@atlasauth/cli 0.23.0 → 0.25.0

package/dist/migrate/corbado/plugin.js

@@ -1,63 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.corbadoPlugin = void 0;
-const corbado_1 = require("../export/corbado");
-const corbado_config_1 = require("../export/corbado-config");
-const plugin_kit_1 = require("../export/plugin-kit");
-/**
- * `atlas migrate corbado` — users with their verified emails, phones and
- * usernames AND their passkeys (credential ids and public keys, which
- * Corbado's Backend API exports), the sign-in methods inferred from your
- * users' identifiers, and the `corbado` bridge preset (short-session JWTs
- * verified against the project's JWKS). Corbado holds no passwords.
- */
-const PROJECT_ID = { flag: '--corbado-project-id', env: 'CORBADO_PROJECT_ID', label: 'your Corbado project id (pro-…)', required: true };
-const API_SECRET = { flag: '--corbado-api-secret', env: 'CORBADO_API_SECRET', label: 'your Corbado API secret', required: true, secret: true };
-const RP_ID = { flag: '--corbado-rp-id', env: 'CORBADO_RP_ID', label: 'the relying-party id (domain) your passkeys were registered for', required: false };
-const BASE_URL = { flag: '--corbado-base-url', env: 'CORBADO_BASE_URL', label: 'the Corbado Backend API origin', required: false };
-function projectId(p) {
-    return p.credential({ ...PROJECT_ID, required: false }) ?? (p.ctx.env.NEXT_PUBLIC_CORBADO_PROJECT_ID?.trim() || p.ctx.env.VITE_CORBADO_PROJECT_ID?.trim() || (0, plugin_kit_1.need)(p, PROJECT_ID));
-}
-exports.corbadoPlugin = {
-    vendor: 'corbado',
-    source: 'corbado',
-    label: 'Corbado',
-    help: 'Move a Corbado project: users with their verified emails, phone numbers and usernames, and their passkeys (credential ids and public keys) so members keep signing in with the passkey they have; the sign-in methods as Atlas config; a zero-logout bridge for Corbado session tokens; and the code. Your API secret stays on this machine.',
-    config: {
-        reads: 'your Corbado project via the Backend API (login identifier counts)',
-        credentials: [PROJECT_ID, API_SECRET, RP_ID, BASE_URL],
-        async translate(p) {
-            const pid = projectId(p);
-            const http = (0, corbado_1.corbadoHttp)({ projectId: pid, apiSecret: (0, plugin_kit_1.need)(p, API_SECRET), baseUrl: p.credential(BASE_URL), fetchImpl: p.fetch });
-            const snap = await (0, plugin_kit_1.vendorStep)('Corbado', () => (0, corbado_config_1.fetchCorbadoConfig)(http, pid, p.credential(RP_ID)));
-            return (0, corbado_config_1.translateCorbadoConfig)(snap);
-        },
-    },
-    export: {
-        reads: 'the Corbado Backend API (users, identifiers, passkeys)',
-        credentials: [PROJECT_ID, API_SECRET, RP_ID, BASE_URL],
-        limits: [
-            'Passkeys are exported with their public keys but are bound to your relying-party id (--corbado-rp-id): Atlas must be served from that domain, or a subdomain, for them to keep working. Without the flag, members register passkeys again.',
-            'Corbado keeps no passwords, authenticator-app secrets, organizations or API keys.',
-            'Linked social accounts are not returned: they relink by verified email on first social sign-in.',
-            'Sessions are not exported: Corbado session tokens are JWTs, exchanged by the corbado bridge preset.',
-        ],
-        async run(p, writer, resume) {
-            const set = await (0, plugin_kit_1.vendorStep)('Corbado', () => (0, corbado_1.exportCorbado)({
-                projectId: projectId(p),
-                apiSecret: (0, plugin_kit_1.need)(p, API_SECRET),
-                baseUrl: p.credential(BASE_URL),
-                rpId: p.credential(RP_ID),
-                fetchImpl: p.fetch,
-                onProgress: (m) => p.say(`  reading ${m}`),
-            }));
-            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
-        },
-    },
-    bridge: {
-        preset: 'corbado',
-        vars: (p, t) => ({ ...t?.bridge?.vars, project_id: t?.bridge?.vars.project_id ?? projectId(p) }),
-    },
-    codemod: 'corbado',
-};
-//# sourceMappingURL=plugin.js.map

