@atlasauth/cli 0.24.0 → 0.25.0

package/dist/migrate/nhost/plugin.js

@@ -1,115 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.nhostPlugin = void 0;
-const nhost_1 = require("../export/nhost");
-const nhost_config_1 = require("../export/nhost-config");
-const errors_1 = require("../../errors");
-const plugin_kit_1 = require("../export/plugin-kit");
-const project_files_1 = require("../export/project-files");
-/**
- * `atlas migrate nhost` — an Nhost project (Nhost Cloud or self-hosted Hasura
- * Auth): `nhost/nhost.toml` as Atlas config; users with their bcrypt hashes,
- * social links, security keys, roles, TOTP secrets and live refresh tokens
- * read through the project's GraphQL endpoint with the admin secret (on this
- * machine only) or from a dump of the `auth` schema; the `nhost` bridge preset
- * (a refresh token becomes an Atlas session, matched on the hash Nhost
- * stores); lazy migration for anyone left; and the code.
- */
-const SUBDOMAIN = { flag: '--nhost-subdomain', env: 'NHOST_SUBDOMAIN', label: 'the Nhost Cloud project subdomain', required: false };
-const REGION = { flag: '--nhost-region', env: 'NHOST_REGION', label: 'the Nhost Cloud region (eu-central-1, us-east-1, …)', required: false };
-const GRAPHQL_URL = { flag: '--nhost-graphql-url', env: 'NHOST_GRAPHQL_URL', label: 'the GraphQL endpoint of a self-hosted project (https://graphql.example.com/v1)', required: false };
-const AUTH_URL = { flag: '--nhost-auth-url', env: 'NHOST_AUTH_URL', label: 'the Auth URL of a self-hosted project (https://auth.example.com/v1), for lazy migration', required: false };
-const ADMIN_SECRET = { flag: '--nhost-admin-secret', env: 'NHOST_ADMIN_SECRET', label: 'the Hasura admin secret', required: false, secret: true };
-const DUMP = { flag: '--nhost-dump', env: 'NHOST_DUMP_DIR', label: 'a folder of auth-schema table dumps (users.csv, user_providers.csv, …)', required: false };
-const CONFIG_FILE = { flag: '--nhost-config', env: 'NHOST_CONFIG_TOML', label: 'nhost/nhost.toml', required: false };
-const ENCRYPTION_KEY = { flag: '--nhost-encryption-key', env: 'AUTH_ENCRYPTION_KEY', label: 'AUTH_ENCRYPTION_KEY (64 hex characters), to carry encrypted TOTP secrets', required: false, secret: true };
-const BRIDGE = { flag: '--nhost-bridge', env: 'NHOST_BRIDGE', label: 'what the bridge exchanges: refresh-token (default; the sessions the export imported) or access-token (JWTs signed by Hasura Auth)', required: false };
-const RP_ID = { flag: '--rp-id', env: 'ATLAS_MIGRATE_RP_ID', label: 'the WebAuthn relying party id security keys were registered for', required: false };
-function cloud(p) {
-    const subdomain = p.credential(SUBDOMAIN)?.trim();
-    const region = p.credential(REGION)?.trim();
-    return subdomain && region ? { subdomain, region } : undefined;
-}
-function authUrl(p) {
-    const url = p.credential(AUTH_URL)?.trim().replace(/\/+$/, '');
-    if (url)
-        return url;
-    const c = cloud(p);
-    return c ? `https://${c.subdomain}.auth.${c.region}.nhost.run/v1` : undefined;
-}
-async function readRows(p) {
-    const dump = (0, project_files_1.projectDir)(p, DUMP);
-    if (dump)
-        return { rows: await (0, plugin_kit_1.vendorStep)('Nhost', async () => (0, nhost_1.readNhostDump)(dump)), origin: 'auth schema dump' };
-    const c = cloud(p);
-    const graphqlUrl = p.credential(GRAPHQL_URL)?.trim().replace(/\/+$/, '') ?? (c ? (0, nhost_1.nhostGraphqlUrl)(c) : undefined);
-    const adminSecret = p.credential(ADMIN_SECRET);
-    if (!graphqlUrl || !adminSecret) {
-        throw new errors_1.CliError('Nhost: pass --set nhost-subdomain=… --set nhost-region=… (or --set nhost-graphql-url=… when self-hosted) with --set nhost-admin-secret=…, or a dump of the auth schema with --set nhost-dump=<dir>.');
-    }
-    const rows = await (0, plugin_kit_1.vendorStep)('Nhost', () => (0, nhost_1.fetchNhostRows)({ graphqlUrl, adminSecret, fetchImpl: p.fetch, onProgress: (m) => p.say(`  reading ${m}`) }));
-    return { rows, origin: 'nhost graphql' };
-}
-exports.nhostPlugin = {
-    vendor: 'nhost',
-    source: 'nhost',
-    label: 'Nhost',
-    help: 'Move an Nhost project: nhost.toml auth settings as Atlas config; users with bcrypt hashes, verified email and phone, metadata, roles, social links, security keys, TOTP secrets and live refresh tokens through GraphQL with the admin secret (on this machine) or from an auth-schema dump; a zero-logout bridge on the refresh tokens Nhost already hashes; lazy migration for anyone left; and the code.',
-    config: {
-        reads: 'nhost/nhost.toml',
-        credentials: [CONFIG_FILE, AUTH_URL, SUBDOMAIN, REGION],
-        async translate(p) {
-            const file = (0, project_files_1.projectFile)(p, CONFIG_FILE, ['nhost/nhost.toml', 'nhost.toml']);
-            if (!file)
-                throw new errors_1.CliError('Nhost: no nhost/nhost.toml in this folder. Pass --set nhost-config=<path to nhost.toml>.');
-            return (0, nhost_config_1.translateNhostConfig)(file, { authUrl: authUrl(p) });
-        },
-    },
-    export: {
-        reads: 'the auth schema through the project GraphQL endpoint (admin secret) or a table dump',
-        credentials: [SUBDOMAIN, REGION, GRAPHQL_URL, ADMIN_SECRET, DUMP, ENCRYPTION_KEY, RP_ID],
-        limits: [
-            'Personal access tokens are not exported: reissue them as Atlas API keys.',
-            'TOTP secrets on current Nhost versions are encrypted with AUTH_ENCRYPTION_KEY; without --set nhost-encryption-key those users enrol again.',
-            'Security keys move only with the relying-party id they were registered for (--set rp-id=…, same domain on Atlas).',
-            'Access tokens are short-lived JWTs and are not exported: the bridge exchanges the refresh token instead.',
-        ],
-        async run(p, writer, resume) {
-            const { rows, origin } = await readRows(p);
-            const set = (0, nhost_1.exportNhost)(rows, { encryptionKey: p.credential(ENCRYPTION_KEY), rpId: p.credential(RP_ID)?.trim(), origin });
-            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
-        },
-    },
-    bridge: {
-        preset: 'nhost',
-        presetFor(p) {
-            const mode = (p.credential(BRIDGE) ?? 'refresh-token').trim().toLowerCase();
-            if (mode === 'access-token')
-                return 'nhost_jwt';
-            if (mode !== 'refresh-token')
-                throw new errors_1.CliError(`Nhost: --set nhost-bridge takes refresh-token or access-token (got ${mode}).`);
-            return 'nhost';
-        },
-        vars(p, t) {
-            const vars = { ...t?.bridge?.vars };
-            if (p.credential(BRIDGE)?.trim().toLowerCase() === 'access-token') {
-                const url = authUrl(p);
-                if (url)
-                    vars.auth_url = url;
-            }
-            return vars;
-        },
-    },
-    lazy: {
-        preset: 'nhost',
-        config(p, t) {
-            const config = { ...t?.lazy?.config };
-            const url = authUrl(p);
-            if (url)
-                config.auth_url = url;
-            return config;
-        },
-    },
-    codemod: 'nhost',
-};
-//# sourceMappingURL=plugin.js.map

