@atlasauth/cli 0.23.0 → 0.25.0

package/dist/migrate/keycloak/plugin.js

@@ -1,148 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.keycloakPlugin = void 0;
-const node_fs_1 = require("node:fs");
-const node_path_1 = require("node:path");
-const errors_1 = require("../../errors");
-const keycloak_1 = require("../export/keycloak");
-const keycloak_config_1 = require("../export/keycloak-config");
-const plugin_kit_1 = require("../export/plugin-kit");
-/**
- * `atlas migrate keycloak` — a Keycloak (or Red Hat build of Keycloak) realm:
- * its settings as Atlas config (Admin API or a realm export); users with their
- * federated identities, roles, groups, organizations, SSO brokers, TOTP,
- * recovery codes and passkeys from a REALM EXPORT (`kc.sh export`, the only
- * path that carries password hashes and OTP secrets) or the Admin API (no
- * secrets); the `keycloak` bridge preset for access / ID tokens; lazy migration
- * through the password grant; and the code. Your admin credentials stay on this machine.
- */
-const URL_SPEC = { flag: '--keycloak-url', env: 'KEYCLOAK_URL', label: 'your Keycloak base URL (https://sso.example.com; with /auth on Keycloak 16 and older)', required: false };
-const REALM = { flag: '--keycloak-realm', env: 'KEYCLOAK_REALM', label: 'the realm to move', required: false };
-const CLIENT_ID = { flag: '--keycloak-client-id', env: 'KEYCLOAK_CLIENT_ID', label: 'an admin client (service account with view-users, view-realm, query-users, view-clients) or the client of an admin user (default admin-cli)', required: false };
-const CLIENT_SECRET = { flag: '--keycloak-client-secret', env: 'KEYCLOAK_CLIENT_SECRET', label: 'that client\'s secret', required: false, secret: true };
-const ADMIN_USER = { flag: '--keycloak-admin-user', env: 'KEYCLOAK_ADMIN_USER', label: 'an admin user (alternative to a client)', required: false };
-const ADMIN_PASSWORD = { flag: '--keycloak-admin-password', env: 'KEYCLOAK_ADMIN_PASSWORD', label: 'that admin user\'s password', required: false, secret: true };
-const AUTH_REALM = { flag: '--keycloak-auth-realm', env: 'KEYCLOAK_AUTH_REALM', label: 'the realm the admin credential lives in (default master for a user, the realm for a client)', required: false };
-const EXPORT_FILE = { flag: '--keycloak-export', env: 'KEYCLOAK_EXPORT', label: 'a realm export: the file or folder `kc.sh export` wrote', required: false };
-const RP_ID = { flag: '--keycloak-rp-id', env: 'KEYCLOAK_RP_ID', label: 'the WebAuthn relying-party id when the realm leaves it empty', required: false };
-const GROUPS_AS = { flag: '--groups-as', env: 'ATLAS_MIGRATE_GROUPS_AS', label: 'how groups move: roles, organizations or skip', required: false };
-const LAZY_CLIENT = { flag: '--keycloak-lazy-client-id', env: 'KEYCLOAK_LAZY_CLIENT_ID', label: 'a client with Direct access grants enabled (lazy migration)', required: false };
-function groupsAs(p) {
-    const raw = p.credential(GROUPS_AS) ?? 'roles';
-    if (raw !== 'roles' && raw !== 'organizations' && raw !== 'skip')
-        throw new errors_1.CliError(`Keycloak: --groups-as must be roles, organizations or skip (got ${raw}).`);
-    return raw;
-}
-function baseUrl(p, required) {
-    const raw = p.credential({ ...URL_SPEC, required });
-    return raw ? (0, keycloak_1.keycloakBase)(raw) : undefined;
-}
-function adminApi(p, realm) {
-    const url = baseUrl(p, true);
-    const username = p.credential(ADMIN_USER);
-    const password = p.credential(ADMIN_PASSWORD);
-    const clientId = p.credential(CLIENT_ID);
-    const clientSecret = p.credential(CLIENT_SECRET);
-    if (!(username && password) && !(clientId && clientSecret)) {
-        throw new errors_1.CliError('Keycloak: pass an admin client (--set keycloak-client-id=… and KEYCLOAK_CLIENT_SECRET) or an admin user (--set keycloak-admin-user=… and KEYCLOAK_ADMIN_PASSWORD).');
-    }
-    return { baseUrl: url, realm, clientId, clientSecret, username, password, authRealm: p.credential(AUTH_REALM), fetchImpl: p.fetch };
-}
-/** The JSON documents of a realm export: one file, or every .json in a folder. */
-function readExportDocs(p, path) {
-    const abs = (0, node_path_1.resolve)(path);
-    let files;
-    try {
-        files = (0, node_fs_1.statSync)(abs).isDirectory() ? (0, node_fs_1.readdirSync)(abs).filter((f) => f.endsWith('.json')).sort().map((f) => (0, node_path_1.join)(abs, f)) : [abs];
-    }
-    catch (err) {
-        throw new errors_1.CliError(`Keycloak: could not read the realm export at ${path}: ${err.message}`);
-    }
-    if (!files.length)
-        throw new errors_1.CliError(`Keycloak: no .json files in ${path}.`);
-    return files.map((f) => {
-        try {
-            return JSON.parse(p.ctx.readFile(f));
-        }
-        catch (err) {
-            throw new errors_1.CliError(`Keycloak: ${f} is not valid JSON: ${err.message}`);
-        }
-    });
-}
-exports.keycloakPlugin = {
-    vendor: 'keycloak',
-    source: 'keycloak',
-    label: 'Keycloak',
-    help: 'Move a Keycloak realm: its settings (password policy, sessions, OTP and WebAuthn, brokers, clients\' redirect URIs, roles) as Atlas config; users with identities, roles, groups or organizations, SAML and OIDC brokers as SSO connections, and, from a realm export, password hashes (PBKDF2, Argon2), TOTP secrets, recovery codes and passkeys; a zero-logout bridge on your realm\'s tokens; lazy migration through the password grant; and the code. Admin credentials stay on this machine.',
-    config: {
-        reads: 'your realm via the Admin REST API, or a realm export',
-        credentials: [URL_SPEC, REALM, CLIENT_ID, CLIENT_SECRET, ADMIN_USER, ADMIN_PASSWORD, AUTH_REALM, EXPORT_FILE],
-        async translate(p) {
-            const file = p.credential(EXPORT_FILE);
-            if (file) {
-                const snap = (0, keycloak_1.readKeycloakExport)(readExportDocs(p, file), p.credential(REALM));
-                return (0, keycloak_config_1.translateKeycloakConfig)(snap.realm, { groupsAs: groupsAs(p), baseUrl: baseUrl(p, false) });
-            }
-            const realm = p.credential({ ...REALM, required: true });
-            const http = (0, keycloak_1.keycloakAdminHttp)(adminApi(p, realm));
-            const doc = await (0, plugin_kit_1.vendorStep)('Keycloak', () => (0, keycloak_config_1.fetchKeycloakConfig)(http, realm, baseUrl(p, true)));
-            return (0, keycloak_config_1.translateKeycloakConfig)(doc, { groupsAs: groupsAs(p), baseUrl: baseUrl(p, true) });
-        },
-    },
-    export: {
-        reads: 'a realm export (kc.sh export) or the Keycloak Admin REST API',
-        credentials: [EXPORT_FILE, URL_SPEC, REALM, CLIENT_ID, CLIENT_SECRET, ADMIN_USER, ADMIN_PASSWORD, AUTH_REALM, RP_ID],
-        limits: [
-            'Only a realm export carries password hashes (PBKDF2-SHA1/256/512, Argon2), OTP secrets and recovery-code hashes: run `kc.sh export --realm <realm> --file realm.json --users realm_file` (or `--dir`) and pass it with --set keycloak-export=<path>. The Admin API strips every secret.',
-            'With the Admin API alone, passwords move by lazy migration (the keycloak preset) and authenticator-app users enrol again; WebAuthn public keys DO come back.',
-            'Users of an LDAP / Kerberos user-storage provider have no password in Keycloak: lazy migration lets Keycloak (and the directory) verify them. Users of a provider without local import are not exported.',
-            'Identity-provider and client secrets are masked by the Admin API (a realm export keeps them unless they live in a vault): enter them on the SSO connection.',
-            'Live sessions are not exportable: the bridge exchanges Keycloak access and ID tokens for Atlas sessions.',
-            'Composite roles import as plain roles; fine-grained authorization services are not migrated.',
-        ],
-        async run(p, writer, resume) {
-            const file = p.credential(EXPORT_FILE);
-            const realm = p.credential(REALM);
-            const common = { realm, groupsAs: groupsAs(p), rpId: p.credential(RP_ID), onProgress: (m) => p.say(`  reading ${m}`) };
-            if (!file && !(baseUrl(p, false) && realm)) {
-                throw new errors_1.CliError('Keycloak: pass a realm export (--set keycloak-export=<path>), or the base URL and realm with an admin credential (--set keycloak-url=… --set keycloak-realm=…).');
-            }
-            const set = await (0, plugin_kit_1.vendorStep)('Keycloak', async () => file
-                ? (0, keycloak_1.exportKeycloak)({ ...common, exportDocs: readExportDocs(p, file), api: baseUrl(p, false) ? { baseUrl: baseUrl(p, false), clientId: undefined } : undefined })
-                : (0, keycloak_1.exportKeycloak)({ ...common, api: adminApi(p, realm) }));
-            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
-        },
-    },
-    bridge: {
-        preset: 'keycloak',
-        vars(p, t) {
-            const vars = { ...t?.bridge?.vars };
-            const url = baseUrl(p, false);
-            if (url)
-                vars.base_url = url;
-            const realm = p.credential(REALM);
-            if (realm)
-                vars.realm = realm;
-            return vars;
-        },
-    },
-    lazy: {
-        preset: 'keycloak',
-        config(p, t) {
-            const config = { ...t?.lazy?.config };
-            const url = baseUrl(p, false);
-            if (url)
-                config.base_url = url;
-            const realm = p.credential(REALM);
-            if (realm)
-                config.realm = realm;
-            const client = p.credential(LAZY_CLIENT) ?? p.credential(CLIENT_ID);
-            if (client)
-                config.client_id = client;
-            return config;
-        },
-        secret: { flag: '--keycloak-lazy-client-secret', env: 'KEYCLOAK_LAZY_CLIENT_SECRET', label: 'the secret of that client (confidential clients only)', required: false, secret: true },
-    },
-    codemod: 'keycloak',
-};
-//# sourceMappingURL=plugin.js.map

