@atlasauth/cli 0.24.0 → 0.25.0

package/dist/migrate/azure-ad-b2c/plugin.js

@@ -1,165 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.azureAdB2cPlugin = void 0;
-exports.readPolicyDir = readPolicyDir;
-exports.azurePlugin = azurePlugin;
-const node_fs_1 = require("node:fs");
-const node_path_1 = require("node:path");
-const azure_1 = require("../export/azure");
-const azure_config_1 = require("../export/azure-config");
-const errors_1 = require("../../errors");
-const project_files_1 = require("../export/project-files");
-const plugin_kit_1 = require("../export/plugin-kit");
-/**
- * `atlas migrate azure-ad-b2c` and (through {@link azurePlugin})
- * `atlas migrate entra-external-id` — a Microsoft customer-identity tenant
- * through Microsoft Graph with an app registration the owner creates
- * (client credentials). Users keyed by their object id with sign-in
- * identities, federated links, custom attributes, groups and SMS / email
- * factors; identity providers, user flows, custom policies (B2C), app
- * registrations and groups as Atlas config; the JWT bridge preset; lazy
- * migration (B2C ROPC user flow, External ID native authentication) — Graph
- * never returns a password. The client secret is sent to Microsoft only.
- */
-const TENANT = { flag: '--azure-tenant', env: 'AZURE_TENANT_ID', label: 'the tenant id (GUID) or domain (contoso.onmicrosoft.com)', required: true };
-const CLIENT_ID = { flag: '--azure-client-id', env: 'AZURE_CLIENT_ID', label: 'the client id of an app registration with Graph User.Read.All (application)', required: false };
-const CLIENT_SECRET = { flag: '--azure-client-secret', env: 'AZURE_CLIENT_SECRET', label: 'that app registration\'s client secret', required: false, secret: true };
-const ACCESS_TOKEN = { flag: '--azure-graph-token', env: 'AZURE_GRAPH_TOKEN', label: 'a Microsoft Graph access token, instead of client credentials', required: false, secret: true };
-const AUTH_METHODS = { flag: '--azure-auth-methods', env: 'AZURE_EXPORT_AUTH_METHODS', label: 'true to read each user\'s phone / email MFA methods (UserAuthenticationMethod.Read.All)', required: false };
-const DIRECTORY_USERS = { flag: '--azure-directory-users', env: 'AZURE_EXPORT_DIRECTORY_USERS', label: 'true to also export admin / work accounts', required: false };
-const GROUPS_AS = { flag: '--groups-as', env: 'ATLAS_MIGRATE_GROUPS_AS', label: 'how groups move: roles or skip', required: false };
-const POLICY_DIR = { flag: '--b2c-policy-dir', env: 'B2C_POLICY_DIR', label: 'a folder with your B2C custom policy XML files (TrustFrameworkBase.xml, …)', required: false };
-const APP_CLIENT_ID = { flag: '--azure-app-client-id', env: 'AZURE_APP_CLIENT_ID', label: 'your app\'s client id (the ID token audience; for lazy migration a public client)', required: false };
-const SIGN_IN_POLICY = { flag: '--b2c-policy', env: 'B2C_POLICY', label: 'the user flow / custom policy that issued your users\' tokens (B2C_1_signupsignin)', required: false };
-const ROPC_CLIENT_ID = { flag: '--b2c-ropc-client-id', env: 'B2C_ROPC_CLIENT_ID', label: 'the public client registration the ROPC user flow signs in with, when it is not your app\'s client id', required: false };
-const ROPC_POLICY = { flag: '--b2c-ropc-policy', env: 'B2C_ROPC_POLICY', label: 'the ROPC user flow lazy migration checks passwords with (B2C_1_ROPC_Auth)', required: false };
-const CUSTOM_DOMAIN = { flag: '--azure-custom-domain', env: 'AZURE_CUSTOM_DOMAIN', label: 'a custom domain in front of b2clogin.com / ciamlogin.com', required: false };
-function graph(p) {
-    const tenant = (0, plugin_kit_1.need)(p, TENANT).trim();
-    const accessToken = p.credential(ACCESS_TOKEN);
-    const clientId = p.credential(CLIENT_ID);
-    const clientSecret = p.credential(CLIENT_SECRET);
-    if (!accessToken && !(clientId && clientSecret)) {
-        throw new errors_1.CliError('Microsoft Graph: pass an app registration\'s client id and secret (AZURE_CLIENT_ID, AZURE_CLIENT_SECRET) with the User.Read.All application permission, or a Graph access token (AZURE_GRAPH_TOKEN).');
-    }
-    return { tenant, accessToken, clientId, clientSecret };
-}
-/** The B2C custom policy files of a folder (`*.xml`), for the config report. */
-function readPolicyDir(dir) {
-    const root = (0, node_path_1.resolve)(dir);
-    let names;
-    try {
-        names = (0, node_fs_1.readdirSync)(root);
-    }
-    catch (err) {