package/dist/migrate/nhost/plugin.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/nhost/plugin.ts"],"names":[],"mappings":";;;AAAA,2CAA8G;AAC9G,yDAA8D;AAC9D,yCAAwC;AAExC,qDAAkE;AAClE,2DAAkE;AAElE;;;;;;;;GAQG;AAEH,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,mCAAmC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACrJ,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,qDAAqD,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC9J,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,gFAAgF,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACxM,MAAM,QAAQ,GAAmB,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,yFAAyF,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACxM,MAAM,YAAY,GAAmB,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,yBAAyB,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAClK,MAAM,IAAI,GAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,wEAAwE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC/K,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,kBAAkB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACrI,MAAM,cAAc,GAAmB,EAAE,IAAI,EAAE,wBAAwB,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,0EAA0E,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACxN,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,mIAAmI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC5O,MAAM,KAAK,GAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,iEAAiE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAEzK,SAAS,KAAK,CAAC,CAAgB;IAC7B,MAAM,SAAS,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;IAClD,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;IAC5C,OAAO,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACjE,CAAC;AAED,SAAS,OAAO,CAAC,CAAgB;IAC/B,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/D,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IACpB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACnB,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,SAAS,SAAS,CAAC,CAAC,MAAM,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;AAChF,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,CAAgB;IACtC,MAAM,IAAI,GAAG,IAAA,0BAAU,EAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACjC,IAAI,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,IAAA,uBAAU,EAAC,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,IAAA,qBAAa,EAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAClH,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACnB,MAAM,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAA,uBAAe,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACjH,MAAM,WAAW,GAAG,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,EAAE,CAAC;QAChC,MAAM,IAAI,iBAAQ,CAAC,qMAAqM,CAAC,CAAC;IAC5N,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,IAAA,uBAAU,EAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAA,sBAAc,EAAC,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1J,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;AAC3C,CAAC;AAEY,QAAA,WAAW,GAAoB;IAC1C,MAAM,EAAE,OAAO;IACf,MAAM,EAAE,OAAO;IACf,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,6YAA6Y;IACnZ,MAAM,EAAE;QACN,KAAK,EAAE,kBAAkB;QACzB,WAAW,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC;QACvD,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,IAAI,GAAG,IAAA,2BAAW,EAAC,CAAC,EAAE,WAAW,EAAE,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC,CAAC;YAC7E,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,iBAAQ,CAAC,0FAA0F,CAAC,CAAC;YAC1H,OAAO,IAAA,mCAAoB,EAAC,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7D,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,qFAAqF;QAC5F,WAAW,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC;QACxF,MAAM,EAAE;YACN,0EAA0E;YAC1E,4IAA4I;YAC5I,mHAAmH;YACnH,0GAA0G;SAC3G;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,IAAA,mBAAW,EAAC,IAAI,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAC1H,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,OAAO;QACf,SAAS,CAAC,CAAC;YACT,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC5E,IAAI,IAAI,KAAK,cAAc;gBAAE,OAAO,WAAW,CAAC;YAChD,IAAI,IAAI,KAAK,eAAe;gBAAE,MAAM,IAAI,iBAAQ,CAAC,sEAAsE,IAAI,IAAI,CAAC,CAAC;YACjI,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,GAA2B,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC5D,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,cAAc,EAAE,CAAC;gBAClE,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;gBACvB,IAAI,GAAG;oBAAE,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC;YAC/B,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,OAAO;QACf,MAAM,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,MAAM,GAA2B,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9D,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACvB,IAAI,GAAG;gBAAE,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC;YAC/B,OAAO,MAAM,CAAC;QAChB,CAAC;KACF;IACD,OAAO,EAAE,OAAO;CACjB,CAAC"}

package/dist/migrate/oidc/plugin.d.ts

@@ -1,2 +0,0 @@
-import type { MigrationPlugin } from '../framework/plugin';
-export declare const oidcPlugin: MigrationPlugin;

