0,0 +1,131 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.logtoPlugin = void 0;
+const node_path_1 = require("node:path");
+const errors_1 = require("../../errors");
+const logto_1 = require("../export/logto");
+const logto_config_1 = require("../export/logto-config");
+const tables_1 = require("../export/frameworks/tables");
+const plugin_kit_1 = require("../export/plugin-kit");
+/**
+ * `atlas migrate logto` — a Logto tenant (self-hosted or Logto Cloud): the
+ * sign-in experience, connectors, applications, API resources and roles as
+ * Atlas config; users, social and enterprise identities, organizations,
+ * roles, invitations and personal access tokens through the Management API
+ * (a machine-to-machine app on this machine) or from a database dump of a
+ * self-hosted Logto, which also carries password hashes, TOTP secrets,
+ * passkeys and backup codes; the `logto` bridge preset (an ID token verified
+ * against the tenant's `/oidc/jwks`); lazy migration through the Management
+ * API's password check; and the code.
+ */
+const ENDPOINT = { flag: '--logto-endpoint', env: 'LOGTO_ENDPOINT', label: 'your Logto endpoint (https://auth.example.com or https://abc123.logto.app)', required: false };
+const TENANT = { flag: '--logto-tenant-id', env: 'LOGTO_TENANT_ID', label: 'the tenant id (default on a self-hosted Logto; the abc123 of abc123.logto.app on Logto Cloud)', required: false };
+const APP_ID = { flag: '--logto-m2m-app-id', env: 'LOGTO_M2M_APP_ID', label: 'the id of a machine-to-machine app with the Management API role', required: false };
+const APP_SECRET = { flag: '--logto-m2m-app-secret', env: 'LOGTO_M2M_APP_SECRET', label: 'that app\'s secret', required: false, secret: true };
+const DUMP = { flag: '--logto-dump', env: 'LOGTO_DUMP_DIR', label: 'a folder of database table dumps (users.csv, roles.csv, organizations.csv, …)', required: false };
+const CLIENT_ID = { flag: '--logto-client-id', env: 'LOGTO_APP_ID', label: 'the id of your Logto application (the audience of its ID tokens)', required: false };
+const PATS = { flag: '--logto-personal-access-tokens', env: 'LOGTO_PERSONAL_ACCESS_TOKENS', label: 'true, to read each user\'s personal access tokens too (one API call per user)', required: false };
+const RP_ID = { flag: '--rp-id', env: 'ATLAS_MIGRATE_RP_ID', label: 'the WebAuthn relying party id passkeys were registered for', required: false };
+function endpointOf(p, required) {
+    const raw = p.credential({ ...ENDPOINT, required });
+    if (!raw)
+        return undefined;
+    try {
+        return (0, logto_1.normalizeEndpoint)(raw);
+    }
+    catch (err) {
+        throw new errors_1.CliError(`Logto: ${err.message}`);
+    }
+}
+function m2m(p) {
+    const appId = p.credential(APP_ID);
+    const appSecret = p.credential(APP_SECRET);
+    return appId && appSecret ? { appId, appSecret } : undefined;
+}
+function tenantOf(p, endpoint) {
+    return p.credential(TENANT)?.trim() ?? (endpoint ? (0, logto_1.tenantOfEndpoint)(endpoint) : null) ?? 'default';
+}
+exports.logtoPlugin = {
+    vendor: 'logto',
+    source: 'logto',
+    label: 'Logto',
+    help: 'Move a Logto tenant (self-hosted or Logto Cloud): its sign-in experience, connectors, applications, API resources and roles as Atlas config; users, social and enterprise identities, organizations, roles, invitations and personal access tokens through the Management API with a machine-to-machine app (on this machine) or from a database dump, which also carries password hashes, TOTP secrets, passkeys and backup codes; a zero-logout bridge on the tenant\'s ID tokens; lazy migration for passwords you cannot export; and the code.',
+    config: {
+        reads: 'your Logto tenant via the Management API',
+        credentials: [ENDPOINT, TENANT, APP_ID, APP_SECRET],
+        async translate(p) {
+            const endpoint = endpointOf(p, true);
+            const credentials = m2m(p);
+            if (!credentials)
+                throw new errors_1.CliError('Logto: pass the machine-to-machine app id and secret (--set logto-m2m-app-id=… --set logto-m2m-app-secret=…, or LOGTO_M2M_APP_ID / LOGTO_M2M_APP_SECRET).');
+            const tenantId = tenantOf(p, endpoint);
+            const http = (0, logto_1.logtoManagementHttp)({ endpoint, m2m: credentials, tenantId, fetchImpl: p.fetch });
+            return (0, logto_config_1.translateLogtoConfig)(await (0, plugin_kit_1.vendorStep)('Logto', () => (0, logto_config_1.fetchLogtoConfig)(http, endpoint, tenantId)));
+        },
+    },
+    export: {