-        throw new errors_1.CliError(`Could not read the custom policy folder ${dir}: ${err.message}`);
-    }
-    return names
-        .filter((n) => n.toLowerCase().endsWith('.xml') && (0, node_fs_1.statSync)((0, node_path_1.join)(root, n)).isFile())
-        .sort()
-        .map((n) => ({ file: (0, node_path_1.basename)(n), text: (0, node_fs_1.readFileSync)((0, node_path_1.join)(root, n), 'utf8') }));
-}
-/** Tenant name of a domain argument (`contoso.onmicrosoft.com` → `contoso`), or undefined for a GUID. */
-function tenantNameOf(raw) {
-    const m = raw ? /^([a-z0-9-]+)\.(onmicrosoft|b2clogin|ciamlogin)\.com$/i.exec(raw.trim()) : null;
-    return m ? m[1].toLowerCase() : undefined;
-}
-const GUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-/** The plugin for one of the two Microsoft customer-identity products. */
-function azurePlugin(kind) {
-    const b2c = kind === 'b2c';
-    const label = b2c ? 'Azure AD B2C' : 'Microsoft Entra External ID';
-    const preset = b2c ? 'azure_ad_b2c' : 'entra_external_id';
-    const commonVars = (p, base) => {
-        const out = { ...base };
-        const tenant = p.credential({ ...TENANT, required: false })?.trim();
-        const name = tenantNameOf(tenant);
-        if (name)
-            out.tenant = name;
-        if (tenant && GUID.test(tenant))
-            out.tenant_id = tenant.toLowerCase();
-        const clientId = p.credential(APP_CLIENT_ID);
-        if (clientId)
-            out.client_id = clientId;
-        return out;
-    };
-    return {
-        vendor: b2c ? 'azure-ad-b2c' : 'entra-external-id',
-        source: preset,
-        label,
-        help: b2c
-            ? 'Move an Azure AD B2C tenant: identity providers, user flows, custom policies (with file and line), custom attributes, app registrations and groups as Atlas config; consumer users keyed by object id with their sign-in names, social links, custom attributes, groups and SMS / email factors; a zero-logout bridge for B2C ID tokens; lazy migration through a ROPC user flow (Graph never returns passwords); and the MSAL code. Your app registration secret stays on this machine.'
-            : 'Move a Microsoft Entra External ID (external) tenant: identity providers, sign-up / sign-in flows, custom attributes, app registrations and groups as Atlas config; customers keyed by object id with their sign-in identities, social links, custom attributes, groups and SMS / email factors; a zero-logout bridge for External ID ID tokens; lazy migration through the native authentication API (Graph never returns passwords); and the MSAL code. Your app registration secret stays on this machine.',
-        config: {
-            reads: `your ${label} tenant via Microsoft Graph${b2c ? ' (and your custom policy files with --b2c-policy-dir)' : ''}`,
-            credentials: [TENANT, CLIENT_ID, CLIENT_SECRET, ACCESS_TOKEN, ...(b2c ? [POLICY_DIR] : [])],
-            async translate(p) {
-                const g = graph(p);
-                const dir = b2c ? p.credential(POLICY_DIR) : undefined;
-                const policies = dir ? readPolicyDir(dir) : [];
-                const snap = await (0, plugin_kit_1.vendorStep)(label, () => (0, azure_config_1.fetchAzureConfig)((0, azure_1.graphHttp)({ ...g, fetchImpl: p.fetch }), kind, g.tenant, policies));
-                return (0, azure_config_1.translateAzureConfig)(snap);
-            },
-        },
-        export: {
-            reads: 'Microsoft Graph (users with their identities and extension attributes, groups, authentication methods)',
-            credentials: [TENANT, CLIENT_ID, CLIENT_SECRET, ACCESS_TOKEN, AUTH_METHODS, DIRECTORY_USERS],
-            limits: [
-                `${label} never returns passwords: Graph's password field is write-only. Every password moves by lazy migration, ${b2c ? 'through a ROPC user flow' : 'through the native authentication API'}, on the user's first Atlas sign-in.`,
-                'Authenticator-app (software OATH) secrets and FIDO2 keys are never exported: those users enrol again. SMS and email methods move with --set azure-auth-methods=true.',
-                'Sessions are not exported: the bridge exchanges the ID token your app holds (MSAL caches up to v3 are read in the browser; v4 caches are encrypted).',
-                ...(b2c ? ['Federated identities that Graph keeps only as an alternativeSecurityId cannot be linked by id: those users relink by verified email on first sign-in.'] : []),
