@atlasauth/cli 0.12.0 → 0.14.0

package/dist/migrate/propelauth/plugin.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.propelauthPlugin = void 0;
+const propelauth_1 = require("../export/propelauth");
+const propelauth_config_1 = require("../export/propelauth-config");
+const plugin_kit_1 = require("../export/plugin-kit");
+/**
+ * `atlas migrate propelauth` — users, organizations, roles and pending
+ * invitations through PropelAuth's backend API (auth URL + API key, on this
+ * machine), password hashes from the export PropelAuth support provides when
+ * the owner has it, and the `propelauth` bridge preset (RS256 access tokens
+ * verified with the project's verifier key). PropelAuth has no password-verify
+ * API, so there is no lazy-migration preset.
+ */
+const AUTH_URL = { flag: '--propelauth-auth-url', env: 'PROPELAUTH_AUTH_URL', label: 'your PropelAuth auth URL (https://123456.propelauthtest.com)', required: true };
+const API_KEY = { flag: '--propelauth-api-key', env: 'PROPELAUTH_API_KEY', label: 'a PropelAuth backend API key', required: true, secret: true };
+const HASHES_FILE = { flag: '--propelauth-hashes-file', env: 'PROPELAUTH_HASHES_FILE', label: 'the password-hash export from PropelAuth support', required: false };
+/** The auth URL from the flag or env, else the one the app already uses (`NEXT_PUBLIC_AUTH_URL`). */
+function authUrl(p) {
+    const raw = p.credential({ ...AUTH_URL, required: false }) ?? (p.ctx.env.NEXT_PUBLIC_AUTH_URL?.trim() || (0, plugin_kit_1.need)(p, AUTH_URL));
+    return (0, propelauth_1.normalizeAuthUrl)(raw);
+}
+exports.propelauthPlugin = {
+    vendor: 'propelauth',
+    source: 'propelauth',
+    label: 'PropelAuth',
+    help: 'Move a PropelAuth project: users with their verified emails, usernames and metadata, organizations with members, roles and permissions, pending invitations, password hashes from the export PropelAuth support provides, a zero-logout bridge for PropelAuth access tokens, and the code. Your API key stays on this machine.',
+    config: {
+        reads: 'your PropelAuth project via the backend API (role mappings, organizations with SAML)',
+        credentials: [AUTH_URL, API_KEY],
+        async translate(p) {
+            const url = authUrl(p);
+            const http = (0, propelauth_1.propelauthHttp)({ authUrl: url, apiKey: (0, plugin_kit_1.need)(p, API_KEY), fetchImpl: p.fetch });
+            return (0, propelauth_config_1.translatePropelauthConfig)(await (0, plugin_kit_1.vendorStep)('PropelAuth', () => (0, propelauth_config_1.fetchPropelauthConfig)(http, url)));
+        },
+    },
+    export: {
+        reads: 'the PropelAuth backend API (users, organizations, invitations) and the support hash export (--propelauth-hashes-file)',
+        credentials: [AUTH_URL, API_KEY, HASHES_FILE],
+        limits: [
+            'PropelAuth has no password-verify API and does not return hashes: PropelAuth support can export them on request. Pass that file with --propelauth-hashes-file; without it members set a password again on first sign-in.',
+            'TOTP secrets, social-account ids and end-user API key secrets cannot be exported: members enrol their second factor again, relink social accounts by verified email and reissue API keys.',
+            'SAML connections cannot be read back (the IdP settings are write-only): set each one up again in Atlas.',
+            'Sessions are not exported: PropelAuth access tokens are exchanged by the propelauth bridge preset, which needs your project\'s verifier key.',
+        ],
+        async run(p, writer, resume) {
+            const set = await (0, plugin_kit_1.vendorStep)('PropelAuth', () => (0, propelauth_1.exportPropelauth)({
+                authUrl: authUrl(p),
+                apiKey: (0, plugin_kit_1.need)(p, API_KEY),
+                hashesText: (0, plugin_kit_1.localFile)(p, HASHES_FILE, 'text'),
+                fetchImpl: p.fetch,
+                onProgress: (m) => p.say(`  reading ${m}`),
+            }));
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    bridge: {
+        preset: 'propelauth',
+        vars(p, t) {
+            return { ...t?.bridge?.vars, auth_url: t?.bridge?.vars.auth_url ?? authUrl(p) };
+        },
+    },
+    codemod: 'propelauth',
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/propelauth/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/propelauth/plugin.ts"],"names":[],"mappings":";;;AAAA,qDAA0F;AAC1F,mEAA+F;AAE/F,qDAAmF;AAEnF;;;;;;;GAOG;AAEH,MAAM,QAAQ,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,8DAA8D,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACtL,MAAM,OAAO,GAAmB,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,8BAA8B,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACjK,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,0BAA0B,EAAE,GAAG,EAAE,wBAAwB,EAAE,KAAK,EAAE,kDAAkD,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAEpL,qGAAqG;AACrG,SAAS,OAAO,CAAC,CAAgB;IAC/B,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,IAAI,IAAA,iBAAI,EAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC5H,OAAO,IAAA,6BAAgB,EAAC,GAAG,CAAC,CAAC;AAC/B,CAAC;AAEY,QAAA,gBAAgB,GAAoB;IAC/C,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,YAAY;IACpB,KAAK,EAAE,YAAY;IACnB,IAAI,EAAE,gUAAgU;IACtU,MAAM,EAAE;QACN,KAAK,EAAE,sFAAsF;QAC7F,WAAW,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;QAChC,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACvB,MAAM,IAAI,GAAG,IAAA,2BAAc,EAAC,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YAC5F,OAAO,IAAA,6CAAyB,EAAC,MAAM,IAAA,uBAAU,EAAC,YAAY,EAAE,GAAG,EAAE,CAAC,IAAA,yCAAqB,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAC3G,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,uHAAuH;QAC9H,WAAW,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,WAAW,CAAC;QAC7C,MAAM,EAAE;YACN,0NAA0N;YAC1N,2LAA2L;YAC3L,yGAAyG;YACzG,8IAA8I;SAC/I;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,YAAY,EAAE,GAAG,EAAE,CAC9C,IAAA,6BAAgB,EAAC;gBACf,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;gBACnB,MAAM,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,OAAO,CAAC;gBACxB,UAAU,EAAE,IAAA,sBAAS,EAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC;gBAC7C,SAAS,EAAE,CAAC,CAAC,KAAK;gBAClB,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;aAC3C,CAAC,CACH,CAAC;YACF,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,YAAY;QACpB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,CAAC;KACF;IACD,OAAO,EAAE,YAAY;CACtB,CAAC"}

package/dist/migrate/saml/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const samlPlugin: MigrationPlugin;

package/dist/migrate/saml/plugin.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.samlPlugin = void 0;
+const node_path_1 = require("node:path");
+const errors_1 = require("../../errors");
+const plugin_kit_1 = require("../export/plugin-kit");
+const sso_metadata_1 = require("../export/sso-metadata");
+const translate_kit_1 = require("../export/translate-kit");
+/**
+ * `atlas migrate saml export --set saml-metadata=<file or https URL>` — any
+ * SAML 2.0 identity provider (Ping, OneLogin, Okta, ADFS, Entra, Shibboleth,
+ * Keycloak …) from its metadata: an Atlas SSO connection with the IdP's
+ * entity id, sign-on URL and signing certificate. The users stay in the IdP:
+ * they sign in through it, now via Atlas, and relink on their verified email.