+        reads: 'the Logto Management API (machine-to-machine app) or a database dump of a self-hosted Logto',
+        credentials: [ENDPOINT, TENANT, APP_ID, APP_SECRET, DUMP, RP_ID, PATS],
+        limits: [
+            'The Management API never returns MFA secrets (TOTP keys, WebAuthn credentials, backup codes): those users enrol again, unless you export from the database of a self-hosted Logto (--set logto-dump=<folder>).',
+            'The Management API does not reliably return password hashes: a database dump of a self-hosted Logto carries them (Argon2, bcrypt, SHA-family and legacy expressions). Logto Cloud tenants, and every user without a hash, move by lazy migration (the logto preset).',
+            'Passkeys move only with the relying-party id they were registered for (--set rp-id=…, or the endpoint host): your Atlas domain must match it.',
+            'Machine-to-machine apps and their secrets are not exported: create Atlas M2M clients.',
+            'Logto sessions are encrypted cookies of your app\'s SDK: the bridge exchanges the ID token inside them (see the guide for the extractor).',
+            'Personal access tokens come over the API one call per user: add --set logto-personal-access-tokens=true.',
+        ],
+        async run(p, writer, resume) {
+            const dumpDir = p.credential(DUMP);
+            const endpoint = endpointOf(p, false);
+            const credentials = m2m(p);
+            if (!dumpDir && !(endpoint && credentials)) {
+                throw new errors_1.CliError('Logto: pass a database dump (--set logto-dump=<folder>), or the endpoint with a machine-to-machine app (--set logto-endpoint=… plus LOGTO_M2M_APP_ID and LOGTO_M2M_APP_SECRET).');
+            }
+            const set = await (0, plugin_kit_1.vendorStep)('Logto', async () => (0, logto_1.exportLogto)({
+                tables: dumpDir ? (0, tables_1.readDumpDir)((0, node_path_1.resolve)(dumpDir)) : undefined,
+                endpoint,
+                m2m: credentials,
+                tenantId: p.credential(TENANT)?.trim(),
+                rpId: p.credential(RP_ID)?.trim(),
+                personalAccessTokens: /^(1|true|yes)$/i.test(p.credential(PATS)?.trim() ?? ''),
+                fetchImpl: p.fetch,
+                onProgress: (m) => p.say(`  reading ${m}`),
+            }));
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    bridge: {
+        preset: 'logto',
+        vars(p, t) {
+            const vars = { ...t?.bridge?.vars };
+            const endpoint = endpointOf(p, false);
+            if (endpoint)
+                vars.base_url = endpoint;
+            const clientId = p.credential(CLIENT_ID);
+            if (clientId)
+                vars.client_id = clientId;
+            return vars;
+        },
+    },
+    lazy: {
+        preset: 'logto',
+        config(p, t) {
+            const config = { ...t?.lazy?.config };
+            const endpoint = endpointOf(p, false);
+            if (endpoint)
+                config.base_url = endpoint;
+            const appId = p.credential(APP_ID);
+            if (appId)
+                config.app_id = appId;
+            const tenant = p.credential(TENANT)?.trim();
+            if (tenant)
+                config.tenant_id = tenant;
+            else if (endpoint && (0, logto_1.tenantOfEndpoint)(endpoint))
+                config.tenant_id = (0, logto_1.tenantOfEndpoint)(endpoint);
+            return config;
+        },
+        secret: APP_SECRET,
+    },
+    codemod: 'logto',
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/logto/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/logto/plugin.ts"],"names":[],"mappings":";;;AAAA,yCAAoC;AACpC,yCAAwC;AACxC,2CAAwG;AACxG,yDAAgF;AAChF,wDAA0D;AAC1D,qDAAkE;AAGlE;;;;;;;;;;GAUG;AAEH,MAAM,QAAQ,GAAmB,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,4EAA4E,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC3L,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,+FAA+F,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC9M,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,iEAAiE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAClL,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,wBAAwB,EAAE,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC/J,MAAM,IAAI,GAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,+EAA+E,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACtL,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,kEAAkE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACjL,MAAM,IAAI,GAAmB,EAAE,IAAI,EAAE,gCAAgC,EAAE,GAAG,EAAE,8BAA8B,EAAE,KAAK,EAAE