package/dist/migrate/keycloak/plugin.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/keycloak/plugin.ts"],"names":[],"mappings":";;;AAAA,qCAAgD;AAChD,yCAA0C;AAC1C,yCAAwC;AACxC,iDAAyG;AACzG,+DAAyF;AACzF,qDAAkE;AAGlE;;;;;;;;GAQG;AAEH,MAAM,QAAQ,GAAmB,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,uFAAuF,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAClM,MAAM,KAAK,GAAmB,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC/H,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,6IAA6I,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACrQ,MAAM,aAAa,GAAmB,EAAE,IAAI,EAAE,0BAA0B,EAAE,GAAG,EAAE,wBAAwB,EAAE,KAAK,EAAE,uBAAuB,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACzK,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,yCAAyC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACpK,MAAM,cAAc,GAAmB,EAAE,IAAI,EAAE,2BAA2B,EAAE,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,6BAA6B,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAClL,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,6FAA6F,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACxN,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,yDAAyD,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC7K,MAAM,KAAK,GAAmB,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,8DAA8D,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC1K,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,+CAA+C,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACnK,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,2BAA2B,EAAE,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,6DAA6D,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAEjM,SAAS,QAAQ,CAAC,CAAgB;IAChC,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC;IAC/C,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,eAAe,IAAI,GAAG,KAAK,MAAM;QAAE,MAAM,IAAI,iBAAQ,CAAC,mEAAmE,GAAG,IAAI,CAAC,CAAC;IACjK,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,OAAO,CAAC,CAAgB,EAAE,QAAiB;IAClD,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpD,OAAO,GAAG,CAAC,CAAC,CAAC,IAAA,uBAAY,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7C,CAAC;AAED,SAAS,QAAQ,CAAC,CAAgB,EAAE,KAAa;IAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,EAAE,IAAI,CAAE,CAAC;IAC9B,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,YAAY,GAAG,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IACjD,IAAI,CAAC,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,YAAY,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,iBAAQ,CAAC,oKAAoK,CAAC,CAAC;IAC3L,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;AACtI,CAAC;AAED,kFAAkF;AAClF,SAAS,cAAc,CAAC,CAAgB,EAAE,IAAY;IACpD,MAAM,GAAG,GAAG,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,IAAA,kBAAQ,EAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAA,qBAAW,EAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACpI,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,iBAAQ,CAAC,gDAAgD,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,iBAAQ,CAAC,+BAA+B,IAAI,GAAG,CAAC,CAAC;IAC9E,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAY,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,iBAAQ,CAAC,aAAa,CAAC,uBAAwB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAEY,QAAA,cAAc,GAAoB;IAC7C,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,UAAU;IAClB,KAAK,EAAE,UAAU;IACjB,IAAI,EAAE,oeAAoe;IAC1e,MAAM,EAAE;QACN,KAAK,EAAE,sDAAsD;QAC7D,WAAW,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,CAAC;QAC7G,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YACvC,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,IAAI,GAAG,IAAA,6BAAkB,EAAC,cAAc,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC9E,OAAO,IAAA,yCAAuB,EAAC,IAAI,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;YACpG,CAAC;YACD,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAE,CAAC;YAC1D,MAAM,IAAI,GAAG,IAAA,4BAAiB,EAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;YACnD,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,UAAU,EAAE,GAAG,EAAE,CAAC,IAAA,qCAAmB,EAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YACnG,OAAO,IAAA,yCAAuB,EAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5F,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,8DAA8D;QACrE,WAAW,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,KAAK,CAAC;QACpH,MAAM,EAAE;YACN,yRAAyR;YACzR,8JAA8J;YAC9J,0MAA0M;YAC1M,6JAA6J;YAC7J,0GAA0G;YAC1G,8FAA8F;SAC/F;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YACvC,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAClC,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC;YAC/H,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBAC3C,MAAM,IAAI,iBAAQ,CAAC,iKAAiK,CAAC,CAAC;YACxL,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,UAAU,EAAE,KAAK,IAAI,EAAE,CAClD,IAAI;gBACF,CAAC,CAAC,IAAA,yBAAc,EAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,CAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;gBAC/J,CAAC,CAAC,IAAA,yBAAc,EAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAM,CAAC,EAAE,CAAC,CAC5D,CAAC;YACF,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,UAAU;QAClB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,GAA2B,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAC9B,IAAI,GAAG;gBAAE,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC;YAC7B,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAClC,IAAI,KAAK;gBAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,UAAU;QAClB,MAAM,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,MAAM,GAA2B,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9D,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAC9B,IAAI,GAAG;gBAAE,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC;YAC/B,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAClC,IAAI,KAAK;gBAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;YAChC,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACpE,IAAI,MAAM;gBAAE,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC;YACtC,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,EAAE,EAAE,IAAI,EAAE,+BAA+B,EAAE,GAAG,EAAE,6BAA6B,EAAE,KAAK,EAAE,uDAAuD,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE;KACrL;IACD,OAAO,EAAE,UAAU;CACpB,CAAC"}