package/dist/migrate/corbado/plugin.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/corbado/plugin.ts"],"names":[],"mappings":";;;AAAA,+CAA+D;AAC/D,6DAAsF;AAEtF,qDAAwE;AAExE;;;;;;GAMG;AAEH,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,iCAAiC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACzJ,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,yBAAyB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC/J,MAAM,KAAK,GAAmB,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,iEAAiE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC3K,MAAM,QAAQ,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,gCAAgC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAEnJ,SAAS,SAAS,CAAC,CAAgB;IACjC,OAAO,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,8BAA8B,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE,IAAI,IAAA,iBAAI,EAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;AACpL,CAAC;AAEY,QAAA,aAAa,GAAoB;IAC5C,MAAM,EAAE,SAAS;IACjB,MAAM,EAAE,SAAS;IACjB,KAAK,EAAE,SAAS;IAChB,IAAI,EAAE,8UAA8U;IACpV,MAAM,EAAE;QACN,KAAK,EAAE,oEAAoE;QAC3E,WAAW,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC;QACtD,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,IAAI,GAAG,IAAA,qBAAW,EAAC,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YAClI,MAAM,IAAI,GAAG,MAAM,IAAA,uBAAU,EAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAA,mCAAkB,EAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACnG,OAAO,IAAA,uCAAsB,EAAC,IAAI,CAAC,CAAC;QACtC,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,wDAAwD;QAC/D,WAAW,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC;QACtD,MAAM,EAAE;YACN,4OAA4O;YAC5O,mFAAmF;YACnF,iGAAiG;YACjG,qGAAqG;SACtG;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,SAAS,EAAE,GAAG,EAAE,CAC3C,IAAA,uBAAa,EAAC;gBACZ,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;gBACvB,SAAS,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,UAAU,CAAC;gBAC9B,OAAO,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAC/B,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;gBACzB,SAAS,EAAE,CAAC,CAAC,KAAK;gBAClB,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;aAC3C,CAAC,CACH,CAAC;YACF,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,SAAS;QACjB,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;KACjG;IACD,OAAO,EAAE,SAAS;CACnB,CAAC"}

package/dist/migrate/descope/plugin.d.ts

@@ -1,2 +0,0 @@
-import type { MigrationPlugin } from '../framework/plugin';
-export declare const descopePlugin: MigrationPlugin;

package/dist/migrate/descope/plugin.js

@@ -1,83 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.descopePlugin = void 0;
-const descope_1 = require("../export/descope");
-const kinde_descope_config_1 = require("../export/kinde-descope-config");
-const plugin_kit_1 = require("../export/plugin-kit");
-const vendor_http_1 = require("../export/vendor-http");
-/**
- * `atlas migrate descope` — users, tenants, roles and permissions through the
- * Descope Management API (project id + management key, on this machine),
- * password hashes from the export Descope support provides when the owner
- * has it, the `descope` bridge preset (DS session JWTs verified against the
- * project's keys) and lazy migration through Descope's password sign-in for
- * every other password.
- */
-const PROJECT_ID = { flag: '--descope-project-id', env: 'DESCOPE_PROJECT_ID', label: 'your Descope project id (P…)', required: true };
-const MANAGEMENT_KEY = { flag: '--descope-management-key', env: 'DESCOPE_MANAGEMENT_KEY', label: 'a Descope management key', required: true, secret: true };
-const BASE_URL = { flag: '--descope-base-url', env: 'DESCOPE_BASE_URL', label: 'the Descope API base URL (regional or custom domain)', required: false };
-const HASHES_FILE = { flag: '--descope-hashes-file', env: 'DESCOPE_HASHES_FILE', label: 'the password-hash export from Descope support', required: false };
-function projectId(p) {
-    return p.credential({ ...PROJECT_ID, required: false }) ?? (p.ctx.env.NEXT_PUBLIC_DESCOPE_PROJECT_ID?.trim() || (0, plugin_kit_1.need)(p, PROJECT_ID));
-}
-function baseUrl(p) {
-    return (p.credential(BASE_URL) ?? (p.ctx.env.NEXT_PUBLIC_DESCOPE_BASE_URL?.trim() || undefined))?.replace(/\/+$/, '');
-}
-exports.descopePlugin = {
-    vendor: 'descope',
-    source: 'descope',
-    label: 'Descope',
-    help: 'Move a Descope project: password policy, roles and permissions as Atlas config; users with their login ids, verified emails and phones, social and SSO links, tenants (as organizations), roles and custom attributes; password hashes from the export Descope support provides; a zero-logout bridge for DS session tokens; lazy migration for the other passwords; and the code. Your management key stays on this machine.',
-    config: {
-        reads: 'your Descope project via the Management API (password settings, roles, permissions)',
-        credentials: [PROJECT_ID, MANAGEMENT_KEY],
-        async translate(p) {
-            const pid = projectId(p);
-            const http = new vendor_http_1.VendorHttp({ vendor: 'Descope', baseUrl: baseUrl(p) ?? 'https://api.descope.com', headers: { authorization: `Bearer ${pid}:${(0, plugin_kit_1.need)(p, MANAGEMENT_KEY)}` }, fetchImpl: p.fetch });
-            const snap = await (0, plugin_kit_1.vendorStep)('Descope', () => (0, kinde_descope_config_1.fetchDescopeConfig)(http, pid));
-            return (0, kinde_descope_config_1.translateDescopeConfig)(snap);
-        },
-    },
-    export: {
-        reads: 'the Descope Management API (users, tenants, roles) and the support hash export (--descope-hashes-file)',
-        credentials: [PROJECT_ID, MANAGEMENT_KEY, HASHES_FILE],
-        limits: [
-            'Password hashes are not returned by the Management API: Descope support can export them on request. Pass that file with --descope-hashes-file; without it, passwords move by lazy migration.',
-            'TOTP seeds, passkeys and magic-link / OTP state cannot be exported: users enrol their second factor and passkeys again (email and SMS codes simply work).',
-            'Sessions are not exported: Descope session tokens are JWTs, exchanged by the descope bridge preset.',
-        ],
-        async run(p, writer, resume) {
-            const set = await (0, plugin_kit_1.vendorStep)('Descope', () => (0, descope_1.exportDescope)({
-                projectId: projectId(p),
-                managementKey: (0, plugin_kit_1.need)(p, MANAGEMENT_KEY),
-                baseUrl: baseUrl(p),
-                hashesText: (0, plugin_kit_1.localFile)(p, HASHES_FILE, 'text'),
-                fetchImpl: p.fetch,
-                onProgress: (m) => p.say(`  reading ${m}`),
-            }));
-            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
-        },
-    },
-    bridge: {
-        preset: 'descope',
-        vars(p, t) {
-            const vars = { ...t?.bridge?.vars, project_id: t?.bridge?.vars.project_id ?? projectId(p) };
-            const base = baseUrl(p);
-            if (base)
-                vars.base_url = base;
-            return vars;
-        },
-    },
-    lazy: {
-        preset: 'descope',
-        config(p, t) {
-            const config = { ...t?.lazy?.config, project_id: t?.lazy?.config.project_id ?? projectId(p) };
-            const base = baseUrl(p);
-            if (base)
-                config.base_url = base;
-            return config;
-        },
-    },
-    codemod: 'descope',
-};
-//# sourceMappingURL=plugin.js.map