package/dist/migrate/oidc/plugin.js

@@ -1,73 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.oidcPlugin = void 0;
-const errors_1 = require("../../errors");
-const plugin_kit_1 = require("../export/plugin-kit");
-const sso_metadata_1 = require("../export/sso-metadata");
-const translate_kit_1 = require("../export/translate-kit");
-/**
- * `atlas migrate oidc export --set oidc-issuer=https://idp.example.com` — any
- * OpenID Connect provider from its discovery document: an Atlas SSO connection,
- * the JWT bridge preset (the issuer's tokens exchange for Atlas sessions, keys
- * found by discovery) and, when the provider allows the password grant, the
- * lazy-migration preset. Users come from `atlas migrate user-table` / `ldap`.
- */
-const ISSUER = { flag: 'oidc-issuer', env: 'OIDC_ISSUER', label: 'the provider issuer URL (https://idp.example.com/realms/acme)', required: true };
-const CLIENT_ID = { flag: 'oidc-client-id', env: 'OIDC_CLIENT_ID', label: 'the client id Atlas signs in with (and the password grant uses)', required: false };
-const CLIENT_SECRET = { flag: 'oidc-client-secret', env: 'OIDC_CLIENT_SECRET', label: 'the client secret', required: false, secret: true };
-const DOMAINS = { flag: 'oidc-domains', env: 'OIDC_DOMAINS', label: 'email domains that sign in through this provider (comma separated)', required: false };
-async function discover(p) {
-    const issuer = p.credential({ ...ISSUER, required: true });
-    try {
-        return await (0, sso_metadata_1.fetchDiscovery)(p.fetch, issuer);
-    }
-    catch (err) {
-        throw new errors_1.CliError(`OpenID Connect discovery: ${err.message}`);
-    }
-}
-exports.oidcPlugin = {
-    vendor: 'oidc',
-    source: 'oidc',
-    label: 'Any OpenID Connect provider',
-    help: 'Move off a generic OpenID Connect provider: discovery (--set oidc-issuer=…) creates the Atlas SSO connection, the zero-logout bridge accepts the provider\'s tokens (keys found by discovery), and lazy migration uses the password grant when the provider offers it for a client you register. Bring the accounts with atlas migrate user-table (a CSV/JSON export) or atlas migrate ldap.',
-    config: {
-        reads: 'the provider\'s OpenID Connect discovery document',
-        credentials: [ISSUER, CLIENT_ID],
-        async translate(p) {
-            const d = await discover(p);
-            const b = new translate_kit_1.ConfigBuilder();
-            b.add('mapped', 'oidc', d.issuer, 'Becomes an Atlas SSO connection (atlas migrate oidc export + import). Add Atlas\'s redirect URI to the provider\'s client.', 'sso_connections');
-            b.add('mapped', 'oidc', 'jwks_uri', d.jwks_uri ? `Session tokens verify against ${d.jwks_uri} (found by discovery).` : 'The provider publishes no jwks_uri: the bridge cannot verify its tokens.', 'bridge');
-            if (d.grant_types_supported.includes('password'))
-                b.add('differs', 'oidc', 'grant_types_supported password', 'The password grant is offered: lazy migration can check passwords against the provider.', 'legacy_auth_connection');
-            else
-                b.add('manual', 'oidc', 'grant_types_supported', 'The provider does not list the password grant: passwords cannot be checked by lazy migration (users reset, or you export hashes).');
-            const clientId = p.credential(CLIENT_ID);
-            return b.result(`OIDC provider ${d.issuer}`, {
-                bridge: { preset: 'oidc', vars: { issuer: d.issuer } },
-                ...(d.token_endpoint && clientId ? { lazy: { preset: 'oidc', config: { token_endpoint: d.token_endpoint, client_id: clientId, ...(d.userinfo_endpoint ? { userinfo_endpoint: d.userinfo_endpoint } : {}) } } } : {}),
-            });
-        },
-    },
-    export: {
-        reads: 'the provider\'s OpenID Connect discovery document (--set oidc-issuer=…)',
-        credentials: [ISSUER, CLIENT_ID, CLIENT_SECRET, DOMAINS],
-        limits: ['An OpenID Connect provider exposes no user list: bring the accounts with atlas migrate user-table or atlas migrate ldap.'],
-        async run(p, writer, resume) {
-            const d = await discover(p);
-            const domains = (p.credential(DOMAINS) ?? '').split(',').map((x) => x.trim().toLowerCase()).filter(Boolean);
-            const c = (0, sso_metadata_1.oidcConnection)(d, { clientId: p.credential(CLIENT_ID), clientSecret: p.credential(CLIENT_SECRET), domains: domains.length ? domains : undefined });
-            await (0, plugin_kit_1.writeRecordSet)((0, sso_metadata_1.connectionSet)([c], `OIDC provider ${d.issuer}`), writer, resume, p.say);
-        },
-    },
-    bridge: {
-        preset: 'oidc',
-        vars: (p, t) => ({ ...t?.bridge?.vars, issuer: t?.bridge?.vars.issuer ?? p.credential({ ...ISSUER, required: true }) }),
-    },
-    lazy: {
-        preset: 'oidc',
-        config: (p, t) => ({ ...t?.lazy?.config, ...(p.credential(CLIENT_ID) ? { client_id: p.credential(CLIENT_ID) } : {}) }),
-        secret: CLIENT_SECRET,
-    },
-};
-//# sourceMappingURL=plugin.js.map

package/dist/migrate/oidc/plugin.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/oidc/plugin.ts"],"names":[],"mappings":";;;AAAA,yCAAwC;AACxC,qDAAsD;AACtD,yDAAuF;AACvF,2DAAwD;AAGxD;;;;;;GAMG;AAEH,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,+DAA+D,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACnK,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,iEAAiE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC/K,MAAM,aAAa,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC3J,MAAM,OAAO,GAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,oEAAoE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAE5K,KAAK,UAAU,QAAQ,CAAC,CAAgB;IACtC,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAE,CAAC;IAC5D,IAAI,CAAC;QACH,OAAO,MAAM,IAAA,6BAAc,EAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,iBAAQ,CAAC,6BAA8B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAEY,QAAA,UAAU,GAAoB;IACzC,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,MAAM;IACd,KAAK,EAAE,6BAA6B;IACpC,IAAI,EAAE,8XAA8X;IACpY,MAAM,EAAE;QACN,KAAK,EAAE,mDAAmD;QAC1D,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;QAChC,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC5B,MAAM,CAAC,GAAG,IAAI,6BAAa,EAAE,CAAC;YAC9B,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,4HAA4H,EAAE,iBAAiB,CAAC,CAAC;YACnL,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,QAAQ,wBAAwB,CAAC,CAAC,CAAC,0EAA0E,EAAE,QAAQ,CAAC,CAAC;YAC7M,IAAI,CAAC,CAAC,qBAAqB,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,gCAAgC,EAAE,yFAAyF,EAAE,wBAAwB,CAAC,CAAC;;gBAC7N,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,uBAAuB,EAAE,mIAAmI,CAAC,CAAC;YAC3L,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACzC,OAAO,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,MAAM,EAAE,EAAE;gBAC3C,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE;gBACtD,GAAG,CAAC,CAAC,CAAC,cAAc,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrN,CAAC,CAAC;QACL,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,yEAAyE;QAChF,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,CAAC;QACxD,MAAM,EAAE,CAAC,0HAA0H,CAAC;QACpI,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC5B,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC5G,MAAM,CAAC,GAAG,IAAA,6BAAc,EAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;YAC7J,MAAM,IAAA,2BAAc,EAAC,IAAA,4BAAa,EAAC,CAAC,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAC/F,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAE,EAAE,CAAC;KACzH;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,SAAS,CAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACvH,MAAM,EAAE,aAAa;KACtB;CACF,CAAC"}

package/dist/migrate/okta/plugin.d.ts

@@ -1,2 +0,0 @@
-import type { MigrationPlugin } from '../framework/plugin';
-export declare const oktaPlugin: MigrationPlugin;