,+EAA+E,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACtN,MAAM,KAAK,GAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,4DAA4D,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAEpK,SAAS,UAAU,CAAC,CAAgB,EAAE,QAAiB;IACrD,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,CAAC;QACH,OAAO,IAAA,yBAAiB,EAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,iBAAQ,CAAC,UAAW,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED,SAAS,GAAG,CAAC,CAAgB;IAC3B,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAC3C,OAAO,KAAK,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC;AAED,SAAS,QAAQ,CAAC,CAAgB,EAAE,QAA4B;IAC9D,OAAO,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAA,wBAAgB,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;AACrG,CAAC;AAEY,QAAA,WAAW,GAAoB;IAC1C,MAAM,EAAE,OAAO;IACf,MAAM,EAAE,OAAO;IACf,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,ohBAAohB;IAC1hB,MAAM,EAAE;QACN,KAAK,EAAE,0CAA0C;QACjD,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC;QACnD,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,EAAE,IAAI,CAAE,CAAC;YACtC,MAAM,WAAW,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,CAAC,WAAW;gBAAE,MAAM,IAAI,iBAAQ,CAAC,2JAA2J,CAAC,CAAC;YAClM,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YACvC,MAAM,IAAI,GAAG,IAAA,2BAAmB,EAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YAC/F,OAAO,IAAA,mCAAoB,EAAC,MAAM,IAAA,uBAAU,EAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAA,+BAAgB,EAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC3G,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,6FAA6F;QACpG,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC;QACtE,MAAM,EAAE;YACN,gNAAgN;YAChN,sQAAsQ;YACtQ,+IAA+I;YAC/I,uFAAuF;YACvF,2IAA2I;YAC3I,0GAA0G;SAC3G;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,OAAO,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACnC,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YACtC,MAAM,WAAW,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,IAAI,WAAW,CAAC,EAAE,CAAC;gBAC3C,MAAM,IAAI,iBAAQ,CAAC,iLAAiL,CAAC,CAAC;YACxM,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,OAAO,EAAE,KAAK,IAAI,EAAE,CAC/C,IAAA,mBAAW,EAAC;gBACV,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,IAAA,oBAAW,EAAC,IAAA,mBAAO,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC3D,QAAQ;gBACR,GAAG,EAAE,WAAW;gBAChB,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE;gBACtC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE;gBACjC,oBAAoB,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;gBAC9E,SAAS,EAAE,CAAC,CAAC,KAAK;gBAClB,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;aAC3C,CAAC,CACH,CAAC;YACF,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,OAAO;QACf,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,GAA2B,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC5D,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YACtC,IAAI,QAAQ;gBAAE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;YACvC,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,QAAQ;gBAAE,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;YACxC,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,OAAO;QACf,MAAM,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,MAAM,GAA2B,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9D,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YACtC,IAAI,QAAQ;gBAAE,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;YACzC,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACnC,IAAI,KAAK;gBAAE,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC;YACjC,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;YAC5C,IAAI,MAAM;gBAAE,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC;iBACjC,IAAI,QAAQ,IAAI,IAAA,wBAAgB,EAAC,QAAQ,CAAC;gBAAE,MAAM,CAAC,SAAS,GAAG,IAAA,wBAAgB,EAAC,QAAQ,CAAE,CAAC;YAChG,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,EAAE,UAAU;KACnB;IACD,OAAO,EAAE,OAAO;CACjB,CAAC"}

package/dist/migrate/magic/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const magicPlugin: MigrationPlugin;

package/dist/migrate/magic/plugin.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.magicPlugin = void 0;
+const magic_1 = require("../export/magic");
+const magic_config_1 = require("../export/magic-config");
+const plugin_kit_1 = require("../export/plugin-kit");
+/**
+ * `atlas migrate magic` — users from the export file in your Magic dashboard
+ * (Magic has no API to list users), their issuers from an optional email →
+ * issuer file, and the `magic` bridge preset (DID tokens verified against the
+ * signer's own key and your client id). Magic holds no passwords.