+ */
+const METADATA = { flag: 'saml-metadata', env: 'SAML_METADATA', label: 'the IdP metadata: a file, or an https:// URL', required: true };
+const DOMAINS = { flag: 'saml-domains', env: 'SAML_DOMAINS', label: 'email domains that sign in through this IdP (comma separated)', required: false };
+const NAME = { flag: 'saml-name', env: 'SAML_CONNECTION_NAME', label: 'a name for the connection', required: false };
+const ORG = { flag: 'saml-organization', env: 'SAML_ORGANIZATION', label: 'create the connection inside an organization with this name', required: false };
+async function metadata(p) {
+    const src = p.credential({ ...METADATA, required: true });
+    if (/^https:\/\//i.test(src)) {
+        const res = await p.fetch(src, { headers: { accept: 'application/samlmetadata+xml, application/xml, text/xml' }, redirect: 'error' });
+        if (res.status !== 200)
+            throw new errors_1.CliError(`${src} answered ${res.status}.`);
+        return { xml: await res.text(), url: src };
+    }
+    if (/^http:\/\//i.test(src))
+        throw new errors_1.CliError('The metadata URL must be https://.');
+    return { xml: p.ctx.readFile((0, node_path_1.resolve)(src)) };
+}
+function build(p, xml, url) {
+    const domains = (p.credential(DOMAINS) ?? '').split(',').map((d) => d.trim().toLowerCase()).filter(Boolean);
+    try {
+        return (0, sso_metadata_1.samlConnections)(xml, { name: p.credential(NAME), domains: domains.length ? domains : undefined, metadataUrl: url });
+    }
+    catch (err) {
+        throw new errors_1.CliError(err.message);
+    }
+}
+exports.samlPlugin = {
+    vendor: 'saml',
+    source: 'saml',
+    label: 'Any SAML identity provider',
+    help: 'Move a SAML single sign-on connection: read the IdP metadata (--set saml-metadata=<file or URL>) and create the Atlas SSO connection from it (entity id, sign-on URL, signing certificate, email domains). Afterwards give the IdP Atlas\'s entity id and ACS URL and switch the application to Atlas. The IdP\'s users are not exportable over SAML: they relink on their verified email at first sign-in.',
+    config: {
+        reads: 'the IdP metadata document',
+        credentials: [METADATA, DOMAINS, NAME],
+        async translate(p) {
+            const { xml, url } = await metadata(p);
+            const { connections, warnings } = build(p, xml, url);
+            const b = new translate_kit_1.ConfigBuilder();
+            for (const c of connections) {
+                b.add('mapped', 'saml', `${c.saml?.idp_entity_id}`, 'Becomes an Atlas SSO connection (atlas migrate saml export + import). Give the IdP Atlas\'s entity id and ACS URL, shown after the import.', 'sso_connections');
+                if (!c.domains?.length)
+                    b.add('manual', 'saml', `${c.saml?.idp_entity_id} domains`, 'Name the email domains that sign in through this IdP (--set saml-domains=…) so Atlas routes them to it.', 'sso_connections');
+            }
+            for (const w of warnings)
+                b.add('differs', 'saml', 'metadata', w);
+            return b.result(`SAML metadata ${url ?? ''}`.trim());
+        },
+    },
+    export: {
+        reads: 'the IdP metadata document (--set saml-metadata=<file or https URL>)',
+        credentials: [METADATA, DOMAINS, NAME, ORG],
+        limits: ['A SAML identity provider exposes no user list: users sign in through it and link to Atlas accounts on their verified email.'],
+        async run(p, writer, resume) {
+            const { xml, url } = await metadata(p);
+            const { connections, warnings } = build(p, xml, url);
+            const org = p.credential(ORG);
+            const set = (0, sso_metadata_1.connectionSet)(connections, `SAML metadata ${url ?? ''}`.trim(), org ? { id: org.toLowerCase().replace(/[^a-z0-9]+/g, '-'), name: org } : undefined);
+            for (const w of warnings)
+                set.warn(w);
+            p.say(`  ${connections.length} identity provider(s) in the metadata`);
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/saml/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/saml/plugin.ts"],"names":[],"mappings":";;;AAAA,yCAAoC;AACpC,yCAAwC;AACxC,qDAAsD;AACtD,yDAAwE;AACxE,2DAAwD;AAGxD;;;;;;GAMG;AAEH,MAAM,QAAQ,GAAmB,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,8CAA8C,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACxJ,MAAM,OAAO,GAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,+DAA+D,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACvK,MAAM,IAAI,GAAmB,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,2BAA2B,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACrI,MAAM,GAAG,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,6DAA6D,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAE3K,KAAK,UAAU,QAAQ,CAAC,CAAgB;IACtC,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAE,CAAC;IAC3D,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,yDAAyD,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACtI,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,MAAM,IAAI,iBAAQ,CAAC,GAAG,GAAG,aAAa,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QAC7E,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IAC7C,CAAC;IACD,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,iBAAQ,CAAC,oCAAoC,CAAC,CAAC;IACtF,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAA,mBAAO,EAAC,GAAG,CAAC,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,KAAK,CAAC,CAAgB,EAAE,GAAW,EAAE,GAAY;IACxD,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5G,IAAI,CAAC;QACH,OAAO,IAAA,8BAAe,EAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7H,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,iBAAQ,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAEY,QAAA,UAAU,GAAoB;IACzC,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,MAAM;IACd,KAAK,EAAE,4BAA4B;IACnC,IAAI,EAAE,6YAA6Y;IACnZ,MAAM,EAAE;QACN,KAAK,EAAE,2BAA2B;QAClC,WAAW,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC;QACtC,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;YACvC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,MAAM,CAAC,GAAG,IAAI,6BAAa,EAAE,CAAC;YAC9B,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;gBAC5B,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,aAAa,EAAE,EAAE,4IAA4I,EAAE,iBAAiB,CAAC,CAAC;gBACrN,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM;oBAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,aAAa,UAAU,EAAE,yGAAyG,EAAE,iBAAiB,CAAC,CAAC;YACpN,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,QAAQ;gBAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;YAClE,OAAO,CAAC,CAAC,MAAM,CAAC,iBAAiB,GAAG,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,qEAAqE;QAC5E,WAAW,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC;QAC3C,MAAM,EAAE,CAAC,6HAA6H,CAAC;QACvI,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;YACvC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAC9B,MAAM,GAAG,GAAG,IAAA,4BAAa,EAAC,WAAW,EAAE,iBAAiB,GAAG,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAChK,KAAK,MAAM,CAAC,IAAI,QAAQ;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACtC,CAAC,CAAC,GAAG,CAAC,KAAK,WAAW,CAAC,MAAM,uCAAuC,CAAC,CAAC;YACtE,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;CACF,CAAC"}

package/dist/migrate/stytch/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const stytchPlugin: MigrationPlugin;

package/dist/migrate/stytch/plugin.js

@@ -0,0 +1,97 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.stytchPlugin = void 0;
+const stytch_1 = require("../export/stytch");
+const stytch_config_1 = require("../export/stytch-config");
+const plugin_kit_1 = require("../export/plugin-kit");
+/**
+ * `atlas migrate stytch` — a Stytch project (consumer or B2B) through the
+ * Stytch API with the project id and secret (on this machine): users with
+ * verified emails and phones, OAuth identities, organizations, members, roles
+ * and SSO connections as data, RBAC as Atlas config; password hashes from the
+ * export Stytch support provides; the `stytch` bridge preset (session JWTs
+ * verified against the project's JWKS) and lazy migration through Stytch's
+ * password authentication.
+ */
+const PROJECT_ID = { flag: '--stytch-project-id', env: 'STYTCH_PROJECT_ID', label: 'your Stytch project id (project-live-…)', required: true };
+const SECRET = { flag: '--stytch-secret', env: 'STYTCH_SECRET', label: 'your Stytch project secret', required: true, secret: true };
+const HASHES = { flag: '--stytch-hashes', env: 'STYTCH_HASHES_FILE', label: 'the password-hash export from Stytch support', required: false };
+const PRODUCT = { flag: '--stytch-product', env: 'STYTCH_PRODUCT', label: 'consumer or b2b (detected when omitted)', required: false };
+const BASE_URL = { flag: '--stytch-base-url', env: 'STYTCH_BASE_URL', label: 'the Stytch API base URL (custom domain)', required: false };
+function baseUrl(p) {
+    return p.credential(BASE_URL)?.replace(/\/+$/, '');
+}
+function productOpt(p) {
+    const v = p.credential(PRODUCT)?.trim().toLowerCase();
+    if (v === undefined || v === '')
+        return undefined;
+    if (v !== 'consumer' && v !== 'b2b')
+        throw new Error(`${PRODUCT.flag} must be "consumer" or "b2b"`);
+    return v;
+}
+function http(p) {
+    return (0, stytch_1.stytchHttp)({ projectId: (0, plugin_kit_1.need)(p, PROJECT_ID), secret: (0, plugin_kit_1.need)(p, SECRET), baseUrl: baseUrl(p), fetchImpl: p.fetch });
+}
+exports.stytchPlugin = {
+    vendor: 'stytch',
+    source: 'stytch',
+    label: 'Stytch',
+    help: 'Move a Stytch project (consumer or B2B): users with verified emails and phones and OAuth identities, organizations with members, roles and SSO connections, RBAC as Atlas config, password hashes from the export Stytch support provides, a zero-logout bridge for Stytch session JWTs, lazy migration through Stytch password authentication, and the code. Your project secret stays on this machine.',
+    config: {
+        reads: 'your Stytch project via the API (RBAC policy, organizations, SSO connections)',
+        credentials: [PROJECT_ID, SECRET, PRODUCT, BASE_URL],
+        async translate(p) {
+            const projectId = (0, plugin_kit_1.need)(p, PROJECT_ID);
+            const client = http(p);
+            const snap = await (0, plugin_kit_1.vendorStep)('Stytch', async () => (0, stytch_config_1.fetchStytchConfig)(client, projectId, productOpt(p) ?? (await (0, stytch_1.detectStytchProduct)(client))));
+            return (0, stytch_config_1.translateStytchConfig)(snap);
+        },
+    },
+    export: {
+        reads: 'the Stytch API (users, or organizations, members and SSO connections, plus the RBAC policy) and, if you have one, the support hash export (--stytch-hashes)',
+        credentials: [PROJECT_ID, SECRET, HASHES, PRODUCT, BASE_URL],
+        limits: [
+            'Stytch only provides password hashes through support (support@stytch.com): pass that file with --stytch-hashes; otherwise passwords move by lazy migration (checked against Stytch on each user\'s first sign-in).',
+            'TOTP secrets, passkeys (WebAuthn) and crypto wallets are not exportable: users enrol again.',
+            'SCIM bearer tokens and OIDC client secrets are not returned: recreate those connections in Atlas.',
+            'Sessions are not exported: Stytch session JWTs are exchanged by the stytch bridge preset.',
+        ],
+        async run(p, writer, resume) {
+            const set = await (0, plugin_kit_1.vendorStep)('Stytch', () => (0, stytch_1.exportStytch)({
+                projectId: (0, plugin_kit_1.need)(p, PROJECT_ID),
+                secret: (0, plugin_kit_1.need)(p, SECRET),
+                product: productOpt(p),