package/dist/migrate/kinde/plugin.d.ts

@@ -1,2 +0,0 @@
-import type { MigrationPlugin } from '../framework/plugin';
-export declare const kindePlugin: MigrationPlugin;

package/dist/migrate/kinde/plugin.js

@@ -1,105 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.kindePlugin = void 0;
-const kinde_1 = require("../export/kinde");
-const kinde_descope_config_1 = require("../export/kinde-descope-config");
-const errors_1 = require("../../errors");
-const plugin_kit_1 = require("../export/plugin-kit");
-const vendor_http_1 = require("../export/vendor-http");
-/**
- * `atlas migrate kinde` — Kinde's "All data" export (Settings → Business →
- * Export data: an AES-256-CTR encrypted zip holding users.ndjson with bcrypt
- * hashes and organizations.ndjson; the Key and IV are shown at download),
- * merged with what the Management API adds (identities, organizations,
- * members, roles, permissions, invitations). Kinde has no password grant, so
- * there is no lazy-migration preset: passwords move with the export. The
- * `kinde` bridge preset verifies Kinde's access and ID tokens against the
- * business's JWKS.
- */
-const DOMAIN = { flag: '--kinde-domain', env: 'KINDE_ISSUER_URL', label: 'your Kinde domain (https://example.kinde.com)', required: false };
-const CLIENT_ID = { flag: '--kinde-client-id', env: 'KINDE_M2M_CLIENT_ID', label: 'the client id of a machine-to-machine app authorized for the Kinde Management API', required: false };
-const CLIENT_SECRET = { flag: '--kinde-client-secret', env: 'KINDE_M2M_CLIENT_SECRET', label: 'that app\'s client secret', required: false, secret: true };
-const EXPORT_FILE = { flag: '--kinde-export', env: 'KINDE_EXPORT_FILE', label: 'the Kinde data export (.dat, or the decrypted .zip)', required: false };
-const EXPORT_KEY = { flag: '--kinde-export-key', env: 'KINDE_EXPORT_KEY', label: 'the Key Kinde showed with the export (hex)', required: false, secret: true };
-const EXPORT_IV = { flag: '--kinde-export-iv', env: 'KINDE_EXPORT_IV', label: 'the IV Kinde showed with the export (hex)', required: false };
-function domainOf(p) {
-    const raw = p.credential(DOMAIN) ?? p.ctx.env.KINDE_DOMAIN?.trim();
-    return raw ? (0, plugin_kit_1.hostOf)(raw) : undefined;
-}
-exports.kindePlugin = {
-    vendor: 'kinde',
-    source: 'kinde',
-    label: 'Kinde',
-    help: 'Move a Kinde business: applications, connections, roles, permissions and APIs as Atlas config; users with their bcrypt password hashes from Kinde\'s encrypted data export, plus organizations, members and roles from the Management API (social accounts relink by verified email); a zero-logout bridge for Kinde tokens; and the code. The export key and API credentials stay on this machine.',
-    config: {
-        reads: 'your Kinde business via the Management API (applications, connections, roles, permissions, APIs)',
-        credentials: [DOMAIN, CLIENT_ID, CLIENT_SECRET],
-        async translate(p) {
-            const domain = domainOf(p);
-            if (!domain)
-                throw new errors_1.CliError('Kinde: your Kinde domain is needed (--kinde-domain or KINDE_ISSUER_URL).');
-            const clientId = (0, plugin_kit_1.need)(p, CLIENT_ID);
-            const clientSecret = (0, plugin_kit_1.need)(p, CLIENT_SECRET);
-            const base = `https://${domain}`;
-            let token;
-            const http = new vendor_http_1.VendorHttp({
-                vendor: 'Kinde',
-                baseUrl: `${base}/api/v1`,
-                headers: async () => ({ authorization: `Bearer ${(token ??= await (0, kinde_1.m2mToken)(base, { clientId, clientSecret, fetchImpl: p.fetch }))}` }),
-                fetchImpl: p.fetch,
-            });
-            const snap = await (0, plugin_kit_1.vendorStep)('Kinde', () => (0, kinde_descope_config_1.fetchKindeConfig)(http, domain));
-            return (0, kinde_descope_config_1.translateKindeConfig)(snap);
-        },
-    },
-    export: {
-        reads: 'the Kinde data export (--kinde-export with its Key and IV) and/or the Kinde Management API',
-        credentials: [DOMAIN, CLIENT_ID, CLIENT_SECRET, EXPORT_FILE, EXPORT_KEY, EXPORT_IV],
-        limits: [
-            'Password hashes only come from the "All data" export (Settings → Business → Export data), which the business owner approves; Kinde has no password grant, so without it users set a new password (or sign in with a code / social login).',
-            'MFA secrets and passkeys are not exportable: users enrol again.',
-            'Sessions are not exported: Kinde tokens are JWTs, exchanged by the kinde bridge preset.',
-        ],
-        async run(p, writer, resume) {
-            const file = (0, plugin_kit_1.localFile)(p, EXPORT_FILE, 'bytes');
-            const domain = domainOf(p);
-            const clientId = p.credential(CLIENT_ID);
-            const clientSecret = p.credential(CLIENT_SECRET);
-            if (!file && !(domain && clientId && clientSecret)) {
-                throw new errors_1.CliError('Kinde: pass the data export (--kinde-export with --kinde-export-key and --kinde-export-iv), Management API credentials (KINDE_ISSUER_URL, KINDE_M2M_CLIENT_ID, KINDE_M2M_CLIENT_SECRET), or both.');
-            }
-            let encryptedExport;
-            let zip;
-            if (file) {
-                // A zip (already decrypted) starts with PK\x03\x04; anything else is the encrypted .dat.
-                if (file.length >= 4 && file.readUInt32LE(0) === 0x04034b50)
-                    zip = file;
-                else
-                    encryptedExport = { data: file, key: (0, plugin_kit_1.need)(p, EXPORT_KEY), iv: (0, plugin_kit_1.need)(p, EXPORT_IV) };
-            }
-            const set = await (0, plugin_kit_1.vendorStep)('Kinde', () => (0, kinde_1.exportKinde)({
-                domain,
-                clientId,
-                clientSecret,
-                encryptedExport,
-                zip,
-                includeDefaultOrganization: (0, plugin_kit_1.flag)(p, 'kinde-include-default-org'),
-                fetchImpl: p.fetch,
-                onProgress: (m) => p.say(`  reading ${m}`),
-            }));
-            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
-        },
-    },
-    bridge: {
-        preset: 'kinde',
-        vars(p, t) {
-            const domain = domainOf(p) ?? t?.bridge?.vars.domain;
-            const vars = {};
-            if (domain)
-                vars.domain = domain;
-            return vars;
-        },
-    },
-    codemod: 'kinde',
-};
-//# sourceMappingURL=plugin.js.map