-            ],
-            async run(p, writer, resume) {
-                const g = graph(p);
-                const groups = p.credential(GROUPS_AS) ?? 'roles';
-                if (groups !== 'roles' && groups !== 'skip')
-                    throw new errors_1.CliError(`${label}: --groups-as must be roles or skip (got ${groups}).`);
-                const set = await (0, plugin_kit_1.vendorStep)(label, () => (0, azure_1.exportAzure)({
-                    kind,
-                    ...g,
-                    authMethods: (0, project_files_1.truthyCredential)(p, AUTH_METHODS),
-                    includeDirectoryUsers: (0, project_files_1.truthyCredential)(p, DIRECTORY_USERS),
-                    groups,
-                    fetchImpl: p.fetch,
-                    onProgress: (m) => p.say(`  reading ${m}`),
-                }));
-                await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
-            },
-        },
-        bridge: {
-            preset,
-            vars(p, t) {
-                const vars = commonVars(p, t?.bridge?.vars);
-                if (b2c) {
-                    const policy = p.credential(SIGN_IN_POLICY);
-                    if (policy)
-                        vars.policy = policy;
-                }
-                return vars;
-            },
-        },
-        lazy: {
-            preset,
-            config(p, t) {
-                const config = commonVars(p, t?.lazy?.config);
-                delete config.tenant_id;
-                if (b2c) {
-                    const policy = p.credential(ROPC_POLICY);
-                    if (policy)
-                        config.policy = policy;
-                    const ropcClient = p.credential(ROPC_CLIENT_ID);
-                    if (ropcClient)
-                        config.client_id = ropcClient;
-                }
-                const domain = p.credential(CUSTOM_DOMAIN);
-                if (domain)
-                    config.custom_domain = domain;
-                return config;
-            },
-        },
-        codemod: b2c ? 'azure-ad-b2c' : 'entra-external-id',
-    };
-}
-exports.azureAdB2cPlugin = azurePlugin('b2c');
-//# sourceMappingURL=plugin.js.map

package/dist/migrate/azure-ad-b2c/plugin.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/azure-ad-b2c/plugin.ts"],"names":[],"mappings":";;;AA+CA,sCAYC;AAWD,kCAwFC;AA9JD,qCAA8D;AAC9D,yCAAoD;AACpD,2CAAyE;AACzE,yDAA0G;AAC1G,yCAAwC;AACxC,2DAA2D;AAE3D,qDAAwE;AAExE;;;;;;;;;;GAUG;AAEH,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,0DAA0D,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACrK,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,6EAA6E,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC/L,MAAM,aAAa,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,wCAAwC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACpL,MAAM,YAAY,GAAmB,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,+DAA+D,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACtM,MAAM,YAAY,GAAmB,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,2BAA2B,EAAE,KAAK,EAAE,yFAAyF,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC3N,MAAM,eAAe,GAAmB,EAAE,IAAI,EAAE,yBAAyB,EAAE,GAAG,EAAE,8BAA8B,EAAE,KAAK,EAAE,2CAA2C,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACtL,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,gCAAgC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACpJ,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,4EAA4E,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC7L,MAAM,aAAa,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,mFAAmF,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACjN,MAAM,cAAc,GAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,oFAAoF,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACjM,MAAM,cAAc,GAAmB,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,uGAAuG,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACpO,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,2EAA2E,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC/L,MAAM,aAAa,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,0DAA0D,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAExL,SAAS,KAAK,CAAC,CAAgB;IAC7B,MAAM,MAAM,GAAG,IAAA,iBAAI,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,MAAM,WAAW,GAAG,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,YAAY,GAAG,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IACjD,