+                baseUrl: baseUrl(p),
+                hashesText: (0, plugin_kit_1.localFile)(p, HASHES, 'text'),
+                fetchImpl: p.fetch,
+                onProgress: (m) => p.say(`  reading ${m}`),
+            }));
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    bridge: {
+        preset: 'stytch',
+        vars(p, t) {
+            if (t?.bridge)
+                return t.bridge.vars;
+            const projectId = (0, plugin_kit_1.need)(p, PROJECT_ID);
+            return {
+                project_id: projectId,
+                ...(projectId.startsWith('project-test-') ? { api_host: 'test.stytch.com' } : {}),
+                ...(productOpt(p) === 'b2b' ? { jwks_path: 'b2b/sessions' } : {}),
+            };
+        },
+    },
+    lazy: {
+        preset: 'stytch',
+        config(p, t) {
+            if (t?.lazy)
+                return t.lazy.config;
+            const product = productOpt(p);
+            return { project_id: (0, plugin_kit_1.need)(p, PROJECT_ID), ...(product ? { product } : {}) };
+        },
+        secret: SECRET,
+    },
+    codemod: 'stytch',
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/stytch/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/stytch/plugin.ts"],"names":[],"mappings":";;;AAAA,6CAAqG;AACrG,2DAAmF;AAEnF,qDAAmF;AAEnF;;;;;;;;GAQG;AAEH,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,yCAAyC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC/J,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,4BAA4B,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACpJ,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,8CAA8C,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC9J,MAAM,OAAO,GAAmB,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,yCAAyC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACvJ,MAAM,QAAQ,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,yCAAyC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAE1J,SAAS,OAAO,CAAC,CAAgB;IAC/B,OAAO,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,UAAU,CAAC,CAAgB;IAClC,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtD,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAClD,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,8BAA8B,CAAC,CAAC;IACpG,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,IAAI,CAAC,CAAgB;IAC5B,OAAO,IAAA,mBAAU,EAAC,EAAE,SAAS,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AAC1H,CAAC;AAEY,QAAA,YAAY,GAAoB;IAC3C,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,QAAQ;IACf,IAAI,EAAE,0YAA0Y;IAChZ,MAAM,EAAE;QACN,KAAK,EAAE,+EAA+E;QACtF,WAAW,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;QACpD,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,SAAS,GAAG,IAAA,iBAAI,EAAC,CAAC,EAAE,UAAU,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACvB,MAAM,IAAI,GAAG,MAAM,IAAA,uBAAU,EAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,IAAA,iCAAiB,EAAC,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,IAAA,4BAAmB,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAChJ,OAAO,IAAA,qCAAqB,EAAC,IAAI,CAAC,CAAC;QACrC,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,6JAA6J;QACpK,WAAW,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;QAC5D,MAAM,EAAE;YACN,oNAAoN;YACpN,6FAA6F;YAC7F,mGAAmG;YACnG,2FAA2F;SAC5F;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,QAAQ,EAAE,GAAG,EAAE,CAC1C,IAAA,qBAAY,EAAC;gBACX,SAAS,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,UAAU,CAAC;gBAC9B,MAAM,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,MAAM,CAAC;gBACvB,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;gBACtB,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;gBACnB,UAAU,EAAE,IAAA,sBAAS,EAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC;gBACxC,SAAS,EAAE,CAAC,CAAC,KAAK;gBAClB,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;aAC3C,CAAC,CACH,CAAC;YACF,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,QAAQ;QAChB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,IAAI,CAAC,EAAE,MAAM;gBAAE,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;YACpC,MAAM,SAAS,GAAG,IAAA,iBAAI,EAAC,CAAC,EAAE,UAAU,CAAC,CAAC;YACtC,OAAO;gBACL,UAAU,EAAE,SAAS;gBACrB,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjF,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClE,CAAC;QACJ,CAAC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,QAAQ;QAChB,MAAM,CAAC,CAAC,EAAE,CAAC;YACT,IAAI,CAAC,EAAE,IAAI;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;YAClC,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC9B,OAAO,EAAE,UAAU,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,UAAU,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC9E,CAAC;QACD,MAAM,EAAE,MAAM;KACf;IACD,OAAO,EAAE,QAAQ;CAClB,CAAC"}

package/dist/migrate/supabase/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const supabasePlugin: MigrationPlugin;

package/dist/migrate/supabase/plugin.js

@@ -0,0 +1,149 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.supabasePlugin = void 0;
+const node_path_1 = require("node:path");
+const supabase_1 = require("../export/supabase");
+const supabase_config_1 = require("../export/supabase-config");
+const errors_1 = require("../../errors");
+const plugin_kit_1 = require("../export/plugin-kit");
+/**
+ * `atlas migrate supabase` — Supabase Auth, hosted or self-hosted: its
+ * `config.toml` (or the hosted project's settings through the Management
+ * API) as Atlas config; users with their bcrypt / argon2 / Firebase-scrypt
+ * hashes, identities, SAML connections, TOTP secrets, phone and WebAuthn
+ * factors, recovery-code hashes and live sessions from a dump of the auth
+ * schema made on this machine; the `supabase` bridge preset (a Supabase
+ * access token becomes an Atlas session); lazy migration when only the Admin
+ * API is available; and the code. Nothing here connects to the database.