package/dist/migrate/kinde/plugin.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/kinde/plugin.ts"],"names":[],"mappings":";;;AAAA,2CAAwD;AACxD,yEAAwF;AACxF,yCAAwC;AAExC,qDAAiG;AACjG,uDAAmD;AAEnD;;;;;;;;;GASG;AAEH,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,+CAA+C,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC5J,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,mFAAmF,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACzM,MAAM,aAAa,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,2BAA2B,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC3K,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,qDAAqD,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACxK,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,4CAA4C,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC/K,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,2CAA2C,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAE7J,SAAS,QAAQ,CAAC,CAAgB;IAChC,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;IACnE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAA,mBAAM,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACvC,CAAC;AAEY,QAAA,WAAW,GAAoB;IAC1C,MAAM,EAAE,OAAO;IACf,MAAM,EAAE,OAAO;IACf,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,qYAAqY;IAC3Y,MAAM,EAAE;QACN,KAAK,EAAE,kGAAkG;QACzG,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,aAAa,CAAC;QAC/C,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,iBAAQ,CAAC,0EAA0E,CAAC,CAAC;YAC5G,MAAM,QAAQ,GAAG,IAAA,iBAAI,EAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YACpC,MAAM,YAAY,GAAG,IAAA,iBAAI,EAAC,CAAC,EAAE,aAAa,CAAC,CAAC;YAC5C,MAAM,IAAI,GAAG,WAAW,MAAM,EAAE,CAAC;YACjC,IAAI,KAAyB,CAAC;YAC9B,MAAM,IAAI,GAAG,IAAI,wBAAU,CAAC;gBAC1B,MAAM,EAAE,OAAO;gBACf,OAAO,EAAE,GAAG,IAAI,SAAS;gBACzB,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,CAAC,KAAK,KAAK,MAAM,IAAA,gBAAQ,EAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;gBACtI,SAAS,EAAE,CAAC,CAAC,KAAK;aACnB,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAA,uBAAU,EAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAA,uCAAgB,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YAC7E,OAAO,IAAA,2CAAoB,EAAC,IAAI,CAAC,CAAC;QACpC,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,4FAA4F;QACnG,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,CAAC;QACnF,MAAM,EAAE;YACN,2OAA2O;YAC3O,iEAAiE;YACjE,yFAAyF;SAC1F;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,IAAI,GAAG,IAAA,sBAAS,EAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;YAChD,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACzC,MAAM,YAAY,GAAG,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;YACjD,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,QAAQ,IAAI,YAAY,CAAC,EAAE,CAAC;gBACnD,MAAM,IAAI,iBAAQ,CAAC,mMAAmM,CAAC,CAAC;YAC1N,CAAC;YACD,IAAI,eAAsE,CAAC;YAC3E,IAAI,GAAuB,CAAC;YAC5B,IAAI,IAAI,EAAE,CAAC;gBACT,yFAAyF;gBACzF,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,UAAU;oBAAE,GAAG,GAAG,IAAI,CAAC;;oBACnE,eAAe,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;YAC1F,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,OAAO,EAAE,GAAG,EAAE,CACzC,IAAA,mBAAW,EAAC;gBACV,MAAM;gBACN,QAAQ;gBACR,YAAY;gBACZ,eAAe;gBACf,GAAG;gBACH,0BAA0B,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,2BAA2B,CAAC;gBAChE,SAAS,EAAE,CAAC,CAAC,KAAK;gBAClB,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;aAC3C,CAAC,CACH,CAAC;YACF,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,OAAO;QACf,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;YACrD,MAAM,IAAI,GAA2B,EAAE,CAAC;YACxC,IAAI,MAAM;gBAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;YACjC,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD,OAAO,EAAE,OAAO;CACjB,CAAC"}

package/dist/migrate/ldap/plugin.d.ts

@@ -1,2 +0,0 @@
-import type { MigrationPlugin } from '../framework/plugin';
-export declare const ldapPlugin: MigrationPlugin;