package/dist/migrate/descope/plugin.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/descope/plugin.ts"],"names":[],"mappings":";;;AAAA,+CAAkD;AAClD,yEAA4F;AAE5F,qDAAmF;AACnF,uDAAmD;AAEnD;;;;;;;GAOG;AAEH,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,8BAA8B,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACtJ,MAAM,cAAc,GAAmB,EAAE,IAAI,EAAE,0BAA0B,EAAE,GAAG,EAAE,wBAAwB,EAAE,KAAK,EAAE,0BAA0B,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC5K,MAAM,QAAQ,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,sDAAsD,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACzK,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,+CAA+C,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAE3K,SAAS,SAAS,CAAC,CAAgB;IACjC,OAAO,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,8BAA8B,EAAE,IAAI,EAAE,IAAI,IAAA,iBAAI,EAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;AACvI,CAAC;AAED,SAAS,OAAO,CAAC,CAAgB;IAC/B,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,4BAA4B,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACxH,CAAC;AAEY,QAAA,aAAa,GAAoB;IAC5C,MAAM,EAAE,SAAS;IACjB,MAAM,EAAE,SAAS;IACjB,KAAK,EAAE,SAAS;IAChB,IAAI,EAAE,+ZAA+Z;IACra,MAAM,EAAE;QACN,KAAK,EAAE,qFAAqF;QAC5F,WAAW,EAAE,CAAC,UAAU,EAAE,cAAc,CAAC;QACzC,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,IAAI,GAAG,IAAI,wBAAU,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,yBAAyB,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,IAAI,IAAA,iBAAI,EAAC,CAAC,EAAE,cAAc,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YACjM,MAAM,IAAI,GAAG,MAAM,IAAA,uBAAU,EAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAA,yCAAkB,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;YAC9E,OAAO,IAAA,6CAAsB,EAAC,IAAI,CAAC,CAAC;QACtC,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,wGAAwG;QAC/G,WAAW,EAAE,CAAC,UAAU,EAAE,cAAc,EAAE,WAAW,CAAC;QACtD,MAAM,EAAE;YACN,8LAA8L;YAC9L,2JAA2J;YAC3J,qGAAqG;SACtG;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,SAAS,EAAE,GAAG,EAAE,CAC3C,IAAA,uBAAa,EAAC;gBACZ,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;gBACvB,aAAa,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,cAAc,CAAC;gBACtC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;gBACnB,UAAU,EAAE,IAAA,sBAAS,EAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC;gBAC7C,SAAS,EAAE,CAAC,CAAC,KAAK;gBAClB,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;aAC3C,CAAC,CACH,CAAC;YACF,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,SAAS;QACjB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,GAA2B,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YACpH,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,IAAI;gBAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,SAAS;QACjB,MAAM,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,MAAM,GAA2B,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YACtH,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,IAAI;gBAAE,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;YACjC,OAAO,MAAM,CAAC;QAChB,CAAC;KACF;IACD,OAAO,EAAE,SAAS;CACnB,CAAC"}

package/dist/migrate/entra-external-id/plugin.d.ts

@@ -1,8 +0,0 @@
-import type { MigrationPlugin } from '../framework/plugin';
-/**
- * `atlas migrate entra-external-id` — Microsoft Entra External ID (external
- * tenants). Same Graph exporter and translator as Azure AD B2C; lazy
- * migration through the native authentication API (external tenants have no
- * ROPC) and the bridge matching on the `oid` claim.
- */
-export declare const entraExternalIdPlugin: MigrationPlugin;