+ */
+const PROJECT_URL = { flag: '--supabase-url', env: 'SUPABASE_URL', label: 'your project URL (https://<ref>.supabase.co)', required: false };
+const DUMP = { flag: '--supabase-dump', env: 'SUPABASE_DUMP_DIR', label: 'a folder of auth-schema table dumps (users.csv, identities.csv, …)', required: false };
+const SERVICE_ROLE = { flag: '--supabase-service-role-key', env: 'SUPABASE_SERVICE_ROLE_KEY', label: 'the service_role / secret key (Admin API export only)', required: false, secret: true };
+const CONFIG_FILE = { flag: '--supabase-config', env: 'SUPABASE_CONFIG_TOML', label: 'supabase/config.toml', required: false };
+const ACCESS_TOKEN = { flag: '--supabase-access-token', env: 'SUPABASE_ACCESS_TOKEN', label: 'a personal access token (Management API)', required: false, secret: true };
+const PROJECT_REF = { flag: '--supabase-project-ref', env: 'SUPABASE_PROJECT_REF', label: 'the project ref (the subdomain of <ref>.supabase.co)', required: false };
+const ANONYMOUS = { flag: '--supabase-anonymous', env: 'SUPABASE_ANONYMOUS', label: '"include" to export anonymous users too', required: false };
+const ANON_KEY = { flag: '--supabase-anon-key', env: 'SUPABASE_ANON_KEY', label: 'the anon / publishable key, for lazy migration', required: false };
+const DB_KEYS = { flag: '--supabase-db-encryption-keys', env: 'GOTRUE_SECURITY_DB_ENCRYPTION_KEYS', label: 'GoTrue column-encryption keys, comma-separated key_id:key (only when GOTRUE_SECURITY_DB_ENCRYPTION_ENCRYPT is on)', required: false, secret: true };
+const BRIDGE = { flag: '--supabase-bridge', env: 'SUPABASE_BRIDGE', label: 'what the bridge exchanges: access-token (default; up to a week past expiry) or refresh-token (the sessions the dump imported)', required: false };
+const AUTH_URL = { flag: '--supabase-auth-url', env: 'SUPABASE_AUTH_URL', label: 'self-hosted or custom domain: the Auth URL (https://db.example.com/auth/v1)', required: false };
+const COOKIE_NAME = { flag: '--supabase-cookie-name', env: 'SUPABASE_COOKIE_NAME', label: 'self-hosted: the SSR cookie name (sb-<first label of the host>-auth-token)', required: false };
+const RP_ID = { flag: '--rp-id', env: 'ATLAS_MIGRATE_RP_ID', label: 'the WebAuthn relying party id passkeys were registered for', required: false };
+/** The project ref, from the flag or a hosted URL. */
+function refOf(p) {
+    const ref = p.credential(PROJECT_REF);
+    if (ref)
+        return ref.trim();
+    const url = p.credential(PROJECT_URL);
+    return url ? /^https:\/\/([a-z0-9]+)\.supabase\.co\/?$/.exec(url.trim())?.[1] : undefined;
+}
+/**
+ * `supabase` (hosted access tokens), `supabase_self_hosted` (an Auth URL of
+ * your own) or `supabase_refresh_token` (refresh tokens among the sessions the
+ * dump imported; hosted cookie names).
+ */
+function bridgePreset(p) {
+    const mode = (p.credential(BRIDGE) ?? 'access-token').trim().toLowerCase();
+    if (mode === 'refresh-token') {
+        if (p.credential(AUTH_URL))
+            throw new errors_1.CliError('Supabase: --set supabase-bridge=refresh-token reads the hosted cookie (sb-<ref>-auth-token); for a self-hosted project use the access-token bridge, or set the preset and cookie name through the bridge API.');
+        return 'supabase_refresh_token';
+    }
+    if (mode !== 'access-token')
+        throw new errors_1.CliError(`Supabase: --set supabase-bridge takes access-token or refresh-token (got ${mode}).`);
+    return p.credential(AUTH_URL) ? 'supabase_self_hosted' : 'supabase';
+}
+exports.supabasePlugin = {
+    vendor: 'supabase',
+    source: 'supabase',
+    label: 'Supabase Auth',
+    help: 'Move Supabase Auth (hosted or self-hosted): config.toml or the hosted project settings as Atlas config; users with their password hashes, social and SAML identities, TOTP secrets, phone and WebAuthn factors and live sessions from a dump of the auth schema you make with psql; a zero-logout bridge for Supabase access tokens; lazy migration when you only have the Admin API; and the code. Database access stays on this machine.',
+    config: {
+        reads: 'supabase/config.toml (or the hosted project through the Management API)',
+        credentials: [CONFIG_FILE, ACCESS_TOKEN, PROJECT_REF, PROJECT_URL],
+        async translate(p) {
+            const token = p.credential(ACCESS_TOKEN);
+            const ref = refOf(p);
+            if (token && ref) {
+                return (0, supabase_config_1.translateSupabaseConfig)(await (0, plugin_kit_1.vendorStep)('Supabase', () => (0, supabase_config_1.fetchSupabaseAuthConfig)({ projectRef: ref, accessToken: token, fetchImpl: p.fetch })));
+            }
+            const path = p.credential(CONFIG_FILE) ?? `${p.project}/supabase/config.toml`;
+            let text;
+            try {
+                text = p.ctx.readFile((0, node_path_1.resolve)(path));
+            }
+            catch {
+                throw new errors_1.CliError(`Supabase: no config.toml at ${path}. Pass --set supabase-config=<path>, or a personal access token and project ref to read the hosted project.`);
+            }
+            const settings = (0, supabase_config_1.settingsFromToml)(text, path);
+            return (0, supabase_config_1.translateSupabaseConfig)(ref ? { ...settings, projectRef: ref } : settings);
+        },
+    },
+    export: {
+        reads: 'a dump of the auth schema (psql \\copy of auth.users, identities, mfa_factors, sessions, refresh_tokens, sso_*, webauthn_credentials) or the Admin API',
+        credentials: [DUMP, PROJECT_URL, SERVICE_ROLE, ANONYMOUS, RP_ID, DB_KEYS],
+        limits: [
+            'Password hashes, TOTP secrets and sessions live only in the database: dump the auth schema (see the guide). The Admin API export has none of them, and passwords then move by lazy migration.',
+            'Values encrypted with GoTrue column encryption (GOTRUE_SECURITY_DB_ENCRYPTION_*) are decrypted on this machine with --set supabase-db-encryption-keys=<key_id>:<key>; without the keys those passwords move by lazy migration and those TOTP users enrol again.',
+            'Recovery codes move as their argon2id hashes; passkeys and WebAuthn factors only with --rp-id and when Atlas serves sign-in on that domain.',
+            'Refresh tokens in the newer signed format (no auth.refresh_tokens row) cannot be exported; the supabase bridge still exchanges the access token.',
+        ],
+        async run(p, writer, resume) {
+            const dump = p.credential(DUMP);
+            const url = p.credential(PROJECT_URL);
+            const key = dump ? undefined : p.credential(SERVICE_ROLE);
+            if (!dump && !(url && key)) {
+                throw new errors_1.CliError('Supabase: pass a folder of auth-schema dumps (--set supabase-dump=<folder>), or the project URL and service_role key for an Admin API export without password hashes.');
+            }
+            const set = await (0, plugin_kit_1.vendorStep)('Supabase', () => (0, supabase_1.exportSupabase)({
+                dumpDir: dump ? (0, node_path_1.resolve)(dump) : undefined,
+                url,
+                serviceRoleKey: key,
+                rpId: p.credential(RP_ID),
+                includeAnonymous: p.credential(ANONYMOUS) === 'include',
+                dbEncryptionKeys: p.credential(DB_KEYS)?.split(',').map((k) => k.trim()).filter(Boolean),
+                fetchImpl: p.fetch,
+                onProgress: (m) => p.say(`  reading ${m}`),
+            }));
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    bridge: {
+        preset: 'supabase',
+        presetFor: bridgePreset,
+        vars(p, t) {
+            const vars = { ...t?.bridge?.vars };
+            const preset = bridgePreset(p);
+            if (preset === 'supabase_self_hosted') {
+                const authUrl = p.credential(AUTH_URL).trim().replace(/\/+$/, '');
+                delete vars.project_ref;
+                vars.auth_url = authUrl;
+                const host = /^https?:\/\/([^/:]+)/i.exec(authUrl)?.[1];
+                if (!host)
+                    throw new errors_1.CliError(`Supabase: --set supabase-auth-url must be an https URL ending in /auth/v1 (got ${authUrl}).`);
+                // @supabase/ssr names the cookie after the first label of the project host.