package/dist/migrate/ldap/plugin.js

@@ -1,73 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ldapPlugin = void 0;
-const node_path_1 = require("node:path");
-const args_1 = require("../../args");
-const errors_1 = require("../../errors");
-const ldap_1 = require("../export/ldap");
-const plugin_kit_1 = require("../export/plugin-kit");
-/**
- * `atlas migrate ldap export --file dir.ldif` — an LDAP directory (OpenLDAP,
- * 389 DS, PingDirectory, Oracle/Sun DS, Active Directory) from an LDIF export
- * made with the directory's own tools. Users keep a password hash Atlas can
- * verify; the rest move by lazy migration (the `ldap` preset binds to the
- * directory over ldaps:// on the user's first sign-in).
- */
-const GROUPS = { flag: 'ldap-groups', env: 'LDAP_GROUPS', label: 'what groups become: roles (default), organizations or none', required: false };
-const ID_ATTRIBUTE = { flag: 'ldap-id-attribute', env: 'LDAP_ID_ATTRIBUTE', label: 'the attribute used as the user id (entryUUID, nsUniqueId, objectGUID …)', required: false };
-const URL_SPEC = { flag: 'ldap-url', env: 'LDAP_URL', label: 'the directory URL for lazy migration (ldaps://ldap.example.com:636)', required: false };
-const BIND_DN = { flag: 'ldap-bind-dn', env: 'LDAP_BIND_DN', label: 'the service account DN for lazy migration', required: false };
-const BASE_DN = { flag: 'ldap-base-dn', env: 'LDAP_BASE_DN', label: 'the search base for lazy migration', required: false };
-const FILTER = { flag: 'ldap-user-filter', env: 'LDAP_USER_FILTER', label: 'the user search filter with {{username}}', required: false };
-const TRUST = { flag: 'ldap-trust-emails', env: 'LDAP_TRUST_EMAILS', label: 'mark directory addresses verified (true or false)', required: false };
-function file(p) {
-    return (0, args_1.str)(p.args.values, 'file') ?? p.credential({ flag: 'file', env: 'ATLAS_MIGRATE_FILE', label: 'the LDIF file (--file)', required: true });
-}
-exports.ldapPlugin = {
-    vendor: 'ldap',
-    source: 'ldap',
-    label: 'LDAP / Active Directory',
-    help: 'Move a directory: users (mail, uid, names, phones, disabled and locked state, creation and last login), groups as roles or organizations, and every userPassword hash Atlas verifies ({SSHA}, {SMD5}, {PBKDF2-*}, {CRYPT}$6$…, bcrypt, Argon2, …). Export the directory as LDIF first (slapcat, ldifde, export-ldif, dsctl db2ldif); the file is read on this machine. Passwords Atlas cannot verify (Active Directory, DES crypt, pass-through) move by lazy migration against your directory over ldaps://.',
-    export: {
-        reads: 'a local LDIF export of the directory (--file)',
-        credentials: [GROUPS, ID_ATTRIBUTE, TRUST],
-        limits: [
-            'Active Directory never exports password hashes (unicodePwd is write-only): configure lazy migration (preset ldap) so each user moves on their first sign-in.',
-            'Traditional DES {CRYPT} and pass-through schemes ({SASL}) cannot be verified by Atlas: those users move by lazy migration.',
-            'Directory addresses were set by administrators, not confirmed by the users: they import unverified unless --set ldap-trust-emails=true.',
-        ],
-        async run(p, writer, resume) {
-            const path = (0, node_path_1.resolve)(file(p));
-            const { entries, problems } = (0, ldap_1.parseLdif)(p.ctx.readFile(path));
-            if (!entries.length)
-                throw new errors_1.CliError(`No entries found in ${path}: is it an LDIF export?`);
-            const mode = p.credential(GROUPS) ?? 'roles';
-            if (!['roles', 'organizations', 'none'].includes(mode))
-                throw new errors_1.CliError('--set ldap-groups must be roles, organizations or none.');
-            const set = (0, ldap_1.mapLdif)(entries, {
-                groups: mode,
-                idAttribute: p.credential(ID_ATTRIBUTE),
-                trustEmails: p.credential(TRUST) === 'true',
-                origin: `LDIF export ${path}`,
-            });
-            for (const problem of problems.slice(0, 20))
-                set.warn(`LDIF: ${problem}`);
-            p.say(`  read ${entries.length} entries from ${path}`);
-            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
-        },
-    },
-    lazy: {
-        preset: 'ldap',
-        config(p) {
-            const config = {};
-            for (const [key, spec] of [['url', URL_SPEC], ['bind_dn', BIND_DN], ['base_dn', BASE_DN], ['user_filter', FILTER], ['id_attribute', ID_ATTRIBUTE]]) {
-                const v = p.credential(spec);
-                if (v)
-                    config[key] = v;
-            }
-            return config;
-        },
-        secret: { flag: 'ldap-bind-password', env: 'LDAP_BIND_PASSWORD', label: 'the service account password', required: false, secret: true },
-    },
-};
-//# sourceMappingURL=plugin.js.map

package/dist/migrate/ldap/plugin.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/ldap/plugin.ts"],"names":[],"mappings":";;;AAAA,yCAAoC;AACpC,qCAAiC;AACjC,yCAAwC;AACxC,yCAAoD;AACpD,qDAAsD;AAGtD;;;;;;GAMG;AAEH,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,4DAA4D,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACjK,MAAM,YAAY,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,yEAAyE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAChM,MAAM,QAAQ,GAAmB,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,qEAAqE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACtK,MAAM,OAAO,GAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,2CAA2C,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACnJ,MAAM,OAAO,GAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,oCAAoC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC5I,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,0CAA0C,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACzJ,MAAM,KAAK,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,mDAAmD,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAEnK,SAAS,IAAI,CAAC,CAAgB;IAC5B,OAAO,IAAA,UAAG,EAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,wBAAwB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAE,CAAC;AACnJ,CAAC;AAEY,QAAA,UAAU,GAAoB;IACzC,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,MAAM;IACd,KAAK,EAAE,yBAAyB;IAChC,IAAI,EAAE,+eAA+e;IACrf,MAAM,EAAE;QACN,KAAK,EAAE,+CAA+C;QACtD,WAAW,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,CAAC;QAC1C,MAAM,EAAE;YACN,8JAA8J;YAC9J,4HAA4H;YAC5H,yIAAyI;SAC1I;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,IAAI,GAAG,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9B,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAA,gBAAS,EAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,OAAO,CAAC,MAAM;gBAAE,MAAM,IAAI,iBAAQ,CAAC,uBAAuB,IAAI,yBAAyB,CAAC,CAAC;YAC9F,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC;YAC7C,IAAI,CAAC,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,iBAAQ,CAAC,yDAAyD,CAAC,CAAC;YACtI,MAAM,GAAG,GAAG,IAAA,cAAO,EAAC,OAAO,EAAE;gBAC3B,MAAM,EAAE,IAA0C;gBAClD,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC;gBACvC,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,MAAM;gBAC3C,MAAM,EAAE,eAAe,IAAI,EAAE;aAC9B,CAAC,CAAC;YACH,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,SAAS,OAAO,EAAE,CAAC,CAAC;YAC1E,CAAC,CAAC,GAAG,CAAC,UAAU,OAAO,CAAC,MAAM,iBAAiB,IAAI,EAAE,CAAC,CAAC;YACvD,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,MAAM;QACd,MAAM,CAAC,CAAC;YACN,MAAM,MAAM,GAA2B,EAAE,CAAC;YAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,CAAC,cAAc,EAAE,YAAY,CAAC,CAAU,EAAE,CAAC;gBAC5J,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBAC7B,IAAI,CAAC;oBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACzB,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,8BAA8B,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE;KACxI;CACF,CAAC"}