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,QAAQ,IAAI,YAAY,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,iBAAQ,CAAC,sMAAsM,CAAC,CAAC;IAC7N,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AACzD,CAAC;AAED,gFAAgF;AAChF,SAAgB,aAAa,CAAC,GAAW;IACvC,MAAM,IAAI,GAAG,IAAA,mBAAO,EAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,IAAA,qBAAW,EAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,iBAAQ,CAAC,2CAA2C,GAAG,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,KAAK;SACT,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAA,kBAAQ,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACnF,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAA,oBAAQ,EAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,yGAAyG;AACzG,SAAS,YAAY,CAAC,GAAuB;IAC3C,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,wDAAwD,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7C,CAAC;AAED,MAAM,IAAI,GAAG,iEAAiE,CAAC;AAE/E,0EAA0E;AAC1E,SAAgB,WAAW,CAAC,IAAe;IACzC,MAAM,GAAG,GAAG,IAAI,KAAK,KAAK,CAAC;IAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,6BAA6B,CAAC;IACnE,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,mBAAmB,CAAC;IAC1D,MAAM,UAAU,GAAG,CAAC,CAAgB,EAAE,IAAwC,EAA0B,EAAE;QACxG,MAAM,GAAG,GAA2B,EAAE,GAAG,IAAI,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;QACpE,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,IAAI;YAAE,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC;QAC5B,IAAI,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,GAAG,CAAC,SAAS,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QACtE,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QAC7C,IAAI,QAAQ;YAAE,GAAG,CAAC,SAAS,GAAG,QAAQ,CAAC;QACvC,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IACF,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,mBAAmB;QAClD,MAAM,EAAE,MAAM;QACd,KAAK;QACL,IAAI,EAAE,GAAG;YACP,CAAC,CAAC,0dAA0d;YAC5d,CAAC,CAAC,+eAA+e;QACnf,MAAM,EAAE;YACN,KAAK,EAAE,QAAQ,KAAK,8BAA8B,GAAG,CAAC,CAAC,CAAC,uDAAuD,CAAC,CAAC,CAAC,EAAE,EAAE;YACtH,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC3F,KAAK,CAAC,SAAS,CAAC,CAAC;gBACf,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACnB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACvD,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,GAAG,MAAM,IAAA,uBAAU,EAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAA,+BAAgB,EAAC,IAAA,iBAAS,EAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;gBAChI,OAAO,IAAA,mCAAoB,EAAC,IAAI,CAAC,CAAC;YACpC,CAAC;SACF;QACD,MAAM,EAAE;YACN,KAAK,EAAE,wGAAwG;YAC/G,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,eAAe,CAAC;YAC5F,MAAM,EAAE;gBACN,GAAG,KAAK,2GAA2G,GAAG,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,uCAAuC,sCAAsC;gBACnO,sKAAsK;gBACtK,sJAAsJ;gBACtJ,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,uJAAuJ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1K;YACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;gBACzB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACnB,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC;gBAClD,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,MAAM;oBAAE,MAAM,IAAI,iBAAQ,CAAC,GAAG,KAAK,4CAA4C,MAAM,IAAI,CAAC,CAAC;gBAChI,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,KAAK,EAAE,GAAG,EAAE,CACvC,IAAA,mBAAW,EAAC;oBACV,IAAI;oBACJ,GAAG,CAAC;oBACJ,WAAW,EAAE,IAAA,gCAAgB,EAAC,CAAC,EAAE,YAAY,CAAC;oBAC9C,qBAAqB,EAAE,IAAA,gCAAgB,EAAC,CAAC,EAAE,eAAe,CAAC;oBAC3D,MAAM;oBACN,SAAS,EAAE,CAAC,CAAC,KAAK;oBAClB,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;iBAC3C,CAAC,CACH,CAAC;gBACF,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;YACnD,CAAC;SACF;QACD,MAAM,EAAE;YACN,MAAM;YACN,IAAI,CAAC,CAAC,EAAE,CAAC;gBACP,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;gBAC5C,IAAI,GAAG,EAAE,CAAC;oBACR,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;oBAC5C,IAAI,MAAM;wBAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;gBACnC,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;SACF;QACD,IAAI,EAAE;YACJ,MAAM;YACN,MAAM,CAAC,CAAC,EAAE,CAAC;gBACT,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;gBAC9C,OAAO,MAAM,CAAC,SAAS,CAAC;gBACxB,IAAI,GAAG,EAAE,CAAC;oBACR,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;oBACzC,IAAI,MAAM;wBAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;oBACnC,MAAM,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;oBAChD,IAAI,UAAU;wBAAE,MAAM,CAAC,SAAS,GAAG,UAAU,CAAC;gBAChD,CAAC;gBACD,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;gBAC3C,IAAI,MAAM;oBAAE,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC;gBAC1C,OAAO,MAAM,CAAC;YAChB,CAAC;SACF;QACD,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,mBAAmB;KACpD,CAAC;AACJ,CAAC;AAEY,QAAA,gBAAgB,GAAoB,WAAW,CAAC,KAAK,CAAC,CAAC"}