package/dist/migrate/okta/plugin.js

@@ -1,105 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.oktaPlugin = void 0;
-const okta_1 = require("../export/okta");
-const okta_config_1 = require("../export/okta-config");
-const errors_1 = require("../../errors");
-const plugin_kit_1 = require("../export/plugin-kit");
-const vendor_http_1 = require("../export/vendor-http");
-/**
- * `atlas migrate okta` — Okta Workforce Identity and Okta Customer Identity
- * Solution (the Okta platform; Okta Customer Identity Cloud is Auth0 and uses
- * `atlas migrate auth0`). Users, groups (as roles or organizations), social
- * and enterprise IdP links and factors through the Okta API; Okta never
- * exports password hashes, so passwords move by lazy migration (Classic
- * `/api/v1/authn`, or the password grant on Identity Engine orgs). The `okta`
- * bridge preset verifies access tokens from a custom authorization server.
- */
-const DOMAIN = { flag: '--okta-domain', env: 'OKTA_DOMAIN', label: 'your Okta domain (example.okta.com)', required: true };
-const API_TOKEN = { flag: '--okta-api-token', env: 'OKTA_API_TOKEN', label: 'an Okta API token (read-only admin is enough)', required: true, secret: true };
-const AUTH_SERVER = { flag: '--okta-auth-server', env: 'OKTA_AUTH_SERVER', label: 'the custom authorization server id (default)', required: false };
-const GROUPS_AS = { flag: '--groups-as', env: 'ATLAS_MIGRATE_GROUPS_AS', label: 'how groups move: roles, organizations or skip', required: false };
-const CLIENT_ID = { flag: '--okta-client-id', env: 'OKTA_CLIENT_ID', label: 'the client id of an app with the Resource Owner Password grant (Identity Engine lazy migration)', required: false };
-function domainOf(p) {
-    // OKTA_ORG_URL is what the Okta SDK samples use.
-    const raw = p.credential({ ...DOMAIN, required: false }) ?? p.ctx.env.OKTA_ORG_URL?.trim();
-    if (!raw)
-        return (0, plugin_kit_1.hostOf)((0, plugin_kit_1.need)(p, DOMAIN));
-    return (0, plugin_kit_1.hostOf)(raw);
-}
-function groupsAs(p) {
-    const raw = p.credential(GROUPS_AS) ?? 'roles';
-    if (raw !== 'roles' && raw !== 'organizations' && raw !== 'skip')
-        throw new errors_1.CliError(`Okta: --groups-as must be roles, organizations or skip (got ${raw}).`);
-    return raw;
-}
-exports.oktaPlugin = {
-    vendor: 'okta',
-    source: 'okta',
-    label: 'Okta',
-    help: 'Move an Okta org (Workforce Identity or Customer Identity Solution): applications, identity providers, password and session policy, authenticators and groups as Atlas config; users with their status, profile, social and enterprise links, groups (as roles or organizations) and factors; a zero-logout bridge for access tokens from a custom authorization server; lazy migration for passwords (Okta never exports hashes); and the code. Your API token stays on this machine.',
-    config: {
-        reads: 'your Okta org via the Okta API (apps, IdPs, policies, authenticators, groups, authorization servers)',
-        credentials: [DOMAIN, API_TOKEN],
-        async translate(p) {
-            const domain = domainOf(p);
-            const http = new vendor_http_1.VendorHttp({ vendor: 'Okta', baseUrl: `https://${domain}/api/v1`, headers: { authorization: `SSWS ${(0, plugin_kit_1.need)(p, API_TOKEN)}` }, fetchImpl: p.fetch });
-            const snap = await (0, plugin_kit_1.vendorStep)('Okta', () => (0, okta_config_1.fetchOktaConfig)(http, domain));
-            return (0, okta_config_1.translateOktaConfig)(snap, { groupsAs: groupsAs(p) });
-        },
-    },
-    export: {
-        reads: 'the Okta API (users, groups, identity providers, factors)',
-        credentials: [DOMAIN, API_TOKEN],
-        limits: [
-            'Okta never exports password hashes (neither by API nor through support): every password moves by lazy migration, verified against Okta on the user\'s first Atlas sign-in.',
-            'Factor secrets (TOTP seeds, WebAuthn credentials) are not exportable: users enrol those again. Phone (SMS/voice) and email factors move as Atlas factors; the export counts the rest by type.',
-            'DEPROVISIONED (deactivated) users are left out: they cannot sign in to Okta either.',
-        ],
-        async run(p, writer, resume) {
-            const set = await (0, plugin_kit_1.vendorStep)('Okta', () => (0, okta_1.exportOkta)({
-                domain: domainOf(p),
-                apiToken: (0, plugin_kit_1.need)(p, API_TOKEN),
-                groupsAs: groupsAs(p),
-                factors: (0, plugin_kit_1.flag)(p, 'factors'),
-                authorizationServerId: p.credential(AUTH_SERVER),
-                fetchImpl: p.fetch,
-                onProgress: (m) => p.say(`  reading ${m}`),
-            }));
-            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
-        },
-    },
-    bridge: {
-        preset: 'okta',
-        vars(p, t) {
-            const vars = { ...t?.bridge?.vars };
-            const raw = p.credential({ ...DOMAIN, required: false }) ?? p.ctx.env.OKTA_ORG_URL?.trim();
-            if (raw)
-                vars.domain = (0, plugin_kit_1.hostOf)(raw);
-            const server = p.credential(AUTH_SERVER);
-            if (server)
-                vars.auth_server = server;
-            return vars;
-        },
-    },
-    lazy: {
-        preset: 'okta',
-        config(p, t) {
-            const config = { ...t?.lazy?.config };
-            const raw = p.credential({ ...DOMAIN, required: false }) ?? p.ctx.env.OKTA_ORG_URL?.trim();
-            if (raw)
-                config.domain = (0, plugin_kit_1.hostOf)(raw);
-            // Identity Engine orgs without the Classic authn API: the password grant through an app that allows it.
-            const clientId = p.credential(CLIENT_ID);
-            if (clientId) {
-                config.mode = 'password_grant';
-                config.client_id = clientId;
-                config.auth_server = p.credential(AUTH_SERVER) ?? 'default';
-            }
-            return config;
-        },
-        secret: { flag: '--okta-client-secret', env: 'OKTA_CLIENT_SECRET', label: 'that app\'s client secret (confidential apps, password grant only)', required: false, secret: true },
-    },
-    codemod: 'okta',
-};
-//# sourceMappingURL=plugin.js.map

package/dist/migrate/okta/plugin.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/okta/plugin.ts"],"names":[],"mappings":";;;AAAA,yCAA4C;AAC5C,uDAA6E;AAC7E,yCAAwC;AAExC,qDAAsF;AACtF,uDAAmD;AAEnD;;;;;;;;GAQG;AAEH,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,qCAAqC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC3I,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,+CAA+C,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC5K,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,8CAA8C,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACpK,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,+CAA+C,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACnK,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,iGAAiG,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAEjN,SAAS,QAAQ,CAAC,CAAgB;IAChC,iDAAiD;IACjD,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;IAC3F,IAAI,CAAC,GAAG;QAAE,OAAO,IAAA,mBAAM,EAAC,IAAA,iBAAI,EAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IACzC,OAAO,IAAA,mBAAM,EAAC,GAAG,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,QAAQ,CAAC,CAAgB;IAChC,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC;IAC/C,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,eAAe,IAAI,GAAG,KAAK,MAAM;QAAE,MAAM,IAAI,iBAAQ,CAAC,+DAA+D,GAAG,IAAI,CAAC,CAAC;IAC7J,OAAO,GAAG,CAAC;AACb,CAAC;AAEY,QAAA,UAAU,GAAoB;IACzC,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,MAAM;IACd,KAAK,EAAE,MAAM;IACb,IAAI,EAAE,wdAAwd;IAC9d,MAAM,EAAE;QACN,KAAK,EAAE,sGAAsG;QAC7G,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;QAChC,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,IAAI,GAAG,IAAI,wBAAU,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,MAAM,SAAS,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,QAAQ,IAAA,iBAAI,EAAC,CAAC,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YACnK,MAAM,IAAI,GAAG,MAAM,IAAA,uBAAU,EAAC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAA,6BAAe,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YAC3E,OAAO,IAAA,iCAAmB,EAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9D,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,2DAA2D;QAClE,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;QAChC,MAAM,EAAE;YACN,4KAA4K;YAC5K,+LAA+L;YAC/L,qFAAqF;SACtF;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,MAAM,EAAE,GAAG,EAAE,CACxC,IAAA,iBAAU,EAAC;gBACT,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;gBACnB,QAAQ,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,SAAS,CAAC;gBAC5B,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;gBACrB,OAAO,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,SAAS,CAAC;gBAC3B,qBAAqB,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC;gBAChD,SAAS,EAAE,CAAC,CAAC,KAAK;gBAClB,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;aAC3C,CAAC,CACH,CAAC;YACF,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,MAAM;QACd,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,GAA2B,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC5D,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;YAC3F,IAAI,GAAG;gBAAE,IAAI,CAAC,MAAM,GAAG,IAAA,mBAAM,EAAC,GAAG,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YACzC,IAAI,MAAM;gBAAE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,MAAM;QACd,MAAM,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,MAAM,GAA2B,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9D,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;YAC3F,IAAI,GAAG;gBAAE,MAAM,CAAC,MAAM,GAAG,IAAA,mBAAM,EAAC,GAAG,CAAC,CAAC;YACrC,wGAAwG;YACxG,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,GAAG,gBAAgB,CAAC;gBAC/B,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC;gBAC5B,MAAM,CAAC,WAAW,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC;YAC9D,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,oEAAoE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE;KAChL;IACD,OAAO,EAAE,MAAM;CAChB,CAAC"}