package/dist/migrate/entra-external-id/plugin.js

@@ -1,12 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.entraExternalIdPlugin = void 0;
-const plugin_1 = require("../azure-ad-b2c/plugin");
-/**
- * `atlas migrate entra-external-id` — Microsoft Entra External ID (external
- * tenants). Same Graph exporter and translator as Azure AD B2C; lazy
- * migration through the native authentication API (external tenants have no
- * ROPC) and the bridge matching on the `oid` claim.
- */
-exports.entraExternalIdPlugin = (0, plugin_1.azurePlugin)('entra');
-//# sourceMappingURL=plugin.js.map

package/dist/migrate/entra-external-id/plugin.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/entra-external-id/plugin.ts"],"names":[],"mappings":";;;AAAA,mDAAqD;AAGrD;;;;;GAKG;AACU,QAAA,qBAAqB,GAAoB,IAAA,oBAAW,EAAC,OAAO,CAAC,CAAC"}

package/dist/migrate/export/appwrite-config.d.ts

@@ -1,28 +0,0 @@
-import type { TranslationResult } from '../framework/plugin';
-import { type Obj } from './record-set';
-/**
- * `atlas migrate appwrite config` — an Appwrite project's auth settings →
- * Atlas config.
- *
- * Two local sources, either or both (Appwrite's Projects API is console-only,
- * so no project key can read it — the owner's own CLI can):
- *   - `appwrite.json` (or `appwrite.config.json`) after `appwrite pull
- *     settings`: `settings.auth.methods` and `settings.auth.security`, read
- *     with file:line;
- *   - the project document (`appwrite projects get --project-id <id> --json`,
- *     Appwrite 1.x model: `authDuration`, `authLimit`, … and `oAuthProviders`),
- *     the only place the OAuth providers are listed.
- */
-export interface AppwriteConfigSnapshot {
-    /** The CLI config file, as text, with its path for the report. */
-    file?: {
-        path: string;
-        text: string;
-    };
-    /** The project document (Projects API / `appwrite projects get --json`). */
-    project?: Obj;
-    endpoint?: string;
-    projectId?: string;
-}
-export declare function parseAppwriteConfigFile(text: string): Obj;
-export declare function translateAppwriteConfig(snap: AppwriteConfigSnapshot): TranslationResult;