+                vars.cookie_name = p.credential(COOKIE_NAME)?.trim() ?? `sb-${host.split('.')[0]}-auth-token`;
+                return vars;
+            }
+            const ref = refOf(p);
+            if (ref)
+                vars.project_ref = ref;
+            return vars;
+        },
+    },
+    lazy: {
+        preset: 'supabase',
+        config(p, t) {
+            const config = { ...t?.lazy?.config };
+            const url = p.credential(PROJECT_URL);
+            if (url)
+                config.url = url.trim().replace(/\/+$/, '');
+            const anon = p.credential(ANON_KEY);
+            if (anon)
+                config.anon_key = anon;
+            return config;
+        },
+    },
+    codemod: 'supabase',
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/supabase/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/supabase/plugin.ts"],"names":[],"mappings":";;;AAAA,yCAAoC;AACpC,iDAAoD;AACpD,+DAA+G;AAC/G,yCAAwC;AAExC,qDAAkE;AAElE;;;;;;;;;GASG;AAEH,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,8CAA8C,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC5J,MAAM,IAAI,GAAmB,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,oEAAoE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACjL,MAAM,YAAY,GAAmB,EAAE,IAAI,EAAE,6BAA6B,EAAE,GAAG,EAAE,2BAA2B,EAAE,KAAK,EAAE,uDAAuD,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC9M,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,sBAAsB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC/I,MAAM,YAAY,GAAmB,EAAE,IAAI,EAAE,yBAAyB,EAAE,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,0CAA0C,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACzL,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,wBAAwB,EAAE,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,sDAAsD,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACpL,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,yCAAyC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACjK,MAAM,QAAQ,GAAmB,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,gDAAgD,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACrK,MAAM,OAAO,GAAmB,EAAE,IAAI,EAAE,+BAA+B,EAAE,GAAG,EAAE,oCAAoC,EAAE,KAAK,EAAE,mHAAmH,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAChR,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,+HAA+H,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC9O,MAAM,QAAQ,GAAmB,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,6EAA6E,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAClM,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,wBAAwB,EAAE,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,4EAA4E,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC1M,MAAM,KAAK,GAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,4DAA4D,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAEpK,sDAAsD;AACtD,SAAS,KAAK,CAAC,CAAgB;IAC7B,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IACtC,OAAO,GAAG,CAAC,CAAC,CAAC,0CAA0C,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5F,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,CAAgB;IACpC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3E,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,iBAAQ,CAAC,+MAA+M,CAAC,CAAC;QAChQ,OAAO,wBAAwB,CAAC;IAClC,CAAC;IACD,IAAI,IAAI,KAAK,cAAc;QAAE,MAAM,IAAI,iBAAQ,CAAC,4EAA4E,IAAI,IAAI,CAAC,CAAC;IACtI,OAAO,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,UAAU,CAAC;AACtE,CAAC;AAEY,QAAA,cAAc,GAAoB;IAC7C,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,UAAU;IAClB,KAAK,EAAE,eAAe;IACtB,IAAI,EAAE,4aAA4a;IAClb,MAAM,EAAE;QACN,KAAK,EAAE,yEAAyE;QAChF,WAAW,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,CAAC;QAClE,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;YACzC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACrB,IAAI,KAAK,IAAI,GAAG,EAAE,CAAC;gBACjB,OAAO,IAAA,yCAAuB,EAAC,MAAM,IAAA,uBAAU,EAAC,UAAU,EAAE,GAAG,EAAE,CAAC,IAAA,yCAAuB,EAAC,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YAC3J,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,CAAC,OAAO,uBAAuB,CAAC;YAC9E,IAAI,IAAY,CAAC;YACjB,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,iBAAQ,CAAC,+BAA+B,IAAI,6GAA6G,CAAC,CAAC;YACvK,CAAC;YACD,MAAM,QAAQ,GAAG,IAAA,kCAAgB,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC9C,OAAO,IAAA,yCAAuB,EAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACpF,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,wJAAwJ;QAC/J,WAAW,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC;QACzE,MAAM,EAAE;YACN,+LAA+L;YAC/L,iQAAiQ;YACjQ,6IAA6I;YAC7I,kJAAkJ;SACnJ;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAChC,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YACtC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;YAC1D,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,iBAAQ,CAAC,uKAAuK,CAAC,CAAC;YAC9L,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,UAAU,EAAE,GAAG,EAAE,CAC5C,IAAA,yBAAc,EAAC;gBACb,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;gBACzC,GAAG;gBACH,cAAc,EAAE,GAAG;gBACnB,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;gBACzB,gBAAgB,EAAE,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,SAAS;gBACvD,gBAAgB,EAAE,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;gBACxF,SAAS,EAAE,CAAC,CAAC,KAAK;gBAClB,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;aAC3C,CAAC,CACH,CAAC;YACF,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,UAAU;QAClB,SAAS,EAAE,YAAY;QACvB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,GAA2B,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC5D,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;YAC/B,IAAI,MAAM,KAAK,sBAAsB,EAAE,CAAC;gBACtC,MAAM,OAAO,GAAG,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBACnE,OAAO,IAAI,CAAC,WAAW,CAAC;gBACxB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;gBACxB,MAAM,IAAI,GAAG,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBACxD,IAAI,CAAC,IAAI;oBAAE,MAAM,IAAI,iBAAQ,CAAC,kFAAkF,OAAO,IAAI,CAAC,CAAC;gBAC7H,4EAA4E;gBAC5E,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;gBAC9F,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACrB,IAAI,GAAG;gBAAE,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,UAAU;QAClB,MAAM,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,MAAM,GAA2B,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9D,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YACtC,IAAI,GAAG;gBAAE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACrD,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACpC,IAAI,IAAI;gBAAE,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;YACjC,OAAO,MAAM,CAAC;QAChB,CAAC;KACF;IACD,OAAO,EAAE,UAAU;CACpB,CAAC"}