package/dist/migrate/logto/plugin.d.ts

@@ -1,2 +0,0 @@
-import type { MigrationPlugin } from '../framework/plugin';
-export declare const logtoPlugin: MigrationPlugin;

package/dist/migrate/logto/plugin.js

@@ -1,131 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.logtoPlugin = void 0;
-const node_path_1 = require("node:path");
-const errors_1 = require("../../errors");
-const logto_1 = require("../export/logto");
-const logto_config_1 = require("../export/logto-config");
-const tables_1 = require("../export/frameworks/tables");
-const plugin_kit_1 = require("../export/plugin-kit");
-/**
- * `atlas migrate logto` — a Logto tenant (self-hosted or Logto Cloud): the
- * sign-in experience, connectors, applications, API resources and roles as
- * Atlas config; users, social and enterprise identities, organizations,
- * roles, invitations and personal access tokens through the Management API
- * (a machine-to-machine app on this machine) or from a database dump of a
- * self-hosted Logto, which also carries password hashes, TOTP secrets,
- * passkeys and backup codes; the `logto` bridge preset (an ID token verified
- * against the tenant's `/oidc/jwks`); lazy migration through the Management
- * API's password check; and the code.
- */
-const ENDPOINT = { flag: '--logto-endpoint', env: 'LOGTO_ENDPOINT', label: 'your Logto endpoint (https://auth.example.com or https://abc123.logto.app)', required: false };
-const TENANT = { flag: '--logto-tenant-id', env: 'LOGTO_TENANT_ID', label: 'the tenant id (default on a self-hosted Logto; the abc123 of abc123.logto.app on Logto Cloud)', required: false };
-const APP_ID = { flag: '--logto-m2m-app-id', env: 'LOGTO_M2M_APP_ID', label: 'the id of a machine-to-machine app with the Management API role', required: false };
-const APP_SECRET = { flag: '--logto-m2m-app-secret', env: 'LOGTO_M2M_APP_SECRET', label: 'that app\'s secret', required: false, secret: true };
-const DUMP = { flag: '--logto-dump', env: 'LOGTO_DUMP_DIR', label: 'a folder of database table dumps (users.csv, roles.csv, organizations.csv, …)', required: false };
-const CLIENT_ID = { flag: '--logto-client-id', env: 'LOGTO_APP_ID', label: 'the id of your Logto application (the audience of its ID tokens)', required: false };
-const PATS = { flag: '--logto-personal-access-tokens', env: 'LOGTO_PERSONAL_ACCESS_TOKENS', label: 'true, to read each user\'s personal access tokens too (one API call per user)', required: false };
-const RP_ID = { flag: '--rp-id', env: 'ATLAS_MIGRATE_RP_ID', label: 'the WebAuthn relying party id passkeys were registered for', required: false };
-function endpointOf(p, required) {
-    const raw = p.credential({ ...ENDPOINT, required });
-    if (!raw)
-        return undefined;
-    try {
-        return (0, logto_1.normalizeEndpoint)(raw);
-    }
-    catch (err) {
-        throw new errors_1.CliError(`Logto: ${err.message}`);
-    }
-}
-function m2m(p) {
-    const appId = p.credential(APP_ID);
-    const appSecret = p.credential(APP_SECRET);
-    return appId && appSecret ? { appId, appSecret } : undefined;
-}
-function tenantOf(p, endpoint) {
-    return p.credential(TENANT)?.trim() ?? (endpoint ? (0, logto_1.tenantOfEndpoint)(endpoint) : null) ?? 'default';
-}
-exports.logtoPlugin = {
-    vendor: 'logto',
-    source: 'logto',
-    label: 'Logto',
-    help: 'Move a Logto tenant (self-hosted or Logto Cloud): its sign-in experience, connectors, applications, API resources and roles as Atlas config; users, social and enterprise identities, organizations, roles, invitations and personal access tokens through the Management API with a machine-to-machine app (on this machine) or from a database dump, which also carries password hashes, TOTP secrets, passkeys and backup codes; a zero-logout bridge on the tenant\'s ID tokens; lazy migration for passwords you cannot export; and the code.',
-    config: {
-        reads: 'your Logto tenant via the Management API',
-        credentials: [ENDPOINT, TENANT, APP_ID, APP_SECRET],
-        async translate(p) {
-            const endpoint = endpointOf(p, true);
-            const credentials = m2m(p);
-            if (!credentials)
-                throw new errors_1.CliError('Logto: pass the machine-to-machine app id and secret (--set logto-m2m-app-id=… --set logto-m2m-app-secret=…, or LOGTO_M2M_APP_ID / LOGTO_M2M_APP_SECRET).');
-            const tenantId = tenantOf(p, endpoint);
-            const http = (0, logto_1.logtoManagementHttp)({ endpoint, m2m: credentials, tenantId, fetchImpl: p.fetch });
-            return (0, logto_config_1.translateLogtoConfig)(await (0, plugin_kit_1.vendorStep)('Logto', () => (0, logto_config_1.fetchLogtoConfig)(http, endpoint, tenantId)));
-        },
-    },
-    export: {
-        reads: 'the Logto Management API (machine-to-machine app) or a database dump of a self-hosted Logto',
-        credentials: [ENDPOINT, TENANT, APP_ID, APP_SECRET, DUMP, RP_ID, PATS],
-        limits: [
-            'The Management API never returns MFA secrets (TOTP keys, WebAuthn credentials, backup codes): those users enrol again, unless you export from the database of a self-hosted Logto (--set logto-dump=<folder>).',
-            'The Management API does not reliably return password hashes: a database dump of a self-hosted Logto carries them (Argon2, bcrypt, SHA-family and legacy expressions). Logto Cloud tenants, and every user without a hash, move by lazy migration (the logto preset).',
-            'Passkeys move only with the relying-party id they were registered for (--set rp-id=…, or the endpoint host): your Atlas domain must match it.',
-            'Machine-to-machine apps and their secrets are not exported: create Atlas M2M clients.',
-            'Logto sessions are encrypted cookies of your app\'s SDK: the bridge exchanges the ID token inside them (see the guide for the extractor).',
-            'Personal access tokens come over the API one call per user: add --set logto-personal-access-tokens=true.',
-        ],
-        async run(p, writer, resume) {
-            const dumpDir = p.credential(DUMP);
-            const endpoint = endpointOf(p, false);
-            const credentials = m2m(p);
-            if (!dumpDir && !(endpoint && credentials)) {
-                throw new errors_1.CliError('Logto: pass a database dump (--set logto-dump=<folder>), or the endpoint with a machine-to-machine app (--set logto-endpoint=… plus LOGTO_M2M_APP_ID and LOGTO_M2M_APP_SECRET).');
-            }
-            const set = await (0, plugin_kit_1.vendorStep)('Logto', async () => (0, logto_1.exportLogto)({
-                tables: dumpDir ? (0, tables_1.readDumpDir)((0, node_path_1.resolve)(dumpDir)) : undefined,
-                endpoint,
-                m2m: credentials,
-                tenantId: p.credential(TENANT)?.trim(),
-                rpId: p.credential(RP_ID)?.trim(),
-                personalAccessTokens: /^(1|true|yes)$/i.test(p.credential(PATS)?.trim() ?? ''),
-                fetchImpl: p.fetch,
-                onProgress: (m) => p.say(`  reading ${m}`),
-            }));
-            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
-        },
-    },
-    bridge: {
-        preset: 'logto',
-        vars(p, t) {
-            const vars = { ...t?.bridge?.vars };
-            const endpoint = endpointOf(p, false);
-            if (endpoint)
-                vars.base_url = endpoint;
-            const clientId = p.credential(CLIENT_ID);
-            if (clientId)
-                vars.client_id = clientId;
-            return vars;
-        },
-    },
-    lazy: {
-        preset: 'logto',
-        config(p, t) {
-            const config = { ...t?.lazy?.config };
-            const endpoint = endpointOf(p, false);
-            if (endpoint)
-                config.base_url = endpoint;
-            const appId = p.credential(APP_ID);
-            if (appId)
-                config.app_id = appId;
-            const tenant = p.credential(TENANT)?.trim();
-            if (tenant)
-                config.tenant_id = tenant;
-            else if (endpoint && (0, logto_1.tenantOfEndpoint)(endpoint))
-                config.tenant_id = (0, logto_1.tenantOfEndpoint)(endpoint);
-            return config;
-        },
-        secret: APP_SECRET,
-    },
-    codemod: 'logto',
-};
-//# sourceMappingURL=plugin.js.map