package/dist/migrate/better-auth/integration.d.ts

@@ -1,59 +0,0 @@
-import { type BetterAuthImport, type BetterAuthImportOptions } from '@atlasauth/backend';
-import type { ConfigHttp } from '../../config-http';
-/**
- * Every call the Better Auth migration makes into the import and session-bridge
- * APIs lives in this one module:
- *
- *  - the export/import pair: the `@atlasauth/better-auth-migrate` exporter seals
- *    a bundle to the instance's import key (`GET /v1/better_auth_imports/public_key`),
- *    which is uploaded in line-split parts, finalized (which runs the dry run)
- *    and applied under `/v1/better_auth_imports`, and
- *  - the session bridge (`/v1/migrations/better_auth/bridge`), which lets a live
- *    Better Auth session become an Atlas session during the cutover window.
- */
-/** The exporter's documented command line. */
-export declare const EXPORTER_BIN = "atlas-better-auth-export";
-export declare const EXPORTER_PACKAGE = "@atlasauth/better-auth-migrate";
-/** `publicKey` is the key's compact `kid:public_key` form. */
-export declare function exporterCommand(opts: {
-    out: string;
-    publicKey: string;
-}): {
-    cmd: string;
-    args: string[];
-    display: string;
-};
-/** The import key the exporter seals the bundle to (the private half stays with Atlas), as `kid:public_key`. */
-export declare function getImportPublicKey(http: ConfigHttp): Promise<string>;
-export type ImportJob = BetterAuthImport;
-/** Statuses an import rests in; anything else is still being worked on. */
-export declare const RESTING_STATUSES: readonly string[];
-/**
- * Upload a sealed bundle: create the import, send it in line-split parts of at
- * most 8 MiB, then finalize (which checks the parts and the key and runs the
- * dry run; a large bundle comes back `analyzing` and finishes in the background).
- */
-export declare function uploadBundle(http: ConfigHttp, opts: {
-    bundle: string;
-    options?: BetterAuthImportOptions;
-    onPart?: (n: number, of: number) => void;
-}): Promise<ImportJob>;
-export declare function getImport(http: ConfigHttp, id: string): Promise<ImportJob>;
-/** Finalize an import whose upload finished but was never finalized. */
-export declare function finalizeImport(http: ConfigHttp, id: string): Promise<ImportJob>;
-/** Apply a dry-run-ready import, or resume a failed one from where it stopped. */
-export declare function applyImport(http: ConfigHttp, id: string, opts: {
-    confirmConflicts: boolean;
-}): Promise<ImportJob>;
-export interface BridgeSettings {
-    /** Better Auth's `advanced.cookiePrefix` (default `better-auth`). */
-    cookiePrefix: string;
-    /** When the bridge stops accepting Better Auth sessions (epoch ms). */
-    endsAt: number;
-}
-/**
- * Turn the Better Auth session bridge on for a window. The old app's Better
- * Auth secret is stored write-only so Atlas can check the cookie signature
- * (the live fallback to the old app stays off unless set up separately).
- */
-export declare function enableSessionBridge(http: ConfigHttp, settings: BridgeSettings, secret: string): Promise<void>;

package/dist/migrate/better-auth/integration.js

@@ -1,81 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.RESTING_STATUSES = exports.EXPORTER_PACKAGE = exports.EXPORTER_BIN = void 0;
-exports.exporterCommand = exporterCommand;
-exports.getImportPublicKey = getImportPublicKey;
-exports.uploadBundle = uploadBundle;
-exports.getImport = getImport;
-exports.finalizeImport = finalizeImport;
-exports.applyImport = applyImport;
-exports.enableSessionBridge = enableSessionBridge;
-const backend_1 = require("@atlasauth/backend");
-/**
- * Every call the Better Auth migration makes into the import and session-bridge
- * APIs lives in this one module:
- *
- *  - the export/import pair: the `@atlasauth/better-auth-migrate` exporter seals
- *    a bundle to the instance's import key (`GET /v1/better_auth_imports/public_key`),
- *    which is uploaded in line-split parts, finalized (which runs the dry run)
- *    and applied under `/v1/better_auth_imports`, and
- *  - the session bridge (`/v1/migrations/better_auth/bridge`), which lets a live
- *    Better Auth session become an Atlas session during the cutover window.