package/dist/migrate/onelogin/plugin.d.ts

@@ -1,2 +0,0 @@
-import type { MigrationPlugin } from '../framework/plugin';
-export declare const oneLoginPlugin: MigrationPlugin;

package/dist/migrate/onelogin/plugin.js

@@ -1,61 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.oneLoginPlugin = void 0;
-const onelogin_1 = require("../export/onelogin");
-const plugin_kit_1 = require("../export/plugin-kit");
-const translate_kit_1 = require("../export/translate-kit");
-/**
- * `atlas migrate onelogin` — a OneLogin account: users and roles through API
- * v2 with API credentials on this machine, the `onelogin` bridge preset
- * (OIDC v2 tokens verified against the account's keys) and lazy migration
- * through OneLogin's session-login-token API (OneLogin never exports hashes).
- */
-const SUBDOMAIN = { flag: 'onelogin-subdomain', env: 'ONELOGIN_SUBDOMAIN', label: 'your OneLogin subdomain (acme for acme.onelogin.com)', required: true };
-const CLIENT_ID = { flag: 'onelogin-client-id', env: 'ONELOGIN_CLIENT_ID', label: 'an API credential client id', required: true };
-const CLIENT_SECRET = { flag: 'onelogin-client-secret', env: 'ONELOGIN_CLIENT_SECRET', label: 'the API credential client secret', required: true, secret: true };
-const subdomain = (p) => (0, onelogin_1.oneLoginSubdomain)((0, plugin_kit_1.need)(p, SUBDOMAIN));
-exports.oneLoginPlugin = {
-    vendor: 'onelogin',
-    source: 'onelogin',
-    label: 'OneLogin',
-    help: 'Move a OneLogin account: users with their login, email, name, phone, status (suspended and locked carry over) and custom attributes, roles as app roles, a zero-logout bridge for OneLogin OIDC tokens, and lazy migration for passwords (OneLogin never exports hashes). Your API credentials stay on this machine. Apps connected through OneLogin\'s SAML / OIDC are moved with atlas migrate saml / oidc using the app\'s metadata.',
-    config: {
-        reads: 'your OneLogin subdomain (the API exposes no policy settings to read)',
-        credentials: [SUBDOMAIN],
-        async translate(p) {
-            const sub = subdomain(p);
-            const b = new translate_kit_1.ConfigBuilder();
-            b.set('strategies.password', true);
-            b.add('differs', 'authentication', 'password', 'OneLogin never exports password hashes: the onelogin lazy-migration preset checks each password against OneLogin on first sign-in.', 'auth_config.strategies.password');
-            b.add('manual', 'security policies', 'user security policies (password, MFA, session)', 'The OneLogin API does not expose security policies: read them in the admin portal and set Atlas\'s passwordPolicy, MFA policy and session lifetimes in auth_config.');
-            b.add('manual', 'apps', 'SAML / OIDC connectors', 'Download each app\'s metadata and move it with atlas migrate saml export (or oidc export).');
-            return b.result(`OneLogin account ${sub}.onelogin.com`, {
-                bridge: { preset: 'onelogin', vars: { subdomain: sub } },
-                lazy: { preset: 'onelogin', config: { subdomain: sub, client_id: (0, plugin_kit_1.need)(p, CLIENT_ID) } },
-            });
-        },
-    },
-    export: {
-        reads: 'your OneLogin account through API v2 (users, roles)',
-        credentials: [SUBDOMAIN, CLIENT_ID, CLIENT_SECRET],
-        limits: [
-            'Password hashes are never exported by OneLogin: passwords move by lazy migration (preset onelogin).',
-            'MFA secrets cannot be exported: users enrol their second factor again.',
-            'OneLogin does not say which addresses were confirmed: they import unverified.',
-        ],
-        async run(p, writer, resume) {
-            const set = await (0, plugin_kit_1.vendorStep)('OneLogin', () => (0, onelogin_1.exportOneLogin)({ subdomain: (0, plugin_kit_1.need)(p, SUBDOMAIN), clientId: (0, plugin_kit_1.need)(p, CLIENT_ID), clientSecret: (0, plugin_kit_1.need)(p, CLIENT_SECRET), fetchImpl: p.fetch, onProgress: (m) => p.say(`  reading ${m}`) }));
-            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
-        },
-    },
-    bridge: {
-        preset: 'onelogin',
-        vars: (p, t) => ({ subdomain: subdomain(p), ...t?.bridge?.vars }),
-    },
-    lazy: {
-        preset: 'onelogin',
-        config: (p, t) => ({ subdomain: subdomain(p), client_id: (0, plugin_kit_1.need)(p, CLIENT_ID), ...t?.lazy?.config }),
-        secret: CLIENT_SECRET,
-    },
-};
-//# sourceMappingURL=plugin.js.map