package/dist/migrate/supertokens/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const supertokensPlugin: MigrationPlugin;

package/dist/migrate/supertokens/plugin.js

@@ -0,0 +1,114 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.supertokensPlugin = void 0;
+const node_path_1 = require("node:path");
+const errors_1 = require("../../errors");
+const tables_1 = require("../export/frameworks/tables");
+const plugin_kit_1 = require("../export/plugin-kit");
+const supertokens_1 = require("../export/supertokens");
+const supertokens_config_1 = require("../export/supertokens-config");
+/**
+ * `atlas migrate supertokens` — a SuperTokens core (self-hosted or the managed
+ * service): the core's recipes, providers and token settings as Atlas config;
+ * users with their linked login methods, verified emails, third-party links,
+ * metadata, roles and tenants through the core API with its API key (on this
+ * machine) or from a dump of the core database, which also carries bcrypt /
+ * Argon2 password hashes and TOTP secrets; the `supertokens` bridge preset (the
+ * session's access token verified against your backend's JWKS); lazy migration
+ * through the core's own sign-in; and the code.
+ */
+const CONNECTION_URI = { flag: '--supertokens-connection-uri', env: 'SUPERTOKENS_CONNECTION_URI', label: 'the core address (https://st-dev-xxxx.aws.supertokens.io, or http://localhost:3567)', required: false };
+const API_KEY = { flag: '--supertokens-api-key', env: 'SUPERTOKENS_API_KEY', label: 'the core API key', required: false, secret: true };
+const DUMP = { flag: '--supertokens-dump', env: 'SUPERTOKENS_DUMP_DIR', label: 'a folder of core database table dumps (all_auth_recipe_users.csv, emailpassword_users.csv, …)', required: false };
+const APP_ID = { flag: '--supertokens-app-id', env: 'SUPERTOKENS_APP_ID', label: 'the SuperTokens app id (multi-app cores; default public)', required: false };
+const TENANT_ID = { flag: '--supertokens-tenant-id', env: 'SUPERTOKENS_TENANT_ID', label: 'the tenant the lazy-migration sign-in runs on (default public)', required: false };
+const PREFIX = { flag: '--supertokens-table-prefix', env: 'SUPERTOKENS_TABLE_PREFIX', label: 'the core\'s table_names_prefix, when it has one', required: false };
+const API_DOMAIN = { flag: '--supertokens-api-domain', env: 'SUPERTOKENS_API_DOMAIN', label: 'your backend\'s apiDomain (https://api.example.com), the issuer of your access tokens', required: false };
+const API_BASE_PATH = { flag: '--supertokens-api-base-path', env: 'SUPERTOKENS_API_BASE_PATH', label: 'your backend\'s apiBasePath without slashes (default auth)', required: false };
+function coreUri(p, required) {
+    const raw = p.credential({ ...CONNECTION_URI, required });
+    if (!raw)
+        return undefined;
+    try {
+        return (0, supertokens_1.normalizeCoreUri)(raw);
+    }
+    catch {
+        throw new errors_1.CliError(`SuperTokens: ${raw} is not a core address (https://host or http://host:3567).`);
+    }
+}
+exports.supertokensPlugin = {
+    vendor: 'supertokens',
+    source: 'supertokens',
+    label: 'SuperTokens',
+    help: 'Move a SuperTokens core (self-hosted or managed): its recipes, third-party providers and token settings as Atlas config; users with linked login methods, verified emails, third-party links, metadata, roles and tenants through the core API with its API key (on this machine) or from a dump of the core database, which also carries bcrypt and Argon2 password hashes and TOTP secrets; a zero-logout bridge on your access tokens; lazy migration through the core\'s own sign-in; and the code.',
+    config: {
+        reads: 'your SuperTokens core via its HTTP API',
+        credentials: [CONNECTION_URI, API_KEY, APP_ID],
+        async translate(p) {
+            const uri = coreUri(p, true);
+            const appId = p.credential(APP_ID)?.trim() || 'public';
+            const http = (0, supertokens_1.supertokensHttp)({ connectionUri: uri, apiKey: p.credential(API_KEY), fetchImpl: p.fetch });
+            return (0, supertokens_config_1.translateSupertokensConfig)(await (0, plugin_kit_1.vendorStep)('SuperTokens', () => (0, supertokens_config_1.fetchSupertokensConfig)(http, uri, appId)));
+        },
+    },
+    export: {
+        reads: 'the SuperTokens core API (API key) or a dump of the core database',
+        credentials: [CONNECTION_URI, API_KEY, DUMP, APP_ID, PREFIX],
+        limits: [
+            'The core API never returns password hashes or TOTP secrets: export from the core database (--set supertokens-dump=<folder>) to carry bcrypt and Argon2 hashes and verified TOTP devices; the managed service has no database access, so those users move by lazy migration and enrol their authenticator app again.',
+            'Sessions are not exported: the core keeps only a double hash of each refresh token. The bridge exchanges the access-token JWT a user still holds, verified against your backend\'s JWKS.',
+            'A password hash that is not bcrypt or Argon2 (for example one imported from Firebase) cannot be verified by Atlas: those users reset their password or move by lazy migration.',
+            'Tenants become organizations; a tenant\'s own enabled recipes and providers do not carry over (configure SSO connections per organization).',
+            'Code in supertokens.init (override functions, custom claims, MFA requirements, email and SMS delivery) is not visible to the core: it is listed in the config report as manual.',
+        ],
+        async run(p, writer, resume) {
+            const dumpDir = p.credential(DUMP);
+            const uri = coreUri(p, false);
+            if (!dumpDir && !uri) {
+                throw new errors_1.CliError('SuperTokens: pass a core database dump (--set supertokens-dump=<folder>), or the core address with its API key (--set supertokens-connection-uri=… and SUPERTOKENS_API_KEY).');