package/dist/migrate/logto/plugin.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/logto/plugin.ts"],"names":[],"mappings":";;;AAAA,yCAAoC;AACpC,yCAAwC;AACxC,2CAAwG;AACxG,yDAAgF;AAChF,wDAA0D;AAC1D,qDAAkE;AAGlE;;;;;;;;;;GAUG;AAEH,MAAM,QAAQ,GAAmB,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,4EAA4E,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC3L,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,+FAA+F,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC9M,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,iEAAiE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAClL,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,wBAAwB,EAAE,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC/J,MAAM,IAAI,GAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,+EAA+E,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACtL,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,kEAAkE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACjL,MAAM,IAAI,GAAmB,EAAE,IAAI,EAAE,gCAAgC,EAAE,GAAG,EAAE,8BAA8B,EAAE,KAAK,EAAE,+EAA+E,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACtN,MAAM,KAAK,GAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,4DAA4D,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAEpK,SAAS,UAAU,CAAC,CAAgB,EAAE,QAAiB;IACrD,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,CAAC;QACH,OAAO,IAAA,yBAAiB,EAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,iBAAQ,CAAC,UAAW,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED,SAAS,GAAG,CAAC,CAAgB;IAC3B,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAC3C,OAAO,KAAK,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC;AAED,SAAS,QAAQ,CAAC,CAAgB,EAAE,QAA4B;IAC9D,OAAO,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAA,wBAAgB,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;AACrG,CAAC;AAEY,QAAA,WAAW,GAAoB;IAC1C,MAAM,EAAE,OAAO;IACf,MAAM,EAAE,OAAO;IACf,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,ohBAAohB;IAC1hB,MAAM,EAAE;QACN,KAAK,EAAE,0CAA0C;QACjD,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC;QACnD,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,EAAE,IAAI,CAAE,CAAC;YACtC,MAAM,WAAW,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,CAAC,WAAW;gBAAE,MAAM,IAAI,iBAAQ,CAAC,2JAA2J,CAAC,CAAC;YAClM,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YACvC,MAAM,IAAI,GAAG,IAAA,2BAAmB,EAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YAC/F,OAAO,IAAA,mCAAoB,EAAC,MAAM,IAAA,uBAAU,EAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAA,+BAAgB,EAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC3G,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,6FAA6F;QACpG,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC;QACtE,MAAM,EAAE;YACN,gNAAgN;YAChN,sQAAsQ;YACtQ,+IAA+I;YAC/I,uFAAuF;YACvF,2IAA2I;YAC3I,0GAA0G;SAC3G;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,OAAO,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACnC,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YACtC,MAAM,WAAW,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,IAAI,WAAW,CAAC,EAAE,CAAC;gBAC3C,MAAM,IAAI,iBAAQ,CAAC,iLAAiL,CAAC,CAAC;YACxM,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,OAAO,EAAE,KAAK,IAAI,EAAE,CAC/C,IAAA,mBAAW,EAAC;gBACV,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,IAAA,oBAAW,EAAC,IAAA,mBAAO,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC3D,QAAQ;gBACR,GAAG,EAAE,WAAW;gBAChB,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE;gBACtC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE;gBACjC,oBAAoB,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;gBAC9E,SAAS,EAAE,CAAC,CAAC,KAAK;gBAClB,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;aAC3C,CAAC,CACH,CAAC;YACF,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,OAAO;QACf,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,GAA2B,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC5D,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YACtC,IAAI,QAAQ;gBAAE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;YACvC,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,QAAQ;gBAAE,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;YACxC,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,OAAO;QACf,MAAM,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,MAAM,GAA2B,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9D,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YACtC,IAAI,QAAQ;gBAAE,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;YACzC,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACnC,IAAI,KAAK;gBAAE,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC;YACjC,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;YAC5C,IAAI,MAAM;gBAAE,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC;iBACjC,IAAI,QAAQ,IAAI,IAAA,wBAAgB,EAAC,QAAQ,CAAC;gBAAE,MAAM,CAAC,SAAS,GAAG,IAAA,wBAAgB,EAAC,QAAQ,CAAE,CAAC;YAChG,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,EAAE,UAAU;KACnB;IACD,OAAO,EAAE,OAAO;CACjB,CAAC"}