package/dist/migrate/export/appwrite-config.js

@@ -1,170 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.parseAppwriteConfigFile = parseAppwriteConfigFile;
-exports.translateAppwriteConfig = translateAppwriteConfig;
-const record_set_1 = require("./record-set");
-const source_lines_1 = require("./source-lines");
-const translate_kit_1 = require("./translate-kit");
-/** Appwrite auth method ids (`settings.auth.methods` keys) → Atlas strategy. */
-const METHODS = {
-    'email-password': { atlas: 'strategies.password', note: 'Email + password sign-in. Imported Appwrite hashes verify as they are and are upgraded to Argon2id.' },
-    'magic-url': { atlas: 'strategies.emailLink', note: 'Magic URL sign-in becomes Atlas email links.' },
-    'email-otp': { atlas: 'strategies.emailCode', note: 'Email OTP becomes Atlas email codes.' },
-    phone: { atlas: 'strategies.phoneCode', note: 'Phone (SMS) OTP becomes Atlas SMS codes, sent through your Atlas SMS settings.' },
-    anonymous: { atlas: 'strategies.anonymous', note: 'Anonymous sessions become Atlas anonymous users.' },
-};
-/** The 1.x project model's method flags, in `settings.auth.methods` terms. */
-const PROJECT_METHODS = {
-    authEmailPassword: 'email-password',
-    authUsersAuthMagicURL: 'magic-url',
-    authEmailOtp: 'email-otp',
-    authPhone: 'phone',
-    authAnonymous: 'anonymous',
-    authInvites: 'invites',
-    authJWT: 'jwt',
-};
-const PROJECT_SECURITY = {
-    authDuration: 'duration',
-    authLimit: 'limit',
-    authSessionsLimit: 'sessionsLimit',
-    authPasswordHistory: 'passwordHistory',
-    authPasswordDictionary: 'passwordDictionary',
-    authPersonalDataCheck: 'personalDataCheck',
-    authSessionAlerts: 'sessionAlerts',
-    authMockNumbers: 'mockNumbers',
-};
-function parseAppwriteConfigFile(text) {
-    const parsed = JSON.parse(text);
-    if (!(0, record_set_1.isObj)(parsed))
-        throw new Error('appwrite.json is not a JSON object.');
-    return parsed;
-}
-function translateAppwriteConfig(snap) {
-    const b = new translate_kit_1.ConfigBuilder();
-    const fileDoc = snap.file ? parseAppwriteConfigFile(snap.file.text) : undefined;
-    const settings = (0, record_set_1.isObj)(fileDoc?.settings) ? fileDoc.settings : {};
-    const auth = (0, record_set_1.isObj)(settings.auth) ? settings.auth : {};
-    const project = snap.project ?? {};
-    const projectId = snap.projectId ?? (0, record_set_1.str)(fileDoc?.projectId) ?? (0, record_set_1.str)(project.$id);
-    const filePath = snap.file?.path;
-    // One view of methods and security, from the file (with lines) or the project document.
-    const methods = {};
-    const fileMethods = (0, record_set_1.isObj)(auth.methods) ? auth.methods : {};
-    for (const [k, v] of Object.entries(fileMethods)) {
-        if (typeof v === 'boolean')
-            methods[k] = { on: v, line: (0, source_lines_1.jsonKeyLine)(snap.file.text, ['settings', 'auth', 'methods', k]), from: `settings.auth.methods.${k}` };
-    }
-    for (const [flag, k] of Object.entries(PROJECT_METHODS)) {
-        if (methods[k] || typeof project[flag] !== 'boolean')
-            continue;
-        methods[k] = { on: project[flag], from: flag };
-    }
-    for (const m of (0, record_set_1.objs)(project.authMethods)) {
-        const id = (0, record_set_1.str)(m.$id);
-        if (id && !methods[id] && typeof m.enabled === 'boolean')
-            methods[id] = { on: m.enabled, from: `authMethods.${id}` };
-    }
-    const security = {};
-    const fileSecurity = (0, record_set_1.isObj)(auth.security) ? auth.security : {};
-    for (const [k, v] of Object.entries(fileSecurity))
-        security[k] = { value: v, line: (0, source_lines_1.jsonKeyLine)(snap.file.text, ['settings', 'auth', 'security', k]), from: `settings.auth.security.${k}` };
-    for (const [flag, k] of Object.entries(PROJECT_SECURITY))
-        if (!security[k] && project[flag] !== undefined)
-            security[k] = { value: project[flag], from: flag };
-    const at = (line) => (line ? filePath : undefined);
-    // ── sign-in methods ──
-    for (const [id, m] of Object.entries(methods)) {
-        const known = METHODS[id];
-        if (known) {
-            b.set(known.atlas, m.on);
-            if (m.on)
-                (0, source_lines_1.addAt)(b, at(m.line), m.line, 'mapped', 'auth methods', m.from, known.note, `auth_config.${known.atlas}`);
-        }
-        else if (id === 'invites' && m.on) {
-            (0, source_lines_1.addAt)(b, at(m.line), m.line, 'mapped', 'auth methods', m.from, 'Team invites become Atlas organization invitations (pending ones are imported).', 'organizations');
-        }
-        else if (id === 'jwt' && m.on) {
-            (0, source_lines_1.addAt)(b, at(m.line), m.line, 'differs', 'auth methods', m.from, 'Appwrite JWTs (account.createJWT) are replaced by Atlas session tokens (getToken()); your backend verifies them with Atlas\'s JWKS instead of calling Appwrite.', 'session tokens');
-        }
-        else if (m.on) {
-            (0, source_lines_1.addAt)(b, at(m.line), m.line, 'manual', 'auth methods', m.from, `The Appwrite method "${id}" has no direct Atlas setting: review it.`);
-        }
-    }
-    if (methods['email-password']?.on) {
-        b.set('passwordPolicy.minLength', 8);
-        b.add('mapped', 'auth methods', 'password minimum length', 'Appwrite requires 8 characters; so does Atlas.', 'auth_config.passwordPolicy.minLength');
-    }
-    // ── security ──
-    const sec = (k) => security[k];
-    const duration = sec('duration');
-    if (duration && typeof duration.value === 'number' && duration.value > 0) {
-        const ms = (0, translate_kit_1.clampSessionMs)(duration.value * 1000);