package/dist/migrate/onelogin/plugin.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/onelogin/plugin.ts"],"names":[],"mappings":";;;AAAA,iDAAuE;AACvE,qDAAwE;AACxE,2DAAwD;AAGxD;;;;;GAKG;AAEH,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,sDAAsD,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC3K,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,6BAA6B,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAClJ,MAAM,aAAa,GAAmB,EAAE,IAAI,EAAE,wBAAwB,EAAE,GAAG,EAAE,wBAAwB,EAAE,KAAK,EAAE,kCAAkC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAEjL,MAAM,SAAS,GAAG,CAAC,CAAgB,EAAE,EAAE,CAAC,IAAA,4BAAiB,EAAC,IAAA,iBAAI,EAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;AAEjE,QAAA,cAAc,GAAoB;IAC7C,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,UAAU;IAClB,KAAK,EAAE,UAAU;IACjB,IAAI,EAAE,yaAAya;IAC/a,MAAM,EAAE;QACN,KAAK,EAAE,sEAAsE;QAC7E,WAAW,EAAE,CAAC,SAAS,CAAC;QACxB,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,CAAC,GAAG,IAAI,6BAAa,EAAE,CAAC;YAC9B,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;YACnC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,gBAAgB,EAAE,UAAU,EAAE,oIAAoI,EAAE,iCAAiC,CAAC,CAAC;YACxN,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,mBAAmB,EAAE,iDAAiD,EAAE,qKAAqK,CAAC,CAAC;YAC/P,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,wBAAwB,EAAE,4FAA4F,CAAC,CAAC;YAChJ,OAAO,CAAC,CAAC,MAAM,CAAC,oBAAoB,GAAG,eAAe,EAAE;gBACtD,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE;gBACxD,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,SAAS,CAAC,EAAE,EAAE;aACxF,CAAC,CAAC;QACL,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,qDAAqD;QAC5D,WAAW,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,aAAa,CAAC;QAClD,MAAM,EAAE;YACN,qGAAqG;YACrG,wEAAwE;YACxE,+EAA+E;SAChF;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,UAAU,EAAE,GAAG,EAAE,CAC5C,IAAA,yBAAc,EAAC,EAAE,SAAS,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,aAAa,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC,CACtL,CAAC;YACF,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,UAAU;QAClB,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;KAClE;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,UAAU;QAClB,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAClG,MAAM,EAAE,aAAa;KACtB;CACF,CAAC"}

package/dist/migrate/ory/plugin.d.ts

@@ -1,2 +0,0 @@
-import type { MigrationPlugin } from '../framework/plugin';
-export declare const oryPlugin: MigrationPlugin;