package/dist/migrate/magic/plugin.d.ts

@@ -1,2 +0,0 @@
-import type { MigrationPlugin } from '../framework/plugin';
-export declare const magicPlugin: MigrationPlugin;

package/dist/migrate/magic/plugin.js

@@ -1,56 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.magicPlugin = void 0;
-const magic_1 = require("../export/magic");
-const magic_config_1 = require("../export/magic-config");
-const plugin_kit_1 = require("../export/plugin-kit");
-/**
- * `atlas migrate magic` — users from the export file in your Magic dashboard
- * (Magic has no API to list users), their issuers from an optional email →
- * issuer file, and the `magic` bridge preset (DID tokens verified against the
- * signer's own key and your client id). Magic holds no passwords.
- */
-const USERS_FILE = { flag: '--magic-users-file', env: 'MAGIC_USERS_FILE', label: 'the user export file from your Magic dashboard (CSV)', required: true };
-const ISSUERS_FILE = { flag: '--magic-issuers-file', env: 'MAGIC_ISSUERS_FILE', label: 'a file mapping each email to its Magic issuer (did:ethr:…)', required: false };
-const CLIENT_ID = { flag: '--magic-client-id', env: 'MAGIC_CLIENT_ID', label: 'your Magic client id (did:magic:…)', required: false };
-function clientId(p) {
-    return p.credential(CLIENT_ID) ?? (p.ctx.env.NEXT_PUBLIC_MAGIC_CLIENT_ID?.trim() || undefined);
-}
-exports.magicPlugin = {
-    vendor: 'magic',
-    source: 'magic',
-    label: 'Magic (magic.link)',
-    help: 'Move a Magic (magic.link) app: users from the export file in your Magic dashboard, with verified emails and, when you have them, Magic issuers so the zero-logout bridge recognises each person\'s current DID token; email code and link sign-in as Atlas config; and the code. Magic has no user-listing API, so no Magic secret key is needed.',
-    config: {
-        reads: 'nothing from Magic (it has no settings API): the translation lists where each Magic setting lives',
-        credentials: [CLIENT_ID],
-        async translate(p) {
-            return (0, magic_config_1.translateMagicConfig)({ ...(clientId(p) ? { clientId: clientId(p) } : {}) });
-        },
-    },
-    export: {
-        reads: 'the Magic dashboard user export (--magic-users-file) and an optional email → issuer file (--magic-issuers-file)',
-        credentials: [USERS_FILE, ISSUERS_FILE],
-        limits: [
-            'Magic has no API to list users: export them from the Magic dashboard (Users → Export) and pass that file with --magic-users-file.',
-            'The dashboard export has no issuers. Users without one are imported by email and sign in with an email code; give an email → issuer file (--magic-issuers-file) to keep their current sessions alive through the bridge.',
-            'Magic holds no passwords. Embedded wallet keys cannot be exported: users export them from Magic themselves.',
-        ],
-        async run(p, writer, resume) {
-            const usersText = (0, plugin_kit_1.localFile)(p, USERS_FILE, 'text');
-            if (usersText === undefined)
-                (0, plugin_kit_1.need)(p, USERS_FILE);
-            const set = await (0, plugin_kit_1.vendorStep)('Magic', async () => (0, magic_1.exportMagic)({ usersText: usersText, issuersText: (0, plugin_kit_1.localFile)(p, ISSUERS_FILE, 'text'), onProgress: (m) => p.say(`  reading ${m}`) }));
-            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
-        },
-    },
-    bridge: {
-        preset: 'magic',
-        vars(p, t) {
-            const id = t?.bridge?.vars.client_id ?? clientId(p);
-            return id ? { ...t?.bridge?.vars, client_id: id } : { ...t?.bridge?.vars };
-        },
-    },
-    codemod: 'magic',
-};
-//# sourceMappingURL=plugin.js.map

package/dist/migrate/magic/plugin.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/magic/plugin.ts"],"names":[],"mappings":";;;AAAA,2CAA8C;AAC9C,yDAA8D;AAE9D,qDAAmF;AAEnF;;;;;GAKG;AAEH,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,sDAAsD,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC1K,MAAM,YAAY,GAAmB,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,4DAA4D,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACvL,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,oCAAoC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAEtJ,SAAS,QAAQ,CAAC,CAAgB;IAChC,OAAO,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC,CAAC;AACjG,CAAC;AAEY,QAAA,WAAW,GAAoB;IAC1C,MAAM,EAAE,OAAO;IACf,MAAM,EAAE,OAAO;IACf,KAAK,EAAE,oBAAoB;IAC3B,IAAI,EAAE,mVAAmV;IACzV,MAAM,EAAE;QACN,KAAK,EAAE,mGAAmG;QAC1G,WAAW,EAAE,CAAC,SAAS,CAAC;QACxB,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,OAAO,IAAA,mCAAoB,EAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,iHAAiH;QACxH,WAAW,EAAE,CAAC,UAAU,EAAE,YAAY,CAAC;QACvC,MAAM,EAAE;YACN,mIAAmI;YACnI,0NAA0N;YAC1N,6GAA6G;SAC9G;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,SAAS,GAAG,IAAA,sBAAS,EAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;YACnD,IAAI,SAAS,KAAK,SAAS;gBAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,UAAU,CAAC,CAAC;YACjD,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,IAAA,mBAAW,EAAC,EAAE,SAAS,EAAE,SAAU,EAAE,WAAW,EAAE,IAAA,sBAAS,EAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YACvL,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,OAAO;QACf,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC;YACpD,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC7E,CAAC;KACF;IACD,OAAO,EAAE,OAAO;CACjB,CAAC"}

package/dist/migrate/nhost/plugin.d.ts

@@ -1,2 +0,0 @@
-import type { MigrationPlugin } from '../framework/plugin';
-export declare const nhostPlugin: MigrationPlugin;