-        b.set('session.absoluteMs', ms);
-        (0, source_lines_1.addAt)(b, at(duration.line), duration.line, ms === duration.value * 1000 ? 'mapped' : 'differs', 'security', duration.from, `${duration.value} s sessions${ms !== duration.value * 1000 ? ' (Appwrite defaults to one year; Atlas allows at most 90 days)' : ''}.`, 'auth_config.session.absoluteMs');
-    }
-    const sessions = sec('sessionsLimit');
-    if (sessions && typeof sessions.value === 'number' && sessions.value > 0) {
-        b.set('session.maxConcurrentSessions', sessions.value);
-        (0, source_lines_1.addAt)(b, at(sessions.line), sessions.line, 'mapped', 'security', sessions.from, `At most ${sessions.value} sessions per user (the oldest is signed out).`, 'auth_config.session.maxConcurrentSessions');
-    }
-    const limit = sec('limit');
-    if (limit && typeof limit.value === 'number' && limit.value > 0) {
-        (0, source_lines_1.addAt)(b, at(limit.line), limit.line, 'manual', 'security', limit.from, `Appwrite caps the project at ${limit.value} users; Atlas has no user cap. Close sign-up (signUpMode "restricted") if that cap was a gate.`, 'auth_config.signUpMode');
-    }
-    const history = sec('passwordHistory');
-    if (history && typeof history.value === 'number' && history.value > 0) {
-        b.set('passwordPolicy.historyCount', history.value);
-        (0, source_lines_1.addAt)(b, at(history.line), history.line, 'mapped', 'security', history.from, `New passwords may not repeat the last ${history.value}. Atlas starts the history at the first password set in Atlas.`, 'auth_config.passwordPolicy.historyCount');
-    }
-    const dict = sec('passwordDictionary');
-    if (dict?.value === true) {
-        b.set('passwordPolicy.checkBreaches', true);
-        (0, source_lines_1.addAt)(b, at(dict.line), dict.line, 'differs', 'security', dict.from, 'Appwrite rejects the 10,000 most common passwords; Atlas rejects passwords found in breach corpora, a superset.', 'auth_config.passwordPolicy.checkBreaches');
-    }
-    const personal = sec('personalDataCheck');
-    if (personal?.value === true) {
-        b.set('passwordPolicy.rejectIdentifierSubstring', true);
-        (0, source_lines_1.addAt)(b, at(personal.line), personal.line, 'mapped', 'security', personal.from, 'Passwords may not contain the user\'s name, email or phone.', 'auth_config.passwordPolicy.rejectIdentifierSubstring');
-    }
-    const alerts = sec('sessionAlerts');
-    if (alerts?.value === true)
-        (0, source_lines_1.addAt)(b, at(alerts.line), alerts.line, 'manual', 'security', alerts.from, 'New-session email alerts: enable Atlas\'s new sign-in notification email in the dashboard (Emails).');
-    const mock = sec('mockNumbers');
-    if (mock && Array.isArray(mock.value) && mock.value.length) {
-        (0, source_lines_1.addAt)(b, at(mock.line), mock.line, 'manual', 'security', mock.from, `${mock.value.length} mock phone number(s) with fixed OTPs: use Atlas development-instance test numbers instead; they are not copied.`);
-    }
-    for (const k of ['membershipsUserName', 'membershipsUserEmail', 'membershipsMfa']) {
-        const flag = `auth${k[0].toUpperCase()}${k.slice(1)}`;
-        if (project[flag] === false)
-            b.add('manual', 'memberships privacy', flag, 'Appwrite hides this member field from team members; Atlas shows members\' names and emails to their organization. Restrict with organization permissions if needed.');
-    }
-    // ── OAuth providers ──
-    for (const p of (0, record_set_1.objs)(project.oAuthProviders)) {
-        const key = (0, record_set_1.str)(p.key);
-        if (!key || p.enabled !== true)
-            continue;
-        const atlas = (0, translate_kit_1.socialKey)(key);
-        const appId = (0, record_set_1.str)(p.appId);
-        if (atlas) {
-            b.socialProvider({ atlasKey: atlas, vendorName: key, area: 'oauth providers', setting: `oAuthProviders.${key}`, clientId: appId });
-        }
-        else {
-            b.add('manual', 'oauth providers', `oAuthProviders.${key}`, `"${key}" is not an Atlas built-in provider: add it as a custom OAuth/OIDC provider (custom_oauth_providers) with the same client id${appId ? ` (${appId})` : ''}.`, 'custom_oauth_providers');
-        }
-    }
-    if (!snap.project && snap.file) {
-        b.add('manual', 'oauth providers', 'oAuthProviders', 'appwrite.json does not list OAuth providers: pass the project document (appwrite projects get --json) to translate them, or add them in the Atlas dashboard with the same client ids.');
-    }
-    // ── always ──
-    b.add('differs', 'sessions', 'a_session_<project> cookie', 'Appwrite sessions live on the Appwrite domain and are stored hashed: the appwrite bridge preset asks Appwrite about each live session once and swaps it for an Atlas session.', 'migrations bridge appwrite');
-    b.add('differs', 'multi-factor', 'TOTP authenticators', 'Appwrite cannot export TOTP secrets: those users enrol an authenticator app again (recovery codes can be exported).', 'auth_config.mfa.factors.totp');
-    const endpoint = snap.endpoint ?? (0, record_set_1.str)(fileDoc?.endpoint);
-    const base = endpoint?.replace(/\/+$/, '');
-    const ids = projectId ? { project_id: projectId } : {};
-    // The bridge preset names the endpoint `endpoint_url`, the lazy preset `endpoint`.
-    return b.result(filePath ?? `appwrite project ${projectId ?? ''}`.trim(), {
-        bridge: { preset: 'appwrite', vars: { ...ids, ...(base ? { endpoint_url: base } : {}) } },
-        lazy: { preset: 'appwrite', config: { ...ids, ...(base ? { endpoint: base } : {}) } },
-    });
-}
-//# sourceMappingURL=appwrite-config.js.map