+ */
+const USERS_FILE = { flag: '--magic-users-file', env: 'MAGIC_USERS_FILE', label: 'the user export file from your Magic dashboard (CSV)', required: true };
+const ISSUERS_FILE = { flag: '--magic-issuers-file', env: 'MAGIC_ISSUERS_FILE', label: 'a file mapping each email to its Magic issuer (did:ethr:…)', required: false };
+const CLIENT_ID = { flag: '--magic-client-id', env: 'MAGIC_CLIENT_ID', label: 'your Magic client id (did:magic:…)', required: false };
+function clientId(p) {
+    return p.credential(CLIENT_ID) ?? (p.ctx.env.NEXT_PUBLIC_MAGIC_CLIENT_ID?.trim() || undefined);
+}
+exports.magicPlugin = {
+    vendor: 'magic',
+    source: 'magic',
+    label: 'Magic (magic.link)',
+    help: 'Move a Magic (magic.link) app: users from the export file in your Magic dashboard, with verified emails and, when you have them, Magic issuers so the zero-logout bridge recognises each person\'s current DID token; email code and link sign-in as Atlas config; and the code. Magic has no user-listing API, so no Magic secret key is needed.',
+    config: {
+        reads: 'nothing from Magic (it has no settings API): the translation lists where each Magic setting lives',
+        credentials: [CLIENT_ID],
+        async translate(p) {
+            return (0, magic_config_1.translateMagicConfig)({ ...(clientId(p) ? { clientId: clientId(p) } : {}) });
+        },
+    },
+    export: {
+        reads: 'the Magic dashboard user export (--magic-users-file) and an optional email → issuer file (--magic-issuers-file)',
+        credentials: [USERS_FILE, ISSUERS_FILE],
+        limits: [
+            'Magic has no API to list users: export them from the Magic dashboard (Users → Export) and pass that file with --magic-users-file.',
+            'The dashboard export has no issuers. Users without one are imported by email and sign in with an email code; give an email → issuer file (--magic-issuers-file) to keep their current sessions alive through the bridge.',
+            'Magic holds no passwords. Embedded wallet keys cannot be exported: users export them from Magic themselves.',
+        ],
+        async run(p, writer, resume) {
+            const usersText = (0, plugin_kit_1.localFile)(p, USERS_FILE, 'text');
+            if (usersText === undefined)
+                (0, plugin_kit_1.need)(p, USERS_FILE);
+            const set = await (0, plugin_kit_1.vendorStep)('Magic', async () => (0, magic_1.exportMagic)({ usersText: usersText, issuersText: (0, plugin_kit_1.localFile)(p, ISSUERS_FILE, 'text'), onProgress: (m) => p.say(`  reading ${m}`) }));
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    bridge: {
+        preset: 'magic',
+        vars(p, t) {
+            const id = t?.bridge?.vars.client_id ?? clientId(p);
+            return id ? { ...t?.bridge?.vars, client_id: id } : { ...t?.bridge?.vars };
+        },
+    },
+    codemod: 'magic',
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/magic/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/magic/plugin.ts"],"names":[],"mappings":";;;AAAA,2CAA8C;AAC9C,yDAA8D;AAE9D,qDAAmF;AAEnF;;;;;GAKG;AAEH,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,sDAAsD,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC1K,MAAM,YAAY,GAAmB,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,4DAA4D,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACvL,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,oCAAoC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAEtJ,SAAS,QAAQ,CAAC,CAAgB;IAChC,OAAO,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC,CAAC;AACjG,CAAC;AAEY,QAAA,WAAW,GAAoB;IAC1C,MAAM,EAAE,OAAO;IACf,MAAM,EAAE,OAAO;IACf,KAAK,EAAE,oBAAoB;IAC3B,IAAI,EAAE,mVAAmV;IACzV,MAAM,EAAE;QACN,KAAK,EAAE,mGAAmG;QAC1G,WAAW,EAAE,CAAC,SAAS,CAAC;QACxB,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,OAAO,IAAA,mCAAoB,EAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,iHAAiH;QACxH,WAAW,EAAE,CAAC,UAAU,EAAE,YAAY,CAAC;QACvC,MAAM,EAAE;YACN,mIAAmI;YACnI,0NAA0N;YAC1N,6GAA6G;SAC9G;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,SAAS,GAAG,IAAA,sBAAS,EAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;YACnD,IAAI,SAAS,KAAK,SAAS;gBAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,UAAU,CAAC,CAAC;YACjD,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,IAAA,mBAAW,EAAC,EAAE,SAAS,EAAE,SAAU,EAAE,WAAW,EAAE,IAAA,sBAAS,EAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YACvL,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,OAAO;QACf,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC;YACpD,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC7E,CAAC;KACF;IACD,OAAO,EAAE,OAAO;CACjB,CAAC"}