- */
-/** The exporter's documented command line. */
-exports.EXPORTER_BIN = 'atlas-better-auth-export';
-exports.EXPORTER_PACKAGE = '@atlasauth/better-auth-migrate';
-/** `publicKey` is the key's compact `kid:public_key` form. */
-function exporterCommand(opts) {
-    const args = ['--yes', exports.EXPORTER_BIN, '--out', opts.out, '--public-key', opts.publicKey];
-    return { cmd: 'npx', args, display: `npx ${exports.EXPORTER_BIN} --out ${opts.out} --public-key ${opts.publicKey}` };
-}
-/** The import key the exporter seals the bundle to (the private half stays with Atlas), as `kid:public_key`. */
-async function getImportPublicKey(http) {
-    const key = await http.get('/v1/better_auth_imports/public_key');
-    if (!key?.compact)
-        throw new Error('The instance did not return an import key.');
-    return key.compact;
-}
-/** Statuses an import rests in; anything else is still being worked on. */
-exports.RESTING_STATUSES = ['uploading', 'ready', 'invalid', 'completed', 'failed'];
-const importPath = (id, sub = '') => `/v1/better_auth_imports/${encodeURIComponent(id)}${sub}`;
-/**
- * Upload a sealed bundle: create the import, send it in line-split parts of at
- * most 8 MiB, then finalize (which checks the parts and the key and runs the
- * dry run; a large bundle comes back `analyzing` and finishes in the background).
- */
-async function uploadBundle(http, opts) {
-    const parts = (0, backend_1.splitBundleParts)(opts.bundle);
-    if (parts.length === 0)
-        throw new Error('The bundle is empty.');
-    const created = await http.post('/v1/better_auth_imports', opts.options ? { options: opts.options } : {});
-    for (let i = 0; i < parts.length; i++) {
-        await http.put(importPath(created.id, `/parts/${i + 1}`), { data: parts[i] });
-        opts.onPart?.(i + 1, parts.length);
-    }
-    return http.post(importPath(created.id, '/finalize'), {});
-}
-async function getImport(http, id) {
-    return http.get(importPath(id));
-}
-/** Finalize an import whose upload finished but was never finalized. */
-async function finalizeImport(http, id) {
-    return http.post(importPath(id, '/finalize'), {});
-}
-/** Apply a dry-run-ready import, or resume a failed one from where it stopped. */
-async function applyImport(http, id, opts) {
-    return http.post(importPath(id, '/apply'), opts.confirmConflicts ? { confirm_conflicts: true } : {});
-}
-/**
- * Turn the Better Auth session bridge on for a window. The old app's Better
- * Auth secret is stored write-only so Atlas can check the cookie signature
- * (the live fallback to the old app stays off unless set up separately).