package/dist/migrate/export/appwrite-config.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"appwrite-config.js","sourceRoot":"","sources":["../../../src/migrate/export/appwrite-config.ts"],"names":[],"mappings":";;AA0DA,0DAIC;AAED,0DAwHC;AAvLD,6CAA0D;AAC1D,iDAAoD;AACpD,mDAA2E;AAwB3E,gFAAgF;AAChF,MAAM,OAAO,GAAoD;IAC/D,gBAAgB,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,IAAI,EAAE,qGAAqG,EAAE;IAC/J,WAAW,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,IAAI,EAAE,8CAA8C,EAAE;IACpG,WAAW,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,IAAI,EAAE,sCAAsC,EAAE;IAC5F,KAAK,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,IAAI,EAAE,gFAAgF,EAAE;IAChI,SAAS,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,IAAI,EAAE,kDAAkD,EAAE;CACvG,CAAC;AAEF,8EAA8E;AAC9E,MAAM,eAAe,GAA2B;IAC9C,iBAAiB,EAAE,gBAAgB;IACnC,qBAAqB,EAAE,WAAW;IAClC,YAAY,EAAE,WAAW;IACzB,SAAS,EAAE,OAAO;IAClB,aAAa,EAAE,WAAW;IAC1B,WAAW,EAAE,SAAS;IACtB,OAAO,EAAE,KAAK;CACf,CAAC;AAEF,MAAM,gBAAgB,GAA2B;IAC/C,YAAY,EAAE,UAAU;IACxB,SAAS,EAAE,OAAO;IAClB,iBAAiB,EAAE,eAAe;IAClC,mBAAmB,EAAE,iBAAiB;IACtC,sBAAsB,EAAE,oBAAoB;IAC5C,qBAAqB,EAAE,mBAAmB;IAC1C,iBAAiB,EAAE,eAAe;IAClC,eAAe,EAAE,aAAa;CAC/B,CAAC;AAEF,SAAgB,uBAAuB,CAAC,IAAY;IAClD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IAC3C,IAAI,CAAC,IAAA,kBAAK,EAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC3E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,uBAAuB,CAAC,IAA4B;IAClE,MAAM,CAAC,GAAG,IAAI,6BAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,MAAM,QAAQ,GAAG,IAAA,kBAAK,EAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,MAAM,IAAI,GAAG,IAAA,kBAAK,EAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;IACnC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAA,gBAAG,EAAC,OAAO,EAAE,SAAS,CAAC,IAAI,IAAA,gBAAG,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC;IAEjC,wFAAwF;IACxF,MAAM,OAAO,GAAiE,EAAE,CAAC;IACjF,MAAM,WAAW,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACjD,IAAI,OAAO,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,IAAA,0BAAW,EAAC,IAAI,CAAC,IAAK,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,yBAAyB,CAAC,EAAE,EAAE,CAAC;IACjK,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QACxD,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC/D,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,IAAI,CAAY,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5D,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1C,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACtB,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;IACvH,CAAC;IACD,MAAM,QAAQ,GAAoE,EAAE,CAAC;IACrF,MAAM,YAAY,GAAG,IAAA,kBAAK,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC;QAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,IAAA,0BAAW,EAAC,IAAI,CAAC,IAAK,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,0BAA0B,CAAC,EAAE,EAAE,CAAC;IAC5L,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAE9J,MAAM,EAAE,GAAG,CAAC,IAAwB,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAEvE,wBAAwB;IACxB,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QAC1B,IAAI,KAAK,EAAE,CAAC;YACV,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;YACzB,IAAI,CAAC,CAAC,EAAE;gBAAE,IAAA,oBAAK,EAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,eAAe,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QACrH,CAAC;aAAM,IAAI,EAAE,KAAK,SAAS,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;YACpC,IAAA,oBAAK,EAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC,IAAI,EAAE,iFAAiF,EAAE,eAAe,CAAC,CAAC;QACrK,CAAC;aAAM,IAAI,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;YAChC,IAAA,oBAAK,EAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC,IAAI,EAAE,iKAAiK,EAAE,gBAAgB,CAAC,CAAC;QACvP,CAAC;aAAM,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;YAChB,IAAA,oBAAK,EAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC,IAAI,EAAE,wBAAwB,EAAE,2CAA2C,CAAC,CAAC;QACxI,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,CAAC;QAClC,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,CAAC,CAAC,CAAC;QACrC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,EAAE,yBAAyB,EAAE,gDAAgD,EAAE,sCAAsC,CAAC,CAAC;IACvJ,CAAC;IAED,iBAAiB;IACjB,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;IACjC,IAAI,QAAQ,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QACzE,MAAM,EAAE,GAAG,IAAA,8BAAc,EAAC,QAAQ,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;QACjD,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;QAChC,IAAA,oBAAK,EAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,QAAQ,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,QAAQ,CAAC,KAAK,cAAc,EAAE,KAAK,QAAQ,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,gEAAgE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,gCAAgC,CAAC,CAAC;IACvS,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,eAAe,CAAC,CAAC;IACtC,IAAI,QAAQ,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QACzE,CAAC,CAAC,GAAG,CAAC,+BAA+B,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QACvD,IAAA,oBAAK,EAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,QAAQ,CAAC,KAAK,gDAAgD,EAAE,2CAA2C,CAAC,CAAC;IAC1M,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3B,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QAChE,IAAA,oBAAK,EAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,gCAAgC,KAAK,CAAC,KAAK,gGAAgG,EAAE,wBAAwB,CAAC,CAAC;IAChP,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACvC,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QACtE,CAAC,CAAC,GAAG,CAAC,6BAA6B,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACpD,IAAA,oBAAK,EAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,yCAAyC,OAAO,CAAC,KAAK,gEAAgE,EAAE,yCAAyC,CAAC,CAAC;IAClP,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACvC,IAAI,IAAI,EAAE,KAAK,KAAK,IAAI,EAAE,CAAC;QACzB,CAAC,CAAC,GAAG,CAAC,8BAA8B,EAAE,IAAI,CAAC,CAAC;QAC5C,IAAA,oBAAK,EAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,iHAAiH,EAAE,0CAA0C,CAAC,CAAC;IACtO,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC1C,IAAI,QAAQ,EAAE,KAAK,KAAK,IAAI,EAAE,CAAC;QAC7B,CAAC,CAAC,GAAG,CAAC,0CAA0C,EAAE,IAAI,CAAC,CAAC;QACxD,IAAA,oBAAK,EAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,6DAA6D,EAAE,sDAAsD,CAAC,CAAC;IACzM,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,eAAe,CAAC,CAAC;IACpC,IAAI,MAAM,EAAE,KAAK,KAAK,IAAI;QAAE,IAAA,oBAAK,EAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,qGAAqG,CAAC,CAAC;IAC7M,MAAM,IAAI,GAAG,GAAG,CAAC,aAAa,CAAC,CAAC;IAChC,IAAI,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAC3D,IAAA,oBAAK,EAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,kHAAkH,CAAC,CAAC;IAC9M,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,sBAAsB,EAAE,gBAAgB,CAAU,EAAE,CAAC;QAC3F,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,qBAAqB,EAAE,IAAI,EAAE,qKAAqK,CAAC,CAAC;IACnP,CAAC;IAED,wBAAwB;IACxB,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAC7C,MAAM,GAAG,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI;YAAE,SAAS;QACzC,MAAM,KAAK,GAAG,IAAA,yBAAS,EAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,KAAK,EAAE,CAAC;YACV,CAAC,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,kBAAkB,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACrI,CAAC;aAAM,CAAC;YACN,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,iBAAiB,EAAE,kBAAkB,GAAG,EAAE,EAAE,IAAI,GAAG,+HAA+H,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;QAC7P,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,uLAAuL,CAAC,CAAC;IAChP,CAAC;IAED,eAAe;IACf,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,4BAA4B,EAAE,+KAA+K,EAAE,4BAA4B,CAAC,CAAC;IAC1Q,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,qBAAqB,EAAE,qHAAqH,EAAE,8BAA8B,CAAC,CAAC;IAE/M,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAA,gBAAG,EAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3C,MAAM,GAAG,GAA2B,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,mFAAmF;IACnF,OAAO,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,oBAAoB,SAAS,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE;QACxE,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,GAAG,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACzF,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,GAAG,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;KACtF,CAAC,CAAC;AACL,CAAC"}