+            }
+            const set = await (0, plugin_kit_1.vendorStep)('SuperTokens', async () => (0, supertokens_1.exportSupertokens)({
+                tables: dumpDir ? (0, tables_1.readDumpDir)((0, node_path_1.resolve)(dumpDir)) : undefined,
+                connectionUri: uri,
+                apiKey: p.credential(API_KEY),
+                appId: p.credential(APP_ID)?.trim(),
+                tablePrefix: p.credential(PREFIX)?.trim(),
+                fetchImpl: p.fetch,
+                onProgress: (m) => p.say(`  reading ${m}`),
+            }));
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    bridge: {
+        preset: 'supertokens',
+        vars(p, t) {
+            const vars = { ...t?.bridge?.vars };
+            const domain = p.credential(API_DOMAIN)?.trim();
+            if (domain)
+                vars.base_url = domain;
+            const basePath = p.credential(API_BASE_PATH)?.trim().replace(/^\/+|\/+$/g, '');
+            if (basePath)
+                vars.api_base_path = basePath;
+            return vars;
+        },
+    },
+    lazy: {
+        preset: 'supertokens',
+        config(p, t) {
+            const config = { ...t?.lazy?.config };
+            const uri = coreUri(p, false);
+            if (uri)
+                config.base_url = uri;
+            const tenant = p.credential(TENANT_ID)?.trim();
+            if (tenant)
+                config.tenant_id = tenant;
+            const app = p.credential(APP_ID)?.trim();
+            if (app)
+                config.app_id = app;
+            return config;
+        },
+        secret: API_KEY,
+    },
+    codemod: 'supertokens',
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/supertokens/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/supertokens/plugin.ts"],"names":[],"mappings":";;;AAAA,yCAAoC;AACpC,yCAAwC;AACxC,wDAA0D;AAC1D,qDAAkE;AAClE,uDAA6F;AAC7F,qEAAkG;AAGlG;;;;;;;;;GASG;AAEH,MAAM,cAAc,GAAmB,EAAE,IAAI,EAAE,8BAA8B,EAAE,GAAG,EAAE,4BAA4B,EAAE,KAAK,EAAE,qFAAqF,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAClO,MAAM,OAAO,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,kBAAkB,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACxJ,MAAM,IAAI,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,+FAA+F,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAClN,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,0DAA0D,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC/K,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,yBAAyB,EAAE,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,gEAAgE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC9L,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,4BAA4B,EAAE,GAAG,EAAE,0BAA0B,EAAE,KAAK,EAAE,iDAAiD,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAClL,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,0BAA0B,EAAE,GAAG,EAAE,wBAAwB,EAAE,KAAK,EAAE,uFAAuF,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACxN,MAAM,aAAa,GAAmB,EAAE,IAAI,EAAE,6BAA6B,EAAE,GAAG,EAAE,2BAA2B,EAAE,KAAK,EAAE,4DAA4D,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAEtM,SAAS,OAAO,CAAC,CAAgB,EAAE,QAAiB;IAClD,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,CAAC;QACH,OAAO,IAAA,8BAAgB,EAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAQ,CAAC,gBAAgB,GAAG,4DAA4D,CAAC,CAAC;IACtG,CAAC;AACH,CAAC;AAEY,QAAA,iBAAiB,GAAoB;IAChD,MAAM,EAAE,aAAa;IACrB,MAAM,EAAE,aAAa;IACrB,KAAK,EAAE,aAAa;IACpB,IAAI,EAAE,yeAAye;IAC/e,MAAM,EAAE;QACN,KAAK,EAAE,wCAAwC;QAC/C,WAAW,EAAE,CAAC,cAAc,EAAE,OAAO,EAAE,MAAM,CAAC;QAC9C,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,EAAE,IAAI,CAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC;YACvD,MAAM,IAAI,GAAG,IAAA,6BAAe,EAAC,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YACxG,OAAO,IAAA,+CAA0B,EAAC,MAAM,IAAA,uBAAU,EAAC,aAAa,EAAE,GAAG,EAAE,CAAC,IAAA,2CAAsB,EAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QACrH,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,mEAAmE;QAC1E,WAAW,EAAE,CAAC,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC;QAC5D,MAAM,EAAE;YACN,qTAAqT;YACrT,0LAA0L;YAC1L,gLAAgL;YAChL,6IAA6I;YAC7I,iLAAiL;SAClL;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,OAAO,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACnC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAC9B,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;gBACrB,MAAM,IAAI,iBAAQ,CAAC,8KAA8K,CAAC,CAAC;YACrM,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,aAAa,EAAE,KAAK,IAAI,EAAE,CACrD,IAAA,+BAAiB,EAAC;gBAChB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,IAAA,oBAAW,EAAC,IAAA,mBAAO,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC3D,aAAa,EAAE,GAAG;gBAClB,MAAM,EAAE,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC;gBAC7B,KAAK,EAAE,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE;gBACnC,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE;gBACzC,SAAS,EAAE,CAAC,CAAC,KAAK;gBAClB,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;aAC3C,CAAC,CACH,CAAC;YACF,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,aAAa;QACrB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,GAA2B,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC5D,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,CAAC;YAChD,IAAI,MAAM;gBAAE,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC;YACnC,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;YAC/E,IAAI,QAAQ;gBAAE,IAAI,CAAC,aAAa,GAAG,QAAQ,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,aAAa;QACrB,MAAM,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,MAAM,GAA2B,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9D,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAC9B,IAAI,GAAG;gBAAE,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC;YAC/B,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;YAC/C,IAAI,MAAM;gBAAE,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC;YACtC,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;YACzC,IAAI,GAAG;gBAAE,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC;YAC7B,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,EAAE,OAAO;KAChB;IACD,OAAO,EAAE,aAAa;CACvB,CAAC"}

package/dist/migrate/user-table/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const userTablePlugin: MigrationPlugin;