package/dist/migrate/nhost/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const nhostPlugin: MigrationPlugin;

package/dist/migrate/nhost/plugin.js

@@ -0,0 +1,115 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.nhostPlugin = void 0;
+const nhost_1 = require("../export/nhost");
+const nhost_config_1 = require("../export/nhost-config");
+const errors_1 = require("../../errors");
+const plugin_kit_1 = require("../export/plugin-kit");
+const project_files_1 = require("../export/project-files");
+/**
+ * `atlas migrate nhost` — an Nhost project (Nhost Cloud or self-hosted Hasura
+ * Auth): `nhost/nhost.toml` as Atlas config; users with their bcrypt hashes,
+ * social links, security keys, roles, TOTP secrets and live refresh tokens
+ * read through the project's GraphQL endpoint with the admin secret (on this
+ * machine only) or from a dump of the `auth` schema; the `nhost` bridge preset
+ * (a refresh token becomes an Atlas session, matched on the hash Nhost
+ * stores); lazy migration for anyone left; and the code.
+ */
+const SUBDOMAIN = { flag: '--nhost-subdomain', env: 'NHOST_SUBDOMAIN', label: 'the Nhost Cloud project subdomain', required: false };
+const REGION = { flag: '--nhost-region', env: 'NHOST_REGION', label: 'the Nhost Cloud region (eu-central-1, us-east-1, …)', required: false };
+const GRAPHQL_URL = { flag: '--nhost-graphql-url', env: 'NHOST_GRAPHQL_URL', label: 'the GraphQL endpoint of a self-hosted project (https://graphql.example.com/v1)', required: false };
+const AUTH_URL = { flag: '--nhost-auth-url', env: 'NHOST_AUTH_URL', label: 'the Auth URL of a self-hosted project (https://auth.example.com/v1), for lazy migration', required: false };
+const ADMIN_SECRET = { flag: '--nhost-admin-secret', env: 'NHOST_ADMIN_SECRET', label: 'the Hasura admin secret', required: false, secret: true };
+const DUMP = { flag: '--nhost-dump', env: 'NHOST_DUMP_DIR', label: 'a folder of auth-schema table dumps (users.csv, user_providers.csv, …)', required: false };
+const CONFIG_FILE = { flag: '--nhost-config', env: 'NHOST_CONFIG_TOML', label: 'nhost/nhost.toml', required: false };
+const ENCRYPTION_KEY = { flag: '--nhost-encryption-key', env: 'AUTH_ENCRYPTION_KEY', label: 'AUTH_ENCRYPTION_KEY (64 hex characters), to carry encrypted TOTP secrets', required: false, secret: true };
+const BRIDGE = { flag: '--nhost-bridge', env: 'NHOST_BRIDGE', label: 'what the bridge exchanges: refresh-token (default; the sessions the export imported) or access-token (JWTs signed by Hasura Auth)', required: false };
+const RP_ID = { flag: '--rp-id', env: 'ATLAS_MIGRATE_RP_ID', label: 'the WebAuthn relying party id security keys were registered for', required: false };
+function cloud(p) {
+    const subdomain = p.credential(SUBDOMAIN)?.trim();
+    const region = p.credential(REGION)?.trim();
+    return subdomain && region ? { subdomain, region } : undefined;
+}
+function authUrl(p) {
+    const url = p.credential(AUTH_URL)?.trim().replace(/\/+$/, '');
+    if (url)
+        return url;
+    const c = cloud(p);
+    return c ? `https://${c.subdomain}.auth.${c.region}.nhost.run/v1` : undefined;
+}
+async function readRows(p) {
+    const dump = (0, project_files_1.projectDir)(p, DUMP);
+    if (dump)
+        return { rows: await (0, plugin_kit_1.vendorStep)('Nhost', async () => (0, nhost_1.readNhostDump)(dump)), origin: 'auth schema dump' };
+    const c = cloud(p);
+    const graphqlUrl = p.credential(GRAPHQL_URL)?.trim().replace(/\/+$/, '') ?? (c ? (0, nhost_1.nhostGraphqlUrl)(c) : undefined);
+    const adminSecret = p.credential(ADMIN_SECRET);
+    if (!graphqlUrl || !adminSecret) {
+        throw new errors_1.CliError('Nhost: pass --set nhost-subdomain=… --set nhost-region=… (or --set nhost-graphql-url=… when self-hosted) with --set nhost-admin-secret=…, or a dump of the auth schema with --set nhost-dump=<dir>.');