package/dist/migrate/ory/plugin.js

@@ -1,186 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.oryPlugin = void 0;
-const node_path_1 = require("node:path");
-const errors_1 = require("../../errors");
-const ory_1 = require("../export/ory");
-const ory_config_1 = require("../export/ory-config");
-const tables_1 = require("../export/frameworks/tables");
-const plugin_kit_1 = require("../export/plugin-kit");
-const vendor_http_1 = require("../export/vendor-http");
-/**
- * `atlas migrate ory` — Ory Kratos and Hydra, self-hosted or on Ory Network:
- * the Kratos config (kratos.yml, or `ory get project` JSON), identity schemas
- * and Hydra's config and OAuth 2.0 clients as Atlas config; identities with
- * their verified addresses, social links, metadata and — from a database dump —
- * password hashes in every format Kratos verifies, TOTP seeds, recovery codes,
- * WebAuthn / passkey credentials and live session tokens; a zero-logout
- * bridge (Kratos vouches for the session, or imported session tokens); lazy
- * migration through Kratos' login flow; and the code. Credentials stay on this
- * machine. Ory Network has no database access and its Admin API returns no
- * hashes, seeds or session tokens: those users move by lazy migration and
- * enrol their second factor again.
- */
-const ADMIN_URL = { flag: '--ory-admin-url', env: 'ORY_ADMIN_URL', label: 'the Kratos admin URL (http://kratos:4434) or your Ory Network project URL', required: false };
-const PUBLIC_URL = { flag: '--ory-public-url', env: 'ORY_PUBLIC_URL', label: 'the Kratos public URL (https://auth.example.com, or https://<slug>.projects.oryapis.com)', required: false };
-const API_KEY = { flag: '--ory-api-key', env: 'ORY_API_KEY', label: 'an Ory Network project API key (ory_pat_…)', required: false, secret: true };
-const DUMP = { flag: '--ory-dump', env: 'ORY_DUMP_DIR', label: 'a folder of Kratos table dumps (identities.csv, identity_credentials.csv, …)', required: false };
-const RP_ID = { flag: '--ory-rp-id', env: 'ORY_RP_ID', label: 'the WebAuthn relying-party id passkeys were registered for (rp.id in kratos.yml)', required: false };
-const NID = { flag: '--ory-nid', env: 'ORY_NID', label: 'the project (nid) to export from a multi-project database', required: false };
-const CONFIG_FILE = { flag: '--ory-config', env: 'ORY_CONFIG', label: 'kratos.yml, or the JSON of `ory get project <id> --format json`', required: false };
-const HYDRA_CONFIG = { flag: '--ory-hydra-config', env: 'ORY_HYDRA_CONFIG', label: 'hydra.yml', required: false };
-const HYDRA_URL = { flag: '--ory-hydra-url', env: 'ORY_HYDRA_URL', label: 'the Hydra admin URL (http://hydra:4445), to read OAuth 2.0 clients', required: false };
-const BRIDGE_MODE = {
-    flag: '--ory-bridge',
-    env: 'ORY_BRIDGE',
-    label: 'what the bridge accepts: whoami-cookie (default when the public URL is known), whoami-token (X-Session-Token / Bearer tokens checked with Kratos) or session-token (tokens imported with a database export)',
-    required: false,
-};
-const COOKIE_NAME = { flag: '--ory-cookie-name', env: 'ORY_COOKIE_NAME', label: 'the session cookie name (ory_kratos_session; ory_session_<slug> on Ory Network)', required: false };
-const EMAIL_TRAIT = { flag: '--ory-email-trait', env: 'ORY_EMAIL_TRAIT', label: 'the identity trait holding the email address (default email), for lazy migration', required: false };
-const NETWORK = /\.projects\.oryapis\.com$|\.oryapis\.com$/i;
-const isNetwork = (url) => !!url && NETWORK.test((0, plugin_kit_1.hostOf)(url).replace(/:\d+$/, ''));
-/** `https://…` with no trailing slash; a bare host gets https. */
-function baseUrl(raw) {
-    const s = raw.trim().replace(/\/+$/, '');
-    return /^https?:\/\//.test(s) ? s : `https://${s}`;
-}
-const PRESETS = { 'whoami-cookie': 'ory_whoami', 'whoami-token': 'ory_whoami_token', 'session-token': 'ory' };
-function publicUrl(p, t) {
-    const admin = p.credential(ADMIN_URL);
-    const raw = p.credential(PUBLIC_URL) ?? (isNetwork(admin) ? admin : undefined) ?? t?.bridge?.vars.base_url ?? t?.lazy?.config.base_url;
-    return raw ? baseUrl(raw) : undefined;
-}
-function bridgeMode(p, hasPublicUrl) {
-    const raw = p.credential(BRIDGE_MODE)?.trim().toLowerCase();
-    if (!raw)
-        return hasPublicUrl ? 'whoami-cookie' : 'session-token';
-    if (raw === 'whoami-cookie' || raw === 'whoami-token' || raw === 'session-token')
-        return raw;
-    throw new errors_1.CliError(`Ory: --set ory-bridge takes whoami-cookie, whoami-token or session-token (got ${raw}).`);
-}
-/** The preset the last `bridge.vars` call chose (the framework reads `vars` first, then `preset`). */
-let chosenPreset = 'ory';
-exports.oryPlugin = {
-    vendor: 'ory',
-    source: 'ory',
-    label: 'Ory (Kratos, Hydra, Ory Network)',
-    help: 'Move Ory Kratos and Hydra (self-hosted or Ory Network): kratos.yml, identity schemas, Hydra settings and OAuth 2.0 clients as Atlas config; identities with verified addresses, social links and metadata through the Admin API, plus password hashes, TOTP seeds, recovery codes, passkeys and session tokens from a database dump; a zero-logout bridge where Kratos vouches for the session; lazy migration through the Kratos login flow; and the code. Credentials stay on this machine.',
-    config: {
-        reads: 'kratos.yml or `ory get project` JSON, hydra.yml, the identity schemas, and the Hydra Admin API (OAuth 2.0 clients)',
-        credentials: [CONFIG_FILE, HYDRA_CONFIG, PUBLIC_URL, HYDRA_URL, ADMIN_URL, API_KEY],
-        async translate(p) {
-            const warnings = [];
-            let kratos;
-            let hydra;
-            const read = (path) => {
-                try {
-                    return (0, ory_config_1.parseOryConfig)(p.ctx.readFile((0, node_path_1.resolve)(path)), path);
-                }
-                catch (err) {
-                    throw new errors_1.CliError(`Ory: could not read ${path}: ${err.message}`);
-                }
-            };
-            const configPath = p.credential(CONFIG_FILE);
-            if (configPath) {
-                const parsed = read(configPath);
-                const project = (0, ory_config_1.splitOryProject)(parsed);
-                kratos = project?.kratos ?? parsed;
-                hydra = project?.hydra;
-            }
-            const hydraPath = p.credential(HYDRA_CONFIG);
-            if (hydraPath)
-                hydra = read(hydraPath);
-            let schemas = (0, ory_config_1.resolveOrySchemas)(kratos, (path) => p.ctx.readFile(path), (m) => warnings.push(m));
-            const url = p.credential(PUBLIC_URL) ?? (isNetwork(p.credential(ADMIN_URL)) ? p.credential(ADMIN_URL) : undefined);
-            const apiKey = p.credential(API_KEY);
-            const headers = apiKey ? { authorization: `Bearer ${apiKey}` } : undefined;
-            if (url && !schemas.length) {
-                const http = new vendor_http_1.VendorHttp({ vendor: 'Ory', baseUrl: baseUrl(url), headers, fetchImpl: p.fetch });
-                schemas = await (0, plugin_kit_1.vendorStep)('Ory', () => (0, ory_config_1.fetchOrySchemas)(http));
-            }
-            let clients = [];
-            const admin = p.credential(ADMIN_URL);
-            const hydraUrl = p.credential(HYDRA_URL) ?? (isNetwork(admin) ? admin : isNetwork(url) ? url : undefined);
-            if (hydraUrl) {
-                const http = new vendor_http_1.VendorHttp({ vendor: 'Ory Hydra', baseUrl: baseUrl(hydraUrl), headers, fetchImpl: p.fetch });
-                clients = await (0, plugin_kit_1.vendorStep)('Ory Hydra', () => (0, ory_config_1.fetchOryClients)(http));
-            }
-            if (!kratos && !hydra && !schemas.length && !clients.length) {
-                throw new errors_1.CliError('Ory: nothing to read. Pass kratos.yml (--set ory-config=<file>), an Ory Network project JSON, a public URL (--set ory-public-url=…) or the Hydra admin URL (--set ory-hydra-url=…).');
-            }
-            for (const w of warnings)
-                p.say(`  ${w}`);
-            const origin = configPath ?? (url ? `Ory ${(0, plugin_kit_1.hostOf)(url)}` : hydraPath ?? `Ory Hydra ${(0, plugin_kit_1.hostOf)(hydraUrl ?? '')}`);
-            return (0, ory_config_1.translateOryConfig)({ origin, kratos, hydra, schemas, clients, publicUrl: url ? baseUrl(url) : undefined });
-        },
-    },
-    export: {
-        reads: 'a dump of the Kratos database (identities, identity_credentials, identity_verifiable_addresses, sessions) or the Kratos Admin API',
-        credentials: [DUMP, ADMIN_URL, API_KEY, RP_ID, NID],
-        limits: [
-            'Password hashes, TOTP seeds, recovery codes, WebAuthn credentials and session tokens live only in the database: dump it (see the guide). The Admin API returns none of them, so those users move by lazy migration and enrol their second factor again.',
-            'Ory Network has no database access: its identities export through the Admin API with a project API key, passwords move by lazy migration and the bridge asks Ory to vouch for the session.',
-            'Hash formats Atlas cannot verify (for example $hmac-md4$) are left out and those users move by lazy migration.',
-            'Passkeys and security keys need the relying-party id (--set ory-rp-id) and keep working only when Atlas serves sign-in on that domain.',
-            'Ory Network organizations (enterprise SSO) and Hydra consent grants are not exported: recreate SSO connections in Atlas; users consent again.',
-        ],
-        async run(p, writer, resume) {
-            const dump = p.credential(DUMP);
-            const rpId = p.credential(RP_ID);
-            const rawAdmin = p.credential(ADMIN_URL) ?? (isNetwork(p.credential(PUBLIC_URL)) ? p.credential(PUBLIC_URL) : undefined);
-            let set;
-            if (dump) {
-                set = await (0, plugin_kit_1.vendorStep)('Ory', async () => (0, ory_1.exportOryTables)((0, tables_1.readDumpDir)((0, node_path_1.resolve)(dump)), { rpId, networkId: p.credential(NID) }));
-            }
-            else if (rawAdmin) {
-                const apiKey = p.credential(API_KEY);
-                if (isNetwork(rawAdmin) && !apiKey)
-                    throw new errors_1.CliError('Ory Network: pass a project API key (--set ory-api-key=ory_pat_… or ORY_API_KEY).');
-                set = await (0, plugin_kit_1.vendorStep)('Ory', () => (0, ory_1.exportOryApi)({ adminUrl: rawAdmin, apiKey, rpId, fetchImpl: p.fetch, onProgress: (m) => p.say(`  reading ${m}`) }));
-            }
-            else {
-                throw new errors_1.CliError('Ory: pass a folder of Kratos table dumps (--set ory-dump=<folder>), or the admin URL (--set ory-admin-url=…) for an Admin API export without password hashes.');
-            }
-            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
-        },
-    },
-    bridge: {
-        get preset() {
-            return chosenPreset;
-        },
-        vars(p, t) {
-            const vars = { ...t?.bridge?.vars };
-            const url = publicUrl(p, t);
-            const mode = bridgeMode(p, !!url);
-            chosenPreset = PRESETS[mode];
-            if (mode === 'session-token')
-                return {};
-            if (!url)
-                throw new errors_1.CliError('Ory: the whoami bridge calls Kratos: pass its public URL (--set ory-public-url=https://auth.example.com).');
-            vars.base_url = url;
-            if (mode === 'whoami-cookie') {
-                const slug = /^https:\/\/([a-z0-9-]+)\.projects\.oryapis\.com/i.exec(url)?.[1];
-                vars.cookie_name = p.credential(COOKIE_NAME)?.trim() ?? vars.cookie_name ?? (slug ? `ory_session_${slug}` : 'ory_kratos_session');
-            }
-            else
-                delete vars.cookie_name;
-            return vars;
-        },
-    },
-    lazy: {
-        preset: 'ory',
-        config(p, t) {
-            const config = { ...t?.lazy?.config };
-            const url = publicUrl(p, t);
-            if (url)
-                config.base_url = url;
-            const trait = p.credential(EMAIL_TRAIT);
-            if (trait)
-                config.email_trait = trait.trim();
-            return config;
-        },
-    },
-    codemod: 'ory',
-};
-//# sourceMappingURL=plugin.js.map