- */
-async function enableSessionBridge(http, settings, secret) {
-    await http.put('/v1/migrations/better_auth/bridge', {
-        enabled: true,
-        ends_at: settings.endsAt,
-        cookie_prefix: settings.cookiePrefix,
-        live_fallback: { secret },
-    });
-}
-//# sourceMappingURL=integration.js.map

package/dist/migrate/better-auth/integration.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"integration.js","sourceRoot":"","sources":["../../../src/migrate/better-auth/integration.ts"],"names":[],"mappings":";;;AAoBA,0CAGC;AAGD,gDAIC;AAcD,oCAYC;AAED,8BAEC;AAGD,wCAEC;AAGD,kCAEC;AAcD,kDAOC;AA3FD,gDAAqI;AAGrI;;;;;;;;;;GAUG;AAEH,8CAA8C;AACjC,QAAA,YAAY,GAAG,0BAA0B,CAAC;AAC1C,QAAA,gBAAgB,GAAG,gCAAgC,CAAC;AAEjE,8DAA8D;AAC9D,SAAgB,eAAe,CAAC,IAAwC;IACtE,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,oBAAY,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACxF,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,oBAAY,UAAU,IAAI,CAAC,GAAG,iBAAiB,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;AAC/G,CAAC;AAED,gHAAgH;AACzG,KAAK,UAAU,kBAAkB,CAAC,IAAgB;IACvD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAsB,oCAAoC,CAAC,CAAC;IACtF,IAAI,CAAC,GAAG,EAAE,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IACjF,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAID,2EAA2E;AAC9D,QAAA,gBAAgB,GAAsB,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;AAE5G,MAAM,UAAU,GAAG,CAAC,EAAU,EAAE,GAAG,GAAG,EAAE,EAAE,EAAE,CAAC,2BAA2B,kBAAkB,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC;AAEvG;;;;GAIG;AACI,KAAK,UAAU,YAAY,CAChC,IAAgB,EAChB,IAAqG;IAErG,MAAM,KAAK,GAAG,IAAA,0BAAgB,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAY,yBAAyB,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrH,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAY,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC;AACvE,CAAC;AAEM,KAAK,UAAU,SAAS,CAAC,IAAgB,EAAE,EAAU;IAC1D,OAAO,IAAI,CAAC,GAAG,CAAY,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,wEAAwE;AACjE,KAAK,UAAU,cAAc,CAAC,IAAgB,EAAE,EAAU;IAC/D,OAAO,IAAI,CAAC,IAAI,CAAY,UAAU,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,kFAAkF;AAC3E,KAAK,UAAU,WAAW,CAAC,IAAgB,EAAE,EAAU,EAAE,IAAmC;IACjG,OAAO,IAAI,CAAC,IAAI,CAAY,UAAU,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAClH,CAAC;AASD;;;;GAIG;AACI,KAAK,UAAU,mBAAmB,CAAC,IAAgB,EAAE,QAAwB,EAAE,MAAc;IAClG,MAAM,IAAI,CAAC,GAAG,CAAC,mCAAmC,EAAE;QAClD,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,QAAQ,CAAC,MAAM;QACxB,aAAa,EAAE,QAAQ,CAAC,YAAY;QACpC,aAAa,EAAE,EAAE,MAAM,EAAE;KAC1B,CAAC,CAAC;AACL,CAAC"}

package/dist/migrate/better-auth/orchestrator.d.ts

@@ -1,43 +0,0 @@
-import { type ParsedArgs } from '../../args';
-import type { RunContext } from '../../context';
-import { type Json } from '../../serialize';
-/**
- * `atlas migrate better-auth [path]` — the whole Better Auth → Atlas program as
- * one resumable run:
- *
- *   preflight → translate → apply (review the diff, confirm, config push) →
- *   export (the exporter runs in the app) → import (dry run, confirm, apply) →
- *   bridge (no forced logout) → code (the codemod) → verify (checklist).
- *
- * Each finished step is checkpointed in the state file, so `--resume` carries
- * on where a run stopped (a confirmation declined, an env var missing, the
- * export not run yet). `--dry-run` walks every step without changing the
- * instance or the code; `--yes` answers every confirmation.
- */
-export declare const STEPS: readonly ["preflight", "translate", "apply", "export", "import", "bridge", "code", "verify"];
-export type StepId = (typeof STEPS)[number];
-type StepStatus = 'done' | 'skipped' | 'planned' | 'action_needed' | 'awaiting_confirmation' | 'blocked';
-interface StepRecord {
-    status: StepStatus;
-    at?: number;
-    detail?: Record<string, unknown>;
-    message?: string;
-}
-export interface MigrationState {
-    version: 1;
-    project: string;
-    instance_id: string | null;
-    environment: string | null;
-    started_at: number;
-    steps: Partial<Record<StepId, StepRecord>>;
-}
-/** `${NAME}` placeholders in the config files that the environment does not set. */
-export declare function missingPlaceholders(dir: string, env: NodeJS.ProcessEnv): Set<string>;
-/** Leaves of `desired` that differ from `live` (arrays compare as a whole). */
-export declare function leafDiff(desired: Json, live: Json, prefix?: string): Array<{
-    path: string;
-    from: Json | undefined;
-    to: Json;
-}>;
-export declare function migrateBetterAuth(ctx: RunContext, args: ParsedArgs, projectArg: string | undefined): Promise<number>;
-export {};