package/dist/migrate/export/appwrite.d.ts

@@ -1,51 +0,0 @@
-import type { PasswordHash } from '@atlasauth/migrate';
-import { RecordSet, type Obj } from './record-set';
-/**
- * `atlas migrate export appwrite` — an Appwrite project (Cloud or self-hosted,
- * 1.5 and later) through the Server API, with an API key the owner creates
- * (scopes `users.read`, `teams.read`; `users.write` too for recovery codes on
- * 2.x). The key is used on this machine only.
- *
- * Appwrite's Users API returns every user's hash with its algorithm and
- * options (`password`, `hash`, `hashOptions`), so passwords move as they are:
- * Argon2 and bcrypt are self-describing, MD5 and the eleven SHA variants are
- * unsalted hex, phpass keeps its `$P$`/`$H$` digest, plain scrypt carries its
- * literal N / r / p and string salt, and `scryptMod` is Firebase's modified
- * scrypt with Appwrite's fixed N=2^14, r=8.
- *
- * Teams become organizations (confirmed memberships with their roles,
- * unconfirmed ones as pending invitations), labels become app roles, prefs
- * become public metadata (list queries use the JSON syntax of 1.5+). MFA
- * recovery codes are readable (opt in); TOTP secrets are encrypted at rest
- * with no read route, so those users enrol again. Sessions are stored as hashes and cannot leave: the `appwrite` bridge
- * preset asks Appwrite about a live session instead.
- */
-export interface AppwriteExportOptions {
-    /** The API endpoint including /v1 (default https://cloud.appwrite.io/v1). */
-    endpoint?: string;
-    projectId: string;
-    apiKey: string;
-    /** Read each MFA user's recovery codes (`GET /users/{id}/mfa/recovery-codes`). */
-    recoveryCodes?: boolean;
-    /** Skip teams and memberships. */
-    skipTeams?: boolean;
-    fetchImpl?: typeof fetch;
-    sleep?: (ms: number) => Promise<void>;
-    onProgress?: (message: string) => void;
-}
-export declare const APPWRITE_CLOUD = "https://cloud.appwrite.io/v1";
-export declare function exportAppwrite(opts: AppwriteExportOptions): Promise<RecordSet>;
-/** Appwrite team roles → one Atlas membership role: `owner` is the org admin, else the first custom role. */
-export declare function appwriteTeamRole(roles: string[]): string;
-/**
- * One Appwrite user's hash in the bundle's terms (see the module comment).
- * `guessed` marks a SHA hash stored without a version; `problem` is a warning
- * for a hash that cannot be carried.
- */
-export declare function appwritePasswordHash(u: Obj): {
-    hash?: PasswordHash;
-    guessed?: boolean;
-    problem?: string;
-};
-/** An Appwrite 1.5+ query (JSON form) for the `queries[]` parameter. */
-export declare function appwriteQuery(method: string, values: unknown[]): string;