package/dist/migrate/ory/plugin.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/ory/plugin.ts"],"names":[],"mappings":";;;AAAA,yCAAoC;AACpC,yCAAwC;AACxC,uCAA8D;AAC9D,qDAA4L;AAC5L,wDAA0D;AAE1D,qDAA0E;AAC1E,uDAAmD;AAGnD;;;;;;;;;;;;GAYG;AAEH,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,2EAA2E,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACzL,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,0FAA0F,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC3M,MAAM,OAAO,GAAmB,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,4CAA4C,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAClK,MAAM,IAAI,GAAmB,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,8EAA8E,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACjL,MAAM,KAAK,GAAmB,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,kFAAkF,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACpL,MAAM,GAAG,GAAmB,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,2DAA2D,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACvJ,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,iEAAiE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC3K,MAAM,YAAY,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAClI,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,oEAAoE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAClL,MAAM,WAAW,GAAmB;IAClC,IAAI,EAAE,cAAc;IACpB,GAAG,EAAE,YAAY;IACjB,KAAK,EAAE,6MAA6M;IACpN,QAAQ,EAAE,KAAK;CAChB,CAAC;AACF,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,iFAAiF,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACrM,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,kFAAkF,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAEtM,MAAM,OAAO,GAAG,4CAA4C,CAAC;AAE7D,MAAM,SAAS,GAAG,CAAC,GAAuB,EAAW,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,IAAA,mBAAM,EAAC,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAEhH,kEAAkE;AAClE,SAAS,OAAO,CAAC,GAAW;IAC1B,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzC,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;AACrD,CAAC;AAGD,MAAM,OAAO,GAA+B,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;AAE1I,SAAS,SAAS,CAAC,CAAgB,EAAE,CAA4F;IAC/H,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC;IACvI,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACxC,CAAC;AAED,SAAS,UAAU,CAAC,CAAgB,EAAE,YAAqB;IACzD,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5D,IAAI,CAAC,GAAG;QAAE,OAAO,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC;IAClE,IAAI,GAAG,KAAK,eAAe,IAAI,GAAG,KAAK,cAAc,IAAI,GAAG,KAAK,eAAe;QAAE,OAAO,GAAG,CAAC;IAC7F,MAAM,IAAI,iBAAQ,CAAC,iFAAiF,GAAG,IAAI,CAAC,CAAC;AAC/G,CAAC;AAED,sGAAsG;AACtG,IAAI,YAAY,GAAG,KAAK,CAAC;AAEZ,QAAA,SAAS,GAAoB;IACxC,MAAM,EAAE,KAAK;IACb,MAAM,EAAE,KAAK;IACb,KAAK,EAAE,kCAAkC;IACzC,IAAI,EAAE,+dAA+d;IACre,MAAM,EAAE;QACN,KAAK,EAAE,oHAAoH;QAC3H,WAAW,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC;QACnF,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,IAAI,MAAiC,CAAC;YACtC,IAAI,KAAgC,CAAC;YACrC,MAAM,IAAI,GAAG,CAAC,IAAY,EAAiB,EAAE;gBAC3C,IAAI,CAAC;oBACH,OAAO,IAAA,2BAAc,EAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;gBAC7D,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,IAAI,iBAAQ,CAAC,uBAAuB,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC/E,CAAC;YACH,CAAC,CAAC;YACF,MAAM,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YAC7C,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;gBAChC,MAAM,OAAO,GAAG,IAAA,4BAAe,EAAC,MAAM,CAAC,CAAC;gBACxC,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,MAAM,CAAC;gBACnC,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC;YACzB,CAAC;YACD,MAAM,SAAS,GAAG,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;YAC7C,IAAI,SAAS;gBAAE,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;YAEvC,IAAI,OAAO,GAAwB,IAAA,8BAAiB,EAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACtH,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACnH,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACrC,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3E,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAAG,IAAI,wBAAU,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;gBACnG,OAAO,GAAG,MAAM,IAAA,uBAAU,EAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAA,4BAAe,EAAC,IAAI,CAAC,CAAC,CAAC;YACjE,CAAC;YACD,IAAI,OAAO,GAAU,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACtC,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC1G,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,IAAI,GAAG,IAAI,wBAAU,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC9G,OAAO,GAAG,MAAM,IAAA,uBAAU,EAAC,WAAW,EAAE,GAAG,EAAE,CAAC,IAAA,4BAAe,EAAC,IAAI,CAAC,CAAC,CAAC;YACvE,CAAC;YACD,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBAC5D,MAAM,IAAI,iBAAQ,CAAC,qLAAqL,CAAC,CAAC;YAC5M,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,QAAQ;gBAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,UAAU,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,IAAA,mBAAM,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,aAAa,IAAA,mBAAM,EAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;YAC/G,OAAO,IAAA,+BAAkB,EAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QACpH,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,mIAAmI;QAC1I,WAAW,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC;QACnD,MAAM,EAAE;YACN,yPAAyP;YACzP,4LAA4L;YAC5L,gHAAgH;YAChH,wIAAwI;YACxI,+IAA+I;SAChJ;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAChC,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACzH,IAAI,GAAc,CAAC;YACnB,IAAI,IAAI,EAAE,CAAC;gBACT,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,IAAA,qBAAe,EAAC,IAAA,oBAAW,EAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YACjI,CAAC;iBAAM,IAAI,QAAQ,EAAE,CAAC;gBACpB,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBACrC,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,iBAAQ,CAAC,mFAAmF,CAAC,CAAC;gBAC5I,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAA,kBAAY,EAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAC1J,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,iBAAQ,CAAC,+JAA+J,CAAC,CAAC;YACtL,CAAC;YACD,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,IAAI,MAAM;YACR,OAAO,YAAY,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,GAA2B,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC5D,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5B,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;YAClC,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,IAAI,KAAK,eAAe;gBAAE,OAAO,EAAE,CAAC;YACxC,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,iBAAQ,CAAC,2GAA2G,CAAC,CAAC;YAC1I,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC;YACpB,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;gBAC7B,MAAM,IAAI,GAAG,kDAAkD,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC/E,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC;YACpI,CAAC;;gBAAM,OAAO,IAAI,CAAC,WAAW,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,KAAK;QACb,MAAM,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,MAAM,GAA2B,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9D,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5B,IAAI,GAAG;gBAAE,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC;YAC/B,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YACxC,IAAI,KAAK;gBAAE,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;YAC7C,OAAO,MAAM,CAAC;QAChB,CAAC;KACF;IACD,OAAO,EAAE,KAAK;CACf,CAAC"}