+    }
+    const rows = await (0, plugin_kit_1.vendorStep)('Nhost', () => (0, nhost_1.fetchNhostRows)({ graphqlUrl, adminSecret, fetchImpl: p.fetch, onProgress: (m) => p.say(`  reading ${m}`) }));
+    return { rows, origin: 'nhost graphql' };
+}
+exports.nhostPlugin = {
+    vendor: 'nhost',
+    source: 'nhost',
+    label: 'Nhost',
+    help: 'Move an Nhost project: nhost.toml auth settings as Atlas config; users with bcrypt hashes, verified email and phone, metadata, roles, social links, security keys, TOTP secrets and live refresh tokens through GraphQL with the admin secret (on this machine) or from an auth-schema dump; a zero-logout bridge on the refresh tokens Nhost already hashes; lazy migration for anyone left; and the code.',
+    config: {
+        reads: 'nhost/nhost.toml',
+        credentials: [CONFIG_FILE, AUTH_URL, SUBDOMAIN, REGION],
+        async translate(p) {
+            const file = (0, project_files_1.projectFile)(p, CONFIG_FILE, ['nhost/nhost.toml', 'nhost.toml']);
+            if (!file)
+                throw new errors_1.CliError('Nhost: no nhost/nhost.toml in this folder. Pass --set nhost-config=<path to nhost.toml>.');
+            return (0, nhost_config_1.translateNhostConfig)(file, { authUrl: authUrl(p) });
+        },
+    },
+    export: {
+        reads: 'the auth schema through the project GraphQL endpoint (admin secret) or a table dump',
+        credentials: [SUBDOMAIN, REGION, GRAPHQL_URL, ADMIN_SECRET, DUMP, ENCRYPTION_KEY, RP_ID],
+        limits: [
+            'Personal access tokens are not exported: reissue them as Atlas API keys.',
+            'TOTP secrets on current Nhost versions are encrypted with AUTH_ENCRYPTION_KEY; without --set nhost-encryption-key those users enrol again.',
+            'Security keys move only with the relying-party id they were registered for (--set rp-id=…, same domain on Atlas).',
+            'Access tokens are short-lived JWTs and are not exported: the bridge exchanges the refresh token instead.',
+        ],
+        async run(p, writer, resume) {
+            const { rows, origin } = await readRows(p);
+            const set = (0, nhost_1.exportNhost)(rows, { encryptionKey: p.credential(ENCRYPTION_KEY), rpId: p.credential(RP_ID)?.trim(), origin });
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    bridge: {
+        preset: 'nhost',
+        presetFor(p) {
+            const mode = (p.credential(BRIDGE) ?? 'refresh-token').trim().toLowerCase();
+            if (mode === 'access-token')
+                return 'nhost_jwt';
+            if (mode !== 'refresh-token')
+                throw new errors_1.CliError(`Nhost: --set nhost-bridge takes refresh-token or access-token (got ${mode}).`);
+            return 'nhost';
+        },
+        vars(p, t) {
+            const vars = { ...t?.bridge?.vars };
+            if (p.credential(BRIDGE)?.trim().toLowerCase() === 'access-token') {
+                const url = authUrl(p);
+                if (url)
+                    vars.auth_url = url;
+            }
+            return vars;
+        },
+    },
+    lazy: {
+        preset: 'nhost',
+        config(p, t) {
+            const config = { ...t?.lazy?.config };
+            const url = authUrl(p);
+            if (url)
+                config.auth_url = url;
+            return config;
+        },
+    },
+    codemod: 'nhost',
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/nhost/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/nhost/plugin.ts"],"names":[],"mappings":";;;AAAA,2CAA8G;AAC9G,yDAA8D;AAC9D,yCAAwC;AAExC,qDAAkE;AAClE,2DAAkE;AAElE;;;;;;;;GAQG;AAEH,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,mCAAmC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACrJ,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,qDAAqD,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC9J,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,gFAAgF,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACxM,MAAM,QAAQ,GAAmB,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,yFAAyF,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACxM,MAAM,YAAY,GAAmB,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,yBAAyB,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAClK,MAAM,IAAI,GAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,wEAAwE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC/K,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,kBAAkB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACrI,MAAM,cAAc,GAAmB,EAAE,IAAI,EAAE,wBAAwB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,0EAA0E,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACxN,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,mIAAmI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC5O,MAAM,KAAK,GAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,iEAAiE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAEzK,SAAS,KAAK,CAAC,CAAgB;IAC7B,MAAM,SAAS,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;IAClD,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;IAC5C,OAAO,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACjE,CAAC;AAED,SAAS,OAAO,CAAC,CAAgB;IAC/B,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/D,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IACpB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACnB,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,SAAS,SAAS,CAAC,CAAC,MAAM,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;AAChF,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,CAAgB;IACtC,MAAM,IAAI,GAAG,IAAA,0BAAU,EAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACjC,IAAI,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,IAAA,uBAAU,EAAC,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,IAAA,qBAAa,EAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAClH,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACnB,MAAM,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAA,uBAAe,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACjH,MAAM,WAAW,GAAG,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,EAAE,CAAC;QAChC,MAAM,IAAI,iBAAQ,CAAC,qMAAqM,CAAC,CAAC;IAC5N,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,IAAA,uBAAU,EAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAA,sBAAc,EAAC,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1J,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;AAC3C,CAAC;AAEY,QAAA,WAAW,GAAoB;IAC1C,MAAM,EAAE,OAAO;IACf,MAAM,EAAE,OAAO;IACf,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,6YAA6Y;IACnZ,MAAM,EAAE;QACN,KAAK,EAAE,kBAAkB;QACzB,WAAW,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC;QACvD,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,IAAI,GAAG,IAAA,2BAAW,EAAC,CAAC,EAAE,WAAW,EAAE,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC,CAAC;YAC7E,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,iBAAQ,CAAC,0FAA0F,CAAC,CAAC;YAC1H,OAAO,IAAA,mCAAoB,EAAC,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7D,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,qFAAqF;QAC5F,WAAW,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC;QACxF,MAAM,EAAE;YACN,0EAA0E;YAC1E,4IAA4I;YAC5I,mHAAmH;YACnH,0GAA0G;SAC3G;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,IAAA,mBAAW,EAAC,IAAI,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAC1H,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,OAAO;QACf,SAAS,CAAC,CAAC;YACT,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC5E,IAAI,IAAI,KAAK,cAAc;gBAAE,OAAO,WAAW,CAAC;YAChD,IAAI,IAAI,KAAK,eAAe;gBAAE,MAAM,IAAI,iBAAQ,CAAC,sEAAsE,IAAI,IAAI,CAAC,CAAC;YACjI,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,GAA2B,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC5D,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,cAAc,EAAE,CAAC;gBAClE,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;gBACvB,IAAI,GAAG;oBAAE,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC;YAC/B,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,OAAO;QACf,MAAM,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,MAAM,GAA2B,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9D,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACvB,IAAI,GAAG;gBAAE,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC;YAC/B,OAAO,MAAM,CAAC;QAChB,CAAC;KACF;IACD,OAAO,EAAE,OAAO;CACjB,CAAC"}

package/dist/migrate/oidc/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const oidcPlugin: MigrationPlugin;